tree ec191e5bec5612a00cfb524e28dc34145cfe41c2
parent f81fce91bf885293f1447c1197bb0c4143d8fced
author Julius Werner <jwerner@chromium.org> 1431150854 -0700
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1431393436 +0000

vboot1: Lock TPM physical presence (kernel rollback) on legacy boot

Even though legacy boot is an unsafe mode that has to be manually
initiated by the user, we should still lock the kernel TPM space to be
consistent with existing developer mode practice.

BRANCH=tbd
BUG=chrome-os-partner:39999
TEST=Spent over an hour unsuccessfully trying to get SeaBIOS to boot a
Chromium test image on my Falco. Decided that's not worth it an just
tested the firmware side of this (pressing CTRL+L when legacy mode is
enabled and disabled, multiple times, with and without GBB flag
DEFAULT_DEV_BOOT_LEGACY).

Change-Id: I3b02b59a9055431d222c0c7446de2cd7d2e0bb82
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270181
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>