summaryrefslogtreecommitdiffstats
path: root/src/interface
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' into openslxopenslxSimon Rettberg2026-01-2860-1555/+3141
|\
| * [build] Mark known reviewed files as permitted for UEFI Secure BootMichael Brown2026-01-149-0/+9
| | | | | | | | | | | | | | | | | | Some past security reviews carried out for UEFI Secure Boot signing submissions have covered specific drivers or functional areas of iPXE. Mark all of the files comprising these areas as permitted for UEFI Secure Boot. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [build] Mark core files as permitted for UEFI Secure BootMichael Brown2026-01-1440-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | Mark all files used in a standard build of bin-x86_64-efi/snponly.efi as permitted for UEFI Secure Boot. These files represent the core functionality of iPXE that is guaranteed to have been included in every binary that was previously subject to a security review and signed by Microsoft. It is therefore legitimate to assume that at least these files have already been reviewed to the required standard multiple times. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Retry calls to GetRNG() as neededMichael Brown2025-12-121-15/+30
| | | | | | | | | | | | | | | | | | | | | | The UEFI specification allows GetRNG() to return EFI_NOT_READY, which is not a particularly helpful error status since there is nothing that can sensibly be done except to retry immediately. Retry failed calls to GetRNG() up to a maximum number of attempts. Debugged-by: Stoo Davies <sdavies@nvidia.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Allow for creating devices with no EFI parent deviceMichael Brown2025-11-252-35/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On some systems (observed on an AWS m8g.medium instance in eu-west-2), the UEFI firmware fails to enumerate some of the underlying hardware devices. On these systems, we cannot comply with the UEFI device model by adding our SNP device as a child of the hardware device and appending to the parent hardware device path, since no parent hardware device has been created. Work around these systems by allowing for the creation of SNP devices with no parent device. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [pci] Use runtime selectable PCI I/O API for EFI cloud buildsMichael Brown2025-11-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On some systems (observed on an AWS m8g.medium instance in eu-west-2), the UEFI firmware omits the PCI host bridge drivers for all but the first PCI bus. The observable result is that any devices on other PCI buses (such as the ENA network device) are not enumerated by the UEFI firmware and are therefore unusable by iPXE. Support these systems by switching to using PCIAPI_CLOUD for EFI cloud builds, trying the EFI PCI I/O API first and falling back to direct access (via ECAM) for devices that the UEFI firmware has failed to enumerate itself. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Wrap a selection of runtime services callsMichael Brown2025-11-131-7/+248
| | | | | | | | | | | | | | Allow DEBUG=efi_wrap to trace various runtime services calls as well as the existing boot services calls. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Allow SAN-booted images to be traced via DEBUG=efi_wrapMichael Brown2025-11-131-0/+7
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add image security database GUID definitionMichael Brown2025-11-121-0/+5
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add Microsoft vendor GUID definitionMichael Brown2025-11-121-0/+6
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add storage security command protocol header and GUID definitionMichael Brown2025-11-121-0/+7
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Update to current EDK2 headersMichael Brown2025-11-121-0/+5
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Switch back to VA_START() etc macros for EFIAPI functionsMichael Brown2025-11-111-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 670810b ("[efi] Use standard va_args macros instead of VA_START() etc") fixed a 32-bit RISC-V build error, but broke the functionality of the InstallMultipleProtocolInterfaces() and UninstallMultipleProtocolInterfaces() wrapper functions. GCC does not automatically check the ABI of the current function when using the __builtin_va_start() and related macros, and it is therefore necessary for code to use __builtin_ms_va_start() etc from within functions marked as EFIAPI. Since commit 9016f2e ("[efi] Skip including the EDK2 ProcessorBind.h header for 32-bit RISC-V") has now fixed the original 32-bit RISC-V build error, we can switch back to using the EDK2 VA_START() etc macros to obtain the correct behaviour. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Use current boot option as a fallback for obtaining the boot URIMichael Brown2025-08-291-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | Some systems (observed with a Lenovo X1) fail to populate the loaded image device path with a Uri() component when performing a UEFI HTTP boot, instead creating a broken loaded image device path that represents a DHCP+TFTP boot that has not actually taken place. If no URI is found within the loaded image device path, then fall back to looking for a URI within the current boot option. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add ability to extract device path from an EFI load optionMichael Brown2025-08-291-0/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | An EFI boot option (stored in a BootXXXX variable) comprises an EFI_LOAD_OPTION structure, which includes some undefined number of EFI device paths. (The structure is extremely messy and awkward to parse in C, but that's par for the course with EFI.) Add a function to extract the first device path from an EFI load option, along with wrapper functions to read and extract the first device path from an EFI boot variable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Check only the non-extended WaitForKey eventMichael Brown2025-07-161-4/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The WaitForKeyEx event in EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL is redundant: by definition it has to signal under exactly the same conditions as the WaitForKey event in EFI_SIMPLE_TEXT_INPUT_PROTOCOL and cannot provide any "extended" information since EFI events do not convey any information beyond their own occurrence. UEFI keyboard drivers such as Ps2KeyboardDxe and UsbKbDxe invariably use a single notification function to implement both events. The console multiplexer driver ConSplitterDxe uses a single notification function for both events, which ends up checking only the WaitForKey event on the underlying console devices. (Since all console input is routed through the console multiplexer, this means that in practice nothing will ever check the underlying devices' WaitForKeyEx events.) UEFI console consumers such as the UEFI shell tend to use only the EFI_SIMPLE_TEXT_INPUT_PROTOCOL instance provided as ConIn in the EFI system table. With the exception of the UEFI text editor (the "edit" command in the UEFI shell), almost nothing bothers to open the EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL instance on the same handle. The Lenovo ThinkPad T14s Gen 5 has a very peculiar firmware bug. Enabling the "UEFI Wi-Fi Network Boot" feature in the BIOS setup will cause the completely unrelated WaitForKeyEx event pointer to be overwritten with a pointer to a FAT_DIRENT structure representing the "BOOT" directory in the EFI system partition. This happens with 100% repeatability. It is not necessary to attempt to boot from Wi-Fi: it is only necessary to have the feature enabled. The root cause is unknown, but is presumably an uninitialised pointer or similar memory-related bug in Lenovo's UEFI Wi-Fi driver. Work around this Lenovo firmware bug by checking only the WaitForKey event, ignoring the WaitForKeyEx event even if we will subsequently use ReadKeyStrokeEx() to read the keypress. Since almost all other UEFI console consumers use only WaitForKey, this ensures that we will be using code paths that the firmware vendor is likely to have tested at least once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Allow compiler to perform type checks on EFI_EVENTMichael Brown2025-07-152-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | As with EFI_HANDLE, the EFI headers define EFI_EVENT as a void pointer, rendering EFI_EVENT compatible with a pointer to itself and hence guaranteeing that pointer type bugs will be introduced. Redefine EFI_EVENT as a pointer to an anonymous structure (as we already do for EFI_HANDLE) to allow the compiler to perform type checking as expected. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [init] Show initialisation function names in debug messagesMichael Brown2025-07-156-0/+6
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Drop to external TPL for calls to ConnectController()Michael Brown2025-07-145-41/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is nothing in the current versions of the UEFI specification that limits the TPL at which we may call ConnectController() or DisconnectController(). However, at least some platforms (observed with a Lenovo ThinkPad T14s Gen 5) will occasionally and unpredictably lock up before returning from ConnectController() if called at a TPL higher than TPL_APPLICATION. Work around whatever defect is present on these systems by dropping to the current external TPL for all calls to ConnectController() or DisconnectController(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Provide efi_tpl_name() for transcribing TPLs in debug messagesMichael Brown2025-07-142-28/+28
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [riscv] Invalidate data cache on completed RX DMA buffersMichael Brown2025-07-101-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The data cache must be invalidated twice for RX DMA buffers: once before passing ownership to the DMA device (in case the cache happens to contain dirty data that will be written back at an undefined future point), and once after receiving ownership from the DMA device (in case the CPU happens to have speculatively accessed data in the buffer while it was owned by the hardware). Only the used portion of the buffer needs to be invalidated after completion, since we do not care about data within the unused portion. Update the DMA API to include the used length as an additional parameter to dma_unmap(), and add the necessary second cache invalidation pass to the RISC-V DMA API implementation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [dma] Use virtual addresses for dma_map()Michael Brown2025-07-081-9/+10
