Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 77 additions & 0 deletions Installing-and-Configuring/Flashing-Guides/google-kano.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
---
layout: default
title: Acer Chromebook Spin 714 (KANO)
permalink: /heads-flashing/
nav_order: 1
parent: Step 2 - Flashing Guides
grand_parent: Installing and configuring
---

Acer Chromebook Spin 714 (KANO)
===


## CCD with Suzyq cable
With Chromebooks there is an option called "Closed Case Debugging". A special usb cable called a SuzyQ cable
is required. A good guide on using the SuzyQ cable is
[MrChromebox](https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html).


### Disable Hardware Write Protection
The first thing you need to do is remove the battery of the laptop to disable hardware
write protection (but then we disable hardware write protection with the echo commands to /dev/ttyUSB0?)

TODO: insert images from https://github.com/linuxboot/heads/pull/2133

Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device
(usually left USB-C port) and the USB-A end to your Linux device
Verify the cable is properly connected:

```
$ ls /dev/ttyUSB*
/dev/ttyUSB0 /dev/ttyUSB1 /dev/ttyUSB2
```

This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2.
If not, then your cable is connected to the wrong port or is upside down.
Adjust and repeat command until output is as expected.

TODO: Do we need to run `gsctool` from ChromeOS? I did not have to but maybe the previous owner of my Kano
device did it? [source](https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#step-1-enabling-closed-case-debugging-ccd)

Now we disable software write protection:

@tlaurion tlaurion Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MrChromebox this is weird and we don't understand.

Even if IFD has all regions disabled per linuxboot/heads#2133 's linuxboot/heads@aece972

Found Master Section
FLMSTR1:   0xffffffff (Host CPU/BIOS)
  EC Region Write Access:            enabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
FLMSTR2:   0xffffffff (Intel ME)
  EC Region Write Access:            enabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
FLMSTR3:   0xffffffff (GbE)
  EC Region Write Access:            enabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
FLMSTR5:   0xffffffff (EC)
  EC Region Write Access:            enabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled

Heads flashprog -p internal still reports:



flashprog unknown on Linux 6.6.30-Heads (x86_64)
flashprog is free software, get the source code at https://flashprog.org

Calibrating delay loop... OK.
coreboot table found at 0x76883000.
Found chipset "Intel Alder Lake-P".
Enabling flash write... GPR0: Warning: 0x00001000-0x001a6fff is read-only.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
OK.
Found Programmer flash chip "Opaque flash chip" (32768 kB, Programmer-specific) on internal.
No operations were specified.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also Heads recovery shell cbmem --console | grep '[DEBUG] ME' returns:

[DEBUG]  ME: HFSTS1                      : 0x90000055
[DEBUG]  ME: HFSTS2                      : 0x82130116
[DEBUG]  ME: HFSTS3                      : 0x00000050
[DEBUG]  ME: HFSTS4                      : 0x00004000
[DEBUG]  ME: HFSTS5                      : 0x00000000
[DEBUG]  ME: HFSTS6                      : 0x40600006
[DEBUG]  ME: Manufacturing Mode          : YES
[DEBUG]  ME: SPI Protection Mode Enabled : NO
[DEBUG]  ME: FW Partition Table          : OK
[DEBUG]  ME: Bringup Loader Failure      : NO
[DEBUG]  ME: Firmware Init Complete      : NO
[DEBUG]  ME: Boot Options Present        : NO
[DEBUG]  ME: Update In Progress          : NO
[DEBUG]  ME: D0i3 Support                : YES
[DEBUG]  ME: Low Power State Enabled     : NO
[DEBUG]  ME: CPU Replaced                : YES
[DEBUG]  ME: CPU Replacement Valid       : YES
[DEBUG]  ME: Current Working State       : 5
[DEBUG]  ME: Current Operation State     : 1
[DEBUG]  ME: Current Operation Mode      : 0
[DEBUG]  ME: Error Code                  : 0
[DEBUG]  ME: FPFs Committed              : YES
[DEBUG]  ME: Enhanced Debug Mode         : NO
[DEBUG]  ME: CPU Debug Disabled          : YES
[DEBUG]  ME: TXT Support                 : NO
[DEBUG]  ME: Manufacturing Vars Locked   : YES
[DEBUG]  ME: WP for RO is enabled        : YES
[DEBUG]  ME: RO write protection scope - Start=0x1000, End=0x1A6FFF

So ME region still protected.

[DEBUG] ME: WP for RO is enabled : YES
[DEBUG] ME: RO write protection scope - Start=0x1000, End=0x1A6FFF


```
sudo -s
echo "wp false" > /dev/ttyUSB0
echo "wp false atboot" > /dev/ttyUSB0
echo "ccd reset factory" > /dev/ttyUSB0
```

## Extra step (What is this really doing?)
KANO requires an extra step before we flash with flashrom:

```
# Get the baud rate
$ sudo stty -F /dev/ttyUSB2
speed 9600 baud; line = 0;

sudo minicom -D /dev/ttyUSB2

run: apshutdown
wait 5s
run: gpioset en_S5_rails 1
```

[source](https://forum.chrultrabook.com/t/flashrom-error-when-trying-to-unbrick-with-suzyq/8789/2?u=stonework5729)

## Backup
TODO: add section about backing up rom first.

## Flash heads

```
sudo flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
--chip "W25Q256JV_M" \
--write heads-kano-202607081551-v0.2.1-3112-gb9dfd39.rom
```