Intel TDX on the OpenMetal XL v5: Ready Out of the Box

Q: Does the OpenMetal XL v5 support Intel TDX out of the box?

Yes — the OpenMetal XL v5 ships TDX-ready with no RAM upgrade: its 1024 GB DDR5-6400 already populates one DIMM on every memory channel (the full-channel configuration TDX requires), so enabling TDX is a BIOS toggle (TDX + SGX), not a hardware change.

Schedule a Consultation

Intel TDX has a hardware gate: at least 8 identical DIMMs per socket with one populating every memory channel (Slot 0 on each channel), symmetric across both sockets. The XL v5 meets it at deploy time — its 1 TB is 16x 64 GB RDIMMs at one DIMM per channel (16 of its 32 slots), exactly the full-channel layout TDX needs, and it also clears OpenMetal’s 1 TB production-performance spec. Unlike the Large v5 and Medium v5 (which ship at half-populated channels and need a RAM upgrade before TDX can be enabled), the XL v5 needs no hardware change — enabling TDX is a single BIOS toggle (TDX + SGX), with no RAM upgrade, no scheduled maintenance window, and no second deploy.

Intel SGX is enabled by the same BIOS toggle, providing process-level enclave isolation alongside TDX’s whole-VM trust domains. TME-MK (multi-key memory encryption) is active across the platform regardless of whether a workload runs inside a TD. Together, these give XL v5 customers a layered confidential computing posture from day one: SGX for small high-value secrets like signing keys, TDX for full guest-OS isolation, and TME-MK as a baseline AES-encrypted memory layer for everything else.

The Granite Rapids platform on the XL v5 also improves TEE performance over earlier generations. AMX, AVX-512, AES-NI, and DL Boost are all available inside trust domains, so confidential inference, confidential analytics, and confidential database workloads run at performance levels closer to bare metal than was practical on earlier TDX implementations. Customers running regulated financial workloads, healthcare PHI, sovereign cloud, or multi-tenant SaaS isolation use cases can launch attested trust domains on day one — configuration guidance is in the OpenMetal SGX/TDX enablement guide.

—-