]> git.ipfire.org Git - thirdparty/ipxe.git/log
thirdparty/ipxe.git
11 years ago[efi] Include EFI_CONSOLE_CONTROL_PROTOCOL header
Michael Brown [Wed, 16 Jul 2014 13:15:40 +0000 (14:15 +0100)] 
[efi] Include EFI_CONSOLE_CONTROL_PROTOCOL header

The EFI_CONSOLE_CONTROL_PROTOCOL does not exist in the current UEFI
specification, but is required to enable text output on some older EFI
1.10 implementations (observed on an old iMac).

The header is not present in any of the standard include directories,
but can still be found in the EDK2 codebase as part of
EdkCompatibilityPkg.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Print well-known GUIDs by name in debug messages
Michael Brown [Wed, 16 Jul 2014 01:16:24 +0000 (02:16 +0100)] 
[efi] Print well-known GUIDs by name in debug messages

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Allow for interception of boot services calls by loaded image
Michael Brown [Wed, 16 Jul 2014 00:25:37 +0000 (01:25 +0100)] 
[efi] Allow for interception of boot services calls by loaded image

When building with DEBUG=efi_wrap, print details of calls made by the
loaded image to selected boot services functions.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Install our own disk I/O protocol and claim exclusive use of it
Michael Brown [Mon, 14 Jul 2014 15:15:05 +0000 (16:15 +0100)] 
[efi] Install our own disk I/O protocol and claim exclusive use of it

The EFI FAT filesystem driver has a bug: if a block device contains no
FAT filesystem but does have an EFI_SIMPLE_FILE_SYSTEM_PROTOCOL
instance, the FAT driver will assume that it must have previously
installed the EFI_SIMPLE_FILE_SYSTEM_PROTOCOL.  This causes the FAT
driver to claim control of our device, and to refuse to stop driving
it, which prevents us from later uninstalling correctly.

Work around this bug by opening the disk I/O protocol ourselves,
thereby preventing the FAT driver from opening it.

Note that the alternative approach of opening the block I/O protocol
(and thereby in theory preventing DiskIo from attaching to the block
I/O protocol) causes an endless loop of calls to our DRIVER_STOP
method when starting the EFI shell.  I have no idea why this is.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Update EDK2 headers
Michael Brown [Mon, 14 Jul 2014 15:13:55 +0000 (16:13 +0100)] 
[efi] Update EDK2 headers

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[netdevice] Reset network device index when last device is unregistered
Michael Brown [Mon, 14 Jul 2014 11:14:18 +0000 (12:14 +0100)] 
[netdevice] Reset network device index when last device is unregistered

When functioning as an EFI driver, drivers can be disconnected and
reconnected multiple times (e.g. via the EFI shell "connect" command,
or by running an executable such as ipxe.efi which will temporarily
disconnect existing drivers).

Minimise surprise by resetting the network device index to zero
whenever the last device is unregistered.  This is not foolproof, but
it does handle the common case of having all devices unregistered and
then reregistered in the original order.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[crypto] Fix debug message
Michael Brown [Sat, 12 Jul 2014 13:24:40 +0000 (14:24 +0100)] 
[crypto] Fix debug message

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[crypto] Add support for iPAddress subject alternative names
Michael Brown [Fri, 11 Jul 2014 15:55:14 +0000 (16:55 +0100)] 
[crypto] Add support for iPAddress subject alternative names

Originally-implemented-by: Jarrod Johnson <jarrod.b.johnson@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Include SNP NIC driver within the all-drivers target
Michael Brown [Tue, 8 Jul 2014 15:28:22 +0000 (16:28 +0100)] 
[efi] Include SNP NIC driver within the all-drivers target

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Rewrite SNP NIC driver
Michael Brown [Fri, 4 Jul 2014 15:52:10 +0000 (16:52 +0100)] 
[efi] Rewrite SNP NIC driver

Rewrite the SNP NIC driver to use non-blocking and deferrable
transmissions, to provide link status detection, to provide
information about the underlying (PCI) hardware device, and to avoid
unnecessary I/O buffer allocations during receive polling.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Attempt to start only drivers claiming support for a device
Michael Brown [Tue, 8 Jul 2014 00:02:35 +0000 (01:02 +0100)] 
[efi] Attempt to start only drivers claiming support for a device

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Identify autoboot device by MAC address when chainloading
Michael Brown [Mon, 7 Jul 2014 23:35:49 +0000 (00:35 +0100)] 
[efi] Identify autoboot device by MAC address when chainloading

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[autoboot] Allow autoboot device to be identified by link-layer address
Michael Brown [Mon, 7 Jul 2014 22:55:55 +0000 (23:55 +0100)] 
[autoboot] Allow autoboot device to be identified by link-layer address

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Allow network devices to be created on top of arbitrary SNP devices
Michael Brown [Tue, 1 Jul 2014 16:58:09 +0000 (17:58 +0100)] 
[efi] Allow network devices to be created on top of arbitrary SNP devices

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Add yet another potential location for isolinux.bin
Michael Brown [Thu, 26 Jun 2014 16:05:36 +0000 (17:05 +0100)] 
[build] Add yet another potential location for isolinux.bin

Reported-by: Martin Sofaru <ipxe@fhloston.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Fix erroneous object name in version object
Michael Brown [Thu, 26 Jun 2014 15:25:18 +0000 (16:25 +0100)] 
[build] Fix erroneous object name in version object

Commit 8290a95 ("[build] Expose build timestamp, build name, and
product names") introduced a regression in the build process which
resulted in broken final binaries which had names based on object
files (e.g. "undionly.kpxe" or "intel.rom") rather than on device IDs
(e.g. "8086100e.mrom").

