On Thu, Aug 13, 2026 at 04:41:07PM -0700, Edgecombe, Rick P wrote: > On Wed, 2026-07-22 at 23:13 +0000, Lisa Wang wrote: > > From: Sagi Shahar <[email protected]> > > > > Add tdx_init_vm() to handle the mandatory VM-level initialization > > sequence required for Intel TDX. > > > > For TDX, the guest's CPUID configuration must be "sealed" during > > KVM_TDX_INIT_VM before any vCPUs are created. This is necessary because > > the TDX hardware directly virtualizes CPUID and includes the > > configuration in the guest's initial security measurement. > > "TDX hardware" should be TDX module. But I'm not sure what it is trying to say > about directly virtualizes. > > Also, it is not accurate to say that the CPUID configuration is included in > the > measurement? Is that right Peter? It's not in the report, but is it in the > measurement?
CPUID is not in the report or the TDX module's measurement. TD attributes and XFAM are in both the report and initial measurement, and some of the bits in there are related to CPUID (e.g. ATTRIBUTES.PKS or XFAM.MAXPA_VIRT). Probably better to make a distinction between these things. > > Or maybe it doesn't really need to be in the log anyway. > > >
