[RFC PATCH 24/27] KVM: x86: Skip paranoid CPUID check for KVM PV leafs when base is relocated

[Binbin Wu <binbin.wu@linux.intel.com>]

Handle the case where the KVM PV CPUID base is relocated from its
default location (0x40000000) in paranoid mode, e.g. when userspace
advertises support for both Hyper-V and KVM.

In CPUID paranoid mode, if KVM CPUID base is relocated, skip the normal
per-register paranoid verification. Just rejects the configuration
outright for TDs (as TDX does not support other PV enhancements) and
allows it for normal guests.

Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
---
 arch/x86/kvm/cpuid.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index af87b803572c..e6f0ecadc290 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -516,6 +516,16 @@ static u32 get_cpuid_reg_dynamic(struct kvm_vcpu *vcpu, u32 func, u32 index, int
 	return 0;
 }
 
+static int kvm_check_pv_cpuid_relocated(struct kvm_vcpu *vcpu, struct kvm_cpuid_entry2 *entry)
+{
+	/* TDX doesn't support other virtualization enhancements. */
+	if (get_cpuid_overlay(vcpu->kvm) == CPUID_OL_TDX)
+		return -EINVAL;
+
+	/* TODO: Check PV CPUIDs when KVM PV CPUID base is relocated. */
+	return 0;
+}
+
 static int cpuid_check_and_set_vcpu_caps(struct kvm_vcpu *vcpu,
 					 struct kvm_cpuid_entry2 *entry)
 {
@@ -524,6 +534,11 @@ static int cpuid_check_and_set_vcpu_caps(struct kvm_vcpu *vcpu,
 	u32 input, supported;
 	u32 leaf;
 
+	if (vcpu->kvm->arch.is_cpuid_paranoid_mode &&
+	    (entry->function & 0xFFFF0000) == KVM_CPUID_SIGNATURE &&
+	    kvm_get_hypervisor_cpuid(vcpu, KVM_SIGNATURE).base != KVM_CPUID_SIGNATURE)
+		return kvm_check_pv_cpuid_relocated(vcpu, entry);
+
 	if (!entry->index)
 		cpuid_func_emulated(vcpu->kvm, &emulated, entry->function, true);
 
-- 
2.46.0