tree bde17547a518c1fe19dfdab300a13fd3af2c1f9e
parent 759d5c4ccda67308695d09f3448e3edb1910dd53
author Hung-Te Lin <hungte@chromium.org> 1322810830 +0800
committer Gerrit <chrome-bot@google.com> 1323096156 -0800

vboot_reference: sanity check firmware A/B content when resigning

If the FW_A and FW_B contents are the same, we should not resign with
DEV/NORM keyblocks.

BUG=chrome-os-partner:6942
TEST=(to sign) ./resign_firmwarefd.sh bios.bin new.bin \
	       ../../tests/devkeys/firmware_data_key.vbprivk
	       ../../tests/devkeys/firmware.keyblock \
	       ../../tests/devkeys/dev_firmware_data_key.vbprivk \
	       ../../tests/devkeys/dev_firmware.keyblock \
	       ../../tests/devkeys/kernel_subkey.vbpubk
     (to verify) dump_fmap -x new.bin
                 vbutil_keyblock --unpack VBLOCK_A | grep Flags
                 vbutil_keyblock --unpack VBLOCK_B | grep Flags
     When the input (bios.bin) have DEV FW (ex, zgb/alex), then output
     is A=6, B=7; when the input is old or new firmware without DEV
     (ex, mario/s*y/l*y), output is A=7, B=7, and you'lll see
     "Found firmware with same A/B content - ignore DEV keyblock."
     meessage during resign process.

Change-Id: I10cbbf7370f35a40673b328b70c83e7d1213a45d
Reviewed-on: https://gerrit.chromium.org/gerrit/12371
Commit-Ready: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
Tested-by: Hung-Te Lin <hungte@chromium.org>