Re: [PATCH v3 0/4] KVM: TDX: Validate directly configurable CPUID bits

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Wed, 2026-09-02 at 21:39 +0800, Xiaoyao Li wrote:
> > I don't think they have agreed to it yet (Binbin?), but I think it mostly
> > works this way already. Why do you think it is a burden on TDX module
> > developers?
> 
> Because it can bring confusion to TDX module developers. VM_EXIT_LOAD_XXX
> control is used by SEAM VMCS to load states for TDX module execution context.
> And I think for most features SEAM VMCS doesn't set it (I don't check it
> though).
> 
> SEAMCALL is kind of a VM exit, and SEAMRET is kind of a VM entry. To
> automatically save and restore the host state, what TDX needs are
> VM_EXIT_SAVE_XXX, VM_ENTRY_LOAD_XXX, and vmcs guest state for XXX.

I'd think we could avoid adding options for configuration that won't be used. If
we did have a clobber control interface, matching VMX bits is an interesting
idea.

I'm a bit torn between wanting to fix the area once and for all with a full
solution, and wanting to get this increasingly blocking CPUID bit fix in. I'm
leaning towards just do the bit filtering and give the save/restore guidelines.

Then we can do a save/restore control later if we find the guidelines are not
sufficient.