Description of problem:

On Dell hardware (at least PowerEdge T340 with BIOS 2.6.3), when selecting option "TPM 1.2 On without Pre-Boot Measurements" in the UEFI firmware, Shim refuses to boot the system the system because the call of mirror_one_mok_variable() function on MokListRT, MokListXRT and SbatLevelRT fails.

Actually the failure is not when creating the variables, but calling tpm_log_event() (line 819):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
 532 static EFI_STATUS NONNULL(1)
 533 mirror_one_mok_variable(struct mok_state_variable *v,
 534                         BOOLEAN only_first)
 535 {
 :
 544         BOOLEAN log = v->flags & MOK_VARIABLE_LOG;
 :
 812                 if (log) {
 813                         /*
 814                          * Log this variable into whichever PCR the table
 815                          * says.
 816                          */
 817                         EFI_PHYSICAL_ADDRESS datap =
 818                                         (EFI_PHYSICAL_ADDRESS)(UINTN)FullData,
 819                         efi_status = tpm_log_event(datap, FullDataSize,
 820                                                    v->pcr, (CHAR8 *)v->name8);
 821                         if (EFI_ERROR(efi_status)) {
 822                                 dprint(L"tpm_log_event(0x%llx, %lu, %lu, \"%s\")->%r\n",
 823                                        FullData, FullDataSize, v->pcr, v->name,
 824                                        efi_status);
 825                                 return efi_status;
 826                         }
 827                 }
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Verbose mode snippet:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
mok.c:358:mirror_mok_db() SetVariable("MokListRT", ... varsz=0x826) = Success
mok.c:792:mirror_one_mok_variable() mirror_mok_db("MokListRT",  datasz=2086) returned Success
mok.c:823:mirror_one_mok_variable() tpm_log_event(0x5C506020, 2086, 14, "MokList")->Unsupported
Could not create MokListRT: Unsupported
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Talking to Javier, he believes that having tpm_log_event() fail should NOT make the mirror_one_mok_variable() function fail, exactly as the code in Grub does (i.e. ignore errors at TPM level):
see patch https://src.fedoraproject.org/rpms/grub2/raw/rawhide/f/0152-tpm-Don-t-propagate-TPM-measurement-errors-to-the-ve.patch


Version-Release number of selected component (if applicable):

All shim releases, customer reproduces with latest for RHEL8.4 (shim-x64-15.4-2.el8_1.x86_64)


How reproducible:

Always on customer system, I don't have the hardware to test myself.