[coreboot-gerrit] Change in coreboot[master]: security/vboot: Decouple measured boot from verified boot

[Bill XIE (Code Review)]

Bill XIE has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/35077 )

Change subject: security/vboot: Decouple measured boot from verified boot
......................................................................

Patch Set 33:

(2 comments)

https://review.coreboot.org/c/coreboot/+/35077/27/src/lib/bootblock.c 
File src/lib/bootblock.c:

https://review.coreboot.org/c/coreboot/+/35077/27/src/lib/bootblock.c@73 
PS27, Line 73: !CONFIG(VBOOT) && CONFIG(TSPI_MEASURED_BOOT)
> Why can't we just run this unconditionally here, and remove the call from verstage?

Reverted to this, for what is observed in https://qa.coreboot.org/job/coreboot-gerrit/112654/

https://review.coreboot.org/c/coreboot/+/35077/27/src/security/vboot/vboot_l... 
File src/security/vboot/vboot_logic.c:

https://review.coreboot.org/c/coreboot/+/35077/27/src/security/vboot/vboot_l... 
PS27, Line 329: 	if (CONFIG(TSPI_MEASURED_BOOT) &&
              : 		!(ctx->flags & VB2_CONTEXT_S3_RESUME)) {
              : 		if (tspi_init_crtm() != VB2_SUCCESS)
> Done

It seems that we cannot, for some platform has limited bootblock size, see https://qa.coreboot.org/job/coreboot-gerrit/112654/