Re: [PATCH v5 3/5] KVM: TDX: Add CORE_CAPABILITIES to the allowlist

[Chao Gao]

On Fri, Oct 16, 2026 at 05:14:20PM +0800, Binbin Wu wrote:
>Add CORE_CAPABILITIES (CPUID.0x7.0.EDX[30]) to KVM's allowlist of TDX
>directly configurable CPUID feature bits to accommodate the legacy TDX
>module definition of the bit, even though KVM doesn't support
>MSR_IA32_CORE_CAPS for TDs.
>
>Older TDX module specs define CORE_CAPABILITIES as fixed-1, so userspace
>may expect the bit to be set for TDs.  The bit is redefined as directly
>configurable due to #VE reduction.  Leaving it out of the allowlist would
>prevent userspace from setting it once KVM starts validating the CPUID
>input to KVM_TDX_INIT_VM, which would be an unexpected behavior change for
>such userspace.
>
>Reporting CORE_CAPABILITIES as directly configurable also lets userspace
>detect that the bit is no longer fixed-1, and thus update its stale
>knowledge.
>
>Keep MSR_IA32_CORE_CAPS unsupported for TDs, as no existing TDX user needs
>guest access to the MSR.
>
>Note, CORE_CAPABILITIES is the only bit that is both unsupported by KVM
>*and* redefined from fixed-1 to directly configurable due to #VE
>reduction, and no further #VE reductions are expected.
>
>Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
>Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>
>Reviewed-by: Xiaoyao Li <xiaoyao.li@xxxxxxxxx>

Reviewed-by: Chao Gao <chao.gao@xxxxxxxxx>