diff options
| -rw-r--r-- | firmware/lib/vboot_kernel.c | 8 | ||||
| -rw-r--r-- | tests/vboot_kernel_tests.c | 10 |
2 files changed, 11 insertions, 7 deletions
diff --git a/firmware/lib/vboot_kernel.c b/firmware/lib/vboot_kernel.c index 8703697e..bf919902 100644 --- a/firmware/lib/vboot_kernel.c +++ b/firmware/lib/vboot_kernel.c @@ -232,18 +232,14 @@ static vb2_error_t vb2_verify_kernel_vblock( VB2_KEYBLOCK_FLAG_DEVELOPER_1 : VB2_KEYBLOCK_FLAG_DEVELOPER_0))) { VB2_DEBUG("Keyblock developer flag mismatch.\n"); - keyblock_valid = 0; - if (need_keyblock_valid) - return VB2_ERROR_KERNEL_KEYBLOCK_DEV_FLAG; + return VB2_ERROR_KERNEL_KEYBLOCK_DEV_FLAG; } if (!(keyblock->keyblock_flags & ((ctx->flags & VB2_CONTEXT_RECOVERY_MODE) ? VB2_KEYBLOCK_FLAG_RECOVERY_1 : VB2_KEYBLOCK_FLAG_RECOVERY_0))) { VB2_DEBUG("Keyblock recovery flag mismatch.\n"); - keyblock_valid = 0; - if (need_keyblock_valid) - return VB2_ERROR_KERNEL_KEYBLOCK_REC_FLAG; + return VB2_ERROR_KERNEL_KEYBLOCK_REC_FLAG; } /* Check for rollback of key version except in recovery mode. */ diff --git a/tests/vboot_kernel_tests.c b/tests/vboot_kernel_tests.c index 01b8b342..2cae6d14 100644 --- a/tests/vboot_kernel_tests.c +++ b/tests/vboot_kernel_tests.c @@ -705,7 +705,15 @@ static void LoadKernelTest(void) TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND, "Keyblock rec!dev flag mismatch"); - /* Check keyblock flag mismatches (dev mode + signed kernel required) */ + /* Check keyblock flag mismatch (dev mode) */ + ResetMocks(); + ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE; + kbh.keyblock_flags = + VB2_KEYBLOCK_FLAG_RECOVERY_1 | VB2_KEYBLOCK_FLAG_DEVELOPER_0; + TestLoadKernel(VB2_ERROR_LK_INVALID_KERNEL_FOUND, + "Keyblock dev flag mismatch"); + + /* Check keyblock flag mismatch (dev mode + signed kernel required) */ ResetMocks(); ctx->flags |= VB2_CONTEXT_DEVELOPER_MODE; vb2_nv_set(ctx, VB2_NV_DEV_BOOT_SIGNED_ONLY, 1); |