-
Notifications
You must be signed in to change notification settings - Fork 1
Open
Labels
Stage 1Related to the loader (stage 1)Related to the loader (stage 1)Stage 2Related to the monitor (stage 2)Related to the monitor (stage 2)x86_64Specific to x86_64Specific to x86_64
Description
What/Why?
To enable trusted boot with Intel TXT, we must go through an ACM module that will setup the trusted environement. TXT is not available in QEMU, so we will need to emulate it if we want to keep the same control flow in both QEMU and on real hardware.
How?
- Create a dummy
fake-acmmodule that can be compiled as a standalone binary, like stage 1 or stage 2 - Setup headers for the fake-acm and stage 2 (probably handled by stage 1?)
- Enable emulation of GETSEC[SENTER], might require emulating a few registers
- Jump into fake-acm, and from there to stage 2 based on headers
At this point, the control flows are identical, but the machine states are different. The next steps are to reproduce the expected environment.
- Properly setup stage 2 page tables (e.g. respect TXT constraints)
- Deactivate paging within face-acm
Metadata
Metadata
Assignees
Labels
Stage 1Related to the loader (stage 1)Related to the loader (stage 1)Stage 2Related to the monitor (stage 2)Related to the monitor (stage 2)x86_64Specific to x86_64Specific to x86_64