Symptoms:

• In ESXi 7.0, TPM/TXT's reset attack protection is enabled by default. If TXT is enabled, when a platform is reset in an ungraceful manner either by reset attack or a sudden warm reset, during subsequent warm boot, BIOS can detect the ungraceful reset and flag an UEFI error similar to the following:

VMware vSphere ESXi 7.0.0

Intel's TPM/TXT technology provides features to launch a trusted environment on a platform. Reset attack protection is one among them. It is implemented in ESXi 7.0. With reset attack protection feature, MLE sets a secrets flag in TPM security memory when secrets are stored in TPM. With secrets in TPM, when a platform is reset in an ungraceful manner either by reset attack or a sudden warm reset, during subsequent warm boot, BIOS can detect that the secrets bit is never de-asserted and perform either of the following action:

1. BIOS interprets the related TXT error code, calls into the ACM to clear the memory contents before unlocking memory, clears the TXT Error code, then enters the normal boot flow. The MLE launch will proceed as normal. This is Intel’s desired workflow for BIOS implementation.
2. BIOS does not clear TXT error code and de assert secrets bit for TPM. Instead it flags the error code, stops the boot flow until user intervenes and performs either a cold reset or continues boot flow with TXT error. In latter case, trusted launch will not be allowed due to TXT error. In the former case, cold reset will clear the error, reset secrets and allow trusted boot to continue. This is the behavior if BIOS implementation does not address the TXT error code.

• The error message is the expected behavior when platform is reset in an ungraceful manner and BIOS does not implement Intel's desired workflow.
• By performing a "cold reboot" after a sudden reboot, TPM/TXT error can be cleared and ESXi can perform a normal, trusted launch.