From e39e67c436e4c4bc416b3ce993a6def65fa2f75d Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Fri, 3 Jul 2026 16:01:37 +0300 Subject: efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set PK, KEK, db, dbx etc must always be measured in PCR7. DeployedMode and AuditMode should be measured in PCR1 if DeployedMode is set and PCR7 otherwise. Fix the u16_strcmp to only change the PCR value for those two variables. Signed-off-by: Ilias Apalodimas Acked-by: Heinrich Schuchardt --- lib/efi_loader/efi_tcg2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c index 07637df7660..5f9bbe97455 100644 --- a/lib/efi_loader/efi_tcg2.c +++ b/lib/efi_loader/efi_tcg2.c @@ -1535,9 +1535,9 @@ static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev) if (!data && !secure_variables[i].accept_empty) continue; - if (u16_strcmp(u"DeployedMode", secure_variables[i].name)) + if (!u16_strcmp(u"DeployedMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; - if (u16_strcmp(u"AuditMode", secure_variables[i].name)) + if (!u16_strcmp(u"AuditMode", secure_variables[i].name)) secure_variables[i].pcr_index = deployed_audit_pcr_index; ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index, -- cgit v1.3.1