Skip to content

Commit

Permalink
HP workaround as default without define
Browse files Browse the repository at this point in the history
  • Loading branch information
neusdan committed Aug 11, 2015
1 parent d34e4a8 commit e1aa8eb
Show file tree
Hide file tree
Showing 4 changed files with 7 additions and 12 deletions.
5 changes: 1 addition & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,10 +69,7 @@ In order to use the TCG-enhanced TrustedGRUB2, you need a computer which has TCG

### 1.5 Known Bugs / Limitations

* On some HP notebooks and workstations, TrustedGRUB2 is not able to do the kernel measurements due to a buggy BIOS. This means PCR 8,9 can contain bogus values. This seems to be especially the case if the core.img is bigger than 64KB.
* For this We probably have found a workaround: HP desktop/laptop BIOS seems to be unable to handle blocks ending on 512 byte boundaries when measuring data. So we increase the number of bytes to read by 1 and also the number of sectors to read, which ensures that all bytes of core.img are read. For this to work correctly the loaded core.img must be padded with zeroes or some other fixed value. grub_mkimage has already been adjusted to pad core.img with zeroes to a 512 byte alignment. The missing zero byte has to be added by yourself. The workaround can be found in diskboot.S . Further uncomment `/* #define TGRUB_HP_WORKAROUND */` in tpm.h

If you find any bugs, create an issue or send a mail to trustedgrub@sirrix.com
If you find any bugs, create an issue on github

### 1.6 Configuring TrustedGRUB2 before installation

Expand Down
7 changes: 3 additions & 4 deletions grub-core/boot/i386/pc/diskboot.S
Original file line number Diff line number Diff line change
Expand Up @@ -69,20 +69,19 @@ _start:
* will ever be a core.img larger than that. ;-) */
shll $9, %eax

#ifdef TGRUB_HP_WORKAROUND
/* HP workaround
* This is a workaround for HP desktop/laptop BIOS which seem to be
* unable to handle blocks ending on 512 byte boundaries when measuring
* data. So we increase the number of bytes to read by 1 and also the
* number of sectors to read, which ensures that all bytes of core.img
* are read. For this to work correctly the loaded core.img must be
* padded with zeroes or some other fixed value:
* 1) pad core.img with zeroes to 512 byte blocks. Already done by grub_mkimage adjustment
* 2) append 1 extra zero byte to core.img. Has to be done by yourself.
* 1) pad core.img with zeroes to 512 byte blocks.
* 2) append 1 extra zero byte to core.img.
* Step 1 and 2 are already implemented in grub_mkimage
* */
inc %eax /* add 1 to number_of_bytes_to_measure */
incw 8(%di) /* make code below read 1 more sector than specified */
#endif

/* write result to number_of_bytes_to_measure var */
movl %eax, number_of_bytes_to_measure
Expand Down
2 changes: 0 additions & 2 deletions include/grub/i386/pc/tpm.h
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@

/* #define TGRUB_DEBUG */

/* #define TGRUB_HP_WORKAROUND */

#ifdef TGRUB_DEBUG
#define DEBUG_PRINT( x ) grub_printf x
#else
Expand Down
5 changes: 3 additions & 2 deletions util/mkimage.c
Original file line number Diff line number Diff line change
Expand Up @@ -1402,9 +1402,10 @@ grub_install_generate_image (const char *dir, const char *prefix,
free (boot_path);

/* BEGIN TCG EXTENSION */

/* To simplify measurement the core.img should be 512 byte aligned */
/* HP workaround */
/* core.img size has to be core_size % 512 != 0 */
size_t newCoreImgSize = ALIGN_UP (core_size, 512);
newCoreImgSize++;

void* newCoreImg = xmalloc (newCoreImgSize);
memset (newCoreImg, 0, newCoreImgSize);
Expand Down

2 comments on commit e1aa8eb

@mtahmed
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am curious why this workaround was made the default. Until #18 is fixed, can this commit be reverted? Along those same lines, does reverting this commit automatically disable the HP workaround by default?

@neusdan
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll fix this in the next few days

Please sign in to comment.