Re: [PATCH v3 0/4] KVM: TDX: Validate directly configurable CPUID bits

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 9/1/2026 5:42 PM, Xiaoyao Li wrote:
> On 8/31/2026 1:01 PM, Binbin Wu wrote:
>>>> So if the approach in this series is taken, I think we still need 
>>>> such an opt-
>>>> in interface to tell the TDX module that the VMM is now filtering 
>>>> the CPUID
>>>> bits so that the TDX module knows that it's safe to report new host 
>>>> state
>>>> clobbering features.
>>> Yep. Can we think about what it would look like? Easiest would be a 
>>> bit passed
>>> in TDH_SYS_CONFIG. But then arch/x86 is saying how KVM will behave. 
>>> Ok to me,
>>> for the simplicity. Could come with a nice comment.
> 
> Can you just treat current KVM behavior of allowing userspace to enable 

well, I meant "can we"...

> any configurable bits as the bug of KVM and backport this series as 
> Binbin suggested below? Instead of introducing more opt-in knobs.
> 
>> The TDX module is initialized before KVM is loaded. I guess the 
>> upstream kernel
>> doesn't support out of tree KVM code, so we can assume if the kernel 
>> has the code to
>> opt-in the new host state clobbering features, KVM must have 
>> implemented the TDX
>> CPUID filtering and validation?
>>
>> Also, do you think it's reasonable to backport this patch series to 
>> stable/LTS
>> kernels as an alternative?
>