Upstream TrenchBoot as Anti Evil Maid - UEFI boot mode support to Xen

[BeataZdunczyk]

Brief summary
Upstream the code implementing TrenchBoot UEFI boot mode support to the official Xen repository: https://lore.kernel.org/xen-devel/.

• Initial Patchset Submission: Submit the initial patchset implementing TrenchBoot UEFI boot mode support to the Xen mailing list: Xen-devel.

• Developing Fixes: Implement additional fixes based on the latest round of feedback.

• Refreshing Code: Ensure the code remains up-to-date with any recent changes in the Xen repository.

• Communication and Collaboration: Continue active communication with the Xen community and maintainers.

[SergiiDmytruk]

@krystian-hebel, what about your SMP patches sent upstream (https://lore.kernel.org/xen-devel/cover.1699982111.git.krystian.hebel@3mdeb.com/)? I see https://github.com/TrenchBoot/xen/commits/smp_v2/, but looks like it wasn't sent yet. If I remember correctly, Slaunch can get away with only having x86/boot: choose AP stack based on APIC ID, but that's still a bit of a duplication between patchsets.

[krystian-hebel]

I was attempting to rebase and refresh them 3 times already, but each time I was getting close to sending it, tasks with higher priority appeared out of nowhere... I would still very much like to send it though.

If I remember correctly, Slaunch can get away with only having x86/boot: choose AP stack based on APIC ID, but that's still a bit of a duplication between patchsets.

Probably yes. There was a discussion about moving stack pointer between structs because it doesn't logically fit where I put it initially, I don't remember if this was already done in smp_v2 branch or not. This could require changes to later, TXT-specific commits on AEM branches, but those should be minimal.

[SergiiDmytruk]

Turned out that aem-staging-18-11-24 which I used as a base before rebasing onto the latest master has never included changes from TrenchBoot/xen#17. Will need to add those fixes in. Otherwise commits should be good for sending upstream, overall changes were things like:

• fixing stylistic issues
• squashing commits
• renaming variables and functions
• getting rid of renames and code moves between files
• adding missing __inits
• "hiding" slaunch_slrt

[SergiiDmytruk]

Integrated the fixes (the one with MTTR enabling/disabling required more changes to be reasonable for upstreaming) but testing showed issues with TXT. First there was BUG_ON() for TXT private space which can be dealt with, but then there are issues accessing registers apparently caused by upstream changes:

• legacy:
  • TXT ranges are in memory map
  • boot CPU can't access TXT registers
• EFI:
  • TXT ranges are not in memory map (as if EDK filters them out, coreboot reserves them according to its log)
  • boot CPU can access TXT registers
  • secondary CPUs can't access TXT registers
  • trying to add the ranges to e820 or e820_raw didn't help

Xen on v0.5.0 seems to be fine with TXT range not being declared in any way and allows accesses to be by any CPU. Searching change log or commits don't reveal any obvious changes regarding handling memory.

I'd think that's an EDK-related issue if it didn't fail even earlier in the boot process with SeaBIOS.

[SergiiDmytruk]

Mystery solved. The erratic behaviour was caused by #ifdef __XEN_CONFIG_H__ in intel_txt.h (#ifdef __BOOT_DEFS_H__ in v0.5.0) which seems to be always defined. I'll just add -D__EARLY_SLAUNCH__ instead of __EARLY_TPM__ and will branch on that everywhere.

[SergiiDmytruk]

Realized that we never checked whether memory mappings succeed, so added that. Also split one commit which introduced early code and TXT checks into two. Confirmed that x86/boot: choose AP stack based on APIC ID is enough for TXT to work. Successfully ran rebased version on APU2 and VP4670 in legacy and UEFI modes checking PCRs against the output of anti-evil-maid-dump-evt-log.

The diff between old and new versions on the same base to give an idea of the changes made for upstreaming:

Diff of before and after diffs

diff --git a/before-same-base b/after-rebase
index b6d21c7606..3f060a00b7 100644
--- a/before-same-base
+++ b/after-rebase
@@ -1,18 +1,3 @@
-diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
-index 4bfc5ddd8a..700c6b2a7f 100644
---- a/.github/workflows/build.yml
-+++ b/.github/workflows/build.yml
-@@ -9,7 +9,9 @@ on:
- 
- jobs:
-   qubes-dom0-package:
--    uses: TrenchBoot/.github/.github/workflows/qubes-dom0-packagev2.yml@master
-+    uses: TrenchBoot/.github/.github/workflows/qubes-dom0-packagev2.yml@very-stable
-     with:
-       qubes-component: 'vmm-xen'
-       qubes-pkg-src-dir: '.'
-+      qubes-pkg-revision: '7'
-+      qubes-pkg-version: '4.17.2'
 diff --git a/.gitignore b/.gitignore
 index 53f5df0003..dab829d7e1 100644
 --- a/.gitignore
@@ -26,44 +11,50 @@ index 53f5df0003..dab829d7e1 100644
  xen/arch/x86/include/asm/asm-macros.h
  xen/arch/*/xen.lds
 diff --git a/docs/hypervisor-guide/x86/how-xen-boots.rst b/docs/hypervisor-guide/x86/how-xen-boots.rst
-index 8b3229005c..98c196516b 100644
+index 8b3229005c..63f81a8198 100644
 --- a/docs/hypervisor-guide/x86/how-xen-boots.rst
 +++ b/docs/hypervisor-guide/x86/how-xen-boots.rst
-@@ -55,6 +55,11 @@ If ``CONFIG_PVH_GUEST`` was selected at build time, an Elf note is included
+@@ -55,6 +55,13 @@ If ``CONFIG_PVH_GUEST`` was selected at build time, an Elf note is included
  which indicates the ability to use the PVH boot protocol, and registers
  ``__pvh_start`` as the entrypoint, entered in 32bit mode.
  
-+MLE header is used with Intel TXT, together with MB2 headers. Entrypoint is
-+different, but it is used just to differentiate from other entries by moving
-+a magic number to EAX. Execution environment is similar to that of Multiboot 2
-+and code falls through to ``start``.
++A combination of Multiboot 2 and MLE headers is used to implement DRTM. The
++separate entry point is used mainly to differentiate from other kinds of boots.
++For a legacy (BIOS) boot, it moves a magic number to EAX before jumping into
++common startup code.  For a EFI boot, it resumes execution of Xen.efi which was
++paused by handing control to a part of a bootloader responsible for initiating
++DRTM sequence.
 +
  
