Blame SOURCES/0001-Add-support-for-Linux-EFI-stub-loading.patch

8631a2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
8631a2
From: Matthew Garrett <mjg@redhat.com>
8631a2
Date: Tue, 10 Jul 2012 11:58:52 -0400
8631a2
Subject: [PATCH] Add support for Linux EFI stub loading.
8631a2
8631a2
Also:
8631a2
8631a2
commit 71c843745f22f81e16d259e2e19c99bf3c1855c1
8631a2
Author: Colin Watson <cjwatson@ubuntu.com>
8631a2
Date:   Tue Oct 23 10:40:49 2012 -0400
8631a2
8631a2
Don't allow insmod when secure boot is enabled.
8631a2
8631a2
Hi,
8631a2
8631a2
Fedora's patch to forbid insmod in UEFI Secure Boot environments is fine
8631a2
as far as it goes.  However, the insmod command is not the only way that
8631a2
modules can be loaded.  In particular, the 'normal' command, which
8631a2
implements the usual GRUB menu and the fully-featured command prompt,
8631a2
will implicitly load commands not currently loaded into memory.  This
8631a2
permits trivial Secure Boot violations by writing commands implementing
8631a2
whatever you want to do and pointing $prefix at the malicious code.
8631a2
8631a2
I'm currently test-building this patch (replacing your current
8631a2
grub-2.00-no-insmod-on-sb.patch), but this should be more correct.  It
8631a2
moves the check into grub_dl_load_file.
8631a2
---
8631a2
 grub-core/Makefile.core.def       |  16 +-
8631a2
 grub-core/kern/dl.c               |  21 +++
8631a2
 grub-core/kern/efi/efi.c          |  28 ++++
8631a2
 grub-core/kern/efi/mm.c           |  32 ++++
8631a2
 grub-core/loader/arm64/linux.c    | 118 +++++++-------
8631a2
 grub-core/loader/arm64/xen_boot.c |   1 -
8631a2
 grub-core/loader/efi/linux.c      |  70 ++++++++
8631a2
 grub-core/loader/i386/efi/linux.c | 335 ++++++++++++++++++++++++++++++++++++++
8631a2
 grub-core/loader/i386/pc/linux.c  |  10 +-
8631a2
 include/grub/arm/linux.h          |   9 +
8631a2
 include/grub/arm64/linux.h        |  10 ++
8631a2
 include/grub/efi/efi.h            |   7 +-
8631a2
 include/grub/efi/linux.h          |  31 ++++
8631a2
 include/grub/i386/linux.h         |   1 +
8631a2
 14 files changed, 620 insertions(+), 69 deletions(-)
8631a2
 create mode 100644 grub-core/loader/efi/linux.c
8631a2
 create mode 100644 grub-core/loader/i386/efi/linux.c
8631a2
 create mode 100644 include/grub/efi/linux.h
8631a2
8631a2
diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
f6e916
index 9590e87d9..0b4b0c212 100644
8631a2
--- a/grub-core/Makefile.core.def
8631a2
+++ b/grub-core/Makefile.core.def
8631a2
@@ -1626,13 +1626,6 @@ module = {
8631a2
   enable = i386_pc;
8631a2
 };
8631a2
 
8631a2
-
8631a2
-module = {
8631a2
-  name = linux16;
8631a2
-  common = loader/i386/pc/linux.c;
8631a2
-  enable = x86;
8631a2
-};
8631a2
-
8631a2
 module = {
8631a2
   name = ntldr;
8631a2
   i386_pc = loader/i386/pc/ntldr.c;
8631a2
@@ -1685,7 +1678,9 @@ module = {
8631a2
 
8631a2
 module = {
8631a2
   name = linux;
8631a2
-  x86 = loader/i386/linux.c;
8631a2
+  i386_pc = loader/i386/pc/linux.c;
8631a2
+  x86_64_efi = loader/i386/efi/linux.c;
8631a2
+  i386_efi = loader/i386/efi/linux.c;
8631a2
   xen = loader/i386/xen.c;
8631a2
   i386_pc = lib/i386/pc/vesa_modes_table.c;
8631a2
   mips = loader/mips/linux.c;
8631a2
@@ -1696,9 +1691,14 @@ module = {
8631a2
   arm_efi = loader/arm64/linux.c;
8631a2
   arm_uboot = loader/arm/linux.c;
8631a2
   arm64 = loader/arm64/linux.c;
8631a2
+  emu = loader/emu/linux.c;
8631a2
+  fdt = lib/fdt.c;
8631a2
+
8631a2
   common = loader/linux.c;
8631a2
   common = lib/cmdline.c;
8631a2
   enable = noemu;
8631a2
+
8631a2
+  efi = loader/efi/linux.c;
8631a2
 };
8631a2
 
8631a2
 module = {
8631a2
diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
f6e916
index e394cd96f..04e804d16 100644
8631a2
--- a/grub-core/kern/dl.c
8631a2
+++ b/grub-core/kern/dl.c
8631a2
@@ -38,6 +38,14 @@
8631a2
 #define GRUB_MODULES_MACHINE_READONLY
8631a2
 #endif
8631a2
 
8631a2
+#ifdef GRUB_MACHINE_EMU
8631a2
+#include <sys/mman.h>
8631a2
+#endif
8631a2
+
8631a2
+#ifdef GRUB_MACHINE_EFI
8631a2
+#include <grub/efi/efi.h>
8631a2
+#endif
8631a2
+
8631a2
 
8631a2
 
8631a2
 #pragma GCC diagnostic ignored "-Wcast-align"
8631a2
@@ -686,6 +694,19 @@ grub_dl_load_file (const char *filename)
8631a2
   void *core = 0;
8631a2
   grub_dl_t mod = 0;
8631a2
 
8631a2
+#ifdef GRUB_MACHINE_EFI
8631a2
+  if (grub_efi_secure_boot ())
8631a2
+    {
8631a2
+#if 0
8631a2
+      /* This is an error, but grub2-mkconfig still generates a pile of
8631a2
+       * insmod commands, so emitting it would be mostly just obnoxious. */
8631a2
+      grub_error (GRUB_ERR_ACCESS_DENIED,
8631a2
+		  "Secure Boot forbids loading module from %s", filename);
8631a2
+#endif
8631a2
+      return 0;
8631a2
+    }
8631a2
+#endif
8631a2
+
8631a2
   grub_boot_time ("Loading module %s", filename);
8631a2
 
8631a2
   file = grub_file_open (filename);
8631a2
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
f6e916
index 708581fcb..c8a9d8307 100644
8631a2
--- a/grub-core/kern/efi/efi.c
8631a2
+++ b/grub-core/kern/efi/efi.c
8631a2
@@ -273,6 +273,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
8631a2
   return NULL;
8631a2
 }
8631a2
 
8631a2
+grub_efi_boolean_t
8631a2
+grub_efi_secure_boot (void)
8631a2
+{
8631a2
+  grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID;
8631a2
+  grub_size_t datasize;
8631a2
+  char *secure_boot = NULL;
8631a2
+  char *setup_mode = NULL;
8631a2
+  grub_efi_boolean_t ret = 0;
8631a2
+
8631a2
+  secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
8631a2
+
8631a2
+  if (datasize != 1 || !secure_boot)
8631a2
+    goto out;
8631a2
+
8631a2
+  setup_mode = grub_efi_get_variable("SetupMode", &efi_var_guid, &datasize);
8631a2
+
8631a2
+  if (datasize != 1 || !setup_mode)
8631a2
+    goto out;
8631a2
+
8631a2
+  if (*secure_boot && !*setup_mode)
8631a2
+    ret = 1;
8631a2
+
8631a2
+ out:
8631a2
+  grub_free (secure_boot);
8631a2
+  grub_free (setup_mode);
8631a2
+  return ret;
8631a2
+}
8631a2
+
8631a2
 #pragma GCC diagnostic ignored "-Wcast-align"
8631a2
 
8631a2
 /* Search the mods section from the PE32/PE32+ image. This code uses
8631a2
diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
f6e916
index 42ad7c570..5cdf6c943 100644
8631a2
--- a/grub-core/kern/efi/mm.c
8631a2
+++ b/grub-core/kern/efi/mm.c
8631a2
@@ -113,6 +113,38 @@ grub_efi_drop_alloc (grub_efi_physical_address_t address,
8631a2
     }
8631a2
 }
8631a2
 
8631a2
+/* Allocate pages below a specified address */
8631a2
+void *
8631a2
+grub_efi_allocate_pages_max (grub_efi_physical_address_t max,
8631a2
+			     grub_efi_uintn_t pages)
8631a2
+{
8631a2
+  grub_efi_status_t status;
8631a2
+  grub_efi_boot_services_t *b;
8631a2
+  grub_efi_physical_address_t address = max;
8631a2
+
8631a2
+  if (max > 0xffffffff)
8631a2
+    return 0;
8631a2
+
8631a2
+  b = grub_efi_system_table->boot_services;
8631a2
+  status = efi_call_4 (b->allocate_pages, GRUB_EFI_ALLOCATE_MAX_ADDRESS, GRUB_EFI_LOADER_DATA, pages, &address);
8631a2
+
8631a2
+  if (status != GRUB_EFI_SUCCESS)
8631a2
+    return 0;
8631a2
+
8631a2
+  if (address == 0)
8631a2
+    {
8631a2
+      /* Uggh, the address 0 was allocated... This is too annoying,
8631a2
+	 so reallocate another one.  */
8631a2
+      address = max;
8631a2
+      status = efi_call_4 (b->allocate_pages, GRUB_EFI_ALLOCATE_MAX_ADDRESS, GRUB_EFI_LOADER_DATA, pages, &address);
8631a2
+      grub_efi_free_pages (0, pages);
8631a2
+      if (status != GRUB_EFI_SUCCESS)
8631a2
+	return 0;
8631a2
+    }
8631a2
+
8631a2
+  return (void *) ((grub_addr_t) address);
8631a2
+}
8631a2
+
8631a2
 /* Allocate pages. Return the pointer to the first of allocated pages.  */
8631a2
 void *
8631a2
 grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
8631a2
diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
f6e916
index 1f86229f8..6c00af98d 100644
8631a2
--- a/grub-core/loader/arm64/linux.c
8631a2
+++ b/grub-core/loader/arm64/linux.c
8631a2
@@ -29,6 +29,7 @@
8631a2
 #include <grub/efi/efi.h>
8631a2
 #include <grub/efi/fdtload.h>
8631a2
 #include <grub/efi/memory.h>
8631a2
+#include <grub/efi/linux.h>
8631a2
 #include <grub/efi/pe32.h>
8631a2
 #include <grub/i18n.h>
8631a2
 #include <grub/lib/cmdline.h>
8631a2
@@ -40,6 +41,7 @@ static int loaded;
8631a2
 
8631a2
 static void *kernel_addr;
8631a2
 static grub_uint64_t kernel_size;
8631a2
+static grub_uint32_t handover_offset;
8631a2
 
8631a2
 static char *linux_args;
8631a2
 static grub_uint32_t cmdline_size;
8631a2
@@ -66,7 +68,8 @@ grub_armxx_efi_linux_check_image (struct linux_armxx_kernel_header * lh)
8631a2
 static grub_err_t
8631a2
 finalize_params_linux (void)
8631a2
 {
8631a2
-  int node, retval;
8631a2
+  grub_efi_loaded_image_t *loaded_image = NULL;
8631a2
+  int node, retval, len;
8631a2
 
8631a2
   void *fdt;
8631a2
 
8631a2
@@ -101,79 +104,70 @@ finalize_params_linux (void)
8631a2
   if (grub_fdt_install() != GRUB_ERR_NONE)
8631a2
     goto failure;
8631a2
 
8631a2
-  return GRUB_ERR_NONE;
8631a2
-
8631a2
-failure:
8631a2
-  grub_fdt_unload();
8631a2
-  return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT");
8631a2
-}
8631a2
-
8631a2
-grub_err_t
8631a2
-grub_armxx_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args)
8631a2
-{
8631a2
-  grub_efi_memory_mapped_device_path_t *mempath;
8631a2
-  grub_efi_handle_t image_handle;
8631a2
-  grub_efi_boot_services_t *b;
8631a2
-  grub_efi_status_t status;
8631a2
-  grub_efi_loaded_image_t *loaded_image;
8631a2
-  int len;
8631a2
-
8631a2
-  mempath = grub_malloc (2 * sizeof (grub_efi_memory_mapped_device_path_t));
8631a2
-  if (!mempath)
8631a2
-    return grub_errno;
8631a2
-
8631a2
-  mempath[0].header.type = GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE;
8631a2
-  mempath[0].header.subtype = GRUB_EFI_MEMORY_MAPPED_DEVICE_PATH_SUBTYPE;
8631a2
-  mempath[0].header.length = grub_cpu_to_le16_compile_time (sizeof (*mempath));
8631a2
-  mempath[0].memory_type = GRUB_EFI_LOADER_DATA;
8631a2
-  mempath[0].start_address = addr;
8631a2
-  mempath[0].end_address = addr + size;
8631a2
-
8631a2
-  mempath[1].header.type = GRUB_EFI_END_DEVICE_PATH_TYPE;
8631a2
-  mempath[1].header.subtype = GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE;
8631a2
-  mempath[1].header.length = sizeof (grub_efi_device_path_t);
8631a2
-
8631a2
-  b = grub_efi_system_table->boot_services;
8631a2
-  status = b->load_image (0, grub_efi_image_handle,
8631a2
-			  (grub_efi_device_path_t *) mempath,
8631a2
-			  (void *) addr, size, &image_handle);
8631a2
-  if (status != GRUB_EFI_SUCCESS)
8631a2
-    return grub_error (GRUB_ERR_BAD_OS, "cannot load image");
8631a2
-
8631a2
-  grub_dprintf ("linux", "linux command line: '%s'\n", args);
8631a2
+  grub_dprintf ("linux", "Installed/updated FDT configuration table @ %p\n",
8631a2
+		fdt);
8631a2
 
8631a2
   /* Convert command line to UCS-2 */
8631a2
-  loaded_image = grub_efi_get_loaded_image (image_handle);
8631a2
+  loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle);
8631a2
+  if (!loaded_image)
8631a2
+    goto failure;
8631a2
+
8631a2
   loaded_image->load_options_size = len =
8631a2
-    (grub_strlen (args) + 1) * sizeof (grub_efi_char16_t);
8631a2
+    (grub_strlen (linux_args) + 1) * sizeof (grub_efi_char16_t);
8631a2
   loaded_image->load_options =
8631a2
     grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size));
8631a2
   if (!loaded_image->load_options)
8631a2
-    return grub_errno;
8631a2
+    return grub_error(GRUB_ERR_BAD_OS, "failed to create kernel parameters");
8631a2
 
8631a2
   loaded_image->load_options_size =
8631a2
     2 * grub_utf8_to_utf16 (loaded_image->load_options, len,
8631a2
-			    (grub_uint8_t *) args, len, NULL);
8631a2
+			    (grub_uint8_t *) linux_args, len, NULL);
8631a2
 
8631a2
-  grub_dprintf ("linux", "starting image %p\n", image_handle);
8631a2
-  status = b->start_image (image_handle, 0, NULL);
8631a2
+  return GRUB_ERR_NONE;
8631a2
 
8631a2
-  /* When successful, not reached */
8631a2
-  b->unload_image (image_handle);
8631a2
-  grub_efi_free_pages ((grub_addr_t) loaded_image->load_options,
8631a2
-		       GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size));
8631a2
+failure:
8631a2
+  grub_fdt_unload();
8631a2
+  return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT");
8631a2
+}
8631a2
 
8631a2
-  return grub_errno;
8631a2
+static void
8631a2
+free_params (void)
8631a2
+{
8631a2
+  grub_efi_loaded_image_t *loaded_image = NULL;
8631a2
+
8631a2
+  loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle);
8631a2
+  if (loaded_image)
8631a2
+    {
8631a2
+      if (loaded_image->load_options)
8631a2
+	grub_efi_free_pages ((grub_efi_physical_address_t)(grub_efi_uintn_t)loaded_image->load_options,
8631a2
+			     GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size));
8631a2
+      loaded_image->load_options = NULL;
8631a2
+      loaded_image->load_options_size = 0;
8631a2
+    }
8631a2
+}
8631a2
+
8631a2
+grub_err_t
8631a2
+grub_armxx_efi_linux_boot_image (grub_addr_t addr, char *args)
8631a2
+{
8631a2
+  grub_err_t retval;
8631a2
+
8631a2
+  retval = finalize_params_linux ();
8631a2
+  if (retval != GRUB_ERR_NONE)
8631a2
+    return grub_errno;
8631a2
+
8631a2
+  grub_dprintf ("linux", "linux command line: '%s'\n", args);
8631a2
+
8631a2
+  retval = grub_efi_linux_boot ((char *)addr, handover_offset, (void *)addr);
8631a2
+
8631a2
+  /* Never reached... */
8631a2
+  free_params();
8631a2
+  return retval;
8631a2
 }
8631a2
 
