Re: [PATCH v4 1/4] KVM: TDX: Track configurable CPUID bits allowed by KVM

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Wed, 2026-09-23 at 08:57 +0800, Binbin Wu wrote:
> > But directly configurable bits don't have any direct conntion to tdcall
> > queried bits. Userspace can still set those to whatever it wants regardless
> > of the allow list. 
> 
> I didn't quite get this.

VE bits don't query the directly configurable bits in any case unless userspace
sets it up that way. So they are not involved in the problem we are trying to
fix here.

> 
> > 
> > So the argument is basically there is not expected to be any reason to allow
> > them, so save the code in the allow list. It's a "there is no point" reason.
> > Makes sense, but I couldn't get that from explanation.
> 
> I think "not just save the code"?
> One argument is that if these bits are reported as allowed to userspace and
> userspace enabled them during init, and the guest doesn't opt-in the #VE
> reduction (KVM doesn't know the real setting), it would cause problem in the
> guest.

Userspace is allowed to cause problems to the guest. We shouldn't try to prevent
it. But here, I think we are saving lines of allowlist in preventing it. So the
reason is to have less allow list lines, not to help userspace. And that is
worth it IMO.