From 889f1e436963ffdd8e2872fcbfa310c8356ca242 Mon Sep 17 00:00:00 2001 From: wynnfeng Date: Sat, 4 Jul 2026 12:32:03 +0800 Subject: [PATCH 1/2] Refactor spec and patches to align with the upstream grub2 baseline --- ...-Fix-user-facing-typo-with-an-incorr.patch | 24 + 0001-remove-GNU-Linux-in-menuentry.patch | 58 - ...-Properly-disable-the-os-prober-by-d.patch | 71 + ...rate-and-hook-for-extended-partition.patch | 60 - ...tes-Disable-the-os-prober-by-default.patch | 70 + 0004-Rework-linux-command.patch | 109 + ...x-error-terminal-gfxterm-isn-t-found.patch | 36 - 0005-Rework-linux16-command.patch | 99 + 0005-fix-menu-in-xen-host-server.patch | 115 - 0006-not-display-menu-when-boot-once.patch | 34 - 0006-re-write-.gitignore.patch | 246 + ...ient-architecture-CAS-reboot-support.patch | 57 +- 0007-Pass-corret-root-for-nfsroot.patch | 145 - 0008-add-grub2-efi-workaround-for-HP.patch | 109 - ...nsole-display-attr-when-clear-screen.patch | 31 + ...video-support-for-IBM-power-machines.patch | 22 +- ...w-insmod-when-secure-boot-is-enabled.patch | 54 - ...0-Move-bash-completion-script-922997.patch | 15 +- ...ecureboot-support-on-efi-chainloader.patch | 601 - ...o-include-entries-by-title-not-just-.patch | 21 +- 0012-Make-exit-take-a-return-code.patch | 280 + 0012-linuxefi-fix-boot-params.patch | 39 - ...es-load-an-env-block-from-a-variable.patch | 26 +- ...-make-it-possible-to-use-in-RPM-buil.patch | 33 - ...014-Migrate-PPC-from-Yaboot-to-Grub2.patch | 30 +- ...t-instead-of-DejaVu-Sans-in-terminal.patch | 29 - ...=> 0015-Add-fw_path-variable-revised.patch | 11 +- 0015-use-rpmsort-for-version-sorting.patch | 163 - ...-hex-hex-straight-through-unmolested.patch | 61 +- ...-mdadm-ddf-fakeraid-as-simple-device.patch | 75 - ...g-module-to-parse-Boot-Loader-Specif.patch | 253 +- ...up-try-fs-embed-if-mbr-gap-too-small.patch | 71 - ...patch => 0018-Add-devicetree-loading.patch | 31 +- 0018-add-xen-linux16-command.patch | 44 - ...0019-Enable-pager-by-default.-985860.patch | 17 +- ...n-t-say-GNU-Linux-in-generated-menus.patch | 65 +- 0020-vbe-blacklist-preferred-1440.patch | 37 - ...rame-to-list-of-relocations-stripped.patch | 10 +- 0021-grubenv-in-btrfs-header.patch | 518 - ...password-to-boot-entries-generated-b.patch | 9 +- 0022-set-default-distributor.patch | 215 - 0023-efi-chainload-harder.patch | 131 - ...ix-when-fallback-searching-for-grub-.patch | 14 +- ...VM-metadata-buffer-from-raw-contents.patch | 152 - ...-before-grub.cfg-on-tftp-config-file.patch | 54 +- ...CLASS-in-10_linux-from-etc-os-releas.patch | 10 +- ...mentation-of-processing-no-metadata-.patch | 226 - ...mkconfig-warning-when-disk-is-LVM-PV.patch | 49 - ...6-Try-prefix-if-fw_path-doesn-t-work.patch | 77 +- ...fig-construct-titles-that-look-like-.patch | 24 +- 0027-util-30_os-prober-multiple-initrd.patch | 26 - ...ly-grub2-password-config-tool-985962.patch | 63 +- ...-getroot-Support-NVDIMM-device-names.patch | 71 - ...s-sure-that-ext2-3-4-is-tried-before.patch | 48 - ... 0029-tcp-add-window-scaling-support.patch | 9 +- ...net-and-bootp-add-support-for-dhcpv6.patch | 690 + ...ce-jorunal-draining-tp-emsure-data-i.patch | 240 - ...=> 0031-bootp-New-net_bootp6-command.patch | 650 +- ...rnel-settings-and-use-it-in-10_linux.patch | 79 +- 0033-Make-grub_fatal-also-backtrace.patch | 169 + ...fo-pages-say-grub2-where-appropriate.patch | 237 +- ...-chainloader-entries-don-t-try-any-x.patch | 124 + ...-Add-ability-to-boot-from-subvolumes.patch | 141 +- 0037-btrfs-fix-a-bad-null-check.patch | 40 + ...rkaround-snapshot-menu-default-entry.patch | 70 - ...port-btrfs_subvol-and-btrfs_subvolid.patch | 13 +- ...> 0039-grub2-btrfs-03-follow_default.patch | 30 +- 0040-btrfs-10-config-directory.patch | 268 - ...=> 0040-grub2-btrfs-04-grub2-install.patch | 66 +- ...ainloader-to-boot-xen.efi-under-UEFI.patch | 192 - ...> 0041-grub2-btrfs-05-grub2-mkconfig.patch | 62 +- 0042-efi-xen-cmdline.patch | 41 - ... => 0042-grub2-btrfs-06-subvol-mount.patch | 145 +- ...subvol-name-scheme-to-support-old-sn.patch | 16 +- ...eters-written-to-Xen-EFI-config-file.patch | 94 - ...-correctly-with-btrfs-snapshots-bsc-.patch | 48 +- ...installed-with-removable-option-to-s.patch | 120 - ...ocate_pool-and-grub_efi_free_pool-wr.patch | 72 + 0045-Add-hidden-menu-entries.patch | 233 - 0046-SUSE-Add-the-t-hotkey.patch | 73 - ...fi_.-memory-helpers-where-reasonable.patch | 36 + 0047-Add-PRIxGRUB_EFI_STATUS-and-use-it.patch | 33 + 0048-don-t-use-int-for-efi-status.patch | 22 + 0048-ppc64le-memory-map.patch | 99 - ...INIT-declare-its-function-prototypes.patch | 29 + ...-efi-as-HFS-on-ppc-machines-in-grub-.patch | 41 + 0050-ppc64-cas-new-scope.patch | 30 - ...d-xen-or-multiboot-2-modules-as-need.patch | 22 +- 0051-ppc64-cas-fix-double-free.patch | 115 - 0052-align-struct-efi_variable-better.patch | 33 + ...ove-useless-check-PReP-partition-is-.patch | 83 - ...053-Add-BLS-support-to-grub-mkconfig.patch | 54 +- 0053-efi-gop-avoid-low-resolution.patch | 50 - ...-backtrace-on-grub_abort-for-grub-em.patch | 26 + ...h => 0055-Add-grub2-switch-to-blscfg.patch | 27 +- ...w-our-startup-message-if-debug-is-se.patch | 23 + ...-some-minor-include-path-weirdnesses.patch | 15 +- ...it-possible-to-enabled-build-id-sha1.patch | 51 +- 0059-make-better-backtraces.patch | 906 + 0060-Build-tpm-as-module.patch | 62 - 0060-Fixup-for-newer-compiler.patch | 22 + ...-export-the-start-and-_start-symbols.patch | 42 + ...tch => 0062-Fixup-for-newer-compiler.patch | 16 +- ...pport-for-non-Ethernet-network-cards.patch | 770 + ...ub-mkcofnig-default-entry-correction.patch | 29 - ...=> 0064-efinet-UEFI-IPv6-PXE-support.patch | 139 +- ...dle-signed-grub-installation-on-arm6.patch | 230 - ...065-grub.texi-Add-net_bootp6-doument.patch | 25 +- ...grub2-btrfs-help-on-snapper-rollback.patch | 34 - ...essing-DHCPACK-packet-from-HTTP-Boot.patch | 137 +- ...-the-resolution-for-fixed-bimap-font.patch | 92 - ...ar-pointers-in-grub-core-net-bootp.c.patch | 37 + ...-support-scrolling-menu-entry-s-text.patch | 286 - ...etting-network-from-UEFI-device-path.patch | 108 +- 0068-kern-mm.c-Make-grub_calloc-inline.patch | 116 - ...-Provide-cmdline-functions-as-module.patch | 54 - ...etting-DNS-server-from-UEFI-protocol.patch | 91 +- ...70-Support-UEFI-networking-protocols.patch | 675 +- ...> 0071-AUDIT-0-http-boot-tracker-bug.patch | 32 +- ...-check-to-enable-btrfs-relative-path.patch | 156 - ...-incr-command-to-increment-integer-v.patch | 30 +- ...h => 0073-Add-auto-hide-menu-support.patch | 52 +- 0073-efi-linux-provide-linux-command.patch | 112 - ...> 0074-Add-grub-set-bootflag-utility.patch | 111 +- ...or-Linux-EFI-stub-loading-on-aarch64.patch | 539 - ...fdt-has-address-cells-and-size-cells.patch | 45 - ...b-boot-indeterminate.service-example.patch | 9 +- ...h => 0076-gentpl-add-disable-support.patch | 13 +- ... => 0077-gentpl-add-pc-firmware-type.patch | 9 +- ...e-the-firmware-acceleration-for-http.patch | 11 +- ...ot_url-reflect-the-protocol-hostname.patch | 17 +- 0079-squash-kern-Add-lockdown-support.patch | 115 - ...n-tell-configure-which-cflags-utils-.patch | 112 +- ...81-Rework-how-the-fdt-command-builds.patch | 47 +- ...orkaround-volatile-efi-boot-variable.patch | 307 - ...able-non-wordsize-allocations-on-arm.patch | 11 +- ...-the-path-of-usr-merged-kernel-confi.patch | 48 - ...nd-prefix-when-HTTP-path-is-relative.patch | 28 +- ...lement-FCP-methods-for-WWPN-and-LUNs.patch | 146 - ...=> 0084-Make-grub_error-more-verbose.patch | 20 +- ...r-the-PE-magic-for-the-compiled-arch.patch | 66 - ...eset-an-alias-for-the-reboot-command.patch | 40 + ....patch => 0086-Add-a-version-command.patch | 47 +- 0086-Factor-out-grub_efi_linux_boot.patch | 230 - ...dprintf-and-nerf-dprintf-in-script.c.patch | 27 +- 0087-Fix-race-in-EFI-validation.patch | 92 - ...p-all-the-places-Wsign-compare-error.patch | 30 +- ...gn-compare-Wno-conversion-Wno-error-.patch | 40 +- 0090-Fix-getroot.c-s-trampolines.patch | 47 + ...not-allow-stack-trampolines-anywhere.patch | 41 +- ...tch => 0092-Reimplement-boot_counter.patch | 23 +- ...ntry-selection-based-on-ID-and-title.patch | 38 +- ...try-users-option-argument-to-be-opti.patch | 12 +- ...export-env-and-efi-load-env-commands.patch | 80 +- ..._EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch | 28 - ...bles-from-the-initial-context-when-c.patch | 15 +- ...-boot-success-reset-from-menu-auto-h.patch | 27 +- ...t-boot-commands-will-only-return-on-.patch | 97 + ...g-Update-comment-about-running-as-ro.patch | 11 +- ...g-Write-new-env-to-tmpfile-and-then-.patch | 12 +- ...indeterminate-getting-set-on-boot_su.patch | 11 +- ... => 0102-Add-start-symbol-for-RISC-V.patch | 9 +- ...conf-Force-autogen.sh-to-use-python3.patch | 9 +- ...fw-http-_path-variables-to-make-them.patch | 14 +- ...-literal-IPv6-addresses-in-square-br.patch | 38 +- ...o-specify-a-port-number-in-addresses.patch | 13 +- ...mprove-check-to-detect-literal-IPv6-.patch | 11 +- ...debug-message-if-parsing-the-address.patch | 68 + ...so-accept-F8-as-a-user-interrupt-key.patch | 30 + ...fix-when-the-HTTP-path-is-relative-a.patch | 13 +- ...turn-in-efi-export-env-and-efi-load-.patch | 11 +- ...p-fix-some-allocation-error-checking.patch | 37 + ...p-fix-some-allocation-error-checking.patch | 13 +- ...g.c-fix-some-potential-allocation-ov.patch | 127 + ...ointers-in-grub-core-net-efi-ip4_con.patch | 38 + ...ointers-in-grub-core-net-efi-ip6_con.patch | 28 + ...tial-Signature-plus-other-Key-Usages.patch | 48 - ...-pointers-in-grub-core-net-efi-net.c.patch | 37 + ...-SUSE-signed-image-support-for-power.patch | 111 - ...-Add-grub_envblk_buf-helper-function.patch | 68 - ...-pointers-in-grub-core-net-efi-pxe.c.patch | 46 + ...grub_disk_write_tail-helper-function.patch | 60 - ...gration-scripts-to-make-systemctl-re.patch | 41 +- ...stall-support-prep-environment-block.patch | 144 - ...ion.sh-Also-set-old-menu_show_once-g.patch | 11 +- 0121-Introduce-prep_load_env-command.patch | 287 - ...set-1-when-keyboard-is-in-Translate-.patch | 12 +- 0122-export-environment-at-start-up.patch | 177 - ...ll-disable-support-for-EFI-platforms.patch | 111 + ...imestamps-configure-flag-to-prepend-.patch | 51 +- ...-install-bailout-root-device-probing.patch | 181 - ...ements-to-grub_disk_open-and-grub_di.patch | 22 +- 0124-install-fix-software-raid1-on-esp.patch | 415 - ...on-grub_debug_is_enabled-void-return.patch | 15 +- ...be-Deduplicate-probed-partmap-output.patch | 110 - ...ear-screen-when-debugging-is-enabled.patch | 13 +- ...boot-loop-on-headless-system-in-qemu.patch | 73 - ..._-instrumentation-new-file-debug-tag.patch | 9 +- ...-boot-time-by-lookup-boot-disk-first.patch | 63 - ...-Avoiding-many-unecessary-open-close.patch | 25 +- ...tectors-Add-key-protectors-framework.patch | 190 - ...-implements-fibre-channel-discovery-.patch | 40 +- 0129-tpm2-Add-TPM-Software-Stack-TSS.patch | 3569 - ...erpc-enables-device-mapper-discovery.patch | 21 +- 0130-protectors-Add-TPM2-Key-Protector.patch | 2052 - ...fallback_set-var-to-force-the-set-ma.patch | 12 +- 0131-cryptodisk-Support-key-protectors.patch | 352 - ...igning-grub-with-an-appended-signatu.patch | 146 +- 0132-util-grub-protect-Add-new-tool.patch | 1620 - ...rub-Document-signing-grub-under-UEFI.patch | 15 +- ...linuxefi-Use-common-grub_initrd_load.patch | 156 - ...ry-to-obviate-the-need-to-input-pass.patch | 341 - ...nt-signing-grub-with-an-appended-sig.patch | 16 +- ...e-grub_dl_set_persistent-for-the-emu.patch | 12 +- ...ates-import-etc-crypttab-to-grub.cfg.patch | 95 - 0136-grub-read-pcr.patch | 186 - ...patch => 0136-pgp-factor-out-rsa_pad.patch | 25 +- ...rage-for-grub_crypto_pk_-to-crypto.c.patch | 11 +- 0137-tpm-record-pcrs.patch | 250 - 0138-grub-install-record-pcrs.patch | 31 - ...p-tweaks-in-preparation-for-libtasn1.patch | 13 +- ...0139-libtasn1-import-libtasn1-4.16.0.patch | 3408 +- 0139-safe-tpm-pcr-snapshot.patch | 112 - 0140-ieee1275-add-support-for-NVMeoFC.patch | 250 - ...asn1-disable-code-not-needed-in-grub.patch | 161 +- ...enable-NVMeoF-logical-device-transla.patch | 374 - ...tasn1-changes-for-grub-compatibility.patch | 164 +- ...42-libtasn1-compile-into-asn1-module.patch | 17 +- 0143-ofpath-controller-name-update.patch | 28 - ...3-test_asn1-test-module-for-libtasn1.patch | 249 +- ...t-blocks-as-used-for-image-embedding.patch | 66 - ...-support-embedding-x509-certificates.patch | 132 +- ...res-import-GNUTLS-s-ASN.1-descriptio.patch | 16 +- ...b-increase-the-size-of-the-path-buff.patch | 30 - ...res-parse-PKCS-7-signedData-and-X.50.patch | 783 +- ...le-device-path-for-a-nvmf-boot-devic.patch | 176 - ...res-support-verifying-appended-signa.patch | 263 +- ...p-a-default-boot-device-correctly-on.patch | 44 - ...pended-signatures-verification-tests.patch | 897 + ...pes-structures-and-command-constants.patch | 205 - ...49-appended-signatures-documentation.patch | 133 +- ...Add-more-marshal-unmarshal-functions.patch | 427 - ...er-lockdown-based-on-ibm-secure-boot.patch | 47 +- 0150-tpm2-Implement-more-TPM2-commands.patch | 543 - ...275-drop-HEAP_MAX_ADDR-HEAP_MIN_SIZE.patch | 46 + 0151-tpm2-Support-authorized-policy.patch | 170 - ...-Also-handle-the-Extended-Key-Usage-.patch | 315 + ...rypttab-and-linux-modules-dependency.patch | 219 - ...ey-before-entering-grub-shell-and-ed.patch | 99 - ...eee1275-ofdisk-retry-on-open-failure.patch | 103 + 0154-efinet-Add-DHCP-proxy-support.patch | 53 + ...fdisk-retry-on-open-and-read-failure.patch | 172 - ...-cmdline-when-generating-legacy-menu.patch | 11 +- ...tup-key-file-permission-for-better-s.patch | 64 - ... 0156-Suppress-gettext-error-message.patch | 9 +- ...t_devargs-and-get_devname-functions-.patch | 52 - ...d-Always-use-boot-grub2-user.cfg-as-.patch | 11 +- ...-regex-for-Open-Firmware-device-spec.patch | 210 - ...over-the-device-to-read-the-config-f.patch | 13 +- ...sing-grub_arch_efi_linux_load_image_.patch | 84 - ...Try-memdisk-fonts-with-the-same-name.patch | 39 - ...etting-of-prefix-for-signed-binary-c.patch | 37 +- ...-grub.cfg-compatible-to-old-binaries.patch | 82 - ...pc-ieee1275-load-grub-at-4MB-not-2MB.patch | 11 +- ...-Fedora-location-of-DejaVu-SANS-font.patch | 11 +- 0161-protectors-Implement-NV-index.patch | 80 - 0162-cryptodisk-Fallback-to-passphrase.patch | 41 - ...h => 0162-efi-new-connectefi-command.patch | 61 +- ...-out-the-cached-keys-from-protectors.patch | 36 - ...etection-support-device-names-with-c.patch | 23 +- ...ter-look-up-cryptodisk-devices-first.patch | 89 - 0164-make-ofdisk_retries-optional.patch | 43 + ...grub_min-and-grub_max-more-resilient.patch | 83 + ...FS-switch-to-using-grub_min-grub_max.patch | 92 + ...pm2-token-for-TPM2-protected-volume-.patch | 143 - ...lculation-for-the-synthesized-initrd.patch | 86 - ...oot_time-also-call-grub_dprintf-boot.patch | 44 + ...key-protection-on-boot-interruptions.patch | 286 - ...dules-make-.module_license-read-only.patch | 30 + ...rict-file-access-on-cryptodisk-print.patch | 197 - ...p-.llvm_addrsig-sections-and-similar.patch | 39 + ...auto-file-completion-on-cryptodisk-p.patch | 117 - ...locate-space-for-non-allocable-secti.patch | 35 + ...vocation-on-out-of-bound-file-access.patch | 91 - ...ule-sections-at-page-aligned-address.patch | 378 + ...rify-the-total-number-of-entries-is-.patch | 49 - ...-nx-add-memory-attribute-get-set-API.patch | 317 + ...-linux-Remove-magic-number-header-fi.patch | 43 - ...-page-permissions-for-loaded-modules.patch | 236 + ...x-compatible-flag-in-EFI-grub-images.patch | 48 + ...ofpath-enable-NVMeoF-logical-device-.patch | 60 - ...probe-dprint-errors-from-filesystems.patch | 43 + ...oot-time-by-focusing-on-boot-disk-re.patch | 243 - ...file-show-which-file-filters-get-run.patch | 45 + 0176-ofdisk-add-early_log-support.patch | 169 - ...e-etc-kernel-cmdline-during-mkconfig.patch | 27 + ...sk-iteration-by-moving-memdisk-to-th.patch | 38 - ...tion-work-with-version-2.12-and-befo.patch | 151 - ...sh-don-t-dup-rhgb-quiet-check-mtimes.patch | 43 +- 0179-squish-give-up-on-rhgb-quiet.patch | 25 + ...n-t-say-GNU-Linux-in-generated-menus.patch | 39 - ...write-etc-kernel-cmdline-if-writable.patch | 57 + ...scfg-Don-t-root-device-in-emu-builds.patch | 27 + 0182-ppc64le-signed-boot-media-changes.patch | 123 + ...veral-implicit-function-declarations.patch | 54 + ...-memory-with-ibm-client-architecture.patch | 109 + ...-work-around-proc-not-reporting-size.patch | 93 + ...blscfg-check-for-mounted-boot-in-emu.patch | 36 +- ...b_dl_set_mem_attrs-fix-format-string.patch | 38 + ...attrs-add-self-check-for-the-tramp-G.patch | 140 + ...disable-some-unsupported-filesystems.patch | 53 - ...ments-page-align-the-tramp-GOT-areas.patch | 70 + 0190-emu-Add-switch-root-to-grub-emu.patch | 330 + ...-of-unsupported-filesystems-in-fs.ls.patch | 31 - ...il-Enable-default-kernel-for-updates.patch | 34 + ...-efi-http-change-uint32_t-to-uintn_t.patch | 30 + ...Install-section-to-aux-systemd-units.patch | 52 + 0194-Fix-missing-include-in-ofdisk.c.patch | 28 + ...ls-for-grub2-btrfs-05-grub2-mkconfig.patch | 25 - ...195-add-flag-to-only-search-root-dev.patch | 184 +- ...ptdisk-fix-incorrect-sign-comparison.patch | 28 + ...-install-fix-a-sign-comparison-error.patch | 25 + ...t-work-around-bad-integer-comparison.patch | 50 + ...-use-after-free-in-get_slave_from_dm.patch | 32 + 0200-Fix-some-sign-comparison-errors.patch | 37 + 0201-normal-Fix-a-discarded-const.patch | 23 + ...-grub_keyboard_controller_write-unus.patch | 35 + ...-another-minor-sign-comparison-error.patch | 23 + ...odule-dependencies-in-Makefile.core..patch | 124 + ...-that-we-preserve-header-vs-region-a.patch | 75 + ...U-variety-of-build-flags-for-PROGRAM.patch | 38 + 0207-Work-around-extra_deps.lst-issue.patch | 24 + ...ttribute-for-an-EFI-API-call-definit.patch | 42 + 0209-cast-grub_error-status-parameter.patch | 67 + 0210-remove-unused-varible.patch | 31 + 0211-cast-grub_net_bootp_packet-pointer.patch | 42 + ...libtasn1-fix-string-overflow-warning.patch | 56 + ...d-support-for-Linux-EFI-stub-loading.patch | 430 +- 0214-fix-i386_pc-on-legacycfg-module.patch | 21 + ...ecureboot-support-on-efi-chainloader.patch | 1390 + ...loaders-that-link-in-efi-mode-honor-.patch | 317 + ...t-ordering-for-.debug-and-rescue-ker.patch | 12 +- ...f-grub_dprintf-without-the-file-line.patch | 56 + ...dprintf-that-tells-us-load-addresses.patch | 83 + ...rch-64-on-32-boot-in-linuxefi-loader.patch | 134 +- ...tter-locations-for-kernel-and-initrd.patch | 53 +- ...ce-buffers-for-reading-to-addresses-.patch | 20 +- ...-arrange-grub_cmd_linux-a-little-bit.patch | 38 +- ...e-our-own-allocator-for-kernel-stuff.patch | 72 +- ...itrd-params-cmdline-allocations-abov.patch | 34 +- ...se-address-before-jumping-to-the-PE-.patch | 44 +- ...maximum-bounce-buffer-size-to-16-MiB.patch | 9 +- ...integer-overflows-in-grub_cmd_initrd.patch | 11 +- ...rnel-validation-without-shim-protoco.patch | 97 + ...ainloading-EFI-apps-from-loop-mounts.patch | 139 + ...-i386-efi-linux.c-do-not-validate-ke.patch | 73 + ...-efi-chainloader.c-do-not-validate-c.patch | 80 + ...-efi-linux.c-drop-now-unused-grub_li.patch | 85 + ...loader-grub_load_and_start_image-doe.patch | 69 + ...hainloader-simplify-the-loader-state.patch | 326 + ...i-chainloader-Use-grub_loader_set_ex.patch | 148 + ...linux-Avoid-a-use-after-free-in-the-.patch | 41 + ...386-efi-linux-Use-grub_loader_set_ex.patch | 299 + ...linux-Fix-a-memory-leak-in-the-initr.patch | 75 + ...nel-in-EFI_RUNTIME_SERVICES_CODE-ins.patch | 85 + ...ed-array-positions-for-our-allocatio.patch | 81 + ...tion-policy-for-kernel-vs-initrd-mem.patch | 127 + ...-initrd-within-the-bounds-expressed-.patch | 57 + ...ER_-CODE-DATA-for-kernel-and-initrd-.patch | 61 + ...ncorrect-array-size-in-kernel-alloca.patch | 36 + 0246-grub-install-on-EFI-if-forced.patch | 80 + ...stall-section-from-aux-systemd-units.patch | 33 + ...der-remove-device-path-debug-message.patch | 25 + ...g-Conservative-partial-fix-for-CVE-2.patch | 16 +- ...g-More-complete-fix-for-CVE-2024-104.patch | 43 +- ...able-support-for-EFI-platforms-unles.patch | 49 - ...g-Exit-calmly-when-not-running-as-ro.patch | 10 +- 0252-Makefile.core.def-fix-linux-module.patch | 61 + ...Linux-EFI-stub-loading-on-arm-archit.patch | 270 + ...-Better-memory-allocation-and-error-.patch | 143 +- ...x-EFI-loader-kernel-image-allocation.patch | 104 +- ...eader-struct-and-fix-some-bad-naming.patch | 81 + 0257-Correct-BSS-zeroing-on-aarch64.patch | 95 + ...er-memory-type-for-kernel-allocation.patch | 29 +- ...ub_env_set-prefix-in-grub_try_normal.patch | 27 + ...n-continuous-data-blocks-in-director.patch | 54 + ...nore-warnings-for-incompatible-types.patch | 28 + ...d-search-Rework-of-CVE-2023-4001-fix.patch | 180 + ....c-read-the-kernel-image-before-head.patch | 69 + 0264-nx-set-attrs-in-our-kernel-loaders.patch | 580 + ...-wrappers-for-load_image-start_image.patch | 183 + ...lback-to-legacy-Linux-loader-when-sh.patch | 66 + ...le-stack-sections-on-EFI-assembly-fi.patch | 47 + ...fig.in-turn-off-executable-owner-bit.patch | 27 + ...it-Add-IEEE-1275-Radix-support-for-K.patch | 119 + 0269-revert-Add-hidden-menu-entries.patch | 211 - ...nsure-grub-cfg-stub-is-not-overwritt.patch | 40 + 0270-revert-Add-the-t-hotkey.patch | 67 - ...hich-forgot-to-maintained-in-release.patch | 21 - ...-mkconfig-Simplify-os_name-detection.patch | 27 + ...move-check-for-mount-point-for-grub-.patch | 29 + ...e-missing-__grub_efi_api-macros-on-E.patch | 495 + ...rub-core-net-arp.c-fix-variable-name.patch | 23 + ...EFI-commands-inside-test-expressions.patch | 44 + ...-if-NX-is-required-in-grub_efi_linux.patch | 25 + ...om-always-printing-dynamic_load_symb.patch | 80 + ...Allow-user-to-retry-failed-passphras.patch | 151 - ...erly-clear-leftover-artifacts-from-t.patch | 72 - ...ate-i-cache-before-starting-the-kern.patch | 39 + ...dont-overwrite-BLS-cmdline-if-BLSCFG.patch | 72 + ...ass-all-boot-params-when-used-by-ana.patch | 32 + ...pe-semicolon-and-ampersand-on-BLS-up.patch | 31 + ...bounds-access-in-grub_acpi_xsdt_find.patch | 22 +- ...-extent-counters-incompat-feature-su.patch | 23 +- ...cr-return-if-redirection-is-disabled.patch | 35 + ...s-legacycfg-Avoid-closing-file-twice.patch | 37 + ...ove-conditional-operator-for-endtime.patch | 27 + ...tfs-Implement-attribute-verification.patch | 245 - ...ld-option-to-block-command-line-inte.patch | 366 + ...Require-authentication-after-TPM-unl.patch | 176 +- ...-Reference-tracking-for-the-loopback.patch | 61 +- 0312-kern-disk-Limit-recursion-depth.patch | 6 +- ...bles-hooks-when-interface-is-unregis.patch | 70 +- ...r-an-integer-overflow-in-grub_dl_ref.patch | 30 +- ...r-the-SHF_INFO_LINK-flag-in-grub_dl_.patch | 34 + ...isable-memory-reading-in-lockdown-mo.patch | 16 +- ...afe-math-macros-to-prevent-overflows.patch | 99 +- ...safe-math-to-avoid-an-integer-overfl.patch | 10 +- ...nux-Cast-left-shift-to-grub_uint32_t.patch | 16 +- ...bsd-Use-safe-math-to-avoid-underflow.patch | 14 +- ...er-Block-the-rescue-mode-until-the-C.patch | 45 - ...ase-MIN-RMA-size-for-CAS-negotiation.patch | 117 + ...ix-grub_malloc-removed-after-added-s.patch | 32 + ...er-Introduce-the-cryptocheck-command.patch | 136 - ...mkimage-Create-new-ELF-note-for-SBAT.patch | 111 +- ...ds-search-Add-the-diskfilter-support.patch | 71 - ...-SBAT-metadata-into-ELF-note-for-Pow.patch | 45 + ...cument-available-crypto-disks-checks.patch | 72 - 0365-loader-efi-Fix-RISC-V-build.patch | 72 + ...odisk-Add-the-erase-secrets-function.patch | 152 - ...nit-Use-time-register-in-grub_efi_ge.patch | 4 +- ...any-instead-of-large-model-for-RISCV.patch | 2 +- ...disk-Wipe-the-passphrase-from-memory.patch | 31 - ...pe-kernel-option-characters-properly.patch | 45 + 0368-cryptocheck-Add-quiet-option.patch | 116 - ...variable-is-escaped-before-consideri.patch | 26 + ...e-memory-attributes-for-the-kernel-P.patch | 293 + ...on-t-let-trailing-blank-lines-determ.patch | 66 + ...k-return-code-of-the-script-when-exe.patch | 45 + ...-license-into-grub-set-password-util.patch | 35 + 0374-libgcrypt-Import-libgcrypt-1.11.patch | 261873 +++++++++++++++ ...-b64dec-Import-b64dec-from-gpg-error.patch | 299 + ...ss-for-compilation-in-GRUB-environme.patch | 42 + ...-import-script-definitions-and-API-u.patch | 2255 + 0378-tests-Add-DSA-and-RSA-SEXP-tests.patch | 285 + ...ak-Disable-acceleration-with-SSE-asm.patch | 47 + 0380-libgcrypt-Fix-Coverity-warnings.patch | 79 + ...Remove-now-unneeded-compilation-flag.patch | 40 + ...bgcrypt-Ignore-sign-compare-warnings.patch | 90 + ...gcrypt-Import-blake-family-of-hashes.patch | 217 + ...gcry-Make-compatible-with-Python-3.4.patch | 44 + ...util-import_gcry-Fix-pylint-warnings.patch | 1324 + ...use-64-bit-division-on-platforms-whe.patch | 34 + 0387-libgcrypt-Fix-a-memory-leak.patch | 41 + ...cs-Write-how-to-import-new-libgcrypt.patch | 67 + ...J_TYPE_PUBKEY-to-OBJ_TYPE_GPG_PUBKEY.patch | 36 + ...-Support-embedding-x509-certificates.patch | 210 + ...res-Import-GNUTLS-s-ASN.1-descriptio.patch | 162 + ...-appended-signatures-Parse-ASN1-node.patch | 274 + ...-signatures-Parse-PKCS-7-signed-data.patch | 659 + ...-signatures-Parse-X.509-certificates.patch | 1590 + ...-Enter-lockdown-based-on-ibm-secure-.patch | 122 + ...res-Support-verifying-appended-signa.patch | 1098 + ...-Read-the-db-and-dbx-secure-boot-var.patch | 775 + ...res-Introducing-key-management-envir.patch | 144 + ...d-signatures-Create-db-and-dbx-lists.patch | 689 + ...res-Using-db-and-dbx-lists-for-signa.patch | 136 + ...res-GRUB-commands-to-manage-the-cert.patch | 406 + ...res-GRUB-commands-to-manage-the-hash.patch | 382 + ...pended-signatures-Verification-tests.patch | 1410 +- ...rub-Document-signing-GRUB-under-UEFI.patch | 44 + ...nt-signing-GRUB-with-an-appended-sig.patch | 124 + ...ocs-grub-Document-appended-signature.patch | 465 + 0407-libtasn1-Fix-include-path-for-grub.patch | 89 + 0408-docs-fix-duplicated-entries.patch | 81 + ...-Add-support-for-signing-GRUB-with-a.patch | 345 + ...grub-mkimage-with-an-unaligned-appen.patch | 43 + 0411-kern-misc-Implement-grub_strtok.patch | 109 + ...g-command-to-parse-Boot-Loader-Speci.patch | 1347 + ...ge-offset-type-for-grub_util_write_i.patch | 43 + ...blsuki-Check-for-mounted-boot-in-emu.patch | 342 + ...ommand-to-load-Unified-Kernel-Image-.patch | 822 + ...p-Tweaks-in-preparation-for-libtasn1.patch | 168 + ...lsuki-do-not-register-blscfg-command.patch | 43 + ...x-error-in-recursion-depth-calculati.patch | 31 + ...Call-grub_dl_unref-after-fs-fs_close.patch | 43 + ...ister-net_set_vlan-command-on-unload.patch | 32 + ...Unregister-gettext-command-on-module.patch | 62 + ...Unregister-commands-on-module-unload.patch | 55 + ...onal_test-Unregister-commands-on-mod.patch | 44 + ...test-Use-correct-string-length-field.patch | 31 + ...-Ensure-string-length-is-sufficient-.patch | 29 + ...c-check-possible-NULL-pointer-before.patch | 24 + ...exx-Stop-generating-unaligned-append.patch | 81 + ...-Do-not-generate-empty-SBAT-metadata.patch | 61 + ...ge-grub_efi_mm_add_regions-to-keep-t.patch | 72 + ...fault-efi0-as-serial-port-if-present.patch | 61 + ...nclude-PCR-check-enable-disable-func.patch | 56 + ....c-check-if-PCR-is-enable-before-TPM.patch | 26 + ...R8-measurements-at-the-configuration.patch | 73 + 0434-Add-support-for-efi-keyword.patch | 112 + 0435-Change-login-error-message.patch | 130 + ...ction-in-userspace-utils-on-IEEE1275.patch | 47 + ...search.fs_uuid-for-RAID1-on-IEEE1275.patch | 39 + ...-implements-fibre-channel-discovery-.patch | 120 + ...lement-FCP-methods-for-WWPN-and-LUNs.patch | 143 + ...ge-the-logic-of-ieee1275_get_devargs.patch | 59 +- ...enable-NVMeoF-logical-device-transla.patch | 547 + ...rt-added-for-multiple-nvme-bootpaths.patch | 218 + 0444-ieee1275-add-support-for-NVMeoFC.patch | 457 + ...-issue.patch => 0445-Fix-build-issue.patch | 0 0446-loongarch-enable-efi-chainloader.patch | 136 + ...447-newfeature-tpcm-add-tpcm-support.patch | 15 +- ...-back-compatibility-for-linux-kernel.patch | 15 +- ...ongArch-Clear-buffer-for-screen-info.patch | 0 ...odisk-add-OS-provided-secret-support.patch | 93 +- ...retrieving-the-EFI-secret-for-crypto.patch | 7 +- ...-Re-enable-measurements-on-confident.patch | 0 20-grub.install | 47 +- 95-set-boot-entry.install | 44 + 99-grub-mkconfig.install | 12 +- bootstrap | 2 +- bootstrap.conf | 2 +- gen_grub_cfgstub | 29 + gitignore | 281 + grub.macros | 724 + grub.patches | 674 +- grub2.spec | 847 +- sbat.csv.in | 4 +- strtoull_test.c | 63 + 540 files changed, 306746 insertions(+), 33500 deletions(-) create mode 100644 0001-Revert-templates-Fix-user-facing-typo-with-an-incorr.patch delete mode 100644 0001-remove-GNU-Linux-in-menuentry.patch create mode 100644 0002-Revert-templates-Properly-disable-the-os-prober-by-d.patch delete mode 100644 0002-grub2-iterate-and-hook-for-extended-partition.patch create mode 100644 0003-Revert-templates-Disable-the-os-prober-by-default.patch create mode 100644 0004-Rework-linux-command.patch delete mode 100644 0004-fix-error-terminal-gfxterm-isn-t-found.patch create mode 100644 0005-Rework-linux16-command.patch delete mode 100644 0005-fix-menu-in-xen-host-server.patch delete mode 100644 0006-not-display-menu-when-boot-once.patch create mode 100644 0006-re-write-.gitignore.patch rename 0049-IBM-client-architecture-CAS-reboot-support.patch => 0007-IBM-client-architecture-CAS-reboot-support.patch (82%) delete mode 100644 0007-Pass-corret-root-for-nfsroot.patch delete mode 100644 0008-add-grub2-efi-workaround-for-HP.patch create mode 100644 0008-for-ppc-reset-console-display-attr-when-clear-screen.patch rename 0047-ppc64le-disable-video.patch => 0009-Disable-GRUB-video-support-for-IBM-power-machines.patch (77%) delete mode 100644 0010-Don-t-allow-insmod-when-secure-boot-is-enabled.patch rename 0191-Move-bash-completion-script-922997.patch => 0010-Move-bash-completion-script-922997.patch (82%) delete mode 100644 0011-Add-secureboot-support-on-efi-chainloader.patch rename 0192-Allow-fallback-to-include-entries-by-title-not-just-.patch => 0011-Allow-fallback-to-include-entries-by-title-not-just-.patch (85%) create mode 100644 0012-Make-exit-take-a-return-code.patch delete mode 100644 0012-linuxefi-fix-boot-params.patch rename 0232-Make-efi-machines-load-an-env-block-from-a-variable.patch => 0013-Make-efi-machines-load-an-env-block-from-a-variable.patch (79%) delete mode 100644 0013-disable-rsync-to-make-it-possible-to-use-in-RPM-buil.patch rename 0003-Migrate-PPC-from-Yaboot-to-Grub2.patch => 0014-Migrate-PPC-from-Yaboot-to-Grub2.patch (86%) delete mode 100644 0014-Use-GNU-Unifont-instead-of-DejaVu-Sans-in-terminal.patch rename 0179-Add-fw_path-variable-revised.patch => 0015-Add-fw_path-variable-revised.patch (91%) delete mode 100644 0015-use-rpmsort-for-version-sorting.patch rename 0193-Pass-x-hex-hex-straight-through-unmolested.patch => 0016-Pass-x-hex-hex-straight-through-unmolested.patch (71%) delete mode 100644 0016-treat-mdadm-ddf-fakeraid-as-simple-device.patch rename 0194-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch => 0017-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch (94%) delete mode 100644 0017-setup-try-fs-embed-if-mbr-gap-too-small.patch rename 0201-Add-devicetree-loading.patch => 0018-Add-devicetree-loading.patch (72%) delete mode 100644 0018-add-xen-linux16-command.patch rename 0202-Enable-pager-by-default.-985860.patch => 0019-Enable-pager-by-default.-985860.patch (57%) rename 0203-Don-t-say-GNU-Linux-in-generated-menus.patch => 0020-Don-t-say-GNU-Linux-in-generated-menus.patch (37%) delete mode 100644 0020-vbe-blacklist-preferred-1440.patch rename 0204-Add-.eh_frame-to-list-of-relocations-stripped.patch => 0021-Add-.eh_frame-to-list-of-relocations-stripped.patch (82%) delete mode 100644 0021-grubenv-in-btrfs-header.patch rename 0181-Don-t-require-a-password-to-boot-entries-generated-b.patch => 0022-Don-t-require-a-password-to-boot-entries-generated-b.patch (80%) delete mode 100644 0022-set-default-distributor.patch delete mode 100644 0023-efi-chainload-harder.patch rename 0182-use-fw_path-prefix-when-fallback-searching-for-grub-.patch => 0023-use-fw_path-prefix-when-fallback-searching-for-grub-.patch (80%) delete mode 100644 0024-Allocate-LVM-metadata-buffer-from-raw-contents.patch rename 0183-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch => 0024-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch (85%) rename 0184-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch => 0025-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch (84%) delete mode 100644 0025-diskfilter-implementation-of-processing-no-metadata-.patch delete mode 100644 0026-Fix-grub2-mkconfig-warning-when-disk-is-LVM-PV.patch rename 0185-Try-prefix-if-fw_path-doesn-t-work.patch => 0026-Try-prefix-if-fw_path-doesn-t-work.patch (88%) rename 0186-Make-grub2-mkconfig-construct-titles-that-look-like-.patch => 0027-Make-grub2-mkconfig-construct-titles-that-look-like-.patch (82%) delete mode 100644 0027-util-30_os-prober-multiple-initrd.patch rename 0187-Add-friendly-grub2-password-config-tool-985962.patch => 0028-Add-friendly-grub2-password-config-tool-985962.patch (87%) delete mode 100644 0028-linux-getroot-Support-NVDIMM-device-names.patch delete mode 100644 0029-Makefile.am-makes-sure-that-ext2-3-4-is-tried-before.patch rename 0206-tcp-add-window-scaling-support.patch => 0029-tcp-add-window-scaling-support.patch (94%) create mode 100644 0030-efinet-and-bootp-add-support-for-dhcpv6.patch delete mode 100644 0030-grub-install-force-jorunal-draining-tp-emsure-data-i.patch rename 0054-bootp-New-net_bootp6-command.patch => 0031-bootp-New-net_bootp6-command.patch (63%) rename 0207-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch => 0032-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch (85%) create mode 100644 0033-Make-grub_fatal-also-backtrace.patch rename 0188-Make-our-info-pages-say-grub2-where-appropriate.patch => 0034-Make-our-info-pages-say-grub2-where-appropriate.patch (83%) create mode 100644 0035-macos-just-build-chainloader-entries-don-t-try-any-x.patch rename 0031-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch => 0036-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch (86%) create mode 100644 0037-btrfs-fix-a-bad-null-check.patch delete mode 100644 0038-btrfs-08-workaround-snapshot-menu-default-entry.patch rename 0032-export-btrfs_subvol-and-btrfs_subvolid.patch => 0038-export-btrfs_subvol-and-btrfs_subvolid.patch (72%) rename 0033-btrfs-03-follow-default.patch => 0039-grub2-btrfs-03-follow_default.patch (86%) delete mode 100644 0040-btrfs-10-config-directory.patch rename 0034-btrfs-04-grub2-install.patch => 0040-grub2-btrfs-04-grub2-install.patch (84%) delete mode 100644 0041-Use-chainloader-to-boot-xen.efi-under-UEFI.patch rename 0035-btrfs-05-grub2-mkconfig.patch => 0041-grub2-btrfs-05-grub2-mkconfig.patch (71%) delete mode 100644 0042-efi-xen-cmdline.patch rename 0036-btrfs-06-subvol-mount.patch => 0042-grub2-btrfs-06-subvol-mount.patch (83%) rename 0037-btrfs-07-subvol-fallback.patch => 0043-Fallback-to-old-subvol-name-scheme-to-support-old-sn.patch (84%) delete mode 100644 0043-Unquote-parameters-written-to-Xen-EFI-config-file.patch rename 0039-btrfs-09-get-default-subvolume.patch => 0044-Grub-not-working-correctly-with-btrfs-snapshots-bsc-.patch (86%) delete mode 100644 0044-The-grub-can-be-installed-with-removable-option-to-s.patch create mode 100644 0045-Add-grub_efi_allocate_pool-and-grub_efi_free_pool-wr.patch delete mode 100644 0045-Add-hidden-menu-entries.patch delete mode 100644 0046-SUSE-Add-the-t-hotkey.patch create mode 100644 0046-Use-grub_efi_.-memory-helpers-where-reasonable.patch create mode 100644 0047-Add-PRIxGRUB_EFI_STATUS-and-use-it.patch create mode 100644 0048-don-t-use-int-for-efi-status.patch delete mode 100644 0048-ppc64le-memory-map.patch create mode 100644 0049-make-GRUB_MOD_INIT-declare-its-function-prototypes.patch create mode 100644 0050-Don-t-guess-boot-efi-as-HFS-on-ppc-machines-in-grub-.patch delete mode 100644 0050-ppc64-cas-new-scope.patch rename 0208-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch => 0051-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch (74%) delete mode 100644 0051-ppc64-cas-fix-double-free.patch create mode 100644 0052-align-struct-efi_variable-better.patch delete mode 100644 0052-grub-install-remove-useless-check-PReP-partition-is-.patch rename 0196-Add-BLS-support-to-grub-mkconfig.patch => 0053-Add-BLS-support-to-grub-mkconfig.patch (91%) delete mode 100644 0053-efi-gop-avoid-low-resolution.patch create mode 100644 0054-Don-t-attempt-to-backtrace-on-grub_abort-for-grub-em.patch rename 0197-Add-grub2-switch-to-blscfg.patch => 0055-Add-grub2-switch-to-blscfg.patch (95%) create mode 100644 0056-normal-don-t-draw-our-startup-message-if-debug-is-se.patch rename 0209-Work-around-some-minor-include-path-weirdnesses.patch => 0057-Work-around-some-minor-include-path-weirdnesses.patch (95%) rename 0210-Make-it-possible-to-enabled-build-id-sha1.patch => 0058-Make-it-possible-to-enabled-build-id-sha1.patch (87%) create mode 100644 0059-make-better-backtraces.patch delete mode 100644 0060-Build-tpm-as-module.patch create mode 100644 0060-Fixup-for-newer-compiler.patch create mode 100644 0061-Don-t-attempt-to-export-the-start-and-_start-symbols.patch rename 0211-Fixup-for-newer-compiler.patch => 0062-Fixup-for-newer-compiler.patch (74%) create mode 100644 0063-Add-support-for-non-Ethernet-network-cards.patch delete mode 100644 0063-grub-mkcofnig-default-entry-correction.patch rename 0055-efinet-UEFI-IPv6-PXE-support.patch => 0064-efinet-UEFI-IPv6-PXE-support.patch (39%) delete mode 100644 0064-grub-install-handle-signed-grub-installation-on-arm6.patch rename 0056-grub.texi-Add-net_bootp6-doument.patch => 0065-grub.texi-Add-net_bootp6-doument.patch (74%) delete mode 100644 0065-grub2-btrfs-help-on-snapper-rollback.patch rename 0057-bootp-Add-processing-DHCPACK-packet-from-HTTP-Boot.patch => 0066-bootp-Add-processing-DHCPACK-packet-from-HTTP-Boot.patch (34%) delete mode 100644 0066-video-limit-the-resolution-for-fixed-bimap-font.patch create mode 100644 0067-Fix-const-char-pointers-in-grub-core-net-bootp.c.patch delete mode 100644 0067-gfxmenu-support-scrolling-menu-entry-s-text.patch rename 0058-efinet-Setting-network-from-UEFI-device-path.patch => 0068-efinet-Setting-network-from-UEFI-device-path.patch (82%) delete mode 100644 0068-kern-mm.c-Make-grub_calloc-inline.patch delete mode 100644 0069-cmdline-Provide-cmdline-functions-as-module.patch rename 0059-efinet-Setting-DNS-server-from-UEFI-protocol.patch => 0069-efinet-Setting-DNS-server-from-UEFI-protocol.patch (80%) rename 0061-Support-UEFI-networking-protocols.patch => 0070-Support-UEFI-networking-protocols.patch (89%) rename 0062-AUDIT-0-http-boot-tracker-bug.patch => 0071-AUDIT-0-http-boot-tracker-bug.patch (73%) delete mode 100644 0072-Unify-the-check-to-enable-btrfs-relative-path.patch rename 0212-grub-editenv-Add-incr-command-to-increment-integer-v.patch => 0072-grub-editenv-Add-incr-command-to-increment-integer-v.patch (81%) rename 0213-Add-auto-hide-menu-support.patch => 0073-Add-auto-hide-menu-support.patch (86%) delete mode 100644 0073-efi-linux-provide-linux-command.patch rename 0214-Add-grub-set-bootflag-utility.patch => 0074-Add-grub-set-bootflag-utility.patch (95%) delete mode 100644 0074-Add-support-for-Linux-EFI-stub-loading-on-aarch64.patch delete mode 100644 0075-arm64-make-sure-fdt-has-address-cells-and-size-cells.patch rename 0215-docs-Add-grub-boot-indeterminate.service-example.patch => 0075-docs-Add-grub-boot-indeterminate.service-example.patch (83%) rename 0216-gentpl-add-disable-support.patch => 0076-gentpl-add-disable-support.patch (81%) rename 0217-gentpl-add-pc-firmware-type.patch => 0077-gentpl-add-pc-firmware-type.patch (79%) rename 0218-efinet-also-use-the-firmware-acceleration-for-http.patch => 0078-efinet-also-use-the-firmware-acceleration-for-http.patch (78%) rename 0219-efi-http-Make-root_url-reflect-the-protocol-hostname.patch => 0079-efi-http-Make-root_url-reflect-the-protocol-hostname.patch (80%) delete mode 100644 0079-squash-kern-Add-lockdown-support.patch rename 0220-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch => 0080-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch (85%) rename 0221-Rework-how-the-fdt-command-builds.patch => 0081-Rework-how-the-fdt-command-builds.patch (87%) delete mode 100644 0081-Workaround-volatile-efi-boot-variable.patch rename 0222-Disable-non-wordsize-allocations-on-arm.patch => 0082-Disable-non-wordsize-allocations-on-arm.patch (84%) delete mode 100644 0082-templates-Follow-the-path-of-usr-merged-kernel-confi.patch rename 0223-Prepend-prefix-when-HTTP-path-is-relative.patch => 0083-Prepend-prefix-when-HTTP-path-is-relative.patch (90%) delete mode 100644 0083-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch rename 0076-Make-grub_error-more-verbose.patch => 0084-Make-grub_error-more-verbose.patch (81%) delete mode 100644 0085-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch create mode 100644 0085-Make-reset-an-alias-for-the-reboot-command.patch rename 0224-Add-a-version-command.patch => 0086-Add-a-version-command.patch (90%) delete mode 100644 0086-Factor-out-grub_efi_linux_boot.patch rename 0225-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch => 0087-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch (77%) delete mode 100644 0087-Fix-race-in-EFI-validation.patch rename 0226-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch => 0088-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch (90%) rename 0227-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch => 0089-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch (37%) create mode 100644 0090-Fix-getroot.c-s-trampolines.patch rename 0228-Do-not-allow-stack-trampolines-anywhere.patch => 0091-Do-not-allow-stack-trampolines-anywhere.patch (55%) rename 0229-Reimplement-boot_counter.patch => 0092-Reimplement-boot_counter.patch (93%) rename 0230-Fix-menu-entry-selection-based-on-ID-and-title.patch => 0093-Fix-menu-entry-selection-based-on-ID-and-title.patch (85%) rename 0231-Make-the-menu-entry-users-option-argument-to-be-opti.patch => 0094-Make-the-menu-entry-users-option-argument-to-be-opti.patch (86%) rename 0233-Add-efi-export-env-and-efi-load-env-commands.patch => 0095-Add-efi-export-env-and-efi-load-env-commands.patch (89%) delete mode 100644 0096-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch rename 0234-Export-all-variables-from-the-initial-context-when-c.patch => 0096-Export-all-variables-from-the-initial-context-when-c.patch (80%) rename 0235-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch => 0097-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch (89%) create mode 100644 0098-Don-t-assume-that-boot-commands-will-only-return-on-.patch rename 0236-grub-set-bootflag-Update-comment-about-running-as-ro.patch => 0099-grub-set-bootflag-Update-comment-about-running-as-ro.patch (79%) rename 0237-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch => 0100-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch (95%) rename 0238-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch => 0101-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch (94%) rename 0239-Add-start-symbol-for-RISC-V.patch => 0102-Add-start-symbol-for-RISC-V.patch (81%) rename 0240-bootstrap.conf-Force-autogen.sh-to-use-python3.patch => 0103-bootstrap.conf-Force-autogen.sh-to-use-python3.patch (85%) rename 0241-efi-http-Export-fw-http-_path-variables-to-make-them.patch => 0104-efi-http-Export-fw-http-_path-variables-to-make-them.patch (83%) rename 0242-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch => 0105-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch (78%) rename 0243-efi-net-Allow-to-specify-a-port-number-in-addresses.patch => 0106-efi-net-Allow-to-specify-a-port-number-in-addresses.patch (81%) rename 0244-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch => 0107-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch (86%) create mode 100644 0108-efi-net-Print-a-debug-message-if-parsing-the-address.patch create mode 100644 0109-kern-term-Also-accept-F8-as-a-user-interrupt-key.patch rename 0245-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch => 0110-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch (82%) rename 0246-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch => 0111-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch (77%) create mode 100644 0112-efi-dhcp-fix-some-allocation-error-checking.patch rename 0247-efi-http-fix-some-allocation-error-checking.patch => 0113-efi-http-fix-some-allocation-error-checking.patch (71%) create mode 100644 0114-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch create mode 100644 0115-Fix-const-char-pointers-in-grub-core-net-efi-ip4_con.patch create mode 100644 0116-Fix-const-char-pointers-in-grub-core-net-efi-ip6_con.patch delete mode 100644 0116-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch create mode 100644 0117-Fix-const-char-pointers-in-grub-core-net-efi-net.c.patch delete mode 100644 0117-grub-install-Add-SUSE-signed-image-support-for-power.patch delete mode 100644 0118-Add-grub_envblk_buf-helper-function.patch create mode 100644 0118-Fix-const-char-pointers-in-grub-core-net-efi-pxe.c.patch delete mode 100644 0119-Add-grub_disk_write_tail-helper-function.patch rename 0248-Add-systemd-integration-scripts-to-make-systemctl-re.patch => 0119-Add-systemd-integration-scripts-to-make-systemctl-re.patch (84%) delete mode 100644 0120-grub-install-support-prep-environment-block.patch rename 0249-systemd-integration.sh-Also-set-old-menu_show_once-g.patch => 0120-systemd-integration.sh-Also-set-old-menu_show_once-g.patch (85%) delete mode 100644 0121-Introduce-prep_load_env-command.patch rename 0250-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch => 0121-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch (94%) delete mode 100644 0122-export-environment-at-start-up.patch create mode 100644 0122-grub-install-disable-support-for-EFI-platforms.patch rename 0252-New-with-debug-timestamps-configure-flag-to-prepend-.patch => 0123-New-with-debug-timestamps-configure-flag-to-prepend-.patch (85%) delete mode 100644 0123-grub-install-bailout-root-device-probing.patch rename 0253-Added-debug-statements-to-grub_disk_open-and-grub_di.patch => 0124-Added-debug-statements-to-grub_disk_open-and-grub_di.patch (62%) delete mode 100644 0124-install-fix-software-raid1-on-esp.patch rename 0254-Introduce-function-grub_debug_is_enabled-void-return.patch => 0125-Introduce-function-grub_debug_is_enabled-void-return.patch (78%) delete mode 100644 0125-grub-probe-Deduplicate-probed-partmap-output.patch rename 0255-Don-t-clear-screen-when-debugging-is-enabled.patch => 0126-Don-t-clear-screen-when-debugging-is-enabled.patch (69%) delete mode 100644 0126-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch rename 0256-grub_file_-instrumentation-new-file-debug-tag.patch => 0127-grub_file_-instrumentation-new-file-debug-tag.patch (91%) delete mode 100644 0127-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch rename 0080-ieee1275-Avoiding-many-unecessary-open-close.patch => 0128-ieee1275-Avoiding-many-unecessary-open-close.patch (74%) delete mode 100644 0128-protectors-Add-key-protectors-framework.patch rename 0070-ieee1275-powerpc-implements-fibre-channel-discovery-.patch => 0129-ieee1275-powerpc-implements-fibre-channel-discovery-.patch (75%) delete mode 100644 0129-tpm2-Add-TPM-Software-Stack-TSS.patch rename 0071-ieee1275-powerpc-enables-device-mapper-discovery.patch => 0130-ieee1275-powerpc-enables-device-mapper-discovery.patch (84%) delete mode 100644 0130-protectors-Add-TPM2-Key-Protector.patch rename 0257-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch => 0131-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch (97%) delete mode 100644 0131-cryptodisk-Support-key-protectors.patch rename 0097-Add-suport-for-signing-grub-with-an-appended-signatu.patch => 0132-Add-suport-for-signing-grub-with-an-appended-signatu.patch (91%) delete mode 100644 0132-util-grub-protect-Add-new-tool.patch rename 0098-docs-grub-Document-signing-grub-under-UEFI.patch => 0133-docs-grub-Document-signing-grub-under-UEFI.patch (87%) delete mode 100644 0133-linuxefi-Use-common-grub_initrd_load.patch delete mode 100644 0134-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch rename 0099-docs-grub-Document-signing-grub-with-an-appended-sig.patch => 0134-docs-grub-Document-signing-grub-with-an-appended-sig.patch (86%) rename 0100-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch => 0135-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch (79%) delete mode 100644 0135-templates-import-etc-crypttab-to-grub.cfg.patch delete mode 100644 0136-grub-read-pcr.patch rename 0101-pgp-factor-out-rsa_pad.patch => 0136-pgp-factor-out-rsa_pad.patch (92%) rename 0102-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch => 0137-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch (90%) delete mode 100644 0137-tpm-record-pcrs.patch delete mode 100644 0138-grub-install-record-pcrs.patch rename 0103-posix_wrap-tweaks-in-preparation-for-libtasn1.patch => 0138-posix_wrap-tweaks-in-preparation-for-libtasn1.patch (88%) rename 0104-libtasn1-import-libtasn1-4.18.0.patch => 0139-libtasn1-import-libtasn1-4.16.0.patch (85%) delete mode 100644 0139-safe-tpm-pcr-snapshot.patch delete mode 100644 0140-ieee1275-add-support-for-NVMeoFC.patch rename 0105-libtasn1-disable-code-not-needed-in-grub.patch => 0140-libtasn1-disable-code-not-needed-in-grub.patch (63%) delete mode 100644 0141-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch rename 0106-libtasn1-changes-for-grub-compatibility.patch => 0141-libtasn1-changes-for-grub-compatibility.patch (57%) rename 0107-libtasn1-compile-into-asn1-module.patch => 0142-libtasn1-compile-into-asn1-module.patch (89%) delete mode 100644 0143-ofpath-controller-name-update.patch rename 0108-test_asn1-test-module-for-libtasn1.patch => 0143-test_asn1-test-module-for-libtasn1.patch (98%) delete mode 100644 0144-Mark-environmet-blocks-as-used-for-image-embedding.patch rename 0109-grub-install-support-embedding-x509-certificates.patch => 0144-grub-install-support-embedding-x509-certificates.patch (84%) rename 0110-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch => 0145-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch (98%) delete mode 100644 0145-commands-crypttab-increase-the-size-of-the-path-buff.patch rename 0111-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch => 0146-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch (75%) delete mode 100644 0146-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch rename 0112-appended-signatures-support-verifying-appended-signa.patch => 0147-appended-signatures-support-verifying-appended-signa.patch (79%) delete mode 100644 0147-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch create mode 100644 0148-appended-signatures-verification-tests.patch delete mode 100644 0148-tpm2-Add-TPM2-types-structures-and-command-constants.patch rename 0114-appended-signatures-documentation.patch => 0149-appended-signatures-documentation.patch (78%) delete mode 100644 0149-tpm2-Add-more-marshal-unmarshal-functions.patch rename 0115-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch => 0150-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch (89%) delete mode 100644 0150-tpm2-Implement-more-TPM2-commands.patch create mode 100644 0151-ieee1275-drop-HEAP_MAX_ADDR-HEAP_MIN_SIZE.patch delete mode 100644 0151-tpm2-Support-authorized-policy.patch create mode 100644 0152-appendedsig-x509-Also-handle-the-Extended-Key-Usage-.patch delete mode 100644 0152-clean-up-crypttab-and-linux-modules-dependency.patch delete mode 100644 0153-discard-cached-key-before-entering-grub-shell-and-ed.patch create mode 100644 0153-ieee1275-ofdisk-retry-on-open-failure.patch create mode 100644 0154-efinet-Add-DHCP-proxy-support.patch delete mode 100644 0154-ieee1275-ofdisk-retry-on-open-and-read-failure.patch rename 0198-Don-t-update-the-cmdline-when-generating-legacy-menu.patch => 0155-Don-t-update-the-cmdline-when-generating-legacy-menu.patch (84%) delete mode 100644 0155-Restrict-cryptsetup-key-file-permission-for-better-s.patch rename 0258-Suppress-gettext-error-message.patch => 0156-Suppress-gettext-error-message.patch (84%) delete mode 100644 0156-openfw-Ensure-get_devargs-and-get_devname-functions-.patch rename 0259-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch => 0157-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch (83%) delete mode 100644 0157-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch rename 0260-normal-main-Discover-the-device-to-read-the-config-f.patch => 0158-normal-main-Discover-the-device-to-read-the-config-f.patch (94%) delete mode 100644 0158-xen_boot-add-missing-grub_arch_efi_linux_load_image_.patch delete mode 100644 0159-font-Try-memdisk-fonts-with-the-same-name.patch rename 0261-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch => 0159-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch (80%) delete mode 100644 0160-Make-grub.cfg-compatible-to-old-binaries.patch rename 0262-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch => 0160-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch (94%) rename 0263-Add-Fedora-location-of-DejaVu-SANS-font.patch => 0161-Add-Fedora-location-of-DejaVu-SANS-font.patch (85%) delete mode 100644 0161-protectors-Implement-NV-index.patch delete mode 100644 0162-cryptodisk-Fallback-to-passphrase.patch rename 0264-efi-new-connectefi-command.patch => 0162-efi-new-connectefi-command.patch (94%) delete mode 100644 0163-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch rename 0265-powerpc-prefix-detection-support-device-names-with-c.patch => 0163-powerpc-prefix-detection-support-device-names-with-c.patch (91%) delete mode 100644 0164-diskfilter-look-up-cryptodisk-devices-first.patch create mode 100644 0164-make-ofdisk_retries-optional.patch create mode 100644 0165-misc-Make-grub_min-and-grub_max-more-resilient.patch create mode 100644 0166-ReiserFS-switch-to-using-grub_min-grub_max.patch delete mode 100644 0166-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch delete mode 100644 0167-Fix-the-size-calculation-for-the-synthesized-initrd.patch create mode 100644 0167-misc-make-grub_boot_time-also-call-grub_dprintf-boot.patch delete mode 100644 0168-Improve-TPM-key-protection-on-boot-interruptions.patch create mode 100644 0168-modules-make-.module_license-read-only.patch delete mode 100644 0169-Restrict-file-access-on-cryptodisk-print.patch create mode 100644 0169-modules-strip-.llvm_addrsig-sections-and-similar.patch delete mode 100644 0170-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch create mode 100644 0170-modules-Don-t-allocate-space-for-non-allocable-secti.patch delete mode 100644 0171-Key-revocation-on-out-of-bound-file-access.patch create mode 100644 0171-modules-load-module-sections-at-page-aligned-address.patch delete mode 100644 0172-fs-xfs-always-verify-the-total-number-of-entries-is-.patch create mode 100644 0172-nx-add-memory-attribute-get-set-API.patch delete mode 100644 0173-loader-arm64-efi-linux-Remove-magic-number-header-fi.patch create mode 100644 0173-nx-set-page-permissions-for-loaded-modules.patch create mode 100644 0174-nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch delete mode 100644 0174-squash-ieee1275-ofpath-enable-NVMeoF-logical-device-.patch create mode 100644 0175-grub_fs_probe-dprint-errors-from-filesystems.patch delete mode 100644 0175-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch create mode 100644 0176-Make-debug-file-show-which-file-filters-get-run.patch delete mode 100644 0176-ofdisk-add-early_log-support.patch create mode 100644 0177-BLS-create-etc-kernel-cmdline-during-mkconfig.patch delete mode 100644 0177-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch delete mode 100644 0178-Make-bash-completion-work-with-version-2.12-and-befo.patch rename 0199-BLS-create-etc-kernel-cmdline-during-mkconfig.patch => 0178-squish-don-t-dup-rhgb-quiet-check-mtimes.patch (41%) create mode 100644 0179-squish-give-up-on-rhgb-quiet.patch delete mode 100644 0180-Don-t-say-GNU-Linux-in-generated-menus.patch create mode 100644 0180-squish-BLS-only-write-etc-kernel-cmdline-if-writable.patch create mode 100644 0181-blscfg-Don-t-root-device-in-emu-builds.patch create mode 100644 0182-ppc64le-signed-boot-media-changes.patch create mode 100644 0183-core-Fix-several-implicit-function-declarations.patch create mode 100644 0184-ieee1275-request-memory-with-ibm-client-architecture.patch create mode 100644 0185-hostdisk-work-around-proc-not-reporting-size.patch rename 0200-blscfg-check-for-mounted-boot-in-emu.patch => 0186-blscfg-check-for-mounted-boot-in-emu.patch (77%) create mode 100644 0187-grub_dl_set_mem_attrs-fix-format-string.patch create mode 100644 0188-grub_dl_set_mem_attrs-add-self-check-for-the-tramp-G.patch delete mode 100644 0189-disable-some-unsupported-filesystems.patch create mode 100644 0189-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch create mode 100644 0190-emu-Add-switch-root-to-grub-emu.patch delete mode 100644 0190-remove-the-items-of-unsupported-filesystems-in-fs.ls.patch create mode 100644 0191-util-Enable-default-kernel-for-updates.patch create mode 100644 0192-efi-http-change-uint32_t-to-uintn_t.patch create mode 100644 0193-Add-Install-section-to-aux-systemd-units.patch create mode 100644 0194-Fix-missing-include-in-ofdisk.c.patch delete mode 100644 0195-add-bls-for-grub2-btrfs-05-grub2-mkconfig.patch rename 0362-commands-search-Introduce-the-cryptodisk-only-argume.patch => 0195-add-flag-to-only-search-root-dev.patch (30%) create mode 100644 0196-cryptdisk-fix-incorrect-sign-comparison.patch create mode 100644 0197-grub-install-fix-a-sign-comparison-error.patch create mode 100644 0198-grub-mount-work-around-bad-integer-comparison.patch create mode 100644 0199-power-Fix-use-after-free-in-get_slave_from_dm.patch create mode 100644 0200-Fix-some-sign-comparison-errors.patch create mode 100644 0201-normal-Fix-a-discarded-const.patch create mode 100644 0202-at_keyboard-mark-grub_keyboard_controller_write-unus.patch create mode 100644 0203-Fix-another-minor-sign-comparison-error.patch create mode 100644 0204-Track-explicit-module-dependencies-in-Makefile.core..patch create mode 100644 0205-Revert-mm-Assert-that-we-preserve-header-vs-region-a.patch create mode 100644 0206-make-use-the-_CPU-variety-of-build-flags-for-PROGRAM.patch create mode 100644 0207-Work-around-extra_deps.lst-issue.patch create mode 100644 0208-include-proper-attribute-for-an-EFI-API-call-definit.patch create mode 100644 0209-cast-grub_error-status-parameter.patch create mode 100644 0210-remove-unused-varible.patch create mode 100644 0211-cast-grub_net_bootp_packet-pointer.patch create mode 100644 0212-libtasn1-fix-string-overflow-warning.patch rename 0009-Add-support-for-linuxefi.patch => 0213-Add-support-for-Linux-EFI-stub-loading.patch (44%) create mode 100644 0214-fix-i386_pc-on-legacycfg-module.patch create mode 100644 0215-Add-secureboot-support-on-efi-chainloader.patch create mode 100644 0216-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch rename 0205-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch => 0217-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch (80%) create mode 100644 0218-Add-grub_qdprintf-grub_dprintf-without-the-file-line.patch create mode 100644 0219-Make-a-gdb-dprintf-that-tells-us-load-addresses.patch rename 0088-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch => 0220-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch (66%) rename 0089-Try-to-pick-better-locations-for-kernel-and-initrd.patch => 0221-Try-to-pick-better-locations-for-kernel-and-initrd.patch (81%) rename 0090-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch => 0222-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch (86%) rename 0091-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch => 0223-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch (85%) rename 0092-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch => 0224-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch (76%) rename 0093-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch => 0225-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch (87%) rename 0078-efi-Set-image-base-address-before-jumping-to-the-PE-.patch => 0226-efi-Set-image-base-address-before-jumping-to-the-PE-.patch (60%) rename 0094-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch => 0227-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch (88%) rename 0095-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch => 0228-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch (84%) create mode 100644 0229-linuxefi-fail-kernel-validation-without-shim-protoco.patch create mode 100644 0230-Allow-chainloading-EFI-apps-from-loop-mounts.patch create mode 100644 0231-grub-core-loader-i386-efi-linux.c-do-not-validate-ke.patch create mode 100644 0232-grub-core-loader-efi-chainloader.c-do-not-validate-c.patch create mode 100644 0233-grub-core-loader-efi-linux.c-drop-now-unused-grub_li.patch create mode 100644 0234-loader-efi-chainloader-grub_load_and_start_image-doe.patch create mode 100644 0235-loader-efi-chainloader-simplify-the-loader-state.patch create mode 100644 0236-loader-efi-chainloader-Use-grub_loader_set_ex.patch create mode 100644 0237-loader-i386-efi-linux-Avoid-a-use-after-free-in-the-.patch create mode 100644 0238-loader-i386-efi-linux-Use-grub_loader_set_ex.patch create mode 100644 0239-loader-i386-efi-linux-Fix-a-memory-leak-in-the-initr.patch create mode 100644 0240-EFI-allocate-kernel-in-EFI_RUNTIME_SERVICES_CODE-ins.patch create mode 100644 0241-efi-use-enumerated-array-positions-for-our-allocatio.patch create mode 100644 0242-efi-split-allocation-policy-for-kernel-vs-initrd-mem.patch create mode 100644 0243-efi-allocate-the-initrd-within-the-bounds-expressed-.patch create mode 100644 0244-efi-use-EFI_LOADER_-CODE-DATA-for-kernel-and-initrd-.patch create mode 100644 0245-x86-efi-Fix-an-incorrect-array-size-in-kernel-alloca.patch create mode 100644 0246-grub-install-on-EFI-if-forced.patch create mode 100644 0247-Remove-Install-section-from-aux-systemd-units.patch create mode 100644 0248-chainloader-remove-device-path-debug-message.patch rename 0266-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch => 0249-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch (96%) rename 0267-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch => 0250-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch (90%) delete mode 100644 0251-grub-install-disable-support-for-EFI-platforms-unles.patch rename 0268-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch => 0251-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch (85%) create mode 100644 0252-Makefile.core.def-fix-linux-module.patch create mode 100644 0253-Add-support-for-Linux-EFI-stub-loading-on-arm-archit.patch rename 0077-arm-arm64-loader-Better-memory-allocation-and-error-.patch => 0254-arm-arm64-loader-Better-memory-allocation-and-error-.patch (76%) rename 0084-arm64-Fix-EFI-loader-kernel-image-allocation.patch => 0255-arm64-Fix-EFI-loader-kernel-image-allocation.patch (68%) create mode 100644 0256-pe-add-the-DOS-header-struct-and-fix-some-bad-naming.patch create mode 100644 0257-Correct-BSS-zeroing-on-aarch64.patch rename 0165-arm64-Use-proper-memory-type-for-kernel-allocation.patch => 0258-arm64-Use-proper-memory-type-for-kernel-allocation.patch (62%) create mode 100644 0259-normal-Remove-grub_env_set-prefix-in-grub_try_normal.patch create mode 100644 0260-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch create mode 100644 0261-Ignore-warnings-for-incompatible-types.patch create mode 100644 0262-cmd-search-Rework-of-CVE-2023-4001-fix.patch create mode 100644 0263-loader-efi-linux.c-read-the-kernel-image-before-head.patch create mode 100644 0264-nx-set-attrs-in-our-kernel-loaders.patch create mode 100644 0265-efi-Provide-wrappers-for-load_image-start_image.patch create mode 100644 0266-efi-Disallow-fallback-to-legacy-Linux-loader-when-sh.patch create mode 100644 0267-Set-non-executable-stack-sections-on-EFI-assembly-fi.patch create mode 100644 0268-grub-mkconfig.in-turn-off-executable-owner-bit.patch create mode 100644 0269-kern-ieee1275-init-Add-IEEE-1275-Radix-support-for-K.patch delete mode 100644 0269-revert-Add-hidden-menu-entries.patch create mode 100644 0270-grub2-mkconfig-Ensure-grub-cfg-stub-is-not-overwritt.patch delete mode 100644 0270-revert-Add-the-t-hotkey.patch delete mode 100644 0271-add-extra_deps-which-forgot-to-maintained-in-release.patch create mode 100644 0271-grub2-mkconfig-Simplify-os_name-detection.patch create mode 100644 0272-grub-mkconfig-Remove-check-for-mount-point-for-grub-.patch create mode 100644 0273-efi-api.h-include-missing-__grub_efi_api-macros-on-E.patch create mode 100644 0274-grub-core-net-arp.c-fix-variable-name.patch create mode 100644 0275-load-EFI-commands-inside-test-expressions.patch create mode 100644 0276-efi-loader-Check-if-NX-is-required-in-grub_efi_linux.patch create mode 100644 0277-Stop-grub.efi-from-always-printing-dynamic_load_symb.patch delete mode 100644 0277-disk-cryptodisk-Allow-user-to-retry-failed-passphras.patch delete mode 100644 0278-efi-console-Properly-clear-leftover-artifacts-from-t.patch create mode 100644 0278-linuxefi-Invalidate-i-cache-before-starting-the-kern.patch create mode 100644 0279-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch create mode 100644 0280-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch create mode 100644 0281-10_linux.in-escape-semicolon-and-ampersand-on-BLS-up.patch rename 0280-kern-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt.patch => 0282-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch (62%) rename 0283-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch => 0283-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch (67%) create mode 100644 0284-term-ns8250-spcr-return-if-redirection-is-disabled.patch create mode 100644 0285-commands-legacycfg-Avoid-closing-file-twice.patch create mode 100644 0286-disk-ahci.c-remove-conditional-operator-for-endtime.patch delete mode 100644 0304-fs-ntfs-Implement-attribute-verification.patch create mode 100644 0309-cli_lock-Add-build-option-to-block-command-line-inte.patch rename 0276-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch => 0310-disk-cryptodisk-Require-authentication-after-TPM-unl.patch (57%) create mode 100644 0321-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch delete mode 100644 0361-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch create mode 100644 0361-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch create mode 100644 0362-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch delete mode 100644 0363-disk-diskfilter-Introduce-the-cryptocheck-command.patch rename 0279-grub-mkimage-Create-new-ELF-note-for-SBAT.patch => 0363-grub-mkimage-Create-new-ELF-note-for-SBAT.patch (60%) delete mode 100644 0364-commands-search-Add-the-diskfilter-support.patch create mode 100644 0364-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch delete mode 100644 0365-docs-Document-available-crypto-disks-checks.patch create mode 100644 0365-loader-efi-Fix-RISC-V-build.patch delete mode 100644 0366-disk-cryptodisk-Add-the-erase-secrets-function.patch rename 0285-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch => 0366-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch (93%) rename 0284-Use-medany-instead-of-large-model-for-RISCV.patch => 0367-Use-medany-instead-of-large-model-for-RISCV.patch (97%) delete mode 100644 0367-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch create mode 100644 0368-10_linux.in-escape-kernel-option-characters-properly.patch delete mode 100644 0368-cryptocheck-Add-quiet-option.patch create mode 100644 0369-blscfg-check-if-variable-is-escaped-before-consideri.patch create mode 100644 0370-Set-correctly-the-memory-attributes-for-the-kernel-P.patch create mode 100644 0371-script-execute-Don-t-let-trailing-blank-lines-determ.patch create mode 100644 0372-normal-menu-Check-return-code-of-the-script-when-exe.patch create mode 100644 0373-Include-license-into-grub-set-password-util.patch create mode 100644 0374-libgcrypt-Import-libgcrypt-1.11.patch create mode 100644 0375-b64dec-Import-b64dec-from-gpg-error.patch create mode 100644 0376-b64dec-Add-harness-for-compilation-in-GRUB-environme.patch create mode 100644 0377-libgcrypt-Adjust-import-script-definitions-and-API-u.patch create mode 100644 0378-tests-Add-DSA-and-RSA-SEXP-tests.patch create mode 100644 0379-keccak-Disable-acceleration-with-SSE-asm.patch create mode 100644 0380-libgcrypt-Fix-Coverity-warnings.patch create mode 100644 0381-libgcrypt-Remove-now-unneeded-compilation-flag.patch create mode 100644 0382-libgcrypt-Ignore-sign-compare-warnings.patch create mode 100644 0383-libgcrypt-Import-blake-family-of-hashes.patch create mode 100644 0384-util-import_gcry-Make-compatible-with-Python-3.4.patch create mode 100644 0385-util-import_gcry-Fix-pylint-warnings.patch create mode 100644 0386-libgcrypt-Don-t-use-64-bit-division-on-platforms-whe.patch create mode 100644 0387-libgcrypt-Fix-a-memory-leak.patch create mode 100644 0388-docs-Write-how-to-import-new-libgcrypt.patch create mode 100644 0389-pgp-Rename-OBJ_TYPE_PUBKEY-to-OBJ_TYPE_GPG_PUBKEY.patch create mode 100644 0390-grub-install-Support-embedding-x509-certificates.patch create mode 100644 0391-appended-signatures-Import-GNUTLS-s-ASN.1-descriptio.patch create mode 100644 0392-appended-signatures-Parse-ASN1-node.patch create mode 100644 0393-appended-signatures-Parse-PKCS-7-signed-data.patch create mode 100644 0394-appended-signatures-Parse-X.509-certificates.patch create mode 100644 0395-powerpc-ieee1275-Enter-lockdown-based-on-ibm-secure-.patch create mode 100644 0396-appended-signatures-Support-verifying-appended-signa.patch create mode 100644 0397-powerpc-ieee1275-Read-the-db-and-dbx-secure-boot-var.patch create mode 100644 0398-appended-signatures-Introducing-key-management-envir.patch create mode 100644 0399-appended-signatures-Create-db-and-dbx-lists.patch create mode 100644 0400-appended-signatures-Using-db-and-dbx-lists-for-signa.patch create mode 100644 0401-appended-signatures-GRUB-commands-to-manage-the-cert.patch create mode 100644 0402-appended-signatures-GRUB-commands-to-manage-the-hash.patch rename 0113-appended-signatures-verification-tests.patch => 0403-appended-signatures-Verification-tests.patch (50%) create mode 100644 0404-docs-grub-Document-signing-GRUB-under-UEFI.patch create mode 100644 0405-docs-grub-Document-signing-GRUB-with-an-appended-sig.patch create mode 100644 0406-docs-grub-Document-appended-signature.patch create mode 100644 0407-libtasn1-Fix-include-path-for-grub.patch create mode 100644 0408-docs-fix-duplicated-entries.patch create mode 100644 0409-powerpc-ieee1275-Add-support-for-signing-GRUB-with-a.patch create mode 100644 0410-appendedsig-Fix-grub-mkimage-with-an-unaligned-appen.patch create mode 100644 0411-kern-misc-Implement-grub_strtok.patch create mode 100644 0412-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch create mode 100644 0413-util-misc.c-Change-offset-type-for-grub_util_write_i.patch create mode 100644 0414-blsuki-Check-for-mounted-boot-in-emu.patch create mode 100644 0415-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch create mode 100644 0416-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch create mode 100644 0417-blsuki-do-not-register-blscfg-command.patch create mode 100644 0418-commands-test-Fix-error-in-recursion-depth-calculati.patch create mode 100644 0419-kern-file-Call-grub_dl_unref-after-fs-fs_close.patch create mode 100644 0420-net-net-Unregister-net_set_vlan-command-on-unload.patch create mode 100644 0421-gettext-gettext-Unregister-gettext-command-on-module.patch create mode 100644 0422-normal-main-Unregister-commands-on-module-unload.patch create mode 100644 0423-tests-lib-functional_test-Unregister-commands-on-mod.patch create mode 100644 0424-commands-usbtest-Use-correct-string-length-field.patch create mode 100644 0425-commands-usbtest-Ensure-string-length-is-sufficient-.patch create mode 100644 0426-commands-search.c-check-possible-NULL-pointer-before.patch create mode 100644 0427-util-grub-mkimagexx-Stop-generating-unaligned-append.patch create mode 100644 0428-grub-mkimage-Do-not-generate-empty-SBAT-metadata.patch create mode 100644 0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch create mode 100644 0430-term-serial.c-default-efi0-as-serial-port-if-present.patch create mode 100644 0431-commands-tpm.c-include-PCR-check-enable-disable-func.patch create mode 100644 0432-commands-efi-tpm.c-check-if-PCR-is-enable-before-TPM.patch create mode 100644 0433-tpm.c-disable-PCR8-measurements-at-the-configuration.patch create mode 100644 0434-Add-support-for-efi-keyword.patch create mode 100644 0435-Change-login-error-message.patch create mode 100644 0437-mdraid-fix-metadata-1.0-detection-in-userspace-utils-on-IEEE1275.patch create mode 100644 0438-grub-install-use-search.fs_uuid-for-RAID1-on-IEEE1275.patch create mode 100644 0439-ieee1275-powerpc-implements-fibre-channel-discovery-.patch create mode 100644 0440-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch rename 0142-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch => 0441-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch (44%) create mode 100644 0442-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch create mode 100644 0443-ieee1275-support-added-for-multiple-nvme-bootpaths.patch create mode 100644 0444-ieee1275-add-support-for-NVMeoFC.patch rename 0274-Fix-build-issue.patch => 0445-Fix-build-issue.patch (100%) create mode 100644 0446-loongarch-enable-efi-chainloader.patch rename 0272-newfeature-tpcm-add-tpcm-support.patch => 0447-newfeature-tpcm-add-tpcm-support.patch (98%) rename 0273-loongarch-Add-back-compatibility-for-linux-kernel.patch => 0448-loongarch-Add-back-compatibility-for-linux-kernel.patch (99%) rename 0275-LoongArch-Clear-buffer-for-screen-info.patch => 0449-LoongArch-Clear-buffer-for-screen-info.patch (100%) rename 0281-cryptodisk-add-OS-provided-secret-support.patch => 0450-cryptodisk-add-OS-provided-secret-support.patch (64%) rename 0282-efi-Add-API-for-retrieving-the-EFI-secret-for-crypto.patch => 0451-efi-Add-API-for-retrieving-the-EFI-secret-for-crypto.patch (97%) rename 0369-commands-efi-tpm-Re-enable-measurements-on-confident.patch => 0452-commands-efi-tpm-Re-enable-measurements-on-confident.patch (100%) create mode 100644 95-set-boot-entry.install create mode 100644 gen_grub_cfgstub create mode 100644 gitignore create mode 100644 grub.macros create mode 100644 strtoull_test.c diff --git a/0001-Revert-templates-Fix-user-facing-typo-with-an-incorr.patch b/0001-Revert-templates-Fix-user-facing-typo-with-an-incorr.patch new file mode 100644 index 0000000..5162165 --- /dev/null +++ b/0001-Revert-templates-Fix-user-facing-typo-with-an-incorr.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Fri, 11 Jun 2021 12:10:45 +0200 +Subject: [PATCH] Revert "templates: Fix user-facing typo with an incorrect use + of "it's"" + +This reverts commit 722737630889607c3b5761f1f5a48f1674cd2821. +--- + util/grub.d/30_os-prober.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in +index 656301eaf22..376ca47efe4 100644 +--- a/util/grub.d/30_os-prober.in ++++ b/util/grub.d/30_os-prober.in +@@ -36,7 +36,7 @@ if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/n + exit 0 + fi + +-grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIts output will be used to detect bootable binaries on them and create new boot entries.")" ++grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")" + + OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`" + if [ -z "${OSPROBED}" ] ; then diff --git a/0001-remove-GNU-Linux-in-menuentry.patch b/0001-remove-GNU-Linux-in-menuentry.patch deleted file mode 100644 index a520e6d..0000000 --- a/0001-remove-GNU-Linux-in-menuentry.patch +++ /dev/null @@ -1,58 +0,0 @@ -From c0d157fd62db0ce62d2c70969b03a8dca235970f Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 16:24:24 +0800 -Subject: [PATCH 001/272] remove GNU/Linux in menuentry - -Signed-off-by: nilusyi ---- - util/grub.d/10_linux.in | 4 ++-- - util/grub.d/20_linux_xen.in | 4 ++-- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index cc393be7e..b28844f20 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -31,7 +31,7 @@ CLASS="--class gnu-linux --class gnu --class os" - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then - OS=GNU/Linux - else -- OS="${GRUB_DISTRIBUTOR} GNU/Linux" -+ OS="${GRUB_DISTRIBUTOR}" - CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" - fi - -@@ -143,7 +143,7 @@ linux_entry () - message="$(gettext_printf "Loading Linux %s ..." ${version})" - sed "s/^/$submenu_indentation/" << EOF - echo '$(echo "$message" | grub_quote)' -- linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args} -+ linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ${args} - EOF - if test -n "${initrd}" ; then - # TRANSLATORS: ramdisk isn't identifier. Should be translated. -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 94dd8be13..51ef272a4 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -31,7 +31,7 @@ CLASS="--class gnu-linux --class gnu --class os --class xen" - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then - OS=GNU/Linux - else -- OS="${GRUB_DISTRIBUTOR} GNU/Linux" -+ OS="${GRUB_DISTRIBUTOR}" - CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" - fi - -@@ -154,7 +154,7 @@ linux_entry_xsm () - fi - ${xen_loader} ${rel_xen_dirname}/${xen_basename} placeholder ${xen_args} \${xen_rm_opts} - echo '$(echo "$lmessage" | grub_quote)' -- ${module_loader} ${rel_dirname}/${basename} placeholder root=${linux_root_device_thisversion} ro ${args} -+ ${module_loader} ${rel_dirname}/${basename} placeholder root=${linux_root_device_thisversion} ${args} - EOF - if test -n "${initrd}" ; then - # TRANSLATORS: ramdisk isn't identifier. Should be translated. --- -2.41.0 - diff --git a/0002-Revert-templates-Properly-disable-the-os-prober-by-d.patch b/0002-Revert-templates-Properly-disable-the-os-prober-by-d.patch new file mode 100644 index 0000000..aa5a326 --- /dev/null +++ b/0002-Revert-templates-Properly-disable-the-os-prober-by-d.patch @@ -0,0 +1,71 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Fri, 11 Jun 2021 12:10:54 +0200 +Subject: [PATCH] Revert "templates: Properly disable the os-prober by default" + +This reverts commit 54e0a1bbf1e9106901a557195bb35e5e20fb3925. +--- + util/grub-mkconfig.in | 5 +---- + util/grub.d/30_os-prober.in | 8 ++++---- + 2 files changed, 5 insertions(+), 8 deletions(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index 32c480daeb2..7516a015be0 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -140,9 +140,6 @@ GRUB_DEVICE_PARTUUID="`${grub_probe} --device ${GRUB_DEVICE} --target=partuuid 2 + GRUB_DEVICE_BOOT="`${grub_probe} --target=device /boot`" + GRUB_DEVICE_BOOT_UUID="`${grub_probe} --device ${GRUB_DEVICE_BOOT} --target=fs_uuid 2> /dev/null`" || true + +-# Disable os-prober by default due to security reasons. +-GRUB_DISABLE_OS_PROBER="true" +- + # Filesystem for the device containing our userland. Used for stuff like + # choosing Hurd filesystem module. + GRUB_FS="`${grub_probe} --device ${GRUB_DEVICE} --target=fs 2> /dev/null || echo unknown`" +@@ -204,7 +201,6 @@ export GRUB_DEVICE \ + GRUB_DEVICE_PARTUUID \ + GRUB_DEVICE_BOOT \ + GRUB_DEVICE_BOOT_UUID \ +- GRUB_DISABLE_OS_PROBER \ + GRUB_FS \ + GRUB_FONT \ + GRUB_PRELOAD_MODULES \ +@@ -250,6 +246,7 @@ export GRUB_DEFAULT \ + GRUB_BACKGROUND \ + GRUB_THEME \ + GRUB_GFXPAYLOAD_LINUX \ ++ GRUB_DISABLE_OS_PROBER \ + GRUB_INIT_TUNE \ + GRUB_SAVEDEFAULT \ + GRUB_ENABLE_CRYPTODISK \ +diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in +index 376ca47efe4..30f27f15b83 100644 +--- a/util/grub.d/30_os-prober.in ++++ b/util/grub.d/30_os-prober.in +@@ -26,8 +26,8 @@ export TEXTDOMAINDIR="@localedir@" + + . "$pkgdatadir/grub-mkconfig_lib" + +-if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then +- grub_warn "$(gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.")" ++if [ "x${GRUB_DISABLE_OS_PROBER}" = "xfalse" ]; then ++ gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.\n" + exit 0 + fi + +@@ -36,12 +36,12 @@ if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/n + exit 0 + fi + +-grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")" +- + OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`" + if [ -z "${OSPROBED}" ] ; then + # empty os-prober output, nothing doing + exit 0 ++else ++ grub_warn "$(gettext_printf "os-prober was executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")" + fi + + osx_entry() { diff --git a/0002-grub2-iterate-and-hook-for-extended-partition.patch b/0002-grub2-iterate-and-hook-for-extended-partition.patch deleted file mode 100644 index b31e971..0000000 --- a/0002-grub2-iterate-and-hook-for-extended-partition.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 774bb390b2851497dc9dea84b422874cbc0b480f Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 16:34:00 +0800 -Subject: [PATCH 002/272] grub2 iterate and hook for extended partition - -From: Michael Chang - -The same as in the previous patch, add a support for installing grub -into an extended partition. - -Here, we do not ignore extended partitions anymore. Instead we call a -hook that makes sure we have the partition when installing. - -Signed-off-by: Jiri Slaby -References: https://bugzilla.novell.com/show_bug.cgi?id=750897 - -From: Andrey Borzenkov - -Apply this logic only to primary extended partition. Ignore extended -partitions that are used to link together logical partitions. - -References: https://bugzilla.novell.com/show_bug.cgi?id=785341 ---- - grub-core/partmap/msdos.c | 19 +++++++++++++------ - 1 file changed, 13 insertions(+), 6 deletions(-) - -diff --git a/grub-core/partmap/msdos.c b/grub-core/partmap/msdos.c -index c85bb74be..ccc56a4ac 100644 ---- a/grub-core/partmap/msdos.c -+++ b/grub-core/partmap/msdos.c -@@ -188,13 +188,20 @@ grub_partition_msdos_iterate (grub_disk_t disk, - (unsigned long long) p.len); - - /* If this partition is a normal one, call the hook. */ -- if (! grub_msdos_partition_is_empty (e->type) -- && ! grub_msdos_partition_is_extended (e->type)) -+ if (! grub_msdos_partition_is_empty (e->type)) - { -- p.number++; -- -- if (hook (disk, &p, hook_data)) -- return grub_errno; -+ if (!grub_msdos_partition_is_extended (e->type) || p.number < 3) -+ { -+ p.number++; -+ -+ /* prevent someone doing mkfs or mkswap on an -+ extended partition, but leave room for LILO */ -+ if (grub_msdos_partition_is_extended (e->type)) -+ p.len = 2; -+ -+ if (hook (disk, &p, hook_data)) -+ return grub_errno; -+ } - } - else if (p.number < 3) - /* If this partition is a logical one, shouldn't increase the --- -2.41.0 - diff --git a/0003-Revert-templates-Disable-the-os-prober-by-default.patch b/0003-Revert-templates-Disable-the-os-prober-by-default.patch new file mode 100644 index 0000000..a51779d --- /dev/null +++ b/0003-Revert-templates-Disable-the-os-prober-by-default.patch @@ -0,0 +1,70 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Fri, 11 Jun 2021 12:10:58 +0200 +Subject: [PATCH] Revert "templates: Disable the os-prober by default" + +This reverts commit e346414725a70e5c74ee87ca14e580c66f517666. +--- + docs/grub.texi | 18 ++++++++---------- + util/grub.d/30_os-prober.in | 5 +---- + 2 files changed, 9 insertions(+), 14 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index a225f9a88d2..974bc0ddb07 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -1552,13 +1552,10 @@ boot sequence. If you have problems, set this option to @samp{text} and + GRUB will tell Linux to boot in normal text mode. + + @item GRUB_DISABLE_OS_PROBER +-The @command{grub-mkconfig} has a feature to use the external +-@command{os-prober} program to discover other operating systems installed on +-the same machine and generate appropriate menu entries for them. It is disabled +-by default since automatic and silent execution of @command{os-prober}, and +-creating boot entries based on that data, is a potential attack vector. Set +-this option to @samp{false} to enable this feature in the +-@command{grub-mkconfig} command. ++Normally, @command{grub-mkconfig} will try to use the external ++@command{os-prober} program, if installed, to discover other operating ++systems installed on the same system and generate appropriate menu entries ++for them. Set this option to @samp{true} to disable this. + + @item GRUB_OS_PROBER_SKIP_LIST + List of space-separated FS UUIDs of filesystems to be ignored from os-prober +@@ -1889,9 +1886,10 @@ than zero; otherwise 0. + @section Multi-boot manual config + + Currently autogenerating config files for multi-boot environments depends on +-os-prober and has several shortcomings. Due to that it is disabled by default. +-It is advised to use the power of GRUB syntax and do it yourself. A possible +-configuration is detailed here, feel free to adjust to your needs. ++os-prober and has several shortcomings. While fixing it is scheduled for the ++next release, meanwhile you can make use of the power of GRUB syntax and do it ++yourself. A possible configuration is detailed here, feel free to adjust to your ++needs. + + First create a separate GRUB partition, big enough to hold GRUB. Some of the + following entries show how to load OS installer images from this same partition, +diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in +index 30f27f15b83..f300e46fc6a 100644 +--- a/util/grub.d/30_os-prober.in ++++ b/util/grub.d/30_os-prober.in +@@ -26,8 +26,7 @@ export TEXTDOMAINDIR="@localedir@" + + . "$pkgdatadir/grub-mkconfig_lib" + +-if [ "x${GRUB_DISABLE_OS_PROBER}" = "xfalse" ]; then +- gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.\n" ++if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then + exit 0 + fi + +@@ -40,8 +39,6 @@ OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`" + if [ -z "${OSPROBED}" ] ; then + # empty os-prober output, nothing doing + exit 0 +-else +- grub_warn "$(gettext_printf "os-prober was executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")" + fi + + osx_entry() { diff --git a/0004-Rework-linux-command.patch b/0004-Rework-linux-command.patch new file mode 100644 index 0000000..26d10ac --- /dev/null +++ b/0004-Rework-linux-command.patch @@ -0,0 +1,109 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Sun, 9 Aug 2015 16:12:39 -0700 +Subject: [PATCH] Rework linux command + +We want a single buffer that contains the entire kernel image in order to +perform a TPM measurement. Allocate one and copy the entire kernel into it +before pulling out the individual blocks later on. + +Signed-off-by: Matthew Garrett +--- + grub-core/loader/i386/linux.c | 35 +++++++++++++++++++++++------------ + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 977757f2cc9..10f967f2563 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -661,13 +661,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + { + grub_file_t file = 0; + struct linux_i386_kernel_header lh; ++ grub_uint8_t *linux_params_ptr; + grub_uint8_t setup_sects; +- grub_size_t real_size, prot_size, prot_file_size; ++ grub_size_t real_size, prot_size, prot_file_size, kernel_offset; + grub_ssize_t len; + int i; + grub_size_t align, min_align; + int relocatable; + grub_uint64_t preferred_address = GRUB_LINUX_BZIMAGE_ADDR; ++ grub_uint8_t *kernel = NULL; + + grub_dl_ref (my_mod); + +@@ -681,7 +683,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + if (! file) + goto fail; + +- if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh)) ++ len = grub_file_size (file); ++ kernel = grub_malloc (len); ++ if (!kernel) ++ { ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel buffer")); ++ goto fail; ++ } ++ ++ if (grub_file_read (file, kernel, len) != len) + { + if (!grub_errno) + grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +@@ -689,6 +699,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ grub_memcpy (&lh, kernel, sizeof (lh)); ++ kernel_offset = sizeof (lh); ++ + if (lh.boot_flag != grub_cpu_to_le16_compile_time (0xaa55)) + { + grub_error (GRUB_ERR_BAD_OS, "invalid magic number"); +@@ -796,13 +809,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + /* We've already read lh so there is no need to read it second time. */ + len -= sizeof(lh); + +- if ((len > 0) && +- (grub_file_read (file, (char *) &linux_params + sizeof (lh), len) != len)) ++ linux_params_ptr = (void *)&linux_params; ++ if (len > 0) + { +- if (!grub_errno) +- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +- argv[0]); +- goto fail; ++ grub_memcpy (linux_params_ptr + sizeof (lh), kernel + kernel_offset, len); ++ kernel_offset += len; + } + + linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; +@@ -865,7 +876,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + /* The other parameters are filled when booting. */ + +- grub_file_seek (file, real_size + GRUB_DISK_SECTOR_SIZE); ++ kernel_offset = real_size + GRUB_DISK_SECTOR_SIZE; + + grub_dprintf ("linux", "bzImage, setup=0x%x, size=0x%x\n", + (unsigned) real_size, (unsigned) prot_size); +@@ -1019,9 +1030,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + + len = prot_file_size; +- if (grub_file_read (file, prot_mode_mem, len) != len && !grub_errno) +- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +- argv[0]); ++ grub_memcpy (prot_mode_mem, kernel + kernel_offset, len); + + if (grub_errno == GRUB_ERR_NONE) + { +@@ -1032,6 +1041,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + fail: + ++ grub_free (kernel); ++ + if (file) + grub_file_close (file); + diff --git a/0004-fix-error-terminal-gfxterm-isn-t-found.patch b/0004-fix-error-terminal-gfxterm-isn-t-found.patch deleted file mode 100644 index e2c87a8..0000000 --- a/0004-fix-error-terminal-gfxterm-isn-t-found.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 3c55b964c5bf63a65359e51cb82bad8df99e5429 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 18 Jul 2012 14:54:32 +0800 -Subject: [PATCH 004/272] fix error: terminal 'gfxterm' isn't found - -References: bnc#771393 -Patch-Mainline: no - -If set GRUB_TERMINAL="gfxterm", the error message "terminal -'gfxterm' isn't found" will be logged to screen. This is caused -by GRUB_TERMINAL_INPUT erroneously set to gfxterm. This patch -fixes the issue by not setting it. - -v2: -Fix error gfxterm isn't found with multiple terminals (bsc#1187565) ---- - util/grub-mkconfig.in | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index 32c480dae..d377fd080 100644 ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -172,7 +172,8 @@ fi - - # XXX: should this be deprecated at some point? - if [ "x${GRUB_TERMINAL}" != "x" ] ; then -- GRUB_TERMINAL_INPUT="${GRUB_TERMINAL}" -+# bnc#771393, bsc#1187565 - fix error: terminal 'gfxterm' isn't found. -+ GRUB_TERMINAL_INPUT="`echo ${GRUB_TERMINAL} | sed -e '/\bgfxterm\b/{s/\bconsole\b//g;s/\bgfxterm\b/console/}'`" - GRUB_TERMINAL_OUTPUT="${GRUB_TERMINAL}" - fi - --- -2.41.0 - diff --git a/0005-Rework-linux16-command.patch b/0005-Rework-linux16-command.patch new file mode 100644 index 0000000..50a648c --- /dev/null +++ b/0005-Rework-linux16-command.patch @@ -0,0 +1,99 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Sun, 9 Aug 2015 16:20:58 -0700 +Subject: [PATCH] Rework linux16 command + +We want a single buffer that contains the entire kernel image in order to +perform a TPM measurement. Allocate one and copy the entire kernel int it +before pulling out the individual blocks later on. + +Signed-off-by: Matthew Garrett +--- + grub-core/loader/i386/pc/linux.c | 33 +++++++++++++++++++++------------ + 1 file changed, 21 insertions(+), 12 deletions(-) + +diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c +index 4adeee9ae00..600530a742b 100644 +--- a/grub-core/loader/i386/pc/linux.c ++++ b/grub-core/loader/i386/pc/linux.c +@@ -124,13 +124,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_file_t file = 0; + struct linux_i386_kernel_header lh; + grub_uint8_t setup_sects; +- grub_size_t real_size; ++ grub_size_t real_size, kernel_offset = 0; + grub_ssize_t len; + int i; + char *grub_linux_prot_chunk; + int grub_linux_is_bzimage; + grub_addr_t grub_linux_prot_target; + grub_err_t err; ++ grub_uint8_t *kernel = NULL; + + grub_dl_ref (my_mod); + +@@ -144,7 +145,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + if (! file) + goto fail; + +- if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh)) ++ len = grub_file_size (file); ++ kernel = grub_malloc (len); ++ if (!kernel) ++ { ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel buffer")); ++ goto fail; ++ } ++ ++ if (grub_file_read (file, kernel, len) != len) + { + if (!grub_errno) + grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +@@ -152,6 +161,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ grub_memcpy (&lh, kernel, sizeof (lh)); ++ kernel_offset = sizeof (lh); ++ + if (lh.boot_flag != grub_cpu_to_le16_compile_time (0xaa55)) + { + grub_error (GRUB_ERR_BAD_OS, "invalid magic number"); +@@ -320,13 +332,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_memmove (grub_linux_real_chunk, &lh, sizeof (lh)); + + len = real_size + GRUB_DISK_SECTOR_SIZE - sizeof (lh); +- if (grub_file_read (file, grub_linux_real_chunk + sizeof (lh), len) != len) +- { +- if (!grub_errno) +- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +- argv[0]); +- goto fail; +- } ++ grub_memcpy (grub_linux_real_chunk + sizeof (lh), kernel + kernel_offset, ++ len); ++ kernel_offset += len; + + if (lh.header != grub_cpu_to_le32_compile_time (GRUB_LINUX_I386_MAGIC_SIGNATURE) + || grub_le_to_cpu16 (lh.version) < 0x0200) +@@ -364,9 +372,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + + len = grub_linux16_prot_size; +- if (grub_file_read (file, grub_linux_prot_chunk, len) != len && !grub_errno) +- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +- argv[0]); ++ grub_memcpy (grub_linux_prot_chunk, kernel + kernel_offset, len); ++ kernel_offset += len; + + if (grub_errno == GRUB_ERR_NONE) + { +@@ -376,6 +383,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + fail: + ++ grub_free (kernel); ++ + if (file) + grub_file_close (file); + diff --git a/0005-fix-menu-in-xen-host-server.patch b/0005-fix-menu-in-xen-host-server.patch deleted file mode 100644 index c8ff3d2..0000000 --- a/0005-fix-menu-in-xen-host-server.patch +++ /dev/null @@ -1,115 +0,0 @@ -From cb2a37f34bb7066d476195ae0cedadf1969a21bb Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 19 Jul 2012 18:43:55 +0800 -Subject: [PATCH 005/272] fix menu in xen host server - -References: bnc#771689, bnc#757895 -Patch-Mainline: no - -When system is configred as "Xen Virtual Machines Host Server", the -grub2 menu is not well organized. We could see some issues on it. - - - Many duplicated xen entries generated by links to xen hypervisor - - Non bootable kernel entries trying to boot xen kernel natively - - The -dbg xen hypervisor takes precedence over release version - -This patch fixes above three issues. - -v2: -References: bnc#877040 -Create only hypervisor pointed by /boot/xen.gz symlink to not clutter -the menu with multiple versions and also not include -dbg. Use custom.cfg -if you need any other custom entries. ---- - util/grub.d/10_linux.in | 34 ++++++++++++++++++++++++++++++++++ - util/grub.d/20_linux_xen.in | 22 ++++++++++++++++++---- - 2 files changed, 52 insertions(+), 4 deletions(-) - -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index b28844f20..618b50a85 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -258,6 +258,40 @@ for linux in ${reverse_sorted_list}; do - fi - done - -+ # try to get the kernel config if $linux is a symlink -+ if test -z "${config}" ; then -+ lnk_version=`basename \`readlink -f $linux\` | sed -e "s,^[^0-9]*-,,g"` -+ if (test -n ${lnk_version} && test -e "${dirname}/config-${lnk_version}") ; then -+ config="${dirname}/config-${lnk_version}" -+ fi -+ fi -+ -+ # check if we are in xen domU -+ if [ ! -e /proc/xen/xsd_port -a -e /proc/xen ]; then -+ # we're running on xen domU guest -+ dmi=/sys/class/dmi/id -+ if [ -r "${dmi}/product_name" -a -r "${dmi}/sys_vendor" ]; then -+ product_name=`cat ${dmi}/product_name` -+ sys_vendor=`cat ${dmi}/sys_vendor` -+ if test "${sys_vendor}" = "Xen" -a "${product_name}" = "HVM domU"; then -+ # xen HVM guest -+ xen_pv_domU=false -+ fi -+ fi -+ else -+ # we're running on baremetal or xen dom0 -+ xen_pv_domU=false -+ fi -+ -+ if test "$xen_pv_domU" = "false" ; then -+ # prevent xen kernel without pv_opt support from booting -+ if (grep -qx "CONFIG_XEN=y" "${config}" 2> /dev/null && ! grep -qx "CONFIG_PARAVIRT=y" "${config}" 2> /dev/null); then -+ echo "Skip xenlinux kernel $linux" >&2 -+ list=`echo $list | tr ' ' '\n' | grep -vx $linux | tr '\n' ' '` -+ continue -+ fi -+ fi -+ - initramfs= - if test -n "${config}" ; then - initramfs=`grep CONFIG_INITRAMFS_SOURCE= "${config}" | cut -f2 -d= | tr -d \"` -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 51ef272a4..113b4ed20 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -26,6 +26,12 @@ datarootdir="@datarootdir@" - export TEXTDOMAIN=@PACKAGE@ - export TEXTDOMAINDIR="@localedir@" - -+if [ ! -e /proc/xen/xsd_port -a -e /proc/xen ]; then -+# we're running on xen domU guest -+# prevent setting up nested virt on HVM or PV domU guest -+ exit 0 -+fi -+ - CLASS="--class gnu-linux --class gnu --class os --class xen" - - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then -@@ -213,10 +219,18 @@ file_is_not_xen_garbage () { - esac - } - --xen_list= --for i in /boot/xen*; do -- if grub_file_is_not_garbage "$i" && file_is_not_xen_garbage "$i" ; then xen_list="$xen_list $i" ; fi --done -+# bnc#877040 - Duplicate entries for boot menu created -+# only create /boot/xen.gz symlink boot entry -+if test -L /boot/xen.gz; then -+ xen_list=`readlink -f /boot/xen.gz` -+else -+ # bnc#757895 - Grub2 menu items incorrect when "Xen Virtual Machines Host Server" selected -+ # wildcard expasion with correct suffix (.gz) for not generating many duplicated menu entries -+ xen_list= -+ for i in /boot/xen*.gz; do -+ if grub_file_is_not_garbage "$i" && file_is_not_sym "$i" ; then xen_list="$xen_list $i" ; fi -+ done -+fi - prepare_boot_cache= - boot_device_id= - --- -2.41.0 - diff --git a/0006-not-display-menu-when-boot-once.patch b/0006-not-display-menu-when-boot-once.patch deleted file mode 100644 index 92aad6b..0000000 --- a/0006-not-display-menu-when-boot-once.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 3304d2656b6a3c2bb706b69f4cb0e022fc596374 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 1 Aug 2012 15:46:34 +0800 -Subject: [PATCH 006/272] not display menu when boot once - -References: bnc#771587 -Patch-Mainline: no - -We should prevent the menu from being displayed if boot once is -specified. This is in order to compliant with Grub1's behavior -and is better than current as it's not make any sense to bother -user to make decision when decision has been made. ---- - util/grub.d/00_header.in | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 6a316a5ba..be29d7148 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -304,7 +304,9 @@ make_timeout () - style="menu" - fi - cat << EOF --if [ x\$feature_timeout_style = xy ] ; then -+if [ x\${boot_once} = xtrue ]; then -+ set timeout=0 -+elif [ x\$feature_timeout_style = xy ] ; then - set timeout_style=${style} - set timeout=${timeout} - EOF --- -2.41.0 - diff --git a/0006-re-write-.gitignore.patch b/0006-re-write-.gitignore.patch new file mode 100644 index 0000000..36b0efd --- /dev/null +++ b/0006-re-write-.gitignore.patch @@ -0,0 +1,246 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jul 2019 12:55:29 +0200 +Subject: [PATCH] re-write .gitignore + +--- + .gitignore | 150 ++++++++++++++++++++++++++++++++++++++ + docs/.gitignore | 5 ++ + grub-core/.gitignore | 16 ++++ + grub-core/lib/.gitignore | 1 + + include/grub/gcrypt/.gitignore | 2 + + po/.gitignore | 5 ++ + util/bash-completion.d/.gitignore | 2 + + 7 files changed, 181 insertions(+) + create mode 100644 docs/.gitignore + create mode 100644 grub-core/.gitignore + create mode 100644 grub-core/lib/.gitignore + create mode 100644 include/grub/gcrypt/.gitignore + create mode 100644 po/.gitignore + create mode 100644 util/bash-completion.d/.gitignore + +diff --git a/.gitignore b/.gitignore +index 4d0dfb700e4..a18787dcfe6 100644 +--- a/.gitignore ++++ b/.gitignore +@@ -279,3 +279,153 @@ widthspec.bin + /xfs_test + /xzcompress_test + /zfs_test ++======= ++# things ./autogen.sh will create ++/Makefile.utilgcry.def ++/ABOUT-NLS ++/aclocal.m4 ++/autom4te.cache ++/build-aux ++/configure ++/gnulib ++/grub-core/lib/gnulib/ ++/Makefile ++ ++# things very common editors create that we never want ++*~ ++.*.sw? ++*.patch ++ ++# stuff you're likely to make while building test trees ++grub.cfg ++/build*/ ++ ++# built objects across the whole tree ++Makefile.in ++*.a ++*.am ++*.efi ++*.exec ++*.image ++*.img ++*.info ++*.lst ++*.marker ++/m4 ++*.mod ++*.module ++*.o ++*.pf2 ++*.yy.[ch] ++.deps/ ++.deps-core/ ++.deps-util/ ++.dirstamp ++ ++# next are things you get if you do ./configure in the topdir (for e.g. ++# "make dist" invocation. ++/config-util.h ++/config.h ++/include/grub/cpu ++/include/grub/machine ++/INSTALL ++/INSTALL.grub ++/po/Makefile.in.in ++/po/Makevars ++/po/Makevars.template ++/po/POTFILES ++/po/Rules-quot ++/stamp-h ++/stamp-h1 ++bootstrap.log ++config.log ++config.status ++ ++# stuff "make dist" creates ++ChangeLog ++grub-*.tar ++grub-*.tar.* ++ ++# stuff "make" creates ++/[[:digit:]][[:digit:]]_?* ++/ascii.h ++/build-grub-gen-asciih ++/build-grub-gen-widthspec ++/build-grub-mkfont ++/config-util.h.in ++/garbage-gen ++/grub*-bios-setup ++/grub*-bios-setup.8 ++/grub*-editenv ++/grub*-editenv.1 ++/grub*-file ++/grub*-file.1 ++/grub*-fs-tester ++/grub*-fstest ++/grub*-fstest.1 ++/grub*-get-kernel-settings ++/grub*-get-kernel-settings.3 ++/grub*-glue-efi ++/grub*-glue-efi.1 ++/grub*-install ++/grub*-install.8 ++/grub*-kbdcomp ++/grub*-kbdcomp.1 ++/grub*-macbless ++/grub*-macbless.8 ++/grub*-menulst2cfg ++/grub*-menulst2cfg.1 ++/grub*-mount ++/grub*-mount.1 ++/grub*-mkconfig ++/grub*-mkconfig.8 ++/grub*-mkconfig_lib ++/grub*-mkfont ++/grub*-mkfont.1 ++/grub*-mkimage ++/grub*-mkimage.1 ++/grub*-mklayout ++/grub*-mklayout.1 ++/grub*-mknetdir ++/grub*-mknetdir.1 ++/grub*-mkpasswd-pbkdf2 ++/grub*-mkpasswd-pbkdf2.1 ++/grub*-mkrelpath ++/grub*-mkrelpath.1 ++/grub*-mkrescue ++/grub*-mkrescue.1 ++/grub*-mkstandalone ++/grub*-mkstandalone.1 ++/grub*-ofpathname ++/grub*-ofpathname.8 ++/grub*-probe ++/grub*-probe.8 ++/grub*-reboot ++/grub*-reboot.8 ++/grub*-render-label ++/grub*-render-label.1 ++/grub*-script-check ++/grub*-script-check.1 ++/grub*-set-bootflag ++/grub*-set-bootflag.1 ++/grub*-set-default ++/grub*-set-default.8 ++/grub*-set-password ++/grub*-set-password.8 ++/grub*-shell ++/grub*-shell-tester ++/grub*-sparc64-setup ++/grub*-sparc64-setup.8 ++/grub*-syslinux2cfg ++/grub*-syslinux2cfg.1 ++/grub*-switch-to-blscfg ++/grub*-switch-to-blscfg.8 ++/grub_fstest.pp ++/grub_fstest_init.c ++/grub_fstest_init.lst ++/grub_script.tab.[ch] ++/libgrub.pp ++/libgrub_a_init.c ++/libgrub_a_init.lst ++/stamp-h.in ++/widthspec.h +diff --git a/docs/.gitignore b/docs/.gitignore +new file mode 100644 +index 00000000000..e1d849ef95b +--- /dev/null ++++ b/docs/.gitignore +@@ -0,0 +1,5 @@ ++/*.in ++/Makefile ++/stamp-1 ++/stamp-vti ++/version*.texi +diff --git a/grub-core/.gitignore b/grub-core/.gitignore +new file mode 100644 +index 00000000000..2acce281159 +--- /dev/null ++++ b/grub-core/.gitignore +@@ -0,0 +1,16 @@ ++/*.lst ++/Makefile ++/Makefile.gcry.def ++/unidata.c ++/build-grub-module-verifier ++/gdb_grub ++/genmod.sh ++/gensyminfo.sh ++/gentrigtables ++/gmodule.pl ++/grub_script.tab.[ch] ++/modinfo.sh ++/rs_decoder.h ++/symlist.c ++/symlist.h ++/trigtables.c +diff --git a/grub-core/lib/.gitignore b/grub-core/lib/.gitignore +new file mode 100644 +index 00000000000..68154591404 +--- /dev/null ++++ b/grub-core/lib/.gitignore +@@ -0,0 +1 @@ ++/libgcrypt-grub/ +diff --git a/include/grub/gcrypt/.gitignore b/include/grub/gcrypt/.gitignore +new file mode 100644 +index 00000000000..8fbf5646246 +--- /dev/null ++++ b/include/grub/gcrypt/.gitignore +@@ -0,0 +1,2 @@ ++g10lib.h ++gcrypt.h +diff --git a/po/.gitignore b/po/.gitignore +new file mode 100644 +index 00000000000..f507e7741e3 +--- /dev/null ++++ b/po/.gitignore +@@ -0,0 +1,5 @@ ++/Makefile ++/POTFILES*.in ++/grub.pot ++/remove-potcdate.sed ++/stamp-po +diff --git a/util/bash-completion.d/.gitignore b/util/bash-completion.d/.gitignore +new file mode 100644 +index 00000000000..6813a527ad3 +--- /dev/null ++++ b/util/bash-completion.d/.gitignore +@@ -0,0 +1,2 @@ ++Makefile ++grub diff --git a/0049-IBM-client-architecture-CAS-reboot-support.patch b/0007-IBM-client-architecture-CAS-reboot-support.patch similarity index 82% rename from 0049-IBM-client-architecture-CAS-reboot-support.patch rename to 0007-IBM-client-architecture-CAS-reboot-support.patch index 11d2db4..4475534 100644 --- a/0049-IBM-client-architecture-CAS-reboot-support.patch +++ b/0007-IBM-client-architecture-CAS-reboot-support.patch @@ -1,37 +1,42 @@ -From 109deee22dfe7c1694d12e3f07823607ecb55dbf Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Paulo Flabiano Smorigo Date: Thu, 20 Sep 2012 18:07:39 -0300 -Subject: [PATCH 049/272] IBM client architecture (CAS) reboot support +Subject: [PATCH] IBM client architecture (CAS) reboot support This is an implementation of IBM client architecture (CAS) reboot for GRUB. There are cases where the POWER firmware must reboot in order to support specific features requested by a kernel. The kernel calls -ibm,client-architecture-support and it may either return or reboot with the new -feature set. eg: +ibm,client-architecture-support and it may either return or reboot with +the new feature set. eg: Calling ibm,client-architecture-support.../ Elapsed time since release of system processors: 70959 mins 50 secs Welcome to GRUB! -Instead of return to the GRUB menu, it will check if the flag for CAS reboot is -set. If so, grub will automatically boot the last booted kernel using the same -parameters +Instead of return to the GRUB menu, it will check if the flag for CAS +reboot is set. If so, grub will automatically boot the last booted +kernel using the same parameters + +Signed-off-by: Paulo Flabiano Smorigo +[rharwood@redhat.com: commit message rewrap] +Signed-off-by: Robbie Harwood --- - grub-core/kern/ieee1275/openfw.c | 63 ++++++++++++++++++++++++++++++++ - grub-core/normal/main.c | 18 +++++++++ - grub-core/script/execute.c | 7 ++++ - include/grub/ieee1275/ieee1275.h | 2 + - 4 files changed, 90 insertions(+) + grub-core/kern/ieee1275/openfw.c | 63 ++++++++++++++++++++++++++++++++++++++++ + grub-core/normal/main.c | 19 ++++++++++++ + grub-core/script/execute.c | 7 +++++ + include/grub/ieee1275/ieee1275.h | 2 ++ + 4 files changed, 91 insertions(+) diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c -index cba4da5a0..af3d844c0 100644 +index 11b2beb2ff2..e2ecc65d2d8 100644 --- a/grub-core/kern/ieee1275/openfw.c +++ b/grub-core/kern/ieee1275/openfw.c -@@ -593,6 +593,69 @@ grub_ieee1275_canonicalise_devname (const char *path) - return NULL; - } +@@ -591,3 +591,66 @@ grub_ieee1275_get_boot_dev (void) + return bootpath; + } ++ +/* Check if it's a CAS reboot. If so, set the script to be executed. */ +int +grub_ieee1275_cas_reboot (char *script) @@ -87,19 +92,15 @@ index cba4da5a0..af3d844c0 100644 + grub_ieee1275_ihandle_t options; + grub_ssize_t actual; + -+ grub_dprintf("ieee1275", "set boot_last_label (size: %" PRIxGRUB_SIZE ")\n", grub_strlen(text)); ++ grub_dprintf("ieee1275", "set boot_last_label (size: %u)\n", grub_strlen(text)); + if (! grub_ieee1275_finddevice ("/options", &options) && + options != (grub_ieee1275_ihandle_t) -1) + grub_ieee1275_set_property (options, "boot-last-label", text, + grub_strlen (text), &actual); + return 0; +} -+ - char * - grub_ieee1275_get_boot_dev (void) - { diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index bd4431000..baa63b2ed 100644 +index bd44310005d..d3f53d93d87 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -34,6 +34,9 @@ @@ -112,7 +113,7 @@ index bd4431000..baa63b2ed 100644 GRUB_MOD_LICENSE ("GPLv3+"); -@@ -276,6 +279,21 @@ grub_normal_execute (const char *config, int nested, int batch) +@@ -276,6 +279,22 @@ grub_normal_execute (const char *config, int nested, int batch) { menu = read_config_file (config); @@ -123,6 +124,7 @@ index bd4431000..baa63b2ed 100644 + script = grub_malloc (1024); + if (! grub_ieee1275_cas_reboot (script)) + { ++ char *dummy[1] = { NULL }; + if (! grub_script_execute_sourcecode (script)) + boot = 1; + } @@ -135,7 +137,7 @@ index bd4431000..baa63b2ed 100644 grub_errno = GRUB_ERR_NONE; } diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c -index 14ff09094..dab8fd2ae 100644 +index 14ff09094f0..dab8fd2aeb0 100644 --- a/grub-core/script/execute.c +++ b/grub-core/script/execute.c @@ -28,6 +28,9 @@ @@ -160,10 +162,10 @@ index 14ff09094..dab8fd2ae 100644 { char *line; diff --git a/include/grub/ieee1275/ieee1275.h b/include/grub/ieee1275/ieee1275.h -index 362c8bece..a99bb210f 100644 +index dddb385149e..4f6e6aaa098 100644 --- a/include/grub/ieee1275/ieee1275.h +++ b/include/grub/ieee1275/ieee1275.h -@@ -260,6 +260,8 @@ int EXPORT_FUNC(grub_ieee1275_devalias_next) (struct grub_ieee1275_devalias *ali +@@ -251,6 +251,8 @@ int EXPORT_FUNC(grub_ieee1275_devalias_next) (struct grub_ieee1275_devalias *ali void EXPORT_FUNC(grub_ieee1275_children_peer) (struct grub_ieee1275_devalias *alias); void EXPORT_FUNC(grub_ieee1275_children_first) (const char *devpath, struct grub_ieee1275_devalias *alias); @@ -172,6 +174,3 @@ index 362c8bece..a99bb210f 100644 char *EXPORT_FUNC(grub_ieee1275_get_boot_dev) (void); --- -2.41.0 - diff --git a/0007-Pass-corret-root-for-nfsroot.patch b/0007-Pass-corret-root-for-nfsroot.patch deleted file mode 100644 index db17d6e..0000000 --- a/0007-Pass-corret-root-for-nfsroot.patch +++ /dev/null @@ -1,145 +0,0 @@ -From b1e10641beec8088391232f71c41df1d63219a29 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 30 Aug 2012 15:43:17 +0800 -Subject: [PATCH 007/272] Pass corret root= for nfsroot - -References: bnc#774548, bsc#1069094 -Patch-Mainline: no - -Fix / is mounted on nfs. The fix is to pass kernel parameters -with correct root= for nfs. However since grub2 doesn't support -nfs file system module, the /boot on nfs is not possible and -grub2-probe not work in probing nfs mounted path. The fix is merely -on the script level and not use grub2-probe for above reasons. - -v2: Filter out autofs and securityfs from /proc/self/mountinfo (bsc#1069094) ---- - util/grub-mkconfig.in | 50 +++++++++++++++++++++++++++++-------- - util/grub.d/10_linux.in | 8 +++++- - util/grub.d/20_linux_xen.in | 7 +++++- - 3 files changed, 52 insertions(+), 13 deletions(-) - -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index d377fd080..a722cf691 100644 ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -131,26 +131,54 @@ else - exit 1 - fi - --# Device containing our userland. Typically used for root= parameter. --GRUB_DEVICE="`${grub_probe} --target=device /`" --GRUB_DEVICE_UUID="`${grub_probe} --device ${GRUB_DEVICE} --target=fs_uuid 2> /dev/null`" || true --GRUB_DEVICE_PARTUUID="`${grub_probe} --device ${GRUB_DEVICE} --target=partuuid 2> /dev/null`" || true -+probe_nfsroot_device () { -+ while read line ; do -+ part1=`echo $line | sed -e 's! - .*$!!'` -+ part2=`echo $line | sed -n -e 's! - \(.*\)$!\n\1!p' | sed 1d` -+ -+ set -- $part1 -+ path=$5 -+ -+ set -- $part2 -+ fstype=$1 -+ device=$2 -+ -+ if [ "x${path}" = "x/" ] && -+ [ "x${fstype}" = "xnfs" -o "x${fstype}" = "xnfs4" ] ; then -+ echo "${fstype}:$device" -+ return -+ fi -+ done -+} - --# Device containing our /boot partition. Usually the same as GRUB_DEVICE. --GRUB_DEVICE_BOOT="`${grub_probe} --target=device /boot`" --GRUB_DEVICE_BOOT_UUID="`${grub_probe} --device ${GRUB_DEVICE_BOOT} --target=fs_uuid 2> /dev/null`" || true -+NFSROOT_DEVICE="`awk '($9!="autofs")&&($9!="securityfs")' /proc/self/mountinfo | probe_nfsroot_device`" - - # Disable os-prober by default due to security reasons. - GRUB_DISABLE_OS_PROBER="true" - --# Filesystem for the device containing our userland. Used for stuff like --# choosing Hurd filesystem module. --GRUB_FS="`${grub_probe} --device ${GRUB_DEVICE} --target=fs 2> /dev/null || echo unknown`" -+if [ "x${NFSROOT_DEVICE}" != "x" ]; then -+ GRUB_DEVICE="" -+ GRUB_DEVICE_UUID="" -+ GRUB_DEVICE_PARTUUID="" -+ GRUB_FS="unknown" -+else -+ # Filesystem for the device containing our userland. Used for stuff like -+ # choosing Hurd filesystem module. -+ GRUB_FS="`${grub_probe} --device ${GRUB_DEVICE} --target=fs 2> /dev/null || echo unknown`" -+ # Device containing our userland. Typically used for root= parameter. -+ GRUB_DEVICE="`${grub_probe} --target=device /`" -+ GRUB_DEVICE_UUID="`${grub_probe} --device ${GRUB_DEVICE} --target=fs_uuid 2> /dev/null`" || true -+ GRUB_DEVICE_PARTUUID="`${grub_probe} --device ${GRUB_DEVICE} --target=partuuid 2> /dev/null`" || true -+fi - --if [ x"$GRUB_FS" = xunknown ]; then -+if [ x"$GRUB_FS" = x ] || [ x"$GRUB_FS" = xunknown ]; then - GRUB_FS="$(stat -f -c %T / || echo unknown)" - fi - -+# Device containing our /boot partition. Usually the same as GRUB_DEVICE. -+GRUB_DEVICE_BOOT="`${grub_probe} --target=device /boot`" -+GRUB_DEVICE_BOOT_UUID="`${grub_probe} --device ${GRUB_DEVICE_BOOT} --target=fs_uuid 2> /dev/null`" || true -+ - # Provide a default set of stock linux early initrd images. - # Define here so the list can be modified in the sourced config file. - if [ "x${GRUB_EARLY_INITRD_LINUX_STOCK}" = "x" ]; then -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 618b50a85..523d13e81 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -88,6 +88,12 @@ linux_entry () - type="$3" - args="$4" - -+ if [ -n "${linux_root_device_thisversion}" ]; then -+ root_device="root=${linux_root_device_thisversion}" -+ else -+ root_device="" -+ fi -+ - if [ -z "$boot_device_id" ]; then - boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" - fi -@@ -143,7 +149,7 @@ linux_entry () - message="$(gettext_printf "Loading Linux %s ..." ${version})" - sed "s/^/$submenu_indentation/" << EOF - echo '$(echo "$message" | grub_quote)' -- linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ${args} -+ linux ${rel_dirname}/${basename} ${root_device} ${args} - EOF - if test -n "${initrd}" ; then - # TRANSLATORS: ramdisk isn't identifier. Should be translated. -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 113b4ed20..ee445068f 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -109,6 +109,11 @@ linux_entry_xsm () - args="$5" - xen_args="$6" - xsm="$7" -+ if [ -n "${linux_root_device_thisversion}" ]; then -+ root_device="root=${linux_root_device_thisversion}" -+ else -+ root_device="" -+ fi - # If user wants to enable XSM support, make sure there's - # corresponding policy file. - xenpolicy= -@@ -160,7 +165,7 @@ linux_entry_xsm () - fi - ${xen_loader} ${rel_xen_dirname}/${xen_basename} placeholder ${xen_args} \${xen_rm_opts} - echo '$(echo "$lmessage" | grub_quote)' -- ${module_loader} ${rel_dirname}/${basename} placeholder root=${linux_root_device_thisversion} ${args} -+ ${module_loader} ${rel_dirname}/${basename} placeholder ${root_device} ${args} - EOF - if test -n "${initrd}" ; then - # TRANSLATORS: ramdisk isn't identifier. Should be translated. --- -2.41.0 - diff --git a/0008-add-grub2-efi-workaround-for-HP.patch b/0008-add-grub2-efi-workaround-for-HP.patch deleted file mode 100644 index aa4054b..0000000 --- a/0008-add-grub2-efi-workaround-for-HP.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 0f3241d9ebe10b335db3e481dfae8b25d7f37d86 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 16:46:41 +0800 -Subject: [PATCH 008/272] add grub2 efi workaround for HP - -v2: Add GRUB_FILE_TYPE_CONFIG to grub_file_open, see also upstream commit -ca0a4f689 verifiers: File type for fine-grained signature-verification controlling - -Signed-off-by: Michael Chang ---- - grub-core/kern/efi/init.c | 68 +++++++++++++++++++++++++++++++++++++++ - 1 file changed, 68 insertions(+) - -diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c -index 6c54af6e7..6ce623466 100644 ---- a/grub-core/kern/efi/init.c -+++ b/grub-core/kern/efi/init.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - - #ifdef GRUB_STACK_PROTECTOR -@@ -136,6 +137,67 @@ grub_efi_init (void) - void (*grub_efi_net_config) (grub_efi_handle_t hnd, - char **device, - char **path); -+static char * -+workaround_efi_firmware_path (const char *device, const char *path) -+{ -+ char *config = NULL;; -+ char *config_upper = NULL; -+ char *path_upper = NULL; -+ char *ret_path = NULL; -+ grub_file_t config_fd = NULL; -+ char *s; -+ -+ if (!device || !path) -+ return NULL; -+ -+ /* only workaround if booting off from cd device */ -+ if (grub_strncmp (device, "cd", 2) != 0) -+ goto quit; -+ -+ config = grub_xasprintf ("(%s)%s/grub.cfg", device, path); -+ config_fd = grub_file_open (config, GRUB_FILE_TYPE_CONFIG); -+ -+ /* everything's fine, so quit the workaround */ -+ if (config_fd) -+ goto quit; -+ -+ /* reset grub error state because noone else does... */ -+ grub_errno = GRUB_ERR_NONE; -+ -+ /* try again, this time upper case path */ -+ path_upper = grub_strdup (path); -+ if (! path_upper) -+ goto quit; -+ -+ s = path_upper; -+ for (; *s; s++) *s = grub_toupper(*s); -+ -+ config_upper = grub_xasprintf ("(%s)%s/grub.cfg", device, path_upper); -+ if (! config_upper) -+ goto quit; -+ -+ config_fd = grub_file_open (config_upper, GRUB_FILE_TYPE_CONFIG); -+ -+ /* if config can be found by the upper case path, return it */ -+ if (config_fd) -+ ret_path = grub_strdup (path_upper); -+ -+quit: -+ -+ if (config_fd) -+ grub_file_close (config_fd); -+ -+ if (grub_errno) -+ grub_errno = GRUB_ERR_NONE; -+ -+ if (config) -+ grub_free (config); -+ -+ if (config_upper) -+ grub_free (config_upper); -+ -+ return ret_path; -+} - - void - grub_machine_get_bootlocation (char **device, char **path) -@@ -160,6 +222,12 @@ grub_machine_get_bootlocation (char **device, char **path) - p = grub_strrchr (*path, '/'); - if (p) - *p = '\0'; -+ -+ if ((p = workaround_efi_firmware_path (*device, *path))) -+ { -+ grub_free (*path); -+ *path = p; -+ } - } - } - --- -2.41.0 - diff --git a/0008-for-ppc-reset-console-display-attr-when-clear-screen.patch b/0008-for-ppc-reset-console-display-attr-when-clear-screen.patch new file mode 100644 index 0000000..6335939 --- /dev/null +++ b/0008-for-ppc-reset-console-display-attr-when-clear-screen.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Paulo Flabiano Smorigo +Date: Wed, 24 Apr 2013 10:51:48 -0300 +Subject: [PATCH] for ppc, reset console display attr when clear screen + +v2: Also use \x0c instead of a literal ^L to make future patches less +awkward. + +This should fix this bugzilla: +https://bugzilla.redhat.com/show_bug.cgi?id=908519 + +Signed-off-by: Peter Jones +Signed-off-by: Paulo Flabiano Smorigo +Signed-off-by: Robbie Harwood +--- + grub-core/term/terminfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/term/terminfo.c b/grub-core/term/terminfo.c +index 4e534c683eb..3dbe88e8933 100644 +--- a/grub-core/term/terminfo.c ++++ b/grub-core/term/terminfo.c +@@ -151,7 +151,7 @@ grub_terminfo_set_current (struct grub_term_output *term, + /* Clear the screen. Using serial console, screen(1) only recognizes the + * ANSI escape sequence. Using video console, Apple Open Firmware + * (version 3.1.1) only recognizes the literal ^L. So use both. */ +- data->cls = grub_strdup (" \e[2J"); ++ data->cls = grub_strdup ("\x0c\e[2J\e[m"); + data->reverse_video_on = grub_strdup ("\e[7m"); + data->reverse_video_off = grub_strdup ("\e[m"); + if (grub_strcmp ("ieee1275", str) == 0) diff --git a/0047-ppc64le-disable-video.patch b/0009-Disable-GRUB-video-support-for-IBM-power-machines.patch similarity index 77% rename from 0047-ppc64le-disable-video.patch rename to 0009-Disable-GRUB-video-support-for-IBM-power-machines.patch index cf8263a..d55e7d0 100644 --- a/0047-ppc64le-disable-video.patch +++ b/0009-Disable-GRUB-video-support-for-IBM-power-machines.patch @@ -1,12 +1,13 @@ -From 7b2ba2f1f005ad435a28f19060869ac4ff2a47d1 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:33:36 +0800 -Subject: [PATCH 047/272] ppc64le disable video +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Paulo Flabiano Smorigo +Date: Tue, 11 Jun 2013 15:14:05 -0300 +Subject: [PATCH] Disable GRUB video support for IBM power machines Should fix the problem in bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=973205 Signed-off-by: Paulo Flabiano Smorigo +Signed-off-by: Robbie Harwood --- grub-core/kern/ieee1275/cmain.c | 5 ++++- grub-core/video/ieee1275.c | 9 ++++++--- @@ -14,7 +15,7 @@ Signed-off-by: Paulo Flabiano Smorigo 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/grub-core/kern/ieee1275/cmain.c b/grub-core/kern/ieee1275/cmain.c -index e74de3248..7e2887763 100644 +index e74de32483f..810a089a934 100644 --- a/grub-core/kern/ieee1275/cmain.c +++ b/grub-core/kern/ieee1275/cmain.c @@ -89,7 +89,10 @@ grub_ieee1275_find_options (void) @@ -23,14 +24,14 @@ index e74de3248..7e2887763 100644 if (rc >= 0 && grub_strncmp (tmp, "IBM", 3) == 0) - grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_NO_TREE_SCANNING_FOR_DISKS); + { -+ grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_NO_TREE_SCANNING_FOR_DISKS); -+ grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_DISABLE_VIDEO_SUPPORT); ++ grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_NO_TREE_SCANNING_FOR_DISKS); ++ grub_ieee1275_set_flag (GRUB_IEEE1275_FLAG_DISABLE_VIDEO_SUPPORT); + } /* Old Macs have no key repeat, newer ones have fully working one. The ones inbetween when repeated key generates an escaoe sequence diff --git a/grub-core/video/ieee1275.c b/grub-core/video/ieee1275.c -index ca3d3c3b2..5592e4bb7 100644 +index ca3d3c3b2c8..5592e4bb7c9 100644 --- a/grub-core/video/ieee1275.c +++ b/grub-core/video/ieee1275.c @@ -351,9 +351,12 @@ static struct grub_video_adapter grub_video_ieee1275_adapter = @@ -50,7 +51,7 @@ index ca3d3c3b2..5592e4bb7 100644 GRUB_MOD_FINI(ieee1275_fb) diff --git a/include/grub/ieee1275/ieee1275.h b/include/grub/ieee1275/ieee1275.h -index dddb38514..eadb84531 100644 +index 4f6e6aaa098..db0ec5f4c68 100644 --- a/include/grub/ieee1275/ieee1275.h +++ b/include/grub/ieee1275/ieee1275.h @@ -145,6 +145,8 @@ enum grub_ieee1275_flag @@ -62,6 +63,3 @@ index dddb38514..eadb84531 100644 }; extern int EXPORT_FUNC(grub_ieee1275_test_flag) (enum grub_ieee1275_flag flag); --- -2.41.0 - diff --git a/0010-Don-t-allow-insmod-when-secure-boot-is-enabled.patch b/0010-Don-t-allow-insmod-when-secure-boot-is-enabled.patch deleted file mode 100644 index 5da4b49..0000000 --- a/0010-Don-t-allow-insmod-when-secure-boot-is-enabled.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 3c48e0fdd6d149f6231c0832b069b3ebb06898a1 Mon Sep 17 00:00:00 2001 -From: Colin Watson -Date: Tue, 23 Oct 2012 10:40:49 -0400 -Subject: [PATCH 010/272] Don't allow insmod when secure boot is enabled. - -References: fate#314485 -Patch-Mainline: no - -v2: -Use grub_efi_get_secureboot to get secure boot status - -Signed-off-by: Michael Chang ---- - grub-core/kern/dl.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) - -diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c -index 0bf40caa6..535b5267a 100644 ---- a/grub-core/kern/dl.c -+++ b/grub-core/kern/dl.c -@@ -38,6 +38,10 @@ - #define GRUB_MODULES_MACHINE_READONLY - #endif - -+#ifdef GRUB_MACHINE_EFI -+#include -+#endif -+ - - - #pragma GCC diagnostic ignored "-Wcast-align" -@@ -708,6 +712,19 @@ grub_dl_load_file (const char *filename) - - grub_boot_time ("Loading module %s", filename); - -+#ifdef GRUB_MACHINE_EFI -+ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) -+ { -+#if 0 -+ /* This is an error, but grub2-mkconfig still generates a pile of -+ * insmod commands, so emitting it would be mostly just obnoxious. */ -+ grub_error (GRUB_ERR_ACCESS_DENIED, -+ "Secure Boot forbids loading module from %s", filename); -+#endif -+ return 0; -+ } -+#endif -+ - file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE); - if (! file) - return 0; --- -2.41.0 - diff --git a/0191-Move-bash-completion-script-922997.patch b/0010-Move-bash-completion-script-922997.patch similarity index 82% rename from 0191-Move-bash-completion-script-922997.patch rename to 0010-Move-bash-completion-script-922997.patch index 79a0cac..113f8b0 100644 --- a/0191-Move-bash-completion-script-922997.patch +++ b/0010-Move-bash-completion-script-922997.patch @@ -1,7 +1,7 @@ -From f909e05c9d4e07eabdeddffb1b4d7e5799b7e272 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 3 Apr 2013 14:35:34 -0400 -Subject: [PATCH 191/272] Move bash completion script (#922997) +Subject: [PATCH] Move bash completion script (#922997) Apparently these go in a new place now. --- @@ -10,10 +10,10 @@ Apparently these go in a new place now. 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 08e7d2236..4388ab483 100644 +index cd667a2eb75..ae3a49321ad 100644 --- a/configure.ac +++ b/configure.ac -@@ -321,6 +321,14 @@ AC_SUBST(grubdirname) +@@ -319,6 +319,14 @@ AC_SUBST(grubdirname) AC_DEFINE_UNQUOTED(GRUB_DIR_NAME, "$grubdirname", [Default grub directory name]) @@ -28,7 +28,7 @@ index 08e7d2236..4388ab483 100644 # # Checks for build programs. # -@@ -536,6 +544,9 @@ HOST_CFLAGS="$HOST_CFLAGS $grub_cv_cc_w_extra_flags" +@@ -534,6 +542,9 @@ HOST_CFLAGS="$HOST_CFLAGS $grub_cv_cc_w_extra_flags" # Check for target programs. # @@ -39,7 +39,7 @@ index 08e7d2236..4388ab483 100644 if test "x$target_alias" != x && test "x$host_alias" != "x$target_alias"; then tmp_ac_tool_prefix="$ac_tool_prefix" diff --git a/util/bash-completion.d/Makefile.am b/util/bash-completion.d/Makefile.am -index 136287cf1..61108f054 100644 +index 136287cf1bf..61108f05429 100644 --- a/util/bash-completion.d/Makefile.am +++ b/util/bash-completion.d/Makefile.am @@ -6,7 +6,6 @@ EXTRA_DIST = $(bash_completion_source) @@ -50,6 +50,3 @@ index 136287cf1..61108f054 100644 bashcompletion_DATA = $(bash_completion_script) $(bash_completion_script): $(bash_completion_source) $(top_builddir)/config.status --- -2.41.0 - diff --git a/0011-Add-secureboot-support-on-efi-chainloader.patch b/0011-Add-secureboot-support-on-efi-chainloader.patch deleted file mode 100644 index 1596cc8..0000000 --- a/0011-Add-secureboot-support-on-efi-chainloader.patch +++ /dev/null @@ -1,601 +0,0 @@ -From f6ed4341fb9be79e6158e9c4fdf00420e5d2f66a Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 18 Dec 2012 16:54:03 +0800 -Subject: [PATCH 011/272] Add secureboot support on efi chainloader - -References: fate#314485 -Patch-Mainline: no - -Expand the chainloader to be able to verify the image by means of shim -lock protocol. The PE/COFF image is loaded and relocated by the -chainloader instead of calling LoadImage and StartImage UEFI boot -Service as they require positive verification result from keys enrolled -in KEK or DB. The shim will use MOK in addition to firmware enrolled -keys to verify the image. - -The chainloader module could be used to load other UEFI bootloaders, -such as xen.efi, and could be signed by any of MOK, KEK or DB. - -v1: -Use grub_efi_get_secureboot to get secure boot status - -Signed-off-by: Michael Chang ---- - grub-core/loader/efi/chainloader.c | 512 +++++++++++++++++++++++++++-- - 1 file changed, 484 insertions(+), 28 deletions(-) - -diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c -index 1de98f783..5359b2507 100644 ---- a/grub-core/loader/efi/chainloader.c -+++ b/grub-core/loader/efi/chainloader.c -@@ -41,10 +41,24 @@ - #include - #endif - -+#ifdef __x86_64__ -+#define SUPPORT_SECURE_BOOT -+#endif -+ -+#ifdef SUPPORT_SECURE_BOOT -+#include -+#include -+#endif -+ - GRUB_MOD_LICENSE ("GPLv3+"); - - static grub_dl_t my_mod; - -+#ifdef SUPPORT_SECURE_BOOT -+static grub_efi_boolean_t debug_secureboot = 0; -+static grub_efi_status_t (__grub_efi_api *entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); -+#endif -+ - static grub_err_t - grub_chainloader_unload (void *context) - { -@@ -209,6 +223,421 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) - return file_path; - } - -+#ifdef SUPPORT_SECURE_BOOT -+#define SHIM_LOCK_GUID \ -+ { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} } -+ -+struct grub_pe32_header_no_msdos_stub -+{ -+ char signature[GRUB_PE32_SIGNATURE_SIZE]; -+ struct grub_pe32_coff_header coff_header; -+ struct grub_pe64_optional_header optional_header; -+}; -+ -+struct pe_coff_loader_image_context -+{ -+ grub_efi_uint64_t image_address; -+ grub_efi_uint64_t image_size; -+ grub_efi_uint64_t entry_point; -+ grub_efi_uintn_t size_of_headers; -+ grub_efi_uint16_t image_type; -+ grub_efi_uint16_t number_of_sections; -+ struct grub_pe32_section_table *first_section; -+ struct grub_pe32_data_directory *reloc_dir; -+ struct grub_pe32_data_directory *sec_dir; -+ grub_efi_uint64_t number_of_rva_and_sizes; -+ struct grub_pe32_header_no_msdos_stub *pe_hdr; -+}; -+ -+struct grub_secureboot_chainloader_context -+{ -+ grub_efi_physical_address_t address; -+ grub_efi_uintn_t pages; -+ grub_ssize_t fsize; -+ grub_efi_device_path_t *file_path; -+ grub_efi_char16_t *cmdline; -+ grub_ssize_t cmdline_len; -+ grub_efi_handle_t dev_handle; -+}; -+ -+typedef struct pe_coff_loader_image_context pe_coff_loader_image_context_t; -+ -+struct grub_efi_shim_lock -+{ -+ grub_efi_status_t (*verify)(void *buffer, -+ grub_efi_uint32_t size); -+ grub_efi_status_t (*hash)(void *data, -+ grub_efi_int32_t datasize, -+ pe_coff_loader_image_context_t *context, -+ grub_efi_uint8_t *sha256hash, -+ grub_efi_uint8_t *sha1hash); -+ grub_efi_status_t (*context)(void *data, -+ grub_efi_uint32_t size, -+ pe_coff_loader_image_context_t *context); -+}; -+ -+typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; -+ -+static grub_efi_boolean_t -+grub_secure_validate (void *data, grub_efi_uint32_t size) -+{ -+ grub_guid_t guid = SHIM_LOCK_GUID; -+ grub_efi_shim_lock_t *shim_lock; -+ -+ shim_lock = grub_efi_locate_protocol (&guid, NULL); -+ -+ if (!shim_lock) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol"); -+ return 0; -+ } -+ -+ if (shim_lock->verify (data, size) == GRUB_EFI_SUCCESS) -+ { -+ grub_dprintf ("chain", "verify success\n"); -+ return 1; -+ } -+ -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "verify failed"); -+ return 0; -+} -+ -+static grub_efi_boolean_t -+read_header (void *data, grub_efi_uint32_t size, pe_coff_loader_image_context_t *context) -+{ -+ grub_efi_guid_t guid = SHIM_LOCK_GUID; -+ grub_efi_shim_lock_t *shim_lock; -+ grub_efi_status_t status; -+ -+ shim_lock = grub_efi_locate_protocol (&guid, NULL); -+ -+ if (!shim_lock) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol"); -+ return 0; -+ } -+ -+ status = shim_lock->context (data, size, context); -+ -+ if (status == GRUB_EFI_SUCCESS) -+ { -+ grub_dprintf ("chain", "context success\n"); -+ return 1; -+ } -+ -+ switch (status) -+ { -+ case GRUB_EFI_UNSUPPORTED: -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error unsupported"); -+ break; -+ case GRUB_EFI_INVALID_PARAMETER: -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error invalid parameter"); -+ break; -+ default: -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error code"); -+ break; -+ } -+ -+ return 0; -+} -+ -+static void* -+image_address (void *image, grub_efi_uint64_t sz, grub_efi_uint64_t adr) -+{ -+ if (adr > sz) -+ return NULL; -+ -+ return ((grub_uint8_t*)image + adr); -+} -+ -+static grub_efi_status_t -+relocate_coff (pe_coff_loader_image_context_t *context, void *data) -+{ -+ struct grub_pe32_data_directory *reloc_base, *reloc_base_end; -+ grub_efi_uint64_t adjust; -+ grub_efi_uint16_t *reloc, *reloc_end; -+ char *fixup, *fixup_base, *fixup_data = NULL; -+ grub_efi_uint16_t *fixup_16; -+ grub_efi_uint32_t *fixup_32; -+ grub_efi_uint64_t *fixup_64; -+ -+ grub_efi_uint64_t size = context->image_size; -+ void *image_end = (char *)data + size; -+ -+ context->pe_hdr->optional_header.image_base = (grub_uint64_t)data; -+ -+ if (context->number_of_rva_and_sizes <= 5 || context->reloc_dir->size == 0) -+ { -+ grub_dprintf ("chain", "no need to reloc, we are done\n"); -+ return GRUB_EFI_SUCCESS; -+ } -+ -+ reloc_base = image_address (data, size, context->reloc_dir->rva); -+ reloc_base_end = image_address (data, size, context->reloc_dir->rva + context->reloc_dir->size -1); -+ -+ grub_dprintf ("chain", "reloc_base %p reloc_base_end %p\n", reloc_base, reloc_base_end); -+ -+ if (!reloc_base || !reloc_base_end) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary"); -+ return GRUB_EFI_UNSUPPORTED; -+ } -+ -+ adjust = (grub_uint64_t)data - context->image_address; -+ -+ while (reloc_base < reloc_base_end) -+ { -+ reloc = (grub_uint16_t *)((char*)reloc_base + sizeof (struct grub_pe32_data_directory)); -+ reloc_end = (grub_uint16_t *)((char*)reloc_base + reloc_base->size); -+ -+ if ((void *)reloc_end < data || (void *)reloc_end > image_end) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary"); -+ return GRUB_EFI_UNSUPPORTED; -+ } -+ -+ fixup_base = image_address(data, size, reloc_base->rva); -+ -+ if (!fixup_base) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid fixupbase"); -+ return GRUB_EFI_UNSUPPORTED; -+ } -+ -+ while (reloc < reloc_end) -+ { -+ fixup = fixup_base + (*reloc & 0xFFF); -+ switch ((*reloc) >> 12) -+ { -+ case GRUB_PE32_REL_BASED_ABSOLUTE: -+ break; -+ case GRUB_PE32_REL_BASED_HIGH: -+ fixup_16 = (grub_uint16_t *)fixup; -+ *fixup_16 = (grub_uint16_t) (*fixup_16 + ((grub_uint16_t)((grub_uint32_t)adjust >> 16))); -+ if (fixup_data != NULL) -+ { -+ *(grub_uint16_t *) fixup_data = *fixup_16; -+ fixup_data = fixup_data + sizeof (grub_uint16_t); -+ } -+ break; -+ case GRUB_PE32_REL_BASED_LOW: -+ fixup_16 = (grub_uint16_t *)fixup; -+ *fixup_16 = (grub_uint16_t) (*fixup_16 + (grub_uint16_t)adjust ); -+ if (fixup_data != NULL) -+ { -+ *(grub_uint16_t *) fixup_data = *fixup_16; -+ fixup_data = fixup_data + sizeof (grub_uint16_t); -+ } -+ break; -+ case GRUB_PE32_REL_BASED_HIGHLOW: -+ fixup_32 = (grub_uint32_t *)fixup; -+ *fixup_32 = *fixup_32 + (grub_uint32_t)adjust; -+ if (fixup_data != NULL) -+ { -+ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint32_t)); -+ *(grub_uint32_t *) fixup_data = *fixup_32; -+ fixup_data += sizeof (grub_uint32_t); -+ } -+ break; -+ case GRUB_PE32_REL_BASED_DIR64: -+ fixup_64 = (grub_uint64_t *)fixup; -+ *fixup_64 = *fixup_64 + (grub_uint64_t)adjust; -+ if (fixup_data != NULL) -+ { -+ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint64_t)); -+ *(grub_uint64_t *) fixup_data = *fixup_64; -+ fixup_data += sizeof (grub_uint64_t); -+ } -+ break; -+ default: -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "unknown relocation"); -+ return GRUB_EFI_UNSUPPORTED; -+ } -+ reloc += 1; -+ } -+ reloc_base = (struct grub_pe32_data_directory *)reloc_end; -+ } -+ -+ return GRUB_EFI_SUCCESS; -+} -+ -+static grub_efi_device_path_t * -+grub_efi_get_media_file_path (grub_efi_device_path_t *dp) -+{ -+ while (1) -+ { -+ grub_efi_uint8_t type; -+ grub_efi_uint8_t subtype; -+ -+ if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp)) -+ break; -+ -+ type = GRUB_EFI_DEVICE_PATH_TYPE (dp); -+ subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); -+ -+ if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE) -+ return dp; -+ -+ dp = GRUB_EFI_NEXT_DEVICE_PATH (dp); -+ } -+ -+ return NULL; -+} -+ -+static grub_efi_boolean_t -+handle_image (struct grub_secureboot_chainloader_context *load_context) -+{ -+ grub_efi_boot_services_t *b; -+ grub_efi_loaded_image_t *li, li_bak; -+ grub_efi_status_t efi_status; -+ void *data = (void *)(unsigned long)load_context->address; -+ grub_efi_uint32_t datasize = load_context->fsize; -+ char *buffer = NULL; -+ char *buffer_aligned = NULL; -+ grub_efi_uint32_t i, size; -+ struct grub_pe32_section_table *section; -+ char *base, *end; -+ pe_coff_loader_image_context_t context; -+ grub_uint32_t section_alignment; -+ grub_uint32_t buffer_size; -+ -+ b = grub_efi_system_table->boot_services; -+ -+ if (read_header (data, datasize, &context)) -+ { -+ grub_dprintf ("chain", "Succeed to read header\n"); -+ } -+ else -+ { -+ grub_dprintf ("chain", "Failed to read header\n"); -+ goto error_exit; -+ } -+ -+ section_alignment = context.pe_hdr->optional_header.section_alignment; -+ buffer_size = context.image_size + section_alignment; -+ -+ efi_status = b->allocate_pool (GRUB_EFI_LOADER_DATA, -+ buffer_size, (void**)&buffer); -+ -+ if (efi_status != GRUB_EFI_SUCCESS) -+ { -+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); -+ goto error_exit; -+ } -+ -+ buffer_aligned = (char *)ALIGN_UP ((grub_addr_t)buffer, section_alignment); -+ -+ grub_memcpy (buffer_aligned, data, context.size_of_headers); -+ -+ section = context.first_section; -+ for (i = 0; i < context.number_of_sections; i++) -+ { -+ size = section->virtual_size; -+ if (size > section->raw_data_size) -+ size = section->raw_data_size; -+ -+ base = image_address (buffer_aligned, context.image_size, section->virtual_address); -+ end = image_address (buffer_aligned, context.image_size, section->virtual_address + size - 1); -+ -+ if (!base || !end) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid section size"); -+ goto error_exit; -+ } -+ -+ if (section->raw_data_size > 0) -+ grub_memcpy (base, (grub_efi_uint8_t*)data + section->raw_data_offset, size); -+ -+ if (size < section->virtual_size) -+ grub_memset (base + size, 0, section->virtual_size - size); -+ -+ grub_dprintf ("chain", "copied section %s\n", section->name); -+ section += 1; -+ } -+ -+ efi_status = relocate_coff (&context, buffer_aligned); -+ -+ if (efi_status != GRUB_EFI_SUCCESS) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "relocation failed"); -+ goto error_exit; -+ } -+ -+ entry_point = image_address (buffer_aligned, context.image_size, context.entry_point); -+ -+ if (!entry_point) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point"); -+ goto error_exit; -+ } -+ -+ li = grub_efi_get_loaded_image (grub_efi_image_handle); -+ if (!li) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "no loaded image available"); -+ goto error_exit; -+ } -+ -+ grub_memcpy (&li_bak, li, sizeof (grub_efi_loaded_image_t)); -+ li->image_base = buffer_aligned; -+ li->image_size = context.image_size; -+ li->load_options = load_context->cmdline; -+ li->load_options_size = load_context->cmdline_len; -+ li->file_path = grub_efi_get_media_file_path (load_context->file_path); -+ li->device_handle = load_context->dev_handle; -+ if (li->file_path) -+ { -+ grub_printf ("file path: "); -+ grub_efi_print_device_path (li->file_path); -+ } -+ else -+ { -+ grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found"); -+ goto error_exit; -+ } -+ -+ efi_status = entry_point (grub_efi_image_handle, grub_efi_system_table); -+ -+ grub_memcpy (li, &li_bak, sizeof (grub_efi_loaded_image_t)); -+ efi_status = b->free_pool (buffer); -+ -+ return 1; -+ -+error_exit: -+ if (buffer) -+ b->free_pool (buffer); -+ -+ return 0; -+ -+} -+ -+static grub_err_t -+grub_secureboot_chainloader_unload (void* context) -+{ -+ grub_efi_boot_services_t *b; -+ struct grub_secureboot_chainloader_context *sb_context = (struct grub_secureboot_chainloader_context *)context; -+ -+ b = grub_efi_system_table->boot_services; -+ b->free_pages (sb_context->address, sb_context->pages); -+ grub_free (sb_context->file_path); -+ grub_free (sb_context->cmdline); -+ grub_free (sb_context); -+ -+ grub_dl_unref (my_mod); -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_secureboot_chainloader_boot (void *context) -+{ -+ struct grub_secureboot_chainloader_context *sb_context = (struct grub_secureboot_chainloader_context *)context; -+ -+ handle_image (sb_context); -+ grub_loader_unset (); -+ return grub_errno; -+} -+#endif -+ - static grub_err_t - grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - int argc, char *argv[]) -@@ -222,11 +651,12 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - grub_efi_loaded_image_t *loaded_image; - char *filename; - void *boot_image = 0; -- grub_efi_handle_t dev_handle = 0; - grub_efi_physical_address_t address = 0; - grub_efi_uintn_t pages = 0; - grub_efi_char16_t *cmdline = NULL; - grub_efi_handle_t image_handle = NULL; -+ grub_ssize_t cmdline_len = 0; -+ grub_efi_handle_t dev_handle = 0; - - if (argc == 0) - return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); -@@ -236,12 +666,39 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - - b = grub_efi_system_table->boot_services; - -+ if (argc > 1) -+ { -+ int i; -+ grub_efi_char16_t *p16; -+ -+ for (i = 1, cmdline_len = 0; i < argc; i++) -+ cmdline_len += grub_strlen (argv[i]) + 1; -+ -+ cmdline_len *= sizeof (grub_efi_char16_t); -+ cmdline = p16 = grub_malloc (cmdline_len); -+ if (! cmdline) -+ goto fail; -+ -+ for (i = 1; i < argc; i++) -+ { -+ char *p8; -+ -+ p8 = argv[i]; -+ while (*p8) -+ *(p16++) = *(p8++); -+ -+ *(p16++) = ' '; -+ } -+ *(--p16) = 0; -+ } -+ - file = grub_file_open (filename, GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE); - if (! file) - goto fail; - -- /* Get the root device's device path. */ -- dev = grub_device_open (0); -+ /* Get the device path from filename. */ -+ char *devname = grub_file_get_device_name (filename); -+ dev = grub_device_open (devname); - if (dev == NULL) - ; - else if (dev->disk) -@@ -343,6 +800,28 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - } - #endif - -+#ifdef SUPPORT_SECURE_BOOT -+ /* FIXME is secure boot possible also with universal binaries? */ -+ if (debug_secureboot || (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED && grub_secure_validate ((void *)address, size))) -+ { -+ struct grub_secureboot_chainloader_context *sb_context; -+ -+ sb_context = grub_malloc (sizeof (*sb_context)); -+ if (!sb_context) -+ goto fail; -+ sb_context->cmdline = cmdline; -+ sb_context->cmdline_len = cmdline_len; -+ sb_context->fsize = size; -+ sb_context->dev_handle = dev_handle; -+ sb_context->address = address; -+ sb_context->pages = pages; -+ sb_context->file_path = file_path; -+ grub_file_close (file); -+ grub_loader_set_ex (grub_secureboot_chainloader_boot, grub_secureboot_chainloader_unload, sb_context, 0); -+ return 0; -+ } -+#endif -+ - status = b->load_image (0, grub_efi_image_handle, file_path, - boot_image, size, - &image_handle); -@@ -368,33 +847,10 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - loaded_image->device_handle = dev_handle; - - /* Build load options with arguments from chainloader command line. */ -- if (argc > 1) -+ if (cmdline) - { -- int i, len; -- grub_efi_char16_t *p16; -- -- for (i = 1, len = 0; i < argc; i++) -- len += grub_strlen (argv[i]) + 1; -- -- len *= sizeof (grub_efi_char16_t); -- cmdline = p16 = grub_malloc (len); -- if (! cmdline) -- goto fail; -- -- for (i = 1; i < argc; i++) -- { -- char *p8; -- -- p8 = argv[i]; -- while (*p8) -- *(p16++) = *(p8++); -- -- *(p16++) = ' '; -- } -- *(--p16) = 0; -- - loaded_image->load_options = cmdline; -- loaded_image->load_options_size = len; -+ loaded_image->load_options_size = cmdline_len; - } - - grub_file_close (file); --- -2.41.0 - diff --git a/0192-Allow-fallback-to-include-entries-by-title-not-just-.patch b/0011-Allow-fallback-to-include-entries-by-title-not-just-.patch similarity index 85% rename from 0192-Allow-fallback-to-include-entries-by-title-not-just-.patch rename to 0011-Allow-fallback-to-include-entries-by-title-not-just-.patch index 6f8ca15..b85e5e6 100644 --- a/0192-Allow-fallback-to-include-entries-by-title-not-just-.patch +++ b/0011-Allow-fallback-to-include-entries-by-title-not-just-.patch @@ -1,21 +1,21 @@ -From 5ba377f2a799c7b5ebb6f6b1167ff17808f27e4e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 5 Sep 2014 10:07:04 -0400 -Subject: [PATCH 192/272] Allow "fallback" to include entries by title, not - just number. +Subject: [PATCH] Allow "fallback" to include entries by title, not just + number. Resolves: rhbz#1026084 Signed-off-by: Peter Jones --- - grub-core/normal/menu.c | 85 ++++++++++++++++++++++++++++------------- + grub-core/normal/menu.c | 85 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 58 insertions(+), 27 deletions(-) diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 6cd4ec590..c007f2db6 100644 +index 6a90e091f22..6444ee6f969 100644 --- a/grub-core/normal/menu.c +++ b/grub-core/normal/menu.c -@@ -178,15 +178,40 @@ grub_menu_set_timeout (int timeout) +@@ -163,15 +163,40 @@ grub_menu_set_timeout (int timeout) } } @@ -57,7 +57,7 @@ index 6cd4ec590..c007f2db6 100644 val = grub_env_get (name); if (! val) -@@ -196,9 +221,39 @@ get_and_remove_first_entry_number (const char *name) +@@ -181,9 +206,39 @@ get_and_remove_first_entry_number (const char *name) entry = (int) grub_strtoul (val, &tail, 0); @@ -98,7 +98,7 @@ index 6cd4ec590..c007f2db6 100644 while (*tail && grub_isspace (*tail)) tail++; grub_env_set (name, tail); -@@ -361,7 +416,7 @@ grub_menu_execute_with_fallback (grub_menu_t menu, +@@ -346,7 +401,7 @@ grub_menu_execute_with_fallback (grub_menu_t menu, grub_menu_execute_entry (entry, 1); /* Deal with fallback entries. */ @@ -107,7 +107,7 @@ index 6cd4ec590..c007f2db6 100644 >= 0) { grub_print_error (); -@@ -488,30 +543,6 @@ grub_menu_register_viewer (struct grub_menu_viewer *viewer) +@@ -464,30 +519,6 @@ grub_menu_register_viewer (struct grub_menu_viewer *viewer) viewers = viewer; } @@ -138,6 +138,3 @@ index 6cd4ec590..c007f2db6 100644 /* Get the entry number from the variable NAME. */ static int get_entry_number (grub_menu_t menu, const char *name) --- -2.41.0 - diff --git a/0012-Make-exit-take-a-return-code.patch b/0012-Make-exit-take-a-return-code.patch new file mode 100644 index 0000000..87e03ad --- /dev/null +++ b/0012-Make-exit-take-a-return-code.patch @@ -0,0 +1,280 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 26 Feb 2014 21:49:12 -0500 +Subject: [PATCH] Make "exit" take a return code. + +This adds "exit" with a return code. With this patch, any "exit" +command /may/ include a return code, and on platforms that support +returning with an exit status, we will do so. By default we return the +same exit status we did before this patch. + +Signed-off-by: Peter Jones +--- + grub-core/commands/minicmd.c | 20 ++++++++++++++++---- + grub-core/kern/efi/efi.c | 9 +++++++-- + grub-core/kern/emu/main.c | 2 +- + grub-core/kern/emu/misc.c | 9 +++++---- + grub-core/kern/i386/coreboot/init.c | 2 +- + grub-core/kern/i386/qemu/init.c | 2 +- + grub-core/kern/ieee1275/init.c | 2 +- + grub-core/kern/mips/arc/init.c | 2 +- + grub-core/kern/mips/loongson/init.c | 2 +- + grub-core/kern/mips/qemu_mips/init.c | 2 +- + grub-core/kern/misc.c | 11 ++++++++++- + grub-core/kern/uboot/init.c | 6 +++--- + grub-core/kern/xen/init.c | 2 +- + include/grub/misc.h | 2 +- + 14 files changed, 50 insertions(+), 23 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index fa498931ed2..2bd3ac76f2d 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -182,12 +182,24 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), + } + + /* exit */ +-static grub_err_t __attribute__ ((noreturn)) ++static grub_err_t + grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)), +- int argc __attribute__ ((unused)), +- char *argv[] __attribute__ ((unused))) ++ int argc, char *argv[]) + { +- grub_exit (); ++ int retval = -1; ++ unsigned long n; ++ ++ if (argc < 0 || argc > 1) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected")); ++ ++ if (argc == 1) ++ { ++ n = grub_strtoul (argv[0], 0, 10); ++ if (n != ~0UL) ++ retval = n; ++ } ++ ++ grub_exit (retval); + /* Not reached. */ + } + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index b93ae3aba12..885d7c6420e 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -175,11 +175,16 @@ grub_reboot (void) + } + + void +-grub_exit (void) ++grub_exit (int retval) + { ++ int rc = GRUB_EFI_LOAD_ERROR; ++ ++ if (retval == 0) ++ rc = GRUB_EFI_SUCCESS; ++ + grub_machine_fini (GRUB_LOADER_FLAG_NORETURN); + grub_efi_system_table->boot_services->exit (grub_efi_image_handle, +- GRUB_EFI_SUCCESS, 0, 0); ++ rc, 0, 0); + for (;;) ; + } + +diff --git a/grub-core/kern/emu/main.c b/grub-core/kern/emu/main.c +index 855b11c3dec..38c1576a2ef 100644 +--- a/grub-core/kern/emu/main.c ++++ b/grub-core/kern/emu/main.c +@@ -67,7 +67,7 @@ grub_reboot (void) + } + + void +-grub_exit (void) ++grub_exit (int retval __attribute__((unused))) + { + grub_reboot (); + } +diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c +index 521220b49d2..16c79bc9488 100644 +--- a/grub-core/kern/emu/misc.c ++++ b/grub-core/kern/emu/misc.c +@@ -83,7 +83,7 @@ grub_util_error (const char *fmt, ...) + vfprintf (stderr, fmt, ap); + va_end (ap); + fprintf (stderr, ".\n"); +- grub_exit (); ++ grub_exit (1); + } + + void * +@@ -152,12 +152,13 @@ xasprintf (const char *fmt, ...) + + #if !defined (GRUB_MACHINE_EMU) || defined (GRUB_UTIL) + void +-grub_exit (void) ++__attribute__ ((noreturn)) ++grub_exit (int rc) + { +-#if defined (GRUB_KERNEL) ++#if defined (GRUB_KERNEL) && !defined (GRUB_MACHINE_EFI) + grub_reboot (); + #endif +- exit (1); ++ exit (rc < 0 ? 1 : rc); + } + #endif + +diff --git a/grub-core/kern/i386/coreboot/init.c b/grub-core/kern/i386/coreboot/init.c +index 4fae8b571f1..feaf9295e30 100644 +--- a/grub-core/kern/i386/coreboot/init.c ++++ b/grub-core/kern/i386/coreboot/init.c +@@ -41,7 +41,7 @@ extern grub_uint8_t _end[]; + extern grub_uint8_t _edata[]; + + void __attribute__ ((noreturn)) +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + /* We can't use grub_fatal() in this function. This would create an infinite + loop, since grub_fatal() calls grub_abort() which in turn calls grub_exit(). */ +diff --git a/grub-core/kern/i386/qemu/init.c b/grub-core/kern/i386/qemu/init.c +index 08f81d25e68..604fc94b5a0 100644 +--- a/grub-core/kern/i386/qemu/init.c ++++ b/grub-core/kern/i386/qemu/init.c +@@ -42,7 +42,7 @@ extern grub_uint8_t _end[]; + extern grub_uint8_t _edata[]; + + void __attribute__ ((noreturn)) +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + /* We can't use grub_fatal() in this function. This would create an infinite + loop, since grub_fatal() calls grub_abort() which in turn calls grub_exit(). */ +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index fb7d1a3bacf..50c65b2f6e5 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -114,7 +114,7 @@ grub_addr_t grub_ieee1275_original_stack; + #define BYTE22 (DY_MEM_V2 | DRC_INFO) + + void +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + grub_ieee1275_exit (); + } +diff --git a/grub-core/kern/mips/arc/init.c b/grub-core/kern/mips/arc/init.c +index 2ed3ff3191e..5c40c34078d 100644 +--- a/grub-core/kern/mips/arc/init.c ++++ b/grub-core/kern/mips/arc/init.c +@@ -276,7 +276,7 @@ grub_halt (void) + } + + void +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + GRUB_ARC_FIRMWARE_VECTOR->exit (); + +diff --git a/grub-core/kern/mips/loongson/init.c b/grub-core/kern/mips/loongson/init.c +index 5bd721260f6..97b09b0eeea 100644 +--- a/grub-core/kern/mips/loongson/init.c ++++ b/grub-core/kern/mips/loongson/init.c +@@ -304,7 +304,7 @@ grub_halt (void) + } + + void +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + grub_halt (); + } +diff --git a/grub-core/kern/mips/qemu_mips/init.c b/grub-core/kern/mips/qemu_mips/init.c +index b5477b87ffa..69488a34e7c 100644 +--- a/grub-core/kern/mips/qemu_mips/init.c ++++ b/grub-core/kern/mips/qemu_mips/init.c +@@ -75,7 +75,7 @@ grub_machine_fini (int flags __attribute__ ((unused))) + } + + void +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + grub_halt (); + } +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 7cee5d75c3c..11037dc0227 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -1311,9 +1311,18 @@ grub_abort (void) + grub_getkey (); + } + +- grub_exit (); ++ grub_exit (1); + } + ++#if defined (__clang__) && !defined (GRUB_UTIL) ++/* clang emits references to abort(). */ ++void __attribute__ ((noreturn)) ++abort (void) ++{ ++ grub_abort (); ++} ++#endif ++ + void + grub_fatal (const char *fmt, ...) + { +diff --git a/grub-core/kern/uboot/init.c b/grub-core/kern/uboot/init.c +index 3e338645c57..be2a5be1d07 100644 +--- a/grub-core/kern/uboot/init.c ++++ b/grub-core/kern/uboot/init.c +@@ -39,9 +39,9 @@ extern grub_size_t grub_total_module_size; + static unsigned long timer_start; + + void +-grub_exit (void) ++grub_exit (int rc) + { +- grub_uboot_return (0); ++ grub_uboot_return (rc < 0 ? 1 : rc); + } + + static grub_uint64_t +@@ -78,7 +78,7 @@ grub_machine_init (void) + if (!ver) + { + /* Don't even have a console to log errors to... */ +- grub_exit (); ++ grub_exit (-1); + } + else if (ver > API_SIG_VERSION) + { +diff --git a/grub-core/kern/xen/init.c b/grub-core/kern/xen/init.c +index 782ca72952a..708b060f324 100644 +--- a/grub-core/kern/xen/init.c ++++ b/grub-core/kern/xen/init.c +@@ -584,7 +584,7 @@ grub_machine_init (void) + } + + void +-grub_exit (void) ++grub_exit (int rc __attribute__((unused))) + { + struct sched_shutdown arg; + +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 1b35a167fde..72aff15750d 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -385,7 +385,7 @@ char *EXPORT_FUNC(grub_xasprintf) (const char *fmt, ...) + __attribute__ ((format (GNU_PRINTF, 1, 2))) WARN_UNUSED_RESULT; + char *EXPORT_FUNC(grub_xvasprintf) (const char *fmt, va_list args) WARN_UNUSED_RESULT; + +-void EXPORT_FUNC(grub_exit) (void) __attribute__ ((noreturn)); ++void EXPORT_FUNC(grub_exit) (int rc) __attribute__ ((noreturn)); + void EXPORT_FUNC(grub_abort) (void) __attribute__ ((noreturn)); + grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t d, diff --git a/0012-linuxefi-fix-boot-params.patch b/0012-linuxefi-fix-boot-params.patch deleted file mode 100644 index be85f2a..0000000 --- a/0012-linuxefi-fix-boot-params.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 5a224d1beaebc0329fcbdeac4abda978e4b5ae8f Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 16:57:10 +0800 -Subject: [PATCH 012/272] linuxefi fix boot params - -+ From https://www.kernel.org/doc/Documentation/x86/boot.txt: -+ The memory for struct boot_params could be allocated anywhere (even above 4G) -+ and initialized to all zero. -+ Then, the setup header at offset 0x01f1 of kernel image on should be -+ loaded into struct boot_params and examined - -Michael Chang ---- - grub-core/loader/i386/efi/linux.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 16f7554e2..6bb9c484f 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -298,7 +298,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - lh.code32_start = (grub_uint32_t)(grub_addr_t) kernel_mem; - } - -- grub_memcpy(params, &lh, 2 * 512); -+ /* Grub linuxefi erroneously initialize linux's boot_params with non-zero values. (bsc#1025563) -+ -+ From https://www.kernel.org/doc/Documentation/x86/boot.txt: -+ The memory for struct boot_params could be allocated anywhere (even above 4G) -+ and initialized to all zero. -+ Then, the setup header at offset 0x01f1 of kernel image on should be -+ loaded into struct boot_params and examined. */ -+ grub_memcpy (¶ms->setup_sects, &lh.setup_sects, sizeof (lh) - 0x01f1); - - params->type_of_loader = 0x21; - --- -2.41.0 - diff --git a/0232-Make-efi-machines-load-an-env-block-from-a-variable.patch b/0013-Make-efi-machines-load-an-env-block-from-a-variable.patch similarity index 79% rename from 0232-Make-efi-machines-load-an-env-block-from-a-variable.patch rename to 0013-Make-efi-machines-load-an-env-block-from-a-variable.patch index 3512f8c..9355298 100644 --- a/0232-Make-efi-machines-load-an-env-block-from-a-variable.patch +++ b/0013-Make-efi-machines-load-an-env-block-from-a-variable.patch @@ -1,16 +1,16 @@ -From 2a74327a05d2465bf5d4ea53dc3593c3191d113b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 7 Dec 2015 14:20:49 -0500 -Subject: [PATCH 232/272] Make efi machines load an env block from a variable +Subject: [PATCH] Make efi machines load an env block from a variable Signed-off-by: Peter Jones --- grub-core/Makefile.core.def | 1 + - grub-core/kern/efi/init.c | 33 +++++++++++++++++++++++++++++++++ - 2 files changed, 34 insertions(+) + grub-core/kern/efi/init.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 35 insertions(+) diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index e1ca1a6ee..cfb71cc4e 100644 +index 1571421d7e8..0bffbfea917 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def @@ -219,6 +219,7 @@ kernel = { @@ -22,11 +22,14 @@ index e1ca1a6ee..cfb71cc4e 100644 i386_multiboot = kern/i386/pc/acpi.c; i386_coreboot = kern/acpi.c; diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c -index 6ce623466..c77b54892 100644 +index 6c54af6e79e..b5201974a76 100644 --- a/grub-core/kern/efi/init.c +++ b/grub-core/kern/efi/init.c -@@ -31,6 +31,8 @@ - #include +@@ -28,8 +28,11 @@ + #include + #include + #include ++ #include +#include @@ -34,7 +37,7 @@ index 6ce623466..c77b54892 100644 #ifdef GRUB_STACK_PROTECTOR static grub_efi_char16_t stack_chk_fail_msg[] = -@@ -104,6 +106,36 @@ stack_protector_init (void) +@@ -103,6 +106,36 @@ stack_protector_init (void) grub_addr_t grub_modbase; @@ -71,7 +74,7 @@ index 6ce623466..c77b54892 100644 __attribute__ ((__optimize__ ("-fno-stack-protector"))) void grub_efi_init (void) { -@@ -129,6 +161,7 @@ grub_efi_init (void) +@@ -128,6 +161,7 @@ grub_efi_init (void) grub_efi_system_table->boot_services->set_watchdog_timer (0, 0, 0, NULL); @@ -79,6 +82,3 @@ index 6ce623466..c77b54892 100644 grub_efidisk_init (); grub_efi_register_debug_commands (); --- -2.41.0 - diff --git a/0013-disable-rsync-to-make-it-possible-to-use-in-RPM-buil.patch b/0013-disable-rsync-to-make-it-possible-to-use-in-RPM-buil.patch deleted file mode 100644 index a16dc75..0000000 --- a/0013-disable-rsync-to-make-it-possible-to-use-in-RPM-buil.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 3d70711be511e7adb9624d006838ee472cde9ff7 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 16:58:58 +0800 -Subject: [PATCH 013/272] disable rsync to make it possible to use in RPM - build - -We need to create po/LINGUAS to generate message catalogs. Use -linguas.sh to ensure we always use the same rules as upstream, but -disable rsync. - -Signed-off-by: Andrey Borzenkov ---- - linguas.sh | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/linguas.sh b/linguas.sh -index b95ad4f7d..6cad91165 100755 ---- a/linguas.sh -+++ b/linguas.sh -@@ -1,8 +1,8 @@ - #!/bin/sh - --rsync -Lrtvz translationproject.org::tp/latest/grub/ po -+#rsync -Lrtvz translationproject.org::tp/latest/grub/ po - --autogenerated="en@quot en@hebrew de@hebrew en@cyrillic en@greek en@arabic en@piglatin de_CH" -+autogenerated="en@quot" # en@hebrew de@hebrew en@cyrillic en@greek en@arabic en@piglatin de_CH" - - - for x in $autogenerated; do --- -2.41.0 - diff --git a/0003-Migrate-PPC-from-Yaboot-to-Grub2.patch b/0014-Migrate-PPC-from-Yaboot-to-Grub2.patch similarity index 86% rename from 0003-Migrate-PPC-from-Yaboot-to-Grub2.patch rename to 0014-Migrate-PPC-from-Yaboot-to-Grub2.patch index 1e1a405..1ff254c 100644 --- a/0003-Migrate-PPC-from-Yaboot-to-Grub2.patch +++ b/0014-Migrate-PPC-from-Yaboot-to-Grub2.patch @@ -1,22 +1,25 @@ -From e02cd78c31c496397b817661b12179239679df5c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Mark Hamzy Date: Wed, 28 Mar 2012 14:46:41 -0500 -Subject: [PATCH 003/272] Migrate PPC from Yaboot to Grub2 +Subject: [PATCH] Migrate PPC from Yaboot to Grub2 -Add configuration support for serial terminal consoles. This will set the -maximum screen size so that text is not overwritten. +Add configuration support for serial terminal consoles. This will set +the maximum screen size so that text is not overwritten. + +Signed-off-by: Mark Hamzy +Signed-off-by: Robbie Harwood --- - Makefile.util.def | 7 ++ - util/grub.d/20_ppc_terminfo.in | 114 +++++++++++++++++++++++++++++++++ + Makefile.util.def | 7 +++ + util/grub.d/20_ppc_terminfo.in | 114 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 121 insertions(+) create mode 100644 util/grub.d/20_ppc_terminfo.in diff --git a/Makefile.util.def b/Makefile.util.def -index 9432365a9..55a9e7ce7 100644 +index 9432365a9df..09bfcadd976 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -511,6 +511,13 @@ script = { - condition = COND_HOST_LINUX; +@@ -517,6 +517,13 @@ script = { + installdir = grubconf; }; +script = { @@ -27,11 +30,11 @@ index 9432365a9..55a9e7ce7 100644 +}; + script = { - name = '25_bli'; - common = util/grub.d/25_bli.in; + name = '30_os-prober'; + common = util/grub.d/30_os-prober.in; diff --git a/util/grub.d/20_ppc_terminfo.in b/util/grub.d/20_ppc_terminfo.in new file mode 100644 -index 000000000..10d665868 +index 00000000000..10d66586820 --- /dev/null +++ b/util/grub.d/20_ppc_terminfo.in @@ -0,0 +1,114 @@ @@ -149,6 +152,3 @@ index 000000000..10d665868 +cat << EOF + terminfo -g ${X}x${Y} ${TERMINAL} +EOF --- -2.41.0 - diff --git a/0014-Use-GNU-Unifont-instead-of-DejaVu-Sans-in-terminal.patch b/0014-Use-GNU-Unifont-instead-of-DejaVu-Sans-in-terminal.patch deleted file mode 100644 index b5e4c8a..0000000 --- a/0014-Use-GNU-Unifont-instead-of-DejaVu-Sans-in-terminal.patch +++ /dev/null @@ -1,29 +0,0 @@ -From e5d6965754a39479dd46f64e13ad889e17a51669 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Fri, 29 Mar 2024 17:00:35 +0800 -Subject: [PATCH 014/272] Use GNU Unifont instead of DejaVu Sans in terminal - -DejaVu Sans is proportional font and looks pretty bad in terminal -window. Use GNU Unifont instead. - -Signed-off-by: Michael Chang ---- - themes/starfield/theme.txt | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/themes/starfield/theme.txt b/themes/starfield/theme.txt -index 5ec871b5f..b3b8d8571 100644 ---- a/themes/starfield/theme.txt -+++ b/themes/starfield/theme.txt -@@ -25,7 +25,7 @@ message-font: "DejaVu Sans Regular 12" - message-color: "#000" - message-bg-color: "#fff" - terminal-box: "terminal_box_*.png" --terminal-font: "DejaVu Sans Regular 12" -+terminal-font: "Gnu Unifont Mono Regular 16" - desktop-image: "starfield.png" - - #help bar at the bottom --- -2.41.0 - diff --git a/0179-Add-fw_path-variable-revised.patch b/0015-Add-fw_path-variable-revised.patch similarity index 91% rename from 0179-Add-fw_path-variable-revised.patch rename to 0015-Add-fw_path-variable-revised.patch index 86cfbf9..4012f3f 100644 --- a/0179-Add-fw_path-variable-revised.patch +++ b/0015-Add-fw_path-variable-revised.patch @@ -1,7 +1,7 @@ -From b5a4bde386f743bcad086a1f0c3a5329d7ae4a1a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Paulo Flabiano Smorigo Date: Wed, 19 Sep 2012 21:22:55 -0300 -Subject: [PATCH 179/272] Add fw_path variable (revised) +Subject: [PATCH] Add fw_path variable (revised) This patch makes grub look for its config file on efi where the app was found. It was originally written by Matthew Garrett, and adapted to fix the @@ -17,7 +17,7 @@ Signed-off-by: Robbie Harwood 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 02df49206..37f936ceb 100644 +index 731c07c2901..463dafdba02 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c @@ -128,16 +128,15 @@ grub_set_prefix_and_root (void) @@ -44,7 +44,7 @@ index 02df49206..37f936ceb 100644 } diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 1b426af69..56f42e1e0 100644 +index d3f53d93d87..08f48c71df1 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -339,7 +339,30 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), @@ -79,6 +79,3 @@ index 1b426af69..56f42e1e0 100644 prefix = grub_env_get ("prefix"); if (prefix) --- -2.41.0 - diff --git a/0015-use-rpmsort-for-version-sorting.patch b/0015-use-rpmsort-for-version-sorting.patch deleted file mode 100644 index f7bb455..0000000 --- a/0015-use-rpmsort-for-version-sorting.patch +++ /dev/null @@ -1,163 +0,0 @@ -From 82bf27c2bfbd9d731c77618acf2c3c5b8eb0378c Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 14:52:13 +0800 -Subject: [PATCH 015/272] use rpmsort for version sorting - -use rpmsort provided by rpm - -Signed-off-by: Michael Chang ---- - util/grub-mkconfig_lib.in | 7 +++++- - util/grub.d/10_linux.in | 44 +++++++++++++++++++++++++++++++++++++ - util/grub.d/20_linux_xen.in | 44 +++++++++++++++++++++++++++++++++++++ - 3 files changed, 94 insertions(+), 1 deletion(-) - -diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in -index 33e1750ae..d8dc4af10 100644 ---- a/util/grub-mkconfig_lib.in -+++ b/util/grub-mkconfig_lib.in -@@ -203,12 +203,17 @@ grub_file_is_not_garbage () - version_sort () - { - case $version_sort_sort_has_v in -+ rpmsort) -+ LC_ALL=C /usr/bin/rpmsort "$@";; - yes) - LC_ALL=C sort -V "$@";; - no) - LC_ALL=C sort -n "$@";; - *) -- if sort -V /dev/null 2>&1; then -+ if test -x /usr/bin/rpmsort; then -+ version_sort_sort_has_v=rpmsort -+ LC_ALL=C /usr/bin/rpmsort "$@" -+ elif sort -V /dev/null 2>&1; then - version_sort_sort_has_v=yes - LC_ALL=C sort -V "$@" - else -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 523d13e81..f69f6753d 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -199,12 +199,56 @@ title_correction_code= - # yet, so it's empty. In a submenu it will be equal to '\t' (one tab). - submenu_indentation="" - -+listvrf="" -+pre_sort () { -+ local l="" -+ -+ for f in $list; do -+ vr="`echo $f | sed -e 's/[^-]*-//' -e 's/-\([^0-9]*\)$/\.\1/' -e 's/-/~/g' -e 's/~\([^~]*\)$/-\1/'`" -+ l="$l $vr" -+ listvrf="$listvrf $vr:$f" -+ done -+ -+ list=$l -+} -+ -+post_sort () { -+ local l="" -+ local vr="" -+ local f="" -+ local found="" -+ -+ for i in $reverse_sorted_list; do -+ found="" -+ for vrf in $listvrf; do -+ vr=${vrf%%:*} -+ f=${vrf#*:} -+ if test x"$vr" = x"$i"; then -+ l="$l $f" -+ found=$vrf -+ break -+ fi -+ done -+ if test -n "$found"; then -+ listvrf="`echo $listvrf | (sed -e 's!'$found'!!' 2>/dev/null || echo $listvrf)`" -+ fi -+ done -+ -+ for vrf in $listvrf; do -+ f=${vrf#*:} -+ l="$l $f" -+ done -+ -+ reverse_sorted_list=$l -+} -+pre_sort - # Perform a reverse version sort on the entire list. - # Temporarily replace the '.old' suffix by ' 1' and append ' 2' for all - # other files to order the '.old' files after their non-old counterpart - # in reverse-sorted order. - - reverse_sorted_list=$(echo $list | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//') -+post_sort - - if [ "x$GRUB_TOP_LEVEL" != x ]; then - reverse_sorted_list=$(grub_move_to_front "$GRUB_TOP_LEVEL" ${reverse_sorted_list}) -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index ee445068f..cf64700e9 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -255,13 +255,57 @@ esac - # yet, so it's empty. In a submenu it will be equal to '\t' (one tab). - submenu_indentation="" - -+listvrf="" -+pre_sort () { -+ local l="" -+ -+ for f in $linux_list; do -+ vr="`echo $f | sed -e 's/[^-]*-//' -e 's/-\([^0-9]*\)$/\.\1/' -e 's/-/~/g' -e 's/~\([^~]*\)$/-\1/'`" -+ l="$l $vr" -+ listvrf="$listvrf $vr:$f" -+ done -+ -+ linux_list=$l -+} -+ -+post_sort () { -+ local l="" -+ local vr="" -+ local f="" -+ local found="" -+ -+ for i in $reverse_sorted_linux_list; do -+ found="" -+ for vrf in $listvrf; do -+ vr=${vrf%%:*} -+ f=${vrf#*:} -+ if test x"$vr" = x"$i"; then -+ l="$l $f" -+ found=$vrf -+ break -+ fi -+ done -+ if test -n "$found"; then -+ listvrf="`echo $listvrf | (sed -e 's!'$found'!!' 2>/dev/null || echo $listvrf)`" -+ fi -+ done -+ -+ for vrf in $listvrf; do -+ f=${vrf#*:} -+ l="$l $f" -+ done -+ -+ reverse_sorted_linux_list=$l -+} - # Perform a reverse version sort on the entire xen_list and linux_list. - # Temporarily replace the '.old' suffix by ' 1' and append ' 2' for all - # other files to order the '.old' files after their non-old counterpart - # in reverse-sorted order. - - reverse_sorted_xen_list=$(echo ${xen_list} | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//') -+pre_sort - reverse_sorted_linux_list=$(echo ${linux_list} | tr ' ' '\n' | sed -e 's/\.old$/ 1/; / 1$/! s/$/ 2/' | version_sort -r | sed -e 's/ 1$/.old/; s/ 2$//') -+post_sort - - if [ "x$GRUB_TOP_LEVEL_XEN" != x ]; then - reverse_sorted_xen_list=$(grub_move_to_front "$GRUB_TOP_LEVEL_XEN" ${reverse_sorted_xen_list}) --- -2.41.0 - diff --git a/0193-Pass-x-hex-hex-straight-through-unmolested.patch b/0016-Pass-x-hex-hex-straight-through-unmolested.patch similarity index 71% rename from 0193-Pass-x-hex-hex-straight-through-unmolested.patch rename to 0016-Pass-x-hex-hex-straight-through-unmolested.patch index 085b33d..e1aa1af 100644 --- a/0193-Pass-x-hex-hex-straight-through-unmolested.patch +++ b/0016-Pass-x-hex-hex-straight-through-unmolested.patch @@ -1,20 +1,19 @@ -From 82b8147f6891d2d1eaac16ae4b955c26b56ca8d4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 1 Oct 2012 13:24:37 -0400 -Subject: [PATCH 193/272] Pass "\x[[:hex:]][[:hex:]]" straight through - unmolested. +Subject: [PATCH] Pass "\x[[:hex:]][[:hex:]]" straight through unmolested. Don't munge raw spaces when we're doing our cmdline escaping (#923374) Signed-off-by: Peter Jones --- - grub-core/commands/wildcard.c | 16 ++++++++++++- - grub-core/lib/cmdline.c | 6 +++++ - grub-core/script/execute.c | 43 ++++++++++++++++++++++++++++++----- - 3 files changed, 58 insertions(+), 7 deletions(-) + grub-core/commands/wildcard.c | 16 +++++++++++++++- + grub-core/lib/cmdline.c | 25 +++++++++++++++++++++++-- + grub-core/script/execute.c | 43 +++++++++++++++++++++++++++++++++++++------ + 3 files changed, 75 insertions(+), 9 deletions(-) diff --git a/grub-core/commands/wildcard.c b/grub-core/commands/wildcard.c -index ed6586505..5455242c3 100644 +index ed65865050a..5455242c352 100644 --- a/grub-core/commands/wildcard.c +++ b/grub-core/commands/wildcard.c @@ -488,6 +488,12 @@ check_file (const char *dir, const char *basename) @@ -48,12 +47,12 @@ index ed6586505..5455242c3 100644 *optr++ = iptr[1]; iptr += 2; diff --git a/grub-core/lib/cmdline.c b/grub-core/lib/cmdline.c -index bd392e30f..f1096d5df 100644 +index ed0b149dca5..8e2294d8ff6 100644 --- a/grub-core/lib/cmdline.c +++ b/grub-core/lib/cmdline.c -@@ -23,6 +23,12 @@ - - GRUB_MOD_LICENSE ("GPLv3+"); +@@ -20,6 +20,12 @@ + #include + #include +static int +is_hex(char c) @@ -64,8 +63,41 @@ index bd392e30f..f1096d5df 100644 static unsigned int check_arg (char *c, int *has_space) { int space = 0; +@@ -27,7 +33,13 @@ static unsigned int check_arg (char *c, int *has_space) + + while (*c) + { +- if (*c == '\\' || *c == '\'' || *c == '"') ++ if (*c == '\\' && *(c+1) == 'x' && is_hex(*(c+2)) && is_hex(*(c+3))) ++ { ++ size += 4; ++ c += 4; ++ continue; ++ } ++ else if (*c == '\\' || *c == '\'' || *c == '"') + size++; + else if (*c == ' ') + space = 1; +@@ -86,7 +98,16 @@ grub_create_loader_cmdline (int argc, char *argv[], char *buf, + + while (*c) + { +- if (*c == '\\' || *c == '\'' || *c == '"') ++ if (*c == '\\' && *(c+1) == 'x' && ++ is_hex(*(c+2)) && is_hex(*(c+3))) ++ { ++ *buf++ = *c++; ++ *buf++ = *c++; ++ *buf++ = *c++; ++ *buf++ = *c++; ++ continue; ++ } ++ else if (*c == '\\' || *c == '\'' || *c == '"') + *buf++ = '\\'; + + *buf++ = *c; diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c -index dab8fd2ae..c19b4bf70 100644 +index dab8fd2aeb0..c19b4bf700e 100644 --- a/grub-core/script/execute.c +++ b/grub-core/script/execute.c @@ -56,6 +56,12 @@ static struct grub_script_scope *scope = 0; @@ -139,6 +171,3 @@ index dab8fd2ae..c19b4bf70 100644 break; case '$': if (escaped) --- -2.41.0 - diff --git a/0016-treat-mdadm-ddf-fakeraid-as-simple-device.patch b/0016-treat-mdadm-ddf-fakeraid-as-simple-device.patch deleted file mode 100644 index ccb2ed8..0000000 --- a/0016-treat-mdadm-ddf-fakeraid-as-simple-device.patch +++ /dev/null @@ -1,75 +0,0 @@ -From c2cb58107e2bd45461591091fc84a3f14d4ce994 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 1 Apr 2024 14:54:38 +0800 -Subject: [PATCH 016/272] treat mdadm ddf fakeraid as simple device - ---- - grub-core/osdep/linux/getroot.c | 19 +++++++++++++------ - 1 file changed, 13 insertions(+), 6 deletions(-) - -diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index 7dd775d2a..0c6c12945 100644 ---- a/grub-core/osdep/linux/getroot.c -+++ b/grub-core/osdep/linux/getroot.c -@@ -119,7 +119,7 @@ struct btrfs_ioctl_search_args { - struct btrfs_ioctl_fs_info_args) - - static int --grub_util_is_imsm (const char *os_dev); -+grub_util_is_imsm_or_ddf (const char *os_dev); - - - #define ESCAPED_PATH_MAX (4 * PATH_MAX) -@@ -635,10 +635,10 @@ out: - } - - static int --grub_util_is_imsm (const char *os_dev) -+grub_util_is_imsm_or_ddf (const char *os_dev) - { - int retry; -- int is_imsm = 0; -+ int is_imsm_or_ddf = 0; - int container_seen = 0; - const char *dev = os_dev; - -@@ -699,10 +699,17 @@ grub_util_is_imsm (const char *os_dev) - if (strncmp (buf, "MD_METADATA=imsm", - sizeof ("MD_METADATA=imsm") - 1) == 0) - { -- is_imsm = 1; -+ is_imsm_or_ddf = 1; - grub_util_info ("%s is imsm", dev); - break; - } -+ if (strncmp (buf, "MD_METADATA=ddf", -+ sizeof ("MD_METADATA=ddf") - 1) == 0) -+ { -+ is_imsm_or_ddf = 1; -+ grub_util_info ("%s is ddf", dev); -+ break; -+ } - } - - free (buf); -@@ -713,7 +720,7 @@ grub_util_is_imsm (const char *os_dev) - - if (dev != os_dev) - free ((void *) dev); -- return is_imsm; -+ return is_imsm_or_ddf; - } - - char * -@@ -1078,7 +1085,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) - - /* Check for RAID. */ - if (!strncmp (os_dev, "/dev/md", 7) && ! grub_util_device_is_mapped (os_dev) -- && !grub_util_is_imsm (os_dev)) -+ && !grub_util_is_imsm_or_ddf (os_dev)) - return GRUB_DEV_ABSTRACTION_RAID; - return GRUB_DEV_ABSTRACTION_NONE; - } --- -2.41.0 - diff --git a/0194-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch b/0017-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch similarity index 94% rename from 0194-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch rename to 0017-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch index 450133b..56582e5 100644 --- a/0194-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch +++ b/0017-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch @@ -1,8 +1,8 @@ -From 324378ada58dc9b29a11075c505ec8c135eea1e0 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 22 Jan 2013 06:31:38 +0100 -Subject: [PATCH 194/272] blscfg: add blscfg module to parse Boot Loader - Specification snippets +Subject: [PATCH] blscfg: add blscfg module to parse Boot Loader Specification + snippets The BootLoaderSpec (BLS) defines a scheme where different bootloaders can share a format for boot items and a configuration directory that accepts @@ -14,24 +14,24 @@ Signed-off-by: Javier Martinez Canillas Signed-off-by: Will Thompson --- grub-core/Makefile.core.def | 11 + - grub-core/commands/blscfg.c | 1177 ++++++++++++++++++++++++++++++++ - grub-core/commands/legacycfg.c | 4 +- + grub-core/commands/blscfg.c | 1177 ++++++++++++++++++++++++++++++++++++++++ + grub-core/commands/legacycfg.c | 5 +- grub-core/commands/loadenv.c | 77 +-- - grub-core/commands/loadenv.h | 93 +++ - grub-core/commands/menuentry.c | 22 +- + grub-core/commands/menuentry.c | 20 +- grub-core/normal/main.c | 6 + + grub-core/commands/loadenv.h | 93 ++++ include/grub/compiler.h | 2 + include/grub/menu.h | 13 + include/grub/normal.h | 2 +- - 10 files changed, 1325 insertions(+), 82 deletions(-) + 10 files changed, 1324 insertions(+), 82 deletions(-) create mode 100644 grub-core/commands/blscfg.c create mode 100644 grub-core/commands/loadenv.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 75fbe7109..57dbf2386 100644 +index 0bffbfea917..47c0fc755a2 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -843,6 +843,16 @@ module = { +@@ -842,6 +842,16 @@ module = { common = commands/blocklist.c; }; @@ -48,7 +48,7 @@ index 75fbe7109..57dbf2386 100644 module = { name = boot; common = commands/boot.c; -@@ -1025,6 +1035,7 @@ module = { +@@ -1009,6 +1019,7 @@ module = { module = { name = loadenv; common = commands/loadenv.c; @@ -58,7 +58,7 @@ index 75fbe7109..57dbf2386 100644 diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c new file mode 100644 -index 000000000..7132555df +index 00000000000..e907a6a5d28 --- /dev/null +++ b/grub-core/commands/blscfg.c @@ -0,0 +1,1177 @@ @@ -974,7 +974,7 @@ index 000000000..7132555df + GRUB_BOOT_DEVICE, clinux, options ? " " : "", options ? options : "", + initrd ? initrd : "", dt ? dt : ""); + -+ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, 0, &index, entry); ++ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry); + grub_dprintf ("blscfg", "Added entry %d id:\"%s\"\n", index, id); + +finish: @@ -1240,29 +1240,30 @@ index 000000000..7132555df + grub_unregister_extcmd (oldcmd); +} diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c -index 54e08a1b4..c22b74ab5 100644 +index e9e9d94eff5..2c5d1a0ef9a 100644 --- a/grub-core/commands/legacycfg.c +++ b/grub-core/commands/legacycfg.c @@ -143,7 +143,7 @@ legacy_file (const char *filename) args[0] = oldname; grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy", NULL, NULL, -- entrysrc, 0, 0); -+ entrysrc, 0, 0, NULL, NULL); +- entrysrc, 0); ++ entrysrc, 0, NULL, NULL); grub_free (args); entrysrc[0] = 0; grub_free (oldname); -@@ -205,7 +205,7 @@ legacy_file (const char *filename) +@@ -205,7 +205,8 @@ legacy_file (const char *filename) } args[0] = entryname; grub_normal_add_menu_entry (1, args, NULL, NULL, NULL, -- NULL, NULL, entrysrc, 0, 0); -+ NULL, NULL, entrysrc, 0, 0, NULL, NULL); +- NULL, NULL, entrysrc, 0); ++ NULL, NULL, entrysrc, 0, NULL, ++ NULL); grub_free (args); } diff --git a/grub-core/commands/loadenv.c b/grub-core/commands/loadenv.c -index 166445849..dfcb19e0f 100644 +index 16644584978..dfcb19e0ff8 100644 --- a/grub-core/commands/loadenv.c +++ b/grub-core/commands/loadenv.c @@ -28,6 +28,8 @@ @@ -1356,9 +1357,105 @@ index 166445849..dfcb19e0f 100644 static grub_err_t grub_cmd_load_env (grub_extcmd_context_t ctxt, int argc, char **args) { +diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c +index 720e6d8ea3b..b194123eb67 100644 +--- a/grub-core/commands/menuentry.c ++++ b/grub-core/commands/menuentry.c +@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args, + char **classes, const char *id, + const char *users, const char *hotkey, + const char *prefix, const char *sourcecode, +- int submenu) ++ int submenu, int *index, struct bls_entry *bls) + { + int menu_hotkey = 0; + char **menu_args = NULL; +@@ -149,9 +149,12 @@ grub_normal_add_menu_entry (int argc, const char **args, + if (! menu_title) + goto fail; + ++ grub_dprintf ("menu", "id:\"%s\"\n", id); ++ grub_dprintf ("menu", "title:\"%s\"\n", menu_title); + menu_id = grub_strdup (id ? : menu_title); + if (! menu_id) + goto fail; ++ grub_dprintf ("menu", "menu_id:\"%s\"\n", menu_id); + + /* Save argc, args to pass as parameters to block arg later. */ + menu_args = grub_calloc (argc + 1, sizeof (char *)); +@@ -170,8 +173,12 @@ grub_normal_add_menu_entry (int argc, const char **args, + } + + /* Add the menu entry at the end of the list. */ ++ int ind=0; + while (*last) +- last = &(*last)->next; ++ { ++ ind++; ++ last = &(*last)->next; ++ } + + *last = grub_zalloc (sizeof (**last)); + if (! *last) +@@ -188,8 +195,11 @@ grub_normal_add_menu_entry (int argc, const char **args, + (*last)->args = menu_args; + (*last)->sourcecode = menu_sourcecode; + (*last)->submenu = submenu; ++ (*last)->bls = bls; + + menu->size++; ++ if (index) ++ *index = ind; + return GRUB_ERR_NONE; + + fail: +@@ -286,7 +296,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) + users, + ctxt->state[2].arg, 0, + ctxt->state[3].arg, +- ctxt->extcmd->cmd->name[0] == 's'); ++ ctxt->extcmd->cmd->name[0] == 's', ++ NULL, NULL); + + src = args[argc - 1]; + args[argc - 1] = NULL; +@@ -303,7 +314,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) + ctxt->state[0].args, ctxt->state[4].arg, + users, + ctxt->state[2].arg, prefix, src + 1, +- ctxt->extcmd->cmd->name[0] == 's'); ++ ctxt->extcmd->cmd->name[0] == 's', NULL, ++ NULL); + + src[len - 1] = ch; + args[argc - 1] = src; +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 08f48c71df1..1317279c081 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -70,6 +71,11 @@ grub_normal_free_menu (grub_menu_t menu) + grub_free (entry->args); + } + ++ if (entry->bls) ++ { ++ entry->bls->visible = 0; ++ } ++ + grub_free ((void *) entry->id); + grub_free ((void *) entry->users); + grub_free ((void *) entry->title); diff --git a/grub-core/commands/loadenv.h b/grub-core/commands/loadenv.h new file mode 100644 -index 000000000..952f46121 +index 00000000000..952f46121bd --- /dev/null +++ b/grub-core/commands/loadenv.h @@ -0,0 +1,93 @@ @@ -1455,107 +1552,8 @@ index 000000000..952f46121 + + return 0; +} -diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c -index c36913752..ccee44ecf 100644 ---- a/grub-core/commands/menuentry.c -+++ b/grub-core/commands/menuentry.c -@@ -78,7 +78,8 @@ grub_normal_add_menu_entry (int argc, const char **args, - char **classes, const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu, int hidden) -+ int submenu, int hidden, -+ int *index, struct bls_entry *bls) - { - int menu_hotkey = 0; - char **menu_args = NULL; -@@ -149,9 +150,12 @@ grub_normal_add_menu_entry (int argc, const char **args, - if (! menu_title) - goto fail; - -+ grub_dprintf ("menu", "id:\"%s\"\n", id); -+ grub_dprintf ("menu", "title:\"%s\"\n", menu_title); - menu_id = grub_strdup (id ? : menu_title); - if (! menu_id) - goto fail; -+ grub_dprintf ("menu", "menu_id:\"%s\"\n", menu_id); - - /* Save argc, args to pass as parameters to block arg later. */ - menu_args = grub_calloc (argc + 1, sizeof (char *)); -@@ -170,8 +174,12 @@ grub_normal_add_menu_entry (int argc, const char **args, - } - - /* Add the menu entry at the end of the list. */ -+ int ind=0; - while (*last) -- last = &(*last)->next; -+ { -+ ind++; -+ last = &(*last)->next; -+ } - - *last = grub_zalloc (sizeof (**last)); - if (! *last) -@@ -189,9 +197,13 @@ grub_normal_add_menu_entry (int argc, const char **args, - (*last)->sourcecode = menu_sourcecode; - (*last)->submenu = submenu; - (*last)->hidden = hidden; -+ (*last)->bls = bls; - - if (!hidden) - menu->size++; -+ -+ if (index) -+ *index = ind; - - return GRUB_ERR_NONE; - -@@ -290,7 +302,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - ctxt->state[2].arg, 0, - ctxt->state[3].arg, - ctxt->extcmd->cmd->name[0] == 's', -- ctxt->extcmd->cmd->name[0] == 'h'); -+ ctxt->extcmd->cmd->name[0] == 'h', -+ NULL, NULL); - - src = args[argc - 1]; - args[argc - 1] = NULL; -@@ -308,7 +321,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - users, - ctxt->state[2].arg, prefix, src + 1, - ctxt->extcmd->cmd->name[0] == 's', -- ctxt->extcmd->cmd->name[0] == 'h'); -+ ctxt->extcmd->cmd->name[0] == 'h', -+ NULL, NULL); - - src[len - 1] = ch; - args[argc - 1] = src; -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index c351c3409..5b70a9861 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -71,6 +72,11 @@ grub_normal_free_menu (grub_menu_t menu) - grub_free (entry->args); - } - -+ if (entry->bls) -+ { -+ entry->bls->visible = 0; -+ } -+ - grub_free ((void *) entry->id); - grub_free ((void *) entry->users); - grub_free ((void *) entry->title); diff --git a/include/grub/compiler.h b/include/grub/compiler.h -index 0c5519387..441a9eca0 100644 +index 0c5519387b2..441a9eca07c 100644 --- a/include/grub/compiler.h +++ b/include/grub/compiler.h @@ -56,4 +56,6 @@ @@ -1566,7 +1564,7 @@ index 0c5519387..441a9eca0 100644 + #endif /* ! GRUB_COMPILER_HEADER */ diff --git a/include/grub/menu.h b/include/grub/menu.h -index eb8a86ba9..43080828c 100644 +index ee2b5e91045..0acdc2aa6bf 100644 --- a/include/grub/menu.h +++ b/include/grub/menu.h @@ -20,6 +20,16 @@ @@ -1586,7 +1584,7 @@ index eb8a86ba9..43080828c 100644 struct grub_menu_entry_class { char *name; -@@ -62,6 +72,9 @@ struct grub_menu_entry +@@ -60,6 +70,9 @@ struct grub_menu_entry /* The next element. */ struct grub_menu_entry *next; @@ -1597,18 +1595,15 @@ index eb8a86ba9..43080828c 100644 typedef struct grub_menu_entry *grub_menu_entry_t; diff --git a/include/grub/normal.h b/include/grub/normal.h -index bcb412466..8c712a9e5 100644 +index 218cbabccaf..8839ad85a19 100644 --- a/include/grub/normal.h +++ b/include/grub/normal.h @@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes, const char *id, const char *users, const char *hotkey, const char *prefix, const char *sourcecode, -- int submenu, int hidden); -+ int submenu, int hidden, int *index, struct bls_entry *bls); +- int submenu); ++ int submenu, int *index, struct bls_entry *bls); grub_err_t grub_normal_set_password (const char *user, const char *password); --- -2.41.0 - diff --git a/0017-setup-try-fs-embed-if-mbr-gap-too-small.patch b/0017-setup-try-fs-embed-if-mbr-gap-too-small.patch deleted file mode 100644 index 5bd76c5..0000000 --- a/0017-setup-try-fs-embed-if-mbr-gap-too-small.patch +++ /dev/null @@ -1,71 +0,0 @@ -From d42abe313128095716c08b0e23912ff317198642 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:02:28 +0800 -Subject: [PATCH 017/272] setup try fs embed if mbr gap too small - -Signed-off-by: Michael Chang ---- - util/setup.c | 40 +++++++++++++++++++++++++++++++++++++--- - 1 file changed, 37 insertions(+), 3 deletions(-) - -diff --git a/util/setup.c b/util/setup.c -index 87a889ff7..8b2780b4a 100644 ---- a/util/setup.c -+++ b/util/setup.c -@@ -530,8 +530,42 @@ SETUP (const char *dir, - err = grub_util_ldm_embed (dest_dev->disk, &nsec, maxsec, - GRUB_EMBED_PCBIOS, §ors); - else if (ctx.dest_partmap) -- err = ctx.dest_partmap->embed (dest_dev->disk, &nsec, maxsec, -- GRUB_EMBED_PCBIOS, §ors, warn_small); -+ { -+ err = ctx.dest_partmap->embed (dest_dev->disk, &nsec, maxsec, -+ GRUB_EMBED_PCBIOS, §ors, warn_small); -+#ifdef GRUB_SETUP_BIOS -+ if ((err == GRUB_ERR_OUT_OF_RANGE || err == GRUB_ERR_FILE_NOT_FOUND) -+ && dest_dev->disk->id == root_dev->disk->id -+ && dest_dev->disk->dev->id == root_dev->disk->dev->id) -+ { -+ grub_fs_t root_fs; -+ -+ root_fs = grub_fs_probe (root_dev); -+ if (root_fs && root_fs->fs_embed) -+ { -+ grub_disk_addr_t *fs_sectors; -+ unsigned int fs_nsec; -+ -+ fs_sectors = NULL; -+ fs_nsec = core_sectors; -+ err = root_fs->fs_embed (root_dev, &fs_nsec, maxsec, -+ GRUB_EMBED_PCBIOS, &fs_sectors); -+ if (!err && fs_nsec >= core_sectors) -+ { -+ sectors = fs_sectors; -+ nsec = fs_nsec; -+ ctx.container = root_dev->disk->partition; -+ core_dev = root_dev; -+ } -+ else -+ { -+ if (fs_sectors) -+ grub_free (fs_sectors); -+ } -+ } -+ } -+#endif -+ } - else - err = fs->fs_embed (dest_dev, &nsec, maxsec, - GRUB_EMBED_PCBIOS, §ors); -@@ -643,7 +677,7 @@ SETUP (const char *dir, - - /* Write the core image onto the disk. */ - for (i = 0; i < nsec; i++) -- grub_disk_write (dest_dev->disk, sectors[i], 0, -+ grub_disk_write (core_dev->disk, sectors[i], 0, - GRUB_DISK_SECTOR_SIZE, - core_img + i * GRUB_DISK_SECTOR_SIZE); - #endif --- -2.41.0 - diff --git a/0201-Add-devicetree-loading.patch b/0018-Add-devicetree-loading.patch similarity index 72% rename from 0201-Add-devicetree-loading.patch rename to 0018-Add-devicetree-loading.patch index f9a0a1e..3897a2a 100644 --- a/0201-Add-devicetree-loading.patch +++ b/0018-Add-devicetree-loading.patch @@ -1,7 +1,7 @@ -From 49b6ddae5b3192ef64b973c2fa83a879f68702e2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 14 Jan 2014 13:12:23 -0500 -Subject: [PATCH 201/272] Add devicetree loading +Subject: [PATCH] Add devicetree loading Signed-off-by: Peter Jones @@ -20,24 +20,24 @@ Signed-off-by: David A. Marlin 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index a4a3da060..209aa1827 100644 +index 7516a015be0..7b355115dd4 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -306,7 +306,8 @@ export GRUB_DEFAULT \ - GRUB_DISABLE_SUBMENU \ - SUSE_BTRFS_SNAPSHOT_BOOTING \ - SUSE_CMDLINE_XENEFI \ -- GRUB_ENABLE_BLSCFG -+ GRUB_ENABLE_BLSCFG \ +@@ -252,7 +252,8 @@ export GRUB_DEFAULT \ + GRUB_ENABLE_CRYPTODISK \ + GRUB_BADRAM \ + GRUB_OS_PROBER_SKIP_LIST \ +- GRUB_DISABLE_SUBMENU ++ GRUB_DISABLE_SUBMENU \ + GRUB_DEFAULT_DTB if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 7d843db85..055389adf 100644 +index cc393be7eda..00d4b220ccb 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -409,6 +409,13 @@ EOF +@@ -155,6 +155,13 @@ EOF sed "s/^/$submenu_indentation/" << EOF echo '$(echo "$message" | grub_quote)' initrd $(echo $initrd_path) @@ -51,8 +51,8 @@ index 7d843db85..055389adf 100644 EOF fi sed "s/^/$submenu_indentation/" << EOF -@@ -550,6 +557,14 @@ for linux in ${reverse_sorted_list}; do - fi +@@ -250,6 +257,14 @@ for linux in ${reverse_sorted_list}; do + gettext_printf "Found initrd image: %s\n" "$(echo $initrd_display)" >&2 fi + fdt= @@ -64,8 +64,5 @@ index 7d843db85..055389adf 100644 + done + config= - for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" "/usr/lib/modules/${version}/config" ; do + for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do if test -e "${i}" ; then --- -2.41.0 - diff --git a/0018-add-xen-linux16-command.patch b/0018-add-xen-linux16-command.patch deleted file mode 100644 index 5a48f0a..0000000 --- a/0018-add-xen-linux16-command.patch +++ /dev/null @@ -1,44 +0,0 @@ -From add6639bdeb38fefdab3d6689c836462f9930d49 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:03:34 +0800 -Subject: [PATCH 018/272] add xen linux16 command - -Signed-off-by: Michael Chang ---- - grub-core/loader/i386/xen.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/grub-core/loader/i386/xen.c b/grub-core/loader/i386/xen.c -index 3b856e842..f3019f97c 100644 ---- a/grub-core/loader/i386/xen.c -+++ b/grub-core/loader/i386/xen.c -@@ -961,7 +961,7 @@ fail: - return grub_errno; - } - --static grub_command_t cmd_xen, cmd_initrd, cmd_module, cmd_multiboot; -+static grub_command_t cmd_xen, cmd_initrd, cmd_module, cmd_multiboot, cmd_xen16, cmd_initrd16; - - GRUB_MOD_INIT (xen) - { -@@ -973,6 +973,10 @@ GRUB_MOD_INIT (xen) - 0, N_("Load initrd.")); - cmd_module = grub_register_command ("module", grub_cmd_module, - 0, N_("Load module.")); -+ cmd_xen16 = grub_register_command ("linux16", grub_cmd_xen, -+ 0, N_("Load Linux.")); -+ cmd_initrd16 = grub_register_command ("initrd16", grub_cmd_initrd, -+ 0, N_("Load initrd.")); - my_mod = mod; - } - -@@ -982,4 +986,6 @@ GRUB_MOD_FINI (xen) - grub_unregister_command (cmd_initrd); - grub_unregister_command (cmd_multiboot); - grub_unregister_command (cmd_module); -+ grub_unregister_command (cmd_xen16); -+ grub_unregister_command (cmd_initrd16); - } --- -2.41.0 - diff --git a/0202-Enable-pager-by-default.-985860.patch b/0019-Enable-pager-by-default.-985860.patch similarity index 57% rename from 0202-Enable-pager-by-default.-985860.patch rename to 0019-Enable-pager-by-default.-985860.patch index bbb71ca..8f38cc2 100644 --- a/0202-Enable-pager-by-default.-985860.patch +++ b/0019-Enable-pager-by-default.-985860.patch @@ -1,7 +1,7 @@ -From f153a1bdc4f3ae9af78bee498b5f4a063cc828f4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 28 Oct 2013 10:09:27 -0400 -Subject: [PATCH 202/272] Enable pager by default. (#985860) +Subject: [PATCH] Enable pager by default. (#985860) Signed-off-by: Peter Jones --- @@ -9,18 +9,15 @@ Signed-off-by: Peter Jones 1 file changed, 2 insertions(+) diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 9320c1f70..1eec16dad 100644 +index 6a316a5ba77..c2d8b093762 100644 --- a/util/grub.d/00_header.in +++ b/util/grub.d/00_header.in -@@ -58,6 +58,8 @@ if [ "x${GRUB_DEFAULT_BUTTON}" = "xsaved" ] ; then GRUB_DEFAULT_BUTTON='${saved_ +@@ -43,6 +43,8 @@ if [ "x${GRUB_DEFAULT_BUTTON}" = "xsaved" ] ; then GRUB_DEFAULT_BUTTON='${saved_ if [ "x${GRUB_TIMEOUT_BUTTON}" = "x" ] ; then GRUB_TIMEOUT_BUTTON="$GRUB_TIMEOUT" ; fi cat << EOF +set pager=1 + - if [ -f \${config_directory}/grubenv ]; then - load_env -f \${config_directory}/grubenv - elif [ -s \$prefix/grubenv ]; then --- -2.41.0 - + if [ -s \$prefix/grubenv ]; then + load_env + fi diff --git a/0203-Don-t-say-GNU-Linux-in-generated-menus.patch b/0020-Don-t-say-GNU-Linux-in-generated-menus.patch similarity index 37% rename from 0203-Don-t-say-GNU-Linux-in-generated-menus.patch rename to 0020-Don-t-say-GNU-Linux-in-generated-menus.patch index dbb6f61..a299f05 100644 --- a/0203-Don-t-say-GNU-Linux-in-generated-menus.patch +++ b/0020-Don-t-say-GNU-Linux-in-generated-menus.patch @@ -1,30 +1,32 @@ -From fb08d5d6d2b0d056ce7631c1e259827cfb663972 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 14 Mar 2011 14:27:42 -0400 -Subject: [PATCH 203/272] Don't say "GNU/Linux" in generated menus. +Subject: [PATCH] Don't say "GNU/Linux" in generated menus. [rharwood: say it even less] --- grub-core/normal/main.c | 2 +- tests/util/grub-shell-tester.in | 2 +- - util/grub.d/10_linux.in | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) + tests/util/grub-shell.in | 2 +- + util/grub.d/10_linux.in | 4 ++-- + util/grub.d/20_linux_xen.in | 4 ++-- + 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 5b70a9861..1f55b286d 100644 +index 1317279c081..568c2adfa16 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -219,7 +219,7 @@ grub_normal_init_page (struct grub_term_output *term, +@@ -218,7 +218,7 @@ grub_normal_init_page (struct grub_term_output *term, grub_term_cls (term); - msg_formatted = grub_xasprintf (_("GNU GRUB version %s"), PACKAGE_VERSION); -+ msg_formatted = grub_xasprintf (_("GRUB version %s"), PACKAGE_VERSION); ++ msg_formatted = grub_xasprintf (_("GRUB version %s"), PACKAGE_VERSION); if (!msg_formatted) return; diff --git a/tests/util/grub-shell-tester.in b/tests/util/grub-shell-tester.in -index 8a87109b1..9a4319d4f 100644 +index 8a87109b152..9a4319d4f4f 100644 --- a/tests/util/grub-shell-tester.in +++ b/tests/util/grub-shell-tester.in @@ -56,7 +56,7 @@ for option in "$@"; do @@ -36,19 +38,48 @@ index 8a87109b1..9a4319d4f 100644 exit 0 ;; --modules=*) ms=`echo "$option" | sed -e 's/--modules=//'` +diff --git a/tests/util/grub-shell.in b/tests/util/grub-shell.in +index 496e1bab33c..e0570c88e15 100644 +--- a/tests/util/grub-shell.in ++++ b/tests/util/grub-shell.in +@@ -243,7 +243,7 @@ for option in "$@"; do + usage + exit 0 ;; + -v | --version) +- echo "$0 (GNU GRUB ${PACKAGE_VERSION})" ++ echo "$0 (GRUB ${PACKAGE_VERSION})" + exit 0 ;; + --trim) + trim=1 ;; diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 055389adf..150795116 100644 +index 00d4b220ccb..901745707f1 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -29,7 +29,7 @@ export TEXTDOMAINDIR="@localedir@" - CLASS="--class gnu-linux --class gnu --class os --unrestricted" +@@ -29,9 +29,9 @@ export TEXTDOMAINDIR="@localedir@" + CLASS="--class gnu-linux --class gnu --class os" if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then -- OS="$(eval $(grep PRETTY_NAME /etc/os-release) ; echo ${PRETTY_NAME})" +- OS=GNU/Linux + OS="$(sed 's, release .*$,,g' /etc/system-release)" - CLASS="--class $(eval $(grep '^ID_LIKE=\|^ID=' /etc/os-release) ; [ -n "${ID_LIKE}" ] && echo ${ID_LIKE} || echo ${ID}) ${CLASS}" else - OS="${GRUB_DISTRIBUTOR}" --- -2.41.0 - +- OS="${GRUB_DISTRIBUTOR} GNU/Linux" ++ OS="${GRUB_DISTRIBUTOR}" + CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" + fi + +diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in +index 94dd8be1342..98ee5bc58dc 100644 +--- a/util/grub.d/20_linux_xen.in ++++ b/util/grub.d/20_linux_xen.in +@@ -29,9 +29,9 @@ export TEXTDOMAINDIR="@localedir@" + CLASS="--class gnu-linux --class gnu --class os --class xen" + + if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then +- OS=GNU/Linux ++ OS="$(sed 's, release .*$,,g' /etc/system-release)" + else +- OS="${GRUB_DISTRIBUTOR} GNU/Linux" ++ OS="${GRUB_DISTRIBUTOR}" + CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" + fi + diff --git a/0020-vbe-blacklist-preferred-1440.patch b/0020-vbe-blacklist-preferred-1440.patch deleted file mode 100644 index 7100d4b..0000000 --- a/0020-vbe-blacklist-preferred-1440.patch +++ /dev/null @@ -1,37 +0,0 @@ -From a7fc83bc477e453ee221dacdf2911573ac645f30 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:06:59 +0800 -Subject: [PATCH 020/272] vbe blacklist preferred 1440 - -Blacklist 1440x900x32 from preferred mode handling until a -better solution is available. This mode causes problems on -many Thinkpads. - -Signed-off-by: Michael Chang ---- - grub-core/video/i386/pc/vbe.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/grub-core/video/i386/pc/vbe.c b/grub-core/video/i386/pc/vbe.c -index a0bb9af09..801ae9470 100644 ---- a/grub-core/video/i386/pc/vbe.c -+++ b/grub-core/video/i386/pc/vbe.c -@@ -1054,6 +1054,15 @@ grub_video_vbe_setup (unsigned int width, unsigned int height, - || vbe_mode_info.y_resolution > height) - /* Resolution exceeds that of preferred mode. */ - continue; -+ -+ /* Blacklist 1440x900x32 from preferred mode handling until a -+ better solution is available. This mode causes problems on -+ many Thinkpads. -+ */ -+ if (vbe_mode_info.x_resolution == 1440 && -+ vbe_mode_info.y_resolution == 900 && -+ vbe_mode_info.bits_per_pixel == 32) -+ continue; - } - else - { --- -2.41.0 - diff --git a/0204-Add-.eh_frame-to-list-of-relocations-stripped.patch b/0021-Add-.eh_frame-to-list-of-relocations-stripped.patch similarity index 82% rename from 0204-Add-.eh_frame-to-list-of-relocations-stripped.patch rename to 0021-Add-.eh_frame-to-list-of-relocations-stripped.patch index aaa9348..9344171 100644 --- a/0204-Add-.eh_frame-to-list-of-relocations-stripped.patch +++ b/0021-Add-.eh_frame-to-list-of-relocations-stripped.patch @@ -1,14 +1,15 @@ -From b83fec11877cbe5cece930f9bf945a168af954d2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Fedora Ninjas Date: Mon, 13 Jan 2014 21:50:59 -0500 -Subject: [PATCH 204/272] Add .eh_frame to list of relocations stripped +Subject: [PATCH] Add .eh_frame to list of relocations stripped +Signed-off-by: Peter Jones --- conf/Makefile.common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/Makefile.common b/conf/Makefile.common -index b8f216f6c..ece9ed8a1 100644 +index b8f216f6cd3..ece9ed8a1bf 100644 --- a/conf/Makefile.common +++ b/conf/Makefile.common @@ -41,7 +41,7 @@ CFLAGS_KERNEL = $(CFLAGS_PLATFORM) -ffreestanding @@ -20,6 +21,3 @@ index b8f216f6c..ece9ed8a1 100644 if !COND_emu if COND_HAVE_ASM_USCORE LDFLAGS_KERNEL += -Wl,--defsym=_malloc=_grub_malloc -Wl,--defsym=_free=_grub_free --- -2.41.0 - diff --git a/0021-grubenv-in-btrfs-header.patch b/0021-grubenv-in-btrfs-header.patch deleted file mode 100644 index b185247..0000000 --- a/0021-grubenv-in-btrfs-header.patch +++ /dev/null @@ -1,518 +0,0 @@ -From 36f34d3d5cbea277988dc2daabf6a38c4b45006c Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:09:25 +0800 -Subject: [PATCH 021/272] grubenv in btrfs header - -GRUB cannot write Btrfs file systems from the bootloader, so it cannot -modify values set from userspace (e.g. "next_entry" set by grub2-once). -As a workaround use the Btrfs header to store known data of the GRUB environment -block. - -v2: export env_block and make sure to use the device of grubenv - -v3: - * Use xcalloc for overflow check and return NULL when it would - occur. - -Signed-off-by: Michael Chang ---- - grub-core/kern/fs.c | 8 + - util/grub-editenv.c | 336 ++++++++++++++++++++++++++++++++++++++- - util/grub.d/00_header.in | 20 ++- - 3 files changed, 360 insertions(+), 4 deletions(-) - -diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c -index 7ad0aaf4e..813ac686e 100644 ---- a/grub-core/kern/fs.c -+++ b/grub-core/kern/fs.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - grub_fs_t grub_fs_list = 0; - -@@ -236,6 +237,13 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) - size, buf) != GRUB_ERR_NONE) - return -1; - -+ if (file->read_hook) -+ { -+ grub_disk_addr_t part_start; -+ -+ part_start = grub_partition_get_start (file->device->disk->partition); -+ file->read_hook (p->offset + sector + part_start, (unsigned)offset, (unsigned)size, NULL, file->read_hook_data); -+ } - ret += size; - len -= size; - sector -= ((size + offset) >> GRUB_DISK_SECTOR_BITS); -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index db6f187cc..b8219335f 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -23,8 +23,11 @@ - #include - #include - #include --#include -+#include - #include -+#include -+#include -+#include - - #include - #include -@@ -120,6 +123,140 @@ block, use `rm %s'."), - NULL, help_filter, NULL - }; - -+struct fs_envblk_spec { -+ const char *fs_name; -+ int offset; -+ int size; -+} fs_envblk_spec[] = { -+ { "btrfs", 256 * 1024, GRUB_DISK_SECTOR_SIZE }, -+ { NULL, 0, 0 } -+}; -+ -+struct fs_envblk { -+ struct fs_envblk_spec *spec; -+ const char *dev; -+}; -+ -+typedef struct fs_envblk_spec *fs_envblk_spec_t; -+typedef struct fs_envblk *fs_envblk_t; -+ -+fs_envblk_t fs_envblk = NULL; -+ -+static int -+read_envblk_fs (const char *varname, const char *value, void *hook_data) -+{ -+ grub_envblk_t *p_envblk = (grub_envblk_t *)hook_data; -+ -+ if (!p_envblk || !fs_envblk) -+ return 0; -+ -+ if (strcmp (varname, "env_block") == 0) -+ { -+ int off, sz; -+ char *p; -+ -+ off = strtol (value, &p, 10); -+ if (*p == '+') -+ sz = strtol (p+1, &p, 10); -+ -+ if (*p == '\0') -+ { -+ FILE *fp; -+ char *buf; -+ -+ off <<= GRUB_DISK_SECTOR_BITS; -+ sz <<= GRUB_DISK_SECTOR_BITS; -+ -+ fp = grub_util_fopen (fs_envblk->dev, "rb"); -+ if (! fp) -+ grub_util_error (_("cannot open `%s': %s"), fs_envblk->dev, -+ strerror (errno)); -+ -+ -+ if (fseek (fp, off, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), fs_envblk->dev, -+ strerror (errno)); -+ -+ buf = xmalloc (sz); -+ if ((fread (buf, 1, sz, fp)) != sz) -+ grub_util_error (_("cannot read `%s': %s"), fs_envblk->dev, -+ strerror (errno)); -+ -+ fclose (fp); -+ -+ *p_envblk = grub_envblk_open (buf, sz); -+ } -+ } -+ -+ return 0; -+} -+ -+static void -+create_envblk_fs (void) -+{ -+ FILE *fp; -+ char *buf; -+ const char *device; -+ int offset, size; -+ -+ if (!fs_envblk) -+ return; -+ -+ device = fs_envblk->dev; -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ fp = grub_util_fopen (device, "r+b"); -+ if (! fp) -+ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); -+ -+ buf = xmalloc (size); -+ memcpy (buf, GRUB_ENVBLK_SIGNATURE, sizeof (GRUB_ENVBLK_SIGNATURE) - 1); -+ memset (buf + sizeof (GRUB_ENVBLK_SIGNATURE) - 1, '#', size - sizeof (GRUB_ENVBLK_SIGNATURE) + 1); -+ -+ if (fseek (fp, offset, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); -+ -+ if (fwrite (buf, 1, size, fp) != size) -+ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); -+ -+ grub_util_file_sync (fp); -+ free (buf); -+ fclose (fp); -+} -+ -+static grub_envblk_t -+open_envblk_fs (grub_envblk_t envblk) -+{ -+ grub_envblk_t envblk_fs = NULL; -+ char *val; -+ int offset, size; -+ -+ if (!fs_envblk) -+ return NULL; -+ -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ grub_envblk_iterate (envblk, &envblk_fs, read_envblk_fs); -+ -+ if (envblk_fs && grub_envblk_size (envblk_fs) == size) -+ return envblk_fs; -+ -+ create_envblk_fs (); -+ -+ offset = offset >> GRUB_DISK_SECTOR_BITS; -+ size = (size + GRUB_DISK_SECTOR_SIZE - 1) >> GRUB_DISK_SECTOR_BITS; -+ -+ val = xasprintf ("%d+%d", offset, size); -+ if (! grub_envblk_set (envblk, "env_block", val)) -+ grub_util_error ("%s", _("environment block too small")); -+ grub_envblk_iterate (envblk, &envblk_fs, read_envblk_fs); -+ free (val); -+ -+ return envblk_fs; -+} -+ - static grub_envblk_t - open_envblk_file (const char *name) - { -@@ -182,10 +319,17 @@ static void - list_variables (const char *name) - { - grub_envblk_t envblk; -+ grub_envblk_t envblk_fs = NULL; - - envblk = open_envblk_file (name); -+ grub_envblk_iterate (envblk, &envblk_fs, read_envblk_fs); - grub_envblk_iterate (envblk, NULL, print_var); - grub_envblk_close (envblk); -+ if (envblk_fs) -+ { -+ grub_envblk_iterate (envblk_fs, NULL, print_var); -+ grub_envblk_close (envblk_fs); -+ } - } - - static void -@@ -208,6 +352,38 @@ write_envblk (const char *name, grub_envblk_t envblk) - fclose (fp); - } - -+static void -+write_envblk_fs (grub_envblk_t envblk) -+{ -+ FILE *fp; -+ const char *device; -+ int offset, size; -+ -+ if (!fs_envblk) -+ return; -+ -+ device = fs_envblk->dev; -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ if (grub_envblk_size (envblk) > size) -+ grub_util_error ("%s", _("environment block too small")); -+ -+ fp = grub_util_fopen (device, "r+b"); -+ -+ if (! fp) -+ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); -+ -+ if (fseek (fp, offset, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); -+ -+ if (fwrite (grub_envblk_buffer (envblk), 1, grub_envblk_size (envblk), fp) != grub_envblk_size (envblk)) -+ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); -+ -+ grub_util_file_sync (fp); -+ fclose (fp); -+} -+ - static void - set_variables (const char *name, int argc, char *argv[]) - { -@@ -224,8 +400,27 @@ set_variables (const char *name, int argc, char *argv[]) - - *(p++) = 0; - -- if (! grub_envblk_set (envblk, argv[0], p)) -- grub_util_error ("%s", _("environment block too small")); -+ if ((strcmp (argv[0], "next_entry") == 0 || -+ strcmp (argv[0], "health_checker_flag") == 0) && fs_envblk) -+ { -+ grub_envblk_t envblk_fs; -+ envblk_fs = open_envblk_fs (envblk); -+ if (!envblk_fs) -+ grub_util_error ("%s", _("can't open fs environment block")); -+ if (! grub_envblk_set (envblk_fs, argv[0], p)) -+ grub_util_error ("%s", _("environment block too small")); -+ write_envblk_fs (envblk_fs); -+ grub_envblk_close (envblk_fs); -+ } -+ else if (strcmp (argv[0], "env_block") == 0) -+ { -+ grub_util_warn ("can't set env_block as it's read-only"); -+ } -+ else -+ { -+ if (! grub_envblk_set (envblk, argv[0], p)) -+ grub_util_error ("%s", _("environment block too small")); -+ } - - argc--; - argv++; -@@ -233,26 +428,158 @@ set_variables (const char *name, int argc, char *argv[]) - - write_envblk (name, envblk); - grub_envblk_close (envblk); -+ - } - - static void - unset_variables (const char *name, int argc, char *argv[]) - { - grub_envblk_t envblk; -+ grub_envblk_t envblk_fs; - - envblk = open_envblk_file (name); -+ -+ envblk_fs = NULL; -+ if (fs_envblk) -+ envblk_fs = open_envblk_fs (envblk); -+ - while (argc) - { - grub_envblk_delete (envblk, argv[0]); - -+ if (envblk_fs) -+ grub_envblk_delete (envblk_fs, argv[0]); -+ - argc--; - argv++; - } - - write_envblk (name, envblk); - grub_envblk_close (envblk); -+ -+ if (envblk_fs) -+ { -+ write_envblk_fs (envblk_fs); -+ grub_envblk_close (envblk_fs); -+ } -+} -+ -+int have_abstraction = 0; -+static void -+probe_abstraction (grub_disk_t disk) -+{ -+ if (disk->partition == NULL) -+ grub_util_info ("no partition map found for %s", disk->name); -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID || -+ disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ have_abstraction = 1; -+ } - } - -+static fs_envblk_t -+probe_fs_envblk (fs_envblk_spec_t spec) -+{ -+ char **grub_devices; -+ char **curdev, **curdrive; -+ size_t ndev = 0; -+ char **grub_drives; -+ grub_device_t grub_dev = NULL; -+ grub_fs_t grub_fs; -+ const char *fs_envblk_device; -+ -+#ifdef __s390x__ -+ return NULL; -+#endif -+ -+ grub_util_biosdisk_init (DEFAULT_DEVICE_MAP); -+ grub_init_all (); -+ grub_gcry_init_all (); -+ -+ grub_lvm_fini (); -+ grub_mdraid09_fini (); -+ grub_mdraid1x_fini (); -+ grub_diskfilter_fini (); -+ grub_diskfilter_init (); -+ grub_mdraid09_init (); -+ grub_mdraid1x_init (); -+ grub_lvm_init (); -+ -+ grub_devices = grub_guess_root_devices (DEFAULT_DIRECTORY); -+ -+ if (!grub_devices || !grub_devices[0]) -+ grub_util_error (_("cannot find a device for %s (is /dev mounted?)"), DEFAULT_DIRECTORY); -+ -+ fs_envblk_device = grub_devices[0]; -+ -+ for (curdev = grub_devices; *curdev; curdev++) -+ { -+ grub_util_pull_device (*curdev); -+ ndev++; -+ } -+ -+ grub_drives = xcalloc ((ndev + 1), sizeof (grub_drives[0])); -+ -+ for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++, -+ curdrive++) -+ { -+ *curdrive = grub_util_get_grub_dev (*curdev); -+ if (! *curdrive) -+ grub_util_error (_("cannot find a GRUB drive for %s. Check your device.map"), -+ *curdev); -+ } -+ *curdrive = 0; -+ -+ grub_dev = grub_device_open (grub_drives[0]); -+ if (! grub_dev) -+ grub_util_error ("%s", grub_errmsg); -+ -+ grub_fs = grub_fs_probe (grub_dev); -+ if (! grub_fs) -+ grub_util_error ("%s", grub_errmsg); -+ -+ if (grub_dev->disk) -+ { -+ probe_abstraction (grub_dev->disk); -+ } -+ for (curdrive = grub_drives + 1; *curdrive; curdrive++) -+ { -+ grub_device_t dev = grub_device_open (*curdrive); -+ if (!dev) -+ continue; -+ if (dev->disk) -+ probe_abstraction (dev->disk); -+ grub_device_close (dev); -+ } -+ -+ free (grub_drives); -+ grub_device_close (grub_dev); -+ grub_gcry_fini_all (); -+ grub_fini_all (); -+ grub_util_biosdisk_fini (); -+ -+ fs_envblk_spec_t p; -+ -+ for (p = spec; p->fs_name; p++) -+ { -+ if (strcmp (grub_fs->name, p->fs_name) == 0 && !have_abstraction) -+ { -+ if (p->offset % GRUB_DISK_SECTOR_SIZE == 0 && -+ p->size % GRUB_DISK_SECTOR_SIZE == 0) -+ { -+ fs_envblk = xmalloc (sizeof (fs_envblk_t)); -+ fs_envblk->spec = p; -+ fs_envblk->dev = strdup(fs_envblk_device); -+ return fs_envblk; -+ } -+ } -+ } -+ -+ return NULL; -+} -+ -+ - int - main (int argc, char *argv[]) - { -@@ -284,6 +611,9 @@ main (int argc, char *argv[]) - command = argv[curindex++]; - } - -+ if (strcmp (filename, DEFAULT_ENVBLK_PATH) == 0) -+ fs_envblk = probe_fs_envblk (fs_envblk_spec); -+ - if (strcmp (command, "create") == 0) - grub_util_create_envblk_file (filename); - else if (strcmp (command, "list") == 0) -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index be29d7148..de0a3c358 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -46,6 +46,13 @@ cat << EOF - if [ -s \$prefix/grubenv ]; then - load_env - fi -+ -+if [ "\${env_block}" ] ; then -+ set env_block="(\${root})\${env_block}" -+ export env_block -+ load_env -f "\${env_block}" -+fi -+ - EOF - if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then - cat < Date: Tue, 11 Feb 2014 11:14:50 -0500 -Subject: [PATCH 181/272] Don't require a password to boot entries generated by +Subject: [PATCH] Don't require a password to boot entries generated by grub-mkconfig. When we set a password, we just want that to mean you can't /edit/ an entry. @@ -14,7 +14,7 @@ Signed-off-by: Peter Jones 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 29e6c51db..41c885838 100644 +index 901745707f1..9c31a94decb 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -26,7 +26,7 @@ datarootdir="@datarootdir@" @@ -26,6 +26,3 @@ index 29e6c51db..41c885838 100644 if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then OS="$(sed 's, release .*$,,g' /etc/system-release)" --- -2.41.0 - diff --git a/0022-set-default-distributor.patch b/0022-set-default-distributor.patch deleted file mode 100644 index 5b8ef6b..0000000 --- a/0022-set-default-distributor.patch +++ /dev/null @@ -1,215 +0,0 @@ -From bba2acd1f6c9b1f536d443f0430ee0753f88c4e7 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:17:45 +0800 -Subject: [PATCH 022/272] set default distributor - -v1: -As long as VERSION in /etc/os-release has been commented out for rolling -release, we can replace openSUSE Tumbleweed specific handling for grub -distributor with a generic one. - -v2: -Use /usr/lib/os-release as fallback to /etc/os-release - -Signed-off-by: Michael Chang ---- - grub-core/osdep/unix/config.c | 146 +++++++++++++++++++++++++++++++++- - util/grub-mkconfig.in | 13 +++ - 2 files changed, 158 insertions(+), 1 deletion(-) - -diff --git a/grub-core/osdep/unix/config.c b/grub-core/osdep/unix/config.c -index 0b1f7618d..c7c4558d8 100644 ---- a/grub-core/osdep/unix/config.c -+++ b/grub-core/osdep/unix/config.c -@@ -61,6 +61,131 @@ grub_util_get_localedir (void) - return LOCALEDIR; - } - -+#ifdef __linux__ -+static char * -+os_release_get_val (const char *buf, const char *key) -+{ -+ const char *ptr = buf; -+ char *ret; -+ -+ while (*ptr && grub_isspace(*ptr)) -+ ptr++; -+ -+ if (*ptr == '#') -+ return NULL; -+ -+ if (grub_strncmp (ptr, key, grub_strlen (key)) != 0) -+ return NULL; -+ -+ ptr += grub_strlen (key); -+ if (*ptr++ != '=' || *ptr == '\0') -+ return NULL; -+ -+ if (*ptr == '"' || *ptr == '\'') -+ { -+ char c = *ptr; -+ int i = 0; -+ char *tmp, *ptmp; -+ -+ if (*++ptr == '\0') -+ return NULL; -+ -+ tmp = grub_strdup (ptr); -+ if ((ptmp = grub_strrchr (tmp, c))) -+ *ptmp = '\0'; -+ -+ ret = malloc (grub_strlen (tmp) + 1); -+ ptmp = tmp; -+ while (*ptmp) -+ { -+ if (*ptmp != '\\' || *(ptmp + 1) != c) -+ ret[i++] = *ptmp; -+ ++ptmp; -+ } -+ -+ grub_free (tmp); -+ ret[i] = '\0'; -+ } -+ else -+ { -+ char *pret; -+ -+ ret = grub_strdup (ptr); -+ if ((pret = grub_strchr (ret, ' '))) -+ *pret = '\0'; -+ } -+ -+ return ret; -+} -+ -+static char* -+grub_util_default_distributor (void) -+{ -+ char *cfgfile; -+ char buf[1024]; -+ FILE *fp = NULL; -+ char *os_name = NULL; -+ char *os_version = NULL; -+ -+ cfgfile = grub_util_path_concat (2, GRUB_SYSCONFDIR, "os-release"); -+ if (!grub_util_is_regular (cfgfile)) -+ { -+ grub_free (cfgfile); -+ cfgfile = grub_util_path_concat (2, "/usr/lib", "os-release"); -+ if (!grub_util_is_regular (cfgfile)) -+ { -+ grub_free (cfgfile); -+ return NULL; -+ } -+ } -+ -+ fp = grub_util_fopen (cfgfile, "r"); -+ -+ if (!fp) -+ { -+ grub_util_warn (_("cannot open configuration file `%s': %s"), -+ cfgfile, strerror (errno)); -+ grub_free (cfgfile); -+ return NULL; -+ } -+ -+ grub_free (cfgfile); -+ -+ while (fgets (buf, sizeof (buf), fp)) -+ { -+ if (buf[grub_strlen(buf) - 1] == '\n') -+ buf[grub_strlen(buf) - 1] = '\0'; -+ -+ if (!os_name -+ && (os_name = os_release_get_val (buf, "NAME"))) -+ continue; -+ if (!os_version -+ && (os_version = os_release_get_val (buf, "VERSION"))) -+ continue; -+ if (os_name && os_version) -+ break; -+ } -+ -+ fclose (fp); -+ -+ if (os_name && os_version) -+ { -+ char *os_name_version; -+ -+ os_name_version = grub_xasprintf ("%s %s", os_name, os_version); -+ -+ grub_free (os_name); -+ grub_free (os_version); -+ -+ return os_name_version; -+ } -+ -+ grub_free (os_version); -+ -+ return os_name; -+} -+#endif -+ - void - grub_util_load_config (struct grub_util_config *cfg) - { -@@ -125,7 +250,17 @@ grub_util_load_config (struct grub_util_config *cfg) - waitpid (pid, NULL, 0); - } - if (f) -- return; -+ { -+#ifdef __linux__ -+ if (!cfg->grub_distributor || cfg->grub_distributor[0] == '\0') -+ { -+ if (cfg->grub_distributor) -+ grub_free (cfg->grub_distributor); -+ cfg->grub_distributor = grub_util_default_distributor (); -+ } -+#endif -+ return; -+ } - - f = grub_util_fopen (cfgfile, "r"); - if (f) -@@ -136,4 +271,13 @@ grub_util_load_config (struct grub_util_config *cfg) - else - grub_util_warn (_("cannot open configuration file `%s': %s"), - cfgfile, strerror (errno)); -+ -+#ifdef __linux__ -+ if (!cfg->grub_distributor || cfg->grub_distributor[0] == '\0') -+ { -+ if (cfg->grub_distributor) -+ grub_free (cfg->grub_distributor); -+ cfg->grub_distributor = grub_util_default_distributor (); -+ } -+#endif - } -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index a722cf691..b450aff60 100644 ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -225,6 +225,19 @@ GRUB_ACTUAL_DEFAULT="$GRUB_DEFAULT" - - if [ "x${GRUB_ACTUAL_DEFAULT}" = "xsaved" ] ; then GRUB_ACTUAL_DEFAULT="`"${grub_editenv}" - list | sed -n '/^saved_entry=/ s,^saved_entry=,,p'`" ; fi - -+if [ x"${GRUB_DISTRIBUTOR}" = x ] ; then -+ for i in "${sysconfdir}/os-release" "/usr/lib/os-release" ; do -+ if [ -f "$i" ] ; then -+ . "$i" -+ break -+ fi -+ done -+ if [ x"${NAME}" != x ] && [ x"${VERSION}" != x ] ; then -+ GRUB_DISTRIBUTOR="${NAME} ${VERSION}" -+ else -+ GRUB_DISTRIBUTOR="${NAME}" -+ fi -+fi - - # These are defined in this script, export them here so that user can - # override them. --- -2.41.0 - diff --git a/0023-efi-chainload-harder.patch b/0023-efi-chainload-harder.patch deleted file mode 100644 index e5e4b66..0000000 --- a/0023-efi-chainload-harder.patch +++ /dev/null @@ -1,131 +0,0 @@ -From e59657678df64f636c85fd62d8cb8c3cc3a076cf Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:28:47 +0800 -Subject: [PATCH 023/272] efi chainload harder - -v2: -Use grub_efi_get_secureboot to get secure boot status - -v3: -Fix null sb_context->file_path due to missing assignment of chainloaded image's -file_path (bsc#1216081) - -Signed-off-by: Michael Chang ---- - grub-core/loader/efi/chainloader.c | 75 +++++++++++++++++++++--------- - 1 file changed, 52 insertions(+), 23 deletions(-) - -diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c -index 5359b2507..655aaad9d 100644 ---- a/grub-core/loader/efi/chainloader.c -+++ b/grub-core/loader/efi/chainloader.c -@@ -305,40 +305,41 @@ grub_secure_validate (void *data, grub_efi_uint32_t size) - static grub_efi_boolean_t - read_header (void *data, grub_efi_uint32_t size, pe_coff_loader_image_context_t *context) - { -- grub_efi_guid_t guid = SHIM_LOCK_GUID; -- grub_efi_shim_lock_t *shim_lock; -- grub_efi_status_t status; -- -- shim_lock = grub_efi_locate_protocol (&guid, NULL); -+ char *msdos = (char *)data; -+ struct grub_pe32_header_no_msdos_stub *pe32 = (struct grub_pe32_header_no_msdos_stub *)data; - -- if (!shim_lock) -+ if (size < sizeof (*pe32)) - { -- grub_error (GRUB_ERR_BAD_ARGUMENT, "no shim lock protocol"); -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid image"); - return 0; - } - -- status = shim_lock->context (data, size, context); -- -- if (status == GRUB_EFI_SUCCESS) -+ if (grub_memcmp (msdos, "MZ", 2) == 0) - { -- grub_dprintf ("chain", "context success\n"); -- return 1; -+ grub_uint32_t off = *((grub_uint32_t *) (msdos + 0x3c)); -+ pe32 = (struct grub_pe32_header_no_msdos_stub *) ((char *)data + off); - } - -- switch (status) -+ if (grub_memcmp (pe32->signature, "PE\0\0", 4) != 0 || -+ pe32->coff_header.machine != GRUB_PE32_MACHINE_X86_64 || -+ pe32->optional_header.magic != GRUB_PE32_PE64_MAGIC) - { -- case GRUB_EFI_UNSUPPORTED: -- grub_error (GRUB_ERR_BAD_ARGUMENT, "context error unsupported"); -- break; -- case GRUB_EFI_INVALID_PARAMETER: -- grub_error (GRUB_ERR_BAD_ARGUMENT, "context error invalid parameter"); -- break; -- default: -- grub_error (GRUB_ERR_BAD_ARGUMENT, "context error code"); -- break; -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "Not supported image"); -+ return 0; - } - -- return 0; -+ context->number_of_rva_and_sizes = pe32->optional_header.num_data_directories; -+ context->size_of_headers = pe32->optional_header.header_size; -+ context->image_size = pe32->optional_header.image_size; -+ context->image_address = pe32->optional_header.image_base; -+ context->entry_point = pe32->optional_header.entry_addr; -+ context->reloc_dir = &pe32->optional_header.base_relocation_table; -+ context->sec_dir = &pe32->optional_header.certificate_table; -+ context->number_of_sections = pe32->coff_header.num_sections; -+ context->pe_hdr = pe32; -+ context->first_section = (struct grub_pe32_section_table *)((char *)(&pe32->optional_header) + pe32->coff_header.optional_header_size); -+ -+ return 1; - } - - static void* -@@ -607,6 +608,9 @@ error_exit: - if (buffer) - b->free_pool (buffer); - -+ if (grub_errno) -+ grub_print_error (); -+ - return 0; - - } -@@ -825,6 +829,31 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), - status = b->load_image (0, grub_efi_image_handle, file_path, - boot_image, size, - &image_handle); -+#ifdef SUPPORT_SECURE_BOOT -+ if (status == GRUB_EFI_SECURITY_VIOLATION && grub_efi_get_secureboot () != GRUB_EFI_SECUREBOOT_MODE_ENABLED) -+ { -+ /* If it failed with security violation while not in secure boot mode, -+ the firmware might be broken. We try to workaround on that by forcing -+ the SB method! (bsc#887793) */ -+ struct grub_secureboot_chainloader_context *sb_context; -+ -+ grub_dprintf ("chain", "Possible firmware flaw! Security violation while not in secure boot mode.\n"); -+ sb_context = grub_malloc (sizeof (*sb_context)); -+ if (!sb_context) -+ goto fail; -+ sb_context->cmdline = cmdline; -+ sb_context->cmdline_len = cmdline_len; -+ sb_context->fsize = size; -+ sb_context->dev_handle = dev_handle; -+ sb_context->address = address; -+ sb_context->pages = pages; -+ sb_context->file_path = file_path; -+ grub_file_close (file); -+ grub_loader_set_ex (grub_secureboot_chainloader_boot, -+ grub_secureboot_chainloader_unload, sb_context, 0); -+ return 0; -+ } -+#endif - if (status != GRUB_EFI_SUCCESS) - { - if (status == GRUB_EFI_OUT_OF_RESOURCES) --- -2.41.0 - diff --git a/0182-use-fw_path-prefix-when-fallback-searching-for-grub-.patch b/0023-use-fw_path-prefix-when-fallback-searching-for-grub-.patch similarity index 80% rename from 0182-use-fw_path-prefix-when-fallback-searching-for-grub-.patch rename to 0023-use-fw_path-prefix-when-fallback-searching-for-grub-.patch index 1b62717..40f598d 100644 --- a/0182-use-fw_path-prefix-when-fallback-searching-for-grub-.patch +++ b/0023-use-fw_path-prefix-when-fallback-searching-for-grub-.patch @@ -1,8 +1,7 @@ -From b9357960a4bc81b824a13aa92c6cbcd5ae1ddc1d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Fedora Ninjas Date: Wed, 19 Feb 2014 15:58:43 -0500 -Subject: [PATCH 182/272] use fw_path prefix when fallback searching for grub - config +Subject: [PATCH] use fw_path prefix when fallback searching for grub config When PXE booting via UEFI firmware, grub was searching for grub.cfg in the fw_path directory where the grub application was found. If @@ -18,10 +17,10 @@ Signed-off-by: Mark Salter 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 56f42e1e0..6bb3ff406 100644 +index 568c2adfa16..0b2bbee19c3 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -341,7 +341,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), +@@ -347,7 +347,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), char *config; const char *prefix, *fw_path; @@ -30,7 +29,7 @@ index 56f42e1e0..6bb3ff406 100644 if (fw_path) { config = grub_xasprintf ("%s/grub.cfg", fw_path); -@@ -364,7 +364,8 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), +@@ -370,7 +370,8 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), } } @@ -40,6 +39,3 @@ index 56f42e1e0..6bb3ff406 100644 if (prefix) { grub_size_t config_len; --- -2.41.0 - diff --git a/0024-Allocate-LVM-metadata-buffer-from-raw-contents.patch b/0024-Allocate-LVM-metadata-buffer-from-raw-contents.patch deleted file mode 100644 index 90a0e7d..0000000 --- a/0024-Allocate-LVM-metadata-buffer-from-raw-contents.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 74f6e4ce785cb2c1722037e117be057070a904b0 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 9 Apr 2021 19:58:24 +0800 -Subject: [PATCH 024/272] Allocate LVM metadata buffer from raw contents - -The size reserved for on disk LVM metadata area can be exceedingly large that -may trigger out of memory error for allocating buffer based on it. Refine the -buffer allocation to use size of raw LVM metadata contents and read them from -within the metadata area as we only need to parse the JSON formatted contents -rather than the entire metadata area. This reduced the size significantly and -the likelihood to out of memory error. ---- - grub-core/disk/lvm.c | 79 ++++++++++++++++++++++++-------------------- - 1 file changed, 43 insertions(+), 36 deletions(-) - -diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c -index 794248540..ea260b47e 100644 ---- a/grub-core/disk/lvm.c -+++ b/grub-core/disk/lvm.c -@@ -140,9 +140,11 @@ grub_lvm_detect (grub_disk_t disk, - grub_err_t err; - grub_uint64_t mda_offset, mda_size; - grub_size_t ptr; -+ grub_uint64_t mda_raw_offset, mda_raw_size; - char buf[GRUB_LVM_LABEL_SIZE]; - char vg_id[GRUB_LVM_ID_STRLEN+1]; - char pv_id[GRUB_LVM_ID_STRLEN+1]; -+ char mdah_buf[sizeof (struct grub_lvm_mda_header) + sizeof (struct grub_lvm_raw_locn)]; - char *metadatabuf, *mda_end, *vgname; - const char *p, *q; - struct grub_lvm_label_header *lh = (struct grub_lvm_label_header *) buf; -@@ -220,21 +222,15 @@ grub_lvm_detect (grub_disk_t disk, - - dlocn++; - mda_offset = grub_le_to_cpu64 (dlocn->offset); -- mda_size = grub_le_to_cpu64 (dlocn->size); - - /* It's possible to have multiple copies of metadata areas, we just use the - first one. */ -- -- /* Allocate buffer space for the circular worst-case scenario. */ -- metadatabuf = grub_calloc (2, mda_size); -- if (! metadatabuf) -+ err = grub_disk_read (disk, 0, mda_offset, sizeof (mdah_buf), mdah_buf); -+ if (err) - goto fail; - -- err = grub_disk_read (disk, 0, mda_offset, mda_size, metadatabuf); -- if (err) -- goto fail2; -+ mdah = (struct grub_lvm_mda_header *) mdah_buf; - -- mdah = (struct grub_lvm_mda_header *) metadatabuf; - if ((grub_strncmp ((char *)mdah->magic, GRUB_LVM_FMTT_MAGIC, - sizeof (mdah->magic))) - || (grub_le_to_cpu32 (mdah->version) != GRUB_LVM_FMTT_VERSION)) -@@ -244,42 +240,58 @@ grub_lvm_detect (grub_disk_t disk, - #ifdef GRUB_UTIL - grub_util_info ("unknown LVM metadata header"); - #endif -- goto fail2; -+ goto fail; - } - - rlocn = mdah->raw_locns; -- if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size)) -+ -+ mda_size = grub_le_to_cpu64 (mdah->size); -+ mda_raw_size = grub_le_to_cpu64 (rlocn->size); -+ mda_raw_offset = grub_le_to_cpu64 (rlocn->offset); -+ -+ if (mda_raw_offset >= mda_size) - { - #ifdef GRUB_UTIL - grub_util_info ("metadata offset is beyond end of metadata area"); - #endif -- goto fail2; -+ goto fail; - } - -- if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) > -- grub_le_to_cpu64 (mdah->size)) -+ metadatabuf = grub_malloc (mda_raw_size); -+ -+ if (! metadatabuf) -+ goto fail; -+ -+ if (mda_raw_offset + mda_raw_size > mda_size) - { -- if (2 * mda_size < GRUB_LVM_MDA_HEADER_SIZE || -- (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) - -- grub_le_to_cpu64 (mdah->size) > mda_size - GRUB_LVM_MDA_HEADER_SIZE)) -- { --#ifdef GRUB_UTIL -- grub_util_info ("cannot copy metadata wrap in circular buffer"); --#endif -- goto fail2; -- } -+ err = grub_disk_read (disk, 0, -+ mda_offset + mda_raw_offset, -+ mda_size - mda_raw_offset, -+ metadatabuf); -+ if (err) -+ goto fail2; - - /* Metadata is circular. Copy the wrap in place. */ -- grub_memcpy (metadatabuf + mda_size, -- metadatabuf + GRUB_LVM_MDA_HEADER_SIZE, -- grub_le_to_cpu64 (rlocn->offset) + -- grub_le_to_cpu64 (rlocn->size) - -- grub_le_to_cpu64 (mdah->size)); -+ err = grub_disk_read (disk, 0, -+ mda_offset + GRUB_LVM_MDA_HEADER_SIZE, -+ mda_raw_offset + mda_raw_size - mda_size, -+ metadatabuf + mda_size - mda_raw_offset); -+ if (err) -+ goto fail2; -+ } -+ else -+ { -+ err = grub_disk_read (disk, 0, -+ mda_offset + mda_raw_offset, -+ mda_raw_size, -+ metadatabuf); -+ if (err) -+ goto fail2; - } - -- if (grub_add ((grub_size_t)metadatabuf, -- (grub_size_t)grub_le_to_cpu64 (rlocn->offset), -- &ptr)) -+ p = q = metadatabuf; -+ -+ if (grub_add ((grub_size_t)metadatabuf, (grub_size_t)mda_raw_size, &ptr)) - { - error_parsing_metadata: - #ifdef GRUB_UTIL -@@ -288,11 +300,6 @@ grub_lvm_detect (grub_disk_t disk, - goto fail2; - } - -- p = q = (char *)ptr; -- -- if (grub_add ((grub_size_t)metadatabuf, (grub_size_t)mda_size, &ptr)) -- goto error_parsing_metadata; -- - mda_end = (char *)ptr; - - while (*q != ' ' && q < mda_end) --- -2.41.0 - diff --git a/0183-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch b/0024-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch similarity index 85% rename from 0183-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch rename to 0024-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch index 891824e..be44d1a 100644 --- a/0183-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch +++ b/0024-Try-mac-guid-etc-before-grub.cfg-on-tftp-config-file.patch @@ -1,19 +1,18 @@ -From b9c281956bf8297b4a78e546a2bfe72780ebbf1d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 8 Jul 2019 17:33:22 +0200 -Subject: [PATCH 183/272] Try mac/guid/etc before grub.cfg on tftp config - files. +Subject: [PATCH] Try mac/guid/etc before grub.cfg on tftp config files. Signed-off-by: Peter Jones --- - grub-core/normal/main.c | 93 ++++++++++++++++++++++------------------- - 1 file changed, 49 insertions(+), 44 deletions(-) + grub-core/normal/main.c | 97 ++++++++++++++++++++++++++----------------------- + 1 file changed, 51 insertions(+), 46 deletions(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 6bb3ff406..ecc7e62e6 100644 +index 0b2bbee19c3..4c89892fa70 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -339,61 +339,66 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), +@@ -345,61 +345,66 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), /* Guess the config filename. It is necessary to make CONFIG static, so that it won't get broken by longjmp. */ char *config; @@ -62,38 +61,40 @@ index 6bb3ff406..ecc7e62e6 100644 - config_len = grub_strlen (prefix) + - sizeof ("/grub.cfg-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"); - config = grub_malloc (config_len); -+ if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 && -+ !disable_net_search) +- +- if (!config) +- goto quit; +- +- grub_snprintf (config, config_len, "%s/grub.cfg", prefix); +- +- net_search_cfg = grub_env_get ("feature_net_search_cfg"); +- if (net_search_cfg && net_search_cfg[0] == 'n') +- disable_net_search = 1; +- + if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 && + !disable_net_search) +- grub_net_search_config_file (config); + { + grub_size_t config_len; + config_len = grub_strlen (prefix) + + sizeof ("/grub.cfg-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"); + config = grub_malloc (config_len); -- if (!config) -- goto quit; +- grub_enter_normal_mode (config); +- grub_free (config); +- } + if (! config) + goto quit; - -- grub_snprintf (config, config_len, "%s/grub.cfg", prefix); ++ + grub_snprintf (config, config_len, "%s/grub.cfg", prefix); - -- net_search_cfg = grub_env_get ("feature_net_search_cfg"); -- if (net_search_cfg && net_search_cfg[0] == 'n') -- disable_net_search = 1; ++ + grub_net_search_configfile (config); - -- if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 && -- !disable_net_search) -- grub_net_search_config_file (config); ++ + grub_enter_normal_mode (config); + grub_free (config); + config = NULL; + } - -- grub_enter_normal_mode (config); -- grub_free (config); -- } ++ + if (!config) + { + config = grub_xasprintf ("%s/grub.cfg", prefix); @@ -124,6 +125,3 @@ index 6bb3ff406..ecc7e62e6 100644 } else grub_enter_normal_mode (argv[0]); --- -2.41.0 - diff --git a/0184-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch b/0025-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch similarity index 84% rename from 0184-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch rename to 0025-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch index 7a51592..d29c0af 100644 --- a/0184-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch +++ b/0025-Generate-OS-and-CLASS-in-10_linux-from-etc-os-releas.patch @@ -1,8 +1,7 @@ -From 1fe5b2a191e0370d6aa20ca03fe6a5c90ef87d19 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 4 Sep 2014 14:23:23 -0400 -Subject: [PATCH 184/272] Generate OS and CLASS in 10_linux from - /etc/os-release +Subject: [PATCH] Generate OS and CLASS in 10_linux from /etc/os-release This makes us use pretty names in the titles we generate in grub2-mkconfig when GRUB_DISTRIBUTOR isn't set. @@ -15,7 +14,7 @@ Signed-off-by: Peter Jones 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 41c885838..b88c4b7c5 100644 +index 9c31a94decb..b7809091b36 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -29,7 +29,8 @@ export TEXTDOMAINDIR="@localedir@" @@ -28,6 +27,3 @@ index 41c885838..b88c4b7c5 100644 else OS="${GRUB_DISTRIBUTOR}" CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" --- -2.41.0 - diff --git a/0025-diskfilter-implementation-of-processing-no-metadata-.patch b/0025-diskfilter-implementation-of-processing-no-metadata-.patch deleted file mode 100644 index f333563..0000000 --- a/0025-diskfilter-implementation-of-processing-no-metadata-.patch +++ /dev/null @@ -1,226 +0,0 @@ -From 1ff53dd39b95d2353b9366622c34f314dd5da185 Mon Sep 17 00:00:00 2001 -From: Lidong Zhong -Date: Wed, 26 Apr 2017 15:52:40 +0800 -Subject: [PATCH 025/272] diskfilter: implementation of processing no metadata - recorded in PV - -If one PV underlying the root LV is created with no metadata, such as - -pvcreate --metadatacopies 0 /dev/sda - -then we could get a lot of error messages when generating a new -configuration file. - -Generating grub configuration file ... -error: unknown LVM metadata header. -error: unknown LVM metadata header. -/usr/sbin/grub2-probe: warning: Couldn't find physical volume `pv1'. -Some modules may be missing from core image.. -(For details, please refer to - https://bugzilla.suse.com/show_bug.cgi?id=1027526) - -When one labelled PV which dose not have any metadata is found, we put -it into a global grub_detached_pv list. and we search all the PVs in the -current array list to check if it is a member of grub_detached_pv list. -So we can know if the PV is really missing or just without metadata. - -Signed-off-by: Lidong Zhong ---- - grub-core/disk/diskfilter.c | 112 +++++++++++++++++++++++++++++++++++- - grub-core/disk/lvm.c | 15 +++-- - 2 files changed, 121 insertions(+), 6 deletions(-) - -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 21e239511..b74d2fd48 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -28,6 +28,7 @@ - #include - #include - #endif -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -43,7 +44,17 @@ static struct grub_diskfilter_lv * - find_lv (const char *name); - static int is_lv_readable (struct grub_diskfilter_lv *lv, int easily); - -- -+struct grub_detached_pv { -+ struct grub_detached_pv *next; -+ struct grub_detached_pv **prev; -+ struct grub_diskfilter_pv_id id; -+ grub_disk_t disk; -+ grub_diskfilter_t diskfilter; -+} ; -+ -+static struct grub_detached_pv *detached_pv_list; -+ -+#define FOR_DETACHED_PVS(var) for (var = detached_pv_list; var; var = var->next) - - static grub_err_t - is_node_readable (const struct grub_diskfilter_node *node, int easily) -@@ -132,6 +143,7 @@ scan_disk_partition_iter (grub_disk_t disk, grub_partition_t p, void *data) - grub_disk_addr_t start_sector; - struct grub_diskfilter_pv_id id; - grub_diskfilter_t diskfilter; -+ struct grub_detached_pv *pv; - - grub_dprintf ("diskfilter", "Scanning for DISKFILTER devices on disk %s\n", - name); -@@ -168,6 +180,28 @@ scan_disk_partition_iter (grub_disk_t disk, grub_partition_t p, void *data) - grub_free (id.uuid); - return 0; - } -+ /*insert the special LVM PV into detached_pv_list*/ -+ if (!arr && (id.uuidlen > 0) && (grub_strcmp(diskfilter->name, "lvm") == 0)) -+ { -+ pv = grub_zalloc(sizeof(*pv)); -+ if (!pv) -+ return 1; -+ pv->id.uuidlen = GRUB_LVM_ID_STRLEN; -+ pv->id.uuid = grub_malloc(GRUB_LVM_ID_STRLEN); -+ if (!pv->id.uuid) -+ goto fail_id; -+ grub_memcpy(pv->id.uuid, id.uuid, GRUB_LVM_ID_STRLEN); -+ /*It's safe to save disk into this standalone pv list*/ -+ pv->disk = grub_disk_open(name); -+ if (!pv->disk) -+ goto fail_id; -+ pv->diskfilter = diskfilter; -+ grub_list_push (GRUB_AS_LIST_P (&detached_pv_list), -+ GRUB_AS_LIST(pv)); -+#ifdef GRUB_UTIL -+ grub_util_info ("adding disk %s into detached pv list", name); -+#endif -+ } - if (arr && id.uuidlen) - grub_free (id.uuid); - -@@ -180,6 +214,65 @@ scan_disk_partition_iter (grub_disk_t disk, grub_partition_t p, void *data) - } - - return 0; -+fail_id: -+ if (pv->id.uuidlen) -+ grub_free(pv->id.uuid); -+ grub_free(pv); -+ return 1; -+} -+ -+static int -+process_detached_pv_list(void) -+{ -+ struct grub_diskfilter_vg *arr; -+ struct grub_diskfilter_pv *pv1; -+ struct grub_detached_pv *pv2; -+ unsigned found = 0; -+ -+ for (arr = array_list; arr != NULL; arr = arr->next) -+ { -+ for (pv1 = arr->pvs; pv1; pv1 = pv1->next) -+ { -+ if (pv1->disk) -+ continue; -+ FOR_DETACHED_PVS(pv2) -+ { -+ if (pv2->id.uuidlen == pv1->id.uuidlen && -+ !grub_memcmp(pv2->id.uuid, pv1->id.uuid, pv1->id.uuidlen)) -+ { -+ if (insert_array(pv2->disk, &(pv2->id), arr, -1, pv2->diskfilter)) -+ return grub_errno; -+ else -+ { -+#ifdef GRUB_UTIL -+ grub_util_info ("found disk %s in detached pv list", pv1->disk->name); -+#endif -+ found = 1; -+ break; -+ } -+ } -+ } -+ /*remove pv2 from the list*/ -+ if (found) -+ { -+#ifdef GRUB_UTIL -+ grub_util_info ("removing disk %s from detached pv list", pv1->disk->name); -+#endif -+ grub_list_remove(GRUB_AS_LIST (pv2)); -+ if (pv2->id.uuidlen) -+ { -+ pv2->id.uuidlen = 0; -+ grub_free(pv2->id.uuid); -+ } -+ grub_disk_close(pv2->disk); -+ grub_free(pv2); -+ break; -+ } -+ } -+ if (found) -+ break; -+ } -+ return 0; - } - - static int -@@ -206,6 +299,9 @@ scan_disk (const char *name, int accept_diskfilter) - grub_partition_iterate (disk, scan_disk_partition_iter, (void *) name); - grub_disk_close (disk); - scan_depth--; -+ -+ /*process the detached_pv_list*/ -+ process_detached_pv_list(); - return 0; - } - -@@ -1285,6 +1381,20 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, - static void - free_array (void) - { -+ while(detached_pv_list) -+ { -+ struct grub_detached_pv *pv; -+ pv = detached_pv_list; -+ detached_pv_list = detached_pv_list->next; -+#ifdef GRUB_UTIL -+ grub_util_warn (_("Couldn't find disk for physical volume `%s'." -+ "Some LVs may not work normally."),pv->disk->name); -+#endif -+ if (pv->id.uuidlen) -+ grub_free(pv->id.uuid); -+ grub_disk_close(pv->disk); -+ grub_free(pv); -+ } - while (array_list) - { - struct grub_diskfilter_vg *vg; -diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c -index ea260b47e..244ec0924 100644 ---- a/grub-core/disk/lvm.c -+++ b/grub-core/disk/lvm.c -@@ -235,11 +235,16 @@ grub_lvm_detect (grub_disk_t disk, - sizeof (mdah->magic))) - || (grub_le_to_cpu32 (mdah->version) != GRUB_LVM_FMTT_VERSION)) - { -- grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -- "unknown LVM metadata header"); --#ifdef GRUB_UTIL -- grub_util_info ("unknown LVM metadata header"); --#endif -+ /* -+ * It's not necessarily an error. There is no metadata recorded when -+ * PV is created with pvmetadatacopies set to zero. We need to process -+ * this kind of PV seperately. -+ */ -+ id->uuid = grub_malloc(GRUB_LVM_ID_STRLEN); -+ if (!id->uuid) -+ goto fail; -+ grub_memcpy(id->uuid, pv_id, GRUB_LVM_ID_STRLEN); -+ id->uuidlen = GRUB_LVM_ID_STRLEN; - goto fail; - } - --- -2.41.0 - diff --git a/0026-Fix-grub2-mkconfig-warning-when-disk-is-LVM-PV.patch b/0026-Fix-grub2-mkconfig-warning-when-disk-is-LVM-PV.patch deleted file mode 100644 index b3332f9..0000000 --- a/0026-Fix-grub2-mkconfig-warning-when-disk-is-LVM-PV.patch +++ /dev/null @@ -1,49 +0,0 @@ -From a9836b9de95ae05f5d057746dea0d052d8fabaa4 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 1 Apr 2024 15:41:03 +0800 -Subject: [PATCH 026/272] Fix grub2-mkconfig warning when disk is LVM PV - -When a disk device was found in grub_util_biosdisk_get_grub_dev, its grub -hostdisk device name just returned. Since the disk could also be used as PV -disk, use grub_util_get_ldm to kick scanning of on disk metadata and adding it -to VG array. ---- - util/getroot.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/util/getroot.c b/util/getroot.c -index 75a7d5f21..e42e945ff 100644 ---- a/util/getroot.c -+++ b/util/getroot.c -@@ -272,8 +272,28 @@ grub_util_biosdisk_get_grub_dev (const char *os_dev) - grub_util_info ("%s is a parent of %s", sys_disk, os_dev); - if (!is_part) - { -+#if defined(__APPLE__) - free (sys_disk); - return make_device_name (drive); -+#else -+ char *name, *ldm_name; -+ grub_disk_t disk; -+ -+ free (sys_disk); -+ name = make_device_name (drive); -+ disk = grub_disk_open (name); -+ if (!disk) -+ return name; -+ ldm_name = grub_util_get_ldm (disk, 0); -+ if (ldm_name) -+ { -+ grub_disk_close (disk); -+ grub_free (name); -+ return ldm_name; -+ } -+ grub_disk_close (disk); -+ return name; -+#endif - } - free (sys_disk); - --- -2.41.0 - diff --git a/0185-Try-prefix-if-fw_path-doesn-t-work.patch b/0026-Try-prefix-if-fw_path-doesn-t-work.patch similarity index 88% rename from 0185-Try-prefix-if-fw_path-doesn-t-work.patch rename to 0026-Try-prefix-if-fw_path-doesn-t-work.patch index ebbaf87..effa351 100644 --- a/0185-Try-prefix-if-fw_path-doesn-t-work.patch +++ b/0026-Try-prefix-if-fw_path-doesn-t-work.patch @@ -1,44 +1,32 @@ -From 7bcaae18b152e07dd9bef023858f5ee85a75dc8c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 9 Jul 2019 10:35:16 +0200 -Subject: [PATCH 185/272] Try $prefix if $fw_path doesn't work. +Subject: [PATCH] Try $prefix if $fw_path doesn't work. Related: rhbz#1148652 Signed-off-by: Peter Jones --- - grub-core/kern/ieee1275/init.c | 28 +++---- + grub-core/kern/ieee1275/init.c | 34 ++++++----- grub-core/net/net.c | 2 +- - grub-core/normal/main.c | 132 ++++++++++++++++----------------- - 3 files changed, 81 insertions(+), 81 deletions(-) + grub-core/normal/main.c | 134 ++++++++++++++++++++--------------------- + 3 files changed, 85 insertions(+), 85 deletions(-) diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c -index 38f1f1f6e..c676da905 100644 +index 50c65b2f6e5..51c1e1c9d9f 100644 --- a/grub-core/kern/ieee1275/init.c +++ b/grub-core/kern/ieee1275/init.c -@@ -172,23 +172,25 @@ grub_machine_get_bootlocation (char **device, char **path) +@@ -170,23 +170,25 @@ grub_machine_get_bootlocation (char **device, char **path) grub_free (canon); } else - *device = grub_ieee1275_encode_devname (bootpath); -- grub_free (type); -- -- filename = grub_ieee1275_get_filename (bootpath); -- if (filename) - { -- char *lastslash = grub_strrchr (filename, '\\'); -- -- /* Truncate at last directory. */ -- if (lastslash) ++ { + filename = grub_ieee1275_get_filename (bootpath); + if (filename) - { -- *lastslash = '\0'; -- grub_translate_ieee1275_path (filename); ++ { + char *lastslash = grub_strrchr (filename, '\\'); - -- *path = filename; -- } ++ + /* Truncate at last directory. */ + if (lastslash) + { @@ -49,17 +37,32 @@ index 38f1f1f6e..c676da905 100644 + } + } + *device = grub_ieee1275_encode_devname (bootpath); - } ++ } + -+ grub_free (type); + grub_free (type); +- +- filename = grub_ieee1275_get_filename (bootpath); +- if (filename) +- { +- char *lastslash = grub_strrchr (filename, '\\'); +- +- /* Truncate at last directory. */ +- if (lastslash) +- { +- *lastslash = '\0'; +- grub_translate_ieee1275_path (filename); +- +- *path = filename; +- } +- } grub_free (bootpath); } diff --git a/grub-core/net/net.c b/grub-core/net/net.c -index 22221dc6a..58d048810 100644 +index 8cad4fb6d4d..54451cea2a7 100644 --- a/grub-core/net/net.c +++ b/grub-core/net/net.c -@@ -2008,7 +2008,7 @@ grub_net_search_config_file (char *config) +@@ -2005,7 +2005,7 @@ grub_net_search_config_file (char *config) /* Remove the remaining minus sign at the end. */ config[config_len] = '\0'; @@ -69,10 +72,10 @@ index 22221dc6a..58d048810 100644 static struct grub_preboot *fini_hnd; diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index ecc7e62e6..c351c3409 100644 +index 4c89892fa70..3463f444f74 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -329,81 +329,79 @@ grub_enter_normal_mode (const char *config) +@@ -335,81 +335,79 @@ grub_enter_normal_mode (const char *config) grub_boot_time ("Exiting normal mode"); } @@ -137,10 +140,7 @@ index ecc7e62e6..c351c3409 100644 int argc, char *argv[]) { - if (argc == 0) -+ if (argc) -+ grub_enter_normal_mode (argv[0]); -+ else - { +- { - /* Guess the config filename. It is necessary to make CONFIG static, - so that it won't get broken by longjmp. */ - char *config; @@ -204,6 +204,12 @@ index ecc7e62e6..c351c3409 100644 - { - grub_enter_normal_mode (0); - } +- } +- else ++ if (argc) + grub_enter_normal_mode (argv[0]); ++ else ++ { + /* Guess the config filename. */ + grub_err_t err; + err = grub_try_normal ("fw_path"); @@ -211,14 +217,9 @@ index ecc7e62e6..c351c3409 100644 + err = grub_try_normal ("prefix"); + if (err == GRUB_ERR_FILE_NOT_FOUND) + grub_enter_normal_mode (0); - } -- else -- grub_enter_normal_mode (argv[0]); ++ } -quit: return 0; } --- -2.41.0 - diff --git a/0186-Make-grub2-mkconfig-construct-titles-that-look-like-.patch b/0027-Make-grub2-mkconfig-construct-titles-that-look-like-.patch similarity index 82% rename from 0186-Make-grub2-mkconfig-construct-titles-that-look-like-.patch rename to 0027-Make-grub2-mkconfig-construct-titles-that-look-like-.patch index 2f067d8..1fb624e 100644 --- a/0186-Make-grub2-mkconfig-construct-titles-that-look-like-.patch +++ b/0027-Make-grub2-mkconfig-construct-titles-that-look-like-.patch @@ -1,24 +1,24 @@ -From 9d603c5429ec03c05204baa8cd1bcb0cafd990d1 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 28 Apr 2015 11:15:03 -0400 -Subject: [PATCH 186/272] Make grub2-mkconfig construct titles that look like - the ones we want elsewhere. +Subject: [PATCH] Make grub2-mkconfig construct titles that look like the ones + we want elsewhere. Resolves: rhbz#1215839 Signed-off-by: Peter Jones --- - util/grub.d/10_linux.in | 33 ++++++++++++++++++++++++++------- - 1 file changed, 26 insertions(+), 7 deletions(-) + util/grub.d/10_linux.in | 34 +++++++++++++++++++++++++++------- + 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index b88c4b7c5..2ae87c8ee 100644 +index b7809091b36..993c53ad92e 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -83,6 +83,31 @@ case x"$GRUB_FS" in - LINUX_ROOT_DEVICE="ZFS=${rpool}${bootfs%/}" +@@ -80,6 +80,32 @@ case x"$GRUB_FS" in ;; esac + +mktitle () +{ + local title_type @@ -44,10 +44,11 @@ index b88c4b7c5..2ae87c8ee 100644 + esac + echo -n ${title} +} - ++ title_correction_code= -@@ -103,17 +128,11 @@ linux_entry () + linux_entry () +@@ -93,17 +119,11 @@ linux_entry () boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" fi if [ x$type != xsimple ] ; then @@ -66,6 +67,3 @@ index b88c4b7c5..2ae87c8ee 100644 fi echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/" else --- -2.41.0 - diff --git a/0027-util-30_os-prober-multiple-initrd.patch b/0027-util-30_os-prober-multiple-initrd.patch deleted file mode 100644 index 61e4c36..0000000 --- a/0027-util-30_os-prober-multiple-initrd.patch +++ /dev/null @@ -1,26 +0,0 @@ -From f0d6d505992683ede24892b5c88a5b95a3b1d9f9 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:42:30 +0800 -Subject: [PATCH 027/272] util 30_os prober multiple initrd - -Signed-off-by: Michael Chang ---- - util/grub.d/30_os-prober.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in -index 656301eaf..222109049 100644 ---- a/util/grub.d/30_os-prober.in -+++ b/util/grub.d/30_os-prober.in -@@ -223,7 +223,7 @@ EOF - - if [ "${LROOT}" != "${LBOOT}" ]; then - LKERNEL="${LKERNEL#/boot}" -- LINITRD="${LINITRD#/boot}" -+ LINITRD="$(echo $LINITRD | sed -e 's!^/boot!!' -e 's!\(\s\)/boot!\1!g')" - fi - - onstr="$(gettext_printf "(on %s)" "${DEVICE}")" --- -2.41.0 - diff --git a/0187-Add-friendly-grub2-password-config-tool-985962.patch b/0028-Add-friendly-grub2-password-config-tool-985962.patch similarity index 87% rename from 0187-Add-friendly-grub2-password-config-tool-985962.patch rename to 0028-Add-friendly-grub2-password-config-tool-985962.patch index 08823d3..2e1ba2c 100644 --- a/0187-Add-friendly-grub2-password-config-tool-985962.patch +++ b/0028-Add-friendly-grub2-password-config-tool-985962.patch @@ -1,7 +1,7 @@ -From c154d598d8ec7627ca8d0af9e2050010e43b3313 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Robert Marshall Date: Thu, 25 Jun 2015 11:13:11 -0400 -Subject: [PATCH 187/272] Add friendly grub2 password config tool (#985962) +Subject: [PATCH] Add friendly grub2 password config tool (#985962) Provided a tool for users to reset the grub2 root user password without having to alter the grub.cfg. The hashed password now @@ -13,24 +13,38 @@ Signed-off-by: Robert Marshall [pjones: fix the efidir in grub-setpassword and rename tool] Signed-off-by: Peter Jones [luto: fix grub-setpassword -o's output path] -Andy Lutomirski +Signed-off-by: Andy Lutomirski +[rharwood: migrate man page to h2m, context] +Signed-off-by: Robbie Harwood --- - Makefile.util.def | 13 ++++ configure.ac | 1 + + Makefile.util.def | 13 +++++ docs/man/grub-set-password.h2m | 2 + util/grub-mkconfig.in | 2 + - util/grub-set-password.in | 128 +++++++++++++++++++++++++++++++++ - util/grub.d/01_users.in | 11 +++ + util/grub-set-password.in | 128 +++++++++++++++++++++++++++++++++++++++++ + util/grub.d/01_users.in | 11 ++++ 6 files changed, 157 insertions(+) create mode 100644 docs/man/grub-set-password.h2m create mode 100644 util/grub-set-password.in create mode 100644 util/grub.d/01_users.in +diff --git a/configure.ac b/configure.ac +index ae3a49321ad..493e336ec6c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -77,6 +77,7 @@ grub_TRANSFORM([grub-mkrelpath]) + grub_TRANSFORM([grub-mkrescue]) + grub_TRANSFORM([grub-probe]) + grub_TRANSFORM([grub-reboot]) ++grub_TRANSFORM([grub-set-password]) + grub_TRANSFORM([grub-script-check]) + grub_TRANSFORM([grub-set-default]) + grub_TRANSFORM([grub-sparc64-setup]) diff --git a/Makefile.util.def b/Makefile.util.def -index 4ce15119b..f3ef63933 100644 +index 09bfcadd976..95884956a68 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -478,6 +478,12 @@ script = { +@@ -455,6 +455,12 @@ script = { installdir = grubconf; }; @@ -41,9 +55,9 @@ index 4ce15119b..f3ef63933 100644 +}; + script = { - name = '05_crypttab'; - common = util/grub.d/05_crypttab.in; -@@ -775,6 +781,13 @@ script = { + name = '10_windows'; + common = util/grub.d/10_windows.in; +@@ -733,6 +739,13 @@ script = { installdir = sbin; }; @@ -57,31 +71,19 @@ index 4ce15119b..f3ef63933 100644 script = { name = grub-mkconfig_lib; common = util/grub-mkconfig_lib.in; -diff --git a/configure.ac b/configure.ac -index 4d0140714..08e7d2236 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -78,6 +78,7 @@ grub_TRANSFORM([grub-mkrescue]) - grub_TRANSFORM([grub-probe]) - grub_TRANSFORM([grub-protect]) - grub_TRANSFORM([grub-reboot]) -+grub_TRANSFORM([grub-set-password]) - grub_TRANSFORM([grub-script-check]) - grub_TRANSFORM([grub-set-default]) - grub_TRANSFORM([grub-sparc64-setup]) diff --git a/docs/man/grub-set-password.h2m b/docs/man/grub-set-password.h2m new file mode 100644 -index 000000000..10ee82f4d +index 00000000000..10ee82f4d52 --- /dev/null +++ b/docs/man/grub-set-password.h2m @@ -0,0 +1,2 @@ +[NAME] +grub-set-password \- generate the user.cfg file containing the hashed grub bootloader password diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index 01b469c1e..bc2108e6e 100644 +index 7b355115dd4..5f2824d4f58 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -326,6 +326,8 @@ for i in "${grub_mkconfig_dir}"/* ; do +@@ -280,6 +280,8 @@ for i in "${grub_mkconfig_dir}"/* ; do *~) ;; # emacsen autosave files. FIXME: support other editors */\#*\#) ;; @@ -92,13 +94,13 @@ index 01b469c1e..bc2108e6e 100644 echo diff --git a/util/grub-set-password.in b/util/grub-set-password.in new file mode 100644 -index 000000000..c0b5ebbfd +index 00000000000..5ebf50576d6 --- /dev/null +++ b/util/grub-set-password.in @@ -0,0 +1,128 @@ +#!/bin/sh -e + -+EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') ++EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/') +if [ -d /sys/firmware/efi/efivars/ ]; then + grubdir=`echo "/@bootdirname@/efi/EFI/${EFIDIR}/" | sed 's,//*,/,g'` +else @@ -226,7 +228,7 @@ index 000000000..c0b5ebbfd +fi diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in new file mode 100644 -index 000000000..db2f44bfb +index 00000000000..db2f44bfb78 --- /dev/null +++ b/util/grub.d/01_users.in @@ -0,0 +1,11 @@ @@ -241,6 +243,3 @@ index 000000000..db2f44bfb + fi +fi +EOF --- -2.41.0 - diff --git a/0028-linux-getroot-Support-NVDIMM-device-names.patch b/0028-linux-getroot-Support-NVDIMM-device-names.patch deleted file mode 100644 index 85aeb61..0000000 --- a/0028-linux-getroot-Support-NVDIMM-device-names.patch +++ /dev/null @@ -1,71 +0,0 @@ -From d57472f3302dea7441f1e063b0a3f53513b9bbc1 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 4 Oct 2018 10:32:07 +0800 -Subject: [PATCH 028/272] linux/getroot: Support NVDIMM device names - -There are two types of NVDIMM block devices in linux: fsdax and blk. -For fsdax, the device name would be /dev/pmemXpY, /dev/pmemXsY, -/dev/pmemX.YpZ, or /dev/pmemX.YsZ. -For blk, the name would be /dev/ndblkX.YpZ or /dev/ndblkX.YsZ ---- - grub-core/osdep/linux/getroot.c | 44 +++++++++++++++++++++++++++++++++ - 1 file changed, 44 insertions(+) - -diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index 0c6c12945..8b33d7f6f 100644 ---- a/grub-core/osdep/linux/getroot.c -+++ b/grub-core/osdep/linux/getroot.c -@@ -967,6 +967,50 @@ grub_util_part_to_disk (const char *os_dev, struct stat *st, - *pp = '\0'; - return path; - } -+ -+ /* If this is a NVDIMM device in fsdax mode */ -+ if (strncmp ("pmem", p, 4) == 0 && p[4] >= '0' && p[4] <= '9') -+ { -+ /* /dev/pmem[0-9]+(\.[0-9]+)?((p[0-9]+)?|s[0-9]*) */ -+ char *pp = strchr (p + 4, 'p'); -+ if (pp) -+ { -+ *is_part = 1; -+ *pp = '\0'; -+ } -+ else -+ { -+ pp = strchr (p + 4, 's'); -+ if (pp && pp[1] >= '0' && pp[1] <= '9') -+ { -+ *is_part = 1; -+ pp[1] = '\0'; -+ } -+ } -+ return path; -+ } -+ -+ /* If this is a NVDIMM device in block mode */ -+ if (strncmp ("ndblk", p, 5) == 0 && p[5] >= '0' && p[5] <= '9') -+ { -+ /* /dev/ndblk[0-9]+\.[0-9]+((p[0-9]+)?|s[0-9]*) */ -+ char *pp = strchr (p + 5, 'p'); -+ if (pp) -+ { -+ *is_part = 1; -+ *pp = '\0'; -+ } -+ else -+ { -+ pp = strchr (p + 5, 's'); -+ if (pp && pp[1] >= '0' && pp[1] <= '9') -+ { -+ *is_part = 1; -+ pp[1] = '\0'; -+ } -+ } -+ return path; -+ } - } - - return path; --- -2.41.0 - diff --git a/0029-Makefile.am-makes-sure-that-ext2-3-4-is-tried-before.patch b/0029-Makefile.am-makes-sure-that-ext2-3-4-is-tried-before.patch deleted file mode 100644 index 97779af..0000000 --- a/0029-Makefile.am-makes-sure-that-ext2-3-4-is-tried-before.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 81d190ec068dd12daf819c35709f3e056e5ffe39 Mon Sep 17 00:00:00 2001 -From: Stefan Seyfried -Date: Mon, 1 Apr 2024 15:46:45 +0800 -Subject: [PATCH 029/272] Makefile.am: makes sure that ext2/3/4 is tried before - minix - -I recently came across a strange grub2-install error when building kiwi images -in OBS. The reason is a bug in the minix file system detection. I filed -upstream bug [1]. - -Note I experienced this on SLES15-SP1. The bug is still present in current -Tumbleweed [2]. This bug thus needs fixing in all supported openSUSE releases. - -The reproducer-script is called as root like - - bash ./grub-bug-57652-reproduce-suse.sh /tmp/grub-test.img /mnt - -/tmp needs 1GB of free storage to store the image. - -Maybe this would be good enough as a minimal-intrusive fix. It does not fix the -minix detection code, but instead makes sure that ext[234] is tried before -minix. - -[1] https://savannah.gnu.org/bugs/index.php?57652 -[2] https://bugzilla.opensuse.org/attachment.cgi?id=828118 ---- - Makefile.am | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/Makefile.am b/Makefile.am -index 43635d5ff..c2fc0938a 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -51,8 +51,11 @@ libgrub.pp: config-util.h grub_script.tab.h grub_script.yy.h $(libgrubmods_a_SOU - -D'GRUB_MOD_INIT(x)=@MARKER@x@' $^ > $@ || (rm -f $@; exit 1) - CLEANFILES += libgrub.pp - -+# the grep/sed ensures that ext2 gets initialized before minix* -+# see https://savannah.gnu.org/bugs/?57652 - libgrub_a_init.lst: libgrub.pp - cat $< | grep '^@MARKER@' | sed 's/@MARKER@\(.*\)@/\1/g' | sort -u > $@ || (rm -f $@; exit 1) -+ if grep ^ext2 $@ >/dev/null; then sed '/ext2/d;/newc/iext2' < $@ > $@.tmp && mv $@.tmp $@; fi - CLEANFILES += libgrub_a_init.lst - - libgrub_a_init.c: libgrub_a_init.lst $(top_srcdir)/geninit.sh --- -2.41.0 - diff --git a/0206-tcp-add-window-scaling-support.patch b/0029-tcp-add-window-scaling-support.patch similarity index 94% rename from 0206-tcp-add-window-scaling-support.patch rename to 0029-tcp-add-window-scaling-support.patch index d95fb29..ef3a81e 100644 --- a/0206-tcp-add-window-scaling-support.patch +++ b/0029-tcp-add-window-scaling-support.patch @@ -1,7 +1,7 @@ -From 699f170eddec703a5afe7a9c5f9cdf30e20117af Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Wed, 12 Aug 2015 08:57:55 -0700 -Subject: [PATCH 206/272] tcp: add window scaling support +Subject: [PATCH] tcp: add window scaling support Sometimes we have to provision boxes across regions, such as California to Sweden. The http server has a 10 minute timeout, so if we can't get our 250mb @@ -17,7 +17,7 @@ Signed-off-by: Josef Bacik 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/grub-core/net/tcp.c b/grub-core/net/tcp.c -index 93dee0caa..902ab7e8a 100644 +index 93dee0caa1b..902ab7e8ae6 100644 --- a/grub-core/net/tcp.c +++ b/grub-core/net/tcp.c @@ -106,6 +106,18 @@ struct tcphdr @@ -85,6 +85,3 @@ index 93dee0caa..902ab7e8a 100644 tcp_socket_register (socket); --- -2.41.0 - diff --git a/0030-efinet-and-bootp-add-support-for-dhcpv6.patch b/0030-efinet-and-bootp-add-support-for-dhcpv6.patch new file mode 100644 index 0000000..19a63c5 --- /dev/null +++ b/0030-efinet-and-bootp-add-support-for-dhcpv6.patch @@ -0,0 +1,690 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 9 Jul 2019 11:47:37 +0200 +Subject: [PATCH] efinet and bootp: add support for dhcpv6 + +Signed-off-by: Peter Jones +--- + grub-core/net/bootp.c | 173 +++++++++++++++++++++++++++++++++++++ + grub-core/net/drivers/efi/efinet.c | 84 +++++++++++++----- + grub-core/net/net.c | 72 +++++++++++++++ + grub-core/net/tftp.c | 3 + + include/grub/efi/api.h | 129 +++++++++++++++++++++++++-- + include/grub/net.h | 60 +++++++++++++ + 6 files changed, 491 insertions(+), 30 deletions(-) + +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index abe45ef7bf6..02d2c2614cb 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -905,6 +905,179 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)), + + static grub_command_t cmd_getdhcp, cmd_bootp, cmd_dhcp; + ++struct grub_net_network_level_interface * ++grub_net_configure_by_dhcpv6_ack (const char *name, ++ struct grub_net_card *card, ++ grub_net_interface_flags_t flags ++ __attribute__((__unused__)), ++ const grub_net_link_level_address_t *hwaddr, ++ const struct grub_net_dhcpv6_packet *packet, ++ int is_def, char **device, char **path) ++{ ++ struct grub_net_network_level_interface *inter = NULL; ++ struct grub_net_network_level_address addr; ++ int mask = -1; ++ ++ if (!device || !path) ++ return NULL; ++ ++ *device = 0; ++ *path = 0; ++ ++ grub_dprintf ("net", "mac address is %02x:%02x:%02x:%02x:%02x:%02x\n", ++ hwaddr->mac[0], hwaddr->mac[1], hwaddr->mac[2], ++ hwaddr->mac[3], hwaddr->mac[4], hwaddr->mac[5]); ++ ++ if (is_def) ++ grub_net_default_server = 0; ++ ++ if (is_def && !grub_net_default_server && packet) ++ { ++ const grub_uint8_t *options = packet->dhcp_options; ++ unsigned int option_max = 1024 - OFFSET_OF (dhcp_options, packet); ++ unsigned int i; ++ ++ for (i = 0; i < option_max - sizeof (grub_net_dhcpv6_option_t); ) ++ { ++ grub_uint16_t num, len; ++ grub_net_dhcpv6_option_t *opt = ++ (grub_net_dhcpv6_option_t *)(options + i); ++ ++ num = grub_be_to_cpu16(opt->option_num); ++ len = grub_be_to_cpu16(opt->option_len); ++ ++ grub_dprintf ("net", "got dhcpv6 option %d len %d\n", num, len); ++ ++ if (len == 0) ++ break; ++ ++ if (len + i > 1024) ++ break; ++ ++ if (num == GRUB_NET_DHCP6_BOOTFILE_URL) ++ { ++ char *scheme, *userinfo, *host, *file; ++ char *tmp; ++ int hostlen; ++ int port; ++ int rc = extract_url_info ((const char *)opt->option_data, ++ (grub_size_t)len, ++ &scheme, &userinfo, &host, &port, ++ &file); ++ if (rc < 0) ++ continue; ++ ++ /* right now this only handles tftp. */ ++ if (grub_strcmp("tftp", scheme)) ++ { ++ grub_free (scheme); ++ grub_free (userinfo); ++ grub_free (host); ++ grub_free (file); ++ continue; ++ } ++ grub_free (userinfo); ++ ++ hostlen = grub_strlen (host); ++ if (hostlen > 2 && host[0] == '[' && host[hostlen-1] == ']') ++ { ++ tmp = host+1; ++ host[hostlen-1] = '\0'; ++ } ++ else ++ tmp = host; ++ ++ *device = grub_xasprintf ("%s,%s", scheme, tmp); ++ grub_free (scheme); ++ grub_free (host); ++ ++ if (file && *file) ++ { ++ tmp = grub_strrchr (file, '/'); ++ if (tmp) ++ *(tmp+1) = '\0'; ++ else ++ file[0] = '\0'; ++ } ++ else if (!file) ++ file = grub_strdup (""); ++ ++ if (file[0] == '/') ++ { ++ *path = grub_strdup (file+1); ++ grub_free (file); ++ } ++ else ++ *path = file; ++ } ++ else if (num == GRUB_NET_DHCP6_IA_NA) ++ { ++ const grub_net_dhcpv6_option_t *ia_na_opt; ++ const grub_net_dhcpv6_opt_ia_na_t *ia_na = ++ (const grub_net_dhcpv6_opt_ia_na_t *)opt; ++ unsigned int left = len - OFFSET_OF (options, ia_na); ++ unsigned int j; ++ ++ if ((grub_uint8_t *)ia_na + left > ++ (grub_uint8_t *)options + option_max) ++ left -= ((grub_uint8_t *)ia_na + left) ++ - ((grub_uint8_t *)options + option_max); ++ ++ if (len < OFFSET_OF (option_data, opt) ++ + sizeof (grub_net_dhcpv6_option_t)) ++ { ++ grub_dprintf ("net", ++ "found dhcpv6 ia_na option with no address\n"); ++ continue; ++ } ++ ++ for (j = 0; left > sizeof (grub_net_dhcpv6_option_t); ) ++ { ++ ia_na_opt = (const grub_net_dhcpv6_option_t *) ++ (ia_na->options + j); ++ grub_uint16_t ia_na_opt_num, ia_na_opt_len; ++ ++ ia_na_opt_num = grub_be_to_cpu16 (ia_na_opt->option_num); ++ ia_na_opt_len = grub_be_to_cpu16 (ia_na_opt->option_len); ++ if (ia_na_opt_len == 0) ++ break; ++ if (j + ia_na_opt_len > left) ++ break; ++ if (ia_na_opt_num == GRUB_NET_DHCP6_IA_ADDRESS) ++ { ++ const grub_net_dhcpv6_opt_ia_address_t *ia_addr; ++ ++ ia_addr = (const grub_net_dhcpv6_opt_ia_address_t *) ++ ia_na_opt; ++ addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; ++ grub_memcpy(addr.ipv6, ia_addr->ipv6_address, ++ sizeof (ia_addr->ipv6_address)); ++ inter = grub_net_add_addr (name, card, &addr, hwaddr, 0); ++ } ++ ++ j += ia_na_opt_len; ++ left -= ia_na_opt_len; ++ } ++ } ++ ++ i += len + 4; ++ } ++ ++ grub_print_error (); ++ } ++ ++ if (is_def) ++ { ++ grub_env_set ("net_default_interface", name); ++ grub_env_export ("net_default_interface"); ++ } ++ ++ if (inter) ++ grub_net_add_ipv6_local (inter, mask); ++ return inter; ++} ++ ++ + void + grub_bootp_init (void) + { +diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c +index 3ea25cf9894..2af8742f904 100644 +--- a/grub-core/net/drivers/efi/efinet.c ++++ b/grub-core/net/drivers/efi/efinet.c +@@ -18,11 +18,14 @@ + + #include + #include ++#include + #include + #include + #include + #include + #include ++#include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -346,7 +349,7 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + char **path) + { + struct grub_net_card *card; +- grub_efi_device_path_t *dp; ++ grub_efi_device_path_t *dp, *ldp = NULL; + struct grub_net_network_level_interface *inter; + grub_efi_device_path_t *vlan_dp; + grub_efi_uint16_t vlan_dp_len; +@@ -361,14 +364,19 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + grub_efi_device_path_t *cdp; + struct grub_efi_pxe *pxe; + struct grub_efi_pxe_mode *pxe_mode; ++ + if (card->driver != &efidriver) + continue; ++ + cdp = grub_efi_get_device_path (card->efi_handle); + if (! cdp) + continue; ++ ++ ldp = grub_efi_find_last_device_path (dp); ++ + if (grub_efi_compare_device_paths (dp, cdp) != 0) + { +- grub_efi_device_path_t *ldp, *dup_dp, *dup_ldp; ++ grub_efi_device_path_t *dup_dp, *dup_ldp; + int match; + + /* EDK2 UEFI PXE driver creates pseudo devices with type IPv4/IPv6 +@@ -377,7 +385,6 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + devices. We skip them when enumerating cards, so here we need to + find matching MAC device. + */ +- ldp = grub_efi_find_last_device_path (dp); + if (GRUB_EFI_DEVICE_PATH_TYPE (ldp) != GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE + || (GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV4_DEVICE_PATH_SUBTYPE + && GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV6_DEVICE_PATH_SUBTYPE)) +@@ -394,41 +401,70 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + if (!match) + continue; + } ++ + pxe = grub_efi_open_protocol (hnd, &pxe_io_guid, + GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); + if (! pxe) + continue; ++ + pxe_mode = pxe->mode; ++ if (pxe_mode->using_ipv6) ++ { ++ grub_net_link_level_address_t hwaddr; ++ struct grub_net_network_level_interface *intf; ++ ++ grub_dprintf ("efinet", "using ipv6 and dhcpv6\n"); ++ grub_dprintf ("efinet", "dhcp_ack_received: %s%s\n", ++ pxe_mode->dhcp_ack_received ? "yes" : "no", ++ pxe_mode->dhcp_ack_received ? "" : " cannot continue"); ++ if (!pxe_mode->dhcp_ack_received) ++ continue; + +- inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, +- (struct grub_net_bootp_packet *) +- &pxe_mode->dhcp_ack, +- sizeof (pxe_mode->dhcp_ack), +- 1, device, path); ++ hwaddr.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ grub_memcpy (hwaddr.mac, ++ card->efi_net->mode->current_address, ++ sizeof (hwaddr.mac)); + +- if (inter != NULL) ++ inter = grub_net_configure_by_dhcpv6_ack (card->name, card, 0, &hwaddr, ++ (const struct grub_net_dhcpv6_packet *)&pxe_mode->dhcp_ack.dhcpv6, ++ 1, device, path); ++ if (inter && device && path) ++ grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); ++ } ++ else + { +- /* +- * Search the device path for any VLAN subtype and use it +- * to configure the interface. +- */ +- vlan_dp = dp; ++ grub_dprintf ("efinet", "using ipv4 and dhcp\n"); ++ inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, ++ (struct grub_net_bootp_packet *) ++ &pxe_mode->dhcp_ack, ++ sizeof (pxe_mode->dhcp_ack), ++ 1, device, path); + +- while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (vlan_dp)) ++ grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); ++ if (inter != NULL) + { +- if (GRUB_EFI_DEVICE_PATH_TYPE (vlan_dp) == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE && +- GRUB_EFI_DEVICE_PATH_SUBTYPE (vlan_dp) == GRUB_EFI_VLAN_DEVICE_PATH_SUBTYPE) ++ /* ++ * Search the device path for any VLAN subtype and use it ++ * to configure the interface. ++ */ ++ vlan_dp = dp; ++ ++ while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (vlan_dp)) + { +- vlan = (grub_efi_vlan_device_path_t *) vlan_dp; +- inter->vlantag = vlan->vlan_id; +- break; ++ if (GRUB_EFI_DEVICE_PATH_TYPE (vlan_dp) == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE && ++ GRUB_EFI_DEVICE_PATH_SUBTYPE (vlan_dp) == GRUB_EFI_VLAN_DEVICE_PATH_SUBTYPE) ++ { ++ vlan = (grub_efi_vlan_device_path_t *) vlan_dp; ++ inter->vlantag = vlan->vlan_id; ++ break; ++ } ++ ++ vlan_dp_len = GRUB_EFI_DEVICE_PATH_LENGTH (vlan_dp); ++ vlan_dp = (grub_efi_device_path_t *) ((grub_efi_uint8_t *) vlan_dp + vlan_dp_len); + } +- +- vlan_dp_len = GRUB_EFI_DEVICE_PATH_LENGTH (vlan_dp); +- vlan_dp = (grub_efi_device_path_t *) ((grub_efi_uint8_t *) vlan_dp + vlan_dp_len); + } ++ return; + } +- return; + } + } + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 54451cea2a7..20c55257647 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -984,6 +984,78 @@ grub_net_network_level_interface_register (struct grub_net_network_level_interfa + grub_net_network_level_interfaces = inter; + } + ++int ++grub_ipv6_get_masksize (grub_uint16_t *be_mask) ++{ ++ grub_uint8_t *mask; ++ grub_uint16_t mask16[8]; ++ int x, y; ++ int ret = 128; ++ ++ grub_memcpy (mask16, be_mask, sizeof (mask16)); ++ for (x = 0; x < 8; x++) ++ mask16[x] = grub_be_to_cpu16 (mask16[x]); ++ ++ mask = (grub_uint8_t *)mask16; ++ ++ for (x = 15; x >= 0; x--) ++ { ++ grub_uint8_t octet = mask[x]; ++ if (!octet) ++ { ++ ret -= 8; ++ continue; ++ } ++ for (y = 0; y < 8; y++) ++ { ++ if (octet & (1 << y)) ++ break; ++ else ++ ret--; ++ } ++ break; ++ } ++ ++ return ret; ++} ++ ++grub_err_t ++grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter, ++ int mask) ++{ ++ struct grub_net_route *route; ++ ++ if (inter->address.type != GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6) ++ return 0; ++ ++ if (mask == -1) ++ mask = grub_ipv6_get_masksize ((grub_uint16_t *)inter->address.ipv6); ++ ++ if (mask == -1) ++ return 0; ++ ++ route = grub_zalloc (sizeof (*route)); ++ if (!route) ++ return grub_errno; ++ ++ route->name = grub_xasprintf ("%s:local", inter->name); ++ if (!route->name) ++ { ++ grub_free (route); ++ return grub_errno; ++ } ++ ++ route->target.