  xen.gz
  ~~~~~~
 diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
-index f59c9665fd..144b2c0ea4 100644
+index f59c9665fd..af4dd16f8a 100644
 --- a/xen/arch/x86/Makefile
 +++ b/xen/arch/x86/Makefile
-@@ -57,8 +57,10 @@ obj-y += pci.o
- obj-y += physdev.o
- obj-$(CONFIG_COMPAT) += x86_64/physdev.o
- obj-$(CONFIG_X86_PSR) += psr.o
+@@ -40,6 +40,7 @@ obj-$(CONFIG_GDBSX) += gdbsx.o
+ obj-y += hypercall.o
+ obj-y += i387.o
+ obj-y += i8259.o
 +obj-y += intel_txt.o
+ obj-y += io_apic.o
+ obj-$(CONFIG_LIVEPATCH) += alternative.o livepatch.o
+ obj-y += msi.o
+@@ -59,12 +60,14 @@ obj-$(CONFIG_COMPAT) += x86_64/physdev.o
+ obj-$(CONFIG_X86_PSR) += psr.o
  obj-y += setup.o
  obj-y += shutdown.o
 +obj-y += slaunch.o
  obj-y += smp.o
  obj-y += smpboot.o
  obj-y += spec_ctrl.o
-@@ -66,6 +68,7 @@ obj-y += srat.o
+ obj-y += srat.o
  obj-y += string.o
  obj-y += time.o
- obj-y += traps-setup.o
 +obj-y += tpm.o
+ obj-y += traps-setup.o
  obj-y += traps.o
  obj-$(CONFIG_INTEL) += tsx.o
- obj-y += usercopy.o
 @@ -87,6 +90,7 @@ extra-y += xen.lds
  
  hostprogs-y += boot/mkelf32
@@ -150,7 +141,7 @@ index bb86a1c161..feae06f57c 100644
      ioapic_init();
  }
 diff --git a/xen/arch/x86/boot/Makefile b/xen/arch/x86/boot/Makefile
-index be91a5757a..44fb61752f 100644
+index be91a5757a..ab37ab1fb7 100644
 --- a/xen/arch/x86/boot/Makefile
 +++ b/xen/arch/x86/boot/Makefile
 @@ -5,6 +5,8 @@ obj-bin-y += $(obj64)
@@ -162,28 +153,30 @@ index be91a5757a..44fb61752f 100644
  
  obj64 := reloc-trampoline.o
  
-@@ -28,6 +30,10 @@ $(obj32): XEN_CFLAGS := $(CFLAGS_x86_32) -fpic
+@@ -28,6 +30,12 @@ $(obj32): XEN_CFLAGS := $(CFLAGS_x86_32) -fpic
  $(obj)/%.32.o: $(src)/%.c FORCE
  	$(call if_changed_rule,cc_o_c)
  
-+$(obj)/tpm_early.32.o: XEN_CFLAGS += -D__EARLY_TPM__
++$(obj)/slaunch_early.32.o: XEN_CFLAGS += -D__EARLY_SLAUNCH__
++
++$(obj)/tpm_early.32.o: XEN_CFLAGS += -D__EARLY_SLAUNCH__
 +$(obj)/tpm_early.32.o: $(src)/../tpm.c FORCE
 +	$(call if_changed_rule,cc_o_c)
 +
  orphan-handling-$(call ld-option,--orphan-handling=error) := --orphan-handling=error
  LDFLAGS_DIRECT-$(call ld-option,--warn-rwx-segments) := --no-warn-rwx-segments
  LDFLAGS_DIRECT += $(LDFLAGS_DIRECT-y)
-@@ -81,7 +87,7 @@ cmd_combine = \
+@@ -81,7 +89,7 @@ cmd_combine = \
                --bin1      $(obj)/built-in-32.base.bin \
                --bin2      $(obj)/built-in-32.offset.bin \
                --map       $(obj)/built-in-32.base.map \
 -              --exports   cmdline_parse_early,reloc,reloc_trampoline32 \
-+              --exports   cmdline_parse_early,reloc,reloc_trampoline32,slaunch_early_tests,tpm_extend_mbi \
++              --exports   cmdline_parse_early,reloc,reloc_trampoline32,slaunch_early_init,tpm_extend_mbi \
                --output    $@
  
  targets += built-in-32.S
 diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S
-index 77bb7a9e21..8164465e4a 100644
+index 77bb7a9e21..27b63fae32 100644
 --- a/xen/arch/x86/boot/head.S
 +++ b/xen/arch/x86/boot/head.S
 @@ -4,9 +4,11 @@
@@ -305,25 +298,29 @@ index 77bb7a9e21..8164465e4a 100644
          xor     %edx,%edx
  
 +        /* Check for TrenchBoot slaunch bootloader. */
-+        cmp     $SLAUNCH_BOOTLOADER_MAGIC,%eax
++        cmp     $SLAUNCH_BOOTLOADER_MAGIC, %eax
 +        je      .Lslaunch_proto
 +
          /* Check for Multiboot2 bootloader. */
          cmp     $MULTIBOOT2_BOOTLOADER_MAGIC,%eax
          je      .Lmultiboot2_proto
-@@ -434,6 +521,43 @@ __start:
+@@ -434,6 +521,51 @@ __start:
          cmovnz  MB_mem_lower(%ebx),%edx
          jmp     trampoline_bios_setup
  
 +.Lslaunch_proto:
-+        /* Upon reaching here, CPU state mostly matches the one setup by the
-+         * bootloader with ESP, ESI and EDX being clobbered above. */
++        /*
++         * Upon reaching here, CPU state mostly matches the one setup by the
++         * bootloader with ESP, ESI and EDX being clobbered above.
++         */
 +
 +        /* Save information that TrenchBoot slaunch was used. */
 +        movb    $1, sym_esi(slaunch_active)
 +
-+        /* Prepare space for output parameter of slaunch_early_tests(), which is
-+         * a structure of two uint32_t fields. */
++        /*
++         * Prepare space for output parameter of slaunch_early_init(), which is
++         * a structure of two uint32_t fields.
++         */
 +        sub     $8, %esp
 +
 +        push    %esp                             /* pointer to output structure */
@@ -331,12 +328,16 @@ index 77bb7a9e21..8164465e4a 100644
 +        lea     sym_offs(__2M_rwdata_end), %ecx  /* end of target image */
 +        lea     sym_offs(_start), %edx           /* target base address */
 +        mov     %esi, %eax                       /* load base address */
-+        /* slaunch_early_tests(load/eax, tgt/edx, tgt_end/ecx,
-+                               slaunch/stk, ret/stk) using fastcall. */
-+        call    slaunch_early_tests
-+        add     $8, %esp
++        /*
++         * slaunch_early_init(load/eax, tgt/edx, tgt_end/ecx,
++         *                     slaunch/stk, ret/stk)
++         *
++         * Uses fastcall calling convention.
++         */
++        call    slaunch_early_init
++        add     $8, %esp                         /* pop last two parameters */
 +
-+        /* Move outputs of slaunch_early_tests() from stack into registers. */
++        /* Move outputs of slaunch_early_init() from stack into registers. */
 +        pop     %eax  /* physical MBI address */
 +        pop     %edx  /* physical SLRT address */
 +
@@ -350,12 +351,12 @@ index 77bb7a9e21..8164465e4a 100644
 +        call    tpm_extend_mbi
 +
 +        /* Move magic number expected by Multiboot 2 to EAX and fall through. */
-+        movl    $MULTIBOOT2_BOOTLOADER_MAGIC,%eax
++        movl    $MULTIBOOT2_BOOTLOADER_MAGIC, %eax
 +
  .Lmultiboot2_proto:
          /* Skip Multiboot2 information fixed part. */
          lea     (MB2_fixed_sizeof+MULTIBOOT2_TAG_ALIGN-1)(%ebx),%ecx
-@@ -710,6 +834,124 @@ trampoline_setup:
+@@ -710,6 +842,124 @@ trampoline_setup:
          /* Jump into the relocated trampoline. */
          lret
  
@@ -482,31 +483,19 @@ index 77bb7a9e21..8164465e4a 100644
  ENTRY(trampoline_end)
 diff --git a/xen/arch/x86/boot/slaunch_early.c b/xen/arch/x86/boot/slaunch_early.c
 new file mode 100644
-index 0000000000..f40c0f717e
+index 0000000000..d53faf8ab0
 --- /dev/null
 +++ b/xen/arch/x86/boot/slaunch_early.c
-@@ -0,0 +1,117 @@
+@@ -0,0 +1,105 @@
 +/*
-+ * Copyright (c) 2022-2024 3mdeb Sp. z o.o. All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2 of the License, or
-+ * (at your option) any later version.
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
 + */
 +
-+#include <xen/macros.h>
++#include <xen/slr_table.h>
 +#include <xen/types.h>
 +#include <asm/intel_txt.h>
-+#include <xen/slr_table.h>
 +#include <asm/x86-vendors.h>
 +
 +/*
@@ -522,7 +511,7 @@ index 0000000000..f40c0f717e
 +    uint16_t bootloader_data_offset;
 +} __packed;
 +
-+struct early_tests_results
++struct early_init_results
 +{
 +    uint32_t mbi_pa;
 +    uint32_t slrt_pa;
@@ -543,11 +532,11 @@ index 0000000000..f40c0f717e
 +        && edx == X86_VENDOR_INTEL_EDX;
 +}
 +
-+void slaunch_early_tests(uint32_t load_base_addr,
-+                         uint32_t tgt_base_addr,
-+                         uint32_t tgt_end_addr,
-+                         uint32_t slaunch_param,
-+                         struct early_tests_results *result)
++void slaunch_early_init(uint32_t load_base_addr,
++                        uint32_t tgt_base_addr,
++                        uint32_t tgt_end_addr,
++                        uint32_t slaunch_param,
++                        struct early_init_results *result)
 +{
 +    void *txt_heap;
 +    struct txt_os_mle_data *os_mle;
@@ -572,10 +561,10 @@ index 0000000000..f40c0f717e
 +        result->slrt_pa = slaunch_param + sl_header->bootloader_data_offset;
 +        result->mbi_pa = 0;
 +
-+        slrt = (struct slr_table *)result->slrt_pa;
++        slrt = (struct slr_table *)(uintptr_t)result->slrt_pa;
 +
 +        amd_info = (struct slr_entry_amd_info *)
-+                   slr_next_entry_by_tag (slrt, NULL, SLR_ENTRY_AMD_INFO);
++            slr_next_entry_by_tag(slrt, NULL, SLR_ENTRY_AMD_INFO);
 +        /* Basic checks only, SKL checked and consumed the rest. */
 +        if ( amd_info == NULL || amd_info->hdr.size != sizeof(*amd_info) )
 +            return;
@@ -591,10 +580,10 @@ index 0000000000..f40c0f717e
 +    result->slrt_pa = os_mle->slrt;
 +    result->mbi_pa = 0;
 +
-+    slrt = (struct slr_table *)result->slrt_pa;
++    slrt = (struct slr_table *)(uintptr_t)os_mle->slrt;
 +
 +    intel_info = (struct slr_entry_intel_info *)
-+               slr_next_entry_by_tag (slrt, NULL, SLR_ENTRY_INTEL_INFO);
++        slr_next_entry_by_tag(slrt, NULL, SLR_ENTRY_INTEL_INFO);
 +    if ( intel_info == NULL || intel_info->hdr.size != sizeof(*intel_info) )
 +        return;
 +
@@ -676,7 +665,7 @@ index a92e399fbe..5989d3a69a 100644
  
          /* Relocations for trampoline Real Mode segments. */
 diff --git a/xen/arch/x86/boot/x86_64.S b/xen/arch/x86/boot/x86_64.S
-index 08ae97e261..9b63ed81f7 100644
+index 08ae97e261..62ff7d62d6 100644
 --- a/xen/arch/x86/boot/x86_64.S
 +++ b/xen/arch/x86/boot/x86_64.S
 @@ -15,7 +15,38 @@ ENTRY(__high_start)
@@ -727,7 +716,7 @@ index 08ae97e261..9b63ed81f7 100644
          tailcall start_secondary
  
  .L_bsp:
-@@ -195,14 +227,23 @@ GLOBAL(__page_tables_end)
+@@ -195,14 +227,22 @@ GLOBAL(__page_tables_end)
  /* Init pagetables. Enough page directories to map into 4GB. */
          .section .init.data, "aw", @progbits
  
@@ -748,75 +737,128 @@ index 08ae97e261..9b63ed81f7 100644
          .fill L3_PAGETABLE_ENTRIES, 8, 0
  END(l3_bootmap)
 +
-+DATA(l4_bootmap, PAGE_SIZE) /* 1x L4 page, mapping the L3 page. */
++DATA_LOCAL(l4_bootmap, PAGE_SIZE) /* 1x L4 page, mapping the L3 page. */
 +        .fill L4_PAGETABLE_ENTRIES, 8, 0
-+        .size l4_bootmap, . - l4_bootmap
 +END(l4_bootmap)
 +
 +bootmap_end:
+diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
+index ce4e1df710..8be135dbc1 100644
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -671,6 +671,19 @@ void amd_log_freq(const struct cpuinfo_x86 *c)
+ #undef FREQ
+ }
+ 
++void amd_log_skinit(const struct cpuinfo_x86 *c)
++{
++    /* Run only on BSP to report the capability only once */
++    if ( smp_processor_id() )
++        return;
++
++    printk("CPU: SKINIT capability ");
++    if ( !test_bit(X86_FEATURE_SKINIT, &boot_cpu_data.x86_capability) )
++        printk("not supported\n");
++    else
++        printk("supported\n");
++}
++
+ void cf_check early_init_amd(struct cpuinfo_x86 *c)
+ {
+ 	if (c == &boot_cpu_data)
+@@ -1320,6 +1333,7 @@ static void cf_check init_amd(struct cpuinfo_x86 *c)
+ 	check_syscfg_dram_mod_en();
+ 
+ 	amd_log_freq(c);
++	amd_log_skinit(c);
+ }
+ 
+ const struct cpu_dev __initconst_cf_clobber amd_cpu_dev = {
+diff --git a/xen/arch/x86/cpu/cpu.h b/xen/arch/x86/cpu/cpu.h
+index 8be65e975a..5bcf118a93 100644
+--- a/xen/arch/x86/cpu/cpu.h
++++ b/xen/arch/x86/cpu/cpu.h
+@@ -20,6 +20,7 @@ extern bool detect_extended_topology(struct cpuinfo_x86 *c);
+ 
+ void cf_check early_init_amd(struct cpuinfo_x86 *c);
+ void amd_log_freq(const struct cpuinfo_x86 *c);
++void amd_log_skinit(const struct cpuinfo_x86 *c);
+ void amd_init_lfence(struct cpuinfo_x86 *c);