The underlying problem is the -DOBJECT=<name> macro which is used to
generate the obj_<name> symbols used to select objects required for
the final binary.  The macro definition is derived from the initial
portion (up to the first dot) of the object being built.  In the case
of e.g. undionly.kpxe.version.o, this gives -DOBJECT=undionly.  This
results in undionly.kpxe.version.o claiming to be the "undionly"
object; the real "undionly" object will therefore never get dragged in
to the build.

Fix by renaming $(BIN)/%.version.o to $(BIN)/version.%.o, so that the
object is always built with -DOBJECT=version (as might be expected,
since it is built from core/version.c).

Final binaries which have names based on device IDs (such as
"8086100e.mrom") are not affected by this problem, since the object
name "8086100e" will not conflict with that of the underlying "intel"
object.

This problem was not detected by the per-commit smoke testing
procedure, which happens to use the binary bin/8086100e.mrom.

Reported-by: Christian Hesse <list@eworm.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Restructure EFI driver model
Michael Brown [Wed, 25 Jun 2014 13:47:35 +0000 (14:47 +0100)] 
[efi] Restructure EFI driver model

Provide a single instance of EFI_DRIVER_BINDING_PROTOCOL (attached to
our image handle); this matches the expectations scattered throughout
the EFI specification.

Open the underlying hardware device using EFI_OPEN_PROTOCOL_BY_DRIVER
and EFI_OPEN_PROTOCOL_EXCLUSIVE, to prevent other drivers from
attaching to the same device.

Do not automatically connect to devices when being loaded as a driver;
leave this task to the platform firmware (or to the user, if loading
directly from the EFI shell).

When running as an application, forcibly disconnect any existing
drivers from devices that we want to control, and reconnect them on
exit.

Provide a meaningful driver version number (based on the build
timestamp), to allow platform firmware to automatically load newer
versions of iPXE drivers if multiple drivers are present.

Include device paths within debug messages where possible, to aid in
debugging.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Provide a meaningful EFI SNP device name
Michael Brown [Wed, 25 Jun 2014 13:45:08 +0000 (14:45 +0100)] 
[efi] Provide a meaningful EFI SNP device name

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Allow device paths to be easily included in debug messages
Michael Brown [Wed, 25 Jun 2014 13:44:13 +0000 (14:44 +0100)] 
[efi] Allow device paths to be easily included in debug messages

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Expose build timestamp, build name, and product names
Michael Brown [Wed, 18 Jun 2014 23:35:04 +0000 (00:35 +0100)] 
[build] Expose build timestamp, build name, and product names

Expose the build timestamp (measured in seconds since the Epoch) and
the build name (e.g. "rtl8139.rom" or "ipxe.efi"), and provide the
product name and product short name in a single centralised location.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[debug] Allow debug message colours to be customised via DBGCOL=...
Michael Brown [Mon, 16 Jun 2014 15:28:20 +0000 (16:28 +0100)] 
[debug] Allow debug message colours to be customised via DBGCOL=...

When multiple iPXE binaries are running concurrently (e.g. in the case
of undionly.kpxe using an underlying iPXE driver via the UNDI
interface) it would be helpful to be able to visually distinguish
debug messages from each binary.

Allow the range of debug colours used to be customised via the
DBGCOL=...  build parameter.  For example:

  # Restrict to colours 31-33 (red, green, yellow)
  make DBGCOL=31-33

  # Restrict to colours 34-36 (blue, magenta, cyan)
  make DBGCOL=34-36

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Check if git index actually exists
Peter Lemenkov [Mon, 16 Jun 2014 12:35:23 +0000 (13:35 +0100)] 
[build] Check if git index actually exists

If iPXE is used as a git submodule then the ../.git/index file will
not exist, and the build will fail.  Fix by checking that the git
index file exists before adding it as a build dependency.

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[smbios] Expose board serial number as ${board-serial}
Dale Hamel [Mon, 10 Mar 2014 22:48:37 +0000 (18:48 -0400)] 
[smbios] Expose board serial number as ${board-serial}

With blade servers, the chassis serial number (exposed via ${serial})
may not be unique.  Expose ${board-serial} as a named setting to
provide easy access to a more meaningful serial number.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[igbvf] Allow changing of MAC address
Hannes Reinecke [Tue, 3 Jun 2014 12:01:17 +0000 (14:01 +0200)] 
[igbvf] Allow changing of MAC address

The VF might not have assigned a MAC address upon startup, and will
end up with a random MAC address during probe().  With this patch the
MAC address can be changed later on.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[igbvf] Assign random MAC address if none is set
Hannes Reinecke [Tue, 3 Jun 2014 12:01:16 +0000 (14:01 +0200)] 
[igbvf] Assign random MAC address if none is set

If the VF doesn't have a MAC address assigned we should create a
random MAC address.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Modified-by: Michael Brown <mcb30@ipxe.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[iscsi] Include IP address origin in iBFT
Michael Brown [Thu, 12 Jun 2014 15:05:48 +0000 (16:05 +0100)] 
[iscsi] Include IP address origin in iBFT

The iBFT includes an "origin" field to indicate the source of the IP
address.  We use the heuristic of assuming that the source should be
"manual" if the IP address originates directly from the network device
settings block, and "DHCP" otherwise.  This is an imperfect guess, but
is likely to be correct in most common situations.

