Re: [PATCH v3 0/4] tdx-guest: Make Quote buffer size dynamic

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Wed, 2026-08-12 at 07:08 -0700, Sean Christopherson wrote:
> >   |Normal quote    |Migration quote |Report size|Quote size|uAPI location  |
> > -|----------------|----------------|-----------|----------|---------------|
> > 1|Platform scoped |Platform scoped |Grows      |Grows     |TDX host driver|
> 
> With my KVM hat on, this option looks very attractive.
> 
> And with the caveat that I'm most definitely not an attestation expert, from a
> separate of concerns perspective, IMO it seems like the report should contain
> the TD-specific information while the quote just wraps that information in
> platform-specific goo.
> 
> In other words, to me, TD-scoped quotes feel like a hack that was thrown in to
> avoid having to modify the guest because y'all didn't plan ahead.

Caveman crypto person here too. It seems scattered and makes me similarly
suspicious about some lack of planning. But I kind of came to a different
conclusion on what went wrong.

It seems to me that from the overall solution level, the report should never
have had the details in it. It should just be some nonce or some type of thing
that can tie the guest request to the quote that it ends up getting
back. Doesn't it seem weird to get a bunch of details from the TDX module, then
pass them from the guest to host KVM to host userspace then back to the TDX
module... which already had all those details?

My understanding was that the original SGX attestation was a complicator of the
design of this stuff. Because I'm not sure that SGX had all those details about
the TD. In fact I can't see how it could have. Is that right Peter? So it needs
them all to be passed in. All the extra validations etc of this shuffling is
TDX's problems to deal with, but for Linux, it would be at least a lot less
confusing if there was not two things that have the TD details in them.

That said, from KVM POV, (1) kicks the attestation out of KVM. I see the
benefit. But a TD quote is a TD scoped operation in concept. To me at least.