+ void amd_init_ssbd(const struct cpuinfo_x86 *c);
+ void amd_init_spectral_chicken(void);
+diff --git a/xen/arch/x86/cpu/hygon.c b/xen/arch/x86/cpu/hygon.c
+index f7508cc8fc..6ebb8b5fab 100644
+--- a/xen/arch/x86/cpu/hygon.c
++++ b/xen/arch/x86/cpu/hygon.c
+@@ -85,6 +85,7 @@ static void cf_check init_hygon(struct cpuinfo_x86 *c)
+ 	}
+ 
+ 	amd_log_freq(c);
++	amd_log_skinit(c);
+ }
+ 
+ const struct cpu_dev __initconst_cf_clobber hygon_cpu_dev = {
 diff --git a/xen/arch/x86/cpu/intel.c b/xen/arch/x86/cpu/intel.c
-index 6a680ba38d..9542ff508c 100644
+index 6a680ba38d..618bd5540e 100644
 --- a/xen/arch/x86/cpu/intel.c
 +++ b/xen/arch/x86/cpu/intel.c
-@@ -13,6 +13,9 @@
+@@ -13,6 +13,7 @@
  #include <asm/apic.h>
  #include <asm/i387.h>
  #include <asm/trampoline.h>
-+#include <mach_apic.h>
-+#include <asm/hvm/support.h>
 +#include <asm/intel_txt.h>
  
  #include "cpu.h"
  
-@@ -571,6 +574,47 @@ static void init_intel_perf(struct cpuinfo_x86 *c)
+@@ -571,6 +572,47 @@ static void init_intel_perf(struct cpuinfo_x86 *c)
      }
  }
  
 +/*
-+ * Print out the SMX and TXT capabilties, so that dom0 can determine if system
-+ * is DRTM capable
++ * Print out the SMX and TXT capabilties, so that dom0 can determine if the
++ * system is DRTM-capable.
 + */
 +static void intel_log_smx_txt(struct cpuinfo_x86 *c)
 +{
-+	unsigned long cr4_val, getsec_caps;
-+	
-+	/* Run only on BSP to report the SMX/TXT caps only once */
-+	if (smp_processor_id())
-+		return;
-+
-+	printk("CPU: SMX capability ");
-+	if (!test_bit(X86_FEATURE_SMX, &boot_cpu_data.x86_capability)) {
-+		printk("not supported\n");
-+		return;
-+	}
-+	printk("supported\n");
-+
-+	/* Can't run GETSEC without VMX and SMX */
-+	if (!test_bit(X86_FEATURE_VMX, &boot_cpu_data.x86_capability))
-+		return;
-+
-+	cr4_val = read_cr4();
-+	if (!(cr4_val & X86_CR4_SMXE))
-+		write_cr4(cr4_val | X86_CR4_SMXE);
-+
-+	asm volatile ("getsec\n"
-+		: "=a" (getsec_caps)
-+		: "a" (GETSEC_CAPABILITIES), "b" (0) :);
-+	
-+	if (getsec_caps & GETSEC_CAP_TXT_CHIPSET)
-+		printk("Chipset supports TXT\n");
-+	else
-+		printk("Chipset does not support TXT\n");
-+
-+	if (!(cr4_val & X86_CR4_SMXE))
-+		write_cr4(cr4_val & ~X86_CR4_SMXE);
++    unsigned long cr4_val, getsec_caps;
++
++    /* Run only on BSP to report the SMX/TXT caps only once */
++    if ( smp_processor_id() )
++        return;
 +
++    printk("CPU: SMX capability ");
++    if ( !test_bit(X86_FEATURE_SMX, &boot_cpu_data.x86_capability) )
++    {
++        printk("not supported\n");
++        return;
++    }
++    printk("supported\n");
++
++    /* Can't run GETSEC without VMX and SMX */
++    if ( !test_bit(X86_FEATURE_VMX, &boot_cpu_data.x86_capability) )
++        return;
++
++    cr4_val = read_cr4();
++    if ( !(cr4_val & X86_CR4_SMXE) )
++        write_cr4(cr4_val | X86_CR4_SMXE);
++
++    asm volatile ("getsec\n"
++        : "=a" (getsec_caps)
++        : "a" (GETSEC_CAPABILITIES), "b" (0) :);
++
++    if ( getsec_caps & GETSEC_CAP_TXT_CHIPSET )
++        printk("Chipset supports TXT\n");
++    else
++        printk("Chipset does not support TXT\n");
++
++    if ( !(cr4_val & X86_CR4_SMXE) )
++        write_cr4(cr4_val & ~X86_CR4_SMXE);
 +}
 +
  static void cf_check init_intel(struct cpuinfo_x86 *c)
  {
  	/* Detect the extended topology information if available */
-@@ -585,6 +629,8 @@ static void cf_check init_intel(struct cpuinfo_x86 *c)
+@@ -585,6 +627,8 @@ static void cf_check init_intel(struct cpuinfo_x86 *c)
  		detect_ht(c);
  	}
  
@@ -825,6 +867,143 @@ index 6a680ba38d..9542ff508c 100644
  	/* Work around errata */
  	Intel_errata_workarounds(c);
  
+diff --git a/xen/arch/x86/cpu/mtrr/generic.c b/xen/arch/x86/cpu/mtrr/generic.c
+index c587e9140e..2a8dd1d8ff 100644
+--- a/xen/arch/x86/cpu/mtrr/generic.c
++++ b/xen/arch/x86/cpu/mtrr/generic.c
+@@ -396,9 +396,7 @@ static bool set_mtrr_var_ranges(unsigned int index, struct mtrr_var_range *vr)
+ 	return changed;
+ }
+ 
+-static uint64_t deftype;
+-
+-static unsigned long set_mtrr_state(void)
++static unsigned long set_mtrr_state(uint64_t *deftype)
+ /*  [SUMMARY] Set the MTRR state for this CPU.
+     <state> The MTRR state information to read.
+     <ctxt> Some relevant CPU context.
+@@ -416,14 +414,12 @@ static unsigned long set_mtrr_state(void)
+ 	if (mtrr_state.have_fixed && set_fixed_ranges(mtrr_state.fixed_ranges))
+ 		change_mask |= MTRR_CHANGE_MASK_FIXED;
+ 
+-	/*  Set_mtrr_restore restores the old value of MTRRdefType,
+-	   so to set it we fiddle with the saved value  */
+-	if ((deftype & 0xff) != mtrr_state.def_type
+-	    || MASK_EXTR(deftype, MTRRdefType_E) != mtrr_state.enabled
+-	    || MASK_EXTR(deftype, MTRRdefType_FE) != mtrr_state.fixed_enabled) {
+-		deftype = (deftype & ~0xcff) | mtrr_state.def_type |
+-		          MASK_INSR(mtrr_state.enabled, MTRRdefType_E) |
+-		          MASK_INSR(mtrr_state.fixed_enabled, MTRRdefType_FE);
++	if ((*deftype & 0xff) != mtrr_state.def_type
++	    || MASK_EXTR(*deftype, MTRRdefType_E) != mtrr_state.enabled
++	    || MASK_EXTR(*deftype, MTRRdefType_FE) != mtrr_state.fixed_enabled) {
++		*deftype = (*deftype & ~0xcff) | mtrr_state.def_type |
++		           MASK_INSR(mtrr_state.enabled, MTRRdefType_E) |
++		           MASK_INSR(mtrr_state.fixed_enabled, MTRRdefType_FE);
+ 		change_mask |= MTRR_CHANGE_MASK_DEFTYPE;
+ 	}
+ 
+@@ -440,9 +436,10 @@ static DEFINE_SPINLOCK(set_atomicity_lock);
+  * has been called.
+  */
+ 
+-static bool prepare_set(void)
++struct mtrr_pausing_state mtrr_pause_caching(void)
+ {
+ 	unsigned long cr4;
++	struct mtrr_pausing_state state;
+ 
+ 	/*  Note that this is not ideal, since the cache is only flushed/disabled
+ 	   for this CPU while the MTRRs are changed, but changing this requires
+@@ -462,7 +459,9 @@ static bool prepare_set(void)
+ 	alternative("wbinvd", "", X86_FEATURE_XEN_SELFSNOOP);
+ 
+ 	cr4 = read_cr4();
+-	if (cr4 & X86_CR4_PGE)
++	state.pge = cr4 & X86_CR4_PGE;
++
++	if (state.pge)
+ 		write_cr4(cr4 & ~X86_CR4_PGE);
+ 	else if (use_invpcid)
+ 		invpcid_flush_all();
+@@ -470,27 +469,27 @@ static bool prepare_set(void)
+ 		write_cr3(read_cr3());
+ 
+ 	/*  Save MTRR state */
+-	rdmsrl(MSR_MTRRdefType, deftype);
++	rdmsrl(MSR_MTRRdefType, state.def_type);
+ 
+ 	/*  Disable MTRRs, and set the default type to uncached  */
+-	mtrr_wrmsr(MSR_MTRRdefType, deftype & ~0xcff);
++	mtrr_wrmsr(MSR_MTRRdefType, state.def_type & ~0xcff);
+ 
+ 	/* Again, only flush caches if we have to. */
+ 	alternative("wbinvd", "", X86_FEATURE_XEN_SELFSNOOP);
+ 
+-	return cr4 & X86_CR4_PGE;
++	return state;
+ }
+ 
+-static void post_set(bool pge)
++void mtrr_resume_caching(struct mtrr_pausing_state state)
+ {
+ 	/* Intel (P6) standard MTRRs */
+-	mtrr_wrmsr(MSR_MTRRdefType, deftype);
++	mtrr_wrmsr(MSR_MTRRdefType, state.def_type);
+ 
+ 	/*  Enable caches  */
+ 	write_cr0(read_cr0() & ~X86_CR0_CD);
+ 
+ 	/*  Reenable CR4.PGE (also flushes the TLB) */
+-	if (pge)
++	if (state.pge)
+ 		write_cr4(read_cr4() | X86_CR4_PGE);
+ 	else if (use_invpcid)
+ 		invpcid_flush_all();
+@@ -504,15 +503,15 @@ void mtrr_set_all(void)
+ {
+ 	unsigned long mask, count;
+ 	unsigned long flags;
+-	bool pge;
++	struct mtrr_pausing_state pausing_state;
+ 
+ 	local_irq_save(flags);
+-	pge = prepare_set();
++	pausing_state = mtrr_pause_caching();
+ 
+ 	/* Actually set the state */
+-	mask = set_mtrr_state();
++	mask = set_mtrr_state(&pausing_state.def_type);
+ 
+-	post_set(pge);
++	mtrr_resume_caching(pausing_state);
+ 	local_irq_restore(flags);
+ 
+ 	/*  Use the atomic bitops to update the global mask  */
+@@ -537,12 +536,12 @@ void mtrr_set(
+ {
+ 	unsigned long flags;
+ 	struct mtrr_var_range *vr;
+-	bool pge;
++	struct mtrr_pausing_state pausing_state;
+ 
+ 	vr = &mtrr_state.var_ranges[reg];
+ 
+ 	local_irq_save(flags);
+-	pge = prepare_set();
++	pausing_state = mtrr_pause_caching();
+ 
+ 	if (size == 0) {
+ 		/* The invalid bit is kept in the mask, so we simply clear the
+@@ -563,7 +562,7 @@ void mtrr_set(
+ 		mtrr_wrmsr(MSR_IA32_MTRR_PHYSMASK(reg), vr->mask);
+ 	}
+ 
+-	post_set(pge);
++	mtrr_resume_caching(pausing_state);
+ 	local_irq_restore(flags);
+ }
+ 
 diff --git a/xen/arch/x86/cpu/mwait-idle.c b/xen/arch/x86/cpu/mwait-idle.c
 index 9c16cc166a..ff5ce2ec56 100644
 --- a/xen/arch/x86/cpu/mwait-idle.c
@@ -877,29 +1056,35 @@ index ca577c0bde..177c428883 100644
      rdmsrl(MSR_MTRRdefType, mtrr_def);
  
 diff --git a/xen/arch/x86/efi/efi-boot.h b/xen/arch/x86/efi/efi-boot.h
-index 1d8902a9a7..b1555efb2e 100644
+index 1d8902a9a7..1cfb4582d4 100644
 --- a/xen/arch/x86/efi/efi-boot.h
 +++ b/xen/arch/x86/efi/efi-boot.h
-@@ -13,8 +13,18 @@
+@@ -5,6 +5,12 @@
+  */
+ #include <xen/vga.h>
+ 
++/*
++ * Tell <asm/intel_txt.h> to access TXT registers without address translation
++ * which has not yet been set up.
++ */
++#define __EARLY_SLAUNCH__
++
+ #include <asm/boot-helpers.h>
+ #include <asm/e820.h>
+ #include <asm/edd.h>
+@@ -13,8 +19,11 @@
  #include <asm/setup.h>
  #include <asm/trampoline.h>
  #include <asm/efi.h>
-+#include <asm/slaunch.h>
-+
-+/*
-+ * Make <asm/intel_txt.h> access TXT registers without address translation which
-+ * is not set up at this point.
-+ */
-+#define __BOOT_DEFS_H__
 +#include <asm/intel_txt.h>
-+#undef __BOOT_DEFS_H__
++#include <asm/slaunch.h>
  
  static struct file __initdata ucode;
 +static uint64_t __initdata xen_image_size;
  static multiboot_info_t __initdata mbi = {
      .flags = MBI_MODULES | MBI_LOADERNAME
  };
-@@ -230,10 +240,29 @@ static void __init efi_arch_pre_exit_boot(void)
+@@ -230,10 +239,29 @@ static void __init efi_arch_pre_exit_boot(void)
      }
  }
  
@@ -930,10 +1115,12 @@ index 1d8902a9a7..b1555efb2e 100644
      efi_arch_relocate_image(__XEN_VIRT_START - xen_phys_start);
      memcpy(_p(trampoline_phys), trampoline_start, cfg.size);
  
-@@ -279,6 +308,63 @@ static void __init noreturn efi_arch_post_exit_boot(void)
+@@ -279,6 +307,65 @@ static void __init noreturn efi_arch_post_exit_boot(void)
      unreachable();
  }
  
++extern uint32_t slaunch_slrt;
++
 +static void __init attempt_secure_launch(void)
 +{
 +    struct slr_table *slrt;
@@ -994,7 +1181,7 @@ index 1d8902a9a7..b1555efb2e 100644
  static void __init efi_arch_cfg_file_early(const EFI_LOADED_IMAGE *image,
                                             EFI_FILE_HANDLE dir_handle,
                                             const char *section)
-@@ -775,6 +861,7 @@ static void __init efi_arch_halt(void)
+@@ -775,6 +862,7 @@ static void __init efi_arch_halt(void)
  static void __init efi_arch_load_addr_check(const EFI_LOADED_IMAGE *loaded_image)
  {
      xen_phys_start = (UINTN)loaded_image->ImageBase;
@@ -1131,17 +1318,17 @@ index 0000000000..d443f3d75d
 +    return 1;
 +}
 diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
-index a44475ae15..f62d599002 100644
+index a44475ae15..ef38903775 100644
 --- a/xen/arch/x86/hvm/vmx/vmcs.c
 +++ b/xen/arch/x86/hvm/vmx/vmcs.c
-@@ -33,6 +33,7 @@
+@@ -30,6 +30,7 @@
+ #include <asm/msr.h>
+ #include <asm/processor.h>
+ #include <asm/shadow.h>
++#include <asm/slaunch.h>
  #include <asm/spec_ctrl.h>
  #include <asm/tboot.h>
  #include <asm/xstate.h>
-+#include <asm/slaunch.h>
- 
- static bool __read_mostly opt_vpid_enabled = true;
- boolean_param("vpid", opt_vpid_enabled);
 @@ -724,7 +725,7 @@ static int _vmx_cpu_up(bool bsp)
      bios_locked = !!(eax & IA32_FEATURE_CONTROL_LOCK);
      if ( bios_locked )
@@ -1181,18 +1368,22 @@ index 72a0082d31..b438e6b895 100644
  
 diff --git a/xen/arch/x86/include/asm/intel_txt.h b/xen/arch/x86/include/asm/intel_txt.h
 new file mode 100644
-index 0000000000..9c10dc7f92
+index 0000000000..76ec651b11
 --- /dev/null
 +++ b/xen/arch/x86/include/asm/intel_txt.h
-@@ -0,0 +1,441 @@
+@@ -0,0 +1,452 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++
 +/*
 + * TXT configuration registers (offsets from TXT_{PUB, PRIV}_CONFIG_REGS_BASE)
 + */
 +#define TXT_PUB_CONFIG_REGS_BASE        0xfed30000
 +#define TXT_PRIV_CONFIG_REGS_BASE       0xfed20000
 +
-+/* The same set of registers is exposed twice (with different permissions) and
-+ * they are allocated continuously with page alignment. */
++/*
++ * The same set of registers is exposed twice (with different permissions) and
++ * they are allocated continuously with page alignment.
++ */
 +#define NR_TXT_CONFIG_SIZE \
 +    (TXT_PUB_CONFIG_REGS_BASE - TXT_PRIV_CONFIG_REGS_BASE)
 +
@@ -1272,21 +1463,21 @@ index 0000000000..9c10dc7f92
 +
 +#ifndef __ASSEMBLY__
 +
-+extern char txt_ap_entry[];
-+extern uint32_t trampoline_gdt[];
-+
 +#include <xen/slr_table.h>
-+#include <xen/types.h>
 +
-+/* We need to differentiate between pre- and post paging enabled. */
-+#ifdef __XEN_CONFIG_H__
++/* Need to differentiate between pre- and post paging enabled. */
++#ifdef __EARLY_SLAUNCH__
 +#include <xen/macros.h>
 +#define _txt(x) _p(x)
 +#else
++#include <xen/types.h>
 +#include <asm/page.h>   // __va()
 +#define _txt(x) __va(x)
 +#endif
 +
++extern char txt_ap_entry[];
++extern uint32_t trampoline_gdt[];
++
 +/*
 + * Always use private space as some of registers are either read-only or not
 + * present in public space.
@@ -1498,6 +1689,22 @@ index 0000000000..9c10dc7f92
 +        sizeof(uint64_t);
 +}
 +
++static inline void *txt_init(void)
++{
++    void *txt_heap;
++
++    /* Clear the TXT error register for a clean start of the day. */
++    write_txt_reg(TXTCR_ERRORCODE, 0);
++
++    txt_heap = _p(read_txt_reg(TXTCR_HEAP_BASE));
++
++    if ( txt_os_mle_data_size(txt_heap) < sizeof(struct txt_os_mle_data) ||
++         txt_os_sinit_data_size(txt_heap) < sizeof(struct txt_os_sinit_data) )
++        txt_reset(SLAUNCH_ERROR_GENERIC);
++
++    return txt_heap;
++}
++
 +static inline int is_in_pmr(struct txt_os_sinit_data *os_sinit, uint64_t base,
 +                            uint32_t size, int check_high)
 +{
@@ -1524,27 +1731,11 @@ index 0000000000..9c10dc7f92
 +    return 0;
 +}
 +
-+static inline void *txt_init(void)
-+{
-+    void *txt_heap;
-+
-+    /* Clear the TXT error registers for a clean start of day */
-+    write_txt_reg(TXTCR_ERRORCODE, 0);
-+
-+    txt_heap = _p(read_txt_reg(TXTCR_HEAP_BASE));
-+
-+    if ( txt_os_mle_data_size(txt_heap) < sizeof(struct txt_os_mle_data) ||
-+         txt_os_sinit_data_size(txt_heap) < sizeof(struct txt_os_sinit_data) )
-+        txt_reset(SLAUNCH_ERROR_GENERIC);
-+
-+    return txt_heap;
-+}
-+
 +static inline void txt_verify_pmr_ranges(struct txt_os_mle_data *os_mle,
 +                                         struct txt_os_sinit_data *os_sinit,
 +                                         struct slr_entry_intel_info *info,
 +                                         uint32_t load_base_addr,
-+                                         uint64_t tgt_base_addr,
++                                         uint32_t tgt_base_addr,
 +                                         uint32_t xen_size)
 +{
 +    int check_high_pmr = 0;
@@ -1587,8 +1778,10 @@ index 0000000000..9c10dc7f92
 +         !is_in_pmr(os_sinit, tgt_base_addr, xen_size, check_high_pmr) )
 +        txt_reset(SLAUNCH_ERROR_LO_PMR_MLE);
 +
-+    /* Check if MBI is covered by PMR. MBI starts with 'uint32_t total_size'.
-+     * There is no MBI on EFI boot. */
++    /*
++     * If present, check that MBI is covered by PMR. MBI starts with 'uint32_t
++     * total_size'.
++     */
 +    if ( info->boot_params_base != 0 &&
 +         !is_in_pmr(os_sinit, info->boot_params_base,
 +                    *(uint32_t *)(uintptr_t)info->boot_params_base,
@@ -1621,9 +1814,14 @@ index 0000000000..9c10dc7f92
 +    */
 +}
 +
-+extern void map_txt_mem_regions(void);
-+extern void protect_txt_mem_regions(void);
-+extern void txt_restore_mtrrs(bool e820_verbose);
++/* Prepares for accesses to TXT-specific memory. */
++void txt_map_mem_regions(void);
++
++/* Marks TXT-specific memory as used to avoid its corruption. */
++void txt_reserve_mem_regions(void);
++
++/* Restores original MTRR values saved by a bootloader before starting DRTM. */
++void txt_restore_mtrrs(bool e820_verbose);
 +
 +#endif /* __ASSEMBLY__ */
 diff --git a/xen/arch/x86/include/asm/mm.h b/xen/arch/x86/include/asm/mm.h
@@ -1654,6 +1852,25 @@ index 22d9e76e55..794cf44abe 100644
  #define MSR_X2APIC_TPR                      0x00000808
  #define MSR_X2APIC_PPR                      0x0000080a
  #define MSR_X2APIC_EOI                      0x0000080b
+diff --git a/xen/arch/x86/include/asm/mtrr.h b/xen/arch/x86/include/asm/mtrr.h
+index 25d442659d..82ea427ba0 100644
+--- a/xen/arch/x86/include/asm/mtrr.h
++++ b/xen/arch/x86/include/asm/mtrr.h
+@@ -66,6 +66,14 @@ extern uint8_t pat_type_2_pte_flags(uint8_t pat_type);
+ extern void mtrr_aps_sync_begin(void);
+ extern void mtrr_aps_sync_end(void);
+ 
++struct mtrr_pausing_state {
++	bool pge;
++	uint64_t def_type;
++};
++
++extern struct mtrr_pausing_state mtrr_pause_caching(void);
++extern void mtrr_resume_caching(struct mtrr_pausing_state state);
++
+ extern bool mtrr_var_range_msr_set(struct domain *d, struct mtrr_state *m,
+                                    uint32_t msr, uint64_t msr_content);
+ extern bool mtrr_fix_range_msr_set(struct domain *d, struct mtrr_state *m,
 diff --git a/xen/arch/x86/include/asm/processor.h b/xen/arch/x86/include/asm/processor.h
 index 75af7ea3c4..c0e577d091 100644
 --- a/xen/arch/x86/include/asm/processor.h
@@ -1690,42 +1907,51 @@ index ac34c69855..ecf2a75324 100644
  void early_cpu_init(bool verbose);
 diff --git a/xen/arch/x86/include/asm/slaunch.h b/xen/arch/x86/include/asm/slaunch.h
 new file mode 100644
-index 0000000000..b8a73a5ea6
+index 0000000000..5cfd9e95af
 --- /dev/null
 +++ b/xen/arch/x86/include/asm/slaunch.h
-@@ -0,0 +1,61 @@
+@@ -0,0 +1,91 @@
++/*
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
++ */
++
 +#ifndef _ASM_X86_SLAUNCH_H_
 +#define _ASM_X86_SLAUNCH_H_
 +
-+#include <xen/types.h>
 +#include <xen/slr_table.h>
++#include <xen/types.h>
 +
 +#define DRTM_LOC                   2
 +#define DRTM_CODE_PCR              17
 +#define DRTM_DATA_PCR              18
 +
 +/*
-+ * Secure Launch event log entry types. The TXT specification defines the
-+ * base event value as 0x400 for DRTM values.
-+ *
-+ * Using the same values for AMD SKINIT.
++ * Secure Launch event log entry types. The TXT specification defines the base
++ * event value as 0x400 for DRTM values, use it regardless of the DRTM for
++ * consistency.
 + */
-+#define TXT_EVTYPE_BASE            0x400
-+#define DLE_EVTYPE_SLAUNCH         (TXT_EVTYPE_BASE + 0x102)
-+#define DLE_EVTYPE_SLAUNCH_START   (TXT_EVTYPE_BASE + 0x103)
-+#define DLE_EVTYPE_SLAUNCH_END     (TXT_EVTYPE_BASE + 0x104)
++#define DLE_EVTYPE_BASE            0x400
++#define DLE_EVTYPE_SLAUNCH         (DLE_EVTYPE_BASE + 0x102)
++#define DLE_EVTYPE_SLAUNCH_START   (DLE_EVTYPE_BASE + 0x103)
++#define DLE_EVTYPE_SLAUNCH_END     (DLE_EVTYPE_BASE + 0x104)
++
++struct boot_info;
 +
 +extern bool slaunch_active;
-+extern uint32_t slaunch_slrt; /* physical address */
 +
-+/* evt_log is a physical address and the caller must map it to virtual, if
-+ * needed. */
++/*
++ * evt_log is assigned a physical address and the caller must map it to
++ * virtual, if needed.
++ */
 +static inline void find_evt_log(struct slr_table *slrt, void **evt_log,
 +                                uint32_t *evt_log_size)
 +{
-+    struct slr_entry_log_info *log_info =
-+        (void *)slr_next_entry_by_tag(slrt, NULL, SLR_ENTRY_LOG_INFO);
++    struct slr_entry_log_info *log_info;
 +
++    log_info = (struct slr_entry_log_info *)
++        slr_next_entry_by_tag(slrt, NULL, SLR_ENTRY_LOG_INFO);
 +    if ( log_info != NULL )
 +    {
 +        *evt_log = _p(log_info->addr);
@@ -1738,9 +1964,30 @@ index 0000000000..b8a73a5ea6
 +    }
 +}
 +
-+void map_slaunch_mem_regions(void);
++/*
++ * Retrieves pointer to SLRT.  Checks table's validity and maps it as necessary.
++ */
++struct slr_table *slaunch_get_slrt(void);
++
++/*
++ * Prepares for accesses to essential data structures setup by boot environment.
++ */
++void slaunch_map_mem_regions(void);
++
++/* Marks regions of memory as used to avoid their corruption. */
++void slaunch_reserve_mem_regions(void);
 +
-+void protect_slaunch_mem_regions(void);
++/* Measures essential parts of SLR table before making use of them. */
++void slaunch_measure_slrt(void);
++
++/*
++ * Takes measurements of DRTM policy entries except for MBI and SLRT which
++ * should have been measured by the time this is called. Also performs sanity
++ * checks of the policy and panics on failure. In particular, the function
++ * verifies that DRTM is consistent with modules obtained from MultibootInfo
++ * (MBI) and written to struct boot_info in setup.c.
++ */
++void slaunch_process_drtm_policy(const struct boot_info *bi);
 +
 +/*
 + * This helper function is used to map memory using L2 page tables by aligning
@@ -1748,11 +1995,11 @@ index 0000000000..b8a73a5ea6
 + * yet initialized) isn't needed for creating new L1 mappings. The function
 + * also checks and skips memory already mapped by the prebuilt tables.
 + *
-+ * There is no unmap_l2() because the function is meant to be used for code that
-+ * accesses TXT registers and TXT heap soon after which Xen rebuilds memory
-+ * maps, effectively dropping all existing mappings.
++ * There is no unmap_l2() because the function is meant to be used by the code
++ * that accesses DRTM-related memory soon after which Xen rebuilds memory maps,
++ * effectively dropping all existing mappings.
 + */
-+extern int map_l2(unsigned long paddr, unsigned long size);
++int slaunch_map_l2(unsigned long paddr, unsigned long size);
 +
 +#endif /* _ASM_X86_SLAUNCH_H_ */
 diff --git a/xen/arch/x86/include/asm/smp.h b/xen/arch/x86/include/asm/smp.h
@@ -1780,14 +2027,19 @@ index c8c7960134..14ce3afaf6 100644
  int cpu_add(uint32_t apic_id, uint32_t acpi_id, uint32_t pxm);
 diff --git a/xen/arch/x86/include/asm/tpm.h b/xen/arch/x86/include/asm/tpm.h
 new file mode 100644
-index 0000000000..77fa2500a9
+index 0000000000..d46eba673c
 --- /dev/null
 +++ b/xen/arch/x86/include/asm/tpm.h
-@@ -0,0 +1,24 @@
+@@ -0,0 +1,19 @@
++/*
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
++ */
++
 +#ifndef _ASM_X86_TPM_H_
 +#define _ASM_X86_TPM_H_
 +
-+#include <asm/bootinfo.h>
 +#include <xen/types.h>
 +
 +#define TPM_TIS_BASE  0xFED40000
@@ -1797,45 +2049,37 @@ index 0000000000..77fa2500a9
 +                     unsigned size, uint32_t type, const uint8_t *log_data,
 +                     unsigned log_data_size);
 +
-+/* Measures essential parts of SLR table before making use of them. */
-+void tpm_measure_slrt(void);
-+
-+/* Takes measurements of DRTM policy entries except for MBI and SLRT which
-+ * should have been measured by the time this is called. Also performs sanity
-+ * checks of the policy and panics on failure. In particular, the function
-+ * verifies that DRTM is consistent with modules obtained from MultibootInfo
-+ * (MBI) and written to struct boot_info in setup.c. */
-+void tpm_process_drtm_policy(const struct boot_info *bi);
-+
 +#endif /* _ASM_X86_TPM_H_ */
 diff --git a/xen/arch/x86/intel_txt.c b/xen/arch/x86/intel_txt.c
 new file mode 100644
-index 0000000000..0303a1090a
+index 0000000000..8ffcab0e61
 --- /dev/null
 +++ b/xen/arch/x86/intel_txt.c
-@@ -0,0 +1,212 @@
-+#include <xen/compiler.h>
-+#include <xen/types.h>
+@@ -0,0 +1,177 @@
++/*
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
++ */
++
++#include <xen/bug.h>
++#include <xen/init.h>
 +#include <xen/lib.h>
++#include <xen/types.h>
 +#include <asm/e820.h>
-+#include <xen/string.h>
-+#include <asm/page.h>
-+#include <asm/mtrr.h>
-+#include <asm/invpcid.h>
-+#include <asm/processor.h>
 +#include <asm/intel_txt.h>
++#include <asm/msr.h>
++#include <asm/mtrr.h>
 +#include <asm/slaunch.h>
-+#include <asm/system.h>
-+#include <asm/tpm.h>
-+#include <xen/init.h>
-+#include <xen/mm.h>
-+#include <xen/slr_table.h>
 +
 +static uint64_t __initdata txt_heap_base, txt_heap_size;
 +
-+void __init map_txt_mem_regions(void)
++void __init txt_map_mem_regions(void)
 +{
-+    map_l2(TXT_PRIV_CONFIG_REGS_BASE, NR_TXT_CONFIG_SIZE);
++    int rc;
++
++    rc = slaunch_map_l2(TXT_PRIV_CONFIG_REGS_BASE, NR_TXT_CONFIG_SIZE);
++    BUG_ON(rc != 0);
 +
 +    txt_heap_base = read_txt_reg(TXTCR_HEAP_BASE);
 +    BUG_ON(txt_heap_base == 0);
@@ -1843,32 +2087,48 @@ index 0000000000..0303a1090a
 +    txt_heap_size = read_txt_reg(TXTCR_HEAP_SIZE);
 +    BUG_ON(txt_heap_size == 0);
 +
-+    map_l2(txt_heap_base, txt_heap_size);
++    rc = slaunch_map_l2(txt_heap_base, txt_heap_size);
++    BUG_ON(rc != 0);
 +}
 +
 +/* Mark RAM region as RESERVED if it isn't marked that way already. */
-+static int __init reserve_e820(struct e820map *e820, uint64_t s, uint64_t e)
++static int __init mark_ram_as(struct e820map *e820, uint64_t start,
++                              uint64_t end, uint32_t type)
 +{
 +    unsigned int i;
++    uint32_t from_type = E820_RAM;
 +
 +    for ( i = 0; i < e820->nr_map; i++ )
 +    {
 +        uint64_t rs = e820->map[i].addr;
 +        uint64_t re = rs + e820->map[i].size;
-+        if ( s >= rs && e <= re )
++        if ( start >= rs && end <= re )
 +            break;
 +    }
 +
-+    if ( i != e820->nr_map && e820->map[i].type == E820_RESERVED )
-+    {
-+        /* Nothing to do, the range is already covered as reserved. */
++    /*
++     * Allow the range to be unlisted since we're only preventing RAM from
++     * use.
++     */
++    if ( i == e820->nr_map )
 +        return 1;
-+    }
 +
-+    return reserve_e820_ram(e820, s, e);
++    /*
++     * e820_change_range_type() fails if the range is already marked with the
++     * desired type. Don't consider it an error if firmware has done it for us.
++     */
++    if ( e820->map[i].type == type )
++        return 1;
++
++    /* E820_ACPI or E820_NVS are really unexpected, but others are fine. */
++    if ( e820->map[i].type == E820_RESERVED ||
++         e820->map[i].type == E820_UNUSABLE )
++        from_type = e820->map[i].type;
++
++    return e820_change_range_type(e820, start, end, from_type, type);
 +}
 +
-+void __init protect_txt_mem_regions(void)
++void __init txt_reserve_mem_regions(void)
 +{
 +    int rc;
 +    uint64_t sinit_base, sinit_size;
@@ -1877,7 +2137,8 @@ index 0000000000..0303a1090a
 +    BUG_ON(txt_heap_base == 0);
 +    printk("SLAUNCH: reserving TXT heap (%#lx - %#lx)\n", txt_heap_base,
 +           txt_heap_base + txt_heap_size);
-+    rc = reserve_e820(&e820_raw, txt_heap_base, txt_heap_base + txt_heap_size);
++    rc = mark_ram_as(&e820_raw, txt_heap_base, txt_heap_base + txt_heap_size,
++                     E820_RESERVED);
 +    BUG_ON(rc == 0);
 +
 +    sinit_base = read_txt_reg(TXTCR_SINIT_BASE);
@@ -1889,85 +2150,30 @@ index 0000000000..0303a1090a
 +    /* SINIT */
 +    printk("SLAUNCH: reserving SINIT memory (%#lx - %#lx)\n", sinit_base,
 +           sinit_base + sinit_size);
-+    rc = reserve_e820(&e820_raw, sinit_base, sinit_base + sinit_size);
++    rc = mark_ram_as(&e820_raw, sinit_base, sinit_base + sinit_size,
++                     E820_RESERVED);
 +    BUG_ON(rc == 0);
 +
 +    /* TXT Private Space */
-+    rc = e820_change_range_type(&e820_raw, TXT_PRIV_CONFIG_REGS_BASE,
-+                                TXT_PRIV_CONFIG_REGS_BASE + NR_TXT_CONFIG_SIZE,
-+                                E820_RAM, E820_UNUSABLE);
++    rc = mark_ram_as(&e820_raw, TXT_PRIV_CONFIG_REGS_BASE,
++                     TXT_PRIV_CONFIG_REGS_BASE + NR_TXT_CONFIG_SIZE,
++                     E820_UNUSABLE);
 +    BUG_ON(rc == 0);
 +}
 +
-+static DEFINE_SPINLOCK(set_atomicity_lock);
-+
-+static uint64_t deftype = 0;
-+
-+static bool disable_mtrrs(void)
-+{
-+    unsigned long cr4;
-+
-+    /*  Note that this is not ideal, since the cache is only flushed/disabled
-+       for this CPU while the MTRRs are changed, but changing this requires
-+       more invasive changes to the way the kernel boots  */
-+
-+    spin_lock(&set_atomicity_lock);
-+
-+    /*  Enter the no-fill (CD=1, NW=0) cache mode and flush caches. */
-+    write_cr0(read_cr0() | X86_CR0_CD);
-+
-+    /* Flush the caches */
-+    wbinvd();
-+
-+    cr4 = read_cr4();
-+    if (cr4 & X86_CR4_PGE)
-+        write_cr4(cr4 & ~X86_CR4_PGE);
-+    else if (use_invpcid)
-+        invpcid_flush_all();
-+    else
-+        write_cr3(read_cr3());
-+
-+    /*  Disable MTRRs, and set the default type to uncached  */
-+    rdmsrl(MSR_MTRRdefType, deftype);
-+    wrmsrl(MSR_MTRRdefType, deftype & ~0xcff);
-+
-+    /* Again, flush caches */
-+    wbinvd();
-+
-+    return cr4 & X86_CR4_PGE;
-+}
-+
-+static void enable_mtrrs(bool pge)
-+{
-+    /* Intel (P6) standard MTRRs */
-+    wrmsrl(MSR_MTRRdefType, deftype);
-+
-+    /*  Enable caches  */
-+    write_cr0(read_cr0() & ~X86_CR0_CD);
-+
-+    /*  Reenable CR4.PGE (also flushes the TLB) */
-+    if (pge)
-+        write_cr4(read_cr4() | X86_CR4_PGE);
-+    else if (use_invpcid)
-+        invpcid_flush_all();
-+    else
-+        write_cr3(read_cr3());
-+
-+    spin_unlock(&set_atomicity_lock);
-+}
-+
 +void __init txt_restore_mtrrs(bool e820_verbose)
 +{
-+    struct slr_table *slrt;
 +    struct slr_entry_intel_info *intel_info;
 +    uint64_t mtrr_cap, mtrr_def, base, mask;
 +    unsigned int i;
-+    bool pge;
++    uint64_t def_type;
++    struct mtrr_pausing_state pausing_state;
 +
 +    rdmsrl(MSR_MTRRcap, mtrr_cap);
 +    rdmsrl(MSR_MTRRdefType, mtrr_def);
 +
-+    if ( e820_verbose ) {
++    if ( e820_verbose )
++    {
 +        printk("MTRRs set previously for SINIT ACM:\n");
 +        printk(" MTRR cap: %"PRIx64" type: %"PRIx64"\n", mtrr_cap, mtrr_def);
 +
@@ -1981,11 +2187,11 @@ index 0000000000..0303a1090a
 +        }
 +    }
 +
-+    slrt = __va(slaunch_slrt);
 +    intel_info = (struct slr_entry_intel_info *)
-+        slr_next_entry_by_tag(slrt, NULL, SLR_ENTRY_INTEL_INFO);
++        slr_next_entry_by_tag(slaunch_get_slrt(), NULL, SLR_ENTRY_INTEL_INFO);
 +
-+    if ( (mtrr_cap & 0xFF) != intel_info->saved_bsp_mtrrs.mtrr_vcnt ) {
++    if ( (mtrr_cap & 0xFF) != intel_info->saved_bsp_mtrrs.mtrr_vcnt )
++    {
 +        printk("Bootloader saved %ld MTRR values, but there should be %ld\n",
 +               intel_info->saved_bsp_mtrrs.mtrr_vcnt, mtrr_cap & 0xFF);
 +        /* Choose the smaller one to be on the safe side. */
@@ -1993,7 +2199,8 @@ index 0000000000..0303a1090a
 +                   intel_info->saved_bsp_mtrrs.mtrr_vcnt : mtrr_cap;
 +    }
 +
-+    pge = disable_mtrrs();
++    def_type = intel_info->saved_bsp_mtrrs.default_mem_type;
++    pausing_state = mtrr_pause_caching();
 +
 +    for ( i = 0; i < (uint8_t)mtrr_cap; i++ )
 +    {
@@ -2003,15 +2210,15 @@ index 0000000000..0303a1090a
 +        wrmsrl(MSR_IA32_MTRR_PHYSMASK(i), mask);
 +    }
 +
-+    deftype = intel_info->saved_bsp_mtrrs.default_mem_type;
-+    enable_mtrrs(pge);
++    pausing_state.def_type = def_type;
++    mtrr_resume_caching(pausing_state);
 +
 +    if ( e820_verbose )
 +    {
 +        printk("Restored MTRRs:\n"); /* Printed by caller, mtrr_top_of_ram(). */
 +
 +        /* If MTRRs are not enabled or WB is not a default type, MTRRs won't be printed */
-+        if ( !test_bit(11, &deftype) || ((uint8_t)deftype == X86_MT_WB) )
++        if ( !test_bit(11, &def_type) || ((uint8_t)def_type == X86_MT_WB) )
 +        {
 +            for ( i = 0; i < (uint8_t)mtrr_cap; i++ )
 +            {
@@ -2103,19 +2310,18 @@ index 90abd3197f..d911fdfa32 100644
              ASSERT(g_info->apic_id != BAD_APICID);
              g_info->flags = 0;
 diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
-index 24b36c1a59..36a3ecb8dd 100644
+index 24b36c1a59..6ad78e0b44 100644
 --- a/xen/arch/x86/setup.c
 +++ b/xen/arch/x86/setup.c
-@@ -56,6 +56,8 @@
+@@ -52,6 +52,7 @@
+ #include <asm/prot-key.h>
+ #include <asm/pv/domain.h>
+ #include <asm/setup.h>
++#include <asm/slaunch.h>
+ #include <asm/smp.h>
  #include <asm/spec_ctrl.h>
  #include <asm/tboot.h>
- #include <asm/trampoline.h>
-+#include <asm/slaunch.h>
-+#include <asm/tpm.h>
- #include <asm/traps.h>
- 
- #include <xsm/xsm.h>
-@@ -170,8 +172,8 @@ unsigned long __read_mostly xen_phys_start;
+@@ -170,8 +171,8 @@ unsigned long __read_mostly xen_phys_start;
  char asmlinkage __section(".init.bss.stack_aligned") __aligned(STACK_SIZE)
      cpu0_stack[STACK_SIZE];
  
@@ -2126,7 +2332,7 @@ index 24b36c1a59..36a3ecb8dd 100644
  
  /* Used by the boot asm and EFI to stash the multiboot_info paddr. */
  unsigned int __initdata multiboot_ptr;
-@@ -411,7 +413,7 @@ static void __init init_idle_domain(void)
+@@ -411,7 +412,7 @@ static void __init init_idle_domain(void)
  void srat_detect_node(int cpu)
  {
      nodeid_t node;
@@ -2135,7 +2341,7 @@ index 24b36c1a59..36a3ecb8dd 100644
  
      node = apicid < MAX_LOCAL_APIC ? apicid_to_node[apicid] : NUMA_NO_NODE;
      if ( node == NUMA_NO_NODE )
-@@ -438,7 +440,7 @@ static void __init normalise_cpu_order(void)
+@@ -438,7 +439,7 @@ static void __init normalise_cpu_order(void)
  
      for_each_present_cpu ( i )
      {
@@ -2144,7 +2350,7 @@ index 24b36c1a59..36a3ecb8dd 100644
          min_diff = min_cpu = ~0u;
  
          /*
-@@ -449,12 +451,12 @@ static void __init normalise_cpu_order(void)
+@@ -449,12 +450,12 @@ static void __init normalise_cpu_order(void)
                j < nr_cpu_ids;
                j = cpumask_next(j, &cpu_present_map) )
          {
@@ -2159,7 +2365,7 @@ index 24b36c1a59..36a3ecb8dd 100644
              {
                  min_diff = diff;
                  min_cpu = j;
-@@ -470,9 +472,9 @@ static void __init normalise_cpu_order(void)
+@@ -470,9 +471,9 @@ static void __init normalise_cpu_order(void)
  
          /* Switch the best-matching CPU with the next CPU in logical order. */
          j = cpumask_next(i, &cpu_present_map);
@@ -2172,7 +2378,7 @@ index 24b36c1a59..36a3ecb8dd 100644
      }
  }
  
-@@ -1058,9 +1060,6 @@ static struct domain *__init create_dom0(struct boot_info *bi)
+@@ -1058,9 +1059,6 @@ static struct domain *__init create_dom0(struct boot_info *bi)
      return d;
  }
  
@@ -2182,27 +2388,27 @@ index 24b36c1a59..36a3ecb8dd 100644
  void asmlinkage __init noreturn __start_xen(void)
  {
      const char *memmap_type = NULL;
-@@ -1396,6 +1395,19 @@ void asmlinkage __init noreturn __start_xen(void)
