vboot: Use kernel max rollforward NV storage field

Kernel verification will now roll forward the minimum allowable
version in the TPM no farther than the kernel_max_rollforward setting.

Note that CL:765573 changes chromeos-setgoodkernel so it always sets
kernel_max_rollforward to 0xfffffffe when marking a kernel as good.
That ensures that firmware with this setting will behave the same for
now as existing firmware.

TEST=make runtests
     Manual testing:
     crossystem tpm_kernvel --> print current kernel version in TPM
     - Resign the kernel with a higher version
     - Reboot
     - Wait a minute for chromeos-setgoodkernel to run
     crossystem kernel_max_rollforward=0
     - Reboot
     crossystem tpm_kernvel --> has not changed
     - Wait a minute for chromeos-setgoodkernel to run
     crossystem kernel_max_rollforward -> 0xfffffffe
     - Reboot
     crossystem tpm_kernvel --> has changed to the higher version

Change-Id: Ia32ecb7fa4078548cd311541ccbe120570cf1bc5
Reviewed-on: https://chromium-review.googlesource.com/765574
Commit-Ready: Randall Spangler <rspangler@chromium.org>
Tested-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@google.com>
2 files changed