the Chromium logo

The Chromium Projects

Keyboard-Controlled Reset Circuit

To enable users to securely reset a Chrome device, or enter recovery and developer modes, a hardware circuit is required. This function can be implemented with a Silego chip, or an equivalent combination of parts and logic.

When a user presses a combination of the power key and certain other keys, the hardware circuit monitoring the keyboard generates a reset signal to the embedded controller. The embedded controller controls power to the rest of the system, which is reset as well. The circuit contains a flip-flop that is can only be cleared by the reset signal. This flip-flop is set by a GPIO signal from the embedded controller that is sent before the embedded controller transitions from its read-only firmware to its rewriteable firmware. The output of the flip-flop goes to a GPIO on the main processor, which can use this signal to verify that the EC has been reset and is still running read-only (and hence trusted) code.

Reset

To reset the system, the user presses Power+F3 (Power+VolumeUp on convertible devices without a secure keyboard connection). When the embedded controller resets, it progresses from read-only firmware to rewritable firmware for operation in Normal Mode.

Recovery mode

To enter Recovery Mode, the user holds Power+F3+ESC (Power+VolumeUp+VolumeDown on convertible devices without a secure keyboard connection). When the embedded controller resets in Recovery Mode, it remains in its read-only firmware and tells the main processor to boot in Recovery Mode.

Developer mode

Users can enter Developer Mode from Recovery Mode, usually by pressing Ctrl+D at the recovery screen. Developer Mode can be accessed if and only if the flip-flop indicates that the embedded controller is still in read-only mode. This requirement ensures that the Recovery Mode firmware on the main processor can trust the keyboard messages from the embedded controller (and thus ensures that the keyboard messages are in fact sent by a physical user who is present at the keyboard—not, for example, from a keyboard that has been hijacked by a remote process).

Optional battery cutoff

Systems with non-removable batteries may implement a battery cut-off. The battery can be cut off by removing the power adapter while holding Power+F3 (Power+VolumeUp on convertible devices without a secure keyboard connection) for 10 seconds or more. The preferred implementation is with a control wire into the controller/gas-gauge inside the battery pack, but an alternative is to force off FETs in the charger circuit. This requirement allows users under direction from support staff to completely cut off power to the device. It also enables users to recover from situations where the power supply has locked up. For example, an out of specification USB device causing the main power regulator to latch a fault and shutdown until power is cycled.

image

KeyboardControlledReset.png.1353360421277.png

This hardware circuit does the following:

The embedded controller boots into read-only (RO) code. It then normally verifies and jumps to rewritable (RW) code. Before jumping to RW code, the RO code must assert the EC_ENTERING_RW GPIO. This will set the flip-flop, so that it asserts the EC_IN_RW signal to the main processor. Once the flip-flop has been set, it can only be cleared by pressing the Reset key combination. No action by the embedded controller can clear the flip-flop.