Enable TPM in developer mode again.

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 134 matching lines @@
   kbuf_sectors = KBUF_SIZE / blba;
   is_dev = (BOOT_FLAG_DEVELOPER & params->boot_flags ? 1 : 0);
   is_rec = (BOOT_FLAG_RECOVERY & params->boot_flags ? 1 : 0);
   is_normal = (!is_dev && !is_rec);
 
   /* Clear output params in case we fail */
   params->partition_number = 0;
   params->bootloader_address = 0;
   params->bootloader_size = 0;
 
-  if (!is_dev) {
-    /* TODO: should use the TPM all the time; for now, only use when
-     * not in developer mode. */
-    /* Let the TPM know if we're in recovery mode */
-    if (is_rec) {
-      if (0 != RollbackKernelRecovery(is_dev ? 1 : 0)) {
-        VBDEBUG(("Error setting up TPM for recovery kernel\n"));
-        /* Ignore return code, since we need to boot recovery mode to
-         * fix the TPM. */
-      }
+  /* Let the TPM know if we're in recovery mode */
+  if (is_rec) {
+    if (0 != RollbackKernelRecovery(is_dev)) {
+      VBDEBUG(("Error setting up TPM for recovery kernel\n"));
+      /* Ignore return code, since we need to boot recovery mode to
+       * fix the TPM. */
     }
   }
 
   if (is_normal) {
     /* Read current kernel key index from TPM.  Assumes TPM is already
      * initialized. */
     status = RollbackKernelRead(&tpm_key_version, &tpm_kernel_version);
     if (0 != status) {
       VBDEBUG(("Unable to get kernel versions from TPM\n"));
       return (status == TPM_E_MUST_REBOOT ?
@@ skipping 168 matching lines @@
       RSAPublicKeyFree(data_key);
 
       /* If we're still here, the kernel is valid. */
       /* Save the first good partition we find; that's the one we'll boot */
       VBDEBUG(("Partiton is good.\n"));
       /* TODO: GPT partitions start at 1, but cgptlib starts them at 0.
        * Adjust here, until cgptlib is fixed. */
       good_partition = gpt.current_kernel + 1;
       params->partition_number = gpt.current_kernel + 1;
       GetCurrentKernelUniqueGuid(&gpt, &params->partition_guid);
+      /* TODO: GetCurrentKernelUniqueGuid() should take a destination size, or
+       * the dest should be a struct, so we know it's big enough. */
       params->bootloader_address = preamble->bootloader_address;
       params->bootloader_size = preamble->bootloader_size;
       /* If we're in developer or recovery mode, there's no rollback
        * protection, so we can stop at the first valid kernel. */
       if (!is_normal) {
         VBDEBUG(("Boot_flags = !is_normal\n"));
         break;
       }
 
       /* Otherwise, we're in normal boot mode, so we do care about the
@@ skipping 30 matching lines @@
        * back to normal mode. */
       VBDEBUG(("Boot_flags = is_normal\n"));
       if ((lowest_key_version > tpm_key_version) ||
           (lowest_key_version == tpm_key_version &&
            lowest_kernel_version > tpm_kernel_version)) {
 
         status = RollbackKernelWrite((uint16_t)lowest_key_version,
                                      (uint16_t)lowest_kernel_version);
         if (0 != status) {
           VBDEBUG(("Error writing kernel versions to TPM.\n"));
-      return (status == TPM_E_MUST_REBOOT ?
-              LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
+          return (status == TPM_E_MUST_REBOOT ?
+                  LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
         }
       }
     }
 
-    if (!is_dev) {
-      /* TODO: should use the TPM all the time; for now, only use when
-       * not in developer mode. */
-      /* Lock the kernel versions */
-      status = RollbackKernelLock();
-      if (0 != status) {
-        VBDEBUG(("Error locking kernel versions.\n"));
-        /* Don't reboot to recovery mode if we're already there */
-        if (!is_rec)
-          return (status == TPM_E_MUST_REBOOT ?
-                  LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
-      }
+    /* Lock the kernel versions */
+    status = RollbackKernelLock();
+    if (0 != status) {
+      VBDEBUG(("Error locking kernel versions.\n"));
+      /* Don't reboot to recovery mode if we're already there */
+      if (!is_rec)
+        return (status == TPM_E_MUST_REBOOT ?
+                LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
     }
 
     /* Success! */
     return LOAD_KERNEL_SUCCESS;
   }
 
   // Handle error cases
   if (found_partitions)
     return LOAD_KERNEL_INVALID;
   else
     return LOAD_KERNEL_NOT_FOUND;
 }