Intel Trusted Domain Extensions (TDX) Host Kernel Support - Kai Huang, Intel Corporation
Channel: The Linux Foundation
Date: 2022-10-08

Intel Trusted Domain Extensions (TDX) Host Kernel Support - Kai Huang, Intel Corporation

Intel Trusted Domain Extensions (TDX) protects guest VMs from the malicious host and certain physical attacks. A CPU-attested software module called 'the TDX module' implements the functionalities to manage and run the protected VMs called Trusted Domains (TD). The TDX module needs to be initialized before it can be used by KVM to create and run protected VMs. This presentation talks about initializing the TDX module in the core kernel. Specifically, it covers: 1) TDX module initialization process defined by the TDX spec; 2) the design choice of when to initialize the TDX module; 3) the details of how to initialize the module, particularly how TDX architecture manages TDX memory and the kernel policy to convert system memory to TDX memory; 4) the interactions between TDX and other kernel components such as CPU/memory hotplug and kexec().