[This may break your toys and doesn’t work. You have been warned.]

So I wanted to change the Soekris on the side of the house to prefer pxe boot so I could reinstall pyramid without needing to take it down to get to the serial console. Of course, to set this setting, you need to get into the serial console. Unless…

The settings are supposedly stored in the nvram so the box will still boot in cases of the bios battery dieing. So I’m valiantly trying to brick a soekris in an effort to maintain my laziness.

Start by making sure you have the /dev/nvram interface. In Pyramid you need to make it:

cd /dev ; ./MAKEDEV nvram

The nvram module will load when you access the device, provided modules.conf contains:

alias char-major-10-144 nvram

Grab a copy of the nvram:

cp /dev/nvram nvram.bin

I used hexdump to check out the nvram. If you’re running pyramid you’ll need to grab the binary. See the package website and grab bsdmainutils-6.1.2ubuntu1 (pyramid currently runs breezy) provided the mirrors are still up (canonical has started taking down breezy mirrors). You can grab hexdump out the deb:

mkdir hexdump-temp ; cd hexdump-temp
ar p ../bsdmainutils_6.1.2ubuntu1_i386.deb | tar xv
cd usr/bin
scp hexdump root@my.soekris:/usr/bin

Soekris 4526 (Metrix Mark I):

sunrise:~# hd nvram.bin
00000000  00 00 00 51 f0 00 01 80  02 00 fc 0f 2f 00 00 00  |...Q......../...|
00000010  00 00 00 80 81 f0 ff 00  00 00 00 00 00 00 00 00  |................|
00000020  05 ee 00 fc 19 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 05 28 08 06 0d 22  80 09 00 0c 06 2a 40 58  |...(...".....*@X|
00000040  0f 04 84 11 47 40 00 20  00 00 00 05 00 08 42 00  |....G@. ......B.|
00000050  07 00 c5 20 00 00 02 00  08 02 40 42 01 40 00 02  |... ......@B.@..|
00000060  84 4c 00 10 0b 20 00 34  c3 08 50 00 44 42 91 00  |.L... .4..P.DB..|
00000070  00 20                                             |. |
00000072

Soekris 4501:

sunrise:~# hexdump -C nvram.orig.4501 
00000000  00 00 00 51 f0 00 01 80  02 00 fc 0f 2f 00 00 00  |...Q......../...|
00000010  00 00 00 80 81 f0 ff 00  00 00 00 00 00 00 00 00  |................|
00000020  05 ee 00 fc 19 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 4c 32 0a 41  42 11 81 00 09 24 1d 80  |....L2.AB....$..|
00000040  0d 04 18 03 04 24 00 00  50 84 06 72 81 01 53 34  |.....$..P..r..S4|
00000050  c1 08 88 02 08 80 01 22  49 04 00 00 10 02 01 00  |......."I.......|
00000060  10 49 0a 02 22 04 48 06  07 48 08 25 06 61 00 02  |.I..".H..H.%.a..|
00000070  99 26                                             |.&|
00000072

In both cases I’m assuming 0x13 – 0x16 controls the boot order. 80 Primary IDE (flash), 81 Secondary IDE, f0 network boot and ff I have no clue.

I copied the file to my laptop and used hexer (vim like hex editing tool) to rewrite those bytes (use r for overwrite) then rewrite the nvram using:

cat nvram.new > /dev/nvram

I rebooted and the box came back up. But I didn’t see any network traffic. I booted up a local 4826 and used the cmos monitor to try to figure it out:

> show

ConSpeed = 19200
ConLock = Enabled
ConMute = Disabled
BIOSentry = Enabled
PCIROMS = Enabled
PXEBoot = Enabled
FLASH = Primary
BootDelay = 5
FastBoot = Disabled
BootPartition = Disabled
BootDrive = 99 FF FF FF 
ShowPCI = Enabled
Reset = Hard

> cmosread
Addr  CMOS Data

00: 06 00 43 00 19 00 07 19 01 80 26 02 50 80 00 00 
10: 00 51 FF 00 01 80 02 00 FC 0F 1F 00 00 00 00 00 
20: 00 80 81 F0 FF 00 00 00 00 00 00 00 00 00 05 ED 
30: 00 FC 19 00 00 00 00 00 00 00 00 00 00 00 00 00 
40: D9 BF FB AE 0C 72 2B 84 9B FE 7B 7F 00 8C 10 05 
50: DD EB 5E FE 04 50 14 12 E7 DF 2F 73 A0 9E 42 01 
60: FB BB AD 77 0C 3B 40 BA 9B 9C F8 15 89 16 02 40 
70: 3D 97 A0 7A 4A 92 F8 24 B8 D9 

> 

I ‘set BootDrive=99’ to make it stand out, rather than the default ‘set BootDrive=80,81,F0’ and you can see the 80,81,F0 around 0x21-0x23 doesn’t change. So I have no idea now where this data is actually stored.