Add crossystem support for nvram_cleared and kern_nv

firmware/lib/vboot_firmware.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * High-level firmware API for loading and verifying rewritable firmware.
  * (Firmware portion)
  */
 
 #include "load_firmware_fw.h"
 #include "rollback_index.h"
@@ skipping 98 matching lines @@
   for (i = 0; i < 2; i++) {
     VbKeyBlockHeader* key_block;
     uint64_t vblock_size;
     VbFirmwarePreambleHeader* preamble;
     RSAPublicKey* data_key;
     uint64_t key_version;
     uint64_t combined_version;
     uint8_t* body_digest;
 
     /* If try B count is non-zero try firmware B first */
-    index = (try_b_count ? i : 1 - i);
-
-    /* Verify the key block */
-    VBPERFSTART("VB_VKB");
+    index = (try_b_count ? 1 - i : i);
     if (0 == index) {
       key_block = (VbKeyBlockHeader*)params->verification_block_0;
       vblock_size = params->verification_size_0;
     } else {
       key_block = (VbKeyBlockHeader*)params->verification_block_1;
       vblock_size = params->verification_size_1;
     }
-    if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) {
-      VBDEBUG(("Key block verification failed.\n"));
-      VBPERFEND("VB_VKB");
-      continue;
-    }
-    VBPERFEND("VB_VKB");
 
-    /* Check the key block flags against the current boot mode. */
+    /* Check the key block flags against the current boot mode.  Do this
+     * before verifying the key block, since flags are faster to check than
+     * the RSA signature. */
     if (!(key_block->key_block_flags &
           (is_dev ? KEY_BLOCK_FLAG_DEVELOPER_1 :
            KEY_BLOCK_FLAG_DEVELOPER_0))) {
       VBDEBUG(("Developer flag mismatch.\n"));
       continue;
     }
     /* RW firmware never runs in recovery mode. */
     if (!(key_block->key_block_flags & KEY_BLOCK_FLAG_RECOVERY_0)) {
       VBDEBUG(("Recovery flag mismatch.\n"));
       continue;
     }
 
+    /* Verify the key block */
+    VBPERFSTART("VB_VKB");
+    if ((0 != KeyBlockVerify(key_block, vblock_size, root_key, 0))) {
+      VBDEBUG(("Key block verification failed.\n"));
+      VBPERFEND("VB_VKB");
+      continue;
+    }
+    VBPERFEND("VB_VKB");
+
     /* Check for rollback of key version. */
     key_version = key_block->data_key.key_version;
     if (key_version < (tpm_version >> 16)) {
       VBDEBUG(("Key rollback detected.\n"));
       continue;
     }
 
     /* Get the key for preamble/data verification from the key block. */
     data_key = PublicKeyToRSA(&key_block->data_key);
     if (!data_key) {
@@ skipping 161 matching lines @@
   uint32_t status = RollbackS3Resume();
 
   /* If we can't resume, just do a full reboot.  No need to go to recovery
    * mode here, since if the TPM is really broken we'll catch it on the
    * next boot. */
   if (status == TPM_SUCCESS)
     return LOAD_FIRMWARE_SUCCESS;
   else
     return LOAD_FIRMWARE_REBOOT;
 }