Jason Chow | 26 Jul 16:21 2012
Picon

Re: TBOOT supports KVM by including kvm kernel module in the trust chain ?



2012/7/26 Jason Chow <jasonchow.pku <at> gmail.com>
Hi Justin,
 
Thank you for your suggestion. So make the KVM inline in the kernel as a whole rather than a later loaded module is the solution for tboot with kvm. Am I correct ?
 
Regards,
Jason

2012/7/26 Justin King-Lacroix <justin.king-lacroix <at> cs.ox.ac.uk>
Hi Jason,

Tboot measures the kernel and the initrd/initramfs, so you should just need to make sure the KVM modules are in it (and installed at boot, before the root filesystem is mounted, of course).

Regards,
Justin



On 26/07/2012 2:44 PM, Jason Chow wrote:
Hi,
 
   As we all know, tboot can work with bare linux kernel. Howerver, does tboot support KVM as well as Xen ? Since kvm is treated as a kernel module, which will not be measured during the process of trusted boot (In my knowledge, only kernel will be measureed rather than kernel modules.). How can tboot provide a clean hypervisor environment as well as Xen does ? Is there any additional support in tboot to keep KVM module in a well-known status.
 
 
Thanks and regards,
Jason


------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________ tboot-devel mailing list tboot-devel <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tboot-devel



------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Jason Chow | 26 Jul 13:44 2012
Picon

TBOOT supports KVM by including kvm kernel module in the trust chain ?

Hi,
 
   As we all know, tboot can work with bare linux kernel. Howerver, does tboot support KVM as well as Xen ? Since kvm is treated as a kernel module, which will not be measured during the process of trusted boot (In my knowledge, only kernel will be measureed rather than kernel modules.). How can tboot provide a clean hypervisor environment as well as Xen does ? Is there any additional support in tboot to keep KVM module in a well-known status.
 
 
Thanks and regards,
Jason
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Jonathan McCune | 23 Jul 21:52 2012
Picon

Release announcement: XMHF (including TrustVisor)

We are pleased to announce the open-source release of the eXtensible,
Modular Hypervisor Framework (XMHF): http://xmhf.org

tl;dr: git clone git://git.code.sf.net/p/xmhf/xmhf

XMHF is a modular hypervisor platform for recent multicore x86
hardware with support for launching via dynamic root of trust and
nested (2-dimensional) paging. It is NOT a full virtual machine
monitor.

XMHF takes a developer-centric approach to hypervisor design and
implementation, and strives to be a comprehensible and flexible
platform for performing hypervisor research and development. XMHF
encapsulates common hypervisor core functionality in a framework that
allows others to build custom hypervisor-based solutions (called
"hypapps"). It currently supports only a single "rich" guest OS.  We
have tested recent 32-bit Ubuntu, and Windows Server 2003 and Windows
XP.

Our flagship hypapp is an implementation of the TrustVisor APIs.  Also
included is a LockDown hypapp that implements a red/green system, the
Trusted Execution Environment SDK for developing small, stand-alone
application components to execute in isolation, and a credential
manager application that leverages TrustVisor and the tee-sdk.

Documentation is maintained in the git repository using markdown,
which is automatically rendered here (scroll down):
https://sourceforge.net/p/xmhf/xmhf/  Academic publications describing
the design and architecture of these components are linked from the
documentation page.  All of the source code that we contribute is
covered under a BSD-style license.  The build process for some of the
example PALs that run on TrustVisor statically links against the
GPL-licensed 'newlib' implementation of the standard C library.  See
the COPYING.md file in the root directory of the git repository for
more information on source code licensing.

Our preferred method for getting support is to use the Discussion
(forums) on the XMHF SourceForge page:
https://sourceforge.net/p/xmhf/discussion/ The Tickets system houses
many known issues.

Please accept our apologies if you receive more than one copy of this
announcement.

Kind Regards,
The XMHF Development Team
--Jon McCune
--Jim Newsome
--Amit Vasudevan

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Matthew Podhorniak | 14 Jun 14:35 2012
Picon

Intel TXT

Hello!

I am looking into using tboot on a laptop I have, in a testing environment.  When reading about tboot I see it utilizes something called Intel TXT, is this something only available to machines who have a TPM manufactured by Intel?

Thank you!

Matthew

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Charles.Fisher | 13 Jun 20:36 2012

Message levels in tboot

It appears from looking at the code that there was an original intent to classify the messages displayed using printk into one of 3 levels (info, warn, and error), although it does not appear that any of the existing printk’s utilize this feature.

 

Are there any plans to do so in the future? We would like to be able to just specify error codes on our production systems, without having all of the extraneous messages displayed.

 

If we were to do the work in classifying the messages, is this something that there is general interest in, and therefore we could ship it upstream?

 

Thanks

 

Charles

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Charles.Fisher | 8 Jun 01:35 2012

Sandy Bridge/Ivy Bridge problem

We have a mixed environment of Sandy Bridge and Ivy Bridge machines. We want to use a standard image for installation, and in the past, have just loaded all of the sinit modules in the grub.conf file, allowing tboot to figure out which was the correct sinit to use.

 

We have run into a problem with the older Sandy Bridge machines. If the 3rd generation sinit module is searched first, then tboot fails, as that module expects the AUX2 index to be defined, and on the older systems that is not the case.

 

It would appear that the only way for tboot to determine the correct sinit module is to examine for the existence of the AUX2 index, and if it is not present, pass on using the 3rd generation sinit module, continuing to look for a 2nd generation module instead. Is this in fact the case, or is there another way of having tboot correctly determine the proper sinit module.

 

Thanks in advance,

 

Charles

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Frédéric Guihéry | 30 May 18:25 2012

Undocumented TXT error code ?

Hi,

I tried Flicker on an HP EliteBook 8460p with a Linux 3.2.17 kernel, 
and encountered an apparently undocumented TXT error code, as shown 
below. The error code is retrieved after a Flicker launch that reset the 
platform. The SINIT module is the last one (version 51 for Sandy Bridge 
processors).

I should mention that tboot works correctly with the same 
configuration.

Does anyone have ever seen this error code and/or know more about it ?

Yours,
Fred

----------------------------------------------------

$ ./parse_err 0xc00024e1
ERRORCODE: 0xc00024e1
AC module error : acm_type=0x1, progress=0x0e, error=0x9

----------------------------------------------------

Intel(r) TXT Configuration Registers:
	STS: 0x00000012
	    senter_done: FALSE
	    sexit_done: TRUE
	    mem_config_lock: FALSE
	    private_open: FALSE
	    locality_1_open: FALSE
	    locality_2_open: FALSE
	ESTS: 0x00
	    txt_reset: FALSE
	E2STS: 0x0000000000000000
	    secrets: FALSE
	ERRORCODE: 0xc00024e1
	DIDVID: 0x00000001b0018086
	    vendor_id: 0x8086
	    device_id: 0xb001
	    revision_id: 0x1
	FSBIF: 0x0000000000000000
	QPIIF: 0x000000009d003000
	SINIT.BASE: 0xbcf00000
	SINIT.SIZE: 131072B (0x20000)
	HEAP.BASE: 0xbcf20000
	HEAP.SIZE: 917504B (0xe0000)
	DPR: 0x00000000bd000041
	    lock: TRUE
	    top: 0xbd000000
	    size: 4MB (4194304B)

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Andrew Goodbody | 23 May 12:51 2012
Picon

parse_err produces the wrong result for a TPM error

The use of bit fields in parse_err is not working correctly.

./parse_err 0xc01128d1
ERRORCODE: 0xc01128d1
AC module error : acm_type=0x1, progress=0x0d, error=0xa
TPM error code = 0x0

Whereas the correct response should be 0x11.

Bit fields are a minefield, they should not be used.

Andrew

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Andrew Goodbody | 21 May 17:15 2012
Picon

Unknown error from TPM

I am getting a reset on executing SENTER and the error code reported is 
from the TPM but I cannot decode it. The error is 0x1ff which is way 
above any of the lists of TPM error codes I can find.

I have attached the log. This is on an Ivy Bridge machine.

Thanks,
Andrew
TBOOT: ******************* TBOOT *******************
TBOOT:    2012-01-31 10:04 -0800 299:950fec11ef90
TBOOT: *********************************************
TBOOT: command line: ehci_handoff=true logging=memory,vga,serial loglvl=all
TBOOT: BSP is cpu 0
TBOOT: original e820 map:
TBOOT: 	0000000000000000 - 000000000009d800  (1)
TBOOT: 	000000000009d800 - 00000000000a0000  (2)
TBOOT: 	00000000000e0000 - 0000000000100000  (2)
TBOOT: 	0000000000100000 - 0000000020000000  (1)
TBOOT: 	0000000020000000 - 0000000020200000  (2)
TBOOT: 	0000000020200000 - 0000000040000000  (1)
TBOOT: 	0000000040000000 - 0000000040200000  (2)
TBOOT: 	0000000040200000 - 00000000b9c49000  (1)
TBOOT: 	00000000b9c49000 - 00000000ba091000  (4)
TBOOT: 	00000000ba091000 - 00000000ba30d000  (1)
TBOOT: 	00000000ba30d000 - 00000000ba567000  (2)
TBOOT: 	00000000ba567000 - 00000000ba7d4000  (1)
TBOOT: 	00000000ba7d4000 - 00000000ba968000  (2)
TBOOT: 	00000000ba968000 - 00000000babe8000  (4)
TBOOT: 	00000000babe8000 - 00000000bac00000  (3)
TBOOT: 	00000000bb800000 - 00000000bfa00000  (2)
TBOOT: 	00000000f8000000 - 00000000fc000000  (2)
TBOOT: 	00000000fec00000 - 00000000fec01000  (2)
TBOOT: 	00000000fed00000 - 00000000fed04000  (2)
TBOOT: 	00000000fed1c000 - 00000000fed90000  (2)
TBOOT: 	00000000fee00000 - 00000000fee01000  (2)
TBOOT: 	00000000ff000000 - 0000000100000000  (2)
TBOOT: 	0000000100000000 - 000000013e600000  (1)
TBOOT: TPM is ready
TBOOT: TPM nv_locked: TRUE
TBOOT: TPM timeout values: A: 750, B: 750, C: 2000, D: 750
TBOOT: Wrong timeout B, fallback to 2000
TBOOT: reading Verified Launch Policy from TPM NV...
TBOOT: 	:256 bytes read
TBOOT: policy:
TBOOT: unsupported version (255)
TBOOT: 	:reading failed
TBOOT: reading Launch Control Policy from TPM NV...
TBOOT: 	:34 bytes read
TBOOT: 	:reading failed
TBOOT: failed to read policy from TPM NV, using default
TBOOT: policy:
TBOOT: 	 version: 2
TBOOT: 	 policy_type: TB_POLTYPE_CONT_NON_FATAL
TBOOT: 	 hash_alg: TB_HALG_SHA1
TBOOT: 	 policy_control: 00000001 (EXTEND_PCR17)
TBOOT: 	 num_entries: 2
TBOOT: 	 policy entry[0]:
TBOOT: 		 mod_num: 0
TBOOT: 		 pcr: none
TBOOT: 		 hash_type: TB_HTYPE_ANY
TBOOT: 		 num_hashes: 0
TBOOT: 	 policy entry[1]:
TBOOT: 		 mod_num: any
TBOOT: 		 pcr: 19
TBOOT: 		 hash_type: TB_HTYPE_ANY
TBOOT: 		 num_hashes: 0
TBOOT: no policy in TPM NV.
TBOOT: IA32_FEATURE_CONTROL_MSR: 0000ff07
TBOOT: CPU is SMX-capable
TBOOT: CPU is VMX-capable
TBOOT: SMX is enabled
TBOOT: TXT chipset and all needed capabilities present
TBOOT: TXT.ERRORCODE: 0x0
TBOOT: TXT.ESTS: 0x0
TBOOT: TXT.E2STS: 0x0
TBOOT: IA32_FEATURE_CONTROL_MSR: 0000ff07
TBOOT: CPU is SMX-capable
TBOOT: CPU is VMX-capable
TBOOT: SMX is enabled
TBOOT: TXT chipset and all needed capabilities present
TBOOT: TXT.HEAP.BASE: 0xbaf20000
TBOOT: TXT.HEAP.SIZE: 0xe0000 (917504)
TBOOT: bios_data ( <at> 0xbaf20008, 0x56):
TBOOT: 	 version: 4
TBOOT: 	 bios_sinit_size: 0x0 (0)
TBOOT: 	 lcp_pd_base: 0x0
TBOOT: 	 lcp_pd_size: 0x0 (0)
TBOOT: 	 num_logical_procs: 4
TBOOT: 	 flags: 0x00000000
TBOOT: 	 ext_data_elts[]:
TBOOT: 		 BIOS_SPEC_VER:
TBOOT: 		     major: 0x1
TBOOT: 		     minor: 0x9
TBOOT: 		     rev: 0x0
TBOOT: 		 ACM:
TBOOT: 		     num_acms: 1
TBOOT: 		     acm_addrs[0]: 0xfff7a000
TBOOT: CR0 and EFLAGS OK
TBOOT: supports preserving machine check errors
TBOOT: CPU is ready for SENTER
TBOOT: checking previous errors on the last boot.
	last boot has error.
TBOOT: checking if module /list.data is an SINIT for this platform...
TBOOT: 	 ACM size is too small: acmod_size=2d0, sizeof(acm_hdr)=4
TBOOT: checking if module /2nd_gen_i5_i7_SINIT_19.BIN is an SINIT for this platf
orm...
TBOOT: chipset production fused: 1
TBOOT: chipset ids: vendor: 0x8086, device: 0xb001, revision: 0x1
TBOOT: processor family/model/stepping: 0x206a7
TBOOT: platform id: 0x10000000000000
TBOOT: 	 1 ACM chipset id entries:
TBOOT: 	     vendor: 0x8086, device: 0xb001, flags: 0x1, revision: 0x1, extended
: 0x0
TBOOT: 	 2 ACM processor id entries:
TBOOT: 	     fms: 0x206a0, fms_mask: 0xfff3ff0, platform_id: 0x10000000000000, p
latform_mask: 0x1c000000000000
TBOOT: SINIT matches platform
TBOOT: TXT.SINIT.BASE: 0xbaf00000
TBOOT: TXT.SINIT.SIZE: 0x20000 (131072)
TBOOT: copied SINIT (size=c000) to 0xbaf00000
TBOOT: AC mod base alignment OK
TBOOT: AC mod size OK
TBOOT: AC module header dump for SINIT:
TBOOT: 	 type: 0x2 (ACM_TYPE_CHIPSET)
TBOOT: 	 subtype: 0x0 
TBOOT: 	 length: 0xa1 (161)
TBOOT: 	 version: 0
TBOOT: 	 chipset_id: 0xb001
TBOOT: 	 flags: 0x0
TBOOT: 		 pre_production: 0
TBOOT: 		 debug_signed: 0
TBOOT: 	 vendor: 0x8086
TBOOT: 	 date: 0x20110506
TBOOT: 	 size*4: 0xc000 (49152)
TBOOT: 	 code_control: 0x0
TBOOT: 	 entry point: 0x00000008:000034ce
TBOOT: 	 scratch_size: 0x8f (143)
TBOOT: 	 info_table:
TBOOT: 		 uuid: {0x7fc03aaa, 0x46a7, 0x18db, 0xac2e,
		{0x69, 0x8f, 0x8d, 0x41, 0x7f, 0x5a}}
TBOOT: 		     ACM_UUID_V3
TBOOT: 		 chipset_acm_type: 0x1 (SINIT)
TBOOT: 		 version: 4
TBOOT: 		 length: 0x2c (44)
TBOOT: 		 chipset_id_list: 0x4ec
TBOOT: 		 os_sinit_data_ver: 0x5
TBOOT: 		 min_mle_hdr_ver: 0x00020000
TBOOT: 		 capabilities: 0x0000000e
TBOOT: 		     rlp_wake_getsec: 0
TBOOT: 		     rlp_wake_monitor: 1
TBOOT: 		     ecx_pgtbl: 1
TBOOT: 		     pcr_map_no_legacy: 0
TBOOT: 		     pcr_map_da: 0
TBOOT: 		 acm_ver: 19
TBOOT: 	 chipset list:
TBOOT: 		 count: 1
TBOOT: 		 entry 0:
TBOOT: 		     flags: 0x1
TBOOT: 		     vendor_id: 0x8086
TBOOT: 		     device_id: 0xb001
TBOOT: 		     revision_id: 0x1
TBOOT: 		     extended_id: 0x0
TBOOT: 	 processor list:
TBOOT: 		 count: 2
TBOOT: 		 entry 0:
TBOOT: 		     fms: 0x206a0
TBOOT: 		     fms_mask: 0xfff3ff0
TBOOT: 		     platform_id: 0x10000000000000
TBOOT: 		     platform_mask: 0x1c000000000000
TBOOT: 		 entry 1:
TBOOT: 		     fms: 0x206a0
TBOOT: 		     fms_mask: 0xfff3ff0
TBOOT: 		     platform_id: 0x4000000000000
TBOOT: 		     platform_mask: 0x1c000000000000
TBOOT: file addresses:
TBOOT: 	 &_start=0x804000
TBOOT: 	 &_end=0x972e88
TBOOT: 	 &_mle_start=0x804000
TBOOT: 	 &_mle_end=0x827000
TBOOT: 	 &_post_launch_entry=0x804010
TBOOT: 	 &_txt_wakeup=0x8041e0
TBOOT: 	 &g_mle_hdr=0x81a5c0
TBOOT: MLE header:
TBOOT: 	 uuid={0x9082ac5a, 0x476f, 0x74a7, 0x5c0f,
		{0x55, 0xa2, 0xcb, 0x51, 0xb6, 0x42}}
TBOOT: 	 length=34
TBOOT: 	 version=00020001
TBOOT: 	 entry_point=00000010
TBOOT: 	 first_valid_page=00000000
TBOOT: 	 mle_start_off=4000
TBOOT: 	 mle_end_off=27000
TBOOT: 	 capabilities: 0x00000027
TBOOT: 	     rlp_wake_getsec: 1
TBOOT: 	     rlp_wake_monitor: 1
TBOOT: 	     ecx_pgtbl: 1
TBOOT: 	     pcr_map_no_legacy: 0
TBOOT: 	     pcr_map_da: 1
TBOOT: MLE start=804000, end=827000, size=23000
TBOOT: ptab_size=3000, ptab_base=0x801000
