Chrome Devices

There are a lot of Chrome devices (Chromebooks and ChromeBoxes) that have MrChromebox’s Coreboot support. Most of these devices can support Heads as well. This guide is a general guide with common steps that apply to all Chrome devices.

Table of contents

Chrome Devices
⚡ Safety First
Summary
Closed Case Debugging
1. Enabling Closed Case Debugging (CCD)
  1. ChromeOS Developer Mode Method
  2. SuzyQ and CR50 Console Method
Disable Hardware Write Protection
Disable Software Write Protection

⚡ Safety First

Before starting, please read our SPI Programmer Best Practices guide for essential safety information and programmer recommendations.

Summary

At a high level we will be doing the following:

Enable closed case debugging (CCD)
Disable hardware write protection
Disable software write protection

Then you can follow the individual device guides on how to backup, and then flash Heads.

Closed Case Debugging

With Chrome devices there is an option called “Closed Case Debugging” or CCD. With CCD You can flash the rom without having to open the device. A special usb cable called a SuzyQ cable is required. A good guide on using the SuzyQ cable is MrChromebox.

Here are 2 places where you can find info on purchasing a SuzyQ board:

Enabling Closed Case Debugging (CCD)

There are 2 ways to enable CCD. One is by using the ChromeOS Developer mode console, this method requires the stock ChromeOS bootloader, but no SuzyQ board. The 2nd option is using a SuzyQ board to send commands to the GSC/CR50 console

ChromeOS Developer Mode Method

You will be using gsctool in the ChromeOS Developer mode console.

Power on the device to the login screen (booted into Developer Mode).
Open VT-2 terminal: press [CTRL+ALT+F2] (F2 is the right arrow).
Login as root
Open the CCD: run gsctool -a -o
You will be prompted to press the PP (physical presence) button several times. On almost all devices, this means to press the power button. Opening the CCD requires you to press the PP button several times over a 2-3 minute period.
When the open CCD process is complete, you will see a message showing PP Done! and the device will reboot in Normal/Verified Boot Mode.
Re-enable developer mode and continue with the instructions below.

MrChromebox source

SuzyQ and CR50 Console Method

Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device (usually left USB-C port) and the USB-A end to your Linux device Verify the cable is properly connected:
```
$ ls /dev/ttyUSB*
/dev/ttyUSB0  /dev/ttyUSB1  /dev/ttyUSB2
```
This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2. If not, then your cable is connected to the wrong port or is upside down. Adjust and repeat command until output is as expected.

Check if CCD is already Unlocked.

# Check the baud rate
sudo stty -F /dev/ttyUSB0

sudo minicom -D /dev/ttyUSB0 -b <baud_rate from above>
< Press Enter >
ccd

If CCD is locked it will show:

State: Locked
Password: none
Flags: 0x000000
Capabilities: 0000000000000000
  UartGscRxAPTx   Y 0=Default (Always)
  UartGscTxAPRx   Y 0=Default (Always)
  UartGscRxECTx   Y 0=Default (Always)
  UartGscTxECRx   - 0=Default (IfOpened)
  FlashAP         - 0=Default (IfOpened)
  FlashEC         - 0=Default (IfOpened)
  OverrideWP      - 0=Default (IfOpened)
  RebootECAP      - 0=Default (IfOpened)
  GscFullConsole  - 0=Default (IfOpened)
  UnlockNoReboot  Y 0=Default (Always)
  UnlockNoShortPP Y 0=Default (Always)
  OpenNoTPMWipe   - 0=Default (IfOpened)
  OpenNoLongPP    - 0=Default (IfOpened)
  BatteryBypassPP Y 0=Default (Always)
  Unused          Y 0=Default (Always)
  I2C             - 0=Default (IfOpened)
  FlashRead       Y 0=Default (Always)
  OpenNoDevMode   - 0=Default (IfOpened)
  OpenFromUSB     - 0=Default (IfOpened)
  OverrideBatt    - 0=Default (IfOpened)
  APROCheckVC     - 0=Default (IfOpened)
read_tpm_nvmem: object at 0x100a not found
[906.873298 Console unlock allowed]
read_tpm_nvmem: object at 0x1007 not found
TPM:
Capabilities are default.
Use 'ccd help' to print subcommands

Unlock CCD
```
ccd open
```

Disable Hardware Write Protection

We now need to disable hardware write protection so we can flash the rom.

Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device (usually left USB-C port) and the USB-A end to your Linux device Verify the cable is properly connected:
```
$ ls /dev/ttyUSB*
/dev/ttyUSB0  /dev/ttyUSB1  /dev/ttyUSB2
```
This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2. If not, then your cable is connected to the wrong port or is upside down. Adjust and repeat command until output is as expected.

Run the following commands to disable hardware write protection:

echo "wp false" > /dev/ttyUSB0
echo "wp false atboot" > /dev/ttyUSB0
echo "ccd reset factory" > /dev/ttyUSB0

Power on the Kano device to the login screen (booted into Developer Mode).
Open VT-2 terminal: press [CTRL+ALT+F2] (F2 is the right arrow).
Login as root
Run gsctool -a -I to verify the CCD is opened, and that the factory values are set. The current value for all CCD flags should be set to Y/Always.
Run crossystem wpsw_cur and verify it returns 0.
Reboot.

MrChromebox source

Disable Software Write Protection

A good guide on how to do this is here

We will be using the SuzyQ device to disable Software write protection. If you don’t already have that plugged in follow the steps above to get the SuzyQ cable plugged in correctly.

Note: Some devices have special programmer parameters, if the below commands do not work for you, go to the specific device page to see if your device has different options.

Check if write protection is enabled:

flashrom --programmer raiden_debug_spi:target=AP \
  --wp-status

Disable software write protection:

flashrom --programmer raiden_debug_spi:target=AP \
  --wp-disable

Changes software write protection addresses range:
```
flashrom --programmer raiden_debug_spi:target=AP \
  --wp-range 0,0
```
(--wp-range 0 0 on older devices)