Re: [PATCH v5 2/5] KVM: TDX: Track configurable CPUID bits allowed by KVM

[Nikolay Borisov]

On 16.10.26 г. 12:14 ч., Binbin Wu wrote:
> Add tdx_cpu_cfg_caps[] to track the subset of TDX directly configurable
> CPUID feature bits that KVM supports, and initialize it during TDX
> hardware setup.
>
> The TDX module reports the CPUID bits that the VMM can directly configure
> for a TD, but KVM can't blindly expose every reported bit to userspace.
> Some features imply additional state, e.g. MSRs, that KVM must context
> switch across host/guest transitions to avoid corrupting host state.  The
> existing hardcoded denylist can't account for such features introduced by
> future TDX modules.
>
> Aside from a few fixed-1 bits required for basic TDX support, features
> that can clobber host state are either directly configurable or controlled
> by TD ATTRIBUTES/XFAM, which KVM already validates.  Thus, an allowlist
> covering only the directly configurable bits is sufficient.
>
> Organize tdx_cpu_cfg_caps[] like kvm_cpu_caps[] so that the allowlist can
> be built with feature-name based initializers.  Directly configurable bits
> that aren't feature flags will be handled when building the per-register
> masks for KVM_TDX_CAPABILITIES.
>
> Sort the directly configurable CPUID feature bits into three categories:
>
>   1) Features that KVM supports and tracks in kvm_cpu_caps[].  Use
>      TDX_CFG_F() so that they are also capped by kvm_cpu_caps[].
>
>   2) Features that KVM supports, or can safely allow, but doesn't track in
>      kvm_cpu_caps[], i.e. MWAIT and HT.  Use TDX_CFG_INDEPENDENT_F().
>
>   3) Features that are obsolete or unsupported by KVM, and thus excluded,
>      i.e. EST, TM2, CID, SDBG, XTPR, DCA, PN (PSN), ACPI, ACC (TM), PBE,
>      HLE, RTM, CQM (RDT_M), RDT_A, PREFETCHWT1, WAITPKG, TME, PCONFIG,
>      CORE_CAPABILITIES, RAO_INT, FRED, and AMX-TRANSPOSE.
>
> Excluding the features in category 3 shouldn't break userspace, as
> userspace is expected to consult KVM_TDX_CAPABILITIES for the configurable
> bits before invoking KVM_TDX_INIT_VM.  Nor should it break guests, as the
> features are either obsolete or unsupported by KVM, and in the latter case,
> a guest relying on them would already have run into problems.
> CORE_CAPABILITIES is a special case; it will be allowed separately to
> accommodate its legacy fixed-1 definition.
>
> Future changes will use tdx_cpu_cfg_caps[] to filter KVM_TDX_CAPABILITIES
> and to reject unsupported CPUID input to KVM_TDX_INIT_VM, so that directly
> configurable bits introduced by future TDX modules are neither advertised
> to nor configurable by userspace until KVM explicitly opts in.
>
> Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>

Reviewed-by: Nikolay Borisov <nik.borisov@xxxxxxxx>