Secure Boot with your own keys

There may be a cleaner way to do this, but this is what worked for me with my Blackbird.

1. Set up a Debian Stretch build environment in accordance with the instructions on the Compiling Firmware page.
2. Set environmental variables (for the purposes of this walkthrough and its helper functions) referring to the OpenPower build directory and the directory where you will be placing your firmware signing keys:

   1 export OPBUILDDIR=~/blackbird-op-build
   2 export KEYDIR=~/new-keys
   

3. Generate the keys you will be using to secure your hardware:

   1 mkdir $KEYDIR
   2 cd $KEYDIR
   3 openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_a.key
   4 openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_b.key
   5 openssl ecparam -genkey -outform pem -noout -name secp521r1 -out hw_key_c.key
   6 openssl ecparam -genkey -outform pem -noout -name secp521r1 -out sw_key_a.key
   

4. Edit $OPBUILDDIR/openpower/configs/hostboot/blackbird.config or $OPBUILDDIR/openpower/configs/hostboot/talos.config (depending on which system you have) and remove or comment out the unset SECUREBOOT line.
5. Follow the Compiling Firmware instructions for building the OpenPower firmware. Run op-build menuconfig before the final op-build if you want to customize your build in some way.
6. Replace the keys and key hashes in the pulled code with your own. I've provided some helper functions for this purpose and described the procedure below.

    1 # Helper functions:
    2 
    3 get_keyhash () {
    4 	$OPBUILDDIR/output/host/bin/create-container -v -w0 \
    5 		-a $1/hw_key_a.key -b $1/hw_key_b.key -c $1/hw_key_c.key \
    6 		--payload /dev/zero --imagefile /dev/null | grep "HW keys hash";
    7 }
    8 
    9 check_keys () {
   10 	while read p; do echo `dirname $p`; get_keyhash `dirname $p`; echo '--'; done <<< $(find -name hw_key_a.*)
   11 }
   12 
   13 replace_keys () {
   14 	NEWKEYHASH=$(get_keyhash $KEYDIR);
   15 	while read p; do
   16 		OLDKEYHASH=$(get_keyhash `dirname $p`);
   17 		if [ "$OLDKEYHASH" != "$NEWKEYHASH" ]; then
   18 			echo "Replacing keys in `dirname $p`"
   19 			cp -a $KEYDIR/. $(dirname $p)
   20 		fi
   21 	done <<< $(find -name hw_key_a.*)
   22 }
   23 
   24 check_imprints () {
   25 	while read p; do
   26 		echo "$p"
   27 		cat $p | xxd -p
   28 	done <<< $(find -name imprintHwKeyHash)
   29 }
   30 
   31 replace_imprints () {
   32 	NEWIMPRINT=$(get_keyhash $KEYDIR | cut -d' ' -f8);
   33 	while read p; do
   34 		OLDIMPRINT=$(cat $p | xxd -p);
   35 		OLDIMPRINT="${OLDIMPRINT//[$'\t\r\n ']}"
   36 		if [ "$OLDIMPRINT" != "$NEWIMPRINT" ]; then
   37 			echo "Replacing imprint $p"
   38 			echo "$NEWIMPRINT" | xxd -p -r > $p
   39 		fi
   40 	done <<< $(find -name imprintHwKeyHash)
   41 }
   42 
   43 untar_code () {
   44   untar_pkg () {
   45     cd $OPBUILDDIR/dl/$1/
   46     tar xzf $1-*.tar.gz
   47   }
   48   untar_pkg hostboot
   49   untar_pkg libflash
   50   untar_pkg sb-signing-utils
   51   untar_pkg skiboot
   52   untar_pkg pnv-lpc
   53   cd $OPBUILDDIR
   54 }
   55 
   56 retar_code () {
   57   retar_pkg () {
   58     cd $OPBUILDDIR/dl/$1/
   59     tar czf $1-*.tar.gz $1-*/
   60     rm -fr $1-/
   61   }
   62   retar_pkg hostboot
   63   retar_pkg libflash
   64   retar_pkg sb-signing-utils
   65   retar_pkg skiboot
   66   retar_pkg pnv-lpc
   67   cd $OPBUILDDIR
   68 }
   69 
   70 # Procedure:
   71 
   72 cd $OPBUILDDIR
   73 untar_code
   74 replace_keys
   75 replace_imprints
   76 retar_code
   

   You can confirm the process worked by running get_keyhash $KEYDIR and comparing the hash returned with the hashes returned by check_keys and check_imprints. They should all match.
7. Configure the build system to produce a key transition container in the PNOR image. Run op-build menuconfig and set External options -> OpenPower -> OpenPower Packages -> OpenPower PNOR assembly options -> Secure Boot key transition type to Transition existing keys to development keys. "Development keys" in the context of the build system means "keys existing locally on my hard drive." "Production keys" refer to keys on a signing server somewhere for which the build system will generate signing requests if any "Production key" options are set.
8. Clear the old build output and re-build. Our aim in building the first time was only to force the build system to populate the dl directory with all the source code it would be compiling.

   1 cd $OPBUILDDIR
   2 mv output/.config .
   3 rm -fr output/*
   4 mv .config output/
   5 op-build
   

9. Save a copy of output/images/ to an external drive. Rename the external drive's copy to transition-images or something similar.
10. Run op-build menuconfig again and set Secure Boot key transition type back to None.
11. Repeat the "clear the old build output and re-build" step.
12. Save a copy of output/images/ to an external drive.
13. Shutdown the computer.
14. Follow the instructions on the Compiling Firmware page to install the transition-images PNOR image on your external drive.
15. Make sure the "secure mode disable" jumper on your mainboard is set. (See the user manual for your mainboard if you need help locating this.)
16. Boot up the computer and then let it shut itself down. If you did not manually clear and set the ECC bits for your firmware during the installation process, the system may reboot itself first to set those bits. Once it is finished, the hash of your own keys should be "imprinted" on the processor's SEEPROM. To confirm this, you can run cat /proc/device-tree/ibm,secureboot/hw-key-hash | xxd -p in either the host OS or the Petitboot shell to see what value is currently set in the SEEPROM after replacing the key transition PNOR image with a non-transition one.
17. Follow the instructions on the Compiling Firmware page to install the images PNOR image on your external drive.
18. Make sure the "secure mode disable" jumper on your mainboard is unset.
19. Boot up the computer. It should now be booting in secure mode using your signed firmware!