!210 [sync] PR-208: Fix the issue that the gBS->LoadImage pointer was empty.

From: @openeuler-sync-bot 
Reviewed-by: @HuaxinLuGitee 
Signed-off-by: @HuaxinLuGitee

Feature-add-tpcm-support-with-ipmi-channel.patch

@@ -185,7 +185,7 @@ index 0000000..42fcc2f
 +    CHAR16 *description)
 +{
 +    UINT32 filename_len = StrLen(description) * 2 + 1;
-+    UINT32 stage_base = bm_stage_base++;
++    UINT32 stage_base = bm_stage_base;
 +    UINT8 filename[FIRMWARE_NAME_SIZE] = {0};
 +
 +    if (filename_len > FIRMWARE_NAME_SIZE) {

backport-Always-clear-SbatLevel-when-Secure-Boot-is-disabled.patch

@@ -0,0 +1,48 @@
+From b078ef274887a4cc0da64fd6668800d1e24a2871 Mon Sep 17 00:00:00 2001
+From: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
+Date: Tue, 16 May 2023 14:31:13 -0700
+Subject: [PATCH] Always clear SbatLevel when Secure Boot is disabled
+
+Unless an explict sbat policy is specified, always delete SbatLevel
+when secure boot is disabled.
+
+Signed-off-by: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com>
+---
+ sbat.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/sbat.c b/sbat.c
+index f1d6e98..cdf4e93 100644
+--- a/sbat.c
++++ b/sbat.c
+@@ -412,7 +412,12 @@ set_sbat_uefi_variable(void)
+ 				       &attributes);
+ 	if (EFI_ERROR(efi_status)) {
+ 		dprint("Default sbat policy: previous\n");
+-		sbat_var = SBAT_VAR_PREVIOUS;
++		if (secure_mode()) {
++		    sbat_var = SBAT_VAR_PREVIOUS;
++		} else {
++		    reset_sbat = true;
++		    sbat_var = SBAT_VAR_ORIGINAL;
++		}
+ 	} else {
+ 		switch (*sbat_policy) {
+ 			case SBAT_POLICY_LATEST:
+@@ -438,7 +443,12 @@ set_sbat_uefi_variable(void)
+ 			default:
+ 				console_error(L"SBAT policy state %llu is invalid",
+ 					      EFI_INVALID_PARAMETER);
+-				sbat_var = SBAT_VAR_PREVIOUS;
++				if (secure_mode()) {
++				    sbat_var = SBAT_VAR_PREVIOUS;
++				} else {
++				    reset_sbat = true;
++				    sbat_var = SBAT_VAR_ORIGINAL;
++				}
+ 				clear_sbat_policy();
+ 				break;
+ 		}
+-- 
+2.33.0
+

backport-Fix-the-issue-that-the-gBS-LoadImage-pointer-was-emp.patch

@@ -0,0 +1,39 @@
+From 712097206702f26e96be3f7ba79eb52d00e1f658 Mon Sep 17 00:00:00 2001
+From: jinlun <869793317@qq.com>
+Date: Sat, 2 Nov 2024 17:21:22 +0800
+Subject: [PATCH] Fix the issue that the gBS->LoadImage pointer was empty.
+
+The interface shouldn't be replaced at the shim_fini
+ stage When the vendor certificate doesn't exist.
+
+Signed-off-by: jinlun <869793317@qq.com>
+Signed-off-by: xuce <xuce10@h-partners.com>
+---
+ shim.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/shim.c b/shim.c
+index 547b052..aa74610 100644
+--- a/shim.c
++++ b/shim.c
+@@ -1651,11 +1651,12 @@ shim_fini(void)
+ 	uninstall_shim_protocols();
+ 
+ 	if (secure_mode()) {
+-
+-		/*
+-		 * Remove our hooks from system services.
+-		 */
+-		unhook_system_services();
++		if (vendor_authorized_size || vendor_deauthorized_size) {
++			/*
++			* Remove our hooks from system services.
++			*/
++			unhook_system_services();
++		}
+ 	}
+ 
+ 	unhook_exit();
+-- 
+2.33.0
+

