Categories

  • 13k Topics
    115k Posts
    Tom ElliottT

    @Jeremy Last time I told you FOG’s server had no U-Boot support and your two
    options were to keep hand-rolling it or put UEFI firmware on the Pi. That’s no
    longer true - I built the server side. It’s merged into working-1.6 as of
    1.6.0-beta.4318, so update and you’ll have it.

    There’s a new endpoint:

    http://<fogserver>/fog/service/uboot/boot.php?mac=<the Pi's MAC>

    It answers with an extlinux.conf-style document, computed live from the
    database. If the host has a task queued you get kernel/initrd/append for FOS;
    if it doesn’t, you get localboot and U-Boot falls through to the disk. Fetch it
    with curl first - the whole thing is plain text and readable, which is the
    point.

    On the Pi:

    dhcp setenv pxefile_addr_r 0x02000000 wget ${pxefile_addr_r} http://<fogserver>/fog/service/uboot/boot.php?mac=${ethaddr} pxe boot ${pxefile_addr_r}

    Use pxe boot, not sysboot. Every extlinux example you’ll find online shows
    sysboot, and it’s wrong here - sysboot reads a config off a filesystem on a
    block device, so it can’t see what wget just put in memory and does nothing
    visible. That’s the one I’d expect to catch people out.

    This should also fix your truncation. “Unknown request type :: Null” was $type
    arriving empty because your bootargs were being cut short, and I pointed at
    U-Boot’s command buffer rather than the kernel. pxe boot doesn’t go through
    that buffer - it parses the append line out of the loaded file straight into
    bootargs, so the ceiling you were hitting isn’t in the path any more. Worth
    confirming, since I’m reasoning about your build rather than looking at it.

    Two deliberate omissions, both because they’re properties of your board and not
    of FOG:

    FOG serves no device tree. No fdt or fdtdir directive, so you keep the tree at
    ${fdtcontroladdr} - the one VideoCore just built for the exact board revision
    it’s running on, which is better than anything I could serve you. Load
    addresses stay yours for the same reason.

    And FOG writes no pxelinux.cfg files. The endpoint is stateless: the board asks
    by MAC and gets an answer out of the database, so there’s nothing on disk to
    drift from what’s actually queued and nothing to clean up when a task finishes.

    One thing to check before you start: if your FOG install has netboot set to
    HTTPS, none of this will work. U-Boot’s wget is HTTP-only with no TLS at all,
    so it can’t even fail a certificate check - the redirect just ends the boot with
    nothing on screen. The installer now exempts service/uboot/ from the HTTP-to-
    HTTPS redirect the same way it does service/ipxe/, but only when netboot is
    configured for HTTP in the first place.

    Full write-up is in docs/UBOOT_ARM_BOOT.md in the repo.

    Being straight about what this is: the emitted config is pinned byte-for-byte
    by tests and the decisions behind it are the same code the iPXE path runs, so I
    know FOG emits what I intended. What I can’t tell you is that a real U-Boot
    consumes it, because nobody here has a Pi. You’re the only person who can prove
    that, and if it’s wrong I’d rather hear it than not.

  • Get the latest news on what's happening.
    184 Topics
    825 Posts
    A

    @Tom-Elliott I really appreciate that you are putting effort into providing more frequent releases, which makes it easier for everyone to deploy new security fixes in time. Keep up the good work!

  • View tutorials or talk about FOG in general.
    2k Topics
    19k Posts
    K

    @jmeyer The first screenshot, I can’t really say what’s wrong beyond for some reason, shim either immediately exits or doesn’t start so the EFI instead moves onto the next boot option which is IPv6.

    The second one, MOK.DER is being loaded, but mokmanager itself (which does the enrolling) is failing to load. Exec format error is usually caused either by trying to load a binary built for the wrong architecture (e.g arm on an x86 CPU) or when you have Secure Boot enabled, but the binary you’re trying to load isn’t signed by one of the keys enrolled in the firmware.

    So, for the second one, double check that you have the Microsoft keys enrolled in the firmware, or try it with secureboot off and see if that fixes it.

    I’m not quite sure what to suggest for the first one, other than maybe try network booting with secureboot off to the standard snponly.efi binary.

  • Report bugs, request features, or get the latest progress.
    2k Topics
    21k Posts
    Tom ElliottT

    @Valer I think we need to understand what this plugin is doing.

    CSS isn’t something we’ve allowed to be injectable though it could be.

    You can still use your own CSS but that’s more at the FOG Configuration -> FOG Setting -> FOG_THEME, but you would need to put it on your server in a location you type the path too here.

    https://docs.fogproject.org/en/latest/development/plugin-development

    This is a good toolkit for understanding how to build your own plugin.

63

Online

12.7k

Users

17.6k

Topics

157.0k

Posts