mirror of
https://github.com/Telecominfraproject/OpenCellular.git
synced 2026-01-01 21:02:27 +00:00
fb5a05ab22
It needs to be possible to prevent unlocking of CCD on enterprise enrolled devices, in particular to prevent users from moving into dev mode. A bit in the FWMP structure flags field was allocated for the purposes of preventing console unlock in those cases. This patch adds code to read the FWMP structure from the TPM NVMEM, verify it and determine if it should be possible to unlock the console. The restriction is not honored by Cr50 DBG images. The FWMP value is read only once per TPM reset, this means each time the admin console changes the relevant flag bit, the Chrome OS device has to be rebooted to pick up the new flag value. BRANCH=cr50 BUG=b:35587387,b:35587053 TEST=verified that FWMP is properly read and acted upon. Change-Id: I17e15ea2b2293a0c096858fba3ccc389452caede Reviewed-on: https://chromium-review.googlesource.com/457824 Commit-Ready: Vadim Bendebury <vbendeb@chromium.org> Tested-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-by: Mary Ruthven <mruthven@chromium.org>
25 lines
613 B
C
25 lines
613 B
C
/* Copyright 2017 The Chromium OS Authors. All rights reserved.
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
* found in the LICENSE file.
|
|
*/
|
|
|
|
#ifndef __EC_BOARD_CR50_WP_H
|
|
#define __EC_BOARD_CR50_WP_H
|
|
|
|
#include "common.h"
|
|
|
|
/**
|
|
* Set the current write protect state in RBOX and long life scratch register.
|
|
*
|
|
* @param asserted: 0 to disable write protect, otherwise enable write protect.
|
|
*/
|
|
void set_wp_state(int asserted);
|
|
|
|
/**
|
|
* Read the FWMP value from TPM NVMEM and set the console restriction
|
|
* appropriately.
|
|
*/
|
|
void read_fwmp(void);
|
|
|
|
#endif /* ! __EC_BOARD_CR50_WP_H */
|