Re: [RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 4/17/2026 3:35 PM, Binbin Wu wrote:
> Guard the use of cpuid_func_emulated() with a check that the CPUID
> sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
> emulated features for index 0 and does not account for indexed leaves.
> 
> Without the guard, when iterating over reverse_cpuid[] entries that
> share the same CPUID function but have a non-zero index, e.g.
> CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
> are incorrectly OR'd into the wrong capability word.  For example,
> RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
> which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
> capabilities.
> 
> This is currently benign as the affected bits in the non-zero index
> words happen to not correspond to meaningful features, but it could
> cause problems as new features are defined in those positions.
> 
> Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
> ---
>   arch/x86/kvm/cpuid.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index e69156b54cff..25f582a8d795 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
> @@ -399,15 +399,16 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
>   		if (!entry)
>   			continue;
>   
> -		cpuid_func_emulated(&emulated, cpuid.function, true);
> -
>   		/*
>   		 * A vCPU has a feature if it's supported by KVM and is enabled
>   		 * in guest CPUID.  Note, this includes features that are
>   		 * supported by KVM but aren't advertised to userspace!
>   		 */
> -		vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i] |
> -					 cpuid_get_reg_unsafe(&emulated, cpuid.reg);
> +		vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i];
> +		if (!cpuid.index) {

Instead of such a temporary fix, I would prefer adding the index 
parameter to cpuid_func_emulated() and split this patch separately.

> +			cpuid_func_emulated(&emulated, cpuid.function, true);
> +			vcpu->arch.cpu_caps[i] |= cpuid_get_reg_unsafe(&emulated, cpuid.reg);
> +		}
>   		vcpu->arch.cpu_caps[i] &= cpuid_get_reg_unsafe(entry, cpuid.reg);
>   	}
>