Re: [PATCH v3 5/6] x86/virt/tdx: Re-initialize the extensions on runtime TDX module update

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] virt/tdx: stale boot metadata breaks TDX extension initialization
--

commit c0a5cf03ba530712949cf538278d0905890ebf56
Author: Xu Yilun <yilun.xu@linux.intel.com>

x86/virt/tdx: Re-initialize the extensions on runtime TDX module update

This commit introduces a mechanism to re-initialize TDX module extensions
during a runtime update. It intentionally skips memory reallocation, expecting
the TDH.EXT.INIT call to fail if the updated extensions require more memory
than what was originally allocated at boot.

> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c

[ ... ]

> +/*
> + * Don't update the memory requirement metadata or try memory allocation in
> + * stop_machine(). If an incompatible update requires more memory, let the
> + * extensions re-initialization fail.
> + */
> +static int reinit_tdx_module_extensions(void)
> +{
> +	if (!(tdx_sysinfo.features.tdx_features0 & TDX_FEATURES0_EXT))
> +		return 0;
> +
> +	return tdx_ext_init();
> +}

[Severity: High]
Will this logic use stale boot-time metadata to skip a mandatory
initialization step for updated modules that introduce extension support?

reinit_tdx_module_extensions() unconditionally reads from
tdx_sysinfo.features.tdx_features0. This struct is populated during boot
initialization.

If an administrator installs a TDX module update where the new firmware
introduces extension support, this check will incorrectly evaluate to 0 and
skip tdx_ext_init().

When a new module adds extension support, it transitions to a pending
initialization state after TDH.SYS.UPDATE and explicitly requires
TDH.EXT.INIT. By returning 0 (success) here, the kernel proceeds as if
the module is fully initialized.

The hardware is left trapped in an intermediate state, which will cause all
subsequent SEAMCALLs to fail and active or new TDs to crash. Conversely,
if an update removes extension support, the kernel will incorrectly attempt
TDH.EXT.INIT and fail the update.

Should the kernel dynamically read the new module's feature bit via
TDH.SYS.RD after the update to accurately determine if TDH.EXT.INIT
is required?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006-tdx-module-ext-v3-0-db52cb05b918@linux.intel.com?part=5