summaryrefslogtreecommitdiffstats
path: root/src/arch
Commit message (Collapse)AuthorAgeFilesLines
...
* [block] Replace gPXE block-device API with an iPXE asynchronous interfaceMichael Brown2010-09-1417-1924/+744Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The block device interface used in gPXE predates the invention of even the old gPXE data-transfer interface, let alone the current iPXE generic asynchronous interface mechanism. Bring this old code up to date, with the following benefits: o Block device commands can be cancelled by the requestor. The INT 13 layer uses this to provide a global timeout on all INT 13 calls, with the result that an unexpected passive failure mode (such as an iSCSI target ACKing the request but never sending a response) will lead to a timeout that gets reported back to the INT 13 user, rather than simply freezing the system. o INT 13,00 (reset drive) is now able to reset the underlying block device. INT 13 users, such as DOS, that use INT 13,00 as a method for error recovery now have a chance of recovering. o All block device commands are tagged, with a numerical tag that will show up in debugging output and in packet captures; this will allow easier interpretation of bug reports that include both sources of information. o The extremely ugly hacks used to generate the boot firmware tables have been eradicated and replaced with a generic acpi_describe() method (exploiting the ability of iPXE interfaces to pass through methods to an underlying interface). The ACPI tables are now built in a shared data block within .bss16, rather than each requiring dedicated space in .data16. o The architecture-independent concept of a SAN device has been exposed to the iPXE core through the sanboot API, which provides calls to hook, unhook, boot, and describe SAN devices. This allows for much more flexible usage patterns (such as hooking an empty SAN device and then running an OS installer via TFTP). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Reduce length of "Features" startup bannerMichael Brown2010-09-121-1/+1
| | | | | | | Minimise the chances of an unwanted line wrap on the iPXE feature list printed at startup. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Call netdev_link_[up|down|err]() only while registeredMichael Brown2010-09-051-3/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xfer] Generalise metadata "whence" field to "flags" fieldMichael Brown2010-09-031-1/+1
| | | | | | | | | | | | | iPXE has never supported SEEK_END; the usage of "whence" offers only the options of SEEK_SET and SEEK_CUR and so is effectively a boolean flag. Further flags will be required to support additional metadata required by the Fibre Channel network model, so repurpose the "whence" field as a generic "flags" field. xfer_seek() has always been used with SEEK_SET, so remove the "whence" field altogether from its argument list. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix misaligned table entries when using gcc 4.5Piotr Jaroszyński2010-08-201-1/+1
| | | | | | | | | | Declarations without the accompanying __table_entry cause misalignment of the table entries when using gcc 4.5. Fix by adding the appropriate __table_entry macro or (where possible) by removing unnecessary forward declarations. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add command line argumentsPiotr Jaroszyński2010-08-192-0/+6
| | | | | | | | | | | Support qemu-like arguments for network setup: --net driver_name[,setting=value]* and global settings: --settings setting=value[,setting=value]* Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add most of the linux apiPiotr Jaroszyński2010-08-192-0/+283
| | | | | Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add linux_syscallPiotr Jaroszyński2010-08-192-0/+78
| | | | | | | Add linux_syscall for both i386 and x86_64. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add linux api headersPiotr Jaroszyński2010-08-193-0/+18
| | | | | Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add linuxprefixPiotr Jaroszyński2010-08-192-0/+47
| | | | | | | Add a minimal _start required to run main. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Use i386-pcbios DHCP options on linuxPiotr Jaroszyński2010-08-191-0/+36
| | | | | Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Add linux platform skeletonPiotr Jaroszyński2010-08-196-2/+227
| | | | | | | | Add makefiles, ld scripts and default config for linux platform for both i386 and x86_64. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Provide %.fd0 build targets only for pcbiosMichael Brown2010-08-172-15/+7Star
| | | | | Originally-fixed-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Build pcbios specific drivers only on pcbiosPiotr Jaroszyński2010-08-162-2/+4
| | | | | Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ioapi] Move get_memmap() to the I/O API groupPiotr Jaroszyński2010-08-167-8/+9
