vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set

Browse Source 
PK, KEK, db, dbx etc must always be measured in PCR7.
DeployedMode and AuditMode should be measured in PCR1 if DeployedMode
is set and PCR7  otherwise.

Fix the u16_strcmp to only change the PCR value for those two variables.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
This commit is contained in:
Ilias Apalodimas
2026-07-16 00:40:43 +02:00
committed by Heinrich Schuchardt
parent 1f4c391428
commit e39e67c436
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/efi_loader/efi_tcg2.c
+2 -2
View File
@@ -1535,9 +1535,9 @@ static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev)
if (!data && !secure_variables[i].accept_empty)
continue;
if (u16_strcmp(u"DeployedMode", secure_variables[i].name))
if (!u16_strcmp(u"DeployedMode", secure_variables[i].name))
secure_variables[i].pcr_index = deployed_audit_pcr_index;
if (u16_strcmp(u"AuditMode", secure_variables[i].name))
if (!u16_strcmp(u"AuditMode", secure_variables[i].name))
secure_variables[i].pcr_index = deployed_audit_pcr_index;
ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index,