+@@ -1396,6 +1394,19 @@ void asmlinkage __init noreturn __start_xen(void)
  #endif
      }
  
 +    if ( slaunch_active )
 +    {
-+        /* Prepare for accesses to essential data structures setup by boot
-+         * environment. */
-+        map_slaunch_mem_regions();
++        slaunch_map_mem_regions();
 +
-+        /* Measure SLRT here because it gets used by init_e820(), the rest is
-+         * measured below by tpm_process_drtm_policy(). */
-+        tpm_measure_slrt();
++        /*
++         * SLRT needs to be measured here because it is used by init_e820(), the
++         * rest is measured slightly below by slaunch_process_drtm_policy().
++         */
++        slaunch_measure_slrt();
 +
-+        protect_slaunch_mem_regions();
++        slaunch_reserve_mem_regions();
 +    }
 +
      /* Sanitise the raw E820 map to produce a final clean version. */
      max_page = raw_max_page = init_e820(memmap_type, &e820_raw);
  
-@@ -1414,6 +1426,14 @@ void asmlinkage __init noreturn __start_xen(void)
+@@ -1414,6 +1425,14 @@ void asmlinkage __init noreturn __start_xen(void)
      /* Create a temporary copy of the E820 map. */
      memcpy(&boot_e820, &e820, sizeof(e820));
  
@@ -2212,12 +2418,12 @@ index 24b36c1a59..36a3ecb8dd 100644
 +     * modules are relocated or used.
 +     */
 +    if ( slaunch_active )
-+        tpm_process_drtm_policy(bi);
++        slaunch_process_drtm_policy(bi);
 +
      /* Early kexec reservation (explicit static start address). */
      nr_pages = 0;
      for ( i = 0; i < e820.nr_map; i++ )
-@@ -2064,6 +2084,7 @@ void asmlinkage __init noreturn __start_xen(void)
+@@ -2064,6 +2083,7 @@ void asmlinkage __init noreturn __start_xen(void)
       */
      if ( !pv_shim )
      {
@@ -2225,7 +2431,7 @@ index 24b36c1a59..36a3ecb8dd 100644
          for_each_present_cpu ( i )
          {
              /* Set up cpu_to_node[]. */
-@@ -2071,6 +2092,14 @@ void asmlinkage __init noreturn __start_xen(void)
+@@ -2071,6 +2091,14 @@ void asmlinkage __init noreturn __start_xen(void)
              /* Set up node_to_cpumask based on cpu_to_node[]. */
              numa_add_cpu(i);
  
@@ -2273,157 +2479,168 @@ index 902076cf67..3ebac80257 100644
          }
 diff --git a/xen/arch/x86/slaunch.c b/xen/arch/x86/slaunch.c
 new file mode 100644
-index 0000000000..67f652a032
+index 0000000000..a4b7d00da5
 --- /dev/null
 +++ b/xen/arch/x86/slaunch.c
-@@ -0,0 +1,425 @@
+@@ -0,0 +1,464 @@
++/*
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
++ */
++
++#include <xen/compiler.h>
++#include <xen/efi.h>
++#include <xen/init.h>
++#include <xen/macros.h>
++#include <xen/mm.h>
 +#include <xen/types.h>
++#include <asm/bootinfo.h>
 +#include <asm/e820.h>
 +#include <asm/intel_txt.h>
 +#include <asm/page.h>
 +#include <asm/processor.h>
 +#include <asm/slaunch.h>
 +#include <asm/tpm.h>
-+#include <xen/efi.h>
-+#include <xen/init.h>
-+#include <xen/mm.h>
-+#include <asm/bootinfo.h>
 +
 +/* SLB is 64k, 64k-aligned */
-+#define SKINIT_SLB_SIZE  0x10000
-+#define SKINIT_SLB_ALIGN 0x10000
++#define SKINIT_SLB_SIZE   0x10000
++#define SKINIT_SLB_ALIGN  0x10000
 +
++/*
++ * These variables are assigned to by the code near Xen's entry point.
++ * slaunch_slrt is not declared in slaunch.h to facilitate accessing the
++ * variable through slaunch_get_slrt().
++ */
 +bool __initdata slaunch_active;
-+uint32_t __initdata slaunch_slrt;
++uint32_t __initdata slaunch_slrt; /* physical address */
 +
++/* Using slaunch_active in head.S assumes it's a single byte in size, so enforce
++ * this assumption. */
 +static void __maybe_unused compile_time_checks(void)
 +{
 +    BUILD_BUG_ON(sizeof(slaunch_active) != 1);
 +}
 +
-+int __init map_l2(unsigned long paddr, unsigned long size)
++struct slr_table *__init slaunch_get_slrt(void)
 +{
-+    unsigned long aligned_paddr = paddr & ~((1ULL << L2_PAGETABLE_SHIFT) - 1);
-+    unsigned long pages = ((paddr + size) - aligned_paddr);
-+    pages = ROUNDUP(pages, 1ULL << L2_PAGETABLE_SHIFT) >> PAGE_SHIFT;
-+
-+    if ( (aligned_paddr + pages * PAGE_SIZE) <= PREBUILT_MAP_LIMIT )
-+        return 0;
-+
-+    if ( aligned_paddr < PREBUILT_MAP_LIMIT )
-+    {
-+        pages -= (PREBUILT_MAP_LIMIT - aligned_paddr) >> PAGE_SHIFT;
-+        aligned_paddr = PREBUILT_MAP_LIMIT;
++    static struct slr_table *slrt;
++
++    if (slrt == NULL) {
++        int rc;
++        bool intel_cpu = (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL);
++        uint16_t slrt_architecture = intel_cpu ? SLR_INTEL_TXT : SLR_AMD_SKINIT;
++
++        slrt = __va(slaunch_slrt);
++
++        rc = slaunch_map_l2(slaunch_slrt, PAGE_SIZE);
++        BUG_ON(rc != 0);
++
++        if ( slrt->magic != SLR_TABLE_MAGIC )
++            panic("SLRT has invalid magic value: %#08x!\n", slrt->magic);
++        /* XXX: are newer revisions allowed? */
++        if ( slrt->revision != SLR_TABLE_REVISION )
++            panic("SLRT is of unsupported revision: %#04x!\n", slrt->revision);
++        if ( slrt->architecture != slrt_architecture )
++            panic("SLRT is for unexpected architecture: %#04x != %#04x!\n",
++                  slrt->architecture, slrt_architecture);
++        if ( slrt->size > slrt->max_size )
++            panic("SLRT is larger than its max size: %#08x > %#08x!\n",
++                  slrt->size, slrt->max_size);
++
++        if ( slrt->size > PAGE_SIZE )
++        {
++            rc = slaunch_map_l2(slaunch_slrt, slrt->size);
++            BUG_ON(rc != 0);
++        }
 +    }
 +
-+    return map_pages_to_xen((unsigned long)__va(aligned_paddr),
-+                            maddr_to_mfn(aligned_paddr),
-+                            pages, PAGE_HYPERVISOR);
++    return slrt;
 +}
 +
-+static uint32_t get_slb_start(void)
++static uint32_t __init get_slb_start(void)
 +{
-+    /* The runtime computation relies on size being a power of 2 and equal to
-+     * alignment. Make sure these assumptions hold. */
++    /*
++     * The runtime computation relies on size being a power of 2 and equal to
++     * alignment. Make sure these assumptions hold.
++     */
 +    BUILD_BUG_ON(SKINIT_SLB_SIZE != SKINIT_SLB_ALIGN);
 +    BUILD_BUG_ON(SKINIT_SLB_SIZE == 0);
 +    BUILD_BUG_ON((SKINIT_SLB_SIZE & (SKINIT_SLB_SIZE - 1)) != 0);
 +
-+    /* Rounding any address within SLB down to alignment gives SLB base and
-+     * SLRT is inside SLB on AMD. */
++    /*
++     * Rounding any address within SLB down to alignment gives SLB base and
++     * SLRT is inside SLB on AMD.
++     */
 +    return slaunch_slrt & ~(SKINIT_SLB_SIZE - 1);
 +}
 +
-+static struct slr_table *slr_get_table(void)
-+{
-+    bool intel_cpu = (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL);
-+    uint16_t slrt_architecture = intel_cpu ? SLR_INTEL_TXT : SLR_AMD_SKINIT;
-+
-+    struct slr_table *slrt = __va(slaunch_slrt);
-+
-+    map_l2(slaunch_slrt, PAGE_SIZE);
-+
-+    if ( slrt->magic != SLR_TABLE_MAGIC )
-+        panic("SLRT has invalid magic value: %#08x!\n", slrt->magic);
-+    /* XXX: are newer revisions allowed? */
-+    if ( slrt->revision != SLR_TABLE_REVISION )
-+        panic("SLRT is of unsupported revision: %#04x!\n", slrt->revision);
-+    if ( slrt->architecture != slrt_architecture )
-+        panic("SLRT is for unexpected architecture: %#04x != %#04x!\n",
-+              slrt->architecture, slrt_architecture);
-+    if ( slrt->size > slrt->max_size )
-+        panic("SLRT is larger than its max size: %#08x > %#08x!\n",
-+              slrt->size, slrt->max_size);
-+
-+    if ( slrt->size > PAGE_SIZE )
-+        map_l2(slaunch_slrt, slrt->size);
-+
-+    return slrt;
-+}
-+
-+void __init map_slaunch_mem_regions(void)
++void __init slaunch_map_mem_regions(void)
 +{
++    int rc;
 +    void *evt_log_addr;
 +    uint32_t evt_log_size;
 +
-+    map_l2(TPM_TIS_BASE, TPM_TIS_SIZE);
++    rc = slaunch_map_l2(TPM_TIS_BASE, TPM_TIS_SIZE);
++    BUG_ON(rc != 0);
 +
-+    /* Vendor-specific part, which may include slaunch_slrt. */
++    /* Vendor-specific part. */
 +    if ( boot_cpu_data.x86_vendor == X86_VENDOR_INTEL )
-+    {
-+        map_txt_mem_regions();
-+    }
++        txt_map_mem_regions();
 +    else if ( boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
-+    {
-+        map_l2(get_slb_start(), SKINIT_SLB_SIZE);
-+    }
++        slaunch_map_l2(get_slb_start(), SKINIT_SLB_SIZE);
 +
-+    find_evt_log(slr_get_table(), &evt_log_addr, &evt_log_size);
++    find_evt_log(slaunch_get_slrt(), &evt_log_addr, &evt_log_size);
 +    if ( evt_log_addr != NULL )
-+        map_l2((unsigned long)evt_log_addr, evt_log_size);
++    {
++        rc = slaunch_map_l2((uintptr_t)evt_log_addr, evt_log_size);
++        BUG_ON(rc != 0);
++    }
 +}
 +
-+void __init protect_slaunch_mem_regions(void)
++void __init slaunch_reserve_mem_regions(void)
 +{
 +    int rc;
 +
 +    void *evt_log_addr;
 +    uint32_t evt_log_size;
 +
-+    find_evt_log(slr_get_table(), &evt_log_addr, &evt_log_size);
-+    if ( evt_log_addr != NULL )
-+    {
-+        printk("SLAUNCH: reserving event log (%#lx - %#lx)\n",
-+               (uint64_t)evt_log_addr,
-+               (uint64_t)evt_log_addr + evt_log_size);
-+        rc = reserve_e820_ram(&e820_raw, (uint64_t)evt_log_addr,
-+                              (uint64_t)evt_log_addr + evt_log_size);
-+        BUG_ON(rc == 0);
-+    }
-+
 +    /* Vendor-specific part. */
 +    if ( boot_cpu_data.x86_vendor == X86_VENDOR_INTEL )
 +    {
-+        protect_txt_mem_regions();
++        txt_reserve_mem_regions();
 +    }
 +    else if ( boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
 +    {
 +        uint64_t slb_start = get_slb_start();
 +        uint64_t slb_end = slb_start + SKINIT_SLB_SIZE;
 +        printk("SLAUNCH: reserving SLB (%#lx - %#lx)\n", slb_start, slb_end);
-+        e820_change_range_type(&e820_raw, slb_start, slb_end,
-+                               E820_RAM, E820_RESERVED);
++        rc = reserve_e820_ram(&e820_raw, slb_start, slb_end);
++        BUG_ON(rc == 0);
++    }
++
++    find_evt_log(slaunch_get_slrt(), &evt_log_addr, &evt_log_size);
++    if ( evt_log_addr != NULL )
++    {
++        printk("SLAUNCH: reserving event log (%#lx - %#lx)\n",
++               (uint64_t)evt_log_addr,
++               (uint64_t)evt_log_addr + evt_log_size);
++        rc = reserve_e820_ram(&e820_raw, (uint64_t)evt_log_addr,
++                              (uint64_t)evt_log_addr + evt_log_size);
++        BUG_ON(rc == 0);
 +    }
 +}
 +
-+void tpm_measure_slrt(void)
++void __init slaunch_measure_slrt(void)
 +{
-+    struct slr_table *slrt = slr_get_table();
++    struct slr_table *slrt = slaunch_get_slrt();
 +
 +    if ( slrt->revision == 1 )
 +    {
-+        /* In revision one of the SLRT, only platform-specific info table is
-+         * measured. */
++        /*
++         * In revision one of the SLRT, only platform-specific info table is
++         * measured.
++         */
 +        if ( boot_cpu_data.x86_vendor == X86_VENDOR_INTEL )
 +        {
 +            struct slr_entry_intel_info tmp;
@@ -2463,14 +2680,14 @@ index 0000000000..67f652a032
 +    else
 +    {
 +        /*
-+         * slr_get_table() checks that the revision is valid, so we must not
-+         * get here unless the code is wrong.
++         * slaunch_get_slrt() checks that the revision is valid, so we must not get
++         * here unless the code is wrong.
 +         */
