valtzu / pipxe

PXE-chainloadable iPXE for Raspberry Pi 4 with full diskless example

PXE-chainloadable iPXE for the Raspberry Pi 4

piPXE is a build of the iPXE network boot firmware for the Raspberry Pi.

Quick start

1. Bring TFTP/PXE server up – set variables according to your network. You can use .env file for convenience.

git clone https://github.com/valtzu/pixpe
cd pixpe/example
INTERFACE=eth0 SUBNET=192.168.1.0 NETMASK=255.255.255.0 docker-compose up

2. Power on your Raspberry Pi 4 with Ethernet cable attached to the same network as your $INTERFACE above
3. Wait a couple of minutes, it should load images directly from the images.maas.io (~500MB or so)
4. You can now SSH to the machine (get the IP from dnsmasq output for example), username unsafe, password unsafe

Build from source

git clone https://github.com/valtzu/pixpe
cd pixpe
docker-compose up 

HTTP boot

Boot sequence

1. EEPROM loads http://your-server/net_install/boot.img and verifies it against http://your-server/net_install/boot.sig
2. start4.elf is launched (from boot.img)
3. UEFI (RPI_EFI.fd) is launched (from boot.img), defined in config.txt: armstub=RPI_EFI.fd
4. iPXE (embedded inside RPI_EFI.fd as EFI driver) is launched
5. iPXE looks up autoexec.ipxe from SD card or from TFTP server (which may be resolved using DHCP)

Embedding iPXE script inside boot.img makes it possible to iPXE boot from internet, without SD card or TFTP server, eliminating step number 5 above.

Implementation

1. Build boot.img with docker-compose run --rm build make EMBED=/opt/build/autoexec.ipxe (or wherever your ipxe script is)
2. Create 2048-bit RSA key pair in PEM format (Google is your friend)
3. Create boot.sig from boot.img with rpi-eeprom-digest -i boot.img -o boot.sig -k your-private-key.pem
4. Copy boot.img to your HTTP server (you may need to also sign it with rpi-eeprom-digest)
5. Flash EEPROM with your public key, BOOT_ORDER, HTTP_HOST etc. – but note that HTTP_PATH does not work and is always net_install (2022-04-02). See official docs on HTTP boot.

All of the above is made easy with valtzu/pipxe-http.

Licence

Every component is under an open source licence. See the individual subproject licensing terms for more details:

• https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
• https://github.com/tianocore/edk2/blob/master/Readme.md
• https://ipxe.org/licensing

