Re: [Xen-devel] Booting signed xen.efi through shim

[Daniel Kiper <daniel.kiper@xxxxxxxxxx>]

Hi Tamas,

On Tue, Sep 12, 2017 at 05:40:35PM -0600, Tamas K Lengyel wrote:
> Hi all,
> for the last couple weeks I've been poking around the options
> available to get Xen booted on a Secureboot enabled box. My goal is to
> extend the chain of trust to the dom0 kernel. According to
> https://wiki.xenproject.org/wiki/Xen_EFI this is something that's
> supposed to be supported out-of-the-box right now via the shim
> protocol. However, when I try to boot a signed xen.efi (4.10 unstable
> head) through shim I get the error "Section 6 is inside image header"

Strange... Could you send more info about your environment?
C compiler type, its version, binutils version, etc. How
did you sign xen.efi? Which tool you used to do that?
Have you seen any warnings or errors during sign?

> and shim refuses to load Xen. OTOH I had been able to boot a
> custom-compiled grub2 from the shim no problem with Secureboot

What do you mean by "custom-compiled grub2"?

> enabled. The signed xen.efi also boots fine with Secureboot enabled if
> booted directly as an EFI application (but then no dom0 verification

IIRC, shim is very picky with PE format. So, anything which is loaded
by EFI loader may not be loaded by shim.

> is done AFAIU). Does anyone have any pointers on what's going on with

Right, only shim provides a such functionality.

> booting through the shim?

I am happy to help but in cases like that I need more info, e.g.: serial
console logs, output from "objdump -x xen/xen.efi" command, etc.

Daniel

PS I am traveling, so, I am reading my emails from time to time.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel