From bc1e30ee1e7940e0e70eab9afd55b6e355ef9899 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Sat, 21 Jul 2018 03:27:26 +0200
Subject: [PATCH] Add vendor_esl

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
---
 Makefile |  3 +++
 cert.S   | 30 ++++++++++++++++++++++++++++++
 shim.c   | 36 +++++++++++++++++++++++++++++++++++-
 3 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 6ece282..78688e0 100644
--- a/Makefile
+++ b/Makefile
@@ -82,6 +82,9 @@ endif
 ifneq ($(origin VENDOR_CERT_FILE), undefined)
 	CFLAGS += -DVENDOR_CERT_FILE=\"$(VENDOR_CERT_FILE)\"
 endif
+ifneq ($(origin VENDOR_ESL_FILE), undefined)
+	CFLAGS += -DVENDOR_ESL_FILE=\"$(VENDOR_ESL_FILE)\"
+endif
 ifneq ($(origin VENDOR_DBX_FILE), undefined)
 	CFLAGS += -DVENDOR_DBX_FILE=\"$(VENDOR_DBX_FILE)\"
 endif
diff --git a/cert.S b/cert.S
index cfc4525..7ad782a 100644
--- a/cert.S
+++ b/cert.S
@@ -8,12 +8,18 @@ cert_table:
 #else
 	.long	0
 #endif
+#if defined(VENDOR_ESL_FILE)
+	.long	vendor_esl_priv_end - vendor_esl_priv
+#else
+	.long	0
+#endif
 #if defined(VENDOR_DBX_FILE)
 	.long	vendor_dbx_priv_end - vendor_dbx_priv
 #else
 	.long	0
 #endif
 	.long	vendor_cert_priv - cert_table
+	.long	vendor_esl_priv - cert_table
 	.long	vendor_dbx_priv - cert_table
 #if defined(VENDOR_CERT_FILE)
 	.data
@@ -39,6 +45,30 @@ vendor_cert_priv:
 	.section .vendor_cert, "a", %progbits
 vendor_cert_priv_end:
 #endif
+#if defined(VENDOR_ESL_FILE)
+	.data
+	.align	1
+	.type	vendor_esl_priv, %object
+	.size	vendor_esl_priv, vendor_esl_priv_end-vendor_esl_priv
+	.section .vendor_cert, "a", %progbits
+vendor_esl_priv:
+.incbin VENDOR_ESL_FILE
+vendor_esl_priv_end:
+#else
+	.bss
+	.type	vendor_esl_priv, %object
+	.size	vendor_esl_priv, 1
+	.section .vendor_cert, "a", %progbits
+vendor_esl_priv:
+	.zero	1
+
+	.data
+	.align 4
+	.type	vendor_esl_size_priv, %object
+	.size	vendor_esl_size_priv, 4
+	.section .vendor_cert, "a", %progbits
+vendor_esl_priv_end:
+#endif
 #if defined(VENDOR_DBX_FILE)
 	.data
 	.align	1
diff --git a/shim.c b/shim.c
index f8a1e67..d99134f 100644
--- a/shim.c
+++ b/shim.c
@@ -84,14 +84,18 @@ EFI_GUID SHIM_LOCK_GUID = { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8,
  */
 extern struct {
 	UINT32 vendor_cert_size;
+	UINT32 vendor_esl_size;
 	UINT32 vendor_dbx_size;
 	UINT32 vendor_cert_offset;
+	UINT32 vendor_esl_offset;
 	UINT32 vendor_dbx_offset;
 } cert_table;
 
 UINT32 vendor_cert_size;
+UINT32 vendor_esl_size;
 UINT32 vendor_dbx_size;
 UINT8 *vendor_cert;
+UINT8 *vendor_esl;
 UINT8 *vendor_dbx;
 
 /*
@@ -1029,6 +1033,18 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 			return status;
 		}
 
+		/*
+		 * Check if there's a vendor ESL built-in
+		 */
+		if (vendor_esl_size &&
+			check_db_cert_in_ram((EFI_SIGNATURE_LIST*)vendor_esl,
+					     vendor_esl_size,
+					     cert,
+					     sha256hash) == DATA_FOUND) {
+			status = EFI_SUCCESS;
+			return status;
+		}
+
 		/*
 		 * And finally, check against shim's built-in key
 		 */
@@ -1973,6 +1989,22 @@ EFI_STATUS mirror_mok_list()
 
 		CertData->SignatureOwner = SHIM_LOCK_GUID;
 		CopyMem(p, vendor_cert, vendor_cert_size);
+	} else if (vendor_esl_size) {
+		FullDataSize = DataSize
+			     + vendor_esl_size
+			     ;
+		FullData = AllocatePool(FullDataSize);
+		if (!FullData) {
+			perror(L"Failed to allocate space for MokListRT\n");
+			return EFI_OUT_OF_RESOURCES;
+		}
+		p = FullData;
+
+		if (efi_status == EFI_SUCCESS && DataSize > 0) {
+			CopyMem(p, Data, DataSize);
+			p += DataSize;
+		}
+		CopyMem(p, vendor_esl, vendor_esl_size);
 	} else {
 		FullDataSize = DataSize;
 		FullData = Data;
@@ -2606,7 +2638,7 @@ shim_init(void)
 	set_second_stage (global_image_handle);
 
 	if (secure_mode()) {
-		if (vendor_cert_size || vendor_dbx_size) {
+		if (vendor_cert_size || vendor_esl_size || vendor_dbx_size) {
 			/*
 			 * If shim includes its own certificates then ensure
 			 * that anything it boots has performed some
@@ -2706,8 +2738,10 @@ efi_main (EFI_HANDLE passed_image_handle, EFI_SYSTEM_TABLE *passed_systab)
 	verification_method = VERIFIED_BY_NOTHING;
 
 	vendor_cert_size = cert_table.vendor_cert_size;
+	vendor_esl_size = cert_table.vendor_esl_size;
 	vendor_dbx_size = cert_table.vendor_dbx_size;
 	vendor_cert = (UINT8 *)&cert_table + cert_table.vendor_cert_offset;
+	vendor_esl = (UINT8 *)&cert_table + cert_table.vendor_esl_offset;
 	vendor_dbx = (UINT8 *)&cert_table + cert_table.vendor_dbx_offset;
 
 	/*
-- 
2.18.0