summaryrefslogtreecommitdiffstats
path: root/src/include/usr
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' into openslxopenslxSimon Rettberg2026-01-2818-1/+50
|\
| * [build] Mark known reviewed files as permitted for UEFI Secure BootMichael Brown2026-01-148-0/+8
| | | | | | | | | | | | | | | | | | Some past security reviews carried out for UEFI Secure Boot signing submissions have covered specific drivers or functional areas of iPXE. Mark all of the files comprising these areas as permitted for UEFI Secure Boot. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [build] Mark core files as permitted for UEFI Secure BootMichael Brown2026-01-148-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | Mark all files used in a standard build of bin-x86_64-efi/snponly.efi as permitted for UEFI Secure Boot. These files represent the core functionality of iPXE that is guaranteed to have been included in every binary that was previously subject to a security review and signed by Microsoft. It is therefore legitimate to assume that at least these files have already been reviewed to the required standard multiple times. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [image] Remove userptr_t from image definitionMichael Brown2025-04-221-1/+1
| | | | | | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [fdt] Add the concept of an FDT imageMichael Brown2025-03-271-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | Define the concept of an "FDT" image, representing a Flattened Device Tree blob that has been downloaded in order to be provided to a kernel or other executable image. FDT images are represented using an image tag (as with other special-purpose images such as the UEFI shim), and are similarly marked as hidden so that they will not be included in a generated magic initrd or show up in a virtual filesystem directory listing. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [image] Add the "imgdecrypt" commandMichael Brown2024-08-291-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the "imgdecrypt" command that can be used to decrypt a detached encrypted data image using a cipher key obtained from a separate CMS envelope image. For example: # Create non-detached encrypted CMS messages # openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \ -in vmlinuz -outform DER -out vmlinuz.cms openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \ -in initrd.img -outform DER -out initrd.img.cms # Detach data from envelopes (using iPXE's contrib/crypto/cmsdetach) # cmsdetach vmlinuz.cms -d vmlinuz.dat -e vmlinuz.env cmsdetach initrd.img.cms -d initrd.img.dat -e initrd.img.env and then within iPXE: #!ipxe imgfetch http://192.168.0.1/vmlinuz.dat imgfetch http://192.168.0.1/initrd.img.dat imgdecrypt vmlinuz.dat http://192.168.0.1/vmlinuz.env imgdecrypt initrd.img.dat http://192.168.0.1/initrd.img.env boot vmlinuz Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'aqc1xx' into openslxSimon Rettberg2024-04-121-1/+2
|\|
| * [block] Allow for additional SAN boot parameters alongside filenameMichael Brown2024-03-061-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The drive specification alone does not necessarily contain enough information to perform a SAN boot (or local disk boot) under UEFI. If the next-stage bootloader is installed in the EFI system partition under a non-standard name (e.g. "\EFI\debian\grubx64.efi") then this explicit boot filename must also be specified. Generalise this concept to use a "SAN boot configuration parameters" structure (currently containing only the optional explicit boot filename), to allow for easy expansion to provide other parameters such as the partition UUID or volume label. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'master' into openslxSimon Rettberg2023-10-061-0/+17
|\|
| * [efi] Support versions of shim that perform SBAT verificationMichael Brown2023-05-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The UEFI shim implements a fairly nicely designed revocation mechanism designed around the concept of security generations. Unfortunately nobody in the shim community has thus far added the relevant metadata to the Linux kernel, with the result that current versions of shim are incapable of booting current versions of the Linux kernel. Experience shows that there is unfortunately no point in trying to get a fix for this upstreamed into shim. We therefore default to working around this undesirable behaviour by patching data read from the "SbatLevel" variable used to hold SBAT configuration. Signed-off-by: Michael Brown <mcb30@ipxe.org>
| * [efi] Add support for executing images via a shimMichael Brown2023-05-221-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for using a shim as a helper to execute an EFI image. When a shim has been specified via shim(), the shim image will be passed to LoadImage() instead of the selected EFI image and the command line will be prepended with the name of the selected EFI image. The selected EFI image will be accessible to the shim via the virtual filesystem as a hidden file. Reduce the Secure Boot attack surface by removing, where possible, the spurious requirement for a third party second stage loader binary such as GRUB to be used solely in order to call the "shim lock protocol" entry point. Do not install the EFI PXE APIs when using a shim, since if shim finds EFI_PXE_BASE_CODE_PROTOCOL on the loaded image's device handle then it will attempt to download files afresh instead of using the files already downloaded by iPXE and exposed via the EFI_SIMPLE_FILE_SYSTEM protocol. (Experience shows that there is no point in trying to get a fix for this upstreamed into shim.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Merge branch 'master' into openslxSimon Rettberg2023-04-041-1/+2
|\|
| * [autoboot] Include VLAN tag in filter for identifying autoboot deviceMichael Brown2023-01-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | When chainloading iPXE from a VLAN device, the MAC address of the loaded image's device handle will match the MAC address of the trunk device created by iPXE, and the autoboot process will then erroneously consider the trunk device to be an autoboot device. Fix by recording the VLAN tag along with the MAC address, and treating the VLAN tag as part of the filter used to match the MAC address against candidate network devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* | Local UEFI disk boot supportSimon Rettberg2021-10-051-0/+15
|/ | | | | By Aaron Young: https://lists.ipxe.org/pipermail/ipxe-devel/2019-February/006504.html
* [image] Add "imgextract" command for extracting archive imagesMichael Brown2021-05-081-0/+16
| | | | | | | | Add the concept of extracting an image from an archive (which could be a single-file archive such as a gzip-compressed file), along with an "imgextract" command to expose this functionality to scripts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Expose "iflinkwait" as a commandMichael Brown2021-01-261-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Provide image_memory()Michael Brown2021-01-251-2/+1Star
| | | | | | | Consolidate the remaining logic common to initrd_init() and imgmem() into a shared image_memory() function. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgmem" commandMichael Brown2021-01-221-0/+2
| | | | | | | Provide the "imgmem" command to create an image from an existing block of memory, for debugging purposes only. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "--timeout" parameter to "ifconf" commandJoe Groocock2020-07-221-1/+2
| | | | | Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Allow use of a non-default EFI SAN boot filenameMichael Brown2017-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Some older operating systems (e.g. RHEL6) use a non-default filename on the root disk and rely on setting an EFI variable to point to the bootloader. This does not work when performing a SAN boot on a machine where the EFI variable is not present. Fix by allowing a non-default filename to be specified via the "sanboot --filename" option or the "san-filename" setting. For example: sanboot --filename \efi\redhat\grub.efi \ iscsi:192.168.0.1::::iqn.2010-04.org.ipxe.demo:rhel6 or option ipxe.san-filename code 188 = string; option ipxe.san-filename "\\efi\\redhat\\grub.efi"; option root-path "iscsi:192.168.0.1::::iqn.2010-04.org.ipxe.demo:rhel6"; Originally-implemented-by: Vishvananda Ishaya Abrams <vish.ishaya@oracle.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Add basic multipath supportMichael Brown2017-03-261-1/+2
| | | | | | | | | | | Add basic support for multipath block devices. The "sanboot" and "sanhook" commands now accept a list of SAN URIs. We open all URIs concurrently. The first connection to become available for issuing block device commands is marked as the active path and used for all subsequent commands; all other connections are then closed. Whenever the active path fails, we reopen all URIs and repeat the process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add certstat() to display basic certificate informationMichael Brown2016-08-311-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "ntp" commandMichael Brown2016-06-131-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lotest] Add option to use broadcast packets for loopback testingMichael Brown2016-05-231-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Add "ibstat" commandMichael Brown2016-03-081-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Allow self-tests to report exit status when running under LinuxMichael Brown2015-08-211-1/+1
| | | | | | | | | Allow the return status from an embedded image to propagate out to the eventual return status from main(). When running under Linux, this allows the pass/fail result of unit tests to be observable without having to visually inspect the console output. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-021-1/+1
| | | | | | | | | | These files cannot be automatically relicensed by util/relicense.pl since they either contain unusual but trivial contributions (such as the addition of __nonnull function attributes), or contain lines dating back to the initial git revision (and so require manual knowledge of the code's origin). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-0213-13/+13
| | | | | | | Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Allow "ping" command output to be inhibitedMichael Brown2014-10-231-1/+1
| | | | | Originally-implemented-by: Cedric Levasseur <cyr-ius@ipocus.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Allow termination after a specified number of packetsMichael Brown2014-10-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Add the "-c <count>" option to the "ping" command, allowing for automatic termination after a specified number of packets. When a number of packets is specified: - if a serious error (i.e. length mismatch or content mismatch) occurs, then the ping will be immediately terminated with the relevant status code; - if at least one response is received successfully, and all errors are non-serious (i.e. timeouts or out-of-sequence responses), then the ping will be terminated after the final response (or timeout) with a success status; - if no responses are received successfully, then the ping will be terminated after the final timeout with ETIMEDOUT. If no number of packets is specified, then the ping will continue until manually interrupted. Originally-implemented-by: Cedric Levasseur <cyr-ius@ipocus.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Allow autoboot device to be identified by link-layer addressMichael Brown2014-07-081-2/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "profstat" command to display profiling statisticsMichael Brown2014-04-281-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add "--timeout" parameter to image downloading commandsMichael Brown2014-03-101-3/+6