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; ++ grub_memcpy (route->target.ipv6.base, inter->address.ipv6, ++ sizeof (inter->address.ipv6)); ++ route->target.ipv6.masksize = mask; ++ route->is_gateway = 0; ++ route->interface = inter; ++ ++ grub_net_route_register (route); ++ ++ return 0; ++} + + grub_err_t + grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter, +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index 409b1d09bcd..f300a9d4007 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -359,6 +359,7 @@ tftp_open (struct grub_file *file, const char *filename) + file->not_easily_seekable = 1; + file->data = data; + ++ grub_dprintf("tftp", "resolving address for %s\n", file->device->net->server); + err = grub_net_resolve_address (file->device->net->server, &addr); + if (err) + { +@@ -369,11 +370,13 @@ tftp_open (struct grub_file *file, const char *filename) + return err; + } + ++ grub_dprintf("tftp", "opening connection\n"); + data->sock = grub_net_udp_open (addr, + port ? port : TFTP_SERVER_PORT, tftp_receive, + file); + if (!data->sock) + { ++ grub_dprintf("tftp", "connection failed\n"); + grub_free (data); + return grub_errno; + } +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index d44d00ad7d5..c6d702831f7 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -637,10 +637,16 @@ typedef void *grub_efi_handle_t; + typedef void *grub_efi_event_t; + typedef grub_efi_uint64_t grub_efi_lba_t; + typedef grub_efi_uintn_t grub_efi_tpl_t; +-typedef grub_uint8_t grub_efi_mac_address_t[32]; +-typedef grub_uint8_t grub_efi_ipv4_address_t[4]; +-typedef grub_uint16_t grub_efi_ipv6_address_t[8]; +-typedef grub_uint8_t grub_efi_ip_address_t[8] __attribute__ ((aligned(4))); ++typedef grub_efi_uint8_t grub_efi_mac_address_t[32]; ++typedef grub_efi_uint8_t grub_efi_ipv4_address_t[4]; ++typedef grub_efi_uint8_t grub_efi_ipv6_address_t[16]; ++typedef union ++{ ++ grub_efi_uint32_t addr[4]; ++ grub_efi_ipv4_address_t v4; ++ grub_efi_ipv6_address_t v6; ++} grub_efi_ip_address_t __attribute__ ((aligned(4))); ++ + typedef grub_efi_uint64_t grub_efi_physical_address_t; + typedef grub_efi_uint64_t grub_efi_virtual_address_t; + +@@ -1521,16 +1527,127 @@ struct grub_efi_simple_text_output_interface + }; + typedef struct grub_efi_simple_text_output_interface grub_efi_simple_text_output_interface_t; + +-typedef grub_uint8_t grub_efi_pxe_packet_t[1472]; ++typedef struct grub_efi_pxe_dhcpv4_packet ++{ ++ grub_efi_uint8_t bootp_opcode; ++ grub_efi_uint8_t bootp_hwtype; ++ grub_efi_uint8_t bootp_hwaddr_len; ++ grub_efi_uint8_t bootp_gate_hops; ++ grub_efi_uint32_t bootp_ident; ++ grub_efi_uint16_t bootp_seconds; ++ grub_efi_uint16_t bootp_flags; ++ grub_efi_uint8_t bootp_ci_addr[4]; ++ grub_efi_uint8_t bootp_yi_addr[4]; ++ grub_efi_uint8_t bootp_si_addr[4]; ++ grub_efi_uint8_t bootp_gi_addr[4]; ++ grub_efi_uint8_t bootp_hw_addr[16]; ++ grub_efi_uint8_t bootp_srv_name[64]; ++ grub_efi_uint8_t bootp_boot_file[128]; ++ grub_efi_uint32_t dhcp_magik; ++ grub_efi_uint8_t dhcp_options[56]; ++} grub_efi_pxe_dhcpv4_packet_t; ++ ++struct grub_efi_pxe_dhcpv6_packet ++{ ++ grub_efi_uint32_t message_type:8; ++ grub_efi_uint32_t transaction_id:24; ++ grub_efi_uint8_t dhcp_options[1024]; ++} GRUB_PACKED; ++typedef struct grub_efi_pxe_dhcpv6_packet grub_efi_pxe_dhcpv6_packet_t; ++ ++typedef union ++{ ++ grub_efi_uint8_t raw[1472]; ++ grub_efi_pxe_dhcpv4_packet_t dhcpv4; ++ grub_efi_pxe_dhcpv6_packet_t dhcpv6; ++} grub_efi_pxe_packet_t; ++ ++#define GRUB_EFI_PXE_MAX_IPCNT 8 ++#define GRUB_EFI_PXE_MAX_ARP_ENTRIES 8 ++#define GRUB_EFI_PXE_MAX_ROUTE_ENTRIES 8 ++ ++typedef struct grub_efi_pxe_ip_filter ++{ ++ grub_efi_uint8_t filters; ++ grub_efi_uint8_t ip_count; ++ grub_efi_uint8_t reserved; ++ grub_efi_ip_address_t ip_list[GRUB_EFI_PXE_MAX_IPCNT]; ++} grub_efi_pxe_ip_filter_t; ++ ++typedef struct grub_efi_pxe_arp_entry ++{ ++ grub_efi_ip_address_t ip_addr; ++ grub_efi_mac_address_t mac_addr; ++} grub_efi_pxe_arp_entry_t; ++ ++typedef struct grub_efi_pxe_route_entry ++{ ++ grub_efi_ip_address_t ip_addr; ++ grub_efi_ip_address_t subnet_mask; ++ grub_efi_ip_address_t gateway_addr; ++} grub_efi_pxe_route_entry_t; ++ ++typedef struct grub_efi_pxe_icmp_error ++{ ++ grub_efi_uint8_t type; ++ grub_efi_uint8_t code; ++ grub_efi_uint16_t checksum; ++ union ++ { ++ grub_efi_uint32_t reserved; ++ grub_efi_uint32_t mtu; ++ grub_efi_uint32_t pointer; ++ struct ++ { ++ grub_efi_uint16_t identifier; ++ grub_efi_uint16_t sequence; ++ } echo; ++ } u; ++ grub_efi_uint8_t data[494]; ++} grub_efi_pxe_icmp_error_t; ++ ++typedef struct grub_efi_pxe_tftp_error ++{ ++ grub_efi_uint8_t error_code; ++ grub_efi_char8_t error_string[127]; ++} grub_efi_pxe_tftp_error_t; + + typedef struct grub_efi_pxe_mode + { +- grub_uint8_t unused[52]; ++ grub_efi_boolean_t started; ++ grub_efi_boolean_t ipv6_available; ++ grub_efi_boolean_t ipv6_supported; ++ grub_efi_boolean_t using_ipv6; ++ grub_efi_boolean_t bis_supported; ++ grub_efi_boolean_t bis_detected; ++ grub_efi_boolean_t auto_arp; ++ grub_efi_boolean_t send_guid; ++ grub_efi_boolean_t dhcp_discover_valid; ++ grub_efi_boolean_t dhcp_ack_received; ++ grub_efi_boolean_t proxy_offer_received; ++ grub_efi_boolean_t pxe_discover_valid; ++ grub_efi_boolean_t pxe_reply_received; ++ grub_efi_boolean_t pxe_bis_reply_received; ++ grub_efi_boolean_t icmp_error_received; ++ grub_efi_boolean_t tftp_error_received; ++ grub_efi_boolean_t make_callbacks; ++ grub_efi_uint8_t ttl; ++ grub_efi_uint8_t tos; ++ grub_efi_ip_address_t station_ip; ++ grub_efi_ip_address_t subnet_mask; + grub_efi_pxe_packet_t dhcp_discover; + grub_efi_pxe_packet_t dhcp_ack; + grub_efi_pxe_packet_t proxy_offer; + grub_efi_pxe_packet_t pxe_discover; + grub_efi_pxe_packet_t pxe_reply; ++ grub_efi_pxe_packet_t pxe_bis_reply; ++ grub_efi_pxe_ip_filter_t ip_filter; ++ grub_efi_uint32_t arp_cache_entries; ++ grub_efi_pxe_arp_entry_t arp_cache[GRUB_EFI_PXE_MAX_ARP_ENTRIES]; ++ grub_efi_uint32_t route_table_entries; ++ grub_efi_pxe_route_entry_t route_table[GRUB_EFI_PXE_MAX_ROUTE_ENTRIES]; ++ grub_efi_pxe_icmp_error_t icmp_error; ++ grub_efi_pxe_tftp_error_t tftp_error; + } grub_efi_pxe_mode_t; + + typedef struct grub_efi_pxe +diff --git a/include/grub/net.h b/include/grub/net.h +index 844e501c128..bf8430a6364 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -450,6 +450,51 @@ struct grub_net_bootp_packet + grub_uint8_t vendor[0]; + } GRUB_PACKED; + ++enum ++ { ++ GRUB_NET_DHCP6_IA_NA = 3, ++ GRUB_NET_DHCP6_IA_ADDRESS = 5, ++ GRUB_NET_DHCP6_BOOTFILE_URL = 59, ++ }; ++ ++struct grub_net_dhcpv6_option ++{ ++ grub_uint16_t option_num; ++ grub_uint16_t option_len; ++ grub_uint8_t option_data[]; ++} GRUB_PACKED; ++typedef struct grub_net_dhcpv6_option grub_net_dhcpv6_option_t; ++ ++struct grub_net_dhcpv6_opt_ia_na ++{ ++ grub_uint16_t option_num; ++ grub_uint16_t option_len; ++ grub_uint32_t iaid; ++ grub_uint32_t t1; ++ grub_uint32_t t2; ++ grub_uint8_t options[]; ++} GRUB_PACKED; ++typedef struct grub_net_dhcpv6_opt_ia_na grub_net_dhcpv6_opt_ia_na_t; ++ ++struct grub_net_dhcpv6_opt_ia_address ++{ ++ grub_uint16_t option_num; ++ grub_uint16_t option_len; ++ grub_uint64_t ipv6_address[2]; ++ grub_uint32_t preferred_lifetime; ++ grub_uint32_t valid_lifetime; ++ grub_uint8_t options[]; ++} GRUB_PACKED; ++typedef struct grub_net_dhcpv6_opt_ia_address grub_net_dhcpv6_opt_ia_address_t; ++ ++struct grub_net_dhcpv6_packet ++{ ++ grub_uint32_t message_type:8; ++ grub_uint32_t transaction_id:24; ++ grub_uint8_t dhcp_options[1024]; ++} GRUB_PACKED; ++typedef struct grub_net_dhcpv6_packet grub_net_dhcpv6_packet_t; ++ + #define GRUB_NET_BOOTP_RFC1048_MAGIC_0 0x63 + #define GRUB_NET_BOOTP_RFC1048_MAGIC_1 0x82 + #define GRUB_NET_BOOTP_RFC1048_MAGIC_2 0x53 +@@ -485,6 +530,21 @@ grub_net_configure_by_dhcp_ack (const char *name, + grub_size_t size, + int is_def, char **device, char **path); + ++struct grub_net_network_level_interface * ++grub_net_configure_by_dhcpv6_ack (const char *name, ++ struct grub_net_card *card, ++ grub_net_interface_flags_t flags, ++ const grub_net_link_level_address_t *hwaddr, ++ const struct grub_net_dhcpv6_packet *packet, ++ int is_def, char **device, char **path); ++ ++int ++grub_ipv6_get_masksize(grub_uint16_t *mask); ++ ++grub_err_t ++grub_net_add_ipv6_local (struct grub_net_network_level_interface *inf, ++ int mask); ++ + grub_err_t + grub_net_add_ipv4_local (struct grub_net_network_level_interface *inf, + int mask); diff --git a/0030-grub-install-force-jorunal-draining-tp-emsure-data-i.patch b/0030-grub-install-force-jorunal-draining-tp-emsure-data-i.patch deleted file mode 100644 index 94d54f5..0000000 --- a/0030-grub-install-force-jorunal-draining-tp-emsure-data-i.patch +++ /dev/null @@ -1,240 +0,0 @@ -From 3f07270d83a48862921fbf83cdb7d5535c51b3aa Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:52:52 +0800 -Subject: [PATCH 030/272] grub-install: force jorunal draining tp emsure data - integrity - -In XFS, the system would end up in unbootable state if an abrupt power -off after grub-install is occuring. It can be easily reproduced with. - - grub-install /dev/vda; reboot -f - -The grub error would show many different kinds of corruption in -filesystem and the problem boils down to incompleted journal transaction -which would leave pending writes behind in the on-disk journal. It is -therefore necessary to recover the system via re-mounting the filesystem -from linux system that all pending journal log can be replayed. - -On the other hand if journal draining can be enforced by grub-install -then it can bring more resilience to such abrupt power loss. The fsync -is not enough here for XFS, because that only writes in-memory log to -on-disk (ie makes sure broken state can be repaired). Unfortunately -there's no designated system call to serve solely for the journal -draining, so it can only be achieved via fsfreeze system call that the -journal draining can happen as a byproduct during the process. - -This patch adds fsfreeze/unfreeze at the end of grub-install to induce -journal draining on journaled file system. However btrfs is excluded -from the list as it is using fsync to drain journal and also is not -desired as reportedly having negative side effect. With this patch -applied, the boot falilure can no longer be reproduced with above -procedure. - -v2: -Fix boot failure after kdump due to the content of grub.cfg is not -completed with pending modificaton in xfs journal (bsc#1186975) - -Signed-off-by: Michael Chang ---- - Makefile.util.def | 3 ++ - grub-core/osdep/basic/journaled_fs.c | 26 +++++++++++++++ - grub-core/osdep/journaled_fs.c | 5 +++ - grub-core/osdep/linux/journaled_fs.c | 48 ++++++++++++++++++++++++++++ - include/grub/util/install.h | 2 ++ - util/grub-install.c | 19 +++++++++++ - util/grub-mkconfig.in | 10 ++++++ - 7 files changed, 113 insertions(+) - create mode 100644 grub-core/osdep/basic/journaled_fs.c - create mode 100644 grub-core/osdep/journaled_fs.c - create mode 100644 grub-core/osdep/linux/journaled_fs.c - -diff --git a/Makefile.util.def b/Makefile.util.def -index 55a9e7ce7..8a74ae0e7 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -667,6 +667,9 @@ program = { - common = util/resolve.c; - common = grub-core/kern/emu/argp_common.c; - common = grub-core/osdep/init.c; -+ common = grub-core/osdep/journaled_fs.c; -+ extra_dist = grub-core/osdep/basic/journaled_fs.c; -+ extra_dist = grub-core/osdep/linux/journaled_fs.c; - - ldadd = '$(LIBLZMA)'; - ldadd = libgrubmods.a; -diff --git a/grub-core/osdep/basic/journaled_fs.c b/grub-core/osdep/basic/journaled_fs.c -new file mode 100644 -index 000000000..9d8245704 ---- /dev/null -+++ b/grub-core/osdep/basic/journaled_fs.c -@@ -0,0 +1,26 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2010,2011,2012,2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+ -+int -+grub_install_sync_fs_journal (const char *path) -+{ -+ return 1; -+} -+ -diff --git a/grub-core/osdep/journaled_fs.c b/grub-core/osdep/journaled_fs.c -new file mode 100644 -index 000000000..fa5d0a199 ---- /dev/null -+++ b/grub-core/osdep/journaled_fs.c -@@ -0,0 +1,5 @@ -+#ifdef __linux__ -+#include "linux/journaled_fs.c" -+#else -+#include "basic/journaled_fs.c" -+#endif -diff --git a/grub-core/osdep/linux/journaled_fs.c b/grub-core/osdep/linux/journaled_fs.c -new file mode 100644 -index 000000000..0fa8360b1 ---- /dev/null -+++ b/grub-core/osdep/linux/journaled_fs.c -@@ -0,0 +1,48 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2010,2011,2012,2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+int -+grub_install_sync_fs_journal (const char *path) -+{ -+ int fd, ret; -+ -+ fd = open (path, O_RDONLY); -+ -+ if (fd == -1) -+ return 1; -+ -+ if (ioctl (fd, FIFREEZE, 0) == 0) -+ { -+ ioctl(fd, FITHAW, 0); -+ ret = 1; -+ } -+ else if (errno == EOPNOTSUPP) -+ ret = 1; -+ else -+ ret = 0; -+ -+ close (fd); -+ return ret; -+} -+ -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index 35cf17a8d..7c44e3d0d 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -297,4 +297,6 @@ grub_set_install_backup_ponr (void) - } - #endif - -+int -+grub_install_sync_fs_journal (const char *path); - #endif -diff --git a/util/grub-install.c b/util/grub-install.c -index 7dc5657bb..453e9b18f 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -42,6 +42,7 @@ - #include - #include - #include -+#include - - #include - -@@ -2033,6 +2034,24 @@ main (int argc, char *argv[]) - break; - } - -+ { -+ const char *journaled_fs[] = {"xfs", "ext2", NULL}; -+ int i; -+ -+ for (i = 0; journaled_fs[i]; ++i) -+ if (grub_strcmp (grub_fs->name, journaled_fs[i]) == 0) -+ { -+ int retries = 10; -+ -+ /* If the fs is already frozen at that point, we could generally -+ * expected that it will be soon unfrozen again (assuming some other -+ * process has frozen it for snapshotting or something), so we may -+ * as well retry a few (limited) times in a delay loop. */ -+ while (retries-- && !grub_install_sync_fs_journal (grubdir)) -+ grub_sleep (1); -+ break; -+ } -+ } - /* - * Either there are no platform specific code, or it didn't raise - * ponr. Raise it here, because usually this is already past point -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index b450aff60..22b04d2cc 100644 ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -335,6 +335,15 @@ for i in "${grub_mkconfig_dir}"/* ; do - esac - done - -+sync_fs_journal () { -+ if test "x$GRUB_DEVICE" = "x$GRUB_DEVICE_BOOT" && -+ test "x$GRUB_FS" = "xxfs" -o "x$GRUB_FS" = "xext2" && -+ test "x${grub_cfg}" != "x" -a "x`make_system_path_relative_to_its_root $grub_cfg`" = "x/boot/grub2/grub.cfg" && -+ test -x /usr/sbin/fsfreeze; then -+ /usr/sbin/fsfreeze --freeze / && /usr/sbin/fsfreeze --unfreeze / -+ fi -+} >&2 -+ - if test "x${grub_cfg}" != "x" ; then - if ! ${grub_script_check} ${grub_cfg}.new; then - # TRANSLATORS: %s is replaced by filename -@@ -351,6 +360,7 @@ and /etc/grub.d/* files or please file a bug report with - cat ${grub_cfg}.new > ${grub_cfg} - umask $oldumask - rm -f ${grub_cfg}.new -+ sync_fs_journal || true - fi - fi - --- -2.41.0 - diff --git a/0054-bootp-New-net_bootp6-command.patch b/0031-bootp-New-net_bootp6-command.patch similarity index 63% rename from 0054-bootp-New-net_bootp6-command.patch rename to 0031-bootp-New-net_bootp6-command.patch index 9387253..91e58f2 100644 --- a/0054-bootp-New-net_bootp6-command.patch +++ b/0031-bootp-New-net_bootp6-command.patch @@ -1,25 +1,25 @@ -From 99bd7c663b1b90fa1922e393afc9b5be71554bdf Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang -Date: Sun, 10 Jul 2016 23:46:06 +0800 -Subject: [PATCH 054/272] bootp: New net_bootp6 command +Date: Wed, 10 Jul 2019 15:42:36 +0200 +Subject: [PATCH] bootp: New net_bootp6 command Implement new net_bootp6 command for IPv6 network auto configuration via the DHCPv6 protocol (RFC3315). Signed-off-by: Michael Chang Signed-off-by: Ken Lin - -V1: - * Use grub_calloc for overflow check and return NULL when it would - occur. +[pjones: Put back our code to add a local route] +Signed-off-by: Peter Jones --- - grub-core/net/bootp.c | 908 +++++++++++++++++++++++++++++++++++++++++- - grub-core/net/ip.c | 39 ++ - include/grub/net.h | 72 ++++ - 3 files changed, 1018 insertions(+), 1 deletion(-) + grub-core/net/bootp.c | 1059 ++++++++++++++++++++++++++++++------ + grub-core/net/drivers/efi/efinet.c | 18 +- + grub-core/net/ip.c | 39 ++ + include/grub/efi/api.h | 2 +- + include/grub/net.h | 91 ++-- + 5 files changed, 1001 insertions(+), 208 deletions(-) diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c -index abe45ef7b..731577f84 100644 +index 02d2c2614cb..e0aec25233d 100644 --- a/grub-core/net/bootp.c +++ b/grub-core/net/bootp.c @@ -24,6 +24,98 @@ @@ -121,7 +121,7 @@ index abe45ef7b..731577f84 100644 struct grub_dhcp_discover_options { -@@ -610,6 +702,578 @@ out: +@@ -610,6 +702,584 @@ out: return err; } @@ -269,7 +269,7 @@ index abe45ef7b..731577f84 100644 + break; + } + dhcp6->num_dns_server = ln = len >> 4; -+ dhcp6->dns_server_addrs = la = grub_calloc (ln, sizeof (*la)); ++ dhcp6->dns_server_addrs = la = grub_zalloc (ln * sizeof (*la)); + + for (po = opt->data; ln > 0; po += 0x10, la++, ln--) + { @@ -372,6 +372,7 @@ index abe45ef7b..731577f84 100644 +} + +static grub_dhcp6_session_t grub_dhcp6_sessions; ++#define FOR_DHCP6_SESSIONS_SAFE(var, next) FOR_LIST_ELEMENTS_SAFE (var, next, grub_dhcp6_sessions) +#define FOR_DHCP6_SESSIONS(var) FOR_LIST_ELEMENTS (var, grub_dhcp6_sessions) + +static void @@ -463,13 +464,13 @@ index abe45ef7b..731577f84 100644 +static void +grub_dhcp6_session_remove_all (void) +{ -+ grub_dhcp6_session_t se; ++ grub_dhcp6_session_t se, next; + -+ FOR_DHCP6_SESSIONS (se) ++ FOR_DHCP6_SESSIONS_SAFE (se, next) + { + grub_dhcp6_session_remove (se); -+ se = grub_dhcp6_sessions; + } ++ grub_dhcp6_sessions = NULL; +} + +static grub_err_t @@ -663,6 +664,7 @@ index abe45ef7b..731577f84 100644 +{ + struct grub_net_network_level_interface *inf; + grub_dhcp6_options_t dhcp6; ++ int mask = -1; + + dhcp6 = grub_dhcp6_options_get (v6h, size); + if (!dhcp6) @@ -694,19 +696,23 @@ index abe45ef7b..731577f84 100644 + } + + grub_dhcp6_options_free (dhcp6); ++ ++ if (inf) ++ grub_net_add_ipv6_local (inf, mask); ++ + return inf; +} + /* * This is called directly from net/ip.c:handle_dgram(), because those * BOOTP/DHCP packets are a bit special due to their improper -@@ -678,6 +1342,77 @@ grub_net_process_dhcp (struct grub_net_buff *nb, +@@ -678,6 +1348,77 @@ grub_net_process_dhcp (struct grub_net_buff *nb, } } +grub_err_t +grub_net_process_dhcp6 (struct grub_net_buff *nb, -+ struct grub_net_card *card __attribute__ ((unused))) ++ struct grub_net_card *card __attribute__ ((unused))) +{ + const struct grub_net_dhcp6_packet *v6h; + grub_dhcp6_session_t se; @@ -729,9 +735,9 @@ index abe45ef7b..731577f84 100644 + FOR_DHCP6_SESSIONS (se) + { + if (se->transaction_id == v6h->transaction_id && -+ grub_memcmp (options->client_duid, &se->duid, sizeof (se->duid)) == 0 && -+ se->iaid == options->iaid) -+ break; ++ grub_memcmp (options->client_duid, &se->duid, sizeof (se->duid)) == 0 && ++ se->iaid == options->iaid) ++ break; + } + + if (!se) @@ -744,11 +750,11 @@ index abe45ef7b..731577f84 100644 + if (v6h->message_type == GRUB_NET_DHCP6_ADVERTISE) + { + if (se->adv) -+ { -+ grub_dprintf ("bootp", "Skipped DHCPv6 Advertised .. \n"); -+ grub_dhcp6_options_free (options); -+ return GRUB_ERR_NONE; -+ } ++ { ++ grub_dprintf ("bootp", "Skipped DHCPv6 Advertised .. \n"); ++ grub_dhcp6_options_free (options); ++ return GRUB_ERR_NONE; ++ } + + se->adv = options; + return grub_dhcp6_session_send_request (se); @@ -756,11 +762,11 @@ index abe45ef7b..731577f84 100644 + else if (v6h->message_type == GRUB_NET_DHCP6_REPLY) + { + if (!se->adv) -+ { -+ grub_dprintf ("bootp", "Skipped DHCPv6 Reply .. \n"); -+ grub_dhcp6_options_free (options); -+ return GRUB_ERR_NONE; -+ } ++ { ++ grub_dprintf ("bootp", "Skipped DHCPv6 Reply .. \n"); ++ grub_dhcp6_options_free (options); ++ return GRUB_ERR_NONE; ++ } + + se->reply = options; + grub_dhcp6_session_configure_network (se); @@ -778,183 +784,342 @@ index abe45ef7b..731577f84 100644 static grub_err_t grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), int argc, char **args) -@@ -903,7 +1638,174 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)), +@@ -903,180 +1644,174 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)), return err; } -static grub_command_t cmd_getdhcp, cmd_bootp, cmd_dhcp; +- +-struct grub_net_network_level_interface * +-grub_net_configure_by_dhcpv6_ack (const char *name, +- struct grub_net_card *card, +- grub_net_interface_flags_t flags +- __attribute__((__unused__)), +- const grub_net_link_level_address_t *hwaddr, +- const struct grub_net_dhcpv6_packet *packet, +- int is_def, char **device, char **path) +static grub_err_t +grub_cmd_bootp6 (struct grub_command *cmd __attribute__ ((unused)), -+ int argc, char **args) -+{ ++ int argc, char **args) + { +- struct grub_net_network_level_interface *inter = NULL; +- struct grub_net_network_level_address addr; +- int mask = -1; + struct grub_net_card *card; + grub_uint32_t iaid = 0; + int interval; + grub_err_t err; + grub_dhcp6_session_t se; -+ + +- if (!device || !path) +- return NULL; + err = GRUB_ERR_NONE; -+ + +- *device = 0; +- *path = 0; + FOR_NET_CARDS (card) + { + struct grub_net_network_level_interface *iface; -+ + +- grub_dprintf ("net", "mac address is %02x:%02x:%02x:%02x:%02x:%02x\n", +- hwaddr->mac[0], hwaddr->mac[1], hwaddr->mac[2], +- hwaddr->mac[3], hwaddr->mac[4], hwaddr->mac[5]); + if (argc > 0 && grub_strcmp (card->name, args[0]) != 0) + continue; -+ + +- if (is_def) +- grub_net_default_server = 0; + iface = grub_net_ipv6_get_link_local (card, &card->default_address); + if (!iface) + { -+ grub_dhcp6_session_remove_all (); -+ return grub_errno; ++ grub_dhcp6_session_remove_all (); ++ return grub_errno; + } -+ + +- if (is_def && !grub_net_default_server && packet) + grub_dhcp6_session_add (iface, iaid++); + } + + for (interval = 200; interval < 10000; interval *= 2) -+ { + { +- const grub_uint8_t *options = packet->dhcp_options; +- unsigned int option_max = 1024 - OFFSET_OF (dhcp_options, packet); +- unsigned int i; +- +- for (i = 0; i < option_max - sizeof (grub_net_dhcpv6_option_t); ) +- { +- grub_uint16_t num, len; +- grub_net_dhcpv6_option_t *opt = +- (grub_net_dhcpv6_option_t *)(options + i); +- +- num = grub_be_to_cpu16(opt->option_num); +- len = grub_be_to_cpu16(opt->option_len); +- +- grub_dprintf ("net", "got dhcpv6 option %d len %d\n", num, len); +- +- if (len == 0) +- break; +- +- if (len + i > 1024) +- break; +- +- if (num == GRUB_NET_DHCP6_BOOTFILE_URL) +- { +- char *scheme, *userinfo, *host, *file; +- char *tmp; +- int hostlen; +- int port; +- int rc = extract_url_info ((const char *)opt->option_data, +- (grub_size_t)len, +- &scheme, &userinfo, &host, &port, +- &file); +- if (rc < 0) +- continue; +- +- /* right now this only handles tftp. */ +- if (grub_strcmp("tftp", scheme)) +- { +- grub_free (scheme); +- grub_free (userinfo); +- grub_free (host); +- grub_free (file); +- continue; +- } +- grub_free (userinfo); +- +- hostlen = grub_strlen (host); +- if (hostlen > 2 && host[0] == '[' && host[hostlen-1] == ']') +- { +- tmp = host+1; +- host[hostlen-1] = '\0'; +- } +- else +- tmp = host; +- +- *device = grub_xasprintf ("%s,%s", scheme, tmp); +- grub_free (scheme); +- grub_free (host); +- +- if (file && *file) +- { +- tmp = grub_strrchr (file, '/'); +- if (tmp) +- *(tmp+1) = '\0'; +- else +- file[0] = '\0'; +- } +- else if (!file) +- file = grub_strdup (""); +- +- if (file[0] == '/') +- { +- *path = grub_strdup (file+1); +- grub_free (file); +- } +- else +- *path = file; +- } +- else if (num == GRUB_NET_DHCP6_IA_NA) +- { +- const grub_net_dhcpv6_option_t *ia_na_opt; +- const grub_net_dhcpv6_opt_ia_na_t *ia_na = +- (const grub_net_dhcpv6_opt_ia_na_t *)opt; +- unsigned int left = len - OFFSET_OF (options, ia_na); +- unsigned int j; +- +- if ((grub_uint8_t *)ia_na + left > +- (grub_uint8_t *)options + option_max) +- left -= ((grub_uint8_t *)ia_na + left) +- - ((grub_uint8_t *)options + option_max); +- +- if (len < OFFSET_OF (option_data, opt) +- + sizeof (grub_net_dhcpv6_option_t)) +- { +- grub_dprintf ("net", +- "found dhcpv6 ia_na option with no address\n"); +- continue; +- } +- +- for (j = 0; left > sizeof (grub_net_dhcpv6_option_t); ) +- { +- ia_na_opt = (const grub_net_dhcpv6_option_t *) +- (ia_na->options + j); +- grub_uint16_t ia_na_opt_num, ia_na_opt_len; +- +- ia_na_opt_num = grub_be_to_cpu16 (ia_na_opt->option_num); +- ia_na_opt_len = grub_be_to_cpu16 (ia_na_opt->option_len); +- if (ia_na_opt_len == 0) +- break; +- if (j + ia_na_opt_len > left) +- break; +- if (ia_na_opt_num == GRUB_NET_DHCP6_IA_ADDRESS) +- { +- const grub_net_dhcpv6_opt_ia_address_t *ia_addr; +- +- ia_addr = (const grub_net_dhcpv6_opt_ia_address_t *) +- ia_na_opt; +- addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; +- grub_memcpy(addr.ipv6, ia_addr->ipv6_address, +- sizeof (ia_addr->ipv6_address)); +- inter = grub_net_add_addr (name, card, &addr, hwaddr, 0); +- } +- +- j += ia_na_opt_len; +- left -= ia_na_opt_len; +- } +- } +- +- i += len + 4; +- } +- +- grub_print_error (); + int done = 1; + + FOR_DHCP6_SESSIONS (se) -+ { -+ struct grub_net_buff *nb; -+ struct grub_net_dhcp6_option *opt; -+ struct grub_net_dhcp6_packet *v6h; -+ struct grub_net_dhcp6_option_duid_ll *duid; -+ struct grub_net_dhcp6_option_iana *ia_na; -+ grub_net_network_level_address_t multicast; -+ grub_net_link_level_address_t ll_multicast; -+ struct udphdr *udph; -+ -+ multicast.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; -+ multicast.ipv6[0] = grub_cpu_to_be64_compile_time (0xff02ULL << 48); -+ multicast.ipv6[1] = grub_cpu_to_be64_compile_time (0x10002ULL); -+ -+ err = grub_net_link_layer_resolve (se->iface, -+ &multicast, &ll_multicast); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ return err; -+ } -+ -+ nb = grub_netbuff_alloc (GRUB_DHCP6_DEFAULT_NETBUFF_ALLOC_SIZE); -+ -+ if (!nb) -+ { -+ grub_dhcp6_session_remove_all (); -+ return grub_errno; -+ } -+ -+ err = grub_netbuff_reserve (nb, GRUB_DHCP6_DEFAULT_NETBUFF_ALLOC_SIZE); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ grub_netbuff_free (nb); -+ return err; -+ } -+ -+ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (grub_uint16_t)); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ grub_netbuff_free (nb); -+ return err; -+ } -+ -+ opt = (struct grub_net_dhcp6_option *)nb->data; -+ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_ELAPSED_TIME); -+ opt->len = grub_cpu_to_be16_compile_time (sizeof (grub_uint16_t)); -+ grub_set_unaligned16 (opt->data, 0); -+ -+ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (*duid)); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ grub_netbuff_free (nb); -+ return err; -+ } -+ -+ opt = (struct grub_net_dhcp6_option *)nb->data; -+ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_CLIENTID); -+ opt->len = grub_cpu_to_be16 (sizeof (*duid)); -+ -+ duid = (struct grub_net_dhcp6_option_duid_ll *) opt->data; -+ grub_memcpy (duid, &se->duid, sizeof (*duid)); -+ -+ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (*ia_na)); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ grub_netbuff_free (nb); -+ return err; -+ } -+ -+ opt = (struct grub_net_dhcp6_option *)nb->data; -+ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_IA_NA); -+ opt->len = grub_cpu_to_be16 (sizeof (*ia_na)); -+ ia_na = (struct grub_net_dhcp6_option_iana *)opt->data; -+ ia_na->iaid = grub_cpu_to_be32 (se->iaid); -+ ia_na->t1 = 0; -+ ia_na->t2 = 0; -+ -+ err = grub_netbuff_push (nb, sizeof (*v6h)); -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ grub_netbuff_free (nb); -+ return err; -+ } -+ -+ v6h = (struct grub_net_dhcp6_packet *)nb->data; -+ v6h->message_type = GRUB_NET_DHCP6_SOLICIT; -+ v6h->transaction_id = se->transaction_id; -+ -+ grub_netbuff_push (nb, sizeof (*udph)); -+ -+ udph = (struct udphdr *) nb->data; -+ udph->src = grub_cpu_to_be16_compile_time (DHCP6_CLIENT_PORT); -+ udph->dst = grub_cpu_to_be16_compile_time (DHCP6_SERVER_PORT); -+ udph->chksum = 0; -+ udph->len = grub_cpu_to_be16 (nb->tail - nb->data); -+ -+ udph->chksum = grub_net_ip_transport_checksum (nb, GRUB_NET_IP_UDP, -+ &se->iface->address, &multicast); -+ -+ err = grub_net_send_ip_packet (se->iface, &multicast, -+ &ll_multicast, nb, GRUB_NET_IP_UDP); -+ done = 0; -+ grub_netbuff_free (nb); -+ -+ if (err) -+ { -+ grub_dhcp6_session_remove_all (); -+ return err; -+ } -+ } ++ { ++ struct grub_net_buff *nb; ++ struct grub_net_dhcp6_option *opt; ++ struct grub_net_dhcp6_packet *v6h; ++ struct grub_net_dhcp6_option_duid_ll *duid; ++ struct grub_net_dhcp6_option_iana *ia_na; ++ grub_net_network_level_address_t multicast; ++ grub_net_link_level_address_t ll_multicast; ++ struct udphdr *udph; ++ ++ multicast.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; ++ multicast.ipv6[0] = grub_cpu_to_be64_compile_time (0xff02ULL << 48); ++ multicast.ipv6[1] = grub_cpu_to_be64_compile_time (0x10002ULL); ++ ++ err = grub_net_link_layer_resolve (se->iface, ++ &multicast, &ll_multicast); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ return err; ++ } ++ ++ nb = grub_netbuff_alloc (GRUB_DHCP6_DEFAULT_NETBUFF_ALLOC_SIZE); ++ ++ if (!nb) ++ { ++ grub_dhcp6_session_remove_all (); ++ return grub_errno; ++ } ++ ++ err = grub_netbuff_reserve (nb, GRUB_DHCP6_DEFAULT_NETBUFF_ALLOC_SIZE); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ grub_netbuff_free (nb); ++ return err; ++ } ++ ++ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (grub_uint16_t)); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ grub_netbuff_free (nb); ++ return err; ++ } ++ ++ opt = (struct grub_net_dhcp6_option *)nb->data; ++ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_ELAPSED_TIME); ++ opt->len = grub_cpu_to_be16_compile_time (sizeof (grub_uint16_t)); ++ grub_set_unaligned16 (opt->data, 0); ++ ++ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (*duid)); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ grub_netbuff_free (nb); ++ return err; ++ } ++ ++ opt = (struct grub_net_dhcp6_option *)nb->data; ++ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_CLIENTID); ++ opt->len = grub_cpu_to_be16 (sizeof (*duid)); ++ ++ duid = (struct grub_net_dhcp6_option_duid_ll *) opt->data; ++ grub_memcpy (duid, &se->duid, sizeof (*duid)); ++ ++ err = grub_netbuff_push (nb, sizeof (*opt) + sizeof (*ia_na)); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ grub_netbuff_free (nb); ++ return err; ++ } ++ ++ opt = (struct grub_net_dhcp6_option *)nb->data; ++ opt->code = grub_cpu_to_be16_compile_time (GRUB_NET_DHCP6_OPTION_IA_NA); ++ opt->len = grub_cpu_to_be16 (sizeof (*ia_na)); ++ ia_na = (struct grub_net_dhcp6_option_iana *)opt->data; ++ ia_na->iaid = grub_cpu_to_be32 (se->iaid); ++ ia_na->t1 = 0; ++ ia_na->t2 = 0; ++ ++ err = grub_netbuff_push (nb, sizeof (*v6h)); ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ grub_netbuff_free (nb); ++ return err; ++ } ++ ++ v6h = (struct grub_net_dhcp6_packet *)nb->data; ++ v6h->message_type = GRUB_NET_DHCP6_SOLICIT; ++ v6h->transaction_id = se->transaction_id; ++ ++ grub_netbuff_push (nb, sizeof (*udph)); ++ ++ udph = (struct udphdr *) nb->data; ++ udph->src = grub_cpu_to_be16_compile_time (DHCP6_CLIENT_PORT); ++ udph->dst = grub_cpu_to_be16_compile_time (DHCP6_SERVER_PORT); ++ udph->chksum = 0; ++ udph->len = grub_cpu_to_be16 (nb->tail - nb->data); ++ ++ udph->chksum = grub_net_ip_transport_checksum (nb, GRUB_NET_IP_UDP, ++ &se->iface->address, &multicast); ++ ++ err = grub_net_send_ip_packet (se->iface, &multicast, ++ &ll_multicast, nb, GRUB_NET_IP_UDP); ++ done = 0; ++ grub_netbuff_free (nb); ++ ++ if (err) ++ { ++ grub_dhcp6_session_remove_all (); ++ return err; ++ } ++ } + if (!done) -+ grub_net_poll_cards (interval, 0); -+ } -+ ++ grub_net_poll_cards (interval, 0); + } + +- if (is_def) + FOR_DHCP6_SESSIONS (se) -+ { + { +- grub_env_set ("net_default_interface", name); +- grub_env_export ("net_default_interface"); + grub_error_push (); + err = grub_error (GRUB_ERR_FILE_NOT_FOUND, -+ N_("couldn't autoconfigure %s"), -+ se->iface->card->name); -+ } -+ ++ N_("couldn't autoconfigure %s"), ++ se->iface->card->name); + } + +- if (inter) +- grub_net_add_ipv6_local (inter, mask); +- return inter; + grub_dhcp6_session_remove_all (); + + return err; -+} -+ + } + +static grub_command_t cmd_getdhcp, cmd_bootp, cmd_dhcp, cmd_bootp6; void grub_bootp_init (void) -@@ -917,6 +1819,9 @@ grub_bootp_init (void) +@@ -1090,11 +1825,15 @@ grub_bootp_init (void) cmd_getdhcp = grub_register_command ("net_get_dhcp_option", grub_cmd_dhcpopt, N_("VAR INTERFACE NUMBER DESCRIPTION"), N_("retrieve DHCP option and save it into VAR. If VAR is - then print the value.")); @@ -964,14 +1129,50 @@ index abe45ef7b..731577f84 100644 } void -@@ -925,4 +1830,5 @@ grub_bootp_fini (void) + grub_bootp_fini (void) + { ++ grub_unregister_command (cmd_bootp6); grub_unregister_command (cmd_getdhcp); grub_unregister_command (cmd_bootp); grub_unregister_command (cmd_dhcp); -+ grub_unregister_command (cmd_bootp6); - } +diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c +index 2af8742f904..3e2432fb61c 100644 +--- a/grub-core/net/drivers/efi/efinet.c ++++ b/grub-core/net/drivers/efi/efinet.c +@@ -410,9 +410,6 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + pxe_mode = pxe->mode; + if (pxe_mode->using_ipv6) + { +- grub_net_link_level_address_t hwaddr; +- struct grub_net_network_level_interface *intf; +- + grub_dprintf ("efinet", "using ipv6 and dhcpv6\n"); + grub_dprintf ("efinet", "dhcp_ack_received: %s%s\n", + pxe_mode->dhcp_ack_received ? "yes" : "no", +@@ -420,14 +417,13 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + if (!pxe_mode->dhcp_ack_received) + continue; + +- hwaddr.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (hwaddr.mac, +- card->efi_net->mode->current_address, +- sizeof (hwaddr.mac)); +- +- inter = grub_net_configure_by_dhcpv6_ack (card->name, card, 0, &hwaddr, +- (const struct grub_net_dhcpv6_packet *)&pxe_mode->dhcp_ack.dhcpv6, +- 1, device, path); ++ inter = grub_net_configure_by_dhcpv6_reply (card->name, card, 0, ++ (struct grub_net_dhcp6_packet *) ++ &pxe_mode->dhcp_ack, ++ sizeof (pxe_mode->dhcp_ack), ++ 1, device, path); ++ if (grub_errno) ++ grub_print_error (); + if (inter && device && path) + grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); + } diff --git a/grub-core/net/ip.c b/grub-core/net/ip.c -index 3c3d0be0e..f967618e5 100644 +index 3c3d0be0e57..f967618e53f 100644 --- a/grub-core/net/ip.c +++ b/grub-core/net/ip.c @@ -240,6 +240,45 @@ handle_dgram (struct grub_net_buff *nb, @@ -1020,21 +1221,50 @@ index 3c3d0be0e..f967618e5 100644 if (proto == GRUB_NET_IP_UDP && grub_be_to_cpu16 (udph->dst) == 68) { const struct grub_net_bootp_packet *bootp; +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index c6d702831f7..c1b869db520 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -1570,7 +1570,7 @@ typedef struct grub_efi_pxe_ip_filter + { + grub_efi_uint8_t filters; + grub_efi_uint8_t ip_count; +- grub_efi_uint8_t reserved; ++ grub_efi_uint16_t reserved; + grub_efi_ip_address_t ip_list[GRUB_EFI_PXE_MAX_IPCNT]; + } grub_efi_pxe_ip_filter_t; + diff --git a/include/grub/net.h b/include/grub/net.h -index 844e501c1..207c764f6 100644 +index bf8430a6364..ff901b96e22 100644 --- a/include/grub/net.h +++ b/include/grub/net.h -@@ -450,6 +450,66 @@ struct grub_net_bootp_packet +@@ -450,50 +450,65 @@ struct grub_net_bootp_packet grub_uint8_t vendor[0]; } GRUB_PACKED; +-enum +- { +- GRUB_NET_DHCP6_IA_NA = 3, +- GRUB_NET_DHCP6_IA_ADDRESS = 5, +- GRUB_NET_DHCP6_BOOTFILE_URL = 59, +- }; +- +-struct grub_net_dhcpv6_option +struct grub_net_dhcp6_packet -+{ + { +- grub_uint16_t option_num; +- grub_uint16_t option_len; +- grub_uint8_t option_data[]; + grub_uint32_t message_type:8; + grub_uint32_t transaction_id:24; + grub_uint8_t dhcp_options[0]; -+} GRUB_PACKED; -+ + } GRUB_PACKED; +-typedef struct grub_net_dhcpv6_option grub_net_dhcpv6_option_t; + +-struct grub_net_dhcpv6_opt_ia_na +-{ +- grub_uint16_t option_num; +- grub_uint16_t option_len; +struct grub_net_dhcp6_option { + grub_uint16_t code; + grub_uint16_t len; @@ -1042,25 +1272,39 @@ index 844e501c1..207c764f6 100644 +} GRUB_PACKED; + +struct grub_net_dhcp6_option_iana { -+ grub_uint32_t iaid; -+ grub_uint32_t t1; -+ grub_uint32_t t2; + grub_uint32_t iaid; + grub_uint32_t t1; + grub_uint32_t t2; +- grub_uint8_t options[]; + grub_uint8_t data[0]; -+} GRUB_PACKED; -+ + } GRUB_PACKED; +-typedef struct grub_net_dhcpv6_opt_ia_na grub_net_dhcpv6_opt_ia_na_t; + +-struct grub_net_dhcpv6_opt_ia_address +-{ +- grub_uint16_t option_num; +- grub_uint16_t option_len; +- grub_uint64_t ipv6_address[2]; +struct grub_net_dhcp6_option_iaaddr { + grub_uint8_t addr[16]; -+ grub_uint32_t preferred_lifetime; -+ grub_uint32_t valid_lifetime; + grub_uint32_t preferred_lifetime; + grub_uint32_t valid_lifetime; +- grub_uint8_t options[]; + grub_uint8_t data[0]; -+} GRUB_PACKED; -+ + } GRUB_PACKED; +-typedef struct grub_net_dhcpv6_opt_ia_address grub_net_dhcpv6_opt_ia_address_t; + +-struct grub_net_dhcpv6_packet +struct grub_net_dhcp6_option_duid_ll -+{ + { +- grub_uint32_t message_type:8; +- grub_uint32_t transaction_id:24; +- grub_uint8_t dhcp_options[1024]; + grub_uint16_t type; + grub_uint16_t hw_type; + grub_uint8_t hwaddr[6]; -+} GRUB_PACKED; + } GRUB_PACKED; +-typedef struct grub_net_dhcpv6_packet grub_net_dhcpv6_packet_t; + +enum + { @@ -1087,26 +1331,29 @@ index 844e501c1..207c764f6 100644 + GRUB_NET_DHCP6_OPTION_DNS_SERVERS = 23, + GRUB_NET_DHCP6_OPTION_BOOTFILE_URL = 59 + }; -+ + #define GRUB_NET_BOOTP_RFC1048_MAGIC_0 0x63 #define GRUB_NET_BOOTP_RFC1048_MAGIC_1 0x82 - #define GRUB_NET_BOOTP_RFC1048_MAGIC_2 0x53 -@@ -485,6 +545,14 @@ grub_net_configure_by_dhcp_ack (const char *name, - grub_size_t size, +@@ -531,12 +546,12 @@ grub_net_configure_by_dhcp_ack (const char *name, int is_def, char **device, char **path); -+struct grub_net_network_level_interface * + struct grub_net_network_level_interface * +-grub_net_configure_by_dhcpv6_ack (const char *name, +- struct grub_net_card *card, +- grub_net_interface_flags_t flags, +- const grub_net_link_level_address_t *hwaddr, +- const struct grub_net_dhcpv6_packet *packet, +- int is_def, char **device, char **path); +grub_net_configure_by_dhcpv6_reply (const char *name, + struct grub_net_card *card, + grub_net_interface_flags_t flags, + const struct grub_net_dhcp6_packet *v6, + grub_size_t size, + int is_def, char **device, char **path); -+ - grub_err_t - grub_net_add_ipv4_local (struct grub_net_network_level_interface *inf, - int mask); -@@ -493,6 +561,10 @@ void + + int + grub_ipv6_get_masksize(grub_uint16_t *mask); +@@ -553,6 +568,10 @@ void grub_net_process_dhcp (struct grub_net_buff *nb, struct grub_net_network_level_interface *iface); @@ -1117,6 +1364,3 @@ index 844e501c1..207c764f6 100644 int grub_net_hwaddr_cmp (const grub_net_link_level_address_t *a, const grub_net_link_level_address_t *b); --- -2.41.0 - diff --git a/0207-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch b/0032-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch similarity index 85% rename from 0207-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch rename to 0032-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch index 94fe7fc..8890e10 100644 --- a/0207-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch +++ b/0032-Add-grub-get-kernel-settings-and-use-it-in-10_linux.patch @@ -1,7 +1,7 @@ -From 30cac9485036699a97f73f588f383ec97ca04f6a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 23 Jun 2016 11:01:39 -0400 -Subject: [PATCH 207/272] Add grub-get-kernel-settings and use it in 10_linux +Subject: [PATCH] Add grub-get-kernel-settings and use it in 10_linux This patch adds grub-get-kernel-settings, which reads the system kernel installation configuration from /etc/sysconfig/kernel, and outputs @@ -12,22 +12,34 @@ debug stanzas. Resolves: rhbz#1226325 [rharwood: migrate man page to h2m] --- - Makefile.util.def | 7 ++ - configure.ac | 1 + - docs/man/grub-get-kernel-settings.h2m | 2 + - .../bash-completion.d/grub-completion.bash.in | 22 +++++ - util/grub-get-kernel-settings.in | 88 +++++++++++++++++++ - util/grub-mkconfig.in | 3 + - util/grub.d/10_linux.in | 23 +++-- + configure.ac | 1 + + Makefile.util.def | 7 ++ + docs/man/grub-get-kernel-settings.h2m | 2 + + util/bash-completion.d/grub-completion.bash.in | 22 +++++++ + util/grub-get-kernel-settings.in | 88 ++++++++++++++++++++++++++ + util/grub-mkconfig.in | 3 + + util/grub.d/10_linux.in | 23 +++++-- 7 files changed, 141 insertions(+), 5 deletions(-) create mode 100644 docs/man/grub-get-kernel-settings.h2m create mode 100644 util/grub-get-kernel-settings.in +diff --git a/configure.ac b/configure.ac +index 493e336ec6c..3602b4ab62b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -70,6 +70,7 @@ grub_TRANSFORM([grub-install]) + grub_TRANSFORM([grub-mkconfig]) + grub_TRANSFORM([grub-mkfont]) + grub_TRANSFORM([grub-mkimage]) ++grub_TRANSFORM([grub-get-kernel-settings]) + grub_TRANSFORM([grub-glue-efi]) + grub_TRANSFORM([grub-mklayout]) + grub_TRANSFORM([grub-mkpasswd-pbkdf2]) diff --git a/Makefile.util.def b/Makefile.util.def -index a3429e3a9..cb1a437e8 100644 +index 95884956a68..84a17ef5cfa 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -750,6 +750,13 @@ script = { +@@ -725,6 +725,13 @@ script = { installdir = sbin; }; @@ -41,31 +53,19 @@ index a3429e3a9..cb1a437e8 100644 script = { name = grub-set-default; common = util/grub-set-default.in; -diff --git a/configure.ac b/configure.ac -index 4388ab483..13c23052a 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -70,6 +70,7 @@ grub_TRANSFORM([grub-install]) - grub_TRANSFORM([grub-mkconfig]) - grub_TRANSFORM([grub-mkfont]) - grub_TRANSFORM([grub-mkimage]) -+grub_TRANSFORM([grub-get-kernel-settings]) - grub_TRANSFORM([grub-glue-efi]) - grub_TRANSFORM([grub-mklayout]) - grub_TRANSFORM([grub-mkpasswd-pbkdf2]) diff --git a/docs/man/grub-get-kernel-settings.h2m b/docs/man/grub-get-kernel-settings.h2m new file mode 100644 -index 000000000..b8051f01f +index 00000000000..b8051f01f3a --- /dev/null +++ b/docs/man/grub-get-kernel-settings.h2m @@ -0,0 +1,2 @@ +[NAME] +grub-get-kernel-settings \- Evaluate the system's kernel installation settings for use while making a grub configuration file diff --git a/util/bash-completion.d/grub-completion.bash.in b/util/bash-completion.d/grub-completion.bash.in -index 76834bbfb..465a19427 100644 +index 213ce1e57cf..da7fca5efac 100644 --- a/util/bash-completion.d/grub-completion.bash.in +++ b/util/bash-completion.d/grub-completion.bash.in -@@ -287,6 +287,28 @@ _have ${__grub_sparc64_setup_program} && \ +@@ -275,6 +275,28 @@ have ${__grub_sparc64_setup_program} && \ unset __grub_sparc64_setup_program @@ -96,7 +96,7 @@ index 76834bbfb..465a19427 100644 # diff --git a/util/grub-get-kernel-settings.in b/util/grub-get-kernel-settings.in new file mode 100644 -index 000000000..7e87dfccc +index 00000000000..7e87dfccc0e --- /dev/null +++ b/util/grub-get-kernel-settings.in @@ -0,0 +1,88 @@ @@ -189,7 +189,7 @@ index 000000000..7e87dfccc + echo export GRUB_UPDATE_DEFAULT_KERNEL +fi diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index 209aa1827..c3d3c399c 100644 +index 5f2824d4f58..28e92515795 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in @@ -45,6 +45,7 @@ grub_probe="${sbindir}/@grub_probe@" @@ -200,7 +200,7 @@ index 209aa1827..c3d3c399c 100644 export TEXTDOMAIN=@PACKAGE@ export TEXTDOMAINDIR="@localedir@" -@@ -195,6 +196,8 @@ if test -f ${sysconfdir}/default/grub ; then +@@ -158,6 +159,8 @@ if test -f ${sysconfdir}/default/grub ; then . ${sysconfdir}/default/grub fi @@ -210,10 +210,10 @@ index 209aa1827..c3d3c399c 100644 if [ -z "${GRUB_DISABLE_LINUX_UUID}" ]; then GRUB_DISABLE_LINUX_UUID="true" diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 150795116..eb33ff6d7 100644 +index 993c53ad92e..e8ab4082f87 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -339,7 +339,8 @@ linux_entry () +@@ -113,7 +113,8 @@ linux_entry () os="$1" version="$2" type="$3" @@ -221,9 +221,9 @@ index 150795116..eb33ff6d7 100644 + isdebug="$4" + args="$5" - if [ -n "${linux_root_device_thisversion}" ]; then - root_device="root=${linux_root_device_thisversion}" -@@ -358,6 +359,9 @@ linux_entry () + if [ -z "$boot_device_id" ]; then + boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" +@@ -125,6 +126,9 @@ linux_entry () quoted="$(echo "$GRUB_ACTUAL_DEFAULT" | grub_quote)" title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;" fi @@ -233,7 +233,7 @@ index 150795116..eb33ff6d7 100644 echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/" else echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/" -@@ -633,11 +637,15 @@ for linux in ${reverse_sorted_list}; do +@@ -320,11 +324,15 @@ for linux in ${reverse_sorted_list}; do fi if [ "x$is_top_level" = xtrue ] && [ "x${GRUB_DISABLE_SUBMENU}" != xtrue ]; then @@ -251,12 +251,12 @@ index 150795116..eb33ff6d7 100644 if [ -z "$boot_device_id" ]; then boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" fi -@@ -646,10 +654,15 @@ for linux in ${reverse_sorted_list}; do +@@ -333,10 +341,15 @@ for linux in ${reverse_sorted_list}; do is_top_level=false fi - linux_entry "${OS}" "${version}" advanced \ -+ linux_entry "${OS}" "${version}" advanced standard\ ++ linux_entry "${OS}" "${version}" advanced standard \ "${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" + if [ "x$GRUB_LINUX_MAKE_DEBUG" = "xtrue" ]; then + linux_entry "${OS}" "${version}" advanced debug \ @@ -265,10 +265,7 @@ index 150795116..eb33ff6d7 100644 + if [ "x${GRUB_DISABLE_RECOVERY}" != "xtrue" ]; then - linux_entry "${OS}" "${version}" recovery \ -+ linux_entry "${OS}" "${version}" recovery standard\ ++ linux_entry "${OS}" "${version}" recovery standard \ "${GRUB_CMDLINE_LINUX_RECOVERY} ${GRUB_CMDLINE_LINUX}" fi done --- -2.41.0 - diff --git a/0033-Make-grub_fatal-also-backtrace.patch b/0033-Make-grub_fatal-also-backtrace.patch new file mode 100644 index 0000000..1cfe763 --- /dev/null +++ b/0033-Make-grub_fatal-also-backtrace.patch @@ -0,0 +1,169 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 27 Jan 2016 09:22:42 -0500 +Subject: [PATCH] Make grub_fatal() also backtrace. + +--- + grub-core/Makefile.core.def | 3 ++ + grub-core/kern/misc.c | 6 ++++ + grub-core/lib/arm64/backtrace.c | 62 +++++++++++++++++++++++++++++++++++++++++ + grub-core/lib/backtrace.c | 2 ++ + grub-core/lib/i386/backtrace.c | 14 +++++++++- + 5 files changed, 86 insertions(+), 1 deletion(-) + create mode 100644 grub-core/lib/arm64/backtrace.c + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 47c0fc755a2..63f053b3add 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -199,6 +199,9 @@ kernel = { + + softdiv = lib/division.c; + ++ x86 = lib/i386/backtrace.c; ++ x86 = lib/backtrace.c; ++ + i386 = kern/i386/dl.c; + i386_xen = kern/i386/dl.c; + i386_xen_pvh = kern/i386/dl.c; +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 11037dc0227..465a8e74ea7 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + union printf_arg + { +@@ -1301,6 +1302,11 @@ grub_printf_fmt_check (const char *fmt, const char *fmt_expected) + void __attribute__ ((noreturn)) + grub_abort (void) + { ++#ifndef GRUB_UTIL ++#if defined(__i386__) || defined(__x86_64__) ++ grub_backtrace(); ++#endif ++#endif + grub_printf ("\nAborted."); + + #ifndef GRUB_UTIL +diff --git a/grub-core/lib/arm64/backtrace.c b/grub-core/lib/arm64/backtrace.c +new file mode 100644 +index 00000000000..1079b5380e1 +--- /dev/null ++++ b/grub-core/lib/arm64/backtrace.c +@@ -0,0 +1,62 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2009 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define MAX_STACK_FRAME 102400 ++ ++void ++grub_backtrace_pointer (int frame) ++{ ++ while (1) ++ { ++ void *lp = __builtin_return_address (frame); ++ if (!lp) ++ break; ++ ++ lp = __builtin_extract_return_addr (lp); ++ ++ grub_printf ("%p: ", lp); ++ grub_backtrace_print_address (lp); ++ grub_printf (" ("); ++ for (i = 0; i < 2; i++) ++ grub_printf ("%p,", ((void **)ptr) [i + 2]); ++ grub_printf ("%p)\n", ((void **)ptr) [i + 2]); ++ nptr = *(void **)ptr; ++ if (nptr < ptr || (void **) nptr - (void **) ptr > MAX_STACK_FRAME ++ || nptr == ptr) ++ { ++ grub_printf ("Invalid stack frame at %p (%p)\n", ptr, nptr); ++ break; ++ } ++ ptr = nptr; ++ } ++} ++ ++void ++grub_backtrace (void) ++{ ++ grub_backtrace_pointer (1); ++} ++ +diff --git a/grub-core/lib/backtrace.c b/grub-core/lib/backtrace.c +index 825a8800e25..c0ad6ab8be1 100644 +--- a/grub-core/lib/backtrace.c ++++ b/grub-core/lib/backtrace.c +@@ -29,6 +29,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + void + grub_backtrace_print_address (void *addr) + { ++#ifndef GRUB_UTIL + grub_dl_t mod; + + FOR_DL_MODULES (mod) +@@ -44,6 +45,7 @@ grub_backtrace_print_address (void *addr) + } + } + ++#endif + grub_printf ("%p", addr); + } + +diff --git a/grub-core/lib/i386/backtrace.c b/grub-core/lib/i386/backtrace.c +index c3e03c7275c..c67273db3ae 100644 +--- a/grub-core/lib/i386/backtrace.c ++++ b/grub-core/lib/i386/backtrace.c +@@ -15,11 +15,23 @@ + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + */ ++#include ++#ifdef GRUB_UTIL ++#define REALLY_GRUB_UTIL GRUB_UTIL ++#undef GRUB_UTIL ++#endif ++ ++#include ++#include ++ ++#ifdef REALLY_GRUB_UTIL ++#define GRUB_UTIL REALLY_GRUB_UTIL ++#undef REALLY_GRUB_UTIL ++#endif + + #include + #include + #include +-#include + #include + #include + #include diff --git a/0188-Make-our-info-pages-say-grub2-where-appropriate.patch b/0034-Make-our-info-pages-say-grub2-where-appropriate.patch similarity index 83% rename from 0188-Make-our-info-pages-say-grub2-where-appropriate.patch rename to 0034-Make-our-info-pages-say-grub2-where-appropriate.patch index 322962e..992bb43 100644 --- a/0188-Make-our-info-pages-say-grub2-where-appropriate.patch +++ b/0034-Make-our-info-pages-say-grub2-where-appropriate.patch @@ -1,7 +1,7 @@ -From b0946a8fc5ee3c94d17c50e01eb084be424b02a0 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 9 Jul 2019 12:59:58 +0200 -Subject: [PATCH 188/272] Make our info pages say "grub2" where appropriate. +Subject: [PATCH] Make our info pages say "grub2" where appropriate. This needs to be hooked up to --program-transform=, but I haven't had time. @@ -9,11 +9,11 @@ time. Signed-off-by: Peter Jones --- docs/grub-dev.texi | 4 +- - docs/grub.texi | 383 +++++++++++++++++++++++---------------------- - 2 files changed, 202 insertions(+), 185 deletions(-) + docs/grub.texi | 357 ++++++++++++++++++++++++++++------------------------- + 2 files changed, 189 insertions(+), 172 deletions(-) diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi -index 1276c5930..04c6678cb 100644 +index 1276c59302a..04c6678cb6b 100644 --- a/docs/grub-dev.texi +++ b/docs/grub-dev.texi @@ -1,7 +1,7 @@ @@ -35,9 +35,18 @@ index 1276c5930..04c6678cb 100644 @setchapternewpage odd diff --git a/docs/grub.texi b/docs/grub.texi -index b9ba66f3f..0addf2b90 100644 +index 974bc0ddb07..c30701b4e1f 100644 --- a/docs/grub.texi +++ b/docs/grub.texi +@@ -1,7 +1,7 @@ + \input texinfo + @c -*-texinfo-*- + @c %**start of header +-@setfilename grub.info ++@setfilename grub2.info + @include version.texi + @settitle GNU GRUB Manual @value{VERSION} + @c Unify all our little indices for now. @@ -32,15 +32,15 @@ Invariant Sections. @dircategory Kernel @@ -343,22 +352,16 @@ index b9ba66f3f..0addf2b90 100644 @item GRUB_GFXMODE Set the resolution used on the @samp{gfxterm} graphical terminal. Note that -@@ -1552,20 +1559,20 @@ boot sequence. If you have problems, set this option to @samp{text} and +@@ -1552,7 +1559,7 @@ boot sequence. If you have problems, set this option to @samp{text} and GRUB will tell Linux to boot in normal text mode. @item GRUB_DISABLE_OS_PROBER --The @command{grub-mkconfig} has a feature to use the external -+The @command{grub2-mkconfig} has a feature to use the external - @command{os-prober} program to discover other operating systems installed on - the same machine and generate appropriate menu entries for them. It is disabled - by default since automatic and silent execution of @command{os-prober}, and - creating boot entries based on that data, is a potential attack vector. Set - this option to @samp{false} to enable this feature in the --@command{grub-mkconfig} command. -+@command{grub2-mkconfig} command. - - @item GRUB_OS_PROBER_SKIP_LIST - List of space-separated FS UUIDs of filesystems to be ignored from os-prober +-Normally, @command{grub-mkconfig} will try to use the external ++Normally, @command{grub2-mkconfig} will try to use the external + @command{os-prober} program, if installed, to discover other operating + systems installed on the same system and generate appropriate menu entries + for them. Set this option to @samp{true} to disable this. +@@ -1562,7 +1569,7 @@ List of space-separated FS UUIDs of filesystems to be ignored from os-prober output. For efi chainloaders it's @@ @item GRUB_DISABLE_SUBMENU @@ -367,7 +370,7 @@ index b9ba66f3f..0addf2b90 100644 the kernel with highest version number and put all other found kernels or alternative menu entries for recovery mode in submenu. For entries returned by @command{os-prober} first entry will be put on top level and all others -@@ -1573,11 +1580,11 @@ in submenu. If this option is set to @samp{true}, flat menu with all entries +@@ -1570,11 +1577,11 @@ in submenu. If this option is set to @samp{true}, flat menu with all entries on top level will be generated instead. Changing this option will require changing existing values of @samp{GRUB_DEFAULT}, @samp{fallback} (@pxref{fallback}) and @samp{default} (@pxref{default}) environment variables as well as saved @@ -382,7 +385,7 @@ index b9ba66f3f..0addf2b90 100644 check for encrypted disks and generate additional commands needed to access them during boot. Note that in this case unattended boot is not possible because GRUB will wait for passphrase to unlock encrypted container. -@@ -1636,7 +1643,7 @@ confusing @samp{GRUB_TIMEOUT_STYLE=countdown} or +@@ -1633,7 +1640,7 @@ confusing @samp{GRUB_TIMEOUT_STYLE=countdown} or @end table @@ -391,7 +394,7 @@ index b9ba66f3f..0addf2b90 100644 edit the scripts in @file{/etc/grub.d} directly. @file{/etc/grub.d/40_custom} is particularly useful for adding entire custom menu entries; simply type the menu entries you want to add at the end of -@@ -1644,14 +1651,14 @@ that file, making sure to leave at least the first two lines intact. +@@ -1641,14 +1648,14 @@ that file, making sure to leave at least the first two lines intact. @node Root Identifcation Heuristics @section Root Identifcation Heuristics @@ -409,7 +412,7 @@ index b9ba66f3f..0addf2b90 100644 system via the UUID of its enclosing partition. If the variables are assigned any other value, that value is considered equivalent to @samp{false}. The variables are also considered to be set to @samp{false} if they are not set. -@@ -1661,18 +1668,18 @@ filesystem to the initrd. Most initrd images determine the root file system by +@@ -1658,18 +1665,18 @@ filesystem to the initrd. Most initrd images determine the root file system by checking the Linux kernel's command-line for the @samp{root} key and use its value as the identification method of the root file system. To improve the reliability of booting, most initrd images also allow the root file system to be @@ -432,7 +435,7 @@ index b9ba66f3f..0addf2b90 100644 command. @multitable {detected} {GRUB_DISABLE_LINUX_PARTUUID} {GRUB_DISABLE_LINUX_UUID} {Linux Root} -@@ -1900,7 +1907,7 @@ images as well. +@@ -1898,7 +1905,7 @@ images as well. Mount this partition on/mnt/boot and disable GRUB in all OSes and manually install self-compiled latest GRUB with: @@ -441,7 +444,7 @@ index b9ba66f3f..0addf2b90 100644 In all the OSes install GRUB tools but disable installing GRUB in bootsector, so you'll have menu.lst and grub.cfg available for use. Also disable os-prober -@@ -1910,20 +1917,20 @@ use by setting: +@@ -1908,20 +1915,20 @@ use by setting: in /etc/default/grub @@ -465,7 +468,7 @@ index b9ba66f3f..0addf2b90 100644 @} menuentry "Windows XP" @{ -@@ -1986,15 +1993,15 @@ GRUB supports embedding a configuration file directly into the core image, +@@ -1984,15 +1991,15 @@ GRUB supports embedding a configuration file directly into the core image, so that it is loaded before entering normal mode. This is useful, for example, when it is not straightforward to find the real configuration file, or when you need to debug problems with loading that file. @@ -484,7 +487,7 @@ index b9ba66f3f..0addf2b90 100644 After the embedded configuration file (if any) is executed, GRUB will load the @samp{normal} module (@pxref{normal}), which will then read the real -@@ -2029,13 +2036,13 @@ included in the core image: +@@ -2027,13 +2034,13 @@ included in the core image: @example @group search.fs_label grub root @@ -502,21 +505,7 @@ index b9ba66f3f..0addf2b90 100644 else echo "Could not find an example configuration file!" fi -@@ -2547,7 +2554,7 @@ To generate a netbootable directory, run: - - @example - @group --grub-mknetdir --net-directory=/srv/tftp --subdir=/boot/grub -d /usr/lib/grub/ -+grub2-mknetdir --net-directory=/srv/tftp --subdir=/boot/grub -d /usr/lib/grub/ - @end group - @end example - -@@ -2555,15 +2562,15 @@ E.g. for i386-pc: - - @example - @group --grub-mknetdir --net-directory=/srv/tftp --subdir=/boot/grub -d /usr/lib/grub/i386-pc -+grub2-mknetdir --net-directory=/srv/tftp --subdir=/boot/grub -d /usr/lib/grub/i386-pc +@@ -2557,7 +2564,7 @@ grub-mknetdir --net-directory=/srv/tftp --subdir=/boot/grub -d /usr/lib/grub/i38 @end group @end example @@ -525,12 +514,7 @@ index b9ba66f3f..0addf2b90 100644 server. The grub.cfg file is placed in the same directory as the path output by --grub-mknetdir hereafter referred to as FWPATH. GRUB will search for its -+grub2-mknetdir hereafter referred to as FWPATH. GRUB will search for its - configuration files in order using the following rules where the appended - value corresponds to a value on the client machine. - -@@ -2762,7 +2769,7 @@ team are: +@@ -2760,7 +2767,7 @@ team are: @end table To take full advantage of this function, install GRUB into the MBR @@ -539,7 +523,7 @@ index b9ba66f3f..0addf2b90 100644 If you have a laptop which has a similar feature and not in the above list could you figure your address and contribute? -@@ -2823,7 +2830,7 @@ bytes. +@@ -2821,7 +2828,7 @@ bytes. The sole function of @file{boot.img} is to read the first sector of the core image from a local disk and jump to it. Because of the size restriction, @file{boot.img} cannot understand any file system structure, so @@ -548,7 +532,7 @@ index b9ba66f3f..0addf2b90 100644 core image into @file{boot.img} when installing GRUB. @item diskboot.img -@@ -2853,7 +2860,7 @@ images. +@@ -2851,7 +2858,7 @@ images. @item core.img This is the core image of GRUB. It is built dynamically from the kernel @@ -557,7 +541,7 @@ index b9ba66f3f..0addf2b90 100644 program. Usually, it contains enough modules to access @file{/boot/grub}, and loads everything else (including menu handling, the ability to load target operating systems, and so on) from the file system at run-time. The -@@ -2905,7 +2912,7 @@ GRUB 2 has no single Stage 2 image. Instead, it loads modules from +@@ -2903,7 +2910,7 @@ GRUB 2 has no single Stage 2 image. Instead, it loads modules from In GRUB 2, images for booting from CD-ROM drives are now constructed using @file{cdboot.img} and @file{core.img}, making sure that the core image contains the @samp{iso9660} module. It is usually best to use the @@ -566,7 +550,7 @@ index b9ba66f3f..0addf2b90 100644 @item nbgrub There is as yet no equivalent for @file{nbgrub} in GRUB 2; it was used by -@@ -3073,8 +3080,8 @@ There are two ways to specify files, by @dfn{absolute file name} and by +@@ -3071,8 +3078,8 @@ There are two ways to specify files, by @dfn{absolute file name} and by An absolute file name resembles a Unix absolute file name, using @samp{/} for the directory separator (not @samp{\} as in DOS). One @@ -577,7 +561,7 @@ index b9ba66f3f..0addf2b90 100644 disk. If you omit the device name in an absolute file name, GRUB uses GRUB's @dfn{root device} implicitly. So if you set the root device to, say, @samp{(hd1,1)} by the command @samp{set root=(hd1,1)} (@pxref{set}), -@@ -3082,8 +3089,8 @@ then @code{/boot/kernel} is the same as @code{(hd1,1)/boot/kernel}. +@@ -3080,8 +3087,8 @@ then @code{/boot/kernel} is the same as @code{(hd1,1)/boot/kernel}. On ZFS filesystem the first path component must be @var{volume}@samp{@@}[@var{snapshot}]. @@ -588,7 +572,7 @@ index b9ba66f3f..0addf2b90 100644 @samp{snap-129}. Trailing @samp{@@} after volume name is mandatory even if snapshot name is omitted. -@@ -3511,7 +3518,7 @@ The more recent release of Minix would then be identified as +@@ -3500,7 +3507,7 @@ The more recent release of Minix would then be identified as @samp{other>minix>minix-3.4.0}. This variable is often set by @samp{GRUB_DEFAULT} (@pxref{Simple @@ -597,7 +581,7 @@ index b9ba66f3f..0addf2b90 100644 @node fallback -@@ -3601,7 +3608,7 @@ If this variable is set, it names the language code that the +@@ -3590,7 +3597,7 @@ If this variable is set, it names the language code that the example, French would be named as @samp{fr}, and Simplified Chinese as @samp{zh_CN}. @@ -606,7 +590,7 @@ index b9ba66f3f..0addf2b90 100644 reasonable default for this variable based on the system locale. -@@ -3609,10 +3616,10 @@ reasonable default for this variable based on the system locale. +@@ -3598,10 +3605,10 @@ reasonable default for this variable based on the system locale. @subsection locale_dir If this variable is set, it names the directory where translation files may @@ -619,7 +603,7 @@ index b9ba66f3f..0addf2b90 100644 default for this variable if internationalization is needed and any translation files are available. -@@ -3756,7 +3763,7 @@ input. The default is not to pause output. +@@ -3738,7 +3745,7 @@ input. The default is not to pause output. The location of the @samp{/boot/grub} directory as an absolute file name (@pxref{File name syntax}). This is normally set by GRUB at startup based @@ -628,7 +612,12 @@ index b9ba66f3f..0addf2b90 100644 dynamically loaded from this directory, so it must be set correctly in order for many parts of GRUB to work. -@@ -3872,13 +3879,13 @@ in @file{/boot/grub/grubenv} (although you should not assume this). At boot +@@ -3850,17 +3857,17 @@ GRUB provides an ``environment block'' which can be used to save a small + amount of state. + + The environment block is a preallocated 1024-byte file, which normally lives +-in @file{/boot/grub/grubenv} (although you should not assume this). At boot ++in @file{/boot/grub2/grubenv} (although you should not assume this). At boot time, the @command{load_env} command (@pxref{load_env}) loads environment variables from it, and the @command{save_env} (@pxref{save_env}) command saves environment variables to it. From a running system, the @@ -644,20 +633,7 @@ index b9ba66f3f..0addf2b90 100644 @samp{GRUB_SAVEDEFAULT} (@pxref{Simple configuration}). @node Modules -@@ -4039,9 +4046,9 @@ a list of commands that could use more documentation: - @item @command{knetbsd} - Load kernel of NetBSD. - @item @command{kopenbsd} - Load kernel of OpenBSD. - @item @command{kopenbsd_ramdisk} - Load kOpenBSD ramdisk. --@item @command{legacy_initrd_nounzip} - Simulate grub-legacy `modulenounzip' command --@item @command{legacy_initrd} - Simulate grub-legacy `initrd' command --@item @command{legacy_kernel} - Simulate grub-legacy `kernel' command -+@item @command{legacy_initrd_nounzip} - Simulate grub2-legacy `modulenounzip' command -+@item @command{legacy_initrd} - Simulate grub2-legacy `initrd' command -+@item @command{legacy_kernel} - Simulate grub2-legacy `kernel' command - @item @command{module2} - Load a multiboot 2 module. - @item @command{module} - Load a multiboot module. - @item @command{multiboot2} - Load a multiboot 2 kernel. -@@ -4963,7 +4970,7 @@ Translate @var{string} into the current language. +@@ -4922,7 +4929,7 @@ Translate @var{string} into the current language. The current language code is stored in the @samp{lang} variable in GRUB's environment (@pxref{lang}). Translation files in MO format are read from @@ -666,7 +642,7 @@ index b9ba66f3f..0addf2b90 100644 @end deffn -@@ -5334,7 +5341,7 @@ Define a user named @var{user} with password @var{clear-password}. +@@ -5274,7 +5281,7 @@ Define a user named @var{user} with password @var{clear-password}. @deffn Command password_pbkdf2 user hashed-password Define a user named @var{user} with password hash @var{hashed-password}. @@ -675,19 +651,7 @@ index b9ba66f3f..0addf2b90 100644 to generate password hashes. @xref{Security}. @end deffn -@@ -6310,9 +6317,9 @@ GRUB shell may provide more information on parameters and usage. - @item @command{inw} - Read 16-bit value from PORT. - @item @command{jpegtest} - Tests loading of JPEG bitmap. - @item @command{keymap} - Load a keyboard layout. --@item @command{legacy_check_password} - Simulate grub-legacy `password' command in menu entry mode -+@item @command{legacy_check_password} - Simulate grub2-legacy `password' command in menu entry mode - @item @command{legacy_configfile} - Parse legacy config in new context --@item @command{legacy_password} - Simulate grub-legacy `password' command -+@item @command{legacy_password} - Simulate grub2-legacy `password' command - @item @command{legacy_source} - Parse legacy config in same context - @item @command{loadbios} - Load BIOS dump. - @item @command{lsacpi} - Show ACPI information. -@@ -6513,8 +6520,8 @@ The @samp{password} (@pxref{password}) and @samp{password_pbkdf2} +@@ -6400,8 +6407,8 @@ The @samp{password} (@pxref{password}) and @samp{password_pbkdf2} which has an associated password. @samp{password} sets the password in plain text, requiring @file{grub.cfg} to be secure; @samp{password_pbkdf2} sets the password hashed using the Password-Based Key Derivation Function @@ -698,7 +662,7 @@ index b9ba66f3f..0addf2b90 100644 In order to enable authentication support, the @samp{superusers} environment variable must be set to a list of usernames, separated by any of spaces, -@@ -6559,7 +6566,7 @@ menuentry "May be run by user1 or a superuser" --users user1 @{ +@@ -6446,7 +6453,7 @@ menuentry "May be run by user1 or a superuser" --users user1 @{ @end group @end example @@ -707,7 +671,7 @@ index b9ba66f3f..0addf2b90 100644 generating configuration files with authentication. You can use @file{/etc/grub.d/40_custom} to add simple superuser authentication, by adding @kbd{set superusers=} and @kbd{password} or @kbd{password_pbkdf2} -@@ -6585,8 +6592,18 @@ validation fails, then file @file{foo} cannot be opened. This failure +@@ -6472,8 +6479,18 @@ validation fails, then file @file{foo} cannot be opened. This failure may halt or otherwise impact the boot process. An initial trusted public key can be embedded within the GRUB @file{core.img} @@ -724,11 +688,11 @@ index b9ba66f3f..0addf2b90 100644 +@comment @file{core.img} using the @code{--pubkey} option to +@comment @command{grub2-mkimage} (@pxref{Invoking grub2-install}). Presently it +@comment is necessary to write a custom wrapper around @command{grub2-mkimage} -+@comment using the @code{--grub2-mkimage} flag to @command{grub2-install}. ++@comment using the @code{--grub-mkimage} flag to @command{grub2-install}. GRUB uses GPG-style detached signatures (meaning that a file @file{foo.sig} will be produced when file @file{foo} is signed), and -@@ -6606,8 +6623,8 @@ gpg --detach-sign /path/to/file +@@ -6493,8 +6510,8 @@ gpg --detach-sign /path/to/file For successful validation of all of GRUB's subcomponents and the loaded OS kernel, they must all be signed. One way to accomplish this is the following (after having already produced the desired @@ -739,7 +703,7 @@ index b9ba66f3f..0addf2b90 100644 @example @group -@@ -6629,7 +6646,7 @@ See also: @ref{check_signatures}, @ref{verify_detached}, @ref{trust}, +@@ -6516,7 +6533,7 @@ See also: @ref{check_signatures}, @ref{verify_detached}, @ref{trust}, Note that internally signature enforcement is controlled by setting the environment variable @code{check_signatures} equal to @code{enforce}. Passing one or more @code{--pubkey} options to @@ -748,16 +712,7 @@ index b9ba66f3f..0addf2b90 100644 equal to @code{enforce} in @file{core.img} prior to processing any configuration files. -@@ -6670,7 +6687,7 @@ core grub image is recommended. - Certificates can be managed at boot time using the @pxref{trust_certificate}, - @pxref{distrust_certificate} and @pxref{list_certificates} commands. - Certificates can also be built in to the core image using the @code{--x509} --parameter to @command{grub-install} or @command{grub-mkimage}. -+parameter to @command{grub2-install} or @command{grub2-mkimage}. - - A file can be explictly verified using the @pxref{verify_appended} command. - -@@ -6753,12 +6770,12 @@ UTF-8 strings as comma-separated values (CSV). See +@@ -6564,7 +6581,7 @@ UTF-8 strings as comma-separated values (CSV). See @uref{https://github.com/rhboot/shim/blob/main/SBAT.md} for more details. To add a data section containing the SBAT information into the binary, the @@ -766,31 +721,7 @@ index b9ba66f3f..0addf2b90 100644 of a CSV file, encoded with UTF-8, is copied as is to the .sbat data section into the generated EFI binary. The CSV file can be stored anywhere on the file system. - @example --grub-mkimage -O x86_64-efi -o grubx64.efi -p '(tftp)/grub' --sbat sbat.csv efinet tftp -+grub2-mkimage -O x86_64-efi -o grubx64.efi -p '(tftp)/grub' --sbat sbat.csv efinet tftp - @end example - - @node Measured Boot -@@ -6836,7 +6853,7 @@ appended signature. - To support IEEE1275 platforms where the boot image is often loaded directly - from a disk partition rather than from a file system, the @file{core.img} - can specify the size and location of the appended signature with an ELF --note added by @command{grub-install}. -+note added by @command{grub2-install}. - - An image can be signed this way using the @command{sign-file} command from - the Linux kernel: -@@ -6853,7 +6870,7 @@ SIG_SIZE=`stat -c '%s' empty.sig` - rm empty empty.sig - - # Build a grub image with $SIG_SIZE reserved for the signature --grub-install --appended-signature-size $SIG_SIZE --modules="..." ... -+grub2-install --appended-signature-size $SIG_SIZE --modules="..." ... - - # Replace the reserved size with a signature: - # cut off the last $SIG_SIZE bytes with truncate's minus modifier -@@ -7225,10 +7242,10 @@ Required files are: +@@ -6975,10 +6992,10 @@ Required files are: GRUB's normal start-up procedure involves setting the @samp{prefix} environment variable to a value set in the core image by @@ -803,7 +734,7 @@ index b9ba66f3f..0addf2b90 100644 things GRUB is supposed to do. If, instead, you only get a rescue shell, this usually means that GRUB -@@ -7254,8 +7271,8 @@ normal +@@ -7004,8 +7021,8 @@ normal However, any problem that leaves you in the rescue shell probably means that GRUB was not correctly installed. It may be more useful to try to reinstall @@ -814,7 +745,7 @@ index b9ba66f3f..0addf2b90 100644 @itemize @bullet{} @item -@@ -7267,7 +7284,7 @@ is usually better to use UUIDs or file system labels and avoid depending on +@@ -7017,7 +7034,7 @@ is usually better to use UUIDs or file system labels and avoid depending on drive ordering entirely. @item @@ -823,16 +754,7 @@ index b9ba66f3f..0addf2b90 100644 to a partition but GRUB has already been installed in the master boot record, then the GRUB installation in the partition will be ignored. -@@ -7291,7 +7308,7 @@ support has not yet been added to GRUB. - @section Firmware stalls instead of booting GRUB - - The EFI implementation of some older MacBook laptops stalls when it gets --presented a grub-mkrescue ISO image for x86_64-efi target on an USB stick. -+presented a grub2-mkrescue ISO image for x86_64-efi target on an USB stick. - Affected are models of year 2010 or earlier. Workaround is to zeroize the - bytes 446 to 461 of the EFI partition, where mformat has put a partition table - entry which claims partition start at block 0. This change will not hamper -@@ -7302,33 +7319,33 @@ bootability on other machines. +@@ -7052,33 +7069,33 @@ bootability on other machines. @chapter User-space utilities @menu @@ -880,7 +802,7 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item --help -@@ -7344,13 +7361,13 @@ separate partition or a removable disk. +@@ -7094,13 +7111,13 @@ separate partition or a removable disk. If this option is not specified then it defaults to @file{/boot}, so @example @@ -896,7 +818,7 @@ index b9ba66f3f..0addf2b90 100644 @end example Here is an example in which you have a separate @dfn{boot} partition which is -@@ -7358,16 +7375,16 @@ mounted on +@@ -7108,16 +7125,16 @@ mounted on @file{/mnt/boot}: @example @@ -916,7 +838,7 @@ index b9ba66f3f..0addf2b90 100644 extra space in the bootloader embedding area for Reed-Solomon error-correcting codes. This enables GRUB to still boot successfully if some blocks are corrupted. The exact amount of protection offered -@@ -7380,17 +7397,17 @@ installation}) where GRUB does not reside in any unpartitioned space +@@ -7130,17 +7147,17 @@ installation}) where GRUB does not reside in any unpartitioned space outside of the MBR. Disable the Reed-Solomon codes with this option. @end table @@ -931,7 +853,7 @@ index b9ba66f3f..0addf2b90 100644 @example -grub-mkconfig -o /boot/grub/grub.cfg -+grub2-mkconfig -o /boot/grub/grub.cfg ++grub2-mkconfig -o /boot/grub2/grub.cfg @end example -@command{grub-mkconfig} accepts the following options: @@ -939,7 +861,7 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item --help -@@ -7406,17 +7423,17 @@ it to standard output. +@@ -7156,17 +7173,17 @@ it to standard output. @end table @@ -962,7 +884,7 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item -c @var{number} -@@ -7434,23 +7451,23 @@ Length of the salt. Defaults to 64. +@@ -7184,23 +7201,23 @@ Length of the salt. Defaults to 64. @end table @@ -992,7 +914,7 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item --help -@@ -7461,17 +7478,17 @@ Print the version number of GRUB and exit. +@@ -7211,17 +7228,17 @@ Print the version number of GRUB and exit. @end table @@ -1015,7 +937,7 @@ index b9ba66f3f..0addf2b90 100644 passed on directly to @command{xorriso} in @command{mkisofs} emulation mode. Options passed to @command{xorriso} will normally be interpreted as @command{mkisofs} options; if the option @samp{--} is used, then anything -@@ -7483,10 +7500,10 @@ commonly used to add extra files to the image: +@@ -7233,10 +7250,10 @@ commonly used to add extra files to the image: @example mkdir -p disk/boot/grub @r{(add extra files to @file{disk/boot/grub})} @@ -1028,13 +950,11 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item --help -@@ -7513,16 +7530,16 @@ directory as well as including them in the image. - Use @var{file} as the @command{xorriso} program, rather than the built-in +@@ -7264,15 +7281,15 @@ Use @var{file} as the @command{xorriso} program, rather than the built-in default. --@item --grub-mkimage=@var{file} + @item --grub-mkimage=@var{file} -Use @var{file} as the @command{grub-mkimage} program, rather than the -+@item --grub2-mkimage=@var{file} +Use @var{file} as the @command{grub2-mkimage} program, rather than the built-in default. @end table @@ -1050,7 +970,7 @@ index b9ba66f3f..0addf2b90 100644 system or file system image that GRUB understands, using GRUB's file system drivers via FUSE. (It is only available if FUSE development files were present when GRUB was built.) This has a number of uses: -@@ -7554,13 +7571,13 @@ even if nobody has yet written a FUSE module specifically for that file +@@ -7304,13 +7321,13 @@ even if nobody has yet written a FUSE module specifically for that file system type. @end itemize @@ -1067,7 +987,7 @@ index b9ba66f3f..0addf2b90 100644 non-option arguments (if it is given more than one image, it will treat them as a RAID set), and also accepts the following options: -@@ -7582,13 +7599,13 @@ Show debugging output for conditions matching @var{string}. +@@ -7332,13 +7349,13 @@ Show debugging output for conditions matching @var{string}. @item -K prompt|@var{file} @itemx --zfs-key=prompt|@var{file} Load a ZFS encryption key. If you use @samp{prompt} as the argument, @@ -1083,7 +1003,7 @@ index b9ba66f3f..0addf2b90 100644 root of the supplied file system. If @var{device} is just a number, then it will be treated as a partition -@@ -7597,7 +7614,7 @@ an entire disk in @file{disk.img}, then you can use this command to mount +@@ -7347,7 +7364,7 @@ an entire disk in @file{disk.img}, then you can use this command to mount its second partition: @example @@ -1092,7 +1012,7 @@ index b9ba66f3f..0addf2b90 100644 @end example @item -v -@@ -7606,18 +7623,18 @@ Print verbose messages. +@@ -7356,18 +7373,18 @@ Print verbose messages. @end table @@ -1117,7 +1037,7 @@ index b9ba66f3f..0addf2b90 100644 argument, and also accepts the following options: @table @option -@@ -7630,16 +7647,16 @@ Print the version number of GRUB and exit. +@@ -7380,16 +7397,16 @@ Print the version number of GRUB and exit. @item -d @itemx --device If this option is given, then the non-option argument is a system device @@ -1137,7 +1057,7 @@ index b9ba66f3f..0addf2b90 100644 @item -t @var{target} @itemx --target=@var{target} -@@ -7692,19 +7709,19 @@ Print verbose messages. +@@ -7442,19 +7459,19 @@ Print verbose messages. @end table @@ -1154,7 +1074,7 @@ index b9ba66f3f..0addf2b90 100644 @example -grub-script-check /boot/grub/grub.cfg -+grub2-script-check /boot/grub/grub.cfg ++grub2-script-check /boot/grub2/grub.cfg @end example -@command{grub-script-check} accepts the following options: @@ -1162,6 +1082,3 @@ index b9ba66f3f..0addf2b90 100644 @table @option @item --help --- -2.41.0 - diff --git a/0035-macos-just-build-chainloader-entries-don-t-try-any-x.patch b/0035-macos-just-build-chainloader-entries-don-t-try-any-x.patch new file mode 100644 index 0000000..3246b11 --- /dev/null +++ b/0035-macos-just-build-chainloader-entries-don-t-try-any-x.patch @@ -0,0 +1,124 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 24 May 2017 12:42:32 -0400 +Subject: [PATCH] macos: just build chainloader entries, don't try any xnu xnu. + +Since our bugs tell us that the xnu boot entries really just don't work +most of the time, and they create piles of extra boot entries, because +they can't quite figure out 32-vs-64 and other stuff like that. + +It's rediculous, and we should just boot their bootloader through the +chainloader instead. + +So this patch does that. + +Resolves: rhbz#893179 + +Signed-off-by: Peter Jones +--- + util/grub.d/30_os-prober.in | 78 +++++++++++---------------------------------- + 1 file changed, 18 insertions(+), 60 deletions(-) + +diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in +index f300e46fc6a..d7d423b2eaf 100644 +--- a/util/grub.d/30_os-prober.in ++++ b/util/grub.d/30_os-prober.in +@@ -42,68 +42,25 @@ if [ -z "${OSPROBED}" ] ; then + fi + + osx_entry() { +- if [ x$2 = x32 ]; then +- # TRANSLATORS: it refers to kernel architecture (32-bit) +- bitstr="$(gettext "(32-bit)")" +- else +- # TRANSLATORS: it refers to kernel architecture (64-bit) +- bitstr="$(gettext "(64-bit)")" +- fi + # TRANSLATORS: it refers on the OS residing on device %s + onstr="$(gettext_printf "(on %s)" "${DEVICE}")" +- cat << EOF +-menuentry '$(echo "${LONGNAME} $bitstr $onstr" | grub_quote)' --class osx --class darwin --class os \$menuentry_id_option 'osprober-xnu-$2-$(grub_get_device_id "${DEVICE}")' { ++ hints="" ++ for hint in `"${grub_probe}" --device ${device} --target=efi_hints 2> /dev/null` ; do ++ hints="${hints} --hint=${hint}" ++ done ++ cat << EOF ++menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' --class osx --class darwin --class os \$menuentry_id_option 'osprober-xnu-$2-$(grub_get_device_id "${DEVICE}")' { + EOF + save_default_entry | grub_add_tab + prepare_grub_to_access_device ${DEVICE} | grub_add_tab + cat << EOF ++ set gfxpayload=keep + load_video +- set do_resume=0 +- if [ /var/vm/sleepimage -nt10 / ]; then +- if xnu_resume /var/vm/sleepimage; then +- set do_resume=1 +- fi +- fi +- if [ \$do_resume = 0 ]; then +- xnu_uuid ${OSXUUID} uuid +- if [ -f /Extra/DSDT.aml ]; then +- acpi -e /Extra/DSDT.aml +- fi +- if [ /kernelcache -nt /System/Library/Extensions ]; then +- $1 /kernelcache boot-uuid=\${uuid} rd=*uuid +- elif [ -f /System/Library/Kernels/kernel ]; then +- $1 /System/Library/Kernels/kernel boot-uuid=\${uuid} rd=*uuid +- xnu_kextdir /System/Library/Extensions +- else +- $1 /mach_kernel boot-uuid=\${uuid} rd=*uuid +- if [ /System/Library/Extensions.mkext -nt /System/Library/Extensions ]; then +- xnu_mkext /System/Library/Extensions.mkext +- else +- xnu_kextdir /System/Library/Extensions +- fi +- fi +- if [ -f /Extra/Extensions.mkext ]; then +- xnu_mkext /Extra/Extensions.mkext +- fi +- if [ -d /Extra/Extensions ]; then +- xnu_kextdir /Extra/Extensions +- fi +- if [ -f /Extra/devprop.bin ]; then +- xnu_devprop_load /Extra/devprop.bin +- fi +- if [ -f /Extra/splash.jpg ]; then +- insmod jpeg +- xnu_splash /Extra/splash.jpg +- fi +- if [ -f /Extra/splash.png ]; then +- insmod png +- xnu_splash /Extra/splash.png +- fi +- if [ -f /Extra/splash.tga ]; then +- insmod tga +- xnu_splash /Extra/splash.tga +- fi +- fi ++ insmod part_gpt ++ insmod hfsplus ++ search --no-floppy --fs-uuid --set=root ${hints} $(grub_get_device_id "${DEVICE}") ++ chainloader (\$root)/System/Library/CoreServices/boot.efi ++ boot + } + EOF + } +@@ -296,11 +253,12 @@ EOF + echo "$title_correction_code" + ;; + macosx) +- if [ "${UUID}" ]; then +- OSXUUID="${UUID}" +- osx_entry xnu_kernel 32 +- osx_entry xnu_kernel64 64 +- fi ++ for subdevice in ${DEVICE%[[:digit:]]*}* ; do ++ parttype="`"${grub_probe}" --device ${device} --target=gpt_parttype "${subdevice}" 2> /dev/null`" ++ if [[ "$parttype" = "426f6f74-0000-11aa-aa11-00306543ecac" ]]; then ++ DEVICE="${subdevice}" osx_entry ++ fi ++ done + ;; + hurd) + onstr="$(gettext_printf "(on %s)" "${DEVICE}")" diff --git a/0031-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch b/0036-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch similarity index 86% rename from 0031-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch rename to 0036-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch index ddfb9a8..ad00442 100644 --- a/0031-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch +++ b/0036-grub2-btrfs-Add-ability-to-boot-from-subvolumes.patch @@ -1,7 +1,7 @@ -From f6a29d71cbf80dd011bd57f54e965da2a823ea76 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Jeff Mahoney -Date: Mon, 1 Apr 2024 15:59:01 +0800 -Subject: [PATCH 031/272] grub2/btrfs: Add ability to boot from subvolumes +Date: Tue, 9 Jul 2019 13:39:45 +0200 +Subject: [PATCH] grub2/btrfs: Add ability to boot from subvolumes This patch adds the ability to specify a different root on a btrfs filesystem too boot from other than the default one. @@ -18,33 +18,25 @@ It is possible to boot into a separate GRUB instance by exporting the variable and loading the config file from the subvolume. Signed-off-by: Jeff Mahoney - -V1: - * Use overflow checking primitives where the arithmetic expression for - buffer allocations may include unvalidated data - -V2: - * Fix gcc-12 error: the comparison will always evaluate as 'true' for the - address of 'label' will never be NULL [-Werror=address] --- - grub-core/fs/btrfs.c | 567 +++++++++++++++++++++++++++++++++++++++++-- + grub-core/fs/btrfs.c | 558 ++++++++++++++++++++++++++++++++++++++++++++++++--- include/grub/btrfs.h | 1 + - 2 files changed, 547 insertions(+), 21 deletions(-) + 2 files changed, 536 insertions(+), 23 deletions(-) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index ba0c58352..6d7bfbd32 100644 +index ba0c583526d..f14fe9c1bda 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c -@@ -41,6 +41,9 @@ - #include - #include - #include +@@ -38,6 +38,9 @@ + #include + #include + #include +#include +#include +#include - - GRUB_MOD_LICENSE ("GPLv3+"); - + #include + #include + #include @@ -79,9 +82,11 @@ struct grub_btrfs_superblock grub_uint64_t generation; grub_uint64_t root_tree; @@ -174,7 +166,7 @@ index ba0c58352..6d7bfbd32 100644 return data; } -@@ -1784,6 +1869,98 @@ get_root (struct grub_btrfs_data *data, struct grub_btrfs_key *key, +@@ -1784,6 +1869,91 @@ get_root (struct grub_btrfs_data *data, struct grub_btrfs_key *key, return GRUB_ERR_NONE; } @@ -218,12 +210,8 @@ index ba0c58352..6d7bfbd32 100644 + key_out.object_id != key_out.offset) { + struct grub_btrfs_inode_ref *inode_ref; + char *new; -+ grub_size_t sz; -+ -+ if (grub_add (elemsize, 1, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); + -+ inode_ref = grub_malloc(sz); ++ inode_ref = grub_malloc(elemsize + 1); + if (!inode_ref) + return grub_error(GRUB_ERR_OUT_OF_MEMORY, + "couldn't allocate memory for inode_ref (%"PRIuGRUB_SIZE")\n", elemsize); @@ -232,10 +220,7 @@ index ba0c58352..6d7bfbd32 100644 + if (err) + return grub_error(err, "read_logical caught %d\n", err); + -+ if (grub_add (grub_le_to_cpu16 (inode_ref->n), 2, &sz) || -+ grub_add (alloc, sz, &alloc)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ ++ alloc += grub_le_to_cpu16 (inode_ref->n) + 2; + new = grub_malloc(alloc); + if (!new) + return grub_error(GRUB_ERR_OUT_OF_MEMORY, @@ -273,7 +258,7 @@ index ba0c58352..6d7bfbd32 100644 static grub_err_t find_path (struct grub_btrfs_data *data, const char *path, struct grub_btrfs_key *key, -@@ -1802,14 +1979,26 @@ find_path (struct grub_btrfs_data *data, +@@ -1802,14 +1972,26 @@ find_path (struct grub_btrfs_data *data, char *origpath = NULL; unsigned symlinks_max = 32; @@ -304,7 +289,7 @@ index ba0c58352..6d7bfbd32 100644 while (1) { while (path[0] == '/') -@@ -1982,13 +2171,25 @@ find_path (struct grub_btrfs_data *data, +@@ -1982,13 +2164,25 @@ find_path (struct grub_btrfs_data *data, path = path_alloc = tmp; if (path[0] == '/') { @@ -327,54 +312,59 @@ index ba0c58352..6d7bfbd32 100644 + { + err = get_root (data, key, tree, type); + if (err) -+ { -+ grub_free (direl); -+ grub_free (path_alloc); -+ grub_free (origpath); -+ return err; -+ } ++ { ++ grub_free (direl); ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return err; ++ } } } continue; -@@ -2256,6 +2457,20 @@ grub_btrfs_read (grub_file_t file, char *buf, grub_size_t len) +@@ -2256,18 +2450,10 @@ grub_btrfs_read (grub_file_t file, char *buf, grub_size_t len) data->tree, file->offset, buf, len); } +-static grub_err_t +-grub_btrfs_uuid (grub_device_t device, char **uuid) +static char * +btrfs_unparse_uuid(struct grub_btrfs_data *data) -+{ + { +- struct grub_btrfs_data *data; +- +- *uuid = NULL; +- +- data = grub_btrfs_mount (device); +- if (!data) +- return grub_errno; +- +- *uuid = grub_xasprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x", + return grub_xasprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x", -+ grub_be_to_cpu16 (data->sblock.uuid[0]), -+ grub_be_to_cpu16 (data->sblock.uuid[1]), -+ grub_be_to_cpu16 (data->sblock.uuid[2]), -+ grub_be_to_cpu16 (data->sblock.uuid[3]), -+ grub_be_to_cpu16 (data->sblock.uuid[4]), -+ grub_be_to_cpu16 (data->sblock.uuid[5]), -+ grub_be_to_cpu16 (data->sblock.uuid[6]), -+ grub_be_to_cpu16 (data->sblock.uuid[7])); + grub_be_to_cpu16 (data->sblock.uuid[0]), + grub_be_to_cpu16 (data->sblock.uuid[1]), + grub_be_to_cpu16 (data->sblock.uuid[2]), +@@ -2276,6 +2462,20 @@ grub_btrfs_uuid (grub_device_t device, char **uuid) + grub_be_to_cpu16 (data->sblock.uuid[5]), + grub_be_to_cpu16 (data->sblock.uuid[6]), + grub_be_to_cpu16 (data->sblock.uuid[7])); +} + - static grub_err_t - grub_btrfs_uuid (grub_device_t device, char **uuid) - { -@@ -2267,15 +2482,7 @@ grub_btrfs_uuid (grub_device_t device, char **uuid) - if (!data) - return grub_errno; - -- *uuid = grub_xasprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x", -- grub_be_to_cpu16 (data->sblock.uuid[0]), -- grub_be_to_cpu16 (data->sblock.uuid[1]), -- grub_be_to_cpu16 (data->sblock.uuid[2]), -- grub_be_to_cpu16 (data->sblock.uuid[3]), -- grub_be_to_cpu16 (data->sblock.uuid[4]), -- grub_be_to_cpu16 (data->sblock.uuid[5]), -- grub_be_to_cpu16 (data->sblock.uuid[6]), -- grub_be_to_cpu16 (data->sblock.uuid[7])); ++static grub_err_t ++grub_btrfs_uuid (grub_device_t device, char **uuid) ++{ ++ struct grub_btrfs_data *data; ++ ++ *uuid = NULL; ++ ++ data = grub_btrfs_mount (device); ++ if (!data) ++ return grub_errno; ++ + *uuid = btrfs_unparse_uuid(data); grub_btrfs_unmount (data); -@@ -2396,6 +2603,248 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)), +@@ -2396,6 +2596,242 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)), } #endif @@ -407,7 +397,7 @@ index ba0c58352..6d7bfbd32 100644 + return grub_error (GRUB_ERR_BAD_ARGUMENT, "failed to open fs"); + } + -+ if (*data->sblock.label != '\0') ++ if (data->sblock.label) + grub_printf("Label: '%s' ", data->sblock.label); + else + grub_printf("Label: none "); @@ -555,15 +545,9 @@ index ba0c58352..6d7bfbd32 100644 + + if (elemsize > allocated) + { -+ grub_size_t sz; -+ + grub_free(buf); -+ -+ if (grub_mul (elemsize, 2, &allocated) || -+ grub_add (allocated, 1, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ -+ buf = grub_malloc(sz); ++ allocated = 2 * elemsize; ++ buf = grub_malloc(allocated + 1); + if (!buf) + { + r = -grub_errno; @@ -623,7 +607,7 @@ index ba0c58352..6d7bfbd32 100644 static struct grub_fs grub_btrfs_fs = { .name = "btrfs", .fs_dir = grub_btrfs_dir, -@@ -2411,12 +2860,88 @@ static struct grub_fs grub_btrfs_fs = { +@@ -2411,12 +2847,88 @@ static struct grub_fs grub_btrfs_fs = { #endif }; @@ -713,7 +697,7 @@ index ba0c58352..6d7bfbd32 100644 + +// vim: si et sw=2: diff --git a/include/grub/btrfs.h b/include/grub/btrfs.h -index 9d93fb6c1..234ad9767 100644 +index 9d93fb6c182..234ad976771 100644 --- a/include/grub/btrfs.h +++ b/include/grub/btrfs.h @@ -29,6 +29,7 @@ enum @@ -724,6 +708,3 @@ index 9d93fb6c1..234ad9767 100644 GRUB_BTRFS_ITEM_TYPE_CHUNK = 0xe4 }; --- -2.41.0 - diff --git a/0037-btrfs-fix-a-bad-null-check.patch b/0037-btrfs-fix-a-bad-null-check.patch new file mode 100644 index 0000000..093ca65 --- /dev/null +++ b/0037-btrfs-fix-a-bad-null-check.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 15:41:52 -0500 +Subject: [PATCH] btrfs: fix a bad null check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +current gcc complains: + + grub-core/fs/btrfs.c: In function ‘grub_cmd_btrfs_info’: + grub-core/fs/btrfs.c:2745:7: error: the comparison will always evaluate as ‘true’ for the address of ‘label’ will never be NULL [-Werror=address] + 2745 | if (data->sblock.label) + | ^~~~ + grub-core/fs/btrfs.c:92:8: note: ‘label’ declared here + 92 | char label[0x100]; + | ^~~~~ + cc1: all warnings being treated as errors + +Obviously this check should be on the first data byte instead of the +symbol itself. + +Signed-off-by: Peter Jones +--- + grub-core/fs/btrfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index f14fe9c1bda..8e2b1e9f7bc 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2625,7 +2625,7 @@ grub_cmd_btrfs_info (grub_command_t cmd __attribute__ ((unused)), int argc, + return grub_error (GRUB_ERR_BAD_ARGUMENT, "failed to open fs"); + } + +- if (data->sblock.label) ++ if (data->sblock.label[0]) + grub_printf("Label: '%s' ", data->sblock.label); + else + grub_printf("Label: none "); diff --git a/0038-btrfs-08-workaround-snapshot-menu-default-entry.patch b/0038-btrfs-08-workaround-snapshot-menu-default-entry.patch deleted file mode 100644 index bcf4a9c..0000000 --- a/0038-btrfs-08-workaround-snapshot-menu-default-entry.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 90dcadebc1b17ea4ad5dc90676d7f146c5c5be67 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:14:25 +0800 -Subject: [PATCH 038/272] btrfs 08 workaround snapshot menu default entry - -Signed-off-by: Michael Chang ---- - grub-core/normal/menu.c | 39 +++++++++++++++++++++++++++++++++++++++ - 1 file changed, 39 insertions(+) - -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 6a90e091f..0e8e48ccb 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -564,6 +564,43 @@ print_countdown (struct grub_term_coordinate *pos, int n) - grub_refresh (); - } - -+/* bsc#956046 - The first entry titled 'Bootable snapshot #$NUM' is inserted on -+ top at runtime to display current snapshot information. If default entry is -+ using number as key to index the entry, the result will be shifted so here we -+ add specical handling to shift it back. We apply this workaround until a better -+ solution can be found. */ -+static void -+workaround_snapshot_menu_default_entry (grub_menu_t menu, const char *name, int *default_entry) -+{ -+ grub_menu_entry_t entry; -+ if ((entry = grub_menu_get_entry (menu, 0)) && -+ ((entry->submenu && grub_strncmp (entry->title, "Bootable snapshot", sizeof("Bootable snapshot") - 1) == 0) || -+ (!entry->submenu && grub_strncmp (entry->title, "Help on bootable snapshot", sizeof("Help on bootable snapshot") - 1) == 0))) -+ { -+ const char *val; -+ -+ if (*default_entry == -1 && menu->size > 1) -+ { -+ *default_entry = 1; -+ return; -+ } -+ -+ val = grub_env_get (name); -+ -+ grub_error_push (); -+ -+ if (val) -+ grub_strtoul (val, 0, 0); -+ -+ if (*default_entry < (menu->size - 1) && grub_errno == GRUB_ERR_NONE) -+ ++(*default_entry); -+ -+ grub_error_pop (); -+ } -+ -+ return; -+} -+ - #define GRUB_MENU_PAGE_SIZE 10 - - /* Show the menu and handle menu entry selection. Returns the menu entry -@@ -584,6 +621,8 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) - - default_entry = get_entry_number (menu, "default"); - -+ workaround_snapshot_menu_default_entry (menu, "default", &default_entry); -+ - /* If DEFAULT_ENTRY is not within the menu entries, fall back to - the first entry. */ - if (default_entry < 0 || default_entry >= menu->size) --- -2.41.0 - diff --git a/0032-export-btrfs_subvol-and-btrfs_subvolid.patch b/0038-export-btrfs_subvol-and-btrfs_subvolid.patch similarity index 72% rename from 0032-export-btrfs_subvol-and-btrfs_subvolid.patch rename to 0038-export-btrfs_subvol-and-btrfs_subvolid.patch index ab7b5b2..d35f598 100644 --- a/0032-export-btrfs_subvol-and-btrfs_subvolid.patch +++ b/0038-export-btrfs_subvol-and-btrfs_subvolid.patch @@ -1,7 +1,7 @@ -From 69419d69e771eb132212913f809c335780ff4c04 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang -Date: Mon, 1 Apr 2024 15:59:20 +0800 -Subject: [PATCH 032/272] export btrfs_subvol and btrfs_subvolid +Date: Wed, 18 Dec 2013 09:57:04 +0000 +Subject: [PATCH] export btrfs_subvol and btrfs_subvolid We should export btrfs_subvol and btrfs_subvolid to have both visible to subsidiary configuration files loaded using configfile. @@ -12,10 +12,10 @@ Signed-off-by: Michael Chang 1 file changed, 2 insertions(+) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 6d7bfbd32..27960d7de 100644 +index 8e2b1e9f7bc..14e38a4df02 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c -@@ -2933,6 +2933,8 @@ GRUB_MOD_INIT (btrfs) +@@ -2920,6 +2920,8 @@ GRUB_MOD_INIT (btrfs) subvol_set_env); grub_register_variable_hook ("btrfs_subvolid", subvolid_get_env, subvolid_set_env); @@ -24,6 +24,3 @@ index 6d7bfbd32..27960d7de 100644 } GRUB_MOD_FINI (btrfs) --- -2.41.0 - diff --git a/0033-btrfs-03-follow-default.patch b/0039-grub2-btrfs-03-follow_default.patch similarity index 86% rename from 0033-btrfs-03-follow-default.patch rename to 0039-grub2-btrfs-03-follow_default.patch index f55adbe..bbe2fbc 100644 --- a/0033-btrfs-03-follow-default.patch +++ b/0039-grub2-btrfs-03-follow_default.patch @@ -1,15 +1,16 @@ -From b9f59bc94df8ba78f3b9bc406254725fa1cce335 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 15:59:49 +0800 -Subject: [PATCH 033/272] btrfs 03 follow default +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Thu, 21 Aug 2014 03:39:11 +0000 +Subject: [PATCH] grub2-btrfs-03-follow_default Signed-off-by: Michael Chang +Signed-off-by: Robbie Harwood --- - grub-core/fs/btrfs.c | 107 ++++++++++++++++++++++++++++++------------- + grub-core/fs/btrfs.c | 107 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 76 insertions(+), 31 deletions(-) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 27960d7de..c711554a7 100644 +index 14e38a4df02..d47f9ab0352 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c @@ -1335,6 +1335,7 @@ grub_btrfs_mount (grub_device_t dev) @@ -39,7 +40,7 @@ index 27960d7de..c711554a7 100644 } return data; -@@ -1973,24 +1977,39 @@ find_path (struct grub_btrfs_data *data, +@@ -1966,24 +1970,39 @@ find_path (struct grub_btrfs_data *data, grub_size_t allocated = 0; struct grub_btrfs_dir_item *direl = NULL; struct grub_btrfs_key key_out; @@ -86,7 +87,7 @@ index 27960d7de..c711554a7 100644 } else { -@@ -2001,15 +2020,23 @@ find_path (struct grub_btrfs_data *data, +@@ -1994,15 +2013,23 @@ find_path (struct grub_btrfs_data *data, while (1) { @@ -119,7 +120,7 @@ index 27960d7de..c711554a7 100644 if (*type != GRUB_BTRFS_DIR_ITEM_TYPE_DIRECTORY) { -@@ -2020,7 +2047,9 @@ find_path (struct grub_btrfs_data *data, +@@ -2013,7 +2040,9 @@ find_path (struct grub_btrfs_data *data, if (ctokenlen == 1 && ctoken[0] == '.') { @@ -130,7 +131,7 @@ index 27960d7de..c711554a7 100644 continue; } if (ctokenlen == 2 && ctoken[0] == '.' && ctoken[1] == '.') -@@ -2051,8 +2080,9 @@ find_path (struct grub_btrfs_data *data, +@@ -2044,8 +2073,9 @@ find_path (struct grub_btrfs_data *data, *type = GRUB_BTRFS_DIR_ITEM_TYPE_DIRECTORY; key->object_id = key_out.offset; @@ -142,7 +143,7 @@ index 27960d7de..c711554a7 100644 continue; } -@@ -2121,7 +2151,9 @@ find_path (struct grub_btrfs_data *data, +@@ -2114,7 +2144,9 @@ find_path (struct grub_btrfs_data *data, return err; } @@ -153,7 +154,7 @@ index 27960d7de..c711554a7 100644 if (cdirel->type == GRUB_BTRFS_DIR_ITEM_TYPE_SYMLINK) { struct grub_btrfs_inode inode; -@@ -2171,14 +2203,26 @@ find_path (struct grub_btrfs_data *data, +@@ -2164,14 +2196,26 @@ find_path (struct grub_btrfs_data *data, path = path_alloc = tmp; if (path[0] == '/') { @@ -187,7 +188,7 @@ index 27960d7de..c711554a7 100644 } else { -@@ -2935,6 +2979,7 @@ GRUB_MOD_INIT (btrfs) +@@ -2922,6 +2966,7 @@ GRUB_MOD_INIT (btrfs) subvolid_set_env); grub_env_export ("btrfs_subvol"); grub_env_export ("btrfs_subvolid"); @@ -195,6 +196,3 @@ index 27960d7de..c711554a7 100644 } GRUB_MOD_FINI (btrfs) --- -2.41.0 - diff --git a/0040-btrfs-10-config-directory.patch b/0040-btrfs-10-config-directory.patch deleted file mode 100644 index 46d0877..0000000 --- a/0040-btrfs-10-config-directory.patch +++ /dev/null @@ -1,268 +0,0 @@ -From 49c7aacd08df9dc75c8376e78abd2b7d431e31bb Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:16:51 +0800 -Subject: [PATCH 040/272] btrfs 10 config directory - -v1: -References: bsc#1063443 - -v2: -References: bsc#1106381 -Fix outputting invalid btrfs subvol path on non btrfs filesystem due to bogus -return code handling. - -Signed-off-by: Michael Chang ---- - grub-core/fs/btrfs.c | 182 +++++++++++++++++++++++++++++++++++++------ - 1 file changed, 159 insertions(+), 23 deletions(-) - -diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index d4f7b022b..886f80645 100644 ---- a/grub-core/fs/btrfs.c -+++ b/grub-core/fs/btrfs.c -@@ -3262,8 +3262,7 @@ grub_btrfs_get_default_subvolume_id (struct grub_btrfs_data *data, grub_uint64_t - } - - static grub_err_t --grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, -- int argc, char **argv) -+grub_btrfs_get_default_subvol (const char *name, grub_uint64_t *ret_subvolid, char **ret_subvol) - { - char *devname; - grub_device_t dev; -@@ -3272,21 +3271,8 @@ grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, - grub_uint64_t id; - char *subvol = NULL; - grub_uint64_t subvolid = 0; -- char *varname = NULL; -- char *output = NULL; -- int path_only = ctxt->state[1].set; -- int num_only = ctxt->state[2].set; -- -- if (ctxt->state[0].set) -- varname = ctxt->state[0].arg; -- -- if (argc < 1) -- return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required"); -- -- devname = grub_file_get_device_name(argv[0]); -- if (!devname) -- return grub_errno; - -+ devname = grub_file_get_device_name(name); - dev = grub_device_open (devname); - grub_free (devname); - if (!dev) -@@ -3297,8 +3283,7 @@ grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, - { - grub_device_close (dev); - grub_dprintf ("btrfs", "failed to open fs\n"); -- grub_errno = GRUB_ERR_NONE; -- return 0; -+ return grub_errno; - } - - err = grub_btrfs_get_default_subvolume_id (data, &subvolid); -@@ -3327,12 +3312,47 @@ grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, - return err; - } - -- if (subvol) -- grub_free (subvol); -+ grub_free (subvol); - subvol = path_out; - id = parent_id; - } - -+ if (ret_subvolid) -+ *ret_subvolid = subvolid; -+ if (ret_subvol) -+ *ret_subvol = subvol; -+ -+ grub_btrfs_unmount (data); -+ grub_device_close (dev); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, -+ int argc, char **argv) -+{ -+ grub_err_t err; -+ char *subvol = NULL; -+ grub_uint64_t subvolid = 0; -+ char *varname = NULL; -+ char *output = NULL; -+ int path_only = ctxt->state[1].set; -+ int num_only = ctxt->state[2].set; -+ -+ if (ctxt->state[0].set) -+ varname = ctxt->state[0].arg; -+ -+ if (argc < 1) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required"); -+ -+ if ((err = grub_btrfs_get_default_subvol (argv[0], &subvolid, &subvol)) != GRUB_ERR_NONE) -+ { -+ if (err == GRUB_ERR_BAD_FS) -+ err = grub_errno = GRUB_ERR_NONE; -+ return err; -+ } -+ - if (num_only && path_only) - output = grub_xasprintf ("%"PRIuGRUB_UINT64_T" /%s", subvolid, subvol); - else if (num_only) -@@ -3348,9 +3368,6 @@ grub_cmd_btrfs_get_default_subvol (struct grub_extcmd_context *ctxt, - grub_free (output); - grub_free (subvol); - -- grub_btrfs_unmount (data); -- grub_device_close (dev); -- - return GRUB_ERR_NONE; - } - -@@ -3429,6 +3446,122 @@ subvol_get_env (struct grub_env_var *var __attribute__ ((unused)), - return ""; - } - -+ -+static char * -+grub_btrfs_path_to_abs (const char *path) -+{ -+ grub_err_t err; -+ char *device_name = NULL; -+ char *subvol = NULL; -+ const char *file_name; -+ char *ret; -+ -+ if (!path) -+ return NULL; -+ -+ if ((err = grub_btrfs_get_default_subvol (path, 0, &subvol)) != GRUB_ERR_NONE) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ return NULL; -+ } -+ -+ if (!subvol || *subvol == '\0') -+ return NULL; -+ -+ file_name = (path[0] == '(') ? grub_strchr (path, ')') : NULL; -+ if (file_name) -+ file_name++; -+ else -+ file_name = path; -+ device_name = grub_file_get_device_name (path); -+ if (device_name) -+ ret = grub_xasprintf ("(%s)/%s%s", device_name, subvol, file_name); -+ else -+ ret = grub_xasprintf ("/%s%s", subvol, file_name); -+ -+ grub_free (device_name); -+ grub_free (subvol); -+ -+ return ret; -+} -+ -+static char * -+grub_btrfs_path_to_rel (const char *path) -+{ -+ grub_err_t err; -+ char *subvol = NULL; -+ const char *file_name; -+ -+ if (!path) -+ return NULL; -+ -+ if ((err = grub_btrfs_get_default_subvol (path, 0, &subvol)) != GRUB_ERR_NONE) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ return NULL; -+ } -+ -+ if (!subvol || *subvol == '\0') -+ return NULL; -+ -+ file_name = (path[0] == '(') ? grub_strchr (path, ')') : NULL; -+ if (file_name) -+ file_name++; -+ else -+ file_name = path; -+ -+ if (*file_name == '/') -+ file_name++; -+ -+ if (grub_strncmp (file_name, subvol, grub_strlen (subvol)) == 0) -+ { -+ char *device_name; -+ char *ret; -+ -+ device_name = grub_file_get_device_name (path); -+ file_name += grub_strlen (subvol); -+ if (device_name) -+ ret = grub_xasprintf ("(%s)%s", device_name, file_name); -+ else -+ ret = grub_strdup (file_name); -+ grub_free (device_name); -+ grub_free (subvol); -+ return ret; -+ } -+ -+ grub_free (subvol); -+ return NULL; -+} -+ -+static char * -+relpath_set_env (struct grub_env_var *var, -+ const char *val) -+{ -+ int new_val, old_val; -+ new_val = (val[0] == '1' || val[0] == 'y') ? 1 : 0; -+ old_val = (var->value[0] == '1' || var->value[0] == 'y') ? 1 : 0; -+ -+ if (new_val != old_val) -+ { -+ const char **n; -+ char * (*path_to_xxx) (const char *); -+ const char *envname[] = {"config_file", "config_directory", NULL}; -+ -+ path_to_xxx = (new_val == 1) ? grub_btrfs_path_to_rel : grub_btrfs_path_to_abs; -+ for (n = envname; *n; n++) -+ { -+ char *ctmp = path_to_xxx (grub_env_get (*n)); -+ if (ctmp) -+ { -+ grub_env_set (*n, ctmp); -+ grub_free (ctmp); -+ } -+ } -+ } -+ -+ return grub_strdup (val); -+} -+ - GRUB_MOD_INIT (btrfs) - { - grub_fs_register (&grub_btrfs_fs); -@@ -3452,6 +3585,8 @@ GRUB_MOD_INIT (btrfs) - subvol_set_env); - grub_register_variable_hook ("btrfs_subvolid", subvolid_get_env, - subvolid_set_env); -+ grub_register_variable_hook ("btrfs_relative_path", NULL, -+ relpath_set_env); - grub_env_export ("btrfs_subvol"); - grub_env_export ("btrfs_subvolid"); - grub_env_export ("btrfs_relative_path"); -@@ -3461,6 +3596,7 @@ GRUB_MOD_FINI (btrfs) - { - grub_register_variable_hook ("btrfs_subvol", NULL, NULL); - grub_register_variable_hook ("btrfs_subvolid", NULL, NULL); -+ grub_register_variable_hook ("btrfs_relative_path", NULL, NULL); - grub_unregister_command (cmd_info); - grub_unregister_extcmd (cmd_list_subvols); - grub_fs_unregister (&grub_btrfs_fs); --- -2.41.0 - diff --git a/0034-btrfs-04-grub2-install.patch b/0040-grub2-btrfs-04-grub2-install.patch similarity index 84% rename from 0034-btrfs-04-grub2-install.patch rename to 0040-grub2-btrfs-04-grub2-install.patch index 0c63719..c7b5656 100644 --- a/0034-btrfs-04-grub2-install.patch +++ b/0040-grub2-btrfs-04-grub2-install.patch @@ -1,20 +1,21 @@ -From d5d5cfaea61722e92be742ae383aa1820e6c3999 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:03:52 +0800 -Subject: [PATCH 034/272] btrfs 04 grub2 install +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Thu, 21 Aug 2014 03:39:11 +0000 +Subject: [PATCH] grub2-btrfs-04-grub2-install Signed-off-by: Michael Chang +Signed-off-by: Robbie Harwood --- grub-core/osdep/linux/getroot.c | 7 +++++++ grub-core/osdep/unix/config.c | 17 +++++++++++++++-- - include/grub/emu/config.h | 1 + util/config.c | 10 ++++++++++ util/grub-install.c | 14 ++++++++++++++ util/grub-mkrelpath.c | 6 ++++++ + include/grub/emu/config.h | 1 + 6 files changed, 53 insertions(+), 2 deletions(-) diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index 8b33d7f6f..3f0c67f73 100644 +index 7dd775d2ad9..7c29b3523b4 100644 --- a/grub-core/osdep/linux/getroot.c +++ b/grub-core/osdep/linux/getroot.c @@ -373,6 +373,7 @@ get_btrfs_fs_prefix (const char *mount_path) @@ -39,10 +40,10 @@ index 8b33d7f6f..3f0c67f73 100644 else if (!retry && grub_strcmp (entries[i].fstype, "autofs") == 0) { diff --git a/grub-core/osdep/unix/config.c b/grub-core/osdep/unix/config.c -index c7c4558d8..a84d02236 100644 +index 0b1f7618d21..0ce0e309ac0 100644 --- a/grub-core/osdep/unix/config.c +++ b/grub-core/osdep/unix/config.c -@@ -207,6 +207,19 @@ grub_util_load_config (struct grub_util_config *cfg) +@@ -82,6 +82,19 @@ grub_util_load_config (struct grub_util_config *cfg) if (v) cfg->grub_distributor = xstrdup (v); @@ -62,7 +63,7 @@ index c7c4558d8..a84d02236 100644 cfgfile = grub_util_get_config_filename (); if (!grub_util_is_regular (cfgfile)) return; -@@ -230,8 +243,8 @@ grub_util_load_config (struct grub_util_config *cfg) +@@ -105,8 +118,8 @@ grub_util_load_config (struct grub_util_config *cfg) *ptr++ = *iptr; } @@ -73,20 +74,8 @@ index c7c4558d8..a84d02236 100644 argv[2] = script; argv[3] = '\0'; -diff --git a/include/grub/emu/config.h b/include/grub/emu/config.h -index 875d5896c..c9a7e5f4a 100644 ---- a/include/grub/emu/config.h -+++ b/include/grub/emu/config.h -@@ -37,6 +37,7 @@ struct grub_util_config - { - int is_cryptodisk_enabled; - char *grub_distributor; -+ int is_suse_btrfs_snapshot_enabled; - }; - - void diff --git a/util/config.c b/util/config.c -index ebcdd8f5e..f044a880a 100644 +index ebcdd8f5e22..f044a880a76 100644 --- a/util/config.c +++ b/util/config.c @@ -42,6 +42,16 @@ grub_util_parse_config (FILE *f, struct grub_util_config *cfg, int simple) @@ -107,10 +96,10 @@ index ebcdd8f5e..f044a880a 100644 sizeof ("GRUB_DISTRIBUTOR=") - 1) == 0) { diff --git a/util/grub-install.c b/util/grub-install.c -index 453e9b18f..cc2df00fd 100644 +index 7dc5657bb67..ec3ed49674b 100644 --- a/util/grub-install.c +++ b/util/grub-install.c -@@ -844,6 +844,8 @@ try_open (const char *path) +@@ -843,6 +843,8 @@ try_open (const char *path) } #endif @@ -119,7 +108,7 @@ index 453e9b18f..cc2df00fd 100644 int main (int argc, char *argv[]) { -@@ -877,6 +879,9 @@ main (int argc, char *argv[]) +@@ -876,6 +878,9 @@ main (int argc, char *argv[]) grub_util_load_config (&config); @@ -129,8 +118,8 @@ index 453e9b18f..cc2df00fd 100644 if (!bootloader_id && config.grub_distributor) { char *ptr; -@@ -1422,6 +1427,15 @@ main (int argc, char *argv[]) - debug_image); +@@ -1366,6 +1371,15 @@ main (int argc, char *argv[]) + relative_grubdir = xstrdup ("/"); } + if (config.is_suse_btrfs_snapshot_enabled @@ -142,11 +131,11 @@ index 453e9b18f..cc2df00fd 100644 + fprintf (load_cfg_f, "set btrfs_relative_path='y'\n"); + } + - if (!have_abstractions) - { - if ((disk_module && grub_strcmp (disk_module, "biosdisk") != 0) + char *prefix_drive = NULL; + char *install_drive = NULL; + diff --git a/util/grub-mkrelpath.c b/util/grub-mkrelpath.c -index 47a241a39..5db7a9a7d 100644 +index 47a241a391b..5db7a9a7d97 100644 --- a/util/grub-mkrelpath.c +++ b/util/grub-mkrelpath.c @@ -40,9 +40,12 @@ struct arguments @@ -172,6 +161,15 @@ index 47a241a39..5db7a9a7d 100644 case ARGP_KEY_ARG: if (state->arg_num == 0) arguments->pathname = xstrdup (arg); --- -2.41.0 - +diff --git a/include/grub/emu/config.h b/include/grub/emu/config.h +index 875d5896ce1..c9a7e5f4ade 100644 +--- a/include/grub/emu/config.h ++++ b/include/grub/emu/config.h +@@ -37,6 +37,7 @@ struct grub_util_config + { + int is_cryptodisk_enabled; + char *grub_distributor; ++ int is_suse_btrfs_snapshot_enabled; + }; + + void diff --git a/0041-Use-chainloader-to-boot-xen.efi-under-UEFI.patch b/0041-Use-chainloader-to-boot-xen.efi-under-UEFI.patch deleted file mode 100644 index 90ab034..0000000 --- a/0041-Use-chainloader-to-boot-xen.efi-under-UEFI.patch +++ /dev/null @@ -1,192 +0,0 @@ -From b48a883c16e0b337c28d32b18c380e9de9606ce2 Mon Sep 17 00:00:00 2001 -From: Raymund Will -Date: Mon, 1 Apr 2024 16:18:57 +0800 -Subject: [PATCH 041/272] Use chainloader to boot xen.efi under UEFI. - -As XEN on SLE12 is not multiboot2 ready, some very dirty hacking -is necessary to boot via xen.efi and separate configfile snippets -(as done in SLE11SP3 secureboot). - -To that end said configfile snippets, xen efi-binaries, kernels and initrds -need to copied to the EFI system partition during 'grub2-mkconfig'! - -V0: -- first, somewhat fragile version, without any sort of cleanup for ESP. -V1: -- add missing whitespace. (bnc879148) -V2: -- second, much less fragile version, using only one config file per - XEN hypervisor version with sections for different kernels, avoiding - useless duplicates for sym-linked hypervisors. and removing previously - installed files from ESP. -V3: -- support move to '/usr/share/efi/$machine' for EFI-binaries. (bsc#1122563) ---- - util/grub.d/20_linux_xen.in | 108 ++++++++++++++++++++++++++++++++---- - 1 file changed, 97 insertions(+), 11 deletions(-) - -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 996b83df9..157b57a3f 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -21,6 +21,8 @@ prefix="@prefix@" - exec_prefix="@exec_prefix@" - datarootdir="@datarootdir@" - -+ME=$(basename $0) -+ - . "$pkgdatadir/grub-mkconfig_lib" - - export TEXTDOMAIN=@PACKAGE@ -@@ -36,11 +38,23 @@ CLASS="--class gnu-linux --class gnu --class os --class xen" - - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then - OS=GNU/Linux -+ os=linux - else - OS="${GRUB_DISTRIBUTOR}" -- CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" -+ os="$(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1)" -+ CLASS="--class ${os} ${CLASS}" - fi - -+machine=`uname -m` -+ -+case "$machine" in -+ i?86) GENKERNEL_ARCH="x86" ;; -+ mips|mips64) GENKERNEL_ARCH="mips" ;; -+ mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;; -+ arm*) GENKERNEL_ARCH="arm" ;; -+ *) GENKERNEL_ARCH="$machine" ;; -+esac -+ - # loop-AES arranges things so that /dev/loop/X can be our root device, but - # the initrds that Linux uses don't like that. - case ${GRUB_DEVICE} in -@@ -99,6 +113,32 @@ esac - - title_correction_code= - -+if [ -d /sys/firmware/efi ]; then -+ is_efi=true -+ err_msg="" -+ efi_dir="/boot/efi/efi/${os}" -+ grub_dir=/boot/@PACKAGE@ -+ xen_dir=/usr/share/efi/$machine -+ [ -d $xen_dir ] || xen_dir=/usr/lib64/efi -+ for d in $grub_dir $efi_dir $xen_dir; do -+ [ ! -d "$d" ] || continue -+ err_msg="${err_msg}$ME: Essential directory '$d' not found!\n" -+ done -+ if ! [ -d "$efi_dir" -a -d "$grub_dir" -a -d "$xen_dir" ]; then -+ err_msg="${err_msg}$ME: XEN configuration skipped!\n" -+ else -+ rm -f $grub_dir/xen*.cfg -+ if [ -s $efi_dir/grub.xen-files ]; then -+ for f in $(sort $efi_dir/grub.xen-files| uniq); do -+ rm -f $efi_dir/$f -+ done -+ : > $efi_dir/grub.xen-files -+ fi -+ fi -+else -+ is_efi=false -+fi -+ - linux_entry () - { - linux_entry_xsm "$@" false -@@ -154,6 +194,40 @@ linux_entry_xsm () - save_default_entry | grub_add_tab | sed "s/^/$submenu_indentation/" - fi - -+ if $is_efi; then -+ xen_cfg=${xen_basename/.efi/.cfg} -+ if [ "$section_count" = 0 ]; then -+ cat <<-EOF > $grub_dir/$xen_cfg -+ # disclaimer -+ [global] -+ #default= -+ EOF -+ fi -+ section_count=$(expr $section_count + 1) -+ if [ x$type != xrecovery ] ; then -+ section="config.$section_count" -+ else -+ section="failsafe.$section_count" -+ fi -+ cat <<-EOF >> $grub_dir/$xen_cfg -+ -+ [$section] -+ options=${xen_args} -+ kernel=${basename} root=${linux_root_device_thisversion} ${args} -+ ramdisk=${initrd_real} -+ EOF -+ message="$(gettext_printf "Loading Xen %s with Linux %s ..." ${xen_version} ${version})" -+ sed "s/^/$submenu_indentation/" <<-EOF -+ echo '$(echo "$message" | grub_quote)' -+ chainloader \$cmdpath/${xen_basename} ${xen_basename} $section -+ } -+ EOF -+ for f in ${grub_dir}/$xen_cfg ${xen_dir}/${xen_basename} ${dirname}/${basename} ${dirname}/${initrd_real}; do -+ cp --preserve=timestamps $f $efi_dir -+ echo $(basename $f) >> $efi_dir/grub.xen-files -+ done -+ return -+ fi - if [ -z "${prepare_boot_cache}" ]; then - prepare_boot_cache="$(prepare_grub_to_access_device ${GRUB_DEVICE_BOOT} | grub_add_tab)" - fi -@@ -245,16 +319,6 @@ boot_device_id= - - title_correction_code= - --machine=`uname -m` -- --case "$machine" in -- i?86) GENKERNEL_ARCH="x86" ;; -- mips|mips64) GENKERNEL_ARCH="mips" ;; -- mipsel|mips64el) GENKERNEL_ARCH="mipsel" ;; -- arm*) GENKERNEL_ARCH="arm" ;; -- *) GENKERNEL_ARCH="$machine" ;; --esac -- - # Extra indentation to add to menu entries in a submenu. We're not in a submenu - # yet, so it's empty. In a submenu it will be equal to '\t' (one tab). - submenu_indentation="" -@@ -325,6 +389,24 @@ for current_xen in ${reverse_sorted_xen_list}; do - xen_dirname=`dirname ${current_xen}` - rel_xen_dirname=`make_system_path_relative_to_its_root $xen_dirname` - xen_version=`echo $xen_basename | sed -e "s,.gz$,,g;s,^xen-,,g"` -+ xen_list=`echo $xen_list | tr ' ' '\n' | grep -vx $current_xen | tr '\n' ' '` -+ if $is_efi; then -+ xen_basename=${xen_basename/.gz/.efi} -+ if ! [ -f ${xen_dir}/${xen_basename} ]; then -+ echo "Skip missing hypervisor $xen_dir/$xen_basename" >&2 -+ continue -+ elif [ -L ${xen_dir}/${xen_basename} ]; then -+ xen_target=$(basename $(readlink -e ${xen_dir}/${xen_basename})) -+ if [ -f ${efi_dir}/${xen_target} ]; then -+ echo "Skip duplicate $xen_dir/$xen_basename for $xen_target" >&2 -+ continue -+ fi -+ elif [ -n "$err_msg" ]; then -+ break -+ fi -+ gettext_printf "Found hypervisor: %s\n" "$current_xen" >&2 -+ section_count=0 -+ fi - if [ -z "$boot_device_id" ]; then - boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" - fi -@@ -445,3 +527,7 @@ if [ x"$is_top_level" != xtrue ]; then - fi - - echo "$title_correction_code" -+ -+if [ -n "$err_msg" ]; then -+ echo -en "$err_msg" >&2 -+fi --- -2.41.0 - diff --git a/0035-btrfs-05-grub2-mkconfig.patch b/0041-grub2-btrfs-05-grub2-mkconfig.patch similarity index 71% rename from 0035-btrfs-05-grub2-mkconfig.patch rename to 0041-grub2-btrfs-05-grub2-mkconfig.patch index 7a8b338..f1187fd 100644 --- a/0035-btrfs-05-grub2-mkconfig.patch +++ b/0041-grub2-btrfs-05-grub2-mkconfig.patch @@ -1,36 +1,33 @@ -From e28f7226cbd8a515b63bf1f291eebd9b4144f556 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:09:52 +0800 -Subject: [PATCH 035/272] btrfs 05 grub2 mkconfig +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Thu, 21 Aug 2014 03:39:11 +0000 +Subject: [PATCH] grub2-btrfs-05-grub2-mkconfig -Always declare path specification in case of inconsistent declaration -elsewhere. (bsc#1209165) - -Signed-off-by: nilusyi +Signed-off-by: Michael Chang --- util/grub-mkconfig.in | 3 ++- util/grub-mkconfig_lib.in | 4 ++++ - util/grub.d/00_header.in | 31 ++++++++++++++++++++++++++++++- + util/grub.d/00_header.in | 25 ++++++++++++++++++++++++- util/grub.d/10_linux.in | 4 ++++ util/grub.d/20_linux_xen.in | 4 ++++ - 5 files changed, 44 insertions(+), 2 deletions(-) + 5 files changed, 38 insertions(+), 2 deletions(-) diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index 22b04d2cc..b3394d7d7 100644 +index 28e92515795..884e4d363ca 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -297,7 +297,8 @@ export GRUB_DEFAULT \ - GRUB_ENABLE_CRYPTODISK \ +@@ -256,7 +256,8 @@ export GRUB_DEFAULT \ GRUB_BADRAM \ GRUB_OS_PROBER_SKIP_LIST \ -- GRUB_DISABLE_SUBMENU -+ GRUB_DISABLE_SUBMENU \ + GRUB_DISABLE_SUBMENU \ +- GRUB_DEFAULT_DTB ++ GRUB_DEFAULT_DTB \ + SUSE_BTRFS_SNAPSHOT_BOOTING if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in -index d8dc4af10..50e64c941 100644 +index 33e1750aebb..0ba0e0e1c65 100644 --- a/util/grub-mkconfig_lib.in +++ b/util/grub-mkconfig_lib.in @@ -49,7 +49,11 @@ grub_warn () @@ -46,10 +43,10 @@ index d8dc4af10..50e64c941 100644 is_path_readable_by_grub () diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index de0a3c358..314d0d763 100644 +index c2d8b093762..3e1b77265db 100644 --- a/util/grub.d/00_header.in +++ b/util/grub.d/00_header.in -@@ -27,6 +27,21 @@ export TEXTDOMAINDIR="@localedir@" +@@ -27,6 +27,14 @@ export TEXTDOMAINDIR="@localedir@" . "$pkgdatadir/grub-mkconfig_lib" @@ -59,35 +56,29 @@ index de0a3c358..314d0d763 100644 +set btrfs_relative_path="y" +export btrfs_relative_path +EOF -+else -+# Always declare path specification in case of inconsistent declaration -+# elsewhere. (bsc#1209165) -+ cat < -Date: Mon, 1 Apr 2024 16:12:19 +0800 -Subject: [PATCH 036/272] btrfs 06 subvol mount - -V2: -* Fix grub2-install --root-directory does not work for /boot/grub2/arch on - separate btrfs subvolume (boo#1098420) - -v3: -* Fix executable stack on which function trampoline is constructed to support - closure (nested function). The closure sematic is replaced. +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Tue, 9 Jul 2019 13:56:16 +0200 +Subject: [PATCH] grub2-btrfs-06-subvol-mount Signed-off-by: Michael Chang +Signed-off-by: Robbie Harwood --- - grub-core/fs/btrfs.c | 195 +++++++++++++++++++++++++++++++- - grub-core/osdep/linux/getroot.c | 140 ++++++++++++++++++++++- - include/grub/emu/getroot.h | 5 + - util/grub-install.c | 52 +++++++++ - 4 files changed, 387 insertions(+), 5 deletions(-) + grub-core/fs/btrfs.c | 195 +++++++++++++++++++++++++++++++++++++++- + grub-core/osdep/linux/getroot.c | 148 +++++++++++++++++++++++++++++- + util/grub-install.c | 49 ++++++++++ + include/grub/emu/getroot.h | 5 ++ + 4 files changed, 392 insertions(+), 5 deletions(-) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index c711554a7..4b255c69d 100644 +index d47f9ab0352..d44a1c73b8a 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c -@@ -44,6 +44,7 @@ +@@ -41,6 +41,7 @@ #include #include #include +#include - - GRUB_MOD_LICENSE ("GPLv3+"); - + #include + #include + #include @@ -266,6 +267,12 @@ static grub_err_t grub_btrfs_read_logical (struct grub_btrfs_data *data, grub_disk_addr_t addr, void *buf, grub_size_t size, @@ -71,7 +64,7 @@ index c711554a7..4b255c69d 100644 if (err) return grub_error(GRUB_ERR_FILE_NOT_FOUND, "couldn't locate %s\n", path); -@@ -2323,11 +2347,20 @@ grub_btrfs_dir (grub_device_t device, const char *path, +@@ -2316,11 +2340,20 @@ grub_btrfs_dir (grub_device_t device, const char *path, grub_uint64_t tree; grub_uint8_t type; grub_size_t est_size = 0; @@ -93,7 +86,7 @@ index c711554a7..4b255c69d 100644 if (err) { grub_btrfs_unmount (data); -@@ -2454,11 +2487,21 @@ grub_btrfs_open (struct grub_file *file, const char *name) +@@ -2447,11 +2480,21 @@ grub_btrfs_open (struct grub_file *file, const char *name) struct grub_btrfs_inode inode; grub_uint8_t type; struct grub_btrfs_key key_in; @@ -116,7 +109,7 @@ index c711554a7..4b255c69d 100644 if (err) { grub_btrfs_unmount (data); -@@ -2693,6 +2736,150 @@ grub_cmd_btrfs_info (grub_command_t cmd __attribute__ ((unused)), int argc, +@@ -2686,6 +2729,150 @@ grub_cmd_btrfs_info (grub_command_t cmd __attribute__ ((unused)), int argc, return 0; } @@ -267,7 +260,7 @@ index c711554a7..4b255c69d 100644 static grub_err_t get_fs_root(struct grub_btrfs_data *data, grub_uint64_t tree, grub_uint64_t objectid, grub_uint64_t offset, -@@ -2905,6 +3092,7 @@ static struct grub_fs grub_btrfs_fs = { +@@ -2892,6 +3079,7 @@ static struct grub_fs grub_btrfs_fs = { }; static grub_command_t cmd_info; @@ -275,7 +268,7 @@ index c711554a7..4b255c69d 100644 static grub_extcmd_t cmd_list_subvols; static char * -@@ -2968,6 +3156,9 @@ GRUB_MOD_INIT (btrfs) +@@ -2955,6 +3143,9 @@ GRUB_MOD_INIT (btrfs) cmd_info = grub_register_command("btrfs-info", grub_cmd_btrfs_info, "DEVICE", "Print BtrFS info about DEVICE."); @@ -286,7 +279,7 @@ index c711554a7..4b255c69d 100644 grub_cmd_btrfs_list_subvols, 0, "[-p|-n] [-o var] DEVICE", diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index 3f0c67f73..b007cae66 100644 +index 7c29b3523b4..74a48c03026 100644 --- a/grub-core/osdep/linux/getroot.c +++ b/grub-core/osdep/linux/getroot.c @@ -103,6 +103,14 @@ struct btrfs_ioctl_search_key @@ -409,12 +402,12 @@ index 3f0c67f73..b007cae66 100644 + return NULL; +} + -+static char *grub_btrfs_mount_path; ++void (*grub_find_root_btrfs_mount_path_hook)(const char *mount_path); + char ** grub_find_root_devices_from_mountinfo (const char *dir, char **relroot) { -@@ -516,12 +627,17 @@ again: +@@ -516,12 +627,15 @@ again: else if (grub_strcmp (entries[i].fstype, "btrfs") == 0) { ret = grub_find_root_devices_from_btrfs (dir); @@ -424,10 +417,8 @@ index 3f0c67f73..b007cae66 100644 - if (fs_prefix) - free (fs_prefix); fs_prefix = xstrdup ("/"); -+ -+ if (grub_btrfs_mount_path) -+ grub_free (grub_btrfs_mount_path); -+ grub_btrfs_mount_path = grub_strdup (entries[i].enc_path); ++ if (grub_find_root_btrfs_mount_path_hook) ++ grub_find_root_btrfs_mount_path_hook (entries[i].enc_path); + } + else + { @@ -435,7 +426,7 @@ index 3f0c67f73..b007cae66 100644 } } else if (!retry && grub_strcmp (entries[i].fstype, "autofs") == 0) -@@ -1198,6 +1314,24 @@ grub_util_get_grub_dev_os (const char *os_dev) +@@ -1147,6 +1261,34 @@ grub_util_get_grub_dev_os (const char *os_dev) return grub_dev; } @@ -443,44 +434,38 @@ index 3f0c67f73..b007cae66 100644 +char * +grub_util_get_btrfs_subvol (const char *path, char **mount_path) +{ ++ char *mp = NULL; ++ + if (mount_path) + *mount_path = NULL; + ++ auto void ++ mount_path_hook (const char *m) ++ { ++ mp = strdup (m); ++ } ++ ++ grub_find_root_btrfs_mount_path_hook = mount_path_hook; + grub_free (grub_find_root_devices_from_mountinfo (path, NULL)); ++ grub_find_root_btrfs_mount_path_hook = NULL; + -+ if (!grub_btrfs_mount_path) ++ if (!mp) + return NULL; + + if (mount_path) -+ *mount_path = grub_strdup (grub_btrfs_mount_path); ++ *mount_path = mp; + -+ return get_btrfs_subvol (grub_btrfs_mount_path); ++ return get_btrfs_subvol (mp); +} + char * grub_make_system_path_relative_to_its_root_os (const char *path) { -diff --git a/include/grub/emu/getroot.h b/include/grub/emu/getroot.h -index 73fa2d34a..9c642ae3f 100644 ---- a/include/grub/emu/getroot.h -+++ b/include/grub/emu/getroot.h -@@ -53,6 +53,11 @@ char ** - grub_find_root_devices_from_mountinfo (const char *dir, char **relroot); - #endif - -+#ifdef __linux__ -+char * -+grub_util_get_btrfs_subvol (const char *path, char **mount_path); -+#endif -+ - /* Devmapper functions provided by getroot_devmapper.c. */ - void - grub_util_pull_devmapper (const char *os_dev); diff --git a/util/grub-install.c b/util/grub-install.c -index cc2df00fd..1d2bf4dd3 100644 +index ec3ed49674b..d3ec2570d1d 100644 --- a/util/grub-install.c +++ b/util/grub-install.c -@@ -1616,6 +1616,58 @@ main (int argc, char *argv[]) +@@ -1615,6 +1615,55 @@ main (int argc, char *argv[]) prefix_drive = xasprintf ("(%s)", grub_drives[0]); } @@ -492,12 +477,13 @@ index cc2df00fd..1d2bf4dd3 100644 + char *subvol = NULL; + char *mount_path = NULL; + char **rootdir_devices = NULL; -+ char *t = grub_util_path_concat (2, "/", rootdir); -+ char *rootdir_path = grub_canonicalize_file_name (t); ++ char *rootdir_path = grub_util_path_concat (2, "/", rootdir); + -+ if (rootdir_path && grub_util_is_directory (rootdir_path)) ++ if (grub_util_is_directory (rootdir_path)) + rootdir_devices = grub_guess_root_devices (rootdir_path); + ++ free (rootdir_path); ++ + if (rootdir_devices && rootdir_devices[0]) + if (grub_strcmp (rootdir_devices[0], grub_devices[0]) == 0) + subvol = grub_util_get_btrfs_subvol (platdir, &mount_path); @@ -506,32 +492,28 @@ index cc2df00fd..1d2bf4dd3 100644 + { + char *def_subvol; + -+ def_subvol = grub_util_get_btrfs_subvol (rootdir_path, NULL); ++ def_subvol = grub_util_get_btrfs_subvol ("/", NULL); + + if (def_subvol) + { -+ char *rootdir_mount_path = NULL; + if (!load_cfg_f) + load_cfg_f = grub_util_fopen (load_cfg, "wb"); + have_load_cfg = 1; + -+ if (grub_strncmp (rootdir_path, mount_path, grub_strlen (rootdir_path)) == 0) -+ rootdir_mount_path = grub_util_path_concat (2, "/", mount_path + grub_strlen (rootdir_path)); -+ -+ if (grub_strcmp (subvol, def_subvol) != 0 && rootdir_mount_path) -+ fprintf (load_cfg_f, "btrfs-mount-subvol ($root) %s %s\n", rootdir_mount_path, subvol); -+ free (rootdir_mount_path); ++ if (grub_strcmp (subvol, def_subvol) != 0) ++ fprintf (load_cfg_f, "btrfs-mount-subvol ($root) %s %s\n", mount_path, subvol); + free (def_subvol); + } + } + -+ free (t); -+ free (rootdir_path); + for (curdev = rootdir_devices; *curdev; curdev++) + free (*curdev); -+ free (rootdir_devices); -+ free (subvol); -+ free (mount_path); ++ if (rootdir_devices) ++ free (rootdir_devices); ++ if (subvol) ++ free (subvol); ++ if (mount_path) ++ free (mount_path); + } + +#endif @@ -539,6 +521,19 @@ index cc2df00fd..1d2bf4dd3 100644 char mkimage_target[200]; const char *core_name = NULL; --- -2.41.0 - +diff --git a/include/grub/emu/getroot.h b/include/grub/emu/getroot.h +index 73fa2d34abb..9c642ae3fe3 100644 +--- a/include/grub/emu/getroot.h ++++ b/include/grub/emu/getroot.h +@@ -53,6 +53,11 @@ char ** + grub_find_root_devices_from_mountinfo (const char *dir, char **relroot); + #endif + ++#ifdef __linux__ ++char * ++grub_util_get_btrfs_subvol (const char *path, char **mount_path); ++#endif ++ + /* Devmapper functions provided by getroot_devmapper.c. */ + void + grub_util_pull_devmapper (const char *os_dev); diff --git a/0037-btrfs-07-subvol-fallback.patch b/0043-Fallback-to-old-subvol-name-scheme-to-support-old-sn.patch similarity index 84% rename from 0037-btrfs-07-subvol-fallback.patch rename to 0043-Fallback-to-old-subvol-name-scheme-to-support-old-sn.patch index ad3ba53..1b3a969 100644 --- a/0037-btrfs-07-subvol-fallback.patch +++ b/0043-Fallback-to-old-subvol-name-scheme-to-support-old-sn.patch @@ -1,15 +1,16 @@ -From f81e509c8542b2ae052c29d611daa138c9b74bae Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:13:31 +0800 -Subject: [PATCH 037/272] btrfs 07 subvol fallback +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrei Borzenkov +Date: Tue, 21 Jun 2016 16:44:17 +0000 +Subject: [PATCH] Fallback to old subvol name scheme to support old snapshot + config -Signed-off-by: Michael Chang +Ref: bsc#953538 --- grub-core/fs/btrfs.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 4b255c69d..34a629a44 100644 +index d44a1c73b8a..dba86d19b1a 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c @@ -1339,11 +1339,41 @@ lookup_root_by_name(struct grub_btrfs_data *data, const char *path) @@ -55,6 +56,3 @@ index 4b255c69d..34a629a44 100644 if (btrfs_default_subvolid) return lookup_root_by_id(data, btrfs_default_subvolid); --- -2.41.0 - diff --git a/0043-Unquote-parameters-written-to-Xen-EFI-config-file.patch b/0043-Unquote-parameters-written-to-Xen-EFI-config-file.patch deleted file mode 100644 index d58df71..0000000 --- a/0043-Unquote-parameters-written-to-Xen-EFI-config-file.patch +++ /dev/null @@ -1,94 +0,0 @@ -From d996e4687d9f554bd35091838b85f723b9eec08f Mon Sep 17 00:00:00 2001 -From: Petr Tesarik -Date: Mon, 1 Apr 2024 16:20:40 +0800 -Subject: [PATCH 043/272] Unquote parameters written to Xen EFI config file - -The GRUB_CMDLINE_* value is copied verbatim to grub.conf, so it is first -parsed by GRUB2 before being passed down to the kernel. OTOH Xen EFI loader -takes the config file options verbatim. This means that any special GRUB2 -syntax must be evaluated when generating that file. - -Of course, some things are not even possible (e.g. substituting GRUB runtime -variables), but let's call them known limitations. - -Signed-off-by: Petr Tesarik ---- - util/grub.d/20_linux_xen.in | 52 +++++++++++++++++++++++++++++++++++-- - 1 file changed, 50 insertions(+), 2 deletions(-) - -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 21ac71bb8..7641f8b27 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -139,6 +139,52 @@ else - is_efi=false - fi - -+grub2_unquote () -+{ -+ awk ' -+ BEGIN { -+ bare = "[^{}|&$;<> \t\n'\''\"\\\\]+" -+ esc = "\\\\." -+ id = "[[:alpha:]_][[:alnum:]_]*|[[:digit:]]+|[?#*@]" -+ var = "\\$("id")|\\$\\{("id")\\}" -+ dqesc = "\\\\[$\"\\\\]" -+ dqstr = "\\$?\"([^\"]|"var"|"dqesc")*\"" -+ sqstr = "'\''[^'\'']*'\''" -+ pat = bare"|"esc"|"var"|"dqstr"|"sqstr -+ ORS = "" -+ } -+ { -+ patsplit($0, words, pat, sep) -+ print sep[0] -+ for (i in words) { -+ w = words[i] -+ if (w ~ /^\$?"/) { -+ # Double-quoted string -+ patsplit(w, segs, var"|"dqesc, ssep) -+ print ssep[0] -+ for (j in segs) { -+ if (segs[j] ~ /^\\/) -+ print substr(segs[j], 2) -+ print ssep[j] -+ } -+ } else if (w ~ /^'\''/) { -+ # Single-quoted string -+ print substr(w, 2, length(w)-2) -+ } else if (w ~ /^\\/) { -+ # Escape sequence -+ print substr(w, 2) -+ } else if (w ~ /^\$/) { -+ # Variable expansion -+ } else { -+ # Bare word -+ print w -+ } -+ print sep[i] -+ } -+ print "\n" -+ }' -+} -+ - linux_entry () - { - linux_entry_xsm "$@" false -@@ -209,11 +255,13 @@ linux_entry_xsm () - else - section="failsafe.$section_count" - fi -+ xen_args_unq=$(echo $xen_args | grub2_unquote) -+ args_unq=$(echo $args | grub2_unquote) - cat <<-EOF >> $grub_dir/$xen_cfg - - [$section] -- options=${xen_args} -- kernel=${basename} root=${linux_root_device_thisversion} ${args} -+ options=${xen_args_unq} -+ kernel=${basename} root=${linux_root_device_thisversion} ${args_unq} - ramdisk=${initrd_real} - EOF - message="$(gettext_printf "Loading Xen %s with Linux %s ..." ${xen_version} ${version})" --- -2.41.0 - diff --git a/0039-btrfs-09-get-default-subvolume.patch b/0044-Grub-not-working-correctly-with-btrfs-snapshots-bsc-.patch similarity index 86% rename from 0039-btrfs-09-get-default-subvolume.patch rename to 0044-Grub-not-working-correctly-with-btrfs-snapshots-bsc-.patch index 473be98..add5764 100644 --- a/0039-btrfs-09-get-default-subvolume.patch +++ b/0044-Grub-not-working-correctly-with-btrfs-snapshots-bsc-.patch @@ -1,22 +1,19 @@ -From ea0e3a4e08d8517bfd92e4f09974ffae5a86fd3d Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:15:46 +0800 -Subject: [PATCH 039/272] btrfs 09 get default subvolume - -V1: - * Use overflow checking primitives where the arithmetic expression for - buffer allocations may include unvalidated data +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Thu, 11 May 2017 08:56:57 +0000 +Subject: [PATCH] Grub not working correctly with btrfs snapshots (bsc#1026511) Signed-off-by: Michael Chang +Signed-off-by: Robbie Harwood --- - grub-core/fs/btrfs.c | 254 +++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 254 insertions(+) + grub-core/fs/btrfs.c | 238 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 238 insertions(+) diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 34a629a44..d4f7b022b 100644 +index dba86d19b1a..87e4dd1a07a 100644 --- a/grub-core/fs/btrfs.c +++ b/grub-core/fs/btrfs.c -@@ -3106,6 +3106,254 @@ out: +@@ -3093,6 +3093,238 @@ out: return 0; } @@ -40,7 +37,6 @@ index 34a629a44..d4f7b022b 100644 + grub_disk_addr_t elemaddr; + grub_err_t err; + char *parent_path; -+ grub_size_t sz; + + *parent_id = 0; + *path_out = 0; @@ -59,10 +55,7 @@ index 34a629a44..d4f7b022b 100644 + return grub_error(GRUB_ERR_FILE_NOT_FOUND, N_("can't find root backrefs")); + } + -+ if (grub_add (elemsize, 1, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ -+ buf = grub_malloc(sz); ++ buf = grub_malloc(elemsize + 1); + if (!buf) + { + free_iterator(&desc); @@ -116,7 +109,6 @@ index 34a629a44..d4f7b022b 100644 + struct grub_btrfs_dir_item *direl = NULL; + const char *ctoken = "default"; + grub_size_t ctokenlen = sizeof ("default") - 1; -+ grub_size_t sz; + + *id = 0; + key.object_id = data->sblock.root_dir_objectid; @@ -131,14 +123,7 @@ index 34a629a44..d4f7b022b 100644 + return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("file not found")); + + struct grub_btrfs_dir_item *cdirel; -+ -+ if (grub_add (elemsize, 1, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ -+ direl = grub_malloc (sz); -+ if (!direl) -+ return grub_errno; -+ ++ direl = grub_malloc (elemsize + 1); + err = grub_btrfs_read_logical (data, elemaddr, direl, elemsize, 0); + if (err) + { @@ -224,10 +209,6 @@ index 34a629a44..d4f7b022b 100644 + } + + id = subvolid; -+ -+ if (id == GRUB_BTRFS_ROOT_VOL_OBJECTID) -+ subvol = grub_strdup (""); -+ else + while (id != GRUB_BTRFS_ROOT_VOL_OBJECTID) + { + grub_uint64_t parent_id; @@ -271,7 +252,7 @@ index 34a629a44..d4f7b022b 100644 static struct grub_fs grub_btrfs_fs = { .name = "btrfs", .fs_dir = grub_btrfs_dir, -@@ -3124,6 +3372,7 @@ static struct grub_fs grub_btrfs_fs = { +@@ -3111,6 +3343,7 @@ static struct grub_fs grub_btrfs_fs = { static grub_command_t cmd_info; static grub_command_t cmd_mount_subvol; static grub_extcmd_t cmd_list_subvols; @@ -279,7 +260,7 @@ index 34a629a44..d4f7b022b 100644 static char * subvolid_set_env (struct grub_env_var *var __attribute__ ((unused)), -@@ -3194,6 +3443,11 @@ GRUB_MOD_INIT (btrfs) +@@ -3181,6 +3414,11 @@ GRUB_MOD_INIT (btrfs) "[-p|-n] [-o var] DEVICE", "Print list of BtrFS subvolumes on " "DEVICE.", options); @@ -291,6 +272,3 @@ index 34a629a44..d4f7b022b 100644 grub_register_variable_hook ("btrfs_subvol", subvol_get_env, subvol_set_env); grub_register_variable_hook ("btrfs_subvolid", subvolid_get_env, --- -2.41.0 - diff --git a/0044-The-grub-can-be-installed-with-removable-option-to-s.patch b/0044-The-grub-can-be-installed-with-removable-option-to-s.patch deleted file mode 100644 index 2cd279c..0000000 --- a/0044-The-grub-can-be-installed-with-removable-option-to-s.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 753f78079e52ac03626cf7b58480f69bdf8fd8f7 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 1 Apr 2024 16:21:03 +0800 -Subject: [PATCH 044/272] The grub can be installed with removable option to - support booting from removable media with standard UEFI default file path of - the form: \EFI\BOOT\BOOT{machine type short-name}.EFI - -It does not make use of distributor directory, which becomes a problem for UEFI -Xen installation as it requires that directory to be present for storing xen -stuff like chainloaded hypervisor, xen kernel and so on. Moreover it makes bad -assumption that hypervisor will be chainloaded by grub under the same -directory, which is also not always true. - -This patch fixes the problem by ensuring the directory available to Xen -installation if any Xen hypervisor found and independent to grub boot path -$cmdpath to work. ---- - util/grub.d/20_linux_xen.in | 62 +++++++++++++++++++++---------------- - 1 file changed, 35 insertions(+), 27 deletions(-) - -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 7641f8b27..63a8dbf4b 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -113,32 +113,6 @@ esac - - title_correction_code= - --if [ -d /sys/firmware/efi ]; then -- is_efi=true -- err_msg="" -- efi_dir="/boot/efi/efi/${os}" -- grub_dir=/boot/@PACKAGE@ -- xen_dir=/usr/share/efi/$machine -- [ -d $xen_dir ] || xen_dir=/usr/lib64/efi -- for d in $grub_dir $efi_dir $xen_dir; do -- [ ! -d "$d" ] || continue -- err_msg="${err_msg}$ME: Essential directory '$d' not found!\n" -- done -- if ! [ -d "$efi_dir" -a -d "$grub_dir" -a -d "$xen_dir" ]; then -- err_msg="${err_msg}$ME: XEN configuration skipped!\n" -- else -- rm -f $grub_dir/xen*.cfg -- if [ -s $efi_dir/grub.xen-files ]; then -- for f in $(sort $efi_dir/grub.xen-files| uniq); do -- rm -f $efi_dir/$f -- done -- : > $efi_dir/grub.xen-files -- fi -- fi --else -- is_efi=false --fi -- - grub2_unquote () - { - awk ' -@@ -264,10 +238,15 @@ linux_entry_xsm () - kernel=${basename} root=${linux_root_device_thisversion} ${args_unq} - ramdisk=${initrd_real} - EOF -+ if [ -z "${prepare_efi_cache}" ]; then -+ grub_device_efi="`${grub_probe} --target=device /boot/efi`" -+ prepare_efi_cache="$(prepare_grub_to_access_device ${grub_device_efi} | grub_add_tab)" -+ fi -+ printf '%s\n' "${prepare_efi_cache}" | sed "s/^/$submenu_indentation/" - message="$(gettext_printf "Loading Xen %s with Linux %s ..." ${xen_version} ${version})" - sed "s/^/$submenu_indentation/" <<-EOF - echo '$(echo "$message" | grub_quote)' -- chainloader \$cmdpath/${xen_basename} ${xen_basename} ${SUSE_CMDLINE_XENEFI} $section -+ chainloader ${rel_efi_dir}/${xen_basename} ${xen_basename} ${SUSE_CMDLINE_XENEFI} $section - } - EOF - for f in ${grub_dir}/$xen_cfg ${xen_dir}/${xen_basename} ${dirname}/${basename} ${dirname}/${initrd_real}; do -@@ -363,6 +342,7 @@ else - done - fi - prepare_boot_cache= -+prepare_efi_cache= - boot_device_id= - - title_correction_code= -@@ -432,6 +412,34 @@ fi - - is_top_level=true - -+if [ -d /sys/firmware/efi ] && [ "x${xen_list}" != "x" ]; then -+ is_efi=true -+ err_msg="" -+ efi_dir="/boot/efi/efi/${os}" -+ grub_dir=/boot/grub2 -+ xen_dir=/usr/share/efi/$machine -+ [ -d $xen_dir ] || xen_dir=/usr/lib64/efi -+ for d in $grub_dir $xen_dir; do -+ [ ! -d "$d" ] || continue -+ err_msg="${err_msg}$ME: Essential directory '$d' not found!\n" -+ done -+ if ! [ -d "$grub_dir" -a -d "$xen_dir" ]; then -+ err_msg="${err_msg}$ME: XEN configuration skipped!\n" -+ else -+ mkdir -p $efi_dir -+ rel_efi_dir=`make_system_path_relative_to_its_root $efi_dir` -+ rm -f $grub_dir/xen*.cfg -+ if [ -s $efi_dir/grub.xen-files ]; then -+ for f in $(sort $efi_dir/grub.xen-files| uniq); do -+ rm -f $efi_dir/$f -+ done -+ : > $efi_dir/grub.xen-files -+ fi -+ fi -+else -+ is_efi=false -+fi -+ - for current_xen in ${reverse_sorted_xen_list}; do - xen_basename=`basename ${current_xen}` - xen_dirname=`dirname ${current_xen}` --- -2.41.0 - diff --git a/0045-Add-grub_efi_allocate_pool-and-grub_efi_free_pool-wr.patch b/0045-Add-grub_efi_allocate_pool-and-grub_efi_free_pool-wr.patch new file mode 100644 index 0000000..b88fbab --- /dev/null +++ b/0045-Add-grub_efi_allocate_pool-and-grub_efi_free_pool-wr.patch @@ -0,0 +1,72 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 1 Jun 2017 09:59:56 -0400 +Subject: [PATCH] Add grub_efi_allocate_pool() and grub_efi_free_pool() + wrappers. + +Signed-off-by: Peter Jones +--- + include/grub/efi/efi.h | 36 ++++++++++++++++++++++++++++++++---- + 1 file changed, 32 insertions(+), 4 deletions(-) + +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index a5cd99e5afa..8d98203a784 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -36,6 +36,10 @@ struct linux_arch_kernel_header { + struct grub_pe_image_header pe_image_header; + }; + ++/* Variables. */ ++extern grub_efi_system_table_t *EXPORT_VAR(grub_efi_system_table); ++extern grub_efi_handle_t EXPORT_VAR(grub_efi_image_handle); ++ + /* Functions. */ + void *EXPORT_FUNC(grub_efi_locate_protocol) (grub_guid_t *protocol, + void *registration); +@@ -71,6 +75,33 @@ EXPORT_FUNC(grub_efi_get_memory_map) (grub_efi_uintn_t *memory_map_size, + grub_efi_uintn_t *descriptor_size, + grub_efi_uint32_t *descriptor_version); + void grub_efi_memory_fini (void); ++ ++static inline grub_efi_status_t ++__attribute__((__unused__)) ++grub_efi_allocate_pool (grub_efi_memory_type_t pool_type, ++ grub_efi_uintn_t buffer_size, ++ void **buffer) ++{ ++ grub_efi_boot_services_t *b; ++ grub_efi_status_t status; ++ ++ b = grub_efi_system_table->boot_services; ++ status = b->allocate_pool(pool_type, buffer_size, buffer); ++ return status; ++} ++ ++static inline grub_efi_status_t ++__attribute__((__unused__)) ++grub_efi_free_pool (void *buffer) ++{ ++ grub_efi_boot_services_t *b; ++ grub_efi_status_t status; ++ ++ b = grub_efi_system_table->boot_services; ++ status = b->free_pool(buffer); ++ return status; ++} ++ + grub_efi_loaded_image_t *EXPORT_FUNC(grub_efi_get_loaded_image) (grub_efi_handle_t image_handle); + void EXPORT_FUNC(grub_efi_print_device_path) (grub_efi_device_path_t *dp); + char *EXPORT_FUNC(grub_efi_get_filename) (grub_efi_device_path_t *dp); +@@ -140,10 +171,7 @@ void grub_efi_init (void); + void grub_efi_fini (void); + void grub_efi_set_prefix (void); + +-/* Variables. */ +-extern grub_efi_system_table_t *EXPORT_VAR(grub_efi_system_table); +-extern grub_efi_handle_t EXPORT_VAR(grub_efi_image_handle); +- ++/* More variables. */ + extern int EXPORT_VAR(grub_efi_is_finished); + + struct grub_net_card; diff --git a/0045-Add-hidden-menu-entries.patch b/0045-Add-hidden-menu-entries.patch deleted file mode 100644 index 8a20339..0000000 --- a/0045-Add-hidden-menu-entries.patch +++ /dev/null @@ -1,233 +0,0 @@ -From e6ff391a8558d0e9456f14c1d300c8e234976f34 Mon Sep 17 00:00:00 2001 -From: Alexander Graf -Date: Tue, 26 Apr 2016 15:29:25 +0200 -Subject: [PATCH 045/272] Add hidden menu entries - -The menu infrastructure is quite powerful. It allows you to define menu -entries that can contain arbitrary grub commands that can do a lot more -than just boot kernel entries. - -For some of these it makes sense to hide them inside the normal menu -though and instead have them available through hotkeys that get advertised -differently. My main use case is to switch to the serial console when -gfxterm is loaded. - -So this patch adds support for hidden menu entries that are accessible -using hotkeys, but are not accessible in the grub menu. - -Signed-off-by: Alexander Graf ---- - grub-core/commands/legacycfg.c | 4 ++-- - grub-core/commands/menuentry.c | 22 +++++++++++++++++----- - grub-core/normal/menu.c | 30 ++++++++++++++++++++++++++---- - grub-core/normal/menu_text.c | 4 ++++ - include/grub/menu.h | 2 ++ - include/grub/normal.h | 2 +- - 6 files changed, 52 insertions(+), 12 deletions(-) - -diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c -index e9e9d94ef..54e08a1b4 100644 ---- a/grub-core/commands/legacycfg.c -+++ b/grub-core/commands/legacycfg.c -@@ -143,7 +143,7 @@ legacy_file (const char *filename) - args[0] = oldname; - grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy", - NULL, NULL, -- entrysrc, 0); -+ entrysrc, 0, 0); - grub_free (args); - entrysrc[0] = 0; - grub_free (oldname); -@@ -205,7 +205,7 @@ legacy_file (const char *filename) - } - args[0] = entryname; - grub_normal_add_menu_entry (1, args, NULL, NULL, NULL, -- NULL, NULL, entrysrc, 0); -+ NULL, NULL, entrysrc, 0, 0); - grub_free (args); - } - -diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c -index 720e6d8ea..c36913752 100644 ---- a/grub-core/commands/menuentry.c -+++ b/grub-core/commands/menuentry.c -@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args, - char **classes, const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu) -+ int submenu, int hidden) - { - int menu_hotkey = 0; - char **menu_args = NULL; -@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args, - (*last)->args = menu_args; - (*last)->sourcecode = menu_sourcecode; - (*last)->submenu = submenu; -+ (*last)->hidden = hidden; -+ -+ if (!hidden) -+ menu->size++; - -- menu->size++; - return GRUB_ERR_NONE; - - fail: -@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - users, - ctxt->state[2].arg, 0, - ctxt->state[3].arg, -- ctxt->extcmd->cmd->name[0] == 's'); -+ ctxt->extcmd->cmd->name[0] == 's', -+ ctxt->extcmd->cmd->name[0] == 'h'); - - src = args[argc - 1]; - args[argc - 1] = NULL; -@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - ctxt->state[0].args, ctxt->state[4].arg, - users, - ctxt->state[2].arg, prefix, src + 1, -- ctxt->extcmd->cmd->name[0] == 's'); -+ ctxt->extcmd->cmd->name[0] == 's', -+ ctxt->extcmd->cmd->name[0] == 'h'); - - src[len - 1] = ch; - args[argc - 1] = src; -@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - return r; - } - --static grub_extcmd_t cmd, cmd_sub; -+static grub_extcmd_t cmd, cmd_sub, cmd_hidden; - - void - grub_menu_init (void) -@@ -327,6 +332,13 @@ grub_menu_init (void) - | GRUB_COMMAND_FLAG_EXTRACTOR, - N_("BLOCK"), N_("Define a submenu."), - options); -+ cmd_hidden = grub_register_extcmd ("hiddenentry", grub_cmd_menuentry, -+ GRUB_COMMAND_FLAG_BLOCKS -+ | GRUB_COMMAND_ACCEPT_DASH -+ | GRUB_COMMAND_FLAG_EXTRACTOR, -+ N_("BLOCK"), -+ N_("Define a hidden menu entry."), -+ options); - } - - void -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 0e8e48ccb..64b377052 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -40,6 +40,8 @@ - grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu, - int nested) = NULL; - -+#define MENU_INCLUDE_HIDDEN 0x10000 -+ - enum timeout_style { - TIMEOUT_STYLE_MENU, - TIMEOUT_STYLE_COUNTDOWN, -@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no) - { - grub_menu_entry_t e; - -- for (e = menu->entry_list; e && no > 0; e = e->next, no--) -- ; -+ if (no & MENU_INCLUDE_HIDDEN) { -+ no &= ~MENU_INCLUDE_HIDDEN; -+ -+ for (e = menu->entry_list; e && no > 0; e = e->next, no--) -+ ; -+ } else { -+ for (e = menu->entry_list; e && no > 0; e = e->next, no--) { -+ /* Skip hidden entries */ -+ while (e && e->hidden) -+ e = e->next; -+ } -+ while (e && e->hidden) -+ e = e->next; -+ } - - return e; - } -@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey) - grub_menu_entry_t entry; - int i; - -- for (i = 0, entry = menu->entry_list; i < menu->size; -+ for (i = 0, entry = menu->entry_list; entry; - i++, entry = entry->next) - if (entry->hotkey == hotkey) -- return i; -+ return i | MENU_INCLUDE_HIDDEN; - - return -1; - } -@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name) - grub_menu_entry_t e = menu->entry_list; - int i; - -+ /* Skip hidden entries */ -+ while (e && e->hidden) -+ e = e->next; -+ - grub_errno = GRUB_ERR_NONE; - - for (i = 0; e; i++) -@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name) - break; - } - e = e->next; -+ -+ /* Skip hidden entries */ -+ while (e && e->hidden) -+ e = e->next; - } - - if (! e) -diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c -index b1321eb26..161083663 100644 ---- a/grub-core/normal/menu_text.c -+++ b/grub-core/normal/menu_text.c -@@ -290,6 +290,10 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data) - e, data); - if (e) - e = e->next; -+ -+ /* Skip hidden entries */ -+ while (e && e->hidden) -+ e = e->next; - } - - grub_term_gotoxy (data->term, -diff --git a/include/grub/menu.h b/include/grub/menu.h -index ee2b5e910..eb8a86ba9 100644 ---- a/include/grub/menu.h -+++ b/include/grub/menu.h -@@ -58,6 +58,8 @@ struct grub_menu_entry - - int submenu; - -+ int hidden; -+ - /* The next element. */ - struct grub_menu_entry *next; - }; -diff --git a/include/grub/normal.h b/include/grub/normal.h -index 218cbabcc..bcb412466 100644 ---- a/include/grub/normal.h -+++ b/include/grub/normal.h -@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes, - const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu); -+ int submenu, int hidden); - - grub_err_t - grub_normal_set_password (const char *user, const char *password); --- -2.41.0 - diff --git a/0046-SUSE-Add-the-t-hotkey.patch b/0046-SUSE-Add-the-t-hotkey.patch deleted file mode 100644 index d80c3f0..0000000 --- a/0046-SUSE-Add-the-t-hotkey.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 723bafd59aa3cc894fada9b637da737b90db968b Mon Sep 17 00:00:00 2001 -From: Alexander Graf -Date: Tue, 26 Apr 2016 15:59:03 +0200 -Subject: [PATCH 046/272] SUSE: Add the "t" hotkey - -While graphical output is fancy and nice, in some environments (EFI) we can -only have fancy graphical on frame buffer _or_ ugly serial on any output. - -To give the user a nicely graphical screen in the default case, but still -allow them to get their boot menu on the serial console, let's add a new -hidden option "t" that switches the output device back to the firmware default. - -Signed-off-by: Alexander Graf ---- - Makefile.util.def | 6 ++++++ - util/grub.d/00_header.in | 4 ++++ - util/grub.d/95_textmode.in | 12 ++++++++++++ - 3 files changed, 22 insertions(+) - create mode 100644 util/grub.d/95_textmode.in - -diff --git a/Makefile.util.def b/Makefile.util.def -index 8a74ae0e7..1aaab4eca 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -548,6 +548,12 @@ script = { - installdir = grubconf; - }; - -+script = { -+ name = '95_textmode'; -+ common = util/grub.d/95_textmode.in; -+ installdir = grubconf; -+}; -+ - program = { - mansection = 1; - name = grub-mkrescue; -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 314d0d763..8b2658279 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -220,6 +220,10 @@ EOF - fi - - cat << EOF -+ if [ "\${grub_platform}" = "efi" ]; then -+ echo "Please press 't' to show the boot menu on this console" -+ fi -+ - set gfxmode=${GRUB_GFXMODE} - load_video - insmod gfxterm -diff --git a/util/grub.d/95_textmode.in b/util/grub.d/95_textmode.in -new file mode 100644 -index 000000000..d6c1dbf00 ---- /dev/null -+++ b/util/grub.d/95_textmode.in -@@ -0,0 +1,12 @@ -+#!/bin/sh -+ -+cat < +Date: Thu, 1 Jun 2017 10:06:38 -0400 +Subject: [PATCH] Use grub_efi_...() memory helpers where reasonable. + +This uses grub_efi_allocate_pool(), grub_efi_free_pool(), and +grub_efi_free_pages() instead of open-coded efi_call_N() calls, so we +get more reasonable type checking. + +Signed-off-by: Peter Jones +--- + grub-core/loader/efi/chainloader.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 1de98f78313..2036924504b 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -95,7 +95,7 @@ grub_chainloader_boot (void *context) + } + + if (exit_data) +- b->free_pool (exit_data); ++ grub_efi_free_pool (exit_data); + + grub_loader_unset (); + +@@ -419,7 +419,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_free (file_path); + + if (address) +- b->free_pages (address, pages); ++ grub_efi_free_pages (address, pages); + + if (image_handle != NULL) + b->unload_image (image_handle); diff --git a/0047-Add-PRIxGRUB_EFI_STATUS-and-use-it.patch b/0047-Add-PRIxGRUB_EFI_STATUS-and-use-it.patch new file mode 100644 index 0000000..c852ced --- /dev/null +++ b/0047-Add-PRIxGRUB_EFI_STATUS-and-use-it.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 1 Jun 2017 10:07:50 -0400 +Subject: [PATCH] Add PRIxGRUB_EFI_STATUS and use it. + +This avoids syntax checkers getting confused about if it's llx or lx. + +Signed-off-by: Peter Jones +--- + include/grub/efi/api.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index c1b869db520..daa9268fdaa 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -577,7 +577,16 @@ typedef grub_uint64_t grub_efi_uint64_t; + typedef grub_uint8_t grub_efi_char8_t; + typedef grub_uint16_t grub_efi_char16_t; + ++ + typedef grub_efi_uintn_t grub_efi_status_t; ++/* Make grub_efi_status_t reasonably printable. */ ++#if GRUB_CPU_SIZEOF_VOID_P == 8 ++#define PRIxGRUB_EFI_STATUS "lx" ++#define PRIdGRUB_EFI_STATUS "ld" ++#else ++#define PRIxGRUB_EFI_STATUS "llx" ++#define PRIdGRUB_EFI_STATUS "lld" ++#endif + + /* + * On x86, the EFI calling convention may deviate from the local one, so diff --git a/0048-don-t-use-int-for-efi-status.patch b/0048-don-t-use-int-for-efi-status.patch new file mode 100644 index 0000000..de4367d --- /dev/null +++ b/0048-don-t-use-int-for-efi-status.patch @@ -0,0 +1,22 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 26 Jun 2017 12:44:59 -0400 +Subject: [PATCH] don't use int for efi status + +--- + grub-core/kern/efi/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 885d7c6420e..2bb8a0e7a38 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -177,7 +177,7 @@ grub_reboot (void) + void + grub_exit (int retval) + { +- int rc = GRUB_EFI_LOAD_ERROR; ++ grub_efi_status_t rc = GRUB_EFI_LOAD_ERROR; + + if (retval == 0) + rc = GRUB_EFI_SUCCESS; diff --git a/0048-ppc64le-memory-map.patch b/0048-ppc64le-memory-map.patch deleted file mode 100644 index 8c1669d..0000000 --- a/0048-ppc64le-memory-map.patch +++ /dev/null @@ -1,99 +0,0 @@ -From d704fc209102e64783e1b8b5c13fae1e883b9c93 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:34:22 +0800 -Subject: [PATCH 048/272] ppc64le memory map - -Signed-off-by: Michael Chang ---- - grub-core/kern/ieee1275/init.c | 1 + - grub-core/kern/ieee1275/openfw.c | 29 +++++++++++++++++++++++++++++ - include/grub/ieee1275/ieee1275.h | 7 +++++++ - 3 files changed, 37 insertions(+) - -diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c -index fb7d1a3ba..08f795b09 100644 ---- a/grub-core/kern/ieee1275/init.c -+++ b/grub-core/kern/ieee1275/init.c -@@ -116,6 +116,7 @@ grub_addr_t grub_ieee1275_original_stack; - void - grub_exit (void) - { -+ grub_releasemap(); - grub_ieee1275_exit (); - } - -diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c -index 11b2beb2f..cba4da5a0 100644 ---- a/grub-core/kern/ieee1275/openfw.c -+++ b/grub-core/kern/ieee1275/openfw.c -@@ -302,6 +302,34 @@ grub_ieee1275_map (grub_addr_t phys, grub_addr_t virt, grub_size_t size, - return args.catch_result; - } - -+/* Preallocate IEEE1275_MAX_MAP_RESOURCE map tracks to track the -+ * map regions allocated to us by the firmware. Cannot -+ * dynamically allocate them, since the heap is not set -+ * yet. -+ */ -+struct grub_map_track grub_map_track[IEEE1275_MAX_MAP_RESOURCE]; -+int grub_map_track_index=0; -+ -+void -+grub_releasemap () -+{ -+ int i=0; -+ for (i=grub_map_track_index-1; i >= 0; i--) -+ grub_ieee1275_release(grub_map_track[i].addr, grub_map_track[i].size); -+ grub_map_track_index = 0; -+ return; -+} -+ -+static void -+grub_track_map (grub_addr_t addr, grub_size_t size) -+{ -+ if (grub_map_track_index >= IEEE1275_MAX_MAP_RESOURCE) -+ return; -+ grub_map_track[grub_map_track_index].addr = addr; -+ grub_map_track[grub_map_track_index++].size = size; -+ return; -+} -+ - grub_err_t - grub_claimmap (grub_addr_t addr, grub_size_t size) - { -@@ -317,6 +345,7 @@ grub_claimmap (grub_addr_t addr, grub_size_t size) - return grub_errno; - } - -+ grub_track_map (addr, size); - return GRUB_ERR_NONE; - } - -diff --git a/include/grub/ieee1275/ieee1275.h b/include/grub/ieee1275/ieee1275.h -index eadb84531..362c8bece 100644 ---- a/include/grub/ieee1275/ieee1275.h -+++ b/include/grub/ieee1275/ieee1275.h -@@ -33,6 +33,12 @@ struct grub_ieee1275_mem_region - unsigned int size; - }; - -+#define IEEE1275_MAX_MAP_RESOURCE 10 -+struct grub_map_track { -+ grub_addr_t addr; -+ grub_size_t size; -+}; -+ - #define IEEE1275_MAX_PROP_LEN 8192 - #define IEEE1275_MAX_PATH_LEN 256 - -@@ -232,6 +238,7 @@ char *EXPORT_FUNC(grub_ieee1275_encode_uint4) (grub_ieee1275_ihandle_t ihandle, - int EXPORT_FUNC(grub_ieee1275_get_block_size) (grub_ieee1275_ihandle_t ihandle); - - grub_err_t EXPORT_FUNC(grub_claimmap) (grub_addr_t addr, grub_size_t size); -+void EXPORT_FUNC(grub_releasemap) (void); - - int - EXPORT_FUNC(grub_ieee1275_map) (grub_addr_t phys, grub_addr_t virt, --- -2.41.0 - diff --git a/0049-make-GRUB_MOD_INIT-declare-its-function-prototypes.patch b/0049-make-GRUB_MOD_INIT-declare-its-function-prototypes.patch new file mode 100644 index 0000000..44c0819 --- /dev/null +++ b/0049-make-GRUB_MOD_INIT-declare-its-function-prototypes.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 26 Jun 2017 12:46:23 -0400 +Subject: [PATCH] make GRUB_MOD_INIT() declare its function prototypes. + +--- + include/grub/dl.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/grub/dl.h b/include/grub/dl.h +index cd1f46c8bad..f2bf50eb98d 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -54,6 +54,7 @@ grub_mod_fini (void) + + #define GRUB_MOD_INIT(name) \ + static void grub_mod_init (grub_dl_t mod __attribute__ ((unused))) __attribute__ ((used)); \ ++extern void grub_##name##_init (void); \ + void \ + grub_##name##_init (void) { grub_mod_init (0); } \ + static void \ +@@ -61,6 +62,7 @@ grub_mod_init (grub_dl_t mod __attribute__ ((unused))) + + #define GRUB_MOD_FINI(name) \ + static void grub_mod_fini (void) __attribute__ ((used)); \ ++extern void grub_##name##_fini (void); \ + void \ + grub_##name##_fini (void) { grub_mod_fini (); } \ + static void \ diff --git a/0050-Don-t-guess-boot-efi-as-HFS-on-ppc-machines-in-grub-.patch b/0050-Don-t-guess-boot-efi-as-HFS-on-ppc-machines-in-grub-.patch new file mode 100644 index 0000000..8dfb85f --- /dev/null +++ b/0050-Don-t-guess-boot-efi-as-HFS-on-ppc-machines-in-grub-.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 20 Apr 2017 13:29:06 -0400 +Subject: [PATCH] Don't guess /boot/efi/ as HFS+ on ppc machines in + grub-install + +This should never be trying this, and since we've consolidated the +grubenv to always be on /boot/efi/EFI/fedora/, this code causes it to +always make the wrong decision. + +Resolves: rhbz#1484474 + +Signed-off-by: Peter Jones +--- + util/grub-install.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/util/grub-install.c b/util/grub-install.c +index d3ec2570d1d..66ef9494d9d 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -1234,18 +1234,8 @@ main (int argc, char *argv[]) + char *d; + + is_guess = 1; +- d = grub_util_path_concat (2, bootdir, "macppc"); +- if (!grub_util_is_directory (d)) +- { +- free (d); +- d = grub_util_path_concat (2, bootdir, "efi"); +- } + /* Find the Mac HFS(+) System Partition. */ +- if (!grub_util_is_directory (d)) +- { +- free (d); +- d = grub_util_path_concat (2, bootdir, "EFI"); +- } ++ d = grub_util_path_concat (2, bootdir, "macppc"); + if (!grub_util_is_directory (d)) + { + free (d); diff --git a/0050-ppc64-cas-new-scope.patch b/0050-ppc64-cas-new-scope.patch deleted file mode 100644 index f0d3a6b..0000000 --- a/0050-ppc64-cas-new-scope.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 577c6adc253866961c38884cea8eca145dd0a022 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:40:45 +0800 -Subject: [PATCH 050/272] ppc64 cas new scope - -Signed-off-by: Michael Chang ---- - grub-core/normal/main.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index baa63b2ed..e99d25bef 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -283,10 +283,11 @@ grub_normal_execute (const char *config, int nested, int batch) - int boot; - boot = 0; - char *script; -+ char *dummy[1] = { NULL }; - script = grub_malloc (1024); - if (! grub_ieee1275_cas_reboot (script)) - { -- if (! grub_script_execute_sourcecode (script)) -+ if (! grub_script_execute_new_scope (script, 0, dummy)) - boot = 1; - } - grub_free (script); --- -2.41.0 - diff --git a/0208-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch b/0051-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch similarity index 74% rename from 0208-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch rename to 0051-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch index 26e1158..026fe5e 100644 --- a/0208-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch +++ b/0051-20_linux_xen-load-xen-or-multiboot-2-modules-as-need.patch @@ -1,8 +1,7 @@ -From 0be3c13f9329a288037b48d9a1cd93e580b4daa9 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 9 Jul 2019 14:31:19 +0200 -Subject: [PATCH 208/272] 20_linux_xen: load xen or multiboot{,2} modules as - needed. +Subject: [PATCH] 20_linux_xen: load xen or multiboot{,2} modules as needed. Signed-off-by: Peter Jones --- @@ -10,26 +9,26 @@ Signed-off-by: Peter Jones 1 file changed, 5 insertions(+) diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 7c106b247..57ef14bc7 100644 +index efcded0fbb4..4ecf5deea17 100644 --- a/util/grub.d/20_linux_xen.in +++ b/util/grub.d/20_linux_xen.in -@@ -268,6 +268,7 @@ linux_entry_xsm () +@@ -156,6 +156,7 @@ linux_entry_xsm () else xen_rm_opts="no-real-mode edd=off" fi -+ insmod ${xen_module} ++ insmod ${xen_module} ${xen_loader} ${rel_xen_dirname}/${xen_basename} placeholder ${xen_args} \${xen_rm_opts} echo '$(echo "$lmessage" | grub_quote)' - ${module_loader} ${rel_dirname}/${basename} placeholder ${root_device} ${args} -@@ -280,6 +281,7 @@ EOF + ${module_loader} ${rel_dirname}/${basename} placeholder root=${linux_root_device_thisversion} ro ${args} +@@ -168,6 +169,7 @@ EOF initrd_path="${rel_dirname}/${i}" sed "s/^/$submenu_indentation/" << EOF echo '$(echo "$message" | grub_quote)' -+ insmod ${xen_module} ++ insmod ${xen_module} ${module_loader} --nounzip $(echo $initrd_path) EOF done -@@ -470,13 +472,16 @@ for current_xen in ${reverse_sorted_xen_list}; do +@@ -269,13 +271,16 @@ for current_xen in ${reverse_sorted_xen_list}; do echo " submenu '$(gettext_printf "Xen hypervisor, version %s" "${xen_version}" | grub_quote)' \$menuentry_id_option 'xen-hypervisor-$xen_version-$boot_device_id' {" fi if ($grub_file --is-arm64-efi $current_xen); then @@ -46,6 +45,3 @@ index 7c106b247..57ef14bc7 100644 xen_loader="multiboot" module_loader="module" fi --- -2.41.0 - diff --git a/0051-ppc64-cas-fix-double-free.patch b/0051-ppc64-cas-fix-double-free.patch deleted file mode 100644 index f606319..0000000 --- a/0051-ppc64-cas-fix-double-free.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 963dc5ec30ef751ba6cfd4a400be451fcae536ac Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:41:21 +0800 -Subject: [PATCH 051/272] ppc64 cas fix double free - -Signed-off-by: Michael Chang ---- - grub-core/kern/ieee1275/openfw.c | 42 ++++++++++++++++++++++++-------- - grub-core/normal/main.c | 5 ++-- - include/grub/ieee1275/ieee1275.h | 2 +- - 3 files changed, 35 insertions(+), 14 deletions(-) - -diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c -index af3d844c0..f93d323eb 100644 ---- a/grub-core/kern/ieee1275/openfw.c -+++ b/grub-core/kern/ieee1275/openfw.c -@@ -595,7 +595,7 @@ grub_ieee1275_canonicalise_devname (const char *path) - - /* Check if it's a CAS reboot. If so, set the script to be executed. */ - int --grub_ieee1275_cas_reboot (char *script) -+grub_ieee1275_cas_reboot (char **script) - { - grub_uint32_t ibm_ca_support_reboot; - grub_uint32_t ibm_fw_nbr_reboots; -@@ -628,16 +628,37 @@ grub_ieee1275_cas_reboot (char *script) - - if (ibm_ca_support_reboot || ibm_fw_nbr_reboots) - { -- if (! grub_ieee1275_get_property_length (options, "boot-last-label", &actual)) -- { -- if (actual > 1024) -- script = grub_realloc (script, actual + 1); -- grub_ieee1275_get_property (options, "boot-last-label", script, actual, -- &actual); -- return 0; -- } -+ grub_ssize_t len; -+ char *buf; -+ -+ if (grub_ieee1275_get_property_length (options, "boot-last-label", &len) -+ || len <= 0) -+ { -+ grub_dprintf ("ieee1275", "boot-last-label missing or invalid\n"); -+ goto out; -+ } -+ /* The returned property string length may not include terminating null byte, and in -+ a bid to avoid out of bound access we allocate one more byte to add it back */ -+ buf = grub_malloc ((grub_size_t)len + 1); -+ if (!buf) -+ { -+ grub_print_error (); -+ goto out; -+ } -+ if (grub_ieee1275_get_property (options, "boot-last-label", buf, (grub_size_t)len + 1, &actual) -+ || actual < 0) -+ { -+ grub_dprintf ("ieee1275", "error while get boot-last-label property\n"); -+ grub_free (buf); -+ goto out; -+ } -+ /* Add terminating null byte */ -+ buf[len] = '\0'; -+ *script = buf; -+ return 0; - } - -+out: - grub_ieee1275_set_boot_last_label (""); - - return -1; -@@ -651,8 +672,9 @@ int grub_ieee1275_set_boot_last_label (const char *text) - grub_dprintf("ieee1275", "set boot_last_label (size: %" PRIxGRUB_SIZE ")\n", grub_strlen(text)); - if (! grub_ieee1275_finddevice ("/options", &options) && - options != (grub_ieee1275_ihandle_t) -1) -+ /* To be on the safe side, set the property string with terminating null byte */ - grub_ieee1275_set_property (options, "boot-last-label", text, -- grub_strlen (text), &actual); -+ grub_strlen (text) + 1, &actual); - return 0; - } - -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index e99d25bef..b5e17344b 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -282,10 +282,9 @@ grub_normal_execute (const char *config, int nested, int batch) - #ifdef GRUB_MACHINE_IEEE1275 - int boot; - boot = 0; -- char *script; -+ char *script = NULL; - char *dummy[1] = { NULL }; -- script = grub_malloc (1024); -- if (! grub_ieee1275_cas_reboot (script)) -+ if (! grub_ieee1275_cas_reboot (&script) && script) - { - if (! grub_script_execute_new_scope (script, 0, dummy)) - boot = 1; -diff --git a/include/grub/ieee1275/ieee1275.h b/include/grub/ieee1275/ieee1275.h -index a99bb210f..ea90d79f7 100644 ---- a/include/grub/ieee1275/ieee1275.h -+++ b/include/grub/ieee1275/ieee1275.h -@@ -260,7 +260,7 @@ int EXPORT_FUNC(grub_ieee1275_devalias_next) (struct grub_ieee1275_devalias *ali - void EXPORT_FUNC(grub_ieee1275_children_peer) (struct grub_ieee1275_devalias *alias); - void EXPORT_FUNC(grub_ieee1275_children_first) (const char *devpath, - struct grub_ieee1275_devalias *alias); --int EXPORT_FUNC(grub_ieee1275_cas_reboot) (char *script); -+int EXPORT_FUNC(grub_ieee1275_cas_reboot) (char **script); - int EXPORT_FUNC(grub_ieee1275_set_boot_last_label) (const char *text); - - char *EXPORT_FUNC(grub_ieee1275_get_boot_dev) (void); --- -2.41.0 - diff --git a/0052-align-struct-efi_variable-better.patch b/0052-align-struct-efi_variable-better.patch new file mode 100644 index 0000000..24c3237 --- /dev/null +++ b/0052-align-struct-efi_variable-better.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 27 Feb 2018 13:55:35 -0500 +Subject: [PATCH] align struct efi_variable better... + +--- + include/grub/efiemu/runtime.h | 2 +- + include/grub/types.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/grub/efiemu/runtime.h b/include/grub/efiemu/runtime.h +index 2ff42984545..6363fd522e1 100644 +--- a/include/grub/efiemu/runtime.h ++++ b/include/grub/efiemu/runtime.h +@@ -33,5 +33,5 @@ struct efi_variable + grub_uint32_t namelen; + grub_uint32_t size; + grub_efi_uint32_t attributes; +-} GRUB_PACKED; ++} GRUB_PACKED GRUB_ALIGNED(8); + #endif /* ! GRUB_EFI_EMU_RUNTIME_HEADER */ +diff --git a/include/grub/types.h b/include/grub/types.h +index 064066e2e18..59e030268c2 100644 +--- a/include/grub/types.h ++++ b/include/grub/types.h +@@ -30,6 +30,7 @@ + #else + #define GRUB_PACKED __attribute__ ((packed)) + #endif ++#define GRUB_ALIGNED(x) __attribute__((aligned (x))) + + #ifdef GRUB_BUILD + # define GRUB_CPU_SIZEOF_VOID_P BUILD_SIZEOF_VOID_P diff --git a/0052-grub-install-remove-useless-check-PReP-partition-is-.patch b/0052-grub-install-remove-useless-check-PReP-partition-is-.patch deleted file mode 100644 index 8a3f1ab..0000000 --- a/0052-grub-install-remove-useless-check-PReP-partition-is-.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 1657812278bb086ca31dc4af24dd0e1627504869 Mon Sep 17 00:00:00 2001 -From: Michal Suchanek -Date: Tue, 31 Oct 2017 14:28:54 +0100 -Subject: [PATCH 052/272] grub-install: remove useless check PReP partition is - empty. - -References: bsc#1065738 - -The grub-install rewrite in commit cd46aa6cefab checks that the PPeP -partition does not install an ELF binary before writing grub to it. This -causes regression in installer scripts that expect to be able to -reinstall bootloaders without first witping the partition by hand. - -Fixes: cd46aa6cefab ("Rewrite grub-install, grub-mkrescue, - grub-mkstandalone and grub-mknetdir ") ---- - util/grub-install.c | 43 +++---------------------------------------- - 1 file changed, 3 insertions(+), 40 deletions(-) - -diff --git a/util/grub-install.c b/util/grub-install.c -index 1d2bf4dd3..036a66dc6 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -746,34 +746,6 @@ is_prep_partition (grub_device_t dev) - return 0; - } - --static int --is_prep_empty (grub_device_t dev) --{ -- grub_disk_addr_t dsize, addr; -- grub_uint32_t buffer[32768]; -- -- dsize = grub_disk_native_sectors (dev->disk); -- for (addr = 0; addr < dsize; -- addr += sizeof (buffer) / GRUB_DISK_SECTOR_SIZE) -- { -- grub_size_t sz = sizeof (buffer); -- grub_uint32_t *ptr; -- -- if (sizeof (buffer) / GRUB_DISK_SECTOR_SIZE > dsize - addr) -- sz = (dsize - addr) * GRUB_DISK_SECTOR_SIZE; -- grub_disk_read (dev->disk, addr, 0, sz, buffer); -- -- if (addr == 0 && grub_memcmp (buffer, ELFMAG, SELFMAG) == 0) -- return 1; -- -- for (ptr = buffer; ptr < buffer + sz / sizeof (*buffer); ptr++) -- if (*ptr) -- return 0; -- } -- -- return 1; --} -- - static void - bless (grub_device_t dev, const char *path, int x86) - { -@@ -1942,18 +1914,9 @@ main (int argc, char *argv[]) - { - grub_util_error ("%s", _("the chosen partition is not a PReP partition")); - } -- if (is_prep_empty (ins_dev)) -- { -- if (write_to_disk (ins_dev, imgfile)) -- grub_util_error ("%s", _("failed to copy Grub to the PReP partition")); -- grub_set_install_backup_ponr (); -- } -- else -- { -- char *s = xasprintf ("dd if=/dev/zero of=%s", install_device); -- grub_util_error (_("the PReP partition is not empty. If you are sure you want to use it, run dd to clear it: `%s'"), -- s); -- } -+ if (write_to_disk (ins_dev, imgfile)) -+ grub_util_error ("%s", _("failed to copy Grub to the PReP partition")); -+ grub_set_install_backup_ponr (); - grub_device_close (ins_dev); - if (update_nvram) - grub_install_register_ieee1275 (1, grub_util_get_os_disk (install_device), --- -2.41.0 - diff --git a/0196-Add-BLS-support-to-grub-mkconfig.patch b/0053-Add-BLS-support-to-grub-mkconfig.patch similarity index 91% rename from 0196-Add-BLS-support-to-grub-mkconfig.patch rename to 0053-Add-BLS-support-to-grub-mkconfig.patch index 6cbdcb0..6b60ee7 100644 --- a/0196-Add-BLS-support-to-grub-mkconfig.patch +++ b/0053-Add-BLS-support-to-grub-mkconfig.patch @@ -1,7 +1,7 @@ -From e1070637adb9aeccc97813545e7306dbbb11a52d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 9 Dec 2016 15:40:29 -0500 -Subject: [PATCH 196/272] Add BLS support to grub-mkconfig +Subject: [PATCH] Add BLS support to grub-mkconfig GRUB now has BootLoaderSpec support, the user can choose to use this by setting GRUB_ENABLE_BLSCFG to true in /etc/default/grub. On this setup, @@ -28,15 +28,15 @@ Signed-off-by: Ian Wienand Signed-off-by: Robbie Harwood --- util/grub-mkconfig.in | 9 +- - util/grub-mkconfig_lib.in | 22 +++- - util/grub.d/10_linux.in | 218 +++++++++++++++++++++++++++++++++++++- + util/grub-mkconfig_lib.in | 22 ++++- + util/grub.d/10_linux.in | 218 +++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 243 insertions(+), 6 deletions(-) diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index bc2108e6e..a4a3da060 100644 +index 884e4d363ca..bec52e052fc 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -49,6 +49,8 @@ grub_script_check="${bindir}/@grub_script_check@" +@@ -50,6 +50,8 @@ grub_get_kernel_settings="${sbindir}/@grub_get_kernel_settings@" export TEXTDOMAIN=@PACKAGE@ export TEXTDOMAINDIR="@localedir@" @@ -45,7 +45,7 @@ index bc2108e6e..a4a3da060 100644 . "${pkgdatadir}/grub-mkconfig_lib" # Usage: usage -@@ -58,6 +60,7 @@ usage () { +@@ -59,6 +61,7 @@ usage () { gettext "Generate a grub config file"; echo echo print_option_help "-o, --output=$(gettext FILE)" "$(gettext "output generated config to FILE [default=stdout]")" @@ -53,7 +53,7 @@ index bc2108e6e..a4a3da060 100644 print_option_help "-h, --help" "$(gettext "print this message and exit")" print_option_help "-V, --version" "$(gettext "print the version information and exit")" echo -@@ -93,6 +96,9 @@ do +@@ -94,6 +97,9 @@ do --output=*) grub_cfg=`echo "$option" | sed 's/--output=//'` ;; @@ -63,18 +63,18 @@ index bc2108e6e..a4a3da060 100644 -*) gettext_printf "Unrecognized option \`%s'\n" "$option" 1>&2 usage -@@ -299,7 +305,8 @@ export GRUB_DEFAULT \ +@@ -257,7 +263,8 @@ export GRUB_DEFAULT \ GRUB_OS_PROBER_SKIP_LIST \ GRUB_DISABLE_SUBMENU \ - SUSE_BTRFS_SNAPSHOT_BOOTING \ -- SUSE_CMDLINE_XENEFI -+ SUSE_CMDLINE_XENEFI \ + GRUB_DEFAULT_DTB \ +- SUSE_BTRFS_SNAPSHOT_BOOTING ++ SUSE_BTRFS_SNAPSHOT_BOOTING \ + GRUB_ENABLE_BLSCFG if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in -index 9a0bff7be..a4145d435 100644 +index 0ba0e0e1c65..c2e107b41ab 100644 --- a/util/grub-mkconfig_lib.in +++ b/util/grub-mkconfig_lib.in @@ -30,6 +30,9 @@ fi @@ -87,7 +87,7 @@ index 9a0bff7be..a4145d435 100644 if test "x$grub_mkrelpath" = x; then grub_mkrelpath="${bindir}/@grub_mkrelpath@" fi -@@ -123,8 +126,19 @@ EOF +@@ -122,8 +125,19 @@ EOF fi } @@ -107,7 +107,7 @@ index 9a0bff7be..a4145d435 100644 old_ifs="$IFS" IFS=' ' -@@ -159,18 +173,18 @@ prepare_grub_to_access_device () +@@ -158,18 +172,18 @@ prepare_grub_to_access_device () # otherwise set root as per value in device.map. fs_hint="`"${grub_probe}" --device $@ --target=compatibility_hint`" if [ "x$fs_hint" != x ]; then @@ -131,14 +131,13 @@ index 9a0bff7be..a4145d435 100644 fi IFS="$old_ifs" diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 2ae87c8ee..7e922ffe4 100644 +index 48ff32c1da4..cd9aea0cc01 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -83,6 +83,219 @@ case x"$GRUB_FS" in - LINUX_ROOT_DEVICE="ZFS=${rpool}${bootfs%/}" +@@ -84,6 +84,218 @@ case x"$GRUB_FS" in ;; esac -+ + +populate_header_warn() +{ +if [ "x${BLS_POPULATE_MENU}" = "xtrue" ]; then @@ -354,7 +353,7 @@ index 2ae87c8ee..7e922ffe4 100644 mktitle () { local title_type -@@ -127,6 +340,7 @@ linux_entry () +@@ -123,6 +335,7 @@ linux_entry () if [ -z "$boot_device_id" ]; then boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" fi @@ -362,7 +361,15 @@ index 2ae87c8ee..7e922ffe4 100644 if [ x$type != xsimple ] ; then title=$(mktitle "$type" "$version") if [ x"$title" = x"$GRUB_ACTUAL_DEFAULT" ] || [ x"Previous Linux versions>$title" = x"$GRUB_ACTUAL_DEFAULT" ]; then -@@ -321,7 +535,9 @@ for linux in ${reverse_sorted_list}; do +@@ -243,6 +456,7 @@ fi + is_top_level=true + for linux in ${reverse_sorted_list}; do + gettext_printf "Found linux image: %s\n" "$linux" >&2 ++ + basename=`basename $linux` + dirname=`dirname $linux` + rel_dirname=`make_system_path_relative_to_its_root $dirname` +@@ -283,7 +497,9 @@ for linux in ${reverse_sorted_list}; do for i in ${initrd}; do initrd_display="${initrd_display} ${dirname}/${i}" done @@ -372,7 +379,4 @@ index 2ae87c8ee..7e922ffe4 100644 + fi fi - config= --- -2.41.0 - + fdt= diff --git a/0053-efi-gop-avoid-low-resolution.patch b/0053-efi-gop-avoid-low-resolution.patch deleted file mode 100644 index f18ab5a..0000000 --- a/0053-efi-gop-avoid-low-resolution.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 8653a0c4fc7008baeeb8f4e0cfcab6c16df49db8 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 16:43:08 +0800 -Subject: [PATCH 053/272] efi gop avoid low resolution - -Signed-off-by: Michael Chang ---- - grub-core/video/efi_gop.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/grub-core/video/efi_gop.c b/grub-core/video/efi_gop.c -index 9452f5e58..4184bac2c 100644 ---- a/grub-core/video/efi_gop.c -+++ b/grub-core/video/efi_gop.c -@@ -358,6 +358,7 @@ grub_video_gop_setup (unsigned int width, unsigned int height, - grub_err_t err; - unsigned bpp; - int found = 0; -+ int avoid_low_resolution = 1; - unsigned long long best_volume = 0; - unsigned int preferred_width = 0, preferred_height = 0; - grub_uint8_t *buffer; -@@ -376,8 +377,11 @@ grub_video_gop_setup (unsigned int width, unsigned int height, - } - } - -+again: - /* Keep current mode if possible. */ -- if (gop->mode->info) -+ if (gop->mode->info && -+ (!avoid_low_resolution || -+ (gop->mode->info->width >= 800 && gop->mode->info->height >= 600))) - { - bpp = grub_video_gop_get_bpp (gop->mode->info); - if (bpp && ((width == gop->mode->info->width -@@ -450,6 +454,11 @@ grub_video_gop_setup (unsigned int width, unsigned int height, - - if (!found) - { -+ if (avoid_low_resolution && gop->mode->info) -+ { -+ avoid_low_resolution = 0; -+ goto again; -+ } - grub_dprintf ("video", "GOP: no mode found\n"); - return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching mode found"); - } --- -2.41.0 - diff --git a/0054-Don-t-attempt-to-backtrace-on-grub_abort-for-grub-em.patch b/0054-Don-t-attempt-to-backtrace-on-grub_abort-for-grub-em.patch new file mode 100644 index 0000000..4b925a5 --- /dev/null +++ b/0054-Don-t-attempt-to-backtrace-on-grub_abort-for-grub-em.patch @@ -0,0 +1,26 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 6 Feb 2018 11:16:28 +0100 +Subject: [PATCH] Don't attempt to backtrace on grub_abort() for grub-emu + +The emu platform doesn't have a grub_backtrace() implementation, so this +causes a build error. Don't attempt to call this when building grub-emu. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/kern/misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 465a8e74ea7..b1d399d37d7 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -1303,7 +1303,7 @@ void __attribute__ ((noreturn)) + grub_abort (void) + { + #ifndef GRUB_UTIL +-#if defined(__i386__) || defined(__x86_64__) ++#if (defined(__i386__) || defined(__x86_64__)) && !defined(GRUB_MACHINE_EMU) + grub_backtrace(); + #endif + #endif diff --git a/0197-Add-grub2-switch-to-blscfg.patch b/0055-Add-grub2-switch-to-blscfg.patch similarity index 95% rename from 0197-Add-grub2-switch-to-blscfg.patch rename to 0055-Add-grub2-switch-to-blscfg.patch index 921ec78..cb97a28 100644 --- a/0197-Add-grub2-switch-to-blscfg.patch +++ b/0055-Add-grub2-switch-to-blscfg.patch @@ -1,7 +1,7 @@ -From 12f6b5cfe58b644c3cbb054f974f69d1d1f6ecb4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 15 Mar 2018 14:12:40 -0400 -Subject: [PATCH 197/272] Add grub2-switch-to-blscfg +Subject: [PATCH] Add grub2-switch-to-blscfg Signed-off-by: Peter Jones Signed-off-by: Javier Martinez Canillas @@ -13,17 +13,17 @@ Signed-off-by: Robbie Harwood Makefile.util.def | 7 + docs/man/grub-switch-to-blscfg.h2m | 2 + util/grub-set-password.in | 2 +- - util/grub-switch-to-blscfg.in | 317 +++++++++++++++++++++++++++++ + util/grub-switch-to-blscfg.in | 317 +++++++++++++++++++++++++++++++++++++ util/grub.d/10_linux.in | 2 +- 5 files changed, 328 insertions(+), 2 deletions(-) create mode 100644 docs/man/grub-switch-to-blscfg.h2m create mode 100644 util/grub-switch-to-blscfg.in diff --git a/Makefile.util.def b/Makefile.util.def -index 4839076d9..a3429e3a9 100644 +index 84a17ef5cfa..acbcc8c208c 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -1411,6 +1411,13 @@ program = { +@@ -1387,6 +1387,13 @@ program = { ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; }; @@ -39,27 +39,27 @@ index 4839076d9..a3429e3a9 100644 mansection = 1; diff --git a/docs/man/grub-switch-to-blscfg.h2m b/docs/man/grub-switch-to-blscfg.h2m new file mode 100644 -index 000000000..fa341426a +index 00000000000..fa341426a50 --- /dev/null +++ b/docs/man/grub-switch-to-blscfg.h2m @@ -0,0 +1,2 @@ +[NAME] +grub-switch-to-blscfg \- switch to using BLS config files diff --git a/util/grub-set-password.in b/util/grub-set-password.in -index c0b5ebbfd..889923e76 100644 +index 5ebf50576d6..c0b5ebbfdc5 100644 --- a/util/grub-set-password.in +++ b/util/grub-set-password.in @@ -1,6 +1,6 @@ #!/bin/sh -e --EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') -+EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/\"//g') +-EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/') ++EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') if [ -d /sys/firmware/efi/efivars/ ]; then grubdir=`echo "/@bootdirname@/efi/EFI/${EFIDIR}/" | sed 's,//*,/,g'` else diff --git a/util/grub-switch-to-blscfg.in b/util/grub-switch-to-blscfg.in new file mode 100644 -index 000000000..218e55a84 +index 00000000000..a851424beb2 --- /dev/null +++ b/util/grub-switch-to-blscfg.in @@ -0,0 +1,317 @@ @@ -105,7 +105,7 @@ index 000000000..218e55a84 + +eval "$("${grub_get_kernel_settings}")" || true + -+EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/\"//g') ++EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') +if [ -d /sys/firmware/efi/efivars/ ]; then + startlink=/etc/grub2-efi.cfg + grubdir=`echo "/@bootdirname@/efi/EFI/${EFIDIR}/" | sed 's,//*,/,g'` @@ -381,7 +381,7 @@ index 000000000..218e55a84 +# Bye. +exit 0 diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 7e922ffe4..887892622 100644 +index cd9aea0cc01..b8bc37e92aa 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -140,7 +140,7 @@ blsdir="/boot/loader/entries" @@ -393,6 +393,3 @@ index 7e922ffe4..887892622 100644 return fi --- -2.41.0 - diff --git a/0056-normal-don-t-draw-our-startup-message-if-debug-is-se.patch b/0056-normal-don-t-draw-our-startup-message-if-debug-is-se.patch new file mode 100644 index 0000000..7b26166 --- /dev/null +++ b/0056-normal-don-t-draw-our-startup-message-if-debug-is-se.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 9 Nov 2017 15:58:52 -0500 +Subject: [PATCH] normal: don't draw our startup message if debug is set + +--- + grub-core/normal/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 3463f444f74..b5fa6156549 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -430,6 +430,9 @@ grub_normal_reader_init (int nested) + const char *msg_esc = _("ESC at any time exits."); + char *msg_formatted; + ++ if (grub_env_get ("debug") != NULL) ++ return 0; ++ + msg_formatted = grub_xasprintf (_("Minimal BASH-like line editing is supported. For " + "the first word, TAB lists possible command completions. Anywhere " + "else TAB lists possible device or file completions. To enable " diff --git a/0209-Work-around-some-minor-include-path-weirdnesses.patch b/0057-Work-around-some-minor-include-path-weirdnesses.patch similarity index 95% rename from 0209-Work-around-some-minor-include-path-weirdnesses.patch rename to 0057-Work-around-some-minor-include-path-weirdnesses.patch index 86c7ed8..460d792 100644 --- a/0209-Work-around-some-minor-include-path-weirdnesses.patch +++ b/0057-Work-around-some-minor-include-path-weirdnesses.patch @@ -1,7 +1,7 @@ -From c04be57d0ab24121643fc8e0570f95fae6893be8 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 16 Mar 2018 13:28:57 -0400 -Subject: [PATCH 209/272] Work around some minor include path weirdnesses +Subject: [PATCH] Work around some minor include path weirdnesses Signed-off-by: Peter Jones --- @@ -17,7 +17,7 @@ Signed-off-by: Peter Jones diff --git a/include/grub/arm/efi/console.h b/include/grub/arm/efi/console.h new file mode 100644 -index 000000000..1592f6f76 +index 00000000000..1592f6f76b5 --- /dev/null +++ b/include/grub/arm/efi/console.h @@ -0,0 +1,24 @@ @@ -47,7 +47,7 @@ index 000000000..1592f6f76 +#endif /* ! GRUB_ARM_EFI_CONSOLE_H */ diff --git a/include/grub/arm64/efi/console.h b/include/grub/arm64/efi/console.h new file mode 100644 -index 000000000..956893393 +index 00000000000..95689339384 --- /dev/null +++ b/include/grub/arm64/efi/console.h @@ -0,0 +1,24 @@ @@ -77,7 +77,7 @@ index 000000000..956893393 +#endif /* ! GRUB_ARM64_EFI_CONSOLE_H */ diff --git a/include/grub/i386/efi/console.h b/include/grub/i386/efi/console.h new file mode 100644 -index 000000000..9231375cb +index 00000000000..9231375cb07 --- /dev/null +++ b/include/grub/i386/efi/console.h @@ -0,0 +1,24 @@ @@ -107,7 +107,7 @@ index 000000000..9231375cb +#endif /* ! GRUB_I386_EFI_CONSOLE_H */ diff --git a/include/grub/x86_64/efi/console.h b/include/grub/x86_64/efi/console.h new file mode 100644 -index 000000000..dba9d8678 +index 00000000000..dba9d8678d0 --- /dev/null +++ b/include/grub/x86_64/efi/console.h @@ -0,0 +1,24 @@ @@ -135,6 +135,3 @@ index 000000000..dba9d8678 +#include + +#endif /* ! GRUB_X86_64_EFI_CONSOLE_H */ --- -2.41.0 - diff --git a/0210-Make-it-possible-to-enabled-build-id-sha1.patch b/0058-Make-it-possible-to-enabled-build-id-sha1.patch similarity index 87% rename from 0210-Make-it-possible-to-enabled-build-id-sha1.patch rename to 0058-Make-it-possible-to-enabled-build-id-sha1.patch index 8f9b6d0..201081d 100644 --- a/0210-Make-it-possible-to-enabled-build-id-sha1.patch +++ b/0058-Make-it-possible-to-enabled-build-id-sha1.patch @@ -1,16 +1,36 @@ -From 2aa94f1b92520b02877731b9d21e7c6bdc0e3507 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 25 Jun 2015 15:41:06 -0400 -Subject: [PATCH 210/272] Make it possible to enabled --build-id=sha1 +Subject: [PATCH] Make it possible to enabled --build-id=sha1 Signed-off-by: Peter Jones --- - acinclude.m4 | 19 +++++++++++++++++++ configure.ac | 8 ++++++++ + acinclude.m4 | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+) +diff --git a/configure.ac b/configure.ac +index 3602b4ab62b..fcfbcbb664d 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1540,7 +1540,15 @@ grub_PROG_TARGET_CC + if test "x$TARGET_APPLE_LINKER" != x1 ; then + grub_PROG_OBJCOPY_ABSOLUTE + fi ++ ++AC_ARG_ENABLE([build-id], ++ [AS_HELP_STRING([--enable-build-id], ++ [ask the linker to supply build-id notes (default=no)])]) ++if test x$enable_build_id = xyes; then ++grub_PROG_LD_BUILD_ID_SHA1 ++else + grub_PROG_LD_BUILD_ID_NONE ++fi + if test "x$target_cpu" = xi386; then + if test "$platform" != emu && test "x$TARGET_APPLE_LINKER" != x1 ; then + if test ! -z "$TARGET_IMG_LDSCRIPT"; then diff --git a/acinclude.m4 b/acinclude.m4 -index fa7840f09..0231e64e3 100644 +index fa7840f09af..0231e64e337 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -136,6 +136,25 @@ if test "x$grub_cv_prog_ld_build_id_none" = xyes; then @@ -39,26 +59,3 @@ index fa7840f09..0231e64e3 100644 dnl Check nm AC_DEFUN([grub_PROG_NM_WORKS], [AC_MSG_CHECKING([whether nm works]) -diff --git a/configure.ac b/configure.ac -index 13c23052a..b492dd7fa 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1541,7 +1541,15 @@ grub_PROG_TARGET_CC - if test "x$TARGET_APPLE_LINKER" != x1 ; then - grub_PROG_OBJCOPY_ABSOLUTE - fi -+ -+AC_ARG_ENABLE([build-id], -+ [AS_HELP_STRING([--enable-build-id], -+ [ask the linker to supply build-id notes (default=no)])]) -+if test x$enable_build_id = xyes; then -+grub_PROG_LD_BUILD_ID_SHA1 -+else - grub_PROG_LD_BUILD_ID_NONE -+fi - if test "x$target_cpu" = xi386; then - if test "$platform" != emu && test "x$TARGET_APPLE_LINKER" != x1 ; then - if test ! -z "$TARGET_IMG_LDSCRIPT"; then --- -2.41.0 - diff --git a/0059-make-better-backtraces.patch b/0059-make-better-backtraces.patch new file mode 100644 index 0000000..d7f64a6 --- /dev/null +++ b/0059-make-better-backtraces.patch @@ -0,0 +1,906 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 9 Jul 2019 17:05:03 +0200 +Subject: [PATCH] make better backtraces + +Signed-off-by: Peter Jones +--- + Makefile.util.def | 6 ++ + grub-core/Makefile.core.def | 16 ++-- + grub-core/{lib => commands}/backtrace.c | 2 +- + grub-core/gdb/cstub.c | 1 - + grub-core/kern/arm64/backtrace.c | 94 ++++++++++++++++++++++++ + grub-core/kern/backtrace.c | 97 +++++++++++++++++++++++++ + grub-core/kern/dl.c | 45 ++++++++++++ + grub-core/kern/i386/backtrace.c | 125 ++++++++++++++++++++++++++++++++ + grub-core/kern/i386/pc/init.c | 4 +- + grub-core/kern/ieee1275/init.c | 1 - + grub-core/kern/misc.c | 11 +-- + grub-core/kern/mm.c | 6 +- + grub-core/lib/arm64/backtrace.c | 62 ---------------- + grub-core/lib/i386/backtrace.c | 78 -------------------- + include/grub/backtrace.h | 10 ++- + include/grub/dl.h | 2 + + include/grub/kernel.h | 3 + + grub-core/kern/arm/efi/startup.S | 2 + + grub-core/kern/arm/startup.S | 2 + + grub-core/kern/arm64/efi/startup.S | 2 + + grub-core/kern/i386/qemu/startup.S | 3 +- + grub-core/kern/ia64/efi/startup.S | 3 +- + grub-core/kern/sparc64/ieee1275/crt0.S | 3 +- + grub-core/Makefile.am | 1 + + 24 files changed, 413 insertions(+), 166 deletions(-) + rename grub-core/{lib => commands}/backtrace.c (98%) + create mode 100644 grub-core/kern/arm64/backtrace.c + create mode 100644 grub-core/kern/backtrace.c + create mode 100644 grub-core/kern/i386/backtrace.c + delete mode 100644 grub-core/lib/arm64/backtrace.c + delete mode 100644 grub-core/lib/i386/backtrace.c + +diff --git a/Makefile.util.def b/Makefile.util.def +index acbcc8c208c..1079add5bbe 100644 +--- a/Makefile.util.def ++++ b/Makefile.util.def +@@ -51,6 +51,12 @@ library = { + common = grub-core/partmap/msdos.c; + common = grub-core/fs/proc.c; + common = grub-core/fs/archelp.c; ++ common = grub-core/kern/backtrace.c; ++ ++ x86 = grub-core/kern/i386/backtrace.c; ++ i386_xen = grub-core/kern/i386/backtrace.c; ++ x86_64_xen = grub-core/kern/i386/backtrace.c; ++ arm64 = grub-core/kern/arm64/backtrace.c; + }; + + library = { +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 63f053b3add..6645fbae34f 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -153,6 +153,12 @@ kernel = { + common = kern/rescue_reader.c; + common = kern/term.c; + common = kern/verifiers.c; ++ common = kern/backtrace.c; ++ ++ x86 = kern/i386/backtrace.c; ++ i386_xen = kern/i386/backtrace.c; ++ x86_64_xen = kern/i386/backtrace.c; ++ arm64 = kern/arm64/backtrace.c; + + noemu = kern/compiler-rt.c; + noemu = kern/mm.c; +@@ -199,9 +205,6 @@ kernel = { + + softdiv = lib/division.c; + +- x86 = lib/i386/backtrace.c; +- x86 = lib/backtrace.c; +- + i386 = kern/i386/dl.c; + i386_xen = kern/i386/dl.c; + i386_xen_pvh = kern/i386/dl.c; +@@ -2455,15 +2458,12 @@ module = { + + module = { + name = backtrace; +- x86 = lib/i386/backtrace.c; +- i386_xen_pvh = lib/i386/backtrace.c; +- i386_xen = lib/i386/backtrace.c; +- x86_64_xen = lib/i386/backtrace.c; +- common = lib/backtrace.c; ++ common = commands/backtrace.c; + enable = x86; + enable = i386_xen_pvh; + enable = i386_xen; + enable = x86_64_xen; ++ enable = arm64; + }; + + module = { +diff --git a/grub-core/lib/backtrace.c b/grub-core/commands/backtrace.c +similarity index 98% +rename from grub-core/lib/backtrace.c +rename to grub-core/commands/backtrace.c +index c0ad6ab8be1..8b5ec3913b5 100644 +--- a/grub-core/lib/backtrace.c ++++ b/grub-core/commands/backtrace.c +@@ -54,7 +54,7 @@ grub_cmd_backtrace (grub_command_t cmd __attribute__ ((unused)), + int argc __attribute__ ((unused)), + char **args __attribute__ ((unused))) + { +- grub_backtrace (); ++ grub_backtrace (1); + return 0; + } + +diff --git a/grub-core/gdb/cstub.c b/grub-core/gdb/cstub.c +index b64acd70fee..99281472d36 100644 +--- a/grub-core/gdb/cstub.c ++++ b/grub-core/gdb/cstub.c +@@ -215,7 +215,6 @@ grub_gdb_trap (int trap_no) + grub_printf ("Unhandled exception 0x%x at ", trap_no); + grub_backtrace_print_address ((void *) grub_gdb_regs[PC]); + grub_printf ("\n"); +- grub_backtrace_pointer ((void *) grub_gdb_regs[EBP]); + grub_fatal ("Unhandled exception"); + } + +diff --git a/grub-core/kern/arm64/backtrace.c b/grub-core/kern/arm64/backtrace.c +new file mode 100644 +index 00000000000..019c6fdfef2 +--- /dev/null ++++ b/grub-core/kern/arm64/backtrace.c +@@ -0,0 +1,94 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2009 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define MAX_STACK_FRAME 102400 ++ ++struct fplr ++{ ++ void *lr; ++ struct fplr *fp; ++}; ++ ++void ++grub_backtrace_pointer (void *frame, unsigned int skip) ++{ ++ unsigned int x = 0; ++ struct fplr *fplr = (struct fplr *)frame; ++ ++ while (fplr) ++ { ++ const char *name = NULL; ++ char *addr = NULL; ++ ++ grub_dprintf("backtrace", "fp is %p next_fp is %p\n", ++ fplr, fplr->fp); ++ ++ if (x >= skip) ++ { ++ name = grub_get_symbol_by_addr (fplr->lr, 1); ++ if (name) ++ addr = grub_resolve_symbol (name); ++ grub_backtrace_print_address (fplr->lr); ++ ++ if (addr && addr != fplr->lr) ++ grub_printf (" %s() %p+%p \n", name ? name : "unknown", addr, ++ (void *)((grub_uint64_t)fplr->lr - (grub_uint64_t)addr)); ++ else ++ grub_printf(" %s() %p \n", name ? name : "unknown", addr); ++ ++ } ++ ++ x += 1; ++ ++ if (fplr->fp < fplr || ++ (grub_uint64_t)fplr->fp - (grub_uint64_t)fplr > MAX_STACK_FRAME || ++ fplr->fp == fplr) ++ { ++ break; ++ } ++ fplr = fplr->fp; ++ } ++} ++ ++asm ("\t.global \"_text\"\n" ++ "_text:\n" ++ "\t.quad .text\n" ++ "\t.global \"_data\"\n" ++ "_data:\n" ++ "\t.quad .data\n" ++ ); ++ ++extern grub_uint64_t _text; ++extern grub_uint64_t _data; ++ ++void ++grub_backtrace_arch (unsigned int skip) ++{ ++ grub_printf ("Backtrace (.text %p .data %p):\n", ++ (void *)_text, (void *)_data); ++ skip += 1; ++ grub_backtrace_pointer(__builtin_frame_address(0), skip); ++} +diff --git a/grub-core/kern/backtrace.c b/grub-core/kern/backtrace.c +new file mode 100644 +index 00000000000..4a82e865cc6 +--- /dev/null ++++ b/grub-core/kern/backtrace.c +@@ -0,0 +1,97 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2009 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++GRUB_MOD_LICENSE ("GPLv3+"); ++ ++static void ++grub_backtrace_print_address_default (void *addr) ++{ ++#ifndef GRUB_UTIL ++ grub_dl_t mod; ++ void *start_addr; ++ ++ FOR_DL_MODULES (mod) ++ { ++ grub_dl_segment_t segment; ++ for (segment = mod->segment; segment; segment = segment->next) ++ if (segment->addr <= addr && (grub_uint8_t *) segment->addr ++ + segment->size > (grub_uint8_t *) addr) ++ { ++ grub_printf ("%s.%x+%" PRIxGRUB_SIZE, mod->name, ++ segment->section, ++ (grub_size_t) ++ ((grub_uint8_t *)addr - (grub_uint8_t *)segment->addr)); ++ return; ++ } ++ } ++ ++ start_addr = grub_resolve_symbol ("_start"); ++ if (start_addr && start_addr < addr) ++ grub_printf ("kernel+%" PRIxGRUB_SIZE, ++ (grub_size_t) ++ ((grub_uint8_t *)addr - (grub_uint8_t *)start_addr)); ++ else ++#endif ++ grub_printf ("%p", addr); ++} ++ ++static void ++grub_backtrace_pointer_default (void *frame __attribute__((__unused__)), ++ unsigned int skip __attribute__((__unused__))) ++{ ++ return; ++} ++ ++void ++grub_backtrace_pointer (void *frame, unsigned int skip) ++ __attribute__((__weak__, ++ __alias__(("grub_backtrace_pointer_default")))); ++ ++void ++grub_backtrace_print_address (void *addr) ++ __attribute__((__weak__, ++ __alias__(("grub_backtrace_print_address_default")))); ++ ++static void ++grub_backtrace_arch_default(unsigned int skip) ++{ ++ grub_backtrace_pointer(__builtin_frame_address(0), skip + 1); ++} ++ ++void grub_backtrace_arch (unsigned int skip) ++ __attribute__((__weak__, __alias__(("grub_backtrace_arch_default")))); ++ ++void grub_backtrace (unsigned int skip) ++{ ++ grub_backtrace_arch(skip + 1); ++} ++ ++void grub_debug_backtrace (const char * const debug, ++ unsigned int skip) ++{ ++ if (grub_debug_enabled (debug)) ++ grub_backtrace (skip + 1); ++} +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 0bf40caa61a..931f6e41442 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -115,6 +115,50 @@ grub_dl_resolve_symbol (const char *name) + return 0; + } + ++void * ++grub_resolve_symbol (const char *name) ++{ ++ grub_symbol_t sym; ++ ++ sym = grub_dl_resolve_symbol (name); ++ if (sym) ++ return sym->addr; ++ return NULL; ++} ++ ++const char * ++grub_get_symbol_by_addr(const void *addr, int isfunc) ++{ ++ unsigned int i; ++ grub_symbol_t before = NULL, after = NULL; ++ for (i = 0; i < GRUB_SYMTAB_SIZE; i++) ++ { ++ grub_symbol_t sym; ++ for (sym = grub_symtab[i]; sym; sym = sym->next) ++ { ++ //grub_printf ("addr 0x%08llx symbol %s\n", (unsigned long long)sym->addr, sym->name); ++ if (sym->addr > addr) ++ { ++ if (!after || sym->addr > after->addr) ++ after = sym; ++ } ++ ++ if (isfunc != sym->isfunc) ++ continue; ++ if (sym->addr > addr) ++ continue; ++ ++ if ((!before && sym->addr <= addr) || (before && before->addr <= sym->addr)) ++ before = sym; ++ } ++ } ++ ++ if (before && addr < after->addr) ++ return before->name; ++ ++ return NULL; ++} ++ + /* Register a symbol with the name NAME and the address ADDR. */ + grub_err_t + grub_dl_register_symbol (const char *name, void *addr, int isfunc, +@@ -330,6 +374,7 @@ grub_dl_resolve_symbols (grub_dl_t mod, Elf_Ehdr *e) + const char *str; + Elf_Word size, entsize; + ++ grub_dprintf ("modules", "Resolving symbols for \"%s\"\n", mod->name); + for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff); + i < e->e_shnum; + i++, s = (Elf_Shdr *) ((char *) s + e->e_shentsize)) +diff --git a/grub-core/kern/i386/backtrace.c b/grub-core/kern/i386/backtrace.c +new file mode 100644 +index 00000000000..2413f9a57db +--- /dev/null ++++ b/grub-core/kern/i386/backtrace.c +@@ -0,0 +1,125 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2009 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define MAX_STACK_FRAME 102400 ++ ++void ++grub_backtrace_pointer (void *frame, unsigned int skip) ++{ ++ void **ebp = (void **)frame; ++ unsigned long x = 0; ++ ++ while (ebp) ++ { ++ void **next_ebp = (void **)ebp[0]; ++ const char *name = NULL; ++ char *addr = NULL; ++ ++ grub_dprintf("backtrace", "ebp is %p next_ebp is %p\n", ebp, next_ebp); ++ ++ if (x >= skip) ++ { ++ name = grub_get_symbol_by_addr (ebp[1], 1); ++ if (name) ++ addr = grub_resolve_symbol (name); ++ grub_backtrace_print_address (ebp[1]); ++ ++ if (addr && addr != ebp[1]) ++ grub_printf (" %s() %p+%p \n", name ? name : "unknown", addr, ++ (char *)((char *)ebp[1] - addr)); ++ else ++ grub_printf(" %s() %p \n", name ? name : "unknown", addr); ++ ++#if 0 ++ grub_printf ("("); ++ for (i = 0, arg = ebp[2]; arg != next_ebp && i < 12; arg++, i++) ++ grub_printf ("%p,", arg); ++ grub_printf (")\n"); ++#endif ++ } ++ ++ x += 1; ++ ++ if (next_ebp < ebp || next_ebp - ebp > MAX_STACK_FRAME || next_ebp == ebp) ++ { ++ //grub_printf ("Invalid stack frame at %p (%p)\n", ebp, next_ebp); ++ break; ++ } ++ ebp = next_ebp; ++ } ++} ++ ++#if defined (__x86_64__) ++asm ("\t.global \"_text\"\n" ++ "_text:\n" ++ "\t.quad .text\n" ++ "\t.global \"_data\"\n" ++ "_data:\n" ++ "\t.quad .data\n" ++ ); ++#elif defined(__i386__) ++asm ("\t.global \"_text\"\n" ++ "_text:\n" ++ "\t.long .text\n" ++ "\t.global \"_data\"\n" ++ "_data:\n" ++ "\t.long .data\n" ++ ); ++#else ++#warning I dunno... ++#endif ++ ++extern unsigned long _text; ++extern unsigned long _data; ++ ++#ifdef GRUB_UTIL ++#define EXT_C(x) x ++#endif ++ ++void ++grub_backtrace_arch (unsigned int skip) ++{ ++ grub_printf ("Backtrace (.text %p .data %p):\n", ++ (void *)_text, (void *)_data); ++ skip += 1; ++#if defined (__x86_64__) ++ asm volatile ("movq %%rbp, %%rdi\n" ++ "movq 0, %%rsi\n" ++ "movl %0, %%esi\n" ++ "call " EXT_C("grub_backtrace_pointer") ++ : ++ : "r" (skip)); ++#elif defined(__i386__) ++ asm volatile ("addl $8, %%esp\n" ++ "pushl %0\n" ++ "pushl %%ebp\n" ++ "call " EXT_C("grub_backtrace_pointer") ++ : ++ : "r" (skip)); ++#else ++ grub_backtrace_pointer(__builtin_frame_address(0), skip); ++#endif ++} +diff --git a/grub-core/kern/i386/pc/init.c b/grub-core/kern/i386/pc/init.c +index 326d491c586..fe7ad14d45c 100644 +--- a/grub-core/kern/i386/pc/init.c ++++ b/grub-core/kern/i386/pc/init.c +@@ -153,7 +153,7 @@ compact_mem_regions (void) + } + + grub_addr_t grub_modbase; +-extern grub_uint8_t _start[], _edata[]; ++extern grub_uint8_t _edata[]; + + /* Helper for grub_machine_init. */ + static int +@@ -226,7 +226,7 @@ grub_machine_init (void) + /* This has to happen before any BIOS calls. */ + grub_via_workaround_init (); + +- grub_modbase = GRUB_MEMORY_MACHINE_DECOMPRESSION_ADDR + (_edata - _start); ++ grub_modbase = GRUB_MEMORY_MACHINE_DECOMPRESSION_ADDR + (_edata - (grub_uint8_t *)_start); + + /* Initialize the console as early as possible. */ + grub_console_init (); +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 51c1e1c9d9f..c4d6962197b 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -70,7 +70,6 @@ + */ + #define RUNTIME_MIN_SPACE (128UL * 1024 * 1024) + +-extern char _start[]; + extern char _end[]; + + #ifdef __sparc__ +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index b1d399d37d7..779586658cb 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -1302,12 +1302,12 @@ grub_printf_fmt_check (const char *fmt, const char *fmt_expected) + void __attribute__ ((noreturn)) + grub_abort (void) + { +-#ifndef GRUB_UTIL +-#if (defined(__i386__) || defined(__x86_64__)) && !defined(GRUB_MACHINE_EMU) +- grub_backtrace(); ++#if !defined(GRUB_MACHINE_EMU) && !defined(GRUB_UTIL) ++ grub_backtrace (1); ++#else ++ grub_printf ("\n"); + #endif +-#endif +- grub_printf ("\nAborted."); ++ grub_printf ("Aborted."); + + #ifndef GRUB_UTIL + if (grub_term_inputs) +@@ -1334,6 +1334,7 @@ grub_fatal (const char *fmt, ...) + { + va_list ap; + ++ grub_printf ("\n"); + va_start (ap, fmt); + grub_vprintf (_(fmt), ap); + va_end (ap); +diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c +index 027a25cd1f0..1aeeba9e27e 100644 +--- a/grub-core/kern/mm.c ++++ b/grub-core/kern/mm.c +@@ -144,13 +144,13 @@ get_header_from_pointer (void *ptr, grub_mm_header_t *p, grub_mm_region_t *r) + break; + + if (! *r) +- grub_fatal ("out of range pointer %p", ptr); ++ grub_fatal ("out of range pointer %p\n", ptr); + + *p = (grub_mm_header_t) ptr - 1; + if ((*p)->magic == GRUB_MM_FREE_MAGIC) +- grub_fatal ("double free at %p", *p); ++ grub_fatal ("double free at %p\n", *p); + if ((*p)->magic != GRUB_MM_ALLOC_MAGIC) +- grub_fatal ("alloc magic is broken at %p: %lx", *p, ++ grub_fatal ("alloc magic is broken at %p: %lx\n", *p, + (unsigned long) (*p)->magic); + } + +diff --git a/grub-core/lib/arm64/backtrace.c b/grub-core/lib/arm64/backtrace.c +deleted file mode 100644 +index 1079b5380e1..00000000000 +--- a/grub-core/lib/arm64/backtrace.c ++++ /dev/null +@@ -1,62 +0,0 @@ +-/* +- * GRUB -- GRand Unified Bootloader +- * Copyright (C) 2009 Free Software Foundation, Inc. +- * +- * GRUB is free software: you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation, either version 3 of the License, or +- * (at your option) any later version. +- * +- * GRUB is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with GRUB. If not, see . +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#define MAX_STACK_FRAME 102400 +- +-void +-grub_backtrace_pointer (int frame) +-{ +- while (1) +- { +- void *lp = __builtin_return_address (frame); +- if (!lp) +- break; +- +- lp = __builtin_extract_return_addr (lp); +- +- grub_printf ("%p: ", lp); +- grub_backtrace_print_address (lp); +- grub_printf (" ("); +- for (i = 0; i < 2; i++) +- grub_printf ("%p,", ((void **)ptr) [i + 2]); +- grub_printf ("%p)\n", ((void **)ptr) [i + 2]); +- nptr = *(void **)ptr; +- if (nptr < ptr || (void **) nptr - (void **) ptr > MAX_STACK_FRAME +- || nptr == ptr) +- { +- grub_printf ("Invalid stack frame at %p (%p)\n", ptr, nptr); +- break; +- } +- ptr = nptr; +- } +-} +- +-void +-grub_backtrace (void) +-{ +- grub_backtrace_pointer (1); +-} +- +diff --git a/grub-core/lib/i386/backtrace.c b/grub-core/lib/i386/backtrace.c +deleted file mode 100644 +index c67273db3ae..00000000000 +--- a/grub-core/lib/i386/backtrace.c ++++ /dev/null +@@ -1,78 +0,0 @@ +-/* +- * GRUB -- GRand Unified Bootloader +- * Copyright (C) 2009 Free Software Foundation, Inc. +- * +- * GRUB is free software: you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation, either version 3 of the License, or +- * (at your option) any later version. +- * +- * GRUB is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with GRUB. If not, see . +- */ +-#include +-#ifdef GRUB_UTIL +-#define REALLY_GRUB_UTIL GRUB_UTIL +-#undef GRUB_UTIL +-#endif +- +-#include +-#include +- +-#ifdef REALLY_GRUB_UTIL +-#define GRUB_UTIL REALLY_GRUB_UTIL +-#undef REALLY_GRUB_UTIL +-#endif +- +-#include +-#include +-#include +-#include +-#include +-#include +- +-#define MAX_STACK_FRAME 102400 +- +-void +-grub_backtrace_pointer (void *ebp) +-{ +- void *ptr, *nptr; +- unsigned i; +- +- ptr = ebp; +- while (1) +- { +- grub_printf ("%p: ", ptr); +- grub_backtrace_print_address (((void **) ptr)[1]); +- grub_printf (" ("); +- for (i = 0; i < 2; i++) +- grub_printf ("%p,", ((void **)ptr) [i + 2]); +- grub_printf ("%p)\n", ((void **)ptr) [i + 2]); +- nptr = *(void **)ptr; +- if (nptr < ptr || (void **) nptr - (void **) ptr > MAX_STACK_FRAME +- || nptr == ptr) +- { +- grub_printf ("Invalid stack frame at %p (%p)\n", ptr, nptr); +- break; +- } +- ptr = nptr; +- } +-} +- +-void +-grub_backtrace (void) +-{ +-#ifdef __x86_64__ +- asm volatile ("movq %%rbp, %%rdi\n" +- "callq *%%rax": :"a"(grub_backtrace_pointer)); +-#else +- asm volatile ("movl %%ebp, %%eax\n" +- "calll *%%ecx": :"c"(grub_backtrace_pointer)); +-#endif +-} +- +diff --git a/include/grub/backtrace.h b/include/grub/backtrace.h +index 395519762f0..275cf85e2d3 100644 +--- a/include/grub/backtrace.h ++++ b/include/grub/backtrace.h +@@ -19,8 +19,14 @@ + #ifndef GRUB_BACKTRACE_HEADER + #define GRUB_BACKTRACE_HEADER 1 + +-void grub_backtrace (void); +-void grub_backtrace_pointer (void *ptr); ++#include ++#include ++ ++void EXPORT_FUNC(grub_debug_backtrace) (const char * const debug, ++ unsigned int skip); ++void EXPORT_FUNC(grub_backtrace) (unsigned int skip); ++void grub_backtrace_arch (unsigned int skip); ++void grub_backtrace_pointer (void *ptr, unsigned int skip); + void grub_backtrace_print_address (void *addr); + + #endif +diff --git a/include/grub/dl.h b/include/grub/dl.h +index f2bf50eb98d..8a3d188d1d1 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -258,6 +258,8 @@ grub_dl_is_persistent (grub_dl_t mod) + + #endif + ++void * EXPORT_FUNC(grub_resolve_symbol) (const char *name); ++const char * EXPORT_FUNC(grub_get_symbol_by_addr) (const void *addr, int isfunc); + grub_err_t grub_dl_register_symbol (const char *name, void *addr, + int isfunc, grub_dl_t mod); + +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index abbca5ea335..300a9766cda 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -111,6 +111,9 @@ grub_addr_t grub_modules_get_end (void); + + #endif + ++void EXPORT_FUNC(start) (void); ++void EXPORT_FUNC(_start) (void); ++ + /* The start point of the C code. */ + void grub_main (void) __attribute__ ((noreturn)); + +diff --git a/grub-core/kern/arm/efi/startup.S b/grub-core/kern/arm/efi/startup.S +index 9f8265315a9..f3bc41f9d0f 100644 +--- a/grub-core/kern/arm/efi/startup.S ++++ b/grub-core/kern/arm/efi/startup.S +@@ -23,6 +23,8 @@ + .file "startup.S" + .text + .arm ++ .globl start, _start ++FUNCTION(start) + FUNCTION(_start) + /* + * EFI_SYSTEM_TABLE and EFI_HANDLE are passed in r1/r0. +diff --git a/grub-core/kern/arm/startup.S b/grub-core/kern/arm/startup.S +index 3946fe8e183..5679a1d00ad 100644 +--- a/grub-core/kern/arm/startup.S ++++ b/grub-core/kern/arm/startup.S +@@ -48,6 +48,8 @@ + + .text + .arm ++ .globl start, _start ++FUNCTION(start) + FUNCTION(_start) + b codestart + +diff --git a/grub-core/kern/arm64/efi/startup.S b/grub-core/kern/arm64/efi/startup.S +index 666a7ee3c92..41676bdb2b8 100644 +--- a/grub-core/kern/arm64/efi/startup.S ++++ b/grub-core/kern/arm64/efi/startup.S +@@ -19,7 +19,9 @@ + #include + + .file "startup.S" ++ .globl start, _start + .text ++FUNCTION(start) + FUNCTION(_start) + /* + * EFI_SYSTEM_TABLE and EFI_HANDLE are passed in x1/x0. +diff --git a/grub-core/kern/i386/qemu/startup.S b/grub-core/kern/i386/qemu/startup.S +index 0d89858d9b3..939f182fc74 100644 +--- a/grub-core/kern/i386/qemu/startup.S ++++ b/grub-core/kern/i386/qemu/startup.S +@@ -24,7 +24,8 @@ + + .text + .code32 +- .globl _start ++ .globl start, _start ++start: + _start: + jmp codestart + +diff --git a/grub-core/kern/ia64/efi/startup.S b/grub-core/kern/ia64/efi/startup.S +index d75c6d7cc74..8f2a593e529 100644 +--- a/grub-core/kern/ia64/efi/startup.S ++++ b/grub-core/kern/ia64/efi/startup.S +@@ -24,8 +24,9 @@ + .psr lsb + .lsb + +- .global _start ++ .global start, _start + .proc _start ++start: + _start: + alloc loc0=ar.pfs,2,4,0,0 + mov loc1=rp +diff --git a/grub-core/kern/sparc64/ieee1275/crt0.S b/grub-core/kern/sparc64/ieee1275/crt0.S +index 03b916f0534..701bf63abcf 100644 +--- a/grub-core/kern/sparc64/ieee1275/crt0.S ++++ b/grub-core/kern/sparc64/ieee1275/crt0.S +@@ -22,7 +22,8 @@ + + .text + .align 4 +- .globl _start ++ .globl start, _start ++start: + _start: + ba codestart + mov %o4, %o0 +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index f18550c1c98..b7192a3da82 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -66,6 +66,7 @@ CLEANFILES += grub_script.yy.c grub_script.yy.h + + include $(srcdir)/Makefile.core.am + ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/backtrace.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/cache.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/command.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/device.h diff --git a/0060-Build-tpm-as-module.patch b/0060-Build-tpm-as-module.patch deleted file mode 100644 index 18ee401..0000000 --- a/0060-Build-tpm-as-module.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ef8c34c85ac68ad0975058487fc50ef1ddbe4c5e Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 23 Nov 2016 16:52:16 +0800 -Subject: [PATCH 060/272] Build tpm as module - -Add --enable-tpm option to grub2-install. ---- - util/grub-install.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/util/grub-install.c b/util/grub-install.c -index 036a66dc6..b195eabbe 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -80,6 +80,7 @@ static char *label_color; - static char *label_bgcolor; - static char *product_version; - static int add_rs_codes = 1; -+static int enable_tpm = 0; - - enum - { -@@ -107,6 +108,7 @@ enum - OPTION_NO_BOOTSECTOR, - OPTION_NO_RS_CODES, - OPTION_MACPPC_DIRECTORY, -+ OPTION_ENABLE_TPM, - OPTION_LABEL_FONT, - OPTION_LABEL_COLOR, - OPTION_LABEL_BGCOLOR, -@@ -225,6 +227,10 @@ argp_parser (int key, char *arg, struct argp_state *state) - add_rs_codes = 0; - return 0; - -+ case OPTION_ENABLE_TPM: -+ enable_tpm = 1; -+ return 0; -+ - case OPTION_DEBUG: - verbosity++; - return 0; -@@ -286,6 +292,7 @@ static struct argp_option options[] = { - {"no-rs-codes", OPTION_NO_RS_CODES, 0, 0, - N_("Do not apply any reed-solomon codes when embedding core.img. " - "This option is only available on x86 BIOS targets."), 0}, -+ {"enable-tpm", OPTION_ENABLE_TPM, 0, 0, N_("install TPM modules"), 0}, - - {"debug", OPTION_DEBUG, 0, OPTION_HIDDEN, 0, 2}, - {"no-floppy", OPTION_NO_FLOPPY, 0, OPTION_HIDDEN, 0, 2}, -@@ -1337,6 +1344,9 @@ main (int argc, char *argv[]) - else if (disk_module && disk_module[0]) - grub_install_push_module (disk_module); - -+ if (enable_tpm && platform == GRUB_INSTALL_PLATFORM_X86_64_EFI) -+ grub_install_push_module ("tpm"); -+ - relative_grubdir = grub_make_system_path_relative_to_its_root (grubdir); - if (relative_grubdir[0] == '\0') - { --- -2.41.0 - diff --git a/0060-Fixup-for-newer-compiler.patch b/0060-Fixup-for-newer-compiler.patch new file mode 100644 index 0000000..b0c1966 --- /dev/null +++ b/0060-Fixup-for-newer-compiler.patch @@ -0,0 +1,22 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 10 May 2018 13:40:19 -0400 +Subject: [PATCH] Fixup for newer compiler + +--- + grub-core/fs/btrfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 87e4dd1a07a..ad35e75750b 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -218,7 +218,7 @@ struct grub_btrfs_inode + grub_uint64_t size; + grub_uint8_t dummy2[0x70]; + struct grub_btrfs_time mtime; +-} GRUB_PACKED; ++} GRUB_PACKED __attribute__ ((aligned(8))); + + struct grub_btrfs_extent_data + { diff --git a/0061-Don-t-attempt-to-export-the-start-and-_start-symbols.patch b/0061-Don-t-attempt-to-export-the-start-and-_start-symbols.patch new file mode 100644 index 0000000..0e925ee --- /dev/null +++ b/0061-Don-t-attempt-to-export-the-start-and-_start-symbols.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 12 May 2018 11:29:07 +0200 +Subject: [PATCH] Don't attempt to export the start and _start symbols for + grub-emu + +Commit 318ee04aadc ("make better backtraces") reworked the backtrace logic +but the changes lead to the following build error on the grub-emu platform: + +grub_emu_lite-symlist.o:(.data+0xf08): undefined reference to `start' +collect2: error: ld returned 1 exit status +make[3]: *** [Makefile:25959: grub-emu-lite] Error 1 +make[3]: *** Waiting for unfinished jobs.... +cat kernel_syms.input | grep -v '^#' | sed -n \ + -e '/EXPORT_FUNC *([a-zA-Z0-9_]*)/{s/.*EXPORT_FUNC *(\([a-zA-Z0-9_]*\)).*/defined kernel '""'\1/;p;}' \ + -e '/EXPORT_VAR *([a-zA-Z0-9_]*)/{s/.*EXPORT_VAR *(\([a-zA-Z0-9_]*\)).*/defined kernel '""'\1/;p;}' \ + | sort -u >kernel_syms.lst + +The problem is that start and _start symbols are exported unconditionally, +but these aren't defined for grub-emu since is an emultaed platform so it +doesn't have a startup logic. Don't attempt to export those for grub-emu. + +Signed-off-by: Javier Martinez Canillas +--- + include/grub/kernel.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index 300a9766cda..55849777eaa 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -111,8 +111,10 @@ grub_addr_t grub_modules_get_end (void); + + #endif + ++#if !defined(GRUB_MACHINE_EMU) + void EXPORT_FUNC(start) (void); + void EXPORT_FUNC(_start) (void); ++#endif + + /* The start point of the C code. */ + void grub_main (void) __attribute__ ((noreturn)); diff --git a/0211-Fixup-for-newer-compiler.patch b/0062-Fixup-for-newer-compiler.patch similarity index 74% rename from 0211-Fixup-for-newer-compiler.patch rename to 0062-Fixup-for-newer-compiler.patch index 32d3e2a..0d495c1 100644 --- a/0211-Fixup-for-newer-compiler.patch +++ b/0062-Fixup-for-newer-compiler.patch @@ -1,26 +1,22 @@ -From 35f7ba8dafd01ee410194a5a5047b56da64940eb Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 10 May 2018 13:40:19 -0400 -Subject: [PATCH 211/272] Fixup for newer compiler +Subject: [PATCH] Fixup for newer compiler --- - conf/Makefile.common | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) + conf/Makefile.common | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/Makefile.common b/conf/Makefile.common -index ece9ed8a1..a7c0e70e9 100644 +index ece9ed8a1bf..6262f21a772 100644 --- a/conf/Makefile.common +++ b/conf/Makefile.common -@@ -41,7 +41,8 @@ CFLAGS_KERNEL = $(CFLAGS_PLATFORM) -ffreestanding +@@ -41,7 +41,7 @@ CFLAGS_KERNEL = $(CFLAGS_PLATFORM) -ffreestanding LDFLAGS_KERNEL = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) CPPFLAGS_KERNEL = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) -DGRUB_KERNEL=1 CCASFLAGS_KERNEL = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) -STRIPFLAGS_KERNEL = -R .eh_frame -R .rel.dyn -R .reginfo -R .note -R .comment -R .drectve -R .note.gnu.gold-version -R .MIPS.abiflags -R .ARM.exidx +STRIPFLAGS_KERNEL = -R .eh_frame -R .rel.dyn -R .reginfo -R .note -R .comment -R .drectve -R .note.gnu.gold-version -R .MIPS.abiflags -R .ARM.exidx -R .note.gnu.property -R .gnu.build.attributes -+ if !COND_emu if COND_HAVE_ASM_USCORE LDFLAGS_KERNEL += -Wl,--defsym=_malloc=_grub_malloc -Wl,--defsym=_free=_grub_free --- -2.41.0 - diff --git a/0063-Add-support-for-non-Ethernet-network-cards.patch b/0063-Add-support-for-non-Ethernet-network-cards.patch new file mode 100644 index 0000000..95ea8fc --- /dev/null +++ b/0063-Add-support-for-non-Ethernet-network-cards.patch @@ -0,0 +1,770 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrzej Kacprowski +Date: Wed, 10 Jul 2019 15:22:29 +0200 +Subject: [PATCH] Add support for non-Ethernet network cards + +This patch replaces fixed 6-byte link layer address with +up to 32-byte variable sized address. +This allows supporting Infiniband and Omni-Path fabric +which use 20-byte address, but other network card types +can also take advantage of this change. +The network card driver is responsible for replacing L2 +header provided by grub2 if needed. +This approach is compatible with UEFI network stack which +also allows up to 32-byte variable size link address. + +The BOOTP/DHCP packet format is limited to 16 byte client +hardware address, if link address is more that 16-bytes +then chaddr field in BOOTP it will be set to 0 as per rfc4390. + +Resolves: rhbz#1370642 + +Signed-off-by: Andrzej Kacprowski +[msalter: Fix max string calculation in grub_net_hwaddr_to_str] +Signed-off-by: Mark Salter +--- + grub-core/net/arp.c | 156 ++++++++++++++++++++++----------- + grub-core/net/bootp.c | 15 ++-- + grub-core/net/drivers/efi/efinet.c | 8 +- + grub-core/net/drivers/emu/emunet.c | 1 + + grub-core/net/drivers/i386/pc/pxe.c | 13 +-- + grub-core/net/drivers/ieee1275/ofnet.c | 2 + + grub-core/net/drivers/uboot/ubootnet.c | 1 + + grub-core/net/ethernet.c | 89 +++++++++---------- + grub-core/net/icmp6.c | 15 ++-- + grub-core/net/ip.c | 4 +- + grub-core/net/net.c | 50 ++++++----- + include/grub/net.h | 19 ++-- + 12 files changed, 220 insertions(+), 153 deletions(-) + +diff --git a/grub-core/net/arp.c b/grub-core/net/arp.c +index 1d367436cfc..8bf0a06e193 100644 +--- a/grub-core/net/arp.c ++++ b/grub-core/net/arp.c +@@ -31,22 +31,12 @@ enum + ARP_REPLY = 2 + }; + +-enum +- { +- /* IANA ARP constant to define hardware type as ethernet. */ +- GRUB_NET_ARPHRD_ETHERNET = 1 +- }; +- +-struct arppkt { ++struct arphdr { + grub_uint16_t hrd; + grub_uint16_t pro; + grub_uint8_t hln; + grub_uint8_t pln; + grub_uint16_t op; +- grub_uint8_t sender_mac[6]; +- grub_uint32_t sender_ip; +- grub_uint8_t recv_mac[6]; +- grub_uint32_t recv_ip; + } GRUB_PACKED; + + static int have_pending; +@@ -57,12 +47,16 @@ grub_net_arp_send_request (struct grub_net_network_level_interface *inf, + const grub_net_network_level_address_t *proto_addr) + { + struct grub_net_buff nb; +- struct arppkt *arp_packet; ++ struct arphdr *arp_header; + grub_net_link_level_address_t target_mac_addr; + grub_err_t err; + int i; + grub_uint8_t *nbd; + grub_uint8_t arp_data[128]; ++ grub_uint8_t hln; ++ grub_uint8_t pln; ++ grub_uint8_t arp_packet_len; ++ grub_uint8_t *tmp_ptr; + + if (proto_addr->type != GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV4) + return grub_error (GRUB_ERR_BUG, "unsupported address family"); +@@ -73,23 +67,39 @@ grub_net_arp_send_request (struct grub_net_network_level_interface *inf, + grub_netbuff_clear (&nb); + grub_netbuff_reserve (&nb, 128); + +- err = grub_netbuff_push (&nb, sizeof (*arp_packet)); ++ hln = inf->card->default_address.len; ++ pln = sizeof (proto_addr->ipv4); ++ arp_packet_len = sizeof (*arp_header) + 2 * (hln + pln); ++ ++ err = grub_netbuff_push (&nb, arp_packet_len); + if (err) + return err; + +- arp_packet = (struct arppkt *) nb.data; +- arp_packet->hrd = grub_cpu_to_be16_compile_time (GRUB_NET_ARPHRD_ETHERNET); +- arp_packet->hln = 6; +- arp_packet->pro = grub_cpu_to_be16_compile_time (GRUB_NET_ETHERTYPE_IP); +- arp_packet->pln = 4; +- arp_packet->op = grub_cpu_to_be16_compile_time (ARP_REQUEST); +- /* Sender hardware address. */ +- grub_memcpy (arp_packet->sender_mac, &inf->hwaddress.mac, 6); +- arp_packet->sender_ip = inf->address.ipv4; +- grub_memset (arp_packet->recv_mac, 0, 6); +- arp_packet->recv_ip = proto_addr->ipv4; +- /* Target protocol address */ +- grub_memset (&target_mac_addr.mac, 0xff, 6); ++ arp_header = (struct arphdr *) nb.data; ++ arp_header->hrd = grub_cpu_to_be16 (inf->card->default_address.type); ++ arp_header->hln = hln; ++ arp_header->pro = grub_cpu_to_be16_compile_time (GRUB_NET_ETHERTYPE_IP); ++ arp_header->pln = pln; ++ arp_header->op = grub_cpu_to_be16_compile_time (ARP_REQUEST); ++ tmp_ptr = nb.data + sizeof (*arp_header); ++ ++ /* The source hardware address. */ ++ grub_memcpy (tmp_ptr, inf->hwaddress.mac, hln); ++ tmp_ptr += hln; ++ ++ /* The source protocol address. */ ++ grub_memcpy (tmp_ptr, &inf->address.ipv4, pln); ++ tmp_ptr += pln; ++ ++ /* The target hardware address. */ ++ grub_memset (tmp_ptr, 0, hln); ++ tmp_ptr += hln; ++ ++ /* The target protocol address */ ++ grub_memcpy (tmp_ptr, &proto_addr->ipv4, pln); ++ tmp_ptr += pln; ++ ++ grub_memset (&target_mac_addr.mac, 0xff, hln); + + nbd = nb.data; + send_ethernet_packet (inf, &nb, target_mac_addr, GRUB_NET_ETHERTYPE_ARP); +@@ -114,30 +124,56 @@ grub_err_t + grub_net_arp_receive (struct grub_net_buff *nb, struct grub_net_card *card, + grub_uint16_t *vlantag) + { +- struct arppkt *arp_packet = (struct arppkt *) nb->data; ++ struct arphdr *arp_header = (struct arphdr *) nb->data; + grub_net_network_level_address_t sender_addr, target_addr; + grub_net_link_level_address_t sender_mac_addr; + struct grub_net_network_level_interface *inf; ++ grub_uint16_t hw_type; ++ grub_uint8_t hln; ++ grub_uint8_t pln; ++ grub_uint8_t arp_packet_len; ++ grub_uint8_t *tmp_ptr; + +- if (arp_packet->pro != grub_cpu_to_be16_compile_time (GRUB_NET_ETHERTYPE_IP) +- || arp_packet->pln != 4 || arp_packet->hln != 6 +- || nb->tail - nb->data < (int) sizeof (*arp_packet)) ++ hw_type = card->default_address.type; ++ hln = card->default_address.len; ++ pln = sizeof(sender_addr.ipv4); ++ arp_packet_len = sizeof (*arp_header) + 2 * (pln + hln); ++ ++ if (arp_header->pro != grub_cpu_to_be16_compile_time (GRUB_NET_ETHERTYPE_IP) ++ || arp_header->hrd != grub_cpu_to_be16 (hw_type) ++ || arp_header->hln != hln || arp_header->pln != pln ++ || nb->tail - nb->data < (int) arp_packet_len) { + return GRUB_ERR_NONE; ++ } + ++ tmp_ptr = nb->data + sizeof (*arp_header); ++ ++ /* The source hardware address. */ ++ sender_mac_addr.type = hw_type; ++ sender_mac_addr.len = hln; ++ grub_memcpy (sender_mac_addr.mac, tmp_ptr, hln); ++ tmp_ptr += hln; ++ ++ /* The source protocol address. */ + sender_addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV4; +- target_addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV4; +- sender_addr.ipv4 = arp_packet->sender_ip; +- target_addr.ipv4 = arp_packet->recv_ip; + sender_addr.option = 0; + target_addr.option = 0; +- if (arp_packet->sender_ip == pending_req) +- have_pending = 1; + +- sender_mac_addr.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (sender_mac_addr.mac, arp_packet->sender_mac, +- sizeof (sender_mac_addr.mac)); ++ grub_memcpy(&target_addr.ipv4, tmp_ptr, pln); ++ tmp_ptr += pln; ++ + grub_net_link_layer_add_address (card, &sender_addr, &sender_mac_addr, 1); + ++ /* The target hardware address. */ ++ tmp_ptr += hln; ++ ++ /* The target protocol address. */ ++ target_addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV4; ++ grub_memcpy(&target_addr.ipv4, tmp_ptr, pln); ++ ++ if (sender_addr.ipv4 == pending_req) ++ have_pending = 1; ++ + FOR_NET_NETWORK_LEVEL_INTERFACES (inf) + { + /* Verify vlantag id */ +@@ -150,11 +186,11 @@ grub_net_arp_receive (struct grub_net_buff *nb, struct grub_net_card *card, + + /* Am I the protocol address target? */ + if (grub_net_addr_cmp (&inf->address, &target_addr) == 0 +- && arp_packet->op == grub_cpu_to_be16_compile_time (ARP_REQUEST)) ++ && arp_header->op == grub_cpu_to_be16_compile_time (ARP_REQUEST)) + { + grub_net_link_level_address_t target; + struct grub_net_buff nb_reply; +- struct arppkt *arp_reply; ++ struct arphdr *arp_reply; + grub_uint8_t arp_data[128]; + grub_err_t err; + +@@ -163,25 +199,39 @@ grub_net_arp_receive (struct grub_net_buff *nb, struct grub_net_card *card, + grub_netbuff_clear (&nb_reply); + grub_netbuff_reserve (&nb_reply, 128); + +- err = grub_netbuff_push (&nb_reply, sizeof (*arp_packet)); ++ err = grub_netbuff_push (&nb_reply, arp_packet_len); + if (err) + return err; + +- arp_reply = (struct arppkt *) nb_reply.data; ++ arp_reply = (struct arphdr *) nb_reply.data; + +- arp_reply->hrd = grub_cpu_to_be16_compile_time (GRUB_NET_ARPHRD_ETHERNET); ++ arp_reply->hrd = grub_cpu_to_be16 (hw_type); + arp_reply->pro = grub_cpu_to_be16_compile_time (GRUB_NET_ETHERTYPE_IP); +- arp_reply->pln = 4; +- arp_reply->hln = 6; ++ arp_reply->pln = pln; ++ arp_reply->hln = hln; + arp_reply->op = grub_cpu_to_be16_compile_time (ARP_REPLY); +- arp_reply->sender_ip = arp_packet->recv_ip; +- arp_reply->recv_ip = arp_packet->sender_ip; +- arp_reply->hln = 6; +- +- target.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (target.mac, arp_packet->sender_mac, 6); +- grub_memcpy (arp_reply->sender_mac, inf->hwaddress.mac, 6); +- grub_memcpy (arp_reply->recv_mac, arp_packet->sender_mac, 6); ++ ++ tmp_ptr = nb_reply.data + sizeof (*arp_reply); ++ ++ /* The source hardware address. */ ++ grub_memcpy (tmp_ptr, inf->hwaddress.mac, hln); ++ tmp_ptr += hln; ++ ++ /* The source protocol address. */ ++ grub_memcpy (tmp_ptr, &target_addr.ipv4, pln); ++ tmp_ptr += pln; ++ ++ /* The target hardware address. */ ++ grub_memcpy (tmp_ptr, sender_mac_addr.mac, hln); ++ tmp_ptr += hln; ++ ++ /* The target protocol address */ ++ grub_memcpy (tmp_ptr, &sender_addr.ipv4, pln); ++ tmp_ptr += pln; ++ ++ target.type = hw_type; ++ target.len = hln; ++ grub_memcpy (target.mac, sender_mac_addr.mac, hln); + + /* Change operation to REPLY and send packet */ + send_ethernet_packet (inf, &nb_reply, target, GRUB_NET_ETHERTYPE_ARP); +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index e0aec25233d..76e4c11a46f 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -325,7 +325,6 @@ grub_net_configure_by_dhcp_ack (const char *name, + int is_def, char **device, char **path) + { + grub_net_network_level_address_t addr; +- grub_net_link_level_address_t hwaddr; + struct grub_net_network_level_interface *inter; + int mask = -1; + char server_ip[sizeof ("xxx.xxx.xxx.xxx")]; +@@ -343,12 +342,8 @@ grub_net_configure_by_dhcp_ack (const char *name, + if (path) + *path = 0; + +- grub_memcpy (hwaddr.mac, bp->mac_addr, +- bp->hw_len < sizeof (hwaddr.mac) ? bp->hw_len +- : sizeof (hwaddr.mac)); +- hwaddr.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- +- inter = grub_net_add_addr (name, card, &addr, &hwaddr, flags); ++ grub_dprintf("dhcp", "configuring dhcp for %s\n", name); ++ inter = grub_net_add_addr (name, card, &addr, &card->default_address, flags); + if (!inter) + return 0; + +@@ -660,7 +655,9 @@ send_dhcp_packet (struct grub_net_network_level_interface *iface) + grub_memset (pack, 0, sizeof (*pack)); + pack->opcode = 1; + pack->hw_type = 1; +- pack->hw_len = 6; ++ pack->hw_len = iface->hwaddress.len > 16 ? 0 ++ : iface->hwaddress.len; ++ + err = grub_get_datetime (&date); + if (err || !grub_datetime2unixtime (&date, &t)) + { +@@ -673,7 +670,7 @@ send_dhcp_packet (struct grub_net_network_level_interface *iface) + else + pack->ident = iface->xid; + +- grub_memcpy (&pack->mac_addr, &iface->hwaddress.mac, 6); ++ grub_memcpy (&pack->mac_addr, &iface->hwaddress.mac, pack->hw_len); + + err = grub_netbuff_push (nb, sizeof (*udph)); + if (err) +diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c +index 3e2432fb61c..7deb0a32efd 100644 +--- a/grub-core/net/drivers/efi/efinet.c ++++ b/grub-core/net/drivers/efi/efinet.c +@@ -288,6 +288,9 @@ grub_efinet_findcards (void) + /* This should not happen... Why? */ + continue; + ++ if (net->mode->hwaddr_size > GRUB_NET_MAX_LINK_ADDRESS_SIZE) ++ continue; ++ + if (net->mode->state == GRUB_EFI_NETWORK_STOPPED + && net->start (net) != GRUB_EFI_SUCCESS) + continue; +@@ -332,10 +335,11 @@ grub_efinet_findcards (void) + * such as LoadFile2 for initrd loading. + */ + card->flags = GRUB_NET_CARD_NO_CLOSE_ON_FINI_HW; +- card->default_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ card->default_address.type = net->mode->if_type; ++ card->default_address.len = net->mode->hwaddr_size; + grub_memcpy (card->default_address.mac, + net->mode->current_address, +- sizeof (card->default_address.mac)); ++ net->mode->hwaddr_size); + card->efi_net = net; + card->efi_handle = *handle; + +diff --git a/grub-core/net/drivers/emu/emunet.c b/grub-core/net/drivers/emu/emunet.c +index 5f311d40f49..7461d13bbc2 100644 +--- a/grub-core/net/drivers/emu/emunet.c ++++ b/grub-core/net/drivers/emu/emunet.c +@@ -46,6 +46,7 @@ static struct grub_net_card emucard = + .mtu = 1500, + .default_address = { + .type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET, ++ . len = 6, + {.mac = {0, 1, 2, 3, 4, 5}} + }, + .flags = 0 +diff --git a/grub-core/net/drivers/i386/pc/pxe.c b/grub-core/net/drivers/i386/pc/pxe.c +index db17186ee7d..816d1d0eeda 100644 +--- a/grub-core/net/drivers/i386/pc/pxe.c ++++ b/grub-core/net/drivers/i386/pc/pxe.c +@@ -386,20 +386,21 @@ GRUB_MOD_INIT(pxe) + grub_memset (ui, 0, sizeof (*ui)); + grub_pxe_call (GRUB_PXENV_UNDI_GET_INFORMATION, ui, pxe_rm_entry); + ++ grub_pxe_card.default_address.len = 6; + grub_memcpy (grub_pxe_card.default_address.mac, ui->current_addr, +- sizeof (grub_pxe_card.default_address.mac)); +- for (i = 0; i < sizeof (grub_pxe_card.default_address.mac); i++) ++ grub_pxe_card.default_address.len); ++ for (i = 0; i < grub_pxe_card.default_address.len; i++) + if (grub_pxe_card.default_address.mac[i] != 0) + break; +- if (i != sizeof (grub_pxe_card.default_address.mac)) ++ if (i != grub_pxe_card.default_address.len) + { +- for (i = 0; i < sizeof (grub_pxe_card.default_address.mac); i++) ++ for (i = 0; i < grub_pxe_card.default_address.len; i++) + if (grub_pxe_card.default_address.mac[i] != 0xff) + break; + } +- if (i == sizeof (grub_pxe_card.default_address.mac)) ++ if (i == grub_pxe_card.default_address.len) + grub_memcpy (grub_pxe_card.default_address.mac, ui->permanent_addr, +- sizeof (grub_pxe_card.default_address.mac)); ++ grub_pxe_card.default_address.len); + grub_pxe_card.mtu = ui->mtu; + + grub_pxe_card.default_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index 78f03df8e21..c56461ff1ae 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -160,6 +160,7 @@ grub_ieee1275_parse_bootpath (const char *devpath, char *bootpath, + grub_uint16_t vlantag = 0; + + hw_addr.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ hw_addr.len = 6; + + args = bootpath + grub_strlen (devpath) + 1; + do +@@ -491,6 +492,7 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + grub_memcpy (&lla.mac, pprop, 6); + + lla.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ lla.len = 6; + card->default_address = lla; + + card->txbufsize = ALIGN_UP (card->mtu, 64) + 256; +diff --git a/grub-core/net/drivers/uboot/ubootnet.c b/grub-core/net/drivers/uboot/ubootnet.c +index b9d5a0cd494..9f3354a1b74 100644 +--- a/grub-core/net/drivers/uboot/ubootnet.c ++++ b/grub-core/net/drivers/uboot/ubootnet.c +@@ -131,6 +131,7 @@ GRUB_MOD_INIT (ubootnet) + + grub_memcpy (&(card->default_address.mac), &devinfo->di_net.hwaddr, 6); + card->default_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ card->default_address.len = 6; + + card->txbufsize = ALIGN_UP (card->mtu, 64) + 256; + card->txbuf = grub_zalloc (card->txbufsize); +diff --git a/grub-core/net/ethernet.c b/grub-core/net/ethernet.c +index 707bbb12cb2..1441a1bacff 100644 +--- a/grub-core/net/ethernet.c ++++ b/grub-core/net/ethernet.c +@@ -29,13 +29,6 @@ + + #define LLCADDRMASK 0x7f + +-struct etherhdr +-{ +- grub_uint8_t dst[6]; +- grub_uint8_t src[6]; +- grub_uint16_t type; +-} GRUB_PACKED; +- + struct llchdr + { + grub_uint8_t dsap; +@@ -55,13 +48,15 @@ send_ethernet_packet (struct grub_net_network_level_interface *inf, + grub_net_link_level_address_t target_addr, + grub_net_ethertype_t ethertype) + { +- struct etherhdr *eth; ++ grub_uint8_t *eth; + grub_err_t err; +- grub_uint8_t etherhdr_size; +- grub_uint16_t vlantag_id = grub_cpu_to_be16_compile_time (VLANTAG_IDENTIFIER); ++ grub_uint32_t vlantag = 0; ++ grub_uint8_t hw_addr_len = inf->card->default_address.len; ++ grub_uint8_t etherhdr_size = 2 * hw_addr_len + 2; + +- etherhdr_size = sizeof (*eth); +- COMPILE_TIME_ASSERT (sizeof (*eth) + 4 < GRUB_NET_MAX_LINK_HEADER_SIZE); ++ /* Source and destination link addresses + ethertype + vlan tag */ ++ COMPILE_TIME_ASSERT ((GRUB_NET_MAX_LINK_ADDRESS_SIZE * 2 + 2 + 4) < ++ GRUB_NET_MAX_LINK_HEADER_SIZE); + + /* Increase ethernet header in case of vlantag */ + if (inf->vlantag != 0) +@@ -70,11 +65,22 @@ send_ethernet_packet (struct grub_net_network_level_interface *inf, + err = grub_netbuff_push (nb, etherhdr_size); + if (err) + return err; +- eth = (struct etherhdr *) nb->data; +- grub_memcpy (eth->dst, target_addr.mac, 6); +- grub_memcpy (eth->src, inf->hwaddress.mac, 6); ++ eth = nb->data; ++ grub_memcpy (eth, target_addr.mac, hw_addr_len); ++ eth += hw_addr_len; ++ grub_memcpy (eth, inf->hwaddress.mac, hw_addr_len); ++ eth += hw_addr_len; ++ ++ /* Check if a vlan-tag is present. */ ++ if (vlantag != 0) ++ { ++ *((grub_uint32_t *)eth) = grub_cpu_to_be32 (vlantag); ++ eth += sizeof (vlantag); ++ } ++ ++ /* Write ethertype */ ++ *((grub_uint16_t*) eth) = grub_cpu_to_be16 (ethertype); + +- eth->type = grub_cpu_to_be16 (ethertype); + if (!inf->card->opened) + { + err = GRUB_ERR_NONE; +@@ -85,19 +91,6 @@ send_ethernet_packet (struct grub_net_network_level_interface *inf, + inf->card->opened = 1; + } + +- /* Check and add a vlan-tag if needed. */ +- if (inf->vlantag != 0) +- { +- /* Move eth type to the right */ +- grub_memcpy ((char *) nb->data + etherhdr_size - 2, +- (char *) nb->data + etherhdr_size - 6, 2); +- +- /* Add the tag in the middle */ +- grub_uint16_t vlan = grub_cpu_to_be16 (inf->vlantag); +- grub_memcpy ((char *) nb->data + etherhdr_size - 6, &vlantag_id, 2); +- grub_memcpy ((char *) nb->data + etherhdr_size - 4, &vlan, 2); +- } +- + return inf->card->driver->send (inf->card, nb); + } + +@@ -105,31 +98,40 @@ grub_err_t + grub_net_recv_ethernet_packet (struct grub_net_buff *nb, + struct grub_net_card *card) + { +- struct etherhdr *eth; ++ grub_uint8_t *eth; + struct llchdr *llch; + struct snaphdr *snaph; + grub_net_ethertype_t type; + grub_net_link_level_address_t hwaddress; + grub_net_link_level_address_t src_hwaddress; + grub_err_t err; +- grub_uint8_t etherhdr_size = sizeof (*eth); ++ grub_uint8_t hw_addr_len = card->default_address.len; ++ grub_uint8_t etherhdr_size = 2 * hw_addr_len + 2; + grub_uint16_t vlantag = 0; + ++ eth = nb->data; + +- /* Check if a vlan-tag is present. If so, the ethernet header is 4 bytes */ +- /* longer than the original one. The vlantag id is extracted and the header */ +- /* is reseted to the original size. */ +- if (grub_get_unaligned16 (nb->data + etherhdr_size - 2) == grub_cpu_to_be16_compile_time (VLANTAG_IDENTIFIER)) ++ hwaddress.type = card->default_address.type; ++ hwaddress.len = hw_addr_len; ++ grub_memcpy (hwaddress.mac, eth, hw_addr_len); ++ eth += hw_addr_len; ++ ++ src_hwaddress.type = card->default_address.type; ++ src_hwaddress.len = hw_addr_len; ++ grub_memcpy (src_hwaddress.mac, eth, hw_addr_len); ++ eth += hw_addr_len; ++ ++ type = grub_be_to_cpu16 (*(grub_uint16_t*)(eth)); ++ if (type == VLANTAG_IDENTIFIER) + { +- vlantag = grub_be_to_cpu16 (grub_get_unaligned16 (nb->data + etherhdr_size)); ++ /* Skip vlan tag */ ++ eth += 2; ++ vlantag = grub_be_to_cpu16 (*(grub_uint16_t*)(eth)); + etherhdr_size += 4; +- /* Move eth type to the original position */ +- grub_memcpy((char *) nb->data + etherhdr_size - 6, +- (char *) nb->data + etherhdr_size - 2, 2); ++ eth += 2; ++ type = grub_be_to_cpu16 (*(grub_uint16_t*)(eth)); + } + +- eth = (struct etherhdr *) nb->data; +- type = grub_be_to_cpu16 (eth->type); + err = grub_netbuff_pull (nb, etherhdr_size); + if (err) + return err; +@@ -149,11 +151,6 @@ grub_net_recv_ethernet_packet (struct grub_net_buff *nb, + } + } + +- hwaddress.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (hwaddress.mac, eth->dst, sizeof (hwaddress.mac)); +- src_hwaddress.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (src_hwaddress.mac, eth->src, sizeof (src_hwaddress.mac)); +- + switch (type) + { + /* ARP packet. */ +diff --git a/grub-core/net/icmp6.c b/grub-core/net/icmp6.c +index 9a8c4511285..5924fd53aca 100644 +--- a/grub-core/net/icmp6.c ++++ b/grub-core/net/icmp6.c +@@ -231,8 +231,9 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb, + && ohdr->len == 1) + { + grub_net_link_level_address_t ll_address; +- ll_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (ll_address.mac, ohdr + 1, sizeof (ll_address.mac)); ++ ll_address.type = card->default_address.type; ++ ll_address.len = card->default_address.len; ++ grub_memcpy (ll_address.mac, ohdr + 1, ll_address.len); + grub_net_link_layer_add_address (card, source, &ll_address, 0); + } + } +@@ -335,8 +336,9 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb, + && ohdr->len == 1) + { + grub_net_link_level_address_t ll_address; +- ll_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (ll_address.mac, ohdr + 1, sizeof (ll_address.mac)); ++ ll_address.type = card->default_address.type; ++ ll_address.len = card->default_address.len; ++ grub_memcpy (ll_address.mac, ohdr + 1, ll_address.len); + grub_net_link_layer_add_address (card, source, &ll_address, 0); + } + } +@@ -384,8 +386,9 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb, + && ohdr->len == 1) + { + grub_net_link_level_address_t ll_address; +- ll_address.type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memcpy (ll_address.mac, ohdr + 1, sizeof (ll_address.mac)); ++ ll_address.type = card->default_address.type; ++ ll_address.len = card->default_address.len; ++ grub_memcpy (ll_address.mac, ohdr + 1, ll_address.len); + grub_net_link_layer_add_address (card, source, &ll_address, 0); + } + if (ohdr->type == OPTION_PREFIX && ohdr->len == 4) +diff --git a/grub-core/net/ip.c b/grub-core/net/ip.c +index f967618e53f..3c475762cc0 100644 +--- a/grub-core/net/ip.c ++++ b/grub-core/net/ip.c +@@ -316,8 +316,8 @@ handle_dgram (struct grub_net_buff *nb, + if (inf->card == card + && inf->address.type == GRUB_NET_NETWORK_LEVEL_PROTOCOL_DHCP_RECV + && inf->hwaddress.type == GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET +- && grub_memcmp (inf->hwaddress.mac, &bootp->mac_addr, +- sizeof (inf->hwaddress.mac)) == 0) ++ && (grub_memcmp (inf->hwaddress.mac, &bootp->mac_addr, ++ bootp->hw_len) == 0 || bootp->hw_len == 0)) + { + grub_net_process_dhcp (nb, inf); + grub_netbuff_free (nb); +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 20c55257647..fa6b6537142 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -133,8 +133,9 @@ grub_net_link_layer_resolve (struct grub_net_network_level_interface *inf, + << 48) + && proto_addr->ipv6[1] == (grub_be_to_cpu64_compile_time (1)))) + { +- hw_addr->type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; +- grub_memset (hw_addr->mac, -1, 6); ++ hw_addr->type = inf->card->default_address.type; ++ hw_addr->len = inf->card->default_address.len; ++ grub_memset (hw_addr->mac, -1, hw_addr->len); + return GRUB_ERR_NONE; + } + +@@ -142,6 +143,7 @@ grub_net_link_layer_resolve (struct grub_net_network_level_interface *inf, + && ((grub_be_to_cpu64 (proto_addr->ipv6[0]) >> 56) == 0xff)) + { + hw_addr->type = GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET; ++ hw_addr->len = inf->card->default_address.len; + hw_addr->mac[0] = 0x33; + hw_addr->mac[1] = 0x33; + hw_addr->mac[2] = ((grub_be_to_cpu64 (proto_addr->ipv6[1]) >> 24) & 0xff); +@@ -772,23 +774,23 @@ grub_net_addr_to_str (const grub_net_network_level_address_t *target, char *buf) + void + grub_net_hwaddr_to_str (const grub_net_link_level_address_t *addr, char *str) + { +- str[0] = 0; +- switch (addr->type) ++ char *ptr; ++ unsigned i; ++ int maxstr; ++ ++ if (addr->len > GRUB_NET_MAX_LINK_ADDRESS_SIZE) + { +- case GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET: +- { +- char *ptr; +- unsigned i; +- for (ptr = str, i = 0; i < ARRAY_SIZE (addr->mac); i++) +- { +- grub_snprintf (ptr, GRUB_NET_MAX_STR_HWADDR_LEN - (ptr - str), +- "%02x:", addr->mac[i] & 0xff); +- ptr += (sizeof ("XX:") - 1); +- } +- return; +- } ++ str[0] = 0; ++ grub_printf (_("Unsupported hw address type %d len %d\n"), ++ addr->type, addr->len); ++ return; ++ } ++ maxstr = addr->len * grub_strlen ("XX:"); ++ for (ptr = str, i = 0; i < addr->len; i++) ++ { ++ ptr += grub_snprintf (ptr, maxstr - (ptr - str), ++ "%02x:", addr->mac[i] & 0xff); + } +- grub_printf (_("Unsupported hw address type %d\n"), addr->type); + } + + void +@@ -813,13 +815,17 @@ grub_net_hwaddr_cmp (const grub_net_link_level_address_t *a, + return -1; + if (a->type > b->type) + return +1; +- switch (a->type) ++ if (a->len < b->len) ++ return -1; ++ if (a->len > b->len) ++ return +1; ++ if (a->len > GRUB_NET_MAX_LINK_ADDRESS_SIZE) + { +- case GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET: +- return grub_memcmp (a->mac, b->mac, sizeof (a->mac)); ++ grub_printf (_("Unsupported hw address type %d len %d\n"), ++ a->type, a->len); ++ return + 1; + } +- grub_printf (_("Unsupported hw address type %d\n"), a->type); +- return 1; ++ return grub_memcmp (a->mac, b->mac, a->len); + } + + int +diff --git a/include/grub/net.h b/include/grub/net.h +index ff901b96e22..1d76fd9a1f5 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -29,7 +29,8 @@ + + enum + { +- GRUB_NET_MAX_LINK_HEADER_SIZE = 64, ++ GRUB_NET_MAX_LINK_HEADER_SIZE = 96, ++ GRUB_NET_MAX_LINK_ADDRESS_SIZE = 32, + GRUB_NET_UDP_HEADER_SIZE = 8, + GRUB_NET_TCP_HEADER_SIZE = 20, + GRUB_NET_OUR_IPV4_HEADER_SIZE = 20, +@@ -42,15 +43,17 @@ enum + + typedef enum grub_link_level_protocol_id + { +- GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET ++ /* IANA ARP constant to define hardware type. */ ++ GRUB_NET_LINK_LEVEL_PROTOCOL_ETHERNET = 1, + } grub_link_level_protocol_id_t; + + typedef struct grub_net_link_level_address + { + grub_link_level_protocol_id_t type; ++ grub_uint8_t len; + union + { +- grub_uint8_t mac[6]; ++ grub_uint8_t mac[GRUB_NET_MAX_LINK_ADDRESS_SIZE]; + }; + } grub_net_link_level_address_t; + +@@ -588,11 +591,13 @@ grub_net_addr_cmp (const grub_net_network_level_address_t *a, + #define GRUB_NET_MAX_STR_ADDR_LEN sizeof ("XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX") + + /* +- Currently suppoerted adresses: +- ethernet: XX:XX:XX:XX:XX:XX ++ Up to 32 byte hardware address supported, see GRUB_NET_MAX_LINK_ADDRESS_SIZE + */ +- +-#define GRUB_NET_MAX_STR_HWADDR_LEN (sizeof ("XX:XX:XX:XX:XX:XX")) ++#define GRUB_NET_MAX_STR_HWADDR_LEN (sizeof (\ ++ "XX:XX:XX:XX:XX:XX:XX:XX:"\ ++ "XX:XX:XX:XX:XX:XX:XX:XX:"\ ++ "XX:XX:XX:XX:XX:XX:XX:XX:"\ ++ "XX:XX:XX:XX:XX:XX:XX:XX")) + + /* Max VLAN id = 4094 */ + #define GRUB_NET_MAX_STR_VLAN_LEN (sizeof ("vlanXXXX")) diff --git a/0063-grub-mkcofnig-default-entry-correction.patch b/0063-grub-mkcofnig-default-entry-correction.patch deleted file mode 100644 index cd11814..0000000 --- a/0063-grub-mkcofnig-default-entry-correction.patch +++ /dev/null @@ -1,29 +0,0 @@ -From b23f0e130f4250679ec132332cd3c3d7ee1dfead Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 17:50:41 +0800 -Subject: [PATCH 063/272] grub mkcofnig default entry correction - -Signed-off-by: Michael Chang ---- - util/grub-mkconfig.in | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index a1f17678d..01b469c1e 100644 ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -362,6 +362,11 @@ and /etc/grub.d/* files or please file a bug report with - cat ${grub_cfg}.new > ${grub_cfg} - umask $oldumask - rm -f ${grub_cfg}.new -+ # check if default entry need to be corrected for updated distributor version -+ # and/or use fallback entry if default kernel entry removed -+ if test -x /usr/sbin/grub2-check-default; then -+ /usr/sbin/grub2-check-default >&2 -+ fi - sync_fs_journal || true - fi - fi --- -2.41.0 - diff --git a/0055-efinet-UEFI-IPv6-PXE-support.patch b/0064-efinet-UEFI-IPv6-PXE-support.patch similarity index 39% rename from 0055-efinet-UEFI-IPv6-PXE-support.patch rename to 0064-efinet-UEFI-IPv6-PXE-support.patch index fbb93a9..2d8a3ae 100644 --- a/0055-efinet-UEFI-IPv6-PXE-support.patch +++ b/0064-efinet-UEFI-IPv6-PXE-support.patch @@ -1,7 +1,7 @@ -From ec9ad0e18df28955bbba66b3316c040fb8d16273 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Wed, 15 Apr 2015 14:48:30 +0800 -Subject: [PATCH 055/272] efinet: UEFI IPv6 PXE support +Subject: [PATCH] efinet: UEFI IPv6 PXE support When grub2 image is booted from UEFI IPv6 PXE, the DHCPv6 Reply packet is cached in firmware buffer which can be obtained by PXE Base Code protocol. The @@ -10,48 +10,62 @@ network interface can be setup through the parameters in that obtained packet. Signed-off-by: Michael Chang Signed-off-by: Ken Lin --- - grub-core/net/drivers/efi/efinet.c | 13 +++++++ - include/grub/efi/api.h | 55 +++++++++++++++++++++++++++++- - 2 files changed, 67 insertions(+), 1 deletion(-) + grub-core/net/drivers/efi/efinet.c | 2 ++ + include/grub/efi/api.h | 71 +++++++++++++++++++++++--------------- + 2 files changed, 46 insertions(+), 27 deletions(-) diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c -index 3ea25cf98..77ee9925b 100644 +index 7deb0a32efd..92bb7444782 100644 --- a/grub-core/net/drivers/efi/efinet.c +++ b/grub-core/net/drivers/efi/efinet.c -@@ -400,6 +400,18 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, - continue; - pxe_mode = pxe->mode; - -+ if (pxe_mode->using_ipv6) -+ { -+ grub_net_configure_by_dhcpv6_reply (card->name, card, 0, -+ (struct grub_net_dhcp6_packet *) -+ &pxe_mode->dhcp_ack, -+ sizeof (pxe_mode->dhcp_ack), -+ 1, device, path); +@@ -430,6 +430,8 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + grub_print_error (); + if (inter && device && path) + grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); + if (grub_errno) + grub_print_error (); -+ } -+ else -+ { - inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, - (struct grub_net_bootp_packet *) - &pxe_mode->dhcp_ack, -@@ -428,6 +440,7 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, - vlan_dp = (grub_efi_device_path_t *) ((grub_efi_uint8_t *) vlan_dp + vlan_dp_len); - } } -+ } - return; - } - } + else + { diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h -index d44d00ad7..4b61c8ea1 100644 +index daa9268fdaa..53f5c781ac3 100644 --- a/include/grub/efi/api.h +++ b/include/grub/efi/api.h -@@ -1523,14 +1523,67 @@ typedef struct grub_efi_simple_text_output_interface grub_efi_simple_text_output +@@ -1571,31 +1571,6 @@ typedef union + grub_efi_pxe_dhcpv6_packet_t dhcpv6; + } grub_efi_pxe_packet_t; - typedef grub_uint8_t grub_efi_pxe_packet_t[1472]; +-#define GRUB_EFI_PXE_MAX_IPCNT 8 +-#define GRUB_EFI_PXE_MAX_ARP_ENTRIES 8 +-#define GRUB_EFI_PXE_MAX_ROUTE_ENTRIES 8 +- +-typedef struct grub_efi_pxe_ip_filter +-{ +- grub_efi_uint8_t filters; +- grub_efi_uint8_t ip_count; +- grub_efi_uint16_t reserved; +- grub_efi_ip_address_t ip_list[GRUB_EFI_PXE_MAX_IPCNT]; +-} grub_efi_pxe_ip_filter_t; +- +-typedef struct grub_efi_pxe_arp_entry +-{ +- grub_efi_ip_address_t ip_addr; +- grub_efi_mac_address_t mac_addr; +-} grub_efi_pxe_arp_entry_t; +- +-typedef struct grub_efi_pxe_route_entry +-{ +- grub_efi_ip_address_t ip_addr; +- grub_efi_ip_address_t subnet_mask; +- grub_efi_ip_address_t gateway_addr; +-} grub_efi_pxe_route_entry_t; +- + typedef struct grub_efi_pxe_icmp_error + { + grub_efi_uint8_t type; +@@ -1621,6 +1596,48 @@ typedef struct grub_efi_pxe_tftp_error + grub_efi_char8_t error_string[127]; + } grub_efi_pxe_tftp_error_t; +typedef struct { + grub_uint8_t addr[4]; @@ -66,28 +80,29 @@ index d44d00ad7..4b61c8ea1 100644 +} grub_efi_pxe_mac_address_t; + +typedef union { -+ grub_uint32_t addr[4]; -+ grub_efi_pxe_ipv4_address_t v4; -+ grub_efi_pxe_ipv6_address_t v6; ++ grub_uint32_t addr[4]; ++ grub_efi_pxe_ipv4_address_t v4; ++ grub_efi_pxe_ipv6_address_t v6; +} grub_efi_pxe_ip_address_t; + +#define GRUB_EFI_PXE_BASE_CODE_MAX_IPCNT 8 -+typedef struct { -+ grub_uint8_t filters; -+ grub_uint8_t ip_cnt; -+ grub_uint16_t reserved; -+ grub_efi_pxe_ip_address_t ip_list[GRUB_EFI_PXE_BASE_CODE_MAX_IPCNT]; ++typedef struct grub_efi_pxe_ip_filter ++{ ++ grub_efi_uint8_t filters; ++ grub_efi_uint8_t ip_count; ++ grub_efi_uint16_t reserved; ++ grub_efi_ip_address_t ip_list[GRUB_EFI_PXE_BASE_CODE_MAX_IPCNT]; +} grub_efi_pxe_ip_filter_t; + +typedef struct { -+ grub_efi_pxe_ip_address_t ip_addr; -+ grub_efi_pxe_mac_address_t mac_addr; ++ grub_efi_pxe_ip_address_t ip_addr; ++ grub_efi_pxe_mac_address_t mac_addr; +} grub_efi_pxe_arp_entry_t; + +typedef struct { -+ grub_efi_pxe_ip_address_t ip_addr; -+ grub_efi_pxe_ip_address_t subnet_mask; -+ grub_efi_pxe_ip_address_t gw_addr; ++ grub_efi_pxe_ip_address_t ip_addr; ++ grub_efi_pxe_ip_address_t subnet_mask; ++ grub_efi_pxe_ip_address_t gw_addr; +} grub_efi_pxe_route_entry_t; + + @@ -96,28 +111,16 @@ index d44d00ad7..4b61c8ea1 100644 + typedef struct grub_efi_pxe_mode { -- grub_uint8_t unused[52]; -+ grub_uint8_t started; -+ grub_uint8_t ipv6_available; -+ grub_uint8_t ipv6_supported; -+ grub_uint8_t using_ipv6; -+ grub_uint8_t unused[16]; -+ grub_efi_pxe_ip_address_t station_ip; -+ grub_efi_pxe_ip_address_t subnet_mask; - grub_efi_pxe_packet_t dhcp_discover; - grub_efi_pxe_packet_t dhcp_ack; - grub_efi_pxe_packet_t proxy_offer; - grub_efi_pxe_packet_t pxe_discover; - grub_efi_pxe_packet_t pxe_reply; -+ grub_efi_pxe_packet_t pxe_bis_reply; -+ grub_efi_pxe_ip_filter_t ip_filter; -+ grub_uint32_t arp_cache_entries; + grub_efi_boolean_t started; +@@ -1652,9 +1669,9 @@ typedef struct grub_efi_pxe_mode + grub_efi_pxe_packet_t pxe_bis_reply; + grub_efi_pxe_ip_filter_t ip_filter; + grub_efi_uint32_t arp_cache_entries; +- grub_efi_pxe_arp_entry_t arp_cache[GRUB_EFI_PXE_MAX_ARP_ENTRIES]; + grub_efi_pxe_arp_entry_t arp_cache[GRUB_EFI_PXE_BASE_CODE_MAX_ARP_ENTRIES]; -+ grub_uint32_t route_table_entries; + grub_efi_uint32_t route_table_entries; +- grub_efi_pxe_route_entry_t route_table[GRUB_EFI_PXE_MAX_ROUTE_ENTRIES]; + grub_efi_pxe_route_entry_t route_table[GRUB_EFI_PXE_BASE_CODE_MAX_ROUTE_ENTRIES]; + grub_efi_pxe_icmp_error_t icmp_error; + grub_efi_pxe_tftp_error_t tftp_error; } grub_efi_pxe_mode_t; - - typedef struct grub_efi_pxe --- -2.41.0 - diff --git a/0064-grub-install-handle-signed-grub-installation-on-arm6.patch b/0064-grub-install-handle-signed-grub-installation-on-arm6.patch deleted file mode 100644 index c556a6c..0000000 --- a/0064-grub-install-handle-signed-grub-installation-on-arm6.patch +++ /dev/null @@ -1,230 +0,0 @@ -From 9d91b42285fbb5614c41d9ebdef3f1f65318219a Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 17:53:18 +0800 -Subject: [PATCH 064/272] grub-install: handle signed grub installation on - arm64-efi - -Use grub2-install to handle signed grub installation for arm64 UEFI secure -boot, the default behavior is auto, which will install signed grub whenever -detected. - -Two options, --suse-force-signed and --suse-inhibit-signed, can be used to -override the default auto detecting behavior. The former will force to use -prebuilt signed image and thus will fail if missing, the latter will always use -'mkimage' to create unsigned core image per the user's running environment. - -Signed-off-by: Michael Chang -Signed-off-by: nilusyi ---- - util/grub-install.c | 134 +++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 133 insertions(+), 1 deletion(-) - -diff --git a/util/grub-install.c b/util/grub-install.c -index b195eabbe..828365580 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -82,6 +82,15 @@ static char *product_version; - static int add_rs_codes = 1; - static int enable_tpm = 0; - -+enum -+ { -+ SIGNED_GRUB_INHIBIT, -+ SIGNED_GRUB_AUTO, -+ SIGNED_GRUB_FORCE -+ }; -+ -+static int signed_grub_mode = SIGNED_GRUB_AUTO; -+ - enum - { - OPTION_BOOT_DIRECTORY = 0x301, -@@ -109,6 +118,8 @@ enum - OPTION_NO_RS_CODES, - OPTION_MACPPC_DIRECTORY, - OPTION_ENABLE_TPM, -+ OPTION_FORCE_SIGNED, -+ OPTION_INHIBIT_SIGNED, - OPTION_LABEL_FONT, - OPTION_LABEL_COLOR, - OPTION_LABEL_BGCOLOR, -@@ -231,6 +242,14 @@ argp_parser (int key, char *arg, struct argp_state *state) - enable_tpm = 1; - return 0; - -+ case OPTION_FORCE_SIGNED: -+ signed_grub_mode = SIGNED_GRUB_FORCE; -+ return 0; -+ -+ case OPTION_INHIBIT_SIGNED: -+ signed_grub_mode = SIGNED_GRUB_INHIBIT; -+ return 0; -+ - case OPTION_DEBUG: - verbosity++; - return 0; -@@ -294,6 +313,13 @@ static struct argp_option options[] = { - "This option is only available on x86 BIOS targets."), 0}, - {"enable-tpm", OPTION_ENABLE_TPM, 0, 0, N_("install TPM modules"), 0}, - -+ {"force-signed", OPTION_FORCE_SIGNED, 0, 0, -+ N_("force installation of signed grub" "%s." -+ "This option is only available on ARM64 EFI targets."), 0}, -+ {"inhibit-signed", OPTION_INHIBIT_SIGNED, 0, 0, -+ N_("inhibit installation of signed grub. " -+ "This option is only available on ARM64 EFI targets."), 0}, -+ - {"debug", OPTION_DEBUG, 0, OPTION_HIDDEN, 0, 2}, - {"no-floppy", OPTION_NO_FLOPPY, 0, OPTION_HIDDEN, 0, 2}, - {"debug-image", OPTION_DEBUG_IMAGE, N_("STRING"), OPTION_HIDDEN, 0, 2}, -@@ -364,6 +390,22 @@ help_filter (int key, const char *text, void *input __attribute__ ((unused))) - free (plats); - return ret; - } -+ case OPTION_FORCE_SIGNED: -+ { -+ const char *t = get_default_platform (); -+ char *ret; -+ if (grub_strcmp (t, "arm64-efi") == 0) -+ { -+ char *s = grub_util_path_concat (3, grub_util_get_pkglibdir (), t, "grub.efi"); -+ char *text2 = xasprintf (" [default=%s]", s); -+ ret = xasprintf (text, text2); -+ free (text2); -+ free (s); -+ } -+ else -+ ret = xasprintf (text, ""); -+ return ret; -+ } - case ARGP_KEY_HELP_POST_DOC: - return xasprintf (text, program_name, GRUB_BOOT_DIR_NAME "/" GRUB_DIR_NAME); - default: -@@ -1652,13 +1694,34 @@ main (int argc, char *argv[]) - - char mkimage_target[200]; - const char *core_name = NULL; -+ char *signed_imgfile = NULL; - - switch (platform) - { -+ case GRUB_INSTALL_PLATFORM_ARM64_EFI: -+ -+ if (signed_grub_mode > SIGNED_GRUB_INHIBIT) -+ { -+ signed_imgfile = grub_util_path_concat (2, grub_install_source_directory, "grub.efi"); -+ if (!grub_util_is_regular (signed_imgfile)) -+ { -+ if (signed_grub_mode >= SIGNED_GRUB_FORCE) -+ grub_util_error ("signed image `%s' does not exist\n", signed_imgfile); -+ else -+ { -+ free (signed_imgfile); -+ signed_imgfile = NULL; -+ } -+ } -+ } -+ -+ if (signed_imgfile) -+ fprintf (stderr, _("Use signed file in %s for installation.\n"), signed_imgfile); -+ -+ /* fallthrough. */ - case GRUB_INSTALL_PLATFORM_I386_EFI: - case GRUB_INSTALL_PLATFORM_X86_64_EFI: - case GRUB_INSTALL_PLATFORM_ARM_EFI: -- case GRUB_INSTALL_PLATFORM_ARM64_EFI: - case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: - case GRUB_INSTALL_PLATFORM_RISCV32_EFI: - case GRUB_INSTALL_PLATFORM_RISCV64_EFI: -@@ -1725,12 +1788,74 @@ main (int argc, char *argv[]) - core_name); - char *prefix = xasprintf ("%s%s", prefix_drive ? : "", - relative_grubdir); -+ char *grub_efi_cfg = NULL; -+ if (!signed_imgfile) - grub_install_make_image_wrap (/* source dir */ grub_install_source_directory, - /*prefix */ prefix, - /* output */ imgfile, - /* memdisk */ NULL, - have_load_cfg ? load_cfg : NULL, - /* image target */ mkimage_target, 0); -+ else if (signed_imgfile) -+ { -+ FILE *grub_cfg_f; -+ -+ grub_install_copy_file (signed_imgfile, imgfile, 1); -+ grub_efi_cfg = grub_util_path_concat (2, platdir, "grub.cfg"); -+ grub_cfg_f = grub_util_fopen (grub_efi_cfg, "wb"); -+ if (!grub_cfg_f) -+ grub_util_error (_("Can't create file: %s"), strerror (errno)); -+ -+ if (have_abstractions) -+ { -+ fprintf (grub_cfg_f, "set prefix=(%s)%s\n", grub_drives[0], relative_grubdir); -+ fprintf (grub_cfg_f, "set root=%s\n", grub_drives[0]); -+ } -+ else if (prefix_drive) -+ { -+ char *uuid = NULL; -+ if (grub_fs->fs_uuid && grub_fs->fs_uuid (grub_dev, &uuid)) -+ { -+ grub_print_error (); -+ grub_errno = 0; -+ uuid = NULL; -+ } -+ if (!uuid) -+ grub_util_error ("cannot find fs uuid for %s", grub_fs->name); -+ -+ fprintf (grub_cfg_f, "search --fs-uuid --set=root %s\n", uuid); -+ fprintf (grub_cfg_f, "set prefix=($root)%s\n", relative_grubdir); -+ } -+ -+ if (have_load_cfg) -+ { -+ size_t len; -+ char *buf; -+ -+ FILE *fp = grub_util_fopen (load_cfg, "rb"); -+ if (!fp) -+ grub_util_error (_("Can't read file: %s"), strerror (errno)); -+ -+ fseek (fp, 0, SEEK_END); -+ len = ftell (fp); -+ fseek (fp, 0, SEEK_SET); -+ buf = xmalloc (len); -+ -+ if (fread (buf, 1, len, fp) != len) -+ grub_util_error (_("cannot read `%s': %s"), load_cfg, strerror (errno)); -+ -+ if (fwrite (buf, 1, len, grub_cfg_f) != len) -+ grub_util_error (_("cannot write `%s': %s"), grub_efi_cfg, strerror (errno)); -+ -+ free (buf); -+ fclose (fp); -+ } -+ -+ fprintf (grub_cfg_f, "source ${prefix}/grub.cfg\n"); -+ fclose (grub_cfg_f); -+ free (signed_imgfile); -+ signed_imgfile = NULL; -+ } - /* Backward-compatibility kludges. */ - switch (platform) - { -@@ -2023,6 +2148,13 @@ main (int argc, char *argv[]) - grub_set_install_backup_ponr (); - - free (dst); -+ if (grub_efi_cfg) -+ { -+ dst = grub_util_path_concat (2, efidir, "grub.cfg"); -+ grub_install_copy_file (grub_efi_cfg, dst, 1); -+ free (dst); -+ free (grub_efi_cfg); -+ } - } - if (!removable && update_nvram) - { --- -2.41.0 - diff --git a/0056-grub.texi-Add-net_bootp6-doument.patch b/0065-grub.texi-Add-net_bootp6-doument.patch similarity index 74% rename from 0056-grub.texi-Add-net_bootp6-doument.patch rename to 0065-grub.texi-Add-net_bootp6-doument.patch index a2c7e7b..7286318 100644 --- a/0056-grub.texi-Add-net_bootp6-doument.patch +++ b/0065-grub.texi-Add-net_bootp6-doument.patch @@ -1,21 +1,21 @@ -From 198ea09198894e49dc3aa2501934f724451cbbce Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Tue, 5 May 2015 14:19:24 +0800 -Subject: [PATCH 056/272] grub.texi: Add net_bootp6 doument +Subject: [PATCH] grub.texi: Add net_bootp6 doument Update grub documentation for net_bootp6 command. Signed-off-by: Michael Chang Signed-off-by: Ken Lin --- - docs/grub.texi | 19 +++++++++++++++++++ - 1 file changed, 19 insertions(+) + docs/grub.texi | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) diff --git a/docs/grub.texi b/docs/grub.texi -index a225f9a88..23c5eb165 100644 +index c30701b4e1f..44c4e665a0d 100644 --- a/docs/grub.texi +++ b/docs/grub.texi -@@ -5950,6 +5950,7 @@ Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). +@@ -5955,6 +5955,7 @@ Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). * net_add_dns:: Add a DNS server * net_add_route:: Add routing entry * net_bootp:: Perform a bootp/DHCP autoconfiguration @@ -23,9 +23,9 @@ index a225f9a88..23c5eb165 100644 * net_del_addr:: Remove IP address from interface * net_del_dns:: Remove a DNS server * net_del_route:: Remove a route entry -@@ -6008,6 +6009,24 @@ command (@pxref{net_dhcp}). - @end deffn +@@ -6080,6 +6081,22 @@ Sets environment variable @samp{net_}@var{}@samp{_boot_file} + @end deffn +@node net_bootp6 +@subsection net_bootp6 @@ -43,11 +43,6 @@ index a225f9a88..23c5eb165 100644 +@end table + +@end deffn -+ -+ - @node net_del_addr - @subsection net_del_addr --- -2.41.0 - + @node net_get_dhcp_option + @subsection net_get_dhcp_option diff --git a/0065-grub2-btrfs-help-on-snapper-rollback.patch b/0065-grub2-btrfs-help-on-snapper-rollback.patch deleted file mode 100644 index 93a7712..0000000 --- a/0065-grub2-btrfs-help-on-snapper-rollback.patch +++ /dev/null @@ -1,34 +0,0 @@ -From a6acf2d85ae2b276b551cd5d4d6a503bd1a0fac9 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 1 Apr 2024 19:10:44 +0800 -Subject: [PATCH 065/272] grub2 btrfs help on snapper rollback - -Signed-off-by: nilusyi ---- - util/grub.d/00_header.in | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 8b2658279..f900f9773 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -401,8 +401,14 @@ if [ "x${SUSE_BTRFS_SNAPSHOT_BOOTING}" = "xtrue" ] && - # Note: No $snapshot_num on *read-only* rollback! (bsc#901487) - cat < -Date: Thu, 14 Jul 2016 18:45:14 +0800 -Subject: [PATCH 057/272] bootp: Add processing DHCPACK packet from HTTP Boot +Date: Wed, 10 Jul 2019 23:58:28 +0200 +Subject: [PATCH] bootp: Add processing DHCPACK packet from HTTP Boot The vendor class identifier with the string "HTTPClient" is used to denote the packet as responding to HTTP boot request. In DHCP4 config, the filename for @@ -17,82 +17,88 @@ packet by treating it as HTTP format, not as the PXE format. Signed-off-by: Michael Chang Signed-off-by: Ken Lin --- - grub-core/net/bootp.c | 49 +++++++++++++++++++++++++++++++++++++++++++ + grub-core/net/bootp.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++ include/grub/net.h | 1 + - 2 files changed, 50 insertions(+) + 2 files changed, 56 insertions(+) diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c -index 731577f84..5d38a83af 100644 +index 76e4c11a46f..f56b293ac72 100644 --- a/grub-core/net/bootp.c +++ b/grub-core/net/bootp.c -@@ -352,6 +352,53 @@ grub_net_configure_by_dhcp_ack (const char *name, - if (!inter) - return 0; +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -501,6 +502,60 @@ grub_net_configure_by_dhcp_ack (const char *name, + if (opt && opt_len) + grub_env_set_net_property (name, "rootpath", (const char *) opt, opt_len); -+ /* FIXME: Introduce new http flag for better synergy with existing tftp code base */ -+ if (size > OFFSET_OF (vendor, bp)) ++ opt = find_dhcp_option (bp, size, GRUB_NET_BOOTP_VENDOR_CLASS_IDENTIFIER, &opt_len); ++ if (opt && opt_len) + { -+ char *cidvar; -+ const char *cid; ++ grub_env_set_net_property (name, "vendor_class_identifier", (const char *) opt, opt_len); ++ if (opt && grub_strcmp (opt, "HTTPClient") == 0) ++ { ++ char *proto, *ip, *pa; + -+ opt = find_dhcp_option (bp, size, GRUB_NET_BOOTP_VENDOR_CLASS_IDENTIFIER, &opt_len); -+ if (opt && opt_len) -+ grub_env_set_net_property (name, "vendor_class_identifier", (const char *) opt, opt_len); -+ cidvar = grub_xasprintf ("net_%s_%s", name, "vendor_class_identifier"); -+ cid = grub_env_get (cidvar); -+ grub_free (cidvar); ++ if (!dissect_url (bp->boot_file, &proto, &ip, &pa)) ++ return inter; + -+ if (cid && grub_strcmp (cid, "HTTPClient") == 0) -+ { -+ char *proto, *ip, *pa; ++ grub_env_set_net_property (name, "boot_file", pa, grub_strlen (pa)); ++ if (is_def) ++ { ++ grub_net_default_server = grub_strdup (ip); ++ grub_env_set ("net_default_interface", name); ++ grub_env_export ("net_default_interface"); ++ } ++ if (device && !*device) ++ { ++ *device = grub_xasprintf ("%s,%s", proto, ip); ++ grub_print_error (); ++ } ++ if (path) ++ { ++ *path = grub_strdup (pa); ++ grub_print_error (); ++ if (*path) ++ { ++ char *slash; ++ slash = grub_strrchr (*path, '/'); ++ if (slash) ++ *slash = 0; ++ else ++ **path = 0; ++ } ++ } ++ grub_net_add_ipv4_local (inter, mask); ++ inter->dhcp_ack = grub_malloc (size); ++ if (inter->dhcp_ack) ++ { ++ grub_memcpy (inter->dhcp_ack, bp, size); ++ inter->dhcp_acklen = size; ++ } ++ else ++ grub_errno = GRUB_ERR_NONE; + -+ /* FIXME: Provide better URL function that returns in place pointers -+ * so that we don't have to free them. -+ */ -+ if (!dissect_url (bp->boot_file, &proto, &ip, &pa)) -+ return inter; -+ -+ if (is_def) -+ { -+ grub_net_default_server = grub_strdup (ip); -+ grub_env_set ("net_default_interface", name); -+ grub_env_export ("net_default_interface"); -+ } -+ if (device && !*device) -+ { -+ *device = grub_xasprintf ("%s,%s", proto, ip); -+ grub_print_error (); -+ } -+ -+ boot_file = pa; -+ boot_file_len = grub_strlen (pa); -+ -+ /* FIXME: Don't use malloc buffer here */ -+ grub_free (proto); -+ grub_free (ip); -+ -+ /* FIXME: NEED TO FREE boot_file */ -+ goto boot_file; -+ } ++ grub_free (proto); ++ grub_free (ip); ++ grub_free (pa); ++ return inter; ++ } + } + - opt = find_dhcp_option (bp, size, GRUB_NET_DHCP_OVERLOAD, &opt_len); - if (opt && opt_len == 1) - overload = *opt; -@@ -428,6 +475,8 @@ grub_net_configure_by_dhcp_ack (const char *name, - } - } - -+boot_file: -+ - if (boot_file) - { - grub_env_set_net_property (name, "boot_file", boot_file, boot_file_len); + opt = find_dhcp_option (bp, size, GRUB_NET_BOOTP_EXTENSIONS_PATH, &opt_len); + if (opt && opt_len) + grub_env_set_net_property (name, "extensionspath", (const char *) opt, opt_len); diff --git a/include/grub/net.h b/include/grub/net.h -index 207c764f6..dfb089a35 100644 +index 1d76fd9a1f5..868c9a2ef29 100644 --- a/include/grub/net.h +++ b/include/grub/net.h -@@ -530,6 +530,7 @@ enum +@@ -533,6 +533,7 @@ enum GRUB_NET_DHCP_MESSAGE_TYPE = 53, GRUB_NET_DHCP_SERVER_IDENTIFIER = 54, GRUB_NET_DHCP_PARAMETER_REQUEST_LIST = 55, @@ -100,6 +106,3 @@ index 207c764f6..dfb089a35 100644 GRUB_NET_BOOTP_CLIENT_ID = 61, GRUB_NET_DHCP_TFTP_SERVER_NAME = 66, GRUB_NET_DHCP_BOOTFILE_NAME = 67, --- -2.41.0 - diff --git a/0066-video-limit-the-resolution-for-fixed-bimap-font.patch b/0066-video-limit-the-resolution-for-fixed-bimap-font.patch deleted file mode 100644 index 2e06bf5..0000000 --- a/0066-video-limit-the-resolution-for-fixed-bimap-font.patch +++ /dev/null @@ -1,92 +0,0 @@ -From a8f74844015960ea3bab1e69e8e9e47bb17f8fa7 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 24 Jan 2019 16:41:04 +0800 -Subject: [PATCH 066/272] video: limit the resolution for fixed bimap font - -As grub uses fixed bitmap font and also its size is a fixed property, it is not -possible to accommodate to all resolutions, therefore we raise some limit to -the preferred resolution as most themes are designed on popular device and the -resolution in its prime, which is supposedly Full HD. - -This change also makes grub font readable on hiDPI device without going through -the steps in. - -https://wiki.archlinux.org/index.php/HiDPI#GRUB - -v2: efi_gop: Avoid high resolution when trying to keep current mode. ---- - grub-core/video/efi_gop.c | 18 +++++++++++++----- - grub-core/video/i386/pc/vbe.c | 8 +++++++- - 2 files changed, 20 insertions(+), 6 deletions(-) - -diff --git a/grub-core/video/efi_gop.c b/grub-core/video/efi_gop.c -index 4184bac2c..5f5b62076 100644 ---- a/grub-core/video/efi_gop.c -+++ b/grub-core/video/efi_gop.c -@@ -358,7 +358,7 @@ grub_video_gop_setup (unsigned int width, unsigned int height, - grub_err_t err; - unsigned bpp; - int found = 0; -- int avoid_low_resolution = 1; -+ int avoid_extreme_resolution = 1; - unsigned long long best_volume = 0; - unsigned int preferred_width = 0, preferred_height = 0; - grub_uint8_t *buffer; -@@ -375,13 +375,21 @@ grub_video_gop_setup (unsigned int width, unsigned int height, - preferred_height = 600; - grub_errno = GRUB_ERR_NONE; - } -+ else -+ { -+ /* Limit the range of preferred resolution not exceeding FHD -+ to keep the fixed bitmap font readable */ -+ preferred_width = (preferred_width < 1920) ? preferred_width : 1920; -+ preferred_height = (preferred_height < 1080) ? preferred_height : 1080; -+ } - } - - again: - /* Keep current mode if possible. */ - if (gop->mode->info && -- (!avoid_low_resolution || -- (gop->mode->info->width >= 800 && gop->mode->info->height >= 600))) -+ (!avoid_extreme_resolution || -+ ((gop->mode->info->width >= 800 && gop->mode->info->height >= 600) && -+ (gop->mode->info->width <= 1920 && gop->mode->info->height <= 1080)))) - { - bpp = grub_video_gop_get_bpp (gop->mode->info); - if (bpp && ((width == gop->mode->info->width -@@ -454,9 +462,9 @@ again: - - if (!found) - { -- if (avoid_low_resolution && gop->mode->info) -+ if (avoid_extreme_resolution && gop->mode->info) - { -- avoid_low_resolution = 0; -+ avoid_extreme_resolution = 0; - goto again; - } - grub_dprintf ("video", "GOP: no mode found\n"); -diff --git a/grub-core/video/i386/pc/vbe.c b/grub-core/video/i386/pc/vbe.c -index 801ae9470..8b72810f8 100644 ---- a/grub-core/video/i386/pc/vbe.c -+++ b/grub-core/video/i386/pc/vbe.c -@@ -994,7 +994,13 @@ grub_video_vbe_setup (unsigned int width, unsigned int height, - { - grub_vbe_get_preferred_mode (&width, &height); - if (grub_errno == GRUB_ERR_NONE) -- preferred_mode = 1; -+ { -+ preferred_mode = 1; -+ /* Limit the range of preferred resolution not exceeding FHD -+ to keep the fixed bitmap font readable */ -+ width = (width < 1920) ? width : 1920; -+ height = (height < 1080) ? height : 1080; -+ } - else - { - /* Fall back to 640x480. This is conservative, but the largest --- -2.41.0 - diff --git a/0067-Fix-const-char-pointers-in-grub-core-net-bootp.c.patch b/0067-Fix-const-char-pointers-in-grub-core-net-bootp.c.patch new file mode 100644 index 0000000..4d84371 --- /dev/null +++ b/0067-Fix-const-char-pointers-in-grub-core-net-bootp.c.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 20 Jul 2020 12:24:02 -0400 +Subject: [PATCH] Fix const char ** pointers in grub-core/net/bootp.c + +This will need to get folded back in the right place on the next rebase, +but it's before "Make grub_strtol() "end" pointers have safer const +qualifiers" currently, so for now I'm leaving it here instead of merging +it back with the original patch. + +Signed-off-by: Peter Jones +--- + grub-core/net/bootp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index f56b293ac72..9cbdc2264c9 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -329,7 +329,7 @@ grub_net_configure_by_dhcp_ack (const char *name, + struct grub_net_network_level_interface *inter; + int mask = -1; + char server_ip[sizeof ("xxx.xxx.xxx.xxx")]; +- const grub_uint8_t *opt; ++ const char *opt; + grub_uint8_t opt_len, overload = 0; + const char *boot_file = 0, *server_name = 0; + grub_size_t boot_file_len, server_name_len; +@@ -506,7 +506,7 @@ grub_net_configure_by_dhcp_ack (const char *name, + if (opt && opt_len) + { + grub_env_set_net_property (name, "vendor_class_identifier", (const char *) opt, opt_len); +- if (opt && grub_strcmp (opt, "HTTPClient") == 0) ++ if (opt && grub_strcmp ((char *)opt, "HTTPClient") == 0) + { + char *proto, *ip, *pa; + diff --git a/0067-gfxmenu-support-scrolling-menu-entry-s-text.patch b/0067-gfxmenu-support-scrolling-menu-entry-s-text.patch deleted file mode 100644 index 4fa8d61..0000000 --- a/0067-gfxmenu-support-scrolling-menu-entry-s-text.patch +++ /dev/null @@ -1,286 +0,0 @@ -From f7e6ef516ae778322df10d425fa1e0d60493c23f Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 7 Jan 2019 17:55:05 +0800 -Subject: [PATCH 067/272] gfxmenu: support scrolling menu entry's text - -If menu entry's title text is longer than its display width, the -overlong text simply get truncated. The only possible way to view the -full text is through the menu editing mode, but is a hassle switching -over the mode back and forth. Also menu editing mode could be password -protected which makes it not generally available to everyone. - -This patch implemented scrolling text support to the title of grub's -gfxmenu to make it convenient for viewing the truncated text by pressing -the ctrl+l and ctrl+r to scroll the highlighted text left and right. The -scrolled result will remain in place to help memorizing it after -changing highlight to other entry. - -V1: - * Use grub_calloc for overflow check and return NULL when it would - occur. ---- - grub-core/gfxmenu/gfxmenu.c | 10 +++++++ - grub-core/gfxmenu/gui_label.c | 2 ++ - grub-core/gfxmenu/gui_list.c | 38 +++++++++++++++++++++++++++ - grub-core/gfxmenu/view.c | 49 +++++++++++++++++++++++++++++++++++ - grub-core/normal/menu.c | 16 ++++++++++++ - include/grub/gfxmenu_view.h | 4 +++ - include/grub/menu_viewer.h | 1 + - 7 files changed, 120 insertions(+) - -diff --git a/grub-core/gfxmenu/gfxmenu.c b/grub-core/gfxmenu/gfxmenu.c -index 72b39f90f..9a79494fe 100644 ---- a/grub-core/gfxmenu/gfxmenu.c -+++ b/grub-core/gfxmenu/gfxmenu.c -@@ -108,6 +108,15 @@ grub_gfxmenu_try (int entry, grub_menu_t menu, int nested) - view->menu = menu; - view->nested = nested; - view->first_timeout = -1; -+ if (menu->size) -+ { -+ view->menu_title_offset = grub_calloc (menu->size, sizeof (*view->menu_title_offset)); -+ if (!view->menu_title_offset) -+ { -+ grub_free (instance); -+ return grub_errno; -+ } -+ } - - grub_video_set_viewport (0, 0, mode_info.width, mode_info.height); - if (view->double_repaint) -@@ -123,6 +132,7 @@ grub_gfxmenu_try (int entry, grub_menu_t menu, int nested) - instance->fini = grub_gfxmenu_viewer_fini; - instance->print_timeout = grub_gfxmenu_print_timeout; - instance->clear_timeout = grub_gfxmenu_clear_timeout; -+ instance->scroll_chosen_entry = grub_gfxmenu_scroll_chosen_entry; - - grub_menu_register_viewer (instance); - -diff --git a/grub-core/gfxmenu/gui_label.c b/grub-core/gfxmenu/gui_label.c -index ffd50223c..d37eb1721 100644 ---- a/grub-core/gfxmenu/gui_label.c -+++ b/grub-core/gfxmenu/gui_label.c -@@ -192,6 +192,8 @@ label_set_property (void *vself, const char *name, const char *value) - "or `c' for a command-line."); - else if (grub_strcmp (value, "@KEYMAP_SHORT@") == 0) - value = _("enter: boot, `e': options, `c': cmd-line"); -+ else if (grub_strcmp (value, "@SUSE_KEYMAP_SCROLL_ENTRY@") == 0) -+ value = _("ctrl+l: scroll entry left, ctrl+r: scroll entry right"); - /* FIXME: Add more templates here if needed. */ - - if (grub_printf_fmt_check(value, "%d") != GRUB_ERR_NONE) -diff --git a/grub-core/gfxmenu/gui_list.c b/grub-core/gfxmenu/gui_list.c -index 2ccd4345f..2d77845f8 100644 ---- a/grub-core/gfxmenu/gui_list.c -+++ b/grub-core/gfxmenu/gui_list.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - - enum scrollbar_slice_mode { - SCROLLBAR_SLICE_WEST, -@@ -314,6 +315,33 @@ draw_scrollbar (list_impl_t self, - thumb->draw (thumb, thumbx, thumby); - } - -+static const char * -+grub_utf8_offset_code (const char *src, grub_size_t srcsize, int num) -+{ -+ int count = 0; -+ grub_uint32_t code = 0; -+ -+ while (srcsize && num) -+ { -+ if (srcsize != (grub_size_t)-1) -+ srcsize--; -+ if (!grub_utf8_process ((grub_uint8_t)*src++, &code, &count)) -+ return 0; -+ if (count != 0) -+ continue; -+ if (code == 0) -+ return 0; -+ if (code > GRUB_UNICODE_LAST_VALID) -+ return 0; -+ --num; -+ } -+ -+ if (!num) -+ return src; -+ -+ return 0; -+} -+ - /* Draw the list of items. */ - static void - draw_menu (list_impl_t self, int num_shown_items) -@@ -433,6 +461,16 @@ draw_menu (list_impl_t self, int num_shown_items) - const char *item_title = - grub_menu_get_entry (self->view->menu, menu_index)->title; - -+ { -+ int off = self->view->menu_title_offset[menu_index]; -+ const char *scrolled_title; -+ -+ scrolled_title = grub_utf8_offset_code (item_title, grub_strlen (item_title), off); -+ -+ if (scrolled_title) -+ item_title = scrolled_title; -+ } -+ - sviewport.y = item_top + top_pad; - sviewport.width = viewport_width; - grub_gui_set_viewport (&sviewport, &svpsave); -diff --git a/grub-core/gfxmenu/view.c b/grub-core/gfxmenu/view.c -index 6358004b2..6e5c206d9 100644 ---- a/grub-core/gfxmenu/view.c -+++ b/grub-core/gfxmenu/view.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - - static void - init_terminal (grub_gfxmenu_view_t view); -@@ -103,6 +104,7 @@ grub_gfxmenu_view_new (const char *theme_path, - view->title_text = grub_strdup (_("GRUB Boot Menu")); - view->progress_message_text = 0; - view->theme_path = 0; -+ view->menu_title_offset = 0; - - /* Set the timeout bar's frame. */ - view->progress_message_frame.width = view->screen.width * 4 / 5; -@@ -142,6 +144,7 @@ grub_gfxmenu_view_destroy (grub_gfxmenu_view_t view) - grub_free (view->title_text); - grub_free (view->progress_message_text); - grub_free (view->theme_path); -+ grub_free (view->menu_title_offset); - if (view->canvas) - view->canvas->component.ops->destroy (view->canvas); - grub_free (view); -@@ -410,6 +413,52 @@ grub_gfxmenu_set_chosen_entry (int entry, void *data) - grub_gfxmenu_redraw_menu (view); - } - -+static int -+grub_utf8_get_num_code (const char *src, grub_size_t srcsize) -+{ -+ int count = 0; -+ grub_uint32_t code = 0; -+ int num = 0; -+ -+ while (srcsize) -+ { -+ if (srcsize != (grub_size_t)-1) -+ srcsize--; -+ if (!grub_utf8_process ((grub_uint8_t)*src++, &code, &count)) -+ return 0; -+ if (count != 0) -+ continue; -+ if (code == 0) -+ return num; -+ if (code > GRUB_UNICODE_LAST_VALID) -+ return 0; -+ ++num; -+ } -+ -+ return num; -+} -+ -+void -+grub_gfxmenu_scroll_chosen_entry (void *data, int diren) -+{ -+ grub_gfxmenu_view_t view = data; -+ const char *item_title; -+ int off; -+ -+ if (!view->menu->size) -+ return; -+ -+ item_title =grub_menu_get_entry (view->menu, view->selected)->title; -+ off = view->menu_title_offset[view->selected] + diren; -+ -+ if (off < 0 -+ || off > grub_utf8_get_num_code (item_title, grub_strlen(item_title))) -+ return; -+ -+ view->menu_title_offset[view->selected] = off; -+ grub_gfxmenu_redraw_menu (view); -+} -+ - static void - grub_gfxmenu_draw_terminal_box (void) - { -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 64b377052..e376c603f 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -389,6 +389,15 @@ menu_set_chosen_entry (int entry) - cur->set_chosen_entry (entry, cur->data); - } - -+static void -+menu_scroll_chosen_entry (int diren) -+{ -+ struct grub_menu_viewer *cur; -+ for (cur = viewers; cur; cur = cur->next) -+ if (cur->scroll_chosen_entry) -+ cur->scroll_chosen_entry (cur->data, diren); -+} -+ - static void - menu_print_timeout (int timeout) - { -@@ -819,6 +828,13 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) - menu_set_chosen_entry (current_entry); - break; - -+ case GRUB_TERM_CTRL | 'w': -+ menu_scroll_chosen_entry (1); -+ break; -+ case GRUB_TERM_CTRL | 'r': -+ menu_scroll_chosen_entry (-1); -+ break; -+ - case '\n': - case '\r': - case GRUB_TERM_KEY_RIGHT: -diff --git a/include/grub/gfxmenu_view.h b/include/grub/gfxmenu_view.h -index c9e12db82..3c71277e7 100644 ---- a/include/grub/gfxmenu_view.h -+++ b/include/grub/gfxmenu_view.h -@@ -61,6 +61,8 @@ void - grub_gfxmenu_print_timeout (int timeout, void *data); - void - grub_gfxmenu_set_chosen_entry (int entry, void *data); -+void -+grub_gfxmenu_scroll_chosen_entry (void *data, int diren); - - grub_err_t grub_font_draw_string (const char *str, - grub_font_t font, -@@ -119,6 +121,8 @@ struct grub_gfxmenu_view - int nested; - - int first_timeout; -+ -+ int *menu_title_offset; - }; - - #endif /* ! GRUB_GFXMENU_VIEW_HEADER */ -diff --git a/include/grub/menu_viewer.h b/include/grub/menu_viewer.h -index 604c07ad1..b0580dd53 100644 ---- a/include/grub/menu_viewer.h -+++ b/include/grub/menu_viewer.h -@@ -33,6 +33,7 @@ struct grub_menu_viewer - void (*set_chosen_entry) (int entry, void *data); - void (*print_timeout) (int timeout, void *data); - void (*clear_timeout) (void *data); -+ void (*scroll_chosen_entry) (void *data, int diren); - void (*fini) (void *fini); - }; - --- -2.41.0 - diff --git a/0058-efinet-Setting-network-from-UEFI-device-path.patch b/0068-efinet-Setting-network-from-UEFI-device-path.patch similarity index 82% rename from 0058-efinet-Setting-network-from-UEFI-device-path.patch rename to 0068-efinet-Setting-network-from-UEFI-device-path.patch index 334d19c..7153630 100644 --- a/0058-efinet-Setting-network-from-UEFI-device-path.patch +++ b/0068-efinet-Setting-network-from-UEFI-device-path.patch @@ -1,7 +1,7 @@ -From 64ddf7564c361c3b4d5442cde44b71db74eb7c43 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Sun, 10 Jul 2016 23:46:31 +0800 -Subject: [PATCH 058/272] efinet: Setting network from UEFI device path +Subject: [PATCH] efinet: Setting network from UEFI device path The PXE Base Code protocol used to obtain cached PXE DHCPACK packet is no longer provided for HTTP Boot. Instead, we have to get the HTTP boot @@ -27,23 +27,23 @@ the same way it used to be. Signed-off-by: Michael Chang Signed-off-by: Ken Lin --- - grub-core/net/drivers/efi/efinet.c | 268 ++++++++++++++++++++++++++++- + grub-core/net/drivers/efi/efinet.c | 286 ++++++++++++++++++++++++++++++++++--- include/grub/efi/api.h | 11 ++ - 2 files changed, 270 insertions(+), 9 deletions(-) + 2 files changed, 281 insertions(+), 16 deletions(-) diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c -index 77ee9925b..b46738caf 100644 +index 92bb7444782..eb68de22023 100644 --- a/grub-core/net/drivers/efi/efinet.c +++ b/grub-core/net/drivers/efi/efinet.c -@@ -23,6 +23,7 @@ - #include - #include +@@ -26,6 +26,7 @@ #include + #include + #include +#include GRUB_MOD_LICENSE ("GPLv3+"); -@@ -341,6 +342,221 @@ grub_efinet_findcards (void) +@@ -348,6 +349,227 @@ grub_efinet_findcards (void) grub_free (handles); } @@ -57,6 +57,9 @@ index 77ee9925b..b46738caf 100644 + grub_err_t err; + + ddp = grub_efi_duplicate_device_path (dp); ++ if (!ddp) ++ return NULL; ++ + ldp = grub_efi_find_last_device_path (ddp); + + if (GRUB_EFI_DEVICE_PATH_TYPE (ldp) != GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE @@ -92,7 +95,10 @@ index 77ee9925b..b46738caf 100644 + + nb = grub_netbuff_alloc (512); + if (!nb) -+ return NULL; ++ { ++ grub_free (ddp); ++ return NULL; ++ } + + if (GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) == GRUB_EFI_IPV4_DEVICE_PATH_SUBTYPE) + { @@ -265,20 +271,21 @@ index 77ee9925b..b46738caf 100644 static void grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, char **path) -@@ -361,6 +577,11 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, +@@ -367,7 +589,11 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + { grub_efi_device_path_t *cdp; struct grub_efi_pxe *pxe; - struct grub_efi_pxe_mode *pxe_mode; +- struct grub_efi_pxe_mode *pxe_mode; ++ struct grub_efi_pxe_mode *pxe_mode = NULL; + grub_uint8_t *packet_buf; + grub_size_t packet_bufsz ; + int ipv6; + struct grub_net_buff *nb = NULL; -+ + if (card->driver != &efidriver) continue; - cdp = grub_efi_get_device_path (card->efi_handle); -@@ -380,11 +601,21 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, - ldp = grub_efi_find_last_device_path (dp); +@@ -391,11 +617,21 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + */ if (GRUB_EFI_DEVICE_PATH_TYPE (ldp) != GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE || (GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV4_DEVICE_PATH_SUBTYPE - && GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV6_DEVICE_PATH_SUBTYPE)) @@ -300,13 +307,12 @@ index 77ee9925b..b46738caf 100644 dup_ldp = grub_efi_find_last_device_path (dup_dp); dup_ldp->type = GRUB_EFI_END_DEVICE_PATH_TYPE; dup_ldp->subtype = GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE; -@@ -396,16 +627,31 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, - } +@@ -408,23 +644,37 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + pxe = grub_efi_open_protocol (hnd, &pxe_io_guid, GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); - if (! pxe) - continue; -- pxe_mode = pxe->mode; + if (!pxe) + { + nb = grub_efinet_create_dhcp_ack_from_device_path (dp, &ipv6); @@ -326,45 +332,60 @@ index 77ee9925b..b46738caf 100644 + ipv6 = pxe_mode->using_ipv6; + } +- pxe_mode = pxe->mode; - if (pxe_mode->using_ipv6) + if (ipv6) { - grub_net_configure_by_dhcpv6_reply (card->name, card, 0, - (struct grub_net_dhcp6_packet *) -- &pxe_mode->dhcp_ack, -- sizeof (pxe_mode->dhcp_ack), -+ packet_buf, -+ packet_bufsz, - 1, device, path); + grub_dprintf ("efinet", "using ipv6 and dhcpv6\n"); +- grub_dprintf ("efinet", "dhcp_ack_received: %s%s\n", +- pxe_mode->dhcp_ack_received ? "yes" : "no", +- pxe_mode->dhcp_ack_received ? "" : " cannot continue"); +- if (!pxe_mode->dhcp_ack_received) +- continue; ++ if (pxe_mode) ++ grub_dprintf ("efinet", "dhcp_ack_received: %s%s\n", ++ pxe_mode->dhcp_ack_received ? "yes" : "no", ++ pxe_mode->dhcp_ack_received ? "" : " cannot continue"); + + inter = grub_net_configure_by_dhcpv6_reply (card->name, card, 0, + (struct grub_net_dhcp6_packet *) +- &pxe_mode->dhcp_ack, +- sizeof (pxe_mode->dhcp_ack), ++ packet_buf, ++ packet_bufsz, + 1, device, path); if (grub_errno) grub_print_error (); -@@ -414,8 +660,8 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, - { - inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, - (struct grub_net_bootp_packet *) -- &pxe_mode->dhcp_ack, -- sizeof (pxe_mode->dhcp_ack), -+ packet_buf, -+ packet_bufsz, - 1, device, path); +@@ -438,8 +688,8 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + grub_dprintf ("efinet", "using ipv4 and dhcp\n"); + inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, + (struct grub_net_bootp_packet *) +- &pxe_mode->dhcp_ack, +- sizeof (pxe_mode->dhcp_ack), ++ packet_buf, ++ packet_bufsz, + 1, device, path); - if (inter != NULL) -@@ -441,6 +687,10 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); +@@ -465,8 +715,12 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + vlan_dp = (grub_efi_device_path_t *) ((grub_efi_uint8_t *) vlan_dp + vlan_dp_len); + } } - } +- return; } + + if (nb) + grub_netbuff_free (nb); + - return; ++ return; } } + diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h -index 4b61c8ea1..23413118a 100644 +index 53f5c781ac3..fa528e73a27 100644 --- a/include/grub/efi/api.h +++ b/include/grub/efi/api.h -@@ -876,6 +876,8 @@ struct grub_efi_ipv4_device_path +@@ -891,6 +891,8 @@ struct grub_efi_ipv4_device_path grub_efi_uint16_t remote_port; grub_efi_uint16_t protocol; grub_efi_uint8_t static_ip_address; @@ -373,7 +394,7 @@ index 4b61c8ea1..23413118a 100644 } GRUB_PACKED; typedef struct grub_efi_ipv4_device_path grub_efi_ipv4_device_path_t; -@@ -939,6 +941,15 @@ struct grub_efi_vlan_device_path +@@ -954,6 +956,15 @@ struct grub_efi_vlan_device_path } GRUB_PACKED; typedef struct grub_efi_vlan_device_path grub_efi_vlan_device_path_t; @@ -389,6 +410,3 @@ index 4b61c8ea1..23413118a 100644 #define GRUB_EFI_VENDOR_MESSAGING_DEVICE_PATH_SUBTYPE 10 /* Media Device Path. */ --- -2.41.0 - diff --git a/0068-kern-mm.c-Make-grub_calloc-inline.patch b/0068-kern-mm.c-Make-grub_calloc-inline.patch deleted file mode 100644 index 4ed33ff..0000000 --- a/0068-kern-mm.c-Make-grub_calloc-inline.patch +++ /dev/null @@ -1,116 +0,0 @@ -From fe0bb1ef3b2a266f7ffe0eb32bed1abd1b6a56db Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 13 Aug 2020 09:36:45 +0800 -Subject: [PATCH 068/272] kern/mm.c : Make grub_calloc inline - -To circumvent the situation that symbol 'grub_calloc' not found would -happen if system is using stray grub (ie not managed by system update) -as stage1 that can be too old to load updated modules. ---- - grub-core/kern/mm.c | 28 ---------------------------- - include/grub/mm.h | 32 +++++++++++++++++++++++++++++++- - 2 files changed, 31 insertions(+), 29 deletions(-) - -diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c -index 027a25cd1..f56d94c3a 100644 ---- a/grub-core/kern/mm.c -+++ b/grub-core/kern/mm.c -@@ -63,14 +63,10 @@ - - #include - #include --#include --#include - #include - #include - #include --#include - #include --#include - - #ifdef MM_DEBUG - # undef grub_calloc -@@ -553,30 +549,6 @@ grub_memalign (grub_size_t align, grub_size_t size) - return 0; - } - --/* -- * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on -- * integer overflow. -- */ --void * --grub_calloc (grub_size_t nmemb, grub_size_t size) --{ -- void *ret; -- grub_size_t sz = 0; -- -- if (grub_mul (nmemb, size, &sz)) -- { -- grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -- return NULL; -- } -- -- ret = grub_memalign (0, sz); -- if (!ret) -- return NULL; -- -- grub_memset (ret, 0, sz); -- return ret; --} -- - /* Allocate SIZE bytes and return the pointer. */ - void * - grub_malloc (grub_size_t size) -diff --git a/include/grub/mm.h b/include/grub/mm.h -index f3bf87fa0..75894dbbe 100644 ---- a/include/grub/mm.h -+++ b/include/grub/mm.h -@@ -47,7 +47,6 @@ extern grub_mm_add_region_func_t EXPORT_VAR(grub_mm_add_region_fn); - #endif - - void grub_mm_init_region (void *addr, grub_size_t size); --void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size); - void *EXPORT_FUNC(grub_malloc) (grub_size_t size); - void *EXPORT_FUNC(grub_zalloc) (grub_size_t size); - void EXPORT_FUNC(grub_free) (void *ptr); -@@ -55,6 +54,37 @@ void *EXPORT_FUNC(grub_realloc) (void *ptr, grub_size_t size); - #ifndef GRUB_MACHINE_EMU - void *EXPORT_FUNC(grub_memalign) (grub_size_t align, grub_size_t size); - #endif -+#if !defined(GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) -+#include -+#include -+#include -+#include -+/* -+ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on -+ * integer overflow. -+ */ -+static inline void * -+grub_calloc (grub_size_t nmemb, grub_size_t size) -+{ -+ void *ret; -+ grub_size_t sz = 0; -+ -+ if (grub_mul (nmemb, size, &sz)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ return NULL; -+ } -+ -+ ret = grub_memalign (0, sz); -+ if (!ret) -+ return NULL; -+ -+ grub_memset (ret, 0, sz); -+ return ret; -+} -+#else -+void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size); -+#endif - - void grub_mm_check_real (const char *file, int line); - #define grub_mm_check() grub_mm_check_real (GRUB_FILE, __LINE__); --- -2.41.0 - diff --git a/0069-cmdline-Provide-cmdline-functions-as-module.patch b/0069-cmdline-Provide-cmdline-functions-as-module.patch deleted file mode 100644 index fd5944b..0000000 --- a/0069-cmdline-Provide-cmdline-functions-as-module.patch +++ /dev/null @@ -1,54 +0,0 @@ -From c3846d9dfce9c758d6607cc4b1ad6f624612499a Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 17 Aug 2020 17:25:56 +0800 -Subject: [PATCH 069/272] cmdline: Provide cmdline functions as module - -The command line processing is needed by many loader modules, hence we should -make it a sharable one rather than belonging to linux loader. This can cut the -dependency to linux module among multiple loaders like multiboot linuxefi and -so on to make custom boot image much more flexible to compose. - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 6 +++++- - grub-core/lib/cmdline.c | 3 +++ - 2 files changed, 8 insertions(+), 1 deletion(-) - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 8b446516e..bc7459ed3 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -1858,7 +1858,6 @@ module = { - x86_64_efi = loader/efi/linux.c; - emu = loader/emu/linux.c; - common = loader/linux.c; -- common = lib/cmdline.c; - }; - - module = { -@@ -2608,3 +2607,8 @@ module = { - efi = commands/bli.c; - enable = efi; - }; -+ -+module = { -+ name = cmdline; -+ common = lib/cmdline.c; -+}; -diff --git a/grub-core/lib/cmdline.c b/grub-core/lib/cmdline.c -index ed0b149dc..bd392e30f 100644 ---- a/grub-core/lib/cmdline.c -+++ b/grub-core/lib/cmdline.c -@@ -19,6 +19,9 @@ - - #include - #include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); - - static unsigned int check_arg (char *c, int *has_space) - { --- -2.41.0 - diff --git a/0059-efinet-Setting-DNS-server-from-UEFI-protocol.patch b/0069-efinet-Setting-DNS-server-from-UEFI-protocol.patch similarity index 80% rename from 0059-efinet-Setting-DNS-server-from-UEFI-protocol.patch rename to 0069-efinet-Setting-DNS-server-from-UEFI-protocol.patch index b458660..43d2df0 100644 --- a/0059-efinet-Setting-DNS-server-from-UEFI-protocol.patch +++ b/0069-efinet-Setting-DNS-server-from-UEFI-protocol.patch @@ -1,7 +1,7 @@ -From 1f00c822d29060df2a3893caa06aa39bd58dc2a8 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Thu, 14 Jul 2016 17:48:45 +0800 -Subject: [PATCH 059/272] efinet: Setting DNS server from UEFI protocol +Subject: [PATCH] efinet: Setting DNS server from UEFI protocol In the URI device path node, any name rahter than address can be used for looking up the resources so that DNS service become needed to get answer of the @@ -28,15 +28,15 @@ it used to be. Signed-off-by: Michael Chang Signed-off-by: Ken Lin --- - grub-core/net/drivers/efi/efinet.c | 163 +++++++++++++++++++++++++++++ - include/grub/efi/api.h | 76 ++++++++++++++ + grub-core/net/drivers/efi/efinet.c | 163 +++++++++++++++++++++++++++++++++++++ + include/grub/efi/api.h | 76 +++++++++++++++++ 2 files changed, 239 insertions(+) diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c -index b46738caf..cc02008f5 100644 +index eb68de22023..a91df09ee6d 100644 --- a/grub-core/net/drivers/efi/efinet.c +++ b/grub-core/net/drivers/efi/efinet.c -@@ -30,6 +30,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); +@@ -33,6 +33,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); /* GUID. */ static grub_guid_t net_io_guid = GRUB_EFI_SIMPLE_NETWORK_GUID; static grub_guid_t pxe_io_guid = GRUB_EFI_PXE_GUID; @@ -45,18 +45,18 @@ index b46738caf..cc02008f5 100644 static grub_err_t send_card_buffer (struct grub_net_card *dev, -@@ -342,6 +344,125 @@ grub_efinet_findcards (void) +@@ -349,6 +351,125 @@ grub_efinet_findcards (void) grub_free (handles); } +static grub_efi_handle_t -+grub_efi_locate_device_path (grub_efi_guid_t *protocol, grub_efi_device_path_t *device_path, ++grub_efi_locate_device_path (grub_guid_t *protocol, grub_efi_device_path_t *device_path, + grub_efi_device_path_t **r_device_path) +{ + grub_efi_handle_t handle; + grub_efi_status_t status; + -+ status = grub_efi_system_table->boot_services->locate_device_path ( ++ status = grub_efi_system_table->boot_services->locate_device_path( + protocol, &device_path, &handle); + + if (status != GRUB_EFI_SUCCESS) @@ -92,9 +92,9 @@ index b46738caf..cc02008f5 100644 + if (!addrs) + return 0; + -+ status = conf->get_data (conf, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, -+ &data_size, addrs); ++ status = conf->get_data(conf, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, ++ &data_size, addrs); + + if (status == GRUB_EFI_BUFFER_TOO_SMALL) + { @@ -103,9 +103,9 @@ index b46738caf..cc02008f5 100644 + if (!addrs) + return 0; + -+ status = conf->get_data (conf, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, -+ &data_size, addrs); ++ status = conf->get_data(conf, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, ++ &data_size, addrs); + } + + if (status != GRUB_EFI_SUCCESS) @@ -142,9 +142,9 @@ index b46738caf..cc02008f5 100644 + if (!addrs) + return 0; + -+ status = conf->get_data (conf, -+ GRUB_EFI_IP6_CONFIG_DATA_TYPE_DNSSERVER, -+ &data_size, addrs); ++ status = conf->get_data(conf, ++ GRUB_EFI_IP6_CONFIG_DATA_TYPE_DNSSERVER, ++ &data_size, addrs); + + if (status == GRUB_EFI_BUFFER_TOO_SMALL) + { @@ -153,9 +153,9 @@ index b46738caf..cc02008f5 100644 + if (!addrs) + return 0; + -+ status = conf->get_data (conf, -+ GRUB_EFI_IP6_CONFIG_DATA_TYPE_DNSSERVER, -+ &data_size, addrs); ++ status = conf->get_data(conf, ++ GRUB_EFI_IP6_CONFIG_DATA_TYPE_DNSSERVER, ++ &data_size, addrs); + } + + if (status != GRUB_EFI_SUCCESS) @@ -171,7 +171,7 @@ index b46738caf..cc02008f5 100644 static struct grub_net_buff * grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *use_ipv6) { -@@ -394,6 +515,8 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u +@@ -407,6 +528,8 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u grub_efi_ipv4_device_path_t *ipv4 = (grub_efi_ipv4_device_path_t *) ldp; struct grub_net_bootp_packet *bp; grub_uint8_t *ptr; @@ -180,7 +180,7 @@ index b46738caf..cc02008f5 100644 bp = (struct grub_net_bootp_packet *) nb->tail; err = grub_netbuff_put (nb, sizeof (*bp) + 4); -@@ -455,6 +578,25 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u +@@ -468,6 +591,25 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u *ptr++ = sizeof ("HTTPClient") - 1; grub_memcpy (ptr, "HTTPClient", sizeof ("HTTPClient") - 1); @@ -206,7 +206,7 @@ index b46738caf..cc02008f5 100644 ptr = nb->tail; err = grub_netbuff_put (nb, 1); if (err) -@@ -487,6 +629,8 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u +@@ -500,6 +642,8 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u struct grub_net_dhcp6_option *opt; struct grub_net_dhcp6_option_iana *iana; struct grub_net_dhcp6_option_iaaddr *iaaddr; @@ -215,7 +215,7 @@ index b46738caf..cc02008f5 100644 d6p = (struct grub_net_dhcp6_packet *)nb->tail; err = grub_netbuff_put (nb, sizeof(*d6p)); -@@ -550,6 +694,25 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u +@@ -563,6 +707,25 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u opt->len = grub_cpu_to_be16 (uri_len); grub_memcpy (opt->data, uri_dp->uri, uri_len); @@ -242,11 +242,11 @@ index b46738caf..cc02008f5 100644 } diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h -index 23413118a..87dcfc0a5 100644 +index fa528e73a27..248d6a28ff9 100644 --- a/include/grub/efi/api.h +++ b/include/grub/efi/api.h -@@ -379,6 +379,16 @@ - {0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f } \ +@@ -369,6 +369,16 @@ + { 0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 } \ } +#define GRUB_EFI_IP4_CONFIG2_PROTOCOL_GUID \ @@ -259,12 +259,12 @@ index 23413118a..87dcfc0a5 100644 + { 0x89, 0x29, 0x48, 0xbc, 0xd9, 0x0a, 0xd3, 0x1a } \ + } + - struct grub_efi_sal_system_table - { - grub_uint32_t signature; -@@ -1879,4 +1889,70 @@ struct initrd_media_device_path { - } GRUB_PACKED; - typedef struct initrd_media_device_path initrd_media_device_path_t; + #define LINUX_EFI_INITRD_MEDIA_GUID \ + { 0x5568e427, 0x68fc, 0x4f3d, \ + { 0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68 } \ +@@ -1963,6 +1973,72 @@ struct grub_efi_load_file2 + }; + typedef struct grub_efi_load_file2 grub_efi_load_file2_t; +enum grub_efi_ip4_config2_data_type { + GRUB_EFI_IP4_CONFIG2_DATA_TYPE_INTERFACEINFO, @@ -278,21 +278,21 @@ index 23413118a..87dcfc0a5 100644 + +struct grub_efi_ip4_config2_protocol +{ -+ grub_efi_status_t (__grub_efi_api *set_data) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (*set_data) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_uintn_t data_size, + void *data); + -+ grub_efi_status_t (__grub_efi_api *get_data) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (*get_data) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_uintn_t *data_size, + void *data); + -+ grub_efi_status_t (__grub_efi_api *register_data_notify) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (*register_data_notify) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_event_t event); + -+ grub_efi_status_t (__grub_efi_api *unregister_datanotify) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (*unregister_datanotify) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_event_t event); +}; @@ -312,27 +312,26 @@ index 23413118a..87dcfc0a5 100644 + +struct grub_efi_ip6_config_protocol +{ -+ grub_efi_status_t (__grub_efi_api *set_data) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (*set_data) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_uintn_t data_size, + void *data); + -+ grub_efi_status_t (__grub_efi_api *get_data) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (*get_data) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_uintn_t *data_size, + void *data); + -+ grub_efi_status_t (__grub_efi_api *register_data_notify) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (*register_data_notify) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_event_t event); + -+ grub_efi_status_t (__grub_efi_api *unregister_datanotify) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (*unregister_datanotify) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_event_t event); +}; +typedef struct grub_efi_ip6_config_protocol grub_efi_ip6_config_protocol_t; + - #endif /* ! GRUB_EFI_API_HEADER */ --- -2.41.0 - + struct initrd_media_device_path { + grub_efi_vendor_media_device_path_t vendor; + grub_efi_device_path_t end; diff --git a/0061-Support-UEFI-networking-protocols.patch b/0070-Support-UEFI-networking-protocols.patch similarity index 89% rename from 0061-Support-UEFI-networking-protocols.patch rename to 0070-Support-UEFI-networking-protocols.patch index f76777a..efa3659 100644 --- a/0061-Support-UEFI-networking-protocols.patch +++ b/0070-Support-UEFI-networking-protocols.patch @@ -1,7 +1,7 @@ -From c42d93573bf925d6788aade07c8a0e9b26b73cf1 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Wed, 22 Feb 2017 14:27:50 +0800 -Subject: [PATCH 061/272] Support UEFI networking protocols +Subject: [PATCH] Support UEFI networking protocols References: fate#320130, bsc#1015589, bsc#1076132 Patch-Mainline: no @@ -23,38 +23,30 @@ V3: * Finish HTTP transaction in one go * Fix bsc#1076132 -V4: - * Add fs_ prefix with upstream commit - ad4bfeec5 Change fs functions to add fs_ prefix - -V5: - * Use overflow checking primitives where the arithmetic expression for - buffer allocations may include unvalidated data - * Use grub_calloc for overflow check and return NULL when it would - occur. - -V6: - * Don't force grub_print_error if no best route found as boot process - could be interrupted by logged error. The default interface will be - used as fallback in this case +Signed-off-by: Michael Chang +[pjones: make efi_netfs not duplicate symbols from efinet] +Signed-off-by: Peter Jones --- - grub-core/Makefile.core.def | 6 + + grub-core/Makefile.core.def | 12 + grub-core/io/bufio.c | 2 +- - grub-core/kern/efi/efi.c | 96 +- - grub-core/net/drivers/efi/efinet.c | 29 +- - grub-core/net/efi/dhcp.c | 399 ++++++++ - grub-core/net/efi/http.c | 424 ++++++++ - grub-core/net/efi/ip4_config.c | 409 ++++++++ - grub-core/net/efi/ip6_config.c | 430 +++++++++ - grub-core/net/efi/net.c | 1440 ++++++++++++++++++++++++++++ - grub-core/net/efi/pxe.c | 424 ++++++++ + grub-core/kern/efi/efi.c | 96 ++- + grub-core/net/drivers/efi/efinet.c | 27 + + grub-core/net/efi/dhcp.c | 397 ++++++++++ + grub-core/net/efi/efi_netfs.c | 57 ++ + grub-core/net/efi/http.c | 410 +++++++++++ + grub-core/net/efi/ip4_config.c | 398 ++++++++++ + grub-core/net/efi/ip6_config.c | 422 +++++++++++ + grub-core/net/efi/net.c | 1428 ++++++++++++++++++++++++++++++++++++ + grub-core/net/efi/pxe.c | 424 +++++++++++ grub-core/net/net.c | 74 ++ - include/grub/efi/api.h | 197 +++- - include/grub/efi/dhcp.h | 343 +++++++ - include/grub/efi/http.h | 215 +++++ - include/grub/net/efi.h | 144 +++ - 15 files changed, 4586 insertions(+), 46 deletions(-) + util/grub-mknetdir.c | 23 +- + include/grub/efi/api.h | 195 ++++- + include/grub/efi/dhcp.h | 343 +++++++++ + include/grub/efi/http.h | 215 ++++++ + include/grub/net/efi.h | 144 ++++ + 17 files changed, 4618 insertions(+), 49 deletions(-) create mode 100644 grub-core/net/efi/dhcp.c + create mode 100644 grub-core/net/efi/efi_netfs.c create mode 100644 grub-core/net/efi/http.c create mode 100644 grub-core/net/efi/ip4_config.c create mode 100644 grub-core/net/efi/ip6_config.c @@ -65,10 +57,23 @@ V6: create mode 100644 include/grub/net/efi.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 43b0f50af..8b446516e 100644 +index 6645fbae34f..56eb6a828e8 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -2358,6 +2358,12 @@ module = { +@@ -2356,6 +2356,12 @@ module = { + common = hook/datehook.c; + }; + ++module = { ++ name = efi_netfs; ++ common = net/efi/efi_netfs.c; ++ enable = efi; ++}; ++ + module = { + name = net; + common = net/net.c; +@@ -2369,6 +2375,12 @@ module = { common = net/ethernet.c; common = net/arp.c; common = net/netbuff.c; @@ -82,7 +87,7 @@ index 43b0f50af..8b446516e 100644 module = { diff --git a/grub-core/io/bufio.c b/grub-core/io/bufio.c -index a458c3aca..163773153 100644 +index a458c3aca78..1637731535e 100644 --- a/grub-core/io/bufio.c +++ b/grub-core/io/bufio.c @@ -139,7 +139,7 @@ grub_bufio_read (grub_file_t file, char *buf, grub_size_t len) @@ -95,10 +100,10 @@ index a458c3aca..163773153 100644 if (file->offset + res < next_buf) { diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c -index b93ae3aba..b674816aa 100644 +index 2bb8a0e7a38..bf16c4307bc 100644 --- a/grub-core/kern/efi/efi.c +++ b/grub-core/kern/efi/efi.c -@@ -770,7 +770,7 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) +@@ -775,7 +775,7 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) { grub_efi_ipv4_device_path_t *ipv4 = (grub_efi_ipv4_device_path_t *) dp; @@ -107,7 +112,7 @@ index b93ae3aba..b674816aa 100644 (unsigned) ipv4->local_ip_address[0], (unsigned) ipv4->local_ip_address[1], (unsigned) ipv4->local_ip_address[2], -@@ -783,33 +783,60 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) +@@ -788,33 +788,60 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) (unsigned) ipv4->remote_port, (unsigned) ipv4->protocol, (unsigned) ipv4->static_ip_address); @@ -185,7 +190,7 @@ index b93ae3aba..b674816aa 100644 } break; case GRUB_EFI_INFINIBAND_DEVICE_PATH_SUBTYPE: -@@ -856,6 +883,39 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) +@@ -861,6 +888,39 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) dump_vendor_path ("Messaging", (grub_efi_vendor_device_path_t *) dp); break; @@ -226,27 +231,18 @@ index b93ae3aba..b674816aa 100644 grub_printf ("/UnknownMessaging(%x)", (unsigned) subtype); break; diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c -index cc02008f5..f6353ed27 100644 +index a91df09ee6d..225dc896da0 100644 --- a/grub-core/net/drivers/efi/efinet.c +++ b/grub-core/net/drivers/efi/efinet.c -@@ -24,6 +24,7 @@ - #include - #include +@@ -27,6 +27,7 @@ + #include + #include #include +#include GRUB_MOD_LICENSE ("GPLv3+"); -@@ -345,7 +346,7 @@ grub_efinet_findcards (void) - } - - static grub_efi_handle_t --grub_efi_locate_device_path (grub_efi_guid_t *protocol, grub_efi_device_path_t *device_path, -+grub_efi_locate_device_path (grub_guid_t *protocol, grub_efi_device_path_t *device_path, - grub_efi_device_path_t **r_device_path) - { - grub_efi_handle_t handle; -@@ -498,6 +499,17 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u +@@ -508,6 +509,17 @@ grub_efinet_create_dhcp_ack_from_device_path (grub_efi_device_path_t *dp, int *u ldp = grub_efi_find_last_device_path (ddp); @@ -264,7 +260,7 @@ index cc02008f5..f6353ed27 100644 if (GRUB_EFI_DEVICE_PATH_TYPE (ldp) != GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE || (GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV4_DEVICE_PATH_SUBTYPE && GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV6_DEVICE_PATH_SUBTYPE)) -@@ -765,6 +777,7 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, +@@ -781,6 +793,7 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, if (GRUB_EFI_DEVICE_PATH_TYPE (ldp) != GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE || (GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV4_DEVICE_PATH_SUBTYPE && GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_IPV6_DEVICE_PATH_SUBTYPE @@ -272,7 +268,7 @@ index cc02008f5..f6353ed27 100644 && GRUB_EFI_DEVICE_PATH_SUBTYPE (ldp) != GRUB_EFI_URI_DEVICE_PATH_SUBTYPE)) continue; dup_dp = grub_efi_duplicate_device_path (dp); -@@ -779,6 +792,15 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, +@@ -795,6 +808,15 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, dup_ldp->length = sizeof (*dup_ldp); } @@ -288,7 +284,7 @@ index cc02008f5..f6353ed27 100644 dup_ldp = grub_efi_find_last_device_path (dup_dp); dup_ldp->type = GRUB_EFI_END_DEVICE_PATH_TYPE; dup_ldp->subtype = GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE; -@@ -860,6 +882,9 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, +@@ -889,6 +911,9 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, GRUB_MOD_INIT(efinet) { @@ -298,7 +294,7 @@ index cc02008f5..f6353ed27 100644 grub_efinet_findcards (); grub_efi_net_config = grub_efi_net_config_real; } -@@ -871,5 +896,7 @@ GRUB_MOD_FINI(efinet) +@@ -900,5 +925,7 @@ GRUB_MOD_FINI(efinet) FOR_NET_CARDS_SAFE (card, next) if (card->driver == &efidriver) grub_net_card_unregister (card); @@ -308,10 +304,10 @@ index cc02008f5..f6353ed27 100644 diff --git a/grub-core/net/efi/dhcp.c b/grub-core/net/efi/dhcp.c new file mode 100644 -index 000000000..77ef932bf +index 00000000000..ca19902441b --- /dev/null +++ b/grub-core/net/efi/dhcp.c -@@ -0,0 +1,399 @@ +@@ -0,0 +1,397 @@ +#include +#include +#include @@ -389,16 +385,16 @@ index 000000000..77ef932bf + grub_efi_uint32_t option_count = 0; + grub_efi_uint32_t i; + -+ status = dhcp4->parse (dhcp4, reply_packet, &option_count, NULL); ++ status = dhcp4->parse(dhcp4, reply_packet, &option_count, NULL); + + if (status != GRUB_EFI_BUFFER_TOO_SMALL) + return NULL; + -+ option_list = grub_calloc (option_count, sizeof(*option_list)); ++ option_list = grub_malloc (option_count * sizeof(*option_list)); + if (!option_list) + return NULL; + -+ status = dhcp4->parse (dhcp4, reply_packet, &option_count, option_list); ++ status = dhcp4->parse(dhcp4, reply_packet, &option_count, option_list); + if (status != GRUB_EFI_SUCCESS) + { + grub_free (option_list); @@ -447,13 +443,13 @@ index 000000000..77ef932bf + + if (!mode->started) + { -+ status = pxe->start (pxe, 0); ++ status = pxe->start(pxe, 0); + + if (status != GRUB_EFI_SUCCESS) + grub_printf ("Couldn't start PXE\n"); + } + -+ status = pxe->dhcp (pxe, 0); ++ status = pxe->dhcp(pxe, 0); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp4 configure failed, %d\n", (int)status); @@ -504,7 +500,7 @@ index 000000000..77ef932bf + config.option_list = &options; + + /* FIXME: What if the dhcp has bounded */ -+ status = netdev->dhcp4->configure (netdev->dhcp4, &config); ++ status = netdev->dhcp4->configure(netdev->dhcp4, &config); + grub_free (options); + if (status != GRUB_EFI_SUCCESS) + { @@ -512,14 +508,14 @@ index 000000000..77ef932bf + continue; + } + -+ status = netdev->dhcp4->start (netdev->dhcp4, NULL); ++ status = netdev->dhcp4->start(netdev->dhcp4, NULL); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp4 start failed, %d\n", (int)status); + continue; + } + -+ status = netdev->dhcp4->get_mode_data (netdev->dhcp4, &mode); ++ status = netdev->dhcp4->get_mode_data(netdev->dhcp4, &mode); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp4 get mode failed, %d\n", (int)status); @@ -620,21 +616,21 @@ index 000000000..77ef932bf + config.rapid_commit = 0; + config.solicit_retransmission = &retrans; + -+ status = dev->dhcp6->configure (dev->dhcp6, &config); ++ status = dev->dhcp6->configure(dev->dhcp6, &config); + grub_free (opt); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp6 configure failed, %d\n", (int)status); + continue; + } -+ status = dev->dhcp6->start (dev->dhcp6); ++ status = dev->dhcp6->start(dev->dhcp6); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp6 start failed, %d\n", (int)status); + continue; + } + -+ status = dev->dhcp6->get_mode_data (dev->dhcp6, &mode, NULL); ++ status = dev->dhcp6->get_mode_data(dev->dhcp6, &mode, NULL); + if (status != GRUB_EFI_SUCCESS) + { + grub_printf ("dhcp4 get mode failed, %d\n", (int)status); @@ -670,14 +666,12 @@ index 000000000..77ef932bf + grub_efi_dhcp6_packet_option_t **options = NULL; + grub_efi_uint32_t i; + -+ status = dev->dhcp6->parse (dev->dhcp6, mode.ia->reply_packet, &count, NULL); ++ status = dev->dhcp6->parse(dev->dhcp6, mode.ia->reply_packet, &count, NULL); + + if (status == GRUB_EFI_BUFFER_TOO_SMALL && count) + { -+ options = grub_calloc (count, sizeof(*options)); -+ if (!options) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+ status = dev->dhcp6->parse (dev->dhcp6, mode.ia->reply_packet, &count, options); ++ options = grub_malloc (count * sizeof(*options)); ++ status = dev->dhcp6->parse(dev->dhcp6, mode.ia->reply_packet, &count, options); + } + + if (status != GRUB_EFI_SUCCESS) @@ -702,8 +696,8 @@ index 000000000..77ef932bf + grub_free (options); + } + -+ b->free_pool (mode.client_id); -+ b->free_pool (mode.ia); ++ b->free_pool(mode.client_id); ++ b->free_pool(mode.ia); + } + + return GRUB_ERR_NONE; @@ -711,19 +705,81 @@ index 000000000..77ef932bf + +grub_command_func_t grub_efi_net_bootp = grub_cmd_efi_bootp; +grub_command_func_t grub_efi_net_bootp6 = grub_cmd_efi_bootp6; +diff --git a/grub-core/net/efi/efi_netfs.c b/grub-core/net/efi/efi_netfs.c +new file mode 100644 +index 00000000000..ef371d885ea +--- /dev/null ++++ b/grub-core/net/efi/efi_netfs.c +@@ -0,0 +1,57 @@ ++#include ++#include ++#define EFI_NET_CMD_PREFIX "net_efi" ++#include ++ ++GRUB_MOD_LICENSE ("GPLv3+"); ++ ++static grub_command_t cmd_efi_lsroutes; ++static grub_command_t cmd_efi_lscards; ++static grub_command_t cmd_efi_lsaddrs; ++static grub_command_t cmd_efi_addaddr; ++static grub_command_t cmd_efi_bootp; ++static grub_command_t cmd_efi_bootp6; ++ ++static int initialized; ++ ++GRUB_MOD_INIT(efi_netfs) ++{ ++ if (grub_net_open) ++ return; ++ ++ if (grub_efi_net_fs_init ()) ++ { ++ cmd_efi_lsroutes = grub_register_command ("net_efi_ls_routes", grub_efi_net_list_routes, ++ "", N_("list network routes")); ++ cmd_efi_lscards = grub_register_command ("net_efi_ls_cards", grub_efi_net_list_cards, ++ "", N_("list network cards")); ++ cmd_efi_lsaddrs = grub_register_command ("net_efi_ls_addr", grub_efi_net_list_addrs, ++ "", N_("list network addresses")); ++ cmd_efi_addaddr = grub_register_command ("net_efi_add_addr", grub_efi_net_add_addr, ++ N_("SHORTNAME CARD ADDRESS [HWADDRESS]"), ++ N_("Add a network address.")); ++ cmd_efi_bootp = grub_register_command ("net_efi_bootp", grub_efi_net_bootp, ++ N_("[CARD]"), ++ N_("perform a bootp autoconfiguration")); ++ cmd_efi_bootp6 = grub_register_command ("net_efi_bootp6", grub_efi_net_bootp6, ++ N_("[CARD]"), ++ N_("perform a bootp autoconfiguration")); ++ initialized = 1; ++ } ++} ++ ++GRUB_MOD_FINI(efi_netfs) ++{ ++ if (initialized) ++ { ++ grub_unregister_command (cmd_efi_lsroutes); ++ grub_unregister_command (cmd_efi_lscards); ++ grub_unregister_command (cmd_efi_lsaddrs); ++ grub_unregister_command (cmd_efi_addaddr); ++ grub_unregister_command (cmd_efi_bootp); ++ grub_unregister_command (cmd_efi_bootp6); ++ grub_efi_net_fs_fini (); ++ initialized = 0; ++ return; ++ } ++} diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c new file mode 100644 -index 000000000..70affd8ed +index 00000000000..de28badccb0 --- /dev/null +++ b/grub-core/net/efi/http.c -@@ -0,0 +1,424 @@ +@@ -0,0 +1,410 @@ + +#include +#include +#include +#include +#include -+#include + +static void +http_configure (struct grub_efi_net_device *dev, int prefer_ip6) @@ -746,9 +802,9 @@ index 000000000..70affd8ed + + http_config.local_address_is_ipv6 = 1; + sz = sizeof (manual_address); -+ status = dev->ip6_config->get_data (dev->ip6_config, -+ GRUB_EFI_IP6_CONFIG_DATA_TYPE_MANUAL_ADDRESS, -+ &sz, &manual_address); ++ status = dev->ip6_config->get_data(dev->ip6_config, ++ GRUB_EFI_IP6_CONFIG_DATA_TYPE_MANUAL_ADDRESS, ++ &sz, &manual_address); + + if (status == GRUB_EFI_NOT_FOUND) + { @@ -778,19 +834,19 @@ index 000000000..70affd8ed + http_config.access_point.ipv4_node = &httpv4_node; + } + -+ status = http->configure (http, &http_config); ++ status = http->configure(http, &http_config); + + if (status == GRUB_EFI_ALREADY_STARTED) + { + /* XXX: This hangs HTTPS boot */ +#if 0 -+ if (http->configure (http, NULL) != GRUB_EFI_SUCCESS) ++ if (http->configure(http, NULL) != GRUB_EFI_SUCCESS) + { + grub_error (GRUB_ERR_IO, N_("couldn't reset http instance")); + grub_print_error (); + return; + } -+ status = http->configure (http, &http_config); ++ status = http->configure(http, &http_config); +#endif + return; + } @@ -806,14 +862,14 @@ index 000000000..70affd8ed +static grub_efi_boolean_t request_callback_done; +static grub_efi_boolean_t response_callback_done; + -+static void __grub_efi_api ++static void +grub_efi_http_request_callback (grub_efi_event_t event __attribute__ ((unused)), + void *context __attribute__ ((unused))) +{ + request_callback_done = 1; +} + -+static void __grub_efi_api ++static void +grub_efi_http_response_callback (grub_efi_event_t event __attribute__ ((unused)), + void *context __attribute__ ((unused))) +{ @@ -848,7 +904,6 @@ index 000000000..70affd8ed + grub_efi_char16_t *ucs2_url; + grub_size_t url_len, ucs2_url_len; + const char *protocol = (use_https == 1) ? "https" : "http"; -+ grub_size_t sz; + + if (grub_efi_string_to_ip6_address (server, &address, &rest) && *rest == 0) + url = grub_xasprintf ("%s://[%s]%s", protocol, server, name); @@ -861,11 +916,8 @@ index 000000000..70affd8ed + } + + url_len = grub_strlen (url); -+ if (grub_mul (url_len, GRUB_MAX_UTF16_PER_UTF8, &ucs2_url_len) || -+ grub_add (ucs2_url_len, 1, &sz)) -+ return GRUB_ERR_OUT_OF_RANGE; -+ -+ ucs2_url = grub_calloc (sz, sizeof (ucs2_url[0])); ++ ucs2_url_len = url_len * GRUB_MAX_UTF16_PER_UTF8; ++ ucs2_url = grub_malloc ((ucs2_url_len + 1) * sizeof (ucs2_url[0])); + + if (!ucs2_url) + { @@ -893,30 +945,27 @@ index 000000000..70affd8ed + request_token.message = &request_message; + + request_callback_done = 0; -+ status = b->create_event ( -+ GRUB_EFI_EVT_NOTIFY_SIGNAL, -+ GRUB_EFI_TPL_CALLBACK, -+ grub_efi_http_request_callback, -+ NULL, -+ &request_token.event); ++ status = b->create_event(GRUB_EFI_EVT_NOTIFY_SIGNAL, GRUB_EFI_TPL_CALLBACK, ++ grub_efi_http_request_callback, NULL, ++ &request_token.event); + + if (status != GRUB_EFI_SUCCESS) + { + grub_free (request_data.url); -+ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%" PRIxGRUB_SIZE, status); ++ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", status); + } + -+ status = http->request (http, &request_token); ++ status = http->request(http, &request_token); + + if (status != GRUB_EFI_SUCCESS) + { -+ b->close_event (request_token.event); ++ b->close_event(request_token.event); + grub_free (request_data.url); -+ return grub_error (GRUB_ERR_IO, "Fail to send a request! status=0x%" PRIxGRUB_SIZE, status); ++ return grub_error (GRUB_ERR_IO, "Fail to send a request! status=0x%x\n", status); + } + /* TODO: Add Timeout */ + while (!request_callback_done) -+ http->poll (http); ++ http->poll(http); + + response_data.status_code = GRUB_EFI_HTTP_STATUS_UNSUPPORTED_STATUS; + response_message.data.response = &response_data; @@ -929,18 +978,15 @@ index 000000000..70affd8ed + response_message.body = NULL; + response_token.event = NULL; + -+ status = b->create_event ( -+ GRUB_EFI_EVT_NOTIFY_SIGNAL, -+ GRUB_EFI_TPL_CALLBACK, -+ grub_efi_http_response_callback, -+ NULL, -+ &response_token.event); ++ status = b->create_event(GRUB_EFI_EVT_NOTIFY_SIGNAL, GRUB_EFI_TPL_CALLBACK, ++ grub_efi_http_response_callback, NULL, ++ &response_token.event); + + if (status != GRUB_EFI_SUCCESS) + { -+ b->close_event (request_token.event); ++ b->close_event(request_token.event); + grub_free (request_data.url); -+ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%" PRIxGRUB_SIZE, status); ++ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", status); + } + + response_token.status = GRUB_EFI_SUCCESS; @@ -948,28 +994,28 @@ index 000000000..70affd8ed + + /* wait for HTTP response */ + response_callback_done = 0; -+ status = http->response (http, &response_token); ++ status = http->response(http, &response_token); + + if (status != GRUB_EFI_SUCCESS) + { -+ b->close_event (response_token.event); -+ b->close_event (request_token.event); ++ b->close_event(response_token.event); ++ b->close_event(request_token.event); + grub_free (request_data.url); + return grub_error (GRUB_ERR_IO, "Fail to receive a response! status=%d\n", (int)status); + } + + /* TODO: Add Timeout */ + while (!response_callback_done) -+ http->poll (http); ++ http->poll(http); + + if (response_message.data.response->status_code != GRUB_EFI_HTTP_STATUS_200_OK) + { + grub_efi_http_status_code_t status_code = response_message.data.response->status_code; + + if (response_message.headers) -+ b->free_pool (response_message.headers); -+ b->close_event (response_token.event); -+ b->close_event (request_token.event); ++ b->free_pool(response_message.headers); ++ b->close_event(response_token.event); ++ b->close_event(request_token.event); + grub_free (request_data.url); + if (status_code == GRUB_EFI_HTTP_STATUS_404_NOT_FOUND) + { @@ -997,9 +1043,9 @@ index 000000000..70affd8ed + } + + if (response_message.headers) -+ b->free_pool (response_message.headers); -+ b->close_event (response_token.event); -+ b->close_event (request_token.event); ++ b->free_pool(response_message.headers); ++ b->close_event(response_token.event); ++ b->close_event(request_token.event); + grub_free (request_data.url); + + return GRUB_ERR_NONE; @@ -1024,12 +1070,9 @@ index 000000000..70affd8ed + return -1; + } + -+ b->create_event ( -+ GRUB_EFI_EVT_NOTIFY_SIGNAL, -+ GRUB_EFI_TPL_CALLBACK, -+ grub_efi_http_response_callback, -+ NULL, -+ &response_token.event); ++ b->create_event(GRUB_EFI_EVT_NOTIFY_SIGNAL, GRUB_EFI_TPL_CALLBACK, ++ grub_efi_http_response_callback, NULL, ++ &response_token.event); + + while (len) + { @@ -1044,23 +1087,23 @@ index 000000000..70affd8ed + + response_callback_done = 0; + -+ status = http->response (http, &response_token); ++ status = http->response(http, &response_token); + if (status != GRUB_EFI_SUCCESS) + { -+ b->close_event (response_token.event); ++ b->close_event(response_token.event); + grub_error (GRUB_ERR_IO, "Error! status=%d\n", (int)status); + return -1; + } + + while (!response_callback_done) -+ http->poll (http); ++ http->poll(http); + + sum += response_message.body_length; + buf += response_message.body_length; + len -= response_message.body_length; + } + -+ b->close_event (response_token.event); ++ b->close_event(response_token.event); + + return sum; +} @@ -1143,29 +1186,25 @@ index 000000000..70affd8ed + }; diff --git a/grub-core/net/efi/ip4_config.c b/grub-core/net/efi/ip4_config.c new file mode 100644 -index 000000000..eb78f8fde +index 00000000000..1deba25e79e --- /dev/null +++ b/grub-core/net/efi/ip4_config.c -@@ -0,0 +1,409 @@ +@@ -0,0 +1,398 @@ + +#include +#include +#include +#include +#include -+#include + +char * +grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_address_t hw_address) +{ + char *hw_addr, *p; -+ int s; ++ int sz, s; + int i; -+ grub_size_t sz; + -+ if (grub_mul (hw_address_size, sizeof ("XX:") - 1, &sz) || -+ grub_add (sz, 1, &sz)) -+ return NULL; ++ sz = (int)hw_address_size * (sizeof ("XX:") - 1) + 1; + + hw_addr = grub_malloc (sz); + if (!hw_addr) @@ -1215,7 +1254,7 @@ index 000000000..eb78f8fde + for (i = 0; i < 4; i++) + { + unsigned long t; -+ t = grub_strtoul (ptr, &ptr, 0); ++ t = grub_strtoul (ptr, (char **) &ptr, 0); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; @@ -1257,17 +1296,17 @@ index 000000000..eb78f8fde + if (!interface_info) + return NULL; + -+ status = ip4_config->get_data (ip4_config, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_INTERFACEINFO, -+ &sz, interface_info); ++ status = ip4_config->get_data(ip4_config, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_INTERFACEINFO, ++ &sz, interface_info); + + if (status == GRUB_EFI_BUFFER_TOO_SMALL) + { + grub_free (interface_info); + interface_info = grub_malloc (sz); -+ status = ip4_config->get_data (ip4_config, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_INTERFACEINFO, -+ &sz, interface_info); ++ status = ip4_config->get_data(ip4_config, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_INTERFACEINFO, ++ &sz, interface_info); + } + + if (status != GRUB_EFI_SUCCESS) @@ -1291,9 +1330,9 @@ index 000000000..eb78f8fde + if (!manual_address) + return NULL; + -+ status = ip4_config->get_data (ip4_config, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_MANUAL_ADDRESS, -+ &sz, manual_address); ++ status = ip4_config->get_data(ip4_config, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_MANUAL_ADDRESS, ++ &sz, manual_address); + + if (status != GRUB_EFI_SUCCESS) + { @@ -1381,19 +1420,12 @@ index 000000000..eb78f8fde + grub_efi_ip4_config2_interface_info_t *interface_info; + char **ret; + int i, id; -+ grub_size_t sz; + + interface_info = efi_ip4_config_interface_info (dev->ip4_config); + if (!interface_info) + return NULL; + -+ if (grub_add (interface_info->route_table_size, 1, &sz)) -+ { -+ grub_free (interface_info); -+ return NULL; -+ } -+ -+ ret = grub_calloc (sz, sizeof (*ret)); ++ ret = grub_malloc (sizeof (*ret) * (interface_info->route_table_size + 1)); + + if (!ret) + { @@ -1505,7 +1537,7 @@ index 000000000..eb78f8fde + } + } + -+ status = dev->ip4_config->set_data (dev->ip4_config, ++ status = dev->ip4_config->set_data(dev->ip4_config, + GRUB_EFI_IP4_CONFIG2_DATA_TYPE_MANUAL_ADDRESS, + sizeof(*address), address); + @@ -1521,9 +1553,9 @@ index 000000000..eb78f8fde +{ + grub_efi_status_t status; + -+ status = dev->ip4_config->set_data (dev->ip4_config, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_GATEWAY, -+ sizeof (address->ip4), &address->ip4); ++ status = dev->ip4_config->set_data(dev->ip4_config, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_GATEWAY, ++ sizeof (address->ip4), &address->ip4); + + if (status != GRUB_EFI_SUCCESS) + return 0; @@ -1537,9 +1569,9 @@ index 000000000..eb78f8fde +{ + grub_efi_status_t status; + -+ status = dev->ip4_config->set_data (dev->ip4_config, -+ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, -+ sizeof (address->ip4), &address->ip4); ++ status = dev->ip4_config->set_data(dev->ip4_config, ++ GRUB_EFI_IP4_CONFIG2_DATA_TYPE_DNSSERVER, ++ sizeof (address->ip4), &address->ip4); + + if (status != GRUB_EFI_SUCCESS) + return 0; @@ -1558,16 +1590,15 @@ index 000000000..eb78f8fde + }; diff --git a/grub-core/net/efi/ip6_config.c b/grub-core/net/efi/ip6_config.c new file mode 100644 -index 000000000..0382b7df7 +index 00000000000..29a03973265 --- /dev/null +++ b/grub-core/net/efi/ip6_config.c -@@ -0,0 +1,430 @@ +@@ -0,0 +1,422 @@ +#include +#include +#include +#include +#include -+#include + +char * +grub_efi_ip6_address_to_string (grub_efi_pxe_ipv6_address_t *address) @@ -1649,7 +1680,7 @@ index 000000000..0382b7df7 + ptr++; + continue; + } -+ t = grub_strtoul (ptr, &ptr, 16); ++ t = grub_strtoul (ptr, (char **) &ptr, 16); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; @@ -1689,7 +1720,7 @@ index 000000000..0382b7df7 + sz = sizeof (*interface_info) + sizeof (*interface_info->route_table); + interface_info = grub_malloc (sz); + -+ status = ip6_config->get_data (ip6_config, ++ status = ip6_config->get_data(ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_INTERFACEINFO, + &sz, interface_info); + @@ -1697,7 +1728,7 @@ index 000000000..0382b7df7 + { + grub_free (interface_info); + interface_info = grub_malloc (sz); -+ status = ip6_config->get_data (ip6_config, ++ status = ip6_config->get_data(ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_INTERFACEINFO, + &sz, interface_info); + } @@ -1723,7 +1754,7 @@ index 000000000..0382b7df7 + if (!manual_address) + return NULL; + -+ status = ip6_config->get_data (ip6_config, ++ status = ip6_config->get_data(ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_MANUAL_ADDRESS, + &sz, manual_address); + @@ -1794,19 +1825,12 @@ index 000000000..0382b7df7 + grub_efi_ip6_config_interface_info_t *interface_info; + char **ret; + int i, id; -+ grub_size_t sz; + + interface_info = efi_ip6_config_interface_info (dev->ip6_config); + if (!interface_info) + return NULL; + -+ if (grub_add (interface_info->route_count, 1, &sz)) -+ { -+ grub_free (interface_info); -+ return NULL; -+ } -+ -+ ret = grub_calloc (sz, sizeof (*ret)); ++ ret = grub_malloc (sizeof (*ret) * (interface_info->route_count + 1)); + + if (!ret) + { @@ -1941,7 +1965,7 @@ index 000000000..0382b7df7 + } + } + -+ status = dev->ip6_config->set_data (dev->ip6_config, ++ status = dev->ip6_config->set_data(dev->ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_MANUAL_ADDRESS, + sizeof(*address), address); + @@ -1957,7 +1981,7 @@ index 000000000..0382b7df7 +{ + grub_efi_status_t status; + -+ status = dev->ip6_config->set_data (dev->ip6_config, ++ status = dev->ip6_config->set_data(dev->ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_GATEWAY, + sizeof (address->ip6), &address->ip6); + @@ -1973,7 +1997,7 @@ index 000000000..0382b7df7 + + grub_efi_status_t status; + -+ status = dev->ip6_config->set_data (dev->ip6_config, ++ status = dev->ip6_config->set_data(dev->ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_DNSSERVER, + sizeof (address->ip6), &address->ip6); + @@ -1994,10 +2018,10 @@ index 000000000..0382b7df7 + }; diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c new file mode 100644 -index 000000000..a7845e2eb +index 00000000000..1a19ee27144 --- /dev/null +++ b/grub-core/net/efi/net.c -@@ -0,0 +1,1440 @@ +@@ -0,0 +1,1428 @@ +#include +#include +#include @@ -2012,7 +2036,6 @@ index 000000000..a7845e2eb +#include +#include +#include -+#include + +GRUB_MOD_LICENSE ("GPLv3+"); + @@ -2047,7 +2070,7 @@ index 000000000..a7845e2eb + grub_efi_handle_t handle; + grub_efi_status_t status; + -+ status = grub_efi_system_table->boot_services->locate_device_path ( ++ status = grub_efi_system_table->boot_services->locate_device_path( + protocol, &device_path, &handle); + + if (status != GRUB_EFI_SUCCESS) @@ -2238,15 +2261,7 @@ index 000000000..a7845e2eb + + if (code == GRUB_NET_DHCP6_OPTION_BOOTFILE_URL) + { -+ char *url; -+ grub_size_t sz; -+ -+ if (grub_add (len, 1, &sz)) -+ return; -+ -+ url = grub_malloc (sz); -+ if (!url) -+ return; ++ char *url = grub_malloc (len + 1); + + grub_memcpy (url, dhcp_opt->data, len); + url[len] = 0; @@ -2355,7 +2370,7 @@ index 000000000..a7845e2eb + device, + path); + -+ grub_memcpy (net_ip.ip6.address, pxe->mode->station_ip.v6.addr, sizeof(net_ip.ip6.address)); ++ grub_memcpy (net_ip.ip6.address, pxe->mode->station_ip.v6, sizeof(net_ip.ip6.address)); + net_ip.ip6.prefix_length = GRUB_EFI_IP6_PREFIX_LENGTH; + net_ip.ip6.is_anycast = 0; + net_ip.is_ip6 = 1; @@ -2374,8 +2389,8 @@ index 000000000..a7845e2eb + path, + 1); + -+ grub_memcpy (net_ip.ip4.address, pxe->mode->station_ip.v4.addr, sizeof (net_ip.ip4.address)); -+ grub_memcpy (net_ip.ip4.subnet_mask, pxe->mode->subnet_mask.v4.addr, sizeof (net_ip.ip4.subnet_mask)); ++ grub_memcpy (net_ip.ip4.address, pxe->mode->station_ip.v4, sizeof (net_ip.ip4.address)); ++ grub_memcpy (net_ip.ip4.subnet_mask, pxe->mode->subnet_mask.v4, sizeof (net_ip.ip4.subnet_mask)); + net_ip.is_ip6 = 0; + return (grub_efi_net_create_interface (netdev, + netdev->card_name, @@ -2710,10 +2725,10 @@ index 000000000..a7845e2eb + return NULL; + } + -+ status = service->create_child (service, &child_dev); ++ status = service->create_child(service, &child_dev); + if (status != GRUB_EFI_SUCCESS) + { -+ grub_error (GRUB_ERR_IO, N_("Failed to create child device of http service %" PRIxGRUB_SIZE), status); ++ grub_error (GRUB_ERR_IO, N_("Failed to create child device of http service %x"), status); + return NULL; + } + @@ -2736,7 +2751,7 @@ index 000000000..a7845e2eb + { + grub_uint32_t subnet_mask_size; + -+ subnet_mask_size = grub_strtoul (rest + 1, &rest, 0); ++ subnet_mask_size = grub_strtoul (rest + 1, (char **) &rest, 0); + + if (!grub_errno && subnet_mask_size <= 32 && *rest == 0) + { @@ -2765,7 +2780,7 @@ index 000000000..a7845e2eb + { + grub_efi_uint8_t prefix_length; + -+ prefix_length = grub_strtoul (rest + 1, &rest, 0); ++ prefix_length = grub_strtoul (rest + 1, (char **) &rest, 0); + if (!grub_errno && prefix_length <= 128 && *rest == 0) + { + ip6->prefix_length = prefix_length; @@ -2799,16 +2814,13 @@ index 000000000..a7845e2eb + grub_efi_net_interface_t *inf; + int is_ip6 = 0; + -+ grub_error_push (); + err = grub_efi_net_parse_address (server, &ip4, &ip6, &is_ip6, 0); + + if (err) + { -+ grub_dprintf ("efinetfs", "error in matching route : %s\n", grub_errmsg); -+ grub_error_pop (); ++ grub_print_error (); + return NULL; + } -+ grub_error_pop (); + + if (is_ip6) + { @@ -2923,7 +2935,7 @@ index 000000000..a7845e2eb + { + grub_efi_ip4_config2_policy_t ip4_policy = GRUB_EFI_IP4_CONFIG2_POLICY_STATIC; + -+ if (dev->ip4_config->set_data (dev->ip4_config, ++ if (dev->ip4_config->set_data(dev->ip4_config, + GRUB_EFI_IP4_CONFIG2_DATA_TYPE_POLICY, + sizeof (ip4_policy), &ip4_policy) != GRUB_EFI_SUCCESS) + grub_dprintf ("efinetfs", "could not set GRUB_EFI_IP4_CONFIG2_POLICY_STATIC on dev `%s'", dev->card_name); @@ -2932,7 +2944,7 @@ index 000000000..a7845e2eb + { + grub_efi_ip6_config_policy_t ip6_policy = GRUB_EFI_IP6_CONFIG_POLICY_MANUAL; + -+ if (dev->ip6_config->set_data (dev->ip6_config, ++ if (dev->ip6_config->set_data(dev->ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_POLICY, + sizeof (ip6_policy), &ip6_policy) != GRUB_EFI_SUCCESS) + grub_dprintf ("efinetfs", "could not set GRUB_EFI_IP6_CONFIG_POLICY_MANUAL on dev `%s'", dev->card_name); @@ -3440,7 +3452,7 @@ index 000000000..a7845e2eb +} diff --git a/grub-core/net/efi/pxe.c b/grub-core/net/efi/pxe.c new file mode 100644 -index 000000000..a8eff6eeb +index 00000000000..b84f86ea470 --- /dev/null +++ b/grub-core/net/efi/pxe.c @@ -0,0 +1,424 @@ @@ -3463,7 +3475,7 @@ index 000000000..a8eff6eeb + if (!manual_address) + return NULL; + -+ status = ip6_config->get_data (ip6_config, ++ status = ip6_config->get_data(ip6_config, + GRUB_EFI_IP6_CONFIG_DATA_TYPE_MANUAL_ADDRESS, + &sz, manual_address); + @@ -3488,7 +3500,7 @@ index 000000000..a8eff6eeb + if (!manual_address) + return NULL; + -+ status = ip4_config->get_data (ip4_config, ++ status = ip4_config->get_data(ip4_config, + GRUB_EFI_IP4_CONFIG2_DATA_TYPE_MANUAL_ADDRESS, + &sz, manual_address); + @@ -3511,7 +3523,7 @@ index 000000000..a8eff6eeb + if (!mode->started) + { + grub_efi_status_t status; -+ status = pxe->start (pxe, prefer_ip6); ++ status = pxe->start(pxe, prefer_ip6); + + if (status != GRUB_EFI_SUCCESS) + grub_printf ("Couldn't start PXE\n"); @@ -3528,13 +3540,13 @@ index 000000000..a8eff6eeb + manual_address = efi_ip6_config_manual_address (dev->ip6_config); + + if (manual_address && -+ grub_memcmp (manual_address->address, mode->station_ip.v6.addr, sizeof (manual_address->address)) != 0) ++ grub_memcmp (manual_address->address, mode->station_ip.v6, sizeof (manual_address->address)) != 0) + { + grub_efi_status_t status; + grub_efi_pxe_ip_address_t station_ip; + + grub_memcpy (station_ip.v6.addr, manual_address->address, sizeof (station_ip.v6.addr)); -+ status = pxe->set_station_ip (pxe, &station_ip, NULL); ++ status = pxe->set_station_ip(pxe, &station_ip, NULL); + + if (status != GRUB_EFI_SUCCESS) + grub_printf ("Couldn't set station ip\n"); @@ -3548,7 +3560,7 @@ index 000000000..a8eff6eeb + manual_address = efi_ip4_config_manual_address (dev->ip4_config); + + if (manual_address && -+ grub_memcmp (manual_address->address, mode->station_ip.v4.addr, sizeof (manual_address->address)) != 0) ++ grub_memcmp (manual_address->address, mode->station_ip.v4, sizeof (manual_address->address)) != 0) + { + grub_efi_status_t status; + grub_efi_pxe_ip_address_t station_ip; @@ -3557,7 +3569,7 @@ index 000000000..a8eff6eeb + grub_memcpy (station_ip.v4.addr, manual_address->address, sizeof (station_ip.v4.addr)); + grub_memcpy (subnet_mask.v4.addr, manual_address->subnet_mask, sizeof (subnet_mask.v4.addr)); + -+ status = pxe->set_station_ip (pxe, &station_ip, &subnet_mask); ++ status = pxe->set_station_ip(pxe, &station_ip, &subnet_mask); + + if (status != GRUB_EFI_SUCCESS) + grub_printf ("Couldn't set station ip\n"); @@ -3633,7 +3645,7 @@ index 000000000..a8eff6eeb + ptr++; + continue; + } -+ t = grub_strtoul (ptr, &ptr, 16); ++ t = grub_strtoul (ptr, (char **) &ptr, 16); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; @@ -3671,7 +3683,7 @@ index 000000000..a8eff6eeb + int type __attribute__((unused))) +{ + int i; -+ const char *p; ++ char *p; + grub_efi_status_t status; + grub_efi_pxe_ip_address_t server_ip; + grub_efi_uint64_t file_size = 0; @@ -3710,7 +3722,7 @@ index 000000000..a8eff6eeb + server_ip.v4.addr[i] = grub_strtoul (p, &p, 10); + } + -+ status = pxe->mtftp ( ++ status = pxe->mtftp( + pxe, + GRUB_EFI_PXE_BASE_CODE_TFTP_GET_FILE_SIZE, + NULL, @@ -3759,7 +3771,7 @@ index 000000000..a8eff6eeb + grub_size_t len) +{ + int i; -+ const char *p; ++ char *p; + grub_efi_status_t status; + grub_efi_pxe_t *pxe = (prefer_ip6) ? dev->ip6_pxe : dev->ip4_pxe; + grub_efi_uint64_t bufsz = len; @@ -3795,7 +3807,7 @@ index 000000000..a8eff6eeb + server_ip.v4.addr[i] = grub_strtoul (p, &p, 10); + } + -+ status = pxe->mtftp ( ++ status = pxe->mtftp( + pxe, + GRUB_EFI_PXE_BASE_CODE_TFTP_READ_FILE, + buf, @@ -3826,7 +3838,7 @@ index 000000000..a8eff6eeb + return 0; + } + -+ status = pxe->mtftp ( ++ status = pxe->mtftp( + pxe, + GRUB_EFI_PXE_BASE_CODE_TFTP_READ_FILE, + buf2, @@ -3869,7 +3881,7 @@ index 000000000..a8eff6eeb + }; + diff --git a/grub-core/net/net.c b/grub-core/net/net.c -index 8cad4fb6d..22221dc6a 100644 +index fa6b6537142..fdec64d55ee 100644 --- a/grub-core/net/net.c +++ b/grub-core/net/net.c @@ -32,6 +32,9 @@ @@ -3882,7 +3894,7 @@ index 8cad4fb6d..22221dc6a 100644 GRUB_MOD_LICENSE ("GPLv3+"); -@@ -2014,8 +2017,49 @@ static grub_command_t cmd_addaddr, cmd_deladdr, cmd_addroute, cmd_delroute; +@@ -2092,8 +2095,49 @@ static grub_command_t cmd_addaddr, cmd_deladdr, cmd_addroute, cmd_delroute; static grub_command_t cmd_setvlan, cmd_lsroutes, cmd_lscards; static grub_command_t cmd_lsaddr, cmd_slaac; @@ -3932,7 +3944,7 @@ index 8cad4fb6d..22221dc6a 100644 grub_register_variable_hook ("net_default_server", defserver_get_env, defserver_set_env); grub_env_export ("net_default_server"); -@@ -2066,10 +2110,37 @@ GRUB_MOD_INIT(net) +@@ -2144,10 +2188,37 @@ GRUB_MOD_INIT(net) grub_net_restore_hw, GRUB_LOADER_PREBOOT_HOOK_PRIO_DISK); grub_net_poll_cards_idle = grub_net_poll_cards_idle_real; @@ -3970,7 +3982,7 @@ index 8cad4fb6d..22221dc6a 100644 grub_register_variable_hook ("net_default_server", 0, 0); grub_register_variable_hook ("pxe_default_server", 0, 0); -@@ -2088,4 +2159,7 @@ GRUB_MOD_FINI(net) +@@ -2166,4 +2237,7 @@ GRUB_MOD_FINI(net) grub_net_fini_hw (0); grub_loader_unregister_preboot_hook (fini_hnd); grub_net_poll_cards_idle = NULL; @@ -3978,12 +3990,94 @@ index 8cad4fb6d..22221dc6a 100644 + init_mode = INIT_MODE_NONE; +#endif } +diff --git a/util/grub-mknetdir.c b/util/grub-mknetdir.c +index 46f304c2b47..11c9db11775 100644 +--- a/util/grub-mknetdir.c ++++ b/util/grub-mknetdir.c +@@ -32,13 +32,15 @@ + + static char *rootdir = NULL, *subdir = NULL; + static char *debug_image = NULL; ++static char efi_netfs = 0; + + enum + { + OPTION_NET_DIRECTORY = 0x301, + OPTION_SUBDIR, + OPTION_DEBUG, +- OPTION_DEBUG_IMAGE ++ OPTION_DEBUG_IMAGE, ++ OPTION_DEBUG_EFI_NETFS + }; + + static struct argp_option options[] = { +@@ -49,6 +51,7 @@ static struct argp_option options[] = { + 0, N_("relative subdirectory on network server"), 2}, + {"debug", OPTION_DEBUG, 0, OPTION_HIDDEN, 0, 2}, + {"debug-image", OPTION_DEBUG_IMAGE, N_("STRING"), OPTION_HIDDEN, 0, 2}, ++ {"debug-efi-netfs", OPTION_DEBUG_EFI_NETFS, 0, OPTION_HIDDEN, 0, 2}, + {0, 0, 0, 0, 0, 0} + }; + +@@ -67,6 +70,9 @@ argp_parser (int key, char *arg, struct argp_state *state) + free (subdir); + subdir = xstrdup (arg); + return 0; ++ case OPTION_DEBUG_EFI_NETFS: ++ efi_netfs = 1; ++ return 0; + /* This is an undocumented feature... */ + case OPTION_DEBUG: + verbosity++; +@@ -82,7 +88,6 @@ argp_parser (int key, char *arg, struct argp_state *state) + } + } + +- + struct argp argp = { + options, argp_parser, NULL, + "\v"N_("Prepares GRUB network boot images at net_directory/subdir " +@@ -92,7 +97,7 @@ struct argp argp = { + + static char *base; + +-static const struct ++static struct + { + const char *mkimage_target; + const char *netmodule; +@@ -157,6 +162,7 @@ process_input_dir (const char *input_dir, enum grub_install_plat platform) + grub_install_push_module (targets[platform].netmodule); + + output = grub_util_path_concat_ext (2, grubdir, "core", targets[platform].ext); ++ + grub_install_make_image_wrap (input_dir, prefix, output, + 0, load_cfg, + targets[platform].mkimage_target, 0); +@@ -196,7 +202,16 @@ main (int argc, char *argv[]) + + grub_install_mkdir_p (base); + +- grub_install_push_module ("tftp"); ++ if (!efi_netfs) ++ { ++ grub_install_push_module ("tftp"); ++ grub_install_push_module ("http"); ++ } ++ else ++ { ++ targets[GRUB_INSTALL_PLATFORM_I386_EFI].netmodule = "efi_netfs"; ++ targets[GRUB_INSTALL_PLATFORM_X86_64_EFI].netmodule = "efi_netfs"; ++ } + + if (!grub_install_source_directory) + { diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h -index 87dcfc0a5..7947cf592 100644 +index 248d6a28ff9..805a9d7adf9 100644 --- a/include/grub/efi/api.h +++ b/include/grub/efi/api.h -@@ -653,6 +653,23 @@ typedef grub_uint16_t grub_efi_ipv6_address_t[8]; - typedef grub_uint8_t grub_efi_ip_address_t[8] __attribute__ ((aligned(4))); +@@ -668,6 +668,23 @@ typedef union + typedef grub_efi_uint64_t grub_efi_physical_address_t; typedef grub_efi_uint64_t grub_efi_virtual_address_t; +typedef struct { @@ -4006,7 +4100,7 @@ index 87dcfc0a5..7947cf592 100644 /* XXX although the spec does not specify the padding, this actually must have the padding! */ -@@ -902,6 +919,8 @@ struct grub_efi_ipv6_device_path +@@ -917,6 +934,8 @@ struct grub_efi_ipv6_device_path grub_efi_uint16_t remote_port; grub_efi_uint16_t protocol; grub_efi_uint8_t static_ip_address; @@ -4015,7 +4109,7 @@ index 87dcfc0a5..7947cf592 100644 } GRUB_PACKED; typedef struct grub_efi_ipv6_device_path grub_efi_ipv6_device_path_t; -@@ -960,6 +979,15 @@ struct grub_efi_uri_device_path +@@ -975,6 +994,15 @@ struct grub_efi_uri_device_path } GRUB_PACKED; typedef struct grub_efi_uri_device_path grub_efi_uri_device_path_t; @@ -4031,7 +4125,7 @@ index 87dcfc0a5..7947cf592 100644 #define GRUB_EFI_VENDOR_MESSAGING_DEVICE_PATH_SUBTYPE 10 /* Media Device Path. */ -@@ -1042,6 +1070,23 @@ struct grub_efi_bios_device_path +@@ -1057,6 +1085,23 @@ struct grub_efi_bios_device_path } GRUB_PACKED; typedef struct grub_efi_bios_device_path grub_efi_bios_device_path_t; @@ -4039,11 +4133,11 @@ index 87dcfc0a5..7947cf592 100644 +struct grub_efi_service_binding; + +typedef grub_efi_status_t -+(__grub_efi_api *grub_efi_service_binding_create_child) (struct grub_efi_service_binding *this, ++(*grub_efi_service_binding_create_child) (struct grub_efi_service_binding *this, + grub_efi_handle_t *child_handle); + +typedef grub_efi_status_t -+(__grub_efi_api *grub_efi_service_binding_destroy_child) (struct grub_efi_service_binding *this, ++(*grub_efi_service_binding_destroy_child) (struct grub_efi_service_binding *this, + grub_efi_handle_t *child_handle); + +typedef struct grub_efi_service_binding @@ -4055,9 +4149,9 @@ index 87dcfc0a5..7947cf592 100644 struct grub_efi_open_protocol_information_entry { grub_efi_handle_t agent_handle; -@@ -1544,23 +1589,28 @@ typedef struct grub_efi_simple_text_output_interface grub_efi_simple_text_output - - typedef grub_uint8_t grub_efi_pxe_packet_t[1472]; +@@ -1617,23 +1662,27 @@ typedef struct grub_efi_pxe_tftp_error + grub_efi_char8_t error_string[127]; + } grub_efi_pxe_tftp_error_t; -typedef struct { - grub_uint8_t addr[4]; @@ -4079,16 +4173,15 @@ index 87dcfc0a5..7947cf592 100644 + GRUB_EFI_PXE_BASE_CODE_MTFTP_LAST +} grub_efi_pxe_base_code_tftp_opcode_t; --typedef struct { + typedef struct { - grub_uint8_t addr[32]; -} grub_efi_pxe_mac_address_t; - +- -typedef union { -- grub_uint32_t addr[4]; -- grub_efi_pxe_ipv4_address_t v4; -- grub_efi_pxe_ipv6_address_t v6; +- grub_uint32_t addr[4]; +- grub_efi_pxe_ipv4_address_t v4; +- grub_efi_pxe_ipv6_address_t v6; -} grub_efi_pxe_ip_address_t; -+typedef struct { + grub_efi_ip_address_t mcast_ip; + grub_efi_pxe_base_code_udp_port_t c_port; + grub_efi_pxe_base_code_udp_port_t s_port; @@ -4097,8 +4190,8 @@ index 87dcfc0a5..7947cf592 100644 +} grub_efi_pxe_base_code_mtftp_info_t; #define GRUB_EFI_PXE_BASE_CODE_MAX_IPCNT 8 - typedef struct { -@@ -1610,18 +1660,32 @@ typedef struct grub_efi_pxe_mode + typedef struct grub_efi_pxe_ip_filter +@@ -1700,18 +1749,31 @@ typedef struct grub_efi_pxe_mode typedef struct grub_efi_pxe { grub_uint64_t rev; @@ -4114,12 +4207,12 @@ index 87dcfc0a5..7947cf592 100644 - void *setparams; - void *setstationip; - void *setpackets; -+ grub_efi_status_t (__grub_efi_api *start) (struct grub_efi_pxe *this, grub_efi_boolean_t use_ipv6); -+ void (__grub_efi_api *stop) (void); -+ grub_efi_status_t (__grub_efi_api *dhcp) (struct grub_efi_pxe *this, ++ grub_efi_status_t (*start) (struct grub_efi_pxe *this, grub_efi_boolean_t use_ipv6); ++ void (*stop) (void); ++ grub_efi_status_t (*dhcp) (struct grub_efi_pxe *this, + grub_efi_boolean_t sort_offers); -+ void (__grub_efi_api *discover) (void); -+ grub_efi_status_t (__grub_efi_api *mtftp) (struct grub_efi_pxe *this, ++ void (*discover) (void); ++ grub_efi_status_t (*mtftp) (struct grub_efi_pxe *this, + grub_efi_pxe_base_code_tftp_opcode_t operation, + void *buffer_ptr, + grub_efi_boolean_t overwrite, @@ -4130,20 +4223,19 @@ index 87dcfc0a5..7947cf592 100644 + grub_efi_char8_t *filename, + grub_efi_pxe_base_code_mtftp_info_t *info, + grub_efi_boolean_t dont_use_buffer); -+ void (__grub_efi_api *udpwrite) (void); -+ void (__grub_efi_api *udpread) (void); -+ void (__grub_efi_api *setipfilter) (void); -+ void (__grub_efi_api *arp) (void); -+ void (__grub_efi_api *setparams) (void); -+ grub_efi_status_t (__grub_efi_api *set_station_ip) (struct grub_efi_pxe *this, ++ void (*udpwrite) (void); ++ void (*udpread) (void); ++ void (*setipfilter) (void); ++ void (*arp) (void); ++ void (*setparams) (void); ++ grub_efi_status_t (*set_station_ip) (struct grub_efi_pxe *this, + grub_efi_pxe_ip_address_t *new_station_ip, + grub_efi_pxe_ip_address_t *new_subnet_mask); -+ //void (*setstationip) (void); -+ void (__grub_efi_api *setpackets) (void); ++ void (*setpackets) (void); struct grub_efi_pxe_mode *mode; } grub_efi_pxe_t; -@@ -1921,6 +1985,44 @@ struct grub_efi_ip4_config2_protocol +@@ -2005,6 +2067,44 @@ struct grub_efi_ip4_config2_protocol }; typedef struct grub_efi_ip4_config2_protocol grub_efi_ip4_config2_protocol_t; @@ -4188,7 +4280,7 @@ index 87dcfc0a5..7947cf592 100644 enum grub_efi_ip6_config_data_type { GRUB_EFI_IP6_CONFIG_DATA_TYPE_INTERFACEINFO, GRUB_EFI_IP6_CONFIG_DATA_TYPE_ALT_INTERFACEID, -@@ -1955,4 +2057,47 @@ struct grub_efi_ip6_config_protocol +@@ -2039,6 +2139,49 @@ struct grub_efi_ip6_config_protocol }; typedef struct grub_efi_ip6_config_protocol grub_efi_ip6_config_protocol_t; @@ -4235,10 +4327,12 @@ index 87dcfc0a5..7947cf592 100644 +}; +typedef struct grub_efi_ip6_config_manual_address grub_efi_ip6_config_manual_address_t; + - #endif /* ! GRUB_EFI_API_HEADER */ + struct initrd_media_device_path { + grub_efi_vendor_media_device_path_t vendor; + grub_efi_device_path_t end; diff --git a/include/grub/efi/dhcp.h b/include/grub/efi/dhcp.h new file mode 100644 -index 000000000..e4518128a +index 00000000000..fdb88eb810e --- /dev/null +++ b/include/grub/efi/dhcp.h @@ -0,0 +1,343 @@ @@ -4397,27 +4491,27 @@ index 000000000..e4518128a +typedef struct grub_efi_dhcp4_mode_data grub_efi_dhcp4_mode_data_t; + +struct grub_efi_dhcp4_protocol { -+ grub_efi_status_t (__grub_efi_api *get_mode_data) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*get_mode_data) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_mode_data_t *dhcp4_mode_data); -+ grub_efi_status_t (__grub_efi_api *configure) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*configure) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_config_data_t *dhcp4_cfg_data); -+ grub_efi_status_t (__grub_efi_api *start) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*start) (grub_efi_dhcp4_protocol_t *this, + grub_efi_event_t completion_event); -+ grub_efi_status_t (__grub_efi_api *renew_rebind) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*renew_rebind) (grub_efi_dhcp4_protocol_t *this, + grub_efi_boolean_t rebind_request, + grub_efi_event_t completion_event); -+ grub_efi_status_t (__grub_efi_api *release) (grub_efi_dhcp4_protocol_t *this); -+ grub_efi_status_t (__grub_efi_api *stop) (grub_efi_dhcp4_protocol_t *this); -+ grub_efi_status_t (__grub_efi_api *build) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*release) (grub_efi_dhcp4_protocol_t *this); ++ grub_efi_status_t (*stop) (grub_efi_dhcp4_protocol_t *this); ++ grub_efi_status_t (*build) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_packet_t *seed_packet, + grub_efi_uint32_t delete_count, + grub_efi_uint8_t *delete_list, + grub_efi_uint32_t append_count, + grub_efi_dhcp4_packet_option_t *append_list[], + grub_efi_dhcp4_packet_t **new_packet); -+ grub_efi_status_t (__grub_efi_api *transmit_receive) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*transmit_receive) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_transmit_receive_token_t *token); -+ grub_efi_status_t (__grub_efi_api *parse) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (*parse) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_packet_t *packet, + grub_efi_uint32_t *option_count, + grub_efi_dhcp4_packet_option_t *packet_option_list[]); @@ -4552,33 +4646,33 @@ index 000000000..e4518128a +typedef struct grub_efi_dhcp6_config_data grub_efi_dhcp6_config_data_t; + +struct grub_efi_dhcp6_protocol { -+ grub_efi_status_t (__grub_efi_api *get_mode_data) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*get_mode_data) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_mode_data_t *dhcp6_mode_data, + grub_efi_dhcp6_config_data_t *dhcp6_config_data); -+ grub_efi_status_t (__grub_efi_api *configure) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*configure) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_config_data_t *dhcp6_cfg_data); -+ grub_efi_status_t (__grub_efi_api *start) (grub_efi_dhcp6_protocol_t *this); -+ grub_efi_status_t (__grub_efi_api *info_request) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*start) (grub_efi_dhcp6_protocol_t *this); ++ grub_efi_status_t (*info_request) (grub_efi_dhcp6_protocol_t *this, + grub_efi_boolean_t send_client_id, + grub_efi_dhcp6_packet_option_t *option_request, + grub_efi_uint32_t option_count, + grub_efi_dhcp6_packet_option_t *option_list[], + grub_efi_dhcp6_retransmission_t *retransmission, + grub_efi_event_t timeout_event, -+ grub_efi_status_t (__grub_efi_api *reply_callback) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*reply_callback) (grub_efi_dhcp6_protocol_t *this, + void *context, + grub_efi_dhcp6_packet_t *packet), + void *callback_context); -+ grub_efi_status_t (__grub_efi_api *renew_rebind) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*renew_rebind) (grub_efi_dhcp6_protocol_t *this, + grub_efi_boolean_t rebind_request); -+ grub_efi_status_t (__grub_efi_api *decline) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*decline) (grub_efi_dhcp6_protocol_t *this, + grub_efi_uint32_t address_count, + grub_efi_ipv6_address_t *addresses); -+ grub_efi_status_t (__grub_efi_api *release) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*release) (grub_efi_dhcp6_protocol_t *this, + grub_efi_uint32_t address_count, + grub_efi_ipv6_address_t *addresses); -+ grub_efi_status_t (__grub_efi_api *stop) (grub_efi_dhcp6_protocol_t *this); -+ grub_efi_status_t (__grub_efi_api *parse) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (*stop) (grub_efi_dhcp6_protocol_t *this); ++ grub_efi_status_t (*parse) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_packet_t *packet, + grub_efi_uint32_t *option_count, + grub_efi_dhcp6_packet_option_t *packet_option_list[]); @@ -4587,7 +4681,7 @@ index 000000000..e4518128a +#endif /* ! GRUB_EFI_DHCP_HEADER */ diff --git a/include/grub/efi/http.h b/include/grub/efi/http.h new file mode 100644 -index 000000000..79592cdb7 +index 00000000000..c5e9a89f505 --- /dev/null +++ b/include/grub/efi/http.h @@ -0,0 +1,215 @@ @@ -4781,34 +4875,34 @@ index 000000000..79592cdb7 + +struct grub_efi_http { + grub_efi_status_t -+ (__grub_efi_api *get_mode_data) (struct grub_efi_http *this, ++ (*get_mode_data) (struct grub_efi_http *this, + grub_efi_http_config_data_t *http_config_data); + + grub_efi_status_t -+ (__grub_efi_api *configure) (struct grub_efi_http *this, ++ (*configure) (struct grub_efi_http *this, + grub_efi_http_config_data_t *http_config_data); + + grub_efi_status_t -+ (__grub_efi_api *request) (struct grub_efi_http *this, ++ (*request) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t -+ (__grub_efi_api *cancel) (struct grub_efi_http *this, ++ (*cancel) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t -+ (__grub_efi_api *response) (struct grub_efi_http *this, ++ (*response) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t -+ (__grub_efi_api *poll) (struct grub_efi_http *this); ++ (*poll) (struct grub_efi_http *this); +}; +typedef struct grub_efi_http grub_efi_http_t; + +#endif /* !GRUB_EFI_HTTP_HEADER */ diff --git a/include/grub/net/efi.h b/include/grub/net/efi.h new file mode 100644 -index 000000000..de90d223e +index 00000000000..de90d223e8e --- /dev/null +++ b/include/grub/net/efi.h @@ -0,0 +1,144 @@ @@ -4956,6 +5050,3 @@ index 000000000..de90d223e +extern grub_command_func_t grub_efi_net_bootp6; + +#endif /* ! GRUB_NET_EFI_HEADER */ --- -2.41.0 - diff --git a/0062-AUDIT-0-http-boot-tracker-bug.patch b/0071-AUDIT-0-http-boot-tracker-bug.patch similarity index 73% rename from 0062-AUDIT-0-http-boot-tracker-bug.patch rename to 0071-AUDIT-0-http-boot-tracker-bug.patch index ecacda4..db7f9c7 100644 --- a/0062-AUDIT-0-http-boot-tracker-bug.patch +++ b/0071-AUDIT-0-http-boot-tracker-bug.patch @@ -1,7 +1,7 @@ -From 303d5635958fb0b4c0cf3b3550d92378a1c99511 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Sebastian Krahmer Date: Tue, 28 Nov 2017 17:24:38 +0800 -Subject: [PATCH 062/272] AUDIT-0: http boot tracker bug +Subject: [PATCH] AUDIT-0: http boot tracker bug Fixing a memory leak in case of error, and a integer overflow, leading to a heap overflow due to overly large chunk sizes. @@ -15,19 +15,17 @@ This is no big issue for pure http boot, since its going to execute an untrusted kernel anyway, but it will break trusted boot scenarios, where only signed code is allowed to be executed. -v2: Fix GCC 13 build failure (bsc#1201089) - Signed-off-by: Michael Chang --- grub-core/net/efi/net.c | 4 +++- - grub-core/net/http.c | 3 +++ - 2 files changed, 6 insertions(+), 1 deletion(-) + grub-core/net/http.c | 8 +++++++- + 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c -index a7845e2eb..ebc68484a 100644 +index 1a19ee27144..ed04f05ad21 100644 --- a/grub-core/net/efi/net.c +++ b/grub-core/net/efi/net.c -@@ -654,8 +654,10 @@ grub_efihttp_chunk_read (grub_file_t file, char *buf, +@@ -645,8 +645,10 @@ grub_efihttp_chunk_read (grub_file_t file, char *buf, rd = efi_net_interface (read, file, chunk, sz); @@ -40,18 +38,23 @@ index a7845e2eb..ebc68484a 100644 if (buf) { diff --git a/grub-core/net/http.c b/grub-core/net/http.c -index f389bf03d..686949c17 100644 +index f389bf03d96..af486198399 100644 --- a/grub-core/net/http.c +++ b/grub-core/net/http.c -@@ -30,6 +30,7 @@ +@@ -29,7 +29,11 @@ + GRUB_MOD_LICENSE ("GPLv3+"); - #define HTTP_PORT ((grub_uint16_t) 80) -+#define HTTP_MAX_CHUNK_SIZE GRUB_INT_MAX +-#define HTTP_PORT ((grub_uint16_t) 80) ++enum ++ { ++ HTTP_PORT = 80, ++ HTTP_MAX_CHUNK_SIZE = 0x80000000 ++ }; typedef struct http_data { -@@ -82,6 +83,8 @@ parse_line (grub_file_t file, http_data_t data, char *ptr, grub_size_t len) +@@ -82,6 +86,8 @@ parse_line (grub_file_t file, http_data_t data, char *ptr, grub_size_t len) if (data->in_chunk_len == 2) { data->chunk_rem = grub_strtoul (ptr, 0, 16); @@ -60,6 +63,3 @@ index f389bf03d..686949c17 100644 grub_errno = GRUB_ERR_NONE; if (data->chunk_rem == 0) { --- -2.41.0 - diff --git a/0072-Unify-the-check-to-enable-btrfs-relative-path.patch b/0072-Unify-the-check-to-enable-btrfs-relative-path.patch deleted file mode 100644 index a29a679..0000000 --- a/0072-Unify-the-check-to-enable-btrfs-relative-path.patch +++ /dev/null @@ -1,156 +0,0 @@ -From 63c084af27f253d0ebf49e2d6a8224fb691f2efe Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Sat, 22 Aug 2020 02:32:43 +0800 -Subject: [PATCH 072/272] Unify the check to enable btrfs relative path - -This unified the test in grub-install and grub-mkconfig that the path to -default or selected btrfs subvolume/snapshot is used if the root file -system is btrfs and the config has enabled btrfs snapshot booting. - -Signed-off-by: Michael Chang ---- - util/grub-install.c | 67 +++++++++++++++++++++++++++------------ - util/grub-mkconfig_lib.in | 3 +- - 2 files changed, 48 insertions(+), 22 deletions(-) - -diff --git a/util/grub-install.c b/util/grub-install.c -index 828365580..bc107c654 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -875,6 +875,7 @@ main (int argc, char *argv[]) - const char *efi_file = NULL; - char **grub_devices; - grub_fs_t grub_fs; -+ grub_fs_t root_fs; - grub_device_t grub_dev = NULL; - enum grub_install_plat platform; - char *grubdir, *device_map; -@@ -887,6 +888,8 @@ main (int argc, char *argv[]) - int efidir_is_mac = 0; - int is_prep = 0; - const char *pkgdatadir; -+ char *rootdir_path; -+ char **rootdir_devices; - - grub_util_host_init (&argc, &argv); - product_version = xstrdup (PACKAGE_VERSION); -@@ -900,9 +903,6 @@ main (int argc, char *argv[]) - - grub_util_load_config (&config); - -- if (config.is_suse_btrfs_snapshot_enabled) -- use_relative_path_on_btrfs = 1; -- - if (!bootloader_id && config.grub_distributor) - { - char *ptr; -@@ -1051,6 +1051,45 @@ main (int argc, char *argv[]) - grub_hostfs_init (); - grub_host_init (); - -+ { -+ char *rootdir_grub_devname; -+ grub_device_t rootdir_grub_dev; -+ char *t = grub_util_path_concat (2, "/", rootdir); -+ -+ rootdir_path = grub_canonicalize_file_name (t); -+ if (!rootdir_path) -+ grub_util_error (_("failed to get canonical path of `%s'"), t); -+ -+ rootdir_devices = grub_guess_root_devices (rootdir_path); -+ if (!rootdir_devices || !rootdir_devices[0]) -+ grub_util_error (_("cannot find a device for %s (is /dev mounted?)"), -+ rootdir_path); -+ -+ for (curdev = rootdir_devices; *curdev; curdev++) -+ grub_util_pull_device (*curdev); -+ -+ rootdir_grub_devname = grub_util_get_grub_dev (rootdir_devices[0]); -+ if (!rootdir_grub_devname) -+ grub_util_error (_("cannot find a GRUB drive for %s. Check your device.map"), -+ rootdir_devices[0]); -+ -+ rootdir_grub_dev = grub_device_open (rootdir_grub_devname); -+ if (! rootdir_grub_dev) -+ grub_util_error ("%s", grub_errmsg); -+ -+ root_fs = grub_fs_probe (rootdir_grub_dev); -+ if (!root_fs) -+ grub_util_error ("%s", grub_errmsg); -+ -+ if (config.is_suse_btrfs_snapshot_enabled -+ && grub_strncmp(root_fs->name, "btrfs", sizeof ("btrfs") - 1) == 0) -+ use_relative_path_on_btrfs = 1; -+ -+ free (t); -+ free (rootdir_grub_devname); -+ grub_device_close (rootdir_grub_dev); -+ } -+ - switch (platform) - { - case GRUB_INSTALL_PLATFORM_I386_EFI: -@@ -1451,8 +1490,7 @@ main (int argc, char *argv[]) - debug_image); - } - -- if (config.is_suse_btrfs_snapshot_enabled -- && grub_strncmp(grub_fs->name, "btrfs", sizeof ("btrfs") - 1) == 0) -+ if (use_relative_path_on_btrfs) - { - if (!load_cfg_f) - load_cfg_f = grub_util_fopen (load_cfg, "wb"); -@@ -1642,21 +1680,13 @@ main (int argc, char *argv[]) - - #ifdef __linux__ - -- if (config.is_suse_btrfs_snapshot_enabled -- && grub_strncmp(grub_fs->name, "btrfs", sizeof ("btrfs") - 1) == 0) -+ if (use_relative_path_on_btrfs) - { - char *subvol = NULL; - char *mount_path = NULL; -- char **rootdir_devices = NULL; -- char *t = grub_util_path_concat (2, "/", rootdir); -- char *rootdir_path = grub_canonicalize_file_name (t); -- -- if (rootdir_path && grub_util_is_directory (rootdir_path)) -- rootdir_devices = grub_guess_root_devices (rootdir_path); - -- if (rootdir_devices && rootdir_devices[0]) -- if (grub_strcmp (rootdir_devices[0], grub_devices[0]) == 0) -- subvol = grub_util_get_btrfs_subvol (platdir, &mount_path); -+ if (grub_strcmp (rootdir_devices[0], grub_devices[0]) == 0) -+ subvol = grub_util_get_btrfs_subvol (platdir, &mount_path); - - if (subvol && mount_path) - { -@@ -1681,11 +1711,6 @@ main (int argc, char *argv[]) - } - } - -- free (t); -- free (rootdir_path); -- for (curdev = rootdir_devices; *curdev; curdev++) -- free (*curdev); -- free (rootdir_devices); - free (subvol); - free (mount_path); - } -diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in -index 50e64c941..9a0bff7be 100644 ---- a/util/grub-mkconfig_lib.in -+++ b/util/grub-mkconfig_lib.in -@@ -49,7 +49,8 @@ grub_warn () - - make_system_path_relative_to_its_root () - { -- if [ "x${SUSE_BTRFS_SNAPSHOT_BOOTING}" = "xtrue" ] ; then -+ if [ "x${SUSE_BTRFS_SNAPSHOT_BOOTING}" = "xtrue" ] && -+ [ "x${GRUB_FS}" = "xbtrfs" ] ; then - "${grub_mkrelpath}" -r "$1" - else - "${grub_mkrelpath}" "$1" --- -2.41.0 - diff --git a/0212-grub-editenv-Add-incr-command-to-increment-integer-v.patch b/0072-grub-editenv-Add-incr-command-to-increment-integer-v.patch similarity index 81% rename from 0212-grub-editenv-Add-incr-command-to-increment-integer-v.patch rename to 0072-grub-editenv-Add-incr-command-to-increment-integer-v.patch index eb147f8..f8de42a 100644 --- a/0212-grub-editenv-Add-incr-command-to-increment-integer-v.patch +++ b/0072-grub-editenv-Add-incr-command-to-increment-integer-v.patch @@ -1,8 +1,8 @@ -From 59d911dc0086044dd2eb45dc1a5175b7600414a8 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Mon, 4 Jun 2018 19:49:47 +0200 -Subject: [PATCH 212/272] grub-editenv: Add "incr" command to increment integer - value env. variables +Subject: [PATCH] grub-editenv: Add "incr" command to increment integer value + env. variables To be able to automatically detect if the last boot was successful, We want to keep count of succesful / failed boots in some integer @@ -13,14 +13,14 @@ integer value env. variables by 1 for use from various boot scripts. Signed-off-by: Hans de Goede --- - util/grub-editenv.c | 49 +++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 49 insertions(+) + util/grub-editenv.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index af30aabe7..7fb599cd3 100644 +index db6f187cc63..948eec8a114 100644 --- a/util/grub-editenv.c +++ b/util/grub-editenv.c -@@ -56,6 +56,9 @@ static struct argp_option options[] = { +@@ -53,6 +53,9 @@ static struct argp_option options[] = { /* TRANSLATORS: "unset" is a keyword. It's a summary of "unset" subcommand. */ {N_("unset [NAME ...]"), 0, 0, OPTION_DOC|OPTION_NO_USAGE, N_("Delete variables."), 0}, @@ -30,10 +30,10 @@ index af30aabe7..7fb599cd3 100644 {0, 0, 0, OPTION_DOC, N_("Options:"), -1}, {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, -@@ -576,6 +579,50 @@ probe_fs_envblk (fs_envblk_spec_t spec) - - return NULL; +@@ -253,6 +256,51 @@ unset_variables (const char *name, int argc, char *argv[]) + grub_envblk_close (envblk); } + +struct get_int_value_params { + char *varname; + int value; @@ -78,10 +78,11 @@ index af30aabe7..7fb599cd3 100644 + write_envblk (name, envblk); + grub_envblk_close (envblk); +} - - ++ int -@@ -620,6 +667,8 @@ main (int argc, char *argv[]) + main (int argc, char *argv[]) + { +@@ -292,6 +340,8 @@ main (int argc, char *argv[]) set_variables (filename, argc - curindex, argv + curindex); else if (strcmp (command, "unset") == 0) unset_variables (filename, argc - curindex, argv + curindex); @@ -90,6 +91,3 @@ index af30aabe7..7fb599cd3 100644 else { char *program = xstrdup(program_name); --- -2.41.0 - diff --git a/0213-Add-auto-hide-menu-support.patch b/0073-Add-auto-hide-menu-support.patch similarity index 86% rename from 0213-Add-auto-hide-menu-support.patch rename to 0073-Add-auto-hide-menu-support.patch index 964d159..5b9a0d7 100644 --- a/0213-Add-auto-hide-menu-support.patch +++ b/0073-Add-auto-hide-menu-support.patch @@ -1,7 +1,7 @@ -From 6201d8239a711358ccf77c775517f139675c5473 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 6 Jun 2018 08:44:11 +0200 -Subject: [PATCH 213/272] Add auto-hide menu support +Subject: [PATCH] Add auto-hide menu support On single-os systems we do not want to show the menu, unless something went wrong with the previous boot, in which case the user may need the @@ -36,14 +36,14 @@ https://git.launchpad.net/~ubuntu-core-dev/grub/+git/ubuntu/tree/debian/patches/ Signed-off-by: Hans de Goede --- - Makefile.util.def | 6 ++++ - util/grub.d/01_menu_auto_hide.in | 48 ++++++++++++++++++++++++++++++++ - util/grub.d/30_os-prober.in | 19 ++++++++++++- - 3 files changed, 72 insertions(+), 1 deletion(-) + Makefile.util.def | 6 +++++ + util/grub.d/01_menu_auto_hide.in | 48 ++++++++++++++++++++++++++++++++++++++++ + util/grub.d/30_os-prober.in | 18 +++++++++++++++ + 3 files changed, 72 insertions(+) create mode 100644 util/grub.d/01_menu_auto_hide.in diff --git a/Makefile.util.def b/Makefile.util.def -index cb1a437e8..442fbf5ee 100644 +index 1079add5bbe..5b9f85d4869 100644 --- a/Makefile.util.def +++ b/Makefile.util.def @@ -461,6 +461,12 @@ script = { @@ -61,7 +61,7 @@ index cb1a437e8..442fbf5ee 100644 common = util/grub.d/01_users.in; diff --git a/util/grub.d/01_menu_auto_hide.in b/util/grub.d/01_menu_auto_hide.in new file mode 100644 -index 000000000..ad175870a +index 00000000000..ad175870a54 --- /dev/null +++ b/util/grub.d/01_menu_auto_hide.in @@ -0,0 +1,48 @@ @@ -114,18 +114,18 @@ index 000000000..ad175870a +fi +EOF diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in -index 222109049..2b6713667 100644 +index d7d423b2eaf..18fe02cefd8 100644 --- a/util/grub.d/30_os-prober.in +++ b/util/grub.d/30_os-prober.in -@@ -52,6 +52,7 @@ osx_entry() { - # TRANSLATORS: it refers to kernel architecture (64-bit) - bitstr="$(gettext "(64-bit)")" - fi +@@ -42,6 +42,7 @@ if [ -z "${OSPROBED}" ] ; then + fi + + osx_entry() { + found_other_os=1 # TRANSLATORS: it refers on the OS residing on device %s onstr="$(gettext_printf "(on %s)" "${DEVICE}")" - cat << EOF -@@ -152,6 +153,7 @@ for OS in ${OSPROBED} ; do + hints="" +@@ -106,6 +107,7 @@ for OS in ${OSPROBED} ; do case ${BOOT} in chain) @@ -133,7 +133,7 @@ index 222109049..2b6713667 100644 onstr="$(gettext_printf "(on %s)" "${DEVICE}")" cat << EOF -@@ -182,6 +184,7 @@ EOF +@@ -136,6 +138,7 @@ EOF EOF ;; efi) @@ -141,24 +141,23 @@ index 222109049..2b6713667 100644 EFIPATH=${DEVICE#*@} DEVICE=${DEVICE%@*} -@@ -225,7 +228,7 @@ EOF - LKERNEL="${LKERNEL#/boot}" - LINITRD="$(echo $LINITRD | sed -e 's!^/boot!!' -e 's!\(\s\)/boot!\1!g')" +@@ -180,6 +183,7 @@ EOF + LINITRD="${LINITRD#/boot}" fi -- -+ found_other_os=1 + ++ found_other_os=1 onstr="$(gettext_printf "(on %s)" "${DEVICE}")" recovery_params="$(echo "${LPARAMS}" | grep single)" || true counter=1 -@@ -306,6 +309,7 @@ EOF - fi +@@ -261,6 +265,7 @@ EOF + done ;; hurd) + found_other_os=1 onstr="$(gettext_printf "(on %s)" "${DEVICE}")" cat << EOF menuentry '$(echo "${LONGNAME} $onstr" | grub_quote)' --class hurd --class gnu --class os \$menuentry_id_option 'osprober-gnuhurd-/boot/gnumach.gz-false-$(grub_get_device_id "${DEVICE}")' { -@@ -332,6 +336,7 @@ EOF +@@ -287,6 +292,7 @@ EOF EOF ;; minix) @@ -166,7 +165,7 @@ index 222109049..2b6713667 100644 cat << EOF menuentry "${LONGNAME} (on ${DEVICE}, Multiboot)" { EOF -@@ -348,3 +353,15 @@ EOF +@@ -303,3 +309,15 @@ EOF ;; esac done @@ -182,6 +181,3 @@ index 222109049..2b6713667 100644 +fi +EOF +fi --- -2.41.0 - diff --git a/0073-efi-linux-provide-linux-command.patch b/0073-efi-linux-provide-linux-command.patch deleted file mode 100644 index d180c17..0000000 --- a/0073-efi-linux-provide-linux-command.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 6358e3fb0068ff452c1880d2a7fcfd6bf3d8823c Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 7 Sep 2020 17:02:57 +0800 -Subject: [PATCH 073/272] efi/linux: provide linux command - -The linux kernel's efi handover entry point is used to boot efistub of -the linux kernel. Since then the efistub has been improved with many new -features and fixes that ordinary 32-bit entry point cannot provide. - -Besides, nearly every x86 efi kernel is built with efistub enabled so it -is of little value to keep 32-bit entry as default to boot kernel -without needed kconfig options enabled. - -For all good reasons, making efi handover the default entry point for -booting kernel in x86 efi platform so that linux command works in the -same way to linuxefi. This can also reduce the complexity of providing -general grub configuation for x86 system due to the linux command may -not be available in signed image for UEFI Secure Boot and linuxefi is -not available for leagcy bios booting. - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 8 ++++---- - grub-core/gensyminfo.sh.in | 3 +++ - grub-core/loader/i386/efi/linux.c | 17 +++++++++++++---- - 3 files changed, 20 insertions(+), 8 deletions(-) - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index bc7459ed3..c67092280 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -1838,7 +1838,9 @@ module = { - - module = { - name = linux; -- x86 = loader/i386/linux.c; -+ i386_pc = loader/i386/linux.c; -+ i386_efi = loader/i386/efi/linux.c; -+ x86_64_efi = loader/i386/efi/linux.c; - i386_xen_pvh = loader/i386/linux.c; - xen = loader/i386/xen.c; - i386_pc = lib/i386/pc/vesa_modes_table.c; -@@ -1854,8 +1856,6 @@ module = { - loongarch64 = loader/efi/linux.c; - riscv32 = loader/efi/linux.c; - riscv64 = loader/efi/linux.c; -- i386_efi = loader/efi/linux.c; -- x86_64_efi = loader/efi/linux.c; - emu = loader/emu/linux.c; - common = loader/linux.c; - }; -@@ -1920,7 +1920,7 @@ module = { - - module = { - name = linuxefi; -- efi = loader/i386/efi/linux.c; -+ efi = lib/fake_module.c; - enable = i386_efi; - enable = x86_64_efi; - }; -diff --git a/grub-core/gensyminfo.sh.in b/grub-core/gensyminfo.sh.in -index 9bc767532..098de9258 100644 ---- a/grub-core/gensyminfo.sh.in -+++ b/grub-core/gensyminfo.sh.in -@@ -35,3 +35,6 @@ fi - - # Print all undefined symbols used by module - @TARGET_NM@ -u @TARGET_NMFLAGS_MINUS_P@ -p $module | sed "s@^\([^ ]*\).*@undefined $modname \1@g" -+ -+# Specify linuxefi module should load default linux -+test "$modname" = "linuxefi" && echo "undefined $modname grub_initrd_init" || true -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 6bb9c484f..355ecc9b9 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -333,20 +333,29 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - } - - static grub_command_t cmd_linux, cmd_initrd; -+static grub_command_t cmd_linuxefi, cmd_initrdefi; - --GRUB_MOD_INIT(linuxefi) -+GRUB_MOD_INIT(linux) - { -- cmd_linux = -+ cmd_linuxefi = - grub_register_command ("linuxefi", grub_cmd_linux, - 0, N_("Load Linux.")); -- cmd_initrd = -+ cmd_initrdefi = - grub_register_command ("initrdefi", grub_cmd_initrd, - 0, N_("Load initrd.")); -+ cmd_linux = -+ grub_register_command ("linux", grub_cmd_linux, -+ 0, N_("Load Linux.")); -+ cmd_initrd = -+ grub_register_command ("initrd", grub_cmd_initrd, -+ 0, N_("Load initrd.")); - my_mod = mod; - } - --GRUB_MOD_FINI(linuxefi) -+GRUB_MOD_FINI(linux) - { -+ grub_unregister_command (cmd_linuxefi); -+ grub_unregister_command (cmd_initrdefi); - grub_unregister_command (cmd_linux); - grub_unregister_command (cmd_initrd); - } --- -2.41.0 - diff --git a/0214-Add-grub-set-bootflag-utility.patch b/0074-Add-grub-set-bootflag-utility.patch similarity index 95% rename from 0214-Add-grub-set-bootflag-utility.patch rename to 0074-Add-grub-set-bootflag-utility.patch index 04e85dc..f6dc731 100644 --- a/0214-Add-grub-set-bootflag-utility.patch +++ b/0074-Add-grub-set-bootflag-utility.patch @@ -1,7 +1,7 @@ -From 0e2b75f3b955461633f0c9971610d25ddfad0174 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 12 Jun 2018 13:25:16 +0200 -Subject: [PATCH 214/272] Add grub-set-bootflag utility +Subject: [PATCH] Add grub-set-bootflag utility This commit adds a new grub-set-bootflag utility, which can be used to set known bootflags in the grubenv: boot_success or menu_show_once. @@ -37,22 +37,22 @@ Signed-off-by: Gena Makhomed Signed-off-by: Robbie Harwood --- Makefile.util.def | 7 ++ + util/grub-set-bootflag.c | 172 +++++++++++++++++++++++++++++++++++++++++ conf/Makefile.extra-dist | 3 + docs/grub-boot-success.service | 6 ++ docs/grub-boot-success.timer | 7 ++ docs/man/grub-set-bootflag.h2m | 2 + - util/grub-set-bootflag.c | 172 +++++++++++++++++++++++++++++++++ 6 files changed, 197 insertions(+) + create mode 100644 util/grub-set-bootflag.c create mode 100644 docs/grub-boot-success.service create mode 100644 docs/grub-boot-success.timer create mode 100644 docs/man/grub-set-bootflag.h2m - create mode 100644 util/grub-set-bootflag.c diff --git a/Makefile.util.def b/Makefile.util.def -index 442fbf5ee..7837701aa 100644 +index 5b9f85d4869..01096ded815 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -1493,3 +1493,10 @@ program = { +@@ -1468,3 +1468,10 @@ program = { ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; }; @@ -63,56 +63,9 @@ index 442fbf5ee..7837701aa 100644 + mansection = 1; + common = util/grub-set-bootflag.c; +}; -diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist -index 5e7126f98..26ac8765e 100644 ---- a/conf/Makefile.extra-dist -+++ b/conf/Makefile.extra-dist -@@ -15,6 +15,9 @@ EXTRA_DIST += docs/man - EXTRA_DIST += docs/autoiso.cfg - EXTRA_DIST += docs/grub.cfg - EXTRA_DIST += docs/osdetect.cfg -+EXTRA_DIST += docs/org.gnu.grub.policy -+EXTRA_DIST += docs/grub-boot-success.service -+EXTRA_DIST += docs/grub-boot-success.timer - - EXTRA_DIST += conf/i386-cygwin-img-ld.sc - -diff --git a/docs/grub-boot-success.service b/docs/grub-boot-success.service -new file mode 100644 -index 000000000..80e79584c ---- /dev/null -+++ b/docs/grub-boot-success.service -@@ -0,0 +1,6 @@ -+[Unit] -+Description=Mark boot as successful -+ -+[Service] -+Type=oneshot -+ExecStart=/usr/sbin/grub2-set-bootflag boot_success -diff --git a/docs/grub-boot-success.timer b/docs/grub-boot-success.timer -new file mode 100644 -index 000000000..406f17200 ---- /dev/null -+++ b/docs/grub-boot-success.timer -@@ -0,0 +1,7 @@ -+[Unit] -+Description=Mark boot as successful after the user session has run 2 minutes -+ConditionUser=!@system -+ConditionVirtualization=!container -+ -+[Timer] -+OnActiveSec=2min -diff --git a/docs/man/grub-set-bootflag.h2m b/docs/man/grub-set-bootflag.h2m -new file mode 100644 -index 000000000..94ec0b92e ---- /dev/null -+++ b/docs/man/grub-set-bootflag.h2m -@@ -0,0 +1,2 @@ -+[NAME] -+grub-set-bootflag \- set a bootflag in the GRUB environment block diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c new file mode 100644 -index 000000000..d506f7e75 +index 00000000000..d506f7e75bc --- /dev/null +++ b/util/grub-set-bootflag.c @@ -0,0 +1,172 @@ @@ -288,6 +241,50 @@ index 000000000..d506f7e75 + + return 0; +} --- -2.41.0 - +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index 5e7126f9878..26ac8765e30 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -15,6 +15,9 @@ EXTRA_DIST += docs/man + EXTRA_DIST += docs/autoiso.cfg + EXTRA_DIST += docs/grub.cfg + EXTRA_DIST += docs/osdetect.cfg ++EXTRA_DIST += docs/org.gnu.grub.policy ++EXTRA_DIST += docs/grub-boot-success.service ++EXTRA_DIST += docs/grub-boot-success.timer + + EXTRA_DIST += conf/i386-cygwin-img-ld.sc + +diff --git a/docs/grub-boot-success.service b/docs/grub-boot-success.service +new file mode 100644 +index 00000000000..80e79584c91 +--- /dev/null ++++ b/docs/grub-boot-success.service +@@ -0,0 +1,6 @@ ++[Unit] ++Description=Mark boot as successful ++ ++[Service] ++Type=oneshot ++ExecStart=/usr/sbin/grub2-set-bootflag boot_success +diff --git a/docs/grub-boot-success.timer b/docs/grub-boot-success.timer +new file mode 100644 +index 00000000000..406f1720056 +--- /dev/null ++++ b/docs/grub-boot-success.timer +@@ -0,0 +1,7 @@ ++[Unit] ++Description=Mark boot as successful after the user session has run 2 minutes ++ConditionUser=!@system ++ConditionVirtualization=!container ++ ++[Timer] ++OnActiveSec=2min +diff --git a/docs/man/grub-set-bootflag.h2m b/docs/man/grub-set-bootflag.h2m +new file mode 100644 +index 00000000000..94ec0b92ede +--- /dev/null ++++ b/docs/man/grub-set-bootflag.h2m +@@ -0,0 +1,2 @@ ++[NAME] ++grub-set-bootflag \- set a bootflag in the GRUB environment block diff --git a/0074-Add-support-for-Linux-EFI-stub-loading-on-aarch64.patch b/0074-Add-support-for-Linux-EFI-stub-loading-on-aarch64.patch deleted file mode 100644 index cd5dcef..0000000 --- a/0074-Add-support-for-Linux-EFI-stub-loading-on-aarch64.patch +++ /dev/null @@ -1,539 +0,0 @@ -From 09f50ee0684eabb55bce4caa0e677f0619c7baa6 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Fri, 6 Nov 2020 08:36:36 +0000 -Subject: [PATCH 074/272] Add support for Linux EFI stub loading on aarch64. - -Add support for Linux EFI stub loading on aarch64. - -v1: -Make efi handoff the default loader for arm64 platform. - -v2: -The efi shim_lock verifier has been moved to grub core so local -shim_lock protocol is no longer needed here for aarch64 efi to verify -the loaded kernel image. From now on the framework will take care the -verificaion, consolidating the integration of various security verifiers -like secure boot, gpg and tpm. ---- - grub-core/Makefile.core.def | 4 +- - grub-core/loader/arm64/efi/linux.c | 411 +++++++++++++++++++++++++++++ - include/grub/arm/linux.h | 12 + - include/grub/arm64/linux.h | 39 +++ - 4 files changed, 464 insertions(+), 2 deletions(-) - create mode 100644 grub-core/loader/arm64/efi/linux.c - create mode 100644 include/grub/arm64/linux.h - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index c67092280..bdecd23f1 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -1852,7 +1852,7 @@ module = { - arm_coreboot = loader/arm/linux.c; - arm_efi = loader/efi/linux.c; - arm_uboot = loader/arm/linux.c; -- arm64 = loader/efi/linux.c; -+ arm64 = loader/arm64/efi/linux.c; - loongarch64 = loader/efi/linux.c; - riscv32 = loader/efi/linux.c; - riscv64 = loader/efi/linux.c; -@@ -1920,7 +1920,7 @@ module = { - - module = { - name = linuxefi; -- efi = lib/fake_module.c; -+ x86 = lib/fake_module.c; - enable = i386_efi; - enable = x86_64_efi; - }; -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -new file mode 100644 -index 000000000..d569bcceb ---- /dev/null -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -0,0 +1,411 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); -+ -+static grub_dl_t my_mod; -+static int loaded; -+ -+static void *kernel_addr; -+static grub_uint64_t kernel_size; -+static grub_uint32_t handover_offset; -+ -+static char *linux_args; -+static grub_uint32_t cmdline_size; -+ -+static grub_addr_t initrd_start; -+static grub_addr_t initrd_end; -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wcast-align" -+ -+typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); -+ -+static grub_err_t -+grub_efi_linux_boot (void *kernel_address, grub_off_t offset, -+ void *kernel_params) -+{ -+ handover_func hf; -+ -+ hf = (handover_func)((char *)kernel_address + offset); -+ hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); -+ -+ return GRUB_ERR_BUG; -+} -+ -+#pragma GCC diagnostic pop -+ -+static grub_err_t -+grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh) -+{ -+ if (lh->magic != GRUB_LINUX_ARMXX_MAGIC_SIGNATURE) -+ return grub_error(GRUB_ERR_BAD_OS, "invalid magic number"); -+ -+ if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC) -+ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled")); -+ -+ grub_dprintf ("linux", "UEFI stub kernel:\n"); -+ grub_dprintf ("linux", "PE/COFF header @ %08x\n", lh->hdr_offset); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+finalize_params_linux (void) -+{ -+ grub_efi_loaded_image_t *loaded_image = NULL; -+ int node, retval, len; -+ -+ void *fdt; -+ -+ fdt = grub_fdt_load (GRUB_EFI_LINUX_FDT_EXTRA_SPACE); -+ -+ if (!fdt) -+ goto failure; -+ -+ node = grub_fdt_find_subnode (fdt, 0, "chosen"); -+ if (node < 0) -+ node = grub_fdt_add_subnode (fdt, 0, "chosen"); -+ -+ if (node < 1) -+ goto failure; -+ -+ /* Set initrd info */ -+ if (initrd_start && initrd_end > initrd_start) -+ { -+ grub_dprintf ("linux", "Initrd @ %p-%p\n", -+ (void *) initrd_start, (void *) initrd_end); -+ -+ retval = grub_fdt_set_prop64 (fdt, node, "linux,initrd-start", -+ initrd_start); -+ if (retval) -+ goto failure; -+ retval = grub_fdt_set_prop64 (fdt, node, "linux,initrd-end", -+ initrd_end); -+ if (retval) -+ goto failure; -+ } -+ -+ if (grub_fdt_install() != GRUB_ERR_NONE) -+ goto failure; -+ -+ grub_dprintf ("linux", "Installed/updated FDT configuration table @ %p\n", -+ fdt); -+ -+ /* Convert command line to UCS-2 */ -+ loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); -+ if (!loaded_image) -+ goto failure; -+ -+ loaded_image->load_options_size = len = -+ (grub_strlen (linux_args) + 1) * sizeof (grub_efi_char16_t); -+ loaded_image->load_options = -+ grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); -+ if (!loaded_image->load_options) -+ return grub_error(GRUB_ERR_BAD_OS, "failed to create kernel parameters"); -+ -+ loaded_image->load_options_size = -+ 2 * grub_utf8_to_utf16 (loaded_image->load_options, len, -+ (grub_uint8_t *) linux_args, len, NULL); -+ -+ return GRUB_ERR_NONE; -+ -+failure: -+ grub_fdt_unload(); -+ return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT"); -+} -+ -+static void -+free_params (void) -+{ -+ grub_efi_loaded_image_t *loaded_image = NULL; -+ -+ loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); -+ if (loaded_image) -+ { -+ if (loaded_image->load_options) -+ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_efi_uintn_t)loaded_image->load_options, -+ GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); -+ loaded_image->load_options = NULL; -+ loaded_image->load_options_size = 0; -+ } -+} -+ -+grub_err_t -+grub_arch_efi_linux_boot_image (grub_addr_t addr, -+ grub_size_t size __attribute__ ((unused)), -+ char *args) -+{ -+ grub_err_t retval; -+ -+ retval = finalize_params_linux (); -+ if (retval != GRUB_ERR_NONE) -+ return grub_errno; -+ -+ grub_dprintf ("linux", "linux command line: '%s'\n", args); -+ -+ retval = grub_efi_linux_boot ((char *)addr, handover_offset, (void *)addr); -+ -+ /* Never reached... */ -+ free_params(); -+ return retval; -+} -+ -+static grub_err_t -+grub_linux_boot (void) -+{ -+ return (grub_arch_efi_linux_boot_image ((grub_addr_t)kernel_addr, kernel_size, linux_args)); -+} -+ -+static grub_err_t -+grub_linux_unload (void) -+{ -+ grub_dl_unref (my_mod); -+ loaded = 0; -+ if (initrd_start) -+ grub_efi_free_pages ((grub_efi_physical_address_t) initrd_start, -+ GRUB_EFI_BYTES_TO_PAGES (initrd_end - initrd_start)); -+ initrd_start = initrd_end = 0; -+ grub_free (linux_args); -+ if (kernel_addr) -+ grub_efi_free_pages ((grub_addr_t) kernel_addr, -+ GRUB_EFI_BYTES_TO_PAGES (kernel_size)); -+ grub_fdt_unload (); -+ return GRUB_ERR_NONE; -+} -+ -+/* -+ * As per linux/Documentation/arm/Booting -+ * ARM initrd needs to be covered by kernel linear mapping, -+ * so place it in the first 512MB of DRAM. -+ * -+ * As per linux/Documentation/arm64/booting.txt -+ * ARM64 initrd needs to be contained entirely within a 1GB aligned window -+ * of up to 32GB of size that covers the kernel image as well. -+ * Since the EFI stub loader will attempt to load the kernel near start of -+ * RAM, place the buffer in the first 32GB of RAM. -+ */ -+#ifdef __arm__ -+#define INITRD_MAX_ADDRESS_OFFSET (512U * 1024 * 1024) -+#else /* __aarch64__ */ -+#define INITRD_MAX_ADDRESS_OFFSET (32ULL * 1024 * 1024 * 1024) -+#endif -+ -+/* -+ * This function returns a pointer to a legally allocated initrd buffer, -+ * or NULL if unsuccessful -+ */ -+static void * -+allocate_initrd_mem (int initrd_pages) -+{ -+ grub_addr_t max_addr; -+ -+ if (grub_efi_get_ram_base (&max_addr) != GRUB_ERR_NONE) -+ return NULL; -+ -+ max_addr += INITRD_MAX_ADDRESS_OFFSET - 1; -+ -+ return grub_efi_allocate_pages_real (max_addr, initrd_pages, -+ GRUB_EFI_ALLOCATE_MAX_ADDRESS, -+ GRUB_EFI_LOADER_DATA); -+} -+ -+static grub_err_t -+grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char *argv[]) -+{ -+ struct grub_linux_initrd_context initrd_ctx = { 0, 0, 0 }; -+ int initrd_size, initrd_pages; -+ void *initrd_mem = NULL; -+ -+ if (argc == 0) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); -+ goto fail; -+ } -+ -+ if (!loaded) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("you need to load the kernel first")); -+ goto fail; -+ } -+ -+ if (grub_initrd_init (argc, argv, &initrd_ctx)) -+ goto fail; -+ -+ initrd_size = grub_get_initrd_size (&initrd_ctx); -+ grub_dprintf ("linux", "Loading initrd\n"); -+ -+ initrd_pages = (GRUB_EFI_BYTES_TO_PAGES (initrd_size)); -+ initrd_mem = allocate_initrd_mem (initrd_pages); -+ -+ if (!initrd_mem) -+ { -+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); -+ goto fail; -+ } -+ -+ if (grub_initrd_load (&initrd_ctx, initrd_mem)) -+ goto fail; -+ -+ initrd_start = (grub_addr_t) initrd_mem; -+ initrd_end = initrd_start + initrd_size; -+ grub_dprintf ("linux", "[addr=%p, size=0x%x]\n", -+ (void *) initrd_start, initrd_size); -+ -+ fail: -+ grub_initrd_close (&initrd_ctx); -+ if (initrd_mem && !initrd_start) -+ grub_efi_free_pages ((grub_addr_t) initrd_mem, initrd_pages); -+ -+ return grub_errno; -+} -+ -+static grub_err_t -+grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char *argv[]) -+{ -+ grub_file_t file = 0; -+ struct linux_arch_kernel_header lh; -+ struct grub_armxx_linux_pe_header *pe; -+ grub_err_t err; -+ -+ grub_dl_ref (my_mod); -+ -+ if (argc == 0) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); -+ goto fail; -+ } -+ -+ file = grub_file_open (argv[0], GRUB_FILE_TYPE_LINUX_KERNEL); -+ if (!file) -+ goto fail; -+ -+ kernel_size = grub_file_size (file); -+ -+ if (grub_file_read (file, &lh, sizeof (lh)) < (long) sizeof (lh)) -+ return grub_errno; -+ -+ if (grub_arch_efi_linux_check_image (&lh) != GRUB_ERR_NONE) -+ goto fail; -+ -+ grub_loader_unset(); -+ -+ grub_dprintf ("linux", "kernel file size: %lld\n", (long long) kernel_size); -+ kernel_addr = grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (kernel_size)); -+ grub_dprintf ("linux", "kernel numpages: %lld\n", -+ (long long) GRUB_EFI_BYTES_TO_PAGES (kernel_size)); -+ if (!kernel_addr) -+ { -+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); -+ goto fail; -+ } -+ -+ grub_file_seek (file, 0); -+ if (grub_file_read (file, kernel_addr, kernel_size) -+ < (grub_int64_t) kernel_size) -+ { -+ if (!grub_errno) -+ grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), argv[0]); -+ goto fail; -+ } -+ -+ grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); -+ -+ pe = (void *)((unsigned long)kernel_addr + lh.hdr_offset); -+ handover_offset = pe->opt.entry_addr; -+ -+ cmdline_size = grub_loader_cmdline_size (argc, argv) + sizeof (LINUX_IMAGE); -+ linux_args = grub_malloc (cmdline_size); -+ if (!linux_args) -+ { -+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); -+ goto fail; -+ } -+ grub_memcpy (linux_args, LINUX_IMAGE, sizeof (LINUX_IMAGE)); -+ err = grub_create_loader_cmdline (argc, argv, -+ linux_args + sizeof (LINUX_IMAGE) - 1, -+ cmdline_size, -+ GRUB_VERIFY_KERNEL_CMDLINE); -+ if (err) -+ goto fail; -+ -+ if (grub_errno == GRUB_ERR_NONE) -+ { -+ grub_loader_set (grub_linux_boot, grub_linux_unload, 0); -+ loaded = 1; -+ } -+ -+fail: -+ if (file) -+ grub_file_close (file); -+ -+ if (grub_errno != GRUB_ERR_NONE) -+ { -+ grub_dl_unref (my_mod); -+ loaded = 0; -+ } -+ -+ if (linux_args && !loaded) -+ grub_free (linux_args); -+ -+ if (kernel_addr && !loaded) -+ grub_efi_free_pages ((grub_addr_t) kernel_addr, -+ GRUB_EFI_BYTES_TO_PAGES (kernel_size)); -+ -+ return grub_errno; -+} -+ -+ -+static grub_command_t cmd_linux, cmd_initrd; -+ -+GRUB_MOD_INIT (linux) -+{ -+ cmd_linux = grub_register_command ("linux", grub_cmd_linux, 0, -+ N_("Load Linux.")); -+ cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd, 0, -+ N_("Load initrd.")); -+ my_mod = mod; -+} -+ -+GRUB_MOD_FINI (linux) -+{ -+ grub_unregister_command (cmd_linux); -+ grub_unregister_command (cmd_initrd); -+} -diff --git a/include/grub/arm/linux.h b/include/grub/arm/linux.h -index 5b8fb14e0..5c3d4e1a5 100644 ---- a/include/grub/arm/linux.h -+++ b/include/grub/arm/linux.h -@@ -20,10 +20,22 @@ - #ifndef GRUB_ARM_LINUX_HEADER - #define GRUB_ARM_LINUX_HEADER 1 - -+#include - #include "system.h" - - #include - -+struct grub_arm_linux_pe_header -+{ -+ grub_uint32_t magic; -+ struct grub_pe32_coff_header coff; -+ struct grub_pe32_optional_header opt; -+}; -+ -+#if defined(__arm__) -+# define grub_armxx_linux_pe_header grub_arm_linux_pe_header -+#endif -+ - #if defined GRUB_MACHINE_UBOOT - # include - # define LINUX_ADDRESS (start_of_ram + 0x8000) -diff --git a/include/grub/arm64/linux.h b/include/grub/arm64/linux.h -new file mode 100644 -index 000000000..d86e32906 ---- /dev/null -+++ b/include/grub/arm64/linux.h -@@ -0,0 +1,39 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_ARM64_LINUX_HEADER -+#define GRUB_ARM64_LINUX_HEADER 1 -+ -+#include -+#include -+ -+#define GRUB_LINUX_ARM64_MAGIC_SIGNATURE 0x644d5241 /* 'ARM\x64' */ -+ -+struct grub_arm64_linux_pe_header -+{ -+ grub_uint32_t magic; -+ struct grub_pe32_coff_header coff; -+ struct grub_pe64_optional_header opt; -+}; -+ -+#if defined(__aarch64__) -+# define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM64_MAGIC_SIGNATURE -+# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header -+#endif -+ -+#endif /* ! GRUB_ARM64_LINUX_HEADER */ --- -2.41.0 - diff --git a/0075-arm64-make-sure-fdt-has-address-cells-and-size-cells.patch b/0075-arm64-make-sure-fdt-has-address-cells-and-size-cells.patch deleted file mode 100644 index 5a1da9a..0000000 --- a/0075-arm64-make-sure-fdt-has-address-cells-and-size-cells.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 6af48db8cfdda7e86742a613e1a11e56e6cb0b16 Mon Sep 17 00:00:00 2001 -From: Mark Salter -Date: Mon, 17 Apr 2017 08:44:29 -0400 -Subject: [PATCH 075/272] arm64: make sure fdt has #address-cells and - #size-cells properties - -Recent upstream changes to kexec-tools relies on #address-cells -and #size-cells properties in the FDT. If grub2 needs to create -a chosen node, it is likely because firmware did not provide one. -In that case, set #address-cells and #size-cells properties to -make sure they exist. ---- - grub-core/loader/arm64/efi/linux.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index d569bcceb..a8cfeeea2 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -99,7 +99,21 @@ finalize_params_linux (void) - - node = grub_fdt_find_subnode (fdt, 0, "chosen"); - if (node < 0) -- node = grub_fdt_add_subnode (fdt, 0, "chosen"); -+ { -+ /* -+ * If we have to create a chosen node, Make sure we -+ * have #address-cells and #size-cells properties. -+ */ -+ retval = grub_fdt_set_prop32(fdt, 0, "#address-cells", 2); -+ if (retval) -+ goto failure; -+ -+ retval = grub_fdt_set_prop32(fdt, 0, "#size-cells", 2); -+ if (retval) -+ goto failure; -+ -+ node = grub_fdt_add_subnode (fdt, 0, "chosen"); -+ } - - if (node < 1) - goto failure; --- -2.41.0 - diff --git a/0215-docs-Add-grub-boot-indeterminate.service-example.patch b/0075-docs-Add-grub-boot-indeterminate.service-example.patch similarity index 83% rename from 0215-docs-Add-grub-boot-indeterminate.service-example.patch rename to 0075-docs-Add-grub-boot-indeterminate.service-example.patch index f45264f..44f6ad3 100644 --- a/0215-docs-Add-grub-boot-indeterminate.service-example.patch +++ b/0075-docs-Add-grub-boot-indeterminate.service-example.patch @@ -1,7 +1,7 @@ -From 78327d7e89ecc1fe92b68d88e5069d74498f4e48 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 19 Jun 2018 15:20:54 +0200 -Subject: [PATCH 215/272] docs: Add grub-boot-indeterminate.service example +Subject: [PATCH] docs: Add grub-boot-indeterminate.service example This is an example service file, for use from /lib/systemd/system/system-update.target.wants @@ -16,7 +16,7 @@ Signed-off-by: Hans de Goede diff --git a/docs/grub-boot-indeterminate.service b/docs/grub-boot-indeterminate.service new file mode 100644 -index 000000000..6c8dcb186 +index 00000000000..6c8dcb186b6 --- /dev/null +++ b/docs/grub-boot-indeterminate.service @@ -0,0 +1,11 @@ @@ -31,6 +31,3 @@ index 000000000..6c8dcb186 +[Service] +Type=oneshot +ExecStart=/usr/bin/grub2-editenv - incr boot_indeterminate --- -2.41.0 - diff --git a/0216-gentpl-add-disable-support.patch b/0076-gentpl-add-disable-support.patch similarity index 81% rename from 0216-gentpl-add-disable-support.patch rename to 0076-gentpl-add-disable-support.patch index baae776..949cfe8 100644 --- a/0216-gentpl-add-disable-support.patch +++ b/0076-gentpl-add-disable-support.patch @@ -1,7 +1,7 @@ -From ca904fd030bd0a935efbda6e99d20ff7de5baa59 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 11 Jul 2018 13:43:15 -0400 -Subject: [PATCH 216/272] gentpl: add 'disable = ' support +Subject: [PATCH] gentpl: add 'disable = ' support Signed-off-by: Peter Jones --- @@ -9,10 +9,10 @@ Signed-off-by: Peter Jones 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/gentpl.py b/gentpl.py -index fb9908c3a..9dd99599c 100644 +index bfab2113a1d..6cad9b8231f 100644 --- a/gentpl.py +++ b/gentpl.py -@@ -598,11 +598,21 @@ def platform_conditional(platform, closure): +@@ -594,11 +594,21 @@ def platform_conditional(platform, closure): # }; # def foreach_enabled_platform(defn, closure): @@ -35,7 +35,7 @@ index fb9908c3a..9dd99599c 100644 for platform in GRUB_PLATFORMS: platform_conditional(platform, closure) -@@ -661,6 +671,8 @@ def first_time(defn, snippet): +@@ -657,6 +667,8 @@ def first_time(defn, snippet): def is_platform_independent(defn): if 'enable' in defn: return False @@ -44,6 +44,3 @@ index fb9908c3a..9dd99599c 100644 for suffix in [ "", "_nodist" ]: template = platform_values(defn, GRUB_PLATFORMS[0], suffix) for platform in GRUB_PLATFORMS[1:]: --- -2.41.0 - diff --git a/0217-gentpl-add-pc-firmware-type.patch b/0077-gentpl-add-pc-firmware-type.patch similarity index 79% rename from 0217-gentpl-add-pc-firmware-type.patch rename to 0077-gentpl-add-pc-firmware-type.patch index 6dc0066..608582a 100644 --- a/0217-gentpl-add-pc-firmware-type.patch +++ b/0077-gentpl-add-pc-firmware-type.patch @@ -1,7 +1,7 @@ -From 70e02cb518258a5a70fcdd742c7e167b4704bfe9 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 11 Jul 2019 11:04:24 +0200 -Subject: [PATCH 217/272] gentpl: add 'pc' firmware type +Subject: [PATCH] gentpl: add 'pc' firmware type Signed-off-by: Peter Jones --- @@ -9,7 +9,7 @@ Signed-off-by: Peter Jones 1 file changed, 1 insertion(+) diff --git a/gentpl.py b/gentpl.py -index 9dd99599c..eec4f29f8 100644 +index 6cad9b8231f..597129a2bc4 100644 --- a/gentpl.py +++ b/gentpl.py @@ -52,6 +52,7 @@ GROUPS["riscv32"] = [ "riscv32_efi" ] @@ -20,6 +20,3 @@ index 9dd99599c..eec4f29f8 100644 GROUPS["efi"] = [ "i386_efi", "x86_64_efi", "ia64_efi", "arm_efi", "arm64_efi", "loongarch64_efi", "riscv32_efi", "riscv64_efi" ] GROUPS["ieee1275"] = [ "i386_ieee1275", "sparc64_ieee1275", "powerpc_ieee1275" ] --- -2.41.0 - diff --git a/0218-efinet-also-use-the-firmware-acceleration-for-http.patch b/0078-efinet-also-use-the-firmware-acceleration-for-http.patch similarity index 78% rename from 0218-efinet-also-use-the-firmware-acceleration-for-http.patch rename to 0078-efinet-also-use-the-firmware-acceleration-for-http.patch index 4380f21..8ce3e01 100644 --- a/0218-efinet-also-use-the-firmware-acceleration-for-http.patch +++ b/0078-efinet-also-use-the-firmware-acceleration-for-http.patch @@ -1,7 +1,7 @@ -From e486eea66b27cb492e95f1628c32bdf8c5592786 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 30 Jul 2018 14:06:42 -0400 -Subject: [PATCH 218/272] efinet: also use the firmware acceleration for http +Subject: [PATCH] efinet: also use the firmware acceleration for http Signed-off-by: Peter Jones --- @@ -9,10 +9,10 @@ Signed-off-by: Peter Jones 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c -index ebc68484a..b5b870c6f 100644 +index ed04f05ad21..1f7e1b63557 100644 --- a/grub-core/net/efi/net.c +++ b/grub-core/net/efi/net.c -@@ -1336,7 +1336,9 @@ grub_efi_net_boot_from_https (void) +@@ -1324,7 +1324,9 @@ grub_efi_net_boot_from_https (void) && (subtype == GRUB_EFI_URI_DEVICE_PATH_SUBTYPE)) { grub_efi_uri_device_path_t *uri_dp = (grub_efi_uri_device_path_t *) dp; @@ -23,6 +23,3 @@ index ebc68484a..b5b870c6f 100644 } if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp)) --- -2.41.0 - diff --git a/0219-efi-http-Make-root_url-reflect-the-protocol-hostname.patch b/0079-efi-http-Make-root_url-reflect-the-protocol-hostname.patch similarity index 80% rename from 0219-efi-http-Make-root_url-reflect-the-protocol-hostname.patch rename to 0079-efi-http-Make-root_url-reflect-the-protocol-hostname.patch index 4cecd8f..6f98f25 100644 --- a/0219-efi-http-Make-root_url-reflect-the-protocol-hostname.patch +++ b/0079-efi-http-Make-root_url-reflect-the-protocol-hostname.patch @@ -1,8 +1,8 @@ -From 6a6023148735e2ff05869448fe6eed08de1d91d1 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 30 Jul 2018 16:39:57 -0400 -Subject: [PATCH 219/272] efi/http: Make root_url reflect the protocol+hostname - of our boot url. +Subject: [PATCH] efi/http: Make root_url reflect the protocol+hostname of our + boot url. This lets you write config files that don't know urls. @@ -12,18 +12,18 @@ Signed-off-by: Peter Jones 1 file changed, 19 insertions(+) diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c -index 70affd8ed..9f860fc04 100644 +index de28badccb0..b94dbc68eef 100644 --- a/grub-core/net/efi/http.c +++ b/grub-core/net/efi/http.c -@@ -5,6 +5,7 @@ +@@ -4,6 +4,7 @@ + #include #include #include - #include +#include static void http_configure (struct grub_efi_net_device *dev, int prefer_ip6) -@@ -356,6 +357,24 @@ grub_efihttp_open (struct grub_efi_net_device *dev, +@@ -342,6 +343,24 @@ grub_efihttp_open (struct grub_efi_net_device *dev, grub_err_t err; grub_off_t size; char *buf; @@ -48,6 +48,3 @@ index 70affd8ed..9f860fc04 100644 err = efihttp_request (dev->http, file->device->net->server, file->device->net->name, type, 1, 0); if (err != GRUB_ERR_NONE) --- -2.41.0 - diff --git a/0079-squash-kern-Add-lockdown-support.patch b/0079-squash-kern-Add-lockdown-support.patch deleted file mode 100644 index e69fdff..0000000 --- a/0079-squash-kern-Add-lockdown-support.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 92c8be79a9a43f6b7fa5c73a28e842a30aa17f22 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 24 Feb 2021 23:51:38 +0800 -Subject: [PATCH 079/272] squash! kern: Add lockdown support - -Since the lockdown feature is efi specific, the -grub_{command,extcmd}_lockdown functions can be removed from other -platform for not taking up space in kernel image. ---- - grub-core/commands/extcmd.c | 2 ++ - grub-core/kern/command.c | 2 ++ - include/grub/command.h | 11 +++++++++++ - include/grub/extcmd.h | 13 +++++++++++++ - 4 files changed, 28 insertions(+) - -diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c -index 90a5ca24a..4ac111a99 100644 ---- a/grub-core/commands/extcmd.c -+++ b/grub-core/commands/extcmd.c -@@ -111,6 +111,7 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func, - summary, description, parser, 1); - } - -+#ifdef GRUB_MACHINE_EFI - static grub_err_t - grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)), - int argc __attribute__ ((unused)), -@@ -132,6 +133,7 @@ grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func, - - return grub_register_extcmd (name, func, flags, summary, description, parser); - } -+#endif - - void - grub_unregister_extcmd (grub_extcmd_t ext) -diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c -index 5812e131c..36a56fcc5 100644 ---- a/grub-core/kern/command.c -+++ b/grub-core/kern/command.c -@@ -78,6 +78,7 @@ grub_register_command_prio (const char *name, - return cmd; - } - -+#ifdef GRUB_MACHINE_EFI - static grub_err_t - grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)), - int argc __attribute__ ((unused)), -@@ -100,6 +101,7 @@ grub_register_command_lockdown (const char *name, - - return grub_register_command_prio (name, func, summary, description, 0); - } -+#endif - - void - grub_unregister_command (grub_command_t cmd) -diff --git a/include/grub/command.h b/include/grub/command.h -index 2a6f7f846..b518e262e 100644 ---- a/include/grub/command.h -+++ b/include/grub/command.h -@@ -86,11 +86,22 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name, - const char *summary, - const char *description, - int prio); -+#ifdef GRUB_MACHINE_EFI - grub_command_t - EXPORT_FUNC(grub_register_command_lockdown) (const char *name, - grub_command_func_t func, - const char *summary, - const char *description); -+#else -+static inline grub_command_t -+grub_register_command_lockdown (const char *name, -+ grub_command_func_t func, -+ const char *summary, -+ const char *description) -+{ -+ return grub_register_command_prio (name, func, summary, description, 0); -+} -+#endif - void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd); - - static inline grub_command_t -diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h -index fe9248b8b..fa1328ea5 100644 ---- a/include/grub/extcmd.h -+++ b/include/grub/extcmd.h -@@ -62,12 +62,25 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name, - const char *description, - const struct grub_arg_option *parser); - -+#ifdef GRUB_MACHINE_EFI - grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name, - grub_extcmd_func_t func, - grub_command_flags_t flags, - const char *summary, - const char *description, - const struct grub_arg_option *parser); -+#else -+static inline grub_extcmd_t -+grub_register_extcmd_lockdown (const char *name, -+ grub_extcmd_func_t func, -+ grub_command_flags_t flags, -+ const char *summary, -+ const char *description, -+ const struct grub_arg_option *parser) -+{ -+ return grub_register_extcmd (name, func, flags, summary, description, parser); -+} -+#endif - - grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name, - grub_extcmd_func_t func, --- -2.41.0 - diff --git a/0220-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch b/0080-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch similarity index 85% rename from 0220-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch rename to 0080-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch index 8e08dc2..9d8be1e 100644 --- a/0220-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch +++ b/0080-Make-it-so-we-can-tell-configure-which-cflags-utils-.patch @@ -1,8 +1,8 @@ -From 96b7f5d3d9845c7d971ec2ffb588b01f2ac93484 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 26 Jun 2018 17:16:06 -0400 -Subject: [PATCH 220/272] Make it so we can tell configure which cflags utils - are built with +Subject: [PATCH] Make it so we can tell configure which cflags utils are built + with This lets us have kernel.img be built with TARGET_CFLAGS but grub-mkimage and friends built with HOST_CFLAGS. That in turn lets us build with an ARM compiler @@ -11,58 +11,17 @@ float for grub.efi. Signed-off-by: Peter Jones --- - conf/Makefile.common | 23 +++++++++++---------- - configure.ac | 49 +++++++++++++++++++++++++++++++++++++++++++- + configure.ac | 49 ++++++++++++++++++++++++++++++++++++++++++++++++- + conf/Makefile.common | 23 ++++++++++++----------- gentpl.py | 8 ++++---- 3 files changed, 64 insertions(+), 16 deletions(-) -diff --git a/conf/Makefile.common b/conf/Makefile.common -index a7c0e70e9..e19d12690 100644 ---- a/conf/Makefile.common -+++ b/conf/Makefile.common -@@ -51,24 +51,25 @@ else - endif - endif - --CFLAGS_MODULE = $(CFLAGS_PLATFORM) -ffreestanding --LDFLAGS_MODULE = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-r --CPPFLAGS_MODULE = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) --CCASFLAGS_MODULE = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) -+CFLAGS_MODULE = $(TARGET_CFLAGS) $(CFLAGS_PLATFORM) -ffreestanding -+LDFLAGS_MODULE = $(TARGET_LDFLAGS) $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-r,-d -+CPPFLAGS_MODULE = $(TARGET_CPPFLAGS) $(CPPFLAGS_DEFAULT) $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) -+CCASFLAGS_MODULE = $(TARGET_CCASFLAGS) $(CCASFLAGS_DEFAULT) $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) - - CFLAGS_IMAGE = $(CFLAGS_PLATFORM) -fno-builtin - LDFLAGS_IMAGE = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-S - CPPFLAGS_IMAGE = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) - CCASFLAGS_IMAGE = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) - --CFLAGS_PROGRAM = --LDFLAGS_PROGRAM = --CPPFLAGS_PROGRAM = --CCASFLAGS_PROGRAM = -+CFLAGS_PROGRAM = $(UTILS_CFLAGS) -+LDFLAGS_PROGRAM = $(UTILS_LDFLAGS) -+CPPFLAGS_PROGRAM = $(UTILS_CPPFLAGS) -+CCASFLAGS_PROGRAM = $(UTILS_CCASFLAGS) - --CFLAGS_LIBRARY = --CPPFLAGS_LIBRARY = --CCASFLAGS_LIBRARY = -+CFLAGS_LIBRARY = $(UTILS_CFLAGS) -+LDFLAGS_LIBRARY = $(UTILS_LDFLAGS) -+CPPFLAGS_LIBRARY = $(UTILS_CPPFLAGS) -+CCASFLAGS_LIBRARY = $(UTILS_CCASFLAGS) - - # Other variables - diff --git a/configure.ac b/configure.ac -index b492dd7fa..81a84b89d 100644 +index fcfbcbb664d..c17e83acf87 100644 --- a/configure.ac +++ b/configure.ac -@@ -863,6 +863,18 @@ if ( test "x$target_cpu" = xi386 || test "x$target_cpu" = xx86_64 ) && test "x$p - TARGET_CFLAGS="$TARGET_CFLAGS -mno-mmx -mno-sse -mno-sse2 -mno-sse3 -mno-3dnow" +@@ -914,11 +914,23 @@ if test "x$target_cpu" = xloongarch64; then + TARGET_CCASFLAGS="$TARGET_CCASFLAGS -Wa,-mla-global-with-abs" fi +# Should grub utils get the host CFLAGS, or the target CFLAGS? @@ -77,10 +36,7 @@ index b492dd7fa..81a84b89d 100644 + with_utils=target +fi + - if ( test "x$target_cpu" = xi386 || test "x$target_cpu" = xx86_64 ); then - AC_CACHE_CHECK([whether -Wa,-mx86-used-note works], [grub_cv_cc_mx86_used_note], [ - CFLAGS="$TARGET_CFLAGS -Wa,-mx86-used-note=no -Werror" -@@ -919,7 +931,7 @@ fi + # GRUB doesn't use float or doubles at all. Yet some toolchains may decide # that floats are a good fit to run instead of what's written in the code. # Given that floating point unit is disabled (if present to begin with) # when GRUB is running which may result in various hard crashes. @@ -89,7 +45,7 @@ index b492dd7fa..81a84b89d 100644 AC_CACHE_CHECK([for options to get soft-float], grub_cv_target_cc_soft_float, [ grub_cv_target_cc_soft_float=no if test "x$target_cpu" = xarm64; then -@@ -2120,6 +2132,41 @@ HOST_CPPFLAGS="$HOST_CPPFLAGS -I\$(top_builddir)/include" +@@ -2111,6 +2123,41 @@ HOST_CPPFLAGS="$HOST_CPPFLAGS -I\$(top_builddir)/include" TARGET_CPPFLAGS="$TARGET_CPPFLAGS -I\$(top_srcdir)/include" TARGET_CPPFLAGS="$TARGET_CPPFLAGS -I\$(top_builddir)/include" @@ -131,11 +87,52 @@ index b492dd7fa..81a84b89d 100644 GRUB_TARGET_CPU="${target_cpu}" GRUB_PLATFORM="${platform}" +diff --git a/conf/Makefile.common b/conf/Makefile.common +index 6262f21a772..54f0f7f7664 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -50,24 +50,25 @@ else + endif + endif + +-CFLAGS_MODULE = $(CFLAGS_PLATFORM) -ffreestanding +-LDFLAGS_MODULE = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-r +-CPPFLAGS_MODULE = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) +-CCASFLAGS_MODULE = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) ++CFLAGS_MODULE = $(TARGET_CFLAGS) $(CFLAGS_PLATFORM) -ffreestanding ++LDFLAGS_MODULE = $(TARGET_LDFLAGS) $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-r ++CPPFLAGS_MODULE = $(TARGET_CPPFLAGS) $(CPPFLAGS_DEFAULT) $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) ++CCASFLAGS_MODULE = $(TARGET_CCASFLAGS) $(CCASFLAGS_DEFAULT) $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) + + CFLAGS_IMAGE = $(CFLAGS_PLATFORM) -fno-builtin + LDFLAGS_IMAGE = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-S + CPPFLAGS_IMAGE = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) + CCASFLAGS_IMAGE = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) + +-CFLAGS_PROGRAM = +-LDFLAGS_PROGRAM = +-CPPFLAGS_PROGRAM = +-CCASFLAGS_PROGRAM = ++CFLAGS_PROGRAM = $(UTILS_CFLAGS) ++LDFLAGS_PROGRAM = $(UTILS_LDFLAGS) ++CPPFLAGS_PROGRAM = $(UTILS_CPPFLAGS) ++CCASFLAGS_PROGRAM = $(UTILS_CCASFLAGS) + +-CFLAGS_LIBRARY = +-CPPFLAGS_LIBRARY = +-CCASFLAGS_LIBRARY = ++CFLAGS_LIBRARY = $(UTILS_CFLAGS) ++LDFLAGS_LIBRARY = $(UTILS_LDFLAGS) ++CPPFLAGS_LIBRARY = $(UTILS_CPPFLAGS) ++CCASFLAGS_LIBRARY = $(UTILS_CCASFLAGS) + + # Other variables + diff --git a/gentpl.py b/gentpl.py -index eec4f29f8..251ebf79c 100644 +index 597129a2bc4..5826a6b14e8 100644 --- a/gentpl.py +++ b/gentpl.py -@@ -703,10 +703,10 @@ def module(defn, platform): +@@ -699,10 +699,10 @@ def module(defn, platform): var_set(cname(defn) + "_SOURCES", platform_sources(defn, platform) + " ## platform sources") var_set("nodist_" + cname(defn) + "_SOURCES", platform_nodist_sources(defn, platform) + " ## platform nodist sources") var_set(cname(defn) + "_LDADD", platform_ldadd(defn, platform)) @@ -150,6 +147,3 @@ index eec4f29f8..251ebf79c 100644 var_set(cname(defn) + "_DEPENDENCIES", "$(TARGET_OBJ2ELF) " + platform_dependencies(defn, platform)) gvar_add("dist_noinst_DATA", extra_dist(defn)) --- -2.41.0 - diff --git a/0221-Rework-how-the-fdt-command-builds.patch b/0081-Rework-how-the-fdt-command-builds.patch similarity index 87% rename from 0221-Rework-how-the-fdt-command-builds.patch rename to 0081-Rework-how-the-fdt-command-builds.patch index e15727a..8c00d38 100644 --- a/0221-Rework-how-the-fdt-command-builds.patch +++ b/0081-Rework-how-the-fdt-command-builds.patch @@ -1,7 +1,7 @@ -From e8a90849011c23cb62a9547615b34f1b185a45c7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 11 Jul 2019 13:01:41 +0200 -Subject: [PATCH 221/272] Rework how the fdt command builds. +Subject: [PATCH] Rework how the fdt command builds. Trying to avoid all variants of: cat syminfo.lst | sort | gawk -f ../../grub-core/genmoddep.awk > moddep.lst || (rm -f moddep.lst; exit 1) @@ -17,30 +17,18 @@ Signed-off-by: Peter Jones Signed-off-by: Javier Martinez Canillas Signed-off-by: Robbie Harwood --- - grub-core/Makefile.am | 1 + grub-core/Makefile.core.def | 4 ++-- grub-core/lib/fdt.c | 2 -- grub-core/loader/efi/fdt.c | 2 ++ include/grub/fdt.h | 6 ++++++ + grub-core/Makefile.am | 1 + 5 files changed, 11 insertions(+), 4 deletions(-) -diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am -index b52444517..76d887336 100644 ---- a/grub-core/Makefile.am -+++ b/grub-core/Makefile.am -@@ -75,6 +75,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/efi/sb.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env_private.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/err.h -+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fdt.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/file.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 57dbf2386..37e810c1b 100644 +index 56eb6a828e8..4629c179e40 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -183,7 +183,6 @@ kernel = { +@@ -188,7 +188,6 @@ kernel = { arm_coreboot = kern/arm/coreboot/init.c; arm_coreboot = kern/arm/coreboot/timer.c; arm_coreboot = kern/arm/coreboot/coreboot.S; @@ -48,7 +36,7 @@ index 57dbf2386..37e810c1b 100644 arm_coreboot = bus/fdt.c; arm_coreboot = term/ps2.c; arm_coreboot = term/arm/pl050.c; -@@ -365,6 +364,8 @@ kernel = { +@@ -370,6 +369,8 @@ kernel = { riscv64 = kern/riscv/cache_flush.S; riscv64 = kern/riscv/dl.c; @@ -57,7 +45,7 @@ index 57dbf2386..37e810c1b 100644 emu = disk/host.c; emu = kern/emu/cache_s.S; emu = kern/emu/hostdisk.c; -@@ -1894,7 +1895,6 @@ module = { +@@ -1882,7 +1883,6 @@ module = { module = { name = fdt; efi = loader/efi/fdt.c; @@ -66,7 +54,7 @@ index 57dbf2386..37e810c1b 100644 }; diff --git a/grub-core/lib/fdt.c b/grub-core/lib/fdt.c -index 73cfa94a2..fbf749e1d 100644 +index 73cfa94a2df..fbf749e1d61 100644 --- a/grub-core/lib/fdt.c +++ b/grub-core/lib/fdt.c @@ -21,8 +21,6 @@ @@ -79,7 +67,7 @@ index 73cfa94a2..fbf749e1d 100644 #define FDT_BEGIN_NODE 0x00000001 diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c -index 439964b9c..e08d8738a 100644 +index 439964b9ca6..e08d8738afc 100644 --- a/grub-core/loader/efi/fdt.c +++ b/grub-core/loader/efi/fdt.c @@ -27,6 +27,8 @@ @@ -92,7 +80,7 @@ index 439964b9c..e08d8738a 100644 static void *fdt; diff --git a/include/grub/fdt.h b/include/grub/fdt.h -index e609c7e41..3514aa4a5 100644 +index e609c7e4111..3514aa4a5b6 100644 --- a/include/grub/fdt.h +++ b/include/grub/fdt.h @@ -19,6 +19,9 @@ @@ -113,6 +101,15 @@ index e609c7e41..3514aa4a5 100644 + (defined(__arm__) || defined(__aarch64__) || defined(__riscv)) */ + #endif /* ! GRUB_FDT_HEADER */ --- -2.41.0 - +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index b7192a3da82..7953ba95399 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -76,6 +76,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/efi/sb.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/env_private.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/err.h ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fdt.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/file.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h diff --git a/0081-Workaround-volatile-efi-boot-variable.patch b/0081-Workaround-volatile-efi-boot-variable.patch deleted file mode 100644 index e6d05c3..0000000 --- a/0081-Workaround-volatile-efi-boot-variable.patch +++ /dev/null @@ -1,307 +0,0 @@ -From e497b716e2338f202ea0a76b166f013c937e59da Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 19 Mar 2021 22:58:45 +0800 -Subject: [PATCH 081/272] Workaround volatile efi boot variable - -The efi variable in Microsoft Azure virtual machine is volatile that it cannot -persist across power cycling. If we use efi variable to communicate with efi -boot manager for booting a distribution, the process would silently fail as the -default loader in the efi system partition will start to take over the process -whenever the efi variable evaporated. - -That will lead to undefined symbol error one day as the default path didn't -receive any grub update so it cannot keep up with new ABI requirement by -updated grub modules. - -The patch will try to workaround the problem by providing grub update to the -default path along with the distribution specific one. To avoid negative side -effects of inadvertently overwritting other loader intended in default path, -care must be taken to ensure that: - -1. The workaround only takes place on detected Azure virtual machine -2. The default path is not in use by shim for the secure boot ---- - Makefile.util.def | 3 + - .../osdep/basic/efi_removable_fallback.c | 26 +++ - grub-core/osdep/efi_removable_fallback.c | 5 + - .../osdep/linux/efi_removable_fallback.c | 151 ++++++++++++++++++ - include/grub/util/install.h | 3 + - util/grub-install.c | 19 +++ - 6 files changed, 207 insertions(+) - create mode 100644 grub-core/osdep/basic/efi_removable_fallback.c - create mode 100644 grub-core/osdep/efi_removable_fallback.c - create mode 100644 grub-core/osdep/linux/efi_removable_fallback.c - -diff --git a/Makefile.util.def b/Makefile.util.def -index 1aaab4eca..268fc99f2 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -676,6 +676,9 @@ program = { - common = grub-core/osdep/journaled_fs.c; - extra_dist = grub-core/osdep/basic/journaled_fs.c; - extra_dist = grub-core/osdep/linux/journaled_fs.c; -+ common = grub-core/osdep/efi_removable_fallback.c; -+ extra_dist = grub-core/osdep/basic/efi_removable_fallback.c; -+ extra_dist = grub-core/osdep/linux/efi_removable_fallback.c; - - ldadd = '$(LIBLZMA)'; - ldadd = libgrubmods.a; -diff --git a/grub-core/osdep/basic/efi_removable_fallback.c b/grub-core/osdep/basic/efi_removable_fallback.c -new file mode 100644 -index 000000000..3f782f764 ---- /dev/null -+++ b/grub-core/osdep/basic/efi_removable_fallback.c -@@ -0,0 +1,26 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+ -+const char * -+grub_install_efi_removable_fallback (const char *efidir, enum grub_install_plat platform) -+{ -+ return NULL; -+} -+ -diff --git a/grub-core/osdep/efi_removable_fallback.c b/grub-core/osdep/efi_removable_fallback.c -new file mode 100644 -index 000000000..615a60831 ---- /dev/null -+++ b/grub-core/osdep/efi_removable_fallback.c -@@ -0,0 +1,5 @@ -+#ifdef __linux__ -+#include "linux/efi_removable_fallback.c" -+#else -+#include "basic/efi_removable_fallback.c" -+#endif -diff --git a/grub-core/osdep/linux/efi_removable_fallback.c b/grub-core/osdep/linux/efi_removable_fallback.c -new file mode 100644 -index 000000000..7375fb0c2 ---- /dev/null -+++ b/grub-core/osdep/linux/efi_removable_fallback.c -@@ -0,0 +1,151 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2013 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+ -+#include -+#include -+#include -+#include -+ -+static char * -+get_dmi_id (const char *id) -+{ -+ FILE *fp; -+ char *buf = NULL; -+ size_t len = 0; -+ -+ char *dmi_entry; -+ -+ dmi_entry = grub_util_path_concat (2, "/sys/class/dmi/id", id); -+ -+ fp = grub_util_fopen (dmi_entry, "r"); -+ if (!fp) -+ { -+ free (dmi_entry); -+ return NULL; -+ } -+ -+ if (getline (&buf, &len, fp) == -1) -+ { -+ fclose (fp); -+ free (dmi_entry); -+ return NULL; -+ } -+ -+ fclose (fp); -+ free (dmi_entry); -+ return buf; -+} -+ -+ -+static struct dmi { -+ const char *id; -+ const char *val; -+} azure_dmi [3] = { -+ {"bios_vendor", "Microsoft Corporation"}, -+ {"product_name", "Virtual Machine"}, -+ {"sys_vendor", "Microsoft Corporation"}, -+}; -+ -+static int -+is_azure (void) -+{ -+ int i; -+ int n = sizeof (azure_dmi) / sizeof (struct dmi); -+ -+ for (i = 0; i < n; ++i) -+ { -+ char *val; -+ -+ val = get_dmi_id (azure_dmi[i].id); -+ if (!val) -+ break; -+ if (strncmp (val, azure_dmi[i].val, strlen (azure_dmi[i].val)) != 0) -+ { -+ free (val); -+ break; -+ } -+ free (val); -+ } -+ -+ return (i == n) ? 1 : 0; -+} -+ -+static int -+guess_shim_installed (const char *instdir) -+{ -+ const char *shim[] = {"fallback.efi", "MokManager.efi", NULL}; -+ const char **s; -+ -+ for (s = shim; *s ; ++s) -+ { -+ char *p = grub_util_path_concat (2, instdir, *s); -+ -+ if (access (p, F_OK) == 0) -+ { -+ free (p); -+ return 1; -+ } -+ free (p); -+ } -+ -+ return 0; -+} -+ -+const char * -+grub_install_efi_removable_fallback (const char *efidir, enum grub_install_plat platform) -+{ -+ char *instdir; -+ -+ if (!is_azure ()) -+ return NULL; -+ -+ instdir = grub_util_path_concat (3, efidir, "EFI", "BOOT"); -+ -+ if (guess_shim_installed (instdir)) -+ { -+ grub_util_info ("skip removable fallback occupied by shim"); -+ return NULL; -+ } -+ -+ free (instdir); -+ -+ switch (platform) -+ { -+ case GRUB_INSTALL_PLATFORM_I386_EFI: -+ return "BOOTIA32.EFI"; -+ case GRUB_INSTALL_PLATFORM_X86_64_EFI: -+ return "BOOTX64.EFI"; -+ case GRUB_INSTALL_PLATFORM_IA64_EFI: -+ return "BOOTIA64.EFI"; -+ case GRUB_INSTALL_PLATFORM_ARM_EFI: -+ return "BOOTARM.EFI"; -+ case GRUB_INSTALL_PLATFORM_ARM64_EFI: -+ return "BOOTAA64.EFI"; -+ case GRUB_INSTALL_PLATFORM_RISCV32_EFI: -+ return "BOOTRISCV32.EFI"; -+ case GRUB_INSTALL_PLATFORM_RISCV64_EFI: -+ return "BOOTRISCV64.EFI"; -+ default: -+ grub_util_error ("%s", _("You've found a bug")); -+ break; -+ } -+ return NULL; -+} -+ -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index 7c44e3d0d..f026f69c9 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -299,4 +299,7 @@ grub_set_install_backup_ponr (void) - - int - grub_install_sync_fs_journal (const char *path); -+ -+const char * -+grub_install_efi_removable_fallback (const char *efidir, enum grub_install_plat platform); - #endif -diff --git a/util/grub-install.c b/util/grub-install.c -index bc107c654..b72048c08 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -890,6 +890,7 @@ main (int argc, char *argv[]) - const char *pkgdatadir; - char *rootdir_path; - char **rootdir_devices; -+ char *efidir_root; - - grub_util_host_init (&argc, &argv); - product_version = xstrdup (PACKAGE_VERSION); -@@ -1162,6 +1163,7 @@ main (int argc, char *argv[]) - } - if (!efidir) - grub_util_error ("%s", _("cannot find EFI directory")); -+ efidir_root = grub_strdup (efidir); - efidir_device_names = grub_guess_root_devices (efidir); - if (!efidir_device_names || !efidir_device_names[0]) - grub_util_error (_("cannot find a device for %s (is /dev mounted?)"), -@@ -2181,6 +2183,23 @@ main (int argc, char *argv[]) - free (grub_efi_cfg); - } - } -+ if (!removable) -+ { -+ const char *f; -+ -+ f = grub_install_efi_removable_fallback (efidir_root, platform); -+ if (f) -+ { -+ char *t = grub_util_path_concat (3, efidir_root, "EFI", "BOOT"); -+ char *dst = grub_util_path_concat (2, t, f); -+ -+ grub_install_mkdir_p (t); -+ fprintf (stderr, _("Install to %s as fallback.\n"), dst); -+ grub_install_copy_file (imgfile, dst, 1); -+ grub_free (t); -+ grub_free (dst); -+ } -+ } - if (!removable && update_nvram) - { - char * efifile_path; --- -2.41.0 - diff --git a/0222-Disable-non-wordsize-allocations-on-arm.patch b/0082-Disable-non-wordsize-allocations-on-arm.patch similarity index 84% rename from 0222-Disable-non-wordsize-allocations-on-arm.patch rename to 0082-Disable-non-wordsize-allocations-on-arm.patch index 3b49b83..e8c4641 100644 --- a/0222-Disable-non-wordsize-allocations-on-arm.patch +++ b/0082-Disable-non-wordsize-allocations-on-arm.patch @@ -1,7 +1,7 @@ -From aadb605f05f7c613b4ccf4b1660c09e3e49a61d7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 2 Aug 2018 10:56:38 -0400 -Subject: [PATCH 222/272] Disable non-wordsize allocations on arm +Subject: [PATCH] Disable non-wordsize allocations on arm Signed-off-by: Peter Jones --- @@ -9,10 +9,10 @@ Signed-off-by: Peter Jones 1 file changed, 20 insertions(+) diff --git a/configure.ac b/configure.ac -index 81a84b89d..03a13b26a 100644 +index c17e83acf87..3f3a170ab17 100644 --- a/configure.ac +++ b/configure.ac -@@ -1347,6 +1347,26 @@ if test "x$target_cpu" = xarm; then +@@ -1346,6 +1346,26 @@ if test "x$target_cpu" = xarm; then done ]) @@ -39,6 +39,3 @@ index 81a84b89d..03a13b26a 100644 if test x"$grub_cv_target_cc_mno_movt" != xno ; then # A trick so that clang doesn't see it on link stage TARGET_CPPFLAGS="$TARGET_CPPFLAGS $grub_cv_target_cc_mno_movt" --- -2.41.0 - diff --git a/0082-templates-Follow-the-path-of-usr-merged-kernel-confi.patch b/0082-templates-Follow-the-path-of-usr-merged-kernel-confi.patch deleted file mode 100644 index 3cb19c7..0000000 --- a/0082-templates-Follow-the-path-of-usr-merged-kernel-confi.patch +++ /dev/null @@ -1,48 +0,0 @@ -From e6556c934ae82d8ba5e9e1ce10e77acd62fa5560 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 7 Sep 2021 10:06:50 +0800 -Subject: [PATCH 082/272] templates: Follow the path of usr merged kernel - config - -The background for usr merge can be found at: - -https://www.freedesktop.org/wiki/Software/systemd/TheCaseForTheUsrMerge/ - -This patch adapts related mkconfig scripts to follow the usr merge for -looking up kernel configs. - -Signed-off-by: Michael Chang ---- - util/grub.d/10_linux.in | 2 +- - util/grub.d/20_linux_xen.in | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 6562966f5..2accd4574 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -305,7 +305,7 @@ for linux in ${reverse_sorted_list}; do - fi - - config= -- for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do -+ for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" "/usr/lib/modules/${version}/config" ; do - if test -e "${i}" ; then - config="${i}" - break -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 63a8dbf4b..672835df3 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -303,7 +303,7 @@ for i in /boot/vmlinu[xz]-* /vmlinu[xz]-* /boot/kernel-*; do - version=$(echo $basename | sed -e "s,^[^0-9]*-,,g") - dirname=$(dirname $i) - config= -- for j in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do -+ for j in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" "/usr/lib/modules/${version}/config" ; do - if test -e "${j}" ; then - config="${j}" - break --- -2.41.0 - diff --git a/0223-Prepend-prefix-when-HTTP-path-is-relative.patch b/0083-Prepend-prefix-when-HTTP-path-is-relative.patch similarity index 90% rename from 0223-Prepend-prefix-when-HTTP-path-is-relative.patch rename to 0083-Prepend-prefix-when-HTTP-path-is-relative.patch index 50e6cac..ac6c806 100644 --- a/0223-Prepend-prefix-when-HTTP-path-is-relative.patch +++ b/0083-Prepend-prefix-when-HTTP-path-is-relative.patch @@ -1,7 +1,7 @@ -From 56ee317e97a6c6c2d23cf22be6f69b876453e1b3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Stephen Benjamin Date: Thu, 16 Aug 2018 16:58:51 -0400 -Subject: [PATCH 223/272] Prepend prefix when HTTP path is relative +Subject: [PATCH] Prepend prefix when HTTP path is relative This sets a couple of variables. With the url http://www.example.com/foo/bar : http_path: /foo/bar @@ -11,12 +11,12 @@ Signed-off-by: Peter Jones Signed-off-by: Stephen Benjamin Signed-off-by: Robbie Harwood --- - grub-core/kern/main.c | 10 ++++- - grub-core/net/efi/http.c | 84 ++++++++++++++++++++++++++++++---------- - 2 files changed, 72 insertions(+), 22 deletions(-) + grub-core/kern/main.c | 10 +++++- + grub-core/net/efi/http.c | 82 ++++++++++++++++++++++++++++++++++++------------ + 2 files changed, 71 insertions(+), 21 deletions(-) diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 37f936ceb..5f69ffd38 100644 +index 463dafdba02..7347a8de676 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c @@ -131,11 +131,19 @@ grub_set_prefix_and_root (void) @@ -41,10 +41,10 @@ index 37f936ceb..5f69ffd38 100644 } } diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c -index 9f860fc04..ebbb3f0b4 100644 +index b94dbc68eef..5e97f5d5e70 100644 --- a/grub-core/net/efi/http.c +++ b/grub-core/net/efi/http.c -@@ -10,10 +10,52 @@ +@@ -9,10 +9,52 @@ static void http_configure (struct grub_efi_net_device *dev, int prefer_ip6) { @@ -97,14 +97,16 @@ index 9f860fc04..ebbb3f0b4 100644 grub_efi_http_t *http = dev->http; -@@ -357,32 +399,32 @@ grub_efihttp_open (struct grub_efi_net_device *dev, +@@ -343,32 +385,32 @@ grub_efihttp_open (struct grub_efi_net_device *dev, grub_err_t err; grub_off_t size; char *buf; - char *root_url; - grub_efi_ipv6_address_t address; - const char *rest; -- ++ char *file_name = NULL; ++ const char *http_path; + - if (grub_efi_string_to_ip6_address (file->device->net->server, &address, &rest) && *rest == 0) - root_url = grub_xasprintf ("%s://[%s]", type ? "https" : "http", file->device->net->server); - else @@ -117,9 +119,6 @@ index 9f860fc04..ebbb3f0b4 100644 - } - else - { -+ char *file_name = NULL; -+ const char *http_path; -+ + /* If path is relative, prepend http_path */ + http_path = grub_env_get ("http_path"); + if (http_path && file->device->net->name[0] != '/') { @@ -151,6 +150,3 @@ index 9f860fc04..ebbb3f0b4 100644 buf = grub_malloc (size); efihttp_read (dev, buf, size); --- -2.41.0 - diff --git a/0083-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch b/0083-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch deleted file mode 100644 index 6990e45..0000000 --- a/0083-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch +++ /dev/null @@ -1,146 +0,0 @@ -From 10a78774f662267cfc5b23a5ba860b4b9a234057 Mon Sep 17 00:00:00 2001 -From: Diego Domingos -Date: Mon, 24 Jun 2019 10:15:56 -0400 -Subject: [PATCH 083/272] ieee1275: implement FCP methods for WWPN and LUNs - -This patch enables the fcp-targets and fcp-luns methods which are -responsible to get WWPNs and LUNs for fibre channel devices. - -Those methods are specially necessary if the boot directory and grub -installation are in different FCP disks, allowing the dev_iterate() -to find the WWPNs and LUNs when called by searchfs.uuid tool. ---- - grub-core/disk/ieee1275/ofdisk.c | 117 ++++++++++++++++++++++++++++++- - 1 file changed, 116 insertions(+), 1 deletion(-) - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index 629fc15f2..ca8f963c9 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -209,7 +209,122 @@ dev_iterate_real (const char *name, const char *path) - static void - dev_iterate (const struct grub_ieee1275_devalias *alias) - { -- if (grub_strcmp (alias->type, "vscsi") == 0) -+ if (grub_strcmp (alias->type, "fcp") == 0) -+ { -+ -+ /* If we are dealing with fcp devices, we need -+ * to find the WWPNs and LUNs to iterate them */ -+ grub_ieee1275_ihandle_t ihandle; -+ grub_uint64_t *ptr_targets, *ptr_luns, k, l; -+ unsigned int i, j, pos; -+ char *buf, *bufptr; -+ -+ struct set_fcp_targets_args -+ { -+ struct grub_ieee1275_common_hdr common; -+ grub_ieee1275_cell_t method; -+ grub_ieee1275_cell_t ihandle; -+ grub_ieee1275_cell_t catch_result; -+ grub_ieee1275_cell_t nentries; -+ grub_ieee1275_cell_t table; -+ } args_targets; -+ -+ struct set_fcp_luns_args -+ { -+ struct grub_ieee1275_common_hdr common; -+ grub_ieee1275_cell_t method; -+ grub_ieee1275_cell_t ihandle; -+ grub_ieee1275_cell_t wwpn_h; -+ grub_ieee1275_cell_t wwpn_l; -+ grub_ieee1275_cell_t catch_result; -+ grub_ieee1275_cell_t nentries; -+ grub_ieee1275_cell_t table; -+ } args_luns; -+ -+ struct args_ret -+ { -+ grub_uint64_t addr; -+ grub_uint64_t len; -+ }; -+ -+ if(grub_ieee1275_open (alias->path, &ihandle)) -+ { -+ grub_dprintf("disk", "failed to open the disk while iterating FCP disk path=%s\n", alias->path); -+ return; -+ } -+ -+ /* Setup the fcp-targets method to call via pfw*/ -+ INIT_IEEE1275_COMMON (&args_targets.common, "call-method", 2, 3); -+ args_targets.method = (grub_ieee1275_cell_t) "fcp-targets"; -+ args_targets.ihandle = ihandle; -+ -+ /* Setup the fcp-luns method to call via pfw */ -+ INIT_IEEE1275_COMMON (&args_luns.common, "call-method", 4, 3); -+ args_luns.method = (grub_ieee1275_cell_t) "fcp-luns"; -+ args_luns.ihandle = ihandle; -+ -+ if (IEEE1275_CALL_ENTRY_FN (&args_targets) == -1) -+ { -+ grub_dprintf("disk", "failed to get the targets while iterating FCP disk path=%s\n", alias->path); -+ grub_ieee1275_close(ihandle); -+ return; -+ } -+ -+ buf = grub_malloc (grub_strlen (alias->path) + 32 + 32); -+ -+ if (!buf) -+ { -+ grub_ieee1275_close(ihandle); -+ return; -+ } -+ -+ bufptr = grub_stpcpy (buf, alias->path); -+ -+ /* Iterate over entries returned by pfw. Each entry contains a -+ * pointer to wwpn table and his length. */ -+ struct args_ret *targets_table = (struct args_ret *)(args_targets.table); -+ for (i=0; i< args_targets.nentries; i++) -+ { -+ ptr_targets = (grub_uint64_t*)(grub_uint32_t) targets_table[i].addr; -+ /* Iterate over all wwpns in given table */ -+ for(k=0;k> 32); -+ pos=grub_snprintf (bufptr, 32, "/disk@%" PRIxGRUB_UINT64_T, -+ *ptr_targets++); -+ /* Get the luns for given wwpn target */ -+ if (IEEE1275_CALL_ENTRY_FN (&args_luns) == -1) -+ { -+ grub_dprintf("disk", "failed to get the LUNS while iterating FCP disk path=%s\n", buf); -+ grub_ieee1275_close (ihandle); -+ grub_free (buf); -+ return; -+ } -+ -+ struct args_ret *luns_table = (struct args_ret *)(args_luns.table); -+ -+ /* Iterate over all LUNs */ -+ for(j=0;jtype, "vscsi") == 0) - { - static grub_ieee1275_ihandle_t ihandle; - struct set_color_args --- -2.41.0 - diff --git a/0076-Make-grub_error-more-verbose.patch b/0084-Make-grub_error-more-verbose.patch similarity index 81% rename from 0076-Make-grub_error-more-verbose.patch rename to 0084-Make-grub_error-more-verbose.patch index 1e2d8be..5ad2684 100644 --- a/0076-Make-grub_error-more-verbose.patch +++ b/0084-Make-grub_error-more-verbose.patch @@ -1,16 +1,16 @@ -From 32600ecac16fe532df9d12f6c4928bb648299ede Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 27 Aug 2018 13:14:06 -0400 -Subject: [PATCH 076/272] Make grub_error() more verbose +Subject: [PATCH] Make grub_error() more verbose Signed-off-by: Peter Jones --- grub-core/kern/err.c | 13 +++++++++++-- - include/grub/err.h | 7 +++++-- - 2 files changed, 16 insertions(+), 4 deletions(-) + include/grub/err.h | 8 ++++++-- + 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/grub-core/kern/err.c b/grub-core/kern/err.c -index 53c734de7..aebfe0cf8 100644 +index 53c734de70e..aebfe0cf839 100644 --- a/grub-core/kern/err.c +++ b/grub-core/kern/err.c @@ -33,15 +33,24 @@ static struct grub_error_saved grub_error_stack_items[GRUB_ERROR_STACK_SIZE]; @@ -41,23 +41,21 @@ index 53c734de7..aebfe0cf8 100644 return n; diff --git a/include/grub/err.h b/include/grub/err.h -index 1c07034cd..b0f746672 100644 +index 1c07034cd60..3c587b9b822 100644 --- a/include/grub/err.h +++ b/include/grub/err.h -@@ -86,8 +86,11 @@ struct grub_error_saved +@@ -86,8 +86,12 @@ struct grub_error_saved extern grub_err_t EXPORT_VAR(grub_errno); extern char EXPORT_VAR(grub_errmsg)[GRUB_MAX_ERRMSG]; -grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *fmt, ...) - __attribute__ ((format (GNU_PRINTF, 2, 3))); +grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *file, const int line, const char *fmt, ...) -+ __attribute__ ((format (GNU_PRINTF, 4, 5))); ++ __attribute__ ((format (GNU_PRINTF, 4, 5))); + +#define grub_error(n, fmt, ...) grub_error (n, __FILE__, __LINE__, fmt, ##__VA_ARGS__) ++ + void EXPORT_FUNC(grub_fatal) (const char *fmt, ...) __attribute__ ((noreturn)); void EXPORT_FUNC(grub_error_push) (void); int EXPORT_FUNC(grub_error_pop) (void); --- -2.41.0 - diff --git a/0085-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch b/0085-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch deleted file mode 100644 index 7b6960f..0000000 --- a/0085-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 7273541c4c3be33f0009027a90040d80ba45dccc Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Thu, 9 Sep 2021 10:59:28 -0400 -Subject: [PATCH 085/272] Arm: check for the PE magic for the compiled arch - -In "arm64: Fix EFI loader kernel image allocation", Ben fixed the kernel -alignment to match the alignment given in the PE header. In doing so, a -check for valid PE magic was added, which was hard-coded to the value -seen on Aarch64 (GRUB_PE32_PE64_MAGIC). - -Unfortunately, this code is shared between 64-bit and 32-bit, and so -that value broke 32-bit Arm systems. - -This patch adds a constant definition for GRUB_PE32_PEXX_MAGIC, which is -either GRUB_PE32_PE64_MAGIC or GRUB_PE32_PE32_MAGIC, depending on which -platform is being built, and uses it in the header magic check. - -Resolves: rhbz#2000756 - -Signed-off-by: Peter Jones ---- - grub-core/loader/arm64/efi/linux.c | 2 +- - include/grub/arm/linux.h | 1 + - include/grub/arm64/linux.h | 1 + - 3 files changed, 3 insertions(+), 1 deletion(-) - -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index b91b550fa..32b76b954 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -376,7 +376,7 @@ parse_pe_header (void *kernel, grub_uint64_t *total_size, - - pe = (void *)((unsigned long)kernel + lh->hdr_offset); - -- if (pe->opt.magic != GRUB_PE32_PE64_MAGIC) -+ if (pe->opt.magic != GRUB_PE32_PEXX_MAGIC) - return grub_error(GRUB_ERR_BAD_OS, "Invalid PE optional header magic"); - - *total_size = pe->opt.image_size; -diff --git a/include/grub/arm/linux.h b/include/grub/arm/linux.h -index 5c3d4e1a5..9398fd46c 100644 ---- a/include/grub/arm/linux.h -+++ b/include/grub/arm/linux.h -@@ -33,6 +33,7 @@ struct grub_arm_linux_pe_header - }; - - #if defined(__arm__) -+# define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE32_MAGIC - # define grub_armxx_linux_pe_header grub_arm_linux_pe_header - #endif - -diff --git a/include/grub/arm64/linux.h b/include/grub/arm64/linux.h -index d86e32906..1cab170a5 100644 ---- a/include/grub/arm64/linux.h -+++ b/include/grub/arm64/linux.h -@@ -33,6 +33,7 @@ struct grub_arm64_linux_pe_header - - #if defined(__aarch64__) - # define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM64_MAGIC_SIGNATURE -+# define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE64_MAGIC - # define grub_armxx_linux_pe_header grub_arm64_linux_pe_header - #endif - --- -2.41.0 - diff --git a/0085-Make-reset-an-alias-for-the-reboot-command.patch b/0085-Make-reset-an-alias-for-the-reboot-command.patch new file mode 100644 index 0000000..c86acf1 --- /dev/null +++ b/0085-Make-reset-an-alias-for-the-reboot-command.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 31 Aug 2018 16:42:03 -0400 +Subject: [PATCH] Make "reset" an alias for the "reboot" command. + +I'm really tired of half the tools I get to use having one and the other half +having the other. + +Signed-off-by: Peter Jones +--- + grub-core/commands/reboot.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/reboot.c b/grub-core/commands/reboot.c +index 46d364c99a9..f5cc2283636 100644 +--- a/grub-core/commands/reboot.c ++++ b/grub-core/commands/reboot.c +@@ -32,15 +32,18 @@ grub_cmd_reboot (grub_command_t cmd __attribute__ ((unused)), + grub_reboot (); + } + +-static grub_command_t cmd; ++static grub_command_t reboot_cmd, reset_cmd; + + GRUB_MOD_INIT(reboot) + { +- cmd = grub_register_command ("reboot", grub_cmd_reboot, +- 0, N_("Reboot the computer.")); ++ reboot_cmd = grub_register_command ("reboot", grub_cmd_reboot, ++ 0, N_("Reboot the computer.")); ++ reset_cmd = grub_register_command ("reset", grub_cmd_reboot, ++ 0, N_("Reboot the computer.")); + } + + GRUB_MOD_FINI(reboot) + { +- grub_unregister_command (cmd); ++ grub_unregister_command (reboot_cmd); ++ grub_unregister_command (reset_cmd); + } diff --git a/0224-Add-a-version-command.patch b/0086-Add-a-version-command.patch similarity index 90% rename from 0224-Add-a-version-command.patch rename to 0086-Add-a-version-command.patch index c24ee0b..b8770ee 100644 --- a/0224-Add-a-version-command.patch +++ b/0086-Add-a-version-command.patch @@ -1,7 +1,7 @@ -From 4e1b237c449bef152710a537c5b96d323cff6f0f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 11 Sep 2018 14:20:37 -0400 -Subject: [PATCH 224/272] Add a "version" command +Subject: [PATCH] Add a "version" command This adds a command that shows you info about grub's version, the grub target platform, the compiler version, and if you built with @@ -11,30 +11,18 @@ Signed-off-by: Peter Jones [rharwood: don't say GNU, commit message cleanup] Signed-off-by: Robbie Harwood --- - config.h.in | 1 + - configure.ac | 13 +++++++++ + configure.ac | 13 ++++++++++ grub-core/Makefile.core.def | 5 ++++ - grub-core/commands/version.c | 56 ++++++++++++++++++++++++++++++++++++ + grub-core/commands/version.c | 56 ++++++++++++++++++++++++++++++++++++++++++++ + config.h.in | 1 + 4 files changed, 75 insertions(+) create mode 100644 grub-core/commands/version.c -diff --git a/config.h.in b/config.h.in -index 9b1d39971..d294d2c65 100644 ---- a/config.h.in -+++ b/config.h.in -@@ -63,6 +63,7 @@ - - # define GRUB_TARGET_CPU "@GRUB_TARGET_CPU@" - # define GRUB_PLATFORM "@GRUB_PLATFORM@" -+# define GRUB_RPM_VERSION "@GRUB_RPM_VERSION@" - - # define GRUB_STACK_PROTECTOR_INIT @GRUB_STACK_PROTECTOR_INIT@ - diff --git a/configure.ac b/configure.ac -index 03a13b26a..205a33a7f 100644 +index 3f3a170ab17..2175aa56997 100644 --- a/configure.ac +++ b/configure.ac -@@ -290,6 +290,19 @@ AC_SUBST(target_cpu) +@@ -289,6 +289,19 @@ AC_SUBST(target_cpu) AC_SUBST(platform) # Define default variables @@ -55,10 +43,10 @@ index 03a13b26a..205a33a7f 100644 have_with_bootdir=n AC_ARG_WITH([bootdir], diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 37e810c1b..422965704 100644 +index 4629c179e40..f26c689723c 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -593,6 +593,11 @@ image = { +@@ -598,6 +598,11 @@ image = { enable = mips_loongson; }; @@ -72,7 +60,7 @@ index 37e810c1b..422965704 100644 common = lib/disk.c; diff --git a/grub-core/commands/version.c b/grub-core/commands/version.c new file mode 100644 -index 000000000..de0acb07b +index 00000000000..de0acb07ba2 --- /dev/null +++ b/grub-core/commands/version.c @@ -0,0 +1,56 @@ @@ -132,6 +120,15 @@ index 000000000..de0acb07b +{ + grub_unregister_command (cmd); +} --- -2.41.0 - +diff --git a/config.h.in b/config.h.in +index 9b1d3997185..d294d2c653f 100644 +--- a/config.h.in ++++ b/config.h.in +@@ -63,6 +63,7 @@ + + # define GRUB_TARGET_CPU "@GRUB_TARGET_CPU@" + # define GRUB_PLATFORM "@GRUB_PLATFORM@" ++# define GRUB_RPM_VERSION "@GRUB_RPM_VERSION@" + + # define GRUB_STACK_PROTECTOR_INIT @GRUB_STACK_PROTECTOR_INIT@ + diff --git a/0086-Factor-out-grub_efi_linux_boot.patch b/0086-Factor-out-grub_efi_linux_boot.patch deleted file mode 100644 index 45e701b..0000000 --- a/0086-Factor-out-grub_efi_linux_boot.patch +++ /dev/null @@ -1,230 +0,0 @@ -From f4ee91d3cd801bdb070c527b38e7c6026cb8748f Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 8 Oct 2021 13:36:45 +0800 -Subject: [PATCH 086/272] Factor out grub_efi_linux_boot - -Both x86 and arm64 on efi are using handover protocol to boot linux -kernel. To enable better code reuse, factor out grub_efi_linux_boot from -arm64 so that it can be shared with x86 platform for the common fixes. - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 3 ++ - grub-core/loader/arm64/efi/linux.c | 35 +----------------- - grub-core/loader/efi/linux_boot.c | 58 ++++++++++++++++++++++++++++++ - grub-core/loader/i386/efi/linux.c | 13 ++----- - include/grub/efi/linux.h | 29 +++++++++++++++ - 5 files changed, 94 insertions(+), 44 deletions(-) - create mode 100644 grub-core/loader/efi/linux_boot.c - create mode 100644 include/grub/efi/linux.h - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index bdecd23f1..3f48cfa75 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -1858,6 +1858,9 @@ module = { - riscv64 = loader/efi/linux.c; - emu = loader/emu/linux.c; - common = loader/linux.c; -+ i386_efi = loader/efi/linux_boot.c; -+ x86_64_efi = loader/efi/linux_boot.c; -+ arm64 = loader/efi/linux_boot.c; - }; - - module = { -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index 32b76b954..f5508a6de 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -51,40 +52,6 @@ static grub_uint32_t cmdline_size; - static grub_addr_t initrd_start; - static grub_addr_t initrd_end; - --#pragma GCC diagnostic push --#pragma GCC diagnostic ignored "-Wcast-align" -- --typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); -- --static grub_err_t --grub_efi_linux_boot (void *kernel_address, grub_off_t offset, -- void *kernel_params) --{ -- grub_efi_loaded_image_t *loaded_image = NULL; -- handover_func hf; -- -- /* -- * Since the EFI loader is not calling the LoadImage() and StartImage() -- * services for loading the kernel and booting respectively, it has to -- * set the Loaded Image base address. -- */ -- loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); -- if (loaded_image) -- loaded_image->image_base = kernel_addr; -- else -- grub_dprintf ("linux", "Loaded Image base address could not be set\n"); -- -- grub_dprintf ("linux", "kernel_addr: %p handover_offset: %p params: %p\n", -- kernel_address, (void *)(grub_efi_uintn_t)offset, kernel_params); -- hf = (handover_func)((char *)kernel_address + offset); -- grub_dprintf ("linux", "handover_func() = %p\n", hf); -- hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); -- -- return GRUB_ERR_BUG; --} -- --#pragma GCC diagnostic pop -- - static grub_err_t - grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh) - { -diff --git a/grub-core/loader/efi/linux_boot.c b/grub-core/loader/efi/linux_boot.c -new file mode 100644 -index 000000000..442627dc2 ---- /dev/null -+++ b/grub-core/loader/efi/linux_boot.c -@@ -0,0 +1,58 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2014 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wcast-align" -+ -+typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); -+ -+grub_err_t -+grub_efi_linux_boot (void *kernel_addr, grub_off_t offset, -+ void *kernel_params) -+{ -+ grub_efi_loaded_image_t *loaded_image = NULL; -+ handover_func hf; -+ -+ /* -+ * Since the EFI loader is not calling the LoadImage() and StartImage() -+ * services for loading the kernel and booting respectively, it has to -+ * set the Loaded Image base address. -+ */ -+ loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); -+ if (loaded_image) -+ loaded_image->image_base = kernel_addr; -+ else -+ grub_dprintf ("linux", "Loaded Image base address could not be set\n"); -+ -+ grub_dprintf ("linux", "kernel_addr: %p handover_offset: %p params: %p\n", -+ kernel_addr, (void *)(grub_efi_uintn_t)offset, kernel_params); -+ hf = (handover_func)((char *)kernel_addr + offset); -+ hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); -+ -+ return GRUB_ERR_BUG; -+} -+ -+#pragma GCC diagnostic pop -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 355ecc9b9..06814cae3 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -40,26 +41,18 @@ static char *linux_cmdline; - - #define BYTES_TO_PAGES(bytes) (((bytes) + 0xfff) >> 12) - --typedef void(*handover_func)(void *, grub_efi_system_table_t *, struct linux_kernel_params *); -- - static grub_err_t - grub_linuxefi_boot (void) - { -- handover_func hf; - int offset = 0; - - #ifdef __x86_64__ - offset = 512; - #endif -- -- hf = (handover_func)((char *)kernel_mem + handover_offset + offset); -- - asm volatile ("cli"); - -- hf (grub_efi_image_handle, grub_efi_system_table, params); -- -- /* Not reached */ -- return GRUB_ERR_NONE; -+ return grub_efi_linux_boot ((char *)kernel_mem, handover_offset + offset, -+ params); - } - - static grub_err_t -diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h -new file mode 100644 -index 000000000..887b02fd9 ---- /dev/null -+++ b/include/grub/efi/linux.h -@@ -0,0 +1,29 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2014 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+#ifndef GRUB_EFI_LINUX_HEADER -+#define GRUB_EFI_LINUX_HEADER 1 -+ -+#include -+#include -+#include -+ -+grub_err_t -+EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset, -+ void *kernel_param); -+ -+#endif /* ! GRUB_EFI_LINUX_HEADER */ --- -2.41.0 - diff --git a/0225-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch b/0087-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch similarity index 77% rename from 0225-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch rename to 0087-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch index 816816f..9ad4036 100644 --- a/0225-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch +++ b/0087-Add-more-dprintf-and-nerf-dprintf-in-script.c.patch @@ -1,7 +1,7 @@ -From 6c277b3935da3a20fe5be7aad019ca4405516437 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 11 Sep 2018 15:58:29 -0400 -Subject: [PATCH 225/272] Add more dprintf, and nerf dprintf in script.c +Subject: [PATCH] Add more dprintf, and nerf dprintf in script.c Signed-off-by: Peter Jones --- @@ -12,10 +12,10 @@ Signed-off-by: Peter Jones 4 files changed, 10 insertions(+) diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 1e44e3add..8c4345668 100644 +index 21e2395111a..c35ce8915b2 100644 --- a/grub-core/disk/diskfilter.c +++ b/grub-core/disk/diskfilter.c -@@ -281,6 +281,8 @@ scan_disk (const char *name, int accept_diskfilter) +@@ -188,6 +188,8 @@ scan_disk (const char *name, int accept_diskfilter) grub_disk_t disk; static int scan_depth = 0; @@ -24,16 +24,16 @@ index 1e44e3add..8c4345668 100644 if (!accept_diskfilter && is_valid_diskfilter_name (name)) return 0; -@@ -1396,6 +1398,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, +@@ -1247,6 +1249,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, the same. */ - if (pv->disk && grub_disk_native_sectors (disk) >= grub_disk_native_sectors (pv->disk)) + if (pv->disk && grub_disk_native_sectors (disk) >= pv->part_size) return GRUB_ERR_NONE; + grub_dprintf ("diskfilter", "checking %s\n", disk->name); - if (disk->partition) - { - char *p = grub_partition_get_name (disk->partition); + pv->disk = grub_disk_open (disk->name); + if (!pv->disk) + return grub_errno; diff --git a/grub-core/disk/efi/efidisk.c b/grub-core/disk/efi/efidisk.c -index 3b5ed5691..822005456 100644 +index 3b5ed569133..822005456eb 100644 --- a/grub-core/disk/efi/efidisk.c +++ b/grub-core/disk/efi/efidisk.c @@ -865,6 +865,7 @@ grub_efidisk_get_device_name (grub_efi_handle_t *handle) @@ -45,7 +45,7 @@ index 3b5ed5691..822005456 100644 grub_free (dup_dp); diff --git a/grub-core/kern/device.c b/grub-core/kern/device.c -index 670e213cf..d01963747 100644 +index 670e213cf3c..d019637470d 100644 --- a/grub-core/kern/device.c +++ b/grub-core/kern/device.c @@ -34,6 +34,7 @@ grub_device_open (const char *name) @@ -57,7 +57,7 @@ index 670e213cf..d01963747 100644 { name = grub_env_get ("root"); diff --git a/grub-core/script/script.c b/grub-core/script/script.c -index ec4d4337c..844e8343c 100644 +index ec4d4337c66..844e8343ca7 100644 --- a/grub-core/script/script.c +++ b/grub-core/script/script.c @@ -22,6 +22,11 @@ @@ -72,6 +72,3 @@ index ec4d4337c..844e8343c 100644 /* It is not possible to deallocate the memory when a syntax error was found. Because of that it is required to keep track of all memory allocations. The memory is freed in case of an error, or assigned --- -2.41.0 - diff --git a/0087-Fix-race-in-EFI-validation.patch b/0087-Fix-race-in-EFI-validation.patch deleted file mode 100644 index ba483a2..0000000 --- a/0087-Fix-race-in-EFI-validation.patch +++ /dev/null @@ -1,92 +0,0 @@ -From e20e84d4e17a0818c4cb93ea89f0baac9a755cde Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Tue, 14 Jul 2015 16:58:51 -0700 -Subject: [PATCH 087/272] Fix race in EFI validation - ---- - grub-core/loader/i386/efi/linux.c | 40 +++++++------------------------ - 1 file changed, 9 insertions(+), 31 deletions(-) - -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 06814cae3..1e09c88ab 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -154,7 +154,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - grub_file_t file = 0; - struct linux_i386_kernel_header lh; - grub_ssize_t len, start, filelen; -- void *kernel; -+ void *kernel = NULL; - grub_err_t err; - - grub_dl_ref (my_mod); -@@ -185,10 +185,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - goto fail; - } - -- grub_file_seek (file, 0); -- -- grub_free(kernel); -- - params = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(16384)); - - if (! params) -@@ -199,13 +195,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - - grub_memset (params, 0, 16384); - -- if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh)) -- { -- if (!grub_errno) -- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -- argv[0]); -- goto fail; -- } -+ grub_memcpy (&lh, kernel, sizeof (lh)); - - if (lh.boot_flag != grub_cpu_to_le16 (0xaa55)) - { -@@ -271,26 +261,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - goto fail; - } - -- if (grub_file_seek (file, start) == (grub_off_t) -1) -- { -- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -- argv[0]); -- goto fail; -- } -- -- if (grub_file_read (file, kernel_mem, len) != len && !grub_errno) -- { -- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -- argv[0]); -- } -- -- if (grub_errno == GRUB_ERR_NONE) -- { -- grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); -- loaded = 1; -- lh.code32_start = (grub_uint32_t)(grub_addr_t) kernel_mem; -- } -+ grub_memcpy (kernel_mem, (char *)kernel + start, len); -+ grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); -+ loaded=1; - -+ lh.code32_start = (grub_uint32_t)(grub_uint64_t) kernel_mem; - /* Grub linuxefi erroneously initialize linux's boot_params with non-zero values. (bsc#1025563) - - From https://www.kernel.org/doc/Documentation/x86/boot.txt: -@@ -307,6 +282,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - if (file) - grub_file_close (file); - -+ if (kernel) -+ grub_free (kernel); -+ - if (grub_errno != GRUB_ERR_NONE) - { - grub_dl_unref (my_mod); --- -2.41.0 - diff --git a/0226-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch b/0088-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch similarity index 90% rename from 0226-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch rename to 0088-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch index 1ac102e..2868f23 100644 --- a/0226-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch +++ b/0088-Attempt-to-fix-up-all-the-places-Wsign-compare-error.patch @@ -1,8 +1,7 @@ -From e8d9eb2d14481e6dcccf0b070d57b755a5d40fe4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 11 Jul 2019 18:03:25 +0200 -Subject: [PATCH 226/272] Attempt to fix up all the places -Wsign-compare=error - finds. +Subject: [PATCH] Attempt to fix up all the places -Wsign-compare=error finds. Signed-off-by: Peter Jones --- @@ -18,10 +17,10 @@ Signed-off-by: Peter Jones 9 files changed, 16 insertions(+), 15 deletions(-) diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c -index 521220b49..1a50be8de 100644 +index 16c79bc9488..d145e5796b3 100644 --- a/grub-core/kern/emu/misc.c +++ b/grub-core/kern/emu/misc.c -@@ -188,7 +188,7 @@ grub_util_get_image_size (const char *path) +@@ -189,7 +189,7 @@ grub_util_get_image_size (const char *path) sz = ftello (f); if (sz < 0) grub_util_error (_("cannot open `%s': %s"), path, strerror (errno)); @@ -31,7 +30,7 @@ index 521220b49..1a50be8de 100644 ret = (size_t) sz; diff --git a/grub-core/lib/reed_solomon.c b/grub-core/lib/reed_solomon.c -index 562bd2e3e..5fee7f2a1 100644 +index 562bd2e3e3f..5fee7f2a1a4 100644 --- a/grub-core/lib/reed_solomon.c +++ b/grub-core/lib/reed_solomon.c @@ -162,7 +162,7 @@ static void @@ -53,7 +52,7 @@ index 562bd2e3e..5fee7f2a1 100644 { grub_size_t ds = (s + SECTOR_SIZE - 1 - i) / SECTOR_SIZE; diff --git a/grub-core/osdep/linux/blocklist.c b/grub-core/osdep/linux/blocklist.c -index 2efee2c2a..902cfee53 100644 +index 2efee2c2aee..902cfee53ae 100644 --- a/grub-core/osdep/linux/blocklist.c +++ b/grub-core/osdep/linux/blocklist.c @@ -109,7 +109,7 @@ grub_install_get_blocklist (grub_device_t root_dev, @@ -66,7 +65,7 @@ index 2efee2c2a..902cfee53 100644 + fie1.fm_mapped_extents * sizeof (fie1.fm_extents[1])); diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index b007cae66..5aa9e6d50 100644 +index 74a48c03026..477fb420992 100644 --- a/grub-core/osdep/linux/getroot.c +++ b/grub-core/osdep/linux/getroot.c @@ -233,7 +233,7 @@ grub_find_root_devices_from_btrfs (const char *dir) @@ -79,7 +78,7 @@ index b007cae66..5aa9e6d50 100644 fd = open (dir, 0); diff --git a/util/grub-fstest.c b/util/grub-fstest.c -index 25ae52ab6..982ce9ed7 100644 +index 25ae52ab6f4..982ce9ed7d8 100644 --- a/util/grub-fstest.c +++ b/util/grub-fstest.c @@ -329,7 +329,7 @@ cmd_cmp (char *src, char *dest) @@ -92,7 +91,7 @@ index 25ae52ab6..982ce9ed7 100644 fseek (ff, 0, SEEK_END); if (pre != ftell (ff)) diff --git a/util/grub-menulst2cfg.c b/util/grub-menulst2cfg.c -index b80e15cc3..1ea2a86e1 100644 +index b80e15cc36e..1ea2a86e129 100644 --- a/util/grub-menulst2cfg.c +++ b/util/grub-menulst2cfg.c @@ -34,7 +34,7 @@ main (int argc, char **argv) @@ -105,7 +104,7 @@ index b80e15cc3..1ea2a86e1 100644 grub_util_host_init (&argc, &argv); diff --git a/util/grub-mkfont.c b/util/grub-mkfont.c -index 7624d7808..e8a914021 100644 +index 7624d7808b7..e8a914021b2 100644 --- a/util/grub-mkfont.c +++ b/util/grub-mkfont.c @@ -143,7 +143,8 @@ add_glyph (struct grub_font_info *font_info, FT_UInt glyph_idx, FT_Face face, @@ -159,10 +158,10 @@ index 7624d7808..e8a914021 100644 add_pixel (&data, &mask, glyph->bitmap.buffer[i / 8 + j * glyph->bitmap.pitch] & diff --git a/util/grub-probe.c b/util/grub-probe.c -index 99c738e44..8a8e4f135 100644 +index 65c1ca3f8b6..08ae915e8d7 100644 --- a/util/grub-probe.c +++ b/util/grub-probe.c -@@ -868,7 +868,7 @@ argp_parser (int key, char *arg, struct argp_state *state) +@@ -799,7 +799,7 @@ argp_parser (int key, char *arg, struct argp_state *state) case 't': { @@ -172,7 +171,7 @@ index 99c738e44..8a8e4f135 100644 for (i = PRINT_FS; i < ARRAY_SIZE (targets); i++) if (strcmp (arg, targets[i]) == 0) diff --git a/util/setup.c b/util/setup.c -index 8b2780b4a..893389a91 100644 +index 87a889ff7e3..7aab468b0eb 100644 --- a/util/setup.c +++ b/util/setup.c @@ -406,7 +406,7 @@ SETUP (const char *dir, @@ -184,6 +183,3 @@ index 8b2780b4a..893389a91 100644 grub_fs_t fs; unsigned int nsec, maxsec; --- -2.41.0 - diff --git a/0227-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch b/0089-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch similarity index 37% rename from 0227-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch rename to 0089-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch index 112a7d4..668a20c 100644 --- a/0227-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch +++ b/0089-Don-t-use-Wno-sign-compare-Wno-conversion-Wno-error-.patch @@ -1,27 +1,47 @@ -From ffb3dc46e26565e76a280aeaec4b3e8f786985a4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 11 Jul 2019 18:20:37 +0200 -Subject: [PATCH 227/272] Don't use -Wno-sign-compare -Wno-conversion - -Wno-error, do use -Wextra. +Subject: [PATCH] Don't use -Wno-sign-compare -Wno-conversion -Wno-error, do + use -Wextra. + +Updated for grub-2.12 which introduced new sign comparison problems: +we're using -Wno-error=sign-compare Signed-off-by: Peter Jones --- + configure.ac | 8 ++++++++ conf/Makefile.common | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + 2 files changed, 9 insertions(+), 1 deletion(-) +diff --git a/configure.ac b/configure.ac +index 2175aa56997..81240397384 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2147,6 +2147,14 @@ if test x"$enable_werror" != xno ; then + fi + fi + ++AC_ARG_ENABLE([wextra], ++ [AS_HELP_STRING([--disable-wextra], ++ [do not use -Wextra when building GRUB])]) ++if test x"$enable_wextra" != xno ; then ++ TARGET_CFLAGS="$TARGET_CFLAGS -Wextra" ++ HOST_CFLAGS="$HOST_CFLAGS -Wextra" ++fi ++ + TARGET_CPP="$TARGET_CC -E" + TARGET_CCAS=$TARGET_CC + diff --git a/conf/Makefile.common b/conf/Makefile.common -index e19d12690..8a29aa12a 100644 +index 54f0f7f7664..e53ff352407 100644 --- a/conf/Makefile.common +++ b/conf/Makefile.common -@@ -77,7 +77,7 @@ grubconfdir = $(sysconfdir)/grub.d +@@ -76,7 +76,7 @@ grubconfdir = $(sysconfdir)/grub.d platformdir = $(pkglibdir)/$(target_cpu)-$(platform) starfielddir = $(pkgdatadir)/themes/starfield -CFLAGS_GNULIB = -Wno-undef -Wno-sign-compare -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Wno-conversion -Wno-error=attributes -+CFLAGS_GNULIB = -Wno-undef -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code ++CFLAGS_GNULIB = -Wno-undef -Wno-error=sign-compare -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Wno-error=attributes CPPFLAGS_GNULIB = -I$(top_builddir)/grub-core/lib/gnulib -I$(top_srcdir)/grub-core/lib/gnulib CFLAGS_POSIX = -fno-builtin --- -2.41.0 - diff --git a/0090-Fix-getroot.c-s-trampolines.patch b/0090-Fix-getroot.c-s-trampolines.patch new file mode 100644 index 0000000..b1f65de --- /dev/null +++ b/0090-Fix-getroot.c-s-trampolines.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 28 Sep 2018 15:42:19 -0400 +Subject: [PATCH] Fix getroot.c's trampolines. + +This makes the stack executable on most of the grub utilities, which is +bad, and rpmdiff complains about it. + +Signed-off-by: Peter Jones +--- + grub-core/osdep/linux/getroot.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index 477fb420992..b32582eb302 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -1261,22 +1261,20 @@ grub_util_get_grub_dev_os (const char *os_dev) + return grub_dev; + } + ++static void *mp = NULL; ++static void ++btrfs_mount_path_hook(const char *m) ++{ ++ mp = strdup (m); ++} + + char * + grub_util_get_btrfs_subvol (const char *path, char **mount_path) + { +- char *mp = NULL; +- + if (mount_path) + *mount_path = NULL; + +- auto void +- mount_path_hook (const char *m) +- { +- mp = strdup (m); +- } +- +- grub_find_root_btrfs_mount_path_hook = mount_path_hook; ++ grub_find_root_btrfs_mount_path_hook = btrfs_mount_path_hook; + grub_free (grub_find_root_devices_from_mountinfo (path, NULL)); + grub_find_root_btrfs_mount_path_hook = NULL; + diff --git a/0228-Do-not-allow-stack-trampolines-anywhere.patch b/0091-Do-not-allow-stack-trampolines-anywhere.patch similarity index 55% rename from 0228-Do-not-allow-stack-trampolines-anywhere.patch rename to 0091-Do-not-allow-stack-trampolines-anywhere.patch index 6531664..0c3b298 100644 --- a/0228-Do-not-allow-stack-trampolines-anywhere.patch +++ b/0091-Do-not-allow-stack-trampolines-anywhere.patch @@ -1,33 +1,20 @@ -From b4b00f9e46f23e1a8592d2fb345b785ba12342ac Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 12 Jul 2019 10:06:50 +0200 -Subject: [PATCH 228/272] Do not allow stack trampolines, anywhere. +Subject: [PATCH] Do not allow stack trampolines, anywhere. Signed-off-by: Peter Jones --- - conf/Makefile.common | 2 +- configure.ac | 3 +++ + conf/Makefile.common | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) -diff --git a/conf/Makefile.common b/conf/Makefile.common -index 8a29aa12a..3ce6a805d 100644 ---- a/conf/Makefile.common -+++ b/conf/Makefile.common -@@ -77,7 +77,7 @@ grubconfdir = $(sysconfdir)/grub.d - platformdir = $(pkglibdir)/$(target_cpu)-$(platform) - starfielddir = $(pkgdatadir)/themes/starfield - --CFLAGS_GNULIB = -Wno-undef -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -+CFLAGS_GNULIB = -Wno-undef -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Werror=trampolines -fno-trampolines - CPPFLAGS_GNULIB = -I$(top_builddir)/grub-core/lib/gnulib -I$(top_srcdir)/grub-core/lib/gnulib - - CFLAGS_POSIX = -fno-builtin diff --git a/configure.ac b/configure.ac -index 205a33a7f..25b249040 100644 +index 81240397384..ae7683d0693 100644 --- a/configure.ac +++ b/configure.ac -@@ -2156,6 +2156,9 @@ if test x"$enable_werror" != xno ; then - fi +@@ -2155,6 +2155,9 @@ if test x"$enable_wextra" != xno ; then + HOST_CFLAGS="$HOST_CFLAGS -Wextra" fi +TARGET_CFLAGS="$TARGET_CFLAGS -Werror=trampolines -fno-trampolines" @@ -36,6 +23,16 @@ index 205a33a7f..25b249040 100644 TARGET_CPP="$TARGET_CC -E" TARGET_CCAS=$TARGET_CC --- -2.41.0 - +diff --git a/conf/Makefile.common b/conf/Makefile.common +index e53ff352407..91ff6c905fb 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -76,7 +76,7 @@ grubconfdir = $(sysconfdir)/grub.d + platformdir = $(pkglibdir)/$(target_cpu)-$(platform) + starfielddir = $(pkgdatadir)/themes/starfield + +-CFLAGS_GNULIB = -Wno-undef -Wno-error=sign-compare -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Wno-error=attributes ++CFLAGS_GNULIB = -Wno-undef -Wno-error=sign-compare -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Wno-error=attributes -Werror=trampolines -fno-trampolines + CPPFLAGS_GNULIB = -I$(top_builddir)/grub-core/lib/gnulib -I$(top_srcdir)/grub-core/lib/gnulib + + CFLAGS_POSIX = -fno-builtin diff --git a/0229-Reimplement-boot_counter.patch b/0092-Reimplement-boot_counter.patch similarity index 93% rename from 0229-Reimplement-boot_counter.patch rename to 0092-Reimplement-boot_counter.patch index 8a1a3ba..1f0cb96 100644 --- a/0229-Reimplement-boot_counter.patch +++ b/0092-Reimplement-boot_counter.patch @@ -1,7 +1,7 @@ -From 37878080009e0efa051c4f9185607cee6a9b2c14 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 4 Oct 2018 14:22:09 -0400 -Subject: [PATCH 229/272] Reimplement boot_counter +Subject: [PATCH] Reimplement boot_counter This adds "increment" and "decrement" commands, and uses them to maintain our variables in 01_fallback_counter. It also simplifies the counter logic, so @@ -14,16 +14,16 @@ Signed-off-by: Peter Jones [lorbus: add comments and revert logic changes in 01_fallback_counting] Signed-off-by: Christian Glombek --- - Makefile.util.def | 6 ++ + Makefile.util.def | 6 +++ grub-core/Makefile.core.def | 5 ++ - grub-core/commands/increment.c | 105 ++++++++++++++++++++++++++++ - util/grub.d/01_fallback_counting.in | 22 ++++++ + grub-core/commands/increment.c | 105 ++++++++++++++++++++++++++++++++++++ + util/grub.d/01_fallback_counting.in | 22 ++++++++ 4 files changed, 138 insertions(+) create mode 100644 grub-core/commands/increment.c create mode 100644 util/grub.d/01_fallback_counting.in diff --git a/Makefile.util.def b/Makefile.util.def -index 7837701aa..014080636 100644 +index 01096ded815..0bb47c6d40a 100644 --- a/Makefile.util.def +++ b/Makefile.util.def @@ -461,6 +461,12 @@ script = { @@ -40,10 +40,10 @@ index 7837701aa..014080636 100644 name = '01_menu_auto_hide'; common = util/grub.d/01_menu_auto_hide.in; diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 422965704..e1ca1a6ee 100644 +index f26c689723c..08c0c67bcf2 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -412,6 +412,11 @@ kernel = { +@@ -417,6 +417,11 @@ kernel = { extra_dist = kern/mips/cache_flush.S; }; @@ -57,7 +57,7 @@ index 422965704..e1ca1a6ee 100644 mansection = 1; diff --git a/grub-core/commands/increment.c b/grub-core/commands/increment.c new file mode 100644 -index 000000000..79cf13765 +index 00000000000..79cf137656c --- /dev/null +++ b/grub-core/commands/increment.c @@ -0,0 +1,105 @@ @@ -168,7 +168,7 @@ index 000000000..79cf13765 +} diff --git a/util/grub.d/01_fallback_counting.in b/util/grub.d/01_fallback_counting.in new file mode 100644 -index 000000000..be0e770ea +index 00000000000..be0e770ea82 --- /dev/null +++ b/util/grub.d/01_fallback_counting.in @@ -0,0 +1,22 @@ @@ -194,6 +194,3 @@ index 000000000..be0e770ea + save_env boot_counter +fi +EOF --- -2.41.0 - diff --git a/0230-Fix-menu-entry-selection-based-on-ID-and-title.patch b/0093-Fix-menu-entry-selection-based-on-ID-and-title.patch similarity index 85% rename from 0230-Fix-menu-entry-selection-based-on-ID-and-title.patch rename to 0093-Fix-menu-entry-selection-based-on-ID-and-title.patch index a93194a..597e0c1 100644 --- a/0230-Fix-menu-entry-selection-based-on-ID-and-title.patch +++ b/0093-Fix-menu-entry-selection-based-on-ID-and-title.patch @@ -1,7 +1,7 @@ -From a171a110db45e43688dcb02c379b97dcaac66af6 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 19 Oct 2018 10:57:52 -0400 -Subject: [PATCH 230/272] Fix menu entry selection based on ID and title +Subject: [PATCH] Fix menu entry selection based on ID and title Currently if grub_strtoul(saved_entry_value, NULL, 0) does not return an error, we assume the value it has produced is a correct index into our @@ -20,14 +20,14 @@ Signed-off-by: Peter Jones [javierm: fix menu entry selection based on title] Signed-off-by: Javier Martinez Canillas --- - grub-core/normal/menu.c | 148 +++++++++++++++++++--------------------- - 1 file changed, 71 insertions(+), 77 deletions(-) + grub-core/normal/menu.c | 141 ++++++++++++++++++++++++------------------------ + 1 file changed, 71 insertions(+), 70 deletions(-) diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index c007f2db6..ae2728cb2 100644 +index 6444ee6f969..b0cfa32ddd8 100644 --- a/grub-core/normal/menu.c +++ b/grub-core/normal/menu.c -@@ -179,12 +179,12 @@ grub_menu_set_timeout (int timeout) +@@ -164,12 +164,12 @@ grub_menu_set_timeout (int timeout) } static int @@ -42,7 +42,7 @@ index c007f2db6..ae2728cb2 100644 { if (*ptr2 == '>' && ptr2[1] != '>' && *ptr1 == 0) return ptr2 - spec; -@@ -193,7 +193,11 @@ menuentry_eq (const char *id, const char *spec) +@@ -178,7 +178,11 @@ menuentry_eq (const char *id, const char *spec) if (*ptr2 == '>') ptr2++; if (*ptr1 != *ptr2) @@ -55,7 +55,7 @@ index c007f2db6..ae2728cb2 100644 if (*ptr1 == 0) return ptr1 - id; ptr1++; -@@ -202,6 +206,58 @@ menuentry_eq (const char *id, const char *spec) +@@ -187,6 +191,58 @@ menuentry_eq (const char *id, const char *spec) return 0; } @@ -114,7 +114,7 @@ index c007f2db6..ae2728cb2 100644 /* Get the first entry number from the value of the environment variable NAME, which is a space-separated list of non-negative integers. The entry number which is returned is stripped from the value of NAME. If no entry number -@@ -211,7 +267,6 @@ get_and_remove_first_entry_number (grub_menu_t menu, const char *name) +@@ -196,7 +252,6 @@ get_and_remove_first_entry_number (grub_menu_t menu, const char *name) { const char *val, *tail; int entry; @@ -122,7 +122,7 @@ index c007f2db6..ae2728cb2 100644 val = grub_env_get (name); if (! val) -@@ -219,50 +274,24 @@ get_and_remove_first_entry_number (grub_menu_t menu, const char *name) +@@ -204,50 +259,24 @@ get_and_remove_first_entry_number (grub_menu_t menu, const char *name) grub_error_push (); @@ -181,7 +181,7 @@ index c007f2db6..ae2728cb2 100644 } grub_error_pop (); -@@ -548,6 +577,7 @@ static int +@@ -524,6 +553,7 @@ static int get_entry_number (grub_menu_t menu, const char *name) { const char *val; @@ -189,10 +189,11 @@ index c007f2db6..ae2728cb2 100644 int entry; val = grub_env_get (name); -@@ -556,45 +586,9 @@ get_entry_number (grub_menu_t menu, const char *name) +@@ -531,38 +561,9 @@ get_entry_number (grub_menu_t menu, const char *name) + return -1; grub_error_push (); - +- - entry = (int) grub_strtoul (val, 0, 0); - - if (grub_errno == GRUB_ERR_BAD_NUMBER) @@ -201,10 +202,6 @@ index c007f2db6..ae2728cb2 100644 - grub_menu_entry_t e = menu->entry_list; - int i; - -- /* Skip hidden entries */ -- while (e && e->hidden) -- e = e->next; -- - grub_errno = GRUB_ERR_NONE; - - for (i = 0; e; i++) @@ -216,10 +213,6 @@ index c007f2db6..ae2728cb2 100644 - break; - } - e = e->next; -- -- /* Skip hidden entries */ -- while (e && e->hidden) -- e = e->next; - } - - if (! e) @@ -238,6 +231,3 @@ index c007f2db6..ae2728cb2 100644 grub_error_pop (); return entry; --- -2.41.0 - diff --git a/0231-Make-the-menu-entry-users-option-argument-to-be-opti.patch b/0094-Make-the-menu-entry-users-option-argument-to-be-opti.patch similarity index 86% rename from 0231-Make-the-menu-entry-users-option-argument-to-be-opti.patch rename to 0094-Make-the-menu-entry-users-option-argument-to-be-opti.patch index 759163c..e0d36db 100644 --- a/0231-Make-the-menu-entry-users-option-argument-to-be-opti.patch +++ b/0094-Make-the-menu-entry-users-option-argument-to-be-opti.patch @@ -1,8 +1,7 @@ -From cee2a2b9d459b135f56cc14f6fc47178bf59a118 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 26 Nov 2018 10:06:42 +0100 -Subject: [PATCH 231/272] Make the menu entry users option argument to be - optional +Subject: [PATCH] Make the menu entry users option argument to be optional The --users option is used to restrict the access to specific menu entries only to a set of users. But the option requires an argument to either be a @@ -24,7 +23,7 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c -index ccee44ecf..787dc978a 100644 +index b194123eb67..b175a1b43b7 100644 --- a/grub-core/commands/menuentry.c +++ b/grub-core/commands/menuentry.c @@ -29,7 +29,7 @@ static const struct grub_arg_option options[] = @@ -36,7 +35,7 @@ index ccee44ecf..787dc978a 100644 N_("List of users allowed to boot this entry."), N_("USERNAME[,USERNAME]"), ARG_TYPE_STRING}, {"hotkey", 3, 0, -@@ -286,7 +286,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) +@@ -281,7 +281,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) if (! ctxt->state[3].set && ! ctxt->script) return grub_error (GRUB_ERR_BAD_ARGUMENT, "no menuentry definition"); @@ -45,6 +44,3 @@ index ccee44ecf..787dc978a 100644 users = ctxt->state[1].arg; else if (ctxt->state[5].set) users = NULL; --- -2.41.0 - diff --git a/0233-Add-efi-export-env-and-efi-load-env-commands.patch b/0095-Add-efi-export-env-and-efi-load-env-commands.patch similarity index 89% rename from 0233-Add-efi-export-env-and-efi-load-env-commands.patch rename to 0095-Add-efi-export-env-and-efi-load-env-commands.patch index b71237f..6a5abef 100644 --- a/0233-Add-efi-export-env-and-efi-load-env-commands.patch +++ b/0095-Add-efi-export-env-and-efi-load-env-commands.patch @@ -1,7 +1,7 @@ -From 4ed3182df854708eecc1d600d5cdb65ca5d61094 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 16 Jan 2019 13:21:46 -0500 -Subject: [PATCH 233/272] Add efi-export-env and efi-load-env commands +Subject: [PATCH] Add efi-export-env and efi-load-env commands This adds "efi-export-env VARIABLE" and "efi-load-env", which manipulate the environment block stored in the EFI variable @@ -10,21 +10,21 @@ GRUB_ENV-91376aff-cba6-42be-949d-06fde81128e8. Signed-off-by: Peter Jones --- grub-core/Makefile.core.def | 6 ++ - grub-core/commands/efi/env.c | 168 +++++++++++++++++++++++++++++++++++ + grub-core/commands/efi/env.c | 168 +++++++++++++++++++++++++++++++++++++++++++ grub-core/kern/efi/efi.c | 3 + grub-core/kern/efi/init.c | 5 -- - grub-core/lib/envblk.c | 43 +++++++++ - include/grub/efi/efi.h | 6 ++ - include/grub/lib/envblk.h | 3 + + grub-core/lib/envblk.c | 43 +++++++++++ util/grub-set-bootflag.c | 1 + - 8 files changed, 230 insertions(+), 5 deletions(-) + include/grub/efi/efi.h | 5 ++ + include/grub/lib/envblk.h | 3 + + 8 files changed, 229 insertions(+), 5 deletions(-) create mode 100644 grub-core/commands/efi/env.c diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index cfb71cc4e..f7e594b82 100644 +index 08c0c67bcf2..4aa20cdfc13 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -838,6 +838,12 @@ module = { +@@ -842,6 +842,12 @@ module = { enable = efi; }; @@ -39,7 +39,7 @@ index cfb71cc4e..f7e594b82 100644 efi = commands/efi/efifwsetup.c; diff --git a/grub-core/commands/efi/env.c b/grub-core/commands/efi/env.c new file mode 100644 -index 000000000..45f107ccd +index 00000000000..45f107ccd5b --- /dev/null +++ b/grub-core/commands/efi/env.c @@ -0,0 +1,168 @@ @@ -212,10 +212,10 @@ index 000000000..45f107ccd + grub_unregister_command (loadenv_cmd); +} diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c -index b674816aa..02f18a28f 100644 +index bf16c4307bc..ef837387368 100644 --- a/grub-core/kern/efi/efi.c +++ b/grub-core/kern/efi/efi.c -@@ -222,6 +222,9 @@ grub_efi_set_variable_with_attributes (const char *var, const grub_guid_t *guid, +@@ -227,6 +227,9 @@ grub_efi_set_variable_with_attributes (const char *var, const grub_guid_t *guid, if (status == GRUB_EFI_SUCCESS) return GRUB_ERR_NONE; @@ -226,7 +226,7 @@ index b674816aa..02f18a28f 100644 } diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c -index c77b54892..fdc6c97d1 100644 +index b5201974a76..dee3918fd35 100644 --- a/grub-core/kern/efi/init.c +++ b/grub-core/kern/efi/init.c @@ -106,11 +106,6 @@ stack_protector_init (void) @@ -242,10 +242,10 @@ index c77b54892..fdc6c97d1 100644 static int set_var (const char *name, const char *value, diff --git a/grub-core/lib/envblk.c b/grub-core/lib/envblk.c -index 24efbe7ff..c1c5ad4fa 100644 +index 2e4e78b132d..874506da169 100644 --- a/grub-core/lib/envblk.c +++ b/grub-core/lib/envblk.c -@@ -235,6 +235,49 @@ grub_envblk_delete (grub_envblk_t envblk, const char *name) +@@ -223,6 +223,49 @@ grub_envblk_delete (grub_envblk_t envblk, const char *name) } } @@ -295,25 +295,36 @@ index 24efbe7ff..c1c5ad4fa 100644 void grub_envblk_iterate (grub_envblk_t envblk, void *hook_data, +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index d506f7e75bc..a6ccc113839 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -25,6 +25,7 @@ + + #include /* For *_DIR_NAME defines */ + #include ++#include + #include /* For GRUB_ENVBLK_DEFCFG define */ + #include + #include diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h -index 87aa1ce25..1108d0c07 100644 +index 8d98203a784..6c2c1f36e37 100644 --- a/include/grub/efi/efi.h +++ b/include/grub/efi/efi.h -@@ -27,6 +27,12 @@ - - #define GRUB_LINUX_ARM_MAGIC_SIGNATURE 0x016f2818 +@@ -36,6 +36,11 @@ struct linux_arch_kernel_header { + struct grub_pe_image_header pe_image_header; + }; +#define GRUB_EFI_GRUB_VARIABLE_GUID \ + { 0x91376aff, 0xcba6, 0x42be, \ + { 0x94, 0x9d, 0x06, 0xfd, 0xe8, 0x11, 0x28, 0xe8 } \ + } + -+ - struct linux_arch_kernel_header { - grub_uint32_t code0; - grub_uint32_t code1; + /* Variables. */ + extern grub_efi_system_table_t *EXPORT_VAR(grub_efi_system_table); + extern grub_efi_handle_t EXPORT_VAR(grub_efi_image_handle); diff --git a/include/grub/lib/envblk.h b/include/grub/lib/envblk.h -index d01927bcf..a2a8c2ccb 100644 +index c3e65592170..ab969af2461 100644 --- a/include/grub/lib/envblk.h +++ b/include/grub/lib/envblk.h @@ -22,6 +22,8 @@ @@ -324,27 +335,12 @@ index d01927bcf..a2a8c2ccb 100644 + #ifndef ASM_FILE - #include -@@ -37,6 +39,7 @@ typedef struct grub_envblk *grub_envblk_t; - char *grub_envblk_buf (grub_size_t size); + struct grub_envblk +@@ -33,6 +35,7 @@ typedef struct grub_envblk *grub_envblk_t; + grub_envblk_t grub_envblk_open (char *buf, grub_size_t size); int grub_envblk_set (grub_envblk_t envblk, const char *name, const char *value); +grub_err_t grub_envblk_get (grub_envblk_t envblk, const char * const name, char ** const value); void grub_envblk_delete (grub_envblk_t envblk, const char *name); void grub_envblk_iterate (grub_envblk_t envblk, void *hook_data, -diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index d506f7e75..a6ccc1138 100644 ---- a/util/grub-set-bootflag.c -+++ b/util/grub-set-bootflag.c -@@ -25,6 +25,7 @@ - - #include /* For *_DIR_NAME defines */ - #include -+#include - #include /* For GRUB_ENVBLK_DEFCFG define */ - #include - #include --- -2.41.0 - diff --git a/0096-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch b/0096-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch deleted file mode 100644 index c52e3a5..0000000 --- a/0096-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 561ca00e206680d2e75a184cf515ba9a37b2cce8 Mon Sep 17 00:00:00 2001 -From: David Abdurachmanov -Date: Thu, 16 Jan 2020 13:10:10 +0100 -Subject: [PATCH 096/272] Also define GRUB_EFI_MAX_ALLOCATION_ADDRESS for - RISC-V - -The commit "Try to pick better locations for kernel and initrd" missed to -define this macro for the RISC-V (riscv64) architecture, so add it there. - -Signed-off-by: David Abdurachmanov ---- - include/grub/riscv64/efi/memory.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/grub/riscv64/efi/memory.h b/include/grub/riscv64/efi/memory.h -index c6cb32417..acb61dca4 100644 ---- a/include/grub/riscv64/efi/memory.h -+++ b/include/grub/riscv64/efi/memory.h -@@ -2,5 +2,6 @@ - #include - - #define GRUB_EFI_MAX_USABLE_ADDRESS 0xffffffffffffULL -+#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS - - #endif /* ! GRUB_MEMORY_CPU_HEADER */ --- -2.41.0 - diff --git a/0234-Export-all-variables-from-the-initial-context-when-c.patch b/0096-Export-all-variables-from-the-initial-context-when-c.patch similarity index 80% rename from 0234-Export-all-variables-from-the-initial-context-when-c.patch rename to 0096-Export-all-variables-from-the-initial-context-when-c.patch index cb063bf..a35174b 100644 --- a/0234-Export-all-variables-from-the-initial-context-when-c.patch +++ b/0096-Export-all-variables-from-the-initial-context-when-c.patch @@ -1,8 +1,8 @@ -From 7b1445a07277a192865068b940674e21e435747c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 22 Jan 2019 15:40:25 +0100 -Subject: [PATCH 234/272] Export all variables from the initial context when - creating a submenu +Subject: [PATCH] Export all variables from the initial context when creating a + submenu When a submenu is created, only the exported variables are copied to the new menu context. But we want the variables to be global, so export lets @@ -17,7 +17,7 @@ Signed-off-by: Javier Martinez Canillas 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/grub-core/normal/context.c b/grub-core/normal/context.c -index ba185e915..b4baa4392 100644 +index ba185e91599..b4baa4392cd 100644 --- a/grub-core/normal/context.c +++ b/grub-core/normal/context.c @@ -99,7 +99,7 @@ grub_env_new_context (int export_all) @@ -30,10 +30,10 @@ index ba185e915..b4baa4392 100644 int grub_extractor_level = 0; diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index ae2728cb2..d58dbe443 100644 +index b0cfa32ddd8..30ddcea0c11 100644 --- a/grub-core/normal/menu.c +++ b/grub-core/normal/menu.c -@@ -390,8 +390,6 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) +@@ -375,8 +375,6 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) if (ptr && ptr[0] && ptr[1]) grub_env_set ("default", ptr + 1); @@ -42,6 +42,3 @@ index ae2728cb2..d58dbe443 100644 grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); --- -2.41.0 - diff --git a/0235-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch b/0097-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch similarity index 89% rename from 0235-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch rename to 0097-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch index 391a631..08cc563 100644 --- a/0235-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch +++ b/0097-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch @@ -1,8 +1,8 @@ -From c7139da4c4eeea0790660ae7e872178f05ff9331 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Christian Glombek Date: Tue, 2 Apr 2019 16:22:21 +0200 -Subject: [PATCH 235/272] grub.d: Split out boot success reset from menu auto - hide script +Subject: [PATCH] grub.d: Split out boot success reset from menu auto hide + script Also rename fallback and menu auto hide script to be executed before and after boot success reset script. @@ -11,17 +11,17 @@ In menu auto hide script, rename last_boot_ok var to menu_hide_ok Signed-off-by: Christian Glombek Signed-off-by: Robbie Harwood --- - Makefile.util.def | 14 ++++++++--- - ...ck_counting.in => 08_fallback_counting.in} | 14 ++++++----- - util/grub.d/10_reset_boot_success.in | 25 +++++++++++++++++++ - ...menu_auto_hide.in => 12_menu_auto_hide.in} | 23 ++++------------- + Makefile.util.def | 14 ++++++++---- + ...allback_counting.in => 08_fallback_counting.in} | 14 ++++++------ + util/grub.d/10_reset_boot_success.in | 25 ++++++++++++++++++++++ + .../{01_menu_auto_hide.in => 12_menu_auto_hide.in} | 23 +++++--------------- 4 files changed, 48 insertions(+), 28 deletions(-) rename util/grub.d/{01_fallback_counting.in => 08_fallback_counting.in} (65%) create mode 100644 util/grub.d/10_reset_boot_success.in rename util/grub.d/{01_menu_auto_hide.in => 12_menu_auto_hide.in} (58%) diff --git a/Makefile.util.def b/Makefile.util.def -index 014080636..b1c75e9d2 100644 +index 0bb47c6d40a..885dc688a60 100644 --- a/Makefile.util.def +++ b/Makefile.util.def @@ -462,14 +462,14 @@ script = { @@ -43,7 +43,7 @@ index 014080636..b1c75e9d2 100644 installdir = grubconf; }; -@@ -528,6 +528,12 @@ script = { +@@ -521,6 +521,12 @@ script = { condition = COND_HOST_LINUX; }; @@ -60,7 +60,7 @@ diff --git a/util/grub.d/01_fallback_counting.in b/util/grub.d/08_fallback_count similarity index 65% rename from util/grub.d/01_fallback_counting.in rename to util/grub.d/08_fallback_counting.in -index be0e770ea..2e2c3ff7d 100644 +index be0e770ea82..2e2c3ff7d31 100644 --- a/util/grub.d/01_fallback_counting.in +++ b/util/grub.d/08_fallback_counting.in @@ -1,15 +1,17 @@ @@ -89,7 +89,7 @@ index be0e770ea..2e2c3ff7d 100644 set boot_counter=-1 diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in new file mode 100644 -index 000000000..6c88d933d +index 00000000000..6c88d933dde --- /dev/null +++ b/util/grub.d/10_reset_boot_success.in @@ -0,0 +1,25 @@ @@ -122,7 +122,7 @@ diff --git a/util/grub.d/01_menu_auto_hide.in b/util/grub.d/12_menu_auto_hide.in similarity index 58% rename from util/grub.d/01_menu_auto_hide.in rename to util/grub.d/12_menu_auto_hide.in -index ad175870a..6a7c0fa0d 100644 +index ad175870a54..6a7c0fa0d43 100644 --- a/util/grub.d/01_menu_auto_hide.in +++ b/util/grub.d/12_menu_auto_hide.in @@ -1,5 +1,8 @@ @@ -166,6 +166,3 @@ index ad175870a..6a7c0fa0d 100644 set orig_timeout_style=\${timeout_style} set orig_timeout=\${timeout} if [ "\${fastboot}" = "1" ]; then --- -2.41.0 - diff --git a/0098-Don-t-assume-that-boot-commands-will-only-return-on-.patch b/0098-Don-t-assume-that-boot-commands-will-only-return-on-.patch new file mode 100644 index 0000000..06c6581 --- /dev/null +++ b/0098-Don-t-assume-that-boot-commands-will-only-return-on-.patch @@ -0,0 +1,97 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 9 Apr 2019 13:12:40 +0200 +Subject: [PATCH] Don't assume that boot commands will only return on fail + +While it's true that for most loaders the boot command never returns, it +may be the case that it does. For example the GRUB emulator boot command +calls to systemctl kexec which in turn does an asynchonous call to kexec. + +So in this case GRUB will wrongly assume that the boot command fails and +print a "Failed to boot both default and fallback entries" even when the +kexec call later succeeds. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/normal/menu.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index 30ddcea0c11..cda10fa8b3f 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -285,7 +285,7 @@ get_and_remove_first_entry_number (grub_menu_t menu, const char *name) + } + + /* Run a menu entry. */ +-static void ++static grub_err_t + grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + { + grub_err_t err = GRUB_ERR_NONE; +@@ -302,7 +302,7 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + { + grub_print_error (); + grub_errno = GRUB_ERR_NONE; +- return; ++ return grub_errno; + } + + errs_before = grub_err_printed_errors; +@@ -315,7 +315,7 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + grub_env_context_open (); + menu = grub_zalloc (sizeof (*menu)); + if (! menu) +- return; ++ return grub_errno; + grub_env_set_menu (menu); + if (auto_boot) + grub_env_set ("timeout", "0"); +@@ -385,7 +385,7 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + + if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ()) + /* Implicit execution of boot, only if something is loaded. */ +- grub_command_execute ("boot", 0, 0); ++ err = grub_command_execute ("boot", 0, 0); + + if (errs_before != grub_err_printed_errors) + grub_wait_after_message (); +@@ -408,6 +408,8 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + else + grub_env_unset ("default"); + grub_env_unset ("timeout"); ++ ++ return err; + } + + /* Execute ENTRY from the menu MENU, falling back to entries specified +@@ -422,10 +424,13 @@ grub_menu_execute_with_fallback (grub_menu_t menu, + void *callback_data) + { + int fallback_entry; ++ grub_err_t err; + + callback->notify_booting (entry, callback_data); + +- grub_menu_execute_entry (entry, 1); ++ err = grub_menu_execute_entry (entry, 1); ++ if (err == GRUB_ERR_NONE) ++ return; + + /* Deal with fallback entries. */ + while ((fallback_entry = get_and_remove_first_entry_number (menu, "fallback")) +@@ -436,11 +441,9 @@ grub_menu_execute_with_fallback (grub_menu_t menu, + + entry = grub_menu_get_entry (menu, fallback_entry); + callback->notify_fallback (entry, callback_data); +- grub_menu_execute_entry (entry, 1); +- /* If the function call to execute the entry returns at all, then this is +- taken to indicate a boot failure. For menu entries that do something +- other than actually boot an operating system, this could assume +- incorrectly that something failed. */ ++ err = grub_menu_execute_entry (entry, 1); ++ if (err == GRUB_ERR_NONE) ++ return; + } + + if (!autobooted) diff --git a/0236-grub-set-bootflag-Update-comment-about-running-as-ro.patch b/0099-grub-set-bootflag-Update-comment-about-running-as-ro.patch similarity index 79% rename from 0236-grub-set-bootflag-Update-comment-about-running-as-ro.patch rename to 0099-grub-set-bootflag-Update-comment-about-running-as-ro.patch index 820afd9..4fa4df4 100644 --- a/0236-grub-set-bootflag-Update-comment-about-running-as-ro.patch +++ b/0099-grub-set-bootflag-Update-comment-about-running-as-ro.patch @@ -1,8 +1,8 @@ -From f9dea851a9a26624de85ed29e3347dbf64ab944f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 12:15:43 +0100 -Subject: [PATCH 236/272] grub-set-bootflag: Update comment about running as - root through pkexec +Subject: [PATCH] grub-set-bootflag: Update comment about running as root + through pkexec We have stopped using pkexec for grub-set-bootflag, instead it is now installed suid root, update the comment accordingly. @@ -13,7 +13,7 @@ Signed-off-by: Hans de Goede 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index a6ccc1138..3eb04beb5 100644 +index a6ccc113839..3eb04beb5e7 100644 --- a/util/grub-set-bootflag.c +++ b/util/grub-set-bootflag.c @@ -18,7 +18,7 @@ @@ -25,6 +25,3 @@ index a6ccc1138..3eb04beb5 100644 * use any grub library / util functions to allow for easy auditing. * The grub headers are only included to get certain defines. */ --- -2.41.0 - diff --git a/0237-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch b/0100-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch similarity index 95% rename from 0237-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch rename to 0100-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch index ceaf775..ab3f79e 100644 --- a/0237-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch +++ b/0100-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch @@ -1,8 +1,7 @@ -From 19c318515b02498a48d5d5172b0349d203b73a69 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 13:02:01 +0100 -Subject: [PATCH 237/272] grub-set-bootflag: Write new env to tmpfile and then - rename +Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename Make the grubenv writing code in grub-set-bootflag more robust by writing the modified grubenv to a tmpfile first and then renaming the @@ -10,11 +9,11 @@ tmpfile over the old grubenv (following symlinks). Signed-off-by: Hans de Goede --- - util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++----- + util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 78 insertions(+), 9 deletions(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index 3eb04beb5..3b4c25ca2 100644 +index 3eb04beb5e7..3b4c25ca2ac 100644 --- a/util/grub-set-bootflag.c +++ b/util/grub-set-bootflag.c @@ -28,7 +28,9 @@ @@ -151,6 +150,3 @@ index 3eb04beb5..3b4c25ca2 100644 return 0; } --- -2.41.0 - diff --git a/0238-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0101-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch similarity index 94% rename from 0238-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch rename to 0101-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch index 29f31f4..a32c146 100644 --- a/0238-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch +++ b/0101-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch @@ -1,8 +1,8 @@ -From 3e1ebc32e76de3c448ea58e6e1ab253badaaf49c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH 238/272] grub.d: Fix boot_indeterminate getting set on - boot_success=0 boot +Subject: [PATCH] grub.d: Fix boot_indeterminate getting set on boot_success=0 + boot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -53,7 +53,7 @@ Signed-off-by: Robbie Harwood 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in -index 6c88d933d..e73f4137b 100644 +index 6c88d933dde..e73f4137b36 100644 --- a/util/grub.d/10_reset_boot_success.in +++ b/util/grub.d/10_reset_boot_success.in @@ -6,18 +6,18 @@ @@ -79,6 +79,3 @@ index 6c88d933d..e73f4137b 100644 fi # Reset boot_success for current boot set boot_success=0 --- -2.41.0 - diff --git a/0239-Add-start-symbol-for-RISC-V.patch b/0102-Add-start-symbol-for-RISC-V.patch similarity index 81% rename from 0239-Add-start-symbol-for-RISC-V.patch rename to 0102-Add-start-symbol-for-RISC-V.patch index a0ad171..677efae 100644 --- a/0239-Add-start-symbol-for-RISC-V.patch +++ b/0102-Add-start-symbol-for-RISC-V.patch @@ -1,7 +1,7 @@ -From 5b62c1f7f7e06198f085756c6c52a5b4f4c45186 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Sat, 9 Nov 2019 19:51:57 +0000 -Subject: [PATCH 239/272] Add start symbol for RISC-V +Subject: [PATCH] Add start symbol for RISC-V All other architectures have start symbol. @@ -15,7 +15,7 @@ Signed-off-by: David Abdurachmanov 1 file changed, 1 insertion(+) diff --git a/grub-core/kern/riscv/efi/startup.S b/grub-core/kern/riscv/efi/startup.S -index f2a7b2b1e..781773136 100644 +index f2a7b2b1ede..781773136e8 100644 --- a/grub-core/kern/riscv/efi/startup.S +++ b/grub-core/kern/riscv/efi/startup.S @@ -29,6 +29,7 @@ @@ -26,6 +26,3 @@ index f2a7b2b1e..781773136 100644 FUNCTION(_start) /* * EFI_SYSTEM_TABLE and EFI_HANDLE are passed in a1/a0. --- -2.41.0 - diff --git a/0240-bootstrap.conf-Force-autogen.sh-to-use-python3.patch b/0103-bootstrap.conf-Force-autogen.sh-to-use-python3.patch similarity index 85% rename from 0240-bootstrap.conf-Force-autogen.sh-to-use-python3.patch rename to 0103-bootstrap.conf-Force-autogen.sh-to-use-python3.patch index ed9c01f..c25b28e 100644 --- a/0240-bootstrap.conf-Force-autogen.sh-to-use-python3.patch +++ b/0103-bootstrap.conf-Force-autogen.sh-to-use-python3.patch @@ -1,7 +1,7 @@ -From bbe30eab66c0a212f502a8bd4794b3db985d954f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 15 Jan 2020 12:47:46 +0100 -Subject: [PATCH 240/272] bootstrap.conf: Force autogen.sh to use python3 +Subject: [PATCH] bootstrap.conf: Force autogen.sh to use python3 The python-unversioned-command package is not installed in the buildroot, but the bootstrap script expects the python command to be present if one @@ -19,7 +19,7 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bootstrap.conf b/bootstrap.conf -index 7a7813d28..60de0597c 100644 +index 7a7813d2825..60de0597c50 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -94,7 +94,7 @@ bootstrap_post_import_hook () { @@ -31,6 +31,3 @@ index 7a7813d28..60de0597c 100644 set +e # bootstrap expects this } --- -2.41.0 - diff --git a/0241-efi-http-Export-fw-http-_path-variables-to-make-them.patch b/0104-efi-http-Export-fw-http-_path-variables-to-make-them.patch similarity index 83% rename from 0241-efi-http-Export-fw-http-_path-variables-to-make-them.patch rename to 0104-efi-http-Export-fw-http-_path-variables-to-make-them.patch index ca42d45..55cce24 100644 --- a/0241-efi-http-Export-fw-http-_path-variables-to-make-them.patch +++ b/0104-efi-http-Export-fw-http-_path-variables-to-make-them.patch @@ -1,8 +1,7 @@ -From 4f731fbffca98770a59a2eedb486a620a2bf239c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 5 Mar 2020 16:21:47 +0100 -Subject: [PATCH 241/272] efi/http: Export {fw,http}_path variables to make - them global +Subject: [PATCH] efi/http: Export {fw,http}_path variables to make them global The fw_path environment variable is used by http_configure() function to determine the HTTP path that should be used as prefix when using relative @@ -26,7 +25,7 @@ Signed-off-by: Javier Martinez Canillas 2 files changed, 2 insertions(+) diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 5f69ffd38..e396be9b2 100644 +index 7347a8de676..353a62ef1e1 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c @@ -143,6 +143,7 @@ grub_set_prefix_and_root (void) @@ -38,10 +37,10 @@ index 5f69ffd38..e396be9b2 100644 grub_free (fw_path); } diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c -index ebbb3f0b4..b20e99100 100644 +index 5e97f5d5e70..3be86c141f5 100644 --- a/grub-core/net/efi/http.c +++ b/grub-core/net/efi/http.c -@@ -40,6 +40,7 @@ http_configure (struct grub_efi_net_device *dev, int prefer_ip6) +@@ -39,6 +39,7 @@ http_configure (struct grub_efi_net_device *dev, int prefer_ip6) http_path++; grub_env_unset ("http_path"); grub_env_set ("http_path", http_path); @@ -49,6 +48,3 @@ index ebbb3f0b4..b20e99100 100644 } } --- -2.41.0 - diff --git a/0242-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch b/0105-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch similarity index 78% rename from 0242-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch rename to 0105-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch index 3b9e814..30d206e 100644 --- a/0242-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch +++ b/0105-efi-http-Enclose-literal-IPv6-addresses-in-square-br.patch @@ -1,8 +1,7 @@ -From 87aca3738c9c8168e43349910eed08ebbc779a77 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 5 Mar 2020 16:21:58 +0100 -Subject: [PATCH 242/272] efi/http: Enclose literal IPv6 addresses in square - brackets +Subject: [PATCH] efi/http: Enclose literal IPv6 addresses in square brackets According to RFC 2732 (https://www.ietf.org/rfc/rfc2732.txt), literal IPv6 addresses must be enclosed in square brackets. But GRUB currently does not @@ -40,14 +39,14 @@ Resolves: rhbz#1732765 Signed-off-by: Javier Martinez Canillas --- - grub-core/net/efi/http.c | 36 +++++++++++++++++++++++++++--------- - 1 file changed, 27 insertions(+), 9 deletions(-) + grub-core/net/efi/http.c | 37 ++++++++++++++++++++++++++++--------- + 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c -index b20e99100..5b4ebfb99 100644 +index 3be86c141f5..c37c359c713 100644 --- a/grub-core/net/efi/http.c +++ b/grub-core/net/efi/http.c -@@ -159,13 +159,7 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, +@@ -158,13 +158,7 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, grub_efi_status_t status; grub_efi_boot_services_t *b = grub_efi_system_table->boot_services; char *url = NULL; @@ -62,8 +61,8 @@ index b20e99100..5b4ebfb99 100644 { grub_efi_ipv6_address_t address; -@@ -176,10 +170,24 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, - grub_size_t sz; +@@ -174,9 +168,24 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, + const char *protocol = (use_https == 1) ? "https" : "http"; if (grub_efi_string_to_ip6_address (server, &address, &rest) && *rest == 0) - url = grub_xasprintf ("%s://[%s]%s", protocol, server, name); @@ -82,14 +81,14 @@ index b20e99100..5b4ebfb99 100644 + } + } else -+ { - url = grub_xasprintf ("%s://%s%s", protocol, server, name); -- -+ } +- url = grub_xasprintf ("%s://%s%s", protocol, server, name); ++ { ++ url = grub_xasprintf ("%s://%s%s", protocol, server, name); ++ } + if (!url) { - return grub_errno; -@@ -204,6 +212,13 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, +@@ -199,6 +208,13 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, request_data.url = ucs2_url; } @@ -103,16 +102,13 @@ index b20e99100..5b4ebfb99 100644 request_data.method = (headeronly > 0) ? GRUB_EFI_HTTPMETHODHEAD : GRUB_EFI_HTTPMETHODGET; request_message.data.request = &request_data; -@@ -233,6 +248,9 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, +@@ -225,6 +241,9 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, - status = http->request (http, &request_token); + status = http->request(http, &request_token); + if (hostname) + grub_free (hostname); + if (status != GRUB_EFI_SUCCESS) { - b->close_event (request_token.event); --- -2.41.0 - + b->close_event(request_token.event); diff --git a/0243-efi-net-Allow-to-specify-a-port-number-in-addresses.patch b/0106-efi-net-Allow-to-specify-a-port-number-in-addresses.patch similarity index 81% rename from 0243-efi-net-Allow-to-specify-a-port-number-in-addresses.patch rename to 0106-efi-net-Allow-to-specify-a-port-number-in-addresses.patch index d239dd7..96ebab3 100644 --- a/0243-efi-net-Allow-to-specify-a-port-number-in-addresses.patch +++ b/0106-efi-net-Allow-to-specify-a-port-number-in-addresses.patch @@ -1,7 +1,7 @@ -From 38f78bee8dcd3495f478398e7cb1db42b2cd89e8 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 9 Mar 2020 15:29:45 +0100 -Subject: [PATCH 243/272] efi/net: Allow to specify a port number in addresses +Subject: [PATCH] efi/net: Allow to specify a port number in addresses The grub_efi_net_parse_address() function is not covering the case where a port number is specified in an IPv4 or IPv6 address, so will fail to parse @@ -25,10 +25,10 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c -index b5b870c6f..175ab6d4f 100644 +index 1f7e1b63557..4ef3f709ee2 100644 --- a/grub-core/net/efi/net.c +++ b/grub-core/net/efi/net.c -@@ -751,7 +751,7 @@ grub_efi_net_parse_address (const char *address, +@@ -742,7 +742,7 @@ grub_efi_net_parse_address (const char *address, return GRUB_ERR_NONE; } } @@ -37,7 +37,7 @@ index b5b870c6f..175ab6d4f 100644 { grub_uint32_t subnet_mask = 0xffffffffU; grub_memcpy (ip4->subnet_mask, &subnet_mask, sizeof (ip4->subnet_mask)); -@@ -777,7 +777,7 @@ grub_efi_net_parse_address (const char *address, +@@ -768,7 +768,7 @@ grub_efi_net_parse_address (const char *address, return GRUB_ERR_NONE; } } @@ -46,6 +46,3 @@ index b5b870c6f..175ab6d4f 100644 { ip6->prefix_length = 128; ip6->is_anycast = 0; --- -2.41.0 - diff --git a/0244-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch b/0107-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch similarity index 86% rename from 0244-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch rename to 0107-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch index 2d18158..eb342e8 100644 --- a/0244-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch +++ b/0107-efi-ip4_config-Improve-check-to-detect-literal-IPv6-.patch @@ -1,7 +1,7 @@ -From fe5cb2af656379482e192bd9f9005d2f11c392e4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 9 Mar 2020 15:30:05 +0100 -Subject: [PATCH 244/272] efi/ip4_config: Improve check to detect literal IPv6 +Subject: [PATCH] efi/ip4_config: Improve check to detect literal IPv6 addresses The grub_efi_string_to_ip4_address() function wrongly assumes that an IPv6 @@ -21,10 +21,10 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/grub-core/net/efi/ip4_config.c b/grub-core/net/efi/ip4_config.c -index eb78f8fde..92099b353 100644 +index 1deba25e79e..fb2fe850d0e 100644 --- a/grub-core/net/efi/ip4_config.c +++ b/grub-core/net/efi/ip4_config.c -@@ -60,9 +60,20 @@ int +@@ -56,9 +56,20 @@ int grub_efi_string_to_ip4_address (const char *val, grub_efi_ipv4_address_t *address, const char **rest) { grub_uint32_t newip = 0; @@ -46,6 +46,3 @@ index eb78f8fde..92099b353 100644 for (i = 0; i < 4; i++) { unsigned long t; --- -2.41.0 - diff --git a/0108-efi-net-Print-a-debug-message-if-parsing-the-address.patch b/0108-efi-net-Print-a-debug-message-if-parsing-the-address.patch new file mode 100644 index 0000000..8ef8514 --- /dev/null +++ b/0108-efi-net-Print-a-debug-message-if-parsing-the-address.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 10 Mar 2020 11:23:49 +0100 +Subject: [PATCH] efi/net: Print a debug message if parsing the address fails + +Currently if parsing the address fails an error message is printed. But in +most cases this isn't a fatal error since the grub_efi_net_parse_address() +function is only used to match an address with a network interface to use. + +And if this fails, the default interface is used which is good enough for +most cases. So instead of printing an error that would pollute the console +just print a debug message if the address is not parsed correctly. + +A user can enable debug messages for the efinet driver to have information +about the failure and the fact that the default interface is being used. + +Related: rhbz#1732765 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/net/efi/net.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c +index 4ef3f709ee2..a9536c66550 100644 +--- a/grub-core/net/efi/net.c ++++ b/grub-core/net/efi/net.c +@@ -778,9 +778,9 @@ grub_efi_net_parse_address (const char *address, + } + } + +- return grub_error (GRUB_ERR_NET_BAD_ADDRESS, +- N_("unrecognised network address `%s'"), +- address); ++ grub_dprintf ("efinet", "unrecognised network address '%s'\n", address); ++ ++ return GRUB_ERR_NET_BAD_ADDRESS; + } + + static grub_efi_net_interface_t * +@@ -795,10 +795,7 @@ match_route (const char *server) + err = grub_efi_net_parse_address (server, &ip4, &ip6, &is_ip6, 0); + + if (err) +- { +- grub_print_error (); + return NULL; +- } + + if (is_ip6) + { +@@ -1233,8 +1230,15 @@ grub_net_open_real (const char *name __attribute__ ((unused))) + /*FIXME: Use DNS translate name to address */ + net_interface = match_route (server); + ++ if (!net_interface && net_default_interface) ++ { ++ net_interface = net_default_interface; ++ grub_dprintf ("efinet", "interface lookup failed, using default '%s'\n", ++ net_interface->name); ++ } ++ + /*XXX: should we check device with default gateway ? */ +- if (!net_interface && !(net_interface = net_default_interface)) ++ if (!net_interface) + { + grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("disk `%s' no route found"), + name); diff --git a/0109-kern-term-Also-accept-F8-as-a-user-interrupt-key.patch b/0109-kern-term-Also-accept-F8-as-a-user-interrupt-key.patch new file mode 100644 index 0000000..3dd525a --- /dev/null +++ b/0109-kern-term-Also-accept-F8-as-a-user-interrupt-key.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 22 Apr 2020 12:41:52 +0200 +Subject: [PATCH] kern/term: Also accept F8 as a user interrupt key + +Make F8, which used to be the hotkey to show the Windows boot menu during +boot for a long long time, also interrupt sleeps / stop the menu countdown. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/kern/term.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/term.c b/grub-core/kern/term.c +index 14d59649832..4d61f4e9790 100644 +--- a/grub-core/kern/term.c ++++ b/grub-core/kern/term.c +@@ -144,9 +144,10 @@ grub_key_is_interrupt (int key) + /* + * ESC sometimes is the BIOS setup hotkey and may be hard to discover, also + * check F4, which was chosen because is not used as a hotkey to enter the +- * BIOS setup by any vendor. ++ * BIOS setup by any vendor. Also, F8 which was the key to get the Windows ++ * bootmenu for a long time. + */ +- if (key == GRUB_TERM_ESC || key == GRUB_TERM_KEY_F4) ++ if (key == GRUB_TERM_ESC || key == GRUB_TERM_KEY_F4 || key == GRUB_TERM_KEY_F8) + return 1; + + /* diff --git a/0245-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch b/0110-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch similarity index 82% rename from 0245-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch rename to 0110-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch index ecea1f8..2f443d7 100644 --- a/0245-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch +++ b/0110-http-Prepend-prefix-when-the-HTTP-path-is-relative-a.patch @@ -1,8 +1,8 @@ -From 5492e11d5d0dacf5fcb579cbc80856a61c87f20b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 2 Jun 2020 13:25:01 +0200 -Subject: [PATCH 245/272] http: Prepend prefix when the HTTP path is relative - as done in efi/http +Subject: [PATCH] http: Prepend prefix when the HTTP path is relative as done + in efi/http There are two different HTTP drivers that can be used when requesting an HTTP resource: the efi/http that uses the EFI_HTTP_PROTOCOL and the http @@ -20,10 +20,10 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/grub-core/net/http.c b/grub-core/net/http.c -index 686949c17..ef966205a 100644 +index af486198399..ce2b492c353 100644 --- a/grub-core/net/http.c +++ b/grub-core/net/http.c -@@ -499,13 +499,20 @@ http_open (struct grub_file *file, const char *filename) +@@ -502,13 +502,20 @@ http_open (struct grub_file *file, const char *filename) { grub_err_t err; struct http_data *data; @@ -45,6 +45,3 @@ index 686949c17..ef966205a 100644 if (!data->filename) { grub_free (data); --- -2.41.0 - diff --git a/0246-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch b/0111-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch similarity index 77% rename from 0246-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch rename to 0111-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch index 01e4256..f29706f 100644 --- a/0246-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch +++ b/0111-Fix-a-missing-return-in-efi-export-env-and-efi-load-.patch @@ -1,8 +1,8 @@ -From 3fd64781312da846377ee4757e486bd3e517641f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 16 Jan 2019 13:21:46 -0500 -Subject: [PATCH 246/272] Fix a missing return in efi-export-env and - efi-load-env commands +Subject: [PATCH] Fix a missing return in efi-export-env and efi-load-env + commands Somewhere along the way this got mis-merged to include a return without a value. Fix it up. @@ -13,7 +13,7 @@ Signed-off-by: Peter Jones 1 file changed, 2 insertions(+) diff --git a/grub-core/commands/efi/env.c b/grub-core/commands/efi/env.c -index 45f107ccd..4080f24fd 100644 +index 45f107ccd5b..4080f24fdb8 100644 --- a/grub-core/commands/efi/env.c +++ b/grub-core/commands/efi/env.c @@ -149,6 +149,8 @@ grub_efi_load_env(grub_command_t cmd __attribute__ ((unused)), @@ -25,6 +25,3 @@ index 45f107ccd..4080f24fd 100644 } static grub_command_t export_cmd, loadenv_cmd; --- -2.41.0 - diff --git a/0112-efi-dhcp-fix-some-allocation-error-checking.patch b/0112-efi-dhcp-fix-some-allocation-error-checking.patch new file mode 100644 index 0000000..e891757 --- /dev/null +++ b/0112-efi-dhcp-fix-some-allocation-error-checking.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 17:11:06 -0400 +Subject: [PATCH] efi+dhcp: fix some allocation error checking. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/dhcp.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/grub-core/net/efi/dhcp.c b/grub-core/net/efi/dhcp.c +index ca19902441b..6cc0dad85a7 100644 +--- a/grub-core/net/efi/dhcp.c ++++ b/grub-core/net/efi/dhcp.c +@@ -80,7 +80,7 @@ grub_efi_dhcp4_parse_dns (grub_efi_dhcp4_protocol_t *dhcp4, grub_efi_dhcp4_packe + if (status != GRUB_EFI_BUFFER_TOO_SMALL) + return NULL; + +- option_list = grub_malloc (option_count * sizeof(*option_list)); ++ option_list = grub_calloc (option_count, sizeof(*option_list)); + if (!option_list) + return NULL; + +@@ -360,8 +360,11 @@ grub_cmd_efi_bootp6 (struct grub_command *cmd __attribute__ ((unused)), + + if (status == GRUB_EFI_BUFFER_TOO_SMALL && count) + { +- options = grub_malloc (count * sizeof(*options)); +- status = dev->dhcp6->parse(dev->dhcp6, mode.ia->reply_packet, &count, options); ++ options = grub_calloc (count, sizeof(*options)); ++ if (options) ++ status = dev->dhcp6->parse(dev->dhcp6, mode.ia->reply_packet, &count, options); ++ else ++ status = GRUB_EFI_OUT_OF_RESOURCES; + } + + if (status != GRUB_EFI_SUCCESS) diff --git a/0247-efi-http-fix-some-allocation-error-checking.patch b/0113-efi-http-fix-some-allocation-error-checking.patch similarity index 71% rename from 0247-efi-http-fix-some-allocation-error-checking.patch rename to 0113-efi-http-fix-some-allocation-error-checking.patch index ca69b53..ba34e7f 100644 --- a/0247-efi-http-fix-some-allocation-error-checking.patch +++ b/0113-efi-http-fix-some-allocation-error-checking.patch @@ -1,7 +1,7 @@ -From 56bd285b65a3d2acca8cdcbd65a1710e2f4ed9db Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 17:14:15 -0400 -Subject: [PATCH 247/272] efi+http: fix some allocation error checking. +Subject: [PATCH] efi+http: fix some allocation error checking. Signed-off-by: Peter Jones --- @@ -9,10 +9,10 @@ Signed-off-by: Peter Jones 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c -index 5b4ebfb99..6abaf833e 100644 +index c37c359c713..0568ea5d43e 100644 --- a/grub-core/net/efi/http.c +++ b/grub-core/net/efi/http.c -@@ -416,8 +416,8 @@ grub_efihttp_open (struct grub_efi_net_device *dev, +@@ -403,8 +403,8 @@ grub_efihttp_open (struct grub_efi_net_device *dev, int type) { grub_err_t err; @@ -23,7 +23,7 @@ index 5b4ebfb99..6abaf833e 100644 char *file_name = NULL; const char *http_path; -@@ -445,8 +445,11 @@ grub_efihttp_open (struct grub_efi_net_device *dev, +@@ -432,8 +432,11 @@ grub_efihttp_open (struct grub_efi_net_device *dev, return err; } @@ -37,6 +37,3 @@ index 5b4ebfb99..6abaf833e 100644 file->size = size; file->data = buf; --- -2.41.0 - diff --git a/0114-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch b/0114-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch new file mode 100644 index 0000000..c4beaa4 --- /dev/null +++ b/0114-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch @@ -0,0 +1,127 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 17:27:00 -0400 +Subject: [PATCH] efi/ip[46]_config.c: fix some potential allocation overflows + +In theory all of this data comes from the firmware stack and it should +be safe, but it's better to be paranoid. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/ip4_config.c | 25 ++++++++++++++++++------- + grub-core/net/efi/ip6_config.c | 13 ++++++++++--- + 2 files changed, 28 insertions(+), 10 deletions(-) + +diff --git a/grub-core/net/efi/ip4_config.c b/grub-core/net/efi/ip4_config.c +index fb2fe850d0e..e9fc24865ec 100644 +--- a/grub-core/net/efi/ip4_config.c ++++ b/grub-core/net/efi/ip4_config.c +@@ -4,15 +4,20 @@ + #include + #include + #include ++#include + + char * + grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_address_t hw_address) + { + char *hw_addr, *p; +- int sz, s; +- int i; ++ grub_size_t sz, s, i; + +- sz = (int)hw_address_size * (sizeof ("XX:") - 1) + 1; ++ if (grub_mul (hw_address_size, sizeof ("XX:") - 1, &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + + hw_addr = grub_malloc (sz); + if (!hw_addr) +@@ -20,7 +25,7 @@ grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_a + + p = hw_addr; + s = sz; +- for (i = 0; i < (int)hw_address_size; i++) ++ for (i = 0; i < hw_address_size; i++) + { + grub_snprintf (p, sz, "%02x:", hw_address[i]); + p += sizeof ("XX:") - 1; +@@ -238,14 +243,20 @@ grub_efi_ip4_interface_route_table (struct grub_efi_net_device *dev) + { + grub_efi_ip4_config2_interface_info_t *interface_info; + char **ret; +- int i, id; ++ int id; ++ grub_size_t i, nmemb; + + interface_info = efi_ip4_config_interface_info (dev->ip4_config); + if (!interface_info) + return NULL; + +- ret = grub_malloc (sizeof (*ret) * (interface_info->route_table_size + 1)); ++ if (grub_add (interface_info->route_table_size, 1, &nmemb)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + ++ ret = grub_calloc (nmemb, sizeof (*ret)); + if (!ret) + { + grub_free (interface_info); +@@ -253,7 +264,7 @@ grub_efi_ip4_interface_route_table (struct grub_efi_net_device *dev) + } + + id = 0; +- for (i = 0; i < (int)interface_info->route_table_size; i++) ++ for (i = 0; i < interface_info->route_table_size; i++) + { + char *subnet, *gateway, *mask; + grub_uint32_t u32_subnet, u32_gateway; +diff --git a/grub-core/net/efi/ip6_config.c b/grub-core/net/efi/ip6_config.c +index 29a03973265..050af4fbfd1 100644 +--- a/grub-core/net/efi/ip6_config.c ++++ b/grub-core/net/efi/ip6_config.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + + char * + grub_efi_ip6_address_to_string (grub_efi_pxe_ipv6_address_t *address) +@@ -228,14 +229,20 @@ grub_efi_ip6_interface_route_table (struct grub_efi_net_device *dev) + { + grub_efi_ip6_config_interface_info_t *interface_info; + char **ret; +- int i, id; ++ int id; ++ grub_size_t i, nmemb; + + interface_info = efi_ip6_config_interface_info (dev->ip6_config); + if (!interface_info) + return NULL; + +- ret = grub_malloc (sizeof (*ret) * (interface_info->route_count + 1)); ++ if (grub_add (interface_info->route_count, 1, &nmemb)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + ++ ret = grub_calloc (nmemb, sizeof (*ret)); + if (!ret) + { + grub_free (interface_info); +@@ -243,7 +250,7 @@ grub_efi_ip6_interface_route_table (struct grub_efi_net_device *dev) + } + + id = 0; +- for (i = 0; i < (int)interface_info->route_count ; i++) ++ for (i = 0; i < interface_info->route_count ; i++) + { + char *gateway, *destination; + grub_uint64_t u64_gateway[2]; diff --git a/0115-Fix-const-char-pointers-in-grub-core-net-efi-ip4_con.patch b/0115-Fix-const-char-pointers-in-grub-core-net-efi-ip4_con.patch new file mode 100644 index 0000000..d0dd887 --- /dev/null +++ b/0115-Fix-const-char-pointers-in-grub-core-net-efi-ip4_con.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 20 Jul 2020 12:24:02 -0400 +Subject: [PATCH] Fix const char ** pointers in grub-core/net/efi/ip4_config.c + +This will need to get folded back in the right place on the next rebase, +but it's before "Make grub_strtol() "end" pointers have safer const +qualifiers" currently, so for now I'm leaving it here instead of merging +it back with the original patch. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/ip4_config.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/efi/ip4_config.c b/grub-core/net/efi/ip4_config.c +index e9fc24865ec..85a090ec422 100644 +--- a/grub-core/net/efi/ip4_config.c ++++ b/grub-core/net/efi/ip4_config.c +@@ -61,7 +61,8 @@ int + grub_efi_string_to_ip4_address (const char *val, grub_efi_ipv4_address_t *address, const char **rest) + { + grub_uint32_t newip = 0; +- int i, ncolon = 0; ++ grub_size_t i; ++ int ncolon = 0; + const char *ptr = val; + + /* Check that is not an IPv6 address */ +@@ -78,7 +79,7 @@ grub_efi_string_to_ip4_address (const char *val, grub_efi_ipv4_address_t *addres + for (i = 0; i < 4; i++) + { + unsigned long t; +- t = grub_strtoul (ptr, (char **) &ptr, 0); ++ t = grub_strtoul (ptr, &ptr, 0); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; diff --git a/0116-Fix-const-char-pointers-in-grub-core-net-efi-ip6_con.patch b/0116-Fix-const-char-pointers-in-grub-core-net-efi-ip6_con.patch new file mode 100644 index 0000000..1ecbfd8 --- /dev/null +++ b/0116-Fix-const-char-pointers-in-grub-core-net-efi-ip6_con.patch @@ -0,0 +1,28 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 20 Jul 2020 12:24:02 -0400 +Subject: [PATCH] Fix const char ** pointers in grub-core/net/efi/ip6_config.c + +This will need to get folded back in the right place on the next rebase, +but it's before "Make grub_strtol() "end" pointers have safer const +qualifiers" currently, so for now I'm leaving it here instead of merging +it back with the original patch. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/ip6_config.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/net/efi/ip6_config.c b/grub-core/net/efi/ip6_config.c +index 050af4fbfd1..952bda9fa74 100644 +--- a/grub-core/net/efi/ip6_config.c ++++ b/grub-core/net/efi/ip6_config.c +@@ -85,7 +85,7 @@ grub_efi_string_to_ip6_address (const char *val, grub_efi_ipv6_address_t *addres + ptr++; + continue; + } +- t = grub_strtoul (ptr, (char **) &ptr, 16); ++ t = grub_strtoul (ptr, &ptr, 16); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; diff --git a/0116-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch b/0116-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch deleted file mode 100644 index 66e95a5..0000000 --- a/0116-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch +++ /dev/null @@ -1,48 +0,0 @@ -From a29a0a1c82147557632c8a3ba048809abe8316f8 Mon Sep 17 00:00:00 2001 -From: Daniel Axtens -Date: Tue, 30 Nov 2021 15:00:57 +1100 -Subject: [PATCH 116/272] x509: allow Digitial Signature plus other Key Usages - -Currently the x509 certificate parser for appended signature -verification requires that the certificate have the Digitial Signature -key usage and _only_ the Digitial Signature use. This is overly strict -and becomes policy enforcement rather than a security property. - -Require that the Digitial Signature usage is present, but do not -require that it is the only usage present. - -Reported-by: Michal Suchanek -Signed-off-by: Daniel Axtens ---- - grub-core/commands/appendedsig/x509.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/grub-core/commands/appendedsig/x509.c b/grub-core/commands/appendedsig/x509.c -index 70480aa73..6ae985b30 100644 ---- a/grub-core/commands/appendedsig/x509.c -+++ b/grub-core/commands/appendedsig/x509.c -@@ -547,7 +547,7 @@ cleanup: - - /* - * Verify the Key Usage extension. -- * We only permit the Digital signature usage. -+ * We require the Digital signature usage. - */ - static grub_err_t - verify_key_usage (grub_uint8_t *value, int value_size) -@@ -586,10 +586,10 @@ verify_key_usage (grub_uint8_t *value, int value_size) - goto cleanup; - } - -- if (usage != digitalSignatureUsage) -+ if (!(usage & digitalSignatureUsage)) - { - err = -- grub_error (GRUB_ERR_BAD_FILE_TYPE, "Unexpected Key Usage value: %x", -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, "Key Usage (0x%x) missing Digital Signature usage", - usage); - goto cleanup; - } --- -2.41.0 - diff --git a/0117-Fix-const-char-pointers-in-grub-core-net-efi-net.c.patch b/0117-Fix-const-char-pointers-in-grub-core-net-efi-net.c.patch new file mode 100644 index 0000000..fe583d3 --- /dev/null +++ b/0117-Fix-const-char-pointers-in-grub-core-net-efi-net.c.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 20 Jul 2020 12:24:02 -0400 +Subject: [PATCH] Fix const char ** pointers in grub-core/net/efi/net.c + +This will need to get folded back in the right place on the next rebase, +but it's before "Make grub_strtol() "end" pointers have safer const +qualifiers" currently, so for now I'm leaving it here instead of merging +it back with the original patch. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/net.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c +index a9536c66550..0a1e604b5bd 100644 +--- a/grub-core/net/efi/net.c ++++ b/grub-core/net/efi/net.c +@@ -729,7 +729,7 @@ grub_efi_net_parse_address (const char *address, + { + grub_uint32_t subnet_mask_size; + +- subnet_mask_size = grub_strtoul (rest + 1, (char **) &rest, 0); ++ subnet_mask_size = grub_strtoul (rest + 1, &rest, 0); + + if (!grub_errno && subnet_mask_size <= 32 && *rest == 0) + { +@@ -758,7 +758,7 @@ grub_efi_net_parse_address (const char *address, + { + grub_efi_uint8_t prefix_length; + +- prefix_length = grub_strtoul (rest + 1, (char **) &rest, 0); ++ prefix_length = grub_strtoul (rest + 1, &rest, 0); + if (!grub_errno && prefix_length <= 128 && *rest == 0) + { + ip6->prefix_length = prefix_length; diff --git a/0117-grub-install-Add-SUSE-signed-image-support-for-power.patch b/0117-grub-install-Add-SUSE-signed-image-support-for-power.patch deleted file mode 100644 index b6e3c5b..0000000 --- a/0117-grub-install-Add-SUSE-signed-image-support-for-power.patch +++ /dev/null @@ -1,111 +0,0 @@ -From e23b0cdd89a48b0769b44a6cdf7b79df78d00ba1 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 10:12:24 +0800 -Subject: [PATCH 117/272] grub-install: Add SUSE signed image support for - powerpc. - -Signed-off-by: Michal Suchanek ---- - grub-core/osdep/linux/platform.c | 13 +++++++++++++ - include/grub/util/install.h | 3 +++ - util/grub-install.c | 27 ++++++++++++++++++++++++--- - 3 files changed, 40 insertions(+), 3 deletions(-) - -diff --git a/grub-core/osdep/linux/platform.c b/grub-core/osdep/linux/platform.c -index e28a79dab..f5ba7b99b 100644 ---- a/grub-core/osdep/linux/platform.c -+++ b/grub-core/osdep/linux/platform.c -@@ -154,3 +154,16 @@ grub_install_get_default_x86_platform (void) - grub_util_info ("... not found"); - return "i386-pc"; - } -+ -+int -+grub_install_get_powerpc_secure_boot (void) -+{ -+ int32_t ret = -1; -+ FILE *fp = grub_util_fopen ("/proc/device-tree/ibm,secure-boot", "rb"); -+ if (fp) { -+ if (fread (&ret , 1, sizeof(ret), fp) > 0) -+ ret = grub_be_to_cpu32(ret); -+ fclose(fp); -+ } -+ return ret; -+} -\ No newline at end of file -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index 274b9f60e..e0decd784 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -231,6 +231,9 @@ grub_install_get_default_arm_platform (void); - const char * - grub_install_get_default_x86_platform (void); - -+int -+grub_install_get_powerpc_secure_boot (void); -+ - int - grub_install_register_efi (grub_device_t efidir_grub_dev, - const char *efifile_path, -diff --git a/util/grub-install.c b/util/grub-install.c -index b72048c08..3f59bb5a6 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -315,10 +315,10 @@ static struct argp_option options[] = { - - {"force-signed", OPTION_FORCE_SIGNED, 0, 0, - N_("force installation of signed grub" "%s." -- "This option is only available on ARM64 EFI targets."), 0}, -+ "This option is only available on ARM64 EFI and powerpc targets."), 0}, - {"inhibit-signed", OPTION_INHIBIT_SIGNED, 0, 0, - N_("inhibit installation of signed grub. " -- "This option is only available on ARM64 EFI targets."), 0}, -+ "This option is only available on ARM64 EFI and powerpc targets."), 0}, - - {"debug", OPTION_DEBUG, 0, OPTION_HIDDEN, 0, 2}, - {"no-floppy", OPTION_NO_FLOPPY, 0, OPTION_HIDDEN, 0, 2}, -@@ -1722,6 +1722,7 @@ main (int argc, char *argv[]) - char mkimage_target[200]; - const char *core_name = NULL; - char *signed_imgfile = NULL; -+ int ppc_sb_state = -1; - - switch (platform) - { -@@ -1768,12 +1769,32 @@ main (int argc, char *argv[]) - grub_install_get_platform_cpu (platform), - grub_install_get_platform_platform (platform)); - break; -+ case GRUB_INSTALL_PLATFORM_POWERPC_IEEE1275: -+ ppc_sb_state = grub_install_get_powerpc_secure_boot(); -+ -+ if ((signed_grub_mode >= SIGNED_GRUB_FORCE) || ((signed_grub_mode == SIGNED_GRUB_AUTO) && (ppc_sb_state > 0))) -+ { -+ signed_imgfile = grub_util_path_concat (2, grub_install_source_directory, "grub.elf"); -+ if (!grub_util_is_regular (signed_imgfile)) -+ { -+ if ((signed_grub_mode >= SIGNED_GRUB_FORCE) || (ppc_sb_state > 1)) -+ grub_util_error ("signed image `%s' does not exist\n", signed_imgfile); -+ else -+ { -+ free (signed_imgfile); -+ signed_imgfile = NULL; -+ } -+ } -+ } - -+ if (signed_imgfile) -+ fprintf (stderr, _("Use signed file in %s for installation.\n"), signed_imgfile); -+ -+ /* fallthrough. */ - case GRUB_INSTALL_PLATFORM_I386_COREBOOT: - case GRUB_INSTALL_PLATFORM_ARM_COREBOOT: - case GRUB_INSTALL_PLATFORM_I386_MULTIBOOT: - case GRUB_INSTALL_PLATFORM_I386_IEEE1275: -- case GRUB_INSTALL_PLATFORM_POWERPC_IEEE1275: - case GRUB_INSTALL_PLATFORM_I386_XEN: - case GRUB_INSTALL_PLATFORM_X86_64_XEN: - case GRUB_INSTALL_PLATFORM_I386_XEN_PVH: --- -2.41.0 - diff --git a/0118-Add-grub_envblk_buf-helper-function.patch b/0118-Add-grub_envblk_buf-helper-function.patch deleted file mode 100644 index a402c47..0000000 --- a/0118-Add-grub_envblk_buf-helper-function.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 70afeca07450e72a87a11c72307fd219f7d79b7e Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 17 Jan 2022 17:45:00 +0800 -Subject: [PATCH 118/272] Add grub_envblk_buf helper function - -This helps in creation and initialization of memory buffer for -environment block of given size. - -Signed-off-by: Michael Chang ---- - grub-core/lib/envblk.c | 12 ++++++++++++ - include/grub/lib/envblk.h | 1 + - util/grub-editenv.c | 4 +--- - 3 files changed, 14 insertions(+), 3 deletions(-) - -diff --git a/grub-core/lib/envblk.c b/grub-core/lib/envblk.c -index 2e4e78b13..24efbe7ff 100644 ---- a/grub-core/lib/envblk.c -+++ b/grub-core/lib/envblk.c -@@ -23,6 +23,18 @@ - #include - #include - -+char * -+grub_envblk_buf (grub_size_t size) -+{ -+ char *buf; -+ -+ buf = grub_malloc (size); -+ grub_memcpy (buf, GRUB_ENVBLK_SIGNATURE, sizeof (GRUB_ENVBLK_SIGNATURE) - 1); -+ grub_memset (buf + sizeof (GRUB_ENVBLK_SIGNATURE) - 1, '#', size - sizeof (GRUB_ENVBLK_SIGNATURE) + 1); -+ -+ return buf; -+} -+ - grub_envblk_t - grub_envblk_open (char *buf, grub_size_t size) - { -diff --git a/include/grub/lib/envblk.h b/include/grub/lib/envblk.h -index c3e655921..83f3fcf84 100644 ---- a/include/grub/lib/envblk.h -+++ b/include/grub/lib/envblk.h -@@ -31,6 +31,7 @@ struct grub_envblk - }; - typedef struct grub_envblk *grub_envblk_t; - -+char *grub_envblk_buf (grub_size_t size); - grub_envblk_t grub_envblk_open (char *buf, grub_size_t size); - int grub_envblk_set (grub_envblk_t envblk, const char *name, const char *value); - void grub_envblk_delete (grub_envblk_t envblk, const char *name); -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index b8219335f..a02d3f2a6 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -210,9 +210,7 @@ create_envblk_fs (void) - if (! fp) - grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); - -- buf = xmalloc (size); -- memcpy (buf, GRUB_ENVBLK_SIGNATURE, sizeof (GRUB_ENVBLK_SIGNATURE) - 1); -- memset (buf + sizeof (GRUB_ENVBLK_SIGNATURE) - 1, '#', size - sizeof (GRUB_ENVBLK_SIGNATURE) + 1); -+ buf = grub_envblk_buf (size); - - if (fseek (fp, offset, SEEK_SET) < 0) - grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); --- -2.41.0 - diff --git a/0118-Fix-const-char-pointers-in-grub-core-net-efi-pxe.c.patch b/0118-Fix-const-char-pointers-in-grub-core-net-efi-pxe.c.patch new file mode 100644 index 0000000..ea5be7c --- /dev/null +++ b/0118-Fix-const-char-pointers-in-grub-core-net-efi-pxe.c.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 20 Jul 2020 12:24:02 -0400 +Subject: [PATCH] Fix const char ** pointers in grub-core/net/efi/pxe.c + +This will need to get folded back in the right place on the next rebase, +but it's before "Make grub_strtol() "end" pointers have safer const +qualifiers" currently, so for now I'm leaving it here instead of merging +it back with the original patch. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/pxe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/net/efi/pxe.c b/grub-core/net/efi/pxe.c +index b84f86ea470..e828fb23e96 100644 +--- a/grub-core/net/efi/pxe.c ++++ b/grub-core/net/efi/pxe.c +@@ -187,7 +187,7 @@ parse_ip6 (const char *val, grub_uint64_t *ip, const char **rest) + ptr++; + continue; + } +- t = grub_strtoul (ptr, (char **) &ptr, 16); ++ t = grub_strtoul (ptr, &ptr, 16); + if (grub_errno) + { + grub_errno = GRUB_ERR_NONE; +@@ -225,7 +225,7 @@ pxe_open (struct grub_efi_net_device *dev, + int type __attribute__((unused))) + { + int i; +- char *p; ++ const char *p; + grub_efi_status_t status; + grub_efi_pxe_ip_address_t server_ip; + grub_efi_uint64_t file_size = 0; +@@ -313,7 +313,7 @@ pxe_read (struct grub_efi_net_device *dev, + grub_size_t len) + { + int i; +- char *p; ++ const char *p; + grub_efi_status_t status; + grub_efi_pxe_t *pxe = (prefer_ip6) ? dev->ip6_pxe : dev->ip4_pxe; + grub_efi_uint64_t bufsz = len; diff --git a/0119-Add-grub_disk_write_tail-helper-function.patch b/0119-Add-grub_disk_write_tail-helper-function.patch deleted file mode 100644 index 677dc02..0000000 --- a/0119-Add-grub_disk_write_tail-helper-function.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 60162d82a2bd33f8df32b6743ae996b62290dbbb Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 7 Feb 2022 20:44:40 +0800 -Subject: [PATCH 119/272] Add grub_disk_write_tail helper function - -This helps in writing data to partition where the end of buffer is -aligned to end of partition. - -Signed-off-by: Michael Chang ---- - grub-core/lib/disk.c | 18 ++++++++++++++++++ - include/grub/disk.h | 3 +++ - 2 files changed, 21 insertions(+) - -diff --git a/grub-core/lib/disk.c b/grub-core/lib/disk.c -index 123993dd4..b6076faf1 100644 ---- a/grub-core/lib/disk.c -+++ b/grub-core/lib/disk.c -@@ -51,6 +51,24 @@ grub_disk_cache_invalidate (unsigned long dev_id, unsigned long disk_id, - } - } - -+grub_err_t -+grub_disk_write_tail (grub_disk_t disk, grub_size_t size, const void *buf) -+{ -+ grub_partition_t part; -+ grub_disk_addr_t sector; -+ grub_off_t offset; -+ -+ if (!disk->partition) -+ return GRUB_ERR_NONE; -+ -+ part = disk->partition; -+ sector = part->len; -+ sector -= (size + GRUB_DISK_SECTOR_SIZE - 1) >> GRUB_DISK_SECTOR_BITS; -+ offset = size & (GRUB_DISK_SECTOR_SIZE - 1); -+ -+ return grub_disk_write (disk, sector, offset, size, buf); -+} -+ - grub_err_t - grub_disk_write (grub_disk_t disk, grub_disk_addr_t sector, - grub_off_t offset, grub_size_t size, const void *buf) -diff --git a/include/grub/disk.h b/include/grub/disk.h -index fbf23df7f..0858ee40e 100644 ---- a/include/grub/disk.h -+++ b/include/grub/disk.h -@@ -255,6 +255,9 @@ grub_err_t EXPORT_FUNC(grub_disk_read) (grub_disk_t disk, - grub_off_t offset, - grub_size_t size, - void *buf); -+grub_err_t grub_disk_write_tail (grub_disk_t disk, -+ grub_size_t size, -+ const void *buf); - grub_err_t grub_disk_write (grub_disk_t disk, - grub_disk_addr_t sector, - grub_off_t offset, --- -2.41.0 - diff --git a/0248-Add-systemd-integration-scripts-to-make-systemctl-re.patch b/0119-Add-systemd-integration-scripts-to-make-systemctl-re.patch similarity index 84% rename from 0248-Add-systemd-integration-scripts-to-make-systemctl-re.patch rename to 0119-Add-systemd-integration-scripts-to-make-systemctl-re.patch index 1599103..ce424e1 100644 --- a/0248-Add-systemd-integration-scripts-to-make-systemctl-re.patch +++ b/0119-Add-systemd-integration-scripts-to-make-systemctl-re.patch @@ -1,8 +1,8 @@ -From a368fe521d760421195888acd921f604958ee845 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 22 Jul 2020 14:03:42 +0200 -Subject: [PATCH 248/272] Add systemd integration scripts to make "systemctl - reboot --boot-loader-menu=xxx" work with grub +Subject: [PATCH] Add systemd integration scripts to make "systemctl reboot + --boot-loader-menu=xxx" work with grub This commit adds a number of scripts / config files to make "systemctl reboot --boot-loader-menu=xxx" work with grub: @@ -52,12 +52,12 @@ Downstream notes: Signed-off-by: Hans de Goede --- - Makefile.util.def | 27 +++++++++++++++++++ - conf/Makefile.common | 6 +++++ - util/grub.d/14_menu_show_once.in | 13 +++++++++ - util/systemd/10-grub-logind-service.conf.in | 2 ++ - .../grub-systemd-integration.service.in | 8 ++++++ - util/systemd/systemd-integration.sh.in | 6 +++++ + Makefile.util.def | 27 ++++++++++++++++++++++++ + conf/Makefile.common | 6 ++++++ + util/grub.d/14_menu_show_once.in | 13 ++++++++++++ + util/systemd/10-grub-logind-service.conf.in | 2 ++ + util/systemd/grub-systemd-integration.service.in | 8 +++++++ + util/systemd/systemd-integration.sh.in | 6 ++++++ 6 files changed, 62 insertions(+) create mode 100755 util/grub.d/14_menu_show_once.in create mode 100644 util/systemd/10-grub-logind-service.conf.in @@ -65,7 +65,7 @@ Signed-off-by: Hans de Goede create mode 100644 util/systemd/systemd-integration.sh.in diff --git a/Makefile.util.def b/Makefile.util.def -index b1c75e9d2..d557c268b 100644 +index 885dc688a60..8e52e48c780 100644 --- a/Makefile.util.def +++ b/Makefile.util.def @@ -473,6 +473,12 @@ script = { @@ -81,7 +81,7 @@ index b1c75e9d2..d557c268b 100644 script = { name = '01_users'; common = util/grub.d/01_users.in; -@@ -591,6 +597,27 @@ script = { +@@ -578,6 +584,27 @@ script = { installdir = grubconf; }; @@ -110,10 +110,10 @@ index b1c75e9d2..d557c268b 100644 mansection = 1; name = grub-mkrescue; diff --git a/conf/Makefile.common b/conf/Makefile.common -index 3ce6a805d..b7a700a17 100644 +index 91ff6c905fb..c8756d8146f 100644 --- a/conf/Makefile.common +++ b/conf/Makefile.common -@@ -74,8 +74,11 @@ CCASFLAGS_LIBRARY = $(UTILS_CCASFLAGS) +@@ -73,8 +73,11 @@ CCASFLAGS_LIBRARY = $(UTILS_CCASFLAGS) # Other variables grubconfdir = $(sysconfdir)/grub.d @@ -123,9 +123,9 @@ index 3ce6a805d..b7a700a17 100644 +systemdunitdir = ${prefix}/lib/systemd/system +systemd_logind_service_ddir = $(systemdunitdir)/systemd-logind.service.d - CFLAGS_GNULIB = -Wno-undef -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Werror=trampolines -fno-trampolines + CFLAGS_GNULIB = -Wno-undef -Wno-error=sign-compare -Wno-unused -Wno-unused-parameter -Wno-redundant-decls -Wno-unreachable-code -Wno-error=attributes -Werror=trampolines -fno-trampolines CPPFLAGS_GNULIB = -I$(top_builddir)/grub-core/lib/gnulib -I$(top_srcdir)/grub-core/lib/gnulib -@@ -134,6 +137,9 @@ platform_SCRIPTS = +@@ -133,6 +136,9 @@ platform_SCRIPTS = platform_PROGRAMS = sbin_SCRIPTS = sbin_PROGRAMS = @@ -137,7 +137,7 @@ index 3ce6a805d..b7a700a17 100644 CLEANFILES = diff --git a/util/grub.d/14_menu_show_once.in b/util/grub.d/14_menu_show_once.in new file mode 100755 -index 000000000..1cd7f3614 +index 00000000000..1cd7f36142b --- /dev/null +++ b/util/grub.d/14_menu_show_once.in @@ -0,0 +1,13 @@ @@ -156,7 +156,7 @@ index 000000000..1cd7f3614 +EOF diff --git a/util/systemd/10-grub-logind-service.conf.in b/util/systemd/10-grub-logind-service.conf.in new file mode 100644 -index 000000000..f2d4ac007 +index 00000000000..f2d4ac00732 --- /dev/null +++ b/util/systemd/10-grub-logind-service.conf.in @@ -0,0 +1,2 @@ @@ -164,7 +164,7 @@ index 000000000..f2d4ac007 +Environment=SYSTEMD_REBOOT_TO_BOOT_LOADER_MENU=true diff --git a/util/systemd/grub-systemd-integration.service.in b/util/systemd/grub-systemd-integration.service.in new file mode 100644 -index 000000000..c81fb594c +index 00000000000..c81fb594ce1 --- /dev/null +++ b/util/systemd/grub-systemd-integration.service.in @@ -0,0 +1,8 @@ @@ -178,7 +178,7 @@ index 000000000..c81fb594c +ExecStart=@libexecdir@/@grubdirname@/systemd-integration.sh diff --git a/util/systemd/systemd-integration.sh.in b/util/systemd/systemd-integration.sh.in new file mode 100644 -index 000000000..dc1218597 +index 00000000000..dc1218597bc --- /dev/null +++ b/util/systemd/systemd-integration.sh.in @@ -0,0 +1,6 @@ @@ -188,6 +188,3 @@ index 000000000..dc1218597 +TIMEOUT=$(((TIMEOUT_USEC + 500000) / 1000000)) + +@grub_editenv@ - set menu_show_once_timeout=$TIMEOUT --- -2.41.0 - diff --git a/0120-grub-install-support-prep-environment-block.patch b/0120-grub-install-support-prep-environment-block.patch deleted file mode 100644 index 12c9e73..0000000 --- a/0120-grub-install-support-prep-environment-block.patch +++ /dev/null @@ -1,144 +0,0 @@ -From e0f3b92d3561e7bd0604dd1d2054a698af4f3da9 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 7 Feb 2022 20:49:01 +0800 -Subject: [PATCH 120/272] grub-install: support prep environment block - -The grub-install can be instructed to create environment block at end of -PReP paritition with probed device identities and properties in -variables to facilitate root device discovery. So far these variables -are defined for this purpose: - -ENV_FS_UUID - The filesystem uuid for the grub root device -ENV_CRYPTO_UUID - The crytodisk uuid for the grub root device separated -by space -ENV_GRUB_DIR - The path to grub prefix directory -ENV_HINT - The recommended hint string for searching root device - -The size of environment block is defined in GRUB_ENVBLK_PREP_SIZE which -is 4096 bytes and can be extended in the future. - -v2: Improve detection of ENV_CRYPTO_UUID by traversing all members of -the logical disk and utilize a space as a separator when multiple UUIDs -are found (bsc#1216075). - -Signed-off-by: Michael Chang ---- - include/grub/lib/envblk.h | 3 ++ - util/grub-install.c | 73 +++++++++++++++++++++++++++++++++++++++ - 2 files changed, 76 insertions(+) - -diff --git a/include/grub/lib/envblk.h b/include/grub/lib/envblk.h -index 83f3fcf84..d01927bcf 100644 ---- a/include/grub/lib/envblk.h -+++ b/include/grub/lib/envblk.h -@@ -24,6 +24,9 @@ - - #ifndef ASM_FILE - -+#include -+#define GRUB_ENVBLK_PREP_SIZE (GRUB_DISK_SECTOR_SIZE << 3) -+ - struct grub_envblk - { - char *buf; -diff --git a/util/grub-install.c b/util/grub-install.c -index 3f59bb5a6..efef6d09e 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -43,6 +43,7 @@ - #include - #include - #include -+#include - - #include - -@@ -598,6 +599,41 @@ probe_cryptodisk_uuid (grub_disk_t disk) - } - } - -+static char * -+cryptodisk_uuids (grub_disk_t disk, int in_recurse) -+{ -+ grub_disk_memberlist_t list = NULL, tmp; -+ static char *ret; -+ -+ if (!in_recurse) -+ ret = NULL; -+ -+ if (disk->dev->disk_memberlist) -+ list = disk->dev->disk_memberlist (disk); -+ -+ while (list) -+ { -+ ret = cryptodisk_uuids (list->disk, 1); -+ tmp = list->next; -+ free (list); -+ list = tmp; -+ } -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ if (!ret) -+ ret = grub_strdup (grub_util_cryptodisk_get_uuid (disk)); -+ else -+ { -+ char *s = grub_xasprintf ("%s %s", grub_util_cryptodisk_get_uuid (disk), ret); -+ grub_free (ret); -+ ret = s; -+ } -+ } -+ -+ return ret; -+} -+ - static int - is_same_disk (const char *a, const char *b) - { -@@ -2100,6 +2136,43 @@ main (int argc, char *argv[]) - if (write_to_disk (ins_dev, imgfile)) - grub_util_error ("%s", _("failed to copy Grub to the PReP partition")); - grub_set_install_backup_ponr (); -+ -+ if ((signed_grub_mode >= SIGNED_GRUB_FORCE) || ((signed_grub_mode == SIGNED_GRUB_AUTO) && (ppc_sb_state > 0))) -+ { -+ char *uuid = NULL; -+ grub_envblk_t envblk = NULL; -+ char *buf; -+ char *cryptouuid = NULL; -+ -+ if (grub_dev->disk) -+ cryptouuid = cryptodisk_uuids (grub_dev->disk, 0); -+ -+ if (grub_fs->fs_uuid && grub_fs->fs_uuid (grub_dev, &uuid)) -+ { -+ grub_print_error (); -+ grub_errno = 0; -+ uuid = NULL; -+ } -+ buf = grub_envblk_buf (GRUB_ENVBLK_PREP_SIZE); -+ envblk = grub_envblk_open (buf, GRUB_ENVBLK_PREP_SIZE); -+ if (uuid) -+ grub_envblk_set (envblk, "ENV_FS_UUID", uuid); -+ if (cryptouuid) -+ grub_envblk_set (envblk, "ENV_CRYPTO_UUID", cryptouuid); -+ if (relative_grubdir) -+ grub_envblk_set (envblk, "ENV_GRUB_DIR", relative_grubdir); -+ if (have_abstractions) -+ grub_envblk_set (envblk, "ENV_HINT", grub_dev->disk->name); -+ if (use_relative_path_on_btrfs) -+ grub_envblk_set (envblk, "btrfs_relative_path", "1"); -+ if (envblk) -+ { -+ fprintf (stderr, _("Write environment block to PReP.