Files
lbmk/config/grub/nvme/config/payload
T
Leah Rowe 697afdea43 Bump GRUB revision to add 73 security patches
NOTE: This cherry-pick also imports the following patches
from lbmk master:
* a4bc37f12 xhci: configure TT for non-root-hubs
* 91130b6d8 xhci: workaround z790 non-root-hub speed detection
* 0ce513f44 xhci: fix port indexing
* 200404dc3 xHCI: also accept SBRN 0x31 and 0x32
* 8e79cfbb1 grub-core/bus/usb/usbhub: Add xHCI non root hub support
These patches are present in the GRUB "xhci" tree, in lbmk.
It has been decided that these should be included, as part of the
Libreboot 20241206 rev10 release.
NOTE: This also includes the following lbmk changes:
* 66d084e7f7 grub.cfg: scan luks *inside lvm*
* 5a3b0dab96 grub.cfg: Scan *every* LVM device

You can find information about the security patches here:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

GRUB has been on a crusade as of late, to proactively audit
and fix many security vulnerabilities. This lbmk change brings
in a comprehensive series of patches that fix bugs ranging from
possible buffer overflows, use-after frees, null derefs and so on.

These changes are critical, so a revision release *will* be issued,
for the Libreboot 20241206 release series.

This change imports the following 73 patches which
are present on the upstream GRUB repository (commit IDs
matched to upstream):

* 4dc616657 loader/i386/bsd: Use safe math to avoid underflow
* 490a6ab71 loader/i386/linux: Cast left shift to grub_uint32_t
* a8d6b0633 kern/misc: Add sanity check after grub_strtoul() call
* 8e6e87e79 kern/partition: Add sanity check after grub_strtoul() call
* 5b36a5210 normal/menu: Use safe math to avoid an integer overflow
* 9907d9c27 bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t
* f8795cde2 misc: Ensure consistent overflow error messages
* 66733f7c7 osdep/unix/getroot: Fix potential underflow
* d13b6e8eb script/execute: Fix potential underflow and NULL dereference
* e3c578a56 fs/sfs: Check if allocated memory is NULL
* 1c06ec900 net: Check if returned pointer for allocated memory is NULL
* dee2c14fd net: Prevent overflows when allocating memory for arrays
* 4beeff8a3 net: Use safe math macros to prevent overflows
* dd6a4c8d1 fs/zfs: Add missing NULL check after grub_strdup() call
* 13065f69d fs/zfs: Check if returned pointer for allocated memory is NULL
* 7f38e32c7 fs/zfs: Prevent overflows when allocating memory for arrays
* 88e491a0f fs/zfs: Use safe math macros to prevent overflows
* cde9f7f33 fs: Prevent overflows when assigning returned values from read_number()
* 84bc0a9a6 fs: Prevent overflows when allocating memory for arrays
* 6608163b0 fs: Use safe math macros to prevent overflows
* fbaddcca5 disk/ieee1275/ofdisk: Call grub_ieee1275_close() when grub_malloc() fails
* 33bd6b5ac disk: Check if returned pointer for allocated memory is NULL
* d8151f983 disk: Prevent overflows when allocating memory for arrays
* c407724da disk: Use safe math macros to prevent overflows
* c4bc55da2 fs: Disable many filesystems under lockdown