8631a2
 static grub_err_t
8631a2
 grub_linux_boot (void)
8631a2
 {
8631a2
-  if (finalize_params_linux () != GRUB_ERR_NONE)
8631a2
-    return grub_errno;
8631a2
-
8631a2
-  return (grub_armxx_efi_linux_boot_image((grub_addr_t)kernel_addr,
8631a2
-                                          kernel_size, linux_args));
8631a2
+  return grub_armxx_efi_linux_boot_image((grub_addr_t)kernel_addr, linux_args);
8631a2
 }
8631a2
 
8631a2
 static grub_err_t
8631a2
@@ -287,6 +281,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
8631a2
 {
8631a2
   grub_file_t file = 0;
8631a2
   struct linux_armxx_kernel_header lh;
8631a2
+  struct grub_armxx_linux_pe_header *pe;
8631a2
 
8631a2
   grub_dl_ref (my_mod);
8631a2
 
8631a2
@@ -331,6 +326,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
8631a2
 
8631a2
   grub_dprintf ("linux", "kernel @ %p\n", kernel_addr);
8631a2
 
8631a2
+  if (!grub_linuxefi_secure_validate (kernel_addr, kernel_size))
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), argv[0]);
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  pe = (void *)((unsigned long)kernel_addr + lh.hdr_offset);
8631a2
+  handover_offset = pe->opt.entry_addr;
8631a2
+
8631a2
   cmdline_size = grub_loader_cmdline_size (argc, argv) + sizeof (LINUX_IMAGE);
8631a2
   linux_args = grub_malloc (cmdline_size);
8631a2
   if (!linux_args)
8631a2
diff --git a/grub-core/loader/arm64/xen_boot.c b/grub-core/loader/arm64/xen_boot.c
f6e916
index 1003a0b99..f35b16caa 100644
8631a2
--- a/grub-core/loader/arm64/xen_boot.c
8631a2
+++ b/grub-core/loader/arm64/xen_boot.c
8631a2
@@ -266,7 +266,6 @@ xen_boot (void)
8631a2
     return err;
8631a2
 
8631a2
   return grub_armxx_efi_linux_boot_image (xen_hypervisor->start,
8631a2
-					  xen_hypervisor->size,
8631a2
 					  xen_hypervisor->cmdline);
8631a2
 }
8631a2
 
8631a2
diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c
8631a2
new file mode 100644
f6e916
index 000000000..c24202a5d
8631a2
--- /dev/null
8631a2
+++ b/grub-core/loader/efi/linux.c
8631a2
@@ -0,0 +1,70 @@
8631a2
+/*
8631a2
+ *  GRUB  --  GRand Unified Bootloader
8631a2
+ *  Copyright (C) 2014 Free Software Foundation, Inc.
8631a2
+ *
8631a2
+ *  GRUB is free software: you can redistribute it and/or modify
8631a2
+ *  it under the terms of the GNU General Public License as published by
8631a2
+ *  the Free Software Foundation, either version 3 of the License, or
8631a2
+ *  (at your option) any later version.
8631a2
+ *
8631a2
+ *  GRUB is distributed in the hope that it will be useful,
8631a2
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
8631a2
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
8631a2
+ *  GNU General Public License for more details.
8631a2
+ *
8631a2
+ *  You should have received a copy of the GNU General Public License
8631a2
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
8631a2
+ */
8631a2
+
8631a2
+#include <grub/err.h>
8631a2
+#include <grub/mm.h>
8631a2
+#include <grub/types.h>
8631a2
+#include <grub/cpu/linux.h>
8631a2
+#include <grub/efi/efi.h>
8631a2
+#include <grub/efi/pe32.h>
8631a2
+#include <grub/efi/linux.h>
8631a2
+
8631a2
+#define SHIM_LOCK_GUID \
8631a2
+ { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} }
8631a2
+
8631a2
+struct grub_efi_shim_lock
8631a2
+{
8631a2
+  grub_efi_status_t (*verify) (void *buffer, grub_uint32_t size);
8631a2
+};
8631a2
+typedef struct grub_efi_shim_lock grub_efi_shim_lock_t;
8631a2
+
8631a2
+grub_efi_boolean_t
8631a2
+grub_linuxefi_secure_validate (void *data, grub_uint32_t size)
8631a2
+{
8631a2
+  grub_efi_guid_t guid = SHIM_LOCK_GUID;
8631a2
+  grub_efi_shim_lock_t *shim_lock;
8631a2
+
8631a2
+  shim_lock = grub_efi_locate_protocol(&guid, NULL);
8631a2
+
8631a2
+  if (!shim_lock)
8631a2
+    return 1;
8631a2
+
8631a2
+  if (shim_lock->verify(data, size) == GRUB_EFI_SUCCESS)
8631a2
+    return 1;
8631a2
+
8631a2
+  return 0;
8631a2
+}
8631a2
+
8631a2
+#pragma GCC diagnostic push
8631a2
+#pragma GCC diagnostic ignored "-Wcast-align"
8631a2
+
8631a2
+typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *);
8631a2
+
8631a2
+grub_err_t
8631a2
+grub_efi_linux_boot (void *kernel_addr, grub_off_t offset,
8631a2
+		     void *kernel_params)
8631a2
+{
8631a2
+  handover_func hf;
8631a2
+
8631a2
+  hf = (handover_func)((char *)kernel_addr + offset);
8631a2
+  hf (grub_efi_image_handle, grub_efi_system_table, kernel_params);
8631a2
+
8631a2
+  return GRUB_ERR_BUG;
8631a2
+}
8631a2
+
8631a2
+#pragma GCC diagnostic pop
8631a2
diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
8631a2
new file mode 100644
f6e916
index 000000000..3db82e782
8631a2
--- /dev/null
8631a2
+++ b/grub-core/loader/i386/efi/linux.c
8631a2
@@ -0,0 +1,335 @@
8631a2
+/*
8631a2
+ *  GRUB  --  GRand Unified Bootloader
8631a2
+ *  Copyright (C) 2012  Free Software Foundation, Inc.
8631a2
+ *
8631a2
+ *  GRUB is free software: you can redistribute it and/or modify
8631a2
+ *  it under the terms of the GNU General Public License as published by
8631a2
+ *  the Free Software Foundation, either version 3 of the License, or
8631a2
+ *  (at your option) any later version.
8631a2
+ *
8631a2
+ *  GRUB is distributed in the hope that it will be useful,
8631a2
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
8631a2
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
8631a2
+ *  GNU General Public License for more details.
8631a2
+ *
8631a2
+ *  You should have received a copy of the GNU General Public License
8631a2
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
8631a2
+ */
8631a2
+
8631a2
+#include <grub/loader.h>
8631a2
+#include <grub/file.h>
8631a2
+#include <grub/err.h>
8631a2
+#include <grub/types.h>
8631a2
+#include <grub/mm.h>
8631a2
+#include <grub/cpu/linux.h>
8631a2
+#include <grub/command.h>
8631a2
+#include <grub/i18n.h>
8631a2
+#include <grub/lib/cmdline.h>
8631a2
+#include <grub/efi/efi.h>
8631a2
+#include <grub/efi/linux.h>
8631a2
+
8631a2
+GRUB_MOD_LICENSE ("GPLv3+");
8631a2
+
8631a2
+static grub_dl_t my_mod;
8631a2
+static int loaded;
8631a2
+static void *kernel_mem;
8631a2
+static grub_uint64_t kernel_size;
8631a2
+static grub_uint8_t *initrd_mem;
8631a2
+static grub_uint32_t handover_offset;
8631a2
+struct linux_kernel_params *params;
8631a2
+static char *linux_cmdline;
8631a2
+
8631a2
+#define BYTES_TO_PAGES(bytes)   (((bytes) + 0xfff) >> 12)
8631a2
+
8631a2
+static grub_err_t
8631a2
+grub_linuxefi_boot (void)
8631a2
+{
8631a2
+  int offset = 0;
8631a2
+
8631a2
+#ifdef __x86_64__
8631a2
+  offset = 512;
8631a2
+#endif
8631a2
+  asm volatile ("cli");
8631a2
+
8631a2
+  return grub_efi_linux_boot ((char *)kernel_mem, handover_offset + offset,
8631a2
+			      params);
8631a2
+}
8631a2
+
8631a2
+static grub_err_t
8631a2
+grub_linuxefi_unload (void)
8631a2
+{
8631a2
+  grub_dl_unref (my_mod);
8631a2
+  loaded = 0;
8631a2
+  if (initrd_mem)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem,
8631a2
+			 BYTES_TO_PAGES(params->ramdisk_size));
8631a2
+  if (linux_cmdline)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)
8631a2
+			 linux_cmdline,
8631a2
+			 BYTES_TO_PAGES(params->cmdline_size + 1));
8631a2
+  if (kernel_mem)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem,
8631a2
+			 BYTES_TO_PAGES(kernel_size));
8631a2
+  if (params)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params,
8631a2
+			 BYTES_TO_PAGES(16384));
8631a2
+  return GRUB_ERR_NONE;
8631a2
+}
8631a2
+
8631a2
+static grub_err_t
8631a2
+grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
8631a2
+                 int argc, char *argv[])
8631a2
+{
8631a2
+  grub_file_t *files = 0;
8631a2
+  int i, nfiles = 0;
8631a2
+  grub_size_t size = 0;
8631a2
+  grub_uint8_t *ptr;
8631a2
+
8631a2
+  if (argc == 0)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (!loaded)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_ARGUMENT, N_("you need to load the kernel first"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  files = grub_zalloc (argc * sizeof (files[0]));
8631a2
+  if (!files)
8631a2
+    goto fail;
8631a2
+
8631a2
+  for (i = 0; i < argc; i++)
8631a2
+    {
8631a2
+      grub_file_filter_disable_compression ();
8631a2
+      files[i] = grub_file_open (argv[i]);
8631a2
+      if (! files[i])
8631a2
+        goto fail;
8631a2
+      nfiles++;
8631a2
+      size += ALIGN_UP (grub_file_size (files[i]), 4);
8631a2
+    }
8631a2
+
8631a2
+  initrd_mem = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(size));
8631a2
+  if (!initrd_mem)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate initrd"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  params->ramdisk_size = size;
8631a2
+  params->ramdisk_image = (grub_uint32_t)(grub_addr_t) initrd_mem;
8631a2
+
8631a2