 +        panic("Unhandled SLRT revision: %d!\n", slrt->revision);
 +    }
 +}
 +
-+static struct slr_entry_policy *slr_get_policy(struct slr_table *slrt)
++static struct slr_entry_policy *__init slr_get_policy(struct slr_table *slrt)
 +{
 +    struct slr_entry_policy *policy;
 +
@@ -2487,9 +2704,10 @@ index 0000000000..67f652a032
 +    return policy;
 +}
 +
-+static void check_slrt_policy_entry(struct slr_policy_entry *policy_entry,
-+                                    int idx,
-+                                    struct slr_table *slrt)
++static void __init
++check_slrt_policy_entry(struct slr_policy_entry *policy_entry,
++                        int idx,
++                        struct slr_table *slrt)
 +{
 +    if ( policy_entry->entity_type != SLR_ET_SLRT )
 +        panic("Expected DRTM policy entry #%d to describe SLRT, got %#04x!\n",
@@ -2503,10 +2721,11 @@ index 0000000000..67f652a032
 +}
 +
 +/* Returns number of policy entries that were already measured. */
-+static unsigned int check_drtm_policy(struct slr_table *slrt,
-+                                      struct slr_entry_policy *policy,
-+                                      struct slr_policy_entry *policy_entry,
-+                                      const struct boot_info *bi)
++static unsigned int __init
++check_drtm_policy(struct slr_table *slrt,
++                  struct slr_entry_policy *policy,
++                  struct slr_policy_entry *policy_entry,
++                  const struct boot_info *bi)
 +{
 +    uint32_t i;
 +    uint32_t num_mod_entries;
@@ -2514,8 +2733,10 @@ index 0000000000..67f652a032
 +
 +    min_entries = efi_enabled(EFI_BOOT) ? 1 : 2;
 +    if ( policy->nr_entries < min_entries )
++    {
 +        panic("DRTM policy in SLRT contains less than %d entries (%d)!\n",
 +              min_entries, policy->nr_entries);
++    }
 +
 +    if ( efi_enabled(EFI_BOOT) )
 +    {
@@ -2526,8 +2747,10 @@ index 0000000000..67f652a032
 +
 +    /* This must be legacy MultiBoot2 boot. */
 +
-+    /* MBI policy entry must be the first one, so that measuring order matches
-+     * policy order. */
++    /*
++     * MBI policy entry must be the first one, so that measuring order matches
++     * policy order.
++     */
 +    if ( policy_entry[0].entity_type != SLR_ET_MULTIBOOT2_INFO )
 +        panic("First entry of DRTM policy in SLRT is not MBI: %#04x!\n",
 +              policy_entry[0].entity_type);
@@ -2538,11 +2761,6 @@ index 0000000000..67f652a032
 +    /* SLRT policy entry must be the second one. */
 +    check_slrt_policy_entry(&policy_entry[1], 1, slrt);
 +
-+    /*
-+     * XXX: this loop uses transitionary format of struct boot_module, added in
-+     * 7cf6e073e47 "x86/boot: introduce struct boot_module", and will have to
-+     * be updated if that definition changes.
-+     */
 +    for ( i = 0; i < bi->nr_modules; i++ )
 +    {
 +        uint16_t j;
@@ -2591,15 +2809,16 @@ index 0000000000..67f652a032
 +    return 2;
 +}
 +
-+void tpm_process_drtm_policy(const struct boot_info *bi)
++void __init slaunch_process_drtm_policy(const struct boot_info *bi)
 +{
 +    struct slr_table *slrt;
 +    struct slr_entry_policy *policy;
 +    struct slr_policy_entry *policy_entry;
++    int rc;
 +    uint16_t i;
 +    unsigned int measured;
 +
-+    slrt = slr_get_table();
++    slrt = slaunch_get_slrt();
 +
 +    policy = slr_get_policy(slrt);
 +    policy_entry = (struct slr_policy_entry *)
@@ -2645,7 +2864,9 @@ index 0000000000..67f652a032
 +            panic("Unexpected implicitly-sized DRTM entry of Secure Launch at %d (type %d, info: %s)\n",
 +                  i, policy_entry[i].entity_type, policy_entry[i].evt_info);
 +
-+        map_l2(start, size);
++        rc = slaunch_map_l2(start, size);
++        BUG_ON(rc != 0);
++
 +        tpm_hash_extend(DRTM_LOC, policy_entry[i].pcr, __va(start), size,
 +                        DLE_EVTYPE_SLAUNCH, (uint8_t *)policy_entry[i].evt_info,
 +                        strnlen(policy_entry[i].evt_info,
@@ -2689,12 +2910,16 @@ index 0000000000..67f652a032
 +             *
 +             * 2 MiB is minimally mapped size and it should more than suffice.
 +             */
-+            map_l2(string, 2 * 1024 * 1024);
++            rc = slaunch_map_l2(string, 2 * 1024 * 1024);
++            BUG_ON(rc != 0);
++
 +            tpm_hash_extend(DRTM_LOC, DRTM_DATA_PCR,
 +                            __va(string), strlen(__va(string)),
 +                            DLE_EVTYPE_SLAUNCH, LOG_DATA("MB module string"));
 +
-+            map_l2(start, size);
++            rc = slaunch_map_l2(start, size);
++            BUG_ON(rc != 0);
++
 +            tpm_hash_extend(DRTM_LOC, DRTM_CODE_PCR, __va(start), size,
 +                            DLE_EVTYPE_SLAUNCH, LOG_DATA("MB module"));
 +        }
@@ -2702,19 +2927,46 @@ index 0000000000..67f652a032
 +#undef LOG_DATA
 +    }
 +}
++
++int __init slaunch_map_l2(unsigned long paddr, unsigned long size)
++{
++    unsigned long aligned_paddr = paddr & ~((1ULL << L2_PAGETABLE_SHIFT) - 1);
++    unsigned long pages = ((paddr + size) - aligned_paddr);
++    pages = ROUNDUP(pages, 1ULL << L2_PAGETABLE_SHIFT) >> PAGE_SHIFT;
++
++    if ( aligned_paddr + pages * PAGE_SIZE <= PREBUILT_MAP_LIMIT )
++        return 0;
++
++    if ( aligned_paddr < PREBUILT_MAP_LIMIT )
++    {
++        pages -= (PREBUILT_MAP_LIMIT - aligned_paddr) >> PAGE_SHIFT;
++        aligned_paddr = PREBUILT_MAP_LIMIT;
++    }
++
++    return map_pages_to_xen((uintptr_t)__va(aligned_paddr),
++                            maddr_to_mfn(aligned_paddr),
++                            pages, PAGE_HYPERVISOR);
++}
 diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
-index 54207e6d88..0161bb4c4f 100644
+index 54207e6d88..5a98fe3ddd 100644
 --- a/xen/arch/x86/smpboot.c
 +++ b/xen/arch/x86/smpboot.c
-@@ -32,6 +32,8 @@
+@@ -29,6 +29,7 @@
+ #include <asm/flushtlb.h>
+ #include <asm/guest.h>
+ #include <asm/idt.h>
++#include <asm/intel_txt.h>
  #include <asm/io_apic.h>
  #include <asm/irq-vectors.h>
  #include <asm/mc146818rtc.h>
-+#include <asm/intel_txt.h>
-+#include <asm/slaunch.h>
- #include <asm/microcode.h>
- #include <asm/msr.h>
+@@ -37,6 +38,7 @@
  #include <asm/mtrr.h>
+ #include <asm/prot-key.h>
+ #include <asm/setup.h>
++#include <asm/slaunch.h>
+ #include <asm/spec_ctrl.h>
+ #include <asm/tboot.h>
+ #include <asm/time.h>
 @@ -66,27 +68,30 @@ unsigned int __read_mostly nr_sockets;
  cpumask_t **__read_mostly socket_cpumask;
  static cpumask_t *secondary_socket_cpumask;
@@ -2943,6 +3195,10 @@ index 54207e6d88..0161bb4c4f 100644
 -    booting_cpu = cpu;
 -
 -    start_eip = bootsym_phys(entry_SIPI16);
+-
+-    /* start_eip needs be page aligned, and below the 1M boundary. */
+-    if ( start_eip & ~0xff000 )
+-        panic("AP trampoline %#lx not suitably positioned\n", start_eip);
 +    /* Check if AP is already up. */
 +    if ( cpu_state[cpu] != CPU_STATE_INIT )
 +    {
@@ -2950,18 +3206,14 @@ index 54207e6d88..0161bb4c4f 100644
 +        unsigned long start_eip;
 +        start_eip = bootsym_phys(entry_SIPI16);
  
--    /* start_eip needs be page aligned, and below the 1M boundary. */
--    if ( start_eip & ~0xff000 )
--        panic("AP trampoline %#lx not suitably positioned\n", start_eip);
-+        /* start_eip needs be page aligned, and below the 1M boundary. */
-+        if ( start_eip & ~0xff000 )
-+            panic("AP trampoline %#lx not suitably positioned\n", start_eip);
- 
 -    /* So we see what's up   */
 -    if ( opt_cpu_info )
 -        printk("Booting processor %d/%d eip %lx\n",
 -               cpu, apicid, start_eip);
--
++        /* start_eip needs be page aligned, and below the 1M boundary. */
++        if ( start_eip & ~0xff000 )
++            panic("AP trampoline %#lx not suitably positioned\n", start_eip);
+ 
 -    stack_start = stack_base[cpu] + STACK_SIZE - sizeof(struct cpu_info);
 +        /* So we see what's up   */
 +        if ( opt_cpu_info )
@@ -3055,7 +3307,7 @@ index 54207e6d88..0161bb4c4f 100644
 +void smp_send_init_sipi_sipi_allbutself(void)
 +{
 +    unsigned long start_eip;
-+    start_eip = bootsym_phys(trampoline_realmode_entry);
++    start_eip = bootsym_phys(entry_SIPI16);
 +
 +    /* start_eip needs be page aligned, and below the 1M boundary. */
 +    if ( start_eip & ~0xff000 )
@@ -3205,25 +3457,14 @@ index d5db60d335..f68354c374 100644
          return 0;
 diff --git a/xen/arch/x86/tpm.c b/xen/arch/x86/tpm.c
 new file mode 100644
-index 0000000000..f0668bcd23
+index 0000000000..8562296681
 --- /dev/null
 +++ b/xen/arch/x86/tpm.c
-@@ -0,0 +1,1039 @@
+@@ -0,0 +1,1057 @@
 +/*
-+ * Copyright (c) 2022-2024 3mdeb Sp. z o.o. All rights reserved.
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
++ * Copyright (c) 2022-2025 3mdeb Sp. z o.o. All rights reserved.
 + */
 +
 +#include <xen/sha1.h>
@@ -3234,7 +3475,7 @@ index 0000000000..f0668bcd23
 +#include <asm/tpm.h>
 +#include <asm/x86-vendors.h>
 +
-+#ifdef __EARLY_TPM__
++#ifdef __EARLY_SLAUNCH__
 +
 +#ifdef __va
 +#error "__va defined in non-paged mode!"
@@ -3242,7 +3483,12 @@ index 0000000000..f0668bcd23
 +
 +#define __va(x)     _p(x)
 +
-+uint32_t slaunch_slrt;
++/* Implementation of slaunch_get_slrt() for early TPM code. */
++static uint32_t slrt_location;
++struct slr_table *slaunch_get_slrt(void)
++{
++    return __va(slrt_location);
++}
 +
 +/*
 + * The code is being compiled as a standalone binary without linking to any
@@ -3284,7 +3530,7 @@ index 0000000000..f0668bcd23
 +        && edx == X86_VENDOR_AMD_EDX;
 +}
 +
-+#else   /* __EARLY_TPM__ */
++#else   /* __EARLY_SLAUNCH__ */
 +
 +#include <xen/mm.h>
 +#include <xen/pfn.h>
@@ -3294,7 +3540,7 @@ index 0000000000..f0668bcd23
 +    return boot_cpu_data.x86_vendor == X86_VENDOR_AMD;
 +}
 +
-+#endif  /* __EARLY_TPM__ */
++#endif  /* __EARLY_SLAUNCH__ */
 +
 +#define TPM_LOC_REG(loc, reg)   (0x1000 * (loc) + (reg))
 +
@@ -3355,7 +3601,8 @@ index 0000000000..f0668bcd23
 +    unsigned i;
 +
 +    /* Make sure TPM can accept a command. */
-+    if ( (tis_read8(TPM_STS_(loc)) & STS_COMMAND_READY) == 0 ) {
++    if ( (tis_read8(TPM_STS_(loc)) & STS_COMMAND_READY) == 0 )
++    {
 +        /* Abort current command. */
 +        tis_write8(TPM_STS_(loc), STS_COMMAND_READY);
 +        /* Wait until TPM is ready for a new one. */
@@ -3507,7 +3754,7 @@ index 0000000000..f0668bcd23
 +    struct TPM12_PCREvent   PCREvents[];
 +};
 +
-+#ifdef __EARLY_TPM__
++#ifdef __EARLY_SLAUNCH__
 +#define CMD_RSP_BUF_SIZE    (sizeof(struct sha1_update_cmd) + MAX_HASH_BLOCK)
 +
 +union cmd_rsp {
@@ -3544,7 +3791,8 @@ index 0000000000..f0668bcd23
 +    if ( max_bytes > swap32(cmd_rsp.start_r.maxNumBytes) )
 +        max_bytes = swap32(cmd_rsp.start_r.maxNumBytes);
 +
-+    while ( size > 64 ) {
++    while ( size > 64 )
++    {
 +        if ( size < max_bytes )
 +            max_bytes = size & ~(64 - 1);
 +
@@ -3627,7 +3875,7 @@ index 0000000000..f0668bcd23
 +    return (o_size >= sizeof(struct extend_rsp));
 +}
 +
-+#endif /* __EARLY_TPM__ */
++#endif /* __EARLY_SLAUNCH__ */
 +
 +static void *create_log_event12(struct txt_ev_log_container_12 *evt_log,
 +                                uint32_t evt_log_size, uint32_t pcr,
@@ -3636,7 +3884,8 @@ index 0000000000..f0668bcd23
 +{
 +    struct TPM12_PCREvent *new_entry;
 +
-+    if ( is_amd_cpu() ) {
++    if ( is_amd_cpu() )
++    {
 +        /*
 +         * On AMD, TXT-compatible structure is stored as vendor data of
