1# Google Security Chip (GSC) Case Closed Debugging (CCD) 2 3Cr50 or Ti50 is the firmware that runs on the Google Security Chip (GSC), which 4has support for [Case Closed Debugging](CCD). 5 6This document explains how to setup CCD, so you can access all of the necessary 7features to develop firmware on your Chrome OS device, access 8[debug consoles][consoles], and [disable hardware write protect][hw-wp]. 9 10[TOC] 11 12## Overview 13 14GSC CCD was designed to restrict CCD access to device owners and is implemented 15through **CCD privilege levels** ([`Open`], [`Unlocked`], [`Locked`]) that can 16be used to enable access to different **[CCD capabilities][cap]**. Capability 17settings can be modified to require certain privilege levels to access each 18capability. Device owners can use these settings to customize CCD so that it is 19as open or restricted as they want. 20 21GSC CCD exposes [3 debug consoles][consoles]: AP, EC, and GSC as well as control 22over [Hardware Write Protect][hw-wp]. GSC CCD also allows 23[flashing the AP firmware] or [flashing the EC firmware]. 24 25### Capability and Privilege Levels {#cap-priv} 26 27Privilege Levels | 28---------------- | 29`Open` | 30`Unlocked` | 31`Locked` | 32 33Capability Setting | Definition 34------------------ | ---------- 35`IfOpened` | Specified capability is allowed if GSC Privilege Level is `Open`. 36`UnlessLocked` | Specified capability is allowed unless GSC Privilege Level is `Locked`. 37`Always` | Specified capability is always allowed, regardless of GSC Privilege Level. 38 39Capability Setting | Privilege Level Required 40------------------ | ---------------------------------------- 41`IfOpened` | `Open` 42`UnlessLocked` | `Open` or `Unlocked` 43`Always` | `Open`, `Unlocked`, `Locked` (any state) 44 45## CCD Capabilities {#cap} 46 47The default GSC privilege level is [`Locked`] with the following capability 48settings: 49 50Capability | Default | Function 51----------------- | ---------- | -------- 52`UartGscRxAPTx` | `Always` | AP console read access 53`UartGscTxAPRx` | `Always` | AP console write access 54`UartGscRxECTx` | `Always` | EC console read access 55`UartGscTxECRx` | `IfOpened` | EC console write access 56[`FlashAP`] | `IfOpened` | Allows flashing the AP 57[`FlashEC`] | `IfOpened` | Allows flashing the EC 58[`OverrideWP`] | `IfOpened` | Override hardware write protect 59`RebootECAP` | `IfOpened` | Allow rebooting the EC/AP from the GSC console 60`GscFullConsole` | `IfOpened` | Allow access to restricted GSC console commands 61`UnlockNoReboot` | `Always` | Allow unlocking GSC without rebooting the AP 62`UnlockNoShortPP` | `Always` | Allow unlocking GSC without physical presence 63`OpenNoTPMWipe` | `IfOpened` | Allow opening GSC without wiping the TPM 64`OpenNoLongPP` | `IfOpened` | Allow opening GSC without physical presence 65`BatteryBypassPP` | `Always` | Allow opening GSC without physical presence and developer mode if the battery is removed 66`Unused` | `Always` | Doesn't do anything 67`I2C` | `IfOpened` | Allow access to the I2C controller (used for measuring power) 68`FlashRead` | `Always` | Allow dumping a hash of the AP or EC flash 69`OpenNoDevMode` | `IfOpened` | Allow opening GSC without developer mode 70`OpenFromUSB` | `IfOpened` | Allow opening GSC from USB 71 72## Consoles {#consoles} 73 74GSC presents 3 consoles through CCD: AP, EC, and GSC, each of which show up on 75your host machine as a `/dev/ttyUSBX` device when a debug cable ([Suzy-Q] or 76[Type-C Servo v4]) is plugged in to the DUT. 77 78Console | Default access | Capability Name 79------- | ------------------------------------------- | --------------- 80GSC | always read/write, but commands are limited | `GscFullConsole` enables the full set of GSC console commands 81AP | read/write | `UartGscRxAPTx` / `UartGscTxAPRx` 82EC | read-only | `UartGscRxECTx` / `UartGscTxECRx` 83 84### Connecting to a Console 85 86When a debug cable ([Suzy-Q] or [Type-C Servo v4]) is plugged in to the DUT, the 873 consoles will show up as `/dev/ttyUSBX` devices. You can connect to them with 88your favorite terminal program (e.g., `minicom`, `screen`, etc). You can also 89use the [`usb_console`] command to connect to Cr50 (`18d1:5014`) or Ti50 90(`18d1:504a`) and specify the interface to choose between the consoles. 