| | | | | | | | | | | | | | | | | | iPXE will detect timeout failures in several situations: network link-up, DHCP, TCP connection attempts, unacknowledged TCP data, etc. This does not cover all possible circumstances. For example, if a connection to a web server is successfully established and the web server acknowledges the HTTP request but never sends any data in response, then no timeout will be triggered. There is no timeout defined within the HTTP specifications, and the underlying TCP connection will not generate a timeout since it has no way to know that the HTTP layer is expecting to receive data from the server. Add a "--timeout" parameter to "imgfetch", "chain", etc. If no progress is made (i.e. no data is downloaded) within the timeout period, then the download will be aborted. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Enable infrastructure to specify an autoboot device locationAlex Williamson2014-03-031-1/+3
| | | | | | | | | | | | | | | | | | iPXE will currently attempt to boot from every network device for which it has a driver. Where a system has more than one network device supported by iPXE, this renders BIOS IPL lists ineffective. Allow an autoboot device location to be specified. If such a location is specified, then only devices matching that location will be used as part of the automatic boot sequence. If no such location is specified, then all devices will be used. Note that this does not affect the "autoboot" command, which will continue to use all devices. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add the "ipstat" commandMichael Brown2014-03-031-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Remove obsolete dhcp() functionMichael Brown2013-11-051-1/+0Star
| | | | | | | All functionality provided by dhcp() has now been obviated by the more generic ifconf(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ifmgmt] Add ifconf() to carry out network device configurationMichael Brown2013-11-051-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ifmgmt] Rewrite iflinkwait() to use monojob_wait()Michael Brown2013-11-051-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Rewrite "sync" command to use monojob_wait()Michael Brown2013-11-011-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [parseopt] Add parse_timeout()Michael Brown2013-11-012-2/+2
| | | | | | | | Parsing a timeout value (specified in milliseconds) into an internal timeout value measured in timer ticks is a common operation. Provide a parse_timeout() value to carry out this conversion automatically. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Add top-level ping() function to ping a hostMichael Brown2013-10-211-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [neighbour] Add nstat() function to print out neighbour tableMichael Brown2013-09-251-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Abstract out protocol-specific portions of "route" commandMichael Brown2013-09-031-1/+22
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Split main control flow out of main() into a new function ipxe()Michael Brown2013-03-131-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add standalone "nslookup" commandPatrick Plenefisch2012-09-101-0/+14
| | | | | Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgtrust" and "imgverify" commandsMichael Brown2012-03-251-0/+17
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Simplify image management commands and internal APIMichael Brown2012-03-251-35/+3Star
| | | | | | | | | | | | | | | | | | | | | | Remove the name, cmdline, and action parameters from imgdownload() and imgdownload_string(). These functions now simply download and return an image. Add the function imgacquire(), which will interpret a "name or URI string" parameter and return either an existing image or a newly downloaded image. Use imgacquire() to merge similar image-management commands that currently differ only by whether they take the name of an existing image or the URI of a new image to download. For example, "chain" and "imgexec" can now be merged. Extend imgstat and imgfree commands to take an optional list of images. Remove the arbitrary restriction on the length of image names. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Eliminate the register_and_xxx_image() functionsMichael Brown2011-10-251-5/+0Star
| | | | | | | | All users of imgdownload() require registration of the image, so make registration an integral part of imgdownload() itself and simplify the "action" parameter to be one of image_select(), image_exec() et al. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [sanboot] Add "sanhook" and "sanunhook" commandsMichael Brown2011-04-241-1/+13
| | | | | | | Expose the multiple-SAN-drive capability of the iPXE core via the iPXE command line by adding commands to hook and unhook additional drives. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Simplify use of imgdownload()Michael Brown2011-03-091-3/+7
| | | | | | | Allow imgdownload() to be called without first having to allocate (and so keep track of) an image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-04 19:08:08 +0100