NetworkBoot.org Blog posts related to network booting

I have been doing endpoint management for a long time. I started on SMS 2.0 – Microsoft Systems Management Server – back when there were rumors the product was going to be cancelled and it was not clear it would survive. It did. It became SCCM, then Configuration Manager, and a good chunk of this blog from 2010 to 2015 is me working through that era: OSD task sequences, building WinPE boot images, driver packages, collections and advertisements, the trickle install, TSConfig.INI, and running a task sequence after OSD. Then I moved on to other things and have not touched endpoint deployment in a while.

I wanted to catch up – to see how the new technology actually works now, not just read about it. So I rebuilt Windows 11 bare-metal in a dev environment from scratch, on purpose without a management server, to find out which parts have changed and which are exactly the same. This time I took it all the way: bare metal to a managed, Entra-joined machine with its apps installed.

What I built

A Windows 11 machine that PXE-boots with no install media attached and provisions itself end to end. The chain: PXE and DHCP hand the machine a boot file over TFTP; that chainloads iPXE, which uses wimboot to pull WinPE over HTTP; WinPE partitions the disk, pulls the Windows image over HTTP, applies it with DISM, writes the boot files – and, before it reboots, computes the machine’s Autopilot hardware hash and registers it with the tenant itself. The machine then reboots into the out-of-box experience, joins Entra, enrolls in Intune, and installs its apps. No distribution point, no site server, no client agent, and no one collecting a hardware hash by hand.

Bare-metal Windows 11 provisioning chain, top to bottom, from power-on through PXE, WinPE and DISM to cloud Entra join, Intune enrollment and apps
Power-on to a managed machine, top to bottom: on-prem boot plumbing, then WinPE, then cloud provisioning – no management server in the middle.

The old-to-new mapping

This is the part I actually wanted to see, and most of the pieces I knew are still here – they just moved. The OSD task sequence became a WinPE script doing a DISM apply, or, for the cloud path, Autopilot; the task sequence engine is gone and what is left is the primitives it was wrapping. The boot image I used to build inside Configuration Manager is still WinPE, still a boot.wim, but now I serve it over HTTP with wimboot instead of staging it on a distribution point – the same idea as my old WinPE wim/ISO post, fifteen years on. Driver injection is still a real problem: I hit the modern version of my own drivers-missing post when WinPE could not see the disk because the virtual SCSI controller had no inbox driver. The rest mostly maps one to one:

Configuration Manager Modern equivalent
Domain join and client push Entra join, Autopilot, Intune
Group Policy Intune configuration profiles
WSUS and the software update point Windows Update for Business and update rings
Collections and advertisements Intune groups and policies
Software distribution Intune apps delivered at enrollment

Apps moved out of the image

This was the biggest practical change. In the SCCM days I either baked applications into the image – the thick image – or laid them down in the task sequence. Now the image is just the operating system. Intune installs the applications after the machine enrolls: I deployed Office and Visual Studio Code, and the Enrollment Status Page holds the desktop until the required apps finish, which is the closest modern thing to a task sequence installing software before handing the machine over. One snag worth recording: the tenant did not have the Microsoft Store integration turned on, so Visual Studio Code could not go in as a Store app. It had to be a Win32 app, which meant building the .intunewin package and its encrypted upload myself instead of using the packaging tool. The primitives are still here, you just assemble them.

What is the same, and what is not

The same: under everything, bare-metal first boot is still DHCP, TFTP, and WinPE. If you want a machine to image itself from power-on, you are still standing up the same plumbing I was standing up in 2010. That surprised me – I expected the cloud to have absorbed more of it. I even had to add PowerShell to the WinPE boot image to make the registration call, the same optional-component surgery I did on boot images years ago.

What is not: the server in the middle is gone. SMS and then SCCM were one big box that did imaging, software, updates, inventory, and reporting. The modern version is disaggregated – PXE and WinPE for first boot, Autopilot for provisioning, Intune for management – and most of it is cloud-side. You assemble it from parts instead of installing one product, and you still need something to orchestrate the parts; mine is a CI pipeline. The other shift is identity: a device used to be identified after the fact by a client push, and now it is identified up front by a hardware hash you register before it ever boots. BIOS and MBR also gave way to UEFI, GPT, and a TPM, which Autopilot requires, and that bit me with a boot-loader detail that did not exist in the BIOS world.

Where I landed

It works end to end – power-on to a managed, Entra-joined Windows 11 machine with Office and VS Code installed, no management server in the path. The only manual step left is a single sign-in at the out-of-box experience with a work account; that is user-driven Autopilot. Self-deploying mode removes even that, but it needs a real, attestable TPM, which my virtual machine does not have – on physical hardware it would. Coming back to this after a decade, the surprise was not how much changed but how much did not: it is still WinPE and a boot.wim and DISM at the bottom, with the one big server in the middle replaced by a handful of cloud services you wire together yourself.
I started on SMS 2.0 when it was rumored for cancellation, did endpoint for years, then stepped away. I rebuilt a Windows 11 bare-metal install by hand to see how endpoint management is done now.
 https://www.jbmurphy.com/?p=8138 2026-06-10T02:50:08Z Jeffrey B. Murphy Jeffrey B. Murphy: Coming back to endpoint management: from SMS 2.0 to Autopilot

On June 3 through 5, Microsoft pushed about 40 Azure updates. Microsoft Foundry IQ went GA, Microsoft Discovery went GA, HorizonDB and DocumentDB kept extending, Azure Monitor kept closing the OpenTelemetry gap, and a cluster of agent-side updates landed that line up directly with the Agent Framework posts from June 1 and June 2. The Agent Framework follow-on is the most useful framing for the drop, so it goes first.

Follow-on to the Agent Framework posts

If you followed the Agent Framework posts last week, six of these updates are direct follow-ons. Part 1 walked from a single ChatClientAgent to one wired up to a remote MCP server. Part 2 ran three of them in a debate and gated a Jenkins deploy on the verdict. This week Microsoft shipped first-class versions of most of the moving parts those posts hand-rolled.

Agent-to-agent (A2A) for Prompt and Hosted agents in Foundry (preview)

The Part 2 debate was hand-rolled: three ChatClientAgents sharing a transcript across three rounds, with a judge persona constrained by a strict-format prompt. A2A is Microsoft formalizing exactly that pattern as a first-class Foundry primitive for prompt agents and hosted agents. Worth watching whether the preview converges on the same multi-round, single-transcript shape the debate post used, or on a different topology.

Rubric evaluator and Intelligent Trace Sampling evaluations (preview)

The judge persona in Part 2 was a hand-built rubric (VERDICT: APPROVE / BLOCK / NEEDS_HUMAN plus a confidence score). The rubric evaluator is the productized version of that pattern. Intelligent trace sampling is the answer to the question that breaks most agent-eval pipelines: how do you score the runs without paying to evaluate every single one. It picks representative traces instead of evaluating wall-to-wall.

Foundry for VS Code (GA, June Build 2026 refresh), code-first observability for Foundry Agents in VS Code (preview), and observability developer experience in Azure Developer CLI (preview)

Both Agent Framework posts were code-first Python against an agent-framework==1.0 install, run from a terminal. This week is Microsoft shipping the IDE and CLI dev loop for that exact workflow. The VS Code refresh is GA; the in-editor agent observability and the azd observability experience are both in preview. Pair them and the local agent dev loop in VS Code starts to look like the local API loop did five years ago.

Tool search in Foundry toolboxes (preview)

Part 1, example 3 connected to the Microsoft Learn remote MCP server as a tool source. Tool search is the catalog UX for that pattern once a Foundry toolbox holds more than one MCP server. Useful the moment a team has more than two or three.

Microsoft Foundry IQ (GA) and two new knowledge sources (preview)

Foundry IQ is the managed knowledge layer for grounding agents in enterprise data: connect SharePoint, OneLake, Azure Blob, and other sources, and Foundry IQ handles the retrieval pipeline that previously had to be rebuilt for each project. The MCP-server-as-tool-source pattern from Part 1 covers half of grounding; Foundry IQ packages the retrieval half behind one managed surface. The two new sources land alongside the GA: Azure SQL Database becomes a first-class knowledge source, and a Microsoft Fabric Ontology can be queried as a federated source. The Fabric Ontology one is the more interesting half. Agents query the semantic layer Fabric customers already curate, instead of a parallel definition built only for retrieval.

User feedback logging in Microsoft Foundry (preview)

Part 2 writes a PR comment and exits 0, 1, or 2. The Jenkins gate decides the next step; the eventual human verdict on whether the gate was right never makes it back into the agent. Feedback logging is the Foundry-native equivalent for capturing that verdict so the next evaluator run has a ground-truth signal to train against.

The pattern across all six is the one the agent space has been on for a year. A community or hand-rolled approach gets validated, then absorbed into a managed surface.

Microsoft Discovery (GA)

Microsoft Discovery is generally available as an enterprise platform for building and governing agentic AI workflows for R&D organizations across scientific and engineering disciplines. This was previewed earlier in the year. The GA is the signal that the agentic-workflow surface inside Microsoft is no longer just the Foundry Agent Service.

Foundry and AI Search platform updates

Four more Foundry and AI Search items that are not Agent Framework follow-ons but are worth knowing.

Private connectivity for AI Search and Foundry Knowledge Bases (GA)

Ingestion, enrichment, retrieval, and agent traffic between AI Search and Foundry Knowledge Bases can now stay on Shared Private Link or Network Security Perimeter end-to-end. Together with the Purview integration that went GA in the June 2 drop, the retrieval layer is closing the same governance and networking gaps the data-plane services closed years ago.

APIM support for Foundry Models in Azure AI Search (preview)

Azure API Management can now front all Foundry model integrations used by Azure AI Search. The reason this matters for platform teams: it puts a single throttling, key-vault, and observability surface between AI Search and the underlying model deployments, instead of each search workload calling models directly.

Content Understanding chunking and image verbalization in AI Search (preview)

The Content Understanding pipeline can now chunk and verbalize images as part of AI Search indexing. The output is searchable text derived from images, which lets a single retrieval query span text and visual content.

Domain filter in the Foundry model catalog (preview)

The Foundry model catalog adds a domain filter that narrows the 1,900-plus models to the ones trained for a specific industry or use case, with filters for domains like robotics and biomedical sciences. A small UX change, but the catalog crossed the size where browse-by-name stopped scaling a while ago. This is the model-catalog equivalent of the tool search update above – the same problem (too many things in the catalog) solved one layer down.

Databases

HorizonDB AI pipelines (preview)

HorizonDB, the Postgres-compatible database introduced in the June 2 drop, now lets you describe an AI ingestion workflow (chunking, embedding, extraction, generation, ranking) declaratively in SQL and run it as a fault-tolerant pipeline inside the engine. Same play as the rest of HorizonDB: keep the RAG pipeline on the operational database instead of stitching together a separate service per stage.

DocumentDB advanced full-text search (preview)

Advanced full-text search lands in DocumentDB, alongside the instant free-tier clusters that shipped on June 2. HorizonDB and DocumentDB are clearly the two databases Microsoft wants to push for new workloads.

Postgres Flexible Server DuckDB extension (GA)

The DuckDB extension is now GA in Azure Database for PostgreSQL Flexible Server. DuckDB-in-Postgres turns the operational instance into a competent analytics endpoint for parquet and CSV in blob storage without moving the data. For the small-to-medium analytics that do not justify a Fabric or Synapse footprint, this is the simplest viable answer.

Azure Monitor

Three Monitor updates landed together and all went GA.

OTLP ingestion is GA: send OpenTelemetry Protocol signals straight from instrumented applications and platforms to Azure Monitor with no Application Insights SDK in between. Dynamic thresholds for log search alerts went GA, so the platform calculates the threshold instead of asking the operator to guess. And Azure Monitor Service Level Indicators reached GA. Combined with the simple log alerts and OpenTelemetry metrics that shipped on June 2, Azure Monitor is methodically closing the gap with the open observability stack.

A day later, on June 5, Metrics Usage Insights added an Ingestion Volume Change dashboard in preview, for comparing ingestion volume over time and spotting spikes or drops in time-series counts and event ingestion rates. It is a cost-and-noise control surface more than an observability one – the dashboard you open when the Monitor bill jumps and you need to know which stream moved.

Confidential computing

Three updates on the confidential side. Confidential Clean Rooms gets a preview of multiparty analytics, a managed service for partners to jointly analyze privacy-sensitive datasets with Apache Spark without exposing the underlying data. Confidential live migration for Intel TDX VMs is in development, which is the last big operational gap separating confidential VMs from regular ones. And Azure Confidential Ledger gains a GA backup tool for audit retention of ledger files.

GitHub Copilot modernization agent (GA)

The GitHub Copilot modernization agent is GA. It coordinates application assessments and upgrades across a whole portfolio, not just a single repo. For the Java-on-old-Spring or .NET-Framework migration backlog most enterprises still carry, this is the first serious estate-wide automation Microsoft has shipped.

Migration

Azure Files assessments worldwide in Azure Migrate (GA)

Azure Migrate now discovers and assesses SMB and NFS file shares hosted on Windows and Linux servers, worldwide. File shares were the awkward gap in most migrate-to-Azure-Files plans: you could assess the servers but had to size and plan the share targets by hand. This closes that gap and gives a data-driven view of the file-share estate. Read it alongside the Copilot modernization agent above – one is the estate-level story for application code, this is the estate-level story for file data.

App Service Flex Consumption: rolling updates (GA)

Rolling updates are GA in the Flex Consumption plan. Instead of restarting all instances during a deploy, the platform rolls them. Zero-downtime deploys on Flex no longer need a slot-swap or external front door.

Compute

Lasv5 and Laosv5 storage-optimized VMs (preview)

Storage-optimized VM series based on the 5th-generation AMD EPYC (Turin). Lasv5 targets high disk capacity, throughput, and I/O. Laosv5 targets the same shape with a different storage profile.

Azure Infrastructure Resiliency Manager (preview)

A new preview service for orchestrating resiliency testing and recovery across an Azure estate. It sits in the same conversation as Chaos Studio but framed for the resiliency-program owner rather than the SRE writing fault-injection experiments.

Guest RDMA on Azure Boost (private preview)

Landing on June 5, Guest RDMA is in preview on Azure Boost, starting in UK South, bringing high-throughput, ultra-low-latency RDMA networking directly into guest VMs within a region. Offloaded to Azure Boost, this is the kind of networking that used to require specialized HPC SKUs showing up as a general guest-VM capability – the part that matters for tightly-coupled HPC and AI-training traffic that is sensitive to latency between nodes.

Speech, voice, and language

MAI-Voice-2 is in preview in Foundry. Custom Voice portal and self-serve custom photo avatar creation both went GA. Voice Live API also picks up avatar voice sync with custom voices in preview, pairing a branded or persona-specific text-to-speech voice with a real-time avatar – the piece that ties the custom-voice and custom-avatar tracks together. On the language side, Text Analytics for Health NextGen Playground is GA, and the Conversational and Text PII NextGen playgrounds shipped updates. The pattern: the NextGen playgrounds are now the default front door for the language services.

