2 ms·
Do you have more details? Why can't you upload your own private key in the new bios payload, like you can for SecureBoot? Everything is sitting in a flash chi
by csdvrx 4y ago
Do you have more details?
Why can't you upload your own private key in the new bios payload, like you can for SecureBoot?
Everything is sitting in a flash chip. Some parts may be RO, but it can be replaced by another chip if you can't tweak it directly with flashrom.
- Harvesterify 4y agoI'm guessing Intel Boot Guard is enabled and provisionned with Dell keys, but it's just a guess.
- treffer 4y agooh well, I thought the same, but got curious because the framework laptop would be way nicer with an open UEFI... Vendors burn a key into the system which prevents loading an unsigned BIOS. This is a one-time-programmable fuse (OTP fuse) and part of Intel BootGuard protections. You get a laptop with _fused burned_ to prevent loading other firmware to your device. Booting won't work if you load a replacement SPI chip with anything but a vendor-signed firmware.