<commit_before>Instructions for building and installing TBOOT for DRTM Boot
============================================================


Trousers and trousers-devel packages must already be installed in order 
to build lcptools.

Tboot requires an ACM Module that sets up the machine for TXT.
The appropriate SINIT Module can be downloaded from the 
http://sourceforge.net/projects/tboot/files/.
The current version of tboot requires version 17 or greater of the SINIT 
module.  A copy of the module we used is in this distribution.


----------------------------------------------------------------------------


Building Tboot
    cd tbootprep/tboot-1.7.0
    make
    make install

To build the LCPTools
    cd lcptools
    make


----------------------------------------------------------------------------


Now you must built a Launch Control Policy (LCP) which controls what can be
booted.  The LCP consists of policy elements.

Create an MLE element:
1.  lcp_mlehash -c "the command line for tboot from grub.conf" /boot/tboot.gz
    > mle_hash
2.  lcp_crtpolelt --create --type mle --ctrl 0x00 --minver 17 --out mle.elt
    mle_hash

Create a PCONF element:
1.  cat /sys/devices/platform/tpm_tis/pcrs |grep -e PCR-00 -e PCR-01 > pcrs
2.  lcp_crtpolelt --create --type pconf --out pconf.elt pcrs

Create an SBIOS element:
1.  Create hash file containing BIOS hash(es), e.g. named sbios_hash
2.  lcp_crtpolelt --create --type sbios --out sbios.elt sbios_hash

Create a CUSTOM element:
1.  Create or determine the UUID that will identify this data format (e.g.
    using 'uuidgen')
2.  Create the data the will be placed in this element.  E.g. the policy file
    from tb_polgen.
3.  lcp_crtpolelt --create --type custom --out custom.elt --uuid <uuid value>
    <data file>

Create policy list(s):
1.  lcp_crtpollist --create --out list_unsig.lst mle.elt pconf.elt

Note:  I dont think you need to sign the list. If not, you can remove the
indented directions.

    Use lcp_crtpollist to sign the list:
    1.  openssl genrsa -out privkey.pem 2048
    2.  openssl rsa -pubout -in privkey.pem -out pubkey.pem
    3.  cp list_unsig.lst list_sig.lst
    4.  lcp_crtpollist --sign --pub pubkey.pem --priv privkey.pem --out list_sig.lst

    Use openssl to sign the list:
    1.  openssl rsa -pubout -in privkey.pem -out pubkey.pem
    2.  cp list_unsig.lst list_sig.lst
    3.  lcp_crtpollist --sign --pub pubkey.pem --nosig --out list_sig.lst
    4.  openssl genrsa -out privkey.pem 2048
    5.  openssl dgst -sha1 -sign privkey.pem -out list.sig list_sig.lst
    6.  lcp_crtpollist --addsig --sig list.sig --out list_sig.lst

Create policy and policy data files:
1.  lcp_crtpol2 --create --type list --pol list.pol --data list.data
    list_{unsig,sig}.lst

Create Verified Launch policy:
1.  tb_polgen/tb_polgen --create --type nonfatal vl.pol
2.  tb_polgen/tb_polgen --add --num 0 --pcr none --hash image
    --cmdline "the command line for xen from grub.conf"
    --image /boot/xen.gz
    vl.pol
3.  tb_polgen/tb_polgen --add --num 1 --pcr 19 --hash image
    --cmdline "the command line for dom0 from grub.conf"
    --image /boot/vmlinuz-2.6.18.8-xen
    vl.pol
4.  tb_polgen/tb_polgen --add --num 2 --pcr 19 --hash image
    --cmdline ""
    --image /boot/initrd-2.6.18.8-xen.img
    vl.pol

Define tboot error TPM NV index:
1.  lcptools/tpmnv_defindex -i 0x20000002 -s 8 -pv 0 -rl 0x07 -wl 0x07
    -p TPM-password

Define LCP and Verified Launch policy indices:
1.  lcptools/tpmnv_defindex -i owner -s 0x36 -p TPM-owner-password
2.  lcptools/tpmnv_defindex -i 0x20000001 -s 256 -pv 0x02 -p TPM-owner-password

Write LCP and Verified Launch policies to TPM:
(modprobe tpm_tis; tcsd;)
1.  lcptools/lcp_writepol -i owner -f list.pol -p TPM-password
2.  lcptools/lcp_writepol -i 0x20000001 -f vl.pol -p TPM-password


-----------------------------------------------------------------


Next you must modify grub so that you can choose the tbooted linux from the
boot window.

The Grub(2) configuration file is usually in /boot/grub and is called
grub.cfg.  It is updated automatically when a kernel is updated or
when you run update-grub.  

Tboot module must be added as the 'kernel' in the grub.conf file.
Here is an example:
   root (hd0,1)
   kernel /tboot.gz logging=vga vga_delay=10
   module /vmlinuz-2.6.18-xen root=/dev/VolGroup00/LogVol00 ro
   module /initrd...
   module /Q35_SINIT_17.BIN

I don't do the indented thing and it seems to work.
    For Linux:  the 'intel_iommu=on' command line option will enable VT-d and
    the TXT code in Linux will force this if it is not specified.  Support is
    part of the 2.6.32 kernel and later.

The final grub configuration file will look something like:
menuentry 'Ubuntu Linux 3.0.0-16-generic with TXT' --class ubuntu --class gnu-linux --class gnu --class os {
        recordfail
        set gfxpayload=text
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='(hd0,msdos5)'
        search --no-floppy --fs-uuid --set=root 8ab78657-8561-4fa8-af57-bff736275cc6
        echo 'Multiboot'
        multiboot /boot/tboot.gz /boot/tboot.gz logging=vga,memory,serial
        echo 'Linux'
        module   /boot/vmlinuz-3.0.0-16-generic /boot/vmlinuz-3.0.0-16-generic root=UUID=8ab78657-8561-4fa8-af57-bff736275cc6 ro   splash vt.handoff=7 intel_iommu=on
        echo 'initrd'
        module /boot/initrd.img-3.0.0-16-generic /boot/initrd.img-3.0.0-16-generic
        echo 'sinit'
        module /boot/sinit51.bin /boot/sinit51.bin

Modify grub.conf to load the policy data file:
1.  Edit grub.conf and add the following:
        module /list.data
    where you should use the path to this file.

Copy sinit into /boot and change run grub.conf then run update-grub.

Check the /boot directory to make sure tboot.gz is there.
<commit_msg>updated the tboot information to note that Lenovo T410 doesn't work and fixes the http address for SINIT<commit_after>Instructions for building and installing TBOOT for DRTM Boot
============================================================


Trousers and trousers-devel packages must already be installed in order 
to build lcptools.

Tboot requires an ACM Module that sets up the machine for TXT.  The appropriate
SINIT Module can be downloaded from
http://software.intel.com/en-us/articles/intel-trusted-execution-technology/.
Tboot will show the appropriate device ID in its output if it is booted with
the incorrect version of sinit. Use txt-stat (installed with tboot) to read the
most recent tboot logs.  The current version of tboot requires version 17 or
greater of the SINIT module.  A copy of the module we used is in this
distribution.


----------------------------------------------------------------------------


Building Tboot
    cd tbootprep/tboot-1.7.0
    make
    make install

To build the LCPTools
    cd lcptools
    make


----------------------------------------------------------------------------


Now you must built a Launch Control Policy (LCP) which controls what can be
booted.  The LCP consists of policy elements.

Create an MLE element:
1.  lcp_mlehash -c "the command line for tboot from grub.conf" /boot/tboot.gz
    > mle_hash
2.  lcp_crtpolelt --create --type mle --ctrl 0x00 --minver 17 --out mle.elt
    mle_hash

Create a PCONF element:
1.  cat /sys/devices/platform/tpm_tis/pcrs |grep -e PCR-00 -e PCR-01 > pcrs
2.  lcp_crtpolelt --create --type pconf --out pconf.elt pcrs

Create an SBIOS element:
1.  Create hash file containing BIOS hash(es), e.g. named sbios_hash
2.  lcp_crtpolelt --create --type sbios --out sbios.elt sbios_hash

Create a CUSTOM element:
1.  Create or determine the UUID that will identify this data format (e.g.
    using 'uuidgen')
2.  Create the data the will be placed in this element.  E.g. the policy file
    from tb_polgen.
3.  lcp_crtpolelt --create --type custom --out custom.elt --uuid <uuid value>
    <data file>

Create policy list(s):
1.  lcp_crtpollist --create --out list_unsig.lst mle.elt pconf.elt

Note:  I dont think you need to sign the list. If not, you can remove the
indented directions.

    Use lcp_crtpollist to sign the list:
    1.  openssl genrsa -out privkey.pem 2048
    2.  openssl rsa -pubout -in privkey.pem -out pubkey.pem
    3.  cp list_unsig.lst list_sig.lst
    4.  lcp_crtpollist --sign --pub pubkey.pem --priv privkey.pem --out list_sig.lst

    Use openssl to sign the list:
    1.  openssl rsa -pubout -in privkey.pem -out pubkey.pem
    2.  cp list_unsig.lst list_sig.lst
    3.  lcp_crtpollist --sign --pub pubkey.pem --nosig --out list_sig.lst
    4.  openssl genrsa -out privkey.pem 2048
    5.  openssl dgst -sha1 -sign privkey.pem -out list.sig list_sig.lst
    6.  lcp_crtpollist --addsig --sig list.sig --out list_sig.lst

Create policy and policy data files:
1.  lcp_crtpol2 --create --type list --pol list.pol --data list.data
    list_{unsig,sig}.lst

Create Verified Launch policy:
1.  tb_polgen/tb_polgen --create --type nonfatal vl.pol
2.  tb_polgen/tb_polgen --add --num 0 --pcr none --hash image
    --cmdline "the command line for xen from grub.conf"
    --image /boot/xen.gz
    vl.pol
3.  tb_polgen/tb_polgen --add --num 1 --pcr 19 --hash image
    --cmdline "the command line for dom0 from grub.conf"
    --image /boot/vmlinuz-2.6.18.8-xen
    vl.pol
4.  tb_polgen/tb_polgen --add --num 2 --pcr 19 --hash image
    --cmdline ""
    --image /boot/initrd-2.6.18.8-xen.img
    vl.pol

Define tboot error TPM NV index:
1.  lcptools/tpmnv_defindex -i 0x20000002 -s 8 -pv 0 -rl 0x07 -wl 0x07
    -p TPM-password

Define LCP and Verified Launch policy indices:
1.  lcptools/tpmnv_defindex -i owner -s 0x36 -p TPM-owner-password
2.  lcptools/tpmnv_defindex -i 0x20000001 -s 256 -pv 0x02 -p TPM-owner-password

Write LCP and Verified Launch policies to TPM:
(modprobe tpm_tis; tcsd;)
1.  lcptools/lcp_writepol -i owner -f list.pol -p TPM-password
2.  lcptools/lcp_writepol -i 0x20000001 -f vl.pol -p TPM-password


-----------------------------------------------------------------


Next you must modify grub so that you can choose the tbooted linux from the
boot window.

The Grub(2) configuration file is usually in /boot/grub and is called
grub.cfg.  It is updated automatically when a kernel is updated or
when you run update-grub.  

Tboot module must be added as the 'kernel' in the grub.conf file.
Here is an example:
   root (hd0,1)
   kernel /tboot.gz logging=vga vga_delay=10
   module /vmlinuz-2.6.18-xen root=/dev/VolGroup00/LogVol00 ro
   module /initrd...
   module /Q35_SINIT_17.BIN

I don't do the indented thing and it seems to work.
    For Linux:  the 'intel_iommu=on' command line option will enable VT-d and
    the TXT code in Linux will force this if it is not specified.  Support is
    part of the 2.6.32 kernel and later.

Note that the Lenovo T410 is known not to work with the Intel IOMMU; it will
not successfully boot with TBOOT.

The final grub configuration file will look something like:
menuentry 'Ubuntu Linux 3.0.0-16-generic with TXT' --class ubuntu --class gnu-linux --class gnu --class os {
        recordfail
        set gfxpayload=text
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='(hd0,msdos5)'
        search --no-floppy --fs-uuid --set=root 8ab78657-8561-4fa8-af57-bff736275cc6
        echo 'Multiboot'
        multiboot /boot/tboot.gz /boot/tboot.gz logging=vga,memory,serial
        echo 'Linux'
        module   /boot/vmlinuz-3.0.0-16-generic /boot/vmlinuz-3.0.0-16-generic root=UUID=8ab78657-8561-4fa8-af57-bff736275cc6 ro   splash vt.handoff=7 intel_iommu=on
        echo 'initrd'
        module /boot/initrd.img-3.0.0-16-generic /boot/initrd.img-3.0.0-16-generic
        echo 'sinit'
        module /boot/sinit51.bin /boot/sinit51.bin

Modify grub.conf to load the policy data file:
1.  Edit grub.conf and add the following:
        module /list.data
    where you should use the path to this file.

Copy sinit into /boot and change run grub.conf then run update-grub.

Check the /boot directory to make sure tboot.gz is there.

{'fraction_non_alphanumeric': 0.12837725841206696, 'fraction_numerical': 0.03580308304326206, 'mean_word_length': 2.4556128293241697, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3987630', 'n_tokens_mistral': 4424, 'n_tokens_neox': 4100, 'n_words': 1493}