Watch

[v3] x86/kexec: Secure Boot support #4

Open

lore-8719a683491a583a90621e2f wants to merge 7 commits from lore/1776935e5187e91e4e9f0607bc5880662d00ac3632481ec35e84c109800b2bad/v3 into lore/1776935e5187e91e4e9f0607bc5880662d00ac3632481ec35e84c109800b2bad/v3-base

Kevin Lampis commented

2026-10-26 10:18:04 +01:00

First-time contributor

Revision: v3

These changes allow loading and booting an EFI kexec crash kernel.

For this new EFI kexec type, userspace won't provide purgatory code.
Instead Xen jumps directly to the new kernel.

Signature validation is done by the dom0 kernel. Xen then calculates a
digest for all the segments stored in memory. This digest is verified
again during execution. This digest check obviates the need for Xen to
verify Secure Boot signatures directly.

Changes in v3:
- Review comments

Changes in v2:
- Addressed review comments for specific patches

Kevin Lampis (2):
  x86/kexec: Pass boot params directly to new kernel
  x86/kexec: Zero GPRs before entering

Ross Lagerwall (5):
  x86/kexec: add digest checks
  x86/kexec: rename setup_header to bzimage_header
  x86/kexec: add new struct kimage_segment
  x86/kexec: Support non-page-aligned kexec segments
  x86/kexec: Implement new EFI load type

 tools/libs/ctrl/xc_kexec.c               |   2 +-
 xen/arch/x86/Makefile                    |   1 +
 xen/arch/x86/bzimage.c                   |  47 +----
 xen/arch/x86/include/asm/bzimage.h       |  44 +++++
 xen/arch/x86/include/asm/kexec.h         |   9 +
 xen/arch/x86/include/asm/machine_kexec.h |   2 +-
 xen/arch/x86/kexec.c                     |  58 +++++++
 xen/arch/x86/machine_kexec.c             |   3 +-
 xen/arch/x86/x86_64/kexec_reloc.S        |  23 +++
 xen/common/kexec.c                       |  38 ++++-
 xen/common/kimage.c                      | 208 ++++++++++++++++++-----
 xen/include/public/kexec.h               |  12 +-
 xen/include/xen/kimage.h                 |  20 ++-
 13 files changed, 367 insertions(+), 100 deletions(-)
 create mode 100644 xen/arch/x86/include/asm/kexec.h
 create mode 100644 xen/arch/x86/kexec.c

-- 
2.52.0

Imported by review-companion Internal server error - Forgejo: Beyond coding. We Forge.

500

Internal server error

Forgejo version: 18.0.0-dev-238-4242acdd5a+gitea-1.22.0