diff --git a/host/lib/crossystem.c b/host/lib/crossystem.c
index 2e29d04..7ad5d80 100644
--- a/host/lib/crossystem.c
+++ b/host/lib/crossystem.c
@@ -41,6 +41,10 @@
 } VdatIntField;
 
 
+/* Masks for kern_nv usage by kernel */
+#define KERN_NV_FWUPDATE_TRIES_MASK 0x0000000F
+
+
 /* Return true if the FWID starts with the specified string. */
 int FwidStartsWith(const char *start) {
   char fwid[128];
@@ -93,7 +97,7 @@
     goto VbSetNvCleanup;
 
   if (vnc.raw_changed) {
-    if (0 != VbReadNvStorage(&vnc))
+    if (0 != VbWriteNvStorage(&vnc))
       goto VbSetNvCleanup;
   }
 
@@ -351,6 +355,12 @@
     value = VbGetNvStorage(VBNV_DEBUG_RESET_MODE);
   } else if (!strcasecmp(name,"fwb_tries")) {
     value = VbGetNvStorage(VBNV_TRY_B_COUNT);
+  } else if (!strcasecmp(name,"fwupdate_tries")) {
+    value = VbGetNvStorage(VBNV_KERNEL_FIELD);
+    if (value != -1)
+      value &= KERN_NV_FWUPDATE_TRIES_MASK;
+  } else if (!strcasecmp(name,"loc_idx")) {
+    value = VbGetNvStorage(VBNV_LOCALIZATION_INDEX);
   }
   /* Other parameters */
   else if (!strcasecmp(name,"cros_debug")) {
@@ -397,6 +407,7 @@
 
 int VbSetSystemPropertyInt(const char* name, int value) {
   /* Check architecture-dependent properties first */
+
   if (0 == VbSetArchPropertyInt(name, value))
     return 0;
 
@@ -416,6 +427,15 @@
     return VbSetNvStorage(VBNV_DEBUG_RESET_MODE, value);
   } else if (!strcasecmp(name,"fwb_tries")) {
     return VbSetNvStorage(VBNV_TRY_B_COUNT, value);
+  } else if (!strcasecmp(name,"fwupdate_tries")) {
+    int kern_nv = VbGetNvStorage(VBNV_KERNEL_FIELD);
+    if (kern_nv == -1)
+      return -1;
+    kern_nv &= ~KERN_NV_FWUPDATE_TRIES_MASK;
+    kern_nv |= (value & KERN_NV_FWUPDATE_TRIES_MASK);
+    return VbSetNvStorage(VBNV_KERNEL_FIELD, kern_nv);
+  } else if (!strcasecmp(name,"loc_idx")) {
+    return VbSetNvStorage(VBNV_LOCALIZATION_INDEX, value);
   }
 
   return -1;
diff --git a/utility/crossystem_main.c b/utility/crossystem_main.c
index 133ab00..5189627 100644
--- a/utility/crossystem_main.c
+++ b/utility/crossystem_main.c
@@ -62,8 +62,10 @@
   {"recovery_request", CAN_WRITE, "Recovery mode request (writable)"},
   {"dbg_reset", CAN_WRITE, "Debug reset mode request (writable)"},
   {"fwb_tries", CAN_WRITE, "Try firmware B count (writable)"},
+  {"fwupdate_tries", CAN_WRITE, "Times to try OS firmware update (writable)"},
   {"vbtest_errfunc", CAN_WRITE, "Verified boot test error function (writable)"},
   {"vbtest_errno", CAN_WRITE, "Verified boot test error number (writable)"},
+  {"loc_idx", CAN_WRITE, "Localization index for firmware screens (writable)"},
   /* Fields not shown in a print-all list */
   {"vdat_lfdebug", IS_STRING|NO_PRINT_ALL,
    "LoadFirmware() debug data (not in print-all)"},