 +         * TCG-defined event log header.
@@ -3835,7 +4084,7 @@ index 0000000000..f0668bcd23
 +    /* uint8_t vendorInfo[vendorInfoSize]; */
 +} __packed;
 +
-+#ifdef __EARLY_TPM__
++#ifdef __EARLY_SLAUNCH__
 +
 +union tpm2_cmd_rsp {
 +    uint8_t b[sizeof(struct tpm2_sequence_update_cmd) + MAX_HASH_BLOCK];
@@ -3875,7 +4124,8 @@ index 0000000000..f0668bcd23
 +    send_cmd(loc, cmd_rsp.b, swap32(cmd_rsp.c.paramSize), &o_size);
 +
 +    if ( cmd_rsp.r.tag == swap16(TPM_ST_NO_SESSIONS) &&
-+         cmd_rsp.r.paramSize == swap32(10) ) {
++         cmd_rsp.r.paramSize == swap32(10) )
++    {
 +        rc = swap32(cmd_rsp.r.returnCode);
 +        if ( rc != 0 )
 +            goto error;
@@ -3883,7 +4133,8 @@ index 0000000000..f0668bcd23
 +
 +    seq_handle = swap32(cmd_rsp.start_r.sequenceHandle);
 +
-+    while ( size > 64 ) {
++    while ( size > 64 )
++    {
 +        if ( size < max_bytes )
 +            max_bytes = size & ~(64 - 1);
 +
@@ -3903,7 +4154,8 @@ index 0000000000..f0668bcd23
 +        send_cmd(loc, cmd_rsp.b, swap32(cmd_rsp.c.paramSize), &o_size);
 +
 +        if ( cmd_rsp.r.tag == swap16(TPM_ST_NO_SESSIONS) &&
-+             cmd_rsp.r.paramSize == swap32(10) ) {
++             cmd_rsp.r.paramSize == swap32(10) )
++        {
 +            rc = swap32(cmd_rsp.r.returnCode);
 +            if ( rc != 0 )
 +                goto error;
@@ -3931,33 +4183,36 @@ index 0000000000..f0668bcd23
 +    send_cmd(loc, cmd_rsp.b, swap32(cmd_rsp.c.paramSize), &o_size);
 +
 +    if ( cmd_rsp.r.tag == swap16(TPM_ST_NO_SESSIONS) &&
-+         cmd_rsp.r.paramSize == swap32(10) ) {
++         cmd_rsp.r.paramSize == swap32(10) )
++    {
 +        rc = swap32(cmd_rsp.r.returnCode);
 +        if ( rc != 0 )
 +            goto error;
 +    }
 +
 +    p = cmd_rsp.finish_r.hashes;
-+    for ( i = 0; i < swap32(cmd_rsp.finish_r.hashCount); ++i ) {
++    for ( i = 0; i < swap32(cmd_rsp.finish_r.hashCount); ++i )
++    {
 +        unsigned j;
 +        uint16_t hash_type;
 +
 +        hash_type = swap16(*(uint16_t *)p);
 +        p += sizeof(uint16_t);
 +
-+        for ( j = 0; j < log_hashes->count; ++j ) {
++        for ( j = 0; j < log_hashes->count; ++j )
++        {
 +            struct tpm2_log_hash *hash = &log_hashes->hashes[j];
-+            if ( hash->alg == hash_type ) {
++            if ( hash->alg == hash_type )
++            {
 +                memcpy(hash->data, p, hash->size);
 +                p += hash->size;
 +                break;
 +            }
 +        }
 +
-+        if ( j == log_hashes->count ) {
++        if ( j == log_hashes->count )
 +            /* Can't continue parsing without knowing hash size. */
 +            break;
-+        }
 +    }
 +
 +    rc = 0;
@@ -3996,10 +4251,12 @@ index 0000000000..f0668bcd23
 +    };
 +
 +    p = cmd_rsp.extend_c.hashes;
-+    for ( i = 0; i < log_hashes->count; ++i ) {
++    for ( i = 0; i < log_hashes->count; ++i )
++    {
 +        const struct tpm2_log_hash *hash = &log_hashes->hashes[i];
 +
-+        if ( p + sizeof(uint16_t) + hash->size > &cmd_rsp.b[sizeof(cmd_rsp)] ) {
++        if ( p + sizeof(uint16_t) + hash->size > &cmd_rsp.b[sizeof(cmd_rsp)] )
++        {
 +            printk(XENLOG_ERR "Hit TPM message size implementation limit: %ld\n",
 +                   sizeof(cmd_rsp));
 +            return -1;
@@ -4030,8 +4287,10 @@ index 0000000000..f0668bcd23
 +        .hashes[0] = *hash,
 +    };
 +
-+    /* This is a valid way of checking hash support, using it to not implement
-+     * TPM2_GetCapability(). */
++    /*
++     * This is a valid way of checking hash support, using it to not implement
++     * TPM2_GetCapability().
++     */
 +    rc = tpm20_pcr_extend(loc, /*pcr_handle=*/TPM_RH_NULL, &hashes);
 +
 +    return rc == 0;
@@ -4047,9 +4306,11 @@ index 0000000000..f0668bcd23
 +
 +    request_locality(loc);
 +
-+    for ( i = 0; i < log_hashes->count; ++i ) {
++    for ( i = 0; i < log_hashes->count; ++i )
++    {
 +        const struct tpm2_log_hash *hash = &log_hashes->hashes[i];
-+        if ( !tpm_supports_hash(loc, hash) ) {
++        if ( !tpm_supports_hash(loc, hash) )
++        {
 +            printk(XENLOG_WARNING "Skipped hash unsupported by TPM: %d\n",
 +                   hash->alg);
 +            continue;
@@ -4062,7 +4323,8 @@ index 0000000000..f0668bcd23
 +        else
 +            /* create_log_event20() took care of initializing the digest. */;
 +
-+        if ( supported_hashes.count == MAX_HASH_COUNT ) {
++        if ( supported_hashes.count == MAX_HASH_COUNT )
++        {
 +            printk(XENLOG_ERR "Hit hash count implementation limit: %d\n",
 +                   MAX_HASH_COUNT);
 +            return -1;
@@ -4078,7 +4340,7 @@ index 0000000000..f0668bcd23
 +    return rc;
 +}
 +
-+#endif /* __EARLY_TPM__ */
++#endif /* __EARLY_SLAUNCH__ */
 +
 +static struct heap_event_log_pointer_element2_1 *
 +find_evt_log_ext_data(struct tpm2_spec_id_event *evt_log)
@@ -4086,7 +4348,8 @@ index 0000000000..f0668bcd23
 +    struct txt_os_sinit_data *os_sinit;
 +    struct txt_ext_data_element *ext_data;
 +
-+    if ( is_amd_cpu() ) {
++    if ( is_amd_cpu() )
++    {
 +        /*
 +         * Event log pointer is defined by TXT specification, but
 +         * secure-kernel-loader provides a compatible structure in vendor data
@@ -4109,7 +4372,8 @@ index 0000000000..f0668bcd23
 +     * Find TXT_HEAP_EXTDATA_TYPE_EVENT_LOG_POINTER2_1 which is necessary to
 +     * know where to put the next entry.
 +     */
-+    while ( ext_data->type != TXT_HEAP_EXTDATA_TYPE_END ) {
++    while ( ext_data->type != TXT_HEAP_EXTDATA_TYPE_END )
++    {
 +        if ( ext_data->type == TXT_HEAP_EXTDATA_TYPE_EVENT_LOG_POINTER2_1 )
 +            break;
 +        ext_data = (void *)&ext_data->data[ext_data->size];
@@ -4139,7 +4403,8 @@ index 0000000000..f0668bcd23
 +        return log_hashes;
 +
 +    entry_size = sizeof(*new_entry);
-+    for ( i = 0; i < evt_log->digestCount; ++i ) {
++    for ( i = 0; i < evt_log->digestCount; ++i )
++    {
 +        entry_size += sizeof(uint16_t); /* hash type */
 +        entry_size += evt_log->digestSizes[i].digestSize;
 +    }
@@ -4163,7 +4428,8 @@ index 0000000000..f0668bcd23
 +    new_entry->digestCount = evt_log->digestCount;
 +
 +    p = &new_entry->digests[0];
-+    for ( i = 0; i < evt_log->digestCount; ++i ) {
++    for ( i = 0; i < evt_log->digestCount; ++i )
++    {
 +        uint16_t alg = evt_log->digestSizes[i].algId;
 +        uint16_t size = evt_log->digestSizes[i].digestSize;
 +
@@ -4199,10 +4465,11 @@ index 0000000000..f0668bcd23
 +    void *evt_log_addr;
 +    uint32_t evt_log_size;
 +
-+    find_evt_log(__va(slaunch_slrt), &evt_log_addr, &evt_log_size);
++    find_evt_log(slaunch_get_slrt(), &evt_log_addr, &evt_log_size);
 +    evt_log_addr = __va((uintptr_t)evt_log_addr);
 +
-+    if ( is_tpm12() ) {
++    if ( is_tpm12() )
++    {
 +        uint8_t sha1_digest[SHA1_DIGEST_SIZE];
 +
 +        struct txt_ev_log_container_12 *evt_log = evt_log_addr;
@@ -4213,12 +4480,15 @@ index 0000000000..f0668bcd23
 +        if ( entry_digest == NULL )
 +            entry_digest = sha1_digest;
 +
-+        if ( !tpm12_hash_extend(loc, buf, size, pcr, entry_digest) ) {
-+#ifndef __EARLY_TPM__
++        if ( !tpm12_hash_extend(loc, buf, size, pcr, entry_digest) )
++        {
++#ifndef __EARLY_SLAUNCH__
 +            printk(XENLOG_ERR "Extending PCR%u failed\n", pcr);
 +#endif
 +        }
-+    } else {
++    }
++    else
++    {
 +        uint32_t rc;
 +
 +        struct tpm2_spec_id_event *evt_log = evt_log_addr;
@@ -4227,8 +4497,9 @@ index 0000000000..f0668bcd23
 +                               log_data_size);
 +
 +        rc = tpm2_hash_extend(loc, buf, size, pcr, &log_hashes);
-+        if ( rc != 0 ) {
-+#ifndef __EARLY_TPM__
++        if ( rc != 0 )
++        {
++#ifndef __EARLY_SLAUNCH__
 +            printk(XENLOG_ERR "Extending PCR%u failed with TPM error: 0x%08x\n",
 +                   pcr, rc);
 +#endif
@@ -4236,12 +4507,11 @@ index 0000000000..f0668bcd23
 +    }
 +}
 +
-+#ifdef __EARLY_TPM__
++#ifdef __EARLY_SLAUNCH__
 +void tpm_extend_mbi(uint32_t *mbi, uint32_t slrt_pa)
 +{
-+    /* Early TPM code isn't linked with the rest but still needs to have this
-+     * variable with correct value. */
-+    slaunch_slrt = slrt_pa;
++    /* Need this to implement slaunch_get_slrt() for early TPM code. */
++    slrt_location = slrt_pa;
 +
 +    /* MBI starts with uint32_t total_size. */
 +    tpm_hash_extend(DRTM_LOC, DRTM_DATA_PCR, (uint8_t *)mbi, *mbi,
@@ -4318,10 +4588,12 @@ index 160804e294..614dfce66a 100644
  extern struct efi efi;
 diff --git a/xen/include/xen/sha1.h b/xen/include/xen/sha1.h
 new file mode 100644
-index 0000000000..85be7b3c12
+index 0000000000..752dfdf827
 --- /dev/null
 +++ b/xen/include/xen/sha1.h
-@@ -0,0 +1,10 @@
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
 +#ifndef __XEN_SHA1_H
 +#define __XEN_SHA1_H
 +
@@ -4334,10 +4606,12 @@ index 0000000000..85be7b3c12
 +#endif /* !__XEN_SHA1_H */
 diff --git a/xen/include/xen/sha256.h b/xen/include/xen/sha256.h
 new file mode 100644
-index 0000000000..0a483b6fd6
+index 0000000000..703eddc198
 --- /dev/null
 +++ b/xen/include/xen/sha256.h
-@@ -0,0 +1,10 @@
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
 +#ifndef __XEN_SHA256_H
 +#define __XEN_SHA256_H
 +
@@ -4350,11 +4624,11 @@ index 0000000000..0a483b6fd6
 +#endif /* !__XEN_SHA256_H */
 diff --git a/xen/include/xen/slr_table.h b/xen/include/xen/slr_table.h
 new file mode 100644
-index 0000000000..a9f9e05389
+index 0000000000..e9dbac5d0a
 --- /dev/null
 +++ b/xen/include/xen/slr_table.h
 @@ -0,0 +1,274 @@
-+/* SPDX-License-Identifier: GPL-3.0 */
++/* SPDX-License-Identifier: GPL-3.0-or-later */
 +
 +/*
 + *  Copyright (C) 2023  Oracle and/or its affiliates.
@@ -4365,8 +4639,10 @@ index 0000000000..a9f9e05389
 +#ifndef _SLR_TABLE_H
 +#define _SLR_TABLE_H
 +
++#include <xen/types.h>
++
 +#define UEFI_SLR_TABLE_GUID \
-+    { 0x877a9b2a, 0x0385, 0x45d1, { 0xa0, 0x34, 0x9d, 0xac, 0x9c, 0x9e, 0x56, 0x5f }}
++    { 0x877a9b2a, 0x0385, 0x45d1, { 0xa0, 0x34, 0x9d, 0xac, 0x9c, 0x9e, 0x56, 0x5f } }
 +
 +/* SLR table header values */
 +#define SLR_TABLE_MAGIC         0x4452544d
@@ -4453,6 +4729,9 @@ index 0000000000..a9f9e05389
 +    uint64_t context;
 +} __packed;
 +
++/*
++ * Prototype of a function pointed to by slr_entry_dl_info::dl_handler.
++ */
 +typedef void (*dl_handler_func)(struct slr_bl_context *bl_context);
 +
 +/*
@@ -4622,11 +4901,6 @@ index 0000000000..a9f9e05389
 +    return NULL;
 +}
 +
-+/*
-+ * slr_add_entry() and slr_init_table() were omitted to not have issues with
-+ * memcpy() usage.
-+ */
-+
 +#endif /* _SLR_TABLE_H */
 diff --git a/xen/lib/Makefile b/xen/lib/Makefile
 index 76dc86fab0..c7a8d1bb02 100644
@@ -4889,7 +5163,7 @@ index 0000000000..a11822519d
 +}
 diff --git a/xen/lib/sha256.c b/xen/lib/sha256.c
 new file mode 100644
-index 0000000000..d569efa88c
+index 0000000000..369a52af80
 --- /dev/null
 +++ b/xen/lib/sha256.c
 @@ -0,0 +1,238 @@
@@ -4906,9 +5180,9 @@ index 0000000000..d569efa88c
 + * Copyright (c) 2014 Red Hat Inc.
 + */
 +
-+#include <xen/unaligned.h>
 +#include <xen/bitops.h>
 +#include <xen/sha256.h>
++#include <xen/unaligned.h>
 +
 +#define SHA256_BLOCK_SIZE 64
 +

[SergiiDmytruk]

Do these patches need to be CCed to trenchboot-devel@googlegroups.com? Parallel AP patches weren't.