TBOOT: TXT.HEAP.BASE: 0xbaf20000
TBOOT: TXT.HEAP.SIZE: 0xe0000 (917504)
TBOOT: bios_data ( <at> 0xbaf20008, 0x56):
TBOOT: 	 version: 4
TBOOT: 	 bios_sinit_size: 0x0 (0)
TBOOT: 	 lcp_pd_base: 0x0
TBOOT: 	 lcp_pd_size: 0x0 (0)
TBOOT: 	 num_logical_procs: 4
TBOOT: 	 flags: 0x00000000
TBOOT: 	 ext_data_elts[]:
TBOOT: 		 BIOS_SPEC_VER:
TBOOT: 		     major: 0x1
TBOOT: 		     minor: 0x9
TBOOT: 		     rev: 0x0
TBOOT: 		 ACM:
TBOOT: 		     num_acms: 1
TBOOT: 		     acm_addrs[0]: 0xfff7a000
TBOOT: discarding RAM above reserved regions: 0x20200000 - 0x40000000
TBOOT: discarding RAM above reserved regions: 0x40200000 - 0xb9c49000
TBOOT: discarding RAM above reserved regions: 0xba091000 - 0xba30d000
TBOOT: discarding RAM above reserved regions: 0xba567000 - 0xba7d4000
TBOOT: min_lo_ram: 0x0, max_lo_ram: 0x20000000
TBOOT: min_hi_ram: 0x100000000, max_hi_ram: 0x13e600000
TBOOT: v2 LCP policy data found
TBOOT: os_sinit_data ( <at> 0xbaf3117e, 0x64):
TBOOT: 	 version: 5
TBOOT: 	 mle_ptab: 0x801000
TBOOT: 	 mle_size: 0x23000 (143360)
TBOOT: 	 mle_hdr_base: 0x165c0
TBOOT: 	 vtd_pmr_lo_base: 0x0
TBOOT: 	 vtd_pmr_lo_size: 0x20000000
TBOOT: 	 vtd_pmr_hi_base: 0x100000000
TBOOT: 	 vtd_pmr_hi_size: 0x3e600000
TBOOT: 	 lcp_po_base: 0xbaf20176
TBOOT: 	 lcp_po_size: 0x2d0 (720)
TBOOT: 	 capabilities: 0x00000002
TBOOT: 	     rlp_wake_getsec: 0
TBOOT: 	     rlp_wake_monitor: 1
TBOOT: 	     ecx_pgtbl: 0
TBOOT: 	     pcr_map_no_legacy: 0
TBOOT: 	     pcr_map_da: 0
TBOOT: 	 efi_rsdt_ptr: 0x0
TBOOT: setting MTRRs for acmod: base=0xbaf00000, size=0xc000, num_pages=12
TBOOT: executing GETSEC[SENTER]...
TBOOT: ******************* TBOOT *******************
TBOOT:    2012-01-31 10:04 -0800 299:950fec11ef90
TBOOT: *********************************************
TBOOT: command line: ehci_handoff=true logging=memory,vga,serial loglvl=all
TBOOT: BSP is cpu 0
TBOOT: original e820 map:
TBOOT: 	0000000000000000 - 000000000009d800  (1)
TBOOT: 	000000000009d800 - 00000000000a0000  (2)
TBOOT: 	00000000000e0000 - 0000000000100000  (2)
TBOOT: 	0000000000100000 - 0000000020000000  (1)
TBOOT: 	0000000020000000 - 0000000020200000  (2)
TBOOT: 	0000000020200000 - 0000000040000000  (1)
TBOOT: 	0000000040000000 - 0000000040200000  (2)
TBOOT: 	0000000040200000 - 00000000b9c49000  (1)
TBOOT: 	00000000b9c49000 - 00000000ba091000  (4)
TBOOT: 	00000000ba091000 - 00000000ba30d000  (1)
TBOOT: 	00000000ba30d000 - 00000000ba567000  (2)
TBOOT: 	00000000ba567000 - 00000000ba7d4000  (1)
TBOOT: 	00000000ba7d4000 - 00000000ba968000  (2)
TBOOT: 	00000000ba968000 - 00000000babe8000  (4)
TBOOT: 	00000000babe8000 - 00000000bac00000  (3)
TBOOT: 	00000000bb800000 - 00000000bfa00000  (2)
TBOOT: 	00000000f8000000 - 00000000fc000000  (2)
TBOOT: 	00000000fec00000 - 00000000fec01000  (2)
TBOOT: 	00000000fed00000 - 00000000fed04000  (2)
TBOOT: 	00000000fed1c000 - 00000000fed90000  (2)
TBOOT: 	00000000fee00000 - 00000000fee01000  (2)
TBOOT: 	00000000ff000000 - 0000000100000000  (2)
TBOOT: 	0000000100000000 - 000000013e600000  (1)
TBOOT: TPM is ready
TBOOT: TPM nv_locked: TRUE
TBOOT: TPM timeout values: A: 750, B: 750, C: 2000, D: 750
TBOOT: Wrong timeout B, fallback to 2000
TBOOT: reading Verified Launch Policy from TPM NV...
TBOOT: 	:256 bytes read
TBOOT: policy:
TBOOT: unsupported version (255)
TBOOT: 	:reading failed
TBOOT: reading Launch Control Policy from TPM NV...
