Add Google kano (MrChromebox 26.03 coreboot fork) support - First full Chromebook port!

[cwiggs]

This pull request adds support for the Acer Chromebook Spin 714 ("kano") board based on the MrChromebox coreboot fork (26.06), including CI integration, configuration files, and documentation updates. It also introduces a patch for musl compatibility in the MrChromebox fork, adds a new Linux kernel version (6.6.30), and documents TPM2 CR50 command support. The most important changes are grouped below:

Kano (Acer Chromebook Spin 714) board support:

• Adds boards/kano/kano.config for Heads and Linux build configuration for the kano board.
• Adds config/coreboot-kano.config_defconfig as a defconfig backup for kano, documenting non-default coreboot options.
• Integrates kano into CircleCI: adds coreboot-mrchromebox as a seed, defines the kano build job, and documents its workflow. [1] [2] [3]
• Documents kano's handling of the RTC century byte and why USE_PC_CMOS_ALTCENTURY must be unset for this board. [1] [2] [3]

MrChromebox coreboot fork integration:

• Adds the MrChromebox coreboot fork (26.03) as a supported module in modules/coreboot, with commit hash pinning and submodule handling notes. [1] [2]
• Documents and implements post-build application of the ME HAP bit for MrChromebox-based boards (e.g., kano) via ifdtool. [1] [2]

Build system and kernel updates:

• Adds Linux kernel version 6.6.30 support for use by kano and other boards. [1] [2]
• Adds a musl compatibility patch for MrChromebox coreboot's cbmem utility.

Documentation improvements:

• Documents how to clone the repository with full history and repair shallow clones for reproducible builds.
• Adds a section on CR50 TPM command limitations and Heads TPM2 command compatibility.
• Expands documentation on defconfig backups for Chromebook boards and Heads-common coreboot options. [1] [2] [3]

Minor adjustments:

• Updates the list of boards with specific coreboot options and clarifies configuration for Purism and QEMU boards. [1] [2]

These changes collectively enable official Heads support for the Acer Chromebook Spin 714 (kano), ensure compatibility with the MrChromebox fork, and improve build reproducibility and documentation for new contributors.

(copilot generalized pr summary, asked by @tlaurion)

---

TODO before merge

• Create Chromebook section with notes of this PR
• Go through/modify porting guide checklist
  • Go through/modify testing checklist
    • Successful external flash link to circleci: https://output.circle-artifacts.com/output/job/97786f70-ace9-4498-9a51-38424e090075/artifacts/0/build/x86/kano/heads-kano-202607201344-v0.2.1-3129-g5cbf889.zip. from commit [5cbf889](https://github.com/linuxboot/heads/commit/5cbf8896292b1e7c8953feb60102096c6b7debdf) using external programmer model suzyq
    • Boots successfully after the flashing:
    • Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected
    • Clean boot detected (no keyring, nothing installed on disk): usb boot proposed and followed
    • Boots on usb
    • OS NixOS 26.05 install and reboot
    • Heads functionality- no pubkey detected, but OS detected -> OEM-Factory-reset proposed. Done with Yubikey 5c NFC v3.4 hardwarekey
    • On reboot after re-ownership: generate new HOTP/TOTP
    • wifi works based on OS NixOS 26.05
    • PR0
      • flashprog -p internal (not locked)
      • lock_chip (locks the platform with PR0, if PR0 patch applied in fork or under patches/coreboot-X.Y.Z. and coreboot config contain proper preparation of the platform)
      • flashprog -p internal (reports locked)

Additional actionable items:

• Confirm/infirm initrd/bin/kexec-save-default.sh: skip symlinks when finding crypttabfiles #2155 needed to boot NixOS
• Any impact from ME being HAP disabled??
• doc/BOARDS_AND_TESTERS.md needs addition of the board and your name added there before merging
• Create HTOP build for Kano.

[tlaurion]

first review as I was there and saw work on this PR :)

[tlaurion]

I suggest you tart a thread under Matrix Heads channel. You must rebase the old PR on linuxboot/heads master, an dthen adapt coreboot config to your board. Following https://osresearch.net/Porting/ @cwiggs otherwise your experience might be really frustrating.