Originally-implemented-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[iscsi] Read IPv4 settings only from the relevant network device
Michael Brown [Thu, 12 Jun 2014 15:08:28 +0000 (16:08 +0100)] 
[iscsi] Read IPv4 settings only from the relevant network device

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[scsi] Improve sense code parsing
Michael Brown [Mon, 2 Jun 2014 01:17:28 +0000 (02:17 +0100)] 
[scsi] Improve sense code parsing

Parse the sense data to extract the reponse code, the sense key, the
additional sense code, and the additional sense code qualifier.

Originally-implemented-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ethernet] Provide eth_random_addr() to generate random Ethernet addresses
Hannes Reinecke [Sun, 1 Jun 2014 22:26:20 +0000 (23:26 +0100)] 
[ethernet] Provide eth_random_addr() to generate random Ethernet addresses

Modified-by: Michael Brown <mcb30@ipxe.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ifmgmt] Do not sleep CPU while configuring network devices
Michael Brown [Sun, 1 Jun 2014 18:24:16 +0000 (19:24 +0100)] 
[ifmgmt] Do not sleep CPU while configuring network devices

iPXE currently calls cpu_nap() while performing DHCP, in order to
reduce CPU utilisation on virtual machines.  Under mild broadcast load
(~100 packets per second), this can cause received packets to be
dropped because the receive descriptor ring is overrun before the next
18Hz timer interrupt wakes up the CPU.  The result is that DHCP is
likely to intermittently fail on networks with appreciable amounts of
broadcast (or multicast) traffic.

This behaviour was introduced in the series of commits which
generalised the "dhcp" command to the "ifconf" command.  The earlier
code (which did not handle IPv6 configuration) had no call to
cpu_nap() and so did not suffer from this problem.

Fix by removing the call to cpu_nap() in ifpoller_progress().  This
has the undesirable side effect that CPU utilisation will remain at
100% while waiting for DHCP to complete (which can take several
seconds, if we have to wait around for potential ProxyDHCP offers to
arrive).

Reported-by: Alex Davies <adavies@jumptrading.com>
Reported-by: Christoffer Stokbæk <christoffers@easyspeedy.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Allow for the PIC interrupt vector offset to be changed
Michael Brown [Tue, 27 May 2014 13:23:49 +0000 (14:23 +0100)] 
[librm] Allow for the PIC interrupt vector offset to be changed

Some external code (observed with FreeBSD's bootloader) will continue
to make INT 13 calls after reconfiguring the 8259 PIC to change the
vector offsets for IRQs.  If an IRQ (e.g. the timer IRQ) subsequently
occurs while iPXE is in protected mode, this will cause a general
protection fault since the corresponding IDT entry is empty.

A general protection fault is INT 0x0d, which happens to overlap with
the original IRQ5.  We therefore do have an ISR set up to handle a
general protection fault, but this ISR simply reflects the interrupt
down to the real-mode INT 0x0d and then attempts to return.  Since our
ISR is expecting a hardware interrupt rather than a general protection
fault, it doesn't remove the error code from the stack before issuing
the iret instruction; it therefore attempts to return to a garbage
address.  Since the segment part of this address is likely to be
invalid, a second general protection fault occurs.  This cycle
continues until we run out of stack space and triple fault.

Fix by reflecting all INTs down to real mode.  This actually reduces
the code size by four bytes (but increases the bss size by almost
2kB).

Reported-by: Brian Rak <dn@devicenull.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()
Michael Brown [Fri, 23 May 2014 12:47:19 +0000 (13:47 +0100)] 
[ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()

If ipv6_tx() is called with a non-NULL network device, a NULL or
unspecified source address, and a destination address which does not
match any routing table entry, then it will attempt to copy the source
address from a NULL pointer.

I don't think that there is currently any code path which could
trigger this behaviour, but we should probably ensure that it can
never happen.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ipv6] Include network device when transcribing multicast addresses
Michael Brown [Fri, 23 May 2014 12:36:35 +0000 (13:36 +0100)] 
[ipv6] Include network device when transcribing multicast addresses

Destination multicast addresses require a sin6_scope_id, which should
therefore be transcribed to a network device name by ipv6_sock_ntoa().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ipv6] Do not set sin6_scope_id on source address
Michael Brown [Fri, 23 May 2014 12:34:33 +0000 (13:34 +0100)] 
[ipv6] Do not set sin6_scope_id on source address

The transmitting network device is specified via the destination
address, not the source address.  There is no reason to set
sin6_scope_id on the source address.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[dhcpv6] Do not set sin6_scope_id on the unspecified client socket address
Michael Brown [Fri, 23 May 2014 12:29:40 +0000 (13:29 +0100)] 
[dhcpv6] Do not set sin6_scope_id on the unspecified client socket address

Setting sin6_scope_id to a non-zero value will cause the check against
the "empty socket address" in udp_demux() to fail, and incoming DHCPv6
responses on interfaces other than net0 will be rejected with a
spurious "No UDP connection listening on port 546" error.

The transmitting network device is specified via the destination
address, not the source address.  Fix by simply not setting
sin6_scope_id on the client socket address.

Reported-by: Anton D. Kachalov <mouse@yandex-team.ru>
Tested-by: Anton D. Kachalov <mouse@yandex-team.ru>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ipv6] Fix definition of IN6_IS_ADDR_LINKLOCAL()
Michael Brown [Wed, 21 May 2014 16:51:31 +0000 (17:51 +0100)] 
[ipv6] Fix definition of IN6_IS_ADDR_LINKLOCAL()

Fix an erroneous htonl() in the definition of IN6_IS_ADDR_LINKLOCAL(),
and add self-tests for the IN6_IS_ADDR_xxx() family of macros.

Reported-by: Marin Hannache <git@mareo.fr>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Do not try to fetch loaded image device path protocol
Michael Brown [Mon, 19 May 2014 22:08:42 +0000 (23:08 +0100)] 
[efi] Do not try to fetch loaded image device path protocol

Some UEFI systems (observed with a Mac Pro) do not provide a loaded
image device path protocol.  We don't currently use the loaded image
device path protocol for anything beyond printing a debug message, so
simply remove the code which attempts to fetch it.

Reported-by: Matt Woodward <pxematt@woodwardcc.com>
Tested-by: Matt Woodward <pxematt@woodwardcc.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Make EFI_HII_DATABASE_PROTOCOL optional
Michael Brown [Mon, 19 May 2014 19:29:01 +0000 (20:29 +0100)] 
[efi] Make EFI_HII_DATABASE_PROTOCOL optional

Some UEFI systems (observed with a Mac Pro) do not provide
EFI_HII_DATABASE_PROTOCOL.  We can continue to function without
providing access to network device settings via HII, so make this
protocol optional and fall back to simply not providing any HII
protocols.

Reported-by: Matt Woodward <pxematt@woodwardcc.com>
Tested-by: Matt Woodward <pxematt@woodwardcc.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Make EFI_DEVICE_PATH_TO_TEXT_PROTOCOL optional
Michael Brown [Mon, 19 May 2014 19:24:04 +0000 (20:24 +0100)] 
[efi] Make EFI_DEVICE_PATH_TO_TEXT_PROTOCOL optional

Some UEFI systems (observed with a Mac Pro) do not provide
EFI_DEVICE_PATH_TO_TEXT_PROTOCOL.  Since we use this protocol only for
debug messages, make it optional and fall back to printing the raw
device path bytes.

Reported-by: Matt Woodward <pxematt@woodwardcc.com>
Tested-by: Matt Woodward <pxematt@woodwardcc.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[efi] Allow for optional protocols
Michael Brown [Mon, 19 May 2014 19:23:31 +0000 (20:23 +0100)] 
[efi] Allow for optional protocols

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[nfs] Rewrite NFS URI handling
Marin Hannache [Fri, 16 May 2014 14:43:08 +0000 (16:43 +0200)] 
[nfs] Rewrite NFS URI handling

Get the NFS URI manipulation code out of nfs_open.c.  The resulting
code is now much more readable.

Signed-off-by: Marin Hannache <git@mareo.fr>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[libc] Prevent strndup() from reading beyond the end of the string
Michael Brown [Sun, 18 May 2014 20:05:39 +0000 (21:05 +0100)] 
[libc] Prevent strndup() from reading beyond the end of the string

strndup() may be called on a string which is not NUL-terminated.  Use
strnlen() instead of strlen() to ensure that we do not read beyond the
end of such a string.

Add self-tests for strndup(), including a test case with an
unterminated string.

Originally-fixed-by: Marin Hannache <git@mareo.fr>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Add self-tests for strdup()
Michael Brown [Sun, 18 May 2014 19:39:04 +0000 (20:39 +0100)] 
[test] Add self-tests for strdup()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[syslog] Strip invalid characters from hostname
Michael Brown [Fri, 16 May 2014 12:45:52 +0000 (13:45 +0100)] 
[syslog] Strip invalid characters from hostname

Avoid generating syntactically invalid log messages by ensuring that
invalid characters are not present in the hostname.  In particular,
ensure that any whitespace is stripped, since whitespace functions as
a field separator for syslog messages.

Reported-by: Alex Davies <adavies@jumptrading.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[intel] Increase receive ring fill level
Michael Brown [Fri, 16 May 2014 12:07:36 +0000 (13:07 +0100)] 
[intel] Increase receive ring fill level

As of commit d28bb51 ("[tcp] Defer sending ACKs until all received
packets have been processed"), increasing the RX ring size will
increase the number of received packets per transmitted ACK (since
each poll will process up to one complete receive ring).  Under KVM,
this can make a substantial (up to ~200%) difference to the overall
download speed, since transmissions are very expensive.

Increase the ring fill level from four to eight packets: this
increases the download speed by around 50% at a cost of around 8kB of
heap space.  Further speedups are possible by increasing the ring size
further, but it would be preferable to find alternative methods which
do not use noticeable amounts of heap space.

Tested-by: Robin Smidsrød <robin@smidsrod.no>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[nfs] Fix an invalid free() when loading a regular (non-symlink) file
Marin Hannache [Thu, 15 May 2014 17:05:48 +0000 (19:05 +0200)] 
[nfs] Fix an invalid free() when loading a regular (non-symlink) file

An invalid free() was ironically introduced by fixing another invalid
free in commit 7aa69c4 ("[nfs] Fix an invalid free() when loading a
symlink").

Signed-off-by: Marin Hannache <git@mareo.fr>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[lkrnprefix] Make real-mode setup code relocatable
Michael Brown [Thu, 15 May 2014 12:04:47 +0000 (13:04 +0100)] 
[lkrnprefix] Make real-mode setup code relocatable

The bzImage boot protocol allows the real-mode code to be loaded at
any segment within base memory.  (The fact that both iPXE and recent
versions of Syslinux will load the real-mode code at 1000:0000 is a
coincidence; it is not guaranteed by the specification.)

Fix by making the code relocatable.

Reported-by: Andrew Stuart <andrew@shopcusa.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Merge util/geniso and util/genliso
Christian Hesse [Tue, 13 May 2014 16:38:52 +0000 (18:38 +0200)] 
[build] Merge util/geniso and util/genliso

Rework geniso and genliso to provide a single merged utility for
generating ISO images.

Modified-by: Michael Brown <mcb30@ipxe.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Apply quota only to number of complete received packets
Michael Brown [Wed, 14 May 2014 12:50:30 +0000 (13:50 +0100)] 
[undi] Apply quota only to number of complete received packets

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Avoid errors when build directory is mounted via NFS
Michael Brown [Tue, 13 May 2014 10:20:04 +0000 (11:20 +0100)] 
[build] Avoid errors when build directory is mounted via NFS

Reported-by: Robin Smidsrød <robin@smidsrod.no>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[lkrnprefix] Function as a bzImage kernel
Michael Brown [Mon, 12 May 2014 22:49:14 +0000 (23:49 +0100)] 
[lkrnprefix] Function as a bzImage kernel

The .lkrn prefix currently provides a zImage kernel with unused setup
sectors and the whole iPXE binary placed within the "protected mode
kernel" portion of the zImage.

The work carried out years ago to create the .mrom format provides a
mechanism allowing the iPXE binary to be split into a small real-mode
header and a larger payload.  This neatly matches the way that a
bzImage is loaded: the "setup sectors" can contain the header and the
"protected mode kernel" can contain the payload.

This removes the size restrictions on an iPXE .lkrn image (and hence
on derived image formats such as .iso).

Also remove obsolete copyright information, since none of the original
code or functionality now remains.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[tcp] Defer sending ACKs until all received packets have been processed
Michael Brown [Wed, 7 May 2014 01:31:48 +0000 (02:31 +0100)] 
[tcp] Defer sending ACKs until all received packets have been processed

When running inside a virtual machine (or when using the UNDI driver),
transmitting packets can be expensive.  When we receive several
packets in one poll (e.g. because a slow BIOS timer interrupt routine
has caused us to fall behind in processing), we can safely send just a
single ACK to cover all of the received packets.  This reduces the
time spent transmitting and allows us to clear the backlog much
faster.

Various RFCs (starting with RFC1122) state that there should be an ACK
for at least every second segment.  We choose not to enforce this
rule.  Under normal operation each poll should find at most one
received packet, and we will then not delay any ACKs.  We delay
(i.e. omit) ACKs only when under sufficiently heavy load that we are
finding multiple packets per poll; under these conditions it is
important to clear the backlog quickly since any delay may lead to
dropped packets.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[nfs] Fix an invalid free() when loading a symlink
Marin Hannache [Wed, 12 Mar 2014 15:26:24 +0000 (16:26 +0100)] 
[nfs] Fix an invalid free() when loading a symlink

Signed-off-by: Marin Hannache <git@mareo.fr>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Fix version.o dependency upon git index
Michael Brown [Mon, 12 May 2014 15:41:06 +0000 (16:41 +0100)] 
[build] Fix version.o dependency upon git index

Commit 8540300 ("[build] Disable ccache for all relevant build
targets") attempted to generalise the rule for $(BIN)/version.o to
$(BIN)/version.% in order to apply the dependency to all relevant
build targets (debug objects, assembly listings, etc).

This generalisation appears to work for the ccache override
directives, but seems to cause make (at least, GNU make 4.0) to simply
ignore the dependency upon the git index.

Since version.c contains only some string constants, there is unlikely
to be a substantive need for its debug objects, assembly listings,
etc.  Restore the previous form of the dependency and accept that
hypothetical builds with e.g. DEBUG=version will not be handled
correctly.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[intel] Exclude time spent in hypervisor from profiling
Michael Brown [Tue, 6 May 2014 21:53:33 +0000 (22:53 +0100)] 
[intel] Exclude time spent in hypervisor from profiling

When profiling, exclude any time spent inside the hypervisor
responding to our MMIO accesses.  This substantially reduces the
variance accumulated on many other profilers.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[profile] Allow interrupts to be excluded from profiling results
Michael Brown [Sun, 4 May 2014 10:45:11 +0000 (11:45 +0100)] 
[profile] Allow interrupts to be excluded from profiling results

Interrupt processing adds noise to profiling results.  Allow
interrupts (from within protected mode) to be profiled separately,
with time spent within the interrupt handler being excluded from any
other profiling currently in progress.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Place an upper limit on the number of PXENV_UNDI_ISR calls per poll
Michael Brown [Sat, 3 May 2014 11:53:20 +0000 (12:53 +0100)] 
[undi] Place an upper limit on the number of PXENV_UNDI_ISR calls per poll

