tdx-kernel.nix

{ lib, pkgs, ... }:

let
  decodeMbox = pkgs.writeShellScript "decodeMbox" ''
    # The lore.kernel.org mailing list uses public-inbox, which supports
    # downloading threads as a gzip-compressed mbox file (see the "mbox.gz" link
    # next to "Thread overview"). This can be used to download a patch series in
    # a single file. However, public-inbox may not sort the messages in the
    # thread [1], which may break application of the patches. b4 am [2] can be
    # used to sort patches in the mbox file and produce a patch that can be
    # applied with git am or patch.
    # [1]: https://public-inbox.org/meta/20240411-dancing-pink-marmoset-f442d0@meerkat/
    # [2]: https://b4.docs.kernel.org/en/latest/maintainer/am-shazam.html

    # b4 expects git to be in $PATH and $XDG_DATA_HOME to be writable.
    export PATH="${lib.makeBinPath [ pkgs.gitMinimal ]}:$PATH"
    export XDG_DATA_HOME="$(mktemp -d)"
    gzip -dc | ${pkgs.b4}/bin/b4 -n --offline-mode am -m - -o -
  '';
in {
  boot = {
    kernelPackages = pkgs.linuxPackages_6_8;
    kernelPatches = [
      {
        name = "Enable Intel TDX guest support";
        patch = null;
        extraStructuredConfig = with lib.kernel; {
          INTEL_TDX_GUEST = yes;
          TDX_GUEST_DRIVER = module;
        };
      }
      {
        name = "[PATCHv3 0/4] x86/tdx: Adjust TD settings on boot";
        patch = pkgs.fetchpatch {
          # patch complains that "Only garbage was found in the patch input" if
          # the .gz suffix is present, so remove it (it is not required):
          # https://public-inbox.org/public-inbox.git/289599b8cc33ec17b1ba3e131222cc6fa9a47d0e/s/?b=lib/PublicInbox/WWW.pm/lib/PublicInbox/WWW.pm#n471
          # 
          url = "https://lore.kernel.org/linux-coco/20240506121553.3824346-1-kirill.shutemov@linux.intel.com/t.mbox";
          hash = "sha256-QpNMeKXSykxNGYy/5KIVPof2OezQRuiuCw2IKefswXw=";
          decode = decodeMbox;
        };
      }
    ];
  };
}