summaryrefslogtreecommitdiffstats
path: root/src/image
Commit message (Collapse)AuthorAgeFilesLines
* [build] Mark known reviewed files as permitted for UEFI Secure BootMichael Brown2026-01-144-0/+4
| | | | | | | | | Some past security reviews carried out for UEFI Secure Boot signing submissions have covered specific drivers or functional areas of iPXE. Mark all of the files comprising these areas as permitted for UEFI Secure Boot. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Mark core files as permitted for UEFI Secure BootMichael Brown2026-01-143-0/+3
| | | | | | | | | | | | Mark all files used in a standard build of bin-x86_64-efi/snponly.efi as permitted for UEFI Secure Boot. These files represent the core functionality of iPXE that is guaranteed to have been included in every binary that was previously subject to a security review and signed by Microsoft. It is therefore legitimate to assume that at least these files have already been reviewed to the required standard multiple times. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Show commands in alphabetical orderMichael Brown2025-08-061-8/+2Star
| | | | | | | | | | | | | Commands were originally ordered by functional group (e.g. keeping the image management commands together), with arrays used to impose a functionally meaningful order within the group. As the number of commands and functional groups has expanded over the years, this has become essentially useless as an organising principle. Switch to sorting commands alphabetically (using the linker table mechanism). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [init] Show initialisation function names in debug messagesMichael Brown2025-07-151-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Use image name rather than pointer value in all debug messagesMichael Brown2025-05-262-22/+22
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [memmap] Allow explicit colour selection for memory map debug messagesMichael Brown2025-05-252-6/+6
| | | | | | | | | | | Provide DBGC_MEMMAP() as a replacement for memmap_dump(), allowing the colour used to match other messages within the same message group. Retain a dedicated colour for output from memmap_dump_all(), on the basis that it is generally most useful to visually compare full memory dumps against previous full memory dumps. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [memmap] Rename addr/last fields to min/max for clarityMichael Brown2025-05-233-8/+8
| | | | | | | | Use the terminology "min" and "max" for addresses covered by a memory region descriptor, since this is sufficiently intuitive to generally not require further explanation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lkrn] Support initrd construction for RISC-V bare-metal kernelsMichael Brown2025-05-231-99/+95Star
| | | | | | | | | | | | | | | | | | | | | | Use the shared initrd reshuffling and CPIO header construction code for RISC-V bare-metal kernels. This allows for files to be injected into the constructed ("magic") initrd image in exactly the same way as is done for bzImage and UEFI kernels. We append a dummy image encompassing the FDT to the end of the reshuffle list, so that it ends up directly following the constructed initrd in memory (but excluded from the initrd length, which was recorded before constructing the FDT). We also temporarily prepend the kernel binary itself to the reshuffle list. This is guaranteed to be safe (since reshuffling is designed to be unable to fail), and avoids the requirement for the kernel segment to be available before reshuffling. This is useful since current RISC-V bare-metal kernels tend to be distributed as EFI zboot images, which require large temporary allocations from the external heap for the intermediate images created during archive extraction. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Squash and shuffle only initrds within the external heapMichael Brown2025-05-231-33/+35
| | | | | | | | | | | | | | | | | Any initrd images that are not within the external heap (e.g. embedded images) do not need to be copied to the external heap for reshuffling, and can just be left in their original locations. Ignore any images that are not already within the external heap (or, more precisely, that are wholly outside of the reshuffle region within the external heap) when squashing and swapping images. This reduces the maximum additional storage required by squashing and swapping to zero, and so ensures that the reshuffling step is guaranteed to succeed under all circumstances. (This is unrelated to the post-reshuffle load region check, which is still required.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Split out initrd construction from bzimage.cMichael Brown2025-05-231-15/+116
| | | | | | | | | Provide a reusable function initrd_load_all() to load all initrds (including any constructed CPIO headers) into a contiguous memory region, and support functions to find the constructed total length and permissible post-reshuffling load address range. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Allow for images straddling the top of the reshuffle regionMichael Brown2025-05-221-1/+8
| | | | | | | | | | | | It is hypothetically possible for external heap memory allocated during driver startup to have been freed before an image was downloaded, which could therefore leave an image straddling the address recorded as the top of the reshuffle region. Allow for this possibility by skipping squashing for any images already straddling (or touching) the top of the reshuffle region. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Rename bzimage_align() to initrd_align()Michael Brown2025-05-221-13/+5Star
| | | | | | | Alignment of initrd lengths is applicable to all Linux kernels, not just those in the x86 bzImage format. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Swap initrds entirely in-place via triple reversalMichael Brown2025-05-221-49/+42Star
| | | | | | | Eliminate the requirement for free space when reshuffling initrds by swapping adjacent initrds using an in-place triple reversal. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uheap] Expose external heap region directlyMichael Brown2025-05-221-21/+16Star
| | | | | | | | | | | | | We currently rely on implicit detection of the external heap region. The INT 15 memory map mangler relies on examining the corresponding in-use memory region, and the initrd reshuffler relies on performing a separate detection of the largest free memory block after startup has completed. Replace these with explicit public symbols to describe the external heap region. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lkrn] Shut down devices before jumping to kernel entry pointMichael Brown2025-05-211-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lkrn] Allow a single initrd to be passed to the booted kernelMichael Brown2025-05-211-1/+13
| | | | | | | | | | | | Allow a single initrd image to be passed verbatim to the booted RISC-V kernel, as a proof of concept. We do not yet support reshuffling to make optimal use of available memory, or dynamic construction of CPIO headers, but this is sufficient to allow iPXE to start up the Fedora 42 kernel with its matching initrd image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fdt] Allow an initrd to be specified when creating a device treeMichael Brown2025-05-211-1/+1
| | | | | | | Allow an initrd location to be specified in our constructed device tree via the "linux,initrd-start" and "linux,initrd-end" properties. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [initrd] Move initrd reshuffling to be architecture-independent codeMichael Brown2025-05-211-0/+309
| | | | | | | | There is nothing x86-specific in initrd.c, and a variant of the reshuffling logic will be required for executing bare-metal kernels on RISC-V and AArch64. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lkrn] Add support for EFI zboot compressed kernel imagesMichael Brown2025-05-201-0/+102
| | | | | | | | | | | | | | | | | | Current RISC-V and AArch64 kernels found in the wild tend not to be in the documented kernel format, but are instead "EFI zboot" kernels comprising a small EFI executable that decompresses and executes the inner payload (which is a kernel in the expected format). The EFI zboot header includes a recognisable magic value "zimg" along with two fields describing the offset and length of the compressed payload. We can therefore treat this as an archive image format, extracting the payload as-is and then relying on our existing ability to execute compressed images. This is sufficient to allow iPXE to execute the Fedora 42 RISC-V kernel binary as currently published. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lkrn] Add basic support for the RISC-V Linux kernel image formatMichael Brown2025-05-201-0/+254
| | | | | | | | | | | | | | | | | | | | | | The RISC-V and AArch64 bare-metal kernel images share a common header format, and require essentially the same execution environment: loaded close to the start of RAM, entered with paging disabled, and passed a pointer to a flattened device tree that describes the hardware and any boot arguments. Implement basic support for executing bare-metal RISC-V and AArch64 kernel images. The (trivial) AArch64-specific code path is untested since we do not yet have the ability to build for any bare-metal AArch64 platforms. Constructing and passing an initramfs image is not yet supported. Rename the IMAGE_BZIMAGE build configuration option to IMAGE_LKRN, since "bzImage" is specific to x86. To retain backwards compatibility with existing local build configurations, we leave IMAGE_BZIMAGE as the enabled option in config/default/pcbios.h and treat IMAGE_LKRN as a synonym for IMAGE_BZIMAGE when building for x86 BIOS. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Use memmap_describe() to check loadable image segmentsMichael Brown2025-05-161-23/+30
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Formalise mechanism for accessing absolute symbolsMichael Brown2025-05-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | In a position-dependent executable, where all addresses are fixed at link time, we can use the standard technique as documented by GNU ld to get the value of an absolute symbol, e.g.: extern char _my_symbol[]; printf ( "Absolute symbol value is %x\n", ( ( int ) _my_symbol ) ); This technique may not work in a position-independent executable. When dynamic relocations are applied, the runtime addresses will no longer be equal to the link-time addresses. If the code to obtain the address of _my_symbol uses PC-relative addressing, then it will calculate the runtime "address" of the absolute symbol, which will no longer be equal the the link-time "address" (i.e. the correct value) of the absolute symbol. Define macros ABS_SYMBOL(), ABS_VALUE_INIT(), and ABS_VALUE() that provide access to the correct values of absolute symbols even in position-independent code, and use these macros wherever absolute symbols are accessed. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Reduce scope of included uaccess.h headerMichael Brown2025-04-301-0/+1
| | | | | | | | | The uaccess.h header is no longer required for any code that touches external ("user") memory, since such memory accesses are now performed through pointer dereferences. Reduce the number of files including this header. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Make image data read-only to most consumersMichael Brown2025-04-303-17/+17
