[coreboot-gerrit] Change in coreboot[master]: security/vboot: Decouple measured boot from verified boot

[Philipp Deppenwiese (Code Review)]

Philipp Deppenwiese has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/35077 )

Change subject: security/vboot: Decouple measured boot from verified boot
......................................................................

Patch Set 72:

(1 comment)

I understand the approach of decopupling measured boot from vboot in order to support other use cases. What I don't understand is why we need to extend measurements from the TCPA log into the TPM. If the measurements are done before? BTW it took me months to get my stuff merged in the past. I went on a vacation for a week and we don't have time to wait for another?

https://review.coreboot.org/c/coreboot/+/35077/72/src/security/tpm/tspi/log.... 
File src/security/tpm/tspi/log.c:

https://review.coreboot.org/c/coreboot/+/35077/72/src/security/tpm/tspi/log.... 
PS72, Line 115: 			int result = tlcl_extend(tce->pcr,
Please explain me why we need to extend measurements which are already extended into a TPM again by using the unsafe and optional TCPA log?