summaryrefslogtreecommitdiffstats
path: root/src/config
Commit message (Collapse)AuthorAgeFilesLines
* [time] Add support for the ACPI power management timerMichael Brown2018-03-201-0/+3
| | | | | | | | Allow the ACPI power management timer to be used if enabled via TIMER_ACPI in config/timer.h. This provides an alternative timer on systems where the standard 8254 PIT is unavailable or unreliable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Allow OCSP checks to be disabledMichael Brown2018-03-181-0/+8
| | | | | | | | | Some CAs provide non-functional OCSP servers, and some clients are forced to operate on networks without access to the OCSP servers. Allow the user to explicitly disable the use of OCSP checks by undefining OCSP_CHECK in config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add support for NTLM authenticationMichael Brown2017-11-122-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [shell] Enable "shell" command even when BANNER_TIMEOUT is zeroMichael Brown2017-08-012-0/+4
| | | | | | | | | | | Setting BANNER_TIMEOUT to zero removes the only symbol reference to shell.o, causing the "shell" command to become unavailable. Add SHELL_CMD in config/general.h (enabled by default) which will explicitly drag in shell.o regardless of the value of BANNER_TIMEOUT. Reported-by: Julian Brost <julian@0x4a42.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Expose ACPI tables via settings mechanismMichael Brown2017-05-232-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Allow values to be read from ACPI tables using the syntax ${acpi/<signature>.<index>.0.<offset>.<length>} where <signature> is the ACPI table signature as a 32-bit hexadecimal number (e.g. 0x41504093 for the 'APIC' signature on the MADT), <index> is the index into the array of tables matching this signature, <offset> is the byte offset within the table, and <length> is the field length in bytes. Numeric values are returned in reverse byte order, since ACPI numeric values are usually little-endian. For example: ${acpi/0x41504943.0.0.0.0} - entire MADT table in raw hex ${acpi/0x41504943.0.0.0x0a.6:string} - MADT table OEM ID ${acpi/0x41504943.0.0.0x24.4:uint32} - local APIC address Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Provide access to ACPI tablesMichael Brown2017-05-231-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Make acpi_find_rsdt() a per-platform methodMichael Brown2017-05-232-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Use dummy SAN deviceMichael Brown2017-03-281-1/+7
| | | | | | | Allow for easier testing of SAN code by using the dummy SAN device by default. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add missing SANBOOT_PROTO_HTTP to EFI default configurationMichael Brown2017-03-071-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Allow timer to be selected at runtimeMichael Brown2017-01-261-0/+48
| | | | | | | | | | | | | | | | | | | | | | Allow the active timer (providing udelay() and currticks()) to be selected at runtime based on probing during the INIT_EARLY stage of initialisation. TICKS_PER_SEC is now a fixed compile-time constant for all builds, and is independent of the underlying clock tick rate. We choose the value 1024 to allow multiplications and divisions on seconds to be converted to bit shifts. TICKS_PER_MS is defined as 1, allowing multiplications and divisions on milliseconds to be omitted entirely. The 2% inaccuracy in this definition is negligible when using the standard BIOS timer (running at around 18.2Hz). TIMER_RDTSC now checks for a constant TSC before claiming to be a usable timer. (This timer can be tested in KVM via the command-line option "-cpu host,+invtsc".) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Show CPU vendor and model in example cloud boot scriptsMichael Brown2017-01-243-0/+6
| | | | | | | | | Some problems arise only when running on a specific CPU type (e.g. non-functional timer interrupts as observed in Azure AMD instances). Include the CPU vendor and model within the sample cloud boot scripts, to assist in debugging such problems. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Add ability to retrieve Google Compute Engine metadataMichael Brown2017-01-234-0/+15
| | | | | | | | | | | | | | | | | | | | | | | For some unspecified "security" reason, the Google Compute Engine metadata server will refuse any requests that do not include the non-standard HTTP header "Metadata-Flavor: Google". Attempt to autodetect such requests (by comparing the hostname against "metadata.google.internal"), and add the "Metadata-Flavor: Google" header if applicable. Enable this feature in the CONFIG=cloud build, and include a sample embedded script allowing iPXE to boot from a script configured as metadata via e.g. # Create shared boot image make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/gce.ipxe # Configure per-instance boot script gcloud compute instances add-metadata <instance> \ --metadata-from-file ipxeboot=boot.ipxe Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add basic EFI SAN booting capabilityMichael Brown2016-11-171-1/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Disable TIVOLI_VMM_WORKAROUND in the qemu configurationLaszlo Ersek2016-11-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents KVM guests from crashing that run iPXE on host CPUs without "unrestricted_guest" support. Once KVM gets the FXSAVE / FXRSTOR emulation feature (*), and the feature becomes widely available to users, we can back out this change from iPXE. (*) Already in progress by Radim: [PATCH 0/2] KVM: x86: emulate fxsave and fxrstor https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1258895.html https://www.spinics.net/lists/kernel/msg2370327.html Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Conditionalize the workaround for the Tivoli VMM's SSE garblingLaszlo Ersek2016-11-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 71560d1 ("[librm] Preserve FPU, MMX and SSE state across calls to virt_call()") added FXSAVE and FXRSTOR instructions to iPXE. In KVM virtual machines, these instructions execute fine as long as the host CPU supports the "unrestricted_guest" feature (that is, it can virtualize big real mode natively). On older host CPUs however, KVM has to emulate big real mode, and it currently doesn't implement FXSAVE emulation. Upstream QEMU rebuilt iPXE at commit 0418631 ("[thunderx] Fix compilation with older versions of gcc") which is a descendant of commit 71560d1 (see above). This was done in QEMU commit ffdc5a2 ("ipxe: update submodule from 4e03af8ec to 041863191"). The resultant binaries were bundled with the QEMU v2.7.0 release; see QEMU commit c52125a ("ipxe: update prebuilt binaries"). This distributed the iPXE workaround for the Tivoli VMM bug to a number of KVM users with old host CPUs, causing KVM emulation failures (guest crashes) for them while netbooting. Make the FXSAVE and FXRSTOR instructions conditional on a new feature test macro called TIVOLI_VMM_WORKAROUND. Define the macro by default. There is prior art for an assembly file including config/general.h: see arch/x86/prefix/romprefix.S. Also, TIVOLI_VMM_WORKAROUND seems to be a good fit for the "Obscure configuration options" section in config/general.h. Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add certificate management commandsMichael Brown2016-08-312-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pixbuf] Enable PNG format by defaultMichael Brown2016-07-293-7/+40
| | | | | | | Enable IMAGE_PNG (but not IMAGE_PNM) by default, and drag in the relevant objects only when image_pixbuf() is present in the binary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Enable both DER and PEM formats by defaultMichael Brown2016-07-293-8/+41
| | | | | | | | | | Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add PEM image formatMichael Brown2016-07-292-0/+4
| | | | | | | | | | | Add PEM-encoded ASN.1 as an image format. We accept as PEM any image containing a line starting with a "-----BEGIN" boundary marker. We allow for PEM files containing multiple ASN.1 objects, such as a certificate chain produced by concatenating individual certificate files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add DER image formatMichael Brown2016-07-292-0/+4
| | | | | | | | Add DER-encoded ASN.1 as an image format. There is no fixed signature for DER files. We treat an image as DER if it comprises a single valid SEQUENCE object covering the entire length of the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "ntp" commandMichael Brown2016-06-132-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arm] Add support for 64-bit ARM (Aarch64)Michael Brown2016-05-081-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arm] Add support for 32-bit ARMMichael Brown2016-05-061-2/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ethernet] Make LACP support configurable at build timeMichael Brown2016-04-182-0/+4
| | | | | | | Add a build configuration option NET_PROTO_LACP to control whether or not LACP support is included for Ethernet devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow cross-certificate source to be configured at build timeMichael Brown2016-03-241-0/+8
| | | | | | | | | Provide a build option CROSSCERT in config/crypto.h to allow the default cross-signed certificate source to be configured at build time. The ${crosscert} setting may still be used to reconfigure the cross-signed certificate source at runtime. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Provide access to files stored on EFI filesystemsMichael Brown2016-03-143-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | Provide access to local files via the "file://" URI scheme. There are three syntaxes: - An opaque URI with a relative path (e.g. "file:script.ipxe"). This will be interpreted as a path relative to the iPXE binary. - A hierarchical URI with a non-network absolute path (e.g. "file:/boot/script.ipxe"). This will be interpreted as a path relative to the root of the filesystem from which the iPXE binary was loaded. - A hierarchical URI with a network path in which the authority is a volume label (e.g. "file://bootdisk/script.ipxe"). This will be interpreted as a path relative to the root of the filesystem with the specified volume label. Note that the potentially desirable shell mappings (e.g. "fs0:" and "blk0:") are concepts internal to the UEFI shell binary, and do not seem to be exposed in any way to external executables. The old EFI_SHELL_PROTOCOL (which did provide access to these mappings) is no longer installed by current versions of the UEFI shell. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xsigo] Add support for Xsigo virtual Ethernet (XVE) EoIB devicesMichael Brown2016-03-092-0/+4
| | | | | | | | | Add support for EoIB devices as implemented by Xsigo. Based on the public (but out-of-tree) Linux kernel drivers at https://oss.oracle.com/git/?p=linux-uek.git;a=log;h=v4.1.12-32.2.1 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Make IPoIB support configurable at build timeMichael Brown2016-03-092-0/+13
| | | | | | | Add a build configuration option VNIC_IPOIB to control whether or not IPoIB support is included for Infiniband devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Add "ibstat" commandMichael Brown2016-03-082-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Support ioremap() for addresses above 4GB in a 64-bit buildMichael Brown2016-02-261-1/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ioapi] Split ioremap() out to a separate IOMAP APIMichael Brown2016-02-262-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Add named configuration for public cloud environmentsMichael Brown2016-01-189-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | Add a named CONFIG=cloud configuration, which enables console types useful for obtaining output from virtual machines in public clouds such as AWS EC2. An image suitable for use in AWS EC2 can be built using make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/aws.ipxe The embedded script will direct iPXE to download and execute the EC2 "user-data" file, which is always available to an EC2 VM via the URI http://169.254.169.254/latest/user-data (regardless of the VPC networking settings). The boot can therefore be controlled by modifying the per-instance user data, without having to modify the boot disk image. Console output can be obtained via syslog (with a syslog server configured in the user-data script), via the AWS "System Log" (after the instance has been stopped), or as a last resort from the log partition on the boot disk. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Limit maximum number of DHCP discovery deferralsMichael Brown2015-11-101-0/+6
| | | | | | | | | For switches which remain permanently in the non-forwarding state (or which erroneously report a non-forwarding state), ensure that iPXE will eventually give up waiting for the link to become unblocked. Originally-fixed-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add support for EFI_GRAPHICS_OUTPUT_PROTOCOL frame buffer consolesMichael Brown2015-10-161-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Generalise CONSOLE_VESAFB to CONSOLE_FRAMEBUFFERMichael Brown2015-10-165-10/+133
| | | | | | | | | | | The name "vesafb" is intrinsically specific to a BIOS environment. Generalise the build configuration option CONSOLE_VESAFB to CONSOLE_FRAMEBUFFER, in preparation for adding EFI framebuffer support. Existing configurations using CONSOLE_VESAFB will continue to work. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Tidy up config/console.hMichael Brown2015-10-161-7/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Expose unused USB devices via EFI_USB_IO_PROTOCOLMichael Brown2015-09-143-5/+23
| | | | | | | Allow the UEFI platform firmware to provide drivers for unrecognised devices, by exposing our own implementation of EFI_USB_IO_PROTOCOL. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add a USB host controller driver based on EFI_USB_IO_PROTOCOLMichael Brown2015-09-072-0/+4
| | | | | | | | | | | | | | | | | | | | | Allow iPXE to coexist with other USB device drivers, by attaching to the EFI_USB_IO_PROTOCOL instances provided by the UEFI platform firmware. The EFI_USB_IO_PROTOCOL is an unsurprisingly badly designed abstraction of a USB device. The poor design choices intrinsic in the UEFI specification prevent efficient operation as a network device, with the result that devices operated using the EFI_USB_IO_PROTOCOL operate approximately two orders of magnitude slower than devices operated using our native EHCI or xHCI host controller drivers. Since the performance is so abysmally slow, and since the underlying problems are due to fundamental architectural mistakes in the UEFI specification, support for the EFI_USB_IO_PROTOCOL host controller driver is left as disabled by default. Users are advised to use the native iPXE host controller drivers instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Add support for PeerDist (aka BranchCache) HTTP content encodingMichael Brown2015-08-172-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Add individual block download mechanismMichael Brown2015-08-171-0/+12
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Add segment discovery mechanismMichael Brown2015-08-171-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Rewrite HTTP core to support content encodingsMichael Brown2015-08-174-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite the HTTP core to allow for the addition of arbitrary content encoding mechanisms, such as PeerDist and gzip. The core now exposes http_open() which can be used to create requests with an explicitly selected HTTP method, an optional requested content range, and an optional request body. A simple wrapper provides the preexisting behaviour of creating either a GET request or an application/x-www-form-urlencoded POST request (if the URI includes parameters). The HTTP SAN interface is now implemented using the generic block device translator. Individual blocks are requested using http_open() to create a range request. Server connections are now managed via a connection pool; this allows for multiple requests to the same server (e.g. for SAN blocks) to be completely unaware of each other. Repeated HTTPS connections to the same server can reuse a pooled connection, avoiding the per-connection overhead of establishing a TLS session (which can take several seconds if using a client certificate). Support for HTTP SAN booting and for the Basic and Digest authentication schemes is now optional and can be controlled via the SANBOOT_PROTO_HTTP, HTTP_AUTH_BASIC, and HTTP_AUTH_DIGEST build configuration options in config/general.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Support SHA-{224,384,512} in X.509 certificatesMichael Brown2015-08-022-0/+109
| | | | | | | | | Add support for SHA-224, SHA-384, and SHA-512 as digest algorithms in X.509 certificates, and allow the choice of public-key, cipher, and digest algorithms to be configured at build time via config/crypto.h. Originally-implemented-by: Tufan Karadere <tufank@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fault] Generalise NETDEV_DISCARD_RATE fault injection mechanismMichael Brown2015-07-222-1/+19
| | | | | | | Provide a generic inject_fault() function that can be used to inject random faults with configurable probabilities. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Add named configuration for qemuMichael Brown2015-07-228-0/+10
| | | | | | | | Add a named configuration for qemu, based on the config.ipxe.general.h file taken from the current qemu repository and enabling the option to work around the missing EFI_PXE_BASE_CODE_PROTOCOL. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Allow user experience to be downgradedMichael Brown2015-07-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | iPXE does not currently provide EFI_PXE_BASE_CODE_PROTOCOL: this causes failures when chainloading bootloaders such as shim.efi which assume that this protocol will be present. Provide the ability to work around these problems via the build configuration option EFI_DOWNGRADE_UX. If this option is enabled, then we will not install our usual EFI_LOAD_FILE_PROTOCOL implementation, thereby allowing the platform firmware to install its own EFI_PXE_BASE_CODE_PROTOCOL implementation on top of our EFI_SIMPLE_NETWORK_PROTOCOL handle. A somewhat major side-effect of this workaround is that almost all iPXE features will be disabled. This configuration option will be removed in future when support for EFI_PXE_BASE_CODE_PROTOCOL is added. Requested-by: Laszlo Ersek <lersek@redhat.com> Requested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [serial] Use new UART abstraction in serial console driverMichael Brown2015-06-292-6/+1Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [stp] Add support for detecting Spanning Tree Protocol non-forwarding portsMichael Brown2015-06-252-0/+4
| | | | | | | | | | | | | | | | | | A fairly common end-user problem is that the default configuration of a switch may leave the port in a non-forwarding state for a substantial length of time (tens of seconds) after link up. This can cause iPXE to time out and give up attempting to boot. We cannot force the switch to start forwarding packets sooner, since any attempt to send a Spanning Tree Protocol bridge PDU may cause the switch to disable our port (if the switch happens to have the Bridge PDU Guard feature enabled for the port). For non-ancient versions of the Spanning Tree Protocol, we can detect whether or not the port is currently forwarding and use this to inform the network device core that the link is currently blocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [int13con] Add basic ability to log to a local disk via INT 13Michael Brown2015-05-192-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several popular public cloud providers do not provide any sensible mechanism for obtaining debug output from an OS which is failing to boot. For example, Amazon EC2 provides the "Get System Log" facility, which occasionally deigns to report a random subset of the characters emitted via the VM's serial port, but usually returns only a blank screen. (Amazingly, this is still superior to the debugging facilities provided by Azure.) Work around these shortcomings by adding a console type which sends output to a magically detected raw disk partition, and including such a partition within any iPXE .usb-format image. To use this facility: - build an iPXE .usb image with CONSOLE_INT13 enabled - boot the cloud VM from this image - after the boot fails, attach the VM's boot disk to a second VM - from this second VM, use "less -f -R /dev/sdb3" (or similar) to view the iPXE output. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [usb] Add basic support for USB keyboardsMichael Brown2015-05-123-0/+14
| | | | | | | | | | | | When USB network card drivers are used, the BIOS' legacy USB capability is necessarily disabled since there is no way to share the host controller between the BIOS and iPXE. This currently results in USB keyboards becoming non-functional in USB-enabled builds of iPXE. Fix by adding basic support for USB keyboards, enabled by default in iPXE builds which include USB support. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-05-14 17:59:09 +0200