Skip to navigation
Confidential Virtual MachinesDeployment Guide

Configuring the Hardware

View as Markdown

The Hardware IT Administrator selects the CPUs and GPUs and configures the BIOS or UEFI so that the host OS administrator can enable Confidential Computing.

Selecting Hardware

Confidential Computing requires CPUs and GPUs that provide the security features defined by the Confidential Computing Consortium. Refer to Supported Platforms for the CPUs, GPUs, and operating systems that NVIDIA supports.

Configuring the BIOS

Configure the motherboard BIOS to enable the options that Confidential Computing requires. The following examples show the BIOS menus on systems that NVIDIA tested. Menu names and locations vary by motherboard vendor.

AMD

BIOS MenuSettingValue
Advanced > CPU ConfigurationSMEEEnabled
Advanced > CPU ConfigurationSEV ASID Count509 ASIDs
Advanced > CPU ConfigurationSEV-ES ASID Space Limit ControlManual
Advanced > CPU ConfigurationSEV-ES ASID Space Limit100
Advanced > CPU ConfigurationSNP Memory CoverageEnabled
Advanced > NB ConfigurationIOMMUEnabled
Advanced > NB ConfigurationSEV-SNP SupportEnabled

Intel

BIOS MenuSettingValue
CPU Configuration > Processor ConfigurationLimit CPU PA to 46 BitsDisable
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXTotal Memory Encryption (Intel TME)Enable
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXTotal Memory Encryption (Intel TME) BypassAuto
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXTotal Memory Encryption Multi-Tenant (Intel TME-MT)Enable
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXMemory IntegrityDisable
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXIntel TDXEnable
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXTDX Secure Arbitration Mode Loader (SEAM)Enabled
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXDisable excluding Mem below 1MB in CMRAuto
CPU Configuration > Processor Configuration > Intel TME, Intel TME-MT, Intel TDXIntel TDX Key SplitA non-zero value
CPU Configuration > Processor ConfigurationSoftware Guard ExtensionEnable

After you configure the BIOS, continue with Configuring the Host.