nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-26 08:53:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

linux/common-config: enable Intel TDX guest support

Browse Source 
Intel Trust Domain Extensions (TDX) is a VM-based trusted execution
environment which attempts to isolate confidential guest VMs from the
host, similar to AMD SEV-SNP. Like AMD SEV-SNP it requires guest
modifications (also referred to as "enlightenments") to operate in the
TEE. Initial support for running Linux in a TDX guest environment was
merged [in 5.19][1]. The guest driver used for generating attestation
reports was merged [in 6.2][2].

Enable both of these options on supported kernel versions. This matches
other distros such as [Arch Linux][3], [Debian][4], [Fedora][5],
[openSUSE][6], and [Ubuntu][7].

[1]: https://lore.kernel.org/lkml/Yot1IAqHoRBlwe0w@zn.tnic/
[2]: https://lore.kernel.org/lkml/20221212191525.553266-1-dave.hansen@linux.intel.com/
[3]: ac5ceec882/config (L409)
[4]: 3fdc0bdcaf/debian/config/amd64/config (L13)
[5]: 28b3da71f8/f/kernel-x86_64-fedora.config (_3170)
[6]: 994cc2d44d/config/x86_64/default (L403)
[7]: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/tree/debian.master/config/annotations#n6660

(cherry picked from commit 41a390a2a2)
This commit is contained in:
Alex James 2024-09-24 13:59:37 -05:00 committed by github-actions[bot]
parent 7bdd6ff0f0
commit 842dcb6221
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/os-specific/linux/kernel/common-config.nix
View File

@ -769,6 +769,10 @@ let
# Shadow stacks # Shadow stacks
X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes; X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes;
# Enable support for Intel Trust Domain Extensions (TDX)
INTEL_TDX_GUEST = whenAtLeast "5.19" yes;
TDX_GUEST_DRIVER = whenAtLeast "6.2" module;
# Mitigate straight line speculation at the cost of some file size # Mitigate straight line speculation at the cost of some file size
SLS = whenBetween "5.17" "6.9" yes; SLS = whenBetween "5.17" "6.9" yes;
MITIGATION_SLS = whenAtLeast "6.9" yes; MITIGATION_SLS = whenAtLeast "6.9" yes;