gPXE responds to duplicated ACKs with an immediate retransmission,
which can lead to a sorceror's apprentice syndrome.  It also responds
to out-of-range (or old duplicate) ACKs with a RST, which can cause
valid connections to be dropped.

Fix the sorceror's apprentice syndrome by leaving the retransmission
timer running (and so inhibiting the immediate retransmission) when we
receive a potential duplicate ACK.  This seems to match the behaviour
of Linux observed via wireshark traces.

Fix the RST issue by sending RST only on out-of-range ACKs that occur
before the connection is fully established, as per RFC 793.

These problems were exposed during development of the 802.11 wireless
link layer; the 802.11 protocol has a failure mode that can easily
cause duplicated packets.  The fixes were tested in a controlled way
by faking large numbers of duplicated packets in the rtl8139 driver.

Originally-fixed-by: Joshua Oreman <oremanj@rwcr.net>

setting_cmp() compares by option tag and then by name.  Empty names
will always match, which gives us a false positive.

Fix by explicitly checking for empty names.

Modified-by: Michael Brown <mcb30@etherboot.org>
Signed-off-by: Michael Brown <mcb30@etherboot.org>

MAX_LL_HEADER_LEN is erroneously set to 6 rather than 14, resulting
in possible data corruption whenever we send an ARP packet.

Fix value and add a comment explaining why MAX_LL_ADDR_LEN is greater
than MAX_LL_HEADER_LEN.

Reported-by: Joshua Oreman <oremanj@rwcr.net>

Windows text editors such as Notepad tend to use CRLF line endings,
which breaks gPXE's signature detection for script images.  Since
scripts are usually very small, they end up falling back to being
detected as valid PXE executable images (since there are no signature
checks for PXE executables).  Executing text files as x86 machine code
tends not to work well.

Fix by allowing for any isspace() character to terminate the "#!gpxe"
signature, and by ensuring that CR characters get stripped during
command line parsing.

Suggested-by: Shao Miller <Shao.Miller@yrdsb.edu.on.ca>

Several SPI chips will respond to an SPI read command with a dummy
zero bit immediately prior to the first real data bit.  This can be
used to autodetect the address length, provided that the command
length and data length are already known, and that the MISO data line
is tied high.

Tested-by: Thomas Miletich <thomas.miletich@gmail.com>
Debugged-by: Thomas Miletich <thomas.miletich@gmail.com>

gcc 4.4 defaults to using .cfi assembler directives for debugging
information, which causes unneeded .eh_frame sections to be generated.
These sections are already stripped out by our linker script, so don't
affect the final build, but do distort the output of "size" when run
on individual .o files; the .eh_frame size is included within the size
reported for .text.  This makes it difficult to accurately judge the
effects of source code changes upon object code size.

Fix by adding -fno-dwarf2-cfi-asm to CFLAGS if we detect that this
option is supported by the gcc that we are compiling with.

Tested-by: Daniel Verkamp <daniel@drv.nu>

Signed-off-by: Michael Brown <mcb30@etherboot.org>

Signed-off-by: Michael Brown <mcb30@etherboot.org>

Signed-off-by: Michael Brown <mcb30@etherboot.org>

Signed-off-by: Michael Brown <mcb30@etherboot.org>

This provides a mechanism for using arbitrarily-named variables within
gPXE, using the existing syntax for settings.

Grub will include the module name as part of the command line, and
some multiboot kernels expect this to be done.

If the ProxyDHCPOFFER already includes PXE options (i.e. option 60 is
set to "PXEClient" and option 43 is present) then assume that the
ProxyDHCPREQUEST can be sent to port 67, rather than port 4011.  This
is a reasonable assumption, since in that case the ProxyDHCP server
has already demonstrated by responding to the DHCPDISCOVER that it is
listening on port 67.  (If the ProxyDHCP server were not listening on
port 67, then the standard DHCP server would have been configured to
respond with option 60 set to "PXEClient" but no option 43 present.)

The PXE specification is ambiguous on this point; the specified
behaviour covers only the cases in which option 43 is *not* present in
the ProxyDHCPOFFER.  In these cases, we will continue to send the
ProxyDHCPREQUEST to port 4011.

This change is required in order to allow us to interoperate with
dnsmasq, which listens only on port 67.  (dnsmasq relies on
unspecified behaviour of the Intel PXE stack, which it seems will
retain the ProxyDHCPOFFER as an options source and never issue a
ProxyDHCPREQUEST, thereby enabling dnsmasq to omit listening on port
4011.)

Tested with COM1 and COM2.

Signed-off-by: Michael Brown <mcb30@etherboot.org>

IBM Tivoli PXE Server 5.1.0.3 is reported to send trailing garbage
bytes at the end of the OACK packet, which causes gPXE to reject the
packet and abort the TFTP transfer.

Work around the problem by processing as much as possible of the OACK,
and treating name/value parsing errors as non-fatal.

