6.0 KiB
6.0 KiB
https://wiki.raptorcs.com/wiki/Secure_Boot_with_your_own_keys
Secure Boot with your own keys
Disclaimer: There may be a cleaner way to do this. There may also be a way to speed the process up using partial rebuilds. This guide was created by Fizzbuzz and successfully tested on a Blackbird system using the raptor-v2.00 branch of the blackbird-op-build firmware repository.
- Set up a Debian Stretch build environment in accordance with the instructions on the Compiling Firmware page.
- Set environmental variables (for the purposes of this walkthrough and its helper functions) referring to the OpenPower build directory and the directory where you will be placing your firmware signing keys:
export OPBUILDDIR=~/blackbird-op-build
export KEYDIR=~/new-keys
- Generate the keys you will be using to secure your hardware:
mkdir $KEYDIR
cd $KEYDIR
openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_a.key
openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_b.key
openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_c.key
openssl ecparam -genkey -outform pem -noout -name secp521r1 -out sw_key_a.key
- Edit
$OPBUILDDIR/openpower/configs/hostboot/blackbird.config
or$OPBUILDDIR/openpower/configs/hostboot/talos.config
(depending on which system you have) and remove or comment out theunset SECUREBOOT
line. - Follow the Compiling Firmware instructions for building the OpenPower firmware. Run
op-build menuconfig
before the finalop-build
if you want to customize your build in some way. - Replace the keys and key hashes in the pulled code with your own. I've provided some helper functions for this purpose and described the procedure below.
# Helper functions:
get_keyhash () {
$OPBUILDDIR/output/host/bin/create-container -v -w0 \
-a $1/hw_key_a.key -b $1/hw_key_b.key -c $1/hw_key_c.key \
--payload /dev/zero --imagefile /dev/null | grep "HW keys hash";
}
check_keys () {
while read p;
do echo `dirname $p`;
get_keyhash `dirname $p`;
echo '--';
done <<< $(find -name hw_key_a.*)
}
replace_keys () {
NEWKEYHASH=$(get_keyhash $KEYDIR);
while read p; do
OLDKEYHASH=$(get_keyhash `dirname $p`);
if [ "$OLDKEYHASH" != "$NEWKEYHASH" ]; then
echo "Replacing keys in `dirname $p`"
cp -a $KEYDIR/. $(dirname $p)
fi
done <<< $(find -name hw_key_a.*)
}
check_imprints () {
while read p; do
echo "$p"
cat $p | xxd -p
done <<< $(find -name imprintHwKeyHash)
}
replace_imprints () {
NEWIMPRINT=$(get_keyhash $KEYDIR | cut -d' ' -f8);
while read p; do
OLDIMPRINT=$(cat $p | xxd -p);
OLDIMPRINT="${OLDIMPRINT//[$'\t\r\n ']}"
if [ "$OLDIMPRINT" != "$NEWIMPRINT" ]; then
echo "Replacing imprint $p"
echo "$NEWIMPRINT" | xxd -p -r > $p
fi
done <<< $(find -name imprintHwKeyHash)
}
untar_code () {
untar_pkg () {
cd $OPBUILDDIR/dl/$1/
tar xzf $1-*.tar.gz
}
untar_pkg hostboot
untar_pkg libflash
untar_pkg sb-signing-utils
untar_pkg skiboot
untar_pkg pnv-lpc
cd $OPBUILDDIR
}
retar_code () {
retar_pkg () {
cd $OPBUILDDIR/dl/$1/
tar czf $1-*.tar.gz $1-*/
rm -fr $1-/
}
retar_pkg hostboot
retar_pkg libflash
retar_pkg sb-signing-utils
retar_pkg skiboot
retar_pkg pnv-lpc
cd $OPBUILDDIR
}
# Procedure:
cd $OPBUILDDIR
untar_code
replace_keys
replace_imprints
retar_code
You can confirm the process worked by running get_keyhash $KEYDIR
and comparing the hash returned with the hashes returned by check_keys
and check_imprints
. They should all match.
- Configure the build system to produce a key transition container in the PNOR image. Run
op-build menuconfig
and setExternal options -> OpenPower -> OpenPower Packages -> OpenPower PNOR assembly options -> Secure Boot key transition type
toTransition existing keys to development keys
. "Development keys" in the context of the build system means "keys existing locally on my hard drive." "Production keys" refer to keys on a signing server somewhere for which the build system will generate signing requests if any "Production key" options are set. - Clear the old build output and re-build. Our aim in building the first time was only to force the build system to populate the
dl
directory with all the source code it would be compiling.
cd $OPBUILDDIR
mv output/.config .
rm -fr output/*
mv .config output/
op-build
- Save a copy of
output/images/
to an external drive. Rename the external drive's copy totransition-images
or something similar. - Run
op-build menuconfig
again and setSecure Boot key transition type
back toNone
. - Repeat the "clear the old build output and re-build" step.
- Save a copy of
output/images/
to an external drive. - Shutdown the computer.
- Follow the instructions on the Compiling Firmware page to install the
transition-images
PNOR image on your external drive. - Make sure the "secure mode disable" jumper on your mainboard is set. (See the user manual for your mainboard if you need help locating this.)
- Boot up the computer and then let it shut itself down. If you did not manually clear and set the ECC bits for your firmware during the installation process, the system may reboot itself first to set those bits. Once it is finished, the hash of your own keys should be "imprinted" on the processor's SEEPROM. To confirm this, you can run
cat /proc/device-tree/ibm,secureboot/hw-key-hash | xxd -p
in either the host OS or the Petitboot shell to see what value is currently set in the SEEPROM after replacing the key transition PNOR image with a non-transition one. - Follow the instructions on the Compiling Firmware page to install the
images
PNOR image on your external drive. - Make sure the "secure mode disable" jumper on your mainboard is unset.
- Boot up the computer. It should now be booting in secure mode using your signed firmware!