Deploying Intel TDX in VCF9

A hands-on guide for infrastructure engineers

Confidential Computing is no longer a niche cloud feature – it’s moving into on-prem and private cloud platforms. With VMware Cloud Foundation (VCF) 9.0, VMware officially supports Intel Trust Domain Extensions (TDX), enabling virtual machines whose memory is encrypted and isolated even from the hypervisor.

This post walks through how to deploy and validate Intel TDX in VCF 9.0, using a modern Dell PowerEdge server (R760) as a reference platform. The steps apply to any server with TDX-capable Intel Xeon CPUs.

This is a hands-on, engineer-focused guide – no theory overload, just what you need to make it work.

What Intel TDX Actually Changes

Intel TDX introduces a new VM security model:

Each VM becomes a Trust Domain (TD)
VM memory is encrypted with per-VM hardware keys
The hypervisor cannot read or introspect guest memory
CPU state, registers, and page tables are protected
Isolation is enforced by the CPU, not software

This directly addresses one of virtualization’s long-standing trust assumptions:

“The hypervisor is trusted.”

With TDX, that assumption is gone.

Prerequisites (Non-Negotiable)

Hardware

Intel Xeon 5th Gen (Emerald Rapids) or newer
CPUs must explicitly support TDX + TME-MK
All CPUs in the host must be TDX-capable

Memory

Symmetric DIMM population
Typically 8 or 16 DIMMs per socket
No Optane / PMem
NUMA-aware layout

BIOS Configuration (Critical Step)

TDX lives or dies in the BIOS.
If one setting is wrong, ESXi will silently disable it.

Required BIOS Settings

Setting	Value
Node Interleaving	Disabled
x2APIC Mode	Enabled
CPU Physical Address Limit	Disabled
Memory Encryption	Multiple Keys (MKTME)
Global Memory Integrity	Disabled
Intel SGX	Enabled
Intel TDX	Enabled
TDX Key Split	≥ 1
SEAM Loader	Enabled

⚠️ Single-Key TME is not enough – TDX requires Multi-Key TME (MKTME).

After applying changes, power-cycle the host (not just reboot).

Verifying TDX at the ESXi Level

Once ESXi 9.0 is installed:

Check TDX Readiness

vsish -e get /hardware/cpu/tdx/moduleInfo

Expected output:

Lifecycle state: 3 -> Ready

Anything else means:

BIOS misconfiguration
Unsupported CPU
Firmware mismatch

Check VMkernel Logs

grep -i tdx /var/log/vmkernel.log

Look for:

SEAM loader initialization
TDX module loaded
No “TDXEarly power on failed” errors

Creating a TDX VM in VCF 9

VM Configuration Checklist

VM Hardware Version: 22 or newer
Firmware: UEFI
Secure Boot: Disabled
Memory Reservation: 100% (mandatory)
vTPM: Not supported (do not add)
Snapshots: Not supported
vMotion: Not supported

In the VM Security / Confidential Computing section:

Set Confidential VM Mode → Intel TDX

Power on the VM and install a supported OS.

Validating TDX Inside the Guest

Inside the VM:

dmesg | grep -i tdx

You should see kernel messages confirming TDX initialization.

Then:

systemd-detect-virt --cvm

Expected output:

tdx

Optional:

cat /proc/cpuinfo | grep tdx

If the guest sees TDX, the trust domain is active.

What Does NOT Work (By Design)

TDX is intentionally restrictive.

Feature	Supported
vMotion / DRS	❌
Snapshots	❌
Suspend / Resume	❌
Hot-add CPU / RAM	❌
Fault Tolerance	❌
Hypervisor introspection	❌
Agentless backups	❌

This is not a bug.
It’s the security model.

Treat TDX VMs like sealed appliances, not pets.

Backup & Operations Strategy

Because snapshots are unavailable:

Use in-guest backup agents
Push logs and metrics from inside the VM
Design for immutable infrastructure
Replace VMs instead of modifying them

TDX pairs extremely well with:

GitOps
Stateless services
Key management / crypto workloads
Regulated data processing

(Optional) Remote Attestation – Why It Matters

TDX supports hardware-backed remote attestation.

This allows a workload owner to verify:

CPU model & microcode
Firmware state
That the VM is actually running as a Trust Domain

Only after successful attestation do you release:

Encryption keys
Secrets
Sensitive data

VCF integrates with Intel’s attestation services, but setting this up deserves its own deep dive.

Final Thoughts

Intel TDX in VMware Cloud Foundation 9 is not a checkbox feature.

It fundamentally changes:

How you design workloads
How you operate VMs
How much you trust the platform

If you need:

Strong tenant isolation
Protection from insider threats
Compliance-driven security guarantees

→ TDX is the right tool.

If you rely heavily on:

vMotion
Snapshots
Traditional VM lifecycle tooling

→ TDX is not for those workloads (yet).

hcidude's blog