[coreboot-gerrit] Change in coreboot[master]: security/vboot: Decouple measured boot from verified boot

[Bill XIE (Code Review)]

Bill XIE has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/35077 )

Change subject: security/vboot: Decouple measured boot from verified boot
......................................................................

Patch Set 33:

(1 comment)

https://review.coreboot.org/c/coreboot/+/35077/27/src/security/vboot/vboot_l... 
File src/security/vboot/vboot_logic.c:

https://review.coreboot.org/c/coreboot/+/35077/27/src/security/vboot/vboot_l... 
PS27, Line 329: 	if (CONFIG(TSPI_MEASURED_BOOT) &&
              : 		!(ctx->flags & VB2_CONTEXT_S3_RESUME)) {
              : 		if (tspi_init_crtm() != VB2_SUCCESS)
> What if we want to use TSPI_MEASURED_BOOT without VBOOT?  Isn't that the whole point of this CL?

I have no good idea now. I may have to conclude that TSPI_MEASURED_BOOT cannot be decoupled from VBOOT on platforms require VBOOT_SEPARATE_VERSTAGE, for their space for bootblock is too small.