PK, KEK, db, dbx etc must always be measured in PCR7. DeployedMode and AuditMode should be measured in PCR1 if DeployedMode is set and PCR7 otherwise.
Fix the u16_strcmp to only change the PCR value for those two variables. Signed-off-by: Ilias Apalodimas <[email protected]> --- lib/efi_loader/efi_tcg2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 07637df7660b..5f9bbe974555 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -1535,9 +1535,9 @@ static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev) if (!data && !secure_variables[i].accept_empty) continue; - if (u16_strcmp(u"DeployedMode", secure_variables[i].name)) + if (!u16_strcmp(u"DeployedMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; - if (u16_strcmp(u"AuditMode", secure_variables[i].name)) + if (!u16_strcmp(u"AuditMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index, -- 2.53.0
