summaryrefslogtreecommitdiff
path: root/doc/usage/cmd
diff options
context:
space:
mode:
Diffstat (limited to 'doc/usage/cmd')
-rw-r--r--doc/usage/cmd/acpi.rst20
-rw-r--r--doc/usage/cmd/fuse.rst176
-rw-r--r--doc/usage/cmd/meminfo.rst71
-rw-r--r--doc/usage/cmd/mv.rst61
-rw-r--r--doc/usage/cmd/ut.rst145
-rw-r--r--doc/usage/cmd/wget.rst82
6 files changed, 502 insertions, 53 deletions
diff --git a/doc/usage/cmd/acpi.rst b/doc/usage/cmd/acpi.rst
index 9f30972fe53..e652968d584 100644
--- a/doc/usage/cmd/acpi.rst
+++ b/doc/usage/cmd/acpi.rst
@@ -11,7 +11,7 @@ Synopsis
::
- acpi list
+ acpi list [-c]
acpi items [-d]
acpi dump <name>
acpi set <address>
@@ -38,6 +38,9 @@ List the ACPI tables that have been generated. Each table has a 4-character
table name (e.g. SSDT, FACS) and has a format defined by the
`ACPI specification`_.
+The `-c` flag tells U-Boot to verify the checksums and print 'OK' or 'BAD' next
+to each table.
+
U-Boot does not currently support decoding the tables. Unlike devicetree, ACPI
tables have no regular schema and also some include bytecode, so decoding the
tables requires a lot of code.
@@ -259,5 +262,20 @@ pointer::
WAET bff76a3b 28 v01 BOCHS BXPC 1 BXPC 1
SSDT bff95040 c5 v02 COREv4 COREBOOT 2a CORE 20221020
+This shows checking that the checksums are correct for each table::
+
+ => acpi list -c
+ Name Base Size Detail
+ ---- ---------------- ----- ----------------------------
+ RSDP bec9a000 24 v00 BOCHS OK OK
+ RSDT bec9bd4a 38 v01 BOCHS BXPC 1 BXPC 1 OK
+ FACP bec9bb46 74 v01 BOCHS BXPC 1 BXPC 1 OK
+ DSDT bec9a080 1ac6 v01 BOCHS BXPC 1 BXPC 1 OK
+ FACS bec9a040 40
+ APIC bec9bbba 78 v03 BOCHS BXPC 1 BXPC 1 OK
+ HPET bec9bc32 38 v01 BOCHS BXPC 1 BXPC 1 OK
+ SRAT bec9bc6a b8 v01 BOCHS BXPC 1 BXPC 1 OK
+ WAET bec9bd22 28 v01 BOCHS BXPC 1 BXPC 1 OK
+
.. _`ACPI specification`: https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf
diff --git a/doc/usage/cmd/fuse.rst b/doc/usage/cmd/fuse.rst
new file mode 100644
index 00000000000..42c6e209f99
--- /dev/null
+++ b/doc/usage/cmd/fuse.rst
@@ -0,0 +1,176 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+.. index::
+ single: fuse (command)
+
+fuse command
+============
+
+Synopsis
+--------
+
+::
+
+ fuse read <bank> <word> [<cnt>]
+ fuse cmp <bank> <word> <hexval>
+ fuse readm <bank> <word> <addr> [<cnt>]
+ fuse sense <bank> <word> [<cnt>]
+ fuse prog [-y] <bank> <word> <hexval> [<hexval>...]
+ fuse override <bank> <word> <hexval> [<hexval>...]
+ fuse writebuff [-y] <addr>
+
+Description
+-----------
+
+The fuse API allows to control a fusebox and how it is used by the upper
+hardware layers.
+
+A fuse corresponds to a single non-volatile memory bit that can be programmed
+(i.e., blown, set to 1) only once. The programming operation is irreversible.
+A fuse that has not been programmed reads as 0.
+
+Fuses can be used by SoCs to store various permanent configurations and data,
+such as boot configurations, security settings, MAC addresses, etc.
