Re: [PATCH v3 4/4] virt: tdx-guest: Allocate Quote buffer dynamically

[Tony Lindgren]

On Fri, Sep 04, 2026 at 01:59:35PM -0700, Peter Fang wrote:
> On Thu, Sep 03, 2026 at 09:33:17AM +0300, Tony Lindgren wrote:
> > On Thu, Sep 03, 2026 at 02:21:35PM +0800, Xiaoyao Li wrote:
> > > On 7/29/2026 8:29 PM, Peter Fang wrote:
> > > > A new TDX module ABI reports the TD Quote size limit in a metadata
> > > > field. This size used to be fixed at 128 KB.
> > > > 
> > > > The guest driver's Quote buffer is shared with the host VMM. The current
> > > > fixed size may be too small for Quotes using schemes such as
> > > > post-quantum cryptography (PQC), where larger certificate chains can
> > > > increase the Quote size significantly.
> > > > 
> > > > Allocate the Quote buffer based on the reported limit. This avoids
> > > > wasting memory on platforms that do not require larger Quotes. Older
> > > > platforms fall back to the default 128 KB buffer.
> > > 
> > > I think we need to justify why using the value reported by TDX module
> > > (i.e., QUOTE_MAX_SIZE) is safe.
> > > 
> > > From "Intel TDX Module Extension for Quoting" spec,
> > > 
> > >   QUOTE_MAX_SIZE that specifies the maximum size of the buffer that must be
> > >   allocated to contain the Intel TDX Quote received from Intel TDX Module.
> > > 
> > > So, TDX module only guarantees that QUOTE_MAX_SIZE is big enough to hold
> > > the quote that is generated by the TDX module. But for the current tdx
> > > guest driver, it doesn't know how host will generate the quote. Host can
> > > generate the SGX-based quote and we need to justify the QUOTE_MAX_SIZE will
> > > be enough for such case.
> 
> Thanks for pointing this out. I confirmed with the TDX security folks.
> The reported QUOTE_MAX_SIZE covers all possible quote types on the
> platform. If GetQuote gets routed to SGX and QUOTE_MAX_SIZE is too small
> for that, it's a TDX module bug.
> 
> I'll add a comment and update the changelog.
> 
> > 
> > And can we assume the TDX module provided size does not change after init
> > with a TDX module update?
> 
> Yep, it's safe to assume that.

Thanks for checking the above:

Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>