From d9d300dc4c9318fa6df22772c8f5ac94b1dd30cc Mon Sep 17 00:00:00 2001 From: cdown Date: Thu, 22 Jan 2026 04:16:49 -0800 Subject: [PATCH 1/2] boot: Fix UKI boot for kernels with non-zero ImageBase The current code incorrectly subtracts ImageBase from section VirtualAddress values when loading sections into memory. This is based on a misunderstanding of the PE specification. VirtualAddress in section headers is the address of the first byte of the section relative to the image base when the section is loaded into memory. In other words, VirtualAddress is already an RVA measured from the image base, it is definitely NOT an absolute address that needs to be adjusted. So when loading a PE image into a newly allocated buffer, sections should be copied to buffer + VirtualAddress, regardless of what ImageBase says. The ImageBase field merely indicates the *preferred* load address, it does not affect how section RVAs are interpreted. This happens to not cause issues when ImageBase was 0 (since VirtualAddress - 0 = VirtualAddress), which is why this bug went undetected on modern kernels. However, it fails with kernels that have non-zero ImageBase values. So let's remove the nonsensical VirtualAddress < ImageBase check, and remove the ImageBase subtractions from section loading offsets. This lets all kernel UKIs work properly again. Fixes: #40342 --- src/boot/linux.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/boot/linux.c b/src/boot/linux.c index 22b758b8e6..3d20258ddc 100644 --- a/src/boot/linux.c +++ b/src/boot/linux.c @@ -161,14 +161,13 @@ EFI_STATUS linux_exec( size_t kernel_size_in_memory = 0; uint32_t compat_entry_point, entry_point; - uint64_t image_base; EFI_STATUS err; assert(parent_image); assert(iovec_is_set(kernel)); assert(iovec_is_valid(initrd)); - err = pe_kernel_info(kernel->iov_base, &entry_point, &compat_entry_point, &image_base, &kernel_size_in_memory); + err = pe_kernel_info(kernel->iov_base, &entry_point, &compat_entry_point, /* ret_image_base= */ NULL, &kernel_size_in_memory); #if defined(__i386__) || defined(__x86_64__) if (err == EFI_UNSUPPORTED) /* Kernel is too old to support LINUX_INITRD_MEDIA_GUID, try the deprecated EFI handover @@ -276,10 +275,9 @@ EFI_STATUS linux_exec( if (h->SizeOfRawData == 0) continue; - if ((h->VirtualAddress < image_base) - || (h->VirtualAddress - image_base + h->SizeOfRawData > kernel_size_in_memory)) + if (h->VirtualAddress + h->SizeOfRawData > kernel_size_in_memory) return log_error_status(EFI_LOAD_ERROR, "Section would write outside of memory"); - memcpy(loaded_kernel + h->VirtualAddress - image_base, + memcpy(loaded_kernel + h->VirtualAddress, (const uint8_t*)kernel->iov_base + h->PointerToRawData, h->SizeOfRawData); memzero(loaded_kernel + h->VirtualAddress + h->SizeOfRawData, @@ -288,7 +286,7 @@ EFI_STATUS linux_exec( /* Not a code section? Nothing to do, leave as-is. */ if (memory_proto && (h->Characteristics & (PE_CODE|PE_EXECUTE))) { nx_sections = xrealloc(nx_sections, n_nx_sections * sizeof(struct iovec), (n_nx_sections + 1) * sizeof(struct iovec)); - nx_sections[n_nx_sections].iov_base = loaded_kernel + h->VirtualAddress - image_base; + nx_sections[n_nx_sections].iov_base = loaded_kernel + h->VirtualAddress; nx_sections[n_nx_sections].iov_len = h->VirtualSize; err = memory_mark_ro_x(memory_proto, &nx_sections[n_nx_sections]); From 353701b07e6750282461d6d61a3d8bffffe3ebbc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 17 Feb 2026 18:21:45 +0100 Subject: [PATCH 2/2] boot: drop now-unused image_base param --- src/boot/boot.c | 2 +- src/boot/linux.c | 2 +- src/boot/pe.c | 18 +----------------- src/boot/pe.h | 2 +- 4 files changed, 4 insertions(+), 20 deletions(-) diff --git a/src/boot/boot.c b/src/boot/boot.c index d88f99459a..2a7dc6c31b 100644 --- a/src/boot/boot.c +++ b/src/boot/boot.c @@ -2775,7 +2775,7 @@ static EFI_STATUS call_image_start( uint32_t compat_address; err = pe_kernel_info(loaded_image->ImageBase, /* ret_entry_point= */ NULL, &compat_address, - /* ret_image_base= */ NULL, /* ret_size_in_memory= */ NULL); + /* ret_size_in_memory= */ NULL); if (err != EFI_SUCCESS) { if (err != EFI_UNSUPPORTED) return log_error_status(err, "Error finding kernel compat entry address: %m"); diff --git a/src/boot/linux.c b/src/boot/linux.c index 3d20258ddc..554769f47c 100644 --- a/src/boot/linux.c +++ b/src/boot/linux.c @@ -167,7 +167,7 @@ EFI_STATUS linux_exec( assert(iovec_is_set(kernel)); assert(iovec_is_valid(initrd)); - err = pe_kernel_info(kernel->iov_base, &entry_point, &compat_entry_point, /* ret_image_base= */ NULL, &kernel_size_in_memory); + err = pe_kernel_info(kernel->iov_base, &entry_point, &compat_entry_point, &kernel_size_in_memory); #if defined(__i386__) || defined(__x86_64__) if (err == EFI_UNSUPPORTED) /* Kernel is too old to support LINUX_INITRD_MEDIA_GUID, try the deprecated EFI handover diff --git a/src/boot/pe.c b/src/boot/pe.c index 8616bee6b6..397a7a6940 100644 --- a/src/boot/pe.c +++ b/src/boot/pe.c @@ -459,7 +459,7 @@ static uint32_t get_compatibility_entry_address(const DosFileHeader *dos, const return 0; } -EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_compat_entry_point, uint64_t *ret_image_base, size_t *ret_size_in_memory) { +EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_compat_entry_point, size_t *ret_size_in_memory) { assert(base); const DosFileHeader *dos = (const DosFileHeader *) base; @@ -470,18 +470,6 @@ EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t if (!verify_pe(dos, pe, /* allow_compatibility= */ true)) return EFI_LOAD_ERROR; - uint64_t image_base; - switch (pe->OptionalHeader.Magic) { - case OPTHDR32_MAGIC: - image_base = pe->OptionalHeader.ImageBase32; - break; - case OPTHDR64_MAGIC: - image_base = pe->OptionalHeader.ImageBase64; - break; - default: - assert_not_reached(); - } - /* When allocating we need to also consider the virtual/uninitialized data sections, so parse it out * of the SizeOfImage field in the PE header and return it */ size_t size_in_memory = pe->OptionalHeader.SizeOfImage; @@ -495,8 +483,6 @@ EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_entry_point = pe->OptionalHeader.AddressOfEntryPoint; if (ret_compat_entry_point) *ret_compat_entry_point = 0; - if (ret_image_base) - *ret_image_base = image_base; if (ret_size_in_memory) *ret_size_in_memory = size_in_memory; return EFI_SUCCESS; @@ -511,8 +497,6 @@ EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_entry_point = 0; if (ret_compat_entry_point) *ret_compat_entry_point = compat_entry_point; - if (ret_image_base) - *ret_image_base = image_base; if (ret_size_in_memory) *ret_size_in_memory = size_in_memory; diff --git a/src/boot/pe.h b/src/boot/pe.h index a7bcfbb676..7387f3e2fd 100644 --- a/src/boot/pe.h +++ b/src/boot/pe.h @@ -57,7 +57,7 @@ EFI_STATUS pe_memory_locate_sections( const char *const section_names[], PeSectionVector sections[]); -EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_compat_entry_point, uint64_t *ret_image_base, size_t *ret_size_in_memory); +EFI_STATUS pe_kernel_info(const void *base, uint32_t *ret_entry_point, uint32_t *ret_compat_entry_point, size_t *ret_size_in_memory); EFI_STATUS pe_kernel_check_no_relocation(const void *base);