Re: [PATCHv7 00/13] kexec: Use BPF lskel to enable kexec to load PE format boot image

["Ard Biesheuvel" <ardb@kernel.org>]

Hi Jason,

Thanks for chiming in.

On Sun, 11 Oct 2026, at 22:13, Jason Gunthorpe wrote:
> On Sun, Mar 22, 2026 at 09:43:49AM +0800, Pingfan Liu wrote:
>> *** The history ***
>> 
>> Nowadays, UEFI PE bootable images are becoming increasingly popular
>> among distributions. Currently, we have several kinds of image format
>> parsers in user space (kexec-tools). However, this approach breaks the
>> integrity protection of the images. To address this integrity protection
>> concern, several approaches have been proposed to resolve this issue,
>> but none of them have been accepted upstream yet.
>> 
>> The summary of those approaches:
>>   -1. UEFI service emulator for UEFI stub
>>   -2. PE format parser in kernel
>>   -3. Signing the arm64/boot/Image
>
> I recently had an interesting discussion with Ard around DRTM for
> kexec and we sort of independently concluded that #1 would be the best
> (only?) option there.
>
> All the implementations of DRTM today live in the EFI stub and
> intercept the boot process as it goes along. After ExitBootServices
> the DRTM implementation will launch the kernel in a different way.
> Even worse today's x86 version strongly requires EFI boot services to
> connect the Linux stub with a trampoline helper provided earlier in
> the boot chain.
>
> A kexec flow that only works on decompressed vmlinux, with no option
> to run any EFI code, is going to be difficult to support. There is
> enough information and choices involved in DRTM that it is undesirable
> for the predecessor kernel to try and DRTM launch it on behalf of the
> successor, let alone trying to get the insane x86 trampolines into a
> kexec successor kernel.
>
> Given those constraints entering the successor kernel through the
> normal EFI entry point is highly desirable. This would allow x86 to
> continue to provide the DRTM trampolines through an EFI mechanism and
> means the Linux EFI stub always handles the launch with identical code
> in all scenarios.
>

With some help from my friend Claude, I've prepared a prototype that
reuses my efiloader Rust crate to boot EFI stub images (bare Image,
zboot, UKI) in the kernel: the EFI boot phase is invoked at kexec
load time, and runs under the preceding kernel up until the point
where ExitBootServices() is called. Then, the actual kexec call
will return from ExitBootServices() after shutting down the first
kernel.

https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=efiloader-kexec

There are some limitations (4k pages only, CONTIG_ALLOC support
required) but it seems to work as expected.

I haven't looked at measured boot or DRTM specifics.