we add a new ELF note for SBAT which store the SBAT data. The name field of shall be the string "Secure-Boot-Advanced-Targeting", zero-padded to 4 byte alignment. The type field shall be 0x41536967 (the ASCII values for the string "sbat").
Signed-off-by: Sudhakar Kuppusamy <sudha...@linux.ibm.com> Co-authored-by: Daniel Axtens <d...@axtens.net> --- include/grub/util/mkimage.h | 4 +-- util/grub-mkimagexx.c | 61 ++++++++++++++++++++++++++++++++++--- 2 files changed, 58 insertions(+), 7 deletions(-) diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h index 6f1da89b9..881e3031f 100644 --- a/include/grub/util/mkimage.h +++ b/include/grub/util/mkimage.h @@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, const struct grub_install_image_target_desc *image_target); void grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, - int note, size_t appsig_size, char **core_img, size_t *core_size, + int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, Elf32_Addr target_addr, struct grub_mkimage_layout *layout); void grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, - int note, size_t appsig_size, char **core_img, size_t *core_size, + int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, Elf64_Addr target_addr, struct grub_mkimage_layout *layout); diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c index 9488f0525..2ab90ff8f 100644 --- a/util/grub-mkimagexx.c +++ b/util/grub-mkimagexx.c @@ -85,6 +85,14 @@ struct grub_ieee1275_note struct grub_ieee1275_note_desc descriptor; }; +#define GRUB_SBAT_NOTE_NAME "Secure-Boot-Advanced-Targeting" +#define GRUB_SBAT_NOTE_TYPE 0x73626174 /* "sbat" */ + +struct grub_sbat_note { + Elf32_Nhdr header; + char name[ALIGN_UP(sizeof(GRUB_SBAT_NOTE_NAME), 4)]; +}; + #define GRUB_APPENDED_SIGNATURE_NOTE_NAME "Appended-Signature" #define GRUB_APPENDED_SIGNATURE_NOTE_TYPE 0x41536967 /* "ASig" */ @@ -217,7 +225,7 @@ grub_arm_reloc_jump24 (grub_uint32_t *target, Elf32_Addr sym_addr) void SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc *image_target, - int note, size_t appsig_size, char **core_img, size_t *core_size, + int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, Elf_Addr target_addr, struct grub_mkimage_layout *layout) { @@ -226,11 +234,18 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc Elf_Ehdr *ehdr; Elf_Phdr *phdr; Elf_Shdr *shdr; - int header_size, footer_size = 0; + int header_size, footer_size = 0, footer_offset = 0; + char *footer; int phnum = 1; int shnum = 4; int string_size = sizeof (".text") + sizeof ("mods") + 1; + if (sbat) + { + phnum++; + footer_size += ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); + } + if (appsig_size) { phnum++; @@ -263,6 +278,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc ehdr = (void *) elf_img; phdr = (void *) (elf_img + sizeof (*ehdr)); shdr = (void *) (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr)); + footer = elf_img + program_size + header_size; memcpy (ehdr->e_ident, ELFMAG, SELFMAG); ehdr->e_ident[EI_CLASS] = ELFCLASSXX; if (!image_target->bigendian) @@ -435,6 +451,9 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (XEN_NOTE_SIZE); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); + + footer = ptr; + footer_offset = XEN_NOTE_SIZE; } if (image_target->id == IMAGE_XEN_PVH) @@ -468,6 +487,9 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (XEN_PVH_NOTE_SIZE); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); + + footer = ptr; + footer_offset = XEN_PVH_NOTE_SIZE; } if (note) @@ -498,12 +520,39 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (note_size); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); + + footer = (elf_img + program_size + header_size + note_size); + footer_offset += note_size; } + if (sbat) { + int note_size = ALIGN_UP(sizeof (struct grub_sbat_note) + layout->sbat_size, 4); + struct grub_sbat_note *note_ptr = (struct grub_sbat_note *)footer; + + note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_SBAT_NOTE_NAME)); + note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(layout->sbat_size, 4)); + note_ptr->header.n_type = grub_host_to_target32 (GRUB_SBAT_NOTE_TYPE); + memcpy (note_ptr->name, GRUB_SBAT_NOTE_NAME, sizeof (GRUB_SBAT_NOTE_NAME)); + memcpy ((char *)(note_ptr + 1), sbat, layout->sbat_size); + + phdr++; + phdr->p_type = grub_host_to_target32 (PT_NOTE); + phdr->p_flags = grub_host_to_target32 (PF_R); + phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); + phdr->p_vaddr = 0; + phdr->p_paddr = 0; + phdr->p_filesz = grub_host_to_target32 (note_size); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); + + footer += note_size; + footer_offset += note_size; + } + + if (appsig_size) { int note_size = ALIGN_UP(sizeof (struct grub_appended_signature_note) + appsig_size, 4); - struct grub_appended_signature_note *note_ptr = (struct grub_appended_signature_note *) - (elf_img + program_size + header_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); + struct grub_appended_signature_note *note_ptr = (struct grub_appended_signature_note *)footer; note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_APPENDED_SIGNATURE_NOTE_NAME)); /* needs to sit at the end, so we round this up and sign some zero padding */ @@ -519,7 +568,9 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_paddr = 0; phdr->p_filesz = grub_host_to_target32 (note_size); phdr->p_memsz = 0; - phdr->p_offset = grub_host_to_target32 (header_size + program_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); + phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); + + /* do not update footer, this must be last */ } { -- 2.39.3 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel