[coreboot-gerrit] Change in ...coreboot[master]: security/vboot: Add measured boot mode

[Werner Zeh (Code Review)]

Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/29547 )

Change subject: security/vboot: Add measured boot mode
......................................................................

Patch Set 55:

(1 comment)

I still dislike the idea of CBFS files being measured every go they are accessed. This will lead hashing the same file multiple times.

https://review.coreboot.org/#/c/29547/55/src/security/vboot/vboot_crtm.h 
File src/security/vboot/vboot_crtm.h:

https://review.coreboot.org/#/c/29547/55/src/security/vboot/vboot_crtm.h@47 
PS55, Line 47: #define TPM_DATA_PCR 6
> I'm honestly still a bit confused by what logic you're splitting up these PCRs. […]

There is one valid case for spliting up PCRs, at least a bit. There might be configuration data inside cbfs which should not be measured in the same PCR like runtime code. So just smashing everything into one single PCR would be counterproductive.