Intel(R) TXT Overview | Linux 6.18.37

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약과 해설

intel_txt.rst:1-227

Intel TXT와 tboot은 `GETSEC[SENTER]`로 dynamic root of trust를 만들고 kernel/initrd를 policy에 따라 검증합니다. pre-launch component를 trust chain에서 줄이고 VT-d PMR, platform check, TPM-rooted policy로 initial state assurance를 높입니다.

kernel에는 `boot_params`의 shared page로 state를 전달하고, TXT launch 뒤 sleep에서는 tboot을 거쳐 environment를 종료합니다. S3 resume에서는 measured environment와 PCR을 복구하고 protected memory-range MAC을 검증합니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기

1 =====================

2 Intel(R) TXT Overview

3 =====================

5 Intel's technology for safer computing, Intel(R) Trusted Execution

6 Technology (Intel(R) TXT), defines platform-level enhancements that

7 provide the building blocks for creating trusted platforms.

9 Intel TXT was formerly known by the code name LaGrande Technology (LT).

11 Intel TXT in Brief:

13 - Provides dynamic root of trust for measurement (DRTM)

14 - Data protection in case of improper shutdown

15 - Measurement and verification of launched environment

17 Intel TXT is part of the vPro(TM) brand and is also available some

18 non-vPro systems. It is currently available on desktop systems

19 based on the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell

20 Optiplex 755, HP dc7800, etc.) and mobile systems based on the GM45,

21 PM45, and GS45 Express chipsets.

23 For more information, see http://www.intel.com/technology/security/.

24 This site also has a link to the Intel TXT MLE Developers Manual,

25 which has been updated for the new released platforms.

27 Intel TXT has been presented at various events over the past few

28 years, some of which are:

30 - LinuxTAG 2008:

31 http://www.linuxtag.org/2008/en/conf/events/vp-donnerstag.html

33 - TRUST2008:

34 http://www.trust-conference.eu/downloads/Keynote-Speakers/

35 3_David-Grawrock_The-Front-Door-of-Trusted-Computing.pdf

37 - IDF, Shanghai:

38 http://www.prcidf.com.cn/index_en.html

40 - IDFs 2006, 2007

41 (I'm not sure if/where they are online)

43 Trusted Boot Project Overview

44 =============================

46 Trusted Boot (tboot) is an open source, pre-kernel/VMM module that

47 uses Intel TXT to perform a measured and verified launch of an OS

48 kernel/VMM.

50 It is hosted on SourceForge at http://sourceforge.net/projects/tboot.

51 The mercurial source repo is available at http://www.bughost.org/

52 repos.hg/tboot.hg.

54 Tboot currently supports launching Xen (open source VMM/hypervisor

55 w/ TXT support since v3.2), and now Linux kernels.

58 Value Proposition for Linux or "Why should you care?"

59 =====================================================

61 While there are many products and technologies that attempt to

62 measure or protect the integrity of a running kernel, they all

63 assume the kernel is "good" to begin with. The Integrity

64 Measurement Architecture (IMA) and Linux Integrity Module interface

65 are examples of such solutions.

67 To get trust in the initial kernel without using Intel TXT, a

68 static root of trust must be used. This bases trust in BIOS

69 starting at system reset and requires measurement of all code

70 executed between system reset through the completion of the kernel

71 boot as well as data objects used by that code. In the case of a

72 Linux kernel, this means all of BIOS, any option ROMs, the

73 bootloader and the boot config. In practice, this is a lot of

74 code/data, much of which is subject to change from boot to boot

75 (e.g. changing NICs may change option ROMs). Without reference

76 hashes, these measurement changes are difficult to assess or

77 confirm as benign. This process also does not provide DMA

78 protection, memory configuration/alias checks and locks, crash

79 protection, or policy support.

81 By using the hardware-based root of trust that Intel TXT provides,

82 many of these issues can be mitigated. Specifically: many

83 pre-launch components can be removed from the trust chain, DMA

84 protection is provided to all launched components, a large number

85 of platform configuration checks are performed and values locked,

86 protection is provided for any data in the event of an improper

87 shutdown, and there is support for policy-based execution/verification.

