[v2,0/3] GRUB: Supporting Secure Boot of xen

Message

Ross Lagerwall March 28, 2024, 3:12 p.m. UTC

This patch series implements support for loading and verifying a signed
xen binary. This would allow the same xen binary to be used for BIOS
boot, UEFI boot, and UEFI boot with Secure Boot verification.
There is an accompanying Xen patch series.

The first patch updates the multiboot2 specification to allow PE
binaries.

Patch 2 implements the spec change.
Patch 3 allows loading multiboot modules without verification since the
multiboot kernel is expected to verify them if needed.

Ross

Changed in v2:

* Use magic numbers to determine whether to load as ELF or PE rather
  than introducing a load type tag.
* Drop the 64 bit entry address extensions to the protocol - this is no
  longer necessary after some Xen build changes.
* Dropped the patch to allow verification after compression since it is
  not critical to make this work.

Diff stat for patch 1 (to be applied to  the "multiboot2" branch):

Ross Lagerwall (1):
  multiboot2: Add support for the PE binary type

 doc/multiboot.texi | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

Diff stat for patch 2 and 3 (to be applied to the "master" branch):

Ross Lagerwall (2):
  multiboot2: Add PE load support
  efi: Allow loading multiboot modules without verification

 grub-core/Makefile.core.def       |   1 +
 grub-core/kern/efi/sb.c           |   1 +
 grub-core/loader/multiboot.c      |   7 +
 grub-core/loader/multiboot_mbi2.c |  11 +-
 grub-core/loader/multiboot_pe.c   | 702 ++++++++++++++++++++++++++++++
 include/grub/efi/pe32.h           |  64 +++
 include/grub/multiboot.h          |   3 +
 include/grub/multiboot2.h         |   9 +
 8 files changed, 797 insertions(+), 1 deletion(-)
 create mode 100644 grub-core/loader/multiboot_pe.c