From: Frediano Ziglio <frediano.ziglio@cloud.com>
To: xen-devel@lists.xenproject.org
Cc: "Frediano Ziglio" <frediano.ziglio@cloud.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Anthony PERARD" <anthony.perard@vates.tech>,
"Michal Orzel" <michal.orzel@amd.com>,
"Jan Beulich" <jbeulich@suse.com>,
"Julien Grall" <julien@xen.org>,
"Roger Pau Monné" <roger.pau@citrix.com>,
"Stefano Stabellini" <sstabellini@kernel.org>,
"Bertrand Marquis" <bertrand.marquis@arm.com>,
"Volodymyr Babchuk" <Volodymyr_Babchuk@epam.com>
Subject: [PATCH 0/4] Allows Secure Boot for Kexec
Date: Tue, 6 May 2025 14:56:49 +0100 [thread overview]
Message-ID: <20250506135655.187014-1-frediano.ziglio@cloud.com> (raw)
Using EFI Secure Boot all kernel level code should be signed and
there should be no way to run unchecked code.
For this reason the Kexec interface needs to be changed in order
to allows signature checking.
The purgatory code is included in Xen itself as passing this code
from userspace it's not secure (see patches 2/4 and 3/4).
Ross Lagerwall (4):
xen/lib: Export additional sha256 functions
kexec: Include purgatory in Xen
kexec: Implement new EFI load types
kexec: Support non-page-aligned kexec segments
xen/arch/arm/Makefile | 1 +
xen/arch/arm/kexec.c | 27 +
xen/arch/x86/Makefile | 2 +
xen/arch/x86/bzimage.c | 40 +-
xen/arch/x86/kexec.c | 125 +++++
xen/arch/x86/purgatory/.gitignore | 3 +
xen/arch/x86/purgatory/Makefile | 64 +++
xen/arch/x86/purgatory/config.h | 37 ++
xen/arch/x86/purgatory/entry64.S | 108 ++++
xen/arch/x86/purgatory/purgatory.c | 59 +++
xen/arch/x86/purgatory/setup-x86_64.S | 63 +++
xen/arch/x86/purgatory/stack.S | 21 +
xen/common/Kconfig | 1 +
xen/common/kexec.c | 33 +-
xen/common/kimage.c | 703 ++++++++++++++++++++++++--
xen/include/public/kexec.h | 23 +-
xen/include/xen/kimage.h | 57 ++-
xen/include/xen/sha2.h | 10 +
xen/include/xen/x86-linux.h | 62 +++
xen/lib/sha2-256.c | 16 +-
20 files changed, 1344 insertions(+), 111 deletions(-)
create mode 100644 xen/arch/arm/kexec.c
create mode 100644 xen/arch/x86/kexec.c
create mode 100644 xen/arch/x86/purgatory/.gitignore
create mode 100644 xen/arch/x86/purgatory/Makefile
create mode 100644 xen/arch/x86/purgatory/config.h
create mode 100644 xen/arch/x86/purgatory/entry64.S
create mode 100644 xen/arch/x86/purgatory/purgatory.c
create mode 100644 xen/arch/x86/purgatory/setup-x86_64.S
create mode 100644 xen/arch/x86/purgatory/stack.S
create mode 100644 xen/include/xen/x86-linux.h
--
2.43.0
next reply other threads:[~2025-05-06 13:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-06 13:56 Frediano Ziglio [this message]
2025-05-06 13:56 ` [PATCH 1/4] xen/lib: Export additional sha256 functions Frediano Ziglio
2025-05-06 14:05 ` Andrew Cooper
2025-05-06 22:17 ` Andrew Cooper
2025-05-07 5:26 ` Frediano Ziglio
2025-05-07 6:17 ` Andrew Cooper
2025-05-12 10:30 ` Jan Beulich
2025-05-06 13:56 ` [PATCH 4/4] kexec: Support non-page-aligned kexec segments Frediano Ziglio
2025-05-06 14:11 ` [PATCH 0/4] Allows Secure Boot for Kexec Andrii Sultanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250506135655.187014-1-frediano.ziglio@cloud.com \
--to=frediano.ziglio@cloud.com \
--cc=Volodymyr_Babchuk@epam.com \
--cc=andrew.cooper3@citrix.com \
--cc=anthony.perard@vates.tech \
--cc=bertrand.marquis@arm.com \
--cc=jbeulich@suse.com \
--cc=julien@xen.org \
--cc=michal.orzel@amd.com \
--cc=roger.pau@citrix.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.