[PATCH] x86/tdx: Harden exports

[PATCH] x86/tdx: Harden exports

[Nikolay Borisov]

tdx_* function aren't supposed to be used by the kernel at large, rather
they are mostly used by KVM and a very small number of them are exposed
via the tdx-guest/tdx-host drivers. Reflect this fact in their
EXPORT_SYMBOL* declarations.

Reported-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
---
 arch/x86/coco/tdx/tdx.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index f904a636d449..3055a76c0dfd 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -64,7 +64,7 @@ long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, unsigned long p2,
 
 	return __tdx_hypercall(&args);
 }
-EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
+EXPORT_SYMBOL_FOR_KVM(tdx_kvm_hypercall);
 #endif
 
 /*
@@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
+EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
 
 /**
  * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
@@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
+EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
 
 /**
  * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
@@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
 	/* Since buf is a shared memory, set the shared (decrypted) bits */
 	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
 }
-EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
+EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
 
 static void __noreturn tdx_panic(const char *msg)
 {
-- 
2.55.0

Re: [PATCH] x86/tdx: Harden exports

[Xiaoyao Li]

+ Peter,

On 9/11/2026 7:31 PM, Nikolay Borisov wrote:
> tdx_* function aren't supposed to be used by the kernel at large, rather
> they are mostly used by KVM and a very small number of them are exposed
> via the tdx-guest/tdx-host drivers. Reflect this fact in their
> EXPORT_SYMBOL* declarations.

we found this and discussed it in [1]. It was left to Peter's todo list.
Glad to see you do it earlier.

[1] https://lore.kernel.org/all/cdb43316-6535-4f11-9fb0-abdf2adf4568@intel.com/

> Reported-by: Michal Koutný <mkoutny@suse.com>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
>  arch/x86/coco/tdx/tdx.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> index f904a636d449..3055a76c0dfd 100644
> --- a/arch/x86/coco/tdx/tdx.c
> +++ b/arch/x86/coco/tdx/tdx.c
> @@ -64,7 +64,7 @@ long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, unsigned long p2,
>  
>  	return __tdx_hypercall(&args);
>  }
> -EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
> +EXPORT_SYMBOL_FOR_KVM(tdx_kvm_hypercall);

tdx_kvm_hypecall() is used by kvm_hypercall{0,1,2,3,4}, which are not used by
KVM modules, but used by guest kernel code when running as a KVM guest.

It seems the reason we need to export is kvm_arch_ptp_init() calls
kvm_hypercall2() and kvm_arch_ptp_init() can be called by guest-side PTP module.

>  #endif
>  
>  /*
> @@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
>  
>  	return 0;
>  }
> -EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
>  
>  /**
>   * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
> @@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
>  
>  	return 0;
>  }
> -EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
>  
>  /**
>   * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
> @@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
>  	/* Since buf is a shared memory, set the shared (decrypted) bits */
>  	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
>  }
> -EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
> +EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
>  
>  static void __noreturn tdx_panic(const char *msg)
>  {

Re: [PATCH] x86/tdx: Harden exports

[Nikolay Borisov]

On 11.09.26 г. 16:01 ч., Xiaoyao Li wrote:
> + Peter,
> 
> On 9/11/2026 7:31 PM, Nikolay Borisov wrote:
>> tdx_* function aren't supposed to be used by the kernel at large, rather
>> they are mostly used by KVM and a very small number of them are exposed
>> via the tdx-guest/tdx-host drivers. Reflect this fact in their
>> EXPORT_SYMBOL* declarations.
> 
> we found this and discussed it in [1]. It was left to Peter's todo list.
> Glad to see you do it earlier.
> 
> [1] https://lore.kernel.org/all/cdb43316-6535-4f11-9fb0-abdf2adf4568@intel.com/
> 
>> Reported-by: Michal Koutný <mkoutny@suse.com>
>> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
>> ---
>>   arch/x86/coco/tdx/tdx.c | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
>> index f904a636d449..3055a76c0dfd 100644
>> --- a/arch/x86/coco/tdx/tdx.c
>> +++ b/arch/x86/coco/tdx/tdx.c
>> @@ -64,7 +64,7 @@ long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, unsigned long p2,
>>   
>>   	return __tdx_hypercall(&args);
>>   }
>> -EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
>> +EXPORT_SYMBOL_FOR_KVM(tdx_kvm_hypercall);
> 
> tdx_kvm_hypecall() is used by kvm_hypercall{0,1,2,3,4}, which are not used by
> KVM modules, but used by guest kernel code when running as a KVM guest.
> 
> It seems the reason we need to export is kvm_arch_ptp_init() calls
> kvm_hypercall2() and kvm_arch_ptp_init() can be called by guest-side PTP module.


So what do you suggest the correct export is?

> 
>>   #endif
>>   
>>   /*
>> @@ -139,7 +139,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
>>   
>>   	return 0;
>>   }
>> -EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
>> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_get_report0, "tdx-guest");
>>   
>>   /**
>>    * tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
>> @@ -175,7 +175,7 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data)
>>   
>>   	return 0;
>>   }
>> -EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
>> +EXPORT_SYMBOL_FOR_MODULES(tdx_mcall_extend_rtmr, "tdx-guest");
>>   
>>   /**
>>    * tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
>> @@ -196,7 +196,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
>>   	/* Since buf is a shared memory, set the shared (decrypted) bits */
>>   	return _tdx_hypercall(TDVMCALL_GET_QUOTE, cc_mkdec(virt_to_phys(buf)), size, 0, 0);
>>   }
>> -EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
>> +EXPORT_SYMBOL_FOR_MODULES(tdx_hcall_get_quote, "tdx-guest");
>>   
>>   static void __noreturn tdx_panic(const char *msg)
>>   {
>