[PATCH v8 0/4] Various patches to improve Secure Boot support

[PATCH v8 0/4] Various patches to improve Secure Boot support

[Frediano Ziglio]

These patches improve support for Secure boot.
UEFI CA memory mitigation requires memory pages to be not executable and
writable at the same time. So changing permissions and splitting some section
is required.
Remove multiboot pieces from EFI executable.

Changes since v1:
- improved some comments;
- merged 2 pacthes removing multiboot support in x86 PE;
- removed a patch dealing with SBAT;
- other minor changes (see single patches).

Changes since v2:
- improved some comments.

Changes since v3:
- Added Acked-by;
- Improve commit message.

Changes since v4:
- Messages updates;
- Clean some dependencies cause by code removal;
- Add small commit to remove a possibly unused string.

Changes since v5:
- removed merged commit;
- remove more code/data from xen.efi output.

Changes since v6:
- fix commit message.

Changes since v7:
- added Acked-by, all commit are now acked.

Frediano Ziglio (2):
  Align relevant sections to 4KB
  x86: Split .init section to satisfy UEFI CA memory mitigation

Roger Pau Monné (2):
  x86/efi: discard multiboot and PVH support for PE binary
  x86/efi: avoid a relocation in efi_arch_post_exit_boot()

 docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
 xen/arch/x86/boot/head.S                    |  8 +++----
 xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
 xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
 xen/tools/combine_two_binaries.py           |  2 +-
 5 files changed, 25 insertions(+), 23 deletions(-)

-- 
2.43.0

[PATCH v8 1/4] Align relevant sections to 4KB

[Frediano Ziglio]

Required by UEFI CA memory mitigation.

It is a requirement for NX_COMPAT so the PE can be loaded with W^X perms
in the pagetables.

NX_COMPAT is a requirement from shim-review,
https://github.com/rhboot/shim-review#do-you-have-the-nx-bit-set-in-your-shim-if-so-is-your-entire-boot-stack-nx-compatible-and-what-testing-have-you-done-to-ensure-such-compatibility

Sections with different permissions must be in separate pages.
In the case of debug sections they are contiguous and have the same
permissions, including the immediately preceding .reloc section, so it's
not an issue if they are not aligned to the page.
Before the .debug sections you could have the .reloc or the SBAT section,
either are permission-compatible.

Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes since v1:
- Change subject.

Changes since v2:
- Improved commit message and subject.

Changes since v3:
- Added Acked-by;
- Improved commit message.

Changes since v4:
- Added missing comment;
- Added Acked-by.
---
 xen/arch/x86/xen.lds.S | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S
index b9e888e596..8e63cf5bc2 100644
--- a/xen/arch/x86/xen.lds.S
+++ b/xen/arch/x86/xen.lds.S
@@ -162,8 +162,8 @@ SECTIONS
        __note_gnu_build_id_end = .;
   } PHDR(note) PHDR(text)
 #elif defined(BUILD_ID_EFI)
-  /* Workaround bug in binutils < 2.36 */
-  . = ALIGN(32);
+  /* Align to satisfy UEFI CA memory mitigation. */
+  . = ALIGN(PAGE_SIZE);
   DECL_SECTION(.buildid) {
        __note_gnu_build_id_start = .;
        *(.buildid)
@@ -330,6 +330,8 @@ SECTIONS
   __2M_rwdata_end = ALIGN(SECTION_ALIGN);
 
 #ifdef EFI
+  /* Align to satisfy UEFI CA memory mitigation. */
+  . = ALIGN(PAGE_SIZE);
   .reloc ALIGN(4) : {
     __base_relocs_start = .;
     *(.reloc)
-- 
2.43.0

[PATCH v8 2/4] x86/efi: discard multiboot and PVH support for PE binary

[Frediano Ziglio]

From: Roger Pau Monné <roger.pau@citrix.com>

Multiboot and PVH booting are not supported for PE, hence discards them
in the linker script when doing a PE build.

That removes some relocations that otherwise appear due to the usage of the
start and __efi64_mb2_start symbols in the multiboot2 header.

Section discarding is not done updating DISCARD_SECTIONS definition as the
change is specific for x86.

No functional change intended.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes since v1:
- improve commit message;
- change section orders to avoid changing code order in final executable;
- merge 2 commits;
- removed deprecated documentation section.

Changes since v2:
- Update commit message, join 2 sentences together.

Changes since v3:
- Added Acked-by.

