Power-on Failures for VMs using Intel TDX on Hosts Using Enhanced vMotion Compability (EVC)

Products

• VMware vSphere ESXi

Issue/Introduction

• If a host has a non-native EVC mode set, attempting to power-on a VM with Intel TDX enabled may fail with the following error in vmware.log:
  Power on failure messages: Module 'TDX' power on failed.
  
  
• Additionally, vmkernel.log will show the following error:
  WARNING: TDX: 2391: TDH.MNG.INIT failed with status: 0xc000010000000045

Environment

VMware vSphere ESXi 9.0

Cause

Intel TDX does not support configuration of the CPUID(1).EAX leaf (which contains the family, model, and stepping) to non-native values. Live migration of VMs using Intel TDX is not supported in VMware ESXi 9.0, but EVC masks for the family, model, and stepping fields are still applied to the CPUID configuration. This may result in a power-on failure if the EVC masks specify non-native values for the family, model, or stepping.

Resolution

• As a workaround, EVC masks which specify 0 for the family, model, and stepping can be set in an individual VM's configuration (.vmx file) to override the host-wide EVC masks:
  featMask.evc.cpuid.FAMILY = "Val:0"
featMask.evc.cpuid.MODEL = "Val:0"
featMask.evc.cpuid.STEPPING = "Val:0"


• Intel TDX will use native values for the family, model, and stepping if the corresponding entries in the CPUID configuration are set to 0.
  
  
• VMware vSphere ESXi 9.1 contains a fix for this issue. The workaround is not needed in 9.1 and above.