pipxe's Issues

ipxe build problem

Can't build ipxe (on ArchLinux current) - any clue ?
docker-compose up
.................
⠿ Container pipxe-build-1 Created 0.3s
Attaching to pipxe-build-1
pipxe-build-1 | which git && git submodule update --init --recursive || true
pipxe-build-1 | /usr/bin/git
pipxe-build-1 | make -C edk2/BaseTools
pipxe-build-1 | mkdir -p $(dirname ipxe/src/config/local/rpi/console.h) || true
pipxe-build-1 | mkdir -p $(dirname ipxe/src/config/local/rpi/general.h) || true
pipxe-build-1 | make[1]: Entering directory '/opt/build/edk2/BaseTools'
pipxe-build-1 | make -C Source/C
pipxe-build-1 | make -C Source/Python
pipxe-build-1 | make[2]: Entering directory '/opt/build/edk2/BaseTools/Source/C'
pipxe-build-1 | echo "#undef LOG_LEVEL" > ipxe/src/config/local/rpi/console.h
pipxe-build-1 | Attempting to detect HOST_ARCH from 'uname -m': x86_64
pipxe-build-1 | echo "#define DOWNLOAD_PROTO_HTTPS" > ipxe/src/config/local/rpi/general.h
pipxe-build-1 | make[2]: Entering directory '/opt/build/edk2/BaseTools/Source/Python'
pipxe-build-1 | make[2]: Nothing to be done for 'all'.
pipxe-build-1 | make[2]: Leaving directory '/opt/build/edk2/BaseTools/Source/Python'
pipxe-build-1 | echo "#define LOG_LEVEL LOG_ALL" >> ipxe/src/config/local/rpi/console.h
pipxe-build-1 | echo "#define NTP_CMD" >> ipxe/src/config/local/rpi/general.h
pipxe-build-1 | echo "#define CONSOLE_SYSLOG CONSOLE_USAGE_ALL" >> ipxe/src/config/local/rpi/console.h
pipxe-build-1 | Detected HOST_ARCH of X64 using uname.
pipxe-build-1 | make -C ipxe/src CROSS=aarch64-linux-gnu- CONFIG=rpi bin-arm64-efi/snp.efi
pipxe-build-1 | make[1]: Entering directory '/opt/build/ipxe/src'
pipxe-build-1 | mkdir -p .
pipxe-build-1 | make -C Common
pipxe-build-1 | make[3]: Entering directory '/opt/build/edk2/BaseTools/Source/C/Common'
pipxe-build-1 | make[3]: Leaving directory '/opt/build/edk2/BaseTools/Source/C/Common'
pipxe-build-1 | make[3]: *** No rule to make target '/usr/lib/gcc/x86_64-pc-linux-gnu/12.1.1/include/stdint.h', needed by 'BasePeCoff.o.
pipxe-build-1 | make[2]: *** [GNUmakefile:76: Common] Error 2
pipxe-build-1 | make[2]: Leaving directory '/opt/build/edk2/BaseTools/Source/C'
pipxe-build-1 | make[1]: *** [GNUmakefile:19: Source/C] Error 2
pipxe-build-1 | make[1]: Leaving directory '/opt/build/edk2/BaseTools'
pipxe-build-1 | make: *** [Makefile:38: efi-basetools] Error 2
pipxe-build-1 | make: *** Waiting for unfinished jobs....
pipxe-build-1 | [BUILD] bin-arm64-efi/acpi.o
pipxe-build-1 | [BUILD] bin-arm64-efi/acpi_settings.o
pipxe-build-1 | [BUILD] bin-arm64-efi/acpimac.o
pipxe-build-1 | [BUILD] bin-arm64-efi/ansicol.o
pipxe-build-1 | [BUILD] bin-arm64-efi/ansicoldef.o
pipxe-build-1 | [BUILD] bin-arm64-efi/ansiesc.o
pipxe-build-1 | [BUILD] bin-arm64-efi/archive.o
pipxe-build-1 | [BUILD] bin-arm64-efi/asprintf.o
pipxe-build-1 | [BUILD] bin-arm64-efi/assert.o
pipxe-build-1 | In file included from core/ansicol.c:31:
pipxe-build-1 | ./config/colour.h:35:10: fatal error: config/local/colour.h: No such file or directory
pipxe-build-1 | 35 | #include <config/local/colour.h>
pipxe-build-1 | | ^~~~~~~~~~~~~~~~~~~~~~~
pipxe-build-1 | compilation terminated.

same without docker:

Ran 301 tests in 0.987s

OK
make[3]: Leaving directory '/tmp/pipxe-http/pipxe/edk2/BaseTools/Tests'
make[2]: Leaving directory '/tmp/pipxe-http/pipxe/edk2/BaseTools'
mkdir -p $(dirname ipxe/src/config/local/rpi/console.h) || true
echo "#undef LOG_LEVEL" > ipxe/src/config/local/rpi/console.h
echo "#define LOG_LEVEL LOG_ALL" >> ipxe/src/config/local/rpi/console.h
echo "#define CONSOLE_SYSLOG CONSOLE_USAGE_ALL" >> ipxe/src/config/local/rpi/console.h
mkdir -p $(dirname ipxe/src/config/local/rpi/general.h) || true
echo "#define DOWNLOAD_PROTO_HTTPS" > ipxe/src/config/local/rpi/general.h
echo "#define NTP_CMD" >> ipxe/src/config/local/rpi/general.h
make -C ipxe/src CROSS=aarch64-linux-gnu- CONFIG=rpi bin-arm64-efi/ipxe.efidrv
make[2]: Entering directory '/tmp/pipxe-http/pipxe/ipxe/src'
[BUILD] bin-arm64-efi/acpi.o
In file included from include/ipxe/uaccess.h:27,
from core/acpi.c:28:
./config/ioapi.h:19:10: fatal error: config/local/ioapi.h: No such file or directory
19 | #include <config/local/ioapi.h>
| ^~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
make[2]: *** [Makefile.housekeeping:952: bin-arm64-efi/acpi.o] Error 1
make[2]: Leaving directory '/tmp/pipxe-http/pipxe/ipxe/src'
make[1]: *** [Makefile:64: ipxe/src/bin-arm64-efi/ipxe.efidrv] Error 2
make[1]: Leaving directory '/tmp/pipxe-http/pipxe'
make: *** [Makefile:22: dist/boot-ubuntu-jammy.img] Error 2