Better understanding of Firmeware write protection

Support
1

System Details

  • Device: Kano
  • OS: Linux (NixOS 26.05)
  • Firmware Type: Heads
  • Firmware Version: Not sure
  • Internal storage type: NVMe

Summary of the Issue

I am in the process of porting the Heads bootloader to the Google Kano device but am running into some issues with the firmware write protection and hope someone can help me understand it better.

The PR for Heads on the Kano is here. At some point in the process it seems I was able to fully disable the firmware write protection, but now I can’t seem to get back to that state.

Questions:

  1. The Kano section on the “Supported Devices” MrChromeBox page just says “CR50 (SuzyQ)”. Does that mean that I just need to use a SuzyQ device/cable to disable Using this guide: Disabling Firmware Write Protection | MrChromebox.tech
  2. If I follow that guide above it says to use gsctoolto enable CCD, should I boot back into ChromeOS to do this? I think the answer is no, or perhaps a previous user of the laptop already did that because I was already able to successfully flash Heads via the SuzyQ cable.
  3. Do I ever need to remove the Battery to disable hardware write protection with the Kano?
  4. I think to flash Heads I do need to follow this: Disabling Firmware Write Protection | MrChromebox.tech I am able to run the flashrom commands and I posted the results here: https://github.com/linuxboot/heads/pull/2133#issuecomment-4925922599
  5. There is a lot more info in this heads-wiki PR that I think might help: Add google kano flashing guide by cwiggs · Pull Request #223 · linuxboot/heads-wiki · GitHub Would love to hear what others think.
2
  1. yes
  2. if your device is running HEADS, then WP is alresdy disabled
  3. no, devices which have WP tied to the battery sense line are explicitly called out on my site. Kano does not support it.
  4. if your device is already running HEADS, you don’t need to do anything else.
  5. ?

Mrchromebox and Librebook guides both say that the --wp flags are only present on the ChromeOS version of flashrom.

this is absolutely untrue and nothing on my site states this.

If your device has already had the firmware flashed, there is nothing more you need to do. You can flash the firmware at will using flashrom from the OS, or via the SuzyQ.

3

I think based on what tlaurion said in Add google kano flashing guide by cwiggs · Pull Request #223 · linuxboot/heads-wiki · GitHub is the Intel ME portion of the IFD is still showing as protected?

I think the concern is that an update to Heads won’t work because portions of the IFD (?) are still reporting as protected.

this is absolutely untrue and nothing on my site states this.

I might just being confusing things but I got this from here: Disabling Firmware Write Protection | MrChromebox.tech specifically:

The ChromeOS/ChromiumOS version of flashrom can manipulate the software write protect register.

Thanks for your response.

4

right, but that’s not to say that upstream can’t.

so you disable the IFD lock, same as any other device, and then flash back the unlocked IFD via SuzyQ. HEADS shouldn’t be screwing with the IFD/ME on this device, but that’s another story