Fix KeyBlockVerify() to take an explicit param for whether to use hash only.

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 150 matching lines @@
 
   if (is_normal) {
     /* Read current kernel key index from TPM.  Assumes TPM is already
      * initialized. */
     status = RollbackKernelRead(&tpm_version);
     if (0 != status) {
       VBDEBUG(("Unable to get kernel versions from TPM\n"));
       return (status == TPM_E_MUST_REBOOT ?
               LOAD_KERNEL_REBOOT : LOAD_KERNEL_RECOVERY);
     }
-  } else if (is_dev && !is_rec) {
-    /* In developer mode, we ignore the kernel subkey, and just use
-     * the SHA-512 hash to verify the key block. */
-    kernel_subkey = NULL;
   }
 
   do {
     /* Read GPT data */
     gpt.sector_bytes = (uint32_t)blba;
     gpt.drive_sectors = params->ending_lba + 1;
     if (0 != AllocAndReadGptData(&gpt)) {
       VBDEBUG(("Unable to read GPT data\n"));
       break;
     }
@@ skipping 23 matching lines @@
 
       /* Found at least one kernel partition. */
       found_partitions++;
 
       /* Read the first part of the kernel partition  */
       if (part_size < kbuf_sectors)
         continue;
       if (0 != BootDeviceReadLBA(part_start, kbuf_sectors, kbuf))
         continue;
 
-      /* Verify the key block */
+      /* Verify the key block.  In developer mode, we ignore the key
+       * and use only the SHA-512 hash to verify the key block. */
       key_block = (VbKeyBlockHeader*)kbuf;
-      if ((0 != KeyBlockVerify(key_block, KBUF_SIZE, kernel_subkey))) {
+      if ((0 != KeyBlockVerify(key_block, KBUF_SIZE, kernel_subkey,
+                               is_dev && !is_rec))) {
         VBDEBUG(("Verifying key block failed.\n"));
         continue;
       }
 
       /* Check the key block flags against the current boot mode in normal
        * and recovery modes (not in developer mode booting from SSD). */
       if (is_rec || is_normal) {
         if (!(key_block->key_block_flags &
               (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
                KEY_BLOCK_FLAG_DEVELOPER_0))) {
@@ skipping 175 matching lines @@
     /* Success! */
     return LOAD_KERNEL_SUCCESS;
   }
 
   // Handle error cases
   if (found_partitions)
     return LOAD_KERNEL_INVALID;
   else
     return LOAD_KERNEL_NOT_FOUND;
 }