aboutsummaryrefslogtreecommitdiffstats
path: root/src/usr
Commit message (Collapse)AuthorAgeFilesLines
* [efi] Support versions of shim that perform SBAT verificationMichael Brown2023-05-231-1/+4
| | | | | | | | | | | | | | | The UEFI shim implements a fairly nicely designed revocation mechanism designed around the concept of security generations. Unfortunately nobody in the shim community has thus far added the relevant metadata to the Linux kernel, with the result that current versions of shim are incapable of booting current versions of the Linux kernel. Experience shows that there is unfortunately no point in trying to get a fix for this upstreamed into shim. We therefore default to working around this undesirable behaviour by patching data read from the "SbatLevel" variable used to hold SBAT configuration. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add support for executing images via a shimMichael Brown2023-05-221-0/+58
| | | | | | | | | | | | | | | | | | | | | | | Add support for using a shim as a helper to execute an EFI image. When a shim has been specified via shim(), the shim image will be passed to LoadImage() instead of the selected EFI image and the command line will be prepended with the name of the selected EFI image. The selected EFI image will be accessible to the shim via the virtual filesystem as a hidden file. Reduce the Secure Boot attack surface by removing, where possible, the spurious requirement for a third party second stage loader binary such as GRUB to be used solely in order to call the "shim lock protocol" entry point. Do not install the EFI PXE APIs when using a shim, since if shim finds EFI_PXE_BASE_CODE_PROTOCOL on the loaded image's device handle then it will attempt to download files afresh instead of using the files already downloaded by iPXE and exposed via the EFI_SIMPLE_FILE_SYSTEM protocol. (Experience shows that there is no point in trying to get a fix for this upstreamed into shim.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Generalise concept of selected imageMichael Brown2023-05-171-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most image flags are independent values: any combination of flags may be set for any image, and the flags for one image are independent of the flags for any other image. The "selected" flag does not follow this pattern: at most one image may be marked as selected at any time. When invoking a kernel via the UEFI shim, there will be multiple "special" images: the selected kernel itself, the shim image, and potentially a shim-signed GRUB binary to be used as a crutch to assist shim in loading the kernel (since current versions of the UEFI shim are not capable of directly loading a Linux kernel). Remove the "selected" image flag and replace it with a general concept of an image tag with the same semantics: a given tag may be assigned to at most one image, an image may be found by its tag only while the image is currently registered, and a tag will survive unregistration and reregistration of an image (if it has not already been assigned to a new image). For visual consistency, also replace the current image pointer with a current image tag. The image pointer stored within the image tag holds only a weak reference to the image, since the selection of an image should not prevent that image from being freed. (The strong reference to the currently executing image is held locally within the execution scope of image_exec(), and is logically separate from the current image pointer.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Allow for images to be hidden from lists of all imagesMichael Brown2023-05-051-0/+2
| | | | | | | | | | | | | | | When invoking a kernel via the UEFI shim, the kernel (and potentially also a helper binary such as GRUB) must be accessible via the virtual filesystem exposed via EFI_SIMPLE_FILE_SYSTEM_PROTOCOL but must not be present in the magic initrd constructed from all registered images. Allow for images to be flagged as hidden, which will cause them to be excluded from API-level lists of all images such as the virtual filesystem directory contents, the magic initrd, or the Multiboot module list. Hidden images remain visible to iPXE commands including "imgstat", which will show a "[HIDDEN]" flag for such images. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pxe] Avoid drawing menu items on bottom row of screenpxemenuscrollMichael Brown2023-01-231-1/+1
| | | | | | | | | | | | | | | Many consoles will scroll immediately upon drawing a character in the rightmost column of the bottom row of the display, in order to be able to advance the cursor to the next character (even if the cursor is disabled). This causes PXE menus to display incorrectly. Specifically, pressing the down arrow key while already on the last menu item may cause the whole screen to scroll and the line to be duplicated. Fix by moving the PXE menu one row up from the bottom of the screen. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Include VLAN tag in filter for identifying autoboot deviceMichael Brown2023-01-151-3/+13
| | | | | | | | | | | | | When chainloading iPXE from a VLAN device, the MAC address of the loaded image's device handle will match the MAC address of the trunk device created by iPXE, and the autoboot process will then erroneously consider the trunk device to be an autoboot device. Fix by recording the VLAN tag along with the MAC address, and treating the VLAN tag as part of the filter used to match the MAC address against candidate network devices. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [doc] Update user-visible ipxe.org URIs to use HTTPSMichael Brown2022-01-131-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Retain original encodings for path, query, and fragment fieldsMichael Brown2021-11-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iPXE decodes any percent-encoded characters during the URI parsing stage, thereby allowing protocol implementations to consume the raw field values directly without further decoding. When reconstructing a URI string for use in an HTTP request line, the percent-encoding is currently reapplied in a reversible way: we guarantee that our reconstructed URI string could be decoded to give the same raw field values. This technically violates RFC3986, which states that "URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent". Experiments show that several HTTP server applications will attach meaning to the choice of whether or not a particular character was percent-encoded, even when the percent-encoding is unnecessary from the perspective of parsing the URI into its component fields. Fix by storing the originally encoded substrings for the path, query, and fragment fields and using these original encoded versions when reconstructing a URI string. The path field is also stored as a decoded string, for use by protocols such as TFTP that communicate using raw strings rather than URI-encoded strings. All other fields (such as the username and password) continue to be stored only in their decoded versions since nothing ever needs to know the originally encoded versions of these fields. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add "imgextract" command for extracting archive imagesMichael Brown2021-05-081-0/+54
| | | | | | | | Add the concept of extracting an image from an archive (which could be a single-file archive such as a gzip-compressed file), along with an "imgextract" command to expose this functionality to scripts. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Avoid closing and immediately reopening network deviceMichael Brown2021-02-011-6/+7
| | | | | | | | | Some network devices can take a substantial time to close and reopen. Avoid closing the device from which we are about to attempt booting, in case it happens to be already open. Suggested-by: Christian Iversen <ci@iversenit.dk> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ifmgmt] Make "ifstat" show the link-layer protocol for each netdevChristian Iversen2021-01-261-1/+2
| | | | | | | | | | | | | | | This is useful on devices that perform auto-detection for ports. Example output: iPXE> ifstat net0: 00:11:22:33:44:55 using mt4099 on 0000:00:03.0 (Ethernet) [open] [Link:down, TX:0 TXE:0 RX:0 RXE:0] [Link status: Unknown (http://ipxe.org/1a086101)] net1: 00:11:22:33:44:56 using mt4099 on 0000:00:03.0 (IPoIB) [open] [Link:down, TX:0 TXE:0 RX:0 RXE:0] [Link status: Initialising (http://ipxe.org/1a136101)] Signed-off-by: Christian Iversen <ci@iversenit.dk>
* [cmdline] Expose "iflinkwait" as a commandMichael Brown2021-01-262-6/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Provide image_memory()Michael Brown2021-01-251-32/+9
| | | | | | | Consolidate the remaining logic common to initrd_init() and imgmem() into a shared image_memory() function. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgmem" commandMichael Brown2021-01-221-0/+44
| | | | | | | Provide the "imgmem" command to create an image from an existing block of memory, for debugging purposes only. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Record root of trust used when validating a certificateMichael Brown2020-12-082-2/+3
| | | | | | | | | | | | | Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "--timeout" parameter to "ifconf" commandJoe Groocock2020-07-222-3/+5
| | | | | Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Omit URI query string and fragment from download progress messagesMichael Brown2017-12-281-6/+7
