[RFC PATCH 23/27] KVM: x86: Account for runtime CPUID features in paranoid mode

[Binbin Wu <binbin.wu@linux.intel.com>]

Include RUNTIME_F() features in the supported mask during paranoid CPUID
verification to avoid false rejections of legitimate userspace CPUID
configurations.

Add get_cpuid_reg_dynamic() to return OSXSAVE and OSPKE as supported
bits based on the vCPU's current CR4 state.  Both features are declared
with RUNTIME_F() and thus absent from kvm_cpu_caps[][], but userspace
may legitimately set them when CR4.OSXSAVE or CR4.PKE is enabled.  TDX
guests are unaffected as these bits are not configurable for TDs.

For non-TDX guests, MWAIT is already permitted via cpuid_func_emulated(),
but that function early-returns zero for TDX guests since KVM cannot
(even partially) emulate these features for TDs.  The TDX module does
support exposing MWAIT to guests when the host has MWAIT and userspace
configures it, Declare MWAIT with F(MWAIT, F_CPUID_TDX) alongside the
existing RUNTIME_F(MWAIT) to populate MWAIT in the TDX overlay.

Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
---
 arch/x86/kvm/cpuid.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 2027230a1f42..af87b803572c 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -498,6 +498,24 @@ static int do_cpuid_reg_paranoid_check(struct kvm *kvm,
 	return -EINVAL;
 }
 
+static u32 get_cpuid_reg_dynamic(struct kvm_vcpu *vcpu, u32 func, u32 index, int reg)
+{
+	switch (func) {
+	case 1:
+		if (reg == CPUID_ECX && kvm_is_cr4_bit_set(vcpu, X86_CR4_OSXSAVE))
+			return feature_bit(OSXSAVE);
+		break;
+	case 7:
+		if (index == 0 && reg == CPUID_ECX && kvm_is_cr4_bit_set(vcpu, X86_CR4_PKE))
+			return feature_bit(OSPKE);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 static int cpuid_check_and_set_vcpu_caps(struct kvm_vcpu *vcpu,
 					 struct kvm_cpuid_entry2 *entry)
 {
@@ -527,6 +545,7 @@ static int cpuid_check_and_set_vcpu_caps(struct kvm_vcpu *vcpu,
 
 		supported = leaf != (u32)-1 ? kvm_cpu_caps[cpuid_overlay][leaf] : 0;
 		supported |= (!entry->index ? cpuid_get_reg_unsafe(&emulated, reg) : 0);
+		supported |= get_cpuid_reg_dynamic(vcpu, entry->function, entry->index, reg);
 
 		if (do_cpuid_reg_paranoid_check(vcpu->kvm, entry, reg, input, supported))
 			return -EINVAL;
@@ -1025,6 +1044,11 @@ void kvm_initialize_cpu_caps(void)
 		 * that KVM is aware that it's a known, unadvertised flag.
 		 */
 		RUNTIME_F(MWAIT),
+		/*
+		 * For TDX, MWAIT could be advertised to guests if the host
+		 * supports it and userspace configures it.
+		 */
+		F(MWAIT, F_CPUID_TDX),
 		/* DSCPL is fixed-1 in TDX */
 		F(DSCPL, F_CPUID_TDX),
 		VENDOR_F(VMX),
-- 
2.46.0