On Mon, Mar 2, 2020 at 11:57 AM Sean Christopherson <sean.j.christopherson@xxxxxxxxx> wrote: > The bad behavior can be visually confirmed by dumping CPUID output in > the guest when running Qemu with a stable TSC, as Qemu extends the limit > of range 0x40000000 to 0x40000010 to advertise VMware's cpuid_freq, > without defining zeroed entries for 0x40000002 - 0x4000000f. I think it could be reasonably argued that this is a userspace bug. Clearly, when userspace explicitly supplies the results for a leaf, those results override the default CPUID values for that leaf. But I haven't seen it documented anywhere that leaves *not* explicitly supplied by userspace will override the default CPUID values, just because they happen to appear in some magic range.