62e3547e57
- Version bump to 2.04 * removed - translations-20170427.tar.xz * grub2.spec - Make signed grub-tpm.efi specific to x86_64-efi build, the platform currently shipped with tpm module from upstream codebase - Add shim_lock to signed grub.efi in x86_64-efi build - x86_64: linuxefi now depends on linux, both will verify kernel via shim_lock - Remove translation tarball and po file hacks as it's been included in upstream tarball * rediff - grub2-setup-try-fs-embed-if-mbr-gap-too-small.patch - grub2-commands-introduce-read_file-subcommand.patch - grub2-secureboot-add-linuxefi.patch - 0001-add-support-for-UEFI-network-protocols.patch - grub2-efi-HP-workaround.patch - grub2-secureboot-install-signed-grub.patch - grub2-linux.patch - use-grub2-as-a-package-name.patch - grub2-pass-corret-root-for-nfsroot.patch - grub2-secureboot-use-linuxefi-on-uefi.patch - grub2-secureboot-no-insmod-on-sb.patch - grub2-secureboot-provide-linuxefi-config.patch - grub2-secureboot-chainloader.patch - grub2-s390x-01-Changes-made-and-files-added-in-order-to-allow-s390x.patch - grub2-s390x-02-kexec-module-added-to-emu.patch - grub2-s390x-04-grub2-install.patch - grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch - grub2-efi-chainloader-root.patch OBS-URL: https://build.opensuse.org/request/show/741033 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=340
691 lines
20 KiB
Diff
691 lines
20 KiB
Diff
From 06ff1079788fedac5e3f1f12ed7bbe69228a7ae0 Mon Sep 17 00:00:00 2001
|
|
From: Michael Chang <mchang@suse.com>
|
|
Date: Tue, 18 Dec 2012 16:54:03 +0800
|
|
Subject: [PATCH] Add secureboot support on efi chainloader
|
|
|
|
References: fate#314485
|
|
Patch-Mainline: no
|
|
|
|
Expand the chainloader to be able to verify the image by means of shim
|
|
lock protocol. The PE/COFF image is loaded and relocated by the
|
|
chainloader instead of calling LoadImage and StartImage UEFI boot
|
|
Service as they require positive verification result from keys enrolled
|
|
in KEK or DB. The shim will use MOK in addition to firmware enrolled
|
|
keys to verify the image.
|
|
|
|
The chainloader module could be used to load other UEFI bootloaders,
|
|
such as xen.efi, and could be signed by any of MOK, KEK or DB.
|
|
|
|
Signed-off-by: Michael Chang <mchang@suse.com>
|
|
---
|
|
grub-core/loader/efi/chainloader.c | 538 +++++++++++++++++++++++++++++++++--
|
|
1 files changed, 507 insertions(+), 31 deletions(-)
|
|
|
|
Index: grub-2.04~rc1/grub-core/loader/efi/chainloader.c
|
|
===================================================================
|
|
--- grub-2.04~rc1.orig/grub-core/loader/efi/chainloader.c
|
|
+++ grub-2.04~rc1/grub-core/loader/efi/chainloader.c
|
|
@@ -40,15 +40,31 @@
|
|
#include <grub/i386/macho.h>
|
|
#endif
|
|
|
|
+#ifdef __x86_64__
|
|
+#define SUPPORT_SECURE_BOOT
|
|
+#endif
|
|
+
|
|
+#ifdef SUPPORT_SECURE_BOOT
|
|
+#include <grub/efi/pe32.h>
|
|
+#endif
|
|
+
|
|
GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
|
static grub_dl_t my_mod;
|
|
|
|
static grub_efi_physical_address_t address;
|
|
static grub_efi_uintn_t pages;
|
|
+static grub_ssize_t fsize;
|
|
static grub_efi_device_path_t *file_path;
|
|
static grub_efi_handle_t image_handle;
|
|
static grub_efi_char16_t *cmdline;
|
|
+static grub_ssize_t cmdline_len;
|
|
+static grub_efi_handle_t dev_handle;
|
|
+
|
|
+#ifdef SUPPORT_SECURE_BOOT
|
|
+static grub_efi_boolean_t debug_secureboot = 0;
|
|
+static grub_efi_status_t (*entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table);
|
|
+#endif
|
|
|
|
static grub_err_t
|
|
grub_chainloader_unload (void)
|
|
@@ -63,6 +79,7 @@ grub_chainloader_unload (void)
|
|
grub_free (cmdline);
|
|
cmdline = 0;
|
|
file_path = 0;
|
|
+ dev_handle = 0;
|
|
|
|
grub_dl_unref (my_mod);
|
|
return GRUB_ERR_NONE;
|
|
@@ -197,12 +214,460 @@ make_file_path (grub_efi_device_path_t *
|
|
return file_path;
|
|
}
|
|
|
|
+#ifdef SUPPORT_SECURE_BOOT
|
|
+#define SHIM_LOCK_GUID \
|
|
+ { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} }
|
|
+
|
|
+struct grub_pe32_header_no_msdos_stub
|
|
+{
|
|
+ char signature[GRUB_PE32_SIGNATURE_SIZE];
|
|
+ struct grub_pe32_coff_header coff_header;
|
|
+ struct grub_pe64_optional_header optional_header;
|
|
+};
|
|
+
|
|
+struct pe_coff_loader_image_context
|
|
+{
|
|
+ grub_efi_uint64_t image_address;
|
|
+ grub_efi_uint64_t image_size;
|
|
+ grub_efi_uint64_t entry_point;
|
|
+ grub_efi_uintn_t size_of_headers;
|
|
+ grub_efi_uint16_t image_type;
|
|
+ grub_efi_uint16_t number_of_sections;
|
|
+ struct grub_pe32_section_table *first_section;
|
|
+ struct grub_pe32_data_directory *reloc_dir;
|
|
+ struct grub_pe32_data_directory *sec_dir;
|
|
+ grub_efi_uint64_t number_of_rva_and_sizes;
|
|
+ struct grub_pe32_header_no_msdos_stub *pe_hdr;
|
|
+};
|
|
+
|
|
+typedef struct pe_coff_loader_image_context pe_coff_loader_image_context_t;
|
|
+
|
|
+struct grub_efi_shim_lock
|
|
+{
|
|
+ grub_efi_status_t (*verify)(void *buffer,
|
|
+ grub_efi_uint32_t size);
|
|
+ grub_efi_status_t (*hash)(void *data,
|
|
+ grub_efi_int32_t datasize,
|
|
+ pe_coff_loader_image_context_t *context,
|
|
+ grub_efi_uint8_t *sha256hash,
|
|
+ grub_efi_uint8_t *sha1hash);
|
|
+ grub_efi_status_t (*context)(void *data,
|
|
+ grub_efi_uint32_t size,
|
|
+ pe_coff_loader_image_context_t *context);
|
|
+};
|
|
+
|
|
+typedef struct grub_efi_shim_lock grub_efi_shim_lock_t;
|
|
+
|
|
+static grub_efi_boolean_t
|
|
+grub_secure_validate (void *data, grub_efi_uint32_t size)
|
|
+{
|
|
+ grub_efi_guid_t guid = SHIM_LOCK_GUID;
|
|
+ grub_efi_shim_lock_t *shim_lock;
|
|
+
|
|
+ shim_lock = grub_efi_locate_protocol (&guid, NULL);
|
|
+
|
|
+ if (!shim_lock)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol");
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ if (shim_lock->verify (data, size) == GRUB_EFI_SUCCESS)
|
|
+ {
|
|
+ grub_dprintf ("chain", "verify success\n");
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "verify failed");
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static grub_efi_boolean_t
|
|
+grub_secure_mode (void)
|
|
+{
|
|
+ grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
|
|
+ grub_uint8_t *data;
|
|
+ grub_size_t datasize;
|
|
+
|
|
+ data = grub_efi_get_variable ("SecureBoot", &efi_var_guid, &datasize);
|
|
+
|
|
+ if (data)
