\HeadingLevelB{Intel's Trusted Execution Technology (TXT)}
\label{sec:sgx_related_intel_txt}

Intel's Trusted Execution Technology (TXT) \citep{grawrock2009txt} uses the
TPM's software attestation model and auxiliary tamper-resistant chip, but
reduces the software inside the secure container to a virtual machine (guest
operating system and application) hosted by the CPU's hardware virtualization
features (VMX \citep{uhlig2005vmx}).

TXT isolates the software inside the container from untrusted software by
ensuring that the container has exclusive control over the entire computer
while it is active. This is accomplished by a secure initialization
authenticated code module (SINIT ACM) that effectively performs a warm system
reset before starting the container's VM.

TXT requires a TPM module with an extended register set. The registers used by
the measured boot process described in \S~\ref{sec:sgx_related_tpm} are
considered to make up the platform's Static Root of Trust Measurement (SRTM).
When a TXT VM is initialized, it updates TPM registers that make up the Dynamic
Root of Trust Measurement (DRTM). While the TPM's SRTM registers only reset at
the start of a boot cycle, the DRTM registers are reset by the SINIT ACM, every
time a TXT VM is launched.

TXT does not implement DRAM encryption or HMACs, and therefore is vulnerable to
physical DRAM attacks, just like TPM-based designs. Furthermore, early TXT
implementations were vulnerable to attacks where a malicious operating system
would program a device, such as a network card, to perform DMA transfers
to the DRAM region used by a TXT container \citep{wojtczuk2009txt,
wojtczuk2009txt2}. In recent Intel CPUs, the memory controller is integrated on
the CPU die, so the SINIT ACM can securely set up the memory controller to
reject DMA transfers targeting TXT memory. An Intel chipset
datasheet~\citep{intel2015datasheet} documents an ``Intel TXT DMA Protected
Range'' IIO configuration register.

Early TXT implementations did not measure the SINIT ACM. Instead, the microcode
implementing the TXT launch instruction verified that the code module contained
an RSA signature by a hard-coded Intel key. SINIT ACM signatures cannot be
revoked if vulnerabilities are found, so TXT's software attestation had to be
revised when SINIT ACM exploits \citep{wojtczuk2011txt} surfaced. Currently, the
SINIT ACM's cryptographic hash is included in the attestation measurement.

Last, the warm reset performed by the SINIT ACM does not include the software
running in System Management Mode (SMM). SMM was designed solely for use by
firmware, and is stored in a protected memory area (SMRAM) which should not be
accessible to non-SMM software. However, the SMM handler was compromised on
multiple occasions \citep{duflot2006smm, rutkowska2008remap, wojtczuk2009smm,
wecherowski2009smm, embleton2010smm}, and an attacker who obtains SMM execution
can access the memory used by TXT's container.
