Re: [PATCH v5 6/6] virt: tdx-guest: Make the Quote buffer size dynamic

[Kuppuswamy Sathyanarayanan]

Hi,

On 9/28/2026 3:08 AM, Peter Fang wrote:
> Support a new TDX module ABI that reports the Quote size limit in a
> metadata field. The fixed 128KB buffer in the driver may be too small
> for Quotes that use new algorithms like post-quantum cryptography (PQC),
> which can produce much larger certificates. With this ABI, the guest
> sizes the buffer to the platform's needs and no longer has to rely on
> some empirical number.
> 
> The shared buffer comes from the buddy allocator, as the host expects it
> to be physically contiguous. The allocator's page order limit should be
> sufficient for current attestation needs. Platforms that don't report
> the limit fall back to the default 128KB buffer.
> 
> AI was used under supervision to collect/apply feedback, review code and
> workshop logs.
> 
> Based on a patch originally by Kuppuswamy Sathyanarayanan.
> 
> Signed-off-by: Peter Fang <peter.fang@xxxxxxxxx>
> ---
> v5:
>  - Do the export here, and use EXPORT_SYMBOL_FOR_MODULES() instead.
>    [Xiaoyao, Dave]
>  - Drop the comment about the buddy allocator. [Dave]
>  - Drop the RB tags, as the code changed substantially.
> v4:
>  - Move the PAGE_ALIGN() out of get_quote_buf_size(). [Xiaoyao]
>  - Improve the get_quote_buf_size() pattern again.
>  - Document that the reported size covers every Quote type. [Xiaoyao]
>  - Document that a module update does not change the reported size.
>    [Tony]
>  - Add Tony's Reviewed-by.
> v3:
>  - Split out from the v2 "Allocate Quote buffer dynamically" patch. Add
>    the dynamic buffer feature on top of the refactoring. [Dave]
>  - Improve the get_quote_buf_size() pattern for better readability.
>    [Dave]
>  - Drop __GFP_NOWARN so an allocation failure warns. [Dave, Rick, Kiryl]
>  - Drop the Reviewed-by tags from v2 (Kiryl, Binbin) as the patch was
>    reworked.
> ---
>  arch/x86/coco/tdx/tdx.c                 |  1 +
>  drivers/virt/coco/tdx-guest/tdx-guest.c | 13 ++++++++++++-
>  2 files changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> index 323e1efc78ea..847430fc639f 100644
> --- a/arch/x86/coco/tdx/tdx.c
> +++ b/arch/x86/coco/tdx/tdx.c
> @@ -213,6 +213,7 @@ int tdx_get_max_quote_size(u64 *max_quote_size)
>  
>  	return 0;
>  }
> +EXPORT_SYMBOL_FOR_MODULES(tdx_get_max_quote_size, "tdx-guest");

I think you can cleanup other exports consumed by tdx-guest driver
to use the same format (in a prep patch).

tdx_hcall_get_quote(), tdx_mcall_get_report0() and tdx_mcall_extend_rtmr(0.

>  
>  static void __noreturn tdx_panic(const char *msg)
>  {
> diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
> index b79b4325da3a..ad2cb4740898 100644
> --- a/drivers/virt/coco/tdx-guest/tdx-guest.c
> +++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
> @@ -212,11 +212,22 @@ static long tdx_get_report0(struct tdx_report_req __user *req)
>  static size_t get_quote_buf_size(void)
>  {
>  	static size_t quote_buf_size;
> +	u64 max_quote_size;
>  
>  	if (quote_buf_size)
>  		return quote_buf_size;
>  
> -	quote_buf_size = PAGE_ALIGN(TDX_DEFAULT_QUOTE_SIZE);
> +	/* Start with the default buffer size */
> +	quote_buf_size = TDX_DEFAULT_QUOTE_SIZE;
> +
> +	/*
> +	 * Override the default when the TDX module reports a size. Add room
> +	 * for the header metadata.
> +	 */
> +	if (!tdx_get_max_quote_size(&max_quote_size))
> +		quote_buf_size = TDX_QUOTE_TOTAL_SIZE(max_quote_size);
> +
> +	quote_buf_size = PAGE_ALIGN(quote_buf_size);
>  
>  	return quote_buf_size;
>  }

-- 
Sathyanarayanan Kuppuswamy
Linux Kernel Developer