GRUB2: Difference between revisions

From coreboot
Jump to navigation Jump to search
Line 45: Line 45:
  terminal_input --append  serial
  terminal_input --append  serial
  terminal_output --append serial
  terminal_output --append serial
== Compiling GRUB2 for being use as a payload ==
See [[Talk:GRUB2]] and [https://lists.gnu.org/archive/html/grub-devel/2011-06/msg00003.html here] for more details.


=== Compiling ===
=== Compiling ===
Line 58: Line 55:
=== creating the grub payload (with a memdisk) ===
=== creating the grub payload (with a memdisk) ===
  cd grub-core
  cd grub-core
  tar cvf ../memdisk.tar serial.mod terminal.mod normal.mod echo.mod ahci.mod all_video.mod ata.mod boot.mod cat.mod chain.mod configfile.mod crypto.mod elf.mod ext2.mod extcmd.mod fshelp.mod help.mod linux.mod memdisk.mod minicmd.mod multiboot2.mod pata.mod part_msdos.mod gettext.mod --transform 's#^#/boot/grub/i386-coreboot/#'
  tar cvf ../memdisk.tar serial.mod terminal.mod normal.mod echo.mod  
ahci.mod all_video.mod ata.mod boot.mod cat.mod chain.mod configfile.mod
crypto.mod elf.mod ext2.mod extcmd.mod fshelp.mod help.mod linux.mod  
memdisk.mod minicmd.mod multiboot2.mod pata.mod part_msdos.mod  
gettext.mod --transform 's#^#/boot/grub/i386-coreboot/#'
  tar uvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  tar uvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar ehci ohci uhci at_keyboard usb_keyboard -m ../memdisk.tar
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar  
ehci ohci uhci at_keyboard usb_keyboard -m ../memdisk.tar
  ls -l -h ../../grub2.elf
  ls -l -h ../../grub2.elf


=== creating the grub payload (without a memdisk) ===
=== creating the grub payload (without a memdisk) ===
  cd grub-core
  cd grub-core
  modules="serial terminal normal echo ahci all_video ata boot cat chain configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd multiboot2 pata part_msdos gettext"
  modules="serial terminal normal echo ahci all_video ata boot cat chain  
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar ehci ohci uhci at_keyboard usb_keyboard ${modules}
configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd  
multiboot2 pata part_msdos gettext"
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar  
ehci ohci uhci at_keyboard usb_keyboard ${modules}
  ls -l -h ../../grub2.elf
  ls -l -h ../../grub2.elf


Line 72: Line 77:
  cd grub-core
  cd grub-core
  tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  modules="serial terminal normal echo ahci all_video ata boot cat chain configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd multiboot2 pata part_msdos gettext"
  modules="serial terminal normal echo ahci all_video ata boot cat chain  
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar ehci ohci uhci at_keyboard usb_keyboard ${modules} -m ../memdisk.tar
configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd  
multiboot2 pata part_msdos gettext"
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar  
ehci ohci uhci at_keyboard usb_keyboard ${modules} -m ../memdisk.tar
  ls -l -h ../../grub2.elf
  ls -l -h ../../grub2.elf
=== With all modules(possible with last grub from bzr) And a memdisk for grub.cfg ===
=== With all modules(possible with last grub from bzr) And a memdisk for
grub.cfg ===
  cd grub-core
  cd grub-core
  tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
  memdisk="$(ls *.mod | sed 's#.mod$##g')"
  memdisk="$(ls *.mod | sed 's#.mod$##g')"
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf ${modules} -m ../memdisk.tar
  ../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf ${modules} -m  
../memdisk.tar
  ls -l -h ../../grub2.elf
  ls -l -h ../../grub2.elf


=== combining with coreboot ===
=== combining with coreboot ===
==== As a SeaBIOS payload ====
==== As a SeaBIOS payload ====
  build/cbfstool build/coreboot.rom add-payload -n img/grub2 -f grub2.elf -t raw
  build/cbfstool build/coreboot.rom add-payload -n img/grub2 -f grub2.elf
-t raw
  build/cbfstool build/coreboot.rom print
  build/cbfstool build/coreboot.rom print
That way it will be possible to run grub2 as a payload after SeaBIOS: The advantage is that it's less risky. At runtime press F12 and you'll have the grub2 option.
That way it will be possible to run grub2 as a payload after SeaBIOS:  
The advantage is that it's less risky. At runtime press F12 and you'll  
have the grub2 option.
==== As a Coreboot payload ====
==== As a Coreboot payload ====
Advantages: faster, can be used for security
Advantages: faster, can be used for security
Line 96: Line 109:
In make menuconfig of coreboot, select the path of grub2.elf.
In make menuconfig of coreboot, select the path of grub2.elf.


