Enable TPM in developer mode again.

firmware/lib/vboot_firmware.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * High-level firmware API for loading and verifying rewritable firmware.
  * (Firmware portion)
  */
 
 #include "load_firmware_fw.h"
 #include "rollback_index.h"
@@ skipping 23 matching lines @@
 int LoadFirmware(LoadFirmwareParams* params) {
 
   VbPublicKey* root_key = (VbPublicKey*)params->firmware_root_key_blob;
   VbLoadFirmwareInternal* lfi;
 
   uint16_t tpm_key_version = 0;
   uint16_t tpm_fw_version = 0;
   uint64_t lowest_key_version = 0xFFFF;
   uint64_t lowest_fw_version = 0xFFFF;
   uint32_t status;
-  int is_dev = (BOOT_FLAG_DEVELOPER & params->boot_flags ? 1 : 0);
   int good_index = -1;
   int index;
 
   /* Clear output params in case we fail */
   params->firmware_index = 0;
 
   VBDEBUG(("LoadFirmware started...\n"));
 
   if (params->kernel_sign_key_size < sizeof(VbPublicKey)) {
     VBDEBUG(("Kernel sign key buffer too small\n"));
     return LOAD_FIRMWARE_RECOVERY;
   }
 
   /* Must have a root key */
   if (!root_key) {
     VBDEBUG(("No root key\n"));
     return LOAD_FIRMWARE_RECOVERY;
   }
 
   /* Initialize the TPM and read rollback indices. */
-  if (!is_dev) {
-    /* TODO: should use the TPM all the time; for now, only use when
-     * not in developer mode. */
-    status = RollbackFirmwareSetup(params->boot_flags & BOOT_FLAG_DEVELOPER);
-    if (0 != status) {
-      VBDEBUG(("Unable to setup TPM.\n"));
-      return (status == TPM_E_MUST_REBOOT ?
-              LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
-    }
-    status = RollbackFirmwareRead(&tpm_key_version, &tpm_fw_version);
-    if (0 != status) {
-      VBDEBUG(("Unable to read stored versions.\n"));
-      return (status == TPM_E_MUST_REBOOT ?
-              LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
-    }
+  status = RollbackFirmwareSetup(params->boot_flags & BOOT_FLAG_DEVELOPER);
+  if (0 != status) {
+    VBDEBUG(("Unable to setup TPM.\n"));

[semenzato, 2010/08/05 19:50:53]

This message may be too scary when the firmware is just reenabling the TPM.

+    return (status == TPM_E_MUST_REBOOT ?
+            LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
+  }
+  status = RollbackFirmwareRead(&tpm_key_version, &tpm_fw_version);
+  if (0 != status) {
+    VBDEBUG(("Unable to read stored versions.\n"));
+    return (status == TPM_E_MUST_REBOOT ?
+            LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
   }
 
   /* Allocate our internal data */
   lfi = (VbLoadFirmwareInternal*)Malloc(sizeof(VbLoadFirmwareInternal));
   if (!lfi)
     return LOAD_FIRMWARE_RECOVERY;
   params->load_firmware_internal = (uint8_t*)lfi;
 
   /* Loop over indices */
   for (index = 0; index < 2; index++) {
@@ skipping 133 matching lines @@
   params->load_firmware_internal = NULL;
 
   /* Handle finding good firmware */
   if (good_index >= 0) {
 
     /* Update TPM if necessary */
     if ((lowest_key_version > tpm_key_version) ||
         (lowest_key_version == tpm_key_version &&
          lowest_fw_version > tpm_fw_version)) {
 
-      if (!is_dev) {
-        /* TODO: should use the TPM all the time; for now, only use
-         * when not in developer mode. */
-        status = RollbackFirmwareWrite((uint16_t)lowest_key_version,
-                                       (uint16_t)lowest_fw_version);
-        if (0 != status) {
-          VBDEBUG(("Unable to write stored versions.\n"));
-          return (status == TPM_E_MUST_REBOOT ?
-                  LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
-        }
-      }
-    }
-
-    if (!is_dev) {
-      /* TODO: should use the TPM all the time; for now, only use
-       * when not in developer mode. */
-      /* Lock firmware versions in TPM */
-      status = RollbackFirmwareLock();
+      status = RollbackFirmwareWrite((uint16_t)lowest_key_version,
+                                     (uint16_t)lowest_fw_version);
       if (0 != status) {
-        VBDEBUG(("Unable to lock firmware versions.\n"));
+        VBDEBUG(("Unable to write stored versions.\n"));
         return (status == TPM_E_MUST_REBOOT ?
                 LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
       }
     }
 
+    /* Lock firmware versions in TPM */
+    status = RollbackFirmwareLock();
+    if (0 != status) {
+      VBDEBUG(("Unable to lock firmware versions.\n"));
+      return (status == TPM_E_MUST_REBOOT ?
+              LOAD_FIRMWARE_REBOOT : LOAD_FIRMWARE_RECOVERY);
+    }
+
     /* Success */
     VBDEBUG(("Will boot firmware index %d\n", (int)params->firmware_index));
     return LOAD_FIRMWARE_SUCCESS;
   }
 
   /* If we're still here, no good firmware, so go to recovery mode. */
   VBDEBUG(("Alas, no good firmware.\n"));
   return LOAD_FIRMWARE_RECOVERY;
 }