Support dev vs consumer firmware in vboot_reference

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 128 matching lines @@
 
   /* Initialization */
   kernel_subkey = (VbPublicKey*)params->header_sign_key_blob;
   blba = params->bytes_per_lba;
   kbuf_sectors = KBUF_SIZE / blba;
   if (0 == kbuf_sectors) {
     VBDEBUG(("LoadKernel() called with sector size > KBUF_SIZE\n"));
     return LOAD_KERNEL_INVALID;
   }
 
-  is_dev = (BOOT_FLAG_DEVELOPER & params->boot_flags ? 1 : 0);
   is_rec = (BOOT_FLAG_RECOVERY & params->boot_flags ? 1 : 0);
+  if (is_rec || (BOOT_FLAG_DEV_FIRMWARE & params->boot_flags)) {
+    /* Recovery or developer firmware, so accurately represent the
+     * state of the developer switch for the purposes of verified boot. */
+    is_dev = (BOOT_FLAG_DEVELOPER & params->boot_flags ? 1 : 0);
+  } else {
+    /* Normal firmware always does a fully verified boot regardless of
+     * the state of the developer switch. */
+    is_dev = 0;
+  }
   is_normal = (!is_dev && !is_rec);
 
   /* Clear output params in case we fail */
   params->partition_number = 0;
   params->bootloader_address = 0;
   params->bootloader_size = 0;
 
   /* Let the TPM know if we're in recovery mode */
   if (is_rec) {
     if (0 != RollbackKernelRecovery(is_dev)) {
@@ skipping 278 matching lines @@
     return LOAD_KERNEL_SUCCESS;
   }
 
   /* The BIOS may attempt to display different screens depending on whether
    * we find an invalid kernel partition (return LOAD_KERNEL_INVALID) or not.
    * But the flow is changing, so for now treating both cases as invalid gives
    * slightly less confusing user feedback. Sigh.
    */
   return LOAD_KERNEL_INVALID;
 }