backport-shim-don-t-set-second_stage-to-the-empty-string.patch

@@ -0,0 +1,54 @@
+From 0287c6b14c77eeb3e3c61996330850d43d937a2b Mon Sep 17 00:00:00 2001
+From: Jonathan Davies <jonathan.davies@nutanix.com>
+Date: Thu, 22 Feb 2024 16:24:01 +0000
+Subject: [PATCH] shim: don't set second_stage to the empty string
+
+When LoadOptions is either L" " or L"shim.efi ", parse_load_options sets
+second_stage to the empty string. This is unlikely to be what is intended, and
+typically leads to a non-obvious failure mode.
+
+The failure happens because parse_load_options's call to split_load_options
+(after eating shim's own filename, if present) returns the empty string. Since
+init_grub typically passes second_stage to start_image, this causes read_image
+to concatenate the empty string onto the directory name. This means PathName
+refers to the directory, not the path to a pe image. Then load_image
+successfully opens a handle on the directory and reads "data" from it. It only
+eventually fails when handle_image calls read_header which finds that this data
+isn't in fact a pe header, reporting "Invalid image".
+
+This scenario has been seen when shim is loaded via rEFInd 0.11.5, which sets
+LoadOptions to the name of the shim program followed by a space character.
+
+Instead, modify parse_load_options to leave second_stage set to its default
+value rather than the empty string.
+
+Reference:https://github.com/rhboot/shim/commit/0287c6b14c77eeb3e3c61996330850d43d937a2b
+Conflict:NA
+
+Signed-off-by: Jonathan Davies <jonathan.davies@nutanix.com>
+---
+ load-options.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/load-options.c b/load-options.c
+index a8c6e1a..8b92e37 100644
+--- a/load-options.c
++++ b/load-options.c
+@@ -447,10 +447,12 @@ parse_load_options(EFI_LOADED_IMAGE *li)
+ 
+ 	/*
+ 	 * Set up the name of the alternative loader and the LoadOptions for
+-	 * the loader
++	 * the loader if it's not the empty string.
+ 	 */
+ 	if (loader_str) {
+-		second_stage = loader_str;
++		if (*loader_str) {
++			second_stage = loader_str;
++		}
+ 		load_options = remaining;
+ 		load_options_size = remaining_size;
+ 	}
+-- 
+2.33.0
+

shim.spec

@@ -25,7 +25,7 @@
 
 Name:	   	   shim
 Version:	   15.6
-Release:	   20
+Release:	   25
 Summary:	   First-stage UEFI bootloader
 ExclusiveArch:     x86_64 aarch64
 License:	   BSD
@@ -86,6 +86,9 @@ Patch48:backport-CVE-2023-40549-Authenticode-verify-that-the-signatur.patch
 Patch49: backport-CVE-2023-2650.patch
 Patch50: backport-CVE-2023-0465.patch
 Patch51: backport-CVE-2024-0727.patch
+Patch52: backport-Always-clear-SbatLevel-when-Secure-Boot-is-disabled.patch
+Patch53: backport-shim-don-t-set-second_stage-to-the-empty-string.patch
+Patch54: backport-Fix-the-issue-that-the-gBS-LoadImage-pointer-was-emp.patch
 
 # Feature for shim SMx support
 Patch9000:Feature-shim-openssl-add-ec-support.patch
@@ -191,6 +194,11 @@ install -m 0700 %{SOURCE1} ${RPM_BUILD_ROOT}/%{shimefivendor}
 %ifarch x86_64
 install -m 0700 %{SOURCE2} ${RPM_BUILD_ROOT}/%{shimefivendor}
 %endif
+%if "%{_vendor}" != "openEuler"
+    iconv -f UTF-16LE -t UTF-8 ${RPM_BUILD_ROOT}/%{shimefivendor}/%{bootcsv} > /tmp/%{bootcsv}.tmp
+    sed -i -e 's/openeuler/%{_vendor}/g' -e 's/openEuler/%{_vendor}/g' /tmp/%{bootcsv}.tmp
+    iconv -f UTF-8 -t UTF-16LE /tmp/%{bootcsv}.tmp > ${RPM_BUILD_ROOT}/%{shimefivendor}/%{bootcsv}
+%endif
 
 # install the debug symbols
 install -d ${RPM_BUILD_ROOT}/usr/lib/debug/%{shimefivendor}
@@ -223,6 +231,21 @@ make test
 /usr/src/debug/%{name}-%{version}-%{release}/*
 
 %changelog
+* Tue Feb 11 2025 fuanan <fuanan3@h-partners.com> -15.6-25
+- fix the issue that the gBS->LoadImage pointer was empty.
+
+* Tue Oct 22 2024 fuanan <fuanan3@h-partners.com> -15.6-24
+- backport patch from upstream
+
+* Tue May 7 2024 jinlun <jinlun@huawei.com> - 15.6-23
+- Fix the TPCM feature issue
+
+* Tue Apr 23 2024 lijuzhang <lijuzhang@inspur.com> - 15.6-22
+- replace vendor for BOOTX64.CSV or BOOTAA64.CSV
+
+* Tue Mar 26 2024 yixiangzhike <yixiangzhike007@163.com> - 15.6-21
+- backport patch from upstream
+
 * Wed Feb 28 2024 zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 15.6-20
 - fix CVE-2023-0465 CVE-2023-2650 CVE-2024-0727