GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
coreboot-kgpe-d16/Documentation/security/intel/txt.md

118 lines
4.3 KiB
Markdown
Raw Normal View History

Documentation: Add Intel TXT Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-06-10 20:20:29 +02:00
# Intel Trusted Execution Technology
Intel TXT allows
1. Attestation of the authenticity of a platform and its operating system.
2. Assuring that an authentic operating system starts in a
trusted environment, which can then be considered trusted.
3. Providing of a trusted operating system with additional
security capabilities not available to an unproven one.
Intel TXT requirements:
1. Intel TXT requires a **TPM** to measure parts of the firmware before it's
run on the BSP.
2. Intel TXT requires signed **Authenticated Code Modules** ([ACM]s), provided
by Intel.
3. Intel TXT requires **CPU and Chipset** support (supported since
Intel Core 2 Duo/ICH9).
## Authenticated Code Modules
The ACMs are Intel digitally signed modules that contain code to be run
before the traditional x86 CPU reset vector.
More details can be found here: [Intel ACM].
## Modified bootflow with Intel TXT
With Intel TXT the first instruction executed on the BSP isn't the
*reset vector*, but the [Intel ACM].
It initializes the TPM and measures parts of the firmware, the IBB.
### Marking the Initial Boot Block
Individual files in the CBFS can be marked as IBB.
More details can be found in the [Intel TXT IBB] chapter.
### Measurements
The IBBs (Initial Boot Blocks) are measured into TPM's PCR0 by the BIOS [ACM]
Documentation: Fix spelling errors These issues were found and fixed by codespell, a useful tool for finding spelling errors. Signed-off-by: Martin Roth <martin@coreboot.org> Change-Id: If2a8e97911420c19e9365d5c28810b998f2c2ac8 Reviewed-on: https://review.coreboot.org/c/coreboot/+/58078 Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-10-01 22:10:19 +02:00
before the CPU reset vector is executed. To identify the regions that need
Documentation: Add Intel TXT Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-06-10 20:20:29 +02:00
to be measured, the [FIT] contains one ore multiple *Type 7* entries, that
point to the IBBs.
### Authentication
After the IBBs have been measured, the ACM decides if the boot firmware is
trusted. There exists two validation modes:
1. HASH Autopromotion
* Uses a known good HASH stored in TPM NVRAM
* Doesn't allow to boot a fallback IBB
2. Signed BIOS policy
* Uses a signed policy stored in flash containing multiple HASHes
* The public key HASH of BIOS policy is burned into TPM by manufacturer
* Can be updated by firmware
* Allows to boot a fallback IBB
At the moment only *Autopromotion mode* is implemented and tested well.
In the next step the ACM terminates and the regular x86 CPU reset vector
is being executed on the BSP.
### Protecting Secrets in Memory
Intel TXT sets the `Secrets in Memory` bit, whenever the launch of the SINIT
ACM was successful.
The bit is reset when leaving the *MLE* by a regular shutdown or by removing
the CMOS battery.
When `Secrets in Memory` bit is set and the IBB isn't trusted, the memory
controller won't be unlocked, resulting in a platform that cannot access DRAM.
When `Secrets in Memory` bit is set and the IBB is trusted, the memory
controller will be unlocked, and it's the responsibility of the firmware to
[clear all DRAM] and wipe any secrets of the MLE.
The platform will be reset after all DRAM has been wiped and will boot
with the `Secrets in Memory` bit cleared.
### Configuring protected regions for SINIT ACM
The memory regions used by the SINIT ACM need to be prepared and protected
against DMA attacks.
The SINIT ACM as well as the SINIT handoff data are placed in memory.
### Locking TXT register
As last step the TXT registers are locked.
Whenever the SINIT ACM is invoked, it verifies that the hardware is in the
correct state. If it's not the SINIT ACM will reset the platform.
## For developers
### Configuring Intel TXT in Kconfig
security/intel: Add TXT infrastructure * Add Kconfig to enable TXT * Add possibility to add BIOS and SINIT ACMs * Set default BIOS ACM alignment * Increase FIT space if TXT is enabled The following commits depend on the basic Kconfig infrastructure. Intel TXT isn't supported until all following commits are merged. Change-Id: I5f0f956d2b7ba43d4e7e0062803c6d8ba569a052 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/34585 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: David Hendricks <david.hendricks@gmail.com>
2019-07-25 11:55:30 +02:00
Enable ``INTEL_TXT`` and set the following:
Documentation: Add Intel TXT Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-06-10 20:20:29 +02:00
security/intel: Add TXT infrastructure * Add Kconfig to enable TXT * Add possibility to add BIOS and SINIT ACMs * Set default BIOS ACM alignment * Increase FIT space if TXT is enabled The following commits depend on the basic Kconfig infrastructure. Intel TXT isn't supported until all following commits are merged. Change-Id: I5f0f956d2b7ba43d4e7e0062803c6d8ba569a052 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/34585 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: David Hendricks <david.hendricks@gmail.com>
2019-07-25 11:55:30 +02:00
``INTEL_TXT_BIOSACM_FILE`` to the path of the BIOS ACM provided by Intel
Documentation: Add Intel TXT Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-06-10 20:20:29 +02:00
security/intel: Add TXT infrastructure * Add Kconfig to enable TXT * Add possibility to add BIOS and SINIT ACMs * Set default BIOS ACM alignment * Increase FIT space if TXT is enabled The following commits depend on the basic Kconfig infrastructure. Intel TXT isn't supported until all following commits are merged. Change-Id: I5f0f956d2b7ba43d4e7e0062803c6d8ba569a052 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/34585 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: David Hendricks <david.hendricks@gmail.com>
2019-07-25 11:55:30 +02:00
``INTEL_TXT_SINITACM_FILE`` to the path of the SINIT ACM provided by Intel
Documentation: Add Intel TXT Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-06-10 20:20:29 +02:00
### Print TXT status as early as possible
Add platform code to print the TXT status as early as possible, as the register
is cleared on cold reset.
## References
More information can be found here:
* [Intel TXT Software Development Guide]
* [Intel TXT enabling]
* [FIT]
* [Intel TXT Lab Handout]
[Intel TXT IBB]: txt_ibb.md
[FIT]: ../../soc/intel/fit.md
[Intel ACM]: acm.md
[ACM]: acm.md
[FIT table]: ../../soc/intel/fit.md
[clear all DRAM]: ../memory_clearing.md
[Intel TXT Lab Handout]: https://downloadmirror.intel.com/18931/eng/Intel%20TXT%20LAB%20Handout.pdf
[Intel TXT Software Development Guide]: https://www.intel.com/content/dam/www/public/us/en/documents/guides/intel-txt-software-development-guide.pdf
[Intel TXT enabling]: https://www.intel.com/content/dam/www/public/us/en/documents/guides/txt-enabling-guide.pdf