File fwupdate-bsc1182057-add-sbat-support.patch of Package fwupdate.24670

From 21a2041ffe301ee32d26f0486123194f0f00342c Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com>
Date: Wed, 24 Feb 2021 16:45:40 +0800
Subject: [PATCH] Add SBAT Support to EFI binaries

Signed-off-by: Gary Lin <glin@suse.com>
---
 data/sbat.csv           |  2 ++
 efi/Makefile            | 13 ++++++++++---
 efi/elf_aarch64_efi.lds | 10 ++++++++++
 efi/elf_ia32_efi.lds    |  8 ++++++++
 efi/elf_x86_64_efi.lds  |  8 ++++++++
 5 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 data/sbat.csv

diff --git a/data/sbat.csv b/data/sbat.csv
new file mode 100644
index 0000000..6a4ecb3
--- /dev/null
+++ b/data/sbat.csv
@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+fwupdate,1,Firmware Update Utility,fwupdate,9,https://github.com/rhboot/fwupdate
diff --git a/efi/Makefile b/efi/Makefile
index 26d9357..9aa11f5 100644
--- a/efi/Makefile
+++ b/efi/Makefile
@@ -3,6 +3,7 @@ default : all
 TOPDIR	?= $(shell pwd)/..
 include $(TOPDIR)/Make.version
 include $(TOPDIR)/Make.defaults
+SBATPATH ?= $(TOPDIR)/data/sbat.csv
 
 CFLAGS	?= -Og -g3 -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 \
 	   -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 \
@@ -60,6 +61,12 @@ endif
 
 TARGETS = fakeesrt2.efi fakeesrt.efi dumpesrt.efi $(FWUP).efi mkvar.efi dumpf.efi mkvar2.efi
 
+sbat.o : $(SBATPATH)
+	$(CC) -x c -c -o $@ /dev/null
+	$(OBJCOPY) --add-section .sbat=$(SBATPATH) \
+		--set-section-flags .sbat=contents,alloc,load,readonly,data \
+		$@
+
 all : $(TARGETS)
 
 .SECONDARY: $(foreach target,$(TARGETS),$(target).debug $(target).build-id)
@@ -77,7 +84,7 @@ ifneq ($(OBJCOPY_GTE224),1)
 	$(error objcopy >= 2.24 is required)
 endif
 	$(OBJCOPY) -j .text -j .sdata -j .data -j .dynamic -j .dynsym \
-		-j .rel* -j .rela* -j .reloc -j .eh_frame \
+		-j .rel* -j .rela* -j .reloc -j .eh_frame -j .sbat \
 		$(FORMAT) $^ $@
 
 %.efi.debug : %.so
@@ -85,7 +92,7 @@ ifneq ($(OBJCOPY_GTE224),1)
 	$(error objcopy >= 2.24 is required)
 endif
 	$(OBJCOPY) -j .text -j .sdata -j .data -j .dynamic -j .dynsym \
-		-j .rel* -j .rela* -j .reloc -j .eh_frame \
+		-j .rel* -j .rela* -j .reloc -j .eh_frame -j .sbat \
 		-j .debug* -j .note.gnu.build-id \
 		$^ $@
 
@@ -93,7 +100,7 @@ endif
 	$(READELF) -n $^ | grep "Build ID:" | \
 		sed -e 's/^.*Build ID: //' -e 's,^\(..\),\1/,' > $@
 
-%.so : %.o
+%.so : %.o sbat.o
 	$(CC) $(CCLDFLAGS) -o $@ $^ -lefi -lgnuefi \
 		$(shell $(CC) -print-libgcc-file-name) \
 		-T elf_$(ARCH)_efi.lds
diff --git a/efi/elf_aarch64_efi.lds b/efi/elf_aarch64_efi.lds
index 365692d..6ded938 100644
--- a/efi/elf_aarch64_efi.lds
+++ b/efi/elf_aarch64_efi.lds
@@ -39,6 +39,16 @@ SECTIONS
   }
   .note.gnu.build-id : { *(.note.gnu.build-id) }
 
+  . = ALIGN(4096);
+  .sbat :
+  {
+    _sbat = .;
+    *(.sbat)
+    *(.sbat.*)
+    _esbat = .;
+  }
+  . = ALIGN(4096);
+
   .rela.dyn : { *(.rela.dyn) }
   .rela.plt : { *(.rela.plt) }
   .rela.got : { *(.rela.got) }
diff --git a/efi/elf_ia32_efi.lds b/efi/elf_ia32_efi.lds
index 2308b8a..25ed142 100644
--- a/efi/elf_ia32_efi.lds
+++ b/efi/elf_ia32_efi.lds
@@ -47,6 +47,14 @@ SECTIONS
   }
   .note.gnu.build-id : { *(.note.gnu.build-id) }
 
+  . = ALIGN(4096);
+  .sbat :
+  {
+    _sbat = .;
+    *(.sbat)
+    *(.sbat.*)
+    _esbat = .;
+  }
   . = ALIGN(4096);
   .dynamic  : { *(.dynamic) }
   . = ALIGN(4096);
diff --git a/efi/elf_x86_64_efi.lds b/efi/elf_x86_64_efi.lds
index 73a79e7..9936936 100644
--- a/efi/elf_x86_64_efi.lds
+++ b/efi/elf_x86_64_efi.lds
@@ -47,6 +47,14 @@ SECTIONS
   }
   .note.gnu.build-id : { *(.note.gnu.build-id) }
 
+  . = ALIGN(4096);
+  .sbat :
+  {
+    _sbat = .;
+    *(.sbat)
+    *(.sbat.*)
+    _esbat = .;
+  }
   . = ALIGN(4096);
   .dynamic  : { *(.dynamic) }
   . = ALIGN(4096);
-- 
2.29.2