Re: [PATCH v2 00/21] Runtime TDX Module update support

[Sagi Shahar]

On Wed, Nov 19, 2025 at 8:47 PM Chao Gao <chao.gao@xxxxxxxxx> wrote:
>
> On Wed, Nov 19, 2025 at 04:44:50PM -0600, Sagi Shahar wrote:
> >On Thu, Oct 30, 2025 at 9:53 PM Chao Gao <chao.gao@xxxxxxxxx> wrote:
> >>
> >> >A reference patch we tested for "Avoid updates during update-sensitive
> >> >times" and one caveat was that
> >> >/sys/devices/virtual/tdx/tdx_tsm/version was not available post update
> >> >failure until a subsequent successful update:
> >>
> >> I also tested this. It works well to prevent updates during TD build, so,
> >>
> >>   Tested-by: Chao Gao <chao.gao@xxxxxxxxx>
> >>
> >> And I can integrate this change into my next version if you don't object.
> >>
> >> Regarding the caveat, could you check if the diff [*] I posted earlier this
> >> week can fix it?
> >>
> >> [1]: https://lore.kernel.org/linux-coco/aQAwRrvYMcaMsu02@xxxxxxxxx/
> >
> >[Now in plaintext]
> >
> >I tried testing it with the 1.5.24 TDX module and it sometimes fails,
> >but the failure does not appear consistent.
> >
> >I added a local change to add the
> >TDX_SYS_SHUTDOWN_AVOID_COMPAT_SENSITIVE flag when calling
> >TDH_SYS_SHUTDOWN and TDH_SYS_SHUTDOWN fails as expected if a VM is
> >under build:
> >[ 1224.571177] virt/tdx: SEAMCALL (52) failed: 0x8000051200010000
> >
> >But then sometimes trying to finalize the VM fail with the following error:
> >[ 1230.915145] kvm_intel: SEAMCALL TDH_MR_FINALIZE failed: 0x8000ff00ffff0000
> >[ 1230.948264] kvm_intel: tdh_mng_vpflushdone() failed. HKID 3 is leaked.
> >
> >At this point the module seems to be in a broken state and trying to
> >create more TDs will fail:
> >[ 1543.745606] kvm_intel: SEAMCALL TDH_MNG_CREATE failed: 0x8000ff00ffff0000
> >
> >Trying to update the module will fail shutdown with -ENODEV
>
> Can you apply this incremental change to see if the issue gets fixed?
>
> diff --git a/arch/x86/virt/vmx/tdx/seamldr.c b/arch/x86/virt/vmx/tdx/seamldr.c
> index e525bbd16610..f0bea1fecc52 100644
> --- a/arch/x86/virt/vmx/tdx/seamldr.c
> +++ b/arch/x86/virt/vmx/tdx/seamldr.c
> @@ -317,8 +317,9 @@ static int do_seamldr_install_module(void *params)
>                                         tdx_module_set_error();
>                                         print_update_failure_message();
>                                 }
> +                       } else {
> +                               ack_state();
>                         }
> -                       ack_state();
>                 } else {
>                         touch_nmi_watchdog();
>                         rcu_momentary_eqs();
>
>
> The problem is if the failing CPU is the last one to ack the TDP_SHUTDOWN
> state, the state will move to TDP_CPU_INSTALL state. Other CPUs may proceed to
> install the new module before seeing tdp_data.failed. This disables TDX ISA, so
> any subsequent SEAMCALLs get 0x8000ff00ffff0000.

Thanks, I ran a couple dozen updates while TD was being built and
couldn't reproduce the issue with the new fix