ThinkWiki - User contributions [en]

Embedded Security Subsystem

2006-10-19T12:59:18Z

CarlosLiu: /* TCPA/TCG clean models */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:ESS.jpg|IBM Embedded Security Subsystem]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
=== The Embedded Security Subsystem ===
The Embedded Security Subsystem is nothing but a chip installed on the ThinkPads mainboard that can take care of certain security related tasks conforming to the TCPA standard. It was first introduced among the T23 models and is now under the name Embedded Security Subsystem 2.0 an integral part of most of the modern ThinkPads. The functions of the chip are bound to three main groups:
* public key functions
* trusted boot functions
* initialization and management functions

The purpose of the whole thing is to keep the user's sensitive data out of range from software based attacks (like viruses, internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the neccessary functions to handle them within itself, so that a i.e. a private key never has to leave the chip (can't be seen by any piece of software). Besides this there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the [http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page].</div>
|}

==WARNING==
There's a bug in the latest release of the security chip software. You end up facing a security chip login, and you press Ctrl-alt-delete, and it just sits there. DO NOT Download the latest patch (Dated 13/06/2006 v 7.00.0017.00) <BR>
Actaully they appear to have removed that patch.<BR>
Ring IBM support (in Australia 131426, 1, 2) and they'll talk you through doing a system restore.<BR>

==Trusted or Treacherous?==

TC - Trusted Computing - will be the biggest change of the information landscape since decades. Besides positive features like a more secure hardware storage for cryptographic keys, an analysis of the proposed TCG-standards shows some problematic properties. <br />
As ThinkPads of recent generations following the ThinkPad {{T23}} ([[Embedded Security Subsystem#Models featuring this Technology|see the complete list of models]]) are equipped with this disputed TCG-/TCPA-Technology, it can be interesting, which promises of the TCG are fulfilled inside your ThinkPad and which parts of the TCG-specifications still seem to be a privacy issue for every user of digital devices like a MP3-player or a ThinkPad - so please read [[TCPA/TCG - Trusted or Treacherous|this article]] for more details.

==Linux Support==
Two linux drivers are available, a [[tpm|classical one]] and a [[tpmdd|newer one]].
Coverage of functionality of the first is unknown so far, the second is part of a bigger project aiming to provide a usable security framework.

David Stafford (one of the developers of the tpm code at IBM) on March 10, 2005 sent me the most recent version of the tpm-kml code. With his permission, I quote his email:

"I am attaching our latest driver and library.
This version is in the process of kernel mailing list review, and
will hopefully be accepted into the official kernel. It works
much better across various 2.6 kernels. Note that this builds
three modules tpm, tpm_atmel, and tpm_nsc. You modprobe the
tpm_atmel (for all current shipping atmel based systems), or
tpm_nsc (for the coming national based systems).

Also note that there is a conflict with the snd-intel8x0
kernel module (they each try to grab the LPC bus). You can
either: load the tpm modules first (such as in initrd or
rc.sysinit, before sound), or recompile the snd-intel8x0, turning
off the MIDI and JOYSTICK support. The latest 2.6.11 version
of snd-intel8x0 also reportedly fixes things."

Compiling this library was easy. Compiling the driver on my 2.6.8-686 (debian testing) laptop failed. But the library works with the driver I compiled from the tpm-2.0 package IBM made available on its pages (see the links below).

Gijs

The T43 requires a patch posted to the LKML by Kylene Jo Hall: [http://marc.theaimsgroup.com/?l=linux-kernel&m=111884603309146&w=2 LKML posting]. An updated patch for linux 2.6.12 is available [http://shamrock.dyndns.org/~ln/linux/tpm_2.6.12.diff here].

The atmel driver comes with 2.6.12.
----
now suported in 2.6.15.1(and mabe others kernels under this number) in:

/device drivers/caracter devices/tpm devices

==Versions & Features==
=== Embedded Security Chip ===
IBM introduced it's TCPA/TCG features with some of the [[:Category:T23|T23]] models. The earlier of them didn't yet have the Embedded Security Subsystem, but a kind of pre 1.0 version called the Embedded Security Chip. This chip had the following capabilities:
*Data communications authentication and encryption
*Storage of encrypted passwords

=== Embedded Security Subsystem (1.0) ===
The original Embedded Security Subsystem (in IBM documents there is no use of the additive version-number 1.0) claims to be compliant with TCG specs, but apparently did not fully implement any specific TCG spec.

