Re: [PATCH v2 0/6] efi: implement generic compressed boot support

[Matthew Garrett <mjg59@srcf.ucam.org>]

On Tue, Aug 09, 2022 at 10:09:38AM +0200, Ard Biesheuvel wrote:

> The only slight downside is that when UEFI secure boot is enabled, the
> generic LoadImage/StartImage only allow signed images to be loaded and
> started, and we prefer to avoid the need to sign both the inner and
> outer PE/COFF images. This series adopts the EFI shim approach, i.e., to
> override an internal UEFI/PI protocol that is used by the image loader,
> to allow the inner image to be booted after decompression. This has been
> tested to work with Tianocore based EFI implementations on arm64, but
> u-boot will need some interoperability tweaks as well, ideally just a
> protocol that exposes a LoadImage/StartImage combo that the decompresor
> can use directly to circumvent the signature check. (Note that EFI apps
> have full control over the CPU, page tables, etc. so having code that
> circumvents authentication checks is not as crazy as it sounds, given
> that the app can do anything it pleases already.)

I think it's worth mentioning that Shim doesn't do this by default 
because it's not guaranteed that something implementing the UEFI DXE 
layer also implements the PI layer. I don't have an objection to it 
being an expectation on any Linux-supporting platform that the 
implementation works this way, but it should maybe be made clear that 
this could unexpectedly fail on generic platforms.