dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0220-Add-secureboot-support-on-efi-chainloader.patch

28f7f8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
27a4da
From: Peter Jones <pjones@redhat.com>
27a4da
Date: Tue, 6 Oct 2015 13:04:37 -0400
28f7f8
Subject: [PATCH] Add secureboot support on efi chainloader
27a4da
27a4da
Expand the chainloader to be able to verify the image by means of shim
27a4da
lock protocol. The PE/COFF image is loaded and relocated by the
27a4da
chainloader instead of calling LoadImage and StartImage UEFI boot
27a4da
Service as they require positive verification result from keys enrolled
27a4da
in KEK or DB. The shim will use MOK in addition to firmware enrolled
27a4da
keys to verify the image.
27a4da
27a4da
The chainloader module could be used to load other UEFI bootloaders,
27a4da
such as xen.efi, and could be signed by any of MOK, KEK or DB.
27a4da
27a4da
Based on https://build.opensuse.org/package/view_file/openSUSE:Factory/grub2/grub2-secureboot-chainloader.patch
27a4da
27a4da
Signed-off-by: Peter Jones <pjones@redhat.com>
27a4da
---
27a4da
 grub-core/loader/efi/chainloader.c | 612 ++++++++++++++++++++++++++++++++++---
27a4da
 include/grub/efi/pe32.h            |  20 +-
27a4da
 2 files changed, 595 insertions(+), 37 deletions(-)
27a4da
27a4da
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
28f7f8
index 14ce6ddd7ad..87a91e16f17 100644
27a4da
--- a/grub-core/loader/efi/chainloader.c
27a4da
+++ b/grub-core/loader/efi/chainloader.c
27a4da
@@ -32,6 +32,8 @@
27a4da
 #include <grub/efi/api.h>
27a4da
 #include <grub/efi/efi.h>
27a4da
 #include <grub/efi/disk.h>
27a4da
+#include <grub/efi/pe32.h>
27a4da
+#include <grub/efi/linux.h>
27a4da
 #include <grub/command.h>
27a4da
 #include <grub/i18n.h>
27a4da
 #include <grub/net.h>
27a4da
@@ -46,9 +48,14 @@ static grub_dl_t my_mod;
27a4da
 
27a4da
 static grub_efi_physical_address_t address;
27a4da
 static grub_efi_uintn_t pages;
27a4da
+static grub_ssize_t fsize;
27a4da
 static grub_efi_device_path_t *file_path;
27a4da
 static grub_efi_handle_t image_handle;
27a4da
 static grub_efi_char16_t *cmdline;
27a4da
+static grub_ssize_t cmdline_len;
27a4da
+static grub_efi_handle_t dev_handle;
27a4da
+
27a4da
+static grub_efi_status_t (*entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table);
27a4da
 
27a4da
 static grub_err_t
27a4da
 grub_chainloader_unload (void)
27a4da
@@ -63,6 +70,7 @@ grub_chainloader_unload (void)
27a4da
   grub_free (cmdline);
27a4da
   cmdline = 0;
27a4da
   file_path = 0;
27a4da
+  dev_handle = 0;
27a4da
 
27a4da
   grub_dl_unref (my_mod);
27a4da
   return GRUB_ERR_NONE;
27a4da
@@ -191,12 +199,523 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
27a4da
   return file_path;
27a4da
 }
27a4da
 
