Lock firmware by default, require manual confirmation to boot unlocked

[jackpot51]

• The EC resets in LOCK security state
• The firmware updater is written to the EFI partition, and set as the next boot option
• Upon reboot, the firmware updater prompts for an enter keypress to confirm firmware flashing
• The firmware updater tells the EC to enter the PREPARE_UNLOCK security state
• The system reboots, which will unlock the SPI flash as well as setting the EC to UNLOCK security state
• The firmware security driver detects this condition prior to booting code outside of firmware and prompts for the user to enter a guaranteed (by hardware) random 8-digit number in order to continue
• If the code is entered, the firmware updater is booted, the firmware is flashed, and upon the final EC reset that shuts everything down, the EC security state will go back to locked
• In the case that the code is not entered, the EC will be told to prepare to lock and will be rebooted, which will make the SPI flash and the EC enter the PREPARE_LOCK security state

[JanZerebecki]

Is it planned to include this feature in a official firmware update for the galp4?

[crawfxrd]

EC locking is enabled on TGL and later.