The Embedded Security Subsystem has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security

=== Embedded Security Subsystem 2.0 ===
The Embedded Security Subsystem 2.0 conforms to the TCG TPM 1.1b specification, with a TPM manufactured by either Atmel or National Semiconductor.

The Embedded Security Subsystem 2.0 has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security
*TCG compliant

==Models featuring this Technology==
===IBM Embedded Security Chip===
*ThinkPad {{T23}}
===IBM Embedded Security Subsystem===
*ThinkPad {{A30p}}
*ThinkPad {{R31}}
*ThinkPad {{T23}}, {{T30}}, {{T41}}
*ThinkPad {{X22}}, {{X23}}, {{X24}}

===IBM Embedded Security Subsystem 2.0===
*ThinkPad {{R32}}, {{R40}}, {{R50}}, {{R50p}}, {{R51}}, {{R51e}}, {{R52}}
*ThinkPad {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}
*ThinkPad {{X30}}, {{X31}}, {{X32}}, {{X40}}, {{X41}}, {{X41T}}, {{X60}}, {{X60s}}
*ThinkPad {{Z60m}}, {{Z60t}}
[[Category:Glossary]] [[Category:Trusted Computing]]

==TCPA/TCG clean models==
*all models produced before 2000
*all i Series models
*ThinkPad [[:Category:240X|240X]]
*ThinkPad [[:Category:A20m|A20m]], [[:Category:A20p|A20p]], [[:Category:A21e|A21e]], [[:Category:A21m|A21m]], [[:Category:A21p|A21p]], [[:Category:A22e|A22e]], [[:Category:A22m|A22m]], [[:Category:A22p|A22p]], [[:Category:A30|A30]]
*ThinkPad [[:Category:R50e|R50e]]
*ThinkPad [[:Category:T20|T20]], [[:Category:T21|T21]], [[:Category:T22|T22]]
*ThinkPad [[:Category:X20|X20]], [[:Category:X21|X21]], [[:Category:X22|X22]]
*ThinkPad [[:Category:TransNote|TransNote]]

==External Sources==
*[http://www.pc.ibm.com/us/think/thinkvantagetech/security.html IBMs ThinkVantage<sup>TM</sup> Technologies Embedded Security Subsystem page]
*[http://www.pc.ibm.com/presentations/us/thinkvantage/56/index.html?shortcut=ess& IBMs ThinkVantage<sup>TM</sup> Technologies Flash presentation - Embedded Security Subsystem]
*[http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page]
*[http://www.prosec.rub.de/trusted_grub.html Trusted Grub]

Rescue and Recovery

2006-10-17T15:18:49Z

CarlosLiu: /* Proper MBR */ add new path

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Rescue and Recovery===
Rescue and Recovery version 3.0 consists of a bootable partition containing various system recovery tools, including full recovery of the preinstalled Windows XP partition. It can be activated by pressing the {{ibmkey|ThinkPad|#494949}}, {{ibmkey|Access IBM|#495988}} or {{ibmkey|ThinkVantage|#495988}} [[ThinkPad Button|Button]] during system boot. It contains a FAT filesystem (labeled "IBM_SERVICE"), and has partition type 0x12 ("Compaq diagnostics" in <tt>fdisk</tt>).

As opposed to a [[Hidden Protected Area|Hidden Protected Area]] Recovery partitions are ordinary partitions, accessible through the partition table. As they are ordinary partitions they are accessible by ordinary partitioning tools. They should be dealt carefully with.
</div>
|}
==Proper MBR==
{{WARN|Only tinker with the MBR and the Rescue and Recovery partition if you know what you're doing. Mistakes can leave the system unbootable and can make it very difficult to retrieve the data on the harddisk.}}

Consideration 6 of the Readme states:
<blockquote>"The Master Boot Record (MBR) must be configured properly for the Rescue and Recovery application to function properly. When possible, the Rescue and Recovery application attempts to ensure the proper configuration of the MBR. This can only occur if the Rescue and Recovery application is installed after other applications that requires the MBR."</blockquote>

Apparently, the MBR is not "configured properly" if LILO or GRUB have written it. The following is the case:
*the default bootloader seems to ignore the active bit and always boots the first partition instead
*the default bootloader contains code to catch a press of the appropriate button during bootup and launch the Rescue and Recovery application in that case
*before launching the Rescue and Recovery application at system boot, the default bootloader changes the partition type of the Rescue and Recovery partiton to 0x0b, otherwise it changes it to 0x12 (to hide it from Windows)
*the Rescue and Recovery application assumes that the first partition contains Windows
*the Rescue and Recovery partition needs to be of type 0x0b (FAT32) otherwise the default bootloader will not launch the Rescue and Recovery application

Since neither LILO nor GRUB catch the press of the button (an undocumented mechanism anyway) it is not possible to launch the Rescue and Recovery application by pressing the appropriate button during system boot, once LILO or GRUB have altered the MBR for their boot procedure.

IBM provides a program to manage the Rescue and Recovery bootloader. It is located in {{path|C:\Program Files\IBM ThinkVantage\Common\BMGR}} or {{path|C:\Program Files\Common Files\Lenovo\BMGR}}. It can select the partition to boot, and also allows for rewriting the MBR if it was written by another bootloader.

===MBR written by GRUB===
If the MBR was written by GRUB you can still use GRUB to launch the Rescue and Recovery application. However if you leave the type of the Rescue and Recovery partition to 0x12 (Compaq diagnostics), this will result in an error message "c000021a, Fatal System Error" if you try to launch it. To avoid that and to make sure the recovery partition always is of the right type, add a line to change the partition type to 0x0b to the Rescue and Recovery partition's entry in your {{path|/boot/grub/menu.lst}}. Assuming your Rescue and Recovery partition is the second partition, it could look like this:
title IBM Rescue and Recovery
root (hd0,1)
'''parttype (hd0,1) 0x0b'''
'''unhide (hd0,1)'''
chainloader +1

Also add an <tt>unhide</tt> line here because we are going to hide the Rescue and Recovery partition on every boot of Windows, so we need to unhide it, when the recovery partition is booted. This is because if we don't hide the partition when booting Windows, it would be visible and accessable there and that's not what we want. So, assuming that Windows is on the first partition, the Windows entry could now look like this:
title Windows
root (hd0,0)
'''hide (hd0,1)'''
chainloader +1

===GRUB in a partitions boot sector===
A way to have your Access IBM button still functional on bootup, is to create a separate {{path|/boot}} partition, install GRUB to that partition and make it active. This will leave the MBR untouched.
{{NOTE|If the above finding is true that the MBR ignores the active bit, that partition has to be the first one. In most recent Linux distributions it is not easy to create /boot as first partition and shrink the Windows partition. In that case the Windows bootloader can be used to boot Windows and Linux, also preserving the Rescue and Recovery functionality. See below.}}
*In the BIOS, set the IBM Predesktop Area to 'Secure'.
*Boot your Linux distribution's installation CD.
*Follow the instructions and go through the regular installation process.
*Create a primary partition for /boot (the other stuff can go into the extended partitions) and when the time comes to install GRUB, make sure you install it into the boot sector of the boot partition.
*Set this boot partition as active.

===Using NTLDR to boot Linux===
It is possible to configure the Windows bootloader to also boot Linux (installed on separate partition). This allows to preserve the Rescue and Recovery functionality at system boot (as MBR is not modified), Windows XP (booted via its native bootloader) and Linux (booted from its own partition by Windows XP bootloader). A quick and dirty howto, regarding applying this procedure to Ubuntu Dapper Drake installation can be found [http://gawrysiak.org/corvus/?p=4 here].