PXENV_UNDI_ISR calls may implicitly refill the underlying receive
ring, and so could continue to retrieve packets indefinitely.  Place
an upper limit on the number of calls to PXENV_UNDI_ISR per call to
undinet_poll().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Do not switch to real mode to check for NIC interrupt
Michael Brown [Sat, 3 May 2014 11:35:03 +0000 (12:35 +0100)] 
[undi] Do not switch to real mode to check for NIC interrupt

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Report any PXENV_UNDI_ISR errors via netdev_rx_err()
Michael Brown [Sat, 3 May 2014 12:00:02 +0000 (13:00 +0100)] 
[undi] Report any PXENV_UNDI_ISR errors via netdev_rx_err()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Profile transmit and receive datapaths
Michael Brown [Sat, 3 May 2014 11:34:16 +0000 (12:34 +0100)] 
[undi] Profile transmit and receive datapaths

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[undi] Profile all PXE API calls
Michael Brown [Sat, 3 May 2014 12:35:50 +0000 (13:35 +0100)] 
[undi] Profile all PXE API calls

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[pxe] Work around missing PXENV_UNDI_OPEN only when necessary
Michael Brown [Sat, 3 May 2014 00:07:38 +0000 (01:07 +0100)] 
[pxe] Work around missing PXENV_UNDI_OPEN only when necessary

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[pxe] Profile UNDI transmit datapath
Michael Brown [Sat, 3 May 2014 00:02:20 +0000 (01:02 +0100)] 
[pxe] Profile UNDI transmit datapath

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[pxe] Profile all PXE API calls
Michael Brown [Fri, 2 May 2014 23:52:43 +0000 (00:52 +0100)] 
[pxe] Profile all PXE API calls

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Add profiling self-tests for complete real_call and prot_call cycles
Michael Brown [Sat, 3 May 2014 11:29:08 +0000 (12:29 +0100)] 
[librm] Add profiling self-tests for complete real_call and prot_call cycles

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[profile] Provide methods for profiling individual stages of operations
Michael Brown [Sat, 3 May 2014 17:25:19 +0000 (18:25 +0100)] 
[profile] Provide methods for profiling individual stages of operations

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Speed up protected-mode calls under KVM
Michael Brown [Fri, 2 May 2014 17:45:18 +0000 (18:45 +0100)] 
[librm] Speed up protected-mode calls under KVM

When making a call from real mode to protected mode, we save and
restore the global and interrupt descriptor table registers.  The
restore currently takes place after returning to real mode, which
generates two EXCEPTION_NMIs and corresponding VM exits when running
under KVM on an Intel CPU.

Avoid the VM exits by restoring the descriptor table registers inside
prot_to_real, while still running in protected mode.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Speed up real-to-protected mode transition under KVM
Michael Brown [Fri, 2 May 2014 12:18:55 +0000 (13:18 +0100)] 
[librm] Speed up real-to-protected mode transition under KVM

Ensure that all segment registers have zero in the low two bits before
transitioning to protected mode.  This allows the CPU state to
immediately be deemed to be "valid", and eliminates the need for any
further emulated instructions.

Load the protected-mode interrupt descriptor table after switching to
protected mode, since this avoids triggering an EXCEPTION_NMI and
corresponding VM exit.

This reduces the time taken by real_to_prot under KVM by around 50%.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Speed up protected-to-real mode transition under KVM
Michael Brown [Thu, 1 May 2014 13:58:24 +0000 (14:58 +0100)] 
[librm] Speed up protected-to-real mode transition under KVM

On an Intel CPU supporting VMX, KVM will emulate instructions while
the CPU state remains "invalid".  In real mode, the CPU state is
defined to be "invalid" if any segment register has a base which is
not equal to (sreg<<4) or a limit which is not equal to 64kB.

We don't actually use the base stored in the REAL_DS descriptor for
any significant purpose.  Change the base stored in this descriptor to
be equal to (REAL_DS<<4).  A segment register loaded with REAL_DS is
then automatically valid in both real and protected modes.  This
allows KVM to stop emulating instructions much sooner.

The only use of REAL_DS for memory accesses currently occurs in the
indirect ljmp within prot_to_real.  Change this to a direct ljmp,
storing rm_cs in .text16 as part of the ljmp instruction.  This
removes the only memory access via REAL_DS (thereby allowing for the
above descriptor base address hack), and also simplifies the ljmp
instruction (which will still have to be emulated).

Load the real-mode interrupt descriptor table register before
switching to real mode, since this avoids triggering an EXCEPTION_NMI
and corresponding VM exit.

This reduces the time taken by prot_to_real under KVM by around 65%.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Add meaningful labels at section changes
Michael Brown [Wed, 30 Apr 2014 17:03:10 +0000 (18:03 +0100)] 
[librm] Add meaningful labels at section changes

The mode-transition code involves paths which switch back and forth
between the .text and .text16 sections.  At present, only the start of
each function is labelled, which makes it difficult to decode
addresses within the parts of the function existing in a different
section.

