Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

ESXi host platform reset behavior with Intel TPM/TXT's reset attack protection feature (78243)

Last Updated: 4/22/2020Categories: TroubleshootingTotal Views: 26865Language:
Chinese (Simplified)JapaneseEnglish

14 like this article

Subscribe to get an email
newsletter with new updates

14 people found this helpful Please provide article feedback:

Symptoms

In ESXi 7.0, TPM/TXT's reset attack protection is enabled by default. If TXT is enabled, when a platform is reset in an ungraceful manner either by reset attack or a sudden warm reset, during subsequent warm boot, BIOS can detect the ungraceful reset and flag an UEFI error similar to the following:

UEFI0046: An issue is observed in the previous invocation of TXT SINIT Authenticated Code Module (ACM) because the TXT information stored in the TPM chip may be corrupted. Do one of the following:
1) Update the BIOS firmware.
2) Go to System Setup >System Security page, click the "Clear" option under TPM command. Restart the system, go to System Setup > System Security page, click the "Activate" option under TPM command, and then enable TXT.

Cause

Intel's TPM/TXT technology provides features to launch a trusted environment on a platform. Reset attack protection is one among them. It is implemented in ESXi 7.0. With reset attack protection feature, MLE sets a secrets flag in TPM security memory when secrets are stored in TPM. With secrets in TPM, when a platform is reset in an ungraceful manner either by reset attack or a sudden warm reset, during subsequent warm boot, BIOS can detect that the secrets bit is never de-asserted and perform either of the following action:

BIOS interprets the related TXT error code, calls into the ACM to clear the memory contents before unlocking memory, clears the TXT Error code, then enters the normal boot flow. The MLE launch will proceed as normal. This is Intel’s desired workflow for BIOS implementation.

BIOS does not clear TXT error code and de assert secrets bit for TPM. Instead it flags the error code, stops the boot flow until user intervenes and performs either a cold reset or continues boot flow with TXT error. In latter case, trusted launch will not be allowed due to TXT error. In the former case, cold reset will clear the error, reset secrets and allow trusted boot to continue. This is the behavior if BIOS implementation does not address the TXT error code.

Error message noted in the previous section is due to BIOS flagging the error per (2).

Resolution

The error message is the expected behavior when platform is reset in an ungraceful manner and BIOS does not implement Intel's desired workflow.

By performing a "cold reboot" after a sudden reboot, TPM/TXT error can be cleared and ESXi can perform a normal, trusted launch.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
ESXi 6.7 以降では、仮想スイッチが不正な形式のパケットを仮想マシンに転送しない (78283)

KB
•
无法下载以句点开头的虚拟机文件 (78286)

KB
•
SRM サイトのインベントリ マッピングで変更が行われた後、既存の保護グループ（保護された仮想マシン）のインベントリ マッピングを更新できない (78232)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware vSphere ESXi

Related Versions:

VMware vSphere ESXi 7.0.0

VMware vSphere ESXi 7.0.0

Take Our Survey

Support Assistant