What is petitboot?

Because petitboot executes from within a minimal Linux initial RAM disk environment, it inherits full support for complex peripherals directly from the underlying Linux kernel. This enables configurations that are otherwise impractical to set up and maintain. Examples include booting from LSI SAS adapters without relying on x86-specific binaries embedded in the vendor's option ROM, or booting directly from a remote fibre channel or IPoIB (Infiniband) source. Also, by taking advantage of petitboot's kernel signature support, you can be assured that only kernels authorized by you or your organization are utilized, even when booting over an untrusted network layer or from untrustworthy physical media. Finally, if the kernel or initramfs in question contain sensitive data such as Kerberos keytab files or SSH keys, the kernel and initramfs can be encrypted at the source, then decrypted and verified by petitboot prior to execution.

Where can I install it?

• OpenPOWER (POWER8 or higher) machines, such as our Talos™ system
• Certain older x86 machines with coreboot support, such as the ASUS KGPE-D16, ASUS KCMA-D8, and the Lenovo T400 / T500 laptops
• Specific ARM machines, particularly ARM chromebooks such as the ASUS C201
• QEMU virtual machines

Image build process

Overview

• The low-level boot firmware (coreboot, skiboot, or u-boot)
• A minimal Linux kernel customized for the destination hardware
• An initial RAM disk (initramfs), containing petitboot, busybox, and several helper utilities

NOTE: Because large capacity DIP-8 Flash ROMs can be difficult to source, we are pleased to offer "plug and play" 16MB Flash ROMs with petitboot preinstalled for both the ASUS KGPE-D16 and KCMA-D8. These Flash ROMs, like the vendor-supplied Flash ROMs, may be reprogrammed with custom firmware image(s) at your own risk using flashrom under Linux. If you are interested in this option, please contact us at sales@raptorengineering.com for more information.

Prerequisites

• At least 5GB of free disk space on a local filesystem
• Identical userspace architecture to the target system
• Debian Stretch or higher, though Ubuntu Wily or higher may also work
• The following packages
  • git
  • lzma
• Installed build dependencies for the following packages:
  • busybox
  • petitboot
  • systemd
• Initial, known-working target system configuration files for:
  • Linux
  • coreboot
• Working knowledge of either external firmware flashing for the target device or QEMU boot arguments, depending on your application

Initial Setup

Create a new directory, petitboot, in which all source and build files will be stored, and open a new terminal session from within that directory.

Dependency Build

petitboot uses udev to detect disks, network interfaces, and related devices. Unfortunately, udev has been fully integrated into systemd and is not available as a standalone source tree. As a result, most of systemd must be built to obtain the required udev libraries and applications.

Download and build kexec userspace utilities

Petitboot / Busybox Build

Download and build petitboot

Download and build busybox

Initramfs Build

The following commands assume you are building the firmware image on a 64-bit x86 system for a 64-bit x86 target. Please replace "x86_64-linux-gnu" with the correct architecture tuple as needed. As an example, on a ppc64el system the "powerpc64le-linux-gnu" tuple would be used instead.

Prepare the skeleton directory structure

Copy core libraries to the new initramfs

Copy helper binaries to the new initramfs

Install petitboot itself to the initramfs

Copy udev rules to the new initramfs

Set up udhcp helper scripts

Set up nsswitch

Add basic groups

Create boot script

The following script is automatically used on every system start to mount needed special directories, start udev, and finally launch petitboot. It can be customized as required for your particular application.

OPTIONAL: Set up GPG keyring for signed or encrypted boot

If you are setting up GPG signature checking or encryption, you will need to export the public key of your GPG kernel signer account, in ASCII format, to the file "public_key.txt". For encrypted kernels, you will also need to export the machine's private key in ASCII format to the file "private_key.txt". The machine private key is a specific, dedicated GPG account that should be created only for a single machine; encrypted kernels will use this GPG account as the recipient and the kernel signer as the source GPG account. Both files should be placed in the petitboot build root directory, and the private key (if present) should be chmod 600 (read/write by owner only).

To only boot signed kernels, execute the following commands:

To only boot kernels that have been both encrypted and signed, execute the following commands:

Strip debug symbols from files installed in the initramfs

This step is crucial to reduce the initramfs size down to a range that will fit on a typical Flash ROM. Leaving unstripped binaries with debug symbols intact can more than double the size of the compressed initramfs!

CPIO creation and image compression

First and Second Stage Firmware Build

Download and build the Linux kernel

Copy a known-working Linux configuration file for your hardware to .config. Then, customize your kernel using the menuconfig tool, eliminating unnecessary options to reduce size. Please note that only built-in options ([*]) will be available, modules ([M]) will not be included.

Recommended settings for common options are shown below:

Compile the kernel

Download and build coreboot

Build the coreboot toolchain and helper utilities

Copy a known-working coreboot configuration file for your hardware to .config. Then, customize coreboot if desired using the menuconfig tool.

Recommended settings for common options are shown below:

Build coreboot

Congratulations! You now have a bootable ROM image with petitboot installed in coreboot/coreboot/build/coreboot.rom.

Testing

QEMU

If all went well, after a short delay (less than 10 seconds on modern computers) you should see the petitboot TUI (Text-mode User Interface). Try passing disks, CDROMs, and network interfaces to QEMU via the QEMU command line to see the full power and flexibility that petitboot offers.

All data and information provided on this page is for informational purposes only. Raptor Engineering makes no representations as to accuracy, completeness, currentness, suitability, or validity of any information on this page and will not be liable for any errors, omissions, or delays in this information or any losses, injuries, or damages arising from its display or use. All information is provided on an as-is basis. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this page are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.