Add explicit labels at the start of each section change, so that
addresses can be meaningfully decoded to the nearest label.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Add a profiling self-test for measuring mode transition times
Michael Brown [Fri, 2 May 2014 14:20:56 +0000 (15:20 +0100)] 
[librm] Add a profiling self-test for measuring mode transition times

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Print out profiling statistics after a successful test run
Michael Brown [Fri, 2 May 2014 14:20:12 +0000 (15:20 +0100)] 
[test] Print out profiling statistics after a successful test run

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[pcbios] Do not switch to real mode to sleep the CPU
Michael Brown [Tue, 29 Apr 2014 17:17:17 +0000 (18:17 +0100)] 
[pcbios] Do not switch to real mode to sleep the CPU

Now that we can handle interrupts while in protected mode, there is no
need to switch to real mode just to halt the CPU.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[pcbios] Do not switch to real mode to check for timer interrupt
Michael Brown [Mon, 28 Apr 2014 19:20:44 +0000 (20:20 +0100)] 
[pcbios] Do not switch to real mode to check for timer interrupt

The currticks() function is called at least once per TCP packet, and
so is performance-critical.  Switching to real mode just to allow the
timer interrupt to fire is expensive when running inside a virtual
machine, and imposes a significant performance cost.

Fix by enabling interrupts without switching to real mode.  This
results in an approximately 100% increase in download speed when
running under KVM.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[comboot] Use built-in interrupt reflector
Michael Brown [Mon, 28 Apr 2014 20:11:04 +0000 (21:11 +0100)] 
[comboot] Use built-in interrupt reflector

We now have the ability to handle interrupts while in protected mode,
and so no longer need to set up a dedicated interrupt descriptor table
while running COM32 executables.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Allow interrupts in protected mode
Michael Brown [Mon, 28 Apr 2014 19:17:15 +0000 (20:17 +0100)] 
[librm] Allow interrupts in protected mode

When running in a virtual machine, switching to real mode may be
expensive.  Allow interrupts to be enabled while in protected mode and
reflected down to the real-mode interrupt handlers.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Allow for a debug level of zero
Michael Brown [Mon, 28 Apr 2014 13:43:19 +0000 (14:43 +0100)] 
[build] Allow for a debug level of zero

Allow for an explicit debug level of zero, which will enable
assertions and profiling (i.e. anything controlled by NDEBUG) without
generating any debug messages.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[downloader] Profile receive datapath
Michael Brown [Mon, 28 Apr 2014 11:31:39 +0000 (12:31 +0100)] 
[downloader] Profile receive datapath

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[http] Profile receive datapath
Michael Brown [Mon, 28 Apr 2014 11:31:23 +0000 (12:31 +0100)] 
[http] Profile receive datapath

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[tcp] Profile transmit and receive datapaths
Michael Brown [Mon, 28 Apr 2014 11:30:57 +0000 (12:30 +0100)] 
[tcp] Profile transmit and receive datapaths

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[ipv4] Profile transmit and receive datapaths
Michael Brown [Mon, 28 Apr 2014 11:30:09 +0000 (12:30 +0100)] 
[ipv4] Profile transmit and receive datapaths

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[librm] Use genuine real mode to accelerate operation in virtual machines
Michael Brown [Mon, 28 Apr 2014 00:21:08 +0000 (01:21 +0100)] 
[librm] Use genuine real mode to accelerate operation in virtual machines

We currently use flat real mode wherever real mode is required.  This
guarantees that we will not surprise some unsuspecting external caller
which has carefully set up flat real mode by suddenly reducing the
segment limits to 64kB.

However, operating in flat real mode imposes a severe performance
penalty in some virtualisation environments, since some CPUs cannot
fully virtualise flat real mode and so the hypervisor must fall back
to emulation.  In particular, operating under KVM on a pre-Westmere
Intel CPU will be at least an order of magnitude slower, to the point
that there is a visible teletype effect when printing anything to the
BIOS console.  (Older versions of KVM used to cheat and ignore the
"flat" part of flat real mode, which masked the problem.)

Switch (back) to using genuine real mode with 64kB segment limits
instead of flat real mode.  Hopefully this won't break anything.

Add an explicit switch to flat real mode before returning to the BIOS
from the ROM prefix, since we know that a PMM BIOS will call the ROM
initialisation point (and potentially the BEV) in flat real mode.

As noted in previous commit messages, it is not possible to restore
the real-mode segment limits after a transition to protected mode,
since there is no way to know which protected-mode segment descriptor
was originally used to initialise the limit portion of the segment
register.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[intel] Push new RX descriptors in batches
Michael Brown [Sun, 27 Apr 2014 21:35:48 +0000 (22:35 +0100)] 
[intel] Push new RX descriptors in batches

Inside a virtual machine, writing the RX ring tail pointer may incur a
substantial overhead of processing inside the hypervisor.  Minimise
this overhead by writing the tail pointer once per batch of
descriptors, rather than once per descriptor.

Profiling under qemu-kvm (version 1.6.2) shows that this reduces the
amount of time taken to refill the RX descriptor ring by around 90%.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[intel] Profile common virtual machine operations
Michael Brown [Sun, 27 Apr 2014 20:51:26 +0000 (21:51 +0100)] 
[intel] Profile common virtual machine operations

Operations which are negligible on physical hardware (such as issuing
a posted write to the transmit ring tail register) may involve
substantial amounts of processing within the hypervisor if running in
a virtual machine.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[netdevice] Profile common operations
Michael Brown [Sun, 27 Apr 2014 20:51:03 +0000 (21:51 +0100)] 
[netdevice] Profile common operations

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[cmdline] Add "profstat" command to display profiling statistics
Michael Brown [Sun, 27 Apr 2014 18:31:25 +0000 (19:31 +0100)] 
[cmdline] Add "profstat" command to display profiling statistics

