[Burnfire]

the flash chip is a Winbond W25Q64FV IIRC, but that datasheet won't help much, as the layout of the flash is largely dictated by the firmware itself. You never want 100% write protection with these kinds of systems as there is always some data which needs to be written. Even the stock firmware only write-protects a few small regions of the chip (teh details of which are on the firmware page of my website).

Nice to know. I always believed the WP pin would block 100% of writes, but apparently I was wrong.

it's a perfectly viable option if building your own firmware for personal use, but less so if distributing general purpose firmware for others to use

I'll play around a bit with those. By the way, which coreboot image of yours matches my device (Asus Chromebox CN60 - Celeron 2955U 1.4GHz)?
Is it this one: https://mrchromebox.tech/files/firmware/...170319.rom
If so, can I please have the coreboot .config (menu config) file for this image? Thanks!

Also, are you by any chance present in #coreboot on freenode IRC? Maybe we can talk live sometime. ^.^

if the OS normally installs grub (or whatever bootloader) to bootx64.efi, then it gets updated normally. If it nromally installs to (eg) /efi/ubuntu/grubx64.efi, then you would need to manually copy that, but IME that file itself isn't updated all that often since it's just a stub

Interesting, I'll definitely check this out next time I setup an UEFI system. Thanks for the info though.

Sincerely.