27a4da
+#define SHIM_LOCK_GUID \
27a4da
+  { 0x605dab50, 0xe046, 0x4300, { 0xab,0xb6,0x3d,0xd8,0x10,0xdd,0x8b,0x23 } }
27a4da
+
27a4da
+typedef union
27a4da
+{
27a4da
+  struct grub_pe32_header_32 pe32;
27a4da
+  struct grub_pe32_header_64 pe32plus;
27a4da
+} grub_pe_header_t;
27a4da
+
27a4da
+struct pe_coff_loader_image_context
27a4da
+{
27a4da
+  grub_efi_uint64_t image_address;
27a4da
+  grub_efi_uint64_t image_size;
27a4da
+  grub_efi_uint64_t entry_point;
27a4da
+  grub_efi_uintn_t size_of_headers;
27a4da
+  grub_efi_uint16_t image_type;
27a4da
+  grub_efi_uint16_t number_of_sections;
27a4da
+  grub_efi_uint32_t section_alignment;
27a4da
+  struct grub_pe32_section_table *first_section;
27a4da
+  struct grub_pe32_data_directory *reloc_dir;
27a4da
+  struct grub_pe32_data_directory *sec_dir;
27a4da
+  grub_efi_uint64_t number_of_rva_and_sizes;
27a4da
+  grub_pe_header_t *pe_hdr;
27a4da
+};
27a4da
+
27a4da
+typedef struct pe_coff_loader_image_context pe_coff_loader_image_context_t;
27a4da
+
27a4da
+struct grub_efi_shim_lock
27a4da
+{
27a4da
+  grub_efi_status_t (*verify)(void *buffer,
27a4da
+                              grub_efi_uint32_t size);
27a4da
+  grub_efi_status_t (*hash)(void *data,
27a4da
+                            grub_efi_int32_t datasize,
27a4da
+                            pe_coff_loader_image_context_t *context,
27a4da
+                            grub_efi_uint8_t *sha256hash,
27a4da
+                            grub_efi_uint8_t *sha1hash);
27a4da
+  grub_efi_status_t (*context)(void *data,
27a4da
+                               grub_efi_uint32_t size,
27a4da
+                               pe_coff_loader_image_context_t *context);
27a4da
+};
27a4da
+
27a4da
+typedef struct grub_efi_shim_lock grub_efi_shim_lock_t;
27a4da
+
27a4da
+static grub_efi_boolean_t
27a4da
+read_header (void *data, grub_efi_uint32_t size,
27a4da
+	     pe_coff_loader_image_context_t *context)
27a4da
+{
27a4da
+  grub_efi_guid_t guid = SHIM_LOCK_GUID;
27a4da
+  grub_efi_shim_lock_t *shim_lock;
27a4da
+  grub_efi_status_t status;
27a4da
+
27a4da
+  shim_lock = grub_efi_locate_protocol (&guid, NULL);
27a4da
+
27a4da
+  if (!shim_lock)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol");
27a4da
+      return 0;
27a4da
+    }
27a4da
+
27a4da
+  status = shim_lock->context (data, size, context);
27a4da
+
27a4da
+  if (status == GRUB_EFI_SUCCESS)
27a4da
+    {
27a4da
+      grub_dprintf ("chain", "context success\n");
27a4da
+      return 1;
27a4da
+    }
27a4da
+
27a4da
+  switch (status)
27a4da
+    {
27a4da
+      case GRUB_EFI_UNSUPPORTED:
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "context error unsupported");
27a4da
+      break;
27a4da
+      case GRUB_EFI_INVALID_PARAMETER:
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "context error invalid parameter");
27a4da
+      break;
27a4da
+      default:
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "context error code");
27a4da
+      break;
27a4da
+    }
27a4da
+
27a4da
+  return 0;
27a4da
+}
27a4da
+
27a4da
+static void*
27a4da
+image_address (void *image, grub_efi_uint64_t sz, grub_efi_uint64_t adr)
27a4da
+{
27a4da
+  if (adr > sz)
27a4da
+    return NULL;
27a4da
+
27a4da
+  return ((grub_uint8_t*)image + adr);
27a4da
+}
27a4da
+
27a4da
+static int
27a4da
+image_is_64_bit (grub_pe_header_t *pe_hdr)
27a4da
+{
27a4da
+  /* .Magic is the same offset in all cases */
27a4da
+  if (pe_hdr->pe32plus.optional_header.magic == GRUB_PE32_PE64_MAGIC)
27a4da
+    return 1;
27a4da
+  return 0;
27a4da
+}
27a4da
+
27a4da
+static const grub_uint16_t machine_type =
27a4da
+#if defined(__x86_64__)
27a4da
+  GRUB_PE32_MACHINE_X86_64;
27a4da
+#elif defined(__aarch64__)
27a4da
+  GRUB_PE32_MACHINE_ARM64;
27a4da
+#elif defined(__arm__)
27a4da
+  GRUB_PE32_MACHINE_ARMTHUMB_MIXED;
27a4da
+#elif defined(__i386__) || defined(__i486__) || defined(__i686__)
27a4da
+  GRUB_PE32_MACHINE_I386;
27a4da
+#elif defined(__ia64__)
