From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mx1.redhat.com ([209.132.183.28]) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1TtlRw-0002eF-Gx for kexec@lists.infradead.org; Fri, 11 Jan 2013 20:43:37 +0000 Date: Fri, 11 Jan 2013 15:43:18 -0500 From: Vivek Goyal Subject: Re: [Xen-devel] [PATCH v3 00/11] xen: Initial kexec/kdump implementation Message-ID: <20130111204317.GB17126@redhat.com> References: <50E41973.9050705@citrix.com> <20130104142257.GC3346@host-192-168-1-59.local.net-space.pl> <50E6F81D02000078000B3245@nat28.tlf.novell.com> <20130104170751.GB3472@host-192-168-1-59.local.net-space.pl> <20130104191146.GC6721@phenom.dumpdata.com> <20130107123404.GA2927@host-192-168-1-59.local.net-space.pl> <20130107162018.GJ3219@phenom.dumpdata.com> <87ehhsqrpr.fsf@xmission.com> <20130111165506.GD25620@phenom.dumpdata.com> <50F07588.90902@zytor.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <50F07588.90902@zytor.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: kexec-bounces@lists.infradead.org Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: "H. Peter Anvin" Cc: "xen-devel@lists.xensource.com" , Konrad Rzeszutek Wilk , Andrew Cooper , Daniel Kiper , "x86@kernel.org" , "kexec@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "virtualization@lists.linux-foundation.org" , "mingo@redhat.com" , "Eric W. Biederman" , Jan Beulich , "maxim.uvarov@oracle.com" , "tglx@linutronix.de" , David Woodhouse On Fri, Jan 11, 2013 at 12:26:48PM -0800, H. Peter Anvin wrote: > > > >And there is nothing fancy to be done for EFI and SecureBoot? Or is > >that something that the kernel has to handle on its own (so somehow > >passing some certificates to somewhere). > > > > For EFI, no... other than passing the EFI parameters, which > apparently is *not* currently done (David Woodhouse is working on > it.) Secure boot is still a work in progress. For secureboot, as a first step in that direction, I just wrote some code to sign elf executable and be able to verify it in kernel upon exec(). I am soon planning to post RFC code (most likely next week). Hopefully we will be able to sign statically signed /sbin/kexec, give it extra capability (upon signature verification) to be able to call sys_exec(). Thanks Vivek _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec