On Tue, Sep 27, 2011 at 10:50:48AM -0400, Stefan Berger wrote: > +Since the host's firmware (BIOS/UEFI) has already initialized the TPM, > +the VM's firmware (BIOS/UEFI) will not be able to initialize the > +TPM again and may therefore not show a TPM-specific menu that would > +otherwise allow the user to configure the TPM.
> +Also, if TPM ownership is released from within a VM then this will > +require a reboot of the host and the user will have to enter the host's > +firmware menu to enable and activate the TPM again. Rewrite: Further, if TPM ownership is released from within a VM, TPM gets deactivated in host. To enable and activate the TPM again afterwards, host has to be rebooted and the user is required to enter the host's firmware menu. > If the TPM is left > +disabled and deactivated most TPM commands will fail. Why do we allow guest to do this then? Can we return an error, or ignore the release command? If someone really wants this unsafe behaviour we could make this an option, off by default. -- MST
