qemu-spoof: CPUID — KVM signature + leaf 0x16 frequency

CPUID 0x40000000 KVM signature "KVMKVMKVM" -> spoof_kvm_signature() (vendor-
anchored GenuineIntel/AuthenticAMD). CPUID leaf 0x16 (Processor Frequency Info),
which stock QEMU returns as zeros, is filled from spoof_cpu_{base,max,bus}_mhz().
Inert unless a spoof-seed is set. (hv-mode kvm=off / hypervisor-bit handling is
done via the Proxmox cpu flags, see README.)
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c6fd1dc..1093326 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -18,6 +18,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "hw/misc/spoof.h"
 #include "qemu/units.h"
 #include "qemu/cutils.h"
 #include "qemu/qemu-print.h"
@@ -9166,6 +9167,20 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *ecx = 0;
         *edx = 0;
         break;
+    case 0x16:
+        /* qemu-spoof: Processor Frequency Information (stock QEMU returns 0). */
+        if (spoof_enabled()) {
+            *eax = spoof_cpu_base_mhz(0) & 0xffff;
+            *ebx = spoof_cpu_max_mhz(0) & 0xffff;
+            *ecx = spoof_cpu_bus_mhz(0) & 0xffff;
+            *edx = 0;
+        } else {
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
+            *edx = 0;
+        }
+        break;
     default:
         /* reserved values: zero */
         *eax = 0;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 9e35288..5b112b5 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -13,6 +13,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "hw/misc/spoof.h"
 #include "qapi/qapi-events-run-state.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
@@ -2380,7 +2381,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
         abort();
 #endif
     } else if (cpu->expose_kvm) {
-        memcpy(signature, "KVMKVMKVM\0\0\0", 12);
+        memcpy(signature, spoof_kvm_signature("KVMKVMKVM\0\0\0"), 12);
         c = &cpuid_data.entries[cpuid_i++];
         c->function = KVM_CPUID_SIGNATURE | kvm_base;
         c->eax = KVM_CPUID_FEATURES | kvm_base;