Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934331AbeAKMvO (ORCPT + 1 other); Thu, 11 Jan 2018 07:51:14 -0500 Received: from mail-it0-f68.google.com ([209.85.214.68]:45639 "EHLO mail-it0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754365AbeAKMvJ (ORCPT ); Thu, 11 Jan 2018 07:51:09 -0500 X-Google-Smtp-Source: ACJfBot5w3Z9fKlQlY0ndBuvdm5w820z++D9HVf1BMnqPTjuCHzJ3KeL/PMOCNllRLiMOdjW6jpdJJq9iiZSqqKJROA= MIME-Version: 1.0 In-Reply-To: <1515507745-17391-1-git-send-email-daniel.kiper@oracle.com> References: <1515507745-17391-1-git-send-email-daniel.kiper@oracle.com> From: Ard Biesheuvel Date: Thu, 11 Jan 2018 12:51:07 +0000 Message-ID: Subject: Re: [PATCH 0/4] x86/xen/efi: Initialize UEFI secure boot state during dom0 boot To: Daniel Kiper , Ingo Molnar Cc: linux-efi@vger.kernel.org, Linux Kernel Mailing List , "the arch/x86 maintainers" , xen-devel , Boris Ostrovsky , "H. Peter Anvin" , Juergen Gross , Konrad Rzeszutek Wilk , Thomas Gleixner Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 9 January 2018 at 14:22, Daniel Kiper wrote: > Hi, > > Initialize UEFI secure boot state during dom0 boot. Otherwise the kernel > may not even know that it runs on secure boot enabled platform. > Hi Daniel, I must say, I am not too thrilled with the approach you have chosen here. #including .c files in other .c files, and using #defines to override C functions or other stub functionality is rather fragile. In particular, it means we have to start caring about not breaking Xen/x86 code when making modifications to the EFI stub, and that code is already difficult enough to maintain, given that it is shared between ARM, arm64 and x86, and runs either from the decompressor or the kernel proper (arm64) but in the context of the UEFI firmware. None of the stub code currently runs in ordinary kernel context. So please, could you try to find another way to do this? Thanks, Ard. > > arch/x86/xen/Makefile | 4 +++- > arch/x86/xen/efi.c | 14 +++++++++++++ > drivers/firmware/efi/libstub/secureboot-core.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > drivers/firmware/efi/libstub/secureboot.c | 66 +++++------------------------------------------------------ > 4 files changed, 99 insertions(+), 62 deletions(-) > > Daniel Kiper (4): > efi/stub: Extract efi_get_secureboot() to separate file > x86/xen/efi: Initialize boot_params.secure_boot in xen_efi_init() > efi: Tweak efi_get_secureboot() and its data section assignment > efi: Rename efi_get_secureboot() to __efi_get_secureboot() and make it static >