[tboot-devel] RE : TXT and kvm : conflict ?

[Courtay O. <Oli...@th...>]

Hello,

my response bellow quoted by [OC]

-----Original Message-----
From: tbo...@li...
[mailto:tbo...@li...] On Behalf Of Courtay
Olivier
Sent: Wednesday, September 10, 2008 5:57 AM
To: tbo...@li...
Subject: [tboot-devel] TXT and kvm : conflict ?

Hello,

I have successfully installed tboot on a Dell Optiplex 755 (E8500).
VMM and dom0 verification is OK.

One question.
In TBOOT log I have:

TBOOT: dom0 is verified.
TBOOT: succeeded.
TBOOT: invalid module #

What is this invalid module ?

[JC]  Older versions of tboot displayed this during policy processing,
even though there was not an error.  What changeset are you using?

[OC] Ok, I use the tboot-20080613. I can provide log of my TBOOT if you want.

 
I have not yet tested sealed process.

[JC]  FYI, your TPM will need to have an owner and you should have
created the SRK with the null auth (use '-z' flag to tpm_takeownership).

[OC] Ok, I will test that.


I have a problem.
When Trusted Execution is deactivated on BIOS , kvm run normally.
But when I activate TXT, the module load failed (Error: Operation not
supported).
In the kernel log, I have :"kvm: disable by bios"

Is there a conflict between TXT and KVM?

[JC]  This is a security feature.  When you enabled both TXT and VT,
BIOS set the bit in the IA32_FEATURE_CONTROL MSR that means that VT can
only be used after a TXT launch has occurred.  This is to prevent
installation of malicious VT-based rootkits.  If you want to use VT w/o
doing a TXT launch, disable TXT in BIOS and leave VT enabled.

[OC] Ok, I will contact KVM to know if they will support TXT like XEN.
There is two part for this support:
- Intel => be able to launch KVM 
- KVM => not use the E820 unusable memory
That's right ?

Thank you
Olivier,