Coreboot building

Creating your own self-signed kernel for use with Coreboot (open-source firmware) involves building Coreboot, signing it with your own key, and ensuring it works with your target device. Below is a step-by-step breakdown to create and sign your custom kernel with Coreboot.

Prerequisites
	1.	Hardware and Firmware Understanding: Familiarity with firmware flashing, Linux terminal, and Coreboot basics.
	2.	Tools:
	•	A Linux machine (or a virtual machine).
	•	A Chromebook or a device compatible with Coreboot.
	•	cbfstool, coreboot_util, and openssl (installable on Linux systems).
	3.	Build Environment:
	•	A working Coreboot source tree (cloned from Coreboot’s GitHub).
	•	Required dependencies for building Coreboot (varies by distribution).
	4.	Private and Public Keys: You’ll generate these for signing your kernel.

Step-by-Step Instructions

Step 1: Clone Coreboot Repository

git clone https://github.com/coreboot/coreboot.git
cd coreboot

Step 2: Set Up the Build Environment

Run the Coreboot dependency script to set up your environment:

sudo apt update
sudo apt install git build-essential bison flex libncurses5-dev \
  zlib1g-dev libpci-dev libelf-dev libssl-dev bc

Use the Coreboot-provided buildgcc script:

cd util/crossgcc
make -j$(nproc)
cd ../..

Step 3: Configure Coreboot

Use make menuconfig to configure the Coreboot build:

make menuconfig

	1.	Target Device: Select your specific mainboard.
	2.	Payload: Choose a payload such as GRUB or SeaBIOS.
	3.	Signature Options: Enable support for verified boot and signing if your target supports it.

Save your configuration when done.

Step 4: Build Coreboot

Build Coreboot using:

make -j$(nproc)

The resulting firmware image will be in the build/ directory as coreboot.rom.

Step 5: Generate Keys

Generate your private and public keys using openssl:

openssl genrsa -out private_key.pem 2048
openssl rsa -in private_key.pem -pubout -out public_key.pem

Step 6: Sign the Kernel

Use cbfstool to add and sign your kernel:
	1.	Insert Your Kernel (vmlinuz) into Coreboot:
	•	Replace <path_to_kernel> with the path to your Linux kernel image.

cbfstool build/coreboot.rom add -f <path_to_kernel> -n kernel -t raw


	2.	Sign the Kernel:
	•	Create a signature:

openssl dgst -sha256 -sign private_key.pem -out kernel.sig <path_to_kernel>


	•	Add the signature to the Coreboot image:

cbfstool build/coreboot.rom add -f kernel.sig -n kernel.sig -t raw

Step 7: Flash Coreboot

Flash the firmware onto your target device. Use a supported flasher tool such as flashrom:

sudo flashrom -p internal -w build/coreboot.rom

	Note: Some devices require hardware flashing with an external programmer.

Tips and Considerations
	1.	Test on a Spare Device: Always test your Coreboot build on a non-critical device to avoid bricking your main system.
	2.	Enable Recovery Options: Ensure your Coreboot configuration includes recovery options like fallback payloads or recovery firmware.
	3.	Back Up Current Firmware: Use flashrom to back up your existing firmware before flashing Coreboot:

sudo flashrom -p internal -r backup.rom

Troubleshooting
	•	If the device doesn’t boot, check your menuconfig settings, kernel compatibility, and payload integration.
	•	Use the Coreboot IRC channel or forums for specific hardware issues.

Let me know if you need further guidance on any step!