[PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Peter Fang]

Hi,

This is v4 of the series to make the TDX guest driver's Quote buffer
size dynamic. The only functional change since v3 is an updated
TDCS_QUOTE_MAX_SIZE encoding. The rest is documentation, changelogs, and
stronger page alignment for the Quote buffer size. It also collected RB
tags from several reviewers. Dave, Kiryl and Rick your review would be
much appreciated.

Newer TDX modules have an ABI that tells the guest how big a Quote can
get. The Quote buffer no longer has to be a fixed size. So effectively:

  s/FIXED_BUF_SIZE/queried_buf_size/

...in the TDX guest driver.

Terminology
===========

A "TD Quote" is an attestation structure signed with a platform key. It
contains information about a TDX guest and the platform it's running on.

The "Quote buffer" in the TDX guest driver is a memory buffer shared
between the TDX guest and the host VMM to retrieve TD Quotes. It has a
header defined in the GHCI spec [1].

Device Identifier Composition Engine ("DICE") provides a framework for
layering attestation evidence. This replaces the SGX model of contacting
an Intel server to obtain a certificate.

Problem
=======

The fixed-size Quote buffer approach is not sustainable. As
cryptographic algorithms evolve, TD Quote sizes also grow. A previous
commit [2] increased the guest driver's fixed-size Quote buffer to
128KB to accommodate DICE Quotes, but it may still be insufficient when
those Quotes use post-quantum cryptography (PQC). PQC certificate chains
are roughly 10x-15x larger than conventional ones, which can increase
Quote sizes significantly.

What's in this series
=====================

To avoid changing the driver whenever the Quote buffer becomes too
small, newer TDX modules report their maximum Quote size via a metadata
field. The guest driver uses this value for its Quote buffer when
available. Older TDX modules continue to use the 128KB buffer.

Patches 2 and 3 refactor the existing fixed buffer handling. Patch 4
then makes the buffer size dynamic.

The "outblob" file in configfs-tsm no longer has a fixed maximum size.
The limit can now come from this new TDX module ABI.

Patch 1/4: Add a helper to read the QUOTE_MAX_SIZE metadata field.
Patch 2/4: Calculate the Quote buffer size with struct_size_t().
Patch 3/4: Store the Quote buffer size in a variable instead of a
           constant.
Patch 4/4: Allocate the Quote buffer using the queried size, when
           available.

AI use
======

I used Claude:claude-opus-5 to help edit this cover letter and the
changelogs, and to collect the review feedback on lore. The series also
underwent AI code review (Claude:claude-opus-4-7), but its comments were
limited to style suggestions and existing issues. Sashiko's __GFP_NOWARN
suggestion was adopted in v2, but it was dropped in v3.

v3: https://lore.kernel.org/all/20260729122939.1340412-1-peter.fang@intel.com/

Changes in v4:
 - Update the TDCS_QUOTE_MAX_SIZE encoding to 0x9010000200000007.
 - Provide documentation for the metadata field. [Rick, Kiryl]
 - Document the reported size's properties. [Xiaoyao, Tony]
 - Page align quote_data_len unconditionally. [Xiaoyao]
 - Collect Reviewed-by tags. [Sathya, Tony, Xiaoyao, Binbin]

v2: https://lore.kernel.org/all/20260717214349.4075994-1-peter.fang@intel.com/

Changes in v3:
 - Split the v2 "Allocate Quote buffer dynamically" patch to do the
   refactoring first, then make the buffer size dynamic. [Dave]
 - Improve patterns for readability. [Dave]
 - Drop __GFP_NOWARN so an allocation failure warns. [Dave, Rick, Kiryl]
 - Add Binbin's Reviewed-by to patch 1.
 - Drop the Reviewed-by tags (Kiryl, Binbin) as the patch was reworked.

v1: https://lore.kernel.org/all/20260612110853.3188196-1-peter.fang@intel.com/

Changes in v2:
 - Collect Reviewed-by tags. [Kiryl, Xiaoyao, Binbin, Sathya]
 - Keep the explicit (u32) cast in tdx_get_max_quote_size(). [Binbin]
 - Calculate the Quote buffer size with struct_size_t(). [Kiryl, Binbin]
 - Add __GFP_NOWARN to the allocation since its size comes from the
   host. [sashiko]
 - Rename quote_data_size to quote_data_len. [Sathya]
 - Drop the Assisted-by tags, as AI was not used to write the code.

