x86/tdx: Add TDG.MR.KEY.GET ABI support

[mingweishih]

Add support for the TDG.MR.KEY.GET TDCALL, which derives a persistent, hardware-bound sealing key for the TD customized to its measurements and policy. Add the tdx_mcall_key_get() wrapper, the TDX_CMD_KEY_GET ioctl with its tdx_key_get_req UAPI structure, and the tdx_guest driver handler that marshals the TDKEYREQUEST input and key output buffers with the alignment required by the TDX module ABI.

[mishih: fix typos and a misplaced apostrophe from the original patch;
use _IOWR since the ioctl both reads the request and writes back the
key and error code; document that kmalloc()/kzalloc() satisfy the 128B
and 32B buffer alignment for these power-of-two sizes; write err_code
back on success so callers do not observe a stale value; and use
kfree_sensitive() to clear keying material]

[Copilot]

Pull request overview

This PR adds guest-kernel support for the TDX TDG.MR.KEY.GET TDCALL by introducing a new UAPI ioctl and the corresponding kernel-side plumbing to derive and return a persistent, TD-bound sealing key to userspace.

Changes:

• Add TDX_CMD_KEY_GET ioctl and struct tdx_key_get_req UAPI to pass a TDKEYREQUEST input buffer and receive the derived key + error code.
• Implement the ioctl handler in the tdx-guest driver, including buffer allocation/alignment handling and sensitive-memory cleanup.
• Add a low-level tdx_mcall_key_get() wrapper and the TDG_MR_KEY_GET leaf ID constant.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
include/uapi/linux/tdx-guest.h	Adds UAPI request struct, sizes, and ioctl definition for key derivation.
drivers/virt/coco/tdx-guest/tdx-guest.c	Adds the ioctl handler that marshals TDKEYREQUEST/key buffers and returns results to userspace.
arch/x86/include/asm/tdx.h	Exposes the new tdx_mcall_key_get() prototype to in-kernel callers.
arch/x86/include/asm/shared/tdx.h	Adds the shared TDCALL leaf ID constant for TDG.MR.KEY.GET.
arch/x86/coco/tdx/tdx.c	Implements the tdx_mcall_key_get() wrapper around __tdcall().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hargar19]

This PR is a copy of dev branch PR #149
that was approved by Chris and Dexuan.