stub: measure SMBIOS kernel-cmdline-extra in PCR12

PCR1, where SMBIOS strings are measured, is filled with data that is not
under the control of the machine owner. Measure cmdline extensions in
PCR12 too, where we measure other optional addons that are loaded by
sd-stub.

src/boot/efi/stub.c

@@ -277,11 +277,17 @@ static EFI_STATUS run(EFI_HANDLE image) {
                 mangle_stub_cmdline(cmdline);
         }
 
-        /* SMBIOS strings are measured in PCR1, so we do not re-measure these command line extensions. */
         const char *extra = smbios_find_oem_string("io.systemd.stub.kernel-cmdline-extra");
         if (extra) {
                 _cleanup_free_ char16_t *tmp = TAKE_PTR(cmdline), *extra16 = xstr8_to_16(extra);
                 cmdline = xasprintf("%ls %ls", tmp, extra16);
+
+                /* SMBIOS strings are measured in PCR1, but we also want to measure them in our specific
+                 * PCR12, as firmware-owned PCRs are very difficult to use as they'll contain unpredictable
+                 * measurements that are not under control of the machine owner. */
+                m = false;
+                (void) tpm_log_load_options(extra16, &m);
+                parameters_measured = parameters_measured < 0 ? m : (parameters_measured && m);
         }
 
         export_variables(loaded_image);