[1] Guest Hypervisor Communication Interface (GHCI) Specification,
    Version 1.5, Section "TDG.VP.VMCALL<GetQuote>"
[2] 43185067c6fd ("configfs-tsm-report: tdx_guest: Increase Quote buffer
    size to 128KB")

Kuppuswamy Sathyanarayanan (1):
  virt: tdx-guest: Allocate Quote buffer dynamically

Peter Fang (3):
  x86/tdx: Add helper to query maximum TD Quote size
  virt: tdx-guest: Calculate the Quote buffer size safely
  virt: tdx-guest: Use a variable to store the Quote buffer size

 arch/x86/coco/tdx/tdx.c                 | 24 +++++++++++
 arch/x86/include/asm/shared/tdx.h       |  1 +
 arch/x86/include/asm/tdx.h              |  2 +
 drivers/virt/coco/tdx-guest/tdx-guest.c | 53 +++++++++++++++++++------
 4 files changed, 67 insertions(+), 13 deletions(-)


base-commit: fd73f4a6659897191fa0d40695fe370925dd3780
-- 
2.53.0

[PATCH v4 1/4] x86/tdx: Add helper to query maximum TD Quote size

[Peter Fang]

TDX attestation report ("Quote") sizes can grow with newer cryptographic
schemes, so guests can no longer rely on a fixed-size buffer for the
Quote.

Newer TDX modules report the maximum Quote size via the
TDCS_QUOTE_MAX_SIZE metadata field [1]. Add a helper to query the size
instead of exposing tdg_vm_rd() directly, as it can read arbitrary
metadata fields.

The reported size covers every Quote type the platform can produce,
including SGX-based Quotes. A runtime TDX module update should not
change the size. So if a Quote does not fit, it is a TDX module bug.

Thanks to Xu Yilun for suggesting this in an off-list discussion.

[1] "Intel TDX Module ABI Definitions", August 2026

Signed-off-by: Peter Fang <peter.fang@intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
---
v4:
 - Update the TDCS_QUOTE_MAX_SIZE encoding to 0x9010000200000007. [1]
 - Provide documentation for the metadata field. [Rick, Kiryl]
 - Document that the reported size covers every Quote type. [Xiaoyao]
 - Document that a module update does not change the reported size.
   [Tony]
 - Add Tony's Reviewed-by.
v3:
 - No code changes. Add Binbin's Reviewed-by.
v2:
 - Keep the explicit (u32) cast to document the metadata field width.
   [Binbin]
 - Note that Xu Yilun's suggestion was made in an off-list discussion.
   [Sathya]
 - Drop the Assisted-by tags, as the code was not written by AI.
---
 arch/x86/coco/tdx/tdx.c           | 24 ++++++++++++++++++++++++
 arch/x86/include/asm/shared/tdx.h |  1 +
 arch/x86/include/asm/tdx.h        |  2 ++
 3 files changed, 27 insertions(+)

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index f904a636d449..b98058d7d244 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -198,6 +198,30 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t size)
 }
 EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
 
+/**
+ * tdx_get_max_quote_size() - Get the maximum TD Quote size
+ *
+ * Read the maximum size of a TD Quote from a 4-byte TD metadata field. The TDX
+ * guest driver uses it to size the buffer for Quotes. Older TDX modules do not
+ * support this field and return an error.
+ *
+ * The reported size covers every Quote type supported by the platform,
+ * including SGX-based Quotes.
+ *
+ * A runtime TDX module update does not change the reported size.
+ *
+ * Return: Maximum Quote size in bytes on success, or 0 on failure.
+ */
+u32 tdx_get_max_quote_size(void)
+{
+	u64 val, ret;
+
+	ret = tdg_vm_rd(TDCS_QUOTE_MAX_SIZE, &val);
+
+	return ret ? 0 : (u32)val;
+}
+EXPORT_SYMBOL_GPL(tdx_get_max_quote_size);
+
 static void __noreturn tdx_panic(const char *msg)
 {
 	struct tdx_module_args args = {
diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
index f20e91d7ac35..6f106d4b1a58 100644
--- a/arch/x86/include/asm/shared/tdx.h
+++ b/arch/x86/include/asm/shared/tdx.h
@@ -50,6 +50,7 @@
 /* TDX TD-Scope Metadata. To be used by TDG.VM.WR and TDG.VM.RD */
 #define TDCS_CONFIG_FLAGS		0x1110000300000016
 #define TDCS_TD_CTLS			0x1110000300000017
+#define TDCS_QUOTE_MAX_SIZE		0x9010000200000007
 #define TDCS_NOTIFY_ENABLES		0x9100000000000010
 #define TDCS_TOPOLOGY_ENUM_CONFIGURED	0x9100000000000019
 
diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
index 89e97d5761d8..a75dbbe004bd 100644
--- a/arch/x86/include/asm/tdx.h
+++ b/arch/x86/include/asm/tdx.h
@@ -83,6 +83,8 @@ int tdx_mcall_extend_rtmr(u8 index, u8 *data);
 
 u64 tdx_hcall_get_quote(u8 *buf, size_t size);
 
+u32 tdx_get_max_quote_size(void);
+
 void __init tdx_dump_attributes(u64 td_attr);
 void __init tdx_dump_td_ctls(u64 td_ctls);
 
-- 
2.53.0

[PATCH v4 2/4] virt: tdx-guest: Calculate the Quote buffer size safely

[Peter Fang]

struct tdx_quote_buf has a trailing flexible array member.
struct_size_t() calculates the size of this kind of struct safely. It
handles overflow, which helps since the Quote size comes from the host.

Use it to rewrite the bounds check logic, since

  "header_size + data_len > buf_size"

...is more readable than "data_len > buf_size - header_size".

Signed-off-by: Peter Fang <peter.fang@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
---
v4:
 - No code changes.
 - Add Reviewed-by tags. [Sathya, Tony, Xiaoyao, Binbin]
v3:
 - Split out the use of struct_size_t() for buffer length from the v2
   "Allocate Quote buffer dynamically" patch to refactor first. [Dave]
 - Drop the Reviewed-by tags from v2 (Kiryl, Binbin) as the patch was
   reworked.
---
 drivers/virt/coco/tdx-guest/tdx-guest.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
index d0303e31e816..f47c5429d002 100644
--- a/drivers/virt/coco/tdx-guest/tdx-guest.c
+++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
@@ -170,7 +170,7 @@ static void tdx_mr_deinit(const struct attribute_group *mr_grp)
 #define GET_QUOTE_SUCCESS		0
 #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
 
-#define TDX_QUOTE_MAX_LEN		(GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
+#define TDX_QUOTE_BUF_LEN(n)		struct_size_t(struct tdx_quote_buf, data, n)
 
 /* struct tdx_quote_buf: Format of Quote request buffer.
  * @version: Quote format version, filled by TD.
@@ -315,7 +315,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 
 	out_len = READ_ONCE(quote_buf->out_len);
 
-	if (out_len > TDX_QUOTE_MAX_LEN)
+	if (TDX_QUOTE_BUF_LEN(out_len) > GET_QUOTE_BUF_SIZE)
 		return -EFBIG;
 
 	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
-- 
2.53.0

[PATCH v4 3/4] virt: tdx-guest: Use a variable to store the Quote buffer size

[Peter Fang]

In preparation for dynamic Quote buffer size, replace the fixed size
constant with a variable.

The constant is sprinkled across several places. Read the size from the
variable instead.

Signed-off-by: Peter Fang <peter.fang@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
---
v4:
 - Keep the PAGE_ALIGN() when initializing quote_data_len. [Xiaoyao]
 - Add Reviewed-by tags. [Sathya, Tony, Binbin]
v3:
 - Split out using a variable for the buffer size from the v2 "Allocate
   Quote buffer dynamically" patch to refactor first. [Dave]
 - Pass the buffer size into alloc_quote_buf() by value. [Dave]
 - Drop the Reviewed-by tags from v2 (Kiryl, Binbin) as the patch was
   reworked.
---
 drivers/virt/coco/tdx-guest/tdx-guest.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
index f47c5429d002..ec886c401fcb 100644
--- a/drivers/virt/coco/tdx-guest/tdx-guest.c
+++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
@@ -191,8 +191,9 @@ struct tdx_quote_buf {
 	u8 data[];
 };
 
-/* Quote data buffer */
+/* Quote data buffer and length */
 static void *quote_data;
+static size_t quote_data_len;
 
 /* Lock to streamline quote requests */
 static DEFINE_MUTEX(quote_lock);
@@ -209,9 +210,8 @@ static long tdx_get_report0(struct tdx_report_req __user *req)
 			     USER_SOCKPTR(req->tdreport));
 }
 
-static void free_quote_buf(void *buf)
+static void free_quote_buf(void *buf, size_t len)
 {
-	size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
 	unsigned int count = len >> PAGE_SHIFT;
 
 	if (set_memory_encrypted((unsigned long)buf, count)) {
@@ -222,9 +222,8 @@ static void free_quote_buf(void *buf)
 	free_pages_exact(buf, len);
 }
 
-static void *alloc_quote_buf(void)
+static void *alloc_quote_buf(size_t len)
 {
-	size_t len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
 	unsigned int count = len >> PAGE_SHIFT;
 	void *addr;
 
@@ -285,7 +284,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 	if (desc->inblob_len != TDX_REPORTDATA_LEN)
 		return -EINVAL;
 
-	memset(quote_data, 0, GET_QUOTE_BUF_SIZE);
+	memset(quote_data, 0, quote_data_len);
 
 	/* Update Quote buffer header */
 	quote_buf->version = GET_QUOTE_CMD_VER;
@@ -296,7 +295,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 	if (ret)
 		return ret;
 
-	err = tdx_hcall_get_quote(quote_data, GET_QUOTE_BUF_SIZE);
+	err = tdx_hcall_get_quote(quote_data, quote_data_len);
 	if (err) {
 		pr_err("GetQuote hypercall failed, status:%llx\n", err);
 		return -EIO;
@@ -315,7 +314,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 
 	out_len = READ_ONCE(quote_buf->out_len);
 
-	if (TDX_QUOTE_BUF_LEN(out_len) > GET_QUOTE_BUF_SIZE)
+	if (TDX_QUOTE_BUF_LEN(out_len) > quote_data_len)
 		return -EFBIG;
 
 	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
@@ -417,7 +416,8 @@ static int __init tdx_guest_init(void)
 	if (ret)
 		goto deinit_mr;
 
-	quote_data = alloc_quote_buf();
+	quote_data_len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
+	quote_data = alloc_quote_buf(quote_data_len);
 	if (!quote_data) {
 		pr_err("Failed to allocate Quote buffer\n");
 		ret = -ENOMEM;
@@ -431,7 +431,7 @@ static int __init tdx_guest_init(void)
 	return 0;
 
 free_quote:
-	free_quote_buf(quote_data);
+	free_quote_buf(quote_data, quote_data_len);
 free_misc:
 	misc_deregister(&tdx_misc_dev);
 deinit_mr:
@@ -444,7 +444,7 @@ module_init(tdx_guest_init);
 static void __exit tdx_guest_exit(void)
 {
 	tsm_report_unregister(&tdx_tsm_ops);
-	free_quote_buf(quote_data);
+	free_quote_buf(quote_data, quote_data_len);
 	misc_deregister(&tdx_misc_dev);
 	tdx_mr_deinit(tdx_attr_groups[0]);
 }
-- 
2.53.0

[PATCH v4 4/4] virt: tdx-guest: Allocate Quote buffer dynamically

[Peter Fang]

From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>

A new TDX module ABI reports the Quote size limit in a metadata field.
Prior to this, the guest driver uses a fixed 128KB buffer. Intel derived
this number from current Quote types, but that is not sustainable as
Quotes evolve. 128KB may be too small for Quotes using schemes such as
post-quantum cryptography (PQC), where larger certificate chains can
increase the Quote size significantly. With this ABI, the guest no
longer has to rely on some empirical number.

Allocate the Quote buffer based on the reported limit. This avoids
wasting memory on platforms that do not need larger Quotes. Older
platforms fall back to the default 128KB buffer.

As a result, the maximum size of the "outblob" file in configfs-tsm now
depends on the TDX module.

Because the Quote buffer must be physically contiguous, its size is
bound by the buddy allocator's maximum page order (4MB), which should be
sufficient for current attestation needs.

Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Peter Fang <peter.fang@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
---
v4:
 - Move the PAGE_ALIGN() out of get_quote_buf_size(). [Xiaoyao]
 - Improve the get_quote_buf_size() pattern again.
 - Document that the reported size covers every Quote type. [Xiaoyao]
 - Document that a module update does not change the reported size.
   [Tony]
 - Add Tony's Reviewed-by.
v3:
 - Split out from the v2 "Allocate Quote buffer dynamically" patch. Add
   the dynamic buffer feature on top of the refactoring. [Dave]
 - Improve the get_quote_buf_size() pattern for better readability.
   [Dave]
 - Drop __GFP_NOWARN so an allocation failure warns. [Dave, Rick, Kiryl]
 - Drop the Reviewed-by tags from v2 (Kiryl, Binbin) as the patch was
   reworked.
---
 drivers/virt/coco/tdx-guest/tdx-guest.c | 31 +++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
index ec886c401fcb..7224a66b65d1 100644
--- a/drivers/virt/coco/tdx-guest/tdx-guest.c
+++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
@@ -162,7 +162,7 @@ static void tdx_mr_deinit(const struct attribute_group *mr_grp)
  * DICE-based attestation uses layered evidence that requires
  * larger Quote size (~100K).
  */
-#define GET_QUOTE_BUF_SIZE		SZ_128K
+#define GET_QUOTE_DEFAULT_BUF_SIZE	SZ_128K
 
 #define GET_QUOTE_CMD_VER		1
 
@@ -222,11 +222,34 @@ static void free_quote_buf(void *buf, size_t len)
 	free_pages_exact(buf, len);
 }
 
+/*
+ * Return a buffer size large enough for a Quote. This covers all Quote
+ * types supported by the platform.
+ */
+static size_t get_quote_buf_size(void)
+{
+	u32 quote_size = tdx_get_max_quote_size();
+	size_t len;
+
+	if (quote_size)
+		/* The reported size does not include the buffer header */
+		len = TDX_QUOTE_BUF_LEN(quote_size);
+	else
+		/* Older TDX modules don't report the size, use the default */
+		len = GET_QUOTE_DEFAULT_BUF_SIZE;
+
+	return len;
+}
+
 static void *alloc_quote_buf(size_t len)
 {
 	unsigned int count = len >> PAGE_SHIFT;
 	void *addr;
 
+	/*
+	 * This fails if the requested size exceeds the buddy allocator's
+	 * maximum order (order-10, 4MB).
+	 */
 	addr = alloc_pages_exact(len, GFP_KERNEL | __GFP_ZERO);
 	if (!addr)
 		return NULL;
@@ -416,7 +439,11 @@ static int __init tdx_guest_init(void)
 	if (ret)
 		goto deinit_mr;
 
-	quote_data_len = PAGE_ALIGN(GET_QUOTE_BUF_SIZE);
+	/*
+	 * The buffer size remains the same throughout the lifecycle of the TD,
+	 * even after a runtime TDX module update.
+	 */
+	quote_data_len = PAGE_ALIGN(get_quote_buf_size());
 	quote_data = alloc_quote_buf(quote_data_len);
 	if (!quote_data) {
 		pr_err("Failed to allocate Quote buffer\n");
-- 
2.53.0

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Sean Christopherson]

On Tue, Sep 15, 2026, Peter Fang wrote:
> Hi,
> 
> This is v4 of the series to make the TDX guest driver's Quote buffer
> size dynamic. The only functional change since v3 is an updated
> TDCS_QUOTE_MAX_SIZE encoding. The rest is documentation, changelogs, and
> stronger page alignment for the Quote buffer size. It also collected RB
> tags from several reviewers. Dave, Kiryl and Rick your review would be
> much appreciated.

Where is the breakdown of why "generating quotes entirely within the TDX-Module
is too complex" I was promised?

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Edgecombe, Rick P]

On Tue, 2026-09-15 at 07:07 -0700, Sean Christopherson wrote:
> Where is the breakdown of why "generating quotes entirely within the TDX-
> Module is too complex" I was promised?

Several of us have been investigating this. It turns out there was a discussion
in the past where several complex but solvable problems were discussed. During
the discussion, a larger problem was identified. But, and you might find this
funny given your preference for recording everything on the list, the larger
problem that got identified was not written down. We've been unable to reproduce
it, so we're currently writing up what we have.

And in case there is any confusion, this series here is orthogonal to the TDG
get quote question. The buffer needs to be expanded for PQC stuff in any case.

