Commit Graph

14719 Commits

Author SHA1 Message Date
Steve Langasek
ac32067c63 If we don't have writable grubenv and we're on EFI, always show the menu
If we don't have writable grubenv, recordfail doesn't work, which means our
quickboot behavior - with a timeout of 0 - leaves the user without a
reliable way to access the boot menu if they're on UEFI, because unlike
BIOS, UEFI does not support checking the state of modifier keys (i.e.
holding down shift at boot is not detectable).

Handle this corner case by always using a non-zero timeout on EFI when
save_env doesn't work.

Reuse GRUB_RECORDFAIL_TIMEOUT to avoid introducing another variable.
2019-06-24 08:13:18 +01:00
Steve McIntyre
c11b8c616a Deal with --force-extra-removable with signed shim too
In this case, we need both the signed shim as /EFI/BOOT/BOOTXXX.EFI
and signed Grub as /EFI/BOOT/grubXXX.efi.

Also install the BOOTXXX.CSV into /EFI/debian, and FBXXX.EFI into
/EFI/BOOT/ so that it can work when needed (*iff* we're updating the
NVRAM).

[cjwatson: Refactored also_install_removable somewhat for brevity and so
that we're using consistent case-insensitive logic.]

Bug-Debian: https://bugs.debian.org/930531
Last-Update: 2019-06-14

Patch-Name: grub-install-removable-shim.patch
2019-06-24 08:12:05 +01:00
Peter Jones
c2f1fd9710 Forbid the "devicetree" command when Secure Boot is enabled.
Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Steve McIntyre <93sam@debian.org>

Origin: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927888#15
Bug-Debian: https://bugs.debian.org/927888
Last-Update: 2019-05-04

Patch-Name: no-devicetree-if-secure-boot.patch
2019-06-24 08:12:05 +01:00
Alexander Graf
f726c80c38 arm: Align section alignment with manual relocation offset code
The arm relocation code has a manual special case for EFI binaries to
add the natural alignment to its own relocation awareness.

Since commit a51f953f4e ("mkimage: Align efi sections on 4k
boundary") we changed that alignment from 0x400 to 0x1000 bytes. Reflect
the change in that branch that we forgot as well.

This fixes running 32bit arm grub efi binaries for me again.

Fixes: a51f953f4e ("mkimage: Align efi sections on 4k boundary")
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reported-by: Steve McIntyre <steve@einval.com>
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
Tested-by: Julien ROBIN <julien.robin28@free.fr>
Tested-by: Leif Lindholm <leif.lindholm@linaro.org>

Bug-Debian: https://bugs.debian.org/927269
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2019-04/msg00132.html
Last-Update: 2019-05-03

Patch-Name: arm-align-section-alignment-with-manual-reloc-offset.patch
2019-06-24 08:12:05 +01:00
Alexander Graf
184866f804 arm: Move trampolines into code section
When creating T32->A32 transition jumps, the relocation code in grub
will generate trampolines. These trampolines live in the .data section
of our PE binary which means they are not marked as executable.

This misbehavior was unmasked by commit a51f953f4e ("mkimage: Align
efi sections on 4k boundary") which made the X/NX boundary more obvious
because everything became page aligned.

To put things into proper order, let's move the arm trampolines into the
.text section instead. That way everyone knows they are executable.

Fixes: a51f953f4e ("mkimage: Align efi sections on 4k boundary")
Reported-by: Julien ROBIN <julien.robin28@free.fr>
Reported-by: Leif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
Tested-by: Julien ROBIN <julien.robin28@free.fr>
Tested-by: Leif Lindholm <leif.lindholm@linaro.org>

Bug-Debian: https://bugs.debian.org/927269
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2019-04/msg00131.html
Last-Update: 2019-05-03

Patch-Name: arm-move-trampolines-into-code-section.patch
2019-06-24 08:12:05 +01:00
Colin Watson
027a69e392 Minimise writes to EFI variable storage
Some UEFI firmware is easily provoked into running out of space in its
variable storage.  This is usually due to certain kernel drivers (e.g.
pstore), but regardless of the cause it can cause grub-install to fail
because it currently asks efibootmgr to delete and re-add entries, and
the deletion often doesn't result in an immediate garbage collection.
Writing variables frequently also increases wear on the NVRAM which may
have limited write cycles.  For these reasons, it's desirable to find a
way to minimise writes while still allowing grub-install to ensure that
a suitable boot entry exists.