+
+A fuse 'word' is the smallest group of fuses that can be read at once from
+the fusebox control IP registers. In the current API, this is limited to 32 bits.
+
+A fuse 'bank' is the smallest group of fuse words having a common ID, as
+defined by each SoC.
+
+Upon startup, the fusebox control IP reads the fuse values and stores them in a
+volatile shadow cache.
+
+Commands
+--------
+
+- **fuse read <bank> <word> [<cnt>]**
+ Reads 1 or 'cnt' fuse words, starting at 'word' from the shadow cache.
+
+- **fuse cmp <bank> <word> <hexval>**
+ Compares 'hexval' to fuse at 'word'.
+
+- **fuse readm <bank> <word> <addr> [<cnt>]**
+ Reads 1 or 'cnt' fuse words, starting at 'word' into memory at 'addr'.
+
+- **fuse sense <bank> <word> [<cnt>]**
+ Sense 1 or 'cnt' fuse words, starting at 'word'.
+ Sense - i.e. read directly from the fusebox, skipping the shadow cache -
+ fuse words. This operation does not update the shadow cache. This is
+ useful to know the true value of fuses if an override has been
+ performed (see below).
+
+- **fuse prog [-y] <bank> <word> <hexval> [<hexval>...]**
+ Permanently programs 1 or several fuse words, starting at 'word'.
+ This operation directly affects the fusebox and is irreversible. The
+ shadow cache is updated accordingly or not, depending on each IP.
+ Only the bits to be programmed should be set in the input value (i.e.
+ for fuse bits that have already been programmed and hence should be
+ left unchanged by a further programming, it is preferable to clear
+ the corresponding bits in the input value in order not to perform a
+ new hardware programming operation on these fuse bits).
+
+- **fuse override <bank> <word> <hexval> [<hexval>...]**
+ Override 1 or several fuse words, starting at 'word' in the shadow cache.
+ The fusebox is unaffected, so following this operation, the shadow cache
+ may differ from the fusebox values. Read or sense operations can then be
+ used to get the values from the shadow cache or from the fusebox.
+ This is useful to change the behaviours linked to some cached fuse values,
+ either because this is needed only temporarily, or because some of the
+ fuses have already been programmed or are locked (if the SoC allows to
+ override a locked fuse).
+
+- **fuse writebuff [-y] <addr>**
+ Programs fuse data using a structured buffer in memory starting at 'addr'.
+ This operation directly affects the fusebox and is irreversible.
+
+ The structure of the buffer should contain all necessary details for
+ programming fuses, such as the values to be written to the fuse, optional
+ metadata for validation or programming constraints and any configuration
+ data required for the operation. Define CONFIG_CMD_FUSE_WRITEBUFF to
+ enable the fuse writebuff command.
+
+Examples
+--------
+
+fuse read
+~~~~~~~~~
+
+::
+
+ u-boot=> fuse read 0 1
+ Reading bank 0:
+
+ Word 0x00000001: 00000001
+
+fuse cmp
+~~~~~~~~
+
+::
+
+ u-boot=> fuse cmp 0 1 0x1
+ Comparing bank 0:
+
+ Word 0x00000001:
+ Value 0x00000001:0x00000001
+ passed
+
+fuse readm
+~~~~~~~~~~
+
+::
+
+ u-boot=> fuse readm 0 1 0x83000000
+ Reading bank 0 len 1 to 0x83000000
+
+fuse sense
+~~~~~~~~~~
+
+::
+
+ u-boot=> fuse sense 0 1
+ Sensing bank 0:
+
+ Word 0x00000001: 00000001
+
+fuse prog
+~~~~~~~~~
+
+::
+
+ u-boot=> fuse prog 0 1 0x00000002
+ Programming bank 0 word 0x00000001 to 0x00000002...
+ Warning: Programming fuses is an irreversible operation!
+ This may brick your system.
+ Use this command only if you are sure of what you are doing!
