summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* [undi] Clean up driver and device name informationMichael Brown2016-12-055-39/+32Star
| | | | | | | | | | | | | | | | | | | | Fix the <NULL> driver name reported by "ifstat" when using the undipci driver (due to the unnecessary extra device node inserted as a child of the PCI device). Remove the "UNDI-" prefix from device names since the driver name is also now visible via "ifstat", and tidy up the device name to match the format used by standard PCI devices. The output from "ifstat" now resembles: iPXE> ifstat net0: 52:54:00:12:34:56 using undipci on 0000:00:03.0 iPXE> ifstat net0: 52:54:00:12:34:56 using undionly on 0000:00:03.0 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [romprefix] Avoid using PMM-allocated memory in UNDI loader entry pointMichael Brown2016-12-052-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The UNDI loader entry point is very likely to be called after POST, when there is a high chance that the PMM-allocated image source area and decompression area have been reused by something else. In particular, using an iPXE .iso to test a separate iPXE ROM's UNDI loader entry point in a qemu VM is likely to crash. SeaBIOS allocates PMM blocks from close to the top of memory and so these blocks have a high chance of colliding with the runtime addresses subsequently chosen by the non-ROM iPXE by scanning the INT 15,e820 memory map. The standard romprefix.S has no choice about relying on the PMM-allocated image source area, since it has no other way to retrieve its compressed payload. In mromprefix.S, the image source area functions only as an optional buffer used to avoid repeated reads from the (potentially slow) expansion ROM BAR by the decompression code. We can therefore always set %esi=0 when calling install_prealloc from the UNDI loader entry point, and simply fall back to reading directly from the expansion ROM BAR. We can always set %edi=0 when calling install_prealloc from the UNDI loader entry point. This will behave as though the decompression area PMM allocation failed, and will therefore use INT 15,88 to find a temporary decompression area somewhere close to 64MB. This is by no means guaranteed to be safe from collisions, but it's probably safer on balance than the PMM-allocated address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [undi] Allocate base memory before calling UNDI loader entry pointMichael Brown2016-12-051-14/+16
| | | | | | | | Allocate base memory (by decreasing the free base memory counter) before calling the UNDI loader entry point, to minimise surprises for the UNDI loader code. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add basic EFI SAN booting capabilityMichael Brown2016-11-175-1/+1097
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Avoid potential infinite loops during shutdownMichael Brown2016-11-171-0/+1
| | | | | | | | The command and data interfaces may be connected to the same object. Nullify the data interface before shutting down the control interface to avoid potential infinite loops. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Provide intf_reinit() to reinitialise nullified interfacesMichael Brown2016-11-163-6/+20
| | | | | | | Provide an abstraction intf_reinit() to restore the descriptor of a previously nullified interface. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Disable TIVOLI_VMM_WORKAROUND in the qemu configurationLaszlo Ersek2016-11-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents KVM guests from crashing that run iPXE on host CPUs without "unrestricted_guest" support. Once KVM gets the FXSAVE / FXRSTOR emulation feature (*), and the feature becomes widely available to users, we can back out this change from iPXE. (*) Already in progress by Radim: [PATCH 0/2] KVM: x86: emulate fxsave and fxrstor https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1258895.html https://www.spinics.net/lists/kernel/msg2370327.html Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Conditionalize the workaround for the Tivoli VMM's SSE garblingLaszlo Ersek2016-11-082-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 71560d1 ("[librm] Preserve FPU, MMX and SSE state across calls to virt_call()") added FXSAVE and FXRSTOR instructions to iPXE. In KVM virtual machines, these instructions execute fine as long as the host CPU supports the "unrestricted_guest" feature (that is, it can virtualize big real mode natively). On older host CPUs however, KVM has to emulate big real mode, and it currently doesn't implement FXSAVE emulation. Upstream QEMU rebuilt iPXE at commit 0418631 ("[thunderx] Fix compilation with older versions of gcc") which is a descendant of commit 71560d1 (see above). This was done in QEMU commit ffdc5a2 ("ipxe: update submodule from 4e03af8ec to 041863191"). The resultant binaries were bundled with the QEMU v2.7.0 release; see QEMU commit c52125a ("ipxe: update prebuilt binaries"). This distributed the iPXE workaround for the Tivoli VMM bug to a number of KVM users with old host CPUs, causing KVM emulation failures (guest crashes) for them while netbooting. Make the FXSAVE and FXRSTOR instructions conditional on a new feature test macro called TIVOLI_VMM_WORKAROUND. Define the macro by default. There is prior art for an assembly file including config/general.h: see arch/x86/prefix/romprefix.S. Also, TIVOLI_VMM_WORKAROUND seems to be a good fit for the "Obscure configuration options" section in config/general.h. Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [bzimage] Fix page alignment of initrd imagesMichael Brown2016-10-291-3/+5
| | | | | | | | | | | | The initrd_addr_max field represents the highest byte address that may be used to hold initrd images, and is therefore almost certainly not aligned to a page boundary: a typical value might be 0x7fffffff. Fix the address calculations to ensure that the initrd images are always aligned to a page boundary. Reported-by: Sitsofe Wheeler <sitsofe@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add EFI_BLOCK_IO2_PROTOCOL header and GUID definitionMichael Brown2016-10-174-0/+216
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Update to current EDK2 headersMichael Brown2016-10-1615-46/+401
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Mark AppleNetBoot.h as a native iPXE headerMichael Brown2016-10-161-3/+3
| | | | | | | | | AppleNetBoot.h is not taken from the EDK2 codebase and so cannot be imported using include/ipxe/efi/import.pl. Mark as a native iPXE header (by changing the include guard) to avoid breaking the import process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Mark permanent certificates as permanentMichael Brown2016-08-311-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add certificate management commandsMichael Brown2016-08-314-0/+309
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add certstat() to display basic certificate informationMichael Brown2016-08-313-2/+81
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificates to be marked as having been added explicitlyMichael Brown2016-08-312-4/+23
| | | | | | | | Allow certificates to be marked as having been added explicitly at run time. Such certificates will not be discarded via the certificate store cache discarder. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose certstore_del() to explicitly remove stored certificatesMichael Brown2016-08-312-4/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_next_entry() and list_prev_entry()Michael Brown2016-08-312-0/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown2016-08-255-10/+25
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add image_x509() to extract X.509 certificates from imageMichael Brown2016-08-252-0/+46
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pixbuf] Enable PNG format by defaultMichael Brown2016-07-296-31/+73
| | | | | | | Enable IMAGE_PNG (but not IMAGE_PNM) by default, and drag in the relevant objects only when image_pixbuf() is present in the binary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove more obsolete explicit object requirementsMichael Brown2016-07-291-6/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Enable both DER and PEM formats by defaultMichael Brown2016-07-295-43/+83
| | | | | | | | | | Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove obsolete explicit object requirementsMichael Brown2016-07-291-4/+0Star
| | | | | | | | As of commit b1caa48 ("[crypto] Support SHA-{224,384,512} in X.509 certificates"), the list of supported cryptographic algorithms is controlled by config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Use image_asn1() to extract data from CMS signature imagesMichael Brown2016-07-292-12/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add PEM image formatMichael Brown2016-07-297-0/+343
| | | | | | | | | | | Add PEM-encoded ASN.1 as an image format. We accept as PEM any image containing a line starting with a "-----BEGIN" boundary marker. We allow for PEM files containing multiple ASN.1 objects, such as a certificate chain produced by concatenating individual certificate files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add DER image formatMichael Brown2016-07-299-0/+396
| | | | | | | | Add DER-encoded ASN.1 as an image format. There is no fixed signature for DER files. We treat an image as DER if it comprises a single valid SEQUENCE object covering the entire length of the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add image_asn1() to extract ASN.1 objects from imageMichael Brown2016-07-292-0/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for parsing of partial ASN.1 cursorsMichael Brown2016-07-282-6/+9
