As of Jan 15, 2025
This document is subject to periodic updates as new hardware, drivers, and validation data become available – or as such information is confirmed by or reported to Super Protocol.
For the most accurate and up-to-date guidance, always consult your provider directly when making a decision.
The system's CPU and GPU must both support TEE mode and be fully compatible with each other to operate in confidential mode.
Blackwell Architecture:
Rubin Architecture:
More information will be provided at a later time.
Unlike DGX/HGX Hopper-based systems (H100/H200), which support either single-GPU passthrough or full-platform passthrough (e.g., 8-GPU systems), Blackwell-based platforms (such as B200 and RTX PRO 6000) introduce greater flexibility and enhanced inter-GPU security in TEE mode.
They may be configured to run both TEE and non-TEE virtual machines (VMs) on the same system. However, for bare metal servers, where the entire machine is dedicated to a single user, this distinction may be less relevant.
Blackwell-based HGX/DGX systems with NVLink are expected to support configurations with 1, 2, 4, or 8 GPUs in TEE mode, providing significantly more deployment options than previous-generation systems.
Hopper GPUs support two TEE modes:
Single GPU Passthrough (SPT CC): 1 GPU per Confidential VM (CVM). Multiple CVMs may run on the same node, each with 1 GPU.
Multi-GPU Passthrough (PPCIe CC): All 8 GPUs within the physical platform are passed through to a single CVM. CPU–GPU traffic is encrypted via a bounce buffer, but GPU–GPU communication over NVLink or NVSwitch is not hardware-encrypted.
Hopper does not support partial GPU allocation within a larger multi-GPU platform.
Blackwell expands multi-GPU TEE capabilities:
Multiple GPU Passthrough (MPT CC): The R590 TRD1 driver enables MPT CC on supported HGX B200 and B200-850 (8-GPU, SXM6 180GB HBM3e, AC) platforms. Within a supported multi-GPU platform, 1, 2, 4, or 8 GPUs may be assigned to a single Confidential VM (CVM). CPU–GPU traffic is encrypted via bounce buffers, while GPU–GPU communication within the same CVM occurs over hardware-encrypted NVLink connections.
This enables granular GPU allocation and extends the trusted boundary across multiple GPUs within a CVM.
Single GPU Passthrough (SPT CC): The R590 TRD1 driver also supports 1 GPU per CVM under SPT CC mode.
Mixed Deployment: Blackwell systems may also support mixed TEE and non-TEE virtual machines on the same physical server, subject to configuration. However, for bare metal servers, where the entire machine is dedicated to a single user, this distinction may be operationally less relevant.
Refer to official NVIDIA Confidential Computing driver documentation for SKU-level compatibility and supported modes.
NVIDIA has released Confidential Computing (TEE) driver support for the RTX PRO 6000 Blackwell Server Edition, starting with driver R580 TRD1. TEE functionality is currently available only for the Server Edition, while the Workstation and Max-Q Editions are expected to add support in future releases. Super plans to validate this release in upcoming tests. For now, the available information is based on NVIDIA’s official documentation.
The release of RTX PRO 6000 Blackwell Server Edition makes TEE support much more flexible in various topologies.
RTX PRO 6000 Blackwell servers will be available in three editions: Server Edition, Workstation Edition, and Max-Q Workstation Edition. All editions are expected to support Bounce Buffer Confidential Computing, once the necessary drivers are released. Hardware and platform requirements may vary by edition.
⚠️ 4th Gen Intel Xeon (Sapphire Rapids)
Intel supplied 4th Gen Xeon CPUs with TDX support exclusively to Google Cloud Platform, Microsoft Azure, IBM, and Alibaba. Only these cloud providers can offer instances with TEE-enabled 4th Gen Intel Xeon CPUs. All 4th Gen Intel Xeon CPUs from any other sources (cloud providers, OEMs, etc.) do not support Intel TDX.
✅ For all other cases, TDX support begins with the 5th Gen Xeon (Emerald Rapids) and newer — including Sierra Forest, Granite Rapids, and beyond.
However, Intel TDX support alone may not be sufficient for NVIDIA GPU TEE workloads. NVIDIA certifies platforms based on CPU generation (among other factors), and in some cases, OEMs support only specific CPU models (SKUs) to ensure proper functionality in GPU TEE mode.
Note: These compatibility requirements apply to both Intel TDX and AMD SEV-SNP based systems.
NVIDIA certifies platforms based on public upstream Long-Term Support (LTS) Linux kernels.
The formal qualification and certification process depends on features being upstreamed, and since Confidential Computing was only recently added, official GPU+CPU TEE certifications are not yet available. Updates to the certified configuration list are expected in the coming months.
For validated information, always refer to NVIDIA’s official qualification and certification catalog.
In the meantime, NVIDIA has published several articles outlining which GPU and CPU combinations are capable of supporting NVIDIA Confidential Computing.
Based on this information, our compatibility table of OEM server models supporting GPU+CPU TEE includes two categories:
OEMs are not required to conduct separate testing for TEE mode. While OEMs may not officially validate systems for TEE configurations, they often limit available configurations to those more likely to function reliably, especially in scenarios involving TEE workloads.
Additionally, many OEMs confirm that if TEE is part of the GPU feature set and all components meet the necessary requirements, TEE functionality is expected to work as intended.
Note: However, caution is advised with brand-new server models that have not yet been widely tested in the field. We’ve encountered cases where a newly launched system did not meet the OEM’s own standards for TEE readiness and required additional adjustments or testing. Actual outcomes may vary depending on the OEM and their internal validation processes.
Until formal certification is available — or the system has proven field use in TEE mode — testing the full configuration in a real or pilot environment remains the most reliable way to confirm compatibility.
⚠️ Always consult directly with your OEM or hardware reseller to verify that your specific system configuration (including BIOS/Firmware versions, memory (DIMMs) and OS validation) fully meets the requirements for Intel TDX, AMD SEV-SNP, NVIDIA GPU TEE, and your intended confidential computing workloads.
In some cases, ODMs had TEE-related BIOS settings hidden by default, making it impossible to enable TEE on otherwise compatible CPUs (AMD SEV-SNP in our case) — simply because TEE was not part of their expected use case. It can be solved but requires extra effort and time.
⚠️ Some cloud providers claimed to offer Intel TDX-enabled instances, but the required DIMM configuration (i.e., main memory setup) was not met, preventing TEE mode from being properly enabled.
The configurations below are not compatible for use in TEE mode in their current form.