Re: [PATCH v3 2/4] KVM: TDX: Report CORE_CAPABILITIES as configurable

[Binbin Wu]

On 9/3/2026 1:43 AM, Kishen Maloor wrote:
> On 8/26/26 8:18 PM, Binbin Wu wrote:
>> Reporting CORE_CAPABILITIES as configurable keeps userspace able to enable
>> the bit across the fixed-1 => configurable transition, and lets userspace
>> infer that the bit is no longer fixed-1 so it can adjust its expectations.
>> ...
>> @@ -147,6 +147,12 @@ static void __init tdx_initialize_cpu_cfg_caps(void)
>> +		/*
>> +		 * KVM does not support MSR_IA32_CORE_CAPS, but older TDX specs
>> +		 * define this bit as fixed-1.  Report it as configurable so
>> +		 * userspace can know the feature is no longer a fixed-1 bit.
>> +		 */
>> +		TDX_CFG_EXTRA_F(CORE_CAPABILITIES),
> 
> Would a mask of the bits that are fixed-1 across the modules KVM supports today
> be worth carrying, or adding to the allowed set?
> I assume it would be hardcoded, just as the allowed list is.

This version doesn't include fixed-1 bits or other non-"directly configurable"
bits to minimize the code footprint.


> 
> If a module update later made one of them configurable, userspace would keep the
> ability to set it -- something it has today with the denylist. And since such
> bits are already enabled in every TD running now, continuing to accept them 
> can't turn on anything that isn't already on.

After discussions with the TDX module team, there is one potential backward
compatibility issue regarding x86 feature deprecation. I raised the it as
in the cover letter and there were discussions.
https://lore.kernel.org/kvm/1deddc78d14326b378ddd62ad99c21d66da401e6.camel@xxxxxxxxx/

> 
> A bit that becomes fixed-1 in the future and configurable after a subsequent
> module update would still need a patch to the mask, just as this patch does.
> Is CORE_CAPABILITIES the only fixed-1 case so far?

Actually this is the #VE reduction on fixed-1 bit, which changes a previous fixed-1
bit to directly configurable.
There are several cases of this category, i.e. MCA/MCE/MTRR/CORE_CAPABILITIES.
However, CORE_CAPABILITIES is the only case that KVM doesn't support for non-TDX
VMs
I will add these info to the change log.