Booting CentOS 7 via iPXE on UEFI (HP G9)

[allenb]

Hi All,

Wanted to pass along a little bit more information which could be of use down the line. I've got two workable methods for booting the CentOS 7 installer via iPXE on a UEFI system. I hope this information is useful to someone.

Method 1: The somewhat ugly workaround for unmodified images.

It seems possible to consistently boot the completely stock CentOS 7 pxeboot files with something like this:

initrd <%= kickstart %>/allen/blank32m.bin
initrd <%= kickstart %>/allen/centos7-initrd.img
initrd <%= kickstart %>/allen/blank32m.bin
kernel <%= kickstart %>/allen/centos7-vmlinuz initrd=centos7-initrd.img
initrd <%= kickstart %>/allen/blank32m.bin
boot

The files called "blank32m.bin" contain 32MB of nulls. The idea was to take up space and prevent anything from being overwritten due to the pre-3.16 bug in EFISTUB. I came up with this in a moment of semi-desperation and I've not read the ipxe source to understand how useful it may actually be. However, it does work in our environment and may be worth a try for other folks. Perhaps mcb30 or another dev can weigh in.

(this came up when I ran into a hardware combination where merely reversing the order of initrd & kernel as described above no longer worked)

Method 2: Using a newer ELRepo kernel which has the relevant EFISTUB fix which appeared in 3.16

This works without any silly magical guesswork/hacks with the loading of initrd as in the first method. The downside is that it requires you to extract, modify, and rebuild the pxeboot/initrd.img provided by CentOS 7. Essentially what you'll be doing is inserting the necessary /lib/modules directory from a newer ELRepo kernel package and then making a few changes so that it will all work. Note that this does not affect which kernel is eventually installed via Kickstart.

NOTE: I posted this a few hours ago using the CentOS kernelplus kernel which claims to have backported the EFISTUB patch, per https://bugs.centos.org/view.php?id=8295. As best I can determine, it doesn't work, or doesn't work reliably on all of my hardware. This update appears to.

1. Download the ELRepo kernel rpm. I'm using kernel-ml-4.5.0-1.el7.elrepo.x86_64.rpm from http://elrepo.org/linux/kernel/el7/x86_6...x86_64.rpm

2. Extract that rpm to a temporary directory via "rpm2cpio ../kernel-ml-4.5.0-1.el7.elrepo.x86_64.rpm | cpio -idum"

3. Download the initrd.img, such as from http://mirror.centos.org/centos-7/7/os/x...initrd.img

4. Extract that into another temporary directory via "xzcat ../initrd.img | cpio -idum"

Note that my temporary directories are called "kernel" and "initrd", within a "repack" directory. I'm running as root to keep file ownership correct.

5. Within initrd, "rm -r lib/modules/3.10.0-327.el7.x86_64"

6. From the upper "repack" directory, copy over the modules provided with the new kernel by using "rsync -a kernel/lib/modules/4.5.0-1.el7.elrepo.x86_64 initrd/lib/modules"

7. Build the dependency information. You'll need to adjust your absolute path but for me it's "depmod -ae -b /home/abelletti/repack/initrd 4.5.0-1.el7.elrepo.x86_64"

8. Within initrd, mkdir "etc/modules-load.d"

9. echo "loop" >etc/modules-load.d/loop.conf

10. echo -e "libcrc32c\nxfs" >etc/modules-load.d/xfs.conf

11. echo -e "fat\nvfat" >etc/modules-load.d/fat.conf

NOTE: Why steps 9-11? It turns out that the kernel signing key that's used for the regular CentOS 7 kernel and modules isn't the same as the one used by ELRepo. By the time these modules (loop, libcrc32c, xfs, fat, and vfat) are called for, Dracut has already replaced our /lib/modules directory with the one in squashfs.img. As a result, the modules won't load. Listing them in modules-load.d forces them to be loaded earlier, when the kernel and module keys still match.

12. Again from initrd, build the new img file. NOTE: The CentOS kernelplus kernel which I originally tried to use seems to be built without support for xz compression. I'm using lzma instead, which does work: "find . | cpio --create --format='newc' | lzma > /your/boot/files/centos7-elrepo45-initrd-lzma.img

13. From repack, "cp kernel/boot/vmlinuz-4.5.0-1.el7.elrepo.x86_64 /your/boot/files/vmlinuz-4.5.0-1.el7.elrepo.x86_64"

14. Adjust your ipxe configuration as needed. I'm using:

initrd <%= kickstart %>/allen/centos7-elrepo45-initrd-lzma.img
chain <%= kickstart %>/allen/4.5.0-1.el7.elrepo.x86_64 initrd=centos7-elrepo45-initrd-lzma.img lots-of-other-kernel-options

15. Give it a try! I went through the process as I wrote the above, and it's working for me so hopefully will work for you. If you have any questions, I'll be glad to assist if I can.

Cheers,
Allen Belletti