\n")); -+ if (grub_disk_write_tail (ins_dev->disk, envblk->size, envblk->buf)) -+ grub_util_error ("%s", _("failed to write environment block to the PReP partition")); -+ } -+ grub_envblk_close (envblk); -+ } - grub_device_close (ins_dev); - if (update_nvram) - grub_install_register_ieee1275 (1, grub_util_get_os_disk (install_device), --- -2.41.0 - diff --git a/0249-systemd-integration.sh-Also-set-old-menu_show_once-g.patch b/0120-systemd-integration.sh-Also-set-old-menu_show_once-g.patch similarity index 85% rename from 0249-systemd-integration.sh-Also-set-old-menu_show_once-g.patch rename to 0120-systemd-integration.sh-Also-set-old-menu_show_once-g.patch index 43014ff..9021de5 100644 --- a/0249-systemd-integration.sh-Also-set-old-menu_show_once-g.patch +++ b/0120-systemd-integration.sh-Also-set-old-menu_show_once-g.patch @@ -1,8 +1,8 @@ -From 6d1ddd7fff6402ce3aadfe74b1e9a9c3f023362b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Thu, 23 Jul 2020 09:27:36 +0200 -Subject: [PATCH 249/272] systemd-integration.sh: Also set old menu_show_once - grubenv var +Subject: [PATCH] systemd-integration.sh: Also set old menu_show_once grubenv + var Downstream RH / Fedora patch for compatibility with old, not (yet) regenerated grub.cfg files which miss the menu_show_once_timeout check. @@ -18,7 +18,7 @@ Signed-off-by: Hans de Goede 1 file changed, 5 insertions(+) diff --git a/util/systemd/systemd-integration.sh.in b/util/systemd/systemd-integration.sh.in -index dc1218597..a4c071c5b 100644 +index dc1218597bc..a4c071c5b0c 100644 --- a/util/systemd/systemd-integration.sh.in +++ b/util/systemd/systemd-integration.sh.in @@ -4,3 +4,8 @@ TIMEOUT_USEC=$(cat /run/systemd/reboot-to-boot-loader-menu) @@ -30,6 +30,3 @@ index dc1218597..a4c071c5b 100644 +# regenerated grub.cfg files which miss the menu_show_once_timeout check +# this older grubenv variable leads to a fixed timeout of 60 seconds +@grub_editenv@ - set menu_show_once=1 --- -2.41.0 - diff --git a/0121-Introduce-prep_load_env-command.patch b/0121-Introduce-prep_load_env-command.patch deleted file mode 100644 index 2ecba1a..0000000 --- a/0121-Introduce-prep_load_env-command.patch +++ /dev/null @@ -1,287 +0,0 @@ -From 006d73ee56a80164dae9fd1c59cb888410ba017f Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 18 Feb 2022 21:43:38 +0800 -Subject: [PATCH 121/272] Introduce prep_load_env command - -This command will accept grub disk device and perform load_env for -environment block located at end of PReP partition which belongs to that -input disk device. All variables read from that environment block are -exported to grub as environment variables. - -Please note there's no support for whitelist variables and also ---skip-sig option compared to ordinary load_env command. - -v2: -To avoid disrupting the boot process with errors, it's important to log -any errors that may occur and always return GRUB_ERR_NONE. - -v3: -Making the new module powerpc_ieee1275 specific. - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 6 + - grub-core/commands/prep_loadenv.c | 237 ++++++++++++++++++++++++++++++ - 2 files changed, 243 insertions(+) - create mode 100644 grub-core/commands/prep_loadenv.c - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index c9ba34bf9..38d93ff4f 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -2673,3 +2673,9 @@ module = { - common = lib/libtasn1_wrap/tests/Test_strings.c; - common = lib/libtasn1_wrap/wrap_tests.c; - }; -+ -+module = { -+ name = prep_loadenv; -+ common = commands/prep_loadenv.c; -+ enable = powerpc_ieee1275; -+}; -diff --git a/grub-core/commands/prep_loadenv.c b/grub-core/commands/prep_loadenv.c -new file mode 100644 -index 000000000..e731684d3 ---- /dev/null -+++ b/grub-core/commands/prep_loadenv.c -@@ -0,0 +1,237 @@ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); -+ -+static char * -+match_substr (regmatch_t *match, const char *str) -+{ -+ if (match->rm_so != -1) -+ { -+ char *substr; -+ regoff_t sz = match->rm_eo - match->rm_so; -+ -+ if (!sz) -+ return NULL; -+ substr = grub_malloc (1 + sz); -+ if (!substr) -+ { -+ grub_print_error (); -+ return NULL; -+ } -+ grub_memcpy (substr, str + match->rm_so, sz); -+ substr[sz] = '\0'; -+ return substr; -+ } -+ -+ return NULL; -+} -+ -+static int -+is_prep_partition (grub_device_t dev) -+{ -+ if (!dev->disk) -+ return 0; -+ if (!dev->disk->partition) -+ return 0; -+ if (grub_strcmp (dev->disk->partition->partmap->name, "msdos") == 0) -+ return (dev->disk->partition->msdostype == 0x41); -+ -+ if (grub_strcmp (dev->disk->partition->partmap->name, "gpt") == 0) -+ { -+ struct grub_gpt_partentry gptdata; -+ grub_partition_t p = dev->disk->partition; -+ int ret = 0; -+ dev->disk->partition = dev->disk->partition->parent; -+ -+ if (grub_disk_read (dev->disk, p->offset, p->index, -+ sizeof (gptdata), &gptdata) == 0) -+ { -+ const grub_guid_t template = { -+ grub_cpu_to_le32_compile_time (0x9e1a2d38), -+ grub_cpu_to_le16_compile_time (0xc612), -+ grub_cpu_to_le16_compile_time (0x4316), -+ { 0xaa, 0x26, 0x8b, 0x49, 0x52, 0x1e, 0x5a, 0x8b } -+ }; -+ -+ ret = grub_memcmp (&template, &gptdata.type, -+ sizeof (template)) == 0; -+ } -+ dev->disk->partition = p; -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static int -+part_hook (grub_disk_t disk, const grub_partition_t partition, void *data) -+{ -+ char **ret = data; -+ char *partition_name, *devname; -+ grub_device_t dev; -+ -+ partition_name = grub_partition_get_name (partition); -+ if (! partition_name) -+ return 2; -+ -+ devname = grub_xasprintf ("%s,%s", disk->name, partition_name); -+ grub_free (partition_name); -+ if (!devname) -+ return 2; -+ -+ dev = grub_device_open (devname); -+ if (!dev) -+ { -+ grub_free (devname); -+ return 2; -+ } -+ if (is_prep_partition (dev)) -+ { -+ *ret = devname; -+ return 1; -+ } -+ grub_free (devname); -+ grub_device_close (dev); -+ return 0; -+} -+ -+static int -+set_var (const char *name, const char *value, -+ void *hook_data __attribute__ ((unused))) -+{ -+ grub_env_set (name, value); -+ grub_env_export (name); -+ return 0; -+} -+ -+static grub_err_t -+prep_read_envblk (const char *devname) -+{ -+ char *buf = NULL; -+ grub_device_t dev = NULL; -+ grub_envblk_t envblk = NULL; -+ -+ dev = grub_device_open (devname); -+ if (!dev) -+ return grub_errno; -+ -+ if (!dev->disk || !dev->disk->partition) -+ { -+ grub_error (GRUB_ERR_BAD_DEVICE, "disk device required"); -+ goto fail; -+ } -+ -+ buf = grub_malloc (GRUB_ENVBLK_PREP_SIZE); -+ if (!buf) -+ goto fail; -+ -+ if (grub_disk_read (dev->disk, dev->disk->partition->len - (GRUB_ENVBLK_PREP_SIZE >> GRUB_DISK_SECTOR_BITS), 0, GRUB_ENVBLK_PREP_SIZE, buf)) -+ goto fail; -+ -+ envblk = grub_envblk_open (buf, GRUB_ENVBLK_PREP_SIZE); -+ if (!envblk) -+ { -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid environment block"); -+ goto fail; -+ } -+ grub_envblk_iterate (envblk, NULL, set_var); -+ -+ fail: -+ if (envblk) -+ grub_envblk_close (envblk); -+ else -+ grub_free (buf); -+ if (dev) -+ grub_device_close (dev); -+ return grub_errno; -+} -+ -+static grub_err_t -+prep_partname (const char *devname, char **prep) -+{ -+ grub_device_t dev = NULL; -+ grub_err_t err; -+ int ret; -+ -+ dev = grub_device_open (devname); -+ if (!dev) -+ return grub_errno; -+ -+ /* Only needed for disk device */ -+ if (!dev->disk) -+ { -+ err = GRUB_ERR_NONE; -+ goto out; -+ } -+ -+ ret = grub_partition_iterate (dev->disk, part_hook, prep); -+ if (ret == 1 && *prep) -+ { -+ err = GRUB_ERR_NONE; -+ goto out; -+ } -+ else if (ret == 0 && grub_errno == GRUB_ERR_NONE) -+ err = grub_error (GRUB_ERR_FILE_NOT_FOUND, "no prep partition"); -+ else -+ err = grub_errno; -+ -+ out: -+ grub_device_close (dev); -+ return err; -+} -+ -+static grub_err_t -+grub_cmd_prep_loadenv (grub_command_t cmd __attribute__ ((unused)), -+ int argc, -+ char **argv) -+{ -+ char *devname, *prep = NULL; -+ grub_err_t err; -+ -+ if (argc < 1) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required"); -+ -+ devname = grub_file_get_device_name(argv[0]); -+ if (!devname) -+ return grub_errno; -+ -+ err = prep_partname (devname, &prep); -+ if (prep == NULL || err != GRUB_ERR_NONE) -+ goto out; -+ -+ err = prep_read_envblk (prep); -+ -+ out: -+ grub_free (devname); -+ grub_free (prep); -+ -+ if (err) -+ grub_print_error (); -+ return GRUB_ERR_NONE; -+} -+ -+static grub_command_t cmd_prep_load; -+ -+GRUB_MOD_INIT(prep_loadenv) -+{ -+ cmd_prep_load = -+ grub_register_command("prep_load_env", grub_cmd_prep_loadenv, -+ "DEVICE", -+ N_("Load variables from environment block file.")); -+} -+ -+GRUB_MOD_FINI(prep_loadenv) -+{ -+ grub_unregister_command (cmd_prep_load); -+} --- -2.41.0 - diff --git a/0250-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch b/0121-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch similarity index 94% rename from 0250-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch rename to 0121-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch index 0060129..6011b33 100644 --- a/0250-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch +++ b/0121-at_keyboard-use-set-1-when-keyboard-is-in-Translate-.patch @@ -1,8 +1,7 @@ -From 8f7e634e2f5b080e4b98713b80fc20abdad2bd7a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Thu, 3 Dec 2020 09:13:24 +0100 -Subject: [PATCH 250/272] at_keyboard: use set 1 when keyboard is in Translate - mode +Subject: [PATCH] at_keyboard: use set 1 when keyboard is in Translate mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -30,7 +29,7 @@ Signed-off-by: Renaud Métrich 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/grub-core/term/at_keyboard.c b/grub-core/term/at_keyboard.c -index f8a129eb7..2d9ab65ae 100644 +index f8a129eb7f1..2d9ab65aee0 100644 --- a/grub-core/term/at_keyboard.c +++ b/grub-core/term/at_keyboard.c @@ -145,20 +145,28 @@ query_mode (void) @@ -106,7 +105,7 @@ index f8a129eb7..2d9ab65ae 100644 } diff --git a/include/grub/at_keyboard.h b/include/grub/at_keyboard.h -index bcb4d9ba7..9414dc1b9 100644 +index bcb4d9ba78f..9414dc1b996 100644 --- a/include/grub/at_keyboard.h +++ b/include/grub/at_keyboard.h @@ -19,6 +19,10 @@ @@ -120,6 +119,3 @@ index bcb4d9ba7..9414dc1b9 100644 /* Used for sending commands to the controller. */ #define KEYBOARD_COMMAND_ISREADY(x) !((x) & 0x02) #define KEYBOARD_COMMAND_READ 0x20 --- -2.41.0 - diff --git a/0122-export-environment-at-start-up.patch b/0122-export-environment-at-start-up.patch deleted file mode 100644 index ce93f3e..0000000 --- a/0122-export-environment-at-start-up.patch +++ /dev/null @@ -1,177 +0,0 @@ -From 86be8711fe701a280e0589ad14ccaf8ed286688f Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 18 Feb 2022 21:51:16 +0800 -Subject: [PATCH 122/272] export environment at start up - -If the prep_loadenv module is built into the core image, it will read -the environment block automatically during start up and export all -variables. The will ease integration with those without early scripts to -running the command. - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 2 + - grub-core/commands/prep_loadenv.c | 77 +++++++++++++++++++++++++++++++ - grub-core/kern/env.c | 2 + - grub-core/kern/main.c | 3 ++ - include/grub/env.h | 1 + - 5 files changed, 85 insertions(+) - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 38d93ff4f..38f5deeee 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -2678,4 +2678,6 @@ module = { - name = prep_loadenv; - common = commands/prep_loadenv.c; - enable = powerpc_ieee1275; -+ cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; -+ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; - }; -diff --git a/grub-core/commands/prep_loadenv.c b/grub-core/commands/prep_loadenv.c -index e731684d3..eaef2c9d4 100644 ---- a/grub-core/commands/prep_loadenv.c -+++ b/grub-core/commands/prep_loadenv.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -191,6 +192,65 @@ prep_partname (const char *devname, char **prep) - return err; - } - -+static grub_err_t -+boot_disk_prep_partname (char **name) -+{ -+ regex_t regex; -+ int ret; -+ grub_size_t s; -+ char *comperr; -+ const char *cmdpath; -+ regmatch_t *matches = NULL; -+ grub_err_t err = GRUB_ERR_NONE; -+ -+ *name = NULL; -+ -+ cmdpath = grub_env_get ("cmdpath"); -+ if (!cmdpath) -+ return GRUB_ERR_NONE; -+ -+ ret = regcomp (®ex, "\\(([^,]+)(,?.*)?\\)(.*)", REG_EXTENDED); -+ if (ret) -+ goto fail; -+ -+ matches = grub_calloc (regex.re_nsub + 1, sizeof (*matches)); -+ if (! matches) -+ goto fail; -+ -+ ret = regexec (®ex, cmdpath, regex.re_nsub + 1, matches, 0); -+ if (!ret) -+ { -+ char *devname = devname = match_substr (matches + 1, cmdpath); -+ if (!devname) -+ { -+ err = grub_error (GRUB_ERR_FILE_NOT_FOUND, "%s contains no disk name", cmdpath); -+ goto out; -+ } -+ -+ err = prep_partname (devname, name); -+ out: -+ grub_free (devname); -+ regfree (®ex); -+ grub_free (matches); -+ return err; -+ } -+ -+ fail: -+ grub_free (matches); -+ s = regerror (ret, ®ex, 0, 0); -+ comperr = grub_malloc (s); -+ if (!comperr) -+ { -+ regfree (®ex); -+ return grub_errno; -+ } -+ regerror (ret, ®ex, comperr, s); -+ err = grub_error (GRUB_ERR_TEST_FAILURE, "%s", comperr); -+ regfree (®ex); -+ grub_free (comperr); -+ return err; -+} -+ - static grub_err_t - grub_cmd_prep_loadenv (grub_command_t cmd __attribute__ ((unused)), - int argc, -@@ -221,10 +281,27 @@ grub_cmd_prep_loadenv (grub_command_t cmd __attribute__ ((unused)), - return GRUB_ERR_NONE; - } - -+static void -+early_prep_loadenv (void) -+{ -+ grub_err_t err; -+ char *prep; -+ -+ err = boot_disk_prep_partname (&prep); -+ if (err == GRUB_ERR_NONE && prep) -+ err = prep_read_envblk (prep); -+ if (err == GRUB_ERR_BAD_FILE_TYPE || err == GRUB_ERR_FILE_NOT_FOUND) -+ grub_error_pop (); -+ if (err != GRUB_ERR_NONE) -+ grub_print_error (); -+ grub_free (prep); -+} -+ - static grub_command_t cmd_prep_load; - - GRUB_MOD_INIT(prep_loadenv) - { -+ early_env_hook = early_prep_loadenv; - cmd_prep_load = - grub_register_command("prep_load_env", grub_cmd_prep_loadenv, - "DEVICE", -diff --git a/grub-core/kern/env.c b/grub-core/kern/env.c -index 764068896..5aa2dee6c 100644 ---- a/grub-core/kern/env.c -+++ b/grub-core/kern/env.c -@@ -28,6 +28,8 @@ static struct grub_env_context initial_context; - /* The current context. */ - struct grub_env_context *grub_current_context = &initial_context; - -+void (*early_env_hook) (void) = NULL; -+ - /* Return the hash representation of the string S. */ - static unsigned int - grub_env_hashval (const char *s) -diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 731c07c29..02df49206 100644 ---- a/grub-core/kern/main.c -+++ b/grub-core/kern/main.c -@@ -309,6 +309,9 @@ grub_main (void) - - grub_boot_time ("Before execution of embedded config."); - -+ if (early_env_hook != NULL) -+ early_env_hook (); -+ - if (load_config) - grub_parser_execute (load_config); - -diff --git a/include/grub/env.h b/include/grub/env.h -index 6b9379a30..cf78c5e12 100644 ---- a/include/grub/env.h -+++ b/include/grub/env.h -@@ -69,5 +69,6 @@ grub_env_extractor_open (int source); - grub_err_t - grub_env_extractor_close (int source); - -+extern void (*EXPORT_VAR (early_env_hook)) (void); - - #endif /* ! GRUB_ENV_HEADER */ --- -2.41.0 - diff --git a/0122-grub-install-disable-support-for-EFI-platforms.patch b/0122-grub-install-disable-support-for-EFI-platforms.patch new file mode 100644 index 0000000..380dbef --- /dev/null +++ b/0122-grub-install-disable-support-for-EFI-platforms.patch @@ -0,0 +1,111 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jan Hlavac +Date: Fri, 20 Nov 2020 23:51:47 +0100 +Subject: [PATCH] grub-install: disable support for EFI platforms + +For each platform, GRUB is shipped as a kernel image and a set of +modules. These files are then used by the grub-install utility to +install GRUB on a specific device. However, in order to support UEFI +Secure Boot, the resulting EFI binary must be signed by a recognized +private key. For this reason, for EFI platforms, most distributions also +ship prebuilt EFI binaries signed by a distribution-specific private +key. In this case, however, the grub-install utility should not be used +because it would overwrite the signed EFI binary. + +The current fix is suboptimal because it preserves all EFI-related code. +A better solution could be to modularize the code and provide a +build-time option. + +Resolves: rhbz#1737444 + +Signed-off-by: Jan Hlavac +[rharwood: drop man page] +--- + util/grub-install.c | 41 +++++++++++++++++++---------------------- + docs/grub.texi | 7 +++++++ + 2 files changed, 26 insertions(+), 22 deletions(-) + +diff --git a/util/grub-install.c b/util/grub-install.c +index 66ef9494d9d..828e8722ba5 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -915,6 +915,25 @@ main (int argc, char *argv[]) + + platform = grub_install_get_target (grub_install_source_directory); + ++ switch (platform) ++ { ++ case GRUB_INSTALL_PLATFORM_ARM_EFI: ++ case GRUB_INSTALL_PLATFORM_ARM64_EFI: ++ case GRUB_INSTALL_PLATFORM_I386_EFI: ++ case GRUB_INSTALL_PLATFORM_IA64_EFI: ++ case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: ++ case GRUB_INSTALL_PLATFORM_RISCV32_EFI: ++ case GRUB_INSTALL_PLATFORM_RISCV64_EFI: ++ case GRUB_INSTALL_PLATFORM_X86_64_EFI: ++ is_efi = 1; ++ grub_util_error (_("this utility cannot be used for EFI platforms" ++ " because it does not support UEFI Secure Boot")); ++ break; ++ default: ++ is_efi = 0; ++ break; ++ } ++ + { + char *platname = grub_install_get_platform_name (platform); + fprintf (stderr, _("Installing for %s platform.\n"), platname); +@@ -1029,27 +1048,6 @@ main (int argc, char *argv[]) + grub_hostfs_init (); + grub_host_init (); + +- switch (platform) +- { +- case GRUB_INSTALL_PLATFORM_I386_EFI: +- case GRUB_INSTALL_PLATFORM_X86_64_EFI: +- case GRUB_INSTALL_PLATFORM_ARM_EFI: +- case GRUB_INSTALL_PLATFORM_ARM64_EFI: +- case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: +- case GRUB_INSTALL_PLATFORM_RISCV32_EFI: +- case GRUB_INSTALL_PLATFORM_RISCV64_EFI: +- case GRUB_INSTALL_PLATFORM_IA64_EFI: +- is_efi = 1; +- break; +- default: +- is_efi = 0; +- break; +- +- /* pacify warning. */ +- case GRUB_INSTALL_PLATFORM_MAX: +- break; +- } +- + switch (platform) + { + case GRUB_INSTALL_PLATFORM_I386_IEEE1275: +@@ -1065,7 +1063,6 @@ main (int argc, char *argv[]) + } + + /* Find the EFI System Partition. */ +- + if (is_efi) + { + grub_fs_t fs; +diff --git a/docs/grub.texi b/docs/grub.texi +index 44c4e665a0d..1e577d2fee9 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -7112,6 +7112,13 @@ grub2-install @var{install_device} + The device name @var{install_device} is an OS device name or a GRUB + device name. + ++In order to support UEFI Secure Boot, the resulting GRUB EFI binary must ++be signed by a recognized private key. For this reason, for EFI ++platforms, most distributions also ship prebuilt GRUB EFI binaries ++signed by a distribution-specific private key. In this case, however, ++@command{grub2-install} should not be used because it would overwrite ++the signed EFI binary. ++ + @command{grub2-install} accepts the following options: + + @table @option diff --git a/0252-New-with-debug-timestamps-configure-flag-to-prepend-.patch b/0123-New-with-debug-timestamps-configure-flag-to-prepend-.patch similarity index 85% rename from 0252-New-with-debug-timestamps-configure-flag-to-prepend-.patch rename to 0123-New-with-debug-timestamps-configure-flag-to-prepend-.patch index d690eb7..426d5be 100644 --- a/0252-New-with-debug-timestamps-configure-flag-to-prepend-.patch +++ b/0123-New-with-debug-timestamps-configure-flag-to-prepend-.patch @@ -1,36 +1,24 @@ -From ea121326a65e2f33891e219d84d52a7f08d0bb80 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Sat, 23 Nov 2019 14:57:41 +0100 -Subject: [PATCH 252/272] New --with-debug-timestamps configure flag to prepend - debug traces with absolute and relative timestamp +Subject: [PATCH] New --with-debug-timestamps configure flag to prepend debug + traces with absolute and relative timestamp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Renaud Métrich --- - config.h.in | 1 + configure.ac | 18 ++++++++++++++++++ grub-core/kern/misc.c | 20 ++++++++++++++++++++ + config.h.in | 1 + 3 files changed, 39 insertions(+) -diff --git a/config.h.in b/config.h.in -index d294d2c65..39f4e5472 100644 ---- a/config.h.in -+++ b/config.h.in -@@ -16,6 +16,7 @@ - /* Define to 1 to enable disk cache statistics. */ - #define DISK_CACHE_STATS @DISK_CACHE_STATS@ - #define BOOT_TIME_STATS @BOOT_TIME_STATS@ -+#define DEBUG_WITH_TIMESTAMPS @DEBUG_WITH_TIMESTAMPS@ - - /* We don't need those. */ - #define MINILZO_CFG_SKIP_LZO_PTR 1 diff --git a/configure.ac b/configure.ac -index 25b249040..20209e24a 100644 +index ae7683d0693..016cd3d4e0e 100644 --- a/configure.ac +++ b/configure.ac -@@ -1687,6 +1687,17 @@ else +@@ -1686,6 +1686,17 @@ else fi AC_SUBST([BOOT_TIME_STATS]) @@ -48,7 +36,7 @@ index 25b249040..20209e24a 100644 AC_ARG_ENABLE([grub-emu-sdl2], [AS_HELP_STRING([--enable-grub-emu-sdl2], [build and install the `grub-emu' debugging utility with SDL2 support (default=guessed)])]) -@@ -2297,6 +2308,7 @@ AM_CONDITIONAL([COND_APPLE_LINKER], [test x$TARGET_APPLE_LINKER = x1]) +@@ -2296,6 +2307,7 @@ AM_CONDITIONAL([COND_APPLE_LINKER], [test x$TARGET_APPLE_LINKER = x1]) AM_CONDITIONAL([COND_ENABLE_EFIEMU], [test x$enable_efiemu = xyes]) AM_CONDITIONAL([COND_ENABLE_CACHE_STATS], [test x$DISK_CACHE_STATS = x1]) AM_CONDITIONAL([COND_ENABLE_BOOT_TIME_STATS], [test x$BOOT_TIME_STATS = x1]) @@ -56,7 +44,7 @@ index 25b249040..20209e24a 100644 AM_CONDITIONAL([COND_HAVE_CXX], [test x$HAVE_CXX = xyes]) -@@ -2398,6 +2410,12 @@ else +@@ -2397,6 +2409,12 @@ else echo With boot time statistics: No fi @@ -70,20 +58,20 @@ index 25b249040..20209e24a 100644 echo efiemu runtime: Yes else diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c -index 7cee5d75c..8fb711d56 100644 +index 779586658cb..d40586b9268 100644 --- a/grub-core/kern/misc.c +++ b/grub-core/kern/misc.c -@@ -26,6 +26,9 @@ - #include +@@ -27,6 +27,9 @@ #include #include + #include +#if DEBUG_WITH_TIMESTAMPS +#include +#endif union printf_arg { -@@ -235,9 +238,26 @@ grub_real_dprintf (const char *file, const int line, const char *condition, +@@ -236,9 +239,26 @@ grub_real_dprintf (const char *file, const int line, const char *condition, const char *fmt, ...) { va_list args; @@ -110,6 +98,15 @@ index 7cee5d75c..8fb711d56 100644 grub_printf ("%s:%d:%s: ", file, line, condition); va_start (args, fmt); grub_vprintf (fmt, args); --- -2.41.0 - +diff --git a/config.h.in b/config.h.in +index d294d2c653f..39f4e5472ce 100644 +--- a/config.h.in ++++ b/config.h.in +@@ -16,6 +16,7 @@ + /* Define to 1 to enable disk cache statistics. */ + #define DISK_CACHE_STATS @DISK_CACHE_STATS@ + #define BOOT_TIME_STATS @BOOT_TIME_STATS@ ++#define DEBUG_WITH_TIMESTAMPS @DEBUG_WITH_TIMESTAMPS@ + + /* We don't need those. */ + #define MINILZO_CFG_SKIP_LZO_PTR 1 diff --git a/0123-grub-install-bailout-root-device-probing.patch b/0123-grub-install-bailout-root-device-probing.patch deleted file mode 100644 index ec69273..0000000 --- a/0123-grub-install-bailout-root-device-probing.patch +++ /dev/null @@ -1,181 +0,0 @@ -From 5bc2a14ea50c1381dd557ff058788aa46c196b80 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 10 Feb 2022 22:16:58 +0800 -Subject: [PATCH 123/272] grub-install: bailout root device probing - -The root device is probed to test if the filesystem is btrfs in order to setup -boot configs for snapshot booting. However when the root device is a lvm thin -volume, due to lack in grub support, the probing will be errored out and entire -installation process aborts. - -Here we call out stat to bailout the situation whenever grub fails to probe -filesystem in it's own right. - - stat -f -c %T / - -The command is also used by grub-mkconfig for the same purpose. - -Signed-off-by: Michael Chang ---- - grub-core/osdep/basic/no_platform.c | 6 +++++ - grub-core/osdep/unix/platform.c | 34 +++++++++++++++++++++++++++++ - grub-core/osdep/windows/platform.c | 7 ++++++ - include/grub/util/install.h | 3 +++ - util/grub-install.c | 31 ++++++++++++++++++-------- - 5 files changed, 72 insertions(+), 9 deletions(-) - -diff --git a/grub-core/osdep/basic/no_platform.c b/grub-core/osdep/basic/no_platform.c -index d76c34c14..a9de0597d 100644 ---- a/grub-core/osdep/basic/no_platform.c -+++ b/grub-core/osdep/basic/no_platform.c -@@ -44,3 +44,9 @@ grub_install_sgi_setup (const char *install_device, - { - grub_util_error ("%s", _("no SGI routines are available for your platform")); - } -+ -+char * -+grub_install_get_filesystem (const char *path) -+{ -+ return NULL; -+} -\ No newline at end of file -diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c -index de712211c..1edca359a 100644 ---- a/grub-core/osdep/unix/platform.c -+++ b/grub-core/osdep/unix/platform.c -@@ -239,3 +239,37 @@ grub_install_sgi_setup (const char *install_device, - imgfile, destname, NULL }); - grub_util_warn ("%s", _("You will have to set `SystemPartition' and `OSLoader' manually.")); - } -+ -+char * -+grub_install_get_filesystem (const char *path) -+{ -+ int fd; -+ pid_t pid; -+ FILE *fp; -+ ssize_t len; -+ char *buf = NULL; -+ size_t bufsz = 0; -+ -+ pid = grub_util_exec_pipe ((const char * []){ "stat", "-f", "-c", "%T", path, NULL }, &fd); -+ if (!pid) -+ return NULL; -+ -+ fp = fdopen (fd, "r"); -+ if (!fp) -+ return NULL; -+ -+ len = getline (&buf, &bufsz, fp); -+ if (len == -1) -+ { -+ free (buf); -+ fclose (fp); -+ return NULL; -+ } -+ -+ fclose (fp); -+ -+ if (len > 0 && buf[len - 1] == '\n') -+ buf[len - 1] = '\0'; -+ -+ return buf; -+} -\ No newline at end of file -diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c -index af04c1a1e..e84c4d897 100644 ---- a/grub-core/osdep/windows/platform.c -+++ b/grub-core/osdep/windows/platform.c -@@ -434,3 +434,10 @@ grub_install_sgi_setup (const char *install_device, - { - grub_util_error ("%s", _("no SGI routines are available for your platform")); - } -+ -+ -+char * -+grub_install_get_filesystem (const char *path) -+{ -+ return NULL; -+} -\ No newline at end of file -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index e0decd784..8732a2494 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -247,6 +247,9 @@ void - grub_install_sgi_setup (const char *install_device, - const char *imgfile, const char *destname); - -+char * -+grub_install_get_filesystem (const char *path); -+ - int - grub_install_compress_gzip (const char *src, const char *dest); - int -diff --git a/util/grub-install.c b/util/grub-install.c -index efef6d09e..397592be9 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -911,7 +911,6 @@ main (int argc, char *argv[]) - const char *efi_file = NULL; - char **grub_devices; - grub_fs_t grub_fs; -- grub_fs_t root_fs; - grub_device_t grub_dev = NULL; - enum grub_install_plat platform; - char *grubdir, *device_map; -@@ -1089,8 +1088,10 @@ main (int argc, char *argv[]) - grub_host_init (); - - { -- char *rootdir_grub_devname; -- grub_device_t rootdir_grub_dev; -+ grub_device_t rootdir_grub_dev = NULL; -+ char *rootdir_grub_devname = NULL; -+ char *root_fs_name = NULL; -+ - char *t = grub_util_path_concat (2, "/", rootdir); - - rootdir_path = grub_canonicalize_file_name (t); -@@ -1111,20 +1112,32 @@ main (int argc, char *argv[]) - rootdir_devices[0]); - - rootdir_grub_dev = grub_device_open (rootdir_grub_devname); -- if (! rootdir_grub_dev) -- grub_util_error ("%s", grub_errmsg); -+ if (!rootdir_grub_dev) -+ { -+ root_fs_name = grub_install_get_filesystem (t); -+ if (root_fs_name) -+ grub_errno = 0; -+ } -+ else -+ { -+ grub_fs_t root_fs = grub_fs_probe (rootdir_grub_dev); -+ if (root_fs) -+ root_fs_name = grub_strdup (root_fs->name); -+ } - -- root_fs = grub_fs_probe (rootdir_grub_dev); -- if (!root_fs) -+ if (!root_fs_name) - grub_util_error ("%s", grub_errmsg); - - if (config.is_suse_btrfs_snapshot_enabled -- && grub_strncmp(root_fs->name, "btrfs", sizeof ("btrfs") - 1) == 0) -+ && root_fs_name -+ && grub_strncmp(root_fs_name, "btrfs", sizeof ("btrfs") - 1) == 0) - use_relative_path_on_btrfs = 1; - -+ free (root_fs_name); - free (t); - free (rootdir_grub_devname); -- grub_device_close (rootdir_grub_dev); -+ if (rootdir_grub_dev) -+ grub_device_close (rootdir_grub_dev); - } - - switch (platform) --- -2.41.0 - diff --git a/0253-Added-debug-statements-to-grub_disk_open-and-grub_di.patch b/0124-Added-debug-statements-to-grub_disk_open-and-grub_di.patch similarity index 62% rename from 0253-Added-debug-statements-to-grub_disk_open-and-grub_di.patch rename to 0124-Added-debug-statements-to-grub_disk_open-and-grub_di.patch index 9c9cac8..0cd12c4 100644 --- a/0253-Added-debug-statements-to-grub_disk_open-and-grub_di.patch +++ b/0124-Added-debug-statements-to-grub_disk_open-and-grub_di.patch @@ -1,7 +1,7 @@ -From 062ea7b8bfba6a7a3e289e0544bbb65ef18409fb Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Sat, 23 Nov 2019 15:22:16 +0100 -Subject: [PATCH 253/272] Added debug statements to grub_disk_open() and +Subject: [PATCH] Added debug statements to grub_disk_open() and grub_disk_close() on success MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -9,11 +9,11 @@ Content-Transfer-Encoding: 8bit Signed-off-by: Renaud Métrich --- - grub-core/kern/disk.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) + grub-core/kern/disk.c | 4 ++++ + 1 file changed, 4 insertions(+) diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c -index 1eda58fe9..6aaeeb515 100644 +index 1eda58fe9a1..355b6579d87 100644 --- a/grub-core/kern/disk.c +++ b/grub-core/kern/disk.c @@ -285,6 +285,8 @@ grub_disk_open (const char *name) @@ -25,15 +25,6 @@ index 1eda58fe9..6aaeeb515 100644 return disk; } -@@ -296,7 +298,7 @@ grub_disk_close (grub_disk_t disk) - if (disk == NULL) - return; - -- grub_dprintf ("disk", "Closing `%s'.\n", disk->name); -+ grub_dprintf ("disk", "Closing `%s'...\n", disk->name); - - if (disk->dev && disk->dev->disk_close) - (disk->dev->disk_close) (disk); @@ -310,8 +312,10 @@ grub_disk_close (grub_disk_t disk) grub_free (disk->partition); disk->partition = part; @@ -45,6 +36,3 @@ index 1eda58fe9..6aaeeb515 100644 } /* Small read (less than cache size and not pass across cache unit boundaries). --- -2.41.0 - diff --git a/0124-install-fix-software-raid1-on-esp.patch b/0124-install-fix-software-raid1-on-esp.patch deleted file mode 100644 index e85ed16..0000000 --- a/0124-install-fix-software-raid1-on-esp.patch +++ /dev/null @@ -1,415 +0,0 @@ -From 2143dab8db3b0ada0d3f1744c5e472716f6e1459 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 31 Dec 2020 21:54:07 +0800 -Subject: [PATCH 124/272] install: fix software raid1 on esp - -While running grub-install on an efi system where efi system partition -is configured as mdadm software raid1, it fails with errors like this: - - grub2-install: info: copying `/boot/grub2/x86_64-efi/core.efi' -> `/boot/efi/EFI/opensuse/grubx64.efi'. - grub2-install: info: Registering with EFI: distributor = `opensuse', path = `\EFI\opensuse\grubx64.efi', ESP at mduuid/9182c46b9d469f79b48850b68f3371a5. - grub2-install: info: executing efibootmgr --version /dev/null. - grub2-install: info: executing modprobe -q efivars. - grub2-install: info: executing efibootmgr -c -d. - efibootmgr: option requires an argument -- 'd' - efibootmgr version 14 - usage: efibootmgr [options] - -This should work with mdadm raid1 with metadata 0.9 and 1.0 whose -superblocks are at the end of device. However -grub_install_register_efi() doesn't seem to work if the target is -multiple devices so that it errors out. - -The patch changes grub_install_register_efi() to accept multiple devices -that can be used to creating efi boot entries for probed raid1 member -devices on mounted efi system partition. - -This patch also adds check for metadata 0.9 or 1.0 or the validation -will fail to continue the install. - -Signed-off-by: Michael Chang ---- - grub-core/disk/diskfilter.c | 27 +++---- - grub-core/disk/mdraid1x_linux.c | 3 + - grub-core/osdep/basic/no_platform.c | 3 +- - grub-core/osdep/unix/platform.c | 57 +++++++++++---- - grub-core/osdep/windows/platform.c | 3 +- - include/grub/diskfilter.h | 3 +- - include/grub/util/install.h | 5 +- - util/grub-install.c | 107 ++++++++++++++++++++++++++-- - 8 files changed, 171 insertions(+), 37 deletions(-) - -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index b74d2fd48..41e177549 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -159,8 +159,8 @@ scan_disk_partition_iter (grub_disk_t disk, grub_partition_t p, void *data) - for (m = arr->pvs; m; m = m->next) - if (m->disk && m->disk->id == disk->id - && m->disk->dev->id == disk->dev->id -- && m->part_start == grub_partition_get_start (disk->partition) -- && m->part_size == grub_disk_native_sectors (disk)) -+ && grub_partition_get_start (m->disk->partition) == grub_partition_get_start (disk->partition) -+ && grub_disk_native_sectors (m->disk) == grub_disk_native_sectors (disk)) - return 0; - } - -@@ -1338,19 +1338,23 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, - ? (grub_memcmp (pv->id.uuid, id->uuid, id->uuidlen) == 0) - : (pv->id.id == id->id)) - { -+ char *part_name = NULL; - struct grub_diskfilter_lv *lv; - /* FIXME: Check whether the update time of the superblocks are - the same. */ -- if (pv->disk && grub_disk_native_sectors (disk) >= pv->part_size) -+ if (pv->disk && grub_disk_native_sectors (disk) >= grub_disk_native_sectors (pv->disk)) - return GRUB_ERR_NONE; -- pv->disk = grub_disk_open (disk->name); -+ if (disk->partition) -+ { -+ char *p = grub_partition_get_name (disk->partition); -+ if (p) -+ part_name = grub_xasprintf ("%s,%s", disk->name, p); -+ grub_free (p); -+ } -+ pv->disk = grub_disk_open (part_name ? : disk->name); -+ grub_free (part_name); - if (!pv->disk) - return grub_errno; -- /* This could happen to LVM on RAID, pv->disk points to the -- raid device, we shouldn't change it. */ -- pv->start_sector -= pv->part_start; -- pv->part_start = grub_partition_get_start (disk->partition); -- pv->part_size = grub_disk_native_sectors (disk); - - #ifdef GRUB_UTIL - { -@@ -1367,7 +1371,6 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, - #endif - if (start_sector != (grub_uint64_t)-1) - pv->start_sector = start_sector; -- pv->start_sector += pv->part_start; - /* Add the device to the array. */ - for (lv = array->lvs; lv; lv = lv->next) - if (!lv->became_readable_at && lv->fullname && is_lv_readable (lv, 0)) -@@ -1455,8 +1458,8 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk, - { - if (pv->disk && pv->disk->id == disk->id - && pv->disk->dev->id == disk->dev->id -- && pv->part_start == grub_partition_get_start (disk->partition) -- && pv->part_size == grub_disk_native_sectors (disk)) -+ && grub_partition_get_start (pv->disk->partition) == grub_partition_get_start (disk->partition) -+ && grub_disk_native_sectors (pv->disk) == grub_disk_native_sectors (disk)) - { - if (vg_out) - *vg_out = vg; -diff --git a/grub-core/disk/mdraid1x_linux.c b/grub-core/disk/mdraid1x_linux.c -index 72e5cb6f4..d33b98b96 100644 ---- a/grub-core/disk/mdraid1x_linux.c -+++ b/grub-core/disk/mdraid1x_linux.c -@@ -208,6 +208,9 @@ grub_mdraid_detect (grub_disk_t disk, - grub_le_to_cpu32 (sb.chunksize), - grub_le_to_cpu32 (sb.layout), - grub_le_to_cpu32 (sb.level)); -+#ifdef GRUB_UTIL -+ array->mdraid1x_minor_version = minor_version; -+#endif - - return array; - } -diff --git a/grub-core/osdep/basic/no_platform.c b/grub-core/osdep/basic/no_platform.c -index a9de0597d..bcb5ab0ff 100644 ---- a/grub-core/osdep/basic/no_platform.c -+++ b/grub-core/osdep/basic/no_platform.c -@@ -33,7 +33,8 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, - void - grub_install_register_efi (grub_device_t efidir_grub_dev, - const char *efifile_path, -- const char *efi_distributor) -+ const char *efi_distributor, -+ const char *force_disk) - { - grub_util_error ("%s", _("no EFI routines are available for your platform")); - } -diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c -index 1edca359a..0a16ac293 100644 ---- a/grub-core/osdep/unix/platform.c -+++ b/grub-core/osdep/unix/platform.c -@@ -132,15 +132,14 @@ grub_install_remove_efi_entries_by_distributor (const char *efi_distributor) - } - - int --grub_install_register_efi (grub_device_t efidir_grub_dev, -+grub_install_register_efi (const grub_disk_t *efidir_grub_disk, - const char *efifile_path, -- const char *efi_distributor) -+ const char *efi_distributor, -+ const char *force_disk) - { -- const char * efidir_disk; -- int efidir_part; - int ret; -- efidir_disk = grub_util_biosdisk_get_osdev (efidir_grub_dev->disk); -- efidir_part = efidir_grub_dev->disk->partition ? efidir_grub_dev->disk->partition->number + 1 : 1; -+ const grub_disk_t *curdisk; -+ int ndev = 0; - - if (grub_util_exec_redirect_null ((const char * []){ "efibootmgr", "--version", NULL })) - { -@@ -158,22 +157,50 @@ grub_install_register_efi (grub_device_t efidir_grub_dev, - if (ret) - return ret; - -- char *efidir_part_str = xasprintf ("%d", efidir_part); -+ for (curdisk = efidir_grub_disk; *curdisk; curdisk++) -+ ndev++; - -- if (!verbosity) -- ret = grub_util_exec ((const char * []){ "efibootmgr", "-q", -+ for (curdisk = efidir_grub_disk; *curdisk; curdisk++) -+ { -+ const char * efidir_disk; -+ int efidir_part; -+ char *efidir_part_str; -+ char *new_efi_distributor = NULL; -+ grub_disk_t disk = *curdisk; -+ -+ efidir_disk = force_disk ? : grub_util_biosdisk_get_osdev (disk); -+ if (!efidir_disk) -+ grub_util_error (_("%s: no device for efi"), disk->name); -+ -+ efidir_part = disk->partition ? disk->partition->number + 1 : 1; -+ efidir_part_str = xasprintf ("%d", efidir_part); -+ if (ndev > 1) -+ { -+ const char *p = grub_strrchr (efidir_disk, '/'); -+ new_efi_distributor = xasprintf ("%s (%s%d)\n", -+ efi_distributor, -+ p ? p + 1: efidir_disk, -+ efidir_part); -+ } -+ -+ if (!verbosity) -+ ret = grub_util_exec ((const char * []){ "efibootmgr", "-q", - "-c", "-d", efidir_disk, - "-p", efidir_part_str, "-w", -- "-L", efi_distributor, "-l", -+ "-L", new_efi_distributor ? : efi_distributor, "-l", - efifile_path, NULL }); -- else -- ret = grub_util_exec ((const char * []){ "efibootmgr", -+ else -+ ret = grub_util_exec ((const char * []){ "efibootmgr", - "-c", "-d", efidir_disk, - "-p", efidir_part_str, "-w", -- "-L", efi_distributor, "-l", -+ "-L", new_efi_distributor ? : efi_distributor, "-l", - efifile_path, NULL }); -- free (efidir_part_str); -- return ret; -+ free (efidir_part_str); -+ free (new_efi_distributor); -+ if (ret) -+ return ret; -+ } -+ return 0; - } - - void -diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c -index e84c4d897..29c9bf81d 100644 ---- a/grub-core/osdep/windows/platform.c -+++ b/grub-core/osdep/windows/platform.c -@@ -204,7 +204,8 @@ set_efi_variable_bootn (grub_uint16_t n, void *in, grub_size_t len) - int - grub_install_register_efi (grub_device_t efidir_grub_dev, - const char *efifile_path, -- const char *efi_distributor) -+ const char *efi_distributor, -+ const char *force_disk) - { - grub_uint16_t *boot_order, *new_boot_order; - grub_uint16_t *distributor16; -diff --git a/include/grub/diskfilter.h b/include/grub/diskfilter.h -index f020d025b..dc1bd4db0 100644 ---- a/include/grub/diskfilter.h -+++ b/include/grub/diskfilter.h -@@ -49,6 +49,7 @@ struct grub_diskfilter_vg { - - #ifdef GRUB_UTIL - struct grub_diskfilter *driver; -+ grub_uint8_t mdraid1x_minor_version; - #endif - }; - -@@ -66,8 +67,6 @@ struct grub_diskfilter_pv { - /* Optional. */ - char *name; - grub_disk_t disk; -- grub_disk_addr_t part_start; -- grub_disk_addr_t part_size; - grub_disk_addr_t start_sector; /* Sector number where the data area starts. */ - struct grub_diskfilter_pv *next; - /* Optional. */ -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index 8732a2494..fe11a0411 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -235,9 +235,10 @@ int - grub_install_get_powerpc_secure_boot (void); - - int --grub_install_register_efi (grub_device_t efidir_grub_dev, -+grub_install_register_efi (const grub_disk_t *efidir_grub_disk, - const char *efifile_path, -- const char *efi_distributor); -+ const char *efi_distributor, -+ const char *force_disk); - - void - grub_install_register_ieee1275 (int is_prep, const char *install_device, -diff --git a/util/grub-install.c b/util/grub-install.c -index 397592be9..62012d055 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -1727,6 +1727,40 @@ main (int argc, char *argv[]) - } - } - prefix_drive = xasprintf ("(%s)", grub_drives[0]); -+ -+ if (platform == GRUB_INSTALL_PLATFORM_X86_64_EFI -+ && grub_dev->disk -+ && grub_dev->disk->partition -+ && grub_fs->fs_uuid) -+ { -+ int raid_level; -+ char *uuid = NULL; -+ char *escaped_relpath = NULL; -+ -+ raid_level = probe_raid_level (grub_dev->disk); -+ if (raid_level != 1) -+ goto out; -+ -+ escaped_relpath = escape (relative_grubdir); -+ if (!escaped_relpath) -+ goto out; -+ -+ if (grub_fs->fs_uuid (grub_dev, &uuid) || !uuid) -+ { -+ grub_print_error (); -+ grub_errno = 0; -+ goto out; -+ } -+ -+ if (!load_cfg_f) -+ load_cfg_f = grub_util_fopen (load_cfg, "wb"); -+ have_load_cfg = 1; -+ fprintf (load_cfg_f, "search --no-floppy --fs-uuid --set=root --hint='%s' %s\n", grub_drives[0], uuid); -+ fprintf (load_cfg_f, "set prefix=($root)'%s'\n", escaped_relpath); -+ grub_install_push_module ("search"); -+ out: -+ grub_free (escaped_relpath); -+ } - } - - #ifdef __linux__ -@@ -2255,9 +2289,13 @@ main (int argc, char *argv[]) - { - /* Try to make this image bootable using the EFI Boot Manager, if available. */ - int ret; -- ret = grub_install_register_efi (efidir_grub_dev, -+ grub_disk_t efidir_grub_disk[2]; -+ efidir_grub_disk[0] = efidir_grub_dev->disk; -+ efidir_grub_disk[1] = NULL; -+ ret = grub_install_register_efi (efidir_grub_disk, - "\\System\\Library\\CoreServices", -- efi_distributor); -+ efi_distributor, -+ NULL); - if (ret) - grub_util_error (_("efibootmgr failed to register the boot entry: %s"), - strerror (ret)); -@@ -2311,7 +2349,11 @@ main (int argc, char *argv[]) - { - char * efifile_path; - char * part; -+ int raid_level; - int ret; -+ grub_disk_t *efidir_grub_disk; -+ grub_disk_memberlist_t list = NULL, cur; -+ char * force_disk = NULL; - - /* Try to make this image bootable using the EFI Boot Manager, if available. */ - if (!efi_distributor || efi_distributor[0] == '\0') -@@ -2328,8 +2370,65 @@ main (int argc, char *argv[]) - efidir_grub_dev->disk->name, - (part ? ",": ""), (part ? : "")); - grub_free (part); -- ret = grub_install_register_efi (efidir_grub_dev, -- efifile_path, efi_distributor); -+ -+ raid_level = probe_raid_level (efidir_grub_dev->disk); -+ if (raid_level >= 0 && raid_level != 1) -+ grub_util_warn (_("unsupported raid level %d detected for efi system partition"), raid_level); -+ if (raid_level == 1 && !efidir_grub_dev->disk->partition) -+ { -+ const char *raidname = NULL; -+ -+ if (efidir_grub_dev->disk->dev->disk_raidname) -+ raidname = efidir_grub_dev->disk->dev->disk_raidname (efidir_grub_dev->disk); -+ if (raidname -+ && (grub_strncmp (raidname, "mdraid09", sizeof ("mdraid09")) == 0 -+ || (grub_strcmp (raidname, "mdraid1x") == 0 -+ && ((struct grub_diskfilter_lv *) efidir_grub_dev->disk->data)->vg->mdraid1x_minor_version == 0))) -+ { -+ if (efidir_grub_dev->disk->dev->disk_memberlist) -+ list = efidir_grub_dev->disk->dev->disk_memberlist (efidir_grub_dev->disk); -+ } -+ else -+ { -+ grub_util_warn (_("this array has metadata at the start and may not be suitable as a efi system partition." -+ " please ensure that your firmware understands md/v1.x metadata, or use --metadata=0.90" -+ " to create the array.")); -+ /* Try to continue regardless metadata, nothing to lose here */ -+ if (efidir_grub_dev->disk->dev->disk_memberlist) -+ list = efidir_grub_dev->disk->dev->disk_memberlist (efidir_grub_dev->disk); -+ } -+ } -+ else if (raid_level == 1) -+ force_disk = grub_util_get_os_disk (install_device); -+ if (list) -+ { -+ int i; -+ int ndisk = 0; -+ -+ for (cur = list; cur; cur = cur->next) -+ ++ndisk; -+ efidir_grub_disk = xcalloc (ndisk + 1, sizeof (*efidir_grub_disk)); -+ for (cur = list, i = 0; i < ndisk; cur = cur->next, i++) -+ efidir_grub_disk[i] = cur->disk; -+ efidir_grub_disk[ndisk] = NULL; -+ } -+ else -+ { -+ efidir_grub_disk = xcalloc (2, sizeof (*efidir_grub_disk)); -+ efidir_grub_disk[0] = efidir_grub_dev->disk; -+ efidir_grub_disk[1] = NULL; -+ } -+ ret = grub_install_register_efi (efidir_grub_disk, -+ efifile_path, efi_distributor, -+ force_disk); -+ while (list) -+ { -+ cur = list; -+ list = list->next; -+ grub_free (cur); -+ } -+ grub_free (force_disk); -+ grub_free (efidir_grub_disk); - if (ret) - grub_util_error (_("efibootmgr failed to register the boot entry: %s"), - strerror (ret)); --- -2.41.0 - diff --git a/0254-Introduce-function-grub_debug_is_enabled-void-return.patch b/0125-Introduce-function-grub_debug_is_enabled-void-return.patch similarity index 78% rename from 0254-Introduce-function-grub_debug_is_enabled-void-return.patch rename to 0125-Introduce-function-grub_debug_is_enabled-void-return.patch index c7c2805..224d204 100644 --- a/0254-Introduce-function-grub_debug_is_enabled-void-return.patch +++ b/0125-Introduce-function-grub_debug_is_enabled-void-return.patch @@ -1,8 +1,8 @@ -From b9dca03de43cf7ada4c22b51ba44a6d9eef9ee08 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Mon, 25 Nov 2019 09:29:53 +0100 -Subject: [PATCH 254/272] Introduce function grub_debug_is_enabled(void) - returning 1 if 'debug' is in the environment and not empty +Subject: [PATCH] Introduce function grub_debug_is_enabled(void) returning 1 if + 'debug' is in the environment and not empty MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -14,10 +14,10 @@ Signed-off-by: Renaud Métrich 2 files changed, 14 insertions(+) diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c -index 8fb711d56..73fd17897 100644 +index d40586b9268..d3a493e3552 100644 --- a/grub-core/kern/misc.c +++ b/grub-core/kern/misc.c -@@ -185,6 +185,19 @@ int grub_err_printf (const char *fmt, ...) +@@ -186,6 +186,19 @@ int grub_err_printf (const char *fmt, ...) __attribute__ ((alias("grub_printf"))); #endif @@ -38,7 +38,7 @@ index 8fb711d56..73fd17897 100644 grub_debug_enabled (const char * condition) { diff --git a/include/grub/misc.h b/include/grub/misc.h -index 1b35a167f..044d04689 100644 +index 72aff15750d..3f5f5b61695 100644 --- a/include/grub/misc.h +++ b/include/grub/misc.h @@ -369,6 +369,7 @@ grub_puts (const char *s) @@ -49,6 +49,3 @@ index 1b35a167f..044d04689 100644 int EXPORT_FUNC(grub_debug_enabled) (const char *condition); void EXPORT_FUNC(grub_real_dprintf) (const char *file, const int line, --- -2.41.0 - diff --git a/0125-grub-probe-Deduplicate-probed-partmap-output.patch b/0125-grub-probe-Deduplicate-probed-partmap-output.patch deleted file mode 100644 index 1aa4e9c..0000000 --- a/0125-grub-probe-Deduplicate-probed-partmap-output.patch +++ /dev/null @@ -1,110 +0,0 @@ -From d096e4de13b428f825b6ad91b6ff1479cbca14b4 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 18 Mar 2022 13:19:33 +0800 -Subject: [PATCH 125/272] grub-probe: Deduplicate probed partmap output - -If the target device being probed is staked on top of other physical or logical -devices, all containing device's partition map type will be printed once if ---target=partmap is used. This usually results in duplicated output as same -partition map type. - -This in turn may clutter grub.cfg with many duplicated insmod part_[a-z]+ if -the /boot is RAIDed because --target=partmap output is used to producing -partmap modules required to access disk device. - -Let's deduplicate that to make the grub.cfg looks better and disciplined. - -Signed-off-by: Michael Chang ---- - util/grub-probe.c | 59 +++++++++++++++++++++++++++++++++++++++++++---- - 1 file changed, 55 insertions(+), 4 deletions(-) - -diff --git a/util/grub-probe.c b/util/grub-probe.c -index 65c1ca3f8..e7efcc268 100644 ---- a/util/grub-probe.c -+++ b/util/grub-probe.c -@@ -153,6 +153,50 @@ do_print (const char *x, void *data) - grub_printf ("%s%c", x, delim); - } - -+static int -+check_duplicate_partmap (const char *name) -+{ -+ static int alloc, used; -+ static char **partmaps; -+ int i; -+ -+ if (!name) -+ { -+ if (partmaps) -+ { -+ for (i= 0; i < used; ++i) -+ free (partmaps[i]); -+ free (partmaps); -+ partmaps = NULL; -+ alloc = 0; -+ used = 0; -+ } -+ return 1; -+ } -+ -+ for (i= 0; i < used; ++i) -+ if (strcmp (partmaps[i], name) == 0) -+ return 1; -+ -+ if (alloc <= used) -+ { -+ alloc = (alloc) ? (alloc << 1) : 4; -+ partmaps = xrealloc (partmaps, alloc * sizeof (*partmaps)); -+ } -+ -+ partmaps[used++] = strdup (name); -+ return 0; -+} -+ -+static void -+do_print_partmap (const char *x, void *data) -+{ -+ char delim = *(const char *) data; -+ if (check_duplicate_partmap (x) != 0) -+ return; -+ grub_printf ("%s%c", x, delim); -+} -+ - static void - probe_partmap (grub_disk_t disk, char delim) - { -@@ -165,10 +209,14 @@ probe_partmap (grub_disk_t disk, char delim) - } - - for (part = disk->partition; part; part = part->parent) -- printf ("%s%c", part->partmap->name, delim); -+ { -+ if (check_duplicate_partmap (part->partmap->name) != 0) -+ continue; -+ printf ("%s%c", part->partmap->name, delim); -+ } - - if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) -- grub_diskfilter_get_partmap (disk, do_print, &delim); -+ grub_diskfilter_get_partmap (disk, do_print_partmap, &delim); - - /* In case of LVM/RAID, check the member devices as well. */ - if (disk->dev->disk_memberlist) -@@ -674,8 +722,11 @@ probe (const char *path, char **device_names, char delim) - probe_cryptodisk_uuid (dev->disk, delim); - - else if (print == PRINT_PARTMAP) -- /* Check if dev->disk itself is contained in a partmap. */ -- probe_partmap (dev->disk, delim); -+ { -+ /* Check if dev->disk itself is contained in a partmap. */ -+ probe_partmap (dev->disk, delim); -+ check_duplicate_partmap (NULL); -+ } - - else if (print == PRINT_PARTUUID) - { --- -2.41.0 - diff --git a/0255-Don-t-clear-screen-when-debugging-is-enabled.patch b/0126-Don-t-clear-screen-when-debugging-is-enabled.patch similarity index 69% rename from 0255-Don-t-clear-screen-when-debugging-is-enabled.patch rename to 0126-Don-t-clear-screen-when-debugging-is-enabled.patch index da4fd23..8cca97c 100644 --- a/0255-Don-t-clear-screen-when-debugging-is-enabled.patch +++ b/0126-Don-t-clear-screen-when-debugging-is-enabled.patch @@ -1,7 +1,7 @@ -From 92338e541fa3ec5cc191149a7a136f81f80294ef Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Sat, 23 Nov 2019 16:23:54 +0100 -Subject: [PATCH 255/272] Don't clear screen when debugging is enabled +Subject: [PATCH] Don't clear screen when debugging is enabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -14,10 +14,10 @@ Signed-off-by: Robbie Harwood 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 1f55b286d..668f48ba6 100644 +index b5fa6156549..0ea27d3c534 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -217,7 +217,8 @@ grub_normal_init_page (struct grub_term_output *term, +@@ -216,7 +216,8 @@ grub_normal_init_page (struct grub_term_output *term, grub_uint32_t *unicode_msg; grub_uint32_t *last_position; @@ -25,8 +25,5 @@ index 1f55b286d..668f48ba6 100644 + if (! grub_debug_is_enabled ()) + grub_term_cls (term); - msg_formatted = grub_xasprintf (_("GRUB version %s"), PACKAGE_VERSION); + msg_formatted = grub_xasprintf (_("GRUB version %s"), PACKAGE_VERSION); if (!msg_formatted) --- -2.41.0 - diff --git a/0126-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch b/0126-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch deleted file mode 100644 index 28d7427..0000000 --- a/0126-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 6c21bb7a11b70db7b4a57d662a6adad3bb23307e Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 19 May 2022 13:08:12 +0800 -Subject: [PATCH 126/272] Fix infinite boot loop on headless system in qemu - -After finishing headless virtual machine installation via serial -console, the reboot fails in grub with infinte boot loop and also -keyboard input for serial console is unresponsive. - -The cause of infinte loop boils down to legacy vga driver in grub -crashes when '-dispaly none' is used as qemu's display type described in -the manual as: - -"Do not display video output. The guest will still see an emulated -graphics card, but its output will not be displayed tothe QEMU user. -This option differs from the -nographic option in that it only affects -what is done with video output; -nographic also changes the destination -of the serial and parallel port data." - -Given there's no sensible way found to skip the emulated device from the -legacy vga module, we ended up removing it from all_video dependency so -it wouldn't be loaded by default. In any case, the vbe module remain -loaded and should fulfill the requirement of most hardwares even twenty -years old or more. - -The unresponsive serial input is also fixed by ensuring that console -input is loaded via appended so that they won't fail altogether with -errors by other console device if specifying on the same list. - -Signed-off-by: Michael Chang ---- - grub-core/genmoddep.awk | 3 +++ - util/grub.d/00_header.in | 10 +++++++++- - 2 files changed, 12 insertions(+), 1 deletion(-) - -diff --git a/grub-core/genmoddep.awk b/grub-core/genmoddep.awk -index cc987a53a..aaeb09270 100644 ---- a/grub-core/genmoddep.awk -+++ b/grub-core/genmoddep.awk -@@ -102,6 +102,9 @@ END { - } - modlist = "" - while (getline <"video.lst") { -+ if ($1 == "vga") { -+ continue; -+ } - modlist = modlist " " $1; - } - printf "all_video:%s\n", modlist; -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index f900f9773..2eeee1c62 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -260,7 +260,15 @@ case x${GRUB_TERMINAL_OUTPUT} in - ;; - x*) - cat << EOF --terminal_output ${GRUB_TERMINAL_OUTPUT} -+ -+for i in ${GRUB_TERMINAL_OUTPUT}; do -+ if [ x\${use_append} = xtrue ]; then -+ terminal_output --append \$i -+ elif terminal_output \$i; then -+ use_append=true; -+ fi -+done -+ - EOF - ;; - esac --- -2.41.0 - diff --git a/0256-grub_file_-instrumentation-new-file-debug-tag.patch b/0127-grub_file_-instrumentation-new-file-debug-tag.patch similarity index 91% rename from 0256-grub_file_-instrumentation-new-file-debug-tag.patch rename to 0127-grub_file_-instrumentation-new-file-debug-tag.patch index 4d98337..1d35707 100644 --- a/0256-grub_file_-instrumentation-new-file-debug-tag.patch +++ b/0127-grub_file_-instrumentation-new-file-debug-tag.patch @@ -1,7 +1,7 @@ -From 0750caf79b394d45ca27619b28775ce416f9552c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Fri, 29 Nov 2019 11:02:00 +0100 -Subject: [PATCH 256/272] grub_file_* instrumentation (new 'file' debug tag) +Subject: [PATCH] grub_file_* instrumentation (new 'file' debug tag) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -12,7 +12,7 @@ Signed-off-by: Renaud Métrich 1 file changed, 14 insertions(+) diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c -index 750177248..264211b11 100644 +index 750177248f9..264211b1143 100644 --- a/grub-core/kern/file.c +++ b/grub-core/kern/file.c @@ -66,6 +66,8 @@ grub_file_open (const char *name, enum grub_file_type type) @@ -69,6 +69,3 @@ index 750177248..264211b11 100644 grub_free (file->name); grub_free (file); return grub_errno; --- -2.41.0 - diff --git a/0127-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch b/0127-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch deleted file mode 100644 index 4085db4..0000000 --- a/0127-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 263c67739865bdcc52c5cab905075531be36ad34 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 11 May 2022 09:56:11 -0400 -Subject: [PATCH 127/272] ofdisk: improve boot time by lookup boot disk first - -While booting lvm, grub will try to build up logical volumes via hooks -to disk iteration where on-disk metadata can be read and parsed. However -the process can become very slow on multipath as reachable disks are -duplicated by multiple I/O paths and they all get inspected. - -Fortunately grub allows lvm to be lazy binding and opportunistic that -root volume can be created when it's needed using a smaller set of -discovered disks. The disk iteration can also be controlled by pull -methods to only returning specified disks. That said we may be able to -take advantage of existing design to cause less overhead in lvm -construction. - -This patch will return boot disks in OpenFirmware so they can be used -first. If lvm managed to create root volume out of those boot disks then -it is all very nice as they are readily available. Otherwise disk -scanning will be performed to present all discoverable disks to grub as -what it was done in the past. The result maybe again time consuming but -we have nothing to lose here. - -Signed-off-by: Michael Chang ---- - grub-core/disk/ieee1275/ofdisk.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index ca8f963c9..41869772a 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -491,10 +491,11 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, - { - unsigned i; - -- if (pull != GRUB_DISK_PULL_NONE) -+ if (pull > GRUB_DISK_PULL_REMOVABLE) - return 0; - -- scan (); -+ if (pull == GRUB_DISK_PULL_REMOVABLE) -+ scan (); - - for (i = 0; i < ARRAY_SIZE (ofdisk_hash); i++) - { -@@ -532,6 +533,12 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, - if (!ent->is_boot && ent->is_removable) - continue; - -+ if (pull == GRUB_DISK_PULL_NONE && !ent->is_boot) -+ continue; -+ -+ if (pull == GRUB_DISK_PULL_REMOVABLE && ent->is_boot) -+ continue; -+ - if (hook (ent->grub_shortest, hook_data)) - return 1; - } --- -2.41.0 - diff --git a/0080-ieee1275-Avoiding-many-unecessary-open-close.patch b/0128-ieee1275-Avoiding-many-unecessary-open-close.patch similarity index 74% rename from 0080-ieee1275-Avoiding-many-unecessary-open-close.patch rename to 0128-ieee1275-Avoiding-many-unecessary-open-close.patch index 639358f..fac8dc7 100644 --- a/0080-ieee1275-Avoiding-many-unecessary-open-close.patch +++ b/0128-ieee1275-Avoiding-many-unecessary-open-close.patch @@ -1,23 +1,15 @@ -From 10cd05f1bace213a2a8b4d3ca5364b3f36a8347e Mon Sep 17 00:00:00 2001 -From: Diego Domingos -Date: Thu, 19 Nov 2020 10:47:25 -0300 -Subject: [PATCH 080/272] ieee1275: Avoiding many unecessary open/close +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Diego Domingos +Date: Mon, 14 Dec 2020 17:42:45 +0100 +Subject: [PATCH] ieee1275: Avoiding many unecessary open/close -This patch aims to change the grub_ofdisk_open and grub_ofdisk_close behaviors. Since some devices (Fibre Channel and NVMe) can have a long time for shutdown notification, we should avoid open and close the disks as much as we can. - -So, we are changing how those functions works. The grub_ofdisk_close will take care of just changing the disk element status, by doing a soft close, i.e, the firmware will not be called. On the other hand, the grub_ofdisk_open will take care of closing the current disk opened only if the disk requested in the current call is different from the current one. This close will be responsible to request the firmware to actually close the disk. - -Yet, this patch modifies the grub_ofdisk_get_block_size function, avoiding open and close calls inside of it. - -Thank you Michael Chang (mchang@suse.com) for all support. - -Signed-off-by: Diego Domingos +Signed-off-by: Diego Domingos --- - grub-core/disk/ieee1275/ofdisk.c | 64 +++++++++++++++++--------------- + grub-core/disk/ieee1275/ofdisk.c | 64 ++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 29 deletions(-) diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index c6cba0c8a..629fc15f2 100644 +index c6cba0c8aaf..629fc15f284 100644 --- a/grub-core/disk/ieee1275/ofdisk.c +++ b/grub-core/disk/ieee1275/ofdisk.c @@ -44,7 +44,7 @@ struct ofdisk_hash_ent @@ -142,6 +134,3 @@ index c6cba0c8a..629fc15f2 100644 *block_size = 0; if (op->block_size_fails >= 2) --- -2.41.0 - diff --git a/0128-protectors-Add-key-protectors-framework.patch b/0128-protectors-Add-key-protectors-framework.patch deleted file mode 100644 index f4069ac..0000000 --- a/0128-protectors-Add-key-protectors-framework.patch +++ /dev/null @@ -1,190 +0,0 @@ -From eaeebf541569f218af84e82f773aabe20c2a134f Mon Sep 17 00:00:00 2001 -From: Hernan Gatta -Date: Tue, 1 Feb 2022 05:02:53 -0800 -Subject: [PATCH 128/272] protectors: Add key protectors framework - -A key protector encapsulates functionality to retrieve an unlocking key -for a fully-encrypted disk from a specific source. A key protector -module registers itself with the key protectors framework when it is -loaded and unregisters when unloaded. Additionally, a key protector may -accept parameters that describe how it should operate. - -The key protectors framework, besides offering registration and -unregistration functions, also offers a one-stop routine for finding and -invoking a key protector by name. If a key protector with the specified -name exists and if an unlocking key is successfully retrieved by it, the -function returns to the caller the retrieved key and its length. - -Signed-off-by: Hernan Gatta -Signed-off-by: Gary Lin ---- - grub-core/Makefile.am | 1 + - grub-core/Makefile.core.def | 1 + - grub-core/kern/protectors.c | 75 +++++++++++++++++++++++++++++++++++++ - include/grub/protector.h | 48 ++++++++++++++++++++++++ - 4 files changed, 125 insertions(+) - create mode 100644 grub-core/kern/protectors.c - create mode 100644 include/grub/protector.h - -diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am -index f18550c1c..af21fc72d 100644 ---- a/grub-core/Makefile.am -+++ b/grub-core/Makefile.am -@@ -90,6 +90,7 @@ endif - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h -+KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/protector.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/stack_protector.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h - KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 38f5deeee..0800e1f0a 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -149,6 +149,7 @@ kernel = { - common = kern/misc.c; - common = kern/parser.c; - common = kern/partition.c; -+ common = kern/protectors.c; - common = kern/rescue_parser.c; - common = kern/rescue_reader.c; - common = kern/term.c; -diff --git a/grub-core/kern/protectors.c b/grub-core/kern/protectors.c -new file mode 100644 -index 000000000..5ee059565 ---- /dev/null -+++ b/grub-core/kern/protectors.c -@@ -0,0 +1,75 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+ -+struct grub_key_protector *grub_key_protectors = NULL; -+ -+grub_err_t -+grub_key_protector_register (struct grub_key_protector *protector) -+{ -+ if (protector == NULL || protector->name == NULL || grub_strlen(protector->name) == 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ if (grub_key_protectors && -+ grub_named_list_find (GRUB_AS_NAMED_LIST (grub_key_protectors), -+ protector->name)) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ grub_list_push (GRUB_AS_LIST_P (&grub_key_protectors), -+ GRUB_AS_LIST (protector)); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_key_protector_unregister (struct grub_key_protector *protector) -+{ -+ if (protector == NULL) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ grub_list_remove (GRUB_AS_LIST (protector)); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_key_protector_recover_key (const char *protector, grub_uint8_t **key, -+ grub_size_t *key_size) -+{ -+ struct grub_key_protector *kp = NULL; -+ -+ if (grub_key_protectors == NULL) -+ return GRUB_ERR_OUT_OF_RANGE; -+ -+ if (protector == NULL || grub_strlen (protector) == 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ kp = grub_named_list_find (GRUB_AS_NAMED_LIST (grub_key_protectors), -+ protector); -+ if (kp == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("A key protector with name '%s' could not be found. " -+ "Is the name spelled correctly and is the " -+ "corresponding module loaded?"), protector); -+ -+ return kp->recover_key (key, key_size); -+} -diff --git a/include/grub/protector.h b/include/grub/protector.h -new file mode 100644 -index 000000000..3d9f69bce ---- /dev/null -+++ b/include/grub/protector.h -@@ -0,0 +1,48 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_PROTECTOR_HEADER -+#define GRUB_PROTECTOR_HEADER 1 -+ -+#include -+#include -+ -+struct grub_key_protector -+{ -+ struct grub_key_protector *next; -+ struct grub_key_protector **prev; -+ -+ const char *name; -+ -+ grub_err_t (*recover_key) (grub_uint8_t **key, grub_size_t *key_size); -+}; -+ -+extern struct grub_key_protector *EXPORT_VAR (grub_key_protectors); -+ -+grub_err_t -+EXPORT_FUNC (grub_key_protector_register) (struct grub_key_protector *protector); -+ -+grub_err_t -+EXPORT_FUNC (grub_key_protector_unregister) (struct grub_key_protector *protector); -+ -+grub_err_t -+EXPORT_FUNC (grub_key_protector_recover_key) (const char *protector, -+ grub_uint8_t **key, -+ grub_size_t *key_size); -+ -+#endif /* ! GRUB_PROTECTOR_HEADER */ --- -2.41.0 - diff --git a/0070-ieee1275-powerpc-implements-fibre-channel-discovery-.patch b/0129-ieee1275-powerpc-implements-fibre-channel-discovery-.patch similarity index 75% rename from 0070-ieee1275-powerpc-implements-fibre-channel-discovery-.patch rename to 0129-ieee1275-powerpc-implements-fibre-channel-discovery-.patch index 21a6cd0..9fa02bb 100644 --- a/0070-ieee1275-powerpc-implements-fibre-channel-discovery-.patch +++ b/0129-ieee1275-powerpc-implements-fibre-channel-discovery-.patch @@ -1,25 +1,28 @@ -From dbab0f047a86012ff4ba8bbe8d6b1d18675f44d2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Diego Domingos -Date: Wed, 24 Jun 2020 08:17:18 -0400 -Subject: [PATCH 070/272] ieee1275/powerpc: implements fibre channel discovery - for ofpathname +Date: Mon, 14 Dec 2020 17:45:28 +0100 +Subject: [PATCH] ieee1275/powerpc: implements fibre channel discovery for + ofpathname grub-ofpathname doesn't work with fibre channel because there is no function currently implemented for it. This patch enables it by prividing a function that looks for the port name, building the entire path for OF devices. + +Signed-off-by: Diego Domingos --- - grub-core/osdep/linux/ofpath.c | 48 ++++++++++++++++++++++++++++++++++ - 1 file changed, 48 insertions(+) + grub-core/osdep/linux/ofpath.c | 49 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 49 insertions(+) diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index a6153d359..f2bc9fc5c 100644 +index a6153d35954..0f5d54e9f2d 100644 --- a/grub-core/osdep/linux/ofpath.c +++ b/grub-core/osdep/linux/ofpath.c -@@ -399,6 +399,37 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), +@@ -350,6 +350,38 @@ of_path_of_ide(const char *sys_devname __attribute__((unused)), const char *devi + return ret; } - #endif ++ +static void +of_fc_port_name(const char *path, const char *subpath, char *port_name) +{ @@ -44,17 +47,17 @@ index a6153d359..f2bc9fc5c 100644 + grub_util_error (_("cannot read `%s': %s"), bname, strerror (errno)); + + sscanf(port_name,"0x%s",port_name); -+ ++ + close(fd); + + free(bname); + free(basepath); +} + - static int - vendor_is_ATA(const char *path) - { -@@ -577,6 +608,16 @@ of_path_of_scsi(const char *sys_devname __attribute__((unused)), const char *dev + #ifdef __sparc__ + static char * + of_path_of_nvme(const char *sys_devname __attribute__((unused)), +@@ -577,6 +609,16 @@ of_path_of_scsi(const char *sys_devname __attribute__((unused)), const char *dev digit_string = trailing_digits (device); if (strncmp (of_path, "/vdevice/", sizeof ("/vdevice/") - 1) == 0) { @@ -62,7 +65,7 @@ index a6153d359..f2bc9fc5c 100644 + { + char * port_name = xmalloc(sizeof(char)*17); + of_fc_port_name(sysfs_path, p, port_name); -+ ++ + snprintf(disk,sizeof(disk),"/%s@%s", disk_name, port_name); + free(port_name); + } @@ -71,7 +74,7 @@ index a6153d359..f2bc9fc5c 100644 unsigned long id = 0x8000 | (tgt << 8) | (bus << 5) | lun; if (*digit_string == '\0') { -@@ -590,6 +631,13 @@ of_path_of_scsi(const char *sys_devname __attribute__((unused)), const char *dev +@@ -590,6 +632,13 @@ of_path_of_scsi(const char *sys_devname __attribute__((unused)), const char *dev snprintf(disk, sizeof (disk), "/%s@%04lx000000000000:%c", disk_name, id, 'a' + (part - 1)); } @@ -79,12 +82,9 @@ index a6153d359..f2bc9fc5c 100644 + } else if (strstr(of_path,"fibre-channel")||(strstr(of_path,"vfc-client"))){ + char * port_name = xmalloc(sizeof(char)*17); + of_fc_port_name(sysfs_path, p, port_name); -+ ++ + snprintf(disk,sizeof(disk),"/%s@%s", disk_name, port_name); + free(port_name); } else { --- -2.41.0 - diff --git a/0129-tpm2-Add-TPM-Software-Stack-TSS.patch b/0129-tpm2-Add-TPM-Software-Stack-TSS.patch deleted file mode 100644 index 7ac3500..0000000 --- a/0129-tpm2-Add-TPM-Software-Stack-TSS.patch +++ /dev/null @@ -1,3569 +0,0 @@ -From 32eea7b2acf875b08391a9950db69927425fd7a9 Mon Sep 17 00:00:00 2001 -From: Hernan Gatta -Date: Tue, 1 Feb 2022 05:02:54 -0800 -Subject: [PATCH 129/272] tpm2: Add TPM Software Stack (TSS) - -A Trusted Platform Module (TPM) Software Stack (TSS) provides logic to -compose, submit, and parse TPM commands and responses. - -A limited number of TPM commands may be accessed via the EFI TCG2 -protocol. This protocol exposes functionality that is primarily geared -toward TPM usage within the context of Secure Boot. For all other TPM -commands, however, such as sealing and unsealing, this protocol does not -provide any help, with the exception of passthrough command submission. - -The SubmitCommand method allows a caller to send raw commands to the -system's TPM and to receive the corresponding response. These -command/response pairs are formatted using the TPM wire protocol. To -construct commands in this way, and to parse the TPM's response, it is -necessary to, first, possess knowledge of the various TPM structures, and, -second, of the TPM wire protocol itself. - -As such, this patch includes a set of header files that define the -necessary TPM structures and TSS functions, implementations of various -TPM2_* functions (inventoried below), and logic to write and read command -and response buffers, respectively, using the TPM wire protocol. - -Functions: TPM2_Create, TPM2_CreatePrimary, TPM2_EvictControl, -TPM2_FlushContext, TPM2_Load, TPM2_PCR_Read, TPM2_PolicyGetDigest, -TPM2_PolicyPCR, TPM2_ReadPublic, TPM2_StartAuthSession, TPM2_Unseal. - -Signed-off-by: Hernan Gatta -Signed-off-by: Gary Lin ---- - grub-core/tpm2/buffer.c | 145 +++++ - grub-core/tpm2/mu.c | 807 +++++++++++++++++++++++++ - grub-core/tpm2/tcg2.c | 143 +++++ - grub-core/tpm2/tpm2.c | 761 +++++++++++++++++++++++ - include/grub/tpm2/buffer.h | 65 ++ - include/grub/tpm2/internal/functions.h | 117 ++++ - include/grub/tpm2/internal/structs.h | 675 +++++++++++++++++++++ - include/grub/tpm2/internal/types.h | 370 ++++++++++++ - include/grub/tpm2/mu.h | 292 +++++++++ - include/grub/tpm2/tcg2.h | 34 ++ - include/grub/tpm2/tpm2.h | 34 ++ - 11 files changed, 3443 insertions(+) - create mode 100644 grub-core/tpm2/buffer.c - create mode 100644 grub-core/tpm2/mu.c - create mode 100644 grub-core/tpm2/tcg2.c - create mode 100644 grub-core/tpm2/tpm2.c - create mode 100644 include/grub/tpm2/buffer.h - create mode 100644 include/grub/tpm2/internal/functions.h - create mode 100644 include/grub/tpm2/internal/structs.h - create mode 100644 include/grub/tpm2/internal/types.h - create mode 100644 include/grub/tpm2/mu.h - create mode 100644 include/grub/tpm2/tcg2.h - create mode 100644 include/grub/tpm2/tpm2.h - -diff --git a/grub-core/tpm2/buffer.c b/grub-core/tpm2/buffer.c -new file mode 100644 -index 000000000..cb9f29497 ---- /dev/null -+++ b/grub-core/tpm2/buffer.c -@@ -0,0 +1,145 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+ -+void grub_tpm2_buffer_init (grub_tpm2_buffer_t buffer) -+{ -+ grub_memset (buffer->data, 0xDD, sizeof (buffer->data)); -+ buffer->size = 0; -+ buffer->offset = 0; -+ buffer->cap = sizeof (buffer->data); -+ buffer->error = 0; -+} -+ -+void -+grub_tpm2_buffer_pack (grub_tpm2_buffer_t buffer, const void* data, -+ grub_size_t size) -+{ -+ grub_uint32_t r = buffer->cap - buffer->size; -+ -+ if (buffer->error) -+ return; -+ -+ if (size > r) -+ { -+ buffer->error = 1; -+ return; -+ } -+ -+ grub_memcpy (&buffer->data[buffer->size], (void*) data, size); -+ buffer->size += size; -+} -+ -+void -+grub_tpm2_buffer_pack_u8 (grub_tpm2_buffer_t buffer, grub_uint8_t value) -+{ -+ grub_tpm2_buffer_pack (buffer, (const char*) &value, sizeof (value)); -+} -+ -+void -+grub_tpm2_buffer_pack_u16 (grub_tpm2_buffer_t buffer, grub_uint16_t value) -+{ -+ grub_uint16_t tmp = grub_cpu_to_be16 (value); -+ grub_tpm2_buffer_pack (buffer, (const char*) &tmp, sizeof (tmp)); -+} -+ -+void -+grub_tpm2_buffer_pack_u32 (grub_tpm2_buffer_t buffer, grub_uint32_t value) -+{ -+ grub_uint32_t tmp = grub_cpu_to_be32 (value); -+ grub_tpm2_buffer_pack (buffer, (const char*) &tmp, sizeof (tmp)); -+} -+ -+void -+grub_tpm2_buffer_unpack (grub_tpm2_buffer_t buffer, void* data, -+ grub_size_t size) -+{ -+ grub_uint32_t r = buffer->size - buffer->offset; -+ -+ if (buffer->error) -+ return; -+ -+ if (size > r) -+ { -+ buffer->error = 1; -+ return; -+ } -+ -+ grub_memcpy (data, &buffer->data[buffer->offset], size); -+ buffer->offset += size; -+} -+ -+void -+grub_tpm2_buffer_unpack_u8 (grub_tpm2_buffer_t buffer, grub_uint8_t* value) -+{ -+ grub_uint32_t r = buffer->size - buffer->offset; -+ -+ if (buffer->error) -+ return; -+ -+ if (sizeof (*value) > r) -+ { -+ buffer->error = 1; -+ return; -+ } -+ -+ grub_memcpy (value, &buffer->data[buffer->offset], sizeof (*value)); -+ buffer->offset += sizeof (*value); -+} -+ -+void -+grub_tpm2_buffer_unpack_u16 (grub_tpm2_buffer_t buffer, grub_uint16_t* value) -+{ -+ grub_uint16_t tmp; -+ grub_uint32_t r = buffer->size - buffer->offset; -+ -+ if (buffer->error) -+ return; -+ -+ if (sizeof (tmp) > r) -+ { -+ buffer->error = 1; -+ return; -+ } -+ -+ grub_memcpy (&tmp, &buffer->data[buffer->offset], sizeof (tmp)); -+ buffer->offset += sizeof (tmp); -+ *value = grub_be_to_cpu16 (tmp); -+} -+ -+void -+grub_tpm2_buffer_unpack_u32 (grub_tpm2_buffer_t buffer, grub_uint32_t* value) -+{ -+ grub_uint32_t tmp; -+ grub_uint32_t r = buffer->size - buffer->offset; -+ -+ if (buffer->error) -+ return; -+ -+ if (sizeof (tmp) > r) -+ { -+ buffer->error = 1; -+ return; -+ } -+ -+ grub_memcpy (&tmp, &buffer->data[buffer->offset], sizeof (tmp)); -+ buffer->offset += sizeof (tmp); -+ *value = grub_be_to_cpu32 (tmp); -+} -diff --git a/grub-core/tpm2/mu.c b/grub-core/tpm2/mu.c -new file mode 100644 -index 000000000..1617f37cd ---- /dev/null -+++ b/grub-core/tpm2/mu.c -@@ -0,0 +1,807 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+ -+void -+grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_AUTH_COMMAND* authCommand) -+{ -+ grub_uint32_t start; -+ grub_uint32_t tmp; -+ -+ grub_tpm2_buffer_pack_u32 (buffer, 0); -+ start = buffer->size; -+ -+ grub_tpm2_buffer_pack_u32 (buffer, authCommand->sessionHandle); -+ -+ grub_tpm2_buffer_pack_u16 (buffer, authCommand->nonce.size); -+ grub_tpm2_buffer_pack (buffer, authCommand->nonce.buffer, -+ authCommand->nonce.size); -+ -+ grub_tpm2_buffer_pack_u8 (buffer, -+ *((const grub_uint8_t*) &authCommand->sessionAttributes)); -+ -+ grub_tpm2_buffer_pack_u16 (buffer, authCommand->hmac.size); -+ grub_tpm2_buffer_pack (buffer, authCommand->hmac.buffer, -+ authCommand->hmac.size); -+ -+ tmp = grub_cpu_to_be32 (buffer->size - start); -+ grub_memcpy (&buffer->data[start - sizeof (grub_uint32_t)], &tmp, -+ sizeof (tmp)); -+} -+ -+void -+grub_tpm2_mu_TPM2B_Marshal (grub_tpm2_buffer_t buffer, -+ const grub_uint16_t size, -+ const grub_uint8_t* b) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, size); -+ -+ for (grub_uint16_t i = 0; i < size; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, b[i]); -+} -+ -+void -+grub_tpm2_mu_TPMU_SYM_KEY_BITS_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_SYM_OBJECT algorithm, -+ const TPMU_SYM_KEY_BITS *p) -+{ -+ switch (algorithm) -+ { -+ case TPM_ALG_AES: -+ case TPM_ALG_SM4: -+ case TPM_ALG_CAMELLIA: -+ case TPM_ALG_XOR: -+ grub_tpm2_buffer_pack_u16 (buffer, *((const grub_uint16_t*) p)); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMU_SYM_MODE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_SYM_OBJECT algorithm, -+ const TPMU_SYM_MODE *p) -+{ -+ switch (algorithm) -+ { -+ case TPM_ALG_AES: -+ case TPM_ALG_SM4: -+ case TPM_ALG_CAMELLIA: -+ grub_tpm2_buffer_pack_u16 (buffer, *((const grub_uint16_t*) p)); -+ break; -+ case TPM_ALG_XOR: -+ case TPM_ALG_NULL: -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_SYM_DEF *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->algorithm); -+ grub_tpm2_mu_TPMU_SYM_KEY_BITS_Marshal (buffer, p->algorithm, &p->keyBits); -+ grub_tpm2_mu_TPMU_SYM_MODE_Marshal (buffer, p->algorithm, &p->mode); -+} -+ -+void -+grub_tpm2_mu_TPMS_PCR_SELECTION_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_PCR_SELECTION* pcrSelection) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, pcrSelection->hash); -+ grub_tpm2_buffer_pack_u8 (buffer, pcrSelection->sizeOfSelect); -+ -+ for (grub_uint32_t i = 0; i < pcrSelection->sizeOfSelect; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, pcrSelection->pcrSelect[i]); -+} -+ -+void -+grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (grub_tpm2_buffer_t buffer, -+ const TPML_PCR_SELECTION* pcrSelection) -+{ -+ grub_tpm2_buffer_pack_u32 (buffer, pcrSelection->count); -+ -+ for (grub_uint32_t i = 0; i < pcrSelection->count; i++) -+ grub_tpm2_mu_TPMS_PCR_SELECTION_Marshal (buffer, -+ &pcrSelection->pcrSelections[i]); -+} -+ -+void -+grub_tpm2_mu_TPMA_OBJECT_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMA_OBJECT *p) -+{ -+ grub_tpm2_buffer_pack_u32 (buffer, *((const grub_uint32_t*) p)); -+} -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_XOR_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SCHEME_XOR *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->hashAlg); -+ grub_tpm2_buffer_pack_u16 (buffer, p->kdf); -+} -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_HMAC_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SCHEME_HMAC *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->hashAlg); -+} -+ -+void -+grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_KEYEDHASH_SCHEME scheme, -+ const TPMU_SCHEME_KEYEDHASH *p) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_HMAC: -+ grub_tpm2_mu_TPMS_SCHEME_HMAC_Marshal (buffer, &p->hmac); -+ break; -+ case TPM_ALG_XOR: -+ grub_tpm2_mu_TPMS_SCHEME_XOR_Marshal (buffer, &p->exclusiveOr); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_KEYEDHASH_SCHEME *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->scheme); -+ grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Marshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_KEYEDHASH_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Marshal (buffer, &p->scheme); -+} -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_SYM_DEF_OBJECT *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->algorithm); -+ grub_tpm2_mu_TPMU_SYM_KEY_BITS_Marshal (buffer, p->algorithm, &p->keyBits); -+ grub_tpm2_mu_TPMU_SYM_MODE_Marshal (buffer, p->algorithm, &p->mode); -+} -+ -+void -+grub_tpm2_mu_TPMU_ASYM_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_RSA_DECRYPT scheme, -+ const TPMU_ASYM_SCHEME *p __attribute__ ((unused))) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_NULL: -+ break; -+ default: -+ /* Unsupported */ -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_RSA_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_RSA_SCHEME *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->scheme); -+ grub_tpm2_mu_TPMU_ASYM_SCHEME_Marshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_RSA_PARMS_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_RSA_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Marshal (buffer, &p->symmetric); -+ grub_tpm2_mu_TPMT_RSA_SCHEME_Marshal (buffer, &p->scheme); -+ grub_tpm2_buffer_pack_u16 (buffer, p->keyBits); -+ grub_tpm2_buffer_pack_u32 (buffer, p->exponent); -+} -+ -+void -+grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SYMCIPHER_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Marshal (buffer, &p->sym); -+} -+ -+void -+grub_tpm2_mu_TPMT_ECC_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_ECC_SCHEME *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->scheme); -+ grub_tpm2_mu_TPMU_ASYM_SCHEME_Marshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMU_KDF_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_KDF scheme, -+ const TPMU_KDF_SCHEME *p) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_MGF1: -+ grub_tpm2_buffer_pack_u16 (buffer, p->mgf1.hashAlg); -+ break; -+ case TPM_ALG_KDF1_SP800_56A: -+ grub_tpm2_buffer_pack_u16 (buffer, p->kdf1_sp800_56a.hashAlg); -+ break; -+ case TPM_ALG_KDF2: -+ grub_tpm2_buffer_pack_u16 (buffer, p->kdf2.hashAlg); -+ break; -+ case TPM_ALG_KDF1_SP800_108: -+ grub_tpm2_buffer_pack_u16 (buffer, p->kdf1_sp800_108.hashAlg); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_KDF_SCHEME_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_KDF_SCHEME *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->scheme); -+ grub_tpm2_mu_TPMU_KDF_SCHEME_Marshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_ECC_PARMS_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_ECC_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Marshal (buffer, &p->symmetric); -+ grub_tpm2_mu_TPMT_ECC_SCHEME_Marshal (buffer, &p->scheme); -+ grub_tpm2_buffer_pack_u16 (buffer, p->curveID); -+ grub_tpm2_mu_TPMT_KDF_SCHEME_Marshal (buffer, &p->kdf); -+} -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_PARMS_Marshal (grub_tpm2_buffer_t buffer, -+ const grub_uint32_t type, -+ const TPMU_PUBLIC_PARMS *p) -+{ -+ switch (type) -+ { -+ case TPM_ALG_KEYEDHASH: -+ grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Marshal (buffer, &p->keyedHashDetail); -+ break; -+ case TPM_ALG_SYMCIPHER: -+ grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Marshal (buffer, &p->symDetail); -+ break; -+ case TPM_ALG_RSA: -+ grub_tpm2_mu_TPMS_RSA_PARMS_Marshal (buffer, &p->rsaDetail); -+ break; -+ case TPM_ALG_ECC: -+ grub_tpm2_mu_TPMS_ECC_PARMS_Marshal (buffer, &p->eccDetail); -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMS_ECC_POINT_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_ECC_POINT *p) -+{ -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->x.size, p->x.buffer); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->y.size, p->y.buffer); -+} -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_ID_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_PUBLIC type, -+ const TPMU_PUBLIC_ID *p) -+{ -+ switch(type) -+ { -+ case TPM_ALG_KEYEDHASH: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->keyedHash.size, -+ p->keyedHash.buffer); -+ break; -+ case TPM_ALG_SYMCIPHER: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->sym.size, p->sym.buffer); -+ break; -+ case TPM_ALG_RSA: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->rsa.size, p->rsa.buffer); -+ break; -+ case TPM_ALG_ECC: -+ grub_tpm2_mu_TPMS_ECC_POINT_Marshal (buffer, &p->ecc); -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_PUBLIC_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_PUBLIC *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->type); -+ grub_tpm2_buffer_pack_u16 (buffer, p->nameAlg); -+ grub_tpm2_mu_TPMA_OBJECT_Marshal (buffer, &p->objectAttributes); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->authPolicy.size, p->authPolicy.buffer); -+ grub_tpm2_mu_TPMU_PUBLIC_PARMS_Marshal (buffer, p->type, &p->parameters); -+ grub_tpm2_mu_TPMU_PUBLIC_ID_Marshal (buffer, p->type, &p->unique); -+} -+ -+void -+grub_tpm2_mu_TPM2B_PUBLIC_Marshal (grub_tpm2_buffer_t buffer, -+ const TPM2B_PUBLIC *p) -+{ -+ grub_uint32_t start; -+ grub_uint16_t size; -+ -+ if (p) -+ { -+ grub_tpm2_buffer_pack_u16 (buffer, p->size); -+ -+ start = buffer->size; -+ grub_tpm2_mu_TPMT_PUBLIC_Marshal (buffer, &p->publicArea); -+ size = grub_cpu_to_be16 (buffer->size - start); -+ grub_memcpy (&buffer->data[start - sizeof (grub_uint16_t)], &size, -+ sizeof (size)); -+ } -+ else -+ grub_tpm2_buffer_pack_u16 (buffer, 0); -+} -+ -+void -+grub_tpm2_mu_TPMS_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SENSITIVE_CREATE *p) -+{ -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->userAuth.size, p->userAuth.buffer); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->data.size, p->data.buffer); -+} -+ -+void -+grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPM2B_SENSITIVE_CREATE *sensitiveCreate) -+{ -+ grub_uint32_t start; -+ grub_uint16_t size; -+ -+ if (sensitiveCreate) -+ { -+ grub_tpm2_buffer_pack_u16 (buffer, sensitiveCreate->size); -+ start = buffer->size; -+ grub_tpm2_mu_TPMS_SENSITIVE_CREATE_Marshal (buffer, -+ &sensitiveCreate->sensitive); -+ size = grub_cpu_to_be16 (buffer->size - start); -+ -+ grub_memcpy (&buffer->data[start - sizeof (grub_uint16_t)], &size, -+ sizeof (size)); -+ } -+ else -+ grub_tpm2_buffer_pack_u16 (buffer, 0); -+} -+ -+void -+grub_tpm2_mu_TPM2B_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPM2B* p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->size); -+ -+ for (grub_uint16_t i = 0; i < p->size; i++) -+ grub_tpm2_buffer_unpack_u8 (buffer, &p->buffer[i]); -+} -+ -+void -+grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_AUTH_RESPONSE* p) -+{ -+ grub_uint8_t tmp; -+ grub_uint32_t tmp32; -+ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->nonce.size); -+ -+ if (p->nonce.size) -+ grub_tpm2_buffer_unpack (buffer, &p->nonce.buffer, p->nonce.size); -+ -+ grub_tpm2_buffer_unpack_u8 (buffer, &tmp); -+ tmp32 = tmp; -+ grub_memcpy (&p->sessionAttributes, &tmp32, sizeof (grub_uint32_t)); -+ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->hmac.size); -+ -+ if (p->hmac.size) -+ grub_tpm2_buffer_unpack (buffer, &p->hmac.buffer, p->hmac.size); -+} -+ -+void -+grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPM2B_DIGEST* digest) -+{ -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*)digest); -+} -+ -+void -+grub_tpm2_mu_TPMA_OBJECT_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMA_OBJECT *p) -+{ -+ grub_tpm2_buffer_unpack_u32 (buffer, (grub_uint32_t*)p); -+} -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_HMAC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_SCHEME_HMAC *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->hashAlg); -+} -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_XOR_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_SCHEME_XOR *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->hashAlg); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->kdf); -+} -+ -+void -+grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_KEYEDHASH_SCHEME scheme, -+ TPMU_SCHEME_KEYEDHASH *p) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_HMAC: -+ grub_tpm2_mu_TPMS_SCHEME_HMAC_Unmarshal (buffer, &p->hmac); -+ break; -+ case TPM_ALG_XOR: -+ grub_tpm2_mu_TPMS_SCHEME_XOR_Unmarshal (buffer, &p->exclusiveOr); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_KEYEDHASH_SCHEME *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->scheme); -+ grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Unmarshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_KEYEDHASH_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Unmarshal (buffer, &p->scheme); -+} -+ -+void -+grub_tpm2_mu_TPMU_SYM_KEY_BITS_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_SYM_OBJECT algorithm, -+ TPMU_SYM_KEY_BITS *p) -+{ -+ switch (algorithm) -+ { -+ case TPM_ALG_AES: -+ case TPM_ALG_SM4: -+ case TPM_ALG_CAMELLIA: -+ case TPM_ALG_XOR: -+ grub_tpm2_buffer_unpack_u16 (buffer, (grub_uint16_t*) p); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMU_SYM_MODE_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_SYM_OBJECT algorithm, -+ TPMU_SYM_MODE *p) -+{ -+ switch (algorithm) -+ { -+ case TPM_ALG_AES: -+ case TPM_ALG_SM4: -+ case TPM_ALG_CAMELLIA: -+ grub_tpm2_buffer_unpack_u16 (buffer, (grub_uint16_t*) p); -+ break; -+ case TPM_ALG_XOR: -+ case TPM_ALG_NULL: -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_SYM_DEF_OBJECT *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->algorithm); -+ grub_tpm2_mu_TPMU_SYM_KEY_BITS_Unmarshal (buffer, p->algorithm, &p->keyBits); -+ grub_tpm2_mu_TPMU_SYM_MODE_Unmarshal (buffer, p->algorithm, &p->mode); -+} -+ -+void -+grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_SYMCIPHER_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Unmarshal (buffer, &p->sym); -+} -+ -+void -+grub_tpm2_mu_TPMU_ASYM_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_RSA_DECRYPT scheme, -+ TPMU_ASYM_SCHEME *p __attribute__((unused))) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_NULL: -+ break; -+ default: -+ /* Unsupported */ -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_RSA_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_RSA_SCHEME *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->scheme); -+ grub_tpm2_mu_TPMU_ASYM_SCHEME_Unmarshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_RSA_PARMS_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_RSA_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Unmarshal (buffer, &p->symmetric); -+ grub_tpm2_mu_TPMT_RSA_SCHEME_Unmarshal (buffer, &p->scheme); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->keyBits); -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->exponent); -+} -+ -+void -+grub_tpm2_mu_TPMT_ECC_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_ECC_SCHEME *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->scheme); -+ grub_tpm2_mu_TPMU_ASYM_SCHEME_Unmarshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMU_KDF_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_KDF scheme, -+ TPMU_KDF_SCHEME *p) -+{ -+ switch (scheme) -+ { -+ case TPM_ALG_MGF1: -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->mgf1.hashAlg); -+ break; -+ case TPM_ALG_KDF1_SP800_56A: -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->kdf1_sp800_56a.hashAlg); -+ break; -+ case TPM_ALG_KDF2: -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->kdf2.hashAlg); -+ break; -+ case TPM_ALG_KDF1_SP800_108: -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->kdf1_sp800_108.hashAlg); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_KDF_SCHEME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_KDF_SCHEME *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->scheme); -+ grub_tpm2_mu_TPMU_KDF_SCHEME_Unmarshal (buffer, p->scheme, &p->details); -+} -+ -+void -+grub_tpm2_mu_TPMS_ECC_PARMS_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_ECC_PARMS *p) -+{ -+ grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Unmarshal (buffer, &p->symmetric); -+ grub_tpm2_mu_TPMT_ECC_SCHEME_Unmarshal (buffer, &p->scheme ); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->curveID); -+ grub_tpm2_mu_TPMT_KDF_SCHEME_Unmarshal (buffer, &p->kdf); -+} -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_PARMS_Unmarshal (grub_tpm2_buffer_t buffer, -+ grub_uint32_t type, -+ TPMU_PUBLIC_PARMS *p) -+{ -+ switch (type) -+ { -+ case TPM_ALG_KEYEDHASH: -+ grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Unmarshal (buffer, &p->keyedHashDetail); -+ break; -+ case TPM_ALG_SYMCIPHER: -+ grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Unmarshal (buffer, &p->symDetail); -+ break; -+ case TPM_ALG_RSA: -+ grub_tpm2_mu_TPMS_RSA_PARMS_Unmarshal (buffer, &p->rsaDetail); -+ break; -+ case TPM_ALG_ECC: -+ grub_tpm2_mu_TPMS_ECC_PARMS_Unmarshal (buffer, &p->eccDetail); -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMS_ECC_POINT_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_ECC_POINT *p) -+{ -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->x); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->y); -+} -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_ID_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_PUBLIC type, -+ TPMU_PUBLIC_ID *p) -+{ -+ switch(type) -+ { -+ case TPM_ALG_KEYEDHASH: -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->keyedHash); -+ break; -+ case TPM_ALG_SYMCIPHER: -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->sym); -+ break; -+ case TPM_ALG_RSA: -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->rsa); -+ break; -+ case TPM_ALG_ECC: -+ grub_tpm2_mu_TPMS_ECC_POINT_Unmarshal (buffer, &p->ecc); -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_PUBLIC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_PUBLIC *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->type); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->nameAlg); -+ grub_tpm2_mu_TPMA_OBJECT_Unmarshal (buffer, &p->objectAttributes); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->authPolicy); -+ grub_tpm2_mu_TPMU_PUBLIC_PARMS_Unmarshal (buffer, p->type, &p->parameters); -+ grub_tpm2_mu_TPMU_PUBLIC_ID_Unmarshal (buffer, p->type, &p->unique); -+} -+ -+void -+grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPM2B_PUBLIC *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->size); -+ grub_tpm2_mu_TPMT_PUBLIC_Unmarshal (buffer, &p->publicArea); -+} -+ -+void -+grub_tpm2_mu_TPMS_NV_PUBLIC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_NV_PUBLIC *p) -+{ -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->nvIndex); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->nameAlg); -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->attributes); -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (buffer, &p->authPolicy); -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->dataSize); -+} -+ -+void -+grub_tpm2_mu_TPM2B_NV_PUBLIC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPM2B_NV_PUBLIC *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->size); -+ grub_tpm2_mu_TPMS_NV_PUBLIC_Unmarshal (buffer, &p->nvPublic); -+} -+ -+void -+grub_tpm2_mu_TPM2B_NAME_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPM2B_NAME *n) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &n->size); -+ grub_tpm2_buffer_unpack (buffer, n->name, n->size); -+} -+ -+void -+grub_tpm2_mu_TPMS_TAGGED_PROPERTY_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_TAGGED_PROPERTY* property) -+{ -+ grub_tpm2_buffer_unpack_u32 (buffer, &property->property); -+ grub_tpm2_buffer_unpack_u32 (buffer, &property->value); -+} -+ -+void -+grub_tpm2_mu_TPMS_CAPABILITY_DATA_tpmProperties_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_CAPABILITY_DATA* capabilityData) -+{ -+ grub_tpm2_buffer_unpack_u32 (buffer, -+ &capabilityData->data.tpmProperties.count); -+ -+ if (buffer->error) -+ return; -+ -+ for (grub_uint32_t i = 0; i < capabilityData->data.tpmProperties.count; i++) -+ grub_tpm2_mu_TPMS_TAGGED_PROPERTY_Unmarshal (buffer, -+ &capabilityData->data.tpmProperties.tpmProperty[i]); -+} -+ -+void -+grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_TK_CREATION *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->tag); -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->hierarchy); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->digest); -+} -+ -+void -+grub_tpm2_mu_TPMS_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_PCR_SELECTION* pcrSelection) -+{ -+ grub_tpm2_buffer_unpack_u16 (buf, &pcrSelection->hash); -+ grub_tpm2_buffer_unpack_u8 (buf, &pcrSelection->sizeOfSelect); -+ -+ for (grub_uint32_t i = 0; i < pcrSelection->sizeOfSelect; i++) -+ grub_tpm2_buffer_unpack_u8 (buf, &pcrSelection->pcrSelect[i]); -+} -+ -+void -+grub_tpm2_mu_TPML_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, -+ TPML_PCR_SELECTION* pcrSelection) -+{ -+ grub_tpm2_buffer_unpack_u32 (buf, &pcrSelection->count); -+ -+ for (grub_uint32_t i = 0; i < pcrSelection->count; i++) -+ grub_tpm2_mu_TPMS_PCR_SELECTION_Unmarshal (buf, &pcrSelection->pcrSelections[i]); -+} -+ -+void -+grub_tpm2_mu_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buf, -+ TPML_DIGEST* digest) -+{ -+ grub_tpm2_buffer_unpack_u32 (buf, &digest->count); -+ -+ for (grub_uint32_t i = 0; i < digest->count; i++) -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (buf, &digest->digests[i]); -+} -diff --git a/grub-core/tpm2/tcg2.c b/grub-core/tpm2/tcg2.c -new file mode 100644 -index 000000000..9e4b7f565 ---- /dev/null -+++ b/grub-core/tpm2/tcg2.c -@@ -0,0 +1,143 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+static grub_err_t -+grub_tcg2_get_caps (grub_efi_tpm2_protocol_t *protocol, int *tpm2, -+ grub_size_t *max_output_size) -+{ -+ grub_efi_status_t status; -+ -+ static int has_caps = 0; -+ static EFI_TCG2_BOOT_SERVICE_CAPABILITY caps = -+ { -+ .Size = (grub_uint8_t) sizeof (caps) -+ }; -+ -+ if (has_caps) -+ goto exit; -+ -+ status = protocol->get_capability (protocol, &caps); -+ if (status != GRUB_EFI_SUCCESS || !caps.TPMPresentFlag) -+ return GRUB_ERR_FILE_NOT_FOUND; -+ -+ has_caps = 1; -+ -+exit: -+ if (tpm2) -+ *tpm2 = caps.TPMPresentFlag; -+ if (max_output_size) -+ *max_output_size = caps.MaxResponseSize; -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tcg2_get_protocol (grub_efi_tpm2_protocol_t **protocol) -+{ -+ static grub_guid_t tpm2_guid = EFI_TPM2_GUID; -+ static grub_efi_tpm2_protocol_t *tpm2_protocol = NULL; -+ -+ int tpm2; -+ grub_efi_handle_t *handles; -+ grub_efi_uintn_t num_handles; -+ grub_efi_handle_t tpm2_handle; -+ grub_err_t err = GRUB_ERR_FILE_NOT_FOUND; -+ -+ if (tpm2_protocol) -+ { -+ *protocol = tpm2_protocol; -+ return GRUB_ERR_NONE; -+ } -+ -+ handles = grub_efi_locate_handle (GRUB_EFI_BY_PROTOCOL, &tpm2_guid, NULL, -+ &num_handles); -+ if (!handles || !num_handles) -+ return err; -+ -+ tpm2_handle = handles[0]; -+ -+ tpm2_protocol = grub_efi_open_protocol (tpm2_handle, &tpm2_guid, -+ GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL); -+ if (!tpm2_protocol) -+ goto exit; -+ -+ err = grub_tcg2_get_caps (tpm2_protocol, &tpm2, NULL); -+ if (err || !tpm2) -+ goto exit; -+ -+ *protocol = tpm2_protocol; -+ err = GRUB_ERR_NONE; -+ -+exit: -+ grub_free (handles); -+ return err; -+} -+ -+grub_err_t -+grub_tcg2_get_max_output_size (grub_size_t *size) -+{ -+ grub_err_t err; -+ grub_size_t max; -+ grub_efi_tpm2_protocol_t *protocol; -+ -+ if (!size) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ err = grub_tcg2_get_protocol (&protocol); -+ if (err) -+ return err; -+ -+ err = grub_tcg2_get_caps (protocol, NULL, &max); -+ if (err) -+ return err; -+ -+ *size = max; -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tcg2_submit_command (grub_size_t input_size, -+ grub_uint8_t *input, -+ grub_size_t output_size, -+ grub_uint8_t *output) -+{ -+ grub_err_t err; -+ grub_efi_status_t status; -+ grub_efi_tpm2_protocol_t *protocol; -+ -+ if (!input_size || !input || !output_size || !output) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ err = grub_tcg2_get_protocol (&protocol); -+ if (err) -+ return err; -+ -+ status = protocol->submit_command (protocol, input_size, input, -+ output_size, output); -+ if (status != GRUB_EFI_SUCCESS) -+ return GRUB_ERR_INVALID_COMMAND; -+ -+ return GRUB_ERR_NONE; -+} -diff --git a/grub-core/tpm2/tpm2.c b/grub-core/tpm2/tpm2.c -new file mode 100644 -index 000000000..d67699a24 ---- /dev/null -+++ b/grub-core/tpm2/tpm2.c -@@ -0,0 +1,761 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+static TPM_RC -+grub_tpm2_submit_command_real (const TPMI_ST_COMMAND_TAG tag, -+ const TPM_CC commandCode, -+ TPM_RC *responseCode, -+ const struct grub_tpm2_buffer *in, -+ struct grub_tpm2_buffer *out) -+{ -+ grub_err_t err; -+ struct grub_tpm2_buffer buf; -+ TPMI_ST_COMMAND_TAG tag_out; -+ grub_uint32_t command_size; -+ grub_size_t max_output_size; -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&buf); -+ grub_tpm2_buffer_pack_u16 (&buf, tag); -+ grub_tpm2_buffer_pack_u32 (&buf, 0); -+ grub_tpm2_buffer_pack_u32 (&buf, commandCode); -+ grub_tpm2_buffer_pack (&buf, in->data, in->size); -+ -+ if (buf.error) -+ return TPM_RC_FAILURE; -+ -+ command_size = grub_swap_bytes32 (buf.size); -+ grub_memcpy (&buf.data[sizeof (grub_uint16_t)], &command_size, -+ sizeof (command_size)); -+ -+ /* Stay within output block limits */ -+ err = grub_tcg2_get_max_output_size (&max_output_size); -+ if (err || max_output_size > out->cap) -+ max_output_size = out->cap - 1; -+ -+ /* Submit */ -+ err = grub_tcg2_submit_command (buf.size, buf.data, max_output_size, -+ out->data); -+ if (err) -+ return TPM_RC_FAILURE; -+ -+ /* Unmarshal*/ -+ out->size = sizeof (grub_uint16_t) + sizeof (grub_uint32_t) + -+ sizeof (grub_uint32_t); -+ grub_tpm2_buffer_unpack_u16 (out, &tag_out); -+ grub_tpm2_buffer_unpack_u32 (out, &command_size); -+ grub_tpm2_buffer_unpack_u32 (out, responseCode); -+ out->size = command_size; -+ if (out->error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+static TPM_RC -+grub_tpm2_submit_command (const TPMI_ST_COMMAND_TAG tag, -+ const TPM_CC commandCode, -+ TPM_RC *responseCode, -+ const struct grub_tpm2_buffer *in, -+ struct grub_tpm2_buffer *out) -+{ -+ TPM_RC err; -+ int retry_cnt = 0; -+ -+ /* Catch TPM_RC_RETRY and send the command again */ -+ do { -+ err = grub_tpm2_submit_command_real (tag, commandCode, responseCode, -+ in, out); -+ if (*responseCode != TPM_RC_RETRY) -+ break; -+ -+ retry_cnt++; -+ } while (retry_cnt < 3); -+ -+ return err; -+} -+ -+TPM_RC -+TPM2_CreatePrimary (const TPMI_RH_HIERARCHY primaryHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE_CREATE *inSensitive, -+ const TPM2B_PUBLIC *inPublic, -+ const TPM2B_DATA *outsideInfo, -+ const TPML_PCR_SELECTION *creationPCR, -+ TPM_HANDLE *objectHandle, -+ TPM2B_PUBLIC *outPublic, -+ TPM2B_CREATION_DATA *creationData, -+ TPM2B_DIGEST *creationHash, -+ TPMT_TK_CREATION *creationTicket, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM_HANDLE objectHandleTmp; -+ TPM2B_PUBLIC outPublicTmp; -+ TPM2B_CREATION_DATA creationDataTmp; -+ TPM2B_DIGEST creationHashTmp; -+ TPMT_TK_CREATION creationTicketTmp; -+ TPM2B_NAME nameTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t parameterSize; -+ -+ if (!inSensitive || !inPublic || !outsideInfo || !creationPCR) -+ return TPM_RC_VALUE; -+ -+ if (!objectHandle) -+ objectHandle = &objectHandleTmp; -+ if (!outPublic) -+ outPublic = &outPublicTmp; -+ if (!creationData) -+ creationData = &creationDataTmp; -+ if (!creationHash) -+ creationHash = &creationHashTmp; -+ if (!creationTicket) -+ creationTicket = &creationTicketTmp; -+ if (!name) -+ name = &nameTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (outPublic, 0, sizeof (*outPublic)); -+ grub_memset (creationData, 0, sizeof (*creationData)); -+ grub_memset (creationHash, 0, sizeof (*creationHash)); -+ grub_memset (creationTicket, 0, sizeof (*creationTicket)); -+ grub_memset (name, 0, sizeof (*name)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, primaryHandle); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (&in, inSensitive); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&in, inPublic); -+ grub_tpm2_mu_TPM2B_Marshal (&in, outsideInfo->size, outsideInfo->buffer); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&in, creationPCR); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_CreatePrimary, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ grub_tpm2_buffer_unpack_u32 (&out, objectHandle); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (&out, outPublic); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)creationData); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)creationHash); -+ grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (&out, creationTicket); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)name); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_StartAuthSession (const TPMI_DH_OBJECT tpmKey, -+ const TPMI_DH_ENTITY bind, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_NONCE *nonceCaller, -+ const TPM2B_ENCRYPTED_SECRET *encryptedSalt, -+ const TPM_SE sessionType, -+ const TPMT_SYM_DEF *symmetric, -+ const TPMI_ALG_HASH authHash, -+ TPMI_SH_AUTH_SESSION *sessionHandle, -+ TPM2B_NONCE *nonceTpm, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMI_SH_AUTH_SESSION sessionHandleTmp; -+ TPM2B_NONCE nonceTpmTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!nonceCaller || !symmetric) -+ return TPM_RC_VALUE; -+ -+ if (tpmKey == TPM_RH_NULL && -+ (encryptedSalt && encryptedSalt->size != 0)) -+ return TPM_RC_VALUE; -+ -+ if (!sessionHandle) -+ sessionHandle = &sessionHandleTmp; -+ if (!nonceTpm) -+ nonceTpm = &nonceTpmTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (sessionHandle, 0, sizeof (*sessionHandle)); -+ grub_memset (nonceTpm, 0, sizeof (*nonceTpm)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, tpmKey); -+ grub_tpm2_buffer_pack_u32 (&in, bind); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_Marshal (&in, nonceCaller->size, nonceCaller->buffer); -+ if (encryptedSalt) -+ grub_tpm2_mu_TPM2B_Marshal (&in, encryptedSalt->size, encryptedSalt->secret); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_buffer_pack_u8 (&in, sessionType); -+ grub_tpm2_mu_TPMT_SYM_DEF_Marshal (&in, symmetric); -+ grub_tpm2_buffer_pack_u16 (&in, authHash); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_StartAuthSession, &responseCode, -+ &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ grub_tpm2_buffer_unpack_u32 (&out, sessionHandle); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)nonceTpm); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_PolicyPCR (const TPMI_SH_POLICY policySessions, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *pcrDigest, -+ const TPML_PCR_SELECTION *pcrs, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!pcrs) -+ return TPM_RC_VALUE; -+ -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, policySessions); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (pcrDigest) -+ grub_tpm2_mu_TPM2B_Marshal (&in, pcrDigest->size, pcrDigest->buffer); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&in, pcrs); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_PolicyPCR, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_ReadPublic (const TPMI_DH_OBJECT objectHandle, -+ const TPMS_AUTH_COMMAND* authCommand, -+ TPM2B_PUBLIC *outPublic) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t parameterSize; -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, objectHandle); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_ReadPublic, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (&out, outPublic); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_Load (const TPMI_DH_OBJECT parent_handle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_PRIVATE *inPrivate, -+ const TPM2B_PUBLIC *inPublic, -+ TPM_HANDLE *objectHandle, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM_HANDLE objectHandleTmp; -+ TPM2B_NAME nonceTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!inPrivate || !inPublic) -+ return TPM_RC_VALUE; -+ -+ if (!objectHandle) -+ objectHandle = &objectHandleTmp; -+ if (!name) -+ name = &nonceTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (objectHandle, 0, sizeof (*objectHandle)); -+ grub_memset (name, 0, sizeof (*name)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, parent_handle); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_Marshal (&in, inPrivate->size, inPrivate->buffer); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&in, inPublic); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_Load, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ grub_tpm2_buffer_unpack_u32 (&out, objectHandle); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)name); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_Unseal (const TPMI_DH_OBJECT itemHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ TPM2B_SENSITIVE_DATA *outData, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM2B_SENSITIVE_DATA outDataTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!outData) -+ outData = &outDataTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (outData, 0, sizeof (*outData)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, itemHandle); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_Unseal, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ // Unmarhsal -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)outData); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_FlushContext (const TPMI_DH_CONTEXT handle) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM_RC responseCode; -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, handle); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (TPM_ST_NO_SESSIONS, TPM_CC_FlushContext, -+ &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_PCR_Read (const TPMS_AUTH_COMMAND *authCommand, -+ const TPML_PCR_SELECTION *pcrSelectionIn, -+ grub_uint32_t *pcrUpdateCounter, -+ TPML_PCR_SELECTION *pcrSelectionOut, -+ TPML_DIGEST *pcrValues, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ grub_uint32_t pcrUpdateCounterTmp; -+ TPML_PCR_SELECTION pcrSelectionOutTmp; -+ TPML_DIGEST pcrValuesTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t parameterSize; -+ -+ if (!pcrSelectionIn) -+ return TPM_RC_VALUE; -+ -+ if (!pcrUpdateCounter) -+ pcrUpdateCounter = &pcrUpdateCounterTmp; -+ if (!pcrSelectionOut) -+ pcrSelectionOut = &pcrSelectionOutTmp; -+ if (!pcrValues) -+ pcrValues = &pcrValuesTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&in, pcrSelectionIn); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_PCR_Read, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_buffer_unpack_u32 (&out, pcrUpdateCounter); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Unmarshal (&out, pcrSelectionOut); -+ grub_tpm2_mu_TPML_DIGEST_Unmarshal (&out, pcrValues); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_PolicyGetDigest (const TPMI_SH_POLICY policySession, -+ const TPMS_AUTH_COMMAND *authCommand, -+ TPM2B_DIGEST *policyDigest, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPM2B_DIGEST policyDigestTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t parameterSize; -+ -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ if (!policyDigest) -+ policyDigest = &policyDigestTmp; -+ -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ grub_memset (policyDigest, 0, sizeof (*policyDigest)); -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, policySession); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_PolicyGetDigest, &responseCode, -+ &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)policyDigest); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_Create (const TPMI_DH_OBJECT parentHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE_CREATE *inSensitive, -+ const TPM2B_PUBLIC *inPublic, -+ const TPM2B_DATA *outsideInfo, -+ const TPML_PCR_SELECTION *creationPCR, -+ TPM2B_PRIVATE *outPrivate, -+ TPM2B_PUBLIC *outPublic, -+ TPM2B_CREATION_DATA *creationData, -+ TPM2B_DIGEST *creationHash, -+ TPMT_TK_CREATION *creationTicket, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM2B_PUBLIC outPublicTmp; -+ TPM2B_PRIVATE outPrivateTmp; -+ TPM2B_CREATION_DATA creationDataTmp; -+ TPM2B_DIGEST creationHashTmp; -+ TPMT_TK_CREATION creationTicketTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS:TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ TPM_RC rc; -+ grub_uint32_t parameterSize; -+ -+ if (!inSensitive || !inPublic || !outsideInfo || !creationPCR) -+ return TPM_RC_VALUE; -+ -+ if (!outPrivate) -+ outPrivate = &outPrivateTmp; -+ if (!outPublic) -+ outPublic = &outPublicTmp; -+ if (!creationData) -+ creationData = &creationDataTmp; -+ if (!creationHash) -+ creationHash = &creationHashTmp; -+ if (!creationTicket) -+ creationTicket = &creationTicketTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (outPrivate, 0, sizeof (*outPrivate)); -+ grub_memset (outPublic, 0, sizeof (*outPublic)); -+ grub_memset (creationData, 0, sizeof (*creationData)); -+ grub_memset (creationHash, 0, sizeof (*creationHash)); -+ grub_memset (creationTicket, 0, sizeof (*creationTicket)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, parentHandle); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (&in, inSensitive); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&in, inPublic); -+ grub_tpm2_mu_TPM2B_Marshal (&in, outsideInfo->size, outsideInfo->buffer); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&in, creationPCR); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_Create, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)outPrivate); -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (&out, outPublic); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)creationData); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)creationHash); -+ grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (&out, creationTicket); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal(&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_EvictControl (const TPMI_RH_PROVISION auth, -+ const TPMI_DH_OBJECT objectHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPMI_DH_PERSISTENT persistentHandle, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ TPM_RC rc; -+ grub_uint32_t parameterSize; -+ -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, auth); -+ grub_tpm2_buffer_pack_u32 (&in, objectHandle); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_buffer_pack_u32 (&in, persistentHandle); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_EvictControl, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ { -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal(&out, authResponse); -+ } -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -diff --git a/include/grub/tpm2/buffer.h b/include/grub/tpm2/buffer.h -new file mode 100644 -index 000000000..87dcd8d6c ---- /dev/null -+++ b/include/grub/tpm2/buffer.h -@@ -0,0 +1,65 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_BUFFER_HEADER -+#define GRUB_TPM2_BUFFER_HEADER 1 -+ -+#include -+ -+#define GRUB_TPM2_BUFFER_CAPACITY 4096 -+ -+struct grub_tpm2_buffer -+{ -+ grub_uint8_t data[GRUB_TPM2_BUFFER_CAPACITY]; -+ grub_size_t size; -+ grub_size_t offset; -+ grub_size_t cap; -+ int error; -+}; -+typedef struct grub_tpm2_buffer *grub_tpm2_buffer_t; -+ -+void -+grub_tpm2_buffer_init (grub_tpm2_buffer_t buffer); -+ -+void -+grub_tpm2_buffer_pack (grub_tpm2_buffer_t buffer, const void* data, -+ grub_size_t size); -+ -+void -+grub_tpm2_buffer_pack_u8 (grub_tpm2_buffer_t buffer, grub_uint8_t value); -+ -+void -+grub_tpm2_buffer_pack_u16 (grub_tpm2_buffer_t buffer, grub_uint16_t value); -+ -+void -+grub_tpm2_buffer_pack_u32 (grub_tpm2_buffer_t buffer, grub_uint32_t value); -+ -+void -+grub_tpm2_buffer_unpack (grub_tpm2_buffer_t buffer, void* data, -+ grub_size_t size); -+ -+void -+grub_tpm2_buffer_unpack_u8 (grub_tpm2_buffer_t buffer, grub_uint8_t* value); -+ -+void -+grub_tpm2_buffer_unpack_u16 (grub_tpm2_buffer_t buffer, grub_uint16_t* value); -+ -+void -+grub_tpm2_buffer_unpack_u32 (grub_tpm2_buffer_t buffer, grub_uint32_t* value); -+ -+#endif /* ! GRUB_TPM2_BUFFER_HEADER */ -diff --git a/include/grub/tpm2/internal/functions.h b/include/grub/tpm2/internal/functions.h -new file mode 100644 -index 000000000..9380f26a2 ---- /dev/null -+++ b/include/grub/tpm2/internal/functions.h -@@ -0,0 +1,117 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_INTERNAL_FUNCTIONS_HEADER -+#define GRUB_TPM2_INTERNAL_FUNCTIONS_HEADER 1 -+ -+#include -+ -+TPM_RC -+TPM2_CreatePrimary (const TPMI_RH_HIERARCHY primaryHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE_CREATE *inSensitive, -+ const TPM2B_PUBLIC *inPublic, -+ const TPM2B_DATA *outsideInfo, -+ const TPML_PCR_SELECTION *creationPCR, -+ TPM_HANDLE *objectHandle, -+ TPM2B_PUBLIC *outPublic, -+ TPM2B_CREATION_DATA *creationData, -+ TPM2B_DIGEST *creationHash, -+ TPMT_TK_CREATION *creationTicket, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_StartAuthSession (const TPMI_DH_OBJECT tpmKey, -+ const TPMI_DH_ENTITY bind, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_NONCE *nonceCaller, -+ const TPM2B_ENCRYPTED_SECRET *encryptedSalt, -+ const TPM_SE sessionType, -+ const TPMT_SYM_DEF *symmetric, -+ const TPMI_ALG_HASH authHash, -+ TPMI_SH_AUTH_SESSION *sessionHandle, -+ TPM2B_NONCE *nonceTpm, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_PolicyPCR (const TPMI_SH_POLICY policySession, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *pcrDigest, -+ const TPML_PCR_SELECTION *pcrs, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_ReadPublic (const TPMI_DH_OBJECT objectHandle, -+ const TPMS_AUTH_COMMAND* authCommand, -+ TPM2B_PUBLIC *outPublic); -+ -+TPM_RC -+TPM2_Load (const TPMI_DH_OBJECT parent_handle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_PRIVATE *inPrivate, -+ const TPM2B_PUBLIC *inPublic, -+ TPM_HANDLE *objectHandle, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_Unseal (const TPMI_DH_OBJECT item_handle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ TPM2B_SENSITIVE_DATA *outData, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_FlushContext (const TPMI_DH_CONTEXT handle); -+ -+TPM_RC -+TPM2_PCR_Read (const TPMS_AUTH_COMMAND *authCommand, -+ const TPML_PCR_SELECTION *pcrSelectionIn, -+ grub_uint32_t *pcrUpdateCounter, -+ TPML_PCR_SELECTION *pcrSelectionOut, -+ TPML_DIGEST *pcrValues, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_PolicyGetDigest (const TPMI_SH_POLICY policySession, -+ const TPMS_AUTH_COMMAND *authCommand, -+ TPM2B_DIGEST *policyDigest, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_Create (const TPMI_DH_OBJECT parentHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE_CREATE *inSensitive, -+ const TPM2B_PUBLIC *inPublic, -+ const TPM2B_DATA *outsideInfo, -+ const TPML_PCR_SELECTION *creationPCR, -+ TPM2B_PRIVATE *outPrivate, -+ TPM2B_PUBLIC *outPublic, -+ TPM2B_CREATION_DATA *creationData, -+ TPM2B_DIGEST *creationHash, -+ TPMT_TK_CREATION *creationTicket, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_EvictControl (const TPMI_RH_PROVISION auth, -+ const TPMI_DH_OBJECT objectHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPMI_DH_PERSISTENT persistentHandle, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+#endif /* ! GRUB_TPM2_INTERNAL_FUNCTIONS_HEADER */ -diff --git a/include/grub/tpm2/internal/structs.h b/include/grub/tpm2/internal/structs.h -new file mode 100644 -index 000000000..72d71eb70 ---- /dev/null -+++ b/include/grub/tpm2/internal/structs.h -@@ -0,0 +1,675 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_INTERNAL_STRUCTS_HEADER -+#define GRUB_TPM2_INTERNAL_STRUCTS_HEADER 1 -+ -+#include -+ -+/* TPMS_TAGGED_PROPERTY Structure */ -+struct TPMS_TAGGED_PROPERTY -+{ -+ TPM_PT property; -+ grub_uint32_t value; -+}; -+typedef struct TPMS_TAGGED_PROPERTY TPMS_TAGGED_PROPERTY; -+ -+/* TPML_TAGGED_TPM_PROPERTY Structure */ -+struct TPML_TAGGED_TPM_PROPERTY -+{ -+ grub_uint32_t count; -+ TPMS_TAGGED_PROPERTY tpmProperty[TPM_MAX_TPM_PROPERTIES]; -+}; -+typedef struct TPML_TAGGED_TPM_PROPERTY TPML_TAGGED_TPM_PROPERTY; -+ -+/* TPMU_CAPABILITIES Structure */ -+union TPMU_CAPABILITIES -+{ -+ TPML_TAGGED_TPM_PROPERTY tpmProperties; -+}; -+typedef union TPMU_CAPABILITIES TPMU_CAPABILITIES; -+ -+/* TPMS_CAPABILITY_DATA Structure */ -+struct TPMS_CAPABILITY_DATA -+{ -+ TPM_CAP capability; -+ TPMU_CAPABILITIES data; -+}; -+typedef struct TPMS_CAPABILITY_DATA TPMS_CAPABILITY_DATA; -+ -+/* TPMS_PCR_SELECT Structure */ -+struct TPMS_PCR_SELECT -+{ -+ grub_uint8_t sizeOfSelect; -+ grub_uint8_t pcrSelect[TPM_PCR_SELECT_MAX]; -+}; -+typedef struct TPMS_PCR_SELECT TPMS_PCR_SELECT; -+ -+/* TPMS_PCR_SELECTION Structure */ -+struct TPMS_PCR_SELECTION -+{ -+ TPMI_ALG_HASH hash; -+ grub_uint8_t sizeOfSelect; -+ grub_uint8_t pcrSelect[TPM_PCR_SELECT_MAX]; -+}; -+typedef struct TPMS_PCR_SELECTION TPMS_PCR_SELECTION; -+ -+static inline void TPMS_PCR_SELECTION_SelectPCR(TPMS_PCR_SELECTION* self, grub_uint32_t n) -+{ -+ self->pcrSelect[(n / 8)] |= (1 << (n % 8)); -+} -+ -+/* TPML_PCR_SELECTION Structure */ -+struct TPML_PCR_SELECTION -+{ -+ grub_uint32_t count; -+ TPMS_PCR_SELECTION pcrSelections[TPM_NUM_PCR_BANKS]; -+}; -+typedef struct TPML_PCR_SELECTION TPML_PCR_SELECTION; -+ -+/* TPMU_HA Structure */ -+union TPMU_HA -+{ -+ grub_uint8_t sha1[TPM_SHA1_DIGEST_SIZE]; -+ grub_uint8_t sha256[TPM_SHA256_DIGEST_SIZE]; -+ grub_uint8_t sha384[TPM_SHA384_DIGEST_SIZE]; -+ grub_uint8_t sha512[TPM_SHA512_DIGEST_SIZE]; -+ grub_uint8_t sm3_256[TPM_SM3_256_DIGEST_SIZE]; -+}; -+typedef union TPMU_HA TPMU_HA; -+ -+/* TPM2B Structure */ -+struct TPM2B -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[1]; -+}; -+typedef struct TPM2B TPM2B; -+ -+/* TPM2B_DIGEST Structure */ -+struct TPM2B_DIGEST -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[sizeof(TPMU_HA)]; -+}; -+typedef struct TPM2B_DIGEST TPM2B_DIGEST; -+ -+/* TPML_DIGEST Structure */ -+struct TPML_DIGEST -+{ -+ grub_uint32_t count; -+ TPM2B_DIGEST digests[8]; -+}; -+typedef struct TPML_DIGEST TPML_DIGEST; -+ -+/* TPM2B_NONCE Type */ -+typedef TPM2B_DIGEST TPM2B_NONCE; -+ -+/* TPMA_SESSION Structure */ -+struct TPMA_SESSION -+{ -+ unsigned int continueSession:1; -+ unsigned int auditExclusive:1; -+ unsigned int auditReset:1; -+ unsigned int reserved1:2; -+ unsigned int decrypt:1; -+ unsigned int encrypt:1; -+ unsigned int audit:1; -+ unsigned int reserved:24; -+}; -+typedef struct TPMA_SESSION TPMA_SESSION; -+ -+/* TPM2B_AUTH Type */ -+typedef TPM2B_DIGEST TPM2B_AUTH; -+ -+/* TPMS_AUTH_COMMAND Structure */ -+struct TPMS_AUTH_COMMAND -+{ -+ TPMI_SH_AUTH_SESSION sessionHandle; -+ TPM2B_NONCE nonce; -+ TPMA_SESSION sessionAttributes; -+ TPM2B_AUTH hmac; -+}; -+typedef struct TPMS_AUTH_COMMAND TPMS_AUTH_COMMAND; -+ -+/* TPMS_AUTH_RESPONSE Structure */ -+struct TPMS_AUTH_RESPONSE -+{ -+ TPM2B_NONCE nonce; -+ TPMA_SESSION sessionAttributes; -+ TPM2B_AUTH hmac; -+}; -+typedef struct TPMS_AUTH_RESPONSE TPMS_AUTH_RESPONSE; -+ -+/* TPM2B_SENSITIVE_DATA Structure */ -+struct TPM2B_SENSITIVE_DATA -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_SYM_DATA]; -+}; -+typedef struct TPM2B_SENSITIVE_DATA TPM2B_SENSITIVE_DATA; -+ -+/* TPMS_SENSITIVE_CREATE Structure */ -+struct TPMS_SENSITIVE_CREATE -+{ -+ TPM2B_AUTH userAuth; -+ TPM2B_SENSITIVE_DATA data; -+}; -+typedef struct TPMS_SENSITIVE_CREATE TPMS_SENSITIVE_CREATE; -+ -+/* TPM2B_SENSITIVE_CREATE Structure */ -+struct TPM2B_SENSITIVE_CREATE -+{ -+ grub_uint16_t size; -+ TPMS_SENSITIVE_CREATE sensitive; -+}; -+typedef struct TPM2B_SENSITIVE_CREATE TPM2B_SENSITIVE_CREATE; -+ -+/* TPMA_OBJECT Structure */ -+struct TPMA_OBJECT -+{ -+ unsigned int reserved1:1; -+ unsigned int fixedTPM:1; -+ unsigned int stClear:1; -+ unsigned int reserved2:1; -+ unsigned int fixedParent:1; -+ unsigned int sensitiveDataOrigin:1; -+ unsigned int userWithAuth:1; -+ unsigned int adminWithPolicy:1; -+ unsigned int reserved3:2; -+ unsigned int noDA:1; -+ unsigned int encryptedDuplication:1; -+ unsigned int reserved4:4; -+ unsigned int restricted:1; -+ unsigned int decrypt:1; -+ unsigned int sign:1; -+ unsigned int reserved5:13; -+}; -+typedef struct TPMA_OBJECT TPMA_OBJECT; -+ -+/* TPMS_SCHEME_HASH Structure */ -+struct TPMS_SCHEME_HASH -+{ -+ TPMI_ALG_HASH hashAlg; -+}; -+typedef struct TPMS_SCHEME_HASH TPMS_SCHEME_HASH; -+ -+/* TPMS_SCHEME_HASH Types */ -+typedef TPMS_SCHEME_HASH TPMS_KEY_SCHEME_ECDH; -+typedef TPMS_SCHEME_HASH TPMS_KEY_SCHEME_ECMQV; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_RSASSA; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_RSAPSS; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_ECDSA; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_ECDAA; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_SM2; -+typedef TPMS_SCHEME_HASH TPMS_SIG_SCHEME_ECSCHNORR; -+typedef TPMS_SCHEME_HASH TPMS_ENC_SCHEME_RSAES; -+typedef TPMS_SCHEME_HASH TPMS_ENC_SCHEME_OAEP; -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_KDF2; -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_MGF1; -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_KDF1_SP800_56A; -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_KDF2; -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_KDF1_SP800_108; -+ -+/* TPMS_SCHEME_HMAC Type */ -+typedef TPMS_SCHEME_HASH TPMS_SCHEME_HMAC; -+ -+/* TPMS_SCHEME_XOR Structure */ -+struct TPMS_SCHEME_XOR -+{ -+ TPMI_ALG_HASH hashAlg; -+ TPMI_ALG_KDF kdf; -+}; -+typedef struct TPMS_SCHEME_XOR TPMS_SCHEME_XOR; -+ -+/* TPMU_SCHEME_KEYEDHASH Union */ -+union TPMU_SCHEME_KEYEDHASH -+{ -+ TPMS_SCHEME_HMAC hmac; -+ TPMS_SCHEME_XOR exclusiveOr; -+}; -+typedef union TPMU_SCHEME_KEYEDHASH TPMU_SCHEME_KEYEDHASH; -+ -+/* TPMT_KEYEDHASH_SCHEME Structure */ -+struct TPMT_KEYEDHASH_SCHEME -+{ -+ TPMI_ALG_KEYEDHASH_SCHEME scheme; -+ TPMU_SCHEME_KEYEDHASH details; -+}; -+typedef struct TPMT_KEYEDHASH_SCHEME TPMT_KEYEDHASH_SCHEME; -+ -+/* TPMS_KEYEDHASH_PARMS Structure */ -+struct TPMS_KEYEDHASH_PARMS -+{ -+ TPMT_KEYEDHASH_SCHEME scheme; -+}; -+typedef struct TPMS_KEYEDHASH_PARMS TPMS_KEYEDHASH_PARMS; -+ -+/* TPMU_SYM_KEY_BITS Union */ -+union TPMU_SYM_KEY_BITS -+{ -+ TPM_KEY_BITS aes; -+ TPM_KEY_BITS exclusiveOr; -+ TPM_KEY_BITS sm4; -+ TPM_KEY_BITS camellia; -+}; -+typedef union TPMU_SYM_KEY_BITS TPMU_SYM_KEY_BITS; -+ -+/* TPMU_SYM_MODE Union */ -+union TPMU_SYM_MODE -+{ -+ TPMI_ALG_SYM_MODE aes; -+ TPMI_ALG_SYM_MODE sm4; -+ TPMI_ALG_SYM_MODE camellia; -+ TPMI_ALG_SYM_MODE sym; -+}; -+typedef union TPMU_SYM_MODE TPMU_SYM_MODE; -+ -+/* TPMT_SYM_DEF_OBJECT Structure */ -+struct TPMT_SYM_DEF_OBJECT -+{ -+ TPMI_ALG_SYM_OBJECT algorithm; -+ TPMU_SYM_KEY_BITS keyBits; -+ TPMU_SYM_MODE mode; -+}; -+typedef struct TPMT_SYM_DEF_OBJECT TPMT_SYM_DEF_OBJECT; -+ -+/* TPMS_SYMCIPHER_PARMS Structure */ -+struct TPMS_SYMCIPHER_PARMS -+{ -+ TPMT_SYM_DEF_OBJECT sym; -+}; -+typedef struct TPMS_SYMCIPHER_PARMS TPMS_SYMCIPHER_PARMS; -+ -+/* TPMU_ASYM_SCHEME Union */ -+union TPMU_ASYM_SCHEME -+{ -+ TPMS_KEY_SCHEME_ECDH ecdh; -+ TPMS_KEY_SCHEME_ECMQV ecmqv; -+ TPMS_SIG_SCHEME_RSASSA rsassa; -+ TPMS_SIG_SCHEME_RSAPSS rsapss; -+ TPMS_SIG_SCHEME_ECDSA ecdsa; -+ TPMS_SIG_SCHEME_ECDAA ecdaa; -+ TPMS_SIG_SCHEME_SM2 sm2; -+ TPMS_SIG_SCHEME_ECSCHNORR ecschnorr; -+ TPMS_ENC_SCHEME_RSAES rsaes; -+ TPMS_ENC_SCHEME_OAEP oaep; -+ TPMS_SCHEME_HASH anySig; -+ unsigned char padding[4]; -+}; -+typedef union TPMU_ASYM_SCHEME TPMU_ASYM_SCHEME; -+ -+/* TPMT_RSA_SCHEME Structure */ -+struct TPMT_RSA_SCHEME -+{ -+ TPMI_ALG_RSA_SCHEME scheme; -+ TPMU_ASYM_SCHEME details; -+}; -+typedef struct TPMT_RSA_SCHEME TPMT_RSA_SCHEME; -+ -+/* TPMS_RSA_PARMS Structure */ -+struct TPMS_RSA_PARMS -+{ -+ TPMT_SYM_DEF_OBJECT symmetric; -+ TPMT_RSA_SCHEME scheme; -+ TPM_KEY_BITS keyBits; -+ grub_uint32_t exponent; -+}; -+typedef struct TPMS_RSA_PARMS TPMS_RSA_PARMS; -+ -+/* TPMT_ECC_SCHEME Structure */ -+struct TPMT_ECC_SCHEME -+{ -+ TPMI_ALG_ECC_SCHEME scheme; -+ TPMU_ASYM_SCHEME details; -+}; -+typedef struct TPMT_ECC_SCHEME TPMT_ECC_SCHEME; -+ -+/* TPMU_KDF_SCHEME Union */ -+union TPMU_KDF_SCHEME -+{ -+ TPMS_SCHEME_MGF1 mgf1; -+ TPMS_SCHEME_KDF1_SP800_56A kdf1_sp800_56a; -+ TPMS_SCHEME_KDF2 kdf2; -+ TPMS_SCHEME_KDF1_SP800_108 kdf1_sp800_108; -+}; -+typedef union TPMU_KDF_SCHEME TPMU_KDF_SCHEME; -+ -+/* TPMT_KDF_SCHEME Structure */ -+struct TPMT_KDF_SCHEME -+{ -+ TPMI_ALG_KDF scheme; -+ TPMU_KDF_SCHEME details; -+}; -+typedef struct TPMT_KDF_SCHEME TPMT_KDF_SCHEME; -+ -+/* TPMS_ECC_PARMS Structure */ -+struct TPMS_ECC_PARMS -+{ -+ TPMT_SYM_DEF_OBJECT symmetric; -+ TPMT_ECC_SCHEME scheme; -+ TPMI_ECC_CURVE curveID; -+ TPMT_KDF_SCHEME kdf; -+}; -+typedef struct TPMS_ECC_PARMS TPMS_ECC_PARMS; -+ -+/* TPMT_ASYM_SCHEME Structure */ -+struct TPMT_ASYM_SCHEME -+{ -+ TPMI_ALG_ASYM_SCHEME scheme; -+ TPMU_ASYM_SCHEME details; -+}; -+typedef struct TPMT_ASYM_SCHEME TPMT_ASYM_SCHEME; -+ -+/* TPMS_ASYM_PARMS Structure */ -+struct TPMS_ASYM_PARMS -+{ -+ TPMT_SYM_DEF_OBJECT symmetric; -+ TPMT_ASYM_SCHEME scheme; -+}; -+typedef struct TPMS_ASYM_PARMS TPMS_ASYM_PARMS; -+ -+/* TPMU_PUBLIC_PARMS Union */ -+union TPMU_PUBLIC_PARMS -+{ -+ TPMS_KEYEDHASH_PARMS keyedHashDetail; -+ TPMS_SYMCIPHER_PARMS symDetail; -+ TPMS_RSA_PARMS rsaDetail; -+ TPMS_ECC_PARMS eccDetail; -+ TPMS_ASYM_PARMS asymDetail; -+}; -+typedef union TPMU_PUBLIC_PARMS TPMU_PUBLIC_PARMS; -+ -+/* TPM2B_PUBLIC_KEY_RSA Structure */ -+struct TPM2B_PUBLIC_KEY_RSA -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_RSA_KEY_BYTES]; -+}; -+typedef struct TPM2B_PUBLIC_KEY_RSA TPM2B_PUBLIC_KEY_RSA; -+ -+/* TPM2B_ECC_PARAMETER Structure */ -+struct TPM2B_ECC_PARAMETER -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_ECC_KEY_BYTES]; -+}; -+typedef struct TPM2B_ECC_PARAMETER TPM2B_ECC_PARAMETER; -+ -+/* TPMS_ECC_POINT Structure */ -+struct TPMS_ECC_POINT -+{ -+ TPM2B_ECC_PARAMETER x; -+ TPM2B_ECC_PARAMETER y; -+}; -+typedef struct TPMS_ECC_POINT TPMS_ECC_POINT; -+ -+/* TPMU_ENCRYPTED_SECRET Union */ -+union TPMU_ENCRYPTED_SECRET -+{ -+ grub_uint8_t ecc[sizeof(TPMS_ECC_POINT)]; -+ grub_uint8_t rsa[TPM_MAX_RSA_KEY_BYTES]; -+ grub_uint8_t symmetric[sizeof(TPM2B_DIGEST)]; -+ grub_uint8_t keyedHash[sizeof(TPM2B_DIGEST)]; -+}; -+typedef union TPMU_ENCRYPTED_SECRET TPMU_ENCRYPTED_SECRET; -+ -+/* TPM2B_ENCRYPTED_SECRET Structure */ -+struct TPM2B_ENCRYPTED_SECRET -+{ -+ grub_uint16_t size; -+ grub_uint8_t secret[sizeof(TPMU_ENCRYPTED_SECRET)]; -+}; -+typedef struct TPM2B_ENCRYPTED_SECRET TPM2B_ENCRYPTED_SECRET; -+ -+/* TPMU_PUBLIC_ID Union */ -+union TPMU_PUBLIC_ID -+{ -+ TPM2B_DIGEST keyedHash; -+ TPM2B_DIGEST sym; -+ TPM2B_PUBLIC_KEY_RSA rsa; -+ TPMS_ECC_POINT ecc; -+}; -+typedef union TPMU_PUBLIC_ID TPMU_PUBLIC_ID; -+ -+/* TPMT_PUBLIC Structure */ -+struct TPMT_PUBLIC -+{ -+ TPMI_ALG_PUBLIC type; -+ TPMI_ALG_HASH nameAlg; -+ TPMA_OBJECT objectAttributes; -+ TPM2B_DIGEST authPolicy; -+ TPMU_PUBLIC_PARMS parameters; -+ TPMU_PUBLIC_ID unique; -+}; -+typedef struct TPMT_PUBLIC TPMT_PUBLIC; -+ -+/* TPM2B_PUBLIC Structure */ -+struct TPM2B_PUBLIC -+{ -+ grub_uint16_t size; -+ TPMT_PUBLIC publicArea; -+}; -+typedef struct TPM2B_PUBLIC TPM2B_PUBLIC; -+ -+/* TPMT_HA Structure */ -+struct TPMT_HA -+{ -+ TPMI_ALG_HASH hashAlg; -+ TPMU_HA digest; -+}; -+typedef struct TPMT_HA TPMT_HA; -+ -+/* TPM2B_DATA Structure */ -+struct TPM2B_DATA -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[sizeof(TPMT_HA)]; -+}; -+typedef struct TPM2B_DATA TPM2B_DATA; -+ -+/* TPMA_LOCALITY Structure */ -+struct TPMA_LOCALITY -+{ -+ unsigned char TPM_LOC_ZERO:1; -+ unsigned char TPM_LOC_ONE:1; -+ unsigned char TPM_LOC_TWO:1; -+ unsigned char TPM_LOC_THREE:1; -+ unsigned char TPM_LOC_FOUR:1; -+ unsigned char Extended:3; -+}; -+typedef struct TPMA_LOCALITY TPMA_LOCALITY; -+ -+/* TPMU_NAME Union */ -+union TPMU_NAME -+{ -+ TPMT_HA digest; -+ TPM_HANDLE handle; -+}; -+typedef union TPMU_NAME TPMU_NAME; -+ -+/* TPM2B_NAME Structure */ -+struct TPM2B_NAME -+{ -+ grub_uint16_t size; -+ grub_uint8_t name[sizeof(TPMU_NAME)]; -+}; -+typedef struct TPM2B_NAME TPM2B_NAME; -+ -+/* TPMS_CREATION_DATA Structure */ -+struct TPMS_CREATION_DATA -+{ -+ TPML_PCR_SELECTION pcrSelect; -+ TPM2B_DIGEST pcrDigest; -+ TPMA_LOCALITY locality; -+ TPM_ALG_ID parentNameAlg; -+ TPM2B_NAME parentName; -+ TPM2B_NAME parentQualifiedName; -+ TPM2B_DATA outsideInfo; -+}; -+typedef struct TPMS_CREATION_DATA TPMS_CREATION_DATA; -+ -+/* TPM2B_CREATION_DATA Structure */ -+struct TPM2B_CREATION_DATA -+{ -+ grub_uint16_t size; -+ TPMS_CREATION_DATA creationData; -+}; -+typedef struct TPM2B_CREATION_DATA TPM2B_CREATION_DATA; -+ -+/* TPMT_SYM_DEF Structure */ -+struct TPMT_SYM_DEF -+{ -+ TPMI_ALG_SYM algorithm; -+ TPMU_SYM_KEY_BITS keyBits; -+ TPMU_SYM_MODE mode; -+}; -+typedef struct TPMT_SYM_DEF TPMT_SYM_DEF; -+ -+/* TPM2B_MAX_BUFFER Structure */ -+struct TPM2B_MAX_BUFFER -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_DIGEST_BUFFER]; -+}; -+typedef struct TPM2B_MAX_BUFFER TPM2B_MAX_BUFFER; -+ -+/* TPMT_TK_HASHCHECK Structure */ -+struct TPMT_TK_HASHCHECK -+{ -+ TPM_ST tag; -+ TPMI_RH_HIERARCHY hierarchy; -+ TPM2B_DIGEST digest; -+}; -+typedef struct TPMT_TK_HASHCHECK TPMT_TK_HASHCHECK; -+ -+/* TPM2B_SYM_KEY Structure */ -+struct TPM2B_SYM_KEY -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_SYM_KEY_BYTES]; -+}; -+typedef struct TPM2B_SYM_KEY TPM2B_SYM_KEY; -+ -+/* TPM2B_PRIVATE_KEY_RSA Structure */ -+struct TPM2B_PRIVATE_KEY_RSA -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_RSA_KEY_BYTES/2]; -+}; -+typedef struct TPM2B_PRIVATE_KEY_RSA TPM2B_PRIVATE_KEY_RSA; -+ -+/* TPM2B_PRIVATE_VENDOR_SPECIFIC Structure */ -+struct TPM2B_PRIVATE_VENDOR_SPECIFIC -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_PRIVATE_VENDOR_SPECIFIC_BYTES]; -+}; -+typedef struct TPM2B_PRIVATE_VENDOR_SPECIFIC TPM2B_PRIVATE_VENDOR_SPECIFIC; -+ -+/* TPM2B_PRIVATE_VENDOR_SPECIFIC Union */ -+union TPMU_SENSITIVE_COMPOSITE -+{ -+ TPM2B_PRIVATE_KEY_RSA rsa; -+ TPM2B_ECC_PARAMETER ecc; -+ TPM2B_SENSITIVE_DATA bits; -+ TPM2B_SYM_KEY sym; -+ TPM2B_PRIVATE_VENDOR_SPECIFIC any; -+}; -+typedef union TPMU_SENSITIVE_COMPOSITE TPMU_SENSITIVE_COMPOSITE; -+ -+/* TPMT_SENSITIVE Structure */ -+struct TPMT_SENSITIVE -+{ -+ TPMI_ALG_PUBLIC sensitiveType; -+ TPM2B_AUTH authValue; -+ TPM2B_DIGEST seedValue; -+ TPMU_SENSITIVE_COMPOSITE sensitive; -+}; -+typedef struct TPMT_SENSITIVE TPMT_SENSITIVE; -+ -+/* TPM2B_SENSITIVE Structure */ -+struct TPM2B_SENSITIVE -+{ -+ grub_uint16_t size; -+ TPMT_SENSITIVE sensitiveArea; -+}; -+typedef struct TPM2B_SENSITIVE TPM2B_SENSITIVE; -+ -+/* _PRIVATE Structure */ -+struct _PRIVATE -+{ -+ TPM2B_DIGEST integrityOuter; -+ TPM2B_DIGEST integrityInner; -+ TPM2B_SENSITIVE sensitive; -+}; -+typedef struct _PRIVATE _PRIVATE; -+ -+/* TPM2B_PRIVATE Structure */ -+struct TPM2B_PRIVATE -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[sizeof(_PRIVATE)]; -+}; -+typedef struct TPM2B_PRIVATE TPM2B_PRIVATE; -+ -+/* TPML_DIGEST_VALUES Structure */ -+struct TPML_DIGEST_VALUES -+{ -+ grub_uint16_t count; -+ TPMT_HA digests[TPM_NUM_PCR_BANKS]; -+}; -+typedef struct TPML_DIGEST_VALUES TPML_DIGEST_VALUES; -+ -+/* TPM2B_MAX_NV_BUFFER Structure */ -+struct TPM2B_MAX_NV_BUFFER -+{ -+ grub_uint16_t size; -+ grub_uint8_t buffer[TPM_MAX_NV_BUFFER_SIZE]; -+}; -+typedef struct TPM2B_MAX_NV_BUFFER TPM2B_MAX_NV_BUFFER; -+ -+/* TPMS_NV_PUBLIC Structure */ -+struct TPMS_NV_PUBLIC -+{ -+ TPMI_RH_NV_INDEX nvIndex; -+ TPMI_ALG_HASH nameAlg; -+ TPMA_NV attributes; -+ TPM2B_DIGEST authPolicy; -+ grub_uint16_t dataSize; -+}; -+typedef struct TPMS_NV_PUBLIC TPMS_NV_PUBLIC; -+ -+/* TPM2B_NV_PUBLIC Structure */ -+struct TPM2B_NV_PUBLIC -+{ -+ grub_uint16_t size; -+ TPMS_NV_PUBLIC nvPublic; -+}; -+typedef struct TPM2B_NV_PUBLIC TPM2B_NV_PUBLIC; -+ -+/* TPMT_TK_CREATION Structure */ -+struct TPMT_TK_CREATION -+{ -+ TPM_ST tag; -+ TPMI_RH_HIERARCHY hierarchy; -+ TPM2B_DIGEST digest; -+}; -+typedef struct TPMT_TK_CREATION TPMT_TK_CREATION; -+ -+#endif /* ! GRUB_TPM2_INTERNAL_STRUCTS_HEADER */ -diff --git a/include/grub/tpm2/internal/types.h b/include/grub/tpm2/internal/types.h -new file mode 100644 -index 000000000..9118cad5d ---- /dev/null -+++ b/include/grub/tpm2/internal/types.h -@@ -0,0 +1,370 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_INTERNAL_TYPES_HEADER -+#define GRUB_TPM2_INTERNAL_TYPES_HEADER 1 -+ -+#include -+ -+/* TPM2_RC Constants */ -+typedef grub_uint32_t TPM_RC; -+ -+#define TPM_RC_1 ((TPM_RC) 0x100) -+#define TPM_RC_2 ((TPM_RC) 0x200) -+#define TPM_RC_3 ((TPM_RC) 0x300) -+#define TPM_RC_4 ((TPM_RC) 0x400) -+#define TPM_RC_5 ((TPM_RC) 0x500) -+#define TPM_RC_6 ((TPM_RC) 0x600) -+#define TPM_RC_7 ((TPM_RC) 0x700) -+#define TPM_RC_8 ((TPM_RC) 0x800) -+#define TPM_RC_9 ((TPM_RC) 0x900) -+#define TPM_RC_A ((TPM_RC) 0xA00) -+#define TPM_RC_ASYMMETRIC ((TPM_RC) 0x081) -+#define TPM_RC_ATTRIBUTES ((TPM_RC) 0x082) -+#define TPM_RC_AUTH_CONTEXT ((TPM_RC) 0x145) -+#define TPM_RC_AUTH_FAIL ((TPM_RC) 0x08E) -+#define TPM_RC_AUTH_MISSING ((TPM_RC) 0x125) -+#define TPM_RC_AUTHSIZE ((TPM_RC) 0x144) -+#define TPM_RC_AUTH_TYPE ((TPM_RC) 0x124) -+#define TPM_RC_AUTH_UNAVAILABLE ((TPM_RC) 0x12F) -+#define TPM_RC_B ((TPM_RC) 0xB00) -+#define TPM_RC_BAD_AUTH ((TPM_RC) 0x0A2) -+#define TPM_RC_BAD_CONTEXT ((TPM_RC) 0x150) -+#define TPM_RC_BAD_TAG ((TPM_RC) 0x01E) -+#define TPM_RC_BINDING ((TPM_RC) 0x0A5) -+#define TPM_RC_C ((TPM_RC) 0xC00) -+#define TPM_RC_CANCELED ((TPM_RC) 0x909) -+#define TPM_RC_COMMAND_CODE ((TPM_RC) 0x143) -+#define TPM_RC_COMMAND_SIZE ((TPM_RC) 0x142) -+#define TPM_RC_CONTEXT_GAP ((TPM_RC) 0x901) -+#define TPM_RC_CPHASH ((TPM_RC) 0x151) -+#define TPM_RC_CURVE ((TPM_RC) 0x0A6) -+#define TPM_RC_D ((TPM_RC) 0xD00) -+#define TPM_RC_DISABLED ((TPM_RC) 0x120) -+#define TPM_RC_E ((TPM_RC) 0xE00) -+#define TPM_RC_ECC_POINT ((TPM_RC) 0x0A7) -+#define TPM_RC_EXCLUSIVE ((TPM_RC) 0x121) -+#define TPM_RC_EXPIRED ((TPM_RC) 0x0A3) -+#define TPM_RC_F ((TPM_RC) 0xF00) -+#define TPM_RC_FAILURE ((TPM_RC) 0x101) -+#define TPM_RC_H ((TPM_RC) 0x000) -+#define TPM_RC_HANDLE ((TPM_RC) 0x08B) -+#define TPM_RC_HASH ((TPM_RC) 0x083) -+#define TPM_RC_HIERARCHY ((TPM_RC) 0x085) -+#define TPM_RC_HMAC ((TPM_RC) 0x119) -+#define TPM_RC_INITIALIZE ((TPM_RC) 0x100) -+#define TPM_RC_INSUFFICIENT ((TPM_RC) 0x09A) -+#define TPM_RC_INTEGRITY ((TPM_RC) 0x09F) -+#define TPM_RC_KDF ((TPM_RC) 0x08C) -+#define TPM_RC_KEY ((TPM_RC) 0x09C) -+#define TPM_RC_KEY_SIZE ((TPM_RC) 0x087) -+#define TPM_RC_LOCALITY ((TPM_RC) 0x907) -+#define TPM_RC_LOCKOUT ((TPM_RC) 0x921) -+#define TPM_RC_MEMORY ((TPM_RC) 0x904) -+#define TPM_RC_MGF ((TPM_RC) 0x088) -+#define TPM_RC_MODE ((TPM_RC) 0x089) -+#define TPM_RC_NEEDS_TEST ((TPM_RC) 0x153) -+#define TPM_RC_N_MASK ((TPM_RC) 0xF00) -+#define TPM_RC_NONCE ((TPM_RC) 0x08F) -+#define TPM_RC_NO_RESULT ((TPM_RC) 0x154) -+#define TPM_RC_NOT_USED ((TPM_RC) 0x97F) -+#define TPM_RC_NV_AUTHORIZATION ((TPM_RC) 0x149) -+#define TPM_RC_NV_DEFINED ((TPM_RC) 0x14C) -+#define TPM_RC_NV_LOCKED ((TPM_RC) 0x148) -+#define TPM_RC_NV_RANGE ((TPM_RC) 0x146) -+#define TPM_RC_NV_RATE ((TPM_RC) 0x920) -+#define TPM_RC_NV_SIZE ((TPM_RC) 0x147) -+#define TPM_RC_NV_SPACE ((TPM_RC) 0x14B) -+#define TPM_RC_NV_UNAVAILABLE ((TPM_RC) 0x923) -+#define TPM_RC_NV_UNINITIALIZED ((TPM_RC) 0x14A) -+#define TPM_RC_OBJECT_HANDLES ((TPM_RC) 0x906) -+#define TPM_RC_OBJECT_MEMORY ((TPM_RC) 0x902) -+#define TPM_RC_P ((TPM_RC) 0x040) -+#define TPM_RC_PARENT ((TPM_RC) 0x152) -+#define TPM_RC_PCR ((TPM_RC) 0x127) -+#define TPM_RC_PCR_CHANGED ((TPM_RC) 0x128) -+#define TPM_RC_POLICY ((TPM_RC) 0x126) -+#define TPM_RC_POLICY_CC ((TPM_RC) 0x0A4) -+#define TPM_RC_POLICY_FAIL ((TPM_RC) 0x09D) -+#define TPM_RC_PP ((TPM_RC) 0x090) -+#define TPM_RC_PRIVATE ((TPM_RC) 0x10B) -+#define TPM_RC_RANGE ((TPM_RC) 0x08D) -+#define TPM_RC_REBOOT ((TPM_RC) 0x130) -+#define TPM_RC_REFERENCE_H0 ((TPM_RC) 0x910) -+#define TPM_RC_REFERENCE_H1 ((TPM_RC) 0x911) -+#define TPM_RC_REFERENCE_H2 ((TPM_RC) 0x912) -+#define TPM_RC_REFERENCE_H3 ((TPM_RC) 0x913) -+#define TPM_RC_REFERENCE_H4 ((TPM_RC) 0x914) -+#define TPM_RC_REFERENCE_H5 ((TPM_RC) 0x915) -+#define TPM_RC_REFERENCE_H6 ((TPM_RC) 0x916) -+#define TPM_RC_REFERENCE_S0 ((TPM_RC) 0x918) -+#define TPM_RC_REFERENCE_S1 ((TPM_RC) 0x919) -+#define TPM_RC_REFERENCE_S2 ((TPM_RC) 0x91A) -+#define TPM_RC_REFERENCE_S3 ((TPM_RC) 0x91B) -+#define TPM_RC_REFERENCE_S4 ((TPM_RC) 0x91C) -+#define TPM_RC_REFERENCE_S5 ((TPM_RC) 0x91D) -+#define TPM_RC_REFERENCE_S6 ((TPM_RC) 0x91E) -+#define TPM_RC_RESERVED_BITS ((TPM_RC) 0x0A1) -+#define TPM_RC_RETRY ((TPM_RC) 0x922) -+#define TPM_RC_S ((TPM_RC) 0x800) -+#define TPM_RC_SCHEME ((TPM_RC) 0x092) -+#define TPM_RC_SELECTOR ((TPM_RC) 0x098) -+#define TPM_RC_SENSITIVE ((TPM_RC) 0x155) -+#define TPM_RC_SEQUENCE ((TPM_RC) 0x103) -+#define TPM_RC_SESSION_HANDLES ((TPM_RC) 0x905) -+#define TPM_RC_SESSION_MEMORY ((TPM_RC) 0x903) -+#define TPM_RC_SIGNATURE ((TPM_RC) 0x09B) -+#define TPM_RC_SIZE ((TPM_RC) 0x095) -+#define TPM_RC_SUCCESS ((TPM_RC) 0x000) -+#define TPM_RC_SYMMETRIC ((TPM_RC) 0x096) -+#define TPM_RC_TAG ((TPM_RC) 0x097) -+#define TPM_RC_TESTING ((TPM_RC) 0x90A) -+#define TPM_RC_TICKET ((TPM_RC) 0x0A0) -+#define TPM_RC_TOO_MANY_CONTEXTS ((TPM_RC) 0x12E) -+#define TPM_RC_TYPE ((TPM_RC) 0x08A) -+#define TPM_RC_UNBALANCED ((TPM_RC) 0x131) -+#define TPM_RC_UPGRADE ((TPM_RC) 0x12D) -+#define TPM_RC_VALUE ((TPM_RC) 0x084) -+#define TPM_RC_YIELDED ((TPM_RC) 0x908) -+ -+/* TPMA_NV Constants */ -+typedef grub_uint32_t TPMA_NV; -+ -+#define TPMA_NV_PPWRITE ((TPMA_NV) 0x00000001) -+#define TPMA_NV_OWNERWRITE ((TPMA_NV) 0x00000002) -+#define TPMA_NV_AUTHWRITE ((TPMA_NV) 0x00000004) -+#define TPMA_NV_POLICYWRITE ((TPMA_NV) 0x00000008) -+#define TPMA_NV_TPM2_NT_MASK ((TPMA_NV) 0x000000F0) -+#define TPMA_NV_TPM2_NT_SHIFT (4) -+#define TPMA_NV_RESERVED1_MASK ((TPMA_NV) 0x00000300) -+#define TPMA_NV_POLICY_DELETE ((TPMA_NV) 0x00000400) -+#define TPMA_NV_WRITELOCKED ((TPMA_NV) 0x00000800) -+#define TPMA_NV_WRITEALL ((TPMA_NV) 0x00001000) -+#define TPMA_NV_WRITEDEFINE ((TPMA_NV) 0x00002000) -+#define TPMA_NV_WRITE_STCLEAR ((TPMA_NV) 0x00004000) -+#define TPMA_NV_GLOBALLOCK ((TPMA_NV) 0x00008000) -+#define TPMA_NV_PPREAD ((TPMA_NV) 0x00010000) -+#define TPMA_NV_OWNERREAD ((TPMA_NV) 0x00020000) -+#define TPMA_NV_AUTHREAD ((TPMA_NV) 0x00040000) -+#define TPMA_NV_POLICYREAD ((TPMA_NV) 0x00080000) -+#define TPMA_NV_RESERVED2_MASK ((TPMA_NV) 0x01F00000) -+#define TPMA_NV_NO_DA ((TPMA_NV) 0x02000000) -+#define TPMA_NV_ORDERLY ((TPMA_NV) 0x04000000) -+#define TPMA_NV_CLEAR_STCLEAR ((TPMA_NV) 0x08000000) -+#define TPMA_NV_READLOCKED ((TPMA_NV) 0x10000000) -+#define TPMA_NV_WRITTEN ((TPMA_NV) 0x20000000) -+#define TPMA_NV_PLATFORMCREATE ((TPMA_NV) 0x40000000) -+#define TPMA_NV_READ_STCLEAR ((TPMA_NV) 0x80000000) -+ -+/* TPM_ALG_ID Constants */ -+typedef grub_uint16_t TPM_ALG_ID; -+ -+#define TPM_ALG_ERROR ((TPM_ALG_ID) 0x0000) -+#define TPM_ALG_AES ((TPM_ALG_ID) 0x0006) -+#define TPM_ALG_CAMELLIA ((TPM_ALG_ID) 0x0026) -+#define TPM_ALG_CBC ((TPM_ALG_ID) 0x0042) -+#define TPM_ALG_CFB ((TPM_ALG_ID) 0x0043) -+#define TPM_ALG_ECB ((TPM_ALG_ID) 0x0044) -+#define TPM_ALG_ECC ((TPM_ALG_ID) 0x0023) -+#define TPM_ALG_HMAC ((TPM_ALG_ID) 0x0005) -+#define TPM_ALG_KDF1_SP800_108 ((TPM_ALG_ID) 0x0022) -+#define TPM_ALG_KDF1_SP800_56A ((TPM_ALG_ID) 0x0020) -+#define TPM_ALG_KDF2 ((TPM_ALG_ID) 0x0021) -+#define TPM_ALG_KEYEDHASH ((TPM_ALG_ID) 0x0008) -+#define TPM_ALG_MGF1 ((TPM_ALG_ID) 0x0007) -+#define TPM_ALG_NULL ((TPM_ALG_ID) 0x0010) -+#define TPM_ALG_RSA ((TPM_ALG_ID) 0x0001) -+#define TPM_ALG_SHA1 ((TPM_ALG_ID) 0x0004) -+#define TPM_ALG_SHA256 ((TPM_ALG_ID) 0x000B) -+#define TPM_ALG_SHA384 ((TPM_ALG_ID) 0x000C) -+#define TPM_ALG_SHA512 ((TPM_ALG_ID) 0x000D) -+#define TPM_ALG_SM3_256 ((TPM_ALG_ID) 0x0012) -+#define TPM_ALG_SM4 ((TPM_ALG_ID) 0x0013) -+#define TPM_ALG_SYMCIPHER ((TPM_ALG_ID) 0x0025) -+#define TPM_ALG_XOR ((TPM_ALG_ID) 0x000A) -+ -+/* TPM_CAP Constants */ -+typedef grub_uint32_t TPM_CAP; -+ -+#define TPM_CAP_FIRST ((TPM_CAP) 0x00000000) -+#define TPM_CAP_ALGS ((TPM_CAP) 0x00000000) -+#define TPM_CAP_HANDLES ((TPM_CAP) 0x00000001) -+#define TPM_CAP_COMMANDS ((TPM_CAP) 0x00000002) -+#define TPM_CAP_PP_COMMANDS ((TPM_CAP) 0x00000003) -+#define TPM_CAP_AUDIT_COMMANDS ((TPM_CAP) 0x00000004) -+#define TPM_CAP_PCRS ((TPM_CAP) 0x00000005) -+#define TPM_CAP_TPM_PROPERTIES ((TPM_CAP) 0x00000006) -+#define TPM_CAP_PCR_PROPERTIES ((TPM_CAP) 0x00000007) -+#define TPM_CAP_ECC_CURVES ((TPM_CAP) 0x00000008) -+#define TPM_CAP_LAST ((TPM_CAP) 0x00000008) -+#define TPM_CAP_VENDOR_PROPERTY ((TPM_CAP) 0x00000100) -+ -+/* TPM_PT Constants */ -+typedef grub_uint32_t TPM_PT; -+ -+#define TPM_PT_NONE ((TPM_PT) 0x00000000) -+#define PT_GROUP ((TPM_PT) 0x00000100) -+#define PT_FIXED ((TPM_PT) (PT_GROUP * 1)) -+#define TPM_PT_FAMILY_INDICATOR ((TPM_PT) (PT_FIXED + 0)) -+#define TPM_PT_LEVEL ((TPM_PT) (PT_FIXED + 1)) -+#define TPM_PT_REVISION ((TPM_PT) (PT_FIXED + 2)) -+#define TPM_PT_DAY_OF_YEAR ((TPM_PT) (PT_FIXED + 3)) -+#define TPM_PT_YEAR ((TPM_PT) (PT_FIXED + 4)) -+#define TPM_PT_PCR_COUNT ((TPM_PT) (PT_FIXED + 18)) -+ -+/* TPM_SE Constants */ -+typedef grub_uint8_t TPM_SE; -+ -+#define TPM_SE_HMAC ((TPM_SE) 0x00) -+#define TPM_SE_POLICY ((TPM_SE) 0x01) -+#define TPM_SE_TRIAL ((TPM_SE) 0x03) -+ -+/* TPMI_YES_NO Constants */ -+typedef grub_uint8_t TPMI_YES_NO; -+ -+#define TPM_NO ((TPMI_YES_NO)0) -+#define TPM_YES ((TPMI_YES_NO)1) -+ -+/* TPM_ST Constants */ -+typedef grub_uint16_t TPM_ST; -+typedef TPM_ST TPMI_ST_COMMAND_TAG; -+ -+#define TPM_ST_NO_SESSIONS ((TPMI_ST_COMMAND_TAG) 0x8001) -+#define TPM_ST_SESSIONS ((TPMI_ST_COMMAND_TAG) 0x8002) -+ -+/* TPM_HANDLE Types */ -+typedef grub_uint32_t TPM_HANDLE; -+ -+typedef TPM_HANDLE TPMI_RH_HIERARCHY; -+typedef TPM_HANDLE TPMI_RH_LOCKOUT; -+typedef TPM_HANDLE TPMI_SH_AUTH_SESSION; -+typedef TPM_HANDLE TPMI_DH_CONTEXT; -+typedef TPM_HANDLE TPMI_DH_OBJECT; -+typedef TPM_HANDLE TPMI_DH_ENTITY; -+typedef TPM_HANDLE TPMI_SH_POLICY; -+typedef TPM_HANDLE TPMI_DH_PCR; -+typedef TPM_HANDLE TPMI_RH_NV_AUTH; -+typedef TPM_HANDLE TPMI_RH_NV_INDEX; -+ -+/* TPM_RH Constants */ -+typedef TPM_HANDLE TPM_RH; -+ -+#define TPM_RH_FIRST ((TPM_RH) 0x40000000) -+#define TPM_RH_SRK ((TPM_RH) 0x40000000) -+#define TPM_RH_OWNER ((TPM_RH) 0x40000001) -+#define TPM_RH_REVOKE ((TPM_RH) 0x40000002) -+#define TPM_RH_TRANSPORT ((TPM_RH) 0x40000003) -+#define TPM_RH_OPERATOR ((TPM_RH) 0x40000004) -+#define TPM_RH_ADMIN ((TPM_RH) 0x40000005) -+#define TPM_RH_EK ((TPM_RH) 0x40000006) -+#define TPM_RH_NULL ((TPM_RH) 0x40000007) -+#define TPM_RH_UNASSIGNED ((TPM_RH) 0x40000008) -+#define TPM_RS_PW ((TPM_RH) 0x40000009) -+#define TPM_RH_LOCKOUT ((TPM_RH) 0x4000000A) -+#define TPM_RH_ENDORSEMENT ((TPM_RH) 0x4000000B) -+#define TPM_RH_PLATFORM ((TPM_RH) 0x4000000C) -+#define TPM_RH_PLATFORM_NV ((TPM_RH) 0x4000000D) -+#define TPM_RH_AUTH_00 ((TPM_RH) 0x40000010) -+#define TPM_RH_AUTH_FF ((TPM_RH) 0x4000010F) -+#define TPM_RH_LAST ((TPM_RH) 0x4000010F) -+ -+/* TPM_ECC_CURVE Constants */ -+typedef grub_uint16_t TPM_ECC_CURVE; -+ -+#define TPM_ECC_NONE ((TPM_ECC_CURVE) 0x0000) -+#define TPM_ECC_NIST_P192 ((TPM_ECC_CURVE) 0x0001) -+#define TPM_ECC_NIST_P224 ((TPM_ECC_CURVE) 0x0002) -+#define TPM_ECC_NIST_P256 ((TPM_ECC_CURVE) 0x0003) -+#define TPM_ECC_NIST_P384 ((TPM_ECC_CURVE) 0x0004) -+#define TPM_ECC_NIST_P521 ((TPM_ECC_CURVE) 0x0005) -+#define TPM_ECC_BN_P256 ((TPM_ECC_CURVE) 0x0010) -+#define TPM_ECC_BN_P638 ((TPM_ECC_CURVE) 0x0011) -+#define TPM_ECC_SM2_P256 ((TPM_ECC_CURVE) 0x0020) -+ -+/* TPM_CC Constants */ -+typedef grub_uint32_t TPM_CC; -+ -+#define TPM_CC_EvictControl ((TPM_CC) 0x00000120) -+#define TPM_CC_CreatePrimary ((TPM_CC) 0x00000131) -+#define TPM_CC_Create ((TPM_CC) 0x00000153) -+#define TPM_CC_FlushContext ((TPM_CC) 0x00000165) -+#define TPM_CC_ReadPublic ((TPM_CC) 0x00000173) -+#define TPM_CC_StartAuthSession ((TPM_CC) 0x00000176) -+#define TPM_CC_PolicyPCR ((TPM_CC) 0x0000017f) -+#define TPM_CC_NV_Read ((TPM_CC) 0x0000014e) -+#define TPM_CC_NV_ReadPublic ((TPM_CC) 0x00000169) -+#define TPM_CC_GetCapability ((TPM_CC) 0x0000017a) -+#define TPM_CC_PCR_Read ((TPM_CC) 0x0000017e) -+#define TPM_CC_Load ((TPM_CC) 0x00000157) -+#define TPM_CC_Unseal ((TPM_CC) 0x0000015e) -+#define TPM_CC_PolicyGetDigest ((TPM_CC) 0x00000189) -+ -+/* Hash algorithm sizes */ -+#define TPM_SHA1_DIGEST_SIZE 20 -+#define TPM_SHA256_DIGEST_SIZE 32 -+#define TPM_SM3_256_DIGEST_SIZE 32 -+#define TPM_SHA384_DIGEST_SIZE 48 -+#define TPM_SHA512_DIGEST_SIZE 64 -+ -+/* Encryption algorithm sizes */ -+#define TPM_MAX_SYM_BLOCK_SIZE 16 -+#define TPM_MAX_SYM_DATA 256 -+#define TPM_MAX_ECC_KEY_BYTES 128 -+#define TPM_MAX_SYM_KEY_BYTES 32 -+#define TPM_MAX_RSA_KEY_BYTES 512 -+ -+/* Buffer Size Constants */ -+#define TPM_MAX_PCRS 32 -+#define TPM_NUM_PCR_BANKS 16 -+#define TPM_PCR_SELECT_MAX ((TPM_MAX_PCRS + 7) / 8) -+#define TPM_MAX_DIGEST_BUFFER 1024 -+#define TPM_MAX_TPM_PROPERTIES 8 -+#define TPM_MAX_NV_BUFFER_SIZE 2048 -+#define TPM_PRIVATE_VENDOR_SPECIFIC_BYTES 1280 -+ -+/* TPM_GENERATED Constants */ -+typedef grub_uint32_t TPM_GENERATED; -+ -+#define TPM_GENERATED_VALUE ((TPM_GENERATED) 0xff544347) -+ -+/* TPM_ALG_ID Types */ -+typedef TPM_ALG_ID TPMI_ALG_PUBLIC; -+typedef TPM_ALG_ID TPMI_ALG_HASH; -+typedef TPM_ALG_ID TPMI_ALG_KEYEDHASH_SCHEME; -+typedef TPM_ALG_ID TPMI_ALG_KDF; -+typedef TPM_ALG_ID TPMI_ALG_SYM_OBJECT; -+typedef TPM_ALG_ID TPMI_ALG_SYM_MODE; -+typedef TPM_ALG_ID TPMI_ALG_RSA_DECRYPT; -+typedef TPM_ALG_ID TPMI_ALG_ECC_SCHEME; -+typedef TPM_ALG_ID TPMI_ALG_ASYM_SCHEME; -+typedef TPM_ALG_ID TPMI_ALG_RSA_SCHEME; -+typedef TPM_ALG_ID TPMI_ALG_SYM; -+ -+/* TPM_KEY_BITS Type */ -+typedef grub_uint16_t TPM_KEY_BITS; -+ -+/* TPM_ECC_CURVE Types */ -+typedef TPM_ECC_CURVE TPMI_ECC_CURVE; -+ -+/* TPMI_RH_PROVISION Type */ -+typedef TPM_HANDLE TPMI_RH_PROVISION; -+ -+/* TPMI_RH_PROVISION Type */ -+typedef TPM_HANDLE TPMI_DH_PERSISTENT; -+ -+#endif /* ! GRUB_TPM2_INTERNAL_TYPES_HEADER */ -diff --git a/include/grub/tpm2/mu.h b/include/grub/tpm2/mu.h -new file mode 100644 -index 000000000..c545976db ---- /dev/null -+++ b/include/grub/tpm2/mu.h -@@ -0,0 +1,292 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_MU_HEADER -+#define GRUB_TPM2_MU_HEADER 1 -+ -+#include -+#include -+ -+void -+grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_AUTH_COMMAND* authCommand); -+ -+void -+grub_tpm2_mu_TPM2B_Marshal (grub_tpm2_buffer_t buf, -+ const grub_uint16_t size, -+ const grub_uint8_t* buffer); -+ -+void -+grub_tpm2_mu_TPMU_SYM_KEY_BITS_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_SYM_OBJECT algorithm, -+ const TPMU_SYM_KEY_BITS *p); -+ -+void -+grub_tpm2_mu_TPMU_SYM_MODE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_SYM_OBJECT algorithm, -+ const TPMU_SYM_MODE *p); -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_SYM_DEF *p); -+ -+void -+grub_tpm2_mu_TPMS_PCR_SELECTION_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_PCR_SELECTION* pcrSelection); -+ -+void -+grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (grub_tpm2_buffer_t buf, -+ const TPML_PCR_SELECTION* pcrSelection); -+ -+void -+grub_tpm2_mu_TPMA_OBJECT_Marshal (grub_tpm2_buffer_t buf, -+ const TPMA_OBJECT *p); -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_XOR_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SCHEME_XOR *p); -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_HMAC_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SCHEME_HMAC *p); -+ -+void -+grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_KEYEDHASH_SCHEME scheme, -+ const TPMU_SCHEME_KEYEDHASH *p); -+ -+void -+grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_KEYEDHASH_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_KEYEDHASH_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_SYM_DEF_OBJECT *p); -+ -+void -+grub_tpm2_mu_TPMU_ASYM_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_RSA_DECRYPT scheme, -+ const TPMU_ASYM_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMT_RSA_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_RSA_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_RSA_PARMS_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_RSA_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SYMCIPHER_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMT_ECC_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_ECC_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMU_KDF_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_KDF scheme, -+ const TPMU_KDF_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMT_KDF_SCHEME_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_KDF_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_ECC_PARMS_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_ECC_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_PARMS_Marshal (grub_tpm2_buffer_t buf, -+ const grub_uint32_t type, -+ const TPMU_PUBLIC_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMS_ECC_POINT_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_ECC_POINT *p); -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_ID_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_PUBLIC type, -+ const TPMU_PUBLIC_ID *p); -+ -+void -+grub_tpm2_mu_TPMT_PUBLIC_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPM2B_PUBLIC_Marshal (grub_tpm2_buffer_t buf, -+ const TPM2B_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPMS_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SENSITIVE_CREATE *p); -+ -+void -+grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buf, -+ const TPM2B_SENSITIVE_CREATE *sensitiveCreate); -+ -+void -+grub_tpm2_mu_TPM2B_Unmarshal (grub_tpm2_buffer_t buf, -+ TPM2B* p); -+ -+void -+grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_AUTH_RESPONSE* p); -+ -+void -+grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (grub_tpm2_buffer_t buf, -+ TPM2B_DIGEST* digest); -+ -+void -+grub_tpm2_mu_TPMA_OBJECT_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMA_OBJECT *p); -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_HMAC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_SCHEME_HMAC *p); -+ -+void -+grub_tpm2_mu_TPMS_SCHEME_XOR_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_SCHEME_XOR *p); -+ -+void -+grub_tpm2_mu_TPMU_SCHEME_KEYEDHASH_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_KEYEDHASH_SCHEME scheme, -+ TPMU_SCHEME_KEYEDHASH *p); -+ -+void -+grub_tpm2_mu_TPMT_KEYEDHASH_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_KEYEDHASH_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_KEYEDHASH_PARMS_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_KEYEDHASH_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMU_SYM_KEY_BITS_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_SYM_OBJECT algorithm, -+ TPMU_SYM_KEY_BITS *p); -+ -+void -+grub_tpm2_mu_TPMU_SYM_MODE_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_SYM_OBJECT algorithm, -+ TPMU_SYM_MODE *p); -+ -+void -+grub_tpm2_mu_TPMT_SYM_DEF_OBJECT_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_SYM_DEF_OBJECT *p); -+ -+void -+grub_tpm2_mu_TPMS_SYMCIPHER_PARMS_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_SYMCIPHER_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMU_ASYM_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_RSA_DECRYPT scheme, -+ TPMU_ASYM_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMT_RSA_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_RSA_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_RSA_PARMS_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_RSA_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMT_ECC_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_ECC_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMU_KDF_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_KDF scheme, -+ TPMU_KDF_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMT_KDF_SCHEME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_KDF_SCHEME *p); -+ -+void -+grub_tpm2_mu_TPMS_ECC_PARMS_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_ECC_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_PARMS_Unmarshal (grub_tpm2_buffer_t buf, -+ grub_uint32_t type, -+ TPMU_PUBLIC_PARMS *p); -+ -+void -+grub_tpm2_mu_TPMS_ECC_POINT_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_ECC_POINT *p); -+ -+void -+grub_tpm2_mu_TPMU_PUBLIC_ID_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_PUBLIC type, -+ TPMU_PUBLIC_ID *p); -+ -+void -+grub_tpm2_mu_TPMT_PUBLIC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPM2B_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPMS_NV_PUBLIC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_NV_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPM2B_NV_PUBLIC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPM2B_NV_PUBLIC *p); -+ -+void -+grub_tpm2_mu_TPM2B_NAME_Unmarshal (grub_tpm2_buffer_t buf, -+ TPM2B_NAME *n); -+ -+void -+grub_tpm2_mu_TPMS_TAGGED_PROPERTY_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_TAGGED_PROPERTY* property); -+ -+void -+grub_tpm2_mu_TPMS_CAPABILITY_DATA_tpmProperties_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_CAPABILITY_DATA* capabilityData); -+ -+void -+grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_TK_CREATION *p); -+ -+void -+grub_tpm2_mu_TPMS_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_PCR_SELECTION* pcrSelection); -+ -+void -+grub_tpm2_mu_TPML_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, -+ TPML_PCR_SELECTION* pcrSelection); -+ -+void -+grub_tpm2_mu_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buf, -+ TPML_DIGEST* digest); -+ -+#endif /* ! GRUB_TPM2_MU_HEADER */ -diff --git a/include/grub/tpm2/tcg2.h b/include/grub/tpm2/tcg2.h -new file mode 100644 -index 000000000..553b3fd93 ---- /dev/null -+++ b/include/grub/tpm2/tcg2.h -@@ -0,0 +1,34 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_TCG2_HEADER -+#define GRUB_TPM2_TCG2_HEADER 1 -+ -+#include -+#include -+ -+grub_err_t -+grub_tcg2_get_max_output_size (grub_size_t *size); -+ -+grub_err_t -+grub_tcg2_submit_command (grub_size_t input_size, -+ grub_uint8_t *input, -+ grub_size_t output_size, -+ grub_uint8_t *output); -+ -+#endif /* ! GRUB_TPM2_TCG2_HEADER */ -diff --git a/include/grub/tpm2/tpm2.h b/include/grub/tpm2/tpm2.h -new file mode 100644 -index 000000000..cfdc9edcd ---- /dev/null -+++ b/include/grub/tpm2/tpm2.h -@@ -0,0 +1,34 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_TPM2_HEADER -+#define GRUB_TPM2_TPM2_HEADER 1 -+ -+#include -+#include -+#include -+ -+/* Well-Known Windows SRK handle */ -+#define TPM2_SRK_HANDLE 0x81000001 -+ -+typedef struct TPM2_SEALED_KEY { -+ TPM2B_PUBLIC public; -+ TPM2B_PRIVATE private; -+} TPM2_SEALED_KEY; -+ -+#endif /* ! GRUB_TPM2_TPM2_HEADER */ --- -2.41.0 - diff --git a/0071-ieee1275-powerpc-enables-device-mapper-discovery.patch b/0130-ieee1275-powerpc-enables-device-mapper-discovery.patch similarity index 84% rename from 0071-ieee1275-powerpc-enables-device-mapper-discovery.patch rename to 0130-ieee1275-powerpc-enables-device-mapper-discovery.patch index fa60c0c..6f1c21b 100644 --- a/0071-ieee1275-powerpc-enables-device-mapper-discovery.patch +++ b/0130-ieee1275-powerpc-enables-device-mapper-discovery.patch @@ -1,7 +1,7 @@ -From 4f0eefeafe48827dc9bec01443aca9a2e2accf2c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Diego Domingos -Date: Wed, 24 Jun 2020 08:22:50 -0400 -Subject: [PATCH 071/272] ieee1275/powerpc: enables device mapper discovery +Date: Mon, 14 Dec 2020 17:47:16 +0100 +Subject: [PATCH] ieee1275/powerpc: enables device mapper discovery this patch enables the device mapper discovery on ofpath.c. Currently, when we are dealing with a device like /dev/dm-* the ofpath returns null @@ -11,15 +11,13 @@ This patch implements a function that will look into /sys/block/dm-* devices and search recursively inside slaves directory to find the root disk. -v2: -Fix gcc-12 error: pointer 'device_path' may be used after 'free' -[-Werror=use-after-free] +Signed-off-by: Diego Domingos --- - grub-core/osdep/linux/ofpath.c | 64 +++++++++++++++++++++++++++++++++- + grub-core/osdep/linux/ofpath.c | 64 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 63 insertions(+), 1 deletion(-) diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index f2bc9fc5c..89beceef4 100644 +index 0f5d54e9f2d..cc849d9c94c 100644 --- a/grub-core/osdep/linux/ofpath.c +++ b/grub-core/osdep/linux/ofpath.c @@ -37,6 +37,7 @@ @@ -30,7 +28,7 @@ index f2bc9fc5c..89beceef4 100644 #ifdef __sparc__ typedef enum -@@ -754,13 +755,74 @@ strip_trailing_digits (const char *p) +@@ -755,13 +756,74 @@ strip_trailing_digits (const char *p) return new; } @@ -79,7 +77,7 @@ index f2bc9fc5c..89beceef4 100644 + closedir (dp); + } + else -+ grub_util_warn (_("cannot open directory `/sys/block/%s/slaves'"), curr_device); ++ grub_util_warn (_("cannot open directory `%s'"), device_path); + } + + free (directory); @@ -106,6 +104,3 @@ index f2bc9fc5c..89beceef4 100644 device = get_basename (name_buf); devnode = strip_trailing_digits (name_buf); devicenode = strip_trailing_digits (device); --- -2.41.0 - diff --git a/0130-protectors-Add-TPM2-Key-Protector.patch b/0130-protectors-Add-TPM2-Key-Protector.patch deleted file mode 100644 index a092ba8..0000000 --- a/0130-protectors-Add-TPM2-Key-Protector.patch +++ /dev/null @@ -1,2052 +0,0 @@ -From 96497eb4182f5c6d2ed74d2e8b84684958484d8e Mon Sep 17 00:00:00 2001 -From: Hernan Gatta -Date: Tue, 1 Feb 2022 05:02:55 -0800 -Subject: [PATCH 130/272] protectors: Add TPM2 Key Protector - -The TPM2 key protector is a module that enables the automatic retrieval -of a fully-encrypted disk's unlocking key from a TPM 2.0. - -The theory of operation is such that the module accepts various -arguments, most of which are optional and therefore possess reasonable -defaults. One of these arguments is the keyfile/tpm2key parameter, which -is mandatory. There are two supported key formats: - -1. Raw Sealed Key (--keyfile) - When sealing a key with TPM2_Create, the public portion of the sealed - key is stored in TPM2B_PUBLIC, and the private portion is in - TPM2B_PRIVATE. The raw sealed key glues the fully marshalled - TPM2B_PUBLIC and TPM2B_PRIVATE into one file. - -2. TPM 2.0 Key (--tpm2key) - The following is the ASN.1 definition of TPM 2.0 Key File: - - TPMPolicy ::= SEQUENCE { - CommandCode [0] EXPLICIT INTEGER - CommandPolicy [1] EXPLICIT OCTET STRING - } - - TPMAuthPolicy ::= SEQUENCE { - Name [0] EXPLICIT UTF8STRING OPTIONAL - Policy [1] EXPLICIT SEQUENCE OF TPMPolicy - } - - TPMKey ::= SEQUENCE { - type OBJECT IDENTIFIER - emptyAuth [0] EXPLICIT BOOLEAN OPTIONAL - policy [1] EXPLICIT SEQUENCE OF TPMPolicy OPTIONAL - secret [2] EXPLICIT OCTET STRING OPTIONAL - authPolicy [3] EXPLICIT SEQUENCE OF TPMAuthPolicy OPTIONAL - parent INTEGER - pubkey OCTET STRING - privkey OCTET STRING - } - - The TPM2 key protector only expects a "sealed" key in DER encoding, - so 'type' is always 2.23.133.10.1.5, 'emptyAuth' is 'TRUE', and - 'secret' is empty. 'policy' and 'authPolicy' are the possible policy - command sequences to construst the policy digest to unseal the key. - Similar to the raw sealed key, the public portion (TPM2B_PUBLIC) of - the sealed key is stored in 'pubkey', and the private portion - (TPM2B_PRIVATE) is in 'privkey'. - - For more details: https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html - -This sealed key file is created via the grub-protect tool. The tool -utilizes the TPM's sealing functionality to seal (i.e., encrypt) an -unlocking key using a Storage Root Key (SRK) to the values of various -Platform Configuration Registers (PCRs). These PCRs reflect the state -of the system as it boots. If the values are as expected, the system -may be considered trustworthy, at which point the TPM allows for a -caller to utilize the private component of the SRK to unseal (i.e., -decrypt) the sealed key file. The caller, in this case, is this key -protector. - -The TPM2 key protector registers two commands: - -- tpm2_key_protector_init: Initializes the state of the TPM2 key - protector for later usage, clearing any - previous state, too, if any. - -- tpm2_key_protector_clear: Clears any state set by tpm2_key_protector_init. - -The way this is expected to be used requires the user to, either -interactively or, normally, via a boot script, initialize/configure -the key protector and then specify that it be used by the 'cryptomount' -command (modifications to this command are in a different patch). - -For instance, to unseal the raw sealed key file: - -tpm2_key_protector_init --keyfile=(hd0,gpt1)/efi/grub2/sealed-1.key -cryptomount -u -P tpm2 - -tpm2_key_protector_init --keyfile=(hd0,gpt1)/efi/grub2/sealed-2.key --pcrs=7,11 -cryptomount -u -P tpm2 - -Or, to unseal the TPM 2.0 Key file: - -tpm2_key_protector_init --tpm2key=(hd0,gpt1)/efi/grub2/sealed-1.tpm -cryptomount -u -P tpm2 - -tpm2_key_protector_init --tpm2key=(hd0,gpt1)/efi/grub2/sealed-2.tpm --pcrs=7,11 -cryptomount -u -P tpm2 - -If a user does not initialize the key protector and attempts to use it -anyway, the protector returns an error. - -Before unsealing the key, the TPM2 key protector follows the "TPMPolicy" -sequences to enforce the TPM policy commands to construct a valid policy -digest to unseal the key. - -For the TPM 2.0 Key files, 'authPolicy' may contain multiple "TPMPolicy" -sequences, the TPM2 key protector iterates 'authPolicy' to find a valid -sequence to unseal key. If 'authPolicy' is empty or all sequences in -'authPolicy' fail, the protector tries the one from 'policy'. In case -'policy' is also empty, the protector creates a "TPMPolicy" sequence -based on the given PCR selection. - -For the raw sealed key, the TPM2 key protector treats the key file as a -TPM 2.0 Key file without 'authPolicy' and 'policy', so the "TPMPolicy" -sequence is always based on the PCR selection from the command -parameters. - -Currently, there is only one supported policy command: TPM2_PolicyPCR. -The command set can be extended to support advanced features, such as -authorized policy, in the future. - -Signed-off-by: Hernan Gatta -Signed-off-by: Gary Lin ---- - grub-core/Makefile.core.def | 13 + - grub-core/tpm2/args.c | 177 +++++ - grub-core/tpm2/module.c | 1028 +++++++++++++++++++++++++++++ - grub-core/tpm2/tpm2key.asn | 31 + - grub-core/tpm2/tpm2key.c | 447 +++++++++++++ - grub-core/tpm2/tpm2key_asn1_tab.c | 41 ++ - include/grub/tpm2/internal/args.h | 41 ++ - include/grub/tpm2/tpm2key.h | 83 +++ - 8 files changed, 1861 insertions(+) - create mode 100644 grub-core/tpm2/args.c - create mode 100644 grub-core/tpm2/module.c - create mode 100644 grub-core/tpm2/tpm2key.asn - create mode 100644 grub-core/tpm2/tpm2key.c - create mode 100644 grub-core/tpm2/tpm2key_asn1_tab.c - create mode 100644 include/grub/tpm2/internal/args.h - create mode 100644 include/grub/tpm2/tpm2key.h - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 0800e1f0a..c26b30423 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -2598,6 +2598,19 @@ module = { - enable = efi; - }; - -+module = { -+ name = tpm2; -+ common = tpm2/args.c; -+ common = tpm2/buffer.c; -+ common = tpm2/module.c; -+ common = tpm2/mu.c; -+ common = tpm2/tpm2.c; -+ common = tpm2/tpm2key.c; -+ common = tpm2/tpm2key_asn1_tab.c; -+ efi = tpm2/tcg2.c; -+ enable = efi; -+}; -+ - module = { - name = tr; - common = commands/tr.c; -diff --git a/grub-core/tpm2/args.c b/grub-core/tpm2/args.c -new file mode 100644 -index 000000000..274f4fef0 ---- /dev/null -+++ b/grub-core/tpm2/args.c -@@ -0,0 +1,177 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+ -+grub_err_t -+grub_tpm2_protector_parse_pcrs (char *value, grub_uint8_t *pcrs, -+ grub_uint8_t *pcr_count) -+{ -+ char *current_pcr = value; -+ char *next_pcr; -+ unsigned long pcr; -+ grub_uint8_t i; -+ -+ if (grub_strlen (value) == 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ *pcr_count = 0; -+ for (i = 0; i < TPM_MAX_PCRS; i++) -+ { -+ next_pcr = grub_strchr (current_pcr, ','); -+ if (next_pcr == current_pcr) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Empty entry in PCR list")); -+ if (next_pcr) -+ *next_pcr = '\0'; -+ -+ grub_errno = GRUB_ERR_NONE; -+ pcr = grub_strtoul (current_pcr, NULL, 10); -+ if (grub_errno != GRUB_ERR_NONE) -+ return grub_error (grub_errno, -+ N_("Entry '%s' in PCR list is not a number"), -+ current_pcr); -+ -+ if (pcr > TPM_MAX_PCRS) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Entry %lu in PCR list is too large to be a PCR " -+ "number, PCR numbers range from 0 to %u"), -+ pcr, TPM_MAX_PCRS); -+ -+ pcrs[i] = (grub_uint8_t)pcr; -+ *pcr_count += 1; -+ -+ if (next_pcr == NULL) -+ break; -+ -+ current_pcr = next_pcr + 1; -+ if (*current_pcr == '\0') -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Trailing comma at the end of PCR list")); -+ } -+ -+ if (i == TPM_MAX_PCRS) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Too many PCRs in PCR list, the maximum number of " -+ "PCRs is %u"), TPM_MAX_PCRS); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tpm2_protector_parse_asymmetric (const char *value, -+ TPM_ALG_ID *asymmetric, -+ TPM_KEY_BITS *rsa_bits, -+ TPM_ECC_CURVE *ecc_curve) -+{ -+ if (grub_strcasecmp (value, "ECC") == 0 || -+ grub_strcasecmp (value, "ECC_NIST_P256") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_NIST_P256; -+ } -+ else if (grub_strcasecmp (value, "RSA") == 0 || -+ grub_strcasecmp (value, "RSA2048") == 0) -+ { -+ *asymmetric = TPM_ALG_RSA; -+ *rsa_bits = 2048; -+ } -+ else if (grub_strcasecmp (value, "RSA3072") == 0) -+ { -+ *asymmetric = TPM_ALG_RSA; -+ *rsa_bits = 3072; -+ } -+ else if (grub_strcasecmp (value, "RSA4096") == 0) -+ { -+ *asymmetric = TPM_ALG_RSA; -+ *rsa_bits = 4096; -+ } -+ else if (grub_strcasecmp (value, "ECC_NIST_P384") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_NIST_P384; -+ } -+ else if (grub_strcasecmp (value, "ECC_NIST_P521") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_NIST_P521; -+ } -+ else if (grub_strcasecmp (value, "ECC_BN_P256") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_BN_P256; -+ } -+ else if (grub_strcasecmp (value, "ECC_BN_P638") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_BN_P638; -+ } -+ else if (grub_strcasecmp (value, "ECC_SM2_P256") == 0) -+ { -+ *asymmetric = TPM_ALG_ECC; -+ *ecc_curve = TPM_ECC_SM2_P256; -+ } -+ else -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Value '%s' is not a valid asymmetric key type"), -+ value); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tpm2_protector_parse_bank (const char *value, TPM_ALG_ID *bank) -+{ -+ if (grub_strcasecmp (value, "SHA1") == 0) -+ *bank = TPM_ALG_SHA1; -+ else if (grub_strcasecmp (value, "SHA256") == 0) -+ *bank = TPM_ALG_SHA256; -+ else if (grub_strcasecmp (value, "SHA384") == 0) -+ *bank = TPM_ALG_SHA384; -+ else if (grub_strcasecmp (value, "SHA512") == 0) -+ *bank = TPM_ALG_SHA512; -+ else -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Value '%s' is not a valid PCR bank"), value); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tpm2_protector_parse_tpm_handle (const char *value, TPM_HANDLE *handle) -+{ -+ unsigned long num; -+ -+ grub_errno = GRUB_ERR_NONE; -+ num = grub_strtoul (value, NULL, 0); -+ if (grub_errno != GRUB_ERR_NONE) -+ return grub_error (grub_errno, N_("TPM handle value '%s' is not a number"), -+ value); -+ -+ if (num > GRUB_UINT_MAX) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Value %lu is too large to be a TPM handle, TPM " -+ "handles are unsigned 32-bit integers"), num); -+ -+ *handle = (TPM_HANDLE)num; -+ -+ return GRUB_ERR_NONE; -+} -diff --git a/grub-core/tpm2/module.c b/grub-core/tpm2/module.c -new file mode 100644 -index 000000000..df0727215 ---- /dev/null -+++ b/grub-core/tpm2/module.c -@@ -0,0 +1,1028 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); -+ -+typedef enum grub_tpm2_protector_mode -+{ -+ GRUB_TPM2_PROTECTOR_MODE_UNSET, -+ GRUB_TPM2_PROTECTOR_MODE_SRK, -+ GRUB_TPM2_PROTECTOR_MODE_NV -+} grub_tpm2_protector_mode_t; -+ -+enum grub_tpm2_protector_options -+{ -+ OPTION_MODE, -+ OPTION_PCRS, -+ OPTION_BANK, -+ OPTION_TPM2KEY, -+ OPTION_KEYFILE, -+ OPTION_SRK, -+ OPTION_ASYMMETRIC, -+ OPTION_NVINDEX -+}; -+ -+struct grub_tpm2_protector_context -+{ -+ grub_tpm2_protector_mode_t mode; -+ grub_uint8_t pcrs[TPM_MAX_PCRS]; -+ grub_uint8_t pcr_count; -+ TPM_ALG_ID asymmetric; -+ TPM_KEY_BITS rsa_bits; -+ TPM_ECC_CURVE ecc_curve; -+ TPM_ALG_ID bank; -+ const char *tpm2key; -+ const char *keyfile; -+ TPM_HANDLE srk; -+ TPM_HANDLE nv; -+}; -+ -+static const struct grub_arg_option grub_tpm2_protector_init_cmd_options[] = -+ { -+ /* Options for all modes */ -+ { -+ .longarg = "mode", -+ .shortarg = 'm', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Unseal key using SRK ('srk') (default) or retrieve it from an NV " -+ "Index ('nv')."), -+ }, -+ { -+ .longarg = "pcrs", -+ .shortarg = 'p', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Comma-separated list of PCRs used to authorize key release " -+ "(e.g., '7,11', default is 7."), -+ }, -+ { -+ .longarg = "bank", -+ .shortarg = 'b', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Bank of PCRs used to authorize key release: " -+ "SHA1, SHA256 (default), SHA384 or SHA512."), -+ }, -+ /* SRK-mode options */ -+ { -+ .longarg = "tpm2key", -+ .shortarg = 'T', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Required in SRK mode, path to the key file in TPM 2.0 Key File Format " -+ "to unseal using the TPM (e.g., (hd0,gpt1)/boot/grub2/secret.tpm)."), -+ }, -+ { -+ .longarg = "keyfile", -+ .shortarg = 'k', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Required in SRK mode, path to the sealed key file to unseal using " -+ "the TPM (e.g., (hd0,gpt1)/boot/grub2/sealed_key). " -+ "Use '-tpm2key' instead"), -+ }, -+ { -+ .longarg = "srk", -+ .shortarg = 's', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("In SRK mode, the SRK handle if the SRK is persistent."), -+ }, -+ { -+ .longarg = "asymmetric", -+ .shortarg = 'a', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("In SRK mode, the type of SRK: RSA (RSA2048), RSA3072, " -+ "RSA4096, ECC (ECC_NIST_P256), ECC_NIST_P384, " -+ "ECC_NIST_P521, ECC_BN_P256, ECC_BN_P638, and ECC_SM2_P256. " -+ "(default is RSA2048)"), -+ }, -+ /* NV Index-mode options */ -+ { -+ .longarg = "nvindex", -+ .shortarg = 'n', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("Required in NV Index mode, the NV handle to read which must " -+ "readily exist on the TPM and which contains the key."), -+ }, -+ /* End of list */ -+ {0, 0, 0, 0, 0, 0} -+ }; -+ -+static grub_extcmd_t grub_tpm2_protector_init_cmd; -+static grub_extcmd_t grub_tpm2_protector_clear_cmd; -+static struct grub_tpm2_protector_context grub_tpm2_protector_ctx = { 0 }; -+ -+static grub_err_t -+grub_tpm2_protector_srk_read_file (const char *filepath, void **buffer, -+ grub_size_t *buffer_size) -+{ -+ grub_file_t file; -+ grub_off_t file_size; -+ void *read_buffer; -+ grub_off_t read_n; -+ grub_err_t err; -+ -+ /* Using GRUB_FILE_TYPE_SIGNATURE ensures we do not hash the keyfile into PCR9 -+ * otherwise we'll never be able to predict the value of PCR9 at unseal time */ -+ file = grub_file_open (filepath, GRUB_FILE_TYPE_SIGNATURE); -+ if (file == NULL) -+ { -+ /* Push errno from grub_file_open() into the error message stack */ -+ grub_error_push(); -+ err = grub_error (GRUB_ERR_FILE_NOT_FOUND, -+ N_("Could not open file: %s\n"), -+ filepath); -+ goto error; -+ } -+ -+ file_size = grub_file_size (file); -+ if (file_size == 0) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Could not read file size: %s"), -+ filepath); -+ goto error; -+ } -+ -+ read_buffer = grub_malloc (file_size); -+ if (read_buffer == NULL) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ N_("Could not allocate buffer for %s"), -+ filepath); -+ goto error; -+ } -+ -+ read_n = grub_file_read (file, read_buffer, file_size); -+ if (read_n != file_size) -+ { -+ grub_free (read_buffer); -+ err = grub_error (GRUB_ERR_FILE_READ_ERROR, -+ N_("Could not retrieve file contents: %s"), -+ filepath); -+ goto error; -+ } -+ -+ *buffer = read_buffer; -+ *buffer_size = file_size; -+ -+ err = GRUB_ERR_NONE; -+ -+error: -+ grub_file_close (file); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_srk_unmarshal_keyfile (void *sealed_key, -+ grub_size_t sealed_key_size, -+ TPM2_SEALED_KEY *sk) -+{ -+ struct grub_tpm2_buffer buf; -+ -+ grub_tpm2_buffer_init (&buf); -+ if (sealed_key_size > buf.cap) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Sealed key larger than %" PRIuGRUB_SIZE " bytes"), -+ buf.cap); -+ -+ grub_memcpy (buf.data, sealed_key, sealed_key_size); -+ buf.size = sealed_key_size; -+ -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (&buf, &sk->public); -+ grub_tpm2_mu_TPM2B_Unmarshal (&buf, (TPM2B *)&sk->private); -+ -+ if (buf.error) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Malformed TPM wire key file")); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_srk_unmarshal_tpm2key (void *sealed_key, -+ grub_size_t sealed_key_size, -+ tpm2key_policy_t *policy_seq, -+ tpm2key_authpolicy_t *authpol_seq, -+ grub_uint32_t *parent, -+ TPM2_SEALED_KEY *sk) -+{ -+ asn1_node tpm2key = NULL; -+ grub_uint32_t parent_tmp; -+ void *sealed_pub = NULL; -+ grub_size_t sealed_pub_size; -+ void *sealed_priv = NULL; -+ grub_size_t sealed_priv_size; -+ struct grub_tpm2_buffer buf; -+ grub_err_t err; -+ -+ /* -+ * Start to parse the tpm2key file -+ * TPMKey ::= SEQUENCE { -+ * type OBJECT IDENTIFIER, -+ * emptyAuth [0] EXPLICIT BOOLEAN OPTIONAL, -+ * policy [1] EXPLICIT SEQUENCE OF TPMPolicy OPTIONAL, -+ * secret [2] EXPLICIT OCTET STRING OPTIONAL, -+ * authPolicy [3] EXPLICIT SEQUENCE OF TPMAuthPolicy OPTIONAL, -+ * parent INTEGER, -+ * pubkey OCTET STRING, -+ * privkey OCTET STRING -+ * } -+ */ -+ err = grub_tpm2key_start_parsing (&tpm2key, sealed_key, sealed_key_size); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ /* -+ * Retrieve the policy sequence from 'policy' -+ * policy_seq will be NULL when 'policy' is not available -+ */ -+ err = grub_tpm2key_get_policy_seq (tpm2key, policy_seq); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ -+ /* -+ * Retrieve the authpolicy sequence from 'authPolicy' -+ * authpol_seq will be NULL when 'authPolicy' is not available -+ */ -+ err = grub_tpm2key_get_authpolicy_seq (tpm2key, authpol_seq); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ -+ /* Retrieve the parent handle */ -+ err = grub_tpm2key_get_parent (tpm2key, &parent_tmp); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ *parent = parent_tmp; -+ -+ /* Retrieve the public part of the sealed key */ -+ err = grub_tpm2key_get_pubkey (tpm2key, &sealed_pub, &sealed_pub_size); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ -+ /* Retrieve the private part of the sealed key */ -+ err = grub_tpm2key_get_privkey (tpm2key, &sealed_priv, &sealed_priv_size); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ -+ /* Unmarshal the sealed key */ -+ grub_tpm2_buffer_init (&buf); -+ if (sealed_pub_size + sealed_priv_size > buf.cap) -+ { -+ err = grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Sealed key larger than %" PRIuGRUB_SIZE " bytes"), -+ buf.cap); -+ goto error; -+ } -+ -+ grub_tpm2_buffer_pack (&buf, sealed_pub, sealed_pub_size); -+ grub_tpm2_buffer_pack (&buf, sealed_priv, sealed_priv_size); -+ -+ buf.offset = 0; -+ -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (&buf, &sk->public); -+ grub_tpm2_mu_TPM2B_Unmarshal (&buf, (TPM2B *)&sk->private); -+ -+ if (buf.error) -+ { -+ err = grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Malformed TPM 2.0 key file")); -+ goto error; -+ } -+ -+ err = GRUB_ERR_NONE; -+ -+error: -+ /* End the parsing */ -+ grub_tpm2key_end_parsing (tpm2key); -+ grub_free (sealed_pub); -+ grub_free (sealed_priv); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_srk_get (const struct grub_tpm2_protector_context *ctx, -+ TPM_HANDLE parent, TPM_HANDLE *srk) -+{ -+ TPM_RC rc; -+ TPM2B_PUBLIC public; -+ TPMS_AUTH_COMMAND authCommand = { 0 }; -+ TPM2B_SENSITIVE_CREATE inSensitive = { 0 }; -+ TPM2B_PUBLIC inPublic = { 0 }; -+ TPM2B_DATA outsideInfo = { 0 }; -+ TPML_PCR_SELECTION creationPcr = { 0 }; -+ TPM2B_PUBLIC outPublic = { 0 }; -+ TPM2B_CREATION_DATA creationData = { 0 }; -+ TPM2B_DIGEST creationHash = { 0 }; -+ TPMT_TK_CREATION creationTicket = { 0 }; -+ TPM2B_NAME srkName = { 0 }; -+ TPM_HANDLE srkHandle; -+ -+ if (ctx->srk != 0) -+ { -+ /* Find SRK */ -+ rc = TPM2_ReadPublic (ctx->srk, NULL, &public); -+ if (rc == TPM_RC_SUCCESS) -+ { -+ *srk = ctx->srk; -+ return GRUB_ERR_NONE; -+ } -+ -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to retrieve SRK (TPM2_ReadPublic: 0x%x)"), -+ rc); -+ } -+ -+ /* Create SRK */ -+ authCommand.sessionHandle = TPM_RS_PW; -+ inPublic.publicArea.type = ctx->asymmetric; -+ inPublic.publicArea.nameAlg = TPM_ALG_SHA256; -+ inPublic.publicArea.objectAttributes.restricted = 1; -+ inPublic.publicArea.objectAttributes.userWithAuth = 1; -+ inPublic.publicArea.objectAttributes.decrypt = 1; -+ inPublic.publicArea.objectAttributes.fixedTPM = 1; -+ inPublic.publicArea.objectAttributes.fixedParent = 1; -+ inPublic.publicArea.objectAttributes.sensitiveDataOrigin = 1; -+ inPublic.publicArea.objectAttributes.noDA = 1; -+ -+ if (ctx->asymmetric == TPM_ALG_RSA) -+ { -+ inPublic.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES; -+ inPublic.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128; -+ inPublic.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB; -+ inPublic.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; -+ inPublic.publicArea.parameters.rsaDetail.keyBits = ctx->rsa_bits; -+ inPublic.publicArea.parameters.rsaDetail.exponent = 0; -+ } -+ else if (ctx->asymmetric == TPM_ALG_ECC) -+ { -+ inPublic.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES; -+ inPublic.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128; -+ inPublic.publicArea.parameters.eccDetail.symmetric.mode.aes = TPM_ALG_CFB; -+ inPublic.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; -+ inPublic.publicArea.parameters.eccDetail.curveID = ctx->ecc_curve; -+ inPublic.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; -+ } -+ else -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Unknown SRK algorithm")); -+ -+ rc = TPM2_CreatePrimary (parent, &authCommand, &inSensitive, &inPublic, -+ &outsideInfo, &creationPcr, &srkHandle, &outPublic, -+ &creationData, &creationHash, &creationTicket, -+ &srkName, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Could not create SRK (TPM2_CreatePrimary: 0x%x)"), -+ rc); -+ -+ *srk = srkHandle; -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_policypcr (TPMI_SH_AUTH_SESSION session, -+ struct grub_tpm2_buffer *cmd_buf) -+{ -+ TPM2B_DIGEST pcr_digest; -+ TPML_PCR_SELECTION pcr_sel; -+ TPM_RC rc; -+ -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (cmd_buf, &pcr_digest); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Unmarshal (cmd_buf, &pcr_sel); -+ if (cmd_buf->error) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to unmarshal CommandPolicy for TPM2_PolicyPCR")); -+ -+ rc = TPM2_PolicyPCR (session, NULL, &pcr_digest, &pcr_sel, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to submit PCR policy (TPM2_PolicyPCR: 0x%x)"), -+ rc); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_enforce_policy (tpm2key_policy_t policy, TPMI_SH_AUTH_SESSION session) -+{ -+ struct grub_tpm2_buffer buf; -+ grub_err_t err; -+ -+ grub_tpm2_buffer_init (&buf); -+ if (policy->cmd_policy_len > buf.cap) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("CommandPolicy larger than TPM buffer")); -+ -+ grub_memcpy (buf.data, policy->cmd_policy, policy->cmd_policy_len); -+ buf.size = policy->cmd_policy_len; -+ -+ switch (policy->cmd_code) -+ { -+ case TPM_CC_PolicyPCR: -+ err = grub_tpm2_protector_policypcr (session, &buf); -+ break; -+ default: -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Unknown TPM Command: 0x%x"), policy->cmd_code); -+ } -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_enforce_policy_seq (tpm2key_policy_t policy_seq, -+ TPMI_SH_AUTH_SESSION session) -+{ -+ tpm2key_policy_t policy; -+ grub_err_t err; -+ -+ FOR_LIST_ELEMENTS (policy, policy_seq) -+ { -+ err = grub_tpm2_protector_enforce_policy (policy, session); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_simple_policy_seq (const struct grub_tpm2_protector_context *ctx, -+ tpm2key_policy_t *policy_seq) -+{ -+ tpm2key_policy_t policy = NULL; -+ struct grub_tpm2_buffer buf; -+ TPML_PCR_SELECTION pcr_sel = { -+ .count = 1, -+ .pcrSelections = { -+ { -+ .hash = ctx->bank, -+ .sizeOfSelect = 3, -+ .pcrSelect = { 0 } -+ }, -+ } -+ }; -+ grub_uint8_t i; -+ grub_err_t err; -+ -+ if (policy_seq == NULL) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ grub_tpm2_buffer_init (&buf); -+ -+ for (i = 0; i < ctx->pcr_count; i++) -+ TPMS_PCR_SELECTION_SelectPCR (&pcr_sel.pcrSelections[0], ctx->pcrs[i]); -+ -+ grub_tpm2_buffer_pack_u16 (&buf, 0); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&buf, &pcr_sel); -+ -+ if (buf.error) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ policy = grub_malloc (sizeof(struct tpm2key_policy)); -+ if (policy == NULL) -+ { -+ err = GRUB_ERR_OUT_OF_MEMORY; -+ goto error; -+ } -+ policy->cmd_code = TPM_CC_PolicyPCR; -+ policy->cmd_policy = grub_malloc (buf.size); -+ if (policy->cmd_policy == NULL) -+ { -+ err = GRUB_ERR_OUT_OF_MEMORY; -+ goto error; -+ } -+ grub_memcpy (policy->cmd_policy, buf.data, buf.size); -+ policy->cmd_policy_len = buf.size; -+ -+ grub_list_push (GRUB_AS_LIST_P (policy_seq), GRUB_AS_LIST (policy)); -+ -+ return GRUB_ERR_NONE; -+ -+error: -+ grub_free (policy); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_unseal (tpm2key_policy_t policy_seq, TPM_HANDLE sealed_handle, -+ grub_uint8_t **key, grub_size_t *key_size) -+{ -+ TPMS_AUTH_COMMAND authCmd = { 0 }; -+ TPM2B_SENSITIVE_DATA data; -+ TPM2B_NONCE nonceCaller = { 0 }; -+ TPMT_SYM_DEF symmetric = { 0 }; -+ TPMI_SH_AUTH_SESSION session; -+ grub_uint8_t *key_out; -+ TPM_RC rc; -+ grub_err_t err; -+ -+ /* Start Auth Session */ -+ nonceCaller.size = TPM_SHA256_DIGEST_SIZE; -+ symmetric.algorithm = TPM_ALG_NULL; -+ rc = TPM2_StartAuthSession (TPM_RH_NULL, TPM_RH_NULL, NULL, &nonceCaller, NULL, -+ TPM_SE_POLICY, &symmetric, TPM_ALG_SHA256, -+ &session, NULL, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to start auth session (TPM2_StartAuthSession: 0x%x)"), -+ rc); -+ -+ /* Enforce the policy command sequence */ -+ err = grub_tpm2_protector_enforce_policy_seq (policy_seq, session); -+ if (err != GRUB_ERR_NONE) -+ goto error; -+ -+ /* Unseal Sealed Key */ -+ authCmd.sessionHandle = session; -+ rc = TPM2_Unseal (sealed_handle, &authCmd, &data, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ err = grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to unseal sealed key (TPM2_Unseal: 0x%x)"), -+ rc); -+ goto error; -+ } -+ -+ /* Epilogue */ -+ key_out = grub_malloc (data.size); -+ if (key_out == NULL) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ N_("No memory left to allocate unlock key buffer")); -+ goto error; -+ } -+ -+ grub_memcpy (key_out, data.buffer, data.size); -+ -+ *key = key_out; -+ *key_size = data.size; -+ -+ err = GRUB_ERR_NONE; -+ -+error: -+ TPM2_FlushContext (session); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_srk_recover (const struct grub_tpm2_protector_context *ctx, -+ grub_uint8_t **key, grub_size_t *key_size) -+{ -+ TPMS_AUTH_COMMAND authCmd = { 0 }; -+ TPM2_SEALED_KEY sealed_key = { 0 }; -+ TPM2B_NAME name = { 0 }; -+ void *file_bytes = NULL; -+ grub_size_t file_size = 0; -+ TPM_HANDLE parent_handle = 0; -+ TPM_HANDLE srk_handle = 0; -+ TPM_HANDLE sealed_handle = 0; -+ tpm2key_policy_t policy_seq = NULL; -+ tpm2key_authpolicy_t authpol = NULL; -+ tpm2key_authpolicy_t authpol_seq = NULL; -+ TPM_RC rc; -+ grub_err_t err; -+ -+ /* -+ * Retrieve sealed key, parent handle, policy sequence, and authpolicy -+ * sequence from the key file -+ */ -+ if (ctx->tpm2key) -+ { -+ err = grub_tpm2_protector_srk_read_file (ctx->tpm2key, &file_bytes, -+ &file_size); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ err = grub_tpm2_protector_srk_unmarshal_tpm2key (file_bytes, -+ file_size, -+ &policy_seq, -+ &authpol_seq, -+ &parent_handle, -+ &sealed_key); -+ if (err != GRUB_ERR_NONE) -+ goto exit1; -+ } -+ else -+ { -+ err = grub_tpm2_protector_srk_read_file (ctx->keyfile, &file_bytes, -+ &file_size); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ parent_handle = TPM_RH_OWNER; -+ err = grub_tpm2_protector_srk_unmarshal_keyfile (file_bytes, -+ file_size, -+ &sealed_key); -+ if (err != GRUB_ERR_NONE) -+ goto exit1; -+ } -+ -+ /* Get the SRK to unseal the sealed key */ -+ err = grub_tpm2_protector_srk_get (ctx, parent_handle, &srk_handle); -+ if (err != GRUB_ERR_NONE) -+ goto exit1; -+ -+ /* Load the sealed key and associate it with the SRK */ -+ authCmd.sessionHandle = TPM_RS_PW; -+ rc = TPM2_Load (srk_handle, &authCmd, &sealed_key.private, &sealed_key.public, -+ &sealed_handle, &name, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ err = grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to load sealed key (TPM2_Load: 0x%x)"), -+ rc); -+ goto exit2; -+ } -+ -+ /* -+ * Set err to an error code to trigger the standalone policy sequence -+ * if there is no authpolicy sequence -+ */ -+ err = GRUB_ERR_READ_ERROR; -+ -+ /* Iterate the authpolicy sequence to find one that unseals the key */ -+ FOR_LIST_ELEMENTS (authpol, authpol_seq) -+ { -+ err = grub_tpm2_protector_unseal (authpol->policy_seq, sealed_handle, -+ key, key_size); -+ if (err == GRUB_ERR_NONE) -+ break; -+ -+ /* -+ * Push the error message into the grub_error stack -+ * Note: The grub_error stack may overflow if there are too many policy -+ * sequences. Anyway, we still can keep the error messages from -+ * the first few policy sequences which are usually most likely to -+ * unseal the key. -+ */ -+ grub_error_push(); -+ } -+ -+ /* Give the standalone policy sequence a try */ -+ if (err != GRUB_ERR_NONE) -+ { -+ /* -+ * Create a basic policy sequence based on the given PCR selection if the -+ * key file doesn't provide one -+ */ -+ if (policy_seq == NULL) -+ { -+ err = grub_tpm2_protector_simple_policy_seq (ctx, &policy_seq); -+ if (err != GRUB_ERR_NONE) -+ goto exit3; -+ } -+ -+ err = grub_tpm2_protector_unseal (policy_seq, sealed_handle, key, key_size); -+ } -+ -+ /* Pop error messages on success */ -+ if (err == GRUB_ERR_NONE) -+ while (grub_error_pop ()); -+ -+exit3: -+ TPM2_FlushContext (sealed_handle); -+ -+exit2: -+ TPM2_FlushContext (srk_handle); -+ -+exit1: -+ grub_tpm2key_free_policy_seq (policy_seq); -+ grub_tpm2key_free_authpolicy_seq (authpol_seq); -+ grub_free (file_bytes); -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_nv_recover (const struct grub_tpm2_protector_context *ctx, -+ grub_uint8_t **key, grub_size_t *key_size) -+{ -+ (void)ctx; -+ (void)key; -+ (void)key_size; -+ -+ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ N_("NV Index mode is not implemented yet")); -+} -+ -+static grub_err_t -+grub_tpm2_protector_recover (const struct grub_tpm2_protector_context *ctx, -+ grub_uint8_t **key, grub_size_t *key_size) -+{ -+ switch (ctx->mode) -+ { -+ case GRUB_TPM2_PROTECTOR_MODE_SRK: -+ return grub_tpm2_protector_srk_recover (ctx, key, key_size); -+ case GRUB_TPM2_PROTECTOR_MODE_NV: -+ return grub_tpm2_protector_nv_recover (ctx, key, key_size); -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+} -+ -+static grub_err_t -+grub_tpm2_protector_recover_key (grub_uint8_t **key, grub_size_t *key_size) -+{ -+ /* Expect a call to tpm2_protector_init before anybody tries to use us */ -+ if (grub_tpm2_protector_ctx.mode == GRUB_TPM2_PROTECTOR_MODE_UNSET) -+ return grub_error (GRUB_ERR_INVALID_COMMAND, -+ N_("Cannot use TPM2 key protector without initializing " -+ "it, call tpm2_protector_init first")); -+ -+ if (key == NULL || key_size == NULL) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ return grub_tpm2_protector_recover (&grub_tpm2_protector_ctx, key, key_size); -+} -+ -+static grub_err_t -+grub_tpm2_protector_check_args (struct grub_tpm2_protector_context *ctx) -+{ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_UNSET) -+ ctx->mode = GRUB_TPM2_PROTECTOR_MODE_SRK; -+ -+ /* Checks for SRK mode */ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_SRK && ctx->keyfile == NULL -+ && ctx->tpm2key == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In SRK mode, a key file must be specified: " -+ "--tpm2key/-T or --keyfile/-k")); -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_SRK && ctx->keyfile -+ && ctx->tpm2key) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In SRK mode, please specify a key file with " -+ "only --tpm2key/-T or --keyfile/-k")); -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_SRK && ctx->nv) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In SRK mode, an NV Index cannot be specified")); -+ -+ /* Checks for NV mode */ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_NV && ctx->nv == 0) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In NV Index mode, an NV Index must be specified: " -+ "--nvindex or -n")); -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_NV && -+ (ctx->tpm2key || ctx->keyfile)) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In NV Index mode, a keyfile cannot be specified")); -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_NV && ctx->srk) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In NV Index mode, an SRK cannot be specified")); -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_NV && ctx->asymmetric) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("In NV Index mode, an asymmetric key type cannot be " -+ "specified")); -+ -+ /* Defaults assignment */ -+ if (ctx->bank == TPM_ALG_ERROR) -+ ctx->bank = TPM_ALG_SHA256; -+ -+ if (ctx->pcr_count == 0) -+ { -+ ctx->pcrs[0] = 7; -+ ctx->pcr_count = 1; -+ } -+ -+ if (ctx->mode == GRUB_TPM2_PROTECTOR_MODE_SRK) -+ { -+ if (!ctx->asymmetric) -+ { -+ ctx->asymmetric = TPM_ALG_RSA; -+ ctx->rsa_bits = 2048; -+ } -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_parse_file (const char *value, const char **file) -+{ -+ if (grub_strlen (value) == 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ *file = grub_strdup (value); -+ if (*file == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ N_("No memory to duplicate file path")); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_parse_mode (const char *value, -+ grub_tpm2_protector_mode_t *mode) -+{ -+ if (grub_strcmp (value, "srk") == 0) -+ *mode = GRUB_TPM2_PROTECTOR_MODE_SRK; -+ else if (grub_strcmp (value, "nv") == 0) -+ *mode = GRUB_TPM2_PROTECTOR_MODE_NV; -+ else -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Value '%s' is not a valid TPM2 key protector mode"), -+ value); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm2_protector_init_cmd_handler (grub_extcmd_context_t ctxt, int argc, -+ char **args __attribute__ ((unused))) -+{ -+ struct grub_arg_list *state = ctxt->state; -+ grub_err_t err; -+ -+ if (argc) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("The TPM2 key protector does not accept any " -+ "non-option arguments (i.e., like -o and/or --option " -+ "only)")); -+ -+ grub_free ((void *) grub_tpm2_protector_ctx.keyfile); -+ grub_memset (&grub_tpm2_protector_ctx, 0, sizeof (grub_tpm2_protector_ctx)); -+ -+ if (state[OPTION_MODE].set) /* mode */ -+ { -+ err = grub_tpm2_protector_parse_mode (state[OPTION_MODE].arg, -+ &grub_tpm2_protector_ctx.mode); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_PCRS].set) /* pcrs */ -+ { -+ err = grub_tpm2_protector_parse_pcrs (state[OPTION_PCRS].arg, -+ grub_tpm2_protector_ctx.pcrs, -+ &grub_tpm2_protector_ctx.pcr_count); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_BANK].set) /* bank */ -+ { -+ err = grub_tpm2_protector_parse_bank (state[OPTION_BANK].arg, -+ &grub_tpm2_protector_ctx.bank); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_TPM2KEY].set) /* tpm2key */ -+ { -+ err = grub_tpm2_protector_parse_file (state[OPTION_TPM2KEY].arg, -+ &grub_tpm2_protector_ctx.tpm2key); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_KEYFILE].set) /* keyfile */ -+ { -+ err = grub_tpm2_protector_parse_file (state[OPTION_KEYFILE].arg, -+ &grub_tpm2_protector_ctx.keyfile); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_SRK].set) /* srk */ -+ { -+ err = grub_tpm2_protector_parse_tpm_handle (state[OPTION_SRK].arg, -+ &grub_tpm2_protector_ctx.srk); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_ASYMMETRIC].set) /* asymmetric */ -+ { -+ err = grub_tpm2_protector_parse_asymmetric (state[OPTION_ASYMMETRIC].arg, -+ &grub_tpm2_protector_ctx.asymmetric, -+ &grub_tpm2_protector_ctx.rsa_bits, -+ &grub_tpm2_protector_ctx.ecc_curve); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ if (state[OPTION_NVINDEX].set) /* nvindex */ -+ { -+ err = grub_tpm2_protector_parse_tpm_handle (state[OPTION_NVINDEX].arg, -+ &grub_tpm2_protector_ctx.nv); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ } -+ -+ err = grub_tpm2_protector_check_args (&grub_tpm2_protector_ctx); -+ -+ /* This command only initializes the protector, so nothing else to do. */ -+ -+ return err; -+} -+ -+static grub_err_t -+grub_tpm2_protector_clear_cmd_handler (grub_extcmd_context_t ctxt __attribute__ ((unused)), -+ int argc, -+ char **args __attribute__ ((unused))) -+{ -+ if (argc) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("tpm2_key_protector_clear accepts no arguments")); -+ -+ grub_free ((void *) grub_tpm2_protector_ctx.keyfile); -+ grub_memset (&grub_tpm2_protector_ctx, 0, sizeof (grub_tpm2_protector_ctx)); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static struct grub_key_protector grub_tpm2_key_protector = -+ { -+ .name = "tpm2", -+ .recover_key = grub_tpm2_protector_recover_key -+ }; -+ -+GRUB_MOD_INIT (tpm2) -+{ -+ grub_tpm2_protector_init_cmd = -+ grub_register_extcmd ("tpm2_key_protector_init", -+ grub_tpm2_protector_init_cmd_handler, 0, -+ N_("[-m mode] " -+ "[-p pcr_list] " -+ "[-b pcr_bank] " -+ "[-T tpm2_key_file_path] " -+ "[-k sealed_key_file_path] " -+ "[-s srk_handle] " -+ "[-a asymmetric_key_type] " -+ "[-n nv_index]"), -+ N_("Initialize the TPM2 key protector."), -+ grub_tpm2_protector_init_cmd_options); -+ grub_tpm2_protector_clear_cmd = -+ grub_register_extcmd ("tpm2_key_protector_clear", -+ grub_tpm2_protector_clear_cmd_handler, 0, NULL, -+ N_("Clear the TPM2 key protector if previously initialized."), -+ NULL); -+ grub_key_protector_register (&grub_tpm2_key_protector); -+} -+ -+GRUB_MOD_FINI (tpm2) -+{ -+ grub_free ((void *) grub_tpm2_protector_ctx.keyfile); -+ grub_memset (&grub_tpm2_protector_ctx, 0, sizeof (grub_tpm2_protector_ctx)); -+ -+ grub_key_protector_unregister (&grub_tpm2_key_protector); -+ grub_unregister_extcmd (grub_tpm2_protector_clear_cmd); -+ grub_unregister_extcmd (grub_tpm2_protector_init_cmd); -+} -diff --git a/grub-core/tpm2/tpm2key.asn b/grub-core/tpm2/tpm2key.asn -new file mode 100644 -index 000000000..e3b6a03e0 ---- /dev/null -+++ b/grub-core/tpm2/tpm2key.asn -@@ -0,0 +1,31 @@ -+-- -+-- TPM 2.0 key file format -+-- To generate tpm2key_asn1_tab.c: asn1Parser tpm2key.asn -+-- -+TPM2KEY {} -+DEFINITIONS IMPLICIT TAGS ::= -+ -+BEGIN -+ -+TPMPolicy ::= SEQUENCE { -+ CommandCode [0] EXPLICIT INTEGER, -+ CommandPolicy [1] EXPLICIT OCTET STRING -+} -+ -+TPMAuthPolicy ::= SEQUENCE { -+ Name [0] EXPLICIT UTF8String OPTIONAL, -+ Policy [1] EXPLICIT SEQUENCE OF TPMPolicy -+} -+ -+TPMKey ::= SEQUENCE { -+ type OBJECT IDENTIFIER, -+ emptyAuth [0] EXPLICIT BOOLEAN OPTIONAL, -+ policy [1] EXPLICIT SEQUENCE OF TPMPolicy OPTIONAL, -+ secret [2] EXPLICIT OCTET STRING OPTIONAL, -+ authPolicy [3] EXPLICIT SEQUENCE OF TPMAuthPolicy OPTIONAL, -+ parent INTEGER, -+ pubkey OCTET STRING, -+ privkey OCTET STRING -+} -+ -+END -diff --git a/grub-core/tpm2/tpm2key.c b/grub-core/tpm2/tpm2key.c -new file mode 100644 -index 000000000..a26c287c9 ---- /dev/null -+++ b/grub-core/tpm2/tpm2key.c -@@ -0,0 +1,447 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2023 SUSE LLC -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+extern asn1_static_node tpm2key_asn1_tab[]; -+const char *sealed_key_oid = "2.23.133.10.1.5"; -+ -+static int -+asn1_allocate_and_read (asn1_node node, const char *name, void **content, grub_size_t *content_size) -+{ -+ grub_uint8_t *tmpstr = NULL; -+ int tmpstr_size = 0; -+ int ret; -+ -+ if (content == NULL) -+ return ASN1_MEM_ERROR; -+ -+ ret = asn1_read_value (node, name, NULL, &tmpstr_size); -+ if (ret != ASN1_MEM_ERROR) -+ return ret; -+ -+ tmpstr = grub_malloc (tmpstr_size); -+ if (tmpstr == NULL) -+ return ASN1_MEM_ERROR; -+ -+ ret = asn1_read_value (node, name, tmpstr, &tmpstr_size); -+ if (ret != ASN1_SUCCESS) -+ return ret; -+ -+ *content = tmpstr; -+ *content_size = tmpstr_size; -+ -+ return ASN1_SUCCESS; -+} -+ -+static int -+asn1_read_uint32 (asn1_node node, const char *name, grub_uint32_t *out) -+{ -+ grub_uint32_t tmp = 0; -+ grub_uint8_t *ptr; -+ void *data = NULL; -+ grub_size_t data_size; -+ int ret; -+ -+ ret = asn1_allocate_and_read (node, name, &data, &data_size); -+ if (ret != ASN1_SUCCESS) -+ return ret; -+ -+ if (data_size > 4) -+ { -+ ret = ASN1_MEM_ERROR; -+ goto error; -+ } -+ -+ /* convert the big-endian integer to host uint32 */ -+ ptr = (grub_uint8_t *)&tmp + (4 - data_size); -+ grub_memcpy (ptr, data, data_size); -+ tmp = grub_be_to_cpu32 (tmp); -+ -+ *out = tmp; -+error: -+ if (data) -+ grub_free (data); -+ return ret; -+} -+ -+grub_err_t -+grub_tpm2key_start_parsing (asn1_node *parsed_tpm2key, void *data, grub_size_t size) -+{ -+ asn1_node tpm2key; -+ asn1_node tpm2key_asn1 = NULL; -+ void *type_oid = NULL; -+ grub_size_t type_oid_size = 0; -+ void *empty_auth = NULL; -+ grub_size_t empty_auth_size = 0; -+ int tmp_size = 0; -+ int ret; -+ grub_err_t err; -+ -+ /* -+ TPMKey ::= SEQUENCE { -+ type OBJECT IDENTIFIER, -+ emptyAuth [0] EXPLICIT BOOLEAN OPTIONAL, -+ policy [1] EXPLICIT SEQUENCE OF TPMPolicy OPTIONAL, -+ secret [2] EXPLICIT OCTET STRING OPTIONAL, -+ authPolicy [3] EXPLICIT SEQUENCE OF TPMAuthPolicy OPTIONAL, -+ parent INTEGER, -+ pubkey OCTET STRING, -+ privkey OCTET STRING -+ } -+ */ -+ ret = asn1_array2tree (tpm2key_asn1_tab, &tpm2key_asn1, NULL); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to parse TPM2KEY ASN.1 array")); -+ -+ ret = asn1_create_element (tpm2key_asn1, "TPM2KEY.TPMKey", &tpm2key); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to create TPM2KEY.TPMKey")); -+ -+ ret = asn1_der_decoding (&tpm2key, data, size, NULL); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to decode TPM2KEY DER")); -+ -+ /* Check if 'type' is Sealed Key or not */ -+ ret = asn1_allocate_and_read (tpm2key, "type", &type_oid, &type_oid_size); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ N_("Not a valid TPM2KEY file")); -+ -+ if (grub_memcmp (sealed_key_oid, type_oid, type_oid_size) != 0) -+ { -+ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ N_("Not a valid TPM2KEY file")); -+ goto error; -+ } -+ -+ /* 'emptyAuth' must be 'TRUE' since we don't support password authorization */ -+ ret = asn1_allocate_and_read (tpm2key, "emptyAuth", &empty_auth, &empty_auth_size); -+ if (ret != ASN1_SUCCESS || grub_strncmp ("TRUE", empty_auth, empty_auth_size) != 0) -+ { -+ err = grub_error (GRUB_ERR_BAD_ARGUMENT, N_("emptyAuth not TRUE")); -+ goto error; -+ } -+ -+ /* 'secret' should not be in a sealed key */ -+ ret = asn1_read_value (tpm2key, "secret", NULL, &tmp_size); -+ if (ret != ASN1_ELEMENT_NOT_FOUND) -+ { -+ err = grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("\"secret\" not allowed for Sealed Key")); -+ goto error; -+ } -+ -+ *parsed_tpm2key = tpm2key; -+ -+ err = GRUB_ERR_NONE; -+ -+error: -+ if (type_oid) -+ grub_free (type_oid); -+ -+ if (empty_auth) -+ grub_free (empty_auth); -+ -+ return err; -+} -+ -+void -+grub_tpm2key_end_parsing (asn1_node tpm2key) -+{ -+ if (tpm2key) -+ asn1_delete_structure (&tpm2key); -+ tpm2key = NULL; -+} -+ -+grub_err_t -+grub_tpm2key_get_parent (asn1_node tpm2key, grub_uint32_t *parent) -+{ -+ int ret; -+ -+ if (parent == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("NULL pointer detected")); -+ -+ if (tpm2key == NULL) -+ return grub_error (GRUB_ERR_READ_ERROR, N_("Invalid parent node")); -+ -+ ret = asn1_read_uint32 (tpm2key, "parent", parent); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_READ_ERROR, N_("Failed to retrieve parent")); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+tpm2key_get_octstring (asn1_node tpm2key, const char *name, void **data, grub_size_t *size) -+{ -+ int ret; -+ -+ if (name == NULL || data == NULL || size == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Invalid parameter(s)")); -+ -+ if (tpm2key == NULL) -+ return grub_error (GRUB_ERR_READ_ERROR, N_("Invalid %s node"), name); -+ -+ ret = asn1_allocate_and_read (tpm2key, name, data, size); -+ if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_READ_ERROR, -+ N_("Failed to retrieve %s"), -+ name); -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tpm2key_get_pubkey (asn1_node tpm2key, void **data, grub_size_t *size) -+{ -+ return tpm2key_get_octstring (tpm2key, "pubkey", data, size); -+} -+ -+grub_err_t -+grub_tpm2key_get_privkey (asn1_node tpm2key, void **data, grub_size_t *size) -+{ -+ return tpm2key_get_octstring (tpm2key, "privkey", data, size); -+} -+ -+/* -+ * The string to fetch 'Policy' from 'authPolicy': -+ * authPolicy.?XX.Policy -+ */ -+#define AUTHPOLICY_POL_MAX_STR "authPolicy.?XX.Policy" -+#define AUTHPOLICY_POL_MAX (sizeof (AUTHPOLICY_POL_MAX_STR)) -+ -+/* -+ * Expected strings for CommandCode and CommandPolicy: -+ * policy.?XX.CommandCode -+ * policy.?XX.CommandPolicy -+ * authPolicy.?XX.Policy.?YY.CommandCode -+ * authPolicy.?XX.Policy.?YY.CommandPolicy -+ */ -+#define CMD_CODE_MAX_STR AUTHPOLICY_POL_MAX_STR".?YY.CommandCode" -+#define CMD_POL_MAX_STR AUTHPOLICY_POL_MAX_STR".?YY.CommandPolicy" -+#define CMD_CODE_MAX (sizeof (CMD_CODE_MAX_STR)) -+#define CMD_POL_MAX (sizeof (CMD_POL_MAX_STR)) -+ -+static int -+tpm2key_get_policy_seq (asn1_node tpm2key, const char *prefix, -+ tpm2key_policy_t *policy_seq) -+{ -+ tpm2key_policy_t tmp_seq = NULL; -+ tpm2key_policy_t policy = NULL; -+ int policy_n; -+ char cmd_code[CMD_CODE_MAX]; -+ char cmd_pol[CMD_POL_MAX]; -+ grub_size_t cmd_policy_len; -+ int i; -+ int ret; -+ -+ ret = asn1_number_of_elements (tpm2key, prefix, &policy_n); -+ if (ret != ASN1_SUCCESS) -+ return ret; -+ -+ /* -+ * Limit the number of policy commands to two digits (99) -+ * Although there is no upper bound for the number of policy commands, -+ * in practice, it takes one or two policy commands to unseal the key, -+ * so the 99 commands limit is more than enough. -+ */ -+ if (policy_n > 100 || policy_n < 1) -+ return ASN1_VALUE_NOT_VALID; -+ -+ /* -+ * Iterate the policy commands backwards since grub_list_push() prepends -+ * the item into the list. -+ */ -+ for (i = policy_n; i >= 1; i--) { -+ policy = grub_zalloc (sizeof (struct tpm2key_policy)); -+ if (policy == NULL) -+ { -+ ret = ASN1_MEM_ALLOC_ERROR; -+ goto error; -+ } -+ grub_snprintf (cmd_code, CMD_CODE_MAX, "%s.?%d.CommandCode", prefix, i); -+ grub_snprintf (cmd_pol, CMD_POL_MAX, "%s.?%d.CommandPolicy", prefix, i); -+ -+ /* CommandCode [0] EXPLICIT INTEGER */ -+ ret = asn1_read_uint32 (tpm2key, cmd_code, &policy->cmd_code); -+ if (ret != ASN1_SUCCESS) -+ return ret; -+ -+ /* CommandPolicy [1] EXPLICIT OCTET STRING */ -+ ret = tpm2key_get_octstring (tpm2key, cmd_pol, &policy->cmd_policy, -+ &cmd_policy_len); -+ if (ret != ASN1_SUCCESS) -+ { -+ goto error; -+ } -+ else if (cmd_policy_len > GRUB_TPM2_BUFFER_CAPACITY) -+ { -+ /* -+ * CommandPolicy is the marshalled parameters for the TPM command so -+ * it should not be larger than the maximum TPM2 buffer. -+ */ -+ ret = ASN1_VALUE_NOT_VALID; -+ goto error; -+ } -+ policy->cmd_policy_len = (grub_uint16_t)cmd_policy_len; -+ -+ /* Prepend the policy command into the sequence */ -+ grub_list_push (GRUB_AS_LIST_P (&tmp_seq), GRUB_AS_LIST (policy)); -+ } -+ -+ *policy_seq = tmp_seq; -+ -+ return ASN1_SUCCESS; -+ -+error: -+ if (policy) -+ { -+ grub_free (policy->cmd_policy); -+ grub_free (policy); -+ } -+ grub_tpm2key_free_policy_seq (tmp_seq); -+ -+ return ret; -+} -+ -+grub_err_t -+grub_tpm2key_get_policy_seq (asn1_node tpm2key, tpm2key_policy_t *policy_seq) -+{ -+ int ret; -+ -+ ret = tpm2key_get_policy_seq (tpm2key, "policy", policy_seq); -+ if (ret == ASN1_ELEMENT_NOT_FOUND) -+ { -+ /* "policy" is optional, so it may not be available */ -+ *policy_seq = NULL; -+ return GRUB_ERR_NONE; -+ } -+ else if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_READ_ERROR, N_("Failed to retrieve policy")); -+ -+ return GRUB_ERR_NONE; -+} -+ -+void -+grub_tpm2key_free_policy_seq (tpm2key_policy_t policy_seq) -+{ -+ tpm2key_policy_t policy; -+ tpm2key_policy_t next; -+ -+ if (policy_seq == NULL) -+ return; -+ -+ FOR_LIST_ELEMENTS_SAFE (policy, next, policy_seq) -+ { -+ grub_free (policy->cmd_policy); -+ grub_free (policy); -+ } -+} -+ -+grub_err_t -+grub_tpm2key_get_authpolicy_seq (asn1_node tpm2key, tpm2key_authpolicy_t *authpol_seq) -+{ -+ tpm2key_authpolicy_t tmp_seq = NULL; -+ tpm2key_authpolicy_t authpol = NULL; -+ int authpol_n; -+ char authpol_pol[AUTHPOLICY_POL_MAX]; -+ int i; -+ int ret; -+ grub_err_t err; -+ -+ ret = asn1_number_of_elements (tpm2key, "authPolicy", &authpol_n); -+ if (ret == ASN1_ELEMENT_NOT_FOUND) -+ { -+ /* "authPolicy" is optional, so it may not be available */ -+ *authpol_seq = NULL; -+ return GRUB_ERR_NONE; -+ } -+ else if (ret != ASN1_SUCCESS) -+ return grub_error (GRUB_ERR_READ_ERROR, N_("Failed to retrieve authPolicy")); -+ -+ /* Limit the number of authPolicy elements to two digits (99) */ -+ if (authpol_n > 100 || authpol_n < 1) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("Invalid number of autoPolicy elements")); -+ -+ /* -+ * Iterate the authPolicy elements backwards since grub_list_push() prepends -+ * the item into the list. -+ */ -+ for (i = authpol_n; i >= 1; i--) { -+ authpol = grub_zalloc (sizeof (struct tpm2key_authpolicy)); -+ if (authpol == NULL) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ N_("Failed to allocate memory for authPolicy")); -+ goto error; -+ } -+ grub_snprintf (authpol_pol, AUTHPOLICY_POL_MAX, "authPolicy.?%d.Policy", i); -+ -+ ret = tpm2key_get_policy_seq (tpm2key, authpol_pol, &authpol->policy_seq); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = grub_error (GRUB_ERR_READ_ERROR, -+ N_("Failed to retrieve policy from authPolicy")); -+ goto error; -+ } -+ -+ /* Prepend the authPolicy element into the sequence */ -+ grub_list_push (GRUB_AS_LIST_P (&tmp_seq), GRUB_AS_LIST (authpol)); -+ } -+ -+ *authpol_seq = tmp_seq; -+ -+ return GRUB_ERR_NONE; -+ -+error: -+ if (authpol) -+ { -+ grub_tpm2key_free_policy_seq (authpol->policy_seq); -+ grub_free (authpol); -+ } -+ -+ grub_tpm2key_free_authpolicy_seq (tmp_seq); -+ -+ return err; -+} -+ -+void -+grub_tpm2key_free_authpolicy_seq (tpm2key_authpolicy_t authpol_seq) -+{ -+ tpm2key_authpolicy_t authpol; -+ tpm2key_authpolicy_t next; -+ -+ if (authpol_seq == NULL) -+ return; -+ -+ FOR_LIST_ELEMENTS_SAFE (authpol, next, authpol_seq) -+ { -+ grub_tpm2key_free_policy_seq (authpol->policy_seq); -+ grub_free (authpol); -+ } -+} -diff --git a/grub-core/tpm2/tpm2key_asn1_tab.c b/grub-core/tpm2/tpm2key_asn1_tab.c -new file mode 100644 -index 000000000..551fc46ec ---- /dev/null -+++ b/grub-core/tpm2/tpm2key_asn1_tab.c -@@ -0,0 +1,41 @@ -+/* -+ * This file is generated by 'asn1Parser tpm2key.asn' and the '#include' -+ * headers are replaced with the ones in grub2. -+ * - 'grub/mm.h' for the definition of 'NULL' -+ * - 'grub/libtasn1.h' for the definition of 'asn1_static_node' -+ */ -+ -+#include -+#include -+ -+const asn1_static_node tpm2key_asn1_tab[] = { -+ { "TPM2KEY", 536875024, NULL }, -+ { NULL, 1073741836, NULL }, -+ { "TPMPolicy", 1610612741, NULL }, -+ { "CommandCode", 1610620931, NULL }, -+ { NULL, 2056, "0"}, -+ { "CommandPolicy", 536879111, NULL }, -+ { NULL, 2056, "1"}, -+ { "TPMAuthPolicy", 1610612741, NULL }, -+ { "Name", 1610637346, NULL }, -+ { NULL, 2056, "0"}, -+ { "Policy", 536879115, NULL }, -+ { NULL, 1073743880, "1"}, -+ { NULL, 2, "TPMPolicy"}, -+ { "TPMKey", 536870917, NULL }, -+ { "type", 1073741836, NULL }, -+ { "emptyAuth", 1610637316, NULL }, -+ { NULL, 2056, "0"}, -+ { "policy", 1610637323, NULL }, -+ { NULL, 1073743880, "1"}, -+ { NULL, 2, "TPMPolicy"}, -+ { "secret", 1610637319, NULL }, -+ { NULL, 2056, "2"}, -+ { "authPolicy", 1610637323, NULL }, -+ { NULL, 1073743880, "3"}, -+ { NULL, 2, "TPMAuthPolicy"}, -+ { "parent", 1073741827, NULL }, -+ { "pubkey", 1073741831, NULL }, -+ { "privkey", 7, NULL }, -+ { NULL, 0, NULL } -+}; -diff --git a/include/grub/tpm2/internal/args.h b/include/grub/tpm2/internal/args.h -new file mode 100644 -index 000000000..58d13e031 ---- /dev/null -+++ b/include/grub/tpm2/internal/args.h -@@ -0,0 +1,41 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_INTERNAL_ARGS_HEADER -+#define GRUB_TPM2_INTERNAL_ARGS_HEADER 1 -+ -+#include -+#include -+ -+grub_err_t -+grub_tpm2_protector_parse_pcrs (char *value, grub_uint8_t *pcrs, -+ grub_uint8_t *pcr_count); -+ -+grub_err_t -+grub_tpm2_protector_parse_asymmetric (const char *value, -+ TPM_ALG_ID *asymmetric, -+ TPM_KEY_BITS *rsa_bits, -+ TPM_ECC_CURVE *ecc_curve); -+ -+grub_err_t -+grub_tpm2_protector_parse_bank (const char *value, TPM_ALG_ID *bank); -+ -+grub_err_t -+grub_tpm2_protector_parse_tpm_handle (const char *value, TPM_HANDLE *handle); -+ -+#endif /* ! GRUB_TPM2_INTERNAL_ARGS_HEADER */ -diff --git a/include/grub/tpm2/tpm2key.h b/include/grub/tpm2/tpm2key.h -new file mode 100644 -index 000000000..df46203e3 ---- /dev/null -+++ b/include/grub/tpm2/tpm2key.h -@@ -0,0 +1,83 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2023 SUSE LLC -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_TPM2_TPM2KEY_HEADER -+#define GRUB_TPM2_TPM2KEY_HEADER 1 -+ -+#include -+#include -+ -+/* -+ * TPMPolicy ::= SEQUENCE { -+ * CommandCode [0] EXPLICIT INTEGER, -+ * CommandPolicy [1] EXPLICIT OCTET STRING -+ * } -+ */ -+struct tpm2key_policy { -+ struct tpm2key_policy *next; -+ struct tpm2key_policy **prev; -+ grub_uint32_t cmd_code; -+ void *cmd_policy; -+ grub_uint16_t cmd_policy_len; -+}; -+typedef struct tpm2key_policy *tpm2key_policy_t; -+ -+/* -+ * TPMAuthPolicy ::= SEQUENCE { -+ * Name [0] EXPLICIT UTF8String OPTIONAL, -+ * Policy [1] EXPLICIT SEQUENCE OF TPMPolicy -+ * } -+ * -+ * Name is not a necessary part to unseal the key. Ignore it. -+ */ -+struct tpm2key_authpolicy { -+ struct tpm2key_authpolicy *next; -+ struct tpm2key_authpolicy **prev; -+ /* char *name; */ -+ tpm2key_policy_t policy_seq; -+}; -+typedef struct tpm2key_authpolicy *tpm2key_authpolicy_t; -+ -+grub_err_t -+grub_tpm2key_start_parsing (asn1_node *parsed_tpm2key, void *data, grub_size_t size); -+ -+void -+grub_tpm2key_end_parsing (asn1_node tpm2key); -+ -+grub_err_t -+grub_tpm2key_get_parent (asn1_node tpm2key, grub_uint32_t *parent); -+ -+grub_err_t -+grub_tpm2key_get_pubkey (asn1_node tpm2key, void **data, grub_size_t *size); -+ -+grub_err_t -+grub_tpm2key_get_privkey (asn1_node tpm2key, void **data, grub_size_t *size); -+ -+grub_err_t -+grub_tpm2key_get_policy_seq (asn1_node tpm2key, tpm2key_policy_t *policy_seq); -+ -+void -+grub_tpm2key_free_policy_seq (tpm2key_policy_t policy_seq); -+ -+grub_err_t -+grub_tpm2key_get_authpolicy_seq (asn1_node tpm2key, tpm2key_authpolicy_t *authpol_seq); -+ -+void -+grub_tpm2key_free_authpolicy_seq (tpm2key_authpolicy_t authpol_seq); -+ -+#endif /* GRUB_TPM2_TPM2KEY_HEADER */ --- -2.41.0 - diff --git a/0257-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch b/0131-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch similarity index 97% rename from 0257-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch rename to 0131-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch index 6780196..65646f7 100644 --- a/0257-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch +++ b/0131-Add-at_keyboard_fallback_set-var-to-force-the-set-ma.patch @@ -1,8 +1,7 @@ -From 3cb50f6b87f94243e97bbdac9c1cafece8136953 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Fri, 18 Dec 2020 15:39:26 +0100 -Subject: [PATCH 257/272] Add 'at_keyboard_fallback_set' var to force the set - manually +Subject: [PATCH] Add 'at_keyboard_fallback_set' var to force the set manually MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -32,11 +31,11 @@ solution": Signed-off-by: Renaud Métrich Signed-off-by: Robbie Harwood --- - grub-core/term/at_keyboard.c | 121 +++++++++++++++++++++++++++-------- + grub-core/term/at_keyboard.c | 121 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 96 insertions(+), 25 deletions(-) diff --git a/grub-core/term/at_keyboard.c b/grub-core/term/at_keyboard.c -index 2d9ab65ae..378deb321 100644 +index 2d9ab65aee0..378deb321d9 100644 --- a/grub-core/term/at_keyboard.c +++ b/grub-core/term/at_keyboard.c @@ -31,6 +31,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); @@ -244,6 +243,3 @@ index 2d9ab65ae..378deb321 100644 static struct grub_term_input grub_at_keyboard_term = { .name = "at_keyboard", --- -2.41.0 - diff --git a/0131-cryptodisk-Support-key-protectors.patch b/0131-cryptodisk-Support-key-protectors.patch deleted file mode 100644 index 202ea35..0000000 --- a/0131-cryptodisk-Support-key-protectors.patch +++ /dev/null @@ -1,352 +0,0 @@ -From 324a61ca219b6c89ef78173106aff9dcc8ab0185 Mon Sep 17 00:00:00 2001 -From: Hernan Gatta -Date: Tue, 1 Feb 2022 05:02:56 -0800 -Subject: [PATCH 131/272] cryptodisk: Support key protectors - -Add a new parameter to cryptomount to support the key protectors framework: -k. -The parameter is used to automatically retrieve a key from specified key -protectors. The parameter may be repeated to specify any number of key -protectors. These are tried in order until one provides a usable key for any -given disk. - -Signed-off-by: ---- - Makefile.util.def | 1 + - grub-core/disk/cryptodisk.c | 172 +++++++++++++++++++++++++++++------- - include/grub/cryptodisk.h | 16 ++++ - 3 files changed, 158 insertions(+), 31 deletions(-) - -diff --git a/Makefile.util.def b/Makefile.util.def -index 09f93e2f6..f9ca7910a 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -35,6 +35,7 @@ library = { - common = grub-core/kern/list.c; - common = grub-core/kern/misc.c; - common = grub-core/kern/partition.c; -+ common = grub-core/kern/protectors.c; - common = grub-core/lib/crypto.c; - common = grub-core/lib/json/json.c; - common = grub-core/disk/luks.c; -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 2246af51b..dba5efa61 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #ifdef GRUB_UTIL - #include -@@ -44,7 +45,8 @@ enum - OPTION_KEYFILE, - OPTION_KEYFILE_OFFSET, - OPTION_KEYFILE_SIZE, -- OPTION_HEADER -+ OPTION_HEADER, -+ OPTION_PROTECTOR - }; - - static const struct grub_arg_option options[] = -@@ -58,6 +60,8 @@ static const struct grub_arg_option options[] = - {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT}, - {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT}, - {"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING}, -+ {"protector", 'P', GRUB_ARG_OPTION_REPEATABLE, -+ N_("Unlock volume(s) using key protector(s)."), 0, ARG_TYPE_STRING}, - {0, 0, 0, 0, 0, 0} - }; - -@@ -1061,6 +1065,7 @@ grub_cryptodisk_scan_device_real (const char *name, - grub_err_t ret = GRUB_ERR_NONE; - grub_cryptodisk_t dev; - grub_cryptodisk_dev_t cr; -+ int i; - struct cryptodisk_read_hook_ctx read_hook_data = {0}; - int askpass = 0; - char *part = NULL; -@@ -1113,41 +1118,112 @@ grub_cryptodisk_scan_device_real (const char *name, - goto error_no_close; - if (!dev) - continue; -+ break; -+ } - -- if (!cargs->key_len) -- { -- /* Get the passphrase from the user, if no key data. */ -- askpass = 1; -- part = grub_partition_get_name (source->partition); -- grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, -- source->partition != NULL ? "," : "", -- part != NULL ? part : N_("UNKNOWN"), -- dev->uuid); -- grub_free (part); -- -- cargs->key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); -- if (cargs->key_data == NULL) -- goto error_no_close; -- -- if (!grub_password_get ((char *) cargs->key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) -- { -- grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); -- goto error; -- } -- cargs->key_len = grub_strlen ((char *) cargs->key_data); -- } -+ if (dev == NULL) -+ { -+ grub_error (GRUB_ERR_BAD_MODULE, -+ "no cryptodisk module can handle this device"); -+ goto error_no_close; -+ } - -- ret = cr->recover_key (source, dev, cargs); -- if (ret != GRUB_ERR_NONE) -- goto error; -+ if (cargs->protectors) -+ { -+ for (i = 0; cargs->protectors[i]; i++) -+ { -+ if (cargs->key_cache[i].invalid) -+ continue; -+ -+ if (cargs->key_cache[i].key == NULL) -+ { -+ ret = grub_key_protector_recover_key (cargs->protectors[i], -+ &cargs->key_cache[i].key, -+ &cargs->key_cache[i].key_len); -+ if (ret != GRUB_ERR_NONE) -+ { -+ if (grub_errno) -+ { -+ grub_print_error (); -+ grub_errno = GRUB_ERR_NONE; -+ } -+ -+ grub_dprintf ("cryptodisk", -+ "failed to recover a key from key protector " -+ "%s, will not try it again for any other " -+ "disks, if any, during this invocation of " -+ "cryptomount\n", -+ cargs->protectors[i]); -+ -+ cargs->key_cache[i].invalid = 1; -+ continue; -+ } -+ } -+ -+ cargs->key_data = cargs->key_cache[i].key; -+ cargs->key_len = cargs->key_cache[i].key_len; - -- ret = grub_cryptodisk_insert (dev, name, source); -- if (ret != GRUB_ERR_NONE) -+ ret = cr->recover_key (source, dev, cargs); -+ if (ret != GRUB_ERR_NONE) -+ { -+ part = grub_partition_get_name (source->partition); -+ grub_dprintf ("cryptodisk", -+ "recovered a key from key protector %s but it " -+ "failed to unlock %s%s%s (%s)\n", -+ cargs->protectors[i], source->name, -+ source->partition != NULL ? "," : "", -+ part != NULL ? part : N_("UNKNOWN"), dev->uuid); -+ grub_free (part); -+ continue; -+ } -+ else -+ { -+ ret = grub_cryptodisk_insert (dev, name, source); -+ if (ret != GRUB_ERR_NONE) -+ goto error; -+ goto cleanup; -+ } -+ } -+ -+ part = grub_partition_get_name (source->partition); -+ grub_error (GRUB_ERR_ACCESS_DENIED, -+ N_("no key protector provided a usable key for %s%s%s (%s)"), -+ source->name, source->partition != NULL ? "," : "", -+ part != NULL ? part : N_("UNKNOWN"), dev->uuid); -+ grub_free (part); - goto error; -+ } -+ -+ if (!cargs->key_len) -+ { -+ /* Get the passphrase from the user, if no key data. */ -+ askpass = 1; -+ part = grub_partition_get_name (source->partition); -+ grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, -+ source->partition != NULL ? "," : "", -+ part != NULL ? part : N_("UNKNOWN"), dev->uuid); -+ grub_free (part); -+ -+ cargs->key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); -+ if (cargs->key_data == NULL) -+ goto error; -+ -+ if (!grub_password_get ((char *) cargs->key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); -+ goto error; -+ } -+ cargs->key_len = grub_strlen ((char *) cargs->key_data); -+ } -+ -+ ret = cr->recover_key (source, dev, cargs); -+ if (ret != GRUB_ERR_NONE) -+ goto error; -+ -+ ret = grub_cryptodisk_insert (dev, name, source); -+ if (ret != GRUB_ERR_NONE) -+ goto error; - -- goto cleanup; -- } -- grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); - goto cleanup; - - error: -@@ -1259,6 +1335,20 @@ grub_cryptodisk_scan_device (const char *name, - return ret; - } - -+static void -+grub_cryptodisk_clear_key_cache (struct grub_cryptomount_args *cargs) -+{ -+ int i; -+ -+ if (cargs->key_cache == NULL || cargs->protectors == NULL) -+ return; -+ -+ for (i = 0; cargs->protectors[i]; i++) -+ grub_free (cargs->key_cache[i].key); -+ -+ grub_free (cargs->key_cache); -+} -+ - static grub_err_t - grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - { -@@ -1271,6 +1361,10 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - if (grub_cryptodisk_list == NULL) - return grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk modules loaded"); - -+ if (state[OPTION_PASSWORD].set && state[OPTION_PROTECTOR].set) /* password and key protector */ -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ "a password and a key protector cannot both be set"); -+ - if (state[OPTION_PASSWORD].set) /* password */ - { - cargs.key_data = (grub_uint8_t *) state[OPTION_PASSWORD].arg; -@@ -1363,6 +1457,15 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - return grub_errno; - } - -+ if (state[OPTION_PROTECTOR].set) /* key protector(s) */ -+ { -+ cargs.key_cache = grub_zalloc (state[OPTION_PROTECTOR].set * sizeof (*cargs.key_cache)); -+ if (cargs.key_cache == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "no memory for key protector key cache"); -+ cargs.protectors = state[OPTION_PROTECTOR].args; -+ } -+ - if (state[OPTION_UUID].set) /* uuid */ - { - int found_uuid; -@@ -1371,6 +1474,7 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - dev = grub_cryptodisk_get_by_uuid (args[0]); - if (dev) - { -+ grub_cryptodisk_clear_key_cache (&cargs); - grub_dprintf ("cryptodisk", - "already mounted as crypto%lu\n", dev->id); - return GRUB_ERR_NONE; -@@ -1379,6 +1483,7 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - cargs.check_boot = state[OPTION_BOOT].set; - cargs.search_uuid = args[0]; - found_uuid = grub_device_iterate (&grub_cryptodisk_scan_device, &cargs); -+ grub_cryptodisk_clear_key_cache (&cargs); - - if (found_uuid) - return GRUB_ERR_NONE; -@@ -1398,6 +1503,7 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - { - cargs.check_boot = state[OPTION_BOOT].set; - grub_device_iterate (&grub_cryptodisk_scan_device, &cargs); -+ grub_cryptodisk_clear_key_cache (&cargs); - return GRUB_ERR_NONE; - } - else -@@ -1421,6 +1527,7 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - disk = grub_disk_open (diskname); - if (!disk) - { -+ grub_cryptodisk_clear_key_cache (&cargs); - if (disklast) - *disklast = ')'; - return grub_errno; -@@ -1431,12 +1538,14 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) - { - grub_dprintf ("cryptodisk", "already mounted as crypto%lu\n", dev->id); - grub_disk_close (disk); -+ grub_cryptodisk_clear_key_cache (&cargs); - if (disklast) - *disklast = ')'; - return GRUB_ERR_NONE; - } - - dev = grub_cryptodisk_scan_device_real (diskname, disk, &cargs); -+ grub_cryptodisk_clear_key_cache (&cargs); - - grub_disk_close (disk); - if (disklast) -@@ -1590,6 +1699,7 @@ GRUB_MOD_INIT (cryptodisk) - cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0, - N_("[ [-p password] | [-k keyfile" - " [-O keyoffset] [-S keysize] ] ] [-H file]" -+ " [-P protector [-P protector ...]]" - " "), - N_("Mount a crypto device."), options); - grub_procfs_register ("luks_script", &luks_script); -diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h -index d94df68b6..0b41e249e 100644 ---- a/include/grub/cryptodisk.h -+++ b/include/grub/cryptodisk.h -@@ -70,6 +70,18 @@ typedef gcry_err_code_t - (*grub_cryptodisk_rekey_func_t) (struct grub_cryptodisk *dev, - grub_uint64_t zoneno); - -+struct grub_cryptomount_cached_key -+{ -+ grub_uint8_t *key; -+ grub_size_t key_len; -+ -+ /* -+ * The key protector associated with this cache entry failed, so avoid it -+ * even if the cached entry (an instance of this structure) is empty. -+ */ -+ int invalid; -+}; -+ - struct grub_cryptomount_args - { - /* scan: Flag to indicate that only bootable volumes should be decrypted */ -@@ -81,6 +93,10 @@ struct grub_cryptomount_args - /* recover_key: Length of key_data */ - grub_size_t key_len; - grub_file_t hdr_file; -+ /* recover_key: Names of the key protectors to use (NULL-terminated) */ -+ char **protectors; -+ /* recover_key: Key cache to avoid invoking the same key protector twice */ -+ struct grub_cryptomount_cached_key *key_cache; - }; - typedef struct grub_cryptomount_args *grub_cryptomount_args_t; - --- -2.41.0 - diff --git a/0097-Add-suport-for-signing-grub-with-an-appended-signatu.patch b/0132-Add-suport-for-signing-grub-with-an-appended-signatu.patch similarity index 91% rename from 0097-Add-suport-for-signing-grub-with-an-appended-signatu.patch rename to 0132-Add-suport-for-signing-grub-with-an-appended-signatu.patch index ddd3ffc..c9a45b1 100644 --- a/0097-Add-suport-for-signing-grub-with-an-appended-signatu.patch +++ b/0132-Add-suport-for-signing-grub-with-an-appended-signatu.patch @@ -1,8 +1,7 @@ -From c4441c5b8d4dcf68b58632cf12ac3db3c3d227b8 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Rashmica Gupta Date: Thu, 11 Jun 2020 11:26:23 +1000 -Subject: [PATCH 097/272] Add suport for signing grub with an appended - signature +Subject: [PATCH] Add suport for signing grub with an appended signature Add infrastructure to allow firmware to verify the integrity of grub by use of a Linux-kernel-module-style appended signature. We initially @@ -35,68 +34,16 @@ under this scheme. Signed-off-by: Daniel Axtens Signed-off-by: Rashmica Gupta --- + util/grub-install-common.c | 14 ++++++++++++-- + util/grub-mkimage.c | 15 +++++++++++++-- + util/grub-mkimagexx.c | 39 ++++++++++++++++++++++++++++++++++++++- + util/mkimage.c | 13 +++++++------ include/grub/util/install.h | 8 ++++++-- include/grub/util/mkimage.h | 4 ++-- - util/grub-install-common.c | 14 +++++++++++-- - util/grub-mkimage.c | 11 +++++++++++ - util/grub-mkimagexx.c | 39 ++++++++++++++++++++++++++++++++++++- - util/mkimage.c | 13 +++++++------ - 6 files changed, 76 insertions(+), 13 deletions(-) + 6 files changed, 78 insertions(+), 15 deletions(-) -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index f026f69c9..4267da52a 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -67,6 +67,9 @@ - N_("SBAT metadata"), 0 }, \ - { "disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, \ - N_("disable shim_lock verifier"), 0 }, \ -+ { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ -+ "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ -+ 1}, \ - { "verbose", 'v', 0, 0, \ - N_("print verbose messages."), 1 } - -@@ -129,7 +132,8 @@ enum grub_install_options { - GRUB_INSTALL_OPTIONS_INSTALL_CORE_COMPRESS, - GRUB_INSTALL_OPTIONS_DTB, - GRUB_INSTALL_OPTIONS_SBAT, -- GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK -+ GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, -+ GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE - }; - - extern char *grub_install_source_directory; -@@ -189,7 +193,7 @@ grub_install_generate_image (const char *dir, const char *prefix, - size_t npubkeys, - char *config_path, - const struct grub_install_image_target_desc *image_target, -- int note, -+ int note, size_t appsig_size, - grub_compression_t comp, const char *dtb_file, - const char *sbat_path, const int disable_shim_lock); - -diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h -index 3819a6744..6f1da89b9 100644 ---- a/include/grub/util/mkimage.h -+++ b/include/grub/util/mkimage.h -@@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, - const struct grub_install_image_target_desc *image_target); - void - grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, -- int note, char **core_img, size_t *core_size, -+ int note, size_t appsig_size, char **core_img, size_t *core_size, - Elf32_Addr target_addr, - struct grub_mkimage_layout *layout); - void - grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, -- int note, char **core_img, size_t *core_size, -+ int note, size_t appsig_size, char **core_img, size_t *core_size, - Elf64_Addr target_addr, - struct grub_mkimage_layout *layout); - diff --git a/util/grub-install-common.c b/util/grub-install-common.c -index ce854d86f..942dafe1a 100644 +index ce854d86f86..1fa0f7f6f00 100644 --- a/util/grub-install-common.c +++ b/util/grub-install-common.c @@ -466,10 +466,12 @@ static size_t npubkeys; @@ -131,7 +78,7 @@ index ce854d86f..942dafe1a 100644 grub_util_info ("grub-mkimage --directory '%s' --prefix '%s' --output '%s'" - " --format '%s' --compression '%s'%s%s%s\n", + " --format '%s' --compression '%s'" -+ " --appended-signature-size %zu%s%s%s\n", ++ " --appended-signture-size %zu %s%s%s\n", dir, prefix, outname, mkimage_target, compnames[compression], + appsig_size, @@ -148,7 +95,7 @@ index ce854d86f..942dafe1a 100644 while (dc--) grub_install_pop_module (); diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c -index c0d559937..d01eaeb84 100644 +index c0d55993702..8a53310548b 100644 --- a/util/grub-mkimage.c +++ b/util/grub-mkimage.c @@ -84,6 +84,7 @@ static struct argp_option options[] = { @@ -189,16 +136,20 @@ index c0d559937..d01eaeb84 100644 case 'm': if (arguments->memdisk) free (arguments->memdisk); -@@ -324,6 +334,7 @@ main (int argc, char *argv[]) +@@ -324,8 +334,9 @@ main (int argc, char *argv[]) arguments.memdisk, arguments.pubkeys, arguments.npubkeys, arguments.config, arguments.image_target, arguments.note, -+ arguments.appsig_size, - arguments.comp, arguments.dtb, - arguments.sbat, arguments.disable_shim_lock); +- arguments.comp, arguments.dtb, +- arguments.sbat, arguments.disable_shim_lock); ++ arguments.appsig_size, arguments.comp, ++ arguments.dtb, arguments.sbat, ++ arguments.disable_shim_lock); + if (grub_util_file_sync (fp) < 0) + grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout", diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c -index e50b29533..9488f0525 100644 +index e50b29533c6..9488f052510 100644 --- a/util/grub-mkimagexx.c +++ b/util/grub-mkimagexx.c @@ -85,6 +85,15 @@ struct grub_ieee1275_note @@ -269,7 +220,7 @@ index e50b29533..9488f0525 100644 char *str_start = (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr) + shnum * sizeof (*shdr)); diff --git a/util/mkimage.c b/util/mkimage.c -index 4237383ac..ff0c48901 100644 +index 4237383acaf..d33838bec6b 100644 --- a/util/mkimage.c +++ b/util/mkimage.c @@ -885,8 +885,9 @@ grub_install_generate_image (const char *dir, const char *prefix, @@ -279,7 +230,7 @@ index 4237383ac..ff0c48901 100644 - int note, grub_compression_t comp, const char *dtb_path, - const char *sbat_path, int disable_shim_lock) + int note, size_t appsig_size, grub_compression_t comp, -+ const char *dtb_path, const char *sbat_path, ++ const char *dtb_path, const char *sbat_path, + int disable_shim_lock) { char *kernel_img, *core_img; @@ -300,6 +251,55 @@ index 4237383ac..ff0c48901 100644 } break; } --- -2.41.0 - +diff --git a/include/grub/util/install.h b/include/grub/util/install.h +index 35cf17a8d93..2720428602b 100644 +--- a/include/grub/util/install.h ++++ b/include/grub/util/install.h +@@ -67,6 +67,9 @@ + N_("SBAT metadata"), 0 }, \ + { "disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, \ + N_("disable shim_lock verifier"), 0 }, \ ++ { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ ++ "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ ++ 1}, \ + { "verbose", 'v', 0, 0, \ + N_("print verbose messages."), 1 } + +@@ -129,7 +132,8 @@ enum grub_install_options { + GRUB_INSTALL_OPTIONS_INSTALL_CORE_COMPRESS, + GRUB_INSTALL_OPTIONS_DTB, + GRUB_INSTALL_OPTIONS_SBAT, +- GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK ++ GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, ++ GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE + }; + + extern char *grub_install_source_directory; +@@ -189,7 +193,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + size_t npubkeys, + char *config_path, + const struct grub_install_image_target_desc *image_target, +- int note, ++ int note, size_t appsig_size, + grub_compression_t comp, const char *dtb_file, + const char *sbat_path, const int disable_shim_lock); + +diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h +index 3819a67441c..6f1da89b9b6 100644 +--- a/include/grub/util/mkimage.h ++++ b/include/grub/util/mkimage.h +@@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, + const struct grub_install_image_target_desc *image_target); + void + grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, +- int note, char **core_img, size_t *core_size, ++ int note, size_t appsig_size, char **core_img, size_t *core_size, + Elf32_Addr target_addr, + struct grub_mkimage_layout *layout); + void + grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, +- int note, char **core_img, size_t *core_size, ++ int note, size_t appsig_size, char **core_img, size_t *core_size, + Elf64_Addr target_addr, + struct grub_mkimage_layout *layout); + diff --git a/0132-util-grub-protect-Add-new-tool.patch b/0132-util-grub-protect-Add-new-tool.patch deleted file mode 100644 index 1a56ed3..0000000 --- a/0132-util-grub-protect-Add-new-tool.patch +++ /dev/null @@ -1,1620 +0,0 @@ -From 46000b878941516a1c0ca89ed6f015ef60741efa Mon Sep 17 00:00:00 2001 -From: Hernan Gatta -Date: Tue, 1 Feb 2022 05:02:57 -0800 -Subject: [PATCH 132/272] util/grub-protect: Add new tool - -To utilize the key protectors framework, there must be a way to protect -full-disk encryption keys in the first place. The grub-protect tool -includes support for the TPM2 key protector but other protectors that -require setup ahead of time can be supported in the future. - -For the TPM2 key protector, the intended flow is for a user to have a -LUKS 1 or LUKS 2-protected fully-encrypted disk. The user then creates a -new LUKS key file, say by reading /dev/urandom into a file, and creates -a new LUKS key slot for this key. Then, the user invokes the grub-protect -tool to seal this key file to a set of PCRs using the system's TPM 2.0. -The resulting sealed key file is stored in an unencrypted partition such -as the EFI System Partition (ESP) so that GRUB may read it. The user also -has to ensure the cryptomount command is included in GRUB's boot script -and that it carries the requisite key protector (-P) parameter. - -Sample usage: - -$ dd if=/dev/urandom of=luks-key bs=1 count=32 -$ sudo cryptsetup luksAddKey /dev/sdb1 luks-key --pbkdf=pbkdf2 --hash=sha512 - -To seal the key with TPM 2.0 Key File (recommended): - -$ sudo grub-protect --action=add \ - --protector=tpm2 \ - --tpm2key \ - --tpm2-keyfile=luks-key \ - --tpm2-outfile=/boot/efi/boot/grub2/sealed.tpm - -Or, to seal the key with the raw sealed key: - -$ sudo grub-protect --action=add \ - --protector=tpm2 \ - --tpm2-keyfile=luks-key \ - --tpm2-outfile=/boot/efi/boot/grub2/sealed.key - -Then, in the boot script, for TPM 2.0 Key File: - -tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm -cryptomount -u -P tpm2 - -Or, for the raw sealed key: - -tpm2_key_protector_init --keyfile=(hd0,gpt1)/boot/grub2/sealed.key -cryptomount -u -P tpm2 - -Signed-off-by: Hernan Gatta -Signed-off-by: Gary Lin ---- - Makefile.util.def | 22 + - configure.ac | 9 + - util/grub-protect.c | 1492 +++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 1523 insertions(+) - create mode 100644 util/grub-protect.c - -diff --git a/Makefile.util.def b/Makefile.util.def -index f9ca7910a..82046d34d 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -207,6 +207,28 @@ program = { - ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; - }; - -+program = { -+ name = grub-protect; -+ -+ common = grub-core/osdep/init.c; -+ common = grub-core/tpm2/args.c; -+ common = grub-core/tpm2/buffer.c; -+ common = grub-core/tpm2/mu.c; -+ common = grub-core/tpm2/tpm2.c; -+ common = grub-core/tpm2/tpm2key_asn1_tab.c; -+ common = util/grub-protect.c; -+ common = util/probe.c; -+ -+ ldadd = libgrubmods.a; -+ ldadd = libgrubgcry.a; -+ ldadd = libgrubkern.a; -+ ldadd = grub-core/lib/gnulib/libgnu.a; -+ ldadd = '$(LIBTASN1)'; -+ ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; -+ -+ enable = efi; -+}; -+ - program = { - name = grub-mkrelpath; - mansection = 1; -diff --git a/configure.ac b/configure.ac -index cd667a2eb..4d0140714 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -76,6 +76,7 @@ grub_TRANSFORM([grub-mkpasswd-pbkdf2]) - grub_TRANSFORM([grub-mkrelpath]) - grub_TRANSFORM([grub-mkrescue]) - grub_TRANSFORM([grub-probe]) -+grub_TRANSFORM([grub-protect]) - grub_TRANSFORM([grub-reboot]) - grub_TRANSFORM([grub-script-check]) - grub_TRANSFORM([grub-set-default]) -@@ -2057,6 +2058,14 @@ fi - AC_SUBST([LIBZFS]) - AC_SUBST([LIBNVPAIR]) - -+LIBTASN1= -+if test x"$platform" = xefi; then -+ AC_CHECK_LIB([tasn1], [asn1_write_value], [], -+ [AC_MSG_ERROR([Your platform requires libtasn1])]) -+ LIBTASN1="-ltasn1" -+fi -+AC_SUBST([LIBTASN1]) -+ - LIBS="" - - AC_SUBST([FONT_SOURCE]) -diff --git a/util/grub-protect.c b/util/grub-protect.c -new file mode 100644 -index 000000000..c6d41ea40 ---- /dev/null -+++ b/util/grub-protect.c -@@ -0,0 +1,1492 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2022 Microsoft Corporation -+ * Copyright (C) 2023 SUSE LLC -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#pragma GCC diagnostic ignored "-Wmissing-prototypes" -+#pragma GCC diagnostic ignored "-Wmissing-declarations" -+#include -+#pragma GCC diagnostic error "-Wmissing-prototypes" -+#pragma GCC diagnostic error "-Wmissing-declarations" -+ -+#include "progname.h" -+ -+/* Unprintable option keys for argp */ -+typedef enum grub_protect_opt -+{ -+ /* General */ -+ GRUB_PROTECT_OPT_ACTION = 'a', -+ GRUB_PROTECT_OPT_PROTECTOR = 'p', -+ /* TPM2 */ -+ GRUB_PROTECT_OPT_TPM2_DEVICE = 0x100, -+ GRUB_PROTECT_OPT_TPM2_PCRS, -+ GRUB_PROTECT_OPT_TPM2_ASYMMETRIC, -+ GRUB_PROTECT_OPT_TPM2_BANK, -+ GRUB_PROTECT_OPT_TPM2_SRK, -+ GRUB_PROTECT_OPT_TPM2_KEYFILE, -+ GRUB_PROTECT_OPT_TPM2_OUTFILE, -+ GRUB_PROTECT_OPT_TPM2_EVICT, -+ GRUB_PROTECT_OPT_TPM2_TPM2KEY -+} grub_protect_opt; -+ -+/* Option flags to keep track of specified arguments */ -+typedef enum grub_protect_arg -+{ -+ /* General */ -+ GRUB_PROTECT_ARG_ACTION = 1 << 0, -+ GRUB_PROTECT_ARG_PROTECTOR = 1 << 1, -+ /* TPM2 */ -+ GRUB_PROTECT_ARG_TPM2_DEVICE = 1 << 2, -+ GRUB_PROTECT_ARG_TPM2_PCRS = 1 << 3, -+ GRUB_PROTECT_ARG_TPM2_ASYMMETRIC = 1 << 4, -+ GRUB_PROTECT_ARG_TPM2_BANK = 1 << 5, -+ GRUB_PROTECT_ARG_TPM2_SRK = 1 << 6, -+ GRUB_PROTECT_ARG_TPM2_KEYFILE = 1 << 7, -+ GRUB_PROTECT_ARG_TPM2_OUTFILE = 1 << 8, -+ GRUB_PROTECT_ARG_TPM2_EVICT = 1 << 9, -+ GRUB_PROTECT_ARG_TPM2_TPM2KEY = 1 << 10 -+} grub_protect_arg_t; -+ -+typedef enum grub_protect_protector -+{ -+ GRUB_PROTECT_TYPE_ERROR, -+ GRUB_PROTECT_TYPE_TPM2 -+} grub_protect_protector_t; -+ -+typedef enum grub_protect_action -+{ -+ GRUB_PROTECT_ACTION_ERROR, -+ GRUB_PROTECT_ACTION_ADD, -+ GRUB_PROTECT_ACTION_REMOVE -+} grub_protect_action_t; -+ -+struct grub_protect_args -+{ -+ grub_protect_arg_t args; -+ grub_protect_action_t action; -+ grub_protect_protector_t protector; -+ -+ const char *tpm2_device; -+ grub_uint8_t tpm2_pcrs[TPM_MAX_PCRS]; -+ grub_uint8_t tpm2_pcr_count; -+ TPM_ALG_ID tpm2_asymmetric; -+ TPM_KEY_BITS rsa_bits; -+ TPM_ECC_CURVE ecc_curve; -+ TPM_ALG_ID tpm2_bank; -+ TPM_HANDLE tpm2_srk; -+ const char *tpm2_keyfile; -+ const char *tpm2_outfile; -+ int tpm2_evict; -+ int tpm2_tpm2key; -+}; -+ -+static struct argp_option grub_protect_options[] = -+ { -+ /* Top-level options */ -+ { -+ .name = "action", -+ .key = 'a', -+ .arg = "add|remove", -+ .flags = 0, -+ .doc = -+ N_("Add or remove a key protector to or from a key."), -+ .group = 0 -+ }, -+ { -+ .name = "protector", -+ .key = 'p', -+ .arg = "tpm2", -+ .flags = 0, -+ .doc = -+ N_("Key protector to use (only tpm2 is currently supported)."), -+ .group = 0 -+ }, -+ /* TPM2 key protector options */ -+ { -+ .name = "tpm2-device", -+ .key = GRUB_PROTECT_OPT_TPM2_DEVICE, -+ .arg = "FILE", -+ .flags = 0, -+ .doc = -+ N_("Path to the TPM2 device (default is /dev/tpm0)."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-pcrs", -+ .key = GRUB_PROTECT_OPT_TPM2_PCRS, -+ .arg = "0[,1]...", -+ .flags = 0, -+ .doc = -+ N_("Comma-separated list of PCRs used to authorize key release " -+ "(e.g., '7,11', default is 7."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-bank", -+ .key = GRUB_PROTECT_OPT_TPM2_BANK, -+ .arg = "ALG", -+ .flags = 0, -+ .doc = -+ N_("Bank of PCRs used to authorize key release: " -+ "SHA1, SHA256 (default), or SHA512."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-keyfile", -+ .key = GRUB_PROTECT_OPT_TPM2_KEYFILE, -+ .arg = "FILE", -+ .flags = 0, -+ .doc = -+ N_("Path to a file that contains the cleartext key to protect."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-outfile", -+ .key = GRUB_PROTECT_OPT_TPM2_OUTFILE, -+ .arg = "FILE", -+ .flags = 0, -+ .doc = -+ N_("Path to the file that will contain the key after sealing (must be " -+ "accessible to GRUB during boot)."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-srk", -+ .key = GRUB_PROTECT_OPT_TPM2_SRK, -+ .arg = "NUM", -+ .flags = 0, -+ .doc = -+ N_("The SRK handle if the SRK is to be made persistent."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-asymmetric", -+ .key = GRUB_PROTECT_OPT_TPM2_ASYMMETRIC, -+ .arg = "TYPE", -+ .flags = 0, -+ .doc = -+ N_("The type of SRK: RSA (RSA2048), RSA3072, RSA4096, " -+ "ECC (ECC_NIST_P256), ECC_NIST_P384, ECC_NIST_P521, " -+ "ECC_BN_P256, ECC_BN_P638, and ECC_SM2_P256. " -+ "(default is RSA2048)"), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2-evict", -+ .key = GRUB_PROTECT_OPT_TPM2_EVICT, -+ .arg = NULL, -+ .flags = 0, -+ .doc = -+ N_("Evict a previously persisted SRK from the TPM, if any."), -+ .group = 0 -+ }, -+ { -+ .name = "tpm2key", -+ .key = GRUB_PROTECT_OPT_TPM2_TPM2KEY, -+ .arg = NULL, -+ .flags = 0, -+ .doc = -+ N_("Use TPM 2.0 Key File format instead of the raw format."), -+ .group = 0 -+ }, -+ /* End of list */ -+ { 0, 0, 0, 0, 0, 0 } -+ }; -+ -+static int grub_protector_tpm2_fd = -1; -+ -+static grub_err_t -+grub_protect_read_file (const char *filepath, void **buffer, -+ size_t *buffer_size) -+{ -+ grub_err_t err; -+ FILE *f; -+ long len; -+ void *buf; -+ -+ f = fopen (filepath, "rb"); -+ if (f == NULL) -+ return GRUB_ERR_FILE_NOT_FOUND; -+ -+ if (fseek (f, 0, SEEK_END)) -+ { -+ err = GRUB_ERR_FILE_READ_ERROR; -+ goto exit1; -+ } -+ -+ len = ftell (f); -+ if (len == 0) -+ { -+ err = GRUB_ERR_FILE_READ_ERROR; -+ goto exit1; -+ } -+ -+ rewind (f); -+ -+ buf = grub_malloc (len); -+ if (buf == NULL) -+ { -+ err = GRUB_ERR_OUT_OF_MEMORY; -+ goto exit1; -+ } -+ -+ if (fread (buf, len, 1, f) != 1) -+ { -+ err = GRUB_ERR_FILE_READ_ERROR; -+ goto exit2; -+ } -+ -+ *buffer = buf; -+ *buffer_size = len; -+ -+ buf = NULL; -+ err = GRUB_ERR_NONE; -+ -+exit2: -+ grub_free (buf); -+ -+exit1: -+ fclose (f); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_write_file (const char *filepath, void *buffer, size_t buffer_size) -+{ -+ grub_err_t err; -+ FILE *f; -+ -+ f = fopen (filepath, "wb"); -+ if (f == NULL) -+ return GRUB_ERR_FILE_NOT_FOUND; -+ -+ if (fwrite (buffer, buffer_size, 1, f) != 1) -+ { -+ err = GRUB_ERR_WRITE_ERROR; -+ goto exit1; -+ } -+ -+ err = GRUB_ERR_NONE; -+ -+exit1: -+ fclose (f); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_get_grub_drive_for_file (const char *filepath, char **drive) -+{ -+ grub_err_t err = GRUB_ERR_IO; -+ char *disk; -+ char **devices; -+ char *grub_dev; -+ char *grub_path; -+ char *efi_drive; -+ char *partition; -+ char *grub_drive; -+ grub_device_t dev; -+ grub_size_t grub_drive_len; -+ int n; -+ -+ grub_path = grub_canonicalize_file_name (filepath); -+ if (grub_path == NULL) -+ goto exit1; -+ -+ devices = grub_guess_root_devices (grub_path); -+ if (devices == NULL || devices[0] == NULL) -+ goto exit2; -+ -+ disk = devices[0]; -+ -+ grub_util_pull_device (disk); -+ -+ grub_dev = grub_util_get_grub_dev (disk); -+ if (grub_dev == NULL) -+ goto exit3; -+ -+ dev = grub_device_open (grub_dev); -+ if (dev == NULL) -+ goto exit4; -+ -+ efi_drive = grub_util_guess_efi_drive (disk); -+ if (efi_drive == NULL) -+ goto exit5; -+ -+ partition = grub_partition_get_name (dev->disk->partition); -+ if (partition == NULL) -+ goto exit6; -+ -+ grub_drive_len = grub_strlen (efi_drive) + grub_strlen (partition) + 3; -+ grub_drive = grub_malloc (grub_drive_len + 1); -+ if (grub_drive == NULL) -+ goto exit7; -+ -+ n = grub_snprintf (grub_drive, grub_drive_len + 1, "(%s,%s)", efi_drive, -+ partition); -+ if (n != grub_drive_len) -+ goto exit8; -+ -+ *drive = grub_drive; -+ grub_drive = NULL; -+ err = GRUB_ERR_NONE; -+ -+exit8: -+ grub_free (grub_drive); -+ -+exit7: -+ grub_free (partition); -+ -+exit6: -+ grub_free (efi_drive); -+ -+exit5: -+ grub_device_close (dev); -+ -+exit4: -+ grub_free (grub_dev); -+ -+exit3: -+ grub_free (devices); -+ -+exit2: -+ grub_free (grub_path); -+ -+exit1: -+ return err; -+} -+ -+grub_err_t -+grub_tcg2_get_max_output_size (grub_size_t *size) -+{ -+ if (size == NULL) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ *size = GRUB_TPM2_BUFFER_CAPACITY; -+ -+ return GRUB_ERR_NONE; -+} -+ -+grub_err_t -+grub_tcg2_submit_command (grub_size_t input_size, grub_uint8_t *input, -+ grub_size_t output_size, grub_uint8_t *output) -+{ -+ static const grub_size_t header_size = sizeof (grub_uint16_t) + -+ (2 * sizeof(grub_uint32_t)); -+ -+ if (write (grub_protector_tpm2_fd, input, input_size) != input_size) -+ return GRUB_ERR_BAD_DEVICE; -+ -+ if (read (grub_protector_tpm2_fd, output, output_size) < header_size) -+ return GRUB_ERR_BAD_DEVICE; -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_tpm2_open_device (const char *dev_node) -+{ -+ if (grub_protector_tpm2_fd != -1) -+ return GRUB_ERR_NONE; -+ -+ grub_protector_tpm2_fd = open (dev_node, O_RDWR); -+ if (grub_protector_tpm2_fd == -1) -+ { -+ fprintf (stderr, _("Could not open TPM device (Error: %u).\n"), errno); -+ return GRUB_ERR_FILE_NOT_FOUND; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_tpm2_close_device (void) -+{ -+ int err; -+ -+ if (grub_protector_tpm2_fd == -1) -+ return GRUB_ERR_NONE; -+ -+ err = close (grub_protector_tpm2_fd); -+ if (err != GRUB_ERR_NONE) -+ { -+ fprintf (stderr, _("Could not close TPM device (Error: %u).\n"), errno); -+ return GRUB_ERR_IO; -+ } -+ -+ grub_protector_tpm2_fd = -1; -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_tpm2_get_policy_digest (struct grub_protect_args *args, -+ TPM2B_DIGEST *digest) -+{ -+ TPM_RC rc; -+ TPML_PCR_SELECTION pcr_sel = { -+ .count = 1, -+ .pcrSelections = { -+ { -+ .hash = args->tpm2_bank, -+ .sizeOfSelect = 3, -+ .pcrSelect = { 0 } -+ }, -+ } -+ }; -+ TPML_PCR_SELECTION pcr_sel_out = { 0 }; -+ TPML_DIGEST pcr_values = { 0 }; -+ grub_uint8_t *pcr_digest; -+ grub_size_t pcr_digest_len; -+ grub_uint8_t *pcr_concat; -+ grub_size_t pcr_concat_len; -+ grub_uint8_t *pcr_cursor; -+ const gcry_md_spec_t *hash_spec; -+ TPM2B_NONCE nonce = { 0 }; -+ TPM2B_ENCRYPTED_SECRET salt = { 0 }; -+ TPMT_SYM_DEF symmetric = { 0 }; -+ TPMI_SH_AUTH_SESSION session = 0; -+ TPM2B_DIGEST pcr_digest_in = { -+ .size = TPM_SHA256_DIGEST_SIZE, -+ .buffer = { 0 } -+ }; -+ TPM2B_DIGEST policy_digest = { 0 }; -+ grub_uint8_t i; -+ grub_err_t err; -+ -+ /* PCR Read */ -+ for (i = 0; i < args->tpm2_pcr_count; i++) -+ TPMS_PCR_SELECTION_SelectPCR (&pcr_sel.pcrSelections[0], args->tpm2_pcrs[i]); -+ -+ rc = TPM2_PCR_Read (NULL, &pcr_sel, NULL, &pcr_sel_out, &pcr_values, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("Failed to read PCRs (TPM2_PCR_Read: 0x%x).\n"), rc); -+ return GRUB_ERR_BAD_DEVICE; -+ } -+ -+ if ((pcr_sel_out.count != pcr_sel.count) || -+ (pcr_sel.pcrSelections[0].sizeOfSelect != -+ pcr_sel_out.pcrSelections[0].sizeOfSelect)) -+ { -+ fprintf (stderr, _("Could not read all the specified PCRs.\n")); -+ return GRUB_ERR_BAD_DEVICE; -+ } -+ -+ /* Compute PCR Digest */ -+ switch (args->tpm2_bank) -+ { -+ case TPM_ALG_SHA1: -+ pcr_digest_len = TPM_SHA1_DIGEST_SIZE; -+ hash_spec = GRUB_MD_SHA1; -+ break; -+ case TPM_ALG_SHA256: -+ pcr_digest_len = TPM_SHA256_DIGEST_SIZE; -+ hash_spec = GRUB_MD_SHA256; -+ break; -+ case TPM_ALG_SHA512: -+ pcr_digest_len = TPM_SHA512_DIGEST_SIZE; -+ hash_spec = GRUB_MD_SHA512; -+ break; -+ /* Although SHA384 can be parsed by grub_tpm2_protector_parse_bank(), -+ it's not supported by the built-in libgcrypt, and we won't be able to -+ calculate the PCR digest, so SHA384 is marked as unsupported. */ -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ pcr_digest = grub_malloc (pcr_digest_len); -+ if (!pcr_digest) -+ { -+ fprintf (stderr, _("Failed to allocate PCR digest buffer.\n")); -+ return GRUB_ERR_OUT_OF_MEMORY; -+ } -+ -+ pcr_concat_len = pcr_digest_len * args->tpm2_pcr_count; -+ pcr_concat = grub_malloc (pcr_concat_len); -+ if (pcr_concat == NULL) -+ { -+ err = GRUB_ERR_OUT_OF_MEMORY; -+ fprintf (stderr, _("Failed to allocate PCR concatenation buffer.\n")); -+ goto exit1; -+ } -+ -+ pcr_cursor = pcr_concat; -+ for (i = 0; i < args->tpm2_pcr_count; i++) -+ { -+ if (pcr_values.digests[i].size != pcr_digest_len) -+ { -+ fprintf (stderr, -+ _("Bad PCR value size: expected %" PRIuGRUB_SIZE " bytes but got %u bytes.\n"), -+ pcr_digest_len, pcr_values.digests[i].size); -+ goto exit2; -+ } -+ -+ grub_memcpy (pcr_cursor, pcr_values.digests[i].buffer, pcr_digest_len); -+ pcr_cursor += pcr_digest_len; -+ } -+ -+ grub_crypto_hash (hash_spec, pcr_digest, pcr_concat, pcr_concat_len); -+ -+ /* Start Trial Session */ -+ nonce.size = TPM_SHA256_DIGEST_SIZE; -+ symmetric.algorithm = TPM_ALG_NULL; -+ -+ rc = TPM2_StartAuthSession (TPM_RH_NULL, TPM_RH_NULL, 0, &nonce, &salt, -+ TPM_SE_TRIAL, &symmetric, TPM_ALG_SHA256, -+ &session, NULL, 0); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, -+ _("Failed to start trial policy session (TPM2_StartAuthSession: 0x%x).\n"), -+ rc); -+ err = GRUB_ERR_BAD_DEVICE; -+ goto exit2; -+ } -+ -+ /* PCR Policy */ -+ memcpy (pcr_digest_in.buffer, pcr_digest, TPM_SHA256_DIGEST_SIZE); -+ -+ rc = TPM2_PolicyPCR (session, NULL, &pcr_digest_in, &pcr_sel, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("Failed to submit PCR policy (TPM2_PolicyPCR: 0x%x).\n"), -+ rc); -+ err = GRUB_ERR_BAD_DEVICE; -+ goto exit3; -+ } -+ -+ /* Retrieve Policy Digest */ -+ rc = TPM2_PolicyGetDigest (session, NULL, &policy_digest, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("Failed to get policy digest (TPM2_PolicyGetDigest: 0x%x).\n"), -+ rc); -+ err = GRUB_ERR_BAD_DEVICE; -+ goto exit3; -+ } -+ -+ /* Epilogue */ -+ *digest = policy_digest; -+ err = GRUB_ERR_NONE; -+ -+exit3: -+ TPM2_FlushContext (session); -+ -+exit2: -+ grub_free (pcr_concat); -+ -+exit1: -+ grub_free (pcr_digest); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_tpm2_get_srk (struct grub_protect_args *args, TPM_HANDLE *srk) -+{ -+ TPM_RC rc; -+ TPM2B_PUBLIC public; -+ TPMS_AUTH_COMMAND authCommand = { 0 }; -+ TPM2B_SENSITIVE_CREATE inSensitive = { 0 }; -+ TPM2B_PUBLIC inPublic = { 0 }; -+ TPM2B_DATA outsideInfo = { 0 }; -+ TPML_PCR_SELECTION creationPcr = { 0 }; -+ TPM2B_PUBLIC outPublic = { 0 }; -+ TPM2B_CREATION_DATA creationData = { 0 }; -+ TPM2B_DIGEST creationHash = { 0 }; -+ TPMT_TK_CREATION creationTicket = { 0 }; -+ TPM2B_NAME srkName = { 0 }; -+ TPM_HANDLE srkHandle; -+ -+ if (args->tpm2_srk != 0) -+ { -+ /* Find SRK */ -+ rc = TPM2_ReadPublic (args->tpm2_srk, NULL, &public); -+ if (rc == TPM_RC_SUCCESS) -+ { -+ printf (_("Read SRK from 0x%x\n"), args->tpm2_srk); -+ *srk = args->tpm2_srk; -+ return GRUB_ERR_NONE; -+ } -+ -+ /* The handle exists but its public area could not be read. */ -+ if ((rc & ~TPM_RC_N_MASK) != TPM_RC_HANDLE) -+ { -+ fprintf (stderr, -+ _("Failed to retrieve SRK from 0x%x (TPM2_ReadPublic: 0x%x).\n"), -+ args->tpm2_srk, rc); -+ return GRUB_ERR_BAD_DEVICE; -+ } -+ } -+ -+ /* Create SRK */ -+ authCommand.sessionHandle = TPM_RS_PW; -+ inPublic.publicArea.type = args->tpm2_asymmetric; -+ inPublic.publicArea.nameAlg = TPM_ALG_SHA256; -+ inPublic.publicArea.objectAttributes.restricted = 1; -+ inPublic.publicArea.objectAttributes.userWithAuth = 1; -+ inPublic.publicArea.objectAttributes.decrypt = 1; -+ inPublic.publicArea.objectAttributes.fixedTPM = 1; -+ inPublic.publicArea.objectAttributes.fixedParent = 1; -+ inPublic.publicArea.objectAttributes.sensitiveDataOrigin = 1; -+ inPublic.publicArea.objectAttributes.noDA = 1; -+ -+ switch (args->tpm2_asymmetric) -+ { -+ case TPM_ALG_RSA: -+ inPublic.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES; -+ inPublic.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128; -+ inPublic.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB; -+ inPublic.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; -+ inPublic.publicArea.parameters.rsaDetail.keyBits = args->rsa_bits; -+ inPublic.publicArea.parameters.rsaDetail.exponent = 0; -+ break; -+ -+ case TPM_ALG_ECC: -+ inPublic.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES; -+ inPublic.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128; -+ inPublic.publicArea.parameters.eccDetail.symmetric.mode.aes = TPM_ALG_CFB; -+ inPublic.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; -+ inPublic.publicArea.parameters.eccDetail.curveID = args->ecc_curve; -+ inPublic.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; -+ break; -+ -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ rc = TPM2_CreatePrimary (TPM_RH_OWNER, &authCommand, &inSensitive, &inPublic, -+ &outsideInfo, &creationPcr, &srkHandle, &outPublic, -+ &creationData, &creationHash, &creationTicket, -+ &srkName, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("Failed to create SRK (TPM2_CreatePrimary: 0x%x).\n"), rc); -+ return GRUB_ERR_BAD_DEVICE; -+ } -+ -+ /* Persist SRK */ -+ if (args->tpm2_srk != 0) -+ { -+ rc = TPM2_EvictControl (TPM_RH_OWNER, srkHandle, &authCommand, -+ args->tpm2_srk, NULL); -+ if (rc == TPM_RC_SUCCESS) -+ { -+ TPM2_FlushContext (srkHandle); -+ srkHandle = args->tpm2_srk; -+ } -+ else -+ fprintf (stderr, -+ _("Warning: Failed to persist SRK (0x%x) (TPM2_EvictControl: 0x%x\n). " -+ "Continuing anyway...\n"), args->tpm2_srk, rc); -+ } -+ -+ /* Epilogue */ -+ *srk = srkHandle; -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_tpm2_seal (TPM2B_DIGEST *policyDigest, TPM_HANDLE srk, -+ grub_uint8_t *clearText, grub_size_t clearTextLength, -+ TPM2_SEALED_KEY *sealed_key) -+{ -+ TPM_RC rc; -+ TPMS_AUTH_COMMAND authCommand = { 0 }; -+ TPM2B_SENSITIVE_CREATE inSensitive = { 0 }; -+ TPM2B_PUBLIC inPublic = { 0 }; -+ TPM2B_DATA outsideInfo = { 0 }; -+ TPML_PCR_SELECTION pcr_sel = { 0 }; -+ TPM2B_PRIVATE outPrivate = { 0 }; -+ TPM2B_PUBLIC outPublic = { 0 }; -+ -+ /* Seal Data */ -+ authCommand.sessionHandle = TPM_RS_PW; -+ -+ inSensitive.sensitive.data.size = clearTextLength; -+ memcpy(inSensitive.sensitive.data.buffer, clearText, clearTextLength); -+ -+ inPublic.publicArea.type = TPM_ALG_KEYEDHASH; -+ inPublic.publicArea.nameAlg = TPM_ALG_SHA256; -+ inPublic.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_NULL; -+ inPublic.publicArea.authPolicy = *policyDigest; -+ -+ rc = TPM2_Create (srk, &authCommand, &inSensitive, &inPublic, &outsideInfo, -+ &pcr_sel, &outPrivate, &outPublic, NULL, NULL, NULL, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("Failed to seal key (TPM2_Create: 0x%x).\n"), rc); -+ return GRUB_ERR_BAD_DEVICE; -+ } -+ -+ /* Epilogue */ -+ sealed_key->public = outPublic; -+ sealed_key->private = outPrivate; -+ -+ return GRUB_ERR_NONE; -+} -+ -+extern asn1_static_node tpm2key_asn1_tab[]; -+ -+static grub_err_t -+grub_protect_tpm2_export_tpm2key (const struct grub_protect_args *args, -+ TPM2_SEALED_KEY *sealed_key) -+{ -+ const char *sealed_key_oid = "2.23.133.10.1.5"; -+ asn1_node asn1_def = NULL; -+ asn1_node tpm2key = NULL; -+ grub_uint32_t parent; -+ grub_uint32_t cmd_code; -+ struct grub_tpm2_buffer pol_buf; -+ TPML_PCR_SELECTION pcr_sel = { -+ .count = 1, -+ .pcrSelections = { -+ { -+ .hash = args->tpm2_bank, -+ .sizeOfSelect = 3, -+ .pcrSelect = { 0 } -+ }, -+ } -+ }; -+ struct grub_tpm2_buffer pub_buf; -+ struct grub_tpm2_buffer priv_buf; -+ void *der_buf = NULL; -+ int der_buf_size = 0; -+ int i; -+ int ret; -+ grub_err_t err; -+ -+ for (i = 0; i < args->tpm2_pcr_count; i++) -+ TPMS_PCR_SELECTION_SelectPCR (&pcr_sel.pcrSelections[0], args->tpm2_pcrs[i]); -+ -+ /* -+ * Prepare the parameters for TPM_CC_PolicyPCR: -+ * empty pcrDigest and the user selected PCRs -+ */ -+ grub_tpm2_buffer_init (&pol_buf); -+ grub_tpm2_buffer_pack_u16 (&pol_buf, 0); -+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&pol_buf, &pcr_sel); -+ -+ grub_tpm2_buffer_init (&pub_buf); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&pub_buf, &sealed_key->public); -+ grub_tpm2_buffer_init (&priv_buf); -+ grub_tpm2_mu_TPM2B_Marshal (&priv_buf, sealed_key->private.size, -+ sealed_key->private.buffer); -+ if (pub_buf.error != 0 || priv_buf.error != 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ ret = asn1_array2tree (tpm2key_asn1_tab, &asn1_def, NULL); -+ if (ret != ASN1_SUCCESS) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ ret = asn1_create_element (asn1_def, "TPM2KEY.TPMKey" , &tpm2key); -+ if (ret != ASN1_SUCCESS) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ /* Set 'type' to "sealed key" */ -+ ret = asn1_write_value (tpm2key, "type", sealed_key_oid, 1); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Set 'emptyAuth' to TRUE */ -+ ret = asn1_write_value (tpm2key, "emptyAuth", "TRUE", 1); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Set 'policy' */ -+ ret = asn1_write_value (tpm2key, "policy", "NEW", 1); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ cmd_code = grub_cpu_to_be32 (TPM_CC_PolicyPCR); -+ ret = asn1_write_value (tpm2key, "policy.?LAST.CommandCode", &cmd_code, -+ sizeof (cmd_code)); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ ret = asn1_write_value (tpm2key, "policy.?LAST.CommandPolicy", &pol_buf.data, -+ pol_buf.size); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Remove 'secret' */ -+ ret = asn1_write_value (tpm2key, "secret", NULL, 0); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Remove 'authPolicy' */ -+ ret = asn1_write_value (tpm2key, "authPolicy", NULL, 0); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Use TPM_RH_OWNER as the default parent handle */ -+ parent = grub_cpu_to_be32 (TPM_RH_OWNER); -+ ret = asn1_write_value (tpm2key, "parent", &parent, sizeof (parent)); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Set the pubkey */ -+ ret = asn1_write_value (tpm2key, "pubkey", pub_buf.data, pub_buf.size); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Set the privkey */ -+ ret = asn1_write_value (tpm2key, "privkey", priv_buf.data, priv_buf.size); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ /* Create the DER binary */ -+ der_buf_size = 0; -+ ret = asn1_der_coding (tpm2key, "", NULL, &der_buf_size, NULL); -+ -+ der_buf = grub_malloc (der_buf_size); -+ if (der_buf == NULL) -+ { -+ err = GRUB_ERR_OUT_OF_MEMORY; -+ goto error; -+ } -+ -+ ret = asn1_der_coding (tpm2key, "", der_buf, &der_buf_size, NULL); -+ if (ret != ASN1_SUCCESS) -+ { -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto error; -+ } -+ -+ err = grub_protect_write_file (args->tpm2_outfile, der_buf, der_buf_size); -+ if (err != GRUB_ERR_NONE) -+ fprintf (stderr, _("Could not write tpm2key file (Error: %u).\n"), -+ errno); -+ -+error: -+ grub_free (der_buf); -+ -+ if (tpm2key) -+ asn1_delete_structure (&tpm2key); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_tpm2_export_sealed_key (const char *filepath, -+ TPM2_SEALED_KEY *sealed_key) -+{ -+ grub_err_t err; -+ struct grub_tpm2_buffer buf; -+ -+ grub_tpm2_buffer_init (&buf); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&buf, &sealed_key->public); -+ grub_tpm2_mu_TPM2B_Marshal (&buf, sealed_key->private.size, -+ sealed_key->private.buffer); -+ if (buf.error != 0) -+ return GRUB_ERR_BAD_ARGUMENT; -+ -+ err = grub_protect_write_file (filepath, buf.data, buf.size); -+ if (err != GRUB_ERR_NONE) -+ fprintf (stderr, _("Could not write sealed key file (Error: %u).\n"), -+ errno); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_tpm2_add (struct grub_protect_args *args) -+{ -+ grub_err_t err; -+ grub_uint8_t *key; -+ grub_size_t key_size; -+ TPM_HANDLE srk; -+ TPM2B_DIGEST policy_digest; -+ TPM2_SEALED_KEY sealed_key; -+ char *grub_drive = NULL; -+ -+ grub_protect_get_grub_drive_for_file (args->tpm2_outfile, &grub_drive); -+ -+ err = grub_protect_tpm2_open_device (args->tpm2_device); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ err = grub_protect_read_file (args->tpm2_keyfile, (void **)&key, &key_size); -+ if (err != GRUB_ERR_NONE) -+ goto exit1; -+ -+ if (key_size > TPM_MAX_SYM_DATA) -+ { -+ fprintf (stderr, -+ _("Input key is too long, maximum allowed size is %u bytes.\n"), -+ TPM_MAX_SYM_DATA); -+ return GRUB_ERR_OUT_OF_RANGE; -+ } -+ -+ err = grub_protect_tpm2_get_srk (args, &srk); -+ if (err != GRUB_ERR_NONE) -+ goto exit2; -+ -+ err = grub_protect_tpm2_get_policy_digest (args, &policy_digest); -+ if (err != GRUB_ERR_NONE) -+ goto exit3; -+ -+ err = grub_protect_tpm2_seal (&policy_digest, srk, key, key_size, -+ &sealed_key); -+ if (err != GRUB_ERR_NONE) -+ goto exit3; -+ -+ if (args->tpm2_tpm2key) -+ err = grub_protect_tpm2_export_tpm2key (args, &sealed_key); -+ else -+ err = grub_protect_tpm2_export_sealed_key (args->tpm2_outfile, &sealed_key); -+ if (err != GRUB_ERR_NONE) -+ goto exit3; -+ -+ if (grub_drive) -+ { -+ printf (_("GRUB drive for the sealed key file: %s\n"), grub_drive); -+ grub_free (grub_drive); -+ } -+ else -+ { -+ fprintf (stderr, -+ _("Warning: Could not determine GRUB drive for sealed key " -+ "file.\n")); -+ err = GRUB_ERR_NONE; -+ } -+ -+exit3: -+ TPM2_FlushContext (srk); -+ -+exit2: -+ grub_free (key); -+ -+exit1: -+ grub_protect_tpm2_close_device (); -+ -+ return err; -+} -+ -+static grub_err_t -+grub_protect_tpm2_remove (struct grub_protect_args *args) -+{ -+ TPM_RC rc; -+ TPM2B_PUBLIC public; -+ TPMS_AUTH_COMMAND authCommand = { 0 }; -+ grub_err_t err; -+ -+ if (args->tpm2_evict == 0) -+ { -+ printf (_("--tpm2-evict not specified, nothing to do.\n")); -+ return GRUB_ERR_NONE; -+ } -+ -+ err = grub_protect_tpm2_open_device (args->tpm2_device); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ /* Find SRK */ -+ rc = TPM2_ReadPublic (args->tpm2_srk, NULL, &public); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, _("SRK with handle 0x%x not found.\n"), args->tpm2_srk); -+ err = GRUB_ERR_BAD_ARGUMENT; -+ goto exit1; -+ } -+ -+ /* Evict SRK */ -+ authCommand.sessionHandle = TPM_RS_PW; -+ -+ rc = TPM2_EvictControl (TPM_RH_OWNER, args->tpm2_srk, &authCommand, -+ args->tpm2_srk, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ fprintf (stderr, -+ _("Failed to evict SRK with handle 0x%x (TPM2_EvictControl: 0x%x).\n"), -+ args->tpm2_srk, rc); -+ err = GRUB_ERR_BAD_DEVICE; -+ goto exit2; -+ } -+ -+ err = GRUB_ERR_NONE; -+ -+exit2: -+ TPM2_FlushContext (args->tpm2_srk); -+ -+exit1: -+ grub_protect_tpm2_close_device (); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_tpm2_run (struct grub_protect_args *args) -+{ -+ switch (args->action) -+ { -+ case GRUB_PROTECT_ACTION_ADD: -+ return grub_protect_tpm2_add (args); -+ -+ case GRUB_PROTECT_ACTION_REMOVE: -+ return grub_protect_tpm2_remove (args); -+ -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+} -+ -+static grub_err_t -+grub_protect_tpm2_args_verify (struct grub_protect_args *args) -+{ -+ switch (args->action) -+ { -+ case GRUB_PROTECT_ACTION_ADD: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_EVICT) -+ { -+ fprintf (stderr, -+ _("--tpm2-evict is invalid when --action is 'add'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->tpm2_keyfile == NULL) -+ { -+ fprintf (stderr, _("--tpm2-keyfile must be specified.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->tpm2_outfile == NULL) -+ { -+ fprintf (stderr, _("--tpm2-outfile must be specified.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->tpm2_device == NULL) -+ args->tpm2_device = "/dev/tpm0"; -+ -+ if (args->tpm2_pcr_count == 0) -+ { -+ args->tpm2_pcrs[0] = 7; -+ args->tpm2_pcr_count = 1; -+ } -+ -+ if (args->tpm2_asymmetric == TPM_ALG_ERROR) -+ { -+ args->tpm2_asymmetric = TPM_ALG_RSA; -+ args->rsa_bits = 2048; -+ } -+ -+ if (args->tpm2_bank == TPM_ALG_ERROR) -+ args->tpm2_bank = TPM_ALG_SHA256; -+ -+ break; -+ -+ case GRUB_PROTECT_ACTION_REMOVE: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_ASYMMETRIC) -+ { -+ fprintf (stderr, -+ _("--tpm2-asymmetric is invalid when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->args & GRUB_PROTECT_ARG_TPM2_BANK) -+ { -+ fprintf (stderr, -+ _("--tpm2-bank is invalid when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->args & GRUB_PROTECT_ARG_TPM2_KEYFILE) -+ { -+ fprintf (stderr, -+ _("--tpm2-keyfile is invalid when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->args & GRUB_PROTECT_ARG_TPM2_OUTFILE) -+ { -+ fprintf (stderr, -+ _("--tpm2-outfile is invalid when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->args & GRUB_PROTECT_ARG_TPM2_PCRS) -+ { -+ fprintf (stderr, -+ _("--tpm2-pcrs is invalid when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->tpm2_srk == 0) -+ { -+ fprintf (stderr, -+ _("--tpm2-srk is not specified when --action is 'remove'.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ if (args->tpm2_device == NULL) -+ args->tpm2_device = "/dev/tpm0"; -+ -+ break; -+ -+ default: -+ fprintf (stderr, -+ _("The TPM2 key protector only supports the following actions: " -+ "add, remove.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static error_t -+grub_protect_argp_parser (int key, char *arg, struct argp_state *state) -+{ -+ grub_err_t err; -+ struct grub_protect_args *args = state->input; -+ -+ switch (key) -+ { -+ case GRUB_PROTECT_OPT_ACTION: -+ if (args->args & GRUB_PROTECT_ARG_ACTION) -+ { -+ fprintf (stderr, _("--action|-a can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ if (grub_strcmp (arg, "add") == 0) -+ args->action = GRUB_PROTECT_ACTION_ADD; -+ else if (grub_strcmp (arg, "remove") == 0) -+ args->action = GRUB_PROTECT_ACTION_REMOVE; -+ else -+ { -+ fprintf (stderr, _("'%s' is not a valid action.\n"), arg); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_ACTION; -+ break; -+ -+ case GRUB_PROTECT_OPT_PROTECTOR: -+ if (args->args & GRUB_PROTECT_ARG_PROTECTOR) -+ { -+ fprintf (stderr, _("--protector|-p can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ if (grub_strcmp (arg, "tpm2") == 0) -+ args->protector = GRUB_PROTECT_TYPE_TPM2; -+ else -+ { -+ fprintf (stderr, _("'%s' is not a valid protector.\n"), arg); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_PROTECTOR; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_DEVICE: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_DEVICE) -+ { -+ fprintf (stderr, _("--tpm2-device can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ args->tpm2_device = xstrdup(arg); -+ args->args |= GRUB_PROTECT_ARG_TPM2_DEVICE; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_PCRS: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_PCRS) -+ { -+ fprintf (stderr, _("--tpm2-pcrs can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ err = grub_tpm2_protector_parse_pcrs (arg, args->tpm2_pcrs, -+ &args->tpm2_pcr_count); -+ if (err != GRUB_ERR_NONE) -+ { -+ if (grub_errno != GRUB_ERR_NONE) -+ grub_print_error (); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_TPM2_PCRS; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_SRK: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_SRK) -+ { -+ fprintf (stderr, _("--tpm2-srk can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ err = grub_tpm2_protector_parse_tpm_handle (arg, &args->tpm2_srk); -+ if (err != GRUB_ERR_NONE) -+ { -+ if (grub_errno != GRUB_ERR_NONE) -+ grub_print_error (); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_TPM2_SRK; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_ASYMMETRIC: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_ASYMMETRIC) -+ { -+ fprintf (stderr, _("--tpm2-asymmetric can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ err = grub_tpm2_protector_parse_asymmetric (arg, &args->tpm2_asymmetric, -+ &args->rsa_bits, &args->ecc_curve); -+ if (err != GRUB_ERR_NONE) -+ { -+ if (grub_errno != GRUB_ERR_NONE) -+ grub_print_error (); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_TPM2_ASYMMETRIC; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_BANK: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_BANK) -+ { -+ fprintf (stderr, _("--tpm2-bank can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ err = grub_tpm2_protector_parse_bank (arg, &args->tpm2_bank); -+ if (err != GRUB_ERR_NONE) -+ { -+ if (grub_errno != GRUB_ERR_NONE) -+ grub_print_error (); -+ return EINVAL; -+ } -+ -+ args->args |= GRUB_PROTECT_ARG_TPM2_BANK; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_KEYFILE: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_KEYFILE) -+ { -+ fprintf (stderr, _("--tpm2-keyfile can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ args->tpm2_keyfile = xstrdup(arg); -+ args->args |= GRUB_PROTECT_ARG_TPM2_KEYFILE; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_OUTFILE: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_OUTFILE) -+ { -+ fprintf (stderr, _("--tpm2-outfile can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ args->tpm2_outfile = xstrdup(arg); -+ args->args |= GRUB_PROTECT_ARG_TPM2_OUTFILE; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_EVICT: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_EVICT) -+ { -+ fprintf (stderr, _("--tpm2-evict can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ args->tpm2_evict = 1; -+ args->args |= GRUB_PROTECT_ARG_TPM2_EVICT; -+ break; -+ -+ case GRUB_PROTECT_OPT_TPM2_TPM2KEY: -+ if (args->args & GRUB_PROTECT_ARG_TPM2_TPM2KEY) -+ { -+ fprintf (stderr, _("--tpm2-tpm2key can only be specified once.\n")); -+ return EINVAL; -+ } -+ -+ args->tpm2_tpm2key = 1; -+ args->args |= GRUB_PROTECT_ARG_TPM2_TPM2KEY; -+ break; -+ -+ default: -+ return ARGP_ERR_UNKNOWN; -+ } -+ -+ return 0; -+} -+ -+static grub_err_t -+grub_protect_args_verify (struct grub_protect_args *args) -+{ -+ if (args->action == GRUB_PROTECT_ACTION_ERROR) -+ { -+ fprintf (stderr, "--action is mandatory.\n"); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ /* At the moment, the only configurable key protector is the TPM2 one, so it -+ * is the only key protector supported by this tool. */ -+ if (args->protector != GRUB_PROTECT_TYPE_TPM2) -+ { -+ fprintf (stderr, -+ _("--protector is mandatory and only 'tpm2' is currently " -+ "supported.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ switch (args->protector) -+ { -+ case GRUB_PROTECT_TYPE_TPM2: -+ return grub_protect_tpm2_args_verify (args); -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_protect_dispatch (struct grub_protect_args *args) -+{ -+ switch (args->protector) -+ { -+ case GRUB_PROTECT_TYPE_TPM2: -+ return grub_protect_tpm2_run (args); -+ default: -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+} -+ -+static void -+grub_protect_init (int *argc, char **argv[]) -+{ -+ grub_util_host_init (argc, argv); -+ -+ grub_util_biosdisk_init (NULL); -+ -+ grub_init_all (); -+ grub_gcry_init_all (); -+ -+ grub_lvm_fini (); -+ grub_mdraid09_fini (); -+ grub_mdraid1x_fini (); -+ grub_diskfilter_fini (); -+ grub_diskfilter_init (); -+ grub_mdraid09_init (); -+ grub_mdraid1x_init (); -+ grub_lvm_init (); -+} -+ -+static void -+grub_protect_fini (void) -+{ -+ grub_gcry_fini_all (); -+ grub_fini_all (); -+ grub_util_biosdisk_fini (); -+} -+ -+static struct argp grub_protect_argp = -+{ -+ .options = grub_protect_options, -+ .parser = grub_protect_argp_parser, -+ .args_doc = NULL, -+ .doc = -+ N_("Protect a cleartext key using a GRUB key protector that can retrieve " -+ "the key during boot to unlock fully-encrypted disks automatically."), -+ .children = NULL, -+ .help_filter = NULL, -+ .argp_domain = NULL -+}; -+ -+int -+main (int argc, char *argv[]) -+{ -+ grub_err_t err; -+ struct grub_protect_args args = { 0 }; -+ -+ if (argp_parse (&grub_protect_argp, argc, argv, 0, 0, &args) != 0) -+ { -+ fprintf (stderr, _("Could not parse arguments.\n")); -+ return GRUB_ERR_BAD_ARGUMENT; -+ } -+ -+ grub_protect_init (&argc, &argv); -+ -+ err = grub_protect_args_verify (&args); -+ if (err != GRUB_ERR_NONE) -+ goto exit; -+ -+ err = grub_protect_dispatch (&args); -+ if (err != GRUB_ERR_NONE) -+ goto exit; -+ -+exit: -+ grub_protect_fini (); -+ -+ return err; -+} --- -2.41.0 - diff --git a/0098-docs-grub-Document-signing-grub-under-UEFI.patch b/0133-docs-grub-Document-signing-grub-under-UEFI.patch similarity index 87% rename from 0098-docs-grub-Document-signing-grub-under-UEFI.patch rename to 0133-docs-grub-Document-signing-grub-under-UEFI.patch index c148ff9..69c352d 100644 --- a/0098-docs-grub-Document-signing-grub-under-UEFI.patch +++ b/0133-docs-grub-Document-signing-grub-under-UEFI.patch @@ -1,7 +1,7 @@ -From d4828baffe7ac07a6394cce09883c160ac58fd0f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Sat, 15 Aug 2020 02:00:57 +1000 -Subject: [PATCH 098/272] docs/grub: Document signing grub under UEFI +Subject: [PATCH] docs/grub: Document signing grub under UEFI Before adding information about how grub is signed with an appended signature scheme, it's worth adding some information about how it @@ -13,10 +13,10 @@ Signed-off-by: Daniel Axtens 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/docs/grub.texi b/docs/grub.texi -index 23c5eb165..6eda37120 100644 +index 1e577d2fee9..30d4046a931 100644 --- a/docs/grub.texi +++ b/docs/grub.texi -@@ -6400,6 +6400,7 @@ environment variables and commands are listed in the same order. +@@ -6403,6 +6403,7 @@ environment variables and commands are listed in the same order. * Secure Boot Advanced Targeting:: Embedded information for generation number based revocation * Measured Boot:: Measuring boot components * Lockdown:: Lockdown when booting on a secure setup @@ -24,7 +24,7 @@ index 23c5eb165..6eda37120 100644 @end menu @node Authentication and authorisation -@@ -6478,7 +6479,7 @@ commands. +@@ -6481,7 +6482,7 @@ commands. GRUB's @file{core.img} can optionally provide enforcement that all files subsequently read from disk are covered by a valid digital signature. @@ -33,7 +33,7 @@ index 23c5eb165..6eda37120 100644 platform's firmware (e.g., Coreboot) validates @file{core.img}. If environment variable @code{check_signatures} -@@ -6641,6 +6642,25 @@ be restricted and some operations/commands cannot be executed. +@@ -6654,6 +6655,25 @@ be restricted and some operations/commands cannot be executed. The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. Otherwise it does not exit. @@ -59,6 +59,3 @@ index 23c5eb165..6eda37120 100644 @node Platform limitations @chapter Platform limitations --- -2.41.0 - diff --git a/0133-linuxefi-Use-common-grub_initrd_load.patch b/0133-linuxefi-Use-common-grub_initrd_load.patch deleted file mode 100644 index ba16071..0000000 --- a/0133-linuxefi-Use-common-grub_initrd_load.patch +++ /dev/null @@ -1,156 +0,0 @@ -From 23cdb20d78670c36f66333ea12f5645adf2d76bf Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 8 Jun 2022 16:04:12 +0800 -Subject: [PATCH 133/272] linuxefi: Use common grub_initrd_load - -By using the common initrd loading routine factored out allows to share between -features like concatenating initramfs component. - -For eg. - - initrdefi /initrd-5.16.15-1-default newc:grub.cfg:/grub2/grub.cfg - -The file /grub2/grub.cfg read off from root disk will be available to use as -/grub.cfg in the target initramfs loaded by grub. - -Signed-off-by: Michael Chang ---- - grub-core/loader/i386/efi/linux.c | 87 ++++--------------------------- - 1 file changed, 10 insertions(+), 77 deletions(-) - -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 6b06a8f2f..ca3435a88 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -146,44 +147,6 @@ grub_linuxefi_unload (void) - return GRUB_ERR_NONE; - } - --#define BOUNCE_BUFFER_MAX 0x1000000ull -- --static grub_ssize_t --read(grub_file_t file, grub_uint8_t *bufp, grub_size_t len) --{ -- grub_ssize_t bufpos = 0; -- static grub_size_t bbufsz = 0; -- static char *bbuf = NULL; -- -- if (bbufsz == 0) -- bbufsz = MIN(BOUNCE_BUFFER_MAX, len); -- -- while (!bbuf && bbufsz) -- { -- bbuf = grub_malloc(bbufsz); -- if (!bbuf) -- bbufsz >>= 1; -- } -- if (!bbuf) -- grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate bounce buffer")); -- -- while (bufpos < (long long)len) -- { -- grub_ssize_t sz; -- -- sz = grub_file_read (file, bbuf, MIN(bbufsz, len - bufpos)); -- if (sz < 0) -- return sz; -- if (sz == 0) -- break; -- -- grub_memcpy(bufp + bufpos, bbuf, sz); -- bufpos += sz; -- } -- -- return bufpos; --} -- - #define LOW_U32(val) ((grub_uint32_t)(((grub_addr_t)(val)) & 0xffffffffull)) - #define HIGH_U32(val) ((grub_uint32_t)(((grub_addr_t)(val) >> 32) & 0xffffffffull)) - -@@ -191,10 +154,8 @@ static grub_err_t - grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), - int argc, char *argv[]) - { -- grub_file_t *files = 0; -- int i, nfiles = 0; -+ struct grub_linux_initrd_context initrd_ctx = { 0, 0, 0 }; - grub_size_t size = 0; -- grub_uint8_t *ptr; - - if (argc == 0) - { -@@ -208,24 +169,10 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), - goto fail; - } - -- files = grub_calloc (argc, sizeof (files[0])); -- if (!files) -+ if (grub_initrd_init (argc, argv, &initrd_ctx)) - goto fail; - -- for (i = 0; i < argc; i++) -- { -- files[i] = grub_file_open (argv[i], GRUB_FILE_TYPE_LINUX_INITRD -- | GRUB_FILE_TYPE_NO_DECOMPRESS); -- if (! files[i]) -- goto fail; -- nfiles++; -- if (grub_add (size, ALIGN_UP (grub_file_size (files[i]), 4), &size)) -- { -- grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -- goto fail; -- } -- } -- -+ size = grub_get_initrd_size (&initrd_ctx); - initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); - if (initrd_mem == NULL) - goto fail; -@@ -238,30 +185,16 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), - params->ext_ramdisk_image = HIGH_U32(initrd_mem); - #endif - -- ptr = initrd_mem; -- -- for (i = 0; i < nfiles; i++) -- { -- grub_ssize_t cursize = grub_file_size (files[i]); -- if (read (files[i], ptr, cursize) != cursize) -- { -- if (!grub_errno) -- grub_error (GRUB_ERR_FILE_READ_ERROR, N_("premature end of file %s"), -- argv[i]); -- goto fail; -- } -- ptr += cursize; -- grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4)); -- ptr += ALIGN_UP_OVERHEAD (cursize, 4); -- } -+ /* FIXME: Use bounce buffers as many UEFI machines apparently can't DMA -+ * correctly above 4GB -+ */ -+ if (grub_initrd_load (&initrd_ctx, initrd_mem)) -+ goto fail; - - params->ramdisk_size = size; - - fail: -- for (i = 0; i < nfiles; i++) -- grub_file_close (files[i]); -- grub_free (files); -- -+ grub_initrd_close (&initrd_ctx); - if (initrd_mem && grub_errno) - grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, BYTES_TO_PAGES(size)); - --- -2.41.0 - diff --git a/0134-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch b/0134-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch deleted file mode 100644 index 154992c..0000000 --- a/0134-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch +++ /dev/null @@ -1,341 +0,0 @@ -From 1c91625c9e9bb0bdeae96ce9b4add26d37521311 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 9 Jun 2022 21:06:00 +0800 -Subject: [PATCH 134/272] Add crypttab_entry to obviate the need to input - password twice - -This patch adds crypttab_entry command to hint grub where to put the key file -automatically loaded by linux cryptsetup. It's syntax is similar to -/etc/crypttab so that it is relatively straightforward to import. - - crypttab_entry - -For eg: - - crypttab_entry cr_root 5e1dd109e39343f984da57fd742d3f23 none - -Please note the "encrypted-device" only accepts UUID without dashes as it is -the only identification used by grub's cryptodisk device. The crypttab_entry -can also be used multiple times to specify encrypted volumes unlocked by -"cryptomount -a". - -Signed-off-by: Michael Chang ---- - grub-core/Makefile.core.def | 5 ++ - grub-core/commands/crypttab.c | 47 ++++++++++++ - grub-core/disk/cryptodisk.c | 6 ++ - grub-core/loader/linux.c | 138 +++++++++++++++++++++++++++++++++- - include/grub/linux.h | 3 + - 5 files changed, 196 insertions(+), 3 deletions(-) - create mode 100644 grub-core/commands/crypttab.c - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index c26b30423..75fbe7109 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -2695,3 +2695,8 @@ module = { - cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; - cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; - }; -+ -+module = { -+ name = crypttab; -+ common = commands/crypttab.c; -+}; -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -new file mode 100644 -index 000000000..5104541df ---- /dev/null -+++ b/grub-core/commands/crypttab.c -@@ -0,0 +1,47 @@ -+ -+#include -+#include -+#include -+#include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); -+ -+static grub_err_t -+grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char **argv) -+{ -+ char buf[64]; -+ const char *path = NULL; -+ -+ if (argc == 2) -+ path = NULL; -+ else if (argc == 3) -+ path = argv[2]; -+ else -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("two or three arguments expected")); -+ -+ if (!path -+ || grub_strcmp (path, "none") == 0 -+ || grub_strcmp (path, "-") == 0) -+ { -+ grub_snprintf (buf, sizeof (buf), "/etc/cryptsetup-keys.d/%s.key", argv[0]); -+ path = buf; -+ } -+ -+ /*FIXME: Validate UUID string*/ -+ return grub_initrd_publish_key (argv[1], NULL, 0, path); -+} -+ -+static grub_command_t cmd; -+ -+GRUB_MOD_INIT(crypttab) -+{ -+ cmd = grub_register_command ("crypttab_entry", grub_cmd_crypttab_entry, -+ N_("VOLUME-NAME ENCRYPTED-DEVICE KEY-FILE") , N_("No description")); -+} -+ -+GRUB_MOD_FINI(crypttab) -+{ -+ grub_unregister_command (cmd); -+} -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index dba5efa61..6d43b0e4f 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -30,6 +30,8 @@ - - #ifdef GRUB_UTIL - #include -+#else -+#include - #endif - - GRUB_MOD_LICENSE ("GPLv3+"); -@@ -1235,6 +1237,10 @@ grub_cryptodisk_scan_device_real (const char *name, - if (cargs->hdr_file != NULL) - source->read_hook = NULL; - -+#ifndef GRUB_UTIL -+ if (cargs->key_data && dev) -+ grub_initrd_publish_key (dev->uuid, (const char *)cargs->key_data, cargs->key_len, NULL); -+#endif - if (askpass) - { - cargs->key_len = 0; -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 56bc1be58..281123958 100644 ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -5,6 +5,7 @@ - #include - #include - #include -+#include - - struct newc_head - { -@@ -27,6 +28,7 @@ struct newc_head - struct grub_linux_initrd_component - { - grub_file_t file; -+ char *buf; - char *newc_name; - grub_off_t size; - }; -@@ -38,6 +40,18 @@ struct dir - struct dir *child; - }; - -+struct grub_key_publisher -+{ -+ struct grub_key_publisher *next; -+ struct grub_key_publisher **prev; -+ char *name; /* UUID */ -+ char *path; -+ char *key; -+ grub_size_t key_len; -+}; -+ -+static struct grub_key_publisher *kpuber; -+ - static char - hex (grub_uint8_t val) - { -@@ -162,6 +176,65 @@ insert_dir (const char *name, struct dir **root, - return GRUB_ERR_NONE; - } - -+static grub_err_t -+grub_initrd_component (const char *buf, int bufsz, const char *newc_name, -+ struct grub_linux_initrd_context *initrd_ctx) -+{ -+ struct dir *root = 0; -+ struct grub_linux_initrd_component *comp = initrd_ctx->components + initrd_ctx->nfiles; -+ grub_size_t dir_size, name_len; -+ -+ while (*newc_name == '/') -+ newc_name++; -+ -+ initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); -+ comp->newc_name = grub_strdup (newc_name); -+ if (!comp->newc_name || -+ insert_dir (comp->newc_name, &root, 0, &dir_size)) -+ { -+ /* FIXME: Check NULL file pointer before close */ -+ grub_initrd_close (initrd_ctx); -+ return grub_errno; -+ } -+ /* Should name_len count terminating null ? */ -+ name_len = grub_strlen (comp->newc_name) + 1; -+ if (grub_add (initrd_ctx->size, -+ ALIGN_UP (sizeof (struct newc_head) + name_len, 4), -+ &initrd_ctx->size) || -+ grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size)) -+ goto overflow; -+ -+ comp->buf = grub_malloc (bufsz); -+ if (!comp->buf) -+ { -+ free_dir (root); -+ grub_initrd_close (initrd_ctx); -+ return grub_errno; -+ } -+ grub_memcpy (comp->buf, buf, bufsz); -+ initrd_ctx->nfiles++; -+ comp->size = bufsz; -+ if (grub_add (initrd_ctx->size, comp->size, -+ &initrd_ctx->size)) -+ goto overflow; -+ -+ initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); -+ if (grub_add (initrd_ctx->size, -+ ALIGN_UP (sizeof (struct newc_head) -+ + sizeof ("TRAILER!!!") - 1, 4), -+ &initrd_ctx->size)) -+ goto overflow; -+ -+ free_dir (root); -+ root = 0; -+ return GRUB_ERR_NONE; -+ -+ overflow: -+ free_dir (root); -+ grub_initrd_close (initrd_ctx); -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); -+} -+ - grub_err_t - grub_initrd_init (int argc, char *argv[], - struct grub_linux_initrd_context *initrd_ctx) -@@ -169,11 +242,17 @@ grub_initrd_init (int argc, char *argv[], - int i; - int newc = 0; - struct dir *root = 0; -+ struct grub_key_publisher *pk; -+ int numkey = 0; - - initrd_ctx->nfiles = 0; - initrd_ctx->components = 0; - -- initrd_ctx->components = grub_calloc (argc, sizeof (initrd_ctx->components[0])); -+ FOR_LIST_ELEMENTS (pk, kpuber) -+ if (pk->key && pk->path) -+ numkey++; -+ -+ initrd_ctx->components = grub_calloc (argc + numkey, sizeof (initrd_ctx->components[0])); - if (!initrd_ctx->components) - return grub_errno; - -@@ -253,6 +332,10 @@ grub_initrd_init (int argc, char *argv[], - root = 0; - } - -+ FOR_LIST_ELEMENTS (pk, kpuber) -+ if (pk->key && pk->path) -+ grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); -+ - return GRUB_ERR_NONE; - - overflow: -@@ -276,7 +359,9 @@ grub_initrd_close (struct grub_linux_initrd_context *initrd_ctx) - for (i = 0; i < initrd_ctx->nfiles; i++) - { - grub_free (initrd_ctx->components[i].newc_name); -- grub_file_close (initrd_ctx->components[i].file); -+ if (initrd_ctx->components[i].file) -+ grub_file_close (initrd_ctx->components[i].file); -+ grub_free (initrd_ctx->components[i].buf); - } - grub_free (initrd_ctx->components); - initrd_ctx->components = 0; -@@ -325,7 +410,12 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - } - - cursize = initrd_ctx->components[i].size; -- if (grub_file_read (initrd_ctx->components[i].file, ptr, cursize) -+ if (initrd_ctx->components[i].buf) -+ { -+ grub_memcpy (ptr, initrd_ctx->components[i].buf, cursize); -+ newc = 1; -+ } -+ else if (grub_file_read (initrd_ctx->components[i].file, ptr, cursize) - != cursize) - { - if (!grub_errno) -@@ -346,3 +436,45 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - root = 0; - return GRUB_ERR_NONE; - } -+ -+grub_err_t -+grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path) -+{ -+ struct grub_key_publisher *cur = NULL; -+ -+ FOR_LIST_ELEMENTS (cur, kpuber) -+ if (grub_uuidcasecmp (cur->name, uuid, sizeof (cur->name)) == 0) -+ break; -+ -+ if (!cur) -+ cur = grub_zalloc (sizeof (*cur)); -+ if (!cur) -+ return grub_errno; -+ -+ if (key && key_len) -+ { -+ grub_free (cur->key); -+ cur->key = grub_malloc (key_len); -+ if (!cur->key) -+ { -+ grub_free (cur); -+ return grub_errno; -+ } -+ grub_memcpy (cur->key, key, key_len); -+ cur->key_len = key_len; -+ } -+ -+ if (path) -+ { -+ grub_free (cur->path); -+ cur->path = grub_strdup (path); -+ } -+ -+ if (!cur->name) -+ { -+ cur->name = grub_strdup (uuid); -+ grub_list_push (GRUB_AS_LIST_P (&kpuber), GRUB_AS_LIST (cur)); -+ } -+ -+ return GRUB_ERR_NONE; -+} -diff --git a/include/grub/linux.h b/include/grub/linux.h -index a96ac2048..d261f2f61 100644 ---- a/include/grub/linux.h -+++ b/include/grub/linux.h -@@ -22,3 +22,6 @@ grub_initrd_close (struct grub_linux_initrd_context *initrd_ctx); - grub_err_t - grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - void *target); -+ -+grub_err_t -+grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); --- -2.41.0 - diff --git a/0099-docs-grub-Document-signing-grub-with-an-appended-sig.patch b/0134-docs-grub-Document-signing-grub-with-an-appended-sig.patch similarity index 86% rename from 0099-docs-grub-Document-signing-grub-with-an-appended-sig.patch rename to 0134-docs-grub-Document-signing-grub-with-an-appended-sig.patch index 7d2b2b3..e5c6320 100644 --- a/0099-docs-grub-Document-signing-grub-with-an-appended-sig.patch +++ b/0134-docs-grub-Document-signing-grub-with-an-appended-sig.patch @@ -1,8 +1,7 @@ -From 122c5b827f52aaadce2aeded1fd73131c128d92a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Sat, 15 Aug 2020 02:19:36 +1000 -Subject: [PATCH 099/272] docs/grub: Document signing grub with an appended - signature +Subject: [PATCH] docs/grub: Document signing grub with an appended signature Signing grub for firmware that verifies an appended signature is a bit fiddly. I don't want people to have to figure it out from scratch @@ -14,20 +13,20 @@ Signed-off-by: Daniel Axtens 1 file changed, 42 insertions(+) diff --git a/docs/grub.texi b/docs/grub.texi -index 6eda37120..fb41419da 100644 +index 30d4046a931..0ac0a1b3735 100644 --- a/docs/grub.texi +++ b/docs/grub.texi -@@ -6661,6 +6661,48 @@ image works under UEFI secure boot and can maintain the secure-boot chain. It +@@ -6674,6 +6674,48 @@ image works under UEFI secure boot and can maintain the secure-boot chain. It will also be necessary to enrol the public key used into a relevant firmware key database. +@section Signing GRUB with an appended signature + -+The @file{core.img} itself can be signed with a Linux kernel module-style ++The @file{core.elf} itself can be signed with a Linux kernel module-style +appended signature. + +To support IEEE1275 platforms where the boot image is often loaded directly -+from a disk partition rather than from a file system, the @file{core.img} ++from a disk partition rather than from a file system, the @file{core.elf} +can specify the size and location of the appended signature with an ELF +note added by @command{grub-install}. + @@ -66,6 +65,3 @@ index 6eda37120..fb41419da 100644 @node Platform limitations @chapter Platform limitations --- -2.41.0 - diff --git a/0100-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch b/0135-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch similarity index 79% rename from 0100-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch rename to 0135-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch index 4a813e2..c25927d 100644 --- a/0100-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch +++ b/0135-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch @@ -1,8 +1,7 @@ -From 83a213a6db59807a40e986d914490e1ab13fc21e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 30 Jul 2020 00:13:21 +1000 -Subject: [PATCH 100/272] dl: provide a fake grub_dl_set_persistent for the emu - target +Subject: [PATCH] dl: provide a fake grub_dl_set_persistent for the emu target Trying to start grub-emu with a module that calls grub_dl_set_persistent will crash because grub-emu fakes modules and passes NULL to the module @@ -17,10 +16,10 @@ Signed-off-by: Daniel Axtens 1 file changed, 11 insertions(+) diff --git a/include/grub/dl.h b/include/grub/dl.h -index cd1f46c8b..c5ab18cb1 100644 +index 8a3d188d1d1..3f10e27d62c 100644 --- a/include/grub/dl.h +++ b/include/grub/dl.h -@@ -242,11 +242,22 @@ grub_dl_get (const char *name) +@@ -244,11 +244,22 @@ grub_dl_get (const char *name) return 0; } @@ -43,6 +42,3 @@ index cd1f46c8b..c5ab18cb1 100644 static inline int grub_dl_is_persistent (grub_dl_t mod) --- -2.41.0 - diff --git a/0135-templates-import-etc-crypttab-to-grub.cfg.patch b/0135-templates-import-etc-crypttab-to-grub.cfg.patch deleted file mode 100644 index c1ff204..0000000 --- a/0135-templates-import-etc-crypttab-to-grub.cfg.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 8481a4b3bd7bc41e2d7b3811d27226beae86ba73 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 14 Jun 2022 17:10:01 +0800 -Subject: [PATCH 135/272] templates: import /etc/crypttab to grub.cfg - -The /etc/crypptab is used to setup location of encryption key files during -boot, among other things. It is useful to make use the information by grub to -determine where keys are being looked up. - -This script can be used to import relevant /etc/crypptab entry to grub.cfg. - -Signed-off-by: Michael Chang ---- - Makefile.util.def | 7 ++++++ - util/grub.d/05_crypttab.in | 50 ++++++++++++++++++++++++++++++++++++++ - 2 files changed, 57 insertions(+) - create mode 100644 util/grub.d/05_crypttab.in - -diff --git a/Makefile.util.def b/Makefile.util.def -index 82046d34d..4ce15119b 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -478,6 +478,13 @@ script = { - installdir = grubconf; - }; - -+script = { -+ name = '05_crypttab'; -+ common = util/grub.d/05_crypttab.in; -+ installdir = grubconf; -+ condition = COND_HOST_LINUX; -+}; -+ - script = { - name = '10_windows'; - common = util/grub.d/10_windows.in; -diff --git a/util/grub.d/05_crypttab.in b/util/grub.d/05_crypttab.in -new file mode 100644 -index 000000000..81e7836b4 ---- /dev/null -+++ b/util/grub.d/05_crypttab.in -@@ -0,0 +1,50 @@ -+#! /bin/sh -+set -e -+ -+# grub-mkconfig helper script. -+# Copyright (C) 2022 Free Software Foundation, Inc. -+# -+# GRUB is free software: you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# GRUB is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with GRUB. If not, see . -+ -+prefix="@prefix@" -+exec_prefix="@exec_prefix@" -+datarootdir="@datarootdir@" -+ -+export TEXTDOMAIN=@PACKAGE@ -+export TEXTDOMAINDIR="@localedir@" -+ -+. "$pkgdatadir/grub-mkconfig_lib" -+ -+CRYPTTAB=/etc/crypttab -+ -+if [ -r "$CRYPTTAB" ]; then -+ awk ' -+ /^\s*#/ || $3 ~ /(^\/dev\/|^\/proc\/|^\/sys\/|:)/ { next } -+ { key[0] = $3 } -+ $3 ~ /(^$|none|-)/ { -+ key[0] = "/etc/cryptsetup-keys.d/" $1 ".key" -+ key[1] = "/run/cryptsetup-keys.d/" $1 ".key" -+ } -+ { -+ for (d in key) -+ if (system("test -f " key[d]) == 0) -+ next -+ } -+ /UUID=/ { -+ sub(/UUID=/,"",$2); -+ gsub(/-/,"",$2); -+ printf("crypttab_entry %s %s %s\n",$1,$2,$3) -+ } -+ ' "$CRYPTTAB" -+fi --- -2.41.0 - diff --git a/0136-grub-read-pcr.patch b/0136-grub-read-pcr.patch deleted file mode 100644 index 08cf80f..0000000 --- a/0136-grub-read-pcr.patch +++ /dev/null @@ -1,186 +0,0 @@ -From 2764edc4a1a5ace2fc6036078476bf2f5c757cd1 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 10:44:40 +0800 -Subject: [PATCH 136/272] grub read pcr - -Signed-off-by: SUSE ---- - grub-core/commands/efi/tpm.c | 109 +++++++++++++++++++++++++++++++++++ - include/grub/tpm.h | 8 +++ - include/grub/tpm2/tpm2.h | 4 ++ - 3 files changed, 121 insertions(+) - -diff --git a/grub-core/commands/efi/tpm.c b/grub-core/commands/efi/tpm.c -index f250c30db..025bd51e0 100644 ---- a/grub-core/commands/efi/tpm.c -+++ b/grub-core/commands/efi/tpm.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -186,6 +187,91 @@ grub_tpm1_log_event (grub_efi_handle_t tpm_handle, unsigned char *buf, - return grub_efi_log_event_status (status); - } - -+static void -+grub_tpm2_select_pcr(TPML_PCR_SELECTION *o, unsigned int pcrIndex, unsigned int algo) -+{ -+ TPMS_PCR_SELECTION *pcr; -+ -+ pcr = &o->pcrSelections[o->count++]; -+ pcr->hash = algo; -+ pcr->sizeOfSelect = 3; -+ pcr->pcrSelect[TPM2_PCR_TO_SELECT(pcrIndex)] |= TPM2_PCR_TO_BIT(pcrIndex); -+} -+ -+struct grub_tpm_hash_info { -+ const char *name; -+ grub_size_t size; -+ int id; -+}; -+ -+static const struct grub_tpm_hash_info * -+grub_tpm2_get_digest_info (const char *algo) -+{ -+ static struct grub_tpm_hash_info __hashes[] = { -+ { "sha256", 32, TPM_ALG_SHA256 }, /* first entry is the default */ -+ { "sha512", 64, TPM_ALG_SHA512 }, -+ { "sha1", 20, TPM_ALG_SHA1 }, -+ { NULL } -+ }; -+ struct grub_tpm_hash_info *h; -+ -+ if (algo == NULL) -+ return &__hashes[0]; -+ -+ for (h = __hashes; h->name; ++h) -+ if (!grub_strcmp(h->name, algo)) -+ return h; -+ -+ return NULL; -+} -+ -+static grub_err_t -+grub_tpm2_read_pcr (grub_int8_t pcrIndex, const char *algo, struct grub_tpm_digest **ret) -+{ -+ const struct grub_tpm_hash_info *info; -+ TPML_PCR_SELECTION inSelection, outSelection; -+ grub_uint32_t pcrUpdateCounter; -+ TPML_DIGEST digests = { 0 }; -+ TPM2B_DIGEST *d; -+ struct grub_tpm_digest *result; -+ int rc; -+ -+ info = grub_tpm2_get_digest_info (algo); -+ if (info == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Unknown digest algorithm %s"), algo); -+ -+ grub_memset(&inSelection, 0, sizeof(inSelection)); -+ grub_memset(&outSelection, 0, sizeof(outSelection)); -+ grub_tpm2_select_pcr(&inSelection, pcrIndex, info->id); -+ -+ rc = TPM2_PCR_Read( -+ NULL, -+ &inSelection, -+ &pcrUpdateCounter, -+ &outSelection, -+ &digests, -+ NULL -+ ); -+ -+ if (rc != 0) -+ return grub_error (GRUB_ERR_BAD_DEVICE, "TPM2_PCR_Read failed, status=%d", rc); -+ -+ d = &digests.digests[0]; -+ -+ *ret = result = grub_malloc (sizeof (*result) + d->size); -+ grub_memcpy (result->value, d->buffer, d->size); -+ result->algorithm = info->name; -+ result->size = d->size; -+ -+ return GRUB_ERR_NONE; -+} -+ -+void -+grub_tpm_digest_free (struct grub_tpm_digest *d) -+{ -+ grub_free (d); -+} -+ - static grub_err_t - grub_tpm2_log_event (grub_efi_handle_t tpm_handle, unsigned char *buf, - grub_size_t size, grub_uint8_t pcr, -@@ -323,3 +409,26 @@ grub_tpm_present (void) - return grub_tpm2_present (tpm); - } - } -+ -+struct grub_tpm_digest * -+grub_tpm_read_pcr (grub_uint8_t pcr, const char *algo) -+{ -+ grub_efi_handle_t tpm_handle; -+ grub_efi_uint8_t protocol_version; -+ struct grub_tpm_digest *result = NULL; -+ -+ -+ if (!grub_tpm_handle_find (&tpm_handle, &protocol_version)) -+ return 0; -+ -+ if (protocol_version != 2) -+ { -+ grub_error (GRUB_ERR_BAD_DEVICE, N_("%s: TPM version %d not implemented"), __func__, protocol_version); -+ return NULL; -+ } -+ -+ if (grub_tpm2_read_pcr (pcr, algo, &result)) -+ return NULL; -+ -+ return result; -+} -diff --git a/include/grub/tpm.h b/include/grub/tpm.h -index d09783dac..caf3c9a10 100644 ---- a/include/grub/tpm.h -+++ b/include/grub/tpm.h -@@ -36,6 +36,12 @@ - - #define EV_IPL 0x0d - -+struct grub_tpm_digest { -+ const char * algorithm; -+ unsigned int size; -+ unsigned char value[1]; /* variable length */ -+}; -+ - grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size, - grub_uint8_t pcr, const char *description); - int grub_tpm_present (void); -@@ -45,5 +51,7 @@ grub_is_tpm_fail_fatal (void) - { - return grub_env_get_bool ("tpm_fail_fatal", false); - } -+struct grub_tpm_digest *grub_tpm_read_pcr (grub_uint8_t index, const char *algo); -+void grub_tpm_digest_free (struct grub_tpm_digest *d); - - #endif -diff --git a/include/grub/tpm2/tpm2.h b/include/grub/tpm2/tpm2.h -index cfdc9edcd..ea467ffd3 100644 ---- a/include/grub/tpm2/tpm2.h -+++ b/include/grub/tpm2/tpm2.h -@@ -23,6 +23,10 @@ - #include - #include - -+/* Defined in: TCG TPM Specification, v1.59, Part 2, Section 10.6.1. */ -+#define TPM2_PCR_TO_SELECT(x) ((x) / 8) -+#define TPM2_PCR_TO_BIT(x) (1 << ((x) % 8)) -+ - /* Well-Known Windows SRK handle */ - #define TPM2_SRK_HANDLE 0x81000001 - --- -2.41.0 - diff --git a/0101-pgp-factor-out-rsa_pad.patch b/0136-pgp-factor-out-rsa_pad.patch similarity index 92% rename from 0101-pgp-factor-out-rsa_pad.patch rename to 0136-pgp-factor-out-rsa_pad.patch index ca1e091..6e629a4 100644 --- a/0101-pgp-factor-out-rsa_pad.patch +++ b/0136-pgp-factor-out-rsa_pad.patch @@ -1,7 +1,7 @@ -From 2ed515648761ce76c3c83f1db7351249b2b6d6cd Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 1 Oct 2020 20:23:48 +1000 -Subject: [PATCH 101/272] pgp: factor out rsa_pad +Subject: [PATCH] pgp: factor out rsa_pad rsa_pad does the PKCS#1 v1.5 padding for the RSA signature scheme. We want to use it in other RSA signature verification applications. @@ -18,19 +18,19 @@ PKCS#1 v1.5 module. Signed-off-by: Daniel Axtens --- - grub-core/Makefile.core.def | 8 +++++ - grub-core/commands/pgp.c | 28 ++---------------- - grub-core/lib/pkcs1_v15.c | 59 +++++++++++++++++++++++++++++++++++++ - include/grub/pkcs1_v15.h | 27 +++++++++++++++++ + grub-core/Makefile.core.def | 8 ++++++ + grub-core/commands/pgp.c | 28 ++------------------- + grub-core/lib/pkcs1_v15.c | 59 +++++++++++++++++++++++++++++++++++++++++++++ + include/grub/pkcs1_v15.h | 27 +++++++++++++++++++++ 4 files changed, 96 insertions(+), 26 deletions(-) create mode 100644 grub-core/lib/pkcs1_v15.c create mode 100644 include/grub/pkcs1_v15.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 3f48cfa75..c8ff3a57f 100644 +index 4aa20cdfc13..82f2e169ad1 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -2540,6 +2540,14 @@ module = { +@@ -2568,6 +2568,14 @@ module = { cppflags = '$(CPPFLAGS_GCRY)'; }; @@ -46,7 +46,7 @@ index 3f48cfa75..c8ff3a57f 100644 name = all_video; common = lib/fake_module.c; diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c -index c6766f044..b084dc9a2 100644 +index c6766f044aa..b084dc9a22f 100644 --- a/grub-core/commands/pgp.c +++ b/grub-core/commands/pgp.c @@ -24,6 +24,7 @@ @@ -93,7 +93,7 @@ index c6766f044..b084dc9a2 100644 struct grub_pubkey_context diff --git a/grub-core/lib/pkcs1_v15.c b/grub-core/lib/pkcs1_v15.c new file mode 100644 -index 000000000..dbacd563d +index 00000000000..dbacd563d01 --- /dev/null +++ b/grub-core/lib/pkcs1_v15.c @@ -0,0 +1,59 @@ @@ -158,7 +158,7 @@ index 000000000..dbacd563d +} diff --git a/include/grub/pkcs1_v15.h b/include/grub/pkcs1_v15.h new file mode 100644 -index 000000000..5c338c84a +index 00000000000..5c338c84a15 --- /dev/null +++ b/include/grub/pkcs1_v15.h @@ -0,0 +1,27 @@ @@ -189,6 +189,3 @@ index 000000000..5c338c84a +grub_crypto_rsa_pad (gcry_mpi_t * hmpi, grub_uint8_t * hval, + const gcry_md_spec_t * hash, gcry_mpi_t mod); + --- -2.41.0 - diff --git a/0102-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch b/0137-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch similarity index 90% rename from 0102-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch rename to 0137-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch index 30c11bf..732b91c 100644 --- a/0102-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch +++ b/0137-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch @@ -1,7 +1,7 @@ -From 625e9f95a30992f94744d36bae14e032d32312f6 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 2 Oct 2020 10:49:26 +1000 -Subject: [PATCH 102/272] crypto: move storage for grub_crypto_pk_* to crypto.c +Subject: [PATCH] crypto: move storage for grub_crypto_pk_* to crypto.c The way gcry_rsa and friends (the asymmetric ciphers) are loaded for the pgp module is a bit quirky. @@ -40,7 +40,7 @@ Signed-off-by: Daniel Axtens 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c -index b084dc9a2..a45c2213c 100644 +index b084dc9a22f..a45c2213c4a 100644 --- a/grub-core/commands/pgp.c +++ b/grub-core/commands/pgp.c @@ -147,10 +147,6 @@ const char *hashes[] = { @@ -55,7 +55,7 @@ index b084dc9a2..a45c2213c 100644 dsa_pad (gcry_mpi_t *hmpi, grub_uint8_t *hval, const gcry_md_spec_t *hash, struct grub_public_subkey *sk); diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c -index 396f76410..d53ddbe2c 100644 +index 396f7641080..d53ddbe2c44 100644 --- a/grub-core/lib/crypto.c +++ b/grub-core/lib/crypto.c @@ -121,6 +121,10 @@ grub_md_unregister (gcry_md_spec_t *cipher) @@ -69,6 +69,3 @@ index 396f76410..d53ddbe2c 100644 void grub_crypto_hash (const gcry_md_spec_t *hash, void *out, const void *in, grub_size_t inlen) --- -2.41.0 - diff --git a/0137-tpm-record-pcrs.patch b/0137-tpm-record-pcrs.patch deleted file mode 100644 index b3c7ed0..0000000 --- a/0137-tpm-record-pcrs.patch +++ /dev/null @@ -1,250 +0,0 @@ -From 3be5aeecdca26e19fdc948ec51d0ee0bb00d9b67 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 10:46:04 +0800 -Subject: [PATCH 137/272] tpm record pcrs - -Signed-off-by: SUSE ---- - grub-core/commands/tpm.c | 210 +++++++++++++++++++++++++++++++++++++++ - 1 file changed, 210 insertions(+) - -diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c -index 324423ef8..9b89f5fe3 100644 ---- a/grub-core/commands/tpm.c -+++ b/grub-core/commands/tpm.c -@@ -26,6 +26,9 @@ - #include - #include - #include -+#include -+#include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -94,8 +97,214 @@ struct grub_file_verifier grub_tpm_verifier = { - .verify_string = grub_tpm_verify_string, - }; - -+/* -+ * Preserve current PCR values and record them to an EFI variable -+ */ -+#define GRUB2_PCR_BITMASK_DEFAULT ((1 << 16) - 1) -+#define GRUB2_PCR_BITMASK_ALL ((1 << 24) - 1) -+ -+static const struct grub_arg_option grub_tpm_record_pcrs_options[] = -+ { -+ { -+ .longarg = "efivar", -+ .shortarg = 'E', -+ .flags = 0, -+ .arg = NULL, -+ .type = ARG_TYPE_STRING, -+ .doc = -+ N_("The EFI variable to publish the PCRs to (default GrubPcrSnapshot)"), -+ }, -+ -+ {0, 0, 0, 0, 0, 0} -+ }; -+ -+static grub_err_t -+grub_tpm_parse_pcr_index (const char *word, const char **end_ret, unsigned int *index) -+{ -+ const char *end; -+ -+ if (!grub_isdigit (word[0])) -+ return GRUB_ERR_BAD_NUMBER; -+ -+ *index = grub_strtoul(word, &end, 0); -+ if (*index > 32) -+ return GRUB_ERR_BAD_NUMBER; -+ -+ *end_ret = end; -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm_parse_pcr_list (const char *arg, grub_uint32_t *bitmask) -+{ -+ const char *word, *end; -+ unsigned int index, last_index = 0; -+ -+ if (!grub_strcmp (arg, "all")) -+ { -+ *bitmask = GRUB2_PCR_BITMASK_ALL; -+ return GRUB_ERR_NONE; -+ } -+ -+ word = arg; -+ while (1) -+ { -+ if (grub_tpm_parse_pcr_index (word, &end, &index)) -+ goto bad_pcr_index; -+ -+ if (*end == '-') -+ { -+ if (grub_tpm_parse_pcr_index (end + 1, &end, &last_index) || last_index < index) -+ goto bad_pcr_index; -+ -+ while (index <= last_index) -+ *bitmask |= (1 << (index++)); -+ } -+ else -+ *bitmask |= (1 << index); -+ -+ if (*end == '\0') -+ break; -+ -+ if (*end != ',') -+ goto bad_pcr_index; -+ -+ word = end + 1; -+ } -+ -+ return GRUB_ERR_NONE; -+ -+bad_pcr_index: -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("cannot parse PCR list \"%s\""), arg); -+} -+ -+static inline unsigned int -+nbits(grub_uint32_t mask) -+{ -+ unsigned int r = 0; -+ -+ for (; mask != 0; mask >>= 1) -+ r += (mask & 1); -+ return r; -+} -+ -+static grub_err_t -+grub_tpm_snapshot_pcrs (grub_uint32_t pcr_bitmask, const char *algo, -+ void **buffer_ret, grub_size_t *size_ret) -+{ -+ char *buffer; -+ grub_size_t size = 65536; -+ unsigned int wpos = 0; -+ grub_uint8_t pcr; -+ -+ buffer = grub_malloc (size); -+ for (pcr = 0; pcr < 32; ++pcr) -+ { -+ struct grub_tpm_digest *d; -+ unsigned int need, k; -+ -+ if (!(pcr_bitmask & (1 << pcr))) -+ continue; -+ -+ d = grub_tpm_read_pcr (pcr, algo); -+ if (d == NULL) -+ { -+ grub_error (GRUB_ERR_BAD_DEVICE, N_("unable to read PCR %d from TPM"), pcr); -+ continue; -+ } -+ -+ /* We need room for the PCR index, 2 spaces, newline, NUL. 16 should be enough. */ -+ need = 16 + grub_strlen(d->algorithm) + 2 * d->size; -+ if (wpos + need > size) -+ { -+ buffer = grub_realloc (buffer, size + need); -+ if (buffer == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("Not enough memory when dumping PCR registers")); -+ } -+ -+ grub_snprintf (buffer + wpos, size - wpos, "%02d %s ", pcr, d->algorithm); -+ wpos = grub_strlen(buffer); -+ -+ for (k = 0; k < d->size; ++k) -+ { -+ grub_snprintf (buffer + wpos, size - wpos, "%02x", d->value[k]); -+ wpos += 2; -+ } -+ -+ buffer[wpos++] = '\n'; -+ buffer[wpos] = '\0'; -+ -+ grub_tpm_digest_free (d); -+ } -+ -+ *buffer_ret = buffer; -+ *size_ret = wpos; -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm_write_pcrs_to_efi (void *data, grub_size_t size, const char *var_name) -+{ -+ grub_guid_t vendor_guid = { 0x7ce323f2, 0xb841, 0x4d30, { 0xa0, 0xe9, 0x54, 0x74, 0xa7, 0x6c, 0x9a, 0x3f }}; -+ grub_err_t rc; -+ -+ rc = grub_efi_set_variable_with_attributes(var_name, &vendor_guid, -+ data, size, -+ GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | GRUB_EFI_VARIABLE_RUNTIME_ACCESS); -+ -+ if (rc) -+ return grub_error (GRUB_ERR_BAD_DEVICE, N_("Failed to publish PCR snapshot to UEFI variable %s"), var_name); -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_tpm_record_pcrs (grub_extcmd_context_t ctxt, int argc, char **args) -+{ -+ struct grub_arg_list *state = ctxt->state; -+ grub_uint32_t pcr_bitmask = 0; -+ const char *efivar; -+ void *buffer = NULL; -+ grub_size_t size = 0; -+ int n, rv = 1; -+ -+ if (argc == 0) -+ pcr_bitmask = GRUB2_PCR_BITMASK_DEFAULT; -+ else -+ { -+ for (n = 0; n < argc; ++n) -+ if (grub_tpm_parse_pcr_list (args[n], &pcr_bitmask)) -+ return 1; -+ } -+ -+ if (grub_tpm_snapshot_pcrs (pcr_bitmask, NULL, &buffer, &size)) -+ goto out; -+ -+ if (state[0].set) -+ efivar = state[0].arg; -+ else -+ efivar = "GrubPcrSnapshot"; -+ -+ if (grub_tpm_write_pcrs_to_efi (buffer, size, efivar)) -+ goto out; -+ -+ rv = 0; -+ -+out: -+ if (buffer) -+ grub_free (buffer); -+ return rv; -+} -+ -+static grub_extcmd_t cmd; -+ - GRUB_MOD_INIT (tpm) - { -+ cmd = grub_register_extcmd ("tpm_record_pcrs", grub_tpm_record_pcrs, 0, -+ N_("LIST_OF_PCRS"), -+ N_("Snapshot one or more PCR values and record them in an EFI variable."), -+ grub_tpm_record_pcrs_options); - /* - * Even though this now calls ibmvtpm's grub_tpm_present() from GRUB_MOD_INIT(), - * it does seem to call it late enough in the initialization sequence so -@@ -109,6 +318,7 @@ GRUB_MOD_INIT (tpm) - - GRUB_MOD_FINI (tpm) - { -+ grub_unregister_extcmd (cmd); - if (!grub_tpm_present()) - return; - grub_verifier_unregister (&grub_tpm_verifier); --- -2.41.0 - diff --git a/0138-grub-install-record-pcrs.patch b/0138-grub-install-record-pcrs.patch deleted file mode 100644 index 725997e..0000000 --- a/0138-grub-install-record-pcrs.patch +++ /dev/null @@ -1,31 +0,0 @@ -From b5b02816fc33f1c45a984f3c9c7f26f058504422 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 10:46:45 +0800 -Subject: [PATCH 138/272] grub install record pcrs - -Signed-off-by: SUSE ---- - util/grub-install.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/util/grub-install.c b/util/grub-install.c -index 62012d055..0cdfa9f4e 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -1533,6 +1533,13 @@ main (int argc, char *argv[]) - - grub_util_unlink (load_cfg); - -+ if (1) -+ { -+ load_cfg_f = grub_util_fopen (load_cfg, "wb"); -+ have_load_cfg = 1; -+ fprintf (load_cfg_f, "tpm_record_pcrs 0-9\n"); -+ } -+ - if (debug_image && debug_image[0]) - { - load_cfg_f = grub_util_fopen (load_cfg, "wb"); --- -2.41.0 - diff --git a/0103-posix_wrap-tweaks-in-preparation-for-libtasn1.patch b/0138-posix_wrap-tweaks-in-preparation-for-libtasn1.patch similarity index 88% rename from 0103-posix_wrap-tweaks-in-preparation-for-libtasn1.patch rename to 0138-posix_wrap-tweaks-in-preparation-for-libtasn1.patch index 5589914..a473c1d 100644 --- a/0103-posix_wrap-tweaks-in-preparation-for-libtasn1.patch +++ b/0138-posix_wrap-tweaks-in-preparation-for-libtasn1.patch @@ -1,7 +1,7 @@ -From 8087cbbba135d02db30567af2376405486c924f4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Sat, 2 May 2020 00:27:57 +1000 -Subject: [PATCH 103/272] posix_wrap: tweaks in preparation for libtasn1 +Subject: [PATCH] posix_wrap: tweaks in preparation for libtasn1 - Define SIZEOF_UNSIGNED_LONG_INT, it's the same as SIZEOF_UNSIGNED_LONG. @@ -23,7 +23,7 @@ Signed-off-by: Daniel Axtens 3 files changed, 10 insertions(+) diff --git a/grub-core/lib/posix_wrap/limits.h b/grub-core/lib/posix_wrap/limits.h -index 26918c8a0..4be7b4080 100644 +index 26918c8a01b..4be7b408063 100644 --- a/grub-core/lib/posix_wrap/limits.h +++ b/grub-core/lib/posix_wrap/limits.h @@ -41,5 +41,6 @@ @@ -34,7 +34,7 @@ index 26918c8a0..4be7b4080 100644 #endif diff --git a/grub-core/lib/posix_wrap/stdlib.h b/grub-core/lib/posix_wrap/stdlib.h -index f5279756a..14e4efdd0 100644 +index f5279756abe..14e4efdd0d6 100644 --- a/grub-core/lib/posix_wrap/stdlib.h +++ b/grub-core/lib/posix_wrap/stdlib.h @@ -64,4 +64,12 @@ abort (void) @@ -51,7 +51,7 @@ index f5279756a..14e4efdd0 100644 + #endif diff --git a/grub-core/lib/posix_wrap/sys/types.h b/grub-core/lib/posix_wrap/sys/types.h -index eeda543c4..2f3e86549 100644 +index eeda543c47e..2f3e865495a 100644 --- a/grub-core/lib/posix_wrap/sys/types.h +++ b/grub-core/lib/posix_wrap/sys/types.h @@ -50,6 +50,7 @@ typedef grub_uint8_t byte; @@ -62,6 +62,3 @@ index eeda543c4..2f3e86549 100644 #define SIZEOF_UNSIGNED_INT 4 #define SIZEOF_UNSIGNED_LONG_LONG 8 #define SIZEOF_UNSIGNED_SHORT 2 --- -2.41.0 - diff --git a/0104-libtasn1-import-libtasn1-4.18.0.patch b/0139-libtasn1-import-libtasn1-4.16.0.patch similarity index 85% rename from 0104-libtasn1-import-libtasn1-4.18.0.patch rename to 0139-libtasn1-import-libtasn1-4.16.0.patch index 36560c1..89552c8 100644 --- a/0104-libtasn1-import-libtasn1-4.18.0.patch +++ b/0139-libtasn1-import-libtasn1-4.16.0.patch @@ -1,192 +1,64 @@ -From e10facd904c4c0aeecda0a005d7a7cf1a5cff1c2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Wed, 10 Jun 2020 16:31:22 +1000 -Subject: [PATCH 104/272] libtasn1: import libtasn1-4.18.0 +Subject: [PATCH] libtasn1: import libtasn1-4.16.0 Import a very trimmed-down set of libtasn1 files: pushd /tmp -wget https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.18.0.tar.gz -tar -xf libtasn1-4.18.0.tar.gz +wget https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.16.0.tar.gz popd pushd grub-core/lib -rm -rf libtasn1 mkdir libtasn1 -cp /tmp/libtasn1-4.18.0/{README.md,COPYING} libtasn1/ +cp /tmp/libtasn1-4.16.0/{README.md,LICENSE} libtasn1/ mkdir libtasn1/lib -cp /tmp/libtasn1-4.18.0/lib/{coding.c,decoding.c,element.c,element.h,errors.c,gstr.c,gstr.h,int.h,parser_aux.c,parser_aux.h,structure.c,structure.h} libtasn1/lib -cp /tmp/libtasn1-4.18.0/lib/includes/libtasn1.h ../../include/grub/ +cp /tmp/libtasn1-4.16.0/lib/{coding.c,decoding.c,element.c,element.h,errors.c,gstr.c,gstr.h,int.h,parser_aux.c,parser_aux.h,structure.c,structure.h} libtasn1/lib +cp /tmp/libtasn1-4.16.0/lib/includes/libtasn1.h ../../include/grub/ git add libtasn1/ ../../include/grub/libtasn1.h popd Signed-off-by: Daniel Axtens --- - grub-core/lib/libtasn1/COPYING | 16 + - grub-core/lib/libtasn1/README.md | 98 + - grub-core/lib/libtasn1/lib/coding.c | 1425 +++++++++++++ - grub-core/lib/libtasn1/lib/decoding.c | 2501 +++++++++++++++++++++++ - grub-core/lib/libtasn1/lib/element.c | 1109 ++++++++++ - grub-core/lib/libtasn1/lib/element.h | 42 + - grub-core/lib/libtasn1/lib/errors.c | 100 + + grub-core/lib/libtasn1/lib/coding.c | 1415 ++++++++++++++++++ + grub-core/lib/libtasn1/lib/decoding.c | 2478 +++++++++++++++++++++++++++++++ + grub-core/lib/libtasn1/lib/element.c | 1111 ++++++++++++++ + grub-core/lib/libtasn1/lib/errors.c | 100 ++ grub-core/lib/libtasn1/lib/gstr.c | 74 + - grub-core/lib/libtasn1/lib/gstr.h | 50 + - grub-core/lib/libtasn1/lib/int.h | 221 ++ - grub-core/lib/libtasn1/lib/parser_aux.c | 1178 +++++++++++ - grub-core/lib/libtasn1/lib/parser_aux.h | 172 ++ - grub-core/lib/libtasn1/lib/structure.c | 1225 +++++++++++ - grub-core/lib/libtasn1/lib/structure.h | 46 + - include/grub/libtasn1.h | 639 ++++++ - 15 files changed, 8896 insertions(+) - create mode 100644 grub-core/lib/libtasn1/COPYING - create mode 100644 grub-core/lib/libtasn1/README.md + grub-core/lib/libtasn1/lib/parser_aux.c | 1173 +++++++++++++++ + grub-core/lib/libtasn1/lib/structure.c | 1220 +++++++++++++++ + grub-core/lib/libtasn1/lib/element.h | 40 + + grub-core/lib/libtasn1/lib/gstr.h | 47 + + grub-core/lib/libtasn1/lib/int.h | 221 +++ + grub-core/lib/libtasn1/lib/parser_aux.h | 172 +++ + grub-core/lib/libtasn1/lib/structure.h | 45 + + include/grub/libtasn1.h | 588 ++++++++ + grub-core/lib/libtasn1/LICENSE | 16 + + grub-core/lib/libtasn1/README.md | 91 ++ + 15 files changed, 8791 insertions(+) create mode 100644 grub-core/lib/libtasn1/lib/coding.c create mode 100644 grub-core/lib/libtasn1/lib/decoding.c create mode 100644 grub-core/lib/libtasn1/lib/element.c - create mode 100644 grub-core/lib/libtasn1/lib/element.h create mode 100644 grub-core/lib/libtasn1/lib/errors.c create mode 100644 grub-core/lib/libtasn1/lib/gstr.c + create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.c + create mode 100644 grub-core/lib/libtasn1/lib/structure.c + create mode 100644 grub-core/lib/libtasn1/lib/element.h create mode 100644 grub-core/lib/libtasn1/lib/gstr.h create mode 100644 grub-core/lib/libtasn1/lib/int.h - create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.c create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.h - create mode 100644 grub-core/lib/libtasn1/lib/structure.c create mode 100644 grub-core/lib/libtasn1/lib/structure.h create mode 100644 include/grub/libtasn1.h + create mode 100644 grub-core/lib/libtasn1/LICENSE + create mode 100644 grub-core/lib/libtasn1/README.md -diff --git a/grub-core/lib/libtasn1/COPYING b/grub-core/lib/libtasn1/COPYING -new file mode 100644 -index 000000000..e8b3628db ---- /dev/null -+++ b/grub-core/lib/libtasn1/COPYING -@@ -0,0 +1,16 @@ -+LICENSING -+========= -+ -+The libtasn1 library is released under the GNU Lesser General Public -+License (LGPL) version 2.1 or later; see [COPYING.LESSER](doc/COPYING.LESSER) -+for the license terms. -+ -+The GNU LGPL applies to the main libtasn1 library, while the -+included applications library are under the GNU GPL version 3. -+The libtasn1 library is located in the lib directory, while the applications -+in src/. -+ -+The documentation in doc/ is under the GNU FDL license 1.3. -+ -+For any copyright year range specified as YYYY-ZZZZ in this package -+note that the range specifies every single year in that closed interval. -diff --git a/grub-core/lib/libtasn1/README.md b/grub-core/lib/libtasn1/README.md -new file mode 100644 -index 000000000..b0305b93e ---- /dev/null -+++ b/grub-core/lib/libtasn1/README.md -@@ -0,0 +1,98 @@ -+# Libtasn1 README -- Introduction information -+ -+This is GNU Libtasn1, a small ASN.1 library. -+ -+The C library (libtasn1.*) is licensed under the GNU Lesser General -+Public License version 2.1 or later. See the file COPYING.LIB. -+ -+The command line tool, self tests, examples, and other auxilliary -+files, are licensed under the GNU General Public License version 3.0 -+or later. See the file COPYING. -+ -+## Building the library -+ -+We require several tools to build the software, including: -+ -+* [Make](https://www.gnu.org/software/make/) -+* [Automake](https://www.gnu.org/software/automake/) (use 1.11.3 or later) -+* [Autoconf](https://www.gnu.org/software/autoconf/) -+* [Libtool](https://www.gnu.org/software/libtool/) -+* [Texinfo](https://www.gnu.org/software/texinfo/) -+* [help2man](http://www.gnu.org/software/help2man/) -+* [Tar](https://www.gnu.org/software/tar/) -+* [Gzip](https://www.gnu.org/software/gzip/) -+* [bison](https://www.gnu.org/software/bison/) -+* [Texlive & epsf](https://www.tug.org/texlive/) (for PDF manual) -+* [GTK-DOC](https://www.gtk.org/gtk-doc/) (for API manual) -+* [Git](https://git-scm.com/) -+* [libabigail](https://pagure.io/libabigail/) (for abi comparison in make dist) -+* [Valgrind](https://valgrind.org/) (optional) -+ -+The required software is typically distributed with your operating -+system, and the instructions for installing them differ. Here are -+some hints: -+ -+Debian/Ubuntu: -+``` -+sudo apt-get install make git autoconf automake libtool bison -+sudo apt-get install texinfo help2man gtk-doc-tools valgrind abigail-tools -+``` -+ -+PDF manual - Debian <= stretch: -+``` -+sudo apt-get install texlive-generic-recommended texlive texlive-extra-utils -+``` -+ -+PDF manual - Debian >= buster: -+``` -+sudo apt-get install texlive-plain-generic texlive texlive-extra-utils -+``` -+ -+The next step is to run autoreconf, ./configure, etc: -+ -+``` -+$ ./bootstrap -+``` -+ -+Then build the project normally: -+ -+``` -+$ ./configure -+$ make check -+``` -+ -+Happy hacking! -+ -+ -+## Manual -+ -+The manual is in the `doc/` directory of the release. -+ -+You can also browse the manual online at: -+ -+ - https://www.gnu.org/software/libtasn1/manual/ -+ - https://gnutls.gitlab.io/libtasn1/manual/ -+ - https://gnutls.gitlab.io/libtasn1/manual/libtasn1.html -+ - https://gnutls.gitlab.io/libtasn1/manual/libtasn1.pdf -+ - https://gnutls.gitlab.io/libtasn1/reference/ -+ - https://gnutls.gitlab.io/libtasn1/reference/libtasn1.pdf -+ -+ -+## Code coverage report -+ -+The coverage report is at: -+ -+ - https://gnutls.gitlab.io/libtasn1/coverage -+ -+ -+## Issue trackers -+ -+ - [Main issue tracker](https://gitlab.com/gnutls/libtasn1/issues) -+ - [oss-fuzz found issues](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=libtasn1&can=2) -+ -+ -+## Homepage -+ -+The project homepage at the gnu site is at: -+ -+https://www.gnu.org/software/libtasn1/ diff --git a/grub-core/lib/libtasn1/lib/coding.c b/grub-core/lib/libtasn1/lib/coding.c new file mode 100644 -index 000000000..671104f63 +index 00000000000..245ea64cf0a --- /dev/null +++ b/grub-core/lib/libtasn1/lib/coding.c -@@ -0,0 +1,1425 @@ +@@ -0,0 +1,1415 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -452,6 +324,9 @@ index 000000000..671104f63 + int len_len; + int max_len; + ++ if (der == NULL) ++ return ASN1_VALUE_NOT_VALID; ++ + max_len = *der_len; + + asn1_length_der (str_len, (max_len > 0) ? der : NULL, &len_len); @@ -504,14 +379,14 @@ index 000000000..671104f63 +} +*/ + -+static void -+encode_val (uint64_t val, unsigned char *der, int max_len, int *der_len) ++static ++void encode_val(uint64_t val, unsigned char *der, int max_len, int *der_len) +{ + int first, k; + unsigned char bit7; + + first = 0; -+ for (k = sizeof (val); k >= 0; k--) ++ for (k = sizeof(val); k >= 0; k--) + { + bit7 = (val >> (k * 7)) & 0x7F; + if (bit7 || first || !k) @@ -572,30 +447,30 @@ index 000000000..671104f63 + counter++; + + if (counter == 1) -+ { ++ { + val1 = val; + } + else if (counter == 2) + { + uint64_t val0; + -+ if (val1 > 2) -+ { -+ free (temp); -+ return ASN1_VALUE_NOT_VALID; -+ } -+ else if ((val1 == 0 || val1 == 1) && val > 39) -+ { -+ free (temp); -+ return ASN1_VALUE_NOT_VALID; -+ } ++ if (val1 > 2) ++ { ++ free(temp); ++ return ASN1_VALUE_NOT_VALID; ++ } ++ else if ((val1 == 0 || val1 == 1) && val > 39) ++ { ++ free(temp); ++ return ASN1_VALUE_NOT_VALID; ++ } + + val0 = 40 * val1 + val; -+ encode_val (val0, der, max_len, der_len); ++ encode_val(val0, der, max_len, der_len); + } + else + { -+ encode_val (val, der, max_len, der_len); ++ encode_val(val, der, max_len, der_len); + } + n_start = n_end + 1; + } @@ -630,9 +505,7 @@ index 000000000..671104f63 + * vector isn't big enough and in this case @der_len will contain the + * length needed. + **/ -+int -+asn1_object_id_der (const char *str, unsigned char *der, int *der_len, -+ unsigned flags) ++int asn1_object_id_der(const char *str, unsigned char *der, int *der_len, unsigned flags) +{ + unsigned char tag_der[MAX_TAG_LEN]; + int tag_len = 0, r; @@ -640,12 +513,12 @@ index 000000000..671104f63 + + *der_len = 0; + -+ _asn1_tag_der (ETYPE_CLASS (ASN1_ETYPE_OBJECT_ID), -+ ETYPE_TAG (ASN1_ETYPE_OBJECT_ID), tag_der, &tag_len); ++ _asn1_tag_der (ETYPE_CLASS (ASN1_ETYPE_OBJECT_ID), ETYPE_TAG (ASN1_ETYPE_OBJECT_ID), ++ tag_der, &tag_len); + + if (max_len > tag_len) + { -+ memcpy (der, tag_der, tag_len); ++ memcpy(der, tag_der, tag_len); + } + max_len -= tag_len; + der += tag_len; @@ -737,7 +610,7 @@ index 000000000..671104f63 + { + p = node->down; + if (p == NULL) -+ return ASN1_DER_ERROR; ++ return ASN1_DER_ERROR; + /* When there are nested tags we must complete them reverse to + the order they were created. This is because completing a tag + modifies all data within it, including the incomplete tags @@ -855,8 +728,7 @@ index 000000000..671104f63 +{ + asn1_node p; + int tag_len, is_tag_implicit; -+ unsigned char class, class_implicit = -+ 0, temp[MAX (SIZEOF_UNSIGNED_INT * 3 + 1, LTOSTR_MAX_SIZE)]; ++ unsigned char class, class_implicit = 0, temp[MAX(SIZEOF_UNSIGNED_INT * 3 + 1, LTOSTR_MAX_SIZE)]; + unsigned long tag_implicit = 0; + unsigned char tag_der[MAX_TAG_LEN]; + @@ -986,7 +858,7 @@ index 000000000..671104f63 + + p = node->down; + while (p && ((type_field (p->type) == ASN1_ETYPE_TAG) || -+ (type_field (p->type) == ASN1_ETYPE_SIZE))) ++ (type_field (p->type) == ASN1_ETYPE_SIZE))) + p = p->right; + + if ((p == NULL) || (p->right == NULL)) @@ -997,7 +869,7 @@ index 000000000..671104f63 + { + p_vet = malloc (sizeof (struct vet)); + if (p_vet == NULL) -+ { ++ { + err = ASN1_MEM_ALLOC_ERROR; + goto error; + } @@ -1016,7 +888,7 @@ index 000000000..671104f63 + if (err != ASN1_SUCCESS) + goto error; + -+ t = ((unsigned int) class) << 24; ++ t = ((unsigned int)class) << 24; + p_vet->value = t | tag; + counter += len2; + @@ -1084,7 +956,7 @@ index 000000000..671104f63 + { + p_vet = first; + first = first->next; -+ free (p_vet); ++ free(p_vet); + } + return err; +} @@ -1095,8 +967,7 @@ index 000000000..671104f63 + int size; +}; + -+static int -+setof_compar (const void *_e1, const void *_e2) ++static int setof_compar(const void *_e1, const void *_e2) +{ + unsigned length; + const struct vet *e1 = _e1, *e2 = _e2; @@ -1109,15 +980,15 @@ index 000000000..671104f63 + * The padding octets are for comparison purposes and + * do not appear in the encodings. + */ -+ length = MIN (e1->size, e2->size); ++ length = MIN(e1->size, e2->size); + -+ rval = memcmp (e1->ptr, e2->ptr, length); ++ rval = memcmp(e1->ptr, e2->ptr, length); + if (rval == 0 && e1->size != e2->size) + { + if (e1->size > e2->size) -+ rval = 1; ++ rval = 1; + else if (e2->size > e1->size) -+ rval = -1; ++ rval = -1; + } + + return rval; @@ -1147,6 +1018,9 @@ index 000000000..671104f63 + unsigned char *out = NULL; + int err; + ++ if (der == NULL) ++ return ASN1_VALUE_NOT_VALID; ++ + counter = 0; + + if (type_field (node->type) != ASN1_ETYPE_SET_OF) @@ -1154,7 +1028,7 @@ index 000000000..671104f63 + + p = node->down; + while (p && ((type_field (p->type) == ASN1_ETYPE_TAG) || -+ (type_field (p->type) == ASN1_ETYPE_SIZE))) ++ (type_field (p->type) == ASN1_ETYPE_SIZE))) + p = p->right; + if (p == NULL) + return ASN1_VALUE_NOT_VALID; @@ -1166,27 +1040,27 @@ index 000000000..671104f63 + while (p) + { + list_size++; -+ tlist = realloc (list, list_size * sizeof (struct vet)); ++ tlist = realloc (list, list_size*sizeof(struct vet)); + if (tlist == NULL) + { + err = ASN1_MEM_ALLOC_ERROR; + goto error; + } + list = tlist; -+ p_vet = &list[list_size - 1]; ++ p_vet = &list[list_size-1]; + -+ p_vet->ptr = der + counter; ++ p_vet->ptr = der+counter; + p_vet->size = 0; + + /* extraction of tag and length */ + if (der_len - counter > 0) + { + err = asn1_get_tag_der (der + counter, der_len - counter, &class, -+ &len, NULL); ++ &len, NULL); + if (err != ASN1_SUCCESS) + goto error; + counter += len; -+ p_vet->size += len; ++ p_vet->size += len; + + len2 = asn1_get_length_der (der + counter, der_len - counter, &len); + if (len2 < 0) @@ -1195,7 +1069,7 @@ index 000000000..671104f63 + goto error; + } + counter += len + len2; -+ p_vet->size += len + len2; ++ p_vet->size += len + len2; + + } + else @@ -1212,9 +1086,9 @@ index 000000000..671104f63 + goto error; + } + -+ qsort (list, list_size, sizeof (struct vet), setof_compar); ++ qsort(list, list_size, sizeof(struct vet), setof_compar); + -+ out = malloc (der_len); ++ out = malloc(der_len); + if (out == NULL) + { + err = ASN1_MEM_ERROR; @@ -1226,16 +1100,16 @@ index 000000000..671104f63 + for (i = 0; i < list_size; i++) + { + p_vet = &list[i]; -+ memcpy (out + counter, p_vet->ptr, p_vet->size); ++ memcpy(out+counter, p_vet->ptr, p_vet->size); + counter += p_vet->size; + } -+ memcpy (der, out, der_len); -+ free (out); ++ memcpy(der, out, der_len); ++ free(out); + + err = ASN1_SUCCESS; + +error: -+ free (list); ++ free(list); + return err; +} + @@ -1261,15 +1135,14 @@ index 000000000..671104f63 + * length needed. + **/ +int -+asn1_der_coding (asn1_node_const element, const char *name, void *ider, -+ int *len, char *ErrorDescription) ++asn1_der_coding (asn1_node_const element, const char *name, void *ider, int *len, ++ char *ErrorDescription) +{ + asn1_node node, p, p2; -+ unsigned char temp[MAX (LTOSTR_MAX_SIZE, SIZEOF_UNSIGNED_LONG_INT * 3 + 1)]; ++ unsigned char temp[MAX(LTOSTR_MAX_SIZE, SIZEOF_UNSIGNED_LONG_INT * 3 + 1)]; + int counter, counter_old, len2, len3, move, max_len, max_len_old; + int err; + unsigned char *der = ider; -+ unsigned char dummy; + + if (ErrorDescription) + ErrorDescription[0] = 0; @@ -1289,10 +1162,7 @@ index 000000000..671104f63 + max_len = *len; + + if (der == NULL && max_len > 0) -+ { -+ err = ASN1_VALUE_NOT_VALID; -+ goto error; -+ } ++ return ASN1_VALUE_NOT_VALID; + + counter = 0; + move = DOWN; @@ -1305,7 +1175,7 @@ index 000000000..671104f63 + max_len_old = max_len; + if (move != UP) + { -+ p->start = counter; ++ p->start = counter; + err = _asn1_insert_tag_der (p, der, &counter, &max_len); + if (err != ASN1_SUCCESS && err != ASN1_MEM_ERROR) + goto error; @@ -1393,9 +1263,7 @@ index 000000000..671104f63 + goto error; + } + len2 = max_len; -+ err = -+ _asn1_object_id_der ((char *) p->value, -+ der ? der + counter : &dummy, &len2); ++ err = _asn1_object_id_der ((char*)p->value, der + counter, &len2); + if (err != ASN1_SUCCESS && err != ASN1_MEM_ERROR) + goto error; + @@ -1413,9 +1281,7 @@ index 000000000..671104f63 + goto error; + } + len2 = max_len; -+ err = -+ _asn1_time_der (p->value, p->value_len, -+ der ? der + counter : &dummy, &len2); ++ err = _asn1_time_der (p->value, p->value_len, der + counter, &len2); + if (err != ASN1_SUCCESS && err != ASN1_MEM_ERROR) + goto error; + @@ -1483,9 +1349,7 @@ index 000000000..671104f63 + p->tmp_ival = 0; + if ((type_field (p->type) == ASN1_ETYPE_SET) && (max_len >= 0)) + { -+ err = -+ _asn1_ordering_set (der ? der + len2 : &dummy, -+ counter - len2, p); ++ err = _asn1_ordering_set (der + len2, counter - len2, p); + if (err != ASN1_SUCCESS) + goto error; + } @@ -1526,9 +1390,7 @@ index 000000000..671104f63 + if ((type_field (p->type) == ASN1_ETYPE_SET_OF) + && (counter - len2 > 0) && (max_len >= 0)) + { -+ err = -+ _asn1_ordering_set_of (der ? der + len2 : &dummy, -+ counter - len2, p); ++ err = _asn1_ordering_set_of (der + len2, counter - len2, p); + if (err != ASN1_SUCCESS) + goto error; + } @@ -1569,7 +1431,7 @@ index 000000000..671104f63 + + if ((move != DOWN) && (counter != counter_old)) + { -+ p->end = counter - 1; ++ p->end = counter - 1; + err = _asn1_complete_explicit_tag (p, der, &counter, &max_len); + if (err != ASN1_SUCCESS && err != ASN1_MEM_ERROR) + goto error; @@ -1612,12 +1474,12 @@ index 000000000..671104f63 +} diff --git a/grub-core/lib/libtasn1/lib/decoding.c b/grub-core/lib/libtasn1/lib/decoding.c new file mode 100644 -index 000000000..b1a35356f +index 00000000000..ff04eb778cb --- /dev/null +++ b/grub-core/lib/libtasn1/lib/decoding.c -@@ -0,0 +1,2501 @@ +@@ -0,0 +1,2478 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2016 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -1650,7 +1512,7 @@ index 000000000..b1a35356f +#include +#include +#include -+#include "c-ctype.h" ++#include + +#ifdef DEBUG +# define warn() fprintf(stderr, "%s: %d\n", __func__, __LINE__) @@ -1689,19 +1551,18 @@ index 000000000..b1a35356f + } while (0) + +static int -+_asn1_get_indefinite_length_string (const unsigned char *der, int der_len, -+ int *len); ++_asn1_get_indefinite_length_string (const unsigned char *der, int der_len, int *len); + +static int +_asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, -+ unsigned int _der_len, unsigned char **str, -+ unsigned int *str_len, unsigned int *ber_len, -+ unsigned dflags); ++ unsigned int _der_len, unsigned char **str, ++ unsigned int *str_len, unsigned int *ber_len, ++ unsigned dflags); + +static int +_asn1_decode_simple_der (unsigned int etype, const unsigned char *der, -+ unsigned int _der_len, const unsigned char **str, -+ unsigned int *str_len, unsigned dflags); ++ unsigned int _der_len, const unsigned char **str, ++ unsigned int *str_len, unsigned dflags); + +static void +_asn1_error_description_tag_error (asn1_node node, char *ErrorDescription) @@ -1748,7 +1609,7 @@ index 000000000..b1a35356f + k = der[0] & 0x7F; + punt = 1; + if (k) -+ { /* definite length method */ ++ { /* definite length method */ + ans = 0; + while (punt <= k && punt < der_len) + { @@ -1874,7 +1735,7 @@ index 000000000..b1a35356f + + if (ret == -1 && ber_len > 1) + { /* indefinite length method */ -+ err = _asn1_get_indefinite_length_string (ber + 1, ber_len - 1, &ret); ++ err = _asn1_get_indefinite_length_string (ber + 1, ber_len-1, &ret); + if (err != ASN1_SUCCESS) + return -3; + } @@ -1916,7 +1777,7 @@ index 000000000..b1a35356f + if (str_size >= *str_len) + { + if (*str_len > 0 && str != NULL) -+ memcpy (str, der + len_len, *str_len); ++ memcpy (str, der + len_len, *str_len); + } + else + { @@ -1944,8 +1805,8 @@ index 000000000..b1a35356f + * Returns: %ASN1_SUCCESS on success, or an error. + -*/ +static int -+_asn1_get_time_der (unsigned type, const unsigned char *der, int der_len, -+ int *ret_len, char *str, int str_size, unsigned flags) ++_asn1_get_time_der (unsigned type, const unsigned char *der, int der_len, int *ret_len, ++ char *str, int str_size, unsigned flags) +{ + int len_len, str_len; + unsigned i; @@ -1963,47 +1824,46 @@ index 000000000..b1a35356f + /* perform some sanity checks on the data */ + if (str_len < 8) + { -+ warn (); ++ warn(); + return ASN1_TIME_ENCODING_ERROR; + } + -+ if ((flags & ASN1_DECODE_FLAG_STRICT_DER) -+ && !(flags & ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME)) ++ if ((flags & ASN1_DECODE_FLAG_STRICT_DER) && !(flags & ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME)) + { + p = &der[len_len]; -+ for (i = 0; i < (unsigned) (str_len - 1); i++) -+ { -+ if (c_isdigit (p[i]) == 0) -+ { -+ if (type == ASN1_ETYPE_GENERALIZED_TIME) -+ { -+ /* tolerate lax encodings */ -+ if (p[i] == '.' && dot_count == 0) -+ { -+ dot_count++; -+ continue; -+ } -+ -+ /* This is not really valid DER, but there are -+ * structures using that */ -+ if (!(flags & ASN1_DECODE_FLAG_STRICT_DER) && -+ (p[i] == '+' || p[i] == '-') && sign_count == 0) -+ { -+ sign_count++; -+ continue; -+ } -+ } -+ -+ warn (); -+ return ASN1_TIME_ENCODING_ERROR; -+ } -+ } -+ -+ if (sign_count == 0 && p[str_len - 1] != 'Z') -+ { -+ warn (); -+ return ASN1_TIME_ENCODING_ERROR; -+ } ++ for (i=0;i<(unsigned)(str_len-1);i++) ++ { ++ if (c_isdigit(p[i]) == 0) ++ { ++ if (type == ASN1_ETYPE_GENERALIZED_TIME) ++ { ++ /* tolerate lax encodings */ ++ if (p[i] == '.' && dot_count == 0) ++ { ++ dot_count++; ++ continue; ++ } ++ ++ /* This is not really valid DER, but there are ++ * structures using that */ ++ if (!(flags & ASN1_DECODE_FLAG_STRICT_DER) && ++ (p[i] == '+' || p[i] == '-') && sign_count == 0) ++ { ++ sign_count++; ++ continue; ++ } ++ } ++ ++ warn(); ++ return ASN1_TIME_ENCODING_ERROR; ++ } ++ } ++ ++ if (sign_count == 0 && p[str_len-1] != 'Z') ++ { ++ warn(); ++ return ASN1_TIME_ENCODING_ERROR; ++ } + } + memcpy (str, der + len_len, str_len); + str[str_len] = 0; @@ -2074,11 +1934,11 @@ index 000000000..b1a35356f + { + val = 1; + val1 = val0 - 40; -+ if (val1 > 39) -+ { -+ val = 2; -+ val1 = val0 - 80; -+ } ++ if (val1 > 39) ++ { ++ val = 2; ++ val1 = val0 - 80; ++ } + } + + _asn1_str_cpy (str, str_size, _asn1_ltostr (val, temp)); @@ -2155,7 +2015,7 @@ index 000000000..b1a35356f + if (str_size >= len_byte) + { + if (len_byte > 0 && str) -+ memcpy (str, der + len_len + 1, len_byte); ++ memcpy (str, der + len_len + 1, len_byte); + } + else + { @@ -2206,19 +2066,21 @@ index 000000000..b1a35356f + &tag) != ASN1_SUCCESS) + return ASN1_DER_ERROR; + -+ DECR_LEN (der_len, len2); ++ DECR_LEN(der_len, len2); + counter += len2; + + if (flags & ASN1_DECODE_FLAG_STRICT_DER) + len3 = -+ asn1_get_length_der (der + counter, der_len, &len2); ++ asn1_get_length_der (der + counter, der_len, ++ &len2); + else + len3 = -+ asn1_get_length_ber (der + counter, der_len, &len2); ++ asn1_get_length_ber (der + counter, der_len, ++ &len2); + if (len3 < 0) + return ASN1_DER_ERROR; + -+ DECR_LEN (der_len, len2); ++ DECR_LEN(der_len, len2); + counter += len2; + + if (!is_tag_implicit) @@ -2256,10 +2118,11 @@ index 000000000..b1a35356f + if (is_tag_implicit) + { + if (asn1_get_tag_der -+ (der + counter, der_len, &class, &len2, &tag) != ASN1_SUCCESS) ++ (der + counter, der_len, &class, &len2, ++ &tag) != ASN1_SUCCESS) + return ASN1_DER_ERROR; + -+ DECR_LEN (der_len, len2); ++ DECR_LEN(der_len, len2); + + if ((class != class_implicit) || (tag != tag_implicit)) + { @@ -2285,10 +2148,11 @@ index 000000000..b1a35356f + } + + if (asn1_get_tag_der -+ (der + counter, der_len, &class, &len2, &tag) != ASN1_SUCCESS) ++ (der + counter, der_len, &class, &len2, ++ &tag) != ASN1_SUCCESS) + return ASN1_DER_ERROR; + -+ DECR_LEN (der_len, len2); ++ DECR_LEN(der_len, len2); + + switch (type) + { @@ -2349,32 +2213,28 @@ index 000000000..b1a35356f +} + +static int -+extract_tag_der_recursive (asn1_node node, const unsigned char *der, -+ int der_len, int *ret_len, int *inner_len, -+ unsigned flags) ++extract_tag_der_recursive(asn1_node node, const unsigned char *der, int der_len, ++ int *ret_len, int *inner_len, unsigned flags) +{ -+ asn1_node p; -+ int ris = ASN1_DER_ERROR; ++asn1_node p; ++int ris = ASN1_DER_ERROR; + + if (type_field (node->type) == ASN1_ETYPE_CHOICE) + { + p = node->down; + while (p) -+ { -+ ris = -+ _asn1_extract_tag_der (p, der, der_len, ret_len, inner_len, -+ flags); -+ if (ris == ASN1_SUCCESS) -+ break; -+ p = p->right; ++ { ++ ris = _asn1_extract_tag_der (p, der, der_len, ret_len, inner_len, flags); ++ if (ris == ASN1_SUCCESS) ++ break; ++ p = p->right; + } + + *ret_len = 0; + return ris; + } + else -+ return _asn1_extract_tag_der (node, der, der_len, ret_len, inner_len, -+ flags); ++ return _asn1_extract_tag_der (node, der, der_len, ret_len, inner_len, flags); +} + +static int @@ -2449,11 +2309,10 @@ index 000000000..b1a35356f + + while (1) + { -+ if (HAVE_TWO (der_len) && (der[counter] == 0) -+ && (der[counter + 1] == 0)) ++ if (HAVE_TWO(der_len) && (der[counter] == 0) && (der[counter + 1] == 0)) + { + counter += 2; -+ DECR_LEN (der_len, 2); ++ DECR_LEN(der_len, 2); + + indefinite--; + if (indefinite <= 0) @@ -2463,10 +2322,11 @@ index 000000000..b1a35356f + } + + if (asn1_get_tag_der -+ (der + counter, der_len, &class, &len2, &tag) != ASN1_SUCCESS) ++ (der + counter, der_len, &class, &len2, ++ &tag) != ASN1_SUCCESS) + return ASN1_DER_ERROR; + -+ DECR_LEN (der_len, len2); ++ DECR_LEN(der_len, len2); + counter += len2; + + len2 = asn1_get_length_der (der + counter, der_len, &len3); @@ -2477,12 +2337,12 @@ index 000000000..b1a35356f + { + indefinite++; + counter += 1; -+ DECR_LEN (der_len, 1); ++ DECR_LEN(der_len, 1); + } + else + { + counter += len2 + len3; -+ DECR_LEN (der_len, len2 + len3); ++ DECR_LEN(der_len, len2+len3); + } + } + @@ -2493,8 +2353,7 @@ index 000000000..b1a35356f + return result; +} + -+static void -+delete_unneeded_choice_fields (asn1_node p) ++static void delete_unneeded_choice_fields(asn1_node p) +{ + asn1_node p2; + @@ -2533,13 +2392,13 @@ index 000000000..b1a35356f + * name (*@ELEMENT deleted). + **/ +int -+asn1_der_decoding2 (asn1_node * element, const void *ider, int *max_ider_len, ++asn1_der_decoding2 (asn1_node *element, const void *ider, int *max_ider_len, + unsigned int flags, char *errorDescription) +{ + asn1_node node, p, p2, p3; + char temp[128]; + int counter, len2, len3, len4, move, ris, tlen; -+ struct node_tail_cache_st tcache = { NULL, NULL }; ++ struct node_tail_cache_st tcache = {NULL, NULL}; + unsigned char class; + unsigned long tag; + int tag_len; @@ -2560,7 +2419,7 @@ index 000000000..b1a35356f + if (node->type & CONST_OPTION) + { + result = ASN1_GENERIC_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + @@ -2580,13 +2439,12 @@ index 000000000..b1a35356f + len2 = p2->tmp_ival; + if (len2 == -1) + { -+ if (HAVE_TWO (ider_len) && !der[counter] -+ && !der[counter + 1]) ++ if (HAVE_TWO(ider_len) && !der[counter] && !der[counter + 1]) + { + p = p2; + move = UP; + counter += 2; -+ DECR_LEN (ider_len, 2); ++ DECR_LEN(ider_len, 2); + continue; + } + } @@ -2599,7 +2457,7 @@ index 000000000..b1a35356f + else if (counter > len2) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + p2 = p2->down; @@ -2608,9 +2466,8 @@ index 000000000..b1a35356f + if ((p2->type & CONST_SET) && (p2->type & CONST_NOT_USED)) + { + ris = -+ extract_tag_der_recursive (p2, der + counter, -+ ider_len, &len2, NULL, -+ flags); ++ extract_tag_der_recursive (p2, der + counter, ++ ider_len, &len2, NULL, flags); + if (ris == ASN1_SUCCESS) + { + p2->type &= ~CONST_NOT_USED; @@ -2623,7 +2480,7 @@ index 000000000..b1a35356f + if (p2 == NULL) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + } @@ -2659,18 +2516,18 @@ index 000000000..b1a35356f + while (p->down) + { + ris = -+ extract_tag_der_recursive (p->down, der + counter, -+ ider_len, &len2, NULL, flags); ++ extract_tag_der_recursive (p->down, der + counter, ++ ider_len, &len2, NULL, flags); + + if (ris == ASN1_SUCCESS) + { -+ delete_unneeded_choice_fields (p->down); ++ delete_unneeded_choice_fields(p->down); + break; + } + else if (ris == ASN1_ERROR_TYPE_ANY) + { + result = ASN1_ERROR_TYPE_ANY; -+ warn (); ++ warn(); + goto cleanup; + } + else @@ -2685,7 +2542,7 @@ index 000000000..b1a35356f + if (!(p->type & CONST_OPTION)) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + } @@ -2707,7 +2564,7 @@ index 000000000..b1a35356f + if (ris == ASN1_SUCCESS) + ris = + extract_tag_der_recursive (p, der + counter, ider_len, -+ &tag_len, &inner_tag_len, flags); ++ &tag_len, &inner_tag_len, flags); + + if (ris != ASN1_SUCCESS) + { @@ -2727,13 +2584,13 @@ index 000000000..b1a35356f + _asn1_error_description_tag_error (p, errorDescription); + + result = ASN1_TAG_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + } + else + { -+ DECR_LEN (ider_len, tag_len); ++ DECR_LEN(ider_len, tag_len); + counter += tag_len; + } + } @@ -2743,23 +2600,23 @@ index 000000000..b1a35356f + switch (type_field (p->type)) + { + case ASN1_ETYPE_NULL: -+ DECR_LEN (ider_len, 1); ++ DECR_LEN(ider_len, 1); + if (der[counter]) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + counter++; + move = RIGHT; + break; + case ASN1_ETYPE_BOOLEAN: -+ DECR_LEN (ider_len, 2); ++ DECR_LEN(ider_len, 2); + + if (der[counter++] != 1) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + if (der[counter++] == 0) @@ -2770,15 +2627,16 @@ index 000000000..b1a35356f + break; + case ASN1_ETYPE_INTEGER: + case ASN1_ETYPE_ENUMERATED: -+ len2 = asn1_get_length_der (der + counter, ider_len, &len3); ++ len2 = ++ asn1_get_length_der (der + counter, ider_len, &len3); + if (len2 < 0) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len3 + len2); ++ DECR_LEN(ider_len, len3+len2); + + _asn1_set_value (p, der + counter, len3 + len2); + counter += len3 + len2; @@ -2789,12 +2647,12 @@ index 000000000..b1a35356f + asn1_get_object_id_der (der + counter, ider_len, &len2, + temp, sizeof (temp)); + if (result != ASN1_SUCCESS) -+ { -+ warn (); ++ { ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + + tlen = strlen (temp); + if (tlen > 0) @@ -2806,16 +2664,15 @@ index 000000000..b1a35356f + case ASN1_ETYPE_GENERALIZED_TIME: + case ASN1_ETYPE_UTC_TIME: + result = -+ _asn1_get_time_der (type_field (p->type), der + counter, -+ ider_len, &len2, temp, sizeof (temp) - 1, -+ flags); ++ _asn1_get_time_der (type_field (p->type), der + counter, ider_len, &len2, temp, ++ sizeof (temp) - 1, flags); + if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } ++ { ++ warn(); ++ goto cleanup; ++ } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + + tlen = strlen (temp); + if (tlen > 0) @@ -2826,60 +2683,57 @@ index 000000000..b1a35356f + break; + case ASN1_ETYPE_OCTET_STRING: + if (counter < inner_tag_len) -+ { ++ { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; -+ } ++ } + -+ ptag = der + counter - inner_tag_len; -+ if ((flags & ASN1_DECODE_FLAG_STRICT_DER) -+ || !(ptag[0] & ASN1_CLASS_STRUCTURED)) -+ { -+ if (ptag[0] & ASN1_CLASS_STRUCTURED) ++ ptag = der + counter - inner_tag_len; ++ if ((flags & ASN1_DECODE_FLAG_STRICT_DER) || !(ptag[0] & ASN1_CLASS_STRUCTURED)) ++ { ++ if (ptag[0] & ASN1_CLASS_STRUCTURED) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ len2 = asn1_get_length_der (der + counter, ider_len, &len3); -+ if (len2 < 0) ++ len2 = ++ asn1_get_length_der (der + counter, ider_len, &len3); ++ if (len2 < 0) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len3 + len2); ++ DECR_LEN(ider_len, len3+len2); + -+ _asn1_set_value (p, der + counter, len3 + len2); -+ counter += len3 + len2; -+ } -+ else -+ { -+ unsigned dflags = 0, vlen, ber_len; ++ _asn1_set_value (p, der + counter, len3 + len2); ++ counter += len3 + len2; ++ } ++ else ++ { ++ unsigned dflags = 0, vlen, ber_len; + -+ if (ptag[0] & ASN1_CLASS_STRUCTURED) -+ dflags |= DECODE_FLAG_CONSTRUCTED; ++ if (ptag[0] & ASN1_CLASS_STRUCTURED) ++ dflags |= DECODE_FLAG_CONSTRUCTED; + -+ result = -+ _asn1_decode_simple_ber (type_field (p->type), -+ der + counter, ider_len, &ptmp, -+ &vlen, &ber_len, dflags); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); ++ result = _asn1_decode_simple_ber(type_field (p->type), der+counter, ider_len, &ptmp, &vlen, &ber_len, dflags); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, ber_len); ++ DECR_LEN(ider_len, ber_len); + + _asn1_set_value_lv (p, ptmp, vlen); + -+ counter += ber_len; -+ free (ptmp); -+ } ++ counter += ber_len; ++ free(ptmp); ++ } + move = RIGHT; + break; + case ASN1_ETYPE_GENERALSTRING: @@ -2892,15 +2746,16 @@ index 000000000..b1a35356f + case ASN1_ETYPE_UTF8_STRING: + case ASN1_ETYPE_VISIBLE_STRING: + case ASN1_ETYPE_BIT_STRING: -+ len2 = asn1_get_length_der (der + counter, ider_len, &len3); ++ len2 = ++ asn1_get_length_der (der + counter, ider_len, &len3); + if (len2 < 0) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len3 + len2); ++ DECR_LEN(ider_len, len3+len2); + + _asn1_set_value (p, der + counter, len3 + len2); + counter += len3 + len2; @@ -2914,12 +2769,12 @@ index 000000000..b1a35356f + p->tmp_ival = 0; + if (len2 == -1) + { /* indefinite length method */ -+ DECR_LEN (ider_len, 2); ++ DECR_LEN(ider_len, 2); + if ((der[counter]) || der[counter + 1]) -+ { -+ result = ASN1_DER_ERROR; -+ warn (); -+ goto cleanup; ++ { ++ result = ASN1_DER_ERROR; ++ warn(); ++ goto cleanup; + } + counter += 2; + } @@ -2928,7 +2783,7 @@ index 000000000..b1a35356f + if (len2 != counter) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + } @@ -2936,15 +2791,16 @@ index 000000000..b1a35356f + } + else + { /* move==DOWN || move==RIGHT */ -+ len3 = asn1_get_length_der (der + counter, ider_len, &len2); -+ if (IS_ERR (len3, flags)) ++ len3 = ++ asn1_get_length_der (der + counter, ider_len, &len2); ++ if (IS_ERR(len3, flags)) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + counter += len2; + + if (len3 > 0) @@ -2982,24 +2838,23 @@ index 000000000..b1a35356f + len2 = p->tmp_ival; + if (len2 == -1) + { /* indefinite length method */ -+ if (!HAVE_TWO (ider_len) -+ || ((der[counter]) || der[counter + 1])) ++ if (!HAVE_TWO(ider_len) || ((der[counter]) || der[counter + 1])) + { + result = _asn1_append_sequence_set (p, &tcache); + if (result != 0) + { -+ warn (); -+ goto cleanup; -+ } ++ warn(); ++ goto cleanup; ++ } + p = tcache.tail; + move = RIGHT; + continue; + } + + p->tmp_ival = 0; -+ tcache.tail = NULL; /* finished decoding this structure */ ++ tcache.tail = NULL; /* finished decoding this structure */ + tcache.head = NULL; -+ DECR_LEN (ider_len, 2); ++ DECR_LEN(ider_len, 2); + counter += 2; + } + else @@ -3009,68 +2864,69 @@ index 000000000..b1a35356f + result = _asn1_append_sequence_set (p, &tcache); + if (result != 0) + { -+ warn (); -+ goto cleanup; -+ } ++ warn(); ++ goto cleanup; ++ } + p = tcache.tail; + move = RIGHT; + continue; + } + + p->tmp_ival = 0; -+ tcache.tail = NULL; /* finished decoding this structure */ ++ tcache.tail = NULL; /* finished decoding this structure */ + tcache.head = NULL; + + if (len2 != counter) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + } + } + else + { /* move==DOWN || move==RIGHT */ -+ len3 = asn1_get_length_der (der + counter, ider_len, &len2); -+ if (IS_ERR (len3, flags)) ++ len3 = ++ asn1_get_length_der (der + counter, ider_len, &len2); ++ if (IS_ERR(len3, flags)) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + counter += len2; + if (len3) + { + if (len3 > 0) + { /* definite length method */ -+ p->tmp_ival = counter + len3; ++ p->tmp_ival = counter + len3; + } + else + { /* indefinite length method */ -+ p->tmp_ival = -1; ++ p->tmp_ival = -1; + } + + p2 = p->down; -+ if (p2 == NULL) -+ { -+ result = ASN1_DER_ERROR; -+ warn (); -+ goto cleanup; -+ } ++ if (p2 == NULL) ++ { ++ result = ASN1_DER_ERROR; ++ warn(); ++ goto cleanup; ++ } + + while ((type_field (p2->type) == ASN1_ETYPE_TAG) + || (type_field (p2->type) == ASN1_ETYPE_SIZE)) + p2 = p2->right; + if (p2->right == NULL) -+ { ++ { + result = _asn1_append_sequence_set (p, &tcache); + if (result != 0) + { -+ warn (); -+ goto cleanup; -+ } ++ warn(); ++ goto cleanup; ++ } + } + p = p2; + } @@ -3080,82 +2936,81 @@ index 000000000..b1a35356f + case ASN1_ETYPE_ANY: + /* Check indefinite lenth method in an EXPLICIT TAG */ + -+ if (!(flags & ASN1_DECODE_FLAG_STRICT_DER) -+ && (p->type & CONST_TAG) && tag_len == 2 -+ && (der[counter - 1] == 0x80)) ++ if (!(flags & ASN1_DECODE_FLAG_STRICT_DER) && (p->type & CONST_TAG) && ++ tag_len == 2 && (der[counter - 1] == 0x80)) + indefinite = 1; + else -+ indefinite = 0; ++ indefinite = 0; + + if (asn1_get_tag_der + (der + counter, ider_len, &class, &len2, + &tag) != ASN1_SUCCESS) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + + len4 = -+ asn1_get_length_der (der + counter + len2, ider_len, &len3); -+ if (IS_ERR (len4, flags)) ++ asn1_get_length_der (der + counter + len2, ++ ider_len, &len3); ++ if (IS_ERR(len4, flags)) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } -+ if (len4 != -1) /* definite */ ++ if (len4 != -1) /* definite */ + { + len2 += len4; + -+ DECR_LEN (ider_len, len4 + len3); ++ DECR_LEN(ider_len, len4+len3); + _asn1_set_value_lv (p, der + counter, len2 + len3); + counter += len2 + len3; + } -+ else /* == -1 */ ++ else /* == -1 */ + { /* indefinite length */ -+ ider_len += len2; /* undo DECR_LEN */ ++ ider_len += len2; /* undo DECR_LEN */ + + if (counter == 0) + { + result = ASN1_DER_ERROR; -+ warn (); ++ warn(); + goto cleanup; + } + + result = -+ _asn1_get_indefinite_length_string (der + counter, -+ ider_len, &len2); ++ _asn1_get_indefinite_length_string (der + counter, ider_len, &len2); + if (result != ASN1_SUCCESS) + { -+ warn (); -+ goto cleanup; -+ } ++ warn(); ++ goto cleanup; ++ } + -+ DECR_LEN (ider_len, len2); ++ DECR_LEN(ider_len, len2); + _asn1_set_value_lv (p, der + counter, len2); + counter += len2; + + } + -+ /* Check if a couple of 0x00 are present due to an EXPLICIT TAG with -+ an indefinite length method. */ -+ if (indefinite) -+ { -+ DECR_LEN (ider_len, 2); -+ if (!der[counter] && !der[counter + 1]) -+ { -+ counter += 2; -+ } -+ else -+ { -+ result = ASN1_DER_ERROR; -+ warn (); -+ goto cleanup; -+ } -+ } ++ /* Check if a couple of 0x00 are present due to an EXPLICIT TAG with ++ an indefinite length method. */ ++ if (indefinite) ++ { ++ DECR_LEN(ider_len, 2); ++ if (!der[counter] && !der[counter + 1]) ++ { ++ counter += 2; ++ } ++ else ++ { ++ result = ASN1_DER_ERROR; ++ warn(); ++ goto cleanup; ++ } ++ } + + move = RIGHT; + break; @@ -3166,9 +3021,9 @@ index 000000000..b1a35356f + } + + if (p) -+ { -+ p->end = counter - 1; -+ } ++ { ++ p->end = counter - 1; ++ } + + if (p == node && move != DOWN) + break; @@ -3196,7 +3051,7 @@ index 000000000..b1a35356f + if ((ider_len < 0) || + (!(flags & ASN1_DECODE_FLAG_ALLOW_PADDING) && (ider_len != 0))) + { -+ warn (); ++ warn(); + result = ASN1_DER_ERROR; + goto cleanup; + } @@ -3266,7 +3121,7 @@ index 000000000..b1a35356f +asn1_der_decoding_element (asn1_node * structure, const char *elementName, + const void *ider, int len, char *errorDescription) +{ -+ return asn1_der_decoding (structure, ider, len, errorDescription); ++ return asn1_der_decoding(structure, ider, len, errorDescription); +} + +/** @@ -3320,19 +3175,19 @@ index 000000000..b1a35356f + if (*start == 0 && *end == 0) + { + if (ider == NULL || ider_len == 0) -+ return ASN1_GENERIC_ERROR; ++ return ASN1_GENERIC_ERROR; + + /* it seems asn1_der_decoding() wasn't called before. Do it now */ + result = asn1_der_decoding (&node, ider, ider_len, NULL); + if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ return result; -+ } ++ { ++ warn(); ++ return result; ++ } + + node_to_find = asn1_find_node (node, name_element); + if (node_to_find == NULL) -+ return ASN1_ELEMENT_NOT_FOUND; ++ return ASN1_ELEMENT_NOT_FOUND; + + *start = node_to_find->start; + *end = node_to_find->end; @@ -3363,7 +3218,8 @@ index 000000000..b1a35356f +int +asn1_expand_any_defined_by (asn1_node_const definitions, asn1_node * element) +{ -+ char name[2 * ASN1_MAX_NAME_SIZE + 2], value[ASN1_MAX_NAME_SIZE]; ++ char name[2 * ASN1_MAX_NAME_SIZE + 2], ++ value[ASN1_MAX_NAME_SIZE]; + int retCode = ASN1_SUCCESS, result; + int len, len2, len3; + asn1_node_const p2; @@ -3449,8 +3305,7 @@ index 000000000..b1a35356f + if ((type_field (p2->type) == ASN1_ETYPE_OBJECT_ID) && + (p2->type & CONST_ASSIGN)) + { -+ snprintf (name, sizeof (name), "%s.%s", definitionsName, -+ p2->name); ++ snprintf(name, sizeof(name), "%s.%s", definitionsName, p2->name); + + len = ASN1_MAX_NAME_SIZE; + result = @@ -3466,8 +3321,7 @@ index 000000000..b1a35356f + + if (p2) + { -+ snprintf (name, sizeof (name), "%s.%s", -+ definitionsName, p2->name); ++ snprintf(name, sizeof(name), "%s.%s", definitionsName, p2->name); + + result = + asn1_create_element (definitions, name, &aux); @@ -3731,8 +3585,8 @@ index 000000000..b1a35356f + -*/ +static int +_asn1_decode_simple_der (unsigned int etype, const unsigned char *der, -+ unsigned int _der_len, const unsigned char **str, -+ unsigned int *str_len, unsigned dflags) ++ unsigned int _der_len, const unsigned char **str, ++ unsigned int *str_len, unsigned dflags) +{ + int tag_len, len_len; + const unsigned char *p; @@ -3744,11 +3598,11 @@ index 000000000..b1a35356f + if (der == NULL || der_len == 0) + return ASN1_VALUE_NOT_VALID; + -+ if (ETYPE_OK (etype) == 0 || ETYPE_IS_STRING (etype) == 0) ++ if (ETYPE_OK (etype) == 0 || ETYPE_IS_STRING(etype) == 0) + return ASN1_VALUE_NOT_VALID; + + /* doesn't handle constructed classes */ -+ class = ETYPE_CLASS (etype); ++ class = ETYPE_CLASS(etype); + if (class != ASN1_CLASS_UNIVERSAL) + return ASN1_VALUE_NOT_VALID; + @@ -3758,18 +3612,18 @@ index 000000000..b1a35356f + { + ret = asn1_get_tag_der (p, der_len, &class, &tag_len, &tag); + if (ret != ASN1_SUCCESS) -+ return ret; ++ return ret; + + if (class != ETYPE_CLASS (etype) || tag != ETYPE_TAG (etype)) -+ { -+ warn (); -+ return ASN1_DER_ERROR; -+ } ++ { ++ warn(); ++ return ASN1_DER_ERROR; ++ } + + p += tag_len; + der_len -= tag_len; + if (der_len <= 0) -+ return ASN1_DER_ERROR; ++ return ASN1_DER_ERROR; + } + + ret = asn1_get_length_der (p, der_len, &len_len); @@ -3805,21 +3659,18 @@ index 000000000..b1a35356f + unsigned int _der_len, const unsigned char **str, + unsigned int *str_len) +{ -+ return _asn1_decode_simple_der (etype, der, _der_len, str, str_len, -+ DECODE_FLAG_HAVE_TAG); ++ return _asn1_decode_simple_der(etype, der, _der_len, str, str_len, DECODE_FLAG_HAVE_TAG); +} + -+static int -+append (uint8_t ** dst, unsigned *dst_size, const unsigned char *src, -+ unsigned src_size) ++static int append(uint8_t **dst, unsigned *dst_size, const unsigned char *src, unsigned src_size) +{ + if (src_size == 0) + return ASN1_SUCCESS; + -+ *dst = _asn1_realloc (*dst, *dst_size + src_size); ++ *dst = _asn1_realloc(*dst, *dst_size+src_size); + if (*dst == NULL) + return ASN1_MEM_ALLOC_ERROR; -+ memcpy (*dst + *dst_size, src, src_size); ++ memcpy(*dst + *dst_size, src, src_size); + *dst_size += src_size; + return ASN1_SUCCESS; +} @@ -3842,9 +3693,9 @@ index 000000000..b1a35356f + -*/ +static int +_asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, -+ unsigned int _der_len, unsigned char **str, -+ unsigned int *str_len, unsigned int *ber_len, -+ unsigned dflags) ++ unsigned int _der_len, unsigned char **str, ++ unsigned int *str_len, unsigned int *ber_len, ++ unsigned dflags) +{ + int tag_len, len_len; + const unsigned char *p; @@ -3858,18 +3709,17 @@ index 000000000..b1a35356f + unsigned out_len; + long result; + -+ if (ber_len) -+ *ber_len = 0; ++ if (ber_len) *ber_len = 0; + + if (der == NULL || der_len == 0) + { -+ warn (); ++ warn(); + return ASN1_VALUE_NOT_VALID; + } + + if (ETYPE_OK (etype) == 0) + { -+ warn (); ++ warn(); + return ASN1_VALUE_NOT_VALID; + } + @@ -3877,7 +3727,7 @@ index 000000000..b1a35356f + class = ETYPE_CLASS (etype); + if (class != ASN1_CLASS_UNIVERSAL) + { -+ warn (); ++ warn(); + return ASN1_VALUE_NOT_VALID; + } + @@ -3886,200 +3736,190 @@ index 000000000..b1a35356f + if (dflags & DECODE_FLAG_HAVE_TAG) + { + result = asn1_get_tag_der (p, der_len, &class, &tag_len, &tag); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ return result; -+ } ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ return result; ++ } + -+ if (tag != ETYPE_TAG (etype)) -+ { -+ warn (); -+ return ASN1_DER_ERROR; -+ } ++ if (tag != ETYPE_TAG (etype)) ++ { ++ warn(); ++ return ASN1_DER_ERROR; ++ } + -+ p += tag_len; ++ p += tag_len; + -+ DECR_LEN (der_len, tag_len); ++ DECR_LEN(der_len, tag_len); + -+ if (ber_len) -+ *ber_len += tag_len; ++ if (ber_len) *ber_len += tag_len; + } + + /* indefinite constructed */ -+ if ((((dflags & DECODE_FLAG_CONSTRUCTED) || class == ASN1_CLASS_STRUCTURED) -+ && ETYPE_IS_STRING (etype)) && !(dflags & DECODE_FLAG_LEVEL3)) ++ if ((((dflags & DECODE_FLAG_CONSTRUCTED) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) && ++ !(dflags & DECODE_FLAG_LEVEL3)) + { + if (der_len == 0) -+ { -+ warn (); -+ result = ASN1_DER_ERROR; -+ goto cleanup; -+ } -+ -+ if (der_len > 0 && p[0] == 0x80) /* indefinite */ -+ { -+ len_len = 1; -+ DECR_LEN (der_len, len_len); -+ p += len_len; -+ -+ if (ber_len) -+ *ber_len += len_len; -+ -+ /* decode the available octet strings */ -+ do -+ { -+ unsigned tmp_len; -+ unsigned flags = DECODE_FLAG_HAVE_TAG; ++ { ++ warn(); ++ result = ASN1_DER_ERROR; ++ goto cleanup; ++ } + -+ if (dflags & DECODE_FLAG_LEVEL1) -+ flags |= DECODE_FLAG_LEVEL2; -+ else if (dflags & DECODE_FLAG_LEVEL2) -+ flags |= DECODE_FLAG_LEVEL3; -+ else ++ if (der_len > 0 && p[0] == 0x80) /* indefinite */ ++ { ++ len_len = 1; ++ DECR_LEN(der_len, len_len); ++ p += len_len; ++ ++ if (ber_len) *ber_len += len_len; ++ ++ /* decode the available octet strings */ ++ do ++ { ++ unsigned tmp_len; ++ unsigned flags = DECODE_FLAG_HAVE_TAG; ++ ++ if (dflags & DECODE_FLAG_LEVEL1) ++ flags |= DECODE_FLAG_LEVEL2; ++ else if (dflags & DECODE_FLAG_LEVEL2) ++ flags |= DECODE_FLAG_LEVEL3; ++ else + flags |= DECODE_FLAG_LEVEL1; + -+ result = -+ _asn1_decode_simple_ber (etype, p, der_len, &out, &out_len, -+ &tmp_len, flags); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } -+ -+ p += tmp_len; -+ DECR_LEN (der_len, tmp_len); ++ result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len, ++ flags); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ goto cleanup; ++ } ++ ++ p += tmp_len; ++ DECR_LEN(der_len, tmp_len); ++ ++ if (ber_len) *ber_len += tmp_len; ++ ++ DECR_LEN(der_len, 2); /* we need the EOC */ ++ ++ result = append(&total, &total_size, out, out_len); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ goto cleanup; ++ } ++ ++ free(out); ++ out = NULL; ++ ++ if (p[0] == 0 && p[1] == 0) /* EOC */ ++ { ++ if (ber_len) *ber_len += 2; ++ break; ++ } ++ ++ /* no EOC */ ++ der_len += 2; ++ ++ if (der_len == 2) ++ { ++ warn(); ++ result = ASN1_DER_ERROR; ++ goto cleanup; ++ } ++ } ++ while(1); ++ } ++ else /* constructed */ ++ { ++ long const_len; ++ ++ result = asn1_get_length_ber(p, der_len, &len_len); ++ if (result < 0) ++ { ++ warn(); ++ result = ASN1_DER_ERROR; ++ goto cleanup; ++ } ++ ++ DECR_LEN(der_len, len_len); ++ p += len_len; ++ ++ const_len = result; ++ ++ if (ber_len) *ber_len += len_len; ++ ++ /* decode the available octet strings */ ++ while(const_len > 0) ++ { ++ unsigned tmp_len; ++ unsigned flags = DECODE_FLAG_HAVE_TAG; ++ ++ if (dflags & DECODE_FLAG_LEVEL1) ++ flags |= DECODE_FLAG_LEVEL2; ++ else if (dflags & DECODE_FLAG_LEVEL2) ++ flags |= DECODE_FLAG_LEVEL3; ++ else ++ flags |= DECODE_FLAG_LEVEL1; + -+ if (ber_len) -+ *ber_len += tmp_len; ++ result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len, ++ flags); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ goto cleanup; ++ } ++ ++ p += tmp_len; ++ DECR_LEN(der_len, tmp_len); ++ DECR_LEN(const_len, tmp_len); ++ ++ if (ber_len) *ber_len += tmp_len; ++ ++ result = append(&total, &total_size, out, out_len); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ goto cleanup; ++ } ++ ++ free(out); ++ out = NULL; ++ } ++ } ++ } ++ else if (class == ETYPE_CLASS(etype)) ++ { ++ if (ber_len) ++ { ++ result = asn1_get_length_der (p, der_len, &len_len); ++ if (result < 0) ++ { ++ warn(); ++ result = ASN1_DER_ERROR; ++ goto cleanup; ++ } ++ *ber_len += result + len_len; ++ } + -+ DECR_LEN (der_len, 2); /* we need the EOC */ ++ /* non-string values are decoded as DER */ ++ result = _asn1_decode_simple_der(etype, der, _der_len, &cout, &out_len, dflags); ++ if (result != ASN1_SUCCESS) ++ { ++ warn(); ++ goto cleanup; ++ } + -+ result = append (&total, &total_size, out, out_len); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } -+ -+ free (out); -+ out = NULL; -+ -+ if (p[0] == 0 && p[1] == 0) /* EOC */ -+ { -+ if (ber_len) -+ *ber_len += 2; -+ break; -+ } -+ -+ /* no EOC */ -+ der_len += 2; -+ -+ if (der_len == 2) -+ { -+ warn (); -+ result = ASN1_DER_ERROR; -+ goto cleanup; -+ } -+ } -+ while (1); -+ } -+ else /* constructed */ -+ { -+ long const_len; -+ -+ result = asn1_get_length_ber (p, der_len, &len_len); -+ if (result < 0) -+ { -+ warn (); -+ result = ASN1_DER_ERROR; -+ goto cleanup; -+ } -+ -+ DECR_LEN (der_len, len_len); -+ p += len_len; -+ -+ const_len = result; -+ -+ if (ber_len) -+ *ber_len += len_len; -+ -+ /* decode the available octet strings */ -+ while (const_len > 0) -+ { -+ unsigned tmp_len; -+ unsigned flags = DECODE_FLAG_HAVE_TAG; -+ -+ if (dflags & DECODE_FLAG_LEVEL1) -+ flags |= DECODE_FLAG_LEVEL2; -+ else if (dflags & DECODE_FLAG_LEVEL2) -+ flags |= DECODE_FLAG_LEVEL3; -+ else -+ flags |= DECODE_FLAG_LEVEL1; -+ -+ result = -+ _asn1_decode_simple_ber (etype, p, der_len, &out, &out_len, -+ &tmp_len, flags); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } -+ -+ p += tmp_len; -+ DECR_LEN (der_len, tmp_len); -+ DECR_LEN (const_len, tmp_len); -+ -+ if (ber_len) -+ *ber_len += tmp_len; -+ -+ result = append (&total, &total_size, out, out_len); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } -+ -+ free (out); -+ out = NULL; -+ } -+ } -+ } -+ else if (class == ETYPE_CLASS (etype)) -+ { -+ if (ber_len) -+ { -+ result = asn1_get_length_der (p, der_len, &len_len); -+ if (result < 0) -+ { -+ warn (); -+ result = ASN1_DER_ERROR; -+ goto cleanup; -+ } -+ *ber_len += result + len_len; -+ } -+ -+ /* non-string values are decoded as DER */ -+ result = -+ _asn1_decode_simple_der (etype, der, _der_len, &cout, &out_len, -+ dflags); -+ if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } -+ -+ result = append (&total, &total_size, cout, out_len); ++ result = append(&total, &total_size, cout, out_len); + if (result != ASN1_SUCCESS) -+ { -+ warn (); -+ goto cleanup; -+ } ++ { ++ warn(); ++ goto cleanup; ++ } + } + else + { -+ warn (); ++ warn(); + result = ASN1_DER_ERROR; + goto cleanup; + } @@ -4089,8 +3929,8 @@ index 000000000..b1a35356f + + return ASN1_SUCCESS; +cleanup: -+ free (out); -+ free (total); ++ free(out); ++ free(total); + return result; +} + @@ -4114,17 +3954,16 @@ index 000000000..b1a35356f + unsigned int _der_len, unsigned char **str, + unsigned int *str_len, unsigned int *ber_len) +{ -+ return _asn1_decode_simple_ber (etype, der, _der_len, str, str_len, ber_len, -+ DECODE_FLAG_HAVE_TAG); ++ return _asn1_decode_simple_ber(etype, der, _der_len, str, str_len, ber_len, DECODE_FLAG_HAVE_TAG); +} diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c new file mode 100644 -index 000000000..86e64f2cf +index 00000000000..997eb2725dc --- /dev/null +++ b/grub-core/lib/libtasn1/lib/element.c -@@ -0,0 +1,1109 @@ +@@ -0,0 +1,1111 @@ +/* -+ * Copyright (C) 2000-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2000-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -4240,7 +4079,7 @@ index 000000000..86e64f2cf + if (value_out != NULL) + { + for (k2 = k; k2 < SIZEOF_UNSIGNED_LONG_INT; k2++) -+ value_out[k2 - k] = val[k2]; ++ value_out[k2 - k] = val[k2]; + } + +#if 0 @@ -4267,7 +4106,7 @@ index 000000000..86e64f2cf +_asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache) +{ + asn1_node p, p2; -+ char temp[LTOSTR_MAX_SIZE + 1]; ++ char temp[LTOSTR_MAX_SIZE]; + long n; + + if (!node || !(node->down)) @@ -4285,9 +4124,9 @@ index 000000000..86e64f2cf + if (pcache == NULL || pcache->tail == NULL || pcache->head != node) + { + while (p->right) -+ { -+ p = p->right; -+ } ++ { ++ p = p->right; ++ } + } + else + { @@ -4446,8 +4285,7 @@ index 000000000..86e64f2cf + + type = type_field (node->type); + -+ if ((type == ASN1_ETYPE_SEQUENCE_OF || type == ASN1_ETYPE_SET_OF) -+ && (value == NULL) && (len == 0)) ++ if ((type == ASN1_ETYPE_SEQUENCE_OF || type == ASN1_ETYPE_SET_OF) && (value == NULL) && (len == 0)) + { + p = node->down; + while ((type_field (p->type) == ASN1_ETYPE_TAG) @@ -4883,8 +4721,7 @@ index 000000000..86e64f2cf + * this function may return %ASN1_SUCCESS even if the provided @len is zero. + **/ +int -+asn1_read_value (asn1_node_const root, const char *name, void *ivalue, -+ int *len) ++asn1_read_value (asn1_node_const root, const char *name, void *ivalue, int *len) +{ + return asn1_read_value_type (root, name, ivalue, len, NULL); +} @@ -5021,8 +4858,8 @@ index 000000000..86e64f2cf + || (p->value[0] == '+')) + { + result = _asn1_convert_integer -+ (p->value, value, value_size, len); -+ if (result != ASN1_SUCCESS) ++ (p->value, value, value_size, len); ++ if (result != ASN1_SUCCESS) + return result; + } + else @@ -5035,7 +4872,8 @@ index 000000000..86e64f2cf + if (!_asn1_strcmp (p2->name, p->value)) + { + result = _asn1_convert_integer -+ (p2->value, value, value_size, len); ++ (p2->value, value, value_size, ++ len); + if (result != ASN1_SUCCESS) + return result; + break; @@ -5049,8 +4887,9 @@ index 000000000..86e64f2cf + { + len2 = -1; + result = asn1_get_octet_der -+ (node->value, node->value_len, &len2, value, value_size, len); -+ if (result != ASN1_SUCCESS) ++ (node->value, node->value_len, &len2, value, value_size, ++ len); ++ if (result != ASN1_SUCCESS) + return result; + } + break; @@ -5103,14 +4942,16 @@ index 000000000..86e64f2cf + case ASN1_ETYPE_VISIBLE_STRING: + len2 = -1; + result = asn1_get_octet_der -+ (node->value, node->value_len, &len2, value, value_size, len); ++ (node->value, node->value_len, &len2, value, value_size, ++ len); + if (result != ASN1_SUCCESS) + return result; + break; + case ASN1_ETYPE_BIT_STRING: + len2 = -1; + result = asn1_get_bit_der -+ (node->value, node->value_len, &len2, value, value_size, len); ++ (node->value, node->value_len, &len2, value, value_size, ++ len); + if (result != ASN1_SUCCESS) + return result; + break; @@ -5232,62 +5073,14 @@ index 000000000..86e64f2cf + + return ASN1_SUCCESS; +} -diff --git a/grub-core/lib/libtasn1/lib/element.h b/grub-core/lib/libtasn1/lib/element.h -new file mode 100644 -index 000000000..4c9a901d1 ---- /dev/null -+++ b/grub-core/lib/libtasn1/lib/element.h -@@ -0,0 +1,42 @@ -+/* -+ * Copyright (C) 2000-2021 Free Software Foundation, Inc. -+ * -+ * This file is part of LIBTASN1. -+ * -+ * The LIBTASN1 library is free software; you can redistribute it -+ * and/or modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -+ * 02110-1301, USA -+ */ -+ -+#ifndef _ELEMENT_H -+# define _ELEMENT_H -+ -+ -+struct node_tail_cache_st -+{ -+ asn1_node head; /* the first element of the sequence */ -+ asn1_node tail; -+}; -+ -+int _asn1_append_sequence_set (asn1_node node, -+ struct node_tail_cache_st *pcached); -+ -+int _asn1_convert_integer (const unsigned char *value, -+ unsigned char *value_out, -+ int value_out_size, int *len); -+ -+void _asn1_hierarchical_name (asn1_node_const node, char *name, -+ int name_size); -+ -+#endif diff --git a/grub-core/lib/libtasn1/lib/errors.c b/grub-core/lib/libtasn1/lib/errors.c new file mode 100644 -index 000000000..4dadbd96d +index 00000000000..cee74daf795 --- /dev/null +++ b/grub-core/lib/libtasn1/lib/errors.c @@ -0,0 +1,100 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -5309,7 +5102,7 @@ index 000000000..4dadbd96d + +#include +#ifdef STDC_HEADERS -+# include ++#include +#endif + +#define LIBTASN1_ERROR_ENTRY(name) { #name, name } @@ -5388,12 +5181,12 @@ index 000000000..4dadbd96d +} diff --git a/grub-core/lib/libtasn1/lib/gstr.c b/grub-core/lib/libtasn1/lib/gstr.c new file mode 100644 -index 000000000..1475ed51b +index 00000000000..e91a3a151c0 --- /dev/null +++ b/grub-core/lib/libtasn1/lib/gstr.c @@ -0,0 +1,74 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -5434,7 +5227,7 @@ index 000000000..1475ed51b + } + else + { -+ if (dest_tot_size > dest_size) ++ if (dest_tot_size - dest_size > 0) + { + strncat (dest, src, (dest_tot_size - dest_size) - 1); + dest[dest_tot_size - 1] = 0; @@ -5466,14 +5259,14 @@ index 000000000..1475ed51b + return 0; + } +} -diff --git a/grub-core/lib/libtasn1/lib/gstr.h b/grub-core/lib/libtasn1/lib/gstr.h +diff --git a/grub-core/lib/libtasn1/lib/parser_aux.c b/grub-core/lib/libtasn1/lib/parser_aux.c new file mode 100644 -index 000000000..cd47d145c +index 00000000000..d5dbbf8765d --- /dev/null -+++ b/grub-core/lib/libtasn1/lib/gstr.h -@@ -0,0 +1,50 @@ ++++ b/grub-core/lib/libtasn1/lib/parser_aux.c +@@ -0,0 +1,1173 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2000-2016 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -5493,374 +5286,93 @@ index 000000000..cd47d145c + * 02110-1301, USA + */ + -+#ifndef GSTR_H -+# define GSTR_H ++#include // WORD_BIT + -+unsigned int _asn1_str_cpy (char *dest, size_t dest_tot_size, -+ const char *src); -+void _asn1_str_cat (char *dest, size_t dest_tot_size, const char *src); ++#include "int.h" ++#include "parser_aux.h" ++#include "gstr.h" ++#include "structure.h" ++#include "element.h" ++#include "c-ctype.h" ++ ++char _asn1_identifierMissing[ASN1_MAX_NAME_SIZE + 1]; /* identifier name not found */ ++ ++/* Return a hash of the N bytes of X using the method described by ++ Bruno Haible in https://www.haible.de/bruno/hashfunc.html. ++ Note that while many hash functions reduce their result via modulo ++ to a 0..table_size-1 range, this function does not do that. + -+# define Estrcpy(x,y) _asn1_str_cpy(x,ASN1_MAX_ERROR_DESCRIPTION_SIZE,y) -+# define Estrcat(x,y) _asn1_str_cat(x,ASN1_MAX_ERROR_DESCRIPTION_SIZE,y) ++ This implementation has been changed from size_t -> unsigned int. */ + -+inline static void -+safe_memset (void *data, int c, size_t size) ++#ifdef __clang__ ++__attribute__((no_sanitize("integer"))) ++#endif ++_GL_ATTRIBUTE_PURE ++static unsigned int ++_asn1_hash_name (const char *x) +{ -+ volatile unsigned volatile_zero = 0; -+ volatile char *vdata = (volatile char *) data; ++ const unsigned char *s = (unsigned char *) x; ++ unsigned h = 0; + -+ /* This is based on a nice trick for safe memset, -+ * sent by David Jacobson in the openssl-dev mailing list. -+ */ ++ while (*s) ++ h = (*s++) + ((h << 9) | (h >> (WORD_BIT - 9))); + -+ if (size > 0) -+ do -+ { -+ memset (data, c, size); -+ } -+ while (vdata[volatile_zero] != c); ++ return h; +} + -+#endif /* GSTR_H */ -diff --git a/grub-core/lib/libtasn1/lib/int.h b/grub-core/lib/libtasn1/lib/int.h -new file mode 100644 -index 000000000..404cd1562 ---- /dev/null -+++ b/grub-core/lib/libtasn1/lib/int.h -@@ -0,0 +1,221 @@ -+/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. -+ * -+ * This file is part of LIBTASN1. -+ * -+ * The LIBTASN1 library is free software; you can redistribute it -+ * and/or modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -+ * 02110-1301, USA -+ */ -+ -+#ifndef INT_H -+# define INT_H ++/******************************************************/ ++/* Function : _asn1_add_static_node */ ++/* Description: creates a new NODE_ASN element and */ ++/* puts it in the list pointed by e_list. */ ++/* Parameters: */ ++/* e_list: of type list_type; must be NULL initially */ ++/* type: type of the new element (see ASN1_ETYPE_ */ ++/* and CONST_ constants). */ ++/* Return: pointer to the new element. */ ++/******************************************************/ ++asn1_node ++_asn1_add_static_node (list_type **e_list, unsigned int type) ++{ ++ list_type *p; ++ asn1_node punt; + -+# ifdef HAVE_CONFIG_H -+# include -+# endif ++ punt = calloc (1, sizeof (struct asn1_node_st)); ++ if (punt == NULL) ++ return NULL; + -+# include -+# include -+# include -+# include ++ p = malloc (sizeof (list_type)); ++ if (p == NULL) ++ { ++ free (punt); ++ return NULL; ++ } + -+# ifdef HAVE_SYS_TYPES_H -+# include -+# endif ++ p->node = punt; ++ p->next = *e_list; ++ *e_list = p; + -+# include ++ punt->type = type; + -+# define ASN1_SMALL_VALUE_SIZE 16 ++ return punt; ++} + -+/* This structure is also in libtasn1.h, but then contains less -+ fields. You cannot make any modifications to these first fields -+ without breaking ABI. */ -+struct asn1_node_st ++static ++int _asn1_add_static_node2 (list_type **e_list, asn1_node node) +{ -+ /* public fields: */ -+ char name[ASN1_MAX_NAME_SIZE + 1]; /* Node name */ -+ unsigned int name_hash; -+ unsigned int type; /* Node type */ -+ unsigned char *value; /* Node value */ -+ int value_len; -+ asn1_node down; /* Pointer to the son node */ -+ asn1_node right; /* Pointer to the brother node */ -+ asn1_node left; /* Pointer to the next list element */ -+ /* private fields: */ -+ unsigned char small_value[ASN1_SMALL_VALUE_SIZE]; /* For small values */ -+ -+ /* values used during decoding/coding */ -+ int tmp_ival; -+ unsigned start; /* the start of the DER sequence - if decoded */ -+ unsigned end; /* the end of the DER sequence - if decoded */ -+}; ++ list_type *p; + -+typedef struct tag_and_class_st -+{ -+ unsigned tag; -+ unsigned class; -+ const char *desc; -+} tag_and_class_st; ++ p = malloc (sizeof (list_type)); ++ if (p == NULL) ++ { ++ return -1; ++ } + -+/* the types that are handled in _asn1_tags */ -+# define CASE_HANDLED_ETYPES \ -+ case ASN1_ETYPE_NULL: \ -+ case ASN1_ETYPE_BOOLEAN: \ -+ case ASN1_ETYPE_INTEGER: \ -+ case ASN1_ETYPE_ENUMERATED: \ -+ case ASN1_ETYPE_OBJECT_ID: \ -+ case ASN1_ETYPE_OCTET_STRING: \ -+ case ASN1_ETYPE_GENERALSTRING: \ -+ case ASN1_ETYPE_NUMERIC_STRING: \ -+ case ASN1_ETYPE_IA5_STRING: \ -+ case ASN1_ETYPE_TELETEX_STRING: \ -+ case ASN1_ETYPE_PRINTABLE_STRING: \ -+ case ASN1_ETYPE_UNIVERSAL_STRING: \ -+ case ASN1_ETYPE_BMP_STRING: \ -+ case ASN1_ETYPE_UTF8_STRING: \ -+ case ASN1_ETYPE_VISIBLE_STRING: \ -+ case ASN1_ETYPE_BIT_STRING: \ -+ case ASN1_ETYPE_SEQUENCE: \ -+ case ASN1_ETYPE_SEQUENCE_OF: \ -+ case ASN1_ETYPE_SET: \ -+ case ASN1_ETYPE_UTC_TIME: \ -+ case ASN1_ETYPE_GENERALIZED_TIME: \ -+ case ASN1_ETYPE_SET_OF ++ p->node = node; ++ p->next = *e_list; ++ *e_list = p; + -+# define ETYPE_TAG(etype) (_asn1_tags[etype].tag) -+# define ETYPE_CLASS(etype) (_asn1_tags[etype].class) -+# define ETYPE_OK(etype) (((etype) != ASN1_ETYPE_INVALID && \ -+ (etype) <= _asn1_tags_size && \ -+ _asn1_tags[(etype)].desc != NULL)?1:0) -+ -+# define ETYPE_IS_STRING(etype) ((etype == ASN1_ETYPE_GENERALSTRING || \ -+ etype == ASN1_ETYPE_NUMERIC_STRING || etype == ASN1_ETYPE_IA5_STRING || \ -+ etype == ASN1_ETYPE_TELETEX_STRING || etype == ASN1_ETYPE_PRINTABLE_STRING || \ -+ etype == ASN1_ETYPE_UNIVERSAL_STRING || etype == ASN1_ETYPE_BMP_STRING || \ -+ etype == ASN1_ETYPE_UTF8_STRING || etype == ASN1_ETYPE_VISIBLE_STRING || \ -+ etype == ASN1_ETYPE_OCTET_STRING)?1:0) -+ -+extern unsigned int _asn1_tags_size; -+extern const tag_and_class_st _asn1_tags[]; -+ -+# define _asn1_strlen(s) strlen((const char *) s) -+# define _asn1_strtol(n,e,b) strtol((const char *) n, e, b) -+# define _asn1_strtoul(n,e,b) strtoul((const char *) n, e, b) -+# define _asn1_strcmp(a,b) strcmp((const char *)a, (const char *)b) -+# define _asn1_strcpy(a,b) strcpy((char *)a, (const char *)b) -+# define _asn1_strcat(a,b) strcat((char *)a, (const char *)b) -+ -+# if SIZEOF_UNSIGNED_LONG_INT == 8 -+# define _asn1_strtou64(n,e,b) strtoul((const char *) n, e, b) -+# else -+# define _asn1_strtou64(n,e,b) strtoull((const char *) n, e, b) -+# endif -+ -+# define MAX_LOG_SIZE 1024 /* maximum number of characters of a log message */ -+ -+/* Define used for visiting trees. */ -+# define UP 1 -+# define RIGHT 2 -+# define DOWN 3 -+ -+/***********************************************************************/ -+/* List of constants to better specify the type of typedef asn1_node_st. */ -+/***********************************************************************/ -+/* Used with TYPE_TAG */ -+# define CONST_UNIVERSAL (1U<<8) -+# define CONST_PRIVATE (1U<<9) -+# define CONST_APPLICATION (1U<<10) -+# define CONST_EXPLICIT (1U<<11) -+# define CONST_IMPLICIT (1U<<12) -+ -+# define CONST_TAG (1U<<13) /* Used in ASN.1 assignement */ -+# define CONST_OPTION (1U<<14) -+# define CONST_DEFAULT (1U<<15) -+# define CONST_TRUE (1U<<16) -+# define CONST_FALSE (1U<<17) -+ -+# define CONST_LIST (1U<<18) /* Used with TYPE_INTEGER and TYPE_BIT_STRING */ -+# define CONST_MIN_MAX (1U<<19) -+ -+# define CONST_1_PARAM (1U<<20) -+ -+# define CONST_SIZE (1U<<21) -+ -+# define CONST_DEFINED_BY (1U<<22) -+ -+/* Those two are deprecated and used for backwards compatibility */ -+# define CONST_GENERALIZED (1U<<23) -+# define CONST_UTC (1U<<24) -+ -+/* #define CONST_IMPORTS (1U<<25) */ -+ -+# define CONST_NOT_USED (1U<<26) -+# define CONST_SET (1U<<27) -+# define CONST_ASSIGN (1U<<28) -+ -+# define CONST_DOWN (1U<<29) -+# define CONST_RIGHT (1U<<30) -+ -+ -+# define ASN1_ETYPE_TIME 17 -+/****************************************/ -+/* Returns the first 8 bits. */ -+/* Used with the field type of asn1_node_st */ -+/****************************************/ -+inline static unsigned int -+type_field (unsigned int ntype) -+{ -+ return (ntype & 0xff); -+} -+ -+/* To convert old types from a static structure */ -+inline static unsigned int -+convert_old_type (unsigned int ntype) -+{ -+ unsigned int type = ntype & 0xff; -+ if (type == ASN1_ETYPE_TIME) -+ { -+ if (ntype & CONST_UTC) -+ type = ASN1_ETYPE_UTC_TIME; -+ else -+ type = ASN1_ETYPE_GENERALIZED_TIME; -+ -+ ntype &= ~(CONST_UTC | CONST_GENERALIZED); -+ ntype &= 0xffffff00; -+ ntype |= type; -+ -+ return ntype; -+ } -+ else -+ return ntype; -+} -+ -+static inline void * -+_asn1_realloc (void *ptr, size_t size) -+{ -+ void *ret; -+ -+ if (size == 0) -+ return ptr; -+ -+ ret = realloc (ptr, size); -+ if (ret == NULL) -+ { -+ free (ptr); -+ } -+ return ret; -+} -+ -+#endif /* INT_H */ -diff --git a/grub-core/lib/libtasn1/lib/parser_aux.c b/grub-core/lib/libtasn1/lib/parser_aux.c -new file mode 100644 -index 000000000..c99c5a4cb ---- /dev/null -+++ b/grub-core/lib/libtasn1/lib/parser_aux.c -@@ -0,0 +1,1178 @@ -+/* -+ * Copyright (C) 2000-2021 Free Software Foundation, Inc. -+ * -+ * This file is part of LIBTASN1. -+ * -+ * The LIBTASN1 library is free software; you can redistribute it -+ * and/or modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -+ * 02110-1301, USA -+ */ -+ -+#include // WORD_BIT -+ -+#include "int.h" -+#include "parser_aux.h" -+#include "gstr.h" -+#include "structure.h" -+#include "element.h" -+#include "c-ctype.h" -+ -+char _asn1_identifierMissing[ASN1_MAX_NAME_SIZE + 1]; /* identifier name not found */ -+ -+/* Return a hash of the N bytes of X using the method described by -+ Bruno Haible in https://www.haible.de/bruno/hashfunc.html. -+ Note that while many hash functions reduce their result via modulo -+ to a 0..table_size-1 range, this function does not do that. -+ -+ This implementation has been changed from size_t -> unsigned int. */ -+ -+#ifdef __clang__ -+__attribute__((no_sanitize ("integer"))) -+#endif -+ _GL_ATTRIBUTE_PURE static unsigned int _asn1_hash_name (const char *x) -+{ -+ const unsigned char *s = (unsigned char *) x; -+ unsigned h = 0; -+ -+ while (*s) -+ h = (*s++) + ((h << 9) | (h >> (WORD_BIT - 9))); -+ -+ return h; -+} -+ -+/******************************************************/ -+/* Function : _asn1_add_static_node */ -+/* Description: creates a new NODE_ASN element and */ -+/* puts it in the list pointed by e_list. */ -+/* Parameters: */ -+/* e_list: of type list_type; must be NULL initially */ -+/* type: type of the new element (see ASN1_ETYPE_ */ -+/* and CONST_ constants). */ -+/* Return: pointer to the new element. */ -+/******************************************************/ -+asn1_node -+_asn1_add_static_node (list_type ** e_list, unsigned int type) -+{ -+ list_type *p; -+ asn1_node punt; -+ -+ punt = calloc (1, sizeof (struct asn1_node_st)); -+ if (punt == NULL) -+ return NULL; -+ -+ p = malloc (sizeof (list_type)); -+ if (p == NULL) -+ { -+ free (punt); -+ return NULL; -+ } -+ -+ p->node = punt; -+ p->next = *e_list; -+ *e_list = p; -+ -+ punt->type = type; -+ -+ return punt; -+} -+ -+static int -+_asn1_add_static_node2 (list_type ** e_list, asn1_node node) -+{ -+ list_type *p; -+ -+ p = malloc (sizeof (list_type)); -+ if (p == NULL) -+ { -+ return -1; -+ } -+ -+ p->node = node; -+ p->next = *e_list; -+ *e_list = p; -+ -+ return 0; -+} ++ return 0; ++} + +/** + * asn1_find_node: @@ -5893,10 +5405,10 @@ index 000000000..c99c5a4cb + n_start = name; + + if (name[0] == '?' && name[1] == 'C' && p->name[0] == '?') -+ { /* ?CURRENT */ -+ n_start = strchr (n_start, '.'); ++ { /* ?CURRENT */ ++ n_start = strchr(n_start, '.'); + if (n_start) -+ n_start++; ++ n_start++; + } + else if (p->name[0] != 0) + { /* has *pointer got a name ? */ @@ -5904,8 +5416,8 @@ index 000000000..c99c5a4cb + if (n_end) + { + nsize = n_end - n_start; -+ if (nsize >= sizeof (n)) -+ return NULL; ++ if (nsize >= sizeof(n)) ++ return NULL; + + memcpy (n, n_start, nsize); + n[nsize] = 0; @@ -5945,8 +5457,8 @@ index 000000000..c99c5a4cb + if (n_end) + { + nsize = n_end - n_start; -+ if (nsize >= sizeof (n)) -+ return NULL; ++ if (nsize >= sizeof(n)) ++ return NULL; + + memcpy (n, n_start, nsize); + n[nsize] = 0; @@ -5967,11 +5479,11 @@ index 000000000..c99c5a4cb + + p = p->down; + if (p == NULL) -+ return NULL; ++ return NULL; + + /* The identifier "?LAST" indicates the last element + in the right chain. */ -+ if (n[0] == '?' && n[1] == 'L') /* ?LAST */ ++ if (n[0] == '?' && n[1] == 'L') /* ?LAST */ + { + while (p->right) + p = p->right; @@ -5987,7 +5499,7 @@ index 000000000..c99c5a4cb + } + } + if (p == NULL) -+ return NULL; ++ return NULL; + } /* while */ + + return (asn1_node) p; @@ -6126,13 +5638,13 @@ index 000000000..c99c5a4cb + } + + if (prev_len > 0) -+ memcpy (node->value, node->small_value, prev_len); ++ memcpy (node->value, node->small_value, prev_len); + + memcpy (&node->value[prev_len], value, len); + + return node; + } -+ else /* if (node->value != NULL && node->value != node->small_value) */ ++ else /* if (node->value != NULL && node->value != node->small_value) */ + { + /* value is allocated */ + int prev_len = node->value_len; @@ -6258,12 +5770,12 @@ index 000000000..c99c5a4cb + if (node->value != NULL) + { + if (flags & ASN1_DELETE_FLAG_ZEROIZE) -+ { -+ safe_memset (node->value, 0, node->value_len); -+ } ++ { ++ safe_memset(node->value, 0, node->value_len); ++ } + + if (node->value != node->small_value) -+ free (node->value); ++ free (node->value); + } + free (node); +} @@ -6291,8 +5803,8 @@ index 000000000..c99c5a4cb + return p->left; +} + -+static unsigned -+_asn1_is_up (asn1_node_const up_cand, asn1_node_const down) ++static ++unsigned _asn1_is_up (asn1_node_const up_cand, asn1_node_const down) +{ + asn1_node_const d, u; + @@ -6301,10 +5813,10 @@ index 000000000..c99c5a4cb + + d = down; + -+ while ((u = _asn1_find_up (d)) != NULL && u != d) ++ while ((u = _asn1_find_up(d)) != NULL && u != d) + { + if (u == up_cand) -+ return 1; ++ return 1; + d = u; + } + @@ -6316,14 +5828,14 @@ index 000000000..c99c5a4cb +/* Description: deletes the list element given */ +/******************************************************************/ +void -+_asn1_delete_node_from_list (list_type * list, asn1_node node) ++_asn1_delete_node_from_list (list_type *list, asn1_node node) +{ + list_type *p = list; + + while (p) + { + if (p->node == node) -+ p->node = NULL; ++ p->node = NULL; + p = p->next; + } +} @@ -6334,7 +5846,7 @@ index 000000000..c99c5a4cb +/* pointed by them). */ +/******************************************************************/ +void -+_asn1_delete_list (list_type * e_list) ++_asn1_delete_list (list_type *e_list) +{ + list_type *p; + @@ -6352,7 +5864,7 @@ index 000000000..c99c5a4cb +/* pointed by them. */ +/******************************************************************/ +void -+_asn1_delete_list_and_nodes (list_type * e_list) ++_asn1_delete_list_and_nodes (list_type *e_list) +{ + list_type *p; + @@ -6378,7 +5890,7 @@ index 000000000..c99c5a4cb + { + str[0] = '-'; + start = 1; -+ val = -((uint64_t) v); ++ val = -((uint64_t)v); + } + else + { @@ -6395,7 +5907,7 @@ index 000000000..c99c5a4cb + count++; + val = d; + } -+ while (val && ((start + count) < LTOSTR_MAX_SIZE - 1)); ++ while (val && ((start+count) < LTOSTR_MAX_SIZE-1)); + + for (k = 0; k < count; k++) + str[k + start] = temp[start + count - k - 1]; @@ -6484,7 +5996,7 @@ index 000000000..c99c5a4cb +/* otherwise ASN1_SUCCESS */ +/******************************************************************/ +int -+_asn1_expand_object_id (list_type ** list, asn1_node node) ++_asn1_expand_object_id (list_type **list, asn1_node node) +{ + asn1_node p, p2, p3, p4, p5; + char name_root[ASN1_MAX_NAME_SIZE], name2[2 * ASN1_MAX_NAME_SIZE + 1]; @@ -6514,10 +6026,9 @@ index 000000000..c99c5a4cb + { + _asn1_str_cpy (name2, sizeof (name2), name_root); + _asn1_str_cat (name2, sizeof (name2), "."); -+ _asn1_str_cat (name2, sizeof (name2), -+ (char *) p2->value); ++ _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); + p3 = asn1_find_node (node, name2); -+ if (!p3 || _asn1_is_up (p2, p3) || ++ if (!p3 || _asn1_is_up(p2, p3) || + (type_field (p3->type) != ASN1_ETYPE_OBJECT_ID) || + !(p3->type & CONST_ASSIGN)) + return ASN1_ELEMENT_NOT_FOUND; @@ -6525,7 +6036,7 @@ index 000000000..c99c5a4cb + _asn1_set_down (p, p2->right); + if (p2->down) + _asn1_delete_structure (*list, &p2->down, 0); -+ _asn1_delete_node_from_list (*list, p2); ++ _asn1_delete_node_from_list(*list, p2); + _asn1_remove_node (p2, 0); + p2 = p; + p4 = p3->down; @@ -6536,18 +6047,18 @@ index 000000000..c99c5a4cb + { + max_constants++; + if (max_constants == MAX_CONSTANTS) -+ return ASN1_RECURSION; ++ return ASN1_RECURSION; + + p5 = + _asn1_add_single_node (ASN1_ETYPE_CONSTANT); + _asn1_set_name (p5, p4->name); + if (p4->value) -+ { -+ tlen = _asn1_strlen (p4->value); -+ if (tlen > 0) -+ _asn1_set_value (p5, p4->value, tlen + 1); -+ } -+ _asn1_add_static_node2 (list, p5); ++ { ++ tlen = _asn1_strlen (p4->value); ++ if (tlen > 0) ++ _asn1_set_value (p5, p4->value, tlen + 1); ++ } ++ _asn1_add_static_node2(list, p5); + + if (p2 == p) + { @@ -6566,8 +6077,8 @@ index 000000000..c99c5a4cb + move = DOWN; + + tries++; -+ if (tries >= EXPAND_OBJECT_ID_MAX_RECURSION) -+ return ASN1_RECURSION; ++ if (tries >= EXPAND_OBJECT_ID_MAX_RECURSION) ++ return ASN1_RECURSION; + + continue; + } @@ -6787,9 +6298,7 @@ index 000000000..c99c5a4cb + if (p2 == NULL) + { + if (p->value) -+ _asn1_str_cpy (_asn1_identifierMissing, -+ sizeof (_asn1_identifierMissing), -+ (char *) p->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p->value); + else + _asn1_strcpy (_asn1_identifierMissing, "(null)"); + return ASN1_IDENTIFIER_NOT_FOUND; @@ -6803,13 +6312,11 @@ index 000000000..c99c5a4cb + { + _asn1_str_cpy (name2, sizeof (name2), node->name); + if (p2->value) -+ { -+ _asn1_str_cat (name2, sizeof (name2), "."); -+ _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); -+ _asn1_str_cpy (_asn1_identifierMissing, -+ sizeof (_asn1_identifierMissing), -+ (char *) p2->value); -+ } ++ { ++ _asn1_str_cat (name2, sizeof (name2), "."); ++ _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p2->value); ++ } + else + _asn1_strcpy (_asn1_identifierMissing, "(null)"); + @@ -6832,9 +6339,7 @@ index 000000000..c99c5a4cb + _asn1_str_cpy (name2, sizeof (name2), node->name); + _asn1_str_cat (name2, sizeof (name2), "."); + _asn1_str_cat (name2, sizeof (name2), (char *) p2->value); -+ _asn1_str_cpy (_asn1_identifierMissing, -+ sizeof (_asn1_identifierMissing), -+ (char *) p2->value); ++ _asn1_str_cpy (_asn1_identifierMissing, sizeof(_asn1_identifierMissing), (char*)p2->value); + + p2 = asn1_find_node (node, name2); + if (!p2 || (type_field (p2->type) != ASN1_ETYPE_OBJECT_ID) @@ -6933,14 +6438,14 @@ index 000000000..c99c5a4cb + + return ASN1_SUCCESS; +} -diff --git a/grub-core/lib/libtasn1/lib/parser_aux.h b/grub-core/lib/libtasn1/lib/parser_aux.h +diff --git a/grub-core/lib/libtasn1/lib/structure.c b/grub-core/lib/libtasn1/lib/structure.c new file mode 100644 -index 000000000..b21235eb1 +index 00000000000..8189c56a4c9 --- /dev/null -+++ b/grub-core/lib/libtasn1/lib/parser_aux.h -@@ -0,0 +1,172 @@ ++++ b/grub-core/lib/libtasn1/lib/structure.c +@@ -0,0 +1,1220 @@ +/* -+ * Copyright (C) 2000-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -6960,222 +6465,44 @@ index 000000000..b21235eb1 + * 02110-1301, USA + */ + -+#ifndef _PARSER_AUX_H -+# define _PARSER_AUX_H -+ -+/***********************************************/ -+/* Type: list_type */ -+/* Description: type used in the list during */ -+/* the structure creation. */ -+/***********************************************/ -+typedef struct list_struct -+{ -+ asn1_node node; -+ struct list_struct *next; -+} list_type; -+ -+/***************************************/ -+/* Functions used by ASN.1 parser */ -+/***************************************/ -+asn1_node _asn1_add_static_node (list_type ** e_list, unsigned int type); + -+void _asn1_delete_list (list_type * e_list); ++/*****************************************************/ ++/* File: structure.c */ ++/* Description: Functions to create and delete an */ ++/* ASN1 tree. */ ++/*****************************************************/ + -+void _asn1_delete_list_and_nodes (list_type * e_list); + -+void _asn1_delete_node_from_list (list_type * list, asn1_node node); ++#include ++#include ++#include "parser_aux.h" ++#include + -+asn1_node -+_asn1_set_value (asn1_node node, const void *value, unsigned int len); + -+asn1_node _asn1_set_value_m (asn1_node node, void *value, unsigned int len); ++extern char _asn1_identifierMissing[]; + -+asn1_node -+_asn1_set_value_lv (asn1_node node, const void *value, unsigned int len); + ++/******************************************************/ ++/* Function : _asn1_add_single_node */ ++/* Description: creates a new NODE_ASN element. */ ++/* Parameters: */ ++/* type: type of the new element (see ASN1_ETYPE_ */ ++/* and CONST_ constants). */ ++/* Return: pointer to the new element. */ ++/******************************************************/ +asn1_node -+_asn1_append_value (asn1_node node, const void *value, unsigned int len); -+ -+asn1_node _asn1_set_name (asn1_node node, const char *name); -+ -+asn1_node _asn1_cpy_name (asn1_node dst, asn1_node_const src); ++_asn1_add_single_node (unsigned int type) ++{ ++ asn1_node punt; + -+asn1_node _asn1_set_right (asn1_node node, asn1_node right); ++ punt = calloc (1, sizeof (struct asn1_node_st)); ++ if (punt == NULL) ++ return NULL; + -+asn1_node _asn1_get_last_right (asn1_node_const node); ++ punt->type = type; + -+void _asn1_remove_node (asn1_node node, unsigned int flags); -+ -+/* Max 64-bit integer length is 20 chars + 1 for sign + 1 for null termination */ -+# define LTOSTR_MAX_SIZE 22 -+char *_asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]); -+ -+asn1_node _asn1_find_up (asn1_node_const node); -+ -+int _asn1_change_integer_value (asn1_node node); -+ -+# define EXPAND_OBJECT_ID_MAX_RECURSION 16 -+int _asn1_expand_object_id (list_type ** list, asn1_node node); -+ -+int _asn1_type_set_config (asn1_node node); -+ -+int _asn1_check_identifier (asn1_node_const node); -+ -+int _asn1_set_default_tag (asn1_node node); -+ -+/******************************************************************/ -+/* Function : _asn1_get_right */ -+/* Description: returns the element pointed by the RIGHT field of */ -+/* a NODE_ASN element. */ -+/* Parameters: */ -+/* node: NODE_ASN element pointer. */ -+/* Return: field RIGHT of NODE. */ -+/******************************************************************/ -+inline static asn1_node -+_asn1_get_right (asn1_node_const node) -+{ -+ if (node == NULL) -+ return NULL; -+ return node->right; -+} -+ -+/******************************************************************/ -+/* Function : _asn1_set_down */ -+/* Description: sets the field DOWN in a NODE_ASN element. */ -+/* Parameters: */ -+/* node: element pointer. */ -+/* down: pointer to a NODE_ASN element that you want be pointed */ -+/* by NODE. */ -+/* Return: pointer to *NODE. */ -+/******************************************************************/ -+inline static asn1_node -+_asn1_set_down (asn1_node node, asn1_node down) -+{ -+ if (node == NULL) -+ return node; -+ node->down = down; -+ if (down) -+ down->left = node; -+ return node; -+} -+ -+/******************************************************************/ -+/* Function : _asn1_get_down */ -+/* Description: returns the element pointed by the DOWN field of */ -+/* a NODE_ASN element. */ -+/* Parameters: */ -+/* node: NODE_ASN element pointer. */ -+/* Return: field DOWN of NODE. */ -+/******************************************************************/ -+inline static asn1_node -+_asn1_get_down (asn1_node_const node) -+{ -+ if (node == NULL) -+ return NULL; -+ return node->down; -+} -+ -+/******************************************************************/ -+/* Function : _asn1_get_name */ -+/* Description: returns the name of a NODE_ASN element. */ -+/* Parameters: */ -+/* node: NODE_ASN element pointer. */ -+/* Return: a null terminated string. */ -+/******************************************************************/ -+inline static char * -+_asn1_get_name (asn1_node_const node) -+{ -+ if (node == NULL) -+ return NULL; -+ return (char *) node->name; -+} -+ -+/******************************************************************/ -+/* Function : _asn1_mod_type */ -+/* Description: change the field TYPE of an NODE_ASN element. */ -+/* The new value is the old one | (bitwise or) the */ -+/* paramener VALUE. */ -+/* Parameters: */ -+/* node: NODE_ASN element pointer. */ -+/* value: the integer value that must be or-ed with the current */ -+/* value of field TYPE. */ -+/* Return: NODE pointer. */ -+/******************************************************************/ -+inline static asn1_node -+_asn1_mod_type (asn1_node node, unsigned int value) -+{ -+ if (node == NULL) -+ return node; -+ node->type |= value; -+ return node; -+} -+ -+#endif -diff --git a/grub-core/lib/libtasn1/lib/structure.c b/grub-core/lib/libtasn1/lib/structure.c -new file mode 100644 -index 000000000..c0802202e ---- /dev/null -+++ b/grub-core/lib/libtasn1/lib/structure.c -@@ -0,0 +1,1225 @@ -+/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. -+ * -+ * This file is part of LIBTASN1. -+ * -+ * The LIBTASN1 library is free software; you can redistribute it -+ * and/or modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -+ * 02110-1301, USA -+ */ -+ -+ -+/*****************************************************/ -+/* File: structure.c */ -+/* Description: Functions to create and delete an */ -+/* ASN1 tree. */ -+/*****************************************************/ -+ -+ -+#include -+#include -+#include "parser_aux.h" -+#include -+ -+ -+extern char _asn1_identifierMissing[]; -+ -+ -+/******************************************************/ -+/* Function : _asn1_add_single_node */ -+/* Description: creates a new NODE_ASN element. */ -+/* Parameters: */ -+/* type: type of the new element (see ASN1_ETYPE_ */ -+/* and CONST_ constants). */ -+/* Return: pointer to the new element. */ -+/******************************************************/ -+asn1_node -+_asn1_add_single_node (unsigned int type) -+{ -+ asn1_node punt; -+ -+ punt = calloc (1, sizeof (struct asn1_node_st)); -+ if (punt == NULL) -+ return NULL; -+ -+ punt->type = type; -+ -+ return punt; -+} ++ return punt; ++} + + +/******************************************************************/ @@ -7197,8 +6524,8 @@ index 000000000..c0802202e + + +int -+_asn1_create_static_structure (asn1_node_const pointer, -+ char *output_file_name, char *vector_name) ++_asn1_create_static_structure (asn1_node_const pointer, char *output_file_name, ++ char *vector_name) +{ + FILE *file; + asn1_node_const p; @@ -7327,15 +6654,15 @@ index 000000000..c0802202e + if (move == DOWN) + { + if (p_last && p_last->down) -+ _asn1_delete_structure (e_list, &p_last->down, 0); ++ _asn1_delete_structure (e_list, &p_last->down, 0); + _asn1_set_down (p_last, p); + } + else if (move == RIGHT) -+ { ++ { + if (p_last && p_last->right) -+ _asn1_delete_structure (e_list, &p_last->right, 0); ++ _asn1_delete_structure (e_list, &p_last->right, 0); + _asn1_set_right (p_last, p); -+ } ++ } + + p_last = p; + @@ -7418,7 +6745,7 @@ index 000000000..c0802202e +/** + * asn1_delete_structure2: + * @structure: pointer to the structure that you want to delete. -+ * @flags: additional flags (see %ASN1_DELETE_FLAG_ZEROIZE) ++ * @flags: additional flags (see %ASN1_DELETE_FLAG) + * + * Deletes the structure *@structure. At the end, *@structure is set + * to NULL. @@ -7433,8 +6760,7 @@ index 000000000..c0802202e +} + +int -+_asn1_delete_structure (list_type * e_list, asn1_node * structure, -+ unsigned int flags) ++_asn1_delete_structure (list_type *e_list, asn1_node * structure, unsigned int flags) +{ + asn1_node p, p2, p3; + @@ -7538,8 +6864,6 @@ index 000000000..c0802202e + return NULL; + + dest_node = _asn1_add_single_node (source_node->type); -+ if (dest_node == NULL) -+ return dest_node; + + p_s = source_node; + p_d = dest_node; @@ -8012,8 +7336,7 @@ index 000000000..c0802202e + fprintf (out, " value(%i):", + (len - 1) * 8 - (p->value[len2])); + for (k = 1; k < len; k++) -+ fprintf (out, "%02x", -+ (unsigned) (p->value)[k + len2]); ++ fprintf (out, "%02x", (unsigned) (p->value)[k + len2]); + } + } + break; @@ -8235,8 +7558,7 @@ index 000000000..c0802202e + * the OID. + **/ +const char * -+asn1_find_structure_from_oid (asn1_node_const definitions, -+ const char *oidValue) ++asn1_find_structure_from_oid (asn1_node_const definitions, const char *oidValue) +{ + char name[2 * ASN1_MAX_NAME_SIZE + 2]; + char value[ASN1_MAX_NAME_SIZE]; @@ -8257,7 +7579,7 @@ index 000000000..c0802202e + if ((type_field (p->type) == ASN1_ETYPE_OBJECT_ID) && + (p->type & CONST_ASSIGN)) + { -+ snprintf (name, sizeof (name), "%s.%s", definitionsName, p->name); ++ snprintf(name, sizeof(name), "%s.%s", definitionsName, p->name); + + len = ASN1_MAX_NAME_SIZE; + result = asn1_read_value (definitions, name, value, &len); @@ -8340,16 +7662,16 @@ index 000000000..c0802202e +asn1_node +asn1_dup_node (asn1_node_const src, const char *src_name) +{ -+ return _asn1_copy_structure2 (src, src_name); ++ return _asn1_copy_structure2(src, src_name); +} -diff --git a/grub-core/lib/libtasn1/lib/structure.h b/grub-core/lib/libtasn1/lib/structure.h +diff --git a/grub-core/lib/libtasn1/lib/element.h b/grub-core/lib/libtasn1/lib/element.h new file mode 100644 -index 000000000..da70ae53f +index 00000000000..440a33f4bb1 --- /dev/null -+++ b/grub-core/lib/libtasn1/lib/structure.h -@@ -0,0 +1,46 @@ ++++ b/grub-core/lib/libtasn1/lib/element.h +@@ -0,0 +1,40 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2000-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * @@ -8369,213 +7691,720 @@ index 000000000..da70ae53f + * 02110-1301, USA + */ + -+/*************************************************/ -+/* File: structure.h */ -+/* Description: list of exported object by */ -+/* "structure.c" */ -+/*************************************************/ -+ -+#ifndef _STRUCTURE_H -+# define _STRUCTURE_H -+ -+# include "parser_aux.h" // list_type ++#ifndef _ELEMENT_H ++#define _ELEMENT_H + -+int _asn1_create_static_structure (asn1_node_const pointer, -+ char *output_file_name, char *vector_name); + -+asn1_node _asn1_copy_structure3 (asn1_node_const source_node); ++struct node_tail_cache_st ++{ ++ asn1_node head; /* the first element of the sequence */ ++ asn1_node tail; ++}; + -+asn1_node _asn1_add_single_node (unsigned int type); ++int _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcached); + -+asn1_node _asn1_find_left (asn1_node_const node); ++int _asn1_convert_integer (const unsigned char *value, ++ unsigned char *value_out, ++ int value_out_size, int *len); + -+int -+_asn1_delete_structure (list_type * e_list, asn1_node * structure, -+ unsigned int flags); ++void _asn1_hierarchical_name (asn1_node_const node, char *name, int name_size); + +#endif -diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h +diff --git a/grub-core/lib/libtasn1/lib/gstr.h b/grub-core/lib/libtasn1/lib/gstr.h new file mode 100644 -index 000000000..fc695a28a +index 00000000000..48229844ff3 --- /dev/null -+++ b/include/grub/libtasn1.h -@@ -0,0 +1,639 @@ ++++ b/grub-core/lib/libtasn1/lib/gstr.h +@@ -0,0 +1,47 @@ +/* -+ * Copyright (C) 2002-2021 Free Software Foundation, Inc. ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * + * This file is part of LIBTASN1. + * -+ * LIBTASN1 is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU Lesser General Public License as -+ * published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. ++ * The LIBTASN1 library is free software; you can redistribute it ++ * and/or modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. + * -+ * LIBTASN1 is distributed in the hope that it will be useful, but ++ * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public -+ * License along with LIBTASN1; if not, write to the Free Software ++ * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA -+ * -+ */ -+ -+/** -+ * SECTION:libtasn1 -+ * @short_description: GNU ASN.1 library -+ * -+ * The Libtasn1 library provides Abstract Syntax Notation One (ASN.1, as -+ * specified by the X.680 ITU-T recommendation) parsing and structures -+ * management, and Distinguished Encoding Rules (DER, as per X.690) -+ * encoding and decoding functions. + */ + ++#ifndef GSTR_H ++# define GSTR_H + -+#ifndef LIBTASN1_H -+# define LIBTASN1_H -+ -+# ifndef ASN1_API -+# if defined ASN1_BUILDING && defined HAVE_VISIBILITY && HAVE_VISIBILITY -+# define ASN1_API __attribute__((__visibility__("default"))) -+# elif defined ASN1_BUILDING && defined _MSC_VER && ! defined ASN1_STATIC -+# define ASN1_API __declspec(dllexport) -+# elif defined _MSC_VER && ! defined ASN1_STATIC -+# define ASN1_API __declspec(dllimport) -+# else -+# define ASN1_API -+# endif -+# endif -+ -+# ifdef __GNUC__ -+# define __LIBTASN1_CONST__ __attribute__((const)) -+# define __LIBTASN1_PURE__ __attribute__((pure)) -+# else -+# define __LIBTASN1_CONST__ -+# define __LIBTASN1_PURE__ -+# endif ++unsigned int _asn1_str_cpy (char *dest, size_t dest_tot_size, ++ const char *src); ++void _asn1_str_cat (char *dest, size_t dest_tot_size, const char *src); + -+# include -+# include -+# include /* for FILE* */ ++#define Estrcpy(x,y) _asn1_str_cpy(x,ASN1_MAX_ERROR_DESCRIPTION_SIZE,y) ++#define Estrcat(x,y) _asn1_str_cat(x,ASN1_MAX_ERROR_DESCRIPTION_SIZE,y) + -+# ifdef __cplusplus -+extern "C" ++inline static ++void safe_memset(void *data, int c, size_t size) +{ -+# endif ++ volatile unsigned volatile_zero = 0; ++ volatile char *vdata = (volatile char*)data; + -+/** -+ * ASN1_VERSION: -+ * -+ * Version of the library as a string. -+ */ -+# define ASN1_VERSION "4.18.0" ++ /* This is based on a nice trick for safe memset, ++ * sent by David Jacobson in the openssl-dev mailing list. ++ */ + -+/** -+ * ASN1_VERSION_MAJOR: -+ * -+ * Major version number of the library. -+ */ -+# define ASN1_VERSION_MAJOR 4 ++ if (size > 0) do { ++ memset(data, c, size); ++ } while(vdata[volatile_zero] != c); ++} + -+/** -+ * ASN1_VERSION_MINOR: ++#endif /* GSTR_H */ +diff --git a/grub-core/lib/libtasn1/lib/int.h b/grub-core/lib/libtasn1/lib/int.h +new file mode 100644 +index 00000000000..ea1625786c1 +--- /dev/null ++++ b/grub-core/lib/libtasn1/lib/int.h +@@ -0,0 +1,221 @@ ++/* ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. + * -+ * Minor version number of the library. -+ */ -+# define ASN1_VERSION_MINOR 18 -+ -+/** -+ * ASN1_VERSION_PATCH: ++ * This file is part of LIBTASN1. + * -+ * Patch version number of the library. -+ */ -+# define ASN1_VERSION_PATCH 0 ++ * The LIBTASN1 library is free software; you can redistribute it ++ * and/or modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA ++ * 02110-1301, USA ++ */ ++ ++#ifndef INT_H ++#define INT_H ++ ++#ifdef HAVE_CONFIG_H ++#include ++#endif ++ ++#include ++#include ++#include ++#include ++ ++#ifdef HAVE_SYS_TYPES_H ++#include ++#endif ++ ++#include ++ ++#define ASN1_SMALL_VALUE_SIZE 16 ++ ++/* This structure is also in libtasn1.h, but then contains less ++ fields. You cannot make any modifications to these first fields ++ without breaking ABI. */ ++struct asn1_node_st ++{ ++ /* public fields: */ ++ char name[ASN1_MAX_NAME_SIZE + 1]; /* Node name */ ++ unsigned int name_hash; ++ unsigned int type; /* Node type */ ++ unsigned char *value; /* Node value */ ++ int value_len; ++ asn1_node down; /* Pointer to the son node */ ++ asn1_node right; /* Pointer to the brother node */ ++ asn1_node left; /* Pointer to the next list element */ ++ /* private fields: */ ++ unsigned char small_value[ASN1_SMALL_VALUE_SIZE]; /* For small values */ ++ ++ /* values used during decoding/coding */ ++ int tmp_ival; ++ unsigned start; /* the start of the DER sequence - if decoded */ ++ unsigned end; /* the end of the DER sequence - if decoded */ ++}; ++ ++typedef struct tag_and_class_st ++{ ++ unsigned tag; ++ unsigned class; ++ const char *desc; ++} tag_and_class_st; ++ ++/* the types that are handled in _asn1_tags */ ++#define CASE_HANDLED_ETYPES \ ++ case ASN1_ETYPE_NULL: \ ++ case ASN1_ETYPE_BOOLEAN: \ ++ case ASN1_ETYPE_INTEGER: \ ++ case ASN1_ETYPE_ENUMERATED: \ ++ case ASN1_ETYPE_OBJECT_ID: \ ++ case ASN1_ETYPE_OCTET_STRING: \ ++ case ASN1_ETYPE_GENERALSTRING: \ ++ case ASN1_ETYPE_NUMERIC_STRING: \ ++ case ASN1_ETYPE_IA5_STRING: \ ++ case ASN1_ETYPE_TELETEX_STRING: \ ++ case ASN1_ETYPE_PRINTABLE_STRING: \ ++ case ASN1_ETYPE_UNIVERSAL_STRING: \ ++ case ASN1_ETYPE_BMP_STRING: \ ++ case ASN1_ETYPE_UTF8_STRING: \ ++ case ASN1_ETYPE_VISIBLE_STRING: \ ++ case ASN1_ETYPE_BIT_STRING: \ ++ case ASN1_ETYPE_SEQUENCE: \ ++ case ASN1_ETYPE_SEQUENCE_OF: \ ++ case ASN1_ETYPE_SET: \ ++ case ASN1_ETYPE_UTC_TIME: \ ++ case ASN1_ETYPE_GENERALIZED_TIME: \ ++ case ASN1_ETYPE_SET_OF ++ ++#define ETYPE_TAG(etype) (_asn1_tags[etype].tag) ++#define ETYPE_CLASS(etype) (_asn1_tags[etype].class) ++#define ETYPE_OK(etype) (((etype) != ASN1_ETYPE_INVALID && \ ++ (etype) <= _asn1_tags_size && \ ++ _asn1_tags[(etype)].desc != NULL)?1:0) ++ ++#define ETYPE_IS_STRING(etype) ((etype == ASN1_ETYPE_GENERALSTRING || \ ++ etype == ASN1_ETYPE_NUMERIC_STRING || etype == ASN1_ETYPE_IA5_STRING || \ ++ etype == ASN1_ETYPE_TELETEX_STRING || etype == ASN1_ETYPE_PRINTABLE_STRING || \ ++ etype == ASN1_ETYPE_UNIVERSAL_STRING || etype == ASN1_ETYPE_BMP_STRING || \ ++ etype == ASN1_ETYPE_UTF8_STRING || etype == ASN1_ETYPE_VISIBLE_STRING || \ ++ etype == ASN1_ETYPE_OCTET_STRING)?1:0) ++ ++extern unsigned int _asn1_tags_size; ++extern const tag_and_class_st _asn1_tags[]; ++ ++#define _asn1_strlen(s) strlen((const char *) s) ++#define _asn1_strtol(n,e,b) strtol((const char *) n, e, b) ++#define _asn1_strtoul(n,e,b) strtoul((const char *) n, e, b) ++#define _asn1_strcmp(a,b) strcmp((const char *)a, (const char *)b) ++#define _asn1_strcpy(a,b) strcpy((char *)a, (const char *)b) ++#define _asn1_strcat(a,b) strcat((char *)a, (const char *)b) ++ ++#if SIZEOF_UNSIGNED_LONG_INT == 8 ++# define _asn1_strtou64(n,e,b) strtoul((const char *) n, e, b) ++#else ++# define _asn1_strtou64(n,e,b) strtoull((const char *) n, e, b) ++#endif ++ ++#define MAX_LOG_SIZE 1024 /* maximum number of characters of a log message */ ++ ++/* Define used for visiting trees. */ ++#define UP 1 ++#define RIGHT 2 ++#define DOWN 3 ++ ++/***********************************************************************/ ++/* List of constants to better specify the type of typedef asn1_node_st. */ ++/***********************************************************************/ ++/* Used with TYPE_TAG */ ++#define CONST_UNIVERSAL (1U<<8) ++#define CONST_PRIVATE (1U<<9) ++#define CONST_APPLICATION (1U<<10) ++#define CONST_EXPLICIT (1U<<11) ++#define CONST_IMPLICIT (1U<<12) ++ ++#define CONST_TAG (1U<<13) /* Used in ASN.1 assignement */ ++#define CONST_OPTION (1U<<14) ++#define CONST_DEFAULT (1U<<15) ++#define CONST_TRUE (1U<<16) ++#define CONST_FALSE (1U<<17) ++ ++#define CONST_LIST (1U<<18) /* Used with TYPE_INTEGER and TYPE_BIT_STRING */ ++#define CONST_MIN_MAX (1U<<19) ++ ++#define CONST_1_PARAM (1U<<20) ++ ++#define CONST_SIZE (1U<<21) ++ ++#define CONST_DEFINED_BY (1U<<22) ++ ++/* Those two are deprecated and used for backwards compatibility */ ++#define CONST_GENERALIZED (1U<<23) ++#define CONST_UTC (1U<<24) ++ ++/* #define CONST_IMPORTS (1U<<25) */ ++ ++#define CONST_NOT_USED (1U<<26) ++#define CONST_SET (1U<<27) ++#define CONST_ASSIGN (1U<<28) ++ ++#define CONST_DOWN (1U<<29) ++#define CONST_RIGHT (1U<<30) ++ ++ ++#define ASN1_ETYPE_TIME 17 ++/****************************************/ ++/* Returns the first 8 bits. */ ++/* Used with the field type of asn1_node_st */ ++/****************************************/ ++inline static unsigned int ++type_field (unsigned int ntype) ++{ ++ return (ntype & 0xff); ++} ++ ++/* To convert old types from a static structure */ ++inline static unsigned int ++convert_old_type (unsigned int ntype) ++{ ++ unsigned int type = ntype & 0xff; ++ if (type == ASN1_ETYPE_TIME) ++ { ++ if (ntype & CONST_UTC) ++ type = ASN1_ETYPE_UTC_TIME; ++ else ++ type = ASN1_ETYPE_GENERALIZED_TIME; ++ ++ ntype &= ~(CONST_UTC | CONST_GENERALIZED); ++ ntype &= 0xffffff00; ++ ntype |= type; ++ ++ return ntype; ++ } ++ else ++ return ntype; ++} ++ ++static inline ++void *_asn1_realloc(void *ptr, size_t size) ++{ ++ void *ret; ++ ++ if (size == 0) ++ return ptr; ++ ++ ret = realloc(ptr, size); ++ if (ret == NULL) ++ { ++ free(ptr); ++ } ++ return ret; ++} ++ ++#endif /* INT_H */ +diff --git a/grub-core/lib/libtasn1/lib/parser_aux.h b/grub-core/lib/libtasn1/lib/parser_aux.h +new file mode 100644 +index 00000000000..598e684b355 +--- /dev/null ++++ b/grub-core/lib/libtasn1/lib/parser_aux.h +@@ -0,0 +1,172 @@ ++/* ++ * Copyright (C) 2000-2014 Free Software Foundation, Inc. ++ * ++ * This file is part of LIBTASN1. ++ * ++ * The LIBTASN1 library is free software; you can redistribute it ++ * and/or modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA ++ * 02110-1301, USA ++ */ ++ ++#ifndef _PARSER_AUX_H ++#define _PARSER_AUX_H ++ ++/***********************************************/ ++/* Type: list_type */ ++/* Description: type used in the list during */ ++/* the structure creation. */ ++/***********************************************/ ++typedef struct list_struct ++{ ++ asn1_node node; ++ struct list_struct *next; ++} list_type; ++ ++/***************************************/ ++/* Functions used by ASN.1 parser */ ++/***************************************/ ++asn1_node _asn1_add_static_node (list_type **e_list, unsigned int type); ++ ++void _asn1_delete_list (list_type *e_list); ++ ++void _asn1_delete_list_and_nodes (list_type *e_list); ++ ++void _asn1_delete_node_from_list (list_type *list, asn1_node node); ++ ++asn1_node ++_asn1_set_value (asn1_node node, const void *value, unsigned int len); ++ ++asn1_node _asn1_set_value_m (asn1_node node, void *value, unsigned int len); ++ ++asn1_node ++_asn1_set_value_lv (asn1_node node, const void *value, unsigned int len); ++ ++asn1_node ++_asn1_append_value (asn1_node node, const void *value, unsigned int len); ++ ++asn1_node _asn1_set_name (asn1_node node, const char *name); ++ ++asn1_node _asn1_cpy_name (asn1_node dst, asn1_node_const src); ++ ++asn1_node _asn1_set_right (asn1_node node, asn1_node right); ++ ++asn1_node _asn1_get_last_right (asn1_node_const node); ++ ++void _asn1_remove_node (asn1_node node, unsigned int flags); ++ ++/* Max 64-bit integer length is 20 chars + 1 for sign + 1 for null termination */ ++#define LTOSTR_MAX_SIZE 22 ++char *_asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]); ++ ++asn1_node _asn1_find_up (asn1_node_const node); ++ ++int _asn1_change_integer_value (asn1_node node); ++ ++#define EXPAND_OBJECT_ID_MAX_RECURSION 16 ++int _asn1_expand_object_id (list_type **list, asn1_node node); ++ ++int _asn1_type_set_config (asn1_node node); ++ ++int _asn1_check_identifier (asn1_node_const node); ++ ++int _asn1_set_default_tag (asn1_node node); ++ ++/******************************************************************/ ++/* Function : _asn1_get_right */ ++/* Description: returns the element pointed by the RIGHT field of */ ++/* a NODE_ASN element. */ ++/* Parameters: */ ++/* node: NODE_ASN element pointer. */ ++/* Return: field RIGHT of NODE. */ ++/******************************************************************/ ++inline static asn1_node ++_asn1_get_right (asn1_node_const node) ++{ ++ if (node == NULL) ++ return NULL; ++ return node->right; ++} ++ ++/******************************************************************/ ++/* Function : _asn1_set_down */ ++/* Description: sets the field DOWN in a NODE_ASN element. */ ++/* Parameters: */ ++/* node: element pointer. */ ++/* down: pointer to a NODE_ASN element that you want be pointed */ ++/* by NODE. */ ++/* Return: pointer to *NODE. */ ++/******************************************************************/ ++inline static asn1_node ++_asn1_set_down (asn1_node node, asn1_node down) ++{ ++ if (node == NULL) ++ return node; ++ node->down = down; ++ if (down) ++ down->left = node; ++ return node; ++} ++ ++/******************************************************************/ ++/* Function : _asn1_get_down */ ++/* Description: returns the element pointed by the DOWN field of */ ++/* a NODE_ASN element. */ ++/* Parameters: */ ++/* node: NODE_ASN element pointer. */ ++/* Return: field DOWN of NODE. */ ++/******************************************************************/ ++inline static asn1_node ++_asn1_get_down (asn1_node_const node) ++{ ++ if (node == NULL) ++ return NULL; ++ return node->down; ++} ++ ++/******************************************************************/ ++/* Function : _asn1_get_name */ ++/* Description: returns the name of a NODE_ASN element. */ ++/* Parameters: */ ++/* node: NODE_ASN element pointer. */ ++/* Return: a null terminated string. */ ++/******************************************************************/ ++inline static char * ++_asn1_get_name (asn1_node_const node) ++{ ++ if (node == NULL) ++ return NULL; ++ return (char *) node->name; ++} ++ ++/******************************************************************/ ++/* Function : _asn1_mod_type */ ++/* Description: change the field TYPE of an NODE_ASN element. */ ++/* The new value is the old one | (bitwise or) the */ ++/* paramener VALUE. */ ++/* Parameters: */ ++/* node: NODE_ASN element pointer. */ ++/* value: the integer value that must be or-ed with the current */ ++/* value of field TYPE. */ ++/* Return: NODE pointer. */ ++/******************************************************************/ ++inline static asn1_node ++_asn1_mod_type (asn1_node node, unsigned int value) ++{ ++ if (node == NULL) ++ return node; ++ node->type |= value; ++ return node; ++} ++ ++#endif +diff --git a/grub-core/lib/libtasn1/lib/structure.h b/grub-core/lib/libtasn1/lib/structure.h +new file mode 100644 +index 00000000000..99e685da07a +--- /dev/null ++++ b/grub-core/lib/libtasn1/lib/structure.h +@@ -0,0 +1,45 @@ ++/* ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. ++ * ++ * This file is part of LIBTASN1. ++ * ++ * The LIBTASN1 library is free software; you can redistribute it ++ * and/or modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA ++ * 02110-1301, USA ++ */ ++ ++/*************************************************/ ++/* File: structure.h */ ++/* Description: list of exported object by */ ++/* "structure.c" */ ++/*************************************************/ ++ ++#ifndef _STRUCTURE_H ++#define _STRUCTURE_H ++ ++#include "parser_aux.h" // list_type ++ ++int _asn1_create_static_structure (asn1_node_const pointer, ++ char *output_file_name, char *vector_name); ++ ++asn1_node _asn1_copy_structure3 (asn1_node_const source_node); ++ ++asn1_node _asn1_add_single_node (unsigned int type); ++ ++asn1_node _asn1_find_left (asn1_node_const node); ++ ++int ++_asn1_delete_structure (list_type *e_list, asn1_node *structure, unsigned int flags); ++ ++#endif +diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h +new file mode 100644 +index 00000000000..6fd7a30dc35 +--- /dev/null ++++ b/include/grub/libtasn1.h +@@ -0,0 +1,588 @@ ++/* ++ * Copyright (C) 2002-2014 Free Software Foundation, Inc. ++ * ++ * This file is part of LIBTASN1. ++ * ++ * LIBTASN1 is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU Lesser General Public License as ++ * published by the Free Software Foundation; either version 2.1 of ++ * the License, or (at your option) any later version. ++ * ++ * LIBTASN1 is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with LIBTASN1; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA ++ * 02110-1301, USA ++ * ++ */ ++ ++/** ++ * libtasn1:Short_Description: ++ * ++ * GNU ASN.1 library ++ */ ++/** ++ * libtasn1:Long_Description: ++ * ++ * The Libtasn1 library provides Abstract Syntax Notation One (ASN.1, as ++ * specified by the X.680 ITU-T recommendation) parsing and structures ++ * management, and Distinguished Encoding Rules (DER, as per X.690) ++ * encoding and decoding functions. ++ */ ++ ++ ++#ifndef LIBTASN1_H ++#define LIBTASN1_H ++ ++#ifndef ASN1_API ++#if defined ASN1_BUILDING && defined HAVE_VISIBILITY && HAVE_VISIBILITY ++#define ASN1_API __attribute__((__visibility__("default"))) ++#elif defined ASN1_BUILDING && defined _MSC_VER && ! defined ASN1_STATIC ++#define ASN1_API __declspec(dllexport) ++#elif defined _MSC_VER && ! defined ASN1_STATIC ++#define ASN1_API __declspec(dllimport) ++#else ++#define ASN1_API ++#endif ++#endif ++ ++#ifdef __GNUC__ ++# define __LIBTASN1_CONST__ __attribute__((const)) ++# define __LIBTASN1_PURE__ __attribute__((pure)) ++#else ++# define __LIBTASN1_CONST__ ++# define __LIBTASN1_PURE__ ++#endif ++ ++#include ++#include ++#include /* for FILE* */ ++ ++#ifdef __cplusplus ++extern "C" ++{ ++#endif ++ ++/** ++ * ASN1_VERSION: ++ * ++ * Version of the library as a string. ++ */ ++#define ASN1_VERSION "4.16.0" ++ ++/** ++ * ASN1_VERSION_MAJOR: ++ * ++ * Major version number of the library. ++ */ ++#define ASN1_VERSION_MAJOR 4 ++ ++/** ++ * ASN1_VERSION_MINOR: ++ * ++ * Minor version number of the library. ++ */ ++#define ASN1_VERSION_MINOR 16 ++ ++/** ++ * ASN1_VERSION_PATCH: ++ * ++ * Patch version number of the library. ++ */ ++#define ASN1_VERSION_PATCH 0 + +/** + * ASN1_VERSION_NUMBER: + * + * Version number of the library as a number. + */ -+# define ASN1_VERSION_NUMBER 0x041200 ++#define ASN1_VERSION_NUMBER 0x041000 + + -+# if defined __GNUC__ && !defined ASN1_INTERNAL_BUILD -+# define _ASN1_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) -+# if _ASN1_GCC_VERSION >= 30100 -+# define _ASN1_GCC_ATTR_DEPRECATED __attribute__ ((__deprecated__)) -+# endif ++#if defined __GNUC__ && !defined ASN1_INTERNAL_BUILD ++# define _ASN1_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) ++# if _ASN1_GCC_VERSION >= 30100 ++# define _ASN1_GCC_ATTR_DEPRECATED __attribute__ ((__deprecated__)) +# endif ++#endif + -+# ifndef _ASN1_GCC_ATTR_DEPRECATED -+# define _ASN1_GCC_ATTR_DEPRECATED -+# endif ++#ifndef _ASN1_GCC_ATTR_DEPRECATED ++#define _ASN1_GCC_ATTR_DEPRECATED ++#endif + +/*****************************************/ +/* Errors returned by libtasn1 functions */ +/*****************************************/ -+# define ASN1_SUCCESS 0 -+# define ASN1_FILE_NOT_FOUND 1 -+# define ASN1_ELEMENT_NOT_FOUND 2 -+# define ASN1_IDENTIFIER_NOT_FOUND 3 -+# define ASN1_DER_ERROR 4 -+# define ASN1_VALUE_NOT_FOUND 5 -+# define ASN1_GENERIC_ERROR 6 -+# define ASN1_VALUE_NOT_VALID 7 -+# define ASN1_TAG_ERROR 8 -+# define ASN1_TAG_IMPLICIT 9 -+# define ASN1_ERROR_TYPE_ANY 10 -+# define ASN1_SYNTAX_ERROR 11 -+# define ASN1_MEM_ERROR 12 -+# define ASN1_MEM_ALLOC_ERROR 13 -+# define ASN1_DER_OVERFLOW 14 -+# define ASN1_NAME_TOO_LONG 15 -+# define ASN1_ARRAY_ERROR 16 -+# define ASN1_ELEMENT_NOT_EMPTY 17 -+# define ASN1_TIME_ENCODING_ERROR 18 -+# define ASN1_RECURSION 19 ++#define ASN1_SUCCESS 0 ++#define ASN1_FILE_NOT_FOUND 1 ++#define ASN1_ELEMENT_NOT_FOUND 2 ++#define ASN1_IDENTIFIER_NOT_FOUND 3 ++#define ASN1_DER_ERROR 4 ++#define ASN1_VALUE_NOT_FOUND 5 ++#define ASN1_GENERIC_ERROR 6 ++#define ASN1_VALUE_NOT_VALID 7 ++#define ASN1_TAG_ERROR 8 ++#define ASN1_TAG_IMPLICIT 9 ++#define ASN1_ERROR_TYPE_ANY 10 ++#define ASN1_SYNTAX_ERROR 11 ++#define ASN1_MEM_ERROR 12 ++#define ASN1_MEM_ALLOC_ERROR 13 ++#define ASN1_DER_OVERFLOW 14 ++#define ASN1_NAME_TOO_LONG 15 ++#define ASN1_ARRAY_ERROR 16 ++#define ASN1_ELEMENT_NOT_EMPTY 17 ++#define ASN1_TIME_ENCODING_ERROR 18 ++#define ASN1_RECURSION 19 + +/*************************************/ +/* Constants used in asn1_visit_tree */ +/*************************************/ -+# define ASN1_PRINT_NAME 1 -+# define ASN1_PRINT_NAME_TYPE 2 -+# define ASN1_PRINT_NAME_TYPE_VALUE 3 -+# define ASN1_PRINT_ALL 4 ++#define ASN1_PRINT_NAME 1 ++#define ASN1_PRINT_NAME_TYPE 2 ++#define ASN1_PRINT_NAME_TYPE_VALUE 3 ++#define ASN1_PRINT_ALL 4 + +/*****************************************/ +/* Constants returned by asn1_read_tag */ +/*****************************************/ -+# define ASN1_CLASS_UNIVERSAL 0x00 /* old: 1 */ -+# define ASN1_CLASS_APPLICATION 0x40 /* old: 2 */ -+# define ASN1_CLASS_CONTEXT_SPECIFIC 0x80 /* old: 3 */ -+# define ASN1_CLASS_PRIVATE 0xC0 /* old: 4 */ -+# define ASN1_CLASS_STRUCTURED 0x20 ++#define ASN1_CLASS_UNIVERSAL 0x00 /* old: 1 */ ++#define ASN1_CLASS_APPLICATION 0x40 /* old: 2 */ ++#define ASN1_CLASS_CONTEXT_SPECIFIC 0x80 /* old: 3 */ ++#define ASN1_CLASS_PRIVATE 0xC0 /* old: 4 */ ++#define ASN1_CLASS_STRUCTURED 0x20 + +/*****************************************/ +/* Constants returned by asn1_read_tag */ +/*****************************************/ -+# define ASN1_TAG_BOOLEAN 0x01 -+# define ASN1_TAG_INTEGER 0x02 -+# define ASN1_TAG_SEQUENCE 0x10 -+# define ASN1_TAG_SET 0x11 -+# define ASN1_TAG_OCTET_STRING 0x04 -+# define ASN1_TAG_BIT_STRING 0x03 -+# define ASN1_TAG_UTCTime 0x17 -+# define ASN1_TAG_GENERALIZEDTime 0x18 -+# define ASN1_TAG_OBJECT_ID 0x06 -+# define ASN1_TAG_ENUMERATED 0x0A -+# define ASN1_TAG_NULL 0x05 -+# define ASN1_TAG_GENERALSTRING 0x1B -+# define ASN1_TAG_NUMERIC_STRING 0x12 -+# define ASN1_TAG_IA5_STRING 0x16 -+# define ASN1_TAG_TELETEX_STRING 0x14 -+# define ASN1_TAG_PRINTABLE_STRING 0x13 -+# define ASN1_TAG_UNIVERSAL_STRING 0x1C -+# define ASN1_TAG_BMP_STRING 0x1E -+# define ASN1_TAG_UTF8_STRING 0x0C -+# define ASN1_TAG_VISIBLE_STRING 0x1A ++#define ASN1_TAG_BOOLEAN 0x01 ++#define ASN1_TAG_INTEGER 0x02 ++#define ASN1_TAG_SEQUENCE 0x10 ++#define ASN1_TAG_SET 0x11 ++#define ASN1_TAG_OCTET_STRING 0x04 ++#define ASN1_TAG_BIT_STRING 0x03 ++#define ASN1_TAG_UTCTime 0x17 ++#define ASN1_TAG_GENERALIZEDTime 0x18 ++#define ASN1_TAG_OBJECT_ID 0x06 ++#define ASN1_TAG_ENUMERATED 0x0A ++#define ASN1_TAG_NULL 0x05 ++#define ASN1_TAG_GENERALSTRING 0x1B ++#define ASN1_TAG_NUMERIC_STRING 0x12 ++#define ASN1_TAG_IA5_STRING 0x16 ++#define ASN1_TAG_TELETEX_STRING 0x14 ++#define ASN1_TAG_PRINTABLE_STRING 0x13 ++#define ASN1_TAG_UNIVERSAL_STRING 0x1C ++#define ASN1_TAG_BMP_STRING 0x1E ++#define ASN1_TAG_UTF8_STRING 0x0C ++#define ASN1_TAG_VISIBLE_STRING 0x1A + +/** + * asn1_node: @@ -8583,10 +8412,10 @@ index 000000000..fc695a28a + * Structure definition used for the node of the tree + * that represents an ASN.1 DEFINITION. + */ -+ typedef struct asn1_node_st asn1_node_st; ++typedef struct asn1_node_st asn1_node_st; + -+ typedef asn1_node_st *asn1_node; -+ typedef const asn1_node_st *asn1_node_const; ++typedef asn1_node_st *asn1_node; ++typedef const asn1_node_st *asn1_node_const; + +/** + * ASN1_MAX_NAME_SIZE: @@ -8594,7 +8423,7 @@ index 000000000..fc695a28a + * Maximum number of characters of a name + * inside a file with ASN1 definitions. + */ -+# define ASN1_MAX_NAME_SIZE 64 ++#define ASN1_MAX_NAME_SIZE 64 + + +/** @@ -8605,46 +8434,47 @@ index 000000000..fc695a28a + * + * For the on-disk format of ASN.1 trees, created by asn1_parser2array(). + */ -+ typedef struct asn1_static_node_st -+ { -+ const char *name; /* Node name */ -+ unsigned int type; /* Node type */ -+ const void *value; /* Node value */ -+ } asn1_static_node; -+ -+/* List of constants for field type of asn1_static_node */ -+# define ASN1_ETYPE_INVALID 0 -+# define ASN1_ETYPE_CONSTANT 1 -+# define ASN1_ETYPE_IDENTIFIER 2 -+# define ASN1_ETYPE_INTEGER 3 -+# define ASN1_ETYPE_BOOLEAN 4 -+# define ASN1_ETYPE_SEQUENCE 5 -+# define ASN1_ETYPE_BIT_STRING 6 -+# define ASN1_ETYPE_OCTET_STRING 7 -+# define ASN1_ETYPE_TAG 8 -+# define ASN1_ETYPE_DEFAULT 9 -+# define ASN1_ETYPE_SIZE 10 -+# define ASN1_ETYPE_SEQUENCE_OF 11 -+# define ASN1_ETYPE_OBJECT_ID 12 -+# define ASN1_ETYPE_ANY 13 -+# define ASN1_ETYPE_SET 14 -+# define ASN1_ETYPE_SET_OF 15 -+# define ASN1_ETYPE_DEFINITIONS 16 -+# define ASN1_ETYPE_CHOICE 18 -+# define ASN1_ETYPE_IMPORTS 19 -+# define ASN1_ETYPE_NULL 20 -+# define ASN1_ETYPE_ENUMERATED 21 -+# define ASN1_ETYPE_GENERALSTRING 27 -+# define ASN1_ETYPE_NUMERIC_STRING 28 -+# define ASN1_ETYPE_IA5_STRING 29 -+# define ASN1_ETYPE_TELETEX_STRING 30 -+# define ASN1_ETYPE_PRINTABLE_STRING 31 -+# define ASN1_ETYPE_UNIVERSAL_STRING 32 -+# define ASN1_ETYPE_BMP_STRING 33 -+# define ASN1_ETYPE_UTF8_STRING 34 -+# define ASN1_ETYPE_VISIBLE_STRING 35 -+# define ASN1_ETYPE_UTC_TIME 36 -+# define ASN1_ETYPE_GENERALIZED_TIME 37 ++struct asn1_static_node_st ++{ ++ const char *name; /* Node name */ ++ unsigned int type; /* Node type */ ++ const void *value; /* Node value */ ++}; ++typedef struct asn1_static_node_st asn1_static_node; ++ ++/* List of constants for field type of node_asn */ ++#define ASN1_ETYPE_INVALID 0 ++#define ASN1_ETYPE_CONSTANT 1 ++#define ASN1_ETYPE_IDENTIFIER 2 ++#define ASN1_ETYPE_INTEGER 3 ++#define ASN1_ETYPE_BOOLEAN 4 ++#define ASN1_ETYPE_SEQUENCE 5 ++#define ASN1_ETYPE_BIT_STRING 6 ++#define ASN1_ETYPE_OCTET_STRING 7 ++#define ASN1_ETYPE_TAG 8 ++#define ASN1_ETYPE_DEFAULT 9 ++#define ASN1_ETYPE_SIZE 10 ++#define ASN1_ETYPE_SEQUENCE_OF 11 ++#define ASN1_ETYPE_OBJECT_ID 12 ++#define ASN1_ETYPE_ANY 13 ++#define ASN1_ETYPE_SET 14 ++#define ASN1_ETYPE_SET_OF 15 ++#define ASN1_ETYPE_DEFINITIONS 16 ++#define ASN1_ETYPE_CHOICE 18 ++#define ASN1_ETYPE_IMPORTS 19 ++#define ASN1_ETYPE_NULL 20 ++#define ASN1_ETYPE_ENUMERATED 21 ++#define ASN1_ETYPE_GENERALSTRING 27 ++#define ASN1_ETYPE_NUMERIC_STRING 28 ++#define ASN1_ETYPE_IA5_STRING 29 ++#define ASN1_ETYPE_TELETEX_STRING 30 ++#define ASN1_ETYPE_PRINTABLE_STRING 31 ++#define ASN1_ETYPE_UNIVERSAL_STRING 32 ++#define ASN1_ETYPE_BMP_STRING 33 ++#define ASN1_ETYPE_UTF8_STRING 34 ++#define ASN1_ETYPE_VISIBLE_STRING 35 ++#define ASN1_ETYPE_UTC_TIME 36 ++#define ASN1_ETYPE_GENERALIZED_TIME 37 + +/** + * ASN1_DELETE_FLAG_ZEROIZE: @@ -8653,7 +8483,7 @@ index 000000000..fc695a28a + * + * Zeroize values prior to deinitialization. + */ -+# define ASN1_DELETE_FLAG_ZEROIZE 1 ++#define ASN1_DELETE_FLAG_ZEROIZE 1 + +/** + * ASN1_DECODE_FLAG_ALLOW_PADDING: @@ -8662,7 +8492,7 @@ index 000000000..fc695a28a + * + * This flag would allow arbitrary data past the DER data. + */ -+# define ASN1_DECODE_FLAG_ALLOW_PADDING 1 ++#define ASN1_DECODE_FLAG_ALLOW_PADDING 1 +/** + * ASN1_DECODE_FLAG_STRICT_DER: + * @@ -8670,7 +8500,7 @@ index 000000000..fc695a28a + * + * This flag would ensure that no BER decoding takes place. + */ -+# define ASN1_DECODE_FLAG_STRICT_DER (1<<1) ++#define ASN1_DECODE_FLAG_STRICT_DER (1<<1) +/** + * ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME: + * @@ -8678,7 +8508,7 @@ index 000000000..fc695a28a + * + * This flag will tolerate Time encoding errors when in strict DER. + */ -+# define ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME (1<<2) ++#define ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME (1<<2) + + +/** @@ -8690,14 +8520,14 @@ index 000000000..fc695a28a + * + * Data node inside a #asn1_node structure. + */ -+ struct asn1_data_node_st -+ { -+ const char *name; /* Node name */ -+ const void *value; /* Node value */ -+ unsigned int value_len; /* Node value size */ -+ unsigned int type; /* Node value type (ASN1_ETYPE_*) */ -+ }; -+ typedef struct asn1_data_node_st asn1_data_node_st; ++struct asn1_data_node_st ++{ ++ const char *name; /* Node name */ ++ const void *value; /* Node value */ ++ unsigned int value_len; /* Node value size */ ++ unsigned int type; /* Node value type (ASN1_ETYPE_*) */ ++}; ++typedef struct asn1_data_node_st asn1_data_node_st; + +/***********************************/ +/* Fixed constants */ @@ -8710,183 +8540,181 @@ index 000000000..fc695a28a + * of a description message + * (null character included). + */ -+# define ASN1_MAX_ERROR_DESCRIPTION_SIZE 128 ++#define ASN1_MAX_ERROR_DESCRIPTION_SIZE 128 + +/***********************************/ +/* Functions definitions */ +/***********************************/ + -+ extern ASN1_API int -+ asn1_parser2tree (const char *file, ++extern ASN1_API int ++ asn1_parser2tree (const char *file, + asn1_node * definitions, char *error_desc); + -+ extern ASN1_API int -+ asn1_parser2array (const char *inputFileName, ++extern ASN1_API int ++ asn1_parser2array (const char *inputFileName, + const char *outputFileName, + const char *vectorName, char *error_desc); + -+ extern ASN1_API int -+ asn1_array2tree (const asn1_static_node * array, ++extern ASN1_API int ++ asn1_array2tree (const asn1_static_node * array, + asn1_node * definitions, char *errorDescription); + -+ extern ASN1_API void -+ asn1_print_structure (FILE * out, asn1_node_const structure, ++extern ASN1_API void ++ asn1_print_structure (FILE * out, asn1_node_const structure, + const char *name, int mode); + -+ extern ASN1_API int -+ asn1_create_element (asn1_node_const definitions, ++extern ASN1_API int ++ asn1_create_element (asn1_node_const definitions, + const char *source_name, asn1_node * element); + -+ extern ASN1_API int asn1_delete_structure (asn1_node * structure); ++extern ASN1_API int asn1_delete_structure (asn1_node * structure); + -+ extern ASN1_API int asn1_delete_structure2 (asn1_node * structure, -+ unsigned int flags); ++extern ASN1_API int asn1_delete_structure2 (asn1_node * structure, unsigned int flags); + -+ extern ASN1_API int -+ asn1_delete_element (asn1_node structure, const char *element_name); ++extern ASN1_API int ++ asn1_delete_element (asn1_node structure, const char *element_name); + -+ extern ASN1_API int -+ asn1_write_value (asn1_node node_root, const char *name, ++extern ASN1_API int ++ asn1_write_value (asn1_node node_root, const char *name, + const void *ivalue, int len); + -+ extern ASN1_API int -+ asn1_read_value (asn1_node_const root, const char *name, ++extern ASN1_API int ++ asn1_read_value (asn1_node_const root, const char *name, + void *ivalue, int *len); + -+ extern ASN1_API int -+ asn1_read_value_type (asn1_node_const root, const char *name, ++extern ASN1_API int ++ asn1_read_value_type (asn1_node_const root, const char *name, + void *ivalue, int *len, unsigned int *etype); + -+ extern ASN1_API int -+ asn1_read_node_value (asn1_node_const node, asn1_data_node_st * data); ++extern ASN1_API int ++ asn1_read_node_value (asn1_node_const node, asn1_data_node_st * data); + -+ extern ASN1_API int -+ asn1_number_of_elements (asn1_node_const element, const char *name, -+ int *num); ++extern ASN1_API int ++ asn1_number_of_elements (asn1_node_const element, const char *name, int *num); + -+ extern ASN1_API int -+ asn1_der_coding (asn1_node_const element, const char *name, ++extern ASN1_API int ++ asn1_der_coding (asn1_node_const element, const char *name, + void *ider, int *len, char *ErrorDescription); + -+ extern ASN1_API int -+ asn1_der_decoding2 (asn1_node * element, const void *ider, ++extern ASN1_API int ++ asn1_der_decoding2 (asn1_node *element, const void *ider, + int *max_ider_len, unsigned int flags, + char *errorDescription); + -+ extern ASN1_API int -+ asn1_der_decoding (asn1_node * element, const void *ider, ++extern ASN1_API int ++ asn1_der_decoding (asn1_node * element, const void *ider, + int ider_len, char *errorDescription); + +/* Do not use. Use asn1_der_decoding() instead. */ -+ extern ASN1_API int -+ asn1_der_decoding_element (asn1_node * structure, ++extern ASN1_API int ++ asn1_der_decoding_element (asn1_node * structure, + const char *elementName, + const void *ider, int len, -+ char *errorDescription) -+ _ASN1_GCC_ATTR_DEPRECATED; ++ char *errorDescription) _ASN1_GCC_ATTR_DEPRECATED; + -+ extern ASN1_API int -+ asn1_der_decoding_startEnd (asn1_node element, ++extern ASN1_API int ++ asn1_der_decoding_startEnd (asn1_node element, + const void *ider, int ider_len, + const char *name_element, + int *start, int *end); + -+ extern ASN1_API int -+ asn1_expand_any_defined_by (asn1_node_const definitions, -+ asn1_node * element); ++extern ASN1_API int ++ asn1_expand_any_defined_by (asn1_node_const definitions, asn1_node * element); + -+ extern ASN1_API int -+ asn1_expand_octet_string (asn1_node_const definitions, ++extern ASN1_API int ++ asn1_expand_octet_string (asn1_node_const definitions, + asn1_node * element, + const char *octetName, const char *objectName); + -+ extern ASN1_API int -+ asn1_read_tag (asn1_node_const root, const char *name, ++extern ASN1_API int ++ asn1_read_tag (asn1_node_const root, const char *name, + int *tagValue, int *classValue); + -+ extern ASN1_API const char *asn1_find_structure_from_oid (asn1_node_const ++extern ASN1_API const char *asn1_find_structure_from_oid (asn1_node_const + definitions, + const char + *oidValue); + -+ __LIBTASN1_PURE__ -+ extern ASN1_API const char *asn1_check_version (const char *req_version); ++__LIBTASN1_PURE__ ++extern ASN1_API const char *asn1_check_version (const char *req_version); + -+ __LIBTASN1_PURE__ extern ASN1_API const char *asn1_strerror (int error); ++__LIBTASN1_PURE__ ++extern ASN1_API const char *asn1_strerror (int error); + -+ extern ASN1_API void asn1_perror (int error); ++extern ASN1_API void asn1_perror (int error); + -+# define ASN1_MAX_TAG_SIZE 4 -+# define ASN1_MAX_LENGTH_SIZE 9 -+# define ASN1_MAX_TL_SIZE (ASN1_MAX_TAG_SIZE+ASN1_MAX_LENGTH_SIZE) -+ extern ASN1_API long -+ asn1_get_length_der (const unsigned char *der, int der_len, int *len); ++#define ASN1_MAX_TAG_SIZE 4 ++#define ASN1_MAX_LENGTH_SIZE 9 ++#define ASN1_MAX_TL_SIZE (ASN1_MAX_TAG_SIZE+ASN1_MAX_LENGTH_SIZE) ++extern ASN1_API long ++ asn1_get_length_der (const unsigned char *der, int der_len, int *len); + -+ extern ASN1_API long -+ asn1_get_length_ber (const unsigned char *ber, int ber_len, int *len); ++extern ASN1_API long ++ asn1_get_length_ber (const unsigned char *ber, int ber_len, int *len); + -+ extern ASN1_API void -+ asn1_length_der (unsigned long int len, unsigned char *der, int *der_len); ++extern ASN1_API void ++ asn1_length_der (unsigned long int len, unsigned char *der, int *der_len); + +/* Other utility functions. */ + -+ extern ASN1_API -+ int asn1_decode_simple_der (unsigned int etype, const unsigned char *der, ++extern ASN1_API ++ int asn1_decode_simple_der (unsigned int etype, const unsigned char *der, + unsigned int _der_len, + const unsigned char **str, + unsigned int *str_len); + -+ extern ASN1_API -+ int asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, ++extern ASN1_API ++ int asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, + unsigned int _der_len, + unsigned char **str, -+ unsigned int *str_len, unsigned int *ber_len); ++ unsigned int *str_len, ++ unsigned int *ber_len); + -+ extern ASN1_API int -+ asn1_encode_simple_der (unsigned int etype, const unsigned char *str, ++extern ASN1_API int ++ asn1_encode_simple_der (unsigned int etype, const unsigned char *str, + unsigned int str_len, unsigned char *tl, + unsigned int *tl_len); + -+ extern ASN1_API asn1_node -+ asn1_find_node (asn1_node_const pointer, const char *name); ++extern ASN1_API asn1_node ++ asn1_find_node (asn1_node_const pointer, const char *name); + -+ extern ASN1_API int -+ asn1_copy_node (asn1_node dst, const char *dst_name, ++extern ASN1_API int ++ asn1_copy_node (asn1_node dst, const char *dst_name, + asn1_node_const src, const char *src_name); -+ extern ASN1_API asn1_node -+ asn1_dup_node (asn1_node_const src, const char *src_name); ++extern ASN1_API asn1_node ++ asn1_dup_node (asn1_node_const src, const char *src_name); + +/* Internal and low-level DER utility functions. */ + -+ extern ASN1_API int -+ asn1_get_tag_der (const unsigned char *der, int der_len, ++extern ASN1_API int ++ asn1_get_tag_der (const unsigned char *der, int der_len, + unsigned char *cls, int *len, unsigned long *tag); + -+ extern ASN1_API void -+ asn1_octet_der (const unsigned char *str, int str_len, ++extern ASN1_API void ++ asn1_octet_der (const unsigned char *str, int str_len, + unsigned char *der, int *der_len); + -+ extern ASN1_API int -+ asn1_get_octet_der (const unsigned char *der, int der_len, ++extern ASN1_API int ++ asn1_get_octet_der (const unsigned char *der, int der_len, + int *ret_len, unsigned char *str, + int str_size, int *str_len); + -+ extern ASN1_API void asn1_bit_der (const unsigned char *str, int bit_len, ++extern ASN1_API void asn1_bit_der (const unsigned char *str, int bit_len, + unsigned char *der, int *der_len); + -+ extern ASN1_API int -+ asn1_get_bit_der (const unsigned char *der, int der_len, ++extern ASN1_API int ++ asn1_get_bit_der (const unsigned char *der, int der_len, + int *ret_len, unsigned char *str, + int str_size, int *bit_len); + -+ extern ASN1_API int -+ asn1_get_object_id_der (const unsigned char *der, -+ int der_len, int *ret_len, -+ char *str, int str_size); ++extern ASN1_API int ++ asn1_get_object_id_der (const unsigned char *der, ++ int der_len, int *ret_len, ++ char *str, int str_size); + -+ extern ASN1_API int -+ asn1_object_id_der (const char *str, unsigned char *der, int *der_len, -+ unsigned flags); ++extern ASN1_API int ++ asn1_object_id_der (const char *str, unsigned char *der, int *der_len, ++ unsigned flags); + +/* Compatibility types */ + @@ -8897,7 +8725,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use int instead. + */ -+ typedef int asn1_retCode _ASN1_GCC_ATTR_DEPRECATED; ++typedef int asn1_retCode; + +/** + * node_asn_struct: @@ -8906,13 +8734,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define node_asn_struct _Pragma ("GCC warning \"'node_asn_struct' macro is deprecated, use 'asn1_node' instead.\"") asn1_node_st -+# else -+# define node_asn_struct asn1_node_st -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define node_asn_struct asn1_node_st + +/** + * node_asn: @@ -8921,13 +8743,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define node_asn _Pragma ("GCC warning \"'node_asn' macro is deprecated, use 'asn1_node' instead.\"") asn1_node_st -+# else -+# define node_asn asn1_node_st -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define node_asn asn1_node_st + +/** + * ASN1_TYPE: @@ -8936,13 +8752,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define ASN1_TYPE _Pragma ("GCC warning \"'ASN1_TYPE' macro is deprecated, use 'asn1_node' instead.\"") asn1_node -+# else -+# define ASN1_TYPE asn1_node -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define ASN1_TYPE asn1_node + +/** + * ASN1_TYPE_EMPTY: @@ -8951,13 +8761,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use NULL instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define ASN1_TYPE_EMPTY _Pragma ("GCC warning \"'ASN1_TYPE_EMPTY' macro is deprecated, use 'NULL' instead.\"") NULL -+# else -+# define ASN1_TYPE_EMPTY NULL -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define ASN1_TYPE_EMPTY NULL + +/** + * static_struct_asn: @@ -8966,13 +8770,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_static_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define static_struct_asn _Pragma ("GCC warning \"'static_struct_asn' macro is deprecated, use 'asn1_static_node_st' instead.\"") asn1_static_node_st -+# else -+# define static_struct_asn asn1_static_node_st -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define static_struct_asn asn1_static_node_st + +/** + * ASN1_ARRAY_TYPE: @@ -8981,13 +8779,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_static_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define ASN1_ARRAY_TYPE _Pragma ("GCC warning \"'ASN1_ARRAY_TYPE' macro is deprecated, use 'asn1_static_node' instead.\"") asn1_static_node -+# else -+# define ASN1_ARRAY_TYPE asn1_static_node -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define ASN1_ARRAY_TYPE asn1_static_node + +/** + * asn1_static_node_t: @@ -8996,13 +8788,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_static_node instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define asn1_static_node_t _Pragma ("GCC warning \"'asn1_static_node_t' macro is deprecated, use 'asn1_static_node' instead.\"") asn1_static_node -+# else -+# define asn1_static_node_t asn1_static_node -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define asn1_static_node_t asn1_static_node + +/** + * node_data_struct: @@ -9011,13 +8797,7 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_data_node_st instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define node_data_struct _Pragma ("GCC warning \"'node_data_struct' macro is deprecated, use 'asn1_data_node_st' instead.\"") asn1_data_node_st -+# else -+# define node_data_struct asn1_data_node_st -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ ++#define node_data_struct asn1_data_node_st + +/** + * ASN1_DATA_NODE: @@ -9026,19 +8806,129 @@ index 000000000..fc695a28a + * + * Deprecated: 3.0: Use #asn1_data_node_st instead. + */ -+# ifndef ASN1_DISABLE_DEPRECATED -+# if _ASN1_GCC_VERSION >= 30100 -+# define ASN1_DATA_NODE _Pragma ("GCC warning \"'asn1_static_node_t' macro is deprecated, use 'asn1_static_node' instead.\"") asn1_data_node_st -+# else -+# define ASN1_DATA_NODE asn1_data_node_st -+# endif -+# endif /* !ASN1_DISABLE_DEPRECATED */ -+ -+# ifdef __cplusplus ++#define ASN1_DATA_NODE asn1_data_node_st ++ ++#ifdef __cplusplus +} -+# endif ++#endif + +#endif /* LIBTASN1_H */ --- -2.41.0 - +diff --git a/grub-core/lib/libtasn1/LICENSE b/grub-core/lib/libtasn1/LICENSE +new file mode 100644 +index 00000000000..e8b3628db9b +--- /dev/null ++++ b/grub-core/lib/libtasn1/LICENSE +@@ -0,0 +1,16 @@ ++LICENSING ++========= ++ ++The libtasn1 library is released under the GNU Lesser General Public ++License (LGPL) version 2.1 or later; see [COPYING.LESSER](doc/COPYING.LESSER) ++for the license terms. ++ ++The GNU LGPL applies to the main libtasn1 library, while the ++included applications library are under the GNU GPL version 3. ++The libtasn1 library is located in the lib directory, while the applications ++in src/. ++ ++The documentation in doc/ is under the GNU FDL license 1.3. ++ ++For any copyright year range specified as YYYY-ZZZZ in this package ++note that the range specifies every single year in that closed interval. +diff --git a/grub-core/lib/libtasn1/README.md b/grub-core/lib/libtasn1/README.md +new file mode 100644 +index 00000000000..50a8642296c +--- /dev/null ++++ b/grub-core/lib/libtasn1/README.md +@@ -0,0 +1,91 @@ ++|Branch|CI system|Status| ++|:----:|:-------:|-----:| ++|Master|Gitlab|[![build status](https://gitlab.com/gnutls/libtasn1/badges/master/pipeline.svg)](https://gitlab.com/gnutls/libtasn1/commits/master)[![coverage report](https://gitlab.com/gnutls/libtasn1/badges/master/coverage.svg)](https://gnutls.gitlab.io/libtasn1/coverage)| ++ ++# libtasn1 ++ ++This is GNU Libtasn1, a small ASN.1 library. ++ ++The C library (libtasn1.*) is licensed under the GNU Lesser General ++Public License version 2.1 or later. See the file COPYING.LIB. ++ ++The command line tool, self tests, examples, and other auxilliary ++files, are licensed under the GNU General Public License version 3.0 ++or later. See the file COPYING. ++ ++## Building the library ++ ++We require several tools to build the software, including: ++ ++* [Make](https://www.gnu.org/software/make/) ++* [Automake](https://www.gnu.org/software/automake/) (use 1.11.3 or later) ++* [Autoconf](https://www.gnu.org/software/autoconf/) ++* [Libtool](https://www.gnu.org/software/libtool/) ++* [Texinfo](https://www.gnu.org/software/texinfo/) ++* [help2man](http://www.gnu.org/software/help2man/) ++* [Tar](https://www.gnu.org/software/tar/) ++* [Gzip](https://www.gnu.org/software/gzip/) ++* [bison](https://www.gnu.org/software/bison/) ++* [Texlive & epsf](https://www.tug.org/texlive/) (for PDF manual) ++* [GTK-DOC](https://www.gtk.org/gtk-doc/) (for API manual) ++* [Git](https://git-scm.com/) ++* [libabigail](https://pagure.io/libabigail/) (for abi comparison in make dist) ++* [Valgrind](https://valgrind.org/) (optional) ++ ++The required software is typically distributed with your operating ++system, and the instructions for installing them differ. Here are ++some hints: ++ ++gNewSense/Debian/Ubuntu: ++``` ++sudo apt-get install make git-core autoconf automake libtool ++sudo apt-get install texinfo texlive texlive-generic-recommended texlive-extra-utils ++sudo apt-get install help2man gtk-doc-tools valgrind abigail-tools ++``` ++ ++The next step is to run autoreconf, ./configure, etc: ++ ++``` ++$ ./bootstrap ++``` ++ ++Then build the project normally: ++ ++``` ++$ make ++$ make check ++``` ++ ++Happy hacking! ++ ++ ++## Manual ++ ++The manual is in the `doc/` directory of the release. You can also browse ++the manual online at: ++ ++ - https://gnutls.gitlab.io/libtasn1/ ++ ++ ++## Code coverage report ++ ++The coverage report is at: ++ ++ - https://gnutls.gitlab.io/libtasn1/coverage ++ ++ ++## Issue trackers ++ ++ - [Main issue tracker](https://gitlab.com/gnutls/libtasn1/issues) ++ - [oss-fuzz found issues](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=libtasn1&can=2) ++ ++ ++## Homepage ++ ++The project homepage at the gnu site is at: ++ ++http://www.gnu.org/software/libtasn1/ ++ ++ ++For any copyright year range specified as YYYY-ZZZZ in this package ++note that the range specifies every single year in that closed interval. diff --git a/0139-safe-tpm-pcr-snapshot.patch b/0139-safe-tpm-pcr-snapshot.patch deleted file mode 100644 index 901c63c..0000000 --- a/0139-safe-tpm-pcr-snapshot.patch +++ /dev/null @@ -1,112 +0,0 @@ -From ccc42c647d07fe61a9055776d7f373e965f63b7f Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 10:47:21 +0800 -Subject: [PATCH 139/272] safe tpm pcr snapshot - -Signed-off-by: SUSE ---- - grub-core/commands/tpm.c | 32 ++++++++++++++++++++++++++------ - util/grub-install.c | 6 ++++-- - 2 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c -index 9b89f5fe3..bb9aee210 100644 ---- a/grub-core/commands/tpm.c -+++ b/grub-core/commands/tpm.c -@@ -27,8 +27,10 @@ - #include - #include - #include -+#ifdef GRUB_MACHINE_EFI - #include - #include -+#endif - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -97,12 +99,6 @@ struct grub_file_verifier grub_tpm_verifier = { - .verify_string = grub_tpm_verify_string, - }; - --/* -- * Preserve current PCR values and record them to an EFI variable -- */ --#define GRUB2_PCR_BITMASK_DEFAULT ((1 << 16) - 1) --#define GRUB2_PCR_BITMASK_ALL ((1 << 24) - 1) -- - static const struct grub_arg_option grub_tpm_record_pcrs_options[] = - { - { -@@ -118,6 +114,14 @@ static const struct grub_arg_option grub_tpm_record_pcrs_options[] = - {0, 0, 0, 0, 0, 0} - }; - -+#ifdef GRUB_MACHINE_EFI -+ -+/* -+ * Preserve current PCR values and record them to an EFI variable -+ */ -+#define GRUB2_PCR_BITMASK_DEFAULT ((1 << 16) - 1) -+#define GRUB2_PCR_BITMASK_ALL ((1 << 24) - 1) -+ - static grub_err_t - grub_tpm_parse_pcr_index (const char *word, const char **end_ret, unsigned int *index) - { -@@ -269,6 +273,10 @@ grub_tpm_record_pcrs (grub_extcmd_context_t ctxt, int argc, char **args) - grub_size_t size = 0; - int n, rv = 1; - -+ /* To prevent error: unable to read PCR from TPM, if no TPM device available */ -+ if (!grub_tpm_present()) -+ return GRUB_ERR_NONE; -+ - if (argc == 0) - pcr_bitmask = GRUB2_PCR_BITMASK_DEFAULT; - else -@@ -297,6 +305,18 @@ out: - return rv; - } - -+#else -+ -+static grub_err_t -+grub_tpm_record_pcrs (grub_extcmd_context_t ctxt __attribute__((unused)), -+ int argc __attribute__((unused)), -+ char **args __attribute__((unused))) -+{ -+ return GRUB_ERR_NONE; -+} -+ -+#endif -+ - static grub_extcmd_t cmd; - - GRUB_MOD_INIT (tpm) -diff --git a/util/grub-install.c b/util/grub-install.c -index 0cdfa9f4e..4f0af4844 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -1533,8 +1533,9 @@ main (int argc, char *argv[]) - - grub_util_unlink (load_cfg); - -- if (1) -+ if (platform == GRUB_INSTALL_PLATFORM_X86_64_EFI && have_cryptodisk) - { -+ grub_install_push_module ("tpm"); - load_cfg_f = grub_util_fopen (load_cfg, "wb"); - have_load_cfg = 1; - fprintf (load_cfg_f, "tpm_record_pcrs 0-9\n"); -@@ -1542,7 +1543,8 @@ main (int argc, char *argv[]) - - if (debug_image && debug_image[0]) - { -- load_cfg_f = grub_util_fopen (load_cfg, "wb"); -+ if (!load_cfg_f) -+ load_cfg_f = grub_util_fopen (load_cfg, "wb"); - have_load_cfg = 1; - fprintf (load_cfg_f, "set debug='%s'\n", - debug_image); --- -2.41.0 - diff --git a/0140-ieee1275-add-support-for-NVMeoFC.patch b/0140-ieee1275-add-support-for-NVMeoFC.patch deleted file mode 100644 index 1b7408d..0000000 --- a/0140-ieee1275-add-support-for-NVMeoFC.patch +++ /dev/null @@ -1,250 +0,0 @@ -From 10c1d851d40d891557e9d243546f647874888016 Mon Sep 17 00:00:00 2001 -From: Diego Domingos -Date: Tue, 15 Feb 2022 13:11:48 -0500 -Subject: [PATCH 140/272] ieee1275: add support for NVMeoFC - -Implements the functions to scan and discovery of NVMeoFC. ---- - grub-core/disk/ieee1275/ofdisk.c | 217 ++++++++++++++++++++++++++++++- - 1 file changed, 213 insertions(+), 4 deletions(-) - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index 41869772a..7197d5401 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -206,12 +206,10 @@ dev_iterate_real (const char *name, const char *path) - return; - } - -+ - static void --dev_iterate (const struct grub_ieee1275_devalias *alias) -+dev_iterate_fcp_disks(const struct grub_ieee1275_devalias *alias) - { -- if (grub_strcmp (alias->type, "fcp") == 0) -- { -- - /* If we are dealing with fcp devices, we need - * to find the WWPNs and LUNs to iterate them */ - grub_ieee1275_ihandle_t ihandle; -@@ -323,6 +321,217 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - grub_free (buf); - return; - -+} -+ -+static void -+dev_iterate_fcp_nvmeof (const struct grub_ieee1275_devalias *alias) -+{ -+ -+ -+ char *bufptr; -+ grub_ieee1275_ihandle_t ihandle; -+ -+ -+ // Create the structs for the parameters passing to PFW -+ struct nvme_args_ -+ { -+ struct grub_ieee1275_common_hdr common; -+ grub_ieee1275_cell_t method; -+ grub_ieee1275_cell_t ihandle; -+ grub_ieee1275_cell_t catch_result; -+ grub_ieee1275_cell_t nentries; -+ grub_ieee1275_cell_t table; -+ } nvme_discovery_controllers_args, nvme_controllers_args, nvme_namespaces_args; -+ -+ -+ // Create the structs for the results from PFW -+ -+ struct discovery_controllers_table_struct_ -+ { -+ grub_uint64_t table[256]; -+ grub_uint32_t len; -+ } discovery_controllers_table; -+ -+ /* struct nvme_controllers_table_entry -+ * this the return of nvme-controllers method tables, containing: -+ * - 2-byte controller ID -+ * - 256-byte transport address string -+ * - 256-byte field containing null-terminated NVM subsystem NQN string up to 223 characters -+ */ -+ struct nvme_controllers_table_entry_ -+ { -+ grub_uint16_t id; -+ char wwpn[256]; -+ char nqn[256]; -+ }; -+ -+ struct nvme_controllers_table_entry_* nvme_controllers_table = grub_malloc(sizeof(struct nvme_controllers_table_entry_)*256); -+ -+ grub_uint32_t nvme_controllers_table_entries; -+ -+ struct nvme_controllers_table_entry_real -+ { -+ grub_uint16_t id; -+ char wwpn[256]; -+ char nqn[256]; -+ }; -+ -+ /* Allocate memory for building the NVMeoF path */ -+ char *buf = grub_malloc (grub_strlen (alias->path) + 512); -+ if (!buf) -+ { -+ grub_ieee1275_close(ihandle); -+ return; -+ } -+ -+ /* Copy the alias->path to buf so we can work with */ -+ bufptr = grub_stpcpy (buf, alias->path); -+ grub_snprintf (bufptr, 32, "/nvme-of"); -+ -+ /* -+ * Open the nvme-of layer -+ * Ex. /pci@bus/fibre-channel@@dev,func/nvme-of -+ */ -+ if(grub_ieee1275_open (buf, &ihandle)) -+ { -+ grub_dprintf("disk", "failed to open the disk while iterating FCP disk path=%s\n", buf); -+ return; -+ } -+ -+ /* -+ * Call to nvme-discovery-controllers method from the nvme-of layer -+ * to get a list of the NVMe discovery controllers per the binding -+ */ -+ -+ INIT_IEEE1275_COMMON (&nvme_discovery_controllers_args.common, "call-method", 2, 2); -+ nvme_discovery_controllers_args.method = (grub_ieee1275_cell_t) "nvme-discovery-controllers"; -+ nvme_discovery_controllers_args.ihandle = ihandle; -+ -+ if (IEEE1275_CALL_ENTRY_FN (&nvme_discovery_controllers_args) == -1) -+ { -+ grub_dprintf("disk", "failed to get the targets while iterating FCP disk path=%s\n", buf); -+ grub_ieee1275_close(ihandle); -+ return; -+ } -+ -+ /* After closing the device, the info is lost. So lets copy each buffer in the buffers table */ -+ -+ discovery_controllers_table.len = (grub_uint32_t) nvme_discovery_controllers_args.nentries; -+ -+ unsigned int i=0; -+ for(i = 0; i < discovery_controllers_table.len; i++){ -+ discovery_controllers_table.table[i] = ((grub_uint64_t*)nvme_discovery_controllers_args.table)[i]; -+ } -+ -+ grub_ieee1275_close(ihandle); -+ -+ grub_dprintf("ofdisk","NVMeoF: Found %d discovery controllers\n",discovery_controllers_table.len); -+ -+ /* For each nvme discovery controller */ -+ int current_buffer_index; -+ for(current_buffer_index = 0; current_buffer_index < (int) discovery_controllers_table.len; current_buffer_index++){ -+ -+ -+ grub_snprintf (bufptr, 64, "/nvme-of/controller@%" PRIxGRUB_UINT64_T ",ffff", -+ discovery_controllers_table.table[current_buffer_index]); -+ -+ grub_dprintf("ofdisk","nvmeof controller=%s\n",buf); -+ -+ if(grub_ieee1275_open (buf, &ihandle)) -+ { -+ grub_dprintf("ofdisk", "failed to open the disk while getting nvme-controllers path=%s\n", buf); -+ continue; -+ } -+ -+ -+ INIT_IEEE1275_COMMON (&nvme_controllers_args.common, "call-method", 2, 2); -+ nvme_controllers_args.method = (grub_ieee1275_cell_t) "nvme-controllers"; -+ nvme_controllers_args.ihandle = ihandle; -+ nvme_controllers_args.catch_result = 0; -+ -+ -+ if (IEEE1275_CALL_ENTRY_FN (&nvme_controllers_args) == -1) -+ { -+ grub_dprintf("ofdisk", "failed to get the nvme-controllers while iterating FCP disk path\n"); -+ grub_ieee1275_close(ihandle); -+ continue; -+ } -+ -+ -+ /* Copy the buffer list to nvme_controllers_table */ -+ nvme_controllers_table_entries = ((grub_uint32_t) nvme_controllers_args.nentries); -+ struct nvme_controllers_table_entry_* nvme_controllers_table_ = (struct nvme_controllers_table_entry_*) nvme_controllers_args.table; -+ -+ for(i = 0; i < nvme_controllers_table_entries; i++){ -+ nvme_controllers_table[i].id = (grub_uint16_t) nvme_controllers_table_[i].id; -+ grub_strcpy(nvme_controllers_table[i].wwpn, nvme_controllers_table_[i].wwpn); -+ grub_strcpy(nvme_controllers_table[i].nqn, nvme_controllers_table_[i].nqn); -+ } -+ -+ grub_ieee1275_close(ihandle); -+ -+ int nvme_controller_index; -+ int bufptr_pos2; -+ grub_dprintf("ofdisk","NVMeoF: found %d nvme controllers\n",(int) nvme_controllers_args.nentries); -+ -+ /* For each nvme controller */ -+ for(nvme_controller_index = 0; nvme_controller_index < (int) nvme_controllers_args.nentries; nvme_controller_index++){ -+ /* Open the nvme controller -+ * /pci@bus/fibre-channel@dev,func/nvme-of/controller@transport-addr,ctlr-id:nqn=tgt-subsystem-nqn -+ */ -+ -+ bufptr_pos2 = grub_snprintf (bufptr, 512, "/nvme-of/controller@%s,ffff:nqn=%s", -+ nvme_controllers_table[nvme_controller_index].wwpn, nvme_controllers_table[nvme_controller_index].nqn); -+ -+ grub_dprintf("ofdisk","NVMeoF: nvmeof controller=%s\n",buf); -+ -+ if(grub_ieee1275_open (buf, &ihandle)){ -+ grub_dprintf("ofdisk","failed to open the path=%s\n",buf); -+ continue; -+ } -+ -+ INIT_IEEE1275_COMMON (&nvme_namespaces_args.common, "call-method", 2, 2); -+ nvme_namespaces_args.method = (grub_ieee1275_cell_t) "get-namespace-list"; -+ nvme_namespaces_args.ihandle = ihandle; -+ nvme_namespaces_args.catch_result = 0; -+ -+ if (IEEE1275_CALL_ENTRY_FN (&nvme_namespaces_args) == -1) -+ { -+ grub_dprintf("ofdisk", "failed to get the nvme-namespace-list while iterating FCP disk path\n"); -+ grub_ieee1275_close(ihandle); -+ continue; -+ } -+ -+ grub_uint32_t *namespaces = (grub_uint32_t*) nvme_namespaces_args.table; -+ grub_dprintf("ofdisk","NVMeoF: found %d namespaces\n",(int)nvme_namespaces_args.nentries); -+ -+ grub_ieee1275_close(ihandle); -+ -+ grub_uint32_t namespace_index = 0; -+ for(namespace_index=0; namespace_index < nvme_namespaces_args.nentries; namespace_index++){ -+ grub_snprintf (bufptr+bufptr_pos2, 512, "/namespace@%"PRIxGRUB_UINT32_T,namespaces[namespace_index]); -+ grub_dprintf("ofdisk","NVMeoF: namespace=%s\n",buf); -+ dev_iterate_real(buf,buf); -+ } -+ -+ dev_iterate_real(buf,buf); -+ } -+ } -+ grub_free(buf); -+ return; -+} -+ -+static void -+dev_iterate (const struct grub_ieee1275_devalias *alias) -+{ -+ if (grub_strcmp (alias->type, "fcp") == 0) -+ { -+ // Iterate disks -+ dev_iterate_fcp_disks(alias); -+ -+ // Iterate NVMeoF -+ dev_iterate_fcp_nvmeof(alias); -+ - } - else if (grub_strcmp (alias->type, "vscsi") == 0) - { --- -2.41.0 - diff --git a/0105-libtasn1-disable-code-not-needed-in-grub.patch b/0140-libtasn1-disable-code-not-needed-in-grub.patch similarity index 63% rename from 0105-libtasn1-disable-code-not-needed-in-grub.patch rename to 0140-libtasn1-disable-code-not-needed-in-grub.patch index 21b49f0..00f5588 100644 --- a/0105-libtasn1-disable-code-not-needed-in-grub.patch +++ b/0140-libtasn1-disable-code-not-needed-in-grub.patch @@ -1,7 +1,7 @@ -From 4c2c38a452ba7c4ce85fc8d93d413ff2ab085d7d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 1 May 2020 17:12:23 +1000 -Subject: [PATCH 105/272] libtasn1: disable code not needed in grub +Subject: [PATCH] libtasn1: disable code not needed in grub We don't expect to be able to write ASN.1, only read it, so we can disable some code. @@ -25,7 +25,7 @@ Signed-off-by: Daniel Axtens 6 files changed, 38 insertions(+), 8 deletions(-) diff --git a/grub-core/lib/libtasn1/lib/coding.c b/grub-core/lib/libtasn1/lib/coding.c -index 671104f63..b3d826710 100644 +index 245ea64cf0a..52def598368 100644 --- a/grub-core/lib/libtasn1/lib/coding.c +++ b/grub-core/lib/libtasn1/lib/coding.c @@ -30,11 +30,11 @@ @@ -57,7 +57,7 @@ index 671104f63..b3d826710 100644 /******************************************************/ /* Function : _asn1_time_der */ /* Description: creates the DER coding for a TIME */ -@@ -278,7 +280,7 @@ _asn1_time_der (unsigned char *str, int str_len, unsigned char *der, +@@ -281,7 +283,7 @@ _asn1_time_der (unsigned char *str, int str_len, unsigned char *der, return ASN1_SUCCESS; } @@ -66,7 +66,7 @@ index 671104f63..b3d826710 100644 /* void -@@ -519,6 +521,7 @@ asn1_bit_der (const unsigned char *str, int bit_len, +@@ -520,6 +522,7 @@ asn1_bit_der (const unsigned char *str, int bit_len, } @@ -74,7 +74,7 @@ index 671104f63..b3d826710 100644 /******************************************************/ /* Function : _asn1_complete_explicit_tag */ /* Description: add the length coding to the EXPLICIT */ -@@ -595,6 +598,7 @@ _asn1_complete_explicit_tag (asn1_node node, unsigned char *der, +@@ -596,6 +599,7 @@ _asn1_complete_explicit_tag (asn1_node node, unsigned char *der, return ASN1_SUCCESS; } @@ -82,7 +82,7 @@ index 671104f63..b3d826710 100644 const tag_and_class_st _asn1_tags[] = { [ASN1_ETYPE_GENERALSTRING] = -@@ -647,6 +651,8 @@ const tag_and_class_st _asn1_tags[] = { +@@ -648,6 +652,8 @@ const tag_and_class_st _asn1_tags[] = { unsigned int _asn1_tags_size = sizeof (_asn1_tags) / sizeof (_asn1_tags[0]); @@ -91,7 +91,7 @@ index 671104f63..b3d826710 100644 /******************************************************/ /* Function : _asn1_insert_tag_der */ /* Description: creates the DER coding of tags of one */ -@@ -1423,3 +1429,5 @@ error: +@@ -1413,3 +1419,5 @@ error: asn1_delete_structure (&node); return err; } @@ -99,10 +99,10 @@ index 671104f63..b3d826710 100644 +#endif \ No newline at end of file diff --git a/grub-core/lib/libtasn1/lib/decoding.c b/grub-core/lib/libtasn1/lib/decoding.c -index b1a35356f..b8130b956 100644 +index ff04eb778cb..42f9a92b5d4 100644 --- a/grub-core/lib/libtasn1/lib/decoding.c +++ b/grub-core/lib/libtasn1/lib/decoding.c -@@ -1620,6 +1620,7 @@ asn1_der_decoding (asn1_node * element, const void *ider, int ider_len, +@@ -1613,6 +1613,7 @@ asn1_der_decoding (asn1_node * element, const void *ider, int ider_len, return asn1_der_decoding2 (element, ider, &ider_len, 0, errorDescription); } @@ -110,16 +110,16 @@ index b1a35356f..b8130b956 100644 /** * asn1_der_decoding_element: * @structure: pointer to an ASN1 structure -@@ -1650,6 +1651,7 @@ asn1_der_decoding_element (asn1_node * structure, const char *elementName, +@@ -1643,6 +1644,7 @@ asn1_der_decoding_element (asn1_node * structure, const char *elementName, { - return asn1_der_decoding (structure, ider, len, errorDescription); + return asn1_der_decoding(structure, ider, len, errorDescription); } +#endif /** * asn1_der_decoding_startEnd: diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c -index 86e64f2cf..8cd6b662c 100644 +index 997eb2725dc..539008d8e94 100644 --- a/grub-core/lib/libtasn1/lib/element.c +++ b/grub-core/lib/libtasn1/lib/element.c @@ -191,7 +191,7 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache) @@ -131,7 +131,7 @@ index 86e64f2cf..8cd6b662c 100644 /** * asn1_write_value: * @node_root: pointer to a structure -@@ -646,7 +646,7 @@ asn1_write_value (asn1_node node_root, const char *name, +@@ -645,7 +645,7 @@ asn1_write_value (asn1_node node_root, const char *name, return ASN1_SUCCESS; } @@ -141,7 +141,7 @@ index 86e64f2cf..8cd6b662c 100644 #define PUT_VALUE( ptr, ptr_size, data, data_size) \ *len = data_size; \ diff --git a/grub-core/lib/libtasn1/lib/errors.c b/grub-core/lib/libtasn1/lib/errors.c -index 4dadbd96d..41921d813 100644 +index cee74daf795..42785e8622b 100644 --- a/grub-core/lib/libtasn1/lib/errors.c +++ b/grub-core/lib/libtasn1/lib/errors.c @@ -57,6 +57,8 @@ static const libtasn1_error_entry error_algorithms[] = { @@ -162,7 +162,7 @@ index 4dadbd96d..41921d813 100644 /** * asn1_strerror: diff --git a/grub-core/lib/libtasn1/lib/structure.c b/grub-core/lib/libtasn1/lib/structure.c -index c0802202e..45435732c 100644 +index 8189c56a4c9..fcfde01a393 100644 --- a/grub-core/lib/libtasn1/lib/structure.c +++ b/grub-core/lib/libtasn1/lib/structure.c @@ -76,7 +76,7 @@ _asn1_find_left (asn1_node_const node) @@ -172,9 +172,9 @@ index c0802202e..45435732c 100644 - +#if 0 int - _asn1_create_static_structure (asn1_node_const pointer, - char *output_file_name, char *vector_name) -@@ -155,7 +155,7 @@ _asn1_create_static_structure (asn1_node_const pointer, + _asn1_create_static_structure (asn1_node_const pointer, char *output_file_name, + char *vector_name) +@@ -155,7 +155,7 @@ _asn1_create_static_structure (asn1_node_const pointer, char *output_file_name, return ASN1_SUCCESS; } @@ -183,7 +183,7 @@ index c0802202e..45435732c 100644 /** * asn1_array2tree: -@@ -721,7 +721,7 @@ asn1_create_element (asn1_node_const definitions, const char *source_name, +@@ -718,7 +718,7 @@ asn1_create_element (asn1_node_const definitions, const char *source_name, return res; } @@ -192,7 +192,7 @@ index c0802202e..45435732c 100644 /** * asn1_print_structure: * @out: pointer to the output file (e.g. stdout). -@@ -1062,7 +1062,7 @@ asn1_print_structure (FILE * out, asn1_node_const structure, const char *name, +@@ -1058,7 +1058,7 @@ asn1_print_structure (FILE * out, asn1_node_const structure, const char *name, } } } @@ -201,7 +201,7 @@ index c0802202e..45435732c 100644 /** -@@ -1158,6 +1158,7 @@ asn1_find_structure_from_oid (asn1_node_const definitions, +@@ -1153,6 +1153,7 @@ asn1_find_structure_from_oid (asn1_node_const definitions, const char *oidValue) return NULL; /* ASN1_ELEMENT_NOT_FOUND; */ } @@ -209,7 +209,7 @@ index c0802202e..45435732c 100644 /** * asn1_copy_node: * @dst: Destination asn1 node. -@@ -1207,6 +1208,7 @@ asn1_copy_node (asn1_node dst, const char *dst_name, +@@ -1202,6 +1203,7 @@ asn1_copy_node (asn1_node dst, const char *dst_name, return result; } @@ -218,93 +218,90 @@ index c0802202e..45435732c 100644 /** * asn1_dup_node: diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h -index fc695a28a..0c3a44881 100644 +index 6fd7a30dc35..785eda2ae3f 100644 --- a/include/grub/libtasn1.h +++ b/include/grub/libtasn1.h -@@ -314,6 +314,8 @@ extern "C" +@@ -319,6 +319,8 @@ typedef struct asn1_data_node_st asn1_data_node_st; /* Functions definitions */ /***********************************/ +/* These functions are not used in grub and should not be referenced. */ -+# if 0 - extern ASN1_API int - asn1_parser2tree (const char *file, ++#if 0 + extern ASN1_API int + asn1_parser2tree (const char *file, asn1_node * definitions, char *error_desc); -@@ -322,14 +324,17 @@ extern "C" - asn1_parser2array (const char *inputFileName, +@@ -327,14 +329,17 @@ extern ASN1_API int + asn1_parser2array (const char *inputFileName, const char *outputFileName, const char *vectorName, char *error_desc); -+# endif ++#endif - extern ASN1_API int - asn1_array2tree (const asn1_static_node * array, + extern ASN1_API int + asn1_array2tree (const asn1_static_node * array, asn1_node * definitions, char *errorDescription); -+# if 0 - extern ASN1_API void - asn1_print_structure (FILE * out, asn1_node_const structure, ++#if 0 + extern ASN1_API void + asn1_print_structure (FILE * out, asn1_node_const structure, const char *name, int mode); -+# endif ++#endif - extern ASN1_API int - asn1_create_element (asn1_node_const definitions, -@@ -343,9 +348,11 @@ extern "C" - extern ASN1_API int - asn1_delete_element (asn1_node structure, const char *element_name); + extern ASN1_API int + asn1_create_element (asn1_node_const definitions, +@@ -347,9 +352,11 @@ extern ASN1_API int asn1_delete_structure2 (asn1_node * structure, unsigned int + extern ASN1_API int + asn1_delete_element (asn1_node structure, const char *element_name); -+# if 0 - extern ASN1_API int - asn1_write_value (asn1_node node_root, const char *name, ++#if 0 + extern ASN1_API int + asn1_write_value (asn1_node node_root, const char *name, const void *ivalue, int len); -+# endif ++#endif - extern ASN1_API int - asn1_read_value (asn1_node_const root, const char *name, -@@ -362,9 +369,11 @@ extern "C" - asn1_number_of_elements (asn1_node_const element, const char *name, - int *num); + extern ASN1_API int + asn1_read_value (asn1_node_const root, const char *name, +@@ -365,9 +372,11 @@ extern ASN1_API int + extern ASN1_API int + asn1_number_of_elements (asn1_node_const element, const char *name, int *num); -+# if 0 - extern ASN1_API int - asn1_der_coding (asn1_node_const element, const char *name, ++#if 0 + extern ASN1_API int + asn1_der_coding (asn1_node_const element, const char *name, void *ider, int *len, char *ErrorDescription); -+# endif ++#endif - extern ASN1_API int - asn1_der_decoding2 (asn1_node * element, const void *ider, -@@ -375,6 +384,7 @@ extern "C" - asn1_der_decoding (asn1_node * element, const void *ider, + extern ASN1_API int + asn1_der_decoding2 (asn1_node *element, const void *ider, +@@ -378,12 +387,14 @@ extern ASN1_API int + asn1_der_decoding (asn1_node * element, const void *ider, int ider_len, char *errorDescription); -+# if 0 ++#if 0 /* Do not use. Use asn1_der_decoding() instead. */ - extern ASN1_API int - asn1_der_decoding_element (asn1_node * structure, -@@ -382,6 +392,7 @@ extern "C" + extern ASN1_API int + asn1_der_decoding_element (asn1_node * structure, + const char *elementName, const void *ider, int len, - char *errorDescription) - _ASN1_GCC_ATTR_DEPRECATED; -+# endif + char *errorDescription) _ASN1_GCC_ATTR_DEPRECATED; ++#endif - extern ASN1_API int - asn1_der_decoding_startEnd (asn1_node element, -@@ -407,12 +418,16 @@ extern "C" + extern ASN1_API int + asn1_der_decoding_startEnd (asn1_node element, +@@ -408,13 +419,17 @@ extern ASN1_API const char *asn1_find_structure_from_oid (asn1_node_const const char *oidValue); -+# if 0 - __LIBTASN1_PURE__ - extern ASN1_API const char *asn1_check_version (const char *req_version); -+# endif ++#if 0 + __LIBTASN1_PURE__ + extern ASN1_API const char *asn1_check_version (const char *req_version); ++#endif - __LIBTASN1_PURE__ extern ASN1_API const char *asn1_strerror (int error); + __LIBTASN1_PURE__ + extern ASN1_API const char *asn1_strerror (int error); -+# if 0 - extern ASN1_API void asn1_perror (int error); -+# endif ++#if 0 + extern ASN1_API void asn1_perror (int error); ++#endif - # define ASN1_MAX_TAG_SIZE 4 - # define ASN1_MAX_LENGTH_SIZE 9 --- -2.41.0 - + #define ASN1_MAX_TAG_SIZE 4 + #define ASN1_MAX_LENGTH_SIZE 9 diff --git a/0141-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch b/0141-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch deleted file mode 100644 index ffda03d..0000000 --- a/0141-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch +++ /dev/null @@ -1,374 +0,0 @@ -From dae5c202b2d1ff848130507f8e90b6cb4709d03f Mon Sep 17 00:00:00 2001 -From: Diego Domingos -Date: Tue, 15 Mar 2022 15:59:41 -0400 -Subject: [PATCH 141/272] ieee1275/ofpath: enable NVMeoF logical device - translation - -This patch add code to enable the translation of logical devices to the of NVMeoFC paths. ---- - grub-core/osdep/linux/ofpath.c | 260 +++++++++++++++++++++++++++++++-- - include/grub/util/ofpath.h | 29 ++++ - 2 files changed, 280 insertions(+), 9 deletions(-) - -diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index 89beceef4..212782d3f 100644 ---- a/grub-core/osdep/linux/ofpath.c -+++ b/grub-core/osdep/linux/ofpath.c -@@ -137,7 +137,7 @@ trim_newline (char *path) - *end-- = '\0'; - } - --#define MAX_DISK_CAT 64 -+#define MAX_DISK_CAT 512 - - static char * - find_obppath (const char *sysfs_path_orig) -@@ -313,6 +313,69 @@ get_basename(char *p) - return ret; - } - -+ -+void -+add_filename_to_pile(char *filename, struct ofpath_files_list_root* root){ -+ struct ofpath_files_list_node* file; -+ -+ file = malloc(sizeof(struct ofpath_files_list_node)); -+ -+ file->filename = filename; -+ -+ if(root->first == NULL){ -+ root->items = 1; -+ root->first = file; -+ file->next = NULL; -+ } else { -+ root->items++; -+ file->next = root->first; -+ root->first = file; -+ } -+} -+ -+ -+void -+find_file(char* filename, char* directory, struct ofpath_files_list_root* root, int max_depth, int depth){ -+ struct dirent *ep; -+ struct stat statbuf; -+ DIR *dp; -+ -+ if(depth > max_depth){ -+ return; -+ } -+ -+ if((dp = opendir(directory)) == NULL){ -+ -+ return; -+ } -+ -+ while((ep = readdir(dp)) != NULL){ -+ -+ char* full_path = malloc(1024*sizeof(char)); -+ snprintf(full_path,1024,"%s/%s",directory,ep->d_name); -+ -+ lstat(full_path,&statbuf); -+ -+ if(S_ISLNK(statbuf.st_mode)){ -+ -+ continue; -+ } -+ -+ if(!strcmp(ep->d_name,".") || !strcmp(ep->d_name,"..")){ -+ continue; -+ } -+ -+ if(!strcmp(ep->d_name,filename)){ -+ add_filename_to_pile(full_path, root); -+ } -+ -+ find_file(filename, full_path, root, max_depth, depth+1); -+ -+ } -+ closedir(dp); -+} -+ -+ - static char * - of_path_of_vdisk(const char *sys_devname __attribute__((unused)), - const char *device, -@@ -351,7 +414,142 @@ of_path_of_ide(const char *sys_devname __attribute__((unused)), const char *devi - return ret; - } - --#ifdef __sparc__ -+char* -+of_find_fc_host(char* host_wwpn){ -+ -+ FILE* fp; -+ char *buf; -+ char portname_filename[sizeof("port_name")] = "port_name"; -+ char devices_path[sizeof("/sys/devices")] = "/sys/devices"; -+ -+ struct ofpath_files_list_root* portnames_file_list; -+ -+ portnames_file_list=malloc(sizeof(portnames_file_list)); -+ portnames_file_list->items=0; -+ portnames_file_list->first=NULL; -+ -+ find_file(portname_filename, devices_path, portnames_file_list, 10, 0); -+ -+ struct ofpath_files_list_node* node = portnames_file_list->first; -+ while(node != NULL){ -+ fp = fopen(node->filename,"r"); -+ buf = malloc(sizeof(char)*512); -+ fscanf(fp, "%s", buf); -+ fclose(fp); -+ if((strcmp(buf,host_wwpn) == 0) && grub_strstr(node->filename, "fc_host")){ -+ return node->filename; -+ } -+ node = node->next; -+ } -+ -+ return NULL; -+} -+ -+void -+of_path_get_nvmeof_adapter_info(char* sysfs_path, -+ struct ofpath_nvmeof_info* nvmeof_info){ -+ -+ FILE *fp; -+ char *buf, *buf2, *buf3; -+ -+ nvmeof_info->host_wwpn = malloc(sizeof(char)*256); -+ nvmeof_info->target_wwpn = malloc(sizeof(char)*256); -+ nvmeof_info->nqn = malloc(sizeof(char)*256); -+ -+ buf = malloc(sizeof(char)*512); -+ snprintf(buf,512,"%s/subsysnqn",sysfs_path); -+ fp = fopen(buf,"r"); -+ fscanf(fp, "%s", nvmeof_info->nqn); -+ fclose(fp); -+ -+ snprintf(buf,512,"%s/cntlid",sysfs_path); -+ fp = fopen(buf,"r"); -+ fscanf(fp, "%u", &(nvmeof_info->cntlid)); -+ fclose(fp); -+ -+ //snprintf(buf,512,"%s/nsid",sysfs_path); -+ //fp = fopen(buf,"r"); -+ //fscanf(fp, "%u", &(nvmeof_info->nsid)); -+ //fclose(fp); -+ -+ snprintf(buf,512,"%s/address",sysfs_path); -+ fp = fopen(buf,"r"); -+ buf2 = malloc(sizeof(char)*512); -+ fscanf(fp, "%s", buf2); -+ fclose(fp); -+ -+ nvmeof_info->host_wwpn = strrchr(buf2,'-')+1; -+ -+ buf3=strchr(buf2,'-')+1; -+ buf3=strchr(buf3,'-')+1; -+ nvmeof_info->target_wwpn = buf3; -+ buf3 = strchr(nvmeof_info->target_wwpn,','); -+ *buf3 = '\0'; -+ -+ -+ free(buf); -+ -+ return; -+} -+ -+#define MAX_NVME_NSID_DIGITS 6 -+ -+static char * -+of_path_get_nvme_controller_name_node(const char* devname) -+{ -+ char *controller_node, *end; -+ -+ controller_node = strdup(devname); -+ -+ end = grub_strchr(controller_node+1, 'n'); -+ -+ if(end != NULL){ -+ *end = '\0'; -+ } -+ -+ return controller_node; -+} -+ -+unsigned int -+of_path_get_nvme_nsid(const char* devname) -+{ -+ unsigned int nsid; -+ char *sysfs_path, *buf; -+ FILE *fp; -+ -+ buf=malloc(sizeof(char)*512); -+ -+ sysfs_path = block_device_get_sysfs_path_and_link (devname); -+ -+ snprintf(buf,512,"%s/%s/nsid",sysfs_path,devname); -+ fp = fopen(buf,"r"); -+ fscanf(fp, "%u", &(nsid)); -+ fclose(fp); -+ -+ free(sysfs_path); -+ free(buf); -+ -+ return nsid; -+ -+} -+ -+static char * -+nvme_get_syspath(const char *nvmedev) -+{ -+ char *sysfs_path, *controller_node; -+ sysfs_path = block_device_get_sysfs_path_and_link (nvmedev); -+ -+ if(strstr(sysfs_path,"nvme-subsystem")){ -+ controller_node = of_path_get_nvme_controller_name_node(nvmedev); -+ strcat(sysfs_path,"/"); -+ strcat(sysfs_path,controller_node); -+ sysfs_path = xrealpath(sysfs_path); -+ } -+ -+ return sysfs_path; -+} -+ -+ - static char * - of_path_of_nvme(const char *sys_devname __attribute__((unused)), - const char *device, -@@ -360,6 +558,7 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), - { - char *sysfs_path, *of_path, disk[MAX_DISK_CAT]; - const char *digit_string, *part_end; -+ int chars_written; - - digit_string = trailing_digits (device); - part_end = devicenode + strlen (devicenode) - 1; -@@ -379,15 +578,61 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), - /* Remove the p. */ - *end = '\0'; - sscanf (digit_string, "%d", &part); -- snprintf (disk, sizeof (disk), "/disk@1:%c", 'a' + (part - 1)); -- sysfs_path = block_device_get_sysfs_path_and_link (nvmedev); -+ -+ sysfs_path = nvme_get_syspath(nvmedev); -+ -+ /* If is a NVMeoF */ -+ if(strstr(sysfs_path,"nvme-fabrics")){ -+ struct ofpath_nvmeof_info* nvmeof_info; -+ nvmeof_info = malloc(sizeof(nvmeof_info)); -+ -+ of_path_get_nvmeof_adapter_info(sysfs_path, nvmeof_info); -+ -+ sysfs_path = of_find_fc_host(nvmeof_info->host_wwpn); -+ -+ chars_written = snprintf(disk,sizeof(disk),"/nvme-of/controller@%s,%x:nqn=%s", -+ nvmeof_info->target_wwpn, -+ 0xffff, -+ nvmeof_info->nqn); -+ -+ unsigned int nsid = of_path_get_nvme_nsid(nvmedev); -+ -+ if(nsid){ -+ snprintf(disk+chars_written,sizeof(disk) - chars_written, -+ "/namespace@%x:%d",nsid, part); -+ } -+ -+ } else { -+ snprintf (disk, sizeof (disk), "/disk@1:%c", 'a' + (part - 1)); -+ } - free (nvmedev); - } - else - { - /* We do not have the parition. */ -- snprintf (disk, sizeof (disk), "/disk@1"); -- sysfs_path = block_device_get_sysfs_path_and_link (device); -+ sysfs_path = nvme_get_syspath (device); -+ if(strstr(sysfs_path,"nvme-fabrics")){ -+ struct ofpath_nvmeof_info* nvmeof_info; -+ nvmeof_info = malloc(sizeof(nvmeof_info)); -+ -+ of_path_get_nvmeof_adapter_info(sysfs_path, nvmeof_info); -+ -+ sysfs_path = of_find_fc_host(nvmeof_info->host_wwpn); -+ -+ chars_written = snprintf(disk,sizeof(disk),"/nvme-of/controller@%s,%x:nqn=%s", -+ nvmeof_info->target_wwpn, -+ 0xffff, -+ nvmeof_info->nqn); -+ -+ unsigned int nsid = of_path_get_nvme_nsid(device); -+ if(nsid){ -+ snprintf(disk+chars_written,sizeof(disk) - chars_written, -+ "/namespace@%x",nsid); -+ } -+ } else { -+ snprintf (disk, sizeof (disk), "/disk@1"); -+ } -+ - } - - of_path = find_obppath (sysfs_path); -@@ -398,7 +643,6 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), - free (sysfs_path); - return of_path; - } --#endif - - static void - of_fc_port_name(const char *path, const char *subpath, char *port_name) -@@ -840,11 +1084,9 @@ grub_util_devname_to_ofpath (const char *sys_devname) - /* All the models I've seen have a devalias "floppy". - New models have no floppy at all. */ - ofpath = xstrdup ("floppy"); --#ifdef __sparc__ - else if (device[0] == 'n' && device[1] == 'v' && device[2] == 'm' - && device[3] == 'e') - ofpath = of_path_of_nvme (name_buf, device, devnode, devicenode); --#endif - else - { - grub_util_warn (_("unknown device type %s"), device); -diff --git a/include/grub/util/ofpath.h b/include/grub/util/ofpath.h -index b43c523cb..a0ec30620 100644 ---- a/include/grub/util/ofpath.h -+++ b/include/grub/util/ofpath.h -@@ -3,4 +3,33 @@ - - char *grub_util_devname_to_ofpath (const char *devname); - -+struct ofpath_files_list_node { -+ char* filename; -+ struct ofpath_files_list_node* next; -+}; -+ -+struct ofpath_files_list_root { -+ int items; -+ struct ofpath_files_list_node* first; -+}; -+ -+struct ofpath_nvmeof_info { -+ char* host_wwpn; -+ char* target_wwpn; -+ char* nqn; -+ int cntlid; -+ int nsid; -+}; -+ -+void of_path_get_nvmeof_adapter_info(char* sysfs_path, -+ struct ofpath_nvmeof_info* nvmeof_info); -+ -+unsigned int of_path_get_nvme_nsid(const char* devname); -+ -+void add_filename_to_pile(char *filename, struct ofpath_files_list_root* root); -+ -+void find_file(char* filename, char* directory, struct ofpath_files_list_root* root, int max_depth, int depth); -+ -+char* of_find_fc_host(char* host_wwpn); -+ - #endif /* ! GRUB_OFPATH_MACHINE_UTIL_HEADER */ --- -2.41.0 - diff --git a/0106-libtasn1-changes-for-grub-compatibility.patch b/0141-libtasn1-changes-for-grub-compatibility.patch similarity index 57% rename from 0106-libtasn1-changes-for-grub-compatibility.patch rename to 0141-libtasn1-changes-for-grub-compatibility.patch index 2d9100f..9b2275c 100644 --- a/0106-libtasn1-changes-for-grub-compatibility.patch +++ b/0141-libtasn1-changes-for-grub-compatibility.patch @@ -1,13 +1,12 @@ -From c162278e9808877d6cc8a9c59fd507f54f00a924 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 1 May 2020 20:44:29 +1000 -Subject: [PATCH 106/272] libtasn1: changes for grub compatibility +Subject: [PATCH] libtasn1: changes for grub compatibility Do a few things to make libtasn1 compile as part of grub: - - redefine _asn1_strcat. grub removed strcat so replace it with the - appropriate calls to memcpy and strlen. Use this internally where - strcat was used. + - replace strcat. grub removed strcat so replace it with the appropriate + calls to memcpy and strlen. - replace c_isdigit with grub_isdigit (and don't import c-ctype from gnulib) grub_isdigit provides the same functionality as c_isdigit: it @@ -27,52 +26,52 @@ Do a few things to make libtasn1 compile as part of grub: Signed-off-by: Daniel Axtens --- - grub-core/lib/libtasn1/lib/decoding.c | 11 +++++----- + grub-core/lib/libtasn1/lib/decoding.c | 11 ++++++----- grub-core/lib/libtasn1/lib/element.c | 3 ++- grub-core/lib/libtasn1/lib/gstr.c | 4 ++-- + grub-core/lib/libtasn1/lib/parser_aux.c | 7 ++++--- grub-core/lib/libtasn1/lib/int.h | 4 ++-- - grub-core/lib/libtasn1/lib/parser_aux.c | 7 +++--- - include/grub/libtasn1.h | 29 +++++++------------------ - 6 files changed, 24 insertions(+), 34 deletions(-) + include/grub/libtasn1.h | 26 ++++++-------------------- + 6 files changed, 22 insertions(+), 33 deletions(-) diff --git a/grub-core/lib/libtasn1/lib/decoding.c b/grub-core/lib/libtasn1/lib/decoding.c -index b8130b956..beeb6a176 100644 +index 42f9a92b5d4..7856858b272 100644 --- a/grub-core/lib/libtasn1/lib/decoding.c +++ b/grub-core/lib/libtasn1/lib/decoding.c @@ -32,7 +32,8 @@ #include #include #include --#include "c-ctype.h" +-#include + +#define c_isdigit grub_isdigit #ifdef DEBUG # define warn() fprintf(stderr, "%s: %d\n", __func__, __LINE__) -@@ -2016,8 +2017,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, +@@ -2008,8 +2009,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, (p2->type & CONST_ASSIGN)) { strcpy (name, definitions->name); - strcat (name, "."); - strcat (name, p2->name); -+ _asn1_strcat (name, "."); -+ _asn1_strcat (name, p2->name); ++ memcpy (name + strlen(name), ".", sizeof(" . ")); ++ memcpy (name + strlen(name), p2->name, strlen(p2->name) + 1); len = sizeof (value); result = asn1_read_value (definitions, name, value, &len); -@@ -2034,8 +2035,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, +@@ -2026,8 +2027,8 @@ asn1_expand_octet_string (asn1_node_const definitions, asn1_node * element, if (p2) { strcpy (name, definitions->name); - strcat (name, "."); - strcat (name, p2->name); -+ _asn1_strcat (name, "."); -+ _asn1_strcat (name, p2->name); ++ memcpy (name + strlen(name), ".", sizeof(" . ")); ++ memcpy (name + strlen(name), p2->name, strlen(p2->name) + 1); result = asn1_create_element (definitions, name, &aux); if (result == ASN1_SUCCESS) diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c -index 8cd6b662c..150b9b377 100644 +index 539008d8e94..ed761ff56bd 100644 --- a/grub-core/lib/libtasn1/lib/element.c +++ b/grub-core/lib/libtasn1/lib/element.c @@ -30,9 +30,10 @@ @@ -88,7 +87,7 @@ index 8cd6b662c..150b9b377 100644 _asn1_hierarchical_name (asn1_node_const node, char *name, int name_size) { diff --git a/grub-core/lib/libtasn1/lib/gstr.c b/grub-core/lib/libtasn1/lib/gstr.c -index 1475ed51b..b729089db 100644 +index e91a3a151c0..e33875c2c7c 100644 --- a/grub-core/lib/libtasn1/lib/gstr.c +++ b/grub-core/lib/libtasn1/lib/gstr.c @@ -36,13 +36,13 @@ _asn1_str_cat (char *dest, size_t dest_tot_size, const char *src) @@ -96,41 +95,19 @@ index 1475ed51b..b729089db 100644 if (dest_tot_size - dest_size > str_size) { - strcat (dest, src); -+ _asn1_strcat (dest, src); ++ memcpy (dest + dest_size, src, str_size + 1); } else { - if (dest_tot_size > dest_size) + if (dest_tot_size - dest_size > 0) { - strncat (dest, src, (dest_tot_size - dest_size) - 1); + memcpy (dest + dest_size, src, (dest_tot_size - dest_size) - 1); dest[dest_tot_size - 1] = 0; } } -diff --git a/grub-core/lib/libtasn1/lib/int.h b/grub-core/lib/libtasn1/lib/int.h -index 404cd1562..edfe84a0e 100644 ---- a/grub-core/lib/libtasn1/lib/int.h -+++ b/grub-core/lib/libtasn1/lib/int.h -@@ -35,7 +35,7 @@ - # include - # endif - --# include -+# include "grub/libtasn1.h" - - # define ASN1_SMALL_VALUE_SIZE 16 - -@@ -115,7 +115,7 @@ extern const tag_and_class_st _asn1_tags[]; - # define _asn1_strtoul(n,e,b) strtoul((const char *) n, e, b) - # define _asn1_strcmp(a,b) strcmp((const char *)a, (const char *)b) - # define _asn1_strcpy(a,b) strcpy((char *)a, (const char *)b) --# define _asn1_strcat(a,b) strcat((char *)a, (const char *)b) -+# define _asn1_strcat(a,b) memcpy((char *)a + strlen((const char *)a), (const char *)b, strlen((const char *)b) + 1) - - # if SIZEOF_UNSIGNED_LONG_INT == 8 - # define _asn1_strtou64(n,e,b) strtoul((const char *) n, e, b) diff --git a/grub-core/lib/libtasn1/lib/parser_aux.c b/grub-core/lib/libtasn1/lib/parser_aux.c -index c99c5a4cb..a933f03ed 100644 +index d5dbbf8765d..89c9be69dc2 100644 --- a/grub-core/lib/libtasn1/lib/parser_aux.c +++ b/grub-core/lib/libtasn1/lib/parser_aux.c @@ -26,7 +26,8 @@ @@ -145,14 +122,14 @@ index c99c5a4cb..a933f03ed 100644 @@ -40,7 +41,7 @@ char _asn1_identifierMissing[ASN1_MAX_NAME_SIZE + 1]; /* identifier name not fou #ifdef __clang__ - __attribute__((no_sanitize ("integer"))) + __attribute__((no_sanitize("integer"))) #endif -- _GL_ATTRIBUTE_PURE static unsigned int _asn1_hash_name (const char *x) -+ __attribute__((__pure__)) static unsigned int _asn1_hash_name (const char *x) +-_GL_ATTRIBUTE_PURE ++__attribute__((__pure__)) + static unsigned int + _asn1_hash_name (const char *x) { - const unsigned char *s = (unsigned char *) x; - unsigned h = 0; -@@ -632,7 +633,7 @@ _asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]) +@@ -634,7 +635,7 @@ _asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]) count = 0; do { @@ -161,48 +138,65 @@ index c99c5a4cb..a933f03ed 100644 r = val - d * 10; temp[start + count] = '0' + (char) r; count++; +diff --git a/grub-core/lib/libtasn1/lib/int.h b/grub-core/lib/libtasn1/lib/int.h +index ea1625786c1..4a568efee9c 100644 +--- a/grub-core/lib/libtasn1/lib/int.h ++++ b/grub-core/lib/libtasn1/lib/int.h +@@ -35,7 +35,7 @@ + #include + #endif + +-#include ++#include "grub/libtasn1.h" + + #define ASN1_SMALL_VALUE_SIZE 16 + +@@ -115,7 +115,7 @@ extern const tag_and_class_st _asn1_tags[]; + #define _asn1_strtoul(n,e,b) strtoul((const char *) n, e, b) + #define _asn1_strcmp(a,b) strcmp((const char *)a, (const char *)b) + #define _asn1_strcpy(a,b) strcpy((char *)a, (const char *)b) +-#define _asn1_strcat(a,b) strcat((char *)a, (const char *)b) ++#define _asn1_strcat(a,b) memcpy((char *)a + strlen((const char *)a), (const char *)b, strlen((const char *)b) + 1) + + #if SIZEOF_UNSIGNED_LONG_INT == 8 + # define _asn1_strtou64(n,e,b) strtoul((const char *) n, e, b) diff --git a/include/grub/libtasn1.h b/include/grub/libtasn1.h -index 0c3a44881..2ea058a3b 100644 +index 785eda2ae3f..28dbf16c4e0 100644 --- a/include/grub/libtasn1.h +++ b/include/grub/libtasn1.h -@@ -34,29 +34,16 @@ +@@ -38,29 +38,15 @@ #ifndef LIBTASN1_H - # define LIBTASN1_H + #define LIBTASN1_H --# ifndef ASN1_API --# if defined ASN1_BUILDING && defined HAVE_VISIBILITY && HAVE_VISIBILITY --# define ASN1_API __attribute__((__visibility__("default"))) --# elif defined ASN1_BUILDING && defined _MSC_VER && ! defined ASN1_STATIC --# define ASN1_API __declspec(dllexport) --# elif defined _MSC_VER && ! defined ASN1_STATIC --# define ASN1_API __declspec(dllimport) --# else --# define ASN1_API --# endif --# endif +-#ifndef ASN1_API +-#if defined ASN1_BUILDING && defined HAVE_VISIBILITY && HAVE_VISIBILITY +-#define ASN1_API __attribute__((__visibility__("default"))) +-#elif defined ASN1_BUILDING && defined _MSC_VER && ! defined ASN1_STATIC +-#define ASN1_API __declspec(dllexport) +-#elif defined _MSC_VER && ! defined ASN1_STATIC +-#define ASN1_API __declspec(dllimport) +-#else +/* grub: ASN1_API is not used */ -+# define ASN1_API -+ -+/* grub: all our supported compilers support these attributes */ -+# define __LIBTASN1_CONST__ __attribute__((const)) -+# define __LIBTASN1_PURE__ __attribute__((pure)) + #define ASN1_API +-#endif +-#endif --# ifdef __GNUC__ --# define __LIBTASN1_CONST__ __attribute__((const)) --# define __LIBTASN1_PURE__ __attribute__((pure)) --# else --# define __LIBTASN1_CONST__ --# define __LIBTASN1_PURE__ --# endif +-#ifdef __GNUC__ +-# define __LIBTASN1_CONST__ __attribute__((const)) +-# define __LIBTASN1_PURE__ __attribute__((pure)) +-#else +-# define __LIBTASN1_CONST__ +-# define __LIBTASN1_PURE__ +-#endif ++/* grub: all our supported compilers support these attributes */ ++#define __LIBTASN1_CONST__ __attribute__((const)) ++#define __LIBTASN1_PURE__ __attribute__((pure)) --# include --# include --# include /* for FILE* */ -+# include -+# include +-#include +-#include +-#include /* for FILE* */ ++#include ++#include - # ifdef __cplusplus + #ifdef __cplusplus extern "C" --- -2.41.0 - diff --git a/0107-libtasn1-compile-into-asn1-module.patch b/0142-libtasn1-compile-into-asn1-module.patch similarity index 89% rename from 0107-libtasn1-compile-into-asn1-module.patch rename to 0142-libtasn1-compile-into-asn1-module.patch index c819458..bdd6f63 100644 --- a/0107-libtasn1-compile-into-asn1-module.patch +++ b/0142-libtasn1-compile-into-asn1-module.patch @@ -1,7 +1,7 @@ -From c7202c4e903b02790a4d98d52bb91fa12043e1ad Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 5 Jun 2020 17:47:25 +1000 -Subject: [PATCH 107/272] libtasn1: compile into asn1 module +Subject: [PATCH] libtasn1: compile into asn1 module Create a wrapper file that specifies the module license. Set up the makefile so it is built. @@ -14,12 +14,12 @@ Signed-off-by: Daniel Axtens create mode 100644 grub-core/lib/libtasn1_wrap/wrap.c diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index c8ff3a57f..6339ccd4e 100644 +index 82f2e169ad1..05b976d9a77 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -2623,3 +2623,18 @@ module = { - name = cmdline; - common = lib/cmdline.c; +@@ -2646,3 +2646,18 @@ module = { + efi = commands/bli.c; + enable = efi; }; + +module = { @@ -38,7 +38,7 @@ index c8ff3a57f..6339ccd4e 100644 +}; diff --git a/grub-core/lib/libtasn1_wrap/wrap.c b/grub-core/lib/libtasn1_wrap/wrap.c new file mode 100644 -index 000000000..622ba942e +index 00000000000..622ba942e33 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/wrap.c @@ -0,0 +1,26 @@ @@ -68,6 +68,3 @@ index 000000000..622ba942e + * is therefore under GPL3+ also. + */ +GRUB_MOD_LICENSE ("GPLv3+"); --- -2.41.0 - diff --git a/0143-ofpath-controller-name-update.patch b/0143-ofpath-controller-name-update.patch deleted file mode 100644 index 09205bb..0000000 --- a/0143-ofpath-controller-name-update.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 7a1bf37bedbd2124836e85853471833d53c4c267 Mon Sep 17 00:00:00 2001 -From: mamatha -Date: Sat, 24 Sep 2022 11:22:39 +0530 -Subject: [PATCH 143/272] ofpath controller name update - -patch to update ofpath controller name - -Signed-off-by: mamatha ---- - grub-core/osdep/linux/ofpath.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index 212782d3f..7d31cfd0f 100644 ---- a/grub-core/osdep/linux/ofpath.c -+++ b/grub-core/osdep/linux/ofpath.c -@@ -483,6 +483,8 @@ of_path_get_nvmeof_adapter_info(char* sysfs_path, - buf3=strchr(buf2,'-')+1; - buf3=strchr(buf3,'-')+1; - nvmeof_info->target_wwpn = buf3; -+ buf3=strchr(buf3,'x')+1; -+ nvmeof_info->target_wwpn = buf3; - buf3 = strchr(nvmeof_info->target_wwpn,','); - *buf3 = '\0'; - --- -2.41.0 - diff --git a/0108-test_asn1-test-module-for-libtasn1.patch b/0143-test_asn1-test-module-for-libtasn1.patch similarity index 98% rename from 0108-test_asn1-test-module-for-libtasn1.patch rename to 0143-test_asn1-test-module-for-libtasn1.patch index 739a70b..23f4bbf 100644 --- a/0108-test_asn1-test-module-for-libtasn1.patch +++ b/0143-test_asn1-test-module-for-libtasn1.patch @@ -1,7 +1,7 @@ -From 06929d934b6c6bf7af60d47c3b43f577575b7b4f Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Wed, 10 Jun 2020 17:48:42 +1000 -Subject: [PATCH 108/272] test_asn1: test module for libtasn1 +Subject: [PATCH] test_asn1: test module for libtasn1 Import tests from libtasn1 that don't use functionality we don't import. I have put them here rather than in the libtasn1 directory @@ -18,25 +18,27 @@ This doesn't test the full decoder but that will be exercised in test suites for coming patch sets. Signed-off-by: Daniel Axtens + +[pjones updated the Makefile.util.def part to have "testcase = native;" +syntax.] --- - Makefile.util.def | 6 + - grub-core/Makefile.core.def | 13 ++ - .../tests/CVE-2018-1000654-1_asn1_tab.h | 32 +++ - .../tests/CVE-2018-1000654-2_asn1_tab.h | 36 +++ - .../libtasn1_wrap/tests/CVE-2018-1000654.c | 61 +++++ - .../lib/libtasn1_wrap/tests/Test_overflow.c | 138 ++++++++++++ - .../lib/libtasn1_wrap/tests/Test_simple.c | 207 +++++++++++++++++ - .../lib/libtasn1_wrap/tests/Test_strings.c | 150 +++++++++++++ - .../libtasn1_wrap/tests/object-id-decoding.c | 116 ++++++++++ - .../libtasn1_wrap/tests/object-id-encoding.c | 120 ++++++++++ - .../lib/libtasn1_wrap/tests/octet-string.c | 211 ++++++++++++++++++ - .../lib/libtasn1_wrap/tests/reproducers.c | 81 +++++++ - grub-core/lib/libtasn1_wrap/wrap_tests.c | 75 +++++++ - grub-core/lib/libtasn1_wrap/wrap_tests.h | 38 ++++ - tests/test_asn1.in | 12 + - 15 files changed, 1296 insertions(+) - create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h - create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h + Makefile.util.def | 6 + + grub-core/Makefile.core.def | 13 ++ + .../lib/libtasn1_wrap/tests/CVE-2018-1000654.c | 61 ++++++ + grub-core/lib/libtasn1_wrap/tests/Test_overflow.c | 138 ++++++++++++++ + grub-core/lib/libtasn1_wrap/tests/Test_simple.c | 207 ++++++++++++++++++++ + grub-core/lib/libtasn1_wrap/tests/Test_strings.c | 150 +++++++++++++++ + .../lib/libtasn1_wrap/tests/object-id-decoding.c | 116 +++++++++++ + .../lib/libtasn1_wrap/tests/object-id-encoding.c | 120 ++++++++++++ + grub-core/lib/libtasn1_wrap/tests/octet-string.c | 211 +++++++++++++++++++++ + grub-core/lib/libtasn1_wrap/tests/reproducers.c | 81 ++++++++ + grub-core/lib/libtasn1_wrap/wrap_tests.c | 75 ++++++++ + .../tests/CVE-2018-1000654-1_asn1_tab.h | 32 ++++ + .../tests/CVE-2018-1000654-2_asn1_tab.h | 36 ++++ + grub-core/lib/libtasn1_wrap/wrap_tests.h | 38 ++++ + .gitignore | 1 + + tests/test_asn1.in | 12 ++ + 16 files changed, 1297 insertions(+) create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654.c create mode 100644 grub-core/lib/libtasn1_wrap/tests/Test_overflow.c create mode 100644 grub-core/lib/libtasn1_wrap/tests/Test_simple.c @@ -46,14 +48,16 @@ Signed-off-by: Daniel Axtens create mode 100644 grub-core/lib/libtasn1_wrap/tests/octet-string.c create mode 100644 grub-core/lib/libtasn1_wrap/tests/reproducers.c create mode 100644 grub-core/lib/libtasn1_wrap/wrap_tests.c + create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h + create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h create mode 100644 grub-core/lib/libtasn1_wrap/wrap_tests.h create mode 100644 tests/test_asn1.in diff --git a/Makefile.util.def b/Makefile.util.def -index 268fc99f2..09f93e2f6 100644 +index 8e52e48c780..ef344f5aa8c 100644 --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -1269,6 +1269,12 @@ script = { +@@ -1328,6 +1328,12 @@ script = { common = tests/luks2_test.in; }; @@ -67,10 +71,10 @@ index 268fc99f2..09f93e2f6 100644 testcase = native; name = example_unit_test; diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 6339ccd4e..dcfbf9fdd 100644 +index 05b976d9a77..0e65fefb195 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -2638,3 +2638,16 @@ module = { +@@ -2661,3 +2661,16 @@ module = { // -Wno-type-limits comes from libtasn1's configure.ac cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB) -I$(srcdir)/lib/libtasn1/lib -Wno-type-limits'; }; @@ -87,89 +91,9 @@ index 6339ccd4e..dcfbf9fdd 100644 + common = lib/libtasn1_wrap/tests/Test_strings.c; + common = lib/libtasn1_wrap/wrap_tests.c; +}; -diff --git a/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h -new file mode 100644 -index 000000000..1e7d3d64f ---- /dev/null -+++ b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h -@@ -0,0 +1,32 @@ -+#if HAVE_CONFIG_H -+# include "config.h" -+#endif -+ -+#include -+ -+const asn1_static_node CVE_2018_1000654_1_asn1_tab[] = { -+ { "TEST_TREE", 536875024, NULL }, -+ { NULL, 1610612748, NULL }, -+ { "iso", 1073741825, "1"}, -+ { "identified-organization", 1073741825, "3"}, -+ { "dod", 1073741825, "6"}, -+ { "internet", 1073741825, "1"}, -+ { "security", 1073741825, "5"}, -+ { "mechanisms", 1073741825, "5"}, -+ { "pkix", 1073741825, "7"}, -+ { "id-mod", 1073741825, "0"}, -+ { "id-pkix1-implicit-88", 1, "2"}, -+ { "id-xnyTest", 1879048204, NULL }, -+ { NULL, 1073741825, "id-ix"}, -+ { NULL, 1073741825, "29"}, -+ { NULL, 1, "1"}, -+ { "id-ix", 1880096780, "OBJECR"}, -+ { NULL, 1073741825, "id-ix"}, -+ { NULL, 1073741825, "29"}, -+ { NULL, 1, "2"}, -+ { "id-xnyTest", 805306380, NULL }, -+ { NULL, 1073741825, "id-ix"}, -+ { NULL, 1073741825, "29"}, -+ { NULL, 1, "1"}, -+ { NULL, 0, NULL } -+}; -diff --git a/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h -new file mode 100644 -index 000000000..e2561e5ec ---- /dev/null -+++ b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h -@@ -0,0 +1,36 @@ -+#if HAVE_CONFIG_H -+# include "config.h" -+#endif -+ -+#include -+ -+const asn1_static_node CVE_2018_1000654_2_asn1_tab[] = { -+ { "TEST_TREE", 536875024, NULL }, -+ { NULL, 1610612748, NULL }, -+ { "iso", 1073741825, "1"}, -+ { "identified-organization", 1073741825, "3"}, -+ { "dod", 1073741825, "6"}, -+ { "internet", 1073741825, "1"}, -+ { "security", 1073741825, "5"}, -+ { "mechanisms", 1073741825, "5"}, -+ { "pkix", 1073741825, "7"}, -+ { "id-mod", 1073741825, "0"}, -+ { "id-pkix1-implicit-88", 1, "2"}, -+ { "id-oneTest", 1879048204, NULL }, -+ { NULL, 1073741825, "id-two"}, -+ { NULL, 1073741825, "9"}, -+ { NULL, 1, "1"}, -+ { "id-two", 1879048204, NULL }, -+ { NULL, 1073741825, "id-three"}, -+ { NULL, 1073741825, "2"}, -+ { NULL, 1, "2"}, -+ { "id-three", 1879048204, NULL }, -+ { NULL, 1073741825, "id-four"}, -+ { NULL, 1073741825, "3"}, -+ { NULL, 1, "3"}, -+ { "id-four", 805306380, NULL }, -+ { NULL, 1073741825, "id-two"}, -+ { NULL, 1073741825, "3"}, -+ { NULL, 1, "3"}, -+ { NULL, 0, NULL } -+}; diff --git a/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654.c b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654.c new file mode 100644 -index 000000000..534e30452 +index 00000000000..534e304521e --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654.c @@ -0,0 +1,61 @@ @@ -236,7 +160,7 @@ index 000000000..534e30452 +} diff --git a/grub-core/lib/libtasn1_wrap/tests/Test_overflow.c b/grub-core/lib/libtasn1_wrap/tests/Test_overflow.c new file mode 100644 -index 000000000..f48aea0ef +index 00000000000..f48aea0ef8b --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/Test_overflow.c @@ -0,0 +1,138 @@ @@ -380,7 +304,7 @@ index 000000000..f48aea0ef +} diff --git a/grub-core/lib/libtasn1_wrap/tests/Test_simple.c b/grub-core/lib/libtasn1_wrap/tests/Test_simple.c new file mode 100644 -index 000000000..9f01006dd +index 00000000000..9f01006ddf4 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/Test_simple.c @@ -0,0 +1,207 @@ @@ -593,7 +517,7 @@ index 000000000..9f01006dd +} diff --git a/grub-core/lib/libtasn1_wrap/tests/Test_strings.c b/grub-core/lib/libtasn1_wrap/tests/Test_strings.c new file mode 100644 -index 000000000..dbe1474b2 +index 00000000000..dbe1474b204 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/Test_strings.c @@ -0,0 +1,150 @@ @@ -749,7 +673,7 @@ index 000000000..dbe1474b2 +} diff --git a/grub-core/lib/libtasn1_wrap/tests/object-id-decoding.c b/grub-core/lib/libtasn1_wrap/tests/object-id-decoding.c new file mode 100644 -index 000000000..d367bbfb5 +index 00000000000..d367bbfb5a7 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/object-id-decoding.c @@ -0,0 +1,116 @@ @@ -871,7 +795,7 @@ index 000000000..d367bbfb5 +} diff --git a/grub-core/lib/libtasn1_wrap/tests/object-id-encoding.c b/grub-core/lib/libtasn1_wrap/tests/object-id-encoding.c new file mode 100644 -index 000000000..3a83b58c5 +index 00000000000..3a83b58c59f --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/object-id-encoding.c @@ -0,0 +1,120 @@ @@ -997,7 +921,7 @@ index 000000000..3a83b58c5 +} diff --git a/grub-core/lib/libtasn1_wrap/tests/octet-string.c b/grub-core/lib/libtasn1_wrap/tests/octet-string.c new file mode 100644 -index 000000000..d8a049e8d +index 00000000000..d8a049e8df0 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/octet-string.c @@ -0,0 +1,211 @@ @@ -1214,7 +1138,7 @@ index 000000000..d8a049e8d +} diff --git a/grub-core/lib/libtasn1_wrap/tests/reproducers.c b/grub-core/lib/libtasn1_wrap/tests/reproducers.c new file mode 100644 -index 000000000..dc7268d4c +index 00000000000..dc7268d4c6c --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/tests/reproducers.c @@ -0,0 +1,81 @@ @@ -1301,7 +1225,7 @@ index 000000000..dc7268d4c +} diff --git a/grub-core/lib/libtasn1_wrap/wrap_tests.c b/grub-core/lib/libtasn1_wrap/wrap_tests.c new file mode 100644 -index 000000000..75fcd21f0 +index 00000000000..75fcd21f0d5 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/wrap_tests.c @@ -0,0 +1,75 @@ @@ -1380,9 +1304,89 @@ index 000000000..75fcd21f0 +{ + grub_unregister_command (cmd); +} +diff --git a/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h +new file mode 100644 +index 00000000000..1e7d3d64f55 +--- /dev/null ++++ b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h +@@ -0,0 +1,32 @@ ++#if HAVE_CONFIG_H ++# include "config.h" ++#endif ++ ++#include ++ ++const asn1_static_node CVE_2018_1000654_1_asn1_tab[] = { ++ { "TEST_TREE", 536875024, NULL }, ++ { NULL, 1610612748, NULL }, ++ { "iso", 1073741825, "1"}, ++ { "identified-organization", 1073741825, "3"}, ++ { "dod", 1073741825, "6"}, ++ { "internet", 1073741825, "1"}, ++ { "security", 1073741825, "5"}, ++ { "mechanisms", 1073741825, "5"}, ++ { "pkix", 1073741825, "7"}, ++ { "id-mod", 1073741825, "0"}, ++ { "id-pkix1-implicit-88", 1, "2"}, ++ { "id-xnyTest", 1879048204, NULL }, ++ { NULL, 1073741825, "id-ix"}, ++ { NULL, 1073741825, "29"}, ++ { NULL, 1, "1"}, ++ { "id-ix", 1880096780, "OBJECR"}, ++ { NULL, 1073741825, "id-ix"}, ++ { NULL, 1073741825, "29"}, ++ { NULL, 1, "2"}, ++ { "id-xnyTest", 805306380, NULL }, ++ { NULL, 1073741825, "id-ix"}, ++ { NULL, 1073741825, "29"}, ++ { NULL, 1, "1"}, ++ { NULL, 0, NULL } ++}; +diff --git a/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h +new file mode 100644 +index 00000000000..e2561e5ec6d +--- /dev/null ++++ b/grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h +@@ -0,0 +1,36 @@ ++#if HAVE_CONFIG_H ++# include "config.h" ++#endif ++ ++#include ++ ++const asn1_static_node CVE_2018_1000654_2_asn1_tab[] = { ++ { "TEST_TREE", 536875024, NULL }, ++ { NULL, 1610612748, NULL }, ++ { "iso", 1073741825, "1"}, ++ { "identified-organization", 1073741825, "3"}, ++ { "dod", 1073741825, "6"}, ++ { "internet", 1073741825, "1"}, ++ { "security", 1073741825, "5"}, ++ { "mechanisms", 1073741825, "5"}, ++ { "pkix", 1073741825, "7"}, ++ { "id-mod", 1073741825, "0"}, ++ { "id-pkix1-implicit-88", 1, "2"}, ++ { "id-oneTest", 1879048204, NULL }, ++ { NULL, 1073741825, "id-two"}, ++ { NULL, 1073741825, "9"}, ++ { NULL, 1, "1"}, ++ { "id-two", 1879048204, NULL }, ++ { NULL, 1073741825, "id-three"}, ++ { NULL, 1073741825, "2"}, ++ { NULL, 1, "2"}, ++ { "id-three", 1879048204, NULL }, ++ { NULL, 1073741825, "id-four"}, ++ { NULL, 1073741825, "3"}, ++ { NULL, 1, "3"}, ++ { "id-four", 805306380, NULL }, ++ { NULL, 1073741825, "id-two"}, ++ { NULL, 1073741825, "3"}, ++ { NULL, 1, "3"}, ++ { NULL, 0, NULL } ++}; diff --git a/grub-core/lib/libtasn1_wrap/wrap_tests.h b/grub-core/lib/libtasn1_wrap/wrap_tests.h new file mode 100644 -index 000000000..555e56dd2 +index 00000000000..555e56dd202 --- /dev/null +++ b/grub-core/lib/libtasn1_wrap/wrap_tests.h @@ -0,0 +1,38 @@ @@ -1424,9 +1428,21 @@ index 000000000..555e56dd2 +void test_strings (void); + +#endif +diff --git a/.gitignore b/.gitignore +index a18787dcfe6..f2e8e1e42d7 100644 +--- a/.gitignore ++++ b/.gitignore +@@ -268,6 +268,7 @@ widthspec.bin + /stamp-h1 + /syslinux_test + /tar_test ++/test_asn1 + /test_sha512sum + /test_unset + /tests/syslinux/ubuntu10.04_grub.cfg diff --git a/tests/test_asn1.in b/tests/test_asn1.in new file mode 100644 -index 000000000..8173c5c27 +index 00000000000..8173c5c270e --- /dev/null +++ b/tests/test_asn1.in @@ -0,0 +1,12 @@ @@ -1442,6 +1458,3 @@ index 000000000..8173c5c27 + exit 1 +fi + --- -2.41.0 - diff --git a/0144-Mark-environmet-blocks-as-used-for-image-embedding.patch b/0144-Mark-environmet-blocks-as-used-for-image-embedding.patch deleted file mode 100644 index 7b7a93e..0000000 --- a/0144-Mark-environmet-blocks-as-used-for-image-embedding.patch +++ /dev/null @@ -1,66 +0,0 @@ -From b6a055e2c811bfe10b888ffac819d9002a68dc9c Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 15 Apr 2022 21:45:04 +0800 -Subject: [PATCH 144/272] Mark environmet blocks as used for image embedding. - -Now that grub will attempt to use full btrfs bootloader area, the -embedded image could have overlapped with environment blocks if it's -size grows too much. Let's define a dedicated area for environment -blocks to the used block mappings for the embedding process so it can be -skipped. - -Signed-off-by: Michael Chang ---- - grub-core/fs/btrfs.c | 3 ++- - include/grub/fs.h | 2 ++ - util/grub-editenv.c | 2 +- - 3 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 886f80645..7e12dce9c 100644 ---- a/grub-core/fs/btrfs.c -+++ b/grub-core/fs/btrfs.c -@@ -2639,7 +2639,7 @@ struct embed_region { - - static const struct { - struct embed_region available; -- struct embed_region used[6]; -+ struct embed_region used[7]; - } btrfs_head = { - .available = {0, GRUB_DISK_KiB_TO_SECTORS (1024)}, /* The first 1 MiB. */ - .used = { -@@ -2647,6 +2647,7 @@ static const struct { - {GRUB_DISK_KiB_TO_SECTORS (64) - 1, 1}, /* Overflow guard. */ - {GRUB_DISK_KiB_TO_SECTORS (64), GRUB_DISK_KiB_TO_SECTORS (4)}, /* 4 KiB superblock. */ - {GRUB_DISK_KiB_TO_SECTORS (68), 1}, /* Overflow guard. */ -+ {GRUB_DISK_KiB_TO_SECTORS (ENV_BTRFS_OFFSET) - 1, 3}, /* Environment Block. */ - {GRUB_DISK_KiB_TO_SECTORS (1024) - 1, 1}, /* Overflow guard. */ - {0, 0} /* Array terminator. */ - } -diff --git a/include/grub/fs.h b/include/grub/fs.h -index 026bc3bb8..4c380e334 100644 ---- a/include/grub/fs.h -+++ b/include/grub/fs.h -@@ -128,4 +128,6 @@ grub_fs_unregister (grub_fs_t fs) - - grub_fs_t EXPORT_FUNC(grub_fs_probe) (grub_device_t device); - -+#define ENV_BTRFS_OFFSET (256) -+ - #endif /* ! GRUB_FS_HEADER */ -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index a02d3f2a6..af30aabe7 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -128,7 +128,7 @@ struct fs_envblk_spec { - int offset; - int size; - } fs_envblk_spec[] = { -- { "btrfs", 256 * 1024, GRUB_DISK_SECTOR_SIZE }, -+ { "btrfs", ENV_BTRFS_OFFSET * 1024, GRUB_DISK_SECTOR_SIZE }, - { NULL, 0, 0 } - }; - --- -2.41.0 - diff --git a/0109-grub-install-support-embedding-x509-certificates.patch b/0144-grub-install-support-embedding-x509-certificates.patch similarity index 84% rename from 0109-grub-install-support-embedding-x509-certificates.patch rename to 0144-grub-install-support-embedding-x509-certificates.patch index 074ecb2..9ebbeb0 100644 --- a/0109-grub-install-support-embedding-x509-certificates.patch +++ b/0144-grub-install-support-embedding-x509-certificates.patch @@ -1,7 +1,7 @@ -From 89b349d9f59df43df5f2fd9acb9744f4fd99fbf2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alastair D'Silva Date: Mon, 6 Jul 2020 13:33:04 +1000 -Subject: [PATCH 109/272] grub-install: support embedding x509 certificates +Subject: [PATCH] grub-install: support embedding x509 certificates To support verification of appended signatures, we need a way to embed the necessary public keys. Existing appended signature schemes @@ -12,15 +12,15 @@ Signed-off-by: Alastair D'Silva Signed-off-by: Daniel Axtens --- grub-core/commands/pgp.c | 2 +- - include/grub/kernel.h | 3 ++- + util/grub-install-common.c | 23 ++++++++++++++++++++++- + util/grub-mkimage.c | 15 +++++++++++++-- + util/mkimage.c | 38 ++++++++++++++++++++++++++++++++++++-- + include/grub/kernel.h | 4 +++- include/grub/util/install.h | 7 +++++-- - util/grub-install-common.c | 22 +++++++++++++++++++- - util/grub-mkimage.c | 15 ++++++++++++-- - util/mkimage.c | 41 ++++++++++++++++++++++++++++++++++--- - 6 files changed, 80 insertions(+), 10 deletions(-) + 6 files changed, 80 insertions(+), 9 deletions(-) diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c -index a45c2213c..847a5046a 100644 +index a45c2213c4a..847a5046a5c 100644 --- a/grub-core/commands/pgp.c +++ b/grub-core/commands/pgp.c @@ -944,7 +944,7 @@ GRUB_MOD_INIT(pgp) @@ -32,47 +32,8 @@ index a45c2213c..847a5046a 100644 continue; pseudo_file.fs = &pseudo_fs; -diff --git a/include/grub/kernel.h b/include/grub/kernel.h -index abbca5ea3..d3aafc884 100644 ---- a/include/grub/kernel.h -+++ b/include/grub/kernel.h -@@ -28,7 +28,8 @@ enum - OBJ_TYPE_MEMDISK, - OBJ_TYPE_CONFIG, - OBJ_TYPE_PREFIX, -- OBJ_TYPE_PUBKEY, -+ OBJ_TYPE_GPG_PUBKEY, -+ OBJ_TYPE_X509_PUBKEY, - OBJ_TYPE_DTB, - OBJ_TYPE_DISABLE_SHIM_LOCK - }; -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index 4267da52a..274b9f60e 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -67,6 +67,8 @@ - N_("SBAT metadata"), 0 }, \ - { "disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, \ - N_("disable shim_lock verifier"), 0 }, \ -+ { "x509key", 'x', N_("FILE"), 0, \ -+ N_("embed FILE as an x509 certificate for signature checking"), 0}, \ - { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ - "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ - 1}, \ -@@ -189,8 +191,9 @@ void - grub_install_generate_image (const char *dir, const char *prefix, - FILE *out, - const char *outname, char *mods[], -- char *memdisk_path, char **pubkey_paths, -- size_t npubkeys, -+ char *memdisk_path, -+ char **pubkey_paths, size_t npubkeys, -+ char **x509key_paths, size_t nx509keys, - char *config_path, - const struct grub_install_image_target_desc *image_target, - int note, size_t appsig_size, diff --git a/util/grub-install-common.c b/util/grub-install-common.c -index 942dafe1a..71a0998c2 100644 +index 1fa0f7f6f00..b58539111da 100644 --- a/util/grub-install-common.c +++ b/util/grub-install-common.c @@ -465,6 +465,8 @@ static char **pubkeys; @@ -122,18 +83,19 @@ index 942dafe1a..71a0998c2 100644 for (md = modules.entries; *md; md++) { *p++ = ' '; -@@ -702,7 +721,8 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, +@@ -702,7 +721,9 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, grub_install_generate_image (dir, prefix, fp, outname, modules.entries, memdisk_path, - pubkeys, npubkeys, config_path, tgt, -+ pubkeys, npubkeys, x509keys, nx509keys, ++ pubkeys, npubkeys, ++ x509keys, nx509keys, + config_path, tgt, note, appsig_size, compression, dtb, sbat, disable_shim_lock); while (dc--) diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c -index d01eaeb84..7d61ef3ea 100644 +index 8a53310548b..e1f1112784a 100644 --- a/util/grub-mkimage.c +++ b/util/grub-mkimage.c @@ -75,7 +75,8 @@ static struct argp_option options[] = { @@ -177,26 +139,23 @@ index d01eaeb84..7d61ef3ea 100644 + arguments.npubkeys, arguments.x509keys, + arguments.nx509keys, arguments.config, arguments.image_target, arguments.note, - arguments.appsig_size, - arguments.comp, arguments.dtb, + arguments.appsig_size, arguments.comp, + arguments.dtb, arguments.sbat, diff --git a/util/mkimage.c b/util/mkimage.c -index ff0c48901..0737935fd 100644 +index d33838bec6b..e2bb4d4cd05 100644 --- a/util/mkimage.c +++ b/util/mkimage.c -@@ -882,8 +882,10 @@ init_pe_section(const struct grub_install_image_target_desc *image_target, - void +@@ -883,7 +883,8 @@ void grub_install_generate_image (const char *dir, const char *prefix, FILE *out, const char *outname, char *mods[], -- char *memdisk_path, char **pubkey_paths, + char *memdisk_path, char **pubkey_paths, - size_t npubkeys, char *config_path, -+ char *memdisk_path, -+ char **pubkey_paths, size_t npubkeys, -+ char **x509key_paths, size_t nx509keys, -+ char *config_path, ++ size_t npubkeys, char **x509key_paths, ++ size_t nx509keys, char *config_path, const struct grub_install_image_target_desc *image_target, int note, size_t appsig_size, grub_compression_t comp, - const char *dtb_path, const char *sbat_path, -@@ -929,6 +931,19 @@ grub_install_generate_image (const char *dir, const char *prefix, + const char *dtb_path, const char *sbat_path, +@@ -929,6 +930,19 @@ grub_install_generate_image (const char *dir, const char *prefix, } } @@ -216,7 +175,7 @@ index ff0c48901..0737935fd 100644 if (memdisk_path) { memdisk_size = ALIGN_UP(grub_util_get_image_size (memdisk_path), 512); -@@ -1050,7 +1065,7 @@ grub_install_generate_image (const char *dir, const char *prefix, +@@ -1050,7 +1064,7 @@ grub_install_generate_image (const char *dir, const char *prefix, curs = grub_util_get_image_size (pubkey_paths[i]); header = (struct grub_module_header *) (kernel_img + offset); @@ -225,7 +184,7 @@ index ff0c48901..0737935fd 100644 header->size = grub_host_to_target32 (curs + sizeof (*header)); offset += sizeof (*header); -@@ -1059,6 +1074,26 @@ grub_install_generate_image (const char *dir, const char *prefix, +@@ -1059,6 +1073,26 @@ grub_install_generate_image (const char *dir, const char *prefix, } } @@ -252,6 +211,43 @@ index ff0c48901..0737935fd 100644 if (memdisk_path) { struct grub_module_header *header; --- -2.41.0 - +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index 55849777eaa..98edc0863f6 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -30,7 +30,9 @@ enum + OBJ_TYPE_PREFIX, + OBJ_TYPE_PUBKEY, + OBJ_TYPE_DTB, +- OBJ_TYPE_DISABLE_SHIM_LOCK ++ OBJ_TYPE_DISABLE_SHIM_LOCK, ++ OBJ_TYPE_GPG_PUBKEY, ++ OBJ_TYPE_X509_PUBKEY, + }; + + /* The module header. */ +diff --git a/include/grub/util/install.h b/include/grub/util/install.h +index 2720428602b..59eabb9bb86 100644 +--- a/include/grub/util/install.h ++++ b/include/grub/util/install.h +@@ -67,6 +67,8 @@ + N_("SBAT metadata"), 0 }, \ + { "disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, \ + N_("disable shim_lock verifier"), 0 }, \ ++ { "x509key", 'x', N_("FILE"), 0, \ ++ N_("embed FILE as an x509 certificate for signature checking"), 0}, \ + { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ + "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ + 1}, \ +@@ -189,8 +191,9 @@ void + grub_install_generate_image (const char *dir, const char *prefix, + FILE *out, + const char *outname, char *mods[], +- char *memdisk_path, char **pubkey_paths, +- size_t npubkeys, ++ char *memdisk_path, ++ char **pubkey_paths, size_t npubkeys, ++ char **x509key_paths, size_t nx509keys, + char *config_path, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, diff --git a/0110-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch b/0145-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch similarity index 98% rename from 0110-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch rename to 0145-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch index 4d79b12..7b7d70c 100644 --- a/0110-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch +++ b/0145-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch @@ -1,8 +1,7 @@ -From 54fdf914566e1bc43bca977a2d26b286f195f183 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 30 Jul 2020 01:35:10 +1000 -Subject: [PATCH 110/272] appended signatures: import GNUTLS's ASN.1 - description files +Subject: [PATCH] appended signatures: import GNUTLS's ASN.1 description files In order to parse PKCS#7 messages and X.509 certificates with libtasn1, we need some information about how they are encoded. @@ -15,15 +14,15 @@ us to import it without issue. Signed-off-by: Daniel Axtens --- - .../commands/appendedsig/gnutls_asn1_tab.c | 121 +++++ - .../commands/appendedsig/pkix_asn1_tab.c | 484 ++++++++++++++++++ + grub-core/commands/appendedsig/gnutls_asn1_tab.c | 121 ++++++ + grub-core/commands/appendedsig/pkix_asn1_tab.c | 484 +++++++++++++++++++++++ 2 files changed, 605 insertions(+) create mode 100644 grub-core/commands/appendedsig/gnutls_asn1_tab.c create mode 100644 grub-core/commands/appendedsig/pkix_asn1_tab.c diff --git a/grub-core/commands/appendedsig/gnutls_asn1_tab.c b/grub-core/commands/appendedsig/gnutls_asn1_tab.c new file mode 100644 -index 000000000..ddd1314e6 +index 00000000000..ddd1314e63b --- /dev/null +++ b/grub-core/commands/appendedsig/gnutls_asn1_tab.c @@ -0,0 +1,121 @@ @@ -150,7 +149,7 @@ index 000000000..ddd1314e6 +}; diff --git a/grub-core/commands/appendedsig/pkix_asn1_tab.c b/grub-core/commands/appendedsig/pkix_asn1_tab.c new file mode 100644 -index 000000000..adef69d95 +index 00000000000..adef69d95ce --- /dev/null +++ b/grub-core/commands/appendedsig/pkix_asn1_tab.c @@ -0,0 +1,484 @@ @@ -638,6 +637,3 @@ index 000000000..adef69d95 + { NULL, 3, NULL }, + { NULL, 0, NULL } +}; --- -2.41.0 - diff --git a/0145-commands-crypttab-increase-the-size-of-the-path-buff.patch b/0145-commands-crypttab-increase-the-size-of-the-path-buff.patch deleted file mode 100644 index 9d5ddb1..0000000 --- a/0145-commands-crypttab-increase-the-size-of-the-path-buff.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 61dcae6a6089889db0ae078d094eaee5d0432495 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Fri, 16 Dec 2022 09:19:50 +0800 -Subject: [PATCH 145/272] commands/crypttab: increase the size of the path - buffer - -Allocate a larger buffer for the cryptsetup.d path in case the system -uses a long volume name. - -Signed-off-by: Gary Lin ---- - grub-core/commands/crypttab.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index 5104541df..cc7f83309 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -11,7 +11,7 @@ static grub_err_t - grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - int argc, char **argv) - { -- char buf[64]; -+ char buf[256]; - const char *path = NULL; - - if (argc == 2) --- -2.41.0 - diff --git a/0111-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch b/0146-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch similarity index 75% rename from 0111-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch rename to 0146-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch index 822111a..04bf1df 100644 --- a/0111-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch +++ b/0146-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch @@ -1,8 +1,8 @@ -From c09a70f26d0260e863fc9d3e4763f44df1208714 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 30 Jul 2020 01:33:46 +1000 -Subject: [PATCH 111/272] appended signatures: parse PKCS#7 signedData and - X.509 certificates +Subject: [PATCH] appended signatures: parse PKCS#7 signedData and X.509 + certificates This code allows us to parse: @@ -15,154 +15,24 @@ This code allows us to parse: PKCS#7 messages. We expect that the certificates embedded in grub will be leaf certificates, not CA certificates. The parser enforces this. - - X.509 certificates support the Extended Key Usage extension and handle - it by verifying that the certificate has a single purpose, that is code - signing. This is required because Red Hat certificates have both Key - Usage and Extended Key Usage extensions present. - -Signed-off-by: Javier Martinez Canillas # EKU support Signed-off-by: Daniel Axtens --- - grub-core/commands/appendedsig/appendedsig.h | 118 ++ - grub-core/commands/appendedsig/asn1util.c | 103 ++ - grub-core/commands/appendedsig/pkcs7.c | 509 +++++++++ - grub-core/commands/appendedsig/x509.c | 1079 ++++++++++++++++++ - 4 files changed, 1809 insertions(+) - create mode 100644 grub-core/commands/appendedsig/appendedsig.h + grub-core/commands/appendedsig/asn1util.c | 102 +++ + grub-core/commands/appendedsig/pkcs7.c | 305 +++++++++ + grub-core/commands/appendedsig/x509.c | 958 +++++++++++++++++++++++++++ + grub-core/commands/appendedsig/appendedsig.h | 110 +++ + 4 files changed, 1475 insertions(+) create mode 100644 grub-core/commands/appendedsig/asn1util.c create mode 100644 grub-core/commands/appendedsig/pkcs7.c create mode 100644 grub-core/commands/appendedsig/x509.c + create mode 100644 grub-core/commands/appendedsig/appendedsig.h -diff --git a/grub-core/commands/appendedsig/appendedsig.h b/grub-core/commands/appendedsig/appendedsig.h -new file mode 100644 -index 000000000..327d68ddb ---- /dev/null -+++ b/grub-core/commands/appendedsig/appendedsig.h -@@ -0,0 +1,118 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2020 IBM Corporation. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+ -+extern asn1_node _gnutls_gnutls_asn; -+extern asn1_node _gnutls_pkix_asn; -+ -+#define MAX_OID_LEN 32 -+ -+/* -+ * One or more x509 certificates. -+ * -+ * We do limited parsing: extracting only the serial, CN and RSA public key. -+ */ -+struct x509_certificate -+{ -+ struct x509_certificate *next; -+ -+ grub_uint8_t *serial; -+ grub_size_t serial_len; -+ -+ char *subject; -+ grub_size_t subject_len; -+ -+ /* We only support RSA public keys. This encodes [modulus, publicExponent] */ -+ gcry_mpi_t mpis[2]; -+}; -+ -+/* -+ * A PKCS#7 signedData signerInfo. -+ */ -+struct pkcs7_signerInfo -+{ -+ const gcry_md_spec_t *hash; -+ gcry_mpi_t sig_mpi; -+}; -+ -+/* -+ * A PKCS#7 signedData message. -+ * -+ * We make no attempt to match intelligently, so we don't save any info about -+ * the signer. -+ */ -+struct pkcs7_signedData -+{ -+ int signerInfo_count; -+ struct pkcs7_signerInfo *signerInfos; -+}; -+ -+ -+/* Do libtasn1 init */ -+int asn1_init (void); -+ -+/* -+ * Import a DER-encoded certificate at 'data', of size 'size'. -+ * -+ * Place the results into 'results', which must be already allocated. -+ */ -+grub_err_t -+parse_x509_certificate (const void *data, grub_size_t size, -+ struct x509_certificate *results); -+ -+/* -+ * Release all the storage associated with the x509 certificate. -+ * If the caller dynamically allocated the certificate, it must free it. -+ * The caller is also responsible for maintenance of the linked list. -+ */ -+void certificate_release (struct x509_certificate *cert); -+ -+/* -+ * Parse a PKCS#7 message, which must be a signedData message. -+ * -+ * The message must be in 'sigbuf' and of size 'data_size'. The result is -+ * placed in 'msg', which must already be allocated. -+ */ -+grub_err_t -+parse_pkcs7_signedData (const void *sigbuf, grub_size_t data_size, -+ struct pkcs7_signedData *msg); -+ -+/* -+ * Release all the storage associated with the PKCS#7 message. -+ * If the caller dynamically allocated the message, it must free it. -+ */ -+void pkcs7_signedData_release (struct pkcs7_signedData *msg); -+ -+/* -+ * Read a value from an ASN1 node, allocating memory to store it. -+ * -+ * It will work for anything where the size libtasn1 returns is right: -+ * - Integers -+ * - Octet strings -+ * - DER encoding of other structures -+ * It will _not_ work for things where libtasn1 size requires adjustment: -+ * - Strings that require an extra NULL byte at the end -+ * - Bit strings because libtasn1 returns the length in bits, not bytes. -+ * -+ * If the function returns a non-NULL value, the caller must free it. -+ */ -+void *grub_asn1_allocate_and_read (asn1_node node, const char *name, -+ const char *friendly_name, -+ int *content_size); diff --git a/grub-core/commands/appendedsig/asn1util.c b/grub-core/commands/appendedsig/asn1util.c new file mode 100644 -index 000000000..e116f8c75 +index 00000000000..eff095a9df2 --- /dev/null +++ b/grub-core/commands/appendedsig/asn1util.c -@@ -0,0 +1,103 @@ +@@ -0,0 +1,102 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2020 IBM Corporation. @@ -186,16 +56,15 @@ index 000000000..e116f8c75 +#include +#include +#include -+#include +#include + +#include "appendedsig.h" + -+asn1_node _gnutls_gnutls_asn = NULL; -+asn1_node _gnutls_pkix_asn = NULL; ++asn1_node _gnutls_gnutls_asn = ASN1_TYPE_EMPTY; ++asn1_node _gnutls_pkix_asn = ASN1_TYPE_EMPTY; + -+extern const asn1_static_node gnutls_asn1_tab[]; -+extern const asn1_static_node pkix_asn1_tab[]; ++extern const ASN1_ARRAY_TYPE gnutls_asn1_tab[]; ++extern const ASN1_ARRAY_TYPE pkix_asn1_tab[]; + +/* + * Read a value from an ASN1 node, allocating memory to store it. @@ -268,10 +137,10 @@ index 000000000..e116f8c75 +} diff --git a/grub-core/commands/appendedsig/pkcs7.c b/grub-core/commands/appendedsig/pkcs7.c new file mode 100644 -index 000000000..845f58a53 +index 00000000000..dc6afe203f7 --- /dev/null +++ b/grub-core/commands/appendedsig/pkcs7.c -@@ -0,0 +1,509 @@ +@@ -0,0 +1,305 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2020 IBM Corporation. @@ -294,7 +163,7 @@ index 000000000..845f58a53 +#include +#include +#include -+#include ++ + +static char asn1_error[ASN1_MAX_ERROR_DESCRIPTION_SIZE]; + @@ -319,18 +188,12 @@ index 000000000..845f58a53 + char algo_oid[MAX_OID_LEN]; + int algo_oid_size = sizeof (algo_oid); + int algo_count; -+ int signer_count; -+ int i; + char version; + int version_size = sizeof (version); + grub_uint8_t *result_buf; + int result_size = 0; + int crls_size = 0; + gcry_error_t gcry_err; -+ bool sha256_in_da, sha256_in_si, sha512_in_da, sha512_in_si; -+ char *da_path; -+ char *si_sig_path; -+ char *si_da_path; + + res = asn1_create_element (_gnutls_pkix_asn, "PKIX1.pkcs-7-SignedData", + &signed_part); @@ -402,92 +265,51 @@ index 000000000..845f58a53 + goto cleanup_signed_part; + } + -+ if (algo_count <= 0) ++ if (algo_count != 1) ++ { ++ err = ++ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, ++ "Only 1 digest algorithm is supported"); ++ goto cleanup_signed_part; ++ } ++ ++ res = ++ asn1_read_value (signed_part, "digestAlgorithms.?1.algorithm", algo_oid, ++ &algo_oid_size); ++ if (res != ASN1_SUCCESS) + { + err = + grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "A minimum of 1 digest algorithm is required"); ++ "Error reading digest algorithm: %s", ++ asn1_strerror (res)); + goto cleanup_signed_part; + } + -+ if (algo_count > 2) ++ if (grub_strncmp (sha512_oid, algo_oid, algo_oid_size) == 0) ++ { ++ msg->hash = grub_crypto_lookup_md_by_name ("sha512"); ++ } ++ else if (grub_strncmp (sha256_oid, algo_oid, algo_oid_size) == 0) ++ { ++ msg->hash = grub_crypto_lookup_md_by_name ("sha256"); ++ } ++ else + { + err = + grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ "A maximum of 2 digest algorithms are supported"); ++ "Only SHA-256 and SHA-512 hashes are supported, found OID %s", ++ algo_oid); + goto cleanup_signed_part; + } + -+ sha256_in_da = false; -+ sha512_in_da = false; -+ -+ for (i = 0; i < algo_count; i++) ++ if (!msg->hash) + { -+ da_path = grub_xasprintf ("digestAlgorithms.?%d.algorithm", i + 1); -+ if (!da_path) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "Could not allocate path for digest algorithm parsing path"); -+ goto cleanup_signed_part; -+ } -+ -+ algo_oid_size = sizeof (algo_oid); -+ res = asn1_read_value (signed_part, da_path, algo_oid, &algo_oid_size); -+ if (res != ASN1_SUCCESS) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Error reading digest algorithm: %s", -+ asn1_strerror (res)); -+ grub_free (da_path); -+ goto cleanup_signed_part; -+ } -+ -+ if (grub_strncmp (sha512_oid, algo_oid, algo_oid_size) == 0) -+ { -+ if (!sha512_in_da) -+ { -+ sha512_in_da = true; -+ } -+ else -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "SHA-512 specified twice in digest algorithm list"); -+ grub_free (da_path); -+ goto cleanup_signed_part; -+ } -+ } -+ else if (grub_strncmp (sha256_oid, algo_oid, algo_oid_size) == 0) -+ { -+ if (!sha256_in_da) -+ { -+ sha256_in_da = true; -+ } -+ else -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "SHA-256 specified twice in digest algorithm list"); -+ grub_free (da_path); -+ goto cleanup_signed_part; -+ } -+ } -+ else -+ { -+ err = -+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ "Only SHA-256 and SHA-512 hashes are supported, found OID %s", -+ algo_oid); -+ grub_free (da_path); -+ goto cleanup_signed_part; -+ } -+ -+ grub_free (da_path); ++ err = ++ grub_error (GRUB_ERR_BAD_SIGNATURE, ++ "Hash algorithm for OID %s not loaded", algo_oid); ++ goto cleanup_signed_part; + } + -+ /* at this point, at least one of sha{256,512}_in_da must be true */ -+ + /* + * We ignore the certificates, but we don't permit CRLs. + * A CRL entry might be revoking the certificate we're using, and we have @@ -502,189 +324,38 @@ index 000000000..845f58a53 + goto cleanup_signed_part; + } + -+ /* read the signatures */ -+ -+ res = asn1_number_of_elements (signed_part, "signerInfos", &signer_count); -+ if (res != ASN1_SUCCESS) ++ /* read the signature */ ++ result_buf = ++ grub_asn1_allocate_and_read (signed_part, "signerInfos.?1.signature", ++ "signature data", &result_size); ++ if (!result_buf) + { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Error counting number of signers: %s", -+ asn1_strerror (res)); ++ err = grub_errno; + goto cleanup_signed_part; + } + -+ if (signer_count <= 0) ++ gcry_err = ++ gcry_mpi_scan (&(msg->sig_mpi), GCRYMPI_FMT_USG, result_buf, result_size, ++ NULL); ++ if (gcry_err != GPG_ERR_NO_ERROR) + { + err = + grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "A minimum of 1 signer is required"); -+ goto cleanup_signed_part; -+ } -+ -+ msg->signerInfos = grub_calloc (signer_count, -+ sizeof (struct pkcs7_signerInfo)); -+ if (!msg->signerInfos) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "Could not allocate space for %d signers", -+ signer_count); -+ goto cleanup_signed_part; -+ } -+ -+ msg->signerInfo_count = 0; -+ for (i = 0; i < signer_count; i++) -+ { -+ si_da_path = -+ grub_xasprintf ("signerInfos.?%d.digestAlgorithm.algorithm", i + 1); -+ if (!si_da_path) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "Could not allocate path for signer %d's digest algorithm parsing path", -+ i); -+ goto cleanup_signerInfos; -+ } -+ -+ algo_oid_size = sizeof (algo_oid); -+ res = -+ asn1_read_value (signed_part, si_da_path, algo_oid, &algo_oid_size); -+ if (res != ASN1_SUCCESS) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Error reading signer %d's digest algorithm: %s", -+ i, asn1_strerror (res)); -+ grub_free (si_da_path); -+ goto cleanup_signerInfos; -+ } -+ -+ grub_free (si_da_path); -+ -+ if (grub_strncmp (sha512_oid, algo_oid, algo_oid_size) == 0) -+ { -+ if (!sha512_in_da) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Signer %d claims a SHA-512 signature which was not specified in the outer DigestAlgorithms", -+ i); -+ goto cleanup_signerInfos; -+ } -+ else -+ { -+ sha512_in_si = true; -+ msg->signerInfos[i].hash = -+ grub_crypto_lookup_md_by_name ("sha512"); -+ } -+ } -+ else if (grub_strncmp (sha256_oid, algo_oid, algo_oid_size) == 0) -+ { -+ if (!sha256_in_da) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Signer %d claims a SHA-256 signature which was not specified in the outer DigestAlgorithms", -+ i); -+ goto cleanup_signerInfos; -+ } -+ else -+ { -+ sha256_in_si = true; -+ msg->signerInfos[i].hash = -+ grub_crypto_lookup_md_by_name ("sha256"); -+ } -+ } -+ else -+ { -+ err = -+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ "Only SHA-256 and SHA-512 hashes are supported, found OID %s", -+ algo_oid); -+ goto cleanup_signerInfos; -+ } -+ -+ if (!msg->signerInfos[i].hash) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Hash algorithm for signer %d (OID %s) not loaded", i, -+ algo_oid); -+ goto cleanup_signerInfos; -+ } -+ -+ si_sig_path = grub_xasprintf ("signerInfos.?%d.signature", i + 1); -+ if (!si_sig_path) -+ { -+ err = grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "Could not allocate path for signer %d's signature parsing path", -+ i); -+ goto cleanup_signerInfos; -+ } -+ -+ result_buf = -+ grub_asn1_allocate_and_read (signed_part, si_sig_path, -+ "signature data", &result_size); -+ if (!result_buf) -+ { -+ err = grub_errno; -+ grub_free (si_sig_path); -+ goto cleanup_signerInfos; -+ } -+ grub_free (si_sig_path); -+ -+ gcry_err = -+ gcry_mpi_scan (&(msg->signerInfos[i].sig_mpi), GCRYMPI_FMT_USG, -+ result_buf, result_size, NULL); -+ if (gcry_err != GPG_ERR_NO_ERROR) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "Error loading signature %d into MPI structure: %d", -+ i, gcry_err); -+ grub_free (result_buf); -+ goto cleanup_signerInfos; -+ } -+ -+ grub_free (result_buf); -+ -+ /* use msg->signerInfo_count to track fully populated signerInfos so we -+ know how many we need to clean up */ -+ msg->signerInfo_count++; -+ } -+ -+ /* Final consistency check of signerInfo.*.digestAlgorithm vs -+ digestAlgorithms.