[coreboot-gerrit] Change in ...coreboot[master]: security/vboot: Add measured boot mode

[Julius Werner (Code Review)]

Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/29547 )

Change subject: security/vboot: Add measured boot mode
......................................................................

Patch Set 43: Code-Review-1

(1 comment)

Can you please respond to my comments from Patch Set 36 before pushing this in? Not saying you have to go for every vague idea, but most of them haven't been addressed at all yet, even simple fixes.

https://review.coreboot.org/#/c/29547/43/src/lib/prog_ops.c 
File src/lib/prog_ops.c:

https://review.coreboot.org/#/c/29547/43/src/lib/prog_ops.c@42 
PS43, Line 42: 	if (!ENV_BOOTBLOCK && !ENV_DECOMPRESSOR &&
Note that ENV_BOOTBLOCK will be set if VBOOT_STARTS_IN_BOOTBLOCK and !VBOOT_SEPARATE_VERSTAGE, and then you won't measure the romstage. A better test might be

if (IS_ENABLED(...) && vb2_logic_executed())