Re: [PATCH v3 3/4] KVM: TDX: Filter configurable CPUID bits

[Binbin Wu]

On 9/1/2026 2:44 PM, Tony Lindgren wrote:
> On Thu, Aug 27, 2026 at 11:18:36AM +0800, Binbin Wu wrote:
>> --- a/arch/x86/kvm/vmx/tdx.c
>> +++ b/arch/x86/kvm/vmx/tdx.c
> ...
>> +static u32 tdx_cfg_non_feature_mask(u32 function, u32 index, int reg)
>>  {
>> -	if (has_tsx(entry))
>> -		clear_tsx(entry);
>> +	/*
>> +	 * For a leaf/subleaf/register that will never be repurposed to hold
>> +	 * feature bits, it's safe to return TDX_CPUID_ALL_ALLOWED_MASK, i.e.
>> +	 * leave the TDX module's CPUID config mask intact.
>> +	 */
>> +	switch (function) {
>> +	case 1:
>> +		if (reg == CPUID_EAX || reg == CPUID_EBX)
>> +			return TDX_CPUID_ALL_ALLOWED_MASK;
>> +		return 0;
>> +	case 4:
>> +	case 0x18:
>> +	case 0x1f:
>> +		return TDX_CPUID_ALL_ALLOWED_MASK;
>> +	case 0x24:
>> +		if (index == 0 && reg == CPUID_EBX)
>> +			return GENMASK_U32(7, 0);
>> +		return 0;
>> +	case 0x80000008:
>> +		if (reg == CPUID_EAX)
>> +			return TDX_CPUID_ALL_ALLOWED_MASK;
>> +		return 0;
>> +	default:
>> +		return 0;
>> +	}
>> +}
> 
> How about rename the above to something simpler like tdx_get_cpuid_bits()?
> Sorry I don't have anything better to suggest for naming.
> 
>> +static u32 tdx_cfg_feature_mask(u32 function, u32 index, int reg)
>> +{
>> +	for (int i = 0; i < NR_KVM_CPU_CAPS; i++) {
>> +		const struct cpuid_reg *cpuid = &reverse_cpuid[i];
>> +
>> +		if (!cpuid->function)
>> +			continue;
>> +
>> +		if (cpuid->function == function && cpuid->index == index &&
>> +		    cpuid->reg == reg)
>> +			return tdx_cpu_cfg_caps[i];
>> +	}
>> +
>> +	return 0;
>>  }
> 
> And then the above to tdx_get_cpuid_feature_bits()?
>   
>> -static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry)
>> +static u32 tdx_get_allowed_cfg_cpuid_mask(u32 function, u32 index, int reg)
>>  {
>> -	return has_tsx(entry) || has_waitpkg(entry);
>> +	u32 non_feature_mask = tdx_cfg_non_feature_mask(function, index, reg);
>> +
>> +	if (non_feature_mask == TDX_CPUID_ALL_ALLOWED_MASK)
>> +		return TDX_CPUID_ALL_ALLOWED_MASK;
>> +
>> +	/*
>> +	 * It's possible that a CPUID register contains both feature and
>> +	 * non-feature bits.
>> +	 */
>> +	return non_feature_mask | tdx_cfg_feature_mask(function, index, reg);
>>  }
> 
> And then tdx_get_cpuid_mask()?

How about:
tdx_get_cpuid_cfg_non_feature_mask()
tdx_get_cpuid_cfg_feature_mask()
tdx_get_cpuid_cfg_mask()