Changes since v4:
- more clear subject;
- removed more code/data from EFI output;
- removed Acked-by.

Changes since v5:
- simplify section exclusion using more wildcard;
- exclude more multiboot functions.

Changes since v7:
- added Reviewed-by.

Changes since v8:
- added Acked-by.
---
 docs/hypervisor-guide/x86/how-xen-boots.rst | 6 ------
 xen/arch/x86/boot/head.S                    | 8 ++++----
 xen/arch/x86/xen.lds.S                      | 7 +++++++
 xen/tools/combine_two_binaries.py           | 2 +-
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/docs/hypervisor-guide/x86/how-xen-boots.rst b/docs/hypervisor-guide/x86/how-xen-boots.rst
index 8b3229005c..b6d852050a 100644
--- a/docs/hypervisor-guide/x86/how-xen-boots.rst
+++ b/docs/hypervisor-guide/x86/how-xen-boots.rst
@@ -82,12 +82,6 @@ When a PEI-capable toolchain is found, the objects are linked together and a
 PE32+ binary is created.  It can be run directly from the EFI shell, and has
 ``efi_start`` as its entry symbol.
 
-.. note::
-
-   xen.efi does contain all MB1/MB2/PVH tags included in the rest of the
-   build.  However, entry via anything other than the EFI64 protocol is
-   unsupported, and won't work.
-
 
 Boot
 ----
diff --git a/xen/arch/x86/boot/head.S b/xen/arch/x86/boot/head.S
index 68b963ce6f..981f262b5e 100644
--- a/xen/arch/x86/boot/head.S
+++ b/xen/arch/x86/boot/head.S
@@ -126,7 +126,7 @@ multiboot2_header:
         .size multiboot2_header, . - multiboot2_header
         .type multiboot2_header, @object
 
-        .section .init.rodata, "a", @progbits
+        .section .init.rodata.multiboot, "a", @progbits
 
 .Lbad_cpu_msg: .asciz "ERR: Not a 64-bit CPU!"
 .Lbad_ldr_msg: .asciz "ERR: Not a Multiboot bootloader!"
@@ -137,8 +137,7 @@ multiboot2_header:
 .Lno_nx_msg:   .asciz "ERR: Not an NX-capable CPU!"
 #endif
 
-        .section .init.data, "aw", @progbits
-        .subsection 1 /* Put data here after the page tables (in x86_64.S). */
+        .section .init.data.multiboot, "aw", @progbits
         .align 4
 
         .word   0
@@ -154,7 +153,7 @@ vga_text_buffer:
 efi_platform:
         .byte   0
 
-        .section .init.text, "ax", @progbits
+        .section .init.multiboot, "ax", @progbits
 
 early_error: /* Here to improve the disassembly. */
 
@@ -712,6 +711,7 @@ trampoline_setup:
         /* Jump into the relocated trampoline. */
         lret
 
+        .section .init.text, "ax", @progbits
 ENTRY(trampoline_start)
 #include "trampoline.S"
 ENTRY(trampoline_end)
diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S
index 8e63cf5bc2..4ed1d2bec1 100644
--- a/xen/arch/x86/xen.lds.S
+++ b/xen/arch/x86/xen.lds.S
@@ -57,6 +57,10 @@ SECTIONS
   __image_base__ = .;
 #else
   . = __image_base__;
+  /DISCARD/ : {
+    *(.text.header)
+    *(.init.*multiboot)
+  }
 #endif
 
 #if 0
@@ -195,6 +199,7 @@ SECTIONS
   DECL_SECTION(.init.text) {
 #endif
        _sinittext = .;
+       *(.init.multiboot)
        *(.init.text)
        *(.text.startup)
        _einittext = .;
@@ -220,6 +225,7 @@ SECTIONS
        *(.init.rodata.cf_clobber)
        __initdata_cf_clobber_end = .;
 
+       *(.init.rodata.multiboot)
        *(.init.rodata)
        *(.init.rodata.*)
 
@@ -234,6 +240,7 @@ SECTIONS
        *(.initcall1.init)
        __initcall_end = .;
 
