Re: [Xen-devel] Booting signed xen.efi through shim

2017-10-27 Thread Tamas K Lengyel
On Fri, Sep 22, 2017 at 5:11 PM, Daniel Kiper wrote: > On Fri, Sep 22, 2017 at 02:25:46AM -0600, Jan Beulich wrote: >> >>> On 22.09.17 at 00:46, wrote: >> > One piece that I see still missing is the Xen command line parameters >> > not being verified. It would be ideal to have the option to get t

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-22 Thread Daniel Kiper
On Fri, Sep 22, 2017 at 02:25:46AM -0600, Jan Beulich wrote: > >>> On 22.09.17 at 00:46, wrote: > > One piece that I see still missing is the Xen command line parameters > > not being verified. It would be ideal to have the option to get that > > set during compile time as well, similar to Linux's

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-22 Thread Tamas K Lengyel
On Fri, Sep 22, 2017 at 2:25 AM, Jan Beulich wrote: On 22.09.17 at 00:46, wrote: >> One piece that I see still missing is the Xen command line parameters >> not being verified. It would be ideal to have the option to get that >> set during compile time as well, similar to Linux's CONFIG_CMDL

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-22 Thread Jan Beulich
>>> On 22.09.17 at 00:46, wrote: > One piece that I see still missing is the Xen command line parameters > not being verified. It would be ideal to have the option to get that > set during compile time as well, similar to Linux's CONFIG_CMDLINE > option, to avoid for example getting iommu or XSM b

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-21 Thread Tamas K Lengyel
On Wed, Sep 20, 2017 at 10:10 AM, Daniel Kiper wrote: > On Wed, Sep 20, 2017 at 09:59:51AM -0600, Tamas K Lengyel wrote: >> On Wed, Sep 20, 2017 at 9:46 AM, Jan Beulich wrote: >> On 20.09.17 at 17:20, wrote: >> >> On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: >> >> On 20.09.17 a

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-21 Thread Tamas K Lengyel
On Wed, Sep 20, 2017 at 10:10 AM, Daniel Kiper wrote: > On Wed, Sep 20, 2017 at 09:59:51AM -0600, Tamas K Lengyel wrote: >> On Wed, Sep 20, 2017 at 9:46 AM, Jan Beulich wrote: >> On 20.09.17 at 17:20, wrote: >> >> On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: >> >> On 20.09.17 a

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-20 Thread Daniel Kiper
On Wed, Sep 20, 2017 at 09:59:51AM -0600, Tamas K Lengyel wrote: > On Wed, Sep 20, 2017 at 9:46 AM, Jan Beulich wrote: > On 20.09.17 at 17:20, wrote: > >> On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: > >> On 20.09.17 at 00:23, wrote: > Yeap, the shim pretty simply removed

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-20 Thread Tamas K Lengyel
On Wed, Sep 20, 2017 at 9:46 AM, Jan Beulich wrote: On 20.09.17 at 17:20, wrote: >> On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: >> On 20.09.17 at 00:23, wrote: Yeap, the shim pretty simply removed the .reloc section as it was marked discardable and did the relocation

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-20 Thread Jan Beulich
>>> On 20.09.17 at 17:20, wrote: > On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: > On 20.09.17 at 00:23, wrote: >>> Yeap, the shim pretty simply removed the .reloc section as it was >>> marked discardable and did the relocations for Xen. So with that >>> removed from the shim I no lon

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-20 Thread Tamas K Lengyel
On Wed, Sep 20, 2017 at 12:30 AM, Jan Beulich wrote: On 20.09.17 at 00:23, wrote: >> On Mon, Sep 18, 2017 at 2:58 AM, Jan Beulich wrote: >> On 14.09.17 at 18:20, wrote: Of course, you can grab them from here: https://drive.google.com/drive/folders/0B5duyI9SzNtWaXE0cjM1QzZJbVk

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-19 Thread Jan Beulich
>>> On 20.09.17 at 00:23, wrote: > On Mon, Sep 18, 2017 at 2:58 AM, Jan Beulich wrote: > On 14.09.17 at 18:20, wrote: >>> Of course, you can grab them from here: >>> https://drive.google.com/drive/folders/0B5duyI9SzNtWaXE0cjM1QzZJbVk?usp=shar >>> >>> ing >> >> So the dumps of the two (usin

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-19 Thread Tamas K Lengyel
On Mon, Sep 18, 2017 at 2:58 AM, Jan Beulich wrote: On 14.09.17 at 18:20, wrote: >> Of course, you can grab them from here: >> https://drive.google.com/drive/folders/0B5duyI9SzNtWaXE0cjM1QzZJbVk?usp=shar >> ing > > So the dumps of the two (using my own tool) are identical except for > the ex

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-18 Thread Jan Beulich
>>> On 13.09.17 at 11:21, wrote: On 13.09.17 at 07:27, wrote: >> CONTENTS, ALLOC, LOAD, DATA >> 6 .bss 00143280 82d08082 82d08082 2**4 >> ALLOC, RELOC > > Objdump is apparently ignoring a section attribute bit here - m

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-17 Thread Jan Beulich
>>> On 14.09.17 at 18:20, wrote: > Of course, you can grab them from here: > https://drive.google.com/drive/folders/0B5duyI9SzNtWaXE0cjM1QzZJbVk?usp=shar > ing So the dumps of the two (using my own tool) are identical except for the expected difference due to the certificate. In particular neith

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-14 Thread Tamas K Lengyel
On Thu, Sep 14, 2017 at 12:06 PM, Jan Beulich wrote: On 14.09.17 at 17:43, wrote: >> On Wed, Sep 13, 2017 at 11:42 AM, Jan Beulich wrote: >> On 13.09.17 at 16:40, wrote: On Wed, Sep 13, 2017 at 3:21 AM, Jan Beulich wrote: On 13.09.17 at 07:27, wrote: >>Sections: >>>

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-14 Thread Jan Beulich
>>> On 14.09.17 at 17:43, wrote: > On Wed, Sep 13, 2017 at 11:42 AM, Jan Beulich wrote: > On 13.09.17 at 16:40, wrote: >>> On Wed, Sep 13, 2017 at 3:21 AM, Jan Beulich wrote: >>> On 13.09.17 at 07:27, wrote: >Sections: >Idx Name Size VMA LMA

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-14 Thread Tamas K Lengyel
On Wed, Sep 13, 2017 at 11:42 AM, Jan Beulich wrote: On 13.09.17 at 16:40, wrote: >> On Wed, Sep 13, 2017 at 3:21 AM, Jan Beulich wrote: >> On 13.09.17 at 07:27, wrote: Sections: Idx Name Size VMA LMA File off Algn 0 .text

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-13 Thread Jan Beulich
>>> On 13.09.17 at 16:40, wrote: > On Wed, Sep 13, 2017 at 3:21 AM, Jan Beulich wrote: > On 13.09.17 at 07:27, wrote: >>>Sections: >>>Idx Name Size VMA LMA File off >>>Algn >>> 0 .text 0017a1ba 82d08020 82d08020 1000

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-13 Thread Tamas K Lengyel
On Wed, Sep 13, 2017 at 3:21 AM, Jan Beulich wrote: On 13.09.17 at 07:27, wrote: >>Sections: >>Idx Name Size VMA LMA File off Algn >> 0 .text 0017a1ba 82d08020 82d08020 1000 >> 2**12 >> CONTENTS, AL

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-13 Thread Jan Beulich
>>> On 13.09.17 at 07:27, wrote: >Sections: >Idx Name Size VMA LMA File off Algn > 0 .text 0017a1ba 82d08020 82d08020 1000 2**12 > CONTENTS, ALLOC, LOAD, CODE > 1 .rodata 000826a0 82d08040

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-13 Thread Jan Beulich
>>> On 13.09.17 at 01:40, wrote: > for the last couple weeks I've been poking around the options > available to get Xen booted on a Secureboot enabled box. My goal is to > extend the chain of trust to the dom0 kernel. According to > https://wiki.xenproject.org/wiki/Xen_EFI this is something that's

Re: [Xen-devel] Booting signed xen.efi through shim

2017-09-12 Thread Daniel Kiper
Hi Tamas, On Tue, Sep 12, 2017 at 05:40:35PM -0600, Tamas K Lengyel wrote: > Hi all, > for the last couple weeks I've been poking around the options > available to get Xen booted on a Secureboot enabled box. My goal is to > extend the chain of trust to the dom0 kernel. According to > https://wiki.

[Xen-devel] Booting signed xen.efi through shim

2017-09-12 Thread Tamas K Lengyel
Hi all, for the last couple weeks I've been poking around the options available to get Xen booted on a Secureboot enabled box. My goal is to extend the chain of trust to the dom0 kernel. According to https://wiki.xenproject.org/wiki/Xen_EFI this is something that's supposed to be supported out-of-t