==Older versions of Rescue and Recovery==
Some Thinkpads (e.g., T23 and T30) do not come with a Recovery CD, but also do not support the [[Hidden Protected Area]]. These ThinkPads have an older version of Rescue and Recovery preloaded on the hard disk to implement the factory recovery function. Most of the comments above also apply to the older versions, with the following differences:
*The recovery partition type is 0x1c, hidden FAT32, LBA-mapped (or 0xc when unhidden).
*The boot manager program is in {{path|C:\IBMTOOLS\RECOVERY}} and only runs in a 16-bit DOS environment
{{Fixme|name of this boot manager needed}}
*The IBM Predesktop area runs atop of Windows 98 (command-line) instead of WinPE

==External Sources==
* IBM page on [http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-4Q2QAK ThinkVantage Rescue and Recovery].
* [ftp://ftp.software.ibm.com/pc/pccbbs/thinkvantage_en/tvtrnr3_1027en.txt Rescue and Recovery Readme]
* [http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-46088 IBM page about accessing the Recovery Partition if Linux has been installed and the F11 button no longer works]
* [http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-54483 IBM Rescue and Recovery repair diskette]

==Models featuring this technology==
* ThinkPad {{T23}}, {{T30}} (R&R 2.0)
* ThinkPad {{T42}}
* ThinkPad {{T43}}, {{T43p}}
* ThinkPad {{R52}}
* ThinkPad {{Z60m}}

[[Category:Glossary]]

Installing Ubuntu 5.04 on a ThinkPad T43 (1875)

2006-10-17T13:22:36Z

CarlosLiu: fix link

I installed {{Ubuntu}} 5.04 "Hoary Hedgehog" on a IBM {{T43}} 1875-E5U.

Before starting the installation, make a copy of the IBM system restore CD's. You can do this in Windows by going to the Access IBM Start Menu option, and clicking on Create Rescue Cd's. '''This is extremely important!!!''' In case you erase your IBM system rescue partition, or remove the BootLoader, these CD's are the only way you can restore your machine to Factory settings. You'll need six blank CD's, or one blank CD and one blank DVD, if you have a DVD-Writer.

Once this is done, install as usual. The only gotcha is the installation of the Boot-loader. There is a method by which you can save your current MBR, so that you don't lose the Access IBM button's functionaltiy, but I don't know it. Please update this page if you know (Note: See section on [[#Getting_Access_IBM_to_Work_1|Partitioning]] at the bottom of this page). (Additional note: As of Ubuntu 5.10, if one chooses to resize existing partitions during installation without making other changes, both the factory-installed Windows and IBM recovery partitions are preserved.)

I installed grub in the MBR of my hard disk. After rebooting, the Access IBM button was not working anymore. My rescue partition would not boot. After the text based installation ended, Ubuntu said that it starting X. Then I got a blank screen.

(See below for an alternative means of booting the rescue partition if this happens to you.)

My machine has the [[Intel Graphics Media Accelerator 900]] installed. To get X working, I had to edit the x.org file. I did this in the following manner:

*Press {{key|Ctrl}}{{key|Alt}}{{key|F2}} to get a Virtual Terminal
*Login as the user you made while installing
*{{cmduser|sudo cp /etc/X11/xorg.conf /etc/X11/xorg.conf.backup}} (keep a backup)
*{{cmduser|sudo vi /etc/X11/xorg.conf}}
*scroll down to this section
Section "Device"
Identifier "Intel Corporation Intel Default Card "
Driver "i810"
BusID "PCI:0:2:0"
EndSection
*Change Driver "i810" to Driver "vesa"
*save and exit

After this, I used {{key|Ctrl}}{{key|Alt}}{{key|F7}} to come back to the X terminal, then {{key|Ctrl}}{{key|ALt}}{{key|Backspace}} to restart it. X started successfully.

The next thing to do was use the excellent [http://ubuntuguide.org Unofficial Ubuntu Guide] to set up various things.

After hunting around on the net, I came across two excellent guides. These are [http://columbia.edu/~em36/ubuntuhoarythinkpadt42.html Edward Mendelson's guide to Ubuntu on a T42] and [http://aaltonen.us/archive/2005/03/02/ubuntu-linux-on-the-ibm-thinkpad-t42/ aaltonen.us Ubuntu Guide]

I have reproduced sections from these two guides. The authors have been notified of this.

