Flashmap
The wiki is being retired!
Documentation is now handled by the same processes we use for code: Add something to the Documentation/ directory in the coreboot repo, and it will be rendered to https://doc.coreboot.org/. Contributions welcome!
or...
Toward a unified representation for the layout of coreboot flash images
N.B. The changes described herein are being made as part of the Chromium OS project; as such, they will initially be committed to the project's own fork of the main coreboot repository, which is available at https://chromium.googlesource.com/chromiumos/third_party/coreboot. Unless otherwise noted, the paths and processes described throughout this page are as they exist(ed) in a checkout of the master branch of the Chromium OS sources as they appeared at the beginning of 2015. One of the guiding design principles is to keep the tools general enough that they will be helpful to others, and the resulting work will be upstreamed to the main repository once it has been regression-tested in the context of Chromium OS hardware.
How it's currently done (how the Chromium OS project presently constructs firmware images)
Most Intel-based Chromium OS devices currently use an 8 MB firmware image that includes---among other things---the Intel ME firmware, a copy of coreboot including the ramstage and depthcharge (bootloader) payload, two additional copies of the ramstage and bootloader payload, and a separate SeaBIOS payload. The primary description of this format exists in board-specific flattened device tree files, which are used by a script called cros_bundle_firmware to modify the image produced by the coreboot build system. For instance, the layout of the Panther board's firmware exists at https://chromium.googlesource.com/chromiumos/platform/depthcharge/+/master/board/panther/fmap.dts, and results in a final image that looks like this:
| Section | Offset | Contents | Original source | cros_bundle_firmware flag(s) | Packaging procedure | Coreboot Kconfig entr[yi](es) |
|---|---|---|---|---|---|---|
| RO | ||||||
| 0x700000 | Bootstub (coreboot image) | coreboot.rom (coreboot build system) | --coreboot coreboot.rom | cros_bundle_firmware helper adds depthcharge.elf as a payload (which---md5sums confirm---is exactly equivalent to just adding depthcharge.payload) and compiled (then mod if ied) version of fmap.dts to the existing CBFS | CONFIG_CMOS_POST_OFFSET, CONFIG_CBFS_SIZE
| |
| 0x611000 | GBB (Google Binary Block) | /chromeos-config/ entries in fmap.dts | cros_bundle_firmware helper generates and inserts it | |||
| 0x610840 | (Reserved) | |||||
| 0x610800 | FWID (Firmware ID) | /model entry in fmap.dts concatenated with build number | cros_bundle_firmware helper performs the concatenation | |||
| 0x610000 | FMAP (Flash MAP) | |||||
| 0x604000 | (Reserved) | |||||
| 0x600000 | RO-VPD (Vital Product Data) | |||||
| 0x400000 | Legacy (SeaBIOS image) | |||||
| 0x3fa000 | (Reserved) | |||||
| 0x3f8000 | RW-VPD (Vital Product Data) | |||||
| RW-shared | ||||||
| 0x3f6000 | Vblock-dev (third-party kernel signing keys) | |||||
| 0x3f4000 | Shared-data (RW firmware calibration data) | |||||
| 0x3f0000 | ELOG (Event LOG) | |||||
| 0x3e0000 | MRC-cache (Memory Reference Code training data) | |||||
| RW-B | ||||||
| 0x3dffc0 | FWID-B | |||||
| 0x300000 | Main-B (copy of coreboot ramstage and payload) | |||||
| 0x2f0000 | Vblock-B (signing keys) | |||||
| RW-A | ||||||
| 0x2effc0 | FWID-A | |||||
| 0x210000 | Main-A (copy of coreboot ramstage and payload) | |||||
| 0x200000 | Vblock-A (signing keys) | |||||
| FW-descriptor | ||||||
| 0x001000 | ME (Intel Management Engine firmware blob) | |||||
| 0x000000 | FD (Intel Firmware Descriptor header) |