| | | | | | | | | pcbios specific get_memmap() is used by the b44 driver making all-drivers builds fail on other platforms. Move it to the I/O API group and provide a dummy implementation on EFI. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [comboot] Run com32 programs with a valid IDTGeoff Lywood2010-08-014-6/+138
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | COM32 binaries generally expect to run with interrupts enabled. Syslinux does so, and COM32 programs will execute cli/sti pairs when running a critical section, to provide mutual exclusion against BIOS interrupt handlers. Previously, under iPXE, the IDT was not valid, so any interrupt (e.g. a timer tick) would generally cause the machine to triple fault. This change introduces code to: - Create a valid IDT at the same location that syslinux uses - Create an "interrupt jump buffer", which contains small pieces of code that simply record the vector number and jump to a common handler - Thunk down to real mode and execute the BIOS's interrupt handler whenever an interrupt is received in a COM32 program - Switch IDTs and enable/disable interrupts when context switching to and from COM32 binaries Testing done: - Booted VMware ESX using a COM32 multiboot loader (mboot.c32) - Built with GDBSERIAL enabled, and tested breakpoints on int22 and com32_irq - Put the following code in a COM32 program: asm volatile ( "sti" ); while ( 1 ); Before this change, the machine would triple fault immediately. After this change, it hangs as expected. Under Bochs, it is possible to see the interrupt handler run, and the current time in the BIOS data area gets incremented. Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [string] Use 64-bit registers in assembly memswap() on x86_64Joshua Oreman2010-08-011-4/+4
| | | | | | | | | An assembly version of memswap() is in an x86 word-length-agnostic header file, but it used 32-bit registers to store pointers, leading to memory errors responding to ARP queries on 64-bit systems. Signed-off-by: Joshua Oreman <oremanj@rwcr.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Do not check for BBS compatibilityMichael Brown2010-06-241-29/+3Star
| | | | | | | | | The existence and usage of the BEV entry point is covered by the PnP spec, not the BBS spec; the BBS spec merely describes a policy for selecting the boot device order. iPXE should therefore check only for a PnP BIOS in order to decide whether or not to hook INT19. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix broken build caused by implied dependency upon "perl"Michael Brown2010-06-241-4/+4
| | | | | | | | | | | | | | | | | Commit ea12dc0 ("[build] Avoid hard-coding the path to perl") introduced a build failure for fully clean trees (e.g. after running "make veryclean"), since the dependency upon $(PARSEROM) now includes a dependency upon "perl" (which doesn't exist) rather than upon "/usr/bin/perl" (which does exist). There should of course be no dependency upon the perl binary at all; the dependency should be upon "./util/parserom.pl" alone. Fix by removing the $(PERL) from the definition of Perl-based utility paths, and adding $(PERL) at the point of usage. Reported-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Convert all data-xfer interfaces to generic interfacesMichael Brown2010-06-222-69/+58Star
| | | | | | | | | | | | | | Remove data-xfer as an interface type, and replace data-xfer interfaces with generic interfaces supporting the data-xfer methods. Filter interfaces (as used by the TLS layer) are handled using the generic pass-through interface capability. A side-effect of this is that deliver_raw() no longer exists as a data-xfer method. (In practice this doesn't lose any efficiency, since there are no instances within the current codebase where xfer_deliver_raw() is used to pass data to an interface supporting the deliver_raw() method.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Convert all name-resolution interfaces to generic interfacesMichael Brown2010-06-221-32/+33
| | | | | | | | Remove name-resolution as an interface type, and replace name-resolution interfaces with generic interfaces supporting the resolv_done() method. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [doc] Fix comment on Linux/x86 boot protocol pathWu Fengguang2010-06-031-1/+1
| | | | | Signed-off-by: Wu Fengguang <fengguang.wu@intel.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Enable automated extraction of error usage reportsMichael Brown2010-05-312-0/+4
| | | | | | | Add preprocessor magic to the error definitions to enable every error usage to be tracked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pxe] Remove obsolete pxe_errortab.cMichael Brown2010-05-311-103/+0Star
| | | | | | | strerror() has not been able to use the PXE-only error table since commit 9aa61ad ("Add per-file error identifiers") back in 2007. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove PACKED macroMichael Brown2010-05-304-70/+70