| | | | | | | | | | | | | | | | | | | | Almost all image consumers do not need to modify the content of the image. Now that the image data is a pointer type (rather than the opaque userptr_t type), we can rely on the compiler to enforce this at build time. Change the .data field to be a const pointer, so that the compiler can verify that image consumers do not modify the image content. Provide a transparent .rwdata field for consumers who have a legitimate (and now explicit) reason to modify the image content. We do not attempt to impose any runtime restriction on checking whether or not an image is writable. The only existing instances of genuinely read-only images are the various unit test images, and it is acceptable for defective test cases to result in a segfault rather than a runtime error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the concept of a static imageMichael Brown2025-04-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Not all images are allocated via alloc_image(). For example: embedded images, the static images created to hold a runtime command line, and the images used by unit tests are all static structures. Using image_set_cmdline() (via e.g. the "imgargs" command) to set the command-line arguments of a static image will succeed but will leak memory, since nothing will ever free the allocated command line. There are no code paths that can lead to calling image_set_len() on a static image, but there is no safety check against future code paths attempting this. Define a flag IMAGE_STATIC to mark an image as statically allocated, generalise free_image() to also handle freeing dynamically allocated portions of static images (such as the command line), and expose free_image() for use by static images. Define a related flag IMAGE_STATIC_NAME to mark the name as statically allocated. Allow a statically allocated name to be replaced with a dynamically allocated name since this is a potentially valid use case (e.g. if "imgdecrypt --name <name>" is used on an embedded image). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Move embedded images from .rodata to .dataMichael Brown2025-04-301-1/+1
| | | | | | | | | | | Decrypting a CMS-encrypted image will overwrite the existing image data in place, and using an encrypted embedded image is a valid use case. Move embedded images from .rodata to .data to reflect the fact that they are intended to be writable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove redundant copy_from_user() and copy_to_user()Michael Brown2025-04-306-0/+6
| | | | | | | Remove the now-redundant copy_from_user() and copy_to_user() wrapper functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Remove userptr_t from Multiboot and ELF image parsingMichael Brown2025-04-281-16/+23
| | | | | | | | Simplify Multiboot and ELF image parsing by assuming that the Multiboot and ELF headers are directly accessible via pointer dereferences, and add some missing header validations. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Use image name in Multiboot and ELF debug messagesMichael Brown2025-04-281-16/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pnm] Remove userptr_t from PNM image parsingMichael Brown2025-04-251-30/+25Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [png] Remove userptr_t from PNG image parsingMichael Brown2025-04-251-99/+78Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Remove userptr_t from EFI PE image parsingMichael Brown2025-04-251-13/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [script] Remove userptr_t from script image parsingMichael Brown2025-04-241-15/+21
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove trivial uses of userptr_tMichael Brown2025-04-241-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [deflate] Remove userptr_t from decompression codeMichael Brown2025-04-223-62/+64
| | | | | | | Simplify the deflate, zlib, and gzip decompression code by assuming that all content is fully accessible via pointer dereferences. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove userptr_t from ASN.1 parsersMichael Brown2025-04-223-55/+44Star
| | | | | | | | | Simplify the ASN.1 code by assuming that all objects are fully accessible via pointer dereferences. This allows the concept of "additional data beyond the end of the cursor" to be removed, and simplifies parsing of all ASN.1 image formats. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove user_to_phys() and phys_to_user()Michael Brown2025-04-212-4/+4
| | | | | | | | Remove the intermediate concept of a user pointer from physical address conversions, leaving virt_to_phys() and phys_to_virt() as the directly implemented functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove redundant user_to_virt()Michael Brown2025-04-211-4/+4
| | | | | | | | | The user_to_virt() function is now a straightforward wrapper around addition, with the addend almost invariably being zero. Remove this redundant wrapper. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove redundant memcpy_user() and related string functionsMichael Brown2025-04-212-2/+2
| | | | | | | | | | The memcpy_user(), memmove_user(), memcmp_user(), memset_user(), and strlen_user() functions are now just straightforward wrappers around the corresponding standard library functions. Remove these redundant wrappers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove redundant userptr_add() and userptr_diff()Michael Brown2025-04-201-1/+1
| | | | | | | | | The userptr_add() and userptr_diff() functions are now just straightforward wrappers around addition and subtraction. Remove these redundant wrappers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fdt] Populate boot arguments in constructed device treeMichael Brown2025-04-011-2/+3
