On 6/7/23 17:51, Huang, Kai wrote: > How about I add below to the changelog? > > " > The current TDX_MODULE_CALL macro handles neither #GP nor #UD. The kernel would > hit Oops if SEAMCALL were mistakenly made when TDX is enabled by the BIOS or > when CPU isn't in VMX operation. For the former, the callers could check > platform_tdx_enabled() first, although that doesn't rule out the buggy BIOS in > which case the kernel could still get Oops. For the latter, the caller could > check CR4.VMXE based on the fact that currently setting this bit and doing VMXON > are done together when IRQ is disabled, although from hardware's perspective > checking CR4.VMXE isn't enough. > > However this could be problematic if SEAMCALL is called in the cases such as > exception handler, NMI handler, etc, as disabling IRQ doesn't prevent any of > them from happening. > > To have a clean solution, just make the SEAMCALL always return error code by > using EXTTABLE so the SEAMCALL can be safely called in any context. A later > patch will need to use SEAMCALL in the machine check handler. There might be > such use cases in the future too. > " No, that's just word salad. SEAMCALL is like VMRESUME. It's will be called by KVM in unsafe (VMX off) contexts in normal operation like "reboot -f". That means it needs an exception handler for #UD(???). I don't care if a bad BIOS can cause #GP. Bad BIOS == oops. You can argue that even if I don't care, it's worth having a nice error message and a common place for SEAMCALL error handling. But it's not functionally needed.
