Installing OpenBSD 7.6 on the Raspberry Pi 4 Model B ======================================================================== Table of Contents ======================================================================== Materials Needed Connect to the Raspberry Pi Serial Console Update the Raspberry Pi Firmware Preparing the SD Card and USB Flash Drive Installing OpenBSD Post-Installation Setup Troubleshooting - U-Boot Does Not Detect My USB Keyboard References ======================================================================== Materials Needed ======================================================================== I used: - A Raspberry Pi Model B purchased from Vilros in late 2024 - A SanDisk Ultra 512GB microSDXC card (U1 A1) - A USB flash drive (at least 16GB) - A DSD Tech USB serial converter (for UART) - Dupont cables (for connecting to the UART pins) - An Ethernet cable - Another computer (I used a machine with Void Linux) ======================================================================== Connect to the Raspberry Pi Serial Console ======================================================================== The Raspberry Pi 4 provides a 3.3V UART on GPIO pins 6 (GND), 8 (TXD), and 10 (RXD). If you do not know which these are, look at the top of the Raspberry Pi 4 with the USB and RJ45 (Ethernet) ports facing you. The GPIO header on the top-right provides the pins. They are numbered left to right, top to bottom, thus: 1 2 3 4 5 6 <-- GND 7 8 <-- TXD 9 10 <-- RXD 11 12 ... 39 40 .----- USB and Ethernet ports are down this way! | v Plug the USB serial adapter's TXD into the Raspberry Pi's RXD and the adapter's RXD into the Pi's TXD. Connect the GND pins, too. The Raspberry Pi 4 uses 3.3V, 115200 baud, 8 data bits, 1 stop bit, and no parity bits. I connected to the serial console using picocom(1) thus: picocom /dev/ttyUSB0 -b 115200 ======================================================================== Update the Raspberry Pi Firmware ======================================================================== Download the Raspberry Pi OS Lite image from raspberrypi.com (the official Raspberry Pi website), the SHA-256 checksum, and the PGP signature. Verify the checksum and signature (change the URIs and PGP public key ID as necessary): wget https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-10-28/2024-10-22-raspios-bookworm-arm64-lite.img.xz wget https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2024-10-28/2024-10-22-raspios-bookworm-arm64-lite.img.xz.{sha256,sig} Compare the SHA-256 hash with the one published on Raspberry Pi OS's download page or what is in the .sha256 file: sha256sum 2024-10-22-raspios-bookworm-arm64-lite.img.xz Unfortnuately, the Raspberry Pi folks do not publish which PGP public key we should use to verify downloads, so signature checking is useless. However, if you still want to do it, first figure out the signature's key ID (look for the "Signature made ... using RSA key ..." lines): gpg --verify 2024-10-22-raspios-bookworm-arm64-lite.img.xz.sig Then add the public key and verify the signature again: gpg --keyserver pgp.mit.edu --recv-key 54C3DD610D9D1B4AF82A37758738CD6B956F460C gpg --verify 2024-10-22-raspios-bookworm-arm64-lite.img.xz.sig Insert your microSD card and flash the downloaded image to it (use the correct USB device!): unxz 2024-10-22-raspios-bookworm-arm64-lite.img.xz sudo dd if=2024-10-22-raspios-bookworm-arm64-lite.img of=/dev/sda bs=1M Mount the boot partition: sudo mount /dev/sda1 /mnt Then add this line near the top of the boot partition's config.txt: enable_uart=1 Ensure that "quiet" is not in the boot partition's cmdline.txt so you can see early kernel boot messages. Recent versions of Raspberry Pi OS do not provide default users, so you have to create one by adding a line like the following to a new file called userconf.txt in the boot partition: username:encryptedpassword Change "username" to your desired username and "encryptedpassword" to the output of this openssl(1) command: openssl passwd -6 -stdin Type the user's password and end standard input via Control-D. userconf.txt uses salted SHA-512 password hashing, so the password is not very secure. Change the user's password and get rid of userconf.txt after logging into the Pi. Unmount the boot partition and eject the microSD card: sudo umount /mnt Insert the microSD card into your Raspberry Pi and connect to the serial console: picocom /dev/ttyUSB0 -b 115200 Power the Pi on and log in as the user you created earlier. Run: sudo raspi-config Select "Update" to update the tool to the latest version. Then go to "Advanced Options", then "Bootloader Version", then select "Latest" to use the latest bootloader image. If the tool asks you whether you want to reset the bootloader to the default configuration, select "Yes". Exit and reboot. Log in again and check whether the bootloader is up- to-date. The following command should say something like "BOOTLOADER: up to date": sudo rpi-eeprom-update Update the system packages: sudo apt update sudo apt full-upgrade Reboot the Pi. This should install the latest firmware. ======================================================================== Preparing the SD Card and USB Flash Drive ======================================================================== Download the arm64 miniroot and install images from openbsd.org: wget https://cdn.openbsd.org/pub/OpenBSD/7.6/arm64/{install,miniroot}76.img wget https://cdn.openbsd.org/pub/OpenBSD/7.6/arm64/SHA256{,.sig} wget https://ftp.openbsd.org/pub/OpenBSD/7.6/openbsd-76-base.pub Then verify the downloaded images' integrity and authenticity. You might have to install OpenBSD's signify(1) tool. Void Linux has a signify package: sha256sum -c --ignore-missing SHA256 signify -Cp openbsd-76-base.pub -x SHA256.sig *76.img Insert your microSD card into your other computer and run this (change the output device to your microSD card!): sudo dd if=/dev/urandom of=/dev/sda bs=4M status=progress sudo dd if=miniroot76.img of=/dev/sda bs=1M conv=fsync Eject your microSD card. Then insert your USB flash drive and run this (again, make sure the device is correct!): sudo dd if=install76.img of=/dev/sda bs=1M conv=fsync Eject the USB drive. ======================================================================== Installing OpenBSD ======================================================================== Plug the USB drive and the microSD card into the Raspberry Pi 4. Connect the Pi to your network via an Ethernet cable. Then connect to the serial console: picocom /dev/ttyUSB0 -b 115200 Then power the Pi on. If you leave it alone, you should eventually see the Pi boot the installer on your USB flash drive. Follow the on-screen instructions. I did not use whole-disk encryption because it is too slow on the Raspberry Pi 4. This is what I did (blank responses to prompts indicate accepting the defaults): ------------------------------------------------------------------------ erase ^?, werase ^W, kill ^U, intr ^C, status ^T Welcome to the OpenBSD/arm64 7.6 installation program. (I)nstall, (U)pgrade, (A)utoinstall or (S)hell? i At any prompt except password prompts you can escape to a shell by typing '!'. Default answers are shown in []'s and are selected by pressing RETURN. You can exit this program at any time by pressing Control-C, but this can leave your system in an inconsistent state. Terminal type? [vt220] System hostname? (short form, e.g. 'foo') foobar Available network interfaces are: bse0 bwfm0 vlan0. Network interface to configure? (name, lladdr, '?', or 'done') [bse0] IPv4 address for bse0? (or 'autoconf' or 'none') [autoconf] IPv6 address for bse0? (or 'autoconf' or 'none') [none] Available network interfaces are: bse0 bwfm0 vlan0. Network interface to configure? (name, lladdr, '?', or 'done') [done] Using DNS domainname mynetworksettings.com Using DNS nameservers at 192.168.1.1 Password for root account? (will not echo) Password for root account? (again) Start sshd(8) by default? [yes] Setup a user? (enter a lower-case loginname, or 'no') [no] mynewuser Full name for user mynewuser? [mynewuser] Password for user mynewuser? (will not echo) Password for user mynewuser? (again) WARNING: root is targeted by password guessing attacks, pubkeys are safer. Allow root