91 92```bash 93# Install `usb_console` 94(chroot) sudo emerge ec-devutils 95``` 96 97```bash 98# Connect to Cr50 (GSC) console 99(chroot) $ sudo usb_console -d 18d1:5014 100# Connect to Ti50 (GSC) console 101(chroot) $ sudo usb_console -d 18d1:504a 102``` 103 104```bash 105# Connect to AP console (on Cr50-based device) 106(chroot) $ sudo usb_console -d 18d1:5014 -i 1 107# Connect to AP console (on Ti50-based device) 108(chroot) $ sudo usb_console -d 18d1:504a -i 1 109``` 110 111```bash 112# Connect to EC console (on Cr50-based device) 113(chroot) $ sudo usb_console -d 18d1:5014 -i 2 114# Connect to EC console (on Ti50-based device) 115(chroot) $ sudo usb_console -d 18d1:504a -i 2 116``` 117 118#### Using "servod" to access the console 119 120[`servod`] can be used to create alternative console devices when combined with 121a [Servo]. 122 123First, make sure your [servo firmware is updated][update servo v4]. 124 125Next, start [`servod`]: 126 127```bash 128(chroot) $ sudo servod -b $BOARD 129``` 130 131Then use `dut-control` to display the console devices: 132 133```bash 134(chroot) $ dut-control gsc_uart_pty ec_uart_pty cpu_uart_pty 135``` 136 137Connect to the console devices with your favorite terminal program (e.g., 138`minicom`, `screen`, etc.). 139 140## CCD Open {#ccd-open} 141 142Some basic CCD functionality is accessible by default: read-only access to the 143EC console, read-write access to the AP console, and a few basic GSC console 144commands. Note that while GSC has read-write access to the AP console by 145default, the AP console itself is disabled for production devices. 146 147In order to access all CCD functionality or to modify capability settings, GSC 148CCD needs to be [`Open`]. 149 1501. Connect to the GSC console by connecting a [Suzy-Q] or [Type-C Servo v4] to 151 the DUT and running one of the following commands: 152 153 ```bash 154 # Connect to Cr50 (GSC) console 155 (chroot) $ sudo usb_console -d 18d1:5014 156 # Connect to Ti50 (GSC) console 157 (chroot) $ sudo usb_console -d 18d1:504a 158 ``` 159 160 *** note 161 **NOTE**: If another program is already connected to the GSC console, 162 you'll see `tx [Errno 16] Resource Busy`. For example, this will happen if 163 [`servod`] is running. 164 *** 165 1661. At the GSC console, use the `version` command to make sure you have a recent 167 enough version to use CCD. The relevant version is either `RW_A` or `RW_B`, 168 whichever has the asterisk next to it: 169 170 ``` 171 cr50 > version 172 173 Chip: g cr50 B2-C 174 Board: 0 175 RO_A: * 0.0.10/29d77172 176 RO_B: 0.0.10/c2a3f8f9 177 RW_A: * 0.3.23/cr50_v1.9308_87_mp.320-aa1dd98 <---- This is the version 178 RW_B: 0.3.18/cr50_v1.9308_87_mp.236-8052858 179 BID A: 00000000:00000000:00000000 Yes 180 BID B: 00000000:00000000:00000000 Yes 181 Build: 0.3.23/cr50_v1.9308_87_mp.320-aa1dd98 182 tpm2:v1.9308_26_0.36-d1631ea 183 cryptoc:v1.9308_26_0.2-a4a45f5 184 2019-10-14 19:18:05 @chromeos-ci-legacy-us-central2 185 ``` 186 1871. Production (`MP`) versions of Cr50 firmware use a [minor version][semver] of 188 `3`: `0.3.x`. Production firmware versions `0.3.9` or newer support CCD. 189 190 Production (`MP`) versions of Ti50 firmware use a [minor version][semver] of 191 `23`: `0.23.x`. 192 193 Development (`PrePVT`) versions of Cr50 firmware use a minor version of `4`: 194 `0.4.x`. Development firmware versions `0.4.9` or newer support CCD. 195 196 Development (`PrePVT`) versions of Ti50 firmware use a minor version of 197 `24`: `0.24.x`. 198 199 Your device likely supports CCD if it was manufactured in the last few 200 years. If you have an older version, follow the [Updating Cr50] instructions 201 before continuing. 202 2031. Put the device into [Recovery Mode] and enable [Developer Mode]. 204 205 *** note 206 **NOTE**: Developer Mode has to be enabled as described. Using GBB flags to 207 force Developer Mode will not work. 208 *** 209 210 If you can't put your device into [Developer Mode] because it doesn't boot, 211 follow the [CCD Open Without Booting the Device] instructions. 212 2131. Verify GSC knows the device is in [Developer Mode] by finding `TPM: 214 dev_mode` in the GSC console `ccd` command output: 215 216 ``` 217 (gsc) > ccd 218 ... 219 TPM: dev_mode <==== This is the important part 220 ... 221 ``` 222 2231. Start the CCD open process from the AP. 224 225 ```bash 226 (dut) $ gsctool -a -o 227 ``` 228 2291. Over the next 5 minutes you will be prompted to press the power button 230 multiple times. After the last power button press the device will reboot. 231 232 *** note 233 **WARNING**: Opening CCD causes GSC to forget that it is in 234 [Developer Mode], so when the device reboots, it will either say that 235 the OS image is invalid or it will enter a bootloop. Use the key 236 combinations to enter [Recovery Mode] and re-enable [Developer Mode]. 237 See [this bug] for details. 238 *** 239 2401. Use the `ccd` command on the GSC console to verify the state is [`Open`]: 241 242 ``` 243 (gsc) > ccd 244 245 State: Opened 246 ... 247 ``` 248 2491. **The [`Open`] state is lost if GSC reboots, the device loses power (e.g., 250 battery runs out and AC is not plugged in), or the battery is removed. Note 251 that GSC does not reboot when the system reboots; it only reboots if it is 252 updated, the devices loses power, the battery runs out, or it crashes**. If 253 you plan on [flashing the AP firmware] or [flashing the EC firmware], it is 254 recommended you modify the capability settings or set a CCD password, so you 255 can reopen the device in the case that you accidentally brick it with bad 256 firmware. The simplest way to do this is to reset to factory settings and 257 enable testlab mode: 258 259 ``` 260 (gsc) > ccd reset factory 261 ``` 262 263 ``` 264 (gsc) > ccd testlab enable 265 ``` 266 267 For full details, see the section on [CCD Open Without Booting the Device]. 268 269## Configuring CCD Capability Settings 270 271CCD capabilities allow you to configure CCD to restrict or open the device as 272much as you want. You can use the `ccd` command on the GSC console to check and 273modify the capabilities, but CCD has to be [`Open`] to change the capabilities. 274 275Setting capabilities you want to use to [`Always`] will make them accessible 276even if CCD loses the [`Open`] state, which happens when GSC reboots or the 277device loses power. 278 279Basic CCD functionality is covered by `UartGscTxECRx`, `UartGscRxECTx`, 280`UartGscTxAPRx`, `UartGscRxAPTx`, [`FlashAP`], [`FlashEC`], [`OverrideWP`], and 281`GscFullConsole`. 282 283``` 284(gsc) > ccd set $CAPABILITY $REQUIREMENT 285``` 286 287### Examples 288 289#### EC Console 290 291If the EC console needs to be read-write even when CCD is [`Locked`] set the 292capability to [`Always`]: 293 294``` 295(gsc) > ccd set UartGscTxECRx Always 296``` 297 298#### Restrict Consoles 299 300If you want to restrict capabilities more than [`Always`], you can set them to 301[`IfOpened`], which will make it so that it is only accessible when CCD is 302[`Open`]ed, not [`Lock`]ed: 303 304##### Restrict EC 305 306``` 307(gsc) > ccd set UartGscTxECRx IfOpened 308(gsc) > ccd set UartGscRxECTx IfOpened 309``` 310 311##### Restrict AP 312 313``` 314(gsc) > ccd set UartGscTxAPRx IfOpened 315(gsc) > ccd set UartGscRxAPTx IfOpened 316``` 317 318#### Most Accessible 319 320If you want things as accessible as possible and want all capabilities to be 321[`Always`], you can run 322 323``` 324(gsc) > ccd reset factory 325``` 326 327This will also permanently disable write protect. To reset write protect run 328 329``` 330(gsc) > wp follow_batt_pres atboot 331``` 332 333To reset capabilities to Default run 334 335``` 336(gsc) > ccd reset 337``` 338 339## Flashing EC {#flashec} 340 341Flashing the EC is restricted by the `FlashEC` capability. 342 343The steps to flash the EC differ based on the board being used, but the 344[`flash_ec`] script will handle this for you. 345 346```bash 347(chroot) $ sudo servod -b $BOARD 348(chroot) $ ~/trunk/src/platform/ec/util/flash_ec -i $IMAGE -b $BOARD 349``` 350 351## Flashing the AP {#flashap} 352 353*** note 354**WARNING**: Before attempting to flash the AP firmware, start with the 355[CCD Open] steps; if you flash broken firmware before opening CCD, you may make 356it impossible to restore your device to a working state. 357*** 358 359Flashing the AP is restricted by the `FlashAP` capability. 360 361```bash 362(chroot) $ sudo flashrom -p raiden_debug_spi:target=AP -w $IMAGE 363``` 364 365This default flashing command takes a very long time to complete, there are ways 366to [speed up the flashing process] by cutting some corners. 367 368If you have many CCD devices connected, you may want to use the GSC serial 369number: 370 371```bash 372# For Cr50-based device 373(chroot) $ lsusb -vd 18d1:5014 | grep iSerial 374# For Tir50-based device 375(chroot) $ lsusb -vd 18d1:504a | grep iSerial 376``` 377 378You can then add the serial number to the [`flashrom`] command: 379 380```bash 381(chroot) $ sudo flashrom -p raiden_debug_spi:target=AP,serial=$SERIAL -w $IMAGE 382``` 383 384**If you don't see GSC print any messages when you're running the [`flashrom`] 385command and you have more than one GSC device connected to your workstation, you 386probably need to use the serial number.** 387 388### Special Cases {#flashap-special-cases} 389 390GSC puts the device in reset to flash the AP. Due to hardware limitations GSC 391may not be able to disable hardware write protect while the device is in reset. 392If you want to reflash the AP RO firmware using CCD and your board has issues 393disabling hardware write protect, you may need to also disable software write 394protect. 395 396If you suspect the board you are using has this issue, you can try this: 397 3981. Disable write protect using the GSC console command: 399 400 ``` 401 (gsc) > wp disable 402 ``` 403 4042. Disable software write protect via CCD: 405 406 ```bash 407 (chroot) $ sudo futility flash --wp-disable --servo 408 ``` 409 410## Control Hardware Write Protect {#hw-wp} 411 412Control of hardware write protect is restricted by the `OverrideWP` capability. 413When the capability is allowed, the hardware write protect setting can be 414controlled with the `wp` command in the GSC console. Otherwise, the hardware 415write protect is determined based on the presence of the battery. 416 417Hardware Write Protect Setting | Battery State | Hardware Write Protect State 418------------------------------ | ------------------------------ | ---------------------------- 419`follow_batt_pres` | Connected | Enabled 420`follow_batt_pres` | Disconnected | Disabled 421`follow_batt_pres` | N/A (Chromebox has no battery) | Write Protect Screw means Enabled 422`enabled` | Any | Enabled 423`disabled` | Any | Disabled 424 425### Write Protect Commands 426 427``` 428(gsc) > wp [enable|disable|follow_batt_pres] 429``` 430 431There are two write protect settings: the current setting and the `atboot` 432setting. 433 434The `wp` command adjusts the current write protect setting that will last until 435GSC reboots or loses power. Note that GSC does not reboot when the rest of the 436system reboots. It will only reboot in the cases where the firmware is being 437updated, it crashes, the battery completely drains, the battery is removed, or 438power is otherwise lost. 439 440The `atboot` setting is the state of the write protect when GSC boots; it 441defaults to `follow_batt_pres`. 442 443To change the `atboot` setting, add the `atboot` arg to the end of the `wp` 444command: 445 446``` 447(gsc) > wp [enable|disable|follow_batt_pres] atboot 448``` 449 450You can query the write protect state with `gsctool`: 451 452```bash 453(dut) $ gsctool -a -w 454 455... 456Flash WP: forced disabled <-- Current hardware write protect state 457 at boot: forced disabled <-- "atboot" hardware write protect state 458 459``` 460 461`gsctool -a -w` Status | Hardware Write Protect State 462---------------------- | ------------------------------------ 463`forced disabled` | Disabled 464`forced enabled` | Enabled 465`enabled` | Enabled, following battery presence 466`disabled` | Disabled, following battery presence 467 468### Special Case Devices 469 470Bob devices have a write protect screw in addition to battery presence. The 471write protect screw will force enable write protect until it's removed. If GSC 472is set to `follow_batt_pres`, you need to remove the write protect screw and 473disconnect the battery to disable write protect. If you run `wp disable`, you 474will also need to remove the screw. 475 476If you are attempting to flash the AP, see the [Flashing the AP Special Cases] 477section for additional steps you may have to take to disable write protection. 478 479## UART Rescue mode 480 481### Overview 482 483UART Rescue Mode is a feature of the GSC RO firmware that supports programming 484the RW firmware using only the UART interface. This is used to recover a bad RW 485firmware update (which should be rare). 486 487This is also useful when bringing up new designs, as this allows to update GSC 488image even before USB CCD or TPM interfaces are operational. 489 490UART rescue works on all existing devices, all it requires is that GSC console 491is mapped to a `/dev/xxx` device on the workstation (the same device used to 492attach a terminal to the console). 493 494Rescue works as follows: when the RO starts, after printing the regular banner 495on the console it prints a magic string to the console and momentarily waits for 496the host to send a sync symbol, to indicate that an alternative RW will have to 497be loaded over UART. The RO also enters this mode if there is no valid RW to 498run. 499 500When rescue mode is triggered, the RO is expecting the host to transfer a single 501RW image in hex format. 502 503Follow the [brescue](./gsc_without_servod.md#gsc-rescue) procedure to perform a 504GSC rescue. 505 506## CCD Open Without Booting the Device {#ccd-open-no-boot} 507 508If you can’t boot your device, you won’t be able to enable [Developer Mode] to 509send the open command from the AP. If you have enabled CCD on the device before, 510GSC may be configured in a way that you can still open GSC. 511 512### Option 1: Remove the battery 513 514If you can remove the battery, you can bypass the [Developer Mode] requirements. 515`ccd open` is allowed from the GSC console if the Chrome OS Firmware Management 516Parameters (`FWMP`) do not disable CCD and the battery is disconnected. This is 517the most universal method and will work even if you haven’t enabled CCD before. 518 5191. Disconnect the battery 520 5211. Send `ccd open` from the GSC console. 522 523### Option 2: "OpenNoDevMode" and "OpenFromUSB" are set to Always 524 525If "OpenNoDevMode" and "OpenFromUSB" are set to Always, you will be able to open 526GSC from the GSC console without enabling [Developer Mode]: 527 528``` 529(gsc) > ccd open 530``` 531 532You will still need physical presence (i.e., press the power button) unless 533`testlab` mode is also enabled: 534 535``` 536(gsc) > ccd testlab 537 CCD test lab mode enabled 538``` 539 540#### Enabling 541 542If CCD is [`Open`], you can enable these settings with: 543 544``` 545(gsc) > ccd set OpenFromUSB Always 546(gsc) > ccd set OpenNoDevMode Always 547``` 548 549### Option 3: CCD Password is Set 550 551If the CCD password is set, you can open from the GSC console without 552[Developer Mode]. 553 554``` 555(gsc) > ccd open $PASSWORD 556(gsc) > ccd unlock $PASSWORD 557``` 558 559Alternatively, you can use `gsctool`, entering the password when prompted: 560 561``` 562(dut) $ gsctool -a -o 563(dut) $ gsctool -a -u 564``` 565 566#### Enabling 567 568When CCD is [`Open`], run the `gsctool` command and enter the password when 569prompted. 570 571```bash 572(chroot) $ gsctool -a -P 573``` 574 575You can use the CCD command on the GSC console to check if the password is set. 576 577``` 578(gsc) > ccd 579 ... 580 Password: [none|set] 581 ... 582``` 583 584#### Disabling 585 586When CCD is [`Open`], you can use `gsctool` to clear the password: 587 588```bash 589(dut) $ gsctool -a -P clear:$PASSWORD 590``` 591 592Alternatively, you can use the GSC console to clear the password and reset CCD 593capabilities to their default values: 594 595``` 596(gsc) > ccd reset 597``` 598 599## Troubleshooting 600 601### rddkeepalive 602 603GSC only enables CCD when it detects a debug accessory is connected (e.g., 604[Suzy-Q] or [Type-C Servo v4]). It detects the cable based on the voltages on 605the CC lines. If you are flashing the EC and AP or working with unstable 606hardware, these CC voltages may become unreliable for detecting a debug 607accessory. 608 609To work around this, you can force GSC to always assume that a debug cable is 610detected: 611 612``` 613(gsc) > rddkeepalive enable 614``` 615 616*** note 617**NOTE**: Enabling `rddkeepalive` does increase power consumption. 618*** 619 620To disable: 621 622``` 623(gsc) > rddkeepalive disable 624``` 625 626### Updating GSC {#updating-cr50} 627 628Production (`MP`) versions of Cr50 firmware use a [minor version][semver] of 629`3`: `0.3.x`. Production firmware versions `0.3.9` or newer support CCD. 630 631Production (`MP`) versions of Ti50 firmware use a [minor version][semver] of 632`23`: `0.23.x`. 633 634Development (`PrePVT`) versions of Cr50 firmware use a minor version of `4`: 635`0.4.x`. Development firmware versions `0.4.9` or newer support CCD. 636 637Development (`PrePVT`) versions of Ti50 firmware use a minor version of `24`: 638`0.24.x`. 639 640There aren't many differences between the MP and PrePVT versions of images, but 641it is a little easier to CCD [`Open`] PrePVT images. You can't run PrePVT images 642on MP devices, so if you're trying to update to PrePVT and it fails try using 643the MP image. 644 6451. Flash a test image newer than M66. 646 6471. Enable [Developer Mode] and connect a debug cable ([`Suzy-Q`] or [`Type-C 648 Servo v4`]). 649 6501. Check the running GSC version with `gsctool`: 651 652```bash 653(dut) $ sudo gsctool -a -f 654 655... 656RW 0.4.26 <-- The "RW" version is the one to check 657``` 658 6591. Update GSC using the firmware in the OS image: 660 661*Production (MP) image*: 662 663```bash 664(dut) $ sudo gsctool -a /opt/google/cr50/firmware/cr50.bin.prod 665(dut) $ sudo gsctool -a /opt/google/ti50/firmware/ti50.bin.prod 666``` 667 668*Development (PrePVT) image*: 669 670```bash 671(dut) $ sudo gsctool -a /opt/google/cr50/firmware/cr50.bin.prepvt 672(dut) $ sudo gsctool -a /opt/google/ti50/firmware/ti50.bin.prepvt 673``` 674 6751. Check the GSC version again to make sure it's either `0.3.X` or `0.4.X`, or 676 check the Ti50 version again to make sure it's either `0.23.X` or `0.24.X`. 677 678### Speed up Flashing the AP {#speed-up-ap-flash} 679 680In the [default AP flashing steps][flashap] [`flashrom`] reads the entire flash 681contents and only erases and programs the pages that have to be modified. 682However, when GSC controls the SPI bus, it can only run at 1.5 MHz, versus the 68350 MHz that the AP normally runs it at. 684 685We can take advantage of the fact that Chrome OS device AP firmware is split 686into sections, only a few of which are essential for maintaining the device 687identity and for booting the device in recovery mode to program faster by only 688reading and writing sections we care about: 689 690```bash 691# This will save device flash map and VPD sections in 692# /tmp/bios.essentials.bin. VPD sections contain information like device 693# firmware ID, WiFi calibration, enrollment status, etc. Use the below command 694# only if you need to preserve the DUT's identity, no need to run it in case 695# the DUT flash is not programmed at all, or you do not care about preserving 696# the device identity. 697sudo flashrom -p raiden_debug_spi:target=AP -i FMAP -i RO_VPD -i RW_VPD -r /tmp/bios.essentials.bin 698 699# This command will erase the entire flash chip in one shot, the fastest 700# possible way to erase. 701sudo flashrom -p raiden_debug_spi:target=AP -E 702 703# This command will program essential flash sections necessary for the 704# Chrome OS device to boot in recovery mode. Note that the SI_ALL section is 705# not always present in the flash image, do not include it if it is not in 706# dump_fmap output. 707sudo flashrom -p raiden_debug_spi:target=AP -w image-atlas.bin -i FMAP -i WP_RO [-i SI_ALL] --noverify 708 709# This command will restore the previously preserved VPD sections of the 710# flash, provided it was saved in the first step above. 711sudo flashrom -p raiden_debug_spi:target=AP -w /tmp/bios.essential.bin -i RO_VPD -i RW_VPD --noverify 712``` 713 714Once flash is programmed, the device can be booted in recovery mode and start 715Chrome OS from external storage, following the usual recovery procedure. Once 716Chrome OS is installed, AP flash can be updated to include the rest of the image 717by running [`flashrom`] or `futility` from the device bash prompt. 718 719[Case Closed Debugging]: ./case_closed_debugging.md 720[chromeos-cr50 ebuild]: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/refs/heads/main/chromeos-base/chromeos-cr50/chromeos-cr50-0.0.1.ebuild 721[chromeos-ti50 ebuild]: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/refs/heads/main/chromeos-base/chromeos-ti50/chromeos-ti50-0.0.1.ebuild 722[Developer Mode]: https://chromium.googlesource.com/chromiumos/docs/+/main/developer_mode.md#dev-mode 723[Recovery Mode]: https://chromium.googlesource.com/chromiumos/docs/+/main/debug_buttons.md 724[Servo]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/main/docs/servo.md 725[`servod`]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/main/docs/servo.md 726[Type-C Servo v4]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/main/docs/servo_v4.md 727[update servo v4]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/main/docs/servo_v4.md#updating-firmware 728[Suzy-Q]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/main/docs/ccd.md#SuzyQ-SuzyQable 729[`hdctools`]: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/refs/heads/main/README.md 730[`FlashAP`]: #flashap 731[flashing the AP firmware]: #flashap 732[flashap]: #flashap 733[Flashing the AP Special Cases]: #flashap-special-cases 734[`FlashEC`]: #flashec 735[flashing the EC firmware]: #flashec 736[`OverrideWP`]: #hw-wp 737[`Always`]: #cap-priv 738[`IfOpened`]: #cap-priv 739[`Open`]: #cap-priv 740[`Locked`]: #cap-priv 741[`Unlocked`]: #cap-priv 742[Updating Cr50]: #updating-cr50 743[CCD Open Without Booting the Device]: #ccd-open-no-boot 744[cap]: #cap 745[consoles]: #consoles 746[hw-wp]: #hw-wp 747[`flash_ec`]: https://chromium.googlesource.com/chromiumos/platform/ec/+/main/util/flash_ec 748[CCD Open]: #ccd-open 749[`flashrom`]: https://chromium.googlesource.com/chromiumos/third_party/flashrom/+/main/README.chromiumos 750[speed up the flashing process]: #speed-up-ap-flash 751[this bug]: https://issuetracker.google.com/149420712 752[semver]: https://semver.org/ 753[`usb_console`]: https://chromium.googlesource.com/chromiumos/platform/ec/+/main/extra/usb_serial/console.py 754