> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/sylica/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/sylica/documentation/getting-started/launch-an-intel-tdx-vm.md).

# Launch an Intel TDX VM

{% hint style="info" %}
For ready-to-use Linux boot artifcats including Universal Kernel Images and Initrd for attestable boot, see [Buckypaper](broken://spaces/JCiJp92CK5rDzO9DECIa).
{% endhint %}

## Step-by-step Guide:

Use:

```
sylica-tdx
```

for Intel TDX Trust Domains.

The architecture is:

```
Intel CPU
    │
    ▼
Intel TDX Module
    │
    ▼
KVM
    │
    ▼
QEMU
    │
    ▼
sylica-tdx / CVMF.fd
    │
    ▼
Trust Domain
```

TDX requires host support from the CPU, platform firmware, TDX module, Linux KVM, and QEMU.

### Verify host support

Check the Intel KVM module:

```bash
lsmod | grep kvm_intel
```

Inspect the kernel log for TDX:

```bash
sudo dmesg | grep -i tdx
```

A correctly configured TDX host must have the TDX module loaded and initialized and KVM must expose TDX VM support.

### Check QEMU TDX support

Verify that QEMU exposes the TDX guest object:

```bash
qemu-system-x86_64 \
    -object help | grep tdx
```

You should see:

```
tdx-guest
```

### Select the firmware

```bash
CVMF=~/cvmf/sylica-tdx/CVMF.fd
```

### Launch

A minimal TDX launch configuration is:

```bash
qemu-system-x86_64 \
    -enable-kvm \
    -machine q35,confidential-guest-support=tdx0,kernel-irqchip=split \
    -cpu host \
    -smp 4 \
    -m 4G \
    -object tdx-guest,id=tdx0 \
    -bios "$CVMF" \
    -kernel "$UKI$" \
    -initrd "$INITRD$" \
    -device virtio-net-pci,netdev=net0 \
    -netdev user,id=net0 \
    -nographic
```

The important TDX options are:

```
-object tdx-guest,id=tdx0
```

and:

```
-machine q35,confidential-guest-support=tdx0,kernel-irqchip=split
```

TDX requires a split kernel IRQ chip in current QEMU/KVM configurations.

### Install an operating system

To boot from an installation ISO:

```bash
qemu-system-x86_64 \
    -enable-kvm \
    -machine q35,confidential-guest-support=tdx0,kernel-irqchip=split \
    -cpu host \
    -smp 4 \
    -m 4G \
    -object tdx-guest,id=tdx0 \
    -bios "$CVMF" \
    -kernel "$UKI$" \
    -initrd "$INITRD$" \
    -cdrom ubuntu.iso \
    -boot order=d \
    -device virtio-net-pci,netdev=net0 \
    -netdev user,id=net0
```

After installation, remove the installer ISO and boot-order override.

### TDX attestation

Booting a TDX guest and verifying a TDX guest are separate operations.

The complete security path is:

```
CVMF.fd
    │
    ▼
TD creation
    │
    ▼
TDX measurements
    │
    ▼
TDX quote
    │
    ▼
attestation verifier
    │
    ▼
policy decision
```

For production deployments, attestation should verify the expected TDX configuration rather than merely checking that a valid TDX quote exists.