coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-20 15:03:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

GRUB: update to rev 2.14-rc1 December 2025

Browse Source 
The argon2 patches were dropped (PHC implementation),
because GRUB has now its own Argon2 KDF implementation
as part of its recent libgcrypt update.

Argon2 support is therefore retained, but GNU's implementation
has replaced the one that Libreboot previously used.

This brings in the following upstream changes:

* 280715ec6 Release 2.14~rc1
* e549317e1 windows: Fix symbol table generation during module conversion from PE to ELF
* a340750f9 windows: Fix relocation sections generation during module conversion from PE to ELF
* c602035a9 loader/efi/linux: Fix compile error with Clang
* f62269767 build: Add tpm2key.asn file for reference to dist archive
* 46be4488f build: Include new zstd test support files in dist archive
* fa79d5ea9 build: Include MAINTAINERS and SECURITY files in dist archive
* 8271bcc13 build: Add appended signatures header file to EXTRA_DIST
* 11845da2b lib/xzembed/xz_dec_stream: Replace grub_memcpy() call with memcpy()
* 7ded35fea bootstrap: Fix patching warnings
* 4129e9ad6 tss2: Always init out buffer before calling tpm2_submit_command_real()
* 000e48b42 fs/ntfs: Correct next_attribute validation
* 5ff9c43cf kern/ieee1275/init: Use net config for boot location instead of firmware bootpath
* c2cae77ab net/tftp: Fix NULL pointer dereference in grub_net_udp_close()
* fadc94b91 net/dns: Prevent UAF and double free
* cd24e2591 net/bootp: Prevent a UAF in network interface unregister
* fca6c0afd docs: Document lsmemregions and memtools commands
* 42c099786 commands/memtools: Add lsmemregions command
* 20211246a tests/file_filter: Add zstd tests
* 092449f63 tests/file_filter: Add zstd test file
* 356dcac9a tests/file_filter: Regenerate gpg keys
* 8ea83c3ee io/zstdio: Implement zstdio decompression
* 7c22c1000 fs/btrfs: Update doc link for bootloader support
* 6435551a6 docs: Add Btrfs env block and special env vars
* b63447748 util/grub.d/00_header.in: Wire grub.cfg to use env_block when present
* e4e177661 fs/btrfs: Add environment block to reserved header area
* d6525f0e6 util/grub-editenv: Add probe call for external envblk
* 4b5ea8dca util/grub-editenv: Wire list_variables() to optional fs_envblk
* 84e2bc2f1 util/grub-editenv: Wire unset_variables() to optional fs_envblk
* c7c901916 util/grub-editenv: Wire set_variables() to optional fs_envblk
* 2abdd8cd2 util/grub-editenv: Add fs_envblk write helper
* e4d684cc4 util/grub-editenv: Add fs_envblk open helper
* 512e33ec7 tests: Add "z" length modifier printf tests
* 3c9762b12 kern/misc: Add the "z" length modifier support
* 91ddada64 disk/cryptodisk: Add --hw-accel to enable hardware acceleration
* f8f68f14a libgcrypt: Add hardware acceleration for gcry_sha512
* 70b2f5f08 libgcrypt: Add hardware acceleration for gcry_sha256
* 2158d8e8a libgcrypt: Declare the sha256 shaext function
* 0ff5faf8c libgcrypt: Implement _gcry_get_hw_features()
* 812356191 libgcrypt: Copy sha512 x86_64 assembly files
* 7f9c590af libgcrypt: Copy sha256 x86_64 assembly files
* 8423176f1 lib/hwfeatures-gcry: Enable SSE and AVX for x86_64 EFI
* 06a5b88ba lib/hwfeatures-gcry: Introduce functions to manage hardware features
* d01abd713 configure: Tweak autoconf/automake files to detect x86_64 features
* a122e0262 lib/pbkdf2: Optimize PBKDF2 by reusing HMAC handle
* 961e38b2b lib/crypto: Introduce new HMAC functions to reuse buffers
* 59304a7b5 docs: Document argon2 and argon2_test modules
* 28dbe8a3b kern/misc: Implement faster grub_memcpy() for aligned buffers
