summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* [iscsi] Avoid potential infinite loops during shutdownMichael Brown2016-11-171-0/+1
| | | | | | | | The command and data interfaces may be connected to the same object. Nullify the data interface before shutting down the control interface to avoid potential infinite loops. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Provide intf_reinit() to reinitialise nullified interfacesMichael Brown2016-11-163-6/+20
| | | | | | | Provide an abstraction intf_reinit() to restore the descriptor of a previously nullified interface. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Disable TIVOLI_VMM_WORKAROUND in the qemu configurationLaszlo Ersek2016-11-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents KVM guests from crashing that run iPXE on host CPUs without "unrestricted_guest" support. Once KVM gets the FXSAVE / FXRSTOR emulation feature (*), and the feature becomes widely available to users, we can back out this change from iPXE. (*) Already in progress by Radim: [PATCH 0/2] KVM: x86: emulate fxsave and fxrstor https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1258895.html https://www.spinics.net/lists/kernel/msg2370327.html Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Conditionalize the workaround for the Tivoli VMM's SSE garblingLaszlo Ersek2016-11-082-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 71560d1 ("[librm] Preserve FPU, MMX and SSE state across calls to virt_call()") added FXSAVE and FXRSTOR instructions to iPXE. In KVM virtual machines, these instructions execute fine as long as the host CPU supports the "unrestricted_guest" feature (that is, it can virtualize big real mode natively). On older host CPUs however, KVM has to emulate big real mode, and it currently doesn't implement FXSAVE emulation. Upstream QEMU rebuilt iPXE at commit 0418631 ("[thunderx] Fix compilation with older versions of gcc") which is a descendant of commit 71560d1 (see above). This was done in QEMU commit ffdc5a2 ("ipxe: update submodule from 4e03af8ec to 041863191"). The resultant binaries were bundled with the QEMU v2.7.0 release; see QEMU commit c52125a ("ipxe: update prebuilt binaries"). This distributed the iPXE workaround for the Tivoli VMM bug to a number of KVM users with old host CPUs, causing KVM emulation failures (guest crashes) for them while netbooting. Make the FXSAVE and FXRSTOR instructions conditional on a new feature test macro called TIVOLI_VMM_WORKAROUND. Define the macro by default. There is prior art for an assembly file including config/general.h: see arch/x86/prefix/romprefix.S. Also, TIVOLI_VMM_WORKAROUND seems to be a good fit for the "Obscure configuration options" section in config/general.h. Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [bzimage] Fix page alignment of initrd imagesMichael Brown2016-10-291-3/+5
| | | | | | | | | | | | The initrd_addr_max field represents the highest byte address that may be used to hold initrd images, and is therefore almost certainly not aligned to a page boundary: a typical value might be 0x7fffffff. Fix the address calculations to ensure that the initrd images are always aligned to a page boundary. Reported-by: Sitsofe Wheeler <sitsofe@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add EFI_BLOCK_IO2_PROTOCOL header and GUID definitionMichael Brown2016-10-174-0/+216
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Update to current EDK2 headersMichael Brown2016-10-1615-46/+401
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Mark AppleNetBoot.h as a native iPXE headerMichael Brown2016-10-161-3/+3
| | | | | | | | | AppleNetBoot.h is not taken from the EDK2 codebase and so cannot be imported using include/ipxe/efi/import.pl. Mark as a native iPXE header (by changing the include guard) to avoid breaking the import process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Mark permanent certificates as permanentMichael Brown2016-08-311-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add certificate management commandsMichael Brown2016-08-314-0/+309
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add certstat() to display basic certificate informationMichael Brown2016-08-313-2/+81
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificates to be marked as having been added explicitlyMichael Brown2016-08-312-4/+23
| | | | | | | | Allow certificates to be marked as having been added explicitly at run time. Such certificates will not be discarded via the certificate store cache discarder. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose certstore_del() to explicitly remove stored certificatesMichael Brown2016-08-312-4/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_next_entry() and list_prev_entry()Michael Brown2016-08-312-0/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown2016-08-255-10/+25
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add image_x509() to extract X.509 certificates from imageMichael Brown2016-08-252-0/+46
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pixbuf] Enable PNG format by defaultMichael Brown2016-07-296-31/+73
