Re: [RFC PATCH 24/27] KVM: x86: Skip paranoid CPUID check for KVM PV leafs when base is relocated

[Binbin Wu <binbin.wu@linux.intel.com>]

Below are responses to issues reported by sashiko. [1]
[1] https://sashiko.dev/#/patchset/20260417073610.3246316-1-binbin.wu%40linux.intel.com?part=24


> diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
> index af87b803572c0..e6f0ecadc290b 100644
> --- a/arch/x86/kvm/cpuid.c
> +++ b/arch/x86/kvm/cpuid.c
[ ... ]
> @@ -524,6 +534,11 @@ static int cpuid_check_and_set_vcpu_caps(struct kvm_vcpu *vcpu,
>  	u32 input, supported;
>  	u32 leaf;
>  
> +	if (vcpu->kvm->arch.is_cpuid_paranoid_mode &&
> +	    (entry->function & 0xFFFF0000) == KVM_CPUID_SIGNATURE &&
> +	    kvm_get_hypervisor_cpuid(vcpu, KVM_SIGNATURE).base != KVM_CPUID_SIGNATURE)
> +		return kvm_check_pv_cpuid_relocated(vcpu, entry);
Issue #1:

"Does this unintentionally bypass validation for the entire hypervisor CPUID
range (0x4000xxxx)?
The condition (entry->function & 0xFFFF0000) == KVM_CPUID_SIGNATURE broadly
matches the entire 0x4000xxxx range. If the KVM signature is omitted
(yielding base == 0) or relocated, the check evaluates to true. For non-TDX
guests with paranoid mode enabled, kvm_check_pv_cpuid_relocated() returns 0,
causing an early return that skips the rest of the verification.
Can a VMM bypass paranoid checks to inject arbitrary, unverified hypervisor
CPUID leaves by simply omitting or relocating the KVM signature?"

This is intentionally bypass validation for hypervisor CPUID range if KVM
base is relocated for non-TDX guests. It is marked as TODO in
kvm_check_pv_cpuid_relocated() since I don't have a simple way to do it.


Issue #2:

"Also, does calling kvm_get_hypervisor_cpuid() here introduce an expensive
O(N^3) loop?
This code executes dynamically per CPUID entry during KVM_SET_CPUID2.
kvm_get_hypervisor_cpuid() performs a linear scan over 256 possible bases,
and calls kvm_find_cpuid_entry(), which linearly scans up to 256 CPUID
entries again.
Could the KVM CPUID base address be resolved once prior to iterating through
all the entries?"

There should be no too many hypervisor CPUID leafs. But yes, the KVM CPUID
base address could be resolved once prior to the iterating.