Add recovery mode protection to new NVRAM locking scheme.

src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c

Index: src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c
diff --git a/src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c b/src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c
index 6cfb1970f5eabb35bb5e3d754dd7ff9345766b9f..27f2cf008e948a16f93fc6e46ae2b0e32368b88a 100644
--- a/src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c
+++ b/src/platform/vboot_reference/vboot_firmware/lib/kernel_image_fw.c
@@ -366,6 +366,7 @@ int VerifyKernelDriver_f(uint8_t* firmware_key_blob,
   kernel_entry* try_kernel[2];  /* Kernel in try order. */
   int try_kernel_which[2];  /* Which corresponding kernel in the try order */
   uint32_t try_kernel_lversion[2];  /* Their logical versions. */
+  uint16_t kernel_version, kernel_key_version;  /* Temporary variables */
 
   /* [kernel_to_boot] will eventually contain the boot path to follow
    * and is returned to the caller. Initially, we set it to recovery. If
@@ -384,8 +385,8 @@ int VerifyKernelDriver_f(uint8_t* firmware_key_blob,
   kernelA_lversion = GetLogicalKernelVersion(kernelA->kernel_blob);
   kernelB_lversion = GetLogicalKernelVersion(kernelB->kernel_blob);
   min_lversion  = Min(kernelA_lversion, kernelB_lversion);
-  stored_lversion = CombineUint16Pair(GetStoredVersion(KERNEL_KEY_VERSION),
-                                      GetStoredVersion(KERNEL_VERSION));
+  GetStoredVersions(KERNEL_VERSIONS, &kernel_key_version, &kernel_version);
+  stored_lversion = CombineUint16Pair(kernel_key_version, kernel_version);
 
   /* TODO(gauravsh): The kernel entries kernelA and kernelB come from the
    * partition table - verify its signature/checksum before proceeding
@@ -433,10 +434,9 @@ int VerifyKernelDriver_f(uint8_t* firmware_key_blob,
         if (VERIFY_KERNEL_SUCCESS == VerifyKernel(firmware_key_blob,
                                                   try_kernel[1]->kernel_blob,
                                                   dev_mode)) {
-          WriteStoredVersion(KERNEL_KEY_VERSION,
-                             (uint16_t) (min_lversion >> 16));
-          WriteStoredVersion(KERNEL_VERSION,
-                             (uint16_t) (min_lversion & 0xFFFF));
+          WriteStoredVersions(KERNEL_VERSIONS,
+                              (uint16_t) (min_lversion >> 16),
+                                (uint16_t) (min_lversion & 0xFFFF));
           stored_lversion = min_lversion;  /* Update stored version as it's
                                             * used later. */
         }