Add Google kano (Mr Chromebox) support

[cwiggs]

No description provided.

[tlaurion]

first review as I was there and saw work on this PR :)

[tlaurion]

I suggest you tart a thread under Matrix Heads channel. You must rebase the old PR on linuxboot/heads master, an dthen adapt coreboot config to your board. Following https://osresearch.net/Porting/ @cwiggs otherwise your experience might be really frustrating.

[cwiggs]

I suggest you tart a thread under Matrix Heads channel. You must rebase the old PR on linuxboot/heads master, an dthen adapt coreboot config to your board. Following https://osresearch.net/Porting/ @cwiggs otherwise your experience might be really frustrating.

Started a thread here: https://matrix.to/#/!eMLMv62wAMCW1V-ufL_bJ_JDngDhrpSOSEQBLzX8aTg/$eepAush4kVo93Zxqtw59P6NX9g6AG7FZFplc2Fu6tyo?via=matrix.org&via=tchncs.de&via=unredacted.org

[tlaurion]

@cwiggs I saw you left the room?

[cwiggs]

@cwiggs I saw you left the room?

Looks like the Matrix homeserver decided to delete my account for some reason, I'll look into getting it reactivated.

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.

CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.

CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config.
I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano
(There is 19 commits atop origin/master there; not 9 as here)

I can push here too, if needed. Let me know.

[cwiggs]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config. I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano (There is 19 commits atop origin/master there; not 9 as here)

I can push here too, if needed. Let me know.

I just rebased off your branch, let me know if it looks good from that point of view. Looks like I also will need to rebase off main.

As far as flashing goes: I got the Suzy-Q "cable" (It's really just a small board with a male and female usb-c, you then use your own usb-c cable). And I have some good news and some bad news (I think?). I was able to get the suzy-q cable to read the rom, but verifying the backup seems to fail.

I've been using this mrchromebox guide to get the suzy-q device working with flashrom and then this heads wiki as well. Below are some notes I put together while I was attempting the flash:

Use Suzy-Q cable for flashing

1. Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device
   (usually left USB-C port) and the USB-A end to your Linux device
   Verify the cable is properly connected:

   • ls /dev/ttyUSB*
   • This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2.
   • If not, then your cable is connected to the wrong port or is upside down.
     Adjust and repeat command until output is as expected.

2. Set the CCD state to open:

   • echo "ccd open" | sudo tee -a /dev/ttyUSB0 > /dev/null

3. Test Connection and detect chip. raiden_debug_spi used from mrchromebox doc

   • sudo flashrom -p raiden_debug_spi

     ╚═ $ sudo flashrom -p raiden_debug_spi
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: (null)
     Raiden target: 0,0
     Raiden: Target SPI bridge is disabled (is WP enabled?)
     Raiden: Error configuring protocol
         protocol       = 2
         status         = 0x00005
     Error: Programmer initialization failed.
     

   • sudo flashrom -p raiden_debug_spi:target=AP casued a reboot.

      ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     No operations were specified.
     

4. Create backup, and verify.

   • sudo flashrom -p raiden_debug_spi:target=AP -r badflash.rom
   • hexdump -C badflash.rom | head -20

       00000000  11 00 00 9c 90 02 00 d6  00 00 00 05 ff ff ff ff  |................|
       00000010  5a a5 f0 0f 03 00 04 00  08 02 10 46 b0 01 14 00  |Z..........F....|
       00000020  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       00000030  f6 30 30 09 21 42 60 ad  b7 b9 c4 c7 ff ff ff ff  |.00.!B`.........|
       00000040  00 00 00 00 00 05 ff 1f  01 00 ff 04 ff 7f 00 00  |................|
       00000050  ff 7f 00 00 ff 7f 00 00  ff 7f 00 00 ff 7f 00 00  |................|
       *
       00000080  00 07 20 00 00 05 40 00  00 00 00 00 00 00 00 00  |.. ...@.........|
       00000090  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
       000000a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       *
       00000100  00 00 00 00 01 00 00 00  09 00 04 00 00 ce 3d 03  |..............=.|
       00000110  7f 00 38 00 00 00 00 00  10 00 00 00 02 00 20 60  |..8........... `|
       00000120  08 30 03 48 00 00 00 00  01 00 7f 0f 82 0b c0 04  |.0.H............|
       00000130  00 00 00 00 00 00 0e 00  22 42 22 42 22 22 42 22  |........"B"B""B"|
       00000140  00 00 00 00 00 00 00 00  00 00 ff 00 60 00 80 c8  |............`...|
       00000150  45 86 00 36 01 00 a6 81  20 0e 58 00 01 00 40 00  |E..6.... .X...@.|
       00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
       00000170  00 1c 00 00 00 00 00 00  54 b3 04 a0 30 00 00 41  |........T...0..A|
       00000180  8f 03 08 c6 00 01 00 00  00 00 00 00 00 00 00 00  |................|
     

   • sudo flashrom -p raiden_debug_spi:target=AP --verify badflash.rom

       flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
       flashrom is free software, get the source code at https://flashrom.org
     
       FISK: AP
       Raiden target: 2,0
       Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
       Verifying flash... FAILED at 0x01bbeadb! Expected=0x94, Found=0xb4, failed byte count from 0x00000000-0x01ffffff: 0x3f
     

5. Created a backup and verify it using heads wiki guide.

   • sudo flashrom -p raiden_debug_spi:target=AP --read backup.bin --chip "W25Q256JV_M"
   • sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"

     ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e
     

Questions:

1. When I run sudo flashrom -p raiden_debug_spi I'm getting a "Error: Programmer initialization failed" and "Target SPI bridge is disabled (is WP enabled?)". The mrchromebox guide does talk about disabling write-protection, but it seems to only be possible to do via a tool in ChromeOS (gsctool), or by disconnecting the laptops battery. Seems very likely write-protection is still on.
2. Looks like I was able to create a backup, but then when I verify it I get: "Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e" Why is it not working?

Anyway I think next steps are to disconnect the battery and try these flashrom commands again. I don't want to proceed until the verify step works without error.

[cwiggs]

Well I disconnected the battery and am getting the same response from flashrom. Should I just continue with flashing heads?

Here are my notes:

6. Disconnect Battery to disable write-protection.

• Remove The 9 screws.

* Use a smudger to take the back cover off. * Disconnect battery cable.

• Put laptop back together.

7. Disable write-protection. mrchromebox guide

• Plug laptop into power.
• Plug in suzy-q cable.
• echo "wp false" > /dev/ttyUSB0
• echo "wp false atboot" > /dev/ttyUSB0
• echo "ccd reset factory" > /dev/ttyUSB0

8. Tried the same flashrom commands to backup and verify above and got the same result of "Error: Programmer initialization failed" and "Verifying flash... FAILED at 0x0003e1c0! Expected=0x28, Found=0x68, failed byte count from 0x00000000-0x01ffffff: 0xe99" when verifying.

[tlaurion]

Sorry i won't be able to help but with theory, I do not own any chromebook; you are guinea pig here :/

from https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disabling-software-write-protection

sudo flashrom --wp-status

What is the output?

Also weird that you cannot verify a backup; that is not good. You shoud not proceed until you have a backup that can be flashed back otherwise you risk bricking. There is no A/B fallback with Heads as opposed to chromebook verified boot counterpart; firmware needs to be correct otherwise you will need to get back to prior firmware until port is complete.

Reading deeper (I guess your device is >2023), if its the case, you MUST disable CCD following those instructions https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification

Let me know!
Might be useful to get direct communication, mrchromebox being online and normally really responsive; since this is first expected first port (and you have other devices) i'm willing to invest time making this work and first class citizen.
Community: https://osresearch.net/community/

[tlaurion]

@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot

Okay, great, should I rebase this branch off that one then?

Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port.
CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886

https://output.circle-artifacts.com/output/job/6e1574dc-9faa-487d-8bfe-1b108383a89a/artifacts/0/build/x86/kano/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom

Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here.

@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config. I cleaned up the commit trail in my branch at https://github.com/tlaurion/heads/tree/cwiggs-google_kano (There is 19 commits atop origin/master there; not 9 as here)
I can push here too, if needed. Let me know.

I just rebased off your branch, let me know if it looks good from that point of view. Looks like I also will need to rebase off main.

As far as flashing goes: I got the Suzy-Q "cable" (It's really just a small board with a male and female usb-c, you then use your own usb-c cable). And I have some good news and some bad news (I think?). I was able to get the suzy-q cable to read the rom, but verifying the backup seems to fail.

I've been using this mrchromebox guide to get the suzy-q device working with flashrom and then this heads wiki as well. Below are some notes I put together while I was attempting the flash:

Use Suzy-Q cable for flashing

1. Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device
   (usually left USB-C port) and the USB-A end to your Linux device
   Verify the cable is properly connected:
   
   * ls /dev/ttyUSB*
   * This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2.
   * If not, then your cable is connected to the wrong port or is upside down.
     Adjust and repeat command until output is as expected.

2. Set the CCD state to open:
   
   * echo "ccd open" | sudo tee -a /dev/ttyUSB0 > /dev/null

3. Test Connection and detect chip. `raiden_debug_spi` used from mrchromebox [doc](https://docs.mrchromebox.tech/docs/support/unbricking/unbrick-suzyq.html#persisting-the-board-s-vital-product-data-vpd-and-hardware-id-hwid)
   
   * sudo flashrom -p raiden_debug_spi
     ```
     ╚═ $ sudo flashrom -p raiden_debug_spi
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: (null)
     Raiden target: 0,0
     Raiden: Target SPI bridge is disabled (is WP enabled?)
     Raiden: Error configuring protocol
         protocol       = 2
         status         = 0x00005
     Error: Programmer initialization failed.
     ```
   * sudo flashrom -p raiden_debug_spi:target=AP casued a reboot.
     ```
      ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     No operations were specified.
     ```

4. Create backup, and verify.
   
   * sudo flashrom -p raiden_debug_spi:target=AP -r badflash.rom
   * hexdump -C badflash.rom | head -20
     ```
       00000000  11 00 00 9c 90 02 00 d6  00 00 00 05 ff ff ff ff  |................|
       00000010  5a a5 f0 0f 03 00 04 00  08 02 10 46 b0 01 14 00  |Z..........F....|
       00000020  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       00000030  f6 30 30 09 21 42 60 ad  b7 b9 c4 c7 ff ff ff ff  |.00.!B`.........|
       00000040  00 00 00 00 00 05 ff 1f  01 00 ff 04 ff 7f 00 00  |................|
       00000050  ff 7f 00 00 ff 7f 00 00  ff 7f 00 00 ff 7f 00 00  |................|
       *
       00000080  00 07 20 00 00 05 40 00  00 00 00 00 00 00 00 00  |.. ...@.........|
       00000090  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
       000000a0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
       *
       00000100  00 00 00 00 01 00 00 00  09 00 04 00 00 ce 3d 03  |..............=.|
       00000110  7f 00 38 00 00 00 00 00  10 00 00 00 02 00 20 60  |..8........... `|
       00000120  08 30 03 48 00 00 00 00  01 00 7f 0f 82 0b c0 04  |.0.H............|
       00000130  00 00 00 00 00 00 0e 00  22 42 22 42 22 22 42 22  |........"B"B""B"|
       00000140  00 00 00 00 00 00 00 00  00 00 ff 00 60 00 80 c8  |............`...|
       00000150  45 86 00 36 01 00 a6 81  20 0e 58 00 01 00 40 00  |E..6.... .X...@.|
       00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
       00000170  00 1c 00 00 00 00 00 00  54 b3 04 a0 30 00 00 41  |........T...0..A|
       00000180  8f 03 08 c6 00 01 00 00  00 00 00 00 00 00 00 00  |................|
     ```
   * sudo flashrom -p raiden_debug_spi:target=AP --verify badflash.rom
     ```
       flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
       flashrom is free software, get the source code at https://flashrom.org
     
       FISK: AP
       Raiden target: 2,0
       Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
       Verifying flash... FAILED at 0x01bbeadb! Expected=0x94, Found=0xb4, failed byte count from 0x00000000-0x01ffffff: 0x3f
     ```

5. Created a backup and verify it using heads wiki guide.
   
   * sudo flashrom -p raiden_debug_spi:target=AP --read backup.bin --chip "W25Q256JV_M"
   * sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     ```
     ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP --verify backup.bin --chip "W25Q256JV_M"
     flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
     flashrom is free software, get the source code at https://flashrom.org
     
     FISK: AP
     Raiden target: 2,0
     Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
     Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count from 0x00000000-0x01ffffff: 0x3e
     ```

Questions:

1. When I run `sudo flashrom -p raiden_debug_spi ` I'm getting a "Error: Programmer initialization failed" and "Target SPI bridge is disabled (is WP enabled?)".  The mrchromebox guide does talk about disabling write-protection, but it seems to only be possible to do via a tool in ChromeOS (gsctool), or by disconnecting the laptops battery.  Seems very likely write-protection is still on.

2. Looks like I was able to create a backup, but then when I verify it I get: "Verifying flash... FAILED at 0x01bc9254! Expected=0xb7, Found=0xb8, failed byte count     from 0x00000000-0x01ffffff: 0x3e"  Why is it not working?

Anyway I think next steps are to disconnect the battery and try these flashrom commands again. I don't want to proceed until the verify step works without error.

@MrChromebox any insights on this? Kano post 2023 device? CCD required to be disabled through https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification ?

Any insight really appreciated. As we discussed prior, TPM2 implementation of cr50 was complete enough; Heads was not using the proper capability, which (hopefully/should...) have been fixed under #2055

[cwiggs]

Sorry i won't be able to help but with theory, I do not own any chromebook; you are guinea pig here :/

No worries, I'm glad to be the guinea big here. Really excited to get heads working on chromebox/book devices.

from https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disabling-software-write-protection

sudo flashrom --wp-status

What is the output?

 ╚═ $ sudo flashrom --wp-status
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)             
flashrom is free software, get the source code at https://flashrom.org

Please select a programmer with the --programmer parameter.
To choose the mainboard of this computer use 'internal'. Valid choices are:
internal, dummy, nic3com, nicrealtek, gfxnvidia, raiden_debug_spi, drkaiser,
satasii, asm106x, atavia, it8212, ft2232_spi, serprog, buspirate_spi, dediprog,
developerbox, rayer_spi, pony_spi, nicintel, nicintel_spi, nicintel_eeprom,
ogp_spi, satamv, linux_mtd, linux_spi, usbblaster_spi, pickit2_spi, ch341a_spi,
ch347_spi, digilent_spi, jlink_spi, stlinkv3_spi, dirtyjtag_spi, spidriver.

 ╔ |1| 17:08:48 | framework | ~/dev/personal/heads  (google_kano)
 ╚═ $ sudo flashrom --wp-status -p raiden_debug_spi
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

FISK: (null)
Raiden target: 0,0
Raiden: Target SPI bridge is disabled (is WP enabled?)
Raiden: Error configuring protocol
    protocol       = 2
    status         = 0x00005
Error: Programmer initialization failed.

Also weird that you cannot verify a backup; that is not good. You shoud not proceed until you have a backup that can be flashed back otherwise you risk bricking. There is no A/B fallback with Heads as opposed to chromebook verified boot counterpart; firmware needs to be correct otherwise you will need to get back to prior firmware until port is complete.

Yeah makes sense. Another option I'll probably try it to follow the mrchromebox guide on flashing coreboot and see if I can do that normally, then at least I can always go back to Mrchromebox's coreboot if flashing heads causes issues.

Reading deeper (I guess your device is >2023), if its the case, you MUST disable CCD following those instructions https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification

Yeah that is my read on it too, which is why I disconnected the battery, which should disable CCD according to that guide but doesn't seem to be working?

Let me know! Might be useful to get direct communication, mrchromebox being online and normally really responsive; since this is first expected first port (and you have other devices) i'm willing to invest time making this work and first class citizen. Community: https://osresearch.net/community/

I'll look into creating a thread on the chultrabook forum too.

Some more context that might help:

• The Kano device I have should be pre 2023, the MFG Date on it is 2022.
• This Kano device I have was bought used with Mrchromebox's coreboot and Linux already installed so I'm not 100% sure how the previous owner flashed the bootloader. I think this influences the "Was write-protection disabled" question.

[cwiggs]

While debugging these issues I did find it recommended to check here to see if the ChromeOS Device supports ccd (which is what the suzyq cable is for) and it looks like the Acer 714 does not support ccd? If that is truly the issue I'll have to order hardware to flash the chip with a normal SPI flasher.

Interestingly the chromium.org page above shows "Acer Chromebook Plus Spin 714 (CP714-1H/CP714-1HN),Acer Chromebook Plus Enterprise Spin 714 (CPE794-1N)]" which is a slightly different model than mine. My model number is CP714-1WN which according to the Mrchromebox link is board name KANO, which also doesn't match the board name on the chromium.org site. I can't find my Chromebook on the chromium.org website though.

I also have 2 other ChromeOS devices already with Mrchromebox's coreboot:

• HP Chromebox G2
• Acer Chromebook Spin 713 (CP713-3W)

So we could potentially try to build and flash heads on those?

[cwiggs]

More findings! I found a post by Mrchromebox here that mentions something is might be needed for KANO! However I tried with minicom like Mrchromebox suggested and get:

cwiggs@framework:~$ sudo minicom -b 115200 -D /dev/ttyUSB0
Failed to set baud rate

[cwiggs]

More findings! I found a post by Mrchromebox here that mentions something is might be needed for KANO! However I tried with minicom like Mrchromebox suggested and get:

cwiggs@framework:~$ sudo minicom -b 115200 -D /dev/ttyUSB0
Failed to set baud rate

I was able to get around this by running sudo stty -F /dev/ttyUSB2 which showed a baud rate of 9600, I then issued: sudo minicom -b 9600 -D /dev/ttyUSB2 and it seems to have worked?

Welcome to minicom 2.11.1

OPTIONS: I18n 
Port /dev/ttyUSB2, 20:55:41 [U]

Press CTRL-A Z for help on special keys

7665 C0: PE_SNK_Startup]
[818.920160 C0: PE_SNK_Discovery]
[818.921676 C0: PE_SNK_Wait_for_Capabilities]
[819.497194 C0: PE_SNK_Hard_Reset]
[819.499716 C0 Hard Reset sent]
[819.501544 C0: PE_SNK_Transition_to_default]
[820.166321 C0: PE_SNK_Startup]
[820.170223 C0: PE_SNK_Discovery]
> apshutdown
[1064.826216 chipset_force_shutdown() 32774]
> gpioset en_S5_rails 1
> [1084.253339 power state 0 = G3, in 0x0040]
i2c 7 recovery! error code is 13, current state is 0
[1084.349970 power state 0 = G3, in 0x0050]
[1084.350542 power state 0 = G3, in 0x0070]

[cwiggs]

More progress!

Seems this new flashrom command with the custom_rst=True that MrChromebox suggested in the link in my previous comment is able to read the chip without issues.

 ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP,custom_rst=True
Please enter the PIN: 
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

FISK: AP
Raiden target: 10,0
Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
No operations were specified.

Backing up with sudo flashrom -p raiden_debug_spi:target=AP,custom_rst=True --read backup_3.bin --chip "W25Q256JV_M", no issues.

And then verifying with no issues!:

 ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP,custom_rst=True --verify backup_3.bin --chip "W25Q256JV_M"
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

FISK: AP
Raiden target: 10,0
Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
Verifying flash... VERIFIED.

Flashing rom from circleci: https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886 now

[cwiggs]

No errors while flashing the heads rom:

 ╚═ $ sudo flashrom -p raiden_debug_spi:target=AP,custom_rst=True --chip "W25Q256JV_M" --write /home/cwiggs/Downloads/heads-kano-20260626-131058-cwiggs-google_kano_-v0.2.1-3072-gb54796f.rom
flashrom v1.6.0 on Linux 7.0.10+deb14-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

FISK: AP
Raiden target: 10,0
Found Winbond flash chip "W25Q256JV_M" (32768 kB, SPI) on raiden_debug_spi.
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 0 to 1ffffff
Verifying flash... VERIFIED.

However when I turn on the device the power LED just blinks now and nothing else happens.

EDIT: The laptop finally booted to heads and dropped me into a recovery shell!

[cwiggs]

Here is the debug.log
debug.log

[cwiggs]

I think I see the issue:

boards/kano/kano.config:export CONFIG_BOOTSCRIPT=/bin/gui-init should be the value should be /bin/gui-init

[cwiggs]

Most recent build worked without issue.

Will probably need some help with the following as I don't understand some of them

• Successful external flash link to circleci: https://output.circle-artifacts.com/output/job/7476705a-09e1-43a4-a67d-37eff2dfb791/artifacts/0/build/x86/kano/heads-kano-202607052203-v0.2.1-3106-gb2ca4f0.rom. from commit 03a407414680fecce34dd67466964ae841e4afda using external programmer model suzyq
• Boots successfully after the flashing:
• Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected
• Clean boot detected (no keyring, nothing installed on disk): usb boot proposed and followed
• Boots on usb
• OS Debian 13 install and reboot
• Heads functionality- no pubkey detected, but OS detected -> OEM-Factory-reset proposed. Done with X.Y.Z. hardwarekey e.g. nk3
• On reboot after re-ownership: generate new HOTP/TOTP
• wifi works based on OS Debian 13
• PR0
  • flashprog -p internal (not locked)
  • lock_chip (locks the platform with PR0, if PR0 patch applied in fork or under patches/coreboot-X.Y.Z. and coreboot config contain proper preparation of the platform)
  • flashprog -p internal (reports locked)