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[profile] Add generic profiling infrastructure
Michael Brown [Wed, 23 Apr 2014 16:43:18 +0000 (17:43 +0100)] 
[profile] Add generic profiling infrastructure

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[libc] Add flsll()
Michael Brown [Sun, 27 Apr 2014 15:11:44 +0000 (16:11 +0100)] 
[libc] Add flsll()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[libc] Add isqrt() function to find integer square roots
Michael Brown [Sat, 26 Apr 2014 17:19:49 +0000 (18:19 +0100)] 
[libc] Add isqrt() function to find integer square roots

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Check for correct -mrtd assumption on libgcc arithmetic functions
Michael Brown [Sat, 26 Apr 2014 15:00:26 +0000 (16:00 +0100)] 
[test] Check for correct -mrtd assumption on libgcc arithmetic functions

As observed in commit 082cedb ("[build] Fix __libgcc attribute for
recent gcc versions"), recent versions of gcc have changed the
semantics of -mrtd as applied to the implicit arithmetic functions.

It is possible for tests to succeed even if our assumptions about
gcc's interpretation of -mrtd are incorrect.  In particular, if gcc
chooses to utilise a frame pointer in the calling function, then it
can tolerate a temporarily incorrect stack pointer (since the stack
pointer will shortly afterwards be restored from the frame pointer
anyway).

Add tests designed specifically to check that our implementations of
the implicit arithmetic functions manipulate the stack pointer as
expected by gcc.

The effect of these tests can be observed by temporarily reverting
commit 082cedb ("[build] Fix __libgcc attribute for recent gcc
versions"): without this fix in place, the tests will fail on gcc 4.7
and later.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[build] Fix __libgcc attribute for recent gcc versions
Michael Brown [Fri, 25 Apr 2014 14:55:36 +0000 (15:55 +0100)] 
[build] Fix __libgcc attribute for recent gcc versions

We observed some time ago (in commit 4ce8d61 "Import various libgcc
functions from syslinux") that gcc seems to treat calls to the
implicit arithmetic functions (e.g. __udivdi3()) as being affected by
-mregparm but unaffected by -mrtd.

This seems to be no longer the case with current gcc versions, which
treat calls to these functions as being affected by both -mregparm and
-mrtd, as expected.

There is nothing obvious in the gcc changelogs to indicate precisely
when this happened.  From experimentation with available gcc versions,
the change occurred sometime between v4.6.3 and v4.7.2.  We assume
that only versions up to v4.6.x require the special treatment.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Add tests for 64-bit division
Michael Brown [Thu, 24 Apr 2014 23:04:25 +0000 (00:04 +0100)] 
[test] Add tests for 64-bit division

On a 32-bit system, 64-bit division is implemented using the libgcc
functions provided in __udivmoddi4.c etc.  Calls to these functions
are generated automatically by gcc, with a calling convention that is
somewhat empirical in nature.  Add these self-tests primarily as a
check that we are using the correct calling convention.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[libc] Add inline assembly implementation of flsl() using BSR instruction
Michael Brown [Thu, 24 Apr 2014 13:49:08 +0000 (14:49 +0100)] 
[libc] Add inline assembly implementation of flsl() using BSR instruction

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Add self-tests for flsl()
Michael Brown [Thu, 24 Apr 2014 12:38:53 +0000 (13:38 +0100)] 
[test] Add self-tests for flsl()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Rewrite TCP/IP tests using okx()
Michael Brown [Wed, 23 Apr 2014 16:21:06 +0000 (17:21 +0100)] 
[test] Rewrite TCP/IP tests using okx()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[serial] Enable UART FIFOs
Peter Pickford [Tue, 22 Apr 2014 12:45:42 +0000 (13:45 +0100)] 
[serial] Enable UART FIFOs

Escape sequences received via the serial console can fail since the
cpu_nap() in getchar_timeout() can delay processing for more than the
time it takes for a single character to arrive.

Fix by enabling the UART FIFOs.

Modified-by: Michael Brown <mcb30@ipxe.org>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[intel] Avoid completely filling the TX descriptor ring
Michael Brown [Tue, 22 Apr 2014 12:12:54 +0000 (13:12 +0100)] 
[intel] Avoid completely filling the TX descriptor ring

It is unclear from the datasheets whether or not the TX ring can be
completely filled (i.e. whether writing the tail value as equal to the
current head value will cause the ring to be treated as completely
full or completely empty).  It is very plausible that this edge case
could differ in behaviour between real hardware and the many
implementations of an emulated Intel NIC found in various virtual
machines.  Err on the side of caution and always leave at least one
ring entry empty.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[crypto] Allow wildcard matches on commonName as well as subjectAltName
Michael Brown [Tue, 1 Apr 2014 10:36:11 +0000 (11:36 +0100)] 
[crypto] Allow wildcard matches on commonName as well as subjectAltName

Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[crypto] Add support for subjectAltName and wildcard certificates
Michael Brown [Mon, 31 Mar 2014 00:11:06 +0000 (01:11 +0100)] 
[crypto] Add support for subjectAltName and wildcard certificates

Originally-implemented-by: Alex Chernyakhovsky <achernya@google.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
11 years ago[test] Add subject alternative names to X.509 server test certificate
Michael Brown [Mon, 31 Mar 2014 12:32:26 +0000 (13:32 +0100)] 
[test] Add subject alternative names to X.509 server test certificate

Signed-off-by: Michael Brown <mcb30@ipxe.org>