CPU identification (CPUID) masks control the CPU features made visible to the guest operating system of the virtual machine. Masking CPU NX/XD bits can make a virtual machine more compatible to migrate to the ESXi hosts. Leaving the CPU NX/XD bit exposed serves the security purpose of marking memory pages as data-only to prevent buffer overflow attacks and malicious software exploits. Check http://vmware.com/kb/1993 for more information. The CPU features are compared with vCenter Server to determine whether to allow or disallow a vMotion migration. Masking the AMD No eXecute (NX) and the Intel eXecute Disable (XD) bits prevents the virtual machine from using these features, allowing the migration to the ESXi hosts that do not have this capability. If the NX/XD bit is visible, the virtual machine can only be migrated to the ESXi hosts on which the feature is enabled.

To modify the CPUID mask: