From f48b01cb016921cf0f58bd6be676c17042923719 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 27 Oct 2022 12:58:33 +0100 Subject: [bzimage] Fix parsing of "vga=..." when not at end of command line bzimage_parse_cmdline() uses strcmp() to identify the named "vga=..." kernel command line option values, which will give a false negative if the option is not last on the command line. Fix by temporarily changing the relevant command line separator (if any) to a NUL terminator. Debugged-by: Simon Rettberg Signed-off-by: Michael Brown --- src/arch/x86/image/bzimage.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/x86/image/bzimage.c b/src/arch/x86/image/bzimage.c index a782127a1..769e0c9d8 100644 --- a/src/arch/x86/image/bzimage.c +++ b/src/arch/x86/image/bzimage.c @@ -252,13 +252,17 @@ static void bzimage_update_header ( struct image *image, */ static int bzimage_parse_cmdline ( struct image *image, struct bzimage_context *bzimg, - const char *cmdline ) { + char *cmdline ) { + char *sep; char *vga; char *mem; /* Look for "vga=" */ if ( ( vga = strstr ( cmdline, "vga=" ) ) ) { vga += 4; + sep = strchr ( vga, ' ' ); + if ( sep ) + *sep = '\0'; if ( strcmp ( vga, "normal" ) == 0 ) { bzimg->vid_mode = BZI_VID_MODE_NORMAL; } else if ( strcmp ( vga, "ext" ) == 0 ) { @@ -267,11 +271,13 @@ static int bzimage_parse_cmdline ( struct image *image, bzimg->vid_mode = BZI_VID_MODE_ASK; } else { bzimg->vid_mode = strtoul ( vga, &vga, 0 ); - if ( *vga && ( *vga != ' ' ) ) { - DBGC ( image, "bzImage %p strange \"vga=\"" + if ( *vga ) { + DBGC ( image, "bzImage %p strange \"vga=\" " "terminator '%c'\n", image, *vga ); } } + if ( sep ) + *sep = ' '; } /* Look for "mem=" */ @@ -522,7 +528,7 @@ static void bzimage_load_initrds ( struct image *image, */ static int bzimage_exec ( struct image *image ) { struct bzimage_context bzimg; - const char *cmdline = ( image->cmdline ? image->cmdline : "" ); + char *cmdline = ( image->cmdline ? image->cmdline : "" ); int rc; /* Read and parse header from image */ -- cgit v1.2.3-55-g7522 From 60b5532cfc1393a8d34cece1b49f953bd72c303c Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 22 Dec 2022 14:59:29 +0000 Subject: [cachedhcp] Include VLAN tag in filter for applying cached DHCPACK When chainloading iPXE from a VLAN device, the MAC address within the cached DHCPACK will match the MAC address of the trunk device created by iPXE, and the cached DHCPACK will then end up being erroneously applied to the trunk device. This tends to break outbound IPv4 routing, since both the trunk and VLAN devices will have the same assigned IPv4 address. Fix by recording the VLAN tag along with the cached DHCPACK, and treating the VLAN tag as part of the filter used to match the cached DHCPACK against candidate network devices. Signed-off-by: Michael Brown --- src/arch/x86/interface/pcbios/bios_cachedhcp.c | 2 +- src/core/cachedhcp.c | 28 ++++++++++++++++++++------ src/include/ipxe/cachedhcp.h | 3 ++- src/include/ipxe/efi/efi_cachedhcp.h | 3 ++- src/interface/efi/efi_cachedhcp.c | 17 +++++++++++----- src/interface/efi/efiprefix.c | 3 ++- 6 files changed, 41 insertions(+), 15 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/x86/interface/pcbios/bios_cachedhcp.c b/src/arch/x86/interface/pcbios/bios_cachedhcp.c index 277c40d6f..bea803d6e 100644 --- a/src/arch/x86/interface/pcbios/bios_cachedhcp.c +++ b/src/arch/x86/interface/pcbios/bios_cachedhcp.c @@ -59,7 +59,7 @@ static void cachedhcp_init ( void ) { } /* Record cached DHCPACK */ - if ( ( rc = cachedhcp_record ( &cached_dhcpack, + if ( ( rc = cachedhcp_record ( &cached_dhcpack, 0, phys_to_user ( cached_dhcpack_phys ), sizeof ( BOOTPLAYER_t ) ) ) != 0 ) { DBGC ( colour, "CACHEDHCP could not record DHCPACK: %s\n", diff --git a/src/core/cachedhcp.c b/src/core/cachedhcp.c index c4ca46e3a..ef2146626 100644 --- a/src/core/cachedhcp.c +++ b/src/core/cachedhcp.c @@ -29,6 +29,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include /** @file @@ -43,6 +44,8 @@ struct cached_dhcp_packet { const char *name; /** DHCP packet (if any) */ struct dhcp_packet *dhcppkt; + /** VLAN tag (if applicable) */ + unsigned int vlan; }; /** Cached DHCPACK */ @@ -136,15 +139,26 @@ static int cachedhcp_apply ( struct cached_dhcp_packet *cache, * matches this network device. */ if ( memcmp ( ll_addr, chaddr, ll_addr_len ) != 0 ) { - DBGC ( colour, "CACHEDHCP %s does not match %s\n", - cache->name, netdev->name ); + DBGC ( colour, "CACHEDHCP %s %s does not match %s\n", + cache->name, ll_protocol->ntoa ( chaddr ), + netdev->name ); + return 0; + } + + /* Do nothing unless cached packet's VLAN tag matches + * this network device. + */ + if ( vlan_tag ( netdev ) != cache->vlan ) { + DBGC ( colour, "CACHEDHCP %s VLAN %d does not match " + "%s\n", cache->name, cache->vlan, + netdev->name ); return 0; } - DBGC ( colour, "CACHEDHCP %s is for %s\n", - cache->name, netdev->name ); /* Use network device's settings block */ settings = netdev_settings ( netdev ); + DBGC ( colour, "CACHEDHCP %s is for %s\n", + cache->name, netdev->name ); } /* Register settings */ @@ -165,12 +179,13 @@ static int cachedhcp_apply ( struct cached_dhcp_packet *cache, * Record cached DHCP packet * * @v cache Cached DHCP packet + * @v vlan VLAN tag, if any * @v data DHCPACK packet buffer * @v max_len Maximum possible length * @ret rc Return status code */ -int cachedhcp_record ( struct cached_dhcp_packet *cache, userptr_t data, - size_t max_len ) { +int cachedhcp_record ( struct cached_dhcp_packet *cache, unsigned int vlan, + userptr_t data, size_t max_len ) { struct dhcp_packet *dhcppkt; struct dhcp_packet *tmp; struct dhcphdr *dhcphdr; @@ -225,6 +240,7 @@ int cachedhcp_record ( struct cached_dhcp_packet *cache, userptr_t data, DBGC ( colour, "CACHEDHCP %s at %#08lx+%#zx/%#zx\n", cache->name, user_to_phys ( data, 0 ), len, max_len ); cache->dhcppkt = dhcppkt; + cache->vlan = vlan; return 0; } diff --git a/src/include/ipxe/cachedhcp.h b/src/include/ipxe/cachedhcp.h index 39ce74543..4ce4a9f2a 100644 --- a/src/include/ipxe/cachedhcp.h +++ b/src/include/ipxe/cachedhcp.h @@ -18,7 +18,8 @@ extern struct cached_dhcp_packet cached_dhcpack; extern struct cached_dhcp_packet cached_proxydhcp; extern struct cached_dhcp_packet cached_pxebs; -extern int cachedhcp_record ( struct cached_dhcp_packet *cache, userptr_t data, +extern int cachedhcp_record ( struct cached_dhcp_packet *cache, + unsigned int vlan, userptr_t data, size_t max_len ); #endif /* _IPXE_CACHEDHCP_H */ diff --git a/src/include/ipxe/efi/efi_cachedhcp.h b/src/include/ipxe/efi/efi_cachedhcp.h index cd60d4095..5968a1ea2 100644 --- a/src/include/ipxe/efi/efi_cachedhcp.h +++ b/src/include/ipxe/efi/efi_cachedhcp.h @@ -11,6 +11,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include -extern int efi_cachedhcp_record ( EFI_HANDLE device ); +extern int efi_cachedhcp_record ( EFI_HANDLE device, + EFI_DEVICE_PATH_PROTOCOL *path ); #endif /* _IPXE_EFI_CACHEDHCP_H */ diff --git a/src/interface/efi/efi_cachedhcp.c b/src/interface/efi/efi_cachedhcp.c index 1d4b98fd6..b9e49cf48 100644 --- a/src/interface/efi/efi_cachedhcp.c +++ b/src/interface/efi/efi_cachedhcp.c @@ -27,6 +27,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include @@ -40,10 +41,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * Record cached DHCP packet * * @v device Device handle + * @v path Device path * @ret rc Return status code */ -int efi_cachedhcp_record ( EFI_HANDLE device ) { - EFI_BOOT_SERVICES *bs = efi_systab->BootServices; +int efi_cachedhcp_record ( EFI_HANDLE device, + EFI_DEVICE_PATH_PROTOCOL *path ) { + EFI_BOOT_SERVICES *bs = efi_systab->BootServices; + unsigned int vlan; union { EFI_PXE_BASE_CODE_PROTOCOL *pxe; void *interface; @@ -52,6 +56,9 @@ int efi_cachedhcp_record ( EFI_HANDLE device ) { EFI_STATUS efirc; int rc; + /* Get VLAN tag, if any */ + vlan = efi_path_vlan ( path ); + /* Look for a PXE base code instance on the image's device handle */ if ( ( efirc = bs->OpenProtocol ( device, &efi_pxe_base_code_protocol_guid, @@ -75,7 +82,7 @@ int efi_cachedhcp_record ( EFI_HANDLE device ) { /* Record DHCPACK, if present */ if ( mode->DhcpAckReceived && - ( ( rc = cachedhcp_record ( &cached_dhcpack, + ( ( rc = cachedhcp_record ( &cached_dhcpack, vlan, virt_to_user ( &mode->DhcpAck ), sizeof ( mode->DhcpAck ) ) ) != 0 ) ) { DBGC ( device, "EFI %s could not record DHCPACK: %s\n", @@ -85,7 +92,7 @@ int efi_cachedhcp_record ( EFI_HANDLE device ) { /* Record ProxyDHCPOFFER, if present */ if ( mode->ProxyOfferReceived && - ( ( rc = cachedhcp_record ( &cached_proxydhcp, + ( ( rc = cachedhcp_record ( &cached_proxydhcp, vlan, virt_to_user ( &mode->ProxyOffer ), sizeof ( mode->ProxyOffer ) ) ) != 0)){ DBGC ( device, "EFI %s could not record ProxyDHCPOFFER: %s\n", @@ -95,7 +102,7 @@ int efi_cachedhcp_record ( EFI_HANDLE device ) { /* Record PxeBSACK, if present */ if ( mode->PxeReplyReceived && - ( ( rc = cachedhcp_record ( &cached_pxebs, + ( ( rc = cachedhcp_record ( &cached_pxebs, vlan, virt_to_user ( &mode->PxeReply ), sizeof ( mode->PxeReply ) ) ) != 0)){ DBGC ( device, "EFI %s could not record PXEBSACK: %s\n", diff --git a/src/interface/efi/efiprefix.c b/src/interface/efi/efiprefix.c index 126c813d7..7286b3e03 100644 --- a/src/interface/efi/efiprefix.c +++ b/src/interface/efi/efiprefix.c @@ -78,12 +78,13 @@ EFI_STATUS EFIAPI _efi_start ( EFI_HANDLE image_handle, */ static void efi_init_application ( void ) { EFI_HANDLE device = efi_loaded_image->DeviceHandle; + EFI_DEVICE_PATH_PROTOCOL *path = efi_loaded_image_path; /* Identify autoboot device, if any */ efi_set_autoboot_ll_addr ( device ); /* Store cached DHCP packet, if any */ - efi_cachedhcp_record ( device ); + efi_cachedhcp_record ( device, path ); /* Load autoexec script, if any */ efi_autoexec_load ( device ); -- cgit v1.2.3-55-g7522 From 2ef5f5e05efa3ab29a207b6641b0ac6afefd3f0b Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 22 Jan 2023 16:15:55 +0000 Subject: [build] Move -Ulinux to common Makefile The requirement to undo the implicit "-Dlinux" is not specific to the x86 architecture. Move this out of the x86-specific Makefile. Signed-off-by: Michael Brown --- src/Makefile.housekeeping | 4 ++++ src/arch/x86/Makefile | 3 --- 2 files changed, 4 insertions(+), 3 deletions(-) (limited to 'src/arch/x86') diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping index 658b84b6b..f3258025d 100644 --- a/src/Makefile.housekeeping +++ b/src/Makefile.housekeeping @@ -512,6 +512,10 @@ CFLAGS += -include include/compiler.h # CFLAGS += -DASM_TCHAR='$(ASM_TCHAR)' -DASM_TCHAR_OPS='$(ASM_TCHAR_OPS)' +# Inhibit the default -Dlinux +# +CFLAGS += -Ulinux + # CFLAGS for specific object types # CFLAGS_c += diff --git a/src/arch/x86/Makefile b/src/arch/x86/Makefile index 011260cac..ef801365e 100644 --- a/src/arch/x86/Makefile +++ b/src/arch/x86/Makefile @@ -22,9 +22,6 @@ SRCDIRS += arch/x86/drivers/xen SRCDIRS += arch/x86/drivers/hyperv SRCDIRS += arch/x86/transitions -# breaks building some of the linux-related objects -CFLAGS += -Ulinux - # disable valgrind CFLAGS += -DNVALGRIND -- cgit v1.2.3-55-g7522 From 2061d658b3d199ec84976e6a573f68424369be69 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 22 Jan 2023 16:54:20 +0000 Subject: [dhcp] Simplify platform-specific client architecture definitions Move the platform-specific DHCP client architecture definitions to header files of the form . This simplifies the directory structure and allows the otherwise unused arch/$(ARCH)/include/$(PLATFORM) to be removed from the include directory search path, which avoids the confusing situation in which a header file may potentially be