|
|
+ {
|
|
+ grub_dprintf ("chain", "SecureBoot: %d, datasize %d\n", (int)*data, (int)datasize);
|
|
+ }
|
|
+
|
|
+ if (data && (datasize == 1))
|
|
+ {
|
|
+ if (*data != 1)
|
|
+ {
|
|
+ grub_dprintf ("chain", "secure boot not enabled\n");
|
|
+ return 0;
|
|
+ }
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ grub_dprintf ("chain", "unknown secure boot status\n");
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ grub_free (data);
|
|
+
|
|
+ data = grub_efi_get_variable ("SetupMode", &efi_var_guid, &datasize);
|
|
+
|
|
+ if (data)
|
|
+ {
|
|
+ grub_dprintf ("chain", "SetupMode: %d, datasize %d\n", (int)*data, (int)datasize);
|
|
+ }
|
|
+
|
|
+ if (data && (datasize == 1))
|
|
+ {
|
|
+ if (*data == 1)
|
|
+ {
|
|
+ grub_dprintf ("chain", "platform in setup mode\n");
|
|
+ return 0;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ grub_free (data);
|
|
+
|
|
+ return 1;
|
|
+}
|
|
+
|
|
+static grub_efi_boolean_t
|
|
+read_header (void *data, grub_efi_uint32_t size, pe_coff_loader_image_context_t *context)
|
|
+{
|
|
+ grub_efi_guid_t guid = SHIM_LOCK_GUID;
|
|
+ grub_efi_shim_lock_t *shim_lock;
|
|
+ grub_efi_status_t status;
|
|
+
|
|
+ shim_lock = grub_efi_locate_protocol (&guid, NULL);
|
|
+
|
|
+ if (!shim_lock)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol");
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ status = shim_lock->context (data, size, context);
|
|
+
|
|
+ if (status == GRUB_EFI_SUCCESS)
|
|
+ {
|
|
+ grub_dprintf ("chain", "context success\n");
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ switch (status)
|
|
+ {
|
|
+ case GRUB_EFI_UNSUPPORTED:
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error unsupported");
|
|
+ break;
|
|
+ case GRUB_EFI_INVALID_PARAMETER:
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error invalid parameter");
|
|
+ break;
|
|
+ default:
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error code");
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static void*
|
|
+image_address (void *image, grub_efi_uint64_t sz, grub_efi_uint64_t adr)
|
|
+{
|
|
+ if (adr > sz)
|
|
+ return NULL;
|
|
+
|
|
+ return ((grub_uint8_t*)image + adr);
|
|
+}
|
|
+
|
|
+static grub_efi_status_t
|
|
+relocate_coff (pe_coff_loader_image_context_t *context, void *data)
|
|
+{
|
|
+ struct grub_pe32_data_directory *reloc_base, *reloc_base_end;
|
|
+ grub_efi_uint64_t adjust;
|
|
+ grub_efi_uint16_t *reloc, *reloc_end;
|
|
+ char *fixup, *fixup_base, *fixup_data = NULL;
|
|
+ grub_efi_uint16_t *fixup_16;
|
|
+ grub_efi_uint32_t *fixup_32;
|
|
+ grub_efi_uint64_t *fixup_64;
|
|
+
|
|
+ grub_efi_uint64_t size = context->image_size;
|
|
+ void *image_end = (char *)data + size;
|
|
+
|
|
+ context->pe_hdr->optional_header.image_base = (grub_uint64_t)data;
|
|
+
|
|
+ if (context->number_of_rva_and_sizes <= 5 || context->reloc_dir->size == 0)
|
|
+ {
|
|
+ grub_dprintf ("chain", "no need to reloc, we are done\n");
|
|
+ return GRUB_EFI_SUCCESS;
|
|
+ }
|
|
+
|
|
+ reloc_base = image_address (data, size, context->reloc_dir->rva);
|
|
+ reloc_base_end = image_address (data, size, context->reloc_dir->rva + context->reloc_dir->size -1);
