Documentation/arch/x86/intel_txt.rst

Source file repositories/reference/linux-study-clean/Documentation/arch/x86/intel_txt.rst

File Facts

System
Linux kernel
Corpus path
Documentation/arch/x86/intel_txt.rst
Extension
.rst
Size
10497 bytes
Lines
228
Domain
Support Tooling And Documentation
Bucket
Documentation
Inferred role
Support Tooling And Documentation: documentation
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

=====================
Intel(R) TXT Overview
=====================

Intel's technology for safer computing, Intel(R) Trusted Execution
Technology (Intel(R) TXT), defines platform-level enhancements that
provide the building blocks for creating trusted platforms.

Intel TXT was formerly known by the code name LaGrande Technology (LT).

Intel TXT in Brief:

-  Provides dynamic root of trust for measurement (DRTM)
-  Data protection in case of improper shutdown
-  Measurement and verification of launched environment

Intel TXT is part of the vPro(TM) brand and is also available some
non-vPro systems.  It is currently available on desktop systems
based on the Q35, X38, Q45, and Q43 Express chipsets (e.g. Dell
Optiplex 755, HP dc7800, etc.) and mobile systems based on the GM45,
PM45, and GS45 Express chipsets.

For more information, see http://www.intel.com/technology/security/.
This site also has a link to the Intel TXT MLE Developers Manual,
which has been updated for the new released platforms.

Intel TXT has been presented at various events over the past few
years, some of which are:

      - LinuxTAG 2008:
          http://www.linuxtag.org/2008/en/conf/events/vp-donnerstag.html

      - TRUST2008:
          http://www.trust-conference.eu/downloads/Keynote-Speakers/
          3_David-Grawrock_The-Front-Door-of-Trusted-Computing.pdf

      - IDF, Shanghai:
          http://www.prcidf.com.cn/index_en.html

      - IDFs 2006, 2007
	  (I'm not sure if/where they are online)

Trusted Boot Project Overview
=============================

Trusted Boot (tboot) is an open source, pre-kernel/VMM module that
uses Intel TXT to perform a measured and verified launch of an OS
kernel/VMM.

It is hosted on SourceForge at http://sourceforge.net/projects/tboot.
The mercurial source repo is available at http://www.bughost.org/
repos.hg/tboot.hg.

Tboot currently supports launching Xen (open source VMM/hypervisor
w/ TXT support since v3.2), and now Linux kernels.


Value Proposition for Linux or "Why should you care?"
=====================================================

While there are many products and technologies that attempt to
measure or protect the integrity of a running kernel, they all
assume the kernel is "good" to begin with.  The Integrity
Measurement Architecture (IMA) and Linux Integrity Module interface
are examples of such solutions.

To get trust in the initial kernel without using Intel TXT, a
static root of trust must be used.  This bases trust in BIOS
starting at system reset and requires measurement of all code
executed between system reset through the completion of the kernel

Annotation

Implementation Notes