Enable TDX

Trust Domain Extensions (TDX) is a hardware-based security feature that provides strong memory encryption and integrity protection for virtual machines (VMs). This isolates VMs from the hypervisor and other host system software. TDX is available only with Intel CPUs.

Important

Enabling TDX on a RHEL host is a Technology Preview only. However, enabling TDX on a RHEL guest is fully supported.

Enable TDX on a RHEL host
Copy link

To enable Trust Domain Extensions (TDX) on a RHEL host, you must ensure that your system meets the prerequisites, then install the libvirt-daemon-kvm and tdx-qgs packages.

Before you begin
Copy link

  • Intel CPU that supports TDX, such as 5th Generation Intel Xeon Scalable Processors or newer
  • Your host uses the following hardware and software:
    • RHEL 10.1 or later
    • TDX firmware version 1.5 or later
  • The following settings are enabled in the UEFI CPU menu:
    • Software Guard Extensions (SGX)
    • SGX Auto MP Registration Agent
    • Total Memory Encryption (TME)
    • Total Memory Encryption Multi-Tenant (TME-MT)
    • Trust Domain Extension (TDX)
    • TDX Secure Arbitration Mode Loader (SEAM Loader)

About this task
Copy link

TDX is a hardware-based security feature that provides strong memory encryption and integrity protection for virtual machines (VMs). This isolates VMs from the hypervisor and other host system software. TDX is available only with Intel CPUs.

Important

Using TDX on a RHEL host is a Technology Preview only. Technology Preview features are not supported with Red Hat production service levels agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Procedure
Copy link

  1. Install the necessary packages on the RHEL host. 
    # dnf install libvirt-daemon-kvm tdx-qgs
  2. Disable hibernation on the host and enable IOMMU. 
    # grubby --update-kernel=ALL --args="nohibernate intel_iommu=on"

    Hibernation must be disabled for TDX to function properly.

  3. Update the bootloader configuration and reboot the system. 
    # grub2-mkconfig -o /boot/grub2/grub.cfg
# reboot

    The system must be rebooted for the TDX configuration to take effect.

Results
Copy link

  • Verify that TDX is enabled on the host. 
    # virt-host-validate qemu
     
      QEMU: Checking for hardware virtualization:   PASS
  QEMU: Checking if device '/dev/kvm' exists:   PASS
  QEMU: Checking if device '/dev/kvm' is accessible:   PASS
  QEMU: Checking if device '/dev/vhost-net' exists:   PASS
  QEMU: Checking if device '/dev/net/tun' exists:   PASS
  QEMU: Checking for cgroup 'cpu' controller support:   PASS
  QEMU: Checking for cgroup 'cpuacct' controller support:   PASS
  QEMU: Checking for cgroup 'cpuset' controller support:   PASS
  QEMU: Checking for cgroup 'memory' controller support:   PASS
  QEMU: Checking for cgroup 'devices' controller support:   PASS
  QEMU: Checking for cgroup 'blkio' controller support:   PASS
  QEMU: Checking for device assignment IOMMU support:   PASS
  QEMU: Checking if IOMMU is enabled by kernel:   PASS
  QEMU: Checking for secure guest support:   PASS

    If TDX is enabled on the host, the Checking for secure guest support line reports PASS.

What to do next
Copy link

Enable TDX on a RHEL guest
Copy link

To enable Domain Extensions (TDX) functionality in a RHEL virtual machine (VM), you can apply TDX configuration when creating the VM. Alternatively, you can enable TDX in an existing RHEL VM by editing the VM configuration.

Before you begin
Copy link

  • TDX is enabled on your RHEL host. For instructions, see Enabling TDX on a RHEL host
  • The host has libvirt, virt-install, and virt-xml installed.
  • The VM uses a supported RHEL version as the guest operating system:
    • RHEL 9.6 or later
    • RHEL 10.0 or later
Note

TDX is incompatible with kdump. Enabling TDX in a VM causes kdump to fail in that VM.

About this task
Copy link

TDX is a hardware-based security feature that provides strong memory encryption and integrity protection for VMs, that isolates VMs from the hypervisor and other host system software. TDX is available only with Intel CPUs.

Procedure
Copy link

  • To create a new RHEL VM with TDX enabled:
    • Use the virt-install utility with the --launchSecurity tdx,quoteGenerationService=on option. For example: 
      # virt-install \
     --name <vm_name> --os-info rhel9.6 --memory 2048 --vcpus 2 \
     --boot uefi --import --disk /var/lib/libvirt/images/disk.qcow2 \
     --graphics none --console pty,target_type=serial \
     --launchSecurity tdx,quoteGenerationService=on
  • To enable TDX functionality in an existing RHEL VM:
    1. Shut down the existing VM if it is running. 
      # virsh shutdown <vm_name>
    2. Export and back up the current VM configuration. 
      # virsh dumpxml <vm_name> > /tmp/<vm_name>-backup.xml
    3. Add TDX launch security configuration to the VM domain. 
      # virt-xml <vm_name> --edit --launchSecurity type=tdx

      This command adds the TDX configuration to the VM’s domain XML. Alternatively, you can manually edit the configuration by using virsh edit <vm_name> and add the <launchSecurity type='tdx'> element.

    4. Ensure the VM is configured with a compatible CPU model. 
      # virsh dumpxml <vm_name> --xpath //cpu
       
      <cpu mode="host-passthrough" check="none" migratable="on"/>

      The CPU must be set to host-passthrough or use an Intel Xeon model. If not, update it:

      # virt-xml <vm_name> --edit --cpu mode=host-passthrough
    5. Start the VM. 
      # virsh start <vm_name>

Results
Copy link

  1. On the host, verify that the VM is running with TDX enabled. 
    # virsh dumpxml --xpath //launchSecurity <vm_name>
     
    <launchSecurity type="tdx">
  <quoteGenerationService/>
</launchSecurity>
  2. Log in to the VM.
  3. Verify that the TDX guest device exists. 
    # ls -l /dev/tdx_guest

    If TDX is properly enabled in the guest, this command lists the /dev/tdx_guest character device.

    Important

    Checking the existence of /dev/tdx_guest proves only that the VM is configured and operating correctly. To prove that the VM is using TDX to secure it against a hostile host, you must perform a cryptographic attestation of the guest.

    For more information about attestation, see Learn about Confidential Computing Attestation (Red Hat Blog).

  • If TDX is not detected in the guest, verify that the host TDX configuration is correct and that the VM was restarted after the configuration change.
  • To revert to the original configuration, restore from the backup: 
    # virsh undefine <vm_name>
# virsh define /tmp/<vm_name>-backup.xml