Acer Chromebook Spin 714 (KANO)

Table of contents

1. Acer Chromebook Spin 714 (KANO)
   1. ✅ Active: CPU generation still receiving microcode updates (12th Gen Alder Lake)
   2. ✅ PROTECTED: TPM GPIO Reset
   3. ⚡ Safety First
      1. Disable Software Write Protection
   4. Extra step
   5. Backup
   6. Flashing

✅ Active: CPU generation still receiving microcode updates (12th Gen Alder Lake)

Still receiving microcode updates. See BOARDS_AND_TESTERS.md, Heads threat model.

✅ PROTECTED: TPM GPIO Reset

GPIO PLTRST# assertion does not apply to the TPM on this platform. Not vulnerable. See Per-Board Protection Status, TPM GPIO Reset Vulnerability.

⚡ Safety First

Before starting, please read our SPI Programmer Best Practices guide for essential safety information and programmer recommendations.

Disable Software Write Protection

A good guide on how to do this is here

We will be using the SuzyQ device to disable Software write protection. If you don’t already have that plugged in follow the steps above to get the SuzyQ cable plugged in correctly.

1. Check if write protection is enabled:

   flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
     --chip "W25Q256JV_M" \
     --wp-status
   

2. Disable software write protection:

   flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
     --chip "W25Q256JV_M" \
     --wp-disable
   

3. Changes software write protection addresses range:

   flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
     --chip "W25Q256JV_M" \
     --wp-range 0,0
   

   (--wp-range 0 0 on older devices)

Extra step

KANO requires an extra step before we flash with flashrom:

# Get the baud rate
sudo stty -F /dev/ttyUSB2
speed 9600 baud; line = 0;

sudo minicom -D /dev/ttyUSB2 -b 9600

run: apshutdown
wait 5s
run: gpioset en_S5_rails 1

source

Backup

Before you flash Heads you should take a backup of the bootloader.

# 1. Read the full chip backup
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --read kano_backup.rom

# 2. Inspect the dump (sanity check)
hexdump -C backup1.bin | head -20

# 3. Verify the backup reads back correctly
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --verify kano_backup.rom

# 4. Read a second backup to a different file (paranoia is good)
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --read kano_backup2.rom

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --verify kano_backup2.rom

More info in the SPI Programmer Best Practices

Flashing

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --write heads-kano-202607081551-v0.2.1-3112-gb9dfd39.rom