[PATCH v2] x86/tdx: Harden exports

[PATCH v2] x86/tdx: Harden exports

[Nikolay Borisov]

tdx_* function aren't supposed to be used by the kernel at large, rather
they are mostly used by KVM and a very small number of them are exposed
via the tdx-guest/tdx-host drivers. Reflect this fact in their
EXPORT_SYMBOL* declarations.

Reported-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
---

V2:
 * Drop the change to tdx_kvm_hypercall

 arch/x86/coco/tdx/tdx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index f904a636d449..a38e44401840 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
+EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
 
 /**
  * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
@@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
+EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
 
 /**
  * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
@@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
 	/* Since buf is a shared memory, set the shared (decrypted) bits */
 	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
 }
-EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
+EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
 
 static void __noreturn tdx_panic(const char *msg)
 {
--
2.55.0

Re: [PATCH v2] x86/tdx: Harden exports

[Peter Fang]

On Thu, Sep 17, 2026 at 02:07:14PM +0300, Nikolay Borisov wrote:
> tdx_* function aren't supposed to be used by the kernel at large, rather
> they are mostly used by KVM and a very small number of them are exposed
> via the tdx-guest/tdx-host drivers. Reflect this fact in their

"exposed via" sounds a bit off? Perhaps "exposed to"?

And this patch only touches functions exported to tdx-guest... In fact
tdx-host only uses functions from arch/x86/virt/vmx/tdx/ (guest code vs
host code). Maybe the log could be a bit more precise.

> EXPORT_SYMBOL* declarations.
> 
> Reported-by: Michal Koutný <mkoutny@suse.com>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
> 
> V2:
>  * Drop the change to tdx_kvm_hypercall
> 
>  arch/x86/coco/tdx/tdx.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 

Re: [PATCH v2] x86/tdx: Harden exports

[Nikolay Borisov]

On 18.09.26 г. 12:36 ч., Peter Fang wrote:
> On Thu, Sep 17, 2026 at 02:07:14PM +0300, Nikolay Borisov wrote:
>> tdx_* function aren't supposed to be used by the kernel at large, rather
>> they are mostly used by KVM and a very small number of them are exposed
>> via the tdx-guest/tdx-host drivers. Reflect this fact in their
> 
> "exposed via" sounds a bit off? Perhaps "exposed to"?

What I meant was that the functionality of those functions is exposed 
via the tdx-guest/tdx-host drivers. I.e those drivers present interfaces 
to userspace to enable them to use the functionality of said functions. 
I.e those functions are only used by those drivers.


> 
> And this patch only touches functions exported to tdx-guest... In fact
> tdx-host only uses functions from arch/x86/virt/vmx/tdx/ (guest code vs
> host code). Maybe the log could be a bit more precise.

Fair point.

> 
>> EXPORT_SYMBOL* declarations.
>>
>> Reported-by: Michal Koutný <mkoutny@suse.com>
>> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
>> ---
>>
>> V2:
>>   * Drop the change to tdx_kvm_hypercall
>>
>>   arch/x86/coco/tdx/tdx.c | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>

Re: [PATCH v2] x86/tdx: Harden exports

[Peter Fang]

On Fri, Sep 18, 2026 at 01:03:46PM +0300, Nikolay Borisov wrote:
> 
> 
> On 18.09.26 г. 12:36 ч., Peter Fang wrote:
> > On Thu, Sep 17, 2026 at 02:07:14PM +0300, Nikolay Borisov wrote:
> > > tdx_* function aren't supposed to be used by the kernel at large, rather
> > > they are mostly used by KVM and a very small number of them are exposed
> > > via the tdx-guest/tdx-host drivers. Reflect this fact in their
> > 
> > "exposed via" sounds a bit off? Perhaps "exposed to"?
> 
> What I meant was that the functionality of those functions is exposed via
> the tdx-guest/tdx-host drivers. I.e those drivers present interfaces to
> userspace to enable them to use the functionality of said functions. I.e
> those functions are only used by those drivers.

Ah I see. Maybe a tiny bit of polishing would be enough. Thanks.

> 
> 
> > 
> > And this patch only touches functions exported to tdx-guest... In fact
> > tdx-host only uses functions from arch/x86/virt/vmx/tdx/ (guest code vs
> > host code). Maybe the log could be a bit more precise.
> 
> Fair point.
> 
> > 

Re: [PATCH v2] x86/tdx: Harden exports

[Nikolay Borisov]

On 17.09.26 г. 14:07 ч., Nikolay Borisov wrote:
> tdx_* function aren't supposed to be used by the kernel at large, rather
> they are mostly used by KVM and a very small number of them are exposed
> via the tdx-guest/tdx-host drivers. Reflect this fact in their
> EXPORT_SYMBOL* declarations.
> 
> Reported-by: Michal Koutný <mkoutny@suse.com>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>


Gentle ping

Re: [PATCH v2] x86/tdx: Harden exports

[Kiryl Shutsemau]

On Thu, Sep 17, 2026 at 02:07:14PM +0300, Nikolay Borisov wrote:
> tdx_* function aren't supposed to be used by the kernel at large, rather
> they are mostly used by KVM and a very small number of them are exposed
> via the tdx-guest/tdx-host drivers. Reflect this fact in their
> EXPORT_SYMBOL* declarations.

Subject could be better. Something like "x86/tdx: Restrict attestation
exports to the tdx-guest driver"?

The changelog still talks about KVM and tdx-host. Rewrite it.

> Reported-by: Michal Koutný <mkoutny@suse.com>

Maybe Suggested-by rather than Reported-by? There is no bug here.

> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>

With that fixed you can use my:

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov