Re: [PATCH] x86/tdx: Harden exports

[Peter Fang <peter.fang@intel.com>]

On Fri, Sep 11, 2026 at 05:19:36PM +0300, Nikolay Borisov wrote:
> 
> > > 
> > > diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> > > index f904a636d449..3055a76c0dfd 100644
> > > --- a/arch/x86/coco/tdx/tdx.c
> > > +++ b/arch/x86/coco/tdx/tdx.c
> > > @@ -64,7 +64,7 @@ long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, unsigned long p2,
> > >   	return __tdx_hypercall(&args);
> > >   }
> > > -EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
> > > +EXPORT_SYMBOL_FOR_KVM(tdx_kvm_hypercall);
> > 
> > tdx_kvm_hypecall() is used by kvm_hypercall{0,1,2,3,4}, which are not used by
> > KVM modules, but used by guest kernel code when running as a KVM guest.
> > 
> > It seems the reason we need to export is kvm_arch_ptp_init() calls
> > kvm_hypercall2() and kvm_arch_ptp_init() can be called by guest-side PTP module.
> 
> 
> So what do you suggest the correct export is?

I agree with Xiaoyao here - EXPORT_SYMBOL_FOR_KVM() isn't the right fit.
And the tricky part is that a lot of it is used by arch/x86/kernel/kvm.c
(e.g. kvm_kick_cpu()), which can't be built as a kernel module.

EXPORT_SYMBOL_FOR_MODULES(tdx_kvm_hypercall, "ptp_kvm") probably will
get you to build, but I think this would be going in a wrong direction.

So... Probably leave it as is?

The remaining EXPORT_SYMBOL_FOR_MODULES(..., "tdx-guest") changes look
good to me though.

> 
> > 
> > >   #endif
> > >   /*
> > > @@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
> > >   	return 0;
> > >   }
> > > -EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
> > > +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
> > >   /**
> > >    * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
> > > @@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
> > >   	return 0;
> > >   }
> > > -EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
> > > +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
> > >   /**
> > >    * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
> > > @@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
> > >   	/* Since buf is a shared memory, set the shared (decrypted) bits */
> > >   	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
> > >   }
> > > -EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
> > > +EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
> > >   static void __noreturn tdx_panic(const char *msg)
> > >   {
> > 
>