Re: [PATCH v4] x86/virt/tdx: Skip TDH.SYS.DISABLE if the TDX module is not initialized

[Edgecombe, Rick P]

On Mon, 2026-11-02 at 15:32 +0800, Challvy Tee wrote:
> Commit 5b25f249be32 ("x86/tdx: Disable the TDX module during kexec and
> kdump") made native_machine_crash_shutdown() call tdx_sys_disable(),
> whose only gate is compile time (CONFIG_INTEL_TDX_HOST).  A kernel that
> never initialized the TDX module therefore still issues
> TDH.SYS.DISABLE.
> 
> In VMX non-root operation on a SEAM-capable host, SEAMCALL causes a VM
> exit instead of a native #UD.  KVM injects #UD only since
> commit 9d7dfb95da2c ("KVM: VMX: Inject #UD if guest tries to execute
> SEAMCALL or TDCALL"), first released in v6.18.  On an older host the
> VMM gets KVM_EXIT_INTERNAL_ERROR and the vCPU never resumes, so
> machine_kexec() is never reached and no vmcore is written.  Kdump is
> thus broken only in guests on SEAM-capable hosts whose hypervisor does
> not handle the exit; plain kexec is unaffected because tdx_shutdown()
> only runs as a syscore op, registered after init_tdx_module() succeeds.
> 
> Gate the SEAMCALL on X86_FEATURE_TDX_HOST_PLATFORM before issuing it,
> the way paddr_is_tdx_private() already guards its own SEAMCALL in this
> file.  Without that feature the module is never initialized, so there
> is nothing to disable; on a TDX host the gate is a no-op.
> 
> It also decouples kdump from the host KVM version -- a guest cannot
> require its host to inject the #UD.
> 
> Fixes: 5b25f249be32 ("x86/tdx: Disable the TDX module during kexec and kdump")
> Suggested-by: Kiryl Shutsemau <kas@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Challvy Tee <challvy.tee@xxxxxxxxx>
> ---

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>