Status Update on TDX Support
summary
Status update on KVM TDX support covers concrete changes across the stack: Linux must load a special TDX module with large contiguous memory and support kexec/kdump state restore without power cycling; KVM adds new ops and a snoop path for debugger access; MMU keeps a conventional EPT mirror for SEPT to avoid costly secure-table hits; user-space guest-memory mapping is being removed with two options (protected mappings or a new file-descriptor-backed object); MMIO uses paravirtual hypercalls and DMA uses shared pages. Work is in progress and a PoC exists.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:25Introduction: What's TDX
- 2:06Touchpoints
- 2:55Linux host
- 7:01KVM MMU
- 8:04Unmapping private pages from user space
- 10:05Linux Guest
- 12:38Qemu changes
- 15:06Related software upstream
- 16:16Status summary
related talks
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
23mAllowing an Intel TDX Module to Run Without SEAM
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment
22mSupporting TEE on x86 Client Platforms with pKVM
31mIntel Trust Domain Extensions
28mConfidential Devices (TEE I/O): A series of modest proposals
18mGuest Memory Protection -- Current Status and Future