RE: [Xen-devel] [PATCH] Intel(R) Trusted Execution Technology support

["Cihula, Joseph" <joseph.cihula@xxxxxxxxx>]

On Saturday, October 27, 2007 1:15 AM, Keir Fraser wrote:
> On 27/10/07 02:56, "Cihula, Joseph" <joseph.cihula@xxxxxxxxx> wrote:
> 
>> o  Xen's command line must include the 'no-real-mode' option to
prevent
>> Xen from reading the e820 table from BIOS.  The TXT code makes
>> modifications to the table passed via GRUB that the Xen portions of
the
>> code need.
> 
> If that's the only reason, we could add another command-line option,
or a
> multiboot info flag, to prevent just the e820 part of real-mode
execution.
> Then you could still set video mode and get disc EDD info even when
running
> on tboot.

It isn't the only reason:  the current tboot code will measure and
verify xen and dom0; if we let xen call into BIOS then we will be
transferring control to code that has not been verified.

If it is very important to initialize the video and disc from BIOS, we
could copy that code into tboot and execute it before tboot launches the
measured environment.  Is this necessary on current model systems (since
TXT is only available on Intel Core 2 -based systems)?

Joe

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel