Fix checking boot flags in developer mode.

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 193 matching lines @@
       if (0 != BootDeviceReadLBA(part_start, kbuf_sectors, kbuf))
         continue;
 
       /* Verify the key block */
       key_block = (VbKeyBlockHeader*)kbuf;
       if ((0 != KeyBlockVerify(key_block, KBUF_SIZE, kernel_subkey))) {
         VBDEBUG(("Verifying key block failed.\n"));
         continue;
       }
 
-      /* Check the key block flags against the current boot mode */
-      if (!(key_block->key_block_flags &
-            (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
-             KEY_BLOCK_FLAG_DEVELOPER_0))) {
-        VBDEBUG(("Developer flag mismatch.\n"));
-        continue;
-      }
-      if (!(key_block->key_block_flags &
-            (is_rec ? KEY_BLOCK_FLAG_RECOVERY_1 :
-             KEY_BLOCK_FLAG_RECOVERY_0))) {
-        VBDEBUG(("Recovery flag mismatch.\n"));
-        continue;
+      /* Check the key block flags against the current boot mode in normal
+       * and recovery modes (not in developer mode booting from SSD). */
+      if (is_rec || is_normal) {
+        if (!(key_block->key_block_flags &
+              (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
+               KEY_BLOCK_FLAG_DEVELOPER_0))) {
+          VBDEBUG(("Developer flag mismatch.\n"));
+          continue;
+        }
+        if (!(key_block->key_block_flags &
+              (is_rec ? KEY_BLOCK_FLAG_RECOVERY_1 :
+               KEY_BLOCK_FLAG_RECOVERY_0))) {
+          VBDEBUG(("Recovery flag mismatch.\n"));
+          continue;
+        }
       }
 
       /* Check for rollback of key version.  Note this is implicitly
        * skipped in recovery and developer modes because those set
        * key_version=0 above. */
       key_version = key_block->data_key.key_version;
       if (key_version < tpm_key_version) {
         VBDEBUG(("Key version too old.\n"));
         continue;
       }
@@ skipping 167 matching lines @@
     /* Success! */
     return LOAD_KERNEL_SUCCESS;
   }
 
   // Handle error cases
   if (found_partitions)
     return LOAD_KERNEL_INVALID;
   else
     return LOAD_KERNEL_NOT_FOUND;
 }