On Fri, Jun 30, 2023 at 02:24:56PM -0700, Sean Christopherson wrote: > Waiting until userspace attempts to create the first TDX guest adds complexity > and limits what KVM can do to harden itself. Currently, all feature support in > KVM is effectively frozen at module load. E.g. most of the setup code is > contained in __init functions, many module-scoped variables are effectively > RO after init (though they can't be marked as such until we smush kvm-intel.ko > and kvm-amd.ko into kvm.ko, which is tentatively the long-term plan). All of > those patterns would get tossed aside if KVM waits until userspace attempts to > create the first guest. .... People got poked and the following was suggested: On boot do: TDH.SYS.INIT TDH.SYS.LP.INIT TDH.SYS.CONFIG TDH.SYS.KEY.CONFIG This should get TDX mostly sorted, but doesn't consume much resources. Then later, when starting the first TDX guest, do the whole TDH.TDMR.INIT dance to set up the PAMT array -- which is what gobbles up memory. From what I understand the TDH.TDMR.INIT thing is not one of those excessively long calls. If we have concerns about allocating the PAMT array, can't we use CMA for this? Allocate the whole thing at boot as CMA such that when not used for TDX it can be used for regular things like userspace and filecache pages? Those TDH.SYS calls should be enough to ensure TDX is actually working, no?
