From: Ross Lagerwall <ross.lagerwall@citrix.com> To: grub-devel@gnu.org Cc: xen-devel@lists.xenproject.org, "Ross Lagerwall" <ross.lagerwall@citrix.com>, "Daniel Kiper" <daniel.kiper@oracle.com>, "Daniel Kiper" <dkiper@net-space.pl>, "Andrew Cooper" <andrew.cooper3@citrix.com>, "Roger Pau Monné" <roger.pau@citrix.com>, "Jan Beulich" <jbeulich@suse.com> Subject: [PATCH v2 0/3] GRUB: Supporting Secure Boot of xen Date: Thu, 28 Mar 2024 15:12:59 +0000 [thread overview] Message-ID: <20240328151302.1451158-1-ross.lagerwall@citrix.com> (raw) This patch series implements support for loading and verifying a signed xen binary. This would allow the same xen binary to be used for BIOS boot, UEFI boot, and UEFI boot with Secure Boot verification. There is an accompanying Xen patch series. The first patch updates the multiboot2 specification to allow PE binaries. Patch 2 implements the spec change. Patch 3 allows loading multiboot modules without verification since the multiboot kernel is expected to verify them if needed. Ross Changed in v2: * Use magic numbers to determine whether to load as ELF or PE rather than introducing a load type tag. * Drop the 64 bit entry address extensions to the protocol - this is no longer necessary after some Xen build changes. * Dropped the patch to allow verification after compression since it is not critical to make this work. Diff stat for patch 1 (to be applied to the "multiboot2" branch): Ross Lagerwall (1): multiboot2: Add support for the PE binary type doc/multiboot.texi | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) Diff stat for patch 2 and 3 (to be applied to the "master" branch): Ross Lagerwall (2): multiboot2: Add PE load support efi: Allow loading multiboot modules without verification grub-core/Makefile.core.def | 1 + grub-core/kern/efi/sb.c | 1 + grub-core/loader/multiboot.c | 7 + grub-core/loader/multiboot_mbi2.c | 11 +- grub-core/loader/multiboot_pe.c | 702 ++++++++++++++++++++++++++++++ include/grub/efi/pe32.h | 64 +++ include/grub/multiboot.h | 3 + include/grub/multiboot2.h | 9 + 8 files changed, 797 insertions(+), 1 deletion(-) create mode 100644 grub-core/loader/multiboot_pe.c -- 2.43.0
WARNING: multiple messages have this Message-ID (diff)
From: Ross Lagerwall via Grub-devel <grub-devel@gnu.org> To: grub-devel@gnu.org Cc: "Ross Lagerwall" <ross.lagerwall@citrix.com>, xen-devel@lists.xenproject.org, "Daniel Kiper" <daniel.kiper@oracle.com>, "Daniel Kiper" <dkiper@net-space.pl>, "Andrew Cooper" <andrew.cooper3@citrix.com>, "Roger Pau Monné" <roger.pau@citrix.com>, "Jan Beulich" <jbeulich@suse.com> Subject: [PATCH v2 0/3] GRUB: Supporting Secure Boot of xen Date: Thu, 28 Mar 2024 15:12:59 +0000 [thread overview] Message-ID: <20240328151302.1451158-1-ross.lagerwall@citrix.com> (raw) This patch series implements support for loading and verifying a signed xen binary. This would allow the same xen binary to be used for BIOS boot, UEFI boot, and UEFI boot with Secure Boot verification. There is an accompanying Xen patch series. The first patch updates the multiboot2 specification to allow PE binaries. Patch 2 implements the spec change. Patch 3 allows loading multiboot modules without verification since the multiboot kernel is expected to verify them if needed. Ross Changed in v2: * Use magic numbers to determine whether to load as ELF or PE rather than introducing a load type tag. * Drop the 64 bit entry address extensions to the protocol - this is no longer necessary after some Xen build changes. * Dropped the patch to allow verification after compression since it is not critical to make this work. Diff stat for patch 1 (to be applied to the "multiboot2" branch): Ross Lagerwall (1): multiboot2: Add support for the PE binary type doc/multiboot.texi | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) Diff stat for patch 2 and 3 (to be applied to the "master" branch): Ross Lagerwall (2): multiboot2: Add PE load support efi: Allow loading multiboot modules without verification grub-core/Makefile.core.def | 1 + grub-core/kern/efi/sb.c | 1 + grub-core/loader/multiboot.c | 7 + grub-core/loader/multiboot_mbi2.c | 11 +- grub-core/loader/multiboot_pe.c | 702 ++++++++++++++++++++++++++++++ include/grub/efi/pe32.h | 64 +++ include/grub/multiboot.h | 3 + include/grub/multiboot2.h | 9 + 8 files changed, 797 insertions(+), 1 deletion(-) create mode 100644 grub-core/loader/multiboot_pe.c -- 2.43.0 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel
next reply other threads:[~2024-03-28 15:11 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-03-28 15:12 Ross Lagerwall [this message] 2024-03-28 15:12 ` [PATCH v2 0/3] GRUB: Supporting Secure Boot of xen Ross Lagerwall via Grub-devel 2024-03-28 15:13 ` [PATCH v2 1/3] multiboot2: Add support for the PE binary type Ross Lagerwall 2024-03-28 15:13 ` Ross Lagerwall via Grub-devel 2024-03-28 15:13 ` [PATCH v2 2/3] multiboot2: Add PE load support Ross Lagerwall 2024-03-28 15:13 ` Ross Lagerwall via Grub-devel 2024-03-28 15:13 ` [PATCH v2 3/3] efi: Allow loading multiboot modules without verification Ross Lagerwall 2024-03-28 15:13 ` Ross Lagerwall via Grub-devel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240328151302.1451158-1-ross.lagerwall@citrix.com \ --to=ross.lagerwall@citrix.com \ --cc=andrew.cooper3@citrix.com \ --cc=daniel.kiper@oracle.com \ --cc=dkiper@net-space.pl \ --cc=grub-devel@gnu.org \ --cc=jbeulich@suse.com \ --cc=roger.pau@citrix.com \ --cc=xen-devel@lists.xenproject.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.