Region

Azure Red Hat OpenShift is GA in Belgium Central.
On June 3 through 5, Microsoft pushed about 40 Azure updates. Microsoft Foundry IQ went GA, Microsoft Discovery went GA, HorizonDB and DocumentDB kept extending, Azure Monitor kept closing the OpenTelemetry gap, and a cluster of agent-side updates landed that line up directly with the Agent Framework posts from June 1 and June 2. The […]
 https://www.jbmurphy.com/?p=8137 2026-06-05T15:15:32Z Jeffrey B. Murphy Jeffrey B. Murphy: Azure Build Update Part 2
PXE Booting on the Steam Deck
 https://littleknife.dev/blog/2022/08/02/pxe-booting-on-the-steam-deck/ 2022-08-02T00:00:00Z Antony Messerli Antony Messerli: PXE Booting on the Steam Deck 2021-02-23T00:00:00+00:00 2021-02-23T00:00:00+00:00 https://toreanderson.github.io/2021/02/23/ipv6-support-in-the-playstation-5 <p>Almost five years after I <a href="/2016/06/15/ipv6-support-in-the-playstation-4.html">wrote about the PlayStation 4’s lacklustre IPv6 support</a>, I have finally managed to get my hands on the PlayStation 5 – and I have of course taken a close look at its IPv6 capabilities.</p> <h2 id="does-the-playstation-5-support-ipv6-at-all">Does the PlayStation 5 support IPv6 at all?</h2> <p>It does indeed! In the <em>View Connection Status</em> page of the network settings, it displays any assigned IPv6 address, gateway and DNS server; right next to their IPv4 counterparts.</p> <p><img src="/images//ipv6-support-in-the-playstation-5/connection-status.jpg" alt="Connection Status" /></p> <p>This is a clear improvement over the PS4, whose IPv6 support was not acknowledged by the user interface at all.</p> <h2 id="what-does-the-the-ps5-use-ipv6-for">What does the the PS5 use IPv6 for?</h2> <p>Not much, really. I have seen it use IPv6 for the following:</p> <ul> <li><code class="language-plaintext highlighter-rouge">IN AAAA</code> DNS queries.</li> <li>A HTTP <code class="language-plaintext highlighter-rouge">GET</code> request towards <code class="language-plaintext highlighter-rouge">http://ena.net.playstation.net/netstart/ps4</code> <em>[sic]</em> immediately after connecting to the network. The response from the server is <code class="language-plaintext highlighter-rouge">403 Forbidden</code>. As I observed back in 2016, the PS4 did the exact same thing.</li> <li>HTTPS requests towards <code class="language-plaintext highlighter-rouge">https://image.api.playstation.com</code> while browsing the PlayStation Store app.</li> <li>The Netflix app uses IPv6 for both API/metadata and video traffic. Interestingly enough the Netflix app appears to use its own built-in stub resolver with 8.8.8.8 as its upstream, so its <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries are using IPv4 transport.</li> </ul> <p>I have also seen it perform <code class="language-plaintext highlighter-rouge">IN AAAA</code> DNS queries for several IPv4-only <code class="language-plaintext highlighter-rouge">*.playstation.com</code> and <code class="language-plaintext highlighter-rouge">*.playstation.net</code> domain names.</p> <p>Some other things that appear to be IPv4-only include:</p> <ul> <li><code class="language-plaintext highlighter-rouge">IN A</code> DNS queries.</li> <li>Logging in to the PlayStation Network.</li> <li>Browsing the PlayStation Store (except for images as previously noted).</li> <li>Downloading games and media apps from the PlayStation Store.</li> <li>Syncing game trophy lists.</li> <li>Playing videos with the NRK TV, Twitch and YouTube media apps.</li> <li>Online multiplayer with Fortnite.</li> <li>The built-in Internet speed test.</li> </ul> <h2 id="technical-implementation-details">Technical implementation details</h2> <ul> <li>It does not realy support IPv6-only networks. If there’s no DHCPv4 service on the network, it will claim that the network connection failed. But Netflix works regardless, see below.</li> <li>It supports SLAAC, the RA <em>RDNSS Option</em> and DHCPv6 – both stateful and stateless.</li> <li>If no IPv6 DNS server is being provided by the RA <em>RDNSS Option</em> or DHCPv6 it will not configure IPv6 addressing or routing either. This is probably because…</li> <li>…it uses its IPv4 DNS server for all <code class="language-plaintext highlighter-rouge">IN A</code> DNS queries, and its IPv6 DNS server for all <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries.</li> <li>When using SLAAC, the Interface ID appears to be randomised and changes on every reconnect.</li> <li>If <code class="language-plaintext highlighter-rouge">OnLink=0</code> is present in the RA <em>Prefix Information Option</em>, it will not configure an address using SLAAC even though <code class="language-plaintext highlighter-rouge">Autonomous=1</code>. This is probably a bug.</li> <li>If <code class="language-plaintext highlighter-rouge">Managed=1</code> in the RA, it will use stateful DHCPv6 to obtain an address using <code class="language-plaintext highlighter-rouge">IA_NA</code>. It will also request DNS servers in the same exchange.</li> <li>Stateful DHCPv6 address assignment through <code class="language-plaintext highlighter-rouge">IA_NA</code> works fine even though there is no <em>Prefix Information Option</em> in the RAs.</li> <li>If addresses are available from both stateful DHCPv6 and SLAAC, it will prefer the one from DHCPv6. The UI only shows a single globally scoped IPv6 address.</li> <li>If <code class="language-plaintext highlighter-rouge">Managed=0</code> and <code class="language-plaintext highlighter-rouge">OtherConfig=1</code> in the RA, it will use stateless DHCPv6 to obtain DNS servers.</li> <li>If <code class="language-plaintext highlighter-rouge">OtherConfig=1</code>, it will prefer DNS servers learned from DHCPv6 over any learned from the RA RDNSS Option. If <code class="language-plaintext highlighter-rouge">OtherConfig=0</code>, the opposite is true.</li> </ul> <p>The PS5 was running system software version 20.02-2.50.00.08-00.00.00.0.1 during my testing.</p> <h2 id="ipv6-only-and-dns64nat64">IPv6-only and DNS64/NAT64</h2> <p>If there is no DHCPv4 service on the LAN, the network settings UI will say <strong>Failed</strong> for both <em>Wired LAN 1</em> and <em>Internet connection</em>. In spite of that, the <em>View Connection Status</em> page does show an IPv6 address, DNS server and gateway. Not much work in this state, I mostly encounter errors saying <em>You’re offline</em>, <em>No Internet connection available</em>, and so forth. The exception is the Netflix app, which continues to work just fine! (It is now using the system IPv6 DNS server instead of 8.8.8.8.)</p> <p>If I keep DHCPv4 disabled but start advertising a DNS64-enabled DNS server, the PS5 still claims that <em>Wired LAN 1</em> and <em>Internet connection</em> is <strong>Failed</strong>. However the <em>View PlayStation Network Status</em> page has begun working (this is just an embed of <a href="https://status.playstation.com">https://status.playstation.com</a>). Twitch also starts working (using NAT64 for its Internet traffic). Fortnite, NRK TV, PlayStation Store and YouTube, on the other hand, still do not work.</p> <p>Lastly, if I re-enable DHCPv4 while leaving DNS64/NAT64 in place, it does not seem to be using IPv6 via NAT64 for much. PlayStation Store downloads, Fortnite, NRK TV and YouTube continue to use IPv4 only.</p> <h2 id="conclusion">Conclusion</h2> <p>The PS5 does support IPv6, and the Netflix app proves that IPv6 connectivity is available for use. Apart from Netflix, though, there is not much use of IPv6. That goes both for the system software and its bundled apps, as well as for third-party apps and games.</p> <p>Some of that might be attributable to a lack of IPv6 support on the server side, as evidenced by <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries for hostnames that have no IPv6 addresses. On the other hand, when I use DNS64 to make those <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries be answered, it doesn’t really make much of a difference – IPv4 is still preferred most of the time.</p> <p>Furthermore, most of the PS5 apps and games I tested do not make any <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries in the first place, so DNS64/NAT64 would not help in any case.</p> <p>Thus software upgrades would be necessary to make these apps and games fully IPv6 capable. The YouTube app is a good example of this; it is well known that the YouTube servers supports IPv6, but their PS5 app never issues any <code class="language-plaintext highlighter-rouge">IN AAAA</code> queries, so it ends up using IPv4 for its video traffic.</p> Almost five years after I wrote about the PlayStation 4’s lacklustre IPv6 support, I have finally managed to get my hands on the PlayStation 5 – and I have of course taken a close look at its IPv6 capabilities. Tore AndersonTore Anderson: IPv6 support in the PlayStation 5 http://blog.zorinaq.com/boot-win10-over-usb/ 2020-05-29T00:00:00+02:00 <p>When I buy a laptop, the first thing I do is netboot into a PXE Linux environment and make a full raw disk image backup of the pre-installed Windows OS. I pipe <code class="language-plaintext highlighter-rouge">dd if=/dev/sda</code> or <code class="language-plaintext highlighter-rouge">dd if=/dev/nvme0n1</code> into <code class="language-plaintext highlighter-rouge">lz4</code> (much faster than <code class="language-plaintext highlighter-rouge">gzip</code>) and write the image on a fileserver. No matter how large the disk is, the image usually shrinks down to 20-30 GB because, well, there are usually only 20-30 GB of files on the drive. The empty NTFS blocks compress very well.</p> <p>I then wipe Windows and install a Linux distribution.</p> <p>Years later when I donate or sell the laptop, I restore the raw disk image. Not only does this restore the Windows OEM image, but because all sectors are overwritten, it <em>securely wipes</em> the disk. Very good for security.</p> <p>The image backup I made turned out very useful today. I needed to update the firmware for the trackpoint of my ThinkPad X1 Carbon laptop. However the firmware update is <em>only</em> possible using a <a href="https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-type-20hr-20hq/downloads/ds122148">Windows 10 utility</a>.</p> <h2 id="booting-from-usb">Booting from USB</h2> <p>Here is how I got Windows running on my laptop, without reimaging or swapping or repartitioning the internal drive.</p> <h3 id="write-the-image-to-a-usb-drive">Write the image to a USB drive</h3> <p>I wrote the factory Windows 10 disk image to an external USB drive (<code class="language-plaintext highlighter-rouge">unlz4 &lt;image.lz4 &gt;/dev/sda</code>). Being a full disk image, it includes 4 partitions: EFI System partition, Microsoft Reserved partition, Basic data partition, Recovery partition.</p> <h3 id="set-bootdriverflags-to-0x14">Set BootDriverFlags to 0x14</h3> <p>If you try to boot from the external USB drive as is, Windows 10 will error out during boot (INACCESSIBLE_BOOT_DEVICE).</p> <p>The key to make it work is to edit the obscure registry value BootDriverFlags to change it from 0x0 to 0x14. The value is located under <code class="language-plaintext highlighter-rouge">HKLM\SYSTEM\HardwareConfig\{...uuid...}</code> and can be edited by mounting the C: partition in Linux, and using the <code class="language-plaintext highlighter-rouge">chntpw</code> utility:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ chntpw -e /path/to/mounted/Windows/System32/config/SYSTEM </code></pre></div></div> <p>List the <code class="language-plaintext highlighter-rouge">{...uuid...}</code> subkey under <code class="language-plaintext highlighter-rouge">HardwareConfig</code>:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>&gt; ls HardwareConfig Node has 1 subkeys and 2 values key name &lt;{ca7bc4cc-350d-11b2-a85c-95cecf0de0fa}&gt; size type value name [value if type DWORD] 78 1 REG_SZ &lt;LastConfig&gt; 4 4 REG_DWORD &lt;LastId&gt; 0 [0x0] </code></pre></div></div> <p>Edit BootDriverFlags with <code class="language-plaintext highlighter-rouge">ed</code> to set it to 0x14:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>&gt; ed HardwareConfig\{ca7bc4cc-350d-11b2-a85c-95cecf0de0fa}\BootDriverFlags EDIT: &lt;HardwareConfig\{ca7bc4cc-350d-11b2-a85c-95cecf0de0fa}\BootDriverFlags&gt; of type REG_DWORD (4) with length 4 [0x4] DWORD: Old value 0 [0x0], enter new value (prepend 0x if hex, empty to keep old value) -&gt; 0x14 DWORD: New value 20 [0x14], </code></pre></div></div> <p>Finally save the changes with <code class="language-plaintext highlighter-rouge">q</code>:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>&gt; q </code></pre></div></div> <p>BootDriverFlags is so obscure that it is barely documented. Some online resources say the value is under <code class="language-plaintext highlighter-rouge">HKLM\System\CurrentControlSet\Control</code> or <code class="language-plaintext highlighter-rouge">HKLM\SYSTEM\HardwareConfig\</code> but they are wrong. The value is under <code class="language-plaintext highlighter-rouge">HKLM\SYSTEM\HardwareConfig\{...uuid...}</code>.</p> <p>That is it. Changing a single registry key is all that is needed to make an OEM Windows 10 image boot from a USB drive.</p> 2020-05-29T00:00:00+02:00Marc BevandMarc Bevand: Booting unmodified Windows 10 over USB 2020-01-11T00:00:00+00:00 2020-01-11T00:00:00+00:00 https://toreanderson.github.io/2020/01/11/get-ipv6-ftth <p><a href="https://www.get.no">Get</a> (<a href="https://www.telia.no">Telia</a>’s fixed broadbrand brand in Norway) has recently launched an opt-in IPv6 pilot available to their their fibre customers. I am happy to report that it works great and scores 10/10 on <a href="https://test-ipv6.com">test-ipv6.com</a>.</p> <p>I first learned about this in <a href="https://www.digi.no/artikler/innsikt-har-du-bare-gammeldags-internett-her-er-ipv6-planene-til-flere-norske-internettleverandorer/480306?key=Phnt5PTg">this article</a> (Norwegian), where Get states that they provide IPv6 to a handful of test customers on fibre.</p> <p>To join the pilot I simply had to ask their customer service. Shortly after I received an e-mail with the new configuration settings: static IPv4 /30 and IPv6 /64 WAN link networks plus a static IPv6 /56 prefix for use on the LAN side. (They do not use Neighbour Discovery or DHCPv6 for automatic configuration.)</p> <p>My understanding is that Get can currently not configure their own CPE to act as an IPv6 router, so it is necessary to bring your own HGW and leave the Get CPE in bridge mode.</p> <p>I am very happy to have native IPv6 at home again, and really hope that Get will roll this out to all of their other FTTH customers in the near future.</p> Get (Telia’s fixed broadbrand brand in Norway) has recently launched an opt-in IPv6 pilot available to their their fibre customers. I am happy to report that it works great and scores 10/10 on test-ipv6.com. Tore AndersonTore Anderson: IPv6 on Get FTTH tag:blogger.com,1999:blog-8009822662942276789.post-5126831580586440512 2017-07-14T19:31:00.000+02:00 2017-07-15T11:49:42.724+02:00 La presente <i>guida</i> ha funzionato per me, su <b>Fedora 26</b>. Probabilmente è valida per altre distribuzioni di GNU/Linux (usando il gestore di pacchetti opportuno).<br /> Guida per modo di dire, poiché i passi da seguire sono veramente semplici.<br /> Alla fine del conto per installare il lettore e la Carta Nazionale dei Servizi (o Tessera Sanitaria), la <a href="http://www.regione.toscana.it/servizi-online/servizi-sicuri/carta-sanitaria-elettronica/guida-all-uso">procedura descritta sul sito della Regione Toscana</a>&nbsp; si rivela macchinosa e inutile.