Re: [PATCH v3 1/4] KVM: TDX: Track configurable CPUID bits allowed by KVM

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Fri, 2026-09-11 at 08:55 +0800, Binbin Wu wrote:
> > Since we share code with normal VMs (and manage shared EPT in KVM), some
> > checks are going to happen. If there is some new feature foo we enable for
> > TDX. And later KVM adds new logic around vcpu->arch.cpu_caps for it, then
> > there is a small risk of being pinned down when we want to add new
> > guest_cpu_cap_has() logic for normal VMs. Since we already are hitting these
> > checks for TDX, the general case is not theoretical.
> 
> ... Yes, this was my concern.
> If in the future KVM adds new guest_cpu_cap_has() for a host state clobbering
> feature and it is used TDX, it would cause problem if there is a mismatch
> between guest_cpu_cap_has() and the real value exposed to the TD.

We discussed offline that another benefit of filtering by kvm caps is that TDX
will respect KVM's logic around disabling certain features, for example the
enable_cet module param. Things like that could easily be added without
consideration of TDX, and the reason for disabling them could possibly still
apply to TDX. Or also surprise the user if TDX doesn't respect it. Better to be
safe by default.