Re: [PATCH v5 2/5] KVM: TDX: Track configurable CPUID bits allowed by KVM

[Chao Gao]

On Fri, Oct 16, 2026 at 05:14:19PM +0800, Binbin Wu wrote:
>Add tdx_cpu_cfg_caps[] to track the subset of TDX directly configurable
>CPUID feature bits that KVM supports, and initialize it during TDX
>hardware setup.
>
>The TDX module reports the CPUID bits that the VMM can directly configure
>for a TD, but KVM can't blindly expose every reported bit to userspace.
>Some features imply additional state, e.g. MSRs, that KVM must context
>switch across host/guest transitions to avoid corrupting host state.  The
>existing hardcoded denylist can't account for such features introduced by
>future TDX modules.
>
>Aside from a few fixed-1 bits required for basic TDX support, features
>that can clobber host state are either directly configurable or controlled
>by TD ATTRIBUTES/XFAM, which KVM already validates.  Thus, an allowlist
>covering only the directly configurable bits is sufficient.
>
>Organize tdx_cpu_cfg_caps[] like kvm_cpu_caps[] so that the allowlist can
>be built with feature-name based initializers.  Directly configurable bits
>that aren't feature flags will be handled when building the per-register
>masks for KVM_TDX_CAPABILITIES.
>
>Sort the directly configurable CPUID feature bits into three categories:
>
> 1) Features that KVM supports and tracks in kvm_cpu_caps[].  Use
>    TDX_CFG_F() so that they are also capped by kvm_cpu_caps[].
>
> 2) Features that KVM supports, or can safely allow, but doesn't track in
>    kvm_cpu_caps[], i.e. MWAIT and HT.  Use TDX_CFG_INDEPENDENT_F().
>
> 3) Features that are obsolete or unsupported by KVM, and thus excluded,
>    i.e. EST, TM2, CID, SDBG, XTPR, DCA, PN (PSN), ACPI, ACC (TM), PBE,
>    HLE, RTM, CQM (RDT_M), RDT_A, PREFETCHWT1, WAITPKG, TME, PCONFIG,
>    CORE_CAPABILITIES, RAO_INT, FRED, and AMX-TRANSPOSE.
>
>Excluding the features in category 3 shouldn't break userspace, as
>userspace is expected to consult KVM_TDX_CAPABILITIES for the configurable
>bits before invoking KVM_TDX_INIT_VM.  Nor should it break guests, as the
>features are either obsolete or unsupported by KVM, and in the latter case,
>a guest relying on them would already have run into problems.
>CORE_CAPABILITIES is a special case; it will be allowed separately to
>accommodate its legacy fixed-1 definition.
>
>Future changes will use tdx_cpu_cfg_caps[] to filter KVM_TDX_CAPABILITIES
>and to reject unsupported CPUID input to KVM_TDX_INIT_VM, so that directly
>configurable bits introduced by future TDX modules are neither advertised
>to nor configurable by userspace until KVM explicitly opts in.
>
>Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>

Reviewed-by: Chao Gao <chao.gao@xxxxxxxxx>