| | | | | | | | | Allow code to create a partial ASN.1 cursor containing only the type and length bytes, so that asn1_start() may be used to determine the length of a large ASN.1 blob without first allocating memory to hold the entire blob. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove obsolete extern declaration for asn1_invalidate_cursor()Michael Brown2016-07-281-1/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [hyperv] Use instance UUID in device nameMichael Brown2016-07-262-2/+6
| | | | | | | | | | The Windows drivers for VMBus devices are enumerated using the instance UUID rather than the channel number. Include the instance UUID within the iPXE device name to allow an iPXE network device to be more easily associated with the corresponding Windows network device when debugging. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Allow for multiple routersMichael Brown2016-07-254-51/+452
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Select the IPv6 source address and corresponding router (if any) using a very simplified version of the algorithm from RFC6724: - Ignore any source address that has a smaller scope than the destination address. For example, do not use a link-local source address when sending to a global destination address. - If we have a source address which is on the same link as the destination address, then use that source address. - If we are left with multiple possible source addresses, then choose the address with the smallest scope. For example, if we are sending to a site-local destination address and we have both a global source address and a site-local source address, then use the site-local source address. - If we are still left with multiple possible source addresses, then choose the address with the longest matching prefix. For the purposes of this algorithm, we treat RFC4193 Unique Local Addresses as having organisation-local scope. Since we use only link-local scope for our multicast transmissions, this approximation should remain valid in all practical situations. Originally-implemented-by: Thomas Bächler <thomas@archlinux.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Update IPv6 tests to use okx()Michael Brown2016-07-251-25/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Rename ipv6_scope to ipv6_settings_scopeMichael Brown2016-07-213-8/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Create routing table based on IPv6 settingsMichael Brown2016-07-204-191/+138Star
| | | | | | | | | | | | | | | | | | | | | | Use the IPv6 settings to construct the routing table, in a matter analogous to the construction of the IPv4 routing table. This allows for manual assignment of IPv6 addresses via e.g. set net0/ip6 2001:ba8:0:1d4::6950:5845 set net0/len6 64 set net0/gateway6 fe80::226:bff:fedd:d3c0 The prefix length ("len6") may be omitted, in which case a default prefix length of 64 will be assumed. Multiple IPv6 addresses may be assigned manually by implicitly creating child settings blocks. For example: set net0/ip6 2001:ba8:0:1d4::6950:5845 set net0.ula/ip6 fda4:2496:e992::6950:5845 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Match user expectations for IPv6 settings prioritiesMichael Brown2016-07-194-2/+31
| | | | | | | | | | | | | | A reasonable user expectation is that ${net0/ip6} should show the "highest-priority" of the IPv6 addresses, even when multiple IPv6 addresses are active. The expected order of priority is likely to be manually-assigned addresses first, then stateful DHCPv6 addresses, then SLAAC addresses, and lastly link-local addresses. Using ${priority} to enforce an ordering is undesirable since that would affect the priority assigned to each of the net<N> blocks as a whole, so use the sibling ordering capability instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Allow settings blocks to specify a sibling orderingMichael Brown2016-07-192-0/+4
| | | | | | | Allow settings blocks to provide an explicit default ordering between siblings, with lower precedence than the existing ${priority} setting. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Expose IPv6 link-local address settingsMichael Brown2016-07-192-0/+116
| | | | | | Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Expose IPv6 address setting acquired through DHCPv6Michael Brown2016-07-191-18/+49
| | | | | | Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Expose IPv6 settings acquired through NDPMichael Brown2016-07-193-5/+282
| | | | | | | | | Expose the IPv6 address (or prefix) as ${ip6}, the prefix length as ${len6}, and the router address as ${gateway6}. Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Allow settings to comprise arbitrary subsets of NDP optionsMichael Brown2016-07-191-35/+67
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Correctly mortalise autovivified child settings blocksMichael Brown2016-07-191-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Rename ipv6_scope to dhcpv6_scopeMichael Brown2016-07-165-8/+8
