[RFC PATCH v2 0/2] TDX: P-SEAMLDR: Support large TDX modules and sigstructs

[Chao Gao <chao.gao@intel.com>]

This series lets TDX module updates handle large TDX modules and
sigstructs. It is an RFC for early review.

Dave, feel free to ignore this RFC for now. TDX developers, please take
a look.

Patch 1 raises the module size limit from about 2MB to about 32MB,
instead of supporting every module size the P-SEAMLDR ABI allows.
Current modules are roughly 2MB and are unlikely to approach 32MB for
years. If they do, raising SEAMLDR_PARAMS_NR_PAGES is enough. In return
the code stays much simpler, so I think this is the right direction.
Does that trade-off look right?

== Changes ==

Changes since RFC v1:

Patch 1 is reworked to be much smaller. In the last version, we tried to
size the chained pages to each module, which needed a prep patch so that
the allocation happens only after the image header is validated. now, we
make 'struct seamldr_params' a fixed 16 pages. This way, the allocation
no longer depends on the header, so the prep patch is dropped.

Other changes:
- Find each link entry by its position at the end of a page instead of
  by checking for a non-zero entry. [Rick]
- Write the link entries in populate_pa_list() while filling in the page
  addresses, instead of in a separate loop and helper.
- Drop the version macros in patch 2 to keep the diff minimal.
- Explain in patch 2 why the sigstruct filling code needs no change.

v1: https://lore.kernel.org/kvm/20261030085304.3886520-1-chao.gao@intel.com/

===

This series is a follow-up to the TDX module update series. As thanks
for merging that series, we agreed to take on the TDX metadata cleanup [1].
With the cleanup converging, we are starting on this work and expect it
to be merged after the cleanup.

Today a TDX module binary can be at most 496 pages and its sigstruct at
most one page. Both limits come from the P-SEAMLDR ABI.

TDX modules are outgrowing them. A post-quantum signature algorithm
pushes the sigstruct past 4KB, and new module features push the binary
past 496 pages. The P-SEAMLDR ABI was extended for both.

The kernel rejects any image over these limits. TDX modules for Diamond
Rapids exceed them, so without this series, TDX module updates fail on
Diamond Rapids. This series is all that is needed to make them work.

The image format that userspace uploads ('struct tdx_image') is generic
enough and needs no change.

== AI Usage ==

AI was used under supervision to review code and workshop logs.

== Testing ==

Tested on a Diamond Rapids system. Updates with a module larger than 2MB
and an 8KB sigstruct work, which exercises both the chained page list
and version 1 of 'struct seamldr_params'. TDs keep running across
updates.

[1]: https://lore.kernel.org/kvm/20261012094754.27702-1-chao.gao@intel.com/


Chao Gao (2):
  x86/virt/seamldr: Support large TDX module binaries
  x86/virt/seamldr: Support multiple sigstruct pages

 arch/x86/virt/vmx/tdx/seamldr.c | 43 ++++++++++++++++++++++++++-------
 1 file changed, 34 insertions(+), 9 deletions(-)

-- 
2.52.0