[RFC PATCH 01/27] KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf

[Binbin Wu <binbin.wu@linux.intel.com>]

Guard the use of cpuid_func_emulated() with a check that the CPUID
sub-leaf index is 0, as cpuid_func_emulated() unconditionally returns
emulated features for index 0 and does not account for indexed leaves.

Without the guard, when iterating over reverse_cpuid[] entries that
share the same CPUID function but have a non-zero index, e.g.
CPUID_7_1_ECX (function=7, index=1), the emulated features for index 0
are incorrectly OR'd into the wrong capability word.  For example,
RDPID (CPUID.7.0:ECX[22]) gets erroneously applied to CPUID_7_1_ECX,
which would allow userspace to set bit 22 of CPUID.7.1:ECX in the vCPU's
capabilities.

This is currently benign as the affected bits in the non-zero index
words happen to not correspond to meaningful features, but it could
cause problems as new features are defined in those positions.

Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
---
 arch/x86/kvm/cpuid.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index e69156b54cff..25f582a8d795 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -399,15 +399,16 @@ void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
 		if (!entry)
 			continue;
 
-		cpuid_func_emulated(&emulated, cpuid.function, true);
-
 		/*
 		 * A vCPU has a feature if it's supported by KVM and is enabled
 		 * in guest CPUID.  Note, this includes features that are
 		 * supported by KVM but aren't advertised to userspace!
 		 */
-		vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i] |
-					 cpuid_get_reg_unsafe(&emulated, cpuid.reg);
+		vcpu->arch.cpu_caps[i] = kvm_cpu_caps[i];
+		if (!cpuid.index) {
+			cpuid_func_emulated(&emulated, cpuid.function, true);
+			vcpu->arch.cpu_caps[i] |= cpuid_get_reg_unsafe(&emulated, cpuid.reg);
+		}
 		vcpu->arch.cpu_caps[i] &= cpuid_get_reg_unsafe(entry, cpuid.reg);
 	}
 
-- 
2.46.0