Re: [PATCH v3 0/4] KVM: TDX: Validate directly configurable CPUID bits

[Artem Bityutskiy]

Hi Binbin,

On Thu, 2026-08-27 at 11:18 +0800, Binbin Wu wrote:
> 
> Specifically, this series builds a KVM-side allowlist of supported TDX
> directly configurable CPUID bits to:
>  - Filter KVM_TDX_CAPABILITIES
>    Replace the hardcoded denylist to only report configurable bits that
>    KVM explicitly supports.
>  - Validate KVM_TDX_INIT_VM
>    Reject any configurable bit that the TDX module allows but KVM does
>    not support, as well as CPUID entries with an unexpected subleaf.

Today's denylist only rejects TSX and WAITPKG. Everything else is allowed.

Obviously, the TDX module allows directly setting virtual CPUID values
only for a subset of CPUID leaves, not all of them. So "everything else"
above is that subset minus TSX and WAITPKG.

My question is: is there a feature in that "everything else" that
causes host state clobbering today?

In other words, does this patch only build the infrastructure for
addressing future clobbering issues, or does it also fix a specific
bug?

Thanks!