Unfortunately, efibootmgr doesn't offer an interface that would let
grub-install do this.  It doesn't in general make very much effort to
minimise writes; it doesn't allow modifying an existing Boot* variable
entry, except in certain limited ways; and current versions don't have a
way to export the expected variable data so that grub-install can
compare it to the current data.  While it would be possible (and perhaps
desirable?) to add at least some of this to efibootmgr, that would still
leave the problem that there isn't a good upstreamable way for
grub-install to guarantee that it has a new enough version of
efibootmgr.  In any case, it's cumbersome and slow for grub-install to
have to fork efibootmgr to get things done.

Fortunately, a few years ago Peter Jones helpfully factored out a
substantial part of efibootmgr to the efivar and efiboot libraries, and
so it's now possible to have grub-install use those directly.  We still
have to use some code from efibootmgr, but much less than would
previously have been necessary.

grub-install now reuses existing boot entries where possible, and avoids
writing to variables when the new contents are the same as the old
contents.  In the common upgrade case where nothing needs to change, it
no longer writes to NVRAM at all.  It's also now slightly faster, since
using libefivar is faster than forking efibootmgr.

Fixes Debian bug #891434.

Signed-off-by: Colin Watson <cjwatson@ubuntu.com>

Bug-Debian: https://bugs.debian.org/891434
Forwarded: https://lists.gnu.org/archive/html/grub-devel/2019-03/msg00119.html
Last-Update: 2019-03-23

Patch-Name: efi-variable-storage-minimise-writes.patch
2019-06-24 08:12:05 +01:00
Colin Watson
8dba354cdd Add %X to grub_vsnprintf_real and friends
This is needed for UEFI Boot* variables, which the standard says are
named using upper-case hexadecimal.

Signed-off-by: Colin Watson <cjwatson@ubuntu.com>

Bug-Debian: https://bugs.debian.org/891434
Forwarded: https://lists.gnu.org/archive/html/grub-devel/2019-03/msg00121.html
Last-Update: 2019-03-23

Patch-Name: vsnprintf-upper-case-hex.patch
2019-06-24 08:12:05 +01:00
Hervé Werner
467a98b72e Fix setup on Secure Boot systems where cryptodisk is in use
On full-encrypted systems, including /boot, the current code omits
cryptodisk commands needed to open the drives if Secure Boot is enabled.
This prevents grub2 from reading any further configuration residing on
the encrypted disk.
This patch fixes this issue by adding the needed "cryptomount" commands in
the load.cfg file that is then copied in the EFI partition.

Bug-Debian: https://bugs.debian.org/917117
Last-Update: 2019-02-10

Patch-Name: uefi-secure-boot-cryptomount.patch
2019-06-24 08:12:05 +01:00
Jeroen Dekkers
3163e0876f at_keyboard: initialize keyboard in module init if keyboard is ready
The change in 0c62a5b2 caused at_keyboard to fail on some
machines. Immediately initializing the keyboard in the module init if
the keyboard is ready makes the problem go away.

Bug-Debian: https://bugs.debian.org/741464
Last-Update: 2019-02-09

Patch-Name: at_keyboard-module-init.patch
2019-06-24 08:12:05 +01:00
Matthew Garrett
b2cacea4f3 Don't enforce Shim signature validation if Secure Boot is disabled
The linuxefi command fails if used on a system without shim, even if
Secure Boot is disabled. There's no need to do the validation if we're
not in Secure Boot mode (an attacker could just boot a modified grub),
so skip this to make it easier to use the Linux EFI entry point even on
non-Secure Boot systems.

Last-Update: 2018-12-07

Patch-Name: linuxefi-skip-validation-without-secure-boot.patch
2019-06-24 08:12:05 +01:00
Colin Watson
1a4a2d3257 bash-completion: Drop "have" checks
These don't work with and aren't needed by dynamically-loaded
completions.

Bug-Debian: https://bugs.debian.org/912852
Forwarded: no
Last-Update: 2018-11-16

Patch-Name: bash-completion-drop-have-checks.patch
2019-06-24 08:12:05 +01:00
Colin Watson
acf98b5689 Skip flaky grub_cmd_set_date test
Bug-Debian: https://bugs.debian.org/906470
Last-Update: 2018-10-28

Patch-Name: skip-grub_cmd_set_date.patch
2019-06-24 08:12:05 +01:00
Luca Boccassi
1890bd10c9 Do not overwrite sentinel byte in boot_params, breaks lockdown
grub currently copies the entire boot_params, which includes setting
sentinel byte to 0xff, which triggers sanitize_boot_params in the kernel
which in turn clears various boot_params variables, including the
indication that the bootloader chain is verified and thus the kernel
disables lockdown mode.  According to the information on the Fedora bug
tracker, only the information from byte 0x1f1 is necessary, so start
copying from there instead.

Author: Luca Boccassi <bluca@debian.org>
Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1418360
Forwarded: no

Patch-Name: fix-lockdown.patch
2019-06-24 08:12:05 +01:00
Michael Chang
6bd9eb79f6 efinet: Setting DNS server from UEFI protocol
In the URI device path node, any name rahter than address can be used for
looking up the resources so that DNS service become needed to get answer of the
name's address. Unfortunately the DNS is not defined in any of the device path
nodes so that we use the EFI_IP4_CONFIG2_PROTOCOL and EFI_IP6_CONFIG_PROTOCOL
to obtain it.

These two protcols are defined the sections of UEFI specification.

 27.5 EFI IPv4 Configuration II Protocol
 27.7 EFI IPv6 Configuration Protocol

include/grub/efi/api.h:
Add new structure and protocol UUID of EFI_IP4_CONFIG2_PROTOCOL and
EFI_IP6_CONFIG_PROTOCOL.

grub-core/net/drivers/efi/efinet.c:
Use the EFI_IP4_CONFIG2_PROTOCOL and EFI_IP6_CONFIG_PROTOCOL to obtain the list
of DNS server address for IPv4 and IPv6 respectively. The address of DNS
servers is structured into DHCPACK packet and feed into the same DHCP packet
processing functions to ensure the network interface is setting up the same way
it used to be.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: efinet-set-dns-from-uefi-proto.patch
2019-06-24 08:12:05 +01:00
Michael Chang
fa804a2c72 efinet: Setting network from UEFI device path
The PXE Base Code protocol used to obtain cached PXE DHCPACK packet is no
longer provided for HTTP Boot. Instead, we have to get the HTTP boot
information from the device path nodes defined in following UEFI Specification
sections.

 9.3.5.12 IPv4 Device Path
 9.3.5.13 IPv6 Device Path
 9.3.5.23 Uniform Resource Identifiers (URI) Device Path

This patch basically does:

include/grub/efi/api.h:
Add new structure of Uniform Resource Identifiers (URI) Device Path

grub-core/net/drivers/efi/efinet.c:
Check if PXE Base Code is available, if not it will try to obtain the netboot
information from the device path where the image booted from. The DHCPACK
packet is recoverd from the information in device patch and feed into the same
DHCP packet processing functions to ensure the network interface is setting up
the same way it used to be.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: efinet-set-network-from-uefi-devpath.patch
2019-06-24 08:12:05 +01:00
Michael Chang
e500f75f15 bootp: Add processing DHCPACK packet from HTTP Boot
The vendor class identifier with the string "HTTPClient" is used to denote the
packet as responding to HTTP boot request. In DHCP4 config, the filename for
HTTP boot is the URL of the boot file while for PXE boot it is the path to the
boot file. As a consequence, the next-server becomes obseleted because the HTTP
URL already contains the server address for the boot file. For DHCP6 config,
there's no difference definition in existing config as dhcp6.bootfile-url can
be used to specify URL for both HTTP and PXE boot file.

This patch adds processing for "HTTPClient" vendor class identifier in DHCPACK
packet by treating it as HTTP format, not as the PXE format.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: bootp-process-dhcpack-http-boot.patch
2019-06-24 08:12:05 +01:00
Michael Chang
a97959a038 efinet: UEFI IPv6 PXE support
When grub2 image is booted from UEFI IPv6 PXE, the DHCPv6 Reply packet is
cached in firmware buffer which can be obtained by PXE Base Code protocol. The
network interface can be setup through the parameters in that obtained packet.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: efinet-uefi-ipv6-pxe-support.patch
2019-06-24 08:12:05 +01:00
Michael Chang
ba5846ff8d bootp: New net_bootp6 command
Implement new net_bootp6 command for IPv6 network auto configuration via the
DHCPv6 protocol (RFC3315).