ssh login? (yes, no, prohibit-password) [no] Available disks are: sd0 sd1. Which disk is the root disk? ('?' for details) [sd0] Encrypt the root disk with a (p)assphrase or (k)eydisk? [no] Disk: sd0 geometry: 62231/255/63 [999743488 Sectors] Offset: 0 Signature: 0xAA55 Starting Ending LBA Info: #: id C H S - C H S [ start: size ] ------------------------------------------------------------------------------- *0: 0C 2 10 9 - 4 20 16 [ 32768: 32768 ] Win95 FAT32L 1: 00 0 0 0 - 0 0 0 [ 0: 0 ] Unused 2: 00 0 0 0 - 0 0 0 [ 0: 0 ] Unused 3: A6 4 20 17 - 62231 39 16 [ 65536: 999677952 ] OpenBSD Use (W)hole disk or (E)dit the MBR? [whole] Creating a msdos partition and an OpenBSD partition for rest of sd0...done. The auto-allocated layout for sd0 is: # size offset fstype [fsize bsize cpg] a: 1024.0M 65536 4.2BSD 2048 16384 1 # / b: 8284.8M 2162688 swap c: 488156.0M 0 unused d: 4096.0M 19130080 4.2BSD 2048 16384 1 # /tmp e: 20153.7M 27518656 4.2BSD 2048 16384 1 # /var f: 30720.0M 68793408 4.2BSD 2048 16384 1 # /usr g: 1024.0M 131707968 4.2BSD 2048 16384 1 # /usr/X11R6 h: 20480.0M 133805120 4.2BSD 2048 16384 1 # /usr/local i: 16.0M 32768 MSDOS j: 5120.0M 175748160 4.2BSD 2048 16384 1 # /usr/src k: 6144.0M 186233920 4.2BSD 2048 16384 1 # /usr/obj l: 307200.0M 198816832 4.2BSD 4096 32768 1 # /home Use (A)uto layout, (E)dit auto layout, or create (C)ustom layout? [a] /dev/rsd0a: 1024.0MB in 2097152 sectors of 512 bytes 6 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0l: 307200.0MB in 629145600 sectors of 512 bytes 378 cylinder groups of 814.44MB, 26062 blocks, 52224 inodes each /dev/rsd0d: 4096.0MB in 8388576 sectors of 512 bytes 21 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0f: 30720.0MB in 62914560 sectors of 512 bytes 152 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0g: 1024.0MB in 2097152 sectors of 512 bytes 6 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0h: 20480.0MB in 41943040 sectors of 512 bytes 102 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0k: 6144.0MB in 12582912 sectors of 512 bytes 31 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0j: 5120.0MB in 10485760 sectors of 512 bytes 26 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each /dev/rsd0e: 20153.7MB in 41274752 sectors of 512 bytes 100 cylinder groups of 202.50MB, 12960 blocks, 25920 inodes each Available disks are: sd1. Which disk do you wish to initialize? (or 'done') [done] /dev/sd0a (c5ad9a3eaa09082e.a) on /mnt type ffs (rw, asynchronous, local) /dev/sd0l (c5ad9a3eaa09082e.l) on /mnt/home type ffs (rw, asynchronous, local, nodev, nosuid) /dev/sd0d (c5ad9a3eaa09082e.d) on /mnt/tmp type ffs (rw, asynchronous, local, nodev, nosuid) /dev/sd0f (c5ad9a3eaa09082e.f) on /mnt/usr type ffs (rw, asynchronous, local, nodev) /dev/sd0g (c5ad9a3eaa09082e.g) on /mnt/usr/X11R6 type ffs (rw, asynchronous, local, nodev) /dev/sd0h (c5ad9a3eaa09082e.h) on /mnt/usr/local type ffs (rw, asynchronous, local, nodev) /dev/sd0k (c5ad9a3eaa09082e.k) on /mnt/usr/obj type ffs (rw, asynchronous, local, nodev, nosuid) /dev/sd0j (c5ad9a3eaa09082e.j) on /mnt/usr/src type ffs (rw, asynchronous, local, nodev, nosuid) /dev/sd0e (c5ad9a3eaa09082e.e) on /mnt/var type ffs (rw, asynchronous, local, nodev, nosuid) Let's install the sets! Location of sets? (disk http nfs or 'done') [http] HTTP proxy URL? (e.g. 'http://proxy:8080', or 'none') [none] (Unable to get list from openbsd.org, but that is OK) HTTP Server? (hostname or 'done') [openbsd.org] ftp.openbsd.org Server directory? [pub/OpenBSD/7.6/arm64] Unable to connect using HTTPS; using HTTP instead. Select sets by entering a set name, a file name pattern or 'all'. De-select sets by prepending a '-', e.g.: '-game*'. Selected sets are labelled '[X]'. [X] bsd [X] base76.tgz [X] game76.tgz [X] xfont76.tgz [X] bsd.mp [X] comp76.tgz [X] xbase76.tgz [X] xserv76.tgz [X] bsd.rd [X] man76.tgz [X] xshare76.tgz Set name(s)? (or 'abort' or 'done') [done] Get/Verify SHA256.sig 100% |**************************| 1814 00:00 Signature Verified Get/Verify bsd 100% |**************************| 17351 KB 00:21 Get/Verify bsd.mp 100% |**************************| 17422 KB 00:05 Get/Verify bsd.rd 100% |**************************| 18008 KB 00:04 Get/Verify base76.tgz 100% |**************************| 306 MB 01:24 Get/Verify comp76.tgz 100% |**************************| 78492 KB 00:15 Get/Verify man76.tgz 100% |**************************| 8056 KB 00:02 Get/Verify game76.tgz 100% |**************************| 2750 KB 00:01 Get/Verify xbase76.tgz 100% |**************************| 52028 KB 00:10 Get/Verify xshare76.tgz 100% |**************************| 4552 KB 00:02 Get/Verify xfont76.tgz 100% |**************************| 23023 KB 00:06 Get/Verify xserv76.tgz 100% |**************************| 15605 KB 00:04 Get/Verify BUILDINFO 100% |**************************| 54 00:00 Installing bsd 100% |**************************| 17351 KB 00:02 Installing bsd.mp 100% |**************************| 17422 KB 00:02 Installing bsd.rd 100% |**************************| 18008 KB 00:02 Installing base76.tgz 100% |**************************| 306 MB 01:48 Extracting etc.tgz 100% |**************************| 264 KB 00:00 Installing comp76.tgz 100% |**************************| 78492 KB 00:56 Installing man76.tgz 100% |**************************| 8056 KB 00:08 Installing game76.tgz 100% |**************************| 2750 KB 00:01 Installing xbase76.tgz 100% |**************************| 52028 KB 00:29 Extracting xetc.tgz 100% |**************************| 8742 00:00 Installing xshare76.tgz 100% |**************************| 4552 KB 00:08 Installing xfont76.tgz 100% |**************************| 23023 KB 00:07 Installing xserv76.tgz 100% |**************************| 15605 KB 00:10 Installing BUILDINFO 100% |**************************| 54 00:00 Location of sets? (disk http nfs or 'done') [done] What timezone are you in? ('?' for list) [Canada/Mountain] US/Eastern Saving configuration files... done. Making all device nodes... done. Multiprocessor machine; using bsd.mp instead of bsd. fw_update: add bwfm; update none Relinking to create unique kernel... done. CONGRATULATIONS! Your OpenBSD install has been successfully completed! When you login to your new system the first time, please read your mail using the 'mail' command. Exit to (S)hell, (H)alt or (R)eboot? [reboot] syncing disks... done rebooting... ------------------------------------------------------------------------ ======================================================================== Post-Installation Setup ======================================================================== Have a look at afterboot(8) to check post-installation setup. I disabled the wireless networking device by adding the following to /etc/bsd.re-config: disable bwfm ntpd(8) should be running. Confirm that it is and that the date and time are correct: ps -Af | grep ntpd date I also ensured that the hostname was correct by editing /etc/myname. I planned to use my Pi as both a server and desktop (continually running) with HDMI, so I put the following in /etc/boot.conf: set tty fb0 I also turned the "console" line in /etc/ttys from "on" to "off" to prevent the serial console from conflicting with fb0. I installed all available patches by running syspatch(8): syspatch Then I updated all installed packages by running: pkg_add -Uu ======================================================================== Troubleshooting ======================================================================== ------------------------------------------------------------------------ U-Boot Does Not Detect My USB Keyboard ------------------------------------------------------------------------ I have a mechanical USB keyboard, but U-Boot seems to disable it as soon as it powers on. I learned on a forum post that some USB keyboards do not send HID signals to the USB host until you press a key. The writer's advice was to mash any key while booting, at least until the U-Boot "boot>" prompt appears. That worked for me. ======================================================================== References ======================================================================== - Installing OpenBSD 7 on Raspberry Pi 3 (and 4) https://dev.to/spacial/installing-openbsd-7-on-raspberry-pi-3-1f98