+       *(.init.data.multiboot)
        *(.init.data)
        *(.init.data.rel)
        *(.init.data.rel.*)
diff --git a/xen/tools/combine_two_binaries.py b/xen/tools/combine_two_binaries.py
index 581e57cbc0..5f0433dcad 100755
--- a/xen/tools/combine_two_binaries.py
+++ b/xen/tools/combine_two_binaries.py
@@ -33,7 +33,7 @@ parser.add_argument('--map', dest='mapfile',
 parser.add_argument('--exports', dest='exports',
                     help='Symbols to export')
 parser.add_argument('--section-header', dest='section_header',
-                    default='.section .init.text, "ax", @progbits',
+                    default='.section .init.multiboot, "ax", @progbits',
                     help='Section header declaration')
 parser.add_argument('-v', '--verbose',
                     action='store_true')
-- 
2.43.0

[PATCH v8 3/4] x86/efi: avoid a relocation in efi_arch_post_exit_boot()

[Frediano Ziglio]

From: Roger Pau Monné <roger.pau@citrix.com>

Instead of using the absolute __start_xen address, calculate it as an
offset from the current instruction pointer.  The relocation would be
problematic if the generated PE binary had .init.text as a standalone
section with just read and execute permissions.

Removing this relocation is necessary to make it safe to split .init.

No functional change intended.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes since v1:
- Improve commit message.

Changes since v3:
- Added Acked-by.

Changes since v6:
- remove spurious quote.
---
 xen/arch/x86/efi/efi-boot.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/efi/efi-boot.h b/xen/arch/x86/efi/efi-boot.h
index d738b839ee..b983f054b5 100644
--- a/xen/arch/x86/efi/efi-boot.h
+++ b/xen/arch/x86/efi/efi-boot.h
@@ -270,7 +270,9 @@ static void __init noreturn efi_arch_post_exit_boot(void)
 
                    /* Jump to higher mappings. */
                    "mov    stack_start(%%rip), %%rsp\n\t"
-                   "movabs $__start_xen, %[rip]\n\t"
+                   "lea    __start_xen(%%rip), %[rip]\n\t"
+                   "add    %[offset], %[rip]\n\t"
+
                    "push   %[cs]\n\t"
                    "push   %[rip]\n\t"
                    "lretq"
@@ -278,7 +280,8 @@ static void __init noreturn efi_arch_post_exit_boot(void)
                      [cr4] "+&r" (cr4)
                    : [cr3] "r" (idle_pg_table),
                      [cs] "i" (__HYPERVISOR_CS),
-                     [ds] "r" (__HYPERVISOR_DS)
+                     [ds] "r" (__HYPERVISOR_DS),
+                     [offset] "r" (__XEN_VIRT_START - xen_phys_start)
                    : "memory" );
     unreachable();
 }
-- 
2.43.0

[PATCH v8 4/4] x86: Split .init section to satisfy UEFI CA memory mitigation

[Frediano Ziglio]

Currently .init section is both writeable and executable, split data and code
to have 2 sections satisfying W^X rule.

It is a requirement for NX_COMPAT so the PE can be loaded with W^X perms
in the pagetables.

NX_COMPAT is a requirement from shim-review,
https://github.com/rhboot/shim-review#do-you-have-the-nx-bit-set-in-your-shim-if-so-is-your-entire-boot-stack-nx-compatible-and-what-testing-have-you-done-to-ensure-such-compatibility

Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Change since v1:
- update comment style.

Changes since v3:
- Added Acked-by.

Changes since v4:
- Added Acked-by.
---
 xen/arch/x86/xen.lds.S | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/xen.lds.S b/xen/arch/x86/xen.lds.S
index 4ed1d2bec1..e26e37db13 100644
--- a/xen/arch/x86/xen.lds.S
+++ b/xen/arch/x86/xen.lds.S
@@ -193,11 +193,7 @@ SECTIONS
   __2M_init_start = .;         /* Start of 2M superpages, mapped RWX (boot only). */
   . = ALIGN(PAGE_SIZE);             /* Init code and data */
   __init_begin = .;
-#ifdef EFI /* EFI wants to merge all of .init.*  ELF doesn't. */
-  DECL_SECTION(.init) {
-#else
   DECL_SECTION(.init.text) {
-#endif
        _sinittext = .;
        *(.init.multiboot)
        *(.init.text)
@@ -210,12 +206,12 @@ SECTIONS
         */
        *(.altinstr_replacement)
 
-#ifdef EFI /* EFI wants to merge all of .init.*  ELF doesn't. */
-       . = ALIGN(SMP_CACHE_BYTES);
-#else
   } PHDR(text)
-  DECL_SECTION(.init.data) {
+#ifdef EFI
+  /* Align to satisfy UEFI CA memory mitigation. */
+  . = ALIGN(SECTION_ALIGN);
 #endif
+  DECL_SECTION(.init.data) {
        *(.init.bss.stack_aligned)
        *(.init.data.page_aligned)
 
-- 
2.43.0

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Jan Beulich]

On 15.07.2026 08:22, Frediano Ziglio wrote:
> These patches improve support for Secure boot.
> UEFI CA memory mitigation requires memory pages to be not executable and
> writable at the same time. So changing permissions and splitting some section
> is required.
> Remove multiboot pieces from EFI executable.
> 
> Changes since v1:
> - improved some comments;
> - merged 2 pacthes removing multiboot support in x86 PE;
> - removed a patch dealing with SBAT;
> - other minor changes (see single patches).
> 
> Changes since v2:
> - improved some comments.
> 
> Changes since v3:
> - Added Acked-by;
> - Improve commit message.
> 
> Changes since v4:
> - Messages updates;
> - Clean some dependencies cause by code removal;
> - Add small commit to remove a possibly unused string.
> 
> Changes since v5:
> - removed merged commit;
> - remove more code/data from xen.efi output.
> 
> Changes since v6:
> - fix commit message.
> 
> Changes since v7:
> - added Acked-by, all commit are now acked.

Forgive me asking, but why did this warrant another re-submission? We've
got enough traffic on the list already.

Jan

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Frediano Ziglio]

On Wed, 15 Jul 2026 at 07:24, Jan Beulich <jbeulich@suse.com> wrote:
>
> On 15.07.2026 08:22, Frediano Ziglio wrote:
> > These patches improve support for Secure boot.
> > UEFI CA memory mitigation requires memory pages to be not executable and
> > writable at the same time. So changing permissions and splitting some section
> > is required.
> > Remove multiboot pieces from EFI executable.
> >
> > Changes since v1:
> > - improved some comments;
> > - merged 2 pacthes removing multiboot support in x86 PE;
> > - removed a patch dealing with SBAT;
> > - other minor changes (see single patches).
> >
> > Changes since v2:
> > - improved some comments.
> >
> > Changes since v3:
> > - Added Acked-by;
> > - Improve commit message.
> >
> > Changes since v4:
> > - Messages updates;
> > - Clean some dependencies cause by code removal;
> > - Add small commit to remove a possibly unused string.
> >
> > Changes since v5:
> > - removed merged commit;
> > - remove more code/data from xen.efi output.
> >
> > Changes since v6:
> > - fix commit message.
> >
> > Changes since v7:
> > - added Acked-by, all commit are now acked.
>
> Forgive me asking, but why did this warrant another re-submission? We've
> got enough traffic on the list already.
>
> Jan

Because there was an update and because nothing was merged.

Frediano

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Jan Beulich]

On 15.07.2026 08:40, Frediano Ziglio wrote:
> On Wed, 15 Jul 2026 at 07:24, Jan Beulich <jbeulich@suse.com> wrote:
>>
>> On 15.07.2026 08:22, Frediano Ziglio wrote:
>>> These patches improve support for Secure boot.
>>> UEFI CA memory mitigation requires memory pages to be not executable and
>>> writable at the same time. So changing permissions and splitting some section
>>> is required.
>>> Remove multiboot pieces from EFI executable.
>>>
>>> Changes since v1:
>>> - improved some comments;
>>> - merged 2 pacthes removing multiboot support in x86 PE;
>>> - removed a patch dealing with SBAT;
>>> - other minor changes (see single patches).
>>>
>>> Changes since v2:
>>> - improved some comments.
>>>
>>> Changes since v3:
>>> - Added Acked-by;
>>> - Improve commit message.
>>>
>>> Changes since v4:
>>> - Messages updates;
>>> - Clean some dependencies cause by code removal;
>>> - Add small commit to remove a possibly unused string.
>>>
>>> Changes since v5:
>>> - removed merged commit;
>>> - remove more code/data from xen.efi output.
>>>
>>> Changes since v6:
>>> - fix commit message.
>>>
>>> Changes since v7:
>>> - added Acked-by, all commit are now acked.
>>
>> Forgive me asking, but why did this warrant another re-submission? We've
>> got enough traffic on the list already.
> 
> Because there was an update and because nothing was merged.