|
|
+
|
|
+ grub_dprintf ("chain", "reloc_base %p reloc_base_end %p\n", reloc_base, reloc_base_end);
|
|
+
|
|
+ if (!reloc_base || !reloc_base_end)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary");
|
|
+ return GRUB_EFI_UNSUPPORTED;
|
|
+ }
|
|
+
|
|
+ adjust = (grub_uint64_t)data - context->image_address;
|
|
+
|
|
+ while (reloc_base < reloc_base_end)
|
|
+ {
|
|
+ reloc = (grub_uint16_t *)((char*)reloc_base + sizeof (struct grub_pe32_data_directory));
|
|
+ reloc_end = (grub_uint16_t *)((char*)reloc_base + reloc_base->size);
|
|
+
|
|
+ if ((void *)reloc_end < data || (void *)reloc_end > image_end)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary");
|
|
+ return GRUB_EFI_UNSUPPORTED;
|
|
+ }
|
|
+
|
|
+ fixup_base = image_address(data, size, reloc_base->rva);
|
|
+
|
|
+ if (!fixup_base)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid fixupbase");
|
|
+ return GRUB_EFI_UNSUPPORTED;
|
|
+ }
|
|
+
|
|
+ while (reloc < reloc_end)
|
|
+ {
|
|
+ fixup = fixup_base + (*reloc & 0xFFF);
|
|
+ switch ((*reloc) >> 12)
|
|
+ {
|
|
+ case GRUB_PE32_REL_BASED_ABSOLUTE:
|
|
+ break;
|
|
+ case GRUB_PE32_REL_BASED_HIGH:
|
|
+ fixup_16 = (grub_uint16_t *)fixup;
|
|
+ *fixup_16 = (grub_uint16_t) (*fixup_16 + ((grub_uint16_t)((grub_uint32_t)adjust >> 16)));
|
|
+ if (fixup_data != NULL)
|
|
+ {
|
|
+ *(grub_uint16_t *) fixup_data = *fixup_16;
|
|
+ fixup_data = fixup_data + sizeof (grub_uint16_t);
|
|
+ }
|
|
+ break;
|
|
+ case GRUB_PE32_REL_BASED_LOW:
|
|
+ fixup_16 = (grub_uint16_t *)fixup;
|
|
+ *fixup_16 = (grub_uint16_t) (*fixup_16 + (grub_uint16_t)adjust );
|
|
+ if (fixup_data != NULL)
|
|
+ {
|
|
+ *(grub_uint16_t *) fixup_data = *fixup_16;
|
|
+ fixup_data = fixup_data + sizeof (grub_uint16_t);
|
|
+ }
|
|
+ break;
|
|
+ case GRUB_PE32_REL_BASED_HIGHLOW:
|
|
+ fixup_32 = (grub_uint32_t *)fixup;
|
|
+ *fixup_32 = *fixup_32 + (grub_uint32_t)adjust;
|
|
+ if (fixup_data != NULL)
|
|
+ {
|
|
+ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint32_t));
|
|
+ *(grub_uint32_t *) fixup_data = *fixup_32;
|
|
+ fixup_data += sizeof (grub_uint32_t);
|
|
+ }
|
|
+ break;
|
|
+ case GRUB_PE32_REL_BASED_DIR64:
|
|
+ fixup_64 = (grub_uint64_t *)fixup;
|
|
+ *fixup_64 = *fixup_64 + (grub_uint64_t)adjust;
|
|
+ if (fixup_data != NULL)
|
|
+ {
|
|
+ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint64_t));
|
|
+ *(grub_uint64_t *) fixup_data = *fixup_64;
|
|
+ fixup_data += sizeof (grub_uint64_t);
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "unknown relocation");
|
|
+ return GRUB_EFI_UNSUPPORTED;
|
|
+ }
|
|
+ reloc += 1;
|
|
+ }
|
|
+ reloc_base = (struct grub_pe32_data_directory *)reloc_end;
|
|
+ }
|
|
+
|
|
+ return GRUB_EFI_SUCCESS;
|
|
+}
|
|
+
|
|
+static grub_efi_device_path_t *
|
|
+grub_efi_get_media_file_path (grub_efi_device_path_t *dp)
|
|
+{
|
|
+ while (1)
|
|
+ {
|
|
+ grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
|
|
+ grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
|
|
+
|
|
+ if (type == GRUB_EFI_END_DEVICE_PATH_TYPE)
|
|
+ break;
|
|
+ else if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE
|
|
+ && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE)
|
|
+ return dp;
|
|
+
|
|
+ dp = GRUB_EFI_NEXT_DEVICE_PATH (dp);
|
|
+ }
|
|
+
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+static grub_efi_boolean_t
|
|
+handle_image (void *data, grub_efi_uint32_t datasize)
|
|
+{
|
|
+ grub_efi_boot_services_t *b;
|
|
+ grub_efi_loaded_image_t *li, li_bak;
|
|
+ grub_efi_status_t efi_status;
|
|
+ char *buffer = NULL;
|
|
+ char *buffer_aligned = NULL;
|
|
+ grub_efi_uint32_t i, size;
|
|
+ struct grub_pe32_section_table *section;
|
|
+ char *base, *end;
|
|
+ pe_coff_loader_image_context_t context;
|
|
+ grub_uint32_t section_alignment;
|
|
+ grub_uint32_t buffer_size;
|
|
+
|
|
+ b = grub_efi_system_table->boot_services;
|
|
+
|
|
+ if (read_header (data, datasize, &context))
|
|
+ {
|
|
+ grub_dprintf ("chain", "Succeed to read header\n");
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ grub_dprintf ("chain", "Failed to read header\n");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ section_alignment = context.pe_hdr->optional_header.section_alignment;
|
|
+ buffer_size = context.image_size + section_alignment;
|
|
+
|
|
+ efi_status = efi_call_3 (b->allocate_pool, GRUB_EFI_LOADER_DATA,
|
|
+ buffer_size, &buffer);
|
|
+
|
|
+ if (efi_status != GRUB_EFI_SUCCESS)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ buffer_aligned = (char *)ALIGN_UP ((grub_addr_t)buffer, section_alignment);
|
|
+
|
|
+ grub_memcpy (buffer_aligned, data, context.size_of_headers);
|
|
+
|
|
+ section = context.first_section;
|
|
+ for (i = 0; i < context.number_of_sections; i++)
|
|
+ {
|
|
+ size = section->virtual_size;
|
|
+ if (size > section->raw_data_size)
|
|
+ size = section->raw_data_size;
|
|
+
|
|
+ base = image_address (buffer_aligned, context.image_size, section->virtual_address);
|
|
+ end = image_address (buffer_aligned, context.image_size, section->virtual_address + size - 1);
|
|
+
|
|
+ if (!base || !end)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid section size");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ if (section->raw_data_size > 0)
|
|
+ grub_memcpy (base, (grub_efi_uint8_t*)data + section->raw_data_offset, size);
|
|
+
|
|
+ if (size < section->virtual_size)
|
|
+ grub_memset (base + size, 0, section->virtual_size - size);
|
|
+
|
|
+ grub_dprintf ("chain", "copied section %s\n", section->name);
|
|
+ section += 1;
|
|
+ }
|
|
+
|
|
+ efi_status = relocate_coff (&context, buffer_aligned);
|
|
+
|
|
+ if (efi_status != GRUB_EFI_SUCCESS)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "relocation failed");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ entry_point = image_address (buffer_aligned, context.image_size, context.entry_point);
|
|
+
|
|
+ if (!entry_point)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ li = grub_efi_get_loaded_image (grub_efi_image_handle);
|
|
+ if (!li)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no loaded image available");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ grub_memcpy (&li_bak, li, sizeof (grub_efi_loaded_image_t));
|
|
+ li->image_base = buffer_aligned;
|
|
