[RFC PATCH v1 0/3] TDX: P-SEAMLDR: Support large TDX modules and sigstructs

[Chao Gao <chao.gao@intel.com>]

This series lets TDX module updates handle large TDX modules and
sigstructs. It is an RFC for early review.

Dave, feel free to ignore this RFC for now. TDX developers, please take
a look.

I would especially like feedback on one question. Does the kernel need
to tell userspace that it supports large modules and sigstructs? I would
rather not add such an interface.

Userspace can simply try such an image, because a kernel without this
series rejects it with -EINVAL before calling P-SEAMLDR, so a failed try
has no side effects. If userspace should not have to try an update to
find out, the alternative is to backport this series to all kernels that
support TDX module updates. Userspace could then assume that any kernel
with TDX module updates handles such images.

====

This series is a follow-up to the TDX module update series. As thanks
for merging that series, we agreed to take on the TDX metadata cleanup [1].
With the cleanup converging, we are starting on this work and expect it
to be merged after the cleanup.

Today a TDX module binary can be at most 496 pages and its sigstruct at
most one page. Both limits come from the P-SEAMLDR ABI.

TDX modules are outgrowing them. A post-quantum signature algorithm
pushes the sigstruct past 4KB, and new module features push the binary
past 496 pages. The P-SEAMLDR ABI was extended for both.

The kernel rejects any image over these limits. TDX modules for Diamond
Rapids exceed them, so without this series, TDX module updates fail on
Diamond Rapids. This series is all that is needed to make them work.

The image format that userspace uploads ('struct tdx_image') is generic
enough and needs no change.

== AI Usage ==
AI was used under supervision to review code and workshop logs. It
spotted a u32 overflow and an oversized allocation that removing the 496
page cap would cause in patch 2. The module size limit in that patch
prevents both. It also suggested renaming init_seamldr_params() in
patch 1 and updating the comments around it.

== Testing ==
Tested on a Diamond Rapids system. Updates with a module larger than 2MB
and an 8KB sigstruct work, which exercises both the chained page list
and version 1 of 'struct seamldr_params'. TDs keep running across
updates.

[1]: https://lore.kernel.org/kvm/20261012094754.27702-1-chao.gao@intel.com/

Chao Gao (3):
  x86/virt/seamldr: Allocate 'struct seamldr_params' after image
    validation
  x86/virt/seamldr: Support large TDX module binaries
  x86/virt/seamldr: Support multiple sigstruct pages

 arch/x86/virt/vmx/tdx/seamldr.c | 154 ++++++++++++++++++++++++++------
 1 file changed, 127 insertions(+), 27 deletions(-)


base-commit: a49e2d257594931772ab8f0024708c3076f3aa1d
-- 
2.52.0