Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Limitations of Virtual Software Guard Extensions (SGX) in vSphere (71367)

Last Updated: 8/24/2022Categories: InformationalTotal Views: 297671Language:
Chinese (Simplified)JapaneseEnglish

4 like this article

Subscribe to get an email
newsletter with new updates

4 people found this helpful Please provide article feedback:

Purpose

This article documents limitations and issues that may arise when using Virtual Software Guard Extensions (SGX) in vSphere. For a full list of supported processors, refer to the vSphere Compatibility Guide.

VMware vSphere 7.0 (and subsequent releases) support virtualizing Intel Secure Guard Extensions (SGX) to virtual machines on selected Intel processors when the VM is using virtual Hardware Version 17 or greater.

Resolution

Limitations on Hyper-Threading for Intel® Xeon® E-2100 and E-2200 Series

There are support limitations for Intel Xeon E-2100 Series and Intel Xeon E-2200 (4 or 6-core) Series. Due to security mitigations, Intel SGX is not available for virtual machines if Hyper-Threading is enabled on these hosts. Attempting to enable SGX on such processors when Hyper-Threading is enabled could result in a message displayed on the host summary page similar to:

Configuring SGX support for virtual machines fails.

Below Intel series are the affected processors:

Intel Xeon E-2100 Series

Intel Xeon E-2200 (4 or 6-core) Series including:

Intel® Xeon® E-2286G

Intel® Xeon® E-2276G

Intel® Xeon® E-2274G

Intel® Xeon® E-2246G

Intel® Xeon® E-2244G

Intel® Xeon® E-2236

Intel® Xeon® E-2234

Intel® Xeon® E-2226G

Intel® Xeon® E-2224

Intel® Xeon® E-2224G

Solution:

Customers that require Intel SGX can disable Hyper-Threading on an ESXi host (at a possible performance loss) using either one of these steps:

Disable Hyper-Threading on the ESXi host's BIOS configuration. This option is labeled Enable HyperThreading by some manufacturers, and Logical Processors by others.

Set the advanced configuration option VMkernel.Boot.hyperthreading to "false" in the ESXi host settings. Restart the ESXi host for the setting to take effect.

Customers that do not require Intel SGX or cannot afford to disable Hyper-Threading can suppress the warnings on a per-host basis:

Set the advanced configuration option SuppressSgxDisabledWarning to 1 in the ESXi host settings. Restart the ESXi host for the setting to take effect.

Notes: For more information on the Intel errata code CFW101, see Intel® Xeon® E-2100 and E-2200 Processor Family Spec Update.

Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. The inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.

Limitations on SGX Remote Attestation for 3rd Gen or Later Intel® Xeon® Scalable Processors

On 3rd Gen or later Intel Xeon Scalable Processor platforms, enabling support for remote attestation of SGX enclaves requires the host to register its SGX cryptographic identity with a public Intel service. Starting from vSphere 8.0, vSphere has built-in functionality to perform SGX registration. Older releases of vSphere cannot perform this registration step.

Solution:

To enable SGX remote attestation, register the host in vSphere if running vSphere 8.0 or later. If running an older version of vSphere, it may be possible for third-party software to register the host during the provisioning stage. Note that this workaround is not officially verified nor supported by vSphere. For more details, see Remote Attestation for Multi-Package Platforms using Intel® SGX Datacenter Attestation Primitives (DCAP) .

Limitations on adding or replacing a CPU Package in a CPU Socket for 3rd Gen or Later Intel® Xeon® Scalable Processor

On 3rd Gen or later Intel Xeon Scalable Processor platforms, when a CPU package is added or replaced in a CPU socket, SGX will automatically be disabled on the next host power-on.

Solution:

On the first boot following the addition or replacement of a CPU package in a CPU socket, customers should manually initiate an SGX Reset on the host's BIOS configuration. Optionally, customers can disable the SGX APB Support BIOS configuration option to automate this process in the future.

Note: This process will reset the encryption keys used by SGX, making any sealed data inaccessible. SGX remote attestation will be disabled following this process. SGX host registration will again be required to re-enabled it.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
尝试从 vApp 模板部署 vApp 时，出现错误“Hub“资源”违反虚拟机主机关联性规则 (Hub "Resources" violates VM host affinity rule)” (71366)

KB
•
vCloud Director for Service Provider の仮想マシンにディスクを追加すると、「StoragePlacementSpec の必須プロパティ podSelectionSpec が設定されていません (StoragePlacementSpec required property podSelectionSpec not set)」というエラーが表示される (71365)

KB
•
Kubernetes サービスの作成が停止し、サービス IP アドレスの待機状態となり「ロード バランサ サービスのプールの最大数を超えました (Exceed maximum number of pools on the Load balancer service)」というエラーが発生する (71372)

KB
•
ファイル /opt/vmware/vcloud-director/data/transfer: cpio: chown のアーカイブの展開に失敗する (71340)

KB
•
API 経由でマシン プリフィックスを削除すると 400 不正な要求エラーが発生する (71344)

Results 1-5 of 5

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

Related Versions:

VMware vSphere ESXi 7.0.0

Take Our Survey

Support Assistant