[PATCH v1 00/26] PCI/TSM: TDX Connect: SPDM Session and IDE Establishment

Xu Yilun
2025-11-17T02:37:56Z

This is a new version of the RFC [1]. It is based on Dan's
"Link" TSM Core infrastructure [2][3] + Sean's VMXON RFC [4]. All
together they enable the SPDM Session and IDE Establishment for TDX
Connect. This series and its base commits are available in Dan's
tsm.git#staging [5].

Changes since public RFC:
- No tdx_enable() needed in tdx-host
- Simplify tdx_page_array kAPI, no singleton mode input
- Refactor the handling of TDX_INTERRUPTED_RESUMABLE
- Refine the usage of scope-based cleanup in tdx-host
- Set nr_stream_id in tdx-host, not in PCI ACPI initialization
- Use KEYP table + ECAP bit50 to decide Domain ID reservation
- Refactor IDE Address Association Register setup
- Remove prototype patches
- Refactor tdx_enable_ext() locking because of Sean's change
- Pick ACPICA KEYP patch from ACPICA repo
- Select TDX Connect feature for TDH.SYS.CONFIG, remove temporary
solution for TDH.SYS.INIT
- Use Rick's tdx_errno.h movement patch [6]
- Factor out scope-based cleanup patches in mm
- Remove redunant header files, add header files only when first used
- Use dev_err_probe() when possible
- keyp_info_match() refactor
- Use bitfield.h macros for PAGE_LIST_INFO & HPA_ARRAY_T raw value
- Remove reserved fields for spdm_config_info_t
- Simplify return for tdh_ide_stream_block()
- Other small fixes for Jonathan's comments

[1]: https://lore.kernel.org/linux-coco/20250919142237.418648-1-dan.j.williams@intel.com/
[2]: https://lore.kernel.org/linux-coco/20251031212902.2256310-1-dan.j.williams@intel.com/
[3]: https://lore.kernel.org/linux-coco/20251105040055.2832866-1-dan.j.williams@intel.com/
[4]: https://lore.kernel.org/all/20251010220403.987927-1-seanjc@google.com/
[5]: https://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm.git/log/?h=staging
[6]: https://lore.kernel.org/all/20250918232224.2202592-2-rick.p.edgecombe@intel.com/

Trimmed Original Cover letter:
-------------------------------

Add a PCI/TSM low-level driver implemenation for TDX Connect (the TEE
I/O architecture for Intel platforms). Recall that PCI/TSM is the
Linux PCI core subsystem for interfacing with platform Trusted Execution
Environment (TEE) Security Managers (TSMs). TSMs establish secure
sessions with PCIe devices (SPDM over Data Object Exchange (DOE)
mailboxes) and establish PCIe link Integrity and Data Encryption (IDE).

This SPDM and IDE facility is enabled with TDX via a new capability
called a TDX Module Extension. An extension, as might be expected, is a
family of new seamcalls. Unlike typical base module seamcalls, an
extension supports preemptible calls for long running flows like SPDM
session establishment. This extension capability was added in response
to Intel Linux team feedback and in support of reducing the complexity
of the Linux implementation. The result is sequences like the following:

guard(mutex)(&tdx_ext_lock);
do {
r = tdh_spdm_connect(tlink->spdm_id, tlink->spdm_conf,
tlink->in_msg, tlink->out_msg,
dev_info, &out_msg_sz);
ret = tdx_link_event_handler(tlink, r, out_msg_sz);
} while (ret == -EAGAIN);

...where tdh_spdm_connect() is a seamcall that may return early if this
CPU takes a hardirq or if the module needs a DOE message marshalled to
the device. tdx_link_event_handler() marshals the message and the
extension is resumed to continue the flow. In this case the TDX Connect
extension supports 1 caller at a time, think of it like a queue-depth of
one device-firmware command queue, so concurrency is managed with
@tdx_ext_lock.

Chao Gao (1):
coco/tdx-host: Introduce a "tdx_host" device

Dave Jiang (2):
ACPICA: Add KEYP table definition
acpi: Add KEYP support to fw_table parsing

Kirill A. Shutemov (1):
x86/tdx: Move all TDX error defines into <asm/shared/tdx_errno.h>

Lu Baolu (2):
iommu/vt-d: Cache max domain ID to avoid redundant calculation
iommu/vt-d: Reserve the MSB domain ID bit for the TDX module

Xu Yilun (15):
x86/virt/tdx: Move bit definitions of TDX_FEATURES0 to public header
coco/tdx-host: Support Link TSM for TDX host
mm: Add __free() support for __free_page()
x86/virt/tdx: Add tdx_page_array helpers for new TDX Module objects
x86/virt/tdx: Read TDX global metadata for TDX Module Extensions
x86/virt/tdx: Read TDX Connect global metadata for TDX Connect
mm: Add __free() support for folio_put()
x86/virt/tdx: Extend tdx_page_array to support IOMMU_MT
x86/virt/tdx: Add a helper to loop on TDX_INTERRUPTED_RESUMABLE
iommu/vt-d: Export a helper to do function for each dmar_drhd_unit
coco/tdx-host: Setup all trusted IOMMUs on TDX Connect init
coco/tdx-host: Parse ACPI KEYP table to init IDE for PCI host bridges
x86/virt/tdx: Add SEAMCALL wrappers for IDE stream management
coco/tdx-host: Implement IDE stream setup/teardown
coco/tdx-host: Finally enable SPDM session and IDE Establishment

Zhenzhong Duan (5):
x86/virt/tdx: Add tdx_enable_ext() to enable of TDX Module Extensions
x86/virt/tdx: Add SEAMCALL wrappers for trusted IOMMU setup and clear
coco/tdx-host: Add a helper to exchange SPDM messages through DOE
x86/virt/tdx: Add SEAMCALL wrappers for SPDM management
coco/tdx-host: Implement SPDM session setup

drivers/virt/coco/Kconfig | 2 +
drivers/virt/coco/tdx-host/Kconfig | 17 +
drivers/virt/coco/Makefile | 1 +
drivers/virt/coco/tdx-host/Makefile | 1 +
arch/x86/include/asm/shared/tdx.h | 1 +
.../vmx => include/asm/shared}/tdx_errno.h | 29 +-
arch/x86/include/asm/tdx.h | 76 +-
arch/x86/include/asm/tdx_global_metadata.h | 14 +
arch/x86/kvm/vmx/tdx.h | 1 -
arch/x86/virt/vmx/tdx/tdx.h | 16 +-
drivers/iommu/intel/iommu.h | 2 +
include/acpi/actbl2.h | 59 ++
include/linux/acpi.h | 3 +
include/linux/dmar.h | 2 +
include/linux/fw_table.h | 1 +
include/linux/gfp.h | 1 +
include/linux/mm.h | 2 +
include/linux/pci-ide.h | 2 +
arch/x86/virt/vmx/tdx/tdx.c | 740 ++++++++++++-
arch/x86/virt/vmx/tdx/tdx_global_metadata.c | 32 +
drivers/acpi/tables.c | 12 +-
drivers/iommu/intel/dmar.c | 67 ++
drivers/iommu/intel/iommu.c | 10 +-
drivers/pci/ide.c | 5 +-
drivers/virt/coco/tdx-host/tdx-host.c | 969 ++++++++++++++++++
lib/fw_table.c | 9 +
26 files changed, 2027 insertions(+), 47 deletions(-)
create mode 100644 drivers/virt/coco/tdx-host/Kconfig
create mode 100644 drivers/virt/coco/tdx-host/Makefile
rename arch/x86/{kvm/vmx => include/asm/shared}/tdx_errno.h (62%)
create mode 100644 drivers/virt/coco/tdx-host/tdx-host.c

--
2.25.1