Add TPM version checking

firmware/lib/vboot_firmware.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * High-level firmware API for loading and verifying rewritable firmware.
  * (Firmware portion)
  */
 
 #include "gbb_header.h"
 #include "load_firmware_fw.h"
@@ skipping 107 matching lines @@
   if (0 != status) {
     VBDEBUG(("Unable to setup TPM and read stored versions.\n"));
     VBPERFEND("VB_TPMI");
     if (status == TPM_E_MUST_REBOOT)
       retval = LOAD_FIRMWARE_REBOOT;
     else
       recovery = VBNV_RECOVERY_RO_TPM_ERROR;
     goto LoadFirmwareExit;
   }
   shared->fw_version_tpm_start = tpm_version;
+  shared->fw_version_tpm = tpm_version;
   VBPERFEND("VB_TPMI");
 
   /* Read try-b count and decrement if necessary */
   VbNvGet(vnc, VBNV_TRY_B_COUNT, &try_b_count);
   if (0 != try_b_count) {
     VbNvSet(vnc, VBNV_TRY_B_COUNT, try_b_count - 1);
     shared->flags |= VBSD_FWB_TRIED;
   }
   VbNvSet(vnc, VBNV_TRIED_FIRMWARE_B, try_b_count ? 1 : 0);
 
@@ skipping 202 matching lines @@
       status = RollbackFirmwareWrite((uint32_t)lowest_version);
       VBPERFEND("VB_TPMU");
       if (0 != status) {
         VBDEBUG(("Unable to write stored versions.\n"));
         if (status == TPM_E_MUST_REBOOT)
           retval = LOAD_FIRMWARE_REBOOT;
         else
           recovery = VBNV_RECOVERY_RO_TPM_ERROR;
         goto LoadFirmwareExit;
       }
+      shared->fw_version_tpm = (uint32_t)lowest_version;
     }
 
     /* Lock firmware versions in TPM */
     VBPERFSTART("VB_TPML");
     status = RollbackFirmwareLock();
     VBPERFEND("VB_TPML");
     if (0 != status) {
       VBDEBUG(("Unable to lock firmware versions.\n"));
       if (status == TPM_E_MUST_REBOOT)
         retval = LOAD_FIRMWARE_REBOOT;
@@ skipping 36 matching lines @@
   uint32_t status = RollbackS3Resume();
 
   /* If we can't resume, just do a full reboot.  No need to go to recovery
    * mode here, since if the TPM is really broken we'll catch it on the
    * next boot. */
   if (status == TPM_SUCCESS)
     return LOAD_FIRMWARE_SUCCESS;
   else
     return LOAD_FIRMWARE_REBOOT;
 }