Re: [PATCH v2 1/7] x86/kexec: add digest checks

[Jan Beulich <jbeulich@xxxxxxxx>]

On 23.06.2026 18:08, Andrew Cooper wrote:
> On 23/06/2026 3:44 pm, Jan Beulich wrote:
>> On 22.06.2026 17:18, Kevin Lampis wrote:
>>> From: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
>>>
>>> To support UEFI Secure Boot we must check that the kexec data has not
>>> changed between signature verification and actual execution.
>>> However, this is also a good check to perform generally.
>>>
>>> During kexec load, calculate a digest over all the kexec segments. This
>>> digest is stored and verified again later prior to entering the image.
>>>
>>> For now, only kexec crash images are supported.
>>>
>>> Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
>>> Signed-off-by: Kevin Lampis <kevin.lampis@xxxxxxxxxx>
>> I guess I'm not quite following here. For secure boot purposes, shouldn't
>> the new kernel already come with a digest (or really with a signature),
>> which we could check in both kexec_load() and kexec_crash()? If we check
>> against a digest we calculated ourselves, we'd apply more trust than we
>> should.
> 
> There are two problems.
> 
> One is plain TOCTOU.  We load the crash kernel at boot, and we jump to
> it in the case that something has fatally-but-not-catastrophically gone
> wrong.  Really, the digest here is an integrity check.
> 
> One is that Xen cannot perform the signature check on the passed
> kernel.  At least, not without gaining a full X.509 stack and
> authenticode algorithm, or a PGP implementation or equivalent. 
> ExitBootServices() nukes SHIM_LOCK/LOADER protocols so they cannot be
> used later in runtime.
> 
> Because we are defining the TCB of the system as "Xen + Dom0 kernel",
> it's fine to let Dom0 do the certificate check and say "trust me, I
> checked this" to Xen (albeit requiring that dom0 userspace can't issue
> the hypercall).  In the current implementation the dom0 checks the
> signature of the binary that userspace proposes, and either rejects it
> or passes it forward to Xen.
> 
> All Xen needs to do is ensure that the bytes the dom0 kernel said were
> good are still the same bytes we're about to jump into.  Hence the
> integrity check, which is a good move even in the non UEFI-SB case.

I.e. "To support UEFI Secure Boot we must check ..." in the description
is really misleading.

Jan