Change rollback interface so kernel/firmware version numbers are

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 102 matching lines @@
 
 int LoadKernel(LoadKernelParams* params) {
   VbPublicKey* kernel_subkey;
   GptData gpt;
   uint64_t part_start, part_size;
   uint64_t blba;
   uint64_t kbuf_sectors;
   uint8_t* kbuf = NULL;
   int found_partitions = 0;
   int good_partition = -1;
-  uint16_t tpm_key_version = 0;
-  uint16_t tpm_kernel_version = 0;
-  uint64_t lowest_key_version = 0xFFFF;
-  uint64_t lowest_kernel_version = 0xFFFF;
+  uint32_t tpm_version = 0;
+  uint64_t lowest_version = 0xFFFFFFFF;
   int is_dev;
   int is_rec;
   int is_normal;
   uint32_t status;
 
   /* Sanity Checks */
   if (!params ||
       !params->bytes_per_lba ||
       !params->ending_lba ||
       !params->kernel_buffer ||
@@ skipping 20 matching lines @@
     if (0 != RollbackKernelRecovery(is_dev)) {
       VBDEBUG(("Error setting up TPM for recovery kernel\n"));
       /* Ignore return code, since we need to boot recovery mode to
        * fix the TPM. */
     }
   }
 
   if (is_normal) {
     /* Read current kernel key index from TPM.  Assumes TPM is already
      * initialized. */
-    status = RollbackKernelRead(&tpm_key_version, &tpm_kernel_version);
+    status = RollbackKernelRead(&tpm_version);
     if (0 != status) {
       VBDEBUG(("Unable to get kernel versions from TPM\n"));
       return (status == TPM_E_MUST_REBOOT ?
               LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
     }
   } else if (is_dev && !is_rec) {
     /* In developer mode, we ignore the kernel subkey, and just use
      * the SHA-512 hash to verify the key block. */
     kernel_subkey = NULL;
   }
@@ skipping 17 matching lines @@
     kbuf = (uint8_t*)Malloc(KBUF_SIZE);
     if (!kbuf)
       break;
 
     /* Loop over candidate kernel partitions */
     while (GPT_SUCCESS == GptNextKernelEntry(&gpt, &part_start, &part_size)) {
       VbKeyBlockHeader* key_block;
       VbKernelPreambleHeader* preamble;
       RSAPublicKey* data_key;
       uint64_t key_version;
+      uint64_t combined_version;
       uint64_t body_offset;
 
       VBDEBUG(("Found kernel entry at %" PRIu64 " size %" PRIu64 "\n",
               part_start, part_size));
 
       /* Found at least one kernel partition. */
       found_partitions++;
 
       /* Read the first part of the kernel partition  */
       if (part_size < kbuf_sectors)
@@ skipping 22 matching lines @@
                KEY_BLOCK_FLAG_RECOVERY_0))) {
           VBDEBUG(("Recovery flag mismatch.\n"));
           continue;
         }
       }
 
       /* Check for rollback of key version.  Note this is implicitly
        * skipped in recovery and developer modes because those set
        * key_version=0 above. */
       key_version = key_block->data_key.key_version;
-      if (key_version < tpm_key_version) {
+      if (key_version < (tpm_version >> 16)) {
         VBDEBUG(("Key version too old.\n"));
         continue;
       }
 
       /* Get the key for preamble/data verification from the key block */
       data_key = PublicKeyToRSA(&key_block->data_key);
       if (!data_key)
         continue;
 
       /* Verify the preamble, which follows the key block */
       preamble = (VbKernelPreambleHeader*)(kbuf + key_block->key_block_size);
       if ((0 != VerifyKernelPreamble(preamble,
                                      KBUF_SIZE - key_block->key_block_size,
                                      data_key))) {
         VBDEBUG(("Preamble verification failed.\n"));
         RSAPublicKeyFree(data_key);
         continue;
       }
 
