summaryrefslogtreecommitdiffstats
path: root/src/config
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' into openslxSimon Rettberg2023-10-064-0/+16
|\
| * [loong64] Add support for building EFI binariesXiaotian Wu2023-06-291-0/+5
| | | | | | | | | | | | Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Provide read-only access to EFI variables via settings mechanismMichael Brown2023-06-093-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EFI variables do not map neatly to the iPXE settings mechanism, since the EFI variable identifier includes a namespace GUID that cannot cleanly be supplied as part of a setting name. Creating a new EFI variable requires the variable's attributes to be specified, which does not fit within iPXE's settings concept. However, EFI variable names are generally unique even without the namespace GUID, and EFI does provide a mechanism to iterate over all existent variables. We can therefore provide read-only access to EFI variables by comparing only the names and ignoring the namespace GUIDs. Provide an "efi" settings block that implements this mechanism using a syntax such as: echo Platform language is ${efi/PlatformLang:string} show efi/SecureBoot:int8 Settings are returned as raw binary values by default since an EFI variable may contain boolean flags, integer values, ASCII strings, UCS-2 strings, EFI device paths, X.509 certificates, or any other arbitrary blob of data. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Implement "shim" as a dummy command on non-EFI platformsMichael Brown2023-05-242-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "shim" command will skip downloading the shim binary (and is therefore a conditional no-op) if there is already a selected EFI image that can be executed directly via LoadImage()/StartImage(). This allows the same iPXE script to be used with Secure Boot either enabled or disabled. Generalise this further to provide a dummy "shim" command that is an unconditional no-op on non-EFI platforms. This then allows the same iPXE script to be used for BIOS, EFI with Secure Boot disabled, or EFI with Secure Boot enabled. The same effect could be achieved by using "iseq ${platform} efi" within the script, but this would complicate end-user documentation. To minimise the code size impact, the dummy "shim" command is a pure no-op that does not call parse_options() and so will ignore even standardised arguments such as "--help". Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add "shim" commandMichael Brown2023-05-223-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | Allow a shim to be used to facilitate booting a kernel using a script such as: kernel /images/vmlinuz console=ttyS0,115200n8 initrd /images/initrd.img shim /images/shimx64.efi boot Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'master' into openslxSimon Rettberg2023-04-048-2/+80
|\|
| * [params] Rename "form parameter" to "request parameter"Michael Brown2023-03-011-1/+1
| | | | | | | | | | | | | | | | Prepare for the parameter mechanism to be generalised to specifying request parameters that are passed via mechanisms other than an application/x-www-form-urlencoded form. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Split out EFI_RNG_PROTOCOL as a separate entropy sourceMichael Brown2023-02-202-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 7ca801d ("[efi] Use the EFI_RNG_PROTOCOL as an entropy source if available") added EFI_RNG_PROTOCOL as an alternative entropy source via an ad-hoc mechanism specific to efi_entropy.c. Split out EFI_RNG_PROTOCOL to a separate entropy source, and allow the entropy core to handle the selection of RDRAND, EFI_RNG_PROTOCOL, or timer ticks as the active source. The fault detection logic added in commit a87537d ("[efi] Detect and disable seriously broken EFI_RNG_PROTOCOL implementations") may be removed completely, since the failure will already be detected by the generic ANS X9.82-mandated repetition count test and will now be handled gracefully by the entropy core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [rng] Allow entropy source to be selected at runtimeMichael Brown2023-02-174-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in commit 3c83843 ("[rng] Check for several functioning RTC interrupts"), experimentation shows that Hyper-V cannot be trusted to reliably generate RTC interrupts. (As noted in commit f3ba0fb ("[hyperv] Provide timer based on the 10MHz time reference count MSR"), Hyper-V appears to suffer from a general problem in reliably generating any legacy interrupts.) An alternative entropy source is therefore required for an image that may be used in a Hyper-V Gen1 virtual machine. The x86 RDRAND instruction provides a suitable alternative entropy source, but may not be supported by all CPUs. We must therefore allow for multiple entropy sources to be compiled in, with the single active entropy source selected only at runtime. Restructure the internal entropy API to allow a working entropy source to be detected and chosen at runtime. Enable the RDRAND entropy source for all x86 builds, since it is likely to be substantially faster than any other source. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Enable NET_PROTO_LLDP by defaultMichael Brown2023-02-052-1/+2