*.algorithm. An algorithm must be present in both -+ digestAlgorithms and signerInfo or in neither. We have already checked -+ for an algorithm in signerInfo that is not in digestAlgorithms, here we -+ check for algorithms in digestAlgorithms but not in signerInfos. */ -+ if (sha512_in_da && !sha512_in_si) -+ { -+ err = grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "SHA-512 specified in DigestAlgorithms but did not appear in SignerInfos"); -+ goto cleanup_signerInfos; -+ } -+ -+ if (sha256_in_da && !sha256_in_si) -+ { -+ err = grub_error (GRUB_ERR_BAD_SIGNATURE, -+ "SHA-256 specified in DigestAlgorithms but did not appear in SignerInfos"); -+ goto cleanup_signerInfos; ++ "Error loading signature into MPI structure: %d", ++ gcry_err); ++ goto cleanup_result; + } + -+ asn1_delete_structure (&signed_part); -+ return GRUB_ERR_NONE; -+ -+cleanup_signerInfos: -+ for (i = 0; i < msg->signerInfo_count; i++) -+ gcry_mpi_release (msg->signerInfos[i].sig_mpi); -+ grub_free (msg->signerInfos); ++cleanup_result: ++ grub_free (result_buf); +cleanup_signed_part: + asn1_delete_structure (&signed_part); ++ + return err; +} + +grub_err_t -+parse_pkcs7_signedData (const void *sigbuf, grub_size_t data_size, ++parse_pkcs7_signedData (void *sigbuf, grub_size_t data_size, + struct pkcs7_signedData *msg) +{ + int res; @@ -711,8 +382,7 @@ index 000000000..845f58a53 + } + + res = asn1_der_decoding2 (&content_info, sigbuf, &size, -+ ASN1_DECODE_FLAG_STRICT_DER | -+ ASN1_DECODE_FLAG_ALLOW_PADDING, asn1_error); ++ ASN1_DECODE_FLAG_STRICT_DER, asn1_error); + if (res != ASN1_SUCCESS) + { + err = @@ -774,19 +444,14 @@ index 000000000..845f58a53 +void +pkcs7_signedData_release (struct pkcs7_signedData *msg) +{ -+ grub_ssize_t i; -+ for (i = 0; i < msg->signerInfo_count; i++) -+ { -+ gcry_mpi_release (msg->signerInfos[i].sig_mpi); -+ } -+ grub_free (msg->signerInfos); ++ gcry_mpi_release (msg->sig_mpi); +} diff --git a/grub-core/commands/appendedsig/x509.c b/grub-core/commands/appendedsig/x509.c new file mode 100644 -index 000000000..70480aa73 +index 00000000000..2b38b3670a2 --- /dev/null +++ b/grub-core/commands/appendedsig/x509.c -@@ -0,0 +1,1079 @@ +@@ -0,0 +1,958 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2020 IBM Corporation. @@ -810,7 +475,6 @@ index 000000000..70480aa73 +#include +#include +#include -+#include +#include + +#include "appendedsig.h" @@ -832,20 +496,12 @@ index 000000000..70480aa73 + */ +const char *keyUsage_oid = "2.5.29.15"; + -+const grub_uint8_t digitalSignatureUsage = 0x80; -+ +/* + * RFC 5280 4.2.1.9 Basic Constraints + */ +const char *basicConstraints_oid = "2.5.29.19"; + +/* -+ * RFC 5280 4.2.1.12 Extended Key Usage -+ */ -+const char *extendedKeyUsage_oid = "2.5.29.37"; -+const char *codeSigningUsage_oid = "1.3.6.1.5.5.7.3.3"; -+ -+/* + * RFC 3279 2.3.1 + * + * The RSA public key MUST be encoded using the ASN.1 type RSAPublicKey: @@ -858,11 +514,11 @@ index 000000000..70480aa73 + * exponent e. + */ +static grub_err_t -+grub_parse_rsa_pubkey (grub_uint8_t *der, int dersize, ++grub_parse_rsa_pubkey (grub_uint8_t * der, int dersize, + struct x509_certificate *certificate) +{ + int result; -+ asn1_node spk = NULL; ++ asn1_node spk = ASN1_TYPE_EMPTY; + grub_uint8_t *m_data, *e_data; + int m_size, e_size; + grub_err_t err = GRUB_ERR_NONE; @@ -1064,7 +720,7 @@ index 000000000..70480aa73 +/* Decode a string as defined in Appendix A */ +static grub_err_t +decode_string (char *der, int der_size, char **string, -+ grub_size_t *string_size) ++ grub_size_t * string_size) +{ + asn1_node strasn; + int result; @@ -1102,39 +758,25 @@ index 000000000..70480aa73 + goto cleanup; + } + -+ if (grub_strncmp ("utf8String", choice, choice_size) == 0) -+ { -+ result = asn1_read_value (strasn, "utf8String", NULL, &tmp_size); -+ if (result != ASN1_MEM_ERROR) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error reading size of UTF-8 string: %s", -+ asn1_strerror (result)); -+ goto cleanup_choice; -+ } -+ } -+ else if (grub_strncmp ("printableString", choice, choice_size) == 0) -+ { -+ result = asn1_read_value (strasn, "printableString", NULL, &tmp_size); -+ if (result != ASN1_MEM_ERROR) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error reading size of UTF-8 string: %s", -+ asn1_strerror (result)); -+ goto cleanup_choice; -+ } -+ } -+ else ++ if (grub_strncmp ("utf8String", choice, choice_size)) + { + err = + grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ "Only UTF-8 and printable DirectoryStrings are supported, got %s", ++ "Only UTF-8 DirectoryStrings are supported, got %s", + choice); + goto cleanup_choice; + } + ++ result = asn1_read_value (strasn, "utf8String", NULL, &tmp_size); ++ if (result != ASN1_MEM_ERROR) ++ { ++ err = ++ grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Error reading size of UTF-8 string: %s", ++ asn1_strerror (result)); ++ goto cleanup_choice; ++ } ++ + /* read size does not include trailing null */ + tmp_size++; + @@ -1147,13 +789,13 @@ index 000000000..70480aa73 + goto cleanup_choice; + } + -+ result = asn1_read_value (strasn, choice, *string, &tmp_size); ++ result = asn1_read_value (strasn, "utf8String", *string, &tmp_size); + if (result != ASN1_SUCCESS) + { + err = + grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error reading out %s in DirectoryString: %s", -+ choice, asn1_strerror (result)); ++ "Error reading out UTF-8 string in DirectoryString: %s", ++ asn1_strerror (result)); + grub_free (*string); + goto cleanup_choice; + } @@ -1180,7 +822,7 @@ index 000000000..70480aa73 + int rc; + const char *name = "tbsCertificate.version"; + grub_uint8_t version; -+ int len = sizeof (version); ++ int len = 1; + + rc = asn1_read_value (certificate, name, &version, &len); + @@ -1204,7 +846,7 @@ index 000000000..70480aa73 + */ +static grub_err_t +read_name (asn1_node asn, const char *name_path, char **name, -+ grub_size_t *name_size) ++ grub_size_t * name_size) +{ + int seq_components, set_components; + int result; @@ -1317,8 +959,6 @@ index 000000000..70480aa73 + break; + } + -+ grub_free (top_path); -+ + return GRUB_ERR_NONE; + +cleanup_string: @@ -1335,17 +975,16 @@ index 000000000..70480aa73 +} + +/* -+ * Verify the Key Usage extension. -+ * We only permit the Digital signature usage. ++ * details here + */ +static grub_err_t -+verify_key_usage (grub_uint8_t *value, int value_size) ++verify_key_usage (grub_uint8_t * value, int value_size) +{ + asn1_node usageasn; + int result; + grub_err_t err = GRUB_ERR_NONE; + grub_uint8_t usage = 0xff; -+ int usage_size = sizeof (usage_size); ++ int usage_size = 1; + + result = + asn1_create_element (_gnutls_pkix_asn, "PKIX1.KeyUsage", &usageasn); @@ -1375,7 +1014,8 @@ index 000000000..70480aa73 + goto cleanup; + } + -+ if (usage != digitalSignatureUsage) ++ /* Only the first bit is permitted to be set */ ++ if (usage != 0x80) + { + err = + grub_error (GRUB_ERR_BAD_FILE_TYPE, "Unexpected Key Usage value: %x", @@ -1394,7 +1034,7 @@ index 000000000..70480aa73 + * pathLenConstraint INTEGER (0..MAX) OPTIONAL } + */ +static grub_err_t -+verify_basic_constraints (grub_uint8_t *value, int value_size) ++verify_basic_constraints (grub_uint8_t * value, int value_size) +{ + asn1_node basicasn; + int result; @@ -1451,85 +1091,6 @@ index 000000000..70480aa73 + return err; +} + -+/* -+ * ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId -+ * -+ * KeyPurposeId ::= OBJECT IDENTIFIER -+ */ -+static grub_err_t -+verify_extended_key_usage (grub_uint8_t *value, int value_size) -+{ -+ asn1_node extendedasn; -+ int result, count; -+ grub_err_t err = GRUB_ERR_NONE; -+ char usage[MAX_OID_LEN]; -+ int usage_size = sizeof (usage); -+ -+ result = -+ asn1_create_element (_gnutls_pkix_asn, "PKIX1.ExtKeyUsageSyntax", -+ &extendedasn); -+ if (result != ASN1_SUCCESS) -+ { -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ "Could not create ASN.1 structure for Extended Key Usage"); -+ } -+ -+ result = asn1_der_decoding2 (&extendedasn, value, &value_size, -+ ASN1_DECODE_FLAG_STRICT_DER, asn1_error); -+ if (result != ASN1_SUCCESS) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error parsing DER for Extended Key Usage: %s", -+ asn1_error); -+ goto cleanup; -+ } -+ -+ /* -+ * If EKUs are present, there must be exactly 1 and it must be a -+ * codeSigning usage. -+ */ -+ result = asn1_number_of_elements (extendedasn, "", &count); -+ if (result != ASN1_SUCCESS) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error counting number of Extended Key Usages: %s", -+ asn1_strerror (result)); -+ goto cleanup; -+ } -+ -+ if (count != 1) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Unexpected number of Extended Key Usages: %d, 1 expected", -+ count); -+ goto cleanup; -+ } -+ -+ result = asn1_read_value (extendedasn, "?1", usage, &usage_size); -+ if (result != ASN1_SUCCESS) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Error reading Extended Key Usage: %s", -+ asn1_strerror (result)); -+ goto cleanup; -+ } -+ -+ if (grub_strncmp (codeSigningUsage_oid, usage, usage_size) != 0) -+ { -+ err = -+ grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Unexpected Extended Key Usage OID, got: %s", usage); -+ goto cleanup; -+ } -+ -+cleanup: -+ asn1_delete_structure (&extendedasn); -+ return err; -+} + +/* + * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension @@ -1543,18 +1104,17 @@ index 000000000..70480aa73 + * -- by extnID + * } + * -+ * A certificate must: ++ * We require that a certificate: + * - contain the Digital Signature usage only + * - not be a CA -+ * - contain no extended usages, or only a code signing extended usage -+ * - not contain any other critical extensions (RFC 5280 s 4.2) ++ * - MUST not contain any other critical extensions (RFC 5280 s 4.2) + */ +static grub_err_t +verify_extensions (asn1_node cert) +{ + int result; + int ext, num_extensions = 0; -+ int usage_present = 0, constraints_present = 0, extended_usage_present = 0; ++ int usage_present = 0, constraints_present = 0; + char *oid_path, *critical_path, *value_path; + char extnID[MAX_OID_LEN]; + int extnID_size; @@ -1587,7 +1147,7 @@ index 000000000..70480aa73 + + extnID_size = sizeof (extnID); + result = asn1_read_value (cert, oid_path, extnID, &extnID_size); -+ if (result != ASN1_SUCCESS) ++ if (result != GRUB_ERR_NONE) + { + err = + grub_error (GRUB_ERR_BAD_FILE_TYPE, @@ -1648,15 +1208,6 @@ index 000000000..70480aa73 + } + constraints_present++; + } -+ else if (grub_strncmp (extendedKeyUsage_oid, extnID, extnID_size) == 0) -+ { -+ err = verify_extended_key_usage (value, value_size); -+ if (err != GRUB_ERR_NONE) -+ { -+ goto cleanup_value; -+ } -+ extended_usage_present++; -+ } + else if (grub_strncmp ("TRUE", critical, critical_size) == 0) + { + /* @@ -1688,12 +1239,6 @@ index 000000000..70480aa73 + "Unexpected number of basic constraints extensions - expected 1, got %d", + constraints_present); + } -+ if (extended_usage_present > 1) -+ { -+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, -+ "Unexpected number of Extended Key Usage extensions - expected 0 or 1, got %d", -+ extended_usage_present); -+ } + return GRUB_ERR_NONE; + +cleanup_value: @@ -1712,8 +1257,8 @@ index 000000000..70480aa73 + * Return the results in @results, which must point to an allocated x509 certificate. + */ +grub_err_t -+parse_x509_certificate (const void *data, grub_size_t data_size, -+ struct x509_certificate *results) ++certificate_import (void *data, grub_size_t data_size, ++ struct x509_certificate *results) +{ + int result = 0; + asn1_node cert; @@ -1830,7 +1375,8 @@ index 000000000..70480aa73 + + err = verify_extensions (cert); + if (err != GRUB_ERR_NONE) -+ goto cleanup_mpis; ++ goto cleanup_name; ++ + + /* + * We do not read or check the signature on the certificate: @@ -1841,9 +1387,7 @@ index 000000000..70480aa73 + asn1_delete_structure (&cert); + return GRUB_ERR_NONE; + -+cleanup_mpis: -+ gcry_mpi_release (results->mpis[0]); -+ gcry_mpi_release (results->mpis[1]); ++ +cleanup_name: + grub_free (results->subject); +cleanup_serial: @@ -1866,6 +1410,119 @@ index 000000000..70480aa73 + gcry_mpi_release (cert->mpis[0]); + gcry_mpi_release (cert->mpis[1]); +} --- -2.41.0 - +diff --git a/grub-core/commands/appendedsig/appendedsig.h b/grub-core/commands/appendedsig/appendedsig.h +new file mode 100644 +index 00000000000..9792ef3901e +--- /dev/null ++++ b/grub-core/commands/appendedsig/appendedsig.h +@@ -0,0 +1,110 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 IBM Corporation. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++ ++extern asn1_node _gnutls_gnutls_asn; ++extern asn1_node _gnutls_pkix_asn; ++ ++#define MAX_OID_LEN 32 ++ ++/* ++ * One or more x509 certificates. ++ * ++ * We do limited parsing: extracting only the serial, CN and RSA public key. ++ */ ++struct x509_certificate ++{ ++ struct x509_certificate *next; ++ ++ grub_uint8_t *serial; ++ grub_size_t serial_len; ++ ++ char *subject; ++ grub_size_t subject_len; ++ ++ /* We only support RSA public keys. This encodes [modulus, publicExponent] */ ++ gcry_mpi_t mpis[2]; ++}; ++ ++/* ++ * A PKCS#7 signedData message. ++ * ++ * We make no attempt to match intelligently, so we don't save any info about ++ * the signer. We also support only 1 signerInfo, so we only store a single ++ * MPI for the signature. ++ */ ++struct pkcs7_signedData ++{ ++ const gcry_md_spec_t *hash; ++ gcry_mpi_t sig_mpi; ++}; ++ ++ ++/* Do libtasn1 init */ ++int asn1_init (void); ++ ++/* ++ * Import a DER-encoded certificate at 'data', of size 'size'. ++ * ++ * Place the results into 'results', which must be already allocated. ++ */ ++grub_err_t ++certificate_import (void *data, grub_size_t size, ++ struct x509_certificate *results); ++ ++/* ++ * Release all the storage associated with the x509 certificate. ++ * If the caller dynamically allocated the certificate, it must free it. ++ * The caller is also responsible for maintenance of the linked list. ++ */ ++void certificate_release (struct x509_certificate *cert); ++ ++/* ++ * Parse a PKCS#7 message, which must be a signedData message. ++ * ++ * The message must be in 'sigbuf' and of size 'data_size'. The result is ++ * placed in 'msg', which must already be allocated. ++ */ ++grub_err_t ++parse_pkcs7_signedData (void *sigbuf, grub_size_t data_size, ++ struct pkcs7_signedData *msg); ++ ++/* ++ * Release all the storage associated with the PKCS#7 message. ++ * If the caller dynamically allocated the message, it must free it. ++ */ ++void pkcs7_signedData_release (struct pkcs7_signedData *msg); ++ ++/* ++ * Read a value from an ASN1 node, allocating memory to store it. ++ * ++ * It will work for anything where the size libtasn1 returns is right: ++ * - Integers ++ * - Octet strings ++ * - DER encoding of other structures ++ * It will _not_ work for things where libtasn1 size requires adjustment: ++ * - Strings that require an extra NULL byte at the end ++ * - Bit strings because libtasn1 returns the length in bits, not bytes. ++ * ++ * If the function returns a non-NULL value, the caller must free it. ++ */ ++void *grub_asn1_allocate_and_read (asn1_node node, const char *name, ++ const char *friendly_name, ++ int *content_size); diff --git a/0146-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch b/0146-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch deleted file mode 100644 index 87db281..0000000 --- a/0146-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 62e1cca48c34491e9ec5209b6698c5df5a9602b1 Mon Sep 17 00:00:00 2001 -From: Wen Xiong -Date: Thu, 15 Dec 2022 21:33:41 -0500 -Subject: [PATCH 146/272] grub2: Set multiple device path for a nvmf boot - device - -nvmf support native multipath(ANA) by default. -The patch added the support for setting multiple -device path for a nvmf boot device. - -localhost:~ grub2-install -v /dev/nvme1n1p1 -... -... -... -grub2-install: info: executing nvsetenv boot-device /pci@800000020000132/fibre-channel@0,1/nvme-of/controller@5005076810193675,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec /pci@800000020000132/fibre-channel@0/nvme-of/controller@5005076810193675,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec /pci@800000020000132/fibre-channel@0/nvme-of/controller@50050768101935e5,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec /pci@800000020000132/fibre-channel@0,1/nvme-of/controller@50050768101935e5,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec. -Installation finished. No error reported. - -localhost:~ # bootlist -m normal -o -nvme7n1 -nvme5n1 -nvme1n1 -nvme4n1 - -localhost:~ # bootlist -m normal -r -/pci@800000020000132/fibre-channel@0,1/nvme-of/controller@5005076810193675,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec -/pci@800000020000132/fibre-channel@0/nvme-of/controller@5005076810193675,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec -/pci@800000020000132/fibre-channel@0/nvme-of/controller@50050768101935e5,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec -/pci@800000020000132/fibre-channel@0,1/nvme-of/controller@50050768101935e5,ffff:nqn=nqn.1986-03.com.ibm:nvme:2145.0000020420006CEA/namespace@ec - -Signed-off-by: Wen Xiong ---- - grub-core/osdep/linux/ofpath.c | 6 ++--- - grub-core/osdep/unix/platform.c | 48 +++++++++++++++++++++++++++++++++ - include/grub/util/install.h | 3 +++ - include/grub/util/ofpath.h | 9 +++++++ - 4 files changed, 63 insertions(+), 3 deletions(-) - -diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index 7d31cfd0f..7129099db 100644 ---- a/grub-core/osdep/linux/ofpath.c -+++ b/grub-core/osdep/linux/ofpath.c -@@ -209,7 +209,7 @@ find_obppath (const char *sysfs_path_orig) - } - } - --static char * -+char * - xrealpath (const char *in) - { - char *out; -@@ -224,7 +224,7 @@ xrealpath (const char *in) - return out; - } - --static char * -+char * - block_device_get_sysfs_path_and_link(const char *devicenode) - { - char *rpath; -@@ -535,7 +535,7 @@ of_path_get_nvme_nsid(const char* devname) - - } - --static char * -+char * - nvme_get_syspath(const char *nvmedev) - { - char *sysfs_path, *controller_node; -diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c -index 0a16ac293..004205786 100644 ---- a/grub-core/osdep/unix/platform.c -+++ b/grub-core/osdep/unix/platform.c -@@ -19,6 +19,7 @@ - #include - - #include -+#include - #include - #include - #include -@@ -131,6 +132,51 @@ grub_install_remove_efi_entries_by_distributor (const char *efi_distributor) - return rc; - } - -+char * -+build_multi_boot_device(const char *install_device) -+{ -+ char *sysfs_path; -+ char *nvme_ns; -+ unsigned int nsid; -+ char *ptr; -+ char *boot_device_string; -+ struct dirent *ep; -+ DIR *dp; -+ -+ nvme_ns = strchr(install_device, 'n'); -+ nsid = of_path_get_nvme_nsid(nvme_ns); -+ sysfs_path = nvme_get_syspath(nvme_ns); -+ strcat(sysfs_path, "/device"); -+ sysfs_path = xrealpath(sysfs_path); -+ -+ dp = opendir(sysfs_path); -+ ptr = boot_device_string = xmalloc (1000); -+ -+ /* We cannot have a boot list with more than five entries */ -+ while((ep = readdir(dp)) != NULL){ -+ char *nvme_device; -+ -+ if (grub_strstr(ep->d_name, "nvme")) { -+ nvme_device = xasprintf ("%s%s%x ", -+ get_ofpathname(ep->d_name),"/namespace@", nsid); -+ if ((strlen(boot_device_string) + strlen(nvme_device)) >= 200*5 - 1) { -+ grub_util_warn (_("More than five entries cannot be specified in the bootlist")); -+ free(nvme_device); -+ break; -+ } -+ -+ strncpy(ptr, nvme_device, strlen(nvme_device)); -+ ptr += strlen(nvme_device); -+ free(nvme_device); -+ } -+ } -+ -+ *--ptr = '\0'; -+ closedir(dp); -+ -+ return boot_device_string; -+} -+ - int - grub_install_register_efi (const grub_disk_t *efidir_grub_disk, - const char *efifile_path, -@@ -242,6 +288,8 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, - } - *ptr = '\0'; - } -+ else if (grub_strstr(install_device, "nvme")) -+ boot_device = build_multi_boot_device(install_device); - else - boot_device = get_ofpathname (install_device); - -diff --git a/include/grub/util/install.h b/include/grub/util/install.h -index fe11a0411..c33344dff 100644 ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -240,6 +240,9 @@ grub_install_register_efi (const grub_disk_t *efidir_grub_disk, - const char *efi_distributor, - const char *force_disk); - -+char * -+build_multi_boot_device(const char *install_device); -+ - void - grub_install_register_ieee1275 (int is_prep, const char *install_device, - int partno, const char *relpath); -diff --git a/include/grub/util/ofpath.h b/include/grub/util/ofpath.h -index a0ec30620..5b1f6a56d 100644 ---- a/include/grub/util/ofpath.h -+++ b/include/grub/util/ofpath.h -@@ -32,4 +32,13 @@ void find_file(char* filename, char* directory, struct ofpath_files_list_root* r - - char* of_find_fc_host(char* host_wwpn); - -+char* nvme_get_syspath(const char *nvmedev); -+ -+char* block_device_get_sysfs_path_and_link(const char *devicenode); -+ -+char* xrealpath (const char *in); -+ -+unsigned int of_path_get_nvme_nsid(const char* devname); -+ -+ - #endif /* ! GRUB_OFPATH_MACHINE_UTIL_HEADER */ --- -2.41.0 - diff --git a/0112-appended-signatures-support-verifying-appended-signa.patch b/0147-appended-signatures-support-verifying-appended-signa.patch similarity index 79% rename from 0112-appended-signatures-support-verifying-appended-signa.patch rename to 0147-appended-signatures-support-verifying-appended-signa.patch index 59bda44..0144264 100644 --- a/0112-appended-signatures-support-verifying-appended-signa.patch +++ b/0147-appended-signatures-support-verifying-appended-signa.patch @@ -1,8 +1,7 @@ -From 71187e53467f46da218d4c3d756cef437c34f7cd Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 30 Jul 2020 01:35:43 +1000 -Subject: [PATCH 112/272] appended signatures: support verifying appended - signatures +Subject: [PATCH] appended signatures: support verifying appended signatures Building on the parsers and the ability to embed x509 certificates, as well as the existing gcrypt functionality, add a module for verifying @@ -21,18 +20,20 @@ other mechanisms, such as a password or lockdown, must be used to ensure that a user cannot drop to the grub shell and disable verification. Signed-off-by: Daniel Axtens +[pjones: fix missing format specifier] +Signed-off-by: Robbie Harwood --- - grub-core/Makefile.core.def | 15 + - grub-core/commands/appendedsig/appendedsig.c | 669 +++++++++++++++++++ + grub-core/Makefile.core.def | 12 + + grub-core/commands/appendedsig/appendedsig.c | 645 +++++++++++++++++++++++++++ include/grub/file.h | 2 + - 3 files changed, 686 insertions(+) + 3 files changed, 659 insertions(+) create mode 100644 grub-core/commands/appendedsig/appendedsig.c diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index dcfbf9fdd..1a85327ca 100644 +index 0e65fefb195..ebe98551960 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -975,6 +975,21 @@ module = { +@@ -1009,6 +1009,18 @@ module = { cppflags = '-I$(srcdir)/lib/posix_wrap'; }; @@ -44,9 +45,6 @@ index dcfbf9fdd..1a85327ca 100644 + common = commands/appendedsig/asn1util.c; + common = commands/appendedsig/gnutls_asn1_tab.c; + common = commands/appendedsig/pkix_asn1_tab.c; -+ -+ extra_dist = commands/appendedsig/appendedsig.h; -+ // posix wrapper required for gcry to get sys/types.h + cflags = '$(CFLAGS_POSIX)'; + cppflags = '-I$(srcdir)/lib/posix_wrap'; +}; @@ -56,10 +54,10 @@ index dcfbf9fdd..1a85327ca 100644 common = commands/hdparm.c; diff --git a/grub-core/commands/appendedsig/appendedsig.c b/grub-core/commands/appendedsig/appendedsig.c new file mode 100644 -index 000000000..e63ad1ac6 +index 00000000000..1b8a8078061 --- /dev/null +++ b/grub-core/commands/appendedsig/appendedsig.c -@@ -0,0 +1,669 @@ +@@ -0,0 +1,645 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2020-2021 IBM Corporation. @@ -152,19 +150,15 @@ index 000000000..e63ad1ac6 + */ +extern gcry_pk_spec_t _gcry_pubkey_spec_rsa; + -+static enum -+{ check_sigs_no = 0, -+ check_sigs_enforce = 1, -+ check_sigs_forced = 2 -+} check_sigs = check_sigs_no; ++static int check_sigs = 0; + +static const char * -+grub_env_read_sec (struct grub_env_var *var __attribute__((unused)), -+ const char *val __attribute__((unused))) ++grub_env_read_sec (struct grub_env_var *var __attribute__ ((unused)), ++ const char *val __attribute__ ((unused))) +{ -+ if (check_sigs == check_sigs_forced) ++ if (check_sigs == 2) + return "forced"; -+ else if (check_sigs == check_sigs_enforce) ++ else if (check_sigs == 1) + return "enforce"; + else + return "no"; @@ -175,99 +169,71 @@ index 000000000..e63ad1ac6 + const char *val) +{ + /* Do not allow the value to be changed if set to forced */ -+ if (check_sigs == check_sigs_forced) ++ if (check_sigs == 2) + return grub_strdup ("forced"); + + if ((*val == '2') || (*val == 'f')) -+ check_sigs = check_sigs_forced; ++ check_sigs = 2; + else if ((*val == '1') || (*val == 'e')) -+ check_sigs = check_sigs_enforce; ++ check_sigs = 1; + else if ((*val == '0') || (*val == 'n')) -+ check_sigs = check_sigs_no; ++ check_sigs = 0; + + return grub_strdup (grub_env_read_sec (NULL, NULL)); +} + +static grub_err_t -+file_read_all (grub_file_t file, grub_uint8_t **buf, grub_size_t *len) ++read_cert_from_file (grub_file_t f, struct x509_certificate *certificate) +{ -+ grub_off_t full_file_size; -+ grub_size_t file_size, total_read_size = 0; ++ grub_err_t err; ++ grub_uint8_t *buf = NULL; + grub_ssize_t read_size; ++ grub_off_t total_read_size = 0; ++ grub_off_t file_size = grub_file_size (f); + -+ full_file_size = grub_file_size (file); -+ if (full_file_size == GRUB_FILE_SIZE_UNKNOWN) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Cannot read a file of unknown size into a buffer")); -+ -+ if (full_file_size > GRUB_SIZE_MAX) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, -+ N_("File is too large to read: %" PRIuGRUB_UINT64_T -+ " bytes"), full_file_size); + -+ file_size = (grub_size_t) full_file_size; ++ if (file_size == GRUB_FILE_SIZE_UNKNOWN) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, ++ N_("Cannot parse a certificate file of unknown size")); + -+ *buf = grub_malloc (file_size); -+ if (!*buf) ++ buf = grub_zalloc (file_size); ++ if (!buf) + return grub_error (GRUB_ERR_OUT_OF_MEMORY, -+ N_("Could not allocate file data buffer size %" -+ PRIuGRUB_SIZE), file_size); ++ N_("Could not allocate buffer for certificate file contents")); + + while (total_read_size < file_size) + { + read_size = -+ grub_file_read (file, *buf + total_read_size, ++ grub_file_read (f, &buf[total_read_size], + file_size - total_read_size); -+ + if (read_size < 0) + { -+ grub_free (*buf); -+ return grub_errno; -+ } -+ else if (read_size == 0) -+ { -+ grub_free (*buf); -+ return grub_error (GRUB_ERR_IO, -+ N_("Could not read full file size (%" -+ PRIuGRUB_SIZE "), only %" PRIuGRUB_SIZE -+ " bytes read"), file_size, total_read_size); ++ err = grub_error (GRUB_ERR_READ_ERROR, ++ N_("Error reading certificate file")); ++ goto cleanup_buf; + } -+ + total_read_size += read_size; + } -+ *len = file_size; -+ return GRUB_ERR_NONE; -+} + -+static grub_err_t -+read_cert_from_file (grub_file_t f, struct x509_certificate *certificate) -+{ -+ grub_err_t err; -+ grub_uint8_t *buf; -+ grub_size_t file_size; -+ -+ err = file_read_all (f, &buf, &file_size); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ err = parse_x509_certificate (buf, file_size, certificate); ++ err = certificate_import (buf, total_read_size, certificate); + if (err != GRUB_ERR_NONE) -+ { -+ grub_free (buf); -+ return err; -+ } ++ goto cleanup_buf; + + return GRUB_ERR_NONE; ++ ++cleanup_buf: ++ grub_free (buf); ++ return err; +} + +static grub_err_t -+extract_appended_signature (const grub_uint8_t *buf, grub_size_t bufsize, ++extract_appended_signature (grub_uint8_t * buf, grub_size_t bufsize, + struct grub_appended_signature *sig) +{ + grub_err_t err; + grub_size_t pkcs7_size; + grub_size_t remaining_len; -+ const grub_uint8_t *appsigdata = buf + bufsize - grub_strlen (magic); ++ grub_uint8_t *appsigdata = buf + bufsize - grub_strlen (magic); + + if (bufsize < grub_strlen (magic)) + return grub_error (GRUB_ERR_BAD_SIGNATURE, @@ -294,7 +260,11 @@ index 000000000..e63ad1ac6 + if (sig->sig_metadata.id_type != 2) + return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("Wrong signature type")); + -+ pkcs7_size = grub_be_to_cpu32 (sig->sig_metadata.sig_len); ++#ifdef GRUB_TARGET_WORDS_BIGENDIAN ++ pkcs7_size = sig->sig_metadata.sig_len; ++#else ++ pkcs7_size = __builtin_bswap32 (sig->sig_metadata.sig_len); ++#endif + + if (pkcs7_size > remaining_len) + return grub_error (GRUB_ERR_BAD_SIGNATURE, @@ -316,7 +286,7 @@ index 000000000..e63ad1ac6 +} + +static grub_err_t -+grub_verify_appended_signature (const grub_uint8_t *buf, grub_size_t bufsize) ++grub_verify_appended_signature (grub_uint8_t * buf, grub_size_t bufsize) +{ + grub_err_t err = GRUB_ERR_NONE; + grub_size_t datasize; @@ -326,8 +296,6 @@ index 000000000..e63ad1ac6 + gcry_err_code_t rc; + struct x509_certificate *pk; + struct grub_appended_signature sig; -+ struct pkcs7_signerInfo *si; -+ int i; + + if (!grub_trusted_key) + return grub_error (GRUB_ERR_BAD_SIGNATURE, @@ -339,70 +307,53 @@ index 000000000..e63ad1ac6 + + datasize = bufsize - sig.signature_len; + -+ for (i = 0; i < sig.pkcs7.signerInfo_count; i++) ++ context = grub_zalloc (sig.pkcs7.hash->contextsize); ++ if (!context) ++ return grub_errno; ++ ++ sig.pkcs7.hash->init (context); ++ sig.pkcs7.hash->write (context, buf, datasize); ++ sig.pkcs7.hash->final (context); ++ hash = sig.pkcs7.hash->read (context); ++ grub_dprintf ("appendedsig", ++ "data size %" PRIxGRUB_SIZE ", hash %02x%02x%02x%02x...\n", ++ datasize, hash[0], hash[1], hash[2], hash[3]); ++ ++ err = GRUB_ERR_BAD_SIGNATURE; ++ for (pk = grub_trusted_key; pk; pk = pk->next) + { -+ /* This could be optimised in a couple of ways: -+ - we could only compute hashes once per hash type -+ - we could track signer information and only verify where IDs match -+ For now we do the naive O(trusted keys * pkcs7 signers) approach. -+ */ -+ si = &sig.pkcs7.signerInfos[i]; -+ context = grub_zalloc (si->hash->contextsize); -+ if (!context) -+ return grub_errno; -+ -+ si->hash->init (context); -+ si->hash->write (context, buf, datasize); -+ si->hash->final (context); -+ hash = si->hash->read (context); -+ -+ grub_dprintf ("appendedsig", -+ "data size %" PRIxGRUB_SIZE ", signer %d hash %02x%02x%02x%02x...\n", -+ datasize, i, hash[0], hash[1], hash[2], hash[3]); -+ -+ err = GRUB_ERR_BAD_SIGNATURE; -+ for (pk = grub_trusted_key; pk; pk = pk->next) ++ rc = grub_crypto_rsa_pad (&hashmpi, hash, sig.pkcs7.hash, pk->mpis[0]); ++ if (rc) + { -+ rc = grub_crypto_rsa_pad (&hashmpi, hash, si->hash, pk->mpis[0]); -+ if (rc) -+ { -+ err = grub_error (GRUB_ERR_BAD_SIGNATURE, -+ N_("Error padding hash for RSA verification: %d"), -+ rc); -+ grub_free (context); -+ goto cleanup; -+ } -+ -+ rc = _gcry_pubkey_spec_rsa.verify (0, hashmpi, &si->sig_mpi, -+ pk->mpis, NULL, NULL); -+ gcry_mpi_release (hashmpi); -+ -+ if (rc == 0) -+ { -+ grub_dprintf ("appendedsig", -+ "verify signer %d with key '%s' succeeded\n", i, -+ pk->subject); -+ err = GRUB_ERR_NONE; -+ break; -+ } -+ -+ grub_dprintf ("appendedsig", -+ "verify signer %d with key '%s' failed with %d\n", i, -+ pk->subject, rc); ++ err = grub_error (GRUB_ERR_BAD_SIGNATURE, ++ N_("Error padding hash for RSA verification: %d"), ++ rc); ++ goto cleanup; + } + -+ grub_free (context); ++ rc = _gcry_pubkey_spec_rsa.verify (0, hashmpi, &sig.pkcs7.sig_mpi, ++ pk->mpis, NULL, NULL); ++ gcry_mpi_release (hashmpi); ++ ++ if (rc == 0) ++ { ++ grub_dprintf ("appendedsig", "verify with key '%s' succeeded\n", ++ pk->subject); ++ err = GRUB_ERR_NONE; ++ break; ++ } + -+ if (err == GRUB_ERR_NONE) -+ break; ++ grub_dprintf ("appendedsig", "verify with key '%s' failed with %d\n", ++ pk->subject, rc); + } + + /* If we didn't verify, provide a neat message */ + if (err != GRUB_ERR_NONE) -+ err = grub_error (GRUB_ERR_BAD_SIGNATURE, -+ N_("Failed to verify signature against a trusted key")); ++ err = grub_error (GRUB_ERR_BAD_SIGNATURE, ++ N_("Failed to verify signature against a trusted key")); + +cleanup: ++ grub_free (context); + pkcs7_signedData_release (&sig.pkcs7); + + return err; @@ -415,7 +366,8 @@ index 000000000..e63ad1ac6 + grub_file_t f; + grub_err_t err = GRUB_ERR_NONE; + grub_uint8_t *data; -+ grub_size_t file_size; ++ grub_ssize_t read_size; ++ grub_off_t file_size, total_read_size = 0; + + if (argc < 1) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected")); @@ -429,14 +381,35 @@ index 000000000..e63ad1ac6 + goto cleanup; + } + -+ err = file_read_all (f, &data, &file_size); -+ if (err != GRUB_ERR_NONE) -+ goto cleanup; ++ file_size = grub_file_size (f); ++ if (file_size == GRUB_FILE_SIZE_UNKNOWN) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, ++ N_("Cannot verify the signature of a file of unknown size")); ++ ++ data = grub_malloc (file_size); ++ if (!data) ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, ++ N_("Could not allocate data buffer size %" ++ PRIuGRUB_UINT64_T " for verification"), file_size); ++ ++ while (total_read_size < file_size) ++ { ++ read_size = ++ grub_file_read (f, &data[total_read_size], ++ file_size - total_read_size); ++ if (read_size < 0) ++ { ++ err = grub_error (GRUB_ERR_READ_ERROR, ++ N_("Error reading file to verify")); ++ goto cleanup_data; ++ } ++ total_read_size += read_size; ++ } + + err = grub_verify_appended_signature (data, file_size); + ++cleanup_data: + grub_free (data); -+ +cleanup: + if (f) + grub_file_close (f); @@ -566,7 +539,7 @@ index 000000000..e63ad1ac6 + void **context __attribute__((unused)), + enum grub_verify_flags *flags) +{ -+ if (check_sigs == check_sigs_no) ++ if (!check_sigs) + { + *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION; + return GRUB_ERR_NONE; @@ -648,12 +621,13 @@ index 000000000..e63ad1ac6 + + /* If in lockdown, immediately enter forced mode */ + if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED) -+ check_sigs = check_sigs_forced; ++ check_sigs = 2; + + grub_trusted_key = NULL; + + grub_register_variable_hook ("check_appended_signatures", -+ grub_env_read_sec, grub_env_write_sec); ++ grub_env_read_sec, ++ grub_env_write_sec); + grub_env_export ("check_appended_signatures"); + + rc = asn1_init (); @@ -730,7 +704,7 @@ index 000000000..e63ad1ac6 + grub_unregister_command (cmd_distrust); +} diff --git a/include/grub/file.h b/include/grub/file.h -index a5bf3a792..d678de063 100644 +index a5bf3a792d6..d678de06325 100644 --- a/include/grub/file.h +++ b/include/grub/file.h @@ -80,6 +80,8 @@ enum grub_file_type @@ -742,6 +716,3 @@ index a5bf3a792..d678de063 100644 /* File of which we intend to print a blocklist to the user. */ GRUB_FILE_TYPE_PRINT_BLOCKLIST, /* File we intend to use for test loading or testing speed. */ --- -2.41.0 - diff --git a/0147-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch b/0147-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch deleted file mode 100644 index c7f0dfb..0000000 --- a/0147-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 438bb3d340d145608787af07c2db393bb1f0f36d Mon Sep 17 00:00:00 2001 -From: Wen Xiong -Date: Tue, 7 Feb 2023 15:10:15 -0500 -Subject: [PATCH 147/272] grub2: Can't setup a default boot device correctly on - nvme device in Beta3 - -The patch in Bug 200486 - SUSE1205666 - SLES15SP5 Beta1: Setup multiple dev path - for a nvmf boot device in grub2 caused the issue. That patch didn't consider -nvme devices carefully. - -The new patch will check "nvme-of" instead of "nvme" to call -build_multi_boot_device(). - -Signed-off-by: Wen Xiong ---- - grub-core/osdep/unix/platform.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c -index 004205786..e4ef0b8be 100644 ---- a/grub-core/osdep/unix/platform.c -+++ b/grub-core/osdep/unix/platform.c -@@ -288,11 +288,15 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, - } - *ptr = '\0'; - } -- else if (grub_strstr(install_device, "nvme")) -- boot_device = build_multi_boot_device(install_device); -- else -+ else { - boot_device = get_ofpathname (install_device); - -+ if (grub_strstr(boot_device, "nvme-of")) { -+ free (boot_device); -+ boot_device = build_multi_boot_device(install_device); -+ } -+ } -+ - if (grub_util_exec ((const char * []){ "nvsetenv", "boot-device", - boot_device, NULL })) - { --- -2.41.0 - diff --git a/0148-appended-signatures-verification-tests.patch b/0148-appended-signatures-verification-tests.patch new file mode 100644 index 0000000..7c4ae86 --- /dev/null +++ b/0148-appended-signatures-verification-tests.patch @@ -0,0 +1,897 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Thu, 30 Jul 2020 01:31:02 +1000 +Subject: [PATCH] appended signatures: verification tests + +These tests are run through all_functional_test and test a range +of commands and behaviours. + +Signed-off-by: Daniel Axtens +--- + grub-core/Makefile.core.def | 6 + + grub-core/tests/appended_signature_test.c | 281 +++++++++++++++ + grub-core/tests/lib/functional_test.c | 1 + + grub-core/tests/appended_signatures.h | 557 ++++++++++++++++++++++++++++++ + 4 files changed, 845 insertions(+) + create mode 100644 grub-core/tests/appended_signature_test.c + create mode 100644 grub-core/tests/appended_signatures.h + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index ebe98551960..c81c9107249 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -2211,6 +2211,12 @@ module = { + common = tests/setjmp_test.c; + }; + ++module = { ++ name = appended_signature_test; ++ common = tests/appended_signature_test.c; ++ common = tests/appended_signatures.h; ++}; ++ + module = { + name = signature_test; + common = tests/signature_test.c; +diff --git a/grub-core/tests/appended_signature_test.c b/grub-core/tests/appended_signature_test.c +new file mode 100644 +index 00000000000..88a485200d8 +--- /dev/null ++++ b/grub-core/tests/appended_signature_test.c +@@ -0,0 +1,281 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 IBM Corporation. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "appended_signatures.h" ++ ++GRUB_MOD_LICENSE ("GPLv3+"); ++ ++#define DEFINE_TEST_CASE(case_name) \ ++static char * \ ++get_ ## case_name (grub_size_t *sz) \ ++{ \ ++ char *ret; \ ++ *sz = case_name ## _len; \ ++ ret = grub_malloc (*sz); \ ++ if (ret) \ ++ grub_memcpy (ret, case_name, *sz); \ ++ return ret; \ ++} \ ++\ ++static struct grub_procfs_entry case_name ## _entry = \ ++{ \ ++ .name = #case_name, \ ++ .get_contents = get_ ## case_name \ ++} ++ ++#define DO_TEST(case_name, is_valid) \ ++{ \ ++ grub_procfs_register (#case_name, &case_name ## _entry); \ ++ do_verify ("(proc)/" #case_name, is_valid); \ ++ grub_procfs_unregister (&case_name ## _entry); \ ++} ++ ++ ++DEFINE_TEST_CASE (hi_signed); ++DEFINE_TEST_CASE (hi_signed_sha256); ++DEFINE_TEST_CASE (hj_signed); ++DEFINE_TEST_CASE (short_msg); ++DEFINE_TEST_CASE (unsigned_msg); ++DEFINE_TEST_CASE (hi_signed_2nd); ++ ++static char * ++get_certificate_der (grub_size_t * sz) ++{ ++ char *ret; ++ *sz = certificate_der_len; ++ ret = grub_malloc (*sz); ++ if (ret) ++ grub_memcpy (ret, certificate_der, *sz); ++ return ret; ++} ++ ++static struct grub_procfs_entry certificate_der_entry = { ++ .name = "certificate.der", ++ .get_contents = get_certificate_der ++}; ++ ++static char * ++get_certificate2_der (grub_size_t * sz) ++{ ++ char *ret; ++ *sz = certificate2_der_len; ++ ret = grub_malloc (*sz); ++ if (ret) ++ grub_memcpy (ret, certificate2_der, *sz); ++ return ret; ++} ++ ++static struct grub_procfs_entry certificate2_der_entry = { ++ .name = "certificate2.der", ++ .get_contents = get_certificate2_der ++}; ++ ++static char * ++get_certificate_printable_der (grub_size_t * sz) ++{ ++ char *ret; ++ *sz = certificate_printable_der_len; ++ ret = grub_malloc (*sz); ++ if (ret) ++ grub_memcpy (ret, certificate_printable_der, *sz); ++ return ret; ++} ++ ++static struct grub_procfs_entry certificate_printable_der_entry = { ++ .name = "certificate_printable.der", ++ .get_contents = get_certificate_printable_der ++}; ++ ++ ++static void ++do_verify (const char *f, int is_valid) ++{ ++ grub_command_t cmd; ++ char *args[] = { (char *) f, NULL }; ++ grub_err_t err; ++ ++ cmd = grub_command_find ("verify_appended"); ++ if (!cmd) ++ { ++ grub_test_assert (0, "can't find command `%s'", "verify_appended"); ++ return; ++ } ++ err = (cmd->func) (cmd, 1, args); ++ if (is_valid) ++ { ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "verification of %s failed: %d: %s", f, grub_errno, ++ grub_errmsg); ++ } ++ else ++ { ++ grub_test_assert (err == GRUB_ERR_BAD_SIGNATURE, ++ "verification of %s unexpectedly succeeded", f); ++ } ++ grub_errno = GRUB_ERR_NONE; ++ ++} ++ ++static void ++appended_signature_test (void) ++{ ++ grub_command_t cmd_trust, cmd_distrust; ++ char *trust_args[] = { (char *) "(proc)/certificate.der", NULL }; ++ char *trust_args2[] = { (char *) "(proc)/certificate2.der", NULL }; ++ char *trust_args_printable[] = { (char *) "(proc)/certificate_printable.der", ++ NULL }; ++ char *distrust_args[] = { (char *) "1", NULL }; ++ char *distrust2_args[] = { (char *) "2", NULL }; ++ grub_err_t err; ++ ++ grub_procfs_register ("certificate.der", &certificate_der_entry); ++ grub_procfs_register ("certificate2.der", &certificate2_der_entry); ++ grub_procfs_register ("certificate_printable.der", ++ &certificate_printable_der_entry); ++ ++ cmd_trust = grub_command_find ("trust_certificate"); ++ if (!cmd_trust) ++ { ++ grub_test_assert (0, "can't find command `%s'", "trust_certificate"); ++ return; ++ } ++ err = (cmd_trust->func) (cmd_trust, 1, trust_args); ++ ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "loading certificate failed: %d: %s", grub_errno, ++ grub_errmsg); ++ ++ /* If we have no certificate the remainder of the tests are meaningless */ ++ if (err != GRUB_ERR_NONE) ++ return; ++ ++ /* ++ * Reload the command: this works around some 'interesting' behaviour in the ++ * dynamic command dispatcher. The first time you call cmd->func you get a ++ * dispatcher that loads the module, finds the real cmd, calls it, and then ++ * releases some internal storage. This means it's not safe to call a second ++ * time and we need to reload it. ++ */ ++ cmd_trust = grub_command_find ("trust_certificate"); ++ ++ DO_TEST (hi_signed, 1); ++ DO_TEST (hi_signed_sha256, 1); ++ DO_TEST (hj_signed, 0); ++ DO_TEST (short_msg, 0); ++ DO_TEST (unsigned_msg, 0); ++ ++ /* ++ * in enforcing mode, we shouldn't be able to load a certificate that isn't ++ * signed by an existing trusted key. ++ * ++ * However, procfs files automatically skip the verification test, so we can't ++ * easily test this. ++ */ ++ ++ /* ++ * verify that testing with 2 trusted certs works ++ */ ++ DO_TEST (hi_signed_2nd, 0); ++ ++ err = (cmd_trust->func) (cmd_trust, 1, trust_args2); ++ ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "loading certificate 2 failed: %d: %s", grub_errno, ++ grub_errmsg); ++ ++ if (err != GRUB_ERR_NONE) ++ return; ++ ++ DO_TEST (hi_signed_2nd, 1); ++ DO_TEST (hi_signed, 1); ++ ++ /* ++ * Check certificate removal. They're added to the _top_ of the list and ++ * removed by position in the list. Current the list looks like [#2, #1]. ++ * ++ * First test removing the second certificate in the list, which is ++ * certificate #1, giving us just [#2]. ++ */ ++ cmd_distrust = grub_command_find ("distrust_certificate"); ++ if (!cmd_distrust) ++ { ++ grub_test_assert (0, "can't find command `%s'", "distrust_certificate"); ++ return; ++ } ++ ++ err = (cmd_distrust->func) (cmd_distrust, 1, distrust2_args); ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "distrusting certificate 1 failed: %d: %s", grub_errno, ++ grub_errmsg); ++ DO_TEST (hi_signed_2nd, 1); ++ DO_TEST (hi_signed, 0); ++ ++ /* ++ * Now reload certificate #1. This will make the list look like [#1, #2] ++ */ ++ err = (cmd_trust->func) (cmd_trust, 1, trust_args); ++ ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "reloading certificate 1 failed: %d: %s", grub_errno, ++ grub_errmsg); ++ DO_TEST (hi_signed, 1); ++ ++ /* Remove the first certificate in the list, giving us just [#2] */ ++ err = (cmd_distrust->func) (cmd_distrust, 1, distrust_args); ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "distrusting certificate 1 (first time) failed: %d: %s", ++ grub_errno, grub_errmsg); ++ DO_TEST (hi_signed_2nd, 1); ++ DO_TEST (hi_signed, 0); ++ ++ /* ++ * Remove the first certificate again, giving an empty list. ++ * ++ * verify_appended should fail if there are no certificates to verify against. ++ */ ++ err = (cmd_distrust->func) (cmd_distrust, 1, distrust_args); ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "distrusting certificate 1 (second time) failed: %d: %s", ++ grub_errno, grub_errmsg); ++ DO_TEST (hi_signed_2nd, 0); ++ ++ /* ++ * Lastly, check a certificate that uses printableString rather than ++ * utf8String loads properly. ++ */ ++ err = (cmd_trust->func) (cmd_trust, 1, trust_args_printable); ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "distrusting printable certificate failed: %d: %s", ++ grub_errno, grub_errmsg); ++ ++ grub_procfs_unregister (&certificate_der_entry); ++ grub_procfs_unregister (&certificate2_der_entry); ++ grub_procfs_unregister (&certificate_printable_der_entry); ++} ++ ++GRUB_FUNCTIONAL_TEST (appended_signature_test, appended_signature_test); +diff --git a/grub-core/tests/lib/functional_test.c b/grub-core/tests/lib/functional_test.c +index 96781fb39b5..403fa5c789a 100644 +--- a/grub-core/tests/lib/functional_test.c ++++ b/grub-core/tests/lib/functional_test.c +@@ -73,6 +73,7 @@ grub_functional_all_tests (grub_extcmd_context_t ctxt __attribute__ ((unused)), + grub_dl_load ("xnu_uuid_test"); + grub_dl_load ("pbkdf2_test"); + grub_dl_load ("signature_test"); ++ grub_dl_load ("appended_signature_test"); + grub_dl_load ("sleep_test"); + grub_dl_load ("bswap_test"); + grub_dl_load ("ctz_test"); +diff --git a/grub-core/tests/appended_signatures.h b/grub-core/tests/appended_signatures.h +new file mode 100644 +index 00000000000..aa3dc6278e3 +--- /dev/null ++++ b/grub-core/tests/appended_signatures.h +@@ -0,0 +1,557 @@ ++unsigned char certificate_der[] = { ++ 0x30, 0x82, 0x03, 0x88, 0x30, 0x82, 0x02, 0x70, 0xa0, 0x03, 0x02, 0x01, ++ 0x02, 0x02, 0x14, 0x25, 0x2e, 0xb8, 0xfd, 0x12, 0x62, 0x2e, 0xcd, 0x5d, ++ 0xa7, 0x53, 0xd2, 0x0b, 0xc2, 0x61, 0x7c, 0x14, 0xe0, 0x0f, 0x5c, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, ++ 0x05, 0x00, 0x30, 0x49, 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, 0x04, ++ 0x03, 0x0c, 0x1f, 0x47, 0x72, 0x75, 0x62, 0x20, 0x41, 0x70, 0x70, 0x65, ++ 0x6e, 0x64, 0x65, 0x64, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, ++ 0x72, 0x65, 0x20, 0x54, 0x65, 0x73, 0x74, 0x20, 0x43, 0x41, 0x31, 0x1d, ++ 0x30, 0x1b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, ++ 0x01, 0x16, 0x0e, 0x64, 0x6a, 0x61, 0x40, 0x61, 0x78, 0x74, 0x65, 0x6e, ++ 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x30, 0x30, ++ 0x37, 0x30, 0x39, 0x30, 0x36, 0x32, 0x32, 0x30, 0x37, 0x5a, 0x18, 0x0f, ++ 0x32, 0x31, 0x32, 0x30, 0x30, 0x36, 0x31, 0x35, 0x30, 0x36, 0x32, 0x32, ++ 0x30, 0x37, 0x5a, 0x30, 0x52, 0x31, 0x31, 0x30, 0x2f, 0x06, 0x03, 0x55, ++ 0x04, 0x03, 0x0c, 0x28, 0x47, 0x72, 0x75, 0x62, 0x20, 0x41, 0x70, 0x70, ++ 0x65, 0x6e, 0x64, 0x65, 0x64, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, ++ 0x75, 0x72, 0x65, 0x20, 0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x69, 0x67, ++ 0x6e, 0x69, 0x6e, 0x67, 0x20, 0x4b, 0x65, 0x79, 0x31, 0x1d, 0x30, 0x1b, ++ 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, ++ 0x0e, 0x64, 0x6a, 0x61, 0x40, 0x61, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x2e, ++ 0x6e, 0x65, 0x74, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, ++ 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, ++ 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, ++ 0xcd, 0xe8, 0x1c, 0x08, 0x68, 0x2e, 0xcb, 0xfe, 0x8c, 0x4b, 0x3b, 0x61, ++ 0xe7, 0x8e, 0x80, 0x58, 0x85, 0x85, 0xea, 0xc8, 0x3b, 0x42, 0xba, 0x72, ++ 0x84, 0x65, 0x20, 0xbc, 0x48, 0xa2, 0x25, 0x49, 0x6e, 0x1c, 0xb9, 0x7d, ++ 0xeb, 0xc1, 0x0c, 0xa8, 0xb7, 0xcc, 0x13, 0x78, 0xba, 0x11, 0xa4, 0x98, ++ 0xd7, 0xd0, 0x7c, 0xdd, 0xf5, 0x5a, 0xb7, 0xcd, 0x31, 0x0e, 0xcd, 0x9e, ++ 0xa7, 0x19, 0xf0, 0xbd, 0x0f, 0xa6, 0xfe, 0x8a, 0x11, 0x97, 0xed, 0x8b, ++ 0xe5, 0x16, 0xa6, 0x21, 0x13, 0x36, 0xad, 0x05, 0x49, 0xec, 0x29, 0x12, ++ 0x38, 0xa7, 0x4b, 0x0f, 0xa1, 0xfb, 0x72, 0xc0, 0xc0, 0x09, 0x67, 0x78, ++ 0xa8, 0xb6, 0xd6, 0x1a, 0x39, 0xc0, 0xa8, 0xbf, 0x5f, 0x14, 0x89, 0x5c, ++ 0xbc, 0x41, 0x0c, 0x0c, 0x5d, 0x42, 0x2e, 0x1c, 0xdf, 0x1f, 0x1d, 0xc9, ++ 0x43, 0x94, 0x5b, 0x6e, 0x8f, 0x15, 0x8c, 0x8f, 0x94, 0x73, 0x4f, 0x97, ++ 0x54, 0xf1, 0x86, 0x8a, 0xbc, 0xe4, 0xe4, 0x93, 0xc1, 0x5e, 0xc2, 0x3e, ++ 0x31, 0x5e, 0xd4, 0x85, 0x57, 0x14, 0xd0, 0x11, 0x07, 0x65, 0xf4, 0x7c, ++ 0x8f, 0x07, 0x57, 0xe1, 0x22, 0xd4, 0x78, 0x47, 0x65, 0x4e, 0xa9, 0xb3, ++ 0xaa, 0xce, 0xc7, 0x36, 0xfe, 0xda, 0x66, 0x02, 0xb6, 0x8d, 0x18, 0x2f, ++ 0x3b, 0x41, 0x8d, 0x02, 0x08, 0x72, 0x4b, 0x69, 0xbd, 0x1e, 0x58, 0xfc, ++ 0x1b, 0x64, 0x04, 0x52, 0x35, 0x35, 0xe2, 0x3d, 0x3e, 0xde, 0xd6, 0x64, ++ 0xf4, 0xec, 0x57, 0x7e, 0x65, 0x59, 0x00, 0xa6, 0xd3, 0x4b, 0x09, 0x93, ++ 0x2a, 0x95, 0x0f, 0x30, 0xb6, 0xa1, 0x8c, 0xe7, 0x8b, 0x49, 0xa4, 0x1d, ++ 0x25, 0x2d, 0x65, 0x48, 0x8a, 0x0f, 0xcf, 0x2a, 0xa2, 0xe1, 0xef, 0x72, ++ 0x92, 0xc3, 0xf5, 0x21, 0x37, 0x83, 0x9b, 0x6d, 0x0b, 0x1b, 0xb3, 0xa2, ++ 0x32, 0x38, 0x11, 0xb1, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x5d, 0x30, ++ 0x5b, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, ++ 0x02, 0x30, 0x00, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, ++ 0x03, 0x02, 0x07, 0x80, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, ++ 0x16, 0x04, 0x14, 0xe5, 0x2a, 0x4f, 0xf2, 0x84, 0x91, 0x57, 0x91, 0xaf, ++ 0x12, 0xd2, 0xf1, 0xa1, 0x87, 0x73, 0x0f, 0x90, 0x25, 0xa0, 0x7a, 0x30, ++ 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, ++ 0x56, 0xd1, 0xfd, 0xe2, 0x1e, 0x7e, 0x1c, 0x63, 0x4f, 0x47, 0xdb, 0xe4, ++ 0xc4, 0x51, 0x04, 0x03, 0x9a, 0x48, 0x35, 0x6e, 0x30, 0x0d, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, ++ 0x82, 0x01, 0x01, 0x00, 0x65, 0x82, 0xd5, 0x88, 0x30, 0xe2, 0x2c, 0x47, ++ 0xf3, 0x31, 0x39, 0xa1, 0x75, 0x9a, 0xb0, 0x8a, 0x6c, 0x4b, 0xac, 0xdf, ++ 0x09, 0x7b, 0x90, 0xb6, 0x9e, 0x76, 0x62, 0x94, 0xc1, 0x3a, 0x99, 0x49, ++ 0x68, 0x29, 0x47, 0x42, 0xc3, 0x06, 0xcb, 0x88, 0x75, 0xe6, 0x79, 0x13, ++ 0x8c, 0x4b, 0x49, 0x6a, 0xb5, 0x56, 0x95, 0xc0, 0x42, 0x21, 0x9b, 0xd4, ++ 0x61, 0xd0, 0x02, 0x41, 0xdd, 0x20, 0x61, 0xe5, 0x91, 0xdf, 0x75, 0x00, ++ 0x25, 0x0e, 0x99, 0x65, 0x5c, 0x54, 0x49, 0x32, 0xa3, 0xe2, 0xcd, 0xa1, ++ 0x5f, 0x40, 0xf3, 0xc5, 0x81, 0xd9, 0x3c, 0xa3, 0x63, 0x5a, 0x38, 0x79, ++ 0xab, 0x77, 0x98, 0xde, 0x8f, 0x4e, 0x9e, 0x26, 0xbc, 0x4e, 0x80, 0x9e, ++ 0x8f, 0xbe, 0xf1, 0x00, 0xb3, 0x78, 0xb9, 0x4b, 0x1d, 0xc7, 0xa4, 0x83, ++ 0x59, 0x56, 0x11, 0xd1, 0x11, 0x1e, 0x50, 0x39, 0xd5, 0x78, 0x14, 0xf3, ++ 0xb9, 0x1d, 0xda, 0xe4, 0xc4, 0x63, 0x74, 0x26, 0xab, 0xa3, 0xfd, 0x9d, ++ 0x58, 0xa2, 0xee, 0x7b, 0x28, 0x34, 0xa3, 0xbe, 0x85, 0x7e, 0xaa, 0x97, ++ 0xb7, 0x5b, 0x9d, 0xa9, 0x4d, 0x96, 0xdb, 0x6b, 0x21, 0xe1, 0x96, 0x5d, ++ 0xc7, 0xad, 0x23, 0x03, 0x9a, 0x16, 0xdb, 0xa4, 0x1f, 0x63, 0xef, 0xaf, ++ 0x1e, 0x4f, 0xf8, 0x27, 0xdc, 0x4b, 0xfc, 0x2b, 0x68, 0x2e, 0xa0, 0xd3, ++ 0xae, 0xf2, 0xce, 0xf5, 0xfc, 0x97, 0x92, 0xd2, 0x29, 0x0f, 0x4f, 0x4b, ++ 0x29, 0xeb, 0x06, 0xcb, 0xf8, 0x21, 0x6e, 0xbc, 0x8b, 0x5c, 0xc5, 0xc9, ++ 0xf7, 0xe2, 0x7c, 0x47, 0xcd, 0x43, 0x98, 0xc4, 0xa3, 0x9a, 0xd7, 0x3e, ++ 0xdc, 0x01, 0x13, 0x28, 0x96, 0xc4, 0x60, 0x83, 0xe2, 0x79, 0xa1, 0x46, ++ 0xef, 0xf5, 0xa4, 0x7b, 0x00, 0xe3, 0x3d, 0x7d, 0xbc, 0xa8, 0x98, 0x49, ++ 0xa8, 0xcf, 0x3b, 0x41, 0xb6, 0x09, 0x97, 0x07 ++}; ++unsigned int certificate_der_len = 908; ++ ++unsigned char hi_signed[] = { ++ 0x68, 0x69, 0x0a, 0x30, 0x82, 0x01, 0xc0, 0x06, 0x09, 0x2a, 0x86, 0x48, ++ 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x01, 0xb1, 0x30, 0x82, ++ 0x01, 0xad, 0x02, 0x01, 0x01, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, ++ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x30, 0x0b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0x31, 0x82, 0x01, ++ 0x8a, 0x30, 0x82, 0x01, 0x86, 0x02, 0x01, 0x01, 0x30, 0x61, 0x30, 0x49, ++ 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x1f, 0x47, ++ 0x72, 0x75, 0x62, 0x20, 0x41, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x64, ++ 0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x54, ++ 0x65, 0x73, 0x74, 0x20, 0x43, 0x41, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0e, 0x64, ++ 0x6a, 0x61, 0x40, 0x61, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x2e, 0x6e, 0x65, ++ 0x74, 0x02, 0x14, 0x25, 0x2e, 0xb8, 0xfd, 0x12, 0x62, 0x2e, 0xcd, 0x5d, ++ 0xa7, 0x53, 0xd2, 0x0b, 0xc2, 0x61, 0x7c, 0x14, 0xe0, 0x0f, 0x5c, 0x30, ++ 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x01, 0x05, 0x00, 0x04, 0x82, 0x01, 0x00, 0xc7, 0x69, 0x35, 0x21, 0x66, ++ 0x4d, 0x50, 0xd4, 0x73, 0xde, 0xbd, 0x3a, 0xf6, 0x45, 0xe3, 0xe4, 0xd0, ++ 0xb6, 0xa1, 0xe7, 0xc0, 0xa2, 0xc9, 0xf4, 0xf0, 0x05, 0x8c, 0xa4, 0x16, ++ 0x9e, 0x81, 0x0d, 0x21, 0x68, 0xf3, 0xfe, 0x03, 0x96, 0x77, 0x31, 0x69, ++ 0x01, 0xd8, 0x26, 0xd9, 0x48, 0x95, 0xcf, 0xd1, 0x17, 0xb1, 0x0b, 0x6b, ++ 0x2c, 0xf1, 0xb0, 0xab, 0x65, 0x65, 0x56, 0xf8, 0x0c, 0xa7, 0xf7, 0xbb, ++ 0xf6, 0x5a, 0x55, 0x98, 0x14, 0x07, 0x8d, 0x2a, 0xbc, 0x16, 0x48, 0x94, ++ 0xab, 0x2f, 0x85, 0x97, 0x90, 0x51, 0x78, 0xa0, 0xda, 0x60, 0xb5, 0x41, ++ 0x4b, 0xe8, 0x78, 0xc5, 0xa6, 0x04, 0x9d, 0x54, 0x2a, 0x85, 0xfd, 0x86, ++ 0x0b, 0x6d, 0xc2, 0xd2, 0xad, 0x07, 0xff, 0x16, 0x42, 0x82, 0xe3, 0x5c, ++ 0xaa, 0x22, 0x59, 0x78, 0x92, 0xea, 0x94, 0xc3, 0x41, 0xb7, 0xa1, 0x86, ++ 0x44, 0xea, 0xd1, 0xdb, 0xe5, 0xac, 0x30, 0x32, 0xfb, 0x7d, 0x3f, 0xf7, ++ 0x8b, 0x11, 0x7f, 0x80, 0x3b, 0xe5, 0xc7, 0x82, 0x0f, 0x92, 0x07, 0x14, ++ 0x66, 0x01, 0x6e, 0x85, 0xab, 0x3a, 0x14, 0xcf, 0x76, 0xd1, 0x7e, 0x14, ++ 0x85, 0xca, 0x01, 0x73, 0x72, 0x38, 0xdc, 0xde, 0x30, 0x5c, 0xfb, 0xc0, ++ 0x3d, 0x93, 0xef, 0x9c, 0xbc, 0xf8, 0xcc, 0xd2, 0xbf, 0x47, 0xec, 0xf8, ++ 0x88, 0x9b, 0xe1, 0x43, 0xbe, 0xa7, 0x47, 0x96, 0xb6, 0x5d, 0x46, 0x0e, ++ 0x7a, 0x78, 0x38, 0x19, 0xbc, 0xb5, 0xbc, 0x9b, 0x3c, 0x39, 0x92, 0x70, ++ 0x0d, 0x9d, 0x8a, 0x35, 0xaf, 0xb4, 0x9e, 0xf4, 0xef, 0xc1, 0xb8, 0x25, ++ 0xd0, 0x14, 0x91, 0xd6, 0xc2, 0xb6, 0xc7, 0x3c, 0x72, 0x91, 0x0f, 0xad, ++ 0xde, 0xb2, 0x36, 0xf8, 0x4e, 0x59, 0xd4, 0xa4, 0x21, 0x9f, 0x03, 0x95, ++ 0x48, 0x01, 0xb4, 0x05, 0xc3, 0x39, 0x60, 0x51, 0x08, 0xd0, 0xbe, 0x00, ++ 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xc4, 0x7e, ++ 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x20, 0x73, 0x69, 0x67, 0x6e, 0x61, ++ 0x74, 0x75, 0x72, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, ++ 0x64, 0x7e, 0x0a ++}; ++unsigned int hi_signed_len = 495; ++ ++unsigned char hj_signed[] = { ++ 0x68, 0x6a, 0x0a, 0x30, 0x82, 0x01, 0xc0, 0x06, 0x09, 0x2a, 0x86, 0x48, ++ 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x01, 0xb1, 0x30, 0x82, ++ 0x01, 0xad, 0x02, 0x01, 0x01, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, ++ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x30, 0x0b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0x31, 0x82, 0x01, ++ 0x8a, 0x30, 0x82, 0x01, 0x86, 0x02, 0x01, 0x01, 0x30, 0x61, 0x30, 0x49, ++ 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x1f, 0x47, ++ 0x72, 0x75, 0x62, 0x20, 0x41, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x64, ++ 0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x54, ++ 0x65, 0x73, 0x74, 0x20, 0x43, 0x41, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0e, 0x64, ++ 0x6a, 0x61, 0x40, 0x61, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x2e, 0x6e, 0x65, ++ 0x74, 0x02, 0x14, 0x25, 0x2e, 0xb8, 0xfd, 0x12, 0x62, 0x2e, 0xcd, 0x5d, ++ 0xa7, 0x53, 0xd2, 0x0b, 0xc2, 0x61, 0x7c, 0x14, 0xe0, 0x0f, 0x5c, 0x30, ++ 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x01, 0x05, 0x00, 0x04, 0x82, 0x01, 0x00, 0xc7, 0x69, 0x35, 0x21, 0x66, ++ 0x4d, 0x50, 0xd4, 0x73, 0xde, 0xbd, 0x3a, 0xf6, 0x45, 0xe3, 0xe4, 0xd0, ++ 0xb6, 0xa1, 0xe7, 0xc0, 0xa2, 0xc9, 0xf4, 0xf0, 0x05, 0x8c, 0xa4, 0x16, ++ 0x9e, 0x81, 0x0d, 0x21, 0x68, 0xf3, 0xfe, 0x03, 0x96, 0x77, 0x31, 0x69, ++ 0x01, 0xd8, 0x26, 0xd9, 0x48, 0x95, 0xcf, 0xd1, 0x17, 0xb1, 0x0b, 0x6b, ++ 0x2c, 0xf1, 0xb0, 0xab, 0x65, 0x65, 0x56, 0xf8, 0x0c, 0xa7, 0xf7, 0xbb, ++ 0xf6, 0x5a, 0x55, 0x98, 0x14, 0x07, 0x8d, 0x2a, 0xbc, 0x16, 0x48, 0x94, ++ 0xab, 0x2f, 0x85, 0x97, 0x90, 0x51, 0x78, 0xa0, 0xda, 0x60, 0xb5, 0x41, ++ 0x4b, 0xe8, 0x78, 0xc5, 0xa6, 0x04, 0x9d, 0x54, 0x2a, 0x85, 0xfd, 0x86, ++ 0x0b, 0x6d, 0xc2, 0xd2, 0xad, 0x07, 0xff, 0x16, 0x42, 0x82, 0xe3, 0x5c, ++ 0xaa, 0x22, 0x59, 0x78, 0x92, 0xea, 0x94, 0xc3, 0x41, 0xb7, 0xa1, 0x86, ++ 0x44, 0xea, 0xd1, 0xdb, 0xe5, 0xac, 0x30, 0x32, 0xfb, 0x7d, 0x3f, 0xf7, ++ 0x8b, 0x11, 0x7f, 0x80, 0x3b, 0xe5, 0xc7, 0x82, 0x0f, 0x92, 0x07, 0x14, ++ 0x66, 0x01, 0x6e, 0x85, 0xab, 0x3a, 0x14, 0xcf, 0x76, 0xd1, 0x7e, 0x14, ++ 0x85, 0xca, 0x01, 0x73, 0x72, 0x38, 0xdc, 0xde, 0x30, 0x5c, 0xfb, 0xc0, ++ 0x3d, 0x93, 0xef, 0x9c, 0xbc, 0xf8, 0xcc, 0xd2, 0xbf, 0x47, 0xec, 0xf8, ++ 0x88, 0x9b, 0xe1, 0x43, 0xbe, 0xa7, 0x47, 0x96, 0xb6, 0x5d, 0x46, 0x0e, ++ 0x7a, 0x78, 0x38, 0x19, 0xbc, 0xb5, 0xbc, 0x9b, 0x3c, 0x39, 0x92, 0x70, ++ 0x0d, 0x9d, 0x8a, 0x35, 0xaf, 0xb4, 0x9e, 0xf4, 0xef, 0xc1, 0xb8, 0x25, ++ 0xd0, 0x14, 0x91, 0xd6, 0xc2, 0xb6, 0xc7, 0x3c, 0x72, 0x91, 0x0f, 0xad, ++ 0xde, 0xb2, 0x36, 0xf8, 0x4e, 0x59, 0xd4, 0xa4, 0x21, 0x9f, 0x03, 0x95, ++ 0x48, 0x01, 0xb4, 0x05, 0xc3, 0x39, 0x60, 0x51, 0x08, 0xd0, 0xbe, 0x00, ++ 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xc4, 0x7e, ++ 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x20, 0x73, 0x69, 0x67, 0x6e, 0x61, ++ 0x74, 0x75, 0x72, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, ++ 0x64, 0x7e, 0x0a ++}; ++unsigned int hj_signed_len = 495; ++ ++unsigned char hi_signed_sha256[] = { ++ 0x68, 0x69, 0x0a, 0x30, 0x82, 0x01, 0xc0, 0x06, 0x09, 0x2a, 0x86, 0x48, ++ 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x01, 0xb1, 0x30, 0x82, ++ 0x01, 0xad, 0x02, 0x01, 0x01, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, ++ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x30, 0x0b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0x31, 0x82, 0x01, ++ 0x8a, 0x30, 0x82, 0x01, 0x86, 0x02, 0x01, 0x01, 0x30, 0x61, 0x30, 0x49, ++ 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x1f, 0x47, ++ 0x72, 0x75, 0x62, 0x20, 0x41, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x64, ++ 0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x54, ++ 0x65, 0x73, 0x74, 0x20, 0x43, 0x41, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0e, 0x64, ++ 0x6a, 0x61, 0x40, 0x61, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x2e, 0x6e, 0x65, ++ 0x74, 0x02, 0x14, 0x25, 0x2e, 0xb8, 0xfd, 0x12, 0x62, 0x2e, 0xcd, 0x5d, ++ 0xa7, 0x53, 0xd2, 0x0b, 0xc2, 0x61, 0x7c, 0x14, 0xe0, 0x0f, 0x5c, 0x30, ++ 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x01, 0x05, 0x00, 0x04, 0x82, 0x01, 0x00, 0x7b, 0x5e, 0x82, 0x1d, 0x21, ++ 0xb6, 0x40, 0xd3, 0x33, 0x79, 0xa7, 0x52, 0x2b, 0xfc, 0x46, 0x51, 0x26, ++ 0xfe, 0x0f, 0x81, 0x90, 0x81, 0xab, 0x57, 0x5e, 0xf6, 0x45, 0x41, 0xa3, ++ 0x7b, 0x48, 0xdd, 0xd6, 0x59, 0x60, 0x51, 0x31, 0x14, 0x14, 0x7b, 0xb4, ++ 0x55, 0x7b, 0x4d, 0xfe, 0x09, 0x7a, 0x5d, 0xae, 0xc4, 0x58, 0x50, 0x80, ++ 0x75, 0xf2, 0x23, 0x20, 0x62, 0xe3, 0x7c, 0x26, 0x1d, 0x2a, 0x4d, 0x9f, ++ 0x89, 0xf0, 0x4f, 0x95, 0x8a, 0x80, 0x6e, 0x1a, 0xea, 0x87, 0xdb, 0x1f, ++ 0xf3, 0xda, 0x04, 0x91, 0x37, 0xea, 0x0a, 0xfb, 0x6c, 0xc9, 0x3d, 0x73, ++ 0xf9, 0x58, 0x7c, 0x15, 0x6b, 0xa2, 0x52, 0x5a, 0x97, 0xff, 0xd6, 0xb0, ++ 0xf1, 0xbf, 0xa5, 0x04, 0x6d, 0x91, 0xc1, 0x54, 0x05, 0xdc, 0x7f, 0x5d, ++ 0x19, 0xaf, 0x55, 0xec, 0x51, 0xfb, 0x66, 0x0a, 0xa4, 0x4e, 0x96, 0x47, ++ 0x43, 0x54, 0x7c, 0x64, 0xa8, 0xaa, 0xb4, 0x90, 0x02, 0xf3, 0xa7, 0x0b, ++ 0xb7, 0xbf, 0x06, 0xdb, 0x5e, 0x9c, 0x32, 0x6d, 0x45, 0x14, 0x1c, 0xaf, ++ 0x46, 0x30, 0x08, 0x55, 0x49, 0x78, 0xfa, 0x57, 0xda, 0x3d, 0xf5, 0xa0, ++ 0xef, 0x11, 0x0a, 0x81, 0x0d, 0x82, 0xcd, 0xaf, 0xdb, 0xda, 0x0e, 0x1a, ++ 0x44, 0xd1, 0xee, 0xc4, 0xb8, 0xde, 0x97, 0xb4, 0xda, 0xb4, 0x8b, 0x4f, ++ 0x58, 0x24, 0x59, 0xc0, 0xe0, 0x08, 0x97, 0x14, 0x68, 0xbe, 0x31, 0x09, ++ 0x5e, 0x67, 0x45, 0xf0, 0xcb, 0x81, 0x4f, 0x17, 0x44, 0x61, 0xe0, 0xe2, ++ 0xf0, 0xfc, 0x1e, 0xb9, 0x73, 0xaf, 0x42, 0xff, 0x33, 0xde, 0x61, 0x6b, ++ 0x7f, 0xc2, 0x69, 0x0d, 0x66, 0x54, 0xae, 0xf6, 0xde, 0x20, 0x47, 0x44, ++ 0x9b, 0x73, 0xd1, 0x07, 0x6e, 0x77, 0x37, 0x0a, 0xbb, 0x7f, 0xa0, 0x93, ++ 0x2d, 0x8d, 0x44, 0xba, 0xe2, 0xdd, 0x34, 0x32, 0xd7, 0x56, 0x71, 0x00, ++ 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xc4, 0x7e, ++ 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x20, 0x73, 0x69, 0x67, 0x6e, 0x61, ++ 0x74, 0x75, 0x72, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x65, ++ 0x64, 0x7e, 0x0a ++}; ++unsigned int hi_signed_sha256_len = 495; ++ ++unsigned char short_msg[] = { ++ 0x68, 0x69, 0x0a ++}; ++unsigned int short_msg_len = 3; ++ ++unsigned char unsigned_msg[] = { ++ 0x53, 0x65, 0x64, 0x20, 0x75, 0x74, 0x20, 0x70, 0x65, 0x72, 0x73, 0x70, ++ 0x69, 0x63, 0x69, 0x61, 0x74, 0x69, 0x73, 0x20, 0x75, 0x6e, 0x64, 0x65, ++ 0x20, 0x6f, 0x6d, 0x6e, 0x69, 0x73, 0x20, 0x69, 0x73, 0x74, 0x65, 0x20, ++ 0x6e, 0x61, 0x74, 0x75, 0x73, 0x20, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x20, ++ 0x73, 0x69, 0x74, 0x20, 0x76, 0x6f, 0x6c, 0x75, 0x70, 0x74, 0x61, 0x74, ++ 0x65, 0x6d, 0x20, 0x61, 0x63, 0x63, 0x75, 0x73, 0x61, 0x6e, 0x74, 0x69, ++ 0x75, 0x6d, 0x20, 0x64, 0x6f, 0x6c, 0x6f, 0x72, 0x65, 0x6d, 0x71, 0x75, ++ 0x65, 0x20, 0x6c, 0x61, 0x75, 0x64, 0x61, 0x6e, 0x74, 0x69, 0x75, 0x6d, ++ 0x2c, 0x20, 0x74, 0x6f, 0x74, 0x61, 0x6d, 0x20, 0x72, 0x65, 0x6d, 0x20, ++ 0x61, 0x70, 0x65, 0x72, 0x69, 0x61, 0x6d, 0x2c, 0x20, 0x65, 0x61, 0x71, ++ 0x75, 0x65, 0x20, 0x69, 0x70, 0x73, 0x61, 0x20, 0x71, 0x75, 0x61, 0x65, ++ 0x20, 0x61, 0x62, 0x20, 0x69, 0x6c, 0x6c, 0x6f, 0x20, 0x69, 0x6e, 0x76, ++ 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x65, 0x20, 0x76, 0x65, 0x72, 0x69, 0x74, ++ 0x61, 0x74, 0x69, 0x73, 0x20, 0x65, 0x74, 0x20, 0x71, 0x75, 0x61, 0x73, ++ 0x69, 0x20, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x6f, ++ 0x20, 0x62, 0x65, 0x61, 0x74, 0x61, 0x65, 0x20, 0x76, 0x69, 0x74, 0x61, ++ 0x65, 0x20, 0x64, 0x69, 0x63, 0x74, 0x61, 0x20, 0x73, 0x75, 0x6e, 0x74, ++ 0x20, 0x65, 0x78, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x62, 0x6f, 0x2e, 0x20, ++ 0x4e, 0x65, 0x6d, 0x6f, 0x20, 0x65, 0x6e, 0x69, 0x6d, 0x20, 0x69, 0x70, ++ 0x73, 0x61, 0x6d, 0x20, 0x76, 0x6f, 0x6c, 0x75, 0x70, 0x74, 0x61, 0x74, ++ 0x65, 0x6d, 0x20, 0x71, 0x75, 0x69, 0x61, 0x20, 0x76, 0x6f, 0x6c, 0x75, ++ 0x70, 0x74, 0x61, 0x73, 0x20, 0x73, 0x69, 0x74, 0x20, 0x61, 0x73, 0x70, ++ 0x65, 0x72, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x20, 0x61, 0x75, 0x74, 0x20, ++ 0x6f, 0x64, 0x69, 0x74, 0x20, 0x61, 0x75, 0x74, 0x20, 0x66, 0x75, 0x67, ++ 0x69, 0x74, 0x2c, 0x20, 0x73, 0x65, 0x64, 0x20, 0x71, 0x75, 0x69, 0x61, ++ 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x71, 0x75, 0x75, 0x6e, 0x74, 0x75, ++ 0x72, 0x20, 0x6d, 0x61, 0x67, 0x6e, 0x69, 0x20, 0x64, 0x6f, 0x6c, 0x6f, ++ 0x72, 0x65, 0x73, 0x20, 0x65, 0x6f, 0x73, 0x20, 0x71, 0x75, 0x69, 0x20, ++ 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x65, 0x20, 0x76, 0x6f, 0x6c, 0x75, ++ 0x70, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x20, 0x73, 0x65, 0x71, 0x75, 0x69, ++ 0x20, 0x6e, 0x65, 0x73, 0x63, 0x69, 0x75, 0x6e, 0x74, 0x2e, 0x20, 0x4e, ++ 0x65, 0x71, 0x75, 0x65, 0x20, 0x70, 0x6f, 0x72, 0x72, 0x6f, 0x20, 0x71, ++ 0x75, 0x69, 0x73, 0x71, 0x75, 0x61, 0x6d, 0x20, 0x65, 0x73, 0x74, 0x2c, ++ 0x20, 0x71, 0x75, 0x69, 0x20, 0x64, 0x6f, 0x6c, 0x6f, 0x72, 0x65, 0x6d, ++ 0x20, 0x69, 0x70, 0x73, 0x75, 0x6d, 0x20, 0x71, 0x75, 0x69, 0x61, 0x20, ++ 0x64, 0x6f, 0x6c, 0x6f, 0x72, 0x20, 0x73, 0x69, 0x74, 0x20, 0x61, 0x6d, ++ 0x65, 0x74, 0x2c, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x74, 0x65, ++ 0x74, 0x75, 0x72, 0x2c, 0x20, 0x61, 0x64, 0x69, 0x70, 0x69, 0x73, 0x63, ++ 0x69, 0x20, 0x76, 0x65, 0x6c, 0x69, 0x74, 0x2c, 0x20, 0x73, 0x65, 0x64, ++ 0x20, 0x71, 0x75, 0x69, 0x61, 0x20, 0x6e, 0x6f, 0x6e, 0x20, 0x6e, 0x75, ++ 0x6d, 0x71, 0x75, 0x61, 0x6d, 0x20, 0x65, 0x69, 0x75, 0x73, 0x20, 0x6d, ++ 0x6f, 0x64, 0x69, 0x20, 0x74, 0x65, 0x6d, 0x70, 0x6f, 0x72, 0x61, 0x20, ++ 0x69, 0x6e, 0x63, 0x69, 0x64, 0x75, 0x6e, 0x74, 0x20, 0x75, 0x74, 0x20, ++ 0x6c, 0x61, 0x62, 0x6f, 0x72, 0x65, 0x20, 0x65, 0x74, 0x20, 0x64, 0x6f, ++ 0x6c, 0x6f, 0x72, 0x65, 0x20, 0x6d, 0x61, 0x67, 0x6e, 0x61, 0x6d, 0x20, ++ 0x61, 0x6c, 0x69, 0x71, 0x75, 0x61, 0x6d, 0x20, 0x71, 0x75, 0x61, 0x65, ++ 0x72, 0x61, 0x74, 0x20, 0x76, 0x6f, 0x6c, 0x75, 0x70, 0x74, 0x61, 0x74, ++ 0x65, 0x6d, 0x2e, 0x20, 0x55, 0x74, 0x20, 0x65, 0x6e, 0x69, 0x6d, 0x20, ++ 0x61, 0x64, 0x20, 0x6d, 0x69, 0x6e, 0x69, 0x6d, 0x61, 0x20, 0x76, 0x65, ++ 0x6e, 0x69, 0x61, 0x6d, 0x2c, 0x20, 0x71, 0x75, 0x69, 0x73, 0x20, 0x6e, ++ 0x6f, 0x73, 0x74, 0x72, 0x75, 0x6d, 0x20, 0x65, 0x78, 0x65, 0x72, 0x63, ++ 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x65, 0x6d, 0x20, 0x75, 0x6c, ++ 0x6c, 0x61, 0x6d, 0x20, 0x63, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x69, 0x73, ++ 0x20, 0x73, 0x75, 0x73, 0x63, 0x69, 0x70, 0x69, 0x74, 0x20, 0x6c, 0x61, ++ 0x62, 0x6f, 0x72, 0x69, 0x6f, 0x73, 0x61, 0x6d, 0x2c, 0x20, 0x6e, 0x69, ++ 0x73, 0x69, 0x20, 0x75, 0x74, 0x20, 0x61, 0x6c, 0x69, 0x71, 0x75, 0x69, ++ 0x64, 0x20, 0x65, 0x78, 0x20, 0x65, 0x61, 0x20, 0x63, 0x6f, 0x6d, 0x6d, ++ 0x6f, 0x64, 0x69, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x71, 0x75, 0x61, ++ 0x74, 0x75, 0x72, 0x3f, 0x20, 0x51, 0x75, 0x69, 0x73, 0x20, 0x61, 0x75, ++ 0x74, 0x65, 0x6d, 0x20, 0x76, 0x65, 0x6c, 0x20, 0x65, 0x75, 0x6d, 0x20, ++ 0x69, 0x75, 0x72, 0x65, 0x20, 0x72, 0x65, 0x70, 0x72, 0x65, 0x68, 0x65, ++ 0x6e, 0x64, 0x65, 0x72, 0x69, 0x74, 0x20, 0x71, 0x75, 0x69, 0x20, 0x69, ++ 0x6e, 0x20, 0x65, 0x61, 0x20, 0x76, 0x6f, 0x6c, 0x75, 0x70, 0x74, 0x61, ++ 0x74, 0x65, 0x20, 0x76, 0x65, 0x6c, 0x69, 0x74, 0x20, 0x65, 0x73, 0x73, ++ 0x65, 0x20, 0x71, 0x75, 0x61, 0x6d, 0x20, 0x6e, 0x69, 0x68, 0x69, 0x6c, ++ 0x20, 0x6d, 0x6f, 0x6c, 0x65, 0x73, 0x74, 0x69, 0x61, 0x65, 0x20, 0x63, ++ 0x6f, 0x6e, 0x73, 0x65, 0x71, 0x75, 0x61, 0x74, 0x75, 0x72, 0x2c, 0x20, ++ 0x76, 0x65, 0x6c, 0x20, 0x69, 0x6c, 0x6c, 0x75, 0x6d, 0x20, 0x71, 0x75, ++ 0x69, 0x20, 0x64, 0x6f, 0x6c, 0x6f, 0x72, 0x65, 0x6d, 0x20, 0x65, 0x75, ++ 0x6d, 0x20, 0x66, 0x75, 0x67, 0x69, 0x61, 0x74, 0x20, 0x71, 0x75, 0x6f, ++ 0x20, 0x76, 0x6f, 0x6c, 0x75, 0x70, 0x74, 0x61, 0x73, 0x20, 0x6e, 0x75, ++ 0x6c, 0x6c, 0x61, 0x20, 0x70, 0x61, 0x72, 0x69, 0x61, 0x74, 0x75, 0x72, ++ 0x3f, 0x0a ++}; ++unsigned int unsigned_msg_len = 866; ++ ++unsigned char certificate2_der[] = { ++ 0x30, 0x82, 0x05, 0x52, 0x30, 0x82, 0x03, 0x3a, 0xa0, 0x03, 0x02, 0x01, ++ 0x02, 0x02, 0x14, 0x5b, 0x5e, 0x59, 0xf2, 0x5f, 0x75, 0x4c, 0x8e, 0xc5, ++ 0x3a, 0x91, 0x07, 0xe9, 0xe7, 0x6d, 0x3c, 0xd0, 0x7f, 0x91, 0xff, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, ++ 0x05, 0x00, 0x30, 0x3a, 0x31, 0x38, 0x30, 0x36, 0x06, 0x03, 0x55, 0x04, ++ 0x03, 0x0c, 0x2f, 0x47, 0x72, 0x75, 0x62, 0x20, 0x32, 0x6e, 0x64, 0x20, ++ 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, ++ 0x54, 0x65, 0x73, 0x74, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, ++ 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, ++ 0x74, 0x79, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x37, 0x32, 0x38, ++ 0x31, 0x33, 0x32, 0x34, 0x32, 0x39, 0x5a, 0x18, 0x0f, 0x32, 0x31, 0x32, ++ 0x30, 0x30, 0x37, 0x30, 0x34, 0x31, 0x33, 0x32, 0x34, 0x32, 0x39, 0x5a, ++ 0x30, 0x2b, 0x31, 0x29, 0x30, 0x27, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, ++ 0x20, 0x47, 0x72, 0x75, 0x62, 0x20, 0x32, 0x6e, 0x64, 0x20, 0x43, 0x65, ++ 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x53, 0x69, ++ 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x20, 0x4b, 0x65, 0x79, 0x30, 0x82, 0x02, ++ 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, ++ 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x02, 0x0f, 0x00, 0x30, 0x82, 0x02, ++ 0x0a, 0x02, 0x82, 0x02, 0x01, 0x00, 0xb0, 0x2f, 0x50, 0x01, 0x9c, 0x0e, ++ 0xd6, 0x8c, 0x07, 0xca, 0xc1, 0xcf, 0xbc, 0x03, 0xdd, 0xd3, 0xfa, 0xe3, ++ 0x4f, 0x71, 0xc1, 0x30, 0xaa, 0x09, 0x96, 0xe4, 0xd0, 0x6c, 0x42, 0x93, ++ 0xdb, 0x35, 0xf6, 0x7e, 0x1b, 0x67, 0xc0, 0xc2, 0x2d, 0x5b, 0xec, 0xca, ++ 0x35, 0x06, 0x32, 0x6c, 0x7b, 0x2c, 0xd3, 0x71, 0x2b, 0xe9, 0x7a, 0x19, ++ 0xd1, 0xf2, 0xa0, 0x7f, 0xd7, 0x4d, 0x6e, 0x28, 0xbb, 0xae, 0x49, 0x4a, ++ 0xbc, 0xea, 0x47, 0x67, 0xb8, 0x36, 0xa6, 0xf5, 0x0d, 0x0e, 0x20, 0x14, ++ 0x0c, 0x66, 0x67, 0x28, 0xb5, 0x97, 0x8b, 0x1f, 0x5e, 0x32, 0x06, 0x29, ++ 0x9c, 0x99, 0x92, 0x0f, 0x73, 0xac, 0xfd, 0xd2, 0x1d, 0xf2, 0xa8, 0x55, ++ 0x9d, 0x1b, 0xd8, 0x3d, 0xb0, 0x76, 0x9a, 0xb6, 0x6c, 0x9f, 0x62, 0x37, ++ 0x2f, 0xc0, 0xef, 0x44, 0xb3, 0x0d, 0x4a, 0x3e, 0x4f, 0x7d, 0xbd, 0xdb, ++ 0xd8, 0x75, 0x5f, 0x68, 0xe3, 0xf0, 0xec, 0x82, 0x66, 0x7c, 0x31, 0x70, ++ 0xa9, 0xa1, 0x6f, 0x38, 0x9f, 0xdf, 0xf5, 0xf0, 0x7d, 0x23, 0x9d, 0x34, ++ 0xa5, 0x85, 0xd3, 0xdf, 0x68, 0x41, 0xfc, 0x4f, 0x89, 0x45, 0x3c, 0x24, ++ 0x81, 0xa6, 0xf2, 0x3c, 0x02, 0x26, 0x09, 0x48, 0xdd, 0xfe, 0x4b, 0xb6, ++ 0x66, 0xbf, 0x8f, 0xe5, 0x5f, 0xf0, 0x5d, 0x8a, 0x61, 0x2e, 0x5f, 0x9f, ++ 0x80, 0xd9, 0xd5, 0xe6, 0x41, 0xd8, 0x10, 0x5e, 0x7a, 0xc6, 0xdb, 0x89, ++ 0xc7, 0xca, 0x6c, 0x5b, 0xb1, 0x4e, 0x7d, 0x0c, 0x03, 0xfd, 0x50, 0xca, ++ 0xbf, 0xbb, 0xe2, 0x69, 0x4b, 0x4e, 0xc2, 0x3d, 0x75, 0xfa, 0xd1, 0xcc, ++ 0xd6, 0xf9, 0x39, 0xb9, 0xdc, 0x53, 0xad, 0x62, 0xfb, 0x1b, 0x94, 0x26, ++ 0x7f, 0x21, 0x54, 0x5c, 0xb7, 0xdc, 0xe7, 0x96, 0x8c, 0xce, 0x75, 0xe0, ++ 0x17, 0x01, 0x3a, 0x3c, 0x77, 0x6e, 0xa4, 0x8b, 0x7a, 0x83, 0x28, 0x7a, ++ 0xf7, 0xb0, 0x5f, 0xfc, 0x7f, 0x2d, 0x2e, 0xec, 0xf5, 0xeb, 0x9c, 0x63, ++ 0x74, 0xd0, 0xe5, 0xdc, 0x19, 0xe4, 0x71, 0xc5, 0x4a, 0x8a, 0x54, 0xa4, ++ 0xe0, 0x7d, 0x4e, 0xbf, 0x53, 0x30, 0xaf, 0xd0, 0xeb, 0x96, 0xc3, 0xbb, ++ 0x65, 0xf7, 0x67, 0xf5, 0xae, 0xd3, 0x96, 0xf2, 0x63, 0xc8, 0x69, 0xf7, ++ 0x47, 0xcb, 0x27, 0x79, 0xe1, 0xff, 0x2f, 0x68, 0xdf, 0x1e, 0xb3, 0xb8, ++ 0x0c, 0xc5, 0x58, 0x73, 0xcc, 0xfe, 0x8c, 0xda, 0x4e, 0x3b, 0x01, 0x04, ++ 0xcd, 0xcb, 0xb8, 0x3e, 0x06, 0xfd, 0x4c, 0x0a, 0x9f, 0x5e, 0x76, 0x8c, ++ 0x0c, 0x83, 0x75, 0x09, 0x08, 0xb2, 0xdb, 0xf4, 0x49, 0x4e, 0xa0, 0xf2, ++ 0x0c, 0x7b, 0x87, 0x38, 0x9e, 0x22, 0x67, 0xbd, 0xd1, 0x97, 0x57, 0x24, ++ 0xf1, 0x46, 0x07, 0xf9, 0xd2, 0x1b, 0xec, 0x25, 0x5e, 0x67, 0xd9, 0x66, ++ 0x23, 0x1b, 0xd3, 0xe4, 0xaa, 0xec, 0x88, 0xf0, 0x7e, 0x15, 0x83, 0x51, ++ 0x31, 0x67, 0x51, 0x76, 0x5f, 0x55, 0xd7, 0x36, 0xdf, 0x4a, 0x84, 0x0b, ++ 0x6f, 0x5c, 0xbb, 0x5b, 0x8f, 0x37, 0x23, 0x7f, 0xf8, 0x17, 0x84, 0xa2, ++ 0x70, 0x20, 0x07, 0x0c, 0x90, 0x3a, 0x04, 0xfd, 0xf0, 0x08, 0x4a, 0xb1, ++ 0x16, 0x0f, 0xe6, 0xf6, 0x40, 0x51, 0x83, 0xd2, 0x87, 0x40, 0x9c, 0x1c, ++ 0x9f, 0x13, 0x38, 0x17, 0xd3, 0x34, 0x58, 0xad, 0x05, 0x71, 0xa0, 0x73, ++ 0xca, 0x40, 0xa6, 0xa4, 0x81, 0x02, 0xee, 0xa8, 0x72, 0x41, 0xa1, 0x41, ++ 0x18, 0x64, 0x8a, 0x86, 0x8a, 0x5d, 0xe6, 0x4f, 0x0a, 0xc5, 0x95, 0x98, ++ 0xf9, 0x78, 0xfe, 0x19, 0x0d, 0xc9, 0xb3, 0x89, 0xc1, 0x2b, 0x09, 0xbe, ++ 0xf1, 0xd2, 0x04, 0x5d, 0xcc, 0x28, 0xf5, 0x4b, 0xd2, 0x20, 0x4f, 0xc5, ++ 0x41, 0x9d, 0x8c, 0x85, 0xd8, 0xb0, 0x68, 0x5e, 0xc1, 0x0c, 0xb7, 0x24, ++ 0x4d, 0x67, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x5d, 0x30, 0x5b, 0x30, ++ 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, ++ 0x00, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, ++ 0x07, 0x80, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, ++ 0x14, 0xac, 0xf5, 0x47, 0x17, 0xd9, 0x7d, 0xc1, 0xb1, 0xc4, 0x41, 0xe1, ++ 0x41, 0x60, 0xcb, 0x37, 0x11, 0x60, 0x28, 0x78, 0x5f, 0x30, 0x1f, 0x06, ++ 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x21, 0x94, ++ 0xfb, 0xf9, 0xb2, 0x43, 0xe9, 0x33, 0xd7, 0x50, 0x7d, 0xc7, 0x37, 0xdb, ++ 0xd5, 0x82, 0x5a, 0x4e, 0xbe, 0x1b, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, ++ 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x02, ++ 0x01, 0x00, 0x96, 0x70, 0x65, 0x26, 0x42, 0xf8, 0xdc, 0x69, 0xde, 0xcf, ++ 0x41, 0x3a, 0x2e, 0x7f, 0x5b, 0xf1, 0xf9, 0x3b, 0x9b, 0xd2, 0x4e, 0x64, ++ 0x48, 0x81, 0xe4, 0x5d, 0x1e, 0x22, 0xce, 0x68, 0x63, 0x62, 0xe5, 0x1b, ++ 0x9b, 0xf2, 0xc7, 0x12, 0xda, 0x1e, 0x9b, 0x90, 0x84, 0x79, 0x48, 0x12, ++ 0xe6, 0x21, 0x6f, 0x2f, 0x7e, 0x18, 0x77, 0xdb, 0x8c, 0xc4, 0xd1, 0x0d, ++ 0x91, 0xbf, 0x39, 0x22, 0x0f, 0x64, 0xcf, 0x25, 0x2e, 0x8c, 0x1f, 0x91, ++ 0x81, 0xb5, 0xe9, 0x6c, 0x02, 0x3a, 0xf8, 0x07, 0xa2, 0x6f, 0x46, 0x5d, ++ 0x7b, 0xfd, 0x43, 0xff, 0x41, 0x0f, 0xe2, 0x57, 0x1c, 0xbd, 0x48, 0x60, ++ 0x53, 0x11, 0x48, 0x87, 0x88, 0x9d, 0x13, 0x82, 0x40, 0x68, 0x44, 0x2c, ++ 0xc6, 0xc8, 0x95, 0x27, 0x4f, 0xb6, 0xb9, 0x4a, 0x22, 0x0a, 0xfd, 0xe4, ++ 0x46, 0x8f, 0x35, 0x12, 0x98, 0x5a, 0x34, 0x6f, 0x2b, 0x57, 0x62, 0xa1, ++ 0x4d, 0x8d, 0x79, 0x37, 0xe4, 0x6b, 0x8a, 0x32, 0x5b, 0xcb, 0xef, 0x79, ++ 0x11, 0xed, 0xa7, 0xf8, 0x7a, 0x1c, 0xbd, 0x86, 0xdc, 0x0e, 0x2e, 0xfd, ++ 0xd3, 0x51, 0xbb, 0x73, 0xad, 0x00, 0xa0, 0x1b, 0xf9, 0x1d, 0xd1, 0x4a, ++ 0xe4, 0xd4, 0x02, 0x63, 0x2b, 0x39, 0x5f, 0x18, 0x08, 0x2f, 0x42, 0xb7, ++ 0x23, 0x4b, 0x48, 0x46, 0x1f, 0x63, 0x87, 0xae, 0x6d, 0xd5, 0xdb, 0x60, ++ 0xf8, 0x5f, 0xd3, 0x13, 0xec, 0xca, 0xdd, 0x60, 0x60, 0x79, 0x52, 0x70, ++ 0x47, 0xae, 0x1d, 0x38, 0x78, 0x71, 0xcf, 0xb3, 0x04, 0x03, 0xbe, 0xba, ++ 0x81, 0xba, 0x74, 0xb1, 0x30, 0x35, 0xdc, 0xea, 0x21, 0x4a, 0x9b, 0x70, ++ 0xfb, 0xd6, 0x60, 0x59, 0x78, 0x0c, 0x4d, 0x39, 0x19, 0x1d, 0xe5, 0x75, ++ 0xba, 0x07, 0xf4, 0x22, 0x37, 0x64, 0xb7, 0xf2, 0x9a, 0xc9, 0x11, 0x2d, ++ 0x8e, 0x58, 0xa6, 0xcf, 0x83, 0xf1, 0xcb, 0x6c, 0x7f, 0x02, 0xbd, 0xda, ++ 0x03, 0x92, 0xa9, 0x45, 0x24, 0x56, 0xc5, 0xbd, 0x41, 0xd1, 0x20, 0x86, ++ 0xc0, 0xb6, 0xb7, 0xe8, 0xa7, 0xb2, 0x46, 0xf7, 0x8e, 0xa9, 0x38, 0x0e, ++ 0x23, 0x77, 0x3c, 0x0d, 0x66, 0x83, 0x6a, 0x1a, 0x6b, 0x7f, 0x54, 0x11, ++ 0x58, 0x0d, 0x4a, 0xb5, 0x74, 0x60, 0xca, 0xed, 0xff, 0x91, 0x47, 0xd9, ++ 0x29, 0xe0, 0xaa, 0x8c, 0xa8, 0x8f, 0x10, 0x4c, 0x15, 0x7d, 0xce, 0x95, ++ 0xf9, 0x87, 0x1e, 0x18, 0x38, 0x18, 0xfc, 0xcc, 0xaf, 0x91, 0x17, 0x3f, ++ 0xfa, 0xf0, 0x8a, 0x09, 0x6f, 0xba, 0x4e, 0x53, 0xf7, 0xfa, 0x4f, 0x20, ++ 0xa3, 0xf4, 0x4a, 0x5a, 0xde, 0x17, 0x1c, 0x29, 0x6a, 0x6f, 0x03, 0x48, ++ 0xdf, 0xad, 0x4f, 0xe4, 0xbc, 0x71, 0xc4, 0x72, 0x32, 0x11, 0x84, 0xac, ++ 0x09, 0xd2, 0x18, 0x44, 0x35, 0xf1, 0xcd, 0xaf, 0xa8, 0x98, 0xe0, 0x8b, ++ 0xec, 0xa0, 0x83, 0x37, 0xc3, 0x35, 0x85, 0xd6, 0xd8, 0x1b, 0xe0, 0x75, ++ 0xdc, 0xfd, 0xde, 0xc9, 0xeb, 0xd5, 0x18, 0x0f, 0xd3, 0x4c, 0x2f, 0x71, ++ 0xdc, 0x48, 0xe3, 0x14, 0xeb, 0xda, 0x00, 0x24, 0x24, 0x9e, 0xa3, 0x8e, ++ 0x3e, 0x08, 0x6f, 0x22, 0x24, 0xd6, 0xc4, 0x85, 0x8f, 0x68, 0x00, 0x4a, ++ 0x82, 0x4c, 0x33, 0x6e, 0xa5, 0x35, 0x7b, 0xeb, 0x4b, 0xdc, 0xa0, 0xa6, ++ 0x65, 0x6f, 0x5a, 0x7a, 0xdf, 0x8a, 0x01, 0x52, 0xa1, 0x6c, 0xff, 0x59, ++ 0x22, 0x7f, 0xe1, 0x96, 0x1b, 0x19, 0xb8, 0xf9, 0x5d, 0x44, 0x9f, 0x91, ++ 0x03, 0x3c, 0x3d, 0xa1, 0x2a, 0xb6, 0x5a, 0x51, 0xa0, 0xce, 0x4a, 0x88, ++ 0x22, 0x72, 0x9c, 0xdc, 0xc0, 0x47, 0x76, 0x35, 0x84, 0x75, 0x9b, 0x87, ++ 0x5c, 0xd3, 0xcf, 0xe7, 0xdd, 0xa3, 0x57, 0x14, 0xdf, 0x00, 0xfd, 0x19, ++ 0x2a, 0x7d, 0x89, 0x27, 0x1c, 0x78, 0x97, 0x04, 0x58, 0x48 ++}; ++unsigned int certificate2_der_len = 1366; ++ ++unsigned char hi_signed_2nd[] = { ++ 0x68, 0x69, 0x0a, 0x30, 0x82, 0x02, 0xb1, 0x06, 0x09, 0x2a, 0x86, 0x48, ++ 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x02, 0xa2, 0x30, 0x82, ++ 0x02, 0x9e, 0x02, 0x01, 0x01, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, ++ 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x30, 0x0b, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0x31, 0x82, 0x02, ++ 0x7b, 0x30, 0x82, 0x02, 0x77, 0x02, 0x01, 0x01, 0x30, 0x52, 0x30, 0x3a, ++ 0x31, 0x38, 0x30, 0x36, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x2f, 0x47, ++ 0x72, 0x75, 0x62, 0x20, 0x32, 0x6e, 0x64, 0x20, 0x43, 0x65, 0x72, 0x74, ++ 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x54, 0x65, 0x73, 0x74, ++ 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, ++ 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x02, 0x14, ++ 0x5b, 0x5e, 0x59, 0xf2, 0x5f, 0x75, 0x4c, 0x8e, 0xc5, 0x3a, 0x91, 0x07, ++ 0xe9, 0xe7, 0x6d, 0x3c, 0xd0, 0x7f, 0x91, 0xff, 0x30, 0x0b, 0x06, 0x09, ++ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x30, 0x0d, 0x06, ++ 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, ++ 0x04, 0x82, 0x02, 0x00, 0x0e, 0xc2, 0x30, 0x38, 0x81, 0x23, 0x68, 0x90, ++ 0xae, 0x5f, 0xce, 0xf7, 0x27, 0xb1, 0x8c, 0x2e, 0x12, 0x10, 0xc6, 0x99, ++ 0xdc, 0x4d, 0x4b, 0x79, 0xda, 0xe4, 0x32, 0x10, 0x46, 0x1c, 0x16, 0x07, ++ 0x87, 0x66, 0x55, 0xff, 0x64, 0x1c, 0x61, 0x25, 0xd5, 0xb9, 0xe1, 0xfe, ++ 0xea, 0x5a, 0xcd, 0x56, 0xa5, 0xc3, 0xbe, 0xb1, 0x61, 0xc7, 0x6f, 0x5f, ++ 0x69, 0x20, 0x64, 0x50, 0x6f, 0x12, 0x78, 0xb6, 0x0c, 0x72, 0x44, 0x4f, ++ 0x60, 0x0f, 0x9f, 0xa2, 0x83, 0x3b, 0xc2, 0x83, 0xd5, 0x14, 0x1f, 0x6f, ++ 0x3e, 0xb2, 0x47, 0xb5, 0x58, 0xc5, 0xa7, 0xb4, 0x82, 0x53, 0x2e, 0x53, ++ 0x95, 0x4e, 0x3d, 0xe4, 0x62, 0xe8, 0xa1, 0xaf, 0xae, 0xbf, 0xa9, 0xd2, ++ 0x22, 0x07, 0xbe, 0x71, 0x37, 0x2c, 0x5a, 0xa7, 0x6c, 0xaf, 0x14, 0xc0, ++ 0x6c, 0x2f, 0xbf, 0x4f, 0x15, 0xc2, 0x0f, 0x8b, 0xdc, 0x68, 0x45, 0xdf, ++ 0xf3, 0xa5, 0x7f, 0x11, 0x6a, 0x54, 0xcd, 0x67, 0xb9, 0x2e, 0x7d, 0x05, ++ 0xe3, 0x1c, 0x1d, 0xcc, 0x77, 0x8e, 0x97, 0xb1, 0xa0, 0x11, 0x09, 0x3d, ++ 0x90, 0x54, 0xfc, 0x7e, 0xbb, 0xbb, 0x21, 0x23, 0x03, 0x44, 0xbf, 0x7d, ++ 0x2c, 0xc9, 0x15, 0x42, 0xe5, 0xa0, 0x3b, 0xa2, 0xd1, 0x5b, 0x73, 0x81, ++ 0xff, 0xfa, 0x90, 0xfc, 0x27, 0x7b, 0x2f, 0x86, 0x9c, 0x1d, 0x14, 0x36, ++ 0x94, 0xa2, 0x6e, 0xe8, 0x9d, 0xa0, 0x5f, 0xfc, 0x5a, 0x0d, 0xa4, 0xd5, ++ 0x2f, 0x8d, 0xd6, 0x00, 0xfa, 0x93, 0x5b, 0x09, 0x7f, 0x42, 0x78, 0xcc, ++ 0x8c, 0x49, 0xda, 0xd9, 0xf6, 0x43, 0xe7, 0xe1, 0x3c, 0xa2, 0xe2, 0x70, ++ 0xe2, 0x6a, 0x99, 0xc5, 0xd6, 0xa2, 0xe3, 0x0b, 0xd4, 0x09, 0xac, 0x94, ++ 0xaf, 0xb7, 0xf0, 0xb3, 0x0c, 0x1e, 0xf5, 0x16, 0x4f, 0x53, 0x9a, 0xe3, ++ 0xcc, 0xe2, 0x0c, 0x4a, 0xb9, 0xe6, 0x06, 0xbb, 0xf7, 0x41, 0x43, 0x20, ++ 0x04, 0xee, 0x99, 0x2f, 0xd8, 0x9f, 0xda, 0x3f, 0xfd, 0x49, 0xb8, 0xc2, ++ 0xbd, 0xd9, 0xc5, 0x72, 0xfd, 0xe3, 0xce, 0x1c, 0xbc, 0xe4, 0x39, 0xac, ++ 0x2a, 0x99, 0xe9, 0xb4, 0x3e, 0x74, 0x10, 0xeb, 0xd5, 0x14, 0xcc, 0xdb, ++ 0xf1, 0x04, 0x63, 0x36, 0xfb, 0x1f, 0x2b, 0xe2, 0x73, 0xd4, 0xd8, 0x49, ++ 0x31, 0xa8, 0x55, 0xcc, 0xa7, 0x76, 0x36, 0x6e, 0x18, 0xdc, 0xb9, 0xb0, ++ 0x29, 0x99, 0xcf, 0x49, 0xbf, 0xf9, 0xdb, 0x7f, 0x24, 0x42, 0x02, 0xcb, ++ 0xc1, 0xaa, 0xcb, 0xba, 0x18, 0x85, 0x86, 0xc7, 0xf4, 0x1c, 0x62, 0x76, ++ 0xbc, 0x73, 0xfb, 0xe4, 0x15, 0xb8, 0xdd, 0x5d, 0xa6, 0x68, 0x39, 0xa5, ++ 0x3d, 0x33, 0xaf, 0xd5, 0x92, 0x4d, 0x48, 0xdb, 0x22, 0xc0, 0xdc, 0x49, ++ 0x5f, 0x7b, 0xa8, 0xd2, 0x62, 0x2d, 0xa7, 0x39, 0x93, 0x48, 0xe7, 0x6b, ++ 0x23, 0xba, 0xd4, 0xe0, 0xc1, 0x29, 0x55, 0xc4, 0x34, 0xe3, 0xac, 0x25, ++ 0xa7, 0x15, 0xad, 0xab, 0xb3, 0xb7, 0x25, 0xca, 0x37, 0x88, 0x40, 0x2e, ++ 0x47, 0x6e, 0x92, 0x20, 0x09, 0x2e, 0x5a, 0xec, 0xf2, 0xfb, 0xb3, 0xa0, ++ 0x16, 0xb6, 0x93, 0xf2, 0xf5, 0x8b, 0xfe, 0xaf, 0x25, 0xee, 0x2e, 0x98, ++ 0x6c, 0x0a, 0xfe, 0xae, 0x0b, 0x57, 0xf5, 0x9f, 0x3c, 0x80, 0xe9, 0x8b, ++ 0xaf, 0x92, 0x8a, 0xad, 0xe7, 0xa0, 0xe4, 0xe6, 0x0a, 0xa0, 0xc7, 0x83, ++ 0xb5, 0x48, 0x58, 0x5f, 0x55, 0x9e, 0x9b, 0x27, 0xcd, 0x31, 0x1f, 0x3e, ++ 0x50, 0x5a, 0x91, 0xad, 0x21, 0x1b, 0x97, 0x5b, 0xe8, 0xfa, 0x29, 0x8a, ++ 0xa4, 0x17, 0xe8, 0xab, 0x87, 0x02, 0xd6, 0x18, 0x8c, 0x9f, 0x65, 0xb7, ++ 0x2a, 0xfa, 0xde, 0x5f, 0x77, 0x30, 0x6c, 0x04, 0x22, 0xe6, 0x58, 0x26, ++ 0x14, 0x0d, 0x9c, 0x41, 0x0a, 0x82, 0x77, 0xdb, 0x40, 0xa1, 0x58, 0xac, ++ 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xb5, ++ 0x7e, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x20, 0x73, 0x69, 0x67, 0x6e, ++ 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, ++ 0x65, 0x64, 0x7e, 0x0a ++}; ++unsigned int hi_signed_2nd_len = 736; ++ ++unsigned char certificate_printable_der[] = { ++ 0x30, 0x82, 0x03, 0x39, 0x30, 0x82, 0x02, 0x21, 0xa0, 0x03, 0x02, 0x01, ++ 0x02, 0x02, 0x09, 0x00, 0xde, 0xf6, 0x22, 0xc4, 0xf2, 0xf1, 0x86, 0x02, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x0b, 0x05, 0x00, 0x30, 0x2a, 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, ++ 0x04, 0x03, 0x13, 0x1f, 0x52, 0x65, 0x64, 0x20, 0x48, 0x61, 0x74, 0x20, ++ 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x42, 0x6f, 0x6f, 0x74, 0x20, ++ 0x43, 0x41, 0x20, 0x32, 0x20, 0x28, 0x62, 0x65, 0x74, 0x61, 0x29, 0x30, ++ 0x1e, 0x17, 0x0d, 0x31, 0x34, 0x31, 0x30, 0x33, 0x31, 0x31, 0x34, 0x31, ++ 0x39, 0x32, 0x33, 0x5a, 0x17, 0x0d, 0x33, 0x37, 0x31, 0x30, 0x32, 0x35, ++ 0x31, 0x34, 0x31, 0x39, 0x32, 0x33, 0x5a, 0x30, 0x2f, 0x31, 0x2d, 0x30, ++ 0x2b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x24, 0x52, 0x65, 0x64, 0x20, ++ 0x48, 0x61, 0x74, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x42, ++ 0x6f, 0x6f, 0x74, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x20, ++ 0x33, 0x20, 0x28, 0x62, 0x65, 0x74, 0x61, 0x29, 0x30, 0x82, 0x01, 0x22, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, ++ 0x02, 0x82, 0x01, 0x01, 0x00, 0xbd, 0xda, 0xa1, 0xed, 0x8d, 0x8e, 0x15, ++ 0x5c, 0xf8, 0x01, 0x77, 0x48, 0x4a, 0x60, 0x96, 0xf9, 0x27, 0xfa, 0xe2, ++ 0xb1, 0x69, 0x0f, 0x51, 0x19, 0x52, 0x7e, 0xc4, 0x34, 0x8e, 0xe1, 0x9b, ++ 0x9c, 0xa4, 0xb1, 0x5c, 0xd6, 0x81, 0x98, 0x78, 0xfe, 0xa9, 0xe5, 0x0b, ++ 0x00, 0xba, 0x9c, 0x64, 0x7e, 0xc7, 0xcc, 0x72, 0xb1, 0x73, 0x4b, 0x11, ++ 0x07, 0x52, 0xf0, 0x20, 0x96, 0x8b, 0x99, 0x39, 0xde, 0xdb, 0xfa, 0x3d, ++ 0x45, 0xe2, 0x98, 0x7b, 0x0c, 0x41, 0xe4, 0x0c, 0xb5, 0x5d, 0x92, 0x74, ++ 0x39, 0x96, 0xe1, 0x97, 0x97, 0xa1, 0xad, 0x2e, 0xcc, 0xd0, 0x1b, 0x4d, ++ 0x9d, 0xbd, 0x3e, 0xa9, 0x36, 0x8e, 0xcc, 0xc7, 0x5f, 0x6a, 0x7d, 0x39, ++ 0x5e, 0x0b, 0x8d, 0xca, 0xe4, 0x83, 0xe9, 0x3b, 0x5c, 0x86, 0x47, 0xd4, ++ 0xba, 0x7d, 0x98, 0x26, 0xa1, 0xf4, 0xe8, 0x90, 0x6b, 0x0f, 0xf1, 0x6b, ++ 0x8c, 0xe3, 0xa2, 0x80, 0x3c, 0x96, 0xf1, 0x0a, 0xb6, 0x66, 0xc0, 0x4b, ++ 0x61, 0xf7, 0x74, 0xcd, 0xd3, 0x7b, 0x8e, 0x5e, 0x39, 0xda, 0x99, 0x20, ++ 0x33, 0x93, 0xd3, 0xf0, 0x7f, 0xad, 0x35, 0xe9, 0x88, 0x8d, 0x9c, 0xbf, ++ 0x65, 0xf1, 0x47, 0x02, 0xf9, 0x7c, 0xed, 0x27, 0x5f, 0x4a, 0x65, 0x3c, ++ 0xcf, 0x5f, 0x0e, 0x88, 0x95, 0x74, 0xde, 0xfb, 0x9e, 0x2e, 0x91, 0x9b, ++ 0x45, 0x37, 0xc8, 0x85, 0xff, 0xe3, 0x41, 0x70, 0xfe, 0xd5, 0xef, 0x0e, ++ 0x82, 0x22, 0x08, 0xb7, 0x3b, 0x44, 0x3e, 0xdc, 0x5b, 0x7f, 0xba, 0xbf, ++ 0xe6, 0x58, 0x9d, 0x02, 0x6e, 0x75, 0xbf, 0x50, 0xec, 0xcf, 0x3f, 0xa5, ++ 0x91, 0x0a, 0xe2, 0x59, 0x2c, 0xc3, 0xe7, 0x05, 0x03, 0xe8, 0xf2, 0x6f, ++ 0x2a, 0x04, 0x68, 0x9a, 0x31, 0x32, 0x8f, 0x04, 0x35, 0xcd, 0x1f, 0x34, ++ 0xcc, 0x4f, 0x79, 0x5a, 0x99, 0x8d, 0x9d, 0x5c, 0xf5, 0x02, 0x03, 0x01, ++ 0x00, 0x01, 0xa3, 0x5d, 0x30, 0x5b, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, ++ 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x0b, 0x06, 0x03, ++ 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x07, 0x80, 0x30, 0x1d, 0x06, ++ 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x65, 0xc5, 0xbe, 0xca, ++ 0xe6, 0x59, 0x6a, 0xfd, 0x6c, 0x71, 0xc4, 0xa7, 0x98, 0xc6, 0x25, 0x8d, ++ 0x7b, 0x67, 0x05, 0xd0, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, ++ 0x18, 0x30, 0x16, 0x80, 0x14, 0x81, 0xf8, 0xee, 0x47, 0x5c, 0x3e, 0xed, ++ 0xfb, 0xce, 0xa5, 0x84, 0xbe, 0xd7, 0xae, 0xdb, 0xd3, 0x7d, 0x64, 0xb3, ++ 0x2a, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, ++ 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x66, 0x1e, 0x3d, ++ 0x1d, 0x53, 0x33, 0xde, 0x4e, 0xc7, 0xc4, 0xf4, 0xdf, 0xda, 0x18, 0x19, ++ 0x8a, 0xa9, 0xff, 0xe2, 0x63, 0x2b, 0xbe, 0xf2, 0x61, 0x63, 0xe2, 0xf6, ++ 0xed, 0x47, 0x1a, 0x71, 0x02, 0xec, 0x2a, 0xef, 0x89, 0x77, 0xe3, 0xfd, ++ 0x86, 0x69, 0xf1, 0x3f, 0x0d, 0xf9, 0x6e, 0xf9, 0x3b, 0xad, 0x26, 0x47, ++ 0xb7, 0xf2, 0x0d, 0xad, 0x23, 0xa3, 0x67, 0x3b, 0xcb, 0x6d, 0x9e, 0x03, ++ 0x0f, 0xbc, 0x69, 0x73, 0x9f, 0xd4, 0xa5, 0x0f, 0x6f, 0xf8, 0xab, 0x4d, ++ 0x36, 0xd1, 0xe0, 0xe0, 0x5d, 0x20, 0x43, 0x90, 0xc4, 0x65, 0x61, 0x93, ++ 0xe2, 0x0f, 0x51, 0x59, 0x0a, 0xf7, 0x88, 0x70, 0x57, 0xb9, 0x04, 0xa9, ++ 0x32, 0x57, 0x9c, 0xb3, 0x57, 0x38, 0x8b, 0x8e, 0x46, 0xc8, 0x32, 0x6c, ++ 0xb4, 0xf3, 0x96, 0x7f, 0x4b, 0xf0, 0x88, 0xf9, 0x7f, 0xe2, 0x71, 0xe1, ++ 0x8b, 0xe2, 0x14, 0xf1, 0x4b, 0x25, 0x00, 0x48, 0x1c, 0x7e, 0xe5, 0x8d, ++ 0x65, 0x2d, 0xeb, 0x72, 0x4f, 0x92, 0x44, 0xf3, 0xe6, 0xe0, 0xd0, 0xdf, ++ 0x85, 0xa8, 0x13, 0x4a, 0xfb, 0x99, 0xca, 0x14, 0x2c, 0x97, 0x80, 0x93, ++ 0x27, 0xd3, 0x20, 0xf8, 0x6d, 0x29, 0x28, 0x2c, 0xb9, 0x77, 0xea, 0xb1, ++ 0x63, 0xbd, 0x7d, 0x53, 0xfd, 0x4a, 0x62, 0x64, 0x0b, 0x98, 0xa8, 0xae, ++ 0x11, 0xfc, 0x6e, 0x8d, 0x63, 0xd4, 0x15, 0x55, 0xc6, 0x4c, 0x74, 0xf5, ++ 0x5f, 0xa0, 0xb9, 0x2c, 0x2d, 0x9a, 0x7a, 0x87, 0x6e, 0xf0, 0x5e, 0x25, ++ 0xed, 0xfc, 0xd8, 0xc4, 0x34, 0x33, 0x32, 0xad, 0x01, 0xd4, 0x4b, 0x49, ++ 0x51, 0xc2, 0x07, 0x7f, 0x90, 0x6d, 0xea, 0xf5, 0x4c, 0x41, 0x71, 0x64, ++ 0xeb, 0x1f, 0x29, 0xa3, 0x1f, 0x64, 0xa2, 0x1e, 0x0e, 0x6f, 0xa1, 0x67, ++ 0x99, 0x8d, 0x98, 0x1c, 0xb8, 0x53, 0x9d, 0x30, 0x1d, 0xae, 0x32, 0x56, ++ 0xd2 ++}; ++unsigned int certificate_printable_der_len = 829; diff --git a/0148-tpm2-Add-TPM2-types-structures-and-command-constants.patch b/0148-tpm2-Add-TPM2-types-structures-and-command-constants.patch deleted file mode 100644 index 8bf183e..0000000 --- a/0148-tpm2-Add-TPM2-types-structures-and-command-constants.patch +++ /dev/null @@ -1,205 +0,0 @@ -From 848137a5ddd13c4f5805d1d6f42b362a36bbb285 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Tue, 7 Feb 2023 18:31:12 +0800 -Subject: [PATCH 148/272] tpm2: Add TPM2 types, structures, and command - constants - -Add new TPM2 types and structures as the preparation to support -authorized policy. - -* New types: - TPM_ALG_ECDAA, TPM_ALG_ECDSA, TPM_ALG_ECSCHNORR, TPM_ALG_RSASSA, - TPM_ALG_RSAPSS, TPM_ALG_SM2, and TPMI_ALG_SIG_SCHEME - -* New structures: - TPMS_EMPTY, TPMS_SIGNATURE_RSA, TPMS_SIGNATURE_ECC, - TPMS_SIGNATURE_ECDSA, TPMS_SIGNATURE_ECDAA, TPMS_SIGNATURE_SM2, - TPMS_SIGNATURE_ECSCHNORR, TPMU_SIGNATURE, and TPMT_TK_VERIFIED - -* New command constants: - TPM_CC_LoadExternal, TPM_CC_HashSequenceStart, TPM_CC_SequenceUpdate, - TPM_CC_SequenceComplete, TPM_CC_Hash, TPM_CC_VerifySignature, - TPM_CC_PolicyAuthorize - -Signed-off-by: Gary Lin ---- - include/grub/tpm2/internal/structs.h | 86 ++++++++++++++++++++++++++++ - include/grub/tpm2/internal/types.h | 42 +++++++++----- - 2 files changed, 114 insertions(+), 14 deletions(-) - -diff --git a/include/grub/tpm2/internal/structs.h b/include/grub/tpm2/internal/structs.h -index 72d71eb70..db9eb6cf6 100644 ---- a/include/grub/tpm2/internal/structs.h -+++ b/include/grub/tpm2/internal/structs.h -@@ -672,4 +672,90 @@ struct TPMT_TK_CREATION - }; - typedef struct TPMT_TK_CREATION TPMT_TK_CREATION; - -+/* TPMS_EMPTY Structure */ -+struct TPMS_EMPTY { -+ grub_uint8_t empty[1]; /* a structure with no member */ -+}; -+typedef struct TPMS_EMPTY TPMS_EMPTY; -+ -+/* TPMS_SIGNATURE_RSA Structure */ -+struct TPMS_SIGNATURE_RSA { -+ TPMI_ALG_HASH hash; -+ TPM2B_PUBLIC_KEY_RSA sig; -+}; -+typedef struct TPMS_SIGNATURE_RSA TPMS_SIGNATURE_RSA; -+ -+/* Definition of Types for RSA Signature */ -+typedef TPMS_SIGNATURE_RSA TPMS_SIGNATURE_RSASSA; -+typedef TPMS_SIGNATURE_RSA TPMS_SIGNATURE_RSAPSS; -+ -+/* TPMS_SIGNATURE_ECC Structure */ -+struct TPMS_SIGNATURE_ECC { -+ TPMI_ALG_HASH hash; -+ TPM2B_ECC_PARAMETER signatureR; -+ TPM2B_ECC_PARAMETER signatureS; -+}; -+typedef struct TPMS_SIGNATURE_ECC TPMS_SIGNATURE_ECC; -+ -+/* Definition of Types for ECC TPMS_SIGNATURE_ECC */ -+typedef TPMS_SIGNATURE_ECC TPMS_SIGNATURE_ECDSA; -+typedef TPMS_SIGNATURE_ECC TPMS_SIGNATURE_ECDAA; -+typedef TPMS_SIGNATURE_ECC TPMS_SIGNATURE_SM2; -+typedef TPMS_SIGNATURE_ECC TPMS_SIGNATURE_ECSCHNORR; -+ -+/* TPMU_SIGNATURE Structure */ -+union TPMU_SIGNATURE { -+ TPMS_SIGNATURE_RSASSA rsassa; -+ TPMS_SIGNATURE_RSAPSS rsapss; -+ TPMS_SIGNATURE_ECDSA ecdsa; -+ TPMS_SIGNATURE_ECDAA ecdaa; -+ TPMS_SIGNATURE_SM2 sm2; -+ TPMS_SIGNATURE_ECSCHNORR ecschnorr; -+ TPMT_HA hmac; -+ TPMS_SCHEME_HASH any; -+ TPMS_EMPTY null; -+}; -+typedef union TPMU_SIGNATURE TPMU_SIGNATURE; -+ -+/* TPMT_SIGNATURE Structure */ -+struct TPMT_SIGNATURE { -+ TPMI_ALG_SIG_SCHEME sigAlg; -+ TPMU_SIGNATURE signature; -+}; -+typedef struct TPMT_SIGNATURE TPMT_SIGNATURE; -+ -+static inline TPMI_ALG_HASH -+TPMT_SIGNATURE_get_hash_alg (TPMT_SIGNATURE *sig) -+{ -+ switch (sig->sigAlg) -+ { -+ case TPM_ALG_RSASSA: -+ return sig->signature.rsassa.hash; -+ case TPM_ALG_RSAPSS: -+ return sig->signature.rsapss.hash; -+ case TPM_ALG_ECDSA: -+ return sig->signature.ecdsa.hash; -+ case TPM_ALG_ECDAA: -+ return sig->signature.ecdaa.hash; -+ case TPM_ALG_SM2: -+ return sig->signature.sm2.hash; -+ case TPM_ALG_ECSCHNORR: -+ return sig->signature.ecschnorr.hash; -+ case TPM_ALG_HMAC: -+ return sig->signature.hmac.hashAlg; -+ default: -+ break; -+ } -+ -+ return TPM_ALG_NULL; -+} -+ -+/* TPMT_TK_VERIFIED Structure */ -+struct TPMT_TK_VERIFIED { -+ TPM_ST tag; -+ TPMI_RH_HIERARCHY hierarchy; -+ TPM2B_DIGEST digest; -+}; -+typedef struct TPMT_TK_VERIFIED TPMT_TK_VERIFIED; -+ - #endif /* ! GRUB_TPM2_INTERNAL_STRUCTS_HEADER */ -diff --git a/include/grub/tpm2/internal/types.h b/include/grub/tpm2/internal/types.h -index 9118cad5d..4eef085f1 100644 ---- a/include/grub/tpm2/internal/types.h -+++ b/include/grub/tpm2/internal/types.h -@@ -181,6 +181,9 @@ typedef grub_uint16_t TPM_ALG_ID; - #define TPM_ALG_CFB ((TPM_ALG_ID) 0x0043) - #define TPM_ALG_ECB ((TPM_ALG_ID) 0x0044) - #define TPM_ALG_ECC ((TPM_ALG_ID) 0x0023) -+#define TPM_ALG_ECDAA ((TPM_ALG_ID) 0x001A) -+#define TPM_ALG_ECDSA ((TPM_ALG_ID) 0x0018) -+#define TPM_ALG_ECSCHNORR ((TPM_ALG_ID) 0x001C) - #define TPM_ALG_HMAC ((TPM_ALG_ID) 0x0005) - #define TPM_ALG_KDF1_SP800_108 ((TPM_ALG_ID) 0x0022) - #define TPM_ALG_KDF1_SP800_56A ((TPM_ALG_ID) 0x0020) -@@ -189,10 +192,13 @@ typedef grub_uint16_t TPM_ALG_ID; - #define TPM_ALG_MGF1 ((TPM_ALG_ID) 0x0007) - #define TPM_ALG_NULL ((TPM_ALG_ID) 0x0010) - #define TPM_ALG_RSA ((TPM_ALG_ID) 0x0001) -+#define TPM_ALG_RSASSA ((TPM_ALG_ID) 0x0014) -+#define TPM_ALG_RSAPSS ((TPM_ALG_ID) 0x0016) - #define TPM_ALG_SHA1 ((TPM_ALG_ID) 0x0004) - #define TPM_ALG_SHA256 ((TPM_ALG_ID) 0x000B) - #define TPM_ALG_SHA384 ((TPM_ALG_ID) 0x000C) - #define TPM_ALG_SHA512 ((TPM_ALG_ID) 0x000D) -+#define TPM_ALG_SM2 ((TPM_ALG_ID) 0x001B) - #define TPM_ALG_SM3_256 ((TPM_ALG_ID) 0x0012) - #define TPM_ALG_SM4 ((TPM_ALG_ID) 0x0013) - #define TPM_ALG_SYMCIPHER ((TPM_ALG_ID) 0x0025) -@@ -299,20 +305,27 @@ typedef grub_uint16_t TPM_ECC_CURVE; - /* TPM_CC Constants */ - typedef grub_uint32_t TPM_CC; - --#define TPM_CC_EvictControl ((TPM_CC) 0x00000120) --#define TPM_CC_CreatePrimary ((TPM_CC) 0x00000131) --#define TPM_CC_Create ((TPM_CC) 0x00000153) --#define TPM_CC_FlushContext ((TPM_CC) 0x00000165) --#define TPM_CC_ReadPublic ((TPM_CC) 0x00000173) --#define TPM_CC_StartAuthSession ((TPM_CC) 0x00000176) --#define TPM_CC_PolicyPCR ((TPM_CC) 0x0000017f) --#define TPM_CC_NV_Read ((TPM_CC) 0x0000014e) --#define TPM_CC_NV_ReadPublic ((TPM_CC) 0x00000169) --#define TPM_CC_GetCapability ((TPM_CC) 0x0000017a) --#define TPM_CC_PCR_Read ((TPM_CC) 0x0000017e) --#define TPM_CC_Load ((TPM_CC) 0x00000157) --#define TPM_CC_Unseal ((TPM_CC) 0x0000015e) --#define TPM_CC_PolicyGetDigest ((TPM_CC) 0x00000189) -+#define TPM_CC_EvictControl ((TPM_CC) 0x00000120) -+#define TPM_CC_CreatePrimary ((TPM_CC) 0x00000131) -+#define TPM_CC_Create ((TPM_CC) 0x00000153) -+#define TPM_CC_FlushContext ((TPM_CC) 0x00000165) -+#define TPM_CC_ReadPublic ((TPM_CC) 0x00000173) -+#define TPM_CC_StartAuthSession ((TPM_CC) 0x00000176) -+#define TPM_CC_PolicyPCR ((TPM_CC) 0x0000017f) -+#define TPM_CC_NV_Read ((TPM_CC) 0x0000014e) -+#define TPM_CC_NV_ReadPublic ((TPM_CC) 0x00000169) -+#define TPM_CC_GetCapability ((TPM_CC) 0x0000017a) -+#define TPM_CC_PCR_Read ((TPM_CC) 0x0000017e) -+#define TPM_CC_Load ((TPM_CC) 0x00000157) -+#define TPM_CC_LoadExternal ((TPM_CC) 0x00000167) -+#define TPM_CC_Unseal ((TPM_CC) 0x0000015e) -+#define TPM_CC_PolicyGetDigest ((TPM_CC) 0x00000189) -+#define TPM_CC_HashSequenceStart ((TPM_CC) 0x00000186) -+#define TPM_CC_SequenceUpdate ((TPM_CC) 0x0000015c) -+#define TPM_CC_SequenceComplete ((TPM_CC) 0x0000013e) -+#define TPM_CC_Hash ((TPM_CC) 0x0000017d) -+#define TPM_CC_VerifySignature ((TPM_CC) 0x00000177) -+#define TPM_CC_PolicyAuthorize ((TPM_CC) 0x0000016a) - - /* Hash algorithm sizes */ - #define TPM_SHA1_DIGEST_SIZE 20 -@@ -354,6 +367,7 @@ typedef TPM_ALG_ID TPMI_ALG_ECC_SCHEME; - typedef TPM_ALG_ID TPMI_ALG_ASYM_SCHEME; - typedef TPM_ALG_ID TPMI_ALG_RSA_SCHEME; - typedef TPM_ALG_ID TPMI_ALG_SYM; -+typedef TPM_ALG_ID TPMI_ALG_SIG_SCHEME; - - /* TPM_KEY_BITS Type */ - typedef grub_uint16_t TPM_KEY_BITS; --- -2.41.0 - diff --git a/0114-appended-signatures-documentation.patch b/0149-appended-signatures-documentation.patch similarity index 78% rename from 0114-appended-signatures-documentation.patch rename to 0149-appended-signatures-documentation.patch index 3d87ba0..c212ed3 100644 --- a/0114-appended-signatures-documentation.patch +++ b/0149-appended-signatures-documentation.patch @@ -1,7 +1,7 @@ -From c3de90cea7f40361fa6cd317d9afc9ea5249c50e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 1 Oct 2020 13:02:09 +1000 -Subject: [PATCH 114/272] appended signatures: documentation +Subject: [PATCH] appended signatures: documentation This explains how appended signatures can be used to form part of a secure boot chain, and documents the commands and variables @@ -9,14 +9,14 @@ introduced. Signed-off-by: Daniel Axtens --- - docs/grub.texi | 193 ++++++++++++++++++++++++++++++++++++++++++++----- - 1 file changed, 176 insertions(+), 17 deletions(-) + docs/grub.texi | 199 ++++++++++++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 182 insertions(+), 17 deletions(-) diff --git a/docs/grub.texi b/docs/grub.texi -index fb41419da..4bb71c019 100644 +index 0ac0a1b3735..eab81718a59 100644 --- a/docs/grub.texi +++ b/docs/grub.texi -@@ -3270,6 +3270,7 @@ These variables have special meaning to GRUB. +@@ -3275,6 +3275,7 @@ These variables have special meaning to GRUB. @menu * biosnum:: @@ -24,7 +24,7 @@ index fb41419da..4bb71c019 100644 * check_signatures:: * chosen:: * cmdpath:: -@@ -3334,11 +3335,18 @@ For an alternative approach which also changes BIOS drive mappings for the +@@ -3339,11 +3340,18 @@ For an alternative approach which also changes BIOS drive mappings for the chain-loaded system, @pxref{drivemap}. @@ -45,7 +45,7 @@ index fb41419da..4bb71c019 100644 @node chosen @subsection chosen -@@ -4357,6 +4365,7 @@ you forget a command, you can run the command @command{help} +@@ -4362,6 +4370,7 @@ you forget a command, you can run the command @command{help} * date:: Display or set current date and time * devicetree:: Load a device tree blob * distrust:: Remove a pubkey from trusted keys @@ -53,7 +53,7 @@ index fb41419da..4bb71c019 100644 * drivemap:: Map a drive to another * echo:: Display a line of text * efitextmode:: Set/Get text output mode resolution -@@ -4373,6 +4382,7 @@ you forget a command, you can run the command @command{help} +@@ -4378,6 +4387,7 @@ you forget a command, you can run the command @command{help} * hexdump:: Show raw contents of a file or memory * insmod:: Insert a module * keystatus:: Check key modifier status @@ -61,7 +61,7 @@ index fb41419da..4bb71c019 100644 * list_env:: List variables in environment block * list_trusted:: List trusted public keys * load_env:: Load variables from environment block -@@ -4411,8 +4421,10 @@ you forget a command, you can run the command @command{help} +@@ -4416,8 +4426,10 @@ you forget a command, you can run the command @command{help} * test:: Check file types and compare values * true:: Do nothing, successfully * trust:: Add public key to list of trusted keys @@ -72,14 +72,14 @@ index fb41419da..4bb71c019 100644 * verify_detached:: Verify detached digital signature * videoinfo:: List available video modes * wrmsr:: Write values to model-specific registers -@@ -4752,9 +4764,28 @@ These keys are used to validate signatures when environment variable +@@ -4757,9 +4769,28 @@ These keys are used to validate signatures when environment variable @code{check_signatures} is set to @code{enforce} (@pxref{check_signatures}), and by some invocations of @command{verify_detached} (@pxref{verify_detached}). @xref{Using -digital signatures}, for more information. +GPG-style digital signatures}, for more information. -+@end deffn -+ + @end deffn + + +@node distrust_certificate +@subsection distrust_certificate @@ -92,17 +92,17 @@ index fb41419da..4bb71c019 100644 +@command{list_certificates} (@pxref{list_certificates}). + +These certificates are used to validate appended signatures when environment -+variable @code{check_appended_signatures} is set to @code{enforce} -+(@pxref{check_appended_signatures}), and by @command{verify_appended} -+(@pxref{verify_appended}). See @xref{Using appended signatures} for more -+information. - @end deffn - ++variable @code{check_appended_signatures} is set to @code{enforce} or ++@code{forced} (@pxref{check_appended_signatures}), and by ++@command{verify_appended} (@pxref{verify_appended}). See ++@xref{Using appended signatures} for more information. ++@end deffn ++ + @node drivemap @subsection drivemap -@@ -5031,6 +5062,21 @@ only if checking key modifier status is supported. +@@ -5036,6 +5067,21 @@ only if checking key modifier status is supported. @end deffn @@ -124,7 +124,7 @@ index fb41419da..4bb71c019 100644 @node list_env @subsection list_env -@@ -5050,7 +5096,7 @@ The output is in GPG's v4 key fingerprint format (i.e., the output of +@@ -5055,7 +5101,7 @@ The output is in GPG's v4 key fingerprint format (i.e., the output of @code{gpg --fingerprint}). The least significant four bytes (last eight hexadecimal digits) can be used as an argument to @command{distrust} (@pxref{distrust}). @@ -133,7 +133,7 @@ index fb41419da..4bb71c019 100644 these keys. @end deffn -@@ -5085,8 +5131,12 @@ When used with care, @option{--skip-sig} and the whitelist enable an +@@ -5090,8 +5136,13 @@ When used with care, @option{--skip-sig} and the whitelist enable an administrator to configure a system to boot only signed configurations, but to allow the user to select from among multiple configurations, and to enable ``one-shot'' boot attempts and @@ -143,11 +143,12 @@ index fb41419da..4bb71c019 100644 + +Extra care should be taken when combining this command with appended signatures +(@pxref{Using appended signatures}), as this file is not validated by an -+appended signature and could set @code{check_appended_signatures=no}. ++appended signature and could set @code{check_appended_signatures=no} if GRUB is ++not in @pxref{Lockdown} mode. @end deffn -@@ -5457,7 +5507,7 @@ read. It is possible to modify a digitally signed environment block +@@ -5462,7 +5513,7 @@ read. It is possible to modify a digitally signed environment block file from within GRUB using this command, such that its signature will no longer be valid on subsequent boots. Care should be taken in such advanced configurations to avoid rendering the system @@ -156,7 +157,7 @@ index fb41419da..4bb71c019 100644 @end deffn -@@ -5873,11 +5923,31 @@ signatures when environment variable @code{check_signatures} is set to +@@ -5878,11 +5929,32 @@ signatures when environment variable @code{check_signatures} is set to must itself be properly signed. The @option{--skip-sig} option can be used to disable signature-checking when reading @var{pubkey_file} itself. It is expected that @option{--skip-sig} is useful for testing @@ -170,17 +171,18 @@ index fb41419da..4bb71c019 100644 +@subsection trust_certificate + +@deffn Command trust_certificate x509_certificate -+Read a DER-formatted x509 certificate from the file @var{x509_certificate} ++Read an DER-formatted x509 certificate from the file @var{x509_certificate} +and add it to GRUB's internal list of trusted x509 certificates. These +certificates are used to validate appended signatures when the environment -+variable @code{check_appended_signatures} is set to @code{enforce}. ++variable @code{check_appended_signatures} is set to @code{enforce} or ++@code{forced}. + -+Note that if @code{check_appended_signatures} is set to @code{enforce} -+when @command{trust_certificate} is executed, then @var{x509_certificate} -+must itself bear an appended signature. (It is not sufficient that -+@var{x509_certificate} be signed by a trusted certificate according to the -+x509 rules: grub does not include support for validating signatures within x509 -+certificates themselves.) ++Note that if @code{check_appended_signatures} is set to @code{enforce} or ++@code{forced} when @command{trust_certificate} is executed, then ++@var{x509_certificate} must itself bear an appended signature. (It is not ++sufficient that @var{x509_certificate} be signed by a trusted certificate ++according to the x509 rules: grub does not include support for validating ++signatures within x509 certificates themselves.) + +See @xref{Using appended signatures} for more information. +@end deffn @@ -189,7 +191,7 @@ index fb41419da..4bb71c019 100644 @node unset @subsection unset -@@ -5896,6 +5966,18 @@ only on PC BIOS platforms. +@@ -5901,6 +5973,18 @@ only on PC BIOS platforms. @end deffn @end ignore @@ -208,7 +210,7 @@ index fb41419da..4bb71c019 100644 @node verify_detached @subsection verify_detached -@@ -5914,7 +5996,7 @@ tried. +@@ -5919,7 +6003,7 @@ tried. Exit code @code{$?} is set to 0 if the signature validates successfully. If validation fails, it is set to a non-zero value. @@ -217,7 +219,7 @@ index fb41419da..4bb71c019 100644 @end deffn @node videoinfo -@@ -6394,13 +6476,14 @@ environment variables and commands are listed in the same order. +@@ -6397,13 +6481,14 @@ environment variables and commands are listed in the same order. @chapter Security @menu @@ -239,7 +241,7 @@ index fb41419da..4bb71c019 100644 @end menu @node Authentication and authorisation -@@ -6474,8 +6557,8 @@ generating configuration files with authentication. You can use +@@ -6477,8 +6562,8 @@ generating configuration files with authentication. You can use adding @kbd{set superusers=} and @kbd{password} or @kbd{password_pbkdf2} commands. @@ -250,7 +252,7 @@ index fb41419da..4bb71c019 100644 GRUB's @file{core.img} can optionally provide enforcement that all files subsequently read from disk are covered by a valid digital signature. -@@ -6558,6 +6641,82 @@ or BIOS) configuration to cause the machine to boot from a different +@@ -6571,6 +6656,86 @@ or BIOS) configuration to cause the machine to boot from a different (attacker-controlled) device. GRUB is at best only one link in a secure boot chain. @@ -266,11 +268,7 @@ index fb41419da..4bb71c019 100644 +~Module signature appended~\n +@end example + -+where @code{\n} represents the carriage-return character, @code{0x0a}. -+ -+To enable appended signature verification, load the appendedsig module and an -+x509 certificate for verification. Building the appendedsig module into the -+core grub image is recommended. ++where @code{\n} represents the line-feed character, @code{0x0a}. + +Certificates can be managed at boot time using the @pxref{trust_certificate}, +@pxref{distrust_certificate} and @pxref{list_certificates} commands. @@ -291,32 +289,32 @@ index fb41419da..4bb71c019 100644 +@end example + +Enforcement of signature verification is controlled by the -+@code{check_appended_signatures} variable. Verification will only take place -+when files are loaded if the variable is set to @code{enforce}. If a -+certificate is built into the grub core image with the @code{--x509} parameter, -+the variable will be automatically set to @code{enforce} when the appendedsig -+module is loaded. ++@code{check_appended_signatures} variable. ++ ++@itemize ++@item @samp{no}: no verification is performed. This is the default when GRUB ++ is not in @pxref{Lockdown} mode. ++@item @samp{enforce}: verification is performed. Verification can be disabled ++ by setting the variable back to @samp{no}. ++@item @samp{forced}: verification is performed and cannot be disabled. This is ++ set when GRUB is in Lockdown when the appendedsig module is loaded. ++@end itemize + +Unlike GPG-style signatures, not all files loaded by GRUB are required to be -+signed. Once verification is turned on, the following file types must carry -+appended signatures: ++signed. Once verification is turned on, the following file types will have ++appended signatures verified: + -+@enumerate -+@item Linux, Multiboot, BSD, XNU and Plan9 kernels -+@item Grub modules, except those built in to the core image ++@itemize ++@item Linux kernels ++@item GRUB modules, except those built into the core image +@item Any new certificate files to be trusted -+@end enumerate ++@end itemize + +ACPI tables and Device Tree images will not be checked for appended signatures +but must be verified by another mechanism such as GPG-style signatures before +they will be loaded. + -+No attempt is made to validate any other file type. In particular, -+chain-loaded binaries are not verified - if your platform supports -+chain-loading and this cannot be disabled, consider an alternative secure -+boot mechanism. -+ -+As with GPG-style appended signatures, signature checking does @strong{not} ++Unless lockdown mode is enabled, signature checking does @strong{not} +stop an attacker with console access from dropping manually to the GRUB +console and executing: + @@ -327,12 +325,17 @@ index fb41419da..4bb71c019 100644 +Refer to the section on password-protecting GRUB (@pxref{Authentication +and authorisation}) for more information on preventing this. + -+Additionally, special care must be taken around the @command{loadenv} command, -+which can be used to turn off @code{check_appended_signature}. ++Additionally, unless lockdown mode is enabled: ++ ++@itemize ++@item Special care must be taken around the @command{loadenv} command, which ++ can be used to turn off @code{check_appended_signature}. ++ ++@item If the grub configuration file is loaded from the disk, anyone who can ++ modify the file on disk can turn off @code{check_appended_signature}. ++ Consider embedding the configuration into the core grub image. ++@end itemize + @node UEFI secure boot and shim @section UEFI secure boot and shim support --- -2.41.0 - diff --git a/0149-tpm2-Add-more-marshal-unmarshal-functions.patch b/0149-tpm2-Add-more-marshal-unmarshal-functions.patch deleted file mode 100644 index bd0a808..0000000 --- a/0149-tpm2-Add-more-marshal-unmarshal-functions.patch +++ /dev/null @@ -1,427 +0,0 @@ -From 05182e68dd9e1887128cb5aedb75767d548b5e17 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Tue, 7 Feb 2023 18:33:42 +0800 -Subject: [PATCH 149/272] tpm2: Add more marshal/unmarshal functions - -Add a few more marshal/unmarshal functions to support authorized policy. - -* Marshal: - grub_tpm2_mu_TPMU_SENSITIVE_COMPOSITE_Marshal() - grub_tpm2_mu_TPMT_SENSITIVE_Marshal() - grub_tpm2_mu_TPM2B_SENSITIVE_Marshal() - grub_tpm2_mu_TPMS_SIGNATURE_RSA_Marshal() - grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal() - grub_tpm2_mu_TPMU_HA_Marshal() - grub_tpm2_mu_TPMT_HA_Marshal() - grub_tpm2_mu_TPMU_SIGNATURE_Marshal() - grub_tpm2_mu_TPMT_SIGNATURE_Marshal() - grub_tpm2_mu_TPMT_TK_VERIFIED_Marshal() - -* Unmarshal: - grub_tpm2_mu_TPMT_TK_HASHCHECK_Unmarshal() - grub_tpm2_mu_TPMT_TK_VERIFIED_Unmarshal() - grub_tpm2_mu_TPMS_SIGNATURE_RSA_Unmarshal() - grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal() - grub_tpm2_mu_TPMU_HA_Unmarshal() - grub_tpm2_mu_TPMT_HA_Unmarshal() - grub_tpm2_mu_TPMU_SIGNATURE_Unmarshal() - grub_tpm2_mu_TPMT_SIGNATURE_Unmarshal() - -Signed-off-by: Gary Lin ---- - grub-core/tpm2/mu.c | 262 +++++++++++++++++++++++++++++++++++++++++ - include/grub/tpm2/mu.h | 75 ++++++++++++ - 2 files changed, 337 insertions(+) - -diff --git a/grub-core/tpm2/mu.c b/grub-core/tpm2/mu.c -index 1617f37cd..3a9a3c1be 100644 ---- a/grub-core/tpm2/mu.c -+++ b/grub-core/tpm2/mu.c -@@ -383,6 +383,49 @@ grub_tpm2_mu_TPMS_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buffer, - grub_tpm2_mu_TPM2B_Marshal (buffer, p->data.size, p->data.buffer); - } - -+void -+grub_tpm2_mu_TPMU_SENSITIVE_COMPOSITE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_PUBLIC type, -+ const TPMU_SENSITIVE_COMPOSITE *p) -+{ -+ switch(type) -+ { -+ case TPM_ALG_RSA: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->rsa.size, p->rsa.buffer); -+ break; -+ case TPM_ALG_ECC: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->ecc.size, p->ecc.buffer); -+ break; -+ case TPM_ALG_KEYEDHASH: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->bits.size, p->bits.buffer); -+ break; -+ case TPM_ALG_SYMCIPHER: -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->sym.size, p->sym.buffer); -+ break; -+ default: -+ buffer->error = 1; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_SENSITIVE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_SENSITIVE *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->sensitiveType); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->authValue.size, p->authValue.buffer); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->seedValue.size, p->seedValue.buffer); -+ grub_tpm2_mu_TPMU_SENSITIVE_COMPOSITE_Marshal (buffer, p->sensitiveType, -+ &p->sensitive); -+} -+ -+void -+grub_tpm2_mu_TPM2B_SENSITIVE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPM2B_SENSITIVE *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->size); -+ grub_tpm2_mu_TPMT_SENSITIVE_Marshal (buffer, &p->sensitiveArea); -+} -+ - void - grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buffer, - const TPM2B_SENSITIVE_CREATE *sensitiveCreate) -@@ -405,6 +448,113 @@ grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buffer, - grub_tpm2_buffer_pack_u16 (buffer, 0); - } - -+void -+grub_tpm2_mu_TPMS_SIGNATURE_RSA_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SIGNATURE_RSA *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->hash); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->sig.size, p->sig.buffer); -+} -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMS_SIGNATURE_ECC *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->hash); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->signatureR.size, p->signatureR.buffer); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->signatureS.size, p->signatureS.buffer); -+} -+ -+void -+grub_tpm2_mu_TPMU_HA_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_HASH hashAlg, -+ const TPMU_HA *p) -+{ -+ switch (hashAlg) -+ { -+ case TPM_ALG_SHA1: -+ for (grub_uint16_t i = 0; i < TPM_SHA1_DIGEST_SIZE; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, p->sha1[i]); -+ break; -+ case TPM_ALG_SHA256: -+ for (grub_uint16_t i = 0; i < TPM_SHA256_DIGEST_SIZE; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, p->sha256[i]); -+ break; -+ case TPM_ALG_SHA384: -+ for (grub_uint16_t i = 0; i < TPM_SHA384_DIGEST_SIZE; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, p->sha384[i]); -+ break; -+ case TPM_ALG_SHA512: -+ for (grub_uint16_t i = 0; i < TPM_SHA512_DIGEST_SIZE; i++) -+ grub_tpm2_buffer_pack_u8 (buffer, p->sha512[i]); -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_HA_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_HA *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->hashAlg); -+ grub_tpm2_mu_TPMU_HA_Marshal (buffer, p->hashAlg, &p->digest); -+} -+ -+void -+grub_tpm2_mu_TPMU_SIGNATURE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMI_ALG_SIG_SCHEME sigAlg, -+ const TPMU_SIGNATURE *p) -+{ -+ switch (sigAlg) -+ { -+ case TPM_ALG_RSASSA: -+ grub_tpm2_mu_TPMS_SIGNATURE_RSA_Marshal (buffer, (TPMS_SIGNATURE_RSA *)&p->rsassa); -+ break; -+ case TPM_ALG_RSAPSS: -+ grub_tpm2_mu_TPMS_SIGNATURE_RSA_Marshal (buffer, (TPMS_SIGNATURE_RSA *)&p->rsapss); -+ break; -+ case TPM_ALG_ECDSA: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecdsa); -+ break; -+ case TPM_ALG_ECDAA: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecdaa); -+ break; -+ case TPM_ALG_SM2: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (buffer, (TPMS_SIGNATURE_ECC *)&p->sm2); -+ break; -+ case TPM_ALG_ECSCHNORR: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecschnorr); -+ break; -+ case TPM_ALG_HMAC: -+ grub_tpm2_mu_TPMT_HA_Marshal (buffer, &p->hmac); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_SIGNATURE_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_SIGNATURE *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->sigAlg); -+ grub_tpm2_mu_TPMU_SIGNATURE_Marshal (buffer, p->sigAlg, &p->signature); -+} -+ -+void -+grub_tpm2_mu_TPMT_TK_VERIFIED_Marshal (grub_tpm2_buffer_t buffer, -+ const TPMT_TK_VERIFIED *p) -+{ -+ grub_tpm2_buffer_pack_u16 (buffer, p->tag); -+ grub_tpm2_buffer_pack_u32 (buffer, p->hierarchy); -+ grub_tpm2_mu_TPM2B_Marshal (buffer, p->digest.size, p->digest.buffer); -+} -+ - void - grub_tpm2_mu_TPM2B_Unmarshal (grub_tpm2_buffer_t buffer, - TPM2B* p) -@@ -775,6 +925,24 @@ grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (grub_tpm2_buffer_t buffer, - grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->digest); - } - -+void -+grub_tpm2_mu_TPMT_TK_HASHCHECK_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_TK_HASHCHECK *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->tag); -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->hierarchy); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->digest); -+} -+ -+void -+grub_tpm2_mu_TPMT_TK_VERIFIED_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_TK_VERIFIED *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->tag); -+ grub_tpm2_buffer_unpack_u32 (buffer, &p->hierarchy); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*) &p->digest); -+} -+ - void - grub_tpm2_mu_TPMS_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, - TPMS_PCR_SELECTION* pcrSelection) -@@ -805,3 +973,97 @@ grub_tpm2_mu_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buf, - for (grub_uint32_t i = 0; i < digest->count; i++) - grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (buf, &digest->digests[i]); - } -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_SIGNATURE_RSA *rsa) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &rsa->hash); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*)&rsa->sig); -+} -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMS_SIGNATURE_ECC *ecc) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &ecc->hash); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*)&ecc->signatureR); -+ grub_tpm2_mu_TPM2B_Unmarshal (buffer, (TPM2B*)&ecc->signatureS); -+} -+ -+void -+grub_tpm2_mu_TPMU_HA_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_HASH hashAlg, -+ TPMU_HA *p) -+{ -+ switch (hashAlg) -+ { -+ case TPM_ALG_SHA1: -+ grub_tpm2_buffer_unpack (buffer, &p->sha1, TPM_SHA1_DIGEST_SIZE); -+ break; -+ case TPM_ALG_SHA256: -+ grub_tpm2_buffer_unpack (buffer, &p->sha256, TPM_SHA256_DIGEST_SIZE); -+ break; -+ case TPM_ALG_SHA384: -+ grub_tpm2_buffer_unpack (buffer, &p->sha384, TPM_SHA384_DIGEST_SIZE); -+ break; -+ case TPM_ALG_SHA512: -+ grub_tpm2_buffer_unpack (buffer, &p->sha512, TPM_SHA512_DIGEST_SIZE); -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_HA_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_HA *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->hashAlg); -+ grub_tpm2_mu_TPMU_HA_Unmarshal (buffer, p->hashAlg, &p->digest); -+} -+ -+void -+grub_tpm2_mu_TPMU_SIGNATURE_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMI_ALG_SIG_SCHEME sigAlg, -+ TPMU_SIGNATURE *p) -+{ -+ switch (sigAlg) -+ { -+ case TPM_ALG_RSASSA: -+ grub_tpm2_mu_TPMS_SIGNATURE_RSA_Unmarshal (buffer, (TPMS_SIGNATURE_RSA *)&p->rsassa); -+ break; -+ case TPM_ALG_RSAPSS: -+ grub_tpm2_mu_TPMS_SIGNATURE_RSA_Unmarshal (buffer, (TPMS_SIGNATURE_RSA *)&p->rsapss); -+ break; -+ case TPM_ALG_ECDSA: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecdsa); -+ break; -+ case TPM_ALG_ECDAA: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecdaa); -+ break; -+ case TPM_ALG_SM2: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (buffer, (TPMS_SIGNATURE_ECC *)&p->sm2); -+ break; -+ case TPM_ALG_ECSCHNORR: -+ grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (buffer, (TPMS_SIGNATURE_ECC *)&p->ecschnorr); -+ break; -+ case TPM_ALG_HMAC: -+ grub_tpm2_mu_TPMT_HA_Unmarshal (buffer, &p->hmac); -+ break; -+ case TPM_ALG_NULL: -+ break; -+ default: -+ buffer->error = 1; -+ break; -+ } -+} -+ -+void -+grub_tpm2_mu_TPMT_SIGNATURE_Unmarshal (grub_tpm2_buffer_t buffer, -+ TPMT_SIGNATURE *p) -+{ -+ grub_tpm2_buffer_unpack_u16 (buffer, &p->sigAlg); -+ grub_tpm2_mu_TPMU_SIGNATURE_Unmarshal (buffer, p->sigAlg, &p->signature); -+} -diff --git a/include/grub/tpm2/mu.h b/include/grub/tpm2/mu.h -index c545976db..afb842ab5 100644 ---- a/include/grub/tpm2/mu.h -+++ b/include/grub/tpm2/mu.h -@@ -147,6 +147,47 @@ grub_tpm2_mu_TPM2B_SENSITIVE_CREATE_Marshal (grub_tpm2_buffer_t buf, - const TPM2B_SENSITIVE_CREATE *sensitiveCreate); - - void -+grub_tpm2_mu_TPMU_SENSITIVE_COMPOSITE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_PUBLIC type, -+ const TPMU_SENSITIVE_COMPOSITE *p); -+void -+grub_tpm2_mu_TPMT_SENSITIVE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_SENSITIVE *p); -+ -+void -+grub_tpm2_mu_TPM2B_SENSITIVE_Marshal (grub_tpm2_buffer_t buf, -+ const TPM2B_SENSITIVE *p); -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_RSA_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SIGNATURE_RSA *p); -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_ECC_Marshal (grub_tpm2_buffer_t buf, -+ const TPMS_SIGNATURE_ECC *p); -+ -+void -+grub_tpm2_mu_TPMU_HA_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_HASH hashAlg, -+ const TPMU_HA *p); -+ -+void -+grub_tpm2_mu_TPMT_HA_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_HA *p); -+ -+void -+grub_tpm2_mu_TPMU_SIGNATURE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMI_ALG_SIG_SCHEME sigAlg, -+ const TPMU_SIGNATURE *p); -+ -+void -+grub_tpm2_mu_TPMT_SIGNATURE_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_SIGNATURE *p); -+ -+void -+grub_tpm2_mu_TPMT_TK_VERIFIED_Marshal (grub_tpm2_buffer_t buf, -+ const TPMT_TK_VERIFIED *p); -+void - grub_tpm2_mu_TPM2B_Unmarshal (grub_tpm2_buffer_t buf, - TPM2B* p); - -@@ -277,6 +318,14 @@ void - grub_tpm2_mu_TPMT_TK_CREATION_Unmarshal (grub_tpm2_buffer_t buf, - TPMT_TK_CREATION *p); - -+void -+grub_tpm2_mu_TPMT_TK_HASHCHECK_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_TK_HASHCHECK *p); -+ -+void -+grub_tpm2_mu_TPMT_TK_VERIFIED_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_TK_VERIFIED *p); -+ - void - grub_tpm2_mu_TPMS_PCR_SELECTION_Unmarshal (grub_tpm2_buffer_t buf, - TPMS_PCR_SELECTION* pcrSelection); -@@ -289,4 +338,30 @@ void - grub_tpm2_mu_TPML_DIGEST_Unmarshal (grub_tpm2_buffer_t buf, - TPML_DIGEST* digest); - -+void -+grub_tpm2_mu_TPMS_SIGNATURE_RSA_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_SIGNATURE_RSA *p); -+ -+void -+grub_tpm2_mu_TPMS_SIGNATURE_ECC_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMS_SIGNATURE_ECC *p); -+ -+void -+grub_tpm2_mu_TPMU_HA_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_HASH hashAlg, -+ TPMU_HA *p); -+ -+void -+grub_tpm2_mu_TPMT_HA_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_HA *p); -+ -+void -+grub_tpm2_mu_TPMU_SIGNATURE_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMI_ALG_SIG_SCHEME sigAlg, -+ TPMU_SIGNATURE *p); -+ -+void -+grub_tpm2_mu_TPMT_SIGNATURE_Unmarshal (grub_tpm2_buffer_t buf, -+ TPMT_SIGNATURE *p); -+ - #endif /* ! GRUB_TPM2_MU_HEADER */ --- -2.41.0 - diff --git a/0115-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch b/0150-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch similarity index 89% rename from 0115-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch rename to 0150-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch index 1e3cceb..a8fdba3 100644 --- a/0115-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch +++ b/0150-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch @@ -1,39 +1,24 @@ -From 3b81df75afd8efa4a2eb557d8c58ea2a3cae94a4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Mon, 28 Sep 2020 11:11:17 +1000 -Subject: [PATCH 115/272] ieee1275: enter lockdown based on /ibm,secure-boot +Subject: [PATCH] ieee1275: enter lockdown based on /ibm,secure-boot If the 'ibm,secure-boot' property of the root node is 2 or greater, enter lockdown. Signed-off-by: Daniel Axtens --- - docs/grub.texi | 4 ++-- grub-core/Makefile.core.def | 1 + grub-core/kern/ieee1275/init.c | 27 +++++++++++++++++++++++++++ include/grub/lockdown.h | 3 ++- + docs/grub.texi | 4 ++-- 4 files changed, 32 insertions(+), 3 deletions(-) -diff --git a/docs/grub.texi b/docs/grub.texi -index 4bb71c019..06fb94325 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -6795,8 +6795,8 @@ platforms. - @section Lockdown when booting on a secure setup - - The GRUB can be locked down when booted on a secure boot environment, for example --if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will --be restricted and some operations/commands cannot be executed. -+if UEFI or Power secure boot is enabled. On a locked down configuration, the -+GRUB will be restricted and some operations/commands cannot be executed. - - The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. - Otherwise it does not exit. diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 0073aa900..c9ba34bf9 100644 +index c81c9107249..c748a37b4c5 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -331,6 +331,7 @@ kernel = { +@@ -337,6 +337,7 @@ kernel = { powerpc_ieee1275 = kern/powerpc/cache.S; powerpc_ieee1275 = kern/powerpc/dl.c; powerpc_ieee1275 = kern/powerpc/compiler-rt.S; @@ -42,7 +27,7 @@ index 0073aa900..c9ba34bf9 100644 sparc64_ieee1275 = kern/sparc64/cache.S; sparc64_ieee1275 = kern/sparc64/dl.c; diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c -index 08f795b09..38f1f1f6e 100644 +index c4d6962197b..85d50e2965f 100644 --- a/grub-core/kern/ieee1275/init.c +++ b/grub-core/kern/ieee1275/init.c @@ -49,6 +49,7 @@ @@ -94,7 +79,7 @@ index 08f795b09..38f1f1f6e 100644 void diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h -index 40531fa82..ebfee4bf0 100644 +index 40531fa823b..ebfee4bf06e 100644 --- a/include/grub/lockdown.h +++ b/include/grub/lockdown.h @@ -24,7 +24,8 @@ @@ -107,6 +92,18 @@ index 40531fa82..ebfee4bf0 100644 extern void EXPORT_FUNC (grub_lockdown) (void); extern int --- -2.41.0 - +diff --git a/docs/grub.texi b/docs/grub.texi +index eab81718a59..096a3cde075 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6814,8 +6814,8 @@ platforms. + @section Lockdown when booting on a secure setup + + The GRUB can be locked down when booted on a secure boot environment, for example +-if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will +-be restricted and some operations/commands cannot be executed. ++if UEFI or Power secure boot is enabled. On a locked down configuration, the ++GRUB will be restricted and some operations/commands cannot be executed. + + The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. + Otherwise it does not exit. diff --git a/0150-tpm2-Implement-more-TPM2-commands.patch b/0150-tpm2-Implement-more-TPM2-commands.patch deleted file mode 100644 index 6f92b7e..0000000 --- a/0150-tpm2-Implement-more-TPM2-commands.patch +++ /dev/null @@ -1,543 +0,0 @@ -From f1bc830aa3d6408715dddfa03d71362cba95cf49 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Wed, 8 Feb 2023 10:30:55 +0800 -Subject: [PATCH 150/272] tpm2: Implement more TPM2 commands - -This commit implements a few more TPM2 commands as the preparation for -the authorized policy support. - -* TPM2_LoadExternal - This command is added to load the external public key to verify the - signed policy digest -* TPM2_HashSequenceStart, TPM2_SequenceUpdate, TPM2_SequenceComplete, - and TPM2_Hash - With those commands, we can use the TPM as a coprocessor to calculate - the hash of a given binary blob. -* TPM2_VerifySignature - This command verifies the given signature with the given public key - and returns the validation ticket to authorize the policy. -* TPM2_PolicyAuthorize - This command approves the given policy digest so that we can unseal - the key with the newly authorized policy. - -Signed-off-by: Gary Lin ---- - grub-core/tpm2/tpm2.c | 424 +++++++++++++++++++++++++ - include/grub/tpm2/internal/functions.h | 57 ++++ - 2 files changed, 481 insertions(+) - -diff --git a/grub-core/tpm2/tpm2.c b/grub-core/tpm2/tpm2.c -index d67699a24..159353b08 100644 ---- a/grub-core/tpm2/tpm2.c -+++ b/grub-core/tpm2/tpm2.c -@@ -427,6 +427,73 @@ TPM2_Load (const TPMI_DH_OBJECT parent_handle, - return TPM_RC_SUCCESS; - } - -+TPM_RC -+TPM2_LoadExternal (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE *inPrivate, -+ const TPM2B_PUBLIC *inPublic, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM_HANDLE *objectHandle, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM_HANDLE objectHandleTmp; -+ TPM2B_NAME nameTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!inPublic) -+ return TPM_RC_VALUE; -+ -+ if (!objectHandle) -+ objectHandle = &objectHandleTmp; -+ if (!name) -+ name = &nameTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (objectHandle, 0, sizeof (*objectHandle)); -+ grub_memset (name, 0, sizeof (*name)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (inPrivate) -+ grub_tpm2_mu_TPM2B_SENSITIVE_Marshal (&in, inPrivate); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&in, inPublic); -+ grub_tpm2_buffer_pack_u32 (&in, hierarchy); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_LoadExternal, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ grub_tpm2_buffer_unpack_u32 (&out, objectHandle); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPM2B_Unmarshal (&out, (TPM2B*)name); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ - TPM_RC - TPM2_Unseal (const TPMI_DH_OBJECT itemHandle, - const TPMS_AUTH_COMMAND *authCommand, -@@ -759,3 +826,360 @@ TPM2_EvictControl (const TPMI_RH_PROVISION auth, - - return TPM_RC_SUCCESS; - } -+ -+TPM_RC -+TPM2_HashSequenceStart (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_AUTH *auth, -+ const TPMI_ALG_HASH hashAlg, -+ TPMI_DH_OBJECT *sequenceHandle, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMI_DH_OBJECT sequenceHandleTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ TPM_RC rc; -+ grub_uint32_t parameterSize; -+ -+ if (!auth) -+ return TPM_RC_VALUE; -+ -+ if (!sequenceHandle) -+ sequenceHandle = &sequenceHandleTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (sequenceHandle, 0, sizeof (*sequenceHandle)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_Marshal (&in, auth->size, auth->buffer); -+ grub_tpm2_buffer_pack_u16 (&in, hashAlg); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_HashSequenceStart, &responseCode, &in, -+ &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal */ -+ grub_tpm2_buffer_unpack_u32 (&out, sequenceHandle); -+ if (tag == TPM_ST_SESSIONS) -+ { -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal(&out, authResponse); -+ } -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_SequenceUpdate (const TPMI_DH_OBJECT sequenceHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *buffer, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPM_RC responseCode; -+ TPM_RC rc; -+ grub_uint32_t parameterSize; -+ -+ if (!authCommand) -+ return TPM_RC_VALUE; -+ -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, sequenceHandle); -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (buffer) -+ grub_tpm2_mu_TPM2B_Marshal (&in, buffer->size, buffer->buffer); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (TPM_ST_SESSIONS, TPM_CC_SequenceUpdate, -+ &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal */ -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal(&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_SequenceComplete (const TPMI_DH_OBJECT sequenceHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *buffer, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM2B_DIGEST *result, -+ TPMT_TK_HASHCHECK *validation, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPM2B_DIGEST resultTmp; -+ TPMT_TK_HASHCHECK validationTmp; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPM_RC responseCode; -+ TPM_RC rc; -+ grub_uint32_t parameterSize; -+ -+ if (!authCommand) -+ return TPM_RC_VALUE; -+ -+ if (!result) -+ result = &resultTmp; -+ if (!validation) -+ validation = &validationTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (result, 0, sizeof (*result)); -+ grub_memset (validation, 0, sizeof (*validation)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, sequenceHandle); -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (buffer) -+ grub_tpm2_mu_TPM2B_Marshal (&in, buffer->size, buffer->buffer); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_buffer_pack_u32 (&in, hierarchy); -+ -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (TPM_ST_SESSIONS, TPM_CC_SequenceComplete, -+ &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal */ -+ grub_tpm2_buffer_unpack_u32 (&out, ¶meterSize); -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (&out, result); -+ grub_tpm2_mu_TPMT_TK_HASHCHECK_Unmarshal (&out, validation); -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal(&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_Hash (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *data, -+ const TPMI_ALG_HASH hashAlg, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM2B_DIGEST *outHash, -+ TPMT_TK_HASHCHECK *validation, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPM2B_DIGEST outHashTmp; -+ TPMT_TK_HASHCHECK validationTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (hashAlg == TPM_ALG_NULL) -+ return TPM_RC_VALUE; -+ -+ if (!outHash) -+ outHash = &outHashTmp; -+ if (!validation) -+ validation = &validationTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (outHash, 0, sizeof (*outHash)); -+ grub_memset (validation, 0, sizeof (*validation)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ if (data) -+ grub_tpm2_mu_TPM2B_Marshal (&in, data->size, data->buffer); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_buffer_pack_u16 (&in, hashAlg); -+ grub_tpm2_buffer_pack_u32 (&in, hierarchy); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_Hash, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (&out, outHash); -+ grub_tpm2_mu_TPMT_TK_HASHCHECK_Unmarshal (&out, validation); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_VerifySignature (const TPMI_DH_OBJECT keyHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *digest, -+ const TPMT_SIGNATURE *signature, -+ TPMT_TK_VERIFIED *validation, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPMT_TK_VERIFIED validationTmp; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!digest || !signature) -+ return TPM_RC_VALUE; -+ -+ if (!validation) -+ validation = &validationTmp; -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (validation, 0, sizeof (*validation)); -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_buffer_pack_u32 (&in, keyHandle); -+ grub_tpm2_mu_TPM2B_Marshal (&in, digest->size, digest->buffer); -+ grub_tpm2_mu_TPMT_SIGNATURE_Marshal (&in, signature); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_VerifySignature, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ grub_tpm2_mu_TPMT_TK_VERIFIED_Unmarshal (&out, validation); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -+ -+TPM_RC -+TPM2_PolicyAuthorize (const TPMI_SH_POLICY policySession, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *approvedPolicy, -+ const TPM2B_NONCE *policyRef, -+ const TPM2B_NAME *keySign, -+ const TPMT_TK_VERIFIED *checkTicket, -+ TPMS_AUTH_RESPONSE *authResponse) -+{ -+ TPM_RC rc; -+ struct grub_tpm2_buffer in; -+ struct grub_tpm2_buffer out; -+ TPMS_AUTH_RESPONSE authResponseTmp; -+ TPMI_ST_COMMAND_TAG tag = authCommand ? TPM_ST_SESSIONS : TPM_ST_NO_SESSIONS; -+ TPM_RC responseCode; -+ grub_uint32_t param_size; -+ -+ if (!approvedPolicy || !keySign || !checkTicket) -+ return TPM_RC_VALUE; -+ -+ if (!authResponse) -+ authResponse = &authResponseTmp; -+ -+ grub_memset (authResponse, 0, sizeof (*authResponse)); -+ -+ /* Marshal */ -+ grub_tpm2_buffer_init (&in); -+ grub_tpm2_buffer_pack_u32 (&in, policySession); -+ if (authCommand) -+ grub_tpm2_mu_TPMS_AUTH_COMMAND_Marshal (&in, authCommand); -+ grub_tpm2_mu_TPM2B_Marshal (&in, approvedPolicy->size, approvedPolicy->buffer); -+ if (policyRef) -+ grub_tpm2_mu_TPM2B_Marshal (&in, policyRef->size, policyRef->buffer); -+ else -+ grub_tpm2_buffer_pack_u16 (&in, 0); -+ grub_tpm2_mu_TPM2B_Marshal (&in, keySign->size, keySign->name); -+ grub_tpm2_mu_TPMT_TK_VERIFIED_Marshal (&in, checkTicket); -+ if (in.error) -+ return TPM_RC_FAILURE; -+ -+ /* Submit */ -+ grub_tpm2_buffer_init (&out); -+ rc = grub_tpm2_submit_command (tag, TPM_CC_PolicyAuthorize, &responseCode, &in, &out); -+ if (rc != TPM_RC_SUCCESS) -+ return rc; -+ if (responseCode != TPM_RC_SUCCESS) -+ return responseCode; -+ -+ /* Unmarshal*/ -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_buffer_unpack_u32 (&out, ¶m_size); -+ if (tag == TPM_ST_SESSIONS) -+ grub_tpm2_mu_TPMS_AUTH_RESPONSE_Unmarshal (&out, authResponse); -+ if (out.error) -+ return TPM_RC_FAILURE; -+ -+ return TPM_RC_SUCCESS; -+} -diff --git a/include/grub/tpm2/internal/functions.h b/include/grub/tpm2/internal/functions.h -index 9380f26a2..67b78fab8 100644 ---- a/include/grub/tpm2/internal/functions.h -+++ b/include/grub/tpm2/internal/functions.h -@@ -70,6 +70,15 @@ TPM2_Load (const TPMI_DH_OBJECT parent_handle, - TPM2B_NAME *name, - TPMS_AUTH_RESPONSE *authResponse); - -+TPM_RC -+TPM2_LoadExternal (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_SENSITIVE *inPrivate, -+ const TPM2B_PUBLIC *inPublic, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM_HANDLE *objectHandle, -+ TPM2B_NAME *name, -+ TPMS_AUTH_RESPONSE *authResponse); -+ - TPM_RC - TPM2_Unseal (const TPMI_DH_OBJECT item_handle, - const TPMS_AUTH_COMMAND *authCommand, -@@ -114,4 +123,52 @@ TPM2_EvictControl (const TPMI_RH_PROVISION auth, - const TPMI_DH_PERSISTENT persistentHandle, - TPMS_AUTH_RESPONSE *authResponse); - -+TPM_RC -+TPM2_HashSequenceStart (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_AUTH *auth, -+ const TPMI_ALG_HASH hashAlg, -+ TPMI_DH_OBJECT *sequenceHandle, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_SequenceUpdate (const TPMI_DH_OBJECT sequenceHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *buffer, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_SequenceComplete (const TPMI_DH_OBJECT sequenceHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *buffer, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM2B_DIGEST *result, -+ TPMT_TK_HASHCHECK *validation, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_Hash (const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_MAX_BUFFER *data, -+ const TPMI_ALG_HASH hashAlg, -+ const TPMI_RH_HIERARCHY hierarchy, -+ TPM2B_DIGEST *outHash, -+ TPMT_TK_HASHCHECK *validation, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_VerifySignature (const TPMI_DH_OBJECT keyHandle, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *digest, -+ const TPMT_SIGNATURE *signature, -+ TPMT_TK_VERIFIED *validation, -+ TPMS_AUTH_RESPONSE *authResponse); -+ -+TPM_RC -+TPM2_PolicyAuthorize (const TPMI_SH_POLICY policySession, -+ const TPMS_AUTH_COMMAND *authCommand, -+ const TPM2B_DIGEST *approvedPolicy, -+ const TPM2B_NONCE *policyRef, -+ const TPM2B_NAME *keySign, -+ const TPMT_TK_VERIFIED *checkTicket, -+ TPMS_AUTH_RESPONSE *authResponse); -+ - #endif /* ! GRUB_TPM2_INTERNAL_FUNCTIONS_HEADER */ --- -2.41.0 - diff --git a/0151-ieee1275-drop-HEAP_MAX_ADDR-HEAP_MIN_SIZE.patch b/0151-ieee1275-drop-HEAP_MAX_ADDR-HEAP_MIN_SIZE.patch new file mode 100644 index 0000000..3ca5139 --- /dev/null +++ b/0151-ieee1275-drop-HEAP_MAX_ADDR-HEAP_MIN_SIZE.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Wed, 14 Apr 2021 20:10:23 +1000 +Subject: [PATCH] ieee1275: drop HEAP_MAX_ADDR, HEAP_MIN_SIZE + +HEAP_MAX_ADDR is confusing. Currently it is set to 32MB, except +on ieee1275 on x86, where it is 64MB. + +There is a comment which purports to explain it: + +/* If possible, we will avoid claiming heap above this address, because it + seems to cause relocation problems with OSes that link at 4 MiB */ + +This doesn't make a lot of sense when the constants are well above 4MB +already. It was not always this way. Prior to +commit 7b5d0fe4440c ("Increase heap limit") in 2010, HEAP_MAX_SIZE and +HEAP_MAX_ADDR were indeed 4MB. However, when the constants were increased +the comment was left unchanged. + +It's been over a decade. It doesn't seem like we have problems with +claims over 4MB on powerpc or x86 ieee1275. (sparc does things completely +differently and never used the constant.) + +Drop the constant and the check. + +The only use of HEAP_MIN_SIZE was to potentially override the +HEAP_MAX_ADDR check. It is now unused. Remove it. + +Signed-off-by: Daniel Axtens +--- + grub-core/kern/ieee1275/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 85d50e2965f..8ce1a0f09ee 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -51,7 +51,7 @@ + #endif + #include + +-/* The maximum heap size we're going to claim at boot. Not used by sparc. */ ++/* The maximum heap size we're going to claim. Not used by sparc. */ + #ifdef __i386__ + #define HEAP_MAX_SIZE (unsigned long) (64 * 1024 * 1024) + #else /* __powerpc__ */ diff --git a/0151-tpm2-Support-authorized-policy.patch b/0151-tpm2-Support-authorized-policy.patch deleted file mode 100644 index 0bb341e..0000000 --- a/0151-tpm2-Support-authorized-policy.patch +++ /dev/null @@ -1,170 +0,0 @@ -From 6d519072658467bab6d49d5707e47ca95e9c46ec Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 6 Apr 2023 16:00:25 +0800 -Subject: [PATCH 151/272] tpm2: Support authorized policy - -This commit handles the TPM2_PolicyAuthorize command from the key file -in TPM 2.0 Key File format. - -TPM2_PolicyAuthorize is the essential command to support authorized -policy which allows the users to sign TPM policies with their own keys. -Per TPM 2.0 Key File(*1), CommandPolicy for TPM2_PolicyAuthorize -comprises 'TPM2B_PUBLIC pubkey', 'TPM2B_DIGEST policy_ref', and -'TPMT_SIGNATURE signature'. To verify the signature, the current policy -digest is hashed with the hash algorithm written in 'signature', and then -'signature' is verified with the hashed policy digest and 'pubkey'. Once -TPM accepts 'signature', TPM2_PolicyAuthorize is invoked to authorize the -signed policy. - -To create the key file with authorized policy, here are the pcr-oracle(*2) -commands: - - # Generate the RSA key and create the authorized policy file - $ pcr-oracle \ - --rsa-generate-key \ - --private-key policy-key.pem \ - --auth authorized.policy \ - create-authorized-policy 0,2,4,7,9 - - # Seal the secret with the authorized policy - $ pcr-oracle \ - --key-format tpm2.0 \ - --auth authorized.policy \ - --input disk-secret.txt \ - --output sealed.key \ - seal-secret - - # Sign the predicted PCR policy - $ pcr-oracle \ - --key-format tpm2.0 \ - --private-key policy-key.pem \ - --from eventlog \ - --stop-event "grub-file=grub.cfg" \ - --after \ - --input sealed.key \ - --output sealed.tpm \ - sign 0,2,4,7.9 - -Then specify the key file and the key protector to grub.cfg in the EFI -system partition: - -tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm -cryptomount -u -P tpm2 - -For any change in the boot components, just run the 'sign' command again -to update the signature in sealed.tpm, and TPM can unseal the key file -with the updated PCR policy. - -(*1) https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html -(*2) https://github.com/okirch/pcr-oracle - -Signed-off-by: Gary Lin ---- - grub-core/tpm2/module.c | 84 +++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 84 insertions(+) - -diff --git a/grub-core/tpm2/module.c b/grub-core/tpm2/module.c -index df0727215..0cbfd06e8 100644 ---- a/grub-core/tpm2/module.c -+++ b/grub-core/tpm2/module.c -@@ -453,6 +453,87 @@ grub_tpm2_protector_policypcr (TPMI_SH_AUTH_SESSION session, - return GRUB_ERR_NONE; - } - -+static grub_err_t -+grub_tpm2_protector_policyauthorize (TPMI_SH_AUTH_SESSION session, -+ struct grub_tpm2_buffer *cmd_buf) -+{ -+ TPM2B_PUBLIC pubkey; -+ TPM2B_DIGEST policy_ref; -+ TPMT_SIGNATURE signature; -+ TPM2B_DIGEST pcr_policy; -+ TPM2B_DIGEST pcr_policy_hash; -+ TPMI_ALG_HASH sig_hash; -+ TPMT_TK_VERIFIED verification_ticket; -+ TPM_HANDLE pubkey_handle = 0; -+ TPM2B_NAME pubname; -+ TPM_RC rc; -+ grub_err_t err; -+ -+ grub_tpm2_mu_TPM2B_PUBLIC_Unmarshal (cmd_buf, &pubkey); -+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (cmd_buf, &policy_ref); -+ grub_tpm2_mu_TPMT_SIGNATURE_Unmarshal (cmd_buf, &signature); -+ if (cmd_buf->error != 0) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to unmarshal the buffer for TPM2_PolicyAuthorize")); -+ -+ /* Retrieve Policy Digest */ -+ rc = TPM2_PolicyGetDigest (session, NULL, &pcr_policy, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to get policy digest (TPM2_PolicyGetDigest: 0x%x)."), -+ rc); -+ -+ /* Calculate the digest of the polcy for VerifySignature */ -+ sig_hash = TPMT_SIGNATURE_get_hash_alg (&signature); -+ if (sig_hash == TPM_ALG_NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ N_("Failed to get the hash algorithm of the signature")); -+ -+ rc = TPM2_Hash (NULL, (TPM2B_MAX_BUFFER *)&pcr_policy, sig_hash, -+ TPM_RH_NULL, &pcr_policy_hash, NULL, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to create PCR policy hash (TPM2_Hash: 0x%x)"), -+ rc); -+ -+ /* Load the public key */ -+ rc = TPM2_LoadExternal (NULL, NULL, &pubkey, TPM_RH_OWNER, -+ &pubkey_handle, &pubname, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ return grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to load public key (TPM2_LoadExternal: 0x%x)"), -+ rc); -+ -+ /* Verify the signature against the public key and the policy digest */ -+ rc = TPM2_VerifySignature (pubkey_handle, NULL, &pcr_policy_hash, &signature, -+ &verification_ticket, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ err = grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to verify signature (TPM2_VerifySignature: 0x%x)"), -+ rc); -+ goto error; -+ } -+ -+ /* Authorize the signed policy with the public key and the verification ticket */ -+ rc = TPM2_PolicyAuthorize (session, NULL, &pcr_policy, &policy_ref, &pubname, -+ &verification_ticket, NULL); -+ if (rc != TPM_RC_SUCCESS) -+ { -+ err = grub_error (GRUB_ERR_BAD_DEVICE, -+ N_("Failed to authorize PCR policy (TPM2_PolicyAuthorize: 0x%x)"), -+ rc); -+ goto error; -+ } -+ -+ err = GRUB_ERR_NONE; -+ -+error: -+ TPM2_FlushContext (pubkey_handle); -+ -+ return err; -+} -+ - static grub_err_t - grub_tpm2_protector_enforce_policy (tpm2key_policy_t policy, TPMI_SH_AUTH_SESSION session) - { -@@ -472,6 +553,9 @@ grub_tpm2_protector_enforce_policy (tpm2key_policy_t policy, TPMI_SH_AUTH_SESSIO - case TPM_CC_PolicyPCR: - err = grub_tpm2_protector_policypcr (session, &buf); - break; -+ case TPM_CC_PolicyAuthorize: -+ err = grub_tpm2_protector_policyauthorize (session, &buf); -+ break; - default: - return grub_error (GRUB_ERR_BAD_ARGUMENT, - N_("Unknown TPM Command: 0x%x"), policy->cmd_code); --- -2.41.0 - diff --git a/0152-appendedsig-x509-Also-handle-the-Extended-Key-Usage-.patch b/0152-appendedsig-x509-Also-handle-the-Extended-Key-Usage-.patch new file mode 100644 index 0000000..a237a21 --- /dev/null +++ b/0152-appendedsig-x509-Also-handle-the-Extended-Key-Usage-.patch @@ -0,0 +1,315 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 8 May 2021 02:27:58 +0200 +Subject: [PATCH] appendedsig/x509: Also handle the Extended Key Usage + extension + +Red Hat certificates have both Key Usage and Extended Key Usage extensions +present, but the appended signatures x509 parser doesn't handle the latter +and so buils due finding an unrecognised critical extension: + +Error loading initial key: +../../grub-core/commands/appendedsig/x509.c:780:Unhandled critical x509 extension with OID 2.5.29.37 + +Fix this by also parsing the Extended Key Usage extension and handle it by +verifying that the certificate has a single purpose, that is code signing. + +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Daniel Axtens +--- + grub-core/commands/appendedsig/x509.c | 94 ++++++++++++++++++++++++++++++- + grub-core/tests/appended_signature_test.c | 29 +++++++++- + grub-core/tests/appended_signatures.h | 81 ++++++++++++++++++++++++++ + 3 files changed, 201 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/appendedsig/x509.c b/grub-core/commands/appendedsig/x509.c +index 2b38b3670a2..42ec65c54aa 100644 +--- a/grub-core/commands/appendedsig/x509.c ++++ b/grub-core/commands/appendedsig/x509.c +@@ -47,6 +47,12 @@ const char *keyUsage_oid = "2.5.29.15"; + */ + const char *basicConstraints_oid = "2.5.29.19"; + ++/* ++ * RFC 5280 4.2.1.12 Extended Key Usage ++ */ ++const char *extendedKeyUsage_oid = "2.5.29.37"; ++const char *codeSigningUsage_oid = "1.3.6.1.5.5.7.3.3"; ++ + /* + * RFC 3279 2.3.1 + * +@@ -637,6 +643,77 @@ cleanup: + return err; + } + ++/* ++ * ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId ++ * ++ * KeyPurposeId ::= OBJECT IDENTIFIER ++ */ ++static grub_err_t ++verify_extended_key_usage (grub_uint8_t * value, int value_size) ++{ ++ asn1_node extendedasn; ++ int result, count; ++ grub_err_t err = GRUB_ERR_NONE; ++ char usage[MAX_OID_LEN]; ++ int usage_size = sizeof (usage); ++ ++ result = ++ asn1_create_element (_gnutls_pkix_asn, "PKIX1.ExtKeyUsageSyntax", ++ &extendedasn); ++ if (result != ASN1_SUCCESS) ++ { ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, ++ "Could not create ASN.1 structure for Extended Key Usage"); ++ } ++ ++ result = asn1_der_decoding2 (&extendedasn, value, &value_size, ++ ASN1_DECODE_FLAG_STRICT_DER, asn1_error); ++ if (result != ASN1_SUCCESS) ++ { ++ err = ++ grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Error parsing DER for Extended Key Usage: %s", ++ asn1_error); ++ goto cleanup; ++ } ++ ++ /* ++ * If EKUs are present, there must be exactly 1 and it must be a ++ * codeSigning usage. ++ */ ++ result = asn1_number_of_elements(extendedasn, "", &count); ++ if (result != ASN1_SUCCESS) ++ { ++ err = ++ grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Error counting number of Extended Key Usages: %s", ++ asn1_strerror (result)); ++ goto cleanup; ++ } ++ ++ result = asn1_read_value (extendedasn, "?1", usage, &usage_size); ++ if (result != ASN1_SUCCESS) ++ { ++ err = ++ grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Error reading Extended Key Usage: %s", ++ asn1_strerror (result)); ++ goto cleanup; ++ } ++ ++ if (grub_strncmp (codeSigningUsage_oid, usage, usage_size) != 0) ++ { ++ err = ++ grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Unexpected Extended Key Usage OID, got: %s", ++ usage); ++ goto cleanup; ++ } ++ ++cleanup: ++ asn1_delete_structure (&extendedasn); ++ return err; ++} + + /* + * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension +@@ -660,7 +737,7 @@ verify_extensions (asn1_node cert) + { + int result; + int ext, num_extensions = 0; +- int usage_present = 0, constraints_present = 0; ++ int usage_present = 0, constraints_present = 0, extended_usage_present = 0; + char *oid_path, *critical_path, *value_path; + char extnID[MAX_OID_LEN]; + int extnID_size; +@@ -754,6 +831,15 @@ verify_extensions (asn1_node cert) + } + constraints_present++; + } ++ else if (grub_strncmp (extendedKeyUsage_oid, extnID, extnID_size) == 0) ++ { ++ err = verify_extended_key_usage (value, value_size); ++ if (err != GRUB_ERR_NONE) ++ { ++ goto cleanup_value; ++ } ++ extended_usage_present++; ++ } + else if (grub_strncmp ("TRUE", critical, critical_size) == 0) + { + /* +@@ -785,6 +871,12 @@ verify_extensions (asn1_node cert) + "Unexpected number of basic constraints extensions - expected 1, got %d", + constraints_present); + } ++ if (extended_usage_present > 1) ++ { ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "Unexpected number of Extended Key Usage extensions - expected 0 or 1, got %d", ++ extended_usage_present); ++ } + return GRUB_ERR_NONE; + + cleanup_value: +diff --git a/grub-core/tests/appended_signature_test.c b/grub-core/tests/appended_signature_test.c +index 88a485200d8..dbba0616621 100644 +--- a/grub-core/tests/appended_signature_test.c ++++ b/grub-core/tests/appended_signature_test.c +@@ -111,6 +111,22 @@ static struct grub_procfs_entry certificate_printable_der_entry = { + .get_contents = get_certificate_printable_der + }; + ++static char * ++get_certificate_eku_der (grub_size_t * sz) ++{ ++ char *ret; ++ *sz = certificate_eku_der_len; ++ ret = grub_malloc (*sz); ++ if (ret) ++ grub_memcpy (ret, certificate_eku_der, *sz); ++ return ret; ++} ++ ++static struct grub_procfs_entry certificate_eku_der_entry = { ++ .name = "certificate_eku.der", ++ .get_contents = get_certificate_eku_der ++}; ++ + + static void + do_verify (const char *f, int is_valid) +@@ -149,6 +165,7 @@ appended_signature_test (void) + char *trust_args2[] = { (char *) "(proc)/certificate2.der", NULL }; + char *trust_args_printable[] = { (char *) "(proc)/certificate_printable.der", + NULL }; ++ char *trust_args_eku[] = { (char *) "(proc)/certificate_eku.der", NULL }; + char *distrust_args[] = { (char *) "1", NULL }; + char *distrust2_args[] = { (char *) "2", NULL }; + grub_err_t err; +@@ -157,6 +174,7 @@ appended_signature_test (void) + grub_procfs_register ("certificate2.der", &certificate2_der_entry); + grub_procfs_register ("certificate_printable.der", + &certificate_printable_der_entry); ++ grub_procfs_register ("certificate_eku.der", &certificate_eku_der_entry); + + cmd_trust = grub_command_find ("trust_certificate"); + if (!cmd_trust) +@@ -266,16 +284,23 @@ appended_signature_test (void) + + /* + * Lastly, check a certificate that uses printableString rather than +- * utf8String loads properly. ++ * utf8String loads properly, and that a certificate with an appropriate ++ * extended key usage loads. + */ + err = (cmd_trust->func) (cmd_trust, 1, trust_args_printable); + grub_test_assert (err == GRUB_ERR_NONE, +- "distrusting printable certificate failed: %d: %s", ++ "trusting printable certificate failed: %d: %s", ++ grub_errno, grub_errmsg); ++ ++ err = (cmd_trust->func) (cmd_trust, 1, trust_args_eku); ++ grub_test_assert (err == GRUB_ERR_NONE, ++ "trusting certificate with extended key usage failed: %d: %s", + grub_errno, grub_errmsg); + + grub_procfs_unregister (&certificate_der_entry); + grub_procfs_unregister (&certificate2_der_entry); + grub_procfs_unregister (&certificate_printable_der_entry); ++ grub_procfs_unregister (&certificate_eku_der_entry); + } + + GRUB_FUNCTIONAL_TEST (appended_signature_test, appended_signature_test); +diff --git a/grub-core/tests/appended_signatures.h b/grub-core/tests/appended_signatures.h +index aa3dc6278e3..2e5ebd7d8bd 100644 +--- a/grub-core/tests/appended_signatures.h ++++ b/grub-core/tests/appended_signatures.h +@@ -555,3 +555,84 @@ unsigned char certificate_printable_der[] = { + 0xd2 + }; + unsigned int certificate_printable_der_len = 829; ++ ++unsigned char certificate_eku_der[] = { ++ 0x30, 0x82, 0x03, 0x90, 0x30, 0x82, 0x02, 0x78, 0xa0, 0x03, 0x02, 0x01, ++ 0x02, 0x02, 0x09, 0x00, 0xd3, 0x9c, 0x41, 0x33, 0xdd, 0x6b, 0x5f, 0x45, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x0b, 0x05, 0x00, 0x30, 0x47, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, ++ 0x04, 0x03, 0x0c, 0x18, 0x52, 0x65, 0x64, 0x20, 0x48, 0x61, 0x74, 0x20, ++ 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x42, 0x6f, 0x6f, 0x74, 0x20, ++ 0x43, 0x41, 0x20, 0x36, 0x31, 0x22, 0x30, 0x20, 0x06, 0x09, 0x2a, 0x86, ++ 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x13, 0x73, 0x65, 0x63, ++ 0x61, 0x6c, 0x65, 0x72, 0x74, 0x40, 0x72, 0x65, 0x64, 0x68, 0x61, 0x74, ++ 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x31, 0x30, 0x32, ++ 0x31, 0x35, 0x31, 0x34, 0x30, 0x30, 0x34, 0x34, 0x5a, 0x17, 0x0d, 0x33, ++ 0x38, 0x30, 0x31, 0x31, 0x37, 0x31, 0x34, 0x30, 0x30, 0x34, 0x34, 0x5a, ++ 0x30, 0x4e, 0x31, 0x28, 0x30, 0x26, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, ++ 0x1f, 0x52, 0x65, 0x64, 0x20, 0x48, 0x61, 0x74, 0x20, 0x53, 0x65, 0x63, ++ 0x75, 0x72, 0x65, 0x20, 0x42, 0x6f, 0x6f, 0x74, 0x20, 0x53, 0x69, 0x67, ++ 0x6e, 0x69, 0x6e, 0x67, 0x20, 0x36, 0x30, 0x32, 0x31, 0x22, 0x30, 0x20, ++ 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, ++ 0x13, 0x73, 0x65, 0x63, 0x61, 0x6c, 0x65, 0x72, 0x74, 0x40, 0x72, 0x65, ++ 0x64, 0x68, 0x61, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, ++ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, ++ 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, ++ 0x02, 0x82, 0x01, 0x01, 0x00, 0xaa, 0x6f, 0xbb, 0x92, 0x77, 0xd7, 0x15, ++ 0xef, 0x88, 0x80, 0x88, 0xc0, 0xe7, 0x89, 0xeb, 0x35, 0x76, 0xf4, 0x85, ++ 0x05, 0x0f, 0x19, 0xe4, 0x5f, 0x25, 0xdd, 0xc1, 0xa2, 0xe5, 0x5c, 0x06, ++ 0xfb, 0xf1, 0x06, 0xb5, 0x65, 0x45, 0xcb, 0xbd, 0x19, 0x33, 0x54, 0xb5, ++ 0x1a, 0xcd, 0xe4, 0xa8, 0x35, 0x2a, 0xfe, 0x9c, 0x53, 0xf4, 0xc6, 0x76, ++ 0xdb, 0x1f, 0x8a, 0xd4, 0x7b, 0x18, 0x11, 0xaf, 0xa3, 0x90, 0xd4, 0xdd, ++ 0x4d, 0xd5, 0x42, 0xcc, 0x14, 0x9a, 0x64, 0x6b, 0xc0, 0x7f, 0xaa, 0x1c, ++ 0x94, 0x47, 0x4d, 0x79, 0xbd, 0x57, 0x9a, 0xbf, 0x99, 0x4e, 0x96, 0xa9, ++ 0x31, 0x2c, 0xa9, 0xe7, 0x14, 0x65, 0x86, 0xc8, 0xac, 0x79, 0x5e, 0x78, ++ 0xa4, 0x3c, 0x00, 0x24, 0xd3, 0xf7, 0xe1, 0xf5, 0x12, 0xad, 0xa0, 0x29, ++ 0xe5, 0xfe, 0x80, 0xae, 0xf8, 0xaa, 0x60, 0x36, 0xe7, 0xe8, 0x94, 0xcb, ++ 0xe9, 0xd1, 0xcc, 0x0b, 0x4d, 0xf7, 0xde, 0xeb, 0x52, 0xd2, 0x73, 0x09, ++ 0x28, 0xdf, 0x48, 0x99, 0x53, 0x9f, 0xc5, 0x9a, 0xd4, 0x36, 0xa3, 0xc6, ++ 0x5e, 0x8d, 0xbe, 0xd5, 0xdc, 0x76, 0xb4, 0x74, 0xb8, 0x26, 0x18, 0x27, ++ 0xfb, 0xf2, 0xfb, 0xd0, 0x9b, 0x3d, 0x7f, 0x10, 0xe2, 0xab, 0x44, 0xc7, ++ 0x88, 0x7f, 0xb4, 0x3d, 0x3e, 0xa3, 0xff, 0x6d, 0x06, 0x4b, 0x3e, 0x55, ++ 0xb2, 0x84, 0xf4, 0xad, 0x54, 0x88, 0x81, 0xc3, 0x9c, 0xf8, 0xb6, 0x68, ++ 0x96, 0x38, 0x8b, 0xcd, 0x90, 0x6d, 0x25, 0x4b, 0xbf, 0x0c, 0x44, 0x90, ++ 0xa5, 0x5b, 0x98, 0xd0, 0x40, 0x2f, 0xbb, 0x0d, 0xa8, 0x4b, 0x8a, 0x62, ++ 0x82, 0x46, 0x46, 0x18, 0x38, 0xae, 0x82, 0x07, 0xd0, 0xb4, 0x2f, 0x16, ++ 0x79, 0x55, 0x9f, 0x1b, 0xc5, 0x08, 0x6d, 0x85, 0xdf, 0x3f, 0xa9, 0x9b, ++ 0x4b, 0xc6, 0x28, 0xd3, 0x58, 0x72, 0x3d, 0x37, 0x11, 0x02, 0x03, 0x01, ++ 0x00, 0x01, 0xa3, 0x78, 0x30, 0x76, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, ++ 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x0e, 0x06, 0x03, ++ 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x07, 0x80, ++ 0x30, 0x16, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x01, 0x01, 0xff, 0x04, 0x0c, ++ 0x30, 0x0a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x03, ++ 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x6c, ++ 0xe4, 0x6c, 0x27, 0xaa, 0xcd, 0x0d, 0x4b, 0x74, 0x21, 0xa4, 0xf6, 0x5f, ++ 0x87, 0xb5, 0x31, 0xfe, 0x10, 0xbb, 0xa7, 0x30, 0x1f, 0x06, 0x03, 0x55, ++ 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xe8, 0x6a, 0x1c, 0xab, ++ 0x2c, 0x48, 0xf9, 0x60, 0x36, 0xa2, 0xf0, 0x7b, 0x8e, 0xd2, 0x9d, 0xb4, ++ 0x2a, 0x28, 0x98, 0xc8, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, ++ 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, ++ 0x55, 0x34, 0xe2, 0xfa, 0xf6, 0x89, 0x86, 0xad, 0x92, 0x21, 0xec, 0xb9, ++ 0x54, 0x0e, 0x18, 0x47, 0x0d, 0x1b, 0xa7, 0x58, 0xad, 0x69, 0xe4, 0xef, ++ 0x3b, 0xe6, 0x8d, 0xdd, 0xda, 0x0c, 0x45, 0xf6, 0xe8, 0x96, 0xa4, 0x29, ++ 0x0f, 0xbb, 0xcf, 0x16, 0xae, 0x93, 0xd0, 0xcb, 0x2a, 0x26, 0x1a, 0x7b, ++ 0xfc, 0x51, 0x22, 0x76, 0x98, 0x31, 0xa7, 0x0f, 0x29, 0x35, 0x79, 0xbf, ++ 0xe2, 0x4f, 0x0f, 0x14, 0xf5, 0x1f, 0xcb, 0xbf, 0x87, 0x65, 0x13, 0x32, ++ 0xa3, 0x19, 0x4a, 0xd1, 0x3f, 0x45, 0xd4, 0x4b, 0xe2, 0x00, 0x26, 0xa9, ++ 0x3e, 0xd7, 0xa5, 0x37, 0x9f, 0xf5, 0xad, 0x61, 0xe2, 0x40, 0xa9, 0x74, ++ 0x24, 0x53, 0xf2, 0x78, 0xeb, 0x10, 0x9b, 0x2c, 0x27, 0x88, 0x46, 0xcb, ++ 0xe4, 0x60, 0xca, 0xf5, 0x06, 0x24, 0x40, 0x2a, 0x97, 0x3a, 0xcc, 0xd0, ++ 0x81, 0xb1, 0x15, 0xa3, 0x4f, 0xd0, 0x2b, 0x4f, 0xca, 0x6e, 0xaa, 0x24, ++ 0x31, 0xb3, 0xac, 0xa6, 0x75, 0x05, 0xfe, 0x8a, 0xf4, 0x41, 0xc4, 0x06, ++ 0x8a, 0xc7, 0x0a, 0x83, 0x4e, 0x49, 0xd4, 0x3f, 0x83, 0x50, 0xec, 0x57, ++ 0x04, 0x97, 0x14, 0x49, 0xf5, 0xe1, 0xb1, 0x7a, 0x9c, 0x09, 0x4f, 0x61, ++ 0x87, 0xc3, 0x97, 0x22, 0x17, 0xc2, 0xeb, 0xcc, 0x32, 0x81, 0x31, 0x21, ++ 0x3f, 0x10, 0x57, 0x5b, 0x43, 0xbe, 0xcd, 0x68, 0x82, 0xbe, 0xe5, 0xc1, ++ 0x65, 0x94, 0x7e, 0xc2, 0x34, 0x76, 0x2b, 0xcf, 0x89, 0x3c, 0x2b, 0x81, ++ 0x23, 0x72, 0x95, 0xcf, 0xc9, 0x67, 0x19, 0x2a, 0xd5, 0x5c, 0xca, 0xa3, ++ 0x46, 0xbd, 0x48, 0x06, 0x0b, 0xa6, 0xa3, 0x96, 0x50, 0x28, 0xc7, 0x7e, ++ 0xcf, 0x62, 0xf2, 0xfa, 0xc4, 0xf2, 0x53, 0xe3, 0xc9, 0xe8, 0x2e, 0xdd, ++ 0x29, 0x37, 0x07, 0x47, 0xff, 0xff, 0x8a, 0x32, 0xbd, 0xa2, 0xb7, 0x21, ++ 0x89, 0xa0, 0x55, 0xf7 ++}; ++unsigned int certificate_eku_der_len = 916; diff --git a/0152-clean-up-crypttab-and-linux-modules-dependency.patch b/0152-clean-up-crypttab-and-linux-modules-dependency.patch deleted file mode 100644 index 7aa8b62..0000000 --- a/0152-clean-up-crypttab-and-linux-modules-dependency.patch +++ /dev/null @@ -1,219 +0,0 @@ -From df1c3935abd4ab22b347381ef9a5806196d9bea9 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Thu, 16 Feb 2023 21:28:07 +0800 -Subject: [PATCH 152/272] clean up crypttab and linux modules dependency - -The linux module could have quite a few dependency to other modules, the -i386-pc build in particular has many. - - linux: normal vbe video boot cmdline relocator mmap - -That will be easy to cause loop dependency if one of these modules has -to require function from linux. To avoid falling into the pitfall in -future extension, we move away the key publish related function from -linux to crypttab module in that it is also a right thing to do. - -Signed-off-by: Michael Chang ---- - grub-core/commands/crypttab.c | 48 +++++++++++++++++++++++++++++- - grub-core/disk/cryptodisk.c | 2 +- - grub-core/loader/linux.c | 55 +---------------------------------- - include/grub/crypttab.h | 22 ++++++++++++++ - include/grub/linux.h | 3 -- - 5 files changed, 71 insertions(+), 59 deletions(-) - create mode 100644 include/grub/crypttab.h - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index cc7f83309..bb6ea5724 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -3,10 +3,56 @@ - #include - #include - #include --#include -+#include -+#include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -+struct grub_key_publisher *kpuber; -+ -+grub_err_t -+grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path) -+{ -+ struct grub_key_publisher *cur = NULL; -+ -+ FOR_LIST_ELEMENTS (cur, kpuber) -+ if (grub_uuidcasecmp (cur->name, uuid, sizeof (cur->name)) == 0) -+ break; -+ -+ if (!cur) -+ cur = grub_zalloc (sizeof (*cur)); -+ if (!cur) -+ return grub_errno; -+ -+ if (key && key_len) -+ { -+ grub_free (cur->key); -+ cur->key = grub_malloc (key_len); -+ if (!cur->key) -+ { -+ grub_free (cur); -+ return grub_errno; -+ } -+ grub_memcpy (cur->key, key, key_len); -+ cur->key_len = key_len; -+ } -+ -+ if (path) -+ { -+ grub_free (cur->path); -+ cur->path = grub_strdup (path); -+ } -+ -+ if (!cur->name) -+ { -+ cur->name = grub_strdup (uuid); -+ grub_list_push (GRUB_AS_LIST_P (&kpuber), GRUB_AS_LIST (cur)); -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ - static grub_err_t - grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - int argc, char **argv) -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 6d43b0e4f..4e03a6393 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -31,7 +31,7 @@ - #ifdef GRUB_UTIL - #include - #else --#include -+#include - #endif - - GRUB_MOD_LICENSE ("GPLv3+"); -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 281123958..1927af4ca 100644 ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - - struct newc_head - { -@@ -40,18 +41,6 @@ struct dir - struct dir *child; - }; - --struct grub_key_publisher --{ -- struct grub_key_publisher *next; -- struct grub_key_publisher **prev; -- char *name; /* UUID */ -- char *path; -- char *key; -- grub_size_t key_len; --}; -- --static struct grub_key_publisher *kpuber; -- - static char - hex (grub_uint8_t val) - { -@@ -436,45 +425,3 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - root = 0; - return GRUB_ERR_NONE; - } -- --grub_err_t --grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path) --{ -- struct grub_key_publisher *cur = NULL; -- -- FOR_LIST_ELEMENTS (cur, kpuber) -- if (grub_uuidcasecmp (cur->name, uuid, sizeof (cur->name)) == 0) -- break; -- -- if (!cur) -- cur = grub_zalloc (sizeof (*cur)); -- if (!cur) -- return grub_errno; -- -- if (key && key_len) -- { -- grub_free (cur->key); -- cur->key = grub_malloc (key_len); -- if (!cur->key) -- { -- grub_free (cur); -- return grub_errno; -- } -- grub_memcpy (cur->key, key, key_len); -- cur->key_len = key_len; -- } -- -- if (path) -- { -- grub_free (cur->path); -- cur->path = grub_strdup (path); -- } -- -- if (!cur->name) -- { -- cur->name = grub_strdup (uuid); -- grub_list_push (GRUB_AS_LIST_P (&kpuber), GRUB_AS_LIST (cur)); -- } -- -- return GRUB_ERR_NONE; --} -diff --git a/include/grub/crypttab.h b/include/grub/crypttab.h -new file mode 100644 -index 000000000..1e1b55b65 ---- /dev/null -+++ b/include/grub/crypttab.h -@@ -0,0 +1,22 @@ -+#ifndef GRUB_CRYPTTAB_HEADER -+#define GRUB_CRYPTTAB_HEADER 1 -+ -+#include -+#include -+ -+struct grub_key_publisher -+{ -+ struct grub_key_publisher *next; -+ struct grub_key_publisher **prev; -+ char *name; /* UUID */ -+ char *path; -+ char *key; -+ grub_size_t key_len; -+}; -+ -+extern struct grub_key_publisher *EXPORT_VAR (kpuber); -+ -+grub_err_t -+grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); -+ -+#endif /* ! GRUB_CRYPTTAB_HEADER */ -diff --git a/include/grub/linux.h b/include/grub/linux.h -index d261f2f61..a96ac2048 100644 ---- a/include/grub/linux.h -+++ b/include/grub/linux.h -@@ -22,6 +22,3 @@ grub_initrd_close (struct grub_linux_initrd_context *initrd_ctx); - grub_err_t - grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - void *target); -- --grub_err_t --grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); --- -2.41.0 - diff --git a/0153-discard-cached-key-before-entering-grub-shell-and-ed.patch b/0153-discard-cached-key-before-entering-grub-shell-and-ed.patch deleted file mode 100644 index c064133..0000000 --- a/0153-discard-cached-key-before-entering-grub-shell-and-ed.patch +++ /dev/null @@ -1,99 +0,0 @@ -From a64e651cbee88e543457039d218733d80dfc63e8 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 3 Feb 2023 19:40:31 +0800 -Subject: [PATCH 153/272] discard cached key before entering grub shell and - editor mode - -The cached key is cleared in case of anyone poking around it by means of -the interactive shell offerings. - -Signed-off-by: Michael Chang ---- - grub-core/commands/crypttab.c | 16 ++++++++++++++++ - grub-core/normal/main.c | 2 ++ - grub-core/normal/menu_entry.c | 3 +++ - include/grub/crypttab.h | 2 ++ - 4 files changed, 23 insertions(+) - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index bb6ea5724..c2217ca98 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -53,6 +53,22 @@ grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, - return GRUB_ERR_NONE; - } - -+void -+grub_initrd_discard_key (void) -+{ -+ struct grub_key_publisher *cur, *nxt; -+ -+ FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber) -+ { -+ grub_list_remove (GRUB_AS_LIST (cur)); -+ grub_memset (cur->key, 0, cur->key_len); -+ grub_free (cur->name); -+ grub_free (cur->path); -+ grub_free (cur->key); -+ grub_free (cur); -+ } -+} -+ - static grub_err_t - grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - int argc, char **argv) -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index b5e17344b..a3f711d1d 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -37,6 +37,7 @@ - #ifdef GRUB_MACHINE_IEEE1275 - #include - #endif -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - -@@ -478,6 +479,7 @@ grub_cmdline_run (int nested, int force_auth) - return; - } - -+ grub_initrd_discard_key (); - grub_normal_reader_init (nested); - - while (1) -diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c -index ade56be2b..384ab9ce3 100644 ---- a/grub-core/normal/menu_entry.c -+++ b/grub-core/normal/menu_entry.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - enum update_mode - { -@@ -1262,6 +1263,8 @@ grub_menu_entry_run (grub_menu_entry_t entry) - return; - } - -+ grub_initrd_discard_key(); -+ - screen = make_screen (entry); - if (! screen) - return; -diff --git a/include/grub/crypttab.h b/include/grub/crypttab.h -index 1e1b55b65..113c53cfc 100644 ---- a/include/grub/crypttab.h -+++ b/include/grub/crypttab.h -@@ -19,4 +19,6 @@ extern struct grub_key_publisher *EXPORT_VAR (kpuber); - grub_err_t - grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); - -+void -+grub_initrd_discard_key (void); - #endif /* ! GRUB_CRYPTTAB_HEADER */ --- -2.41.0 - diff --git a/0153-ieee1275-ofdisk-retry-on-open-failure.patch b/0153-ieee1275-ofdisk-retry-on-open-failure.patch new file mode 100644 index 0000000..160f0c9 --- /dev/null +++ b/0153-ieee1275-ofdisk-retry-on-open-failure.patch @@ -0,0 +1,103 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Diego Domingos +Date: Wed, 10 Mar 2021 14:17:52 -0500 +Subject: [PATCH] ieee1275/ofdisk: retry on open failure + +This patch aims to make grub more robust when booting from SAN/Multipath disks. + +If a path is failing intermittently so grub will retry the OPEN and READ the +disk (grub_ieee1275_open and grub_ieee1275_read) until the total amount of times +specified in MAX_RETRIES. + +Signed-off-by: Diego Domingos +--- + grub-core/disk/ieee1275/ofdisk.c | 25 ++++++++++++++++++++----- + include/grub/ieee1275/ofdisk.h | 8 ++++++++ + 2 files changed, 28 insertions(+), 5 deletions(-) + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 629fc15f284..b413822bb87 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -225,7 +225,9 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + char *buf, *bufptr; + unsigned i; + +- if (grub_ieee1275_open (alias->path, &ihandle)) ++ ++ RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle) ++ if (! ihandle) + return; + + /* This method doesn't need memory allocation for the table. Open +@@ -305,7 +307,9 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + return; + } + +- if (grub_ieee1275_open (alias->path, &ihandle)) ++ RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle); ++ ++ if (! ihandle) + { + grub_free (buf); + grub_free (table); +@@ -495,7 +499,7 @@ grub_ofdisk_open (const char *name, grub_disk_t disk) + last_ihandle = 0; + last_devpath = NULL; + +- grub_ieee1275_open (op->open_path, &last_ihandle); ++ RETRY_IEEE1275_OFDISK_OPEN(op->open_path, &last_ihandle); + if (! last_ihandle) + return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); + last_devpath = op->open_path; +@@ -567,7 +571,7 @@ grub_ofdisk_prepare (grub_disk_t disk, grub_disk_addr_t sector) + last_ihandle = 0; + last_devpath = NULL; + +- grub_ieee1275_open (disk->data, &last_ihandle); ++ RETRY_IEEE1275_OFDISK_OPEN(disk->data, &last_ihandle); + if (! last_ihandle) + return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); + last_devpath = disk->data; +@@ -594,12 +598,23 @@ grub_ofdisk_read (grub_disk_t disk, grub_disk_addr_t sector, + return err; + grub_ieee1275_read (last_ihandle, buf, size << disk->log_sector_size, + &actual); +- if (actual != (grub_ssize_t) (size << disk->log_sector_size)) ++ int i = 0; ++ while(actual != (grub_ssize_t) (size << disk->log_sector_size)){ ++ if (i>MAX_RETRIES){ + return grub_error (GRUB_ERR_READ_ERROR, N_("failure reading sector 0x%llx " + "from `%s'"), + (unsigned long long) sector, + disk->name); ++ } ++ last_devpath = NULL; ++ err = grub_ofdisk_prepare (disk, sector); ++ if (err) ++ return err; + ++ grub_ieee1275_read (last_ihandle, buf, size << disk->log_sector_size, ++ &actual); ++ i++; ++ } + return 0; + } + +diff --git a/include/grub/ieee1275/ofdisk.h b/include/grub/ieee1275/ofdisk.h +index 2f69e3f191d..7d2d5409305 100644 +--- a/include/grub/ieee1275/ofdisk.h ++++ b/include/grub/ieee1275/ofdisk.h +@@ -22,4 +22,12 @@ + extern void grub_ofdisk_init (void); + extern void grub_ofdisk_fini (void); + ++#define MAX_RETRIES 20 ++ ++ ++#define RETRY_IEEE1275_OFDISK_OPEN(device, last_ihandle) unsigned retry_i=0;for(retry_i=0; retry_i < MAX_RETRIES; retry_i++){ \ ++ if(!grub_ieee1275_open(device, last_ihandle)) \ ++ break; \ ++ grub_dprintf("ofdisk","Opening disk %s failed. Retrying...\n",device); } ++ + #endif /* ! GRUB_INIT_HEADER */ diff --git a/0154-efinet-Add-DHCP-proxy-support.patch b/0154-efinet-Add-DHCP-proxy-support.patch new file mode 100644 index 0000000..6d1b6da --- /dev/null +++ b/0154-efinet-Add-DHCP-proxy-support.patch @@ -0,0 +1,53 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Ian Page Hands +Date: Tue, 8 Jun 2021 13:48:56 -0400 +Subject: [PATCH] efinet: Add DHCP proxy support + +If a proxyDHCP configuration is used, the server name, server IP and boot +file values should be taken from the DHCP proxy offer instead of the DHCP +server ack packet. Currently that case is not handled, add support for it. + +Signed-off-by: Ian Page Hands +Signed-off-by: Robbie Harwood +--- + grub-core/net/drivers/efi/efinet.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c +index 225dc896da0..83005ea9f88 100644 +--- a/grub-core/net/drivers/efi/efinet.c ++++ b/grub-core/net/drivers/efi/efinet.c +@@ -871,12 +871,32 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + else + { + grub_dprintf ("efinet", "using ipv4 and dhcp\n"); ++ ++ struct grub_net_bootp_packet *dhcp_ack = &pxe_mode->dhcp_ack; ++ ++ if (pxe_mode->proxy_offer_received) ++ { ++ grub_dprintf ("efinet", "proxy offer receive"); ++ struct grub_net_bootp_packet *proxy_offer = &pxe_mode->proxy_offer; ++ ++ if (proxy_offer && dhcp_ack->boot_file[0] == '\0') ++ { ++ grub_dprintf ("efinet", "setting values from proxy offer"); ++ /* Here we got a proxy offer and the dhcp_ack has a nil boot_file ++ * Copy the proxy DHCP offer details into the bootp_packet we are ++ * sending forward as they are the deatils we need. ++ */ ++ *dhcp_ack->server_name = *proxy_offer->server_name; ++ *dhcp_ack->boot_file = *proxy_offer->boot_file; ++ dhcp_ack->server_ip = proxy_offer->server_ip; ++ } ++ } ++ + inter = grub_net_configure_by_dhcp_ack (card->name, card, 0, + (struct grub_net_bootp_packet *) + packet_buf, + packet_bufsz, + 1, device, path); +- + grub_dprintf ("efinet", "device: `%s' path: `%s'\n", *device, *path); + if (inter != NULL) + { diff --git a/0154-ieee1275-ofdisk-retry-on-open-and-read-failure.patch b/0154-ieee1275-ofdisk-retry-on-open-and-read-failure.patch deleted file mode 100644 index bd4c289..0000000 --- a/0154-ieee1275-ofdisk-retry-on-open-and-read-failure.patch +++ /dev/null @@ -1,172 +0,0 @@ -From dfd58fc640f61f9082e5708a2dd202b4d1f8b00b Mon Sep 17 00:00:00 2001 -From: Mukesh Kumar Chaurasiya -Date: Mon, 17 Jul 2023 16:02:34 +0530 -Subject: [PATCH 154/272] ieee1275/ofdisk: retry on open and read failure - -Sometimes, when booting from a very busy SAN, the access to the -disk can fail and then grub will eventually drop to grub prompt. -This scenario is more frequent when deploying many machines at -the same time using the same SAN. -This patch aims to force the ofdisk module to retry the open or -read function for network disks excluding after it fails. We use -DEFAULT_RETRY_TIMEOUT, which is 15 seconds to specify the time it'll -retry to access the disk before it definitely fails. The timeout can be -changed by setting the environment variable ofdisk_retry_timeout. -If the environment variable fails to read, grub will consider the -default value of 15 seconds. - -Signed-off-by: Diego Domingos -Signed-off-by: Mukesh Kumar Chaurasiya ---- - docs/grub.texi | 8 ++++ - grub-core/disk/ieee1275/ofdisk.c | 80 +++++++++++++++++++++++++++++++- - 2 files changed, 86 insertions(+), 2 deletions(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 06fb94325..b9ba66f3f 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -3307,6 +3307,7 @@ These variables have special meaning to GRUB. - * net_default_ip:: - * net_default_mac:: - * net_default_server:: -+* ofdisk_retry_timeout:: - * pager:: - * prefix:: - * pxe_blksize:: -@@ -3736,6 +3737,13 @@ The default is the value of @samp{color_normal} (@pxref{color_normal}). - @xref{Network}. - - -+@node ofdisk_retry_timeout -+@subsection ofdisk_retry_timeout -+ -+The time in seconds till which the grub will retry to open or read a disk in -+case of failure to do so. This value defaults to 15 seconds. -+ -+ - @node pager - @subsection pager - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index 7197d5401..f96bbb58c 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -24,6 +24,9 @@ - #include - #include - #include -+#include -+ -+#define RETRY_DEFAULT_TIMEOUT 15 - - static char *last_devpath; - static grub_ieee1275_ihandle_t last_ihandle; -@@ -783,7 +786,7 @@ compute_dev_path (const char *name) - } - - static grub_err_t --grub_ofdisk_open (const char *name, grub_disk_t disk) -+grub_ofdisk_open_real (const char *name, grub_disk_t disk) - { - grub_ieee1275_phandle_t dev; - char *devpath; -@@ -879,6 +882,56 @@ grub_ofdisk_open (const char *name, grub_disk_t disk) - return 0; - } - -+static grub_uint64_t -+grub_ofdisk_disk_timeout (grub_disk_t disk) -+{ -+ grub_uint64_t retry; -+ const char *timeout = grub_env_get ("ofdisk_retry_timeout"); -+ -+ if (!(grub_strstr (disk->name, "fibre-channel@") || -+ grub_strstr (disk->name, "vfc-client")) || -+ grub_strstr(disk->name, "nvme-of")) -+ { -+ /* Do not retry in case of non network drives */ -+ return 0; -+ } -+ -+ if (timeout != NULL) -+ { -+ retry = grub_strtoul (timeout, 0, 10); -+ if (grub_errno != GRUB_ERR_NONE) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ return RETRY_DEFAULT_TIMEOUT; -+ } -+ if (retry) -+ return retry; -+ } -+ return RETRY_DEFAULT_TIMEOUT; -+} -+ -+static grub_err_t -+grub_ofdisk_open (const char *name, grub_disk_t disk) -+{ -+ grub_err_t err; -+ grub_uint64_t timeout = grub_get_time_ms () + (grub_ofdisk_disk_timeout (disk) * 1000); -+ _Bool cont; -+ do -+ { -+ err = grub_ofdisk_open_real (name, disk); -+ cont = grub_get_time_ms () < timeout; -+ if (err == GRUB_ERR_UNKNOWN_DEVICE && cont) -+ { -+ grub_dprintf ("ofdisk","Failed to open disk %s. Retrying...\n", name); -+ grub_errno = GRUB_ERR_NONE; -+ } -+ else -+ break; -+ grub_millisleep (1000); -+ } while (cont); -+ return err; -+} -+ - static void - grub_ofdisk_close (grub_disk_t disk) - { -@@ -915,7 +968,7 @@ grub_ofdisk_prepare (grub_disk_t disk, grub_disk_addr_t sector) - } - - static grub_err_t --grub_ofdisk_read (grub_disk_t disk, grub_disk_addr_t sector, -+grub_ofdisk_read_real (grub_disk_t disk, grub_disk_addr_t sector, - grub_size_t size, char *buf) - { - grub_err_t err; -@@ -934,6 +987,29 @@ grub_ofdisk_read (grub_disk_t disk, grub_disk_addr_t sector, - return 0; - } - -+static grub_err_t -+grub_ofdisk_read (grub_disk_t disk, grub_disk_addr_t sector, -+ grub_size_t size, char *buf) -+{ -+ grub_err_t err; -+ grub_uint64_t timeout = grub_get_time_ms () + (grub_ofdisk_disk_timeout (disk) * 1000); -+ _Bool cont; -+ do -+ { -+ err = grub_ofdisk_read_real (disk, sector, size, buf); -+ cont = grub_get_time_ms () < timeout; -+ if (err == GRUB_ERR_UNKNOWN_DEVICE && cont) -+ { -+ grub_dprintf ("ofdisk","Failed to read disk %s. Retrying...\n", (char*)disk->data); -+ grub_errno = GRUB_ERR_NONE; -+ } -+ else -+ break; -+ grub_millisleep (1000); -+ } while (cont); -+ return err; -+} -+ - static grub_err_t - grub_ofdisk_write (grub_disk_t disk, grub_disk_addr_t sector, - grub_size_t size, const char *buf) --- -2.41.0 - diff --git a/0198-Don-t-update-the-cmdline-when-generating-legacy-menu.patch b/0155-Don-t-update-the-cmdline-when-generating-legacy-menu.patch similarity index 84% rename from 0198-Don-t-update-the-cmdline-when-generating-legacy-menu.patch rename to 0155-Don-t-update-the-cmdline-when-generating-legacy-menu.patch index c86cb8d..47eca89 100644 --- a/0198-Don-t-update-the-cmdline-when-generating-legacy-menu.patch +++ b/0155-Don-t-update-the-cmdline-when-generating-legacy-menu.patch @@ -1,8 +1,8 @@ -From 985097b56e9a359b7283f5505aa395c9a625efee Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 17 Jun 2021 14:31:42 +0200 -Subject: [PATCH 198/272] Don't update the cmdline when generating legacy - menuentry commands +Subject: [PATCH] Don't update the cmdline when generating legacy menuentry + commands On OPAL ppc64le machines with an old petitboot version that doesn't have support to parse BLS snippets, the grub2-mkconfig script is executed to @@ -20,7 +20,7 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 887892622..14df28135 100644 +index b8bc37e92aa..360ce26e5f9 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in @@ -258,7 +258,9 @@ if [ -z "\${kernelopts}" ]; then @@ -34,6 +34,3 @@ index 887892622..14df28135 100644 if [ "x${BLS_POPULATE_MENU}" = "xtrue" ]; then populate_menu --- -2.41.0 - diff --git a/0155-Restrict-cryptsetup-key-file-permission-for-better-s.patch b/0155-Restrict-cryptsetup-key-file-permission-for-better-s.patch deleted file mode 100644 index 58f9d69..0000000 --- a/0155-Restrict-cryptsetup-key-file-permission-for-better-s.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 4f7557eb3dd64d4b140bb142b7b61824af172139 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 17 Mar 2023 22:00:23 +0800 -Subject: [PATCH 155/272] Restrict cryptsetup key file permission for better - security - -GRUB's default permission 777 for concatenated initrd files was too -permissive for the cryptsetup key file, causing a complaint from -systemd-cryptsetup during boot. This commit replaces the 0777 permission -with a more secure 0400 permission for the key file. - -Signed-off-by: Michael Chang ---- - grub-core/loader/linux.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 1927af4ca..4e028f570 100644 ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -32,6 +32,7 @@ struct grub_linux_initrd_component - char *buf; - char *newc_name; - grub_off_t size; -+ grub_uint32_t mode; - }; - - struct dir -@@ -203,6 +204,7 @@ grub_initrd_component (const char *buf, int bufsz, const char *newc_name, - grub_memcpy (comp->buf, buf, bufsz); - initrd_ctx->nfiles++; - comp->size = bufsz; -+ comp->mode = 0100400; - if (grub_add (initrd_ctx->size, comp->size, - &initrd_ctx->size)) - goto overflow; -@@ -272,6 +274,7 @@ grub_initrd_init (int argc, char *argv[], - grub_initrd_close (initrd_ctx); - return grub_errno; - } -+ initrd_ctx->components[i].mode = 0100777; - name_len = grub_strlen (initrd_ctx->components[i].newc_name) + 1; - if (grub_add (initrd_ctx->size, - ALIGN_UP (sizeof (struct newc_head) + name_len, 4), -@@ -374,6 +377,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - if (initrd_ctx->components[i].newc_name) - { - grub_size_t dir_size; -+ grub_uint32_t mode = initrd_ctx->components[i].mode; - - if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr, - &dir_size)) -@@ -385,7 +389,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - ptr += dir_size; - ptr = make_header (ptr, initrd_ctx->components[i].newc_name, - grub_strlen (initrd_ctx->components[i].newc_name) + 1, -- 0100777, -+ mode, - initrd_ctx->components[i].size); - newc = 1; - } --- -2.41.0 - diff --git a/0258-Suppress-gettext-error-message.patch b/0156-Suppress-gettext-error-message.patch similarity index 84% rename from 0258-Suppress-gettext-error-message.patch rename to 0156-Suppress-gettext-error-message.patch index a15b7b4..e248495 100644 --- a/0258-Suppress-gettext-error-message.patch +++ b/0156-Suppress-gettext-error-message.patch @@ -1,7 +1,7 @@ -From f1b780eaf4f09bf60e6849d3537e3466546638eb Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Paulo Flabiano Smorigo Date: Tue, 29 Jun 2021 13:17:42 +0200 -Subject: [PATCH 258/272] Suppress gettext error message +Subject: [PATCH] Suppress gettext error message Colin Watson's patch from comment #11 on the upstream bug: https://savannah.gnu.org/bugs/?35880#comment11 @@ -14,7 +14,7 @@ Signed-off-by: Paulo Flabiano Smorigo 1 file changed, 7 insertions(+) diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c -index 7a1c14e4f..631af7a94 100644 +index 7a1c14e4f33..631af7a946b 100644 --- a/grub-core/gettext/gettext.c +++ b/grub-core/gettext/gettext.c @@ -424,6 +424,13 @@ grub_gettext_init_ext (struct grub_gettext_context *ctx, @@ -31,6 +31,3 @@ index 7a1c14e4f..631af7a94 100644 if (locale[0] == 'e' && locale[1] == 'n' && (locale[2] == '\0' || locale[2] == '_')) grub_errno = err = GRUB_ERR_NONE; --- -2.41.0 - diff --git a/0156-openfw-Ensure-get_devargs-and-get_devname-functions-.patch b/0156-openfw-Ensure-get_devargs-and-get_devname-functions-.patch deleted file mode 100644 index 612b496..0000000 --- a/0156-openfw-Ensure-get_devargs-and-get_devname-functions-.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 2a741a6eaab35838018db33381c097ba2be0e98a Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 11 Apr 2023 10:59:34 +0800 -Subject: [PATCH 156/272] openfw: Ensure get_devargs and get_devname functions - are consistent - -Commit 165c9b234 changed the logic of ieee1275_get_devargs() to use the -first or second occurrence of a colon as a separator between device name -and arguments. However, this didn't align with the complementary -function ieee1275_get_devname, which uses the first occurrence of a -colon after the namespace keyword as arguments for the nvme-of device. - -This commit addresses the inconsistency by ensuring that both functions -follow a common logic. Now, get_devargs and get_devname functions are -consistent with each other, making it easier to understand and maintain -the codebase. - -Signed-off-by: Michael Chang ---- - grub-core/kern/ieee1275/openfw.c | 15 +++++++++------ - 1 file changed, 9 insertions(+), 6 deletions(-) - -diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c -index e2ffec32d..3bbd07d95 100644 ---- a/grub-core/kern/ieee1275/openfw.c -+++ b/grub-core/kern/ieee1275/openfw.c -@@ -354,13 +354,16 @@ static char * - grub_ieee1275_get_devargs (const char *path) - { - char *colon = grub_strchr (path, ':'); -- char *colon_check = colon; - -- /* Find the last occurence of colon */ -- while(colon_check){ -- colon = colon_check; -- colon_check = grub_strchr (colon+1, ':'); -- } -+ /* Use the same logic in grub_ieee1275_get_devname for nvme-of arguments */ -+ if (grub_strstr(path, "nvme-of")) -+ { -+ char *namespace_split = grub_strstr(path,"/namespace@"); -+ if (namespace_split) -+ colon = grub_strchr (namespace_split, ':'); -+ else -+ colon = NULL; -+ } - - if (! colon) - return 0; --- -2.41.0 - diff --git a/0259-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch b/0157-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch similarity index 83% rename from 0259-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch rename to 0157-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch index 5a9a271..7ecea22 100644 --- a/0259-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch +++ b/0157-grub-set-password-Always-use-boot-grub2-user.cfg-as-.patch @@ -1,7 +1,7 @@ -From ac22931b0979fc0e68c7c7ebf348123975deb942 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 5 Jul 2021 18:24:22 +0200 -Subject: [PATCH 259/272] grub-set-password: Always use /boot/grub2/user.cfg as +Subject: [PATCH] grub-set-password: Always use /boot/grub2/user.cfg as password default The GRUB configuration file is always placed in /boot/grub2/ now, even for @@ -15,13 +15,13 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/util/grub-set-password.in b/util/grub-set-password.in -index 889923e76..d8005e5a1 100644 +index c0b5ebbfdc5..d8005e5a142 100644 --- a/util/grub-set-password.in +++ b/util/grub-set-password.in @@ -1,11 +1,6 @@ #!/bin/sh -e --EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/\"//g') +-EFIDIR=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') -if [ -d /sys/firmware/efi/efivars/ ]; then - grubdir=`echo "/@bootdirname@/efi/EFI/${EFIDIR}/" | sed 's,//*,/,g'` -else @@ -40,6 +40,3 @@ index 889923e76..d8005e5a1 100644 install -m 0600 /dev/null "${OUTPUT_PATH}/user.cfg" 2>/dev/null || : chmod 0600 "${OUTPUT_PATH}/user.cfg" 2>/dev/null || : echo "GRUB2_PASSWORD=${MYPASS}" > "${OUTPUT_PATH}/user.cfg" --- -2.41.0 - diff --git a/0157-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch b/0157-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch deleted file mode 100644 index 515ed0d..0000000 --- a/0157-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch +++ /dev/null @@ -1,210 +0,0 @@ -From 959ff2fc63354be00b3e22ec268b36a96866055e Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 31 Mar 2023 15:19:58 +0800 -Subject: [PATCH 157/272] prep_loadenv: Fix regex for Open Firmware device - specifier with encoded commas - -The Open Firmware device specifier allows for comma-separated properties -of a component, but this conflicts with the way that grub separates -device and partition in its device specifier. To address this, grub -encodes commas in Open Firmware device strings with a leading backslash -as an established convention. - -However, the regular expression used to extract the boot device -substring from the $cmdpath environment variable did not properly retain -commas with leading backslashes as part of the device. This could cause -the comma to be incorrectly interpreted as a partition delimiter and -result in a broken name for the boot disk. - -To fix this issue, we have updated the regular expression to properly -handle the encoded comma in the Open Firmware device specifier, ensuring -that the correct boot device is identified and used. - -v2: -Fix the issue of freeing an uninitialized pointer in early_prep_loadenv. - -Signed-off-by: Michael Chang ---- - grub-core/commands/prep_loadenv.c | 112 ++++++++++++++++++++++-------- - 1 file changed, 82 insertions(+), 30 deletions(-) - -diff --git a/grub-core/commands/prep_loadenv.c b/grub-core/commands/prep_loadenv.c -index eaef2c9d4..109b7ca5a 100644 ---- a/grub-core/commands/prep_loadenv.c -+++ b/grub-core/commands/prep_loadenv.c -@@ -15,7 +15,7 @@ - GRUB_MOD_LICENSE ("GPLv3+"); - - static char * --match_substr (regmatch_t *match, const char *str) -+match_substr (const regmatch_t *match, const char *str) - { - if (match->rm_so != -1) - { -@@ -192,24 +192,18 @@ prep_partname (const char *devname, char **prep) - return err; - } - --static grub_err_t --boot_disk_prep_partname (char **name) -+static regmatch_t * -+regex_match_str (const char *pattern, const char *str, grub_size_t *nmatch) - { - regex_t regex; - int ret; - grub_size_t s; - char *comperr; -- const char *cmdpath; - regmatch_t *matches = NULL; - grub_err_t err = GRUB_ERR_NONE; - -- *name = NULL; -- -- cmdpath = grub_env_get ("cmdpath"); -- if (!cmdpath) -- return GRUB_ERR_NONE; -- -- ret = regcomp (®ex, "\\(([^,]+)(,?.*)?\\)(.*)", REG_EXTENDED); -+ *nmatch = 0; -+ ret = regcomp (®ex, pattern, REG_EXTENDED); - if (ret) - goto fail; - -@@ -217,22 +211,11 @@ boot_disk_prep_partname (char **name) - if (! matches) - goto fail; - -- ret = regexec (®ex, cmdpath, regex.re_nsub + 1, matches, 0); -- if (!ret) -+ ret = regexec (®ex, str, regex.re_nsub + 1, matches, 0); -+ if (ret == 0) - { -- char *devname = devname = match_substr (matches + 1, cmdpath); -- if (!devname) -- { -- err = grub_error (GRUB_ERR_FILE_NOT_FOUND, "%s contains no disk name", cmdpath); -- goto out; -- } -- -- err = prep_partname (devname, name); -- out: -- grub_free (devname); -- regfree (®ex); -- grub_free (matches); -- return err; -+ *nmatch = regex.re_nsub + 1; -+ return matches; - } - - fail: -@@ -242,13 +225,60 @@ boot_disk_prep_partname (char **name) - if (!comperr) - { - regfree (®ex); -- return grub_errno; -+ return NULL; - } - regerror (ret, ®ex, comperr, s); - err = grub_error (GRUB_ERR_TEST_FAILURE, "%s", comperr); - regfree (®ex); - grub_free (comperr); -- return err; -+ return NULL; -+} -+ -+static grub_err_t -+boot_disk_prep_partname (const char *varname, char **name) -+{ -+ const char *cmdpath; -+ regmatch_t *matches; -+ grub_size_t nmatch; -+ char *devname = NULL; -+ -+ *name = NULL; -+ -+ if (varname) -+ cmdpath = grub_env_get (varname); -+ else -+ cmdpath = grub_env_get ("cmdpath"); -+ if (!cmdpath) -+ return GRUB_ERR_NONE; -+ -+ matches = regex_match_str("\\((.*)\\)(.*)", cmdpath, &nmatch); -+ if (matches && nmatch >= 2) -+ devname = match_substr (matches + 1, cmdpath); -+ if (devname == NULL) -+ goto quit; -+ grub_free (matches); -+ -+ matches = regex_match_str ("(.*[^\\])(,.*)", devname, &nmatch); -+ if (matches && nmatch >= 2) -+ { -+ char *n = match_substr (matches + 1, devname); -+ grub_free (devname); -+ devname = n; -+ } -+ else -+ grub_errno = GRUB_ERR_NONE; -+ if (devname) -+ { -+ grub_printf ("search prep from disk `%s'\n", devname); -+ prep_partname (devname, name); -+ } -+ -+ quit: -+ grub_free (devname); -+ grub_free (matches); -+ if (grub_errno) -+ grub_print_error (); -+ return GRUB_ERR_NONE; - } - - static grub_err_t -@@ -281,13 +311,31 @@ grub_cmd_prep_loadenv (grub_command_t cmd __attribute__ ((unused)), - return GRUB_ERR_NONE; - } - -+static grub_err_t -+grub_cmd_prep_partname (grub_command_t cmd __attribute__ ((unused)), -+ int argc, -+ char **argv) -+{ -+ char *prep = NULL; -+ const char *varname = NULL; -+ -+ if (argc > 0) -+ varname = argv[0]; -+ -+ boot_disk_prep_partname(varname, &prep); -+ if (prep) -+ grub_printf ("prep: %s\n", prep); -+ -+ return GRUB_ERR_NONE; -+} -+ - static void - early_prep_loadenv (void) - { - grub_err_t err; -- char *prep; -+ char *prep = NULL; - -- err = boot_disk_prep_partname (&prep); -+ err = boot_disk_prep_partname (NULL, &prep); - if (err == GRUB_ERR_NONE && prep) - err = prep_read_envblk (prep); - if (err == GRUB_ERR_BAD_FILE_TYPE || err == GRUB_ERR_FILE_NOT_FOUND) -@@ -302,6 +350,10 @@ static grub_command_t cmd_prep_load; - GRUB_MOD_INIT(prep_loadenv) - { - early_env_hook = early_prep_loadenv; -+ cmd_prep_load = -+ grub_register_command("prep_partname", grub_cmd_prep_partname, -+ "VARNAME", -+ N_("Get partition name of PReP.")); - cmd_prep_load = - grub_register_command("prep_load_env", grub_cmd_prep_loadenv, - "DEVICE", --- -2.41.0 - diff --git a/0260-normal-main-Discover-the-device-to-read-the-config-f.patch b/0158-normal-main-Discover-the-device-to-read-the-config-f.patch similarity index 94% rename from 0260-normal-main-Discover-the-device-to-read-the-config-f.patch rename to 0158-normal-main-Discover-the-device-to-read-the-config-f.patch index 30fde9a..d642026 100644 --- a/0260-normal-main-Discover-the-device-to-read-the-config-f.patch +++ b/0158-normal-main-Discover-the-device-to-read-the-config-f.patch @@ -1,8 +1,8 @@ -From ab04eb2f00bdc69fbd9ce91e83c7c0f909f3fbc7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 30 Aug 2021 12:31:18 +0200 -Subject: [PATCH 260/272] normal/main: Discover the device to read the config - from as a fallback +Subject: [PATCH] normal/main: Discover the device to read the config from as a + fallback The GRUB core.img is generated locally, when this is done the grub2-probe tool figures out the device and partition that needs to be read to parse @@ -22,11 +22,11 @@ the prefix and fw_path variables. Signed-off-by: Javier Martinez Canillas --- - grub-core/normal/main.c | 58 ++++++++++++++++++++++++++++++++++++----- + grub-core/normal/main.c | 58 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 51 insertions(+), 7 deletions(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 668f48ba6..8e18dac0b 100644 +index 0ea27d3c534..fc3ed551cec 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -337,18 +337,13 @@ grub_enter_normal_mode (const char *config) @@ -121,6 +121,3 @@ index 668f48ba6..8e18dac0b 100644 if (err == GRUB_ERR_FILE_NOT_FOUND) grub_enter_normal_mode (0); } --- -2.41.0 - diff --git a/0158-xen_boot-add-missing-grub_arch_efi_linux_load_image_.patch b/0158-xen_boot-add-missing-grub_arch_efi_linux_load_image_.patch deleted file mode 100644 index 4dbe9a1..0000000 --- a/0158-xen_boot-add-missing-grub_arch_efi_linux_load_image_.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 279e9d3aa52f4cfbc298d634d995fa3a6041de22 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 25 Nov 2022 16:11:24 +0800 -Subject: [PATCH 158/272] xen_boot: add missing - grub_arch_efi_linux_load_image_header - -The new xen_boot module has used grub_arch_efi_linux_load_image_header -exported by grub-core/loader/arm64/linux.c. It is not a problem for -upstream but many downstream projects may not use it and take -grub-core/loader/arm64/efi/linux.c as a replacement as PE entry is the -preferred way in combination with shim loader. - -This patch did a trivial workaround just adding back the dropped -defintion to the xen_boot itself. - -Signed-off-by: Michael Chang ---- - grub-core/loader/arm64/xen_boot.c | 50 +++++++++++++++++++++++++++++++ - 1 file changed, 50 insertions(+) - -diff --git a/grub-core/loader/arm64/xen_boot.c b/grub-core/loader/arm64/xen_boot.c -index 26e1472c9..b82a2db89 100644 ---- a/grub-core/loader/arm64/xen_boot.c -+++ b/grub-core/loader/arm64/xen_boot.c -@@ -84,6 +84,56 @@ static int loaded; - static struct xen_boot_binary *xen_hypervisor; - static struct xen_boot_binary *module_head; - -+/* The function is exported by grub-core/loader/arm64/linux.c that is not built -+ * because we use PE entry provided by grub-core/loader/arm64/efi/linux.c -+ */ -+static bool initrd_use_loadfile2 = false; -+ -+grub_err_t -+grub_arch_efi_linux_load_image_header (grub_file_t file, -+ struct linux_arch_kernel_header * lh) -+{ -+ grub_file_seek (file, 0); -+ if (grub_file_read (file, lh, sizeof (*lh)) < (grub_ssize_t) sizeof (*lh)) -+ return grub_error(GRUB_ERR_FILE_READ_ERROR, "failed to read Linux image header"); -+ -+ if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC) -+ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -+ N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled")); -+ -+ grub_dprintf ("linux", "UEFI stub kernel:\n"); -+ grub_dprintf ("linux", "PE/COFF header @ %08x\n", lh->hdr_offset); -+ -+ /* -+ * The PE/COFF spec permits the COFF header to appear anywhere in the file, so -+ * we need to double check whether it was where we expected it, and if not, we -+ * must load it from the correct offset into the pe_image_header field of -+ * struct linux_arch_kernel_header. -+ */ -+ if ((grub_uint8_t *) lh + lh->hdr_offset != (grub_uint8_t *) &lh->pe_image_header) -+ { -+ if (grub_file_seek (file, lh->hdr_offset) == (grub_off_t) -1 -+ || grub_file_read (file, &lh->pe_image_header, -+ sizeof (struct grub_pe_image_header)) -+ != sizeof (struct grub_pe_image_header)) -+ return grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read COFF image header"); -+ } -+ -+ /* -+ * Linux kernels built for any architecture are guaranteed to support the -+ * LoadFile2 based initrd loading protocol if the image version is >= 1. -+ */ -+ if (lh->pe_image_header.optional_header.major_image_version >= 1) -+ initrd_use_loadfile2 = true; -+ else -+ initrd_use_loadfile2 = false; -+ -+ grub_dprintf ("linux", "LoadFile2 initrd loading %sabled\n", -+ initrd_use_loadfile2 ? "en" : "dis"); -+ -+ return GRUB_ERR_NONE; -+} -+ - static __inline grub_addr_t - xen_boot_address_align (grub_addr_t start, grub_size_t align) - { --- -2.41.0 - diff --git a/0159-font-Try-memdisk-fonts-with-the-same-name.patch b/0159-font-Try-memdisk-fonts-with-the-same-name.patch deleted file mode 100644 index 1df3e66..0000000 --- a/0159-font-Try-memdisk-fonts-with-the-same-name.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 28476936b056a13638d182fcbfa980cba13cd6d3 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 30 Nov 2022 17:02:50 +0800 -Subject: [PATCH 159/272] font: Try memdisk fonts with the same name - ---- - grub-core/font/font.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/grub-core/font/font.c b/grub-core/font/font.c -index 18de52562..92ff415bf 100644 ---- a/grub-core/font/font.c -+++ b/grub-core/font/font.c -@@ -451,7 +451,21 @@ grub_font_load (const char *filename) - #endif - - if (filename[0] == '(' || filename[0] == '/' || filename[0] == '+') -- file = grub_buffile_open (filename, GRUB_FILE_TYPE_FONT, 1024); -+ { -+ char *n = grub_strdup (filename); -+ char *p = grub_strrchr (n, '/'); -+ if (p) -+ { -+ char *q = grub_strrchr (p, '.'); -+ if (q) -+ *q = 0; -+ p++; -+ file = try_open_from_prefix ("(memdisk)", p); -+ } -+ grub_free (n); -+ if (!file) -+ file = grub_buffile_open (filename, GRUB_FILE_TYPE_FONT, 1024); -+ } - else - { - file = try_open_from_prefix ("(memdisk)", filename); --- -2.41.0 - diff --git a/0261-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch b/0159-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch similarity index 80% rename from 0261-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch rename to 0159-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch index 5faa21a..61bb0b5 100644 --- a/0261-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch +++ b/0159-powerpc-adjust-setting-of-prefix-for-signed-binary-c.patch @@ -1,8 +1,7 @@ -From 59913bb5bee475bf42e2d23f18aa6828428b3678 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Mon, 19 Jul 2021 14:35:55 +1000 -Subject: [PATCH 261/272] powerpc: adjust setting of prefix for signed binary - case +Subject: [PATCH] powerpc: adjust setting of prefix for signed binary case On RHEL-signed powerpc grub, we sign a grub with -p /grub2 and expect that there's a boot partition. @@ -22,17 +21,19 @@ Signed-off-by: Daniel Axtens [rharwood@redhat.com: squash in fixup commit] Signed-off-by: Robbie Harwood --- - grub-core/kern/main.c | 46 +++++++++++++++++++++++++++++++++++++++---- - 1 file changed, 42 insertions(+), 4 deletions(-) + grub-core/kern/main.c | 47 +++++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 43 insertions(+), 4 deletions(-) diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index e396be9b2..76ec966c7 100644 +index 353a62ef1e1..dbd4f596fbe 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c -@@ -217,12 +217,50 @@ grub_set_prefix_and_root (void) +@@ -217,12 +217,51 @@ grub_set_prefix_and_root (void) { char *prefix_set; +- prefix_set = grub_xasprintf ("(%s)%s", device, path ? : ""); +- if (prefix_set) +#ifdef __powerpc__ + /* We have to be careful here on powerpc-ieee1275 + signed grub. We + will have signed something with a prefix that doesn't have a device @@ -69,21 +70,17 @@ index e396be9b2..76ec966c7 100644 + grub_env_set ("prefix", path); + else +#endif -+ { - prefix_set = grub_xasprintf ("(%s)%s", device, path ? : ""); - if (prefix_set) -- { + { - grub_env_set ("prefix", prefix_set); - grub_free (prefix_set); -- } -+ { -+ grub_env_set ("prefix", prefix_set); -+ grub_free (prefix_set); -+ } -+ } ++ prefix_set = grub_xasprintf ("(%s)%s", device, path ? : ""); ++ if (prefix_set) ++ { ++ grub_env_set ("prefix", prefix_set); ++ grub_free (prefix_set); ++ } + } ++ grub_env_set ("root", device); } --- -2.41.0 - diff --git a/0160-Make-grub.cfg-compatible-to-old-binaries.patch b/0160-Make-grub.cfg-compatible-to-old-binaries.patch deleted file mode 100644 index 0cee753..0000000 --- a/0160-Make-grub.cfg-compatible-to-old-binaries.patch +++ /dev/null @@ -1,82 +0,0 @@ -From deead8fb4279124d9b6dcb09bee89832d3baffd3 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 8 Aug 2023 17:57:24 +0800 -Subject: [PATCH 160/272] Make grub.cfg compatible to old binaries - -The new added fwsetup test in the topmost menu is always executed -regardless older grub may not be able to handle and thus trapped in a -boot loop between grub and fwsetup. - -This in particular is to make sure a smooth transition if grub is rolled -back to older release and needs to boot newer snapshots. - -Also removing dashes in the UUID that every version released in the wild -can handle. - -Signed-off-by: Michael Chang ---- - util/grub-probe.c | 20 +++++++++++++++++++- - util/grub.d/30_uefi-firmware.in | 16 ++++++++++------ - 2 files changed, 29 insertions(+), 7 deletions(-) - -diff --git a/util/grub-probe.c b/util/grub-probe.c -index e7efcc268..99c738e44 100644 ---- a/util/grub-probe.c -+++ b/util/grub-probe.c -@@ -290,8 +290,26 @@ probe_cryptodisk_uuid (grub_disk_t disk, char delim) - } - if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) - { -+ grub_size_t i, j; - const char *uu = grub_util_cryptodisk_get_uuid (disk); -- grub_printf ("%s%c", uu, delim); -+ grub_size_t len = grub_strlen (uu); -+ char *p = grub_malloc (len + 1); -+ -+ /* Removing dash in the UUID string -+ * This keeps old grub binary to work with newer config in a system, -+ * especially for snapshots. It is a temporary change to make sure smooth -+ * transition from 2.06 to 2.12-rc1 and this hunk can be removed -+ * after 2.12-rc1 release stablized. -+ */ -+ for (i = 0, j = 0; i < len; i++) -+ { -+ if (uu[i] != '-') -+ p[j++] = uu[i]; -+ } -+ p[j] = '\0'; -+ -+ grub_printf ("%s%c", p, delim); -+ grub_free (p); - } - } - -diff --git a/util/grub.d/30_uefi-firmware.in b/util/grub.d/30_uefi-firmware.in -index 1c2365ddb..96ff112e5 100644 ---- a/util/grub.d/30_uefi-firmware.in -+++ b/util/grub.d/30_uefi-firmware.in -@@ -32,11 +32,15 @@ gettext_printf "Adding boot menu entry for UEFI Firmware Settings ...\n" >&2 - - cat << EOF - if [ "\$grub_platform" = "efi" ]; then -- fwsetup --is-supported -- if [ "\$?" = 0 ]; then -- menuentry '$LABEL' \$menuentry_id_option 'uefi-firmware' { -- fwsetup -- } -- fi -+ menuentry '$LABEL' \$menuentry_id_option 'uefi-firmware' { -+ fwsetup --is-supported -+ if [ "\$?" = 0 ]; then -+ fwsetup -+ else -+ echo "Your firmware doesn't support setup menu entry from a boot loader" -+ echo "Press any key to return ..." -+ read -+ fi -+ } - fi - EOF --- -2.41.0 - diff --git a/0262-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch b/0160-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch similarity index 94% rename from 0262-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch rename to 0160-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch index c54593a..a6b31cc 100644 --- a/0262-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch +++ b/0160-powerpc-ieee1275-load-grub-at-4MB-not-2MB.patch @@ -1,7 +1,7 @@ -From 629bd4d14ddd18f1ffb3c48c8321ba2983ce7472 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 22 Oct 2021 09:53:15 +1100 -Subject: [PATCH 262/272] powerpc-ieee1275: load grub at 4MB, not 2MB +Subject: [PATCH] powerpc-ieee1275: load grub at 4MB, not 2MB This was first reported under PFW but reproduces under SLOF. @@ -79,7 +79,7 @@ Signed-off-by: Robbie Harwood 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index f7e594b82..b56751e06 100644 +index c748a37b4c5..ceb15879272 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def @@ -99,7 +99,7 @@ kernel = { @@ -92,7 +92,7 @@ index f7e594b82..b56751e06 100644 mips_arc_ldflags = '-Wl,-Ttext,$(TARGET_LINK_ADDR)'; mips_qemu_mips_ldflags = '-Wl,-Ttext,0x80200000'; diff --git a/include/grub/offsets.h b/include/grub/offsets.h -index 871e1cd4c..69211aa79 100644 +index 871e1cd4c38..69211aa798b 100644 --- a/include/grub/offsets.h +++ b/include/grub/offsets.h @@ -63,7 +63,7 @@ @@ -104,6 +104,3 @@ index 871e1cd4c..69211aa79 100644 #define GRUB_KERNEL_MIPS_LOONGSON_LINK_ADDR 0x80200000 --- -2.41.0 - diff --git a/0263-Add-Fedora-location-of-DejaVu-SANS-font.patch b/0161-Add-Fedora-location-of-DejaVu-SANS-font.patch similarity index 85% rename from 0263-Add-Fedora-location-of-DejaVu-SANS-font.patch rename to 0161-Add-Fedora-location-of-DejaVu-SANS-font.patch index f7121ce..63bbc18 100644 --- a/0263-Add-Fedora-location-of-DejaVu-SANS-font.patch +++ b/0161-Add-Fedora-location-of-DejaVu-SANS-font.patch @@ -1,7 +1,7 @@ -From 5a618632362d59f93cea290adf9c81f6d7a583b9 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: fluteze Date: Sat, 27 Nov 2021 10:54:44 -0600 -Subject: [PATCH 263/272] Add Fedora location of DejaVu SANS font +Subject: [PATCH] Add Fedora location of DejaVu SANS font In Fedora 35, and possibly earlier, grub would fail to configure with a complaint about DejaVu being "not found" even though it was installed. @@ -16,10 +16,10 @@ Signed-off-by: Robbie Harwood 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 20209e24a..12f618741 100644 +index 016cd3d4e0e..d223fe3ef6e 100644 --- a/configure.ac +++ b/configure.ac -@@ -1925,7 +1925,7 @@ if test "x$with_dejavufont" = x; then +@@ -1924,7 +1924,7 @@ if test "x$with_dejavufont" = x; then # search in well-known directories if test x"$starfield_excuse" = x; then for ext in pcf pcf.gz bdf bdf.gz ttf ttf.gz; do @@ -28,6 +28,3 @@ index 20209e24a..12f618741 100644 if test -f "$dir/DejaVuSans.$ext"; then DJVU_FONT_SOURCE="$dir/DejaVuSans.$ext" break 2 --- -2.41.0 - diff --git a/0161-protectors-Implement-NV-index.patch b/0161-protectors-Implement-NV-index.patch deleted file mode 100644 index 06b149c..0000000 --- a/0161-protectors-Implement-NV-index.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 507384791997ce5cbdb2500138d56d79b3e6f950 Mon Sep 17 00:00:00 2001 -From: Patrick Colp -Date: Mon, 31 Jul 2023 07:01:45 -0700 -Subject: [PATCH 161/272] protectors: Implement NV index - -Currently with the TPM2 protector, only SRK mode is supported and -NV index support is just a stub. Implement the NV index option. - -Note: This only extends support on the unseal path. grub2_protect -has not been updated. tpm2-tools can be used to insert a key into -the NV index. - -An example of inserting a key using tpm2-tools: - - # Get random key. - tpm2_getrandom 32 > key.dat - - # Create primary object. - tpm2_createprimary -C o -g sha256 -G rsa -c primary.ctx - - # Create policy object. `pcrs.dat` contains the PCR values to seal against. - tpm2_startauthsession -S session.dat - tpm2_policypcr -S session.dat -l sha256:7,11 -f pcrs.dat -L policy.dat - tpm2_flushcontext session.dat - - # Seal key into TPM. - cat key.dat | tpm2_create -C primary.ctx -u key.pub -r key.priv -L policy.dat -i- - tpm2_load -C primary.ctx -u key.pub -r key.priv -n sealing.name -c sealing.ctx - tpm2_evictcontrol -C o -c sealing.ctx 0x81000000 - -Then to unseal the key in grub, add this to grub.cfg: - - tpm2_key_protector_init --mode=nv --nvindex=0x81000000 --pcrs=7,11 - cryptomount -u --protector tpm2 - -Signed-off-by: Patrick Colp ---- - grub-core/tpm2/module.c | 25 ++++++++++++++++++++----- - 1 file changed, 20 insertions(+), 5 deletions(-) - -diff --git a/grub-core/tpm2/module.c b/grub-core/tpm2/module.c -index 0cbfd06e8..00b401bd5 100644 ---- a/grub-core/tpm2/module.c -+++ b/grub-core/tpm2/module.c -@@ -834,12 +834,27 @@ static grub_err_t - grub_tpm2_protector_nv_recover (const struct grub_tpm2_protector_context *ctx, - grub_uint8_t **key, grub_size_t *key_size) - { -- (void)ctx; -- (void)key; -- (void)key_size; -+ TPM_HANDLE sealed_handle = ctx->nv; -+ tpm2key_policy_t policy_seq = NULL; -+ grub_err_t err; -+ -+ /* Create a basic policy sequence based on the given PCR selection */ -+ err = grub_tpm2_protector_simple_policy_seq (ctx, &policy_seq); -+ if (err != GRUB_ERR_NONE) -+ goto exit; -+ -+ err = grub_tpm2_protector_unseal (policy_seq, sealed_handle, key, key_size); -+ -+ /* Pop error messages on success */ -+ if (err == GRUB_ERR_NONE) -+ while (grub_error_pop ()); -+ -+exit: -+ TPM2_FlushContext (sealed_handle); - -- return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, -- N_("NV Index mode is not implemented yet")); -+ grub_tpm2key_free_policy_seq (policy_seq); -+ -+ return err; - } - - static grub_err_t --- -2.41.0 - diff --git a/0162-cryptodisk-Fallback-to-passphrase.patch b/0162-cryptodisk-Fallback-to-passphrase.patch deleted file mode 100644 index 74dde57..0000000 --- a/0162-cryptodisk-Fallback-to-passphrase.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 0d7e9d634261f5d58d14126a941e00be5e4a736c Mon Sep 17 00:00:00 2001 -From: Patrick Colp -Date: Sun, 30 Jul 2023 12:58:18 -0700 -Subject: [PATCH 162/272] cryptodisk: Fallback to passphrase - -If a protector is specified, but it fails to unlock the disk, fall back -to asking for the passphrase. However, an error was set indicating that -the protector(s) failed. Later code (e.g., LUKS code) fails as -`grub_errno` is now set. Print the existing errors out first, before -proceeding with the passphrase. - -Signed-off-by: Patrick Colp ---- - grub-core/disk/cryptodisk.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 4e03a6393..84da399b8 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1193,11 +1193,16 @@ grub_cryptodisk_scan_device_real (const char *name, - source->name, source->partition != NULL ? "," : "", - part != NULL ? part : N_("UNKNOWN"), dev->uuid); - grub_free (part); -- goto error; - } - - if (!cargs->key_len) - { -+ if (grub_errno) -+ { -+ grub_print_error (); -+ grub_errno = GRUB_ERR_NONE; -+ } -+ - /* Get the passphrase from the user, if no key data. */ - askpass = 1; - part = grub_partition_get_name (source->partition); --- -2.41.0 - diff --git a/0264-efi-new-connectefi-command.patch b/0162-efi-new-connectefi-command.patch similarity index 94% rename from 0264-efi-new-connectefi-command.patch rename to 0162-efi-new-connectefi-command.patch index 2f7c375..f36d9ca 100644 --- a/0264-efi-new-connectefi-command.patch +++ b/0162-efi-new-connectefi-command.patch @@ -1,7 +1,7 @@ -From 6eaadbfc40fc1ae38ba7630239639b6ddc3b0157 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Renaud=20M=C3=A9trich?= Date: Tue, 15 Feb 2022 14:05:22 +0100 -Subject: [PATCH 264/272] efi: new 'connectefi' command +Subject: [PATCH] efi: new 'connectefi' command MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -52,35 +52,22 @@ needed. Signed-off-by: Renaud Métrich Signed-off-by: Robbie Harwood --- - NEWS | 2 +- - grub-core/Makefile.core.def | 6 + - grub-core/commands/efi/connectefi.c | 205 ++++++++++++++++++++++++++++ + grub-core/Makefile.core.def | 6 ++ + grub-core/commands/efi/connectefi.c | 205 ++++++++++++++++++++++++++++++++++++ grub-core/commands/efi/lsefi.c | 1 + - grub-core/disk/efi/efidisk.c | 13 ++ - grub-core/kern/efi/efi.c | 13 ++ + grub-core/disk/efi/efidisk.c | 13 +++ + grub-core/kern/efi/efi.c | 13 +++ include/grub/efi/disk.h | 2 + include/grub/efi/efi.h | 5 + + NEWS | 2 +- 8 files changed, 246 insertions(+), 1 deletion(-) create mode 100644 grub-core/commands/efi/connectefi.c -diff --git a/NEWS b/NEWS -index 310130962..e3cfcd569 100644 ---- a/NEWS -+++ b/NEWS -@@ -118,7 +118,7 @@ New in 2.02: - * Prefer pmtimer for TSC calibration. - - * New/improved platform support: -- * New `efifwsetup' and `lsefi' commands on EFI platforms. -+ * New `efifwsetup', `lsefi' and `connectefi` commands on EFI platforms. - * New `cmosdump' and `cmosset' commands on platforms with CMOS support. - * New command `pcidump' for PCI platforms. - * Improve opcode parsing in ACPI halt implementation. diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index b56751e06..f7e8864b4 100644 +index ceb15879272..c9dcfa00e85 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -856,6 +856,12 @@ module = { +@@ -861,6 +861,12 @@ module = { enable = efi; }; @@ -95,7 +82,7 @@ index b56751e06..f7e8864b4 100644 common = commands/blocklist.c; diff --git a/grub-core/commands/efi/connectefi.c b/grub-core/commands/efi/connectefi.c new file mode 100644 -index 000000000..0f840ea05 +index 00000000000..0f840ea0575 --- /dev/null +++ b/grub-core/commands/efi/connectefi.c @@ -0,0 +1,205 @@ @@ -305,7 +292,7 @@ index 000000000..0f840ea05 + grub_unregister_command (cmd); +} diff --git a/grub-core/commands/efi/lsefi.c b/grub-core/commands/efi/lsefi.c -index 7b8316d41..3635cd99b 100644 +index 7b8316d4184..3635cd99b75 100644 --- a/grub-core/commands/efi/lsefi.c +++ b/grub-core/commands/efi/lsefi.c @@ -19,6 +19,7 @@ @@ -317,7 +304,7 @@ index 7b8316d41..3635cd99b 100644 #include #include diff --git a/grub-core/disk/efi/efidisk.c b/grub-core/disk/efi/efidisk.c -index 822005456..af69cc3bc 100644 +index 822005456eb..af69cc3bc8a 100644 --- a/grub-core/disk/efi/efidisk.c +++ b/grub-core/disk/efi/efidisk.c @@ -396,6 +396,19 @@ enumerate_disks (void) @@ -341,7 +328,7 @@ index 822005456..af69cc3bc 100644 grub_efidisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, grub_disk_pull_t pull) diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c -index 02f18a28f..f22e0a1d8 100644 +index ef837387368..412a2073f41 100644 --- a/grub-core/kern/efi/efi.c +++ b/grub-core/kern/efi/efi.c @@ -96,6 +96,19 @@ grub_efi_locate_handle (grub_efi_locate_search_type_t search_type, @@ -365,7 +352,7 @@ index 02f18a28f..f22e0a1d8 100644 grub_efi_open_protocol (grub_efi_handle_t handle, grub_guid_t *protocol, diff --git a/include/grub/efi/disk.h b/include/grub/efi/disk.h -index 254475c84..6845c2f1f 100644 +index 254475c8428..6845c2f1fd8 100644 --- a/include/grub/efi/disk.h +++ b/include/grub/efi/disk.h @@ -27,6 +27,8 @@ grub_efi_handle_t @@ -378,10 +365,10 @@ index 254475c84..6845c2f1f 100644 void grub_efidisk_fini (void); diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h -index 1108d0c07..77932f058 100644 +index 6c2c1f36e37..736d6f25694 100644 --- a/include/grub/efi/efi.h +++ b/include/grub/efi/efi.h -@@ -50,6 +50,11 @@ EXPORT_FUNC(grub_efi_locate_handle) (grub_efi_locate_search_type_t search_type, +@@ -53,6 +53,11 @@ EXPORT_FUNC(grub_efi_locate_handle) (grub_efi_locate_search_type_t search_type, grub_guid_t *protocol, void *search_key, grub_efi_uintn_t *num_handles); @@ -393,6 +380,16 @@ index 1108d0c07..77932f058 100644 void *EXPORT_FUNC(grub_efi_open_protocol) (grub_efi_handle_t handle, grub_guid_t *protocol, grub_efi_uint32_t attributes); --- -2.41.0 - +diff --git a/NEWS b/NEWS +index 3101309621b..e3cfcd569c2 100644 +--- a/NEWS ++++ b/NEWS +@@ -118,7 +118,7 @@ New in 2.02: + * Prefer pmtimer for TSC calibration. + + * New/improved platform support: +- * New `efifwsetup' and `lsefi' commands on EFI platforms. ++ * New `efifwsetup', `lsefi' and `connectefi` commands on EFI platforms. + * New `cmosdump' and `cmosset' commands on platforms with CMOS support. + * New command `pcidump' for PCI platforms. + * Improve opcode parsing in ACPI halt implementation. diff --git a/0163-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch b/0163-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch deleted file mode 100644 index b5a814f..0000000 --- a/0163-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 7e3bac9f015f6730e9e4be635269bd0f8cfe80e6 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 3 Aug 2023 15:52:52 +0800 -Subject: [PATCH 163/272] cryptodisk: wipe out the cached keys from protectors - -An attacker may insert a malicious disk with the same crypto UUID and -trick grub2 to mount the fake root. Even though the key from the key -protector fails to unlock the fake root, it's not wiped out cleanly so -the attacker could dump the memory to retrieve the secret key. To defend -such attack, wipe out the cached key when we don't need it. - -Signed-off-by: Gary Lin ---- - grub-core/disk/cryptodisk.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 84da399b8..184efe425 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1355,7 +1355,11 @@ grub_cryptodisk_clear_key_cache (struct grub_cryptomount_args *cargs) - return; - - for (i = 0; cargs->protectors[i]; i++) -- grub_free (cargs->key_cache[i].key); -+ { -+ if (cargs->key_cache[i].key) -+ grub_memset (cargs->key_cache[i].key, 0, cargs->key_cache[i].key_len); -+ grub_free (cargs->key_cache[i].key); -+ } - - grub_free (cargs->key_cache); - } --- -2.41.0 - diff --git a/0265-powerpc-prefix-detection-support-device-names-with-c.patch b/0163-powerpc-prefix-detection-support-device-names-with-c.patch similarity index 91% rename from 0265-powerpc-prefix-detection-support-device-names-with-c.patch rename to 0163-powerpc-prefix-detection-support-device-names-with-c.patch index 2c094a4..5744413 100644 --- a/0265-powerpc-prefix-detection-support-device-names-with-c.patch +++ b/0163-powerpc-prefix-detection-support-device-names-with-c.patch @@ -1,8 +1,7 @@ -From 1479cc070507c1784572adba62b3e47f2c2d0237 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Thu, 24 Mar 2022 14:34:32 +1100 -Subject: [PATCH 265/272] powerpc: prefix detection: support device names with - commas +Subject: [PATCH] powerpc: prefix detection: support device names with commas Frustratingly, the device name itself can contain an embedded comma: e.g /pci@800000020000015/pci1014,034A@0/sas/disk@5000c50098a0ee8b @@ -27,11 +26,11 @@ search anyway, so this will do. Signed-off-by: Daniel Axtens --- - grub-core/kern/main.c | 29 ++++++++++++++++++++++------- - 1 file changed, 22 insertions(+), 7 deletions(-) + grub-core/kern/main.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 76ec966c7..1ec4568f1 100644 +index dbd4f596fbe..8e89763f43b 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c @@ -242,14 +242,29 @@ grub_set_prefix_and_root (void) @@ -40,15 +39,14 @@ index 76ec966c7..1ec4568f1 100644 - So we act unless there is a comma in the device, which would indicate - a partition has already been specified. -- -- (If we only have a path, the code in normal to discover config files -- will try both without partitions and then with any partitions so we -- will cover both CDs and HDs.) + - Frustratingly, the device name itself can contain an embedded comma: + /pci@800000020000015/pci1014,034A@0/sas/disk@5000c50098a0ee8b + So we cannot even rely upon the presence of a comma to say that a + partition has been specified! -+ + +- (If we only have a path, the code in normal to discover config files +- will try both without partitions and then with any partitions so we +- will cover both CDs and HDs.) + If we only have a path in $prefix, the code in normal to discover + config files will try all disks, both without partitions and then with + any partitions so we will cover both CDs and HDs. @@ -71,6 +69,3 @@ index 76ec966c7..1ec4568f1 100644 grub_env_set ("prefix", path); else #endif --- -2.41.0 - diff --git a/0164-diskfilter-look-up-cryptodisk-devices-first.patch b/0164-diskfilter-look-up-cryptodisk-devices-first.patch deleted file mode 100644 index 0ec7e9a..0000000 --- a/0164-diskfilter-look-up-cryptodisk-devices-first.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 9f5d9a0ead66f5d39c910f7b6db3f944de23cfcb Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 10 Aug 2023 10:19:29 +0800 -Subject: [PATCH 164/272] diskfilter: look up cryptodisk devices first - -When using disk auto-unlocking with TPM 2.0, the typical grub.cfg may -look like this: - - tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm - cryptomount -u -P tpm2 - search --fs-uuid --set=root - -Since the disk search order is based on the order of module loading, the -attacker could insert a malicious disk with the same FS-UUID root to -trick grub2 to boot into th malicious root and further dump memory to -steal the unsealed key. - -To defend such attack, we can specify the hint provided by 'grub-probe' -to search the encrypted partition first: - -search --fs-uuid --set=root --hint='cryptouuid/' - -However, for LVM on a encrypted partition, the search hint provided by -'grub-probe' is: - - --hint='lvmid//' - -It doesn't guarantee to look up the logical volume from the encrypted -partition, so the attacker may have the chance to fool grub2 to boot -into the malicious disk. - -To mininize the attack surface, this commit tweaks the disk device search -in diskfilter to look up cryptodisk devices first and then others, so -that the auto-unlocked disk will be found first, not the attacker's disk. - -Signed-off-by: Gary Lin ---- - grub-core/disk/diskfilter.c | 35 ++++++++++++++++++++++++++--------- - 1 file changed, 26 insertions(+), 9 deletions(-) - -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 41e177549..c45bef1ca 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -322,15 +322,32 @@ scan_devices (const char *arname) - int need_rescan; - - for (pull = 0; pull < GRUB_DISK_PULL_MAX; pull++) -- for (p = grub_disk_dev_list; p; p = p->next) -- if (p->id != GRUB_DISK_DEVICE_DISKFILTER_ID -- && p->disk_iterate) -- { -- if ((p->disk_iterate) (scan_disk_hook, NULL, pull)) -- return; -- if (arname && is_lv_readable (find_lv (arname), 1)) -- return; -- } -+ { -+ /* look up the crytodisk devices first */ -+ for (p = grub_disk_dev_list; p; p = p->next) -+ if (p->id == GRUB_DISK_DEVICE_CRYPTODISK_ID -+ && p->disk_iterate) -+ { -+ if ((p->disk_iterate) (scan_disk_hook, NULL, pull)) -+ return; -+ if (arname && is_lv_readable (find_lv (arname), 1)) -+ return; -+ break; -+ } -+ -+ /* check the devices other than crytodisk */ -+ for (p = grub_disk_dev_list; p; p = p->next) -+ if (p->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ continue; -+ else if (p->id != GRUB_DISK_DEVICE_DISKFILTER_ID -+ && p->disk_iterate) -+ { -+ if ((p->disk_iterate) (scan_disk_hook, NULL, pull)) -+ return; -+ if (arname && is_lv_readable (find_lv (arname), 1)) -+ return; -+ } -+ } - - scan_depth = 0; - need_rescan = 1; --- -2.41.0 - diff --git a/0164-make-ofdisk_retries-optional.patch b/0164-make-ofdisk_retries-optional.patch new file mode 100644 index 0000000..791c0a6 --- /dev/null +++ b/0164-make-ofdisk_retries-optional.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Diego Domingos +Date: Thu, 24 Mar 2022 13:14:42 -0400 +Subject: [PATCH] make ofdisk_retries optional + +The feature Retry on Fail added to GRUB can cause a LPM to take +longer if the SAN is slow. + +When a LPM to external site occur, the path of the disk can change +and thus the disk search function on grub can take some time since +it is used as a hint. This can cause the Retry on Fail feature to +try to access the disk 20x times (since this is hardcoded number) +and, if the SAN is slow, the boot time can increase a lot. +In some situations not acceptable. + +The following patch enables a configuration at user space of the +maximum number of retries we want for this feature. + +The variable ofdisk_retries should be set using grub2-editenv +and will be checked by retry function. If the variable is not set, +so the default number of retries will be used instead. +--- + include/grub/ieee1275/ofdisk.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/grub/ieee1275/ofdisk.h b/include/grub/ieee1275/ofdisk.h +index 7d2d5409305..0074d55eee4 100644 +--- a/include/grub/ieee1275/ofdisk.h ++++ b/include/grub/ieee1275/ofdisk.h +@@ -25,7 +25,12 @@ extern void grub_ofdisk_fini (void); + #define MAX_RETRIES 20 + + +-#define RETRY_IEEE1275_OFDISK_OPEN(device, last_ihandle) unsigned retry_i=0;for(retry_i=0; retry_i < MAX_RETRIES; retry_i++){ \ ++#define RETRY_IEEE1275_OFDISK_OPEN(device, last_ihandle) \ ++ unsigned max_retries = MAX_RETRIES; \ ++ if(grub_env_get("ofdisk_retries") != NULL) \ ++ max_retries = grub_strtoul(grub_env_get("ofdisk_retries"), 0, 10)+1; \ ++ grub_dprintf("ofdisk","MAX_RETRIES set to %u\n",max_retries); \ ++ unsigned retry_i=0;for(retry_i=0; retry_i < max_retries; retry_i++){ \ + if(!grub_ieee1275_open(device, last_ihandle)) \ + break; \ + grub_dprintf("ofdisk","Opening disk %s failed. Retrying...\n",device); } diff --git a/0165-misc-Make-grub_min-and-grub_max-more-resilient.patch b/0165-misc-Make-grub_min-and-grub_max-more-resilient.patch new file mode 100644 index 0000000..a9afc99 --- /dev/null +++ b/0165-misc-Make-grub_min-and-grub_max-more-resilient.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 21 Mar 2022 16:06:10 -0400 +Subject: [PATCH] misc: Make grub_min() and grub_max() more resilient. + +grub_min(a,b) and grub_max(a,b) use a relatively naive implementation +which leads to several problems: +- they evaluate their parameters more than once +- the naive way to address this, to declare temporary variables in a + statement-expression, isn't resilient against nested uses, because + MIN(a,MIN(b,c)) results in the temporary variables being declared in + two nested scopes, which may result in a build warning depending on + your build options. + +This patch changes our implementation to use a statement-expression +inside a helper macro, and creates the symbols for the temporary +variables with __COUNTER__ (A GNU C cpp extension) and token pasting to +create uniquely named internal variables. + +Signed-off-by: Peter Jones +--- + grub-core/loader/multiboot_elfxx.c | 4 +--- + include/grub/misc.h | 25 +++++++++++++++++++++++-- + 2 files changed, 24 insertions(+), 5 deletions(-) + +diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c +index 1edad05948c..8d370b0b3f5 100644 +--- a/grub-core/loader/multiboot_elfxx.c ++++ b/grub-core/loader/multiboot_elfxx.c +@@ -45,9 +45,7 @@ + #endif + + #include +- +-#define CONCAT(a,b) CONCAT_(a, b) +-#define CONCAT_(a,b) a ## b ++#include + + #pragma GCC diagnostic ignored "-Wcast-align" + +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 3f5f5b61695..252bdb161eb 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -35,6 +35,14 @@ + #define ARRAY_SIZE(array) (sizeof (array) / sizeof (array[0])) + #define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; } + ++#ifndef CONCAT_ ++#define CONCAT_(a, b) a ## b ++#endif ++ ++#ifndef CONCAT ++#define CONCAT(a, b) CONCAT_(a, b) ++#endif ++ + #define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __LINE__, condition, __VA_ARGS__) + + void *EXPORT_FUNC(grub_memmove) (void *dest, const void *src, grub_size_t n); +@@ -525,8 +533,21 @@ void EXPORT_FUNC(grub_real_boot_time) (const char *file, + #define grub_boot_time(...) + #endif + +-#define grub_max(a, b) (((a) > (b)) ? (a) : (b)) +-#define grub_min(a, b) (((a) < (b)) ? (a) : (b)) ++#define _grub_min(a, b, _a, _b) \ ++ ({ typeof (a) _a = (a); \ ++ typeof (b) _b = (b); \ ++ _a < _b ? _a : _b; }) ++#define grub_min(a, b) _grub_min(a, b, \ ++ CONCAT(_a_,__COUNTER__), \ ++ CONCAT(_b_,__COUNTER__)) ++ ++#define _grub_max(a, b, _a, _b) \ ++ ({ typeof (a) _a = (a); \ ++ typeof (b) _b = (b); \ ++ _a > _b ? _a : _b; }) ++#define grub_max(a, b) _grub_max(a, b, \ ++ CONCAT(_a_,__COUNTER__), \ ++ CONCAT(_b_,__COUNTER__)) + + #define grub_log2ull(n) (GRUB_TYPE_BITS (grub_uint64_t) - __builtin_clzll (n) - 1) + diff --git a/0166-ReiserFS-switch-to-using-grub_min-grub_max.patch b/0166-ReiserFS-switch-to-using-grub_min-grub_max.patch new file mode 100644 index 0000000..76d44ac --- /dev/null +++ b/0166-ReiserFS-switch-to-using-grub_min-grub_max.patch @@ -0,0 +1,92 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 21 Apr 2022 16:31:17 -0400 +Subject: [PATCH] ReiserFS: switch to using grub_min()/grub_max() + +This is a minor cleanup patch to remove the bespoke MIN() and MAX() +definitions from the reiserfs driver, and uses grub_min() / grub_max() +instead. + +Signed-off-by: Peter Jones +--- + grub-core/fs/reiserfs.c | 28 +++++++++------------------- + 1 file changed, 9 insertions(+), 19 deletions(-) + +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index 36b26ac98a0..42818c37622 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -42,16 +42,6 @@ + + GRUB_MOD_LICENSE ("GPLv3+"); + +-#define MIN(a, b) \ +- ({ typeof (a) _a = (a); \ +- typeof (b) _b = (b); \ +- _a < _b ? _a : _b; }) +- +-#define MAX(a, b) \ +- ({ typeof (a) _a = (a); \ +- typeof (b) _b = (b); \ +- _a > _b ? _a : _b; }) +- + #define REISERFS_SUPER_BLOCK_OFFSET 0x10000 + #define REISERFS_MAGIC_LEN 12 + #define REISERFS_MAGIC_STRING "ReIsEr" +@@ -1076,7 +1066,7 @@ grub_reiserfs_read_real (struct grub_fshelp_node *node, + grub_reiserfs_set_key_type (&key, GRUB_REISERFS_ANY, 2); + initial_position = off; + current_position = 0; +- final_position = MIN (len + initial_position, node->size); ++ final_position = grub_min (len + initial_position, node->size); + grub_dprintf ("reiserfs", + "Reading from %lld to %lld (%lld instead of requested %ld)\n", + (unsigned long long) initial_position, +@@ -1115,8 +1105,8 @@ grub_reiserfs_read_real (struct grub_fshelp_node *node, + grub_dprintf ("reiserfs_blocktype", "D: %u\n", (unsigned) block); + if (initial_position < current_position + item_size) + { +- offset = MAX ((signed) (initial_position - current_position), 0); +- length = (MIN (item_size, final_position - current_position) ++ offset = grub_max ((signed) (initial_position - current_position), 0); ++ length = (grub_min (item_size, final_position - current_position) + - offset); + grub_dprintf ("reiserfs", + "Reading direct block %u from %u to %u...\n", +@@ -1161,9 +1151,9 @@ grub_reiserfs_read_real (struct grub_fshelp_node *node, + grub_dprintf ("reiserfs_blocktype", "I: %u\n", (unsigned) block); + if (current_position + block_size >= initial_position) + { +- offset = MAX ((signed) (initial_position - current_position), +- 0); +- length = (MIN (block_size, final_position - current_position) ++ offset = grub_max ((signed) (initial_position - current_position), ++ 0); ++ length = (grub_min (block_size, final_position - current_position) + - offset); + grub_dprintf ("reiserfs", + "Reading indirect block %u from %u to %u...\n", +@@ -1205,7 +1195,7 @@ grub_reiserfs_read_real (struct grub_fshelp_node *node, + switch (found.type) + { + case GRUB_REISERFS_DIRECT: +- read_length = MIN (len, item_size - file->offset); ++ read_length = grub_min (len, item_size - file->offset); + grub_disk_read (found.data->disk, + (found.block_number * block_size) / GRUB_DISK_SECTOR_SIZE, + grub_le_to_cpu16 (found.header.item_location) + file->offset, +@@ -1224,12 +1214,12 @@ grub_reiserfs_read_real (struct grub_fshelp_node *node, + item_size, (char *) indirect_block_ptr); + if (grub_errno) + goto fail; +- len = MIN (len, file->size - file->offset); ++ len = grub_min (len, file->size - file->offset); + for (indirect_block = file->offset / block_size; + indirect_block < indirect_block_count && read_length < len; + indirect_block++) + { +- read = MIN (block_size, len - read_length); ++ read = grub_min (block_size, len - read_length); + grub_disk_read (found.data->disk, + (grub_le_to_cpu32 (indirect_block_ptr[indirect_block]) * block_size) / GRUB_DISK_SECTOR_SIZE, + file->offset % block_size, read, diff --git a/0166-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch b/0166-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch deleted file mode 100644 index b477a4d..0000000 --- a/0166-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch +++ /dev/null @@ -1,143 +0,0 @@ -From be9dee24006431625e3d5910c76b2f8b4f0d91dd Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 23 Oct 2023 16:11:53 +0800 -Subject: [PATCH 166/272] luks2: Use grub-tpm2 token for TPM2-protected volume - unlock - -This commit enables the use of the grub-tpm2 token for unlocking LUKS2 -volumes protected by TPM2. The token tracks keyslots associated with a -sealed key, making the unsealing process more efficient and secure. - -Signed-Off-by Michael Chang ---- - grub-core/disk/luks2.c | 81 ++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 79 insertions(+), 2 deletions(-) - -diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c -index d5106402f..fe5ba777a 100644 ---- a/grub-core/disk/luks2.c -+++ b/grub-core/disk/luks2.c -@@ -124,6 +124,14 @@ struct grub_luks2_digest - }; - typedef struct grub_luks2_digest grub_luks2_digest_t; - -+struct grub_luks2_token_tpm -+{ -+ grub_uint64_t idx; -+ grub_uint64_t keyslots; -+ const char *timestamp; -+}; -+typedef struct grub_luks2_token_tpm grub_luks2_token_tpm_t; -+ - gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src, - grub_uint8_t * dst, grub_size_t blocksize, - grub_size_t blocknumbers); -@@ -257,6 +265,39 @@ luks2_parse_digest (grub_luks2_digest_t *out, const grub_json_t *digest) - return GRUB_ERR_NONE; - } - -+static grub_err_t -+luks2_parse_token_tpm (grub_luks2_token_tpm_t *out, const grub_json_t *token) -+{ -+ grub_json_t keyslots, o; -+ grub_size_t i, size; -+ grub_uint64_t bit; -+ const char *type; -+ -+ if (grub_json_getstring (&type, token, "type")) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid token type"); -+ else if (grub_strcmp (type, "grub-tpm2")) -+ return GRUB_ERR_NONE; -+ -+ if (grub_json_getvalue (&keyslots, token, "keyslots") || -+ grub_json_getstring (&out->timestamp, token, "timestamp")) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing token parameters"); -+ -+ if (grub_json_getsize (&size, &keyslots)) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, -+ "Token references no keyslots"); -+ -+ out->keyslots = 0; -+ for (i = 0; i < size; i++) -+ { -+ if (grub_json_getchild (&o, &keyslots, i) || -+ grub_json_getuint64 (&bit, &o, NULL)) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid keyslot"); -+ out->keyslots |= (1 << bit); -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ - static grub_err_t - luks2_get_keyslot (grub_luks2_keyslot_t *k, grub_luks2_digest_t *d, grub_luks2_segment_t *s, - const grub_json_t *root, grub_size_t keyslot_json_idx) -@@ -561,13 +602,14 @@ luks2_recover_key (grub_disk_t source, - { - grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN]; - char cipher[32], *json_header = NULL, *ptr; -- grub_size_t candidate_key_len = 0, json_idx, size; -+ grub_size_t candidate_key_len = 0, json_idx, size, tsize; - grub_luks2_header_t header; - grub_luks2_keyslot_t keyslot; - grub_luks2_digest_t digest; - grub_luks2_segment_t segment; -+ grub_luks2_token_tpm_t token_tpm; - gcry_err_code_t gcry_ret; -- grub_json_t *json = NULL, keyslots; -+ grub_json_t *json = NULL, keyslots, tokens; - grub_err_t ret; - - if (cargs->key_data == NULL || cargs->key_len == 0) -@@ -605,6 +647,37 @@ luks2_recover_key (grub_disk_t source, - goto err; - } - -+ token_tpm.keyslots = 0; -+ tsize = 0; -+ if (cargs->protectors) -+ { -+ int i; -+ for (i = 0; cargs->protectors[i]; i++) -+ if (grub_strcmp(cargs->protectors[i], "tpm2") == 0) -+ break; -+ -+ if (!cargs->protectors[i] || -+ cargs->key_cache[i].invalid || -+ grub_json_getvalue (&tokens, json, "tokens") || -+ grub_json_getsize (&tsize, &tokens)) -+ grub_dprintf ("luks2", "No valid token or not a tpm2 protector\n"); -+ } -+ -+ for (json_idx = 0; json_idx < tsize; json_idx++) -+ { -+ grub_json_t token; -+ -+ if (grub_json_getchild (&token, &tokens, json_idx) || -+ grub_json_getuint64 (&token_tpm.idx, &token, NULL) || -+ grub_json_getchild (&token, &token, 0) || -+ luks2_parse_token_tpm (&token_tpm, &token)) -+ { -+ grub_dprintf ("luks2", "Could not parse token index %" PRIuGRUB_SIZE "\n", json_idx); -+ grub_errno = GRUB_ERR_NONE; -+ continue; -+ } -+ } -+ - if (grub_disk_native_sectors (source) == GRUB_DISK_SIZE_UNKNOWN) - { - /* FIXME: Allow use of source disk, and maybe cause errors in read. */ -@@ -641,6 +714,10 @@ luks2_recover_key (grub_disk_t source, - continue; - } - -+ if (token_tpm.keyslots && -+ !(token_tpm.keyslots & (1 << keyslot.idx))) -+ continue; -+ - grub_dprintf ("luks2", "Trying keyslot \"%" PRIuGRUB_UINT64_T "\"\n", keyslot.idx); - - /* Sector size should be one of 512, 1024, 2048, or 4096. */ --- -2.41.0 - diff --git a/0167-Fix-the-size-calculation-for-the-synthesized-initrd.patch b/0167-Fix-the-size-calculation-for-the-synthesized-initrd.patch deleted file mode 100644 index ad4e7af..0000000 --- a/0167-Fix-the-size-calculation-for-the-synthesized-initrd.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 454d622ab4ff64d29f0699fc05bdb00b218e9e76 Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 26 Oct 2023 13:18:24 +0800 -Subject: [PATCH 167/272] Fix the size calculation for the synthesized initrd - -When calculating the size of the synthesized initrd in -grub_initrd_component(), the ending "TRAILER!!!" is counted in for every -synthesized initrd. However, in grub_initrd_load(), only one "TRAILER!!!" -will be appended for one group of consecutive synthesized initrds. The -additional size calculation for the ending "TRAILER!!!" could make the -linux kernel to read uninitialized bytes and result in the error message -like this: - -Initramfs unpacking failed: invalid magic at start of compressed archive - -To fit into the original 'newc' design, the ending "TRAILER!!!" is -removed from grub_initrd_component(). Instead, in grub_initrd_init(), -the 'newc' flag is set when calculating size of the synthesized initrd -to append the ending "TRAILER!!!" later. As for grub_initrd_load(), -since the path to the unsealed key is specified in 'newc_name', it's -unnecessary to set the 'newc' flag while copying the unsealed key -because the flag is already set when parsing the path name. - -Signed-off-by: Gary Lin ---- - grub-core/loader/linux.c | 23 ++++++++--------------- - 1 file changed, 8 insertions(+), 15 deletions(-) - -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 4e028f570..9ee8f3790 100644 ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -209,13 +209,6 @@ grub_initrd_component (const char *buf, int bufsz, const char *newc_name, - &initrd_ctx->size)) - goto overflow; - -- initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); -- if (grub_add (initrd_ctx->size, -- ALIGN_UP (sizeof (struct newc_head) -- + sizeof ("TRAILER!!!") - 1, 4), -- &initrd_ctx->size)) -- goto overflow; -- - free_dir (root); - root = 0; - return GRUB_ERR_NONE; -@@ -312,6 +305,13 @@ grub_initrd_init (int argc, char *argv[], - goto overflow; - } - -+ FOR_LIST_ELEMENTS (pk, kpuber) -+ if (pk->key && pk->path) -+ { -+ grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); -+ newc = 1; -+ } -+ - if (newc) - { - initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); -@@ -324,10 +324,6 @@ grub_initrd_init (int argc, char *argv[], - root = 0; - } - -- FOR_LIST_ELEMENTS (pk, kpuber) -- if (pk->key && pk->path) -- grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); -- - return GRUB_ERR_NONE; - - overflow: -@@ -404,10 +400,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, - - cursize = initrd_ctx->components[i].size; - if (initrd_ctx->components[i].buf) -- { -- grub_memcpy (ptr, initrd_ctx->components[i].buf, cursize); -- newc = 1; -- } -+ grub_memcpy (ptr, initrd_ctx->components[i].buf, cursize); - else if (grub_file_read (initrd_ctx->components[i].file, ptr, cursize) - != cursize) - { --- -2.41.0 - diff --git a/0167-misc-make-grub_boot_time-also-call-grub_dprintf-boot.patch b/0167-misc-make-grub_boot_time-also-call-grub_dprintf-boot.patch new file mode 100644 index 0000000..9293ba9 --- /dev/null +++ b/0167-misc-make-grub_boot_time-also-call-grub_dprintf-boot.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 24 Mar 2022 14:40:01 -0400 +Subject: [PATCH] misc: make grub_boot_time() also call + grub_dprintf("boot",...) + +Currently grub_boot_time() includes valuable debugging messages, but if +you build without BOOT_TIME_STATS enabled, they are silently and +confusingly compiled away. + +This patch changes grub_boot_time() to also log when "boot" is enabled +in DEBUG, regardless of BOOT_TIME_STATS. + +Signed-off-by: Peter Jones +--- + grub-core/kern/misc.c | 1 + + include/grub/misc.h | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index d3a493e3552..f607244e7ae 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -1438,6 +1438,7 @@ grub_real_boot_time (const char *file, + + va_start (args, fmt); + n->msg = grub_xvasprintf (fmt, args); ++ grub_dprintf ("boot", "%s\n", n->msg); + va_end (args); + + *boot_time_last = n; +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 252bdb161eb..c3c735371dc 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -530,7 +530,7 @@ void EXPORT_FUNC(grub_real_boot_time) (const char *file, + const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 3, 4))); + #define grub_boot_time(...) grub_real_boot_time(GRUB_FILE, __LINE__, __VA_ARGS__) + #else +-#define grub_boot_time(...) ++#define grub_boot_time(fmt, ...) grub_dprintf("boot", fmt "\n", ##__VA_ARGS__) + #endif + + #define _grub_min(a, b, _a, _b) \ diff --git a/0168-Improve-TPM-key-protection-on-boot-interruptions.patch b/0168-Improve-TPM-key-protection-on-boot-interruptions.patch deleted file mode 100644 index e058610..0000000 --- a/0168-Improve-TPM-key-protection-on-boot-interruptions.patch +++ /dev/null @@ -1,286 +0,0 @@ -From 535fe1e90151e3637fdb9fc57ddd513624296d58 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 17 Nov 2023 12:32:59 +0800 -Subject: [PATCH 168/272] Improve TPM key protection on boot interruptions - -The unattended boot process for full disk encryption relies on an -authorized TPM policy to ensure the system's integrity before releasing -the key to grub. Subsequently, grub assumes responsibility for securing -the boot process, directing it towards a trusted default without any -expected interruptions. Any interruption during this process indicates -potential modification attempts, and releasing the obtained key to the -next stage should not occur in such cases. - -This commit addresses a vulnerability associated with interrupted boot -processes that could potentially enable malicious modifications to the -default or trusted boot target. To reinforce system security, the code -has been updated to incorporate measures that discard the TPM protected -key in the event of boot interruptions. - -Furthermore, this patch aims to enhance code readability by renaming -structures and function names related to cryptographic keys, improving -clarity and maintainability. - -By implementing these changes, this enhancement seeks to fortify the -protection of TPM keys, thereby ensuring a more robust defense against -potential unauthorized modifications during the boot process. - -Signed-Off-by Michael Chang ---- - grub-core/commands/crypttab.c | 38 ++++++++++++++++++++++++++--------- - grub-core/disk/cryptodisk.c | 8 +++++++- - grub-core/loader/linux.c | 6 +++--- - grub-core/normal/main.c | 2 +- - grub-core/normal/menu.c | 7 +++++++ - grub-core/normal/menu_entry.c | 2 +- - include/grub/crypttab.h | 18 ++++++++++------- - 7 files changed, 59 insertions(+), 22 deletions(-) - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index c2217ca98..9397bede9 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -9,17 +9,20 @@ - - GRUB_MOD_LICENSE ("GPLv3+"); - --struct grub_key_publisher *kpuber; -+grub_crypto_key_list_t *cryptokey_lst; - - grub_err_t --grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path) -+grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key_len, const char *path, int is_tpmkey) - { -- struct grub_key_publisher *cur = NULL; -+ grub_crypto_key_list_t *cur = NULL; - -- FOR_LIST_ELEMENTS (cur, kpuber) -+ FOR_LIST_ELEMENTS (cur, cryptokey_lst) - if (grub_uuidcasecmp (cur->name, uuid, sizeof (cur->name)) == 0) - break; - -+ if (!cur && !uuid) -+ return GRUB_ERR_NONE; -+ - if (!cur) - cur = grub_zalloc (sizeof (*cur)); - if (!cur) -@@ -44,21 +47,24 @@ grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, - cur->path = grub_strdup (path); - } - -+ if (is_tpmkey >= 0) -+ cur->is_tpmkey = is_tpmkey; -+ - if (!cur->name) - { - cur->name = grub_strdup (uuid); -- grub_list_push (GRUB_AS_LIST_P (&kpuber), GRUB_AS_LIST (cur)); -+ grub_list_push (GRUB_AS_LIST_P (&cryptokey_lst), GRUB_AS_LIST (cur)); - } - - return GRUB_ERR_NONE; - } - - void --grub_initrd_discard_key (void) -+grub_cryptokey_discard (void) - { -- struct grub_key_publisher *cur, *nxt; -+ grub_crypto_key_list_t *cur, *nxt; - -- FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber) -+ FOR_LIST_ELEMENTS_SAFE (cur, nxt, cryptokey_lst) - { - grub_list_remove (GRUB_AS_LIST (cur)); - grub_memset (cur->key, 0, cur->key_len); -@@ -69,6 +75,20 @@ grub_initrd_discard_key (void) - } - } - -+void -+grub_cryptokey_tpmkey_discard (void) -+{ -+ grub_crypto_key_list_t *cur = NULL; -+ -+ FOR_LIST_ELEMENTS (cur, cryptokey_lst) -+ if (cur->is_tpmkey) -+ break; -+ -+ /* Discard all keys if any of them is tpm */ -+ if (cur) -+ grub_cryptokey_discard(); -+} -+ - static grub_err_t - grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - int argc, char **argv) -@@ -92,7 +112,7 @@ grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - } - - /*FIXME: Validate UUID string*/ -- return grub_initrd_publish_key (argv[1], NULL, 0, path); -+ return grub_cryptokey_add_or_update (argv[1], NULL, 0, path, -1); - } - - static grub_command_t cmd; -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 184efe425..8bc559b99 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1071,6 +1071,9 @@ grub_cryptodisk_scan_device_real (const char *name, - struct cryptodisk_read_hook_ctx read_hook_data = {0}; - int askpass = 0; - char *part = NULL; -+#ifndef GRUB_UTIL -+ int is_tpmkey = 0; -+#endif - - dev = grub_cryptodisk_get_by_source_disk (source); - -@@ -1183,6 +1186,9 @@ grub_cryptodisk_scan_device_real (const char *name, - ret = grub_cryptodisk_insert (dev, name, source); - if (ret != GRUB_ERR_NONE) - goto error; -+#ifndef GRUB_UTIL -+ is_tpmkey = 1; -+#endif - goto cleanup; - } - } -@@ -1244,7 +1250,7 @@ grub_cryptodisk_scan_device_real (const char *name, - - #ifndef GRUB_UTIL - if (cargs->key_data && dev) -- grub_initrd_publish_key (dev->uuid, (const char *)cargs->key_data, cargs->key_len, NULL); -+ grub_cryptokey_add_or_update (dev->uuid, (const char *)cargs->key_data, cargs->key_len, NULL, is_tpmkey); - #endif - if (askpass) - { -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 9ee8f3790..e5e792958 100644 ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -226,13 +226,13 @@ grub_initrd_init (int argc, char *argv[], - int i; - int newc = 0; - struct dir *root = 0; -- struct grub_key_publisher *pk; -+ grub_crypto_key_list_t *pk; - int numkey = 0; - - initrd_ctx->nfiles = 0; - initrd_ctx->components = 0; - -- FOR_LIST_ELEMENTS (pk, kpuber) -+ FOR_LIST_ELEMENTS (pk, cryptokey_lst) - if (pk->key && pk->path) - numkey++; - -@@ -305,7 +305,7 @@ grub_initrd_init (int argc, char *argv[], - goto overflow; - } - -- FOR_LIST_ELEMENTS (pk, kpuber) -+ FOR_LIST_ELEMENTS (pk, cryptokey_lst) - if (pk->key && pk->path) - { - grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index a3f711d1d..1b426af69 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -479,7 +479,7 @@ grub_cmdline_run (int nested, int force_auth) - return; - } - -- grub_initrd_discard_key (); -+ grub_cryptokey_discard (); - grub_normal_reader_init (nested); - - while (1) -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index e376c603f..6cd4ec590 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - - /* Time to delay after displaying an error message about a default/fallback - entry failing to boot. */ -@@ -698,6 +699,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) - if (grub_key_is_interrupt (key)) - { - timeout = -1; -+ grub_cryptokey_tpmkey_discard(); - break; - } - -@@ -780,6 +782,11 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) - clear_timeout (); - } - -+ /* Timeout is interrupted by external input, Forget tpmkey if timeout -+ * is not cut by enter */ -+ if (c != '\n' && c != '\r') -+ grub_cryptokey_tpmkey_discard(); -+ - switch (c) - { - case GRUB_TERM_KEY_HOME: -diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c -index 384ab9ce3..e5ba91ea4 100644 ---- a/grub-core/normal/menu_entry.c -+++ b/grub-core/normal/menu_entry.c -@@ -1263,7 +1263,7 @@ grub_menu_entry_run (grub_menu_entry_t entry) - return; - } - -- grub_initrd_discard_key(); -+ grub_cryptokey_discard(); - - screen = make_screen (entry); - if (! screen) -diff --git a/include/grub/crypttab.h b/include/grub/crypttab.h -index 113c53cfc..f86404686 100644 ---- a/include/grub/crypttab.h -+++ b/include/grub/crypttab.h -@@ -4,21 +4,25 @@ - #include - #include - --struct grub_key_publisher -+typedef struct grub_crypto_key_list - { -- struct grub_key_publisher *next; -- struct grub_key_publisher **prev; -+ struct grub_crypto_key_list *next; -+ struct grub_crypto_key_list **prev; - char *name; /* UUID */ - char *path; - char *key; - grub_size_t key_len; --}; -+ int is_tpmkey; -+} grub_crypto_key_list_t; - --extern struct grub_key_publisher *EXPORT_VAR (kpuber); -+extern grub_crypto_key_list_t *EXPORT_VAR (cryptokey_lst); - - grub_err_t --grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); -+grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key_len, const char *path, int is_tpmkey); - - void --grub_initrd_discard_key (void); -+grub_cryptokey_discard (void); -+ -+void -+grub_cryptokey_tpmkey_discard (void); - #endif /* ! GRUB_CRYPTTAB_HEADER */ --- -2.41.0 - diff --git a/0168-modules-make-.module_license-read-only.patch b/0168-modules-make-.module_license-read-only.patch new file mode 100644 index 0000000..368386d --- /dev/null +++ b/0168-modules-make-.module_license-read-only.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 24 Feb 2022 16:32:51 -0500 +Subject: [PATCH] modules: make .module_license read-only + +Currently .module_license is set writable (that is, the section has the +SHF_WRITE flag set) in the module's ELF headers. This probably never +actually matters, but it can't possibly be correct. + +This patch sets that data as "const", which causes that flag not to be +set. + +Signed-off-by: Peter Jones +--- + include/grub/dl.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 3f10e27d62c..216f8b903ac 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -121,7 +121,7 @@ grub_mod_fini (void) + #define ATTRIBUTE_USED __unused__ + #endif + #define GRUB_MOD_LICENSE(license) \ +- static char grub_module_license[] __attribute__ ((section (GRUB_MOD_SECTION (module_license)), ATTRIBUTE_USED)) = "LICENSE=" license; ++ static const char grub_module_license[] __attribute__ ((section (GRUB_MOD_SECTION (module_license)), ATTRIBUTE_USED)) = "LICENSE=" license; + #define GRUB_MOD_DEP(name) \ + static const char grub_module_depend_##name[] \ + __attribute__((section(GRUB_MOD_SECTION(moddeps)), ATTRIBUTE_USED)) = #name diff --git a/0169-Restrict-file-access-on-cryptodisk-print.patch b/0169-Restrict-file-access-on-cryptodisk-print.patch deleted file mode 100644 index 41d5e88..0000000 --- a/0169-Restrict-file-access-on-cryptodisk-print.patch +++ /dev/null @@ -1,197 +0,0 @@ -From ea590b3226117ffd239cba42310a079cee195c8d Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Sat, 18 Nov 2023 19:02:31 +0800 -Subject: [PATCH 169/272] Restrict file access on cryptodisk print - -When the encrypted partition is automatically unlocked by TPM, granting -access to the system upon validation of its known good state, there's a -potential vulnerability. Grub gains access to file systems that were -previously inaccessible to the public, enabling certain commands from -the grub console to print content. This arises due to grub lacking -restrictions similar to those imposed by password authentication, which -typically occurs before privileged access is granted. - -Although the automatic unlocking process ensures system integrity and a -secure environment for grub to operate in, it doesn't directly address -the issue of authentication for viewing encrypted partition content. - -This commit addresses this security loophole by implementing a file -filter upon adding a TPM key. The newly added file filter will -specifically verify if the disk is encrypted, denying access and -returning an "Access Denied: prohibited to view encrypted data" error -message to alert the user. - -Since the policy to filter out unwanted commands from leaking encrypted -content is irreversible, it is advisable to make the loaded module -persistent to prevent its removal. - -This enhancement aims to bolster security measures and prevent -unauthorized access to encrypted data. - -Signed-Off-by Michael Chang ---- - grub-core/commands/crypttab.c | 35 ++++++++++++++++++++++++++++++++++- - grub-core/disk/diskfilter.c | 35 +++++++++++++++++++++++++++++++++++ - include/grub/disk.h | 10 ++++++++++ - include/grub/file.h | 1 + - 4 files changed, 80 insertions(+), 1 deletion(-) - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index 9397bede9..d3acc4b59 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -6,11 +6,39 @@ - #include - #include - #include -+#include - - GRUB_MOD_LICENSE ("GPLv3+"); - - grub_crypto_key_list_t *cryptokey_lst; - -+static grub_file_t -+grub_nocat_open (grub_file_t io, enum grub_file_type type) -+{ -+ grub_disk_t disk; -+ -+ /* Network device */ -+ if (!io->device->disk) -+ return io; -+ -+ disk = io->device->disk; -+ -+ if (grub_disk_is_crypto (disk)) -+ { -+ switch (type & GRUB_FILE_TYPE_MASK) -+ { -+ case GRUB_FILE_TYPE_CAT: -+ case GRUB_FILE_TYPE_HEXCAT: -+ grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited to view encrypted data")); -+ return NULL; -+ default: -+ break; -+ } -+ } -+ -+ return io; -+} -+ - grub_err_t - grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key_len, const char *path, int is_tpmkey) - { -@@ -48,7 +76,11 @@ grub_cryptokey_add_or_update (const char *uuid, const char *key, grub_size_t key - } - - if (is_tpmkey >= 0) -- cur->is_tpmkey = is_tpmkey; -+ { -+ cur->is_tpmkey = is_tpmkey; -+ if (is_tpmkey) -+ grub_file_filter_register (GRUB_FILE_FILTER_NOCAT, grub_nocat_open); -+ } - - if (!cur->name) - { -@@ -121,6 +153,7 @@ GRUB_MOD_INIT(crypttab) - { - cmd = grub_register_command ("crypttab_entry", grub_cmd_crypttab_entry, - N_("VOLUME-NAME ENCRYPTED-DEVICE KEY-FILE") , N_("No description")); -+ grub_dl_set_persistent (mod); - } - - GRUB_MOD_FINI(crypttab) -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index c45bef1ca..1e44e3add 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -558,6 +558,39 @@ find_lv (const char *name) - return NULL; - } - -+static int -+grub_diskfilter_has_cryptodisk (const struct grub_diskfilter_lv *lv) -+{ -+ struct grub_diskfilter_pv *pv; -+ -+ if (!lv) -+ return 0; -+ -+ if (lv->vg->pvs) -+ for (pv = lv->vg->pvs; pv; pv = pv->next) -+ { -+ if (!pv->disk) -+ { -+ grub_dprintf ("diskfilter", _("Couldn't find physical volume `%s'." -+ " Some modules may be missing from core image."), -+ pv->name); -+ continue; -+ } -+ -+ switch (pv->disk->dev->id) -+ { -+ case GRUB_DISK_DEVICE_CRYPTODISK_ID: -+ return 1; -+ case GRUB_DISK_DEVICE_DISKFILTER_ID: -+ return grub_diskfilter_has_cryptodisk (pv->disk->data); -+ default: -+ break; -+ } -+ } -+ -+ return 0; -+} -+ - static grub_err_t - grub_diskfilter_open (const char *name, grub_disk_t disk) - { -@@ -589,6 +622,8 @@ grub_diskfilter_open (const char *name, grub_disk_t disk) - - disk->total_sectors = lv->size; - disk->max_agglomerate = GRUB_DISK_MAX_MAX_AGGLOMERATE; -+ disk->is_crypto_diskfilter = grub_diskfilter_has_cryptodisk (lv); -+ - return 0; - } - -diff --git a/include/grub/disk.h b/include/grub/disk.h -index 0858ee40e..bf0958885 100644 ---- a/include/grub/disk.h -+++ b/include/grub/disk.h -@@ -147,6 +147,8 @@ struct grub_disk - - /* Device-specific data. */ - void *data; -+ -+ int is_crypto_diskfilter; - }; - typedef struct grub_disk *grub_disk_t; - -@@ -317,4 +319,12 @@ void grub_mdraid1x_fini (void); - void grub_diskfilter_fini (void); - #endif - -+static inline int -+grub_disk_is_crypto (grub_disk_t disk) -+{ -+ return ((disk->is_crypto_diskfilter || -+ disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) ? -+ 1 : 0); -+} -+ - #endif /* ! GRUB_DISK_HEADER */ -diff --git a/include/grub/file.h b/include/grub/file.h -index d678de063..7900acb84 100644 ---- a/include/grub/file.h -+++ b/include/grub/file.h -@@ -184,6 +184,7 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook); - /* Filters with lower ID are executed first. */ - typedef enum grub_file_filter_id - { -+ GRUB_FILE_FILTER_NOCAT, - GRUB_FILE_FILTER_VERIFY, - GRUB_FILE_FILTER_GZIO, - GRUB_FILE_FILTER_XZIO, --- -2.41.0 - diff --git a/0169-modules-strip-.llvm_addrsig-sections-and-similar.patch b/0169-modules-strip-.llvm_addrsig-sections-and-similar.patch new file mode 100644 index 0000000..c86b999 --- /dev/null +++ b/0169-modules-strip-.llvm_addrsig-sections-and-similar.patch @@ -0,0 +1,39 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 24 Feb 2022 16:40:11 -0500 +Subject: [PATCH] modules: strip .llvm_addrsig sections and similar. + +Currently grub modules built with clang or gcc have several sections +which we don't actually need or support. + +We already have a list of section to skip in genmod.sh, and this patch +adds the following sections to that list (as well as a few newlines): + +.note.gnu.property +.llvm* + +Note that the glob there won't work without a new enough linker, but the +failure is just reversion to the status quo, so that's not a big problem. + +Signed-off-by: Peter Jones +--- + grub-core/genmod.sh.in | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/genmod.sh.in b/grub-core/genmod.sh.in +index e57c4d9205c..337753c574c 100644 +--- a/grub-core/genmod.sh.in ++++ b/grub-core/genmod.sh.in +@@ -57,8 +57,11 @@ if test x@TARGET_APPLE_LINKER@ != x1; then + @TARGET_STRIP@ --strip-unneeded \ + -K grub_mod_init -K grub_mod_fini \ + -K _grub_mod_init -K _grub_mod_fini \ +- -R .note.gnu.gold-version -R .note.GNU-stack \ ++ -R .note.GNU-stack \ ++ -R .note.gnu.gold-version \ ++ -R .note.gnu.property \ + -R .gnu.build.attributes \ ++ -R '.llvm*' \ + -R .rel.gnu.build.attributes \ + -R .rela.gnu.build.attributes \ + -R .eh_frame -R .rela.eh_frame -R .rel.eh_frame \ diff --git a/0170-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch b/0170-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch deleted file mode 100644 index 1797230..0000000 --- a/0170-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch +++ /dev/null @@ -1,117 +0,0 @@ -From ab40037609dd65d894392960c96cdfdf271d1dc2 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Sat, 18 Nov 2023 21:42:00 +0800 -Subject: [PATCH 170/272] Restrict 'ls' and auto file completion on cryptodisk - print - -The 'ls' command allows file listing, while file completion assists in -providing matched file names by partially inputting via the TAB key. -Both functionalities should be restricted when the disk is automatically -unlocked for the same reasons as highlighted in the previous patch -addressing the limitation on file access to the cryptodisk. - -Given that no file is explicitly opened for listing, employing file -filters becomes impractical. Consequently, this patch focuses on -modifying relevant routines separately to incorporate necessary checks. -The objective is to introduce measures that prevent 'ls' and auto file -completion from accessing encrypted data when the disk is automatically -unlocked. - -By implementing these modifications, any attempt to utilize 'ls' or file -completion on the cryptodisk will result in an "Access Denied: -prohibited to browse encrypted data" error message, thus effectively -alerting the user about the restricted access. - -While protecting content within disk files from viewing is essential, -it's equally crucial to restrict access to in-memory content. This -includes prohibiting access to the decrypted in-memory copies of disk -files. - -This enhancement aims to fortify security protocols by extending -restrictions to additional functionalities beyond direct file access. - -Signed-Off-by Michael Chang ---- - grub-core/commands/ls.c | 8 ++++++++ - grub-core/commands/minicmd.c | 6 ++++++ - grub-core/kern/corecmd.c | 8 ++++++++ - grub-core/normal/completion.c | 8 ++++++++ - 4 files changed, 30 insertions(+) - -diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c -index 6a1c7f5d3..c004f2ce3 100644 ---- a/grub-core/commands/ls.c -+++ b/grub-core/commands/ls.c -@@ -183,6 +183,14 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human) - if (! dev) - goto fail; - -+ if (dev->disk && -+ grub_disk_is_crypto (dev->disk) && -+ grub_file_filters[GRUB_FILE_FILTER_NOCAT]) -+ { -+ grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited to browse encrypted content")); -+ goto fail; -+ } -+ - fs = grub_fs_probe (dev); - path = grub_strchr (dirname, ')'); - if (! path) -diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c -index fa498931e..8f2ac0539 100644 ---- a/grub-core/commands/minicmd.c -+++ b/grub-core/commands/minicmd.c -@@ -101,6 +101,12 @@ grub_mini_cmd_dump (struct grub_command *cmd __attribute__ ((unused)), - if (argc == 0) - return grub_error (GRUB_ERR_BAD_ARGUMENT, "no address specified"); - -+ /* NOCAT filter is applied to prevent cat alike command from revealing file -+ * content, the dump command should also be prohibited to revealing memory -+ * content as well */ -+ if (grub_file_filters[GRUB_FILE_FILTER_NOCAT]) -+ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited by security policy")); -+ - #if GRUB_CPU_SIZEOF_VOID_P == GRUB_CPU_SIZEOF_LONG - #define grub_strtoaddr grub_strtoul - #else -diff --git a/grub-core/kern/corecmd.c b/grub-core/kern/corecmd.c -index 62d434ba9..b639bc3ae 100644 ---- a/grub-core/kern/corecmd.c -+++ b/grub-core/kern/corecmd.c -@@ -135,6 +135,14 @@ grub_core_cmd_ls (struct grub_command *cmd __attribute__ ((unused)), - if (! dev) - goto fail; - -+ if (dev->disk && -+ grub_disk_is_crypto (dev->disk) && -+ grub_file_filters[GRUB_FILE_FILTER_NOCAT]) -+ { -+ grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited to browse encrypted content")); -+ goto fail; -+ } -+ - fs = grub_fs_probe (dev); - path = grub_strchr (argv[0], ')'); - if (! path) -diff --git a/grub-core/normal/completion.c b/grub-core/normal/completion.c -index 18cadfa85..d003ec37d 100644 ---- a/grub-core/normal/completion.c -+++ b/grub-core/normal/completion.c -@@ -259,6 +259,14 @@ complete_file (void) - goto fail; - } - -+ if (dev->disk && -+ grub_disk_is_crypto (dev->disk) && -+ grub_file_filters[GRUB_FILE_FILTER_NOCAT]) -+ { -+ grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited to browse encrypted content")); -+ goto fail; -+ } -+ - fs = grub_fs_probe (dev); - if (! fs) - { --- -2.41.0 - diff --git a/0170-modules-Don-t-allocate-space-for-non-allocable-secti.patch b/0170-modules-Don-t-allocate-space-for-non-allocable-secti.patch new file mode 100644 index 0000000..19c7fdd --- /dev/null +++ b/0170-modules-Don-t-allocate-space-for-non-allocable-secti.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 21 Mar 2022 16:56:10 -0400 +Subject: [PATCH] modules: Don't allocate space for non-allocable sections. + +Currently when loading grub modules, we allocate space for all sections, +including those without SHF_ALLOC set. We then copy the sections that +/do/ have SHF_ALLOC set into the allocated memory, leaving some of our +allocation untouched forever. Additionally, on platforms with GOT +fixups and trampolines, we currently compute alignment round-ups for the +sections and sections with sh_size = 0. + +This patch removes the extra space from the allocation computation, and +makes the allocation computation loop skip empty sections as the loading +loop does. + +Signed-off-by: Peter Jones +--- + grub-core/kern/dl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 931f6e41442..832c6188df4 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -281,6 +281,9 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + i < e->e_shnum; + i++, s = (const Elf_Shdr *)((const char *) s + e->e_shentsize)) + { ++ if (s->sh_size == 0 || !(s->sh_flags & SHF_ALLOC)) ++ continue; ++ + tsize = ALIGN_UP (tsize, s->sh_addralign) + s->sh_size; + if (talign < s->sh_addralign) + talign = s->sh_addralign; diff --git a/0171-Key-revocation-on-out-of-bound-file-access.patch b/0171-Key-revocation-on-out-of-bound-file-access.patch deleted file mode 100644 index 7de6f73..0000000 --- a/0171-Key-revocation-on-out-of-bound-file-access.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 1ac2e8608242e1e8a68090214c7d09222f2c9a25 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Mon, 20 Nov 2023 09:25:53 +0800 -Subject: [PATCH 171/272] Key revocation on out of bound file access - -After successful disk unlocking, grub now takes on the responsibility of -safeguarding passwords or TPM keys exclusively within authenticated -cryptodisk files. Any attempt to access boot-related files outside this -trust realm triggers immediate key revocation, preventing potential -compromise by out of bound access. - -This patch strengthens security measures by restricting grub's access to -system boot files, except for essential internal processes like memdisk -and procfs, ensuring key protection against potential breaches due to -inadvertent customizations in grub.cfg. - -Signed-Off-by Michael Chang ---- - grub-core/commands/crypttab.c | 36 +++++++++++++++++++++++++++++++++++ - include/grub/file.h | 1 + - 2 files changed, 37 insertions(+) - -diff --git a/grub-core/commands/crypttab.c b/grub-core/commands/crypttab.c -index d3acc4b59..e09296c57 100644 ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c -@@ -121,6 +121,41 @@ grub_cryptokey_tpmkey_discard (void) - grub_cryptokey_discard(); - } - -+static grub_file_t -+grub_distrust_open (grub_file_t io, -+ enum grub_file_type type __attribute__ ((unused))) -+{ -+ grub_disk_t disk = io->device->disk; -+ -+ if (io->device->disk && -+ (io->device->disk->dev->id == GRUB_DISK_DEVICE_MEMDISK_ID -+ || io->device->disk->dev->id == GRUB_DISK_DEVICE_PROCFS_ID)) -+ return io; -+ -+ /* Ensure second stage files is in a protected location or grub won't hand -+ * over the key and discards it */ -+ switch (type & GRUB_FILE_TYPE_MASK) -+ { -+ case GRUB_FILE_TYPE_ACPI_TABLE: -+ case GRUB_FILE_TYPE_CONFIG: -+ case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE: -+ case GRUB_FILE_TYPE_FONT: -+ case GRUB_FILE_TYPE_GRUB_MODULE: -+ case GRUB_FILE_TYPE_GRUB_MODULE_LIST: -+ case GRUB_FILE_TYPE_LINUX_KERNEL: -+ case GRUB_FILE_TYPE_LINUX_INITRD: -+ case GRUB_FILE_TYPE_LOADENV: -+ case GRUB_FILE_TYPE_THEME: -+ if (!disk || !grub_disk_is_crypto (disk)) -+ grub_cryptokey_discard (); -+ break; -+ default: -+ break; -+ } -+ -+ return io; -+} -+ - static grub_err_t - grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), - int argc, char **argv) -@@ -153,6 +188,7 @@ GRUB_MOD_INIT(crypttab) - { - cmd = grub_register_command ("crypttab_entry", grub_cmd_crypttab_entry, - N_("VOLUME-NAME ENCRYPTED-DEVICE KEY-FILE") , N_("No description")); -+ grub_file_filter_register (GRUB_FILE_FILTER_DISTRUST, grub_distrust_open); - grub_dl_set_persistent (mod); - } - -diff --git a/include/grub/file.h b/include/grub/file.h -index 7900acb84..447404fad 100644 ---- a/include/grub/file.h -+++ b/include/grub/file.h -@@ -184,6 +184,7 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook); - /* Filters with lower ID are executed first. */ - typedef enum grub_file_filter_id - { -+ GRUB_FILE_FILTER_DISTRUST, - GRUB_FILE_FILTER_NOCAT, - GRUB_FILE_FILTER_VERIFY, - GRUB_FILE_FILTER_GZIO, --- -2.41.0 - diff --git a/0171-modules-load-module-sections-at-page-aligned-address.patch b/0171-modules-load-module-sections-at-page-aligned-address.patch new file mode 100644 index 0000000..8ace83d --- /dev/null +++ b/0171-modules-load-module-sections-at-page-aligned-address.patch @@ -0,0 +1,378 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 21 Mar 2022 17:45:40 -0400 +Subject: [PATCH] modules: load module sections at page-aligned addresses + +Currently we load module sections at whatever alignment gcc+ld happened +to dump into the ELF section header, which is often pretty useless. For +example, by default time.mod has these sections on a current x86_64 +build: + +$ eu-readelf -a grub-core/time.mod |& grep ^Section -A13 +Section Headers: +[Nr] Name Type Addr Off Size ES Flags Lk Inf Al +[ 0] NULL 0 00000000 00000000 0 0 0 0 +[ 1] .text PROGBITS 0 00000040 0000015e 0 AX 0 0 1 +[ 2] .rela.text RELA 0 00000458 000001e0 24 I 8 1 8 +[ 3] .rodata.str1.1 PROGBITS 0 0000019e 000000a1 1 AMS 0 0 1 +[ 4] .module_license PROGBITS 0 00000240 0000000f 0 A 0 0 8 +[ 5] .data PROGBITS 0 0000024f 00000000 0 WA 0 0 1 +[ 6] .bss NOBITS 0 00000250 00000008 0 WA 0 0 8 +[ 7] .modname PROGBITS 0 00000250 00000005 0 0 0 1 +[ 8] .symtab SYMTAB 0 00000258 00000150 24 9 6 8 +[ 9] .strtab STRTAB 0 000003a8 000000ab 0 0 0 1 +[10] .shstrtab STRTAB 0 00000638 00000059 0 0 0 1 + +With NX protections being page based, loading sections with either a 1 +or 8 *byte* alignment does absolutely nothing to help us out. + +This patch switches most EFI platforms to load module sections at 4kB +page-aligned addresses. To do so, it adds an new per-arch function, +grub_arch_dl_min_alignment(), which returns the alignment needed for +dynamically loaded sections (in bytes). Currently it sets it to 4096 +when GRUB_MACHINE_EFI is true on x86_64, i386, arm, arm64, and emu, and +1-byte alignment on everything else. + +It then changes the allocation size computation and the loader code in +grub_dl_load_segments() to align the locations and sizes up to these +boundaries, and fills any added padding with zeros. + +All of this happens before relocations are applied, so the relocations +factor that in with no change. + +As an aside, initially Daniel Kiper and I thought that it might be a +better idea to split the modules up into top-level sections as +.text.modules, .rodata.modules, .data.modules, etc., so that their page +permissions would get set by the loader that's loading grub itself. +This turns out to have two significant downsides: 1) either in mkimage +or in grub_dl_relocate_symbols(), you wind up having to dynamically +process the relocations to accommodate the moved module sections, and 2) +you then need to change the permissions on the modules and change them +back while relocating them in grub_dl_relocate_symbols(), which means +that any loader that /does/ honor the section flags but does /not/ +generally support NX with the memory attributes API will cause grub to +fail. + +Signed-off-by: Peter Jones +--- + grub-core/kern/arm/dl.c | 13 +++++++++++++ + grub-core/kern/arm64/dl.c | 13 +++++++++++++ + grub-core/kern/dl.c | 29 +++++++++++++++++++++-------- + grub-core/kern/emu/full.c | 13 +++++++++++++ + grub-core/kern/i386/dl.c | 13 +++++++++++++ + grub-core/kern/ia64/dl.c | 9 +++++++++ + grub-core/kern/mips/dl.c | 8 ++++++++ + grub-core/kern/powerpc/dl.c | 9 +++++++++ + grub-core/kern/riscv/dl.c | 13 +++++++++++++ + grub-core/kern/sparc64/dl.c | 9 +++++++++ + grub-core/kern/x86_64/dl.c | 13 +++++++++++++ + include/grub/dl.h | 2 ++ + docs/grub-dev.texi | 6 +++--- + 13 files changed, 139 insertions(+), 11 deletions(-) + +diff --git a/grub-core/kern/arm/dl.c b/grub-core/kern/arm/dl.c +index eab9d17ff2d..92607379366 100644 +--- a/grub-core/kern/arm/dl.c ++++ b/grub-core/kern/arm/dl.c +@@ -278,3 +278,16 @@ grub_arch_dl_check_header (void *ehdr) + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/grub-core/kern/arm64/dl.c b/grub-core/kern/arm64/dl.c +index a2b5789a9dd..95c6d5bf4e5 100644 +--- a/grub-core/kern/arm64/dl.c ++++ b/grub-core/kern/arm64/dl.c +@@ -196,3 +196,16 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 832c6188df4..775b367287e 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -268,7 +268,7 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + { + unsigned i; + const Elf_Shdr *s; +- grub_size_t tsize = 0, talign = 1; ++ grub_size_t tsize = 0, talign = 1, arch_addralign = 1; + #if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) && \ + !defined (__loongarch__) + grub_size_t tramp; +@@ -277,16 +277,24 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + #endif + char *ptr; + ++ arch_addralign = grub_arch_dl_min_alignment (); ++ + for (i = 0, s = (const Elf_Shdr *)((const char *) e + e->e_shoff); + i < e->e_shnum; + i++, s = (const Elf_Shdr *)((const char *) s + e->e_shentsize)) + { ++ grub_size_t sh_addralign; ++ grub_size_t sh_size; ++ + if (s->sh_size == 0 || !