== Install a kernel for your Pentium 4 CPU ==

Use the Gnome menu System | Administration | Synaptic Package Manager, and search and install the two packages linux-686 and (while you are here) build-essential. The first of these installs the version of the kernel that specifically supports Pentium 4; the second provides essential files for â€œbuildingâ€ other programs if necessary. Reboot. The 686 kernel should be at the top of the list of boot options. Boot into it.

== Enable sleep and hibernation ==

Open a terminal and enter these commands:

:{{cmduser|sudo cp /etc/default/acpi-support /etc/default/acpi-support-backup}}
:{{cmduser|sudo gedit /etc/default/acpi-support}}

Edit the file by removing the # character at the beginning of the line that will look like this when the character is removed:

ACPI_SLEEP=true

Save the file. Next, in the terminal, enter:

:{{cmduser|sudo cp /boot/grub/menu.lst /boot/grub/menu.lst-backup2}}
:{{cmduser|sudo gedit /boot/grub/menu.lst}}

and go to the line starting with <tt>#kopt</tt>. Add the following at the end of the existing line (replace <tt>/dev/hda5</tt> with your swap partition, which you can identify by entering the command {{cmdroot|fdisk -l}} in the terminal

resume=/dev/hda5 vga=0x318

The <tt>vga=0x318</tt> string forces the text-mode display during boot-up and shutdown to display in 50-line mode instead of the ugly 25-line mode. This string is perfect for a 1024x768 screen, but you might want something different. You might want to consult this full list of VGA modes for Linux. The #kopt line should look something like this (if you do not find the strings {{bootparm|pci|noacpi}} and {{bootparm|acpi_sleep|s3_bios}} then add them also)

# kopt=root=/dev/hda1 ro pci=noacpi acpi_sleep=s3_bios resume=/dev/hda5 vga=0x318

If you intend to run the command {{cmduser|sudo update-grub}} after you save the file, then save the file now. If you do not intend to run that command, then add these strings by hand to the kernel line that launches Ubuntu and reboot.

To suspend to RAM (sleep), press the ThinkPadâ€™s sleep button ({{key|Fn}}{{key|F4}}); to wake up the system, press the {{key|Fn}} key, wait a few seconds, and press {{key|Ctrl}}{{key|Alt}}{{key|Backspace}} to restart the Xwindow graphic system.

To suspend to disk (hibernate), press the ThinkPad's hibernate button ({{key|Fn}}{{key|F12}}), or use the option to hibernate the computer on the logout menu. Press the power button to wake the system; the desktop should reappear automatically.

== Install on-screen confirmation of the ThinkPad buttons ==

The program tpb (ThinkPad Buttons) makes all the ThinkPad-specific buttons and Fn-key combinations work as expected (some buttons, such as the ones that control screen brightness, are hardware-controlled and work under any operating system). As explained by Michael R Head in his post in this [http://ubuntuforums.org/showthread.php?t=24685 thread] , the Ubuntu Hoary version of tpb does not support on-screen display (OSD) of the results of your actions. To correct this, download the latest Debian version of the program from the [http://packages.debian.org/stable/utils/tpb Debian.org] site (scroll down to the box under the heading "Download tpb").

Open a terminal, use the cd command to navigate to the directory in which you downloaded the package and enter:

sudo dpkg -i tpb*

On the Gnome menu, use System | Preferences | Sessions | Startup Programs and use the Add button to add the following command:

tpb -d

If you want the Access IBM button to start your screensaver, open a terminal and enter these commands:

sudo cp /etc/tpbrc /etc/tpbrc-backup
sudo gedit /etc/tpbrc

Edit the file by adding this line below the line that begins #THINKPAD /usr/bin, etc.:

THINKPAD /usr/bin/xscreensaver-command -activate

Save the file. In the terminal, run man tpb to learn about other ways to use the Access IBM button.

