[realtek] Fix reopening of legacy-mode 8139 NIC

realtek_destroy_ring() currently does nothing if the card is operating
in legacy (pre-RTL8139C+) mode.  In particular, the producer and
consumer counters are incorrectly left holding their current values.
Virtual hardware (e.g. the emulated RTL8139 in qemu and similar VMs)
is tolerant of this behaviour, but real hardware will fail to transmit
if the descriptors are not used in the correct order.

Fix by resetting the producer and consumer counters in
realtek_destroy_ring() even if the card is operating in legacy mode.

Reported-by: Gelip <mrgelip@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Accept OCSP responses containing multiple certificates

RFC2560 mandates that a valid OCSP response will contain exactly one
relevant certificate.  However, some OCSP responders include
extraneous certificates.  iPXE currently assumes that the first
certificate in the OCSP response is the relevant certificate; OCSP
checks will therefore fail if the responder includes the extraneous
certificates before the relevant certificate.

Fix by using the responder ID to identify the relevant certificate.

Reported-by: Christian Stroehmeier <stroemi@mail.uni-paderborn.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[bzimage] Align initrd images to page boundary

Some versions of Linux apparently complain if initrds are not aligned
to a page boundary.  Fix by changing INITRD_ALIGN from 4 bytes to 4096
bytes.

The amount of padding at the end of each initrd will now often be
sufficient to allow the cpio header to be prepended without crossing
an alignment boundary.  The final location of the initrd may therefore
end up being slightly higher than the post-shuffle location.
bzimage_load_initrd() must therefore now copy the initrd body prior to
copying the cpio header, otherwise the start of the initrd body may be
overwritten by the cpio header.  (Note that the guarantee that an
initrd will never need to overwrite an initrd at a higher location
still holds, since the overall length of each initrd cannot decrease
as a result of adding a cpio header.)

Reported-by: Dave Hansen <dave@sr71.net>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[bzimage] Fix spurious uninitialised-variable warning on some gcc versions

Reported-by: Matthew Helton <mwhelton@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[build] Work around bug in gcc >= 4.8

gcc 4.8 and 4.9 fail to compile pxe_call.c with the error "bp cannot
be used in asm here".  Other points in the codebase which use "ebp" in
the asm clobber list do not seem to be affected.

Unfortunately gcc provides no way to specify %ebp as an output
register, so we cannot use this as a workaround.  The only viable
solution is to explicitly push/pop %ebp within the asm itself.  This
is ugly for two reasons: firstly, it may be unnecessary; secondly, it
may cause gcc to generate invalid %esp-relative addresses if the asm
happens to use memory operands.  This specific block of asm uses no
memory operands and so will not generate invalid code.

Reported-by: Daniel P. Berrange <berrange@redhat.com>
Reported-by: Christian Hesse <list@eworm.de>
Originally-fixed-by: Christian Hesse <list@eworm.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[autoboot] Use next-server from filename's settings block

Locate the settings block containing the filename, and search only
that settings block for the next-server address.  This avoids problems
caused by misconfigured DHCP servers which provide a next-server
address (often defaulting to the DHCP server's own IP address) even
when not providing a filename.

Originally-implemented-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[tcp] Do not send RST for unrecognised connections

On large networks with substantial numbers of monitoring agents,
unwanted TCP connection attempts may end up flooding iPXE's ARP cache.

Fix by silently dropping packets received for unrecognised TCP
connections.  This should not cause problems, since many firewalls
will also silently drop any such packets.

Reported-by: Jarrod Johnson <jarrod.b.johnson@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[tcp] Fix comment to match code behaviour

Reported-by: Thomas Miletich <thomas.miletich@gmail.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add self-tests for base16

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[base16] Generalise base16_decode() to hex_decode()

Provide a generic hex_decode() routine which can be shared between the
Base16 code and the "hex" and "hexhyp" settings parsers.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Use hex_decode() to parse hex settings

Use hex_decode() to parse "hex" and "hexhyp" settings.  Note that this
parser is stricter than the old parser; it now requires exactly two
hex digits for each byte.  (The old parser was based upon strtoul()
and so would allow leading whitespace and a leading plus or minus
sign.)

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Add "hexraw" setting type

Originally-implemented-by: Jeppe Toustrup <ipxe@tenzer.dk>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[netdevice] Add "bustype" and "busloc" settings

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Add "busdevfn" setting type

Allow network device's "busloc" setting to be formatted as a PCI
bus:dev.fn address using e.g. ${net0/busloc:busdevfn}.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[linux] Add support for accessing PCI configuration space via /proc/bus/pci

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Add config/settings.h

Move VMWARE_SETTINGS build configuration option from config/sideband.h
to a new config/settings.h.

Existing instances of config/local/sideband.h will not be affected,
since config.c still #includes config/sideband.h.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Expose PCI configuration space via settings mechanism

Allow values to be read from PCI configuration space using the syntax

  ${pci/<busdevfn>.<offset>.<length>}

where <busdevfn> is the bus:dev.fn address of the PCI device
(expressed as a single integer, as returned by ${net0/busloc}),
<offset> is the offset within PCI configuration space, and <length> is
the length within PCI configuration space.

Values are returned in reverse byte order, since PCI configuration
space is little-endian by definition.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Make "netX" settings block function as a symbolic link

Add a facility for settings blocks to act as symbolic links to other
settings blocks, and reimplement the "netX" virtual settings block
using this facility.

The primary advantage of this approach is that unscoped settings such
as ${mac} and ${filename} will now reflect the settings obtained from
the most recently opened network device: in most cases, this will mean
the settings obtained from the most recent DHCP attempt.  This should
improve conformance to the principle of least astonishment.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[cmdline] Accept "netX" in iPXE commands

Allow any iPXE command expecting a network device name to accept
"netX" as a synonym for "most recently opened network device".

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[settings] Add "version" builtin setting

Signed-off-by: Michael Brown <mcb30@ipxe.org>