[cwiggs]

I suggest you tart a thread under Matrix Heads channel. You must rebase the old PR on linuxboot/heads master, an dthen adapt coreboot config to your board. Following https://osresearch.net/Porting/ @cwiggs otherwise your experience might be really frustrating.

Started a thread here: https://matrix.to/#/!eMLMv62wAMCW1V-ufL_bJ_JDngDhrpSOSEQBLzX8aTg/$eepAush4kVo93Zxqtw59P6NX9g6AG7FZFplc2Fu6tyo?via=matrix.org&via=tchncs.de&via=unredacted.org

[tlaurion]

@cwiggs I saw you left the room?

[cwiggs]

@cwiggs I saw you left the room?

Looks like the Matrix homeserver decided to delete my account for some reason, I'll look into getting it reactivated.

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.

CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.

CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config.
I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano
(There is 19 commits atop origin/master there; not 9 as here)

I can push here too, if needed. Let me know.

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config. I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano (There is 19 commits atop origin/master there; not 9 as here)

I can push here too, if needed. Let me know.

I just rebased off your branch, let me know if it looks good from that point of view. Looks like I also will need to rebase off main.

As far as flashing goes: I got the Suzy-Q "cable" (It's really just a small board with a male and female usb-c, you then use your own usb-c cable). And I have some good news and some bad news (I think?). I was able to get the suzy-q cable to read the rom, but verifying the backup seems to fail.

I've been using this mrchromebox guide to get the suzy-q device working with flashrom and then this heads wiki as well. Below are some notes I put together while I was attempting the flash:

Use Suzy-Q cable for flashing

1. Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device
   (usually left USB-C port) and the USB-A end to your Linux device
   Verify the cable is properly connected:

   • ls /dev/ttyUSB*
   • This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2.
   • If not, then your cable is connected to the wrong port or is upside down.
     Adjust and repeat command until output is as expected.

2. Set the CCD state to open:

   • echo "ccd open" | sudo tee -a /dev/ttyUSB0 > /dev/null

3. Test Connection and detect chip. raiden_debug_spi used from mrchromebox doc

   • sudo flashrom -p raiden_debug_spi

     ╚═ $ sudo flashrom -p raiden_debug_spi
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: (null)
     Raiden target: 0,0
     Raiden: Target SPI bridge is disabled (is WP enabled?)
     Raiden: Error configuring protocol
         protocol       = 2
         status         = 0x00005
     Error: Programmer initialization failed.
     

   • sudo flashrom -p raiden_debug_spi:target=AP casued a reboot.

      ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     No operations were specified.
     

4. Create backup, and verify.

   • sudo flashrom -p raiden_debug_spi:target=AP -r badflash.rom
   • hexdump -C badflash.rom | head -20

       00000000  11 00 00 9c 90 02 00 d6  00 00 00 05 ff ff ff ff  |................|
       00000010  5a a5 f0 0f 03 00 04 00  08 02 10 46 b0 01 14 00  |Z..........F....|
       00000020  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       00000030  f6 30 30 09 21 42 60 ad  b7 b9 c4 c7 ff ff ff ff  |.00.!B`.........|
       00000040  00 00 00 00 00 05 ff 1f  01 00 ff 04 ff 7f 00 00  |................|
       00000050  ff 7f 00 00 ff 7f 00 00  ff 7f 00 00 ff 7f 00 00  |................|
       *
       00000080  00 07 20 00 00 05 40 00  00 00 00 00 00 00 00 00  |.. ...@.........|
       00000090  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
       000000a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       *
       00000100  00 00 00 00 01 00 00 00  09 00 04 00 00 ce 3d 03  |..............=.|
       00000110  7f 00 38 00 00 00 00 00  10 00 00 00 02 00 20 60  |..8........... `|
       00000120  08 30 03 48 00 00 00 00  01 00 7f 0f 82 0b c0 04  |.0.H............|
       00000130  00 00 00 00 00 00 0e 00  22 42 22 42 22 22 42 22  |........"B"B""B"|
       00000140  00 00 00 00 00 00 00 00  00 00 ff 00 60 00 80 c8  |............`...|
       00000150  45 86 00 36 01 00 a6 81  20 0e 58 00 01 00 40 00  |E..6.... .X...@.|
       00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
       00000170  00 1c 00 00 00 00 00 00  54 b3 04 a0 30 00 00 41  |........T...0..A|
       00000180  8f 03 08 c6 00 01 00 00  00 00 00 00 00 00 00 00  |................|
     

   • sudo flashrom -p raiden_debug_spi:target=AP --verify badflash.rom

       flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
       flashrom is free software, get the source code at https://flashrom.org
     
       FISK: AP
       Raiden target: 2,0
       Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
       Verifying flash... FAILED at 0x01bbeadb! Expected=0x94, Found=0xb4, failed byte count from 0x00000000-0x01ffffff: 0x3f
     

5. Created a backup and verify it using heads wiki guide.

   • sudo flashrom -p raiden_debug_spi:target=AP --read backup.bin --chip "W25Q256JV_M"
   • sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"

     ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e
     

Questions:

1. When I run sudo flashrom -p raiden_debug_spi I'm getting a "Error: Programmer initialization failed" and "Target SPI bridge is disabled (is WP enabled?)". The mrchromebox guide does talk about disabling write-protection, but it seems to only be possible to do via a tool in ChromeOS (gsctool), or by disconnecting the laptops battery. Seems very likely write-protection is still on.
2. Looks like I was able to create a backup, but then when I verify it I get: "Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e" Why is it not working?

Anyway I think next steps are to disconnect the battery and try these flashrom commands again. I don't want to proceed until the verify step works without error.

[cwiggs]

Well I disconnected the battery and am getting the same response from flashrom. Should I just continue with flashing heads?

Here are my notes:

6. Disconnect Battery to disable write-protection.

• Remove The 9 screws.

* Use a smudger to take the back cover off. * Disconnect battery cable.

• Put laptop back together.

7. Disable write-protection. mrchromebox guide

• Plug laptop into power.
• Plug in suzy-q cable.
• echo "wp false" > /dev/ttyUSB0
• echo "wp false atboot" > /dev/ttyUSB0
• echo "ccd reset factory" > /dev/ttyUSB0

8. Tried the same flashrom commands to backup and verify above and got the same result of "Error: Programmer initialization failed" and "Verifying flash... FAILED at 0x0003e1c0! Expected=0x28, Found=0x68, failed byte count from 0x00000000-0x01ffffff: 0xe99" when verifying.

[tlaurion]

Sorry i won't be able to help but with theory, I do not own any chromebook; you are guinea pig here :/

from https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disabling-software-write-protection

sudo flashrom --wp-status

What is the output?

Also weird that you cannot verify a backup; that is not good. You shoud not proceed until you have a backup that can be flashed back otherwise you risk bricking. There is no A/B fallback with Heads as opposed to chromebook verified boot counterpart; firmware needs to be correct otherwise you will need to get back to prior firmware until port is complete.

Reading deeper (I guess your device is >2023), if its the case, you MUST disable CCD following those instructions https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification

Let me know!
Might be useful to get direct communication, mrchromebox being online and normally really responsive; since this is first expected first port (and you have other devices) i'm willing to invest time making this work and first class citizen.
Community: https://osresearch.net/community/

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config. I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano (There is 19 commits atop origin/master there; not 9 as here)
I can push here too, if needed. Let me know.

I just rebased off your branch, let me know if it looks good from that point of view. Looks like I also will need to rebase off main.

As far as flashing goes: I got the Suzy-Q "cable" (It's really just a small board with a male and female usb-c, you then use your own usb-c cable). And I have some good news and some bad news (I think?). I was able to get the suzy-q cable to read the rom, but verifying the backup seems to fail.

