[PATCH 0/1] Add grub-coreboot

Hi,

In the following mail there will be a patch that adds grub-coreboot.

The './pre-inst-env guix lint grub-coreboot' command shows some warnings:

[...]/bootloaders.scm:301:2: grub-coreboot@2.06:

label 'qemu' does not match package name 'qemu-minimal'

[...]/bootloaders.scm:301:2: grub-coreboot@2.06:

label 'gettext' does not match package name 'gettext-minimal'

[...]/bootloaders.scm:301:2: grub-coreboot@2.06:

file names of patches should start with the package name

[...]/bootloaders.scm:301:2: grub-coreboot@2.06:

probably vulnerable to CVE-2022-2601, CVE-2022-3775, CVE-2021-3981

[...]/bootloaders.scm:301:2: grub-coreboot@2.06:

updater 'gnu' failed to find upstream releases

but since this package is based on grub-coreboot, I guess that things should

be fixed there instead.

A standalone image was built with the following commands:

modules="ahci at_keyboard cbfs ehci ext2 fat ohci part_gpt part_msdos \

pata uhci usb_keyboard usbms usbserial_usbdebug"

install_modules="acpi ahci all_video archelp at_keyboard ata blocklist \

boot btrfs cat cbfs cbls cbls cbmemc cbmemc cbtime cbtime chain chain \

cmosdump cmostest cmp configfile configfile cpio cpuid crc64 crypto \

cryptodisk cs5536 date datehook datetime disk diskfilter div dm_nv echo \

echo ehci elf eval exfat ext2 extcmd fat file fshelp gcry_crc gcry_rfc2268 \

gcry_rijndael gcry_rsa gcry_seed gcry_serpent gcry_sha1 gcry_sha256 \

gcry_sha512 gcry_twofish gettext gfxmenu gfxterm_background gfxterm_menu \

gptsync gzio gzio halt halt hashsum hdparm help help hexdump hexdump iorw \

iorw iso9660 jpeg keylayouts keystatus ldm linux linux linux16 linux16 \

loadenv loopback ls ls lsacpi lsacpi lsmmap lsmmap lspci lspci luks lvm \

lzopio mda_text memdisk memrw memrw minicmd minicmd mmap morse mpi \

msdospart multiboot multiboot multiboot2 nativedisk newc nilfs2 normal \

normal odc offsetio ohci part_gpt part_msdos parttool password \

password_pbkdf2 password_pbkdf2 pata pbkdf2 pci pcidump pcidump pgp play \

priority_queue probe procfs progress random read reboot reboot regexp \

regexp relocator romfs scsi search search search_fs_file search_fs_uuid \

search_label serial serial setjmp setpci setpci sfs sleep spkmodem squash4 \

syslinuxcfg syslinuxcfg tar terminal terminfo test test testload testspeed \

time tr trig true udf uhci usb usb_keyboard usbms usbserial_common \

usbserial_ftdi usbserial_pl2303 usbserial_usbdebug video_colors videoinfo \

xnu xzio"

"/gnu/store/[...]/bin/grub-mkstandalone" \

-O i386-coreboot \

-o grub_payload.elf \

--fonts= \

--themes= \

--locales= \

--modules="${modules}" \

--install-modules="${install_modules}" \

/boot/grub/grub.cfg=coreboot.cfg

The coreboot.cfg file was taken from grub source code (GPLv3+) and consist of

the following:

if test -f (cbfsdisk)/etc/grub.cfg; then

source (cbfsdisk)/etc/grub.cfg

fi

The resulting image was tested on a Thinkpad X200 running a custom 100% free

software version of Coreboot with as a GRUB payload) with the following

commands:

chainloader /path/to/grub_payload.elf

boot

It then booted fine. As for the partitions I used, I have LUKS encrypted hard

drive with LVM2 and a mix of BTRFS and ext4 partitions.

Denis 'GNUtoo' Carikli (1):

gnu: Add grub-coreboot

gnu/packages/bootloaders.scm | 17 ++++++++++++++++-

1 file changed, 16 insertions(+), 1 deletion(-)

base-commit: 796c823a0d1d0aec9f4af908eca462e58e5675b5

--

2.41.0

---

gnu/packages/bootloaders.scm | 17 ++++++++++++++++-

1 file changed, 16 insertions(+), 1 deletion(-)

On 2023-07-16, Denis 'GNUtoo' Carikli wrote:

...

...

Could you explain in more detail about the failing tests in the comment?

Which tests? Are they testing things that are not valid in a

grub-coreboot context? Is it not reasonable or not plausible to

selectively disable only the failing tests?

QA seems to build it fine, and nothing else obviously leaps out at me.

live well,

vagrant

Hi,

On Tue, 18 Jul 2023 11:00:45 -0700

Vagrant Cascadian <vagrant@debian.org> wrote:

I've looked into it, and the reason the test fails is similar than with

UEFI: many tests require to build a Coreboot image (and also to

build cbfstool which is available in Coreboot)[1].

And building Coreboot for qemu would require to deblob it first, and

simply using Libreboot for that doesn't work anymore because recent

versions don't deblob Coreboot and even ship nonfree software in the

releases.

So at some point we will likely have some clean solution for that, but

it could take some time.

In the meantime if the comment is changed for the following, would it

work for you?

Or do I really need to disable the failing tests[2]?

References:

-----------

[1]To be more precise in tests/util/grub-shell.in we have:

> if [ x$boot = xcoreboot ]; then

> imgfile=`mktemp "${TMPDIR:-/tmp}/tmp.XXXXXXXXXX"` || exit 1

> cp "${GRUB_COREBOOT_ROM}" "${imgfile}"

> "${GRUB_CBFSTOOL}" "${imgfile}" add-payload -f \

> "${rom_directory}/coreboot.elf" -n fallback/payload

> [...]

> fi

And GRUB_COREBOOT_ROM and GRUB_CBFSTOOL are not provided anywhere so

somehow the user has to provide them. It's also pretty clear (for

people used to Coreboot) that GRUB_COREBOOT_ROM is a Coreboot image

because the cbfstool command above is for coreboot images.

[2]Here's the output of the build failure with tests enabled:

