From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2762935E558 for ; Thu, 12 Feb 2026 14:36:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.8 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770906982; cv=none; b=a88gYCaEU6bWtdE9V49FuU/Bgn1qfLrZWANWCs/dGjQVbadoDNwJRUtUkfTSWAxVNnarH2MOrTnAWenVoEyYo1nUHVf/Bw8uiFd7atJ6Xcc97aGMESQTu+84Uxs1PGL+9n/f84Hb+jbINK0VOUmUl5dguF0bp4ptFdgjBM36S2M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770906982; c=relaxed/simple; bh=2w/n4WgRXjgVeghR9JMhpN0xb91wx8vFJINQcVtlIN4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rPKR/EImsGVU+zOHLO3kE17XIVpc1/BWPYE0muxrLOVhhceeHRj9E3Z2Nu5JiFFiW0LqEuYQdlzQ/lucoI3RDKchoKIcAIzSGnt9sRpGGypKz5pZ9dgZQgXcoL0TF8XAoAn08Z3spQNpKg+HcT0RA8gdPMooirxepBHEfuvxg1M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=YAiNs3wl; arc=none smtp.client-ip=192.198.163.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="YAiNs3wl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1770906981; x=1802442981; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2w/n4WgRXjgVeghR9JMhpN0xb91wx8vFJINQcVtlIN4=; b=YAiNs3wlgAKUQcGpl9bc7XrGsjhTSeYNCStRPbF/OE+JadIyN2DPy+4R 0uVUi3lfMZgb6dOz+LdAKNfe4aREmfdum9rgzkf9eqMYGa9bB+ojan8en gRwiErspeL0/pI1/qRPYPOzWRLV1BM6vuaTgf10FPGBG6kZPR64V41DVE QGXGm0iAu3bQ6dcmsaKndvB0ZoUqWq2douoRInbecCVtEQA1cDfxbRoGg UbYA28fqkJEYI2OrYCA3mKpF16Gl7FxyKVcKRUkesnK9joyZLkM1wtA1W 9vP1/cQMt8sYap3euxeiedldTcvh89eD88Pve0eJsE4p0EtcWHRlot25k g==; X-CSE-ConnectionGUID: NLGZQ8xQSiqCYIO89KEO9A== X-CSE-MsgGUID: c4dObqB0R5WB8Lti7TJ2kg== X-IronPort-AV: E=McAfee;i="6800,10657,11699"; a="89662811" X-IronPort-AV: E=Sophos;i="6.21,286,1763452800"; d="scan'208";a="89662811" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Feb 2026 06:36:20 -0800 X-CSE-ConnectionGUID: w2WA76lASOid76bByge6hA== X-CSE-MsgGUID: WDPwiLdXQJKbFxEsSdpo7A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.21,286,1763452800"; d="scan'208";a="211428245" Received: from 984fee019967.jf.intel.com ([10.23.153.244]) by fmviesa006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Feb 2026 06:36:19 -0800 From: Chao Gao To: linux-coco@lists.linux.dev, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, x86@kernel.org Cc: reinette.chatre@intel.com, ira.weiny@intel.com, kai.huang@intel.com, dan.j.williams@intel.com, yilun.xu@linux.intel.com, sagis@google.com, vannapurve@google.com, paulmck@kernel.org, nik.borisov@suse.com, zhenzhong.duan@intel.com, seanjc@google.com, rick.p.edgecombe@intel.com, kas@kernel.org, dave.hansen@linux.intel.com, vishal.l.verma@intel.com, binbin.wu@linux.intel.com, tony.lindgren@linux.intel.com, Chao Gao , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" Subject: [PATCH v4 09/24] x86/virt/seamldr: Check update limit before TDX Module updates Date: Thu, 12 Feb 2026 06:35:12 -0800 Message-ID: <20260212143606.534586-10-chao.gao@intel.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260212143606.534586-1-chao.gao@intel.com> References: <20260212143606.534586-1-chao.gao@intel.com> Precedence: bulk X-Mailing-List: linux-coco@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit TDX maintains a log about each TDX Module which has been loaded. This log has a finite size which limits the number of TDX Module updates which can be performed. After each successful update, the remaining updates reduces by one. Once it reaches zero, further updates will fail until next reboot. Before updating the TDX Module, verify that the update limit has not been exceeded. Otherwise, P-SEAMLDR will detect this violation after the old TDX Module is gone and all TDs will be killed. Note that userspace should perform this check before updates. Perform this check in kernel as well to make the update process more robust. Signed-off-by: Chao Gao Reviewed-by: Tony Lindgren --- arch/x86/virt/vmx/tdx/seamldr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/virt/vmx/tdx/seamldr.c b/arch/x86/virt/vmx/tdx/seamldr.c index 694243f1f220..733b13215691 100644 --- a/arch/x86/virt/vmx/tdx/seamldr.c +++ b/arch/x86/virt/vmx/tdx/seamldr.c @@ -52,6 +52,16 @@ EXPORT_SYMBOL_FOR_MODULES(seamldr_get_info, "tdx-host"); */ int seamldr_install_module(const u8 *data, u32 size) { + struct seamldr_info info; + int ret; + + ret = seamldr_get_info(&info); + if (ret) + return ret; + + if (!info.num_remaining_updates) + return -ENOSPC; + if (WARN_ON_ONCE(!is_vmalloc_addr(data))) return -EINVAL; -- 2.47.3