<br /> Viene qui usato un lettore di smartcard B4ID<br /> La carta invece è quella che sul sito della Regione viene identificata come <i>modello 2</i> (AT2012).<br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivYY4iC5wLIkTXCs7g5Dg0gX7lzcYhqsWuig6OAXd3tw03ovXe6fKSZhggHDbyJLBGiYakHohibygc4M60eMB_H8PeP0_v2fTz0-RVf17_zK45cMW9P4UeruWG6pLDEsUKOPbdwWzGCqY/s1600/IMG_20170714_104124.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1600" data-original-width="1422" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivYY4iC5wLIkTXCs7g5Dg0gX7lzcYhqsWuig6OAXd3tw03ovXe6fKSZhggHDbyJLBGiYakHohibygc4M60eMB_H8PeP0_v2fTz0-RVf17_zK45cMW9P4UeruWG6pLDEsUKOPbdwWzGCqY/s320/IMG_20170714_104124.jpg" width="284" /></a></div> <br /> <h2> Installare i pacchetti</h2> Installate PC/SC Lite (Middleware to access a smart card using SCard API)<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo dnf install pcsc-tools</span><br /> <br /> Collegate il lettore e lanciare il comando:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">pcsc_scan -n</span><br /> <br /> Inserite la carta nel lettore. Dovrebbe apparire qualcosa del genere:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">Fri Jul 14 19:51:49 2017<br />Reader 0: ACS ACR 38U-CCID 00 00<br />&nbsp; Card state: Card inserted, <br />&nbsp; ATR: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX X</span><br /> <br /> Quindi ok, il lettore funziona. <br /> Se non funziona: SPIPPOLATE.<br /> <br /> Abilitate il servizio e fatelo partire:<br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;"><br /></span> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo systemctl start pcscd<br />sudo systemctl enable pcscd.service</span><br /> <br /> Installate OpenSC (<span class="col-11 text-gray-dark mr-2" itemprop="about">Open source smart card tools and middleware):</span><br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo dnf install opensc</span><br /> <br /> <h2> Firefox </h2> Andate in Preferenze -&gt; Avanzate -&gt; Certificati<br /> Quindi Dispositivi di Sicurezza<br /> Pigiate sul tasto Carica<br /> Come nome del modulo mettete quel che vi pare<br /> <span style="line-height: 1.4;">Specificate quindi il percorso della libreria: <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">/usr/lib64/opensc-pkcs11.so</span></span><br /> <span style="line-height: 1.4;">Premete ok.</span><br /> <br /> <span style="line-height: 1.4;">A questo punto dovreste vedere un nuovo device.</span><br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhASqCdu1giiVlD04Jcl7BzOBHPwKQwXN7aFEydrB3ewTj1XI3B0CcXdDrNYZ6pPH1wtG34ccQ4guSgmCyb-YV-TYYDv4XVKWxweLsr2Ja8fkHYPcERpdFke3vkUyJcCFBeFMOEqdVWAFI/s1600/Screenshot+from+2017-07-14+11-10-14.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="723" data-original-width="1464" height="315" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhASqCdu1giiVlD04Jcl7BzOBHPwKQwXN7aFEydrB3ewTj1XI3B0CcXdDrNYZ6pPH1wtG34ccQ4guSgmCyb-YV-TYYDv4XVKWxweLsr2Ja8fkHYPcERpdFke3vkUyJcCFBeFMOEqdVWAFI/s640/Screenshot+from+2017-07-14+11-10-14.png" width="640" /></a></div> <span style="line-height: 1.4;"></span><br /> <span style="line-height: 1.4;">Inserendo la carta dovrebbe apparire il nominativo e il codice fiscale.</span><br /> <span style="line-height: 1.4;"><br /></span> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTqVDYpeDp96rNFS78vzoor2-7nkygxDp9QQG3Odu6MADzileZAP-GvdOb9_mZ4sHdznbiErU3kfftzFAXeghNOTfsYplysaQakhVaGpsP_kT-qJweI83hnkdiCoDiByUGJ56YL20Qs-o/s1600/Screenshot+from+2017-07-14+11-10-30.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="768" data-original-width="1520" height="322" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTqVDYpeDp96rNFS78vzoor2-7nkygxDp9QQG3Odu6MADzileZAP-GvdOb9_mZ4sHdznbiErU3kfftzFAXeghNOTfsYplysaQakhVaGpsP_kT-qJweI83hnkdiCoDiByUGJ56YL20Qs-o/s640/Screenshot+from+2017-07-14+11-10-30.png" width="640" /></a></div> <span style="line-height: 1.4;">Premendo su Login dovrebbe venire richiesto il PIN della carta.</span><br /> <span style="line-height: 1.4;"><br />Ora potete</span><span style="line-height: 1.4;"> provare l'effettivo funzionamento collegandovi a un sito che richiede l'autenticazione via CNS, come per esempio <a href="https://accessosicuro.rete.toscana.it/">https://accessosicuro.rete.toscana.it</a> (dove trovate, fra l'altro, il Fascicolo Sanitario elettronico), oppure <a href="https://iris.rete.toscana.it/">https://iris.rete.toscana.it/</a> (per i pagamenti online della Regione Toscana). oppure il sito dell'INPS.</span><br /> <span class="col-11 text-gray-dark mr-2" itemprop="about"><br /></span> <span class="col-11 text-gray-dark mr-2" itemprop="about">Con la tessera sanitaria è anche possibile richiedere le </span>credenziali <b>SPID</b>, il Sistema Pubblico di Identità Digitale: <a href="https://www.spid.gov.it/richiedi-spid#altre-modalita">https://www.spid.gov.it/richiedi-spid#altre-modalita</a> 1 Al CirAl Cir: Firefox: usare la CNS su Fedora tag:blogger.com,1999:blog-8009822662942276789.post-1119143540077071419 2017-07-12T18:30:00.001+02:00 2017-07-12T18:36:26.558+02:00 <h2> </h2> <h3> </h3> The Raspberry Pi is the most famous SBC (Single-Board Computer). It is a recent news that over five millions of units were sold since it came out.<br /> <br /> There are a lot of Linux-based and not Linux-based operating systems that runs on the Raspberry: Fedora is one of the latest landed in this platform. Due to this fact, many things still don’t work: for instance, according to what you can read on the Fedora wiki, expansion HATs, composite TV out, analog sound port and the add-on camera are not yet supported; support for displays other than the official one is not currently planned, GPIO isn't well supported. In addition Fedora supports only Pi version 2 and later.<br /> Obviously the Raspberry Pi Foundation recommends the use of Raspbian, a Debian-based Linux operating system. And as stated before, there are many distributions that have been around for a long time, therefore they probably work better on such platform. Compared to the rest of the world Fedora on ARM could look at early stages of development.<br /> Then, due to these facts the question could be: why using Fedora on the Raspberry Pi when there are more feature rich and widely used distributions? The answer is: isn’t Fedora our favorite distro? So let’s give a try to the ARM version.<br /> Side note: ARM is an architecture officially supported by Fedora.<br /> <br /> Let’s get started.<br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNheKtixDDxCoECsyXoR2vfW_XNKw3wCmVt3v-um_8NaAWZY7BqZhyphenhyphenP0yJ4_CanpqZuw83n6P65-pY_E4GpH87xRMqlg_2mH8Bs9XvWtE9yPSvmxEkfqUOQCu0fXeCnMc31xnf_ickYYM/s1600/Screenshot+from+2017-07-12+15-58-34.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="374" data-original-width="1196" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNheKtixDDxCoECsyXoR2vfW_XNKw3wCmVt3v-um_8NaAWZY7BqZhyphenhyphenP0yJ4_CanpqZuw83n6P65-pY_E4GpH87xRMqlg_2mH8Bs9XvWtE9yPSvmxEkfqUOQCu0fXeCnMc31xnf_ickYYM/s640/Screenshot+from+2017-07-12+15-58-34.png" width="640" /></a></div> <br /> <h2> Preparing the SD card</h2> The installation of the Fedora ARM image on an SD card is simple as these two steps:<br /> <br /> - download the raw image of your choice (in this case Minimal) from <a href="https://arm.fedoraproject.org/">https://arm.fedoraproject.org/</a><br /> <br /> - run this command (supposing you are running Fedora on your PC and that you have installed the fedora-arm-installer package via DNF)<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo arm-image-installer --image=Fedora-Minimal-armhfp-26-1.5-sda.raw.xz --target=rpi3 --norootpass --resizefs --media=/dev/mmcblk0 -y</span><br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;"><br /></span> Please refer to <a href="https://fedoraproject.org/wiki/Architectures/ARM/Raspberry_Pi?rd=Raspberry_Pi#Preparing_the_SD_card">the Fedora wiki</a>.<br /> <br /> Such command will blanks the root password (remember to subsequently set one during first setup) and it will automatically resize the root partition in order to fill up the SD card size.<br /> <br /> Once done, remove the SD card from your PC.<br /> <br /> <h2> The serial console</h2> If you do not have an HDMI screen to connect to the Raspberry Pi, or if you want to run a completely <b>headless</b> box, you have to enable the serial console.<br /> <br /> The task is different between the Raspberry 2 and 3. These steps are for the version 3:<br /> <br /> - insert the SD card in your PC, it should automatically mount three partitions<br /> <br /> - edit the file extlinux.conf<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo vim /run/media/<i>youruser</i>/__boot/extlinux/extlinux.conf</span><br /> <br /> add "<span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">console=tty0 console=ttyAMA0,115200</span>" to the end of the append line<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">append ro root=UUID=<i>&lt;uuid-uuid&gt;</i> console=tty0 console=ttyS0,115200</span><br /> <br /> - edit the <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">config.txt</span> file in the root partiton<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo vim /run/media/<i>youruser</i>/<i>sometinglike-4AC9-BABE</i>/config.txt</span><br /> uncomment the <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">enable_uart</span> line:<br /> <br /> enable_uart=1<br /> <br /> <h2> The onboard wifi adapter</h2> If you want to enable the onboard WiFi adapter, you have to download a file that Fedora can not currently redistribute in the raw image:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo curl https://raw.githubusercontent.com/RPi-Distro/firmware-nonfree/master/brcm80211/brcm/brcmfmac43430-sdio.txt -o /run/media/youruser/__/lib/firmware/brcm/brcmfmac43430-sdio.txt</span><br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">&nbsp;</span> <br /> <h2> Booting the Raspberry</h2> Umount the three partitions, using something like<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">umount /run/media/<i>youruser</i>/__boot ; umount /run/media/<i>youruser</i>/__ ; umount /run/media/<i>youruser</i>/</span><span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;"><i>sometinglike-4AC9-BABE</i></span><br /> <br /> Then insert the SD card in the Raspberry Pi, connect an Usb to Serial/TTL Adapter (the pin 8 on the Raspberry is the TX and pin 10 is the RX). Then power up the device.<br /> <br /> You can look at the boot process using a terminal emulator program like minicom or GTKterm, or even the simple screen command:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">screen&nbsp; /dev/ttyUSB0 115200</span><br /> <br /> <script async="" id="asciicast-KsNYUBmTfWOCYmcWha6yRrpvb" src="https://asciinema.org/a/KsNYUBmTfWOCYmcWha6yRrpvb.js" type="text/javascript"></script> Once the boot process will reach the end, you should see the Fedora initial setup where you can create an account, set the root password, configure the timezone, etc.<br /> <br /> As soon as you log in, if the Raspberry is connected to the network using the Ethernet interface, and there is a DHCP server in the LAN, you are almost done. Check if you are really online and perform a system update:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">sudo dnf update</span><br /> <br /> <h2> Setup the wifi</h2> If for some reason you can’t use the Ethernet interface and you need to connect to the WiFi network, you have to configure the wireless interface using the Network Manager command line interface (nmcli).<br /> <br /> For instance, if your network uses WPA or WPA2, and there is a DHCP this task is pretty simple:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli radio</span><br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli device wifi connect <i>YOURSSID</i> password <i>secretpassword</i></span><br /> <br /> If you need to set up a static IP there are instead various steps to perform:<br /> <br /> Add a connection profile and set the IP/netmask and the default gateway<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli con add con-name <i>ConnectionName</i> ifname wlan0 type wifi ssid <i>YOURSSID</i> ip4 <i>192.168.100.200/24</i> gw4 <i>192.168.100.1</i></span><br /> <br /> Set up the DNS<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli con modify <i>ConnectionName</i> ipv4.dns "<i>8.8.8.8 8.8.4.4</i>"</span><br /> <br /> Configure the wireless security (in this case wpa-psk) and the password<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli con modify <i>ConnectionName</i> wifi-sec.key-mgmt wpa-psk</span><br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli con modify <i>ConnectionName</i> wifi-sec.psk <i>verysecurepassword</i></span><br /> <br /> Now you can bring up the connection:<br /> <br /> <span style="font-family: &quot;courier new&quot; , &quot;courier&quot; , monospace;">nmcli con up ConnectionName</span><br /> <br /> <h2> Conclusion</h2> Here we have an headless and wireless Raspberry Pi 3 running our favorite GNU/Linux distribution! <br /> <br /> Please refer to the Fedora Project wiki for more and up to date informations:<br /> <a href="https://fedoraproject.org/wiki/Raspberry_Pi">https://fedoraproject.org/wiki/Raspberry_Pi </a> 0 Al CirAl Cir: How to install Fedora 26 on the Raspberry Pi (Headless and Wireless)
Booting Linux ISOs with Memdisk and iPXE
 https://littleknife.dev/blog/2016/01/07/booting-linux-isos-with-memdisk-and-ipxe/ 2016-01-07T00:00:00Z Antony Messerli Antony Messerli: Booting Linux ISOs with Memdisk and iPXE
netboot.xyz
 https://littleknife.dev/blog/2015/11/25/netboot-xyz/ 2015-11-25T00:00:00Z Antony Messerli Antony Messerli: netboot.xyz
Booting VMware ESXi in iPXE
 https://littleknife.dev/blog/2015/02/11/booting-vmware-esxi-in-ipxe/ 2015-02-11T00:00:00Z Antony Messerli Antony Messerli: Booting VMware ESXi in iPXE 2014-06-03T00:00:00+00:00 http://litanyagainstfear.com/2014/06/03/reattaching-ipmi-memory-to-a-x8sil-f <p>So, in my last post I had sucessfully removed a flash memory chip from my X8SIL-F. The next step was to attach the &#8216;emulator&#8217; to the motherboard, and attach the connector to another flash chip. This requires lots of t<br /> iny little soldering, which is quite annoying to do. I was ultimately successful, though it took a good 6 hours to accomplish.</p> <ul> <li>Attach some small wires to the socket. These will eventually be connected to the flash chip. I used bits of the conductor from some stranded speaker wire I had. Lacking any sort of third hard, I just hot glue<br /> d the wires and the socket to my desk. You don&#8217;t actually need to connect all the pins, it&#8217;s safe to just connect the outer three on each side. (Look at the <a href="http://datasheet.octopart.com/MX25L12845EMI-10G-Macronix-datasheet-12526005.pdf">datasheet</a> for the pinout).</li> </ul> <p><img src="/files/ipmi_socket.jpg" title="Half soldered IPMI socket"></p> <ul> <li>Bend the legs up, reinforce them with hot glue.</li> </ul> <ul> <li>Solder the flash chip on</li> </ul> <p>You&#8217;ll end up with something that looks like this</p> <p><img src="/files/removable_ipmi.jpg" title="Removable IPMI flash"></p> <p>If you solder somewhat carefully and don&#8217;t cover up the pins on the top you can still fit a Pomona clip on top. This makes it easy to program.</p> <ul> <li>Solder the &#8216;emulator&#8217; onto the motherboard. This looks terrible, but works. I needed magnification to find all the tiny solder bridges I created.</li> </ul> <p><img src="/files/motherboard_header.jpg" title="X8SIL Motherboard Header"></p> <ul> <li>Program the new memory chip with the standard firmware, attach to header.</li> </ul> <p><img src="/files/flash_attached.jpg" title="Flash memory attached"></p> <ul> <li>Moment of truth! Power on the board. If you&#8217;ve done everything correctly, the <span class="caps">IPMI</span> controler should boot up. The &#8216;<span class="caps">IPMI</span> Health Indicator&#8217; (that green circle in the previous image) should start flashing, and the controller should pull a <span class="caps">DHCP</span> leasse.</li> </ul> <p>If your controller doesn&#8217;t work, make sure you haven&#8217;t created any solder bridges. Also make sure that everything is properly attached.</p> <p>After all this, I now have the ability to flash whatever firmware I want and not have to worry about bricking the controller. I can just remove the chip and reflash it if something doesn&#8217;t work. Ultimately, I&#8217;m hoping to find a hidden serial port (the bootloader and kernel are both configured to output things on a serial port, I just don&#8217;t know where it is) which would let me program things in circut.</p> <p>Of course, getting the &#8216;<span class="caps">SDK</span>&#8217; to compile properly, and emit a usable flash image is a whole other story&#8230; one I&#8217;m still <a href="https://github.com/devicenull/supermicro_ipmi_firmware">working on</a></p> 2014-06-03T00:00:00ZBrian RakBrian Rak: Reattaching IPMI Memory to a X8SIL-F
