tdx: document attestation flow for TDX VMs

[liangzhou121]

Add an Attestation section to the Intel TDX documentation, including host and guest prerequisites, Cloud Hypervisor argument behavior for QGS socket usage, and quote generation and optional verification steps.

[Copilot]

Pull request overview

Adds Intel TDX attestation documentation covering prerequisites, QGS socket behavior, quote generation, and verification.

Changes:

• Documents host and guest prerequisites.
• Explains QGS UNIX-socket configuration.
• Adds quote-generation and optional verification steps.

Review findings:

• Moderate: Explicitly document that QGS must use the required UNIX-socket transport and path.
• Nit: Use ./test_tdx_attest in the sample commands.

Suppressed comments (3)

docs/intel_tdx.md:181

• This link targets Intel's intel-innersource repository and the main-internal ref; it is not publicly resolvable (the referenced ref returns 404), so external users cannot follow the optional verification step. Link to a public verification sample or include a verification procedure/source available to the documented audience.

4. (Optional) Download `quote.dat` to the host and verify it with [QuoteVerificationSample](https://github.com/intel-innersource/frameworks.security.confidential-computing.tee.dcap/tree/main-internal/SampleCode/QuoteVerificationSample).

docs/intel_tdx.md:179

• The listed guest packages do not guarantee that make or a C compiler is installed. On a standard cloud image, following the prerequisites can therefore fail with make: command not found before the sample is built. Add the guest build-tool prerequisite, or provide a prebuilt-sample path, before this step.

2. Run `cd /opt/intel/tdx-quote-generation-sample && make` to build `test_tdx_attest`.

docs/intel_tdx.md:180

• The /dev/tdx_guest character device is normally restricted to root or an appropriate device group, so running the sample as the ordinary VM user can fail with permission denied. State the required access, for example by invoking the sample with sudo, or document the udev/device-permission setup.

3. Run `test_tdx_attest` to generate a local quote file named `quote.dat`.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.