Challenges and Status of Enabling TrenchBoot in Xen Hypervisor
summary
Progress enabling TrenchBoot in Xen produces a working DRTM path that boots Qubes OS Anti Evil Maid on Intel and AMD hardware with TPM 2.0 support; developers complete three project phases, update the TrenchBoot protocol and add Xen TPM libraries so Dom0 gets measured, and show a live DRTM demo unsealing secrets. Known failure mode: an early performance stall (likely MTRR restore stall) slows execution. UEFI boot-mode support and a TRenchBoot readiness test suite target late‑2024/early‑2025, with tested machines listed (Protact LV P4670, OptiPlex 7010/9010, HP 800 G2, HP T630).
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 1:05What is DRTM and its importance
- 4:44TrenchBoot project overview
- 7:18TrenchBoot vs Trusted Boot
- 9:28TrenchBoot demo with Cubes OS
- 15:41Current challenges and stall issue
- 16:02Progress since last year
- 19:15Hardware and testing platforms
- 21:00Work in progress and future plans
- 23:55UEFI boot mode support plans
- 26:05Linux kernel interface challenges
- 28:37Q&A session
related talks
37mTrenchBoot - How to Nicely Boot System with Intel TXT and AMD SVM
32mTrenchBoot Update
39mTowards Measured Boot Out of the Box
49mBreaking Hardware-Enforced Security With Hypervisors
20mReLaunch Revisited: A Refresher on TrenchBoot Late Launch
26mVirtual TPM based attestation for Intel Trust Domain Extensions
18mSecurely booting confidential VMs with encrypting disk
17mStatus Update on TDX Support