please add smbios module to the signed grub2 images

Bug #1856424 reported by Dimitri John Ledkov
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
grub2 (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Fix Released
Undecided
Unassigned

Bug Description

smbios is a new module available in grub2 upstream master, merged shortly after 2.04 release.

It allows reading values from various SMBIOS tables to allow detecting vendor, make, model among with other smbios defined handles. In terms of userspace, it can be compared to dmidecode.

The premise to include this module in the EFI prebuild images is to allow automatic selection of appropriate kernel and kernel option at boot time of certified or specilized hardware.

For example:
- allowing to choose linux-hwe kernel on newer generation
  (query handle 0x37, dmi type 4 Processor information)
- allowing to choose linux-oem kernel on OEM certified hardware
  (query handle 0x1, DMI type 1, Manufactuere / serial number / sku number)
- allowing to choose correct DTB for arm64 Laptops

The grub module itself is fairly trivial, and basically dumps memory, processes it into various data types, optionally storing them in a variable thus allowing making scripting decisions based on them (i.e. setting the 'default' menuetry)

This is a request to review this module for inclusion in the prebuilt UEFI signed images of grub.

As a patch:
http://git.savannah.gnu.org/cgit/grub.git/commit/?id=688023cd0ac4c985fd0e2ec477fcf1ec33a0e49c

Main Files:
http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/smbios.c?id=688023cd0ac4c985fd0e2ec477fcf1ec33a0e49c
http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/i386/pc/smbios.c?id=688023cd0ac4c985fd0e2ec477fcf1ec33a0e49c
http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/efi/smbios.c?id=688023cd0ac4c985fd0e2ec477fcf1ec33a0e49c

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Alternative measures avoiding using this module, would be to attempt a kexec from initrd to the right kernel flavour. Which may increase boot time a little bit, but should otherwise allow similar levels of detection.

Note that signed kexec is available these days.

tags: added: rls-ff-incoming
tags: added: oem-desktop-cd
tags: added: id-5df5114fdef31b76021f5a94
Changed in grub2 (Ubuntu):
status: New → Triaged
tags: removed: rls-ff-incoming
Revision history for this message
Chris Coulson (chrisccoulson) wrote :

Hi,

I've given this module a quick review - it looks ok for including in the EFI image. I only have one small note on the while loop in grub_smbios_match_structure, which I made because I thought it looked a bit suspicious:

  while (ptr < table_end
         && ptr[1] >= 4 /* Valid structures include the 4-byte header. */
         && (structure_count++ < structures || structures == 0))
    {
      grub_uint16_t structure_handle = grub_get_unaligned16 (ptr + 2);

... the "ptr < table_end" condition isn't completely sufficient to prevent reads beyond table_end because it reads the size field (ptr[1] >= 4) and the handle (grub_get_unaligned (ptr + 2)) even when this condition is true. But I don't think there's a real issue here as it would require a broken smbios implementation to end up in the situation where ptr is close enough to table_end to cause a read beyond the end of it inside the loop.

Changed in grub2 (Ubuntu Focal):
status: Triaged → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package grub2 - 2.04-1ubuntu20

---------------
grub2 (2.04-1ubuntu20) focal; urgency=medium

  * build-efi-images: do not produce -installer.efi.signed. LP: #1863994

grub2 (2.04-1ubuntu19) focal; urgency=medium

  * uefi-firmware: rename fwsetup menuentry to UEFI Firmware Settings
    (LP: #1864547)
  * build-efi-images: add smbios module to the prebuilt signed EFI images
    (LP: #1856424)

 -- Dimitri John Ledkov <email address hidden> Tue, 25 Feb 2020 01:11:31 +0000

Changed in grub2 (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Frédéric TOURRET (ftourret) wrote :

Hi,

I'm a beginner in GRUB2 and for my use i need to have BIOS information to test the model of hardware i'm uses and fix kernel parameters.

I'm working on Debian Jessie. I have downloaded latest sources of GRUB (2.04) and install it correctly. But smbios module is not present, how can i include smbios.mod sources ?

Thanks for your help.

Greatings
F. TOURRET

Revision history for this message
Dimitri John Ledkov (xnox) wrote : Re: [Bug 1856424] Re: please add smbios module to the signed grub2 images

On Thu, 4 Jun 2020, 10:21 Frédéric TOURRET, <email address hidden>
wrote:

> Hi,
>
> I'm a beginner in GRUB2 and for my use i need to have BIOS information
> to test the model of hardware i'm uses and fix kernel parameters.
>
> I'm working on Debian Jessie. I have downloaded latest sources of GRUB
> (2.04) and install it correctly. But smbios module is not present, how
> can i include smbios.mod sources ?
>
> Thanks for your help.
>

It is included in Ubuntu, so please switch and use Ubuntu.

This bug report is specific to Ubuntu distribution, and the grub that
ubuntu ships, with ubuntu patches. And it is not appropriate to enquire
about upstream grub development.

Grub upstream development is at https://www.gnu.org/software/grub/ you will
find mailing lists there that can help you with upstream grub sources.

For example, did you try building grub form upstream git master?

Please join grub upstream mailing lists to enquire about upstream grub
development or upstream support further.

Regards,

Dimitri.

Revision history for this message
Nikhil (nsahu729) wrote :

Hi,

I am following the above thread. I applied the above patch to add the smbios module on grub 2.04. But even after patch is applied I am not able to get the module on my grub.

This exercise I did on yocto dunfell.

Can anyone suggest, DO/How we can install this on grub? or what extra we need to do to access this on my grub 2.04.

Thanks in advance.
Nikhil Sahu

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.