accessed through more than one path. For Linux userspace binaries on any architecture, use the EFI values for that architecture by delegating to the EFI header file. This avoids the need to explicitly select values for Linux userspace binaries for each architecture. Signed-off-by: Michael Brown --- src/Makefile.housekeeping | 1 - src/arch/arm32/include/efi/ipxe/dhcp_arch.h | 40 ------------------------ src/arch/arm32/include/ipxe/efi/dhcparch.h | 20 ++++++++++++ src/arch/arm64/include/efi/ipxe/dhcp_arch.h | 40 ------------------------ src/arch/arm64/include/ipxe/efi/dhcparch.h | 20 ++++++++++++ src/arch/i386/include/efi/ipxe/dhcp_arch.h | 40 ------------------------ src/arch/i386/include/ipxe/efi/dhcparch.h | 20 ++++++++++++ src/arch/i386/include/pcbios/ipxe/dhcp_arch.h | 40 ------------------------ src/arch/x86/Makefile.linux | 4 --- src/arch/x86/include/ipxe/pcbios/dhcparch.h | 20 ++++++++++++ src/arch/x86/include/linux/ipxe/dhcp_arch.h | 41 ------------------------- src/arch/x86_64/include/efi/ipxe/dhcp_arch.h | 40 ------------------------ src/arch/x86_64/include/ipxe/efi/dhcparch.h | 20 ++++++++++++ src/arch/x86_64/include/pcbios/ipxe/dhcp_arch.h | 40 ------------------------ src/include/ipxe/dhcparch.h | 16 ++++++++++ src/include/ipxe/linux/dhcparch.h | 20 ++++++++++++ src/net/udp/dhcp.c | 2 +- src/net/udp/dhcpv6.c | 2 +- 18 files changed, 138 insertions(+), 288 deletions(-) delete mode 100644 src/arch/arm32/include/efi/ipxe/dhcp_arch.h create mode 100644 src/arch/arm32/include/ipxe/efi/dhcparch.h delete mode 100644 src/arch/arm64/include/efi/ipxe/dhcp_arch.h create mode 100644 src/arch/arm64/include/ipxe/efi/dhcparch.h delete mode 100644 src/arch/i386/include/efi/ipxe/dhcp_arch.h create mode 100644 src/arch/i386/include/ipxe/efi/dhcparch.h delete mode 100644 src/arch/i386/include/pcbios/ipxe/dhcp_arch.h create mode 100644 src/arch/x86/include/ipxe/pcbios/dhcparch.h delete mode 100644 src/arch/x86/include/linux/ipxe/dhcp_arch.h delete mode 100644 src/arch/x86_64/include/efi/ipxe/dhcp_arch.h create mode 100644 src/arch/x86_64/include/ipxe/efi/dhcparch.h delete mode 100644 src/arch/x86_64/include/pcbios/ipxe/dhcp_arch.h create mode 100644 src/include/ipxe/dhcparch.h create mode 100644 src/include/ipxe/linux/dhcparch.h (limited to 'src/arch/x86') diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping index f3258025d..b32003ea5 100644 --- a/src/Makefile.housekeeping +++ b/src/Makefile.housekeeping @@ -369,7 +369,6 @@ endif # Include architecture-specific include path ifdef ARCH INCDIRS += arch/$(ARCH)/include -INCDIRS += arch/$(ARCH)/include/$(PLATFORM) endif ############################################################################### diff --git a/src/arch/arm32/include/efi/ipxe/dhcp_arch.h b/src/arch/arm32/include/efi/ipxe/dhcp_arch.h deleted file mode 100644 index 29a235944..000000000 --- a/src/arch/arm32/include/efi/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2015 Michael Brown . - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_ARM32 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ - -#endif diff --git a/src/arch/arm32/include/ipxe/efi/dhcparch.h b/src/arch/arm32/include/ipxe/efi/dhcparch.h new file mode 100644 index 000000000..0b669992c --- /dev/null +++ b/src/arch/arm32/include/ipxe/efi/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_EFI_DHCPARCH_H +#define _IPXE_EFI_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** DHCP client architecture */ +#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_ARM32 + +/** DHCP client network device interface */ +#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ + +#endif /* _IPXE_EFI_DHCPARCH_H */ diff --git a/src/arch/arm64/include/efi/ipxe/dhcp_arch.h b/src/arch/arm64/include/efi/ipxe/dhcp_arch.h deleted file mode 100644 index bb26aae4d..000000000 --- a/src/arch/arm64/include/efi/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2015 Michael Brown . - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_ARM64 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ - -#endif diff --git a/src/arch/arm64/include/ipxe/efi/dhcparch.h b/src/arch/arm64/include/ipxe/efi/dhcparch.h new file mode 100644 index 000000000..21d5a881b --- /dev/null +++ b/src/arch/arm64/include/ipxe/efi/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_EFI_DHCPARCH_H +#define _IPXE_EFI_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** DHCP client architecture */ +#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_ARM64 + +/** DHCP client network device interface */ +#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ + +#endif /* _IPXE_EFI_DHCPARCH_H */ diff --git a/src/arch/i386/include/efi/ipxe/dhcp_arch.h b/src/arch/i386/include/efi/ipxe/dhcp_arch.h deleted file mode 100644 index cf3dbe499..000000000 --- a/src/arch/i386/include/efi/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2010 VMware, Inc. All Rights Reserved. - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_IA32 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ - -#endif diff --git a/src/arch/i386/include/ipxe/efi/dhcparch.h b/src/arch/i386/include/ipxe/efi/dhcparch.h new file mode 100644 index 000000000..4746d4b18 --- /dev/null +++ b/src/arch/i386/include/ipxe/efi/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_EFI_DHCPARCH_H +#define _IPXE_EFI_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** DHCP client architecture */ +#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_IA32 + +/** DHCP client network device interface */ +#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ + +#endif /* _IPXE_EFI_DHCPARCH_H */ diff --git a/src/arch/i386/include/pcbios/ipxe/dhcp_arch.h b/src/arch/i386/include/pcbios/ipxe/dhcp_arch.h deleted file mode 100644 index e22f50b37..000000000 --- a/src/arch/i386/include/pcbios/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2010 VMware, Inc. All Rights Reserved. - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_X86 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 2, 1 /* v2.1 */ - -#endif diff --git a/src/arch/x86/Makefile.linux b/src/arch/x86/Makefile.linux index b60065567..42590441e 100644 --- a/src/arch/x86/Makefile.linux +++ b/src/arch/x86/Makefile.linux @@ -1,9 +1,5 @@ # -*- makefile -*- : Force emacs to use Makefile mode -# Include x86 Linux headers -# -INCDIRS += arch/x86/include/linux - # Include generic Linux Makefile # MAKEDEPS += Makefile.linux diff --git a/src/arch/x86/include/ipxe/pcbios/dhcparch.h b/src/arch/x86/include/ipxe/pcbios/dhcparch.h new file mode 100644 index 000000000..13138ea96 --- /dev/null +++ b/src/arch/x86/include/ipxe/pcbios/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_PCBIOS_DHCPARCH_H +#define _IPXE_PCBIOS_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** DHCP client architecture */ +#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_X86 + +/** DHCP client network device interface */ +#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 2, 1 /* v2.1 */ + +#endif /* _IPXE_PCBIOS_DHCPARCH_H */ diff --git a/src/arch/x86/include/linux/ipxe/dhcp_arch.h b/src/arch/x86/include/linux/ipxe/dhcp_arch.h deleted file mode 100644 index d60905f22..000000000 --- a/src/arch/x86/include/linux/ipxe/dhcp_arch.h +++ /dev/null @@ -1,41 +0,0 @@ -/* - * Copyright (C) 2010 Piotr Jaroszyński - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _LINUX_DHCP_ARCH_H -#define _LINUX_DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE(GPL2_OR_LATER_OR_UBDL); - -#include - -// Emulate one of the supported arch-platforms -#include -//#include -//#include - -#endif diff --git a/src/arch/x86_64/include/efi/ipxe/dhcp_arch.h b/src/arch/x86_64/include/efi/ipxe/dhcp_arch.h deleted file mode 100644 index fb85b4405..000000000 --- a/src/arch/x86_64/include/efi/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2010 VMware, Inc. All Rights Reserved. - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_X86_64 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ - -#endif diff --git a/src/arch/x86_64/include/ipxe/efi/dhcparch.h b/src/arch/x86_64/include/ipxe/efi/dhcparch.h new file mode 100644 index 000000000..ccf0f46a0 --- /dev/null +++ b/src/arch/x86_64/include/ipxe/efi/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_EFI_DHCPARCH_H +#define _IPXE_EFI_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** DHCP client architecture */ +#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_X86_64 + +/** DHCP client network device interface */ +#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 3, 10 /* v3.10 */ + +#endif /* _IPXE_EFI_DHCPARCH_H */ diff --git a/src/arch/x86_64/include/pcbios/ipxe/dhcp_arch.h b/src/arch/x86_64/include/pcbios/ipxe/dhcp_arch.h deleted file mode 100644 index e22f50b37..000000000 --- a/src/arch/x86_64/include/pcbios/ipxe/dhcp_arch.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2010 VMware, Inc. All Rights Reserved. - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -#ifndef _DHCP_ARCH_H -#define _DHCP_ARCH_H - -/** @file - * - * Architecture-specific DHCP options - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#define DHCP_ARCH_CLIENT_ARCHITECTURE DHCP_CLIENT_ARCHITECTURE_X86 - -#define DHCP_ARCH_CLIENT_NDI 1 /* UNDI */ , 2, 1 /* v2.1 */ - -#endif diff --git a/src/include/ipxe/dhcparch.h b/src/include/ipxe/dhcparch.h new file mode 100644 index 000000000..89ecfb31e --- /dev/null +++ b/src/include/ipxe/dhcparch.h @@ -0,0 +1,16 @@ +#ifndef _IPXE_DHCPARCH_H +#define _IPXE_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +/* Include platform-specific client architecture definitions */ +#define PLATFORM_DHCPARCH(_platform) +#include PLATFORM_DHCPARCH(PLATFORM) + +#endif /* _IPXE_DHCPARCH_H */ diff --git a/src/include/ipxe/linux/dhcparch.h b/src/include/ipxe/linux/dhcparch.h new file mode 100644 index 000000000..464aa5168 --- /dev/null +++ b/src/include/ipxe/linux/dhcparch.h @@ -0,0 +1,20 @@ +#ifndef _IPXE_LINUX_DHCPARCH_H +#define _IPXE_LINUX_DHCPARCH_H + +/** @file + * + * DHCP client architecture definitions + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +/* + * There are no specification-defined values for DHCP architecture for + * PXE clients running as Linux userspace applications. Pretend to be + * the equivalent EFI client. + * + */ +#include + +#endif /* _IPXE_LINUX_DHCPARCH_H */ diff --git a/src/net/udp/dhcp.c b/src/net/udp/dhcp.c index a335a778a..b7b84e7db 100644 --- a/src/net/udp/dhcp.c +++ b/src/net/udp/dhcp.c @@ -46,7 +46,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include +#include #include #include diff --git a/src/net/udp/dhcpv6.c b/src/net/udp/dhcpv6.c index 28c6f7be4..9e27dec6f 100644 --- a/src/net/udp/dhcpv6.c +++ b/src/net/udp/dhcpv6.c @@ -40,7 +40,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include +#include #include /** @file -- cgit v1.2.3-55-g7522 From 4bffe0f0d9d0e1496ae5cfb7579e813277c29b0f Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 23 Jan 2023 22:20:36 +0000 Subject: [pxe] Discard queued PXE UDP packets when under memory pressure The PXE UDP receive queue may grow without limit if the PXE NBP does not call PXENV_UDP_READ sufficiently frequently. Fix by implementing a cache discarder for received PXE UDP packets (similar to the TCP cache discarder). Reported-by: Tal Shorer Signed-off-by: Michael Brown --- src/arch/x86/interface/pxe/pxe_udp.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'src/arch/x86') diff --git a/src/arch/x86/interface/pxe/pxe_udp.c b/src/arch/x86/interface/pxe/pxe_udp.c index 5a04f0865..a5d5eb77b 100644 --- a/src/arch/x86/interface/pxe/pxe_udp.c +++ b/src/arch/x86/interface/pxe/pxe_udp.