efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set

PK, KEK, db, dbx etc must always be measured in PCR7.
DeployedMode and AuditMode should be measured in PCR1 if DeployedMode
is set and PCR7  otherwise.

Fix the u16_strcmp to only change the PCR value for those two variables.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index 07637df7660b2be7070952bcf388578a4667536d..5f9bbe974555772d1335043716a1c098f2f8796f 100644 (file)
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -1535,9 +1535,9 @@ static efi_status_t tcg2_measure_secure_boot_variable(struct udevice *dev)
                if (!data && !secure_variables[i].accept_empty)
                        continue;
 
-               if (u16_strcmp(u"DeployedMode", secure_variables[i].name))
+               if (!u16_strcmp(u"DeployedMode", secure_variables[i].name))
                        secure_variables[i].pcr_index = deployed_audit_pcr_index;
-               if (u16_strcmp(u"AuditMode", secure_variables[i].name))
+               if (!u16_strcmp(u"AuditMode", secure_variables[i].name))
                        secure_variables[i].pcr_index = deployed_audit_pcr_index;
 
                ret = tcg2_measure_variable(dev, secure_variables[i].pcr_index,