Re: [PATCH v5 3/5] KVM: TDX: Add CORE_CAPABILITIES to the allowlist

[Nikolay Borisov <nik.borisov@suse.com>]

On 16.10.26 г. 12:14 ч., Binbin Wu wrote:
> Add CORE_CAPABILITIES (CPUID.0x7.0.EDX[30]) to KVM's allowlist of TDX
> directly configurable CPUID feature bits to accommodate the legacy TDX
> module definition of the bit, even though KVM doesn't support
> MSR_IA32_CORE_CAPS for TDs.
> 
> Older TDX module specs define CORE_CAPABILITIES as fixed-1, so userspace
> may expect the bit to be set for TDs.  The bit is redefined as directly
> configurable due to #VE reduction.  Leaving it out of the allowlist would
> prevent userspace from setting it once KVM starts validating the CPUID
> input to KVM_TDX_INIT_VM, which would be an unexpected behavior change for
> such userspace.
> 
> Reporting CORE_CAPABILITIES as directly configurable also lets userspace
> detect that the bit is no longer fixed-1, and thus update its stale
> knowledge.
> 
> Keep MSR_IA32_CORE_CAPS unsupported for TDs, as no existing TDX user needs
> guest access to the MSR.
> 
> Note, CORE_CAPABILITIES is the only bit that is both unsupported by KVM
> *and* redefined from fixed-1 to directly configurable due to #VE
> reduction, and no further #VE reductions are expected.
> 
> Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
> Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>

Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>