On 05/09/2025 1:10 pm, Gerald Elder-Vass wrote:
> diff --git a/xen/common/efi/boot.c b/xen/common/efi/boot.c
> index ccbfc401f7ba..0a72c293301d 100644
> --- a/xen/common/efi/boot.c
> +++ b/xen/common/efi/boot.c
> @@ -1047,6 +1056,46 @@ static UINTN __init
> efi_find_gop_mode(EFI_GRAPHICS_OUTPUT_PROTOCOL *gop,
> return gop_mode;
> }
>
> +static void __init efi_verify_kernel(EFI_HANDLE ImageHandle)
> +{
> + static EFI_GUID __initdata shim_image_guid = SHIM_IMAGE_LOADER_GUID;
> + static EFI_GUID __initdata shim_lock_guid = SHIM_LOCK_PROTOCOL_GUID;
> + SHIM_IMAGE_LOADER *shim_loader;
> + EFI_HANDLE loaded_kernel;
> + EFI_SHIM_LOCK_PROTOCOL *shim_lock;
> + EFI_STATUS status;
> + bool verified = false;
> +
> + /* Look for LoadImage first */
> + if ( !EFI_ERROR(efi_bs->LocateProtocol(&shim_image_guid, NULL,
> + (void **)&shim_loader)) )
> + {
> + status = shim_loader->LoadImage(false, ImageHandle, NULL,
> + (void *)kernel.ptr, kernel.size,
> + &loaded_kernel);
> + if ( !EFI_ERROR(status) )
> + verified = true;
> +
> + /* LoadImage performed verification, now clean up with UnloadImage */
I think this wants a bit of the explanation given in reply to v3.
Something like:
/* Always unload the image. We only wanted LoadImage to perform
verification anyway, and in the case of a failure, there may still be
cleanup needing to be performed. */
I can fix this on commit if there are no other concerns.
~Andrew
