OpenBSD On A Raspberry Pi 4

Installing OpenBSD on a Raspberry Pi 4, hereafter simply referred to as an RPi4, can be somewhat of a challenge, specifically with respect to setting up the EFI boot partition. The U-Boot EFI code used on earlier models of the Pi does not seem to be as reliable on the RPi4. This document attempts to describe how to install OpenBSD on an RPi4 using a different EFI boot system: EDK II.

The ultimate objective is to set up an OpenBSD system that boots directly from USB without the need of a microSD card or serial console. A serial console will not be required for any part of the build process. A microSD card WILL be required during part of the process but it will not be needed by the end result.

Overview

In broad brush strokes, the installation process consists primarily of the following steps:

  1. Set the RPi4 to boot from USB by default
  2. Get the EDK II UEFI firmware
  3. Create an OpenBSD install disk on a USB drive
  4. Install OpenBSD on a USB drive
  5. Configure the EDK II UEFI firmware

From a hardware standpoint, the RPi4 needs to be attached to an HDMI display and must have a USB keyboard attached. The keyboard should be directly attached because the OpenBSD installer (at least on the RPi4) does not always deal well with wireless USB devices. A hard-wired ethernet connection must also be attached because the OpenBSD installer will not have support firmware for the builtin wireless adapter. Finally, the process as described requires two USB drives: one for the OpenBSD installer and one for the final OpenBSD system.

Specific commands offered in subsequent sections are intended to be used on Unix-based systems. Commands used that may not be part of a base install on such a system include "sudo", "curl", and "unzip". These will need to be installed. If the Unix-based system being used is OpenBSD, the install can be performed by issuing the following command as root:

pkg_add curl sudo unzip

1. Set the RPi4 to boot from USB by default

To begin, put the RPi4 in USB boot mode, in which the RPi4 will first attempt to boot from USB and then from SD only if USB boot failed. This will be done using Pi OS.

1.1 Install Pi OS on a microSD card

The first step is to install Pi OS on a microSD card. This is necessary because the RPi4 will initially possibly only boot from SD. For those not familiar with the Pi OS install process, straightforward instructions can be found on the Raspberry Pi web site at:

which uses a short video to outline the process.

1.2 Make sure Pi OS is up to date

Pi OS and the EEPROM update program should be at the most recent version.

  1. Boot the Pi OS microSD card just created.
  2. Open a terminal session.
  3. Issue the following commands:
    sudo apt update
    sudo apt full-upgrade
    sudo apt install rpi-eeprom
    
  4. Reboot the system.

1.3 Make sure the EEPROM is up to date

In order to set USB boot mode, it is necessary to make sure that the RPi4 EEPROM is set to a sufficiently recent version. To find the EEPROM version that is set, boot the Pi OS system once again (if necessary), open a terminal session, and issue the command:

sudo rpi-eeprom-update

The lines in the output that begin with "CURRENT:" identify the version of the EEPROM that is active. The date should be at least Apr 29/2021! If the active EEPROM is acceptable, then no further action needs be taken in this section of the process.

If the EEPROM needs to be updated, or if it's simply desired to get to a newer level, the process to do so is as follows:

1.3.1 Set the EEPROM release

Two useful releases of the EEPROM are available: "default" and "latest" (also known as "critical" and "stable", respectively). The "raspi-config" program can be used to set the desired one. Issue the command:

sudo raspi-config

Select the following menu items:

Advanced Options > Bootloader Version

and then select the desired release. Select "<No>" when asked to reset the boot ROM to defaults.

Close the "raspi-config" program with:

<Finish>

The reboot, if offered, is optional.

1.3.2 Check for an EEPROM update

The EEPROM should be checked for an update. Re-issue the previous "rpi-eeprom-update" command:

sudo rpi-eeprom-update

The output will indicate if an update is available. Note that it will also identify which EEPROM release is set.

1.3.3 Update the EEPROM

If an update is available, it can be installed with the following command:

sudo rpi-eeprom-update -a

followed by a reboot.

Anyone interested in more details about the RPi4 EEPROM and bootloader can find a wealth of information at:

1.4 Set the boot order

The final step in this phase is to use "raspi-config" to set the RPi4 boot order so as to give first priority to USB. While still running a terminal session in Pi OS, issue:

sudo raspi-config

Select the menu items:

Advanced Options > Boot Order

and select:

USB Boot    Boot from USB if available, otherwise boot from SD Card

Close the "raspi-config" program with:

<Finish>

Select "<Yes>" if asked whether or not to reboot.

A reboot is necessary for the boot order setting to take effect. If one was not done when closing "raspi-config", do a reboot now.

At this point, the default boot device should be USB. This can be verified with the command:

sudo rpi-eeprom-config

The output produced will contain a line of the form:

BOOT_ORDER=0xf14

If the value is "0xf14", then USB is the default boot device. Any other value indicates a different boot order ("0xf41" indicates that SD is the default boot device).

The process of setting of the boot order is now complete. The Pi OS system can be shut down and should not be needed any further (although it's always worth hanging onto).

2. Get the EDK II UEFI firmware

By default, OpenBSD uses U-Boot as the bootloader for its ARM support. It works well with the Raspberry Pi 3 but does not always seem to exhibit the same reliability with the Pi 4. An examination of alternatives produces EDK II as the most reasonable choice to use instead.

A version of EDK II compiled for use by the RPi4 can be downloaded from RPi4 UEFI Firmware. The most recent version at the time of writing is v1.32, which can be obtained on a Unix-based system with the following command:

curl -L -o /tmp/UEFI-1.32.zip \
   https://github.com/pftf/RPi4/releases/download/v1.32/RPi4_UEFI_Firmware_v1.32.zip

which will save the firmware as file "/tmp/UEFI-1.32.zip".

3. Create an OpenBSD install disk on a USB drive

Having obtained the EDK II firmware, it is now possible to create an OpenBSD installer disk that will boot from USB. The instructions in this section assume that this is being performed on a Unix-based OS.

3.1 Get the OpenBSD install image

OpenBSD install images can be downloaded from https://www.openbsd.org. The most recent release at the time of writing is version 7.0. The install image comes in two forms: a full install image and a miniroot image. The suggested version to use is the full install image, which can be obtained for the RPi4 via:

curl -L -o /tmp/install70.img https://cdn.openbsd.org/pub/OpenBSD/7.0/arm64/install70.img

The image will be saved as file "/tmp/install70.img".

3.2 Copy the install image to a USB drive

Use whatever tool that is appropriate for the OS being used to copy the OpenBSD install image to a USB drive. This can be done using:

sudo dd if=/tmp/install70.img of=/dev/rsdXc bs=1m

where "/dev/rsdXc" is the USB drive device name with "X" being an integer associated with the device. This form of device name is used by OpenBSD systems. Change the device name as needed for other Unix-based systems (such as Linux or MacOS). Note that the USB drive must be at least as large in capacity as the size of the image file.

3.2 Replace the boot partition on the USB drive

The U-Boot bootloader on the boot partition needs to be replaced with the EDK II firmware.

First, mount the boot partition. Note that the OS being used must support MSDOS file systems.

sudo mount -o -l -t msdos /dev/sdXi /mnt

Once again, make appropriate changes as needed for the USB drive device name. Make sure that the mount point, in this case: "/mnt", exists. The mount options in the command are OpenBSD-specific. Modify them as needed if using a different OS (the "-l" option means "use long file names").

Now, remove everything in that directory EXCEPT the "efi" directory, which the EDK II firmware needs.

sudo mv /mnt/efi /tmp
sudo rm -fr /mnt/*
sudo mv /tmp/efi /mnt

The only thing that should remain in the MSDOS file system is the "efi" directory.

Finally, extract the contents of the EDK II UEFI zip file into the MSDOS file system and unmount the file system.

sudo unzip -x /tmp/UEFI-1.32.zip -d /mnt
sudo umount /mnt

The USB installer drive should now be ready to boot on the RPi4.

4. Install OpenBSD on a USB drive

Two options exist with respect to installing OpenBSD: it can be installed on a new USB drive or it can be installed on the same USB drive as the installer (replacing the installer system). Particularly because the firmware will need to be replaced, these instructions will deal with installing OpenBSD on a new USB drive, where such replacement will be easier.

To start, make sure neither USB drive is plugged into the RPi4.

4.1 Install OpenBSD on a new USB disk drive

Plug the installer USB drive into the RPI4 and power it on. The system will start to boot. When the raspberry image appears, press the "<esc>" key. This will cause the boot process to enter into a BIOS-like screen. Depending on the speed of the USB drive and the RPi4, it may not allow much time so pay attention.

At this time, plug the new destination USB drive into the RPi4. Doing it this way ensures that the boot process starts from the proper disk (the one with the EDK II firmware).

Now, on the BIOS screen, select:

Boot Manager

On the resulting screen, select the OpenBSD installer USB device. The boot process will continue.

Install OpenBSD as per normal.

At the end, when the install process asks:

Exit to (S)hell, (H)alt or (R)eboot?

select "Shell". Some final changes need to be made.

Note that at this time, the newly installed partitions, including the boot partition, are still mounted.

4.2 Change the console on the new system

Set the console on the new system to HDMI:

echo 'set tty fb0' > /mnt/etc/boot.conf

4.3 Replace the firmware on the new system

Issue the following commands to copy the EDK II firmware and OpenBSD EFI file to the boot partition:

rm -fr /mnt/mnt/*

mount -o -l -t msdos /dev/sdXi /mnt2

cp -pr /mnt2/* /mnt/mnt

where "sdX" is the installer USB drive.

Note that if the new system had been installed on the same USB drive as the installer, this would not have been possible as the EDK II firmware on the installer disk would have been erased.

Now halt the completed OpenBSD install process, power off the RPi4, and remove the installer USB drive.

5. Configure the EDK II UEFI firmware

Some final configuration options need to be set on the new OpenBSD system's firmware. Start the RPi4 with the new OpenBSD system USB drive and, once again, halt the boot process with the "<esc>" key when the raspberry image appears.

5.1 Modify RAM and device table settings

In the BIOS window, select:

Device Manager > Raspberry Pi Configuration > Advanced Configuration

In the resulting window, set:

"Limit RAM to 3 GB"       to  "Disabled"
"System Table Selection"  to  "Devicetree"

Press the "F10" key when done and respond with "Y" when asked to confirm.

Repeatedly press the "<esc>" key until the screen is back to the top level of the BIOS windows.

5.2 Change the boot order in the firmware

In the BIOS window, now select:

Boot Maintenance Manager > Boot Options > Change Boot Order

Then:

1. Press "<enter>" to start the boot order change process.
2. Use the arrow keys to highlight the USB disk drive choice.
3. Press the "+" key repeatedly to move that choice to the top of the list.
4. Press "<enter>" to complete the boot order change process.

Press the "F10" key when done and respond with "Y" when asked to confirm.

Repeatedly press the "<esc>" key until the screen is back to the top level of the BIOS windows.

5.3 Reset the firmware

In the BIOS window, select:

Reset

This will restart the entire boot process with the new settings.

The boot process can now be allowed to continue uninterrupted. It should start the new OpenBSD system which should be ready for normal use.

Closing Remarks

These notes are a personal record of the process used to create a USB-bootable OpenBSD system for the RPI4 and have been written down so that the author does not forget the process the next time it is needed. They are made available in case they might be of use to others. There is, of course, no quarantee that they will be fit for anyone else's purpose.

This process is the result of information obtained from a variety of sources and has been repeatedly tested on a number of Raspberry Pi 4Bs and also a Pi 400. It has been used with success on both USB flash drives and with USB-attached hard drives/SSDs. Although intended to produce a bootable USB device, these notes could, of course, be used equally as well, with very slight modifications, to produce a bootable OpenBSD system on a microSD.

These notes were tested directly on completion to make sure they are accurate.