[PATCH v5 0/6] Enable TDX module extensions

[Xu Yilun <yilun.xu@linux.intel.com>]

Hi,

In v4, Dave raised concerns about the first patch. I refactored it and
dropped its RBs, so it needs more review from TDX developers/reviewers.

Based on some offline discussion, I refactored changelog for patch 3/4/5.
I also simplified the changelog for the rest of the patches. But the RBs
for Patch 2-6 are kept, please speak out if you object.

If these patches (especially Patch 1) get good reviews and no major
concern, Dave, please help take a look. Otherwise, feel free to ignore.

== Changes ==

Dave pointed out that the Patch 1 contained too much information, so
that it was hard to find out why a wrapper is immediately needed. He
also pointed out that introducing the new structure, tdmr_info_pa_array,
is orthogonal. Drop the new structure part. Further simplify the
changelog to make explicit the reason for the wrapper.

Dave pointed out that the changelog of Patch 4 doesn't catch the point
of why DPAMT support is needed. He also pointed out that the
bisectability concern between Patch 3 & 4 is not well explained.
Refactor the changelog of Patch 3 & 4.

We had an internal discussion about simplifying the Quoting extension
initialization flow. The conclusion is to integrate the TDH.QUOTE.INIT
operations (and potentially similar operations for other extensions)
into TDH.EXT.INIT. This raised a question about how to handle errors for
TDH.EXT.INIT if one extension fails while other extensions are good. The
solution in this series is to fail the whole TDX initialization on any
error, though we planned a solution when a nice-to-have extension
appears in the future. Describe the error handling in the changelog of
Patch 5, no code change.

v4: https://lore.kernel.org/r/20261013-tdx-module-ext-v4-0-de5ffac65470@linux.intel.com

v3: https://lore.kernel.org/r/20261006-tdx-module-ext-v3-0-db52cb05b918@linux.intel.com

v2: https://lore.kernel.org/all/20260915102658.713079-1-yilun.xu@linux.intel.com/

v1: https://lore.kernel.org/all/20260821032920.256225-1-yilun.xu@linux.intel.com/

Quoting v2: https://lore.kernel.org/lkml/20260618081355.3253581-1-yilun.xu@linux.intel.com/

Quoting v1: https://lore.kernel.org/all/20260522034128.3144354-1-yilun.xu@linux.intel.com/

== Overview ==

To date, SEAMCALL execution must either complete quickly to avoid
stalling the host, or yield quickly at pre-defined interrupt
checkpoints. This is acceptable for the existing SEAMCALL leafs,
which perform simple, bounded operations.

However, some new features such as attestation and TD migration require
higher level security protocols inside the TDX module, which cannot fit
within that constraint. TDX solves this by making those operations
inherently preemptible and resumable like OS tasks. TDX provides a
separate SEAMCALL execution environment - the TDX module extensions -
for those operations.

This capability allows for higher-level SEAMCALL ABI design - like
"create a DICE-based attestation quote". Several new features, such as
DICE-based attestation, TDISP and TD migration, use SEAMCALL leafs
backed by the TDX module extensions.

The TDX module extensions need memory for their execution environment
to serve these SEAMCALL leafs, so they need extra setup steps during TDX
module initialization. The bulk of this series implements these setup
steps.

At runtime, the host invokes these SEAMCALL leafs just as normal ones -
if interrupted, simply re-invoke the leaf to resume.

For more information on TDX module extensions, please refer to [1].

[1] https://lore.kernel.org/lkml/20260618081355.3253581-1-yilun.xu@linux.intel.com/

== Branch stack ==

This is based on v7.4-rc1. You can find the full branch stack at [2].
The DICE part is in the full branch as an example for extensions. But it
does not include the other DICE feedbacks.

The full branch contains:

  This series: Patch 1~7: This series, including this cover-letter.
  Use case:    Patch 8~N: The old DICE part as an example.

[2] https://github.com/intel-staging/tdx/tree/tdx-module-ext

== Test ==

We made agreement with TDX module team about some ABI changes, it
involves TDH.EXT.INIT, TDH.SYS.UPDATE.

This series is written against these unreleased changes. So we did 2
kinds of tests.

 1. Add some workaround patches in kernel then test on existing TDX
    module & real HW. See the full branch listed in "Branch stack"
    section.

 2. Customize the TDX module, mock the ABI change, run with the module
    in a virtual machine environment with virtual SEAM support, no real
    security in this environment.

---
Xu Yilun (6):
      x86/virt/tdx: Move TDH.SYS.CONFIG operations into a wrapper
      x86/virt/tdx: Configure add-on features on TDX module init
      x86/virt/tdx: Add extra memory to TDX module for the extensions
      x86/virt/tdx: Support DPAMT when adding memory for the extensions
      x86/virt/tdx: Make TDX module initialize the extensions
      x86/virt/tdx: Re-initialize the extensions on runtime TDX module update

 arch/x86/include/asm/tdx.h                  |   1 +
 arch/x86/include/asm/tdx_global_metadata.h  |   4 +
 arch/x86/virt/vmx/tdx/tdx.h                 |   2 +
 arch/x86/virt/vmx/tdx/tdx.c                 | 234 ++++++++++++++++++++++++++--
 arch/x86/virt/vmx/tdx/tdx_global_metadata.c |  14 ++
 5 files changed, 244 insertions(+), 11 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20260916-tdx-module-ext-da1930f33c04

Best regards,
-- 
Xu Yilun <yilun.xu@linux.intel.com>