only update tpm if version if not default value

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
 #include "boot_device.h"
 #include "cgptlib.h"
 #include "cgptlib_internal.h"
 #include "gbb_header.h"
 #include "load_kernel_fw.h"
 #include "rollback_index.h"
 #include "utility.h"
 #include "vboot_common.h"
 
 #define KBUF_SIZE 65536  /* Bytes to read at start of kernel partition */
+#define LOWEST_TPM_VERSION 0xffffffff
 
 typedef enum BootMode {
   kBootNormal,   /* Normal firmware */
   kBootDev,      /* Dev firmware AND dev switch is on */
   kBootRecovery  /* Recovery firmware, regardless of dev switch position */
 } BootMode;
 
 
 /* Allocates and reads GPT data from the drive.  The sector_bytes and
  * drive_sectors fields should be filled on input.  The primary and
@@ skipping 94 matching lines @@
   VbPublicKey* kernel_subkey;
   GptData gpt;
   uint64_t part_start, part_size;
   uint64_t blba;
   uint64_t kbuf_sectors;
   uint8_t* kbuf = NULL;
   int found_partitions = 0;
   int good_partition = -1;
   int good_partition_key_block_valid = 0;
   uint32_t tpm_version = 0;
-  uint64_t lowest_version = 0xFFFFFFFF;
+  uint64_t lowest_version = LOWEST_TPM_VERSION;
   int rec_switch, dev_switch;
   BootMode boot_mode;
   uint32_t status;
 
   /* TODO: differentiate between finding an invalid kernel (found_partitions>0)
    * and not finding one at all.  Right now we treat them the same, and return
    * LOAD_KERNEL_INVALID for both. */
   int retval = LOAD_KERNEL_INVALID;
   int recovery = VBNV_RECOVERY_RO_UNSPECIFIED;
 
@@ skipping 203 matching lines @@
           if (kBootDev != boot_mode)
             goto bad_kernel;
         }
       }
 
       VBDEBUG(("Kernel preamble is good.\n"));
 
       /* Check for lowest version from a valid header. */
       if (key_block_valid && lowest_version > combined_version)
         lowest_version = combined_version;
+      else {
+        VBDEBUG(("Key block valid: %d\n", key_block_valid));
+        VBDEBUG(("Combined version: %" PRIu64 "\n", combined_version));
+      }
 
       /* If we already have a good kernel, no need to read another
        * one; we only needed to look at the versions to check for
        * rollback.  So skip to the next kernel preamble. */
       if (-1 != good_partition)
         continue;
 
       /* Verify body load address matches what we expect */
       if ((preamble->body_load_address != (size_t)params->kernel_buffer) &&
           !(params->boot_flags & BOOT_FLAG_SKIP_ADDR_CHECK)) {
@@ skipping 106 matching lines @@
     VBDEBUG(("Good_partition >= 0\n"));
 
     /* See if we need to update the TPM */
     if (kBootRecovery != boot_mode && good_partition_key_block_valid) {
       /* We only update the TPM in normal and developer boot modes.  In
        * developer mode, we only advanced lowest_version for kernels with valid
        * key blocks, and didn't count self-signed key blocks.  In recovery
        * mode, the TPM stays PP-unlocked, so anything we write gets blown away
        * by the firmware when we go back to normal mode. */
       VBDEBUG(("Boot_flags = not recovery\n"));
-      if (lowest_version > tpm_version) {
+
+      if ((lowest_version > tpm_version) &&
+          (lowest_version != LOWEST_TPM_VERSION)) {
         status = RollbackKernelWrite((uint32_t)lowest_version);
         if (0 != status) {
           VBDEBUG(("Error writing kernel versions to TPM.\n"));
           if (status == TPM_E_MUST_REBOOT)
             retval = LOAD_KERNEL_REBOOT;
           else
             recovery = VBNV_RECOVERY_RW_TPM_ERROR;
           goto LoadKernelExit;
         }
       }
@@ skipping 26 matching lines @@
   VbNvSet(vnc, VBNV_RECOVERY_REQUEST, LOAD_KERNEL_RECOVERY == retval ?
           recovery : VBNV_RECOVERY_NOT_REQUESTED);
   VbNvTeardown(vnc);
 
   /* Store how much shared data we used, if any */
   if (shared)
     params->shared_data_size = shared->data_used;
 
   return retval;
 }