These patches improve support for Secure boot.
UEFI CA memory mitigation requires memory pages to be not executable and
writable at the same time. So changing permissions and splitting some section
is required.
Remove multiboot pieces from EFI executable.

Changes since v1:
- improved some comments;
- merged 2 pacthes removing multiboot support in x86 PE;
- removed a patch dealing with SBAT;
- other minor changes (see single patches).

Changes since v2:
- improved some comments.

Changes since v3:
- Added Acked-by;
- Improve commit message.

Changes since v4:
- Messages updates;
- Clean some dependencies cause by code removal;
- Add small commit to remove a possibly unused string.

Changes since v5:
- removed merged commit;
- remove more code/data from xen.efi output.

Changes since v6:
- fix commit message.

Changes since v7:
- added Acked-by, all commit are now acked.

Frediano Ziglio (2):
  Align relevant sections to 4KB
  x86: Split .init section to satisfy UEFI CA memory mitigation

Roger Pau Monné (2):
  x86/efi: discard multiboot and PVH support for PE binary
  x86/efi: avoid a relocation in efi_arch_post_exit_boot()

 docs/hypervisor-guide/x86/how-xen-boots.rst |  6 -----
 xen/arch/x86/boot/head.S                    |  8 +++----
 xen/arch/x86/efi/efi-boot.h                 |  7 ++++--
 xen/arch/x86/xen.lds.S                      | 25 ++++++++++++---------
 xen/tools/combine_two_binaries.py           |  2 +-
 5 files changed, 25 insertions(+), 23 deletions(-)

-- 
2.43.0

On 15.07.2026 08:22, Frediano Ziglio wrote:
> These patches improve support for Secure boot.
> UEFI CA memory mitigation requires memory pages to be not executable and
> writable at the same time. So changing permissions and splitting some section
> is required.
> Remove multiboot pieces from EFI executable.
> 
> Changes since v1:
> - improved some comments;
> - merged 2 pacthes removing multiboot support in x86 PE;
> - removed a patch dealing with SBAT;
> - other minor changes (see single patches).
> 
> Changes since v2:
> - improved some comments.
> 
> Changes since v3:
> - Added Acked-by;
> - Improve commit message.
> 
> Changes since v4:
> - Messages updates;
> - Clean some dependencies cause by code removal;
> - Add small commit to remove a possibly unused string.
> 
> Changes since v5:
> - removed merged commit;
> - remove more code/data from xen.efi output.
> 
> Changes since v6:
> - fix commit message.
> 
> Changes since v7:
> - added Acked-by, all commit are now acked.

Forgive me asking, but why did this warrant another re-submission? We've
got enough traffic on the list already.

Jan

On Wed, 15 Jul 2026 at 07:24, Jan Beulich <jbeulich@suse.com> wrote:
>
> On 15.07.2026 08:22, Frediano Ziglio wrote:
> > These patches improve support for Secure boot.
> > UEFI CA memory mitigation requires memory pages to be not executable and
> > writable at the same time. So changing permissions and splitting some section
> > is required.
> > Remove multiboot pieces from EFI executable.
> >
> > Changes since v1:
> > - improved some comments;
> > - merged 2 pacthes removing multiboot support in x86 PE;
> > - removed a patch dealing with SBAT;
> > - other minor changes (see single patches).
> >
> > Changes since v2:
> > - improved some comments.
> >
> > Changes since v3:
> > - Added Acked-by;
> > - Improve commit message.
> >
> > Changes since v4:
> > - Messages updates;
> > - Clean some dependencies cause by code removal;
> > - Add small commit to remove a possibly unused string.
> >
> > Changes since v5:
> > - removed merged commit;
> > - remove more code/data from xen.efi output.
> >
> > Changes since v6:
> > - fix commit message.
> >
> > Changes since v7:
> > - added Acked-by, all commit are now acked.
>
> Forgive me asking, but why did this warrant another re-submission? We've
> got enough traffic on the list already.
>
> Jan

Because there was an update and because nothing was merged.

Frediano

On 15.07.2026 08:40, Frediano Ziglio wrote:
> On Wed, 15 Jul 2026 at 07:24, Jan Beulich <jbeulich@suse.com> wrote:
>>
>> On 15.07.2026 08:22, Frediano Ziglio wrote:
>>> These patches improve support for Secure boot.
>>> UEFI CA memory mitigation requires memory pages to be not executable and
>>> writable at the same time. So changing permissions and splitting some section
>>> is required.
>>> Remove multiboot pieces from EFI executable.
>>>
>>> Changes since v1:
>>> - improved some comments;
>>> - merged 2 pacthes removing multiboot support in x86 PE;
>>> - removed a patch dealing with SBAT;
>>> - other minor changes (see single patches).
>>>
>>> Changes since v2:
>>> - improved some comments.
>>>
>>> Changes since v3:
>>> - Added Acked-by;
>>> - Improve commit message.
>>>
>>> Changes since v4:
>>> - Messages updates;
>>> - Clean some dependencies cause by code removal;
>>> - Add small commit to remove a possibly unused string.
>>>
>>> Changes since v5:
>>> - removed merged commit;
>>> - remove more code/data from xen.efi output.
>>>
>>> Changes since v6:
>>> - fix commit message.
>>>
>>> Changes since v7:
>>> - added Acked-by, all commit are now acked.
>>
>> Forgive me asking, but why did this warrant another re-submission? We've
>> got enough traffic on the list already.
> 
> Because there was an update and because nothing was merged.

The tree isn't fully open yet, so things not having been merged yet isn't an
indication of a problem. Andrew did indicate he'd like to massage some of
the commit messages, so talk to him if you still find things uncommitted a
little while after the tree is fully open again.

Jan