Re: [PATCH 2/2] virt: tdx-guest: Allocate Quote buffer dynamically

[Peter Fang <peter.fang@intel.com>]

On Mon, Jul 13, 2026 at 10:27:46AM -0700, Kuppuswamy Sathyanarayanan wrote:
> Hi Peter,
> 
> On 6/12/2026 4:08 AM, Peter Fang wrote:
> > From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> > 
> > The TDX attestation driver currently uses a fixed 128 KB Quote buffer
> > shared with the host VMM. This may be too small for Quotes using schemes
> > such as post-quantum cryptography (PQC), where certificate chains can
> > increase the Quote size to several megabytes.
> > 
> > Allocate the Quote buffer based on the size reported by the TDX module
> > instead of always reserving a fixed-size buffer. This avoids wasting
> > memory on platforms that do not require larger Quotes. Older platforms
> > fall back to the default 128 KB buffer.
> > 
> > Because the Quote buffer must be physically contiguous, its size is
> > bound by the buddy allocator's maximum page order (4 MB), which should
> > be sufficient for current attestation needs.
> > 
> > struct tdx_quote_buf has a trailing flexible array, so use offsetof()
> > instead of sizeof() to calculate the header size.
> > 
> > Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> > Assisted-by: Claude:claude-opus-4-7
> > Assisted-by: GitHub Copilot:gpt-5.4
> > Signed-off-by: Peter Fang <peter.fang@intel.com>
> > ---
> 
> Looks good to me.
> 
> Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>

Thanks Sathya!

> 
> 
> >  drivers/virt/coco/tdx-guest/tdx-guest.c | 52 ++++++++++++++++++-------
> >  1 file changed, 38 insertions(+), 14 deletions(-)
> > 
> > diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
> > index a9ecc46df187..162fb47f3fae 100644
> > --- a/drivers/virt/coco/tdx-guest/tdx-guest.c
> > +++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
> > @@ -163,7 +163,7 @@ static void tdx_mr_deinit(const struct attribute_group *mr_grp)
> >   * DICE-based attestation uses layered evidence that requires
> >   * larger Quote size (~100K).
> >   */
> > -#define GET_QUOTE_BUF_SIZE		SZ_128K
> > +#define GET_QUOTE_DEFAULT_BUF_SIZE	SZ_128K
> >  
> >  #define GET_QUOTE_CMD_VER		1
> >  
> > @@ -171,7 +171,7 @@ static void tdx_mr_deinit(const struct attribute_group *mr_grp)
> >  #define GET_QUOTE_SUCCESS		0
> >  #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
> >  
> > -#define TDX_QUOTE_MAX_LEN		(GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
> > +#define TDX_QUOTE_BUF_LEN(n)		(offsetof(struct tdx_quote_buf, data) + (n))
> >  
> >  /* struct tdx_quote_buf: Format of Quote request buffer.
> >   * @version: Quote format version, filled by TD.
> > @@ -192,8 +192,9 @@ struct tdx_quote_buf {
> >  	u8 data[];
> >  };
> >  
> > -/* Quote data buffer */
> > +/* Quote data buffer and size */
> >  static void *quote_data;
> > +static size_t quote_data_size;
> >  

[ ... ]

> >  
> > @@ -286,7 +310,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
> >  	if (desc->inblob_len != TDX_REPORTDATA_LEN)
> >  		return -EINVAL;
> >  
> > -	memset(quote_data, 0, GET_QUOTE_BUF_SIZE);
> > +	memset(quote_data, 0, quote_data_size);
> >  
> >  	/* Update Quote buffer header */
> >  	quote_buf->version = GET_QUOTE_CMD_VER;
> > @@ -297,7 +321,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
> >  	if (ret)
> >  		return ret;
> >  
> > -	err = tdx_hcall_get_quote(quote_data, GET_QUOTE_BUF_SIZE);
> > +	err = tdx_hcall_get_quote(quote_data, quote_data_size);
> >  	if (err) {
> >  		pr_err("GetQuote hypercall failed, status:%llx\n", err);
> >  		return -EIO;
> > @@ -316,7 +340,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
> >  
> >  	out_len = READ_ONCE(quote_buf->out_len);
> >  
> > -	if (out_len > TDX_QUOTE_MAX_LEN)
> > +	if (TDX_QUOTE_BUF_LEN(out_len) > quote_data_size)
> >  		return -EFBIG;
> 
> Nit: I think this check will be more readable if you can rename
> quote_data_size to quote_buf_size (since it holds total buffer
> size).

Hm. This pairs with the original "static void *quote_data". Or perhaps
"quote_data_len"?

>