x86 Network Boot with iPXE

xCAT boots x86 nodes with iPXE through two netboot methods:

  • ipxe: the unmodified iPXE release in the ipxe-xcat package.

  • xnba: the xCAT Network Boot Agent in the xnba-undi package, a patched iPXE. This method is deprecated, and a later release removes it.

Both methods run the same boot scripts. nodeset writes them under xcat/ipxe/nodes for ipxe and under xcat/xnba/nodes for xnba. The xCAT packages install both ipxe-xcat and xnba-undi.

New x86 nodes get netboot=ipxe: node discovery, profile-based node definitions and the x86 node templates of mkdef --template set it.

The upstream loader

A node with netboot=ipxe that boots with the PXE firmware of its network card loads one of these files from /tftpboot on its TFTP server:

  • BIOS: xcat/ipxe/i386/undionly.kpxe. This is the 32-bit build, so it also boots 32-bit x86 nodes.

  • UEFI: xcat/ipxe/x86_64-sb/snponly-shim.efi, the shim of the iPXE project, which Microsoft signs. The shim loads snponly.efi from the same directory, which the iPXE Secure Boot CA signs. The node boots with UEFI Secure Boot on or off.

iPXE then sends a new DHCP request. The node gets its boot script only when it reports the iPXE features that the script needs in DHCP option 175. For BIOS these are HTTP, bzImage and PXE, and for UEFI they are HTTP and EFI. A node with an iSCSI disk in the iscsi table also needs iSCSI, because iPXE connects that disk before it runs the script. Every other client of the node gets the file above first, including an iPXE in network card firmware that lacks one of these features.

makedhcp names these files even when they are missing on its own server, because a node or a network can use another TFTP server.

Nodes without a definition

An x86 client without a node definition, such as a node in discovery, gets the upstream loader, whatever the method of the other nodes. It then gets the Genesis script of its network from xcat/ipxe/nets, which mknb writes. These clients load from the DHCP server itself, so makedhcp names a loader file for them only when it is in the local TFTP directory, as it does for xNBA.

On a server that serves x86 discovery, makedhcp -n and makedhcp -a warn when an upstream loader file is missing from the local TFTP directory, or when xcat/ipxe/nets has no network boot script.

Move nodes to the ipxe method

  1. Upgrade the management node and every service node that runs DHCP or owns a TFTP directory. The package dependencies install ipxe-xcat.

  2. List every TFTP directory that serves x86 nodes: the management node, each service node with sharedtftp=0, the host that sharedtftp=<hostname> names, and each node or network tftpserver.

  3. For each TFTP directory, run mknb on the xCAT server that writes the directory. Run it for each x86 architecture that the cluster serves: x86_64, and x86 for 32-bit nodes. Alternatively, copy the xcat/ipxe/nets scripts and the ipxe-xcat files into the directory.

  4. In each TFTP directory, make sure that xcat/ipxe/i386/undionly.kpxe, xcat/ipxe/x86_64-sb/snponly-shim.efi and xcat/ipxe/x86_64-sb/snponly.efi exist.

  5. Run makedhcp -n and then makedhcp -a, so that every DHCP server writes its configuration again with the reservations of every node. Between the two commands the DHCP servers have no reservations. Unknown x86 clients now get the upstream loader.

  6. Set the method of the nodes, and run nodeset for them again:

    chdef <noderange> netboot=ipxe
nodeset <noderange> osimage=<osimage>

To go back to xNBA, set netboot=xnba on the nodes, keep xnba-undi installed on every TFTP directory, and run nodeset for them again. Site scripts that use ${netX/machyp} do not work with the upstream loader: use ${netX/mac:hexhyp}.

UEFI Secure Boot

With Secure Boot on, the firmware loads the shim only when it trusts the Microsoft third-party UEFI CA, 2011 or 2023, that signs it. Some firmware turns that CA off by default: turn it on in the firmware setup.

Secure Boot covers the loader only. The boot scripts then load a Linux kernel, elilo-x64.efi or the Genesis kernel, and the firmware refuses each one that no key in its database signs. Install nodes and run Genesis with Secure Boot off.

Known limits of the upstream loader

  • Local boot on BIOS nodes: undionly.kpxe unloads the PXE stack of the network card. When a boot script runs exit to boot from the local disk, iPXE returns to the BIOS through INT 18h. The BIOS then boots the next device in its boot order. Make sure that local boot works on your BIOS hardware before you move nodes.

  • UEFI on some older Lenovo laptops: iPXE v2.0.0 stops the UEFI Dhcp6 driver, and some older Lenovo laptops hang (https://github.com/ipxe/ipxe/issues/1358). Use netboot=grub2 for these nodes.