| | | | | | | | | | | | | | The URIs printed as part of download progress messages are intended to provide a quick visual progress indication to the user. Very long query strings can render this visual indication useless in practice, since the most important information (generally the URI host and path) is drowned out by multiple lines of human-illegible URI-encoded data. Omit the query string entirely from the download progress message. For consistency and brevity, also omit the URI fragment along with the username and password (which was previously redacted anyway). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Allow use of a non-default EFI SAN boot filenameMichael Brown2017-04-122-7/+45
| | | | | | | | | | | | | | | | | | | | | | | Some older operating systems (e.g. RHEL6) use a non-default filename on the root disk and rely on setting an EFI variable to point to the bootloader. This does not work when performing a SAN boot on a machine where the EFI variable is not present. Fix by allowing a non-default filename to be specified via the "sanboot --filename" option or the "san-filename" setting. For example: sanboot --filename \efi\redhat\grub.efi \ iscsi:192.168.0.1::::iqn.2010-04.org.ipxe.demo:rhel6 or option ipxe.san-filename code 188 = string; option ipxe.san-filename "\\efi\\redhat\\grub.efi"; option root-path "iscsi:192.168.0.1::::iqn.2010-04.org.ipxe.demo:rhel6"; Originally-implemented-by: Vishvananda Ishaya Abrams <vish.ishaya@oracle.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Describe all SAN devices via ACPI tablesMichael Brown2017-03-281-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Describe all SAN devices via ACPI tables such as the iBFT. For tables that can describe only a single device (i.e. the aBFT and sBFT), one table is installed per device. For multi-device tables (i.e. the iBFT), all devices are described in a single table. An underlying SAN device connection may be closed at the time that we need to construct an ACPI table. We therefore introduce the concept of an "ACPI descriptor" which enables the SAN boot code to maintain an opaque pointer to the underlying object, and an "ACPI model" which can build tables from a list of such descriptors. This separates the lifecycles of ACPI descriptions from the lifecycles of the block device interfaces, and allows for construction of the ACPI tables even if the block device interface has been closed. For a multipath SAN device, iPXE will wait until sufficient information is available to describe all devices but will not wait for all paths to connect successfully. For example: with a multipath iSCSI boot iPXE will wait until at least one path has become available and name resolution has completed on all other paths. We do this since the iBFT has to include IP addresses rather than DNS names. We will commence booting without waiting for the inactive paths to either become available or close; this avoids unnecessary boot delays. Note that the Linux kernel will refuse to accept an iBFT with more than two NIC or target structures. We therefore describe only the NICs that are actually required in order to reach the described targets. Any iBFT with at most two targets is therefore guaranteed to describe at most two NICs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Add basic multipath supportMichael Brown2017-03-262-7/+9
| | | | | | | | | | | Add basic support for multipath block devices. The "sanboot" and "sanhook" commands now accept a list of SAN URIs. We open all URIs concurrently. The first connection to become available for issuing block device commands is marked as the active path and used for all subsequent commands; all other connections are then closed. Whenever the active path fails, we reopen all URIs and repeat the process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add certstat() to display basic certificate informationMichael Brown2016-08-311-0/+63
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Use image_asn1() to extract data from CMS signature imagesMichael Brown2016-07-291-12/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "ntp" commandMichael Brown2016-06-131-0/+57
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lotest] Add option to use broadcast packets for loopback testingMichael Brown2016-05-231-4/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [int13] Allow drive to be hooked using the natural drive numberMichael Brown2016-03-221-4/+6
| | | | | | | Interpret the maximum drive number (0xff for hard disks, 0x7f for floppy disks) as meaning "use natural drive number". Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ifmgmt] Include human-readable error message for configuration failureMichael Brown2016-03-081-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Add "ibstat" commandMichael Brown2016-03-081-0/+62
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Fix incorrect boolean logicMichael Brown2016-01-191-2/+2
| | | | | | | | | | Commit 53d2d9e ("[uri] Generalise tftp_uri() to pxe_uri()") introduced a regression in which an NFS root path would no longer be treated as an unsupported root path, causing a boot with an NFS root path to fail with a "Could not open SAN device" error. Reported-by: David Evans <dave.evans55@googlemail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Generalise tftp_uri() to pxe_uri()Michael Brown2015-09-021-57/+32
| | | | | | | | | | | | | | | | | | Merge the functionality of parse_next_server_and_filename() and tftp_uri() into a single pxe_uri(), which takes a server address (IPv4/IPv6/none) and a filename, and produces a URI using the rule: - if the filename is a hierarchical absolute URI (i.e. includes a scheme such as "http://" or "tftp://") then use that URI and ignore the server address, - otherwise, if the server address is recognised (according to sa_family) then construct a TFTP URI based on the server address, port, and filename - otherwise fail. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Display image information as part of the default control flowMichael Brown2015-08-211-0/+1
| | | | | | | | | | When booting without an embedded script, display the imgstat() information immediately before executing the downloaded image. This allows potentially useful diagnostic information (such as the detected image type) to be observed by the user without needing to enter the iPXE shell and manually download the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Allow self-tests to report exit status when running under LinuxMichael Brown2015-08-211-7/+11
| | | | | | | | | Allow the return status from an embedded image to propagate out to the eventual return status from main(). When running under Linux, this allows the pass/fail result of unit tests to be observable without having to visually inspect the console output. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Add a generic concept of a "blocked link"Michael Brown2015-06-251-1/+2
| | | | | | | | | | | | When Spanning Tree Protocol (STP) is used, there may be a substantial delay (tens of seconds) from the time that the link goes up to the time that the port starts forwarding packets. Add a generic concept of a "blocked link" (i.e. a link which is up but which is not expected to communicate successfully), and allow "ifstat" to indicate when a link is blocked. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Match against parent devices when matching by bus type and locationMichael Brown2015-03-171-2/+7
| | | | | | | | | | | | | | | | | When using iPXE as an option ROM for a PCI USB controller (e.g. via qemu's "-device nec-usb-xhci,romfile=..." syntax), the ROM prefix will set the PCI bus:dev.fn address of the USB controller as the PCI autoboot device. This will cause iPXE to fail to boot from any detected USB network devices, since they will not match the autoboot bus type (or location). Fix by allowing the autoboot bus type and location to match against the network device or any of its parent devices. This allows the match to succeed for USB network devices attached to the selected PCI USB controller. Reported-by: Dan Ellis <Dan.Ellis@displaylink.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix the REQUIRE_SYMBOL mechanismMichael Brown2015-03-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | At some point in the past few years, binutils became more aggressive at removing unused symbols. To function as a symbol requirement, a relocation record must now be in a section marked with @progbits and must not be in a section which gets discarded during the link (either via --gc-sections or via /DISCARD/). Update REQUIRE_SYMBOL() to generate relocation records meeting these criteria. To minimise the impact upon the final binary size, we use existing symbols (specified via the REQUIRING_SYMBOL() macro) as the relocation targets where possible. We use R_386_NONE or R_X86_64_NONE relocation types to prevent any actual unwanted relocation taking place. Where no suitable symbol exists for REQUIRING_SYMBOL() (such as in config.c), the macro PROVIDE_REQUIRING_SYMBOL() can be used to generate a one-byte-long symbol to act as the relocation target. If there are versions of binutils for which this approach fails, then the fallback will probably involve killing off REQUEST_SYMBOL(), redefining REQUIRE_SYMBOL() to use the current definition of REQUEST_SYMBOL(), and postprocessing the linked ELF file with something along the lines of "nm -u | wc -l" to check that there are no undefined symbols remaining. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Use REQUIRE_OBJECT() to drag in per-object configurationMichael Brown2015-03-051-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-022-2/+10
| | | | | | | | | | These files cannot be automatically relicensed by util/relicense.pl since they either contain unusual but trivial contributions (such as the addition of __nonnull function attributes), or contain lines dating back to the initial git revision (and so require manual knowledge of the code's origin). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-0215-15/+75
| | | | | | | Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow product tag line to be customised via config/branding.hMichael Brown2015-02-111-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow product URI to be customised via config/branding.hMichael Brown2015-02-111-2/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Use PRODUCT_SHORT_NAME for end-user visible stringsMichael Brown2015-02-111-3/+5
| | | | | | | | | | | Use PRODUCT_SHORT_NAME instead of a hardcoded "iPXE" for strings which are typically shown in the user interface. Note that this only allows for customisation of the user interface. Where the "iPXE" string serves a technical purpose (such as in the HTTP User-Agent), the string cannot be customised. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Move branding information to config/branding.hMichael Brown2015-02-111-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Allow tftp_uri() to construct a URI with a custom portMichael Brown2015-02-061-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Allow "ping" command output to be inhibitedMichael Brown2014-10-231-4/+6
| | | | | Originally-implemented-by: Cedric Levasseur <cyr-ius@ipocus.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Allow termination after a specified number of packetsMichael Brown2014-10-231-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Add the "-c <count>" option to the "ping" command, allowing for automatic termination after a specified number of packets. When a number of packets is specified: - if a serious error (i.e. length mismatch or content mismatch) occurs, then the ping will be immediately terminated with the relevant status code; - if at least one response is received successfully, and all errors are non-serious (i.e. timeouts or out-of-sequence responses), then the ping will be terminated after the final response (or timeout) with a success status; - if no responses are received successfully, then the ping will be terminated after the final timeout with ETIMEDOUT. If no number of packets is specified, then the ping will continue until manually interrupted. Originally-implemented-by: Cedric Levasseur <cyr-ius@ipocus.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ping] Report timed-out pings via the callback functionMichael Brown2014-10-231-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lotest] Discard packets arriving on the incorrect network deviceMichael Brown2014-07-291-6/+6
| | | | | | | | | | | | | Commit 24bbaf6 ("[lotest] Allow loopback testing on shared networks") introduced a regression in which loopback testing packets would be accepted from any network device. This produces unexpected results, such as VLAN loopback testing succeeding even when incorrectly using the underlying trunk device as either transmitter or receiver. Fix by discarding any loopback testing packets which arrive on a network device other than the current loopback testing receiver. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [autoboot] Allow autoboot device to be identified by link-layer addressMichael Brown2014-07-081-9/+59
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Expose build timestamp, build name, and product namesMichael Brown2014-06-241-2/+2
| | | | | | | | Expose the build timestamp (measured in seconds since the Epoch) and the build name (e.g. "rtl8139.rom" or "ipxe.efi"), and provide the product name and product short name in a single centralised location. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ifmgmt] Do not sleep CPU while configuring network devicesMichael Brown2014-06-011-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | iPXE currently calls cpu_nap() while performing DHCP, in order to reduce CPU utilisation on virtual machines. Under mild broadcast load (~100 packets per second), this can cause received packets to be dropped because the receive descriptor ring is overrun before the next 18Hz timer interrupt wakes up the CPU. The result is that DHCP is likely to intermittently fail on networks with appreciable amounts of broadcast (or multicast) traffic. This behaviour was introduced in the series of commits which generalised the "dhcp" command to the "ifconf" command. The earlier code (which did not handle IPv6 configuration) had no call to cpu_nap() and so did not suffer from this problem. Fix by removing the call to cpu_nap() in ifpoller_progress(). This has the undesirable side effect that CPU utilisation will remain at 100% while waiting for DHCP to complete (which can take several seconds, if we have to wait around for potential ProxyDHCP offers to arrive). Reported-by: Alex Davies <adavies@jumptrading.com> Reported-by: Christoffer Stokbæk <christoffers@easyspeedy.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cmdline] Add "profstat" command to display profiling statisticsMichael Brown2014-04-271-0/+44
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit (git 2.34.1) at 2025-02-23 23:05:20 +0000