* da01eb0c5 tests/util/grub-fs-tester: Use Argon2id for LUKS2 test
* c1bd9fc82 tests: Integrate Argon2 tests into functional_test
* 6a525ee64 tests: Import Argon2 tests from libgcrypt
* 6052fc2cf disk/luks2: Add Argon2 support
* 66b8718f9 argon2: Introduce grub_crypto_argon2()
* de201105d libgcrypt/kdf: Fix 64-bit modulus on 32-bit platforms
* 93544861b libgcrypt/kdf: Remove unsupported KDFs
* 1ff720641 libgcrypt/kdf: Get rid of gpg_err_code_from_errno()
* 0c06a454f libgcrypt/kdf: Implement hash_buffers() for BLAKE2b-512
* bc94dfd54 crypto: Update crypto.h for libgcrypt KDF functions
* 5b81f490c util/import_gcry: Import kdf.c for Argon2
* 6b5c671d3 commands/menuentry: Fix for out of bound access
* 21cdcb125 tests/tpm2_key_protector_test: Add a test for PCR Capping
* afddba012 tpm2_key_protector: Support PCR capping
* ae7a39900 tss2: Implement grub_tcg2_cap_pcr() for emu
* 7b39970e9 tss2: Implement grub_tcg2_cap_pcr() for ieee1275
* 39f98e471 tss2: Implement grub_tcg2_cap_pcr() for EFI
* d47d261ec tss2: Introduce grub_tcg2_cap_pcr()
* b2549b4d3 tss2: Add TPM2_PCR_Event command
* e1b9d92a8 loader/i386/linux: Transfer EDID information to kernel
* a8379e693 fs/hfsplus: Allow reading files created by Mac OS 9
* c5ff0d616 docs: Fix build warnings in libgcrypt and blsuki doc
* fa93f2412 kern/command,commands/extcmd: Perform explicit NULL check in both the unregister helpers
* 9a725391f commands/efi/tpm: Call get_active_pcr_banks() only with TCG2 1.1 or newer
* 894241c85 kern: Include function name on debug and error print functions
* 75a20cc14 kern: Make grub_error() more verbose
* 8abbafa49 net/tcp: Fix TCP port number reused on reboot
* 3dff10a97 docs/grub: Document appended signature
* 0f2dda8cf docs/grub: Document signing GRUB with an appended signature
* 0b59d379f docs/grub: Document signing GRUB under UEFI
* dbfa3d7d7 appended signatures: Verification tests
* 7f68c7195 appended signatures: GRUB commands to manage the hashes
* 6cb58b1c9 appended signatures: GRUB commands to manage the certificates
* ab7b17717 appended signatures: Using db and dbx lists for signature verification
* 97f7001e1 appended signatures: Create db and dbx lists
* b5e872417 appended signatures: Introducing key management environment variable
* 76158ed1a powerpc/ieee1275: Read the db and dbx secure boot variables
* 069f3614e appended signatures: Support verifying appended signatures
* f8e8779d8 powerpc/ieee1275: Enter lockdown based on /ibm, secure-boot
* e95c52f1f appended signatures: Parse X.509 certificates
* a33754979 appended signatures: Parse PKCS#7 signed data
* 3e4ff6ffb appended signatures: Parse ASN1 node
* 7d28bdb0b appended signatures: Import GNUTLS's ASN.1 description files
* 1fca5f397 grub-install: Support embedding x509 certificates
* aefe0de22 pgp: Rename OBJ_TYPE_PUBKEY to OBJ_TYPE_GPG_PUBKEY
* f826cc8b0 crypto: Move storage for grub_crypto_pk_* to crypto.c
* 31cc7dfe5 powerpc/ieee1275: Add support for signing GRUB with an appended signature
* ee789e1a6 lib/b64dec: Use grub_size_t instead of size_t for _gpgrt_b64dec_proc() function definition
* abb8fb6d1 util/grub-mkimagexx: Fix riscv32 relocation offset
* 1f9092bfd libgcrypt: Allow GRUB to build with Clang
* 1d2ee8f8b tests: Add test ISO files to dist package
* dfa3dbf61 tests: Test dates outside of 32-bit Unix range
* 6837293b8 lib/datetime: Support dates outside of 1901..2038 range
* 02788bfdf bootstrap: Ensure shallow gnulib clone works on newer git
* 4e42199f3 docs: Correct some URLs
* 733cc28eb docs: Update Future section to reflect current release
* 54c8573ef docs: Document new libgrypt modules
* 1562dee69 docs: Clarify section heading and fix wording
* cf1b75a14 BUGS: Update to point to bug tracking system
* 236663dfb INSTALL: Document libtasn1 needed for grub-protect
* 7bfb38627 po: Update translations to build with gettext 0.26
* 49e76ad16 term/efi/console: Treat key.scan_code 0x0102 (suspend) as Enter
* de72f3998 util/bash-completion.d/Makefile.am: s/mkrescure/mkrescue/g
* 14c2966c7 blsuki: Add uki command to load Unified Kernel Image entries
* 5190df851 blsuki: Check for mounted /boot in emu
* 51b960132 util/misc.c: Change offset type for grub_util_write_image_at()
* 8cee1c284 blsuki: Add blscfg command to parse Boot Loader Specification snippets
* e016d6d60 kern/misc: Implement grub_strtok()
* 587db89af kern/xen: Add Xen command line parsing
* b2a975bc5 include/xen/xen.h: Add warning comment for cmd_line
* 19c698d12 zfs: Fix LINUX_ROOT_DEVICE when grub-probe fails
* 6898fcf74 relocator: Switch to own page table while moving chunks
* 67a95527b configure: Generate tar-ustar tarball instead of tar-v7
* 29d515b4c build: Add new libgcrypt and libtasn1 related files to EXTRA_DISTS
* eb76b064d build: Add util/import_gcrypt_inth.sed to EXTRA_DISTS
* eb56a6af9 include/xen/xen.h: Rename MAX_GUEST_CMDLINE to GRUB_XEN_MAX_GUEST_CMDLINE
* 80df5e132 loader/arm64/xen_boot: Set correctly bootargs property for modules
* 6831d242a loader/efi/linux: Return correct size from LoadFile2
* f326c5c47 commands/bli: Set LoaderTpm2ActivePcrBanks runtime variable
* 0e367796c docs: Write how to import new libgcrypt
* b930bfa37 libgcrypt: Fix a memory leak
* d48c277c4 libgcrypt: Don't use 64-bit division on platforms where it's slow
* de49514c9 util/import_gcry: Fix pylint warnings
* 334353a97 util/import_gcry: Make compatible with Python 3.4
* 2a6de4209 libgcrypt: Import blake family of hashes
* e54187912 libgcrypt: Ignore sign-compare warnings
* e3b78e49c libgcrypt: Remove now unneeded compilation flag
* e23704ad4 libgcrypt: Fix Coverity warnings
* d65810b01 keccak: Disable acceleration with SSE asm
* f808ef0d2 tests: Add DSA and RSA SEXP tests
* 0739d24cd libgcrypt: Adjust import script, definitions and API users for libgcrypt 1.11
* 3e1c2890b b64dec: Add harness for compilation in GRUB environment
* 5ca0d5e41 b64dec: Import b64dec from gpg-error
* 3312af6e0 libgcrypt: Import libgcrypt 1.11
* a0d4c94ef loader/efi/linux: Use shim loader image handle where available
* 1b9a84e63 loader/efi/chainloader: Use shim loader image handle where available
* e31d0cd7f efi/sb: Add API for retrieving shim loader image handles
* ed7e053a3 efi/sb: Add support for the shim loader protocol
* 70897d3d3 efi: Provide wrappers for load_image, start_image and unload_image
* 030a70fca loader/arm64/xen_boot: Consider alignment calling grub_arch_efi_linux_boot_image()
* e82609a47 loader/arm64/xen_boot: Use bool instead of int
* d1a470b69 loader/arm64/xen_boot: Remove correctly all modules loaded by xen_module command
* cf5e52fa8 dl: Fix grub_dl_is_persistent() for emu
This commit is contained in:
Leah Rowe
2025-12-23 19:19:07 +01:00
parent 8b338404e8
commit 512cce0770
58 changed files with 145 additions and 8725 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+3 -3
View File
@@ -1,7 +1,7 @@
From dae0cfdbb484eb3576300ad9c4d2c362f4e8fa64 Mon Sep 17 00:00:00 2001
From 3334727192bca5c64e9e1321da23c4b1e745deb2 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Sun, 31 Oct 2021 03:47:05 +0000
Subject: [PATCH 01/14] mitigate grub's missing characters for borders/arrow
Subject: [PATCH 1/8] mitigate grub's missing characters for borders/arrow
characters
This cleans up the display on the main screen in GRUB.
@@ -86,5 +86,5 @@ index 9c383e64a..8ec1dd1e8 100644
grub_term_highlight_color = old_color_highlight;
geo->timeout_y = geo->first_entry_y + geo->num_entries
--
2.39.5
2.47.3
config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
+5 -5
View File
@@ -1,17 +1,17 @@
From 25ae072be49c23abffff657085c16ac3780b8cda Mon Sep 17 00:00:00 2001
From cc6d74da1a6a77935e094601f4f212cd410f5b53 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Sat, 19 Nov 2022 16:30:24 +0000
Subject: [PATCH 02/14] say the name libreboot, in the grub menu
Subject: [PATCH 2/8] say the name libreboot, in the grub menu
---
grub-core/normal/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index 96abfda2f..d806db9c4 100644
index de9a3f961..1fabb9c86 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -215,7 +215,7 @@ grub_normal_init_page (struct grub_term_output *term,
grub_term_cls (term);
@@ -21,5 +21,5 @@ index 96abfda2f..d806db9c4 100644
return;
--
2.39.5
2.47.3
config/grub/default/patches/0003-Add-CC0-license.patch
-42
View File
@@ -1,42 +0,0 @@
From e9969b4ee38e3d9fda1fdff02e127830d7fdf2ec Mon Sep 17 00:00:00 2001
From: Ax333l <main@axelen.xyz>
Date: Thu, 17 Aug 2023 00:00:00 +0000
Subject: [PATCH 03/14] Add CC0 license
Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
---
grub-core/kern/dl.c | 3 ++-
util/grub-module-verifierXX.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
index de8c3aa8d..4a3be8568 100644
--- a/grub-core/kern/dl.c
+++ b/grub-core/kern/dl.c
@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
|| grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
- || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv2+") == 0)
+ || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv2+") == 0
+ || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=CC0") == 0)
return GRUB_ERR_NONE;
return grub_error (GRUB_ERR_BAD_MODULE,
diff --git a/util/grub-module-verifierXX.c b/util/grub-module-verifierXX.c
index a42c20bd1..7157a30aa 100644
--- a/util/grub-module-verifierXX.c
+++ b/util/grub-module-verifierXX.c
@@ -236,7 +236,8 @@ check_license (const char * const filename,
Elf_Shdr *s = find_section (arch, e, ".module_license", module_size);
if (s && (strcmp ((char *) e + grub_target_to_host(s->sh_offset), "LICENSE=GPLv3") == 0
|| strcmp ((char *) e + grub_target_to_host(s->sh_offset), "LICENSE=GPLv3+") == 0
- || strcmp ((char *) e + grub_target_to_host(s->sh_offset), "LICENSE=GPLv2+") == 0))
+ || strcmp ((char *) e + grub_target_to_host(s->sh_offset), "LICENSE=GPLv2+") == 0
+ || strcmp ((char *) e + grub_target_to_host(s->sh_offset), "LICENSE=CC0") == 0))
return;
grub_util_error ("%s: incompatible license", filename);
}
--
2.39.5
config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch → config/grub/default/patches/0003-at_keyboard-coreboot-force-scancodes2-translate.patch
+3 -3
View File
@@ -1,7 +1,7 @@
From fc815438e70cbb13166ab6711b6f6460521b1fd4 Mon Sep 17 00:00:00 2001
From d5aead07155d6eeb36971c0a2e5ee1392a025f91 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Mon, 30 Oct 2023 22:19:21 +0000
Subject: [PATCH 09/14] at_keyboard coreboot: force scancodes2+translate
Subject: [PATCH 3/8] at_keyboard coreboot: force scancodes2+translate
Scan code set 2 with translation should be assumed in
every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
if (ps2_state.current_set == 2)
--
2.39.5
2.47.3
config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
-39
View File
@@ -1,39 +0,0 @@
From 421a44b2f8211fa46ea523fc0feeaba9940af0e7 Mon Sep 17 00:00:00 2001
From: Ax333l <main@axelen.xyz>
Date: Thu, 17 Aug 2023 00:00:00 +0000
Subject: [PATCH 04/14] Define GRUB_UINT32_MAX
Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
---
