[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 0/7] x86/kexec: Secure Boot support
- To: xen-devel@xxxxxxxxxxxxxxxxxxxx
- From: Kevin Lampis <kevin.lampis@xxxxxxxxxx>
- Date: Mon, 26 Oct 2026 09:20:10 +0000
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=E0wegR8SwtKYPW3eDFMZD1yep5qX9R/veXwzvzH8zwE=; b=Ytr2Sz62Ui0p0uDJcDsEvgIyfGtFQRzkETmsGyq2nMThCyThWf9FipU9EChVCYo8bH2tWP3N6G9QoljcpiCeh7Inx5lj40+g0b1vQi+Ublwd4tSjI2kFdy/NTws9vcGH1VHc8HLktOqghRUbShrMKaTs+CT3tHO2uBuKC0WxvFgAhoA1WUHDX7fTQT59+hwfijAQgOv57fds1J0DWJQwineMeewp23n2HmKMyHGRwFcGNYAqj8JX5+u/gZCafvjf9TUcGSpKM10PcQOmJir7x3tJrAOl1JtHB/6NEB67gTwbIFNVRCWdrWeFdN3IgJBGxWeIEBCeXwnsYiVJkq8cDA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DMGHwWZY2vjnt+41DevG+x9kvEamZOWK18MG+vwjUPhDPkWbCFB8mr9spcxweeE4kMUxRa73WYzD9LMw7uAON3ZfRndd3DhCMtXv068hAVmxlhPriw2QaAck1KlkIm2xXmnVNyXRTc8J6V0pqqbC1C0Et4w6Zf7v4j4Q/9wzP82PCFyZqwlw4gN8uDXMIWYARkpln6pBTVylqRpl8BcBRmOjdgwnseTq7jkYoWEsIP1YJ5Wt7yr6ppJp4M2GDxztiakPbzRDGN9NZHoEAktJrFCEdVG/8m7VCy6wbhGa2KEcET30kaoupBNU7Vdc8FWvyZ9Feb5KGfzCNVi9yL9fJQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: jbeulich@xxxxxxxx, andrew.cooper3@xxxxxxxxxx, roger@xxxxxxxxxxxxxx, teddy.astie@xxxxxxxxxx, ross.lagerwall@xxxxxxxxxx, Kevin Lampis <kevin.lampis@xxxxxxxxxx>
- Delivery-date: Mon, 26 Oct 2026 09:17:52 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
These changes allow loading and booting an EFI kexec crash kernel.
For this new EFI kexec type, userspace won't provide purgatory code.
Instead Xen jumps directly to the new kernel.
Signature validation is done by the dom0 kernel. Xen then calculates a
digest for all the segments stored in memory. This digest is verified
again during execution. This digest check obviates the need for Xen to
verify Secure Boot signatures directly.
Changes in v3:
- Review comments
Changes in v2:
- Addressed review comments for specific patches
Kevin Lampis (2):
x86/kexec: Pass boot params directly to new kernel
x86/kexec: Zero GPRs before entering
Ross Lagerwall (5):
x86/kexec: add digest checks
x86/kexec: rename setup_header to bzimage_header
x86/kexec: add new struct kimage_segment
x86/kexec: Support non-page-aligned kexec segments
x86/kexec: Implement new EFI load type
tools/libs/ctrl/xc_kexec.c | 2 +-
xen/arch/x86/Makefile | 1 +
xen/arch/x86/bzimage.c | 47 +----
xen/arch/x86/include/asm/bzimage.h | 44 +++++
xen/arch/x86/include/asm/kexec.h | 9 +
xen/arch/x86/include/asm/machine_kexec.h | 2 +-
xen/arch/x86/kexec.c | 58 +++++++
xen/arch/x86/machine_kexec.c | 3 +-
xen/arch/x86/x86_64/kexec_reloc.S | 23 +++
xen/common/kexec.c | 38 ++++-
xen/common/kimage.c | 208 ++++++++++++++++++-----
xen/include/public/kexec.h | 12 +-
xen/include/xen/kimage.h | 20 ++-
13 files changed, 367 insertions(+), 100 deletions(-)
create mode 100644 xen/arch/x86/include/asm/kexec.h
create mode 100644 xen/arch/x86/kexec.c
--
2.52.0
|
