Chromebooks are purpose-built computers that run Chrome OS, Google's Linux-based operating system. Although they are locked-down by default, there's a convenient 'Developer Mode' that fully unlocks them and lets owners run other OSes like Debian. Google publishes most of the software on them as FOSS, including the boot firmware (based on coreboot) and even the embedded controller, which makes them interesting computers to work on from a free-software standpoint. However, the Chrome OS firmware does not support ordinary boot methods like UEFI, but instead implements a custom verified boot flow due to their focus on security and speed. As a result, the usual strategy of writing Debian Installer to a USB drive and booting from it does not always work (for example on ARM chromebooks). There are a lot of guides on how to manually install Debian and shape it into a format this verified boot mechanism accepts, but even then some steps have to be repeated after every kernel and initramfs update. I got annoyed by the current situation, decided to automate it all, generalize it to all chromebooks and integrate it with Debian such that everything "just works" to the point where we actually can write Debian Installer to a USB drive, go through it and get a working system that will handle the Chrome OS firmware automatically. Along the way, I also discovered ways to run U-Boot from my chromebook's firmware, and ultimately managed to replace it entirely with U-Boot. In this talk I'll try to explain the things I had to learn and do, to the best of my abilities. Ideally, including these topics to some extent: - Details on the Chrome OS verified boot mechanism - Making it chainload into a secondary bootloader like U-Boot - Making it boot a Debian kernel, initramfs, device-tree etc. - Supporting A/B updates and rollbacks like Chrome OS does - Automating everything necessary to manage the verified boot firmware - Integration with kernel and initramfs-tools upgrade hooks - Debian Installer (partman) integration for special Chrome OS partitions - Adding a new Debian Installer step to setup things for verified boot - How to make Debian kernel/initramfs/installer support new hardware - Getting U-Boot to support my rk3399-gru-kevin chromebook
Speakers: Alper Nebi Yasak