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: bootp-new-net_bootp6-command.patch
2019-06-24 08:12:05 +01:00
Aaron Miller
969aca16c8 net: read bracketed ipv6 addrs and port numbers
Allow specifying port numbers for http and tftp paths, and allow ipv6 addresses
to be recognized with brackets around them, which is required to specify a port
number

Patch-Name: net-read-bracketed-ipv6-addr.patch
2019-06-24 08:12:05 +01:00
Chad MILLER
eaf81c2c30 Tell zpool to emit full device names
zfs-initramfs currently provides extraneous, undesired symlinks to
devices directly underneath /dev/ to satisfy zpool's historical output
of unqualified device names. By including this environment variable to
signal our intent to zpool, zfs-linux packages can drop the symlink
behavior when updating to its upstream or backported output behavior.

Bug: https://savannah.gnu.org/bugs/?43653
Bug-Debian: https://bugs.debian.org/824974
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1527727
Last-Update: 2016-11-01

Patch-Name: zpool-full-device-name.patch
2019-06-24 08:12:05 +01:00
Colin Watson
71821e672d Generate alternative init entries in advanced menu
Add fallback boot entries for alternative installed init systems.  Based
on patches from Michael Biebl and Didier Roche.

Bug-Debian: https://bugs.debian.org/757298
Bug-Debian: https://bugs.debian.org/773173
Forwarded: no
Last-Update: 2017-06-23

Patch-Name: mkconfig-other-inits.patch
2019-06-24 08:12:05 +01:00
Steve McIntyre
dd437efb05 Add support for forcing EFI installation to the removable media path
Add an extra option to grub-install "--force-extra-removable". On EFI
platforms, this will cause an extra copy of the grub-efi image to be
written to the appropriate removable media patch
/boot/efi/EFI/BOOT/BOOT$ARCH.EFI as well. This will help with broken
UEFI implementations where the firmware does not work when configured
with new boot paths.

Signed-off-by: Steve McIntyre <93sam@debian.org>

Bug-Debian: https://bugs.debian.org/767037 https://bugs.debian.org/773092
Forwarded: Not yet
Last-Update: 2014-12-20

Patch-Name: grub-install-extra-removable.patch
2019-06-24 08:12:05 +01:00
Ian Campbell
053cbb1bbb Arrange to insmod xzio and lzopio when booting a kernel as a Xen guest
This is needed in case the Linux kernel is compiled with CONFIG_KERNEL_XZ or
CONFIG_KERNEL_LZO rather than CONFIG_KERNEL_GZ (gzio is already loaded by
grub.cfg today).

Signed-off-by: Ian Campbell <ijc@debian.org>

Bug-Debian: https://bugs.debian.org/755256
Forwarded: http://lists.gnu.org/archive/html/grub-devel/2014-11/msg00091.html
Last-Update: 2014-11-30

Patch-Name: insmod-xzio-and-lzopio-on-xen.patch
2019-06-24 08:12:05 +01:00
Ian Campbell
9cc8bea223 grub-install: Install PV Xen binaries into the upstream specified path
Upstream have defined a specification for where guests ought to place their
xenpv grub binaries in order to facilitate chainloading from a stage 1 grub
loaded from dom0.

http://xenbits.xen.org/docs/unstable-staging/misc/x86-xenpv-bootloader.html

The spec calls for installation into /boot/xen/pvboot-i386.elf or
/boot/xen/pvboot-x86_64.elf.

Signed-off-by: Ian Campbell <ijc@hellion.org.uk>

Bug-Debian: https://bugs.debian.org/762307
Forwarded: http://lists.gnu.org/archive/html/grub-devel/2014-10/msg00041.html
Last-Update: 2014-10-24

Patch-Name: grub-install-pvxen-paths.patch

---
v2: Respect bootdir, create /boot/xen as needed.
2019-06-24 08:12:05 +01:00
Paulo Flabiano Smorigo
40ba76638e Disable VSX instruction
VSX bit is enabled by default for Power7 and Power8 CPU models,
so we need to disable them in order to avoid instruction exceptions.
Kernel will activate it when necessary.

* grub-core/kern/powerpc/ieee1275/startup.S: Disable VSX.

Also-By: Adhemerval Zanella <azanella@linux.vnet.ibm.com>
Also-By: Colin Watson <cjwatson@debian.org>

Origin: other, https://lists.gnu.org/archive/html/grub-devel/2014-09/msg00078.html
Last-Update: 2015-01-27

Patch-Name: ppc64el-disable-vsx.patch
2019-06-24 08:12:05 +01:00
Paulo Flabiano Smorigo
037b33d161 Include a text attribute reset in the clear command for ppc
Always clear text attribute for clear command in order to avoid problems
after it boots.

* grub-core/term/terminfo.c: Add escape for text attribute reset

Bug-Ubuntu: https://bugs.launchpad.net/bugs/1295255
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2014-09/msg00076.html
Last-Update: 2014-09-26

Patch-Name: ieee1275-clear-reset.patch
2019-06-24 08:12:05 +01:00
Colin Watson
84ec123a97 Port yaboot logic for various powerpc machine types
Some powerpc machines require not updating the NVRAM.  This can be handled
by existing grub-install command-line options, but it's friendlier to detect
this automatically.

On chrp_ibm machines, use the nvram utility rather than nvsetenv.  (This
is possibly suitable for other machines too, but that needs to be
verified.)

Forwarded: no
Last-Update: 2014-10-15

Patch-Name: install-powerpc-machtypes.patch
2019-06-24 08:12:05 +01:00
Colin Watson
d3300cabc9 Add GRUB_RECOVERY_TITLE option
This allows the controversial "recovery mode" text to be customised.

Bug-Ubuntu: https://bugs.launchpad.net/bugs/1240360
Forwarded: no
Last-Update: 2013-12-25

Patch-Name: mkconfig-recovery-title.patch
2019-06-24 08:12:05 +01:00
Colin Watson
8595788e30 Ignore functional test failures for now as they are broken
See: https://lists.gnu.org/archive/html/grub-devel/2013-11/msg00242.html

Forwarded: not-needed
Last-Update: 2013-11-19

Patch-Name: ignore-grub_func_test-failures.patch
2019-06-24 08:12:05 +01:00
Colin Watson
d84e33f358 Probe FusionIO devices
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1237519
Forwarded: no
Last-Update: 2016-09-18

Patch-Name: probe-fusionio.patch
2019-06-24 08:12:05 +01:00
Colin Watson
de75edd1ba Add configure option to use vt.handoff=7
This is used for non-recovery Linux entries only; it enables
flicker-free booting if gfxpayload=keep is in use and a suitable kernel
is present.

Author: Andy Whitcroft <apw@canonical.com>
Forwarded: not-needed
Last-Update: 2013-12-25

Patch-Name: vt-handoff.patch
2019-06-24 08:12:05 +01:00
Evan Broder
1db27ffb50 Add configure option to enable gfxpayload=keep dynamically
Set GRUB_GFXPAYLOAD_LINUX=keep unless it's known to be unsupported on
the current hardware.  See
https://blueprints.launchpad.net/ubuntu/+spec/packageselection-foundations-n-grub2-boot-framebuffer.

Author: Colin Watson <cjwatson@ubuntu.com>
Forwarded: no
Last-Update: 2019-05-25

Patch-Name: gfxpayload-dynamic.patch
2019-06-24 08:12:05 +01:00
Steve Langasek
3c02896b98 If we don't have writable grubenv and we're on EFI, always show the menu
If we don't have writable grubenv, recordfail doesn't work, which means our
quickboot behavior - with a timeout of 0 - leaves the user without a
reliable way to access the boot menu if they're on UEFI, because unlike
BIOS, UEFI does not support checking the state of modifier keys (i.e.
holding down shift at boot is not detectable).

Handle this corner case by always using a non-zero timeout on EFI when
save_env doesn't work.

Reuse GRUB_RECORDFAIL_TIMEOUT to avoid introducing another variable.