TBOOT: 	:34 bytes read
TBOOT: 	:reading failed
TBOOT: failed to read policy from TPM NV, using default
TBOOT: policy:
TBOOT: 	 version: 2
TBOOT: 	 policy_type: TB_POLTYPE_CONT_NON_FATAL
TBOOT: 	 hash_alg: TB_HALG_SHA1
TBOOT: 	 policy_control: 00000001 (EXTEND_PCR17)
TBOOT: 	 num_entries: 2
TBOOT: 	 policy entry[0]:
TBOOT: 		 mod_num: 0
TBOOT: 		 pcr: none
TBOOT: 		 hash_type: TB_HTYPE_ANY
TBOOT: 		 num_hashes: 0
TBOOT: 	 policy entry[1]:
TBOOT: 		 mod_num: any
TBOOT: 		 pcr: 19
TBOOT: 		 hash_type: TB_HTYPE_ANY
TBOOT: 		 num_hashes: 0
TBOOT: no policy in TPM NV.
TBOOT: IA32_FEATURE_CONTROL_MSR: 0000ff07
TBOOT: CPU is SMX-capable
TBOOT: CPU is VMX-capable
TBOOT: SMX is enabled
TBOOT: TXT chipset and all needed capabilities present
TBOOT: TXT.ERRORCODE: 0xc01128d1
TBOOT: AC module error : acm_type=0x1, progress=0x0d, error=0xa
TBOOT: TPM error code = 0x1ff
TBOOT: TXT.ESTS: 0x0
TBOOT: TXT.E2STS: 0x0
TBOOT: IA32_FEATURE_CONTROL_MSR: 0000ff07
TBOOT: CPU is SMX-capable
TBOOT: CPU is VMX-capable
TBOOT: SMX is enabled
TBOOT: TXT chipset and all needed capabilities present
TBOOT: TXT.HEAP.BASE: 0xbaf20000
TBOOT: TXT.HEAP.SIZE: 0xe0000 (917504)
TBOOT: bios_data ( <at> 0xbaf20008, 0x56):
TBOOT: 	 version: 4
TBOOT: 	 bios_sinit_size: 0x0 (0)
TBOOT: 	 lcp_pd_base: 0x0
TBOOT: 	 lcp_pd_size: 0x0 (0)
TBOOT: 	 num_logical_procs: 4
TBOOT: 	 flags: 0x00000000
TBOOT: 	 ext_data_elts[]:
TBOOT: 		 BIOS_SPEC_VER:
TBOOT: 		     major: 0x1
TBOOT: 		     minor: 0x9
TBOOT: 		     rev: 0x0
TBOOT: 		 ACM:
TBOOT: 		     num_acms: 1
TBOOT: 		     acm_addrs[0]: 0xfff7a000
TBOOT: CR0 and EFLAGS OK
TBOOT: supports preserving machine check errors
TBOOT: CPU is ready for SENTER
TBOOT: checking previous errors on the last boot.
	last boot has error.
TBOOT: checking if module /list.data is an SINIT for this platform...
TBOOT: 	 ACM size is too small: acmod_size=2d0, sizeof(acm_hdr)=4
TBOOT: checking if module /2nd_gen_i5_i7_SINIT_19.BIN is an SINIT for this platf
orm...
TBOOT: chipset production fused: 1
TBOOT: chipset ids: vendor: 0x8086, device: 0xb001, revision: 0x1
TBOOT: processor family/model/stepping: 0x206a7
TBOOT: platform id: 0x10000000000000
TBOOT: 	 1 ACM chipset id entries:
TBOOT: 	     vendor: 0x8086, device: 0xb001, flags: 0x1, revision: 0x1, extended
: 0x0
TBOOT: 	 2 ACM processor id entries:
TBOOT: 	     fms: 0x206a0, fms_mask: 0xfff3ff0, platform_id: 0x10000000000000, p
latform_mask: 0x1c000000000000
TBOOT: SINIT matches platform
TBOOT: TXT.SINIT.BASE: 0xbaf00000
TBOOT: TXT.SINIT.SIZE: 0x20000 (131072)
TBOOT: copied SINIT (size=c000) to 0xbaf00000
TBOOT: AC mod base alignment OK
TBOOT: AC mod size OK
TBOOT: AC module header dump for SINIT:
TBOOT: 	 type: 0x2 (ACM_TYPE_CHIPSET)
TBOOT: 	 subtype: 0x0 
TBOOT: 	 length: 0xa1 (161)
TBOOT: 	 version: 0
TBOOT: 	 chipset_id: 0xb001
TBOOT: 	 flags: 0x0
TBOOT: 		 pre_production: 0
TBOOT: 		 debug_signed: 0
TBOOT: 	 vendor: 0x8086
TBOOT: 	 date: 0x20110506
TBOOT: 	 size*4: 0xc000 (49152)
TBOOT: 	 code_control: 0x0
TBOOT: 	 entry point: 0x00000008:000034ce
TBOOT: 	 scratch_size: 0x8f (143)
TBOOT: 	 info_table:
TBOOT: 		 uuid: {0x7fc03aaa, 0x46a7, 0x18db, 0xac2e,
		{0x69, 0x8f, 0x8d, 0x41, 0x7f, 0x5a}}
TBOOT: 		     ACM_UUID_V3
TBOOT: 		 chipset_acm_type: 0x1 (SINIT)
TBOOT: 		 version: 4
TBOOT: 		 length: 0x2c (44)
TBOOT: 		 chipset_id_list: 0x4ec
TBOOT: 		 os_sinit_data_ver: 0x5
TBOOT: 		 min_mle_hdr_ver: 0x00020000
TBOOT: 		 capabilities: 0x0000000e
TBOOT: 		     rlp_wake_getsec: 0
TBOOT: 		     rlp_wake_monitor: 1
TBOOT: 		     ecx_pgtbl: 1
TBOOT: 		     pcr_map_no_legacy: 0
TBOOT: 		     pcr_map_da: 0
TBOOT: 		 acm_ver: 19
TBOOT: 	 chipset list:
TBOOT: 		 count: 1
TBOOT: 		 entry 0:
TBOOT: 		     flags: 0x1
TBOOT: 		     vendor_id: 0x8086
TBOOT: 		     device_id: 0xb001
TBOOT: 		     revision_id: 0x1
TBOOT: 		     extended_id: 0x0
TBOOT: 	 processor list:
TBOOT: 		 count: 2
TBOOT: 		 entry 0:
TBOOT: 		     fms: 0x206a0
TBOOT: 		     fms_mask: 0xfff3ff0
TBOOT: 		     platform_id: 0x10000000000000
TBOOT: 		     platform_mask: 0x1c000000000000
TBOOT: 		 entry 1:
TBOOT: 		     fms: 0x206a0
TBOOT: 		     fms_mask: 0xfff3ff0
TBOOT: 		     platform_id: 0x4000000000000
TBOOT: 		     platform_mask: 0x1c000000000000
TBOOT: file addresses:
TBOOT: 	 &_start=0x804000
TBOOT: 	 &_end=0x972e88
TBOOT: 	 &_mle_start=0x804000
TBOOT: 	 &_mle_end=0x827000
TBOOT: 	 &_post_launch_entry=0x804010
TBOOT: 	 &_txt_wakeup=0x8041e0
TBOOT: 	 &g_mle_hdr=0x81a5c0
TBOOT: MLE header:
TBOOT: 	 uuid={0x9082ac5a, 0x476f, 0x74a7, 0x5c0f,
		{0x55, 0xa2, 0xcb, 0x51, 0xb6, 0x42}}
TBOOT: 	 length=34
TBOOT: 	 version=00020001
TBOOT: 	 entry_point=00000010
TBOOT: 	 first_valid_page=00000000
TBOOT: 	 mle_start_off=4000
TBOOT: 	 mle_end_off=27000
TBOOT: 	 capabilities: 0x00000027
TBOOT: 	     rlp_wake_getsec: 1
TBOOT: 	     rlp_wake_monitor: 1
TBOOT: 	     ecx_pgtbl: 1
TBOOT: 	     pcr_map_no_legacy: 0
TBOOT: 	     pcr_map_da: 1
TBOOT: MLE start=804000, end=827000, size=23000
TBOOT: ptab_size=3000, ptab_base=0x801000
TBOOT: TXT.HEAP.BASE: 0xbaf20000
TBOOT: TXT.HEAP.SIZE: 0xe0000 (917504)
TBOOT: bios_data ( <at> 0xbaf20008, 0x56):
TBOOT: 	 version: 4
TBOOT: 	 bios_sinit_size: 0x0 (0)
TBOOT: 	 lcp_pd_base: 0x0
TBOOT: 	 lcp_pd_size: 0x0 (0)
TBOOT: 	 num_logical_procs: 4
TBOOT: 	 flags: 0x00000000
TBOOT: 	 ext_data_elts[]:
TBOOT: 		 BIOS_SPEC_VER:
TBOOT: 		     major: 0x1
TBOOT: 		     minor: 0x9
TBOOT: 		     rev: 0x0
TBOOT: 		 ACM:
TBOOT: 		     num_acms: 1
TBOOT: 		     acm_addrs[0]: 0xfff7a000
TBOOT: discarding RAM above reserved regions: 0x20200000 - 0x40000000
TBOOT: discarding RAM above reserved regions: 0x40200000 - 0xb9c49000
TBOOT: discarding RAM above reserved regions: 0xba091000 - 0xba30d000
TBOOT: discarding RAM above reserved regions: 0xba567000 - 0xba7d4000
TBOOT: min_lo_ram: 0x0, max_lo_ram: 0x20000000
TBOOT: min_hi_ram: 0x100000000, max_hi_ram: 0x13e600000
TBOOT: v2 LCP policy data found
TBOOT: os_sinit_data ( <at> 0xbaf3117e, 0x64):
TBOOT: 	 version: 5
TBOOT: 	 mle_ptab: 0x801000
TBOOT: 	 mle_size: 0x23000 (143360)
TBOOT: 	 mle_hdr_base: 0x165c0
TBOOT: 	 vtd_pmr_lo_base: 0x0
TBOOT: 	 vtd_pmr_lo_size: 0x20000000
TBOOT: 	 vtd_pmr_hi_base: 0x100000000
TBOOT: 	 vtd_pmr_hi_size: 0x3e600000
TBOOT: 	 lcp_po_base: 0xbaf20176
TBOOT: 	 lcp_po_size: 0x2d0 (720)
TBOOT: 	 capabilities: 0x00000002
TBOOT: 	     rlp_wake_getsec: 0
TBOOT: 	     rlp_wake_monitor: 1
TBOOT: 	     ecx_pgtbl: 0
TBOOT: 	     pcr_map_no_legacy: 0
TBOOT: 	     pcr_map_da: 0
TBOOT: 	 efi_rsdt_ptr: 0x0
TBOOT: setting MTRRs for acmod: base=0xbaf00000, size=0xc000, num_pages=12
TBOOT: executing GETSEC[SENTER]...
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
Wei, Gang | 27 Apr 18:21 2012
Picon