make check-TESTS

make[3]: Entering directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

make[4]: Entering directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

SKIP: ext234_test

SKIP: squashfs_test

SKIP: iso9660_test

SKIP: hfsplus_test

SKIP: ntfs_test

SKIP: reiserfs_test

SKIP: fat_test

SKIP: minixfs_test

SKIP: xfs_test

SKIP: f2fs_test

SKIP: nilfs2_test

SKIP: romfs_test

SKIP: exfat_test

SKIP: tar_test

SKIP: udf_test

SKIP: hfs_test

SKIP: jfs_test

SKIP: btrfs_test

SKIP: zfs_test

SKIP: cpio_test

PASS: example_scripted_test

FAIL: pata_test

FAIL: ahci_test

PASS: gettext_strings_test

FAIL: uhci_test

FAIL: ehci_test

FAIL: example_grub_script_test

FAIL: ohci_test

FAIL: grub_script_eval

FAIL: grub_script_echo1

FAIL: grub_script_test

FAIL: grub_script_echo_keywords

FAIL: grub_script_vars1

FAIL: grub_script_leading_whitespace

FAIL: grub_script_while1

FAIL: grub_script_for1

PASS: grub_script_blanklines

PASS: grub_script_final_semicolon

PASS: grub_script_dollar

FAIL: grub_script_comments

FAIL: grub_script_if

FAIL: grub_script_break

FAIL: grub_script_functions

FAIL: grub_script_shift

FAIL: grub_script_continue

FAIL: grub_script_blockarg

FAIL: grub_script_setparams

FAIL: grub_cmd_regexp

FAIL: grub_script_return

FAIL: grub_cmd_date

FAIL: grub_script_expansion

FAIL: grub_cmd_sleep

PASS: grub_script_no_commands

SKIP: partmap_test

PASS: hddboot_test

PASS: fddboot_test

PASS: cdboot_test

PASS: netboot_test

PASS: pseries_test

PASS: core_compress_test

SKIP: xzcompress_test

SKIP: gzcompress_test

SKIP: lzocompress_test

FAIL: grub_cmd_echo

FAIL: help_test

FAIL: grub_script_not

FAIL: grub_script_gettext

FAIL: grub_script_escape_comma

FAIL: grub_script_strcmp

FAIL: test_sha512sum

FAIL: test_unset

FAIL: grub_cmd_tr

FAIL: file_filter_test

PASS: grub_cmd_test

PASS: syslinux_test

PASS: example_unit_test

PASS: printf_test

PASS: date_test

PASS: cmp_test

PASS: priority_queue_unit_test

============================================================================

Testsuite summary for GRUB 2.06

============================================================================

# TOTAL: 80

# PASS: 19

# SKIP: 24

# XFAIL: 0

# FAIL: 37

# XPASS: 0

# ERROR: 0

============================================================================

See ./test-suite.log

Please report to bug-grub@gnu.org

============================================================================

make[4]: *** [Makefile:11629: test-suite.log] Error 1

make[4]: Leaving directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

make[3]: *** [Makefile:11737: check-TESTS] Error 2

make[3]: Leaving directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

make[2]: *** [Makefile:12533: check-am] Error 2

make[2]: Leaving directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

make[1]: *** [Makefile:11514: check-recursive] Error 1

make[1]: Leaving directory '/tmp/guix-build-grub-coreboot-2.06.drv-0/grub-2.06'

make: *** [Makefile:12535: check] Error 2

Test suite failed, dumping logs.

--- ./test-suite.log --------------------------------------------------------

=================================

GRUB 2.06: ./test-suite.log

=================================

# TOTAL: 80

# PASS: 19

# SKIP: 24

# XFAIL: 0

# FAIL: 37

# XPASS: 0

# ERROR: 0

.. contents:: :depth: 2

SKIP: ext234_test

=================

SKIP ext234_test (exit status: 77)

SKIP: squashfs_test

===================

mksquashfs not installed; cannot test squashfs.

SKIP squashfs_test (exit status: 77)

SKIP: iso9660_test

==================

xorriso not installed; cannot test iso9660.

SKIP iso9660_test (exit status: 77)

SKIP: hfsplus_test

==================

SKIP hfsplus_test (exit status: 77)

SKIP: ntfs_test

===============

SKIP ntfs_test (exit status: 77)

SKIP: reiserfs_test

===================

SKIP reiserfs_test (exit status: 77)

SKIP: fat_test

==============

SKIP fat_test (exit status: 77)

SKIP: minixfs_test

==================

SKIP minixfs_test (exit status: 77)

SKIP: xfs_test

==============

SKIP xfs_test (exit status: 77)

SKIP: f2fs_test

===============

SKIP f2fs_test (exit status: 77)

SKIP: nilfs2_test

=================

SKIP nilfs2_test (exit status: 77)

SKIP: romfs_test

================

genromfs not installed; cannot test romfs.

SKIP romfs_test (exit status: 77)

SKIP: exfat_test

================

SKIP exfat_test (exit status: 77)

SKIP: tar_test

==============

tar not installed; cannot test tar.

SKIP tar_test (exit status: 77)

SKIP: udf_test

==============

SKIP udf_test (exit status: 77)

SKIP: hfs_test

==============

SKIP hfs_test (exit status: 77)

SKIP: jfs_test

==============

SKIP jfs_test (exit status: 77)

SKIP: btrfs_test

================

SKIP btrfs_test (exit status: 77)

SKIP: zfs_test

==============

SKIP zfs_test (exit status: 77)

SKIP: cpio_test

===============

cpio not installed; cannot test cpio.

SKIP cpio_test (exit status: 77)

FAIL: pata_test

===============

tar: Removing leading `/' from member names

cp: cannot stat '': No such file or directory

FAIL pata_test (exit status: 1)

FAIL: ahci_test

===============

tar: Removing leading `/' from member names

cp: cannot stat '': No such file or directory

FAIL ahci_test (exit status: 1)

FAIL: uhci_test

===============

tar: Removing leading `/' from member names

cp: cannot stat '': No such file or directory

FAIL uhci_test (exit status: 1)

FAIL: ohci_test

===============

tar: Removing leading `/' from member names

cp: cannot stat '': No such file or directory

FAIL ohci_test (exit status: 1)

FAIL: ehci_test

===============

tar: Removing leading `/' from member names

cp: cannot stat '': No such file or directory

FAIL ehci_test (exit status: 1)

FAIL: example_grub_script_test

==============================

cp: cannot stat '': No such file or directory

FAIL example_grub_script_test (exit status: 1)

FAIL: grub_script_eval

======================

cp: cannot stat '': No such file or directory

FAIL grub_script_eval (exit status: 1)

FAIL: grub_script_test

======================

cp: cannot stat '': No such file or directory

FAIL grub_script_test (exit status: 1)

FAIL: grub_script_echo1

=======================

cp: cannot stat '': No such file or directory

FAIL grub_script_echo1 (exit status: 1)

FAIL: grub_script_leading_whitespace

====================================

cp: cannot stat '': No such file or directory

FAIL grub_script_leading_whitespace (exit status: 1)

FAIL: grub_script_echo_keywords

===============================

cp: cannot stat '': No such file or directory

FAIL grub_script_echo_keywords (exit status: 1)

FAIL: grub_script_vars1

=======================

cp: cannot stat '': No such file or directory

FAIL grub_script_vars1 (exit status: 1)

FAIL: grub_script_for1

======================

cp: cannot stat '': No such file or directory

FAIL grub_script_for1 (exit status: 1)

FAIL: grub_script_while1

========================

cp: cannot stat '': No such file or directory

FAIL grub_script_while1 (exit status: 1)

FAIL: grub_script_if

====================

cp: cannot stat '': No such file or directory

FAIL grub_script_if (exit status: 1)

FAIL: grub_script_comments

==========================

cp: cannot stat '': No such file or directory

FAIL grub_script_comments (exit status: 1)

FAIL: grub_script_functions

===========================

cp: cannot stat '': No such file or directory

FAIL grub_script_functions (exit status: 1)

FAIL: grub_script_break

=======================

cp: cannot stat '': No such file or directory

FAIL grub_script_break (exit status: 1)

FAIL: grub_script_continue

==========================

cp: cannot stat '': No such file or directory

FAIL grub_script_continue (exit status: 1)

FAIL: grub_script_shift

=======================

cp: cannot stat '': No such file or directory

FAIL grub_script_shift (exit status: 1)

FAIL: grub_script_blockarg

==========================

cp: cannot stat '': No such file or directory

[] != [{ true }]

FAIL grub_script_blockarg (exit status: 1)

FAIL: grub_script_setparams

===========================

cp: cannot stat '': No such file or directory

FAIL grub_script_setparams (exit status: 1)

FAIL: grub_script_return

========================

cp: cannot stat '': No such file or directory

FAIL grub_script_return (exit status: 1)

FAIL: grub_cmd_regexp

=====================

cp: cannot stat '': No such file or directory

FAIL grub_cmd_regexp (exit status: 1)

FAIL: grub_cmd_date

===================

cp: cannot stat '': No such file or directory

Date not in range: 1690428943 <= 1690416000 <= 1690428943

FAIL grub_cmd_date (exit status: 1)

FAIL: grub_cmd_sleep

====================

cp: cannot stat '': No such file or directory

FAIL grub_cmd_sleep (exit status: 1)

FAIL: grub_script_expansion

===========================

cp: cannot stat '': No such file or directory

FAIL grub_script_expansion (exit status: 1)

FAIL: grub_script_not

=====================

cp: cannot stat '': No such file or directory

FAIL grub_script_not (exit status: 1)

SKIP: partmap_test

==================

parted not installed; cannot test partmap

SKIP partmap_test (exit status: 77)

SKIP: xzcompress_test

=====================

xz not installed; cannot test xz compression.

SKIP xzcompress_test (exit status: 77)

SKIP: gzcompress_test

=====================

gzip not installed; cannot test gzip compression.

SKIP gzcompress_test (exit status: 77)

SKIP: lzocompress_test

======================

lzop not installed; cannot test lzo compression.

