Failed to launch td-shim based TD with qemu 10

[liuw1]

qemu 10 will report below error while launching td-shim based TD.

qemu-kvm: Failed to accept memory for TDVF section 3

Command:
/usr/libexec/qemu-kvm -accel kvm -M q35 -cpu host,host-phys-bits,-kvm-steal-time,pmu=off -smp 1,threads=1,sockets=1 -m 2G -object tdx-guest,id=tdx0,sept-ve-disable=off -object memory-backend-memfd,id=ram1,size=2G,share=off -machine q35,memory-backend=ram1,confidential-guest-support=tdx0,kernel_irqchip=split -bios /root/DCAP/qtd/qtd.bin -device vhost-vsock-pci,id=vhost-vsock-pci1,guest-cid=26,disable-legacy=on -nographic -vga none -nic none -serial mon:stdio

[sgrams]

Root cause: td-layout-config defaults all region BASE addresses to memory_offset + region.start, placing MAILBOX, TEMP_STACK, and TEMP_HEAP inside the TDVF firmware window (0xFF000000+). This window is mapped as ROM/flash by QEMU and is never added to QEMU's internal E820 table as E820_RAM — nor should it be.

Why this causes a crash: During TD initialization, tdx_finalize_vm() calls tdx_accept_ram_range() for every TDVF_SECTION_TYPE_TEMP_MEM section. This function searches only E820_RAM entries (populated by tdx_init_ram_entries() from QEMU's e820_table). Since 0xFF040000–0xFF061000 is never in E820_RAM, the lookup fails and QEMU calls exit(1) — before TD-Shim ever executes.

Key point: This is QEMU's own E820, not the one TD-Shim builds at runtime from the TD_HOB. TD-Shim hasn't run yet at this point and has no influence over the outcome.

Potential Fix: Supply explicit BASE overrides for MAILBOX/TEMP_STACK/TEMP_HEAP in the image layout JSON, placing them in low guest RAM (0x7A0000–0x7FE000, below TD_HOB at 0x800000). This range is always covered by an E820_RAM entry for any practical guest RAM size, allowing tdx_accept_ram_range() to succeed.

[sgrams]

Apart from that I think we're missing documentation on lowest physical memory size supported/required by TD-Shim. I don't think some minimal TDs require 1/2G of physical memory assigned.