Intel Trusted Domain Extensions (TDX) Host Kernel Support
summary
Explains how the kernel actually initializes the Intel TDX module so KVM can create protected VMs: a short sequence — global SIMCALL init on any CPU, per-CPU SIMCALLs on all logical CPUs, configure an array of 1GiB-aligned TDMRs and their PMTs, flush caches, set a per-package global TDX key ID, then initialize each TDMR (current implementation does this sequentially). Chooses runtime init (not boot) and converts all boot-time system memory to convertible memory regions (CMRs); rejects online of non-CMR pages and prevents ACPI hot-remove of CMR CPUs/memory. v5 patches are posted; v6 incoming.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:49TDX Overview
- 4:45TDX Module Memory Management
- 8:20Initializing the TDX Module
- 10:41High Level Design
- 13:42TDX Memory Policy
- 18:10Interaction with ACPI Memory Hotplug
- 19:39Interaction with ACPI CPU Hotplug
- 21:57Handle ACPI CPU/Memory Hotplug (2)
- 22:59Kexec() Support
- 24:17Future work
- 26:52Reference
related talks
17mStatus Update on TDX Support
31mIntel Trust Domain Extensions
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
27mTDX Live Migration
26mVirtual TPM based attestation for Intel Trust Domain Extensions
41mIntroducing IO Devices into Trusted Execution Environments
21mUnmapped Guest Memory
28mConfidential Devices (TEE I/O): A series of modest proposals