Re: [PATCH v3 0/4] KVM: TDX: Validate directly configurable CPUID bits

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 8/31/2026 1:01 PM, Binbin Wu wrote:
>>> So if the approach in this series is taken, I think we still need such an opt-
>>> in interface to tell the TDX module that the VMM is now filtering the CPUID
>>> bits so that the TDX module knows that it's safe to report new host state
>>> clobbering features.
>> Yep. Can we think about what it would look like? Easiest would be a bit passed
>> in TDH_SYS_CONFIG. But then arch/x86 is saying how KVM will behave. Ok to me,
>> for the simplicity. Could come with a nice comment.

Can you just treat current KVM behavior of allowing userspace to enable 
any configurable bits as the bug of KVM and backport this series as 
Binbin suggested below? Instead of introducing more opt-in knobs.

> The TDX module is initialized before KVM is loaded. I guess the upstream kernel
> doesn't support out of tree KVM code, so we can assume if the kernel has the code to
> opt-in the new host state clobbering features, KVM must have implemented the TDX
> CPUID filtering and validation?
> 
> Also, do you think it's reasonable to backport this patch series to stable/LTS
> kernels as an alternative?