I've been using this mrchromebox guide to get the suzy-q device working with flashrom and then this heads wiki as well. Below are some notes I put together while I was attempting the flash:

Use Suzy-Q cable for flashing

1. Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device
   (usually left USB-C port) and the USB-A end to your Linux device
   Verify the cable is properly connected:
   
   * ls /dev/ttyUSB*
   * This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2.
   * If not, then your cable is connected to the wrong port or is upside down.
     Adjust and repeat command until output is as expected.

2. Set the CCD state to open:
   
   * echo "ccd open" | sudo tee -a /dev/ttyUSB0 > /dev/null

3. Test Connection and detect chip. `raiden_debug_spi` used from mrchromebox [doc](https://docs.mrchromebox.tech/docs/support/unbricking/unbrick-suzyq.html#persisting-the-board-s-vital-product-data-vpd-and-hardware-id-hwid)
   
   * sudo flashrom -p raiden_debug_spi
     ```
     ╚═ $ sudo flashrom -p raiden_debug_spi
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: (null)
     Raiden target: 0,0
     Raiden: Target SPI bridge is disabled (is WP enabled?)
     Raiden: Error configuring protocol
         protocol       = 2
         status         = 0x00005
     Error: Programmer initialization failed.
     ```
   * sudo flashrom -p raiden_debug_spi:target=AP casued a reboot.
     ```
      ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     No operations were specified.
     ```

4. Create backup, and verify.
   
   * sudo flashrom -p raiden_debug_spi:target=AP -r badflash.rom
   * hexdump -C badflash.rom | head -20
     ```
       00000000  11 00 00 9c 90 02 00 d6  00 00 00 05 ff ff ff ff  |................|
       00000010  5a a5 f0 0f 03 00 04 00  08 02 10 46 b0 01 14 00  |Z..........F....|
       00000020  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       00000030  f6 30 30 09 21 42 60 ad  b7 b9 c4 c7 ff ff ff ff  |.00.!B`.........|
       00000040  00 00 00 00 00 05 ff 1f  01 00 ff 04 ff 7f 00 00  |................|
       00000050  ff 7f 00 00 ff 7f 00 00  ff 7f 00 00 ff 7f 00 00  |................|
       *
       00000080  00 07 20 00 00 05 40 00  00 00 00 00 00 00 00 00  |.. ...@.........|
       00000090  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
       000000a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       *
       00000100  00 00 00 00 01 00 00 00  09 00 04 00 00 ce 3d 03  |..............=.|
       00000110  7f 00 38 00 00 00 00 00  10 00 00 00 02 00 20 60  |..8........... `|
       00000120  08 30 03 48 00 00 00 00  01 00 7f 0f 82 0b c0 04  |.0.H............|
       00000130  00 00 00 00 00 00 0e 00  22 42 22 42 22 22 42 22  |........"B"B""B"|
       00000140  00 00 00 00 00 00 00 00  00 00 ff 00 60 00 80 c8  |............`...|
       00000150  45 86 00 36 01 00 a6 81  20 0e 58 00 01 00 40 00  |E..6.... .X...@.|
       00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
       00000170  00 1c 00 00 00 00 00 00  54 b3 04 a0 30 00 00 41  |........T...0..A|
       00000180  8f 03 08 c6 00 01 00 00  00 00 00 00 00 00 00 00  |................|
     ```
   * sudo flashrom -p raiden_debug_spi:target=AP --verify badflash.rom
     ```
       flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
       flashrom is free software, get the source code at https://flashrom.org
     
       FISK: AP
       Raiden target: 2,0
       Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
       Verifying flash... FAILED at 0x01bbeadb! Expected=0x94, Found=0xb4, failed byte count from 0x00000000-0x01ffffff: 0x3f
     ```

5. Created a backup and verify it using heads wiki guide.
   
   * sudo flashrom -p raiden_debug_spi:target=AP --read backup.bin --chip "W25Q256JV_M"
   * sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     ```
     ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e
     ```

Questions:

1. When I run `sudo flashrom -p raiden_debug_spi ` I'm getting a "Error: Programmer initialization failed" and "Target SPI bridge is disabled (is WP enabled?)".  The mrchromebox guide does talk about disabling write-protection, but it seems to only be possible to do via a tool in ChromeOS (gsctool), or by disconnecting the laptops battery.  Seems very likely write-protection is still on.

2. Looks like I was able to create a backup, but then when I verify it I get: "Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count     from 0x00000000-0x01ffffff: 0x3e"  Why is it not working?

Anyway I think next steps are to disconnect the battery and try these flashrom commands again. I don't want to proceed until the verify step works without error.

@MrChromebox any insights on this? Kano post 2023 device? CCD required to be disabled through https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification ?

Any insight really appreciated. As we discussed prior, TPM2 implementation of cr50 was complete enough; Heads was not using the proper capability, which (hopefully/should...) have been fixed under #2055

[cwiggs]

Sorry i won't be able to help but with theory, I do not own any chromebook; you are guinea pig here :/

No worries, I'm glad to be the guinea big here. Really excited to get heads working on chromebox/book devices.

from https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disabling-software-write-protection

sudo flashrom --wp-status

What is the output?

 ╚═ $ sudo flashrom --wp-status
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)             
flashrom is free software, get the source code at https://flashrom.org

Please select a programmer with the --programmer parameter.
To choose the mainboard of this computer use 'internal'. Valid choices are:
internal, dummy, nic3com, nicrealtek, gfxnvidia, raiden_debug_spi, drkaiser,
satasii, asm106x, atavia, it8212, ft2232_spi, serprog, buspirate_spi, dediprog,
developerbox, rayer_spi, pony_spi, nicintel, nicintel_spi, nicintel_eeprom,
ogp_spi, satamv, linux_mtd, linux_spi, usbblaster_spi, pickit2_spi, ch341a_spi,
ch347_spi, digilent_spi, jlink_spi, stlinkv3_spi, dirtyjtag_spi, spidriver.

 ╔ |1| 17:08:48 | framework | ~/dev/personal/heads  (google_kano)
 ╚═ $ sudo flashrom --wp-status -p raiden_debug_spi
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

FISK: (null)
Raiden target: 0,0
Raiden: Target SPI bridge is disabled (is WP enabled?)
Raiden: Error configuring protocol
    protocol       = 2
    status         = 0x00005
Error: Programmer initialization failed.

Also weird that you cannot verify a backup; that is not good. You shoud not proceed until you have a backup that can be flashed back otherwise you risk bricking. There is no A/B fallback with Heads as opposed to chromebook verified boot counterpart; firmware needs to be correct otherwise you will need to get back to prior firmware until port is complete.

Yeah makes sense. Another option I'll probably try it to follow the mrchromebox guide on flashing coreboot and see if I can do that normally, then at least I can always go back to Mrchromebox's coreboot if flashing heads causes issues.

Reading deeper (I guess your device is >2023), if its the case, you MUST disable CCD following those instructions https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification

Yeah that is my read on it too, which is why I disconnected the battery, which should disable CCD according to that guide but doesn't seem to be working?

Let me know! Might be useful to get direct communication, mrchromebox being online and normally really responsive; since this is first expected first port (and you have other devices) i'm willing to invest time making this work and first class citizen. Community: https://osresearch.net/community/

I'll look into creating a thread on the chultrabook forum too.

Some more context that might help:

• The Kano device I have should be pre 2023, the MFG Date on it is 2022.
• This Kano device I have was bought used with Mrchromebox's coreboot and Linux already installed so I'm not 100% sure how the previous owner flashed the bootloader. I think this influences the "Was write-protection disabled" question.

[cwiggs]

While debugging these issues I did find it recommended to check here to see if the ChromeOS Device supports ccd (which is what the suzyq cable is for) and it looks like the Acer 714 does not support ccd? If that is truly the issue I'll have to order hardware to flash the chip with a normal SPI flasher.

Interestingly the chromium.org page above shows "Acer Chromebook Plus Spin 714 (CP714-1H/CP714-1HN),Acer Chromebook Plus Enterprise Spin 714 (CPE794-1N)]" which is a slightly different model than mine. My model number is CP714-1WN which according to the Mrchromebox link is board name KANO, which also doesn't match the board name on the chromium.org site. I can't find my Chromebook on the chromium.org website though.

I also have 2 other ChromeOS devices already with Mrchromebox's coreboot:

• HP Chromebox G2
• Acer Chromebook Spin 713 (CP713-3W)

So we could potentially try to build and flash heads on those?

[cwiggs]

More findings! I found a post by Mrchromebox here that mentions something is might be needed for KANO! However I tried with minicom like Mrchromebox suggested and get:

cwiggs@framework:~$ sudo minicom -b 115200 -D /dev/ttyUSB0
Failed to set baud rate

[cwiggs]

More findings! I found a post by Mrchromebox here that mentions something is might be needed for KANO! However I tried with minicom like Mrchromebox suggested and get:

cwiggs@framework:~$ sudo minicom -b 115200 -D /dev/ttyUSB0
Failed to set baud rate

I was able to get around this by running sudo stty -F /dev/ttyUSB2 which showed a baud rate of 9600, I then issued: sudo minicom -b 9600 -D /dev/ttyUSB2 and it seems to have worked?

Welcome to minicom 2.11.1

OPTIONS: I18n 
Port /dev/ttyUSB2, 20:55:41 [U]

Press CTRL-A Z for help on special keys

7665 C0: PE_SNK_Startup]
[818.920160 C0: PE_SNK_Discovery]
[818.921676 C0: PE_SNK_Wait_for_Capabilities]
[819.497194 C0: PE_SNK_Hard_Reset]
[819.499716 C0 Hard Reset sent]
[819.501544 C0: PE_SNK_Transition_to_default]
[820.166321 C0: PE_SNK_Startup]
[820.170223 C0: PE_SNK_Discovery]
> apshutdown
[1064.826216 chipset_force_shutdown() 32774]
> gpioset en_S5_rails 1
> [1084.253339 power state 0 = G3, in 0x0040]
i2c 7 recovery! error code is 13, current state is 0
[1084.349970 power state 0 = G3, in 0x0050]
[1084.350542 power state 0 = G3, in 0x0070]

[tlaurion]

@cwiggs I think I fixed GPR0 correctly with 07b1fd5 as per private discussion we had over matrix?

The post build ifd fix for HAP is now doing another call with board options modified. For the moment it seems to be the cleanest implementation for boards for which IFD is provided by coreboot repo and for which no coreboot options are provided to apply directly. Let me know what you think

Now part of build output:

[...]
FMAP REGION: COREBOOT
Name                           Offset     Type           Size   Comp
cbfs_master_header             0x0        cbfs header        32 none
cpu_microcode_blob.bin         0x80       microcode      569344 none
intel_fit                      0x8b0c0    intel_fit          80 none
fallback/romstage              0x8b140    stage          108880 none
fallback/ramstage              0xa5b00    stage          191360 LZMA (452008 decompressed)
config                         0xd4700    raw              5469 LZMA (20529 decompressed)
revision                       0xd5cc0    raw               766 none
build_info                     0xd6000    raw                92 none
bootsplash.jpg                 0xd6080    bootsplash      60890 none
spd.bin                        0xe4ec0    spd              1536 none
fallback/dsdt.aml              0xe5500    raw             22785 none
(empty)                        0xeae40    null              356 none
fspm.bin                       0xeafc0    fsp            786432 none
fsps.bin                       0x1ab000   fsp            304996 LZ4  (389120 decompressed)
vbt.bin                        0x1f57c0   raw              1253 LZMA (8704 decompressed)
fallback/postcar               0x1f5d00   stage           30636 none
fallback/payload               0x1fd500   simple elf    9471008 none
(empty)                        0xb05980   null          4822564 none
bootblock                      0xf9efc0   bootblock       49152 none

Validating final CBFS/IFD configuration...
===================================================================
IFD vs CBFS Size Validation
===================================================================
Using platform-specific parse: adl
IFD BIOS Region: 0x00500000 - 0x01ffffff
IFD BIOS Size:   0x1B00000 (27648 KiB)
CONFIG_CBFS_SIZE: 0x1000000 (16384 KiB)

✓ CONFIG_CBFS_SIZE fits within IFD BIOS region
   Unused IFD capacity: 11264 KiB

CBFS Free Space: 4822920 bytes (4709 KiB)

===================================================================
✓ Validation complete
===================================================================

===================================================================
IFD post-build processing (ifdtool)
===================================================================
  ME HAP (High Assurance Platform) bit -- sets the AltMeDisable strap to
  disable the Management Engine at runtime after hardware init.
    HAP bit: not set -> set
  GPR0 (Global Protected Range 0) -- hardware IFD strap that makes the ME
  region read-only; clearing it allows the ME region to be flashed.
    GPR0 status: Enabled -> Disabled
===================================================================
[...]

[tlaurion]

Also changed forkname to a versioned one in deb2457 since its possible that other chromebooks are added in later on version. Ideally we move all boards depending on a fork at the same time in the future, but that requires board testing and forks tend to now based boards per branches so I took a practical stance here under deb2457

A reality check would be to verify if all your chromebooks are under mrchromebooks 26.03 and let me know, but in all cases having modules/coreboot and forks stating versioning is good practice anyhow.

[cwiggs]

The post build ifd fix for HAP is now doing another call with board options modified. For the moment it seems to be the cleanest implementation for boards for which IFD is provided by coreboot repo and for which no coreboot options are provided to apply directly. Let me know what you think

Sounds good, let me flash the new rom and get back with flashprog output.

A reality check would be to verify if all your chromebooks are under mrchromebooks 26.03 and let me know, but in all cases having modules/coreboot and forks stating versioning is good practice anyhow.

I think my 3 chrome devices are all on Mrchromebox 26.03 but I'd have to boot them up and verify. I thought that we actually decided to not fork off MrChromebox's coreboot fork and just used vanilla? I remember MrChromebox saying that if our fork doesn't relate to UEFI we don't need anything from the MrChromebox fork?

[tlaurion]

I thought that we actually decided to not fork off MrChromebox's coreboot fork and just used vanilla? I remember MrChromebox saying that if our fork doesn't relate to UEFI we don't need anything from the MrChromebox fork?

We could switch I forgot about that. Changing coreboot, board and CirclCI to reflect the change?

[cwiggs]

Flashed heads-kano-202609021132-v0.2.1-3185-gdeb2457.zip and here is the output of flashprog -p internal now:

flashprog unknown on Linux 6.6.30-Heads (x86_64)
flashprog is free software, get the source code at https://flashprog.org

Calibrating delay loop... OK.
coreboot table found at 0x76883000.
Found chipset "Intel Alder Lake-P".
Enabling flash write... OK.
Found Programmer flash chip "Opaque flash chip" (32768 kB, Programmer-specific) on internal.
No operations were specified.

EDIT: Actually that seems to be incomplete for some odd reason. I used tee to send the output of flashprog -p internal to the usb but it looks like it didn't capture everything, let me use stdout and get an update posted here.

Okay I got an update:

flashprog unknown on Linux 6.6.30-Heads (x86_64)
flashprog is free software, get the source code at https://flashprog.org

Calibrating delay loop... OK.
coreboot table found at 0x76883000.
Found chipset "Intel Alder Lake-P".
Enabling flash write... GPR0: Warning: 0x00001000-0x001a6fff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Programmer flash chip "Opaque flash chip" (32768 kB, Programmer-specific) on internal.
No operations were specified.

I had to send stderr to stdout and then redirect both to the usb. That might explain why I thought it looked good here: #2133 (comment)

[tlaurion]

For the sake of clarity.

deb2457 must be flashed externally for ifd to unlock regions?

Otherwise we are right at same point, not understanding why GPR0 is still on months later :(