After shutting down the running TDX module, the next step is to install the
new TDX Module supplied by userspace.

P-SEAMLDR provides the SEAMLDR.INSTALL SEAMCALL for that. The SEAMCALL
accepts the seamldr_params struct and should be called serially on all
CPUs.

Invoke the SEAMLDR.INSTALL SEAMCALL serially on all CPUs and add a new
spinlock to enforce serialization.

Signed-off-by: Chao Gao <chao.gao@intel.com>
Tested-by: Farrah Chen <farrah.chen@intel.com>
---
 arch/x86/virt/vmx/tdx/seamldr.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/x86/virt/vmx/tdx/seamldr.c b/arch/x86/virt/vmx/tdx/seamldr.c
index a5aff04a85b9..1bb4ae5ccb0a 100644
--- a/arch/x86/virt/vmx/tdx/seamldr.c
+++ b/arch/x86/virt/vmx/tdx/seamldr.c
@@ -13,6 +13,7 @@
 #include <linux/mm.h>
 #include <linux/nmi.h>
 #include <linux/slab.h>
+#include <linux/spinlock.h>
 #include <linux/stop_machine.h>
 #include <linux/types.h>
 
@@ -23,6 +24,7 @@
 
 /* P-SEAMLDR SEAMCALL leaf function */
 #define P_SEAMLDR_INFO			0x8000000000000000
+#define P_SEAMLDR_INSTALL		0x8000000000000001
 
 /* P-SEAMLDR can accept up to 496 4KB pages for TDX module binary */
 #define SEAMLDR_MAX_NR_MODULE_4KB_PAGES	496
@@ -45,6 +47,7 @@ struct seamldr_params {
 } __packed;
 
 static struct seamldr_info seamldr_info __aligned(256);
+static DEFINE_RAW_SPINLOCK(seamldr_lock);
 
 static inline int seamldr_call(u64 fn, struct tdx_module_args *args)
 {
@@ -231,6 +234,7 @@ static struct seamldr_params *init_seamldr_params(const u8 *data, u32 size)
 enum tdp_state {
 	TDP_START,
 	TDP_SHUTDOWN,
+	TDP_CPU_INSTALL,
 	TDP_DONE,
 };
 
@@ -278,6 +282,7 @@ static void print_update_failure_message(void)
  */
 static int do_seamldr_install_module(void *params)
 {
+	struct tdx_module_args args = { .rcx = __pa(params) };
 	enum tdp_state newstate, curstate = TDP_START;
 	int cpu = smp_processor_id();
 	bool primary;
@@ -297,6 +302,10 @@ static int do_seamldr_install_module(void *params)
 				if (primary)
 					ret = tdx_module_shutdown();
 				break;
+			case TDP_CPU_INSTALL:
+				scoped_guard(raw_spinlock, &seamldr_lock)
+					ret = seamldr_call(P_SEAMLDR_INSTALL, &args);
+				break;
 			default:
 				break;
 			}
-- 
2.47.3

>  static int do_seamldr_install_module(void *params)
>  {
> +	struct tdx_module_args args = { .rcx = __pa(params) };

Is it better we put the definition, or at least the value assignment in
case TDP_CPU_INSTALL? This pattern always appears here for a seamcall
wrapper but this function is far more complex than that.

And the .rcx = __pa(params) also confuse me a bit. Better we name it
e.g. seamldr_params which looks reasonable for seamcall arguments.

>  	enum tdp_state newstate, curstate = TDP_START;
>  	int cpu = smp_processor_id();
>  	bool primary;
> @@ -297,6 +302,10 @@ static int do_seamldr_install_module(void *params)
>  				if (primary)
>  					ret = tdx_module_shutdown();
>  				break;
> +			case TDP_CPU_INSTALL:
> +				scoped_guard(raw_spinlock, &seamldr_lock)
> +					ret = seamldr_call(P_SEAMLDR_INSTALL, &args);
> +				break;
>  			default:
>  				break;
>  			}
> -- 
> 2.47.3
>

On Thu, Jan 15, 2026 at 02:15:31PM +0800, Xu Yilun wrote:
>>  static int do_seamldr_install_module(void *params)
>>  {
>> +	struct tdx_module_args args = { .rcx = __pa(params) };
>
>Is it better we put the definition, or at least the value assignment in
>case TDP_CPU_INSTALL? This pattern always appears here for a seamcall
>wrapper but this function is far more complex than that.
>
>And the .rcx = __pa(params) also confuse me a bit. Better we name it
>e.g. seamldr_params which looks reasonable for seamcall arguments.

Sounds good. I will do the following changes:

diff --git a/arch/x86/virt/vmx/tdx/seamldr.c b/arch/x86/virt/vmx/tdx/seamldr.c
index a0b59d6c53c9..f2933c7e3852 100644
--- a/arch/x86/virt/vmx/tdx/seamldr.c
+++ b/arch/x86/virt/vmx/tdx/seamldr.c
@@ -313,10 +313,10 @@ static void print_update_failure_message(void)
  * See multi_cpu_stop() from where this multi-cpu state-machine was
  * adopted, and the rationale for touch_nmi_watchdog()
  */
-static int do_seamldr_install_module(void *params)
+static int do_seamldr_install_module(void *seamldr_params)
 {
-	struct tdx_module_args args = { .rcx = __pa(params) };
	enum tdp_state newstate, curstate = TDP_START;
+	struct tdx_module_args args = {};
	int cpu = smp_processor_id();
	bool primary;
	int ret = 0;
@@ -336,6 +336,7 @@ static int do_seamldr_install_module(void *params)
					ret = tdx_module_shutdown();
				break;
			case TDP_CPU_INSTALL:
+				args.rcx = __pa(seamldr_params);
				scoped_guard(raw_spinlock, &seamldr_lock)
					ret = seamldr_call(P_SEAMLDR_INSTALL, &args);
				break;