SKIP lzocompress_test (exit status: 77)

FAIL: grub_cmd_echo

===================

cp: cannot stat '': No such file or directory

FAIL grub_cmd_echo (exit status: 1)

FAIL: help_test

===============

cp: cannot stat '': No such file or directory

FAIL help_test (exit status: 1)

FAIL: grub_script_gettext

=========================

cp: cannot stat '': No such file or directory

FAIL grub_script_gettext (exit status: 1)

FAIL: grub_script_escape_comma

==============================

cp: cannot stat '': No such file or directory

FAIL grub_script_escape_comma (exit status: 1)

FAIL: grub_script_strcmp

========================

cp: cannot stat '': No such file or directory

FAIL grub_script_strcmp (exit status: 1)

FAIL: test_sha512sum

====================

cp: cannot stat '': No such file or directory

GRUB sha512sum output did not match sha512sum output.

See diff -u /tmp/guix-build-grub-coreboot-2.06.drv-0/tmp.3JBlCBhBGy /tmp/guix-build-grub-coreboot-2.06.drv-0/tmp.1s7bz8jSnV

FAIL test_sha512sum (exit status: 1)

FAIL: test_unset

================

cp: cannot stat '': No such file or directory

FAIL test_unset (exit status: 1)

FAIL: grub_cmd_tr

=================

cp: cannot stat '': No such file or directory

FAIL grub_cmd_tr (exit status: 1)

FAIL: file_filter_test

======================

cp: cannot stat '': No such file or directory

FAIL file_filter_test (exit status: 1)

error: in phase 'check': uncaught exception:

%exception #<&invoke-error program: "make" arguments: ("check" "-j" "2") exit-status: 2 term-signal: #f stop-signal: #f>

phase `check' failed after 34.0 seconds

command "make" "check" "-j" "2" failed with status 2

builder for `/gnu/store/h78fy12q7nijz54ppfdr7z3h7yvpnyxs-grub-coreboot-2.06.drv' failed with exit code 1

build of /gnu/store/h78fy12q7nijz54ppfdr7z3h7yvpnyxs-grub-coreboot-2.06.drv failed

View build log at '/var/log/guix/drvs/h7/8fy12q7nijz54ppfdr7z3h7yvpnyxs-grub-coreboot-2.06.drv.gz'.

guix build: error: build of `/gnu/store/h78fy12q7nijz54ppfdr7z3h7yvpnyxs-grub-coreboot-2.06.drv' failed

Denis

On 2023-07-27, Denis 'GNUtoo' Carikli wrote:

Still seems a bit brief, but I suppose it is not terrible. :)

I might want to identify in the comment which tests need a coreboot

image and which need cbfstool for example. If it is really involved,

perhaps a link to a more detailed explanation, such as to a comment

filed on this bug report.

Well...

Disabling all the tests means that you would miss out on at least 19

tests that currently PASS (but might someday fail, because they are

actually presumably testing something)...

Are all of the failures or skipped tests things that cannot reasonably

be fixed, such as being unable to build a coreboot image or cbfstool?

live well,

vagrant

Hi,

On Tue, 29 Aug 2023 15:58:33 -0700

Vagrant Cascadian <vagrant@debian.org> wrote:

With:

and:

I've looked and luckily all the tests that we need to disable fail

because they miss a Coreboot image.

I'll send a v2.

In the v2 I've also improved a bit the description of the issue.

Denis.

---

ChangeLog:

So now:

* Only theses tests are disabled, enabling other tests to run.

* There is a better comment explaning why these tests needed to be disabled.

---

gnu/packages/bootloaders.scm | 67 +++++++++++++++++++++++++++++++++++-

1 file changed, 66 insertions(+), 1 deletion(-)

On Fri, 15 Sep 2023 16:31:59 +0200

Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org> wrote:

That is now done.

Ping.

Denis.

On 2023-11-23, Denis 'GNUtoo' Carikli wrote:

Never received the patch; it was only sent to the bug tracking system,

not the team members.

Pushed now as:

4b6f6b3e180afc5d1b286130710dd9e3eb6c2889 gnu: Add grub-coreboot

live well,

vagrant