       /* Check for rollback of kernel version.  Note this is implicitly
-       * skipped in recovery and developer modes because those set
-       * key_version=0 and kernel_version=0 above. */
-      if (key_version == tpm_key_version &&
-          preamble->kernel_version < tpm_kernel_version) {
+       * skipped in recovery and developer modes because rollback_index
+       * sets those to 0 in those modes. */
+      combined_version = ((key_version << 16) |
+                          (preamble->kernel_version & 0xFFFF));
+      if (combined_version < tpm_version) {
         VBDEBUG(("Kernel version too low.\n"));
         RSAPublicKeyFree(data_key);
         continue;
       }
 
       VBDEBUG(("Kernel preamble is good.\n"));
 
-      /* Check for lowest key version from a valid header. */
-      if (lowest_key_version > key_version) {
-        lowest_key_version = key_version;
-        lowest_kernel_version = preamble->kernel_version;
-      }
-      else if (lowest_key_version == key_version &&
-               lowest_kernel_version > preamble->kernel_version) {
-        lowest_kernel_version = preamble->kernel_version;
-      }
+      /* Check for lowest version from a valid header. */
+      if (lowest_version > combined_version)
+        lowest_version = combined_version;
 
       /* If we already have a good kernel, no need to read another
        * one; we only needed to look at the versions to check for
        * rollback. */
       if (-1 != good_partition)
         continue;
 
       /* Verify body load address matches what we expect */
       if ((preamble->body_load_address != (size_t)params->kernel_buffer) &&
           !(params->boot_flags & BOOT_FLAG_SKIP_ADDR_CHECK)) {
@@ skipping 57 matching lines @@
       if (!is_normal) {
         VBDEBUG(("Boot_flags = !is_normal\n"));
         break;
       }
 
       /* Otherwise, we're in normal boot mode, so we do care about the
        * key index in the TPM.  If the good partition's key version is
        * the same as the tpm, then the TPM doesn't need updating; we
        * can stop now.  Otherwise, we'll check all the other headers
        * to see if they contain a newer key. */
-      if (key_version == tpm_key_version &&
-          preamble->kernel_version == tpm_kernel_version) {
-        VBDEBUG(("Same key version\n"));
+      if (combined_version == tpm_version) {
+        VBDEBUG(("Same kernel version\n"));
         break;
       }
     } /* while(GptNextKernelEntry) */
   } while(0);
 
   /* Free kernel buffer */
   if (kbuf)
     Free(kbuf);
 
   /* Write and free GPT data */
   WriteAndFreeGptData(&gpt);
 
   /* Handle finding a good partition */
   if (good_partition >= 0) {
     VBDEBUG(("Good_partition >= 0\n"));
 
     /* See if we need to update the TPM */
     if (is_normal) {
       /* We only update the TPM in normal boot mode.  In developer
        * mode, the kernel is self-signed by the developer, so we can't
        * trust the key version and wouldn't want to roll the TPM
        * forward.  In recovery mode, the TPM stays PP-unlocked, so
        * anything we write gets blown away by the firmware when we go
        * back to normal mode. */
       VBDEBUG(("Boot_flags = is_normal\n"));
-      if ((lowest_key_version > tpm_key_version) ||
-          (lowest_key_version == tpm_key_version &&
-           lowest_kernel_version > tpm_kernel_version)) {
-
-        status = RollbackKernelWrite((uint16_t)lowest_key_version,
-                                     (uint16_t)lowest_kernel_version);
+      if (lowest_version > tpm_version) {
+        status = RollbackKernelWrite((uint32_t)lowest_version);
         if (0 != status) {
           VBDEBUG(("Error writing kernel versions to TPM.\n"));
           return (status == TPM_E_MUST_REBOOT ?
                   LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
         }
       }
     }
 
     /* Lock the kernel versions */
     status = RollbackKernelLock();
     if (0 != status) {
       VBDEBUG(("Error locking kernel versions.\n"));
       /* Don't reboot to recovery mode if we're already there */
       if (!is_rec)
         return (status == TPM_E_MUST_REBOOT ?
                 LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
     }
 
     /* Success! */
     return LOAD_KERNEL_SUCCESS;
   }
 
   // Handle error cases
   if (found_partitions)
     return LOAD_KERNEL_INVALID;
   else
     return LOAD_KERNEL_NOT_FOUND;
 }