Trusted Execution Technology is not available in VM guest operating systems in vSphere 7/8

Products

• VMware vSphere ESXi

Issue/Introduction

• Trusted Execution Technology (TXT) or Software Guard Extensions (SGX) are not available in a virtual machines guest operating system
• A virtual machine (VM) has been configured with the latest virtual hardware version (21)
• Virtualization based security (VBS) is enabled
• the physical CPU supports TXT, and the feature has been enabled in the host firmware
• there is no EVC mode configured for the ESXi host, or the EVC mode corresponds to a GPU generation that supports TXT
• if the guest operating system is Windows - when reviewing the boot events in the system event log, events with ID 220 can be found, stating that SMX is not supported:

• if the guest OS is Linux - when looking in /proc/cpuinfo, neither txt nor smx are listed as available CPU flags
• additionally, when reviewing the "Security Devices" section in the VM device configuration wizard, SGX is shown as not available:

Environment

VMware vSphere ESXi 7.0.x

VMware vSphere ESXi 8.0.x

Resolution

This is expected. 

The TXT feature provided by the firmware of the physical server or the physical CPU can only be used to secure the ESXi operating system itself, but it cannot be passed through to the virtual machines hosted by ESXi.

To make these features available to operating systems in VMs, the virtual hardware needs to provide them. Current virtual hardware versions, including hardware version 21, do not expose these options, therefore TXT will not be available to guest operating systems.