linux-kernel - Re: EFI and multiboot2 devlopment work for Xen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 22 Oct 2013 15:42:42 +0000
From:	"Woodhouse, David" <david.woodhouse@...el.com>
To:	Matthew Garrett <mjg59@...f.ucam.org>
CC:	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
	Jan Beulich <JBeulich@...e.com>,
	Ian Campbell <ian.campbell@...rix.com>,
	"ross.philipson@...rix.com" <ross.philipson@...rix.com>,
	"stefano.stabellini@...citrix.com" <stefano.stabellini@...citrix.com>,
	"grub-devel@....org" <grub-devel@....org>,
	"Maliszewski, Richard L" <richard.l.maliszewski@...el.com>,
	"xen-devel@...ts.xen.org" <xen-devel@...ts.xen.org>,
	"boris.ostrovsky@...cle.com" <boris.ostrovsky@...cle.com>,
	Daniel Kiper <daniel.kiper@...cle.com>,
	"Peter Jones" <pjones@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"keir@....org" <keir@....org>
Subject: Re: EFI and multiboot2 devlopment work for Xen

On Tue, 2013-10-22 at 16:32 +0100, Matthew Garrett wrote:
> 
> There are two problems with this:
> 
> 1) The kernel will only boot if it's signed with a key in db, not a key 
> in MOK.
> 2) grub will read the kernel, but the kernel will have to read the 
> initramfs using EFI calls. That means your initramfs must be on a FAT 
> partition.
> 
> If you're happy with those limitations then just use the chainloader 
> command. If you're not, use the linuxefi command.

Well, we're talking about booting the Xen hypervisor aren't we?

So yes, there are reasons the Linux kernel uses the 'boot stub' the way
it does, but I'm not sure we advocate that Xen should emulate that in
all its 'glory'?

-- 
                   Sent with MeeGo's ActiveSync support.

David Woodhouse                            Open Source Technology Centre
David.Woodhouse@...el.com                              Intel Corporation




Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (4370 bytes)