Signed-off-by: Steve Langasek <steve.langasek@canonical.com>

Bug-Ubuntu: https://bugs.launchpad.net/bugs/1800722
Last-Update: 2019-06-24

Patch-Name: quick-boot-lvm.patch
2019-06-24 08:11:26 +01:00
Will Thompson
168de09385 Fix --disable-quiet-boot
QUIET_BOOT is always defined: it is 1 if --enable-quiet-boot is passed
to configure, and 0 otherwise. But every CPP conditional was based on
whether it is defined or not; so the --enable-quiet-boot code paths were
in fact always enabled.
2019-06-24 08:00:55 +01:00
Colin Watson
8569b69ca9 Add configure option to bypass boot menu if possible
If other operating systems are installed, then automatically unhide the
menu.  Otherwise, if GRUB_HIDDEN_TIMEOUT is 0, then use keystatus if
available to check whether Shift is pressed.  If it is, show the menu,
otherwise boot immediately.  If keystatus is not available, then fall
back to a short delay interruptible with Escape.

This may or may not remain Ubuntu-specific, although it's not obviously
wanted upstream.  It implements a requirement of
https://wiki.ubuntu.com/DesktopExperienceTeam/KarmicBootExperienceDesignSpec#Bootloader.

If the previous boot failed (defined as failing to get to the end of one
of the normal runlevels), then show the boot menu regardless.

Author: Richard Laager <rlaager@wiktel.com>
Author: Robie Basak <robie.basak@ubuntu.com>
Forwarded: no
Last-Update: 2015-09-04

Patch-Name: quick-boot.patch
2019-06-24 07:59:34 +01:00
Steve McIntyre
5254a0a3d9 Deal with --force-extra-removable with signed shim too
In this case, we need both the signed shim as /EFI/BOOT/BOOTXXX.EFI
and signed Grub as /EFI/BOOT/grubXXX.efi.

Also install the BOOTXXX.CSV into /EFI/debian, and FBXXX.EFI into
/EFI/BOOT/ so that it can work when needed (*iff* we're updating the
NVRAM).

[cjwatson: Refactored also_install_removable somewhat for brevity and so
that we're using consistent case-insensitive logic.]

Bug-Debian: https://bugs.debian.org/930531
Last-Update: 2019-06-14

Patch-Name: grub-install-removable-shim.patch
2019-06-24 07:59:34 +01:00
Colin Watson
c685231480 Cope with Kubuntu setting GRUB_DISTRIBUTOR
This is not a very good approach, and certainly not sanely upstreamable;
we probably need to split GRUB_DISTRIBUTOR into a couple of different
variables.

Bug-Ubuntu: https://bugs.launchpad.net/bugs/1242417
Forwarded: not-needed
Last-Update: 2013-12-25

Patch-Name: install-efi-ubuntu-flavours.patch
2019-06-24 07:59:34 +01:00
Peter Jones
edd35e8a75 Forbid the "devicetree" command when Secure Boot is enabled.
Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Steve McIntyre <93sam@debian.org>

Origin: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927888#15
Bug-Debian: https://bugs.debian.org/927888
Last-Update: 2019-05-04

Patch-Name: no-devicetree-if-secure-boot.patch
2019-06-24 07:59:34 +01:00
Alexander Graf
d488a4318f arm: Align section alignment with manual relocation offset code
The arm relocation code has a manual special case for EFI binaries to
add the natural alignment to its own relocation awareness.

Since commit a51f953f4e ("mkimage: Align efi sections on 4k
boundary") we changed that alignment from 0x400 to 0x1000 bytes. Reflect
the change in that branch that we forgot as well.

This fixes running 32bit arm grub efi binaries for me again.

Fixes: a51f953f4e ("mkimage: Align efi sections on 4k boundary")
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reported-by: Steve McIntyre <steve@einval.com>
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
Tested-by: Julien ROBIN <julien.robin28@free.fr>
Tested-by: Leif Lindholm <leif.lindholm@linaro.org>

Bug-Debian: https://bugs.debian.org/927269
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2019-04/msg00132.html
Last-Update: 2019-05-03

Patch-Name: arm-align-section-alignment-with-manual-reloc-offset.patch
2019-06-24 07:59:34 +01:00
Alexander Graf
81c1c61223 arm: Move trampolines into code section
When creating T32->A32 transition jumps, the relocation code in grub
will generate trampolines. These trampolines live in the .data section
of our PE binary which means they are not marked as executable.

This misbehavior was unmasked by commit a51f953f4e ("mkimage: Align
efi sections on 4k boundary") which made the X/NX boundary more obvious
because everything became page aligned.

To put things into proper order, let's move the arm trampolines into the
.text section instead. That way everyone knows they are executable.

Fixes: a51f953f4e ("mkimage: Align efi sections on 4k boundary")
Reported-by: Julien ROBIN <julien.robin28@free.fr>
Reported-by: Leif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
Tested-by: Julien ROBIN <julien.robin28@free.fr>
Tested-by: Leif Lindholm <leif.lindholm@linaro.org>

Bug-Debian: https://bugs.debian.org/927269
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2019-04/msg00131.html
Last-Update: 2019-05-03

Patch-Name: arm-move-trampolines-into-code-section.patch
2019-06-24 07:59:34 +01:00
Colin Watson
c8828f5808 Minimise writes to EFI variable storage
Some UEFI firmware is easily provoked into running out of space in its
variable storage.  This is usually due to certain kernel drivers (e.g.
pstore), but regardless of the cause it can cause grub-install to fail
because it currently asks efibootmgr to delete and re-add entries, and
the deletion often doesn't result in an immediate garbage collection.
Writing variables frequently also increases wear on the NVRAM which may
have limited write cycles.  For these reasons, it's desirable to find a
way to minimise writes while still allowing grub-install to ensure that
a suitable boot entry exists.

Unfortunately, efibootmgr doesn't offer an interface that would let
grub-install do this.  It doesn't in general make very much effort to
minimise writes; it doesn't allow modifying an existing Boot* variable
entry, except in certain limited ways; and current versions don't have a
way to export the expected variable data so that grub-install can
compare it to the current data.  While it would be possible (and perhaps
desirable?) to add at least some of this to efibootmgr, that would still
leave the problem that there isn't a good upstreamable way for
grub-install to guarantee that it has a new enough version of
efibootmgr.  In any case, it's cumbersome and slow for grub-install to
have to fork efibootmgr to get things done.

Fortunately, a few years ago Peter Jones helpfully factored out a
substantial part of efibootmgr to the efivar and efiboot libraries, and
so it's now possible to have grub-install use those directly.  We still
have to use some code from efibootmgr, but much less than would
previously have been necessary.

grub-install now reuses existing boot entries where possible, and avoids
writing to variables when the new contents are the same as the old
contents.  In the common upgrade case where nothing needs to change, it
no longer writes to NVRAM at all.  It's also now slightly faster, since
using libefivar is faster than forking efibootmgr.

Fixes Debian bug #891434.

Signed-off-by: Colin Watson <cjwatson@ubuntu.com>

Bug-Debian: https://bugs.debian.org/891434
Forwarded: https://lists.gnu.org/archive/html/grub-devel/2019-03/msg00119.html
Last-Update: 2019-03-23

Patch-Name: efi-variable-storage-minimise-writes.patch
2019-06-24 07:59:34 +01:00
Colin Watson
2405e7b54d Add %X to grub_vsnprintf_real and friends
This is needed for UEFI Boot* variables, which the standard says are
named using upper-case hexadecimal.

Signed-off-by: Colin Watson <cjwatson@ubuntu.com>

Bug-Debian: https://bugs.debian.org/891434
Forwarded: https://lists.gnu.org/archive/html/grub-devel/2019-03/msg00121.html
Last-Update: 2019-03-23

Patch-Name: vsnprintf-upper-case-hex.patch
2019-06-24 07:59:34 +01:00
Hervé Werner
f9b40555ab Fix setup on Secure Boot systems where cryptodisk is in use
On full-encrypted systems, including /boot, the current code omits
cryptodisk commands needed to open the drives if Secure Boot is enabled.
This prevents grub2 from reading any further configuration residing on
the encrypted disk.
This patch fixes this issue by adding the needed "cryptomount" commands in
the load.cfg file that is then copied in the EFI partition.

Bug-Debian: https://bugs.debian.org/917117
Last-Update: 2019-02-10

Patch-Name: uefi-secure-boot-cryptomount.patch
2019-06-24 07:59:34 +01:00
Jeroen Dekkers
629825d649 at_keyboard: initialize keyboard in module init if keyboard is ready
The change in 0c62a5b2 caused at_keyboard to fail on some
machines. Immediately initializing the keyboard in the module init if
the keyboard is ready makes the problem go away.

