mirror of
https://github.com/Telecominfraproject/OpenCellular.git
synced 2025-12-29 18:11:05 +00:00
fb5a05ab22
It needs to be possible to prevent unlocking of CCD on enterprise enrolled devices, in particular to prevent users from moving into dev mode. A bit in the FWMP structure flags field was allocated for the purposes of preventing console unlock in those cases. This patch adds code to read the FWMP structure from the TPM NVMEM, verify it and determine if it should be possible to unlock the console. The restriction is not honored by Cr50 DBG images. The FWMP value is read only once per TPM reset, this means each time the admin console changes the relevant flag bit, the Chrome OS device has to be rebooted to pick up the new flag value. BRANCH=cr50 BUG=b:35587387,b:35587053 TEST=verified that FWMP is properly read and acted upon. Change-Id: I17e15ea2b2293a0c096858fba3ccc389452caede Reviewed-on: https://chromium-review.googlesource.com/457824 Commit-Ready: Vadim Bendebury <vbendeb@chromium.org> Tested-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-by: Mary Ruthven <mruthven@chromium.org>
For an overview of the Embedded Controller firmware, refer to http://www.chromium.org/chromium-os/2014-firmware-summit For instructions on building from source, refer to http://www.chromium.org/chromium-os/ec-development/getting-started-building-ec-images-quickly