I believe some of the following steps may have performed automagically during installation (I simply don't remember whether they were or not), but you should perform all the steps anyway to make certain that everything is set up correctly.

First, in a terminal, enter the commands (replacing [username] with your username):

echo nvram | sudo tee -a /etc/modules
sudo addgroup nvram
sudo adduser [username] nvram

I don't pretend to understand exactly what this does, but the first line adds the string "nvram" at the end of the file /etc/modules; the next two lines create a group called nvram and add yourself to the group. Next, enter these commands in the terminal:

cd /etc/udev/permissions.d
sudo cp udev.permissions udev.permissions-backup
sudo gedit udev.permissions

Edit the file to make sure these lines are present (add them if necessary, perhaps to the top of the second set of lines under the heading # character devices:

misc/nvram:root:nvram:660
nvram:root:nvram:660

Save the file and reboot.

Note: the tpb program does not provide visual confirmation for the Fn+F5 button that toggles the wireless radio, but the button does toggle the radio on and off, exactly as it does in Windows. The indicator light works as well.

== Enable TrackPoint middle-button scrolling ==

To use the blue middle TrackPoint button as a scroll wheel, do the following. In a terminal, enter these commands:

sudo cp /etc/X11/xorg.conf /etc/X11/xorg.conf-backup
sudo gedit /etc/X11/xorg.conf

In the editor, find the section headed Section â€œInputDeviceâ€ / Identifier â€œConfigured Mouseâ€ and the following lines above the â€œEndSectionâ€ line:

Option "EmulateWheel" "true"
Option "EmulateWheelButton" "2"

Save the file. Logout, restart X with Ctrl-Alt-Backspace, and log in again.

== Don't slow down boot-up by synchronizing with network time ==

Ubuntu pauses during boot-up while attempting to synchronize the system clock with a remote time server, but you probably aren't connected to the internet when you boot with a ThinkPad, so this attempt accomplishes nothing. Eliminate this delay by opening a terminal and entering:

sudo gedit /etc/init.d/ntpdate

Change the line 20 from

/usr/sbin/ntpdate -b -s $NTPOPTIONS $NTPSERVERS

to

/usr/sbin/ntpdate -b -s $NTPOPTIONS $NTPSERVERS &

Now the ntp process is detached and boot-up can continue while the clock is been synchronized.

== Don't slow down boot-up when no Ethernet cable is attached ==

In Synaptic find and install the ifplugd package. After installing it, open a terminal and run this command

sudo gedit /etc/default/ifplugd

Edit the file by modify the lines INTERFACES="" and HOTPLUG_INTERFACES="" if no interfaces are listed or if the wrong interfaces are listed. You probably only want to test the hotplug status of the wired Ethernet connection, so the lines should read:

INTERFACES="eth0"
HOTPLUG_INTERFACES="eth0"

I don't pretend to understand these options fully, so please post corrections if I'm wrong. I've also modified the ARGS= line to add the string -b which silences the otherwise excessive beeping when you plug or unplug the cable. Save the file and reboot.

== Getting Access IBM to Work {{footnote|1}}==

'''IMPORTANT NOTE'''

This is for readers with T40 or T41 notebooks, which try to have all: Windows, working Access IBM and linux.

What is described below this note will work only in case that your IBM PreDesktop Area is in a system partition. (Visible "ordinary" partition of usually 3 - 5GB size, with type ID 0x12.)

Older Thinkpads like T40(p) or T41(p) use a HPA (Hidden Protected Area) instead of this system partition for this PreDesktop Area. Unfortunately the linux kernel disables this area (every time non preventable?) at boot time and if you later choose "Use largest unpartitioned space" during ubuntu installation, you will destroy the HPA. Additionally GRUB will write this "altered" geometry (with disabled HPA) into the MBR. This leads to a totally broken system. After reboot windows will boot to bluescreen (Unmountable Volume) and Access IBM will not work as well. It seems that the special IBM MBR has to be there for accessing the hidden partitions in the HPA.
So far, I could not yet install ubuntu (preserving winxp (with security chip on) and preserving IBM PreDesktop Area, with success. Any ideas very welcome. (I will try to partition manually and install GRUB or LILO NOT to MBR and report the results.)