| | | | | | | Enable IMAGE_PNG (but not IMAGE_PNM) by default, and drag in the relevant objects only when image_pixbuf() is present in the binary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove more obsolete explicit object requirementsMichael Brown2016-07-291-6/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Enable both DER and PEM formats by defaultMichael Brown2016-07-295-43/+83
| | | | | | | | | | Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Remove obsolete explicit object requirementsMichael Brown2016-07-291-4/+0Star
| | | | | | | | As of commit b1caa48 ("[crypto] Support SHA-{224,384,512} in X.509 certificates"), the list of supported cryptographic algorithms is controlled by config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Use image_asn1() to extract data from CMS signature imagesMichael Brown2016-07-292-12/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add PEM image formatMichael Brown2016-07-297-0/+343
| | | | | | | | | | | Add PEM-encoded ASN.1 as an image format. We accept as PEM any image containing a line starting with a "-----BEGIN" boundary marker. We allow for PEM files containing multiple ASN.1 objects, such as a certificate chain produced by concatenating individual certificate files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add DER image formatMichael Brown2016-07-299-0/+396
| | | | | | | | Add DER-encoded ASN.1 as an image format. There is no fixed signature for DER files. We treat an image as DER if it comprises a single valid SEQUENCE object covering the entire length of the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add image_asn1() to extract ASN.1 objects from imageMichael Brown2016-07-292-0/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for parsing of partial ASN.1 cursorsMichael Brown2016-07-282-6/+9
| | | | | | | | | Allow code to create a partial ASN.1 cursor containing only the type and length bytes, so that asn1_start() may be used to determine the length of a large ASN.1 blob without first allocating memory to hold the entire blob. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove obsolete extern declaration for asn1_invalidate_cursor()Michael Brown2016-07-281-1/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [hyperv] Use instance UUID in device nameMichael Brown2016-07-262-2/+6
| | | | | | | | | | The Windows drivers for VMBus devices are enumerated using the instance UUID rather than the channel number. Include the instance UUID within the iPXE device name to allow an iPXE network device to be more easily associated with the corresponding Windows network device when debugging. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Allow for multiple routersMichael Brown2016-07-254-51/+452
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Select the IPv6 source address and corresponding router (if any) using a very simplified version of the algorithm from RFC6724: - Ignore any source address that has a smaller scope than the destination address. For example, do not use a link-local source address when sending to a global destination address. - If we have a source address which is on the same link as the destination address, then use that source address. - If we are left with multiple possible source addresses, then choose the address with the smallest scope. For example, if we are sending to a site-local destination address and we have both a global source address and a site-local source address, then use the site-local source address. - If we are still left with multiple possible source addresses, then choose the address with the longest matching prefix. For the purposes of this algorithm, we treat RFC4193 Unique Local Addresses as having organisation-local scope. Since we use only link-local scope for our multicast transmissions, this approximation should remain valid in all practical situations. Originally-implemented-by: Thomas Bächler <thomas@archlinux.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Update IPv6 tests to use okx()Michael Brown2016-07-251-25/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Rename ipv6_scope to ipv6_settings_scopeMichael Brown2016-07-213-8/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Create routing table based on IPv6 settingsMichael Brown2016-07-204-191/+138Star
| | | | | | | | | | | | | | | | | | | | | | Use the IPv6 settings to construct the routing table, in a matter analogous to the construction of the IPv4 routing table. This allows for manual assignment of IPv6 addresses via e.g. set net0/ip6 2001:ba8:0:1d4::6950:5845 set net0/len6 64 set net0/gateway6 fe80::226:bff:fedd:d3c0 The prefix length ("len6") may be omitted, in which case a default prefix length of 64 will be assumed. Multiple IPv6 addresses may be assigned manually by implicitly creating child settings blocks. For example: set net0/ip6 2001:ba8:0:1d4::6950:5845 set net0.ula/ip6 fda4:2496:e992::6950:5845 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Match user expectations for IPv6 settings prioritiesMichael Brown2016-07-194-2/+31
| | | | | | | | | | | | | | A reasonable user expectation is that ${net0/ip6} should show the "highest-priority" of the IPv6 addresses, even when multiple IPv6 addresses are active. The expected order of priority is likely to be manually-assigned addresses first, then stateful DHCPv6 addresses, then SLAAC addresses, and lastly link-local addresses. Using ${priority} to enforce an ordering is undesirable since that would affect the priority assigned to each of the net<N> blocks as a whole, so use the sibling ordering capability instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Allow settings blocks to specify a sibling orderingMichael Brown2016-07-192-0/+4
| | | | | | | Allow settings blocks to provide an explicit default ordering between siblings, with lower precedence than the existing ${priority} setting. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Expose IPv6 link-local address settingsMichael Brown2016-07-192-0/+116
| | | | | | Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Expose IPv6 address setting acquired through DHCPv6Michael Brown2016-07-191-18/+49
| | | | | | Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Expose IPv6 settings acquired through NDPMichael Brown2016-07-193-5/+282
| | | | | | | | | Expose the IPv6 address (or prefix) as ${ip6}, the prefix length as ${len6}, and the router address as ${gateway6}. Originally-implemented-by: Hannes Reinecke <hare@suse.de> Originally-implemented-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Allow settings to comprise arbitrary subsets of NDP optionsMichael Brown2016-07-191-35/+67
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Correctly mortalise autovivified child settings blocksMichael Brown2016-07-191-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Rename ipv6_scope to dhcpv6_scopeMichael Brown2016-07-165-8/+8
| | | | | | | | The settings scope ipv6_scope refers specifically to IPv6 settings that have a corresponding DHCPv6 option. Rename to dhcpv6_scope to more accurately reflect this purpose. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Create space for IPv6 in settings display orderMichael Brown2016-07-154-22/+26
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Perform SLAAC only during autoconfigurationMichael Brown2016-07-151-8/+14
| | | | | | | | | | | | | | | | | | We currently perform IPv6 stateless address autoconfiguration (SLAAC) in response to any router advertisement with the relevant flags set. This can result in the local IPv6 source address changing midway through a TCP connection, since our connections bind only to a local port number and do not store a local network address. In addition, this behaviour for SLAAC is inconsistent with that for DHCPv4 and stateful DHCPv6, both of which will be performed only as a result of an explicit autoconfiguration action (e.g. via the default autoboot sequence, or the "ifconf" command). Fix by ignoring router advertisements arriving outside the context of an ongoing autoconfiguration attempt. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Remove duplicate intelvf_mbox_queues() functionMichael Brown2016-07-141-41/+0Star
| | | | | | | | Commit db34436 ("[intel] Strip spurious VLAN tags received by virtual function NICs") accidentally introduced two copies of the intel[x]vf_mbox_queues() function. Remove the unintended copy. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Strip spurious VLAN tags received by virtual function NICsMichael Brown2016-07-124-0/+144
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The physical function may be configured to transparently insert a VLAN tag into all transmitted packets. Unfortunately, it does not equivalently strip this same VLAN tag from all received packets. This behaviour may be observed in some Amazon EC2 instances with Enhanced Networking enabled: transmissions work as expected but all packets received by iPXE appear to have a spurious VLAN tag. We can configure the receive queue to strip VLAN tags via the RXDCTL.VME bit. We need to find out from the PF driver whether or not we should do so. There exists a "get queue configuration" mailbox message which contains a field labelled IXGBE_VF_TRANS_VLAN in the Linux driver. A comment in the Linux PF driver describes this field as "notify VF of need for VLAN tag stripping, and correct queue". It will be filled with a non-zero value if the PF is enforcing the use of a single VLAN tag. It will also be filled with a non-zero value if the PF is using multiple traffic classes. The Linux VF driver seems to treat this field as being simply the number of traffic classes, and gives it no VLAN-related interpretation. The Linux VF driver instead handles the VLAN tag stripping by simply assuming that any unrecognised VLAN tag ought to be silently dropped. We choose to strip and ignore the VLAN tag if the IXGBE_VF_TRANS_VLAN field has a non-zero value. Reported-by: Leonid Vasetsky <leonidv@velostrata.com> Tested-by: Leonid Vasetsky <leonidv@velostrata.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Send gratuitous ARPs whenever a new IPv4 address is appliedMichael Brown2016-07-121-20/+80