| | | | | | | | The settings scope ipv6_scope refers specifically to IPv6 settings that have a corresponding DHCPv6 option. Rename to dhcpv6_scope to more accurately reflect this purpose. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Create space for IPv6 in settings display orderMichael Brown2016-07-154-22/+26
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Perform SLAAC only during autoconfigurationMichael Brown2016-07-151-8/+14
| | | | | | | | | | | | | | | | | | We currently perform IPv6 stateless address autoconfiguration (SLAAC) in response to any router advertisement with the relevant flags set. This can result in the local IPv6 source address changing midway through a TCP connection, since our connections bind only to a local port number and do not store a local network address. In addition, this behaviour for SLAAC is inconsistent with that for DHCPv4 and stateful DHCPv6, both of which will be performed only as a result of an explicit autoconfiguration action (e.g. via the default autoboot sequence, or the "ifconf" command). Fix by ignoring router advertisements arriving outside the context of an ongoing autoconfiguration attempt. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Remove duplicate intelvf_mbox_queues() functionMichael Brown2016-07-141-41/+0Star
| | | | | | | | Commit db34436 ("[intel] Strip spurious VLAN tags received by virtual function NICs") accidentally introduced two copies of the intel[x]vf_mbox_queues() function. Remove the unintended copy. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Strip spurious VLAN tags received by virtual function NICsMichael Brown2016-07-124-0/+144
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The physical function may be configured to transparently insert a VLAN tag into all transmitted packets. Unfortunately, it does not equivalently strip this same VLAN tag from all received packets. This behaviour may be observed in some Amazon EC2 instances with Enhanced Networking enabled: transmissions work as expected but all packets received by iPXE appear to have a spurious VLAN tag. We can configure the receive queue to strip VLAN tags via the RXDCTL.VME bit. We need to find out from the PF driver whether or not we should do so. There exists a "get queue configuration" mailbox message which contains a field labelled IXGBE_VF_TRANS_VLAN in the Linux driver. A comment in the Linux PF driver describes this field as "notify VF of need for VLAN tag stripping, and correct queue". It will be filled with a non-zero value if the PF is enforcing the use of a single VLAN tag. It will also be filled with a non-zero value if the PF is using multiple traffic classes. The Linux VF driver seems to treat this field as being simply the number of traffic classes, and gives it no VLAN-related interpretation. The Linux VF driver instead handles the VLAN tag stripping by simply assuming that any unrecognised VLAN tag ought to be silently dropped. We choose to strip and ignore the VLAN tag if the IXGBE_VF_TRANS_VLAN field has a non-zero value. Reported-by: Leonid Vasetsky <leonidv@velostrata.com> Tested-by: Leonid Vasetsky <leonidv@velostrata.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Send gratuitous ARPs whenever a new IPv4 address is appliedMichael Brown2016-07-121-20/+80
| | | | | | | | | | | | | | | | | | | | In a busy network (such as a public cloud), IPv4 addresses may be recycled rapidly. When this happens, unidirectional traffic (such as UDP syslog) will succeed, but bidirectional traffic (such as TCP connections) may fail due to stale ARP cache entries on other nodes. The remote ARP cache expiry timeout is likely to exceed iPXE's connection timeout, meaning that boot attempts can fail before the problem is automatically resolved. Fix by sending gratuitous ARPs whenever an IPv4 address is changed, to attempt to update stale remote ARP cache entries. Note that this is not a guaranteed fix, since ARP is an unreliable protocol. We avoid sending gratuitous ARPs unconditionally, since otherwise any unrelated settings change (e.g. "set dns 192.168.0.1") would cause unexpected gratuitous ARPs to be sent. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Add PCI device ID for I219-V/LMLukas Grossar2016-07-121-0/+2
| | | | | Signed-off-by: Lukas Grossar <lukas.grossar@adfinis-sygroup.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Allow time for ACPI power off to take effectMichael Brown2016-07-111-0/+6
| | | | | | | | | The ACPI power off sequence may not take effect immediately. Delay for one second, to eliminate potentially confusing log messages such as "Could not power off: Error 0x43902001 (http://ipx". Reported-by: Leonid Vasetsky <leonidv@velostrata.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-02-28 12:56:17 +0100