| | | | | | | | | | | | | | | | | | | | Cache management operations must generally be performed on virtual addresses rather than physical addresses. Change the address parameter in dma_map() to be a virtual address, and make dma() the API-level primitive instead of dma_phys(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [initrd] Rename bzimage_align() to initrd_align()Michael Brown2025-05-221-0/+1
| | | | | | | | | | | | | | Alignment of initrd lengths is applicable to all Linux kernels, not just those in the x86 bzImage format. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [fdt] Allow an initrd to be specified when creating a device treeMichael Brown2025-05-211-1/+1
| | | | | | | | | | | | | | Allow an initrd location to be specified in our constructed device tree via the "linux,initrd-start" and "linux,initrd-end" properties. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove redundant virt_to_user() and userptr_tMichael Brown2025-04-301-1/+0Star
| | | | | | | | | | | | | | | | | | Remove the last remaining traces of the concept of a user pointer, leaving iPXE with a simpler and cleaner memory model that implicitly assumes that all memory locations can be reached through pointer dereferences. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Reduce scope of included uaccess.h headerMichael Brown2025-04-301-0/+1
| | | | | | | | | | | | | | | | | | The uaccess.h header is no longer required for any code that touches external ("user") memory, since such memory accesses are now performed through pointer dereferences. Reduce the number of files including this header. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [image] Make image data read-only to most consumersMichael Brown2025-04-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Almost all image consumers do not need to modify the content of the image. Now that the image data is a pointer type (rather than the opaque userptr_t type), we can rely on the compiler to enforce this at build time. Change the .data field to be a const pointer, so that the compiler can verify that image consumers do not modify the image content. Provide a transparent .rwdata field for consumers who have a legitimate (and now explicit) reason to modify the image content. We do not attempt to impose any runtime restriction on checking whether or not an image is writable. The only existing instances of genuinely read-only images are the various unit test images, and it is acceptable for defective test cases to result in a segfault rather than a runtime error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [image] Add the concept of a static imageMichael Brown2025-04-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Not all images are allocated via alloc_image(). For example: embedded images, the static images created to hold a runtime command line, and the images used by unit tests are all static structures. Using image_set_cmdline() (via e.g. the "imgargs" command) to set the command-line arguments of a static image will succeed but will leak memory, since nothing will ever free the allocated command line. There are no code paths that can lead to calling image_set_len() on a static image, but there is no safety check against future code paths attempting this. Define a flag IMAGE_STATIC to mark an image as statically allocated, generalise free_image() to also handle freeing dynamically allocated portions of static images (such as the command line), and expose free_image() for use by static images. Define a related flag IMAGE_STATIC_NAME to mark the name as statically allocated. Allow a statically allocated name to be replaced with a dynamically allocated name since this is a potentially valid use case (e.g. if "imgdecrypt --name <name>" is used on an embedded image). Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove redundant copy_from_user() and copy_to_user()Michael Brown2025-04-304-0/+4
| | | | | | | | | | | | | | Remove the now-redundant copy_from_user() and copy_to_user() wrapper functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [bofm] Remove userptr_t from BOFM table parsing and updatingMichael Brown2025-04-291-50/+44Star
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [xferbuf] Simplify and generalise data transfer buffersMichael Brown2025-04-291-45/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since all data transfer buffer contents are now accessible via direct pointer dereferences, remove the unnecessary abstractions for read and write operations and create two new data transfer buffer types: a fixed-size buffer, and a void buffer that records its size but can never receive non-zero lengths of data. These replace the custom data buffer types currently implemented for EFI PXE TFTP downloads and for block device translations. A new operation xferbuf_detach() is required to take ownership of the data accumulated in the data transfer buffer, since we no longer rely on the existence of an independently owned external data pointer for data transfer buffers allocated via umalloc(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add ability to reboot to firmware setup menuMichael Brown2025-04-281-0/+23
| | | | | | | | | | | | | | Add the ability to reboot to the firmware setup menu (if supported) by setting the relevant value in the OsIndications variable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [reboot] Generalise warm reboot indicator to a flags bitmaskMichael Brown2025-04-281-3/+5
| | | | | | | | | | | | | | Allow for the possibility of additional reboot types by extending the reboot() function to use a flags bitmask rather than a single flag. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [linux] Add missing return statement to linux_poll()Michael Brown2025-04-281-0/+1
