Re: [PATCH v4 2/4] KVM: TDX: Report CORE_CAPABILITIES as configurable

[Xiaoyao Li]

On 9/17/2026 3:25 PM, Binbin Wu wrote:
> Add CORE_CAPABILITIES (CPUID.0x7.0.EDX[30]) to KVM's allowlist of TDX
> directly configurable CPUID feature bits, even though KVM doesn't support
> MSR_IA32_CORE_CAPS for TDX guests, to accommodate the legacy TDX module
> definition and userspace's stale knowledge of it.
> 
> Older TDX specifications define the CORE_CAPABILITIES CPUID bit as
> fixed-1, so userspace may expect the bit to be enabled for TDs.  #VE
> reduction turns it into a directly configurable bit, so leaving it out of
> the allowlist would make the bit impossible to enable once KVM starts
> validating userspace's CPUID input, i.e. would be a surprising behavior
> change for such userspace.
> 
> Reporting CORE_CAPABILITIES as directly configurable also lets userspace
> detect that the bit is no longer fixed-1, and thus correct its stale
> knowledge.
> 
> Keep MSR_IA32_CORE_CAPS unsupported for TDs, as no existing TDX user needs
> guest access to the MSR.
> 
> Note, CORE_CAPABILITIES is the only bit that is unsupported by KVM *and*
> changed from fixed-1 to directly configurable by #VE reduction, and no
> further #VE reductions are expected.
> 
> Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
> Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>

Reviewed-by: Xiaoyao Li <xiaoyao.li@xxxxxxxxx>

> ---
> v4:
> - Add #VE reduction related background to the changelog. (Kishen)
> - Add RB from Tony.
> 
> v3:
> - Drop the code for MSR_IA32_CORE_CAPS access.
> ---
>  arch/x86/kvm/vmx/tdx.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 2b51a85c998e8..b34afc52b714e 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -165,6 +165,13 @@ static void __init tdx_initialize_cpu_cfg_caps(void)
>  		TDX_CFG_F(AVX512_VP2INTERSECT),
>  		TDX_CFG_F(SERIALIZE),
>  		TDX_CFG_F(TSXLDTRK),
> +		/*
> +		 * KVM doesn't support MSR_IA32_CORE_CAPS, but older TDX specs
> +		 * define this bit as fixed-1.  Report it as configurable to
> +		 * accommodate the legacy TDX module definition, and to let
> +		 * userspace detect that the bit is no longer fixed-1.
> +		 */
> +		TDX_CFG_EXTRA_F(CORE_CAPABILITIES),
>  	);
>  
>  	tdx_cpu_cfg_cap_init(CPUID_7_1_EAX,