From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jordi Cucurull Juan Subject: Questions about the usage of the vTPM implemented in Xen 4.3 Date: Wed, 05 Feb 2014 17:52:16 +0100 Message-ID: <52F26C40.2060901@scytl.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WB5hy-0000Hu-BA for xen-devel@lists.xenproject.org; Wed, 05 Feb 2014 16:52:18 +0000 List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org List-Id: xen-devel@lists.xenproject.org Dear all, I have recently configured a Xen 4.3 server with the vTPM enabled and a guest virtual machine that takes advantage of it. After playing a bit with it, I have a few questions: 1.According to the documentation, to shutdown the vTPM stubdom it is only needed to normally shutdown the guest VM. Theoretically, the vTPM stubdom automatically shuts down after this. Nevertheless, if I shutdown the guest the vTPM stubdom continues active and, moreover, I can start the machine again and the values of the vTPM are the last ones there were in the previous instance of the guest. Is this normal? 2.In the documentation it is recommended to avoid accessing the physical TPM from Dom0 at the same time than the vTPM Manager stubdom. Nevertheless, I currently have the IMA and the Trousers enabled in Dom0 without any apparent issue. Why is not recommended directly accessing the physical TPM of Dom0? 3.If it is not recommended to directly accessing the physical TPM in Dom0, which is the advisable way to check the integrity of this domain? With solutions such as TBOOT and IntelTXT? Best regards, Jordi.