Acer Chromebook Spin 714 (KANO)

Table of contents

Acer Chromebook Spin 714 (KANO)

✅ Active: CPU generation still receiving microcode updates (12th Gen Alder Lake)

Still receiving microcode updates. See BOARDS_AND_TESTERS.md, Heads threat model.

✅ PROTECTED: TPM GPIO Reset

GPIO PLTRST# assertion does not apply to the TPM on this platform. Not vulnerable. See Per-Board Protection Status, TPM GPIO Reset Vulnerability.

⚡ Safety First

Before starting, please read our SPI Programmer Best Practices guide for essential safety information and programmer recommendations.

Disassembly

Full disassembly instructions, SPI chip details, programmer recommendations, and step-by-step flashing procedures for the Suzy-Q CCD cable:

CCD with Suzyq cable

With Chromebooks there is an option called “Closed Case Debugging”. A special usb cable called a SuzyQ cable is required. A good guide on using the SuzyQ cable is MrChromebox.

Here are 2 places where you can find info on purchasing a SuzyQ board:

Enabling Closed Case Debugging (CCD)

You will be using gsctool in the ChromeOS Developer mode console.

Power on the device to the login screen (booted into Developer Mode).
Open VT-2 terminal: press [CTRL+ALT+F2] (F2 is the right arrow).
Login as root
Open the CCD: run gsctool -a -o
You will be prompted to press the PP (physical presence) button several times. On almost all devices, this means to press the power button. Opening the CCD requires you to press the PP button several times over a 2-3 minute period.
When the open CCD process is complete, you will see a message showing PP Done! and the device will reboot in Normal/Verified Boot Mode.
Re-enable developer mode and continue with the instructions below.

MrChromebox source

Disable Hardware Write Protection

For this section we will be using a laptop running linux (host) and the Kano device (source).

Connect the USB-C end of the Suzy-Q cable to the CCD port on your ChromeOS device (usually left USB-C port) and the USB-A end to your Linux device Verify the cable is properly connected:
```
$ ls /dev/ttyUSB*
/dev/ttyUSB0  /dev/ttyUSB1  /dev/ttyUSB2
```
This command should return 3 items: ttyUSB0, ttyUSB1, and ttyUSB2. If not, then your cable is connected to the wrong port or is upside down. Adjust and repeat command until output is as expected.

Run the following commands to disable hardware write protection:

echo "wp false" > /dev/ttyUSB0
echo "wp false atboot" > /dev/ttyUSB0
echo "ccd reset factory" > /dev/ttyUSB0

Power on the Kano device to the login screen (booted into Developer Mode).
Open VT-2 terminal: press [CTRL+ALT+F2] (F2 is the right arrow).
Login as root
Run gsctool -a -I to verify the CCD is opened, and that the factory values are set. The current value for all CCD flags should be set to Y/Always.
Run crossystem wpsw_cur and verify it returns 0.
Reboot.

MrChromebox source

Disable Software Write Protection

A good guide on how to do this is here

We will be using the SuzyQ device to disable Software write protection. If you don’t already have that plugged in follow the steps above to get the SuzyQ cable plugged in correctly.

Check if write protection is enabled:

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --wp-status

Disable software write protection:

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --wp-disable

Changes software write protection addresses range:

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --wp-range 0,0

(--wp-range 0 0 on older devices)

Extra step

KANO requires an extra step before we flash with flashrom:

# Get the baud rate
sudo stty -F /dev/ttyUSB2
speed 9600 baud; line = 0;

sudo minicom -D /dev/ttyUSB2 -b 9600

run: apshutdown
wait 5s
run: gpioset en_S5_rails 1

source

Backup

Before you flash Heads you should take a backup of the bootloader.

# 1. Read the full chip backup
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --read kano_backup.rom

# 2. Inspect the dump (sanity check)
hexdump -C backup1.bin | head -20

# 3. Verify the backup reads back correctly
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --verify kano_backup.rom

# 4. Read a second backup to a different file (paranoia is good)
flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --read kano_backup2.rom

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --verify kano_backup2.rom

More info in the SPI Programmer Best Practices

Flashing

flashrom --programmer raiden_debug_spi:target=AP,custom_rst=True \
  --chip "W25Q256JV_M" \
  --write heads-kano-202607081551-v0.2.1-3112-gb9dfd39.rom