Re: [PATCH v2] vmx: Handle TDX instruction exit reasons

[Jan Beulich <jbeulich@xxxxxxxx>]

On 10.09.2026 16:17, Teddy Astie wrote:
> On hardware that supports TDX, guests can cause VMEXIT related to
> TDX instructions (SEAMCALL and TDCALL) regardless of VMCS configuration.

Can they? SEAMCALL pseudocode has

ELSIF IA32_SEAMRR_MASK.VALID = 0 or events blocked by MOV SS
THEN #GP(0);
ELSIF SEAM is globally disabled
THEN VMFailInvalid;

For TDCALL I see

IF not in SEAM non-root operation and not in VMX non-root operation
THEN #UD;

which may indeed not be sufficient, but the SEAMCALL conditions shouldn't
be met under present Xen?

Jan