Subject: RPLD actually works (to some degree)!

From: Alexander Oelzant <[email-masked]>
Date: Sun, 7 May 2000 20:45:22 +0200

First of all, thanks for the great project that rpld is. Although I only
managed to do some things with tweaks, it finally worked on the two
rpld clients I had.

The tweaks:

- setting the second interface. All servers I used had more than one
  interface, so I ended up handing the daemon the interface name in argv[1].
- delay. on the pentia PACKET_DELAY=10000 seems to be  about the lowest useful 
  value
- the 3c509 ROM uses/expects a different SAP type (0xf8) in (some?) cases,
  so I liberalized the accept policy (llc.c ~ line 65) and went to send out
  packets using the new SAP. It still seems to work with my other card.
- when DEBUG is defined, I _do_ want output. Fork and >&/dev/null deactivated
  in that case
- on the 3c905 cards, I didn't have any success booting useful kernels,
  however the Etherboot Roms loaded and executed just fine over the
  network

The cards:

The first type is a ISA DE220 CT with ROM DE224A V1.01 of 1993 which
cycles through novell, RIPL and a seemingly proprietary DLINK boot
protocol in quick succession. Using the "linux" option was unsuccessful,
however, using the discrete load stages succeeded. The only "patch"
required for this card was to raise the delay time.

The other type is a weird 3c509 combo. The ROM seems to come from
Lanworks, and the machines are the >200 generic remote boot clients
used in the public labs[0] at the Vienna University of Technology, so I 
cannot send you a specimen without commiting theft ;-). 

Mainly, those cards are used for booting Window$ from a LanMan/NT
Server, which then presents the choice of booting either Windoze or
Linux (via loadlin), and usually this works relatively well.
A 3.6 M tcpdump -w of this procedure can be found at [1]; So the first
step was to extract the LanMan "executable"[2] from the dump and try it
out. The perl/tcpdump uglyness used to do this will only be revealed in 
cases of severe emergency.

It didn't work. Further analysis with ana/tcpdump revealed the nature of
the problem: as mentioned, the cards seemed to expect 0xf8 instead of
0xfc for the RPL_SAP in some cases. I made the appropriate patches and
it started working for the LanMan image, so I booted a kernel, but after
about half the kernel the boot stopped. I tried smaller kernels, but 2.2
wouldn't allow anything remotely bootable. In my despair I remembered my
favourite boot loader[3], which comes in cans, eh, can be booted from
floppy. From floppyload.S I deduced it wanted to be anywhere in memory
and only cared about being executed at byte 6:

        FILE {
                path = "/tftpboot/3c509.rom";
                load=0xd00;
        };
        execute = 0xd06;

It worked!

The two-stage concept is certainly ugly, but then via the etherboot
tagged nb-images you can boot either a linux or (free)bsd kernel, or a
DOS bootdisk; I haven't suceeded with netboot-style menus and block
devices, but that might be possible with some tweaks, too.

The Patch

I hate attaching files to mail, so I'll keep the patch on our web
servers.

Primary location:
 http://prawda.oeh.net/~aoe/mystuff/rpld/rpld.tuwien.patch
Secondary location:
 http://iswjestija.htu.tuwien.ac.at/~aoe/rpld.tuwien.patch

Enjoy!
   Alexander

ps. There is one more patch in the diff. The story behind it is quite
fantastic: since all user PCs boot via stinking 10 Mbps 3c509 cards, the
only protocol that is bound to reach all central servers is RPL (LLC?).
Since our Linux boot service needed something in the line of dhcp for
the kernel, as one had to suffice for all machines booted, the
hackers simply took rpld (afaik, I haven't looked at the source yet),
made it send (on the clients) and respond to (on the server) rpl-style
packets containing ip and hostname of the client. The ana patch now
decodes those instead of hanging in an infinite loop because of the ugly
nature of those "iPlok" packets :-)

[0] http://www.ben.tuwien.ac.at/ben/
[1] http://prawda.oeh.net/~aoe/mystuff/rpld/rpl-zid.w
[2] http://prawda.oeh.net/~aoe/mystuff/rpld/zid.img
[3] http://etherboot.sourceforge.net/
    formerly
    http://www.slug.org.au/etherboot/ 

-- 
Alexander Oelzant 		[email-masked]
Durchlaufstr. 7/4/5		[email-masked]
A-1200 Wien			+43-1-3500929
Austria - Europe		internic, ripe, bofh: !ao418	McQ