[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] Booting signed xen.efi through shim
Hi Tamas, On Tue, Sep 12, 2017 at 05:40:35PM -0600, Tamas K Lengyel wrote: > Hi all, > for the last couple weeks I've been poking around the options > available to get Xen booted on a Secureboot enabled box. My goal is to > extend the chain of trust to the dom0 kernel. According to > https://wiki.xenproject.org/wiki/Xen_EFI this is something that's > supposed to be supported out-of-the-box right now via the shim > protocol. However, when I try to boot a signed xen.efi (4.10 unstable > head) through shim I get the error "Section 6 is inside image header" Strange... Could you send more info about your environment? C compiler type, its version, binutils version, etc. How did you sign xen.efi? Which tool you used to do that? Have you seen any warnings or errors during sign? > and shim refuses to load Xen. OTOH I had been able to boot a > custom-compiled grub2 from the shim no problem with Secureboot What do you mean by "custom-compiled grub2"? > enabled. The signed xen.efi also boots fine with Secureboot enabled if > booted directly as an EFI application (but then no dom0 verification IIRC, shim is very picky with PE format. So, anything which is loaded by EFI loader may not be loaded by shim. > is done AFAIU). Does anyone have any pointers on what's going on with Right, only shim provides a such functionality. > booting through the shim? I am happy to help but in cases like that I need more info, e.g.: serial console logs, output from "objdump -x xen/xen.efi" command, etc. Daniel PS I am traveling, so, I am reading my emails from time to time. _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx https://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |