Intel TDX: whole-VM trusted domains and attestation

How the Trust Domain boundary works

The Intel TDX module runs in a more privileged secure arbitration mode and mediates creation and execution of Trust Domains. Private TD memory and saved CPU state receive hardware-enforced confidentiality and integrity protection from the VMM, host OS, and other VMs. The host still allocates resources, schedules virtual CPUs, and handles emulated I/O.OVERVIEW,ARCH

TDX attestation in practice

MRTD represents build-time TD measurement, while runtime measurement registers can extend the boot and software chain. Guest software requests a TDREPORT and can bind application data such as a session public-key hash. A quoting enclave produces a signed TD Quote for remote verification.ATTEST

• Validate Intel certification and current TCB collateral, including expiry and revocation.
• Compare MRTD and applicable runtime measurements with approved values.
• Check TD attributes, security version and debug-relevant policy.
• Validate freshness and the report-data binding before releasing secrets.
• Operate a controlled update process for new measurements and platform security baselines.

What TDX does not protect

• Availability: a malicious host can deny CPU, memory, devices, network, or power.
• Untrusted I/O: shared pages, hypercalls, MMIO, port I/O, CPUID/MSR values, and device input must be treated as attacker-controlled unless another protected mechanism applies.
• Guest compromise: vulnerabilities in the guest kernel or application run inside the TD boundary.
• Every side channel or sophisticated physical attack: use Intel’s current security guidance for the exact platform.
• External data paths: storage, network, logging, and management services require separate controls.

Customer fit and operational constraints

TDX fits enterprises that want a familiar VM operating model while excluding a cloud or platform administrator from protected guest memory. It is particularly relevant when a supported NVIDIA confidential GPU must attach to an Intel-hosted CVM. Teams must still maintain guest images, attestation collateral, reference values, device/I/O policy, upgrade workflows, and fail-closed key release.