From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vivek Goyal Subject: Re: [Xen-devel] [PATCH v3 00/11] xen: Initial kexec/kdump implementation Date: Fri, 11 Jan 2013 15:43:18 -0500 Message-ID: <20130111204317.GB17126@redhat.com> References: <50E41973.9050705@citrix.com> <20130104142257.GC3346@host-192-168-1-59.local.net-space.pl> <50E6F81D02000078000B3245@nat28.tlf.novell.com> <20130104170751.GB3472@host-192-168-1-59.local.net-space.pl> <20130104191146.GC6721@phenom.dumpdata.com> <20130107123404.GA2927@host-192-168-1-59.local.net-space.pl> <20130107162018.GJ3219@phenom.dumpdata.com> <87ehhsqrpr.fsf@xmission.com> <20130111165506.GD25620@phenom.dumpdata.com> <50F07588.90902@zytor.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <50F07588.90902@zytor.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: virtualization-bounces@lists.linux-foundation.org Errors-To: virtualization-bounces@lists.linux-foundation.org To: "H. Peter Anvin" Cc: "xen-devel@lists.xensource.com" , Konrad Rzeszutek Wilk , Andrew Cooper , Daniel Kiper , "x86@kernel.org" , "kexec@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "virtualization@lists.linux-foundation.org" , "mingo@redhat.com" , "Eric W. Biederman" , Jan Beulich , "maxim.uvarov@oracle.com" , "tglx@linutronix.de" , David Woodhouse List-Id: xen-devel@lists.xenproject.org On Fri, Jan 11, 2013 at 12:26:48PM -0800, H. Peter Anvin wrote: > > > >And there is nothing fancy to be done for EFI and SecureBoot? Or is > >that something that the kernel has to handle on its own (so somehow > >passing some certificates to somewhere). > > > > For EFI, no... other than passing the EFI parameters, which > apparently is *not* currently done (David Woodhouse is working on > it.) Secure boot is still a work in progress. For secureboot, as a first step in that direction, I just wrote some code to sign elf executable and be able to verify it in kernel upon exec(). I am soon planning to post RFC code (most likely next week). Hopefully we will be able to sign statically signed /sbin/kexec, give it extra capability (upon signature verification) to be able to call sys_exec(). Thanks Vivek