drivers/virt/coco/tdx-guest · keep

Intel TDX confidential VM guest driver

Guest-side support for Intel Trust Domain Extensions, the confidential-computing feature on 5th Generation Xeon Scalable and Xeon 6 server CPUs that lets a virtual machine run encrypted and isolated from its hypervisor. It exposes attestation reports and runtime measurements to software inside the protected VM so cloud workloads can prove what they are running.

keep conf=0.82 deploy=medium replacement=none subsystem=virt category=virtualization

82%

recommendation

It should stay because Intel TDX is a current, actively marketed feature on 5th Gen Xeon and Xeon 6 processors that major cloud providers are rolling out, and the kernel code is still receiving both bug fixes and new functionality (such as added measurement and sysfs interfaces) into 2025 and 2026. There is no alternative implementation, since this is the canonical guest-side glue for the TDX/TSM confidential-computing stack.

repository signals

3 files

451 source lines

11 commits, 5y

+559 / −94 lines added / removed, 5y

7 authors, 5y

monthly commits · 2021-04-21 → 2026-04-21 · 11 total · active in 8/61 months

sources

git.kernel.org
Upstream kernel Kconfig describes this as the TDX Guest driver and shows it depends on INTEL_TDX_GUEST, so this is an active kernel-facing guest driver for Intel TDX rather than legacy helper code.
git.kernel.org
The driver received a substantive fix on 2026-03-20/21, indicating current upstream maintenance rather than abandonment.
git.kernel.org
The driver gained new measurement/sysfs functionality in 2025, showing feature work in addition to bug fixes.
intel.com
Intel states Intel TDX is supported on 5th Generation Intel Xeon Scalable Processors and Intel Xeon 6, which are current server products beyond 2025.
intel.com
Intel markets TDX as currently available via cloud providers and says it is widely available with 5th Gen Xeon, supporting ongoing new deployments rather than legacy-only use.

codex reasoning notes (technical)

Kept because local upstream history shows sustained 2024-2026 maintenance and feature work for a young confidential-VM guest driver; there is no natural replacement beyond the same TDX/TSM stack. Source acquisition: Kconfig and commit evidence came from local tree inspection plus `git log` via shell, with canonical kernel.org URLs attached by stable recall; deployment evidence came from web search results on Intel support/product pages. Lore-first fallback was attempted via `lei`, but `lei` was unavailable in this environment, so removal-talk confidence is indirect rather than from lore query output.