NOTE: The project "Linux TDX 1.5 SW Stack" is end of life. Please refer to Red Hat blog Enabling hardware-backed confidential computing with a CentOS SIG or Ubuntu blog Intel® TDX 1.0 technology preview available on Ubuntu 23.10 or SUSE blog Intel® TDX Support Coming to SUSE Linux Enterprise Server for more information of TDX Early Preview. The default branch mid-stream is used to sustain tools for TDX Early Preview.
This project provides the modified components to setup TDX stacks and additional components/tools/services for optimized/full-capabilities Intel® TDX based confidential computing solutions.
NOTE:
- Please refer the white paper: Linux*Stacks for Intel® Trust Domain Extension 1.5 and wiki for additional informational about TDX 1.5 or developer specific information.
- The modified components like Kernel, Qemu, Libvirt etc includes pre-upstream patches are for reference only.
- The modified components like Grub, Shim's were already upstream-ed. Please install from the corresponding OS distribution.
- The component TDVF uses the configuration of
IntelTdxX64.dscfrom edk2 upstream. - The component DCAP refers to
SGXDataCenterAttestationPrimitives - The components, tools, services are not only for function evaluation, but also
are full optimized for performance, please see
Performance Considerations of Intel® Trust Domain Extensions on 4th Generation Intel® Xeon® Scalable Processors - The use case based services/solutions strictly follows the
Kernel Hardening Strategywithout compromising security. - The kernel is keeping to evolving. Please refer to corresponding tags for different kernel version used.
| Tag | Kernel version | TDX Version | Descriptions |
|---|---|---|---|
| 2023ww41 | 6.2.16 | TDX 1.5 | Performance improvement, vTPM+, Live Migration+, latest CVE |
Intel® Trust Domain Extensions(TDX) refers to an Intel technology that extends Virtual Machine Extensions(VMX) and Multi-Key Total Memory Encryption(MK-TME) with a new kind of virtual machine guest called a Trust Domain(TD). A TD runs in a CPU mode that protects the confidentiality of its memory contents and its CPU state from any other software, including the hosting Virtual Machine Monitor (VMM). Please get more details from TDX White Papers and Specifications
- As of July 2023, Intel TDX is available through custom
4th Gen Intel Xeon Scalable processors(formerly code-named “Sapphire Rapids”) delivered to certain major Cloud Service Providers, including Alibaba, Azure, Google Cloud and IBM Cloud. Today, Alibaba and Azure are already in preview, with Google and IBM expected in the coming months. - Intel’s Developer Cloud will be equipped with TDX-capable
Intel Xeon Scalable processorsin the coming months for software testing and solution development. Stay tuned to our GitHub for news on availability. - Intel TDX will be generally available in the upcoming
5th Gen Intel Xeon Scalable processors(code-named “Emerald Rapids”).
NOTE:
- Please run check-tdx-host.sh to check your TDX bare metal host environment.
- Please run check-tdx-guest.sh to check your TDX guest VM environment.
Please see details at here:
It produces the following minimal use cases:
- Launch Intel® TDX guest VM to run general computing workloads
- Do launch-time measurement within the Intel® TDX guest VM
- Do runtime attestation with the quote generated by Intel® Software Guard Extensions (Intel® SGX)-based quote generation service (QGS) on the IaaS host
- vTPM stack for TD works with tpm2-tools, IMA and Keylime.
It provides the below tools for developer:
- Build individual component's package or install pre-build binaries on IaaS host or create PaaS guest image for quick evaluation
- Generate the patch set for deep dive in source code level
- Test, hack and debug the TDX technology based on PyCloudStack framework
- Dump guest VM measurement and generate TD quote report for TDX E2E attestation
- Measured boot and Secure boot for TDX guest VM
- Deployment tool for Linux TDX SW stack deployment on TDX enabled host
- Guest image tool to generate TD guest image
Linux Stack for Intel® TDX includes the components in below diagram:
| Name | Stack | Description |
|---|---|---|
| TDX Kernel | Host + Guest | Linux kernel for TDX |
| TDX Qemu-KVM | Host | Qemu VMM for TDX |
| TDX SEAM Module | Host | TDX Secure Arbitration Module |
| vTPM TD | Host | A service TD provides vTPM service to TD |
| Migration TD | Host | Migration TD for live migration |
| TDX Libvirt | Host | The modified libvirt to create TDX guest domain via Qemu |
| TDVF | Host | The modified OVMF(Open Source Virtual Firmware) to support TDX guest boot like page accept, TDX measurement |
| TDX Grub2 | Guest | The modified grub for guest VM to support TDX measurement |
| TDX shim | Guest | The modified shim for guest VM to support TDX measurement |
| Type | Content |
|---|---|
| BKM | Check Memory Encryption |
| BKM | Enable IMA with TDX RTMR |
| Developer | Developer Guide |
| Developer | Off TD GDB Debug |
| 1.5 | TD Migration |
| 1.5 | vTPM |
| Cloud | Confidential Cloud Native Primitives |