Re: [PATCH v4 1/4] KVM: TDX: Track configurable CPUID bits allowed by KVM

[Xiaoyao Li]

On 9/24/2026 7:41 PM, Binbin Wu wrote:
>> After some search, I find that X86_FEATURE_CID (CPUID.0x1:ECX[10]) is related to
>> MSR_IA32_MISC_ENABLE[24], which seems to be a model specific bit.
>>
>> And on SDM, vol3. 14.5.6 L1 Data Cache Context Mode
>>
>>   L1 data cache context mode is a feature of processors based on the Intel
>>   NetBurst microarchitecture that support Intel Hyper-Threading Technology.
>>   When CPUID.01H:ECX[10] =1, the processor supports setting L1 data cache
>>   context mode using the L1 data cache context mode flag (IA32_MISC_ENABLE[bit
>>   24]). Selectable modes are adaptive mode (default) and shared mode.
>>
>> CPUID.0x1:ECX[10] is 0 on SPR and EMR (I didn't check more). It looks this CPUID
>> bit will not show up on any TDX capable CPUs. I think we can report it to TDX
>> architects and just make the bit fixed0 as a spec fix?
> I think we can confirm with the TDX module team. If it will never show up on TDX
> capable CPUs, then this is similar to PREFETCHWT1. 
> 
> But I am not sure we want new fixed-0 bits.

Leave it as current "Configured & Native" is also OK. Since no TDX capable CPU
has this bit as 1, it's effectively a fixed-0 bit.

>> For X86_FEATURE_PBE (CPUID.0x1:EDX[31]), it's related to bit 10 of MSR
>> IA32_MISC_ENABLE. The CPUID is 1 on SPR and EMR. But bit 10 of MSR
>> IA32_MISC_ENABLE is always 0 and setting bit 10 to 1 fails. It seems though
>> CPUID.0x1:EDX[31] is set to 1, but it's not related to bit 10 of MSR
>> IA32_MISC_ENABLE?
> In the ISE (319433-062, table 1-6), it says:
>   PBE:
>   Pending Break Enable. The processor supports the use of the FERR#/PBE# pin
>   when the processor is in the stop-clock state (STPCLK# is asserted) to signal
>   the processor that an interrupt is pending and that the processor should
>   return to normal operation to handle the interrupt. Bit 10 (PBE enable) in the
>   IA32_MISC_ENABLE MSR enables this capability.
> 
> TDX module doesn't allow IA32_MISC_ENABLE[10] to be 1 is since it's reserved
> TDCS.TD_CTLS.REDUCE_VE is set, so my understanding was the CPUID bit should be 0. 
> 
> It seems bit 10 is phased out in IA32_MISC_ENABLE on modern processors like SPR
> and EMR, since the bit 10 is reserved in "IA-32 Architectural MSRs" table. But
> somehow, CPUID still reports PBE as supported.

yeah. arch/x86/include/asm/msr-index.h divides the bits of MSR IA32_MISC_ENABLE
into two groups: architectural and model-specific. Bit 10 falls into model-specific.

Maybe we can ask internally why CPUID still reports 1.

> I don't know why the CPUID is disconnected with the MSR.
> But this bit is present on the host, I think we can add it to the allowlist.

I have opposite opinion. Since 1) this feature is related to hardware processor
PIN, 2) KVM never advertise it to normal VMs, and 3) no usage in kernel for this
feature. I think no TD relies on it and don't allow it should be OK.