Re: [PATCH v5 2/5] KVM: TDX: Track configurable CPUID bits allowed by KVM

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 10/16/2026 5:14 PM, Binbin Wu wrote:
> Add tdx_cpu_cfg_caps[] to track the subset of TDX directly configurable
> CPUID feature bits that KVM supports, and initialize it during TDX
> hardware setup.
> 
> The TDX module reports the CPUID bits that the VMM can directly configure
> for a TD, but KVM can't blindly expose every reported bit to userspace.
> Some features imply additional state, e.g. MSRs, that KVM must context
> switch across host/guest transitions to avoid corrupting host state.  The
> existing hardcoded denylist can't account for such features introduced by
> future TDX modules.
> 
> Aside from a few fixed-1 bits required for basic TDX support, features
> that can clobber host state are either directly configurable or controlled
> by TD ATTRIBUTES/XFAM, which KVM already validates.  Thus, an allowlist
> covering only the directly configurable bits is sufficient.
> 
> Organize tdx_cpu_cfg_caps[] like kvm_cpu_caps[] so that the allowlist can
> be built with feature-name based initializers.  Directly configurable bits
> that aren't feature flags will be handled when building the per-register
> masks for KVM_TDX_CAPABILITIES.
> 
> Sort the directly configurable CPUID feature bits into three categories:
> 
>  1) Features that KVM supports and tracks in kvm_cpu_caps[].  Use
>     TDX_CFG_F() so that they are also capped by kvm_cpu_caps[].
> 
>  2) Features that KVM supports, or can safely allow, but doesn't track in
>     kvm_cpu_caps[], i.e. MWAIT and HT.  Use TDX_CFG_INDEPENDENT_F().
> 
>  3) Features that are obsolete or unsupported by KVM, and thus excluded,
>     i.e. EST, TM2, CID, SDBG, XTPR, DCA, PN (PSN), ACPI, ACC (TM), PBE,
>     HLE, RTM, CQM (RDT_M), RDT_A, PREFETCHWT1, WAITPKG, TME, PCONFIG,
>     CORE_CAPABILITIES, RAO_INT, FRED, and AMX-TRANSPOSE.
> 
> Excluding the features in category 3 shouldn't break userspace, as
> userspace is expected to consult KVM_TDX_CAPABILITIES for the configurable
> bits before invoking KVM_TDX_INIT_VM.  Nor should it break guests, as the
> features are either obsolete or unsupported by KVM, and in the latter case,
> a guest relying on them would already have run into problems.
> CORE_CAPABILITIES is a special case; it will be allowed separately to
> accommodate its legacy fixed-1 definition.
> 
> Future changes will use tdx_cpu_cfg_caps[] to filter KVM_TDX_CAPABILITIES
> and to reject unsupported CPUID input to KVM_TDX_INIT_VM, so that directly
> configurable bits introduced by future TDX modules are neither advertised
> to nor configurable by userspace until KVM explicitly opts in.
> 
> Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>