AMD DRTM SKINIT Validation Guide

TrenchBoot + SKL + Secure Launch Linux

1. Test Environment

Build Host

OS:

1
Debian 12

Purpose:

  • Build TrenchBoot GRUB
  • Build Secure Kernel Loader
  • Build Secure Launch Linux kernel
  • Generate EFI boot image

Target Platform

AMD Turin CRB

Requirements:

  • AMD CPU with SKINIT support
  • TPM 2.0 enabled
  • UEFI boot mode

2. Install Build Dependencies

1
2
3
apt update

apt install -y git gcc g++ make autoconf automake bison flex gettext pkg-config libtool texinfo python3 python3-pip help2man mtools xorriso grub-common efibootmgr bc libssl-dev libelf-dev flex bison dwarves rsync cpio kmod autopoint

Install TPM tools:

1
apt install -y tpm2-tools libtss2-dev

3. Verify Target Hardware Capability

Boot target system.

Check CPU:

1
cpuid | grep -i skinit

Expected:

1
SKINIT instruction supported

Check TPM:

1
tpm2_getcap properties-fixed

Confirm:

1
2
TPM2_PT_MANUFACTURER
TPM2_PT_FIRMWARE_VERSION

4. Build TrenchBoot GRUB

Clone source:

1
2
3
4
5
6
7
mkdir ~/trenchboot

cd ~/trenchboot

git clone https://github.com/TrenchBoot/grub.git

cd grub

Initialize:

1
./bootstrap

Configure EFI build:

1
2
3
4
./configure \
--target=x86_64 \
--with-platform=efi \
--disable-werror

Build:

1
make -j$(nproc)

Verify Secure Launch support:

1
grep -R "slaunch" .

Expected:

1
slaunch

5. Build Secure Kernel Loader (SKL)

Download:

1
2
3
4
5
cd ~/trenchboot

git clone https://github.com/TrenchBoot/secure-kernel-loader.git

cd secure-kernel-loader

Check SKINIT support:

1
grep -R "SKINIT" .

Build:

1
make

Output:

1
skl

6. Build Secure Launch Linux Kernel

6.1 Obtain TrenchBoot Kernel Source

Do not use normal upstream kernel.

Example:

1
2
3
cd ~/trenchboot

git clone https://github.com/TrenchBoot/linux.git

Enter:

1
cd linux

Check Secure Launch support:

1
grep -R "SECURE_LAUNCH" .

Expected:

1
config SECURE_LAUNCH

6.2 Kernel Configuration

Generate config:

1
make menuconfig

Enable:

1
2
3
4
5
6
7
8
9
Processor type and features
    [*] Secure Launch support


Device Drivers
    Character devices
        TPM Hardware Support
            <*> TPM Interface
            <*> TPM CRB Interface

Verify:

1
2
3
grep -E \
"SECURE_LAUNCH|TCG_TPM|TCG_CRB" \
.config

Expected:

1
2
3
4
CONFIG_SECURE_LAUNCH=y
CONFIG_X86_SECURE_LAUNCH=y
CONFIG_TCG_TPM=y
CONFIG_TCG_CRB=y

6.3 Build Kernel

1
2
3
4
5
make -j$(nproc)

make modules_install

make install

Generated:

1
/boot/vmlinuz-xxx

7. Generate initrd

Create initramfs:

1
2
3
update-initramfs \
-c \
-k <kernel-version>

Output:

1
/boot/initrd.img-<kernel-version>

Note:

initrd.img is not the OS image.

It is the temporary filesystem used during Linux boot.

8. Create TrenchBoot Secure Launch Boot Entry

GRUB entry:

1
2
3
4
5
6
7
8
9
menuentry "AMD SKINIT Secure Launch" {

    slaunch skinit

    linux /boot/vmlinuz-xxx root=/dev/sdaX ro

    initrd /boot/initrd.img-xxx

}

Important:

1
slaunch skinit

This triggers:

1
2
3
4
5
6
7
GRUB
 |
SKL
 |
AMD SKINIT
 |
TPM measurement

9. Boot Target System

On AMD Turin CRB:

Select:

1
AMD SKINIT Secure Launch

Expected flow:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
UEFI

 |
 v

TrenchBoot GRUB

 |
 v

Secure Kernel Loader

 |
 v

AMD SKINIT

 |
 v

Linux Secure Launch Kernel

 |
 v

initrd

 |
 v

OS

10. Validation

10.1 Kernel Log

After boot:

1
dmesg | grep -i secure

or:

1
dmesg | grep -i launch

Expected:

1
Secure Launch enabled

10.2 TPM PCR Verification

Before SKINIT boot:

1
tpm2_pcrread sha256:17

Record PCR value.

After SKINIT boot:

1
tpm2_pcrread sha256:17

Expected:

PCR value changed.

10.3 TPM Event Log

Check:

1
2
tpm2_eventlog \
/sys/kernel/security/tpm0/binary_bios_measurements

Expected:

  • DRTM measurement
  • Secure Launch events

Pass Criteria

PASS:

  • CPU supports SKINIT
  • TrenchBoot GRUB starts Secure Launch
  • SKINIT executes successfully
  • TPM PCR is extended
  • Linux boots with Secure Launch enabled

FAIL:

  • No SKINIT capability
  • No TPM measurement change
  • Secure Launch kernel does not initialize