27a4da
+  GRUB_PE32_MACHINE_IA64;
27a4da
+#else
27a4da
+#error this architecture is not supported by grub2
27a4da
+#endif
27a4da
+
27a4da
+static grub_efi_status_t
27a4da
+relocate_coff (pe_coff_loader_image_context_t *context,
27a4da
+	       struct grub_pe32_section_table *section,
27a4da
+	       void *orig, void *data)
27a4da
+{
27a4da
+  struct grub_pe32_data_directory *reloc_base, *reloc_base_end;
27a4da
+  grub_efi_uint64_t adjust;
27a4da
+  struct grub_pe32_fixup_block *reloc, *reloc_end;
27a4da
+  char *fixup, *fixup_base, *fixup_data = NULL;
27a4da
+  grub_efi_uint16_t *fixup_16;
27a4da
+  grub_efi_uint32_t *fixup_32;
27a4da
+  grub_efi_uint64_t *fixup_64;
27a4da
+  grub_efi_uint64_t size = context->image_size;
27a4da
+  void *image_end = (char *)orig + size;
27a4da
+  int n = 0;
27a4da
+
27a4da
+  if (image_is_64_bit (context->pe_hdr))
27a4da
+    context->pe_hdr->pe32plus.optional_header.image_base =
27a4da
+      (grub_uint64_t)(unsigned long)data;
27a4da
+  else
27a4da
+    context->pe_hdr->pe32.optional_header.image_base =
27a4da
+      (grub_uint32_t)(unsigned long)data;
27a4da
+
27a4da
+  /* Alright, so here's how this works:
27a4da
+   *
27a4da
+   * context->reloc_dir gives us two things:
27a4da
+   * - the VA the table of base relocation blocks are (maybe) to be
27a4da
+   *   mapped at (reloc_dir->rva)
27a4da
+   * - the virtual size (reloc_dir->size)
27a4da
+   *
27a4da
+   * The .reloc section (section here) gives us some other things:
27a4da
+   * - the name! kind of. (section->name)
27a4da
+   * - the virtual size (section->virtual_size), which should be the same
27a4da
+   *   as RelocDir->Size
27a4da
+   * - the virtual address (section->virtual_address)
27a4da
+   * - the file section size (section->raw_data_size), which is
27a4da
+   *   a multiple of optional_header->file_alignment.  Only useful for image
27a4da
+   *   validation, not really useful for iteration bounds.
27a4da
+   * - the file address (section->raw_data_offset)
27a4da
+   * - a bunch of stuff we don't use that's 0 in our binaries usually
27a4da
+   * - Flags (section->characteristics)
27a4da
+   *
27a4da
+   * and then the thing that's actually at the file address is an array
27a4da
+   * of struct grub_pe32_fixup_block structs with some values packed behind
27a4da
+   * them.  The block_size field of this structure includes the
27a4da
+   * structure itself, and adding it to that structure's address will
27a4da
+   * yield the next entry in the array.
27a4da
+   */
27a4da
+
27a4da
+  reloc_base = image_address (orig, size, section->raw_data_offset);
27a4da
+  reloc_base_end = image_address (orig, size, section->raw_data_offset
27a4da
+				  + section->virtual_size - 1);
27a4da
+
27a4da
+  grub_dprintf ("chain", "reloc_base %p reloc_base_end %p\n", reloc_base,
27a4da
+		reloc_base_end);
27a4da
+
27a4da
+  if (!reloc_base && !reloc_base_end)
27a4da
+    return GRUB_EFI_SUCCESS;
27a4da
+
27a4da
+  if (!reloc_base || !reloc_base_end)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary");
27a4da
+      return GRUB_EFI_UNSUPPORTED;
27a4da
+    }
27a4da
+
27a4da
+  adjust = (grub_uint64_t)data - context->image_address;
27a4da
+  if (adjust == 0)
27a4da
+    return GRUB_EFI_SUCCESS;
27a4da
+
27a4da
+  while (reloc_base < reloc_base_end)
27a4da
+    {
27a4da
+      grub_uint16_t *entry;
27a4da
+      reloc = (struct grub_pe32_fixup_block *)((char*)reloc_base);
27a4da
+
27a4da
+      if ((reloc_base->size == 0) ||
27a4da
+	  (reloc_base->size > context->reloc_dir->size))
27a4da
+	{
27a4da
+	  grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
+		      "Reloc %d block size %d is invalid\n", n,
27a4da
+		      reloc_base->size);
27a4da
+	  return GRUB_EFI_UNSUPPORTED;
27a4da
+	}
27a4da
+
27a4da
+      entry = &reloc->entries[0];
27a4da
+      reloc_end = (struct grub_pe32_fixup_block *)
27a4da
+	((char *)reloc_base + reloc_base->size);
27a4da
+
27a4da
+      if ((void *)reloc_end < data || (void *)reloc_end > image_end)
27a4da
+        {
27a4da
+          grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc entry %d overflows binary",
27a4da
+		      n);
27a4da
+          return GRUB_EFI_UNSUPPORTED;
27a4da
+        }
27a4da
+
27a4da
+      fixup_base = image_address(data, size, reloc_base->rva);
27a4da
+
27a4da
+      if (!fixup_base)
27a4da
+        {
27a4da
+          grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc %d Invalid fixupbase", n);
27a4da
+          return GRUB_EFI_UNSUPPORTED;
27a4da
+        }
27a4da
+
27a4da
+      while ((void *)entry < (void *)reloc_end)
27a4da
+        {
27a4da
+          fixup = fixup_base + (*entry & 0xFFF);
27a4da
+          switch ((*entry) >> 12)
27a4da
+            {
27a4da
+              case GRUB_PE32_REL_BASED_ABSOLUTE:
27a4da
+                break;
27a4da
+              case GRUB_PE32_REL_BASED_HIGH:
27a4da
+                fixup_16 = (grub_uint16_t *)fixup;
27a4da
+                *fixup_16 = (grub_uint16_t)
27a4da
+		  (*fixup_16 + ((grub_uint16_t)((grub_uint32_t)adjust >> 16)));
27a4da
+                if (fixup_data != NULL)
27a4da
+                  {
27a4da
+                    *(grub_uint16_t *) fixup_data = *fixup_16;
27a4da
+                    fixup_data = fixup_data + sizeof (grub_uint16_t);
27a4da
+                  }
27a4da
+                break;
27a4da
+              case GRUB_PE32_REL_BASED_LOW:
27a4da
+                fixup_16 = (grub_uint16_t *)fixup;
27a4da
+                *fixup_16 = (grub_uint16_t) (*fixup_16 + (grub_uint16_t)adjust);
27a4da
+                if (fixup_data != NULL)
27a4da
+                  {
27a4da
+                    *(grub_uint16_t *) fixup_data = *fixup_16;
27a4da
+                    fixup_data = fixup_data + sizeof (grub_uint16_t);
27a4da
+                  }
27a4da
+                break;
27a4da
+              case GRUB_PE32_REL_BASED_HIGHLOW:
27a4da
+                fixup_32 = (grub_uint32_t *)fixup;
27a4da
+                *fixup_32 = *fixup_32 + (grub_uint32_t)adjust;
27a4da
+                if (fixup_data != NULL)
27a4da
+                  {
27a4da
+                    fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint32_t));
27a4da
+                    *(grub_uint32_t *) fixup_data = *fixup_32;
27a4da
+                    fixup_data += sizeof (grub_uint32_t);
27a4da
+                  }
27a4da
+                break;
27a4da
+              case GRUB_PE32_REL_BASED_DIR64:
27a4da
+                fixup_64 = (grub_uint64_t *)fixup;
27a4da
+                *fixup_64 = *fixup_64 + (grub_uint64_t)adjust;
27a4da
+                if (fixup_data != NULL)
27a4da
+                  {
27a4da
+                    fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint64_t));
27a4da
+                    *(grub_uint64_t *) fixup_data = *fixup_64;
27a4da
+                    fixup_data += sizeof (grub_uint64_t);
27a4da
+                  }
27a4da
+                break;
27a4da
+              default:
27a4da
+                grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
+			    "Reloc %d unknown relocation type %d",
27a4da
+			    n, (*entry) >> 12);
27a4da
+                return GRUB_EFI_UNSUPPORTED;
27a4da
+            }
27a4da
+          entry += 1;
27a4da
+        }
27a4da
+      reloc_base = (struct grub_pe32_data_directory *)reloc_end;
27a4da
+      n++;
27a4da
+    }
27a4da
+
27a4da
+  return GRUB_EFI_SUCCESS;
27a4da
+}
27a4da
+
27a4da
+static grub_efi_device_path_t *
27a4da
+grub_efi_get_media_file_path (grub_efi_device_path_t *dp)
27a4da
+{
27a4da
+  while (1)
27a4da
+    {
27a4da
+      grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
27a4da
+      grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
27a4da
+
27a4da
+      if (type == GRUB_EFI_END_DEVICE_PATH_TYPE)
27a4da
+        break;
27a4da
+      else if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE
27a4da
+            && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE)
27a4da
+      return dp;
27a4da
+
27a4da
+      dp = GRUB_EFI_NEXT_DEVICE_PATH (dp);
27a4da
+    }
27a4da
+
27a4da
+    return NULL;
27a4da
+}
27a4da
+
27a4da
+static grub_efi_boolean_t
27a4da
+handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
+{
27a4da
+  grub_efi_boot_services_t *b;
27a4da
+  grub_efi_loaded_image_t *li, li_bak;
27a4da
+  grub_efi_status_t efi_status;
27a4da
+  char *buffer = NULL;
27a4da
+  char *buffer_aligned = NULL;
27a4da
+  grub_efi_uint32_t i, size;
27a4da
+  struct grub_pe32_section_table *section;
27a4da
+  char *base, *end;
27a4da
+  pe_coff_loader_image_context_t context;
27a4da
+  grub_uint32_t section_alignment;
27a4da
+  grub_uint32_t buffer_size;
27a4da
+
27a4da
+  b = grub_efi_system_table->boot_services;
27a4da
+
27a4da
+  if (read_header (data, datasize, &context))
27a4da
+    {
27a4da
+      grub_dprintf ("chain", "Succeed to read header\n");
27a4da
+    }
27a4da
+  else
27a4da
+    {
27a4da
+      grub_dprintf ("chain", "Failed to read header\n");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  section_alignment = context.section_alignment;
27a4da
+  buffer_size = context.image_size + section_alignment;
27a4da
+
27a4da
+  efi_status = efi_call_3 (b->allocate_pool, GRUB_EFI_LOADER_DATA,
27a4da
+			   buffer_size, &buffer);
27a4da
+
27a4da
+  if (efi_status != GRUB_EFI_SUCCESS)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  buffer_aligned = (char *)ALIGN_UP ((grub_addr_t)buffer, section_alignment);
27a4da
+
27a4da
+  if (!buffer_aligned)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  grub_memcpy (buffer_aligned, data, context.size_of_headers);
27a4da
+
27a4da
+  char *reloc_base, *reloc_base_end;
27a4da
+  reloc_base = image_address (buffer_aligned, datasize,
27a4da
+			      context.reloc_dir->rva);
27a4da
+  /* RelocBaseEnd here is the address of the last byte of the table */
27a4da
+  reloc_base_end = image_address (buffer_aligned, datasize,
27a4da
+				  context.reloc_dir->rva
27a4da
+				  + context.reloc_dir->size - 1);
27a4da
+  struct grub_pe32_section_table *reloc_section = NULL;
27a4da
+
27a4da
+  section = context.first_section;
27a4da
+  for (i = 0; i < context.number_of_sections; i++, section++)
27a4da
+    {
27a4da
+      size = section->virtual_size;
27a4da
+      if (size > section->raw_data_size)
27a4da
+        size = section->raw_data_size;
27a4da
+
27a4da
+      base = image_address (buffer_aligned, context.image_size,
27a4da
+			    section->virtual_address);
27a4da
+      end = image_address (buffer_aligned, context.image_size,
27a4da
+			   section->virtual_address + size - 1);
27a4da
+
27a4da
+
27a4da
+      /* We do want to process .reloc, but it's often marked
27a4da
+       * discardable, so we don't want to memcpy it. */
27a4da
+      if (grub_memcmp (section->name, ".reloc\0\0", 8) == 0)
27a4da
+	{
27a4da
+	  if (reloc_section)
27a4da
+	    {
27a4da
+	      grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
+			  "Image has multiple relocation sections");
27a4da
+	      goto error_exit;
27a4da
+	    }
27a4da
+
27a4da
+	  /* If it has nonzero sizes, and our bounds check
27a4da
+	   * made sense, and the VA and size match RelocDir's
27a4da
+	   * versions, then we believe in this section table. */
27a4da
+	  if (section->raw_data_size && section->virtual_size &&
27a4da
+	      base && end && reloc_base == base && reloc_base_end == end)
27a4da
+	    {
27a4da
+	      reloc_section = section;
27a4da
+	    }
27a4da
+	}
27a4da
+
27a4da
+      if (section->characteristics && GRUB_PE32_SCN_MEM_DISCARDABLE)
27a4da
+	continue;
27a4da
+
27a4da
+      if (!base || !end)
27a4da
+        {
27a4da
+          grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid section size");
27a4da
+          goto error_exit;
27a4da
+        }
27a4da
+
27a4da
+      if (section->virtual_address < context.size_of_headers ||
27a4da
