How to set the SRWD & block-protect bits?

[tetrahedras]

How can I set the status register write disable (SRWD) and block protect (BP0/BP1) bits in order to write-protect a flash chip?

I see plenty of code for disabling write protection, but I want to enable it...

[ln2max]

This is currently not possible: #185

[tetrahedras]

On Wed, Mar 03, 2021 at 05:28:40AM -0800, ln2max wrote: This is currently not possible: #185

That's good to know. Under certain circumstances, this may also compromise security of the [Qubes Anti-Evil-Maid](https://github.com/QubesOS/qubes-antievilmaid) system, which depends on being able to hardware-write-protect the BIOS:

Some hints: connect the write protect pin on BIOS flash chip to ground (prevents attacker from booting their own software which would bypass BIOS protections and overwrite it) and make sure physically accessing the chip will be tamper-evident by eg. covering the screws holding laptop body together in glitter and taking high-res photos, then examining before each use.

See also this discussion on the importance of hardware write-protect: https://groups.google.com/g/qubes-users/c/Qhm4NQRdSyk/m/wWBE1ib2AQAJ