Intel proposes Linux to add driver filtering function

According to the mailing list, Intel engineers proposed to add a filter to Linux drivers so that they can set a list of drivers that are allowed or denied to be loaded by the boot kernel or cannot be loaded. This solution is part of Intel engineers’ work around Trust Domain Extensions (TDX) support for Linux. TDX is a new technology from Intel that adds support for virtual machines to maintain confidentiality and integrity in the face of untrusted VMM. Since VMM is an untrusted entity, and in order to reduce the attack surface in the guest virtual machine, while still hoping to be able to use the same kernel build between the host and the guest, Intel engineers propose to add this driver filter support to the kernel middle.

This filter allows you to specify specific drivers that are allowed to be loaded by the kernel through the kernel command line when booting guests, or set a list of specific drivers that should not be allowed to be loaded by the system. By default, this will not change any default behavior of the kernel.

cat /sys/bus/$bus/drivers/$driver/allowed