+
+ Really perform this fuse programming? <y/N>
+ y
+
+fuse override
+~~~~~~~~~~~~~
+
+::
+
+ u-boot=> fuse override 0 1 0x00000003
+ Overriding bank 0 word 0x00000001 with 0x00000003...
+
+fuse writebuff
+~~~~~~~~~~~~~~
+
+::
+
+ u-boot=> fuse writebuff -y 0x84000000
+ Programming fuses with buffer at addr 0x84000000
+
+Configuration
+-------------
+
+The fuse commands are available if CONFIG_CMD_FUSE=y.
+The fuse writebuff command is available if CONFIG_CMD_FUSE_WRITEBUFF=y.
+
+Return code
+-----------
+
+The return value $? is set to 0 (true) if the command is successful,
+1 (false) otherwise.
diff --git a/doc/usage/cmd/meminfo.rst b/doc/usage/cmd/meminfo.rst
index 6c94493cccc..e10bdc6832c 100644
--- a/doc/usage/cmd/meminfo.rst
+++ b/doc/usage/cmd/meminfo.rst
@@ -18,7 +18,8 @@ Description
The meminfo command shows the amount of memory. If ``CONFIG_CMD_MEMINFO_MAP`` is
enabled, then it also shows the layout of memory used by U-Boot and the region
-which is free for use by images.
+which is free for use by images. In architectures that support it, it also prints
+the mapped pages and their permissions. The latter is architecture specific.
The layout of memory is set up before relocation, within the init sequence in
``board_init_f()``, specifically the various ``reserve_...()`` functions. This
@@ -26,8 +27,9 @@ The layout of memory is set up before relocation, within the init sequence in
ending with the stack. This results in the maximum possible amount of memory
being left free for image-loading.
-The meminfo command writes the DRAM size, then the rest of its outputs in 5
-columns:
+The meminfo command writes the DRAM size. If the architecture also supports it,
+page table entries will be shown next. Finally the rest of the outputs are
+printed in 5 columns:
Region
Name of the region
@@ -99,28 +101,61 @@ free
Free memory, which is available for loading images. The base address of
this is ``gd->ram_base`` which is generally set by ``CFG_SYS_SDRAM_BASE``.
+Aarch64 specific flags
+----------------------
+
+More information on the output can be found
+Chapter D8 - The AArch64 Virtual Memory System Architecture at
+https://developer.arm.com/documentation/ddi0487/latest/
+
+In short, for a stage 1 translation regime the following apply:
+
+* RWX: Pages mapped with Read, Write and Execute permissions
+* RO: Pages mapped with Read-Only permissions
+* PXN: PXN (Privileged Execute Never) applies to execution at EL1 and above
+* UXN: UXN (Unprivileged Execute Never) applies to EL0
+
Example
-------
This example shows output with both ``CONFIG_CMD_MEMINFO`` and
-``CONFIG_CMD_MEMINFO_MAP`` enabled::
-
- => meminfo
- DRAM: 256 MiB
+``CONFIG_CMD_MEMINFO_MAP`` enabled for aarch64 qemu::
+
+ DRAM: 8 GiB
+ Walking pagetable at 000000023ffe0000, va_bits: 40. Using 4 levels
+ [0x0000023ffe1000] | Table | | |
+ [0x0000023ffe2000] | Table | | |
+ [0x00000000000000 - 0x00000008000000] | Block | RWX | Normal | Inner-shareable
+ [0x00000008000000 - 0x00000040000000] | Block | PXN UXN | Device-nGnRnE | Non-shareable
+ [0x00000040000000 - 0x00000200000000] | Block | RWX | Normal | Inner-shareable
+ [0x0000023ffea000] | Table | | |
+ [0x00000200000000 - 0x0000023f600000] | Block | RWX | Normal | Inner-shareable
+ [0x0000023ffeb000] | Table | | |
+ [0x0000023f600000 - 0x0000023f68c000] | Pages | RWX | Normal | Inner-shareable
+ [0x0000023f68c000 - 0x0000023f74f000] | Pages | RO | Normal | Inner-shareable
+ [0x0000023f74f000 - 0x0000023f794000] | Pages | PXN UXN RO | Normal | Inner-shareable
+ [0x0000023f794000 - 0x0000023f79d000] | Pages | PXN UXN | Normal | Inner-shareable
+ [0x0000023f79d000 - 0x0000023f800000] | Pages | RWX | Normal | Inner-shareable
+ [0x0000023f800000 - 0x00000240000000] | Block | RWX | Normal | Inner-shareable
+ [0x00000240000000 - 0x00004000000000] | Block | RWX | Normal | Inner-shareable
+ [0x0000023ffe3000] | Table | | |
+ [0x00004010000000 - 0x00004020000000] | Block | PXN UXN | Device-nGnRnE | Non-shareable
+ [0x0000023ffe4000] | Table | | |
+ [0x00008000000000 - 0x00010000000000] | Block | PXN UXN | Device-nGnRnE | Non-shareable
Region Base Size End Gap
------------------------------------------------
- video f000000 1000000 10000000
- code ec3a000 3c5d28 efffd28 2d8
- malloc 8c38000 6002000 ec3a000 0
- board_info 8c37f90 68 8c37ff8 8
- global_data 8c37d80 208 8c37f88 8
- devicetree 8c33000 4d7d 8c37d7d 3
- bootstage 8c32c20 3c8 8c32fe8 18
- bloblist 8c32000 400 8c32400 820
- stack 7c31ff0 1000000 8c31ff0 10
- free 0 7c31ff0 7c31ff0 0
-
+ video 23f7e0000 800000 23ffe0000
+ code 23f68a000 156000 23f7e0000 0
+ malloc 23e64a000 1040000 23f68a000 0
+ board_info 23e649f80 78 23e649ff8 8
+ global_data 23e649df0 188 23e649f78 8
+ devicetree 23e549df0 100000 23e649df0 0
+ bloblist 23e547000 2000 23e549000 df0
+ stack 23d546ff0 1000000 23e546ff0 10
+ lmb 23d546ff0 0 23d546ff0 0
+ lmb 23d543000 3ff0 23d546ff0 0
+ free 40000000 23d543000 27d543000 ffffffffc0000000
Return value
------------
diff --git a/doc/usage/cmd/mv.rst b/doc/usage/cmd/mv.rst
new file mode 100644
index 00000000000..99864371038
--- /dev/null
+++ b/doc/usage/cmd/mv.rst
@@ -0,0 +1,61 @@
+.. SPDX-License-Identifier: GPL-2.0+:
+
+.. index::
+ single: mv (command)
+
+mv command
+==========
+
+Synopsis
+--------
+
+::
+
+ mv <interface> [<dev[:part]>] <old_path> <new_path>
+
+Description
+-----------
+
+The mv command renames/moves a file or directory within a filesystem.
+
+interface
+ interface for accessing the block device (mmc, sata, scsi, usb, ....)
+
+dev
+ device number
+
+part
+ partition number, defaults to 0 (whole device)
+
+old_path
+ existing path to file/directory
+
+new_path
+ new path/name for the rename/move
+
+
+Example
+-------
+
+ # Rename file 'foo' in directory 'dir' to 'bar'
+ mv mmc 0:0 dir/foo dir/bar
+
+ # Move file 'f' from directory 'foo' to existing directory 'bar' renaming
+ # 'f' to 'g'
+ mv mmc 0:0 foo/f bar/g
+
+ # Move directory 'abc' in directory 'dir1' into existing directory 'dir2'
+ mv mmc 0:0 dir1/abc dir2
+
+Configuration
+-------------
+
+The mv command is only available if CONFIG_CMD_FS_GENERIC=y.
+
+Return value
+------------
+
+The return value $? is set to 0 (true) if the file was successfully
+renamed/moved.
+
+If an error occurs, the return value $? is set to 1 (false).
diff --git a/doc/usage/cmd/ut.rst b/doc/usage/cmd/ut.rst
index e794922c806..1acf3126680 100644
--- a/doc/usage/cmd/ut.rst
+++ b/doc/usage/cmd/ut.rst
@@ -11,34 +11,44 @@ Synopsis
::
- ut [-r<runs>] [-fs] [-I<n>:<one_test>] [<suite> [<test>]]
-
- <runs> Number of times to run each test
- -f Force 'manual' tests to run as well
- <n> Run <one test> after <n> other tests have run
- <one_test> Name of the 'one' test to run
- <suite> Test suite to run, or `all`
- <test> Name of single test to run
+ ut [-r<runs>] [-f] [-I<n>:<one_test>] [-r<n>] [<suite> | 'all' [<test>]]
+ ut [-s] info
Description
-----------
The ut command runs unit tests written in C.
+suite
+ Specifies the suite to run, This can be a single suite, or a comma-separated
+ list
+
+test
+ Speciifes a particular test to run, within a suite, or all suites
+
+-f
+ Forces running of a manual test.
+
+-r <n>
+ Specifies the number of types to run each test
+
+-I <n>:<one_test>
+ Test to run after <n> other tests have run. This is used to find which test
+ causes another test to fail. If the one test fails, testing stops
+ immediately.
+
Typically the command is run on :ref:`arch/sandbox/sandbox:sandbox` since it
includes a near-complete set of emulators, no code-size limits, many CONFIG
options enabled and runs easily in CI without needing QEMU. It is also possible
to run some tests on real boards.
-For a list of available test suites, type `ut info -s`.
-
Each test is normally run once, although those marked with `UTF_DM` are
run with livetree and flattree where possible. To run a test more than once,
use the `-r` flag.
Manual tests are normally skipped by this command. Use `-f` to run them. See
-See :ref:`develop/tests_writing:mixing python and c` for more information on
-manual test.
+:ref:`develop/tests_writing:mixing python and c` for more information on manual
+tests.
When running unit tests, some may have side effects which cause a subsequent
test to break. This can sometimes be seen when using 'ut dm' or similar. To
@@ -50,9 +60,22 @@ the problem.
Generally all tests in the suite are run. To run just a single test from the
suite, provide the <test> argument.
+To specify a list of suites to run, <suites> can also be a comma-separated list.
+
See :ref:`develop/tests_writing:writing c tests` for more information on how to
write unit tests.
+ut all
+~~~~~~
+
+Instead of a suite name 'all' may be used to run all tests.
+
+ut info
+~~~~~~~
+
+This provides information about the total number of suites and tests. Use the
+`-s` flag to show a detailed list of suites.
+
Example
-------
@@ -97,26 +120,84 @@ List available unit-test suites::
Run one of the suites::
- => ut bloblist
- Running 14 bloblist tests
- Test: bloblist_test_align: bloblist.c
- Test: bloblist_test_bad_blob: bloblist.c
- Test: bloblist_test_blob: bloblist.c
- Test: bloblist_test_blob_ensure: bloblist.c
- Test: bloblist_test_blob_maxsize: bloblist.c
- Test: bloblist_test_checksum: bloblist.c
- Test: bloblist_test_cmd_info: bloblist.c
- Test: bloblist_test_cmd_list: bloblist.c
- Test: bloblist_test_grow: bloblist.c
- Test: bloblist_test_init: bloblist.c
- Test: bloblist_test_reloc: bloblist.c
- Test: bloblist_test_resize_fail: bloblist.c
- Test: bloblist_test_resize_last: bloblist.c
- Test: bloblist_test_shrink: bloblist.c
- Failures: 0
+ => ut common
