Re: [PATCH v3 2/4] KVM: TDX: Report CORE_CAPABILITIES as configurable

[Kishen Maloor <kishen.maloor@intel.com>]

On 8/26/26 8:18 PM, Binbin Wu wrote:
> Reporting CORE_CAPABILITIES as configurable keeps userspace able to enable
> the bit across the fixed-1 => configurable transition, and lets userspace
> infer that the bit is no longer fixed-1 so it can adjust its expectations.
> ...
> @@ -147,6 +147,12 @@ static void __init tdx_initialize_cpu_cfg_caps(void)
> +		/*
> +		 * KVM does not support MSR_IA32_CORE_CAPS, but older TDX specs
> +		 * define this bit as fixed-1.  Report it as configurable so
> +		 * userspace can know the feature is no longer a fixed-1 bit.
> +		 */
> +		TDX_CFG_EXTRA_F(CORE_CAPABILITIES),

Would a mask of the bits that are fixed-1 across the modules KVM supports today
be worth carrying, or adding to the allowed set?
I assume it would be hardcoded, just as the allowed list is.

If a module update later made one of them configurable, userspace would keep the
ability to set it -- something it has today with the denylist. And since such
bits are already enabled in every TD running now, continuing to accept them 
can't turn on anything that isn't already on.

A bit that becomes fixed-1 in the future and configurable after a subsequent
module update would still need a patch to the mask, just as this patch does.
Is CORE_CAPABILITIES the only fixed-1 case so far?