Re: [PATCH v7 18/22] coco/tdx-host: Don't expose P-SEAMLDR features on CPUs with erratum

[Edgecombe, Rick P]

On Tue, 2026-03-31 at 05:41 -0700, Chao Gao wrote:
> Some TDX-capable CPUs have an erratum, as documented in Intel® Trust
> Domain CPU Architectural Extensions (May 2021 edition) Chapter 2.3:
> 
>   SEAMRET from the P-SEAMLDR clears the current VMCS structure pointed
>   to by the current-VMCS pointer. A VMM that invokes the P-SEAMLDR using
>   SEAMCALL must reload the current-VMCS, if required, using the VMPTRLD
>   instruction.
> 
> Clearing the current VMCS behind KVM's back will break KVM.
> 
> This erratum is not present when IA32_VMX_BASIC[60] is set. Add a CPU
> bug bit for this erratum and refuse to expose P-SEAMLDR features (e.g.,
> TDX module updates) on affected CPUs.
> 
> == Alternatives ==
> Two workarounds were considered but both were rejected:
> 
> 1. Save/restore the current VMCS around P-SEAMLDR calls. This produces ugly
>    assembly code [1] and doesn't play well with #MCE or #NMI if they
>    need to use the current VMCS.
> 
> 2. Move KVM's VMCS tracking logic to the TDX core code, which would break
>    the boundary between KVM and the TDX core code [2].
> 
> Signed-off-by: Chao Gao <chao.gao@xxxxxxxxx>
> Reviewed-by: Kai Huang <kai.huang@xxxxxxxxx>
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> Link: https://lore.kernel.org/kvm/fedb3192-e68c-423c-93b2-a4dc2f964148@xxxxxxxxx/ # [1]
> Link: https://lore.kernel.org/kvm/aYIXFmT-676oN6j0@xxxxxxxxxx/ # [2]

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>

> ---
>  arch/x86/include/asm/cpufeatures.h    |  1 +
>  arch/x86/include/asm/vmx.h            |  1 +
>  arch/x86/virt/vmx/tdx/tdx.c           | 11 +++++++++++
>  drivers/virt/coco/tdx-host/tdx-host.c |  8 ++++++++
>  4 files changed, 21 insertions(+)
> 
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
> index dbe104df339b..377d009b7e2e 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -572,4 +572,5 @@
>  #define X86_BUG_ITS_NATIVE_ONLY		X86_BUG( 1*32+ 8) /* "its_native_only" CPU is affected by ITS, VMX is not affected */
>  #define X86_BUG_TSA			X86_BUG( 1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */
>  #define X86_BUG_VMSCAPE			X86_BUG( 1*32+10) /* "vmscape" CPU is affected by VMSCAPE attacks from guests */
> +#define X86_BUG_SEAMRET_INVD_VMCS	X86_BUG( 1*32+11) /* "seamret_invd_vmcs" SEAMRET from P-SEAMLDR clears the current VMCS */
>  #endif /* _ASM_X86_CPUFEATURES_H */
> diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
> index b92ff87e3560..a5a5b373ec42 100644
> --- a/arch/x86/include/asm/vmx.h
> +++ b/arch/x86/include/asm/vmx.h
> @@ -136,6 +136,7 @@
>  #define VMX_BASIC_INOUT				BIT_ULL(54)
>  #define VMX_BASIC_TRUE_CTLS			BIT_ULL(55)
>  #define VMX_BASIC_NO_HW_ERROR_CODE_CC		BIT_ULL(56)
> +#define VMX_BASIC_NO_SEAMRET_INVD_VMCS		BIT_ULL(60)
>  
>  static inline u32 vmx_basic_vmcs_revision_id(u64 vmx_basic)
>  {
> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index d144860e17c2..92ab1d98e1b8 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c
> @@ -39,6 +39,7 @@
>  #include <asm/cpu_device_id.h>
>  #include <asm/processor.h>
>  #include <asm/mce.h>
> +#include <asm/vmx.h>
>  
>  #include "seamcall_internal.h"
>  #include "tdx.h"
> @@ -1462,6 +1463,8 @@ static struct notifier_block tdx_memory_nb = {
>  
>  static void __init check_tdx_erratum(void)
>  {
> +	u64 basic_msr;
> +
>  	/*
>  	 * These CPUs have an erratum.  A partial write from non-TD
>  	 * software (e.g. via MOVNTI variants or UC/WC mapping) to TDX
> @@ -1473,6 +1476,14 @@ static void __init check_tdx_erratum(void)
>  	case INTEL_EMERALDRAPIDS_X:
>  		setup_force_cpu_bug(X86_BUG_TDX_PW_MCE);
>  	}
> +
> +	/*
> +	 * Some TDX-capable CPUs have an erratum where the current VMCS is
> +	 * cleared after calling into P-SEAMLDR.
> +	 */
> +	rdmsrq(MSR_IA32_VMX_BASIC, basic_msr);
> +	if (!(basic_msr & VMX_BASIC_NO_SEAMRET_INVD_VMCS))
> +		setup_force_cpu_bug(X86_BUG_SEAMRET_INVD_VMCS);
>  }
>  
>  void __init tdx_init(void)
> diff --git a/drivers/virt/coco/tdx-host/tdx-host.c b/drivers/virt/coco/tdx-host/tdx-host.c
> index 746a5eef004d..71ea94da8e22 100644
> --- a/drivers/virt/coco/tdx-host/tdx-host.c
> +++ b/drivers/virt/coco/tdx-host/tdx-host.c
> @@ -100,6 +100,14 @@ static bool can_expose_seamldr(void)
>  	if (!sysinfo)
>  		return false;
>  
> +	/*
> +	 * Calling P-SEAMLDR on CPUs with the seamret_invd_vmcs bug clears
> +	 * the current VMCS, which breaks KVM. Verify the erratum is not
> +	 * present before exposing P-SEAMLDR features.
> +	 */
> +	if (boot_cpu_has_bug(X86_BUG_SEAMRET_INVD_VMCS))
> +		return false;
> +
>  	return tdx_supports_runtime_update(sysinfo);
>  }
>