mirror of
https://github.com/projectacrn/acrn-hypervisor.git
synced 2025-06-21 21:19:35 +00:00
doc: terminology cleanup in secure boot GRUB
- Replace UOS or User OS with User VM - Replace SOS or Service OS with Service VM - Clean up some of the grammar Signed-off-by: Amy Reyes <amy.reyes@intel.com>
This commit is contained in:
parent
7ffa2a4a5f
commit
8cbadb488f
@ -5,16 +5,16 @@ Enable ACRN Secure Boot With GRUB
|
|||||||
|
|
||||||
This document shows how to enable ACRN secure boot with GRUB including:
|
This document shows how to enable ACRN secure boot with GRUB including:
|
||||||
|
|
||||||
- ACRN Secure Boot Sequence
|
- `ACRN Secure Boot Sequence`_
|
||||||
- Generate GPG Key
|
- `Generate GPG Key`_
|
||||||
- Setup Standalone GRUB EFI Binary
|
- `Setup Standalone GRUB EFI Binary`_
|
||||||
- Enable UEFI Secure Boot
|
- `Enable UEFI Secure Boot`_
|
||||||
|
|
||||||
**Validation Environment:**
|
**Validation Environment:**
|
||||||
|
|
||||||
- Hardware Platform: TGL-I7, Supported hardware described in
|
- Hardware Platform: Tiger Lake, supported hardware described in
|
||||||
:ref:`hardware`.
|
:ref:`hardware`.
|
||||||
- ACRN Scenario: Industry
|
- ACRN Scenario: Shared
|
||||||
- Service VM: Yocto & Ubuntu
|
- Service VM: Yocto & Ubuntu
|
||||||
- GRUB: 2.04
|
- GRUB: 2.04
|
||||||
|
|
||||||
@ -25,7 +25,7 @@ This document shows how to enable ACRN secure boot with GRUB including:
|
|||||||
ACRN Secure Boot Sequence
|
ACRN Secure Boot Sequence
|
||||||
*************************
|
*************************
|
||||||
|
|
||||||
ACRN can be booted by Multiboot compatible bootloader, following diagram
|
ACRN can be booted by a multiboot compatible bootloader. The following diagram
|
||||||
illustrates the boot sequence of ACRN with GRUB:
|
illustrates the boot sequence of ACRN with GRUB:
|
||||||
|
|
||||||
.. image:: images/acrn_secureboot_flow.png
|
.. image:: images/acrn_secureboot_flow.png
|
||||||
@ -41,10 +41,10 @@ From a secureboot point of view:
|
|||||||
- GRUB verifies ACRN, Service VM kernel, and pre-launched User VM kernel
|
- GRUB verifies ACRN, Service VM kernel, and pre-launched User VM kernel
|
||||||
- Service VM OS kernel verifies the Device Model (``acrn-dm``) and User
|
- Service VM OS kernel verifies the Device Model (``acrn-dm``) and User
|
||||||
VM OVMF bootloader (with the help of ``acrn-dm``)
|
VM OVMF bootloader (with the help of ``acrn-dm``)
|
||||||
- User VM virtual bootloader (e.g. OVMF) starts the guest side verified boot process
|
- User VM virtual bootloader (e.g., OVMF) starts the guest side verified boot process
|
||||||
|
|
||||||
This document shows you how to enable GRUB to
|
This document shows you how to enable GRUB to
|
||||||
verify ACRN binaries such ``acrn.bin``, Service VM kernel (``bzImage``), and
|
verify ACRN binaries such as ``acrn.bin``, Service VM kernel (``bzImage``), and
|
||||||
if present, a pre-launched User VM kernel image.
|
if present, a pre-launched User VM kernel image.
|
||||||
|
|
||||||
.. rst-class:: numbered-step
|
.. rst-class:: numbered-step
|
||||||
@ -185,9 +185,9 @@ For example::
|
|||||||
|
|
||||||
Use the output of the :command:`blkid` to find the right values for the
|
Use the output of the :command:`blkid` to find the right values for the
|
||||||
UUID (``--set``) and PARTUUID (``root=PARTUUID=`` parameter) of the root
|
UUID (``--set``) and PARTUUID (``root=PARTUUID=`` parameter) of the root
|
||||||
partition (e.g. `/dev/nvme0n1p2`) according to your your hardware.
|
partition (e.g., ``/dev/nvme0n1p2``) according to your hardware.
|
||||||
|
|
||||||
Copy this new :file:`grub.cfg` to your ESP (e.g. `/boot/efi/EFI/`).
|
Copy this new :file:`grub.cfg` to your ESP (e.g., ``/boot/efi/EFI/``).
|
||||||
|
|
||||||
|
|
||||||
Sign grub.cfg and ACRN Binaries
|
Sign grub.cfg and ACRN Binaries
|
||||||
@ -196,11 +196,11 @@ Sign grub.cfg and ACRN Binaries
|
|||||||
The :file:`grub.cfg` and all ACRN binaries that will be loaded by GRUB
|
The :file:`grub.cfg` and all ACRN binaries that will be loaded by GRUB
|
||||||
**must** be signed with the same GPG key.
|
**must** be signed with the same GPG key.
|
||||||
|
|
||||||
Here's sequence example of signing the individual binaries::
|
Here's a sequence example of signing the individual binaries::
|
||||||
|
|
||||||
gpg --homedir keys --detach-sign path/to/grub.cfg
|
gpg --homedir keys --detach-sign path/to/grub.cfg
|
||||||
gpg --homedir keys --detach-sign path/to/acrn.bin
|
gpg --homedir keys --detach-sign path/to/acrn.bin
|
||||||
gpg --homedir keys --detach-sign path/to/sos_kernel/bzImage
|
gpg --homedir keys --detach-sign path/to/service_vm_kernel/bzImage
|
||||||
|
|
||||||
Now, you can reboot and the system will boot with the signed GRUB EFI binary.
|
Now, you can reboot and the system will boot with the signed GRUB EFI binary.
|
||||||
GRUB will refuse to boot if any files it attempts to load have been tampered
|
GRUB will refuse to boot if any files it attempts to load have been tampered
|
||||||
@ -246,6 +246,8 @@ The keys to sign bootloader image: :file:`grubx64.efi`, :file:`db.key` , :file:`
|
|||||||
Sign GRUB Image With db Key
|
Sign GRUB Image With db Key
|
||||||
===========================
|
===========================
|
||||||
|
|
||||||
|
Command example::
|
||||||
|
|
||||||
sbsign --key db.key --cert db.crt path/to/grubx64.efi
|
sbsign --key db.key --cert db.crt path/to/grubx64.efi
|
||||||
|
|
||||||
:file:`grubx64.efi.signed` will be created, it will be your bootloader.
|
:file:`grubx64.efi.signed` will be created, it will be your bootloader.
|
||||||
|
Binary file not shown.
Before Width: | Height: | Size: 10 KiB After Width: | Height: | Size: 12 KiB |
Loading…
Reference in New Issue
Block a user