| | | | | | | | | | Requested-by: Christian I. Nilsson <nikize@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [lldp] Add support for the Link Layer Discovery ProtocolMichael Brown2023-02-052-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for recording LLDP packets and exposing TLV values via the settings mechanism. LLDP settings are encoded as ${netX.lldp/<prefix>.<type>.<index>.<offset>.<length>} where <type> is the TLV type <offset> is the starting offset within the TLV value <length> is the length (or zero to read the from <offset> to the end) <prefix>, if it has a non-zero value, is the subtype byte string of length <offset> to match at the start of the TLV value, up to a maximum matched length of 4 bytes <index> is the index of the entry matching <type> and <prefix> to be accessed, with zero indicating the first matching entry The <prefix> is designed to accommodate both matching of the OUI within an organization-specific TLV (e.g. 0x0080c2 for IEEE 802.1 TLVs) and of a subtype byte as found within many TLVs. This encoding allows most LLDP values to be extracted easily. For example System name: ${netX.lldp/5.0.0.0:string} System description: ${netX.lldp/6.0.0.0:string} Port description: ${netX.lldp/4.0.0.0:string} Port interface name: ${netX.lldp/5.2.0.1.0:string} Chassis MAC address: ${netX.lldp/4.1.0.1.0:hex} Management IPv4 address: ${netX.lldp/5.1.8.0.2.4:ipv4} Port VLAN ID: ${netX.lldp/0x0080c2.1.127.0.4.2:int16} Port VLAN name: ${netX.lldp/0x0080c2.3.127.0.7.0:string} Maximum frame size: ${netX.lldp/0x00120f.4.127.0.4.2:uint16} Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [tls] Add GCM cipher suitesMichael Brown2022-11-102-0/+15
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'master' into openslxSimon Rettberg2022-10-211-1/+1
|\|
| * [pci] Select PCI I/O API at runtime for cloud imagesMichael Brown2022-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pretty much all physical machines and off-the-shelf virtual machines will provide a functional PCI BIOS. We therefore default to using only the PCI BIOS, with no fallback to an alternative mechanism if the PCI BIOS fails. AWS EC2 provides the opportunity to experience some exceptions to this rule. For example, the t3a.nano instances in eu-west-1 have no functional PCI BIOS at all. As of commit 83516ba ("[cloud] Use PCIAPI_DIRECT for cloud images") we therefore use direct Type 1 configuration space accesses in the images built and published for use in the cloud. Recent experience has discovered yet more variation in AWS EC2 instances. For example, some of the metal instance types have multiple PCI host bridges and the direct Type 1 accesses therefore see only a subset of the PCI devices. Attempt to accommodate future such variations by making the PCI I/O API selectable at runtime and choosing ECAM (if available), falling back to the PCI BIOS (if available), then finally falling back to direct Type 1 accesses. This is implemented as a dedicated PCIAPI_CLOUD API, rather than by having the PCI core select a suitable API at runtime (as was done for timers in commit 302f1ee ("[time] Allow timer to be selected at runtime"). The common case will remain that only the PCI BIOS API is required, and we would prefer to retain the optimisations that come from inlining the configuration space accesses in this common case. Cloud images are (at present) disk images rather than ROM images, and so the increased code size required for this design approach in the PCIAPI_CLOUD case is acceptable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'master' into openslxSimon Rettberg2022-05-112-12/+34
|\|
| * [efi] Enable IMAGE_GZIP by default for AArch64Michael Brown2022-02-101-0/+4
| | | | | | | | | | | | | | | | | | AArch64 kernels tend to be distributed as gzip compressed images. Enable IMAGE_GZIP by default for AArch64 to avoid the need for uncompressed images to be provided. Originally-implemented-by: Alessandro Di Stefano <aleskandro@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Include Secure Boot Advanced Targeting (SBAT) metadataMichael Brown2022-01-131-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SBAT defines an encoding for security generation numbers stored as a CSV file within a special ".sbat" section in the signed binary. If a Secure Boot exploit is discovered then the generation number will be incremented alongside the corresponding fix. Platforms may then record the minimum generation number required for any given product. This allows for an efficient revocation mechanism that consumes minimal flash storage space (in contrast to the DBX mechanism, which allows for only a single-digit number of revocation events to ever take place across all possible signed binaries). Add SBAT metadata to iPXE EFI binaries to support this mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [doc] Update user-visible ipxe.org URIs to use HTTPSMichael Brown2022-01-131-12/+12
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Local UEFI disk boot supportSimon Rettberg2021-10-052-0/+9
|/ | | | | By Aaron Young: https://lists.ipxe.org/pipermail/ipxe-devel/2019-February/006504.html
* [cloud] Retry DHCP aggressively in AWS EC2Michael Brown2021-07-201-1/+16
| | | | | | | | | | | | | The DHCP service in EC2 has been observed to occasionally stop responding for bursts of several seconds. This can easily result in a failed boot, since the current cloud boot script will attempt DHCP only once. Work around this problem by retrying DHCP in a fairly tight cycle within the cloud boot script, and falling back to a reboot after several failed DHCP attempts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Show ifstat output after a failed boot attemptMichael Brown2021-06-232-2/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Support archive image formats independently of "imgextract" commandMichael Brown2021-05-123-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | Support for the zlib and gzip archive image formats is currently included only if the IMAGE_ARCHIVE_CMD is used to enable the "imgextract" command. The ability to transparently execute a single-member archive image without using the "imgextract" command renders this unintuitive: a user wanting to gain the ability to boot a gzip-compressed kernel image would expect to have to enable IMAGE_GZIP rather than IMAGE_ARCHIVE_CMD. Reverse the inclusion logic, so that archive image formats must now be enabled explicitly (via IMAGE_GZIP and/or IMAGE_ZLIB), with the archive image management commands dragged in as needed if any archive image formats are enabled. The archive image management commands may be explicitly disabled via IMAGE_ARCHIVE_CMD if necessary. This matches the behaviour of IBMGMT_CMD and similar options, where the relevant commands are included only when something else already drags in the underlying feature. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [gzip] Add support for gzip archive imagesMichael Brown2021-05-082-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [zlib] Add support for zlib archive imagesMichael Brown2021-05-082-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add "imgextract" command for extracting archive imagesMichael Brown2021-05-083-0/+36
| | | | | | | | Add the concept of extracting an image from an archive (which could be a single-file archive such as a gzip-compressed file), along with an "imgextract" command to expose this functionality to scripts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Attempt to include CPUID_SETTINGS only for x86 buildsMichael Brown2021-05-021-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Enable "poweroff" command in cloud imagesMichael Brown2021-04-101-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Provide ACPI settings via /sys/firmware/acpi/tablesMichael Brown2021-03-011-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Do not enable serial console on EFI platformsMichael Brown2021-02-171-0/+5
| | | | | | | | | | Most EFI firmware builds (including those found on ARM64 instances in AWS EC2) will already send console output to the serial port. Do not enable direct serial console output in EFI builds using CONFIG=cloud. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Enable IPv6 and HTTPS in cloud boot imagesMichael Brown2021-02-161-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Use PCIAPI_DIRECT for cloud imagesMichael Brown2021-02-135-0/+10
| | | | | | | | | | | | | | | | | | | | | | The version of SeaBIOS found on some AWS EC2 instances (observed with t3a.nano in eu-west-1) has no support for the INT 1A PCI BIOS calls. Bring config/ioapi.h into the named-configuration set of headers, and specify the use of PCIAPI_DIRECT for CONFIG=cloud, to work around the missing PCI BIOS support. Switching to a different named configuration will now unfortunately cause an almost complete rebuild of iPXE. As described in commit c801cb2 ("[build] Allow for named configurations at build time"), this is the reason why config/ioapi.h was not originally in the named-configuration set of header files. This rebuild cost is acceptable given that build times are substantially faster now than seven years ago, and that very few people are likely to be switching named configurations on a regular basis. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgmem" commandMichael Brown2021-01-222-0/+4
| | | | | | | Provide the "imgmem" command to create an image from an existing block of memory, for debugging purposes only. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Allow for links that remained blocked for up to three minutesMichael Brown2021-01-191-1/+1
| | | | | | | | | | | With the default timeouts for Cisco MAC Authentication Bypass, the link will remain blocked for around 90 seconds (plus a likely subsequent delay for STP). Extend the maximum number of DHCP discovery deferrals to allow for up to three minutes of waiting for a link to become unblocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [eap] Treat an EAP Request-Identity as indicating a blocked linkMichael Brown2021-01-192-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A switch port using 802.1x authentication will send EAP Request-Identity packets once the physical link is up, and will not be forwarding packets until the port identity has been established. We do not currently support 802.1x authentication. However, a reasonably common configuration involves using a preset list of permitted MAC addresses, with the "authentication" taking place between the switch and a RADIUS server. In this configuration, the end device does not need to perform any authentication step, but does need to be prepared for the switch port to fail to forward packets for a substantial time after physical link-up. This exactly matches the "blocked link" semantics already used when detecting a non-forwarding switch port via LACP or STP. Treat a received EAP Request-Identity as indicating a blocked link. Unlike LACP or STP, there is no way to determine the expected time until the next EAP packet and so we must choose a fixed timeout. Erroneously assuming that the link is blocked is relatively harmless since we will still attempt to transmit and receive data even over a link that is marked as blocked, and so the net effect is merely to prolong DHCP attempts. In contrast, erroneously assuming that the link is unblocked will potentially cause DHCP to time out and give up, resulting in a failed boot. The default EAP Request-Identity interval in Cisco switches (where this is most likely to be encountered in practice) is 30 seconds, so choose 45 seconds as a timeout that is likely to avoid gaps during which we falsely assume that the link is unblocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dma] Define a DMA API to allow for non-flat device address spacesMichael Brown2020-11-053-0/+3
| | | | | | | | | | | | | | | | | | | iPXE currently assumes that DMA-capable devices can directly address physical memory using host addresses. This assumption fails when using an IOMMU. Define an internal DMA API with two implementations: a "flat" implementation for use in legacy BIOS or other environments in which flat physical addressing is guaranteed to be used and all allocated physical addresses are guaranteed to be within a 32-bit address space, and an "operations-based" implementation for use in UEFI or other environments in which DMA mapping may require bus-specific handling. The purpose of the fully inlined "flat" implementation is to allow the trivial identity DMA mappings to be optimised out at build time, thereby avoiding an increase in code size for legacy BIOS builds. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Enable NET_PROTO_IPV6 by defaultTore Anderson2020-10-142-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | IPv6 PXE was included in the UEFI specification over eight years ago, specifically in version 2.3 (Errata D). http://www.uefi.org/sites/default/files/resources/UEFI_Spec_2_3_D.pdf When iPXE is being chainloaded from a UEFI firmware performing a PXE boot in an IPv6 network, it is essential that iPXE supports IPv6 as well. I understand that the reason for NET_PROTO_IPV6 being disabled by default (in src/config/general.h) is that it would cause certain space-constrained build targets to become too large. However, this should not be an issue for EFI builds. It is also worth noting that RFC 6540 makes a clear recommendation that IPv6 support should not be considered optional. https://tools.ietf.org/html/rfc6540 Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Tore Anderson <tore@fud.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [usbblk] Add support for USB mass storage devicesMichael Brown2020-10-134-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Some UEFI BIOSes (observed with at least the Insyde UEFI BIOS on a Microsoft Surface Go) provide a very broken version of the UsbMassStorageDxe driver that is incapable of binding to the standard EFI_USB_IO_PROTOCOL instances and instead relies on an undocumented proprietary protocol (with GUID c965c76a-d71e-4e66-ab06-c6230d528425) installed by the platform's custom version of UsbCoreDxe. The upshot is that USB mass storage devices become inaccessible once iPXE's native USB host controller drivers are loaded. One possible workaround is to load a known working version of UsbMassStorageDxe (e.g. from the EDK2 tree): this driver will correctly bind to the standard EFI_USB_IO_PROTOCOL instances exposed by iPXE. This workaround is ugly in practice, since it involves embedding UsbMassStorageDxe.efi into the iPXE binary and including an embedded script to perform the required "chain UsbMassStorageDxe.efi". Provide a native USB mass storage driver for iPXE, allowing USB mass storage devices to be exposed as iPXE SAN devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Avoid setting direction flag on EFI platformsMichael Brown2020-07-071-0/+1
| | | | | | | | | | | | | | | | | | | The only remaining use case in iPXE for the CPU direction flag is in __memcpy_reverse() where it is set to allow the use of "rep movsb" to perform the memory copy. This matches the equivalent functionality in the EDK2 codebase, which has functions such as InternalMemCopyMem that also temporarily set the direction flag in order to use "rep movsb". As noted in commit d2fb317 ("[crypto] Avoid temporarily setting direction flag in bigint_is_geq()"), some UEFI implementations are known to have buggy interrupt handlers that may reboot the machine if a timer interrupt happens to occur while the direction flag is set. Work around these buggy UEFI implementations by using the (unoptimised) generic_memcpy_reverse() on i386 or x86_64 UEFI platforms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Disable MD5 as an OID-identifiable algorithm by defaultMichael Brown2020-06-171-1/+1
| | | | | | | | | | | | | | | | Disable the use of MD5 as an OID-identifiable algorithm. Note that the MD5 algorithm implementation will still be present in the build, since it is used implicitly by various cryptographic components such as HTTP digest authentication; this commit removes it only from the list of OID-identifiable algorithms. It would be appropriate to similarly disable the use of SHA-1 by default, but doing so would break the use of OCSP since several OCSP responders (including the current version of openca-ocspd) are not capable of interpreting the hashAlgorithm field and so will fail if the client uses any algorithm other than the configured default. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow algorithms to be included without being OID-identifiableMichael Brown2020-06-162-12/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are many ways in which the object for a cryptographic algorithm may be included, even if not explicitly enabled in config/crypto.h. For example: the MD5 algorithm is required by TLSv1.1 or earlier, by iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM authentication. In the current implementation, inclusion of an algorithm for any reason will result in the algorithm's ASN.1 object identifier being included in the "asn1_algorithms" table, which consequently allows the algorithm to be used for any ASN1-identified purpose. For example: if the MD5 algorithm is included in order to support HTTP digest authentication, then iPXE would accept a (validly signed) TLS certificate using an MD5 digest. Split the ASN.1 object identifiers into separate files that are required only if explicitly enabled in config/crypto.h. This allows an algorithm to be omitted from the "asn1_algorithms" table even if the algorithm implementation is dragged in for some other purpose. The end result is that only the algorithms that are explicitly enabled in config/crypto.h can be used for ASN1-identified purposes such as signature verification. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Default to supporting only TLSv1.1 or aboveMichael Brown2020-06-161-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow a minimum TLS protocol version to be specifiedMichael Brown2020-06-121-0/+3
| | | | | | | | The supported ciphers and digest algorithms may already be specified via config/crypto.h. Extend this to allow a minimum TLS protocol version to be specified. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Add named configuration for Raspberry PiMichael Brown2019-07-198-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Register a device tree if provided by the platform firmwareMichael Brown2019-07-192-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fdt] Add ability to parse a MAC address from a flattened device treeMichael Brown2019-07-192-0/+54
| | | | | | | | | | | | | The Raspberry Pi NIC has no EEPROM to hold the MAC address. The platform firmware (e.g. UEFI or U-Boot) will typically obtain the MAC address from the VideoCore firmware and add it to the device tree, which is then made available to subsequent programs such as iPXE or the Linux kernel. Add the ability to parse a flattened device tree and to extract the MAC address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add support for the ACPI power management timerMichael Brown2018-03-201-0/+3
| | | | | | | | Allow the ACPI power management timer to be used if enabled via TIMER_ACPI in config/timer.h. This provides an alternative timer on systems where the standard 8254 PIT is unavailable or unreliable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Allow OCSP checks to be disabledMichael Brown2018-03-181-0/+8
| | | | | | | | | Some CAs provide non-functional OCSP servers, and some clients are forced to operate on networks without access to the OCSP servers. Allow the user to explicitly disable the use of OCSP checks by undefining OCSP_CHECK in config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add support for NTLM authenticationMichael Brown2017-11-122-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [shell] Enable "shell" command even when BANNER_TIMEOUT is zeroMichael Brown2017-08-012-0/+4
| | | | | | | | | | | Setting BANNER_TIMEOUT to zero removes the only symbol reference to shell.o, causing the "shell" command to become unavailable. Add SHELL_CMD in config/general.h (enabled by default) which will explicitly drag in shell.o regardless of the value of BANNER_TIMEOUT. Reported-by: Julian Brost <julian@0x4a42.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Expose ACPI tables via settings mechanismMichael Brown2017-05-232-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Allow values to be read from ACPI tables using the syntax ${acpi/<signature>.<index>.0.<offset>.<length>} where <signature> is the ACPI table signature as a 32-bit hexadecimal number (e.g. 0x41504093 for the 'APIC' signature on the MADT), <index> is the index into the array of tables matching this signature, <offset> is the byte offset within the table, and <length> is the field length in bytes. Numeric values are returned in reverse byte order, since ACPI numeric values are usually little-endian. For example: ${acpi/0x41504943.0.0.0.0} - entire MADT table in raw hex ${acpi/0x41504943.0.0.0x0a.6:string} - MADT table OEM ID ${acpi/0x41504943.0.0.0x24.4:uint32} - local APIC address Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-07-30 06:28:21 +0200