From f4ef206f36783c713a1367d4237e463ed0fc1808 Mon Sep 17 00:00:00 2001
From: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Thu, 20 Aug 2026 13:06:13 +0200
Subject: [PATCH] Introduce ".loader" section manifesting the default next boot
 target

Offline PCR prediction without fallback CSV file requires the knowledge of
the next boot target after shim. While this is normally "grub{arch}.efi" in
the vendor directory where shim binary is (or just in 'BOOT'), it is also
customizable via DEFAULT_LOADER. Introduce a new section in shim binary and
export the information explicitly.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 Makefile            |  5 +++--
 default_loader.S    | 12 ++++++++++++
 elf_aarch64_efi.lds |  5 +++++
 elf_arm_efi.lds     |  1 +
 elf_ia32_efi.lds    |  5 +++++
 elf_ia64_efi.lds    |  5 +++++
 elf_x86_64_efi.lds  |  5 +++++
 7 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 default_loader.S

diff --git a/Makefile b/Makefile
index 391ca1986..81a63c1fd 100644
--- a/Makefile
+++ b/Makefile
@@ -62,6 +62,7 @@ OBJS	= shim.o \
 	  utils.o \
 	  verify.o \
 	  version.o \
+	  default_loader.o \
 
 KEYS	= shim_cert.h \
 	  ocsp.* \
@@ -432,7 +433,7 @@ endif
 	$(OBJCOPY) -D -j .text -j .sdata -j .data -j .data.ident \
 		-j .dynamic -j .rodata -j .rel* \
 		-j .rela* -j .dyn -j .reloc -j .eh_frame \
-		-j .vendor_cert -j .sbat -j .sbatlevel \
+		-j .vendor_cert -j .sbat -j .sbatlevel -j .loader \
 		--file-alignment 0x1000 \
 		--section-alignment $(ARCH_SECTION_ALIGNMENT) \
 		$(FORMAT) $< $@
@@ -450,7 +451,7 @@ endif
 	$(OBJCOPY) -D -j .text -j .sdata -j .data \
 		-j .dynamic -j .rodata -j .rel* \
 		-j .rela* -j .dyn -j .reloc -j .eh_frame -j .sbat \
-		-j .sbatlevel \
+		-j .sbatlevel -j .loader \
 		-j .debug_info -j .debug_abbrev -j .debug_aranges \
 		-j .debug_line -j .debug_str -j .debug_ranges \
 		-j .note.gnu.build-id \
diff --git a/default_loader.S b/default_loader.S
new file mode 100644
index 000000000..ef13e4943
--- /dev/null
+++ b/default_loader.S
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+
+	.section .loader, "a", %progbits
+	.balign	1, 0
+	.globl	default_loader
+	.type	default_loader, %object
+	.size	default_loader, .Ldefault_loader_end - default_loader
+default_loader:
+	.ascii DEFAULT_LOADER_CHAR
+	.byte	0
+.Ldefault_loader_end:
+	.section .note.GNU-stack,"a"
diff --git a/elf_aarch64_efi.lds b/elf_aarch64_efi.lds
index 7f26a1457..84cd265a3 100644
--- a/elf_aarch64_efi.lds
+++ b/elf_aarch64_efi.lds
@@ -35,6 +35,11 @@ SECTIONS
     *(.sbatlevel)
   }
 
+  . = ALIGN(65536);
+  .loader : {
+    *(.loader)
+  }
+
   . = ALIGN(65536);
   .data :
   {
diff --git a/elf_arm_efi.lds b/elf_arm_efi.lds
index 66185a4fc..0682ac545 100644
--- a/elf_arm_efi.lds
+++ b/elf_arm_efi.lds
@@ -88,6 +88,7 @@ SECTIONS
     . = ALIGN(4096);
     *(.vendor_cert)
     *(.data.ident)
+    *(.loader)
     . = ALIGN(4096);
   }
   . = ALIGN(4096);
diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds
index 3f22c9336..eb06d7a1b 100644
--- a/elf_ia32_efi.lds
+++ b/elf_ia32_efi.lds
@@ -29,6 +29,11 @@ SECTIONS
     *(.sbatlevel)
   }
 
+  . = ALIGN(4096);
+  .loader : {
+    *(.loader)
+  }
+
   . = ALIGN(4096);
   .data :
   {
diff --git a/elf_ia64_efi.lds b/elf_ia64_efi.lds
index a2195609c..06d04510b 100644
--- a/elf_ia64_efi.lds
+++ b/elf_ia64_efi.lds
@@ -39,6 +39,11 @@ SECTIONS
     *(.sbatlevel)
   }
 
+  . = ALIGN(4096);
+  .loader : {
+    *(.loader)
+  }
+
   . = ALIGN(4096);
   .data :
   {
diff --git a/elf_x86_64_efi.lds b/elf_x86_64_efi.lds
index 56a1c71bf..d0589c155 100644
--- a/elf_x86_64_efi.lds
+++ b/elf_x86_64_efi.lds
@@ -36,6 +36,11 @@ SECTIONS
     *(.sbatlevel)
   }
 
+  . = ALIGN(4096);
+  .loader : {
+    *(.loader)
+  }
+
   . = ALIGN(4096);
   .data :
   {