88 This provides a more stable measurement and a higher assurance of

89 system configuration and initial state than would be otherwise

90 possible. Since the tboot project is open source, source code for

91 almost all parts of the trust chain is available (excepting SMM and

92 Intel-provided firmware).

94 How Does it Work?

95 =================

97 - Tboot is an executable that is launched by the bootloader as

98 the "kernel" (the binary the bootloader executes).

99 - It performs all of the work necessary to determine if the

100 platform supports Intel TXT and, if so, executes the GETSEC[SENTER]

101 processor instruction that initiates the dynamic root of trust.

102

103 - If tboot determines that the system does not support Intel TXT

104 or is not configured correctly (e.g. the SINIT AC Module was

105 incorrect), it will directly launch the kernel with no changes

106 to any state.

107 - Tboot will output various information about its progress to the

108 terminal, serial port, and/or an in-memory log; the output

109 locations can be configured with a command line switch.

110

111 - The GETSEC[SENTER] instruction will return control to tboot and

112 tboot then verifies certain aspects of the environment (e.g. TPM NV

113 lock, e820 table does not have invalid entries, etc.).

114 - It will wake the APs from the special sleep state the GETSEC[SENTER]

115 instruction had put them in and place them into a wait-for-SIPI

116 state.

117

118 - Because the processors will not respond to an INIT or SIPI when

119 in the TXT environment, it is necessary to create a small VT-x

120 guest for the APs. When they run in this guest, they will

121 simply wait for the INIT-SIPI-SIPI sequence, which will cause

122 VMEXITs, and then disable VT and jump to the SIPI vector. This

123 approach seemed like a better choice than having to insert

124 special code into the kernel's MP wakeup sequence.

125

126 - Tboot then applies an (optional) user-defined launch policy to

127 verify the kernel and initrd.

128

129 - This policy is rooted in TPM NV and is described in the tboot

130 project. The tboot project also contains code for tools to

131 create and provision the policy.

132 - Policies are completely under user control and if not present

133 then any kernel will be launched.

134 - Policy action is flexible and can include halting on failures

135 or simply logging them and continuing.

136

137 - Tboot adjusts the e820 table provided by the bootloader to reserve

138 its own location in memory as well as to reserve certain other

139 TXT-related regions.

140 - As part of its launch, tboot DMA protects all of RAM (using the

141 VT-d PMRs). Thus, the kernel must be booted with 'intel_iommu=on'

142 in order to remove this blanket protection and use VT-d's

143 page-level protection.

144 - Tboot will populate a shared page with some data about itself and

145 pass this to the Linux kernel as it transfers control.

146

147 - The location of the shared page is passed via the boot_params

148 struct as a physical address.

149

150 - The kernel will look for the tboot shared page address and, if it

151 exists, map it.

152 - As one of the checks/protections provided by TXT, it makes a copy

153 of the VT-d DMARs in a DMA-protected region of memory and verifies

154 them for correctness. The VT-d code will detect if the kernel was

155 launched with tboot and use this copy instead of the one in the

156 ACPI table.

157 - At this point, tboot and TXT are out of the picture until a

158 shutdown (S<n>)

159 - In order to put a system into any of the sleep states after a TXT

160 launch, TXT must first be exited. This is to prevent attacks that

161 attempt to crash the system to gain control on reboot and steal

162 data left in memory.

163

164 - The kernel will perform all of its sleep preparation and

165 populate the shared page with the ACPI data needed to put the

166 platform in the desired sleep state.

167 - Then the kernel jumps into tboot via the vector specified in the

168 shared page.

169 - Tboot will clean up the environment and disable TXT, then use the

170 kernel-provided ACPI information to actually place the platform

171 into the desired sleep state.

172 - In the case of S3, tboot will also register itself as the resume

173 vector. This is necessary because it must re-establish the

174 measured environment upon resume. Once the TXT environment

175 has been restored, it will restore the TPM PCRs and then

176 transfer control back to the kernel's S3 resume vector.

177 In order to preserve system integrity across S3, the kernel

178 provides tboot with a set of memory ranges (RAM and RESERVED_KERN

179 in the e820 table, but not any memory that BIOS might alter over

180 the S3 transition) that tboot will calculate a MAC (message

181 authentication code) over and then seal with the TPM. On resume

182 and once the measured environment has been re-established, tboot

183 will re-calculate the MAC and verify it against the sealed value.

184 Tboot's policy determines what happens if the verification fails.

185 Note that the c/s 194 of tboot which has the new MAC code supports

186 this.

187

188 That's pretty much it for TXT support.

189

190

191 Configuring the System

192 ======================

193

194 This code works with 32bit, 32bit PAE, and 64bit (x86_64) kernels.

195

196 In BIOS, the user must enable: TPM, TXT, VT-x, VT-d. Not all BIOSes

197 allow these to be individually enabled/disabled and the screens in

198 which to find them are BIOS-specific.

199

200 grub.conf needs to be modified as follows::

201

202 title Linux 2.6.29-tip w/ tboot

203 root (hd0,0)

204 kernel /tboot.gz logging=serial,vga,memory

205 module /vmlinuz-2.6.29-tip intel_iommu=on ro

206 root=LABEL=/ rhgb console=ttyS0,115200 3

207 module /initrd-2.6.29-tip.img

208 module /Q35_SINIT_17.BIN

209

210 The kernel option for enabling Intel TXT support is found under the

211 Security top-level menu and is called "Enable Intel(R) Trusted

212 Execution Technology (TXT)". It is considered EXPERIMENTAL and

213 depends on the generic x86 support (to allow maximum flexibility in

214 kernel build options), since the tboot code will detect whether the

215 platform actually supports Intel TXT and thus whether any of the

216 kernel code is executed.

217

218 The Q35_SINIT_17.BIN file is what Intel TXT refers to as an

219 Authenticated Code Module. It is specific to the chipset in the

220 system and can also be found on the Trusted Boot site. It is an

221 (unencrypted) module signed by Intel that is used as part of the

222 DRTM process to verify and configure the system. It is signed

223 because it operates at a higher privilege level in the system than

224 any other macrocode and its correct operation is critical to the

225 establishment of the DRTM. The process for determining the correct

226 SINIT ACM for a system is documented in the SINIT-guide.txt file

227 that is on the tboot SourceForge site under the SINIT ACM downloads.

228

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

Intel TXT 개요와 공개 자료

1-42

Intel Trusted Execution Technology(Intel(R) TXT)는 trusted platform을 만들기 위한 building block을 제공하는 platform-level enhancement입니다. 이전 code name은 LaGrande Technology(LT)였습니다.

Intel TXT의 핵심 기능은 다음과 같습니다.

measurement를 위한 Dynamic Root of Trust(DRTM)를 제공합니다.
improper shutdown이 발생했을 때 data를 보호합니다.
launch된 environment를 measure하고 verify합니다.

Intel TXT는 vPro brand의 일부이며 일부 non-vPro system에도 제공됩니다. 문서 작성 시점 기준 desktop은 Q35, X38, Q45, Q43 Express chipset, 예를 들어 Dell Optiplex 755와 HP dc7800에서 사용할 수 있고 mobile은 GM45, PM45, GS45 Express chipset을 지원합니다.

추가 정보와 최신 Intel TXT MLE Developers Manual은 `http://www.intel.com/technology/security/`에서 확인합니다.

event	자료
LinuxTAG 2008	`http://www.linuxtag.org/2008/en/conf/events/vp-donnerstag.html`
TRUST2008	`http://www.trust-conference.eu/downloads/Keynote-Speakers/3_David-Grawrock_The-Front-Door-of-Trusted-Computing.pdf`
IDF Shanghai	`http://www.prcidf.com.cn/index_en.html`
IDF 2006, 2007	원문 저자는 online 위치를 확신하지 못한다고 밝힙니다.