The tree isn't fully open yet, so things not having been merged yet isn't an
indication of a problem. Andrew did indicate he'd like to massage some of
the commit messages, so talk to him if you still find things uncommitted a
little while after the tree is fully open again.

Jan

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Frediano Ziglio]

On Wed, 15 Jul 2026 at 07:22, Frediano Ziglio <freddy77@gmail.com> wrote:
>
> These patches improve support for Secure boot.
> UEFI CA memory mitigation requires memory pages to be not executable and
> writable at the same time. So changing permissions and splitting some section
> is required.
> Remove multiboot pieces from EFI executable.
>
> Changes since v1:
> - improved some comments;
> - merged 2 pacthes removing multiboot support in x86 PE;
> - removed a patch dealing with SBAT;
> - other minor changes (see single patches).
>
> Changes since v2:
> - improved some comments.
>
> Changes since v3:
> - Added Acked-by;
> - Improve commit message.
>
> Changes since v4:
> - Messages updates;
> - Clean some dependencies cause by code removal;
> - Add small commit to remove a possibly unused string.
>
> Changes since v5:
> - removed merged commit;
> - remove more code/data from xen.efi output.
>
> Changes since v6:
> - fix commit message.
>
> Changes since v7:
> - added Acked-by, all commit are now acked.
>
> Frediano Ziglio (2):
>   Align relevant sections to 4KB
>   x86: Split .init section to satisfy UEFI CA memory mitigation
>
> Roger Pau Monné (2):
>   x86/efi: discard multiboot and PVH support for PE binary
>   x86/efi: avoid a relocation in efi_arch_post_exit_boot()
>
>  docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
>  xen/arch/x86/boot/head.S                    |  8 +++----
>  xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
>  xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
>  xen/tools/combine_two_binaries.py           |  2 +-
>  5 files changed, 25 insertions(+), 23 deletions(-)
>

Ping

Frediano

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Frediano Ziglio]

On Sat, 8 Aug 2026 at 07:41, Frediano Ziglio <freddy77@gmail.com> wrote:
>
> On Wed, 15 Jul 2026 at 07:22, Frediano Ziglio <freddy77@gmail.com> wrote:
> >
> > These patches improve support for Secure boot.
> > UEFI CA memory mitigation requires memory pages to be not executable and
> > writable at the same time. So changing permissions and splitting some section
> > is required.
> > Remove multiboot pieces from EFI executable.
> >
> > Changes since v1:
> > - improved some comments;
> > - merged 2 pacthes removing multiboot support in x86 PE;
> > - removed a patch dealing with SBAT;
> > - other minor changes (see single patches).
> >
> > Changes since v2:
> > - improved some comments.
> >
> > Changes since v3:
> > - Added Acked-by;
> > - Improve commit message.
> >
> > Changes since v4:
> > - Messages updates;
> > - Clean some dependencies cause by code removal;
> > - Add small commit to remove a possibly unused string.
> >
> > Changes since v5:
> > - removed merged commit;
> > - remove more code/data from xen.efi output.
> >
> > Changes since v6:
> > - fix commit message.
> >
> > Changes since v7:
> > - added Acked-by, all commit are now acked.
> >
> > Frediano Ziglio (2):
> >   Align relevant sections to 4KB
> >   x86: Split .init section to satisfy UEFI CA memory mitigation
> >
> > Roger Pau Monné (2):
> >   x86/efi: discard multiboot and PVH support for PE binary
> >   x86/efi: avoid a relocation in efi_arch_post_exit_boot()
> >
> >  docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
> >  xen/arch/x86/boot/head.S                    |  8 +++----
> >  xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
> >  xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
> >  xen/tools/combine_two_binaries.py           |  2 +-
> >  5 files changed, 25 insertions(+), 23 deletions(-)
> >
>
> Ping
>

Ping

Frediano

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Jan Beulich]