+  ptr = initrd_mem;
8631a2
+
8631a2
+  for (i = 0; i < nfiles; i++)
8631a2
+    {
8631a2
+      grub_ssize_t cursize = grub_file_size (files[i]);
8631a2
+      if (grub_file_read (files[i], ptr, cursize) != cursize)
8631a2
+        {
8631a2
+          if (!grub_errno)
8631a2
+            grub_error (GRUB_ERR_FILE_READ_ERROR, N_("premature end of file %s"),
8631a2
+                        argv[i]);
8631a2
+          goto fail;
8631a2
+        }
8631a2
+      ptr += cursize;
8631a2
+      grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
8631a2
+      ptr += ALIGN_UP_OVERHEAD (cursize, 4);
8631a2
+    }
8631a2
+
8631a2
+  params->ramdisk_size = size;
8631a2
+
8631a2
+ fail:
8631a2
+  for (i = 0; i < nfiles; i++)
8631a2
+    grub_file_close (files[i]);
8631a2
+  grub_free (files);
8631a2
+
8631a2
+  if (initrd_mem && grub_errno)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem,
8631a2
+			 BYTES_TO_PAGES(size));
8631a2
+
8631a2
+  return grub_errno;
8631a2
+}
8631a2
+
8631a2
+static grub_err_t
8631a2
+grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
8631a2
+		int argc, char *argv[])
8631a2
+{
8631a2
+  grub_file_t file = 0;
8631a2
+  struct linux_kernel_header lh;
8631a2
+  grub_ssize_t len, start, filelen;
8631a2
+  void *kernel = NULL;
8631a2
+
8631a2
+  grub_dl_ref (my_mod);
8631a2
+
8631a2
+  if (argc == 0)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  file = grub_file_open (argv[0]);
8631a2
+  if (! file)
8631a2
+    goto fail;
8631a2
+
8631a2
+  filelen = grub_file_size (file);
8631a2
+
8631a2
+  kernel = grub_malloc(filelen);
8631a2
+
8631a2
+  if (!kernel)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel buffer"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (grub_file_read (file, kernel, filelen) != filelen)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), argv[0]);
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (! grub_linuxefi_secure_validate (kernel, filelen))
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"),
8631a2
+		  argv[0]);
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  params = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(16384));
8631a2
+
8631a2
+  if (! params)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate kernel parameters");
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  grub_memset (params, 0, 16384);
8631a2
+
8631a2
+  grub_memcpy (&lh, kernel, sizeof (lh));
8631a2
+
8631a2
+  if (lh.boot_flag != grub_cpu_to_le16 (0xaa55))
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_OS, N_("invalid magic number"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (lh.setup_sects > GRUB_LINUX_MAX_SETUP_SECTS)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_OS, N_("too many setup sectors"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (lh.version < grub_cpu_to_le16 (0x020b))
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_OS, N_("kernel too old"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  if (!lh.handover_offset)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_BAD_OS, N_("kernel doesn't support EFI handover"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  grub_dprintf ("linux", "setting up cmdline\n");
8631a2
+  linux_cmdline = grub_efi_allocate_pages_max(0x3fffffff,
8631a2
+					 BYTES_TO_PAGES(lh.cmdline_size + 1));
8631a2
+
8631a2
+  if (!linux_cmdline)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate cmdline"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE));
8631a2
+  grub_create_loader_cmdline (argc, argv,
8631a2
+                              linux_cmdline + sizeof (LINUX_IMAGE) - 1,
8631a2
+			      lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1));
8631a2
+
8631a2
+  lh.cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline;
8631a2
+
8631a2
+  handover_offset = lh.handover_offset;
8631a2
+
8631a2
+  start = (lh.setup_sects + 1) * 512;
8631a2
+  len = grub_file_size(file) - start;
8631a2
+
8631a2
+  kernel_mem = grub_efi_allocate_pages_max(lh.pref_address,
8631a2
+					   BYTES_TO_PAGES(lh.init_size));
8631a2
+
8631a2
+  if (!kernel_mem)
8631a2
+    kernel_mem = grub_efi_allocate_pages_max(0x3fffffff,
8631a2
+					     BYTES_TO_PAGES(lh.init_size));
8631a2
+
8631a2
+  if (!kernel_mem)
8631a2
+    {
8631a2
+      grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate kernel"));
8631a2
+      goto fail;
8631a2
+    }
8631a2
+
8631a2
+  grub_memcpy (kernel_mem, (char *)kernel + start, len);
8631a2
+  grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0);
8631a2
+  loaded=1;
8631a2
+
8631a2
+  lh.code32_start = (grub_uint32_t)(grub_uint64_t) kernel_mem;
8631a2
+  grub_memcpy (params, &lh, 2 * 512);
8631a2
+
8631a2
+  params->type_of_loader = 0x21;
8631a2
+
8631a2
+ fail:
8631a2
+
8631a2
+  if (file)
8631a2
+    grub_file_close (file);
8631a2
+
8631a2
+  if (kernel)
8631a2
+    grub_free (kernel);
8631a2
+
8631a2
+  if (grub_errno != GRUB_ERR_NONE)
8631a2
+    {
8631a2
+      grub_dl_unref (my_mod);
8631a2
+      loaded = 0;
8631a2
+    }
8631a2
+
8631a2
+  if (linux_cmdline && !loaded)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)
8631a2
+			 linux_cmdline,
8631a2
+			 BYTES_TO_PAGES(lh.cmdline_size + 1));
8631a2
+
8631a2
+  if (kernel_mem && !loaded)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem,
8631a2
+			 BYTES_TO_PAGES(kernel_size));
8631a2
+
8631a2
+  if (params && !loaded)
8631a2
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params,
8631a2
+			 BYTES_TO_PAGES(16384));
8631a2
+
8631a2
+  return grub_errno;
8631a2
+}
8631a2
+
8631a2
+static grub_command_t cmd_linux, cmd_initrd;
8631a2
+static grub_command_t cmd_linuxefi, cmd_initrdefi;
8631a2
+
8631a2
+GRUB_MOD_INIT(linux)
8631a2
+{
8631a2
+  cmd_linux =
8631a2
+    grub_register_command ("linux", grub_cmd_linux,
8631a2
+                           0, N_("Load Linux."));
8631a2
+  cmd_linuxefi =
8631a2
+    grub_register_command ("linuxefi", grub_cmd_linux,
8631a2
+                           0, N_("Load Linux."));
8631a2
+  cmd_initrd =
8631a2
+    grub_register_command ("initrd", grub_cmd_initrd,
8631a2
+                           0, N_("Load initrd."));
8631a2
+  cmd_initrdefi =
8631a2
+    grub_register_command ("initrdefi", grub_cmd_initrd,
8631a2
+                           0, N_("Load initrd."));
8631a2
+  my_mod = mod;
8631a2
+}
8631a2
+
8631a2
+GRUB_MOD_FINI(linux)
8631a2
+{
8631a2
+  grub_unregister_command (cmd_linux);
8631a2
+  grub_unregister_command (cmd_linuxefi);
8631a2
+  grub_unregister_command (cmd_initrd);
8631a2
+  grub_unregister_command (cmd_initrdefi);
8631a2
+}
8631a2
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
f6e916
index b69cb7a3a..a3c87cf2f 100644
8631a2
--- a/grub-core/loader/i386/pc/linux.c
8631a2
+++ b/grub-core/loader/i386/pc/linux.c
8631a2
@@ -468,14 +468,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
8631a2
   return grub_errno;
8631a2
 }
8631a2
 
