summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* [pxe] Profile all PXE API callsMichael Brown2014-05-031-0/+49
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Add profiling self-tests for complete real_call and prot_call cyclesMichael Brown2014-05-031-0/+38
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [profile] Provide methods for profiling individual stages of operationsMichael Brown2014-05-032-11/+41
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Speed up protected-mode calls under KVMMichael Brown2014-05-021-19/+35
| | | | | | | | | | | | | When making a call from real mode to protected mode, we save and restore the global and interrupt descriptor table registers. The restore currently takes place after returning to real mode, which generates two EXCEPTION_NMIs and corresponding VM exits when running under KVM on an Intel CPU. Avoid the VM exits by restoring the descriptor table registers inside prot_to_real, while still running in protected mode. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Speed up real-to-protected mode transition under KVMMichael Brown2014-05-023-5/+22
| | | | | | | | | | | | | | | Ensure that all segment registers have zero in the low two bits before transitioning to protected mode. This allows the CPU state to immediately be deemed to be "valid", and eliminates the need for any further emulated instructions. Load the protected-mode interrupt descriptor table after switching to protected mode, since this avoids triggering an EXCEPTION_NMI and corresponding VM exit. This reduces the time taken by real_to_prot under KVM by around 50%. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Speed up protected-to-real mode transition under KVMMichael Brown2014-05-022-22/+20Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On an Intel CPU supporting VMX, KVM will emulate instructions while the CPU state remains "invalid". In real mode, the CPU state is defined to be "invalid" if any segment register has a base which is not equal to (sreg<<4) or a limit which is not equal to 64kB. We don't actually use the base stored in the REAL_DS descriptor for any significant purpose. Change the base stored in this descriptor to be equal to (REAL_DS<<4). A segment register loaded with REAL_DS is then automatically valid in both real and protected modes. This allows KVM to stop emulating instructions much sooner. The only use of REAL_DS for memory accesses currently occurs in the indirect ljmp within prot_to_real. Change this to a direct ljmp, storing rm_cs in .text16 as part of the ljmp instruction. This removes the only memory access via REAL_DS (thereby allowing for the above descriptor base address hack), and also simplifies the ljmp instruction (which will still have to be emulated). Load the real-mode interrupt descriptor table register before switching to real mode, since this avoids triggering an EXCEPTION_NMI and corresponding VM exit. This reduces the time taken by prot_to_real under KVM by around 65%. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Add meaningful labels at section changesMichael Brown2014-05-021-12/+12
| | | | | | | | | | | | | The mode-transition code involves paths which switch back and forth between the .text and .text16 sections. At present, only the start of each function is labelled, which makes it difficult to decode addresses within the parts of the function existing in a different section. Add explicit labels at the start of each section change, so that addresses can be meaningfully decoded to the nearest label. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Add a profiling self-test for measuring mode transition timesMichael Brown2014-05-021-0/+77
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Print out profiling statistics after a successful test runMichael Brown2014-05-021-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pcbios] Do not switch to real mode to sleep the CPUMichael Brown2014-04-291-3/+3
| | | | | | | Now that we can handle interrupts while in protected mode, there is no need to switch to real mode just to halt the CPU. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pcbios] Do not switch to real mode to check for timer interruptMichael Brown2014-04-291-4/+4
| | | | | | | | | | | | | The currticks() function is called at least once per TCP packet, and so is performance-critical. Switching to real mode just to allow the timer interrupt to fire is expensive when running inside a virtual machine, and imposes a significant performance cost. Fix by enabling interrupts without switching to real mode. This results in an approximately 100% increase in download speed when running under KVM. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [comboot] Use built-in interrupt reflectorMichael Brown2014-04-294-134/+6Star
| | | | | | | | We now have the ability to handle interrupts while in protected mode, and so no longer need to set up a dedicated interrupt descriptor table while running COM32 executables. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Allow interrupts in protected modeMichael Brown2014-04-299-135/+322
| | | | | | | | When running in a virtual machine, switching to real mode may be expensive. Allow interrupts to be enabled while in protected mode and reflected down to the real-mode interrupt handlers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow for a debug level of zeroMichael Brown2014-04-282-17/+4Star
| | | | | | | | Allow for an explicit debug level of zero, which will enable assertions and profiling (i.e. anything controlled by NDEBUG) without generating any debug messages. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [downloader] Profile receive datapathMichael Brown2014-04-281-0/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Profile receive datapathMichael Brown2014-04-281-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Profile transmit and receive datapathsMichael Brown2014-04-281-0/+20
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Profile transmit and receive datapathsMichael Brown2014-04-281-0/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Use genuine real mode to accelerate operation in virtual machinesMichael Brown2014-04-282-5/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently use flat real mode wherever real mode is required. This guarantees that we will not surprise some unsuspecting external caller which has carefully set up flat real mode by suddenly reducing the segment limits to 64kB. However, operating in flat real mode imposes a severe performance penalty in some virtualisation environments, since some CPUs cannot fully virtualise flat real mode and so the hypervisor must fall back to emulation. In particular, operating under KVM on a pre-Westmere Intel CPU will be at least an order of magnitude slower, to the point that there is a visible teletype effect when printing anything to the BIOS console. (Older versions of KVM used to cheat and ignore the "flat" part of flat real mode, which masked the problem.) Switch (back) to using genuine real mode with 64kB segment limits instead of flat real mode. Hopefully this won't break anything. Add an explicit switch to flat real mode before returning to the BIOS from the ROM prefix, since we know that a PMM BIOS will call the ROM initialisation point (and potentially the BEV) in flat real mode. As noted in previous commit messages, it is not possible to restore the real-mode segment limits after a transition to protected mode, since there is no way to know which protected-mode segment descriptor was originally used to initialise the limit portion of the segment register. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Push new RX descriptors in batchesMichael Brown2014-04-281-8/+13
| | | | | | | | | | | | Inside a virtual machine, writing the RX ring tail pointer may incur a substantial overhead of processing inside the hypervisor. Minimise this overhead by writing the tail pointer once per batch of descriptors, rather than once per descriptor. Profiling under qemu-kvm (version 1.6.2) shows that this reduces the amount of time taken to refill the RX descriptor ring by around 90%. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Profile common virtual machine operationsMichael Brown2014-04-281-0/+19
| | | | | | | | | Operations which are negligible on physical hardware (such as issuing a posted write to the transmit ring tail register) may involve substantial amounts of processing within the hypervisor if running in a virtual machine. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Profile common operationsMichael Brown2014-04-281-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "profstat" command to display profiling statisticsMichael Brown2014-04-285-0/+132
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [profile] Add generic profiling infrastructureMichael Brown2014-04-2810-76/+591
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Add flsll()Michael Brown2014-04-274-7/+112
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Add isqrt() function to find integer square rootsMichael Brown2014-04-263-0/+77
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Check for correct -mrtd assumption on libgcc arithmetic functionsMichael Brown2014-04-261-4/+74
| | | | | | | | | | | | | | | | | | | | | | | | As observed in commit 082cedb ("[build] Fix __libgcc attribute for recent gcc versions"), recent versions of gcc have changed the semantics of -mrtd as applied to the implicit arithmetic functions. It is possible for tests to succeed even if our assumptions about gcc's interpretation of -mrtd are incorrect. In particular, if gcc chooses to utilise a frame pointer in the calling function, then it can tolerate a temporarily incorrect stack pointer (since the stack pointer will shortly afterwards be restored from the frame pointer anyway). Add tests designed specifically to check that our implementations of the implicit arithmetic functions manipulate the stack pointer as expected by gcc. The effect of these tests can be observed by temporarily reverting commit 082cedb ("[build] Fix __libgcc attribute for recent gcc versions"): without this fix in place, the tests will fail on gcc 4.7 and later. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix __libgcc attribute for recent gcc versionsMichael Brown2014-04-251-0/+11
| | | | | | | | | | | | | | | | | | We observed some time ago (in commit 4ce8d61 "Import various libgcc functions from syslinux") that gcc seems to treat calls to the implicit arithmetic functions (e.g. __udivdi3()) as being affected by -mregparm but unaffected by -mrtd. This seems to be no longer the case with current gcc versions, which treat calls to these functions as being affected by both -mregparm and -mrtd, as expected. There is nothing obvious in the gcc changelogs to indicate precisely when this happened. From experimentation with available gcc versions, the change occurred sometime between v4.6.3 and v4.7.2. We assume that only versions up to v4.6.x require the special treatment. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add tests for 64-bit divisionMichael Brown2014-04-251-0/+122
| | | | | | | | | | On a 32-bit system, 64-bit division is implemented using the libgcc functions provided in __udivmoddi4.c etc. Calls to these functions are generated automatically by gcc, with a calling convention that is somewhat empirical in nature. Add these self-tests primarily as a check that we are using the correct calling convention. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Add inline assembly implementation of flsl() using BSR instructionMichael Brown2014-04-243-15/+33
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for flsl()Michael Brown2014-04-242-0/+87
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Rewrite TCP/IP tests using okx()Michael Brown2014-04-241-38/+53
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [serial] Enable UART FIFOsPeter Pickford2014-04-221-2/+2
| | | | | | | | | | | Escape sequences received via the serial console can fail since the cpu_nap() in getchar_timeout() can delay processing for more than the time it takes for a single character to arrive. Fix by enabling the UART FIFOs. Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Avoid completely filling the TX descriptor ringMichael Brown2014-04-222-1/+4
| | | | | | | | | | | | | It is unclear from the datasheets whether or not the TX ring can be completely filled (i.e. whether writing the tail value as equal to the current head value will cause the ring to be treated as completely full or completely empty). It is very plausible that this edge case could differ in behaviour between real hardware and the many implementations of an emulated Intel NIC found in various virtual machines. Err on the side of caution and always leave at least one ring entry empty. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow wildcard matches on commonName as well as subjectAltNameMichael Brown2014-04-011-10/+8Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for subjectAltName and wildcard certificatesMichael Brown2014-03-314-8/+160
| | | | | Originally-implemented-by: Alex Chernyakhovsky <achernya@google.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add subject alternative names to X.509 server test certificateMichael Brown2014-03-311-69/+75
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add tests for x509_check_name()Michael Brown2014-03-311-0/+38
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Rewrite CMS tests using okx()Michael Brown2014-03-311-14/+40
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Rewrite X.509 tests using okx()Michael Brown2014-03-311-61/+145
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow signed timestamp error margin to be configured at build timeMichael Brown2014-03-304-12/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use fingerprint when no common name is available for debug messagesMichael Brown2014-03-281-4/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 cache to a full certificate storeMichael Brown2014-03-2818-398/+640
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add pubkey_match() to check for matching public/private key pairsMichael Brown2014-03-272-26/+107
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Add dependency of generated files upon MakefileMichael Brown2014-03-261-5/+5
| | | | | | | Ensure that any generated files (such as DER forms of X.509 certificates) are rebuilt if the Makefile changes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Disable ccache for all relevant build targetsMichael Brown2014-03-261-4/+3Star
| | | | | | | | | The build process currently attempts to disable ccache for files using the .incbin directive, but the rule fails to apply to anything beyond the simple object target. Fix by applying to all relevant build targets (including debug objects, assembly listings, and so on). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove long-obsolete mechanism for wrapping embedded imagesMichael Brown2014-03-261-9/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate OCSP URIMichael Brown2014-03-254-35/+19Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate nameMichael Brown2014-03-256-108/+143
| | | | | | | | | | | | | | iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Handle OCSP responses that don't provide certificatesAlexander Chernyakhovsky2014-03-251-2/+7
| | | | | | | | | Certificate authorities are not required to send the certificate used to sign the OCSP response if the response is signed by the original issuer. Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-02 05:25:29 +0100