Re: TDG quote analysis

[Dave Hansen <dave.hansen@intel.com>]

On 9/21/26 16:19, Sean Christopherson wrote:
> On Mon, Sep 21, 2026, Dave Hansen wrote:
>> On 9/18/26 14:32, Sean Christopherson wrote:
>>> By creating these system-wide thread pools, TDX has effectively created a bizarre
>>> M:N scheduling problem, *and* introduced a completely avoidable noisy-neighbor
>>> problem.
>> To be honest, I just want to chop all of the complexity out of this.
>>
>> I want to assume that the TDX module can do one quote at a time. If that
>> quote takes too long, software kills it and lets the next guy do a quote.
>>
>> I don't even want to know that the TDX module *can* have 1 or 10 or 100
>> quoting threads. I just want one which I can make sane rules around
>> because 1 is *FINE*.
> I'm not remotely convinced one per system is fine.  I'm all for one per VM, but
> I'm pretty sure the SEAMCALL alone will have a measurable performance impact,
> especially when factoring in that it will require a VMCS shootdown to do VMCLEAR
> on the previous pCPU.  Mix in a few (tens of?) thousand more cycles, and any use
> case that's trying to boot a decent number of TDX guests in parallel will be sad.

Sad, but way less sad than the folks who decided to offload their
quoting to an Arduino attached over a fancy serial port. ;)

I do think we can _start_ with one. One needs no ABI and no policy bike
shedding. If my crystal ball is right, we can stop there. If yours is
right, then we can go build the stuff we need to make it scale.

Oh, and folks can _theoretically_ do one quoting instance per VM. But I
think the overhead per quoting instance is in 100MB ballpark. So a bit
rotund to be per-TD in practice.