| bcb0e17d | 22-Feb-2024 |
Warner Losh <[email protected]> |
loader: These files have no copyrightable material
These files have no copyrightable material, and so are in the public domain.
Sponsored by: Netflix
(cherry picked from commit 27c0f2a544989760c4
loader: These files have no copyrightable material
These files have no copyrightable material, and so are in the public domain.
Sponsored by: Netflix
(cherry picked from commit 27c0f2a544989760c4b3b16a3615839c8ab44b32)
show more ...
|
| 94e1374b | 16-Feb-2024 |
Warner Losh <[email protected]> |
loader: Move to using linker sets to bring in optional bits
The graphics stuff is optional. When it is pulled into the system, we use a linker set to initialize the lua bindings for it now.
Sponsor
loader: Move to using linker sets to bring in optional bits
The graphics stuff is optional. When it is pulled into the system, we use a linker set to initialize the lua bindings for it now.
Sponsored by: Netflix Reviewed by: kevans, jhb Differential Revision: https://reviews.freebsd.org/D43906
(cherry picked from commit 0921a771da8a9117edf26352a8a047bacbfcee45)
show more ...
|
| e55748d6 | 16-Feb-2024 |
Warner Losh <[email protected]> |
loader: Remove gfx_fb_stub.c, it's no longer needed
Now that we draw in the gfx bindings for all our interpreters only when graphics support is compiled in, we can eliminate this from all the loader
loader: Remove gfx_fb_stub.c, it's no longer needed
Now that we draw in the gfx bindings for all our interpreters only when graphics support is compiled in, we can eliminate this from all the loaders that don't have graphics support.
Sponsored by: Netflix Reviewed by: kevans, jhb Differential Revision: https://reviews.freebsd.org/D43905
(cherry picked from commit 23d9b5c9febf4b02957d01bc46ee75530b0dcb4a)
show more ...
|
| 254adb82 | 16-Feb-2024 |
Warner Losh <[email protected]> |
loader: Only create gfx 4th bindings when gfx is available
Only create the gfx bindings for 4th when it's compiled into the loader. We do this with a linker set that only gets brought in to those lo
loader: Only create gfx 4th bindings when gfx is available
Only create the gfx bindings for 4th when it's compiled into the loader. We do this with a linker set that only gets brought in to those loaders that call gfx_framework_init. This calls gfx_interp_md() will will drag in gfx_loader.c which will add to the linker set that registers these bindings.
Sponsored by: Netflix Reviewed by: kevans, jhb Differential Revision: https://reviews.freebsd.org/D43904
(cherry picked from commit 9c8bf69a53f628b62fb196182ea55fb34c1c19e1)
show more ...
|
| ab3aa90b | 16-Feb-2024 |
Warner Losh <[email protected]> |
loader: Add prototype for gfx_interp_md
This function will be used to draw in the graphics bindings when the loader is compiled with graphics (gfx) support. Provide definitions for lua and the simpl
loader: Add prototype for gfx_interp_md
This function will be used to draw in the graphics bindings when the loader is compiled with graphics (gfx) support. Provide definitions for lua and the simple interpreter. 4th support is forthcoming.
Sponsored by: Netflix Reviewed by: kevans, jhb Differential Revision: https://reviews.freebsd.org/D43903
(cherry picked from commit 60e199d9fde1c3c60a96b969bf6982278cbc1e88)
show more ...
|
| 73fac51c | 16-Feb-2024 |
Warner Losh <[email protected]> |
loader: Create new gfx table
Create a new gfx global table. Put into it all the graphics bindings that we have in loader today. For now, have compatability binding for loader. Remove them from loade
loader: Create new gfx table
Create a new gfx global table. Put into it all the graphics bindings that we have in loader today. For now, have compatability binding for loader. Remove them from loader.
Sponsored by: Netflix Reviewed by: kevans, jhb Differential Revision: https://reviews.freebsd.org/D43902
(cherry picked from commit 9b16231032ddb40be282d76ec0d82b3a0ec96d60)
show more ...
|
| 8ea26f32 | 14-Feb-2024 |
Warner Losh <[email protected]> |
loader: Fetch initial script from loader_lua env
Sometimes it is nice to override the initial script that we run. Make it possible by fetching loader_lua from the env and using that instead of the d
loader: Fetch initial script from loader_lua env
Sometimes it is nice to override the initial script that we run. Make it possible by fetching loader_lua from the env and using that instead of the default if prsent.
Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D43819
(cherry picked from commit cd147a2a024301a796f307c7bae686305d2bf302)
show more ...
|
| 16d49d0e | 12-Feb-2024 |
Simon J. Gerraty <[email protected]> |
libsecureboot do not report expected unverified files
By default only report unverified files at severity VE_WANT and above. This inlcudes *.conf but not *.hints, *.cookie or *.tgz which get VE_TRY
libsecureboot do not report expected unverified files
By default only report unverified files at severity VE_WANT and above. This inlcudes *.conf but not *.hints, *.cookie or *.tgz which get VE_TRY as their severity.
If Verbose is set to 0, then VerifyFlags should default to 0 too. Thus the combination of
module_verbose=0 VE_VEBOSE=0
is sufficient to make the loader almost totally silent.
When verify_prep has to find_manifest and it is verified ok return VE_NOT_CHECKED to verify_file so that it can skip repeating verify_fd
Also add better debugging output for is_verified and add_verify_status.
vectx handle compressed modules
When verifying a compressed module (.ko.gz or .ko.bz2) stat() reports the size as -1 (unknown). vectx_lseek needs to spot this during closing - and just read until EOF is hit.
Note: because of the way libsa's open() works, verify_prep will see the path to be verified as module.ko not module.ko.bz2 etc. This is actually ok, because we need a separate module.ko.bz2 entry so that the package can be verified, and the hash for module.ko is of the uncompressed file which is what vectx will see.
Re-work local.trust.mk so site.trust.mk need only set VE_SIGN_URL_LIST (if using the mentioned signing server)
interp.c: restrict interactive input
Apply the same restrictions to interactive input as for unverified conf and hints files.
Use version.veriexec when LOADER_VERIEXEC is yes
Reviewed by: kevans Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D43810
(cherry picked from commit f616d61ab6b071e5fbfdbae7033a9ef04c1444ad)
show more ...
|