* 26db66050 fs/bfs: Disable under lockdown
* 5f31164ae commands/hexdump: Disable memory reading in lockdown mode
* 340e4d058 commands/memrw: Disable memory reading in lockdown mode
* 34824806a commands/minicmd: Block the dump command in lockdown mode
* c68b7d236 commands/test: Stack overflow due to unlimited recursion depth
* dad8f5029 commands/read: Fix an integer overflow when supplying more than 2^31 characters
* b970a5ed9 gettext: Integer overflow leads to heap OOB write
* 09bd6eb58 gettext: Integer overflow leads to heap OOB write or read
* 7580addfc gettext: Remove variables hooks on module unload
* 9c1619773 normal: Remove variables hooks on module unload
* 2123c5bca commands/pgp: Unregister the "check_signatures" hooks on module unload
* 0bf56bce4 commands/ls: Fix NULL dereference
* 05be856a8 commands/extcmd: Missing check for failed allocation
* 98ad84328 kern/dl: Check for the SHF_INFO_LINK flag in grub_dl_relocate_symbols()
* d72208423 kern/dl: Use correct segment in grub_dl_set_mem_attrs()
* 500e5fdd8 kern/dl: Fix for an integer overflow in grub_dl_ref()
* 2c34af908 video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
* 0707accab net/tftp: Fix stack buffer overflow in tftp_open()
* 5eef88152 net: Fix OOB write in grub_net_search_config_file()
* aa8b4d7fa net: Remove variables hooks when interface is unregisted
* a1dd8e59d net: Unregister net_default_ip and net_default_mac variables hooks on unload
* d8a937cca script/execute: Limit the recursion depth
* 8a7103fdd kern/partition: Limit recursion in part_iterate()
* 18212f064 kern/disk: Limit recursion depth
* 67f70f70a disk/loopback: Reference tracking for the loopback
* 13febd78d disk/cryptodisk: Require authentication after TPM unlock for CLI access
* 16f196874 kern/file: Implement filesystem reference counting
* a79106872 kern/file: Ensure file->data is set
* d1d6b7ea5 fs/xfs: Ensuring failing to mount sets a grub_errno
* 6ccc77b59 fs/xfs: Fix out-of-bounds read
* 067b6d225 fs/ntfs: Implement attribute verification
* 048777bc2 fs/ntfs: Use a helper function to access attributes
* 237a71184 fs/ntfs: Track the end of the MFT attribute buffer
* aff263187 fs/ntfs: Fix out-of-bounds read
* 7e2f750f0 fs/ext2: Fix out-of-bounds read for inline extents
* edd995a26 fs/jfs: Inconsistent signed/unsigned types usage in return values
* bd999310f fs/jfs: Use full 40 bits offset and address for a data extent
* ab09fd053 fs/jfs: Fix OOB read caused by invalid dir slot index
* 66175696f fs/jfs: Fix OOB read in jfs_getent()
* 1443833a9 fs/iso9660: Fix invalid free
* 965db5970 fs/iso9660: Set a grub_errno if mount fails
* f7c070a2e fs/hfsplus: Set a grub_errno if mount fails
* 563436258 fs/f2fs: Set a grub_errno if mount fails
* 0087bc690 fs/tar: Integer overflow leads to heap OOB write
* 2c8ac08c9 fs/tar: Initialize name in grub_cpio_find_file()
* 417547c10 fs/hfs: Fix stack OOB write with grub_strcpy()
* c1a291b01 fs/ufs: Fix a heap OOB write
* ea703528a misc: Implement grub_strlcpy()

Signed-off-by: Leah Rowe <leah@libreboot.org>
2025-02-19 22:04:04 +00:00

321 lines
7.9 KiB
Plaintext

# SPDX-License-Identifier: GPL-3.0-or-later
# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
# Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
set prefix=(memdisk)/boot/grub
insmod at_keyboard
insmod usb_keyboard
insmod nativedisk
insmod ehci
insmod ohci
insmod uhci
insmod usb
insmod usbms
insmod regexp
terminal_input --append at_keyboard
terminal_input --append usb_keyboard
terminal_output --append cbmemc
# User interface overrides wherever "keystatus" is supported
# Keep SHIFT key pressed before powering on to disable graphics
if keystatus --shift; then
terminal_output --append vga_text
else
gfxpayload=keep
terminal_output --append gfxterm
for dt in cbfsdisk memdisk; do
for it in png jpg; do
if [ -f (${dt})/background.${it} ]; then
insmod ${it}
background_image (${dt})/background.${it}
fi
done
done
fi
# Keep CTRL pressed to enable default serial terminal (COM1 or the like)
if keystatus --ctrl; then
serial
terminal_input --append serial
terminal_output --append serial
fi
# Keep ALT pressed to enable spkmodem
if keystatus --alt; then
terminal_output --append spkmodem
fi
set default="0"
if [ -f (cbfsdisk)/timeout.cfg ]; then
source (cbfsdisk)/timeout.cfg
else
set timeout=8
fi
set grub_scan_disk="nvme ahci ata"
if [ -f (cbfsdisk)/scan.cfg ]; then
source (cbfsdisk)/scan.cfg
fi
if [ -f (cbfsdisk)/keymap.gkb ]; then
keymap (cbfsdisk)/keymap.gkb
fi
function really_try_user_config {
set root="${1}"
if [ -f /"${2}"/grub.cfg ]; then
unset superusers
configfile /"${2}"/grub.cfg
fi
}
function try_user_config {
# The @/... entries are for cases where the BTRFS filesystem is being used
for dir in grub boot/grub @/grub @/boot/grub grub2 boot/grub2 @/grub2 @/boot/grub2 boot @/boot; do
really_try_user_config "${1}" "${dir}"
done
for dir in ubuntu debian redhat; do
really_try_user_config "${1}" "EFI/${dir}"
done
}
function search_grub {
echo -n "Attempting to load grub.cfg from '${1}' devices"
for i in 0 1 2 3 4 5 6 7 8; do
for part in 1 2 3 4 5 6 7 8 9 10 11 12; do
if [ "${1}" != "nvme" ]; then
try_user_config "(${1}${i},${part})"
else
# TODO: do we care about other namesapces
try_user_config "(nvme${i}n1,${part})"
fi
done
if [ "${1}" != "nvme" ]; then
# raw devices e.g. (ahci0) instead of (ahci0,1)
try_user_config "(${1}${i})"
else
# TODO: do we care about other namesapces
try_user_config "(nvme${i}n1)"
fi
done
echo # Insert newline
}
function try_isolinux_config {
set root="${1}"
for dir in '' /boot /EFI /@ /@/boot; do
if [ -f "${dir}"/isolinux/isolinux.cfg ]; then
syslinux_configfile -i "${dir}"/isolinux/isolinux.cfg
elif [ -f "${dir}"/syslinux/syslinux.cfg ]; then
syslinux_configfile -s "${dir}"/syslinux/syslinux.cfg
elif [ -f "${dir}"/syslinux/extlinux.conf ]; then
syslinux_configfile -s "${dir}"/syslinux/extlinux.conf
elif [ -f "${dir}"/extlinux/extlinux.conf ]; then
syslinux_configfile -s "${dir}"/extlinux/extlinux.conf
fi
done
}
function search_isolinux {
echo "\nAttempting to parse iso/sys/extlinux config from '${1}' devices"
for i in 0 1 2 3 4 5 6 7 8; do
for part in 1 2 3 4 5 6 7 8 9 10 11 12; do
if [ "${1}" != "nvme" ]; then
try_isolinux_config "(${1}${i},${part})"
else
# TODO: see above
try_isolinux_config "(nvme${i}n1,${part})"
fi
done
if [ "${1}" != "nvme" ]; then
# raw devices e.g. (usb0) instead of (usb0,1)
try_isolinux_config "(${1}${i})"
else
# TODO: do we care about other namesapces
try_isolinux_config "(nvme${i}n1)"
fi
done
echo # Insert newline
}
function try_bootcfg {
try_user_config "${1}"
try_isolinux_config "${1}"
}
function search_bootcfg {
search_grub "${1}"
search_isolinux "${1}"
}
menuentry 'Load Operating System (incl. fully encrypted disks) [o]' --hotkey='o' {
for grub_disk in ${grub_scan_disk}; do
search_bootcfg ${grub_disk}
done
# grub device enumeration is very slow, so checks are hardcoded
raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
# in practise, doing multiple redundant checks is perfectly fast
# TODO: optimize grub itself, and use */? here for everything
for vol in ${raidvol} ; do
try_bootcfg "${vol}"
done
unset bootdev
for grub_disk in ${grub_scan_disk}; do
for i in 0 1 2 3 4 5 6 7 8; do
for part in 1 2 3 4 5 6 7 8 9 10 11 12; do
if [ "${grub_disk}" = "ahci" ]; then
bootdev="${bootdev} (ahci${i},${part})"
elif [ "${grub_disk}" = "ata" ]; then
bootdev="${bootdev} (ata${i},${part})"
elif [ "${grub_disk}" = "nvme" ]; then
# TODO: do we care about other namesapces
bootdev="${bootdev} (nvme${i}n1,${part})"
fi
done
done
done
set pager=0
echo -n "Attempting to unlock encrypted volumes"
for dev in ${bootdev} ${raidvol}; do
if cryptomount "${dev}" ; then break ; fi
done
set pager=1
echo
search_bootcfg crypto
lvmvol=""
# after cryptomount, lvm volumes might be available
# using * is slow on some machines, but we use it here,
# just once. in so doing, we find every lvm volume
for vol in (*); do
if regexp ^lvm/ $vol; then
lvmvol="${lvmvol} ${vol}"
try_bootcfg "${vol}"
fi
done
# user might have put luks inside lvm
set pager=0
echo "Attempting to unlock encrypted LVMs"
for vol in ${lvmvol}; do
cryptomount "$vol"
done
set pager=1
echo
search_bootcfg crypto
true # Prevent pager requiring to accept each line instead of whole screen
}
menuentry 'Search for GRUB/SYSLINUX/EXTLINUX/ISOLINUX on USB [s]' --hotkey='s' {
search_bootcfg usb
}
menuentry 'Search for GRUB/SYSLINUX/EXTLINUX/ISOLINUX on AHCI [a]' --hotkey='a' {
search_bootcfg ahci
}
menuentry 'Search for GRUB/SYSLINUX/EXTLINUX/ISOLINUX on ATA/IDE [d]' --hotkey='d' {
search_bootcfg ata
}
menuentry 'Search for GRUB/SYSLINUX/EXTLINUX/ISOLINUX on NVMe [e]' --hotkey='e' {
search_bootcfg nvme
}
if [ -f (cbfsdisk)/grub.cfg ]; then
menuentry 'Load configuration (grub.cfg) in CBFS [t]' --hotkey='t' {
set root='(cbfsdisk)'
if [ -f /grub.cfg ]; then
configfile /grub.cfg
fi
}
fi
if [ -f (cbfsdisk)/grubtest.cfg ]; then
menuentry 'Load test configuration (grubtest.cfg) inside of CBFS [t]' --hotkey='t' {
set root='(cbfsdisk)'
if [ -f /grubtest.cfg ]; then
configfile /grubtest.cfg
fi
}
fi
if [ -f (cbfsdisk)/u-boot ]; then
menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
set root='cbfsdisk'
chainloader /u-boot
}
fi
if [ -f (cbfsdisk)/seabios.elf ]; then
if [ -f (cbfsdisk)/img/u-boot ]; then
menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /seabios.elf
}
else
menuentry 'Load SeaBIOS [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /seabios.elf
}
fi
fi
if [ -f (cbfsdisk)/img/grub2 ]; then
if [ -f (cbfsdisk)/img/u-boot ]; then
menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /fallback/payload
}
else
menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
set root='cbfsdisk'
chainloader /fallback/payload
}
fi
fi
menuentry 'Poweroff [p]' --hotkey='p' {
halt
}
menuentry 'Reboot [r]' --hotkey='r' {
reboot
}
if [ -f (cbfsdisk)/img/memtest ]; then
menuentry 'Load MemTest86+ [m]' --hotkey='m' {
set root='cbfsdisk'
chainloader /img/memtest
}
fi
submenu 'Other [z]' --hotkey='z' {
menuentry 'Enable default serial terminal [s]' --hotkey='s' {
serial
terminal_input --append serial
terminal_output --append serial
}
menuentry 'Disable default serial terminal' {
terminal_input --remove serial
terminal_output --remove serial
}
menuentry 'Enable gfxterm' {
terminal_output --append gfxterm
terminal_output --remove vga_text
}
menuentry 'Disable gfxterm [g]' --hotkey='g' {
terminal_output --remove gfxterm
terminal_output --append vga_text
}
menuentry 'Enable spkmodem [a]' --hotkey='a' {
terminal_output --append spkmodem
}
menuentry 'Disable spkmodem [z]' --hotkey='z' {
terminal_output --remove spkmodem
}
}