Sure.<p>TXT is Intel's chipset security system. Its best known application is to allow you to boot through a series of cryptographically signed steps, all of which are verified by a hardware module in the chipset. That is, among other things, a defense against rootkits.<p>Modern X86 chips also support hardware virtualization (these are the VT-* technologies). With TXT, you can securely boot into a hypervisor, which is locked into memory and can't be compromised by a generic OS running on the machine even from ring 0, even though the hypervisor is running in the same physical memory as the generic OS.<p>This process only works if neither generic kernel code nor unverified code running at boot can directly access physical memory, so VT-* makes sure to lock down DMA so that peripherals and chipset devices can't do that.<p>But DMA has gotten really complicated. For instance, AGP graphics had a special DMA feature called the GART, which remaps memory to AGP's convenience. There are a bunch more of these DMA remapping features now, and they all need to be accounted for, or else you can reconfigure memory out from under the hypervisor.<p>That's what this paper is about. The TXT/VT-* boot process attempts to account for all the DMA remapping devices. Trusted TXT code checks the PCI configuration to see what remapping features exist. There's a 64/32bit bug in that trusted code, which allows you to screw up a PCI configuration register and get TXT to miss one of the remapping devices. That gives you DMA access later on, and allows you to write directly to memory owned by a hypervisor.