diff -BbuNr xen-unstable.hg-hvmop_set_mem/tools/firmware/hvmloader/config.h xen-unstable.hg-make_ROM_ro/tools/firmware/hvmloader/config.h
--- xen-unstable.hg-hvmop_set_mem/tools/firmware/hvmloader/config.h	2008-06-01 13:51:37.000000000 +0100
+++ xen-unstable.hg-make_ROM_ro/tools/firmware/hvmloader/config.h	2008-07-08 18:46:27.059133000 +0100
@@ -31,4 +31,7 @@
 #define ROMBIOS_PHYSICAL_ADDRESS      0x000F0000
 #define SCRATCH_PHYSICAL_ADDRESS      0x00010000
 
+/* Xen Platform Device */
+#define PFFLAG_ROM_LOCK 1 /* Sets whether ROM memory area is RW or RO */
+
 #endif /* __HVMLOADER_CONFIG_H__ */
diff -BbuNr xen-unstable.hg-hvmop_set_mem/tools/firmware/hvmloader/hvmloader.c xen-unstable.hg-make_ROM_ro/tools/firmware/hvmloader/hvmloader.c
--- xen-unstable.hg-hvmop_set_mem/tools/firmware/hvmloader/hvmloader.c	2008-06-30 15:17:57.000000000 +0100
+++ xen-unstable.hg-make_ROM_ro/tools/firmware/hvmloader/hvmloader.c	2008-07-09 19:00:51.107854371 +0100
@@ -105,6 +105,8 @@
 
 static enum { VGA_none, VGA_std, VGA_cirrus } virtual_vga = VGA_none;
 
+static int xen_platform_io_base;
+
 static void
 init_hypercalls(void)
 {
@@ -149,6 +151,7 @@
     uint32_t base, devfn, bar_reg, bar_data, bar_sz, cmd;
     uint16_t class, vendor_id, device_id;
     unsigned int bar, pin, link, isa_irq;
+    uint32_t xen_pf_devfn = 0xff;
 
     /* Resources assignable to PCI devices via BARs. */
     struct resource {
@@ -213,6 +216,10 @@
                 pci_writew(devfn, 0x42, 0x8000); /* enable IDE1 */
             }
             break;
+        case 0xff80:
+            if ( (vendor_id == 0x5853) && (device_id == 0x0001) )
+                xen_pf_devfn = devfn;
+            break;
         }
 
         /* Map the I/O memory and port resources. */
@@ -284,6 +291,10 @@
         }
 
         base = (resource->base + bar_sz - 1) & ~(bar_sz - 1);
+        
+        if ( devfn == xen_pf_devfn && resource == &io_resource )
+            xen_platform_io_base = base;
+
         bar_data |= base;
         base += bar_sz;
 
@@ -434,10 +445,34 @@
     cmos_outb(0x35, (uint8_t)( alt_mem >> 8));
 }
 
+/*
+ * get_hvmpdio_addr - searchs through BIOS memory for '___HVMPDIO' signature
+ *
+ * The '___HVMMP' signature is created by the ROMBIOS and designates a 
+ * place inside the ROMBIOS to which we can write the base ioport address of
+ * the xen plaform device after it's been allocated by pci_setup
+ */
+void* get_hvmpdio_addr(void)
+{
+    char *bios_mem;
+
+    for ( bios_mem = (char *)ROMBIOS_BEGIN; 
+          bios_mem != (char *)ROMBIOS_END; 
+          bios_mem++ )
+    {
+        if ( strncmp(bios_mem, "___HVMPDIO", 10) == 0)
+            return bios_mem+10;
+    }
+
+    return NULL;
+}
+
+
 int main(void)
 {
     int acpi_sz = 0, vgabios_sz = 0, etherboot_sz = 0, rombios_sz, smbios_sz;
     int extboot_sz = 0;
+    uint16_t *rom_hvmpdio;
 
     printf("HVM Loader\n");
 
@@ -527,6 +562,13 @@
                ROMBIOS_PHYSICAL_ADDRESS,
                ROMBIOS_PHYSICAL_ADDRESS + rombios_sz - 1);
 
+    /* Tell rombios the platform device base io port so it can write-protect ROM once its done self-modifying */
+    rom_hvmpdio = get_hvmpdio_addr();    
+    if ( rom_hvmpdio == NULL )
+        printf("Unable to find __HVMPDIO address. Rombios out of date? \n");
+    else
+        *rom_hvmpdio = (uint16_t) xen_platform_io_base;
+
     printf("Invoking ROMBIOS ...\n");
     return 0;
 }
diff -BbuNr xen-unstable.hg-hvmop_set_mem/tools/firmware/rombios/rombios.c xen-unstable.hg-make_ROM_ro/tools/firmware/rombios/rombios.c
--- xen-unstable.hg-hvmop_set_mem/tools/firmware/rombios/rombios.c	2008-06-30 15:17:57.000000000 +0100
+++ xen-unstable.hg-make_ROM_ro/tools/firmware/rombios/rombios.c	2008-07-09 16:09:18.943054000 +0100
@@ -275,6 +275,26 @@
   mov ?1*4+2, ax
 MEND
 
+MACRO ROM_WRITE_ENABLE
+    push ds
+    mov ax,cs
+    mov ds,ax
+    mov ax,#0
+    mov dx,platform_device_base_ioport
+    out dx,al
+    pop ds
+MEND
+
+MACRO ROM_WRITE_DISABLE
+    push ds
+    mov ax,cs
+    mov ds,ax
+    mov ax,#1
+    mov dx,platform_device_base_ioport
+    out dx,al
+    pop ds
+MEND
+
 ASM_END
 
 typedef unsigned char  Bit8u;
@@ -10155,6 +10176,10 @@
   call tcpa_post_part2
 #endif
 
+#ifdef HVMASSIST
+  ROM_WRITE_DISABLE
+#endif 
+
   ;; Start the boot sequence.   See the comments in int19_relocated 
   ;; for why we use INT 18h instead of INT 19h here.
   int  #0x18
@@ -10955,6 +10980,11 @@
 dw 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 ;; 896 bytes
 
 .align 16
+db 0x5F, 0x5F, 0x5F, 0x48, 0x56, 0x4D, 0x50, 0x44, 0x49, 0x4F ;; ___HVMPDIO
+platform_device_base_ioport:
+dw 0xDEAD;
+
+.align 16
 smbios_entry_point:
 db 0,0,0,0,0,0,0,0 ; 8 bytes
 db 0,0,0,0,0,0,0,0 ; 16 bytes