Re: [PATCH v3 1/4] KVM: TDX: Track configurable CPUID bits allowed by KVM

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 9/10/2026 7:18 AM, Edgecombe, Rick P wrote:
> On Wed, 2026-09-09 at 15:29 -0700, Sean Christopherson wrote:
>>   Yeah, *ideally* we'd magically enable everything everywhere all at once.  In
>> reality, different VM types are going to support features at different times. 
>> More importantly, as Xiaoyao points out below in #1, unless we enable
>> everyting in a single patch, which is probably a terrible idea in most cases,
>> we'll still end up with staged/progressive enabling, i.e. we still need to
>> have patches that selectively enable and advertise a feature only for the VM
>> types that actually support the feature.
>>
>> This is all quite similar to Intel and AMD feature enabling being done at
>> different times.  The biggest difference is that Intel and AMD are mutually
>> exclusive and so KVM_GET_SUPPORTED_CPUID always reports the correct
>> information, but TDX already provides KVM_TDX_CAPABILITIES, so AFAICT we still
>> get accurate reporting for TDX, just in a slightly different way.
> I think this actually surfaces another problem with TD-first enabling.
> KVM_TDX_CAPABILITIES only returns the directly configurable bits. Then recall,
> KVM_TDX_GET_CPUID returns the actual TDX module's view of CPUID bits to
> userspace. Then userspace calls KVM_SET_CPUID to actually put them on KVM's vcpu
> so they can match between Qemu, KVM and TDX
> 
> So if a bit is enabled for KVM_TDX_CAPABILITIES, but not yet in
> KVM_GET_SUPPORTED_CPUID. How should userspace interpret KVM_GET_SUPPORTED_CPUID?
> It can ignore it for TDX, but that is how it can find the PV bits today.>
> If we have a TD first feature, it could be a documentation update on how to
> interpret it. Or we could stuff the PV bits somewhere else for TDX and say to
> ignore KVM_GET_SUPPORTED_CPUID for TDX. I think we don't need to solve it before
> we begin filtering like this series has.

The PV bits reported in KVM_GET_SUPPORTED_CPUID are the bits supported for
non-TDX VMs. Only some of them are actually supported for TDX. I would suggest
reporting TDX supported PV CPUIDs in KVM_TDX_CAPABILITIES as well.