| | | | | | | | When creating a device tree to pass to a booted operating system, ensure that the "chosen" node exists, and populate the "bootargs" property with the image command line. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Allow for fact that SNP device may be removed by executed imageMichael Brown2025-03-291-10/+14
| | | | | | | | | | | | | | | | | | | | | | | | The executed image may call DisconnectController() to remove our network device. This will leave the net device unregistered but not yet freed (since our installed PXE base code protocol retains a reference to the net device). Unregistration will cause the network upper-layer driver removal functions to be called, which will free the SNP device structure. When the image returns from StartImage(), the snpdev pointer may therefore no longer be valid. The SNP device structure is not reference counted, and so we cannot simply take out a reference to ensure that it remains valid across the call to StartImage(). However, the code path following the call to StartImage() doesn't actually require the SNP device pointer, only the EFI device handle. Store the device handle in a local variable and ensure that snpdev is invalidated before the call to StartImage() so that future code cannot accidentally reintroduce this issue. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Install a device tree for the booted OS, if availableMichael Brown2025-03-281-0/+28
| | | | | | | | | | | | | If we have a device tree available (e.g. because the user has explicitly downloaded a device tree using the "fdt" command), then provide it to the booted operating system as an EFI configuration table. Since x86 does not typically use device trees, we create weak symbols for efi_fdt_install() and efi_fdt_uninstall() to avoid dragging FDT support into all x86 UEFI binaries. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Allow use of typed pointers for efi_open() et alMichael Brown2025-03-241-14/+11Star
| | | | | | | | | Provide wrapper macros to allow efi_open() and related functions to accept a pointer to any pointer type as the "interface" argument, in order to allow a substantial amount of type adjustment boilerplate to be removed. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Use efi_open() for all ephemeral protocol opensMichael Brown2025-03-241-5/+2Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Allow wrapping the global boot services table in situMichael Brown2025-03-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | When DEBUG=efi_wrap is enabled, we construct a patched copy of the boot services table and patch the global system table to point to this copy. This ensures that any subsequently loaded EFI binaries will call our wrappers. Previously loaded EFI binaries will typically have cached the boot services table pointer (in the gBS variable used by EDK2 code), and therefore will not pick up the updated pointer and so will not call our wrappers. In most cases, this is what we want to happen: we are interested in tracing the calls issued by the newly loaded binary and we do not want to be distracted by the high volume of boot services calls issued by existing UEFI drivers. In some circumstances (such as when a badly behaved OEM driver is causing the system to lock up during the ExitBootServices() call), it can be very useful to be able to patch the global boot services table in situ, so that we can trace calls issued by existing drivers. Restructure the wrapping code to allow wrapping to be enabled or disabled at any time, and to allow for patching the global boot services table in situ. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Support extracting certificates from EFI signature list imagesMichael Brown2025-03-111-0/+253
| | | | | | | | | | | Add support for the EFI signature list image format (as produced by tools such as efisecdb). The parsing code does not require any EFI boot services functions and so may be enabled even in non-EFI builds. We default to enabling it only for EFI builds. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for parsing of DER data separate from DER imagesMichael Brown2025-03-111-16/+53
| | | | | | | | We currently provide pem_asn1() to allow for parsing of PEM data that is not necessarily contained in an image. Provide an equivalent function der_asn1() to allow for similar parsing of DER data. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Extend asn1_enter() to handle partial object cursorsMichael Brown2024-08-071-11/+4Star
| | | | | | | | | | | | | | | | | | | | | | | Handling large ASN.1 objects such as encrypted CMS files will require the ability to use the asn1_enter() and asn1_skip() family of functions on partial object cursors, where a defined additional length is known to exist after the end of the data buffer pointed to by the ASN.1 object cursor. We already have support for partial object cursors in the underlying asn1_start() operation used by both asn1_enter() and asn1_skip(), and this is used by the DER image probe routine to check that the potential DER file comprises a single ASN.1 SEQUENCE object. Add asn1_enter_partial() to formalise the process of entering an ASN.1 partial object, and refactor the DER image probe routine to use this instead of open-coding calls to the underlying asn1_start() operation. There is no need for an equivalent asn1_skip_partial() function, since only objects that are wholly contained within the partial cursor may be successfully skipped. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Make static_assert() available via assert.hMichael Brown2024-01-161-2/+1Star
| | | | | | | Expose static_assert() via assert.h and migrate link-time assertions to build-time assertions where possible. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-04 19:20:41 +0100