aboutsummaryrefslogtreecommitdiffstats
path: root/src/config
Commit message (Collapse)AuthorAgeFilesLines
* [pci] Select PCI I/O API at runtime for cloud imagesMichael Brown2022-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pretty much all physical machines and off-the-shelf virtual machines will provide a functional PCI BIOS. We therefore default to using only the PCI BIOS, with no fallback to an alternative mechanism if the PCI BIOS fails. AWS EC2 provides the opportunity to experience some exceptions to this rule. For example, the t3a.nano instances in eu-west-1 have no functional PCI BIOS at all. As of commit 83516ba ("[cloud] Use PCIAPI_DIRECT for cloud images") we therefore use direct Type 1 configuration space accesses in the images built and published for use in the cloud. Recent experience has discovered yet more variation in AWS EC2 instances. For example, some of the metal instance types have multiple PCI host bridges and the direct Type 1 accesses therefore see only a subset of the PCI devices. Attempt to accommodate future such variations by making the PCI I/O API selectable at runtime and choosing ECAM (if available), falling back to the PCI BIOS (if available), then finally falling back to direct Type 1 accesses. This is implemented as a dedicated PCIAPI_CLOUD API, rather than by having the PCI core select a suitable API at runtime (as was done for timers in commit 302f1ee ("[time] Allow timer to be selected at runtime"). The common case will remain that only the PCI BIOS API is required, and we would prefer to retain the optimisations that come from inlining the configuration space accesses in this common case. Cloud images are (at present) disk images rather than ROM images, and so the increased code size required for this design approach in the PCIAPI_CLOUD case is acceptable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Enable IMAGE_GZIP by default for AArch64Michael Brown2022-02-101-0/+4
| | | | | | | | | AArch64 kernels tend to be distributed as gzip compressed images. Enable IMAGE_GZIP by default for AArch64 to avoid the need for uncompressed images to be provided. Originally-implemented-by: Alessandro Di Stefano <aleskandro@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Include Secure Boot Advanced Targeting (SBAT) metadatasbatMichael Brown2022-01-131-0/+18
| | | | | | | | | | | | | | | | | SBAT defines an encoding for security generation numbers stored as a CSV file within a special ".sbat" section in the signed binary. If a Secure Boot exploit is discovered then the generation number will be incremented alongside the corresponding fix. Platforms may then record the minimum generation number required for any given product. This allows for an efficient revocation mechanism that consumes minimal flash storage space (in contrast to the DBX mechanism, which allows for only a single-digit number of revocation events to ever take place across all possible signed binaries). Add SBAT metadata to iPXE EFI binaries to support this mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [doc] Update user-visible ipxe.org URIs to use HTTPSMichael Brown2022-01-131-12/+12
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Retry DHCP aggressively in AWS EC2Michael Brown2021-07-201-1/+16
| | | | | | | | | | | | | The DHCP service in EC2 has been observed to occasionally stop responding for bursts of several seconds. This can easily result in a failed boot, since the current cloud boot script will attempt DHCP only once. Work around this problem by retrying DHCP in a fairly tight cycle within the cloud boot script, and falling back to a reboot after several failed DHCP attempts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Show ifstat output after a failed boot attemptMichael Brown2021-06-232-2/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Support archive image formats independently of "imgextract" commandMichael Brown2021-05-123-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | Support for the zlib and gzip archive image formats is currently included only if the IMAGE_ARCHIVE_CMD is used to enable the "imgextract" command. The ability to transparently execute a single-member archive image without using the "imgextract" command renders this unintuitive: a user wanting to gain the ability to boot a gzip-compressed kernel image would expect to have to enable IMAGE_GZIP rather than IMAGE_ARCHIVE_CMD. Reverse the inclusion logic, so that archive image formats must now be enabled explicitly (via IMAGE_GZIP and/or IMAGE_ZLIB), with the archive image management commands dragged in as needed if any archive image formats are enabled. The archive image management commands may be explicitly disabled via IMAGE_ARCHIVE_CMD if necessary. This matches the behaviour of IBMGMT_CMD and similar options, where the relevant commands are included only when something else already drags in the underlying feature. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [gzip] Add support for gzip archive imagesimgextractMichael Brown2021-05-082-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [zlib] Add support for zlib archive imagesMichael Brown2021-05-082-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add "imgextract" command for extracting archive imagesMichael Brown2021-05-083-0/+36
| | | | | | | | Add the concept of extracting an image from an archive (which could be a single-file archive such as a gzip-compressed file), along with an "imgextract" command to expose this functionality to scripts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Attempt to include CPUID_SETTINGS only for x86 buildsMichael Brown2021-05-021-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Enable "poweroff" command in cloud imagesMichael Brown2021-04-101-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Provide ACPI settings via /sys/firmware/acpi/tablesMichael Brown2021-03-011-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Do not enable serial console on EFI platformsMichael Brown2021-02-171-0/+5
| | | | | | | | | | Most EFI firmware builds (including those found on ARM64 instances in AWS EC2) will already send console output to the serial port. Do not enable direct serial console output in EFI builds using CONFIG=cloud. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Enable IPv6 and HTTPS in cloud boot imagesMichael Brown2021-02-161-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Use PCIAPI_DIRECT for cloud imagesMichael Brown2021-02-135-0/+10
| | | | | | | | | | | | | | | | | | | | | | The version of SeaBIOS found on some AWS EC2 instances (observed with t3a.nano in eu-west-1) has no support for the INT 1A PCI BIOS calls. Bring config/ioapi.h into the named-configuration set of headers, and specify the use of PCIAPI_DIRECT for CONFIG=cloud, to work around the missing PCI BIOS support. Switching to a different named configuration will now unfortunately cause an almost complete rebuild of iPXE. As described in commit c801cb2 ("[build] Allow for named configurations at build time"), this is the reason why config/ioapi.h was not originally in the named-configuration set of header files. This rebuild cost is acceptable given that build times are substantially faster now than seven years ago, and that very few people are likely to be switching named configurations on a regular basis. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgmem" commandMichael Brown2021-01-222-0/+4
| | | | | | | Provide the "imgmem" command to create an image from an existing block of memory, for debugging purposes only. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Allow for links that remained blocked for up to three minutesMichael Brown2021-01-191-1/+1
| | | | | | | | | | | With the default timeouts for Cisco MAC Authentication Bypass, the link will remain blocked for around 90 seconds (plus a likely subsequent delay for STP). Extend the maximum number of DHCP discovery deferrals to allow for up to three minutes of waiting for a link to become unblocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [eap] Treat an EAP Request-Identity as indicating a blocked linkMichael Brown2021-01-192-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A switch port using 802.1x authentication will send EAP Request-Identity packets once the physical link is up, and will not be forwarding packets until the port identity has been established. We do not currently support 802.1x authentication. However, a reasonably common configuration involves using a preset list of permitted MAC addresses, with the "authentication" taking place between the switch and a RADIUS server. In this configuration, the end device does not need to perform any authentication step, but does need to be prepared for the switch port to fail to forward packets for a substantial time after physical link-up. This exactly matches the "blocked link" semantics already used when detecting a non-forwarding switch port via LACP or STP. Treat a received EAP Request-Identity as indicating a blocked link. Unlike LACP or STP, there is no way to determine the expected time until the next EAP packet and so we must choose a fixed timeout. Erroneously assuming that the link is blocked is relatively harmless since we will still attempt to transmit and receive data even over a link that is marked as blocked, and so the net effect is merely to prolong DHCP attempts. In contrast, erroneously assuming that the link is unblocked will potentially cause DHCP to time out and give up, resulting in a failed boot. The default EAP Request-Identity interval in Cisco switches (where this is most likely to be encountered in practice) is 30 seconds, so choose 45 seconds as a timeout that is likely to avoid gaps during which we falsely assume that the link is unblocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dma] Define a DMA API to allow for non-flat device address spacesMichael Brown2020-11-053-0/+3
| | | | | | | | | | | | | | | | | | | iPXE currently assumes that DMA-capable devices can directly address physical memory using host addresses. This assumption fails when using an IOMMU. Define an internal DMA API with two implementations: a "flat" implementation for use in legacy BIOS or other environments in which flat physical addressing is guaranteed to be used and all allocated physical addresses are guaranteed to be within a 32-bit address space, and an "operations-based" implementation for use in UEFI or other environments in which DMA mapping may require bus-specific handling. The purpose of the fully inlined "flat" implementation is to allow the trivial identity DMA mappings to be optimised out at build time, thereby avoiding an increase in code size for legacy BIOS builds. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Enable NET_PROTO_IPV6 by defaultTore Anderson2020-10-142-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | IPv6 PXE was included in the UEFI specification over eight years ago, specifically in version 2.3 (Errata D). http://www.uefi.org/sites/default/files/resources/UEFI_Spec_2_3_D.pdf When iPXE is being chainloaded from a UEFI firmware performing a PXE boot in an IPv6 network, it is essential that iPXE supports IPv6 as well. I understand that the reason for NET_PROTO_IPV6 being disabled by default (in src/config/general.h) is that it would cause certain space-constrained build targets to become too large. However, this should not be an issue for EFI builds. It is also worth noting that RFC 6540 makes a clear recommendation that IPv6 support should not be considered optional. https://tools.ietf.org/html/rfc6540 Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Tore Anderson <tore@fud.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [usbblk] Add support for USB mass storage devicesMichael Brown2020-10-134-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Some UEFI BIOSes (observed with at least the Insyde UEFI BIOS on a Microsoft Surface Go) provide a very broken version of the UsbMassStorageDxe driver that is incapable of binding to the standard EFI_USB_IO_PROTOCOL instances and instead relies on an undocumented proprietary protocol (with GUID c965c76a-d71e-4e66-ab06-c6230d528425) installed by the platform's custom version of UsbCoreDxe. The upshot is that USB mass storage devices become inaccessible once iPXE's native USB host controller drivers are loaded. One possible workaround is to load a known working version of UsbMassStorageDxe (e.g. from the EDK2 tree): this driver will correctly bind to the standard EFI_USB_IO_PROTOCOL instances exposed by iPXE. This workaround is ugly in practice, since it involves embedding UsbMassStorageDxe.efi into the iPXE binary and including an embedded script to perform the required "chain UsbMassStorageDxe.efi". Provide a native USB mass storage driver for iPXE, allowing USB mass storage devices to be exposed as iPXE SAN devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Avoid setting direction flag on EFI platformsMichael Brown2020-07-071-0/+1
| | | | | | | | | | | | | | | | | | | The only remaining use case in iPXE for the CPU direction flag is in __memcpy_reverse() where it is set to allow the use of "rep movsb" to perform the memory copy. This matches the equivalent functionality in the EDK2 codebase, which has functions such as InternalMemCopyMem that also temporarily set the direction flag in order to use "rep movsb". As noted in commit d2fb317 ("[crypto] Avoid temporarily setting direction flag in bigint_is_geq()"), some UEFI implementations are known to have buggy interrupt handlers that may reboot the machine if a timer interrupt happens to occur while the direction flag is set. Work around these buggy UEFI implementations by using the (unoptimised) generic_memcpy_reverse() on i386 or x86_64 UEFI platforms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Disable MD5 as an OID-identifiable algorithm by defaultMichael Brown2020-06-161-1/+1
| | | | | | | | | | | | | | | | Disable the use of MD5 as an OID-identifiable algorithm. Note that the MD5 algorithm implementation will still be present in the build, since it is used implicitly by various cryptographic components such as HTTP digest authentication; this commit removes it only from the list of OID-identifiable algorithms. It would be appropriate to similarly disable the use of SHA-1 by default, but doing so would break the use of OCSP since several OCSP responders (including the current version of openca-ocspd) are not capable of interpreting the hashAlgorithm field and so will fail if the client uses any algorithm other than the configured default. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow algorithms to be included without being OID-identifiableMichael Brown2020-06-162-12/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are many ways in which the object for a cryptographic algorithm may be included, even if not explicitly enabled in config/crypto.h. For example: the MD5 algorithm is required by TLSv1.1 or earlier, by iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM authentication. In the current implementation, inclusion of an algorithm for any reason will result in the algorithm's ASN.1 object identifier being included in the "asn1_algorithms" table, which consequently allows the algorithm to be used for any ASN1-identified purpose. For example: if the MD5 algorithm is included in order to support HTTP digest authentication, then iPXE would accept a (validly signed) TLS certificate using an MD5 digest. Split the ASN.1 object identifiers into separate files that are required only if explicitly enabled in config/crypto.h. This allows an algorithm to be omitted from the "asn1_algorithms" table even if the algorithm implementation is dragged in for some other purpose. The end result is that only the algorithms that are explicitly enabled in config/crypto.h can be used for ASN1-identified purposes such as signature verification. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Default to supporting only TLSv1.1 or aboveMichael Brown2020-06-161-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow a minimum TLS protocol version to be specifiedMichael Brown2020-06-121-0/+3
| | | | | | | | The supported ciphers and digest algorithms may already be specified via config/crypto.h. Extend this to allow a minimum TLS protocol version to be specified. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Add named configuration for Raspberry PiMichael Brown2019-07-198-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Register a device tree if provided by the platform firmwareMichael Brown2019-07-192-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fdt] Add ability to parse a MAC address from a flattened device treeMichael Brown2019-07-192-0/+54
| | | | | | | | | | | | | The Raspberry Pi NIC has no EEPROM to hold the MAC address. The platform firmware (e.g. UEFI or U-Boot) will typically obtain the MAC address from the VideoCore firmware and add it to the device tree, which is then made available to subsequent programs such as iPXE or the Linux kernel. Add the ability to parse a flattened device tree and to extract the MAC address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add support for the ACPI power management timerMichael Brown2018-03-201-0/+3
| | | | | | | | Allow the ACPI power management timer to be used if enabled via TIMER_ACPI in config/timer.h. This provides an alternative timer on systems where the standard 8254 PIT is unavailable or unreliable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Allow OCSP checks to be disabledMichael Brown2018-03-181-0/+8
| | | | | | | | | Some CAs provide non-functional OCSP servers, and some clients are forced to operate on networks without access to the OCSP servers. Allow the user to explicitly disable the use of OCSP checks by undefining OCSP_CHECK in config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add support for NTLM authenticationMichael Brown2017-11-122-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [shell] Enable "shell" command even when BANNER_TIMEOUT is zeroMichael Brown2017-08-012-0/+4
| | | | | | | | | | | Setting BANNER_TIMEOUT to zero removes the only symbol reference to shell.o, causing the "shell" command to become unavailable. Add SHELL_CMD in config/general.h (enabled by default) which will explicitly drag in shell.o regardless of the value of BANNER_TIMEOUT. Reported-by: Julian Brost <julian@0x4a42.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Expose ACPI tables via settings mechanismMichael Brown2017-05-232-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Allow values to be read from ACPI tables using the syntax ${acpi/<signature>.<index>.0.<offset>.<length>} where <signature> is the ACPI table signature as a 32-bit hexadecimal number (e.g. 0x41504093 for the 'APIC' signature on the MADT), <index> is the index into the array of tables matching this signature, <offset> is the byte offset within the table, and <length> is the field length in bytes. Numeric values are returned in reverse byte order, since ACPI numeric values are usually little-endian. For example: ${acpi/0x41504943.0.0.0.0} - entire MADT table in raw hex ${acpi/0x41504943.0.0.0x0a.6:string} - MADT table OEM ID ${acpi/0x41504943.0.0.0x24.4:uint32} - local APIC address Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Provide access to ACPI tablesMichael Brown2017-05-231-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [acpi] Make acpi_find_rsdt() a per-platform methodMichael Brown2017-05-232-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [linux] Use dummy SAN deviceMichael Brown2017-03-281-1/+7
| | | | | | | Allow for easier testing of SAN code by using the dummy SAN device by default. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add missing SANBOOT_PROTO_HTTP to EFI default configurationMichael Brown2017-03-071-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Allow timer to be selected at runtimeMichael Brown2017-01-261-0/+48
| | | | | | | | | | | | | | | | | | | | | | Allow the active timer (providing udelay() and currticks()) to be selected at runtime based on probing during the INIT_EARLY stage of initialisation. TICKS_PER_SEC is now a fixed compile-time constant for all builds, and is independent of the underlying clock tick rate. We choose the value 1024 to allow multiplications and divisions on seconds to be converted to bit shifts. TICKS_PER_MS is defined as 1, allowing multiplications and divisions on milliseconds to be omitted entirely. The 2% inaccuracy in this definition is negligible when using the standard BIOS timer (running at around 18.2Hz). TIMER_RDTSC now checks for a constant TSC before claiming to be a usable timer. (This timer can be tested in KVM via the command-line option "-cpu host,+invtsc".) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Show CPU vendor and model in example cloud boot scriptsMichael Brown2017-01-243-0/+6
