breadcrumbs: Firmware Overview and Porting Guide > page_name: firmware-ec-write-protection title: Firmware / EC Write Protection
On customer-ship devices, read-only AP firmware and embedded controller firmware is write-protected. By design, this write protection cannot be removed without physical access to the device.
Application Processor (AP) Firmware
AP firmware (also known as “SOC firmware”, “host firmware”, “main firmware” or even “BIOS”) typically resides on a SPI ROM. Protection registers on the SPI ROM are programmed to protect the read-only region, and these registers normally cannot be modified while the SPI ROM WP (write protect) pin is asserted. This pin is asserted through various physical means (see below), but with effort, users can unprotect devices they own.
Embedded Controller (EC) Firmware
The Chrome OS Embedded Controller (EC) typically has a WP input pin driven by the same hardware that generates SOC firmware write protect. While this pin is asserted, certain debug features (eg. arbitrary I2C access through host commands) are locked out. Some ECs load code from external storage, and for these ECs, RO protection works similar to SOC firmware RO protection (WP pin is asserted to EC SPI ROM). Other ECs use internal flash, and these ECs emulate SPI ROM protection registers, disabling write access to certain regions while the WP pin is asserted.
Methods of Asserting Write Protect
Throughout the history of Chrome OS devices, three main methods have been implemented for asserting (and removing) write protect:
More information about which protection method is used for a particular device, and where to locate the switch / screw, is available on the developer info page.
Disabling Write Protect for Screw / Switch Protection
Disabling Write Protect for cr50
If you have a suzyQ, you can disable write protect without opening the case. You can enable Case-Closed Debugging (CCD) and then use a cr50 console command to disable write protect. The write protect command is only accessible through suzyQ.
If you don‘t want to go through the ccd open process or don’t have a suzyQ, you can open the case and remove the battery to disable write protect.