Enhancing the infrastructure to enable the Platform Keystore (PKS) feature,
which provides access to the SB_VERSION, db, and dbx secure boot variables
from PKS.
If PKS is enabled, it will read secure boot variables such as db and dbx
from PKS and extract EFI Signature List (ESL) from it. The ESLs would be
saved in the Platform Keystore buffer, and the appendedsig module would
read it later to extract the certificate's details from ESL.
In the following scenarios, static key management mode will be activated:
1. When Secure Boot is enabled with static key management mode
2. When SB_VERSION is unavailable but Secure Boot is enabled
3. When PKS support is unavailable but Secure Boot is enabled
Note:
SB_VERSION: Key Management Mode
1 - Enable dynamic key management mode. Read the db and dbx variables from PKS,
and use them for signature verification.
0 - Enable static key management mode. Read keys from the GRUB ELF Note and
use it for signature verification.
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
libgcc for boot environment isn't always present and compatible.
libgcc is often absent if endianness or bit-size at boot is different
from running OS.
libgcc may use optimised opcodes that aren't available on boot time.
So instead of relying on libgcc shipped with the compiler, supply
the functions in GRUB directly.
Tests are present to ensure that those replacement functions behave the
way compiler expects them to.
* grub-core/kern/dl.c (grub_dl_load_segments) [__powerpc__]: Follow
__ia64__ path.
(grub_dl_load_segments): Set mod->sz.
(grub_dl_flush_cache): Flush whole space occupied by module, not just
segments.
* grub-core/kern/ia64/dl.c (nopm): Make const while on it.
(jump): Likewise.
* grub-core/kern/powerpc/dl.c (grub_arch_dl_get_tramp_got_size): New
function.
(trampoline): New struct.
(trampoline_template): New const.
(grub_arch_dl_relocate_symbols): Create trampolines on overflow.
* include/grub/dl.h (grub_dl): Add sz element.
[__powerpc__]: Follow __ia64__.
(GRUB_ARCH_DL_TRAMP_ALIGN): Define on ppc.
(GRUB_ARCH_DL_GOT_ALIGN): Likewise.
(GRUB_ARCH_DL_TRAMP_SIZE): Likewise.
(grub_arch_dl_get_tramp_got_size) [__powerpc__]: New proto.
* grub-core/boot/i386/pc/lnxboot.S: Use
GRUB_KERNEL_I386_PC_MULTIBOOT_SIGNATURE.
* grub-core/kern/i386/pc/startup.S: Move grub_prefix to compressed part.
* include/grub/offsets.h: Rename GRUB_MACHINE_DATA_END to
GRUB_MACHINE_PREFIX_END. All users updated.
(GRUB_KERNEL_I386_PC_PREFIX): Set to GRUB_KERNEL_I386_PC_RAW_SIZE.
(GRUB_KERNEL_I386_PC_PREFIX_END): Set to GRUB_KERNEL_I386_PC_PREFIX
+ 0x40.
(GRUB_KERNEL_I386_PC_RAW_SIZE): Decrease.
* util/grub-mkimage.c (image_target_desc): Change data_end to
prefix_end. All users updated.