Trusted Boot project

43-57

Trusted Boot(tboot)은 Intel TXT로 OS kernel/VMM을 measured·verified launch하는 open-source pre-kernel/VMM module입니다.

project는 `http://sourceforge.net/projects/tboot`에 있고 Mercurial source repository는 `http://www.bughost.org/repos.hg/tboot.hg`에 있습니다.

tboot은 TXT를 v3.2부터 지원하는 open-source VMM/hypervisor Xen과 Linux kernel launch를 지원합니다.

static trust chain 대비 가치

58-93

running kernel integrity를 measure하거나 보호하는 많은 기술은 initial kernel이 처음부터 정상이라고 가정합니다. Integrity Measurement Architecture(IMA)와 Linux Integrity Module interface가 그런 예입니다.

Intel TXT 없이 initial kernel을 trust하려면 static root of trust를 사용해야 합니다. system reset 시점의 BIOS부터 kernel boot 완료까지 실행되는 모든 code와 그 code가 사용하는 data object를 measure해야 합니다. Linux에서는 BIOS 전체, option ROM, boot loader, boot configuration이 포함됩니다.

이 trust chain은 code/data 양이 많고 NIC 교체로 option ROM이 바뀌는 것처럼 boot마다 달라질 수 있습니다. reference hash가 없으면 measurement 변화가 benign한지 판단하기 어렵습니다. 또한 static 과정은 DMA protection, memory configuration/alias check와 lock, crash protection, policy support를 제공하지 않습니다.

Intel TXT의 hardware-based root of trust는 pre-launch component 다수를 trust chain에서 제거하고 launch component 전체에 DMA protection을 제공합니다. platform configuration을 광범위하게 검사해 값을 lock하고 improper shutdown의 data를 보호하며 policy-based execution/verification을 지원합니다.

따라서 measurement가 더 stable하고 system configuration 및 initial state에 대한 assurance가 높아집니다. tboot은 open source이므로 SMM과 Intel-provided firmware를 제외한 trust-chain 거의 전부의 source를 확인할 수 있습니다.

GETSEC[SENTER] launch와 AP wakeup

94-125

boot loader는 tboot executable을 `kernel`, 즉 loader가 실행할 binary로 launch합니다. tboot은 platform이 Intel TXT를 지원하는지 확인하고 지원하면 dynamic root of trust를 시작하는 `GETSEC[SENTER]` processor instruction을 실행합니다.

platform이 Intel TXT를 지원하지 않거나 SINIT AC Module 오류처럼 configuration이 잘못되면 tboot은 state를 바꾸지 않고 kernel을 직접 launch합니다.

tboot 진행 정보는 terminal, serial port, in-memory log 중 하나 이상으로 출력되며 command-line switch로 위치를 구성합니다. `GETSEC[SENTER]`가 tboot으로 return하면 TPM NV lock, invalid entry가 없는 e820 table 등 environment 요소를 검증합니다.

`GETSEC[SENTER]`가 special sleep state에 둔 AP를 깨워 wait-for-SIPI 상태로 전환합니다. TXT environment의 processor는 INIT 또는 SIPI에 응답하지 않으므로 AP용 작은 VT-x guest를 만듭니다.

AP는 guest 안에서 INIT-SIPI-SIPI sequence를 기다리고 각 event로 VMEXIT한 뒤 VT를 disable하고 SIPI vector로 jump합니다. 이는 kernel MP wakeup sequence에 special code를 넣는 것보다 나은 선택으로 판단됐습니다.

launch policy, e820, DMA와 shared page

126-156

tboot은 optional user-defined launch policy로 kernel과 initrd를 verify합니다. policy는 TPM NV에 root를 두며 tboot project 문서에 정의됩니다. project에는 policy 생성과 provisioning tool code도 있습니다.

policy는 완전히 user control 아래 있고 없으면 어떤 kernel도 launch합니다. failure에서 halt하거나 log만 남기고 계속하는 등 action도 유연합니다.

tboot은 boot loader의 e820 table을 조정해 자신의 memory location과 TXT-related region을 reserve합니다. launch 과정에서 VT-d Protected Memory Region(PMR)을 사용해 RAM 전체를 DMA-protect합니다.

blanket DMA protection을 제거하고 VT-d page-level protection을 사용하려면 kernel을 `intel_iommu=on`으로 boot해야 합니다.

tboot은 자신에 관한 data를 shared page에 채워 control transfer 때 Linux kernel에 넘깁니다. physical address는 `boot_params` struct로 전달됩니다. kernel은 address가 있으면 shared page를 map합니다.