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Peter Fang]

On Tue, Sep 15, 2026 at 09:11:31AM -0700, Edgecombe, Rick P wrote:
> On Tue, 2026-09-15 at 07:07 -0700, Sean Christopherson wrote:
> > Where is the breakdown of why "generating quotes entirely within the TDX-
> > Module is too complex" I was promised?
> 
> Several of us have been investigating this. It turns out there was a discussion
> in the past where several complex but solvable problems were discussed. During
> the discussion, a larger problem was identified. But, and you might find this
> funny given your preference for recording everything on the list, the larger
> problem that got identified was not written down. We've been unable to reproduce
> it, so we're currently writing up what we have.
> 
> And in case there is any confusion, this series here is orthogonal to the TDG
> get quote question. The buffer needs to be expanded for PQC stuff in any case.

Just to be extra clear... Patch 4 added this:

        if (quote_size)
                /* The reported size does not include the buffer header */
                len = TDX_QUOTE_BUF_LEN(quote_size);

And it is about adding the GHCI header to the buffer size. So if there
is a design change and this header is no longer needed, this line could
become redundant. The macro might cause the driver to allocate more
memory than needed (up to one page), so things should still work and we
could fix this up later.

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Edgecombe, Rick P]

On Tue, 2026-09-15 at 16:04 -0700, Peter Fang wrote:
> Just to be extra clear... Patch 4 added this:
> 
>         if (quote_size)
>                 /* The reported size does not include the buffer header */
>                 len = TDX_QUOTE_BUF_LEN(quote_size);
> 
> And it is about adding the GHCI header to the buffer size. So if there
> is a design change and this header is no longer needed, this line could
> become redundant. The macro might cause the driver to allocate more
> memory than needed (up to one page), so things should still work and we
> could fix this up later.

So this series uses a new ability to query the max size of the quote. This size
applies to SGX quotes too.

Depending on the DICE design, the guest quoting code may need to change. Maybe
heavily. These changes could touch LOC in this series as well as other TDX guest
quoting code. But the code is still correct and useful based on non-DICE
existing quoting.

Is it all correct?

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Peter Fang]

On Tue, Sep 15, 2026 at 05:06:14PM -0700, Edgecombe, Rick P wrote:
> On Tue, 2026-09-15 at 16:04 -0700, Peter Fang wrote:
> > Just to be extra clear... Patch 4 added this:
> > 
> >         if (quote_size)
> >                 /* The reported size does not include the buffer header */
> >                 len = TDX_QUOTE_BUF_LEN(quote_size);
> > 
> > And it is about adding the GHCI header to the buffer size. So if there
> > is a design change and this header is no longer needed, this line could
> > become redundant. The macro might cause the driver to allocate more
> > memory than needed (up to one page), so things should still work and we
> > could fix this up later.
> 
> So this series uses a new ability to query the max size of the quote. This size
> applies to SGX quotes too.
> 
> Depending on the DICE design, the guest quoting code may need to change. Maybe
> heavily. These changes could touch LOC in this series as well as other TDX guest
> quoting code. But the code is still correct and useful based on non-DICE
> existing quoting.
> 
> Is it all correct?

Yes. If a new TDX module decides to report this field on a non-DICE
platform, this code still works [1]. And quotes in the DICE world will
continue to get larger. This metadata reporting is useful regardless of
how DICE is implemented in the end. I wanted to be upfront about what
the potential impact may be if the guest did DICE differently. The guest
would still need this reported size from the TDX module.

[1] https://lore.kernel.org/kvm/apsxN4jYe3G3meNz@intel.com/

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Edgecombe, Rick P]

On Tue, 2026-09-15 at 17:34 -0700, Peter Fang wrote:
> > Is it all correct?
> 
> Yes. If a new TDX module decides to report this field on a non-DICE
> platform, this code still works [1].

So the real scenario is TDX on a DICE platform, while using legacy SGX based
attestation?

>  And quotes in the DICE world will
> continue to get larger. This metadata reporting is useful regardless of
> how DICE is implemented in the end. I wanted to be upfront about what
> the potential impact may be if the guest did DICE differently. The guest
> would still need this reported size from the TDX module.
> 
> [1] https://lore.kernel.org/kvm/apsxN4jYe3G3meNz@intel.com/

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Peter Fang]

On Tue, Sep 15, 2026 at 05:36:49PM -0700, Edgecombe, Rick P wrote:
> On Tue, 2026-09-15 at 17:34 -0700, Peter Fang wrote:
> > > Is it all correct?
> > 
> > Yes. If a new TDX module decides to report this field on a non-DICE
> > platform, this code still works [1].
> 
> So the real scenario is TDX on a DICE platform, while using legacy SGX based
> attestation?