| | | | | | | Most of iPXE uses __attribute__((packed)) anyway, and PACKED conflicts with an identically-named macro in the upstream EFI header files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Use correct DHCP options on EFI systemsGeoff Lywood2010-05-293-0/+120
| | | | | | | | See RFC 4578 for details. Signed-off-by: Joshua Oreman <oremanj@rwcr.net> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Fix .efi and .efidrv linkingPiotr Jaroszyński2010-05-274-6/+8
| | | | | | | | | | | | | | The linker chooses to look for _start first and always picks efidrvprefix.o to satisfy it (probably because it's earlier in the archive) which causes a multiple definition error when the linker later has to pick efiprefix.o for other symbols. Fix by using EFI-specific TGT_LD_FLAGS with an explicit entry point. Signed-off-by: Piotr Jaroszyński <p.jaroszynski@gmail.com> Signed-off-by: Joshua Oreman <oremanj@rwcr.net> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Use weak definitions instead of weak declarationsJoshua Oreman2010-05-274-21/+17Star
| | | | | | | | | | | | | | | This removes the need for inline safety wrappers, marginally reducing the size penalty of weak functions, and works around an apparent binutils bug that causes undefined weak symbols to not actually be NULL when compiling with -fPIE (as EFI builds do). A bug in versions of binutils prior to 2.16 (released in 2005) will cause same-file weak definitions to not work with those toolchains. Update the README to reflect our new dependency on binutils >= 2.16. Signed-off-by: Joshua Oreman <oremanj@rwcr.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [comboot] Propagate carry flag from COMBOOT APIStefan Hajnoczi2010-05-253-12/+41
| | | | | | | | | | | | COMBOOT API calls set the carry flag on failure. This was not being propagated because the COMBOOT interrupt handler used iret to return with EFLAGS restored from the stack. This patch propagates CF before returning from the interrupt. Reported-by: Geoff Lywood <glywood@vmware.com> Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Marty Connor <mdc@etherboot.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pxe] Treat PXENV_RESTART_TFTP as unreturnableMichael Brown2010-05-213-7/+17
| | | | | | | | | | | | | | | | | | | | | | | Microsoft WDS can end up calling PXENV_RESTART_TFTP to execute a second-stage NBP which then exits. Specifically, wdsnbp.com uses PXENV_RESTART_TFTP to execute pxeboot.com, which will exit if the user does not press F12. iPXE currently treats PXENV_RESTART_TFTP as a normal PXE API call, and so attempts to return to wdsnbp.com, which has just been vaporised by pxeboot.com. Use rmsetjmp/rmlongjmp to preserve the stack state as of the initial NBP execution, and to restore this state immediately prior to executing the NBP loaded via PXENV_RESTART_TFTP. This matches the behaviour in the PXE spec (which says that "if TFTP is restarted, control is never returned to the caller"), and allows pxeboot.com to exit relatively cleanly back to iPXE. As with all usage of setjmp/longjmp, there may be subtle corner case bugs due to not gracefully unwinding any state accumulated by the time of the longjmp call, but this seems to be the only viable way to provide the specified behaviour. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix building with binutils 2.16Michael Brown2010-04-271-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Add .mrom format, allowing loading of large ROMsMichael Brown2010-04-254-8/+516
| | | | | | | | | | | | | | | | | | | | | Add an infrastructure allowing the prefix to provide an open_payload() method for obtaining out-of-band access to the whole iPXE image. Add a mechanism within this infrastructure that allows raw access to the expansion ROM BAR by temporarily borrowing an address from a suitable memory BAR on the same PCI card. For cards that have a memory BAR that is at least as large as their expansion ROM BAR, this allows large iPXE ROMs to be supported even on systems where PMM fails, or where option ROM space pressure makes it impossible to use PMM shrinking. The BIOS sees only a stub ROM of approximately 3kB in size; the remainder (which can be well over 64kB) is loaded only at the time iPXE is invoked. As a nice side-effect, an iPXE .mrom image will continue to work even if its PMM-allocated areas are overwritten between initialisation and invocation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Replace obsolete makerom.pl with quick script using Option::ROMMichael Brown2010-04-251-0/+4
| | | | | | | | | | | The only remaining useful function of makerom.pl is to correct the ROM and PnP checksums; the PCI IDs are set at link time, and padding is performed using padimg.pl. Option::ROM already provides a facility for correcting the checksums, so we may as well just use this instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Inhibit the use of relocation during POSTMichael Brown2010-04-253-6/+25
| | | | | | | | | | | | | | | It is common for system memory maps to be grotesquely unreliable during POST. Many sanity checks have been added to the memory map reading code, but these do not catch all problems. Skip relocation entirely if called during POST. This should avoid the problems typically encountered, at the cost of slightly disrupting the memory map of an operating system booted via iPXE when iPXE was entered during POST. Since this is a very rare special case (used, for example, when reflashing an experimental ROM that would otherwise prevent the system from completing POST), this is an acceptable cost. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Split PMM allocations for image source and decompression areaMichael Brown2010-04-251-51/+119
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some BIOSes (at least some AMI BIOSes) tend to refuse to allocate a single area large enough to hold both the iPXE image source and the temporary decompression area, despite promising a largest available PMM memory block of several megabytes. This causes ROM image shrinking to fail on these BIOSes, with undesirable consequences: other option ROMs may be disabled due to shortage of option ROM space, and the iPXE ROM may itself be corrupted by a further BIOS bug (again, observed on an AMI BIOS) which causes large ROMs to end up overlapping reserved areas of memory. This can potentially render a system unbootable via any means. Increase the chances of a successful PMM allocation by dropping the alignment requirement (which is redundant now that we can enable A20 from within the prefix); this allows us to reduce the allocation size from 2MB down to only the required size. Increase the chances still further by using two separate allocations: one to hold the image source (i.e. the copy of the ROM before being shrunk) and the other to act as the decompression area. This allows ROM image shrinking to take place even on systems that fail to allocate enough memory for the temporary decompression area. Improve the behaviour of iPXE in systems with multiple iPXE ROMs by sharing PMM allocations where possible. Image source areas can be shared with any iPXE ROMs with a matching build identifier, and the temporary decompression area can be shared with any iPXE ROMs with the same uncompressed size (rounded up to the nearest 128kB). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Use area at top of INT 15,88 memory map for temporary decompressionMichael Brown2010-04-253-17/+27
| | | | | | | | | Use INT 15,88 to find a suitable temporary decompression area, rather than a fixed address. This hopefully gives us a better chance of not treading on any PMM-allocated areas, in BIOSes where PMM support exists but tends not to give us the large blocks that we ask for. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pcbios] Always show INT 15,88 result under DEBUG=memmapMichael Brown2010-04-251-5/+5
| | | | | | | | Always call INT 15,88 even if we don't use the result. This allows DEBUG=memmap to show the complete result set returned by all of the INT 15 memory-map calls. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Generate random build identifierMichael Brown2010-04-251-0/+3
| | | | | | | | | Randomly generate a 32-bit build identifier that can be used to identify identical iPXE ROMs when multiple such ROMs are present in a system (e.g. when a multi-function NIC exposes the same iPXE ROM image via each function's expansion ROM BAR). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Provide indication of successful call to install_preallocMichael Brown2010-04-211-4/+12
| | | | | | | | | | | The existing "iPXE starting execution" message indicates that the BEV (or INT19) was invoked, but gives no indication on whether or not the iPXE source was successfully retrieved (e.g. from PMM). Split the "starting execution message" into "starting execution...ok"; the "ok" indicates that the main iPXE body was successfully decompressed and relocated. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Default to 1MB mark as fallback high memory load pointMichael Brown2010-04-201-8/+1Star
| | | | | | | | | | Now that we can use odd megabytes, there is no particular need to use an even megabyte as the fallback temporary load point. Note that the old warnings about avoiding 2MB pre-date our ability to cooperate with other PXE ROMs by using PMM. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [relocate] Remove the even megabyte constraintMichael Brown2010-04-201-48/+8Star
| | | | | | | iPXE is now capable of operating in odd megabytes of memory, so remove the obsolete code enforcing an even-megabyte constraint. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Use libflat to enable A20 line on each real-to-protected transitionMichael Brown2010-04-208-227/+12Star
