Build a TDX confidential computing environment and verify remote attestation

Step 1: Verify that TDX is enabled

Verify that TDX is enabled on your instance before proceeding.

1. Check if TDX is enabled.

   lscpu |grep -i tdx_guest

   If the output contains tdx_guest, TDX is enabled.

   [root@iZwzxxxxxxxx:~]# lscpu |grep -i tdx_guest
   Flags:           fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc bts rep_good nopl xtopology tsc_known_freq pni pclmulqdq dtes64 ds_cpl ssse3 sdbg fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single sbd ibrs ibpb stibp ibrs_enhanced tdx_guest fsgsbase bmi1 hle avx2 smep bmi2 erms invpcid rtm avx512f avx512dq rdseed adx smap avx512ifma clflushopts clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx_vnni avx512_bf16 wbnoinvd avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid bus_lock_detect cldemote movdiri movdir64b _vp2intersect md_clear serialize tsxldtrk amx_bf16 avx512_fp16 amx_tile amx_int8 flush_l1d arch_capabilities

2. Check the available attestation report interface.

   The kernel exposes the TDX attestation reports (TD Report and Quote) to user mode, and the interface differs by kernel version. Select a check command that matches the kernel version of the image. Passing either check is sufficient.

   Interface	Applicable images and kernels	Check command
   ConfigFS TSM /sys/kernel/config/tsm/report	Alibaba Cloud Linux 4, Ubuntu 24.04, Debian 13, and Rocky 9.5 or later (upstream kernel 6.7 or later)	ls -d /sys/kernel/config/tsm/report
   Character device /dev/tdx_guest	Alibaba Cloud Linux 3 (kernel 5.10.134-16.al8 or later)	ls -l /dev/tdx_guest

Step 2: Use TDX confidential computing capabilities

TDX provides four atomic capabilities to user mode, which together form a complete chain from local measurement to remote verification.

The OpenAnolis community provides the tdx-lab command-line tool in go-tdx-guest. Its test cases cover the four capabilities described above. The following steps show how to run those test cases.

1. Obtain and build the tool.

   sudo yum install -y git golang
   git clone https://gitee.com/anolis/go-tdx-guest.git
   cd go-tdx-guest/tools/tdx-lab
   go build -o tdx-lab .

   Note

   For Debian and Ubuntu images, run sudo apt install -y git golang-go instead.

2. Obtain the Alibaba Cloud PCCS address of the region in which the instance resides.

   token=$(curl -s -X PUT -H "X-aliyun-ecs-metadata-token-ttl-seconds: 5" "http://100.100.100.200/latest/api/token")
   region_id=$(curl -s -H "X-aliyun-ecs-metadata-token: $token" http://100.100.100.200/latest/meta-data/region-id)
   PCCS_HOST=sgx-dcap-server-vpc.${region_id}.aliyuncs.com

3. Run the test cases.

   # Run all test cases
   ./tdx-lab --skip-early --pccs-url ${PCCS_HOST}

   Note

   The TCB status is not guaranteed to be UpToDate, so a Strict Tcb Check failure in some scenarios is expected. For the full parameter list and a description of each test case, see tools/tdx-lab/README.md.

Region and instance type limitations

Confidential computing is available only in specific zones. Supported instance types vary by zone.

Images

• Debian 13.1 or later: Debian 13.1, Debian 13.2, Debian 13.3.

• Rocky 9.5 or later: Rocky 9.5, Rocky 9.6, Rocky 9.7, Rocky 10.0, Rocky 10.1.

• Ubuntu 24.04 or later: Ubuntu 24.04.

• Alibaba Cloud Linux 3 or later: Alibaba Cloud Linux 3, Alibaba Cloud Linux 4.