(Source: A Practical Guide to TPM 2.0 (link.springer.com/book/10…2-6584-9)) The main role of Trusted Boot was to prepare a platform to be launched with Intel TXT (Intel’s DRTM technology) in an operating system agnostic way. It has been achieved by loading a tboot kernel with Multiboot protocol and the other system components as the modules. That way, TBOOT is the main kernel that starts first and prepares the platform for TXT launch. When the platform is ready, then tboot performs the TXT launch. The control is passed to SINIT Authenticated Code Module (ACM), a binary signed and provided by Intel designed for DRTM technology. SINIT ACM uses TXT to measure the operating system components in a secure manner. Then the control is handed back to the tboot kernel, which checks if the operation was successful and boots the target operating system. Although the tboot tried to be as OS agnostic as possible, some tboot presence awareness from the operating system is needed because the application processor cores (all cores except the main one) are left in a special state after TXT launch and cannot be woken up like in traditional boot process. To solve this problem, tboot installs a special processor wakeup procedure in the memory, which OS must call into to start the processor cores. Only then OS may initialize the processor per its own requirements. As one can see, the process is complex in the case of Intel TXT. Migration of all tboot responsibilities was not trivial and has been divided into the work on both GRUB and Xen Hypervisor side of Qubes OS. GRUB modifications