Re: [PATCH v5 4/5] KVM: TDX: Report only KVM-allowed CPUIDs in KVM_TDX_CAPABILITIES

[Binbin Wu]

On 10/21/2026 8:39 AM, Edgecombe, Rick P wrote:
> On Fri, 2026-10-16 at 17:14 +0800, Binbin Wu wrote:
>> Note, the change is user-visible, as some bits that were previously
>> reported as configurable no longer are.  The ABI itself is unchanged: KVM
>> already filtered unsupported CPUID bits out of KVM_TDX_CAPABILITIES, albeit
>> via a denylist, and the set of configurable bits already varies with the
>> TDX module and KVM versions.
> 
> I'm not sure what this is saying, the change is user visible but there is no ABI
> change? Can't be both... so I think there is an ABI change.

My understanding is KVM_TDX_CAPABILITIES reports the capabilities supported by
the TDX module *and* KVM, this is not changed before and after this patch series.
ABI-wise, I think userspace doesn't care how KVM do the filter, denylist-based or
allowlist-based. The ABI requires userspace to consult KVM_TDX_CAPABILITIES, and
what KVM_TDX_CAPABILITIES report can be changed. That's why I described the ABI
itself didn't change.

How about simply noting that this is a user-visible change and dropping the ABI
part to avoid any ambiguity about the scope of the ABI?

> 
>>
>> The change isn't expected to break userspace or guests:
>>  - Userspace that honors KVM_TDX_CAPABILITIES simply stops setting the
>>    dropped bits, and KVM_TDX_INIT_VM still succeeds.
>>  - CORE_CAPABILITIES, which older TDX module specs defined as fixed-1, is
>>    still allowed.
>>  - The dropped features are either obsolete or unsupported by KVM, and in
>>    the latter case, a guest relying on them would already have run into
>>    problems.
>