include/grub/types.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/include/grub/types.h b/include/grub/types.h
index 45079bf65..8c0b30395 100644
--- a/include/grub/types.h
+++ b/include/grub/types.h
@@ -156,6 +156,7 @@ typedef grub_int32_t grub_ssize_t;
#define GRUB_SHRT_MAX 0x7fff
#define GRUB_SHRT_MIN (-GRUB_SHRT_MAX - 1)
#define GRUB_UINT_MAX 4294967295U
+#define GRUB_UINT32_MAX 4294967295U
#define GRUB_INT_MAX 0x7fffffff
#define GRUB_INT_MIN (-GRUB_INT_MAX - 1)
#define GRUB_INT32_MAX 2147483647
@@ -177,6 +178,13 @@ typedef grub_int32_t grub_ssize_t;
#define GRUB_TYPE_U_MAX(type) ((unsigned long long)((typeof (type))(~0)))
#define GRUB_TYPE_U_MIN(type) 0ULL
+# define GRUB_UINT32_C(x) x ## U
+# if GRUB_ULONG_MAX >> 31 >> 31 >> 1 == 1
+# define GRUB_UINT64_C(x) x##UL
+# elif 1
+# define GRUB_UINT64_C(x) x##ULL
+# endif
+
typedef grub_uint64_t grub_properly_aligned_t;
#define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
--
2.39.5
config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch → config/grub/default/patches/0004-keylayouts-don-t-print-Unknown-key-message.patch
+3 -3
View File
@@ -1,7 +1,7 @@
From defb7ad35579c321d32b81af7ddd6fecf34cb618 Mon Sep 17 00:00:00 2001
From 22a0e4608428f7f0131789b6bc0e0203b994163f Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Tue, 31 Oct 2023 10:33:28 +0000
Subject: [PATCH 10/14] keylayouts: don't print "Unknown key" message
Subject: [PATCH 4/8] keylayouts: don't print "Unknown key" message
on keyboards with stuck keys, this results in GRUB just
spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
}
--
2.39.5
2.47.3
config/grub/default/patches/0005-Add-Argon2-algorithm.patch
-2612
View File
File diff suppressed because it is too large Load Diff
config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch → config/grub/default/patches/0005-don-t-print-missing-prefix-errors-on-the-screen.patch
+5 -5
View File
@@ -1,7 +1,7 @@
From d0345db429be8089145e0c072db9ac8db0b644bd Mon Sep 17 00:00:00 2001
From d04a862006aaf754af4d0ec8efee33e9a59c7d0c Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Sun, 5 Nov 2023 16:14:58 +0000
Subject: [PATCH 11/14] don't print missing prefix errors on the screen
Subject: [PATCH 5/8] don't print missing prefix errors on the screen
we do actually set the prefix. this patch modifies
grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
}
file = try_open_from_prefix (prefix, filename);
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
index 4a3be8568..6ae3d73f8 100644
index de8c3aa8d..eac3ea48d 100644
--- a/grub-core/kern/dl.c
+++ b/grub-core/kern/dl.c
@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
@@ -880,7 +880,7 @@ grub_dl_load (const char *name)
return 0;
if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4a3be8568..6ae3d73f8 100644
}
--
2.39.5
2.47.3
config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
-58
View File
@@ -1,58 +0,0 @@
From 594a7011d551af530bbbdf5e39b941811a0b7811 Mon Sep 17 00:00:00 2001
From: Ax333l <main@axelen.xyz>
Date: Thu, 17 Aug 2023 00:00:00 +0000
Subject: [PATCH 06/14] Error on missing Argon2id parameters
Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
---
grub-core/disk/luks2.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
index b17cd2115..bbd8f5579 100644
--- a/grub-core/disk/luks2.c
+++ b/grub-core/disk/luks2.c
@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
enum grub_luks2_kdf_type
{
LUKS2_KDF_TYPE_ARGON2I,
+ LUKS2_KDF_TYPE_ARGON2ID,
LUKS2_KDF_TYPE_PBKDF2
};
typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
grub_int64_t time;
grub_int64_t memory;
grub_int64_t cpus;
- } argon2i;
+ } argon2;
struct
{
const char *hash;
@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
{
- out->kdf.type = LUKS2_KDF_TYPE_ARGON2I;
- if (grub_json_getint64 (&out->kdf.u.argon2i.time, &kdf, "time") ||
- grub_json_getint64 (&out->kdf.u.argon2i.memory, &kdf, "memory") ||
- grub_json_getint64 (&out->kdf.u.argon2i.cpus, &kdf, "cpus"))
+ out->kdf.type = !grub_strcmp (type, "argon2i")
+ ? LUKS2_KDF_TYPE_ARGON2I : LUKS2_KDF_TYPE_ARGON2ID;
+ if (grub_json_getint64 (&out->kdf.u.argon2.time, &kdf, "time") ||
+ grub_json_getint64 (&out->kdf.u.argon2.memory, &kdf, "memory") ||
+ grub_json_getint64 (&out->kdf.u.argon2.cpus, &kdf, "cpus"))
return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
}
else if (!grub_strcmp (type, "pbkdf2"))
@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
switch (k->kdf.type)
{
case LUKS2_KDF_TYPE_ARGON2I:
+ case LUKS2_KDF_TYPE_ARGON2ID:
ret = grub_error (GRUB_ERR_BAD_ARGUMENT, "Argon2 not supported");
goto err;
case LUKS2_KDF_TYPE_PBKDF2:
--
2.39.5
config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch → config/grub/default/patches/0006-don-t-print-error-if-module-not-found.patch
+5 -5
View File
@@ -1,7 +1,7 @@
From 2fe963570ac19e3390a792ca2c195112d4efdc24 Mon Sep 17 00:00:00 2001
From 1d72be25322037c703c5fa95ee29b8ee7b7d7106 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Sun, 5 Nov 2023 16:36:22 +0000
Subject: [PATCH 12/14] don't print error if module not found
Subject: [PATCH 6/8] don't print error if module not found
still set grub_errno accordingly, and otherwise
behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
index 6ae3d73f8..4c15027fe 100644
index eac3ea48d..6d67ba54f 100644
--- a/grub-core/kern/dl.c
+++ b/grub-core/kern/dl.c
@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
@@ -510,7 +510,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
s = grub_dl_find_section (e, ".modname");
if (!s)
@@ -30,5 +30,5 @@ index 6ae3d73f8..4c15027fe 100644
mod->name = grub_strdup ((char *) e + s->sh_offset);
if (! mod->name)
--
2.39.5
2.47.3
config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
-83
View File
@@ -1,83 +0,0 @@
From 6a757a3cdf22e840162bb222a87446a32d9b94a2 Mon Sep 17 00:00:00 2001
From: Ax333l <main@axelen.xyz>
Date: Thu, 17 Aug 2023 00:00:00 +0000
Subject: [PATCH 07/14] Compile with Argon2id support
Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
---
Makefile.util.def | 6 +++++-
grub-core/Makefile.core.def | 2 +-
grub-core/disk/luks2.c | 13 +++++++++++--
3 files changed, 17 insertions(+), 4 deletions(-)
diff --git a/Makefile.util.def b/Makefile.util.def
index 038253b37..2f19569c9 100644
--- a/Makefile.util.def
+++ b/Makefile.util.def
@@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
library = {
name = libgrubkern.a;
cflags = '$(CFLAGS_GNULIB)';
- cppflags = '$(CPPFLAGS_GNULIB) -I$(srcdir)/grub-core/lib/json';
+ cppflags = '$(CPPFLAGS_GNULIB) -I$(srcdir)/grub-core/lib/json -I$(srcdir)/grub-core/lib/argon2';
common = util/misc.c;
common = grub-core/kern/command.c;
@@ -36,6 +36,10 @@ library = {
common = grub-core/kern/misc.c;
common = grub-core/kern/partition.c;
common = grub-core/lib/crypto.c;
+ common = grub-core/lib/argon2/argon2.c;
+ common = grub-core/lib/argon2/core.c;
+ common = grub-core/lib/argon2/ref.c;
+ common = grub-core/lib/argon2/blake2/blake2b.c;
common = grub-core/lib/json/json.c;
common = grub-core/disk/luks.c;
common = grub-core/disk/luks2.c;
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 0ee65d54d..cd29a9df8 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -1242,7 +1242,7 @@ module = {
common = disk/luks2.c;
common = lib/gnulib/base64.c;
cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
- cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/json';
+ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/json -I$(srcdir)/lib/argon2';
};
module = {
diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
index bbd8f5579..02cd615d9 100644
--- a/grub-core/disk/luks2.c
+++ b/grub-core/disk/luks2.c
@@ -28,6 +28,7 @@
#include <grub/i18n.h>
#include <grub/safemath.h>
+#include <argon2.h>
#include <base64.h>
#include <json.h>
@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
{
case LUKS2_KDF_TYPE_ARGON2I:
case LUKS2_KDF_TYPE_ARGON2ID:
- ret = grub_error (GRUB_ERR_BAD_ARGUMENT, "Argon2 not supported");
- goto err;
+ ret = argon2_hash (k->kdf.u.argon2.time, k->kdf.u.argon2.memory, k->kdf.u.argon2.cpus,
+ passphrase, passphraselen, salt, saltlen, area_key, k->area.key_size,
+ k->kdf.type == LUKS2_KDF_TYPE_ARGON2I ? Argon2_i : Argon2_id,
+ ARGON2_VERSION_NUMBER);
+ if (ret)
+ {
+ grub_dprintf ("luks2", "Argon2 failed: %s\n", argon2_error_message (ret));
+ goto err;
+ }
+ break;
case LUKS2_KDF_TYPE_PBKDF2:
hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
if (!hash)
--
2.39.5
config/grub/default/patches/0013-don-t-print-empty-error-messages.patch → config/grub/default/patches/0007-don-t-print-empty-error-messages.patch
+5 -5
View File
@@ -1,7 +1,7 @@
From 5a1dd3c19307859aac7d1a22a7a0c0c7ffb09ddb Mon Sep 17 00:00:00 2001
From a0e49c6ae97114afa386286f6005dd9b3a896797 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Sun, 5 Nov 2023 17:25:20 +0000
Subject: [PATCH 13/14] don't print empty error messages
Subject: [PATCH 7/8] don't print empty error messages
this is part two of the quest to kill the prefix
error message. after i disabled prefix-related
@@ -13,10 +13,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/grub-core/kern/err.c b/grub-core/kern/err.c
index 53c734de7..7cac53983 100644
index ba04b57fb..dab62646d 100644
--- a/grub-core/kern/err.c
+++ b/grub-core/kern/err.c
@@ -107,7 +107,8 @@ grub_print_error (void)
@@ -116,7 +116,8 @@ grub_print_error (void)
{
if (grub_errno != GRUB_ERR_NONE)
{
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
}
}
--
2.39.5
2.47.3
config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
-26
View File
@@ -1,26 +0,0 @@
From 4e4ded3f127f5567bdb41de7b671bd9b2a478125 Mon Sep 17 00:00:00 2001
From: Ax333l <main@axelen.xyz>
Date: Thu, 17 Aug 2023 00:00:00 +0000
Subject: [PATCH 08/14] Make grub-install work with Argon2
Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
---
util/grub-install.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/util/grub-install.c b/util/grub-install.c
index 060246589..059036d3c 100644
--- a/util/grub-install.c
+++ b/util/grub-install.c
@@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
{
grub_util_cryptodisk_get_abstraction (disk,
push_cryptodisk_module, NULL);
+ /* HACK: always push argon2 */
+ grub_install_push_module ("argon2");
have_abstractions = 1;
have_cryptodisk = 1;
}
--
2.39.5
config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch → config/grub/default/patches/0008-kern-coreboot-mmap-Map-to-reserved.patch
+3 -3
View File
@@ -1,7 +1,7 @@
From 818f1b19f32e355cc2a0ebe29eee2a2bac7bcb3f Mon Sep 17 00:00:00 2001
From b6f5e33972320c171d0fe44ac2afe4eac0b4b3eb Mon Sep 17 00:00:00 2001
From: Paul Menzel <pmenzel@molgen.mpg.de>
Date: Mon, 17 May 2021 10:24:36 +0200
Subject: [PATCH 14/14] kern/coreboot/mmap: Map to reserved
Subject: [PATCH 8/8] kern/coreboot/mmap: Map to reserved
https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
@@ -33,5 +33,5 @@ index caf8f7cef..2fc316e8d 100644
return 1;
}
--
2.39.5
2.47.3
config/grub/default/target.cfg
+1 -1
View File
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: GPL-3.0-or-later
tree="default"
rev="a68a7dece464c35b1c8d20b98502b6881b103911"
rev="280715ec63a3424f5cf1289302cb4ab4e98768f4"