Models

• Acer Chromebook CB5-311 (nyan-big)

Bootloader

The built-in bootloader is Depthcharge, which is deployed as a Coreboot payload. To boot from USB, you first need to enable developer mode.

Once developer mode is enabled, you can press Ctrl-U to boot from a USB storage device.

USB storage device setup

When booting from USB, the bootloader looks for a signed Flat Image Tree (FIT) written to a GPT partition of type fe3a2a5d-4f32-41a7-b725-accc3285a309 (ChromeOS kernel). The following commands (on Linux) can be used to prepare the device:

DEV=/dev/sdb
sudo parted --script ${DEV} mklabel gpt
sudo cgpt create ${DEV}
sudo cgpt add -t kernel -l kernel -b 32 -s 32768 ${DEV}
sudo cgpt add -i 1 -S 1 -T 5 -P 1 ${DEV}
sudo blockdev --rereadpt ${DEV}

The signed image can now be written to partition 1 of the device (/dev/sdb1 in this example).

Creating the Flat Image Tree (FIT)

The bootloader loads the FIT at 0x81000000. The "kernel" image within the fit is not relocated, so you will need to carefully pad the FIT image and adjust the base of your image to match.

The following .its script creates an image that results in an image that loads the "kernel" at 0x81000100.

/dts-v1/;

/ {
    description = "U-Boot + FDT --------- THIS PADDING IS NEEDED SO THE IMAGE STARTS AT THE RIGHT OFFSET";
    #address-cells = <1>;
    images {
        kernel@1{
            description = "kernel";
            data = /incbin/("u-boot-dtb.bin");
            type = "kernel_noload";
            arch = "arm";
            os = "linux";
            compression = "none";
            load = <0>;
            entry = <0>;
        };
        fdt@1{
            description = "tegra124-nyan-big.dtb";
            data = /incbin/("dts/dt.dtb");
            type = "flat_dt";
            arch = "arm";
            compression = "none";
            hash@1{
                algo = "sha1";
            };
        };
    };
    configurations {
        default = "conf@1";
        conf@1{
            kernel = "kernel@1";
            fdt = "fdt@1";
        };
    };
};

When building U-Boot, you need to set CONFIG_SYS_TEXT_BASE to 0x81000100 in include/configs/tegra124-common.h.

For the NetBSD kernel, set KERNEL_BASE_PHYS and KERNEL_BASE_PHYS to 0x81000100 in sys/arch/evbarm/conf/std.tegra.

To create the FIT image with this script, use mkimage:

$ mkimage -f u-boot.its u-boot.fit

Signing the image

To sign the image, use the vbutil_kernel tool from Google's Verified Boot reference implementation.

$ vbutil_kernel --pack u-boot.signed \
    --keyblock devkeys/kernel.keyblock \
    --version 1 \
    --signprivate devkeys/kernel_data_key.vbprivk \
    --vmlinuz u-boot.fit \
    --arch arm

Other issues

LPAE is enabled by the bootloader

U-Boot and the NetBSD kernel will get confused by LPAE being enabled when chainloaded from Coreboot.

A patch for U-Boot is available to correct this issue. A similar patch could be made to arch/evbarm/tegra/tegra_start.S.