This is version 3 for a patch set sent out to the ML in 2018 [1] to
support UEFI Secure Boot for Xen on multiboot2 platforms.
A new binary, xen.mb.efi, is built. It contains the mb2 header as well
as a hand-crafted PE/COFF header. The dom0 kernel is verified using the
shim lock protocol.
I followed with v2 feedback and attempted to convert the PE/COFF header
into C instead of ASM. Unfortunately, this was only possible for the
first part (Legacy) of the PE/COFF header. The other parts required
addresses only available at link time (such as __2M_rwdata_end,
__pe_SizeOfImage, efi_mb_start address, etc...), which effectively ruled
out C.
The biggest difference between v2 and v3 is that in v3 we do not attempt
to merge xen.mb.efi and xen.efi into a single binary. Instead, this
will be left to a future patch set, unless requested otherwise.
[1]: https://lists.xen.org/archives/html/xen-devel/2018-06/msg01292.html
Changes in v3:
- add requested comment clarification
- remove unnecessary fake data from PE/COFF head (like linker versions)
- macro-ize and refactor Makefile according to Jan's feedback
- break PE/COFF header into its own file
- shrink the PE/COFF to start 0x40 instead of 0x80 (my tests showed
this function with no problem, on a live nested vm or using
objdump/objcopy)
- support SOURCE_EPOCH for posix time
- removed `date` invocation that would break on FreeBSD
- style changes
- And obviously, ported to current HEAD
Daniel Kiper (5):
xen: add XEN_BUILD_POSIX_TIME
xen/x86: manually build xen.mb.efi binary
xen/x86: add some addresses to the Multiboot header
xen/x86: add some addresses to the Multiboot2 header
xen/x86/efi: Verify dom0 kernel with SHIM_LOCK protocol in
efi_multiboot2()
xen/Makefile | 22 ++++---
xen/arch/x86/Makefile | 7 +-
xen/arch/x86/arch.mk | 2 +
xen/arch/x86/boot/Makefile | 1 +
xen/arch/x86/boot/head.S | 53 +++++++++++++--
xen/arch/x86/boot/pecoff.S | 123 +++++++++++++++++++++++++++++++++++
xen/arch/x86/efi/efi-boot.h | 30 ++++++++-
xen/arch/x86/efi/stub.c | 17 ++++-
xen/arch/x86/xen.lds.S | 34 ++++++++++
xen/common/efi/boot.c | 19 ++++--
xen/include/xen/compile.h.in | 1 +
xen/include/xen/efi.h | 1 +
12 files changed, 283 insertions(+), 27 deletions(-)
create mode 100644 xen/arch/x86/boot/pecoff.S
--
2.30.0