| | | | | | | | | Some problems arise only when running on a specific CPU type (e.g. non-functional timer interrupts as observed in Azure AMD instances). Include the CPU vendor and model within the sample cloud boot scripts, to assist in debugging such problems. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Add ability to retrieve Google Compute Engine metadataMichael Brown2017-01-234-0/+15
| | | | | | | | | | | | | | | | | | | | | | | For some unspecified "security" reason, the Google Compute Engine metadata server will refuse any requests that do not include the non-standard HTTP header "Metadata-Flavor: Google". Attempt to autodetect such requests (by comparing the hostname against "metadata.google.internal"), and add the "Metadata-Flavor: Google" header if applicable. Enable this feature in the CONFIG=cloud build, and include a sample embedded script allowing iPXE to boot from a script configured as metadata via e.g. # Create shared boot image make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/gce.ipxe # Configure per-instance boot script gcloud compute instances add-metadata <instance> \ --metadata-from-file ipxeboot=boot.ipxe Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add basic EFI SAN booting capabilityMichael Brown2016-11-161-1/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Disable TIVOLI_VMM_WORKAROUND in the qemu configurationLaszlo Ersek2016-11-081-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents KVM guests from crashing that run iPXE on host CPUs without "unrestricted_guest" support. Once KVM gets the FXSAVE / FXRSTOR emulation feature (*), and the feature becomes widely available to users, we can back out this change from iPXE. (*) Already in progress by Radim: [PATCH 0/2] KVM: x86: emulate fxsave and fxrstor https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1258895.html https://www.spinics.net/lists/kernel/msg2370327.html Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [librm] Conditionalize the workaround for the Tivoli VMM's SSE garblingLaszlo Ersek2016-11-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 71560d1 ("[librm] Preserve FPU, MMX and SSE state across calls to virt_call()") added FXSAVE and FXRSTOR instructions to iPXE. In KVM virtual machines, these instructions execute fine as long as the host CPU supports the "unrestricted_guest" feature (that is, it can virtualize big real mode natively). On older host CPUs however, KVM has to emulate big real mode, and it currently doesn't implement FXSAVE emulation. Upstream QEMU rebuilt iPXE at commit 0418631 ("[thunderx] Fix compilation with older versions of gcc") which is a descendant of commit 71560d1 (see above). This was done in QEMU commit ffdc5a2 ("ipxe: update submodule from 4e03af8ec to 041863191"). The resultant binaries were bundled with the QEMU v2.7.0 release; see QEMU commit c52125a ("ipxe: update prebuilt binaries"). This distributed the iPXE workaround for the Tivoli VMM bug to a number of KVM users with old host CPUs, causing KVM emulation failures (guest crashes) for them while netbooting. Make the FXSAVE and FXRSTOR instructions conditional on a new feature test macro called TIVOLI_VMM_WORKAROUND. Define the macro by default. There is prior art for an assembly file including config/general.h: see arch/x86/prefix/romprefix.S. Also, TIVOLI_VMM_WORKAROUND seems to be a good fit for the "Obscure configuration options" section in config/general.h. Cc: Bandan Das <bsd@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Greg <rollenwiese@yahoo.com> Cc: Michael Brown <mcb30@ipxe.org> Cc: Michael Prokop <launchpad@michael-prokop.at> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Pickford <arch@netremedies.ca> Cc: Radim Krčmář <rkrcmar@redhat.com> Ref: https://bugs.archlinux.org/task/50778 Ref: https://bugs.launchpad.net/qemu/+bug/1623276 Ref: https://bugzilla.proxmox.com/show_bug.cgi?id=1182 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1356762 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add certificate management commandsMichael Brown2016-08-312-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pixbuf] Enable PNG format by defaultMichael Brown2016-07-293-7/+40
| | | | | | | Enable IMAGE_PNG (but not IMAGE_PNM) by default, and drag in the relevant objects only when image_pixbuf() is present in the binary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Enable both DER and PEM formats by defaultMichael Brown2016-07-293-8/+41
| | | | | | | | | | Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add PEM image formatMichael Brown2016-07-292-0/+4
| | | | | | | | | | | Add PEM-encoded ASN.1 as an image format. We accept as PEM any image containing a line starting with a "-----BEGIN" boundary marker. We allow for PEM files containing multiple ASN.1 objects, such as a certificate chain produced by concatenating individual certificate files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add DER image formatMichael Brown2016-07-292-0/+4
| | | | | | | | Add DER-encoded ASN.1 as an image format. There is no fixed signature for DER files. We treat an image as DER if it comprises a single valid SEQUENCE object covering the entire length of the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit (git 2.34.1) at 2025-02-24 00:38:21 +0000