commit dd708d4ad5ddb965bf15cb24492feaec6be43546
author Hung-Te Lin <hungte@chromium.org> Fri Jul 11 17:05:01 2014 +0800
committer chrome-internal-fetch <chrome-internal-fetch@google.com> Mon Jul 14 05:14:24 2014 +0000
tree e01d72f12bd61d0334b24deabf7d98401e412f29
parent 8c88a1294c56b54bcf86728b90cead04e269341d

gooftool: Add verify_me_locked to check if Management Engine is locked.

We want to make shipping products do have locked Management Engine firmware.
Note this verification is executed only if write protection will be enabled.

BUG=chrome-os-partner:30283
TEST=make test # pass

Change-Id: If7ea4eda279ad0a416f0db54c4f2e65540c0591f
Reviewed-on: https://chromium-review.googlesource.com/207497
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
Tested-by: Hung-Te Lin <hungte@chromium.org>
Commit-Queue: Hung-Te Lin <hungte@chromium.org>

py/gooftool/gooftool.py

diff --git a/py/gooftool/gooftool.py b/py/gooftool/gooftool.py
index 674c73a..6c88e7c 100755
--- a/py/gooftool/gooftool.py
+++ b/py/gooftool/gooftool.py
@@ -528,6 +528,12 @@
 
   return GetGooftool(options).VerifyTPM()
 
+@Command('verify_me_locked')
+def VerifyManagementEngineLocked(options):  # pylint: disable=W0613
+  """Verify Managment Engine is locked."""
+
+  return GetGooftool(options).VerifyManagementEngineLocked()
+
 @Command('verify_switch_wp')
 def VerifyWPSwitch(options):  # pylint: disable=W0613
   """Verify hardware write protection switch is enabled."""
@@ -655,6 +661,7 @@
 
   if not options.no_write_protect:
     VerifyWPSwitch(options)
+    VerifyManagementEngineLocked(options)
   VerifyDevSwitch(options)
   if options.hwid_version == 2:
     VerifyHWIDv2(options)