Add Google kano (MrChromebox 26.03 coreboot fork) support - First full Chromebook port! - #2133
Add Google kano (MrChromebox 26.03 coreboot fork) support - First full Chromebook port!#2133cwiggs wants to merge 47 commits into
Conversation
tlaurion
left a comment
There was a problem hiding this comment.
first review as I was there and saw work on this PR :)
|
I suggest you tart a thread under Matrix Heads channel. You must rebase the old PR on linuxboot/heads master, an dthen adapt coreboot config to your board. Following https://osresearch.net/Porting/ @cwiggs otherwise your experience might be really frustrating. |
Started a thread here: https://matrix.to/#/!eMLMv62wAMCW1V-ufL_bJ_JDngDhrpSOSEQBLzX8aTg/$eepAush4kVo93Zxqtw59P6NX9g6AG7FZFplc2Fu6tyo?via=matrix.org&via=tchncs.de&via=unredacted.org |
|
@cwiggs I saw you left the room? |
Looks like the Matrix homeserver decided to delete my account for some reason, I'll look into getting it reactivated. |
|
@cwiggs check https://github.com/tlaurion/heads/tree/cwiggs-google_kano which now builds locally with blobs paths corrected and blobs submodules synced per mrchromebox gitsubmodules sync override in modules/coreboot |
Okay, great, should I rebase this branch off that one then? |
Absolutely. It builds from CI. I pushed progress forward since the last base (coreboot 4.22) was old and not trivial to adapt. Let me know how the testing goes. Feel free to cherry pick all commits or if you agree i can push the changes here but that would make us both co-authors of the port. CircleCI builds at https://app.circleci.com/pipelines/github/tlaurion/heads/4040/workflows/d7699b2f-feca-423f-b0f5-187ebf94e886 |
|
Thanks! I got it downloaded. The suzyq cable should arrive this weekend or Monday and I'll give it a try. I also rebased off your branch here. |
@cwiggs : This branch doesn't include all the needed changes, nor CircleCI config. I can push here too, if needed. Let me know. |
I just rebased off your branch, let me know if it looks good from that point of view. Looks like I also will need to rebase off main. As far as flashing goes: I got the Suzy-Q "cable" (It's really just a small board with a male and female usb-c, you then use your own usb-c cable). And I have some good news and some bad news (I think?). I was able to get the suzy-q cable to read the rom, but verifying the backup seems to fail. I've been using this mrchromebox guide to get the suzy-q device working with flashrom and then this heads wiki as well. Below are some notes I put together while I was attempting the flash: Use Suzy-Q cable for flashing
Questions:
Anyway I think next steps are to disconnect the battery and try these flashrom commands again. I don't want to proceed until the verify step works without error. |
|
Well I disconnected the battery and am getting the same response from flashrom. Should I just continue with flashing heads? Here are my notes:
* Use a smudger to take the back cover off.
* Disconnect battery cable.
|
ea307b4 to
4d2c1e5
Compare
|
Sorry i won't be able to help but with theory, I do not own any chromebook; you are guinea pig here :/ from https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disabling-software-write-protection
What is the output? Also weird that you cannot verify a backup; that is not good. You shoud not proceed until you have a backup that can be flashed back otherwise you risk bricking. There is no A/B fallback with Heads as opposed to chromebook verified boot counterpart; firmware needs to be correct otherwise you will need to get back to prior firmware until port is complete. Reading deeper (I guess your device is >2023), if its the case, you MUST disable CCD following those instructions https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification Let me know! |
@MrChromebox any insights on this? Kano post 2023 device? CCD required to be disabled through https://docs.mrchromebox.tech/docs/firmware/wp/disabling.html#disable-ap-ro-firmware-verification ? Any insight really appreciated. As we discussed prior, TPM2 implementation of cr50 was complete enough; Heads was not using the proper capability, which (hopefully/should...) have been fixed under #2055 |
No worries, I'm glad to be the guinea big here. Really excited to get heads working on chromebox/book devices.
Yeah makes sense. Another option I'll probably try it to follow the mrchromebox guide on flashing coreboot and see if I can do that normally, then at least I can always go back to Mrchromebox's coreboot if flashing heads causes issues.
Yeah that is my read on it too, which is why I disconnected the battery, which should disable CCD according to that guide but doesn't seem to be working?
