Re: [PATCH v7 18/22] coco/tdx-host: Don't expose P-SEAMLDR features on CPUs with erratum

Edgecombe, Rick P
2026-04-13T19:28:52Z

On Tue, 2026-03-31 at 05:41 -0700, Chao Gao wrote:
> Some TDX-capable CPUs have an erratum, as documented in Intel® Trust
> Domain CPU Architectural Extensions (May 2021 edition) Chapter 2.3:
>
> SEAMRET from the P-SEAMLDR clears the current VMCS structure pointed
> to by the current-VMCS pointer. A VMM that invokes the P-SEAMLDR using
> SEAMCALL must reload the current-VMCS, if required, using the VMPTRLD
> instruction.
>
> Clearing the current VMCS behind KVM's back will break KVM.
>
> This erratum is not present when IA32_VMX_BASIC[60] is set. Add a CPU
> bug bit for this erratum and refuse to expose P-SEAMLDR features (e.g.,
> TDX module updates) on affected CPUs.
>
> == Alternatives ==
> Two workarounds were considered but both were rejected:
>
> 1. Save/restore the current VMCS around P-SEAMLDR calls. This produces ugly
> assembly code [1] and doesn't play well with #MCE or #NMI if they
> need to use the current VMCS.
>
> 2. Move KVM's VMCS tracking logic to the TDX core code, which would break
> the boundary between KVM and the TDX core code [2].
>
> Signed-off-by: Chao Gao <chao.gao@intel.com>
> Reviewed-by: Kai Huang <kai.huang@intel.com>
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> Link: https://lore.kernel.org/kvm/fedb3192-e68c-423c-93b2-a4dc2f964148@intel.com/ # [1]
> Link: https://lore.kernel.org/kvm/aYIXFmT-676oN6j0@google.com/ # [2]

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>

> ---
> arch/x86/include/asm/cpufeatures.h | 1 +
> arch/x86/include/asm/vmx.h | 1 +
> arch/x86/virt/vmx/tdx/tdx.c | 11 +++++++++++
> drivers/virt/coco/tdx-host/tdx-host.c | 8 ++++++++
> 4 files changed, 21 insertions(+)
>
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
> index dbe104df339b..377d009b7e2e 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -572,4 +572,5 @@
> #define X86_BUG_ITS_NATIVE_ONLY X86_BUG( 1*32+ 8) /* "its_native_only" CPU is affected by ITS, VMX is not affected */
> #define X86_BUG_TSA X86_BUG( 1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */
> #define X86_BUG_VMSCAPE X86_BUG( 1*32+10) /* "vmscape" CPU is affected by VMSCAPE attacks from guests */
> +#define X86_BUG_SEAMRET_INVD_VMCS X86_BUG( 1*32+11) /* "seamret_invd_vmcs" SEAMRET from P-SEAMLDR clears the current VMCS */
> #endif /* _ASM_X86_CPUFEATURES_H */
> diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
> index b92ff87e3560..a5a5b373ec42 100644
> --- a/arch/x86/include/asm/vmx.h
> +++ b/arch/x86/include/asm/vmx.h
> @@ -136,6 +136,7 @@
> #define VMX_BASIC_INOUT BIT_ULL(54)
> #define VMX_BASIC_TRUE_CTLS BIT_ULL(55)
> #define VMX_BASIC_NO_HW_ERROR_CODE_CC BIT_ULL(56)
> +#define VMX_BASIC_NO_SEAMRET_INVD_VMCS BIT_ULL(60)
>
> static inline u32 vmx_basic_vmcs_revision_id(u64 vmx_basic)
> {
> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index d144860e17c2..92ab1d98e1b8 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c
> @@ -39,6 +39,7 @@
> #include <asm/cpu_device_id.h>
> #include <asm/processor.h>
> #include <asm/mce.h>
> +#include <asm/vmx.h>
>
> #include "seamcall_internal.h"
> #include "tdx.h"
> @@ -1462,6 +1463,8 @@ static struct notifier_block tdx_memory_nb = {
>
> static void __init check_tdx_erratum(void)
> {
> + u64 basic_msr;
> +
> /*
> * These CPUs have an erratum. A partial write from non-TD
> * software (e.g. via MOVNTI variants or UC/WC mapping) to TDX
> @@ -1473,6 +1476,14 @@ static void __init check_tdx_erratum(void)
> case INTEL_EMERALDRAPIDS_X:
> setup_force_cpu_bug(X86_BUG_TDX_PW_MCE);
> }
> +
> + /*
> + * Some TDX-capable CPUs have an erratum where the current VMCS is
> + * cleared after calling into P-SEAMLDR.
> + */
> + rdmsrq(MSR_IA32_VMX_BASIC, basic_msr);
> + if (!(basic_msr & VMX_BASIC_NO_SEAMRET_INVD_VMCS))
> + setup_force_cpu_bug(X86_BUG_SEAMRET_INVD_VMCS);
> }
>
> void __init tdx_init(void)
> diff --git a/drivers/virt/coco/tdx-host/tdx-host.c b/drivers/virt/coco/tdx-host/tdx-host.c
> index 746a5eef004d..71ea94da8e22 100644
> --- a/drivers/virt/coco/tdx-host/tdx-host.c
> +++ b/drivers/virt/coco/tdx-host/tdx-host.c
> @@ -100,6 +100,14 @@ static bool can_expose_seamldr(void)
> if (!sysinfo)
> return false;
>
> + /*
> + * Calling P-SEAMLDR on CPUs with the seamret_invd_vmcs bug clears
> + * the current VMCS, which breaks KVM. Verify the erratum is not
> + * present before exposing P-SEAMLDR features.
> + */
> + if (boot_cpu_has_bug(X86_BUG_SEAMRET_INVD_VMCS))
> + return false;
> +
> return tdx_supports_runtime_update(sysinfo);
> }
>