On Tue, Jun 10, 2025 at 09:20:52PM +0530, Sudhakar wrote:
> From: Sudhakar Kuppusamy <sudha...@linux.ibm.com>
>
> If secure boot is enabled with PKS, it will read secure boot variables
> such as db and dbx from PKS and extract ESL's from it.
> The ESL's would be saved in the platform keystore buffer, and
> the appendedsig (module) would read it later to extract
> the certificate's details from ESL.
>
> In the following scenarios, static key mode will be activated:
> 1. When Secure Boot is enabled with static keys
> 2. When SB Version is unavailable but Secure Boot is enabled
> 3. When PKS support is unavailable but Secure Boot is enabled
>
> Note:-
>
> SB Version - Secure Boot mode
> 1 - PKS
> 0 - static key (embeded key)
>
> Signed-off-by: Sudhakar Kuppusamy <sudha...@linux.ibm.com>
> Reviewed-by: Stefan Berger <stef...@linux.ibm.com>
> Reviewed-by: Avnish Chouhan <avn...@linux.ibm.com>
> ---
> grub-core/Makefile.am | 1 +
> grub-core/Makefile.core.def | 1 +
> grub-core/kern/ieee1275/init.c | 16 +-
> .../kern/powerpc/ieee1275/platform_keystore.c | 332 ++++++++++++++++++
> .../grub/powerpc/ieee1275/platform_keystore.h | 233 ++++++++++++
> include/grub/types.h | 9 +
> 6 files changed, 590 insertions(+), 2 deletions(-)
> create mode 100644 grub-core/kern/powerpc/ieee1275/platform_keystore.c
> create mode 100644 include/grub/powerpc/ieee1275/platform_keystore.h
>
> diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
> index b516e139b..cd6bb7c32 100644
> --- a/grub-core/Makefile.am
> +++ b/grub-core/Makefile.am
> @@ -247,6 +247,7 @@ KERNEL_HEADER_FILES +=
> $(top_srcdir)/include/grub/ieee1275/alloc.h
> KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/terminfo.h
> KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/extcmd.h
> KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lib/arg.h
> +KERNEL_HEADER_FILES +=
> $(top_srcdir)/include/grub/powerpc/ieee1275/platform_keystore.h
> endif
>
> if COND_sparc64_ieee1275
> diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
> index 52d2fe491..c58a24219 100644
> --- a/grub-core/Makefile.core.def
> +++ b/grub-core/Makefile.core.def
> @@ -333,6 +333,7 @@ kernel = {
> powerpc_ieee1275 = kern/powerpc/dl.c;
> powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
> powerpc_ieee1275 = kern/lockdown.c;
> + powerpc_ieee1275 = kern/powerpc/ieee1275/platform_keystore.c;
>
> sparc64_ieee1275 = kern/sparc64/cache.S;
> sparc64_ieee1275 = kern/sparc64/dl.c;
> diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
> index 706a8d236..1ad4d9d2f 100644
> --- a/grub-core/kern/ieee1275/init.c
> +++ b/grub-core/kern/ieee1275/init.c
> @@ -50,6 +50,8 @@
> #include <grub/ieee1275/alloc.h>
> #endif
> #include <grub/lockdown.h>
> +#include <grub/powerpc/ieee1275/ieee1275.h>
> +#include <grub/powerpc/ieee1275/platform_keystore.h>
>
> /* The maximum heap size we're going to claim at boot. Not used by sparc. */
> #ifdef __i386__
> @@ -1001,7 +1003,8 @@ grub_get_ieee1275_secure_boot (void)
> {
> grub_ieee1275_phandle_t root;
> int rc;
> - grub_uint32_t is_sb;
> + grub_err_t err;
> + grub_uint32_t is_sb = 0;
Please define and use constants for this.
> rc = grub_ieee1275_finddevice ("/", &root);
> if (rc != 0)
> @@ -1026,7 +1029,16 @@ grub_get_ieee1275_secure_boot (void)
> * We only support enforce.
