Re-enable firmware write-protection after flashing mrchromebox firmware

Support General Device Support
1

System Details

  • Device: bluebird
  • OS: gentoo
  • Firmware Type: UEFI Full ROM
  • Firmware Version: N/A
  • Internal storage type: eMMC

Summary of the Issue

I want to safely re-enable firmware write-protection on the chromebook for security purposes. I do not want to brick the chromebook in the process of doing this.

Also mrchromebox docs seem to suggest that even reenabling firmware write-protect doesn’t actually protect the firmware?

What will happen if I reconnect the suzyqable, and echo “wp enable” to the device node? Has anyone tried this before, and if so what were the results?

Another option is using the TPM for measured boot, I can’t seem to find any information about using the TPM to do this though.

2

read Firmware Write Protection on ChromeOS Devices | MrChromebox.tech

re-enabling WP via CCD (HW WP) does nothing, because there is no protection set in the flash chip registers (SW WP). SW WP requires setting a specific address range (or ranges) on the flash to protect, but the MrChromebox firmware is not laid out in a way that is conducive to that. You would need to use a custom flash layout which has the different regions ordered and aligned properly so that you can protect the ones that need to be (ie, coreboot itself) without preventing writing to the ones that need it (ie, NVRAM).

TLDR, don’t mess with re-enabling WP

1 Like