(s->sh_flags & SHF_ALLOC)) + continue; + +- tsize = ALIGN_UP (tsize, s->sh_addralign) + s->sh_size; +- if (talign < s->sh_addralign) +- talign = s->sh_addralign; ++ sh_addralign = ALIGN_UP(s->sh_addralign, arch_addralign); ++ sh_size = ALIGN_UP(s->sh_size, sh_addralign); ++ ++ tsize = ALIGN_UP (tsize, sh_addralign) + sh_size; ++ if (talign < sh_addralign) ++ talign = sh_addralign; + } + + #if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) && \ +@@ -316,6 +324,9 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + i < e->e_shnum; + i++, s = (Elf_Shdr *)((char *) s + e->e_shentsize)) + { ++ grub_size_t sh_addralign = ALIGN_UP(s->sh_addralign, arch_addralign); ++ grub_size_t sh_size = ALIGN_UP(s->sh_size, sh_addralign); ++ + if (s->sh_flags & SHF_ALLOC) + { + grub_dl_segment_t seg; +@@ -328,17 +339,19 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + { + void *addr; + +- ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, s->sh_addralign); ++ ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, sh_addralign); + addr = ptr; +- ptr += s->sh_size; ++ ptr += sh_size; + + switch (s->sh_type) + { + case SHT_PROGBITS: + grub_memcpy (addr, (char *) e + s->sh_offset, s->sh_size); ++ grub_memset ((char *)addr + s->sh_size, 0, ++ sh_size - s->sh_size); + break; + case SHT_NOBITS: +- grub_memset (addr, 0, s->sh_size); ++ grub_memset (addr, 0, sh_size); + break; + } + +@@ -347,7 +360,7 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + else + seg->addr = 0; + +- seg->size = s->sh_size; ++ seg->size = sh_size; + seg->section = i; + seg->next = mod->segment; + mod->segment = seg; +diff --git a/grub-core/kern/emu/full.c b/grub-core/kern/emu/full.c +index e8d63b1f5f9..1de1c28eb09 100644 +--- a/grub-core/kern/emu/full.c ++++ b/grub-core/kern/emu/full.c +@@ -67,3 +67,16 @@ grub_arch_dl_init_linker (void) + } + #endif + ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/grub-core/kern/i386/dl.c b/grub-core/kern/i386/dl.c +index 1346da5cc91..d6b4681fc93 100644 +--- a/grub-core/kern/i386/dl.c ++++ b/grub-core/kern/i386/dl.c +@@ -79,3 +79,16 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/grub-core/kern/ia64/dl.c b/grub-core/kern/ia64/dl.c +index db59300fea3..92d82c57505 100644 +--- a/grub-core/kern/ia64/dl.c ++++ b/grub-core/kern/ia64/dl.c +@@ -148,3 +148,12 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + } + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++ return 1; ++} +diff --git a/grub-core/kern/mips/dl.c b/grub-core/kern/mips/dl.c +index 5b02f97fca7..db411899dbe 100644 +--- a/grub-core/kern/mips/dl.c ++++ b/grub-core/kern/mips/dl.c +@@ -272,3 +272,11 @@ grub_arch_dl_init_linker (void) + grub_dl_register_symbol ("_gp_disp", &_gp_disp_dummy, 0, 0); + } + ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++ return 1; ++} +diff --git a/grub-core/kern/powerpc/dl.c b/grub-core/kern/powerpc/dl.c +index 7b6418eabd7..0eb8bc5bd31 100644 +--- a/grub-core/kern/powerpc/dl.c ++++ b/grub-core/kern/powerpc/dl.c +@@ -167,3 +167,12 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++ return 1; ++} +diff --git a/grub-core/kern/riscv/dl.c b/grub-core/kern/riscv/dl.c +index 896653bb41c..1fa085b4acf 100644 +--- a/grub-core/kern/riscv/dl.c ++++ b/grub-core/kern/riscv/dl.c +@@ -344,3 +344,16 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/grub-core/kern/sparc64/dl.c b/grub-core/kern/sparc64/dl.c +index f3d960186ba..f054f08241d 100644 +--- a/grub-core/kern/sparc64/dl.c ++++ b/grub-core/kern/sparc64/dl.c +@@ -189,3 +189,12 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++ return 1; ++} +diff --git a/grub-core/kern/x86_64/dl.c b/grub-core/kern/x86_64/dl.c +index e5a8bdcf4f9..a105dc50cea 100644 +--- a/grub-core/kern/x86_64/dl.c ++++ b/grub-core/kern/x86_64/dl.c +@@ -119,3 +119,16 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + + return GRUB_ERR_NONE; + } ++ ++/* ++ * Tell the loader what our minimum section alignment is. ++ */ ++grub_size_t ++grub_arch_dl_min_alignment (void) ++{ ++#ifdef GRUB_MACHINE_EFI ++ return 4096; ++#else ++ return 1; ++#endif ++} +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 216f8b903ac..9f86765c8e9 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -279,6 +279,8 @@ grub_err_t grub_arch_dl_check_header (void *ehdr); + grub_err_t + grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr, + Elf_Shdr *s, grub_dl_segment_t seg); ++grub_size_t ++grub_arch_dl_min_alignment (void); + #endif + + #if defined (_mips) +diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi +index 04c6678cb6b..8ad5494f5ce 100644 +--- a/docs/grub-dev.texi ++++ b/docs/grub-dev.texi +@@ -996,9 +996,9 @@ declare startup asm file ($cpu_$platform_startup) as well as any other files + (e.g. init.c and callwrap.S) (e.g. $cpu_$platform = kern/$cpu/$platform/init.c). + At this stage you will also need to add dummy dl.c and cache.S with functions + grub_err_t grub_arch_dl_check_header (void *ehdr), grub_err_t +-grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr) (dl.c) and +-void grub_arch_sync_caches (void *address, grub_size_t len) (cache.S). They +-won't be used for now. ++grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr) (dl.c), grub_uint32_t ++grub_arch_dl_min_alignment (void), and void grub_arch_sync_caches (void ++*address, grub_size_t len) (cache.S). They won't be used for now. + + You will need to create directory include/$cpu/$platform and a file + include/$cpu/types.h. The latter following this template: diff --git a/0172-fs-xfs-always-verify-the-total-number-of-entries-is-.patch b/0172-fs-xfs-always-verify-the-total-number-of-entries-is-.patch deleted file mode 100644 index 256c338..0000000 --- a/0172-fs-xfs-always-verify-the-total-number-of-entries-is-.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 86ce93e58d3fc067edb461fd479656bde53ad337 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 23 Jan 2024 12:46:16 +0800 -Subject: [PATCH 172/272] fs/xfs: always verify the total number of entries is - not zero - ---- - grub-core/fs/xfs.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c -index bc2224dbb..1ce5fa4fc 100644 ---- a/grub-core/fs/xfs.c -+++ b/grub-core/fs/xfs.c -@@ -900,6 +900,8 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, - { - struct grub_xfs_dir2_entry *direntry = - grub_xfs_first_de(dir->data, dirblock); -+ struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); -+ - int entries = -1; - char *end = dirblock + dirblk_size; - -@@ -918,18 +920,16 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, - */ - if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) - { -- struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); -- - end = (char *) tail; - - /* Subtract the space used by leaf nodes. */ - end -= grub_be_to_cpu32 (tail->leaf_count) * sizeof (struct grub_xfs_dir_leaf_entry); -+ } - -- entries = grub_be_to_cpu32 (tail->leaf_count) - grub_be_to_cpu32 (tail->leaf_stale); -+ entries = grub_be_to_cpu32 (tail->leaf_count) - grub_be_to_cpu32 (tail->leaf_stale); - -- if (!entries) -- continue; -- } -+ if (!entries) -+ continue; - - /* Iterate over all entries within this block. */ - while ((char *) direntry < (char *) end) --- -2.41.0 - diff --git a/0172-nx-add-memory-attribute-get-set-API.patch b/0172-nx-add-memory-attribute-get-set-API.patch new file mode 100644 index 0000000..6a47341 --- /dev/null +++ b/0172-nx-add-memory-attribute-get-set-API.patch @@ -0,0 +1,317 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 22 Mar 2022 10:56:21 -0400 +Subject: [PATCH] nx: add memory attribute get/set API + +For NX, we need to set the page access permission attributes for write +and execute permissions. + +This patch adds two new primitives, grub_set_mem_attrs() and +grub_clear_mem_attrs(), and associated constant definitions, to be used +for that purpose. + +For most platforms, it adds a dummy implementation that returns +GRUB_ERR_NONE. On EFI platforms, it adds a common helper function, +grub_efi_status_to_err(), which translates EFI error codes to grub error +codes, adds headers for the EFI Memory Attribute Protocol (still pending +standardization), and an implementation of the grub nx primitives using +it. + +Signed-off-by: Peter Jones +[rharwood: add pjones's none/nyi fixup] +Signed-off-by: Robbie Harwood +--- + grub-core/kern/efi/efi.c | 36 +++++++++++++ + grub-core/kern/efi/mm.c | 131 +++++++++++++++++++++++++++++++++++++++++++++++ + include/grub/efi/api.h | 25 +++++++++ + include/grub/efi/efi.h | 2 + + include/grub/mm.h | 32 ++++++++++++ + 5 files changed, 226 insertions(+) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 412a2073f41..cdfc11565c7 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -1130,3 +1130,39 @@ grub_efi_find_configuration_table (const grub_guid_t *target_guid) + + return 0; + } ++ ++grub_err_t ++grub_efi_status_to_err (grub_efi_status_t status) ++{ ++ grub_err_t err; ++ switch (status) ++ { ++ case GRUB_EFI_SUCCESS: ++ err = GRUB_ERR_NONE; ++ break; ++ case GRUB_EFI_INVALID_PARAMETER: ++ default: ++ err = GRUB_ERR_BAD_ARGUMENT; ++ break; ++ case GRUB_EFI_OUT_OF_RESOURCES: ++ err = GRUB_ERR_OUT_OF_MEMORY; ++ break; ++ case GRUB_EFI_DEVICE_ERROR: ++ err = GRUB_ERR_IO; ++ break; ++ case GRUB_EFI_WRITE_PROTECTED: ++ err = GRUB_ERR_WRITE_ERROR; ++ break; ++ case GRUB_EFI_SECURITY_VIOLATION: ++ err = GRUB_ERR_ACCESS_DENIED; ++ break; ++ case GRUB_EFI_NOT_FOUND: ++ err = GRUB_ERR_FILE_NOT_FOUND; ++ break; ++ case GRUB_EFI_ABORTED: ++ err = GRUB_ERR_WAIT; ++ break; ++ } ++ ++ return err; ++} +diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c +index 6a6fba89184..df443f434d4 100644 +--- a/grub-core/kern/efi/mm.c ++++ b/grub-core/kern/efi/mm.c +@@ -687,3 +687,134 @@ grub_efi_get_ram_base(grub_addr_t *base_addr) + return GRUB_ERR_NONE; + } + #endif ++ ++static inline grub_uint64_t ++grub_mem_attrs_to_uefi_mem_attrs (grub_uint64_t attrs) ++{ ++ grub_uint64_t ret = GRUB_EFI_MEMORY_RP | ++ GRUB_EFI_MEMORY_RO | ++ GRUB_EFI_MEMORY_XP; ++ ++ if (attrs & GRUB_MEM_ATTR_R) ++ ret &= ~GRUB_EFI_MEMORY_RP; ++ ++ if (attrs & GRUB_MEM_ATTR_W) ++ ret &= ~GRUB_EFI_MEMORY_RO; ++ ++ if (attrs & GRUB_MEM_ATTR_X) ++ ret &= ~GRUB_EFI_MEMORY_XP; ++ ++ return ret; ++} ++ ++static inline grub_uint64_t ++uefi_mem_attrs_to_grub_mem_attrs (grub_uint64_t attrs) ++{ ++ grub_uint64_t ret = GRUB_MEM_ATTR_R | ++ GRUB_MEM_ATTR_W | ++ GRUB_MEM_ATTR_X; ++ ++ if (attrs & GRUB_EFI_MEMORY_RP) ++ ret &= ~GRUB_MEM_ATTR_R; ++ ++ if (attrs & GRUB_EFI_MEMORY_RO) ++ ret &= ~GRUB_MEM_ATTR_W; ++ ++ if (attrs & GRUB_EFI_MEMORY_XP) ++ ret &= ~GRUB_MEM_ATTR_X; ++ ++ return ret; ++} ++ ++grub_err_t ++grub_get_mem_attrs (grub_addr_t addr, grub_size_t size, grub_uint64_t *attrs) ++{ ++ grub_efi_memory_attribute_protocol_t *proto; ++ grub_efi_physical_address_t physaddr = addr; ++ grub_guid_t protocol_guid = GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID; ++ grub_efi_status_t efi_status; ++ ++ proto = grub_efi_locate_protocol (&protocol_guid, 0); ++ if (!proto) ++ return GRUB_ERR_NOT_IMPLEMENTED_YET; ++ ++ if (physaddr & 0xfff || size & 0xfff || size == 0 || attrs == NULL) ++ { ++ grub_dprintf ("nx", "%s called on 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" and attrs %p\n", ++ __func__, physaddr, physaddr+size-1, attrs); ++ return 0; ++ } ++ ++ efi_status = proto->get_memory_attributes( ++ proto, physaddr, size, attrs); ++ *attrs = uefi_mem_attrs_to_grub_mem_attrs (*attrs); ++ ++ return grub_efi_status_to_err (efi_status); ++} ++ ++grub_err_t ++grub_update_mem_attrs (grub_addr_t addr, grub_size_t size, ++ grub_uint64_t set_attrs, grub_uint64_t clear_attrs) ++{ ++ grub_efi_memory_attribute_protocol_t *proto; ++ grub_efi_physical_address_t physaddr = addr; ++ grub_guid_t protocol_guid = GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID; ++ grub_efi_status_t efi_status = GRUB_EFI_SUCCESS; ++ grub_uint64_t before = 0, after = 0, uefi_set_attrs, uefi_clear_attrs; ++ grub_err_t err; ++ ++ proto = grub_efi_locate_protocol (&protocol_guid, 0); ++ if (!proto) ++ return GRUB_ERR_NONE; ++ ++ err = grub_get_mem_attrs (addr, size, &before); ++ if (err) ++ grub_dprintf ("nx", "grub_get_mem_attrs(0x%"PRIxGRUB_ADDR", %"PRIuGRUB_SIZE", %p) -> 0x%x\n", ++ addr, size, &before, err); ++ ++ if (physaddr & 0xfff || size & 0xfff || size == 0) ++ { ++ grub_dprintf ("nx", "%s called on 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" +%s%s%s -%s%s%s\n", ++ __func__, physaddr, physaddr + size - 1, ++ (set_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (set_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (set_attrs & GRUB_MEM_ATTR_X) ? "x" : "", ++ (clear_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (clear_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (clear_attrs & GRUB_MEM_ATTR_X) ? "x" : ""); ++ return 0; ++ } ++ ++ uefi_set_attrs = grub_mem_attrs_to_uefi_mem_attrs (set_attrs); ++ grub_dprintf ("nx", "translating set_attrs from 0x%lx to 0x%lx\n", set_attrs, uefi_set_attrs); ++ uefi_clear_attrs = grub_mem_attrs_to_uefi_mem_attrs (clear_attrs); ++ grub_dprintf ("nx", "translating clear_attrs from 0x%lx to 0x%lx\n", clear_attrs, uefi_clear_attrs); ++ if (uefi_set_attrs) ++ efi_status = proto->set_memory_attributes( ++ proto, physaddr, size, uefi_set_attrs); ++ if (efi_status == GRUB_EFI_SUCCESS && uefi_clear_attrs) ++ efi_status = proto->clear_memory_attributes( ++ proto, physaddr, size, uefi_clear_attrs); ++ ++ err = grub_get_mem_attrs (addr, size, &after); ++ if (err) ++ grub_dprintf ("nx", "grub_get_mem_attrs(0x%"PRIxGRUB_ADDR", %"PRIuGRUB_SIZE", %p) -> 0x%x\n", ++ addr, size, &after, err); ++ ++ grub_dprintf ("nx", "set +%s%s%s -%s%s%s on 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" before:%c%c%c after:%c%c%c\n", ++ (set_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (set_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (set_attrs & GRUB_MEM_ATTR_X) ? "x" : "", ++ (clear_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (clear_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (clear_attrs & GRUB_MEM_ATTR_X) ? "x" : "", ++ addr, addr + size - 1, ++ (before & GRUB_MEM_ATTR_R) ? 'r' : '-', ++ (before & GRUB_MEM_ATTR_W) ? 'w' : '-', ++ (before & GRUB_MEM_ATTR_X) ? 'x' : '-', ++ (after & GRUB_MEM_ATTR_R) ? 'r' : '-', ++ (after & GRUB_MEM_ATTR_W) ? 'w' : '-', ++ (after & GRUB_MEM_ATTR_X) ? 'x' : '-'); ++ ++ return grub_efi_status_to_err (efi_status); ++} +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index 805a9d7adf9..76c88fbdcb0 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -389,6 +389,11 @@ + {0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f } \ + } + ++#define GRUB_EFI_MEMORY_ATTRIBUTE_PROTOCOL_GUID \ ++ { 0xf4560cf6, 0x40ec, 0x4b4a, \ ++ { 0xa1, 0x92, 0xbf, 0x1d, 0x57, 0xd0, 0xb1, 0x89 } \ ++ } ++ + struct grub_efi_sal_system_table + { + grub_uint32_t signature; +@@ -2182,6 +2187,26 @@ struct grub_efi_ip6_config_manual_address { + }; + typedef struct grub_efi_ip6_config_manual_address grub_efi_ip6_config_manual_address_t; + ++struct grub_efi_memory_attribute_protocol ++{ ++ grub_efi_status_t (*get_memory_attributes) ( ++ struct grub_efi_memory_attribute_protocol *this, ++ grub_efi_physical_address_t base_address, ++ grub_efi_uint64_t length, ++ grub_efi_uint64_t *attributes); ++ grub_efi_status_t (*set_memory_attributes) ( ++ struct grub_efi_memory_attribute_protocol *this, ++ grub_efi_physical_address_t base_address, ++ grub_efi_uint64_t length, ++ grub_efi_uint64_t attributes); ++ grub_efi_status_t (*clear_memory_attributes) ( ++ struct grub_efi_memory_attribute_protocol *this, ++ grub_efi_physical_address_t base_address, ++ grub_efi_uint64_t length, ++ grub_efi_uint64_t attributes); ++}; ++typedef struct grub_efi_memory_attribute_protocol grub_efi_memory_attribute_protocol_t; ++ + struct initrd_media_device_path { + grub_efi_vendor_media_device_path_t vendor; + grub_efi_device_path_t end; +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index 736d6f25694..3670eddc52b 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -189,4 +189,6 @@ struct grub_net_card; + grub_efi_handle_t + grub_efinet_get_device_handle (struct grub_net_card *card); + ++grub_err_t EXPORT_FUNC(grub_efi_status_to_err) (grub_efi_status_t status); ++ + #endif /* ! GRUB_EFI_EFI_HEADER */ +diff --git a/include/grub/mm.h b/include/grub/mm.h +index f3bf87fa0f9..8ee1fc7171c 100644 +--- a/include/grub/mm.h ++++ b/include/grub/mm.h +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + + #ifndef NULL +@@ -56,6 +57,37 @@ void *EXPORT_FUNC(grub_realloc) (void *ptr, grub_size_t size); + void *EXPORT_FUNC(grub_memalign) (grub_size_t align, grub_size_t size); + #endif + ++#define GRUB_MEM_ATTR_R 0x0000000000000004LLU ++#define GRUB_MEM_ATTR_W 0x0000000000000002LLU ++#define GRUB_MEM_ATTR_X 0x0000000000000001LLU ++ ++#ifdef GRUB_MACHINE_EFI ++grub_err_t EXPORT_FUNC(grub_get_mem_attrs) (grub_addr_t addr, ++ grub_size_t size, ++ grub_uint64_t *attrs); ++grub_err_t EXPORT_FUNC(grub_update_mem_attrs) (grub_addr_t addr, ++ grub_size_t size, ++ grub_uint64_t set_attrs, ++ grub_uint64_t clear_attrs); ++#else /* !GRUB_MACHINE_EFI */ ++static inline grub_err_t ++grub_get_mem_attrs (grub_addr_t addr __attribute__((__unused__)), ++ grub_size_t size __attribute__((__unused__)), ++ grub_uint64_t *attrs __attribute__((__unused__))) ++{ ++ return GRUB_ERR_NONE; ++} ++ ++static inline grub_err_t ++grub_update_mem_attrs (grub_addr_t addr __attribute__((__unused__)), ++ grub_size_t size __attribute__((__unused__)), ++ grub_uint64_t set_attrs __attribute__((__unused__)), ++ grub_uint64_t clear_attrs __attribute__((__unused__))) ++{ ++ return GRUB_ERR_NONE; ++} ++#endif /* GRUB_MACHINE_EFI */ ++ + void grub_mm_check_real (const char *file, int line); + #define grub_mm_check() grub_mm_check_real (GRUB_FILE, __LINE__); + diff --git a/0173-loader-arm64-efi-linux-Remove-magic-number-header-fi.patch b/0173-loader-arm64-efi-linux-Remove-magic-number-header-fi.patch deleted file mode 100644 index def038e..0000000 --- a/0173-loader-arm64-efi-linux-Remove-magic-number-header-fi.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 0f84c9979525ff02022ebea65eb4e49bbab61021 Mon Sep 17 00:00:00 2001 -From: Ard Biesheuvel -Date: Thu, 11 Aug 2022 16:51:57 +0200 -Subject: [PATCH 173/272] loader/arm64/efi/linux: Remove magic number header - field check - -The "ARM\x64" magic number in the file header identifies an image as one -that implements the bare metal boot protocol, allowing the loader to -simply move the file to a suitably aligned address in memory, with -sufficient headroom for the trailing .bss segment (the required memory -size is described in the header as well). - -Note of this matters for GRUB, as it only supports EFI boot. EFI does -not care about this magic number, and nor should GRUB: this prevents us -from booting other PE linux images, such as the generic EFI zboot -decompressor, which is a pure PE/COFF image, and does not implement the -bare metal boot protocol. - -So drop the magic number check. - -Signed-off-by: Ard Biesheuvel -Reviewed-by: Daniel Kiper ---- - grub-core/loader/arm64/efi/linux.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index 33df0e1fd..a9f5e05e4 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -57,9 +57,6 @@ static grub_addr_t initrd_end; - static grub_err_t - grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh) - { -- if (lh->magic != GRUB_LINUX_ARMXX_MAGIC_SIGNATURE) -- return grub_error(GRUB_ERR_BAD_OS, "invalid magic number"); -- - if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC) - return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, - N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled")); --- -2.41.0 - diff --git a/0173-nx-set-page-permissions-for-loaded-modules.patch b/0173-nx-set-page-permissions-for-loaded-modules.patch new file mode 100644 index 0000000..416caed --- /dev/null +++ b/0173-nx-set-page-permissions-for-loaded-modules.patch @@ -0,0 +1,236 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 21 Mar 2022 17:46:35 -0400 +Subject: [PATCH] nx: set page permissions for loaded modules. + +For NX, we need to set write and executable permissions on the sections +of grub modules when we load them. + +On sections with SHF_ALLOC set, which is typically everything except +.modname and the symbol and string tables, this patch clears the Read +Only flag on sections that have the ELF flag SHF_WRITE set, and clears +the No eXecute flag on sections with SHF_EXECINSTR set. In all other +cases it sets both flags. + +Signed-off-by: Peter Jones +[rharwood: arm tgptr -> tgaddr] +Signed-off-by: Robbie Harwood +--- + grub-core/kern/dl.c | 102 +++++++++++++++++++++++++++++++++++++++++++++------- + include/grub/dl.h | 44 +++++++++++++++++++++++ + 2 files changed, 133 insertions(+), 13 deletions(-) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 775b367287e..25666ae383f 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -277,6 +277,8 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + #endif + char *ptr; + ++ grub_dprintf ("modules", "loading segments for \"%s\"\n", mod->name); ++ + arch_addralign = grub_arch_dl_min_alignment (); + + for (i = 0, s = (const Elf_Shdr *)((const char *) e + e->e_shoff); +@@ -378,6 +380,7 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + ptr += got; + #endif + ++ grub_dprintf ("modules", "done loading segments for \"%s\"\n", mod->name); + return GRUB_ERR_NONE; + } + +@@ -645,6 +648,7 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + Elf_Shdr *s; + unsigned i; + ++ grub_dprintf ("modules", "relocating symbols for \"%s\"\n", mod->name); + for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff); + i < e->e_shnum; + i++, s = (Elf_Shdr *) ((char *) s + e->e_shentsize)) +@@ -653,22 +657,92 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + grub_dl_segment_t seg; + grub_err_t err; + +- /* Find the target segment. */ +- for (seg = mod->segment; seg; seg = seg->next) +- if (seg->section == s->sh_info) +- break; ++ seg = grub_dl_find_segment(mod, s->sh_info); ++ if (!seg) ++ continue; + +- if (seg) +- { +- if (!mod->symtab) +- return grub_error (GRUB_ERR_BAD_MODULE, "relocation without symbol table"); ++ if (!mod->symtab) ++ return grub_error (GRUB_ERR_BAD_MODULE, "relocation without symbol table"); + +- err = grub_arch_dl_relocate_symbols (mod, ehdr, s, seg); +- if (err) +- return err; +- } ++ err = grub_arch_dl_relocate_symbols (mod, ehdr, s, seg); ++ if (err) ++ return err; + } + ++ grub_dprintf ("modules", "done relocating symbols for \"%s\"\n", mod->name); ++ return GRUB_ERR_NONE; ++} ++ ++static grub_err_t ++grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr) ++{ ++ unsigned i; ++ const Elf_Shdr *s; ++ const Elf_Ehdr *e = ehdr; ++#if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) ++ grub_size_t arch_addralign = grub_arch_dl_min_alignment (); ++ grub_addr_t tgaddr; ++ grub_uint64_t tgsz; ++#endif ++ ++ grub_dprintf ("modules", "updating memory attributes for \"%s\"\n", ++ mod->name); ++ for (i = 0, s = (const Elf_Shdr *)((const char *) e + e->e_shoff); ++ i < e->e_shnum; ++ i++, s = (const Elf_Shdr *)((const char *) s + e->e_shentsize)) ++ { ++ grub_dl_segment_t seg; ++ grub_uint64_t set_attrs = GRUB_MEM_ATTR_R; ++ grub_uint64_t clear_attrs = GRUB_MEM_ATTR_W|GRUB_MEM_ATTR_X; ++ ++ seg = grub_dl_find_segment(mod, i); ++ if (!seg) ++ continue; ++ ++ if (seg->size == 0 || !(s->sh_flags & SHF_ALLOC)) ++ continue; ++ ++ if (s->sh_flags & SHF_WRITE) ++ { ++ set_attrs |= GRUB_MEM_ATTR_W; ++ clear_attrs &= ~GRUB_MEM_ATTR_W; ++ } ++ ++ if (s->sh_flags & SHF_EXECINSTR) ++ { ++ set_attrs |= GRUB_MEM_ATTR_X; ++ clear_attrs &= ~GRUB_MEM_ATTR_X; ++ } ++ ++ grub_dprintf ("modules", "setting memory attrs for section \"%s\" to -%s%s%s+%s%s%s\n", ++ grub_dl_get_section_name(e, s), ++ (clear_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (clear_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (clear_attrs & GRUB_MEM_ATTR_X) ? "x" : "", ++ (set_attrs & GRUB_MEM_ATTR_R) ? "r" : "", ++ (set_attrs & GRUB_MEM_ATTR_W) ? "w" : "", ++ (set_attrs & GRUB_MEM_ATTR_X) ? "x" : ""); ++ grub_update_mem_attrs ((grub_addr_t)(seg->addr), seg->size, set_attrs, clear_attrs); ++ } ++ ++#if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) ++ tgaddr = grub_min((grub_addr_t)mod->tramp, (grub_addr_t)mod->got); ++ tgsz = grub_max((grub_addr_t)mod->trampptr, (grub_addr_t)mod->gotptr) - tgaddr; ++ ++ if (tgsz) ++ { ++ tgsz = ALIGN_UP(tgsz, arch_addralign); ++ ++ grub_dprintf ("modules", "updating attributes for GOT and trampolines\n", ++ mod->name); ++ grub_update_mem_attrs (tgaddr, tgsz, GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_X, ++ GRUB_MEM_ATTR_W); ++ } ++#endif ++ ++ grub_dprintf ("modules", "done updating module memory attributes for \"%s\"\n", ++ mod->name); ++ + return GRUB_ERR_NONE; + } + +@@ -705,6 +779,7 @@ grub_dl_load_core_noinit (void *addr, grub_size_t size) + mod->ref_count = 1; + + grub_dprintf ("modules", "relocating to %p\n", mod); ++ + /* Me, Vladimir Serbinenko, hereby I add this module check as per new + GNU module policy. Note that this license check is informative only. + Modules have to be licensed under GPLv3 or GPLv3+ (optionally +@@ -718,7 +793,8 @@ grub_dl_load_core_noinit (void *addr, grub_size_t size) + || grub_dl_resolve_dependencies (mod, e) + || grub_dl_load_segments (mod, e) + || grub_dl_resolve_symbols (mod, e) +- || grub_dl_relocate_symbols (mod, e)) ++ || grub_dl_relocate_symbols (mod, e) ++ || grub_dl_set_mem_attrs (mod, e)) + { + mod->fini = 0; + grub_dl_unload (mod); +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 9f86765c8e9..1e1262a283b 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #endif + + /* +@@ -267,6 +268,49 @@ grub_dl_is_persistent (grub_dl_t mod) + return mod->persistent; + } + ++static inline const char * ++grub_dl_get_section_name (const Elf_Ehdr *e, const Elf_Shdr *s) ++{ ++ Elf_Shdr *str_s; ++ const char *str; ++ ++ str_s = (Elf_Shdr *) ((char *) e + e->e_shoff + e->e_shstrndx * e->e_shentsize); ++ str = (char *) e + str_s->sh_offset; ++ ++ return str + s->sh_name; ++} ++ ++static inline long ++grub_dl_find_section_index (Elf_Ehdr *e, const char *name) ++{ ++ Elf_Shdr *s; ++ const char *str; ++ unsigned i; ++ ++ s = (Elf_Shdr *) ((char *) e + e->e_shoff + e->e_shstrndx * e->e_shentsize); ++ str = (char *) e + s->sh_offset; ++ ++ for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff); ++ i < e->e_shnum; ++ i++, s = (Elf_Shdr *) ((char *) s + e->e_shentsize)) ++ if (grub_strcmp (str + s->sh_name, name) == 0) ++ return (long)i; ++ return -1; ++} ++ ++/* Return the segment for a section of index N */ ++static inline grub_dl_segment_t ++grub_dl_find_segment (grub_dl_t mod, unsigned n) ++{ ++ grub_dl_segment_t seg; ++ ++ for (seg = mod->segment; seg; seg = seg->next) ++ if (seg->section == n) ++ return seg; ++ ++ return NULL; ++} ++ + #endif + + void * EXPORT_FUNC(grub_resolve_symbol) (const char *name); diff --git a/0174-nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch b/0174-nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch new file mode 100644 index 0000000..c2a4c04 --- /dev/null +++ b/0174-nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch @@ -0,0 +1,48 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 22 Mar 2022 10:57:20 -0400 +Subject: [PATCH] nx: set the nx compatible flag in EFI grub images + +For NX, we need the grub binary to announce that it is compatible with +the NX feature. This implies that when loading the executable grub +image, several attributes are true: + +- the binary doesn't need an executable stack +- the binary doesn't need sections to be both executable and writable +- the binary knows how to use the EFI Memory Attributes protocol on code + it is loading. + +This patch adds a definition for the PE DLL Characteristics flag +GRUB_PE32_NX_COMPAT, and changes grub-mkimage to set that flag. + +Signed-off-by: Peter Jones +--- + util/mkimage.c | 1 + + include/grub/efi/pe32.h | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/util/mkimage.c b/util/mkimage.c +index e2bb4d4cd05..425d920ff92 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -1438,6 +1438,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + #pragma GCC diagnostic push + #pragma GCC diagnostic ignored "-Wdangling-pointer" + #endif ++ PE_OHDR (o32, o64, dll_characteristics) = grub_host_to_target16 (GRUB_PE32_NX_COMPAT); + PE_OHDR (o32, o64, header_size) = grub_host_to_target32 (header_size); + PE_OHDR (o32, o64, entry_addr) = grub_host_to_target32 (layout.start_address); + PE_OHDR (o32, o64, image_base) = 0; +diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h +index 4e6e9d254bd..9887e14b278 100644 +--- a/include/grub/efi/pe32.h ++++ b/include/grub/efi/pe32.h +@@ -231,6 +231,8 @@ struct grub_pe64_optional_header + + #define GRUB_PE32_SUBSYSTEM_EFI_APPLICATION 10 + ++#define GRUB_PE32_NX_COMPAT 0x0100 ++ + #define GRUB_PE32_NUM_DATA_DIRECTORIES 16 + + struct grub_pe32_section_table diff --git a/0174-squash-ieee1275-ofpath-enable-NVMeoF-logical-device-.patch b/0174-squash-ieee1275-ofpath-enable-NVMeoF-logical-device-.patch deleted file mode 100644 index 100a5f7..0000000 --- a/0174-squash-ieee1275-ofpath-enable-NVMeoF-logical-device-.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 0f7943a04bb5c58e46b46c257099c41b3e628b65 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 24 Jan 2024 18:03:51 +0800 -Subject: [PATCH 174/272] squash! ieee1275/ofpath: enable NVMeoF logical device - translation - -Fixes build error on gcc-14: - -[ 73s] In file included from ../grub-core/osdep/ofpath.c:2: -[ 73s] ../grub-core/osdep/linux/ofpath.c: In function 'of_find_fc_host': -[ 73s] ../grub-core/osdep/linux/ofpath.c:427:22: error: allocation of insufficient size '8' for type 'struct ofpath_files_list_root' with size '16' [-Werror=alloc-size] -[ 73s] 427 | portnames_file_list=malloc(sizeof(portnames_file_list)); -[ 73s] | ^ -[ 73s] ../grub-core/osdep/linux/ofpath.c: In function 'of_path_of_nvme': -[ 73s] ../grub-core/osdep/linux/ofpath.c:589:21: error: allocation of insufficient size '8' for type 'struct ofpath_nvmeof_info' with size '32' [-Werror=alloc-size] -[ 73s] 589 | nvmeof_info = malloc(sizeof(nvmeof_info)); -[ 73s] | ^ -[ 73s] ../grub-core/osdep/linux/ofpath.c:618:21: error: allocation of insufficient size '8' for type 'struct ofpath_nvmeof_info' with size '32' [-Werror=alloc-size] -[ 73s] 618 | nvmeof_info = malloc(sizeof(nvmeof_info)); -[ 73s] | ^ - -Signed-off-by: Michael Chang ---- - grub-core/osdep/linux/ofpath.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c -index 7129099db..55ed7ddf2 100644 ---- a/grub-core/osdep/linux/ofpath.c -+++ b/grub-core/osdep/linux/ofpath.c -@@ -424,7 +424,7 @@ of_find_fc_host(char* host_wwpn){ - - struct ofpath_files_list_root* portnames_file_list; - -- portnames_file_list=malloc(sizeof(portnames_file_list)); -+ portnames_file_list=malloc(sizeof(*portnames_file_list)); - portnames_file_list->items=0; - portnames_file_list->first=NULL; - -@@ -586,7 +586,7 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), - /* If is a NVMeoF */ - if(strstr(sysfs_path,"nvme-fabrics")){ - struct ofpath_nvmeof_info* nvmeof_info; -- nvmeof_info = malloc(sizeof(nvmeof_info)); -+ nvmeof_info = malloc(sizeof(*nvmeof_info)); - - of_path_get_nvmeof_adapter_info(sysfs_path, nvmeof_info); - -@@ -615,7 +615,7 @@ of_path_of_nvme(const char *sys_devname __attribute__((unused)), - sysfs_path = nvme_get_syspath (device); - if(strstr(sysfs_path,"nvme-fabrics")){ - struct ofpath_nvmeof_info* nvmeof_info; -- nvmeof_info = malloc(sizeof(nvmeof_info)); -+ nvmeof_info = malloc(sizeof(*nvmeof_info)); - - of_path_get_nvmeof_adapter_info(sysfs_path, nvmeof_info); - --- -2.41.0 - diff --git a/0175-grub_fs_probe-dprint-errors-from-filesystems.patch b/0175-grub_fs_probe-dprint-errors-from-filesystems.patch new file mode 100644 index 0000000..fdd2932 --- /dev/null +++ b/0175-grub_fs_probe-dprint-errors-from-filesystems.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Fri, 15 Jul 2022 15:39:41 -0400 +Subject: [PATCH] grub_fs_probe(): dprint errors from filesystems + +When filesystem detection fails, all that's currently debug-logged is a +series of messages like: + + grub-core/kern/fs.c:56:fs: Detecting ntfs... + grub-core/kern/fs.c:76:fs: ntfs detection failed. + +repeated for each filesystem. Any messages provided to grub_error() by +the filesystem are lost, and one has to break out gdb to figure out what +went wrong. + +With this change, one instead sees: + + grub-core/kern/fs.c:56:fs: Detecting fat... + grub-core/osdep/hostdisk.c:357:hostdisk: reusing open device + `/path/to/device' + grub-core/kern/fs.c:77:fs: error: invalid modification timestamp for /. + grub-core/kern/fs.c:79:fs: fat detection failed. + +in the debug prints. + +Signed-off-by: Robbie Harwood +(cherry picked from commit 838c79d658797d0662ee7f9e033e38ee88059e02) +--- + grub-core/kern/fs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c +index 7ad0aaf4e29..f25bace620b 100644 +--- a/grub-core/kern/fs.c ++++ b/grub-core/kern/fs.c +@@ -74,6 +74,7 @@ grub_fs_probe (grub_device_t device) + if (grub_errno == GRUB_ERR_NONE) + return p; + ++ grub_dprintf ("fs", _("error: %s.\n"), grub_errmsg); + grub_error_push (); + /* The grub_error_push() does not touch grub_errmsg. */ + grub_dprintf ("fs", _("error: %s.\n"), grub_errmsg); diff --git a/0175-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch b/0175-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch deleted file mode 100644 index 0e52572..0000000 --- a/0175-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch +++ /dev/null @@ -1,243 +0,0 @@ -From 1c5438947e4204e2e94bea82240788d0879c5067 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 8 Dec 2023 11:51:57 +0800 -Subject: [PATCH 175/272] ofdisk: enhance boot time by focusing on boot disk - relevance - -After a historical review, it's clear that a boot delay regression -coincided with the introduction of the fcp iterating patch. Reverting -this patch has shown promising signs in mitigating the issue. In order -to improve the efficiency, a more refined discovery process is proposed, -aiming to exclude device types differing from the boot disk to curtail -unnecessary iterations. - -This patch extends prior efforts by exclusively targeting root device -discovery linked to the boot disk, verifying device types to prevent -process elongation. - -It is worth noting that grub's opportunistic approach to assembling the -root device, seeking accessible results in parallel during iteration, -sometimes allows even a partially assembled RAID, albeit in a degraded -mode. However, delays stem from unrelated devices appearing before the -actual boot device. - -To streamline the boot process, the patch utilizes parent nodes in -conjunction with block device nodes to extract essential boot-related -information. This refined identification method efficiently limits the -application's scope to devices connected to the chosen boot device, -notably optimizing subsequent device iteration. By adeptly filtering out -devices not linked to the same FCP (Fibre Channel Protocol) device, it -significantly enhances boot efficiency, ensuring a more streamlined and -efficient boot process. - -Signed-off-by: Michael Chang ---- - grub-core/disk/ieee1275/ofdisk.c | 136 +++++++++++++++++++++++++++++-- - 1 file changed, 131 insertions(+), 5 deletions(-) - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index f96bbb58c..d4358f24d 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -31,6 +31,13 @@ - static char *last_devpath; - static grub_ieee1275_ihandle_t last_ihandle; - -+#define IEEE1275_DISK_ALIAS "/disk@" -+#define IEEE1275_NVMEOF_DISK_ALIAS "/nvme-of/controller@" -+ -+static char *boot_type; -+static char *boot_parent; -+static int is_boot_nvmeof; -+ - struct ofdisk_hash_ent - { - char *devpath; -@@ -529,12 +536,21 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - { - if (grub_strcmp (alias->type, "fcp") == 0) - { -- // Iterate disks -- dev_iterate_fcp_disks(alias); -- -- // Iterate NVMeoF -- dev_iterate_fcp_nvmeof(alias); -+ if (boot_type && -+ grub_strcmp (boot_type, alias->type) != 0) -+ { -+ grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", -+ alias->path, alias->type, boot_type); -+ goto iter_children; -+ } - -+ if (grub_strcmp (boot_parent, alias->path) == 0) -+ { -+ if (is_boot_nvmeof) -+ dev_iterate_fcp_nvmeof(alias); -+ else -+ dev_iterate_fcp_disks(alias); -+ } - } - else if (grub_strcmp (alias->type, "vscsi") == 0) - { -@@ -552,6 +568,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - char *buf, *bufptr; - unsigned i; - -+ if (boot_type && -+ grub_strcmp (boot_type, alias->type) != 0) -+ { -+ grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", -+ alias->path, alias->type, boot_type); -+ return; -+ } -+ - if (grub_ieee1275_open (alias->path, &ihandle)) - return; - -@@ -615,6 +639,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - grub_uint16_t table_size; - grub_ieee1275_ihandle_t ihandle; - -+ if (boot_type && -+ grub_strcmp (boot_type, alias->type) != 0) -+ { -+ grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", -+ alias->path, alias->type, boot_type); -+ goto iter_children; -+ } -+ - buf = grub_malloc (grub_strlen (alias->path) + - sizeof ("/disk@7766554433221100")); - if (!buf) -@@ -674,6 +706,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - return; - } - -+ iter_children: - { - struct grub_ieee1275_devalias child; - -@@ -1042,6 +1075,68 @@ static struct grub_disk_dev grub_ofdisk_dev = - .next = 0 - }; - -+static char * -+get_parent_devname (const char *devname, int *is_nvmeof) -+{ -+ char *parent, *pptr; -+ -+ if (is_nvmeof) -+ *is_nvmeof = 0; -+ -+ parent = grub_strdup (devname); -+ -+ if (parent == NULL) -+ { -+ grub_print_error (); -+ return NULL; -+ } -+ -+ pptr = grub_strstr (parent, IEEE1275_DISK_ALIAS); -+ -+ if (pptr != NULL) -+ { -+ *pptr = '\0'; -+ return parent; -+ } -+ -+ pptr = grub_strstr (parent, IEEE1275_NVMEOF_DISK_ALIAS); -+ -+ if (pptr != NULL) -+ { -+ *pptr = '\0'; -+ if (is_nvmeof) -+ *is_nvmeof = 1; -+ return parent; -+ } -+ -+ return parent; -+} -+ -+static char * -+get_boot_device_parent (const char *bootpath, int *is_nvmeof) -+{ -+ char *dev, *canon, *parent; -+ -+ dev = grub_ieee1275_get_aliasdevname (bootpath); -+ canon = grub_ieee1275_canonicalise_devname (dev); -+ -+ if (!canon) -+ { -+ /* This should not happen. */ -+ grub_error (GRUB_ERR_BAD_DEVICE, "canonicalise devname failed"); -+ grub_print_error (); -+ return NULL; -+ } -+ else -+ grub_dprintf ("ofdisk", "%s is canonical %s\n", bootpath, canon); -+ -+ parent = get_parent_devname (canon, is_nvmeof); -+ grub_dprintf ("ofdisk", "%s is parent of %s\n", parent, canon); -+ -+ grub_free (canon); -+ return parent; -+} -+ - static void - insert_bootpath (void) - { -@@ -1077,6 +1172,12 @@ insert_bootpath (void) - char *device = grub_ieee1275_get_devname (bootpath); - op = ofdisk_hash_add (device, NULL); - op->is_boot = 1; -+ boot_parent = get_boot_device_parent (bootpath, &is_boot_nvmeof); -+ boot_type = grub_ieee1275_get_device_type (boot_parent); -+ if (boot_type) -+ grub_dprintf ("ofdisk", "the boot device type %s is used for root device discovery, others excluded\n", boot_type); -+ else -+ grub_dprintf ("ofdisk", "unknown boot device type, will use all devices to discover root and may be slow\n"); - } - grub_free (type); - grub_free (bootpath); -@@ -1093,12 +1194,37 @@ grub_ofdisk_fini (void) - grub_disk_dev_unregister (&grub_ofdisk_dev); - } - -+static const char * -+grub_env_get_boot_type (struct grub_env_var *var __attribute__ ((unused)), -+ const char *val __attribute__ ((unused))) -+{ -+ static char *ret; -+ -+ if (!ret) -+ ret = grub_xasprintf("boot: %s type: %s is_nvmeof: %d", -+ boot_parent, -+ boot_type ? : "unknown", -+ is_boot_nvmeof); -+ -+ return ret; -+} -+ -+static char * -+grub_env_set_boot_type (struct grub_env_var *var __attribute__ ((unused)), -+ const char *val __attribute__ ((unused))) -+{ -+ /* READ ONLY */ -+ return NULL; -+} -+ - void - grub_ofdisk_init (void) - { - grub_disk_firmware_fini = grub_ofdisk_fini; - - insert_bootpath (); -+ grub_register_variable_hook ("ofdisk_boot_type", grub_env_get_boot_type, -+ grub_env_set_boot_type ); - - grub_disk_dev_register (&grub_ofdisk_dev); - } --- -2.41.0 - diff --git a/0176-Make-debug-file-show-which-file-filters-get-run.patch b/0176-Make-debug-file-show-which-file-filters-get-run.patch new file mode 100644 index 0000000..3bd69d8 --- /dev/null +++ b/0176-Make-debug-file-show-which-file-filters-get-run.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 29 Jul 2022 15:56:00 -0400 +Subject: [PATCH] Make debug=file show which file filters get run. + +If one of the file filters breaks things, it's hard to figure out where +it has happened. + +This makes grub log which filter is being run, which makes it easier to +figure out where you are in the sequence of events. + +Signed-off-by: Peter Jones +--- + grub-core/kern/file.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 264211b1143..1794d022fb0 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -30,6 +30,14 @@ void (*EXPORT_VAR (grub_grubnet_fini)) (void); + + grub_file_filter_t grub_file_filters[GRUB_FILE_FILTER_MAX]; + ++static const char *filter_names[] = { ++ [GRUB_FILE_FILTER_VERIFY] = "GRUB_FILE_FILTER_VERIFY", ++ [GRUB_FILE_FILTER_GZIO] = "GRUB_FILE_FILTER_GZIO", ++ [GRUB_FILE_FILTER_XZIO] = "GRUB_FILE_FILTER_XZIO", ++ [GRUB_FILE_FILTER_LZOPIO] = "GRUB_FILE_FILTER_LZOPIO", ++ [GRUB_FILE_FILTER_MAX] = "GRUB_FILE_FILTER_MAX" ++}; ++ + /* Get the device part of the filename NAME. It is enclosed by parentheses. */ + char * + grub_file_get_device_name (const char *name) +@@ -124,6 +132,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if (grub_file_filters[filter]) + { + last_file = file; ++ if (filter < GRUB_FILE_FILTER_MAX) ++ grub_dprintf ("file", "Running %s file filter\n", ++ filter_names[filter]); + file = grub_file_filters[filter] (file, type); + if (file && file != last_file) + { diff --git a/0176-ofdisk-add-early_log-support.patch b/0176-ofdisk-add-early_log-support.patch deleted file mode 100644 index bfa4db3..0000000 --- a/0176-ofdisk-add-early_log-support.patch +++ /dev/null @@ -1,169 +0,0 @@ -From d20a6eb717e3bcf63dcce2f6d7000b5b2202ac9f Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Tue, 12 Dec 2023 15:34:18 +0800 -Subject: [PATCH 176/272] ofdisk: add early_log support - -The command ofdisk_early_msg can be used to review debug message logged -before output console is initialized. - -For eg: - - grub> ofdisk_early_msg - /vdevice/v-scsi@71000002/disk@8000000000000000 is canonical - /vdevice/v-scsi@71000002/disk@8000000000000000 - - /vdevice/v-scsi@71000002 is parent of - /vdevice/v-scsi@71000002/disk@80000000 - 00000000 - - the boot device type vscsi is used for root device discovery, others excluded - -We can use it in conjunction with the $ofdisk_boot_type variable to get -better understanding the boot device information. - - grub> echo $ofdisk_boot_type - boot: /vdevice/v-scsi@71000002 type: vscsi is_nvmeof? 0 - -Signed-off-by: Michael Chang ---- - grub-core/disk/ieee1275/ofdisk.c | 75 +++++++++++++++++++++++++++++--- - 1 file changed, 70 insertions(+), 5 deletions(-) - -diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index d4358f24d..c5c20a5ec 100644 ---- a/grub-core/disk/ieee1275/ofdisk.c -+++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - #define RETRY_DEFAULT_TIMEOUT 15 - -@@ -60,6 +61,9 @@ grub_ofdisk_get_block_size (grub_uint32_t *block_size, - #define OFDISK_HASH_SZ 8 - static struct ofdisk_hash_ent *ofdisk_hash[OFDISK_HASH_SZ]; - -+static void early_log (const char *fmt, ...); -+static void print_early_log (void); -+ - static int - ofdisk_hash_fn (const char *devpath) - { -@@ -1128,10 +1132,10 @@ get_boot_device_parent (const char *bootpath, int *is_nvmeof) - return NULL; - } - else -- grub_dprintf ("ofdisk", "%s is canonical %s\n", bootpath, canon); -+ early_log ("%s is canonical %s\n", bootpath, canon); - - parent = get_parent_devname (canon, is_nvmeof); -- grub_dprintf ("ofdisk", "%s is parent of %s\n", parent, canon); -+ early_log ("%s is parent of %s\n", parent, canon); - - grub_free (canon); - return parent; -@@ -1175,9 +1179,9 @@ insert_bootpath (void) - boot_parent = get_boot_device_parent (bootpath, &is_boot_nvmeof); - boot_type = grub_ieee1275_get_device_type (boot_parent); - if (boot_type) -- grub_dprintf ("ofdisk", "the boot device type %s is used for root device discovery, others excluded\n", boot_type); -+ early_log ("the boot device type %s is used for root device discovery, others excluded\n", boot_type); - else -- grub_dprintf ("ofdisk", "unknown boot device type, will use all devices to discover root and may be slow\n"); -+ early_log ("unknown boot device type, will use all devices to discover root and may be slow\n"); - } - grub_free (type); - grub_free (bootpath); -@@ -1201,7 +1205,7 @@ grub_env_get_boot_type (struct grub_env_var *var __attribute__ ((unused)), - static char *ret; - - if (!ret) -- ret = grub_xasprintf("boot: %s type: %s is_nvmeof: %d", -+ ret = grub_xasprintf("boot: %s type: %s is_nvmeof? %d", - boot_parent, - boot_type ? : "unknown", - is_boot_nvmeof); -@@ -1217,6 +1221,17 @@ grub_env_set_boot_type (struct grub_env_var *var __attribute__ ((unused)), - return NULL; - } - -+static grub_err_t -+grub_cmd_early_msg (struct grub_command *cmd __attribute__ ((unused)), -+ int argc __attribute__ ((unused)), -+ char *argv[] __attribute__ ((unused))) -+{ -+ print_early_log (); -+ return 0; -+} -+ -+static grub_command_t cmd_early_msg; -+ - void - grub_ofdisk_init (void) - { -@@ -1226,6 +1241,9 @@ grub_ofdisk_init (void) - grub_register_variable_hook ("ofdisk_boot_type", grub_env_get_boot_type, - grub_env_set_boot_type ); - -+ cmd_early_msg = -+ grub_register_command ("ofdisk_early_msg", grub_cmd_early_msg, -+ 0, N_("Show early boot message in ofdisk.")); - grub_disk_dev_register (&grub_ofdisk_dev); - } - -@@ -1274,3 +1292,50 @@ grub_ofdisk_get_block_size (grub_uint32_t *block_size, - - return 0; - } -+ -+struct ofdisk_early_msg -+{ -+ struct ofdisk_early_msg *next; -+ char *msg; -+}; -+ -+static struct ofdisk_early_msg *early_msg_head; -+static struct ofdisk_early_msg **early_msg_last = &early_msg_head; -+ -+static void -+early_log (const char *fmt, ...) -+{ -+ struct ofdisk_early_msg *n; -+ va_list args; -+ -+ grub_error_push (); -+ n = grub_malloc (sizeof (*n)); -+ if (!n) -+ { -+ grub_errno = 0; -+ grub_error_pop (); -+ return; -+ } -+ n->next = 0; -+ -+ va_start (args, fmt); -+ n->msg = grub_xvasprintf (fmt, args); -+ va_end (args); -+ -+ *early_msg_last = n; -+ early_msg_last = &n->next; -+ -+ grub_errno = 0; -+ grub_error_pop (); -+} -+ -+static void -+print_early_log (void) -+{ -+ struct ofdisk_early_msg *cur; -+ -+ if (!early_msg_head) -+ grub_printf ("no early log is available\n"); -+ for (cur = early_msg_head; cur; cur = cur->next) -+ grub_printf ("%s\n", cur->msg); -+} --- -2.41.0 - diff --git a/0177-BLS-create-etc-kernel-cmdline-during-mkconfig.patch b/0177-BLS-create-etc-kernel-cmdline-during-mkconfig.patch new file mode 100644 index 0000000..05e8325 --- /dev/null +++ b/0177-BLS-create-etc-kernel-cmdline-during-mkconfig.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Tue, 2 Aug 2022 15:56:28 -0400 +Subject: [PATCH] BLS: create /etc/kernel/cmdline during mkconfig + +Signed-off-by: Robbie Harwood +--- + util/grub.d/10_linux.in | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 360ce26e5f9..a6568caf7d1 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -163,6 +163,12 @@ update_bls_cmdline() + local cmdline="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" + local -a files=($(get_sorted_bls)) + ++ if [[ ! -f /etc/kernel/cmdline ]]; then ++ # anaconda has the correct information to do this during install; ++ # afterward, grubby will take care of syncing on updates. ++ echo "$cmdline rhgb quiet" > /etc/kernel/cmdline ++ fi ++ + for bls in "${files[@]}"; do + local options="${cmdline}" + if [ -z "${bls##*debug*}" ]; then diff --git a/0177-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch b/0177-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch deleted file mode 100644 index 67ff860..0000000 --- a/0177-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch +++ /dev/null @@ -1,38 +0,0 @@ -From aac51dfb7d9386a24a330ecc5be69666d333ed64 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 31 Jan 2024 18:44:27 +0800 -Subject: [PATCH 177/272] disk: Optimize disk iteration by moving memdisk to - the end - -When performing file or UUID-based searches, prioritize returning -operating system disk devices over the memdisk. The memdisk, typically -used for internal grub data, is moved to the last position in the search -order. This improves search efficiency and prevents potential unexpected -results. - -Signed-off-by: Michael Chang ---- - include/grub/disk.h | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/include/grub/disk.h b/include/grub/disk.h -index bf0958885..f4fd7a00f 100644 ---- a/include/grub/disk.h -+++ b/include/grub/disk.h -@@ -244,7 +244,12 @@ grub_disk_dev_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data) - - for (pull = 0; pull < GRUB_DISK_PULL_MAX; pull++) - for (p = grub_disk_dev_list; p; p = p->next) -- if (p->disk_iterate && (p->disk_iterate) (hook, hook_data, pull)) -+ if (p->id != GRUB_DISK_DEVICE_MEMDISK_ID && p->disk_iterate && (p->disk_iterate) (hook, hook_data, pull)) -+ return 1; -+ -+ for (pull = 0; pull < GRUB_DISK_PULL_MAX; pull++) -+ for (p = grub_disk_dev_list; p; p = p->next) -+ if (p->id == GRUB_DISK_DEVICE_MEMDISK_ID && p->disk_iterate && (p->disk_iterate) (hook, hook_data, pull)) - return 1; - - return 0; --- -2.41.0 - diff --git a/0178-Make-bash-completion-work-with-version-2.12-and-befo.patch b/0178-Make-bash-completion-work-with-version-2.12-and-befo.patch deleted file mode 100644 index 9942870..0000000 --- a/0178-Make-bash-completion-work-with-version-2.12-and-befo.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 8616826f05c35c48f72ec89f1fe0c21ce6117d85 Mon Sep 17 00:00:00 2001 -From: Werner Fink -Date: Thu, 29 Feb 2024 10:07:58 +0800 -Subject: [PATCH 178/272] Make bash completion work with version 2.12 and - before 2.11 - -Note that the shell function have() had become deprecated with 2.11 -and had been removed from 2.12 which is now providing _comp_have_command() - -resolves boo#1220626 ---- - .../bash-completion.d/grub-completion.bash.in | 38 ++++++++++++------- - 1 file changed, 25 insertions(+), 13 deletions(-) - -diff --git a/util/bash-completion.d/grub-completion.bash.in b/util/bash-completion.d/grub-completion.bash.in -index 213ce1e57..76834bbfb 100644 ---- a/util/bash-completion.d/grub-completion.bash.in -+++ b/util/bash-completion.d/grub-completion.bash.in -@@ -17,6 +17,18 @@ - # along with GRUB. If not, see . - # bash completion for grub - -+if test "$(type -t _comp_have_command)" = function -+then -+ _have() { -+ _comp_have_command $1 -+ } -+elif test "$(type -t have)" = function -+then -+ _have() { -+ have $1 -+ } -+fi -+ - __grub_dir() { - local i c=1 boot_dir - -@@ -177,12 +189,12 @@ _grub_set_entry () { - } - - __grub_set_default_program="@grub_set_default@" --have ${__grub_set_default_program} && \ -+_have ${__grub_set_default_program} && \ - complete -F _grub_set_entry -o filenames ${__grub_set_default_program} - unset __grub_set_default_program - - __grub_reboot_program="@grub_reboot@" --have ${__grub_reboot_program} && \ -+_have ${__grub_reboot_program} && \ - complete -F _grub_set_entry -o filenames ${__grub_reboot_program} - unset __grub_reboot_program - -@@ -209,7 +221,7 @@ _grub_editenv () { - } - - __grub_editenv_program="@grub_editenv@" --have ${__grub_editenv_program} && \ -+_have ${__grub_editenv_program} && \ - complete -F _grub_editenv -o filenames ${__grub_editenv_program} - unset __grub_editenv_program - -@@ -230,7 +242,7 @@ _grub_mkconfig () { - fi - } - __grub_mkconfig_program="@grub_mkconfig@" --have ${__grub_mkconfig_program} && \ -+_have ${__grub_mkconfig_program} && \ - complete -F _grub_mkconfig -o filenames ${__grub_mkconfig_program} - unset __grub_mkconfig_program - -@@ -265,12 +277,12 @@ _grub_setup () { - } - - __grub_bios_setup_program="@grub_bios_setup@" --have ${__grub_bios_setup_program} && \ -+_have ${__grub_bios_setup_program} && \ - complete -F _grub_setup -o filenames ${__grub_bios_setup_program} - unset __grub_bios_setup_program - - __grub_sparc64_setup_program="@grub_sparc64_setup@" --have ${__grub_sparc64_setup_program} && \ -+_have ${__grub_sparc64_setup_program} && \ - complete -F _grub_setup -o filenames ${__grub_sparc64_setup_program} - unset __grub_sparc64_setup_program - -@@ -316,7 +328,7 @@ _grub_install () { - fi - } - __grub_install_program="@grub_install@" --have ${__grub_install_program} && \ -+_have ${__grub_install_program} && \ - complete -F _grub_install -o filenames ${__grub_install_program} - unset __grub_install_program - -@@ -338,7 +350,7 @@ _grub_mkfont () { - fi - } - __grub_mkfont_program="@grub_mkfont@" --have ${__grub_mkfont_program} && \ -+_have ${__grub_mkfont_program} && \ - complete -F _grub_mkfont -o filenames ${__grub_mkfont_program} - unset __grub_mkfont_program - -@@ -369,7 +381,7 @@ _grub_mkrescue () { - fi - } - __grub_mkrescue_program="@grub_mkrescue@" --have ${__grub_mkrescue_program} && \ -+_have ${__grub_mkrescue_program} && \ - complete -F _grub_mkrescue -o filenames ${__grub_mkrescue_program} - unset __grub_mkrescue_program - -@@ -411,7 +423,7 @@ _grub_mkimage () { - fi - } - __grub_mkimage_program="@grub_mkimage@" --have ${__grub_mkimage_program} && \ -+_have ${__grub_mkimage_program} && \ - complete -F _grub_mkimage -o filenames ${__grub_mkimage_program} - unset __grub_mkimage_program - -@@ -433,7 +445,7 @@ _grub_mkpasswd_pbkdf2 () { - fi - } - __grub_mkpasswd_pbkdf2_program="@grub_mkpasswd_pbkdf2@" --have ${__grub_mkpasswd_pbkdf2_program} && \ -+_have ${__grub_mkpasswd_pbkdf2_program} && \ - complete -F _grub_mkpasswd_pbkdf2 -o filenames ${__grub_mkpasswd_pbkdf2_program} - unset __grub_mkpasswd_pbkdf2_program - -@@ -471,7 +483,7 @@ _grub_probe () { - fi - } - __grub_probe_program="@grub_probe@" --have ${__grub_probe_program} && \ -+_have ${__grub_probe_program} && \ - complete -F _grub_probe -o filenames ${__grub_probe_program} - unset __grub_probe_program - -@@ -493,7 +505,7 @@ _grub_script_check () { - fi - } - __grub_script_check_program="@grub_script_check@" --have ${__grub_script_check_program} && \ -+_have ${__grub_script_check_program} && \ - complete -F _grub_script_check -o filenames ${__grub_script_check_program} - - --- -2.41.0 - diff --git a/0199-BLS-create-etc-kernel-cmdline-during-mkconfig.patch b/0178-squish-don-t-dup-rhgb-quiet-check-mtimes.patch similarity index 41% rename from 0199-BLS-create-etc-kernel-cmdline-during-mkconfig.patch rename to 0178-squish-don-t-dup-rhgb-quiet-check-mtimes.patch index 48d2419..fa279f1 100644 --- a/0199-BLS-create-etc-kernel-cmdline-during-mkconfig.patch +++ b/0178-squish-don-t-dup-rhgb-quiet-check-mtimes.patch @@ -1,38 +1,35 @@ -From a41df9b3cf6190ed8a2175602eb19a45d7e002aa Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 16:52:33 +0800 -Subject: [PATCH 199/272] BLS: create /etc/kernel/cmdline during mkconfig +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Wed, 17 Aug 2022 10:26:07 -0400 +Subject: [PATCH] squish: don't dup rhgb quiet, check mtimes -- v2: squish: don't dup rhgb quiet, check mtimes -- v3: squish: give up on rhgb quiet -- v4: squish: BLS: only write /etc/kernel/cmdline if writable - -Signed-off-by: nilusyi Signed-off-by: Robbie Harwood -Signed-off-by: Jonathan Lebon --- - util/grub.d/10_linux.in | 8 ++++++++ - 1 file changed, 8 insertions(+) + util/grub.d/10_linux.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 14df28135..7d843db85 100644 +index a6568caf7d1..079bb9a0961 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -163,6 +163,14 @@ update_bls_cmdline() +@@ -163,10 +163,16 @@ update_bls_cmdline() local cmdline="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" local -a files=($(get_sorted_bls)) -+ if [ -w /etc/kernel ] && [[ ! -f /etc/kernel/cmdline || -+ /etc/kernel/cmdline -ot /etc/default/grub ]]; then +- if [[ ! -f /etc/kernel/cmdline ]]; then +- # anaconda has the correct information to do this during install; +- # afterward, grubby will take care of syncing on updates. +- echo "$cmdline rhgb quiet" > /etc/kernel/cmdline ++ if [[ ! -f /etc/kernel/cmdline ]] || ++ [[ /etc/kernel/cmdline -ot /etc/default/grub ]]; then + # anaconda has the correct information to create this during install; + # afterward, grubby will take care of syncing on updates. If the user + # has modified /etc/default/grub, try to cope. ++ if [[ ! "$cmdline" =~ "rhgb quiet" ]]; then ++ # ensure these only show up once ++ cmdline="$cmdline rhgb quiet" ++ fi + echo "$cmdline" > /etc/kernel/cmdline -+ fi -+ + fi + for bls in "${files[@]}"; do - local options="${cmdline}" - if [ -z "${bls##*debug*}" ]; then --- -2.41.0 - diff --git a/0179-squish-give-up-on-rhgb-quiet.patch b/0179-squish-give-up-on-rhgb-quiet.patch new file mode 100644 index 0000000..c1cbf6d --- /dev/null +++ b/0179-squish-give-up-on-rhgb-quiet.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Wed, 17 Aug 2022 11:30:30 -0400 +Subject: [PATCH] squish: give up on rhgb quiet + +Signed-off-by: Robbie Harwood +--- + util/grub.d/10_linux.in | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 079bb9a0961..2dddc39816f 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -168,10 +168,6 @@ update_bls_cmdline() + # anaconda has the correct information to create this during install; + # afterward, grubby will take care of syncing on updates. If the user + # has modified /etc/default/grub, try to cope. +- if [[ ! "$cmdline" =~ "rhgb quiet" ]]; then +- # ensure these only show up once +- cmdline="$cmdline rhgb quiet" +- fi + echo "$cmdline" > /etc/kernel/cmdline + fi + diff --git a/0180-Don-t-say-GNU-Linux-in-generated-menus.patch b/0180-Don-t-say-GNU-Linux-in-generated-menus.patch deleted file mode 100644 index db667f1..0000000 --- a/0180-Don-t-say-GNU-Linux-in-generated-menus.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 6c13567f18258f503dbc4ca19fbf8b24a998e864 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 14 Mar 2011 14:27:42 -0400 -Subject: [PATCH 180/272] Don't say "GNU/Linux" in generated menus. - ---- - util/grub.d/10_linux.in | 2 +- - util/grub.d/20_linux_xen.in | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 2accd4574..29e6c51db 100644 ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -29,7 +29,7 @@ export TEXTDOMAINDIR="@localedir@" - CLASS="--class gnu-linux --class gnu --class os" - - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then -- OS=GNU/Linux -+ OS="$(sed 's, release .*$,,g' /etc/system-release)" - else - OS="${GRUB_DISTRIBUTOR}" - CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}" -diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in -index 672835df3..7c106b247 100644 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -37,7 +37,7 @@ fi - CLASS="--class gnu-linux --class gnu --class os --class xen" - - if [ "x${GRUB_DISTRIBUTOR}" = "x" ] ; then -- OS=GNU/Linux -+ OS="$(sed 's, release .*$,,g' /etc/system-release)" - os=linux - else - OS="${GRUB_DISTRIBUTOR}" --- -2.41.0 - diff --git a/0180-squish-BLS-only-write-etc-kernel-cmdline-if-writable.patch b/0180-squish-BLS-only-write-etc-kernel-cmdline-if-writable.patch new file mode 100644 index 0000000..2c5c7c5 --- /dev/null +++ b/0180-squish-BLS-only-write-etc-kernel-cmdline-if-writable.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jonathan Lebon +Date: Wed, 17 Aug 2022 10:26:03 -0400 +Subject: [PATCH] squish: BLS: only write /etc/kernel/cmdline if writable + +On OSTree systems, `grub2-mkconfig` is run with `/etc` mounted read-only +because as part of the promise of transactional updates, we want to make +sure that we're not modifying the current deployment's state (`/etc` or +`/var`). + +This conflicts with 0837dcdf1 ("BLS: create /etc/kernel/cmdline during +mkconfig") which wants to write to `/etc/kernel/cmdline`. I'm not +exactly sure on the background there, but based on the comment I think +the intent is to fulfill grubby's expectation that the file exists. + +However, in systems like Silverblue, kernel arguments are managed by the +rpm-ostree stack and grubby is not shipped at all. + +Adjust the script slightly so that we only write `/etc/kernel/cmdline` +if the parent directory is writable. + +In the future, we're hoping to simplify things further on rpm-ostree +systems by not running `grub2-mkconfig` at all since libostree already +directly writes BLS entries. Doing that would also have avoided this, +but ratcheting it into existing systems needs more careful thought. + +Signed-off-by: Jonathan Lebon + +Fixes: https://github.com/fedora-silverblue/issue-tracker/issues/322 +--- + util/grub.d/10_linux.in | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 2dddc39816f..11c19304f8b 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -163,12 +163,13 @@ update_bls_cmdline() + local cmdline="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" + local -a files=($(get_sorted_bls)) + +- if [[ ! -f /etc/kernel/cmdline ]] || +- [[ /etc/kernel/cmdline -ot /etc/default/grub ]]; then +- # anaconda has the correct information to create this during install; +- # afterward, grubby will take care of syncing on updates. If the user +- # has modified /etc/default/grub, try to cope. +- echo "$cmdline" > /etc/kernel/cmdline ++ if [ -w /etc/kernel ] && ++ [[ ! -f /etc/kernel/cmdline || ++ /etc/kernel/cmdline -ot /etc/default/grub ]]; then ++ # anaconda has the correct information to create this during install; ++ # afterward, grubby will take care of syncing on updates. If the user ++ # has modified /etc/default/grub, try to cope. ++ echo "$cmdline" > /etc/kernel/cmdline + fi + + for bls in "${files[@]}"; do diff --git a/0181-blscfg-Don-t-root-device-in-emu-builds.patch b/0181-blscfg-Don-t-root-device-in-emu-builds.patch new file mode 100644 index 0000000..d61b1b2 --- /dev/null +++ b/0181-blscfg-Don-t-root-device-in-emu-builds.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Thu, 25 Aug 2022 17:57:55 -0400 +Subject: [PATCH] blscfg: Don't root device in emu builds + +Otherwise, we end up looking for kernel/initrd in /boot/boot which +doesn't work at all. Non-emu builds need to be looking in +($root)/boot/, which is what this is for. + +Signed-off-by: Robbie Harwood +--- + grub-core/commands/blscfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index e907a6a5d28..dbd0899acf3 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -41,7 +41,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_BLS_CONFIG_PATH "/loader/entries/" + #ifdef GRUB_MACHINE_EMU +-#define GRUB_BOOT_DEVICE "/boot" ++#define GRUB_BOOT_DEVICE "" + #else + #define GRUB_BOOT_DEVICE "($root)" + #endif diff --git a/0182-ppc64le-signed-boot-media-changes.patch b/0182-ppc64le-signed-boot-media-changes.patch new file mode 100644 index 0000000..f92570e --- /dev/null +++ b/0182-ppc64le-signed-boot-media-changes.patch @@ -0,0 +1,123 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Wed, 25 Jan 2023 16:10:58 -0500 +Subject: [PATCH] ppc64le: signed boot media changes + +Skip mdraid < 1.1 on isos since mdraid* can't even + +Prior to this change, on ppc64le with part_msdos and the mdraid* modules +enabled, we see: + + disk/diskfilter.c:191: scanning ieee1275/cdrom + kern/disk.c:196: Opening `ieee1275/cdrom'... + disk/ieee1275/ofdisk.c:477: Opening `cdrom'. + disk/ieee1275/ofdisk.c:502: MAX_RETRIES set to 20 + kern/disk.c:288: Opening `ieee1275/cdrom' succeeded. + disk/diskfilter.c:136: Scanning for DISKFILTER devices on disk ieee1275/cdrom + partmap/msdos.c:184: partition 0: flag 0x80, type 0x96, start 0x0, len + 0x6a5d70 + disk/diskfilter.c:136: Scanning for DISKFILTER devices on disk ieee1275/cdrom + SCSI-DISK: Access beyond end of device ! + SCSI-DISK: Access beyond end of device ! + SCSI-DISK: Access beyond end of device ! + SCSI-DISK: Access beyond end of device ! + SCSI-DISK: Access beyond end of device ! + disk/ieee1275/ofdisk.c:578: MAX_RETRIES set to 20 + +These latter two lines repeat many times, eventually ending in: + + kern/disk.c:388: ieee1275/cdrom read failed + error: ../../grub-core/disk/ieee1275/ofdisk.c:608:failure reading sector + 0x1a9720 from `ieee1275/cdrom'. + +and the system drops to a "grub>" prompt. + +Prior to 1.1, mdraid stored the superblock offset from the end of the +disk, and the firmware really doesn't like reads there. Best guess was +that the firmware and the iso image appear to diagree on the blocksize +(512 vs. 2048), and the diskfilter RAID probing is too much for it. +It's tempting to just skip probing for cdroms, but unfortunately isos +can be virtualized elsewhere - such as regular disks. + +Also fix detection of root, and try the chrp path as a fallback if the +built prefix doesn't work. + +Signed-off-by: Robbie Harwood + +wip +--- + grub-core/disk/mdraid1x_linux.c | 6 ++++++ + grub-core/disk/mdraid_linux.c | 5 +++++ + grub-core/kern/ieee1275/openfw.c | 2 +- + grub-core/normal/main.c | 5 +++++ + 4 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/mdraid1x_linux.c b/grub-core/disk/mdraid1x_linux.c +index 72e5cb6f481..3b5b6c42342 100644 +--- a/grub-core/disk/mdraid1x_linux.c ++++ b/grub-core/disk/mdraid1x_linux.c +@@ -130,6 +130,12 @@ grub_mdraid_detect (grub_disk_t disk, + struct grub_diskfilter_vg *array; + char *uuid; + ++#ifdef __powerpc__ ++ /* Firmware will yell at us for reading too far. */ ++ if (minor_version == 0) ++ continue; ++#endif ++ + if (size == GRUB_DISK_SIZE_UNKNOWN && minor_version == 0) + continue; + +diff --git a/grub-core/disk/mdraid_linux.c b/grub-core/disk/mdraid_linux.c +index e40216f5111..98fcfb1be69 100644 +--- a/grub-core/disk/mdraid_linux.c ++++ b/grub-core/disk/mdraid_linux.c +@@ -189,6 +189,11 @@ grub_mdraid_detect (grub_disk_t disk, + grub_uint32_t level; + struct grub_diskfilter_vg *ret; + ++#ifdef __powerpc__ ++ /* Firmware will yell at us for reading too far. */ ++ return NULL; ++#endif ++ + /* The sector where the mdraid 0.90 superblock is stored, if available. */ + size = grub_disk_native_sectors (disk); + if (size == GRUB_DISK_SIZE_UNKNOWN) +diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c +index e2ecc65d2d8..65616254e02 100644 +--- a/grub-core/kern/ieee1275/openfw.c ++++ b/grub-core/kern/ieee1275/openfw.c +@@ -499,7 +499,7 @@ grub_ieee1275_encode_devname (const char *path) + *optr++ ='\\'; + *optr++ = *iptr++; + } +- if (partition && partition[0]) ++ if (partition && partition[0] >= '0' && partition[0] <= '9') + { + unsigned int partno = grub_strtoul (partition, 0, 0); + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index fc3ed551cec..e903f291732 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -372,6 +372,7 @@ grub_try_normal_prefix (const char *prefix) + file = grub_file_open (config, GRUB_FILE_TYPE_CONFIG); + if (file) + { ++ grub_env_set ("prefix", prefix); + grub_file_close (file); + err = GRUB_ERR_NONE; + } +@@ -447,6 +448,10 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), + err = grub_try_normal ("fw_path"); + if (err == GRUB_ERR_FILE_NOT_FOUND) + err = grub_try_normal ("prefix"); ++#ifdef __powerpc__ ++ if (err == GRUB_ERR_FILE_NOT_FOUND) ++ err = grub_try_normal_prefix ("/boot/grub"); ++#endif + if (err == GRUB_ERR_FILE_NOT_FOUND) + err = grub_try_normal_discover (); + if (err == GRUB_ERR_FILE_NOT_FOUND) diff --git a/0183-core-Fix-several-implicit-function-declarations.patch b/0183-core-Fix-several-implicit-function-declarations.patch new file mode 100644 index 0000000..a814033 --- /dev/null +++ b/0183-core-Fix-several-implicit-function-declarations.patch @@ -0,0 +1,54 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Arjun Shankar +Date: Sun, 5 Feb 2023 11:13:55 +0100 +Subject: [PATCH] core: Fix several implicit function declarations + +These #include lines ensure that grub2 continues to build with C99 +where implicit function declarations are removed. + +Related to: + + + +--- + grub-core/commands/efi/connectefi.c | 1 + + grub-core/net/http.c | 1 + + grub-core/term/at_keyboard.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/grub-core/commands/efi/connectefi.c b/grub-core/commands/efi/connectefi.c +index 0f840ea0575..6c397f8f508 100644 +--- a/grub-core/commands/efi/connectefi.c ++++ b/grub-core/commands/efi/connectefi.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/grub-core/net/http.c b/grub-core/net/http.c +index ce2b492c353..40df19426c8 100644 +--- a/grub-core/net/http.c ++++ b/grub-core/net/http.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +diff --git a/grub-core/term/at_keyboard.c b/grub-core/term/at_keyboard.c +index 378deb321d9..e667d0a862c 100644 +--- a/grub-core/term/at_keyboard.c ++++ b/grub-core/term/at_keyboard.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + diff --git a/0184-ieee1275-request-memory-with-ibm-client-architecture.patch b/0184-ieee1275-request-memory-with-ibm-client-architecture.patch new file mode 100644 index 0000000..bd59885 --- /dev/null +++ b/0184-ieee1275-request-memory-with-ibm-client-architecture.patch @@ -0,0 +1,109 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Mon, 6 Feb 2023 10:03:20 -0500 +Subject: [PATCH] ieee1275: request memory with ibm, + client-architecture-support + +On PowerVM, the first time we boot a Linux partition, we may only get +256MB of real memory area, even if the partition has more memory. + +This isn't enough to reliably verify a kernel. Fortunately, the Power +Architecture Platform Reference (PAPR) defines a method we can call to ask +for more memory: the broad and powerful ibm,client-architecture-support +(CAS) method. + +CAS can do an enormous amount of things on a PAPR platform: as well as +asking for memory, you can set the supported processor level, the interrupt +controller, hash vs radix mmu, and so on. + +If: + + - we are running under what we think is PowerVM (compatible property of / + begins with "IBM"), and + + - the full amount of RMA is less than 512MB (as determined by the reg + property of /memory) + +then call CAS as follows: (refer to the Linux on Power Architecture +Reference, LoPAR, which is public, at B.5.2.3): + + - Use the "any" PVR value and supply 2 option vectors. + + - Set option vector 1 (PowerPC Server Processor Architecture Level) + to "ignore". + + - Set option vector 2 with default or Linux-like options, including a + min-rma-size of 512MB. + + - Set option vector 3 to request Floating Point, VMX and Decimal Floating + point, but don't abort the boot if we can't get them. + + - Set option vector 4 to request a minimum VP percentage to 1%, which is + what Linux requests, and is below the default of 10%. Without this, + some systems with very large or very small configurations fail to boot. + +This will cause a CAS reboot and the partition will restart with 512MB +of RMA. Importantly, grub will notice the 512MB and not call CAS again. + +Notes about the choices of parameters: + + - A partition can be configured with only 256MB of memory, which would + mean this request couldn't be satisfied, but PFW refuses to load with + only 256MB of memory, so it's a bit moot. SLOF will run fine with 256MB, + but we will never call CAS under qemu/SLOF because /compatible won't + begin with "IBM".) + + - unspecified CAS vectors take on default values. Some of these values + might restrict the ability of certain hardware configurations to boot. + This is why we need to specify the VP percentage in vector 4, which is + in turn why we need to specify vector 3. + +Finally, we should have enough memory to verify a kernel, and we will +reach Linux. One of the first things Linux does while still running under +OpenFirmware is to call CAS with a much fuller set of options (including +asking for 512MB of memory). Linux includes a much more restrictive set of +PVR values and processor support levels, and this CAS invocation will likely +induce another reboot. On this reboot grub will again notice the higher RMA, +and not call CAS. We will get to Linux again, Linux will call CAS again, but +because the values are now set for Linux this will not induce another CAS +reboot and we will finally boot all the way to userspace. + +On all subsequent boots, everything will be configured with 512MB of RMA, +so there will be no further CAS reboots from grub. (phyp is super sticky +with the RMA size - it persists even on cold boots. So if you've ever booted +Linux in a partition, you'll probably never have grub call CAS. It'll only +ever fire the first time a partition loads grub, or if you deliberately lower +the amount of memory your partition has below 512MB.) + +Signed-off-by: Daniel Axtens +Signed-off-by: Stefan Berger +Reviewed-by: Daniel Kiper +(cherry picked from commit d5571590b7de61887efac1c298901455697ba307) +--- + grub-core/kern/ieee1275/init.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 8ce1a0f09ee..13e8a5b4bb8 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -850,6 +850,19 @@ grub_claim_heap (void) + } + #endif + ++#if defined(__powerpc__) ++ if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY)) ++ { ++ grub_uint64_t rma_size; ++ grub_err_t err; ++ ++ err = grub_ieee1275_total_mem (&rma_size); ++ /* if we have an error, don't call CAS, just hope for the best */ ++ if (err == GRUB_ERR_NONE && rma_size < (512 * 1024 * 1024)) ++ grub_ieee1275_ibm_cas (); ++ } ++#endif ++ + grub_machine_mmap_iterate (heap_init, &total); + } + #endif diff --git a/0185-hostdisk-work-around-proc-not-reporting-size.patch b/0185-hostdisk-work-around-proc-not-reporting-size.patch new file mode 100644 index 0000000..72715ae --- /dev/null +++ b/0185-hostdisk-work-around-proc-not-reporting-size.patch @@ -0,0 +1,93 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Thu, 9 Mar 2023 11:18:19 -0500 +Subject: [PATCH] hostdisk: work around /proc not reporting size + +fstat(2) of files in /proc will yield st_size == 0 regardless of file +contents. Use a negative value in grub_file_t's size to denote "ignore" +and plumb through. + +Signed-off-by: Robbie Harwood +--- + grub-core/kern/file.c | 28 ++++++++++++++++------------ + grub-core/lib/progress.c | 2 +- + grub-core/osdep/unix/hostdisk.c | 6 ++++++ + 3 files changed, 23 insertions(+), 13 deletions(-) + +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 1794d022fb0..75510df7c92 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -172,26 +172,30 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len) + grub_disk_read_hook_t read_hook; + void *read_hook_data; + +- if (file->offset > file->size) +- { +- grub_error (GRUB_ERR_OUT_OF_RANGE, +- N_("attempt to read past the end of file")); +- return -1; +- } +- + if (len == 0) + return 0; + +- if (len > file->size - file->offset) +- len = file->size - file->offset; ++#ifdef GRUB_MACHINE_EMU ++ if (file->size >= 0) ++ { ++#endif ++ if (file->offset > file->size) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ N_("attempt to read past the end of file")); ++ return -1; ++ } ++ ++ if (len > file->size - file->offset) ++ len = file->size - file->offset; ++#ifdef GRUB_MACHINE_EMU ++ } ++#endif + + /* Prevent an overflow. */ + if ((grub_ssize_t) len < 0) + len >>= 1; + +- if (len == 0) +- return 0; +- + read_hook = file->read_hook; + read_hook_data = file->read_hook_data; + if (!file->read_hook) +diff --git a/grub-core/lib/progress.c b/grub-core/lib/progress.c +index 4f4389dd586..eb1b7d13cfd 100644 +--- a/grub-core/lib/progress.c ++++ b/grub-core/lib/progress.c +@@ -72,7 +72,7 @@ grub_file_progress_hook_real (grub_disk_addr_t sector __attribute__ ((unused)), + * 100ULL * 1000ULL, + now - file->last_progress_time, 0); + +- if (file->size == 0) ++ if (file->size <= 0) + percent = 100; + else + percent = grub_divmod64 (100 * file->progress_offset, +diff --git a/grub-core/osdep/unix/hostdisk.c b/grub-core/osdep/unix/hostdisk.c +index 3a00d7451a5..e5f4b4d5f9c 100644 +--- a/grub-core/osdep/unix/hostdisk.c ++++ b/grub-core/osdep/unix/hostdisk.c +@@ -71,6 +71,12 @@ grub_util_get_fd_size (grub_util_fd_t fd, const char *name, unsigned *log_secsiz + if (log_secsize) + *log_secsize = 9; + ++#ifdef GRUB_MACHINE_EMU ++ /* /proc doesn't behave itself and gives 0 for file sizes to stat. */ ++ if (st.st_size == 0 && !grub_strncmp ("/proc", name, 5)) ++ return -1; ++#endif ++ + return st.st_size; + } + diff --git a/0200-blscfg-check-for-mounted-boot-in-emu.patch b/0186-blscfg-check-for-mounted-boot-in-emu.patch similarity index 77% rename from 0200-blscfg-check-for-mounted-boot-in-emu.patch rename to 0186-blscfg-check-for-mounted-boot-in-emu.patch index dce8c13..54b3cf0 100644 --- a/0200-blscfg-check-for-mounted-boot-in-emu.patch +++ b/0186-blscfg-check-for-mounted-boot-in-emu.patch @@ -1,7 +1,7 @@ -From 5e9e47cac7139d535561714f9990e5d5393d5990 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 7 Mar 2023 18:59:40 -0500 -Subject: [PATCH 200/272] blscfg: check for mounted /boot in emu +Subject: [PATCH] blscfg: check for mounted /boot in emu Irritatingly, BLS defines paths relatives to the mountpoint of the filesystem which contains its snippets, not / or any other fixed @@ -10,14 +10,25 @@ filesysem from / and conditionally prepend a path. Signed-off-by: Robbie Harwood --- - grub-core/commands/blscfg.c | 51 ++++++++++++++++++++++++++++++++++--- - 1 file changed, 47 insertions(+), 4 deletions(-) + grub-core/commands/blscfg.c | 54 ++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 49 insertions(+), 5 deletions(-) diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c -index 7132555df..ed1bf11aa 100644 +index dbd0899acf3..6e398fc1757 100644 --- a/grub-core/commands/blscfg.c +++ b/grub-core/commands/blscfg.c -@@ -54,8 +54,50 @@ struct keyval +@@ -40,8 +40,9 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #include "loadenv.h" + + #define GRUB_BLS_CONFIG_PATH "/loader/entries/" ++ + #ifdef GRUB_MACHINE_EMU +-#define GRUB_BOOT_DEVICE "" ++#define GRUB_BOOT_DEVICE "/boot" + #else + #define GRUB_BOOT_DEVICE "($root)" + #endif +@@ -54,8 +55,50 @@ struct keyval static struct bls_entry *entries = NULL; @@ -68,7 +79,7 @@ index 7132555df..ed1bf11aa 100644 static int bls_add_keyval(struct bls_entry *entry, char *key, char *val) { char *k, *v; -@@ -842,7 +884,7 @@ static void create_entry (struct bls_entry *entry) +@@ -842,7 +885,7 @@ static void create_entry (struct bls_entry *entry) for (i = 0; early_initrds != NULL && early_initrds[i] != NULL; i++) { grub_dprintf ("blscfg", "adding early initrd %s\n", early_initrds[i]); @@ -77,7 +88,7 @@ index 7132555df..ed1bf11aa 100644 tmp = grub_stpcpy (tmp, initrd_prefix); tmp = grub_stpcpy (tmp, early_initrds[i]); grub_free(early_initrds[i]); -@@ -851,7 +893,7 @@ static void create_entry (struct bls_entry *entry) +@@ -851,7 +894,7 @@ static void create_entry (struct bls_entry *entry) for (i = 0; initrds != NULL && initrds[i] != NULL; i++) { grub_dprintf ("blscfg", "adding initrd %s\n", initrds[i]); @@ -86,7 +97,7 @@ index 7132555df..ed1bf11aa 100644 tmp = grub_stpcpy (tmp, initrds[i]); } tmp = grub_stpcpy (tmp, "\n"); -@@ -888,7 +930,7 @@ static void create_entry (struct bls_entry *entry) +@@ -888,7 +931,7 @@ static void create_entry (struct bls_entry *entry) } char *tmp = dt; tmp = grub_stpcpy (dt, "devicetree"); @@ -95,7 +106,7 @@ index 7132555df..ed1bf11aa 100644 if (add_dt_prefix) tmp = grub_stpcpy (tmp, prefix); tmp = grub_stpcpy (tmp, devicetree); -@@ -907,7 +949,8 @@ static void create_entry (struct bls_entry *entry) +@@ -907,7 +950,8 @@ static void create_entry (struct bls_entry *entry) "linux %s%s%s%s\n" "%s%s", savedefault ? "savedefault\n" : "", @@ -104,7 +115,4 @@ index 7132555df..ed1bf11aa 100644 + clinux, options ? " " : "", options ? options : "", initrd ? initrd : "", dt ? dt : ""); - grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, 0, &index, entry); --- -2.41.0 - + grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry); diff --git a/0187-grub_dl_set_mem_attrs-fix-format-string.patch b/0187-grub_dl_set_mem_attrs-fix-format-string.patch new file mode 100644 index 0000000..646c609 --- /dev/null +++ b/0187-grub_dl_set_mem_attrs-fix-format-string.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Fri, 7 Apr 2023 14:54:35 +0200 +Subject: [PATCH] grub_dl_set_mem_attrs(): fix format string + +The grub_dprintf() call for printing the message + + updating attributes for GOT and trampolines + +passes the argument "mod->name", but the format string doesn't accept that +argument. + +Print the module name too. + +Example output: + +> kern/dl.c:736: updating attributes for GOT and trampolines ("video_fb") + +Fixes: ad1b904d325b (nx: set page permissions for loaded modules.) +Signed-off-by: Laszlo Ersek +--- + grub-core/kern/dl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 25666ae383f..101e0794dd8 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -733,7 +733,8 @@ grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr) + { + tgsz = ALIGN_UP(tgsz, arch_addralign); + +- grub_dprintf ("modules", "updating attributes for GOT and trampolines\n", ++ grub_dprintf ("modules", ++ "updating attributes for GOT and trampolines (\"%s\")\n", + mod->name); + grub_update_mem_attrs (tgaddr, tgsz, GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_X, + GRUB_MEM_ATTR_W); diff --git a/0188-grub_dl_set_mem_attrs-add-self-check-for-the-tramp-G.patch b/0188-grub_dl_set_mem_attrs-add-self-check-for-the-tramp-G.patch new file mode 100644 index 0000000..6543a9e --- /dev/null +++ b/0188-grub_dl_set_mem_attrs-add-self-check-for-the-tramp-G.patch @@ -0,0 +1,140 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Fri, 7 Apr 2023 16:21:54 +0200 +Subject: [PATCH] grub_dl_set_mem_attrs(): add self-check for the tramp/GOT + sizes + +On aarch64 UEFI, we currently have a crasher: + + grub_dl_load_core() + grub_dl_load_core_noinit() + + /* independent allocation: must remain writable */ + mod = grub_zalloc(); + + /* allocates module image with incorrect tail alignment */ + grub_dl_load_segments() + + /* write-protecting the module image makes "mod" read-only! */ + grub_dl_set_mem_attrs() + grub_update_mem_attrs() + + grub_dl_init() + /* page fault, crash */ + mod->next = ...; + +- Commit 887f1d8fa976 ("modules: load module sections at page-aligned + addresses", 2023-02-08) forgot to page-align the allocation of the + trampolines and GOT areas of grub2 modules, in grub_dl_load_segments(). + +- Commit ad1b904d325b ("nx: set page permissions for loaded modules.", + 2023-02-08) calculated a common bounding box for the trampolines and GOT + areas in grub_dl_set_mem_attrs(), rounded the box size up to a whole + multiple of EFI page size ("arch_addralign"), and write-protected the + resultant page range. + +Consequently, grub_dl_load_segments() places the module image in memory +such that its tail -- the end of the trampolines and GOT areas -- lands at +the head of a page whose tail in turn contains independent memory +allocations, such as "mod". grub_dl_set_mem_attrs() will then unwittingly +write-protect these other allocations too. + +But "mod" must remain writable: we assign "mod->next" in grub_dl_init() +subsequently. Currently we crash there with a page fault / permission +fault. + +(The crash is not trivial to hit: the tramp/GOT areas are irrelevant on +x86_64, plus the page protection depends on the UEFI platform firmware +providing EFI_MEMORY_ATTRIBUTE_PROTOCOL. In practice, the crash is +restricted to aarch64 edk2 (ArmVirtQemu) builds containing commit +1c4dfadb4611, "ArmPkg/CpuDxe: Implement EFI memory attributes protocol", +2023-03-16.) + +Example log before the patch: + +> kern/dl.c:736: updating attributes for GOT and trampolines ("video_fb") +> kern/efi/mm.c:927: set +rx -w on 0x13b88b000-0x13b88bfff before:rwx after:r-x +> kern/dl.c:744: done updating module memory attributes for "video_fb" +> kern/dl.c:639: flushing 0xe4f0 bytes at 0x13b87d000 +> kern/arm64/cache.c:42: D$ line size: 64 +> kern/arm64/cache.c:43: I$ line size: 64 +> kern/dl.c:839: module name: video_fb +> kern/dl.c:840: init function: 0x0 +> kern/dl.c:865: Initing module video_fb +> +> Synchronous Exception at 0x000000013B8A76EC +> PC 0x00013B8A76EC +> +> X0 0x000000013B88B960 X1 0x0000000000000000 X2 0x000000013F93587C X3 0x0000000000000075 +> +> SP 0x00000000470745C0 ELR 0x000000013B8A76EC SPSR 0x60000205 FPSR 0x00000000 +> ESR 0x9600004F FAR 0x000000013B88B9D0 +> +> ESR : EC 0x25 IL 0x1 ISS 0x0000004F +> +> Data abort: Permission fault, third level + +Note the following: + +- The whole 4K page at 0x1_3B88_B000 is write-protected. + +- The "video_fb" module actually lives at [0x1_3B87_D000, 0x1_3B88_B4F0) + -- left-inclusive, right-exclusive --; that is, in the last page (at + 0x1_3B88_B000), it only occupies the first 0x4F0 bytes. + +- The instruction at 0x1_3B8A_76EC faults. Not shown here, but it is a + store instruction, which writes to the field at offset 0x70 of the + structure pointed-to by the X0 register. This is the "mod->next" + assignment from grub_dl_init(). + +- The faulting address is therefore (X0 + 0x70), i.e., 0x1_3B88_B9D0. This + is indeed the value held in the FAR register. + +- The faulting address 0x1_3B88_B9D0 falls in the above-noted page (at + 0x1_3B88_B000), namely at offset 0x9D0. This is *beyond* the first 0x4F0 + bytes that the very tail of the "video_fb" module occupies at the front + of that page. + +For now, add a self-check that reports this bug (and prevents the crash by +skipping the write protection). + +Example log after the patch: + +> kern/dl.c:742:BUG: trying to protect pages outside of module allocation +> ("video_fb"): module base 0x13b87d000, size 0xe4f0; tramp/GOT base +> 0x13b88b000, size 0x1000 + +Signed-off-by: Laszlo Ersek +--- + grub-core/kern/dl.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 101e0794dd8..bad0ad4b945 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -682,7 +682,7 @@ grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr) + #if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) + grub_size_t arch_addralign = grub_arch_dl_min_alignment (); + grub_addr_t tgaddr; +- grub_uint64_t tgsz; ++ grub_size_t tgsz; + #endif + + grub_dprintf ("modules", "updating memory attributes for \"%s\"\n", +@@ -736,6 +736,15 @@ grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr) + grub_dprintf ("modules", + "updating attributes for GOT and trampolines (\"%s\")\n", + mod->name); ++ if (tgaddr < (grub_addr_t)mod->base || ++ tgsz > (grub_addr_t)-1 - tgaddr || ++ tgaddr + tgsz > (grub_addr_t)mod->base + mod->sz) ++ return grub_error (GRUB_ERR_BUG, ++ "BUG: trying to protect pages outside of module " ++ "allocation (\"%s\"): module base %p, size 0x%" ++ PRIxGRUB_SIZE "; tramp/GOT base 0x%" PRIxGRUB_ADDR ++ ", size 0x%" PRIxGRUB_SIZE, ++ mod->name, mod->base, mod->sz, tgaddr, tgsz); + grub_update_mem_attrs (tgaddr, tgsz, GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_X, + GRUB_MEM_ATTR_W); + } diff --git a/0189-disable-some-unsupported-filesystems.patch b/0189-disable-some-unsupported-filesystems.patch deleted file mode 100644 index 4dc7a2e..0000000 --- a/0189-disable-some-unsupported-filesystems.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 56182718bf2b286e86b86d489703cc960b9a4daa Mon Sep 17 00:00:00 2001 -From: Qiumiao Zhang -Date: Thu, 2 Feb 2023 14:37:52 +0800 -Subject: [PATCH 189/272] disable some unsupported filesystems - -Signed-off-by: Qiumiao Zhang ---- - Makefile.util.def | 17 ----------------- - 1 file changed, 17 deletions(-) - -diff --git a/Makefile.util.def b/Makefile.util.def -index f3ef63933..4839076d9 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -90,9 +90,6 @@ library = { - common = grub-core/video/colors.c; - common = grub-core/unidata.c; - common = grub-core/io/bufio.c; -- common = grub-core/fs/affs.c; -- common = grub-core/fs/afs.c; -- common = grub-core/fs/bfs.c; - common = grub-core/fs/btrfs.c; - common = grub-core/fs/cbfs.c; - common = grub-core/fs/cpio.c; -@@ -108,25 +105,11 @@ library = { - common = grub-core/fs/hfsplus.c; - common = grub-core/fs/hfspluscomp.c; - common = grub-core/fs/iso9660.c; -- common = grub-core/fs/jfs.c; -- common = grub-core/fs/minix.c; -- common = grub-core/fs/minix2.c; -- common = grub-core/fs/minix3.c; -- common = grub-core/fs/minix_be.c; -- common = grub-core/fs/minix2_be.c; -- common = grub-core/fs/minix3_be.c; -- common = grub-core/fs/nilfs2.c; - common = grub-core/fs/ntfs.c; - common = grub-core/fs/ntfscomp.c; -- common = grub-core/fs/reiserfs.c; -- common = grub-core/fs/romfs.c; -- common = grub-core/fs/sfs.c; - common = grub-core/fs/squash4.c; - common = grub-core/fs/tar.c; - common = grub-core/fs/udf.c; -- common = grub-core/fs/ufs2.c; -- common = grub-core/fs/ufs.c; -- common = grub-core/fs/ufs_be.c; - common = grub-core/fs/xfs.c; - common = grub-core/fs/zfs/zfscrypt.c; - common = grub-core/fs/zfs/zfs.c; --- -2.41.0 - diff --git a/0189-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch b/0189-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch new file mode 100644 index 0000000..9ccf412 --- /dev/null +++ b/0189-grub_dl_load_segments-page-align-the-tramp-GOT-areas.patch @@ -0,0 +1,70 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Fri, 7 Apr 2023 16:56:09 +0200 +Subject: [PATCH] grub_dl_load_segments(): page-align the tramp/GOT areas too + +The tramp/GOT write-protection in grub_dl_set_mem_attrs() requires that +the tramp/GOT areas of the module image *not* share a page with any other +memory allocations. Page-align the tramp/GOT areas, while satisfying their +intrinsic alignment requirements too. + +Fixes: 887f1d8fa976 (modules: load module sections at page-aligned addresses) +Fixes: ad1b904d325b (nx: set page permissions for loaded modules.) +Signed-off-by: Laszlo Ersek +--- + grub-core/kern/dl.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index bad0ad4b945..c55f0ecf931 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -272,7 +272,9 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + #if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) && \ + !defined (__loongarch__) + grub_size_t tramp; ++ grub_size_t tramp_align; + grub_size_t got; ++ grub_size_t got_align; + grub_err_t err; + #endif + char *ptr; +@@ -304,12 +306,18 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + err = grub_arch_dl_get_tramp_got_size (e, &tramp, &got); + if (err) + return err; +- tsize += ALIGN_UP (tramp, GRUB_ARCH_DL_TRAMP_ALIGN); +- if (talign < GRUB_ARCH_DL_TRAMP_ALIGN) +- talign = GRUB_ARCH_DL_TRAMP_ALIGN; +- tsize += ALIGN_UP (got, GRUB_ARCH_DL_GOT_ALIGN); +- if (talign < GRUB_ARCH_DL_GOT_ALIGN) +- talign = GRUB_ARCH_DL_GOT_ALIGN; ++ tramp_align = GRUB_ARCH_DL_TRAMP_ALIGN; ++ if (tramp_align < arch_addralign) ++ tramp_align = arch_addralign; ++ tsize += ALIGN_UP (tramp, tramp_align); ++ if (talign < tramp_align) ++ talign = tramp_align; ++ got_align = GRUB_ARCH_DL_GOT_ALIGN; ++ if (got_align < arch_addralign) ++ got_align = arch_addralign; ++ tsize += ALIGN_UP (got, got_align); ++ if (talign < got_align) ++ talign = got_align; + #endif + + #ifdef GRUB_MACHINE_EMU +@@ -370,11 +378,11 @@ grub_dl_load_segments (grub_dl_t mod, const Elf_Ehdr *e) + } + #if !defined (__i386__) && !defined (__x86_64__) && !defined(__riscv) && \ + !defined (__loongarch__) +- ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, GRUB_ARCH_DL_TRAMP_ALIGN); ++ ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, tramp_align); + mod->tramp = ptr; + mod->trampptr = ptr; + ptr += tramp; +- ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, GRUB_ARCH_DL_GOT_ALIGN); ++ ptr = (char *) ALIGN_UP ((grub_addr_t) ptr, got_align); + mod->got = ptr; + mod->gotptr = ptr; + ptr += got; diff --git a/0190-emu-Add-switch-root-to-grub-emu.patch b/0190-emu-Add-switch-root-to-grub-emu.patch new file mode 100644 index 0000000..3fabaae --- /dev/null +++ b/0190-emu-Add-switch-root-to-grub-emu.patch @@ -0,0 +1,330 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Fri, 31 Mar 2023 20:47:58 +0200 +Subject: [PATCH] emu: Add switch-root to grub-emu + +If the kernel running grub emu is the same as the one we want to +boot, it makes sense that we just switch-root instead of kexec +the same kernel again by doing grub2-emu --switch-root + +Signed-off-by: Nicolas Frayer +--- + grub-core/kern/emu/main.c | 5 +- + grub-core/kern/emu/misc.c | 13 +++ + grub-core/loader/emu/linux.c | 209 +++++++++++++++++++++++++++++++++++++++++-- + include/grub/emu/exec.h | 2 +- + include/grub/emu/misc.h | 2 + + 5 files changed, 223 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/emu/main.c b/grub-core/kern/emu/main.c +index 38c1576a2ef..61b3181775b 100644 +--- a/grub-core/kern/emu/main.c ++++ b/grub-core/kern/emu/main.c +@@ -108,6 +108,7 @@ static struct argp_option options[] = { + {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, + {"hold", 'H', N_("SECS"), OPTION_ARG_OPTIONAL, N_("wait until a debugger will attach"), 0}, + {"kexec", 'X', 0, 0, N_("use kexec to boot Linux kernels via systemctl (pass twice to enable dangerous fallback to non-systemctl)."), 0}, ++ {"switch-root", 'W', 0, 0, N_("use switch-root to only switch root filesystem without restarting the kernel."), 0}, + { 0, 0, 0, 0, 0, 0 } + }; + +@@ -168,7 +169,9 @@ argp_parser (int key, char *arg, struct argp_state *state) + case 'X': + grub_util_set_kexecute (); + break; +- ++ case 'W': ++ grub_util_set_switch_root (); ++ break; + case ARGP_KEY_ARG: + { + /* Too many arguments. */ +diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c +index d145e5796b3..7b9731b7efa 100644 +--- a/grub-core/kern/emu/misc.c ++++ b/grub-core/kern/emu/misc.c +@@ -40,6 +40,7 @@ + + int verbosity; + int kexecute; ++int switchroot = 0; + + void + grub_util_warn (const char *fmt, ...) +@@ -231,3 +232,15 @@ grub_util_get_kexecute (void) + { + return kexecute; + } ++ ++void ++grub_util_set_switch_root (void) ++{ ++ switchroot = 1; ++} ++ ++int ++grub_util_get_switch_root (void) ++{ ++ return switchroot; ++} +diff --git a/grub-core/loader/emu/linux.c b/grub-core/loader/emu/linux.c +index 7de3f7f8610..6feb0412c58 100644 +--- a/grub-core/loader/emu/linux.c ++++ b/grub-core/loader/emu/linux.c +@@ -15,7 +15,6 @@ + * You should have received a copy of the GNU General Public License + * along with GRUB. If not, see . + */ +- + #include + #include + #include +@@ -33,6 +32,196 @@ static char *kernel_path; + static char *initrd_path; + static char *boot_cmdline; + ++static grub_err_t ++grub_switch_root (void) ++{ ++ char *tmp = NULL; ++ char *options_cmd = NULL; ++ char *options = NULL; ++ char *subvol = NULL; ++ char *root_uuid = NULL; ++ char *kernel_release = NULL; ++ grub_err_t rc = GRUB_ERR_NONE; ++ const char *subvol_param = "subvol="; ++ const char *kernel_release_prefix = "/boot/vmlinuz-"; ++ const char *root_prefix = "root="; ++ const char *systemctl[] = {"systemctl", "--force", "switch-root", "/sysroot", NULL}; ++ const char *mountrootfs[] = {"mount", root_uuid, "/sysroot", options_cmd, options, NULL}; ++ const char *unamer[] = {"uname", "-r", NULL}; ++ char *uname_buf = NULL; ++ int i = 0; ++ ++ /* Extract the kernel release tag from kernel_path */ ++ if (!kernel_path) ++ { ++ rc = GRUB_ERR_BAD_ARGUMENT; ++ grub_dprintf ("linux", "switch_root: No kernel_path found\n"); ++ goto out; ++ } ++ ++ if ((kernel_release = grub_xasprintf ("%s", (kernel_path + grub_strlen (kernel_release_prefix)))) == NULL) ++ { ++ grub_dprintf ("linux", "switch_root: Failed to allocate memory\n"); ++ rc = GRUB_ERR_BAD_ARGUMENT; ++ goto out; ++ } ++ ++ ++ /* Check for kernel mismatch */ ++ /* Retrieve the current kernel relase tag */ ++ grub_util_exec_redirect (unamer, NULL, "/tmp/version"); ++ ++ grub_file_t f = grub_file_open ("/tmp/version", GRUB_FILE_TYPE_FS_SEARCH); ++ ++ if (f == NULL) ++ { ++ grub_dprintf ("linux", "failed opening file.\n"); ++ rc = GRUB_ERR_FILE_NOT_FOUND; ++ goto out; ++ } ++ ++ if ((uname_buf = grub_malloc (f->size)) == NULL) ++ { ++ grub_dprintf ("linux", "switch_root: Failed to allocate memory\n"); ++ rc = GRUB_ERR_OUT_OF_MEMORY; ++ goto out; ++ } ++ ++ if (grub_file_read (f, uname_buf, f->size) < 0) ++ { ++ grub_dprintf ("linux", "switch_root: failed to read from file\n"); ++ rc = GRUB_ERR_FILE_READ_ERROR; ++ goto out; ++ } ++ ++ grub_file_close (f); ++ ++ if (grub_strstr (uname_buf, kernel_release) == NULL) ++ { ++ grub_dprintf ("linux", "switch_root: kernel mismatch, not performing switch-root ...\n"); ++ rc = GRUB_ERR_NO_KERNEL; ++ goto out; ++ } ++ ++ /* Extract the root partition from boot_cmdline */ ++ if (!boot_cmdline) ++ { ++ rc = GRUB_ERR_BAD_ARGUMENT; ++ goto out; ++ } ++ ++ tmp = grub_strdup (boot_cmdline); ++ ++ if (tmp == NULL) ++ { ++ rc = GRUB_ERR_OUT_OF_MEMORY; ++ goto out; ++ } ++ ++ if ((root_uuid = grub_strstr (tmp, root_prefix)) == NULL) ++ { ++ rc = GRUB_ERR_BAD_ARGUMENT; ++ grub_dprintf ("linux", "switch_root: Can't find rootfs\n"); ++ goto out; ++ } ++ ++ root_uuid += grub_strlen (root_prefix); ++ ++ while (root_uuid[i] != ' ' && root_uuid[i] != '\0') ++ i++; ++ ++ root_uuid[i] = '\0'; ++ ++ /* Allocate a new buffer holding root_uuid */ ++ root_uuid = grub_xasprintf ("%s", root_uuid); ++ ++ if (root_uuid == NULL) ++ { ++ grub_dprintf ("linux", "switch_root: Failed to allocated memory\n"); ++ rc = GRUB_ERR_OUT_OF_MEMORY; ++ goto out; ++ } ++ ++ /* Check for subvol parameter */ ++ grub_strcpy (tmp, boot_cmdline); ++ ++ if ((subvol = grub_strstr(tmp, subvol_param)) != NULL) ++ { ++ i = 0; ++ ++ while (subvol[i] != ' ' && subvol[i] != '\0') ++ i++; ++ ++ subvol[i] = '\0'; ++ ++ /* Allocate a new buffer holding subvol */ ++ subvol = grub_xasprintf("%s", subvol); ++ ++ if (subvol == NULL) ++ { ++ grub_dprintf ("linux", "switch_root: Failed to allocated memory\n"); ++ rc = GRUB_ERR_OUT_OF_MEMORY; ++ goto out; ++ } ++ ++ options_cmd = grub_xasprintf("%s", "-o"); ++ options = grub_xasprintf("%s", subvol); ++ } ++ ++ if (options == NULL) ++ { ++ mountrootfs[3] = NULL; ++ } ++ else ++ { ++ mountrootfs[3] = options_cmd; ++ mountrootfs[4] = options; ++ } ++ ++ mountrootfs[1] = root_uuid; ++ ++ grub_dprintf ("linux", "Executing:\n"); ++ grub_dprintf ("linux", "%s %s %s %s %s\n", mountrootfs[0], mountrootfs[1], ++ mountrootfs[2], mountrootfs[3], mountrootfs[4]); ++ ++ /* Mount the rootfs */ ++ rc = grub_util_exec (mountrootfs); ++ ++ if (rc != GRUB_ERR_NONE) ++ { ++ grub_dprintf ("linux", "switch_root: Failed.\n"); ++ rc = GRUB_ERR_INVALID_COMMAND; ++ goto out; ++ } ++ ++ grub_dprintf ("linux", "Done.\n"); ++ ++ grub_dprintf ("linux", "%s %s %s %s\n", systemctl[0], systemctl[1], ++ systemctl[2], systemctl[3]); ++ ++ /* Switch root */ ++ rc = grub_util_exec (systemctl); ++ ++ if (rc != GRUB_ERR_NONE) ++ { ++ grub_dprintf ("linux", "switch_root: Failed.\n"); ++ rc = GRUB_ERR_INVALID_COMMAND; ++ goto out; ++ } ++ ++ grub_dprintf ("linux", "Done.\n"); ++ ++out: ++ grub_free (tmp); ++ grub_free (options_cmd); ++ grub_free (options); ++ grub_free (subvol); ++ grub_free (root_uuid); ++ grub_free (uname_buf); ++ grub_free (kernel_release); ++ return rc; ++} ++ + static grub_err_t + grub_linux_boot (void) + { +@@ -51,12 +240,20 @@ grub_linux_boot (void) + else + initrd_param = grub_xasprintf ("%s", ""); + +- grub_dprintf ("linux", "%serforming 'kexec -la %s %s %s'\n", +- (kexecute) ? "P" : "Not p", +- kernel_path, initrd_param, boot_cmdline); ++ if (grub_util_get_switch_root() == 1) ++ { ++ rc = grub_switch_root(); ++ if (rc != GRUB_ERR_NONE) ++ grub_fatal (N_("Failed to execute switch_root\n")); ++ } ++ else if (kexecute) ++ { ++ grub_dprintf ("linux", "%serforming 'kexec -la %s %s %s'\n", ++ (kexecute) ? "P" : "Not p", ++ kernel_path, initrd_param, boot_cmdline); + +- if (kexecute) +- rc = grub_util_exec (kexec); ++ rc = grub_util_exec (kexec); ++ } + + grub_free (initrd_param); + +diff --git a/include/grub/emu/exec.h b/include/grub/emu/exec.h +index 1b61b4a2e5d..e82f13215e0 100644 +--- a/include/grub/emu/exec.h ++++ b/include/grub/emu/exec.h +@@ -36,7 +36,7 @@ grub_util_exec_redirect_all (const char *const *argv, const char *stdin_file, + int + EXPORT_FUNC(grub_util_exec) (const char *const *argv); + int +-grub_util_exec_redirect (const char *const *argv, const char *stdin_file, ++EXPORT_FUNC(grub_util_exec_redirect) (const char *const *argv, const char *stdin_file, + const char *stdout_file); + int + grub_util_exec_redirect_null (const char *const *argv); +diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h +index 01056954b96..f3a712a8b2f 100644 +--- a/include/grub/emu/misc.h ++++ b/include/grub/emu/misc.h +@@ -59,6 +59,8 @@ void EXPORT_FUNC(grub_util_error) (const char *fmt, ...) __attribute__ ((format + + void EXPORT_FUNC(grub_util_set_kexecute) (void); + int EXPORT_FUNC(grub_util_get_kexecute) (void) WARN_UNUSED_RESULT; ++void EXPORT_FUNC(grub_util_set_switch_root) (void); ++int EXPORT_FUNC(grub_util_get_switch_root) (void); + + grub_uint64_t EXPORT_FUNC (grub_util_get_cpu_time_ms) (void); + diff --git a/0190-remove-the-items-of-unsupported-filesystems-in-fs.ls.patch b/0190-remove-the-items-of-unsupported-filesystems-in-fs.ls.patch deleted file mode 100644 index 55499a7..0000000 --- a/0190-remove-the-items-of-unsupported-filesystems-in-fs.ls.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9b98d69b2817c47a1d68aec4b0f913a55279f15c Mon Sep 17 00:00:00 2001 -From: Qiumiao Zhang -Date: Wed, 5 Jul 2023 16:53:49 +0800 -Subject: [PATCH 190/272] remove the items of unsupported filesystems in fs.lst - ---- - grub-core/Makefile.am | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am -index af21fc72d..b52444517 100644 ---- a/grub-core/Makefile.am -+++ b/grub-core/Makefile.am -@@ -378,10 +378,13 @@ endif - # List files - - fs.lst: $(MARKER_FILES) -+ DISABLE_FS=(affs.marker afs.marker bfs.marker jfs.marker minix.marker minix2.marker minix3.marker minix_be.marker minix2_be.marker minix3_be.marker nilfs2.marker reiserfs.marker romfs.marker sfs.marker ufs1.marker ufs2.marker ufs1_be.marker); \ - (for pp in $^; do \ - b=`basename $$pp .marker`; \ - if grep 'FS_LIST_MARKER' $$pp >/dev/null 2>&1; then \ -- echo $$b; \ -+ if [[ ! "$${DISABLE_FS[@]}" =~ $$b ]]; then \ -+ echo $$b; \ -+ fi; \ - fi; \ - done) | sort -u > $@ - platform_DATA += fs.lst --- -2.41.0 - diff --git a/0191-util-Enable-default-kernel-for-updates.patch b/0191-util-Enable-default-kernel-for-updates.patch new file mode 100644 index 0000000..5682df0 --- /dev/null +++ b/0191-util-Enable-default-kernel-for-updates.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Wed, 24 May 2023 11:22:47 +0200 +Subject: [PATCH] util: Enable default kernel for updates + +Several kernel variants can be installed on a system in parallel. +In order to allow the user to choose which kernel will be set to +default after an update, re-enable grub's usage of DEFAULTKERNEL as +set in /etc/sysconfig/kernel + +Signed-off-by: Marta Lewandowska +--- + util/grub-get-kernel-settings.in | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/util/grub-get-kernel-settings.in b/util/grub-get-kernel-settings.in +index 7e87dfccc0e..f71bc64360b 100644 +--- a/util/grub-get-kernel-settings.in ++++ b/util/grub-get-kernel-settings.in +@@ -68,6 +68,14 @@ if test -f /etc/sysconfig/kernel ; then + . /etc/sysconfig/kernel + fi + ++GRUB_DEFAULT_KERNEL_TYPE=${DEFAULTKERNEL/-core/} ++if [ "$GRUB_DEFAULT_KERNEL_TYPE" != "kernel" ]; then ++ echo GRUB_NON_STANDARD_KERNEL=true ++ echo export GRUB_NON_STANDARD_KERNEL ++ GRUB_DEFAULT_KERNEL_TYPE=${GRUB_DEFAULT_KERNEL_TYPE/kernel-/} ++fi ++echo GRUB_DEFAULT_KERNEL_TYPE=$GRUB_DEFAULT_KERNEL_TYPE ++echo export GRUB_DEFAULT_KERNEL_TYPE + if [ "$MAKEDEBUG" = "yes" ]; then + echo GRUB_LINUX_MAKE_DEBUG=true + echo export GRUB_LINUX_MAKE_DEBUG diff --git a/0192-efi-http-change-uint32_t-to-uintn_t.patch b/0192-efi-http-change-uint32_t-to-uintn_t.patch new file mode 100644 index 0000000..ec22c36 --- /dev/null +++ b/0192-efi-http-change-uint32_t-to-uintn_t.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Keng-Yu Lin +Date: Wed, 26 Apr 2023 01:43:16 -0400 +Subject: [PATCH] efi/http: change uint32_t to uintn_t + +Modify UINT32 to UINTN in EFI_HTTP_MESSAGE to +be UEFI 2.9 compliant. + +Signed-off-by: Keng-Yu Lin +Signed-off-by: Nicolas Frayer +--- + include/grub/efi/http.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/grub/efi/http.h b/include/grub/efi/http.h +index c5e9a89f505..ad164ba1913 100644 +--- a/include/grub/efi/http.h ++++ b/include/grub/efi/http.h +@@ -171,9 +171,9 @@ typedef struct { + grub_efi_http_request_data_t *request; + grub_efi_http_response_data_t *response; + } data; +- grub_efi_uint32_t header_count; ++ grub_efi_uintn_t header_count; + grub_efi_http_header_t *headers; +- grub_efi_uint32_t body_length; ++ grub_efi_uintn_t body_length; + void *body; + } grub_efi_http_message_t; + diff --git a/0193-Add-Install-section-to-aux-systemd-units.patch b/0193-Add-Install-section-to-aux-systemd-units.patch new file mode 100644 index 0000000..6981225 --- /dev/null +++ b/0193-Add-Install-section-to-aux-systemd-units.patch @@ -0,0 +1,52 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Christian Glombek +Date: Wed, 9 Aug 2023 18:11:25 +0200 +Subject: [PATCH] Add [Install] section to aux systemd units + +Currently in Fedora, these services are statically enabled by symlinks, +with no other way to disable them than to manually delete those symlinks. +This is problematic in Fedora IoT, where grub-boot-success.timer is +not supposed to be enabled. + +This change adds `[Install]` sections to all systemd units that are +currently enabled statically, so that they can be enabled dynamically +via presets or manually instead. +--- + docs/grub-boot-indeterminate.service | 3 +++ + docs/grub-boot-success.timer | 3 +++ + util/systemd/grub-systemd-integration.service.in | 3 +++ + 3 files changed, 9 insertions(+) + +diff --git a/docs/grub-boot-indeterminate.service b/docs/grub-boot-indeterminate.service +index 6c8dcb186b6..5bcb474a3d3 100644 +--- a/docs/grub-boot-indeterminate.service ++++ b/docs/grub-boot-indeterminate.service +@@ -9,3 +9,6 @@ Before=system-update-pre.target + [Service] + Type=oneshot + ExecStart=/usr/bin/grub2-editenv - incr boot_indeterminate ++ ++[Install] ++WantedBy=system-update.target +diff --git a/docs/grub-boot-success.timer b/docs/grub-boot-success.timer +index 406f1720056..1d124cccc14 100644 +--- a/docs/grub-boot-success.timer ++++ b/docs/grub-boot-success.timer +@@ -5,3 +5,6 @@ ConditionVirtualization=!container + + [Timer] + OnActiveSec=2min ++ ++[Install] ++WantedBy=timers.target +diff --git a/util/systemd/grub-systemd-integration.service.in b/util/systemd/grub-systemd-integration.service.in +index c81fb594ce1..22ca1ca4885 100644 +--- a/util/systemd/grub-systemd-integration.service.in ++++ b/util/systemd/grub-systemd-integration.service.in +@@ -6,3 +6,6 @@ ConditionPathExists=/run/systemd/reboot-to-boot-loader-menu + + [Service] + ExecStart=@libexecdir@/@grubdirname@/systemd-integration.sh ++ ++[Install] ++WantedBy=reboot.target diff --git a/0194-Fix-missing-include-in-ofdisk.c.patch b/0194-Fix-missing-include-in-ofdisk.c.patch new file mode 100644 index 0000000..a2b9047 --- /dev/null +++ b/0194-Fix-missing-include-in-ofdisk.c.patch @@ -0,0 +1,28 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 29 Sep 2023 10:56:11 -0400 +Subject: [PATCH] Fix missing #include in ofdisk.c + +Recently we started building with -Werror=implicit-function-declaration, +and discovered that ofdisk.c is missing an include to declare +grub_env_get(). + +This patch adds that #include. + +Signed-off-by: Peter Jones +--- + grub-core/disk/ieee1275/ofdisk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index b413822bb87..57624fde55c 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + static char *last_devpath; + static grub_ieee1275_ihandle_t last_ihandle; diff --git a/0195-add-bls-for-grub2-btrfs-05-grub2-mkconfig.patch b/0195-add-bls-for-grub2-btrfs-05-grub2-mkconfig.patch deleted file mode 100644 index 97a6b9e..0000000 --- a/0195-add-bls-for-grub2-btrfs-05-grub2-mkconfig.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 78ce7933952e5ed7421ab23e5474968a3895621e Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Tue, 2 Apr 2024 16:32:48 +0800 -Subject: [PATCH 195/272] add bls for grub2-btrfs-05-grub2-mkconfig - -Signed-off-by: nilusyi ---- - util/grub.d/00_header.in | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 2eeee1c62..9320c1f70 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -405,6 +405,7 @@ if [ "x${GRUB_BADRAM}" != "x" ] ; then - fi - - if [ "x${SUSE_BTRFS_SNAPSHOT_BOOTING}" = "xtrue" ] && -+ [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ] && - [ "x${GRUB_FS}" = "xbtrfs" ] ; then - # Note: No $snapshot_num on *read-only* rollback! (bsc#901487) - cat < -Date: Sat, 1 Mar 2025 14:16:48 +0300 -Subject: [PATCH] commands/search: Introduce the --cryptodisk-only argument - -This allows users to restrict the "search" command's scope to -encrypted disks only. - -Typically, this command is used to "rebase" $root and $prefix -before loading additional configuration files via "source" or -"configfile". Unfortunately, this leads to security problems, -like CVE-2023-4001, when an unexpected, attacker-controlled -device is chosen by the "search" command. - -The --cryptodisk-only argument allows users to ensure that the -file system picked is encrypted. - -This feature supports the CLI authentication, blocking bypass -attempts. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper +From: Marta Lewandowska +Date: Mon, 9 Oct 2023 08:53:18 +0200 +Subject: [PATCH] add flag to only search root dev + +fixes bz#2223437 + +Signed-off-by: Marta Lewandowska --- - grub-core/commands/search.c | 21 +++++++++++++++++++++ - grub-core/commands/search_wrap.c | 8 +++++++- - grub-core/normal/main.c | 3 ++- + grub-core/commands/search.c | 36 ++++++++++++++++++++++++++++++++++++ + grub-core/commands/search_wrap.c | 5 +++++ + grub-core/kern/misc.c | 30 ++++++++++++++++++++++++++++++ + include/grub/misc.h | 1 + include/grub/search.h | 3 ++- - 4 files changed, 32 insertions(+), 3 deletions(-) + 5 files changed, 74 insertions(+), 1 deletion(-) diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index 263f150..660f06b 100644 +index 263f1501cdf..db8692ffbfb 100644 --- a/grub-core/commands/search.c +++ b/grub-core/commands/search.c -@@ -86,6 +86,27 @@ iterate_device (const char *name, void *data) +@@ -86,6 +86,42 @@ iterate_device (const char *name, void *data) grub_device_close (dev); } -+ /* Limit to encrypted disks when requested. */ -+ if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY) ++ /* Skip it if it's not the root device when requested. */ ++ if (ctx->flags & SEARCH_FLAGS_ROOTDEV_ONLY) + { -+ grub_device_t dev; ++ const char *root_dev; ++ root_dev = grub_env_get ("root"); ++ if (root_dev != NULL && *root_dev != '\0') ++ { ++ char *root_disk = grub_malloc (grub_strlen(root_dev) + 1); ++ char *name_disk = grub_malloc (grub_strlen(name) + 1); ++ char *rem_1 = grub_malloc(grub_strlen(root_dev) + 1); ++ char *rem_2 = grub_malloc(grub_strlen(name) + 1); + -+ dev = grub_device_open (name); -+ if (dev == NULL) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ return 0; -+ } -+ if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ grub_device_close (dev); -+ grub_errno = GRUB_ERR_NONE; -+ return 0; -+ } -+ grub_device_close (dev); ++ if (root_disk != NULL && name_disk != NULL && ++ rem_1 != NULL && rem_2 != NULL) ++ { ++ /* get just the disk name; partitions will be different. */ ++ grub_str_sep (root_dev, root_disk, ',', rem_1); ++ grub_str_sep (name, name_disk, ',', rem_2); ++ if (root_disk != NULL && *root_disk != '\0' && ++ name_disk != NULL && *name_disk != '\0') ++ if (grub_strcmp(root_disk, name_disk) != 0) ++ { ++ grub_free (root_disk); ++ grub_free (name_disk); ++ grub_free (rem_1); ++ grub_free (rem_2); ++ return 0; ++ } ++ } ++ grub_free (root_disk); ++ grub_free (name_disk); ++ grub_free (rem_1); ++ grub_free (rem_2); ++ } + } -+ + #ifdef DO_SEARCH_FS_UUID #define compare_fn grub_strcasecmp #else diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c -index 318581f..2c6bc25 100644 +index 318581f3b1e..4fe6440c65b 100644 --- a/grub-core/commands/search_wrap.c +++ b/grub-core/commands/search_wrap.c @@ -41,6 +41,7 @@ static const struct grub_arg_option options[] = ARG_TYPE_STRING}, {"no-floppy", 'n', 0, N_("Do not probe any floppy drive."), 0, 0}, {"efidisk-only", 0, 0, N_("Only probe EFI disks."), 0, 0}, -+ {"cryptodisk-only", 0, 0, N_("Only probe encrypted disks."), 0, 0}, ++ {"root-dev-only", 'r', 0, N_("Only probe root device."), 0, 0}, {"hint", 'h', GRUB_ARG_OPTION_REPEATABLE, N_("First try the device HINT. If HINT ends in comma, " "also try subpartitions"), N_("HINT"), ARG_TYPE_STRING}, @@ -75,46 +77,75 @@ index 318581f..2c6bc25 100644 SEARCH_SET, SEARCH_NO_FLOPPY, SEARCH_EFIDISK_ONLY, -+ SEARCH_CRYPTODISK_ONLY, ++ SEARCH_ROOTDEV_ONLY, SEARCH_HINT, SEARCH_HINT_IEEE1275, SEARCH_HINT_BIOS, -@@ -189,6 +191,10 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args) +@@ -189,6 +191,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args) if (state[SEARCH_EFIDISK_ONLY].set) flags |= SEARCH_FLAGS_EFIDISK_ONLY; -+ if (state[SEARCH_CRYPTODISK_ONLY].set) -+ flags |= SEARCH_FLAGS_CRYPTODISK_ONLY; -+ ++ if (state[SEARCH_ROOTDEV_ONLY].set) ++ flags |= SEARCH_FLAGS_ROOTDEV_ONLY; + if (state[SEARCH_LABEL].set) grub_search_label (id, var, flags, hints, nhints); else if (state[SEARCH_FS_UUID].set) -@@ -210,7 +216,7 @@ GRUB_MOD_INIT(search) - cmd = - grub_register_extcmd ("search", grub_cmd_search, - GRUB_COMMAND_FLAG_EXTRACTOR | GRUB_COMMAND_ACCEPT_DASH, -- N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]" -+ N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint HINT [--hint HINT] ...]" - " NAME"), - N_("Search devices by file, filesystem label" - " or filesystem UUID." -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 272a202..eb90579 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -609,7 +609,8 @@ static const char *features[] = { - "feature_chainloader_bpb", "feature_ntldr", "feature_platform_search_hint", - "feature_default_font_path", "feature_all_video_module", - "feature_menuentry_id", "feature_menuentry_options", "feature_200_final", -- "feature_nativedisk_cmd", "feature_timeout_style" -+ "feature_nativedisk_cmd", "feature_timeout_style", -+ "feature_search_cryptodisk_only" - }; +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index f607244e7ae..96ab7c96b52 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -645,6 +645,36 @@ grub_reverse (char *str) + } + } - GRUB_MOD_INIT(normal) ++/* Separate string into two parts, broken up by delimiter delim. */ ++void ++grub_str_sep (const char *s, char *p, char delim, char *r) ++{ ++ char* t = grub_strndup(s, grub_strlen(s)); ++ ++ if (t != NULL && *t != '\0') ++ { ++ char* tmp = t; ++ ++ while (((*p = *t) != '\0') && ((*p = *t) != delim)) ++ { ++ p++; ++ t++; ++ } ++ *p = '\0'; ++ ++ if (*t != '\0') ++ { ++ t++; ++ while ((*r++ = *t++) != '\0') ++ ; ++ *r = '\0'; ++ } ++ grub_free (tmp); ++ } ++ else ++ grub_free (t); ++} ++ + /* Divide N by D, return the quotient, and store the remainder in *R. */ + grub_uint64_t + grub_divmod64 (grub_uint64_t n, grub_uint64_t d, grub_uint64_t *r) +diff --git a/include/grub/misc.h b/include/grub/misc.h +index c3c735371dc..3e9a00f0a9c 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -343,6 +343,7 @@ char *EXPORT_FUNC(grub_strdup) (const char *s) WARN_UNUSED_RESULT; + char *EXPORT_FUNC(grub_strndup) (const char *s, grub_size_t n) WARN_UNUSED_RESULT; + void *EXPORT_FUNC(grub_memset) (void *s, int c, grub_size_t n); + grub_size_t EXPORT_FUNC(grub_strlen) (const char *s) WARN_UNUSED_RESULT; ++void EXPORT_FUNC(grub_str_sep) (const char *s, char *p, char delim, char *r); + + /* Replace all `ch' characters of `input' with `with' and copy the + result into `output'; return EOS address of `output'. */ diff --git a/include/grub/search.h b/include/grub/search.h -index ffd2411..87efeec 100644 +index ffd2411ca1a..9343c66b134 100644 --- a/include/grub/search.h +++ b/include/grub/search.h @@ -23,7 +23,8 @@ enum search_flags @@ -123,10 +154,7 @@ index ffd2411..87efeec 100644 SEARCH_FLAGS_NO_FLOPPY = 1, - SEARCH_FLAGS_EFIDISK_ONLY = 2 + SEARCH_FLAGS_EFIDISK_ONLY = 2, -+ SEARCH_FLAGS_CRYPTODISK_ONLY = 4 ++ SEARCH_FLAGS_ROOTDEV_ONLY = 4 }; void grub_search_fs_file (const char *key, const char *var, --- -2.41.1 - diff --git a/0196-cryptdisk-fix-incorrect-sign-comparison.patch b/0196-cryptdisk-fix-incorrect-sign-comparison.patch new file mode 100644 index 0000000..dbb4fc2 --- /dev/null +++ b/0196-cryptdisk-fix-incorrect-sign-comparison.patch @@ -0,0 +1,28 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 15:44:27 -0500 +Subject: [PATCH] cryptdisk: fix incorrect sign comparison + +grub_util_get_fd_size() returns a signed integer, but we're assigning it +to an unsigned integer and then testing against -1. That's wrong. + +This patch makes the variable a signed integer. + +Signed-off-by: Peter Jones +--- + grub-core/disk/cryptodisk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 2246af51b6a..98e176a139c 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -721,7 +721,7 @@ grub_cryptodisk_open (const char *name, grub_disk_t disk) + #ifdef GRUB_UTIL + if (dev->cheat) + { +- grub_uint64_t cheat_dev_size; ++ grub_int64_t cheat_dev_size; + unsigned int cheat_log_sector_size; + + if (!GRUB_UTIL_FD_IS_VALID (dev->cheat_fd)) diff --git a/0197-grub-install-fix-a-sign-comparison-error.patch b/0197-grub-install-fix-a-sign-comparison-error.patch new file mode 100644 index 0000000..7b63b08 --- /dev/null +++ b/0197-grub-install-fix-a-sign-comparison-error.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 15:45:57 -0500 +Subject: [PATCH] grub-install: fix a sign comparison error + +This is a trivial sign comparison fix. + +Signed-off-by: Peter Jones +--- + util/grub-install-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub-install-common.c b/util/grub-install-common.c +index b58539111da..67afc2eedf4 100644 +--- a/util/grub-install-common.c ++++ b/util/grub-install-common.c +@@ -368,7 +368,7 @@ char *grub_install_themes_directory = NULL; + int + grub_install_is_short_mbrgap_supported (void) + { +- int i, j; ++ unsigned int i, j; + static const char *whitelist[] = + { + "part_msdos", "biosdisk", "affs", "afs", "bfs", "archelp", diff --git a/0198-grub-mount-work-around-bad-integer-comparison.patch b/0198-grub-mount-work-around-bad-integer-comparison.patch new file mode 100644 index 0000000..d303801 --- /dev/null +++ b/0198-grub-mount-work-around-bad-integer-comparison.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 15:54:31 -0500 +Subject: [PATCH] grub-mount: work around bad integer comparison. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +gcc says: + + util/grub-mount.c: In function ‘fuse_read’: + util/grub-mount.c:273:11: error: comparison of integer expressions of different signedness: ‘off_t’ {aka ‘long int’} and ‘grub_off_t’ {aka ‘long unsigned int’} [-Werror=sign-compare] + 273 | if (off > file->size) + | ^ + +This is happening because grub_off_t is unsigned but the system's off_t is +signed. + +That's too much work to fix today, so this patch works around it with +tests and typecasting. + +Signed-off-by: Peter Jones +--- + util/grub-mount.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/util/grub-mount.c b/util/grub-mount.c +index bf4c8b891be..d369e21666e 100644 +--- a/util/grub-mount.c ++++ b/util/grub-mount.c +@@ -269,11 +269,17 @@ fuse_read (const char *path, char *buf, size_t sz, off_t off, + { + grub_file_t file = files[fi->fh]; + grub_ssize_t size; ++ grub_off_t offset; + +- if (off > file->size) ++ if (off < 0) + return -EINVAL; + +- file->offset = off; ++ if ((grub_off_t)off > file->size) ++ return -EINVAL; ++ ++ offset = (grub_off_t)off; ++ ++ file->offset = offset; + + size = grub_file_read (file, buf, sz); + if (size < 0) diff --git a/0199-power-Fix-use-after-free-in-get_slave_from_dm.patch b/0199-power-Fix-use-after-free-in-get_slave_from_dm.patch new file mode 100644 index 0000000..b4520e7 --- /dev/null +++ b/0199-power-Fix-use-after-free-in-get_slave_from_dm.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 16:03:54 -0500 +Subject: [PATCH] power: Fix use after free in get_slave_from_dm() + +Signed-off-by: Peter Jones +--- + grub-core/osdep/linux/ofpath.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/osdep/linux/ofpath.c b/grub-core/osdep/linux/ofpath.c +index cc849d9c94c..72772c87a66 100644 +--- a/grub-core/osdep/linux/ofpath.c ++++ b/grub-core/osdep/linux/ofpath.c +@@ -775,6 +775,8 @@ get_slave_from_dm(const char * device){ + + device_path = grub_xasprintf ("/sys/block/%s/slaves", curr_device); + dp = opendir(device_path); ++ if (dp == NULL) ++ grub_util_warn (_("cannot open directory `%s'"), device_path); + free(device_path); + + if (dp != NULL) +@@ -800,8 +802,6 @@ get_slave_from_dm(const char * device){ + } + closedir (dp); + } +- else +- grub_util_warn (_("cannot open directory `%s'"), device_path); + } + + free (directory); diff --git a/0200-Fix-some-sign-comparison-errors.patch b/0200-Fix-some-sign-comparison-errors.patch new file mode 100644 index 0000000..a3e5b25 --- /dev/null +++ b/0200-Fix-some-sign-comparison-errors.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 19:08:33 -0500 +Subject: [PATCH] Fix some sign comparison errors + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/pc/truecrypt.c | 2 +- + grub-core/loader/multiboot_elfxx.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/i386/pc/truecrypt.c b/grub-core/loader/i386/pc/truecrypt.c +index bae1ad031b3..7bf801603f4 100644 +--- a/grub-core/loader/i386/pc/truecrypt.c ++++ b/grub-core/loader/i386/pc/truecrypt.c +@@ -176,7 +176,7 @@ grub_cmd_truecrypt (grub_command_t cmd __attribute__ ((unused)), + + edx = (dh << 8) | grub_get_root_biosnumber (); + +- destaddr = ALIGN_DOWN (grub_min (0x90000, grub_mmap_get_lower ()) ++ destaddr = ALIGN_DOWN (grub_min (0x90000ull, grub_mmap_get_lower ()) + - truecryptmemsize, 64 * 1024); + + { +diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c +index 8d370b0b3f5..24480df5053 100644 +--- a/grub-core/loader/multiboot_elfxx.c ++++ b/grub-core/loader/multiboot_elfxx.c +@@ -99,7 +99,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld) + return err; + + /* FIXME: Should we support program headers at strange locations? */ +- phlimit = grub_min (MULTIBOOT_SEARCH, grub_file_size (mld->file)); ++ phlimit = grub_min ((grub_off_t)MULTIBOOT_SEARCH, grub_file_size (mld->file)); + if ((grub_off_t) ehdr->e_phoff + phnum * ehdr->e_phentsize > phlimit) + return grub_error (GRUB_ERR_BAD_OS, "program header at a too high offset"); + diff --git a/0201-normal-Fix-a-discarded-const.patch b/0201-normal-Fix-a-discarded-const.patch new file mode 100644 index 0000000..57598db --- /dev/null +++ b/0201-normal-Fix-a-discarded-const.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 19:12:15 -0500 +Subject: [PATCH] normal: Fix a discarded const. + +Signed-off-by: Peter Jones +--- + grub-core/normal/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index e903f291732..803b9656d36 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -406,7 +406,7 @@ grub_try_normal_dev (const char *name, void *data) + static grub_err_t + grub_try_normal_discover (void) + { +- char *prefix = grub_env_get ("prefix"); ++ const char *prefix = grub_env_get ("prefix"); + grub_err_t err = GRUB_ERR_FILE_NOT_FOUND; + + if (!prefix) diff --git a/0202-at_keyboard-mark-grub_keyboard_controller_write-unus.patch b/0202-at_keyboard-mark-grub_keyboard_controller_write-unus.patch new file mode 100644 index 0000000..058340d --- /dev/null +++ b/0202-at_keyboard-mark-grub_keyboard_controller_write-unus.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 8 Jan 2024 19:14:06 -0500 +Subject: [PATCH] at_keyboard: mark grub_keyboard_controller_write unused + +It's used sometimes and not others by #ifdef, so mark it unused so the +compiler doesn't complain. + +Signed-off-by: Peter Jones +--- + grub-core/term/at_keyboard.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/term/at_keyboard.c b/grub-core/term/at_keyboard.c +index e667d0a862c..d2b716b5b4f 100644 +--- a/grub-core/term/at_keyboard.c ++++ b/grub-core/term/at_keyboard.c +@@ -93,7 +93,7 @@ at_command (grub_uint8_t data) + return (i != GRUB_AT_TRIES); + } + +-static void ++static void __attribute__((__unused__)) + grub_keyboard_controller_write (grub_uint8_t c) + { + at_command (KEYBOARD_COMMAND_WRITE); +@@ -170,7 +170,7 @@ query_mode (void) + grub_uint64_t endtime; + unsigned i; + int e; +- char *envvar; ++ const char *envvar; + + for (i = 0; i < GRUB_AT_TRIES; i++) { + grub_dprintf ("atkeyb", "query_mode: sending command to controller\n"); diff --git a/0203-Fix-another-minor-sign-comparison-error.patch b/0203-Fix-another-minor-sign-comparison-error.patch new file mode 100644 index 0000000..24c343c --- /dev/null +++ b/0203-Fix-another-minor-sign-comparison-error.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 9 Jan 2024 14:37:25 -0500 +Subject: [PATCH] Fix another minor sign comparison error. + +Signed-off-by: Peter Jones +--- + grub-core/kern/mm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c +index 1aeeba9e27e..819bc5126a6 100644 +--- a/grub-core/kern/mm.c ++++ b/grub-core/kern/mm.c +@@ -505,7 +505,7 @@ grub_memalign (grub_size_t align, grub_size_t size) + goto fail; + + /* Preallocate some extra space if heap growth is small. */ +- grow = grub_max (grow, GRUB_MM_HEAP_GROW_EXTRA); ++ grow = grub_max (grow, (grub_size_t)GRUB_MM_HEAP_GROW_EXTRA); + + /* Align up heap growth to make it friendly to CPU/MMU. */ + if (grow > ~(grub_size_t) (GRUB_MM_HEAP_GROW_ALIGN - 1)) diff --git a/0204-Track-explicit-module-dependencies-in-Makefile.core..patch b/0204-Track-explicit-module-dependencies-in-Makefile.core..patch new file mode 100644 index 0000000..c5311c1 --- /dev/null +++ b/0204-Track-explicit-module-dependencies-in-Makefile.core..patch @@ -0,0 +1,124 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Oliver Steffen +Date: Wed, 28 Feb 2024 13:36:00 +0100 +Subject: [PATCH] Track explicit module dependencies in Makefile.core.def + +Add a new keyword, "depends", to the module definition syntax +used in Makefile.core.def. This allows specifying explicit module +dependencies together with the module definition. + +Make use of this new keyword in the bli module definition. + +Signed-off-by: Oliver Steffen +Reviewed-by: Daniel Kiper +Tested-by: Oskari Pirhonen +--- + grub-core/Makefile.core.def | 1 + + .gitignore | 1 - + conf/Makefile.common | 1 + + gentpl.py | 7 +++++++ + grub-core/Makefile.am | 9 ++++++--- + grub-core/genmoddep.awk | 2 +- + 6 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index c9dcfa00e85..a5a3ee31800 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -2670,6 +2670,7 @@ module = { + name = bli; + efi = commands/bli.c; + enable = efi; ++ depends = part_gpt; + }; + + module = { +diff --git a/.gitignore b/.gitignore +index f2e8e1e42d7..c603c15d66c 100644 +--- a/.gitignore ++++ b/.gitignore +@@ -11,7 +11,6 @@ + *.img + *.log + *.lst +-!/grub-core/extra_deps.lst + *.marker + *.mod + *.o +diff --git a/conf/Makefile.common b/conf/Makefile.common +index c8756d8146f..9feac7434da 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -115,6 +115,7 @@ MOD_FILES = + MODULE_FILES = + MARKER_FILES = + KERNEL_HEADER_FILES = ++EXTRA_DEPS = + + bin_SCRIPTS = + bin_PROGRAMS = +diff --git a/gentpl.py b/gentpl.py +index 5826a6b14e8..0f8d009ef21 100644 +--- a/gentpl.py ++++ b/gentpl.py +@@ -642,6 +642,9 @@ def platform_values(defn, platform, suffix): + def extra_dist(defn): + return foreach_value(defn, "extra_dist", lambda value: value + " ") + ++def extra_dep(defn): ++ return foreach_value(defn, "depends", lambda value: value + " ") ++ + def platform_sources(defn, p): return platform_values(defn, p, "") + def platform_nodist_sources(defn, p): return platform_values(defn, p, "_nodist") + +@@ -712,6 +715,10 @@ def module(defn, platform): + gvar_add("MOD_FILES", name + ".mod") + gvar_add("MARKER_FILES", name + ".marker") + gvar_add("CLEANFILES", name + ".marker") ++ ++ for dep in defn.find_all("depends"): ++ gvar_add("EXTRA_DEPS", "depends " + name + " " + dep + ":") ++ + output(""" + """ + name + """.marker: $(""" + cname(defn) + """_SOURCES) $(nodist_""" + cname(defn) + """_SOURCES) + $(TARGET_CPP) -DGRUB_LST_GENERATOR $(CPPFLAGS_MARKER) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(""" + cname(defn) + """_CPPFLAGS) $(CPPFLAGS) $^ > $@.new || (rm -f $@; exit 1) +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 7953ba95399..77f8329cd43 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -456,8 +456,11 @@ crypto.lst: $(srcdir)/lib/libgcrypt-grub/cipher/crypto.lst + platform_DATA += crypto.lst + CLEANFILES += crypto.lst + +-syminfo.lst: gensyminfo.sh kernel_syms.lst $(top_srcdir)/grub-core/extra_deps.lst $(MODULE_FILES) +- cat kernel_syms.lst $(top_srcdir)/grub-core/extra_deps.lst > $@.new ++extra_deps.lst: ++ @echo $(EXTRA_DEPS) | sed "s/\s*:\s*/\n/g" > $@ ++ ++syminfo.lst: gensyminfo.sh kernel_syms.lst extra_deps.lst $(MODULE_FILES) ++ cat kernel_syms.lst extra_deps.lst > $@.new + for m in $(MODULE_FILES); do \ + sh $< $$m >> $@.new || exit 1; \ + done +@@ -467,7 +470,7 @@ syminfo.lst: gensyminfo.sh kernel_syms.lst $(top_srcdir)/grub-core/extra_deps.ls + moddep.lst: syminfo.lst genmoddep.awk video.lst + cat $< | sort | $(AWK) -f $(srcdir)/genmoddep.awk > $@ || (rm -f $@; exit 1) + platform_DATA += moddep.lst +-CLEANFILES += config.log syminfo.lst moddep.lst ++CLEANFILES += config.log syminfo.lst moddep.lst extra_deps.lst + + $(MOD_FILES): %.mod : genmod.sh moddep.lst %.module$(EXEEXT) build-grub-module-verifier$(BUILD_EXEEXT) + TARGET_OBJ2ELF=@TARGET_OBJ2ELF@ sh $^ $@ +diff --git a/grub-core/genmoddep.awk b/grub-core/genmoddep.awk +index cc987a53aa8..ab457cb2b56 100644 +--- a/grub-core/genmoddep.awk ++++ b/grub-core/genmoddep.awk +@@ -35,7 +35,7 @@ BEGIN { + for (i = 3; i <= NF; i++) { + modtab[$2] = modtab[$2] " " $i; + } +- } ++ } else if ($1 == "") {} #Skip empty lines + else { + printf "error: %u: unrecognized input format\n", NR >"/dev/stderr"; + error++; diff --git a/0205-Revert-mm-Assert-that-we-preserve-header-vs-region-a.patch b/0205-Revert-mm-Assert-that-we-preserve-header-vs-region-a.patch new file mode 100644 index 0000000..1a224b3 --- /dev/null +++ b/0205-Revert-mm-Assert-that-we-preserve-header-vs-region-a.patch @@ -0,0 +1,75 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 8 Mar 2024 16:54:43 -0600 +Subject: [PATCH] Revert "mm: Assert that we preserve header vs region + alignment" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This reverts commit 1df8fe66c57087eb33bd6dc69f786ed124615aa7. + +This is temporal while we find the reason for + +In file included from ../../include/grub/mm_private.h:23, + from ../../include/grub/relocator_private.h:24, + from ../../grub-core/lib/efi/relocator.c:20: +../../include/grub/mm_private.h: In function ‘grub_mm_size_sanity_check’: +../../include/grub/misc.h:36:56: error: duplicate case value + 36 | #define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; } + | ^~~~ +../../include/grub/mm_private.h:105:3: note: in expansion of macro ‘COMPILE_TIME_ASSERT’ + 105 | COMPILE_TIME_ASSERT ((sizeof (struct grub_mm_region) % + | ^~~~~~~~~~~~~~~~~~~ +../../include/grub/misc.h:36:48: note: previously used here + 36 | #define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; } + | ^~~~ +../../include/grub/mm_private.h:105:3: note: in expansion of macro ‘COMPILE_TIME_ASSERT’ + 105 | COMPILE_TIME_ASSERT ((sizeof (struct grub_mm_region) % + | ^~~~~~~~~~~~~~~~~~~ +../../include/grub/misc.h:36:56: error: duplicate case value + 36 | #define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; } + | ^~~~ +../../include/grub/mm_private.h:112:3: note: in expansion of macro ‘COMPILE_TIME_ASSERT’ + 112 | COMPILE_TIME_ASSERT (sizeof (struct grub_mm_header) == GRUB_MM_ALIGN); + | ^~~~~~~~~~~~~~~~~~~ +../../include/grub/misc.h:36:48: note: previously used here + 36 | #define COMPILE_TIME_ASSERT(cond) switch (0) { case 1: case !(cond): ; } + | ^~~~ +../../include/grub/mm_private.h:112:3: note: in expansion of macro ‘COMPILE_TIME_ASSERT’ + 112 | COMPILE_TIME_ASSERT (sizeof (struct grub_mm_header) == GRUB_MM_ALIGN); + | ^~~~~~~~~~~~~~~~~~~ +--- + include/grub/mm_private.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/include/grub/mm_private.h b/include/grub/mm_private.h +index 96c2d816be6..2481ee1fa20 100644 +--- a/include/grub/mm_private.h ++++ b/include/grub/mm_private.h +@@ -20,7 +20,6 @@ + #define GRUB_MM_PRIVATE_H 1 + + #include +-#include + + /* For context, see kern/mm.c */ + +@@ -99,17 +98,4 @@ typedef struct grub_mm_region + extern grub_mm_region_t EXPORT_VAR (grub_mm_base); + #endif + +-static inline void +-grub_mm_size_sanity_check (void) { +- /* Ensure we preserve alignment when doing h = (grub_mm_header_t) (r + 1). */ +- COMPILE_TIME_ASSERT ((sizeof (struct grub_mm_region) % +- sizeof (struct grub_mm_header)) == 0); +- +- /* +- * GRUB_MM_ALIGN is supposed to represent cell size, and a mm_header is +- * supposed to be 1 cell. +- */ +- COMPILE_TIME_ASSERT (sizeof (struct grub_mm_header) == GRUB_MM_ALIGN); +-} +- + #endif diff --git a/0206-make-use-the-_CPU-variety-of-build-flags-for-PROGRAM.patch b/0206-make-use-the-_CPU-variety-of-build-flags-for-PROGRAM.patch new file mode 100644 index 0000000..4f56149 --- /dev/null +++ b/0206-make-use-the-_CPU-variety-of-build-flags-for-PROGRAM.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 13 Mar 2024 15:11:15 -0600 +Subject: [PATCH] make: use the _CPU variety of build flags for PROGRAM and + LIBRARY + +Signed-off-by: Peter Jones +--- + conf/Makefile.common | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/conf/Makefile.common b/conf/Makefile.common +index 9feac7434da..f8c2f6bd881 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -60,15 +60,14 @@ LDFLAGS_IMAGE = $(LDFLAGS_PLATFORM) -nostdlib $(TARGET_LDFLAGS_OLDMAGIC) -Wl,-S + CPPFLAGS_IMAGE = $(CPPFLAGS_CPU) $(CPPFLAGS_PLATFORM) + CCASFLAGS_IMAGE = $(CCASFLAGS_CPU) $(CCASFLAGS_PLATFORM) + +-CFLAGS_PROGRAM = $(UTILS_CFLAGS) +-LDFLAGS_PROGRAM = $(UTILS_LDFLAGS) +-CPPFLAGS_PROGRAM = $(UTILS_CPPFLAGS) +-CCASFLAGS_PROGRAM = $(UTILS_CCASFLAGS) ++CFLAGS_PROGRAM = $(CFLAGS_CPU) ++LDFLAGS_PROGRAM = $(LDFLAGS_CPU) ++CPPFLAGS_PROGRAM = $(CPPFLAGS_CPU) ++CCASFLAGS_PROGRAM = $(CCASFLAGS_CPU) + +-CFLAGS_LIBRARY = $(UTILS_CFLAGS) +-LDFLAGS_LIBRARY = $(UTILS_LDFLAGS) +-CPPFLAGS_LIBRARY = $(UTILS_CPPFLAGS) +-CCASFLAGS_LIBRARY = $(UTILS_CCASFLAGS) ++CFLAGS_LIBRARY = $(CFLAGS_CPU) ++CPPFLAGS_LIBRARY = $(CPPFLAGS_CPU) ++CCASFLAGS_LIBRARY = $(CCASFLAGS_CPU) + + # Other variables + diff --git a/0207-Work-around-extra_deps.lst-issue.patch b/0207-Work-around-extra_deps.lst-issue.patch new file mode 100644 index 0000000..0481cd5 --- /dev/null +++ b/0207-Work-around-extra_deps.lst-issue.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 13 Mar 2024 14:06:43 -0400 +Subject: [PATCH] Work around extra_deps.lst issue + +--- + grub-core/Makefile.am | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 77f8329cd43..aa172391fdf 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -460,6 +460,10 @@ extra_deps.lst: + @echo $(EXTRA_DEPS) | sed "s/\s*:\s*/\n/g" > $@ + + syminfo.lst: gensyminfo.sh kernel_syms.lst extra_deps.lst $(MODULE_FILES) ++ if ! [ -f extra_deps.lst ] ; then \ ++ echo Missing extra_deps.lst ; \ ++ echo $(EXTRA_DEPS) | sed "s/\s*:\s*/\n/g" > extra_deps.lst ; \ ++ fi + cat kernel_syms.lst extra_deps.lst > $@.new + for m in $(MODULE_FILES); do \ + sh $< $$m >> $@.new || exit 1; \ diff --git a/0208-include-proper-attribute-for-an-EFI-API-call-definit.patch b/0208-include-proper-attribute-for-an-EFI-API-call-definit.patch new file mode 100644 index 0000000..ad965b6 --- /dev/null +++ b/0208-include-proper-attribute-for-an-EFI-API-call-definit.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Thu, 21 Mar 2024 16:27:25 -0600 +Subject: [PATCH] include proper attribute for an EFI API call definition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Otherwise we observe the following issue + +../../grub-core/net/efi/http.c: In function ‘efihttp_request’: +../../grub-core/net/efi/http.c:233:28: error: passing argument 3 of ‘b->create_event’ from incompatible pointer type [-Wincompatible-pointer-types] + 233 | grub_efi_http_request_callback, NULL, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + | | + | void (*)(void *, void *) +../../grub-core/net/efi/http.c:233:28: note: expected ‘void (__attribute__((ms_abi)) *)(void *, void *)’ but argument is of type ‘void (*)(void *, void *)’ +--- + grub-core/net/efi/http.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c +index 0568ea5d43e..6fecb261c55 100644 +--- a/grub-core/net/efi/http.c ++++ b/grub-core/net/efi/http.c +@@ -131,14 +131,14 @@ static grub_efi_boolean_t request_callback_done; + static grub_efi_boolean_t response_callback_done; + + static void +-grub_efi_http_request_callback (grub_efi_event_t event __attribute__ ((unused)), ++__grub_efi_api grub_efi_http_request_callback (grub_efi_event_t event __attribute__ ((unused)), + void *context __attribute__ ((unused))) + { + request_callback_done = 1; + } + + static void +-grub_efi_http_response_callback (grub_efi_event_t event __attribute__ ((unused)), ++__grub_efi_api grub_efi_http_response_callback (grub_efi_event_t event __attribute__ ((unused)), + void *context __attribute__ ((unused))) + { + response_callback_done = 1; diff --git a/0209-cast-grub_error-status-parameter.patch b/0209-cast-grub_error-status-parameter.patch new file mode 100644 index 0000000..0cea65b --- /dev/null +++ b/0209-cast-grub_error-status-parameter.patch @@ -0,0 +1,67 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 22 Mar 2024 12:12:02 -0600 +Subject: [PATCH] cast grub_error status parameter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +For some reason, the compiler concludes that the status variable is +ultimately a 'long unsigned int' but status is a 'unsigned' (not a +long) so temporally cast it to unsigned otherwise we see the following + +../../grub-core/net/efi/http.c: In function ‘efihttp_request’: +../../grub-core/net/efi/http.c:251:39: warning: format ‘%x’ expects argument of type ‘unsigned int’, but argument 5 has type ‘grub_efi_status_t’ {aka ‘long unsigned int’} [-Wformat=] + 251 | return grub_error (GRUB_ERR_IO, "Fail to send a request! status=0x%x\n", status); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~ + | | + | grub_efi_status_t {aka long unsigned int} +--- + grub-core/net/efi/http.c | 6 +++--- + grub-core/net/efi/net.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c +index 6fecb261c55..5bdb47548f8 100644 +--- a/grub-core/net/efi/http.c ++++ b/grub-core/net/efi/http.c +@@ -236,7 +236,7 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, + if (status != GRUB_EFI_SUCCESS) + { + grub_free (request_data.url); +- return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", status); ++ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", (unsigned) status); + } + + status = http->request(http, &request_token); +@@ -248,7 +248,7 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, + { + b->close_event(request_token.event); + grub_free (request_data.url); +- return grub_error (GRUB_ERR_IO, "Fail to send a request! status=0x%x\n", status); ++ return grub_error (GRUB_ERR_IO, "Fail to send a request! status=0x%x\n", (unsigned) status); + } + /* TODO: Add Timeout */ + while (!request_callback_done) +@@ -273,7 +273,7 @@ efihttp_request (grub_efi_http_t *http, char *server, char *name, int use_https, + { + b->close_event(request_token.event); + grub_free (request_data.url); +- return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", status); ++ return grub_error (GRUB_ERR_IO, "Fail to create an event! status=0x%x\n", (unsigned) status); + } + + response_token.status = GRUB_EFI_SUCCESS; +diff --git a/grub-core/net/efi/net.c b/grub-core/net/efi/net.c +index 0a1e604b5bd..1b13603a63c 100644 +--- a/grub-core/net/efi/net.c ++++ b/grub-core/net/efi/net.c +@@ -706,7 +706,7 @@ grub_efi_service_binding (grub_efi_handle_t dev, grub_guid_t *service_binding_gu + status = service->create_child(service, &child_dev); + if (status != GRUB_EFI_SUCCESS) + { +- grub_error (GRUB_ERR_IO, N_("Failed to create child device of http service %x"), status); ++ grub_error (GRUB_ERR_IO, N_("Failed to create child device of http service %x"), (unsigned) status); + return NULL; + } + diff --git a/0210-remove-unused-varible.patch b/0210-remove-unused-varible.patch new file mode 100644 index 0000000..2a10b10 --- /dev/null +++ b/0210-remove-unused-varible.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 22 Mar 2024 14:20:06 -0600 +Subject: [PATCH] remove unused varible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Otherwise compiler complains with: + +../../grub-core/commands/efi/connectefi.c:143:20: error: unused variable ‘j’ [-Werror=unused-variable] + 143 | unsigned j; + | ^ + +Signed-off-by: Leo Sandoval +--- + grub-core/commands/efi/connectefi.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/commands/efi/connectefi.c b/grub-core/commands/efi/connectefi.c +index 6c397f8f508..9d02f2780f6 100644 +--- a/grub-core/commands/efi/connectefi.c ++++ b/grub-core/commands/efi/connectefi.c +@@ -140,7 +140,6 @@ loop: + { + grub_efi_handle_t handle = handles[i]; + grub_efi_status_t status; +- unsigned j; + + /* Skip already handled handles */ + if (is_in_list (handle)) diff --git a/0211-cast-grub_net_bootp_packet-pointer.patch b/0211-cast-grub_net_bootp_packet-pointer.patch new file mode 100644 index 0000000..b98d9b2 --- /dev/null +++ b/0211-cast-grub_net_bootp_packet-pointer.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 22 Mar 2024 18:28:17 -0600 +Subject: [PATCH] cast grub_net_bootp_packet pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Otherwise compiler complains with: + +../../grub-core/net/drivers/efi/efinet.c: In function ‘grub_efi_net_config_real’: +../../grub-core/net/drivers/efi/efinet.c:876:28: error: cannot convert to a pointer type + 876 | dhcp_ack = (struct grub_net_bootp_packet *) pxe_mode->dhcp_ack; + | ^~~~~~~~~~~~~~~~~~~~~ +../../grub-core/net/drivers/efi/efinet.c:881:57: error: initialization of ‘struct grub_net_bootp_packet *’ from incompatible pointer type ‘grub_efi_pxe_packet_t *’ [-Wincompatible-pointer-types] + 881 | struct grub_net_bootp_packet *proxy_offer = &pxe_mode->proxy_offer; + | ^ + +Signed-off-by: Leo Sandoval +--- + grub-core/net/drivers/efi/efinet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/drivers/efi/efinet.c b/grub-core/net/drivers/efi/efinet.c +index 83005ea9f88..4591d0757ec 100644 +--- a/grub-core/net/drivers/efi/efinet.c ++++ b/grub-core/net/drivers/efi/efinet.c +@@ -872,12 +872,12 @@ grub_efi_net_config_real (grub_efi_handle_t hnd, char **device, + { + grub_dprintf ("efinet", "using ipv4 and dhcp\n"); + +- struct grub_net_bootp_packet *dhcp_ack = &pxe_mode->dhcp_ack; ++ struct grub_net_bootp_packet *dhcp_ack = (struct grub_net_bootp_packet *) &pxe_mode->dhcp_ack; + + if (pxe_mode->proxy_offer_received) + { + grub_dprintf ("efinet", "proxy offer receive"); +- struct grub_net_bootp_packet *proxy_offer = &pxe_mode->proxy_offer; ++ struct grub_net_bootp_packet *proxy_offer = (struct grub_net_bootp_packet *) &pxe_mode->proxy_offer; + + if (proxy_offer && dhcp_ack->boot_file[0] == '\0') + { diff --git a/0212-libtasn1-fix-string-overflow-warning.patch b/0212-libtasn1-fix-string-overflow-warning.patch new file mode 100644 index 0000000..50d151a --- /dev/null +++ b/0212-libtasn1-fix-string-overflow-warning.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Thu, 11 Jan 2024 12:05:20 -0600 +Subject: [PATCH] libtasn1: fix string overflow warning + +Patched also at the libtasn1 project with commit + + c54e523d9dacdb7eec7f20964df12df9b80f467c + Author: Simo Sorce + AuthorDate: Tue May 11 14:18:10 2021 -0400 + Commit: Simo Sorce + CommitDate: Tue May 11 14:26:04 2021 -0400 + + Parent: 890a8a9 Fix resource leak (node) + Contained: master + Follows: v4.16.0 (48) + Precedes: v4.17.0 (5) + + Fix String overflow warning + + Scanner Output + -------------- + rror: COMPILER_WARNING (CWE-758): [#def2] + libtasn1-4.16.0/lib/element.c: scope_hint: In function '_asn1_append_sequence_set' + libtasn1-4.16.0/lib/element.c:186:7: warning[-Wstringop-overflow=]: '_asn1_ltostr' accessing 22 bytes in a region of size 21 + # 186 | _asn1_ltostr (n, temp + 1); + # | ^~~~~~~~~~~~~~~~~~~~~~~~~~ + libtasn1-4.16.0/lib/element.c:186:7: note: referencing argument 2 of type 'char *' + libtasn1-4.16.0/lib/element.c:30: included_from: Included from here. + libtasn1-4.16.0/lib/parser_aux.h:70:7: note: in a call to function '_asn1_ltostr' + # 70 | char *_asn1_ltostr (int64_t v, char str[LTOSTR_MAX_SIZE]); + # | ^~~~~~~~~~~~ + # 184| n++; + # 185| temp[0] = '?'; + # 186|-> _asn1_ltostr (n, temp + 1); + # 187| } + # 188| _asn1_set_name (p2, temp); + +Signed-off-by: Leo Sandoval +--- + grub-core/lib/libtasn1/lib/element.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/lib/libtasn1/lib/element.c b/grub-core/lib/libtasn1/lib/element.c +index ed761ff56bd..8cc73455aee 100644 +--- a/grub-core/lib/libtasn1/lib/element.c ++++ b/grub-core/lib/libtasn1/lib/element.c +@@ -143,7 +143,7 @@ int + _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache) + { + asn1_node p, p2; +- char temp[LTOSTR_MAX_SIZE]; ++ char temp[LTOSTR_MAX_SIZE + 1]; + long n; + + if (!node || !(node->down)) diff --git a/0009-Add-support-for-linuxefi.patch b/0213-Add-support-for-Linux-EFI-stub-loading.patch similarity index 44% rename from 0009-Add-support-for-linuxefi.patch rename to 0213-Add-support-for-Linux-EFI-stub-loading.patch index 966ed34..c930f1c 100644 --- a/0009-Add-support-for-linuxefi.patch +++ b/0213-Add-support-for-Linux-EFI-stub-loading.patch @@ -1,55 +1,136 @@ -From b0c86181f681b63e8d927464bd7d4dce1b6619f4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Matthew Garrett -Date: Tue, 10 Jul 2012 11:58:52 -0400 -Subject: [PATCH 009/272] Add support for linuxefi +Date: Mon, 1 Apr 2024 13:20:18 -0600 +Subject: [PATCH] Add support for Linux EFI stub loading. -References: fate#314485 -Patch-Mainline: no +Also: -Signed-off-by: Michael Chang +commit 71c843745f22f81e16d259e2e19c99bf3c1855c1 +Author: Colin Watson +Date: Tue Oct 23 10:40:49 2012 -0400 -v2: Adjust patch according to new upstream commits -4d4a8c96e verifiers: Add possibility to verify kernel and modules command lines -ca0a4f689 verifiers: File type for fine-grained signature-verification controlling -7d36709d5 i386: make struct linux_kernel_header architecture specific -4bc909bf8 Remove grub_efi_allocate_pages. -v3: -The upstream commit +Don't allow insmod when secure boot is enabled. -df84d6e94 efi: Print error messages to grub_efi_allocate_pages_real() +Hi, -adds grub_error() to set error message and return grub_errno. We have to -unset the grub_errno if we want to ignore the error and proceed, or -the inadvertently provoked error handler would lead to unspecified -consequence. +Fedora's patch to forbid insmod in UEFI Secure Boot environments is fine +as far as it goes. However, the insmod command is not the only way that +modules can be loaded. In particular, the 'normal' command, which +implements the usual GRUB menu and the fully-featured command prompt, +will implicitly load commands not currently loaded into memory. This +permits trivial Secure Boot violations by writing commands implementing +whatever you want to do and pointing $prefix at the malicious code. + +I'm currently test-building this patch (replacing your current +grub-2.00-no-insmod-on-sb.patch), but this should be more correct. It +moves the check into grub_dl_load_file. --- - grub-core/Makefile.core.def | 7 + - grub-core/kern/efi/mm.c | 32 +++ - grub-core/loader/i386/efi/linux.c | 345 ++++++++++++++++++++++++++++++ + grub-core/Makefile.core.def | 16 +- + grub-core/kern/dl.c | 22 +++ + grub-core/kern/efi/mm.c | 32 ++++ + grub-core/loader/efi/linux.c | 47 ++++++ + grub-core/loader/i386/efi/linux.c | 335 ++++++++++++++++++++++++++++++++++++++ + grub-core/loader/i386/pc/linux.c | 10 +- include/grub/efi/efi.h | 3 + - 4 files changed, 387 insertions(+) + include/grub/efi/linux.h | 31 ++++ + 8 files changed, 485 insertions(+), 11 deletions(-) create mode 100644 grub-core/loader/i386/efi/linux.c + create mode 100644 include/grub/efi/linux.h diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 1571421d7..07aa64caf 100644 +index a5a3ee31800..3f6e944d6a5 100644 --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -1919,6 +1919,13 @@ module = { - enable = x86_64_efi; +@@ -1831,12 +1831,6 @@ module = { }; -+module = { -+ name = linuxefi; -+ efi = loader/i386/efi/linux.c; -+ enable = i386_efi; -+ enable = x86_64_efi; -+}; -+ + +-module = { +- name = linux16; +- common = loader/i386/pc/linux.c; +- enable = x86; +-}; +- module = { - name = chain; - efi = loader/efi/chainloader.c; + name = ntldr; + i386_pc = loader/i386/pc/ntldr.c; +@@ -1892,10 +1886,9 @@ module = { + + module = { + name = linux; +- x86 = loader/i386/linux.c; + i386_xen_pvh = loader/i386/linux.c; + xen = loader/i386/xen.c; +- i386_pc = lib/i386/pc/vesa_modes_table.c; ++ i386_pc = loader/i386/pc/linux.c; + i386_xen_pvh = lib/i386/pc/vesa_modes_table.c; + mips = loader/mips/linux.c; + powerpc_ieee1275 = loader/powerpc/ieee1275/linux.c; +@@ -1908,11 +1901,14 @@ module = { + loongarch64 = loader/efi/linux.c; + riscv32 = loader/efi/linux.c; + riscv64 = loader/efi/linux.c; +- i386_efi = loader/efi/linux.c; +- x86_64_efi = loader/efi/linux.c; ++ i386_efi = loader/i386/efi/linux.c; ++ x86_64_efi = loader/i386/efi/linux.c; + emu = loader/emu/linux.c; ++ fdt = lib/fdt.c; + common = loader/linux.c; + common = lib/cmdline.c; ++ efi = loader/efi/linux.c; ++ efi = loader/i386/linux.c; + }; + + module = { +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index c55f0ecf931..d48d4131ba7 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -32,12 +32,21 @@ + #include + #include + #include ++#include + + /* Platforms where modules are in a readonly area of memory. */ + #if defined(GRUB_MACHINE_QEMU) + #define GRUB_MODULES_MACHINE_READONLY + #endif + ++#ifdef GRUB_MACHINE_EMU ++#include ++#endif ++ ++#ifdef GRUB_MACHINE_EFI ++#include ++#endif ++ + + + #pragma GCC diagnostic ignored "-Wcast-align" +@@ -861,6 +870,19 @@ grub_dl_load_file (const char *filename) + void *core = 0; + grub_dl_t mod = 0; + ++#ifdef GRUB_MACHINE_EFI ++ if (grub_efi_get_secureboot ()) ++ { ++#if 0 ++ /* This is an error, but grub2-mkconfig still generates a pile of ++ * insmod commands, so emitting it would be mostly just obnoxious. */ ++ grub_error (GRUB_ERR_ACCESS_DENIED, ++ "Secure Boot forbids loading module from %s", filename); ++#endif ++ return 0; ++ } ++#endif ++ + grub_boot_time ("Loading module %s", filename); + + file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE); diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c -index 6a6fba891..fbfc0e5bf 100644 +index df443f434d4..fb9dbf52528 100644 --- a/grub-core/kern/efi/mm.c +++ b/grub-core/kern/efi/mm.c @@ -112,6 +112,38 @@ grub_efi_drop_alloc (grub_efi_physical_address_t address, @@ -91,12 +172,81 @@ index 6a6fba891..fbfc0e5bf 100644 /* Allocate pages. Return the pointer to the first of allocated pages. */ void * grub_efi_allocate_pages_real (grub_efi_physical_address_t address, +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index bfbd95aeef0..925394d1767 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -25,10 +25,12 @@ + #include + #include + #include ++#include + #include + #include + #include + #include ++#include + #include + #include + #include +@@ -87,6 +89,51 @@ static grub_efi_load_file2_t initrd_lf2 = { + grub_efi_initrd_load_file2 + }; + ++#define SHIM_LOCK_GUID \ ++ { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} } ++ ++struct grub_efi_shim_lock ++{ ++ grub_efi_status_t (*verify) (void *buffer, grub_uint32_t size); ++}; ++typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; ++ ++grub_efi_boolean_t ++grub_linuxefi_secure_validate (void *data, grub_uint32_t size) ++{ ++ grub_guid_t guid = SHIM_LOCK_GUID; ++ grub_efi_shim_lock_t *shim_lock; ++ ++ shim_lock = grub_efi_locate_protocol(&guid, NULL); ++ ++ if (!shim_lock) ++ return 1; ++ ++ if (shim_lock->verify(data, size) == GRUB_EFI_SUCCESS) ++ return 1; ++ ++ return 0; ++} ++ ++#pragma GCC diagnostic push ++#pragma GCC diagnostic ignored "-Wcast-align" ++ ++typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); ++ ++grub_err_t ++grub_efi_linux_boot (void *kernel_address, grub_off_t offset, ++ void *kernel_params) ++{ ++ handover_func hf; ++ ++ hf = (handover_func)((char *)kernel_address + offset); ++ hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); ++ ++ return GRUB_ERR_BUG; ++} ++ ++#pragma GCC diagnostic pop ++ + grub_err_t + grub_arch_efi_linux_load_image_header (grub_file_t file, + struct linux_arch_kernel_header * lh) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c new file mode 100644 -index 000000000..16f7554e2 +index 00000000000..9bfb4ab9e3e --- /dev/null +++ b/grub-core/loader/i386/efi/linux.c -@@ -0,0 +1,345 @@ +@@ -0,0 +1,335 @@ +/* + * GRUB -- GRand Unified Bootloader + * Copyright (C) 2012 Free Software Foundation, Inc. @@ -125,6 +275,7 @@ index 000000000..16f7554e2 +#include +#include +#include ++#include + +GRUB_MOD_LICENSE ("GPLv3+"); + @@ -139,26 +290,18 @@ index 000000000..16f7554e2 + +#define BYTES_TO_PAGES(bytes) (((bytes) + 0xfff) >> 12) + -+typedef void(*handover_func)(void *, grub_efi_system_table_t *, struct linux_kernel_params *); -+ +static grub_err_t +grub_linuxefi_boot (void) +{ -+ handover_func hf; + int offset = 0; + +#ifdef __x86_64__ + offset = 512; +#endif -+ -+ hf = (handover_func)((char *)kernel_mem + handover_offset + offset); -+ + asm volatile ("cli"); + -+ hf (grub_efi_image_handle, grub_efi_system_table, params); -+ -+ /* Not reached */ -+ return GRUB_ERR_NONE; ++ return grub_efi_linux_boot ((char *)kernel_mem, handover_offset + offset, ++ params); +} + +static grub_err_t @@ -167,13 +310,18 @@ index 000000000..16f7554e2 + grub_dl_unref (my_mod); + loaded = 0; + if (initrd_mem) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, BYTES_TO_PAGES(params->ramdisk_size)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, ++ BYTES_TO_PAGES(params->ramdisk_size)); + if (linux_cmdline) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)linux_cmdline, BYTES_TO_PAGES(params->cmdline_size + 1)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) ++ linux_cmdline, ++ BYTES_TO_PAGES(params->cmdline_size + 1)); + if (kernel_mem) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, BYTES_TO_PAGES(kernel_size)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, ++ BYTES_TO_PAGES(kernel_size)); + if (params) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)params, BYTES_TO_PAGES(16384)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params, ++ BYTES_TO_PAGES(16384)); + return GRUB_ERR_NONE; +} + @@ -204,8 +352,7 @@ index 000000000..16f7554e2 + + for (i = 0; i < argc; i++) + { -+ files[i] = grub_file_open (argv[i], GRUB_FILE_TYPE_LINUX_INITRD -+ | GRUB_FILE_TYPE_NO_DECOMPRESS); ++ files[i] = grub_file_open (argv[i], GRUB_FILE_TYPE_LINUX_INITRD | GRUB_FILE_TYPE_NO_DECOMPRESS); + if (! files[i]) + goto fail; + nfiles++; @@ -213,7 +360,6 @@ index 000000000..16f7554e2 + } + + initrd_mem = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(size)); -+ + if (!initrd_mem) + { + grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate initrd")); @@ -248,20 +394,20 @@ index 000000000..16f7554e2 + grub_free (files); + + if (initrd_mem && grub_errno) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, BYTES_TO_PAGES(size)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, ++ BYTES_TO_PAGES(size)); + + return grub_errno; +} + +static grub_err_t +grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char *argv[]) ++ int argc, char *argv[]) +{ + grub_file_t file = 0; + struct linux_i386_kernel_header lh; + grub_ssize_t len, start, filelen; -+ void *kernel; -+ grub_err_t err; ++ void *kernel = NULL; + + grub_dl_ref (my_mod); + @@ -291,9 +437,12 @@ index 000000000..16f7554e2 + goto fail; + } + -+ grub_file_seek (file, 0); -+ -+ grub_free(kernel); ++ if (! grub_linuxefi_secure_validate (kernel, filelen)) ++ { ++ grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), ++ argv[0]); ++ goto fail; ++ } + + params = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(16384)); + @@ -305,13 +454,7 @@ index 000000000..16f7554e2 + + grub_memset (params, 0, 16384); + -+ if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh)) -+ { -+ if (!grub_errno) -+ grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -+ argv[0]); -+ goto fail; -+ } ++ grub_memcpy (&lh, kernel, sizeof (lh)); + + if (lh.boot_flag != grub_cpu_to_le16 (0xaa55)) + { @@ -337,8 +480,9 @@ index 000000000..16f7554e2 + goto fail; + } + ++ grub_dprintf ("linux", "setting up cmdline\n"); + linux_cmdline = grub_efi_allocate_pages_max(0x3fffffff, -+ BYTES_TO_PAGES(lh.cmdline_size + 1)); ++ BYTES_TO_PAGES(lh.cmdline_size + 1)); + + if (!linux_cmdline) + { @@ -347,12 +491,10 @@ index 000000000..16f7554e2 + } + + grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); -+ err = grub_create_loader_cmdline (argc, argv, ++ grub_create_loader_cmdline (argc, argv, + linux_cmdline + sizeof (LINUX_IMAGE) - 1, -+ lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1), -+ GRUB_VERIFY_KERNEL_CMDLINE); -+ if (err) -+ goto fail; ++ lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1), ++ GRUB_VERIFY_KERNEL_CMDLINE); + + lh.cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline; + @@ -361,15 +503,12 @@ index 000000000..16f7554e2 + start = (lh.setup_sects + 1) * 512; + len = grub_file_size(file) - start; + -+ kernel_mem = grub_efi_allocate_fixed (lh.pref_address, -+ BYTES_TO_PAGES(lh.init_size)); ++ kernel_mem = grub_efi_allocate_pages_max(lh.pref_address, ++ BYTES_TO_PAGES(lh.init_size)); + + if (!kernel_mem) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ kernel_mem = grub_efi_allocate_pages_max(0x3fffffff, -+ BYTES_TO_PAGES(lh.init_size)); -+ } ++ kernel_mem = grub_efi_allocate_pages_max(0x3fffffff, ++ BYTES_TO_PAGES(lh.init_size)); + + if (!kernel_mem) + { @@ -377,27 +516,12 @@ index 000000000..16f7554e2 + goto fail; + } + -+ if (grub_file_seek (file, start) == (grub_off_t) -1) -+ { -+ grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -+ argv[0]); -+ goto fail; -+ } -+ -+ if (grub_file_read (file, kernel_mem, len) != len && !grub_errno) -+ { -+ grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), -+ argv[0]); -+ } ++ grub_memcpy (kernel_mem, (char *)kernel + start, len); ++ grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); ++ loaded=1; + -+ if (grub_errno == GRUB_ERR_NONE) -+ { -+ grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); -+ loaded = 1; -+ lh.code32_start = (grub_uint32_t)(grub_addr_t) kernel_mem; -+ } -+ -+ grub_memcpy(params, &lh, 2 * 512); ++ lh.code32_start = (grub_uint32_t)(grub_uint64_t) kernel_mem; ++ grub_memcpy (params, &lh, 2 * 512); + + params->type_of_loader = 0x21; + @@ -406,6 +530,9 @@ index 000000000..16f7554e2 + if (file) + grub_file_close (file); + ++ if (kernel) ++ grub_free (kernel); ++ + if (grub_errno != GRUB_ERR_NONE) + { + grub_dl_unref (my_mod); @@ -413,40 +540,87 @@ index 000000000..16f7554e2 + } + + if (linux_cmdline && !loaded) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)linux_cmdline, BYTES_TO_PAGES(lh.cmdline_size + 1)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) ++ linux_cmdline, ++ BYTES_TO_PAGES(lh.cmdline_size + 1)); + + if (kernel_mem && !loaded) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, BYTES_TO_PAGES(kernel_size)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, ++ BYTES_TO_PAGES(kernel_size)); + + if (params && !loaded) -+ grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)params, BYTES_TO_PAGES(16384)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params, ++ BYTES_TO_PAGES(16384)); + + return grub_errno; +} + +static grub_command_t cmd_linux, cmd_initrd; ++static grub_command_t cmd_linuxefi, cmd_initrdefi; + -+GRUB_MOD_INIT(linuxefi) ++GRUB_MOD_INIT(linux) +{ + cmd_linux = ++ grub_register_command ("linux", grub_cmd_linux, ++ 0, N_("Load Linux.")); ++ cmd_linuxefi = + grub_register_command ("linuxefi", grub_cmd_linux, + 0, N_("Load Linux.")); + cmd_initrd = ++ grub_register_command ("initrd", grub_cmd_initrd, ++ 0, N_("Load initrd.")); ++ cmd_initrdefi = + grub_register_command ("initrdefi", grub_cmd_initrd, + 0, N_("Load initrd.")); + my_mod = mod; +} + -+GRUB_MOD_FINI(linuxefi) ++GRUB_MOD_FINI(linux) +{ + grub_unregister_command (cmd_linux); ++ grub_unregister_command (cmd_linuxefi); + grub_unregister_command (cmd_initrd); ++ grub_unregister_command (cmd_initrdefi); +} +diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c +index 600530a742b..8593d74737f 100644 +--- a/grub-core/loader/i386/pc/linux.c ++++ b/grub-core/loader/i386/pc/linux.c +@@ -483,14 +483,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + return grub_errno; + } + +-static grub_command_t cmd_linux, cmd_initrd; ++static grub_command_t cmd_linux, cmd_linux16, cmd_initrd, cmd_initrd16; + + GRUB_MOD_INIT(linux16) + { + cmd_linux = ++ grub_register_command ("linux", grub_cmd_linux, ++ 0, N_("Load Linux.")); ++ cmd_linux16 = + grub_register_command ("linux16", grub_cmd_linux, + 0, N_("Load Linux.")); + cmd_initrd = ++ grub_register_command ("initrd", grub_cmd_initrd, ++ 0, N_("Load initrd.")); ++ cmd_initrd16 = + grub_register_command ("initrd16", grub_cmd_initrd, + 0, N_("Load initrd.")); + my_mod = mod; +@@ -499,5 +505,7 @@ GRUB_MOD_INIT(linux16) + GRUB_MOD_FINI(linux16) + { + grub_unregister_command (cmd_linux); ++ grub_unregister_command (cmd_linux16); + grub_unregister_command (cmd_initrd); ++ grub_unregister_command (cmd_initrd16); + } diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h -index a5cd99e5a..87aa1ce25 100644 +index 3670eddc52b..83ddbe26e57 100644 --- a/include/grub/efi/efi.h +++ b/include/grub/efi/efi.h -@@ -61,6 +61,9 @@ EXPORT_FUNC(grub_efi_allocate_fixed) (grub_efi_physical_address_t address, +@@ -75,6 +75,9 @@ EXPORT_FUNC(grub_efi_allocate_fixed) (grub_efi_physical_address_t address, grub_efi_uintn_t pages); void * EXPORT_FUNC(grub_efi_allocate_any_pages) (grub_efi_uintn_t pages); @@ -456,6 +630,40 @@ index a5cd99e5a..87aa1ce25 100644 void EXPORT_FUNC(grub_efi_free_pages) (grub_efi_physical_address_t address, grub_efi_uintn_t pages); grub_efi_uintn_t EXPORT_FUNC(grub_efi_find_mmap_size) (void); --- -2.41.0 - +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +new file mode 100644 +index 00000000000..d224daafa4f +--- /dev/null ++++ b/include/grub/efi/linux.h +@@ -0,0 +1,31 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2014 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++#ifndef GRUB_EFI_LINUX_HEADER ++#define GRUB_EFI_LINUX_HEADER 1 ++ ++#include ++#include ++#include ++ ++grub_efi_boolean_t ++EXPORT_FUNC(grub_linuxefi_secure_validate) (void *data, grub_uint32_t size); ++grub_err_t ++EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset, ++ void *kernel_param); ++ ++#endif /* ! GRUB_EFI_LINUX_HEADER */ diff --git a/0214-fix-i386_pc-on-legacycfg-module.patch b/0214-fix-i386_pc-on-legacycfg-module.patch new file mode 100644 index 0000000..9461a9f --- /dev/null +++ b/0214-fix-i386_pc-on-legacycfg-module.patch @@ -0,0 +1,21 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Tue, 2 Apr 2024 12:59:10 -0600 +Subject: [PATCH] fix i386_pc on legacycfg module + +--- + grub-core/Makefile.core.def | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 3f6e944d6a5..b045aac7c91 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -2459,6 +2459,7 @@ module = { + common = commands/legacycfg.c; + common = lib/legacy_parse.c; + emu = lib/i386/pc/vesa_modes_table.c; ++ i386_pc = lib/i386/pc/vesa_modes_table.c; + i386_efi = lib/i386/pc/vesa_modes_table.c; + x86_64_efi = lib/i386/pc/vesa_modes_table.c; + xen = lib/i386/pc/vesa_modes_table.c; diff --git a/0215-Add-secureboot-support-on-efi-chainloader.patch b/0215-Add-secureboot-support-on-efi-chainloader.patch new file mode 100644 index 0000000..2e993cb --- /dev/null +++ b/0215-Add-secureboot-support-on-efi-chainloader.patch @@ -0,0 +1,1390 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Raymund Will +Date: Tue, 2 Apr 2024 16:39:53 -0600 +Subject: [PATCH] Add secureboot support on efi chainloader + +Expand the chainloader to be able to verify the image by means of shim +lock protocol. The PE/COFF image is loaded and relocated by the +chainloader instead of calling LoadImage and StartImage UEFI boot +Service as they require positive verification result from keys enrolled +in KEK or DB. The shim will use MOK in addition to firmware enrolled +keys to verify the image. + +The chainloader module could be used to load other UEFI bootloaders, +such as xen.efi, and could be signed by any of MOK, KEK or DB. + +Based on https://build.opensuse.org/package/view_file/openSUSE:Factory/grub2/grub2-secureboot-chainloader.patch + +Signed-off-by: Peter Jones + +Also: + +commit cd7a8984d4fda905877b5bfe466339100156b3bc +Author: Raymund Will +Date: Fri Apr 10 01:45:02 2015 -0400 + +Use device part of chainloader target, if present. + +Otherwise chainloading is restricted to '$root', which might not even +be readable by EFI! + +v1. use grub_file_get_device_name() to get device name + +Signed-off-by: Michael Chang +Signed-off-by: Peter Jones + +Also: + +commit 0872a2310a0eeac4ecfe9e1b49dd2d72ab373039 +Author: Peter Jones +Date: Fri Jun 10 14:06:15 2016 -0400 + +Rework even more of efi chainload so non-sb cases work right. + +This ensures that if shim protocol is not loaded, or is loaded but shim +is disabled, we will fall back to a correct load method for the efi +chain loader. + +Here's what I tested with this version: + +results expected actual +------------------------------------------------------------ +sb + enabled + shim + fedora success success +sb + enabled + shim + win success success +sb + enabled + grub + fedora fail fail +sb + enabled + grub + win fail fail + +sb + mokdisabled + shim + fedora success success +sb + mokdisabled + shim + win success success +sb + mokdisabled + grub + fedora fail fail +sb + mokdisabled + grub + win fail fail + +sb disabled + shim + fedora success success* +sb disabled + shim + win success success* +sb disabled + grub + fedora success success +sb disabled + grub + win success success + +nosb + shim + fedora success success* +nosb + shim + win success success* +nosb + grub + fedora success success +nosb + grub + win success success + +* for some reason shim protocol is being installed in these cases, and I + can't see why, but I think it may be this firmware build returning an + erroneous value. But this effectively falls back to the mokdisabled + behavior, which works correctly, and the presence of the "grub" (i.e. + no shim) tests effectively tests the desired behavior here. + +Resolves: rhbz#1344512 + +Signed-off-by: Peter Jones + +Also: + +commit ff7b1cb7f69487870211aeb69ff4f54470fbcb58 +Author: Laszlo Ersek +Date: Mon Nov 21 15:34:00 2016 +0100 + +efi/chainloader: fix wrong sanity check in relocate_coff() + +In relocate_coff(), the relocation entries are parsed from the original +image (not the section-wise copied image). The original image is +pointed-to by the "orig" pointer. The current check + + (void *)reloc_end < data + +compares the addresses of independent memory allocations. "data" is a typo +here, it should be "orig". + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1347291 +Signed-off-by: Laszlo Ersek +Tested-by: Bogdan Costescu +Tested-by: Juan Orti + +Also: + +commit ab4ba9997ad4832449e54d930fa2aac6a160d0e9 +Author: Laszlo Ersek +Date: Wed Nov 23 06:27:09 2016 +0100 + +efi/chainloader: truncate overlong relocation section + +The UEFI Windows 7 boot loader ("EFI/Microsoft/Boot/bootmgfw.efi", SHA1 +31b410e029bba87d2068c65a80b88882f9f8ea25) has inconsistent headers. + +Compare: + +> The Data Directory +> ... +> Entry 5 00000000000d9000 00000574 Base Relocation Directory [.reloc] + +Versus: + +> Sections: +> Idx Name Size VMA LMA File off ... +> ... +> 10 .reloc 00000e22 00000000100d9000 00000000100d9000 000a1800 ... + +That is, the size reported by the RelocDir entry (0x574) is smaller than +the virtual size of the .reloc section (0xe22). + +Quoting the grub2 debug log for the same: + +> chainloader.c:595: reloc_dir: 0xd9000 reloc_size: 0x00000574 +> chainloader.c:603: reloc_base: 0x7d208000 reloc_base_end: 0x7d208573 +> ... +> chainloader.c:620: Section 10 ".reloc" at 0x7d208000..0x7d208e21 +> chainloader.c:661: section is not reloc section? +> chainloader.c:663: rds: 0x00001000, vs: 00000e22 +> chainloader.c:664: base: 0x7d208000 end: 0x7d208e21 +> chainloader.c:666: reloc_base: 0x7d208000 reloc_base_end: 0x7d208573 +> chainloader.c:671: Section characteristics are 42000040 +> chainloader.c:673: Section virtual size: 00000e22 +> chainloader.c:675: Section raw_data size: 00001000 +> chainloader.c:678: Discarding section + +After hexdumping "bootmgfw.efi" and manually walking its relocation blocks +(yes, really), I determined that the (smaller) RelocDir value is correct. +The remaining area that extends up to the .reloc section size (== 0xe22 - +0x574 == 0x8ae bytes) exists as zero padding in the file. + +This zero padding shouldn't be passed to relocate_coff() for parsing. In +order to cope with it, split the handling of .reloc sections into the +following branches: + +- original case (equal size): original behavior (--> relocation + attempted), + +- overlong .reloc section (longer than reported by RelocDir): truncate the + section to the RelocDir size for the purposes of relocate_coff(), and + attempt relocation, + +- .reloc section is too short, or other checks fail: original behavior + (--> relocation not attempted). + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1347291 +Signed-off-by: Laszlo Ersek + +Also: + +commit cc06f149fbd2d8c1da1e83173d21629ba97e0d92 +Author: Raymund Will + +chainloader: Define machine types for RISC-V + +The commit "Add secureboot support on efi chainloader" didn't add machine +types for RISC-V, so this patch adds them. + +Note, that grub-core/loader/riscv/linux.c is skipped because Linux is not +supported yet. This patch might need a new revision once that's the case. + +Signed-off-by: David Abdurachmanov +--- + grub-core/loader/efi/chainloader.c | 849 +++++++++++++++++++++++++++++++++---- + grub-core/loader/efi/linux.c | 25 +- + grub-core/loader/i386/efi/linux.c | 17 +- + include/grub/efi/linux.h | 2 +- + include/grub/efi/pe32.h | 51 ++- + 5 files changed, 848 insertions(+), 96 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 2036924504b..e4ac39c87b4 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -32,6 +32,9 @@ + #include + #include + #include ++#include ++#include ++#include + #include + #include + #include +@@ -45,13 +48,24 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + static grub_dl_t my_mod; + ++static grub_efi_physical_address_t address; ++static grub_efi_uintn_t pages; ++static grub_ssize_t fsize; ++static grub_efi_device_path_t *file_path; ++static grub_efi_handle_t image_handle; ++static grub_efi_char16_t *cmdline; ++static grub_ssize_t cmdline_len; ++static grub_efi_handle_t dev_handle; ++ ++static grub_efi_status_t (__grub_efi_api *entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); ++ + static grub_err_t + grub_chainloader_unload (void *context) + { +- grub_efi_handle_t image_handle = (grub_efi_handle_t) context; + grub_efi_loaded_image_t *loaded_image; + grub_efi_boot_services_t *b; + ++ image_handle = (grub_efi_handle_t) context; + loaded_image = grub_efi_get_loaded_image (image_handle); + if (loaded_image != NULL) + grub_free (loaded_image->load_options); +@@ -66,12 +80,12 @@ grub_chainloader_unload (void *context) + static grub_err_t + grub_chainloader_boot (void *context) + { +- grub_efi_handle_t image_handle = (grub_efi_handle_t) context; + grub_efi_boot_services_t *b; + grub_efi_status_t status; + grub_efi_uintn_t exit_data_size; + grub_efi_char16_t *exit_data = NULL; + ++ image_handle = (grub_efi_handle_t) context; + b = grub_efi_system_table->boot_services; + status = b->start_image (image_handle, &exit_data_size, &exit_data); + if (status != GRUB_EFI_SUCCESS) +@@ -136,7 +150,7 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + char *dir_start; + char *dir_end; + grub_size_t size; +- grub_efi_device_path_t *d, *file_path; ++ grub_efi_device_path_t *d; + + dir_start = grub_strchr (filename, ')'); + if (! dir_start) +@@ -209,24 +223,701 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + return file_path; + } + ++#define SHIM_LOCK_GUID \ ++ { 0x605dab50, 0xe046, 0x4300, { 0xab,0xb6,0x3d,0xd8,0x10,0xdd,0x8b,0x23 } } ++ ++typedef union ++{ ++ struct grub_pe32_header_32 pe32; ++ struct grub_pe32_header_64 pe32plus; ++} grub_pe_header_t; ++ ++struct pe_coff_loader_image_context ++{ ++ grub_efi_uint64_t image_address; ++ grub_efi_uint64_t image_size; ++ grub_efi_uint64_t entry_point; ++ grub_efi_uintn_t size_of_headers; ++ grub_efi_uint16_t image_type; ++ grub_efi_uint16_t number_of_sections; ++ grub_efi_uint32_t section_alignment; ++ struct grub_pe32_section_table *first_section; ++ struct grub_pe32_data_directory *reloc_dir; ++ struct grub_pe32_data_directory *sec_dir; ++ grub_efi_uint64_t number_of_rva_and_sizes; ++ grub_pe_header_t *pe_hdr; ++}; ++ ++typedef struct pe_coff_loader_image_context pe_coff_loader_image_context_t; ++ ++struct grub_efi_shim_lock ++{ ++ grub_efi_status_t (*verify)(void *buffer, ++ grub_efi_uint32_t size); ++ grub_efi_status_t (*hash)(void *data, ++ grub_efi_int32_t datasize, ++ pe_coff_loader_image_context_t *context, ++ grub_efi_uint8_t *sha256hash, ++ grub_efi_uint8_t *sha1hash); ++ grub_efi_status_t (*context)(void *data, ++ grub_efi_uint32_t size, ++ pe_coff_loader_image_context_t *context); ++}; ++ ++typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; ++ ++static grub_efi_boolean_t ++read_header (void *data, grub_efi_uint32_t size, ++ pe_coff_loader_image_context_t *context) ++{ ++ grub_guid_t guid = SHIM_LOCK_GUID; ++ grub_efi_shim_lock_t *shim_lock; ++ grub_efi_status_t status; ++ ++ shim_lock = grub_efi_locate_protocol (&guid, NULL); ++ if (!shim_lock) ++ { ++ grub_dprintf ("chain", "no shim lock protocol"); ++ return 0; ++ } ++ ++ status = shim_lock->context (data, size, context); ++ ++ if (status == GRUB_EFI_SUCCESS) ++ { ++ grub_dprintf ("chain", "context success\n"); ++ return 1; ++ } ++ ++ switch (status) ++ { ++ case GRUB_EFI_UNSUPPORTED: ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error unsupported"); ++ break; ++ case GRUB_EFI_INVALID_PARAMETER: ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error invalid parameter"); ++ break; ++ default: ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "context error code"); ++ break; ++ } ++ ++ return -1; ++} ++ ++static void* ++image_address (void *image, grub_efi_uint64_t sz, grub_efi_uint64_t adr) ++{ ++ if (adr > sz) ++ return NULL; ++ ++ return ((grub_uint8_t*)image + adr); ++} ++ ++static int ++image_is_64_bit (grub_pe_header_t *pe_hdr) ++{ ++ /* .Magic is the same offset in all cases */ ++ if (pe_hdr->pe32plus.optional_header.magic == GRUB_PE32_PE64_MAGIC) ++ return 1; ++ return 0; ++} ++ ++static const grub_uint16_t machine_type __attribute__((__unused__)) = ++#if defined(__x86_64__) ++ GRUB_PE32_MACHINE_X86_64; ++#elif defined(__aarch64__) ++ GRUB_PE32_MACHINE_ARM64; ++#elif defined(__arm__) ++ GRUB_PE32_MACHINE_ARMTHUMB_MIXED; ++#elif defined(__i386__) || defined(__i486__) || defined(__i686__) ++ GRUB_PE32_MACHINE_I386; ++#elif defined(__ia64__) ++ GRUB_PE32_MACHINE_IA64; ++#elif defined(__riscv) && (__riscv_xlen == 32) ++ GRUB_PE32_MACHINE_RISCV32; ++#elif defined(__riscv) && (__riscv_xlen == 64) ++ GRUB_PE32_MACHINE_RISCV64; ++#else ++#error this architecture is not supported by grub2 ++#endif ++ ++static grub_efi_status_t ++relocate_coff (pe_coff_loader_image_context_t *context, ++ struct grub_pe32_section_table *section, ++ void *orig, void *data) ++{ ++ struct grub_pe32_data_directory *reloc_base, *reloc_base_end; ++ grub_efi_uint64_t adjust; ++ struct grub_pe32_fixup_block *reloc, *reloc_end; ++ char *fixup, *fixup_base, *fixup_data = NULL; ++ grub_efi_uint16_t *fixup_16; ++ grub_efi_uint32_t *fixup_32; ++ grub_efi_uint64_t *fixup_64; ++ grub_efi_uint64_t size = context->image_size; ++ void *image_end = (char *)orig + size; ++ int n = 0; ++ ++ if (image_is_64_bit (context->pe_hdr)) ++ context->pe_hdr->pe32plus.optional_header.image_base = ++ (grub_uint64_t)(unsigned long)data; ++ else ++ context->pe_hdr->pe32.optional_header.image_base = ++ (grub_uint32_t)(unsigned long)data; ++ ++ /* Alright, so here's how this works: ++ * ++ * context->reloc_dir gives us two things: ++ * - the VA the table of base relocation blocks are (maybe) to be ++ * mapped at (reloc_dir->rva) ++ * - the virtual size (reloc_dir->size) ++ * ++ * The .reloc section (section here) gives us some other things: ++ * - the name! kind of. (section->name) ++ * - the virtual size (section->virtual_size), which should be the same ++ * as RelocDir->Size ++ * - the virtual address (section->virtual_address) ++ * - the file section size (section->raw_data_size), which is ++ * a multiple of optional_header->file_alignment. Only useful for image ++ * validation, not really useful for iteration bounds. ++ * - the file address (section->raw_data_offset) ++ * - a bunch of stuff we don't use that's 0 in our binaries usually ++ * - Flags (section->characteristics) ++ * ++ * and then the thing that's actually at the file address is an array ++ * of struct grub_pe32_fixup_block structs with some values packed behind ++ * them. The block_size field of this structure includes the ++ * structure itself, and adding it to that structure's address will ++ * yield the next entry in the array. ++ */ ++ ++ reloc_base = image_address (orig, size, section->raw_data_offset); ++ reloc_base_end = image_address (orig, size, section->raw_data_offset ++ + section->virtual_size); ++ ++ grub_dprintf ("chain", "relocate_coff(): reloc_base %p reloc_base_end %p\n", ++ reloc_base, reloc_base_end); ++ ++ if (!reloc_base && !reloc_base_end) ++ return GRUB_EFI_SUCCESS; ++ ++ if (!reloc_base || !reloc_base_end) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc table overflows binary"); ++ return GRUB_EFI_UNSUPPORTED; ++ } ++ ++ adjust = (grub_uint64_t)(grub_efi_uintn_t)data - context->image_address; ++ if (adjust == 0) ++ return GRUB_EFI_SUCCESS; ++ ++ while (reloc_base < reloc_base_end) ++ { ++ grub_uint16_t *entry; ++ reloc = (struct grub_pe32_fixup_block *)((char*)reloc_base); ++ ++ if ((reloc_base->size == 0) || ++ (reloc_base->size > context->reloc_dir->size)) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ "Reloc %d block size %d is invalid\n", n, ++ reloc_base->size); ++ return GRUB_EFI_UNSUPPORTED; ++ } ++ ++ entry = &reloc->entries[0]; ++ reloc_end = (struct grub_pe32_fixup_block *) ++ ((char *)reloc_base + reloc_base->size); ++ ++ if ((void *)reloc_end < orig || (void *)reloc_end > image_end) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc entry %d overflows binary", ++ n); ++ return GRUB_EFI_UNSUPPORTED; ++ } ++ ++ fixup_base = image_address(data, size, reloc_base->rva); ++ ++ if (!fixup_base) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "Reloc %d Invalid fixupbase", n); ++ return GRUB_EFI_UNSUPPORTED; ++ } ++ ++ while ((void *)entry < (void *)reloc_end) ++ { ++ fixup = fixup_base + (*entry & 0xFFF); ++ switch ((*entry) >> 12) ++ { ++ case GRUB_PE32_REL_BASED_ABSOLUTE: ++ break; ++ case GRUB_PE32_REL_BASED_HIGH: ++ fixup_16 = (grub_uint16_t *)fixup; ++ *fixup_16 = (grub_uint16_t) ++ (*fixup_16 + ((grub_uint16_t)((grub_uint32_t)adjust >> 16))); ++ if (fixup_data != NULL) ++ { ++ *(grub_uint16_t *) fixup_data = *fixup_16; ++ fixup_data = fixup_data + sizeof (grub_uint16_t); ++ } ++ break; ++ case GRUB_PE32_REL_BASED_LOW: ++ fixup_16 = (grub_uint16_t *)fixup; ++ *fixup_16 = (grub_uint16_t) (*fixup_16 + (grub_uint16_t)adjust); ++ if (fixup_data != NULL) ++ { ++ *(grub_uint16_t *) fixup_data = *fixup_16; ++ fixup_data = fixup_data + sizeof (grub_uint16_t); ++ } ++ break; ++ case GRUB_PE32_REL_BASED_HIGHLOW: ++ fixup_32 = (grub_uint32_t *)fixup; ++ *fixup_32 = *fixup_32 + (grub_uint32_t)adjust; ++ if (fixup_data != NULL) ++ { ++ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint32_t)); ++ *(grub_uint32_t *) fixup_data = *fixup_32; ++ fixup_data += sizeof (grub_uint32_t); ++ } ++ break; ++ case GRUB_PE32_REL_BASED_DIR64: ++ fixup_64 = (grub_uint64_t *)fixup; ++ *fixup_64 = *fixup_64 + (grub_uint64_t)adjust; ++ if (fixup_data != NULL) ++ { ++ fixup_data = (char *)ALIGN_UP ((grub_addr_t)fixup_data, sizeof (grub_uint64_t)); ++ *(grub_uint64_t *) fixup_data = *fixup_64; ++ fixup_data += sizeof (grub_uint64_t); ++ } ++ break; ++ default: ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ "Reloc %d unknown relocation type %d", ++ n, (*entry) >> 12); ++ return GRUB_EFI_UNSUPPORTED; ++ } ++ entry += 1; ++ } ++ reloc_base = (struct grub_pe32_data_directory *)reloc_end; ++ n++; ++ } ++ ++ return GRUB_EFI_SUCCESS; ++} ++ ++static grub_efi_device_path_t * ++grub_efi_get_media_file_path (grub_efi_device_path_t *dp) ++{ ++ while (1) ++ { ++ grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); ++ grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); ++ ++ if (type == GRUB_EFI_END_DEVICE_PATH_TYPE) ++ break; ++ else if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE ++ && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE) ++ return dp; ++ ++ dp = GRUB_EFI_NEXT_DEVICE_PATH (dp); ++ } ++ ++ return NULL; ++} ++ ++static grub_efi_boolean_t ++handle_image (void *data, grub_efi_uint32_t datasize) ++{ ++ grub_efi_boot_services_t *b; ++ grub_efi_loaded_image_t *li, li_bak; ++ grub_efi_status_t efi_status; ++ char *buffer = NULL; ++ char *buffer_aligned = NULL; ++ grub_efi_uint32_t i; ++ struct grub_pe32_section_table *section; ++ char *base, *end; ++ pe_coff_loader_image_context_t context; ++ grub_uint32_t section_alignment; ++ grub_uint32_t buffer_size; ++ int found_entry_point = 0; ++ int rc; ++ ++ b = grub_efi_system_table->boot_services; ++ ++ rc = read_header (data, datasize, &context); ++ if (rc < 0) ++ { ++ grub_dprintf ("chain", "Failed to read header\n"); ++ goto error_exit; ++ } ++ else if (rc == 0) ++ { ++ grub_dprintf ("chain", "Secure Boot is not enabled\n"); ++ return 0; ++ } ++ else ++ { ++ grub_dprintf ("chain", "Header read without error\n"); ++ } ++ ++ /* ++ * The spec says, uselessly, of SectionAlignment: ++ * ===== ++ * The alignment (in bytes) of sections when they are loaded into ++ * memory. It must be greater than or equal to FileAlignment. The ++ * default is the page size for the architecture. ++ * ===== ++ * Which doesn't tell you whose responsibility it is to enforce the ++ * "default", or when. It implies that the value in the field must ++ * be > FileAlignment (also poorly defined), but it appears visual ++ * studio will happily write 512 for FileAlignment (its default) and ++ * 0 for SectionAlignment, intending to imply PAGE_SIZE. ++ * ++ * We only support one page size, so if it's zero, nerf it to 4096. ++ */ ++ section_alignment = context.section_alignment; ++ if (section_alignment == 0) ++ section_alignment = 4096; ++ ++ buffer_size = context.image_size + section_alignment; ++ grub_dprintf ("chain", "image size is %08"PRIxGRUB_UINT64_T", datasize is %08x\n", ++ context.image_size, datasize); ++ ++ efi_status = b->allocate_pool (GRUB_EFI_LOADER_DATA, ++ buffer_size, (void**)&buffer); ++ ++ if (efi_status != GRUB_EFI_SUCCESS) ++ { ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); ++ goto error_exit; ++ } ++ ++ buffer_aligned = (char *)ALIGN_UP ((grub_addr_t)buffer, section_alignment); ++ if (!buffer_aligned) ++ { ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); ++ goto error_exit; ++ } ++ ++ grub_memcpy (buffer_aligned, data, context.size_of_headers); ++ ++ entry_point = image_address (buffer_aligned, context.image_size, ++ context.entry_point); ++ ++ grub_dprintf ("chain", "entry_point: %p\n", entry_point); ++ if (!entry_point) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point"); ++ goto error_exit; ++ } ++ ++ char *reloc_base, *reloc_base_end; ++ grub_dprintf ("chain", "reloc_dir: %p reloc_size: 0x%08x\n", ++ (void *)(unsigned long)context.reloc_dir->rva, ++ context.reloc_dir->size); ++ reloc_base = image_address (buffer_aligned, context.image_size, ++ context.reloc_dir->rva); ++ /* RelocBaseEnd here is the address of the last byte of the table */ ++ reloc_base_end = image_address (buffer_aligned, context.image_size, ++ context.reloc_dir->rva ++ + context.reloc_dir->size - 1); ++ grub_dprintf ("chain", "reloc_base: %p reloc_base_end: %p\n", ++ reloc_base, reloc_base_end); ++ ++ struct grub_pe32_section_table *reloc_section = NULL, fake_reloc_section; ++ ++ section = context.first_section; ++ for (i = 0; i < context.number_of_sections; i++, section++) ++ { ++ char name[9]; ++ ++ base = image_address (buffer_aligned, context.image_size, ++ section->virtual_address); ++ end = image_address (buffer_aligned, context.image_size, ++ section->virtual_address + section->virtual_size -1); ++ ++ grub_strncpy(name, section->name, 9); ++ name[8] = '\0'; ++ grub_dprintf ("chain", "Section %d \"%s\" at %p..%p\n", i, ++ name, base, end); ++ ++ if (end < base) ++ { ++ grub_dprintf ("chain", " base is %p but end is %p... bad.\n", ++ base, end); ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ "Image has invalid negative size"); ++ goto error_exit; ++ } ++ ++ if (section->virtual_address <= context.entry_point && ++ (section->virtual_address + section->raw_data_size - 1) ++ > context.entry_point) ++ { ++ found_entry_point++; ++ grub_dprintf ("chain", " section contains entry point\n"); ++ } ++ ++ /* We do want to process .reloc, but it's often marked ++ * discardable, so we don't want to memcpy it. */ ++ if (grub_memcmp (section->name, ".reloc\0\0", 8) == 0) ++ { ++ if (reloc_section) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ "Image has multiple relocation sections"); ++ goto error_exit; ++ } ++ ++ /* If it has nonzero sizes, and our bounds check ++ * made sense, and the VA and size match RelocDir's ++ * versions, then we believe in this section table. */ ++ if (section->raw_data_size && section->virtual_size && ++ base && end && reloc_base == base) ++ { ++ if (reloc_base_end == end) ++ { ++ grub_dprintf ("chain", " section is relocation section\n"); ++ reloc_section = section; ++ } ++ else if (reloc_base_end && reloc_base_end < end) ++ { ++ /* Bogus virtual size in the reloc section -- RelocDir ++ * reported a smaller Base Relocation Directory. Decrease ++ * the section's virtual size so that it equal RelocDir's ++ * idea, but only for the purposes of relocate_coff(). */ ++ grub_dprintf ("chain", ++ " section is (overlong) relocation section\n"); ++ grub_memcpy (&fake_reloc_section, section, sizeof *section); ++ fake_reloc_section.virtual_size -= (end - reloc_base_end); ++ reloc_section = &fake_reloc_section; ++ } ++ } ++ ++ if (!reloc_section) ++ { ++ grub_dprintf ("chain", " section is not reloc section?\n"); ++ grub_dprintf ("chain", " rds: 0x%08x, vs: %08x\n", ++ section->raw_data_size, section->virtual_size); ++ grub_dprintf ("chain", " base: %p end: %p\n", base, end); ++ grub_dprintf ("chain", " reloc_base: %p reloc_base_end: %p\n", ++ reloc_base, reloc_base_end); ++ } ++ } ++ ++ grub_dprintf ("chain", " Section characteristics are %08x\n", ++ section->characteristics); ++ grub_dprintf ("chain", " Section virtual size: %08x\n", ++ section->virtual_size); ++ grub_dprintf ("chain", " Section raw_data size: %08x\n", ++ section->raw_data_size); ++ if (section->characteristics & GRUB_PE32_SCN_MEM_DISCARDABLE) ++ { ++ grub_dprintf ("chain", " Discarding section\n"); ++ continue; ++ } ++ ++ if (!base || !end) ++ { ++ grub_dprintf ("chain", " section is invalid\n"); ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid section size"); ++ goto error_exit; ++ } ++ ++ if (section->characteristics & GRUB_PE32_SCN_CNT_UNINITIALIZED_DATA) ++ { ++ if (section->raw_data_size != 0) ++ grub_dprintf ("chain", " UNINITIALIZED_DATA section has data?\n"); ++ } ++ else if (section->virtual_address < context.size_of_headers || ++ section->raw_data_offset < context.size_of_headers) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ "Section %d is inside image headers", i); ++ goto error_exit; ++ } ++ ++ if (section->raw_data_size > 0) ++ { ++ grub_dprintf ("chain", " copying 0x%08x bytes to %p\n", ++ section->raw_data_size, base); ++ grub_memcpy (base, ++ (grub_efi_uint8_t*)data + section->raw_data_offset, ++ section->raw_data_size); ++ } ++ ++ if (section->raw_data_size < section->virtual_size) ++ { ++ grub_dprintf ("chain", " padding with 0x%08x bytes at %p\n", ++ section->virtual_size - section->raw_data_size, ++ base + section->raw_data_size); ++ grub_memset (base + section->raw_data_size, 0, ++ section->virtual_size - section->raw_data_size); ++ } ++ ++ grub_dprintf ("chain", " finished section %s\n", name); ++ } ++ ++ /* 5 == EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC */ ++ if (context.number_of_rva_and_sizes <= 5) ++ { ++ grub_dprintf ("chain", "image has no relocation entry\n"); ++ goto error_exit; ++ } ++ ++ if (context.reloc_dir->size && reloc_section) ++ { ++ /* run the relocation fixups */ ++ efi_status = relocate_coff (&context, reloc_section, data, ++ buffer_aligned); ++ ++ if (efi_status != GRUB_EFI_SUCCESS) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "relocation failed"); ++ goto error_exit; ++ } ++ } ++ ++ if (!found_entry_point) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "entry point is not within sections"); ++ goto error_exit; ++ } ++ if (found_entry_point > 1) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "%d sections contain entry point", ++ found_entry_point); ++ goto error_exit; ++ } ++ ++ li = grub_efi_get_loaded_image (grub_efi_image_handle); ++ if (!li) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "no loaded image available"); ++ goto error_exit; ++ } ++ ++ grub_memcpy (&li_bak, li, sizeof (grub_efi_loaded_image_t)); ++ li->image_base = buffer_aligned; ++ li->image_size = context.image_size; ++ li->load_options = cmdline; ++ li->load_options_size = cmdline_len; ++ li->file_path = grub_efi_get_media_file_path (file_path); ++ li->device_handle = dev_handle; ++ if (!li->file_path) ++ { ++ grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found"); ++ goto error_exit; ++ } ++ ++ grub_dprintf ("chain", "booting via entry point\n"); ++ efi_status = entry_point (grub_efi_image_handle, ++ grub_efi_system_table); ++ ++ grub_dprintf ("chain", "entry_point returned %ld\n", efi_status); ++ grub_memcpy (li, &li_bak, sizeof (grub_efi_loaded_image_t)); ++ efi_status = b->free_pool (buffer); ++ ++ return 1; ++ ++error_exit: ++ grub_dprintf ("chain", "error_exit: grub_errno: %d\n", grub_errno); ++ if (buffer) ++ b->free_pool (buffer); ++ ++ return 0; ++} ++ ++static grub_err_t ++grub_secureboot_chainloader_unload (void) ++{ ++ grub_efi_boot_services_t *b; ++ ++ b = grub_efi_system_table->boot_services; ++ b->free_pages (address, pages); ++ grub_free (file_path); ++ grub_free (cmdline); ++ cmdline = 0; ++ file_path = 0; ++ dev_handle = 0; ++ ++ grub_dl_unref (my_mod); ++ return GRUB_ERR_NONE; ++} ++ ++static grub_err_t ++grub_load_and_start_image(void *boot_image) ++{ ++ grub_efi_boot_services_t *b; ++ grub_efi_status_t status; ++ grub_efi_loaded_image_t *loaded_image; ++ ++ b = grub_efi_system_table->boot_services; ++ ++ status = b->load_image (0, grub_efi_image_handle, file_path, ++ boot_image, fsize, &image_handle); ++ if (status != GRUB_EFI_SUCCESS) ++ { ++ if (status == GRUB_EFI_OUT_OF_RESOURCES) ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, "out of resources"); ++ else ++ grub_error (GRUB_ERR_BAD_OS, "cannot load image"); ++ return -1; ++ } ++ ++ /* LoadImage does not set a device handler when the image is ++ loaded from memory, so it is necessary to set it explicitly here. ++ This is a mess. */ ++ loaded_image = grub_efi_get_loaded_image (image_handle); ++ if (! loaded_image) ++ { ++ grub_error (GRUB_ERR_BAD_OS, "no loaded image available"); ++ return -1; ++ } ++ loaded_image->device_handle = dev_handle; ++ ++ if (cmdline) ++ { ++ loaded_image->load_options = cmdline; ++ loaded_image->load_options_size = cmdline_len; ++ } ++ ++ return 0; ++} ++ ++static grub_err_t ++grub_secureboot_chainloader_boot (void) ++{ ++ int rc; ++ rc = handle_image ((void *)(unsigned long)address, fsize); ++ if (rc == 0) ++ { ++ grub_load_and_start_image((void *)(unsigned long)address); ++ } ++ ++ grub_loader_unset (); ++ return grub_errno; ++} ++ + static grub_err_t + grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + int argc, char *argv[]) + { + grub_file_t file = 0; +- grub_ssize_t size; + grub_efi_status_t status; + grub_efi_boot_services_t *b; + grub_device_t dev = 0; +- grub_efi_device_path_t *dp = NULL, *file_path = NULL; +- grub_efi_loaded_image_t *loaded_image; ++ grub_efi_device_path_t *dp = NULL; + char *filename; + void *boot_image = 0; +- grub_efi_handle_t dev_handle = 0; +- grub_efi_physical_address_t address = 0; +- grub_efi_uintn_t pages = 0; +- grub_efi_char16_t *cmdline = NULL; +- grub_efi_handle_t image_handle = NULL; ++ int rc; ++ ++ file_path = NULL; ++ address = 0; ++ pages = 0; ++ cmdline = NULL; ++ image_handle = NULL; ++ dev_handle = 0; + + if (argc == 0) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); +@@ -236,12 +927,42 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + b = grub_efi_system_table->boot_services; + ++ if (argc > 1) ++ { ++ int i; ++ grub_efi_char16_t *p16; ++ ++ for (i = 1, cmdline_len = 0; i < argc; i++) ++ cmdline_len += grub_strlen (argv[i]) + 1; ++ ++ cmdline_len *= sizeof (grub_efi_char16_t); ++ cmdline = p16 = grub_malloc (cmdline_len); ++ if (! cmdline) ++ goto fail; ++ ++ for (i = 1; i < argc; i++) ++ { ++ char *p8; ++ ++ p8 = argv[i]; ++ while (*p8) ++ *(p16++) = *(p8++); ++ ++ *(p16++) = ' '; ++ } ++ *(--p16) = 0; ++ } ++ ++ + file = grub_file_open (filename, GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE); + if (! file) + goto fail; + +- /* Get the root device's device path. */ +- dev = grub_device_open (0); ++ /* Get the device path from filename. */ ++ char *devname = grub_file_get_device_name (filename); ++ dev = grub_device_open (devname); ++ if (devname) ++ grub_free (devname); + if (dev == NULL) + ; + else if (dev->disk) +@@ -272,19 +993,16 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + file_path = make_file_path (dp, filename); + if (file_path == NULL) + goto fail; +- +- grub_printf ("file path: "); +- grub_efi_print_device_path (file_path); + } + +- size = grub_file_size (file); +- if (!size) ++ fsize = grub_file_size (file); ++ if (!fsize) + { + grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), + filename); + goto fail; + } +- pages = (grub_efi_uintn_t) GRUB_EFI_BYTES_TO_PAGES (size); ++ pages = (grub_efi_uintn_t) GRUB_EFI_BYTES_TO_PAGES (fsize); + + status = b->allocate_pages (GRUB_EFI_ALLOCATE_ANY_PAGES, + GRUB_EFI_LOADER_CODE, +@@ -298,7 +1016,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + } + + boot_image = (void *) ((grub_addr_t) address); +- if (grub_file_read (file, boot_image, size) != size) ++ if (grub_file_read (file, boot_image, fsize) != fsize) + { + if (grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), +@@ -308,7 +1026,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + } + + #if defined (__i386__) || defined (__x86_64__) +- if (size >= (grub_ssize_t) sizeof (struct grub_macho_fat_header)) ++ if (fsize >= (grub_ssize_t) sizeof (struct grub_macho_fat_header)) + { + struct grub_macho_fat_header *head = boot_image; + if (head->magic +@@ -317,6 +1035,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_uint32_t i; + struct grub_macho_fat_arch *archs + = (struct grub_macho_fat_arch *) (head + 1); ++ ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ { ++ grub_error (GRUB_ERR_BAD_OS, ++ "MACHO binaries are forbidden with Secure Boot"); ++ goto fail; ++ } ++ + for (i = 0; i < grub_cpu_to_le32 (head->nfat_arch); i++) + { + if (GRUB_MACHO_CPUTYPE_IS_HOST_CURRENT (archs[i].cputype)) +@@ -331,83 +1057,39 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + > ~grub_cpu_to_le32 (archs[i].size) + || grub_cpu_to_le32 (archs[i].offset) + + grub_cpu_to_le32 (archs[i].size) +- > (grub_size_t) size) ++ > (grub_size_t) fsize) + { + grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"), + filename); + goto fail; + } + boot_image = (char *) boot_image + grub_cpu_to_le32 (archs[i].offset); +- size = grub_cpu_to_le32 (archs[i].size); ++ fsize = grub_cpu_to_le32 (archs[i].size); + } + } + #endif + +- status = b->load_image (0, grub_efi_image_handle, file_path, +- boot_image, size, +- &image_handle); +- if (status != GRUB_EFI_SUCCESS) ++ rc = grub_linuxefi_secure_validate((void *)(unsigned long)address, fsize); ++ grub_dprintf ("chain", "linuxefi_secure_validate: %d\n", rc); ++ if (rc > 0) + { +- if (status == GRUB_EFI_OUT_OF_RESOURCES) +- grub_error (GRUB_ERR_OUT_OF_MEMORY, "out of resources"); +- else +- grub_error (GRUB_ERR_BAD_OS, "cannot load image"); +- +- goto fail; ++ grub_file_close (file); ++ grub_device_close (dev); ++ grub_loader_set (grub_secureboot_chainloader_boot, ++ grub_secureboot_chainloader_unload, 0); ++ return 0; + } +- +- /* LoadImage does not set a device handler when the image is +- loaded from memory, so it is necessary to set it explicitly here. +- This is a mess. */ +- loaded_image = grub_efi_get_loaded_image (image_handle); +- if (! loaded_image) ++ else if (rc == 0) + { +- grub_error (GRUB_ERR_BAD_OS, "no loaded image available"); +- goto fail; +- } +- loaded_image->device_handle = dev_handle; +- +- /* Build load options with arguments from chainloader command line. */ +- if (argc > 1) +- { +- int i, len; +- grub_efi_char16_t *p16; +- +- for (i = 1, len = 0; i < argc; i++) +- len += grub_strlen (argv[i]) + 1; +- +- len *= sizeof (grub_efi_char16_t); +- cmdline = p16 = grub_malloc (len); +- if (! cmdline) +- goto fail; ++ grub_load_and_start_image(boot_image); ++ grub_file_close (file); ++ grub_device_close (dev); ++ grub_loader_set_ex (grub_chainloader_boot, grub_chainloader_unload, image_handle, 0); + +- for (i = 1; i < argc; i++) +- { +- char *p8; +- +- p8 = argv[i]; +- while (*p8) +- *(p16++) = *(p8++); +- +- *(p16++) = ' '; +- } +- *(--p16) = 0; +- +- loaded_image->load_options = cmdline; +- loaded_image->load_options_size = len; ++ return 0; + } + +- grub_file_close (file); +- grub_device_close (dev); +- +- /* We're finished with the source image buffer and file path now. */ +- b->free_pages (address, pages); +- grub_free (file_path); +- +- grub_loader_set_ex (grub_chainloader_boot, grub_chainloader_unload, image_handle, 0); +- return 0; +- +- fail: ++fail: + + if (dev) + grub_device_close (dev); +@@ -421,6 +1103,9 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + if (address) + grub_efi_free_pages (address, pages); + ++ if (cmdline) ++ grub_free (cmdline); ++ + if (image_handle != NULL) + b->unload_image (image_handle); + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 925394d1767..0a7f8208022 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -98,21 +98,36 @@ struct grub_efi_shim_lock + }; + typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; + +-grub_efi_boolean_t ++int + grub_linuxefi_secure_validate (void *data, grub_uint32_t size) + { + grub_guid_t guid = SHIM_LOCK_GUID; + grub_efi_shim_lock_t *shim_lock; ++ grub_efi_status_t status; + + shim_lock = grub_efi_locate_protocol(&guid, NULL); + ++ grub_dprintf ("secureboot", "shim_lock: %p\n", shim_lock); + if (!shim_lock) +- return 1; ++ { ++ grub_dprintf ("secureboot", "shim not available\n"); ++ return 0; ++ } + +- if (shim_lock->verify(data, size) == GRUB_EFI_SUCCESS) +- return 1; ++ grub_dprintf ("secureboot", "Asking shim to verify kernel signature\n"); ++ status = shim_lock->verify (data, size); ++ grub_dprintf ("secureboot", "shim_lock->verify(): %ld\n", (long int)status); ++ if (status == GRUB_EFI_SUCCESS) ++ { ++ grub_dprintf ("secureboot", "Kernel signature verification passed\n"); ++ return 1; ++ } ++ ++ grub_dprintf ("secureboot", "Kernel signature verification failed (0x%lx)\n", ++ (unsigned long) status); ++ ++ return -1; + +- return 0; + } + + #pragma GCC diagnostic push +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 9bfb4ab9e3e..b59d125286d 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -117,6 +117,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ grub_dprintf ("linux", "initrd_mem = %lx\n", (unsigned long) initrd_mem); ++ + params->ramdisk_size = size; + params->ramdisk_image = (grub_uint32_t)(grub_addr_t) initrd_mem; + +@@ -159,6 +161,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + struct linux_i386_kernel_header lh; + grub_ssize_t len, start, filelen; + void *kernel = NULL; ++ int rc; + + grub_dl_ref (my_mod); + +@@ -184,11 +187,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + if (grub_file_read (file, kernel, filelen) != filelen) + { +- grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), argv[0]); ++ grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), ++ argv[0]); + goto fail; + } + +- if (! grub_linuxefi_secure_validate (kernel, filelen)) ++ rc = grub_linuxefi_secure_validate (kernel, filelen); ++ if (rc < 0) + { + grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), + argv[0]); +@@ -203,6 +208,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ grub_dprintf ("linux", "params = %lx\n", (unsigned long) params); ++ + grub_memset (params, 0, 16384); + + grub_memcpy (&lh, kernel, sizeof (lh)); +@@ -241,6 +248,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ grub_dprintf ("linux", "linux_cmdline = %lx\n", ++ (unsigned long)linux_cmdline); ++ + grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); + grub_create_loader_cmdline (argc, argv, + linux_cmdline + sizeof (LINUX_IMAGE) - 1, +@@ -275,9 +285,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_memcpy (params, &lh, 2 * 512); + + params->type_of_loader = 0x21; ++ grub_dprintf("linux", "kernel_mem: %p handover_offset: %08x\n", ++ kernel_mem, handover_offset); + + fail: +- + if (file) + grub_file_close (file); + +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +index d224daafa4f..b2cfd8c1f44 100644 +--- a/include/grub/efi/linux.h ++++ b/include/grub/efi/linux.h +@@ -22,7 +22,7 @@ + #include + #include + +-grub_efi_boolean_t ++int + EXPORT_FUNC(grub_linuxefi_secure_validate) (void *data, grub_uint32_t size); + grub_err_t + EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset, +diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h +index 9887e14b278..a39743396dc 100644 +--- a/include/grub/efi/pe32.h ++++ b/include/grub/efi/pe32.h +@@ -238,7 +238,11 @@ struct grub_pe64_optional_header + struct grub_pe32_section_table + { + char name[8]; +- grub_uint32_t virtual_size; ++ union ++ { ++ grub_uint32_t physical_address; ++ grub_uint32_t virtual_size; ++ }; + grub_uint32_t virtual_address; + grub_uint32_t raw_data_size; + grub_uint32_t raw_data_offset; +@@ -249,12 +253,18 @@ struct grub_pe32_section_table + grub_uint32_t characteristics; + }; + ++#define GRUB_PE32_SCN_TYPE_NO_PAD 0x00000008 + #define GRUB_PE32_SCN_CNT_CODE 0x00000020 + #define GRUB_PE32_SCN_CNT_INITIALIZED_DATA 0x00000040 +-#define GRUB_PE32_SCN_MEM_DISCARDABLE 0x02000000 +-#define GRUB_PE32_SCN_MEM_EXECUTE 0x20000000 +-#define GRUB_PE32_SCN_MEM_READ 0x40000000 +-#define GRUB_PE32_SCN_MEM_WRITE 0x80000000 ++#define GRUB_PE32_SCN_CNT_UNINITIALIZED_DATA 0x00000080 ++#define GRUB_PE32_SCN_LNK_OTHER 0x00000100 ++#define GRUB_PE32_SCN_LNK_INFO 0x00000200 ++#define GRUB_PE32_SCN_LNK_REMOVE 0x00000800 ++#define GRUB_PE32_SCN_LNK_COMDAT 0x00001000 ++#define GRUB_PE32_SCN_GPREL 0x00008000 ++#define GRUB_PE32_SCN_MEM_16BIT 0x00020000 ++#define GRUB_PE32_SCN_MEM_LOCKED 0x00040000 ++#define GRUB_PE32_SCN_MEM_PRELOAD 0x00080000 + + #define GRUB_PE32_SCN_ALIGN_1BYTES 0x00100000 + #define GRUB_PE32_SCN_ALIGN_2BYTES 0x00200000 +@@ -263,10 +273,26 @@ struct grub_pe32_section_table + #define GRUB_PE32_SCN_ALIGN_16BYTES 0x00500000 + #define GRUB_PE32_SCN_ALIGN_32BYTES 0x00600000 + #define GRUB_PE32_SCN_ALIGN_64BYTES 0x00700000 ++#define GRUB_PE32_SCN_ALIGN_128BYTES 0x00800000 ++#define GRUB_PE32_SCN_ALIGN_256BYTES 0x00900000 ++#define GRUB_PE32_SCN_ALIGN_512BYTES 0x00A00000 ++#define GRUB_PE32_SCN_ALIGN_1024BYTES 0x00B00000 ++#define GRUB_PE32_SCN_ALIGN_2048BYTES 0x00C00000 ++#define GRUB_PE32_SCN_ALIGN_4096BYTES 0x00D00000 ++#define GRUB_PE32_SCN_ALIGN_8192BYTES 0x00E00000 + + #define GRUB_PE32_SCN_ALIGN_SHIFT 20 + #define GRUB_PE32_SCN_ALIGN_MASK 7 + ++#define GRUB_PE32_SCN_LNK_NRELOC_OVFL 0x01000000 ++#define GRUB_PE32_SCN_MEM_DISCARDABLE 0x02000000 ++#define GRUB_PE32_SCN_MEM_NOT_CACHED 0x04000000 ++#define GRUB_PE32_SCN_MEM_NOT_PAGED 0x08000000 ++#define GRUB_PE32_SCN_MEM_SHARED 0x10000000 ++#define GRUB_PE32_SCN_MEM_EXECUTE 0x20000000 ++#define GRUB_PE32_SCN_MEM_READ 0x40000000 ++#define GRUB_PE32_SCN_MEM_WRITE 0x80000000 ++ + #define GRUB_PE32_SIGNATURE_SIZE 4 + + #if GRUB_TARGET_SIZEOF_VOID_P == 8 +@@ -292,6 +318,21 @@ struct grub_pe_image_header + #endif + }; + ++struct grub_pe32_header_32 ++{ ++ char signature[GRUB_PE32_SIGNATURE_SIZE]; ++ struct grub_pe32_coff_header coff_header; ++ struct grub_pe32_optional_header optional_header; ++}; ++ ++struct grub_pe32_header_64 ++{ ++ char signature[GRUB_PE32_SIGNATURE_SIZE]; ++ struct grub_pe32_coff_header coff_header; ++ struct grub_pe64_optional_header optional_header; ++}; ++ ++ + struct grub_pe32_fixup_block + { + grub_uint32_t page_rva; diff --git a/0216-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch b/0216-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch new file mode 100644 index 0000000..8313e06 --- /dev/null +++ b/0216-Make-any-of-the-loaders-that-link-in-efi-mode-honor-.patch @@ -0,0 +1,317 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 13 Feb 2024 16:30:24 -0600 +Subject: [PATCH] Make any of the loaders that link in efi mode honor secure + boot. + +And in this case "honor" means "even if somebody does link this in, they +won't register commands if SB is enabled." + +Signed-off-by: Peter Jones +--- + grub-core/commands/iorw.c | 7 +++++++ + grub-core/commands/memrw.c | 7 +++++++ + grub-core/kern/dl.c | 4 ++-- + grub-core/loader/efi/appleloader.c | 7 +++++++ + grub-core/loader/i386/bsd.c | 7 +++++++ + grub-core/loader/i386/linux.c | 7 +++++++ + grub-core/loader/i386/pc/linux.c | 7 +++++++ + grub-core/loader/multiboot.c | 7 +++++++ + grub-core/loader/xnu.c | 7 +++++++ + include/grub/ia64/linux.h | 0 + include/grub/mips/linux.h | 0 + include/grub/powerpc/linux.h | 0 + include/grub/sparc64/linux.h | 0 + 13 files changed, 58 insertions(+), 2 deletions(-) + create mode 100644 include/grub/ia64/linux.h + create mode 100644 include/grub/mips/linux.h + create mode 100644 include/grub/powerpc/linux.h + create mode 100644 include/grub/sparc64/linux.h + +diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c +index 584baec8f91..7b2999b14b5 100644 +--- a/grub-core/commands/iorw.c ++++ b/grub-core/commands/iorw.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -119,6 +120,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv) + + GRUB_MOD_INIT(memrw) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_read_byte = + grub_register_extcmd ("inb", grub_cmd_read, 0, + N_("PORT"), N_("Read 8-bit value from PORT."), +@@ -147,6 +151,9 @@ GRUB_MOD_INIT(memrw) + + GRUB_MOD_FINI(memrw) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_extcmd (cmd_read_byte); + grub_unregister_extcmd (cmd_read_word); + grub_unregister_extcmd (cmd_read_dword); +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index d401a6db0ef..39cf3a06dbd 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -121,6 +122,9 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv) + + GRUB_MOD_INIT(memrw) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_read_byte = + grub_register_extcmd ("read_byte", grub_cmd_read, 0, + N_("ADDR"), N_("Read 8-bit value from ADDR."), +@@ -149,6 +153,9 @@ GRUB_MOD_INIT(memrw) + + GRUB_MOD_FINI(memrw) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_extcmd (cmd_read_byte); + grub_unregister_extcmd (cmd_read_word); + grub_unregister_extcmd (cmd_read_dword); +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index d48d4131ba7..2a9ae9fc894 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -871,13 +871,13 @@ grub_dl_load_file (const char *filename) + grub_dl_t mod = 0; + + #ifdef GRUB_MACHINE_EFI +- if (grub_efi_get_secureboot ()) ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) + { + #if 0 + /* This is an error, but grub2-mkconfig still generates a pile of + * insmod commands, so emitting it would be mostly just obnoxious. */ + grub_error (GRUB_ERR_ACCESS_DENIED, +- "Secure Boot forbids loading module from %s", filename); ++ "Secure Boot forbids loading module from %s", filename); + #endif + return 0; + } +diff --git a/grub-core/loader/efi/appleloader.c b/grub-core/loader/efi/appleloader.c +index a0b61a240b7..35d53c5f85d 100644 +--- a/grub-core/loader/efi/appleloader.c ++++ b/grub-core/loader/efi/appleloader.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -227,6 +228,9 @@ static grub_command_t cmd; + + GRUB_MOD_INIT(appleloader) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd = grub_register_command ("appleloader", grub_cmd_appleloader, + N_("[OPTS]"), + /* TRANSLATORS: This command is used on EFI to +@@ -238,5 +242,8 @@ GRUB_MOD_INIT(appleloader) + + GRUB_MOD_FINI(appleloader) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_command (cmd); + } +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index 1f9128f6f20..8075ac9b06a 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -40,6 +40,7 @@ + #ifdef GRUB_MACHINE_PCBIOS + #include + #endif ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -2137,6 +2138,9 @@ static grub_command_t cmd_netbsd_module_elf, cmd_openbsd_ramdisk; + + GRUB_MOD_INIT (bsd) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + /* Net and OpenBSD kernels are often compressed. */ + grub_dl_load ("gzio"); + +@@ -2176,6 +2180,9 @@ GRUB_MOD_INIT (bsd) + + GRUB_MOD_FINI (bsd) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_extcmd (cmd_freebsd); + grub_unregister_extcmd (cmd_openbsd); + grub_unregister_extcmd (cmd_netbsd); +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 10f967f2563..5a257552234 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1164,6 +1165,9 @@ static grub_command_t cmd_linux, cmd_initrd; + + GRUB_MOD_INIT(linux) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_linux = grub_register_command ("linux", grub_cmd_linux, + 0, N_("Load Linux.")); + cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd, +@@ -1173,6 +1177,9 @@ GRUB_MOD_INIT(linux) + + GRUB_MOD_FINI(linux) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_command (cmd_linux); + grub_unregister_command (cmd_initrd); + } +diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c +index 8593d74737f..54a76504a79 100644 +--- a/grub-core/loader/i386/pc/linux.c ++++ b/grub-core/loader/i386/pc/linux.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -487,6 +488,9 @@ static grub_command_t cmd_linux, cmd_linux16, cmd_initrd, cmd_initrd16; + + GRUB_MOD_INIT(linux16) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_linux = + grub_register_command ("linux", grub_cmd_linux, + 0, N_("Load Linux.")); +@@ -504,6 +508,9 @@ GRUB_MOD_INIT(linux16) + + GRUB_MOD_FINI(linux16) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_command (cmd_linux); + grub_unregister_command (cmd_linux16); + grub_unregister_command (cmd_initrd); +diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c +index 94be512c4d0..94c112a29d4 100644 +--- a/grub-core/loader/multiboot.c ++++ b/grub-core/loader/multiboot.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -444,6 +445,9 @@ static grub_command_t cmd_multiboot, cmd_module; + + GRUB_MOD_INIT(multiboot) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_multiboot = + #ifdef GRUB_USE_MULTIBOOT2 + grub_register_command ("multiboot2", grub_cmd_multiboot, +@@ -464,6 +468,9 @@ GRUB_MOD_INIT(multiboot) + + GRUB_MOD_FINI(multiboot) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + grub_unregister_command (cmd_multiboot); + grub_unregister_command (cmd_module); + } +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index 4cca55df92d..f76f511ac2d 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1497,6 +1498,9 @@ static grub_extcmd_t cmd_splash; + + GRUB_MOD_INIT(xnu) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + cmd_kernel = grub_register_command ("xnu_kernel", grub_cmd_xnu_kernel, 0, + N_("Load XNU image.")); + cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64, +@@ -1540,6 +1544,9 @@ GRUB_MOD_INIT(xnu) + + GRUB_MOD_FINI(xnu) + { ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) ++ return; ++ + #ifndef GRUB_MACHINE_EMU + grub_unregister_command (cmd_resume); + #endif +diff --git a/include/grub/ia64/linux.h b/include/grub/ia64/linux.h +new file mode 100644 +index 00000000000..e69de29bb2d +diff --git a/include/grub/mips/linux.h b/include/grub/mips/linux.h +new file mode 100644 +index 00000000000..e69de29bb2d +diff --git a/include/grub/powerpc/linux.h b/include/grub/powerpc/linux.h +new file mode 100644 +index 00000000000..e69de29bb2d +diff --git a/include/grub/sparc64/linux.h b/include/grub/sparc64/linux.h +new file mode 100644 +index 00000000000..e69de29bb2d diff --git a/0205-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch b/0217-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch similarity index 80% rename from 0205-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch rename to 0217-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch index 0474422..428737c 100644 --- a/0205-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch +++ b/0217-Minimize-the-sort-ordering-for-.debug-and-rescue-ker.patch @@ -1,8 +1,7 @@ -From 00836ac9326088994cfb65537495c7cfbc770f83 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 4 Sep 2014 15:52:08 -0400 -Subject: [PATCH 205/272] Minimize the sort ordering for .debug and -rescue- - kernels. +Subject: [PATCH] Minimize the sort ordering for .debug and -rescue- kernels. Resolves: rhbz#1065360 Signed-off-by: Peter Jones @@ -11,10 +10,10 @@ Signed-off-by: Peter Jones 1 file changed, 8 insertions(+) diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in -index a4145d435..1d3581dcf 100644 +index c2e107b41ab..4eadcba4b85 100644 --- a/util/grub-mkconfig_lib.in +++ b/util/grub-mkconfig_lib.in -@@ -305,6 +305,14 @@ version_test_gt () +@@ -299,6 +299,14 @@ version_test_gt () *.old:*.old) ;; *.old:*) version_test_gt_a="`echo "$version_test_gt_a" | sed -e 's/\.old$//'`" ; version_test_gt_cmp=gt ;; *:*.old) version_test_gt_b="`echo "$version_test_gt_b" | sed -e 's/\.old$//'`" ; version_test_gt_cmp=ge ;; @@ -29,6 +28,3 @@ index a4145d435..1d3581dcf 100644 esac version_test_numeric "$version_test_gt_a" "$version_test_gt_cmp" "$version_test_gt_b" return "$?" --- -2.41.0 - diff --git a/0218-Add-grub_qdprintf-grub_dprintf-without-the-file-line.patch b/0218-Add-grub_qdprintf-grub_dprintf-without-the-file-line.patch new file mode 100644 index 0000000..c0f1707 --- /dev/null +++ b/0218-Add-grub_qdprintf-grub_dprintf-without-the-file-line.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 28 Jun 2015 13:09:58 -0400 +Subject: [PATCH] Add grub_qdprintf() - grub_dprintf() without the file+line + number. + +This just makes copy+paste of our debug loading info easier. + +Signed-off-by: Peter Jones +--- + grub-core/kern/misc.c | 18 ++++++++++++++++++ + include/grub/misc.h | 2 ++ + 2 files changed, 20 insertions(+) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 96ab7c96b52..98700423d79 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -280,6 +280,24 @@ grub_real_dprintf (const char *file, const int line, const char *condition, + } + } + ++void ++grub_qdprintf (const char *condition, const char *fmt, ...) ++{ ++ va_list args; ++ const char *debug = grub_env_get ("debug"); ++ ++ if (! debug) ++ return; ++ ++ if (grub_strword (debug, "all") || grub_strword (debug, condition)) ++ { ++ va_start (args, fmt); ++ grub_vprintf (fmt, args); ++ va_end (args); ++ grub_refresh (); ++ } ++} ++ + #define PREALLOC_SIZE 255 + + int +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 3e9a00f0a9c..db517acd592 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -386,6 +386,8 @@ void EXPORT_FUNC(grub_real_dprintf) (const char *file, + const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 4, 5))); + int EXPORT_FUNC(grub_printf) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); + int EXPORT_FUNC(grub_printf_) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); ++void EXPORT_FUNC(grub_qdprintf) (const char *condition, ++ const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 2, 3))); + int EXPORT_FUNC(grub_vprintf) (const char *fmt, va_list args); + int EXPORT_FUNC(grub_snprintf) (char *str, grub_size_t n, const char *fmt, ...) + __attribute__ ((format (GNU_PRINTF, 3, 4))); diff --git a/0219-Make-a-gdb-dprintf-that-tells-us-load-addresses.patch b/0219-Make-a-gdb-dprintf-that-tells-us-load-addresses.patch new file mode 100644 index 0000000..c7d42e4 --- /dev/null +++ b/0219-Make-a-gdb-dprintf-that-tells-us-load-addresses.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 4 Apr 2024 11:57:54 -0600 +Subject: [PATCH] Make a "gdb" dprintf that tells us load addresses. + +This makes a grub_dprintf() call during platform init and during module +loading that tells us the virtual addresses of the .text and .data +sections of grub-core/kernel.exec and any modules it loads. + +Specifically, it displays them in the gdb "add-symbol-file" syntax, with +the presumption that there's a variable $grubdir that reflects the path +to any such binaries. + +Signed-off-by: Peter Jones +--- + grub-core/kern/dl.c | 34 ++++++++++++++++++++++++++++++++++ + grub-core/kern/efi/init.c | 1 + + 2 files changed, 35 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 2a9ae9fc894..2eaef7150ed 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -690,6 +690,38 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + return GRUB_ERR_NONE; + } + ++static void ++grub_dl_print_gdb_info (grub_dl_t mod, Elf_Ehdr *e) ++{ ++ void *text, *data = NULL; ++ long idx; ++ ++ idx = grub_dl_find_section_index (e, ".text"); ++ if (idx < 0) ++ return; ++ ++ text = grub_dl_get_section_addr (mod, idx); ++ if (!text) ++ return; ++ ++ idx = grub_dl_find_section_index (e, ".data"); ++ if (idx >= 0) ++ data = grub_dl_get_section_addr (mod, idx); ++ ++ if (data) ++ grub_qdprintf ("gdb", "add-symbol-file \\\n" ++ "/usr/lib/debug/usr/lib/grub/%s-%s/%s.debug " ++ "\\\n %p -s .data %p\n", ++ GRUB_TARGET_CPU, GRUB_PLATFORM, ++ mod->name, text, data); ++ else ++ grub_qdprintf ("gdb", "add-symbol-file \\\n" ++ "/usr/lib/debug/usr/lib/grub/%s-%s/%s.debug " ++ "\\\n%p\n", ++ GRUB_TARGET_CPU, GRUB_PLATFORM, ++ mod->name, text); ++} ++ + static grub_err_t + grub_dl_set_mem_attrs (grub_dl_t mod, void *ehdr) + { +@@ -833,6 +865,8 @@ grub_dl_load_core_noinit (void *addr, grub_size_t size) + grub_dprintf ("modules", "module name: %s\n", mod->name); + grub_dprintf ("modules", "init function: %p\n", mod->init); + ++ grub_dl_print_gdb_info (mod, e); ++ + if (grub_dl_add (mod)) + { + grub_dl_unload (mod); +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index dee3918fd35..d35d6974734 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -157,6 +157,7 @@ grub_efi_init (void) + grub_efi_system_table->boot_services->set_watchdog_timer (0, 0, 0, NULL); + + grub_efi_env_init (); ++ grub_efi_print_gdb_info (); + grub_efidisk_init (); + + grub_efi_register_debug_commands (); diff --git a/0088-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch b/0220-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch similarity index 66% rename from 0088-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch rename to 0220-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch index fd82269..0284cc6 100644 --- a/0088-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch +++ b/0220-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch @@ -1,55 +1,46 @@ -From 4024e8c493deeeeee89ecfe3b8dfae8b7cae3d4d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 8 Jul 2019 12:32:37 +0200 -Subject: [PATCH 088/272] Handle multi-arch (64-on-32) boot in linuxefi loader. +Subject: [PATCH] Handle multi-arch (64-on-32) boot in linuxefi loader. Allow booting 64-bit kernels on 32-bit EFI on x86. Signed-off-by: Peter Jones --- - grub-core/loader/efi/linux_boot.c | 11 ++- - grub-core/loader/i386/efi/linux.c | 127 +++++++++++++++++++----------- + grub-core/loader/efi/linux.c | 9 ++- + grub-core/loader/i386/efi/linux.c | 116 ++++++++++++++++++++++++++------------ include/grub/i386/linux.h | 5 ++ - 3 files changed, 96 insertions(+), 47 deletions(-) + 3 files changed, 91 insertions(+), 39 deletions(-) -diff --git a/grub-core/loader/efi/linux_boot.c b/grub-core/loader/efi/linux_boot.c -index 442627dc2..9265cf420 100644 ---- a/grub-core/loader/efi/linux_boot.c -+++ b/grub-core/loader/efi/linux_boot.c -@@ -30,11 +30,16 @@ +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 0a7f8208022..742e8e9af35 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -136,12 +136,17 @@ grub_linuxefi_secure_validate (void *data, grub_uint32_t size) typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); grub_err_t --grub_efi_linux_boot (void *kernel_addr, grub_off_t offset, -+grub_efi_linux_boot (void *kernel_addr, grub_off_t handover_offset, +-grub_efi_linux_boot (void *kernel_address, grub_off_t offset, ++grub_efi_linux_boot (void *kernel_address, grub_off_t handover_offset, void *kernel_params) { - grub_efi_loaded_image_t *loaded_image = NULL; handover_func hf; + int offset = 0; -+ + +- hf = (handover_func)((char *)kernel_address + offset); +#ifdef __x86_64__ + offset = 512; +#endif - - /* - * Since the EFI loader is not calling the LoadImage() and StartImage() -@@ -48,8 +53,8 @@ grub_efi_linux_boot (void *kernel_addr, grub_off_t offset, - grub_dprintf ("linux", "Loaded Image base address could not be set\n"); - - grub_dprintf ("linux", "kernel_addr: %p handover_offset: %p params: %p\n", -- kernel_addr, (void *)(grub_efi_uintn_t)offset, kernel_params); -- hf = (handover_func)((char *)kernel_addr + offset); -+ kernel_addr, (void *)(grub_efi_uintn_t)handover_offset, kernel_params); -+ hf = (handover_func)((char *)kernel_addr + handover_offset + offset); ++ ++ hf = (handover_func)((char *)kernel_address + handover_offset + offset); hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); return GRUB_ERR_BUG; diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 1e09c88ab..0b3d20875 100644 +index b59d125286d..3c2e30f8751 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c -@@ -44,14 +44,10 @@ static char *linux_cmdline; +@@ -44,15 +44,11 @@ static char *linux_cmdline; static grub_err_t grub_linuxefi_boot (void) { @@ -61,12 +52,14 @@ index 1e09c88ab..0b3d20875 100644 asm volatile ("cli"); - return grub_efi_linux_boot ((char *)kernel_mem, handover_offset + offset, +- params); + return grub_efi_linux_boot ((char *)kernel_mem, + handover_offset, - params); ++ params); } -@@ -147,14 +143,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + static grub_err_t +@@ -153,14 +149,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), return grub_errno; } @@ -77,7 +70,7 @@ index 1e09c88ab..0b3d20875 100644 + static grub_err_t grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - int argc, char *argv[]) + int argc, char *argv[]) { grub_file_t file = 0; - struct linux_i386_kernel_header lh; @@ -86,10 +79,10 @@ index 1e09c88ab..0b3d20875 100644 + grub_ssize_t start, filelen; void *kernel = NULL; + int setup_header_end_offset; - grub_err_t err; + int rc; grub_dl_ref (my_mod); -@@ -185,45 +187,79 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -200,48 +202,79 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), goto fail; } @@ -103,15 +96,15 @@ index 1e09c88ab..0b3d20875 100644 goto fail; } +- grub_dprintf ("linux", "params = %lx\n", (unsigned long) params); ++ grub_dprintf ("linux", "params = %p\n", params); + - grub_memset (params, 0, 16384); -- ++ grub_memset (params, 0, sizeof(*params)); + - grub_memcpy (&lh, kernel, sizeof (lh)); - - if (lh.boot_flag != grub_cpu_to_le16 (0xaa55)) -+ grub_dprintf ("linux", "params = %p\n", params); -+ -+ grub_memset (params, 0, sizeof(*params)); -+ + setup_header_end_offset = *((grub_uint8_t *)kernel + 0x201); + grub_dprintf ("linux", "copying %lu bytes from %p to %p\n", + MIN((grub_size_t)0x202+setup_header_end_offset, @@ -154,8 +147,6 @@ index 1e09c88ab..0b3d20875 100644 goto fail; } -- linux_cmdline = grub_efi_allocate_pages_max(0x3fffffff, -- BYTES_TO_PAGES(lh.cmdline_size + 1)); +#if defined(__x86_64__) || defined(__aarch64__) + grub_dprintf ("linux", "checking lh->xloadflags\n"); + if (!(lh->xloadflags & LINUX_XLF_KERNEL_64)) @@ -174,22 +165,23 @@ index 1e09c88ab..0b3d20875 100644 + goto fail; + } +#endif - -+ grub_dprintf ("linux", "setting up cmdline\n"); -+ linux_cmdline = grub_efi_allocate_pages_max(0x3fffffff, ++ + grub_dprintf ("linux", "setting up cmdline\n"); + linux_cmdline = grub_efi_allocate_pages_max(0x3fffffff, +- BYTES_TO_PAGES(lh.cmdline_size + 1)); +- + BYTES_TO_PAGES(lh->cmdline_size + 1)); if (!linux_cmdline) { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate cmdline")); -@@ -233,27 +269,26 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -254,22 +287,24 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); - err = grub_create_loader_cmdline (argc, argv, + grub_create_loader_cmdline (argc, argv, linux_cmdline + sizeof (LINUX_IMAGE) - 1, -- lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1), +- lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1), +- GRUB_VERIFY_KERNEL_CMDLINE); + lh->cmdline_size - (sizeof (LINUX_IMAGE) - 1), - GRUB_VERIFY_KERNEL_CMDLINE); - if (err) - goto fail; ++ GRUB_VERIFY_KERNEL_CMDLINE); - lh.cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline; + grub_dprintf ("linux", "cmdline:%s\n", linux_cmdline); @@ -204,23 +196,19 @@ index 1e09c88ab..0b3d20875 100644 - len = grub_file_size(file) - start; + start = (lh->setup_sects + 1) * 512; -- kernel_mem = grub_efi_allocate_fixed (lh.pref_address, -- BYTES_TO_PAGES(lh.init_size)); +- kernel_mem = grub_efi_allocate_pages_max(lh.pref_address, +- BYTES_TO_PAGES(lh.init_size)); + kernel_mem = grub_efi_allocate_pages_max(lh->pref_address, + BYTES_TO_PAGES(lh->init_size)); if (!kernel_mem) -- { -- grub_errno = GRUB_ERR_NONE; -- kernel_mem = grub_efi_allocate_pages_max(0x3fffffff, -- BYTES_TO_PAGES(lh.init_size)); -- } -+ kernel_mem = grub_efi_allocate_pages_max(0x3fffffff, + kernel_mem = grub_efi_allocate_pages_max(0x3fffffff, +- BYTES_TO_PAGES(lh.init_size)); + BYTES_TO_PAGES(lh->init_size)); if (!kernel_mem) { -@@ -261,21 +296,23 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -277,14 +312,21 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), goto fail; } @@ -233,42 +221,35 @@ index 1e09c88ab..0b3d20875 100644 + lh->code32_start = (grub_uint32_t)(grub_addr_t) kernel_mem; - lh.code32_start = (grub_uint32_t)(grub_uint64_t) kernel_mem; -- /* Grub linuxefi erroneously initialize linux's boot_params with non-zero values. (bsc#1025563) +- grub_memcpy (params, &lh, 2 * 512); + grub_memcpy (kernel_mem, (char *)kernel + start, filelen - start); -- From https://www.kernel.org/doc/Documentation/x86/boot.txt: -- The memory for struct boot_params could be allocated anywhere (even above 4G) -- and initialized to all zero. -- Then, the setup header at offset 0x01f1 of kernel image on should be -- loaded into struct boot_params and examined. */ -- grub_memcpy (¶ms->setup_sects, &lh.setup_sects, sizeof (lh) - 0x01f1); +- params->type_of_loader = 0x21; + grub_dprintf ("linux", "setting lh->type_of_loader\n"); + lh->type_of_loader = 0x6; - -- params->type_of_loader = 0x21; ++ + grub_dprintf ("linux", "setting lh->ext_loader_{type,ver}\n"); + params->ext_loader_type = 0; + params->ext_loader_ver = 2; -+ grub_dprintf("linux", "kernel_mem: %p handover_offset: %08x\n", -+ kernel_mem, handover_offset); - - fail: + grub_dprintf("linux", "kernel_mem: %p handover_offset: %08x\n", + kernel_mem, handover_offset); -@@ -291,8 +328,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -301,10 +343,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), loaded = 0; } - if (linux_cmdline && !loaded) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)linux_cmdline, BYTES_TO_PAGES(lh.cmdline_size + 1)); + if (linux_cmdline && lh && !loaded) -+ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) + grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) +- linux_cmdline, +- BYTES_TO_PAGES(lh.cmdline_size + 1)); + linux_cmdline, + BYTES_TO_PAGES(lh->cmdline_size + 1)); if (kernel_mem && !loaded) - grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, BYTES_TO_PAGES(kernel_size)); + grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, diff --git a/include/grub/i386/linux.h b/include/grub/i386/linux.h -index d4b550869..4ccd9d7d9 100644 +index d4b55086953..4ccd9d7d9f2 100644 --- a/include/grub/i386/linux.h +++ b/include/grub/i386/linux.h @@ -148,6 +148,11 @@ struct linux_i386_kernel_header @@ -283,6 +264,3 @@ index d4b550869..4ccd9d7d9 100644 grub_uint16_t xloadflags; grub_uint32_t cmdline_size; grub_uint32_t hardware_subarch; --- -2.41.0 - diff --git a/0089-Try-to-pick-better-locations-for-kernel-and-initrd.patch b/0221-Try-to-pick-better-locations-for-kernel-and-initrd.patch similarity index 81% rename from 0089-Try-to-pick-better-locations-for-kernel-and-initrd.patch rename to 0221-Try-to-pick-better-locations-for-kernel-and-initrd.patch index 95f793c..2927f4b 100644 --- a/0089-Try-to-pick-better-locations-for-kernel-and-initrd.patch +++ b/0221-Try-to-pick-better-locations-for-kernel-and-initrd.patch @@ -1,7 +1,7 @@ -From 2fedd2607d7b59fa43430b97a1f2f8c279500a39 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 11 Jul 2019 17:17:02 +0200 -Subject: [PATCH 089/272] Try to pick better locations for kernel and initrd +Subject: [PATCH] Try to pick better locations for kernel and initrd - Don't limit allocations on 64-bit platforms to < 0x[37f]fffffff if we're using the "large" code model ; use __UINTPTR_MAX__. @@ -23,18 +23,22 @@ Additionally, we now try to locate kernel+initrd+cmdline+etc below we try a higher address. Signed-off-by: Peter Jones +[david.abdurachmanov: fix macro for riscv64] +Signed-off-by: David Abdurachmanov +Signed-off-by: Robbie Harwood --- grub-core/kern/efi/mm.c | 8 ++++---- - grub-core/loader/i386/efi/linux.c | 25 +++++++++++++++++-------- + grub-core/loader/i386/efi/linux.c | 24 +++++++++++++++++------- include/grub/arm/efi/memory.h | 1 + include/grub/arm64/efi/memory.h | 1 + include/grub/i386/efi/memory.h | 1 + include/grub/ia64/efi/memory.h | 1 + + include/grub/riscv64/efi/memory.h | 1 + include/grub/x86_64/efi/memory.h | 4 +++- - 7 files changed, 28 insertions(+), 13 deletions(-) + 8 files changed, 29 insertions(+), 12 deletions(-) diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c -index dfd18613a..9b1d3add7 100644 +index fb9dbf52528..8f75205a732 100644 --- a/grub-core/kern/efi/mm.c +++ b/grub-core/kern/efi/mm.c @@ -121,7 +121,7 @@ grub_efi_allocate_pages_max (grub_efi_physical_address_t max, @@ -46,7 +50,7 @@ index dfd18613a..9b1d3add7 100644 return 0; b = grub_efi_system_table->boot_services; -@@ -481,7 +481,7 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map, +@@ -477,7 +477,7 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map, { if (desc->type == GRUB_EFI_CONVENTIONAL_MEMORY #if 1 @@ -55,7 +59,7 @@ index dfd18613a..9b1d3add7 100644 #endif && desc->physical_start + PAGES_TO_BYTES (desc->num_pages) > 0x100000 && desc->num_pages != 0) -@@ -499,9 +499,9 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map, +@@ -495,9 +495,9 @@ filter_memory_map (grub_efi_memory_descriptor_t *memory_map, #if 1 if (BYTES_TO_PAGES (filtered_desc->physical_start) + filtered_desc->num_pages @@ -68,7 +72,7 @@ index dfd18613a..9b1d3add7 100644 #endif diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 0b3d20875..f3abbd025 100644 +index 3c2e30f8751..9e5dca9458a 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -27,6 +27,7 @@ @@ -79,19 +83,18 @@ index 0b3d20875..f3abbd025 100644 GRUB_MOD_LICENSE ("GPLv3+"); -@@ -102,8 +103,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -106,7 +107,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), size += ALIGN_UP (grub_file_size (files[i]), 4); } - initrd_mem = grub_efi_allocate_pages_max (0x3fffffff, BYTES_TO_PAGES(size)); -- + initrd_mem = grub_efi_allocate_pages_max (GRUB_EFI_MAX_ALLOCATION_ADDRESS, BYTES_TO_PAGES(size)); + if (!initrd_mem) + initrd_mem = grub_efi_allocate_pages_max (GRUB_EFI_MAX_USABLE_ADDRESS, BYTES_TO_PAGES(size)); if (!initrd_mem) { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate initrd")); -@@ -187,8 +189,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -202,8 +205,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), goto fail; } @@ -104,7 +107,7 @@ index 0b3d20875..f3abbd025 100644 if (! params) { grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate kernel parameters"); -@@ -258,8 +263,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -273,8 +279,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), #endif grub_dprintf ("linux", "setting up cmdline\n"); @@ -118,7 +121,7 @@ index 0b3d20875..f3abbd025 100644 if (!linux_cmdline) { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate cmdline")); -@@ -285,11 +293,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -301,11 +310,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), kernel_mem = grub_efi_allocate_pages_max(lh->pref_address, BYTES_TO_PAGES(lh->init_size)); @@ -135,7 +138,7 @@ index 0b3d20875..f3abbd025 100644 { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate kernel")); diff --git a/include/grub/arm/efi/memory.h b/include/grub/arm/efi/memory.h -index 2c64918e3..a4c2ec835 100644 +index 2c64918e3f7..a4c2ec83502 100644 --- a/include/grub/arm/efi/memory.h +++ b/include/grub/arm/efi/memory.h @@ -2,5 +2,6 @@ @@ -146,7 +149,7 @@ index 2c64918e3..a4c2ec835 100644 #endif /* ! GRUB_MEMORY_CPU_HEADER */ diff --git a/include/grub/arm64/efi/memory.h b/include/grub/arm64/efi/memory.h -index c6cb32417..acb61dca4 100644 +index c6cb3241714..acb61dca44b 100644 --- a/include/grub/arm64/efi/memory.h +++ b/include/grub/arm64/efi/memory.h @@ -2,5 +2,6 @@ @@ -157,7 +160,7 @@ index c6cb32417..acb61dca4 100644 #endif /* ! GRUB_MEMORY_CPU_HEADER */ diff --git a/include/grub/i386/efi/memory.h b/include/grub/i386/efi/memory.h -index 2c64918e3..a4c2ec835 100644 +index 2c64918e3f7..a4c2ec83502 100644 --- a/include/grub/i386/efi/memory.h +++ b/include/grub/i386/efi/memory.h @@ -2,5 +2,6 @@ @@ -168,7 +171,7 @@ index 2c64918e3..a4c2ec835 100644 #endif /* ! GRUB_MEMORY_CPU_HEADER */ diff --git a/include/grub/ia64/efi/memory.h b/include/grub/ia64/efi/memory.h -index 2c64918e3..a4c2ec835 100644 +index 2c64918e3f7..a4c2ec83502 100644 --- a/include/grub/ia64/efi/memory.h +++ b/include/grub/ia64/efi/memory.h @@ -2,5 +2,6 @@ @@ -177,9 +180,20 @@ index 2c64918e3..a4c2ec835 100644 #define GRUB_EFI_MAX_USABLE_ADDRESS 0xffffffff +#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS + #endif /* ! GRUB_MEMORY_CPU_HEADER */ +diff --git a/include/grub/riscv64/efi/memory.h b/include/grub/riscv64/efi/memory.h +index c6cb3241714..acb61dca44b 100644 +--- a/include/grub/riscv64/efi/memory.h ++++ b/include/grub/riscv64/efi/memory.h +@@ -2,5 +2,6 @@ + #include + + #define GRUB_EFI_MAX_USABLE_ADDRESS 0xffffffffffffULL ++#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS + #endif /* ! GRUB_MEMORY_CPU_HEADER */ diff --git a/include/grub/x86_64/efi/memory.h b/include/grub/x86_64/efi/memory.h -index 46e9145a3..e81cfb322 100644 +index 46e9145a308..e81cfb32213 100644 --- a/include/grub/x86_64/efi/memory.h +++ b/include/grub/x86_64/efi/memory.h @@ -2,9 +2,11 @@ @@ -195,6 +209,3 @@ index 46e9145a3..e81cfb322 100644 #endif #endif /* ! GRUB_MEMORY_CPU_HEADER */ --- -2.41.0 - diff --git a/0090-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch b/0222-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch similarity index 86% rename from 0090-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch rename to 0222-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch index 51857df..83c02c9 100644 --- a/0090-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch +++ b/0222-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch @@ -1,19 +1,18 @@ -From 6c342a7bf439b7c93809769caf425f31038bc5c6 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 12 Jul 2019 09:53:32 +0200 -Subject: [PATCH 090/272] x86-efi: Use bounce buffers for reading to addresses - > 4GB +Subject: [PATCH] x86-efi: Use bounce buffers for reading to addresses > 4GB Lots of machines apparently can't DMA correctly above 4GB during UEFI, so use bounce buffers for the initramfs read. Signed-off-by: Peter Jones --- - grub-core/loader/i386/efi/linux.c | 52 ++++++++++++++++++++++++++----- + grub-core/loader/i386/efi/linux.c | 52 +++++++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 7 deletions(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index f3abbd025..d6bed4fb4 100644 +index 9e5dca9458a..3a940bec7f6 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -35,11 +35,16 @@ static grub_dl_t my_mod; @@ -34,7 +33,7 @@ index f3abbd025..d6bed4fb4 100644 #define BYTES_TO_PAGES(bytes) (((bytes) + 0xfff) >> 12) static grub_err_t -@@ -68,6 +73,44 @@ grub_linuxefi_unload (void) +@@ -73,6 +78,44 @@ grub_linuxefi_unload (void) return GRUB_ERR_NONE; } @@ -79,7 +78,7 @@ index f3abbd025..d6bed4fb4 100644 static grub_err_t grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), int argc, char *argv[]) -@@ -120,7 +163,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -126,7 +169,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), for (i = 0; i < nfiles; i++) { grub_ssize_t cursize = grub_file_size (files[i]); @@ -88,7 +87,7 @@ index f3abbd025..d6bed4fb4 100644 { if (!grub_errno) grub_error (GRUB_ERR_FILE_READ_ERROR, N_("premature end of file %s"), -@@ -145,11 +188,6 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -152,11 +195,6 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), return grub_errno; } @@ -99,7 +98,4 @@ index f3abbd025..d6bed4fb4 100644 - static grub_err_t grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - int argc, char *argv[]) --- -2.41.0 - + int argc, char *argv[]) diff --git a/0091-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch b/0223-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch similarity index 85% rename from 0091-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch rename to 0223-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch index 43f0623..e4c80fe 100644 --- a/0091-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch +++ b/0223-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch @@ -1,20 +1,20 @@ -From 81c782360fc97a2939524fae235dde7ec2630b17 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 13 Sep 2018 14:42:34 -0400 -Subject: [PATCH 091/272] x86-efi: Re-arrange grub_cmd_linux() a little bit. +Subject: [PATCH] x86-efi: Re-arrange grub_cmd_linux() a little bit. This just helps the next patch be easier to read. Signed-off-by: Peter Jones --- - grub-core/loader/i386/efi/linux.c | 73 +++++++++++++++++-------------- - 1 file changed, 40 insertions(+), 33 deletions(-) + grub-core/loader/i386/efi/linux.c | 75 +++++++++++++++++++++------------------ + 1 file changed, 41 insertions(+), 34 deletions(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index d6bed4fb4..096a52eb5 100644 +index 3a940bec7f6..8d0b9436011 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c -@@ -227,32 +227,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -243,32 +243,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), goto fail; } @@ -28,13 +28,13 @@ index d6bed4fb4..096a52eb5 100644 - grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate kernel parameters"); - goto fail; - } -- -- grub_dprintf ("linux", "params = %p\n", params); -- -- grub_memset (params, 0, sizeof(*params)); + lh = (struct linux_i386_kernel_header *)kernel; + grub_dprintf ("linux", "original lh is at %p\n", kernel); +- grub_dprintf ("linux", "params = %p\n", params); +- +- grub_memset (params, 0, sizeof(*params)); +- - setup_header_end_offset = *((grub_uint8_t *)kernel + 0x201); - grub_dprintf ("linux", "copying %lu bytes from %p to %p\n", - MIN((grub_size_t)0x202+setup_header_end_offset, @@ -49,7 +49,7 @@ index d6bed4fb4..096a52eb5 100644 grub_dprintf ("linux", "checking lh->boot_flag\n"); if (lh->boot_flag != grub_cpu_to_le16 (0xaa55)) { -@@ -300,6 +277,34 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -316,6 +293,34 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), } #endif @@ -69,7 +69,7 @@ index d6bed4fb4..096a52eb5 100644 + grub_memset (params, 0, sizeof(*params)); + + setup_header_end_offset = *((grub_uint8_t *)kernel + 0x201); -+ grub_dprintf ("linux", "copying %" PRIuGRUB_SIZE " bytes from %p to %p\n", ++ grub_dprintf ("linux", "copying %lu bytes from %p to %p\n", + MIN((grub_size_t)0x202+setup_header_end_offset, + sizeof (*params)) - 0x1f1, + (grub_uint8_t *)kernel + 0x1f1, @@ -84,7 +84,7 @@ index d6bed4fb4..096a52eb5 100644 grub_dprintf ("linux", "setting up cmdline\n"); linux_cmdline = grub_efi_allocate_pages_max(GRUB_EFI_MAX_ALLOCATION_ADDRESS, BYTES_TO_PAGES(lh->cmdline_size + 1)); -@@ -324,8 +329,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -341,8 +346,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), grub_dprintf ("linux", "setting lh->cmd_line_ptr\n"); lh->cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline; @@ -94,7 +94,7 @@ index d6bed4fb4..096a52eb5 100644 start = (lh->setup_sects + 1) * 512; -@@ -342,24 +347,26 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -359,26 +364,28 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate kernel")); goto fail; } @@ -121,13 +121,13 @@ index d6bed4fb4..096a52eb5 100644 params->ext_loader_type = 0; params->ext_loader_ver = 2; - grub_dprintf("linux", "kernel_mem: %p handover_offset: %08x\n", -- kernel_mem, handover_offset); +- kernel_mem, handover_offset); + grub_dprintf ("linux", + "setting lh->ext_loader_{type,ver} = {0x%02x,0x%02x}\n", + params->ext_loader_type, params->ext_loader_ver); - fail: +- fail: ++fail: + if (file) + grub_file_close (file); --- -2.41.0 - diff --git a/0092-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch b/0224-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch similarity index 76% rename from 0092-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch rename to 0224-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch index 3a3460a..afd82c3 100644 --- a/0092-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch +++ b/0224-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch @@ -1,17 +1,17 @@ -From 9df13938147e81af2cd0537a68bc604f85122250 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 12 Sep 2018 16:03:55 -0400 -Subject: [PATCH 092/272] x86-efi: Make our own allocator for kernel stuff +Subject: [PATCH] x86-efi: Make our own allocator for kernel stuff This helps enable allocations above 4GB. Signed-off-by: Peter Jones --- - grub-core/loader/i386/efi/linux.c | 155 ++++++++++++++++++------------ - 1 file changed, 94 insertions(+), 61 deletions(-) + grub-core/loader/i386/efi/linux.c | 166 +++++++++++++++++++++----------------- + 1 file changed, 93 insertions(+), 73 deletions(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 096a52eb5..d284db5d1 100644 +index 8d0b9436011..039b40e321d 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -47,6 +47,65 @@ static char *linux_cmdline; @@ -55,8 +55,8 @@ index 096a52eb5..d284db5d1 100644 + continue; + + pages = BYTES_TO_PAGES(size); -+ grub_dprintf ("linux", "Trying to allocate %" PRIuGRUB_SIZE" pages from %p\n", -+ pages, (void *)(grub_addr_t)max); ++ grub_dprintf ("linux", "Trying to allocate %lu pages from %p\n", ++ pages, (void *)max); + + prev_max = max; + addr = grub_efi_allocate_pages_real (max, pages, @@ -80,18 +80,23 @@ index 096a52eb5..d284db5d1 100644 static grub_err_t grub_linuxefi_boot (void) { -@@ -62,14 +121,12 @@ grub_linuxefi_unload (void) +@@ -62,19 +121,12 @@ grub_linuxefi_unload (void) { grub_dl_unref (my_mod); loaded = 0; - if (initrd_mem) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, BYTES_TO_PAGES(params->ramdisk_size)); +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, +- BYTES_TO_PAGES(params->ramdisk_size)); - if (linux_cmdline) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)linux_cmdline, BYTES_TO_PAGES(params->cmdline_size + 1)); +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) +- linux_cmdline, +- BYTES_TO_PAGES(params->cmdline_size + 1)); - if (kernel_mem) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, BYTES_TO_PAGES(kernel_size)); +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, +- BYTES_TO_PAGES(kernel_size)); - if (params) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)params, BYTES_TO_PAGES(16384)); +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params, +- BYTES_TO_PAGES(16384)); + + kernel_free(initrd_mem, params->ramdisk_size); + kernel_free(linux_cmdline, params->cmdline_size + 1); @@ -101,7 +106,7 @@ index 096a52eb5..d284db5d1 100644 return GRUB_ERR_NONE; } -@@ -146,17 +203,13 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -150,19 +202,13 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), size += ALIGN_UP (grub_file_size (files[i]), 4); } @@ -113,6 +118,8 @@ index 096a52eb5..d284db5d1 100644 - grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate initrd")); - goto fail; - } +- +- grub_dprintf ("linux", "initrd_mem = %lx\n", (unsigned long) initrd_mem); + initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); + if (initrd_mem == NULL) + goto fail; @@ -120,11 +127,11 @@ index 096a52eb5..d284db5d1 100644 params->ramdisk_size = size; - params->ramdisk_image = (grub_uint32_t)(grub_addr_t) initrd_mem; -+ params->ramdisk_image = initrd_mem; ++ params->ramdisk_image = (grub_uint64_t) initrd_mem; ptr = initrd_mem; -@@ -214,7 +267,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -221,7 +267,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), filelen = grub_file_size (file); kernel = grub_malloc(filelen); @@ -132,7 +139,7 @@ index 096a52eb5..d284db5d1 100644 if (!kernel) { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel buffer")); -@@ -258,7 +310,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -274,7 +319,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), goto fail; } @@ -141,7 +148,7 @@ index 096a52eb5..d284db5d1 100644 grub_dprintf ("linux", "checking lh->xloadflags\n"); if (!(lh->xloadflags & LINUX_XLF_KERNEL_64)) { -@@ -277,17 +329,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -293,17 +338,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), } #endif @@ -161,7 +168,7 @@ index 096a52eb5..d284db5d1 100644 grub_dprintf ("linux", "params = %p\n", params); grub_memset (params, 0, sizeof(*params)); -@@ -306,16 +350,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -322,19 +359,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), grub_dprintf ("linux", "new lh is at %p\n", lh); grub_dprintf ("linux", "setting up cmdline\n"); @@ -176,20 +183,22 @@ index 096a52eb5..d284db5d1 100644 - grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("can't allocate cmdline")); - goto fail; - } +- +- grub_dprintf ("linux", "linux_cmdline = %lx\n", +- (unsigned long)linux_cmdline); + goto fail; + grub_dprintf ("linux", "linux_cmdline = %p\n", linux_cmdline); grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); - err = grub_create_loader_cmdline (argc, argv, -@@ -326,27 +364,24 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - goto fail; + grub_create_loader_cmdline (argc, argv, +@@ -343,27 +371,23 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + GRUB_VERIFY_KERNEL_CMDLINE); grub_dprintf ("linux", "cmdline:%s\n", linux_cmdline); - grub_dprintf ("linux", "setting lh->cmd_line_ptr\n"); - lh->cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline; -+ grub_dprintf ("linux", "setting lh->cmd_line_ptr to 0x%08x\n", -+ linux_cmdline); -+ lh->cmd_line_ptr = linux_cmdline; ++ ++ lh->cmd_line_ptr = (grub_uint64_t) linux_cmdline; handover_offset = lh->handover_offset; - grub_dprintf("linux", "handover_offset: %08x\n", handover_offset); @@ -220,7 +229,7 @@ index 096a52eb5..d284db5d1 100644 grub_dprintf("linux", "kernel_mem = %p\n", kernel_mem); grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); -@@ -382,16 +417,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -398,18 +422,14 @@ fail: loaded = 0; } @@ -228,22 +237,21 @@ index 096a52eb5..d284db5d1 100644 - grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) - linux_cmdline, - BYTES_TO_PAGES(lh->cmdline_size + 1)); -- -- if (kernel_mem && !loaded) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, BYTES_TO_PAGES(kernel_size)); + if (!loaded) + { + if (lh) + kernel_free (linux_cmdline, lh->cmdline_size + 1); +- if (kernel_mem && !loaded) +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)kernel_mem, +- BYTES_TO_PAGES(kernel_size)); +- - if (params && !loaded) -- grub_efi_free_pages((grub_efi_physical_address_t)(grub_addr_t)params, BYTES_TO_PAGES(16384)); +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)params, +- BYTES_TO_PAGES(16384)); + kernel_free (kernel_mem, kernel_size); + kernel_free (params, sizeof(*params)); + } return grub_errno; } --- -2.41.0 - diff --git a/0093-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch b/0225-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch similarity index 87% rename from 0093-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch rename to 0225-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch index a935a4d..a3b68e6 100644 --- a/0093-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch +++ b/0225-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch @@ -1,8 +1,7 @@ -From cc1410075442fddbd44ad9faf68fdc5bc4cdf22d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 12 Sep 2018 16:12:27 -0400 -Subject: [PATCH 093/272] x86-efi: Allow initrd+params+cmdline allocations - above 4GB. +Subject: [PATCH] x86-efi: Allow initrd+params+cmdline allocations above 4GB. This enables everything except the kernel itself to be above 4GB. Putting the kernel up there still doesn't work, because of the way @@ -10,12 +9,12 @@ params->code32_start is used. Signed-off-by: Peter Jones --- - grub-core/loader/i386/efi/linux.c | 67 +++++++++++++++++++++++++++---- - include/grub/i386/linux.h | 6 ++- - 2 files changed, 65 insertions(+), 8 deletions(-) + grub-core/loader/i386/efi/linux.c | 67 +++++++++++++++++++++++++++++++++++---- + include/grub/i386/linux.h | 6 +++- + 2 files changed, 66 insertions(+), 7 deletions(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index d284db5d1..d49749269 100644 +index 039b40e321d..015bb01d4c4 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -52,13 +52,22 @@ struct allocation_choice { @@ -64,12 +63,12 @@ index d284db5d1..d49749269 100644 static grub_err_t grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), int argc, char *argv[]) -@@ -208,8 +225,12 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -207,8 +224,12 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), goto fail; grub_dprintf ("linux", "initrd_mem = %p\n", initrd_mem); - params->ramdisk_size = size; -- params->ramdisk_image = initrd_mem; +- params->ramdisk_image = (grub_uint64_t) initrd_mem; + params->ramdisk_size = LOW_U32(size); + params->ramdisk_image = LOW_U32(initrd_mem); +#if defined(__x86_64__) @@ -79,7 +78,7 @@ index d284db5d1..d49749269 100644 ptr = initrd_mem; -@@ -329,6 +350,18 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -338,6 +359,18 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), } #endif @@ -98,12 +97,12 @@ index d284db5d1..d49749269 100644 params = kernel_alloc (sizeof(*params), "cannot allocate kernel parameters"); if (!params) goto fail; -@@ -365,21 +398,40 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -372,20 +405,41 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), grub_dprintf ("linux", "cmdline:%s\n", linux_cmdline); - grub_dprintf ("linux", "setting lh->cmd_line_ptr to 0x%08x\n", -- linux_cmdline); -- lh->cmd_line_ptr = linux_cmdline; + +- lh->cmd_line_ptr = (grub_uint64_t) linux_cmdline; ++ grub_dprintf ("linux", "setting lh->cmd_line_ptr to 0x%08x\n", + LOW_U32(linux_cmdline)); + lh->cmd_line_ptr = LOW_U32(linux_cmdline); +#if defined(__x86_64__) @@ -141,7 +140,7 @@ index d284db5d1..d49749269 100644 if (!kernel_mem) goto fail; grub_dprintf("linux", "kernel_mem = %p\n", kernel_mem); -@@ -388,8 +440,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -394,8 +448,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), loaded = 1; @@ -154,7 +153,7 @@ index d284db5d1..d49749269 100644 grub_memcpy (kernel_mem, (char *)kernel + start, filelen - start); diff --git a/include/grub/i386/linux.h b/include/grub/i386/linux.h -index 4ccd9d7d9..461097781 100644 +index 4ccd9d7d9f2..461097781fd 100644 --- a/include/grub/i386/linux.h +++ b/include/grub/i386/linux.h @@ -246,7 +246,11 @@ struct linux_kernel_params @@ -170,6 +169,3 @@ index 4ccd9d7d9..461097781 100644 union { --- -2.41.0 - diff --git a/0078-efi-Set-image-base-address-before-jumping-to-the-PE-.patch b/0226-efi-Set-image-base-address-before-jumping-to-the-PE-.patch similarity index 60% rename from 0078-efi-Set-image-base-address-before-jumping-to-the-PE-.patch rename to 0226-efi-Set-image-base-address-before-jumping-to-the-PE-.patch index e6c69f5..f6176ba 100644 --- a/0078-efi-Set-image-base-address-before-jumping-to-the-PE-.patch +++ b/0226-efi-Set-image-base-address-before-jumping-to-the-PE-.patch @@ -1,8 +1,8 @@ -From fb009ddeeca0cf3c6f087bdff11533f9db9ff4c1 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 23 Apr 2020 15:06:46 +0200 -Subject: [PATCH 078/272] efi: Set image base address before jumping to the - PE/COFF entry point +Subject: [PATCH] efi: Set image base address before jumping to the PE/COFF + entry point Upstream GRUB uses the EFI LoadImage() and StartImage() to boot the Linux kernel. But our custom EFI loader that supports Secure Boot instead uses @@ -21,23 +21,28 @@ and print the following warning message: EFI stub: ERROR: FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value -Resolves: rhbz#1825411 +Resolves: rhbz#1814690 Signed-off-by: Javier Martinez Canillas --- - grub-core/loader/arm64/efi/linux.c | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index 536272d90..c1b08450c 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -58,9 +58,24 @@ static grub_err_t - grub_efi_linux_boot (void *kernel_address, grub_off_t offset, + grub-core/loader/efi/linux.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 742e8e9af35..32766bf7b19 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -139,6 +139,7 @@ grub_err_t + grub_efi_linux_boot (void *kernel_address, grub_off_t handover_offset, void *kernel_params) { + grub_efi_loaded_image_t *loaded_image = NULL; handover_func hf; + int offset = 0; + +@@ -146,6 +147,19 @@ grub_efi_linux_boot (void *kernel_address, grub_off_t handover_offset, + offset = 512; + #endif + /* + * Since the EFI loader is not calling the LoadImage() and StartImage() @@ -46,17 +51,12 @@ index 536272d90..c1b08450c 100644 + */ + loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); + if (loaded_image) -+ loaded_image->image_base = kernel_addr; ++ loaded_image->image_base = kernel_address; + else + grub_dprintf ("linux", "Loaded Image base address could not be set\n"); + -+ grub_dprintf ("linux", "kernel_addr: %p handover_offset: %p params: %p\n", -+ kernel_address, (void *)(grub_efi_uintn_t)offset, kernel_params); - hf = (handover_func)((char *)kernel_address + offset); -+ grub_dprintf ("linux", "handover_func() = %p\n", hf); ++ grub_dprintf ("linux", "kernel_address: %p handover_offset: %p params: %p\n", ++ kernel_address, (void *)(grub_efi_uintn_t)handover_offset, kernel_params); + hf = (handover_func)((char *)kernel_address + handover_offset + offset); hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); - return GRUB_ERR_BUG; --- -2.41.0 - diff --git a/0094-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch b/0227-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch similarity index 88% rename from 0094-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch rename to 0227-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch index 743c63d..35c0f32 100644 --- a/0094-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch +++ b/0227-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch @@ -1,7 +1,7 @@ -From 5dd395b7b4477baa59f90269b55b201f46c0bb03 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 26 May 2020 16:59:28 +0200 -Subject: [PATCH 094/272] x86-efi: Reduce maximum bounce buffer size to 16 MiB +Subject: [PATCH] x86-efi: Reduce maximum bounce buffer size to 16 MiB The EFI linux loader allocates a bounce buffer to copy the initrd since in some machines doing DMA on addresses above 4GB is not possible during EFI. @@ -26,7 +26,7 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index d49749269..652212227 100644 +index 015bb01d4c4..adfb2739ae4 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -144,7 +144,7 @@ grub_linuxefi_unload (void) @@ -38,6 +38,3 @@ index d49749269..652212227 100644 static grub_ssize_t read(grub_file_t file, grub_uint8_t *bufp, grub_size_t len) --- -2.41.0 - diff --git a/0095-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch b/0228-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch similarity index 84% rename from 0095-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch rename to 0228-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch index b5939df..7b507d9 100644 --- a/0095-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch +++ b/0228-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch @@ -1,7 +1,7 @@ -From 740fc57f366f99919b17f41e0b98713221e56336 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Fri, 24 Jul 2020 17:18:09 +0100 -Subject: [PATCH 095/272] efilinux: Fix integer overflows in grub_cmd_initrd +Subject: [PATCH] efilinux: Fix integer overflows in grub_cmd_initrd These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with @@ -13,7 +13,7 @@ Signed-off-by: Colin Watson 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index 652212227..6b06a8f2f 100644 +index adfb2739ae4..325aa594db1 100644 --- a/grub-core/loader/i386/efi/linux.c +++ b/grub-core/loader/i386/efi/linux.c @@ -28,6 +28,8 @@ @@ -34,7 +34,7 @@ index 652212227..6b06a8f2f 100644 if (!files) goto fail; -@@ -217,7 +219,11 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +@@ -216,7 +218,11 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), if (! files[i]) goto fail; nfiles++; @@ -47,6 +47,3 @@ index 652212227..6b06a8f2f 100644 } initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); --- -2.41.0 - diff --git a/0229-linuxefi-fail-kernel-validation-without-shim-protoco.patch b/0229-linuxefi-fail-kernel-validation-without-shim-protoco.patch new file mode 100644 index 0000000..0bf7b19 --- /dev/null +++ b/0229-linuxefi-fail-kernel-validation-without-shim-protoco.patch @@ -0,0 +1,97 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dimitri John Ledkov +Date: Wed, 22 Jul 2020 11:31:43 +0100 +Subject: [PATCH] linuxefi: fail kernel validation without shim protocol. + +If certificates that signed grub are installed into db, grub can be +booted directly. It will then boot any kernel without signature +validation. The booted kernel will think it was booted in secureboot +mode and will implement lockdown, yet it could have been tampered. + +This version of the patch skips calling verification, when booted +without secureboot. And is indented with gnu ident. + +CVE-2020-15705 + +Reported-by: Mathieu Trudel-Lapierre +Signed-off-by: Dimitri John Ledkov +--- + grub-core/loader/efi/chainloader.c | 1 + + grub-core/loader/efi/linux.c | 1 + + grub-core/loader/i386/efi/linux.c | 17 +++++++++++------ + 3 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index e4ac39c87b4..0ec682e2988 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1088,6 +1088,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + return 0; + } ++ // -1 fall-through to fail + + fail: + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 32766bf7b19..ecb6d593cef 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -98,6 +98,7 @@ struct grub_efi_shim_lock + }; + typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; + ++// Returns 1 on success, -1 on error, 0 when not available + int + grub_linuxefi_secure_validate (void *data, grub_uint32_t size) + { +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 325aa594db1..97484bbe24d 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -101,7 +102,7 @@ kernel_alloc(grub_efi_uintn_t size, const char * const errmsg) + + pages = BYTES_TO_PAGES(size); + grub_dprintf ("linux", "Trying to allocate %lu pages from %p\n", +- pages, (void *)max); ++ (unsigned long)pages, (void *)(unsigned long)max); + + prev_max = max; + addr = grub_efi_allocate_pages_real (max, pages, +@@ -307,12 +308,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + +- rc = grub_linuxefi_secure_validate (kernel, filelen); +- if (rc < 0) ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) + { +- grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), +- argv[0]); +- goto fail; ++ rc = grub_linuxefi_secure_validate (kernel, filelen); ++ if (rc <= 0) ++ { ++ grub_error (GRUB_ERR_INVALID_COMMAND, ++ N_("%s has invalid signature"), argv[0]); ++ goto fail; ++ } + } + + lh = (struct linux_i386_kernel_header *)kernel; +@@ -386,6 +390,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + setup_header_end_offset = *((grub_uint8_t *)kernel + 0x201); + grub_dprintf ("linux", "copying %lu bytes from %p to %p\n", ++ (unsigned long) + MIN((grub_size_t)0x202+setup_header_end_offset, + sizeof (*params)) - 0x1f1, + (grub_uint8_t *)kernel + 0x1f1, diff --git a/0230-Allow-chainloading-EFI-apps-from-loop-mounts.patch b/0230-Allow-chainloading-EFI-apps-from-loop-mounts.patch new file mode 100644 index 0000000..c5e4457 --- /dev/null +++ b/0230-Allow-chainloading-EFI-apps-from-loop-mounts.patch @@ -0,0 +1,139 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dimitri John Ledkov +Date: Fri, 11 Jun 2021 13:51:20 +0200 +Subject: [PATCH] Allow chainloading EFI apps from loop mounts. + +Signed-off-by: Dimitri John Ledkov +Signed-off-by: Robbie Harwood +--- + grub-core/disk/loopback.c | 9 +-------- + grub-core/loader/efi/chainloader.c | 24 ++++++++++++++++++++++++ + include/grub/loopback.h | 30 ++++++++++++++++++++++++++++++ + 3 files changed, 55 insertions(+), 8 deletions(-) + create mode 100644 include/grub/loopback.h + +diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c +index 4635dcfdeec..11a5e0cbd02 100644 +--- a/grub-core/disk/loopback.c ++++ b/grub-core/disk/loopback.c +@@ -21,20 +21,13 @@ + #include + #include + #include ++#include + #include + #include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); + +-struct grub_loopback +-{ +- char *devname; +- grub_file_t file; +- struct grub_loopback *next; +- unsigned long id; +-}; +- + static struct grub_loopback *loopback_list; + static unsigned long last_id = 0; + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 0ec682e2988..efbe2bd38aa 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -907,6 +908,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_efi_status_t status; + grub_efi_boot_services_t *b; + grub_device_t dev = 0; ++ grub_device_t orig_dev = 0; + grub_efi_device_path_t *dp = NULL; + char *filename; + void *boot_image = 0; +@@ -963,6 +965,16 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + dev = grub_device_open (devname); + if (devname) + grub_free (devname); ++ ++ /* if device is loopback, use underlying dev */ ++ if (dev && dev->disk->dev->id == GRUB_DISK_DEVICE_LOOPBACK_ID) ++ { ++ struct grub_loopback *d; ++ orig_dev = dev; ++ d = dev->disk->data; ++ dev = d->file->device; ++ } ++ + if (dev == NULL) + ; + else if (dev->disk) +@@ -1069,6 +1081,12 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + } + #endif + ++ if (orig_dev) ++ { ++ dev = orig_dev; ++ orig_dev = 0; ++ } ++ + rc = grub_linuxefi_secure_validate((void *)(unsigned long)address, fsize); + grub_dprintf ("chain", "linuxefi_secure_validate: %d\n", rc); + if (rc > 0) +@@ -1092,6 +1110,12 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + fail: + ++ if (orig_dev) ++ { ++ dev = orig_dev; ++ orig_dev = 0; ++ } ++ + if (dev) + grub_device_close (dev); + +diff --git a/include/grub/loopback.h b/include/grub/loopback.h +new file mode 100644 +index 00000000000..3b9a9e32e80 +--- /dev/null ++++ b/include/grub/loopback.h +@@ -0,0 +1,30 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2019 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#ifndef GRUB_LOOPBACK_HEADER ++#define GRUB_LOOPBACK_HEADER 1 ++ ++struct grub_loopback ++{ ++ char *devname; ++ grub_file_t file; ++ struct grub_loopback *next; ++ unsigned long id; ++}; ++ ++#endif /* ! GRUB_LOOPBACK_HEADER */ diff --git a/0231-grub-core-loader-i386-efi-linux.c-do-not-validate-ke.patch b/0231-grub-core-loader-i386-efi-linux.c-do-not-validate-ke.patch new file mode 100644 index 0000000..084be2f --- /dev/null +++ b/0231-grub-core-loader-i386-efi-linux.c-do-not-validate-ke.patch @@ -0,0 +1,73 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dimitri John Ledkov +Date: Thu, 3 Mar 2022 13:10:56 +0100 +Subject: [PATCH] grub-core/loader/i386/efi/linux.c: do not validate kernels + twice + +On codebases that have shim-lock-verifier built into the grub core +(like 2.06 upstream), shim-lock-verifier is in enforcing mode when +booted with secureboot. It means that grub_cmd_linux() command +attempts to perform shim validate upon opening linux kernel image, +including kernel measurement. And the verifier correctly returns file +open error when shim validate protocol is not present or shim fails to +validate the kernel. + +This makes the call to grub_linuxefi_secure_validate() redundant, but +also harmful. As validating the kernel image twice, extends the PCRs +with the same measurement twice. Which breaks existing sealing +policies when upgrading from grub2.04+rhboot+sb+linuxefi to +grub2.06+rhboot+sb+linuxefi builds. It is also incorrect to measure +the kernel twice. + +This patch must not be ported to older editions of grub code bases +that do not have verifiers framework, or it is not builtin, or +shim-lock-verifier is an optional module. + +This patch is tested to ensure that unsigned kernels are not possible +to boot in secureboot mode when shim rejects kernel, or shim protocol +is missing, and that the measurements become stable once again. The +above also ensures that CVE-2020-15705 is not reintroduced. + +Signed-off-by: Dimitri John Ledkov +--- + grub-core/loader/i386/efi/linux.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 97484bbe24d..1dd787081f2 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -30,7 +30,6 @@ + #include + #include + #include +-#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -278,7 +277,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_ssize_t start, filelen; + void *kernel = NULL; + int setup_header_end_offset; +- int rc; + + grub_dl_ref (my_mod); + +@@ -308,17 +306,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + +- if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) +- { +- rc = grub_linuxefi_secure_validate (kernel, filelen); +- if (rc <= 0) +- { +- grub_error (GRUB_ERR_INVALID_COMMAND, +- N_("%s has invalid signature"), argv[0]); +- goto fail; +- } +- } +- + lh = (struct linux_i386_kernel_header *)kernel; + grub_dprintf ("linux", "original lh is at %p\n", kernel); + diff --git a/0232-grub-core-loader-efi-chainloader.c-do-not-validate-c.patch b/0232-grub-core-loader-efi-chainloader.c-do-not-validate-c.patch new file mode 100644 index 0000000..1ec4787 --- /dev/null +++ b/0232-grub-core-loader-efi-chainloader.c-do-not-validate-c.patch @@ -0,0 +1,80 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dimitri John Ledkov +Date: Fri, 4 Mar 2022 09:31:43 +0100 +Subject: [PATCH] grub-core/loader/efi/chainloader.c: do not validate + chainloader twice + +On secureboot systems, with shimlock verifier, call to +grub_file_open(, GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE) will already +pass the chainloader target through shim-lock protocol verify +call. And create a TPM measurement. If verification fails, +grub_cmd_chainloader will fail at file open time. + +This makes previous code paths for negative, and zero return codes +from grub_linuxefi_secure_validate unreachable under secureboot. But +also breaking measurements compatibility with 2.04+linuxefi codebases, +as the chainloader file is passed through shim_lock->verify() twice +(via verifier & direct call to grub_linuxefi_secure_validate) +extending the PCRs twice. + +This reduces grub_loader options to perform +grub_secureboot_chainloader when secureboot is on, and otherwise +attempt grub_chainloader_boot. + +It means that booting with secureboot off, yet still with shim (which +always verifies things successfully), will stop choosing +grub_secureboot_chainloader, and opting for a more regular +loadimage/startimage codepath. If we want to use the +grub_secureboot_chainloader codepath in such scenarios we should adapt +the code to simply check for shim_lock protocol presence / +shim_lock->context() success?! But I am not sure if that is necessary. + +This patch must not be ported to older editions of grub code bases +that do not have verifiers framework, or it is not builtin, or +shim-lock-verifier is an optional module. + +Signed-off-by: Dimitri John Ledkov +--- + grub-core/loader/efi/chainloader.