Reported-by: Shao Miller <Shao.Miller@yrdsb.edu.on.ca>

We currently send all boot server discovery requests to port 4011.
Section 2.2.1 of the PXE spec states that boot server discovery
packets should be "sent broadcast (port 67), multicast (port 4011), or
unicast (port 4011)".  Adjust our behaviour so that any boot server
discovery packets that are sent to the broadcast address are directed
to port 67 rather than port 4011.

This is required for operation with dnsmasq as a PXE server, since
dnsmasq listens only on port 67, and relies upon this (specified)
behaviour.

This change may break some setups using the (itself very broken) Linux
PXE server from kano.org.uk.  This server will, in its default
configuration, listen only on port 4011.  It never constructs a boot
server list (PXE_BOOT_SERVERS, option 43.8), and uses the wrong
definitions for the discovery control bits (PXE_DISCOVERY_CONTROL,
option 43.6).  The upshot is that it will always instruct the client
to perform multicast and broadcast discovery only.  In setups lacking
a valid multicast route on the server side, this used to work because
gPXE would eventually give up on the (non-responsive) multicast
address and send a broadcast request to port 4011, which the Linux PXE
server would respond to.  Now that gPXE correctly sends this broadcast
request to port 67 instead, it is never seen by the Linux PXE server,
and the boot fails.  The fix is to either (a) set up a multicast route
correctly on the server side before starting the PXE server, or (b)
edit /etc/pxe.conf to contain the server's unicast address in the
"multicast_address" field (a hack that happens to work).

Suggested-by: Simon Kelley <simon@thekelleys.org.uk>

This prevents gPXE from wasting time attempting to contact a ProxyDHCP
server on port 4011 if the DHCP response already contains the relevant
PXE options.  This behaviour is hinted at (though not explicitly
specified) in the PXE spec, and seems to match what the Intel client
does.

Suggested-by: Simon Kelley <simon@thekelleys.org.uk>

Add FILE_LICENCE declarations to almost all files that make up the
various standard builds of gPXE.

It is now possible to run e.g.

  make bin/rtl8139.dsk.licence

in order to see a licensing assessment for any given gPXE build.  The
assessment will either produce a single overall licence for the build
(based on combining all the licences used within the source files for
that build), or will exit with an error stating why a licence
assessment is not possible (for example, if there are files involved
that do not yet contain an explicit FILE_LICENCE() declaration).

For partly historical reasons, various files in the gPXE source tree
are licensed under different, though compatible, terms.  Most of the
code is licensed under GPLv2 with the "or later" clause, but there are
exceptions such as:

  The string.h file, which derives from Linux and is licensed as
  Public Domain.

  The EFI header files, which are taken from the EDK2 source tree and
  are licensed under BSD.

  The 3c90x driver, which has a custom GPL-like licence text.

Introduce a FILE_LICENCE() macro to make licensing more explicit.
This macro should be applied exactly once to each source (.c, .S or
.h) file.  It will cause a corresponding zero-sized common symbol to
be added to any .o files generated from that source file (and hence to
any final gPXE binaries generated from that source file).  Determining
the applicable licences to generated files can then be done using e.g.

  $ objdump -t bin/process.o | grep __licence
  00000000       O *COM*  00000001 .hidden __licence_gpl2_or_later

indicating that bin/process.o is covered entirely by the GPLv2
with the "or later" clause, or

  $ objdump -t bin/rtl8139.dsk.tmp | grep __licence
  00033e8c g     O .bss.textdata  00000000 .hidden __licence_gpl2_only
  00033e8c g     O .bss.textdata  00000000 .hidden __licence_gpl2_or_later
  00033e8c g     O .bss.textdata  00000000 .hidden __licence_public_domain

indicating that bin/rtl8139.dsk includes both code licensed under
GPLv2 (both with and without the "or later" clause) and code licensed
as Public Domain.

Determining the result of licence combinations is currently left as an
exercise for the reader.

Etherboot 5.4 erroneously treats PXENV_UNLOAD_STACK as the "final
shutdown" call, and unhooks INT15.  When using gPXE's undionly.kpxe,
this results in gPXE overwriting the portion of Etherboot located in
high memory, because it is no longer hidden from the system memory map
at the time that gPXE loads.

Work around this by explicitly testing for Etherboot as the underlying
PXE stack (as is already done in undinet.c) and skipping the call to
PXENV_UNLOAD_STACK if necessary.

Commit b149a99 ([build] Round up SUBx deltas) introduced a
signed/unsigned issue that affects gPXE images built on 32-bit hosts.
The zbin fixup utility performed an unsigned division, which led to
.usb images with an incorrect number of sectors to load.

The issue snuck by on 64-bit hosts since uint32_t is promoted to long.
On 32-bit hosts it is promoted to unsigned long.

Modified-by: Michael Brown <mcb30@etherboot.org>
Signed-off-by: Michael Brown <mcb30@etherboot.org>

NetBSD kernels are multiboot ELF kernels with an entry point
incorrectly specified as a virtual address rather than a physical
address.

Work around this by looking for the segment that could plausibly
contain the entry point address (interpreted as either a physical or
virtual address), and using that to determine the eventual physical
entry point.

In the event of any ambiguity, precedence is given to interpretation
of the entry point as a physical address.

Solaris kernels are multiboot images with the "raw" flag set,
indicating that the loader should use the raw address fields within
the multiboot header rather than looking for an ELF header.  However,
the Solaris kernel contains garbage data in the raw address fields,
and requires us to use the ELF header instead.

Work around this by always using the ELF header if present.  This
renders the "raw" flag somewhat redundant.

You can now type e.g.

  make bin/rtl8139.rom.sizes

in order to see the (uncompressed) sizes of all of the object files
linked in to bin/rtl8139.rom.  This should make it easier to identify
relevant code bloat.

Now that there are no remaining multiple-object source files, kill off
the mechanism in order to simplify the Makefile.

The build mechanism currently allows for multiple objects per source
file.  The only remaining user of this is unnrv2b.S.  Replace this
usage with a separate unnrv2b16.S wrapper file, as is currently used
for e.g. pxeprefix.S and kpxeprefix.S.

You can now type e.g.

  make bin/rtl8139.rom.deps

to see a list of the source files included in the build of
bin/rtl8139.rom.  This is intended to assist with copyright vetting.

Other new debugging targets include

  make bin/rtl8139.rom.objs

to see a list of object files linked in to bin/rtl8139.rom, and

  make bin/rtl8139.rom.nodeps

to see a list of the source files that are *not* required for the
build of bin/rtl8139.rom.

Sometimes it's just so much fun doing things the complicated way that
you forget to check the man page for the existence of a simpler
syntax.

Some utilities that expect a floppy disk image (e.g. iLO?) may test
for a file of the correct size.  Reinstate the .pdsk image format in
order to provide this if needed.

QEMU will silently round down a disk or ROM image file to the nearest
512 bytes.  Fix by always padding .rom, .dsk and .hd images to the
nearest 512-byte boundary.

Originally-fixed-by: Stefan Hajnoczi <stefanha@gmail.com>

Allow options with dedicated BOOTP fields to fall back to using the
equivalent DHCP option if the relevant field is empty.

Add SMBIOS asset tag as a named setting.

Signed-off-by: Michael Brown <mcb30@etherboot.org>

This replaces the gdbstub's polite NAK behavior with retransmission of
the current outstanding reply packet.  It solves situations where gdb
and gPXE's gdbstub get out of sync due to the lack of flow control in
the gdb protocol spec.

Signed-off-by: Michael Brown <mcb30@etherboot.org>

The zbin compressor fixup utility rounds down file sizes before
calculating their difference.  This produces incorrect values and may
cause truncated gPXE images to be loaded at boot.

The following example explains the problem:
ilen    = 48 bytes     (uncompressed input file)
olen    = 17 bytes     (compressed output file)
divisor = 16 bytes     (paragraph granularity)
fixmeup = 3 paragraphs (value to fix up)

olen / divisor - ilen / divisor
= 1 - 3
= -2 paragraphs  (old delta calculation)

( align ( olen, divisor ) - align ( ilen, divisor ) ) / divisor
= 2 - 3
= -1 paragraphs  (new delta calculation)

If we perform the SUBx operation with old delta:
fixmeup + -2 = 1 paragraph gets loaded by the prefix

With the new delta:
fixmeup + -1 = 2 paragraphs get loaded by the prefix

The old delta calculation removes the last paragraph; the prefix will
load a truncated copy of gPXE into memory.  We need to load 2
paragraphs since olen is 17 bytes.  Loading only 1 paragraph (16
bytes) would truncate the last byte.

Signed-off-by: Michael Brown <mcb30@etherboot.org>

Using "lret $2" to return from an interrupt causes interrupts to be
disabled in the calling program, since the INT instruction will have
disabled interrupts.  Instead, patch CF on the stack and use iret to
return.

Interestingly, the original PC BIOS had this bug in at least one
place.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Michael Brown <mcb30@etherboot.org>

The "seq" command is GNU-specific; a BSD userland will not have it.
Use POSIX-conforming "awk" instead.

Reported-by: Joshua Oreman <oremanj@rwcr.net>
Suggested-by: Stefan Hajnoczi <stefanha@gmail.com>

On Mac OS X, it is necessary to build binutils manually; the system
does not provide bfd.h or the libbfd or libiberty libraries.

Originally-fixed-by: Joshua Oreman <oremanj@rwcr.net>

The Mac compiler treats "#pragma pack()" as gcc's "#pragma pack(pop)",
and so dies if the pragma pack stack is empty.  Adding a "#pragma
pack(1)" immediately beforehand is enough to keep the Mac compiler
happy.

The combination of "#pragma pack(1)", "#pragma pack()" won't actually
achieve anything on a Mac, but it will at least build.  (With gcc, the
"#pragma pack()" overrides any previous pragmas, so is still useful.)

Suggested-by: Joshua Oreman <oremanj@rwcr.net>