> */
> if (is_sb >= 2)
> - grub_lockdown ();
> + {
> + grub_dprintf ("ieee1275", "Secure Boot Enabled\n");
> + err = grub_pks_keystore_init ();
> + if (err != GRUB_ERR_NONE)
> + grub_error (err, "Initialization of the Platform Keystore
> failed!\n");
> +
> + grub_lockdown ();
> + }
> + else
> + grub_dprintf ("ieee1275", "Secure Boot Disabled\n");
> }
>
> grub_addr_t grub_modbase;
> diff --git a/grub-core/kern/powerpc/ieee1275/platform_keystore.c
> b/grub-core/kern/powerpc/ieee1275/platform_keystore.c
> new file mode 100644
> index 000000000..44ec6e8b7
> --- /dev/null
> +++ b/grub-core/kern/powerpc/ieee1275/platform_keystore.c
> @@ -0,0 +1,332 @@
> +/*
> + * GRUB -- GRand Unified Bootloader
> + * Copyright (C) 2024 Free Software Foundation, Inc.
> + * Copyright (C) 2022, 2023, 2024, 2025 IBM Corporation
> + *
> + * GRUB is free software: you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation, either version 3 of the License, or
> + * (at your option) any later version.
> + *
> + * GRUB is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> + * GNU General Public License for more details.
> + *
> + * You should have received a copy of the GNU General Public License
> + * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
> + */
> +
> +#include <grub/mm.h>
> +#include <grub/powerpc/ieee1275/ieee1275.h>
> +#include <grub/types.h>
> +#include <grub/misc.h>
> +#include <grub/lockdown.h>
> +#include <grub/powerpc/ieee1275/platform_keystore.h>
> +
> +#define PKS_CONSUMER_FW ((grub_uint8_t) 1)
Why do you glue all different constants into one block? Please separate
them logically with empty lines.
> +#define SB_VERSION_KEY_NAME ((grub_uint8_t *) "SB_VERSION")
> +#define SB_VERSION_KEY_LEN ((grub_size_t) 10)
> +#define DB ((grub_uint8_t) 1)
> +#define DBX ((grub_uint8_t) 2)
> +#define PKS_OBJECT_NOT_FOUND ((grub_err_t) -7)
Why do you need PKS_OBJECT_NOT_FOUND constant? Why cannot you use
grub_err_t enum type directly? If it is really needed please do not use
plain number but an enum constant. And probably a comment explaining why
the PKS_OBJECT_NOT_FOUND is needed would be nice...
... and align all values in a column with tab(s).
[...]
> +/* Test the availability of PKS support. */
> +static grub_err_t
> +is_support_pks (void)
> +{
> + grub_err_t rc = GRUB_ERR_NONE;
You do not need this assignment.
> + grub_ieee1275_cell_t missing = 0;
> +
> + rc = grub_ieee1275_test ("pks-max-object-size", &missing);
This function returns an int and you cast it to grub_err_t. I do not
mention that returned values do not map to grub_err_t constants at all.
Please fix this. I think grub_ieee1275_test() should return a grub_err_t.
> + if (rc != GRUB_ERR_NONE || (int) missing == -1)
s/-1/GRUB_IEEE1275_CELL_INVALID/?
> + rc = grub_error (GRUB_ERR_BAD_FIRMWARE, "firmware doesn't have PKS
> support\n");
> + else
> + {
> + rc = grub_ieee1275_pks_max_object_size (&pks_max_object_size);
Same problems with types mismatch as above. Please fix this problem everywhere.
> + if (rc != GRUB_ERR_NONE)
> + rc = grub_error (GRUB_ERR_BAD_NUMBER, "PKS support is there but it
> has zero objects\n");
> + }
> +
> + return rc;
> +}
> +
> +/*
> + * Retrieve the secure boot variable from PKS, unpacks it, read the esd
> + * from ESL, and store the information in the pks sd buffer.
> + */
> +static grub_err_t
> +read_secure_boot_variables (const grub_uint8_t sbvarflags, const
> grub_uint8_t sbvartype,
> + grub_pks_sd_t **pks_sd, grub_size_t
> *pks_sd_entries)
> +{
> + grub_err_t rc = GRUB_ERR_NONE;
> + grub_uint8_t *esl_data = NULL;
> + grub_size_t esl_data_size = 0;
> +
> + rc = read_sbvar_from_pks (sbvarflags, sbvartype, &esl_data,
> &esl_data_size);
> + /*
> + * at this point we have SB_VERSION, so any error is worth
> + * at least some user-visible info
May I ask you to use proper English in all comments, i.e. start with
upper case, variable/function names are exceptions, and end with
full stop? Additionally, please differentiate functions by adding "()"
at the end of their names. These issues have to be fixed in many places
not only in this patch.
> + */
> + if (rc != GRUB_ERR_NONE)
> + rc = grub_error (rc, "secure boot variable %s reading (%d)",
> + (sbvartype == DB ? "db" : "dbx"), (int) rc);
> + else if (esl_data_size != 0)
> + rc = pks_sd_from_esl ((const grub_uint8_t *) esl_data, esl_data_size,
> + pks_sd, pks_sd_entries);
> + grub_free (esl_data);
> +
> + return rc;
> +}
> +
> +/* reads secure boot version (SB_VERSION) and it supports following
Wrong coding style for comments...
> + * SB_VERSION
> + * 1 - PKS
> + * 0 - static key (embeded key)
> + */
> +static grub_err_t
> +get_secure_boot_version (void)
> +{
> + grub_err_t rc = GRUB_ERR_NONE;
> + grub_uint8_t *data = NULL;
> + grub_size_t len = 0, policy = 0;
> +
> + rc = read_sbversion_from_pks (&data, &len, &policy);
> + if (rc != GRUB_ERR_NONE)
> + rc = grub_error (GRUB_ERR_READ_ERROR, "SB version read failed (%d)\n",
> (int) rc);
> + else if (len != 1 || (*data >= 2))
> + rc = grub_error (GRUB_ERR_BAD_NUMBER, "found unexpected SB version
> (%d)\n", *data);
> +
> + if (rc != GRUB_ERR_NONE)
> + {
> + grub_printf ("switch to static key!\n");
> + if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED)
> + grub_fatal ("secure boot locked down");
> + }
> + else
> + grub_pks_use_keystore = *data;
> +
> + grub_free (data);
> +
> + return rc;
> +}
> +
> +/* Free allocated memory */
> +void
> +grub_pks_free_keystore (void)
> +{
> + grub_size_t i = 0;
> +
> + for (i = 0; i < grub_pks_keystore.db_entries; i++)
> + grub_free (grub_pks_keystore.db[i].data);
> +
> + for (i = 0; i < grub_pks_keystore.dbx_entries; i++)
> + grub_free (grub_pks_keystore.dbx[i].data);
> +
> + grub_free (grub_pks_keystore.db);
> + grub_free (grub_pks_keystore.dbx);
> + grub_memset (&grub_pks_keystore, 0, sizeof (grub_pks_t));
> +}
> +
> +/* Initialization of the Platform Keystore */
> +grub_err_t
> +grub_pks_keystore_init (void)
> +{
> + grub_err_t rc = GRUB_ERR_NONE;
> +
> + grub_dprintf ("ieee1275", "trying to load Platform Keystore\n");
> +
> + rc = is_support_pks ();
> + if (rc != GRUB_ERR_NONE)
> + {
> + grub_printf ("switch to static key\n");
> + return rc;
> + }
> +
> + /* SB_VERSION */
> + rc = get_secure_boot_version ();
> + if (rc != GRUB_ERR_NONE)
> + return rc;
> +
> + if (grub_pks_use_keystore)
> + {
> + grub_memset (&grub_pks_keystore, 0, sizeof (grub_pks_t));
> + /* DB */
> + rc = read_secure_boot_variables (0, DB, &grub_pks_keystore.db,
> &grub_pks_keystore.db_entries);
> + if (rc == GRUB_ERR_NONE)
> + {
> + /* DBX */
> + rc = read_secure_boot_variables (0, DBX, &grub_pks_keystore.dbx,
> &grub_pks_keystore.dbx_entries);
> + if (rc == PKS_OBJECT_NOT_FOUND)
> + {
> + grub_dprintf ("ieee1275", "dbx is not found in PKS\n");
> + rc = GRUB_ERR_NONE;
> + }
> + }
> +
> + }
> +
> + if (rc != GRUB_ERR_NONE)
> + grub_pks_free_keystore ();
> +
> + return rc;
> +}
> diff --git a/include/grub/powerpc/ieee1275/platform_keystore.h
> b/include/grub/powerpc/ieee1275/platform_keystore.h
> new file mode 100644
> index 000000000..ed6cc6bd0
> --- /dev/null
> +++ b/include/grub/powerpc/ieee1275/platform_keystore.h
> @@ -0,0 +1,233 @@
> +/*
> + * Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved. This
> + * program and the accompanying materials are licensed and made available
> + * under the terms and conditions of the 2-Clause BSD License which
> + * accompanies this distribution.
> + *
> + * Redistribution and use in source and binary forms, with or without
> + * modification, are permitted provided that the following conditions are
> met:
> + *
> + * 1. Redistributions of source code must retain the above copyright notice,
> + * this list of conditions and the following disclaimer.
> + *
> + * 2. Redistributions in binary form must reproduce the above copyright
> + * notice, this list of conditions and the following disclaimer in the
> + * documentation and/or other materials provided with the distribution.
> + *
> + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
> IS"
> + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
> + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
> + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
> + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
> + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
> + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
> + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
> + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
> + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
> + * POSSIBILITY OF SUCH DAMAGE.
> + *
> + *
Please drop this extra empty line...
> + * https://github.com/tianocore/edk2-staging (edk2-staging repo of
> tianocore),
> + * the ImageAuthentication.h file under it, and here's the copyright and
> license.
> + *
> + * MdePkg/Include/Guid/ImageAuthentication.h
> + *
> + * Copyright 2022, 2023, 2024, 2025 IBM Corp.
> + */
> +
> +#ifndef __PLATFORM_KEYSTORE_H__
> +#define __PLATFORM_KEYSTORE_H__
> +
> +#include <grub/symbol.h>
> +#include <grub/mm.h>
> +#include <grub/types.h>
> +
> +#if __GNUC__ >= 9
> +#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
> +#endif
> +
> +#define GRUB_MAX_HASH_SIZE 64
> +
> +typedef struct grub_esd grub_esd_t;
> +typedef struct grub_esl grub_esl_t;
These two lines should go behind immediately after relevant struct
definitions... Good examples are all over the GRUB code...
> +/*
> + * It is derived from EFI_SIGNATURE_DATA
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + *
> + * The structure of an EFI signature database (ESD).*/
> +struct grub_esd
> +{
> + /*
> + * An identifier which identifies the agent which added
> + * the signature to the list.
> + */
> + grub_uuid_t signatureowner;
s/signatureowner/signature_owner/
> + /* The format of the signature is defined by the SignatureType.*/
> + grub_uint8_t signaturedata[];
s/signaturedata/signature_data/
> +} GRUB_PACKED;
> +
> +/*
> + * It is derived from EFI_SIGNATURE_LIST
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + *
> + * The structure of an EFI signature list (ESL).*/
> +struct grub_esl
> +{
> + /* Type of the signature. GUID signature types are defined in below.*/
> + grub_uuid_t signaturetype;
s/signaturetype/signature_type/
> + /* Total size of the signature list, including this header.*/
> + grub_uint32_t signaturelistsize;
s/signaturelistsize/signature_list_size/
> + /*
> + * Size of the signature header which precedes
> + * the array of signatures.