+ Running 14 common tests
+ Test: cli_ch_test: cread.c
+ Test: cread_test: cread.c
+ Test: dm_test_cyclic_running: cyclic.c
+ Test: print_display_buffer: print.c
+ Test: print_do_hex_dump: print.c
+ Test: print_efi_ut: print.c
+ Test: print_guid: print.c
+ Test: print_hexdump_line: print.c
+ Test: print_printf: print.c
+ Test: snprint: print.c
+ Test: test_autoboot: test_autoboot.c
+ Enter password "a" in 1 seconds to stop autoboot
+ Enter password "a" in 1 seconds to stop autoboot
+ Enter password "a" in 1 seconds to stop autoboot
+ Enter password "a" in 1 seconds to stop autoboot
+ Enter password "a" in 1 seconds to stop autoboot
+ Enter password "a" in 1 seconds to stop autoboot
+ Autoboot password unlock not successful
+ Test: test_event_base: event.c
+ Test: test_event_probe: event.c
+ Test: test_event_probe: event.c (flat tree)
+ Test: test_event_simple: event.c
+ Tests run: 14, 2611 ms, average 186 ms, skipped: 2, failures: 0
Run just a single test in a suite::
- => ut bloblist bloblist_test_grow
- Test: bloblist_test_grow: bloblist.c
- Failures: 0
+ => ut fdt_overlay change_int_property
+ Test: fdt_overlay_init: cmd_ut_fdt_overlay.c
+ Test: change_int_property: cmd_ut_fdt_overlay.c
+ Tests run: 2, 0 ms, average 0 ms, failures: 0
+
+Run a selection of three suites::
+
+ => ut bloblist,mem,fdt_overlay
+ Running 14 bloblist tests
+ Test: align: bloblist.c
+ Test: bad_blob: bloblist.c
+ Test: blob: bloblist.c
+ Test: blob_ensure: bloblist.c
+ Test: blob_maxsize: bloblist.c
+ Test: checksum: bloblist.c
+ Test: cmd_info: bloblist.c
+ Test: cmd_list: bloblist.c
+ Test: grow: bloblist.c
+ Test: init: bloblist.c
+ Test: reloc: bloblist.c
+ Test: resize_fail: bloblist.c
+ Test: resize_last: bloblist.c
+ Test: shrink: bloblist.c
+ Tests run: 14, 1 ms, average: 0 ms, failures: 0
+ Running 13 mem tests
+ Test: cp_b: mem_copy.c
+ Test: cp_l: mem_copy.c
+ Test: cp_q: mem_copy.c
+ Test: cp_w: mem_copy.c
+ Test: ms_b: mem_search.c
+ Test: ms_cont: mem_search.c
+ Test: ms_cont_end: mem_search.c
+ Test: ms_l: mem_search.c
+ Test: ms_limit: mem_search.c
+ Test: ms_mult: mem_search.c
+ Test: ms_quiet: mem_search.c
+ Test: ms_s: mem_search.c
+ Test: ms_w: mem_search.c
+ Tests run: 13, 13 ms, average: 1 ms, failures: 0
+ Running 10 fdt_overlay tests
+ Test: fdt_overlay_init: cmd_ut_fdt_overlay.c
+ Test: add_node_by_path: cmd_ut_fdt_overlay.c
+ Test: add_node_by_phandle: cmd_ut_fdt_overlay.c
+ Test: add_str_property: cmd_ut_fdt_overlay.c
+ Test: add_subnode_property: cmd_ut_fdt_overlay.c
+ Test: change_int_property: cmd_ut_fdt_overlay.c
+ Test: change_str_property: cmd_ut_fdt_overlay.c
+ Test: local_phandle: cmd_ut_fdt_overlay.c
+ Test: local_phandles: cmd_ut_fdt_overlay.c
+ Test: stacked: cmd_ut_fdt_overlay.c
+ Tests run: 10, 12 ms, average: 1 ms, failures: 0
+ Suites run: 3, total tests run: 37, 26 ms, average: 0 ms, failures: 0
+ Average test time: 0 ms, worst case 'mem' took 1 ms
diff --git a/doc/usage/cmd/wget.rst b/doc/usage/cmd/wget.rst
index 48bedf1e845..cc82e495a29 100644
--- a/doc/usage/cmd/wget.rst
+++ b/doc/usage/cmd/wget.rst
@@ -12,7 +12,9 @@ Synopsis
::
wget [address] [host:]path
- wget [address] url # lwIP only
+ wget [address] url # lwIP only
+ wget cacert none|optional|required # lwIP only
+ wget cacert <address> <size> # lwIP only
Description
@@ -54,6 +56,32 @@ address
url
HTTP or HTTPS URL, that is: http[s]://<host>[:<port>]/<path>.
+The cacert (stands for 'Certification Authority certificates') subcommand is
+used to provide root certificates for the purpose of HTTPS authentication. It
+also allows to enable or disable authentication.
+
+wget cacert <address> <size>
+
+address
+ memory address of the root certificates in X509 DER format
+
+size
+ the size of the root certificates
+
+wget cacert none|optional|required
+
+none
+ certificate verification is disabled. HTTPS is used without any server
+ authentication (unsafe)
+optional
+ certificate verification is enabled provided root certificates have been
+ provided via wget cacert <addr> <size> or wget cacert builtin. Otherwise
+ HTTPS is used without any server authentication (unsafe).
+required
+ certificate verification is mandatory. If no root certificates have been
+ configured, HTTPS transfers will fail.
+
+
Examples
--------
@@ -97,11 +125,61 @@ In the example the following steps are executed:
1694892032 bytes transferred in 492181 ms (3.3 MiB/s)
Bytes transferred = 1694892032 (65060000 hex)
+Here is an example showing how to configure built-in root certificates as
+well as providing some at run time. In this example it is assumed that
+CONFIG_WGET_BUILTIN_CACERT_PATH=DigiCertTLSRSA4096RootG5.crt downloaded from
+https://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt.
+
+::
+
+ # Make sure IP is configured
+ => dhcp
+ # When built-in certificates are configured, authentication is mandatory
+ # (i.e., "wget cacert required"). Use a test server...
+ => wget https://digicert-tls-rsa4096-root-g5.chain-demos.digicert.com/
+ 1864 bytes transferred in 1 ms (1.8 MiB/s)
+ Bytes transferred = 1864 (748 hex)
+ # Another server not signed against Digicert will fail
+ => wget https://www.google.com/
+ Certificate verification failed
+
+ HTTP client error 4
+ # Disable authentication to allow the command to proceed anyways
+ => wget cacert none
+ => wget https://www.google.com/
+ WARNING: no CA certificates, HTTPS connections not authenticated
+ 16683 bytes transferred in 15 ms (1.1 MiB/s)
+ Bytes transferred = 16683 (412b hex)
+ # Force verification but unregister the CA certificates
+ => wget cacert required
+ => wget cacert 0 0
+ # Unsurprisingly, download fails
+ => wget https://digicert-tls-rsa4096-root-g5.chain-demos.digicert.com/
+ Error: cacert authentication mode is 'required' but no CA certificates given
+ # Get the same certificates as above from the network
+ => wget cacert none
+ => wget https://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt
+ WARNING: no CA certificates, HTTPS connections not authenticated
+ 1386 bytes transferred in 1 ms (1.3 MiB/s)
+ Bytes transferred = 1386 (56a hex)
+ # Register them and force authentication
+ => wget cacert $fileaddr $filesize
+ => wget cacert required
+ # Authentication is operational again
+ => wget https://digicert-tls-rsa4096-root-g5.chain-demos.digicert.com/
+ 1864 bytes transferred in 1 ms (1.8 MiB/s)
+ Bytes transferred = 1864 (748 hex)
+ # The builtin certificates can be restored at any time
+ => wget cacert builtin
+
Configuration
-------------
The command is only available if CONFIG_CMD_WGET=y.
-To enable lwIP support set CONFIG_NET_LWIP=y.
+To enable lwIP support set CONFIG_NET_LWIP=y. In this case, root certificates
+support can be enabled via CONFIG_WGET_BUILTIN_CACERT=y
+CONFIG_WGET_BUILTIN_CACERT_PATH=<some path> (for built-in certificates) and/or
+CONFIG_WGET_CACERT=y (for the wget cacert command).
TCP Selective Acknowledgments in the legacy network stack can be enabled via
CONFIG_PROT_TCP_SACK=y. This will improve the download speed. Selective