Re: [PATCH v3 3/4] KVM: TDX: Filter configurable CPUID bits

[Tony Lindgren]

On Thu, Aug 27, 2026 at 11:18:36AM +0800, Binbin Wu wrote:
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
...
> +static u32 tdx_cfg_non_feature_mask(u32 function, u32 index, int reg)
>  {
> -	if (has_tsx(entry))
> -		clear_tsx(entry);
> +	/*
> +	 * For a leaf/subleaf/register that will never be repurposed to hold
> +	 * feature bits, it's safe to return TDX_CPUID_ALL_ALLOWED_MASK, i.e.
> +	 * leave the TDX module's CPUID config mask intact.
> +	 */
> +	switch (function) {
> +	case 1:
> +		if (reg == CPUID_EAX || reg == CPUID_EBX)
> +			return TDX_CPUID_ALL_ALLOWED_MASK;
> +		return 0;
> +	case 4:
> +	case 0x18:
> +	case 0x1f:
> +		return TDX_CPUID_ALL_ALLOWED_MASK;
> +	case 0x24:
> +		if (index == 0 && reg == CPUID_EBX)
> +			return GENMASK_U32(7, 0);
> +		return 0;
> +	case 0x80000008:
> +		if (reg == CPUID_EAX)
> +			return TDX_CPUID_ALL_ALLOWED_MASK;
> +		return 0;
> +	default:
> +		return 0;
> +	}
> +}

How about rename the above to something simpler like tdx_get_cpuid_bits()?
Sorry I don't have anything better to suggest for naming.

> +static u32 tdx_cfg_feature_mask(u32 function, u32 index, int reg)
> +{
> +	for (int i = 0; i < NR_KVM_CPU_CAPS; i++) {
> +		const struct cpuid_reg *cpuid = &reverse_cpuid[i];
> +
> +		if (!cpuid->function)
> +			continue;
> +
> +		if (cpuid->function == function && cpuid->index == index &&
> +		    cpuid->reg == reg)
> +			return tdx_cpu_cfg_caps[i];
> +	}
> +
> +	return 0;
>  }

And then the above to tdx_get_cpuid_feature_bits()?
  
> -static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry)
> +static u32 tdx_get_allowed_cfg_cpuid_mask(u32 function, u32 index, int reg)
>  {
> -	return has_tsx(entry) || has_waitpkg(entry);
> +	u32 non_feature_mask = tdx_cfg_non_feature_mask(function, index, reg);
> +
> +	if (non_feature_mask == TDX_CPUID_ALL_ALLOWED_MASK)
> +		return TDX_CPUID_ALL_ALLOWED_MASK;
> +
> +	/*
> +	 * It's possible that a CPUID register contains both feature and
> +	 * non-feature bits.
> +	 */
> +	return non_feature_mask | tdx_cfg_feature_mask(function, index, reg);
>  }

And then tdx_get_cpuid_mask()?