From 62489adc36c5177f90ed16af936a4c0a992cea7e Mon Sep 17 00:00:00 2001
From: Lans Zhang <jia.zhang@windriver.com>
Date: Wed, 21 Sep 2016 11:17:29 +0800
Subject: [PATCH 11/11] Update verification_method if the loaded image is
 signed by shim/vendor cert

Upstream-Status: Pending

Also, if the loaded image is not verfied by cert, the validation process
should be allowed as well.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
---
 replacements.c | 2 +-
 shim.c         | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/replacements.c b/replacements.c
index 01eda0e..9ed5a5d 100644
--- a/replacements.c
+++ b/replacements.c
@@ -144,7 +144,7 @@ start_image(EFI_HANDLE image_handle, UINTN *exit_data_size, CHAR16 **exit_data)
 static EFI_STATUS EFIAPI
 exit_boot_services(EFI_HANDLE image_key, UINTN map_key)
 {
-	if (loader_is_participating || verification_method == VERIFIED_BY_HASH) {
+	if (loader_is_participating || verification_method != VERIFIED_BY_NOTHING) {
 		unhook_system_services();
 		EFI_STATUS status;
 		status = systab->BootServices->ExitBootServices(image_key, map_key);
diff --git a/shim.c b/shim.c
index 364784b..ef62145 100644
--- a/shim.c
+++ b/shim.c
@@ -1029,6 +1029,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 			       cert->Hdr.dwLength - sizeof(cert->Hdr),
 			       shim_cert, sizeof(shim_cert), sha256hash,
 			       SHA256_DIGEST_SIZE)) {
+			update_verification_method(VERIFIED_BY_CERT);
 			status = EFI_SUCCESS;
 			return status;
 		    }
@@ -1037,6 +1038,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 			    cert->Hdr.dwLength - sizeof(cert->Hdr),
 			    shim_cert, sizeof(shim_cert), sha1hash,
 			    SHA1_DIGEST_SIZE)) {
+			update_verification_method(VERIFIED_BY_CERT);
 			status = EFI_SUCCESS;
 			return status;
 		    }
@@ -1050,6 +1052,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 				       cert->Hdr.dwLength - sizeof(cert->Hdr),
 				       vendor_cert, vendor_cert_size,
 				       sha256hash, SHA256_DIGEST_SIZE)) {
+			update_verification_method(VERIFIED_BY_CERT);
 			status = EFI_SUCCESS;
 			return status;
 		    }
@@ -1058,6 +1061,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 					   cert->Hdr.dwLength - sizeof(cert->Hdr),
 					   vendor_cert, vendor_cert_size,
 					   sha1hash, SHA1_DIGEST_SIZE)) {
+			update_verification_method(VERIFIED_BY_CERT);
 			status = EFI_SUCCESS;
 			return status;
 		    }
-- 
2.11.0

