On Tue, Jun 09, 2026 at 05:00:46PM +0800, Ewan Hai-oc wrote: > Date: Tue, 9 Jun 2026 17:00:46 +0800 > From: Ewan Hai-oc <[email protected]> > Subject: [PATCH] target/i386/cpu: don't assert on out-of-range CPUID 0x1f > subleaf > X-Mailer: git-send-email 2.34.1 > > encode_topo_cpuid1f() asserts count <= CPU_TOPOLOGY_LEVEL_SOCKET, but > count is the subleaf index passed straight from the guest's ECX; > cpu_x86_cpuid() does not clamp it for leaf 0x1f. On a TCG vCPU exposing > 0x1f, any CPUID(0x1f) with ECX > 5 aborts QEMU. SeaBIOS already trips > this during POST (its cpuid() helper leaves a stale ECX from the > EFLAGS.ID probe), and guests reach it too,the kernel walks 0x1f > subleaves in a loop and /dev/cpu/*/cpuid forwards arbitrary subleaves. > > Per the SDM, CPUID never faults and a subleaf past the last topology > level returns the invalid encoding (EAX=EBX=0, ECX level type 0, EDX the > x2APIC ID), exactly as the legacy 0xB leaf already does. Return that > instead of asserting. KVM is unaffected. > > Affected models: SapphireRapids (v4+), GraniteRapids (v3+), SierraForest > (v3+), ClearwaterForest (v3+), DiamondRapids and YongFeng (v3+). > > Fixes: 822bce9f58df ("i386/cpu: Decouple CPUID[0x1F] subleaf with specific > topology level") > Signed-off-by: Ewan Hai <[email protected]> > --- > target/i386/cpu.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-)
(cc stable list) Yes, good catch! On a TCG vCPU exposing 0x1f, requesting an invalid subleaf triggers this abort, e.g.: cpuid -1 -l 0x1f -s 8 Thanks for the fix, Reviewed-by: Zhao Liu <[email protected]> Regards, Zhao
