From nobody Sun Jul 26 11:01:48 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1782996822; cv=none; d=zohomail.com; s=zohoarc; b=EucFii3HIjYZNeOAsHnNaliERIqU1z0LMI0IW3ZOBkq+cbD2n7asZWJB49CthemtQKc+TEyypti1REP1ji5uuD6IX5igr2WWCaHfEEy/rzhmkDAKtOThPu6yh7NfIVwMMqR/qrfjWcIy7AeEPeNUARH04ARjebzJswlnY3rr1WE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782996822; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bq8uv8/M+d7V425XxI+caQVZ9sYvYXSUIzrNxIYMxWA=; b=meMIy0+2Yz+YUeIERHXYBhtz2OxbtvXim/d+aHQOGSAWkzvmaGcOL4YIqUzCKGk9mzbZwN0LNwnymoUsnPx9Oa8dMLG9f9Lc7xD15J79aOkb6qQ2DzQCOVGx+GZllfp01ApMTpfH2pUDzsTMcqCOiRy7S31XhgosFGeuW7qy91g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782996822758329.0777981316336; Thu, 2 Jul 2026 05:53:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wfGut-0002M0-Az; Thu, 02 Jul 2026 08:53:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wfGur-0002La-G2 for qemu-devel@nongnu.org; Thu, 02 Jul 2026 08:53:17 -0400 Received: from linux.microsoft.com ([13.77.154.182]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wfGup-0007ld-TA for qemu-devel@nongnu.org; Thu, 02 Jul 2026 08:53:17 -0400 Received: from DESKTOP-TUU1E5L.localdomain (unknown [167.220.208.73]) by linux.microsoft.com (Postfix) with ESMTPSA id 8465920B7167; Thu, 2 Jul 2026 05:53:11 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 8465920B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1782996793; bh=bq8uv8/M+d7V425XxI+caQVZ9sYvYXSUIzrNxIYMxWA=; h=From:To:Cc:Subject:Date:From; b=jC4NWi5Z9xbBjx6gRUU6v6owaDEFw5utwwowmGEuajH8SFVpRWGzWs0km+n5F4ft6 oKbKQEqFtEo0yLk2q8VdsSVg3qSvBZ7KQNTzONT8BoxagtG6ctIrV4tnkid42IlOVt wze24UHgA4x52hSuuSW+kqSeCprsGYnM6pT9++2k= From: Magnus Kulke To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Doru=20Bl=C3=A2nzeanu?= , Magnus Kulke , =?UTF-8?q?Doru=20Bl=C3=A2nzeanu?= , Wei Liu , Paolo Bonzini , Wei Liu Subject: [PATCH] target/i386/mshv: Fix cpu feature-leak from host Date: Thu, 2 Jul 2026 14:53:09 +0200 Message-Id: <20260702125309.450767-1-magnuskulke@linux.microsoft.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=13.77.154.182; envelope-from=magnuskulke@linux.microsoft.com; helo=linux.microsoft.com X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.microsoft.com) X-ZM-MESSAGEID: 1782996826145158500 Content-Type: text/plain; charset="utf-8" In the current implementation there are subtle bugs that have to do with the termination of subleaves, resulting in features reported on the guest that it should not have according to the model. If a guest model has fewer valid subleaves stopping too early leaves unspecified gaps that are filled by the host, resulting in potentially invalid feature combinations, for example: The host reports features: CPUID[EAX=3D01H].ECX.AVX [bit 28] and CPUID[EAX=3D07H,ECX=3D01H].EAX.AVX_VNNI [bit 4] In the current implementation we would skip over 7.1 completely, not registering CPUID responses for the subleaf, resulting in a guest with qemu64 model (which does not feature AVX), reporting AVX_VNNI as available (passthrough from host). We need to walk through the max subleaves of leaf 7 and register them explicitly (also if they're 0). A second bug was about the propagation of "terminator" subleaves, all-zero responses that signal the end. We also want to register this terminator response , so the guest stops enumerating. In the current implementation we weren't doing that. Fixes: 4fa04dd1621 Signed-off-by: Magnus Kulke Reviewed-by: Doru Bl=C3=A2nzeanu --- target/i386/mshv/mshv-cpu.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c index 126ca40b48..a3b5f4474f 100644 --- a/target/i386/mshv/mshv-cpu.c +++ b/target/i386/mshv/mshv-cpu.c @@ -997,7 +997,7 @@ static void collect_cpuid_entries(const CPUState *cpu, = GList **cpuid_entries) CPUX86State *env =3D &x86_cpu->env; uint32_t eax, ebx, ecx, edx; uint32_t leaf, subleaf; - uint32_t max_basic_leaf, max_extended_leaf; + uint32_t max_basic_leaf, max_extended_leaf, max_subleaf_7; uint32_t max_subleaf =3D 0x20; uint32_t leaves_with_subleaves[] =3D {0x04, 0x07, 0x0d, 0x0f, 0x10}; int n_subleaf_leaves =3D ARRAY_SIZE(leaves_with_subleaves); @@ -1035,14 +1035,31 @@ static void collect_cpuid_entries(const CPUState *c= pu, GList **cpuid_entries) continue; } =20 + /* + * Valid subleaves for are reported in 7.0:EAX. We need to registe= r all + * subleaves to the maximum subleaf, even if they are 0. Otherwise= the + * host will supply its own values for a unregistered subleaf, whi= ch + * can result in an inconsistent feature set. + */ + if (leaf =3D=3D 0x07) { + cpu_x86_cpuid(env, leaf, 0, &max_subleaf_7, &ebx, &ecx, &edx); + for (subleaf =3D 0; subleaf <=3D max_subleaf_7; subleaf++) { + cpu_x86_cpuid(env, leaf, subleaf, &eax, &ebx, &ecx, &edx); + add_cpuid_entry(cpuid_entries, leaf, subleaf, + eax, ebx, ecx, edx); + } + continue; + } + subleaf =3D 0; while (subleaf < max_subleaf) { cpu_x86_cpuid(env, leaf, subleaf, &eax, &ebx, &ecx, &edx); =20 + /* register the "terminator" to the guest, before breaking */ + add_cpuid_entry(cpuid_entries, leaf, subleaf, eax, ebx, ecx, e= dx); if (eax =3D=3D 0 && ebx =3D=3D 0 && ecx =3D=3D 0 && edx =3D=3D= 0) { break; } - add_cpuid_entry(cpuid_entries, leaf, subleaf, eax, ebx, ecx, e= dx); subleaf++; } } --=20 2.34.1