--- /dev/null
+TDVF Overview\r
+-------------\r
+\r
+<b>Intel Trust Domain Extension (TDX)</b> is Intel Architecture extension\r
+to provide trusted, isolated VM execution by removing CSP software\r
+(hypervisor etc) from the TCB. <b>TDX Virtual Firmware (TDVF)</b> is an\r
+EDK II based project to enable UEFI support for TDX based Virtual\r
+Machines. It provides the capability to launch a TD.\r
+\r
+The <b>Intel? TDX Virtual Firmware Design Guide</b> is at\r
+https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.01.pdf.\r
+\r
+More information can be found at:\r
+https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html\r
+\r
+\r
+Configurations and Features\r
+----------------------------\r
+\r
+There are 2 configurations for TDVF.\r
+\r
+<b>Config-A:</b>\r
+ - Merge the *basic* TDVF feature to existing OvmfX64Pkg.dsc. (Align\r
+ with existing SEV)\r
+ - Threat model: VMM is NOT out of TCB. (We don?t make things worse)\r
+ - The OvmfX64Pkg.dsc includes SEV/TDX/normal OVMF basic boot capability.\r
+ The final binary can run on SEV/TDX/normal OVMF.\r
+ - No changes to existing OvmfPkgX64 image layout.\r
+ - No need to add additional security features if they do not exist today.\r
+ - No need to remove features if they exist today.\r
+ - RTMR is not supported.\r
+ - PEI phase is NOT skipped in either Td or Non-Td.\r
+\r
+<b>Config-B:</b>\r
+ - (*) Add a standalone IntelTdx.dsc to a TDX specific directory for a *full*\r
+ feature TDVF.(Align with existing SEV)\r
+ - (*) Threat model: VMM is out of TCB. (We need necessary change to prevent\r
+ attack from VMM)\r
+ - (*) IntelTdx.dsc includes TDX/normal OVMF basic boot capability. The final\r
+ binary can run on TDX/normal OVMF.\r
+ - It might eventually merge with AmdSev.dsc, but NOT at this point of\r
+ time. And we don?t know when it will happen. We need sync with AMD in\r
+ the community after both of us think the solutions are mature to merge.\r
+ - Need to add necessary security feature as mandatory requirement, such\r
+ as RTMR based Trusted Boot support.\r
+ - Need to measure the external input from Host VMM, such as TdHob, CFV.\r
+ - Need to measure other external input, such as FW_CFG data, os loader,\r
+ initrd, etc.\r
+ - Need to remove unnecessary attack surfaces, such as network stack.\r
+\r
+In current stage, <b>Config-A</b> has been merged into edk2-master branch.\r
+The corresponding pkg file is OvmfPkg/OvmfPkgX64.dsc.\r
+\r
+<b>Config-B</b> is split into several waves. The corresponding pkg file is\r
+OvmfPkg/IntelTdx/IntelTdxX64.dsc. The features with (*) have been implemented\r
+and merged into edk2-master branch. Others are in upstreaming progress.\r
+\r
+Build\r
+------\r
+- Build the TDVF (Config-A) target:\r
+`cd /path/to/edk2`\r
+`source edksetup.sh`\r
+`build.sh -p OvmfPkg/OvmfPkgX64.dsc -a X64 -t GCC5`\r
+\r
+- Build the TDVF (Config-B) target:\r
+`cd /path/to/edk2`\r
+`set PACKAGES_PATH=/path/to/edk2/OvmfPkg`\r
+`source edksetup.sh`\r
+`build.sh -p OvmfPkg/IntelTdx/IntelTdxX64.dsc -a X64 -t GCC5`\r
+\r
+Usage\r
+-----\r
+\r
+Assuming TDX-QEMU/TDX-KVM are already built, one can start a TD virtual\r
+machine as [launching-td-guest](https://github.com/intel/qemu-tdx/blob/tdx-qemu-upstream-rfc-v3/docs/system/i386/tdx.rst#launching-a-td-tdx-vm):\r
+\r
+`qemu_system_x86 \`\r
+` -machine ...,confidential-guest-support=tdx0 \`\r
+` -object tdx-guest,id=tdx0,[sept-ve-disable=off] \`\r
+` -drive if=pflash,format=raw,unit=0,file=/path/to/OVMF_CODE.fd \`\r
+` -drive if=pflash,format=raw,unit=1,file=/path/to/OVMF_VARS.fd \`\r
+\r
+Note:\r
+TDX-QEMU/TDX-KVM are still in upstreaming progress. Please refer to:\r
+ - kvm : https://github.com/intel/tdx/tree/kvm-upstream\r
+ - qemu : https://github.com/intel/qemu-tdx/blob/tdx-qemu-upstream-rfc-v3\r
+\r
+Once above 2 upstreaming are completed a minimum qemu/kvm version will be updated here.\r