Open korran opened 10 months ago
Only the FMC image digest is compared for differentiation during Update Reset and not the svn, so the test succeeding is expected. Also, the FMC svn from the updated firmware is not stored in the data vault (since FMC is expected to remain the same). For logging to the PCR log, the FMC svn is picked from the data vault, hence the old value is seen in the PCR log.
I think this is harmless with how the ROM is now, but could be a trap for future changes.
info.fmc.svn
is NEW_FMC_SVN
from the test. I confirmed that the ROM doesn't do anything with this value today (preferring the value from the datavault). However, having this incorrect value floating around for someone to use by mistake in the future is a bit error-prone. I think a decent argument can be made for failing the update if any of the FMC fields in the image header change. Maybe not for 1.0 though...
"I think a decent argument can be made for failing the update if any of the FMC fields in the image header change. Maybe not for 1.0 though..."
Fair point. We'll revisit this for 2.0. Added the 2.0 tag to this.
I noticed something interesting last week. This test passes when it probably shouldn't: