Re: [PATCH] x86/tdx: Harden exports

[Xiaoyao Li <xiaoyao.li@intel.com>]

+ Peter,

On 9/11/2026 7:31 PM, Nikolay Borisov wrote:
> tdx_* function aren't supposed to be used by the kernel at large, rather
> they are mostly used by KVM and a very small number of them are exposed
> via the tdx-guest/tdx-host drivers. Reflect this fact in their
> EXPORT_SYMBOL* declarations.

we found this and discussed it in [1]. It was left to Peter's todo list.
Glad to see you do it earlier.

[1] https://lore.kernel.org/all/cdb43316-6535-4f11-9fb0-abdf2adf4568@intel.com/

> Reported-by: Michal Koutný <mkoutny@suse.com>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
>  arch/x86/coco/tdx/tdx.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> index f904a636d449..3055a76c0dfd 100644
> --- a/arch/x86/coco/tdx/tdx.c
> +++ b/arch/x86/coco/tdx/tdx.c
> @@ -64,7 +64,7 @@ long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, unsigned long p2,
>  
>  	return __tdx_hypercall(&args);
>  }
> -EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
> +EXPORT_SYMBOL_FOR_KVM(tdx_kvm_hypercall);

tdx_kvm_hypecall() is used by kvm_hypercall{0,1,2,3,4}, which are not used by
KVM modules, but used by guest kernel code when running as a KVM guest.

It seems the reason we need to export is kvm_arch_ptp_init() calls
kvm_hypercall2() and kvm_arch_ptp_init() can be called by guest-side PTP module.

>  #endif
>  
>  /*
> @@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
>  
>  	return 0;
>  }
> -EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
>  
>  /**
>   * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
> @@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
>  
>  	return 0;
>  }
> -EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
>  
>  /**
>   * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
> @@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
>  	/* Since buf is a shared memory, set the shared (decrypted) bits */
>  	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
>  }
> -EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
>  
>  static void __noreturn tdx_panic(const char *msg)
>  {