> + */
> + grub_uint32_t signatureheadersize;
s/signatureheadersize/signature_header_size/
> + /* Size of each signature.*/
> + grub_uint32_t signaturesize;
s/signaturesize/signature_size/
> +} GRUB_PACKED;
> +
> +/*
> + * It is derived from EFI_CERT_X509_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_X509_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0xa1, 0x59, 0xc0, 0xa5, 0xe4, 0x94, \
> + 0xa7, 0x4a, 0x87, 0xb5, 0xab, 0x15, \
> + 0x5c, 0x2b, 0xf0, 0x72 \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_SHA256_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_SHA256_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0x26, 0x16, 0xc4, 0xc1, 0x4c, 0x50, \
> + 0x92, 0x40, 0xac, 0xa9, 0x41, 0xf9, \
> + 0x36, 0x93, 0x43, 0x28 \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_SHA384_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_SHA384_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0x07, 0x53, 0x3e, 0xff, 0xd0, 0x9f, \
> + 0xc9, 0x48, 0x85, 0xf1, 0x8a, 0xd5, \
> + 0x6c, 0x70, 0x1e, 0x1 \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_SHA512_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_SHA512_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0xae, 0x0f, 0x3e, 0x09, 0xc4, 0xa6, \
> + 0x50, 0x4f, 0x9f, 0x1b, 0xd4, 0x1e, \
> + 0x2b, 0x89, 0xc1, 0x9a \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_X509_SHA256_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_X509_SHA256_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0x92, 0xa4, 0xd2, 0x3b, 0xc0, 0x96, \
> + 0x79, 0x40, 0xb4, 0x20, 0xfc, 0xf9, \
> + 0x8e, 0xf1, 0x03, 0xed \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_X509_SHA384_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_X509_SHA384_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0x6e, 0x87, 0x76, 0x70, 0xc2, 0x80, \
> + 0xe6, 0x4e, 0xaa, 0xd2, 0x28, 0xb3, \
> + 0x49, 0xa6, 0x86, 0x5b \
> + } \
> + }
> +
> +/*
> + * It is derived from EFI_CERT_X509_SHA512_GUID
> + *
> https://github.com/tianocore/edk2-staging/blob/master/MdePkg/Include/Guid/ImageAuthentication.h
> + */
> +#define GRUB_PKS_CERT_X509_SHA512_GUID \
> + (grub_uuid_t) \
> + { \
> + { \
> + 0x63, 0xbf, 0x6d, 0x44, 0x02, 0x25, \
> + 0xda, 0x4c, 0xbc, 0xfa, 0x24, 0x65, \
> + 0xd2, 0xb0, 0xfe, 0x9d \
> + } \
> + }
All GRUB_PKS_* constants should go to the new include/grub/efi/pks.h file...
The include/grub/efi/api.h shows how they should be defined...
> +typedef struct grub_pks_sd grub_pks_sd_t;
> +typedef struct grub_pks grub_pks_t;
Same comment for these typedefs as above...
> +/* The structure of a PKS signature data.*/
> +struct grub_pks_sd
> +{
> + grub_uuid_t guid; /* signature type */
> + grub_uint8_t *data; /* signature data */
> + grub_size_t data_size; /* size of signature data */
> +} GRUB_PACKED;
> +
> +/* The structure of a PKS.*/
> +struct grub_pks
> +{
> + grub_pks_sd_t *db; /* signature database */
> + grub_pks_sd_t *dbx; /* forbidden signature database */
> + grub_size_t db_entries; /* size of signature database */
> + grub_size_t dbx_entries; /* size of forbidden signature database */
> +} GRUB_PACKED;
> +
> +#ifdef __powerpc__
> +
> +/* Initialization of the Platform Keystore */
> +extern grub_err_t
> +grub_pks_keystore_init (void);
> +/* Free allocated memory */
> +extern void
> +EXPORT_FUNC (grub_pks_free_keystore) (void);
> +
> +extern grub_uint8_t EXPORT_VAR (grub_pks_use_keystore);
> +extern grub_pks_t EXPORT_VAR (grub_pks_keystore);
> +
> +#else
> +
> +/* Free allocated memory */
> +inline void
static inline void
> +grub_pks_free_keystore (void)
> +{
> +}
> +
> +grub_uint8_t grub_pks_use_keystore = 0;
> +grub_pks_t grub_pks_keystore = {NULL, NULL, 0, 0};
These variables cannot be defined in header file.
> +#endif
> +
> +#endif
> diff --git a/include/grub/types.h b/include/grub/types.h
> index 45079bf65..ce914decb 100644
> --- a/include/grub/types.h
> +++ b/include/grub/types.h
> @@ -388,4 +388,13 @@ struct grub_packed_guid
> } GRUB_PACKED;
> typedef struct grub_packed_guid grub_packed_guid_t;
>
> +
> +#define GRUB_UUID_SIZE 16
> +typedef struct grub_uuid grub_uuid_t;
> +/* The structure of a UUID.*/
> +struct grub_uuid
> +{
> + grub_uint8_t b[GRUB_UUID_SIZE];
> +};
Why cannot you use existing grub_guid_t/grub_packed_guid_t types?
Daniel
_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