Bug-Debian: https://bugs.debian.org/741464
Last-Update: 2019-02-09

Patch-Name: at_keyboard-module-init.patch
2019-06-24 07:59:34 +01:00
Matthew Garrett
13cd3e22d3 Don't enforce Shim signature validation if Secure Boot is disabled
The linuxefi command fails if used on a system without shim, even if
Secure Boot is disabled. There's no need to do the validation if we're
not in Secure Boot mode (an attacker could just boot a modified grub),
so skip this to make it easier to use the Linux EFI entry point even on
non-Secure Boot systems.

Last-Update: 2018-12-07

Patch-Name: linuxefi-skip-validation-without-secure-boot.patch
2019-06-24 07:59:34 +01:00
Colin Watson
86aaa7e7c1 bash-completion: Drop "have" checks
These don't work with and aren't needed by dynamically-loaded
completions.

Bug-Debian: https://bugs.debian.org/912852
Forwarded: no
Last-Update: 2018-11-16

Patch-Name: bash-completion-drop-have-checks.patch
2019-06-24 07:59:34 +01:00
Colin Watson
763b79e93d Skip flaky grub_cmd_set_date test
Bug-Debian: https://bugs.debian.org/906470
Last-Update: 2018-10-28

Patch-Name: skip-grub_cmd_set_date.patch
2019-06-24 07:59:34 +01:00
Luca Boccassi
ba7c2b16f3 Do not overwrite sentinel byte in boot_params, breaks lockdown
grub currently copies the entire boot_params, which includes setting
sentinel byte to 0xff, which triggers sanitize_boot_params in the kernel
which in turn clears various boot_params variables, including the
indication that the bootloader chain is verified and thus the kernel
disables lockdown mode.  According to the information on the Fedora bug
tracker, only the information from byte 0x1f1 is necessary, so start
copying from there instead.

Author: Luca Boccassi <bluca@debian.org>
Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1418360
Forwarded: no

Patch-Name: fix-lockdown.patch
2019-06-24 07:59:34 +01:00
Michael Chang
abc4d99c4d efinet: Setting DNS server from UEFI protocol
In the URI device path node, any name rahter than address can be used for
looking up the resources so that DNS service become needed to get answer of the
name's address. Unfortunately the DNS is not defined in any of the device path
nodes so that we use the EFI_IP4_CONFIG2_PROTOCOL and EFI_IP6_CONFIG_PROTOCOL
to obtain it.

These two protcols are defined the sections of UEFI specification.

 27.5 EFI IPv4 Configuration II Protocol
 27.7 EFI IPv6 Configuration Protocol

include/grub/efi/api.h:
Add new structure and protocol UUID of EFI_IP4_CONFIG2_PROTOCOL and
EFI_IP6_CONFIG_PROTOCOL.

grub-core/net/drivers/efi/efinet.c:
Use the EFI_IP4_CONFIG2_PROTOCOL and EFI_IP6_CONFIG_PROTOCOL to obtain the list
of DNS server address for IPv4 and IPv6 respectively. The address of DNS
servers is structured into DHCPACK packet and feed into the same DHCP packet
processing functions to ensure the network interface is setting up the same way
it used to be.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: efinet-set-dns-from-uefi-proto.patch
2019-06-24 07:59:34 +01:00
Michael Chang
083d30ef94 efinet: Setting network from UEFI device path
The PXE Base Code protocol used to obtain cached PXE DHCPACK packet is no
longer provided for HTTP Boot. Instead, we have to get the HTTP boot
information from the device path nodes defined in following UEFI Specification
sections.

 9.3.5.12 IPv4 Device Path
 9.3.5.13 IPv6 Device Path
 9.3.5.23 Uniform Resource Identifiers (URI) Device Path

This patch basically does:

include/grub/efi/api.h:
Add new structure of Uniform Resource Identifiers (URI) Device Path

grub-core/net/drivers/efi/efinet.c:
Check if PXE Base Code is available, if not it will try to obtain the netboot
information from the device path where the image booted from. The DHCPACK
packet is recoverd from the information in device patch and feed into the same
DHCP packet processing functions to ensure the network interface is setting up
the same way it used to be.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Ken Lin <ken.lin@hpe.com>

Patch-Name: efinet-set-network-from-uefi-devpath.patch
2019-06-24 07:59:34 +01:00