+	  section->raw_data_offset < context.size_of_headers)
27a4da
+	{
27a4da
+	  grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
+		      "Section %d is inside image headers", i);
27a4da
+	  goto error_exit;
27a4da
+	}
27a4da
+
27a4da
+      if (section->raw_data_size > 0)
27a4da
+        grub_memcpy (base, (grub_efi_uint8_t*)data + section->raw_data_offset,
27a4da
+		     size);
27a4da
+
27a4da
+      if (size < section->virtual_size)
27a4da
+        grub_memset (base + size, 0, section->virtual_size - size);
27a4da
+
27a4da
+      grub_dprintf ("chain", "copied section %s\n", section->name);
27a4da
+    }
27a4da
+
27a4da
+  /* 5 == EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC */
27a4da
+  if (context.number_of_rva_and_sizes <= 5)
27a4da
+    {
27a4da
+      grub_dprintf ("chain", "image has no relocation entry\n");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  if (context.reloc_dir->size && reloc_section)
27a4da
+    {
27a4da
+      /* run the relocation fixups */
27a4da
+      efi_status = relocate_coff (&context, reloc_section, data,
27a4da
+				  buffer_aligned);
27a4da
+
27a4da
+      if (efi_status != GRUB_EFI_SUCCESS)
27a4da
+	{
27a4da
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "relocation failed");
27a4da
+	  goto error_exit;
27a4da
+	}
27a4da
+    }
27a4da
+
27a4da
+  entry_point = image_address (buffer_aligned, context.image_size,
27a4da
+			       context.entry_point);
27a4da
+
27a4da
+  if (!entry_point)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  li = grub_efi_get_loaded_image (grub_efi_image_handle);
27a4da
+  if (!li)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "no loaded image available");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  grub_memcpy (&li_bak, li, sizeof (grub_efi_loaded_image_t));
27a4da
+  li->image_base = buffer_aligned;
27a4da
+  li->image_size = context.image_size;
27a4da
+  li->load_options = cmdline;
27a4da
+  li->load_options_size = cmdline_len;
27a4da
+  li->file_path = grub_efi_get_media_file_path (file_path);
27a4da
+  li->device_handle = dev_handle;
27a4da
+  if (li->file_path)
27a4da
+    {
27a4da
+      grub_printf ("file path: ");
27a4da
+      grub_efi_print_device_path (li->file_path);
27a4da
+    }
27a4da
+  else
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
+  efi_status = efi_call_2 (entry_point, grub_efi_image_handle,
27a4da
+			   grub_efi_system_table);
27a4da
+
27a4da
+  grub_memcpy (li, &li_bak, sizeof (grub_efi_loaded_image_t));
27a4da
+  efi_status = efi_call_1 (b->free_pool, buffer);
27a4da
+
27a4da
+  return 1;
27a4da
+
27a4da
+error_exit:
27a4da
+  if (buffer)
27a4da
+      efi_call_1 (b->free_pool, buffer);
27a4da
+
27a4da
+  return 0;
27a4da
+}
27a4da
+
27a4da
+static grub_err_t
27a4da
+grub_secureboot_chainloader_unload (void)
27a4da
+{
27a4da
+  grub_efi_boot_services_t *b;
27a4da
+
27a4da
+  b = grub_efi_system_table->boot_services;
27a4da
+  efi_call_2 (b->free_pages, address, pages);
27a4da
+  grub_free (file_path);
27a4da
+  grub_free (cmdline);
27a4da
+  cmdline = 0;
27a4da
+  file_path = 0;
27a4da
+  dev_handle = 0;
27a4da
+
27a4da
+  grub_dl_unref (my_mod);
27a4da
+  return GRUB_ERR_NONE;
27a4da
+}
27a4da
+
27a4da
+static grub_err_t
27a4da
+grub_secureboot_chainloader_boot (void)
27a4da
+{
27a4da
+  handle_image ((void *)address, fsize);
27a4da
+  grub_loader_unset ();
27a4da
+  return grub_errno;
27a4da
+}
27a4da
+
27a4da
 static grub_err_t
27a4da
 grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
 		      int argc, char *argv[])
27a4da
 {
27a4da
   grub_file_t file = 0;
27a4da
-  grub_ssize_t size;
27a4da
   grub_efi_status_t status;
27a4da
   grub_efi_boot_services_t *b;
27a4da
   grub_device_t dev = 0;
27a4da
@@ -204,7 +723,6 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
   grub_efi_loaded_image_t *loaded_image;
27a4da
   char *filename;
27a4da
   void *boot_image = 0;
27a4da
-  grub_efi_handle_t dev_handle = 0;
27a4da
 
27a4da
   if (argc == 0)
27a4da
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
27a4da
@@ -216,9 +734,36 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
   address = 0;
27a4da
   image_handle = 0;
27a4da
   file_path = 0;
27a4da
+  dev_handle = 0;
27a4da
 
27a4da
   b = grub_efi_system_table->boot_services;
27a4da
 
27a4da
+  if (argc > 1)
27a4da
+    {
27a4da
+      int i;
27a4da
+      grub_efi_char16_t *p16;
27a4da
+
27a4da
+      for (i = 1, cmdline_len = 0; i < argc; i++)
27a4da
+        cmdline_len += grub_strlen (argv[i]) + 1;
27a4da
+
27a4da
+      cmdline_len *= sizeof (grub_efi_char16_t);
27a4da
+      cmdline = p16 = grub_malloc (cmdline_len);
27a4da
+      if (! cmdline)
27a4da
+        goto fail;
27a4da
+
27a4da
+      for (i = 1; i < argc; i++)
27a4da
+        {
27a4da
+          char *p8;
27a4da
+
27a4da
+          p8 = argv[i];
27a4da
+          while (*p8)
27a4da
+            *(p16++) = *(p8++);
27a4da
+
27a4da
+          *(p16++) = ' ';
27a4da
+        }
27a4da
+      *(--p16) = 0;
27a4da
+    }
27a4da
+
27a4da
   file = grub_file_open (filename);
27a4da
   if (! file)
27a4da
     goto fail;
27a4da
@@ -267,14 +812,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
   grub_printf ("file path: ");
27a4da
   grub_efi_print_device_path (file_path);
27a4da
 
27a4da
-  size = grub_file_size (file);
27a4da
-  if (!size)
27a4da
+  fsize = grub_file_size (file);
27a4da
+  if (!fsize)
27a4da
     {
27a4da
       grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
27a4da
 		  filename);
27a4da
       goto fail;
27a4da
     }
27a4da
-  pages = (((grub_efi_uintn_t) size + ((1 << 12) - 1)) >> 12);
27a4da
+  pages = (((grub_efi_uintn_t) fsize + ((1 << 12) - 1)) >> 12);
27a4da
 
27a4da
   status = efi_call_4 (b->allocate_pages, GRUB_EFI_ALLOCATE_ANY_PAGES,
27a4da
 			      GRUB_EFI_LOADER_CODE,
27a4da
@@ -288,7 +833,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
     }
27a4da
 
27a4da
   boot_image = (void *) ((grub_addr_t) address);
27a4da
-  if (grub_file_read (file, boot_image, size) != size)
27a4da
+  if (grub_file_read (file, boot_image, fsize) != fsize)
27a4da
     {
27a4da
       if (grub_errno == GRUB_ERR_NONE)
27a4da
 	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
27a4da
@@ -298,7 +843,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
     }
27a4da
 
27a4da
 #if defined (__i386__) || defined (__x86_64__)
27a4da
-  if (size >= (grub_ssize_t) sizeof (struct grub_macho_fat_header))
27a4da
+  if (fsize >= (grub_ssize_t) sizeof (struct grub_macho_fat_header))
27a4da
     {
27a4da
       struct grub_macho_fat_header *head = boot_image;
27a4da
       if (head->magic
27a4da
@@ -307,6 +852,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
 	  grub_uint32_t i;
27a4da
 	  struct grub_macho_fat_arch *archs
27a4da
 	    = (struct grub_macho_fat_arch *) (head + 1);
27a4da
+
27a4da
+	  if (grub_efi_secure_boot())
27a4da
+	    {
27a4da
+	      grub_error (GRUB_ERR_BAD_OS,
27a4da
+			  "MACHO binaries are forbidden with Secure Boot");
27a4da
+	      goto fail;
27a4da
+	    }
27a4da
+
27a4da
 	  for (i = 0; i < grub_cpu_to_le32 (head->nfat_arch); i++)
27a4da
 	    {
27a4da
 	      if (GRUB_MACHO_CPUTYPE_IS_HOST_CURRENT (archs[i].cputype))
27a4da
@@ -321,21 +874,28 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
 	      > ~grub_cpu_to_le32 (archs[i].size)
27a4da
 	      || grub_cpu_to_le32 (archs[i].offset)
27a4da
 	      + grub_cpu_to_le32 (archs[i].size)
27a4da
-	      > (grub_size_t) size)
27a4da
+	      > (grub_size_t) fsize)
27a4da
 	    {
27a4da
 	      grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
27a4da
 			  filename);
27a4da
 	      goto fail;
27a4da
 	    }
27a4da
 	  boot_image = (char *) boot_image + grub_cpu_to_le32 (archs[i].offset);
27a4da
-	  size = grub_cpu_to_le32 (archs[i].size);
27a4da
+	  fsize = grub_cpu_to_le32 (archs[i].size);
27a4da
 	}
27a4da
     }
27a4da
 #endif
27a4da
 
