From aaf848db834a721e9790aa9900da709d8753105e Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Mon, 6 Jul 2026 10:48:07 +0200
Subject: [PATCH] OVMF-inteltdx: init at 202605

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 .../61-edk2-ovmf-x64-inteltdx.json            | 24 +++++++
 pkgs/by-name/ov/OVMF-inteltdx/package.nix     | 62 +++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 pkgs/by-name/ov/OVMF-inteltdx/61-edk2-ovmf-x64-inteltdx.json
 create mode 100644 pkgs/by-name/ov/OVMF-inteltdx/package.nix

diff --git a/pkgs/by-name/ov/OVMF-inteltdx/61-edk2-ovmf-x64-inteltdx.json b/pkgs/by-name/ov/OVMF-inteltdx/61-edk2-ovmf-x64-inteltdx.json
new file mode 100644
index 000000000000..ddaf263bcd57
--- /dev/null
+++ b/pkgs/by-name/ov/OVMF-inteltdx/61-edk2-ovmf-x64-inteltdx.json
@@ -0,0 +1,24 @@
+{
+    "description": "OVMF with Intel TDX support",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "memory",
+        "filename": "@firmware@"
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "intel-tdx"
+    ],
+    "tags": [
+
+    ]
+}
diff --git a/pkgs/by-name/ov/OVMF-inteltdx/package.nix b/pkgs/by-name/ov/OVMF-inteltdx/package.nix
new file mode 100644
index 000000000000..a061aebec071
--- /dev/null
+++ b/pkgs/by-name/ov/OVMF-inteltdx/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  edk2,
+  util-linux,
+  nasm,
+  acpica-tools,
+  debug ? false,
+}:
+
+edk2.mkDerivation "OvmfPkg/IntelTdx/IntelTdxX64.dsc" (finalAttrs: {
+  pname = "OVMF-inteltdx";
+  version = lib.getVersion edk2;
+
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "fd"
+  ];
+
+  nativeBuildInputs = [
+    util-linux
+    nasm
+    acpica-tools
+  ];
+  strictDeps = true;
+
+  hardeningDisable = [
+    "format"
+    "pic"
+    "fortify"
+  ];
+
+  buildFlags = lib.optionals debug [ "-D DEBUG_ON_SERIAL_PORT=TRUE" ];
+  buildConfig = if debug then "DEBUG" else "RELEASE";
+
+  # Only ship the unified firmware image: TDX attests the initial guest
+  # memory, so the image is mapped read-only via -bios instead of pflash
+  # and the CODE/VARS split is not useful.
+  postInstall = ''
+    mkdir -vp $fd/FV $fd/share/qemu/firmware
+    mv -v $out/FV/OVMF.fd $fd/FV/OVMF.inteltdx.fd
+    substitute ${./61-edk2-ovmf-x64-inteltdx.json} \
+      $fd/share/qemu/firmware/61-edk2-ovmf-x64-inteltdx.json \
+      --subst-var-by firmware "$fd/FV/OVMF.inteltdx.fd"
+  '';
+
+  dontPatchELF = true;
+
+  passthru = {
+    firmware = "${finalAttrs.finalPackage.fd}/FV/OVMF.inteltdx.fd";
+    mergedFirmware = "${finalAttrs.finalPackage.fd}/FV/OVMF.inteltdx.fd";
+  };
+
+  meta = {
+    description = "UEFI firmware with Intel TDX support";
+    homepage = "https://github.com/tianocore/tianocore.github.io/wiki/OVMF";
+    license = lib.licenses.bsd2;
+    platforms = builtins.filter (lib.hasPrefix "x86_64-") edk2.meta.platforms;
+    maintainers = [ lib.maintainers.katexochen ];
+  };
+})