[PATCH] kvm: vmx: Validate INVPCID bit in the CPUID supplied to the guest

[Junaid Shahid <junaids@xxxxxxxxxx>]

When INVPCID is not supported, KVM should clear the INVPCID bit from the
guest CPUID.

Signed-off-by: Junaid Shahid <junaids@xxxxxxxxxx>
---
 arch/x86/kvm/vmx.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index aafcc9881e888..5bc9c737eddc6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5810,6 +5810,7 @@ static bool vmx_rdseed_supported(void)
 static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
 {
 	struct kvm_vcpu *vcpu = &vmx->vcpu;
+	bool invpcid_enabled;
 
 	u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
 
@@ -5880,25 +5881,23 @@ static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
 		}
 	}
 
-	if (vmx_invpcid_supported()) {
-		/* Exposing INVPCID only when PCID is exposed */
-		bool invpcid_enabled =
-			guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
-			guest_cpuid_has(vcpu, X86_FEATURE_PCID);
+	/* Exposing INVPCID only when PCID is exposed */
+	invpcid_enabled = vmx_invpcid_supported() &&
+			  guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
+			  guest_cpuid_has(vcpu, X86_FEATURE_PCID);
 
-		if (!invpcid_enabled) {
-			exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
-			guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
-		}
+	if (!invpcid_enabled) {
+		exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+		guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
+	}
 
-		if (nested) {
-			if (invpcid_enabled)
-				vmx->nested.msrs.secondary_ctls_high |=
-					SECONDARY_EXEC_ENABLE_INVPCID;
-			else
-				vmx->nested.msrs.secondary_ctls_high &=
-					~SECONDARY_EXEC_ENABLE_INVPCID;
-		}
+	if (nested) {
+		if (invpcid_enabled)
+			vmx->nested.msrs.secondary_ctls_high |=
+				SECONDARY_EXEC_ENABLE_INVPCID;
+		else
+			vmx->nested.msrs.secondary_ctls_high &=
+				~SECONDARY_EXEC_ENABLE_INVPCID;
 	}
 
 	if (vmx_rdrand_supported()) {
-- 
2.17.0.441.gb46fe60e1d-goog