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include @@ -482,3 +483,28 @@ struct pxe_api_call pxe_udp_api[] __pxe_api_call = { PXE_API_CALL ( PXENV_UDP_READ, pxenv_udp_read, struct s_PXENV_UDP_READ ), }; + +/** + * Discard some cached PXE UDP data + * + * @ret discarded Number of cached items discarded + */ +static unsigned int pxe_udp_discard ( void ) { + struct io_buffer *iobuf; + unsigned int discarded = 0; + + /* Try to discard the oldest received UDP packet */ + iobuf = list_first_entry ( &pxe_udp.list, struct io_buffer, list ); + if ( iobuf ) { + list_del ( &iobuf->list ); + free_iob ( iobuf ); + discarded++; + } + + return discarded; +} + +/** PXE UDP cache discarder */ +struct cache_discarder pxe_udp_discarder __cache_discarder ( CACHE_NORMAL ) = { + .discard = pxe_udp_discard, +}; -- cgit v1.2.3-55-g7522 From ef0a6f47920a4fb245f35f1b2e4bcaa7305819cd Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 6 Feb 2023 12:32:50 +0000 Subject: [ioapi] Move PAGE_SHIFT to bits/io.h The PAGE_SHIFT definition is an architectural property, rather than an aspect of a particular I/O API implementation (of which, in theory, there may be more than one per architecture). Reflect this by moving the definition to the top-level bits/io.h for each architecture. Signed-off-by: Michael Brown --- src/arch/arm/include/bits/io.h | 3 +++ src/arch/arm/include/ipxe/arm_io.h | 3 --- src/arch/x86/include/bits/io.h | 3 +++ src/arch/x86/include/ipxe/x86_io.h | 3 --- 4 files changed, 6 insertions(+), 6 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/arm/include/bits/io.h b/src/arch/arm/include/bits/io.h index 90f6455ec..272ec12bf 100644 --- a/src/arch/arm/include/bits/io.h +++ b/src/arch/arm/include/bits/io.h @@ -9,6 +9,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +/** Page shift */ +#define PAGE_SHIFT 12 + #include #endif /* _BITS_IO_H */ diff --git a/src/arch/arm/include/ipxe/arm_io.h b/src/arch/arm/include/ipxe/arm_io.h index 105f22bfb..046cbdb06 100644 --- a/src/arch/arm/include/ipxe/arm_io.h +++ b/src/arch/arm/include/ipxe/arm_io.h @@ -20,9 +20,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ -/** Page shift */ -#define PAGE_SHIFT 12 - /* * Physical<->Bus address mappings * diff --git a/src/arch/x86/include/bits/io.h b/src/arch/x86/include/bits/io.h index 60c2e3edf..95673ad8d 100644 --- a/src/arch/x86/include/bits/io.h +++ b/src/arch/x86/include/bits/io.h @@ -9,6 +9,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +/** Page shift */ +#define PAGE_SHIFT 12 + #include #endif /* _BITS_IO_H */ diff --git a/src/arch/x86/include/ipxe/x86_io.h b/src/arch/x86/include/ipxe/x86_io.h index a6ebe1f4c..eeb3f8454 100644 --- a/src/arch/x86/include/ipxe/x86_io.h +++ b/src/arch/x86/include/ipxe/x86_io.h @@ -28,9 +28,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ -/** Page shift */ -#define PAGE_SHIFT 12 - /* * Physical<->Bus address mappings * -- cgit v1.2.3-55-g7522 From 3c83843e111ece30d3dfb5143d5e6aed6164d587 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sat, 11 Feb 2023 15:07:00 +0000 Subject: [rng] Check for several functioning RTC interrupts Commit 74222cd ("[rng] Check for functioning RTC interrupt") added a check that the RTC is capable of generating interrupts via the legacy PIC, since this mechanism appears to be broken in some Hyper-V virtual machines. Experimentation shows that the RTC is sometimes capable of generating a single interrupt, but will then generate no subsequent interrupts. This currently causes rtc_entropy_check() to falsely detect that the entropy gathering mechanism is functional. Fix by checking for several RTC interrupts before declaring that it is a functional entropy source. Reported-by: Andreas Hammarskjöld Signed-off-by: Michael Brown --- src/arch/x86/interface/pcbios/rtc_entropy.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/x86/interface/pcbios/rtc_entropy.c b/src/arch/x86/interface/pcbios/rtc_entropy.c index e0c175685..c400d8a78 100644 --- a/src/arch/x86/interface/pcbios/rtc_entropy.c +++ b/src/arch/x86/interface/pcbios/rtc_entropy.c @@ -42,6 +42,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** Maximum time to wait for an RTC interrupt, in milliseconds */ #define RTC_MAX_WAIT_MS 100 +/** Number of RTC interrupts to check for */ +#define RTC_CHECK_COUNT 3 + /** RTC interrupt handler */ extern void rtc_isr ( void ); @@ -145,6 +148,7 @@ static void rtc_disable_int ( void ) { * @ret rc Return status code */ static int rtc_entropy_check ( void ) { + unsigned int count = 0; unsigned int i; /* Check that RTC interrupts are working */ @@ -158,14 +162,18 @@ static int rtc_entropy_check ( void ) { "cli\n\t" ); /* Check for RTC interrupt flag */ - if ( rtc_flag ) - return 0; + if ( rtc_flag ) { + rtc_flag = 0; + if ( ++count >= RTC_CHECK_COUNT ) + return 0; + } /* Delay */ mdelay ( 1 ); } - DBGC ( &rtc_flag, "RTC timed out waiting for interrupt\n" ); + DBGC ( &rtc_flag, "RTC timed out waiting for interrupt %d/%d\n", + ( count + 1 ), RTC_CHECK_COUNT ); return -ETIMEDOUT; } -- cgit v1.2.3-55-g7522 From 76a286530a8b5bdbab81c3851b851dea2da32114 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 13 Feb 2023 20:40:42 +0000 Subject: [image] Check delimiters when parsing command-line key-value arguments The Linux kernel bzImage image format and the CPIO archive constructor will parse the image command line for certain arguments of the form "key=value". This parsing is currently implemented using strstr() in a way that can cause a false positive suffix match. For example, a command line containing "highmem=" would erroneously be treated as containing a value for "mem=". Fix by centralising the logic used for parsing such arguments, and including a check that the argument immediately follows a whitespace delimiter (or is at the start of the string). Reported-by: Filippo Giunchedi Signed-off-by: Michael Brown --- src/arch/x86/image/bzimage.c | 37 ++++++++++++++++--------------------- src/core/cpio.c | 9 ++------- src/core/image.c | 31 +++++++++++++++++++++++++++++++ src/include/ipxe/image.h | 1 + 4 files changed, 50 insertions(+), 28 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/x86/image/bzimage.c b/src/arch/x86/image/bzimage.c index 769e0c9d8..b40bb2d07 100644 --- a/src/arch/x86/image/bzimage.c +++ b/src/arch/x86/image/bzimage.c @@ -247,19 +247,17 @@ static void bzimage_update_header ( struct image *image, * * @v image bzImage file * @v bzimg bzImage context - * @v cmdline Kernel command line * @ret rc Return status code */ static int bzimage_parse_cmdline ( struct image *image, - struct bzimage_context *bzimg, - char *cmdline ) { + struct bzimage_context *bzimg ) { + const char *vga; + const char *mem; char *sep; - char *vga; - char *mem; + char *end; /* Look for "vga=" */ - if ( ( vga = strstr ( cmdline, "vga=" ) ) ) { - vga += 4; + if ( ( vga = image_argument ( image, "vga=" ) ) ) { sep = strchr ( vga, ' ' ); if ( sep ) *sep = '\0'; @@ -270,10 +268,10 @@ static int bzimage_parse_cmdline ( struct image *image, } else if ( strcmp ( vga, "ask" ) == 0 ) { bzimg->vid_mode = BZI_VID_MODE_ASK; } else { - bzimg->vid_mode = strtoul ( vga, &vga, 0 ); - if ( *vga ) { + bzimg->vid_mode = strtoul ( vga, &end, 0 ); + if ( *end ) { DBGC ( image, "bzImage %p strange \"vga=\" " - "terminator '%c'\n", image, *vga ); + "terminator '%c'\n", image, *end ); } } if ( sep ) @@ -281,10 +279,9 @@ static int bzimage_parse_cmdline ( struct image *image, } /* Look for "mem=" */ - if ( ( mem = strstr ( cmdline, "mem=" ) ) ) { - mem += 4; - bzimg->mem_limit = strtoul ( mem, &mem, 0 ); - switch ( *mem ) { + if ( ( mem = image_argument ( image, "mem=" ) ) ) { + bzimg->mem_limit = strtoul ( mem, &end, 0 ); + switch ( *end ) { case 'G': case 'g': bzimg->mem_limit <<= 10; @@ -302,7 +299,7 @@ static int bzimage_parse_cmdline ( struct image *image, break; default: DBGC ( image, "bzImage %p strange \"mem=\" " - "terminator '%c'\n", image, *mem ); + "terminator '%c'\n", image, *end ); break; } bzimg->mem_limit -= 1; @@ -316,11 +313,10 @@ static int bzimage_parse_cmdline ( struct image *image, * * @v image bzImage image * @v bzimg bzImage context - * @v cmdline Kernel command line */ static void bzimage_set_cmdline ( struct image *image, - struct bzimage_context *bzimg, - const char *cmdline ) { + struct bzimage_context *bzimg ) { + const char *cmdline = ( image->cmdline ? image->cmdline : "" ); size_t cmdline_len; /* Copy command line down to real-mode portion */ @@ -528,7 +524,6 @@ static void bzimage_load_initrds ( struct image *image, */ static int bzimage_exec ( struct image *image ) { struct bzimage_context bzimg; - char *cmdline = ( image->cmdline ? image->cmdline : "" ); int rc; /* Read and parse header from image */ @@ -551,7 +546,7 @@ static int bzimage_exec ( struct image *image ) { } /* Parse command line for bootloader parameters */ - if ( ( rc = bzimage_parse_cmdline ( image, &bzimg, cmdline ) ) != 0) + if ( ( rc = bzimage_parse_cmdline ( image, &bzimg ) ) != 0) return rc; /* Check that initrds can be loaded */ @@ -568,7 +563,7 @@ static int bzimage_exec ( struct image *image ) { bzimg.rm_filesz, bzimg.pm_sz ); /* Store command line */ - bzimage_set_cmdline ( image, &bzimg, cmdline ); + bzimage_set_cmdline ( image, &bzimg ); /* Prepare for exiting. Must do this before loading initrds, * since loading the initrds will corrupt the external heap. diff --git a/src/core/cpio.c b/src/core/cpio.c index 27aee7581..4b607e260 100644 --- a/src/core/cpio.c +++ b/src/core/cpio.c @@ -77,17 +77,12 @@ size_t cpio_name_len ( struct image *image ) { */ static void cpio_parse_cmdline ( struct image *image, struct cpio_header *cpio ) { - const char *cmdline; - char *arg; + const char *arg; char *end; unsigned int mode; - /* Skip image filename */ - cmdline = ( cpio_name ( image ) + cpio_name_len ( image ) ); - /* Look for "mode=" */ - if ( ( arg = strstr ( cmdline, "mode=" ) ) ) { - arg += 5; + if ( ( arg = image_argument ( image, "mode=" ) ) ) { mode = strtoul ( arg, &end, 8 /* Octal for file mode */ ); if ( *end && ( *end != ' ' ) ) { DBGC ( image, "CPIO %p strange \"mode=\" " diff --git a/src/core/image.c b/src/core/image.c index 3e236ca60..f6d3d8ddd 100644 --- a/src/core/image.c +++ b/src/core/image.c @@ -27,6 +27,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include @@ -569,3 +570,33 @@ struct image * image_memory ( const char *name, userptr_t data, size_t len ) { err_alloc_image: return NULL; } + +/** + * Find argument within image command line + * + * @v image Image + * @v key Argument search key (including trailing delimiter) + * @ret value Argument value, or NULL if not found + */ +const char * image_argument ( struct image *image, const char *key ) { + const char *cmdline = image->cmdline; + const char *search; + const char *match; + const char *next; + + /* Find argument */ + for ( search = cmdline ; search ; search = next ) { + + /* Find next occurrence, if any */ + match = strstr ( search, key ); + if ( ! match ) + break; + next = ( match + strlen ( key ) ); + + /* Check preceding delimiter, if any */ + if ( ( match == cmdline ) || isspace ( match[-1] ) ) + return next; + } + + return NULL; +} diff --git a/src/include/ipxe/image.h b/src/include/ipxe/image.h index 0a5a26034..9e0c0f22a 100644 --- a/src/include/ipxe/image.h +++ b/src/include/ipxe/image.h @@ -195,6 +195,7 @@ extern struct image * image_find_selected ( void ); extern int image_set_trust ( int require_trusted, int permanent ); extern struct image * image_memory ( const char *name, userptr_t data, size_t len ); +extern const char * image_argument ( struct image *image, const char *key ); extern int image_pixbuf ( struct image *image, struct pixel_buffer **pixbuf ); extern int image_asn1 ( struct image *image, size_t offset, struct asn1_cursor **cursor ); -- cgit v1.2.3-55-g7522 From cff857461be443339aa39d614635d9a4eae8f8b2 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 15 Feb 2023 22:43:33 +0000 Subject: [rng] Add RDRAND as an entropy source Signed-off-by: Michael Brown --- src/arch/x86/core/rdrand.c | 99 +++++++++++++++++++++++++++++++++++++ src/arch/x86/include/bits/entropy.h | 1 + src/arch/x86/include/bits/errfile.h | 1 + src/arch/x86/include/ipxe/cpuid.h | 3 ++ src/arch/x86/include/ipxe/rdrand.h | 37 ++++++++++++++ 5 files changed, 141 insertions(+) create mode 100644 src/arch/x86/core/rdrand.c create mode 100644 src/arch/x86/include/ipxe/rdrand.h (limited to 'src/arch/x86') diff --git a/src/arch/x86/core/rdrand.c b/src/arch/x86/core/rdrand.c new file mode 100644 index 000000000..29605ab2f --- /dev/null +++ b/src/arch/x86/core/rdrand.c @@ -0,0 +1,99 @@ +/* + * Copyright (C) 2023 Michael Brown . + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + * + * You can also choose to distribute this program under the terms of + * the Unmodified Binary Distribution Licence (as given in the file + * COPYING.UBDL), provided that you have satisfied its requirements. + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +/** @file + * + * Hardware random number generator + * + */ + +#include +#include +#include + +/** Number of times to retry RDRAND instruction */ +#define RDRAND_RETRY_COUNT 16 + +/** Colour for debug messages */ +#define colour CPUID_FEATURES_INTEL_ECX_RDRAND + +/** + * Enable entropy gathering + * + * @ret rc Return status code + */ +static int rdrand_entropy_enable ( void ) { + struct x86_features features; + + /* Check that RDRAND is supported */ + x86_features ( &features ); + if ( ! ( features.intel.ecx & CPUID_FEATURES_INTEL_ECX_RDRAND ) ) { + DBGC ( colour, "RDRAND not supported\n" ); + return -ENOTSUP; + } + + return 0; +} + +/** + * Disable entropy gathering + * + */ +static void rdrand_entropy_disable ( void ) { + + /* Nothing to do */ +} + +/** + * Get noise sample + * + * @ret noise Noise sample + * @ret rc Return status code + */ +static int rdrand_get_noise ( noise_sample_t *noise ) { + unsigned int result; + unsigned int discard_c; + unsigned int ok; + + /* Issue RDRAND, retrying until CF is set */ + __asm__ ( "\n1:\n\t" + "rdrand %0\n\t" + "sbb %1, %1\n\t" + "loopz 1b\n\t" + : "=r" ( result ), "=r" ( ok ), "=c" ( discard_c ) + : "2" ( RDRAND_RETRY_COUNT ) ); + if ( ! ok ) { + DBGC ( colour, "RDRAND failed to become ready\n" ); + return -EBUSY; + } + + *noise = result; + return 0; +} + +PROVIDE_ENTROPY_INLINE ( rdrand, min_entropy_per_sample ); +PROVIDE_ENTROPY ( rdrand, entropy_enable, rdrand_entropy_enable ); +PROVIDE_ENTROPY ( rdrand, entropy_disable, rdrand_entropy_disable ); +PROVIDE_ENTROPY ( rdrand, get_noise, rdrand_get_noise ); diff --git a/src/arch/x86/include/bits/entropy.h b/src/arch/x86/include/bits/entropy.h index 5ac7fcd2e..7accea33f 100644 --- a/src/arch/x86/include/bits/entropy.h +++ b/src/arch/x86/include/bits/entropy.h @@ -10,5 +10,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #endif /* _BITS_ENTROPY_H */ diff --git a/src/arch/x86/include/bits/errfile.h b/src/arch/x86/include/bits/errfile.h index b0ae1abc2..b5316a586 100644 --- a/src/arch/x86/include/bits/errfile.h +++ b/src/arch/x86/include/bits/errfile.h @@ -28,6 +28,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define ERRFILE_cpuid ( ERRFILE_ARCH | ERRFILE_CORE | 0x00110000 ) #define ERRFILE_rdtsc_timer ( ERRFILE_ARCH | ERRFILE_CORE | 0x00120000 ) #define ERRFILE_acpi_timer ( ERRFILE_ARCH | ERRFILE_CORE | 0x00130000 ) +#define ERRFILE_rdrand ( ERRFILE_ARCH | ERRFILE_CORE | 0x00140000 ) #define ERRFILE_bootsector ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00000000 ) #define ERRFILE_bzimage ( ERRFILE_ARCH | ERRFILE_IMAGE | 0x00010000 ) diff --git a/src/arch/x86/include/ipxe/cpuid.h b/src/arch/x86/include/ipxe/cpuid.h index 3983dfb89..90d1bf01d 100644 --- a/src/arch/x86/include/ipxe/cpuid.h +++ b/src/arch/x86/include/ipxe/cpuid.h @@ -39,6 +39,9 @@ struct x86_features { /** Get standard features */ #define CPUID_FEATURES 0x00000001UL +/** RDRAND instruction is supported */ +#define CPUID_FEATURES_INTEL_ECX_RDRAND 0x40000000UL + /** Hypervisor is present */ #define CPUID_FEATURES_INTEL_ECX_HYPERVISOR 0x80000000UL diff --git a/src/arch/x86/include/ipxe/rdrand.h b/src/arch/x86/include/ipxe/rdrand.h new file mode 100644 index 000000000..c9c170fb0 --- /dev/null +++ b/src/arch/x86/include/ipxe/rdrand.h @@ -0,0 +1,37 @@ +#ifndef _IPXE_RDRAND_H +#define _IPXE_RDRAND_H + +/** @file + * + * Hardware random number generator + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include +#include + +#ifdef ENTROPY_RDRAND +#define ENTROPY_PREFIX_rdrand +#else +#define ENTROPY_PREFIX_rdrand __rdrand_ +#endif + +/** + * min-entropy per sample + * + * @ret min_entropy min-entropy of each sample + */ +static inline __always_inline min_entropy_t +ENTROPY_INLINE ( rdrand, min_entropy_per_sample ) ( void ) { + + /* Data returned by RDRAND is theoretically full entropy, up + * to a security strength of 128 bits. + */ + if ( DRBG_SECURITY_STRENGTH > 128 ) + return 0; + return MIN_ENTROPY ( 8 * sizeof ( noise_sample_t ) ); +} + +#endif /* _IPXE_RDRAND_H */ -- cgit v1.2.3-55-g7522 From 9f17d1116d27696ec76c48c5c77df34cba521380 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 17 Feb 2023 16:56:11 +0000 Subject: [rng] Allow entropy source to be selected at runtime As noted in commit 3c83843 ("[rng] Check for several functioning RTC interrupts"), experimentation shows that Hyper-V cannot be trusted to reliably generate RTC interrupts. (As noted in commit f3ba0fb ("[hyperv] Provide timer based on the 10MHz time reference count MSR"), Hyper-V appears to suffer from a general problem in reliably generating any legacy interrupts.) An alternative entropy source is therefore required for an image that may be used in a Hyper-V Gen1 virtual machine. The x86 RDRAND instruction provides a suitable alternative entropy source, but may not be supported by all CPUs. We must therefore allow for multiple entropy sources to be compiled in, with the single active entropy source selected only at runtime. Restructure the internal entropy API to allow a working entropy source to be detected and chosen at runtime. Enable the RDRAND entropy source for all x86 builds, since it is likely to be substantially faster than any other source. Signed-off-by: Michael Brown --- src/arch/arm/include/bits/entropy.h | 12 - src/arch/loong64/include/bits/entropy.h | 12 - src/arch/x86/core/rdrand.c | 32 ++- src/arch/x86/include/bits/entropy.h | 15 - src/arch/x86/include/ipxe/rdrand.h | 37 --- src/arch/x86/include/ipxe/rtc_entropy.h | 62 ----- src/arch/x86/interface/pcbios/rtc_entropy.c | 38 ++- src/config/config_entropy.c | 48 ++++ src/config/defaults/efi.h | 1 + src/config/defaults/linux.h | 4 + src/config/defaults/pcbios.h | 1 + src/crypto/entropy.c | 283 +++++++------------ src/crypto/null_entropy.c | 40 --- src/include/ipxe/efi/efi_entropy.h | 35 --- src/include/ipxe/entropy.h | 414 +++++++++++++++++++++------- src/include/ipxe/linux/linux_entropy.h | 34 --- src/include/ipxe/null_entropy.h | 52 ---- src/interface/efi/efi_entropy.c | 19 +- src/interface/linux/linux_entropy.c | 20 +- 19 files changed, 540 insertions(+), 619 deletions(-) delete mode 100644 src/arch/arm/include/bits/entropy.h delete mode 100644 src/arch/loong64/include/bits/entropy.h delete mode 100644 src/arch/x86/include/bits/entropy.h delete mode 100644 src/arch/x86/include/ipxe/rdrand.h delete mode 100644 src/arch/x86/include/ipxe/rtc_entropy.h create mode 100644 src/config/config_entropy.c delete mode 100644 src/crypto/null_entropy.c delete mode 100644 src/include/ipxe/efi/efi_entropy.h delete mode 100644 src/include/ipxe/linux/linux_entropy.h delete mode 100644 src/include/ipxe/null_entropy.h (limited to 'src/arch/x86') diff --git a/src/arch/arm/include/bits/entropy.h b/src/arch/arm/include/bits/entropy.h deleted file mode 100644 index 75fdc90ea..000000000 --- a/src/arch/arm/include/bits/entropy.h +++ /dev/null @@ -1,12 +0,0 @@ -#ifndef _BITS_ENTROPY_H -#define _BITS_ENTROPY_H - -/** @file - * - * ARM-specific entropy API implementations - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#endif /* _BITS_ENTROPY_H */ diff --git a/src/arch/loong64/include/bits/entropy.h b/src/arch/loong64/include/bits/entropy.h deleted file mode 100644 index 8d3726930..000000000 --- a/src/arch/loong64/include/bits/entropy.h +++ /dev/null @@ -1,12 +0,0 @@ -#ifndef _BITS_ENTROPY_H -#define _BITS_ENTROPY_H - -/** @file - * - * LoongArch64-specific entropy API implementations - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#endif /* _BITS_ENTROPY_H */ diff --git a/src/arch/x86/core/rdrand.c b/src/arch/x86/core/rdrand.c index 29605ab2f..850ab1f11 100644 --- a/src/arch/x86/core/rdrand.c +++ b/src/arch/x86/core/rdrand.c @@ -32,12 +32,15 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include + +struct entropy_source rdrand_entropy __entropy_source ( ENTROPY_PREFERRED ); /** Number of times to retry RDRAND instruction */ #define RDRAND_RETRY_COUNT 16 /** Colour for debug messages */ -#define colour CPUID_FEATURES_INTEL_ECX_RDRAND +#define colour &rdrand_entropy /** * Enable entropy gathering @@ -54,16 +57,15 @@ static int rdrand_entropy_enable ( void ) { return -ENOTSUP; } - return 0; -} - -/** - * Disable entropy gathering - * - */ -static void rdrand_entropy_disable ( void ) { + /* Data returned by RDRAND is theoretically full entropy, up + * to a security strength of 128 bits, so assume that each + * sample contains exactly 8 bits of entropy. + */ + if ( DRBG_SECURITY_STRENGTH > 128 ) + return -ENOTSUP; + entropy_init ( &rdrand_entropy, MIN_ENTROPY ( 8.0 ) ); - /* Nothing to do */ + return 0; } /** @@ -93,7 +95,9 @@ static int rdrand_get_noise ( noise_sample_t *noise ) { return 0; } -PROVIDE_ENTROPY_INLINE ( rdrand, min_entropy_per_sample ); -PROVIDE_ENTROPY ( rdrand, entropy_enable, rdrand_entropy_enable ); -PROVIDE_ENTROPY ( rdrand, entropy_disable, rdrand_entropy_disable ); -PROVIDE_ENTROPY ( rdrand, get_noise, rdrand_get_noise ); +/** Hardware random number generator entropy source */ +struct entropy_source rdrand_entropy __entropy_source ( ENTROPY_PREFERRED ) = { + .name = "rdrand", + .enable = rdrand_entropy_enable, + .get_noise = rdrand_get_noise, +}; diff --git a/src/arch/x86/include/bits/entropy.h b/src/arch/x86/include/bits/entropy.h deleted file mode 100644 index 7accea33f..000000000 --- a/src/arch/x86/include/bits/entropy.h +++ /dev/null @@ -1,15 +0,0 @@ -#ifndef _BITS_ENTROPY_H -#define _BITS_ENTROPY_H - -/** @file - * - * x86-specific entropy API implementations - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include -#include - -#endif /* _BITS_ENTROPY_H */ diff --git a/src/arch/x86/include/ipxe/rdrand.h b/src/arch/x86/include/ipxe/rdrand.h deleted file mode 100644 index c9c170fb0..000000000 --- a/src/arch/x86/include/ipxe/rdrand.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef _IPXE_RDRAND_H -#define _IPXE_RDRAND_H - -/** @file - * - * Hardware random number generator - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include -#include - -#ifdef ENTROPY_RDRAND -#define ENTROPY_PREFIX_rdrand -#else -#define ENTROPY_PREFIX_rdrand __rdrand_ -#endif - -/** - * min-entropy per sample - * - * @ret min_entropy min-entropy of each sample - */ -static inline __always_inline min_entropy_t -ENTROPY_INLINE ( rdrand, min_entropy_per_sample ) ( void ) { - - /* Data returned by RDRAND is theoretically full entropy, up - * to a security strength of 128 bits. - */ - if ( DRBG_SECURITY_STRENGTH > 128 ) - return 0; - return MIN_ENTROPY ( 8 * sizeof ( noise_sample_t ) ); -} - -#endif /* _IPXE_RDRAND_H */ diff --git a/src/arch/x86/include/ipxe/rtc_entropy.h b/src/arch/x86/include/ipxe/rtc_entropy.h deleted file mode 100644 index 581abcd3e..000000000 --- a/src/arch/x86/include/ipxe/rtc_entropy.h +++ /dev/null @@ -1,62 +0,0 @@ -#ifndef _IPXE_RTC_ENTROPY_H -#define _IPXE_RTC_ENTROPY_H - -/** @file - * - * RTC-based entropy source - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#ifdef ENTROPY_RTC -#define ENTROPY_PREFIX_rtc -#else -#define ENTROPY_PREFIX_rtc __rtc_ -#endif - -/** - * min-entropy per sample - * - * @ret min_entropy min-entropy of each sample - */ -static inline __always_inline min_entropy_t -ENTROPY_INLINE ( rtc, min_entropy_per_sample ) ( void ) { - - /* The min-entropy has been measured on several platforms - * using the entropy_sample test code. Modelling the samples - * as independent, and using a confidence level of 99.99%, the - * measurements were as follows: - * - * qemu-kvm : 7.38 bits - * VMware : 7.46 bits - * Physical hardware : 2.67 bits - * - * We choose the lowest of these (2.67 bits) and apply a 50% - * safety margin to allow for some potential non-independence - * of samples. - */ - return MIN_ENTROPY ( 1.3 ); -} - -extern uint8_t rtc_sample ( void ); - -/** - * Get noise sample - * - * @ret noise Noise sample - * @ret rc Return status code - */ -static inline __always_inline int -ENTROPY_INLINE ( rtc, get_noise ) ( noise_sample_t *noise ) { - - /* Get sample */ - *noise = rtc_sample(); - - /* Always successful */ - return 0; -} - -#endif /* _IPXE_RTC_ENTROPY_H */ diff --git a/src/arch/x86/interface/pcbios/rtc_entropy.c b/src/arch/x86/interface/pcbios/rtc_entropy.c index c400d8a78..8f47ff6b8 100644 --- a/src/arch/x86/interface/pcbios/rtc_entropy.c +++ b/src/arch/x86/interface/pcbios/rtc_entropy.c @@ -39,6 +39,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +struct entropy_source rtc_entropy __entropy_source ( ENTROPY_NORMAL ); + /** Maximum time to wait for an RTC interrupt, in milliseconds */ #define RTC_MAX_WAIT_MS 100 @@ -203,6 +205,21 @@ static int rtc_entropy_enable ( void ) { if ( ( rc = rtc_entropy_check() ) != 0 ) goto err_check; + /* The min-entropy has been measured on several platforms + * using the entropy_sample test code. Modelling the samples + * as independent, and using a confidence level of 99.99%, the + * measurements were as follows: + * + * qemu-kvm : 7.38 bits + * VMware : 7.46 bits + * Physical hardware : 2.67 bits + * + * We choose the lowest of these (2.67 bits) and apply a 50% + * safety margin to allow for some potential non-independence + * of samples. + */ + entropy_init ( &rtc_entropy, MIN_ENTROPY ( 1.3 ) ); + return 0; err_check: @@ -226,11 +243,12 @@ static void rtc_entropy_disable ( void ) { } /** - * Measure a single RTC tick + * Get noise sample * - * @ret delta Length of RTC tick (in TSC units) + * @ret noise Noise sample + * @ret rc Return status code */ -uint8_t rtc_sample ( void ) { +static int rtc_get_noise ( noise_sample_t *noise ) { uint32_t before; uint32_t after; uint32_t temp; @@ -265,10 +283,14 @@ uint8_t rtc_sample ( void ) { : "=a" ( after ), "=d" ( before ), "=Q" ( temp ) : "2" ( 0 ) ); - return ( after - before ); + *noise = ( after - before ); + return 0; } -PROVIDE_ENTROPY_INLINE ( rtc, min_entropy_per_sample ); -PROVIDE_ENTROPY ( rtc, entropy_enable, rtc_entropy_enable ); -PROVIDE_ENTROPY ( rtc, entropy_disable, rtc_entropy_disable ); -PROVIDE_ENTROPY_INLINE ( rtc, get_noise ); +/** RTC entropy source */ +struct entropy_source rtc_entropy __entropy_source ( ENTROPY_NORMAL ) = { + .name = "rtc", + .enable = rtc_entropy_enable, + .disable = rtc_entropy_disable, + .get_noise = rtc_get_noise, +}; diff --git a/src/config/config_entropy.c b/src/config/config_entropy.c new file mode 100644 index 000000000..e96019a58 --- /dev/null +++ b/src/config/config_entropy.c @@ -0,0 +1,48 @@ +/* + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + * + * You can also choose to distribute this program under the terms of + * the Unmodified Binary Distribution Licence (as given in the file + * COPYING.UBDL), provided that you have satisfied its requirements. + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +/** @file + * + * Entropy configuration options + * + */ + +PROVIDE_REQUIRING_SYMBOL(); + +/* + * Drag in entropy sources + */ +#ifdef ENTROPY_RTC +REQUIRE_OBJECT ( rtc_entropy ); +#endif +#ifdef ENTROPY_EFI +REQUIRE_OBJECT ( efi_entropy ); +#endif +#ifdef ENTROPY_LINUX +REQUIRE_OBJECT ( linux_entropy ); +#endif +#ifdef ENTROPY_RDRAND +REQUIRE_OBJECT ( rdrand ); +#endif diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 625ae055c..16c561660 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -50,6 +50,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #if defined ( __i386__ ) || defined ( __x86_64__ ) #define IOAPI_X86 #define NAP_EFIX86 +#define ENTROPY_RDRAND #define CPUID_CMD /* x86 CPU feature detection command */ #define UNSAFE_STD /* Avoid setting direction flag */ #endif diff --git a/src/config/defaults/linux.h b/src/config/defaults/linux.h index 5c4106d30..21de2a2e2 100644 --- a/src/config/defaults/linux.h +++ b/src/config/defaults/linux.h @@ -33,4 +33,8 @@ FILE_LICENCE ( GPL2_OR_LATER ); #define SANBOOT_PROTO_FCP #define SANBOOT_PROTO_HTTP +#if defined ( __i386__ ) || defined ( __x86_64__ ) +#define ENTROPY_RDRAND +#endif + #endif /* CONFIG_DEFAULTS_LINUX_H */ diff --git a/src/config/defaults/pcbios.h b/src/config/defaults/pcbios.h index 83835805a..ee342d41b 100644 --- a/src/config/defaults/pcbios.h +++ b/src/config/defaults/pcbios.h @@ -20,6 +20,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define SMBIOS_PCBIOS #define SANBOOT_PCBIOS #define ENTROPY_RTC +#define ENTROPY_RDRAND #define TIME_RTC #define REBOOT_PCBIOS #define ACPI_RSDP diff --git a/src/crypto/entropy.c b/src/crypto/entropy.c index ced6fd921..204e6bb1e 100644 --- a/src/crypto/entropy.c +++ b/src/crypto/entropy.c @@ -50,46 +50,61 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define EINFO_EPIPE_ADAPTIVE_PROPORTION_TEST \ __einfo_uniqify ( EINFO_EPIPE, 0x02, "Adaptive proportion test failed" ) +/** Current entropy source */ +static struct entropy_source *entropy_source; + /** - * Calculate cutoff value for the repetition count test - * - * @ret cutoff Cutoff value + * Enable entropy gathering * - * This is the cutoff value for the Repetition Count Test defined in - * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.2. + * @ret rc Return status code */ -static inline __attribute__ (( always_inline )) unsigned int -repetition_count_cutoff ( void ) { - double max_repetitions; - unsigned int cutoff; +int entropy_enable ( void ) { + int rc; - /* The cutoff formula for the repetition test is: - * - * C = ( 1 + ( -log2(W) / H_min ) ) - * - * where W is set at 2^(-30) (in ANS X9.82 Part 2 (October - * 2011 Draft) Section 8.5.2.1.3.1). - */ - max_repetitions = ( 1 + ( MIN_ENTROPY ( 30 ) / - min_entropy_per_sample() ) ); + /* Enable selected source, if applicable */ + if ( entropy_source ) { - /* Round up to a whole number of repetitions. We don't have - * the ceil() function available, so do the rounding by hand. - */ - cutoff = max_repetitions; - if ( cutoff < max_repetitions ) - cutoff++; - linker_assert ( ( cutoff >= max_repetitions ), rounding_error ); - - /* Floating-point operations are not allowed in iPXE since we - * never set up a suitable environment. Abort the build - * unless the calculated number of repetitions is a - * compile-time constant. - */ - linker_assert ( __builtin_constant_p ( cutoff ), - repetition_count_cutoff_not_constant ); + /* Enable entropy source */ + if ( ( rc = entropy_source->enable() ) != 0 ) { + DBGC ( &entropy_source, "ENTROPY could not enable " + "source \"%s\": %s\n", entropy_source->name, + strerror ( rc ) ); + return rc; + } - return cutoff; + /* Sanity checks */ + assert ( entropy_source->min_entropy_per_sample > 0 ); + assert ( entropy_source->repetition_count_cutoff > 0 ); + assert ( entropy_source->adaptive_proportion_cutoff > 0 ); + assert ( entropy_source->startup_test_count > 0 ); + + return 0; + } + + /* Find the first working source */ + rc = -ENOENT; + for_each_table_entry ( entropy_source, ENTROPY_SOURCES ) { + if ( ( rc = entropy_enable() ) == 0 ) { + DBGC ( &entropy_source, "ENTROPY using source \"%s\"\n", + entropy_source->name ); + break; + } + } + return rc; +} + +/** + * Disable entropy gathering + * + */ +void entropy_disable ( void ) { + + /* Sanity check */ + assert ( entropy_source != NULL ); + + /* Disable entropy gathering, if applicable */ + if ( entropy_source->disable ) + entropy_source->disable(); } /** @@ -104,6 +119,8 @@ repetition_count_cutoff ( void ) { static int repetition_count_test ( noise_sample_t sample ) { static noise_sample_t most_recent_sample; static unsigned int repetition_count = 0; + unsigned int repetition_count_cutoff = + entropy_source->repetition_count_cutoff; /* A = the most recently seen sample value * B = the number of times that value A has been seen in a row @@ -124,7 +141,7 @@ static int repetition_count_test ( noise_sample_t sample ) { /* i. If B >= C, then an error condition is raised * due to a failure of the test */ - if ( repetition_count >= repetition_count_cutoff() ) + if ( repetition_count >= repetition_count_cutoff ) return -EPIPE_REPETITION_COUNT_TEST; } else { @@ -141,117 +158,6 @@ static int repetition_count_test ( noise_sample_t sample ) { return 0; } -/** - * Window size for the adaptive proportion test - * - * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.3.1.1 allows - * five possible window sizes: 16, 64, 256, 4096 and 65536. - * - * We expect to generate relatively few (<256) entropy samples during - * a typical iPXE run; the use of a large window size would mean that - * the test would never complete a single cycle. We use a window size - * of 64, which is the smallest window size that permits values of - * H_min down to one bit per sample. - */ -#define ADAPTIVE_PROPORTION_WINDOW_SIZE 64 - -/** - * Combine adaptive proportion test window size and min-entropy - * - * @v n N (window size) - * @v h H (min-entropy) - * @ret n_h (N,H) combined value - */ -#define APC_N_H( n, h ) ( ( (n) << 8 ) | (h) ) - -/** - * Define a row of the adaptive proportion cutoff table - * - * @v h H (min-entropy) - * @v c16 Cutoff for N=16 - * @v c64 Cutoff for N=64 - * @v c256 Cutoff for N=256 - * @v c4096 Cutoff for N=4096 - * @v c65536 Cutoff for N=65536 - */ -#define APC_TABLE_ROW( h, c16, c64, c256, c4096, c65536) \ - case APC_N_H ( 16, h ) : return c16; \ - case APC_N_H ( 64, h ) : return c64; \ - case APC_N_H ( 256, h ) : return c256; \ - case APC_N_H ( 4096, h ) : return c4096; \ - case APC_N_H ( 65536, h ) : return c65536; - -/** Value used to represent "N/A" in adaptive proportion cutoff table */ -#define APC_NA 0 - -/** - * Look up value in adaptive proportion test cutoff table - * - * @v n N (window size) - * @v h H (min-entropy) - * @ret cutoff Cutoff - * - * This is the table of cutoff values defined in ANS X9.82 Part 2 - * (October 2011 Draft) Section 8.5.2.1.3.1.2. - */ -static inline __attribute__ (( always_inline )) unsigned int -adaptive_proportion_cutoff_lookup ( unsigned int n, unsigned int h ) { - switch ( APC_N_H ( n, h ) ) { - APC_TABLE_ROW ( 1, APC_NA, 51, 168, 2240, 33537 ); - APC_TABLE_ROW ( 2, APC_NA, 35, 100, 1193, 17053 ); - APC_TABLE_ROW ( 3, 10, 24, 61, 643, 8705 ); - APC_TABLE_ROW ( 4, 8, 16, 38, 354, 4473 ); - APC_TABLE_ROW ( 5, 6, 12, 25, 200, 2321 ); - APC_TABLE_ROW ( 6, 5, 9, 17, 117, 1220 ); - APC_TABLE_ROW ( 7, 4, 7, 15, 71, 653 ); - APC_TABLE_ROW ( 8, 4, 5, 9, 45, 358 ); - APC_TABLE_ROW ( 9, 3, 4, 7, 30, 202 ); - APC_TABLE_ROW ( 10, 3, 4, 5, 21, 118 ); - APC_TABLE_ROW ( 11, 2, 3, 4, 15, 71 ); - APC_TABLE_ROW ( 12, 2, 3, 4, 11, 45 ); - APC_TABLE_ROW ( 13, 2, 2, 3, 9, 30 ); - APC_TABLE_ROW ( 14, 2, 2, 3, 7, 21 ); - APC_TABLE_ROW ( 15, 1, 2, 2, 6, 15 ); - APC_TABLE_ROW ( 16, 1, 2, 2, 5, 11 ); - APC_TABLE_ROW ( 17, 1, 1, 2, 4, 9 ); - APC_TABLE_ROW ( 18, 1, 1, 2, 4, 7 ); - APC_TABLE_ROW ( 19, 1, 1, 1, 3, 6 ); - APC_TABLE_ROW ( 20, 1, 1, 1, 3, 5 ); - default: - return APC_NA; - } -} - -/** - * Calculate cutoff value for the adaptive proportion test - * - * @ret cutoff Cutoff value - * - * This is the cutoff value for the Adaptive Proportion Test defined - * in ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.3.1.2. - */ -static inline __attribute__ (( always_inline )) unsigned int -adaptive_proportion_cutoff ( void ) { - unsigned int h; - unsigned int n; - unsigned int cutoff; - - /* Look up cutoff value in cutoff table */ - n = ADAPTIVE_PROPORTION_WINDOW_SIZE; - h = ( min_entropy_per_sample() / MIN_ENTROPY_SCALE ); - cutoff = adaptive_proportion_cutoff_lookup ( n, h ); - - /* Fail unless cutoff value is a build-time constant */ - linker_assert ( __builtin_constant_p ( cutoff ), - adaptive_proportion_cutoff_not_constant ); - - /* Fail if cutoff value is N/A */ - linker_assert ( ( cutoff != APC_NA ), - adaptive_proportion_cutoff_not_applicable ); - - return cutoff; -} - /** * Perform adaptive proportion test * @@ -265,6 +171,8 @@ static int adaptive_proportion_test ( noise_sample_t sample ) { static noise_sample_t current_counted_sample; static unsigned int sample_count = ADAPTIVE_PROPORTION_WINDOW_SIZE; static unsigned int repetition_count; + unsigned int adaptive_proportion_cutoff = + entropy_source->adaptive_proportion_cutoff; /* A = the sample value currently being counted * B = the number of samples examined in this run of the test so far @@ -312,7 +220,7 @@ static int adaptive_proportion_test ( noise_sample_t sample ) { * condition, because the test has * detected a failure */ - if ( repetition_count > adaptive_proportion_cutoff() ) + if ( repetition_count > adaptive_proportion_cutoff ) return -EPIPE_ADAPTIVE_PROPORTION_TEST; } @@ -321,6 +229,23 @@ static int adaptive_proportion_test ( noise_sample_t sample ) { return 0; } +/** + * Get noise sample + * + * @ret noise Noise sample + * @ret rc Return status code + * + * This is the GetNoise function defined in ANS X9.82 Part 2 + * (October 2011 Draft) Section 6.5.2. + */ +int get_noise ( noise_sample_t *noise ) { + + /* Sanity check */ + assert ( entropy_source != NULL ); + + return entropy_source->get_noise ( noise ); +} + /** * Get entropy sample * @@ -334,6 +259,9 @@ static int get_entropy ( entropy_sample_t *entropy ) { static int rc = 0; noise_sample_t noise; + /* Sanity check */ + assert ( entropy_source != NULL ); + /* Any failure is permanent */ if ( rc != 0 ) return rc; @@ -357,31 +285,6 @@ static int get_entropy ( entropy_sample_t *entropy ) { return 0; } -/** - * Calculate number of samples required for startup tests - * - * @ret num_samples Number of samples required - * - * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.5 requires - * that at least one full cycle of the continuous tests must be - * performed at start-up. - */ -static inline __attribute__ (( always_inline )) unsigned int -startup_test_count ( void ) { - unsigned int num_samples; - - /* At least max(N,C) samples shall be generated by the noise - * source for start-up testing. - */ - num_samples = repetition_count_cutoff(); - if ( num_samples < adaptive_proportion_cutoff() ) - num_samples = adaptive_proportion_cutoff(); - linker_assert ( __builtin_constant_p ( num_samples ), - startup_test_count_not_constant ); - - return num_samples; -} - /** * Create next nonce value * @@ -402,7 +305,7 @@ static uint32_t make_next_nonce ( void ) { /** * Obtain entropy input temporary buffer * - * @v num_samples Number of entropy samples + * @v min_entropy Min-entropy required * @v tmp Temporary buffer * @v tmp_len Length of temporary buffer * @ret rc Return status code @@ -412,11 +315,8 @@ static uint32_t make_next_nonce ( void ) { * and condensing each entropy source output after each GetEntropy * call) as defined in ANS X9.82 Part 4 (April 2011 Draft) Section * 13.3.4.2. - * - * To minimise code size, the number of samples required is calculated - * at compilation time. */ -int get_entropy_input_tmp ( unsigned int num_samples, uint8_t *tmp, +int get_entropy_input_tmp ( min_entropy_t min_entropy, uint8_t *tmp, size_t tmp_len ) { static unsigned int startup_tested = 0; struct { @@ -424,6 +324,8 @@ int get_entropy_input_tmp ( unsigned int num_samples, uint8_t *tmp, entropy_sample_t sample; } __attribute__ (( packed )) data;; uint8_t df_buf[tmp_len]; + min_entropy_t entropy_total; + unsigned int num_samples; unsigned int i; int rc; @@ -432,22 +334,20 @@ int get_entropy_input_tmp ( unsigned int num_samples, uint8_t *tmp, return rc; /* Perform mandatory startup tests, if not yet performed */ - for ( ; startup_tested < startup_test_count() ; startup_tested++ ) { + for ( ; startup_tested < entropy_source->startup_test_count ; + startup_tested++ ) { if ( ( rc = get_entropy ( &data.sample ) ) != 0 ) goto err_get_entropy; } - /* 3. entropy_total = 0 - * - * (Nothing to do; the number of entropy samples required has - * already been precalculated.) - */ + /* 3. entropy_total = 0 */ + entropy_total = MIN_ENTROPY ( 0 ); /* 4. tmp = a fixed n-bit value, such as 0^n */ memset ( tmp, 0, tmp_len ); /* 5. While ( entropy_total < min_entropy ) */ - while ( num_samples-- ) { + for ( num_samples = 0 ; entropy_total < min_entropy ; num_samples++ ) { /* 5.1. ( status, entropy_bitstring, assessed_entropy ) * = GetEntropy() * 5.2. If status indicates an error, return ( status, Null ) @@ -466,19 +366,24 @@ int get_entropy_input_tmp ( unsigned int num_samples, uint8_t *tmp, for ( i = 0 ; i < tmp_len ; i++ ) tmp[i] ^= df_buf[i]; - /* 5.5. entropy_total = entropy_total + assessed_entropy - * - * (Nothing to do; the number of entropy samples - * required has already been precalculated.) - */ + /* 5.5. entropy_total = entropy_total + assessed_entropy */ + entropy_total += entropy_source->min_entropy_per_sample; } /* Disable entropy gathering */ entropy_disable(); + DBGC ( &entropy_source, "ENTROPY gathered %d bits in %d samples\n", + ( min_entropy / MIN_ENTROPY_SCALE ), num_samples ); return 0; err_get_entropy: entropy_disable(); return rc; } + +/* Drag in objects via entropy_enable */ +REQUIRING_SYMBOL ( entropy_enable ); + +/* Drag in entropy configuration */ +REQUIRE_OBJECT ( config_entropy ); diff --git a/src/crypto/null_entropy.c b/src/crypto/null_entropy.c deleted file mode 100644 index d1e1a6f73..000000000 --- a/src/crypto/null_entropy.c +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2012 Michael Brown . - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of the - * License, or any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - * - * You can also choose to distribute this program under the terms of - * the Unmodified Binary Distribution Licence (as given in the file - * COPYING.UBDL), provided that you have satisfied its requirements. - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -/** @file - * - * Nonexistent entropy source - * - * - * This source provides no entropy and must NOT be used in a - * security-sensitive environment. - */ - -#include - -PROVIDE_ENTROPY_INLINE ( null, min_entropy_per_sample ); -PROVIDE_ENTROPY_INLINE ( null, entropy_enable ); -PROVIDE_ENTROPY_INLINE ( null, entropy_disable ); -PROVIDE_ENTROPY_INLINE ( null, get_noise ); diff --git a/src/include/ipxe/efi/efi_entropy.h b/src/include/ipxe/efi/efi_entropy.h deleted file mode 100644 index 5b16fd7f9..000000000 --- a/src/include/ipxe/efi/efi_entropy.h +++ /dev/null @@ -1,35 +0,0 @@ -#ifndef _IPXE_EFI_ENTROPY_H -#define _IPXE_EFI_ENTROPY_H - -/** @file - * - * EFI entropy source - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#ifdef ENTROPY_EFI -#define ENTROPY_PREFIX_efi -#else -#define ENTROPY_PREFIX_efi __efi_ -#endif - -/** - * min-entropy per sample - * - * @ret min_entropy min-entropy of each sample - */ -static inline __always_inline min_entropy_t -ENTROPY_INLINE ( efi, min_entropy_per_sample ) ( void ) { - - /* We use essentially the same mechanism as for the BIOS - * RTC-based entropy source, and so assume the same - * min-entropy per sample. - */ - return MIN_ENTROPY ( 1.3 ); -} - -#endif /* _IPXE_EFI_ENTROPY_H */ diff --git a/src/include/ipxe/entropy.h b/src/include/ipxe/entropy.h index d2e3ce501..108c37669 100644 --- a/src/include/ipxe/entropy.h +++ b/src/include/ipxe/entropy.h @@ -12,40 +12,11 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include +#include #include -/** - * Calculate static inline entropy API function name - * - * @v _prefix Subsystem prefix - * @v _api_func API function - * @ret _subsys_func Subsystem API function - */ -#define ENTROPY_INLINE( _subsys, _api_func ) \ - SINGLE_API_INLINE ( ENTROPY_PREFIX_ ## _subsys, _api_func ) - -/** - * Provide a entropy API implementation - * - * @v _prefix Subsystem prefix - * @v _api_func API function - * @v _func Implementing function - */ -#define PROVIDE_ENTROPY( _subsys, _api_func, _func ) \ - PROVIDE_SINGLE_API ( ENTROPY_PREFIX_ ## _subsys, _api_func, _func ) - -/** - * Provide a static inline entropy API implementation - * - * @v _prefix Subsystem prefix - * @v _api_func API function - */ -#define PROVIDE_ENTROPY_INLINE( _subsys, _api_func ) \ - PROVIDE_SINGLE_API_INLINE ( ENTROPY_PREFIX_ ## _subsys, _api_func ) - /** A noise sample */ typedef uint8_t noise_sample_t; @@ -71,56 +42,93 @@ typedef unsigned int min_entropy_t; #define MIN_ENTROPY( bits ) \ ( ( min_entropy_t ) ( (bits) * MIN_ENTROPY_SCALE ) ) -/* Include all architecture-independent entropy API headers */ -#include -#include -#include +/** An entropy source */ +struct entropy_source { + /** Name */ + const char *name; + /** + * min-entropy per sample + * + * min-entropy is defined in ANS X9.82 Part 1-2006 Section 8.3 and in + * NIST SP 800-90 Appendix C.3 as + * + * H_min = -log2 ( p_max ) + * + * where p_max is the probability of the most likely sample value. + * + * Filled in by entropy_init(). + */ + min_entropy_t min_entropy_per_sample; + /** + * Repetition count test cutoff value + * + * This is the cutoff value for the Repetition Count Test + * defined in ANS X9.82 Part 2 (October 2011 Draft) Section + * 8.5.2.1.2. + * + * Filled in by entropy_init(). + */ + unsigned int repetition_count_cutoff; + /** + * Adaptive proportion test cutoff value + * + * This is the cutoff value for the Adaptive Proportion Test + * defined in ANS X9.82 Part 2 (October 2011 Draft) Section + * 8.5.2.1.3.1.2. + * + * Filled in by entropy_init(). + */ + unsigned int adaptive_proportion_cutoff; + /** + * Startup test count + * + * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.5 + * requires that at least one full cycle of the continuous + * tests must be performed at start-up. + */ + unsigned int startup_test_count; + /** + * Enable entropy gathering + * + * @ret rc Return status code + */ + int ( * enable ) ( void ); + /** + * Disable entropy gathering + * + */ + void ( * disable ) ( void ); + /** + * Get noise sample + * + * @ret noise Noise sample + * @ret rc Return status code + * + * This is the GetNoise function defined in ANS X9.82 Part 2 + * (October 2011 Draft) Section 6.5.2. + */ + int ( * get_noise ) ( noise_sample_t *noise ); +}; -/* Include all architecture-dependent entropy API headers */ -#include +/** Entropy source table */ +#define ENTROPY_SOURCES __table ( struct entropy_source, "entropy_sources" ) -/** - * Enable entropy gathering - * - * @ret rc Return status code - */ -int entropy_enable ( void ); +/** Declare an entropy source */ +#define __entropy_source( order ) __table_entry ( ENTROPY_SOURCES, order ) -/** - * Disable entropy gathering +/** @defgroup entropy_source_order Entropy source order * + * @{ */ -void entropy_disable ( void ); -/** - * min-entropy per sample - * - * @ret min_entropy min-entropy of each sample - * - * min-entropy is defined in ANS X9.82 Part 1-2006 Section 8.3 and in - * NIST SP 800-90 Appendix C.3 as - * - * H_min = -log2 ( p_max ) - * - * where p_max is the probability of the most likely sample value. - * - * This must be a compile-time constant. - */ -min_entropy_t min_entropy_per_sample ( void ); +#define ENTROPY_PREFERRED 01 /**< Preferred entropy source */ +#define ENTROPY_NORMAL 02 /**< Normal entropy source */ +#define ENTROPY_FALLBACK 03 /**< Fallback entropy source */ -/** - * Get noise sample - * - * @ret noise Noise sample - * @ret rc Return status code - * - * This is the GetNoise function defined in ANS X9.82 Part 2 - * (October 2011 Draft) Section 6.5.2. - */ -int get_noise ( noise_sample_t *noise ); +/** @} */ -extern int get_entropy_input_tmp ( unsigned int num_samples, - uint8_t *tmp, size_t tmp_len ); +extern int get_entropy_input_tmp ( min_entropy_t min_entropy, uint8_t *tmp, + size_t tmp_len ); /** Use SHA-256 as the underlying hash algorithm for Hash_df * @@ -145,8 +153,8 @@ extern int get_entropy_input_tmp ( unsigned int num_samples, * each entropy source output after each GetEntropy call) as defined * in ANS X9.82 Part 4 (April 2011 Draft) Section 13.3.4.2. * - * To minimise code size, the number of samples required is calculated - * at compilation time. + * This function is inlined since the entropy amount and length inputs + * are always compile-time constants. */ static inline __attribute__ (( always_inline )) int get_entropy_input ( unsigned int min_entropy_bits, void *data, size_t min_len, @@ -154,41 +162,16 @@ get_entropy_input ( unsigned int min_entropy_bits, void *data, size_t min_len, size_t tmp_len = ( ( ( min_entropy_bits * 2 ) + 7 ) / 8 ); uint8_t tmp_buf[ tmp_len ]; uint8_t *tmp = ( ( tmp_len > max_len ) ? tmp_buf : data ); - double min_samples; - unsigned int num_samples; unsigned int n; int rc; - /* Sanity checks */ - linker_assert ( ( min_entropy_per_sample() <= - MIN_ENTROPY ( 8 * sizeof ( noise_sample_t ) ) ), - min_entropy_per_sample_is_impossibly_high ); + /* Sanity check */ linker_assert ( ( min_entropy_bits <= ( 8 * max_len ) ), entropy_buffer_too_small ); /* Round up minimum entropy to an integral number of bytes */ min_entropy_bits = ( ( min_entropy_bits + 7 ) & ~7 ); - /* Calculate number of samples required to contain sufficient entropy */ - min_samples = ( MIN_ENTROPY ( min_entropy_bits ) / - min_entropy_per_sample() ); - - /* Round up to a whole number of samples. We don't have the - * ceil() function available, so do the rounding by hand. - */ - num_samples = min_samples; - if ( num_samples < min_samples ) - num_samples++; - linker_assert ( ( num_samples >= min_samples ), rounding_error ); - - /* Floating-point operations are not allowed in iPXE since we - * never set up a suitable environment. Abort the build - * unless the calculated number of samples is a compile-time - * constant. - */ - linker_assert ( __builtin_constant_p ( num_samples ), - num_samples_not_constant ); - /* (Unnumbered). The output length of the hash function shall * meet or exceed the security strength indicated by the * min_entropy parameter. @@ -218,8 +201,10 @@ get_entropy_input ( unsigned int min_entropy_bits, void *data, size_t min_len, linker_assert ( __builtin_constant_p ( tmp_len ), tmp_len_not_constant ); linker_assert ( ( n == ( 8 * tmp_len ) ), tmp_len_mismatch ); - if ( ( rc = get_entropy_input_tmp ( num_samples, tmp, tmp_len ) ) != 0 ) + if ( ( rc = get_entropy_input_tmp ( MIN_ENTROPY ( min_entropy_bits ), + tmp, tmp_len ) ) != 0 ) { return rc; + } /* 6. If ( n < min_length ), then tmp = tmp || 0^(min_length-n) * 7. If ( n > max_length ), then tmp = df ( tmp, max_length ) @@ -242,4 +227,231 @@ get_entropy_input ( unsigned int min_entropy_bits, void *data, size_t min_len, } } +/** + * Calculate cutoff value for the repetition count test + * + * @v min_entropy_per_sample Min-entropy per sample + * @ret cutoff Cutoff value + * + * This is the cutoff value for the Repetition Count Test defined in + * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.2. + */ +static inline __attribute__ (( always_inline )) unsigned int +entropy_repetition_count_cutoff ( min_entropy_t min_entropy_per_sample ) { + double max_repetitions; + unsigned int cutoff; + + /* The cutoff formula for the repetition test is: + * + * C = ( 1 + ( -log2(W) / H_min ) ) + * + * where W is set at 2^(-30) (in ANS X9.82 Part 2 (October + * 2011 Draft) Section 8.5.2.1.3.1). + */ + max_repetitions = ( 1 + ( MIN_ENTROPY ( 30 ) / + min_entropy_per_sample ) ); + + /* Round up to a whole number of repetitions. We don't have + * the ceil() function available, so do the rounding by hand. + */ + cutoff = max_repetitions; + if ( cutoff < max_repetitions ) + cutoff++; + linker_assert ( ( cutoff >= max_repetitions ), rounding_error ); + + /* Floating-point operations are not allowed in iPXE since we + * never set up a suitable environment. Abort the build + * unless the calculated number of repetitions is a + * compile-time constant. + */ + linker_assert ( __builtin_constant_p ( cutoff ), + repetition_count_cutoff_not_constant ); + + return cutoff; +} + +/** + * Window size for the adaptive proportion test + * + * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.3.1.1 allows + * five possible window sizes: 16, 64, 256, 4096 and 65536. + * + * We expect to generate relatively few (<256) entropy samples during + * a typical iPXE run; the use of a large window size would mean that + * the test would never complete a single cycle. We use a window size + * of 64, which is the smallest window size that permits values of + * H_min down to one bit per sample. + */ +#define ADAPTIVE_PROPORTION_WINDOW_SIZE 64 + +/** + * Combine adaptive proportion test window size and min-entropy + * + * @v n N (window size) + * @v h H (min-entropy) + * @ret n_h (N,H) combined value + */ +#define APC_N_H( n, h ) ( ( (n) << 8 ) | (h) ) + +/** + * Define a row of the adaptive proportion cutoff table + * + * @v h H (min-entropy) + * @v c16 Cutoff for N=16 + * @v c64 Cutoff for N=64 + * @v c256 Cutoff for N=256 + * @v c4096 Cutoff for N=4096 + * @v c65536 Cutoff for N=65536 + */ +#define APC_TABLE_ROW( h, c16, c64, c256, c4096, c65536) \ + case APC_N_H ( 16, h ) : return c16; \ + case APC_N_H ( 64, h ) : return c64; \ + case APC_N_H ( 256, h ) : return c256; \ + case APC_N_H ( 4096, h ) : return c4096; \ + case APC_N_H ( 65536, h ) : return c65536; + +/** Value used to represent "N/A" in adaptive proportion cutoff table */ +#define APC_NA 0 + +/** + * Look up value in adaptive proportion test cutoff table + * + * @v n N (window size) + * @v h H (min-entropy) + * @ret cutoff Cutoff + * + * This is the table of cutoff values defined in ANS X9.82 Part 2 + * (October 2011 Draft) Section 8.5.2.1.3.1.2. + */ +static inline __attribute__ (( always_inline )) unsigned int +entropy_adaptive_proportion_cutoff_lookup ( unsigned int n, unsigned int h ) { + switch ( APC_N_H ( n, h ) ) { + APC_TABLE_ROW ( 1, APC_NA, 51, 168, 2240, 33537 ); + APC_TABLE_ROW ( 2, APC_NA, 35, 100, 1193, 17053 ); + APC_TABLE_ROW ( 3, 10, 24, 61, 643, 8705 ); + APC_TABLE_ROW ( 4, 8, 16, 38, 354, 4473 ); + APC_TABLE_ROW ( 5, 6, 12, 25, 200, 2321 ); + APC_TABLE_ROW ( 6, 5, 9, 17, 117, 1220 ); + APC_TABLE_ROW ( 7, 4, 7, 15, 71, 653 ); + APC_TABLE_ROW ( 8, 4, 5, 9, 45, 358 ); + APC_TABLE_ROW ( 9, 3, 4, 7, 30, 202 ); + APC_TABLE_ROW ( 10, 3, 4, 5, 21, 118 ); + APC_TABLE_ROW ( 11, 2, 3, 4, 15, 71 ); + APC_TABLE_ROW ( 12, 2, 3, 4, 11, 45 ); + APC_TABLE_ROW ( 13, 2, 2, 3, 9, 30 ); + APC_TABLE_ROW ( 14, 2, 2, 3, 7, 21 ); + APC_TABLE_ROW ( 15, 1, 2, 2, 6, 15 ); + APC_TABLE_ROW ( 16, 1, 2, 2, 5, 11 ); + APC_TABLE_ROW ( 17, 1, 1, 2, 4, 9 ); + APC_TABLE_ROW ( 18, 1, 1, 2, 4, 7 ); + APC_TABLE_ROW ( 19, 1, 1, 1, 3, 6 ); + APC_TABLE_ROW ( 20, 1, 1, 1, 3, 5 ); + default: + return APC_NA; + } +} + +/** + * Calculate cutoff value for the adaptive proportion test + * + * @v min_entropy_per_sample Min-entropy per sample + * @ret cutoff Cutoff value + * + * This is the cutoff value for the Adaptive Proportion Test defined + * in ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.3.1.2. + */ +static inline __attribute__ (( always_inline )) unsigned int +entropy_adaptive_proportion_cutoff ( min_entropy_t min_entropy_per_sample ) { + unsigned int h; + unsigned int n; + unsigned int cutoff; + + /* Look up cutoff value in cutoff table */ + n = ADAPTIVE_PROPORTION_WINDOW_SIZE; + h = ( min_entropy_per_sample / MIN_ENTROPY_SCALE ); + cutoff = entropy_adaptive_proportion_cutoff_lookup ( n, h ); + + /* Fail unless cutoff value is a compile-time constant */ + linker_assert ( __builtin_constant_p ( cutoff ), + adaptive_proportion_cutoff_not_constant ); + + /* Fail if cutoff value is N/A */ + linker_assert ( ( cutoff != APC_NA ), + adaptive_proportion_cutoff_not_applicable ); + + return cutoff; +} + +/** + * Calculate number of samples required for startup tests + * + * @v repetition_count_cutoff Repetition count test cutoff value + * @v adaptive_proportion_cutoff Adaptive proportion test cutoff value + * @ret num_samples Number of samples required + * + * ANS X9.82 Part 2 (October 2011 Draft) Section 8.5.2.1.5 requires + * that at least one full cycle of the continuous tests must be + * performed at start-up. + */ +static inline __attribute__ (( always_inline )) unsigned int +entropy_startup_test_count ( unsigned int repetition_count_cutoff, + unsigned int adaptive_proportion_cutoff ) { + unsigned int num_samples; + + /* At least max(N,C) samples shall be generated by the noise + * source for start-up testing. + */ + num_samples = repetition_count_cutoff; + if ( num_samples < adaptive_proportion_cutoff ) + num_samples = adaptive_proportion_cutoff; + linker_assert ( __builtin_constant_p ( num_samples ), + startup_test_count_not_constant ); + + return num_samples; +} + +/** + * Initialise entropy source + * + * @v source Entropy source + * @v min_entropy_per_sample Min-entropy per sample + * + * The cutoff value calculations for the repetition count test and the + * adaptive proportion test are provided as static inline functions + * since the results will always be compile-time constants. + */ +static inline __attribute__ (( always_inline )) void +entropy_init ( struct entropy_source *source, + min_entropy_t min_entropy_per_sample ) { + unsigned int repetition_count_cutoff; + unsigned int adaptive_proportion_cutoff; + unsigned int startup_test_count; + + /* Sanity check */ + linker_assert ( min_entropy_per_sample > MIN_ENTROPY ( 0 ), + min_entropy_per_sample_is_zero ); + linker_assert ( ( min_entropy_per_sample <= + MIN_ENTROPY ( 8 * sizeof ( noise_sample_t ) ) ), + min_entropy_per_sample_is_impossibly_high ); + + /* Calculate test cutoff values */ + repetition_count_cutoff = + entropy_repetition_count_cutoff ( min_entropy_per_sample ); + adaptive_proportion_cutoff = + entropy_adaptive_proportion_cutoff ( min_entropy_per_sample ); + startup_test_count = + entropy_startup_test_count ( repetition_count_cutoff, + adaptive_proportion_cutoff ); + + /* Record min-entropy per sample and test cutoff values */ + source->min_entropy_per_sample = min_entropy_per_sample; + source->repetition_count_cutoff = repetition_count_cutoff; + source->adaptive_proportion_cutoff = adaptive_proportion_cutoff; + source->startup_test_count = startup_test_count; +} + +extern int entropy_enable ( void ); +extern void entropy_disable ( void ); +extern int get_noise ( noise_sample_t *noise ); + #endif /* _IPXE_ENTROPY_H */ diff --git a/src/include/ipxe/linux/linux_entropy.h b/src/include/ipxe/linux/linux_entropy.h deleted file mode 100644 index ea8c1f16c..000000000 --- a/src/include/ipxe/linux/linux_entropy.h +++ /dev/null @@ -1,34 +0,0 @@ -#ifndef _IPXE_LINUX_ENTROPY_H -#define _IPXE_LINUX_ENTROPY_H - -/** @file - * - * /dev/random-based entropy source - * - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#ifdef ENTROPY_LINUX -#define ENTROPY_PREFIX_linux -#else -#define ENTROPY_PREFIX_linux __linux_ -#endif - -/** - * min-entropy per sample - * - * @ret min_entropy min-entropy of each sample - */ -static inline __always_inline min_entropy_t -ENTROPY_INLINE ( linux, min_entropy_per_sample ) ( void ) { - - /* linux_get_noise() reads a single byte from /dev/random, - * which is supposed to block until a sufficient amount of - * entropy is available. We therefore assume that each sample - * contains exactly 8 bits of entropy. - */ - return MIN_ENTROPY ( 8.0 ); -} - -#endif /* _IPXE_LINUX_ENTROPY_H */ diff --git a/src/include/ipxe/null_entropy.h b/src/include/ipxe/null_entropy.h deleted file mode 100644 index 5a6bb6218..000000000 --- a/src/include/ipxe/null_entropy.h +++ /dev/null @@ -1,52 +0,0 @@ -#ifndef _IPXE_NULL_ENTROPY_H -#define _IPXE_NULL_ENTROPY_H - -/** @file - * - * Nonexistent entropy source - * - * This source provides no entropy and must NOT be used in a - * security-sensitive environment. - */ - -FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); - -#include - -#ifdef ENTROPY_NULL -#define ENTROPY_PREFIX_null -#else -#define ENTROPY_PREFIX_null __null_ -#endif - -static inline __always_inline int -ENTROPY_INLINE ( null, entropy_enable ) ( void ) { - /* Do nothing */ - return 0; -} - -static inline __always_inline void -ENTROPY_INLINE ( null, entropy_disable ) ( void ) { - /* Do nothing */ -} - -static inline __always_inline min_entropy_t -ENTROPY_INLINE ( null, min_entropy_per_sample ) ( void ) { - /* Actual amount of min-entropy is zero. To avoid - * division-by-zero errors and to allow compilation of - * entropy-consuming code, pretend to have 1 bit of entropy in - * each sample. - */ - return MIN_ENTROPY ( 1.0 ); -} - -static inline __always_inline int -ENTROPY_INLINE ( null, get_noise ) ( noise_sample_t *noise ) { - - /* All sample values are constant */ - *noise = 0x01; - - return 0; -} - -#endif /* _IPXE_NULL_ENTROPY_H */ diff --git a/src/interface/efi/efi_entropy.c b/src/interface/efi/efi_entropy.c index 1e8ddfb68..e5c393562 100644 --- a/src/interface/efi/efi_entropy.c +++ b/src/interface/efi/efi_entropy.c @@ -36,6 +36,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +struct entropy_source efi_entropy __entropy_source ( ENTROPY_NORMAL ); + /** Random number generator protocol */ static EFI_RNG_PROTOCOL *efirng; EFI_REQUEST_PROTOCOL ( EFI_RNG_PROTOCOL, &efirng ); @@ -91,6 +93,12 @@ static int efi_entropy_enable ( void ) { return rc; } + /* We use essentially the same mechanism as for the BIOS + * RTC-based entropy source, and so assume the same + * min-entropy per sample. + */ + entropy_init ( &efi_entropy, MIN_ENTROPY ( 1.3 ) ); + return 0; } @@ -235,7 +243,10 @@ static int efi_get_noise ( noise_sample_t *noise ) { return 0; } -PROVIDE_ENTROPY_INLINE ( efi, min_entropy_per_sample ); -PROVIDE_ENTROPY ( efi, entropy_enable, efi_entropy_enable ); -PROVIDE_ENTROPY ( efi, entropy_disable, efi_entropy_disable ); -PROVIDE_ENTROPY ( efi, get_noise, efi_get_noise ); +/** EFI entropy source */ +struct entropy_source efi_entropy __entropy_source ( ENTROPY_NORMAL ) = { + .name = "efi", + .enable = efi_entropy_enable, + .disable = efi_entropy_disable, + .get_noise = efi_get_noise, +}; diff --git a/src/interface/linux/linux_entropy.c b/src/interface/linux/linux_entropy.c index 257e993a0..f24969794 100644 --- a/src/interface/linux/linux_entropy.c +++ b/src/interface/linux/linux_entropy.c @@ -34,6 +34,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +struct entropy_source linux_entropy __entropy_source ( ENTROPY_NORMAL ); + /** Entropy source filename */ static const char entropy_filename[] = "/dev/random"; @@ -55,6 +57,13 @@ static int linux_entropy_enable ( void ) { return entropy_fd; } + /* linux_get_noise() reads a single byte from /dev/random, + * which is supposed to block until a sufficient amount of + * entropy is available. We therefore assume that each sample + * contains exactly 8 bits of entropy. + */ + entropy_init ( &linux_entropy, MIN_ENTROPY ( 8.0 ) ); + return 0; } @@ -95,7 +104,10 @@ static int linux_get_noise ( noise_sample_t *noise ) { return 0; } -PROVIDE_ENTROPY_INLINE ( linux, min_entropy_per_sample ); -PROVIDE_ENTROPY ( linux, entropy_enable, linux_entropy_enable ); -PROVIDE_ENTROPY ( linux, entropy_disable, linux_entropy_disable ); -PROVIDE_ENTROPY ( linux, get_noise, linux_get_noise ); +/** Linux entropy source */ +struct entropy_source linux_entropy __entropy_source ( ENTROPY_NORMAL ) = { + .name = "linux", + .enable = linux_entropy_enable, + .disable = linux_entropy_disable, + .get_noise = linux_get_noise, +}; -- cgit v1.2.3-55-g7522 From 9e1f7a3659071004f4b8c76f2593da6287f0d575 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 6 Mar 2023 16:28:48 +0000 Subject: [image] Always unregister currently executing image We unregister script images during their execution, to prevent a "boot" command from re-executing the containing script. This also has the side effect of preventing executing scripts from showing up within the Linux magic initrd image (or the Multiboot module list). Additional logic in bzimage.c and efi_file.c prevents a currently executing kernel from showing up within the magic initrd image. Similar logic in multiboot.c prevents the Multiboot kernel from showing up as a Multiboot module. This still leaves some corner cases that are not covered correctly. For example: when using a gzip-compressed kernel image, nothing will currently hide the original compressed image from the magic initrd. Fix by moving the logic that temporarily unregisters the current image from script_exec() to image_exec(), so that it applies to all image types, and simplify the magic initrd and Multiboot module list construction logic on the basis that no further filtering of the registered image list is necessary. This change has the side effect of hiding currently executing EFI images from the virtual filesystem exposed by iPXE. For example, when using iPXE to boot wimboot, the wimboot binary itself will no longer be visible within the virtual filesystem. Signed-off-by: Michael Brown --- src/arch/x86/image/bzimage.c | 8 -------- src/arch/x86/image/multiboot.c | 4 ---- src/core/image.c | 12 +++++++++--- src/image/script.c | 9 --------- src/interface/efi/efi_file.c | 6 +----- 5 files changed, 10 insertions(+), 29 deletions(-) (limited to 'src/arch/x86') diff --git a/src/arch/x86/image/bzimage.c b/src/arch/x86/image/bzimage.c index b40bb2d07..b15bd5563 100644 --- a/src/arch/x86/image/bzimage.c +++ b/src/arch/x86/image/bzimage.c @@ -355,10 +355,6 @@ static size_t bzimage_load_initrd ( struct image *image, size_t offset; size_t pad_len; - /* Do not include kernel image itself as an initrd */ - if ( initrd == image ) - return 0; - /* Create cpio header for non-prebuilt images */ offset = cpio_header ( initrd, &cpio ); @@ -406,10 +402,6 @@ static int bzimage_check_initrds ( struct image *image, /* Calculate total loaded length of initrds */ for_each_image ( initrd ) { - /* Skip kernel */ - if ( initrd == image ) - continue; - /* Calculate length */ len += bzimage_load_initrd ( image, initrd, UNULL ); len = bzimage_align ( len ); diff --git a/src/arch/x86/image/multiboot.c b/src/arch/x86/image/multiboot.c index 0c85df708..c1c63bc97 100644 --- a/src/arch/x86/image/multiboot.c +++ b/src/arch/x86/image/multiboot.c @@ -204,10 +204,6 @@ static int multiboot_add_modules ( struct image *image, physaddr_t start, break; } - /* Do not include kernel image itself as a module */ - if ( module_image == image ) - continue; - /* Page-align the module */ start = ( ( start + 0xfff ) & ~0xfff ); diff --git a/src/core/image.c b/src/core/image.c index 5a9aebc74..b280eb4d3 100644 --- a/src/core/image.c +++ b/src/core/image.c @@ -349,9 +349,8 @@ int image_exec ( struct image *image ) { /* Preserve record of any currently-running image */ saved_current_image = current_image; - /* Take out a temporary reference to the image. This allows - * the image to unregister itself if necessary, without - * automatically freeing itself. + /* Take out a temporary reference to the image, so that it + * does not get freed when temporarily unregistered. */ current_image = image_get ( image ); @@ -371,6 +370,9 @@ int image_exec ( struct image *image ) { /* Record boot attempt */ syslog ( LOG_NOTICE, "Executing \"%s\"\n", image->name ); + /* Temporarily unregister the image during its execution */ + unregister_image ( image ); + /* Try executing the image */ if ( ( rc = image->type->exec ( image ) ) != 0 ) { DBGC ( image, "IMAGE %s could not execute: %s\n", @@ -387,6 +389,10 @@ int image_exec ( struct image *image ) { image->name, strerror ( rc ) ); } + /* Re-register image (unless due to be replaced) */ + if ( ! image->replacement ) + register_image ( image ); + /* Pick up replacement image before we drop the original * image's temporary reference. The replacement image must * already be registered, so we don't need to hold a temporary diff --git a/src/image/script.c b/src/image/script.c index 28050868a..b34df1e21 100644 --- a/src/image/script.c +++ b/src/image/script.c @@ -197,11 +197,6 @@ static int script_exec ( struct image *image ) { size_t saved_offset; int rc; - /* Temporarily de-register image, so that a "boot" command - * doesn't throw us into an execution loop. - */ - unregister_image ( image ); - /* Preserve state of any currently-running script */ saved_offset = script_offset; @@ -212,10 +207,6 @@ static int script_exec ( struct image *image ) { /* Restore saved state */ script_offset = saved_offset; - /* Re-register image (unless we have been replaced) */ - if ( ! image->replacement ) - register_image ( image ); - return rc; } diff --git a/src/interface/efi/efi_file.c b/src/interface/efi/efi_file.c index f2b44fa73..a0bba1606 100644 --- a/src/interface/efi/efi_file.c +++ b/src/interface/efi/efi_file.c @@ -240,10 +240,6 @@ static size_t efi_file_read_initrd ( struct efi_file_reader *reader ) { len = 0; for_each_image ( image ) { - /* Ignore currently executing image */ - if ( image == current_image ) - continue; - /* Pad to alignment boundary */ pad_len = ( ( -reader->pos ) & ( INITRD_ALIGN - 1 ) ); if ( pad_len ) { @@ -1091,7 +1087,7 @@ int efi_file_install ( EFI_HANDLE handle ) { * instance only if the initrd is non-empty, since Linux does * not gracefully handle a zero-length initrd. */ - load = ( list_is_singular ( &images ) ? NULL : &efi_file_initrd.load ); + load = ( have_images() ? &efi_file_initrd.load : NULL ); if ( ( rc = efi_file_path_install ( &efi_file_initrd_path.vendor.Header, load ) ) != 0 ) { goto err_initrd; -- cgit v1.2.3-55-g7522