From: Ross Philipson <ross.philip...@oracle.com>
Signed-off-by: Ross Philipson <ross.philip...@oracle.com>
Signed-off-by: Sergii Dmytruk <sergii.dmyt...@3mdeb.com>
---
grub-core/Makefile.core.def | 1 +
grub-core/loader/efi/linux.c | 16 ++
grub-core/loader/slaunch/x86_efi_linux.c | 212 +++++++++++++++++++++++
include/grub/slaunch.h | 7 +
4 files changed, 236 insertions(+)
create mode 100644 grub-core/loader/slaunch/x86_efi_linux.c
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index 327a8391b..aba480842 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -1885,6 +1885,7 @@ module = {
x86 = loader/slaunch/i386_linux.c;
x86 = loader/slaunch/dlstub.c;
x86 = loader/efi/dltrampoline.S;
+ x86_64_efi = loader/slaunch/x86_efi_linux.c;
enable = x86;
};
diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c
index 78ea07ca8..da13b4f62 100644
--- a/grub-core/loader/efi/linux.c
+++ b/grub-core/loader/efi/linux.c
@@ -25,11 +25,14 @@
#include <grub/loader.h>
#include <grub/mm.h>
#include <grub/types.h>
+#include <grub/slr_table.h>
+#include <grub/slaunch.h>
#include <grub/efi/efi.h>
#include <grub/efi/fdtload.h>
#include <grub/efi/memory.h>
#include <grub/efi/pe32.h>
#include <grub/efi/sb.h>
+#include <grub/x86_64/efi/memory.h>
#include <grub/i18n.h>
#include <grub/lib/cmdline.h>
#include <grub/verify.h>
@@ -55,6 +58,8 @@ static bool initrd_use_loadfile2 = false;
static grub_guid_t load_file2_guid = GRUB_EFI_LOAD_FILE2_PROTOCOL_GUID;
static grub_guid_t device_path_guid = GRUB_EFI_DEVICE_PATH_GUID;
+static struct grub_slaunch_params slparams = {0};
+
static initrd_media_device_path_t initrd_lf2_device_path = {
{
{
@@ -190,6 +195,7 @@ grub_arch_efi_linux_boot_image (grub_addr_t addr,
grub_size_t size, char *args)
grub_efi_boot_services_t *b;
grub_efi_status_t status;
grub_efi_loaded_image_t *loaded_image;
+ grub_err_t err;
int len;
mempath = grub_malloc (2 * sizeof (grub_efi_memory_mapped_device_path_t));
@@ -234,6 +240,16 @@ grub_arch_efi_linux_boot_image (grub_addr_t addr,
grub_size_t size, char *args)
2 * grub_utf8_to_utf16 (loaded_image->load_options, len,
(grub_uint8_t *) args, len, NULL);
+ if (grub_slaunch_platform_type () == SLP_INTEL_TXT)
+ {
+ err = grub_sl_efi_txt_setup (&slparams, kernel_addr, loaded_image);
+ if (err != GRUB_ERR_NONE)
+ {
+ grub_error (err, "Secure Launch setup TXT failed");
+ goto unload;
+ }
+ }
+
grub_dprintf ("linux", "starting image %p\n", image_handle);
status = b->start_image (image_handle, 0, NULL);
diff --git a/grub-core/loader/slaunch/x86_efi_linux.c
b/grub-core/loader/slaunch/x86_efi_linux.c
new file mode 100644
index 000000000..1a237b42c
--- /dev/null
+++ b/grub-core/loader/slaunch/x86_efi_linux.c
@@ -0,0 +1,212 @@
+/*
+ * GRUB -- GRand Unified Bootloader
+ * Copyright (C) 2024, Oracle and/or its affiliates.
