Re: [RFC PATCH v1 0/3] TDX: P-SEAMLDR: Support large TDX modules and sigstructs

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Fri, 2026-10-30 at 01:52 -0700, Chao Gao wrote:
> This series lets TDX module updates handle large TDX modules and
> sigstructs. It is an RFC for early review.
> 
> Dave, feel free to ignore this RFC for now. TDX developers, please take
> a look.
> 
> I would especially like feedback on one question. Does the kernel need
> to tell userspace that it supports large modules and sigstructs? I would
> rather not add such an interface.
> 
> Userspace can simply try such an image, because a kernel without this
> series rejects it with -EINVAL before calling P-SEAMLDR, so a failed try
> has no side effects. If userspace should not have to try an update to
> find out, the alternative is to backport this series to all kernels that
> support TDX module updates. Userspace could then assume that any kernel
> with TDX module updates handles such images.

Sounds good to me.

> 
> ====
> 
> This series is a follow-up to the TDX module update series. As thanks
> for merging that series, we agreed to take on the TDX metadata cleanup [1].
> With the cleanup converging, we are starting on this work and expect it
> to be merged after the cleanup.
> 
> Today a TDX module binary can be at most 496 pages and its sigstruct at
> most one page. Both limits come from the P-SEAMLDR ABI.
> 
> TDX modules are outgrowing them. A post-quantum signature algorithm
> pushes the sigstruct past 4KB, and new module features push the binary
> past 496 pages. The P-SEAMLDR ABI was extended for both.
> 
> The kernel rejects any image over these limits. TDX modules for Diamond
> Rapids exceed them, so without this series, TDX module updates fail on
> Diamond Rapids. This series is all that is needed to make them work.
> 
> The image format that userspace uploads ('struct tdx_image') is generic
> enough and needs no change.
> 
> == AI Usage ==
> AI was used under supervision to review code and workshop logs. It
> spotted a u32 overflow and an oversized allocation that removing the 496
> page cap would cause in patch 2. The module size limit in that patch
> prevents both. It also suggested renaming init_seamldr_params() in
> patch 1 and updating the comments around it.
> 
> == Testing ==
> Tested on a Diamond Rapids system. Updates with a module larger than 2MB
> and an 8KB sigstruct work, which exercises both the chained page list
> and version 1 of 'struct seamldr_params'. TDs keep running across
> updates.
> 
> [1]: https://lore.kernel.org/kvm/20261012094754.27702-1-chao.gao@intel.com/
> 
> Chao Gao (3):
>   x86/virt/seamldr: Allocate 'struct seamldr_params' after image
>     validation
>   x86/virt/seamldr: Support large TDX module binaries
>   x86/virt/seamldr: Support multiple sigstruct pages
> 
>  arch/x86/virt/vmx/tdx/seamldr.c | 154 ++++++++++++++++++++++++++------
>  1 file changed, 127 insertions(+), 27 deletions(-)

This is a lot bigger than I expected. The old SEAMLDR_PARAMS_VERSION_1 chunk
that got deferred was tiny.

So I guess DMR support takes a bit more.

> 
> 
> base-commit: a49e2d257594931772ab8f0024708c3076f3aa1d