[tracking] shim 15.4 critical regressions

[julian-klode]

Posting this here for awareness of submitters regarding fatal issues that can break boot on machines and other errors of unknown extend.

Critical issues:

• fails to boot on older Macs, and other machines with EFI < 2: Don't call QueryVariableInfo() on EFI 1.10 machines shim#364
• mokutil --disable-validation does not work: Don't set user_insecure_mode and ignore_db in import_one_mok_state shim#362
• 32-bit Intel is broken: Broken ia32 relocs and an unimportant submodule change. shim#357
• various systems, especially older ones that do not support secure boot, fail to mirror MOK variables. Relax the check for import_mok_state() shim#372 makes that non-fatal for non-secure systems which is at least something
• fwupd and similar cannot be loaded, load option parsing is broken. Patches fixing that in shim: another attempt to fix load options handling shim#379

Important issues:

• 64-bit ARM is broken on old binutils; unreproducible with new ones: Significant problems with Aarch64 (and Arm?) builds shim#366

Unknown extent:

• produces kernel errors: mok: allocate MOK config table as BootServicesData shim#361

You might want to hold off submitting shims until there is a 15.5 release, or cherry-pick patches.

[Doncuppjr]

So we need 822d07ad4f07ef66fe447a130e1027c88d02a394 if we want Mac support?

[steve-mcintyre]

aarch64 builds are really awkward - they will break using binutils versions before 2.35, and even after that they may give unpredictable results. We really need proper toolchain support.

[Doncuppjr]

I guess the better question is, do they want to make a 15.5?

[steve-mcintyre]

822d07ad4f07ef66fe447a130e1027c88d02a394 is for really old Macs that won't do SB anyway. But without that patch you'll fail to boot the machine at all

[Doncuppjr]

And I guess we are waiting on 8b59591775a0412863aab9596ab87bdd493a9c1e to be merged or QA'ed?

[cmurf]

Fedora's shim-15.4-4 has fixes for some of the items listed in this issue. But there are two issues we're seeing with a subset of Lenovo and Dell systems that don't yet have upstream issues filed (and I don't understand the problem well enough to file them).
https://bugzilla.redhat.com/show_bug.cgi?id=1955416
https://bugzilla.redhat.com/show_bug.cgi?id=1954245

[realnickel]

As this issue is pinned I'd like to draw attention of new submitters to an old comment, calling for cross review between submitters themselves:
#120 (comment)
I think that might speed up review process for everyone by eliminating most common inconsistencies before authorized review-board members pay attention to submission.

[pnardini]

This was a good reminder @realnickel, thanks. If submitters are hesitant to review because they "don't know where to start" they can begin with some of the reviewer guidelines captured here: https://github.com/rhboot/shim/wiki/reviewer-guidelines.

[julian-klode]

shim 15.5 is out, closing this.