stub: call inner kernel directly

Since shim 16, it is not possible anymore to override the security arch
protocol to avoid signature check and measurements.

Also on Dell servers, EFI_SECURITY2_ARCH_PROTOCOL is not implemented, so
unexpected measurements on PCR 4 were still happening.

This just loads and run the kernel pe. We verify that there is no relocation
needed. Also for simplification, we assume and verify that the base address is
expected to be 0.
This commit is contained in:
Valentin David
2025-06-11 13:04:53 +02:00
parent 114ad16c4d
commit cab9c7b5a4
5 changed files with 202 additions and 101 deletions
+2 -1
View File
@@ -2688,7 +2688,8 @@ static EFI_STATUS call_image_start(
if (err == EFI_UNSUPPORTED && entry->type == LOADER_LINUX) {
uint32_t compat_address;
err = pe_kernel_info(loaded_image->ImageBase, &compat_address, /* ret_size_in_memory= */ NULL);
err = pe_kernel_info(loaded_image->ImageBase, /* ret_entry_point= */ NULL, &compat_address,
/* ret_image_base= */ NULL, /* ret_size_in_memory= */ NULL);
if (err != EFI_SUCCESS) {
if (err != EFI_UNSUPPORTED)
return log_error_status(err, "Error finding kernel compat entry address: %m");