Building and Booting Debian Live Over the Network
 https://littleknife.dev/blog/2014/05/17/building-and-booting-debian-live-over-the-network/ 2014-05-17T00:00:00Z Antony Messerli Antony Messerli: Building and Booting Debian Live Over the Network 2014-02-02T00:00:00+00:00 http://litanyagainstfear.com/2014/02/02/supermicro-ipmi-firmware-x8sil-f-analysis <p>I&#8217;ve been looking into modifying the SuperMicro <span class="caps">IPMI</span> firmware. It&#8217;s full of bugs and lacks some features that would make it useful to manage many servers at once. Step one was figuring out what the existing firmware looks like. For this, I&#8217;m using the X8SIL-F board (This was the cheapest board w/<span class="caps">IPMI</span> controller that I could find).</p> <p>So, I downloaded the firmware image (SMT_313.bin inside SMT_313.zip) and ran it through binwalk:</p> <pre class="highlight"> $ binwalk SMT_313.bin DECIMAL HEX DESCRIPTION ------------------------------------------------------------------------------------------------------------------- 59700 0xE934 Copyright string: " (c) Winbond Limited 2001 - 2006. All rights reserved.6. All rights reserved." 60835 0xEDA3 Copyright string: " 1995-1998 Mark Adler termination" 1572864 0x180000 CramFS filesystem, little endian size 8118272 version #2 sorted_dirs CRC 0x9236f037, edition 0, 5000 blocks, 1012 files 9961472 0x980000 Zip archive data, at least v2.0 to extract, compressed size: 1124880, uncompressed size: 2331112, name: "kernel.bin" 11086482 0xA92A92 End of Zip archive 12058624 0xB80000 CramFS filesystem, little endian size 1970176 version #2 sorted_dirs CRC 0xc7723bfb, edition 0, 948 blocks, 210 files </pre> <p>These are some interesting results, we have two CramFS filesystems as well as a kernel image. There&#8217;s also a whole bunch of unknown data at the beginning of the image. Using the binwalk data, I looked through the entire image with hexdump. It turns out there&#8217;s a custom bootloader at the beginning of the image, as well as a whole bunch of empty space.</p> <p>This is what I came up with:<br /> <pre class="highlight">0&#215;0 0xfa40: Looks like a winbound bootloader &#8220;W90P710 Command Shell&#8221;<br /> 0xfa40 0&#215;180000: empty<br /> 0&#215;180000 0&#215;93dea0: cramfs filesystem (root filesystem)<br /> 0&#215;93dea0 0&#215;93e000: empty<br /> 0&#215;93e000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br /> 0&#215;93e010 0&#215;93ffc0: empty<br /> 0093ffc0 ff ff ff ff ff ff ff ff ff ff ff ff 02 00 00 00 |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br /> 0093ffd0 00 00 18 40 00 e0 7b 00 00 00 d0 00 00 00 d0 00 |&#8230;<code>..{.........| 0093ffe0 31 73 74 46 53 00 00 00 00 00 00 00 00 00 00 00 |1stFS...........| 0093fff0 0a 2c c1 ae 9f ff ff a0 08 00 00 00 c7 80 96 27 |.,.............'| 00940000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| 0x940010 0x980000: empty 0x980000 0xa92ac0: kernel image 0xa92ac0 0xa9ffc0: empty 0xa9ffc0 ff ff ff ff ff ff ff ff ff ff ff ff 03 00 00 00 |................| 0xa9ffd0 00 00 98 40 a8 2a 11 00 00 80 00 00 00 80 00 00 |...</code>.*&#8230;&#8230;&#8230;.|<br /> 0xa9ffe0 6b 65 72 6e 65 6c 00 00 00 00 00 00 00 00 00 00 |kernel&#8230;&#8230;&#8230;.|<br /> 0xa9fff0 23 f5 cc 9c 9f ff ff a0 17 00 00 00 aa 0e 16 13 |#&#8230;&#8230;&#8230;&#8230;&#8230;|<br /> 0xaa0000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br /> 0xaa0010 0xb80000: empty<br /> 0xb80000 0xd604d0: cramfs filesystem (web ui)<br /> 0xd604d0 0xd61000: empty<br /> 0xd61000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br /> 0xd61010 0xd6ffb0: empty<br /> 0xd6ffb0 ff ff ff 41 54 45 4e 73 5f 46 57 03 13 71 8c 61 |&#8230;ATENs_FW..q.a|<br /> 0xd6ffc0 29 9f 17 ff ff ff ff ff ff ff ff ff 04 00 00 00 |)&#8230;&#8230;&#8230;&#8230;&#8230;|<br /> 0xd6ffd0 00 00 b8 40 00 10 1e 00 00 00 d0 00 00 00 d0 00 |&#8230;@&#8230;&#8230;&#8230;&#8230;|<br /> 0xd6ffe0 32 6e 64 46 53 00 00 00 00 00 00 00 00 00 00 00 |2ndFS&#8230;&#8230;&#8230;..|<br /> 0xd6fff0 ac 1c 9c 9a 9f ff ff a0 08 00 00 00 22 65 89 3b |&#8230;&#8230;&#8230;&#8230;&quot;e.;|<br /> 0xd70000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br /> 0xd70010 0&#215;1000000: empty</pre></p> <p>It seems that the root linux image (aka 1stFS) is entirely separate from the web UI fiels (aka 2ndFS). I suspect that this firmware is based on the <span class="caps">ATEN</span> <span class="caps">SDK</span>, and that it was meant to be easy to customize the web UI (so that different manufacturers can use the same code, but have different looks). This means it should be quite easy to replace the entire frontend. However, the kinds of issues that I&#8217;m aiming to fix run far deeper then that.</p> <p>Before looking at what&#8217;s actually in the firmware, I decided to check out the &#8220;<span class="caps">SDK</span>&#8221; SuperMicro gave me. I&#8217;d been harassing them to give me an updated package of <span class="caps">GPL</span> code for their firmware, and they finally came through a couple weeks ago. This file is named <a href="ftp://ftp.supermicro.com/GPL/SMT/SDK_SMT_X9_317.tar.gz">SDK_SMT_X9_317.tar.gz</a>, and can be found on ftp.supermicro.com (though, that link seems pretty constant).</p> <p>They provide a Makefile, which compiles most of whats there. That&#8217;s not entirely useful to us, but some of the other files they include are.</p> <p>images/bootloader_pcb_rev_b.bin this looks suspiciously like the bootloader from our image. Let&#8217;s extract it and find out!</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="nv">$ </span>dd <span class="k">if</span><span class="o">=</span>SMT_313.bin <span class="nv">of</span><span class="o">=</span>bootloader <span class="nv">bs</span><span class="o">=</span><span class="m">1</span> <span class="nv">count</span><span class="o">=</span>64040 64040+0 records in 64040+0 records out <span class="m">64040</span> bytes <span class="o">(</span><span class="m">64</span> kB<span class="o">)</span> copied, 0.0795194 s, <span class="m">805</span> kB/s <span class="nv">$ </span>md5sum bootloader 166162c6c9f21d7a710dfd62a3452684 bootloader <span class="nv">$ </span>md5sum images/bootloader_pcb_rev_b.bin 166162c6c9f21d7a710dfd62a3452684 images/bootloader_pcb_rev_b.bin</code></pre></div><p>Awesome, this bootloader appears to be some pretty standard software, so we shouldn&#8217;t have to worry about any customizations that may have been made to it. A quick look inside the bootloader (with `strings`) shows some interesting things:</p> <pre class="highlight"> WPCM450 Boot Loader [ Version:1.0.14 ] W90P710 Command Shell v1.0 Rebuilt on Mar 23 2012 at 17:48:54 usage: D -[w,h,b,s] &lt;taddr&gt; -w, -W Word alignment -h, -H Half-word alignment -b, -B Byte alignment -s, -S Swap target &lt;taddr&gt; Target memory address. Displaying memory at 0x%X usage: E -[w,h,b,s] &lt;taddr&gt; -a Active image -c Image needs to be copy to RAM -x Executable image -f File system image -z Compressed image -nofooter No footer be written Usage: DEL [ImageNo.] [b{blockNo.}] [-all] [ImageNo.] Delete the image [b{blockNo.}] Delete the block -all Delete all blocks -net_mac [0,1] Set active MAC number -mac[0,1] [addr] Set MAC Address -ip[0,1] [ip addr] IP Address -dhcp [1,0] Enable/Disable Dhcp client -baudrate [baud rate setting] Set the default baud rate -sn [serial number] Set the serial number Program the flash by TFTP. FT -? for help Program the flash by Xmodem. FX -? for help </pre> <p>So, it looks like there&#8217;s a serial console here that we can use to reprogram the flash. That&#8217;s pretty handy, though I currently have no idea how to access the serial console (there&#8217;s no obvious headers on the board). It also looks like we can just grab the images via <span class="caps">TFTP</span>, which is nice. I&#8217;d rather not try to get Xmodem working.</p> <p>Poking around the image some more, I came across MKIMG_Tool/Host/<span class="caps">HERMON</span>/Board/SuperMicro_X7SB3/mkbin.inf, which further confirmed the flash layout I had manually discovered:<br /> <pre class="highlight">bootloader_pcb_rev_b.bin = 0<br /> out_rootfs_img.bin = 0&#215;180000<br /> out_kernel.bin = 0&#215;980000<br /> out_webfs_img.bin = 0xB80000</pre></p> <p>There&#8217;s also a binary in here (mkbin), though it segfaults whenever I try to run it. Looking at `strings` output again, I suspect we can replicate all the functionality with dd and not a whole lot of effort.</p> <p>Though it doesn&#8217;t help us, you can also find the default ntp.conf file (<span class="caps">NTP</span>/etc/ntp.conf). This lacks the correct configuration, which is why we see <span class="caps">IPMI</span> controllers taking part in <span class="caps">NTP</span> reflection attacks.</p> <p>While it&#8217;s interesting they&#8217;ve implemented a new bootloader (rather then using something like U-Boot), that&#8217;s not exactly helpful to us. The bootloader isn&#8217;t part of any of the bugs that need fixing, so let&#8217;s move on the root filesystem. We need to pull it from the image and extract it:</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="nv">$ </span>dd <span class="k">if</span><span class="o">=</span>SMT_313.bin <span class="nv">of</span><span class="o">=</span>cramfs1 <span class="nv">skip</span><span class="o">=</span><span class="m">1572864</span> <span class="nv">count</span><span class="o">=</span><span class="k">$((</span><span class="m">9961472</span><span class="o">-</span><span class="m">1572864</span><span class="k">))</span> <span class="nv">bs</span><span class="o">=</span>1 8388608+0 records in 8388608+0 records out <span class="m">8388608</span> bytes <span class="o">(</span>8.4 MB<span class="o">)</span> copied, 9.49599 s, <span class="m">883</span> kB/s <span class="nv">$ </span>file cramfs1 cramfs1: Linux Compressed ROM File System data, little endian size <span class="m">8118272</span> version <span class="c">#2 sorted_dirs CRC 0x9236f037, edition 0, 5000 blocks, 1012 files</span> <span class="nv">$ </span>mkdir mount cramfs1_extract <span class="nv">$ </span>sudo mount -o loop ./cramfs1 mount<span class="p">;</span> <span class="nb">cd </span>mount mount: warning: mount seems to be mounted <span class="nb">read</span>-only. <span class="nv">$ </span>sudo tar -cf - . <span class="p">|</span> sudo tar -C ../cramfs1_extract/ -xpf -</code></pre></div><p>This copies everything to cramfs1_extract (you could look through everything in mount, but you can&#8217;t make any changes that way). Looking around, there are various bits of standard linux software:</p> <ul> <li>BusyBox v1.12.0 (2014-01-02 18:15:33 <span class="caps">PST</span>) &#8211; This version of BusyBox is from 2008</li> <li>lighttpd/1.4.23 (Jan 2 2014 18:16:36) &#8211; Lighttpd from 2009</li> <li>Dropbear 2013.60 &#8211; It&#8217;s interesting that this is so much newer</li> <li>Openwsman 2.1.0 &#8211; 2008 again</li> <li>ntpd 4.2.4p4@1.1520 Fri Jan 3 02:24:48 <span class="caps">UTC</span> 2014 (55) &#8211; From 2007, not 2014!</li> <li>sfcbd 1.3.2 &#8211; 2008</li> </ul> <p>There&#8217;s also a whole bunch of custom software:</p> <ul> <li>/bin/ivkmserver &#8211; Remote <span class="caps">KVM</span>, most likely</li> <li>/bin/uiso &#8211; This is probably the &#8220;virtual media&#8221; daemon</li> <li>/bin/LanNotifier</li> <li>Various kernel modules: usb_hid, vcddev</ul> <p>And, we can see it mount the web UI files:<br /> <pre class="highlight">mount -t cramfs /dev/mtdblock4 /web</pre></p> <p>Only one user has a password by default (though, I&#8217;m not sure what this auth is used for other then ssh):<br /> <pre class="highlight">root:$1$9X8dqhm3$zuZISagav2MF3yWHBrWQ8/:14396:0:99999:7:::</pre></p> <p>Google shows that this is apparently the hash for &#8216;atenuser&#8217;. Not surprising.</p> <p>At this point, we know we have a standard <span class="caps">ARM</span> Linux system, and we know the basic structure of the flash image. I&#8217;m still waiting on my board to be delivered, so I can&#8217;t currently test modifying the image.</p> 2014-02-02T00:00:00ZBrian RakBrian Rak: SuperMicro IPMI Firmware (X8SIL-F) Analysis 2013-11-25T00:00:00+00:00 http://litanyagainstfear.com/2013/11/25/edgemax-and-ipxe <p>Recently, I needed to reinstall one of my machines at home. My choices were find a <span class="caps">USB</span> drive and setup the installer or finally get around to setting up network installs. At this point I can setup network installs in my sleep, so that was the better choice. I use an Edgemax router at home, which is based on Vyatta. Figuring out the configuration necessary to do this took longer then anything else.</p> <p>For reference:</p> <pre class="highlight"> set service dhcp-server global-parameters "if exists user-class and option user-class = &amp;quot;iPXE&amp;quot; {" set service dhcp-server global-parameters "filename &amp;quot;/iPXE.conf&amp;quot;;" set service dhcp-server global-parameters " } else { " set service dhcp-server global-parameters "filename &amp;quot;ipxe.pxe&amp;quot;;" set service dhcp-server global-parameters "}" set service dhcp-server global-paramters "next-server TFTPSERVERIP;" </pre> <p>I&#8217;m only using <span class="caps">TFTP</span> here, but it&#8217;s just as easy to use <span class="caps">HTTP</span>.</p> 2013-11-25T00:00:00ZBrian RakBrian Rak: Edgemax and iPXE 2013-11-14T00:00:00+00:00 http://litanyagainstfear.com/2013/11/14/ipxe-wimboot-and-windows-server-2012r2 <p>Recently, I&#8217;ve been trying to get iPXE and wimboot to boot the Windows Server 2012R2 installer. This uses WinPE 5.0, which is still very new at this point. In this version of WinPE, the compression scheme used for bootmgr has changed, and iPXE no longer recognizes it. This leads to errors such as &#8216;no embedded bootmgr.exe found&#8217;, and ultimately &#8216;<span class="caps">FATAL</span>: no bootmgr.exe&#8217;.