Re: [PATCH v10 10/11] Documentation/x86: Add documentation for TDX's Dynamic PAMT

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Thu, 2026-09-03 at 08:47 -0700, Dave Hansen wrote:
> On 9/2/26 18:51, Rick Edgecombe wrote:
> > +Dynamic PAMT is only enabled when supported and the ``tdx_dpamt=`` kernel
> > +parameter is set to "on". The feature is off by default because TDX module
> > +internal details prevent Dynamic PAMT from working on all keyid partitioning
> > +configurations. When the TDX module is fixed to include these constraints in
> > +its enumeration of Dynamic PAMT support, kernel support can be changed to
> > +default on. For more information, consult the Intel TDX documentation about
> > +Dynamic PAMT.
> 
> What's the end user visible effect of hitting one of these troublesome
> "keyid partitioning configurations"?

DPAMT gets turned on via the TDH_SYS_CONFIG SEAMCALL in config_tdx_module().
Inside the TDX module, this SEAMCALL does some checks about the number of
configured keyids, and will fail the call if it doesn't like the configured
keyids. For a server with 52 bit physical address width, it should require at
least 16 hkids (4 bits). If a lower number of bits is set, TDH_SYS_CONFIG will
fail and it will cascade into a TDX init failure.

The TDX module exposes if DPAMT is supported via a features0 bit. If DPAMT is
not supported due to the hkids limits, the module still reports it as supported.
The module folks agreed to change the behavior of this bit to say if DPAMT is
actually supported (i.e. do the keyid bit checks itself).

So we have:
1. If you are inclined to think support bits should actually report whether
something is supported, then this kinda is a TDX module bug that we are working
around by making DPAMT an opt-in.
2. The bug will only be hit if anyone has configured a low number of hkids.

We could optimistically think the TDX module with the fix will be distributed
before anyone with this configuration hits it? And if that is wrong, add the
keyid checking or opt-in as a fix. Then maybe we save some code long term.