File 0009-powerpc_ieee1275-Enter-lockdown-based-on-ibm-secure-.patch of Package grub2
From 003b2772f36f3a6025d405e48f7d61bf6d43ee58 Mon Sep 17 00:00:00 2001
From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Date: Mon, 25 Aug 2025 16:38:31 +0530
Subject: [PATCH 09/18] powerpc_ieee1275: Enter lockdown based on /ibm,
secure-boot
Read secure boot mode from 'ibm,secure-boot' property and if
the secure boot mode is enforced, enter lockdown. Else it is
considered as disabled. There are three secure boot modes.
They are
0 - disabled
No signature verification is performed. This is the default.
1 - audit
Signature verification is performed and if signature verification
fails, post the errors and allow the boot to continue.
2 - enforced
Lockdown the GRUB. Signature verification is performed and
If signature verification fails, post the errors and stop the boot.
Now, only support disabled and enforced.
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
docs/grub.texi | 2 +-
grub-core/Makefile.core.def | 1 +
grub-core/kern/ieee1275/init.c | 56 ++++++++++++++++++++++++++++++++++
include/grub/lockdown.h | 3 +-
4 files changed, 60 insertions(+), 2 deletions(-)
Index: grub-2.12/docs/grub.texi
===================================================================
--- grub-2.12.orig/docs/grub.texi
+++ grub-2.12/docs/grub.texi
@@ -6677,7 +6677,7 @@ platforms.
@section Lockdown when booting on a secure setup
The GRUB can be locked down when booted on a secure boot environment, for example
-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will
+if the UEFI or PowerPC secure boot is enabled. On a locked down configuration, the GRUB will
be restricted and some operations/commands cannot be executed.
The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
Index: grub-2.12/grub-core/Makefile.core.def
===================================================================
--- grub-2.12.orig/grub-core/Makefile.core.def
+++ grub-2.12/grub-core/Makefile.core.def
@@ -331,6 +331,7 @@ kernel = {
powerpc_ieee1275 = kern/powerpc/cache.S;
powerpc_ieee1275 = kern/powerpc/dl.c;
powerpc_ieee1275 = kern/powerpc/compiler-rt.S;
+ powerpc_ieee1275 = kern/lockdown.c;
sparc64_ieee1275 = kern/sparc64/cache.S;
sparc64_ieee1275 = kern/sparc64/dl.c;
Index: grub-2.12/grub-core/kern/ieee1275/init.c
===================================================================
--- grub-2.12.orig/grub-core/kern/ieee1275/init.c
+++ grub-2.12/grub-core/kern/ieee1275/init.c
@@ -49,6 +49,14 @@
#if defined(__powerpc__) || defined(__i386__)
#include <grub/ieee1275/alloc.h>
#endif
+#if defined(__powerpc__)
+#include <grub/lockdown.h>
+#endif
+
+#ifdef __powerpc__
+#define GRUB_SB_DISABLED ((grub_uint32_t) 0)
+#define GRUB_SB_ENFORCED ((grub_uint32_t) 2)
+#endif
/* The maximum heap size we're going to claim at boot. Not used by sparc. */
#ifdef __i386__
@@ -979,6 +987,50 @@ grub_parse_cmdline (void)
}
}
+#ifdef __powerpc__
+static void
+grub_ieee1275_get_secure_boot (void)
+{
+ grub_ieee1275_phandle_t root;
+ grub_uint32_t sb_mode = GRUB_SB_DISABLED;
+ int rc;
+
+ rc = grub_ieee1275_finddevice ("/", &root);
+ if (rc != 0)
+ {
+ grub_error (GRUB_ERR_UNKNOWN_DEVICE, "couldn't find / node");
+ return;
+ }
+
+ rc = grub_ieee1275_get_integer_property (root, "ibm,secure-boot", &sb_mode, sizeof (sb_mode), 0);
+ if (rc != 0)
+ {
+ grub_error (GRUB_ERR_UNKNOWN_DEVICE, "couldn't examine /ibm,secure-boot property");
+ return;
+ }
+ /*
+ * Secure Boot Mode:
+ * 0 - disabled
+ * No signature verification is performed. This is the default.
+ * 1 - audit
+ * Signature verification is performed and if signature verification fails,
+ * post the errors and allow the boot to continue.
+ * 2 - enforced
+ * Lockdown the GRUB. Signature verification is performed and If signature verification fails,
+ * post the errors and stop the boot.
+ *
+ * Now, only support disabled and enforced.
+ */
+ if (sb_mode == GRUB_SB_ENFORCED)
+ {
+ grub_dprintf ("ieee1275", "Secure Boot Enabled\n");
+ grub_lockdown ();
+ }
+ else
+ grub_dprintf ("ieee1275", "Secure Boot Disabled\n");
+}
+#endif /* __powerpc__ */
+
grub_addr_t grub_modbase;
void
@@ -1004,6 +1056,10 @@ grub_machine_init (void)
#else
grub_install_get_time_ms (grub_rtc_get_time_ms);
#endif
+
+#ifdef __powerpc__
+ grub_ieee1275_get_secure_boot ();
+#endif
}
void
Index: grub-2.12/include/grub/lockdown.h
===================================================================
--- grub-2.12.orig/include/grub/lockdown.h
+++ grub-2.12/include/grub/lockdown.h
@@ -24,7 +24,8 @@
#define GRUB_LOCKDOWN_DISABLED 0
#define GRUB_LOCKDOWN_ENABLED 1
-#ifdef GRUB_MACHINE_EFI
+#if defined(GRUB_MACHINE_EFI) || \
+ (defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275))
extern void
EXPORT_FUNC (grub_lockdown) (void);
extern int