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [build] Prevent the use of reserved words in C23Miao Wang2025-04-271-6/+6
| | | | | | | | | | | | | | | | GCC 15 defaults to C23, which reserves bool, true, and false as keywords. Avoid using these as parameter or variable names. Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [fbcon] Remove userptr_t from framebuffer console driversMichael Brown2025-04-251-12/+10Star
| | | | | | | | | | | | | | | | | | | | | | | | Simplify the framebuffer console drivers by assuming that the raw framebuffer, character cell array, background picture, and glyph data are all directly accessible via pointer dereferences. In particular, this avoids the need to copy each glyph during drawing: the VESA framebuffer driver can simply return a pointer to the glyph data stored in the video ROM. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [block] Remove userptr_t from block device abstractionMichael Brown2025-04-241-2/+3
| | | | | | | | | | | | | | Simplify the block device code by assuming that all read/write buffers are directly accessible via pointer dereferences. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove now-obsolete memchr_user()Michael Brown2025-04-241-1/+0Star
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove trivial uses of userptr_tMichael Brown2025-04-248-25/+20Star
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [umalloc] Remove userptr_t from user memory allocationsMichael Brown2025-04-233-67/+25Star
| | | | | | | | | | | | | | | | Use standard void pointers for umalloc(), urealloc(), and ufree(), with the "u" prefix retained to indicate that these allocations are made from external ("user") memory rather than from the internal heap. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [smbios] Remove userptr_t from SMBIOS structure parsingMichael Brown2025-04-234-212/+196Star
| | | | | | | | | | | | | | | | | | | | | | | | | | Simplify the SMBIOS structure parsing code by assuming that all structure content is fully accessible via pointer dereferences. In particular, this allows the convoluted find_smbios_structure() and read_smbios_structure() to be combined into a single function smbios_structure() that just returns a direct pointer to the SMBIOS structure, with smbios_string() similarly now returning a direct pointer to the relevant string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [acpi] Remove userptr_t from ACPI table parsingMichael Brown2025-04-222-7/+9
| | | | | | | | | | | | | | Simplify the ACPI table parsing code by assuming that all table content is fully accessible via pointer dereferences. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [crypto] Remove userptr_t from ASN.1 parsersMichael Brown2025-04-221-2/+2
| | | | | | | | | | | | | | | | | | Simplify the ASN.1 code by assuming that all objects are fully accessible via pointer dereferences. This allows the concept of "additional data beyond the end of the cursor" to be removed, and simplifies parsing of all ASN.1 image formats. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove user_to_phys() and phys_to_user()Michael Brown2025-04-217-14/+15
| | | | | | | | | | | | | | | | Remove the intermediate concept of a user pointer from physical address conversions, leaving virt_to_phys() and phys_to_virt() as the directly implemented functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove redundant user_to_virt()Michael Brown2025-04-215-6/+4Star
| | | | | | | | | | | | | | | | | | The user_to_virt() function is now a straightforward wrapper around addition, with the addend almost invariably being zero. Remove this redundant wrapper. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove redundant memcpy_user() and related string functionsMichael Brown2025-04-214-9/+5Star
| | | | | | | | | | | | | | | | | | | | The memcpy_user(), memmove_user(), memcmp_user(), memset_user(), and strlen_user() functions are now just straightforward wrappers around the corresponding standard library functions. Remove these redundant wrappers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Remove redundant userptr_add() and userptr_diff()Michael Brown2025-04-201-1/+0Star
| | | | | | | | | | | | | | | | | | The userptr_add() and userptr_diff() functions are now just straightforward wrappers around addition and subtraction. Remove these redundant wrappers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [uaccess] Add explicit casts to and from userptr_t where neededMichael Brown2025-04-201-1/+1
| | | | | | | | | | | | | | Allow for the possibility of userptr_t becoming a pointer type by adding explicit casts where necessary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Allow for custom methods for disconnecting existing driversMichael Brown2025-04-172-10/+28
| | | | | | | | | | | | | | | | Allow for greater control over the process used to disconnect existing drivers from a device handle, by converting the "exclude" field from a simple protocol GUID to a per-driver method. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [fdt] Populate boot arguments in constructed device treeMichael Brown2025-04-011-2/+3
| | | | | | | | | | | | | | | | When creating a device tree to pass to a booted operating system, ensure that the "chosen" node exists, and populate the "bootargs" property with the image command line. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-04 16:02:00 +0100