I'll look into creating a thread on the chultrabook forum too. Some more context that might help:
|
|
While debugging these issues I did find it recommended to check here to see if the ChromeOS Device supports ccd (which is what the suzyq cable is for) and it looks like the Acer 714 does not support ccd? If that is truly the issue I'll have to order hardware to flash the chip with a normal SPI flasher. Interestingly the chromium.org page above shows "Acer Chromebook Plus Spin 714 (CP714-1H/CP714-1HN),Acer Chromebook Plus Enterprise Spin 714 (CPE794-1N)]" which is a slightly different model than mine. My model number is I also have 2 other ChromeOS devices already with Mrchromebox's coreboot:
So we could potentially try to build and flash heads on those? |
|
More findings! I found a post by Mrchromebox here that mentions something is might be needed for KANO! However I tried with minicom like Mrchromebox suggested and get: |
I was able to get around this by running |
Use upstream coreboot 26.03 (git tag 26.03, commit e5c99fe) instead of the
MrChromebox fork for kano, since heads does not use EFI. The kano brya
variant is present upstream at this tag.
- modules/coreboot: replace coreboot-mrchromebox-26.03 fork pin with
coreboot-26.03 upstream git module (repo coreboot/coreboot) and add the
new coreboot-26.03 seed for the shared toolchain.
- boards/kano/kano.config: CONFIG_COREBOOT_VERSION=mrchromebox-26.03 -> 26.03.
The APPLY_HAP/GPR0_DISABLE ifdtool post-build handling is heads-side and
unchanged (upstream has HAP Kconfigs but heads applies via ifdtool).
- git mv patches/coreboot-mrchromebox-26.03 -> patches/coreboot-26.03.
Both heads-maintained patches are still required on upstream 26.03
(verified unmerged upstream and cleanly applying):
- 0001 util/cbmem: add endian.h include for musl compat
- 0002 soc/intel/lockdown: SPI/LPC SMM lockdown for PR0. Rebased for the
upstream HECI1 disable rename (soc_disable_heci1_at_pre_boot() ->
CONFIG(DISABLE_HECI1_AT_PRE_BOOT)) that drifted cannonlake/tigerlake
hunks vs the fork base; metadata note updated accordingly.
- .circleci/config.yml + doc/circleci.md: rename kano seed/job to
coreboot-26.03.
Verification: upstream 26.03 clone -> both patches git-apply cleanly, and
config/coreboot-kano.config olddefconfig passes (exit 0; only benign
FMAP_SIZE / EC_CHROMEEC_USE_VENDOR_TABLET_CONTROLS unknown-symbol warnings,
both dropped by olddefconfig).
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Regenerate coreboot-kano.config against upstream coreboot 26.03 via 'save_in_oldconfig_format_in_place' (olddefconfig) and the .config_defconfig backup via 'save_in_defconfig_format_backup', capturing what the upstream 26.03 switch rewrites. Config deltas vs the MrChromebox fork (fork-only symbols dropped upstream): - FMAP_SIZE, EDK2_BOOT_MANAGER_ESCAPE, EDK2_FOLLOW_BGRT_SPEC, EDK2_DISABLE_TPM, CSE_RESET_CLEAR_EC_AP_IDLE_FLAG, EC_CHROMEEC_USE_VENDOR_TABLET_CONTROLS, CR50_RESET_CLEAR_EC_AP_IDLE_FLAG dropped (no upstream equivalent) - CONFIG_SYSTEM_TYPE_CONVERTIBLE -> CONFIG_SYSTEM_TYPE_LAPTOP (upstream renamed the symbol; kano loses the convertible/tablet distinction) - FSP_M/FSP_S_FILE + FSP_HEADER_PATH re-homed under their sections; savedefconfig makes PCIEXP_HOTPLUG_/DRIVERS_HWID_DMI/VPD/SMBIOS_SERIAL and NO_POST/CONSOLE_SERIAL explicit CONCLUSION (build blocker): 'make BOARD=kano' fails at 'No rule to make target 3rdparty/blobs/mainboard/google/brya/brya/kano/ flashdescriptor.bin'. Upstream 26.03's 3rdparty/blobs submodule (pinned 4a8de03) contains ZERO brya blobs (only butterfly, guybrush, kahlee, link, parrot, skyrim, stout, zork). The kano IFD (flashdescriptor.bin), ME (me.bin), microcode, vbt, and ec blobs are proprietary Google/Intel blobs that exist ONLY in the MrChromebox fork's 3rdparty/blobs submodule (MrChromebox/blobs mainboard/google/brya/brya/kano). Upstream 26.03 cannot build kano unless those blobs are sourced into the heads build; this commit records the attempt and the blocker, not a working upstream build. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Abandon the upstream coreboot 26.03 attempt (see 5494064 / 4be877d which record the attempt and the blocker). Restore the build to the MrChromebox fork (coreboot 26.03 based), which is the only coreboot source that carries the kano proprietary blobs (IFD flashdescriptor.bin, me.bin, microcode, vbt, ec) in its 3rdparty/blobs submodule — upstream 26.03 lacks them entirely, so kano cannot build from upstream. Restored to pre-migration fork state (forward commit, history preserved): - modules/coreboot: coreboot-mrchromebox-26.03 module back (MrChromebox/coreboot, f8244f25) - boards/kano/kano.config: CONFIG_COREBOOT_VERSION=mrchromebox-26.03 - patches: git mv coreboot-26.03 -> coreboot-mrchromebox-26.03; 0002 restored to its original fork-flavored content (the migration had rebased it for the upstream HECI1 rename); 0001 unchanged - .circleci/config.yml + doc/circleci.md: kano seed/job back to coreboot-mrchromebox-26.03 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…ore TPM GPIO caveats Regenerate the kano coreboot config against the MrChromebox fork (coreboot 26.03 based) using the coreboot make helpers: ./docker_repro.sh make BOARD=kano coreboot.save_in_oldconfig_format_in_place ./docker_repro.sh make BOARD=kano coreboot.save_in_defconfig_format_backup These rederive config/coreboot-kano.config and config/coreboot-kano.config_defconfig from the fork, undoing the upstream-26.03 normalization from 4be877d: - SYSTEM_TYPE_LAPTOP back to SYSTEM_TYPE_CONVERTIBLE (kano is a 2-in-1) - fork-only symbols re-added: FMAP_SIZE, EDK2_BOOT_MANAGER_ESCAPE, EDK2_FOLLOW_BGRT_SPEC, EDK2_DISABLE_TPM, CSE_RESET_CLEAR_EC_AP_IDLE_FLAG, CR50_RESET_CLEAR_EC_AP_IDLE_FLAG, EC_CHROMEEC_USE_VENDOR_TABLET_CONTROLS - VPD/SMBIOS_SERIAL_FROM_VPD/DRIVERS_HWID_DMI/INTEL_GMA_HAVE_VBT/ PCIEXP_HOTPLUG_IO back in their original fork positions Result: both config files are byte-identical to the pre-attempt fork state (deb2457). Also restore the TPM GPIO NOT_VULNERABLE caveats in boards/kano/kano.config, which the switch-back (ec5fa14) had accidentally dropped by restoring the file from deb2457 (older than the TPM GPIO commit c2dd57b). Restored from c2dd57b so the board config again carries: CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- Google CR50 on I2C. patches/, .circleci/, and doc/circleci.md remain on the MrChromebox fork naming (coreboot-mrchromebox-26.03) as restored in ec5fa14. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…ixups) Advance the tpm-gpio-fail pin from 8a9fc3a to 3e3a695 (tlaurion/tpm-gpio-fail), taking three upstream commits: - TPM GPIO reset PoC for Heads: extended platform support - Add Alder Lake-N, Elkhart Lake, Gemini Lake, Jasper Lake platform support - reset/inteltool.c: remove unnecessary print line at the end of execution (cleanup fixup) Delivered to boards enabling CONFIG_TPM2_TOOLS via the modules-$(CONFIG_TPM2_TOOLS) conditional (tpm-gpio-detect / tpm-gpio-assert). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
426f650 to
d242134
Compare
The pinned revision (3e3a695) carries commits by Kondix10 / Konrad Dadasiewicz (tlaurion/tpm-gpio-fail): Alder Lake-N, Elkhart Lake, Gemini Lake, Jasper Lake platform support and the inteltool print-line cleanup fixup. Document the full attribution chain in the module header: - kukrimate/tpm-gpio-fail (Mate Kukri): original PoC - tlaurion/tpm-gpio-fail (Thierry Laurion): Heads-leaning fork + extended platform support, the repo Heads pins - Kondix10/tpm-gpio-fail (Konrad Dadasiewicz): additional platform families and build/output fixups bundled into the pinned revision Signed-off-by: Thierry Laurion <insurgo@riseup.net>
kano (MrChromebox coreboot fork, Alder Lake) meets all PR0 chipset-locking requirements: BOOTMEDIA_LOCK_CONTROLLER=y, BOOTMEDIA_LOCK_WHOLE_RO=y, INTEL_CHIPSET_LOCKDOWN disabled, SOC_INTEL_COMMON_SPI_LOCKDOWN_SMM=y, and SPI_FLASH_SMM=y (verified in config/coreboot-kano.config). Add it to the Skylake+ SMM-lockdown board list (10 -> 11, total 29 -> 30). Also document the fork's lockdown patch location for kano: patches/coreboot-mrchromebox-26.03/0002-soc-intel-lockdown-of-CB-85278 (same CB:85278 patch as coreboot-25.09/0003, rebased for the fork). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
f9f371a to
4bf43c8
Compare
Add a HOTP remote-attestation variant of the Acer Chromebook Spin 714 (KANO) board, following the qemu-coreboot-fbwhiptail-tpm2[-hotp] unified pattern: boards/kano-hotp/kano-hotp.config is identical to the base boards/kano/kano.config except CONFIG_HOTPKEY=y and CONFIG_BOARD_NAME="Google Kano HOTP". Both boards share the same config/coreboot-kano.config and config/linux-kano.config pointers. CI: kano-hotp builds seeded by the kano coreboot-mrchromebox-26.03 seed. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
d0ecff3 to
cec089e
Compare
…king Extend .gitignore to cover editor and tooling scratch/backup files so they cannot silently get committed again (a prior commit tracked tpmr.sh.bck, tpm-patch2, tpm.md-patch and tpm2_* scratch fixtures under the repo root). Adds: *.bak, *.bck, *.orig, *.rej, *.save, *.tmp, -patch, .md-patch (build/archives already covered by *.o, *.rom, *.img, *.cpio etc.) Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
left a comment
There was a problem hiding this comment.
LGTM! Last internal flash test works?
|
I confirm build is reproducible: both local build and CircleCI produced the same hash:
|
|
Two actionnable items left in OP
|
Oh yes, see commit trails on this. Tried to switch to coreboot 26.03 but blobs absent and gave up. In commit trails for proof and switched back to mrchromebox fork (see 98574da) cc @MrChromebox |
Bring in upstream master (PR linuxboot#2200: tpm-gpio-reset Kondix10 attribution and module pin 3e3a695). Both commits are already present in this branch by identical patch content (modules/tpm-gpio-reset matches at both tips), so they are not duplicated here. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
|
@cwiggs also, can you add your gpg public key under github so that your commits show as verified? |
Let me download the file and flash. Should I flash this internally, not externally via the SuzyQ board?
I think the first one is complete? I've been able to boot into NixOS from these Heads-Kano builds for months without issue.
I think this one we solved recently but I'll check with flashprog after I flash the most recent Heads build.
Looks like I signed those with my old key that I'm not using anymore. My new key you can see here: linuxboot/heads-wiki@0dc6d86 Let me see about resigning the commits here. |
Actually that it looks like they were re-signed with your key |
I ended up flashing externally via the SuzyQ board. No issues there. I think we are good to go? Next step remove debug mode and reflash? |
Let's be clear :) Initial flash: IFD, unlocking of whole flash; needs external. So on here testing went wrong, you had a IFS that was restricting ME and everythig else FD defined (regions, properties of regions) before flashing externally and confirming flashprog output with tee (which is their bad: stderr/stdout sent different paths which resolves the confusion we ha before: GPR0 was alwaus there until your test at #2133 (comment) After IFD good: everything (everyone following your instructions under https://cwiggs.github.io/heads-wiki/ now) should be able to externally flash kano and then internally flash internal upgrades.
Next steps: checking last checkboxes of OP and merge both heads and heads-wiki pr with your consent |
When everything ticket in Op, yes, remove non-production bits and merge. Thanks for your patience, this unlocks a whole big family of new boards here. |
Look at https://github.com/linuxboot/heads/pull/2133/commits Clicking unverified commit shows on my side That is your's, not mine. Mine is seen clicking on my github profile and on verified commits there: EDIT: wait what? same key?!?!?! Damnit github... Will dig tomorrow.... |
Anything specific I should check with this? I'm able to use Heads like normal so I'm not sure if there is any impact. |
@cwiggs that was empty comment |
Sorry Github has odd formatting and included my comment in the quote. I just fixed it. |







This pull request adds support for the Acer Chromebook Spin 714 ("kano") board based on the MrChromebox coreboot fork (26.06), including CI integration, configuration files, and documentation updates. It also introduces a patch for musl compatibility in the MrChromebox fork, adds a new Linux kernel version (6.6.30), and documents TPM2 CR50 command support. The most important changes are grouped below:
Kano (Acer Chromebook Spin 714) board support:
boards/kano/kano.configfor Heads and Linux build configuration for the kano board.config/coreboot-kano.config_defconfigas a defconfig backup for kano, documenting non-default coreboot options.coreboot-mrchromeboxas a seed, defines the kano build job, and documents its workflow. [1] [2] [3]USE_PC_CMOS_ALTCENTURYmust be unset for this board. [1] [2] [3]MrChromebox coreboot fork integration:
modules/coreboot, with commit hash pinning and submodule handling notes. [1] [2]ifdtool. [1] [2]Build system and kernel updates:
cbmemutility.Documentation improvements:
Minor adjustments:
These changes collectively enable official Heads support for the Acer Chromebook Spin 714 (kano), ensure compatibility with the MrChromebox fork, and improve build reproducibility and documentation for new contributors.
(copilot generalized pr summary, asked by @tlaurion)
TODO before merge
[5cbf889](https://github.com/linuxboot/heads/commit/5cbf8896292b1e7c8953feb60102096c6b7debdf)using external programmer model suzyqNixOS 26.05install and rebootNixOS 26.05patches/coreboot-X.Y.Z.and coreboot config contain proper preparation of the platform)Additional actionable items: