i386-pc: build verifiers API as module

Given no core functions on i386-pc would require verifiers to work and
the only consumer of the verifier API is the pgp module, it looks good
to me that we can move the verifiers out of the kernel image and let
moddep.lst to auto-load it when pgp is loaded on i386-pc platform.

This helps to reduce the size of core image and thus can relax the
tension of exploding on some i386-pc system with very short MBR gap
size. See also a very comprehensive summary from Colin [1] about the
details.

[1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00240.html

V2:
Drop COND_NOT_i386_pc and use !COND_i386_pc.
Add comment in kern/verifiers.c to help understanding what's going on
without digging into the commit history.

Reported-by: Colin Watson <cjwatson@debian.org>
Reviewed-by: Colin Watson <cjwatson@debian.org>
Signed-off-by: Michael Chang <mchang@suse.com>
Origin: other, https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00251.html
Bug-Debian: https://bugs.debian.org/984488
Bug-Debian: https://bugs.debian.org/985374
Last-Update: 2021-09-24

Patch-Name: pc-verifiers-module.patch

Gbp-Pq: Name pc-verifiers-module.patch

diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
index f18550c1c98ee372a47b490b9632356a1faa5bca..f9d4aa27de665620a2a1fc0c90fcd8fca12f0b19 100644 (file)
--- a/grub-core/Makefile.am
+++ b/grub-core/Makefile.am
@@ -93,7 +93,9 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/stack_protector.h
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h
+if !COND_i386_pc
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/verify.h
+endif
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm_private.h
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/net.h
 KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/memory.h

diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 044e53c2919435b5e43df221f00ce0a0bd3d68d0..333d3fe425b96d99562b95c551708c7041519eae 100644 (file)
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -152,7 +152,7 @@ kernel = {
   common = kern/rescue_parser.c;
   common = kern/rescue_reader.c;
   common = kern/term.c;
-  common = kern/verifiers.c;
+  nopc = kern/verifiers.c;
 
   noemu = kern/compiler-rt.c;
   noemu = kern/mm.c;
@@ -975,6 +975,12 @@ module = {
   cppflags = '-I$(srcdir)/lib/posix_wrap';
 };
 
+module = {
+  name = verifiers;
+  common = kern/verifiers.c;
+  enable = i386_pc;
+};
+
 module = {
   name = hdparm;
   common = commands/hdparm.c;

diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c
index 8401bc376ab356538e18629dd6865facf8c6183f..1258514e05e351fc82450746be1297abf3698bd0 100644 (file)
--- a/grub-core/kern/main.c
+++ b/grub-core/kern/main.c
@@ -29,7 +29,9 @@
 #include <grub/command.h>
 #include <grub/reader.h>
 #include <grub/parser.h>
+#ifndef GRUB_MACHINE_PCBIOS
 #include <grub/verify.h>
+#endif
 
 #ifdef GRUB_MACHINE_PCBIOS
 #include <grub/machine/memory.h>
@@ -296,8 +298,10 @@ grub_main (void)
 #endif
 #endif
 
+#ifndef GRUB_MACHINE_PCBIOS
   /* Init verifiers API. */
   grub_verifiers_init ();
+#endif
 
   grub_load_config ();
 

diff --git a/grub-core/kern/verifiers.c b/grub-core/kern/verifiers.c
index 75d7994cf6e388d5eb2dbe8d80e6414c1c026aa8..1245d0d9ed35c29c0b348b30ad78dcd8e27b6e38 100644 (file)
--- a/grub-core/kern/verifiers.c
+++ b/grub-core/kern/verifiers.c
@@ -221,8 +221,25 @@ grub_verify_string (char *str, enum grub_verify_string_type type)
   return GRUB_ERR_NONE;
 }
 
+/*
+ * It is intended to build verifiers as module on i386-pc platform to minimize
+ * the impact of growing core image size could blow up the 63 sectors limit of
+ * some MBR gap one day. It is also adequate to do so, given no core function
+ * on i386-pc would require the verifiers API to work.
+ */
+#ifdef GRUB_MACHINE_PCBIOS
+GRUB_MOD_INIT(verifiers)
+#else
 void
 grub_verifiers_init (void)
+#endif
 {
   grub_file_filter_register (GRUB_FILE_FILTER_VERIFY, grub_verifiers_open);
 }
+
+#ifdef GRUB_MACHINE_PCBIOS
+GRUB_MOD_FINI(verifiers)
+{
+  grub_file_filter_unregister (GRUB_FILE_FILTER_VERIFY);
+}
+#endif

diff --git a/include/grub/verify.h b/include/grub/verify.h
index 672ae16924674d7a58d8b6b669d4aa333b6c689b..67448165f4fa89dc4942c4de11b4fcfda23d6dc7 100644 (file)
--- a/include/grub/verify.h
+++ b/include/grub/verify.h
@@ -65,10 +65,14 @@ struct grub_file_verifier
   grub_err_t (*verify_string) (char *str, enum grub_verify_string_type type);
 };
 
+#ifdef GRUB_MACHINE_PCBIOS
+extern struct grub_file_verifier *grub_file_verifiers;
+#else
 extern struct grub_file_verifier *EXPORT_VAR (grub_file_verifiers);
 
 extern void
 grub_verifiers_init (void);
+#endif
 
 static inline void
 grub_verifier_register (struct grub_file_verifier *ver)
@@ -82,7 +86,12 @@ grub_verifier_unregister (struct grub_file_verifier *ver)
   grub_list_remove (GRUB_AS_LIST (ver));
 }
 
+#ifdef GRUB_MACHINE_PCBIOS
+grub_err_t
+grub_verify_string (char *str, enum grub_verify_string_type type);
+#else
 extern grub_err_t
 EXPORT_FUNC (grub_verify_string) (char *str, enum grub_verify_string_type type);
+#endif
 
 #endif /* ! GRUB_VERIFY_HEADER */