From 8835a24a56089e90953af7f2a79363fcccd7f97c Mon Sep 17 00:00:00 2001 From: Binbin Wu Date: Tue, 9 Jun 2026 15:57:48 +0800 Subject: [PATCH] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf Pass the CPUID index into cpuid_func_emulated() and return no emulated features for indexed CPUID leaves with a non-zero index. KVM currently emulates CPUID features only for index 0, but kvm_vcpu_after_set_cpuid() looks up emulated features by function alone. As a result, reverse_cpuid[] entries that share a function but use a non-zero index, e.g. CPUID.7.1:ECX, can inherit emulated features that belong to index 0. For example, RDPID, which is CPUID.7.0:ECX[22], can be incorrectly OR'd into CPUID.7.1:ECX. This is benign today because the affected bits do not correspond to features KVM cares about, but it can become a real bug as new CPUID features are defined. Make the helper index-aware so emulated features are applied only to the CPUID entry they actually describe. Fixes: e592ec657d84 ("KVM: x86: Initialize guest cpu_caps based on KVM support") Suggested-by: Sean Christopherson Signed-off-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20260609075748.612704-1-binbin.wu@linux.intel.com Signed-off-by: Sean Christopherson --- arch/x86/kvm/cpuid.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 2698fa42cd97..f402a5dc4390 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -370,7 +370,7 @@ static u32 cpuid_get_reg_unsafe(struct kvm_cpuid_entry2 *entry, u32 reg) } } -static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, +static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, u32 index, bool include_partially_emulated); void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu) @@ -400,7 +400,7 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu) if (!entry) continue; - cpuid_func_emulated(&emulated, cpuid.function, true); + cpuid_func_emulated(&emulated, cpuid.function, cpuid.index, true); /* * A vCPU has a feature if it's supported by KVM and is enabled @@ -1369,11 +1369,15 @@ static struct kvm_cpuid_entry2 *do_host_cpuid(struct kvm_cpuid_array *array, return entry; } -static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, +static int cpuid_func_emulated(struct kvm_cpuid_entry2 *entry, u32 func, u32 index, bool include_partially_emulated) { memset(entry, 0, sizeof(*entry)); + /* KVM doesn't currently emulate any non-zero indices. */ + if (cpuid_function_is_indexed(func) && index) + return 0; + entry->function = func; entry->index = 0; entry->flags = 0; @@ -1411,7 +1415,7 @@ static int __do_cpuid_func_emulated(struct kvm_cpuid_array *array, u32 func) if (array->nent >= array->maxnent) return -E2BIG; - array->nent += cpuid_func_emulated(&array->entries[array->nent], func, false); + array->nent += cpuid_func_emulated(&array->entries[array->nent], func, 0, false); return 0; }