Messages in this thread | | | Date | Fri, 18 Feb 2022 13:07:11 -0800 | From | Dave Hansen <> | Subject | Re: [PATCHv3 03/32] x86/tdx: Detect running as a TDX guest in early boot |
| |
On 2/18/22 08:16, Kirill A. Shutemov wrote: > From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> > > cc_platform_has() API is used in the kernel to enable confidential > computing features. Since TDX guest is a confidential computing > platform, it also needs to use this API.
I'm struggling to connect the relevance of this paragraph to the patch below.
I went through the whole series and I don't see any modifications to cc_platform_has() or checks for X86_FEATURE_TDX_GUEST that seem like they influence cc_platform_has().
What the heck am I missing?
> In preparation of extending cc_platform_has() API to support TDX guest, > use CPUID instruction to detect support for TDX guests in the early > boot code (via tdx_early_init()). Since copy_bootdata() is the first > user of cc_platform_has() API, detect the TDX guest status before it.
This is good. It tells us *why* it is initialized in that location.
> Since cc_plaform_has() API will be used frequently across the boot > code, instead of repeatedly detecting the TDX guest status using the > CPUID instruction, detect once and cache the result.
Isn't this a remnant of an old implementation where there was a separate 'tdx_enabled' variable in addition to X86_FEATURE_TDX_GUEST?
Does this "caching" refer to X86_FEATURE_TDX_GUEST or the old thing?
> Define a synthetic feature flag (X86_FEATURE_TDX_GUEST) and set this > bit in a valid TDX guest platform.
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index 391c4cac8958..ea4190c53db6 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -880,6 +880,18 @@ config ACRN_GUEST > IOT with small footprint and real-time features. More details can be > found in https://projectacrn.org/. > > +config INTEL_TDX_GUEST > + bool "Intel TDX (Trust Domain Extensions) - Guest Support" > + depends on X86_64 && CPU_SUP_INTEL > + depends on X86_X2APIC > + help > + Support running as a guest under Intel TDX. Without this support, > + the guest kernel can not boot or run under TDX. > + TDX includes memory encryption and integrity capabilities > + which protect the confidentiality and integrity of guest > + memory contents and CPU state. TDX guests are protected from > + potential attacks from the VMM.
Nit: I don't think "potential" is the right word there. "some" might work better.
| |