Re: TDG quote analysis

[Peter Fang <peter.fang@intel.com>]

On Wed, Sep 16, 2026 at 03:31:50PM -0700, Edgecombe, Rick P wrote:
> On Wed, 2026-09-16 at 12:27 -0700, Sean Christopherson wrote:
> > > If you are thinking the implementation could punt on how to handle the guest
> > > interrupts for now, that seems reasonable. I'd think exiting to handle the
> > > host interrupts could not be skipped though.
> > 
> > I'm just trying to understand the scope of the problem we're trying to solve.
> > E.g. I don't think any design will save us if generating a quote requires a
> > CPU to be spinning for multiple milliseconds.
> 
> Elena, any updated estimates on CPU based quote generation and HW based?

The current estimate is 10s of milliseconds for HW based, and
milliseconds or less for CPU based.

> 
> > 
> > > > Does the TDX Module *need* to provide a save slot?  What would prevent TDX
> > > > from requiring the guest to provide storage for whatever in-flight data is
> > > > needed? That way there it doesn't matter if the guest never resumes the
> > > > call, it can only hurt itself.
> > > 
> > > I was thinking about this too, but thought it sounded a bit like the NAKed
> > > SNP secure AVIC pattern. At least the TDX module would need to handle
> > > getting asked to zap the guest page that was given to be a saved state slot.
> > 
> > But doesn't the TDX Module already need to do this?  It's writing guest
> > memory, no?  So it needs to prevent the page from being freed while it's
> > handling the quote.  Just put the onus on the guest to provide the same GPA
> > when restarting the TDG.
> 
> When you make a non-interruptible/non-restartable call, the TDX module doesn't
> rush out if there is an interrupt pending. It lets the call fully complete, if
> it is short. During that time, if it is operating on private memory it would
> take internal locks to prevent the page from getting zapped out or swapped.

Given that quoting could take 10s of milliseconds, I think this TDG
might need to be interruptible/restartable, at least during some types
of quoting. So when this TDCALL returns to the guest to handle an
interrupt, the host could take a lock, and then the next TDCALL fails
with a BUSY?

>