On 19.08.2026 12:03, Frediano Ziglio wrote:
> On Sat, 8 Aug 2026 at 07:41, Frediano Ziglio <freddy77@gmail.com> wrote:
>>
>> On Wed, 15 Jul 2026 at 07:22, Frediano Ziglio <freddy77@gmail.com> wrote:
>>>
>>> These patches improve support for Secure boot.
>>> UEFI CA memory mitigation requires memory pages to be not executable and
>>> writable at the same time. So changing permissions and splitting some section
>>> is required.
>>> Remove multiboot pieces from EFI executable.
>>>
>>> Changes since v1:
>>> - improved some comments;
>>> - merged 2 pacthes removing multiboot support in x86 PE;
>>> - removed a patch dealing with SBAT;
>>> - other minor changes (see single patches).
>>>
>>> Changes since v2:
>>> - improved some comments.
>>>
>>> Changes since v3:
>>> - Added Acked-by;
>>> - Improve commit message.
>>>
>>> Changes since v4:
>>> - Messages updates;
>>> - Clean some dependencies cause by code removal;
>>> - Add small commit to remove a possibly unused string.
>>>
>>> Changes since v5:
>>> - removed merged commit;
>>> - remove more code/data from xen.efi output.
>>>
>>> Changes since v6:
>>> - fix commit message.
>>>
>>> Changes since v7:
>>> - added Acked-by, all commit are now acked.
>>>
>>> Frediano Ziglio (2):
>>>   Align relevant sections to 4KB
>>>   x86: Split .init section to satisfy UEFI CA memory mitigation
>>>
>>> Roger Pau Monné (2):
>>>   x86/efi: discard multiboot and PVH support for PE binary
>>>   x86/efi: avoid a relocation in efi_arch_post_exit_boot()
>>>
>>>  docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
>>>  xen/arch/x86/boot/head.S                    |  8 +++----
>>>  xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
>>>  xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
>>>  xen/tools/combine_two_binaries.py           |  2 +-
>>>  5 files changed, 25 insertions(+), 23 deletions(-)
>>
>> Ping
> 
> Ping

Andrew had indicated to me (apparently not to you?) that he'd like to
massage the descriptions some while committing. Hence why I refrained
from putting any of this in.

Jan

Re: [PATCH v8 0/4] Various patches to improve Secure Boot support

[Frediano Ziglio]

On Wed, 19 Aug 2026 at 11:12, Jan Beulich <jbeulich@suse.com> wrote:
>
> On 19.08.2026 12:03, Frediano Ziglio wrote:
> > On Sat, 8 Aug 2026 at 07:41, Frediano Ziglio <freddy77@gmail.com> wrote:
> >>
> >> On Wed, 15 Jul 2026 at 07:22, Frediano Ziglio <freddy77@gmail.com> wrote:
> >>>
> >>> These patches improve support for Secure boot.
> >>> UEFI CA memory mitigation requires memory pages to be not executable and
> >>> writable at the same time. So changing permissions and splitting some section
> >>> is required.
> >>> Remove multiboot pieces from EFI executable.
> >>>
> >>> Changes since v1:
> >>> - improved some comments;
> >>> - merged 2 pacthes removing multiboot support in x86 PE;
> >>> - removed a patch dealing with SBAT;
> >>> - other minor changes (see single patches).
> >>>
> >>> Changes since v2:
> >>> - improved some comments.
> >>>
> >>> Changes since v3:
> >>> - Added Acked-by;
> >>> - Improve commit message.
> >>>
> >>> Changes since v4:
> >>> - Messages updates;
> >>> - Clean some dependencies cause by code removal;
> >>> - Add small commit to remove a possibly unused string.
> >>>
> >>> Changes since v5:
> >>> - removed merged commit;
> >>> - remove more code/data from xen.efi output.
> >>>
> >>> Changes since v6:
> >>> - fix commit message.
> >>>
> >>> Changes since v7:
> >>> - added Acked-by, all commit are now acked.
> >>>
> >>> Frediano Ziglio (2):
> >>>   Align relevant sections to 4KB
> >>>   x86: Split .init section to satisfy UEFI CA memory mitigation
> >>>
> >>> Roger Pau Monné (2):
> >>>   x86/efi: discard multiboot and PVH support for PE binary
> >>>   x86/efi: avoid a relocation in efi_arch_post_exit_boot()
> >>>
> >>>  docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
> >>>  xen/arch/x86/boot/head.S                    |  8 +++----
> >>>  xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
> >>>  xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
> >>>  xen/tools/combine_two_binaries.py           |  2 +-
> >>>  5 files changed, 25 insertions(+), 23 deletions(-)
> >>
> >> Ping
> >
> > Ping
>
> Andrew had indicated to me (apparently not to you?) that he'd like to
> massage the descriptions some while committing. Hence why I refrained
> from putting any of this in.
>
> Jan

I understand maybe we want better comments and explaining what's
missing/improvable could take more time than updating them directly,
but how many months does this require?
Especially after the changes had different acks.

Frediano