Also make sure you have some kinds of output such as VGA or serial(it needs to be activated in both coreboot and grub)
Also make sure you have some kinds of output such as VGA or serial(it  
needs to be activated in both coreboot and grub)

Revision as of 19:54, 13 March 2013

GRUB2 is a modular, multiboot-capable bootloader for many operating systems that can be used as a payload for coreboot.

Status

Grub2 can be launched:

  • Directly by coreboot as a payload
  • Directly by SeaBIOS as a payload
  • By SeaBIOS, on disk, as it would with a normal BIOS.

Recent bzr versions have improved memory management that removes the memory limitations when ran as a payload.

features

Security

LUKS disks openning

grub is capable of opening LUKS disks like that:

grub> ls 
(ata2) (ata2,msdos3) (ata2,msdos2) (ata2,msdos1) (usb0) (usb0,msdos1) (ata6) (memdisk)
grub> cryptomount (ata2,msdos3)
Attempting to decrypt master key...
Enter passphrase for ata2,msdos3 (431439b0870f40a3bfe8f3ca3aa7072a):
Slot 0 opened
grub> ls
(crypto0) (ata2) (ata2,msdos3) (ata2,msdos2) (ata2,msdos1) (usb0) (usb0,msdos1) (ata6) (memdisk) 
grub> set root=crypto0
grub> ls /
lost+found/ boot/ var/ dev/ run/ etc/ tmp/ sys/ proc/ usr/ lib sbin/ bin/ home/
mnt/ opt/ root/ srv/ media/

Note that you have to type the password and so it's better to have some kind of output(VGA, Serial etc...)

Other features

SeaBIOS launching

grub is capable of launching seabios like that: Add Seabios to the memdisk:

tar uvf ../memdisk.tar ../../seabios/out/bios.bin.elf --transform 's#.*#/bios.bin.elf#'

Then add that to grub.cfg:

menuentry 'SeaBios' {
	set root='memdisk'
	echo    'Loading SeaBios ...'
	chainloader /bios.bin.elf
}

grub.cfg

Serial

To enable serial, add the following on top of your grub.cfg:

serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
terminal_input --append  serial
terminal_output --append serial

Compiling

bzr branch http://bzr.savannah.gnu.org/r/grub/trunk/grub
cd grub
./autogen.sh
./configure --with-platform=coreboot
make

creating the grub payload (with a memdisk)

cd grub-core
tar cvf ../memdisk.tar serial.mod terminal.mod normal.mod echo.mod 

ahci.mod all_video.mod ata.mod boot.mod cat.mod chain.mod configfile.mod

crypto.mod elf.mod ext2.mod extcmd.mod fshelp.mod help.mod linux.mod 

memdisk.mod minicmd.mod multiboot2.mod pata.mod part_msdos.mod gettext.mod --transform 's#^#/boot/grub/i386-coreboot/#'

tar uvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar 

ehci ohci uhci at_keyboard usb_keyboard -m ../memdisk.tar

ls -l -h ../../grub2.elf

creating the grub payload (without a memdisk)

cd grub-core
modules="serial terminal normal echo ahci all_video ata boot cat chain 

configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd multiboot2 pata part_msdos gettext"

../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar 

ehci ohci uhci at_keyboard usb_keyboard ${modules}

ls -l -h ../../grub2.elf

creating the grub payload (with a memdisk for the config file)

cd grub-core
tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
modules="serial terminal normal echo ahci all_video ata boot cat chain 

configfile crypto elf ext2 extcmd fshelp help linux memdisk minicmd multiboot2 pata part_msdos gettext"

../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf memdisk tar 

ehci ohci uhci at_keyboard usb_keyboard ${modules} -m ../memdisk.tar

ls -l -h ../../grub2.elf

=== With all modules(possible with last grub from bzr) And a memdisk for

grub.cfg ===
cd grub-core
tar cvf ../memdisk.tar grub.cfg  --transform 's#^#/boot/grub/#'
memdisk="$(ls *.mod | sed 's#.mod$##g')"
../grub-mkimage -d . -O i386-coreboot -o ../../grub2.elf ${modules} -m 

../memdisk.tar

ls -l -h ../../grub2.elf

combining with coreboot

As a SeaBIOS payload

build/cbfstool build/coreboot.rom add-payload -n img/grub2 -f grub2.elf
-t raw
build/cbfstool build/coreboot.rom print

That way it will be possible to run grub2 as a payload after SeaBIOS: The advantage is that it's less risky. At runtime press F12 and you'll have the grub2 option.

As a Coreboot payload

Advantages: faster, can be used for security

Disadvantages: more risky if you have no way to recover

Howto

In make menuconfig of coreboot, select the path of grub2.elf.

Also make sure you have some kinds of output such as VGA or serial(it needs to be activated in both coreboot and grub)