VBoot Reference: Add kernel rollback prevention and choosing logic.

src/platform/vboot_reference/utils/firmware_image.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for generating and manipulating a verified boot firmware image.
  */
 
 #include "firmware_image.h"
 
 #include <fcntl.h>
@@ skipping 662 matching lines @@
   min_lversion  = Min(firmwareA_lversion, firmwareB_lversion);
   stored_lversion = CombineUint16Pair(GetStoredVersion(FIRMWARE_KEY_VERSION),
                                       GetStoredVersion(FIRMWARE_VERSION));
   /* Always try FirmwareA first. */
   if (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob, firmwareA))
     firmwareA_is_verified = 1;
   if (firmwareA_is_verified && (stored_lversion < firmwareA_lversion)) {
     /* Stored version may need to be updated but only if FirmwareB
      * is successfully verified and has a logical version greater than
      * the stored logical version. */
-    if (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob, firmwareB)) {
-        if (stored_lversion < firmwareB_lversion) {
-          WriteStoredVersion(FIRMWARE_KEY_VERSION,
-                             (uint16_t) (min_lversion >> 16));
-          WriteStoredVersion(FIRMWARE_VERSION,
-                             (uint16_t) (min_lversion & 0x00FFFF));
-          stored_lversion = min_lversion;  /* Update stored version as it's used
-                                            * later. */
-        }
+    if (stored_lversion < firmwareB_lversion) {
+      if (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob, firmwareB)) {
+        WriteStoredVersion(FIRMWARE_KEY_VERSION,
+                           (uint16_t) (min_lversion >> 16));
+        WriteStoredVersion(FIRMWARE_VERSION,
+                           (uint16_t) (min_lversion & 0x00FFFF));
+        stored_lversion = min_lversion;  /* Update stored version as it's used
+                                          * later. */
+      }
     }
   }
   /* Lock Firmware TPM rollback indices from further writes. */
   /* TODO(gauravsh): Figure out if these can be combined into one
    * 32-bit location since we seem to always use them together. This can help
    * us minimize the number of NVRAM writes/locks (which are limited over flash
    * memory lifetimes.
    */
   LockStoredVersion(FIRMWARE_KEY_VERSION);
   LockStoredVersion(FIRMWARE_VERSION);
@@ skipping 15 matching lines @@
     if (stored_lversion <= firmwareA_lversion)
       return BOOT_FIRMWARE_A_CONTINUE;
   } else {
     /* If FirmwareA was not valid, then we skipped over the
      * check to update the rollback indices and a Verify of FirmwareB wasn't
      * attempted.
      * If FirmwareB is not a rollback, then we attempt to do the verification.
      */
     if (stored_lversion <= firmwareB_lversion &&
         (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob, firmwareB)))
-      return BOOT_FIRMWARE_B_CONTINUE;
+        return BOOT_FIRMWARE_B_CONTINUE;
   }
   /* D'oh: No bootable firmware. */
   return BOOT_FIRMWARE_RECOVERY_CONTINUE;
 }