Yes that is the real scenario and this series supports it. Reporting
this field on a non-DICE platform is just a theory at this point.

This is probably pretty obvious... This series still only uses the
GetQuote GHCI for quoting, so there is no other future DICE enabling in
it.

> 
> >  And quotes in the DICE world will
> > continue to get larger. This metadata reporting is useful regardless of
> > how DICE is implemented in the end. I wanted to be upfront about what
> > the potential impact may be if the guest did DICE differently. The guest
> > would still need this reported size from the TDX module.
> > 
> > [1] https://lore.kernel.org/kvm/apsxN4jYe3G3meNz@intel.com/
> 

Re: [PATCH v4 0/4] tdx-guest: Make Quote buffer size dynamic

[Edgecombe, Rick P]

On Tue, 2026-09-15 at 17:50 -0700, Peter Fang wrote:
> On Tue, Sep 15, 2026 at 05:36:49PM -0700, Edgecombe, Rick P wrote:
> > On Tue, 2026-09-15 at 17:34 -0700, Peter Fang wrote:
> > > > Is it all correct?
> > > 
> > > Yes. If a new TDX module decides to report this field on a non-DICE
> > > platform, this code still works [1].
> > 
> > So the real scenario is TDX on a DICE platform, while using legacy SGX based
> > attestation?
> 
> Yes that is the real scenario and this series supports it. Reporting
> this field on a non-DICE platform is just a theory at this point.
> 
> This is probably pretty obvious... This series still only uses the
> GetQuote GHCI for quoting, so there is no other future DICE enabling in
> it.

So this series has a small benefit outside of DICE. But we know DICE based
quotes (however they get to the TD) are going to be big. So this code will
eventually probably help DICE in some form.

So to say this has nothing to do with DICE is not quite true. The querying of
the size will almost certainly get re-used for the eventual DICE design.

I think we should proceed with it now still. Any time we have an opportunity to
break up TDX series into smaller sets that do something useful, it is good. And
if the entire thing only helps the rare SGX user in it's current form because
DICE goes in an unforeseeable direction. It's not a disaster.

Re: [PATCH v4 2/4] virt: tdx-guest: Calculate the Quote buffer size safely

[Kiryl Shutsemau]

On Tue, Sep 15, 2026 at 02:26:01AM -0700, Peter Fang wrote:
> struct tdx_quote_buf has a trailing flexible array member.
> struct_size_t() calculates the size of this kind of struct safely. It
> handles overflow, which helps since the Quote size comes from the host.
> 
> Use it to rewrite the bounds check logic, since
> 
>   "header_size + data_len > buf_size"
> 
> ...is more readable than "data_len > buf_size - header_size".
> 
> Signed-off-by: Peter Fang <peter.fang@intel.com>
> Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH v4 3/4] virt: tdx-guest: Use a variable to store the Quote buffer size

[Kiryl Shutsemau]

On Tue, Sep 15, 2026 at 02:26:02AM -0700, Peter Fang wrote:
> In preparation for dynamic Quote buffer size, replace the fixed size
> constant with a variable.
> 
> The constant is sprinkled across several places. Read the size from the
> variable instead.
> 
> Signed-off-by: Peter Fang <peter.fang@intel.com>
> Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH v4 4/4] virt: tdx-guest: Allocate Quote buffer dynamically

[Kiryl Shutsemau]

On Tue, Sep 15, 2026 at 02:26:03AM -0700, Peter Fang wrote:
> From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> 
> A new TDX module ABI reports the Quote size limit in a metadata field.
> Prior to this, the guest driver uses a fixed 128KB buffer. Intel derived
> this number from current Quote types, but that is not sustainable as
> Quotes evolve. 128KB may be too small for Quotes using schemes such as
> post-quantum cryptography (PQC), where larger certificate chains can
> increase the Quote size significantly. With this ABI, the guest no
> longer has to rely on some empirical number.
> 
> Allocate the Quote buffer based on the reported limit. This avoids
> wasting memory on platforms that do not need larger Quotes. Older
> platforms fall back to the default 128KB buffer.
> 
> As a result, the maximum size of the "outblob" file in configfs-tsm now
> depends on the TDX module.
> 
> Because the Quote buffer must be physically contiguous, its size is
> bound by the buddy allocator's maximum page order (4MB), which should be
> sufficient for current attestation needs.
> 
> Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> Signed-off-by: Peter Fang <peter.fang@intel.com>
> Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov