diff options
| author | Ilias Apalodimas <[email protected]> | 2026-07-03 16:01:37 +0300 |
|---|---|---|
| committer | Heinrich Schuchardt <[email protected]> | 2026-07-16 00:40:43 +0200 |
| commit | e39e67c436e4c4bc416b3ce993a6def65fa2f75d (patch) | |
| tree | a58dbb0022cb8d3671d25a0a6b6144c72401f557 /lib | |
| parent | 1f4c391428e5ef17249ccf7af7f4648a73846e51 (diff) | |
efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set
PK, KEK, db, dbx etc must always be measured in PCR7.
DeployedMode and AuditMode should be measured in PCR1 if DeployedMode
is set and PCR7 otherwise.
Fix the u16_strcmp to only change the PCR value for those two variables.
Signed-off-by: Ilias Apalodimas <[email protected]>
Acked-by: Heinrich Schuchardt <[email protected]>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/efi_loader/efi_tcg2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 07637df7660..5f9bbe97455 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -1535,9 +1535,9 @@ static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev) if (!data && !secure_variables[i].accept_empty) continue; - if (u16_strcmp(u"DeployedMode", secure_variables[i].name)) + if (!u16_strcmp(u"DeployedMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; - if (u16_strcmp(u"AuditMode", secure_variables[i].name)) + if (!u16_strcmp(u"AuditMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index, |