[PATCH v5 3/5] KVM: TDX: Add CORE_CAPABILITIES to the allowlist

[Binbin Wu]

Add CORE_CAPABILITIES (CPUID.0x7.0.EDX[30]) to KVM's allowlist of TDX
directly configurable CPUID feature bits to accommodate the legacy TDX
module definition of the bit, even though KVM doesn't support
MSR_IA32_CORE_CAPS for TDs.

Older TDX module specs define CORE_CAPABILITIES as fixed-1, so userspace
may expect the bit to be set for TDs.  The bit is redefined as directly
configurable due to #VE reduction.  Leaving it out of the allowlist would
prevent userspace from setting it once KVM starts validating the CPUID
input to KVM_TDX_INIT_VM, which would be an unexpected behavior change for
such userspace.

Reporting CORE_CAPABILITIES as directly configurable also lets userspace
detect that the bit is no longer fixed-1, and thus update its stale
knowledge.

Keep MSR_IA32_CORE_CAPS unsupported for TDs, as no existing TDX user needs
guest access to the MSR.

Note, CORE_CAPABILITIES is the only bit that is both unsupported by KVM
*and* redefined from fixed-1 to directly configurable due to #VE
reduction, and no further #VE reductions are expected.

Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>
Reviewed-by: Xiaoyao Li <xiaoyao.li@xxxxxxxxx>
---
v5:
- Clarify in the changelog that #VE reduction redefines the bit from
  fixed-1 to directly configurable.
- Change the shortlog from "KVM: TDX: Report CORE_CAPABILITIES as
  configurable" to "KVM: TDX: Add CORE_CAPABILITIES to the allowlist"
  since the patch doesn't change the CPUID reporting behavior yet.
- Add RB from Xiaoyao.

v4:
- Add #VE reduction related background to the changelog. (Kishen)
- Add RB from Tony.

v3:
- Drop the code for MSR_IA32_CORE_CAPS access.
---
 arch/x86/kvm/vmx/tdx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index b6e096079655..13aaf7eb11b5 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -219,6 +219,13 @@ static void __init tdx_initialize_cpu_cfg_caps(void)
 		TDX_CFG_F(AVX512_VP2INTERSECT),
 		TDX_CFG_F(SERIALIZE),
 		TDX_CFG_F(TSXLDTRK),
+		/*
+		 * KVM doesn't support MSR_IA32_CORE_CAPS, but older TDX module
+		 * specs define this bit as fixed-1.  Report it as configurable
+		 * to accommodate the legacy TDX module definition, and to let
+		 * userspace detect that the bit is no longer fixed-1.
+		 */
+		TDX_CFG_INDEPENDENT_F(CORE_CAPABILITIES),
 	);
 
 	tdx_cpu_cfg_cap_init(CPUID_7_1_EAX,
-- 
2.46.0