+ li->image_size = context.image_size;
|
|
+ li->load_options = cmdline;
|
|
+ li->load_options_size = cmdline_len;
|
|
+ li->file_path = grub_efi_get_media_file_path (file_path);
|
|
+ li->device_handle = dev_handle;
|
|
+ if (li->file_path)
|
|
+ {
|
|
+ grub_printf ("file path: ");
|
|
+ grub_efi_print_device_path (li->file_path);
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found");
|
|
+ goto error_exit;
|
|
+ }
|
|
+
|
|
+ efi_status = efi_call_2 (entry_point, grub_efi_image_handle, grub_efi_system_table);
|
|
+
|
|
+ grub_memcpy (li, &li_bak, sizeof (grub_efi_loaded_image_t));
|
|
+ efi_status = efi_call_1 (b->free_pool, buffer);
|
|
+
|
|
+ return 1;
|
|
+
|
|
+error_exit:
|
|
+ if (buffer)
|
|
+ efi_call_1 (b->free_pool, buffer);
|
|
+
|
|
+ return 0;
|
|
+
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_secureboot_chainloader_unload (void)
|
|
+{
|
|
+ grub_efi_boot_services_t *b;
|
|
+
|
|
+ b = grub_efi_system_table->boot_services;
|
|
+ efi_call_2 (b->free_pages, address, pages);
|
|
+ grub_free (file_path);
|
|
+ grub_free (cmdline);
|
|
+ cmdline = 0;
|
|
+ file_path = 0;
|
|
+ dev_handle = 0;
|
|
+
|
|
+ grub_dl_unref (my_mod);
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_secureboot_chainloader_boot (void)
|
|
+{
|
|
+ handle_image ((void *)address, fsize);
|
|
+ grub_loader_unset ();
|
|
+ return grub_errno;
|
|
+}
|
|
+#endif
|
|
+
|
|
static grub_err_t
|
|
grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
|
|
int argc, char *argv[])
|
|
{
|
|
grub_file_t file = 0;
|
|
- grub_ssize_t size;
|
|
grub_efi_status_t status;
|
|
grub_efi_boot_services_t *b;
|
|
grub_device_t dev = 0;
|
|
@@ -210,7 +675,6 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
grub_efi_loaded_image_t *loaded_image;
|
|
char *filename;
|
|
void *boot_image = 0;
|
|
- grub_efi_handle_t dev_handle = 0;
|
|
|
|
if (argc == 0)
|
|
return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
|
|
@@ -222,9 +686,36 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
address = 0;
|
|
image_handle = 0;
|
|
file_path = 0;
|
|
+ dev_handle = 0;
|
|
|
|
b = grub_efi_system_table->boot_services;
|
|
|
|
+ if (argc > 1)
|
|
+ {
|
|
+ int i;
|
|
+ grub_efi_char16_t *p16;
|
|
+
|
|
+ for (i = 1, cmdline_len = 0; i < argc; i++)
|
|
+ cmdline_len += grub_strlen (argv[i]) + 1;
|
|
+
|
|
+ cmdline_len *= sizeof (grub_efi_char16_t);
|
|
+ cmdline = p16 = grub_malloc (cmdline_len);
|
|
+ if (! cmdline)
|
|
+ goto fail;
|
|
+
|
|
+ for (i = 1; i < argc; i++)
|
|
+ {
|
|
+ char *p8;
|
|
+
|
|
+ p8 = argv[i];
|
|
+ while (*p8)
|
|
+ *(p16++) = *(p8++);
|
|
+
|
|
+ *(p16++) = ' ';
|
|
+ }
|
|
+ *(--p16) = 0;
|
|
+ }
|
|
+
|
|
file = grub_file_open (filename, GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE);
|
|
if (! file)
|
|
goto fail;
|
|
@@ -270,14 +761,14 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
grub_printf ("file path: ");
|
|
grub_efi_print_device_path (file_path);
|
|
|
|
- size = grub_file_size (file);
|
|
- if (!size)
|
|
+ fsize = grub_file_size (file);
|
|
+ if (!fsize)
|
|
{
|
|
grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
filename);
|
|
goto fail;
|
|
}
|
|
- pages = (((grub_efi_uintn_t) size + ((1 << 12) - 1)) >> 12);
|
|
+ pages = (((grub_efi_uintn_t) fsize + ((1 << 12) - 1)) >> 12);
|
|
|
|
status = efi_call_4 (b->allocate_pages, GRUB_EFI_ALLOCATE_ANY_PAGES,
|
|
GRUB_EFI_LOADER_CODE,
|
|
@@ -291,7 +782,7 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
}
|
|
|
|
boot_image = (void *) ((grub_addr_t) address);
|
|
- if (grub_file_read (file, boot_image, size) != size)
|
|
+ if (grub_file_read (file, boot_image, fsize) != fsize)
|
|
{
|
|
if (grub_errno == GRUB_ERR_NONE)
|
|
grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
@@ -301,7 +792,7 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
}
|
|
|
|
#if defined (__i386__) || defined (__x86_64__)
|
|
- if (size >= (grub_ssize_t) sizeof (struct grub_macho_fat_header))
|
|
+ if (fsize >= (grub_ssize_t) sizeof (struct grub_macho_fat_header))
|
|
{
|
|
struct grub_macho_fat_header *head = boot_image;
|
|
if (head->magic
|
|
@@ -324,20 +815,30 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
> ~grub_cpu_to_le32 (archs[i].size)
|
|
|| grub_cpu_to_le32 (archs[i].offset)
|
|
+ grub_cpu_to_le32 (archs[i].size)
|
|
- > (grub_size_t) size)
|
|
+ > (grub_size_t) fsize)
|
|
{
|
|
grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
filename);
|
|
goto fail;
|
|
}
|
|
boot_image = (char *) boot_image + grub_cpu_to_le32 (archs[i].offset);
|
|
- size = grub_cpu_to_le32 (archs[i].size);
|
|
+ fsize = grub_cpu_to_le32 (archs[i].size);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
+#ifdef SUPPORT_SECURE_BOOT
|
|
+ /* FIXME is secure boot possible also with universal binaries? */
|
|
+ if (debug_secureboot || (grub_secure_mode() && grub_secure_validate ((void *)address, fsize)))
|
|
+ {
|
|
+ grub_file_close (file);
|
|
+ grub_loader_set (grub_secureboot_chainloader_boot, grub_secureboot_chainloader_unload, 0);
|
|
+ return 0;
|
|
+ }
|
|
+#endif
|
|
+
|
|
status = efi_call_6 (b->load_image, 0, grub_efi_image_handle, file_path,
|
|
- boot_image, size,
|
|
+ boot_image, fsize,
|
|
&image_handle);
|
|
if (status != GRUB_EFI_SUCCESS)
|
|
{
|
|
@@ -360,33 +861,10 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
}
|
|
loaded_image->device_handle = dev_handle;
|
|
|
|
- if (argc > 1)
|
|
+ if (cmdline)
|
|
{
|
|
- int i, len;
|
|
- grub_efi_char16_t *p16;
|
|
-
|
|
- for (i = 1, len = 0; i < argc; i++)
|
|
- len += grub_strlen (argv[i]) + 1;
|
|
-
|
|
- len *= sizeof (grub_efi_char16_t);
|
|
- cmdline = p16 = grub_malloc (len);
|
|
- if (! cmdline)
|
|
- goto fail;
|
|
-
|
|
- for (i = 1; i < argc; i++)
|
|
- {
|
|
- char *p8;
|
|
-
|
|
- p8 = argv[i];
|
|
- while (*p8)
|
|
- *(p16++) = *(p8++);
|
|
-
|
|
- *(p16++) = ' ';
|
|
- }
|
|
- *(--p16) = 0;
|
|
-
|
|
loaded_image->load_options = cmdline;
|
|
- loaded_image->load_options_size = len;
|
|
+ loaded_image->load_options_size = cmdline_len;
|
|
}
|
|
|
|
grub_file_close (file);
|
|
@@ -408,6 +886,9 @@ grub_cmd_chainloader (grub_command_t cmd
|
|
if (address)
|
|
efi_call_2 (b->free_pages, address, pages);
|
|
|
|
+ if (cmdline)
|
|
+ grub_free (cmdline);
|
|
+
|
|
grub_dl_unref (my_mod);
|
|
|
|
return grub_errno;
|