Intel Virtualization Technology Extensions to Enable Hardware Isolated VMs
summary
Hardware-enforced VMs (TDs) run with CPU/memory confidentiality and integrity using a signed TDX module in a new SEAM mode, private MKTME keys, secure EPT tables, and a CMRR-protected module loader. KVM integration adds ~6,000 new LOC and ~40 TDX APIs so KVM can create TDs, add vCPUs, and run enlightened Linux guests with virtio working; QEMU support lags. Current gaps: 2 MiB large pages, host page migration, unmapping guest-private memory, and live migration/nested TDs remain on the roadmap.
AI-written summary · about
chapters (15)
- 0:00Introduction to Intel TDX
- 0:36Hardware and software overview
- 1:11Secure arbitration mode
- 2:02Memory encryption and integrity
- 3:42The TDX module and VMM ABI
- 6:00Seam loader and module boot
- 7:32TDX API and life cycle
- 8:44Guest interfaces and calls
- 9:43KVM and Linux changes
- 11:12Secure EPT management
- 12:51Private memory management
- 13:52TDMRs and memory unmapping
- 15:41Shared memory and exceptions
- 17:03Advanced features and migration
- 17:51Status and future work
related talks
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
17mStatus Update on TDX Support
22mSupporting TEE on x86 Client Platforms with pKVM
23mAllowing an Intel TDX Module to Run Without SEAM
26mVirtual TPM based attestation for Intel Trust Domain Extensions
27mTDX Live Migration
23mHyper-V's Virtual Secure Mode in KVM project update
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment