Files
lbmk/script/roms
Leah Rowe e67cd17164 roms: only support SeaBIOS/SeaGRUB on x86
Never, ever build images where GRUB is the primary payload.

These options have been removed from target.cfg handling:

* seabios_withgrub
* grub_withseabios

The "payload_grub" variable now does the same thing as
the old "seabios_withgrub" variable, if set.

The "grubonly" configuration is retained, and enabled by
default when SeaGRUB is enabled (non-grubonly also available).

Due to lbmk issue #216, it is no longer Libreboot policy to
make GRUB the primary payload on any board. GRUB's sheer size
and complexity, plus the large number of memory corruption issues
similar to it that *have* been fixed over the years, tells me
that GRUB is a liability when it is the primary payload.

SeaBIOS is a much safer payload to run as primary, on x86, due
to its smaller size and much more conservative development; it
is simply far less likely to break.

If GRUB breaks in the future, the user's machine is not
bricked. This is because SeaBIOS is the default payload.

Since I no longer wish to ever provide GRUB as a primary
payload, supporting it in lbmk adds needless bloat that
will later probably break anyway due to lack of testing,
so let's just assume SeaGRUB in all cases where the user
wants to use a GRUB payload.

You can mitigate potential security issues with SeaBIOS
by disabling option ROM execution, which can be done at
runtime by inserting integers into CBFS. The SeaBIOS
documentation says how to do this.

Libreboot's GRUB hardening guide still says how to add
a bootorder file in CBFS, making SeaBIOS only load GRUB
from CBFS, and nothing else. This, combined with the
disablement of option ROM execution (if using Intel
graphics), pretty much provides the same security benefits
as GRUB-as-primary, for example when setting a GRUB password
and GPG checks, with encrypted /boot as in the hardening guide.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2024-06-22 22:57:39 +01:00

253 lines
7.8 KiB
Bash
Executable File

#!/usr/bin/env sh
# SPDX-License-Identifier: GPL-3.0-or-later
# Copyright (c) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
# Copyright (c) 2021-2022 Ferass El Hafidi <vitali64pmemail@protonmail.com>
# Copyright (c) 2022 Caleb La Grange <thonkpeasant@protonmail.com>
# Copyright (c) 2022-2023 Alper Nebi Yasak <alpernebiyasak@gmail.com>
# Copyright (c) 2023 Riku Viitanen <riku.viitanen@protonmail.com>
set -u -e
. "include/lib.sh"
seavgabiosrom="elf/seabios/default/libgfxinit/vgabios.bin"
cfgsdir="config/coreboot"
rp2040src="src/pico-serprog"
rp2040x="$rp2040src/build/pico_serprog.uf2"
picosdk="src/pico-sdk"
rp2040dir="$picosdk/src/boards/include/boards"
stm32src="src/stm32-vserprog"
stm32x="$stm32src/stm32-vserprog.hex"
stm32dir="$stm32src/boards"
# Disable all payloads by default.
# target.cfg files have to specifically enable [a] payload(s)
pv="payload_uboot payload_seabios payload_memtest t payload_grub"
v="romdir cbrom initmode displaymode cbcfg targetdir tree release ubootelf"
v="$v board grub_scan_disk uboot_config grubtree grubelf tmpmv"
eval `setvars "n" $pv`
eval `setvars "" $v boards targets serdir ser`
main()
{
while [ $# -gt 0 ]; do
if [ "$1" = "serprog" ]; then
[ $# -lt 2 ] && $err "serprog type not set"
[ "$2" != "rp2040" ] && [ "$2" != "stm32" ] && \
$err "invalid serprog type"
eval "x_ ./update trees -f \"\${${2}src##*/}\""
ser="$2" && shift 2 && continue
fi
[ "$1$ser" = "list" ] && x_ ls -1 config/coreboot && return
[ "$1" = "all" ] && shift && continue
boards="$1 $boards"; shift 1
done
[ -n "$boards" ] || [ -n "$ser" ] || boards="$(ls -1 \
config/coreboot)" || $err "can't list coreboot boards"
[ -n "$ser" ] && \
eval "serlist \"\$${ser}dir\" > \"\$tmpdir/ser\" || $err \"!ser\""
[ -n "$ser" ] && [ -z "$boards" ] && boards="$(cat "$tmpdir/ser")"
for x in $boards; do
[ -n "$ser" ] && mkserprogfw "$ser" "$x"
[ -z "$ser" ] && [ -d "config/coreboot/$x/config" ] && \
configure_target "$x" && build_payloads && build_board && \
[ -d "bin/$board" ] && targets="$targets, $x"; continue
done
[ -n "$ser" ] && [ "$xbmk_release" = "y" ] && \
mkrom_tarball "bin/serprog_$ser" && return 0
[ -z "$ser" ] && [ -z "$targets" ] && $err "No images were compiled"
printf "DO NOT flash images from elf/ - use bin/ instead. ALSO:\n"
printf "%s\n" "$kbnotice"
}
mkserprogfw()
{
x_ mkdir -p "bin/serprog_$1"
if [ "$1" = "rp2040" ]; then
x_ cmake -DPICO_BOARD="$2" -DPICO_SDK_PATH="$picosdk" \
-B "$rp2040src/build" "$rp2040src"
x_ cmake --build "$rp2040src/build"
else
x_ make -C "$stm32src" libopencm3-just-make BOARD=$2
x_ make -C "$stm32src" BOARD=$2
fi
eval "x_ mv \"\$${1}x\" \"bin/serprog_$1/serprog_$2.\${${1}x##*.}\""
printf "Look in bin/serprog_%s/ for images\n" "$1"
}
serlist()
{
basename -a -s .h "$1/"*.h || $err "$1: can't list boards"
}
configure_target()
{
eval `setvars "n" $pv`
eval `setvars "" $v`
board="$1"
targetdir="$cfgsdir/$board"
# Override the above defaults using target.cfg
eval `setcfg "$targetdir/target.cfg"`
[ -z "$tree" ] && $err "$board: tree not defined"
[ "$xbmk_release" = "y" ] && [ "$release" = "n" ] && return 1
[ "$board" = "$tree" ] && return 1
[ -n "$uboot_config" ] || uboot_config="default"
[ "$payload_uboot" = "y" ] || payload_seabios="y"
[ "$payload_grub" = "y" ] && payload_seabios="y"
[ "$payload_seabios" = "y" ] && [ -n "$payload_uboot" = "y" ] && \
$err "$board: U-Boot and SeaBIOS/GRUB are both enabled."
[ -z "$grub_scan_disk" ] && grub_scan_disk="nvme ahci ata"
[ -n "$grubtree" ] || grubtree="default"
grubelf="elf/grub/$grubtree/payload/grub.elf"
[ "$payload_memtest" = "y" ] || payload_memtest="n"
[ "$(uname -m)" = "x86_64" ] || payload_memtest="n"
[ "$payload_uboot" = "y" ] && payload_memtest="n"; return 0
}
build_payloads()
{
romdir="bin/$board"
cbdir="src/coreboot/$board"
[ "$board" = "$tree" ] || cbdir="src/coreboot/$tree"
cbfstool="elf/cbfstool/$tree/cbfstool"
cbrom="$cbdir/build/coreboot.rom"
[ -f "$cbfstool" ] || x_ ./update trees -b coreboot utils $tree
[ "$payload_memtest" = "y" ] && x_ ./update trees -b memtest86plus
[ "$payload_seabios" = "y" ] && x_ ./update trees -b seabios
[ "$payload_grub" = "y" ] && x_ ./update trees -b grub $grubtree
[ "$payload_uboot" = "y" ] || return 0
x_ ./update trees -b u-boot $board
ubdir="elf/u-boot/$board/$uboot_config"
ubootelf="$ubdir/u-boot.elf" && [ ! -f "$ubootelf" ] && \
ubootelf="$ubdir/u-boot"
[ -f "$ubootelf" ] || $err "$board: Can't find u-boot"; return 0
}
build_board()
{
x_ rm -Rf "$romdir"
for it in "normal" "vgarom" "libgfxinit"; do
initmode="$it"
hmode="vesafb"
[ "$initmode" = "vgarom" ] || hmode="corebootfb"
modes="$hmode txtmode"
for y in $modes; do
displaymode="$y"
[ "$initmode" = "normal" ] && \
[ "$displaymode" != "txtmode" ] && continue
cbcfg="$targetdir/config/${initmode}_$displaymode"
[ "$initmode" = "normal" ] && cbcfg="${cbcfg%_*}"
e "$cbcfg" f not || build_roms; x_ rm -f "$cbrom"
done
done
}
build_roms()
{
x_ ./update trees -b coreboot $board
_cbrom="$cbelfdir/$board/${initmode}_$displaymode"
[ "$initmode" = "normal" ] && _cbrom="${_cbrom%"_$displaymode"}"
_cbrom="$_cbrom/coreboot.rom"
cbrom="$(mktemp -t coreboot_rom.XXXXXXXXXX)"
x_ cp "$_cbrom" "$cbrom"
[ "$payload_memtest" != "y" ] || cbfs "$cbrom" \
"elf/memtest86plus/memtest.bin" img/memtest
[ "$payload_seabios" = "y" ] && build_seabios_roms
[ "$payload_uboot" = "y" ] && x_ cp "$_cbrom" "$cbrom" && \
build_uboot_roms; return 0
}
build_seabios_roms()
{
if [ "$payload_grub" = "y" ]; then # SeaBIOS with GRUB
t="$(mktemp -t coreboot_rom.XXXXXXXXXX)"
x_ cp "$cbrom" "$t"
build_seagrub_roms "$t" "seabios_withgrub"
else # SeaBIOS only
t="$(mkSeabiosRom "$cbrom")" || \
$err "build_seabios_roms: cannot build tmprom"
newrom="$romdir/seabios_${board}_${initmode}_$displaymode"
[ "$initmode" = "normal" ] && newrom="$romdir/seabios" \
&& newrom="${newrom}_${board}_$initmode"
cprom cp "$t" "$newrom.rom"
fi
x_ rm -f "$t"
}
build_seagrub_roms()
{
tmpmv="$(mkSeabiosRom "$1")" || $err "$board: !mk grub tmprom"
x_ mv "$tmpmv" "$1"
# we only need insert grub.elf once, for each coreboot config:
cbfs "$1" "$grubelf" "img/grub2"
printf "set grub_scan_disk=\"%s\"\n" "$grub_scan_disk" \
> "$tmpdir/tmpcfg" || $err "set grub_scan_disk, $grub_scan_disk"
cbfs "$1" "$tmpdir/tmpcfg" scan.cfg raw
newrom="$romdir/seabios_withgrub_${board}_${initmode}_$displaymode.rom"
[ "$initmode" = "normal" ] && newrom="$romdir/seabios_withgrub_" \
&& newrom="$newrom${board}_$initmode.rom"
cprom cp "$1" "$newrom"
cbfs "$1" "$grubdata/bootorder" bootorder raw # SeaGRUB
cprom cp "$1" "${newrom%.rom}_grubfirst.rom"
}
# make a rom in /tmp/ and then print the path of that ROM
mkSeabiosRom() {
tmprom="$(mktemp -t coreboot_rom.XXXXXXXXXX)" # 1=cbrom, 2=cbfs path
_seabioself="elf/seabios/default/$initmode/bios.bin.elf"
x_ cp "$1" "$tmprom"
cbfs "$tmprom" "$_seabioself" "fallback/payload"
x_ "$cbfstool" "$tmprom" add-int -i 3000 -n etc/ps2-keyboard-spinup
z="2"; [ "$initmode" = "vgarom" ] && z="0"
x_ "$cbfstool" "$tmprom" add-int -i $z -n etc/pci-optionrom-exec
x_ "$cbfstool" "$tmprom" add-int -i 0 -n etc/optionroms-checksum
[ "$initmode" != "libgfxinit" ] || cbfs "$tmprom" "$seavgabiosrom" \
vgaroms/seavgabios.bin raw
printf "%s\n" "$tmprom"
}
build_uboot_roms()
{
tmprom="$(mktemp -t coreboot_rom.XXXXXXXXXX)"
newrom="$romdir/uboot_payload_${board}_${initmode}_$displaymode.rom"
x_ cp "$cbrom" "$tmprom"
cbfs "$tmprom" "$ubootelf" "fallback/payload"
cprom mv "$tmprom" "$newrom"
}
cprom()
{
printf "Creating target image: %s\n" "$3"
x_ mkdir -p "${3%/*}"
x_ $1 "$2" "$3"
[ "$xbmk_release" = "y" ] && mksha512sum "$3" "vendorhashes" && \
x_ ./vendor inject -r "$3" -b "$board" -n nuke; return 0
}
main $@