'''Partitioning'''

The great thing about the Ubuntu installer is that it is able to resize NTFS partitions. Just choose the manual partitioning option, select the XP partition and change it's size. The partition should not be fragmented as this may cause problems during resizing. Doesn't hurt to run the XP drive defragmentation tool before shrinking the partition this way.

The 80GB disk of my T42 had two partitions on it:
-Windows XP taking up around 75 GB
-5GB IBM Rescue system you can boot into by pressing the blue {{ibmkey|Access IBM|#495988}} key during startup. Interesting thing, seems to contain a complete OS including Opera browser, somehow looks like Win 3.11 or 95.

As the disk is large enough, I decided to keep both systems. I changed the size of the windows partition to around 20 GB and created my new partitions in the now free space between xp and ibm rescue partition:

Disk /dev/hda: 80.0 GB, 80026361856 bytes
16 heads, 63 sectors/track, 155061 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 1 38760 19535008+ 7 HPFS/NTFS
/dev/hda2 145411 155055 4861080 12 Compaq diagnostics
/dev/hda3 38761 43127 2200905 82 Linux swap / Solaris
/dev/hda4 43127 145398 51544552+ 5 Extended
/dev/hda5 43127 81887 19535008+ 83 Linux
/dev/hda6 81887 145398 32009481 83 Linux

hda5 will become the root fs, hda6 my {{path|/home}} partition.

'''Grub installation'''

I told the Ubuntu installer to install Grub into the MBR. The following entries in {{path|/boot/grub/menu.lst}} allow to boot Windows and the IBM rescue system:

# IBM rescue partition on /dev/hda2
title IBM Rescue
root (hd0,1)
# savedefault
makeactive
chainloader +1

# Win XP on /dev/hda1
title Microsoft Windows XP Professional
root (hd0,0)
savedefault
makeactive
chainloader +1

I don't remember if the installer added those automatically, or if I did so, anymore. Just make sure they are there.
Check if everything works

You should now be able to boot into all three systems without problems.

{{footnotes|
#The above excerpt has been taken from [http://www.jkraemer.net/knowhow/t42_ubuntu.html jkraemer.net] which describes installing Ubuntu on an IBM T42. The same steps should be applicable to the T43 as well. If you encounter problems getting Access IBM working please describe them here.
# The following link describes how to set-up dual boot while still being able to use the access key [http://sharadware.com/2005/07/11/suse-linux-winxp-access-ibm-on-the-thinkpad-t43/]
}}

'''An Additional Note about Booting to the IBM Recovery Partition'''

During installation I also installed GRUB to the MBR, thus wiping out the original one from IBM (which their tech support people then confirmed could not be recovered except by completely restoring to factory-shipped state). The installation program did successfully auto-detect the IBM Recovery partition, and added it to the GRUB menu. However, when I tried booting into it, the sequence only just began, then went to a blue error screen unable to complete the process. I later discovered that this partition was set to type 0x12 ("Compaq Diagnostics"), when in fact it should be 0x0b ("W95 FAT32"). I ran fdisk -l to find which partition was the IBM Recovery one. Then, fdisk /dev/sda (or hda, etc., depending on your system), command t (type), partition number 2 (whichever one you determine to be the recovery), changed to type 0b. Relist to double-check; it should now read W95 FAT32 for the partition in the partition table. Then, remember to use the command w to write the changes to the disk (without this it does nothing of course). I rebooted the system, choose the IBM Recovery partition from the GRUB menu, and now it worked just fine.

== Conclusion ==

In the end, Ubuntu turned out to be a beautiful distro to install. Most of it "just worked", and with a little tweaking, I have reached a level of functionality that eluded me with Suse.

Here's a quick summary.

Worked out of the Box:
Sound, Networking (wired and wireless), Power Management, Hibernate, ThinkPad Buttons (without OSD)

Worked after little tweaking:
Sleep, Middle button scrolling, ThinkPad Buttons OSD.

Did not Work:
IBM Rescue and Recovery Partition. Don't forget to make the Rescue CD's