8631a2
-static grub_command_t cmd_linux, cmd_initrd;
8631a2
+static grub_command_t cmd_linux, cmd_linux16, cmd_initrd, cmd_initrd16;
8631a2
 
8631a2
 GRUB_MOD_INIT(linux16)
8631a2
 {
8631a2
   cmd_linux =
8631a2
+    grub_register_command ("linux", grub_cmd_linux,
8631a2
+			   0, N_("Load Linux."));
8631a2
+  cmd_linux16 =
8631a2
     grub_register_command ("linux16", grub_cmd_linux,
8631a2
 			   0, N_("Load Linux."));
8631a2
   cmd_initrd =
8631a2
+    grub_register_command ("initrd", grub_cmd_initrd,
8631a2
+			   0, N_("Load initrd."));
8631a2
+  cmd_initrd16 =
8631a2
     grub_register_command ("initrd16", grub_cmd_initrd,
8631a2
 			   0, N_("Load initrd."));
8631a2
   my_mod = mod;
8631a2
@@ -484,5 +490,7 @@ GRUB_MOD_INIT(linux16)
8631a2
 GRUB_MOD_FINI(linux16)
8631a2
 {
8631a2
   grub_unregister_command (cmd_linux);
8631a2
+  grub_unregister_command (cmd_linux16);
8631a2
   grub_unregister_command (cmd_initrd);
8631a2
+  grub_unregister_command (cmd_initrd16);
8631a2
 }
8631a2
diff --git a/include/grub/arm/linux.h b/include/grub/arm/linux.h
f6e916
index 712ba17b9..5900fc8a4 100644
8631a2
--- a/include/grub/arm/linux.h
8631a2
+++ b/include/grub/arm/linux.h
8631a2
@@ -20,6 +20,7 @@
8631a2
 #ifndef GRUB_ARM_LINUX_HEADER
8631a2
 #define GRUB_ARM_LINUX_HEADER 1
8631a2
 
8631a2
+#include <grub/efi/pe32.h>
8631a2
 #include "system.h"
8631a2
 
8631a2
 #define GRUB_LINUX_ARM_MAGIC_SIGNATURE 0x016f2818
8631a2
@@ -34,9 +35,17 @@ struct linux_arm_kernel_header {
8631a2
   grub_uint32_t hdr_offset;
8631a2
 };
8631a2
 
8631a2
+struct grub_arm_linux_pe_header
8631a2
+{
8631a2
+  grub_uint32_t magic;
8631a2
+  struct grub_pe32_coff_header coff;
8631a2
+  struct grub_pe32_optional_header opt;
8631a2
+};
8631a2
+
8631a2
 #if defined(__arm__)
8631a2
 # define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM_MAGIC_SIGNATURE
8631a2
 # define linux_armxx_kernel_header linux_arm_kernel_header
8631a2
+# define grub_armxx_linux_pe_header grub_arm_linux_pe_header
8631a2
 #endif
8631a2
 
8631a2
 #if defined GRUB_MACHINE_UBOOT
8631a2
diff --git a/include/grub/arm64/linux.h b/include/grub/arm64/linux.h
f6e916
index 8655067e0..7b533b571 100644
8631a2
--- a/include/grub/arm64/linux.h
8631a2
+++ b/include/grub/arm64/linux.h
8631a2
@@ -19,6 +19,8 @@
8631a2
 #ifndef GRUB_ARM64_LINUX_HEADER
8631a2
 #define GRUB_ARM64_LINUX_HEADER 1
8631a2
 
8631a2
+#include <grub/efi/pe32.h>
8631a2
+
8631a2
 #define GRUB_LINUX_ARM64_MAGIC_SIGNATURE 0x644d5241 /* 'ARM\x64' */
8631a2
 
8631a2
 /* From linux/Documentation/arm64/booting.txt */
8631a2
@@ -36,9 +38,17 @@ struct linux_arm64_kernel_header
8631a2
   grub_uint32_t hdr_offset;	/* Offset of PE/COFF header */
8631a2
 };
8631a2
 
8631a2
+struct grub_arm64_linux_pe_header
8631a2
+{
8631a2
+  grub_uint32_t magic;
8631a2
+  struct grub_pe32_coff_header coff;
8631a2
+  struct grub_pe64_optional_header opt;
8631a2
+};
8631a2
+
8631a2
 #if defined(__aarch64__)
8631a2
 # define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM64_MAGIC_SIGNATURE
8631a2
 # define linux_armxx_kernel_header linux_arm64_kernel_header
8631a2
+# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header
8631a2
 #endif
8631a2
 
8631a2
 #endif /* ! GRUB_ARM64_LINUX_HEADER */
8631a2
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
f6e916
index 2c6648d46..1061aee97 100644
8631a2
--- a/include/grub/efi/efi.h
8631a2
+++ b/include/grub/efi/efi.h
8631a2
@@ -47,6 +47,9 @@ EXPORT_FUNC(grub_efi_allocate_fixed) (grub_efi_physical_address_t address,
8631a2
 				      grub_efi_uintn_t pages);
8631a2
 void *
8631a2
 EXPORT_FUNC(grub_efi_allocate_any_pages) (grub_efi_uintn_t pages);
8631a2
+void *
8631a2
+EXPORT_FUNC(grub_efi_allocate_pages_max) (grub_efi_physical_address_t max,
8631a2
+					  grub_efi_uintn_t pages);
8631a2
 void EXPORT_FUNC(grub_efi_free_pages) (grub_efi_physical_address_t address,
8631a2
 				       grub_efi_uintn_t pages);
8631a2
 grub_efi_uintn_t EXPORT_FUNC(grub_efi_find_mmap_size) (void);
8631a2
@@ -82,6 +85,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
8631a2
 				     const grub_efi_guid_t *guid,
8631a2
 				     void *data,
8631a2
 				     grub_size_t datasize);
8631a2
+grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void);
8631a2
 int
8631a2
 EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
8631a2
 					     const grub_efi_device_path_t *dp2);
8631a2
@@ -95,8 +99,7 @@ void *EXPORT_FUNC(grub_efi_get_firmware_fdt)(void);
8631a2
 grub_err_t EXPORT_FUNC(grub_efi_get_ram_base)(grub_addr_t *);
8631a2
 #include <grub/cpu/linux.h>
8631a2
 grub_err_t grub_armxx_efi_linux_check_image(struct linux_armxx_kernel_header *lh);
8631a2
-grub_err_t grub_armxx_efi_linux_boot_image(grub_addr_t addr, grub_size_t size,
8631a2
-                                           char *args);
8631a2
+grub_err_t grub_armxx_efi_linux_boot_image(grub_addr_t addr, char *args);
8631a2
 #endif
8631a2
 
8631a2
 grub_addr_t grub_efi_modules_addr (void);
8631a2
diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h
8631a2
new file mode 100644
f6e916
index 000000000..d9ede3677
8631a2
--- /dev/null
8631a2
+++ b/include/grub/efi/linux.h
8631a2
@@ -0,0 +1,31 @@
8631a2
+/*
8631a2
+ *  GRUB  --  GRand Unified Bootloader
8631a2
+ *  Copyright (C) 2014  Free Software Foundation, Inc.
8631a2
+ *
8631a2
+ *  GRUB is free software: you can redistribute it and/or modify
8631a2
+ *  it under the terms of the GNU General Public License as published by
8631a2
+ *  the Free Software Foundation, either version 3 of the License, or
8631a2
+ *  (at your option) any later version.
8631a2
+ *
8631a2
+ *  GRUB is distributed in the hope that it will be useful,
8631a2
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
8631a2
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
8631a2
+ *  GNU General Public License for more details.
8631a2
+ *
8631a2
+ *  You should have received a copy of the GNU General Public License
8631a2
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
8631a2
+ */
8631a2
+#ifndef GRUB_EFI_LINUX_HEADER
8631a2
+#define GRUB_EFI_LINUX_HEADER	1
8631a2
+
8631a2
+#include <grub/efi/api.h>
8631a2
+#include <grub/err.h>
8631a2
+#include <grub/symbol.h>
8631a2
+
8631a2
+grub_efi_boolean_t
8631a2
+EXPORT_FUNC(grub_linuxefi_secure_validate) (void *data, grub_uint32_t size);
8631a2
+grub_err_t
8631a2
+EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset,
8631a2
+				  void *kernel_param);
8631a2
+
8631a2
+#endif /* ! GRUB_EFI_LINUX_HEADER */
8631a2
diff --git a/include/grub/i386/linux.h b/include/grub/i386/linux.h
f6e916
index 60c7c3b5e..bb19dbd5a 100644
8631a2
--- a/include/grub/i386/linux.h
8631a2
+++ b/include/grub/i386/linux.h
8631a2
@@ -142,6 +142,7 @@ struct linux_i386_kernel_header
8631a2
   grub_uint64_t setup_data;
8631a2
   grub_uint64_t pref_address;
8631a2
   grub_uint32_t init_size;
8631a2
+  grub_uint32_t handover_offset;
8631a2
 } GRUB_PACKED;
8631a2
 
8631a2
 /* Boot parameters for Linux based on 2.6.12. This is used by the setup