tboot 1.7.1 released

Source package tboot-1.7.1.tar.gz can be downloaded from sourceforge.net.
And the upstream repository was moved from bughost.org to sf.net at 
http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot. 
(Note, the check-in notification CAN'T be sent to tboot-changelog mailing list by far.)

Major changes since 1.7.0 (20120115):

    Fix cmdline size in tb_polgen
    New tboot cmdline option "min_ram=0xXXXXXX"
    Update test-patches/tpm-test.patch to fit in latest code.

Please help testing it, and enjoy it.

Jimmy

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
Charles.Fisher | 26 Apr 20:06 2012

Question about the difference between aux and aux2

I have a question about the Sandy Bridge SINIT module (2nd_gen_i5_i7_SINIT_51.BIN).

 

The developers kit has a set of programs for defining the default policy (NVRAM index 0x50000001) and aux2 (NVRAM index 0x50000003).

 

All of the Sandy Bridge Machines that we currently have, have aux predefined (0x50000002), and tboot and the SINIT module appear to work fine.

 

We are currently in the position of having to define the Platform Supplier indices before locking down the NVRAM.

The questions are:

 

Does it matter that AUX2 is not defined?

 

Is it a problem to define both the AUX and AUX2 indexes?

 

Given that there is nothing that is every written to AUX or AUX 2 by any of tboot programs, I am assuming that they are used by the SINIT module for internal scratch space.

 

Given that the SINIT module will not function with the NVRAM unlocked, and that locking the NVRAM is a one way street, we would like to be certain that we have the PS indices defined correctly before  taking that step.

 

Thanks for any help that you have available.

 

Charles

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
tboot-devel mailing list
tboot-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel

Gmane