</p> <p>The fix for this is pretty easy, you want to use bootmgr.exe directly, instead of relying on wimboot to extract it from bootmgr. You can find bootmgr.exe inside the &#8216;boot.wim&#8217; file you get from WinPE. Mount this (using the Windows <span class="caps">ADK</span>) and bootmgr.exe can be found in mount\Windows\Boot\<span class="caps">PXE</span>\bootmgr.exe. Make sure you update your initrd line to contain bootmgr.exe instead of just bootmgr, so you&#8217;d end up with:</p> <pre class="highlight"> kernel wimboot initrd bootmgr.exe bootmgr.exe initrd boot/bcd BCD initrd boot/fonts/wgl4_boot.ttf wgl4_boot.ttf initrd boot/fonts/chs_boot.ttf chs_boot.ttf initrd boot/fonts/cht_boot.ttf cht_boot.ttf initrd boot/fonts/jpn_boot.ttf jpn_boot.ttf initrd boot/fonts/kor_boot.ttf kor_boot.ttf initrd boot/boot.sdi boot.sdi initrd sources/boot.wim boot.wim </pre> 2013-11-14T00:00:00ZBrian RakBrian Rak: iPXE, wimboot and Windows Server 2012R2 2013-11-05T00:00:00+00:00 http://litanyagainstfear.com/2013/11/05/lessons-learned-from-a-very-large-server-deployment <p>It&#8217;s that time of year again for us. The time of year where we deploy massive numbers of servers in a very short period of time. This year we deployed around 1000 servers to 23 locations. That&#8217;s a <strong>lot</strong> of work to get done in two weeks, but we&#8217;ve managed to do it. There are things that went very well, things that merely went ok, and things that were terrible.</p> <p>We&#8217;re on our third generation (well, third generation since I&#8217;ve been here) OS installation system. I&#8217;ve talked about how this works in other posts, but the short version is that without iPXE, none of this would have been possible. We ended up having a central image server per location, which made all the installs speedy (though we did manage to peg the install servers gigabit ethernet link multiple times). This also isolated us from any transient network issues that may have occured. This entire system worked wonderfully. For a very large majority of servers, we didn&#8217;t have to do anything other then turn them on. The entire process from bare metal to fully configured machine was automated, and all the time spent refining that process was well spent.</p> <p>More recently then I would have liked, we&#8217;ve also developed similar systems to automatically configure all the <span class="caps">IPMI</span> controllers, and provide us with the ability to manage them all centrally. Having a &#8216;View <span class="caps">KVM</span>&#8217; button within our server management system made troubleshooting broken installs that much simpler. There was no tracking down which <span class="caps">IPMI</span> controller went to which machine, nor remembering to firewall off all the <span class="caps">IPMI</span> controllers from the internet. Having a list of all the new machines in a location, and their status (configured or not) made confirming the physical installs were done simple.</p> <p>While we use local mirrors for the initial OS install, we were still relying on one central mirror for our other software. This ended up being a source of delays (23 locations remember, the vast majority of them were not close enough to get great download speeds), as well as causing some failures. Next year we&#8217;ll definitely have to distribute this content globally. I&#8217;ll probably end up investigating geo-replicated file systems to make this a more transparent process.</p> <p>Speaking of other software, we were surprised mid-deployment by a Cygwin update that broke sshd. We heavily rely on sshd for mangagement and configuration, so this led to a paniced debugging session. We ended up rolling back to the previous Cygwin release by using the &#8216;Cygwin Time Machine&#8217;. The lesson here is to freeze all your software dependencies before starting a large rollout. This only ended up breaking around 50 machines, so it wasn&#8217;t a ton of wasted work.</p> <p>Unsurprisingly, the other big source of issues was the physical hardware itself. Most of our deployment was Supermicro. Supermicro (at least from our reseller) doesn&#8217;t seem to believe in issuing unique serial numbers for their hardware. Dell, for example, has the service tag prominently displayed on the outside of the machine. This means you can retrieve it from the OS, and go tell remote hands to look for it. Or, you can retrieve a list of all the known ones, and tell remote hands to go investigate any missing ones. With Supermicro, we ended up tracking all this by <span class="caps">MAC</span> address. We keep track of the <span class="caps">MAC</span> addresses of all the servers, and use our networking gear to tell us which <span class="caps">MAC</span> is on which switch port. We can then tell which switch ports the broken machines are on, and make remote hands trace cables. This process has it&#8217;s uses, but it&#8217;s not great for this kind of setup. I&#8217;m not certain how we can fix this in the future, it still requires some thought.</p> <p>This has been the quickest and easiest deployment we&#8217;ve done so far. It&#8217;s not as quick and easy as I&#8217;d like, but we&#8217;re definitely moving in the right direction. We&#8217;ve come a long way from manually imaging, configuring, and shipping boxes. The only way forward is more automation!</p> 2013-11-05T00:00:00ZBrian RakBrian Rak: Lessons learned from a very large server deployment 2013-09-04T00:00:00+00:00 http://litanyagainstfear.com/2013/09/04/network-booting-with-sr-iov <p>I&#8217;ve been doing some research into using <span class="caps">KVM</span> to virtualize some of our machines. Our workloads are very latency sensitive, and require excellent network performance. We have hardware (Intel I350 Chipset) that supports SR-<span class="caps">IOV</span>. SR-<span class="caps">IOV</span> is pretty cool, each network card exposes 7 different &#8216;virtual functions&#8217; (virtual network cards), as well as one &#8216;physical function&#8217; (used by the host). Each of these VFs can be mapped to an individual virtual machine. This isn&#8217;t emulation, the VM is communicating directly with the network card. This decreases latency (one less emulation step) and increases performance. We&#8217;ve seen significant performance gains from using this, despite the extra complexity it adds.</p> <p>As part of our virtualization setup, we rely on iPXE to get the machine running and installed. We&#8217;re currently doing fresh installs for each virtual machine, so network booting is essential. Virtual functions, however, do not have any access to the onboard option rom, so they have no way of <span class="caps">PXE</span> booting. This is actually pretty easy to fix by making qemu load iPXE.</p> <p>Step 1) Compile a rom for your network card. iPXE has this process pretty <a href="http://ipxe.org/howto/romburning">well documented</a> . For my card, I had a <span class="caps">PCI</span> ID of 8086:1520. I used <a href="http://rom-o-matic.eu">rom-o-matic</a> to compile my rom file. Copy this file to the host somewhere</p> <p>Step 2) Edit your libvirt interface definition to include a <rom> entry, like so:</p> <div class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt">&lt;interface</span> <span class="na">type=</span><span class="s">&#39;network&#39;</span><span class="nt">&gt;</span> <span class="nt">&lt;source</span> <span class="na">network=</span><span class="s">&#39;sriov&#39;</span><span class="nt">/&gt;</span> <span class="nt">&lt;rom</span> <span class="na">bar=</span><span class="s">&#39;on&#39;</span> <span class="na">file=</span><span class="s">&#39;/root/80861520.rom&#39;</span><span class="nt">/&gt;</span> <span class="nt">&lt;/interface&gt;</span></code></pre></div><p>Reboot, and you should see iPXE start up. This was actually a lot easier then I was expecting it to be.</p> 2013-09-04T00:00:00ZBrian RakBrian Rak: Network booting with SR-IOV 2013-08-09T00:00:00+00:00 http://litanyagainstfear.com/2013/08/09/the-evolution-of-our-windows-installation-methods <p>In the beginning there was G4L (Ghost for Linux). Lacking any sort of <span class="caps">PXE</span> system, we shipped a cdrom in each server. Reimaging a server meant rebooting it from the cd drive, and grabbing the image via <span class="caps">FTP</span>. This was actually an effective hack, and appears to have worked quite well. Next, we went to a basic pxelinux setup (still using G4L). While better in some regards (no shipping cds in every drive), it was not quite optimal. G4L suffers from the problem of not understanding <span class="caps">NTFS</span>, so you end up with a 1:1 copy of every sector of the hard disk. This means restores take forever, and take longer the bigger your disks.</p> <p>After awhile, we switched to Clonezilla. This was a significant improvement, as it uses Partimage to create the images. Partimage can tell the difference between unused and in use blocks. This significantly decreased the amount of time needed to image a server (we were now able to image multiple batches of servers in a day, limited only by the amount of power available). Clonezilla was nice, as it offered an all in one setup, and didn&#8217;t require that you understand how everything was working. This is where I got hooked on <span class="caps">PXE</span>. At this point, we still had minimal automation for the setup process. We had a simple batch script that would prompt you for the IP/hostname of a machine, and do the necessary configs. This script was on a <span class="caps">USB</span> drive that moved from machine to machine.</p> <p>Our initial deployment of Clonezilla used it as part of <span class="caps">DRBL</span>. <span class="caps">DRBL</span> has some fancy scripts that guide you through the entire setup process, and abstract away a lot of what&#8217;s going on. <span class="caps">DRBL</span> lasted awhile, as it took me some time to understand all the different moving parts that go along with network bootring. The main reason we dropped <span class="caps">DRBL</span> was because it would blow away the entire pxelinux.cfg menu every time you made a change.</p> <p>Up next was your basic PXELinux stack. We had a <span class="caps">DHCP</span> server, <span class="caps">TFTP</span>, and <span class="caps">NFS</span> (for images). This was what we deployed worldwide, and is still in use in some of our locations. We still use Clonezilla for Windows images, but we boot the <span class="caps">PXE</span> version, and no longer rely on <span class="caps">DRBL</span> to set things up for us. We also started to use public IPs for the setup process. This gave us a significant advantage during mass deployments, as it means you can directly connect to the servers from a remote location to finish the setup process.</p> <p>I developed some automation here, but it was fairly fragile. A <span class="caps">PHP</span> script was launched on the first login to the machine (and the machine was configured to automatically login on the first boot). This would attempt to pull down network configurations from a central machine, and would configure the network, then wait for someone to acknowledge the configuration before restarting. The acknowledgement was important, as the machine needed to be properly labeled and sent to the correct location. We&#8217;d often be configuring the machines for multiple locations at a time, so labeling was important.</p> <p>Somewhat later, I developed a batch script that did all the necessary software configuration with minimal human interaction. This was significant as before we would manually follow a checklist when setting up machines. That was moderately effective, but you would always end up with machines where some critical step had been missed. We ended up with various scripts that checked for various pieces of software over and over again (as you couldn&#8217;t rely on any software being present).</p> <p>Next up comes iPXE. This replaces PXELinux, and gives us a couple advantages. One big one is we can now generate configuration files on the fly. This lets us keep track of what machines have already been imaged and default to booting from the local drive instead of overwriting the drive. It also lets us improve our Linux install process (we pull down an IP via <span class="caps">DHCP</span>, and statically configure that on the machine). We&#8217;re still relying on Clonezilla to restore the images, but we&#8217;re pushing down IP configurations to make it more automated (and reliable).</p> <p>That&#8217;s where we are today. My current plan is to get rid of all the images, and switch to doing Windows installs via the network. iPXE has enough documentation on this to get you to booting the Windows installer successfully. From there, unattend.xml will get you through the rest of the Windows installer. The big advantage with this is that hardware configuration no longer matters. There&#8217;s no need to maintain a ton of different images for each different hardware configuration. There&#8217;s no keeping track of which image works where. It&#8217;s just start the installer and go. I&#8217;m also developing a Python app to grab relevant software configurations. Python works a bit better in this case, as I can compile it to a single exe (yay PyInstaller) which makes it easier to copy over and launch from unattend.xml.</p> <p>I&#8217;ve looked into various Windows specific solutions (<span class="caps">AIK</span>, <span class="caps">RDS</span>, etc), but they all seem to want too much control over the process. I wouldn&#8217;t have nearly as much control over the installation process if I switched. Somewhat more importantly, I can deploy our entire iPXE system automatically with Puppet. I can&#8217;t do that with the Windows specific systems (well, <span class="caps">SCCM</span> might be able to, but that&#8217;s an extra license fee and a significant amount of work. I have heard that <span class="caps">SCCM</span> is only worth it if you have people to devote to it).</p> 2013-08-09T00:00:00ZBrian RakBrian Rak: The evolution of our Windows installation methods <p>So, a while ago I decided that I wanted to invite the core developers of the <a href="https://ipxe.org/">iPXE project</a> to my home for an extended weekend of hacking on the project. The agenda was to try and merge as many outstanding patches and pull requests that we knew about. The work the various students did as part of GSoC 2012 was on the priority list. The three people that were able to come were Michael Brown, Thomas Miletich and Marin Hannache.</p><p><strong>TL;DR: Skip down to the summary at the bottom.</strong></p><h3 id="thursday-11th-of-july">Thursday 11th of July</h3><p>After a busy day cleaning the house and making things ready for the arrival of the guests I headed down to Sandefjord airport (TRF) to pick up Michael. His plane was scheduled to arrive around midnight. He had brought a test machine padded in a large suitcase which packed the car quite full. Luckily Marin and Thomas missed the planned train from Oslo airport, so they arrived an hour later, which was just enough time to get Michael settled in before I had to pick them up. After everyone had arrived we ensured the sleeping arrangements were appropriate and test equipment was unpacked and set up. We finished up the evening around 3AM with strawberries with cream and sugar accompanied by white wine (brought by Marin). Finally people crashed and burned after a <em>long</em> day.</p><h3 id="friday-12th-of-july">Friday 12th of July</h3><p>Since the day before was quite late, people slept in a bit and woke up a little bit before noon. I had solicited food preferences in advance, which was received favorably when we had breakfast out on the patio in the sun/shade.</p><p>After the breakfast Thomas started working on the code review of the <a href="https://ipxe.org/gsoc/via">VIA Velocity Gigabit driver</a> written from scratch by Adrian Jamr&#xF3;z as part of GSoC 2012. I guess we should&apos;ve merged this code a long time ago, but better late than never.</p><p>Michael continued working on his code to allow iPXE scripts to pull out information from PCI configuration space. This is useful for e.g. including the PCI vendor/device IDs in embedded menus or sending it off to a server-side script somewhere, either for inventory purposes or dynamic driver loading. The code was merged and pushed out later the same day. Documentation on how to use it is expected to show up at <a href="https://ipxe.org/settings/pci">https://ipxe.org/settings/pci</a> eventually.</p><p>Marin worked hard on cleaning up his <a href="https://ipxe.org/gsoc/nfs">NFS protocol support</a> code. There were some bugs around that caused the downloaded image name to be NULL, and the URL format was a bit odd. After some discussion we decided on a new URL format and a way to derive the required mount point. Marin worked actively on that piece for the rest of the day.</p><p>I was performing initial testing on the new <a href="https://ipxe.org/gsoc/bnx2">Broadcom NetXtreme II driver</a> written by Daniel Wyatt as part of GSoC 2012. Preliminary testing indicated there was something strange with the loopback test between this card and the Intel 82541pi used as a reference. Except for performance, most of the driver seemed to be working more or less as it should, but the loopback failure required more hardcore debugging. I decided to let it rest until Michael could help me out.</p><figure class="kg-card kg-image-card"><a href="https://www.flickr.com/photos/robinsmidsrod/9276159642/"><img src="https://live.staticflickr.com/5537/9276159642_3475d2ac80_n.jpg" class="kg-image" alt="Hacking on iPXE" loading="lazy" width="320" height="213"></a></figure><p>Some time during the day we all went to the supermarket and bought various food we were planning on eating during the weekend. That avoided the trouble of trying to translate all of the names of things from Norwegian to English.</p><p>Later in the evening I organized a traditional Norwegian barbecue with potato salad, fresh watermelon summer salad and burgers, hot dogs and some tender beef. The guys seemed to like it. After the dinner we ate marzipan cake, which is something Michael decided to buy at the supermarket. Michael also made a traditional English drink called Pimm&apos;s with lemonade to top it off. It tasted quite good, all of it, in my opinion.</p><p>After a break which included a few episodes of Futurama some more hacking got done, until we eventually succumbed to sleep deprivation.</p><h3 id="saturday-13th-of-july">Saturday 13th of July</h3><p>Even before breakfast was served, Marin was hard at work with the changes on his NFS project. I helped him test it out and eventually he was able to finish it up and hand it over to Michael for final code review and merging.</p><p>Also before breakfast Michael rewrote the support for <code>netX</code> by implementing symlink support between settings blocks. The <code>netX</code> settings block now shows up first in the list of network adapters, and it directly points to the last opened network device. This now enables a clean way of abstracting out the <code>netX</code> feature to be used in e.g. <code>autoboot</code> and other places you can specify a network device. It also fixes a bug with <code>${mac}</code>, <code>${chip}</code> and <code>${busid}</code> not representing the currently opened device if you have more than one network device, but always the first network device.</p><p>Thomas was still working hard on the VIA Velocity driver. It seemed like never-ending work.</p><p>Breakfast we enjoyed outside this day as well. I had bought cold burgers, heated in the microwave, and put them on the table together with the other normal things. Since the first meal of the day was quite late (2PM), everyone ate like the hungry wolves they were. :)</p><p>After looking through some iPXE configuration menu I suggested to Marin that he should add support for Home/End/PgUp/PgDown to the <a href="https://ipxe.org/cmd/config">config TUI</a>. It didn&apos;t take him much time to shake that out of his right arm. It&apos;s currently waiting for merging. After he did that he started looking into a shutdown command someone had mentioned they wanted. He spent some time trying to figure out how APM works, and sometime in the middle of the day Shao Miller showed up on IRC and helped him out, and he was able to complete a patch for that feature. It is currently lingering in the merge queue.</p><p>Michael started reviewing the <a href="https://ipxe.org/gsoc/via">VIA Rhine driver</a>, first cleaning it up and then hitting several obstacles with the loopback test not giving him what he expected. He continued figuratively banging his head against the wall for the rest of the day.</p><p>Sometimes it is good to take a break when you just can&apos;t find any good answers. He started making a typical Asian dish called watercress &amp; chicken stir-fry with rice for dinner (we couldn&apos;t find watercress in the store, but he substituted with some other appropriate vegetables). Once he was done with that we sat down and enjoyed a good meal at a late hour (almost 10PM).</p><p>I had mentioned earlier in the day that Matthew Helton wanted a way to make the iPXE version string available to scripts. Michael encouraged me to try to write the support myself, considering it was just a few lines of code in <code>core/settings.c</code>. While Michael was busy making dinner I had a look at it, and with some insight from Marin and Thomas I was able to push out <a href="https://git.ipxe.org/ipxe.git/blobdiff/eba6bb38f2d6642efcb20d43e8b4c6c20406dd32..7016164056fb1065c1379d6ac58d1e9cc475c4db:/src/core/settings.c">my second commit</a> in the C parts of the iPXE codebase. I felt so proud of myself, even though it was mostly copy and paste and two lines of changed code.</p><p>After a long day of extensive hacking and a good meal, we sat down with some ice cream for dessert. While we were eating we fired up the old MAME emulator and had some fun playing games like Street Fighter II, Mortal Kombat and Bubble Bobble with an authentic arcade joystick from X-Arcade. Michael even tried it!</p><p>Although most of us was ready for bed Michael and Thomas ended up back at the computers hacking on the troublesome VIA drivers while Marin and myself continued beating each other to a pulp in Mortal Kombat. Michael found a page with the special moves earlier which made it so much more funny.</p><p>At 3AM the last of us figured it was getting way too late and decided to just stop what we were doing and try again the next day with fresh eyes.</p><h3 id="sunday-14th-of-july">Sunday 14th of July</h3><p>I had mentioned to the guys earlier that I was planning on making eggs and bacon for breakfast one morning, and this was indeed the day for that. Everything went well and my favorite brunch was served the way it was supposed to. We ate it indoors because the wind was a bit chilly. It seemed to go down very well after a long evening hacking the night before.</p><p>After the breakfast we went on a tour around the center of T&#xF8;nsberg. We started at Slottsfjell museum where we saw the viking ship and the large whale skeletons. Both things impressed the guys. After that we walked up to Tallak and had a look around the old buildings there. The place was very busy, because a lot of construction workers were preparing for the Slottsfjell festival that is happening the next weekend. After that we walked up to the tower and had a look out over the city. For the first time in years I could see the changes in the city from an aerial view. The next stop on our route was the pier, which was reasonably active with people. We stopped at Parad-is for some long-awaited ice-cream and a walking break. Finally we walked back up to where the car was parked by the museum. All along the route me and Marin were busy hacking <a href="https://www.ingress.com/">Ingress</a> portals.</p><figure class="kg-card kg-image-card"><a href="https://www.flickr.com/photos/robinsmidsrod/9304717985/"><img src="https://live.staticflickr.com/7397/9304717985_5cb979eba7_n.jpg" class="kg-image" alt="Overlooking T&#xF8;nsberg" loading="lazy" width="320" height="213"></a></figure><figure class="kg-card kg-image-card"><a href="https://www.flickr.com/photos/robinsmidsrod/9304729801/"><img src="https://live.staticflickr.com/3666/9304729801_531120a2f4_n.jpg" class="kg-image" alt="Cannons are fun" loading="lazy" width="320" height="213"></a></figure><figure class="kg-card kg-image-card"><a href="https://www.flickr.com/photos/robinsmidsrod/9307518772/"><img src="https://live.staticflickr.com/3737/9307518772_74c3d887eb_n.jpg" class="kg-image" alt="Hand-built viking ship" loading="lazy" width="320" height="240"></a></figure><p>Once we came back Michael continued working on his VIA Rhine reviewing, in which he had an epiphany and found out there was an interrupt bug in the Intel driver which caused packets to be lost for some reason. Once that was taken care of he was able to finally push the new <code>rhine</code> driver.</p><p>Thomas continued working on the VIA Velocity driver, getting more and more annoyed at the poor quality of the data sheet and the odd behavior of the test hardware.</p><p>Marin said he wanted to make potatoes baked in cream for dinner one of the days, so he started preparing that after we got back, and after a good amount of time in the stove the dinner was ready. Together with some left-over watermelon salad, some sausages, burgers, grilled chicken and other goodies it was time for a feast. And boy was it true!</p><p>After the dinner everyone was feeling a bit sleepy after a long day with more than just hacking, so we sat back and watched an episode of Futurama and MacGyver, during which some of us fell asleep for shorter bits of time. It&apos;s really nice to see that people enjoy themselves and feel like they&apos;re at home. While we were cleaning the plates off the table Marin was eating out of the almost empty pot of left-over potatoes. I guess he&apos;s just as much a sucker for food as I am.</p><p>The guys went back to hacking the code, while I decided to go to bed a bit earlier than the other days.</p><h3 id="monday-15th-of-july">Monday 15th of July</h3><p>When I woke up I got some good news from Thomas. It seems the machine he had been using for testing the VIA Velocity driver had some hardware issues. Once he moved to another machine, all the tests passed and he was very happy with the outcome. The driver could finally be merged.</p><p>Once everyone was up and around we had breakfast out in the sun again. The weather had improved a bit from the day before.</p><p>After the breakfast Michael was busy merging all of the other outstanding patches mentioned earlier before he started in the NFS feature from Marin. After several back-and-forth bug fixes by Marin the patch was finally in a mergeable state and we could all rejoice over a job well done.</p><p>While the others were busy doing code reviewing, I tried to figure out why my dual-NIC test machine didn&apos;t want to exit properly back to my embedded menu from my main menu script. After a lot of testing we found out that <code>autoboot</code> had an issue with its getopt implementation which caused it to go in a loop if you specified a network adapter, but worked fine if you didn&apos;t specify an adapter list.</p><p>We had already decided on going out to eat dinner one of the days, so this was definitely the day to do that. We went to the restaurant in the city which is supposed to have the best kitchen, La Barca. Most of us ordered reindeer, and the dish was outstanding, as usual.</p><figure class="kg-card kg-image-card"><a href="https://www.flickr.com/photos/robinsmidsrod/9304737691/"><img src="https://live.staticflickr.com/3738/9304737691_ae59ea5ae0_n.jpg" class="kg-image" alt="Well deserved dinner" loading="lazy" width="320" height="240"></a></figure><p>After we got back from the city Marin and Michael worked more on getting the file license Makefile target to work properly. They actually got it working, but it also revealed a lot of manual work that needs to be done (basically going through each source file, figuring out which license it is under and then tagging it with a single line of code - if you want to help out with this, please get it touch).</p><p>Thomas was at this point getting tired of the review work on the bnx2 driver, so he decided to start looking at a driver for the IC+ 1000 Gigabit Ethernet adapter he&apos;s had around for a while.</p><p>At 1AM we started getting hungry, so we pulled out the rest of the strawberries and enjoyed (most likely) the last desert of the hackathon.</p><p>While eating people got grandiose ideas about implementing Pong using iPXE scripting. It was pretty obvious the sleep deprivation was starting to get to us.</p><h3 id="tuesday-16th-of-july">Tuesday 16th of July</h3><p>The day had finally arrived when everyone had to pack up and get back home. People woke up quite late, which meant we had to eat breakfast in a hurry to avoid Thomas and Marin missing their train to the airport.</p><p>While I drove Thomas and Marin to the train, Michael was still hacking around on a new increment command for the iPXE scripting language. It is going to be a neat feature that should enable us to easily loop through e.g. network adapters in embedded menus and probe hardware or other information using the <code>pci</code> or <code>smbios</code> settings blocks.</p><p>When I got back we sat down and chatted a bit, watched a couple of episodes (introduced Michael to The Big Bang Theory) and I suggested to him to get in touch with Randal Schwartz to appear on <a href="https://twit.tv/floss">FLOSS Weekly</a>. This could give us a decent PR boost and get the word out a bit more, and hopefully grow our community.</p><p>Later I dropped Michael off at the airport and hacked some more Ingress portals on my way home.</p><h3 id="summary">Summary</h3><p>Overall these new features and drivers where published to mainline during the hackathon:</p><ul><li>New <code>hexraw</code> variable format. Useful for using MAC addresses without separators.</li><li>A network interface&apos;s PCI location can be used from scripts.</li><li>PCI vendor/device IDs (and more) can be used from scripts.</li><li><code>netX</code> is now a symlink settings block to most recently opened interface.</li><li>Version string available to scripts.</li><li>New VIA Rhine 100Mbit driver.</li><li>Backslash (like bash) continuation to break long script lines.</li><li>New VIA Velocity Gigabit driver.</li><li>Home/End/PgUp/PgDown keys now work in <code>config</code>.</li><li>APM computer shutdown command, <code>poweroff</code>.</li><li>Downloading of files using NFS protocol.</li><li>Building the license targets now work (although we miss license info for lots of files).</li><li>Several minor bug fixes that have been reported and some we discovered during the weekend.</li></ul><p>These are the items on the agenda we weren&apos;t able to complete because of lack of time:</p><ul><li>Merge the <code>bnx2</code> driver.</li><li>Make <code>ipxe.kpxe</code> work (aka UNDI fallback).</li><li>Make iPXE as an EFI application work.</li><li>New Intel wireless driver.</li></ul><p>All in all it was a great event, and I&apos;m happy that everyone enjoyed it as much as I did hosting it. I&apos;m quite up for doing it again some time in the future, it was a blast! You can find some photos from the event on my <a href="https://www.flickr.com/photos/robinsmidsrod/sets/72157634671915481/">Flickr set for the hackathon</a>.</p><p>If you want to participate in the iPXE community, join us on <a href="https://ipxe.org/contact">IRC, the mailing-list or the forum</a>. If you&apos;re a beginner to network booting, you might also find the website <a href="https://networkboot.org/">https://networkboot.org/</a> useful.</p><p>If you want to get in touch with me there are links at the top of my blog with links to Twitter, Facebook and Google+. Talk to you later!</p>

So, a while ago I decided that I wanted to invite the core developers of the iPXE project to my home for an extended weekend of hacking on the project. The agenda was to try and merge as many outstanding patches and pull requests that we knew about. The work

 64b0753f1c914a000180deec 2013-07-17T11:09:09Z Robin Smidsrød Robin Smidsrød: iPXE hackathon in Tønsberg, Norway
XenServer 6.2 Automated Install for Openstack
 https://littleknife.dev/blog/2013/06/26/xenserver-6-2-automated-install-for-openstack/ 2013-06-26T00:00:00Z Antony Messerli Antony Messerli: XenServer 6.2 Automated Install for Openstack
A patched XenServer 6.1 (Tampa) installer prebuilt for OpenStack Nova's XenAPI driver — drop in the latest CD, boot via PXE or osimag.es, and skip the manual hotfix dance.
 https://littleknife.dev/blog/2013/05/12/citrix-xenserver-6-1-automated-installer-for-openstack/ 2013-05-12T00:00:00Z Antony Messerli Antony Messerli: Citrix XenServer 6.1 Automated Installer for Openstack 2013-04-19T00:00:00-07:00 http://nahamu.github.com/2013/04/19/smartos-wiki <h1>SmartOS Wiki Pages</h1> <p class="meta">2013-04-19</p> <h2>Just a list of some SmartOS wiki pages I've spent a lot of time working on.</h2> <ol> <li><a href="http://wiki.smartos.org/display/DOC/Simple+PXE+Server">Simple PXE Server</a></li> <li><a href="http://wiki.smartos.org/display/DOC/Spice+on+SmartOS">Spice on SmartOS</a></li> </ol> <p>Also, this blog (such as it is) has been added to the <a href="http://networkboot.org/planet/">NetworkBoot.org blog roll</a>.<br /> I probably won't write a whole lot of PXE related posts, but I look forward to the broader exposure if/when I do!<br /> People finding this post from that avenue might enjoy this page: <a href="http://wiki.smartos.org/display/DOC/PXE+Booting+SmartOS">PXE Booting SmartOS</a><br /></p> 2013-04-19T00:00:00-07:00Nahum ShalmanNahum Shalman: SmartOS Wiki Pages 2013-03-04T00:00:00+00:00 http://litanyagainstfear.com/2013/03/04/ipxe-and-dell-r210-ii <p>Today, I was trying to <span class="caps">PXE</span> boot a Dell PowerEdge R210 II system in order to clone the hard drive. We&#8217;ve settled on iPXE to be our <span class="caps">PXE</span> boot system. We&#8217;ve been using ipxe.pxe (which is iPXE with all it&#8217;s own drivers built in) instead of undionly.kpxe (which makes iPXE try to use the <span class="caps">UNDI</span> drive) as it tends to perform a little better. With the R210&#8217;s there&#8217;s a <span class="caps">BIOS</span>/<span class="caps">EFI</span> issue that prevents this from working. If you try to boot with ipxe.pxe, you get an error &#8216;Try to free Memory without Signature&#8217;.</p> <p>Based on my research, the only way to fix this currently is to switch to undionly.kpxe. The iPXE driver doesn&#8217;t seem to handle this case correctly.</p> <p>For reference, this was with yesterday&#8217;s build of iPXE (2013-03-04) and with v2.2.3 of the R210 <span class="caps">BIOS</span> (which uses Broadcom <span class="caps">UNDI</span> <span class="caps">PXE</span>-2.1 v7.2.3).</p> 2013-03-04T00:00:00ZBrian RakBrian Rak: iPXE and Dell R210 II 2013-02-27T00:00:00+00:00 http://litanyagainstfear.com/2013/02/27/foreman-boot-menu <p>We have a somewhat unique (well, probably not unique but not frequently discussed) hardware build process. We start with a request to our <span class="caps">NOC</span> to build a machine with certain specs. They do so, and run a couple scripts before handing it over to us. At this point, we manually undo some of the steps they did, then manually run the tail end of Foreman&#8217;s provisioning script (install <span class="caps">EPEL</span>, install Puppet, edit puppet.conf, service puppet start, log in to puppetmaster and `puppet ca sign`, restart puppet again). This is pretty tedious, and it&#8217;s really time consuming to set up a new machine. This really happens because we&#8217;re using Foreman wrong. Our network setup is complex enough that Foreman doesn&#8217;t really know how to reserve IPs for individual machines. We&#8217;ve also got a custom <span class="caps">PXE</span> system, so Foreman isn&#8217;t even the default next-host.</p> <p>Today, I got tired of dealing with all this. I spent a bunch of time fixing up our Foreman boot system (it had slowly decayed over time because nothing was actually using it). I also made some changes to our <span class="caps">PXE</span> system so that it generates a list of hosts set to &#8216;Build&#8217; in Foreman, and lets you choose which one the new machine should be. Once you&#8217;ve chosen, it reconfigures the network adapter (yay, iPXE) and chainloads to Foreman. This means that I can now setup a machine in Foreman, and tell our <span class="caps">NOC</span> staff to netboot the machine, and choose option X. The rest of it will be handled for them, which means quicker setups, fewer mistakes, and in general everyone is happier.</p> <p>We&#8217;ve set our <span class="caps">PXE</span> system up so it works across our entire network, so I no longer have to get them to install a machine in one location then drag it across the datacenter to it&#8217;s final location.</p> <p>Note: All the code that follows is a reconstruction of what I did earlier. My actual scripts reference internal systems rather then Foreman, so some of this might be buggy!</p> <p>The process looks like this:</p> <p>1) Machine boots up and grabs a generic iPXE config. This contains an option that goes to a custom <span class="caps">PHP</span> script. Basically, it looks like this:</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="c">#!ipxe</span> menu iPXE boot menu item localboot Local boot item Foreman Choose foreman options choose --default localboot --timeout <span class="m">60000</span> bootoption <span class="o">&amp;&amp;</span> goto <span class="k">${</span><span class="nv">bootoption</span><span class="k">}</span> <span class="o">||</span> :localboot <span class="nb">exit</span> :foreman chain http://<span class="k">${</span><span class="nv">next</span><span class="p">-server</span><span class="k">}</span>/showpendinghosts.php</code></pre></div><p>2) showpendinghosts.php generates a list of all the hosts that are currently in the build state in Foreman. It looks a little bit like this:</p> <div class="highlight"><pre><code class="language-php" data-lang="php"><span class="x">#!ipxe</span> <span class="x">:start</span> <span class="x">menu Foreman Boot Options</span> <span class="x">item --gap -- -------- Pending Hosts --------</span> <span class="cp">&lt;?php</span> <span class="nv">$db</span> <span class="o">=</span> <span class="nb">mysql_connect</span><span class="p">();</span> <span class="nv">$host</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span><span class="p">;</span> <span class="nv">$res</span> <span class="o">=</span> <span class="nb">mysql_query</span><span class="p">(</span><span class="s1">&#39;select * from hosts where build=1&#39;</span><span class="p">);</span> <span class="k">while</span> <span class="p">(</span><span class="nv">$row</span> <span class="o">=</span> <span class="nb">mysql_fetch_assoc</span><span class="p">(</span><span class="nv">$res</span><span class="p">))</span> <span class="p">{</span> <span class="nv">$res2</span> <span class="o">=</span> <span class="nb">mysql_query</span><span class="p">(</span><span class="s1">&#39;select * from subnets where inet_aton(&quot;&#39;</span><span class="o">.</span><span class="nv">$row</span><span class="p">[</span><span class="s1">&#39;ip&#39;</span><span class="p">]</span><span class="o">.</span><span class="s1">&#39;&quot;) between inet_aton(from) and inet_aton(to)&#39;</span><span class="p">);</span> <span class="nv">$subnet</span> <span class="o">=</span> <span class="nb">mysql_fetch_assoc</span><span class="p">(</span><span class="nv">$res</span><span class="p">);</span> <span class="nv">$host</span> <span class="o">.=</span> <span class="s2">&quot;</span> <span class="s2"> :host_</span><span class="si">{</span><span class="nv">$row</span><span class="p">[</span><span class="s1">&#39;id&#39;</span><span class="p">]</span><span class="si">}</span><span class="s2"></span> <span class="s2"> set netX/ip </span><span class="si">{</span><span class="nv">$row</span><span class="p">[</span><span class="s1">&#39;ip&#39;</span><span class="p">]</span><span class="si">}</span><span class="s2"></span> <span class="s2"> set netX/gateway </span><span class="si">{</span><span class="nv">$subnet</span><span class="p">[</span><span class="s1">&#39;gateway&#39;</span><span class="p">]</span><span class="si">}</span><span class="s2"></span> <span class="s2"> set netX/netmask </span><span class="si">{</span><span class="nv">$subnet</span><span class="p">[</span><span class="s1">&#39;mask&#39;</span><span class="p">]</span><span class="si">}</span><span class="s2"></span> <span class="s2"> chain http://your_foreman_server/unattended/gPXE</span> <span class="s2"> &quot;</span><span class="p">;</span> <span class="k">echo</span> <span class="s2">&quot;item host_</span><span class="si">{</span><span class="nv">$row</span><span class="p">[</span><span class="s1">&#39;id&#39;</span><span class="p">]</span><span class="si">}</span><span class="s2"> Install </span><span class="si">{</span><span class="nv">$row</span><span class="p">[</span><span class="s1">&#39;name&#39;</span><span class="p">]</span><span class="si">}</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">;</span> <span class="p">}</span> <span class="cp">?&gt;</span><span class="x"></span> <span class="x">choose bootoption &amp;&amp; goto ${bootoption} ||</span> <span class="x">echo Invalid option selected!</span> <span class="x">shell</span> <span class="cp">&lt;?php</span> <span class="k">echo</span> <span class="nv">$host</span><span class="p">;</span> <span class="cp">?&gt;</span><span class="x"></span></code></pre></div><p>Prerequsites:</p> <p>1) Your <span class="caps">DHCP</span> server must be setup to serve <a href="http://ipxe.org/howto/chainloading">iPXE</a> instead of pxelinux.</p> <p>2) Foreman must have <a href="http://wiki.theforeman.org/projects/foreman/wiki/Fetch_boot_files_via_http_instead_of_TFTP">gPXE support</a> enabled</p> <p>3) All your subnets in Foreman must have a from/to IP address range set. You can avoid this with some clever bitmask tricks with the gateway/subnet, but I have not implemented those.</p> 2013-02-27T00:00:00ZBrian RakBrian Rak: Foreman boot menu 2013-01-28T00:00:00+00:00 http://litanyagainstfear.com/2013/01/28/matching-on-relay-ip-with-isc-dhcpd <p>We&#8217;ve started using <span class="caps">DHCP</span> agent forwarding to run <span class="caps">DHCP</span> servers across our network. For one of our setups, we needed to be able to assign IP addresses based on the IP address of the relay agent. There isn&#8217;t a built in reference to this that I could find, so you&#8217;re stuck matching against the raw packet contents. This is pretty straightforward:</p> <pre class="highlight"> class "myclass" { match if packet(24,4) = 10:10:10:01; } </pre> <p>Just make sure to convert the IP you&#8217;re looking for to hex. If you have the option, it&#8217;s really a lot easier to use a <span class="caps">DHCP</span> subscriber tag. If you go with the relay agent IP, you need to make sure that it&#8217;s consistently one IP (as it may change if you have multiple subnets on the same <span class="caps">VLAN</span>).</p> 2013-01-28T00:00:00ZBrian RakBrian Rak: Matching on relay IP with ISC DHCPD <p>During the summer season of 2012 (northern hemisphere) I&apos;ve had the pleasure of being the coordinator of <a href="http://ipxe.org/">the iPXE network boot loader</a>&apos;s participation in the <a href="http://code.google.com/soc/">Google Summer of Code</a> program. This is a summary of what happened during the summer.</p><h2 id="what-is-ipxe">What is iPXE?</h2><p>iPXE is a network boot loader. What does that actually mean? Normally when you boot your computer, control is handed over to the boot sector on a local hard drive in your computer and an operating system is loaded. But that is not the only option you have. For a lot of years a standard called PXE (developed by Intel), has been available which allows x86-based computers to boot from the network (using DHCP and TFTP). iPXE&apos;s main goal is to extend that ability to not only boot from TFTP (which is quite slow), but allow computers to boot from HTTP, FTP, iSCSI, AoE and other more esoteric sources. We also have a goal of being the main network boot loader for EFI-based systems (almost working, get in touch for details). We already support more than 60 different network cards, and cards without a native driver are also supported using a feature called <a href="http://ipxe.org/howto/chainloading">chainloading</a>.</p><h2 id="first-time-participating-in-gsoc">First time participating in GSoC</h2><p>This is the first year iPXE participates in the GSoC program as an organization. Most of the mentors involved have participated earlier years as part of other organizations, such as kernel.org and Etherboot. It was the first time for me, though, and it was quite fun! My job was to keep all the students and mentors on track and ensure no deadlines were forgotten and that communication between everyone flowed smoothly. In total we had three students, which I understand is quite a lot for a first year organization. Thank you to Google for believing in us.</p><h2 id="students-and-projects">Students and projects</h2><p>Marin Hannache from EPITA University in France wrote protocol <a href="http://ipxe.org/gsoc/nfs">support for downloading boot files using NFS</a>. His work is awaiting review and integration into mainline. From what I&apos;ve tested it still has some issues, but it is working, and I&apos;m most eager to get it in, as it will allow booting directly from an NFS3 server, not even needing a web server. This should be great news for people using small NAS boxes to do their booting, as they don&apos;t always have a way to serve files using HTTP.</p><p>Adrian Jamr&#xF3;z from Jan Kochanowski University in Poland <a href="http://ipxe.org/gsoc/via">reimplemented the drivers for the VIA Rhine and VIA Velocity family of network cards</a>. The existing drivers were using a deprecated API and was much bigger in size than they really needed to be. Code size is always a big challenge for a project like iPXE, which commonly is burned into ROM chips that have a limit of 64KB. His code was very good and is just awaiting final review and integration. I&apos;ve personally tested it on one of my Rhine2-based cards, and it seems to work reliably.</p><p>Daniel Wyatt from Lord Fairfax Community College in the United States <a href="http://ipxe.org/gsoc/bnx2">reimplemented the driver for the Broadcom NetExtreme II family of network cards</a>. The problem with the old bnx2 driver was the same as the VIA driver. It used a very large proprietary firmware blob to run the MIPS-based microcontrollers on the card. Most of the summer was used to understand how we could minimize this firmware without losing any functionality. In the end the student got something working, but we&apos;re still having issues with the legality of including the firmware inside the iPXE project. The integration with mainline is currently on the fence awaiting some kind of confirmation from Broadcom that we can actually distribute the firmware blob with iPXE. Luckily we have people from Broadcom participating in the community, so it shouldn&apos;t be too impossible to get this kind of approval. I guess this student got a crash course in how licensing affects what you can do within an open-source project.</p><h2 id="other-tidbits">Other tidbits</h2><p>All of the pages linked to above were maintained by the students as they were working on their code during the summer. You can also find links to specific Git repositories that include all of their code if you&apos;re interested in testing it out before it is integrated into mainline. Most of the day-to-day collaboration was done using IRC on the #ipxe channel on irc.freenode.net. Below you can read some of the interesting things said during the summer by the students:</p><ul><li><code>20120608-010814 &lt;Mareo&gt;</code> wow, I&apos;m in the black magic part of iPXE codebase :D</li><li><code>20120703-121824 &lt;Mareo&gt;</code> this gsoc is awesome :D</li><li><code>20120712-203713 &lt;dewyatt&gt;</code> the bnx2 datasheet is horrible :(</li><li><code>20120720-233044 &lt;dewyatt&gt;</code> mcb30: okay...I&apos;m eager to get started on the fun stuff</li><li><code>20120728-160956 &lt;budrys&gt;</code> meteger: but I think it can&apos;t be left as is, it&apos;s a dirty hack for me</li><li><code>20120815-172646 &lt;dewyatt&gt;</code> mcb30: mouse sent me some ROMs that have firmware in them. This made me take another look at the newest PXE ROM I have and I found compressed firmware. I hackishly extracted this by pausing the broadcom PXE ROM during DHCP and reading from the Debug UART. I can&apos;t do this for RV2P and I don&apos;t really know the bounds of the MIPS firmware so it&apos;s still a work in progress.</li><li><code>20120816-083313 &lt;dewyatt&gt;</code> I don&apos;t know if I can legally commit this code really :/</li></ul><h2 id="thanks-to-everyone">Thanks to everyone</h2><p>It is great to have taken part in this journey and seen how much the students have learned over the summer. I want to thank our three mentors, Michael Brown, Joshua Oreman and Thomas Miletich and all the other knowledgable people on the #ipxe IRC channel for the great work they&apos;ve provided during the summer. Participating in GSoC has been a great experience for us all, and I hope we&apos;ll be able to participate next year as well.</p><p>If I&apos;ve whet your appetite to learn more about network booting, I invite you to <a href="http://webchat.freenode.net/?channels=#ipxe">join us on IRC</a>, participate in the <a href="http://forum.ipxe.org/">iPXE forums</a> or <a href="https://lists.ipxe.org/mailman/listinfo/ipxe-devel">join the mailing-list</a>.</p><p>Until next time,<br>Robin Smidsr&#xF8;d,<br>iPXE GSoC 2012 coordinator</p>

During the summer season of 2012 (northern hemisphere) I've had the pleasure of being the coordinator of the iPXE network boot loader's participation in the Google Summer of Code program. This is a summary of what happened during the summer.

What is iPXE?

iPXE is a

 64b0753f1c914a000180deea 2012-11-04T14:25:01Z Robin Smidsrød Robin Smidsrød: GSoC 2012 roundup for iPXE 2012-10-20T00:00:00+00:00 http://litanyagainstfear.com/2012/10/20/filtering-ipmi-clients-with-dhcp <p>If you ever need to run a <span class="caps">DHCP</span> server and assign different IP addresses to <span class="caps">IPMI</span> clients and actual OS clients, you can use the following:</p> <pre class="highlight"> class "ipmi" { match if substring (option vendor-class-identifier,0,5) = "udhcp"; } class "normal" { match if substring (option vendor-class-identifier,0,5) != "udhcp"; } subnet 10.0.0.0 netmask 255.255.255.248 { pool { allow members of "normal"; deny members of "ipmi"; range 10.0.0.100 10.0.0.105; } pool { deny members of "ipmi"; allow members of "normal"; range 10.0.0.106 10.0.0.110; } } </pre> <p>This code uses the <span class="caps">DHCP</span> vendor class identifier to determine what is and is not an <span class="caps">IPMI</span> client (this only works if your OS doesn&#8217;t use udhcp!). From there you can pretty easily use it to restrict IP ranges assigned to <span class="caps">DHCP</span> or normal clients.</p> 2012-10-20T00:00:00ZBrian RakBrian Rak: Filtering IPMI clients with DHCP 2012-10-10T00:00:00+00:00 http://litanyagainstfear.com/2012/10/10/expanding-isc-dhcpd-options <p>I was recently trying to do some tricky things using a <span class="caps">DHCP</span> server and the &#8216;subscriber-id&#8217; option (part of option 82). It turns out that <span class="caps">ISC</span> <span class="caps">DHCPD</span> doesn&#8217;t support this out of the box. There&#8217;s two options: recompile the dhcp server, or add support using the config file. Since I don&#8217;t really have a decent way to maintain custom compiled versions of software (nor do I want to), adding support via the config file was the way to go.</p> <p>This is actually pretty straightforward, just add the following to your config file, and use &#8216;myagent.subscriber-id&#8217; to retrieve the value for it. You shouldn&#8217;t have to do any decoding, it&#8217;s handled automatically.</p> <pre class="highlight"> option space myagent; option myagent.circuit-id code 1 = text; option myagent.remote-id code 2 = text; option myagent.agent-id code 3 = text; option myagent.DOCSIS-device-class code 4 = unsigned integer 32; option myagent.link-selection code 5 = ip-address; option myagent.subscriber-id code 6 = text; option myagent-encapsulation code 82 = encapsulate myagent; </pre> 2012-10-10T00:00:00ZBrian RakBrian Rak: Expanding ISC DHCPD Options 2012-01-22T00:00:00+00:00 http://litanyagainstfear.com/2012/01/22/nfs-booting-using-only-the-kernel <p>The Linux kernel has the ability to do a <span class="caps">DHCP</span> request on boot and mount the root directory via <span class="caps">NFS</span>. This is all possible using only kernel options, you don&#8217;t need an initrd and a bunch of custom tricks to do this. Before I go any further, be warned that a lot of the documentation regarding this is out of date or incomplete. You are unlikely to find one guide that tells you everything you need to know.</p> <p>1) You need to setup a minimal linux image. My <a href="/2011/10/05/diskless-centos-booting.html">diskless centos booting</a> entry would be a good start for setting this up. This step is critical, as you need some tweaks to make this image bootable.</p> <p>2) You need to rebuild your kernel (if you are using CentOS). There&#8217;s a number of options that need to be enabled, and most of them aren&#8217;t enabled by default. Make sure you have the following options enabled:</p> <ul> <li><span class="caps">NIC</span> drivers must be included in the kernel (not via a module!)</li> <li>Networking options &#8212;&#8594; IP: kernel level autoconfiguration (CONFIG_IP_PNP=y)</li> <li>Networking options &#8212;&#8594; IP: <span class="caps">DHCP</span> support (CONFIG_IP_PNP_DHCP=y)</li> <li>Network File Systems &#8212;&#8594; <span class="caps">NFS</span> file system support (CONFIG_NFS_FS=y)</li> <li>Network File Systems &#8212;&#8594; Root file system on <span class="caps">NFS</span> (CONFIG_ROOT_NFS=y) <br /> After rebuiling your kernel, copy the resulting bzImage to your tftpboot directory.</li> </ul> <p>3) Create a fstab. This one sets up a 100mb tmpfs based /var. This is important for things like log files and sockets.</p> <pre class="highlight"> none / none rw 0 0 /proc /proc proc rw 0 0 /sys /sys sysfs rw 0 0 devpts /dev/pts devpts gid=5,mode=620 0 0 tmpfs /var tmpfs size=100M,mode=0755 0 0 </pre> <p>4) Once all your packages are setup (install anything else you need before this step, as it will break Yum until you undo it), do the following:</p> <pre class="highlight"> mv var newvar mkdir var </pre> <p>If you skip this step, you&#8217;re going to end up with a read-only /var . This will break many, many things, so we will be creating a ramdisk for this. In order to do this, we need to modify one of the startup scripts to copy everything from /newvar to /var. I currently do this in /etc/rc.d/rc.sysinit. Find the &#8220;Mounting local filesystems&#8221; action, and add something like this after it:</p> <pre class="highlight"> action $"Copying contents of var over" cp -R /newvar/* /var/ </pre> <p>5) Export your new linux image via <span class="caps">NFS</span>. Add this line to your /etc/exports. Don&#8217;t make this writable unless you are only going to be booting one machine from it. If you need writable mounts for multiple machines, take a look at the <a href="http://www.mjmwired.net/kernel/Documentation/filesystems/nfsroot.txt">nfsroot</a> documentation for some tricks.</p> <pre class="highlight"> label diskless MENU LABEL CentOS 6 x64 diskless kernel bzImage append ip=dhcp rootfstype=nfs root=/dev/nfs ro nfsroot=10.10.10.10:/home/nfsboot/cent6 single </pre> <p>At this point, you should be able to boot the image with no issues. You may see some errors pop up during boot, but these are generally non-fatal. I haven&#8217;t had a reason to go and fix them yet, as they don&#8217;t seem to cause any issues.</p> <p>Here are some of the references I used in setting this up:</p> <ul> <li><a href="http://kernelnewbies.org/FAQ/DisklessImages">DisklessImages @ KernelNewbies</a></li> <li><a href="http://onesis.sourceforge.net/NFSroot-HOWTO.php">oneSIS NFSroot <span class="caps">HOWTO</span></a></li> <li><a href="http://www.mjmwired.net/kernel/Documentation/filesystems/nfsroot.txt">nfsroot documentation</a></li> </ul> 2012-01-22T00:00:00ZBrian RakBrian Rak: NFS Booting using only the kernel 2011-10-05T00:00:00+00:00 http://litanyagainstfear.com/2011/10/05/diskless-centos-booting <p>Recently, one of my projects required the ability to disklessly boot a bunch of machines. Initally, I was doing this with <span class="caps">DRBL</span>, however <span class="caps">DRBL</span> has a lot of cruft that was unnecessary for us, and wasn&#8217;t really what we wanted. <span class="caps">DRBL</span> relies on a number of <span class="caps">NFS</span> mounts back to the server, so if your <span class="caps">DRBL</span> server crashes, all the machines go down. I took a look at <span class="caps">LTSP</span>, but the project appears to be msotly dead at this point, and seems to suffer from the same issues as <span class="caps">DRBL</span>.</p> <p>Thankfully, the actual process for setting up a diskless image to boot from isn&#8217;t terribly difficult. It took a bit of fiddling with it, but in the end it turned out pretty simple. Basically, you set up a chrooted environment containing your entire system, then compress that into the inital ramdisk for the system.</p> <p>This would be the setup process for a Centos 5 x86_64 OS. It&#8217;s pretty similar for Centos 6, I&#8217;ve not attempted it with any other operating system. I run this on another Centos 5 machine. I&#8217;ve found that it can be very difficult to bootstrap the OS from another OS. Attempting to create a Centos 6 image on a Centos 5 machine fails due to some missing libraries and incompatible rpm formats.</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="c"># This would be needed to get the centos-release RPM.</span> <span class="c"># Alternatively, just wget it from one of the mirrors.</span> <span class="c"># pigz will make compressing the image a lot faster (it&#39;s parallel gzip)</span> yum install yumdownloader pigz yumdownloader centos-release mkdir /root/diskless <span class="c"># centos-release contains things like the yum configs, and is necessary to bootstrap the system</span> rpm --root<span class="o">=</span>/root/diskless -ivh --nodeps centos-release-5-7.el5.centos.x86_64.rpm yum --installroot<span class="o">=</span>/root/diskless -y install basesystem filesystem bash kernel passwd <span class="nb">cd </span>diskless <span class="c"># This next line is important, your system won&#39;t boot without it</span> ln -s ./sbin/init ./init <span class="nb">echo </span><span class="nv">NETWORKING</span><span class="o">=</span>yes &gt; etc/sysconfig/network chroot . pwconv <span class="c"># Set your root password</span> passwd <span class="nb">exit</span> <span class="nb"> </span> find <span class="p">|</span> cpio -ocv <span class="p">|</span> pigz -9 &gt; diskless.cpio.gz</code></pre></div><p>Now, take your newly created diskless.cpio.gz file, and the vmlinuz file from your chroot&#8217;s /boot/ directory, and copy them into your <span class="caps">TFTP</span> root. Assuming you are using PXELinux to boot this, you would need a menu option like this:</p> <pre class="highlight"> label diskless # Change the name here to match your actual kernel kernel vmlinuz append initrd=diskless.cpio.gz </pre> <p>If you are using SysLinux &gt;= 5.10, you can make this process faster by grabbing the files via <span class="caps">HTTP</span> instead.</p> <pre class="highlight"> label diskless kerenl http://YOURSERVERHERE/vmlinuz append initrd=http://YOURSERVERHERE/diskless.cpio.gz </pre> 2011-10-05T00:00:00ZBrian RakBrian Rak: Diskless CentOS booting 2011-08-17T00:00:00-07:00 http://nahamu.github.com/2011/08/17/smartos-pxe <h1>Serving SmartOS from your PXE server</h1> <p class="meta">2011-08-17</p> <p>(Quick and Dirty Edition)</p> <h2>Assumptions</h2> <ol> <li>This guide assumes that you already have a PXE (TFTP) server set up.</li> <li>This guide assumes that you use <a href="http://syslinux.zytor.com/wiki/index.php/PXELINUX">pxelinux</a></li> <li>This guide assumes that you only want to boot SmartOS. Please adjust accordingly.</li> <li>This guide assumes that you know how to do all sorts of other things as well...</li> </ol> <h2>Instructions</h2> <ol> <li>Download the ISO from <a href="http://smartos.org/">smartos.org</a></li> <li>Extract the entire <code>platform</code> subtree from the ISO.</li> <li>Download a tarball of <a href="http://syslinux.zytor.com/wiki/index.php/Download">SYSLINUX</a> and get the <code>mboot.c32</code> binary out of it.</li> <li>In the tftp root directory, create a directory named <code>smartos</code></li> <li>Copy the <code>platform</code> directory you got from the ISO into the <code>smartos</code> directory</li> <li>Copy the <code>mboot.c32</code> binary into the <code>smartos</code> directory</li> <li>Update your <code>pxelinux.cfg/default</code> file with this content: <pre> default smartos prompt 1 timeout 50 label smartos kernel smartos/mboot.c32 append smartos/platform/i86pc/kernel/amd64/unix -B console=text,standalone=true,noimport=true,root_shadow='$5$2HOHRnK3$NvLlm.1KQBbB0WjoP7xcIwGnllhzp2HnT.mDO7DpxYA' --- smartos/platform/i86pc/amd64/boot_archive </pre></li> </ol> <h2>References</h2> <ol> <li><a href="http://www.ryan.net/smartos-disk-blogpost/real_disk_smartos.html">Ryan's Guide to a disk install of SmartOS</a></li> <li><a href="http://syslinux.zytor.com/wiki/index.php/Mboot.c32">mboot.c32 documentation</a></li> </ol> 2011-08-17T00:00:00-07:00Nahum ShalmanNahum Shalman: Serving SmartOS from your PXE server 2011-07-27T00:00:00+00:00 http://litanyagainstfear.com/2011/07/27/know-your-architecture <p>You need to know your architecture. How can you expect to effectively develop anything when you don&#8217;t know the basics of your architcture? When you resolve problems by making changes and guessing at how they work? When your method of rolling out a new server is some bash commands pasted into a txt file, and when they break you have no idea what to do?</p> <p>I&#8217;m not saying you need to understand every minor detail of the stack you work on. I&#8217;m saying that you need to know the basics of your setup.</p> <p>Let&#8217;s say you are a <span class="caps">PHP</span> developer. If you are given a clean install and can&#8217;t manage to setup your site, Apache, and <span class="caps">PHP</span>&#8230; you are doing it wrong. If you rely on others to configure your machines and setup your code for you, can you really feel responsible for the code you rolled out to production?</p> <p>Maybe I&#8217;m crazy, but I believe every developer should be able to accomplish at least basic sysadmin tasks. I don&#8217;t expect them to be able to go and tweak sysctl settings to maximize performance, but I expect them to be able to go set up a server and have it run their code successfully. I don&#8217;t expect to be asked how to install basic <span class="caps">PHP</span> extensions, nor troubleshoot an install when it&#8217;s missing the -devel version of a package.</p> <p>I&#8217;ve always been a generalist. I know something about a wide variety of things, but I know very little in detail about each one. You know what? That perfectly suits what I have to do every day. Some days I might be debugging some ancient <span class="caps">PHP</span> code, other days I&#8217;m trying to get unattended installs working via <span class="caps">SSH</span> under Windows, other days I&#8217;m fighting network issues that occur during <span class="caps">PXE</span> boots. I wouldn&#8217;t have it any other way. I take pride in my ability to figue it out, not matter what situation I&#8217;m thrown into.</p> 2011-07-27T00:00:00ZBrian RakBrian Rak: Know your architecture 2011-07-25T00:00:00+00:00 http://litanyagainstfear.com/2011/07/25/adventures-in-pxe-booting-part-3 <p>So, in my quest to be able to network boot with a static IP, one issue that comes up a lot is passing the IP and other information to whatever I&#8217;m booting. It would be pretty annoying to have to enter the information once to get the boot menu, then again to boot whatever it is I wanted to boot. This seems like it should be pretty straightforward, however every operating system seems to have it&#8217;s own way of doing it. This gets even worse with the various LiveCD distributions (Clonezilla, GParted, RIPLinux, etc), as they inevitably have their own customized (undocumented) way of handling it, if they handle it at all.</p> <p>So, to boot recent Debian-based operating systems and assign it an IP from iPXE, you need to append the following to the kernel command line:</p> <pre class="highlight"> ip=${net0/ip}::${net0/gateway}:${net0/netmask}:${net0/hostname}:eth0 </pre> <p>For CentOS, you would use the following:</p> <pre class="highlight"> ip=${net0/ip} netmask=${net0/netmask} gateway=${net0/gateway} hostname=${net0/hostname} </pre> <p>For Clonezilla (which is Debian based, but doesn&#8217;t use the standard Debian way):</p> <pre class="highlight"> ip=eth0:${net0/ip}:${net0/netmask}:${net0/gateway}:8.8.8.8 </pre> <p>If you have some software that indicates you should use &#8216;<span class="caps">IPAPPEND</span> 1&#8217; from SysLinux, this really means you need to add this to the command line:</p> <pre class="highlight"> ip=${net0/ip}::${net0/gateway}:${net0/netmask} </pre> <p>Similarly, if you have something that says to use &#8216;<span class="caps">IPAPPEND</span> 2&#8217;, this is what you need:</p> <pre class="highlight"> BOOTIF=01-${net0/mac:hexhyp} </pre> <p>For that last one, I really don&#8217;t have any idea what the &#8220;01-&#8221; in front is for, but after examining the Anaconda (CentOS installer) source, <strong>something</strong> seems to be required there, and the installer happily ignores whatever you put.</p> 2011-07-25T00:00:00ZBrian RakBrian Rak: Adventures in PXE booting part 3 2011-07-22T00:00:00+00:00 http://litanyagainstfear.com/2011/07/22/ipxe-scripting-for-fun-and-profit <p>iPXE supports a moderately powerful scripting language. It&#8217;s actually possible to do some pretty cool things with it. For example, to prompt for the IP information on boot you would use the following script. Note that the &#8216;ifopen net0&#8217; isn&#8217;t in the example script iPXE gives for this, and without it your connection won&#8217;t actually work.</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="c">#!ipxe</span> <span class="nb">echo</span> -n IP: <span class="o">&amp;&amp;</span> <span class="nb">read </span>net0/ip <span class="nb">echo</span> -n Subnet mask: <span class="o">&amp;&amp;</span> <span class="nb">read </span>net0/netmask <span class="nb">echo</span> -n Gateway: <span class="o">&amp;&amp;</span> <span class="nb">read </span>net0/gateway ifopen net0</code></pre></div><p>You can pull off some pretty basic menus with it too:</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="c">#!ipxe</span> <span class="nb">echo</span> -n 1<span class="o">)</span> CentOS netinstall <span class="nb">echo</span> -n 2<span class="o">)</span> iPXE shell <span class="nb">echo</span> -n Please <span class="k">select</span> an option: <span class="nb">read </span>option goto option_<span class="o">{</span><span class="nv">$option</span><span class="o">}</span> :option_1 <span class="c"># Install centos</span> :option_2 shell</code></pre></div><p>Embedding these into a custom image is pretty easy, you would just do:</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash">make <span class="nv">EMBED</span><span class="o">=</span><span class="s2">&quot;yourscript.ipxe&quot;</span></code></pre></div><p>This would make an image that started yourscript.ipxe immediately on boot, which coupled with the script to read the IP information means you no longer need a <span class="caps">DHCP</span> server to network boot.</p> 2011-07-22T00:00:00ZBrian RakBrian Rak: iPXE scripting for fun and profit 2011-07-21T00:00:00+00:00 http://litanyagainstfear.com/2011/07/21/adventures-in-pxe-booting-part-2 <p>Today was spent trying to get SysLinux chainloaded via iPXE over <span class="caps">HTTP</span>. This appears to be something that not many people attempt to do. Usually <span class="caps">TFTP</span> is the protocol of choice here, and there&#8217;s very little documentation about getting this working correctly. In order to do this, I&#8217;m loading gpxelinux.0 (part of the syslinux package, look in the gpxe directory) via <span class="caps">HTTP</span>, and having it fetch the config. The setup for this is rather straightforward, once I determined that putting quotes around the values here breaks everything. The basic config in iPXE you need for this is:</p> <div class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="nb">set </span>209:string /menu.cfg <span class="nb">set </span>210:string http://10.10.10.10/ chain http://10.10.10.10/gpxelinux.0</code></pre></div><p>The 209:string line here is the name and path to your configuration file. The 210:string is the hostname of your web server. My understanding is that the 210:string line will be used as the base url for any other files that are needed. Once you have this set your menu.cfg should look something like this:</p> <pre class="highlight"> UI vesamenu.c32 TITLE Test1 localboot </pre> <p>This <strong>should</strong> work, but it doesn&#8217;t. I can check web server logs, and see that both menu.cfg and vesamenu.c32 get downloaded, but the machine immediately reboots after that. I&#8217;m probably going to have to use <span class="caps">TFTP</span> for this, though I&#8217;m going to make every effort to try to use <span class="caps">HTTP</span> for everything else.</p> <p>An annoying bug I&#8217;ve discovered with most (all?) Debian based LiveCD&#8217;s: You can&#8217;t boot them via MemDisk. You can usally extract the kernel, initrd, and filesystem from them and boot those, but it&#8217;s a bit more annyoing then dropping an <span class="caps">ISO</span> in a directory.</p> <p>If you are using Cisco routers (possibly anything with <span class="caps">STP</span>), you should be aware it can take anywhere from 15-30 seconds before an ethernet port goes from unlinked to linked. This is just manifests itself as networking randomly not working, or <span class="caps">DHCP</span> timing out. I&#8217;ve seen the issue where <span class="caps">DHCP</span> in <span class="caps">PXE</span> works correctly, but when it loads the operating system the port shuts down for long enough for <span class="caps">STP</span> to have to reinitialize, leading to more <span class="caps">DHCP</span> timeouts. The appropriate setting to disable this is called &#8216;portfast&#8217; on Cisco routers. I haven&#8217;t disabled it, because it can apparently cause temporary broadcast storms if you manage to plug a router into itself. 30s of delay is far better then taking down a production network for any amount of time.</p> 2011-07-21T00:00:00ZBrian RakBrian Rak: Adventures in PXE booting part 2 2011-07-20T00:00:00+00:00 http://litanyagainstfear.com/2011/07/20/adventures-in-pxe-booting <p>I&#8217;ve been working with getting <span class="caps">PXE</span>/network booting working for a few days now, and I&#8217;ve learned all manner of things that aren&#8217;t anywhere in documentation for various projects. I&#8217;m in a fairly unique environment, in that we can&#8217;t just run your normal <span class="caps">DHCP</span> and <span class="caps">TFTP</span> server (well, <span class="caps">TFTP</span> is probably possible, but has it&#8217;s own set of issues). Things tend to get irritating quickly when you stop using <span class="caps">DHCP</span>. <span class="caps">TFTP</span> is slightly less essential in that regard, but there&#8217;s still a bunch of common <span class="caps">PXE</span> tools that assume it&#8217;s what you are using (syslinux for one).</p> <p>In order for our network booting to work, we need to be able to manually configure an IP address and subnet. <span class="caps">DHCP</span> is out, because we&#8217;re booting many different machines, in many different locations. It&#8217;s possible for us to run <span class="caps">DHCP</span> servers in some locations, but not in all of them.</p> <p>So, a quick overview of how <span class="caps">PXE</span> works if you have <span class="caps">DHCP</span> and <span class="caps">TFTP</span>. Your machine boots up, and starts looking for an IP address. When the <span class="caps">DHCP</span> server responds to it, it sends the extra field &#8216;next-server&#8217;. If this is present, the machine tries to get a file called &#8216;pxelinux.0&#8217;. This contains the second stage bootloader, and (in my experience) is typically SysLinux. SysLinux can give you nice semi-graphical menus, and can chainload a lot of other stuff.</p> <p>This wouldn&#8217;t work for us. First off, the default pxe software in most network cards (the stuff that gets <span class="caps">DHCP</span> and pxelinux.0) is crap. It&#8217;s not really configuarble, and you usually have to be actively watching the machine so you can press a button and configure it. Enter <a href="http://ipxe.org/">iPXE</a>. iPXE can either be burned into your network cards (I&#8217;ve not tested this yet), or you can create bootable isos or <span class="caps">USB</span> drives. iPXE is scriptable, and can download any necessary files via a wide variety of methods. The only downside is you lose the nice menus of SysLinux. It&#8217;s supposedly possible to chainload a <a href="http://git.ipxe.org/people/mcb30/syslinux.git">modified-syslinux</a>, but I&#8217;ve been unable to get this working properly.</p> <p>I&#8217;ve developed a rather simple script that asks the user for the IP, netmask, and gateway settings, then grabs a &#8220;stage 2&#8221; configuration file off of a remote webserver. The advantage of this is that the burned iso/usb stick doesn&#8217;t go out of date and need to be redone.</p> <p>More on this later.</p> 2011-07-20T00:00:00ZBrian RakBrian Rak: Adventures in PXE booting