** Description changed:
[Impact]
- Enable DRTM (Dynamic Root of Trust for Measurement) on the linux-nvidia
kernel, giving Grace-based
- platforms hardware-measured boot-integrity
- attestation. Adds:
+ Enable DRTM (Dynamic Root of Trust for Measurement) on the linux-nvidia
kernel,
+ giving Grace-based platforms hardware-measured boot-integrity attestation.
Adds:
- ARM64 Secure Launch (DRTM): on `drtm=on` the kernel (as DLME) requests a
dynamic launch, measures ACPI/DTB/cmdline/initrd into the TPM (PCR 18),
validates the EFI systab/memory map, asserts SMMU DMA protection, and
disables
EFI runtime services.
- - Trusted KASLR: under launch, the linear-map and kernel-image KASLR are
seeded
- from the firmware TRNG (`TRNG_RND64`) instead of the attacker-visible FDT
seed.
- FIRME attestation driver (`nvidia_firme`): TSM report + measurement-register
backends (configfs/sysfs).
[Test Plan]
On DRTM-capable Grace/GB200 (TF-A/EL3 Secure Launch service + TPM):
- - Boot `drtm=on` and confirm the launch engaged: `dmesg | grep -i slaunch`
- shows `DRTM Secure Launch detected`, the ACPI/DTB/cmdline/initrd measurement
- chain, and `SMMU DMA protection verified`; `modprobe nvidia_firme` loads.
- - Boot without `drtm=on` → boots via the standard EFI stub (feature inert when
- not requested).
+ 1. Boot `drtm=on` and confirm the launch engaged: `dmesg | grep -i slaunch`
+ shows `DRTM Secure Launch detected`, the ACPI/DTB/cmdline/initrd
measurement
+ chain, and `SMMU DMA protection verified`; `modprobe nvidia_firme` loads.
+ 2. Boot without `drtm=on` → boots via the standard EFI stub (feature inert
when
+ not requested).
- Validated on Grace/GB200/GB300.
+ Validated on Grace/GB200/GB300
[Where problems could occur]
- - The Secure Launch code is gated behind the `drtm=on` command-line
parameter, so
- without it the kernel behaves as before. The configuration changes it
requires,
- though, apply to every arm64 build.
-
- - Trusted KASLR requires disabling memory hotplug (`MEMORY_HOTPLUG=n`), which
also
- disables the features built on it: ZONE_DEVICE, DAX and NVDIMM, HMM device
- memory, GPU shared virtual memory, PCI peer-to-peer DMA, VFIO DMABUF and
- virtio-mem. This is an intentional trade-off, limited to arm64; amd64 keeps
- memory hotplug.
-
- - The image also ships uncompressed (`EFI_ZBOOT=n`), adding about 48 MB to
`/boot`
- and the package per flavour, because GRUB on Grace can't load the
compressed one.
+ The Secure Launch code is gated behind the `drtm=on` command-line parameter,
so
+ without it the kernel behaves as before. The one change that applies to every
+ arm64 build regardless is the kernel image: it ships uncompressed
+ (`EFI_ZBOOT=n`), adding about 48 MB to `/boot` and the package per flavour.
[Other Info]
+
+ The trusted-KASLR patches (`ARM64_SECURE_LAUNCH_KASLR`) are included in the
+ series but left disabled: enabling them requires `MEMORY_HOTPLUG=n`, which is
+ incompatible with the coherent-memory and GPUDirect features on GB200/GB300.
+ Enabling the kernel-image KASLR without disabling hotplug needs a config split
+ (the image and linear-map variants currently share one Kconfig symbol) and is
+ deferred to a follow-up.
References:
- Arm DRTM Architecture (DEN0113) — dynamic-launch/DLME interface this
implements: https://developer.arm.com/documentation/den0113/latest/
- - Arm TRNG Firmware Interface (DEN0098) — SMCCC `TRNG_RND64`, trusted-entropy
- source for KASLR: https://developer.arm.com/documentation/den0098/latest/
+ - Arm TRNG Firmware Interface (DEN0098) — SMCCC `TRNG_RND64`, used by the
+ trusted-KASLR patches:
https://developer.arm.com/documentation/den0098/latest/
- Trusted Firmware-A DRTM service — firmware side that performs the launch:
https://trustedfirmware-a.readthedocs.io/en/latest/design_documents/drtm_poc.html
- ARM64 Secure Launch upstreaming (LPC 2024, TrenchBoot):
https://lpc.events/event/18/contributions/1814/attachments/1482/3132/arm_securelaunch_lpc_2024.pdf
** Description changed:
[Impact]
Enable DRTM (Dynamic Root of Trust for Measurement) on the linux-nvidia
kernel,
giving Grace-based platforms hardware-measured boot-integrity attestation.
Adds:
- ARM64 Secure Launch (DRTM): on `drtm=on` the kernel (as DLME) requests a
dynamic launch, measures ACPI/DTB/cmdline/initrd into the TPM (PCR 18),
validates the EFI systab/memory map, asserts SMMU DMA protection, and
disables
EFI runtime services.
- FIRME attestation driver (`nvidia_firme`): TSM report + measurement-register
backends (configfs/sysfs).
[Test Plan]
On DRTM-capable Grace/GB200 (TF-A/EL3 Secure Launch service + TPM):
1. Boot `drtm=on` and confirm the launch engaged: `dmesg | grep -i slaunch`
shows `DRTM Secure Launch detected`, the ACPI/DTB/cmdline/initrd
measurement
chain, and `SMMU DMA protection verified`; `modprobe nvidia_firme` loads.
2. Boot without `drtm=on` → boots via the standard EFI stub (feature inert
when
not requested).
Validated on Grace/GB200/GB300
[Where problems could occur]
The Secure Launch code is gated behind the `drtm=on` command-line parameter,
so
without it the kernel behaves as before. The one change that applies to every
arm64 build regardless is the kernel image: it ships uncompressed
(`EFI_ZBOOT=n`), adding about 48 MB to `/boot` and the package per flavour.
[Other Info]
The trusted-KASLR patches (`ARM64_SECURE_LAUNCH_KASLR`) are included in the
- series but left disabled: enabling them requires `MEMORY_HOTPLUG=n`, which is
- incompatible with the coherent-memory and GPUDirect features on GB200/GB300.
- Enabling the kernel-image KASLR without disabling hotplug needs a config split
- (the image and linear-map variants currently share one Kconfig symbol) and is
- deferred to a follow-up.
+ series but left disabled: enabling them requires `MEMORY_HOTPLUG=n`.
References:
- Arm DRTM Architecture (DEN0113) — dynamic-launch/DLME interface this
implements: https://developer.arm.com/documentation/den0113/latest/
- Arm TRNG Firmware Interface (DEN0098) — SMCCC `TRNG_RND64`, used by the
trusted-KASLR patches:
https://developer.arm.com/documentation/den0098/latest/
- Trusted Firmware-A DRTM service — firmware side that performs the launch:
https://trustedfirmware-a.readthedocs.io/en/latest/design_documents/drtm_poc.html
- ARM64 Secure Launch upstreaming (LPC 2024, TrenchBoot):
https://lpc.events/event/18/contributions/1814/attachments/1482/3132/arm_securelaunch_lpc_2024.pdf
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161563
Title:
Enable ARM64 Secure Launch (DRTM)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-nvidia/+bug/2161563/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