27a4da
+  if (grub_linuxefi_secure_validate((void *)address, fsize))
27a4da
+    {
27a4da
+      grub_file_close (file);
27a4da
+      grub_loader_set (grub_secureboot_chainloader_boot,
27a4da
+		       grub_secureboot_chainloader_unload, 0);
27a4da
+      return 0;
27a4da
+    }
27a4da
+
27a4da
   status = efi_call_6 (b->load_image, 0, grub_efi_image_handle, file_path,
27a4da
-		       boot_image, size,
27a4da
-		       &image_handle);
27a4da
+		       boot_image, fsize, &image_handle);
27a4da
   if (status != GRUB_EFI_SUCCESS)
27a4da
     {
27a4da
       if (status == GRUB_EFI_OUT_OF_RESOURCES)
27a4da
@@ -357,33 +917,10 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
     }
27a4da
   loaded_image->device_handle = dev_handle;
27a4da
 
27a4da
-  if (argc > 1)
27a4da
+  if (cmdline)
27a4da
     {
27a4da
-      int i, len;
27a4da
-      grub_efi_char16_t *p16;
27a4da
-
27a4da
-      for (i = 1, len = 0; i < argc; i++)
27a4da
-        len += grub_strlen (argv[i]) + 1;
27a4da
-
27a4da
-      len *= sizeof (grub_efi_char16_t);
27a4da
-      cmdline = p16 = grub_malloc (len);
27a4da
-      if (! cmdline)
27a4da
-        goto fail;
27a4da
-
27a4da
-      for (i = 1; i < argc; i++)
27a4da
-        {
27a4da
-          char *p8;
27a4da
-
27a4da
-          p8 = argv[i];
27a4da
-          while (*p8)
27a4da
-            *(p16++) = *(p8++);
27a4da
-
27a4da
-          *(p16++) = ' ';
27a4da
-        }
27a4da
-      *(--p16) = 0;
27a4da
-
27a4da
       loaded_image->load_options = cmdline;
27a4da
-      loaded_image->load_options_size = len;
27a4da
+      loaded_image->load_options_size = cmdline_len;
27a4da
     }
27a4da
 
27a4da
   grub_file_close (file);
27a4da
@@ -405,6 +942,9 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
27a4da
   if (address)
27a4da
     efi_call_2 (b->free_pages, address, pages);
27a4da
 
27a4da
+  if (cmdline)
27a4da
+    grub_free (cmdline);
27a4da
+
27a4da
   grub_dl_unref (my_mod);
27a4da
 
27a4da
   return grub_errno;
27a4da
diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h
28f7f8
index f79c36c026e..f79782e1bde 100644
27a4da
--- a/include/grub/efi/pe32.h
27a4da
+++ b/include/grub/efi/pe32.h
27a4da
@@ -212,7 +212,11 @@ struct grub_pe64_optional_header
27a4da
 struct grub_pe32_section_table
27a4da
 {
27a4da
   char name[8];
27a4da
-  grub_uint32_t virtual_size;
27a4da
+  union
27a4da
+    {
27a4da
+      grub_uint32_t physical_address;
27a4da
+      grub_uint32_t virtual_size;
27a4da
+    };
27a4da
   grub_uint32_t virtual_address;
27a4da
   grub_uint32_t raw_data_size;
27a4da
   grub_uint32_t raw_data_offset;
27a4da
@@ -263,6 +267,20 @@ struct grub_pe32_header
27a4da
 #endif
27a4da
 };
27a4da
 
27a4da
+struct grub_pe32_header_32
27a4da
+{
27a4da
+  char signature[GRUB_PE32_SIGNATURE_SIZE];
27a4da
+  struct grub_pe32_coff_header coff_header;
27a4da
+  struct grub_pe32_optional_header optional_header;
27a4da
+};
27a4da
+
27a4da
+struct grub_pe32_header_64
27a4da
+{
27a4da
+  char signature[GRUB_PE32_SIGNATURE_SIZE];
27a4da
+  struct grub_pe32_coff_header coff_header;
27a4da
+  struct grub_pe64_optional_header optional_header;
27a4da
+};
27a4da
+
27a4da
 struct grub_pe32_fixup_block
27a4da
 {
27a4da
   grub_uint32_t page_rva;