NVIDIA H100 confidential computing: supported SKUs, modes, and availability

Support status at a glance

H100 PCIe

NVIDIA’s current matrix lists H100 PCIe for single-GPU passthrough confidential mode. A provider exposing the board through ordinary passthrough is not enough: the host CPU TEE, system firmware, VBIOS, driver branch, guest software, and reference measurements must match a supported row.MATRIX,PLATFORMS

H100 NVL

H100 NVL is supported for single-GPU confidential passthrough. Azure’s GA NCCadsH100v5 product uses one 94 GB H100 NVL with AMD EPYC Genoa and SEV-SNP. Azure documents no live migration, memory-preserving updates, resizing, or accelerated networking for this series; regional SKU availability should be queried at procurement time.AZURE,AZURE-SKU

HGX H100 variants

The live matrix names HGX H100 4-GPU configurations in 64 GB, 80 GB, and 94 GB variants, and HGX H100 8-GPU 80 GB and 96 GB configurations. NVIDIA’s R595 release supports Protected PCIe multi-GPU confidential mode on the named 8-GPU configurations. Check the current row for cooling and board/system specifics rather than generalizing from the HGX label.R595,MATRIX

Confirmed cloud products

AWS, Oracle Cloud, CoreWeave, Nebius, and other providers may list H100 hardware. Their product documentation does not establish a named H100 service with NVIDIA confidential mode enabled. Keep “H100 available” separate from “H100 CC-On with verifiable evidence.”

Security properties and limits

• Secure/measured GPU boot, device identity, hardware access controls, memory scrubbing, a protected session to the CPU confidential VM, and GPU attestation establish the intended device boundary.
• Hopper uses AES-GCM-protected bounce buffers for CPU–GPU traffic through host-visible shared memory.
• H100 HBM is not encrypted. NVIDIA treats on-package placement as protection against common physical interposers in its published threat model.
• Denial of service, sophisticated physical attacks, unsafe code inside the workload, unprotected logs, and disclosure through outputs remain outside the automatic protection.
• CC-DevTools exposes counters/debug-related capability and is not equivalent to production CC-On; attestation policy should reject it.

Customer fit and performance considerations

H100 is a strong option for sensitive inference, fine-tuning, analytics, and proprietary model serving where a single GPU or a documented HGX topology provides enough memory and throughput. Compute-dense work fits better than workloads that repeatedly transfer small buffers across the CPU–GPU boundary. Pinned host-memory restrictions and unsupported cudaHostRegister behavior can affect existing pipelines; test the real runtime and libraries.R595,PLATFORMS

• Confidential Containers currently require passthrough; MIG and vGPU are unsupported.
• Mixed confidential and non-confidential GPUs on one node are unsupported.
• For supported multi-GPU mode, all devices are assigned to one confidential VM.
• Pinned host memory is slower, and software such as NPP that assumes pinned memory may fail.
• R595 reports an NCCL performance issue with 2.26.2 in Protected PCIe mode and recommends 2.26.3 or newer.