[v2,0/2] x86: Multiboot PE support

Message

Ross Lagerwall March 28, 2024, 3:11 p.m. UTC

Hi,

This patches series implements support for building a multiboot-capable
PE binary in addition to the existing xen.efi and xen.gz. The purpose of
this is to allow the same binary to be booted using BIOS, UEFI, and UEFI
with Secure Boot verification just like it can be done with a Linux
kernel. It also means that it is possible to enable Secure Boot while
still retaining the flexibility of a full bootloader like GRUB2 - not
currently possible when using xen.efi.

This requires a multiboot2 loader that supports loading PE binaries.
Changes to implement this in GRUB will be sent in a separate series.

Ross

Changed in v2:

* Adjusted for changes to the proposed multiboot2 spec changes. In
  particular, there are no new multiboot2 tags needed.
* Unconditionally build a new binary rather than adding a build option.
* Avoid compressing it since this makes verification more difficult.
* Build the new binary as a modification of xen.efi rather than
  relinking from scratch.

Ross Lagerwall (2):
  x86: Add support for building a multiboot2 PE binary
  x86: Call Shim Verify in the multiboot2 path

 .gitignore                        |  2 +
 xen/Makefile                      |  1 +
 xen/arch/x86/Makefile             | 16 ++++++-
 xen/arch/x86/boot/head.S          |  4 +-
 xen/arch/x86/efi/efi-boot.h       | 65 +++++++++++++++++++++++++-
 xen/arch/x86/efi/modify-mbi-exe.c | 77 +++++++++++++++++++++++++++++++
 6 files changed, 162 insertions(+), 3 deletions(-)
 create mode 100644 xen/arch/x86/efi/modify-mbi-exe.c