| | | | | | | | | | | | | | | | | | | | In a busy network (such as a public cloud), IPv4 addresses may be recycled rapidly. When this happens, unidirectional traffic (such as UDP syslog) will succeed, but bidirectional traffic (such as TCP connections) may fail due to stale ARP cache entries on other nodes. The remote ARP cache expiry timeout is likely to exceed iPXE's connection timeout, meaning that boot attempts can fail before the problem is automatically resolved. Fix by sending gratuitous ARPs whenever an IPv4 address is changed, to attempt to update stale remote ARP cache entries. Note that this is not a guaranteed fix, since ARP is an unreliable protocol. We avoid sending gratuitous ARPs unconditionally, since otherwise any unrelated settings change (e.g. "set dns 192.168.0.1") would cause unexpected gratuitous ARPs to be sent. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Add PCI device ID for I219-V/LMLukas Grossar2016-07-121-0/+2
| | | | | Signed-off-by: Lukas Grossar <lukas.grossar@adfinis-sygroup.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Allow time for ACPI power off to take effectMichael Brown2016-07-111-0/+6
| | | | | | | | | The ACPI power off sequence may not take effect immediately. Delay for one second, to eliminate potentially confusing log messages such as "Could not power off: Error 0x43902001 (http://ipx". Reported-by: Leonid Vasetsky <leonidv@velostrata.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Add support for ACPI power offMichael Brown2016-07-119-4/+519
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Check for functioning RTC interruptMichael Brown2016-07-102-0/+57
| | | | | | | | | | | | | | | | | | | | | On some platforms (observed in a small subset of Microsoft Azure (Hyper-V) virtual machines), the RTC appears to be incapable of generating an interrupt via the legacy PIC. The RTC status registers show that a periodic interrupt has been asserted, but the PIC IRR shows that IRQ8 remains inactive. On such systems, iPXE will currently freeze during the "iPXE initialising devices..." message. Work around this problem by checking that RTC interrupts are being raised before returning from rtc_entropy_enable(). If no interrupt is seen within 100ms, then we assume that the RTC interrupt mechanism is broken. In these circumstances, iPXE will continue to initialise but any subsequent attempt to generate entropy will fail. In particular, HTTPS connections will fail with an error indicating that no entropy is available. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Install the HII config access protocol on a child of the SNP handleLaszlo Ersek2016-07-082-4/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In edk2, there are several drivers that associate HII forms (and corresponding config access protocol instances) with each individual network device. (In this context, "network device" means the EFI handle on which the SNP protocol is installed, and on which the device path ending with the MAC() node is installed also.) Such edk2 drivers are, for example: Ip4Dxe, HttpBootDxe, VlanConfigDxe. In UEFI, any given handle can carry at most one instance of a specific protocol (see e.g. the specification of the InstallProtocolInterface() boot service). This implies that the class of drivers mentioned above can't install their EFI_HII_CONFIG_ACCESS_PROTOCOL instances on the SNP handle directly -- they would conflict with each other. Accordingly, each of those edk2 drivers creates a "private" child handle under the SNP handle, and installs its config access protocol (and corresponding HII package list) on its child handle. The device path for the child handle is traditionally derived by appending a Hardware Vendor Device Path node after the MAC() node. The VenHw() nodes in question consist of a GUID (by definition), and no trailing data (by choice). The purpose of these VenHw() nodes is only that all the child nodes can be uniquely identified by device path. At the moment iPXE does not follow this pattern. It doesn't run into a conflict when it installs its EFI_HII_CONFIG_ACCESS_PROTOCOL directly on the SNP handle, but that's only because iPXE is the sole driver not following the pattern. This behavior seems risky (one might call it a "latent bug"); better align iPXE with the edk2 custom. Cc: Michael Brown <mcb30@ipxe.org> Cc: Gary Lin <glin@suse.com> Cc: Ladi Prosek <lprosek@redhat.com> Ref: http://thread.gmane.org/gmane.comp.bios.edk2.devel/13494/focus=13532 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Ladi Prosek <lprosek@redhat.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [profile] Allow profiling to be globally enabled or disabledMichael Brown2016-07-052-0/+29
| | | | | | | | | | As with assertions, profiling is enabled for objects built with any debug level (including an explicit debug level of zero). Allow profiling to be globally enabled or disabled by adding PROFILE=1 or PROFILE=0 respectively to the build command line. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-02-28 08:53:39 +0100