| | | | | | | | | | | | | Use the shared code in libflat to perform the A20 transitions automatically on each transition from real to protected mode. This allows us to remove all explicit calls to gateA20_set(). The old warnings about avoiding automatically enabling A20 are essentially redundant; they date back to the time when we would always start hammering the keyboard controller without first checking to see if gate A20 was already enabled (which it almost always is). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Add A20-enabling code in libflatMichael Brown2010-04-202-8/+296
| | | | | | | | | | | | | | | | iPXE currently insists on residing in an even megabyte. This imposes undesirably severe constraints upon our PMM allocation strategy, and limits our options for mechanisms to access ROMs greater than 64kB in size. Add A20 handling code to libflat so that prefixes are able to access memory even in odd megabytes. The algorithms and tuning parameters in the new A20 handling code are based upon a mixture of the existing iPXE A20 code and the A20 code from the 2.6.32 Linux kernel. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Move flatten_real_mode to libflat.SMichael Brown2010-04-202-122/+141
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Move flatten_real_mode to .text16.earlyMichael Brown2010-04-201-41/+31Star
| | | | | | | | | | The flatten_real_mode routine is not needed until after decompressing .text16.early, and currently performs various contortions to compensate for the fact that .prefix may not be writable. Move flatten_real_mode to .text16.early to save on (compressed) binary size and simplify the code. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Add .text16.early sectionMichael Brown2010-04-203-34/+94
| | | | | | | | | | | | | Add a section .text16.early which is always kept inline with the prefix. This will allow for some code sharing between the .prefix and .text16 sections. Note that the simple solution of just prepending the .prefix section to the .text16 section will not work, because a bug in Wyse Streaming Manager server (WLDRM13.BIN) requires us to place a dummy PXENV+ entry point at the start of .text16. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Use flat real mode for access to high memoryMichael Brown2010-04-201-127/+79Star
| | | | | | | | | | Use flat real mode rather than 16-bit protected mode for access to high memory during installation. This simplifies the code by reducing the number of CPU modes we need to think about, and also increases the amount of code in common between the normal and (somewhat hypothetical) KEEP_IT_REAL methods of operation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Use flat real mode instead of real modeMichael Brown2010-04-202-17/+8Star
| | | | | | | | | | | | | | | | | | | | When returning to real mode, set 4GB segment limits instead of 64kB limits. This change improves our chances of successfully returning to a PMM-capable BIOS aftering entering iPXE during POST; the BIOS will have set up flat real mode before calling our initialisation point, and may be disconcerted if we then return in genuine real mode. This change is unlikely to break anything, since any code that might potentially access beyond 64kB must use addr32 prefixes to do so; if this is the case then it is almost certainly code written to expect flat real mode anyway. Note that it is not possible to restore the real-mode segment limits to their original values, since it is not possible to know which protected-mode segment descriptor was originally used to initialise the limit portion of the segment register. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Remove .hrom prefixMichael Brown2010-04-203-27/+0Star
| | | | | | | | | | | | The .hrom prefix provides an experimental mechanism for reducing option ROM space usage on systems where PMM allocation fails, by pretending that PMM allocation succeeded and gave us an address fixed at compilation time. This is unreliable, and potentially dangerous. In particular, when multiple gPXE ROMs are present in a system, each gPXE ROM will assume ownership of the same fixed address, resulting in undefined behaviour. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Remove .xrom prefixMichael Brown2010-04-204-387/+8Star
| | | | | | | | | | | | | | | The .xrom prefix provides an experimental mechanism for loading ROM images greater than 64kB in size by mapping the expansion ROM BAR in at a hopefully-unused address. This is unreliable, and potentially dangerous. In particular, there is no guarantee that any PCI bridges between the CPU and the device will respond to accesses for the "unused" memory region that is chosen, and it is possible that the process of scanning for the "unused" memory region may end up issuing reads to other PCI devices. If this ends up trampling on a register with read side-effects belonging to an unrelated PCI device, this may cause undefined behaviour. Signed-off-by: Michael Brown <mcb30@ipxe.org>