+ *
+ * GRUB is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GRUB is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/charset.h>
+#include <grub/command.h>
+#include <grub/err.h>
+#include <grub/linux.h>
+#include <grub/loader.h>
+#include <grub/mm.h>
+#include <grub/types.h>
+#include <grub/slr_table.h>
+#include <grub/slaunch.h>
+#include <grub/efi/efi.h>
+#include <grub/efi/memory.h>
+#include <grub/x86_64/efi/memory.h>
+#include <grub/i386/msr.h>
+#include <grub/i386/mmio.h>
+#include <grub/i386/memory.h>
+#include <grub/i386/linux.h>
+#include <grub/i386/txt.h>
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+#define GRUB_EFI_SLAUNCH_TPM_EVT_LOG_SIZE 0x8000
+#define GRUB_EFI_MLE_AP_WAKE_BLOCK_SIZE 0x14000
+#define OFFSET_OF(x, y) ((grub_size_t)((grub_uint8_t *)(&(y)->x) -
(grub_uint8_t *)(y)))
+
+static struct linux_kernel_params boot_params = {0};
+
+static grub_err_t
+sl_efi_install_slr_table (struct grub_slaunch_params *slparams)
+{
+ grub_guid_t slrt_guid = GRUB_UEFI_SLR_TABLE_GUID;
+ grub_efi_boot_services_t *b;
+ grub_efi_status_t status;
+
+ b = grub_efi_system_table->boot_services;
+ status = b->install_configuration_table (&slrt_guid, (void
*)slparams->slr_table_base);
+ if (status != GRUB_EFI_SUCCESS)
+ return grub_error (GRUB_ERR_BAD_OS, "cannot load image");
+
+ return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+sl_efi_locate_mle_offset (struct grub_slaunch_params *slparams,
+ void *kernel_addr, grub_ssize_t kernel_start)
+{
+ struct linux_kernel_params *lh = (struct linux_kernel_params *)kernel_addr;
+ struct linux_kernel_info kernel_info;
+
+ /* Locate the MLE header offset in kernel_info section */
+ grub_memcpy ((void *)&kernel_info,
+ (char *)kernel_addr + kernel_start + grub_le_to_cpu32
(lh->kernel_info_offset),
+ sizeof (struct linux_kernel_info));
+
+ if (OFFSET_OF (mle_header_offset, &kernel_info) >= grub_le_to_cpu32
(kernel_info.size))
+ return grub_error (GRUB_ERR_BAD_OS, N_("not slaunch kernel: lack of
mle_header_offset"));
+
+ slparams->mle_header_offset = grub_le_to_cpu32
(kernel_info.mle_header_offset);
+
+ return GRUB_ERR_NONE;
+}
+
+static void *
+sl_efi_txt_setup_slmem (struct grub_slaunch_params *slparams,
+ grub_efi_physical_address_t max_addr,
+ grub_uint32_t *slmem_size_out)
+{
+ grub_uint8_t *slmem;
+ grub_uint32_t slmem_size =
+ GRUB_EFI_PAGE_SIZE + GRUB_EFI_SLAUNCH_TPM_EVT_LOG_SIZE +
GRUB_EFI_MLE_AP_WAKE_BLOCK_SIZE;
+
+ slmem = grub_efi_allocate_pages_real (max_addr,
+ GRUB_EFI_BYTES_TO_PAGES(slmem_size),
+ GRUB_EFI_ALLOCATE_MAX_ADDRESS,
+ GRUB_EFI_LOADER_DATA);
+ if (!slmem)
+ return NULL;
+
+ grub_memset (slmem, 0, slmem_size);
+
+ slparams->slr_table_base = (grub_uint64_t)slmem;
+ slparams->slr_table_size = GRUB_EFI_PAGE_SIZE;
+ slparams->slr_table_mem = slmem;
+
+ slparams->tpm_evt_log_base = (grub_uint64_t)(slmem + GRUB_EFI_PAGE_SIZE);
+ slparams->tpm_evt_log_size = GRUB_EFI_SLAUNCH_TPM_EVT_LOG_SIZE;
+
+ slparams->ap_wake_block = (grub_uint32_t)(grub_uint64_t)(slmem +
GRUB_EFI_PAGE_SIZE + GRUB_EFI_SLAUNCH_TPM_EVT_LOG_SIZE);
+ slparams->ap_wake_block_size = GRUB_EFI_MLE_AP_WAKE_BLOCK_SIZE;
+
+ *slmem_size_out = slmem_size;
+ return slmem;
+}
+
+grub_err_t
+grub_sl_efi_txt_setup (struct grub_slaunch_params *slparams, void *kernel_addr,
+ grub_efi_loaded_image_t *loaded_image)
+{
+ struct linux_kernel_params *lh = (struct linux_kernel_params *)kernel_addr;
+ grub_uint64_t image_base = (grub_uint64_t)loaded_image->image_base;
+ grub_efi_uint64_t image_size = loaded_image->image_size;
+ grub_efi_physical_address_t requested;
+ grub_ssize_t start;
+ grub_err_t err;
+ void *addr;
+ void *slmem = NULL;
+ grub_uint32_t slmem_size = 0;
+
+ slparams->boot_type = GRUB_SL_BOOT_TYPE_EFI;
+ slparams->platform_type = grub_slaunch_platform_type ();
+
+ /*
+ * Dummy empty boot params structure for now. EFI stub will create a boot
params
+ * and populate it. The SL code in EFI stub will update the boot params
structure
+ * in the OSMLE data and SLRT.