TXT check의 하나로 tboot은 VT-d DMAR copy를 DMA-protected memory에 만들고 correctness를 검증합니다. VT-d code는 tboot launch를 detect하면 ACPI table의 DMAR 대신 이 protected copy를 사용합니다.

TXT exit, S3 resume와 memory MAC

157-190

이후 shutdown 또는 sleep state `S<n>`까지 tboot과 TXT는 관여하지 않습니다. TXT launch 뒤 sleep state로 들어가려면 먼저 TXT를 exit해야 합니다. crash를 유도해 reboot control을 얻고 memory에 남은 data를 훔치는 attack을 막기 위해서입니다.

kernel은 sleep 준비를 마치고 원하는 ACPI sleep state에 필요한 data를 shared page에 채운 뒤 그 page의 vector를 통해 tboot으로 jump합니다. tboot은 environment를 clean up하고 TXT를 disable한 다음 kernel이 제공한 ACPI information으로 platform을 sleep state에 넣습니다.

S3에서는 tboot 자신을 resume vector로 등록해야 합니다. resume 때 measured environment를 다시 세우고 TPM PCRs를 restore한 뒤 kernel의 S3 resume vector로 control을 돌려줍니다.

S3 전후 system integrity를 유지하기 위해 kernel은 e820의 RAM과 `RESERVED_KERN` range 중 BIOS가 transition 동안 바꿀 수 있는 memory를 제외한 range set을 tboot에 제공합니다. tboot은 range 전체의 MAC(message authentication code)을 계산해 TPM으로 seal합니다.

resume에서 measured environment를 복구한 뒤 MAC을 다시 계산해 sealed value와 비교합니다. verification failure의 action은 tboot policy가 정합니다. 원문은 새 MAC code가 있는 tboot changeset 194가 이를 지원한다고 명시합니다.

BIOS, grub와 SINIT ACM 구성

191-227

이 code는 32-bit, 32-bit PAE, 64-bit(x86_64) kernel에서 동작합니다. BIOS에서 TPM, TXT, VT-x, VT-d를 enable해야 합니다. BIOS에 따라 각각을 따로 제어하지 못할 수 있고 menu 위치도 다릅니다.

`grub.conf` 구성 예시는 다음과 같습니다.

title Linux 2.6.29-tip w/ tboot
  root (hd0,0)
        kernel /tboot.gz logging=serial,vga,memory
        module /vmlinuz-2.6.29-tip intel_iommu=on ro
               root=LABEL=/ rhgb console=ttyS0,115200 3
        module /initrd-2.6.29-tip.img
        module /Q35_SINIT_17.BIN

Intel TXT kernel option은 Security top-level menu의 `Enable Intel(R) Trusted Execution Technology (TXT)`입니다. EXPERIMENTAL이며 kernel build flexibility를 위해 generic x86 support에 의존합니다. tboot이 platform support를 detect하므로 해당 kernel code를 실제로 실행할지도 runtime에 결정됩니다.

`Q35_SINIT_17.BIN`은 Intel TXT의 Authenticated Code Module(ACM)이며 system chipset-specific합니다. Trusted Boot site에서 받을 수 있는 Intel-signed unencrypted module이고 DRTM 과정에서 system을 verify·configure합니다.

다른 microcode보다 높은 privilege level에서 실행되고 올바른 동작이 DRTM 수립에 결정적이므로 Intel signature가 필요합니다. system에 맞는 SINIT ACM 선택 절차는 tboot SourceForge의 SINIT ACM download 아래 `SINIT-guide.txt`에 있습니다.