add a note on -shim to direct kernel boot docs
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> Link: https://lore.kernel.org/qemu-devel/20260612161707.158029-1-kraxel@redhat.com Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Gerd Hoffmann committed
Jun 12, 2026 at 18:17 UTC
717cd7bc7602323ef03ddd63046e66e20f17dcb6
1 file changed
+17
docs/system/linuxboot.rst
+17
@@ -17,6 +17,23 @@ Use ``-kernel`` to provide the Linux kernel image and ``-append`` to
17
give the kernel command line arguments. The ``-initrd`` option can be
18
used to provide an INITRD image.
19
20
+The ``-shim`` option specifies the ``shim.efi`` binary. This is needed
21
+when you are booting UEFI firmware and using the ``-kernel`` option to
22
+tell UEFI to boot a specific kernel image, and the UEFI firmware you
23
+are booting has UEFI secure boot enabled.
24
+
25
+When this option is specified, the guest UEFI firmware will first
26
+load, verify and run the shim binary, which is typically signed by
27
+Microsoft so the firmware accepts it. The shim binary in turn will
28
+load and verify the Linux kernel. The kernel is typically signed by
29
+the distro and the certificates needed to verify them are compiled
30
+into the shim binary, so shim and kernel must come from the same Linux
31
+distribution.
32
+
33
+Usually you can find shim.efi as ``EFI/BOOT/BOOT{X64,AA64}.EFI`` on
34
+distro install media. You might find a second shim copy in the
35
+``EFI/$distro/`` directory.
36
+
37
If you do not need graphical output, you can disable it and redirect the
38
virtual serial port and the QEMU monitor to the console with the
39
``-nographic`` option. The typical command line is: