Re: [RFC PATCH 17/27] KVM: x86: Init allowed masks for extended CPUID range in paranoid mode

[Binbin Wu <binbin.wu@linux.intel.com>]

Below are responses to issues reported by sashiko. [1]
[1] https://sashiko.dev/#/patchset/20260417073610.3246316-1-binbin.wu%40linux.intel.com?part=17

[...]

> @@ -1310,6 +1311,18 @@ void kvm_initialize_cpu_caps(void)
>  		F(AVX10_VNNI_INT, F_CPUID_DEFAULT),
>  	);
>  
> +	kvm_cpu_cap_ignore(0x80000000, 0, 0, BIT(CPUID_EAX),
> +			   F_CPUID_DEFAULT | F_CPUID_TDX);
> +	kvm_cpu_cap_ignore(0x80000000, 0, 0, BIT(CPUID_EBX) | BIT(CPUID_ECX) | BIT(CPUID_EDX),
> +			   F_CPUID_SVM);

Issue #1:
"Does this strict zero-checking of EBX, ECX, and EDX on VMX/TDX break
userspace VMMs like QEMU?
QEMU unconditionally populates 0x80000000 EBX, ECX, and EDX with the CPU
vendor string (e.g., GenuineIntel) across all x86 architectures. When
KVM paranoid mode is enabled, KVM will reject these non-zero values.
This could cause KVM_SET_CPUID2 to fail with -EINVAL, breaking VM creation
for TDX (where paranoid mode is forced to true) or VMX.
Do these registers need to be ignored across all overlays, similar to the
explicit workaround implemented below for 0x80000001 EAX?"

The concern is valid.
Although after commit a539cd26145c
("i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf as reserved for Intel"),
QEMU by default zeros out EBX, ECX, EDX for Intel or Zhaoxin CPUs, 

But for back compatibility (PC machine v10.0 and older), or 
vendor_cpuid_only_v2 is manually disabled, there will be problems.
Considering CPUID paranoid mode is enforced for TDX, it will cause problem
when older QEMU populates 0x80000000 EBX, ECX, and EDX unconditionally. Will
add 0x80000000 EBX/ECX/EDX to ignored set for VMX/TDX as well.


[...]

> @@ -1388,6 +1422,10 @@ void kvm_initialize_cpu_caps(void)
>  		F(AMD_IBPB_RET, F_CPUID_DEFAULT),
>  	);
>  
> +	kvm_cpu_cap_init_mf(CPUID_8000_0008_ECX, GENMASK_U32(17, 12) | GENMASK_U32(7, 0),
> +			    F_CPUID_SVM);
> +	kvm_cpu_cap_ignore(0x80000008, 0, 0, BIT(CPUID_EDX), F_CPUID_SVM);
> +
Issue #2:
"Will initializing this allowed mask exclusively for AMD cause failures for
multi-core VMs booted via QEMU on Intel?
QEMU unconditionally populates 0x80000008 ECX with the core count and
APIC ID size for any multi-core guest configuration, bypassing host vendor
checks.
Under KVM paranoid mode, KVM will reject these non-zero values on Intel
hosts, causing KVM_SET_CPUID2 to fail and preventing multi-core VMs from
booting.
Does the allowed mask or ignore rule for this register need to be expanded
to include VMX and TDX?"

Similar to issue #1, for back compatibility (PC machine v10.0 and older), will
add the allowed mask for ECX in VMX/TDX overlays and ignore EDX for VMX/TDX
overlays for CPUID 0x80000008.