+ */
+ slparams->boot_params = &boot_params;
+ slparams->boot_params_base = (grub_uint64_t)&boot_params;
+
+ /*
+ * Note that while the boot params on the zero page are not used or updated
during a Linux
+ * UEFI boot through the PE header, the values placed there in the bzImage
during the build
+ * are still valid and can be treated as boot params for certain things.
+ */
+ start = (lh->setup_sects + 1) * 512;
+
+ /* Allocate page tables for TXT just in front of the kernel image */
+ slparams->mle_ptab_size = grub_txt_get_mle_ptab_size (image_size);
+ slparams->mle_ptab_size = ALIGN_UP (slparams->mle_ptab_size,
GRUB_TXT_PMR_ALIGN);
+ requested = ALIGN_DOWN ((image_base - slparams->mle_ptab_size),
+ GRUB_TXT_PMR_ALIGN);
+
+ addr = grub_efi_allocate_pages_real (requested,
+
GRUB_EFI_BYTES_TO_PAGES(slparams->mle_ptab_size),
+ GRUB_EFI_ALLOCATE_ADDRESS,
+ GRUB_EFI_LOADER_DATA);
+ if (!addr)
+ {
+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
+ return GRUB_ERR_OUT_OF_MEMORY;
+ }
+
+ slparams->mle_ptab_mem = addr;
+ slparams->mle_ptab_target = (grub_uint64_t)addr;
+
+ /*
+ * For the MLE, skip the zero page and startup section of the binary. The MLE
+ * begins with the protected mode .text section which follows. The MLE header
+ * and MLE entry point are RVA's from the beginning of .text where startup_32
+ * begins.
+ *
+ * Note, to do the EFI boot, the entire bzImage binary is loaded since the PE
+ * header is in the startup section before the protected mode piece begins.
+ * In legacy world this part of the image would have been stripped off.
+ */
+ slparams->mle_mem = image_base + start;
+ slparams->mle_start = image_base + start;
+ slparams->mle_size = image_size - start;
+
+ /* Setup the TXT ACM page tables */
+ grub_txt_setup_mle_ptab (slparams);
+
+ /* Allocate a block of memory for Secure Launch entities */
+ slmem = sl_efi_txt_setup_slmem (slparams, (grub_efi_physical_address_t)addr,
+ &slmem_size);
+ if (!slmem)
+ {
+ err = GRUB_ERR_OUT_OF_MEMORY;
+ goto fail;
+ }
+
+ err = sl_efi_locate_mle_offset (slparams, kernel_addr, start);
+ if (err != GRUB_ERR_NONE)
+ goto fail;
+
+ /* Final stage for secure launch, setup TXT and install the SLR table */
+ err = grub_txt_boot_prepare (slparams);
+ if (err != GRUB_ERR_NONE)
+ goto fail;
+
+ err = sl_efi_install_slr_table (slparams);
+ if (err != GRUB_ERR_NONE)
+ goto fail;
+
+ return GRUB_ERR_NONE;
+
+fail:
+
+ if (slmem && slmem_size)
+ grub_efi_free_pages ((grub_addr_t)slmem, slmem_size);
+
+ grub_efi_free_pages ((grub_addr_t)addr, slparams->mle_ptab_size);
+
+ return err;
+}
diff --git a/include/grub/slaunch.h b/include/grub/slaunch.h
index 061d8e439..e0b51f12c 100644
--- a/include/grub/slaunch.h
+++ b/include/grub/slaunch.h
@@ -36,11 +36,14 @@
#define GRUB_KERNEL_INFO_HEADER "LToP"
#define GRUB_KERNEL_INFO_MIN_SIZE_TOTAL 12
+/* Forward declarations */
struct linux_kernel_params;
struct linux_i386_kernel_header;
struct grub_relocator;
struct grub_slr_entry_hdr;
struct grub_slr_policy_entry;
+struct grub_efi_loaded_image;
+typedef struct grub_efi_loaded_image grub_efi_loaded_image_t;
struct grub_slaunch_params
{
@@ -106,6 +109,10 @@ grub_err_t grub_sl_txt_setup_linux (struct
grub_slaunch_params *slparams,
struct grub_relocator *relocator,
grub_size_t total_size, grub_size_t
prot_size,
void **prot_mode_mem, grub_addr_t
*prot_mode_target);
+
+/* Linux EFI functions */
+grub_err_t grub_sl_efi_txt_setup (struct grub_slaunch_params *slparams, void
*kernel_addr,
+ grub_efi_loaded_image_t *loaded_image);
#endif /* ASM_FILE */
#endif /* GRUB_I386_SLAUNCH_H */
--
2.47.1
_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
