Re: [PATCH 1/2] KVM: TDX: Enable Notify VM exit

[Sean Christopherson <seanjc@google.com>]

+Chang

On Thu, Aug 06, 2026, Nikolay Borisov wrote:
> On 8/5/26 06:12, Xiaoyao Li wrote:
> > Enable Notify VM exit functionality for TDX guests.
> > 
> > Notify VM exit is an existing feature supported by KVM. Userspace can
> > enable Notify VM exit through KVM_CAP_X86_NOTIFY_VMEXIT when it's
> > reported as supported. However, KVM reports the support of this CAP just
> > based on the hardware capability but doesn't differentiate between VMX
> > and TDX. This leads to the issue that userspace can enable this cap for
> > TDX guests without getting an error, but the feature is not actually
> > enabled because KVM doesn't call the TDX module API to program the
> > relevant TD VMCS fields.
> > 
> > Enable Notify VM exit for TDX guests by:
> > 
> >    - Invoking TDX module API calls to set NOTIFY_VM_EXITING and Notify
> >      Window in TD VMCS. It's done in tdx_vcpu_init() where other TD VMCS
> >      bits are set. Since TDX vCPU cannot be reset, it only needs to be
> >      configured once when initializing the TDX vCPU.
> > 
> >    - Adding corresponding exit handler for TDX Notify VM Exit.
> 
> 
> nit: That feature is completely misnamed in the kernel.

Well that's bloody annoying.  The feature was called "NOTIFY VM EXIT" in the
December 2022 version of the ISE, but indeed is called Instruction Timeout in
the March 2023 versio of the SDM.  Intel isn't exactly building a stellar track
record with ISE publications...

Chang, please forward this to the right people as well.  Changing the name of a
feature isn't the end of the world, but things like this add friction and make
it quite clear that ISEs are very much "pre-production" drafts.  Which is totally
fine, and there is most definitely value in publishing early drafts of features,
but it means I'm going to be very hesitant to merge features in advance of them
being formally defined in the SDM.

> It should be instruction timeout (as is in the SDM). Please reword the
> changelog to refer to the name of the features as they are in the SDM. I.e if
> you search for NOTIFY_VMEXIT or NOTIFY_WINDOW absolutely nothing can be found
> in the SDM.  The changelog should ideally mention both - SDM's nomenclature
> and linux's nomenclature.

No, let's change Linux's nomenclature before merging this, "Notify" was always
vague and confusing.  It's unfortunate that we let that bleed into uAPI headers,
but we can simply #define aliases (or just force userspace to update as well, if
they use kernel headers directly).