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index efbe2bd38aa..3a3b55c1d61 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -912,7 +912,6 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_efi_device_path_t *dp = NULL; + char *filename; + void *boot_image = 0; +- int rc; + + file_path = NULL; + address = 0; +@@ -1087,9 +1086,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + orig_dev = 0; + } + +- rc = grub_linuxefi_secure_validate((void *)(unsigned long)address, fsize); +- grub_dprintf ("chain", "linuxefi_secure_validate: %d\n", rc); +- if (rc > 0) ++ if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) + { + grub_file_close (file); + grub_device_close (dev); +@@ -1097,7 +1094,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_secureboot_chainloader_unload, 0); + return 0; + } +- else if (rc == 0) ++ else + { + grub_load_and_start_image(boot_image); + grub_file_close (file); +@@ -1106,7 +1103,6 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + return 0; + } +- // -1 fall-through to fail + + fail: + diff --git a/0233-grub-core-loader-efi-linux.c-drop-now-unused-grub_li.patch b/0233-grub-core-loader-efi-linux.c-drop-now-unused-grub_li.patch new file mode 100644 index 0000000..a9f7888 --- /dev/null +++ b/0233-grub-core-loader-efi-linux.c-drop-now-unused-grub_li.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Mon, 8 Apr 2024 10:59:25 -0600 +Subject: [PATCH] grub-core/loader/efi/linux.c: drop now unused + grub_linuxefi_secure_validate + +Drop the now unused grub_linuxefi_secure_validate() as all prior users +of this API now rely on the shim-lock-verifier codepath instead. + +This patch must not be ported to older editions of grub code bases +that do not have verifiers framework, or it is not builtin, or +shim-lock-verifier is an optional module. + +Signed-off-by: Dimitri John Ledkov +--- + grub-core/loader/efi/linux.c | 42 ------------------------------------------ + include/grub/efi/linux.h | 2 -- + 2 files changed, 44 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index ecb6d593cef..f5ab0128991 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -89,48 +89,6 @@ static grub_efi_load_file2_t initrd_lf2 = { + grub_efi_initrd_load_file2 + }; + +-#define SHIM_LOCK_GUID \ +- { 0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23} } +- +-struct grub_efi_shim_lock +-{ +- grub_efi_status_t (*verify) (void *buffer, grub_uint32_t size); +-}; +-typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; +- +-// Returns 1 on success, -1 on error, 0 when not available +-int +-grub_linuxefi_secure_validate (void *data, grub_uint32_t size) +-{ +- grub_guid_t guid = SHIM_LOCK_GUID; +- grub_efi_shim_lock_t *shim_lock; +- grub_efi_status_t status; +- +- shim_lock = grub_efi_locate_protocol(&guid, NULL); +- +- grub_dprintf ("secureboot", "shim_lock: %p\n", shim_lock); +- if (!shim_lock) +- { +- grub_dprintf ("secureboot", "shim not available\n"); +- return 0; +- } +- +- grub_dprintf ("secureboot", "Asking shim to verify kernel signature\n"); +- status = shim_lock->verify (data, size); +- grub_dprintf ("secureboot", "shim_lock->verify(): %ld\n", (long int)status); +- if (status == GRUB_EFI_SUCCESS) +- { +- grub_dprintf ("secureboot", "Kernel signature verification passed\n"); +- return 1; +- } +- +- grub_dprintf ("secureboot", "Kernel signature verification failed (0x%lx)\n", +- (unsigned long) status); +- +- return -1; +- +-} +- + #pragma GCC diagnostic push + #pragma GCC diagnostic ignored "-Wcast-align" + +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +index b2cfd8c1f44..c806a7757f3 100644 +--- a/include/grub/efi/linux.h ++++ b/include/grub/efi/linux.h +@@ -22,8 +22,6 @@ + #include + #include + +-int +-EXPORT_FUNC(grub_linuxefi_secure_validate) (void *data, grub_uint32_t size); + grub_err_t + EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset, + void *kernel_param); diff --git a/0234-loader-efi-chainloader-grub_load_and_start_image-doe.patch b/0234-loader-efi-chainloader-grub_load_and_start_image-doe.patch new file mode 100644 index 0000000..75cb622 --- /dev/null +++ b/0234-loader-efi-chainloader-grub_load_and_start_image-doe.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Thu, 28 Apr 2022 21:53:36 +0100 +Subject: [PATCH] loader/efi/chainloader: grub_load_and_start_image doesn't + load and start + +grub_load_and_start_image only loads an image - it still requires the +caller to start it. This renames it to grub_load_image. + +It's called from 2 places: +- grub_cmd_chainloader when not using the shim protocol. +- grub_secureboot_chainloader_boot if handle_image returns an error. +In this case, the image is loaded and then nothing else happens which +seems strange. I assume the intention is that it falls back to LoadImage +and StartImage if handle_image fails, so I've made it do that. + +Signed-off-by: Chris Coulson +(cherry picked from commit b4d70820a65c00561045856b7b8355461a9545f6) +--- + grub-core/loader/efi/chainloader.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 3a3b55c1d61..9c6a5f92600 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -847,7 +847,7 @@ grub_secureboot_chainloader_unload (void) + } + + static grub_err_t +-grub_load_and_start_image(void *boot_image) ++grub_load_image(void *boot_image) + { + grub_efi_boot_services_t *b; + grub_efi_status_t status; +@@ -889,13 +889,23 @@ grub_load_and_start_image(void *boot_image) + static grub_err_t + grub_secureboot_chainloader_boot (void) + { ++ grub_efi_boot_services_t *b; + int rc; ++ + rc = handle_image ((void *)(unsigned long)address, fsize); + if (rc == 0) + { +- grub_load_and_start_image((void *)(unsigned long)address); ++ /* We weren't able to attempt to execute the image, so fall back ++ * to LoadImage / StartImage. ++ */ ++ rc = grub_load_image((void *)(unsigned long)address); ++ if (rc == 0) ++ grub_chainloader_boot (); + } + ++ b = grub_efi_system_table->boot_services; ++ efi_call_1 (b->unload_image, image_handle); ++ + grub_loader_unset (); + return grub_errno; + } +@@ -1096,7 +1106,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + } + else + { +- grub_load_and_start_image(boot_image); ++ grub_load_image(boot_image); + grub_file_close (file); + grub_device_close (dev); + grub_loader_set_ex (grub_chainloader_boot, grub_chainloader_unload, image_handle, 0); diff --git a/0235-loader-efi-chainloader-simplify-the-loader-state.patch b/0235-loader-efi-chainloader-simplify-the-loader-state.patch new file mode 100644 index 0000000..d9962f0 --- /dev/null +++ b/0235-loader-efi-chainloader-simplify-the-loader-state.patch @@ -0,0 +1,326 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Fri, 29 Apr 2022 21:13:08 +0100 +Subject: [PATCH] loader/efi/chainloader: simplify the loader state + +When not using the shim lock protocol, the chainloader command retains +the source buffer and device path passed to LoadImage, requiring the +unload hook passed to grub_loader_set to free them. It isn't required +to retain this state though - they aren't required by StartImage or +anything else in the boot hook, so clean them up before +grub_cmd_chainloader finishes. + +This also wraps the loader state when using the shim lock protocol +inside a struct. + +Signed-off-by: Chris Coulson +(cherry picked from commit fa39862933b3be1553a580a3a5c28073257d8046) +[rharwood: fix unitialized handle and double-frees of file/dev] +Signed-off-by: Robbie Harwood +--- + grub-core/loader/efi/chainloader.c | 161 ++++++++++++++++++++++++------------- + 1 file changed, 103 insertions(+), 58 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 9c6a5f92600..cbe028cd8af 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -49,46 +49,30 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + static grub_dl_t my_mod; + +-static grub_efi_physical_address_t address; +-static grub_efi_uintn_t pages; +-static grub_ssize_t fsize; +-static grub_efi_device_path_t *file_path; + static grub_efi_handle_t image_handle; +-static grub_efi_char16_t *cmdline; +-static grub_ssize_t cmdline_len; +-static grub_efi_handle_t dev_handle; + +-static grub_efi_status_t (__grub_efi_api *entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); ++struct grub_secureboot_chainloader_context { ++ grub_efi_physical_address_t address; ++ grub_efi_uintn_t pages; ++ grub_ssize_t fsize; ++ grub_efi_device_path_t *file_path; ++ grub_efi_char16_t *cmdline; ++ grub_ssize_t cmdline_len; ++ grub_efi_handle_t dev_handle; ++}; ++static struct grub_secureboot_chainloader_context *sb_context; + + static grub_err_t +-grub_chainloader_unload (void *context) +-{ +- grub_efi_loaded_image_t *loaded_image; +- grub_efi_boot_services_t *b; +- +- image_handle = (grub_efi_handle_t) context; +- loaded_image = grub_efi_get_loaded_image (image_handle); +- if (loaded_image != NULL) +- grub_free (loaded_image->load_options); +- +- b = grub_efi_system_table->boot_services; +- b->unload_image (image_handle); +- +- grub_dl_unref (my_mod); +- return GRUB_ERR_NONE; +-} +- +-static grub_err_t +-grub_chainloader_boot (void *context) ++grub_start_image (grub_efi_handle_t handle) + { + grub_efi_boot_services_t *b; + grub_efi_status_t status; + grub_efi_uintn_t exit_data_size; + grub_efi_char16_t *exit_data = NULL; + +- image_handle = (grub_efi_handle_t) context; + b = grub_efi_system_table->boot_services; +- status = b->start_image (image_handle, &exit_data_size, &exit_data); ++ ++ status = b->start_image (handle, &exit_data_size, &exit_data); + if (status != GRUB_EFI_SUCCESS) + { + if (exit_data) +@@ -112,11 +96,37 @@ grub_chainloader_boot (void *context) + if (exit_data) + grub_efi_free_pool (exit_data); + +- grub_loader_unset (); +- + return grub_errno; + } + ++static grub_err_t ++grub_chainloader_unload (void) ++{ ++ grub_efi_loaded_image_t *loaded_image; ++ grub_efi_boot_services_t *b; ++ ++ loaded_image = grub_efi_get_loaded_image (image_handle); ++ if (loaded_image != NULL) ++ grub_free (loaded_image->load_options); ++ ++ b = grub_efi_system_table->boot_services; ++ b->unload_image (image_handle); ++ ++ grub_dl_unref (my_mod); ++ return GRUB_ERR_NONE; ++} ++ ++static grub_err_t ++grub_chainloader_boot (void) ++{ ++ grub_err_t err; ++ ++ err = grub_start_image (image_handle); ++ ++ grub_loader_unset (); ++ return err; ++} ++ + static grub_err_t + copy_file_path (grub_efi_file_path_device_path_t *fp, + const char *str, grub_efi_uint16_t len) +@@ -151,7 +161,7 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + char *dir_start; + char *dir_end; + grub_size_t size; +- grub_efi_device_path_t *d; ++ grub_efi_device_path_t *d, *file_path; + + dir_start = grub_strchr (filename, ')'); + if (! dir_start) +@@ -527,12 +537,14 @@ grub_efi_get_media_file_path (grub_efi_device_path_t *dp) + } + + static grub_efi_boolean_t +-handle_image (void *data, grub_efi_uint32_t datasize) ++handle_image (struct grub_secureboot_chainloader_context *load_context) + { + grub_efi_boot_services_t *b; + grub_efi_loaded_image_t *li, li_bak; + grub_efi_status_t efi_status; +- char *buffer = NULL; ++ void *data = (void *)(unsigned long)load_context->address; ++ grub_efi_uint32_t datasize = load_context->fsize; ++ void *buffer = NULL; + char *buffer_aligned = NULL; + grub_efi_uint32_t i; + struct grub_pe32_section_table *section; +@@ -542,6 +554,7 @@ handle_image (void *data, grub_efi_uint32_t datasize) + grub_uint32_t buffer_size; + int found_entry_point = 0; + int rc; ++ grub_efi_status_t (*entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); + + b = grub_efi_system_table->boot_services; + +@@ -801,10 +814,10 @@ handle_image (void *data, grub_efi_uint32_t datasize) + grub_memcpy (&li_bak, li, sizeof (grub_efi_loaded_image_t)); + li->image_base = buffer_aligned; + li->image_size = context.image_size; +- li->load_options = cmdline; +- li->load_options_size = cmdline_len; +- li->file_path = grub_efi_get_media_file_path (file_path); +- li->device_handle = dev_handle; ++ li->load_options = load_context->cmdline; ++ li->load_options_size = load_context->cmdline_len; ++ li->file_path = grub_efi_get_media_file_path (load_context->file_path); ++ li->device_handle = load_context->dev_handle; + if (!li->file_path) + { + grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found"); +@@ -832,22 +845,22 @@ error_exit: + static grub_err_t + grub_secureboot_chainloader_unload (void) + { +- grub_efi_boot_services_t *b; ++ grub_efi_free_pages (sb_context->address, sb_context->pages); ++ grub_free (sb_context->file_path); ++ grub_free (sb_context->cmdline); ++ grub_free (sb_context); + +- b = grub_efi_system_table->boot_services; +- b->free_pages (address, pages); +- grub_free (file_path); +- grub_free (cmdline); +- cmdline = 0; +- file_path = 0; +- dev_handle = 0; ++ sb_context = 0; + + grub_dl_unref (my_mod); + return GRUB_ERR_NONE; + } + + static grub_err_t +-grub_load_image(void *boot_image) ++grub_load_image(grub_efi_device_path_t *file_path, void *boot_image, ++ grub_efi_uintn_t image_size, grub_efi_handle_t dev_handle, ++ grub_efi_char16_t *cmdline, grub_ssize_t cmdline_len, ++ grub_efi_handle_t *image_handle_out) + { + grub_efi_boot_services_t *b; + grub_efi_status_t status; +@@ -856,7 +869,7 @@ grub_load_image(void *boot_image) + b = grub_efi_system_table->boot_services; + + status = b->load_image (0, grub_efi_image_handle, file_path, +- boot_image, fsize, &image_handle); ++ boot_image, image_size, image_handle_out); + if (status != GRUB_EFI_SUCCESS) + { + if (status == GRUB_EFI_OUT_OF_RESOURCES) +@@ -869,7 +882,7 @@ grub_load_image(void *boot_image) + /* LoadImage does not set a device handler when the image is + loaded from memory, so it is necessary to set it explicitly here. + This is a mess. */ +- loaded_image = grub_efi_get_loaded_image (image_handle); ++ loaded_image = grub_efi_get_loaded_image (*image_handle_out); + if (! loaded_image) + { + grub_error (GRUB_ERR_BAD_OS, "no loaded image available"); +@@ -891,20 +904,25 @@ grub_secureboot_chainloader_boot (void) + { + grub_efi_boot_services_t *b; + int rc; ++ grub_efi_handle_t handle = 0; + +- rc = handle_image ((void *)(unsigned long)address, fsize); ++ rc = handle_image (sb_context); + if (rc == 0) + { + /* We weren't able to attempt to execute the image, so fall back + * to LoadImage / StartImage. + */ +- rc = grub_load_image((void *)(unsigned long)address); ++ rc = grub_load_image(sb_context->file_path, ++ (void *)(unsigned long)sb_context->address, ++ sb_context->fsize, sb_context->dev_handle, ++ sb_context->cmdline, sb_context->cmdline_len, ++ &handle); + if (rc == 0) +- grub_chainloader_boot (); ++ grub_start_image (handle); + } + + b = grub_efi_system_table->boot_services; +- efi_call_1 (b->unload_image, image_handle); ++ b->unload_image (handle); + + grub_loader_unset (); + return grub_errno; +@@ -919,9 +937,15 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_efi_boot_services_t *b; + grub_device_t dev = 0; + grub_device_t orig_dev = 0; +- grub_efi_device_path_t *dp = NULL; ++ grub_efi_device_path_t *dp = 0, *file_path = 0; + char *filename; + void *boot_image = 0; ++ grub_efi_physical_address_t address = 0; ++ grub_ssize_t fsize; ++ grub_efi_uintn_t pages = 0; ++ grub_efi_char16_t *cmdline = 0; ++ grub_ssize_t cmdline_len = 0; ++ grub_efi_handle_t dev_handle = 0; + + file_path = NULL; + address = 0; +@@ -1098,18 +1122,36 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED) + { ++ sb_context = grub_malloc (sizeof (*sb_context)); ++ if (sb_context == NULL) ++ goto fail; ++ sb_context->address = address; ++ sb_context->fsize = fsize; ++ sb_context->pages = pages; ++ sb_context->file_path = file_path; ++ sb_context->cmdline = cmdline; ++ sb_context->cmdline_len = cmdline_len; ++ sb_context->dev_handle = dev_handle; ++ + grub_file_close (file); + grub_device_close (dev); ++ + grub_loader_set (grub_secureboot_chainloader_boot, + grub_secureboot_chainloader_unload, 0); + return 0; + } + else + { +- grub_load_image(boot_image); ++ grub_load_image(file_path, boot_image, fsize, dev_handle, cmdline, ++ cmdline_len, &image_handle); + grub_file_close (file); + grub_device_close (dev); +- grub_loader_set_ex (grub_chainloader_boot, grub_chainloader_unload, image_handle, 0); ++ ++ /* We're finished with the source image buffer and file path now */ ++ b->free_pages (address, pages); ++ grub_free (file_path); ++ ++ grub_loader_set (grub_chainloader_boot, grub_chainloader_unload, 0); + + return 0; + } +@@ -1137,8 +1179,11 @@ fail: + if (cmdline) + grub_free (cmdline); + +- if (image_handle != NULL) +- b->unload_image (image_handle); ++ if (image_handle != 0) ++ { ++ b->unload_image (image_handle); ++ image_handle = 0; ++ } + + grub_dl_unref (my_mod); + diff --git a/0236-loader-efi-chainloader-Use-grub_loader_set_ex.patch b/0236-loader-efi-chainloader-Use-grub_loader_set_ex.patch new file mode 100644 index 0000000..ce98152 --- /dev/null +++ b/0236-loader-efi-chainloader-Use-grub_loader_set_ex.patch @@ -0,0 +1,148 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Fri, 29 Apr 2022 21:30:56 +0100 +Subject: [PATCH] loader/efi/chainloader: Use grub_loader_set_ex + +This ports the EFI chainloader to use grub_loader_set_ex in order to fix +a use-after-free bug that occurs when grub_cmd_chainloader is executed +more than once before a boot attempt is performed. + +Signed-off-by: Chris Coulson +(cherry picked from commit 4b7f0402b7cb0f67a93be736f2b75b818d7f44c9) +[rharwood: context sludge from other change] +Signed-off-by: Robbie Harwood +--- + grub-core/loader/efi/chainloader.c | 39 +++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index cbe028cd8af..b40acdeda80 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -49,8 +49,6 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + static grub_dl_t my_mod; + +-static grub_efi_handle_t image_handle; +- + struct grub_secureboot_chainloader_context { + grub_efi_physical_address_t address; + grub_efi_uintn_t pages; +@@ -60,7 +58,6 @@ struct grub_secureboot_chainloader_context { + grub_ssize_t cmdline_len; + grub_efi_handle_t dev_handle; + }; +-static struct grub_secureboot_chainloader_context *sb_context; + + static grub_err_t + grub_start_image (grub_efi_handle_t handle) +@@ -100,11 +97,14 @@ grub_start_image (grub_efi_handle_t handle) + } + + static grub_err_t +-grub_chainloader_unload (void) ++grub_chainloader_unload (void *context) + { ++ grub_efi_handle_t image_handle; + grub_efi_loaded_image_t *loaded_image; + grub_efi_boot_services_t *b; + ++ image_handle = (grub_efi_handle_t) context; ++ + loaded_image = grub_efi_get_loaded_image (image_handle); + if (loaded_image != NULL) + grub_free (loaded_image->load_options); +@@ -117,10 +117,12 @@ grub_chainloader_unload (void) + } + + static grub_err_t +-grub_chainloader_boot (void) ++grub_chainloader_boot (void *context) + { ++ grub_efi_handle_t image_handle; + grub_err_t err; + ++ image_handle = (grub_efi_handle_t) context; + err = grub_start_image (image_handle); + + grub_loader_unset (); +@@ -843,15 +845,17 @@ error_exit: + } + + static grub_err_t +-grub_secureboot_chainloader_unload (void) ++grub_secureboot_chainloader_unload (void *context) + { ++ struct grub_secureboot_chainloader_context *sb_context; ++ ++ sb_context = (struct grub_secureboot_chainloader_context *) context; ++ + grub_efi_free_pages (sb_context->address, sb_context->pages); + grub_free (sb_context->file_path); + grub_free (sb_context->cmdline); + grub_free (sb_context); + +- sb_context = 0; +- + grub_dl_unref (my_mod); + return GRUB_ERR_NONE; + } +@@ -900,12 +904,15 @@ grub_load_image(grub_efi_device_path_t *file_path, void *boot_image, + } + + static grub_err_t +-grub_secureboot_chainloader_boot (void) ++grub_secureboot_chainloader_boot (void *context) + { ++ struct grub_secureboot_chainloader_context *sb_context; + grub_efi_boot_services_t *b; + int rc; + grub_efi_handle_t handle = 0; + ++ sb_context = (struct grub_secureboot_chainloader_context *) context; ++ + rc = handle_image (sb_context); + if (rc == 0) + { +@@ -946,6 +953,8 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_efi_char16_t *cmdline = 0; + grub_ssize_t cmdline_len = 0; + grub_efi_handle_t dev_handle = 0; ++ grub_efi_handle_t image_handle = 0; ++ struct grub_secureboot_chainloader_context *sb_context = 0; + + file_path = NULL; + address = 0; +@@ -1136,8 +1145,8 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_file_close (file); + grub_device_close (dev); + +- grub_loader_set (grub_secureboot_chainloader_boot, +- grub_secureboot_chainloader_unload, 0); ++ grub_loader_set_ex (grub_secureboot_chainloader_boot, ++ grub_secureboot_chainloader_unload, sb_context, 0); + return 0; + } + else +@@ -1151,7 +1160,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + b->free_pages (address, pages); + grub_free (file_path); + +- grub_loader_set (grub_chainloader_boot, grub_chainloader_unload, 0); ++ grub_loader_set_ex (grub_chainloader_boot, grub_chainloader_unload, image_handle, 0); + + return 0; + } +@@ -1179,11 +1188,7 @@ fail: + if (cmdline) + grub_free (cmdline); + +- if (image_handle != 0) +- { +- b->unload_image (image_handle); +- image_handle = 0; +- } ++ b->unload_image (image_handle); + + grub_dl_unref (my_mod); + diff --git a/0237-loader-i386-efi-linux-Avoid-a-use-after-free-in-the-.patch b/0237-loader-i386-efi-linux-Avoid-a-use-after-free-in-the-.patch new file mode 100644 index 0000000..4d080a0 --- /dev/null +++ b/0237-loader-i386-efi-linux-Avoid-a-use-after-free-in-the-.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Mon, 2 May 2022 14:39:31 +0200 +Subject: [PATCH] loader/i386/efi/linux: Avoid a use-after-free in the linuxefi + loader + +In some error paths in grub_cmd_linux, the pointer to lh may be +dereferenced after the buffer it points to has been freed. There aren't +any security implications from this because nothing else uses the +allocator after the buffer is freed and before the pointer is +dereferenced, but fix it anyway. + +Signed-off-by: Chris Coulson +(cherry picked from commit 8224f5a71af94bec8697de17e7e579792db9f9e2) +--- + grub-core/loader/i386/efi/linux.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 1dd787081f2..8f7eddaa962 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -466,9 +466,6 @@ fail: + if (file) + grub_file_close (file); + +- if (kernel) +- grub_free (kernel); +- + if (grub_errno != GRUB_ERR_NONE) + { + grub_dl_unref (my_mod); +@@ -484,6 +481,8 @@ fail: + kernel_free (params, sizeof(*params)); + } + ++ grub_free (kernel); ++ + return grub_errno; + } + diff --git a/0238-loader-i386-efi-linux-Use-grub_loader_set_ex.patch b/0238-loader-i386-efi-linux-Use-grub_loader_set_ex.patch new file mode 100644 index 0000000..428c498 --- /dev/null +++ b/0238-loader-i386-efi-linux-Use-grub_loader_set_ex.patch @@ -0,0 +1,299 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Mon, 2 May 2022 17:04:23 +0200 +Subject: [PATCH] loader/i386/efi/linux: Use grub_loader_set_ex + +This ports the linuxefi loader to use grub_loader_set_ex in order to fix +a use-after-fre bug that occurs when grub_cmd_linux is executed more than +once before a boot attempt is performed. + +This is more complicated than for the chainloader command, as the initrd +command needs access to the loader state. To solve this, the linuxefi +module registers a dummy initrd command at startup that returns an error. +The linuxefi command then registers a proper initrd command with a higher +priority that is passed the loader state. + +Signed-off-by: Chris Coulson +(cherry picked from commit 7cf736436b4c934df5ddfa6f44b46a7e07d99fdc) +[rharwood/pjones: set kernel_size in context] +Signed-off-by: Robbie Harwood +--- + grub-core/loader/i386/efi/linux.c | 149 ++++++++++++++++++++++---------------- + 1 file changed, 88 insertions(+), 61 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 8f7eddaa962..3aaa2e9f175 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -34,13 +34,19 @@ + GRUB_MOD_LICENSE ("GPLv3+"); + + static grub_dl_t my_mod; +-static int loaded; +-static void *kernel_mem; +-static grub_uint64_t kernel_size; +-static void *initrd_mem; +-static grub_uint32_t handover_offset; +-struct linux_kernel_params *params; +-static char *linux_cmdline; ++ ++static grub_command_t cmd_linux, cmd_initrd; ++static grub_command_t cmd_linuxefi, cmd_initrdefi; ++ ++struct grub_linuxefi_context { ++ void *kernel_mem; ++ grub_uint64_t kernel_size; ++ grub_uint32_t handover_offset; ++ struct linux_kernel_params *params; ++ char *cmdline; ++ ++ void *initrd_mem; ++}; + + #define MIN(a, b) \ + ({ typeof (a) _a = (a); \ +@@ -123,25 +129,32 @@ kernel_alloc(grub_efi_uintn_t size, const char * const errmsg) + } + + static grub_err_t +-grub_linuxefi_boot (void) ++grub_linuxefi_boot (void *data) + { ++ struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) data; ++ + asm volatile ("cli"); + +- return grub_efi_linux_boot ((char *)kernel_mem, +- handover_offset, +- params); ++ return grub_efi_linux_boot ((char *)context->kernel_mem, ++ context->handover_offset, ++ context->params); + } + + static grub_err_t +-grub_linuxefi_unload (void) ++grub_linuxefi_unload (void *data) + { ++ struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) data; ++ struct linux_kernel_params *params = context->params; ++ + grub_dl_unref (my_mod); +- loaded = 0; + +- kernel_free(initrd_mem, params->ramdisk_size); +- kernel_free(linux_cmdline, params->cmdline_size + 1); +- kernel_free(kernel_mem, kernel_size); +- kernel_free(params, sizeof(*params)); ++ kernel_free (context->initrd_mem, params->ramdisk_size); ++ kernel_free (context->cmdline, params->cmdline_size + 1); ++ kernel_free (context->kernel_mem, context->kernel_size); ++ kernel_free (params, sizeof(*params)); ++ cmd_initrd->data = 0; ++ cmd_initrdefi->data = 0; ++ grub_free (context); + + return GRUB_ERR_NONE; + } +@@ -188,13 +201,14 @@ read(grub_file_t file, grub_uint8_t *bufp, grub_size_t len) + #define HIGH_U32(val) ((grub_uint32_t)(((grub_addr_t)(val) >> 32) & 0xffffffffull)) + + static grub_err_t +-grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), +- int argc, char *argv[]) ++grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + { + grub_file_t *files = 0; + int i, nfiles = 0; + grub_size_t size = 0; + grub_uint8_t *ptr; ++ struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) cmd->data; ++ struct linux_kernel_params *params; + + if (argc == 0) + { +@@ -202,12 +216,14 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + +- if (!loaded) ++ if (!context) + { + grub_error (GRUB_ERR_BAD_ARGUMENT, N_("you need to load the kernel first")); + goto fail; + } + ++ params = context->params; ++ + files = grub_calloc (argc, sizeof (files[0])); + if (!files) + goto fail; +@@ -225,19 +241,19 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + } + } + +- initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); +- if (initrd_mem == NULL) ++ context->initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); ++ if (context->initrd_mem == NULL) + goto fail; +- grub_dprintf ("linux", "initrd_mem = %p\n", initrd_mem); ++ grub_dprintf ("linux", "initrd_mem = %p\n", context->initrd_mem); + + params->ramdisk_size = LOW_U32(size); +- params->ramdisk_image = LOW_U32(initrd_mem); ++ params->ramdisk_image = LOW_U32(context->initrd_mem); + #if defined(__x86_64__) + params->ext_ramdisk_size = HIGH_U32(size); +- params->ext_ramdisk_image = HIGH_U32(initrd_mem); ++ params->ext_ramdisk_image = HIGH_U32(context->initrd_mem); + #endif + +- ptr = initrd_mem; ++ ptr = context->initrd_mem; + + for (i = 0; i < nfiles; i++) + { +@@ -261,9 +277,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + grub_file_close (files[i]); + grub_free (files); + +- if (initrd_mem && grub_errno) +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem, +- BYTES_TO_PAGES(size)); ++ if (context->initrd_mem && grub_errno) ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)context->initrd_mem, ++ BYTES_TO_PAGES(size)); + + return grub_errno; + } +@@ -277,6 +293,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_ssize_t start, filelen; + void *kernel = NULL; + int setup_header_end_offset; ++ void *kernel_mem = 0; ++ grub_uint64_t kernel_size = 0; ++ grub_uint32_t handover_offset; ++ struct linux_kernel_params *params = 0; ++ char *cmdline = 0; ++ struct grub_linuxefi_context *context = 0; + + grub_dl_ref (my_mod); + +@@ -390,28 +412,27 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_dprintf ("linux", "new lh is at %p\n", lh); + + grub_dprintf ("linux", "setting up cmdline\n"); +- linux_cmdline = kernel_alloc (lh->cmdline_size + 1, N_("can't allocate cmdline")); +- if (!linux_cmdline) ++ cmdline = kernel_alloc (lh->cmdline_size + 1, N_("can't allocate cmdline")); ++ if (!cmdline) + goto fail; +- grub_dprintf ("linux", "linux_cmdline = %p\n", linux_cmdline); ++ grub_dprintf ("linux", "cmdline = %p\n", cmdline); + +- grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); ++ grub_memcpy (cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE)); + grub_create_loader_cmdline (argc, argv, +- linux_cmdline + sizeof (LINUX_IMAGE) - 1, ++ cmdline + sizeof (LINUX_IMAGE) - 1, + lh->cmdline_size - (sizeof (LINUX_IMAGE) - 1), + GRUB_VERIFY_KERNEL_CMDLINE); + +- grub_dprintf ("linux", "cmdline:%s\n", linux_cmdline); +- ++ grub_dprintf ("linux", "cmdline:%s\n", cmdline); + grub_dprintf ("linux", "setting lh->cmd_line_ptr to 0x%08x\n", +- LOW_U32(linux_cmdline)); +- lh->cmd_line_ptr = LOW_U32(linux_cmdline); ++ LOW_U32(cmdline)); ++ lh->cmd_line_ptr = LOW_U32(cmdline); + #if defined(__x86_64__) +- if ((grub_efi_uintn_t)linux_cmdline > 0xffffffffull) ++ if ((grub_efi_uintn_t)cmdline > 0xffffffffull) + { + grub_dprintf ("linux", "setting params->ext_cmd_line_ptr to 0x%08x\n", +- HIGH_U32(linux_cmdline)); +- params->ext_cmd_line_ptr = HIGH_U32(linux_cmdline); ++ HIGH_U32(cmdline)); ++ params->ext_cmd_line_ptr = HIGH_U32(cmdline); + } + #endif + +@@ -436,16 +457,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + max_addresses[1].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + max_addresses[2].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; +- kernel_mem = kernel_alloc (lh->init_size, N_("can't allocate kernel")); ++ kernel_size = lh->init_size; ++ kernel_mem = kernel_alloc (kernel_size, N_("can't allocate kernel")); + restore_addresses(); + if (!kernel_mem) + goto fail; + grub_dprintf("linux", "kernel_mem = %p\n", kernel_mem); + +- grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0); +- +- loaded = 1; +- + grub_dprintf ("linux", "setting lh->code32_start to 0x%08x\n", + LOW_U32(kernel_mem)); + lh->code32_start = LOW_U32(kernel_mem); +@@ -462,33 +480,42 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + "setting lh->ext_loader_{type,ver} = {0x%02x,0x%02x}\n", + params->ext_loader_type, params->ext_loader_ver); + ++ context = grub_zalloc (sizeof (*context)); ++ if (!context) ++ goto fail; ++ context->kernel_mem = kernel_mem; ++ context->kernel_size = kernel_size; ++ context->handover_offset = handover_offset; ++ context->params = params; ++ context->cmdline = cmdline; ++ ++ grub_loader_set_ex (grub_linuxefi_boot, grub_linuxefi_unload, context, 0); ++ ++ cmd_initrd->data = context; ++ cmd_initrdefi->data = context; ++ ++ grub_file_close (file); ++ grub_free (kernel); ++ return 0; ++ + fail: + if (file) + grub_file_close (file); + +- if (grub_errno != GRUB_ERR_NONE) +- { +- grub_dl_unref (my_mod); +- loaded = 0; +- } ++ grub_dl_unref (my_mod); + +- if (!loaded) +- { +- if (lh) +- kernel_free (linux_cmdline, lh->cmdline_size + 1); ++ if (lh) ++ kernel_free (cmdline, lh->cmdline_size + 1); + +- kernel_free (kernel_mem, kernel_size); +- kernel_free (params, sizeof(*params)); +- } ++ kernel_free (kernel_mem, kernel_size); ++ kernel_free (params, sizeof(*params)); + ++ grub_free (context); + grub_free (kernel); + + return grub_errno; + } + +-static grub_command_t cmd_linux, cmd_initrd; +-static grub_command_t cmd_linuxefi, cmd_initrdefi; +- + GRUB_MOD_INIT(linux) + { + cmd_linux = diff --git a/0239-loader-i386-efi-linux-Fix-a-memory-leak-in-the-initr.patch b/0239-loader-i386-efi-linux-Fix-a-memory-leak-in-the-initr.patch new file mode 100644 index 0000000..e3b44f1 --- /dev/null +++ b/0239-loader-i386-efi-linux-Fix-a-memory-leak-in-the-initr.patch @@ -0,0 +1,75 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Tue, 3 May 2022 09:47:35 +0200 +Subject: [PATCH] loader/i386/efi/linux: Fix a memory leak in the initrd + command + +Subsequent invocations of the initrd command result in the previous +initrd being leaked, so fix that. + +Signed-off-by: Chris Coulson +(cherry picked from commit d98af31ce1e31bb22163960d53f5eb28c66582a0) +--- + grub-core/loader/i386/efi/linux.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 3aaa2e9f175..71c7ed6a76e 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -209,6 +209,7 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + grub_uint8_t *ptr; + struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) cmd->data; + struct linux_kernel_params *params; ++ void *initrd_mem = 0; + + if (argc == 0) + { +@@ -241,19 +242,19 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + } + } + +- context->initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); +- if (context->initrd_mem == NULL) ++ initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); ++ if (initrd_mem == NULL) + goto fail; +- grub_dprintf ("linux", "initrd_mem = %p\n", context->initrd_mem); ++ grub_dprintf ("linux", "initrd_mem = %p\n", initrd_mem); + + params->ramdisk_size = LOW_U32(size); +- params->ramdisk_image = LOW_U32(context->initrd_mem); ++ params->ramdisk_image = LOW_U32(initrd_mem); + #if defined(__x86_64__) + params->ext_ramdisk_size = HIGH_U32(size); +- params->ext_ramdisk_image = HIGH_U32(context->initrd_mem); ++ params->ext_ramdisk_image = HIGH_U32(initrd_mem); + #endif + +- ptr = context->initrd_mem; ++ ptr = initrd_mem; + + for (i = 0; i < nfiles; i++) + { +@@ -270,6 +271,9 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + ptr += ALIGN_UP_OVERHEAD (cursize, 4); + } + ++ kernel_free(context->initrd_mem, params->ramdisk_size); ++ ++ context->initrd_mem = initrd_mem; + params->ramdisk_size = size; + + fail: +@@ -277,9 +281,8 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + grub_file_close (files[i]); + grub_free (files); + +- if (context->initrd_mem && grub_errno) +- grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)context->initrd_mem, +- BYTES_TO_PAGES(size)); ++ if (initrd_mem && grub_errno) ++ kernel_free (initrd_mem, size); + + return grub_errno; + } diff --git a/0240-EFI-allocate-kernel-in-EFI_RUNTIME_SERVICES_CODE-ins.patch b/0240-EFI-allocate-kernel-in-EFI_RUNTIME_SERVICES_CODE-ins.patch new file mode 100644 index 0000000..ed35915 --- /dev/null +++ b/0240-EFI-allocate-kernel-in-EFI_RUNTIME_SERVICES_CODE-ins.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 9 Feb 2022 16:08:20 -0500 +Subject: [PATCH] EFI: allocate kernel in EFI_RUNTIME_SERVICES_CODE instead of + EFI_LOADER_DATA. + +On some of the firmwares with more security mitigations, EFI_LOADER_DATA +doesn't get you executable memory, and we take a fault and reboot when +we enter kernel. + +This patch correctly allocates the kernel code as EFI_RUNTIME_SERVICES_CODE +rather than EFI_LOADER_DATA. + +Signed-off-by: Peter Jones +[rharwood: use kernel_size] +Signed-off-by: Robbie Harwood +--- + grub-core/loader/i386/efi/linux.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 71c7ed6a76e..3ec9bb09c52 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -86,7 +86,9 @@ kernel_free(void *addr, grub_efi_uintn_t size) + } + + static void * +-kernel_alloc(grub_efi_uintn_t size, const char * const errmsg) ++kernel_alloc(grub_efi_uintn_t size, ++ grub_efi_memory_type_t memtype, ++ const char * const errmsg) + { + void *addr = 0; + unsigned int i; +@@ -112,7 +114,7 @@ kernel_alloc(grub_efi_uintn_t size, const char * const errmsg) + prev_max = max; + addr = grub_efi_allocate_pages_real (max, pages, + max_addresses[i].alloc_type, +- GRUB_EFI_LOADER_DATA); ++ memtype); + if (addr) + grub_dprintf ("linux", "Allocated at %p\n", addr); + } +@@ -242,7 +244,8 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + } + } + +- initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); ++ initrd_mem = kernel_alloc(size, GRUB_EFI_RUNTIME_SERVICES_DATA, ++ N_("can't allocate initrd")); + if (initrd_mem == NULL) + goto fail; + grub_dprintf ("linux", "initrd_mem = %p\n", initrd_mem); +@@ -393,7 +396,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + #endif + +- params = kernel_alloc (sizeof(*params), "cannot allocate kernel parameters"); ++ params = kernel_alloc (sizeof(*params), GRUB_EFI_RUNTIME_SERVICES_DATA, ++ "cannot allocate kernel parameters"); + if (!params) + goto fail; + grub_dprintf ("linux", "params = %p\n", params); +@@ -415,7 +419,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_dprintf ("linux", "new lh is at %p\n", lh); + + grub_dprintf ("linux", "setting up cmdline\n"); +- cmdline = kernel_alloc (lh->cmdline_size + 1, N_("can't allocate cmdline")); ++ cmdline = kernel_alloc (lh->cmdline_size + 1, ++ GRUB_EFI_RUNTIME_SERVICES_DATA, ++ N_("can't allocate cmdline")); + if (!cmdline) + goto fail; + grub_dprintf ("linux", "cmdline = %p\n", cmdline); +@@ -461,7 +467,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + max_addresses[1].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + max_addresses[2].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + kernel_size = lh->init_size; +- kernel_mem = kernel_alloc (kernel_size, N_("can't allocate kernel")); ++ kernel_mem = kernel_alloc (kernel_size, GRUB_EFI_RUNTIME_SERVICES_CODE, ++ N_("can't allocate kernel")); + restore_addresses(); + if (!kernel_mem) + goto fail; diff --git a/0241-efi-use-enumerated-array-positions-for-our-allocatio.patch b/0241-efi-use-enumerated-array-positions-for-our-allocatio.patch new file mode 100644 index 0000000..24f9131 --- /dev/null +++ b/0241-efi-use-enumerated-array-positions-for-our-allocatio.patch @@ -0,0 +1,81 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 1 Aug 2022 14:06:30 -0400 +Subject: [PATCH] efi: use enumerated array positions for our allocation + choices + +In our kernel allocator on EFI systems, we currently have a growing +amount of code that references the various allocation policies by +position in the array, and of course maintenance of this code scales +very poorly. + +This patch changes them to be enumerated, so they're easier to refer to +farther along in the code without confusion. + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/efi/linux.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 3ec9bb09c52..ef5875b7697 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -60,17 +60,26 @@ struct allocation_choice { + grub_efi_allocate_type_t alloc_type; + }; + +-static struct allocation_choice max_addresses[4] = ++enum { ++ KERNEL_PREF_ADDRESS, ++ KERNEL_4G_LIMIT, ++ KERNEL_NO_LIMIT, ++}; ++ ++static struct allocation_choice max_addresses[] = + { + /* the kernel overrides this one with pref_address and + * GRUB_EFI_ALLOCATE_ADDRESS */ +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ [KERNEL_PREF_ADDRESS] = ++ { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ /* If the flag in params is set, this one gets changed to be above 4GB. */ ++ [KERNEL_4G_LIMIT] = ++ { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, + /* this one is always below 4GB, which we still *prefer* even if the flag + * is set. */ +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, +- /* If the flag in params is set, this one gets changed to be above 4GB. */ +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, +- { 0, 0 } ++ [KERNEL_NO_LIMIT] = ++ { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ { NO_MEM, 0, 0 } + }; + static struct allocation_choice saved_addresses[4]; + +@@ -388,7 +397,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + if (lh->xloadflags & LINUX_XLF_CAN_BE_LOADED_ABOVE_4G) + { + grub_dprintf ("linux", "Loading kernel above 4GB is supported; enabling.\n"); +- max_addresses[2].addr = GRUB_EFI_MAX_USABLE_ADDRESS; ++ max_addresses[KERNEL_NO_LIMIT].addr = GRUB_EFI_MAX_USABLE_ADDRESS; + } + else + { +@@ -461,11 +470,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_dprintf ("linux", "lh->pref_address: %p\n", (void *)(grub_addr_t)lh->pref_address); + if (lh->pref_address < (grub_uint64_t)GRUB_EFI_MAX_ALLOCATION_ADDRESS) + { +- max_addresses[0].addr = lh->pref_address; +- max_addresses[0].alloc_type = GRUB_EFI_ALLOCATE_ADDRESS; ++ max_addresses[KERNEL_PREF_ADDRESS].addr = lh->pref_address; ++ max_addresses[KERNEL_PREF_ADDRESS].alloc_type = GRUB_EFI_ALLOCATE_ADDRESS; + } +- max_addresses[1].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; +- max_addresses[2].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; ++ max_addresses[KERNEL_4G_LIMIT].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; ++ max_addresses[KERNEL_NO_LIMIT].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + kernel_size = lh->init_size; + kernel_mem = kernel_alloc (kernel_size, GRUB_EFI_RUNTIME_SERVICES_CODE, + N_("can't allocate kernel")); diff --git a/0242-efi-split-allocation-policy-for-kernel-vs-initrd-mem.patch b/0242-efi-split-allocation-policy-for-kernel-vs-initrd-mem.patch new file mode 100644 index 0000000..20f3c66 --- /dev/null +++ b/0242-efi-split-allocation-policy-for-kernel-vs-initrd-mem.patch @@ -0,0 +1,127 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 1 Aug 2022 14:24:39 -0400 +Subject: [PATCH] efi: split allocation policy for kernel vs initrd memories. + +Currently in our kernel allocator, we use the same set of choices for +all of our various kernel and initramfs allocations, though they do not +have exactly the same constraints. + +This patch adds the concept of an allocation purpose, which currently +can be KERNEL_MEM or INITRD_MEM, and updates kernel_alloc() calls +appropriately, but does not change any current policy decision. It +also adds a few debug prints. + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/efi/linux.c | 35 +++++++++++++++++++++++++++-------- + 1 file changed, 27 insertions(+), 8 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index ef5875b7697..1d7ced3d1f8 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -55,7 +55,14 @@ struct grub_linuxefi_context { + + #define BYTES_TO_PAGES(bytes) (((bytes) + 0xfff) >> 12) + ++typedef enum { ++ NO_MEM, ++ KERNEL_MEM, ++ INITRD_MEM, ++} kernel_alloc_purpose_t; ++ + struct allocation_choice { ++ kernel_alloc_purpose_t purpose; + grub_efi_physical_address_t addr; + grub_efi_allocate_type_t alloc_type; + }; +@@ -64,6 +71,7 @@ enum { + KERNEL_PREF_ADDRESS, + KERNEL_4G_LIMIT, + KERNEL_NO_LIMIT, ++ INITRD_MAX_ADDRESS, + }; + + static struct allocation_choice max_addresses[] = +@@ -71,14 +79,17 @@ static struct allocation_choice max_addresses[] = + /* the kernel overrides this one with pref_address and + * GRUB_EFI_ALLOCATE_ADDRESS */ + [KERNEL_PREF_ADDRESS] = +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ { KERNEL_MEM, GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, + /* If the flag in params is set, this one gets changed to be above 4GB. */ + [KERNEL_4G_LIMIT] = +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ { KERNEL_MEM, GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, + /* this one is always below 4GB, which we still *prefer* even if the flag + * is set. */ + [KERNEL_NO_LIMIT] = +- { GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ { KERNEL_MEM, GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, ++ /* this is for the initrd */ ++ [INITRD_MAX_ADDRESS] = ++ { INITRD_MEM, GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, + { NO_MEM, 0, 0 } + }; + static struct allocation_choice saved_addresses[4]; +@@ -95,7 +106,8 @@ kernel_free(void *addr, grub_efi_uintn_t size) + } + + static void * +-kernel_alloc(grub_efi_uintn_t size, ++kernel_alloc(kernel_alloc_purpose_t purpose, ++ grub_efi_uintn_t size, + grub_efi_memory_type_t memtype, + const char * const errmsg) + { +@@ -108,6 +120,9 @@ kernel_alloc(grub_efi_uintn_t size, + grub_uint64_t max = max_addresses[i].addr; + grub_efi_uintn_t pages; + ++ if (purpose != max_addresses[i].purpose) ++ continue; ++ + /* + * When we're *not* loading the kernel, or >4GB allocations aren't + * supported, these entries are basically all the same, so don't re-try +@@ -253,7 +268,8 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + } + } + +- initrd_mem = kernel_alloc(size, GRUB_EFI_RUNTIME_SERVICES_DATA, ++ grub_dprintf ("linux", "Trying to allocate initrd mem\n"); ++ initrd_mem = kernel_alloc(INITRD_MEM, size, GRUB_EFI_RUNTIME_SERVICES_DATA, + N_("can't allocate initrd")); + if (initrd_mem == NULL) + goto fail; +@@ -405,7 +421,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + #endif + +- params = kernel_alloc (sizeof(*params), GRUB_EFI_RUNTIME_SERVICES_DATA, ++ params = kernel_alloc (KERNEL_MEM, sizeof(*params), ++ GRUB_EFI_RUNTIME_SERVICES_DATA, + "cannot allocate kernel parameters"); + if (!params) + goto fail; +@@ -428,7 +445,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_dprintf ("linux", "new lh is at %p\n", lh); + + grub_dprintf ("linux", "setting up cmdline\n"); +- cmdline = kernel_alloc (lh->cmdline_size + 1, ++ cmdline = kernel_alloc (KERNEL_MEM, lh->cmdline_size + 1, + GRUB_EFI_RUNTIME_SERVICES_DATA, + N_("can't allocate cmdline")); + if (!cmdline) +@@ -476,7 +493,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + max_addresses[KERNEL_4G_LIMIT].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + max_addresses[KERNEL_NO_LIMIT].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; + kernel_size = lh->init_size; +- kernel_mem = kernel_alloc (kernel_size, GRUB_EFI_RUNTIME_SERVICES_CODE, ++ grub_dprintf ("linux", "Trying to allocate kernel mem\n"); ++ kernel_mem = kernel_alloc (KERNEL_MEM, kernel_size, ++ GRUB_EFI_RUNTIME_SERVICES_CODE, + N_("can't allocate kernel")); + restore_addresses(); + if (!kernel_mem) diff --git a/0243-efi-allocate-the-initrd-within-the-bounds-expressed-.patch b/0243-efi-allocate-the-initrd-within-the-bounds-expressed-.patch new file mode 100644 index 0000000..922088b --- /dev/null +++ b/0243-efi-allocate-the-initrd-within-the-bounds-expressed-.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 1 Aug 2022 14:07:50 -0400 +Subject: [PATCH] efi: allocate the initrd within the bounds expressed by the + kernel + +Currently on x86, only linux kernels built with CONFIG_RELOCATABLE for +x86_64 can be loaded above 4G, but the maximum address for the initramfs +is specified via a HdrS field. This allows us to utilize that value, +and unless loading the kernel above 4G, uses the value present there. +If loading kernel above 4G is allowed, we assume loading the initramfs +above 4G also works; in practice this has been true in the kernel code +for quite some time. + +Resolves: rhbz#2112134 + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/efi/linux.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 1d7ced3d1f8..a798da334ab 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -182,6 +182,8 @@ grub_linuxefi_unload (void *data) + cmd_initrdefi->data = 0; + grub_free (context); + ++ max_addresses[INITRD_MAX_ADDRESS].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; ++ + return GRUB_ERR_NONE; + } + +@@ -409,11 +411,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + } + #endif + ++ max_addresses[INITRD_MAX_ADDRESS].addr = lh->initrd_addr_max; + #if defined(__x86_64__) + if (lh->xloadflags & LINUX_XLF_CAN_BE_LOADED_ABOVE_4G) + { + grub_dprintf ("linux", "Loading kernel above 4GB is supported; enabling.\n"); + max_addresses[KERNEL_NO_LIMIT].addr = GRUB_EFI_MAX_USABLE_ADDRESS; ++ max_addresses[INITRD_MAX_ADDRESS].addr = GRUB_EFI_MAX_USABLE_ADDRESS; + } + else + { +@@ -542,6 +546,8 @@ fail: + + grub_dl_unref (my_mod); + ++ max_addresses[INITRD_MAX_ADDRESS].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS; ++ + if (lh) + kernel_free (cmdline, lh->cmdline_size + 1); + diff --git a/0244-efi-use-EFI_LOADER_-CODE-DATA-for-kernel-and-initrd-.patch b/0244-efi-use-EFI_LOADER_-CODE-DATA-for-kernel-and-initrd-.patch new file mode 100644 index 0000000..914ad43 --- /dev/null +++ b/0244-efi-use-EFI_LOADER_-CODE-DATA-for-kernel-and-initrd-.patch @@ -0,0 +1,61 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 1 Aug 2022 13:04:43 -0400 +Subject: [PATCH] efi: use EFI_LOADER_(CODE|DATA) for kernel and initrd + allocations + +At some point due to an erroneous kernel warning, we switched kernel and +initramfs to being loaded in EFI_RUNTIME_SERVICES_CODE and +EFI_RUNTIME_SERVICES_DATA memory pools. This doesn't appear to be +correct according to the spec, and that kernel warning has gone away. + +This patch puts them back in EFI_LOADER_CODE and EFI_LOADER_DATA +allocations, respectively. + +Resolves: rhbz#2108456 + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/efi/linux.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index a798da334ab..03d27c81fd3 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -271,7 +271,7 @@ grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[]) + } + + grub_dprintf ("linux", "Trying to allocate initrd mem\n"); +- initrd_mem = kernel_alloc(INITRD_MEM, size, GRUB_EFI_RUNTIME_SERVICES_DATA, ++ initrd_mem = kernel_alloc(INITRD_MEM, size, GRUB_EFI_LOADER_DATA, + N_("can't allocate initrd")); + if (initrd_mem == NULL) + goto fail; +@@ -426,7 +426,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + #endif + + params = kernel_alloc (KERNEL_MEM, sizeof(*params), +- GRUB_EFI_RUNTIME_SERVICES_DATA, ++ GRUB_EFI_LOADER_DATA, + "cannot allocate kernel parameters"); + if (!params) + goto fail; +@@ -450,7 +450,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + grub_dprintf ("linux", "setting up cmdline\n"); + cmdline = kernel_alloc (KERNEL_MEM, lh->cmdline_size + 1, +- GRUB_EFI_RUNTIME_SERVICES_DATA, ++ GRUB_EFI_LOADER_DATA, + N_("can't allocate cmdline")); + if (!cmdline) + goto fail; +@@ -499,7 +499,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + kernel_size = lh->init_size; + grub_dprintf ("linux", "Trying to allocate kernel mem\n"); + kernel_mem = kernel_alloc (KERNEL_MEM, kernel_size, +- GRUB_EFI_RUNTIME_SERVICES_CODE, ++ GRUB_EFI_LOADER_CODE, + N_("can't allocate kernel")); + restore_addresses(); + if (!kernel_mem) diff --git a/0245-x86-efi-Fix-an-incorrect-array-size-in-kernel-alloca.patch b/0245-x86-efi-Fix-an-incorrect-array-size-in-kernel-alloca.patch new file mode 100644 index 0000000..e19f154 --- /dev/null +++ b/0245-x86-efi-Fix-an-incorrect-array-size-in-kernel-alloca.patch @@ -0,0 +1,36 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 11 Oct 2022 17:00:50 -0400 +Subject: [PATCH] x86-efi: Fix an incorrect array size in kernel allocation + +In 81a6ebf62bbe166ddc968463df2e8bd481bf697c ("efi: split allocation +policy for kernel vs initrd memories."), I introduced a split in the +kernel allocator to allow for different dynamic policies for the kernel +and the initrd allocations. + +Unfortunately, that change increased the size of the policy data used to +make decisions, but did not change the size of the temporary storage we +use to back it up and restore. This results in some of .data getting +clobbered at runtime, and hilarity ensues. + +This patch makes the size of the backup storage be based on the size of +the initial policy data. + +Signed-off-by: Peter Jones +--- + grub-core/loader/i386/efi/linux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 03d27c81fd3..f97b123a51e 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -92,7 +92,7 @@ static struct allocation_choice max_addresses[] = + { INITRD_MEM, GRUB_EFI_MAX_ALLOCATION_ADDRESS, GRUB_EFI_ALLOCATE_MAX_ADDRESS }, + { NO_MEM, 0, 0 } + }; +-static struct allocation_choice saved_addresses[4]; ++static struct allocation_choice saved_addresses[sizeof(max_addresses) / sizeof(max_addresses[0])]; + + #define save_addresses() grub_memcpy(saved_addresses, max_addresses, sizeof(max_addresses)) + #define restore_addresses() grub_memcpy(max_addresses, saved_addresses, sizeof(max_addresses)) diff --git a/0246-grub-install-on-EFI-if-forced.patch b/0246-grub-install-on-EFI-if-forced.patch new file mode 100644 index 0000000..e569cf1 --- /dev/null +++ b/0246-grub-install-on-EFI-if-forced.patch @@ -0,0 +1,80 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Tue, 6 Feb 2024 17:42:47 -0600 +Subject: [PATCH] grub-install on EFI if forced + +UEFI Secure Boot requires signed grub binaries to work, so grub- +install should not be used. However, users who have Secure Boot +disabled and wish to use the command should not be prevented from +doing so if they invoke --force. + +fixes bz#1917213 / bz#2240994 + +Signed-off-by: Marta Lewandowska +--- + util/grub-install.c | 38 +++++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/util/grub-install.c b/util/grub-install.c +index 828e8722ba5..314b6143b8e 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -915,25 +915,6 @@ main (int argc, char *argv[]) + + platform = grub_install_get_target (grub_install_source_directory); + +- switch (platform) +- { +- case GRUB_INSTALL_PLATFORM_ARM_EFI: +- case GRUB_INSTALL_PLATFORM_ARM64_EFI: +- case GRUB_INSTALL_PLATFORM_I386_EFI: +- case GRUB_INSTALL_PLATFORM_IA64_EFI: +- case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: +- case GRUB_INSTALL_PLATFORM_RISCV32_EFI: +- case GRUB_INSTALL_PLATFORM_RISCV64_EFI: +- case GRUB_INSTALL_PLATFORM_X86_64_EFI: +- is_efi = 1; +- grub_util_error (_("this utility cannot be used for EFI platforms" +- " because it does not support UEFI Secure Boot")); +- break; +- default: +- is_efi = 0; +- break; +- } +- + { + char *platname = grub_install_get_platform_name (platform); + fprintf (stderr, _("Installing for %s platform.\n"), platname); +@@ -1050,6 +1031,22 @@ main (int argc, char *argv[]) + + switch (platform) + { ++ case GRUB_INSTALL_PLATFORM_ARM_EFI: ++ case GRUB_INSTALL_PLATFORM_ARM64_EFI: ++ case GRUB_INSTALL_PLATFORM_I386_EFI: ++ case GRUB_INSTALL_PLATFORM_IA64_EFI: ++ case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: ++ case GRUB_INSTALL_PLATFORM_RISCV32_EFI: ++ case GRUB_INSTALL_PLATFORM_RISCV64_EFI: ++ case GRUB_INSTALL_PLATFORM_X86_64_EFI: ++ is_efi = 1; ++ if (!force) ++ grub_util_error (_("This utility should not be used for EFI platforms" ++ " because it does not support UEFI Secure Boot." ++ " If you really wish to proceed, invoke the --force" ++ " option.\nMake sure Secure Boot is disabled before" ++ " proceeding")); ++ break; + case GRUB_INSTALL_PLATFORM_I386_IEEE1275: + case GRUB_INSTALL_PLATFORM_POWERPC_IEEE1275: + #ifdef __linux__ +@@ -1058,6 +1055,9 @@ main (int argc, char *argv[]) + try_open ("/dev/nvram"); + #endif + break; ++ /* pacify warning. */ ++ case GRUB_INSTALL_PLATFORM_MAX: ++ break; + default: + break; + } diff --git a/0247-Remove-Install-section-from-aux-systemd-units.patch b/0247-Remove-Install-section-from-aux-systemd-units.patch new file mode 100644 index 0000000..500b9f5 --- /dev/null +++ b/0247-Remove-Install-section-from-aux-systemd-units.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Christian Glombek +Date: Tue, 14 Nov 2023 07:54:59 +0100 +Subject: [PATCH] Remove [Install] section from aux systemd units + +See https://bugzilla.redhat.com/show_bug.cgi?id=2247635#c7 +--- + docs/grub-boot-indeterminate.service | 3 --- + util/systemd/grub-systemd-integration.service.in | 3 --- + 2 files changed, 6 deletions(-) + +diff --git a/docs/grub-boot-indeterminate.service b/docs/grub-boot-indeterminate.service +index 5bcb474a3d3..6c8dcb186b6 100644 +--- a/docs/grub-boot-indeterminate.service ++++ b/docs/grub-boot-indeterminate.service +@@ -9,6 +9,3 @@ Before=system-update-pre.target + [Service] + Type=oneshot + ExecStart=/usr/bin/grub2-editenv - incr boot_indeterminate +- +-[Install] +-WantedBy=system-update.target +diff --git a/util/systemd/grub-systemd-integration.service.in b/util/systemd/grub-systemd-integration.service.in +index 22ca1ca4885..c81fb594ce1 100644 +--- a/util/systemd/grub-systemd-integration.service.in ++++ b/util/systemd/grub-systemd-integration.service.in +@@ -6,6 +6,3 @@ ConditionPathExists=/run/systemd/reboot-to-boot-loader-menu + + [Service] + ExecStart=@libexecdir@/@grubdirname@/systemd-integration.sh +- +-[Install] +-WantedBy=reboot.target diff --git a/0248-chainloader-remove-device-path-debug-message.patch b/0248-chainloader-remove-device-path-debug-message.patch new file mode 100644 index 0000000..306aad3 --- /dev/null +++ b/0248-chainloader-remove-device-path-debug-message.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: raravind +Date: Tue, 9 May 2023 11:29:35 +0200 +Subject: [PATCH] chainloader: remove device path debug message + +Remove the debug message "/EndEntire" while using GRUB chainloader command. + +Signed-off-by: raravind +(cherry picked from commit f75f5386b7a6a7cb2e10d30f817a3564c0a28dd7) +--- + grub-core/loader/efi/chainloader.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index b40acdeda80..badff5e50b5 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -212,7 +212,6 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + /* Fill the file path for the directory. */ + d = (grub_efi_device_path_t *) ((char *) file_path + + ((char *) d - (char *) dp)); +- grub_efi_print_device_path (d); + if (copy_file_path ((grub_efi_file_path_device_path_t *) d, + dir_start, dir_end - dir_start) != GRUB_ERR_NONE) + { diff --git a/0266-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch b/0249-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch similarity index 96% rename from 0266-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch rename to 0249-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch index d3eb61d..995181f 100644 --- a/0266-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch +++ b/0249-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch @@ -1,8 +1,7 @@ -From 734596cba0c064ccdcb96de3fd66dbf093e7ec09 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Solar Designer Date: Tue, 6 Feb 2024 21:39:41 +0100 -Subject: [PATCH 266/272] grub-set-bootflag: Conservative partial fix for - CVE-2024-1048 +Subject: [PATCH] grub-set-bootflag: Conservative partial fix for CVE-2024-1048 Following up on CVE-2019-14865 and taking a fresh look at grub2-set-bootflag now (through my work at CIQ on Rocky Linux), I saw some @@ -71,7 +70,7 @@ Signed-off-by: Solar Designer 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index 3b4c25ca2..5bbbef804 100644 +index 3b4c25ca2ac..5bbbef80439 100644 --- a/util/grub-set-bootflag.c +++ b/util/grub-set-bootflag.c @@ -33,6 +33,8 @@ @@ -112,15 +111,15 @@ index 3b4c25ca2..5bbbef804 100644 */ - ret = setuid(0); - if (ret) -- { ++ if (setegid(0)) + { - perror ("Error setuid(0) failed"); - return 1; - } - - ret = setgid(0); - if (ret) -+ if (setegid(0)) - { +- { - perror ("Error setgid(0) failed"); + perror ("Error setegid(0) failed"); return 1; @@ -145,6 +144,3 @@ index 3b4c25ca2..5bbbef804 100644 memcpy(s, buf, len + 3); --- -2.41.0 - diff --git a/0267-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch b/0250-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch similarity index 90% rename from 0267-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch rename to 0250-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch index 92b5bf7..615b04d 100644 --- a/0267-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch +++ b/0250-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch @@ -1,8 +1,7 @@ -From 95c3ef1d6daf1b52cd0916c57db83c8a3c124407 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Solar Designer Date: Tue, 6 Feb 2024 21:56:21 +0100 -Subject: [PATCH 267/272] grub-set-bootflag: More complete fix for - CVE-2024-1048 +Subject: [PATCH] grub-set-bootflag: More complete fix for CVE-2024-1048 Switch to per-user fixed temporary filenames along with a weird locking mechanism, which is explained in source code comments. This is a more @@ -26,11 +25,11 @@ B. One leftover temporary file per user is still possible. Signed-off-by: Solar Designer --- - util/grub-set-bootflag.c | 87 ++++++++++++++++++++++++++++++++++------ - 1 file changed, 75 insertions(+), 12 deletions(-) + util/grub-set-bootflag.c | 95 ++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 79 insertions(+), 16 deletions(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index 5bbbef804..514c4f909 100644 +index 5bbbef80439..514c4f9091a 100644 --- a/util/grub-set-bootflag.c +++ b/util/grub-set-bootflag.c @@ -33,6 +33,7 @@ @@ -153,36 +152,36 @@ index 5bbbef804..514c4f909 100644 f = fdopen (fd, "w"); if (!f) { -@@ -213,23 +274,25 @@ int main(int argc, char *argv[]) +@@ -213,6 +274,14 @@ int main(int argc, char *argv[]) return 1; } -- ret = fsync (fileno (f)); + ret = ftruncate (fileno (f), GRUBENV_SIZE); ++ if (ret) ++ { ++ perror ("Error truncating tmpfile"); ++ unlink(tmp_filename); ++ return 1; ++ } ++ + ret = fsync (fileno (f)); if (ret) { -- perror ("Error syncing tmpfile"); -+ perror ("Error truncating tmpfile"); - unlink(tmp_filename); +@@ -221,15 +290,9 @@ int main(int argc, char *argv[]) return 1; } - ret = fclose (f); -+ ret = fsync (fileno (f)); - if (ret) - { +- if (ret) +- { - perror ("Error closing tmpfile"); -+ perror ("Error syncing tmpfile"); - unlink(tmp_filename); - return 1; - } - +- unlink(tmp_filename); +- return 1; +- } +- /* + * We must not close the file before rename() as that would remove the lock. + * * And finally rename the tmpfile with the new env over the old env, the * linux kernel guarantees that this is atomic (from a syscall pov). */ --- -2.41.0 - diff --git a/0251-grub-install-disable-support-for-EFI-platforms-unles.patch b/0251-grub-install-disable-support-for-EFI-platforms-unles.patch deleted file mode 100644 index b8790a2..0000000 --- a/0251-grub-install-disable-support-for-EFI-platforms-unles.patch +++ /dev/null @@ -1,49 +0,0 @@ -From a5ddb3cb4380396025f8ccbc1f7c11bae11b8b8b Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Wed, 3 Apr 2024 14:49:19 +0800 -Subject: [PATCH 251/272] grub-install: disable support for EFI platforms, - unless use --force - -v1: For each platform, GRUB is shipped as a kernel image and a set of -modules. These files are then used by the grub-install utility to -install GRUB on a specific device. However, in order to support UEFI -Secure Boot, the resulting EFI binary must be signed by a recognized -private key. For this reason, for EFI platforms, most distributions also -ship prebuilt EFI binaries signed by a distribution-specific private -key. In this case, however, the grub-install utility should not be used -because it would overwrite the signed EFI binary. - -v2: UEFI Secure Boot requires signed grub binaries to work, so grub- -install should not be used. However, users who have Secure Boot -disabled and wish to use the command should not be prevented from -doing so if they invoke --force. - -fixes bz#1917213 / bz#2240994 - -Signed-off-by: Jan Hlavac -Signed-off-by: Marta Lewandowska -Signed-off-by: nilusyi ---- - util/grub-install.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/util/grub-install.c b/util/grub-install.c -index 4f0af4844..7a2fcfea2 100644 ---- a/util/grub-install.c -+++ b/util/grub-install.c -@@ -1151,6 +1151,12 @@ main (int argc, char *argv[]) - case GRUB_INSTALL_PLATFORM_RISCV64_EFI: - case GRUB_INSTALL_PLATFORM_IA64_EFI: - is_efi = 1; -+ if (!force) -+ grub_util_error (_("This utility should not be used for EFI platforms" -+ " because it does not support UEFI Secure Boot." -+ " If you really wish to proceed, invoke the --force" -+ " option.\nMake sure Secure Boot is disabled before" -+ " proceeding")); - break; - default: - is_efi = 0; --- -2.41.0 - diff --git a/0268-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch b/0251-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch similarity index 85% rename from 0268-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch rename to 0251-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch index b619939..5b41025 100644 --- a/0268-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch +++ b/0251-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch @@ -1,8 +1,7 @@ -From c1edbdb3480020b8a6e9803ba502879518c45934 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Solar Designer Date: Tue, 6 Feb 2024 22:05:45 +0100 -Subject: [PATCH 268/272] grub-set-bootflag: Exit calmly when not running as - root +Subject: [PATCH] grub-set-bootflag: Exit calmly when not running as root Exit calmly when not installed SUID root and invoked by non-root. This allows installing user/grub-boot-success.service unconditionally while @@ -14,7 +13,7 @@ Signed-off-by: Solar Designer 1 file changed, 11 insertions(+) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c -index 514c4f909..31a868aec 100644 +index 514c4f9091a..31a868aeca8 100644 --- a/util/grub-set-bootflag.c +++ b/util/grub-set-bootflag.c @@ -98,6 +98,17 @@ int main(int argc, char *argv[]) @@ -35,6 +34,3 @@ index 514c4f909..31a868aec 100644 /* * setegid avoids the new grubenv's gid being that of the user. */ --- -2.41.0 - diff --git a/0252-Makefile.core.def-fix-linux-module.patch b/0252-Makefile.core.def-fix-linux-module.patch new file mode 100644 index 0000000..83d8d8e --- /dev/null +++ b/0252-Makefile.core.def-fix-linux-module.patch @@ -0,0 +1,61 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Mon, 15 Apr 2024 09:24:47 -0600 +Subject: [PATCH] Makefile.core.def: fix linux module + +Set EFI source file targets specifically for i386 and x86_64 archs, +otherwise we observe build failures at aarch64 + +../../grub-core/tests/videotest_checksum.c > videotest_checksum.marker.new || (rm -f videotest_checksum.marker; exit 1) +../../grub-core/loader/efi/linux.c:28:10: fatal error: grub/cpu/linux.h: No such file or directory + 28 | #include + | ^~~~~~~~~~~~~~~~~~ +compilation terminated. +. +. +. +../../grub-core/loader/i386/linux.c:30:10: fatal error: grub/cpu/linux.h: No such file or directory + 30 | #include + | ^~~~~~~~~~~~~~~~~~ +compilation terminated. + +Signed-off-by: Leo Sandoval +--- + grub-core/Makefile.core.def | 7 ++++--- + grub-core/loader/efi/linux.c | 1 - + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index b045aac7c91..6ff4835340d 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -1902,13 +1902,14 @@ module = { + riscv32 = loader/efi/linux.c; + riscv64 = loader/efi/linux.c; + i386_efi = loader/i386/efi/linux.c; ++ i386_efi = loader/efi/linux.c; ++ i386_efi = loader/i386/linux.c; + x86_64_efi = loader/i386/efi/linux.c; ++ x86_64_efi = loader/efi/linux.c; ++ x86_64_efi = loader/i386/linux.c; + emu = loader/emu/linux.c; +- fdt = lib/fdt.c; + common = loader/linux.c; + common = lib/cmdline.c; +- efi = loader/efi/linux.c; +- efi = loader/i386/linux.c; + }; + + module = { +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index f5ab0128991..44587df3858 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -25,7 +25,6 @@ + #include + #include + #include +-#include + #include + #include + #include diff --git a/0253-Add-support-for-Linux-EFI-stub-loading-on-arm-archit.patch b/0253-Add-support-for-Linux-EFI-stub-loading-on-arm-archit.patch new file mode 100644 index 0000000..d9ff0b6 --- /dev/null +++ b/0253-Add-support-for-Linux-EFI-stub-loading-on-arm-archit.patch @@ -0,0 +1,270 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Mon, 15 Apr 2024 11:19:31 -0600 +Subject: [PATCH] Add support for Linux EFI stub loading on arm architectures + +--- + grub-core/loader/arm64/xen_boot.c | 1 - + grub-core/loader/efi/linux.c | 116 ++++++++++++++++++-------------------- + include/grub/efi/efi.h | 28 ++++++++- + 3 files changed, 80 insertions(+), 65 deletions(-) + +diff --git a/grub-core/loader/arm64/xen_boot.c b/grub-core/loader/arm64/xen_boot.c +index 26e1472c9d2..9838a0f878b 100644 +--- a/grub-core/loader/arm64/xen_boot.c ++++ b/grub-core/loader/arm64/xen_boot.c +@@ -252,7 +252,6 @@ xen_boot (void) + return err; + + return grub_arch_efi_linux_boot_image (xen_hypervisor->start, +- xen_hypervisor->size, + xen_hypervisor->cmdline); + } + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 44587df3858..8742e303d85 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -42,6 +43,7 @@ static int loaded; + + static void *kernel_addr; + static grub_uint64_t kernel_size; ++static grub_uint32_t handover_offset; + + static char *linux_args; + static grub_uint32_t cmdline_size; +@@ -94,7 +96,7 @@ static grub_efi_load_file2_t initrd_lf2 = { + typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); + + grub_err_t +-grub_efi_linux_boot (void *kernel_address, grub_off_t handover_offset, ++grub_efi_linux_boot (void *kernel_address, grub_off_t ho_offset, + void *kernel_params) + { + grub_efi_loaded_image_t *loaded_image = NULL; +@@ -117,8 +119,8 @@ grub_efi_linux_boot (void *kernel_address, grub_off_t handover_offset, + grub_dprintf ("linux", "Loaded Image base address could not be set\n"); + + grub_dprintf ("linux", "kernel_address: %p handover_offset: %p params: %p\n", +- kernel_address, (void *)(grub_efi_uintn_t)handover_offset, kernel_params); +- hf = (handover_func)((char *)kernel_address + handover_offset + offset); ++ kernel_address, (void *)(grub_efi_uintn_t)ho_offset, kernel_params); ++ hf = (handover_func)((char *)kernel_address + ho_offset + offset); + hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); + + return GRUB_ERR_BUG; +@@ -178,7 +180,8 @@ grub_arch_efi_linux_load_image_header (grub_file_t file, + static grub_err_t + finalize_params_linux (void) + { +- int node, retval; ++ grub_efi_loaded_image_t *loaded_image = NULL; ++ int node, retval, len; + + void *fdt; + +@@ -213,79 +216,65 @@ finalize_params_linux (void) + if (grub_fdt_install() != GRUB_ERR_NONE) + goto failure; + +- return GRUB_ERR_NONE; +- +-failure: +- grub_fdt_unload(); +- return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT"); +-} +-#endif +- +-grub_err_t +-grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args) +-{ +- grub_efi_memory_mapped_device_path_t *mempath; +- grub_efi_handle_t image_handle; +- grub_efi_boot_services_t *b; +- grub_efi_status_t status; +- grub_efi_loaded_image_t *loaded_image; +- int len; +- +- mempath = grub_malloc (2 * sizeof (grub_efi_memory_mapped_device_path_t)); +- if (!mempath) +- return grub_errno; +- +- mempath[0].header.type = GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE; +- mempath[0].header.subtype = GRUB_EFI_MEMORY_MAPPED_DEVICE_PATH_SUBTYPE; +- mempath[0].header.length = grub_cpu_to_le16_compile_time (sizeof (*mempath)); +- mempath[0].memory_type = GRUB_EFI_LOADER_DATA; +- mempath[0].start_address = addr; +- mempath[0].end_address = addr + size; +- +- mempath[1].header.type = GRUB_EFI_END_DEVICE_PATH_TYPE; +- mempath[1].header.subtype = GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE; +- mempath[1].header.length = sizeof (grub_efi_device_path_t); +- +- b = grub_efi_system_table->boot_services; +- status = b->load_image (0, grub_efi_image_handle, +- (grub_efi_device_path_t *) mempath, +- (void *) addr, size, &image_handle); +- if (status != GRUB_EFI_SUCCESS) +- return grub_error (GRUB_ERR_BAD_OS, "cannot load image"); +- +- grub_dprintf ("linux", "linux command line: '%s'\n", args); ++ grub_dprintf ("linux", "Installed/updated FDT configuration table @ %p\n", ++ fdt); + + /* Convert command line to UCS-2 */ +- loaded_image = grub_efi_get_loaded_image (image_handle); ++ loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); + if (loaded_image == NULL) + { + grub_error (GRUB_ERR_BAD_FIRMWARE, "missing loaded_image proto"); +- goto unload; ++ goto failure; + } + loaded_image->load_options_size = len = +- (grub_strlen (args) + 1) * sizeof (grub_efi_char16_t); ++ (grub_strlen (linux_args) + 1) * sizeof (grub_efi_char16_t); + loaded_image->load_options = + grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); + if (!loaded_image->load_options) +- return grub_errno; ++ return grub_error(GRUB_ERR_BAD_OS, "failed to create kernel parameters"); + + loaded_image->load_options_size = + 2 * grub_utf8_to_utf16 (loaded_image->load_options, len, +- (grub_uint8_t *) args, len, NULL); ++ (grub_uint8_t *) linux_args, len, NULL); + +- grub_dprintf ("linux", "starting image %p\n", image_handle); +- status = b->start_image (image_handle, 0, NULL); ++ return GRUB_ERR_NONE; + +- /* When successful, not reached */ +- grub_error (GRUB_ERR_BAD_OS, "start_image() returned 0x%" PRIxGRUB_EFI_UINTN_T, status); +- grub_efi_free_pages ((grub_addr_t) loaded_image->load_options, +- GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); +-unload: +- b->unload_image (image_handle); ++failure: ++ grub_fdt_unload(); ++ return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT"); ++} ++#endif ++ ++static void ++free_params (void) ++{ ++ grub_efi_loaded_image_t *loaded_image = NULL; + +- return grub_errno; ++ loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); ++ if (loaded_image) ++ { ++ if (loaded_image->load_options) ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_efi_uintn_t)loaded_image->load_options, ++ GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); ++ loaded_image->load_options = NULL; ++ loaded_image->load_options_size = 0; ++ } + } + ++grub_err_t ++grub_arch_efi_linux_boot_image (grub_addr_t addr, char *args) ++{ ++ grub_err_t retval; ++ ++ grub_dprintf ("linux", "linux command line: '%s'\n", args); ++ ++ retval = grub_efi_linux_boot ((char *)addr, handover_offset, (void *)addr); ++ ++ /* Never reached... */ ++ free_params(); ++ return retval; ++ } ++ + static grub_err_t + grub_linux_boot (void) + { +@@ -294,8 +283,7 @@ grub_linux_boot (void) + return grub_errno; + #endif + +- return grub_arch_efi_linux_boot_image ((grub_addr_t) kernel_addr, +- kernel_size, linux_args); ++ return grub_arch_efi_linux_boot_image ((grub_addr_t) kernel_addr, linux_args); + } + + static grub_err_t +@@ -572,6 +560,12 @@ fallback: + + grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); + ++#if !defined(__i386__) && !defined(__x86_64__) ++ struct grub_armxx_linux_pe_header *pe; ++ pe = (void *)((unsigned long)kernel_addr + lh.hdr_offset); ++ handover_offset = pe->opt.entry_addr; ++#endif ++ + cmdline_size = grub_loader_cmdline_size (argc, argv) + sizeof (LINUX_IMAGE); + linux_args = grub_malloc (cmdline_size); + if (!linux_args) +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index 83ddbe26e57..bff833468ee 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -20,6 +20,7 @@ + #ifndef GRUB_EFI_EFI_HEADER + #define GRUB_EFI_EFI_HEADER 1 + ++#include + #include + #include + #include +@@ -36,7 +37,29 @@ struct linux_arch_kernel_header { + struct grub_pe_image_header pe_image_header; + }; + +-#define GRUB_EFI_GRUB_VARIABLE_GUID \ ++struct grub_arm_linux_pe_header ++{ ++ grub_uint32_t magic; ++ struct grub_pe32_coff_header coff; ++ struct grub_pe32_optional_header opt; ++}; ++ ++struct grub_arm64_linux_pe_header ++{ ++ grub_uint32_t magic; ++ struct grub_pe32_coff_header coff; ++ struct grub_pe64_optional_header opt; ++}; ++ ++#if defined(__arm__) ++# define grub_armxx_linux_pe_header grub_arm_linux_pe_header ++#endif ++ ++#if defined(__aarch64__) ++# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header ++#endif ++ ++#define GRUB_EFI_GRUB_VARIABLE_GUID \ + { 0x91376aff, 0xcba6, 0x42be, \ + { 0x94, 0x9d, 0x06, 0xfd, 0xe8, 0x11, 0x28, 0xe8 } \ + } +@@ -173,8 +196,7 @@ grub_err_t EXPORT_FUNC(grub_efi_get_ram_base)(grub_addr_t *); + #include + grub_err_t grub_arch_efi_linux_load_image_header(grub_file_t file, + struct linux_arch_kernel_header *lh); +-grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, grub_size_t size, +- char *args); ++grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, char *args); + + grub_addr_t grub_efi_section_addr (const char *section); + diff --git a/0077-arm-arm64-loader-Better-memory-allocation-and-error-.patch b/0254-arm-arm64-loader-Better-memory-allocation-and-error-.patch similarity index 76% rename from 0077-arm-arm64-loader-Better-memory-allocation-and-error-.patch rename to 0254-arm-arm64-loader-Better-memory-allocation-and-error-.patch index 5fc4b4f..b6c1dc9 100644 --- a/0077-arm-arm64-loader-Better-memory-allocation-and-error-.patch +++ b/0254-arm-arm64-loader-Better-memory-allocation-and-error-.patch @@ -1,7 +1,7 @@ -From 8c8ae68b724d220c99290b1068327c46562e4b32 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones -Date: Thu, 11 Jul 2019 14:38:57 +0200 -Subject: [PATCH 077/272] arm/arm64 loader: Better memory allocation and error +Date: Mon, 15 Apr 2024 12:58:13 -0600 +Subject: [PATCH] arm/arm64 loader: Better memory allocation and error messages. On mustang, our memory map looks like: @@ -65,30 +65,26 @@ time, rather than interposing GRUB_EFI_MAX_USABLE_ADDRESS there, so that any per-platform constraints on its given address are maintained. Signed-off-by: Peter Jones - -squash! arm/arm64 loader: Better memory allocation and error messages. - -Use PRIxGRUB_* conversion specifier in printf's format string to -correspond properly to the data type of arguments. - -Signed-off-by: Michael Chang --- - grub-core/kern/efi/mm.c | 33 ++++++++++--- - grub-core/loader/arm64/efi/linux.c | 78 ++++++++++++++++++++++-------- - 2 files changed, 84 insertions(+), 27 deletions(-) + grub-core/kern/efi/mm.c | 35 ++++++++++++++++++------ + grub-core/loader/efi/linux.c | 65 +++++++++++++++++++++++++++++++++----------- + 2 files changed, 75 insertions(+), 25 deletions(-) diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c -index fbfc0e5bf..dfd18613a 100644 +index 8f75205a732..560b859b6f4 100644 --- a/grub-core/kern/efi/mm.c +++ b/grub-core/kern/efi/mm.c -@@ -153,6 +153,7 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address, +@@ -153,8 +153,9 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address, { grub_efi_status_t status; grub_efi_boot_services_t *b; + grub_efi_physical_address_t ret = address; - /* Limit the memory access to less than 4GB for 32-bit platforms. */ +- /* Limit the memory access to less than 4GB for 32-bit platforms. */ ++/* Limit the memory access to less than 4GB for 32-bit platforms. */ if (address > GRUB_EFI_MAX_USABLE_ADDRESS) + { + char inv_addr[17], max_addr[17]; /* log16(2^64) = 16, plus NUL. */ @@ -169,19 +170,22 @@ grub_efi_allocate_pages_real (grub_efi_physical_address_t address, } @@ -98,7 +94,7 @@ index fbfc0e5bf..dfd18613a 100644 if (status != GRUB_EFI_SUCCESS) { + grub_dprintf ("efi", -+ "allocate_pages(%d, %d, 0x%0" PRIxGRUB_SIZE ", 0x%016" PRIxGRUB_UINT64_T ") = 0x%016" PRIxGRUB_SIZE "\n", ++ "allocate_pages(%d, %d, 0x%0lx, 0x%016lx) = 0x%016lx\n", + alloctype, memtype, pages, address, status); grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); return NULL; @@ -139,24 +135,24 @@ index fbfc0e5bf..dfd18613a 100644 + (desc->attribute & GRUB_EFI_MEMORY_WB)) + { + *base_addr = grub_min (*base_addr, desc->physical_start); -+ grub_dprintf ("efi", "setting base_addr=0x%016" PRIxGRUB_ADDR "\n", *base_addr); ++ grub_dprintf ("efi", "setting base_addr=0x%016lx\n", *base_addr); + } + else + { -+ grub_dprintf ("efi", "ignoring address 0x%016" PRIxGRUB_UINT64_T "\n", desc->physical_start); ++ grub_dprintf ("efi", "ignoring address 0x%016lx\n", desc->physical_start); + } + } + + if (*base_addr == GRUB_EFI_MAX_USABLE_ADDRESS) -+ grub_dprintf ("efi", "base_addr 0x%016" PRIxGRUB_ADDR " is probably wrong.\n", *base_addr); ++ grub_dprintf ("efi", "base_addr 0x%016lx is probably wrong.\n", *base_addr); grub_free(memory_map); -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index a8cfeeea2..536272d90 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -89,13 +89,15 @@ finalize_params_linux (void) +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 8742e303d85..ddb27834131 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -182,7 +182,7 @@ finalize_params_linux (void) { grub_efi_loaded_image_t *loaded_image = NULL; int node, retval, len; @@ -164,48 +160,32 @@ index a8cfeeea2..536272d90 100644 + grub_err_t err = GRUB_ERR_NONE; void *fdt; - fdt = grub_fdt_load (GRUB_EFI_LINUX_FDT_EXTRA_SPACE); -- - if (!fdt) -- goto failure; -+ { -+ err = grub_error(GRUB_ERR_BAD_OS, "failed to load FDT"); -+ goto failure; -+ } - - node = grub_fdt_find_subnode (fdt, 0, "chosen"); - if (node < 0) -@@ -106,17 +108,26 @@ finalize_params_linux (void) - */ - retval = grub_fdt_set_prop32(fdt, 0, "#address-cells", 2); - if (retval) -- goto failure; -+ { -+ err = grub_error(retval, "Could not find #address-cells"); -+ goto failure; -+ } + /* Set initrd info */ +@@ -191,14 +191,21 @@ finalize_params_linux (void) + fdt = grub_fdt_load (GRUB_EFI_LINUX_FDT_EXTRA_SPACE); - retval = grub_fdt_set_prop32(fdt, 0, "#size-cells", 2); - if (retval) -- goto failure; -+ { -+ err = grub_error(retval, "Could not find #size-cells"); -+ goto failure; -+ } + if (!fdt) +- goto failure; ++ { ++ err = grub_error(GRUB_ERR_BAD_OS, "failed to load FDT"); ++ goto failure; ++ } ++ - node = grub_fdt_add_subnode (fdt, 0, "chosen"); - } + node = grub_fdt_find_subnode (fdt, 0, "chosen"); + if (node < 0) + node = grub_fdt_add_subnode (fdt, 0, "chosen"); - if (node < 1) -- goto failure; -+ { -+ err = grub_error(grub_errno, "failed to load chosen fdt node."); -+ goto failure; -+ } + if (node < 1) +- goto failure; ++ { ++ err = grub_error(grub_errno, "failed to load chosen fdt node."); ++ goto failure; ++ } - /* Set initrd info */ - if (initrd_start && initrd_end > initrd_start) -@@ -127,15 +138,26 @@ finalize_params_linux (void) + grub_dprintf ("linux", "Initrd @ %p-%p\n", + (void *) initrd_start, (void *) initrd_end); +@@ -206,15 +213,26 @@ finalize_params_linux (void) retval = grub_fdt_set_prop64 (fdt, node, "linux,initrd-start", initrd_start); if (retval) @@ -235,19 +215,17 @@ index a8cfeeea2..536272d90 100644 + } grub_dprintf ("linux", "Installed/updated FDT configuration table @ %p\n", - fdt); -@@ -143,14 +165,20 @@ finalize_params_linux (void) - /* Convert command line to UCS-2 */ + fdt); +@@ -223,7 +241,7 @@ finalize_params_linux (void) loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); - if (!loaded_image) -- goto failure; -+ { + if (loaded_image == NULL) + { +- grub_error (GRUB_ERR_BAD_FIRMWARE, "missing loaded_image proto"); + err = grub_error(grub_errno, "Failed to install fdt"); -+ goto failure; -+ } - + goto failure; + } loaded_image->load_options_size = len = - (grub_strlen (linux_args) + 1) * sizeof (grub_efi_char16_t); +@@ -231,7 +249,10 @@ finalize_params_linux (void) loaded_image->load_options = grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size)); if (!loaded_image->load_options) @@ -259,16 +237,16 @@ index a8cfeeea2..536272d90 100644 loaded_image->load_options_size = 2 * grub_utf8_to_utf16 (loaded_image->load_options, len, -@@ -160,7 +188,7 @@ finalize_params_linux (void) +@@ -241,7 +262,7 @@ finalize_params_linux (void) failure: grub_fdt_unload(); - return grub_error(GRUB_ERR_BAD_OS, "failed to install/update FDT"); + return err; } + #endif - static void -@@ -246,16 +274,28 @@ grub_linux_unload (void) +@@ -344,16 +365,28 @@ grub_linux_unload (void) static void * allocate_initrd_mem (int initrd_pages) { @@ -276,16 +254,16 @@ index a8cfeeea2..536272d90 100644 + grub_addr_t max_addr = 0; + grub_err_t err; + void *ret; -+ + +- if (grub_efi_get_ram_base (&max_addr) != GRUB_ERR_NONE) +- return NULL; + err = grub_efi_get_ram_base (&max_addr); + if (err != GRUB_ERR_NONE) + { + grub_error (err, "grub_efi_get_ram_base() failed"); + return NULL; + } - -- if (grub_efi_get_ram_base (&max_addr) != GRUB_ERR_NONE) -- return NULL; ++ + grub_dprintf ("linux", "max_addr: 0x%016lx, INITRD_MAX_ADDRESS_OFFSET: 0x%016llx\n", + max_addr, INITRD_MAX_ADDRESS_OFFSET); @@ -301,8 +279,5 @@ index a8cfeeea2..536272d90 100644 + grub_dprintf ("linux", "got 0x%016llx\n", (unsigned long long)ret); + return ret; } + #endif - static grub_err_t --- -2.41.0 - diff --git a/0084-arm64-Fix-EFI-loader-kernel-image-allocation.patch b/0255-arm64-Fix-EFI-loader-kernel-image-allocation.patch similarity index 68% rename from 0084-arm64-Fix-EFI-loader-kernel-image-allocation.patch rename to 0255-arm64-Fix-EFI-loader-kernel-image-allocation.patch index 91573e2..61f6d44 100644 --- a/0084-arm64-Fix-EFI-loader-kernel-image-allocation.patch +++ b/0255-arm64-Fix-EFI-loader-kernel-image-allocation.patch @@ -1,7 +1,7 @@ -From baef24a8f9aa0a40670d176804037e36bc4f8613 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Benjamin Herrenschmidt -Date: Mon, 2 Aug 2021 23:10:01 +1000 -Subject: [PATCH 084/272] arm64: Fix EFI loader kernel image allocation +Date: Tue, 16 Apr 2024 12:22:54 -0600 +Subject: [PATCH] arm64: Fix EFI loader kernel image allocation We are currently allocating just enough memory for the file size, which means that the kernel BSS is in limbo (and not even zeroed). @@ -14,15 +14,19 @@ actual size it needs, including BSS, and make sure we clear it, and honors the specified alignment for the image. Signed-off-by: Benjamin Herrenschmidt +[pjones: arm: check for the PE magic for the compiled arch] +Signed-off-by: Peter Jones +Signed-off-by: Robbie Harwood --- - grub-core/loader/arm64/efi/linux.c | 92 ++++++++++++++++++++---------- - 1 file changed, 63 insertions(+), 29 deletions(-) + grub-core/loader/efi/linux.c | 93 +++++++++++++++++++++++++++++++------------- + include/grub/efi/efi.h | 3 +- + 2 files changed, 68 insertions(+), 28 deletions(-) -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index c1b08450c..b91b550fa 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -39,6 +39,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index ddb27834131..cb9de5565de 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -41,6 +41,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); static grub_dl_t my_mod; static int loaded; @@ -31,7 +35,7 @@ index c1b08450c..b91b550fa 100644 static void *kernel_addr; static grub_uint64_t kernel_size; static grub_uint32_t handover_offset; -@@ -258,9 +260,8 @@ grub_linux_unload (void) +@@ -319,9 +321,8 @@ grub_linux_unload (void) GRUB_EFI_BYTES_TO_PAGES (initrd_end - initrd_start)); initrd_start = initrd_end = 0; grub_free (linux_args); @@ -40,13 +44,14 @@ index c1b08450c..b91b550fa 100644 - GRUB_EFI_BYTES_TO_PAGES (kernel_size)); + if (kernel_alloc_addr) + grub_efi_free_pages ((grub_addr_t) kernel_alloc_addr, kernel_alloc_pages); + #if !defined(__i386__) && !defined(__x86_64__) grub_fdt_unload (); - return GRUB_ERR_NONE; - } -@@ -365,14 +366,35 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + #endif +@@ -512,12 +513,37 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), return grub_errno; } ++#if !defined(__i386__) && !defined(__x86_64__) +static grub_err_t +parse_pe_header (void *kernel, grub_uint64_t *total_size, + grub_uint32_t *entry_offset, @@ -57,7 +62,7 @@ index c1b08450c..b91b550fa 100644 + + pe = (void *)((unsigned long)kernel + lh->hdr_offset); + -+ if (pe->opt.magic != GRUB_PE32_PE64_MAGIC) ++ if (pe->opt.magic != GRUB_PE32_PEXX_MAGIC) + return grub_error(GRUB_ERR_BAD_OS, "Invalid PE optional header magic"); + + *total_size = pe->opt.image_size; @@ -66,26 +71,33 @@ index c1b08450c..b91b550fa 100644 + + return GRUB_ERR_NONE; +} ++#endif + static grub_err_t grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), int argc, char *argv[]) { grub_file_t file = 0; -- struct linux_arch_kernel_header lh; -- struct grub_armxx_linux_pe_header *pe; - grub_err_t err; + struct linux_arch_kernel_header lh; + grub_off_t filelen; -+ grub_uint32_t align = 0; ++ grub_uint32_t align; + void *kernel = NULL; + grub_err_t err; grub_dl_ref (my_mod); - -@@ -386,39 +408,49 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -548,8 +574,6 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), if (!file) goto fail; - kernel_size = grub_file_size (file); +- + if (grub_arch_efi_linux_load_image_header (file, &lh) != GRUB_ERR_NONE) + #if !defined(__i386__) && !defined(__x86_64__) + goto fail; +@@ -570,33 +594,46 @@ fallback: + } + #endif + + filelen = grub_file_size (file); + kernel = grub_malloc(filelen); + if (!kernel) @@ -93,27 +105,21 @@ index c1b08450c..b91b550fa 100644 + grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel load buffer")); + goto fail; + } - -- if (grub_file_read (file, &lh, sizeof (lh)) < (long) sizeof (lh)) -- return grub_errno; ++ + if (grub_file_read (file, kernel, filelen) < (grub_ssize_t)filelen) + { + grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), + argv[0]); + goto fail; + } - -- if (grub_arch_efi_linux_check_image (&lh) != GRUB_ERR_NONE) -+ grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); + -+ if (grub_arch_efi_linux_check_image (kernel) != GRUB_ERR_NONE) -+ goto fail; ++#if !defined(__i386__) && !defined(__x86_64__) + if (parse_pe_header (kernel, &kernel_size, &handover_offset, &align) != GRUB_ERR_NONE) - goto fail; ++ goto fail; + grub_dprintf ("linux", "kernel mem size : %lld\n", (long long) kernel_size); + grub_dprintf ("linux", "kernel entry offset : %d\n", handover_offset); + grub_dprintf ("linux", "kernel alignment : 0x%x\n", align); - ++ grub_loader_unset(); - grub_dprintf ("linux", "kernel file size: %lld\n", (long long) kernel_size); @@ -142,6 +148,8 @@ index c1b08450c..b91b550fa 100644 grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); - +-#if !defined(__i386__) && !defined(__x86_64__) +- struct grub_armxx_linux_pe_header *pe; - pe = (void *)((unsigned long)kernel_addr + lh.hdr_offset); - handover_offset = pe->opt.entry_addr; + grub_memcpy (kernel_addr, kernel, grub_min(filelen, kernel_size)); @@ -149,10 +157,10 @@ index c1b08450c..b91b550fa 100644 + grub_memset ((char *)kernel_addr + filelen, 0, kernel_size - filelen); + grub_free(kernel); + kernel = NULL; + #endif cmdline_size = grub_loader_cmdline_size (argc, argv) + sizeof (LINUX_IMAGE); - linux_args = grub_malloc (cmdline_size); -@@ -442,6 +474,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), +@@ -621,6 +658,9 @@ fallback: } fail: @@ -162,7 +170,7 @@ index c1b08450c..b91b550fa 100644 if (file) grub_file_close (file); -@@ -454,9 +489,8 @@ fail: +@@ -633,9 +673,8 @@ fail: if (linux_args && !loaded) grub_free (linux_args); @@ -174,6 +182,28 @@ index c1b08450c..b91b550fa 100644 return grub_errno; } --- -2.41.0 - +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index bff833468ee..c40684821e1 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -20,7 +20,6 @@ + #ifndef GRUB_EFI_EFI_HEADER + #define GRUB_EFI_EFI_HEADER 1 + +-#include + #include + #include + #include +@@ -52,10 +51,12 @@ struct grub_arm64_linux_pe_header + }; + + #if defined(__arm__) ++# define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE32_MAGIC + # define grub_armxx_linux_pe_header grub_arm_linux_pe_header + #endif + + #if defined(__aarch64__) ++# define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE64_MAGIC + # define grub_armxx_linux_pe_header grub_arm64_linux_pe_header + #endif + diff --git a/0256-pe-add-the-DOS-header-struct-and-fix-some-bad-naming.patch b/0256-pe-add-the-DOS-header-struct-and-fix-some-bad-naming.patch new file mode 100644 index 0000000..222a13c --- /dev/null +++ b/0256-pe-add-the-DOS-header-struct-and-fix-some-bad-naming.patch @@ -0,0 +1,81 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 16 Apr 2024 12:51:50 -0600 +Subject: [PATCH] pe: add the DOS header struct and fix some bad naming. + +In order to properly validate a loaded kernel's support for being loaded +without a writable stack or executable, we need to be able to properly +parse arbitrary PE headers. + +Currently, pe32.h is written in such a way that the MS-DOS header that +tells us where to find the PE header in the binary can't be accessed. +Further, for some reason it calls the DOS MZ magic "GRUB_PE32_MAGIC". + +This patch adds the structure for the DOS header, renames the DOS magic +define, and adds defines for the actual PE magic. + +Signed-off-by: Peter Jones +--- + grub-core/loader/efi/linux.c | 2 +- + include/grub/efi/pe32.h | 28 ++++++++++++++++++++++++++-- + 2 files changed, 27 insertions(+), 3 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index cb9de5565de..ecaa8c18c4d 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -138,7 +138,7 @@ grub_arch_efi_linux_load_image_header (grub_file_t file, + if (grub_file_read (file, lh, sizeof (*lh)) < (grub_ssize_t) sizeof (*lh)) + return grub_error(GRUB_ERR_FILE_READ_ERROR, "failed to read Linux image header"); + +- if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC) ++ if ((lh->code0 & 0xffff) != GRUB_DOS_MAGIC) + return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, + N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled")); + +diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h +index a39743396dc..13fdd0e7d98 100644 +--- a/include/grub/efi/pe32.h ++++ b/include/grub/efi/pe32.h +@@ -46,7 +46,30 @@ + + #define GRUB_PE32_MSDOS_STUB_SIZE 0x80 + +-#define GRUB_PE32_MAGIC 0x5a4d ++#define GRUB_DOS_MAGIC 0x5a4d ++ ++struct grub_dos_header ++{ ++ grub_uint16_t magic; ++ grub_uint16_t cblp; ++ grub_uint16_t cp; ++ grub_uint16_t crlc; ++ grub_uint16_t cparhdr; ++ grub_uint16_t minalloc; ++ grub_uint16_t maxalloc; ++ grub_uint16_t ss; ++ grub_uint16_t sp; ++ grub_uint16_t csum; ++ grub_uint16_t ip; ++ grub_uint16_t cs; ++ grub_uint16_t lfarlc; ++ grub_uint16_t ovno; ++ grub_uint16_t res0[4]; ++ grub_uint16_t oemid; ++ grub_uint16_t oeminfo; ++ grub_uint16_t res1[10]; ++ grub_uint32_t lfanew; ++}; + + struct grub_msdos_image_header + { +@@ -293,7 +316,8 @@ struct grub_pe32_section_table + #define GRUB_PE32_SCN_MEM_READ 0x40000000 + #define GRUB_PE32_SCN_MEM_WRITE 0x80000000 + +-#define GRUB_PE32_SIGNATURE_SIZE 4 ++#define GRUB_PE32_SIGNATURE_SIZE 4 ++#define GRUB_PE32_SIGNATURE "PE\0\0" + + #if GRUB_TARGET_SIZEOF_VOID_P == 8 + #define GRUB_PE32_NATIVE_MAGIC GRUB_PE32_PE64_MAGIC diff --git a/0257-Correct-BSS-zeroing-on-aarch64.patch b/0257-Correct-BSS-zeroing-on-aarch64.patch new file mode 100644 index 0000000..232393f --- /dev/null +++ b/0257-Correct-BSS-zeroing-on-aarch64.patch @@ -0,0 +1,95 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Tue, 16 Apr 2024 13:26:55 -0600 +Subject: [PATCH] Correct BSS zeroing on aarch64 + +The aarch64 loader doesn't use efi bootservices, and +therefor it has a very minimal loader which makes a lot +of assumptions about the kernel layout. With the ZBOOT +changes, the layout has changed a bit and we not should +really be parsing the PE sections to determine how much +data to copy, otherwise the BSS won't be setup properly. + +This code still makes a lot of assumptions about the +the kernel layout, so its far from ideal, but it works. + +Resolves: rhbz#2125069 + +Signed-off-by: Jeremy Linton +--- + grub-core/loader/efi/linux.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index ecaa8c18c4d..55c5c8600d4 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -517,10 +517,12 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + static grub_err_t + parse_pe_header (void *kernel, grub_uint64_t *total_size, + grub_uint32_t *entry_offset, +- grub_uint32_t *alignment) ++ grub_uint32_t *alignment, grub_uint32_t *code_size) + { + struct linux_arch_kernel_header *lh = kernel; + struct grub_armxx_linux_pe_header *pe; ++ grub_uint16_t i; ++ struct grub_pe32_section_table *sections; + + pe = (void *)((unsigned long)kernel + lh->hdr_offset); + +@@ -530,6 +532,19 @@ parse_pe_header (void *kernel, grub_uint64_t *total_size, + *total_size = pe->opt.image_size; + *entry_offset = pe->opt.entry_addr; + *alignment = pe->opt.section_alignment; ++ *code_size = pe->opt.section_alignment; ++ ++ sections = (struct grub_pe32_section_table *) ((char *)&pe->opt + ++ pe->coff.optional_header_size); ++ grub_dprintf ("linux", "num_sections : %d\n", pe->coff.num_sections ); ++ for (i = 0 ; i < pe->coff.num_sections; i++) ++ { ++ grub_dprintf ("linux", "raw_size : %lld\n", ++ (long long) sections[i].raw_data_size); ++ grub_dprintf ("linux", "virt_size : %lld\n", ++ (long long) sections[i].virtual_size); ++ *code_size += sections[i].raw_data_size; ++ } + + return GRUB_ERR_NONE; + } +@@ -543,6 +558,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + struct linux_arch_kernel_header lh; + grub_off_t filelen; + grub_uint32_t align; ++ grub_uint32_t code_size; + void *kernel = NULL; + grub_err_t err; + +@@ -610,11 +626,12 @@ fallback: + } + + #if !defined(__i386__) && !defined(__x86_64__) +- if (parse_pe_header (kernel, &kernel_size, &handover_offset, &align) != GRUB_ERR_NONE) ++ if (parse_pe_header (kernel, &kernel_size, &handover_offset, &align, &code_size) != GRUB_ERR_NONE) + goto fail; + grub_dprintf ("linux", "kernel mem size : %lld\n", (long long) kernel_size); + grub_dprintf ("linux", "kernel entry offset : %d\n", handover_offset); + grub_dprintf ("linux", "kernel alignment : 0x%x\n", align); ++ grub_dprintf ("linux", "kernel size : 0x%x\n", code_size); + + grub_loader_unset(); + +@@ -629,9 +646,9 @@ fallback: + kernel_addr = (void *)ALIGN_UP((grub_uint64_t)kernel_alloc_addr, align); + + grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); +- grub_memcpy (kernel_addr, kernel, grub_min(filelen, kernel_size)); +- if (kernel_size > filelen) +- grub_memset ((char *)kernel_addr + filelen, 0, kernel_size - filelen); ++ grub_memcpy (kernel_addr, kernel, grub_min(code_size, kernel_size)); ++ if (kernel_size > code_size) ++ grub_memset ((char *)kernel_addr + code_size, 0, kernel_size - code_size); + grub_free(kernel); + kernel = NULL; + #endif diff --git a/0165-arm64-Use-proper-memory-type-for-kernel-allocation.patch b/0258-arm64-Use-proper-memory-type-for-kernel-allocation.patch similarity index 62% rename from 0165-arm64-Use-proper-memory-type-for-kernel-allocation.patch rename to 0258-arm64-Use-proper-memory-type-for-kernel-allocation.patch index 7da7df4..453ee57 100644 --- a/0165-arm64-Use-proper-memory-type-for-kernel-allocation.patch +++ b/0258-arm64-Use-proper-memory-type-for-kernel-allocation.patch @@ -1,7 +1,7 @@ -From 798d1d07829d67ae9a46737209d0088038e52ab5 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Maximilian Luz -Date: Tue, 28 Jun 2022 23:06:46 +0200 -Subject: [PATCH 165/272] arm64: Use proper memory type for kernel allocation +Date: Tue, 16 Apr 2024 14:21:49 -0600 +Subject: [PATCH] arm64: Use proper memory type for kernel allocation Currently, the kernel pages are allocated with type EFI_LOADER_DATA. While the vast majority of systems will happily execute code from those @@ -11,28 +11,26 @@ Pro X stalls, as this memory is not designated as "executable". Therefore, allocate the kernel pages as EFI_LOADER_CODE to request memory that is actually executable. -Link: https://github.com/rhboot/grub2/commit/4f9d3f4f8d7866c69e52ba7d81562daea38b22e6 Signed-off-by: Maximilian Luz -Signed-off-by: Chester Lin --- - grub-core/loader/arm64/efi/linux.c | 7 ++++++- + grub-core/loader/efi/linux.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -diff --git a/grub-core/loader/arm64/efi/linux.c b/grub-core/loader/arm64/efi/linux.c -index f5508a6de..33df0e1fd 100644 ---- a/grub-core/loader/arm64/efi/linux.c -+++ b/grub-core/loader/arm64/efi/linux.c -@@ -26,7 +26,9 @@ +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 55c5c8600d4..d9ded7c4f12 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -25,7 +25,9 @@ + #include #include #include - #include +#include #include +#include #include #include - #include -@@ -403,7 +405,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + #include +@@ -636,7 +638,10 @@ fallback: grub_loader_unset(); kernel_alloc_pages = GRUB_EFI_BYTES_TO_PAGES (kernel_size + align - 1); @@ -44,6 +42,3 @@ index f5508a6de..33df0e1fd 100644 grub_dprintf ("linux", "kernel numpages: %d\n", kernel_alloc_pages); if (!kernel_alloc_addr) { --- -2.41.0 - diff --git a/0259-normal-Remove-grub_env_set-prefix-in-grub_try_normal.patch b/0259-normal-Remove-grub_env_set-prefix-in-grub_try_normal.patch new file mode 100644 index 0000000..af24bcc --- /dev/null +++ b/0259-normal-Remove-grub_env_set-prefix-in-grub_try_normal.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Tue, 19 Dec 2023 16:52:05 +0100 +Subject: [PATCH] normal: Remove grub_env_set prefix in grub_try_normal_prefix + +Commit de735a453aa35 added a grub_env_set where the prefix contains +the arch name in the pathname. This create issues when trying to +load modules using this prefix as the pathname contains a "doubled" +arch name in it (ie .../powerpc-ieee1275/powerpc-ieee1275/). + +Signed-off-by: Nicolas Frayer +--- + grub-core/normal/main.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 803b9656d36..26872ce9477 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -372,7 +372,6 @@ grub_try_normal_prefix (const char *prefix) + file = grub_file_open (config, GRUB_FILE_TYPE_CONFIG); + if (file) + { +- grub_env_set ("prefix", prefix); + grub_file_close (file); + err = GRUB_ERR_NONE; + } diff --git a/0260-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch b/0260-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch new file mode 100644 index 0000000..2198ce3 --- /dev/null +++ b/0260-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch @@ -0,0 +1,54 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jon DeVree +Date: Sun, 11 Feb 2024 10:34:58 -0500 +Subject: [PATCH] fs/xfs: Handle non-continuous data blocks in directory + extents + +The directory extent list does not have to be a continuous list of data +blocks. When GRUB tries to read a non-existant member of the list, +grub_xfs_read_file() will return a block of zero'ed memory. Checking for +a zero'ed magic number is sufficient to skip this non-existant data block. + +Prior to commit 07318ee7e (fs/xfs: Fix XFS directory extent parsing) +this was handled as a subtle side effect of reading the (non-existant) +tail data structure. Since the block was zero'ed the computation of the +number of directory entries in the block would return 0 as well. + +Fixes: 07318ee7e (fs/xfs: Fix XFS directory extent parsing) +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2254370 + +Signed-off-by: Jon DeVree +Reviewed-By: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index bc2224dbb46..8e02ab4a301 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -902,6 +902,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + grub_xfs_first_de(dir->data, dirblock); + int entries = -1; + char *end = dirblock + dirblk_size; ++ grub_uint32_t magic; + + numread = grub_xfs_read_file (dir, 0, 0, + blk << dirblk_log2, +@@ -912,6 +913,15 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + return 0; + } + ++ /* ++ * If this data block isn't actually part of the extent list then ++ * grub_xfs_read_file() returns a block of zeros. So, if the magic ++ * number field is all zeros then this block should be skipped. ++ */ ++ magic = *(grub_uint32_t *)(void *) dirblock; ++ if (!magic) ++ continue; ++ + /* + * Leaf and tail information are only in the data block if the number + * of extents is 1. diff --git a/0261-Ignore-warnings-for-incompatible-types.patch b/0261-Ignore-warnings-for-incompatible-types.patch new file mode 100644 index 0000000..ad7dacb --- /dev/null +++ b/0261-Ignore-warnings-for-incompatible-types.patch @@ -0,0 +1,28 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 17 Jan 2024 21:15:14 +0100 +Subject: [PATCH] Ignore warnings for incompatible types + +Add -Wno-incompatible-pointer-types to ignore warnings for incompatible +types + +Signed-off-by: Nicolas Frayer +--- + configure.ac | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d223fe3ef6e..4788f3d6adc 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2166,8 +2166,8 @@ if test x"$enable_wextra" != xno ; then + HOST_CFLAGS="$HOST_CFLAGS -Wextra" + fi + +-TARGET_CFLAGS="$TARGET_CFLAGS -Werror=trampolines -fno-trampolines" +-HOST_CFLAGS="$HOST_CFLAGS -Werror=trampolines -fno-trampolines" ++TARGET_CFLAGS="$TARGET_CFLAGS -Werror=trampolines -fno-trampolines -Wno-incompatible-pointer-types" ++HOST_CFLAGS="$HOST_CFLAGS -Werror=trampolines -fno-trampolines -Wno-incompatible-pointer-types" + + TARGET_CPP="$TARGET_CC -E" + TARGET_CCAS=$TARGET_CC diff --git a/0262-cmd-search-Rework-of-CVE-2023-4001-fix.patch b/0262-cmd-search-Rework-of-CVE-2023-4001-fix.patch new file mode 100644 index 0000000..c63fc3e --- /dev/null +++ b/0262-cmd-search-Rework-of-CVE-2023-4001-fix.patch @@ -0,0 +1,180 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Thu, 16 May 2024 10:58:32 +0200 +Subject: [PATCH] cmd/search: Rework of CVE-2023-4001 fix + +The initial fix implemented a new flag that forces the grub cfg +stub to be located on the same disk as grub. This created several +issues such as RAID machines not being able to boot as their +partition names under grub were different from the partition where +grub is located. It also simply means that any machines with the +/boot partition located on a disk other than the one containing grub +won't boot. +This commit denies booting if the grub cfg stub is located on a USB +drive with a duplicated UUID (UUID being the same as the partition +containing the actual grub cfg stub) + +Signed-off-by: Nicolas Frayer +--- + grub-core/commands/search.c | 134 +++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 126 insertions(+), 8 deletions(-) + +diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c +index db8692ffbfb..9dd937e6df4 100644 +--- a/grub-core/commands/search.c ++++ b/grub-core/commands/search.c +@@ -30,6 +30,8 @@ + #include + #include + #include ++#include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -54,6 +56,100 @@ struct search_ctx + int is_cache; + }; + ++static int ++is_device_usb (const char *name) ++{ ++ int ret = 0; ++ ++ grub_device_t dev = grub_device_open(name); ++ ++ if (dev) ++ { ++ struct grub_efidisk_data ++ { ++ grub_efi_handle_t handle; ++ grub_efi_device_path_t *device_path; ++ grub_efi_device_path_t *last_device_path; ++ grub_efi_block_io_t *block_io; ++ struct grub_efidisk_data *next; ++ }; ++ ++ if (dev->disk && dev->disk->data) ++ { ++ struct grub_efidisk_data *dp = dev->disk->data; ++ ++ if ( GRUB_EFI_DEVICE_PATH_TYPE (dp->last_device_path) == GRUB_EFI_MESSAGING_DEVICE_PATH_TYPE && ++ GRUB_EFI_DEVICE_PATH_SUBTYPE (dp->last_device_path) == GRUB_EFI_USB_DEVICE_PATH_SUBTYPE) ++ { ++ ret = 1; ++ } ++ } ++ grub_device_close(dev); ++ } ++ ++ return ret; ++} ++ ++static int ++get_device_uuid(const char *name, char** quid) ++{ ++ int ret = 0; ++ ++ grub_device_t dev_part = grub_device_open(name); ++ ++ if (dev_part) ++ { ++ grub_fs_t fs; ++ ++ fs = grub_fs_probe (dev_part); ++ ++#ifdef DO_SEARCH_FS_UUID ++#define read_fn fs_uuid ++#else ++#define read_fn fs_label ++#endif ++ if (fs && fs->read_fn) ++ { ++ fs->read_fn (dev_part, quid); ++ ++ if (grub_errno == GRUB_ERR_NONE && *quid) ++ { ++ ret = 1; ++ } ++ ++ } ++ grub_device_close (dev_part); ++ } ++ ++ return ret; ++} ++struct uuid_context { ++ char* name; ++ char* uuid; ++}; ++ ++static int ++check_for_duplicate (const char *name, void *data) ++{ ++ int ret = 0; ++ struct uuid_context * uuid_ctx = (struct uuid_context *)data; ++ char *quid = 0; ++ ++ get_device_uuid(name, &quid); ++ ++ if (quid == NULL) ++ return 0; ++ ++ if (!grub_strcasecmp(quid, uuid_ctx->uuid) && grub_strcasecmp(name, uuid_ctx->name)) ++ { ++ ret = 1; ++ } ++ ++ grub_free(quid); ++ ++ return ret; ++} ++ + /* Helper for FUNC_NAME. */ + static int + iterate_device (const char *name, void *data) +@@ -106,14 +202,36 @@ iterate_device (const char *name, void *data) + grub_str_sep (name, name_disk, ',', rem_2); + if (root_disk != NULL && *root_disk != '\0' && + name_disk != NULL && *name_disk != '\0') +- if (grub_strcmp(root_disk, name_disk) != 0) +- { +- grub_free (root_disk); +- grub_free (name_disk); +- grub_free (rem_1); +- grub_free (rem_2); +- return 0; +- } ++ { ++ grub_device_t dev, dev_part; ++ ++ if (is_device_usb(name) && !is_device_usb(root_dev)) ++ { ++ char *quid_name = NULL; ++ int longlist = 0; ++ struct uuid_context uuid_ctx; ++ int ret = 0; ++ ++ get_device_uuid(name, &quid_name); ++ if (!grub_strcmp(quid_name, ctx->key)) ++ { ++ uuid_ctx.name = name; ++ uuid_ctx.uuid = quid_name; ++ ++ ret = grub_device_iterate (check_for_duplicate, &uuid_ctx); ++ ++ if (ret) ++ { ++ grub_printf("Duplicated media UUID found, rebooting ...\n"); ++ grub_sleep(10); ++ grub_reboot(); ++ } ++ } ++ ++ if (quid_name) grub_free (quid_name); ++ ++ } ++ } + } + grub_free (root_disk); + grub_free (name_disk); diff --git a/0263-loader-efi-linux.c-read-the-kernel-image-before-head.patch b/0263-loader-efi-linux.c-read-the-kernel-image-before-head.patch new file mode 100644 index 0000000..e8dc223 --- /dev/null +++ b/0263-loader-efi-linux.c-read-the-kernel-image-before-head.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 29 May 2024 17:35:35 -0600 +Subject: [PATCH] loader/efi/linux.c: read the kernel image before header + +Signed-off-by: Leo Sandoval +--- + grub-core/loader/efi/linux.c | 34 ++++++++++++++++++++-------------- + 1 file changed, 20 insertions(+), 14 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index d9ded7c4f12..3ada50ed969 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -559,6 +559,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_file_t file = 0; + struct linux_arch_kernel_header lh; + grub_off_t filelen; ++ grub_off_t filereadlen; + grub_uint32_t align; + grub_uint32_t code_size; + void *kernel = NULL; +@@ -592,6 +593,25 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + if (!file) + goto fail; + ++ filelen = grub_file_size (file); ++ kernel = grub_malloc(filelen); ++ if (!kernel) ++ { ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel load buffer")); ++ goto fail; ++ } ++ ++ filereadlen = grub_file_read (file, kernel, filelen); ++ grub_dprintf ("linux", "filelen : %lld\n", (long long) filelen); ++ grub_dprintf ("linux", "filereadlen : %lld\n", (long long) filereadlen); ++ ++ if (filereadlen < filelen) ++ { ++ grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), ++ argv[0]); ++ goto fail; ++ } ++ + if (grub_arch_efi_linux_load_image_header (file, &lh) != GRUB_ERR_NONE) + #if !defined(__i386__) && !defined(__x86_64__) + goto fail; +@@ -612,20 +632,6 @@ fallback: + } + #endif + +- filelen = grub_file_size (file); +- kernel = grub_malloc(filelen); +- if (!kernel) +- { +- grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel load buffer")); +- goto fail; +- } +- +- if (grub_file_read (file, kernel, filelen) < (grub_ssize_t)filelen) +- { +- grub_error (GRUB_ERR_FILE_READ_ERROR, N_("Can't read kernel %s"), +- argv[0]); +- goto fail; +- } + + #if !defined(__i386__) && !defined(__x86_64__) + if (parse_pe_header (kernel, &kernel_size, &handover_offset, &align, &code_size) != GRUB_ERR_NONE) diff --git a/0264-nx-set-attrs-in-our-kernel-loaders.patch b/0264-nx-set-attrs-in-our-kernel-loaders.patch new file mode 100644 index 0000000..6b0aa1d --- /dev/null +++ b/0264-nx-set-attrs-in-our-kernel-loaders.patch @@ -0,0 +1,580 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 3 Jul 2024 17:54:41 -0600 +Subject: [PATCH] nx: set attrs in our kernel loaders + +For NX, our kernel loaders need to set write and execute page +permissions on allocated pages and the stack. + +This patch adds those calls. + +Signed-off-by: Peter Jones +[rharwood: fix stack_attrs undefined, fix aarch64 callsites] +Signed-off-by: Robbie Harwood +--- + grub-core/kern/efi/mm.c | 79 ++++++++++++++++ + grub-core/loader/arm64/xen_boot.c | 5 +- + grub-core/loader/efi/chainloader.c | 11 +++ + grub-core/loader/efi/linux.c | 188 ++++++++++++++++++++++++++++++++++--- + grub-core/loader/i386/efi/linux.c | 26 ++++- + grub-core/loader/i386/linux.c | 5 + + include/grub/efi/efi.h | 6 +- + include/grub/efi/linux.h | 16 +++- + include/grub/efi/pe32.h | 2 + + 9 files changed, 319 insertions(+), 19 deletions(-) + +diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c +index 560b859b6f4..464fe1c3c01 100644 +--- a/grub-core/kern/efi/mm.c ++++ b/grub-core/kern/efi/mm.c +@@ -603,6 +603,83 @@ print_memory_map (grub_efi_memory_descriptor_t *memory_map, + } + #endif + ++grub_addr_t grub_stack_addr = (grub_addr_t)-1ll; ++grub_size_t grub_stack_size = 0; ++ ++static void ++grub_nx_init (void) ++{ ++ grub_uint64_t attrs, stack_attrs; ++ grub_err_t err; ++ grub_addr_t stack_current, stack_end; ++ const grub_uint64_t page_size = 4096; ++ const grub_uint64_t page_mask = ~(page_size - 1); ++ ++ /* ++ * These are to confirm that the flags are working as expected when ++ * debugging. ++ */ ++ attrs = 0; ++ stack_current = (grub_addr_t)grub_nx_init & page_mask; ++ err = grub_get_mem_attrs (stack_current, page_size, &attrs); ++ if (err) ++ { ++ grub_dprintf ("nx", ++ "grub_get_mem_attrs(0x%"PRIxGRUB_UINT64_T", ...) -> 0x%x\n", ++ stack_current, err); ++ grub_error_pop (); ++ } ++ else ++ grub_dprintf ("nx", "page attrs for grub_nx_init (%p) are %c%c%c\n", ++ grub_dl_load_core, ++ (attrs & GRUB_MEM_ATTR_R) ? 'r' : '-', ++ (attrs & GRUB_MEM_ATTR_R) ? 'w' : '-', ++ (attrs & GRUB_MEM_ATTR_R) ? 'x' : '-'); ++ ++ stack_current = (grub_addr_t)&stack_current & page_mask; ++ err = grub_get_mem_attrs (stack_current, page_size, &stack_attrs); ++ if (err) ++ { ++ grub_dprintf ("nx", ++ "grub_get_mem_attrs(0x%"PRIxGRUB_UINT64_T", ...) -> 0x%x\n", ++ stack_current, err); ++ grub_error_pop (); ++ } ++ else ++ { ++ attrs = stack_attrs; ++ grub_dprintf ("nx", "page attrs for stack (%p) are %c%c%c\n", ++ &attrs, ++ (attrs & GRUB_MEM_ATTR_R) ? 'r' : '-', ++ (attrs & GRUB_MEM_ATTR_R) ? 'w' : '-', ++ (attrs & GRUB_MEM_ATTR_R) ? 'x' : '-'); ++ } ++ for (stack_end = stack_current + page_size ; ++ !(attrs & GRUB_MEM_ATTR_R); ++ stack_end += page_size) ++ { ++ err = grub_get_mem_attrs (stack_current, page_size, &attrs); ++ if (err) ++ { ++ grub_dprintf ("nx", ++ "grub_get_mem_attrs(0x%"PRIxGRUB_UINT64_T", ...) -> 0x%x\n", ++ stack_current, err); ++ grub_error_pop (); ++ break; ++ } ++ } ++ if (stack_end > stack_current) ++ { ++ grub_stack_addr = stack_current; ++ grub_stack_size = stack_end - stack_current; ++ grub_dprintf ("nx", ++ "detected stack from 0x%"PRIxGRUB_ADDR" to 0x%"PRIxGRUB_ADDR"\n", ++ grub_stack_addr, grub_stack_addr + grub_stack_size - 1); ++ } ++} ++ ++ ++ + static grub_err_t + grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + { +@@ -615,6 +692,8 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + grub_err_t err; + int mm_status; + ++ grub_nx_init (); ++ + /* Prepare a memory region to store two memory maps. */ + memory_map = grub_efi_allocate_any_pages (2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE)); + if (! memory_map) +diff --git a/grub-core/loader/arm64/xen_boot.c b/grub-core/loader/arm64/xen_boot.c +index 9838a0f878b..5d7c8603db9 100644 +--- a/grub-core/loader/arm64/xen_boot.c ++++ b/grub-core/loader/arm64/xen_boot.c +@@ -252,7 +252,10 @@ xen_boot (void) + return err; + + return grub_arch_efi_linux_boot_image (xen_hypervisor->start, +- xen_hypervisor->cmdline); ++ xen_hypervisor->size, ++ xen_hypervisor->cmdline, ++ 0); ++ + } + + static void +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index badff5e50b5..5cd6f6a5993 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1078,6 +1078,17 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ /* ++ * The OS kernel is going to set its own permissions when it takes over ++ * paging a few million instructions from now, and load_image() will set up ++ * anything that's needed based on the section headers, so there's no point ++ * in doing anything but clearing the protection bits here. ++ */ ++ grub_dprintf("nx", "setting attributes for %p (%lu bytes) to %llx\n", ++ (void *)(grub_addr_t)address, fsize, 0llu); ++ grub_update_mem_attrs (address, fsize, ++ GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W|GRUB_MEM_ATTR_X, 0); ++ + #if defined (__i386__) || defined (__x86_64__) + if (fsize >= (grub_ssize_t) sizeof (struct grub_macho_fat_header)) + { +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 3ada50ed969..fe48001442a 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -96,16 +96,127 @@ static grub_efi_load_file2_t initrd_lf2 = { + + #pragma GCC diagnostic push + #pragma GCC diagnostic ignored "-Wcast-align" ++#pragma GCC diagnostic ignored "-Wint-to-pointer-cast" ++ ++grub_err_t ++grub_efi_check_nx_image_support (grub_addr_t k_add, ++ grub_size_t k_size, ++ int *nx_supported) ++{ ++ struct grub_dos_header *doshdr; ++ grub_size_t sz = sizeof (*doshdr); ++ ++ struct grub_pe32_header_32 *pe32; ++ struct grub_pe32_header_64 *pe64; ++ ++ int image_is_compatible = 0; ++ int is_64_bit; ++ ++ if (k_size < sz) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel is too small")); ++ ++ doshdr = (void *)k_add; ++ ++ if ((doshdr->magic & 0xffff) != GRUB_DOS_MAGIC) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel DOS magic is invalid")); ++ ++ sz = doshdr->lfanew + sizeof (*pe32); ++ if (k_size < sz) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel is too small")); ++ ++ pe32 = (struct grub_pe32_header_32 *)(k_add + doshdr->lfanew); ++ pe64 = (struct grub_pe32_header_64 *)pe32; ++ ++ if (grub_memcmp (pe32->signature, GRUB_PE32_SIGNATURE, ++ GRUB_PE32_SIGNATURE_SIZE) != 0) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel PE magic is invalid")); ++ ++ switch (pe32->coff_header.machine) ++ { ++ case GRUB_PE32_MACHINE_ARMTHUMB_MIXED: ++ case GRUB_PE32_MACHINE_I386: ++ case GRUB_PE32_MACHINE_RISCV32: ++ is_64_bit = 0; ++ break; ++ case GRUB_PE32_MACHINE_ARM64: ++ case GRUB_PE32_MACHINE_IA64: ++ case GRUB_PE32_MACHINE_RISCV64: ++ case GRUB_PE32_MACHINE_X86_64: ++ is_64_bit = 1; ++ break; ++ default: ++ return grub_error (GRUB_ERR_BAD_OS, N_("PE machine type 0x%04hx unknown"), ++ pe32->coff_header.machine); ++ } ++ ++ if (is_64_bit) ++ { ++ sz = doshdr->lfanew + sizeof (*pe64); ++ if (k_size < sz) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel is too small")); ++ ++ if (pe64->optional_header.dll_characteristics & GRUB_PE32_NX_COMPAT) ++ image_is_compatible = 1; ++ } ++ else ++ { ++ if (pe32->optional_header.dll_characteristics & GRUB_PE32_NX_COMPAT) ++ image_is_compatible = 1; ++ } ++ ++ *nx_supported = image_is_compatible; ++ return GRUB_ERR_NONE; ++} ++ ++grub_err_t ++grub_efi_check_nx_required (int *nx_required) ++{ ++ grub_efi_status_t status; ++ grub_guid_t guid = GRUB_EFI_SHIM_LOCK_GUID; ++ grub_size_t mok_policy_sz = 0; ++ char *mok_policy = NULL; ++ grub_uint32_t mok_policy_attrs = 0; ++ ++ status = grub_efi_get_variable_with_attributes ("MokPolicy", &guid, ++ &mok_policy_sz, ++ (void **)&mok_policy, ++ &mok_policy_attrs); ++ if (status == GRUB_EFI_NOT_FOUND || ++ mok_policy_sz == 0 || ++ mok_policy == NULL) ++ { ++ *nx_required = 0; ++ return GRUB_ERR_NONE; ++ } ++ ++ *nx_required = 0; ++ if (mok_policy_sz < 1 || ++ mok_policy_attrs != (GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | ++ GRUB_EFI_VARIABLE_RUNTIME_ACCESS) || ++ (mok_policy[mok_policy_sz-1] & GRUB_MOK_POLICY_NX_REQUIRED)) ++ *nx_required = 1; ++ ++ return GRUB_ERR_NONE; ++} + + typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); + + grub_err_t +-grub_efi_linux_boot (void *kernel_address, grub_off_t ho_offset, +- void *kernel_params) ++grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, ++ grub_off_t h_offset, void *k_params, ++ int nx_supported) + { + grub_efi_loaded_image_t *loaded_image = NULL; + handover_func hf; + int offset = 0; ++ grub_uint64_t stack_set_attrs = GRUB_MEM_ATTR_R | ++ GRUB_MEM_ATTR_W | ++ GRUB_MEM_ATTR_X; ++ grub_uint64_t stack_clear_attrs = 0; ++ grub_uint64_t kernel_set_attrs = stack_set_attrs; ++ grub_uint64_t kernel_clear_attrs = stack_clear_attrs; ++ grub_uint64_t attrs; ++ int nx_required = 0; + + #ifdef __x86_64__ + offset = 512; +@@ -118,14 +229,59 @@ grub_efi_linux_boot (void *kernel_address, grub_off_t ho_offset, + */ + loaded_image = grub_efi_get_loaded_image (grub_efi_image_handle); + if (loaded_image) +- loaded_image->image_base = kernel_address; ++ loaded_image->image_base = (void *)k_address; + else + grub_dprintf ("linux", "Loaded Image base address could not be set\n"); + + grub_dprintf ("linux", "kernel_address: %p handover_offset: %p params: %p\n", +- kernel_address, (void *)(grub_efi_uintn_t)ho_offset, kernel_params); +- hf = (handover_func)((char *)kernel_address + ho_offset + offset); +- hf (grub_efi_image_handle, grub_efi_system_table, kernel_params); ++ (void *)k_address, (void *)h_offset, k_params); ++ ++ ++ if (nx_required && !nx_supported) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel does not support NX loading required by policy")); ++ ++ if (nx_supported) ++ { ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_W; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_W; ++ stack_set_attrs &= ~GRUB_MEM_ATTR_X; ++ stack_clear_attrs |= GRUB_MEM_ATTR_X; ++ } ++ ++ grub_dprintf ("nx", "Setting attributes for 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to r%cx\n", ++ k_address, k_address + k_size - 1, ++ (kernel_set_attrs & GRUB_MEM_ATTR_W) ? 'w' : '-'); ++ grub_update_mem_attrs (k_address, k_size, ++ kernel_set_attrs, kernel_clear_attrs); ++ ++ grub_get_mem_attrs (k_address, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ (grub_addr_t)k_address, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ if (grub_stack_addr != (grub_addr_t)-1ll) ++ { ++ grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", ++ grub_stack_addr, grub_stack_addr + grub_stack_size - 1, ++ (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); ++ grub_update_mem_attrs (grub_stack_addr, grub_stack_size, ++ stack_set_attrs, stack_clear_attrs); ++ ++ grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ grub_stack_addr, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ } ++ ++#if defined(__i386__) || defined(__x86_64__) ++ asm volatile ("cli"); ++#endif ++ ++ hf = (handover_func)((char *)k_address + h_offset + offset); ++ hf (grub_efi_image_handle, grub_efi_system_table, k_params); + + return GRUB_ERR_BUG; + } +@@ -287,13 +443,15 @@ free_params (void) + } + + grub_err_t +-grub_arch_efi_linux_boot_image (grub_addr_t addr, char *args) ++grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args, ++ int nx_supported) + { + grub_err_t retval; + + grub_dprintf ("linux", "linux command line: '%s'\n", args); + +- retval = grub_efi_linux_boot ((char *)addr, handover_offset, (void *)addr); ++ retval = grub_efi_linux_boot (addr, size, handover_offset, ++ (void *)addr, nx_supported); + + /* Never reached... */ + free_params(); +@@ -308,7 +466,10 @@ grub_linux_boot (void) + return grub_errno; + #endif + +- return grub_arch_efi_linux_boot_image ((grub_addr_t) kernel_addr, linux_args); ++ return grub_arch_efi_linux_boot_image((grub_addr_t)kernel_addr, ++ (grub_size_t)kernel_size, ++ linux_args, ++ 0); + } + + static grub_err_t +@@ -560,10 +721,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + struct linux_arch_kernel_header lh; + grub_off_t filelen; + grub_off_t filereadlen; +- grub_uint32_t align; +- grub_uint32_t code_size; + void *kernel = NULL; + grub_err_t err; ++ int nx_supported = 1; + + grub_dl_ref (my_mod); + +@@ -634,6 +794,8 @@ fallback: + + + #if !defined(__i386__) && !defined(__x86_64__) ++ grub_uint32_t align; ++ grub_uint32_t code_size; + if (parse_pe_header (kernel, &kernel_size, &handover_offset, &align, &code_size) != GRUB_ERR_NONE) + goto fail; + grub_dprintf ("linux", "kernel mem size : %lld\n", (long long) kernel_size); +@@ -641,6 +803,10 @@ fallback: + grub_dprintf ("linux", "kernel alignment : 0x%x\n", align); + grub_dprintf ("linux", "kernel size : 0x%x\n", code_size); + ++ err = grub_efi_check_nx_image_support((grub_addr_t)kernel, filelen, &nx_supported); ++ if (err != GRUB_ERR_NONE) ++ goto fail; ++ + grub_loader_unset(); + + kernel_alloc_pages = GRUB_EFI_BYTES_TO_PAGES (kernel_size + align - 1); +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index f97b123a51e..abbf6b24f50 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -44,7 +44,7 @@ struct grub_linuxefi_context { + grub_uint32_t handover_offset; + struct linux_kernel_params *params; + char *cmdline; +- ++ int nx_supported; + void *initrd_mem; + }; + +@@ -134,13 +134,19 @@ kernel_alloc(kernel_alloc_purpose_t purpose, + pages = BYTES_TO_PAGES(size); + grub_dprintf ("linux", "Trying to allocate %lu pages from %p\n", + (unsigned long)pages, (void *)(unsigned long)max); ++ size = pages * GRUB_EFI_PAGE_SIZE; + + prev_max = max; + addr = grub_efi_allocate_pages_real (max, pages, + max_addresses[i].alloc_type, + memtype); + if (addr) +- grub_dprintf ("linux", "Allocated at %p\n", addr); ++ { ++ grub_dprintf ("linux", "Allocated at %p\n", addr); ++ grub_update_mem_attrs ((grub_addr_t)addr, size, ++ GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, ++ GRUB_MEM_ATTR_X); ++ } + } + + while (grub_error_pop ()) +@@ -161,9 +167,11 @@ grub_linuxefi_boot (void *data) + + asm volatile ("cli"); + +- return grub_efi_linux_boot ((char *)context->kernel_mem, ++ return grub_efi_linux_boot ((grub_addr_t)context->kernel_mem, ++ context->kernel_size, + context->handover_offset, +- context->params); ++ context->params, ++ context->nx_supported); + } + + static grub_err_t +@@ -331,7 +339,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_uint32_t handover_offset; + struct linux_kernel_params *params = 0; + char *cmdline = 0; ++ int nx_supported = 1; + struct grub_linuxefi_context *context = 0; ++ grub_err_t err; + + grub_dl_ref (my_mod); + +@@ -361,6 +371,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++ err = grub_efi_check_nx_image_support ((grub_addr_t)kernel, filelen, ++ &nx_supported); ++ if (err != GRUB_ERR_NONE) ++ return err; ++ grub_dprintf ("linux", "nx is%s supported by this kernel\n", ++ nx_supported ? "" : " not"); ++ + lh = (struct linux_i386_kernel_header *)kernel; + grub_dprintf ("linux", "original lh is at %p\n", kernel); + +@@ -530,6 +547,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + context->handover_offset = handover_offset; + context->params = params; + context->cmdline = cmdline; ++ context->nx_supported = nx_supported; + + grub_loader_set_ex (grub_linuxefi_boot, grub_linuxefi_unload, context, 0); + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 5a257552234..90121e9bc5a 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -817,6 +817,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + kernel_offset += len; + } + ++ grub_dprintf("efi", "setting attributes for %p (%zu bytes) to +rw-x\n", ++ &linux_params, sizeof (lh) + len); ++ grub_update_mem_attrs ((grub_addr_t)&linux_params, sizeof (lh) + len, ++ GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, GRUB_MEM_ATTR_X); ++ + linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; + linux_params.kernel_alignment = (1 << align); + linux_params.ps_mouse = linux_params.padding11 = 0; +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index c40684821e1..2c0e7f24bda 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -190,6 +190,9 @@ extern void (*EXPORT_VAR(grub_efi_net_config)) (grub_efi_handle_t hnd, + void * + EXPORT_FUNC (grub_efi_find_configuration_table) (const grub_guid_t *target_guid); + ++extern grub_addr_t EXPORT_VAR(grub_stack_addr); ++extern grub_size_t EXPORT_VAR(grub_stack_size); ++ + #if defined(__arm__) || defined(__aarch64__) || defined(__riscv) || defined(__loongarch__) + void *EXPORT_FUNC(grub_efi_get_firmware_fdt)(void); + grub_err_t EXPORT_FUNC(grub_efi_get_ram_base)(grub_addr_t *); +@@ -197,7 +200,8 @@ grub_err_t EXPORT_FUNC(grub_efi_get_ram_base)(grub_addr_t *); + #include + grub_err_t grub_arch_efi_linux_load_image_header(grub_file_t file, + struct linux_arch_kernel_header *lh); +-grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, char *args); ++grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, grub_size_t size, ++ char *args, int nx_enabled); + + grub_addr_t grub_efi_section_addr (const char *section); + +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +index c806a7757f3..5b4e626c37c 100644 +--- a/include/grub/efi/linux.h ++++ b/include/grub/efi/linux.h +@@ -22,8 +22,20 @@ + #include + #include + ++#define GRUB_MOK_POLICY_NX_REQUIRED 0x1 ++ + grub_err_t +-EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset, +- void *kernel_param); ++EXPORT_FUNC(grub_efi_linux_boot) (grub_addr_t kernel_address, ++ grub_size_t kernel_size, ++ grub_off_t handover_offset, ++ void *kernel_param, int nx_enabled); ++ ++grub_err_t ++EXPORT_FUNC(grub_efi_check_nx_image_support) (grub_addr_t kernel_addr, ++ grub_size_t kernel_size, ++ int *nx_supported); ++ ++grub_err_t ++EXPORT_FUNC(grub_efi_check_nx_required) (int *nx_required); + + #endif /* ! GRUB_EFI_LINUX_HEADER */ +diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h +index 13fdd0e7d98..a4d62373cc9 100644 +--- a/include/grub/efi/pe32.h ++++ b/include/grub/efi/pe32.h +@@ -194,6 +194,8 @@ struct grub_pe32_optional_header + struct grub_pe32_data_directory reserved_entry; + }; + ++#define GRUB_PE32_NX_COMPAT 0x0100 ++ + struct grub_pe64_optional_header + { + grub_uint16_t magic; diff --git a/0265-efi-Provide-wrappers-for-load_image-start_image.patch b/0265-efi-Provide-wrappers-for-load_image-start_image.patch new file mode 100644 index 0000000..1ee0f32 --- /dev/null +++ b/0265-efi-Provide-wrappers-for-load_image-start_image.patch @@ -0,0 +1,183 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Julian Andres Klode +Date: Tue, 9 Jul 2024 16:46:05 -0600 +Subject: [PATCH] efi: Provide wrappers for load_image, start_image, + +These can be used to register a different implementation later, +for example, when shim provides a protocol with those functions. + +Signed-off-by: Mate Kukri +--- + grub-core/kern/efi/efi.c | 57 ++++++++++++++++++++++++++++++++++++++ + grub-core/loader/efi/chainloader.c | 13 ++++----- + include/grub/efi/efi.h | 37 +++++++++++++++++++++++++ + 3 files changed, 100 insertions(+), 7 deletions(-) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index cdfc11565c7..b5b8a329622 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -1131,6 +1131,63 @@ grub_efi_find_configuration_table (const grub_guid_t *target_guid) + return 0; + } + ++static const grub_efi_loader_t *override_loader = NULL; ++ ++grub_err_t ++grub_efi_register_loader (const grub_efi_loader_t *loader) ++{ ++ if (override_loader != NULL) ++ return grub_error (GRUB_ERR_BUG, "trying to register different loader"); ++ override_loader = loader; ++ return GRUB_ERR_NONE; ++} ++ ++grub_err_t ++grub_efi_unregister_loader (const grub_efi_loader_t *loader) ++{ ++ if (loader != override_loader) ++ return grub_error (GRUB_ERR_BUG, "trying to unregister different loader"); ++ ++ override_loader = NULL; ++ return GRUB_ERR_NONE; ++} ++ ++grub_efi_status_t ++grub_efi_load_image (grub_efi_boolean_t boot_policy, ++ grub_efi_handle_t parent_image_handle, ++ grub_efi_device_path_t *file_path, void *source_buffer, ++ grub_efi_uintn_t source_size, ++ grub_efi_handle_t *image_handle) ++{ ++ if (override_loader != NULL) ++ return override_loader->load_image (boot_policy, parent_image_handle, ++ file_path, source_buffer, source_size, ++ image_handle); ++ return grub_efi_system_table->boot_services->load_image ( ++ boot_policy, parent_image_handle, file_path, source_buffer, source_size, ++ image_handle); ++} ++ ++grub_efi_status_t ++grub_efi_start_image (grub_efi_handle_t image_handle, ++ grub_efi_uintn_t *exit_data_size, ++ grub_efi_char16_t **exit_data) ++{ ++ if (override_loader != NULL) ++ return override_loader->start_image (image_handle, exit_data_size, ++ exit_data); ++ return grub_efi_system_table->boot_services->start_image ( ++ image_handle, exit_data_size, exit_data); ++} ++ ++grub_efi_status_t ++grub_efi_unload_image (grub_efi_handle_t image_handle) ++{ ++ if (override_loader != NULL) ++ return override_loader->unload_image (image_handle); ++ return grub_efi_system_table->boot_services->unload_image (image_handle); ++} ++ + grub_err_t + grub_efi_status_to_err (grub_efi_status_t status) + { +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 5cd6f6a5993..9b1cc3fd41d 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -69,7 +69,7 @@ grub_start_image (grub_efi_handle_t handle) + + b = grub_efi_system_table->boot_services; + +- status = b->start_image (handle, &exit_data_size, &exit_data); ++ status = grub_efi_start_image (handle, &exit_data_size, &exit_data); + if (status != GRUB_EFI_SUCCESS) + { + if (exit_data) +@@ -101,7 +101,6 @@ grub_chainloader_unload (void *context) + { + grub_efi_handle_t image_handle; + grub_efi_loaded_image_t *loaded_image; +- grub_efi_boot_services_t *b; + + image_handle = (grub_efi_handle_t) context; + +@@ -109,8 +108,7 @@ grub_chainloader_unload (void *context) + if (loaded_image != NULL) + grub_free (loaded_image->load_options); + +- b = grub_efi_system_table->boot_services; +- b->unload_image (image_handle); ++ grub_efi_unload_image (image_handle); + + grub_dl_unref (my_mod); + return GRUB_ERR_NONE; +@@ -871,8 +869,8 @@ grub_load_image(grub_efi_device_path_t *file_path, void *boot_image, + + b = grub_efi_system_table->boot_services; + +- status = b->load_image (0, grub_efi_image_handle, file_path, +- boot_image, image_size, image_handle_out); ++ status = grub_efi_load_image (0, grub_efi_image_handle, file_path, ++ boot_image, image_size, image_handle_out); + if (status != GRUB_EFI_SUCCESS) + { + if (status == GRUB_EFI_OUT_OF_RESOURCES) +@@ -1198,7 +1196,8 @@ fail: + if (cmdline) + grub_free (cmdline); + +- b->unload_image (image_handle); ++ if (image_handle != NULL) ++ grub_efi_unload_image (image_handle); + + grub_dl_unref (my_mod); + +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index 2c0e7f24bda..7eed1bd791d 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -202,6 +202,43 @@ grub_err_t grub_arch_efi_linux_load_image_header(grub_file_t file, + struct linux_arch_kernel_header *lh); + grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, grub_size_t size, + char *args, int nx_enabled); ++grub_efi_status_t ++EXPORT_FUNC (grub_efi_load_image) (grub_efi_boolean_t boot_policy, ++ grub_efi_handle_t parent_image_handle, ++ grub_efi_device_path_t *file_path, ++ void *source_buffer, grub_efi_uintn_t source_size, ++ grub_efi_handle_t *image_handle); ++ ++grub_efi_status_t ++EXPORT_FUNC (grub_efi_start_image) (grub_efi_handle_t image_handle, ++ grub_efi_uintn_t *exit_data_size, ++ grub_efi_char16_t **exit_data); ++ ++grub_efi_status_t ++EXPORT_FUNC (grub_efi_unload_image) (grub_efi_handle_t image_handle); ++ ++typedef struct grub_efi_loader ++{ ++ grub_efi_status_t (__grub_efi_api *load_image) (grub_efi_boolean_t boot_policy, ++ grub_efi_handle_t parent_image_handle, ++ grub_efi_device_path_t *file_path, ++ void *source_buffer, ++ grub_efi_uintn_t source_size, ++ grub_efi_handle_t *image_handle); ++ ++ grub_efi_status_t (__grub_efi_api *start_image) (grub_efi_handle_t image_handle, ++ grub_efi_uintn_t *exit_data_size, ++ grub_efi_char16_t **exit_data); ++ ++ grub_efi_status_t (__grub_efi_api *unload_image) (grub_efi_handle_t image_handle); ++} grub_efi_loader_t; ++ ++grub_err_t ++EXPORT_FUNC (grub_efi_register_loader) (const grub_efi_loader_t *loader); ++ ++grub_err_t ++EXPORT_FUNC (grub_efi_unregister_loader) (const grub_efi_loader_t *loader); ++ + + grub_addr_t grub_efi_section_addr (const char *section); + diff --git a/0266-efi-Disallow-fallback-to-legacy-Linux-loader-when-sh.patch b/0266-efi-Disallow-fallback-to-legacy-Linux-loader-when-sh.patch new file mode 100644 index 0000000..719d920 --- /dev/null +++ b/0266-efi-Disallow-fallback-to-legacy-Linux-loader-when-sh.patch @@ -0,0 +1,66 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Mate Kukri +Date: Wed, 10 Jul 2024 12:07:17 -0600 +Subject: [PATCH] efi: Disallow fallback to legacy Linux loader when shim says + NX is required. + +Signed-off-by: Mate Kukri +--- + grub-core/loader/efi/linux.c | 13 ++++++++----- + include/grub/efi/api.h | 2 ++ + 2 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index fe48001442a..0d1804b602d 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -724,6 +724,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + void *kernel = NULL; + grub_err_t err; + int nx_supported = 1; ++ int nx_required = 0; + + grub_dl_ref (my_mod); + +@@ -772,21 +773,23 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + ++#if !defined(__i386__) && !defined(__x86_64__) + if (grub_arch_efi_linux_load_image_header (file, &lh) != GRUB_ERR_NONE) +-#if !defined(__i386__) && !defined(__x86_64__) + goto fail; + #else +- goto fallback; +- +- if (!initrd_use_loadfile2) ++ if (grub_arch_efi_linux_load_image_header (file, &lh) != GRUB_ERR_NONE || ++ !initrd_use_loadfile2) + { ++ /* We cannot use the legacy loader when NX is required */ ++ if (grub_efi_check_nx_required(&nx_required)) ++ goto fail; ++ + /* + * This is a EFI stub image but it is too old to implement the LoadFile2 + * based initrd loading scheme, and Linux/x86 does not support the DT + * based method either. So fall back to the x86-specific loader that + * enters Linux in EFI mode but without going through its EFI stub. + */ +-fallback: + grub_file_close (file); + return grub_cmd_linux_x86_legacy (cmd, argc, argv); + } +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index 76c88fbdcb0..2376182d735 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -2006,6 +2006,8 @@ struct grub_efi_block_io + }; + typedef struct grub_efi_block_io grub_efi_block_io_t; + ++#define GRUB_MOK_POLICY_NX_REQUIRED 0x1 ++ + struct grub_efi_shim_lock_protocol + { + /* diff --git a/0267-Set-non-executable-stack-sections-on-EFI-assembly-fi.patch b/0267-Set-non-executable-stack-sections-on-EFI-assembly-fi.patch new file mode 100644 index 0000000..85ccb0e --- /dev/null +++ b/0267-Set-non-executable-stack-sections-on-EFI-assembly-fi.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Mon, 5 Aug 2024 13:19:28 -0600 +Subject: [PATCH] Set non-executable stack sections on EFI assembly files + +For those manual assembly files created where no '.note.GNU-stack' +section is explicitly added, linker defaults it as executable and this +is the reason that RHEL CI rpminspect & annocheck tests are +failing. The proposed change sets the corresponding GNU-stack +sections otherwise CI detects the following security vulnerability + + $ annocheck annocheck --ignore-unknown --verbose --profile=el9 *.rpm 2>&1 | grep FAIL | grep stack + (standard input):(standard input):Hardened: ./usr/lib/grub/x86_64-efi/kernel.exec: FAIL: gnu-stack test because .note.GNU-stack section has execute permission + (standard input):(standard input):Hardened: ./usr/lib/grub/x86_64-efi/kernel.img: FAIL: gnu-stack test because .note.GNU-stack section has execute permission + +Signed-off-by: Leo Sandoval +--- + grub-core/kern/i386/efi/startup.S | 5 +++++ + grub-core/kern/x86_64/efi/startup.S | 5 +++++ + 2 files changed, 10 insertions(+) + +diff --git a/grub-core/kern/i386/efi/startup.S b/grub-core/kern/i386/efi/startup.S +index fc5ea3dac86..36d1b1a6897 100644 +--- a/grub-core/kern/i386/efi/startup.S ++++ b/grub-core/kern/i386/efi/startup.S +@@ -34,3 +34,8 @@ _start: + movl %eax, EXT_C(grub_efi_system_table) + call EXT_C(grub_main) + ret ++ ++/* An executable stack is not required for these functions. */ ++#if defined (__linux__) && defined (__ELF__) ++.section .note.GNU-stack,"",%progbits ++#endif +diff --git a/grub-core/kern/x86_64/efi/startup.S b/grub-core/kern/x86_64/efi/startup.S +index 9357e5c5dda..f5c6bc3d8eb 100644 +--- a/grub-core/kern/x86_64/efi/startup.S ++++ b/grub-core/kern/x86_64/efi/startup.S +@@ -33,3 +33,8 @@ _start: + andq $~0xf, %rsp + call EXT_C(grub_main) + /* Doesn't return. */ ++ ++/* An executable stack is not required for these functions. */ ++#if defined (__linux__) && defined (__ELF__) ++.section .note.GNU-stack,"",%progbits ++#endif diff --git a/0268-grub-mkconfig.in-turn-off-executable-owner-bit.patch b/0268-grub-mkconfig.in-turn-off-executable-owner-bit.patch new file mode 100644 index 0000000..9a40b96 --- /dev/null +++ b/0268-grub-mkconfig.in-turn-off-executable-owner-bit.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Mon, 6 May 2024 15:35:41 -0600 +Subject: [PATCH] grub-mkconfig.in: turn off executable owner bit + +Stricker permissions are required on the grub.cfg file, resulting in +at most 0600 owner's file permissions. This resolves conflicting +requirement permissions on grub2-pc package's grub2.cfg file. + +Signed-off-by: Leo Sandoval +--- + util/grub-mkconfig.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index bec52e052fc..461df7f09af 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -316,7 +316,7 @@ and /etc/grub.d/* files or please file a bug report with + else + # none of the children aborted with error, install the new grub.cfg + oldumask=$(umask) +- umask 077 ++ umask 177 + cat ${grub_cfg}.new > ${grub_cfg} + umask $oldumask + rm -f ${grub_cfg}.new diff --git a/0269-kern-ieee1275-init-Add-IEEE-1275-Radix-support-for-K.patch b/0269-kern-ieee1275-init-Add-IEEE-1275-Radix-support-for-K.patch new file mode 100644 index 0000000..4847c54 --- /dev/null +++ b/0269-kern-ieee1275-init-Add-IEEE-1275-Radix-support-for-K.patch @@ -0,0 +1,119 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Avnish Chouhan +Date: Thu, 23 May 2024 18:43:14 +0530 +Subject: [PATCH] kern/ieee1275/init: Add IEEE 1275 Radix support for KVM on + Power + +This patch adds support for Radix, Xive and Radix_gtse in Options +vector5 which is required for KVM LPARs. KVM LPARs ONLY support +Radix and not the Hash. Not enabling Radix on any PowerVM KVM LPARs +will result in boot failure. + +Signed-off-by: Avnish Chouhan +Reviewed-by: Daniel Kiper +--- + grub-core/kern/ieee1275/init.c | 63 +++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 62 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 13e8a5b4bb8..6c5f4fb77af 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -113,6 +113,16 @@ grub_addr_t grub_ieee1275_original_stack; + #define DRC_INFO 0x40 + #define BYTE22 (DY_MEM_V2 | DRC_INFO) + ++/* For ibm,arch-vec-5-platform-support. */ ++#define XIVE_INDEX 0x17 ++#define MMU_INDEX 0x18 ++#define RADIX_GTSE_INDEX 0x1a ++#define RADIX_ENABLED 0x40 ++#define XIVE_ENABLED 0x40 ++#define HASH_ENABLED 0x00 ++#define MAX_SUPPORTED 0xC0 ++#define RADIX_GTSE_ENABLED 0x40 ++ + void + grub_exit (int rc __attribute__((unused))) + { +@@ -739,6 +749,10 @@ struct option_vector5 + grub_uint32_t platform_facilities; + grub_uint8_t sub_processors; + grub_uint8_t byte22; ++ grub_uint8_t xive; ++ grub_uint8_t mmu; ++ grub_uint8_t hpt_ext; ++ grub_uint8_t radix_gtse; + } GRUB_PACKED; + + struct pvr_entry +@@ -777,6 +791,13 @@ grub_ieee1275_ibm_cas (void) + { + int rc; + grub_ieee1275_ihandle_t root; ++ grub_uint8_t ibm_arch_platform_support[8]; ++ grub_ssize_t actual; ++ grub_uint8_t xive_support = 0; ++ grub_uint8_t mmu_support = 0; ++ grub_uint8_t radix_gtse_support = 0; ++ int i = 0; ++ int prop_len = 8; + struct cas_args + { + struct grub_ieee1275_common_hdr common; +@@ -785,6 +806,46 @@ grub_ieee1275_ibm_cas (void) + grub_ieee1275_cell_t cas_addr; + grub_ieee1275_cell_t result; + } args; ++ ++ grub_ieee1275_get_integer_property (grub_ieee1275_chosen, ++ "ibm,arch-vec-5-platform-support", ++ (grub_uint32_t *) ibm_arch_platform_support, ++ sizeof (ibm_arch_platform_support), ++ &actual); ++ ++ for (i = 0; i < prop_len; i++) ++ { ++ switch (ibm_arch_platform_support[i]) ++ { ++ case XIVE_INDEX: ++ if (ibm_arch_platform_support[i + 1] & MAX_SUPPORTED) ++ xive_support = XIVE_ENABLED; ++ else ++ xive_support = 0; ++ break; ++ ++ case MMU_INDEX: ++ if (ibm_arch_platform_support[i + 1] & MAX_SUPPORTED) ++ mmu_support = RADIX_ENABLED; ++ else ++ mmu_support = HASH_ENABLED; ++ break; ++ ++ case RADIX_GTSE_INDEX: ++ if (mmu_support == RADIX_ENABLED) ++ radix_gtse_support = ibm_arch_platform_support[i + 1] & RADIX_GTSE_ENABLED; ++ else ++ radix_gtse_support = 0; ++ break; ++ ++ default: ++ /* Ignoring the other indexes of ibm,arch-vec-5-platform-support. */ ++ break; ++ } ++ /* Skipping the property value. */ ++ i++; ++ } ++ + struct cas_vector vector = + { + .pvr_list = { { 0x00000000, 0xffffffff } }, /* any processor */ +@@ -801,7 +862,7 @@ grub_ieee1275_ibm_cas (void) + .vec4 = 0x0001, /* set required minimum capacity % to the lowest value */ + .vec5_size = 1 + sizeof (struct option_vector5) - 2, + .vec5 = { +- 0, BYTE2, 0, CMO, ASSOCIATIVITY, BIN_OPTS, 0, 0, MAX_CPU, 0, 0, PLATFORM_FACILITIES, SUB_PROCESSORS, BYTE22 ++ 0, BYTE2, 0, CMO, ASSOCIATIVITY, BIN_OPTS, 0, 0, MAX_CPU, 0, 0, PLATFORM_FACILITIES, SUB_PROCESSORS, BYTE22, xive_support, mmu_support, 0, radix_gtse_support + } + }; + diff --git a/0269-revert-Add-hidden-menu-entries.patch b/0269-revert-Add-hidden-menu-entries.patch deleted file mode 100644 index 6046e9b..0000000 --- a/0269-revert-Add-hidden-menu-entries.patch +++ /dev/null @@ -1,211 +0,0 @@ -From c53ef0ff4c471f284ecb7bc2f75d0c5ae28fbd9f Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Sun, 7 Apr 2024 11:15:34 +0800 -Subject: [PATCH 269/272] revert Add hidden menu entries - -no need of this function - -Signed-off-by: nilusyi ---- - grub-core/commands/blscfg.c | 2 +- - grub-core/commands/legacycfg.c | 4 ++-- - grub-core/commands/menuentry.c | 17 +++-------------- - grub-core/normal/menu.c | 22 ++++------------------ - grub-core/normal/menu_text.c | 4 ---- - include/grub/menu.h | 2 -- - include/grub/normal.h | 2 +- - 7 files changed, 11 insertions(+), 42 deletions(-) - -diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c -index ed1bf11aa..047a9d15c 100644 ---- a/grub-core/commands/blscfg.c -+++ b/grub-core/commands/blscfg.c -@@ -953,7 +953,7 @@ static void create_entry (struct bls_entry *entry) - clinux, options ? " " : "", options ? options : "", - initrd ? initrd : "", dt ? dt : ""); - -- grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, 0, &index, entry); -+ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry); - grub_dprintf ("blscfg", "Added entry %d id:\"%s\"\n", index, id); - - finish: -diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c -index c22b74ab5..a43c0533d 100644 ---- a/grub-core/commands/legacycfg.c -+++ b/grub-core/commands/legacycfg.c -@@ -143,7 +143,7 @@ legacy_file (const char *filename) - args[0] = oldname; - grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy", - NULL, NULL, -- entrysrc, 0, 0, NULL, NULL); -+ entrysrc, 0, NULL, NULL); - grub_free (args); - entrysrc[0] = 0; - grub_free (oldname); -@@ -205,7 +205,7 @@ legacy_file (const char *filename) - } - args[0] = entryname; - grub_normal_add_menu_entry (1, args, NULL, NULL, NULL, -- NULL, NULL, entrysrc, 0, 0, NULL, NULL); -+ NULL, NULL, entrysrc, 0, NULL, NULL); - grub_free (args); - } - -diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c -index 787dc978a..5bf972139 100644 ---- a/grub-core/commands/menuentry.c -+++ b/grub-core/commands/menuentry.c -@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args, - char **classes, const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu, int hidden, -+ int submenu, - int *index, struct bls_entry *bls) - { - int menu_hotkey = 0; -@@ -196,11 +196,9 @@ grub_normal_add_menu_entry (int argc, const char **args, - (*last)->args = menu_args; - (*last)->sourcecode = menu_sourcecode; - (*last)->submenu = submenu; -- (*last)->hidden = hidden; - (*last)->bls = bls; - -- if (!hidden) -- menu->size++; -+ menu->size++; - - if (index) - *index = ind; -@@ -302,7 +300,6 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - ctxt->state[2].arg, 0, - ctxt->state[3].arg, - ctxt->extcmd->cmd->name[0] == 's', -- ctxt->extcmd->cmd->name[0] == 'h', - NULL, NULL); - - src = args[argc - 1]; -@@ -321,7 +318,6 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - users, - ctxt->state[2].arg, prefix, src + 1, - ctxt->extcmd->cmd->name[0] == 's', -- ctxt->extcmd->cmd->name[0] == 'h', - NULL, NULL); - - src[len - 1] = ch; -@@ -330,7 +326,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - return r; - } - --static grub_extcmd_t cmd, cmd_sub, cmd_hidden; -+static grub_extcmd_t cmd, cmd_sub; - - void - grub_menu_init (void) -@@ -346,13 +342,6 @@ grub_menu_init (void) - | GRUB_COMMAND_FLAG_EXTRACTOR, - N_("BLOCK"), N_("Define a submenu."), - options); -- cmd_hidden = grub_register_extcmd ("hiddenentry", grub_cmd_menuentry, -- GRUB_COMMAND_FLAG_BLOCKS -- | GRUB_COMMAND_ACCEPT_DASH -- | GRUB_COMMAND_FLAG_EXTRACTOR, -- N_("BLOCK"), -- N_("Define a hidden menu entry."), -- options); - } - - void -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index d58dbe443..23293b5ce 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -41,8 +41,6 @@ - grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu, - int nested) = NULL; - --#define MENU_INCLUDE_HIDDEN 0x10000 -- - enum timeout_style { - TIMEOUT_STYLE_MENU, - TIMEOUT_STYLE_COUNTDOWN, -@@ -83,20 +81,8 @@ grub_menu_get_entry (grub_menu_t menu, int no) - { - grub_menu_entry_t e; - -- if (no & MENU_INCLUDE_HIDDEN) { -- no &= ~MENU_INCLUDE_HIDDEN; -- -- for (e = menu->entry_list; e && no > 0; e = e->next, no--) -- ; -- } else { -- for (e = menu->entry_list; e && no > 0; e = e->next, no--) { -- /* Skip hidden entries */ -- while (e && e->hidden) -- e = e->next; -- } -- while (e && e->hidden) -- e = e->next; -- } -+ for (e = menu->entry_list; e && no > 0; e = e->next, no--) -+ ; - - return e; - } -@@ -108,10 +94,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey) - grub_menu_entry_t entry; - int i; - -- for (i = 0, entry = menu->entry_list; entry; -+ for (i = 0, entry = menu->entry_list; i < menu->size; - i++, entry = entry->next) - if (entry->hotkey == hotkey) -- return i | MENU_INCLUDE_HIDDEN; -+ return i; - - return -1; - } -diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c -index 161083663..b1321eb26 100644 ---- a/grub-core/normal/menu_text.c -+++ b/grub-core/normal/menu_text.c -@@ -290,10 +290,6 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data) - e, data); - if (e) - e = e->next; -- -- /* Skip hidden entries */ -- while (e && e->hidden) -- e = e->next; - } - - grub_term_gotoxy (data->term, -diff --git a/include/grub/menu.h b/include/grub/menu.h -index 43080828c..0acdc2aa6 100644 ---- a/include/grub/menu.h -+++ b/include/grub/menu.h -@@ -68,8 +68,6 @@ struct grub_menu_entry - - int submenu; - -- int hidden; -- - /* The next element. */ - struct grub_menu_entry *next; - -diff --git a/include/grub/normal.h b/include/grub/normal.h -index 8c712a9e5..8839ad85a 100644 ---- a/include/grub/normal.h -+++ b/include/grub/normal.h -@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes, - const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu, int hidden, int *index, struct bls_entry *bls); -+ int submenu, int *index, struct bls_entry *bls); - - grub_err_t - grub_normal_set_password (const char *user, const char *password); --- -2.41.0 - diff --git a/0270-grub2-mkconfig-Ensure-grub-cfg-stub-is-not-overwritt.patch b/0270-grub2-mkconfig-Ensure-grub-cfg-stub-is-not-overwritt.patch new file mode 100644 index 0000000..a3f8c80 --- /dev/null +++ b/0270-grub2-mkconfig-Ensure-grub-cfg-stub-is-not-overwritt.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Tue, 16 Jul 2024 11:11:43 +0200 +Subject: [PATCH] grub2-mkconfig: Ensure grub cfg stub is not overwritten + +/boot/efi/EFI/$os_name/grub.cfg contains a grub cfg stub +that should not be overwritten by grub2-mkconfig. +Ensure that we prevent this from happening. + +Signed-off-by: Marta Lewandowska +Signed-off-by: Nicolas Frayer +--- + util/grub-mkconfig.in | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index 461df7f09af..b560aae6c5f 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -109,6 +109,20 @@ do + esac + done + ++os_name=$(grep '^ID=' /etc/os-release | sed 's/ID=//') ++if test "$os_name" = '"rhel"'; then ++ os_name=redhat ++elif test "$os_name" = '"centos"'; then ++ os_name=centos ++fi ++if test "x${grub_cfg}" = "x/boot/efi/EFI/$os_name/grub.cfg" &&\ ++ mountpoint -q /boot/efi; then ++ gettext_printf "Running \`grub2-mkconfig -o %s' will overwrite the GRUB wrapper.\n" "$grub_cfg" 1>&2 ++ gettext_printf "Please run \`grub2-mkconfig -o /boot/grub2/grub.cfg' instead to update grub.cfg.\n" 1>&2 ++ gettext_printf "GRUB configuration file was not updated.\n" 1>&2 ++ exit 1 ++fi ++ + if [ "x$EUID" = "x" ] ; then + EUID=`id -u` + fi diff --git a/0270-revert-Add-the-t-hotkey.patch b/0270-revert-Add-the-t-hotkey.patch deleted file mode 100644 index dfc2397..0000000 --- a/0270-revert-Add-the-t-hotkey.patch +++ /dev/null @@ -1,67 +0,0 @@ -From a222a636e9d3cf5ccad652e9126446f2be5a16a2 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Sun, 7 Apr 2024 11:17:52 +0800 -Subject: [PATCH 270/272] revert Add the "t" hotkey - -no need of this function - -Signed-off-by: nilusyi ---- - Makefile.util.def | 6 ------ - util/grub.d/00_header.in | 3 --- - util/grub.d/95_textmode.in | 12 ------------ - 3 files changed, 21 deletions(-) - delete mode 100644 util/grub.d/95_textmode.in - -diff --git a/Makefile.util.def b/Makefile.util.def -index d557c268b..5ecba7c9e 100644 ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -591,12 +591,6 @@ script = { - installdir = grubconf; - }; - --script = { -- name = '95_textmode'; -- common = util/grub.d/95_textmode.in; -- installdir = grubconf; --}; -- - script = { - name = 'grub-systemd-integration.service'; - common = util/systemd/grub-systemd-integration.service.in; -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 1eec16dad..f402d2072 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -222,9 +222,6 @@ EOF - fi - - cat << EOF -- if [ "\${grub_platform}" = "efi" ]; then -- echo "Please press 't' to show the boot menu on this console" -- fi - - set gfxmode=${GRUB_GFXMODE} - load_video -diff --git a/util/grub.d/95_textmode.in b/util/grub.d/95_textmode.in -deleted file mode 100644 -index d6c1dbf00..000000000 ---- a/util/grub.d/95_textmode.in -+++ /dev/null -@@ -1,12 +0,0 @@ --#!/bin/sh -- --cat < -Date: Sun, 7 Apr 2024 14:44:42 +0800 -Subject: [PATCH 272/272] add extra_deps which forgot to maintained in release - -Signed-off-by: nilusyi ---- - grub-core/extra_deps.lst | 1 + - 1 file changed, 1 insertion(+) - create mode 100644 grub-core/extra_deps.lst - -diff --git a/grub-core/extra_deps.lst b/grub-core/extra_deps.lst -new file mode 100644 -index 000000000..f44ad6a0c ---- /dev/null -+++ b/grub-core/extra_deps.lst -@@ -0,0 +1 @@ -+depends bli part_gpt --- -2.41.0 - diff --git a/0271-grub2-mkconfig-Simplify-os_name-detection.patch b/0271-grub2-mkconfig-Simplify-os_name-detection.patch new file mode 100644 index 0000000..72e7e32 --- /dev/null +++ b/0271-grub2-mkconfig-Simplify-os_name-detection.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrew Lukoshko +Date: Wed, 31 Jul 2024 16:06:10 +0000 +Subject: [PATCH] grub2-mkconfig: Simplify os_name detection + +--- + util/grub-mkconfig.in | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index b560aae6c5f..6f48c5dab5f 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -109,12 +109,7 @@ do + esac + done + +-os_name=$(grep '^ID=' /etc/os-release | sed 's/ID=//') +-if test "$os_name" = '"rhel"'; then +- os_name=redhat +-elif test "$os_name" = '"centos"'; then +- os_name=centos +-fi ++os_name=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') + if test "x${grub_cfg}" = "x/boot/efi/EFI/$os_name/grub.cfg" &&\ + mountpoint -q /boot/efi; then + gettext_printf "Running \`grub2-mkconfig -o %s' will overwrite the GRUB wrapper.\n" "$grub_cfg" 1>&2 diff --git a/0272-grub-mkconfig-Remove-check-for-mount-point-for-grub-.patch b/0272-grub-mkconfig-Remove-check-for-mount-point-for-grub-.patch new file mode 100644 index 0000000..35ee9e2 --- /dev/null +++ b/0272-grub-mkconfig-Remove-check-for-mount-point-for-grub-.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Thu, 1 Aug 2024 11:13:20 +0200 +Subject: [PATCH] grub/mkconfig: Remove check for mount point for grub cfg stub + +Remove mountpoint when checking whether or not the grub cfg stub +exists and add -s to the test. This should cover scenarios where +the ESP doesn't have a seperate partition but still uses a grub +cfg stub + +Signed-off-by: Nicolas Frayer +--- + util/grub-mkconfig.in | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index 6f48c5dab5f..1cfb5873ff2 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -110,8 +110,7 @@ do + done + + os_name=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') +-if test "x${grub_cfg}" = "x/boot/efi/EFI/$os_name/grub.cfg" &&\ +- mountpoint -q /boot/efi; then ++if test -s "${grub_cfg}" && test "x${grub_cfg}" = "x/boot/efi/EFI/$os_name/grub.cfg"; then + gettext_printf "Running \`grub2-mkconfig -o %s' will overwrite the GRUB wrapper.\n" "$grub_cfg" 1>&2 + gettext_printf "Please run \`grub2-mkconfig -o /boot/grub2/grub.cfg' instead to update grub.cfg.\n" 1>&2 + gettext_printf "GRUB configuration file was not updated.\n" 1>&2 diff --git a/0273-efi-api.h-include-missing-__grub_efi_api-macros-on-E.patch b/0273-efi-api.h-include-missing-__grub_efi_api-macros-on-E.patch new file mode 100644 index 0000000..f71764d --- /dev/null +++ b/0273-efi-api.h-include-missing-__grub_efi_api-macros-on-E.patch @@ -0,0 +1,495 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 29 Aug 2024 12:11:11 -0600 +Subject: [PATCH] efi/api.h: include missing __grub_efi_api macros on EFI + functions + +Signed-off-by: Peter Jones +Signed-off-by: Leo Sandoval +--- + grub-core/loader/efi/chainloader.c | 2 +- + include/grub/efi/api.h | 34 +++++++++++++------------- + include/grub/efi/dhcp.h | 42 ++++++++++++++++---------------- + include/grub/efi/edid.h | 2 +- + include/grub/efi/http.h | 12 ++++----- + include/grub/efi/pci.h | 50 +++++++++++++++++++------------------- + 6 files changed, 71 insertions(+), 71 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 9b1cc3fd41d..7652f5a9291 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -553,7 +553,7 @@ handle_image (struct grub_secureboot_chainloader_context *load_context) + grub_uint32_t buffer_size; + int found_entry_point = 0; + int rc; +- grub_efi_status_t (*entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); ++ grub_efi_status_t (__grub_efi_api *entry_point) (grub_efi_handle_t image_handle, grub_efi_system_table_t *system_table); + + b = grub_efi_system_table->boot_services; + +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index 2376182d735..5047ecf28c5 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -1094,11 +1094,11 @@ typedef struct grub_efi_bios_device_path grub_efi_bios_device_path_t; + struct grub_efi_service_binding; + + typedef grub_efi_status_t +-(*grub_efi_service_binding_create_child) (struct grub_efi_service_binding *this, ++(__grub_efi_api *grub_efi_service_binding_create_child) (struct grub_efi_service_binding *this, + grub_efi_handle_t *child_handle); + + typedef grub_efi_status_t +-(*grub_efi_service_binding_destroy_child) (struct grub_efi_service_binding *this, ++(__grub_efi_api *grub_efi_service_binding_destroy_child) (struct grub_efi_service_binding *this, + grub_efi_handle_t *child_handle); + + typedef struct grub_efi_service_binding +@@ -1754,12 +1754,12 @@ typedef struct grub_efi_pxe_mode + typedef struct grub_efi_pxe + { + grub_uint64_t rev; +- grub_efi_status_t (*start) (struct grub_efi_pxe *this, grub_efi_boolean_t use_ipv6); ++ grub_efi_status_t (__grub_efi_api *start) (struct grub_efi_pxe *this, grub_efi_boolean_t use_ipv6); + void (*stop) (void); +- grub_efi_status_t (*dhcp) (struct grub_efi_pxe *this, ++ grub_efi_status_t (__grub_efi_api *dhcp) (struct grub_efi_pxe *this, + grub_efi_boolean_t sort_offers); + void (*discover) (void); +- grub_efi_status_t (*mtftp) (struct grub_efi_pxe *this, ++ grub_efi_status_t (__grub_efi_api *mtftp) (struct grub_efi_pxe *this, + grub_efi_pxe_base_code_tftp_opcode_t operation, + void *buffer_ptr, + grub_efi_boolean_t overwrite, +@@ -1775,7 +1775,7 @@ typedef struct grub_efi_pxe + void (*setipfilter) (void); + void (*arp) (void); + void (*setparams) (void); +- grub_efi_status_t (*set_station_ip) (struct grub_efi_pxe *this, ++ grub_efi_status_t (__grub_efi_api *set_station_ip) (struct grub_efi_pxe *this, + grub_efi_pxe_ip_address_t *new_station_ip, + grub_efi_pxe_ip_address_t *new_subnet_mask); + void (*setpackets) (void); +@@ -2054,21 +2054,21 @@ typedef enum grub_efi_ip4_config2_data_type grub_efi_ip4_config2_data_type_t; + + struct grub_efi_ip4_config2_protocol + { +- grub_efi_status_t (*set_data) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (__grub_efi_api *set_data) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_uintn_t data_size, + void *data); + +- grub_efi_status_t (*get_data) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (__grub_efi_api *get_data) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_uintn_t *data_size, + void *data); + +- grub_efi_status_t (*register_data_notify) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (__grub_efi_api *register_data_notify) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_event_t event); + +- grub_efi_status_t (*unregister_datanotify) (struct grub_efi_ip4_config2_protocol *this, ++ grub_efi_status_t (__grub_efi_api *unregister_datanotify) (struct grub_efi_ip4_config2_protocol *this, + grub_efi_ip4_config2_data_type_t data_type, + grub_efi_event_t event); + }; +@@ -2126,21 +2126,21 @@ typedef enum grub_efi_ip6_config_data_type grub_efi_ip6_config_data_type_t; + + struct grub_efi_ip6_config_protocol + { +- grub_efi_status_t (*set_data) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (__grub_efi_api *set_data) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_uintn_t data_size, + void *data); + +- grub_efi_status_t (*get_data) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (__grub_efi_api *get_data) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_uintn_t *data_size, + void *data); + +- grub_efi_status_t (*register_data_notify) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (__grub_efi_api *register_data_notify) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_event_t event); + +- grub_efi_status_t (*unregister_datanotify) (struct grub_efi_ip6_config_protocol *this, ++ grub_efi_status_t (__grub_efi_api *unregister_datanotify) (struct grub_efi_ip6_config_protocol *this, + grub_efi_ip6_config_data_type_t data_type, + grub_efi_event_t event); + }; +@@ -2191,17 +2191,17 @@ typedef struct grub_efi_ip6_config_manual_address grub_efi_ip6_config_manual_add + + struct grub_efi_memory_attribute_protocol + { +- grub_efi_status_t (*get_memory_attributes) ( ++ grub_efi_status_t (__grub_efi_api *get_memory_attributes) ( + struct grub_efi_memory_attribute_protocol *this, + grub_efi_physical_address_t base_address, + grub_efi_uint64_t length, + grub_efi_uint64_t *attributes); +- grub_efi_status_t (*set_memory_attributes) ( ++ grub_efi_status_t (__grub_efi_api *set_memory_attributes) ( + struct grub_efi_memory_attribute_protocol *this, + grub_efi_physical_address_t base_address, + grub_efi_uint64_t length, + grub_efi_uint64_t attributes); +- grub_efi_status_t (*clear_memory_attributes) ( ++ grub_efi_status_t (__grub_efi_api *clear_memory_attributes) ( + struct grub_efi_memory_attribute_protocol *this, + grub_efi_physical_address_t base_address, + grub_efi_uint64_t length, +diff --git a/include/grub/efi/dhcp.h b/include/grub/efi/dhcp.h +index fdb88eb810e..d996716e409 100644 +--- a/include/grub/efi/dhcp.h ++++ b/include/grub/efi/dhcp.h +@@ -123,7 +123,7 @@ struct grub_efi_dhcp4_config_data { + grub_efi_uint32_t request_try_count; + grub_efi_uint32_t *request_timeout; + grub_efi_ipv4_address_t client_address; +- grub_efi_status_t (*dhcp4_callback) ( ++ grub_efi_status_t (__grub_efi_api *dhcp4_callback) ( + grub_efi_dhcp4_protocol_t *this, + void *context, + grub_efi_dhcp4_state_t current_state, +@@ -153,27 +153,27 @@ struct grub_efi_dhcp4_mode_data { + typedef struct grub_efi_dhcp4_mode_data grub_efi_dhcp4_mode_data_t; + + struct grub_efi_dhcp4_protocol { +- grub_efi_status_t (*get_mode_data) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *get_mode_data) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_mode_data_t *dhcp4_mode_data); +- grub_efi_status_t (*configure) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *configure) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_config_data_t *dhcp4_cfg_data); +- grub_efi_status_t (*start) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *start) (grub_efi_dhcp4_protocol_t *this, + grub_efi_event_t completion_event); +- grub_efi_status_t (*renew_rebind) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *renew_rebind) (grub_efi_dhcp4_protocol_t *this, + grub_efi_boolean_t rebind_request, + grub_efi_event_t completion_event); +- grub_efi_status_t (*release) (grub_efi_dhcp4_protocol_t *this); +- grub_efi_status_t (*stop) (grub_efi_dhcp4_protocol_t *this); +- grub_efi_status_t (*build) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *release) (grub_efi_dhcp4_protocol_t *this); ++ grub_efi_status_t (__grub_efi_api *stop) (grub_efi_dhcp4_protocol_t *this); ++ grub_efi_status_t (__grub_efi_api *build) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_packet_t *seed_packet, + grub_efi_uint32_t delete_count, + grub_efi_uint8_t *delete_list, + grub_efi_uint32_t append_count, + grub_efi_dhcp4_packet_option_t *append_list[], + grub_efi_dhcp4_packet_t **new_packet); +- grub_efi_status_t (*transmit_receive) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *transmit_receive) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_transmit_receive_token_t *token); +- grub_efi_status_t (*parse) (grub_efi_dhcp4_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *parse) (grub_efi_dhcp4_protocol_t *this, + grub_efi_dhcp4_packet_t *packet, + grub_efi_uint32_t *option_count, + grub_efi_dhcp4_packet_option_t *packet_option_list[]); +@@ -289,7 +289,7 @@ struct grub_efi_dhcp6_mode_data { + typedef struct grub_efi_dhcp6_mode_data grub_efi_dhcp6_mode_data_t; + + struct grub_efi_dhcp6_config_data { +- grub_efi_status_t (*dhcp6_callback) (grub_efi_dhcp6_protocol_t this, ++ grub_efi_status_t (__grub_efi_api *dhcp6_callback) (grub_efi_dhcp6_protocol_t this, + void *context, + grub_efi_dhcp6_state_t current_state, + grub_efi_dhcp6_event_t dhcp6_event, +@@ -308,33 +308,33 @@ struct grub_efi_dhcp6_config_data { + typedef struct grub_efi_dhcp6_config_data grub_efi_dhcp6_config_data_t; + + struct grub_efi_dhcp6_protocol { +- grub_efi_status_t (*get_mode_data) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *get_mode_data) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_mode_data_t *dhcp6_mode_data, + grub_efi_dhcp6_config_data_t *dhcp6_config_data); +- grub_efi_status_t (*configure) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *configure) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_config_data_t *dhcp6_cfg_data); +- grub_efi_status_t (*start) (grub_efi_dhcp6_protocol_t *this); +- grub_efi_status_t (*info_request) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *start) (grub_efi_dhcp6_protocol_t *this); ++ grub_efi_status_t (__grub_efi_api *info_request) (grub_efi_dhcp6_protocol_t *this, + grub_efi_boolean_t send_client_id, + grub_efi_dhcp6_packet_option_t *option_request, + grub_efi_uint32_t option_count, + grub_efi_dhcp6_packet_option_t *option_list[], + grub_efi_dhcp6_retransmission_t *retransmission, + grub_efi_event_t timeout_event, +- grub_efi_status_t (*reply_callback) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *reply_callback) (grub_efi_dhcp6_protocol_t *this, + void *context, + grub_efi_dhcp6_packet_t *packet), + void *callback_context); +- grub_efi_status_t (*renew_rebind) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *renew_rebind) (grub_efi_dhcp6_protocol_t *this, + grub_efi_boolean_t rebind_request); +- grub_efi_status_t (*decline) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *decline) (grub_efi_dhcp6_protocol_t *this, + grub_efi_uint32_t address_count, + grub_efi_ipv6_address_t *addresses); +- grub_efi_status_t (*release) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *release) (grub_efi_dhcp6_protocol_t *this, + grub_efi_uint32_t address_count, + grub_efi_ipv6_address_t *addresses); +- grub_efi_status_t (*stop) (grub_efi_dhcp6_protocol_t *this); +- grub_efi_status_t (*parse) (grub_efi_dhcp6_protocol_t *this, ++ grub_efi_status_t (__grub_efi_api *stop) (grub_efi_dhcp6_protocol_t *this); ++ grub_efi_status_t (__grub_efi_api *parse) (grub_efi_dhcp6_protocol_t *this, + grub_efi_dhcp6_packet_t *packet, + grub_efi_uint32_t *option_count, + grub_efi_dhcp6_packet_option_t *packet_option_list[]); +diff --git a/include/grub/efi/edid.h b/include/grub/efi/edid.h +index 43c0c4372f7..ac1b8e2fdac 100644 +--- a/include/grub/efi/edid.h ++++ b/include/grub/efi/edid.h +@@ -33,7 +33,7 @@ + struct grub_efi_edid_override; + + typedef grub_efi_status_t +-(*grub_efi_edid_override_get_edid) (struct grub_efi_edid_override *this, ++(__grub_efi_api *grub_efi_edid_override_get_edid) (struct grub_efi_edid_override *this, + grub_efi_handle_t *childhandle, + grub_efi_uint32_t *attributes, + grub_efi_uintn_t *edidsize, +diff --git a/include/grub/efi/http.h b/include/grub/efi/http.h +index ad164ba1913..242d001b624 100644 +--- a/include/grub/efi/http.h ++++ b/include/grub/efi/http.h +@@ -188,27 +188,27 @@ typedef struct { + + struct grub_efi_http { + grub_efi_status_t +- (*get_mode_data) (struct grub_efi_http *this, ++ (__grub_efi_api *get_mode_data) (struct grub_efi_http *this, + grub_efi_http_config_data_t *http_config_data); + + grub_efi_status_t +- (*configure) (struct grub_efi_http *this, ++ (__grub_efi_api *configure) (struct grub_efi_http *this, + grub_efi_http_config_data_t *http_config_data); + + grub_efi_status_t +- (*request) (struct grub_efi_http *this, ++ (__grub_efi_api *request) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t +- (*cancel) (struct grub_efi_http *this, ++ (__grub_efi_api *cancel) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t +- (*response) (struct grub_efi_http *this, ++ (__grub_efi_api *response) (struct grub_efi_http *this, + grub_efi_http_token_t *token); + + grub_efi_status_t +- (*poll) (struct grub_efi_http *this); ++ (__grub_efi_api *poll) (struct grub_efi_http *this); + }; + typedef struct grub_efi_http grub_efi_http_t; + +diff --git a/include/grub/efi/pci.h b/include/grub/efi/pci.h +index b17245549f5..a90f6104228 100644 +--- a/include/grub/efi/pci.h ++++ b/include/grub/efi/pci.h +@@ -48,7 +48,7 @@ typedef enum + struct grub_efi_pci_io; + + typedef grub_efi_status_t +-(*grub_efi_pci_io_mem_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_mem_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint8_t bar_index, + grub_efi_uint64_t offset, +@@ -56,7 +56,7 @@ typedef grub_efi_status_t + void *buffer); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_config_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_config_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint32_t offset, + grub_efi_uintn_t count, +@@ -113,7 +113,7 @@ typedef enum + grub_efi_pci_io_attribute_operation_t; + + typedef grub_efi_status_t +-(*grub_efi_pci_io_poll_io_mem_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_poll_io_mem_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint8_t bar_ndex, + grub_efi_uint64_t offset, +@@ -123,7 +123,7 @@ typedef grub_efi_status_t + grub_efi_uint64_t *result); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_copy_mem_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_copy_mem_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint8_t dest_bar_index, + grub_efi_uint64_t dest_offset, +@@ -132,7 +132,7 @@ typedef grub_efi_status_t + grub_efi_uintn_t count); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_map_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_map_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_operation_t operation, + void *host_address, + grub_efi_uintn_t *number_of_bytes, +@@ -140,11 +140,11 @@ typedef grub_efi_status_t + void **mapping); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_unmap_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_unmap_t) (struct grub_efi_pci_io *this, + void *mapping); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_allocate_buffer_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_allocate_buffer_t) (struct grub_efi_pci_io *this, + grub_efi_allocate_type_t type, + grub_efi_memory_type_t memory_type, + grub_efi_uintn_t pages, +@@ -152,7 +152,7 @@ typedef grub_efi_status_t + grub_efi_uint64_t attributes); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_free_buffer_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_free_buffer_t) (struct grub_efi_pci_io *this, + grub_efi_allocate_type_t type, + grub_efi_memory_type_t memory_type, + grub_efi_uintn_t pages, +@@ -160,29 +160,29 @@ typedef grub_efi_status_t + grub_efi_uint64_t attributes); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_flush_t) (struct grub_efi_pci_io *this); ++(__grub_efi_api *grub_efi_pci_io_flush_t) (struct grub_efi_pci_io *this); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_get_location_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_get_location_t) (struct grub_efi_pci_io *this, + grub_efi_uintn_t *segment_number, + grub_efi_uintn_t *bus_number, + grub_efi_uintn_t *device_number, + grub_efi_uintn_t *function_number); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_attributes_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_attributes_t) (struct grub_efi_pci_io *this, + grub_efi_pci_io_attribute_operation_t operation, + grub_efi_uint64_t attributes, + grub_efi_uint64_t *result); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_get_bar_attributes_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_get_bar_attributes_t) (struct grub_efi_pci_io *this, + grub_efi_uint8_t bar_index, + grub_efi_uint64_t *supports, + void **resources); + + typedef grub_efi_status_t +-(*grub_efi_pci_io_set_bar_attributes_t) (struct grub_efi_pci_io *this, ++(__grub_efi_api *grub_efi_pci_io_set_bar_attributes_t) (struct grub_efi_pci_io *this, + grub_efi_uint64_t attributes, + grub_efi_uint8_t bar_index, + grub_efi_uint64_t *offset, +@@ -212,12 +212,12 @@ struct grub_efi_pci_root_io; + + typedef struct + { +- grub_efi_status_t(*read) (struct grub_efi_pci_root_io *this, ++ grub_efi_status_t(__grub_efi_api *read) (struct grub_efi_pci_root_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint64_t address, + grub_efi_uintn_t count, + void *buffer); +- grub_efi_status_t(*write) (struct grub_efi_pci_root_io *this, ++ grub_efi_status_t(__grub_efi_api *write) (struct grub_efi_pci_root_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint64_t address, + grub_efi_uintn_t count, +@@ -237,7 +237,7 @@ typedef enum + grub_efi_pci_root_io_operation_t; + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_poll_io_mem_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_poll_io_mem_t) (struct grub_efi_pci_root_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint64_t address, + grub_efi_uint64_t mask, +@@ -246,7 +246,7 @@ typedef grub_efi_status_t + grub_efi_uint64_t *result); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_copy_mem_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_copy_mem_t) (struct grub_efi_pci_root_io *this, + grub_efi_pci_io_width_t width, + grub_efi_uint64_t dest_offset, + grub_efi_uint64_t src_offset, +@@ -254,7 +254,7 @@ typedef grub_efi_status_t + + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_map_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_map_t) (struct grub_efi_pci_root_io *this, + grub_efi_pci_root_io_operation_t operation, + void *host_address, + grub_efi_uintn_t *number_of_bytes, +@@ -262,11 +262,11 @@ typedef grub_efi_status_t + void **mapping); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_unmap_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_unmap_t) (struct grub_efi_pci_root_io *this, + void *mapping); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_allocate_buffer_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_allocate_buffer_t) (struct grub_efi_pci_root_io *this, + grub_efi_allocate_type_t type, + grub_efi_memory_type_t memory_type, + grub_efi_uintn_t pages, +@@ -274,26 +274,26 @@ typedef grub_efi_status_t + grub_efi_uint64_t attributes); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_free_buffer_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_free_buffer_t) (struct grub_efi_pci_root_io *this, + grub_efi_uintn_t pages, + void **host_address); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_flush_t) (struct grub_efi_pci_root_io *this); ++(__grub_efi_api *grub_efi_pci_root_io_flush_t) (struct grub_efi_pci_root_io *this); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_get_attributes_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_get_attributes_t) (struct grub_efi_pci_root_io *this, + grub_efi_uint64_t *supports, + void **resources); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_set_attributes_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_set_attributes_t) (struct grub_efi_pci_root_io *this, + grub_efi_uint64_t attributes, + grub_efi_uint64_t *offset, + grub_efi_uint64_t *length); + + typedef grub_efi_status_t +-(*grub_efi_pci_root_io_configuration_t) (struct grub_efi_pci_root_io *this, ++(__grub_efi_api *grub_efi_pci_root_io_configuration_t) (struct grub_efi_pci_root_io *this, + void **resources); + + struct grub_efi_pci_root_io { diff --git a/0274-grub-core-net-arp.c-fix-variable-name.patch b/0274-grub-core-net-arp.c-fix-variable-name.patch new file mode 100644 index 0000000..f1f26ba --- /dev/null +++ b/0274-grub-core-net-arp.c-fix-variable-name.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 28 Aug 2024 13:37:42 -0600 +Subject: [PATCH] grub-core/net/arp.c: fix variable name + +Signed-off-by: Leo Sandoval +--- + grub-core/net/arp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/net/arp.c b/grub-core/net/arp.c +index 8bf0a06e193..7adeb7447b4 100644 +--- a/grub-core/net/arp.c ++++ b/grub-core/net/arp.c +@@ -159,7 +159,7 @@ grub_net_arp_receive (struct grub_net_buff *nb, struct grub_net_card *card, + sender_addr.option = 0; + target_addr.option = 0; + +- grub_memcpy(&target_addr.ipv4, tmp_ptr, pln); ++ grub_memcpy(&sender_addr.ipv4, tmp_ptr, pln); + tmp_ptr += pln; + + grub_net_link_layer_add_address (card, &sender_addr, &sender_mac_addr, 1); diff --git a/0275-load-EFI-commands-inside-test-expressions.patch b/0275-load-EFI-commands-inside-test-expressions.patch new file mode 100644 index 0000000..ce74316 --- /dev/null +++ b/0275-load-EFI-commands-inside-test-expressions.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 4 Sep 2024 13:25:23 -0600 +Subject: [PATCH] load EFI commands inside test expressions + +These two commands may fail interrumping the normal boot process, +so placing these inside test expressions is a safer approach. + +Resolves: #2305291 +Suggested-by: Kan-Ru Chen: +Signed-off-by: Leo Sandoval +--- + util/grub.d/25_bli.in | 4 +++- + util/grub.d/30_uefi-firmware.in | 3 +-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/util/grub.d/25_bli.in b/util/grub.d/25_bli.in +index 26e27a01975..00a8d7159c0 100644 +--- a/util/grub.d/25_bli.in ++++ b/util/grub.d/25_bli.in +@@ -19,6 +19,8 @@ set -e + + cat << EOF + if [ "\$grub_platform" = "efi" ]; then +- insmod bli ++ if [ ! insmod bli ]; then ++ echo "bli module not available" ++ fi + fi + EOF +diff --git a/util/grub.d/30_uefi-firmware.in b/util/grub.d/30_uefi-firmware.in +index 1c2365ddbd3..1ef31e08f6b 100644 +--- a/util/grub.d/30_uefi-firmware.in ++++ b/util/grub.d/30_uefi-firmware.in +@@ -32,8 +32,7 @@ gettext_printf "Adding boot menu entry for UEFI Firmware Settings ...\n" >&2 + + cat << EOF + if [ "\$grub_platform" = "efi" ]; then +- fwsetup --is-supported +- if [ "\$?" = 0 ]; then ++ if [ fwsetup --is-supported ]; then + menuentry '$LABEL' \$menuentry_id_option 'uefi-firmware' { + fwsetup + } diff --git a/0276-efi-loader-Check-if-NX-is-required-in-grub_efi_linux.patch b/0276-efi-loader-Check-if-NX-is-required-in-grub_efi_linux.patch new file mode 100644 index 0000000..88d6765 --- /dev/null +++ b/0276-efi-loader-Check-if-NX-is-required-in-grub_efi_linux.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 25 Sep 2024 17:23:33 +0200 +Subject: [PATCH] efi/loader: Check if NX is required in grub_efi_linux_boot() + +Call grub_efi_check_nx_required() passing it nx_required to +assign the correct value + +Signed-off-by: Nicolas Frayer +--- + grub-core/loader/efi/linux.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 0d1804b602d..5889e3f36f8 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -236,6 +236,7 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, + grub_dprintf ("linux", "kernel_address: %p handover_offset: %p params: %p\n", + (void *)k_address, (void *)h_offset, k_params); + ++ grub_efi_check_nx_required(&nx_required); + + if (nx_required && !nx_supported) + return grub_error (GRUB_ERR_BAD_OS, N_("kernel does not support NX loading required by policy")); diff --git a/0277-Stop-grub.efi-from-always-printing-dynamic_load_symb.patch b/0277-Stop-grub.efi-from-always-printing-dynamic_load_symb.patch new file mode 100644 index 0000000..44e7790 --- /dev/null +++ b/0277-Stop-grub.efi-from-always-printing-dynamic_load_symb.patch @@ -0,0 +1,80 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 3 Oct 2024 12:26:07 +0200 +Subject: [PATCH] Stop grub.efi from always printing "dynamic_load_symbols + %p\n" during boot + +Commit 972aa68d2bf5 ("Make a "gdb" dprintf that tells us load addresses.") +added some debug prints to help with running gdb against grub. + +Besides adding a new grub_dl_print_gdb_info () function which uses +`grub_qdprintf ("gdb", ...);` it also adds a new grub_efi_print_gdb_info () +call to grub_efi_init (). + +grub_efi_print_gdb_info () is intended for the gdbinfo command and uses +a non debug grub_printf () call leading to grub now always printing this +message during boot breaking flicker-free boot. + +Add a new "debug" parameter to grub_efi_print_gdb_info () and use +`grub_qdprintf ("gdb", ...);` when this is set to silence the printing +done from grub_efi_init () when debugging is not enabled. + +Fixes: 972aa68d2bf5 ("Make a "gdb" dprintf that tells us load addresses.") +Signed-off-by: Hans de Goede +--- + grub-core/kern/efi/debug.c | 2 +- + grub-core/kern/efi/init.c | 2 +- + include/grub/efi/debug.h | 7 +++++-- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/grub-core/kern/efi/debug.c b/grub-core/kern/efi/debug.c +index 5d2ab1a36ff..5ac194fc8f4 100644 +--- a/grub-core/kern/efi/debug.c ++++ b/grub-core/kern/efi/debug.c +@@ -26,7 +26,7 @@ grub_cmd_gdbinfo (struct grub_command *cmd __attribute__ ((unused)), + int argc __attribute__ ((unused)), + char **args __attribute__ ((unused))) + { +- grub_efi_print_gdb_info (); ++ grub_efi_print_gdb_info (false); + return 0; + } + +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index d35d6974734..ce8a7fe7122 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -157,7 +157,7 @@ grub_efi_init (void) + grub_efi_system_table->boot_services->set_watchdog_timer (0, 0, 0, NULL); + + grub_efi_env_init (); +- grub_efi_print_gdb_info (); ++ grub_efi_print_gdb_info (true); + grub_efidisk_init (); + + grub_efi_register_debug_commands (); +diff --git a/include/grub/efi/debug.h b/include/grub/efi/debug.h +index c2d2a03b06f..961e591afa3 100644 +--- a/include/grub/efi/debug.h ++++ b/include/grub/efi/debug.h +@@ -27,7 +27,7 @@ + void grub_efi_register_debug_commands (void); + + static inline void +-grub_efi_print_gdb_info (void) ++grub_efi_print_gdb_info (bool debug) + { + grub_addr_t text; + +@@ -35,7 +35,10 @@ grub_efi_print_gdb_info (void) + if (!text) + return; + +- grub_printf ("dynamic_load_symbols %p\n", (void *)text); ++ if (debug) ++ grub_qdprintf ("gdb", "dynamic_load_symbols %p\n", (void *)text); ++ else ++ grub_printf ("dynamic_load_symbols %p\n", (void *)text); + } + + #endif /* ! GRUB_EFI_DEBUG_HEADER */ diff --git a/0277-disk-cryptodisk-Allow-user-to-retry-failed-passphras.patch b/0277-disk-cryptodisk-Allow-user-to-retry-failed-passphras.patch deleted file mode 100644 index a7d1292..0000000 --- a/0277-disk-cryptodisk-Allow-user-to-retry-failed-passphras.patch +++ /dev/null @@ -1,151 +0,0 @@ -From a06c236183511b5de86f35b4df8686cc15a4243a Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Thu, 26 Dec 2024 17:44:40 +0800 -Subject: [PATCH 1/4] disk/cryptodisk: Allow user to retry failed passphrase - -Give the user a chance to re-enter their cryptodisk passphrase after a typo, -rather than immediately failing (and likely dumping them into a GRUB shell). - -By default, we allow 3 tries before giving up. A value in the -cryptodisk_passphrase_tries environment variable will override this default. - -The user can give up early by entering an empty passphrase, just as they -could before this patch. - -Signed-off-by: Forest -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 8 +++++ - grub-core/disk/cryptodisk.c | 71 +++++++++++++++++++++++++++---------- - 2 files changed, 61 insertions(+), 18 deletions(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 0addf2b90..de03d5a97 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -3285,6 +3285,7 @@ These variables have special meaning to GRUB. - * color_normal:: - * config_directory:: - * config_file:: -+* cryptodisk_passphrase_tries:: - * debug:: - * default:: - * fallback:: -@@ -3457,6 +3458,13 @@ processed by commands @command{configfile} (@pxref{configfile}) or @command{norm - (@pxref{normal}). It is restored to the previous value when command completes. - - -+@node cryptodisk_passphrase_tries -+@subsection cryptodisk_passphrase_tries -+When prompting the user for a cryptodisk passphrase, allow this many attempts -+before giving up. Defaults to @samp{3} if unset or set to an invalid value. -+(The user can give up early by entering an empty passphrase.) -+ -+ - @node debug - @subsection debug - -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index b62fc02b7..1fcd001b1 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -17,6 +17,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -1202,7 +1203,12 @@ grub_cryptodisk_scan_device_real (const char *name, - grub_free (part); - } - -- if (!cargs->key_len) -+ if (cargs->key_len) { -+ ret = cr->recover_key (source, dev, cargs); -+ if (ret != GRUB_ERR_NONE) -+ goto error; -+ } -+ else - { - if (grub_errno) - { -@@ -1211,28 +1217,57 @@ grub_cryptodisk_scan_device_real (const char *name, - } - - /* Get the passphrase from the user, if no key data. */ -- askpass = 1; -- part = grub_partition_get_name (source->partition); -- grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, -- source->partition != NULL ? "," : "", -- part != NULL ? part : N_("UNKNOWN"), dev->uuid); -- grub_free (part); -+ unsigned long tries = 3; -+ const char *tries_env; - -+ askpass = 1; - cargs->key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); - if (cargs->key_data == NULL) -- goto error; -+ goto error_no_close; - -- if (!grub_password_get ((char *) cargs->key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) -- { -- grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); -- goto error; -- } -- cargs->key_len = grub_strlen ((char *) cargs->key_data); -- } -+ tries_env = grub_env_get ("cryptodisk_passphrase_tries"); -+ if (tries_env != NULL && tries_env[0] != '\0') -+ { -+ unsigned long tries_env_val; -+ const char *p; -+ tries_env_val = grub_strtoul (tries_env, &p, 0); -+ if (*p == '\0' && tries_env_val != ~0UL) -+ tries = tries_env_val; -+ else -+ grub_printf_ (N_("Invalid cryptodisk_passphrase_tries value `%s'. Defaulting to %lu.\n"), -+ tries_env, -+ tries); -+ } - -- ret = cr->recover_key (source, dev, cargs); -- if (ret != GRUB_ERR_NONE) -- goto error; -+ for (; tries > 0; tries--) -+ { -+ part = grub_partition_get_name (source->partition); -+ grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, -+ source->partition != NULL ? "," : "", -+ part != NULL ? part : N_("UNKNOWN"), -+ dev->uuid); -+ grub_free (part); -+ if (!grub_password_get ((char *) cargs->key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) -+ { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); -+ goto error; -+ } -+ cargs->key_len = grub_strlen ((char *) cargs->key_data); -+ ret = cr->recover_key (source, dev, cargs); -+ if (ret == GRUB_ERR_NONE) -+ break; -+ if (ret != GRUB_ERR_ACCESS_DENIED || tries == 1) -+ goto error; -+ grub_puts_ (N_("Invalid passphrase.")); -+ /* -+ * Since recover_key() calls a function that returns grub_errno, -+ * a leftover error value from a previously rejected passphrase -+ * will trigger a phantom failure. We therefore clear it before -+ * trying a new passphrase. -+ */ -+ grub_errno = GRUB_ERR_NONE; -+ } -+ } - - ret = grub_cryptodisk_insert (dev, name, source); - if (ret != GRUB_ERR_NONE) --- -2.41.1 - diff --git a/0278-efi-console-Properly-clear-leftover-artifacts-from-t.patch b/0278-efi-console-Properly-clear-leftover-artifacts-from-t.patch deleted file mode 100644 index b3063f1..0000000 --- a/0278-efi-console-Properly-clear-leftover-artifacts-from-t.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 69bc6e967c6f4685c1c00eb403b394adf998e086 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Thu, 26 Dec 2024 19:12:51 +0800 -Subject: [PATCH 2/4] efi/console: Properly clear leftover artifacts from the - screen - -A regression in GRUB 2.12 causes the GRUB screen to become cluttered -with artifacts from the previous screen whether it's the UEFI post UI, -UEFI shell or any graphical UI running before GRUB. This issue occurs -in situations like booting GRUB from the UEFI shell and going straight -to the rescue or command shell causing visual discomfort. - -The regression was introduced by commit 2d7c3ab (efi/console: Do not -set text-mode until it is actually needed). To address the screen -flickering issue this commit suppresses the text-mode setting until the -first output is requested. Before text-mode is set any attempt to clear -the screen has no effect. This inactive period renders the clear screen -ineffective in early boot stages, potentially leaving leftover artifacts -that will clutter the GRUB console display, as there is no guarantee -there will always be a clear screen after the first output. - -The issue is fixed by ensuring grub_console_cls() to work through lazy -mode-setting, while also avoiding screen clearing for the hidden menu -which the flicker-free patch aims to improve. - -Fixes: 2d7c3ab (efi/console: Do not set text-mode until we actually need it) - -Signed-off-by: Michael Chang -Reviewed-by: Daniel Kiper ---- - grub-core/normal/menu.c | 7 ++++--- - grub-core/term/efi/console.c | 2 +- - 2 files changed, 5 insertions(+), 4 deletions(-) - -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 23293b5ce..4ba650b8a 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -974,13 +974,14 @@ show_menu (grub_menu_t menu, int nested, int autobooted) - if (! e) - continue; /* Menu is empty. */ - -- grub_cls (); -- - if (auto_boot) - grub_menu_execute_with_fallback (menu, e, autobooted, - &execution_callback, ¬ify_boot); - else -- grub_menu_execute_entry (e, 0); -+ { -+ grub_cls (); -+ grub_menu_execute_entry (e, 0); -+ } - if (autobooted) - break; - } -diff --git a/grub-core/term/efi/console.c b/grub-core/term/efi/console.c -index bb587f39d..258b52737 100644 ---- a/grub-core/term/efi/console.c -+++ b/grub-core/term/efi/console.c -@@ -432,7 +432,7 @@ grub_console_cls (struct grub_term_output *term __attribute__ ((unused))) - grub_efi_simple_text_output_interface_t *o; - grub_efi_int32_t orig_attr; - -- if (grub_efi_is_finished || text_mode != GRUB_TEXT_MODE_AVAILABLE) -+ if (grub_prepare_for_text_output (term) != GRUB_ERR_NONE) - return; - - o = grub_efi_system_table->con_out; --- -2.41.1 - diff --git a/0278-linuxefi-Invalidate-i-cache-before-starting-the-kern.patch b/0278-linuxefi-Invalidate-i-cache-before-starting-the-kern.patch new file mode 100644 index 0000000..f837dff --- /dev/null +++ b/0278-linuxefi-Invalidate-i-cache-before-starting-the-kern.patch @@ -0,0 +1,39 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: dann frazier +Date: Thu, 25 Aug 2022 17:08:09 -0600 +Subject: [PATCH] linuxefi: Invalidate i-cache before starting the kernel + +We need to flush the memory range of the code we are about to execute +from the instruction cache before we can safely execute it. Not doing +so appears to be the source of rare synchronous exceptions a user +is seeing on a Cortex-A72-based platform while executing the Linux EFI +stub. Notably they seem to correlate with an instruction on a cache +line boundary. + +Signed-off-by: dann frazier +--- + grub-core/loader/efi/linux.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 5889e3f36f8..21a6298b087 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -16,6 +16,7 @@ + * along with GRUB. If not, see . + */ + ++#include + #include + #include + #include +@@ -281,6 +282,9 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, + asm volatile ("cli"); + #endif + ++ /* Invalidate the instruction cache */ ++ grub_arch_sync_caches((void *)kernel_addr, kernel_size); ++ + hf = (handover_func)((char *)k_address + h_offset + offset); + hf (grub_efi_image_handle, grub_efi_system_table, k_params); + diff --git a/0279-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch b/0279-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch new file mode 100644 index 0000000..226b845 --- /dev/null +++ b/0279-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch @@ -0,0 +1,72 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Mon, 17 Jul 2023 16:03:39 -0400 +Subject: [PATCH] grub-mkconfig dont overwrite BLS cmdline if BLSCFG + +If GRUB_ENABLE_BLSCFG is true, running grub2-mkconfig will not +overwrite kernel cmdline in BLS snippets with what is in +GRUB_CMDLINE_LINUX in /etc/default/grub. Update can be forced by +sending new arg --update-bls-cmdline, thus decoupling cmdline +updates from updates of other parameters. GRUB_GRUBENV_UPDATE +remains 'yes' by default. + +Signed-off-by: mkl +--- + util/grub-mkconfig.in | 9 +++++++++ + util/grub.d/10_linux.in | 2 +- + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index 1cfb5873ff2..b043a19c12e 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -51,6 +51,7 @@ export TEXTDOMAIN=@PACKAGE@ + export TEXTDOMAINDIR="@localedir@" + + export GRUB_GRUBENV_UPDATE="yes" ++export GRUB_UPDATE_BLS_CMDLINE="yes" + + . "${pkgdatadir}/grub-mkconfig_lib" + +@@ -62,6 +63,7 @@ usage () { + echo + print_option_help "-o, --output=$(gettext FILE)" "$(gettext "output generated config to FILE [default=stdout]")" + print_option_help "--no-grubenv-update" "$(gettext "do not update variables in the grubenv file")" ++ print_option_help "--update-bls-cmdline" "$(gettext "overwrite BLS cmdline args with default args")" + print_option_help "-h, --help" "$(gettext "print this message and exit")" + print_option_help "-V, --version" "$(gettext "print the version information and exit")" + echo +@@ -100,6 +102,9 @@ do + --no-grubenv-update) + GRUB_GRUBENV_UPDATE="no" + ;; ++ --update-bls-cmdline) ++ bls_cmdline_update=true ++ ;; + -*) + gettext_printf "Unrecognized option \`%s'\n" "$option" 1>&2 + usage +@@ -175,6 +180,10 @@ fi + + eval "$("${grub_get_kernel_settings}")" || true + ++if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ] && [ "x${bls_cmdline_update}" != "xtrue" ]; then ++ GRUB_UPDATE_BLS_CMDLINE="no" ++fi ++ + if [ "x${GRUB_DISABLE_UUID}" = "xtrue" ]; then + if [ -z "${GRUB_DISABLE_LINUX_UUID}" ]; then + GRUB_DISABLE_LINUX_UUID="true" +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 11c19304f8b..c258aa3cd81 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -267,7 +267,7 @@ if [ -z "\${kernelopts}" ]; then + fi + EOF + +- if [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ]; then ++ if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ]; then + update_bls_cmdline + fi + diff --git a/0280-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch b/0280-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch new file mode 100644 index 0000000..41b78cc --- /dev/null +++ b/0280-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Mon, 27 May 2024 13:03:32 -0600 +Subject: [PATCH] grub2-mkconfig: Pass all boot params when used by anaconda + +Previous patch makes it so that the machine can boot, but not all +boot params are passed from /etc/default/grub to BLS snippets +because /etc/default/grub gets written by anaconda during boot +loader installation, long after grub rpms first got installed. + +Signed-off-by: Marta Lewandowska +--- + util/grub.d/10_linux.in | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index c258aa3cd81..7cf37e9ea68 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -267,7 +267,11 @@ if [ -z "\${kernelopts}" ]; then + fi + EOF + +- if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ]; then ++ if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ] || [[ -d /run/install ]]; then ++ # only update the bls cmdline if the user specifically requests it or _anytime_ ++ # in the installer environment: /run/install directory only exists during the ++ # installation and not in cloud images, so this should get all the boot params ++ # from /etc/default/grub into BLS snippets + update_bls_cmdline + fi + diff --git a/0281-10_linux.in-escape-semicolon-and-ampersand-on-BLS-up.patch b/0281-10_linux.in-escape-semicolon-and-ampersand-on-BLS-up.patch new file mode 100644 index 0000000..cbb1ffe --- /dev/null +++ b/0281-10_linux.in-escape-semicolon-and-ampersand-on-BLS-up.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Thu, 21 Nov 2024 11:32:18 -0600 +Subject: [PATCH] 10_linux.in: escape semicolon and ampersand on BLS upddate + +Besides escaping the character '/', escape ';' and '&' which may be set on on +kernel parameters. + +Resolves: #RHEL-68531 +Signed-off-by: Marta Lewandowska +Reviewed-by: Leo Sandoval +--- + util/grub.d/10_linux.in | 2 ++ + 1 file changed, 2 insertions(+) + mode change 100644 => 100755 util/grub.d/10_linux.in + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +old mode 100644 +new mode 100755 +index 041a11529..7754ef853 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -176,6 +176,8 @@ update_bls_cmdline() + options="${options} ${GRUB_CMDLINE_LINUX_DEBUG}" + fi + options="$(echo "${options}" | sed -e 's/\//\\\//g')" ++ options="$(echo "${options}" | sed -e 's/\;/\\\;/g')" ++ options="$(echo "${options}" | sed -e 's/\\&/\\\\&/g')" + sed -i -e "s/^options.*/options ${options}/" "${blsdir}/${bls}.conf" + done + } diff --git a/0280-kern-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt.patch b/0282-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch similarity index 62% rename from 0280-kern-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt.patch rename to 0282-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch index 9c0e0c3..20d2de3 100644 --- a/0280-kern-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt.patch +++ b/0282-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch @@ -1,8 +1,7 @@ -From 2c43798717ee5af0b666fc49b7b8c1d992563f06 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Thu, 26 Dec 2024 19:24:32 +0800 -Subject: [PATCH 4/4] kern/acpi: Fix out of bounds access in - grub_acpi_xsdt_find_table() +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Wed, 16 Oct 2024 16:20:24 +1100 +Subject: [PATCH] acpi: Fix out of bounds access in grub_acpi_xsdt_find_table() The calculation of the size of the table was incorrect (copy/pasta from grub_acpi_rsdt_find_table() I assume...). The entries are 64-bit long. @@ -11,21 +10,17 @@ This causes us to access beyond the end of the table which is causing crashes during boot on some systems. Typically this is causing a crash on VMWare when using UEFI and enabling serial autodetection, as - grub_acpi_find_table (GRUB_ACPI_SPCR_SIGNATURE); +grub_acpi_find_table (GRUB_ACPI_SPCR_SIGNATURE); -will goes past the end of the table (the SPCR table doesn't exits). +Will goes past the end of the table (the SPCR table doesn't exits) Signed-off-by: Benjamin Herrenschmidt -Reviewed-by: Vladimir Serbinenko -Reviewed-by: Daniel Kiper -Reviewed-by: Ross Philipson -Tested-by: Renata Ravanelli --- grub-core/kern/acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/kern/acpi.c b/grub-core/kern/acpi.c -index 48ded4e2e..8ff0835d5 100644 +index 48ded4e2ea6e..8ff0835d501f 100644 --- a/grub-core/kern/acpi.c +++ b/grub-core/kern/acpi.c @@ -75,7 +75,7 @@ grub_acpi_xsdt_find_table (struct grub_acpi_table_header *xsdt, const char *sig) @@ -37,6 +32,3 @@ index 48ded4e2e..8ff0835d5 100644 for (; s; s--, ptr++) { struct grub_acpi_table_header *tbl; --- -2.41.1 - diff --git a/0283-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch b/0283-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch similarity index 67% rename from 0283-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch rename to 0283-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch index 8f6aca3..ba64163 100644 --- a/0283-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch +++ b/0283-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch @@ -1,8 +1,7 @@ -From f2e18547d81a4e5946132340e5e73efe23b81671 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Wed, 4 Dec 2024 07:50:28 -0600 -Subject: [PATCH 1/2] fs/xfs: fix large extent counters incompat feature - support +Subject: [PATCH] fs/xfs: fix large extent counters incompat feature support When large extent counter / NREXT64 support was added to grub, it missed a couple of direct reads of nextents which need to be changed to the new @@ -18,22 +17,23 @@ Signed-off-by: Eric Sandeen Reviewed-by: Anthony Iliopoulos Reviewed-by: Jon DeVree --- - grub-core/fs/xfs.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) + grub-core/fs/xfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c -index ed0c8e9..244f0e0 100644 +index 8e02ab4a3014..92046f9bdf49 100644 --- a/grub-core/fs/xfs.c +++ b/grub-core/fs/xfs.c -@@ -945,6 +945,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, +@@ -926,7 +926,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + * Leaf and tail information are only in the data block if the number * of extents is 1. */ - if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) +- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) + if (grub_xfs_get_inode_nextents(&dir->inode) == 1) { - end = (char *) tail; + struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); -@@ -996,7 +997,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, +@@ -980,7 +980,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, * The expected number of directory entries is only tracked for the * single extent case. */ @@ -42,6 +42,3 @@ index ed0c8e9..244f0e0 100644 { /* Check if last direntry in this block is reached. */ entries--; --- -2.43.5 - diff --git a/0284-term-ns8250-spcr-return-if-redirection-is-disabled.patch b/0284-term-ns8250-spcr-return-if-redirection-is-disabled.patch new file mode 100644 index 0000000..f700322 --- /dev/null +++ b/0284-term-ns8250-spcr-return-if-redirection-is-disabled.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Thu, 16 Jan 2025 10:22:48 -0600 +Subject: [PATCH] term/ns8250-spcr: return if redirection is disabled + +The Microsoft spec for SPCR says "The base address of the Serial Port register +set described using the ACPI Generic Address Structure, or 0 if console +redirection is disabled." so return if disable (base address = 0). If this check +is not done, we may get invalid ports for those particular machines that +redirection is disabled and at some point hanging the booting execution when +reading the grub.cfg configuration file. + +Signed-off-by: Benjamin Herrenschmidt +Reviewed-by: Leo Sandoval +--- + grub-core/term/ns8250-spcr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/term/ns8250-spcr.c b/grub-core/term/ns8250-spcr.c +index d52b52c26..86f1aa078 100644 +--- a/grub-core/term/ns8250-spcr.c ++++ b/grub-core/term/ns8250-spcr.c +@@ -75,6 +75,11 @@ grub_ns8250_spcr_init (void) + config.speed = 115200; + break; + }; ++ ++ /* if base address is 0, it means redirection is disable, so return it */ ++ if (spcr->base_addr.addr == 0) ++ return NULL; ++ + switch (spcr->base_addr.space_id) + { + case GRUB_ACPI_GENADDR_MEM_SPACE: + diff --git a/0285-commands-legacycfg-Avoid-closing-file-twice.patch b/0285-commands-legacycfg-Avoid-closing-file-twice.patch new file mode 100644 index 0000000..2e126ab --- /dev/null +++ b/0285-commands-legacycfg-Avoid-closing-file-twice.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 16 Oct 2024 11:54:38 -0600 +Subject: [PATCH] commands/legacycfg: Avoid closing file twice + +An internal (at Red Hat) static soure code scan detected an +use-after-free scenario: + + Error: USE_AFTER_FREE (CWE-416): + grub-2.06/grub-core/commands/legacycfg.c:194: freed_arg: "grub_file_close" frees "file". + grub-2.06/grub-core/commands/legacycfg.c:201: deref_arg: Calling "grub_file_close" dereferences freed pointer "file". + # 199| if (!args) + # 200| { + # 201|-> grub_file_close (file); + # 202| grub_free (suffix); + # 203| grub_free (entrysrc); + +So, remove the extra file close call. + +Signed-off-by: Leo Sandoval +Reviewed-by: Daniel Kiper +--- + grub-core/commands/legacycfg.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index 2c5d1a0ef..86bcda695 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -198,7 +198,6 @@ legacy_file (const char *filename) + const char **args = grub_malloc (sizeof (args[0])); + if (!args) + { +- grub_file_close (file); + grub_free (suffix); + grub_free (entrysrc); + return grub_errno; diff --git a/0286-disk-ahci.c-remove-conditional-operator-for-endtime.patch b/0286-disk-ahci.c-remove-conditional-operator-for-endtime.patch new file mode 100644 index 0000000..759cd4f --- /dev/null +++ b/0286-disk-ahci.c-remove-conditional-operator-for-endtime.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 22 Jan 2025 13:37:42 -0600 +Subject: [PATCH] disk/ahci.c: remove conditional operator for endtime + +The conditional makes no sense when the two possible expressions have the same +value, so remove it (perhaps the compiler does it for us but better to remove +it). + +Signed-off-by: Leo Sandoval +--- + grub-core/disk/ahci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/disk/ahci.c b/grub-core/disk/ahci.c +index e7b5dc5f2..b247161b9 100644 +--- a/grub-core/disk/ahci.c ++++ b/grub-core/disk/ahci.c +@@ -1038,7 +1038,7 @@ grub_ahci_readwrite_real (struct grub_ahci_device *dev, + grub_dprintf ("ahci", "AHCI tfd = %x\n", + dev->hba->ports[dev->port].task_file_data); + +- endtime = grub_get_time_ms () + (spinup ? 20000 : 20000); ++ endtime = grub_get_time_ms () + 20000; + while ((dev->hba->ports[dev->port].command_issue & 1)) + if (grub_get_time_ms () > endtime || + (dev->hba->ports[dev->port].intstatus & GRUB_AHCI_HBA_PORT_IS_FATAL_MASK)) diff --git a/0304-fs-ntfs-Implement-attribute-verification.patch b/0304-fs-ntfs-Implement-attribute-verification.patch deleted file mode 100644 index 4ee1c39..0000000 --- a/0304-fs-ntfs-Implement-attribute-verification.patch +++ /dev/null @@ -1,245 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: B Horn -Date: Tue, 14 May 2024 12:39:56 +0100 -Subject: [PATCH] fs/ntfs: Implement attribute verification - -It was possible to read OOB when an attribute had a size that exceeded -the allocated buffer. This resolves that by making sure all attributes -that get read are fully in the allocated space by implementing -a function to validate them. - -Defining the offsets in include/grub/ntfs.h but they are only used in -the validation function and not across the rest of the NTFS code. - -Signed-off-by: B Horn -Reviewed-by: Daniel Kiper ---- - grub-core/fs/ntfs.c | 153 ++++++++++++++++++++++++++++++++++++++++++++++++++++ - include/grub/ntfs.h | 22 ++++++++ - 2 files changed, 175 insertions(+) - -diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c -index 1c678f3d0..64f4f2221 100644 ---- a/grub-core/fs/ntfs.c -+++ b/grub-core/fs/ntfs.c -@@ -70,6 +70,149 @@ res_attr_data_len (void *res_attr_ptr) - return u32at (res_attr_ptr, 0x10); - } - -+/* -+ * Check if the attribute is valid and doesn't exceed the allocated region. -+ * This accounts for resident and non-resident data. -+ * -+ * This is based off the documentation from the linux-ntfs project: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+static bool -+validate_attribute (grub_uint8_t *attr, void *end) -+{ -+ grub_size_t attr_size = 0; -+ grub_size_t min_size = 0; -+ grub_size_t spare = (grub_uint8_t *) end - attr; -+ /* -+ * Just used as a temporary variable to try and deal with cases where someone -+ * tries to overlap fields. -+ */ -+ grub_size_t curr = 0; -+ -+ /* Need verify we can entirely read the attributes header. */ -+ if (attr + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) -+ goto fail; -+ -+ /* -+ * So, the rest of this code uses a 16bit int for the attribute length but -+ * from reading the all the documentation I could find it says this field is -+ * actually 32bit. But let's be consistent with the rest of the code. -+ * -+ * https://elixir.bootlin.com/linux/v6.10.7/source/fs/ntfs3/ntfs.h#L370 -+ */ -+ attr_size = u16at (attr, GRUB_NTFS_ATTRIBUTE_LENGTH); -+ -+ if (attr_size > spare) -+ goto fail; -+ -+ /* Not an error case, just reached the end of the attributes. */ -+ if (attr_size == 0) -+ return false; -+ -+ /* -+ * Extra validation by trying to calculate a minimum possible size for this -+ * attribute. +8 from the size of the resident data struct which is the -+ * minimum that can be added. -+ */ -+ min_size = GRUB_NTFS_ATTRIBUTE_HEADER_SIZE + 8; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* Is the data is resident (0) or not (1). */ -+ if (attr[GRUB_NTFS_ATTRIBUTE_RESIDENT] == 0) -+ { -+ /* Read the offset and size of the attribute. */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_RES_OFFSET); -+ curr += u32at (attr, GRUB_NTFS_ATTRIBUTE_RES_LENGTH); -+ if (curr > min_size) -+ min_size = curr; -+ } -+ else -+ { -+ /* -+ * If the data is non-resident, the minimum size is 64 which is where -+ * the data runs start. We already have a minimum size of 24. So, just -+ * adding 40 to get to the real value. -+ */ -+ min_size += 40; -+ if (min_size > attr_size) -+ goto fail; -+ /* If the compression unit size is > 0, +8 bytes*/ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE) > 0) -+ min_size += 8; -+ -+ /* -+ * Need to consider the data runs now. Each member of the run has byte -+ * that describes the size of the data length and offset. Each being -+ * 4 bits in the byte. -+ */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_DATA_RUNS); -+ -+ if (curr + 1 > min_size) -+ min_size = curr + 1; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* -+ * Each attribute can store multiple data runs which are stored -+ * continuously in the attribute. They exist as one header byte -+ * with up to 14 bytes following it depending on the lengths. -+ * We stop when we hit a header that is just a NUL byte. -+ * -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/data_runs.html -+ */ -+ while (attr[curr] != 0) -+ { -+ /* -+ * We stop when we hit a header that is just a NUL byte. The data -+ * run header is stored as a single byte where the top 4 bits refer -+ * to the number of bytes used to store the total length of the -+ * data run, and the number of bytes used to store the offset. -+ * These directly follow the header byte, so we use them to update -+ * the minimum size. -+ */ -+ min_size += (attr[curr] & 0x7) + ((attr[curr] >> 4) & 0x7); -+ curr += min_size; -+ min_size++; -+ if (min_size > attr_size) -+ goto fail; -+ } -+ } -+ -+ /* Name offset, doing this after data residence checks. */ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET) != 0) -+ { -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET); -+ /* -+ * Multiple the name length by 2 as its UTF-16. Can be zero if this in an -+ * unamed attribute. -+ */ -+ curr += attr[GRUB_NTFS_ATTRIBUTE_NAME_LENGTH] * 2; -+ if (curr > min_size) -+ min_size = curr; -+ } -+ -+ /* Padded to 8 bytes. */ -+ if (min_size % 8 != 0) -+ min_size += 8 - (min_size % 8); -+ -+ /* -+ * At this point min_size should be exactly attr_size but being flexible -+ * here to avoid any issues. -+ */ -+ if (min_size > attr_size) -+ goto fail; -+ -+ return true; -+ -+ fail: -+ grub_dprintf ("ntfs", "spare=%" PRIuGRUB_SIZE " min_size=%" PRIuGRUB_SIZE " attr_size=%" PRIuGRUB_SIZE "\n", -+ spare, min_size, attr_size); -+ return false; -+} -+ - /* Return the next attribute if it exists, otherwise return NULL. */ - static grub_uint8_t * - next_attribute (grub_uint8_t *curr_attribute, void *end) -@@ -84,6 +227,8 @@ next_attribute (grub_uint8_t *curr_attribute, void *end) - return NULL; - - next += u16at (curr_attribute, 4); -+ if (validate_attribute (next, end) == false) -+ return NULL; - - return next; - } -@@ -290,6 +435,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - /* From this point on pa_end is the end of the buffer */ - at->end = pa_end; - -+ if (validate_attribute (at->attr_nxt, pa_end) == false) -+ return NULL; -+ - while (at->attr_nxt) - { - if ((*at->attr_nxt == attr) || (attr == 0)) -@@ -319,6 +467,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - + 1)); - pa = at->attr_nxt + u16at (pa, 4); - -+ if (validate_attribute (pa, pa_end) == true) -+ pa = NULL; -+ - while (pa) - { - if (*pa != attr) -@@ -572,6 +723,8 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, - else - vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); - pa = at->attr_nxt + u16at (at->attr_nxt, 4); -+ if (validate_attribute (pa, at->attr_end) == false) -+ pa = NULL; - - while (pa) - { -diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h -index 2c8078403..77b182acf 100644 ---- a/include/grub/ntfs.h -+++ b/include/grub/ntfs.h -@@ -91,6 +91,28 @@ enum - - #define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 - -+/* -+ * To make attribute validation clearer the offsets for each value in the -+ * attribute headers are defined as macros. -+ * -+ * These offsets are all from: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+ -+/* These offsets are part of the attribute header. */ -+#define GRUB_NTFS_ATTRIBUTE_LENGTH 4 -+#define GRUB_NTFS_ATTRIBUTE_RESIDENT 8 -+#define GRUB_NTFS_ATTRIBUTE_NAME_LENGTH 9 -+#define GRUB_NTFS_ATTRIBUTE_NAME_OFFSET 10 -+ -+/* Offsets for values needed for resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_RES_LENGTH 16 -+#define GRUB_NTFS_ATTRIBUTE_RES_OFFSET 20 -+ -+/* Offsets for values needed for non-resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_DATA_RUNS 32 -+#define GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE 34 -+ - enum - { - GRUB_NTFS_AF_ALST = 1, diff --git a/0309-cli_lock-Add-build-option-to-block-command-line-inte.patch b/0309-cli_lock-Add-build-option-to-block-command-line-inte.patch new file mode 100644 index 0000000..3c7d641 --- /dev/null +++ b/0309-cli_lock-Add-build-option-to-block-command-line-inte.patch @@ -0,0 +1,366 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 24 Jan 2024 06:26:37 +0000 +Subject: [PATCH] cli_lock: Add build option to block command line interface + +Add functionality to disable command line interface access and editing of GRUB +menu entries if GRUB image is built with --disable-cli. + +Signed-off-by: Alec Brown +Reviewed-by: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 6 ++++-- + grub-core/kern/main.c | 28 ++++++++++++++++++++++++++++ + grub-core/kern/rescue_reader.c | 13 +++++++++++++ + grub-core/normal/auth.c | 3 +++ + grub-core/normal/menu_text.c | 31 +++++++++++++++++-------------- + include/grub/kernel.h | 1 + + include/grub/misc.h | 2 ++ + include/grub/util/install.h | 8 ++++++-- + util/grub-install-common.c | 10 ++++++++-- + util/grub-mkimage.c | 9 ++++++++- + util/mkimage.c | 15 ++++++++++++++- + 11 files changed, 104 insertions(+), 22 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 096a3cde0..9ce9c5b82 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6520,8 +6520,10 @@ the GRUB command line, edit menu entries, and execute any menu entry. If + @samp{superusers} is set, then use of the command line and editing of menu + entries are automatically restricted to superusers. Setting @samp{superusers} + to empty string effectively disables both access to CLI and editing of menu +-entries. Note: The environment variable needs to be exported to also affect +-the section defined by the @samp{submenu} command (@pxref{submenu}). ++entries. Building a grub image with @samp{--disable-cli} option will also ++disable access to CLI and editing of menu entries, as well as disabling rescue ++mode. Note: The environment variable needs to be exported to also affect the ++section defined by the @samp{submenu} command (@pxref{submenu}). + + Other users may be allowed to execute specific menu entries by giving a list of + usernames (as above) using the @option{--users} option to the +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 8e89763f4..0d6b8138d 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -30,11 +30,14 @@ + #include + #include + #include ++#include + + #ifdef GRUB_MACHINE_PCBIOS + #include + #endif + ++static bool cli_disabled = false; ++ + grub_addr_t + grub_modules_get_end (void) + { +@@ -299,6 +302,28 @@ grub_load_normal_mode (void) + grub_command_execute ("normal", 0, 0); + } + ++bool ++grub_is_cli_disabled (void) ++{ ++ return cli_disabled; ++} ++ ++static void ++check_is_cli_disabled (void) ++{ ++ struct grub_module_header *header; ++ header = 0; ++ ++ FOR_MODULES (header) ++ { ++ if (header->type == OBJ_TYPE_DISABLE_CLI) ++ { ++ cli_disabled = true; ++ return; ++ } ++ } ++} ++ + static void + reclaim_module_space (void) + { +@@ -356,6 +381,9 @@ grub_main (void) + + grub_boot_time ("After loading embedded modules."); + ++ /* Check if the CLI should be disabled */ ++ check_is_cli_disabled (); ++ + /* It is better to set the root device as soon as possible, + for convenience. */ + grub_set_prefix_and_root (); +diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c +index dcd7d4439..4259857ba 100644 +--- a/grub-core/kern/rescue_reader.c ++++ b/grub-core/kern/rescue_reader.c +@@ -78,6 +78,19 @@ grub_rescue_read_line (char **line, int cont, + void __attribute__ ((noreturn)) + grub_rescue_run (void) + { ++ /* Stall if the CLI has been disabled */ ++ if (grub_is_cli_disabled ()) ++ { ++ grub_printf ("Rescue mode has been disabled...\n"); ++ ++ do ++ { ++ /* Do not optimize out the loop. */ ++ asm volatile (""); ++ } ++ while (1); ++ } ++ + grub_printf ("Entering rescue mode...\n"); + + while (1) +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index 517fc623f..d94020186 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -209,6 +209,9 @@ grub_auth_check_authentication (const char *userlist) + char entered[GRUB_AUTH_MAX_PASSLEN]; + struct grub_auth_user *user; + ++ if (grub_is_cli_disabled ()) ++ return GRUB_ACCESS_DENIED; ++ + grub_memset (login, 0, sizeof (login)); + + if (is_authenticated (userlist)) +diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c +index b1321eb26..9c383e64a 100644 +--- a/grub-core/normal/menu_text.c ++++ b/grub-core/normal/menu_text.c +@@ -178,21 +178,24 @@ command-line or ESC to discard edits and return to the GRUB menu."), + + grub_free (msg_translated); + +- if (nested) ++ if (!grub_is_cli_disabled ()) + { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line. ESC to return previous menu."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); +- } +- else +- { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ if (nested) ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line. ESC to return previous menu."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } ++ else ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } + } + } + return ret; +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index 98edc0863..f98a780da 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -33,6 +33,7 @@ enum + OBJ_TYPE_DISABLE_SHIM_LOCK, + OBJ_TYPE_GPG_PUBKEY, + OBJ_TYPE_X509_PUBKEY, ++ OBJ_TYPE_DISABLE_CLI + }; + + /* The module header. */ +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 6b1e084af..d6e9bae8e 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -442,6 +442,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t d, + grub_uint64_t *r); + ++extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); ++ + /* Must match softdiv group in gentpl.py. */ + #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ + (defined(__riscv) && (__riscv_xlen == 32))) +diff --git a/include/grub/util/install.h b/include/grub/util/install.h +index 59eabb9bb..dbf3c216d 100644 +--- a/include/grub/util/install.h ++++ b/include/grub/util/install.h +@@ -72,6 +72,8 @@ + { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ + "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ + 1}, \ ++ { "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, \ ++ N_("disabled command line interface access"), 0 }, \ + { "verbose", 'v', 0, 0, \ + N_("print verbose messages."), 1 } + +@@ -135,7 +137,8 @@ enum grub_install_options { + GRUB_INSTALL_OPTIONS_DTB, + GRUB_INSTALL_OPTIONS_SBAT, + GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, +- GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE ++ GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE, ++ GRUB_INSTALL_OPTIONS_DISABLE_CLI + }; + + extern char *grub_install_source_directory; +@@ -198,7 +201,8 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, + grub_compression_t comp, const char *dtb_file, +- const char *sbat_path, const int disable_shim_lock); ++ const char *sbat_path, const int disable_shim_lock, ++ const int disable_cli); + + const struct grub_install_image_target_desc * + grub_install_get_image_target (const char *arg); +diff --git a/util/grub-install-common.c b/util/grub-install-common.c +index 67afc2eed..42aec141e 100644 +--- a/util/grub-install-common.c ++++ b/util/grub-install-common.c +@@ -469,6 +469,7 @@ static char **x509keys; + static size_t nx509keys; + static grub_compression_t compression; + static size_t appsig_size; ++static int disable_cli; + + int + grub_install_parse (int key, char *arg) +@@ -514,6 +515,9 @@ grub_install_parse (int key, char *arg) + * (nx509keys + 1)); + x509keys[nx509keys++] = xstrdup (arg); + return 1; ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ disable_cli = 1; ++ return 1; + + case GRUB_INSTALL_OPTIONS_VERBOSITY: + verbosity++; +@@ -708,11 +712,13 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + grub_util_info ("grub-mkimage --directory '%s' --prefix '%s' --output '%s'" + " --format '%s' --compression '%s'" + " --appended-signture-size %zu %s%s%s\n", ++ " --format '%s' --compression '%s'%s%s%s%s\n", + dir, prefix, outname, + mkimage_target, compnames[compression], + appsig_size, + note ? " --note" : "", +- disable_shim_lock ? " --disable-shim-lock" : "", s); ++ disable_shim_lock ? " --disable-shim-lock" : "", ++ disable_cli ? " --disable-cli" : "", s); + free (s); + + tgt = grub_install_get_image_target (mkimage_target); +@@ -725,7 +731,7 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + x509keys, nx509keys, + config_path, tgt, + note, appsig_size, compression, dtb, sbat, +- disable_shim_lock); ++ disable_shim_lock, disable_cli); + while (dc--) + grub_install_pop_module (); + } +diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c +index e1f111278..13bdc6cf0 100644 +--- a/util/grub-mkimage.c ++++ b/util/grub-mkimage.c +@@ -84,6 +84,7 @@ static struct argp_option options[] = { + {"compression", 'C', "(xz|none|auto)", 0, N_("choose the compression to use for core image"), 0}, + {"sbat", 's', N_("FILE"), 0, N_("SBAT metadata"), 0}, + {"disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, N_("disable shim_lock verifier"), 0}, ++ {"disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, N_("disable command line interface access"), 0}, + {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, + {"appended-signature-size", 'S', N_("SIZE"), 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 0}, + { 0, 0, 0, 0, 0, 0 } +@@ -133,6 +134,7 @@ struct arguments + int note; + int disable_shim_lock; + size_t appsig_size; ++ int disable_cli; + const struct grub_install_image_target_desc *image_target; + grub_compression_t comp; + }; +@@ -259,6 +261,10 @@ argp_parser (int key, char *arg, struct argp_state *state) + arguments->disable_shim_lock = 1; + break; + ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ arguments->disable_cli = 1; ++ break; ++ + case 'v': + verbosity++; + break; +@@ -347,7 +353,8 @@ main (int argc, char *argv[]) + arguments.image_target, arguments.note, + arguments.appsig_size, arguments.comp, + arguments.dtb, arguments.sbat, +- arguments.disable_shim_lock); ++ arguments.disable_shim_lock, ++ arguments.disable_cli); + + if (grub_util_file_sync (fp) < 0) + grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout", +diff --git a/util/mkimage.c b/util/mkimage.c +index 425d920ff..f31fdefa8 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -888,7 +888,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, grub_compression_t comp, + const char *dtb_path, const char *sbat_path, +- int disable_shim_lock) ++ int disable_shim_lock, int disable_cli) + { + char *kernel_img, *core_img; + size_t total_module_size, core_size; +@@ -963,6 +963,9 @@ grub_install_generate_image (const char *dir, const char *prefix, + if (disable_shim_lock) + total_module_size += sizeof (struct grub_module_header); + ++ if (disable_cli) ++ total_module_size += sizeof (struct grub_module_header); ++ + if (config_path) + { + config_size = ALIGN_ADDR (grub_util_get_image_size (config_path) + 1); +@@ -1129,6 +1132,16 @@ grub_install_generate_image (const char *dir, const char *prefix, + offset += sizeof (*header); + } + ++ if (disable_cli) ++ { ++ struct grub_module_header *header; ++ ++ header = (struct grub_module_header *) (kernel_img + offset); ++ header->type = grub_host_to_target32 (OBJ_TYPE_DISABLE_CLI); ++ header->size = grub_host_to_target32 (sizeof (*header)); ++ offset += sizeof (*header); ++ } ++ + if (config_path) + { + struct grub_module_header *header; diff --git a/0276-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch b/0310-disk-cryptodisk-Require-authentication-after-TPM-unl.patch similarity index 57% rename from 0276-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch rename to 0310-disk-cryptodisk-Require-authentication-after-TPM-unl.patch index 12f8552..2c2396a 100644 --- a/0276-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch +++ b/0310-disk-cryptodisk-Require-authentication-after-TPM-unl.patch @@ -1,15 +1,16 @@ -From d8ca3efe0b0d0d1035b018967b79ae5b33544cf2 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Mon, 18 Nov 2024 10:02:52 +0800 -Subject: [PATCH] Requiring authentication after tpm unlock for CLI access +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Tue, 11 Feb 2025 15:08:06 -0600 +Subject: [PATCH] disk/cryptodisk: Require authentication after TPM unlock for + CLI access -GRUB may use TPM to verify the integrity of boot components, and the +The GRUB may use TPM to verify the integrity of boot components and the result can determine whether a previously sealed key can be released. If everything checks out, showing nothing has been tampered with, the key -is released, and grub unlocks the encrypted root partition for the next +is released and GRUB unlocks the encrypted root partition for the next stage of booting. -However, the liberal command line interface (CLI) can be misused by +However, the liberal Command Line Interface (CLI) can be misused by anyone in this case to access files in the encrypted partition one way or another. Despite efforts to keep the CLI secure by preventing utility command output from leaking file content, many techniques in the wild @@ -20,36 +21,81 @@ where a hack could be applied. Therefore, to mitigate potential misuse of the CLI after the root device has been successfully unlocked via TPM, the user should be required to authenticate using the LUKS password. This added layer of security -ensures that only authorized users can access the CLI, reducing the risk +ensures that only authorized users can access the CLI reducing the risk of exploitation or unauthorized access to the encrypted partition. Fixes: CVE-2024-49504 Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper --- - grub-core/disk/cryptodisk.c | 80 +++++++++++++++++++++++++++++++++++ - grub-core/kern/main.c | 13 ++++++ - grub-core/normal/auth.c | 30 +++++++++++++ + docs/grub.texi | 29 +++++++++++++++ + grub-core/disk/cryptodisk.c | 87 ++++++++++++++++++++++++++++++++++++++++++- + grub-core/kern/main.c | 12 ++++++ + grub-core/normal/auth.c | 30 +++++++++++++++ grub-core/normal/main.c | 4 ++ grub-core/normal/menu_entry.c | 4 ++ include/grub/auth.h | 1 + - include/grub/cryptodisk.h | 4 +- - include/grub/misc.h | 3 ++ - 8 files changed, 138 insertions(+), 1 deletion(-) + include/grub/cryptodisk.h | 3 ++ + include/grub/misc.h | 2 + + 9 files changed, 171 insertions(+), 1 deletion(-) +diff --git a/docs/grub.texi b/docs/grub.texi +index 9ce9c5b82..2d6d73a78 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6882,6 +6882,35 @@ sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed + As with UEFI secure boot, it is necessary to build in the required modules, + or sign them separately. + ++@subsection Command line and menuentry editor protection ++ ++The TPM key protector provides full disk encryption support on servers or ++virtual machine images, meanwhile keeping the boot process unattended. This ++prevents service disruptions by eliminating the need for manual password input ++during startup, improving system uptime and continuity. It is achieved by TPM, ++which verifies the integrity of boot components by checking cryptographic ++hashes against securely stored values, to confirm the disks are unlocked in a ++trusted state. ++ ++However, for users to access the system interactively, some form of ++authentication is still required, as the disks are not unlocked by an ++authorized user. This raised concerns about using an unprotected ++@samp{command-line interface} (@pxref{Command-line interface}), as anyone could ++execute commands to access decrypted data. To address this issue, the LUKS ++password is used to ensure that only authorized users are granted access to the ++interface. Additionally, the @samp{menu entry editor} (@pxref{Menu entry ++editor}) is also safeguarded by the LUKS password, as modifying a boot entry is ++effectively the same as altering the @file{grub.cfg} file read from encrypted ++files. ++ ++It is worth mentioning that the built-in password support, as described in ++@samp{Authentication and Authorization in GRUB} (@pxref{Authentication and ++authorisation}), can also be used to protect the command-line interface from ++unauthorized access. However, it is not recommended to rely on this approach as ++it is an optional step. Setting it up requires additional manual intervention, ++which increases the risk of password leakage during the process. Moreover, the ++superuser list must be well maintained, and the password used cannot be ++synchronized with LUKS key rotation. + + @node Platform limitations + @chapter Platform limitations diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 8bc559b99..b62fc02b7 100644 +index 98e176a13..06a42b2d7 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c -@@ -1188,6 +1188,7 @@ grub_cryptodisk_scan_device_real (const char *name, - goto error; - #ifndef GRUB_UTIL - is_tpmkey = 1; -+ grub_cli_set_auth_needed (); - #endif - goto cleanup; - } -@@ -1706,6 +1707,85 @@ luks_script_get (grub_size_t *sz) +@@ -1144,7 +1144,9 @@ grub_cryptodisk_scan_device_real (const char *name, + ret = grub_cryptodisk_insert (dev, name, source); + if (ret != GRUB_ERR_NONE) + goto error; +- ++#ifndef GRUB_UTIL ++ grub_cli_set_auth_needed (); ++#endif + goto cleanup; + } + grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); +@@ -1576,6 +1578,89 @@ luks_script_get (grub_size_t *sz) return ret; } @@ -74,25 +120,30 @@ index 8bc559b99..b62fc02b7 100644 + source = grub_disk_open (cr_dev->source); + + if (source == NULL) -+ goto error_out; ++ { ++ ret = grub_errno; ++ goto error_out; ++ } + + FOR_CRYPTODISK_DEVS (cr) + { + dev = cr->scan (source, &cargs); + if (grub_errno) -+ goto error_out; -+ if (!dev) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ if (dev == NULL) + continue; + break; + } + + if (dev == NULL) + { -+ grub_error (GRUB_ERR_BAD_MODULE, -+ "no cryptodisk module can handle this device"); ++ ret = grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); + goto error_out; + } -+ ++ + part = grub_partition_get_name (source->partition); + grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, + source->partition != NULL ? "," : "", @@ -101,22 +152,22 @@ index 8bc559b99..b62fc02b7 100644 + + cargs.key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); + if (cargs.key_data == NULL) -+ goto error_out; ++ { ++ ret = grub_errno; ++ goto error_out; ++ } + + if (!grub_password_get ((char *) cargs.key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) + { -+ grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); ++ ret = grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); + goto error_out; + } + cargs.key_len = grub_strlen ((char *) cargs.key_data); + ret = cr->recover_key (source, dev, &cargs); -+ if (ret != GRUB_ERR_NONE) -+ goto error_out; + + error_out: -+ if (source) -+ grub_disk_close (source); -+ if (dev) ++ grub_disk_close (source); ++ if (dev != NULL) + cryptodisk_close (dev); + if (cargs.key_data) + { @@ -124,8 +175,7 @@ index 8bc559b99..b62fc02b7 100644 + grub_free (cargs.key_data); + } + -+ if (grub_errno != GRUB_ERR_NONE) -+ return grub_errno; ++ return ret; + } + + return GRUB_ERR_NONE; @@ -136,20 +186,19 @@ index 8bc559b99..b62fc02b7 100644 { .name = "luks_script", diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c -index 1ec4568f1..01e111aaa 100644 +index 0d6b8138d..2e6b79ee3 100644 --- a/grub-core/kern/main.c +++ b/grub-core/kern/main.c -@@ -35,6 +35,8 @@ - #include +@@ -37,6 +37,7 @@ #endif + static bool cli_disabled = false; +static bool cli_need_auth = false; -+ + grub_addr_t grub_modules_get_end (void) - { -@@ -284,6 +286,17 @@ grub_set_prefix_and_root (void) - grub_print_error (); +@@ -308,6 +309,17 @@ grub_is_cli_disabled (void) + return cli_disabled; } +bool @@ -163,11 +212,11 @@ index 1ec4568f1..01e111aaa 100644 + cli_need_auth = true; +} + - /* Load the normal mode module and execute the normal mode if possible. */ static void - grub_load_normal_mode (void) + check_is_cli_disabled (void) + { diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c -index 517fc623f..121f99601 100644 +index d94020186..71b361bc0 100644 --- a/grub-core/normal/auth.c +++ b/grub-core/normal/auth.c @@ -25,6 +25,10 @@ @@ -207,7 +256,7 @@ index 517fc623f..121f99601 100644 + return GRUB_ACCESS_DENIED; +#endif + } -+ ++ + return GRUB_ERR_NONE; +} + @@ -215,10 +264,10 @@ index 517fc623f..121f99601 100644 grub_auth_check_authentication (const char *userlist) { diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 8e18dac0b..1c8f15159 100644 +index 26872ce94..86ffb388d 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -550,9 +550,13 @@ grub_cmdline_run (int nested, int force_auth) +@@ -557,9 +557,13 @@ grub_cmdline_run (int nested, int force_auth) } while (err && force_auth); @@ -233,10 +282,10 @@ index 8e18dac0b..1c8f15159 100644 return; } diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c -index e5ba91ea4..06682a396 100644 +index ade56be2b..8b0d17e3f 100644 --- a/grub-core/normal/menu_entry.c +++ b/grub-core/normal/menu_entry.c -@@ -1256,9 +1256,13 @@ grub_menu_entry_run (grub_menu_entry_t entry) +@@ -1255,9 +1255,13 @@ grub_menu_entry_run (grub_menu_entry_t entry) err = grub_auth_check_authentication (NULL); @@ -262,32 +311,27 @@ index 747334451..21d5190f0 100644 #endif /* ! GRUB_AUTH_HEADER */ diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h -index 0b41e249e..0b5a3626f 100644 +index d94df68b6..d2572f8b0 100644 --- a/include/grub/cryptodisk.h +++ b/include/grub/cryptodisk.h -@@ -202,5 +202,7 @@ grub_util_get_geli_uuid (const char *dev); - +@@ -187,4 +187,7 @@ grub_util_get_geli_uuid (const char *dev); grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid); grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); -- + +#ifdef GRUB_MACHINE_EFI +grub_err_t grub_cryptodisk_challenge_password (void); +#endif #endif diff --git a/include/grub/misc.h b/include/grub/misc.h -index 044d04689..e08d83e48 100644 +index d6e9bae8e..0429339ef 100644 --- a/include/grub/misc.h +++ b/include/grub/misc.h -@@ -392,6 +392,9 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, - grub_uint64_t d, +@@ -443,6 +443,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, grub_uint64_t *r); + extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); +extern bool EXPORT_FUNC(grub_is_cli_need_auth) (void); +extern void EXPORT_FUNC(grub_cli_set_auth_needed) (void); -+ + /* Must match softdiv group in gentpl.py. */ #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ - (defined(__riscv) && (__riscv_xlen == 32))) --- -2.41.1 - diff --git a/0311-disk-loopback-Reference-tracking-for-the-loopback.patch b/0311-disk-loopback-Reference-tracking-for-the-loopback.patch index fe038c5..5f6cd3a 100644 --- a/0311-disk-loopback-Reference-tracking-for-the-loopback.patch +++ b/0311-disk-loopback-Reference-tracking-for-the-loopback.patch @@ -1,7 +1,7 @@ -From abff01c61155a33c22d259c224ce2d7f9fae54f7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: B Horn -Date: Sun, 12 May 2024 03:26:19 +0100 -Subject: [PATCH 24/73] disk/loopback: Reference tracking for the loopback +Date: Tue, 11 Feb 2025 15:22:28 -0600 +Subject: [PATCH] disk/loopback: Reference tracking for the loopback It was possible to delete a loopback while there were still references to it. This led to an exploitable use-after-free. @@ -12,15 +12,16 @@ Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- - grub-core/disk/loopback.c | 18 ++++++++++++++++++ - include/grub/err.h | 1 + - 2 files changed, 19 insertions(+) + grub-core/disk/loopback.c | 17 +++++++++++++++++ + include/grub/err.h | 3 ++- + include/grub/loopback.h | 1 + + 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c -index 4635dcf..2bea4e9 100644 +index 11a5e0cbd..f39281323 100644 --- a/grub-core/disk/loopback.c +++ b/grub-core/disk/loopback.c -@@ -24,6 +24,7 @@ +@@ -25,6 +25,7 @@ #include #include #include @@ -28,15 +29,7 @@ index 4635dcf..2bea4e9 100644 GRUB_MOD_LICENSE ("GPLv3+"); -@@ -33,6 +34,7 @@ struct grub_loopback - grub_file_t file; - struct grub_loopback *next; - unsigned long id; -+ grub_uint64_t refcnt; - }; - - static struct grub_loopback *loopback_list; -@@ -64,6 +66,8 @@ delete_loopback (const char *name) +@@ -57,6 +58,8 @@ delete_loopback (const char *name) if (! dev) return grub_error (GRUB_ERR_BAD_DEVICE, "device not found"); @@ -45,7 +38,7 @@ index 4635dcf..2bea4e9 100644 /* Remove the device from the list. */ *prev = dev->next; -@@ -120,6 +124,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args) +@@ -113,6 +116,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args) newdev->file = file; newdev->id = last_id++; @@ -53,7 +46,7 @@ index 4635dcf..2bea4e9 100644 /* Add the new entry to the list. */ newdev->next = loopback_list; -@@ -161,6 +166,9 @@ grub_loopback_open (const char *name, grub_disk_t disk) +@@ -154,6 +158,9 @@ grub_loopback_open (const char *name, grub_disk_t disk) if (! dev) return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); @@ -63,7 +56,7 @@ index 4635dcf..2bea4e9 100644 /* Use the filesize for the disk size, round up to a complete sector. */ if (dev->file->size != GRUB_FILE_SIZE_UNKNOWN) disk->total_sectors = ((dev->file->size + GRUB_DISK_SECTOR_SIZE - 1) -@@ -178,6 +186,15 @@ grub_loopback_open (const char *name, grub_disk_t disk) +@@ -171,6 +178,15 @@ grub_loopback_open (const char *name, grub_disk_t disk) return 0; } @@ -79,7 +72,7 @@ index 4635dcf..2bea4e9 100644 static grub_err_t grub_loopback_read (grub_disk_t disk, grub_disk_addr_t sector, grub_size_t size, char *buf) -@@ -220,6 +237,7 @@ static struct grub_disk_dev grub_loopback_dev = +@@ -213,6 +229,7 @@ static struct grub_disk_dev grub_loopback_dev = .id = GRUB_DISK_DEVICE_LOOPBACK_ID, .disk_iterate = grub_loopback_iterate, .disk_open = grub_loopback_open, @@ -88,16 +81,28 @@ index 4635dcf..2bea4e9 100644 .disk_write = grub_loopback_write, .next = 0 diff --git a/include/grub/err.h b/include/grub/err.h -index 322d067..7a20749 100644 +index 3c587b9b8..29f1a73c5 100644 --- a/include/grub/err.h +++ b/include/grub/err.h -@@ -74,6 +74,7 @@ typedef enum +@@ -73,7 +73,8 @@ typedef enum + GRUB_ERR_NET_NO_DOMAIN, GRUB_ERR_EOF, GRUB_ERR_BAD_SIGNATURE, - GRUB_ERR_BAD_FIRMWARE, -+ GRUB_ERR_STILL_REFERENCED, - GRUB_ERR_TPCM_VERIFY +- GRUB_ERR_BAD_FIRMWARE ++ GRUB_ERR_BAD_FIRMWARE, ++ GRUB_ERR_STILL_REFERENCED } grub_err_t; --- -2.33.0 + +diff --git a/include/grub/loopback.h b/include/grub/loopback.h +index 3b9a9e32e..915ef65fc 100644 +--- a/include/grub/loopback.h ++++ b/include/grub/loopback.h +@@ -25,6 +25,7 @@ struct grub_loopback + grub_file_t file; + struct grub_loopback *next; + unsigned long id; ++ grub_uint64_t refcnt; + }; + + #endif /* ! GRUB_LOOPBACK_HEADER */ diff --git a/0312-kern-disk-Limit-recursion-depth.patch b/0312-kern-disk-Limit-recursion-depth.patch index ae50273..eba37f9 100644 --- a/0312-kern-disk-Limit-recursion-depth.patch +++ b/0312-kern-disk-Limit-recursion-depth.patch @@ -112,9 +112,9 @@ index 29f1a73c5..7530f58b2 100644 GRUB_ERR_EOF, GRUB_ERR_BAD_SIGNATURE, GRUB_ERR_BAD_FIRMWARE, - GRUB_ERR_STILL_REFERENCED, -+ GRUB_ERR_RECURSION_DEPTH, - GRUB_ERR_TPCM_VERIFY +- GRUB_ERR_STILL_REFERENCED ++ GRUB_ERR_STILL_REFERENCED, ++ GRUB_ERR_RECURSION_DEPTH } grub_err_t; diff --git a/0316-net-Remove-variables-hooks-when-interface-is-unregis.patch b/0316-net-Remove-variables-hooks-when-interface-is-unregis.patch index 4542a49..c7b25c1 100644 --- a/0316-net-Remove-variables-hooks-when-interface-is-unregis.patch +++ b/0316-net-Remove-variables-hooks-when-interface-is-unregis.patch @@ -1,8 +1,7 @@ -From aa8b4d7facef7b75a2703274b1b9d4e0e734c401 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: B Horn -Date: Fri, 1 Nov 2024 23:49:48 +0000 -Subject: [PATCH 29/73] net: Remove variables hooks when interface is - unregisted +Date: Tue, 11 Feb 2025 15:42:44 -0600 +Subject: [PATCH] net: Remove variables hooks when interface is unregisted The grub_net_network_level_interface_unregister(), previously implemented in a header, did not remove the variables hooks that @@ -13,16 +12,16 @@ variables and move the function into the grub-core/net/net.c. Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- - grub-core/net/net.c | 32 ++++++++++++++++++++++++++++++++ + grub-core/net/net.c | 33 +++++++++++++++++++++++++++++++++ include/grub/net.h | 11 +---------- - 2 files changed, 33 insertions(+), 10 deletions(-) + 2 files changed, 34 insertions(+), 10 deletions(-) diff --git a/grub-core/net/net.c b/grub-core/net/net.c -index f69c67b64..0e41e21a5 100644 +index 9959a2ae8..22d5cc3ba 100644 --- a/grub-core/net/net.c +++ b/grub-core/net/net.c -@@ -984,6 +984,38 @@ grub_net_network_level_interface_register (struct grub_net_network_level_interfa - grub_net_network_level_interfaces = inter; +@@ -1066,6 +1066,39 @@ grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter, + return 0; } +void @@ -30,41 +29,42 @@ index f69c67b64..0e41e21a5 100644 +{ + char *name; + -+ { -+ char buf[GRUB_NET_MAX_STR_HWADDR_LEN]; ++ { ++ char buf[GRUB_NET_MAX_STR_HWADDR_LEN]; + -+ grub_net_hwaddr_to_str (&inter->hwaddress, buf); -+ name = grub_xasprintf ("net_%s_mac", inter->name); -+ if (name != NULL) -+ grub_register_variable_hook (name, NULL, NULL); -+ grub_free (name); -+ } ++ grub_net_hwaddr_to_str (&inter->hwaddress, buf); ++ name = grub_xasprintf ("net_%s_mac", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } + -+ { -+ char buf[GRUB_NET_MAX_STR_ADDR_LEN]; ++ { ++ char buf[GRUB_NET_MAX_STR_ADDR_LEN]; + -+ grub_net_addr_to_str (&inter->address, buf); -+ name = grub_xasprintf ("net_%s_ip", inter->name); -+ if (name != NULL) -+ grub_register_variable_hook (name, NULL, NULL); -+ grub_free (name); -+ } ++ grub_net_addr_to_str (&inter->address, buf); ++ name = grub_xasprintf ("net_%s_ip", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } + -+ inter->card->num_ifaces--; -+ *inter->prev = inter->next; -+ if (inter->next) -+ inter->next->prev = inter->prev; -+ inter->next = 0; -+ inter->prev = 0; ++ inter->card->num_ifaces--; ++ *inter->prev = inter->next; ++ if (inter->next) ++ inter->next->prev = inter->prev; ++ inter->next = 0; ++ inter->prev = 0; +} - ++ grub_err_t grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter, + int mask) diff --git a/include/grub/net.h b/include/grub/net.h -index 844e501c1..228d04963 100644 +index 868c9a2ef..273afbddf 100644 --- a/include/grub/net.h +++ b/include/grub/net.h -@@ -540,16 +540,7 @@ void grub_bootp_fini (void); +@@ -625,16 +625,7 @@ void grub_bootp_fini (void); void grub_dns_init (void); void grub_dns_fini (void); @@ -82,5 +82,3 @@ index 844e501c1..228d04963 100644 void grub_net_tcp_retransmit (void); --- -2.33.0 diff --git a/0320-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch b/0320-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch index 5734f7d..1fee4bf 100644 --- a/0320-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch +++ b/0320-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch @@ -1,7 +1,7 @@ -From 832604bba80220879b54c2ebc99489cb1bc2e03d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: B Horn -Date: Thu, 18 Apr 2024 15:59:26 +0100 -Subject: [PATCH 33/73] kern/dl: Fix for an integer overflow in grub_dl_ref() +Date: Tue, 11 Feb 2025 16:41:57 -0600 +Subject: [PATCH] kern/dl: Fix for an integer overflow in grub_dl_ref() It was possible to overflow the value of mod->ref_count, a signed integer, by repeatedly invoking insmod on an already loaded module. @@ -24,10 +24,10 @@ Reviewed-by: Daniel Kiper 4 files changed, 19 insertions(+), 12 deletions(-) diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c -index 8f2ac05..33cfff0 100644 +index 2bd3ac76f..2001043cf 100644 --- a/grub-core/commands/minicmd.c +++ b/grub-core/commands/minicmd.c -@@ -173,7 +173,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), +@@ -167,7 +167,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), { grub_dl_dep_t dep; @@ -37,7 +37,7 @@ index 8f2ac05..33cfff0 100644 { if (dep != mod->dep) diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c -index 73a5b9e..1ba0b73 100644 +index 2eaef7150..fe7c3b940 100644 --- a/grub-core/kern/dl.c +++ b/grub-core/kern/dl.c @@ -32,6 +32,7 @@ @@ -45,10 +45,10 @@ index 73a5b9e..1ba0b73 100644 #include #include +#include + #include /* Platforms where modules are in a readonly area of memory. */ - #if defined(GRUB_MACHINE_QEMU) -@@ -536,7 +537,7 @@ grub_dl_resolve_dependencies (grub_dl_t mod, Elf_Ehdr *e) +@@ -613,7 +614,7 @@ grub_dl_resolve_dependencies (grub_dl_t mod, Elf_Ehdr *e) return GRUB_ERR_NONE; } @@ -57,7 +57,7 @@ index 73a5b9e..1ba0b73 100644 grub_dl_ref (grub_dl_t mod) { grub_dl_dep_t dep; -@@ -547,10 +548,13 @@ grub_dl_ref (grub_dl_t mod) +@@ -624,10 +625,13 @@ grub_dl_ref (grub_dl_t mod) for (dep = mod->dep; dep; dep = dep->next) grub_dl_ref (dep->mod); @@ -73,7 +73,7 @@ index 73a5b9e..1ba0b73 100644 grub_dl_unref (grub_dl_t mod) { grub_dl_dep_t dep; -@@ -561,10 +565,13 @@ grub_dl_unref (grub_dl_t mod) +@@ -638,10 +642,13 @@ grub_dl_unref (grub_dl_t mod) for (dep = mod->dep; dep; dep = dep->next) grub_dl_unref (dep->mod); @@ -90,10 +90,10 @@ index 73a5b9e..1ba0b73 100644 { if (mod == NULL) diff --git a/include/grub/dl.h b/include/grub/dl.h -index c5ab18c..644ecfd 100644 +index 1e1262a28..055bb564e 100644 --- a/include/grub/dl.h +++ b/include/grub/dl.h -@@ -174,7 +174,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t; +@@ -177,7 +177,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t; struct grub_dl { char *name; @@ -102,7 +102,7 @@ index c5ab18c..644ecfd 100644 int persistent; grub_dl_dep_t dep; grub_dl_segment_t segment; -@@ -203,9 +203,9 @@ grub_dl_t EXPORT_FUNC(grub_dl_load) (const char *name); +@@ -206,9 +206,9 @@ grub_dl_t EXPORT_FUNC(grub_dl_load) (const char *name); grub_dl_t grub_dl_load_core (void *addr, grub_size_t size); grub_dl_t EXPORT_FUNC(grub_dl_load_core_noinit) (void *addr, grub_size_t size); int EXPORT_FUNC(grub_dl_unload) (grub_dl_t mod); @@ -116,7 +116,7 @@ index c5ab18c..644ecfd 100644 extern grub_dl_t EXPORT_VAR(grub_dl_head); diff --git a/util/misc.c b/util/misc.c -index d545212..0f928e5 100644 +index d545212d9..0f928e5b4 100644 --- a/util/misc.c +++ b/util/misc.c @@ -190,14 +190,14 @@ grub_xputs_real (const char *str) @@ -136,5 +136,3 @@ index d545212..0f928e5 100644 grub_dl_unref (grub_dl_t mod) { (void) mod; --- -2.33.0 diff --git a/0321-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch b/0321-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch new file mode 100644 index 0000000..213ef19 --- /dev/null +++ b/0321-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 17:01:26 -0600 +Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in + grub_dl_relocate_symbols() + +The grub_dl_relocate_symbols() iterates through the sections in +an ELF looking for relocation sections. According to the spec [1] +the SHF_INFO_LINK flag should be set if the sh_info field is meant +to be a section index. + +[1] https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/dl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index fe7c3b940..cb49bdc4b 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -681,6 +681,9 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + grub_dl_segment_t seg; + grub_err_t err; + ++ if (!(s->sh_flags & SHF_INFO_LINK)) ++ continue; ++ + seg = grub_dl_find_segment(mod, s->sh_info); + if (!seg) + continue; diff --git a/0332-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch b/0332-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch index d553f3e..e787d6f 100644 --- a/0332-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch +++ b/0332-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch @@ -1,7 +1,7 @@ -From 340e4d058f584534f4b90b7dbea2b64a9f8c418c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: B Horn -Date: Thu, 18 Apr 2024 20:37:10 +0100 -Subject: [PATCH 46/73] commands/memrw: Disable memory reading in lockdown mode +Date: Tue, 11 Feb 2025 17:12:29 -0600 +Subject: [PATCH] commands/memrw: Disable memory reading in lockdown mode With the rest of module being blocked in lockdown mode it does not make a lot of sense to leave memory reading enabled. This also goes in par @@ -15,12 +15,12 @@ Reviewed-by: Daniel Kiper 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c -index d401a6db0..3542683d1 100644 +index 39cf3a06d..9d8a54a4b 100644 --- a/grub-core/commands/memrw.c +++ b/grub-core/commands/memrw.c -@@ -122,17 +122,20 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv) - GRUB_MOD_INIT(memrw) - { +@@ -126,17 +126,20 @@ GRUB_MOD_INIT(memrw) + return; + cmd_read_byte = - grub_register_extcmd ("read_byte", grub_cmd_read, 0, - N_("ADDR"), N_("Read 8-bit value from ADDR."), @@ -48,5 +48,3 @@ index d401a6db0..3542683d1 100644 cmd_write_byte = grub_register_command_lockdown ("write_byte", grub_cmd_write, N_("ADDR VALUE [MASK]"), --- -2.33.0 diff --git a/0336-disk-Use-safe-math-macros-to-prevent-overflows.patch b/0336-disk-Use-safe-math-macros-to-prevent-overflows.patch index 32e1445..db3d937 100644 --- a/0336-disk-Use-safe-math-macros-to-prevent-overflows.patch +++ b/0336-disk-Use-safe-math-macros-to-prevent-overflows.patch @@ -1,7 +1,7 @@ -From cb558b33aeeb4d1ef58e706f12f349187c560297 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alec Brown -Date: Wed, 22 Jan 2025 02:55:09 +0000 -Subject: [PATCH 50/73] disk: Use safe math macros to prevent overflows +Date: Tue, 11 Feb 2025 17:59:04 -0600 +Subject: [PATCH] disk: Use safe math macros to prevent overflows Replace direct arithmetic operations with macros from include/grub/safemath.h to prevent potential overflow issues when calculating the memory sizes. @@ -9,29 +9,29 @@ to prevent potential overflow issues when calculating the memory sizes. Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- - grub-core/disk/cryptodisk.c | 36 ++++++++++++++----- - grub-core/disk/diskfilter.c | 9 +++-- - grub-core/disk/ieee1275/obdisk.c | 43 +++++++++++++++++++---- - grub-core/disk/ieee1275/ofdisk.c | 59 +++++++++++++++++++++++++++----- - grub-core/disk/ldm.c | 36 ++++++++++++++++--- - grub-core/disk/luks2.c | 7 +++- - grub-core/disk/memdisk.c | 7 +++- - grub-core/disk/plainmount.c | 9 +++-- - 8 files changed, 172 insertions(+), 34 deletions(-) + grub-core/disk/cryptodisk.c | 36 ++++++++++++++++++------ + grub-core/disk/diskfilter.c | 9 ++++-- + grub-core/disk/ieee1275/obdisk.c | 43 ++++++++++++++++++++++++---- + grub-core/disk/ieee1275/ofdisk.c | 60 ++++++++++++++++++++++++++++++++++------ + grub-core/disk/ldm.c | 36 ++++++++++++++++++++---- + grub-core/disk/luks2.c | 7 ++++- + grub-core/disk/memdisk.c | 7 ++++- + grub-core/disk/plainmount.c | 9 ++++-- + 8 files changed, 172 insertions(+), 35 deletions(-) diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 6c01837..b1b0e04 100644 +index 06a42b2d7..872776010 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c -@@ -27,6 +27,7 @@ +@@ -26,6 +26,7 @@ + #include #include #include - #include +#include #ifdef GRUB_UTIL #include -@@ -1660,7 +1661,7 @@ static char * +@@ -1475,7 +1476,7 @@ static char * luks_script_get (grub_size_t *sz) { grub_cryptodisk_t i; @@ -40,7 +40,7 @@ index 6c01837..b1b0e04 100644 char *ptr, *ret; *sz = 0; -@@ -1669,10 +1670,6 @@ luks_script_get (grub_size_t *sz) +@@ -1484,10 +1485,6 @@ luks_script_get (grub_size_t *sz) if (grub_strcmp (i->modname, "luks") == 0 || grub_strcmp (i->modname, "luks2") == 0) { @@ -51,7 +51,7 @@ index 6c01837..b1b0e04 100644 /* * Add space in the line for (in order) spaces, cipher mode, cipher IV * mode, sector offset, sector size and the trailing newline. This is -@@ -1680,14 +1677,35 @@ luks_script_get (grub_size_t *sz) +@@ -1495,14 +1492,35 @@ luks_script_get (grub_size_t *sz) * in an earlier version of this code that are unaccounted for. It is * left in the calculations in case it is needed. At worst, its short- * lived wasted space. @@ -92,7 +92,7 @@ index 6c01837..b1b0e04 100644 return 0; diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 1e44e3a..3d1aa1c 100644 +index c35ce8915..fef0b815a 100644 --- a/grub-core/disk/diskfilter.c +++ b/grub-core/disk/diskfilter.c @@ -24,6 +24,7 @@ @@ -103,7 +103,7 @@ index 1e44e3a..3d1aa1c 100644 #ifdef GRUB_UTIL #include #include -@@ -1187,7 +1188,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, +@@ -1041,7 +1042,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, { struct grub_diskfilter_vg *array; int i; @@ -112,7 +112,7 @@ index 1e44e3a..3d1aa1c 100644 grub_uint64_t totsize; struct grub_diskfilter_pv *pv; grub_err_t err; -@@ -1288,7 +1289,11 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, +@@ -1142,7 +1143,11 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, } array->lvs->vg = array; @@ -126,7 +126,7 @@ index 1e44e3a..3d1aa1c 100644 goto fail; diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c -index cd923b9..9d4c426 100644 +index cd923b90f..9d4c42665 100644 --- a/grub-core/disk/ieee1275/obdisk.c +++ b/grub-core/disk/ieee1275/obdisk.c @@ -26,6 +26,7 @@ @@ -225,18 +225,18 @@ index cd923b9..9d4c426 100644 /* diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c -index c5c20a5..04efe9d 100644 +index 57624fde5..6c628635f 100644 --- a/grub-core/disk/ieee1275/ofdisk.c +++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -26,6 +26,7 @@ +@@ -25,6 +25,7 @@ + #include #include #include - #include +#include - #define RETRY_DEFAULT_TIMEOUT 15 - -@@ -94,6 +95,7 @@ ofdisk_hash_add_real (char *devpath) + static char *last_devpath; + static grub_ieee1275_ihandle_t last_ihandle; +@@ -81,6 +82,7 @@ ofdisk_hash_add_real (char *devpath) struct ofdisk_hash_ent **head = &ofdisk_hash[ofdisk_hash_fn(devpath)]; const char *iptr; char *optr; @@ -244,7 +244,7 @@ index c5c20a5..04efe9d 100644 p = grub_zalloc (sizeof (*p)); if (!p) -@@ -101,8 +103,14 @@ ofdisk_hash_add_real (char *devpath) +@@ -88,8 +90,14 @@ ofdisk_hash_add_real (char *devpath) p->devpath = devpath; @@ -261,7 +261,7 @@ index c5c20a5..04efe9d 100644 if (!p->grub_devpath) { -@@ -112,7 +120,13 @@ ofdisk_hash_add_real (char *devpath) +@@ -99,7 +107,13 @@ ofdisk_hash_add_real (char *devpath) if (! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_NO_PARTITION_0)) { @@ -276,15 +276,16 @@ index c5c20a5..04efe9d 100644 if (!p->open_path) { grub_free (p->grub_devpath); -@@ -571,6 +585,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) +@@ -225,7 +239,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) args; char *buf, *bufptr; unsigned i; +- + grub_size_t sz; - if (boot_type && - grub_strcmp (boot_type, alias->type) != 0) -@@ -598,7 +613,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle) + if (! ihandle) +@@ -246,7 +260,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) return; } @@ -300,18 +301,12 @@ index c5c20a5..04efe9d 100644 if (!buf) return; bufptr = grub_stpcpy (buf, alias->path); -@@ -642,6 +664,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) +@@ -290,9 +311,15 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) grub_uint64_t *table; grub_uint16_t table_size; grub_ieee1275_ihandle_t ihandle; + grub_size_t sz; - if (boot_type && - grub_strcmp (boot_type, alias->type) != 0) -@@ -651,8 +674,13 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) - goto iter_children; - } - - buf = grub_malloc (grub_strlen (alias->path) + - sizeof ("/disk@7766554433221100")); + if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) @@ -324,7 +319,7 @@ index c5c20a5..04efe9d 100644 if (!buf) return; bufptr = grub_stpcpy (buf, alias->path); -@@ -798,9 +826,17 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, +@@ -432,9 +459,17 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, static char * compute_dev_path (const char *name) { @@ -343,7 +338,7 @@ index c5c20a5..04efe9d 100644 if (!devpath) return NULL; -@@ -1147,6 +1183,7 @@ insert_bootpath (void) +@@ -657,6 +692,7 @@ insert_bootpath (void) char *bootpath; grub_ssize_t bootpath_size; char *type; @@ -351,7 +346,7 @@ index c5c20a5..04efe9d 100644 if (grub_ieee1275_get_property_length (grub_ieee1275_chosen, "bootpath", &bootpath_size) -@@ -1157,7 +1194,13 @@ insert_bootpath (void) +@@ -667,7 +703,13 @@ insert_bootpath (void) return; } @@ -367,7 +362,7 @@ index c5c20a5..04efe9d 100644 { grub_print_error (); diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c -index 34bfe6b..4101b15 100644 +index 34bfe6bd1..4101b15d8 100644 --- a/grub-core/disk/ldm.c +++ b/grub-core/disk/ldm.c @@ -220,6 +220,7 @@ make_vg (grub_disk_t disk, @@ -456,7 +451,7 @@ index 34bfe6b..4101b15 100644 if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c -index fe5ba77..a493942 100644 +index d5106402f..8036d76ff 100644 --- a/grub-core/disk/luks2.c +++ b/grub-core/disk/luks2.c @@ -26,6 +26,7 @@ @@ -467,15 +462,15 @@ index fe5ba77..a493942 100644 #include #include -@@ -611,6 +612,7 @@ luks2_recover_key (grub_disk_t source, +@@ -569,6 +570,7 @@ luks2_recover_key (grub_disk_t source, gcry_err_code_t gcry_ret; - grub_json_t *json = NULL, keyslots, tokens; + grub_json_t *json = NULL, keyslots; grub_err_t ret; + grub_size_t sz; if (cargs->key_data == NULL || cargs->key_len == 0) return grub_error (GRUB_ERR_BAD_ARGUMENT, "no key data"); -@@ -619,7 +621,10 @@ luks2_recover_key (grub_disk_t source, +@@ -577,7 +579,10 @@ luks2_recover_key (grub_disk_t source, if (ret) return ret; @@ -488,7 +483,7 @@ index fe5ba77..a493942 100644 return GRUB_ERR_OUT_OF_MEMORY; diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c -index 613779c..36de3bf 100644 +index 613779cf3..36de3bfab 100644 --- a/grub-core/disk/memdisk.c +++ b/grub-core/disk/memdisk.c @@ -23,6 +23,7 @@ @@ -513,7 +508,7 @@ index 613779c..36de3bf 100644 grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); diff --git a/grub-core/disk/plainmount.c b/grub-core/disk/plainmount.c -index 47e6480..21ec407 100644 +index 47e64805f..21ec4072c 100644 --- a/grub-core/disk/plainmount.c +++ b/grub-core/disk/plainmount.c @@ -24,6 +24,7 @@ @@ -546,5 +541,3 @@ index 47e6480..21ec407 100644 derived_hash = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN * 2); if (p == NULL || derived_hash == NULL) { --- -2.33.0 diff --git a/0355-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch b/0355-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch index 82d7b71..2ae5ec6 100644 --- a/0355-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch +++ b/0355-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch @@ -17,18 +17,18 @@ Reviewed-by: Daniel Kiper 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 47cfd93..c2d7bb5 100644 +index cda10fa8b..97687013c 100644 --- a/grub-core/normal/menu.c +++ b/grub-core/normal/menu.c -@@ -33,6 +33,7 @@ +@@ -32,6 +32,7 @@ + #include #include #include - #include +#include /* Time to delay after displaying an error message about a default/fallback entry failing to boot. */ -@@ -836,9 +837,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) +@@ -784,9 +785,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) case GRUB_TERM_CTRL | 'c': case GRUB_TERM_KEY_NPAGE: @@ -39,5 +39,3 @@ index 47cfd93..c2d7bb5 100644 current_entry = menu->size - 1; menu_set_chosen_entry (current_entry); break; --- -2.33.0 diff --git a/0358-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch b/0358-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch index 60578da..9c8819b 100644 --- a/0358-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch +++ b/0358-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch @@ -1,7 +1,7 @@ -From 490a6ab71cebd96fae7a1ceb9067484f5ccbec2a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alec Brown -Date: Fri, 7 Feb 2025 01:47:57 +0000 -Subject: [PATCH 72/73] loader/i386/linux: Cast left shift to grub_uint32_t +Date: Wed, 12 Feb 2025 10:56:13 -0600 +Subject: [PATCH] loader/i386/linux: Cast left shift to grub_uint32_t The Coverity complains that we might overflow into a negative value when setting linux_params.kernel_alignment to (1 << align). We can remedy @@ -16,17 +16,15 @@ Reviewed-by: Daniel Kiper 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c -index 977757f2c..b051600c8 100644 +index 90121e9bc..33a852197 100644 --- a/grub-core/loader/i386/linux.c +++ b/grub-core/loader/i386/linux.c -@@ -806,7 +806,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - } +@@ -823,7 +823,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, GRUB_MEM_ATTR_X); linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; - linux_params.kernel_alignment = (1 << align); -+ linux_params.kernel_alignment = ((grub_uint32_t) 1 << align); ++ linux_params.kernel_alignment = ((grub_uint32_t)1 << align); linux_params.ps_mouse = linux_params.padding11 = 0; linux_params.type_of_loader = GRUB_LINUX_BOOT_LOADER_TYPE; --- -2.33.0 diff --git a/0359-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch b/0359-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch index 92b7e5f..272293b 100644 --- a/0359-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch +++ b/0359-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch @@ -1,7 +1,7 @@ -From 4dc6166571645780c459dde2cdc1b001a5ec844c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alec Brown Date: Wed, 5 Feb 2025 22:04:08 +0000 -Subject: [PATCH 73/73] loader/i386/bsd: Use safe math to avoid underflow +Subject: [PATCH] loader/i386/bsd: Use safe math to avoid underflow The operation kern_end - kern_start may underflow when we input it into grub_relocator_alloc_chunk_addr() call. To avoid this we can use safe @@ -16,10 +16,10 @@ Reviewed-by: Daniel Kiper 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c -index 1f9128f6f..578433402 100644 +index 8075ac9b0..50f96ea7a 100644 --- a/grub-core/loader/i386/bsd.c +++ b/grub-core/loader/i386/bsd.c -@@ -1340,6 +1340,7 @@ static grub_err_t +@@ -1341,6 +1341,7 @@ static grub_err_t grub_bsd_load_elf (grub_elf_t elf, const char *filename) { grub_err_t err; @@ -27,7 +27,7 @@ index 1f9128f6f..578433402 100644 kern_end = 0; kern_start = ~0; -@@ -1370,8 +1371,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) +@@ -1371,8 +1372,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) if (grub_errno) return grub_errno; @@ -41,7 +41,7 @@ index 1f9128f6f..578433402 100644 if (err) return err; -@@ -1431,8 +1435,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) +@@ -1432,8 +1436,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) { grub_relocator_chunk_t ch; @@ -54,5 +54,3 @@ index 1f9128f6f..578433402 100644 if (err) return err; kern_chunk_src = get_virtual_current_address (ch); --- -2.33.0 \ No newline at end of file diff --git a/0361-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch b/0361-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch deleted file mode 100644 index 18f5f2f..0000000 --- a/0361-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Fri, 28 Feb 2025 17:00:53 +0300 -Subject: [PATCH] kern/rescue_reader: Block the rescue mode until the CLI - authentication - -This further mitigates potential misuse of the CLI after the -root device has been successfully unlocked via TPM. - -Fixes: CVE-2025-4382 - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/kern/rescue_reader.c | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - -diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c -index dcd7d44..591b52b 100644 ---- a/grub-core/kern/rescue_reader.c -+++ b/grub-core/kern/rescue_reader.c -@@ -78,6 +78,21 @@ grub_rescue_read_line (char **line, int cont, - void __attribute__ ((noreturn)) - grub_rescue_run (void) - { -+ -+ /* Stall if the CLI has been disabled */ -+ if (grub_is_cli_need_auth ()) -+ { -+ grub_printf ("Rescue mode has been disabled...\n"); -+ -+ do -+ { -+ /* Do not optimize out the loop. */ -+ asm volatile (""); -+ } -+ while (1); -+ } -+ -+ - grub_printf ("Entering rescue mode...\n"); - - while (1) --- -2.41.1 \ No newline at end of file diff --git a/0361-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch b/0361-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch new file mode 100644 index 0000000..9c3a3fd --- /dev/null +++ b/0361-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch @@ -0,0 +1,117 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Avnish Chouhan +Date: Thu, 13 Mar 2025 19:45:50 +0530 +Subject: [PATCH] powerpc: increase MIN RMA size for CAS negotiation + +Change RMA size from 512 MB to 768 MB which will result +in more memory at boot time for PowerPC. When vTPM, Secure Boot or +FADump are enabled on PowerPC, the 512 MB RMA memory is not sufficient for +booting. With this 512 MB RMA, GRUB2 runs out of memory and fails to +boot the machine. Sometimes even usage of CDROM requires more memory +for installation and along with the options mentioned above exhausts +the boot memory which results in boot failures. Increasing the RMA size +will resolves multiple out of memory issues observed in PowerPC. + +Failure details (GRUB2 debugs): + + kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 1 + kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space + kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 0 + kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space + kern/file.c:215: Closing `/ppc/ppc64/initrd.img' ... + kern/disk.c:297: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000'... + kern/disk.c:311: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000' succeeded. + kern/file.c:225: Closing `/ppc/ppc64/initrd.img' failed with 3. + kern/file.c:148: Opening `/ppc/ppc64/initrd.img' succeeded. + error: ../../grub-core/kern/mm.c:552:out of memory. + +Signed-off-by: Avnish Chouhan +--- + grub-core/kern/ieee1275/init.c | 51 +++++++++++++++++++++++++++++++++++++----- + 1 file changed, 46 insertions(+), 5 deletions(-) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 6c5f4fb77afa..482cad20903e 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -782,7 +782,7 @@ struct cas_vector + + /* + * Call ibm,client-architecture-support to try to get more RMA. +- * We ask for 512MB which should be enough to verify a distro kernel. ++ * We ask for 768MB which should be enough to verify a distro kernel. + * We ignore most errors: if we don't succeed we'll proceed with whatever + * memory we have. + */ +@@ -854,7 +854,7 @@ grub_ieee1275_ibm_cas (void) + .vec1 = 0x80, /* ignore */ + .vec2_size = 1 + sizeof (struct option_vector2) - 2, + .vec2 = { +- 0, 0, -1, -1, -1, -1, -1, 512, -1, 0, 48 ++ 0, 0, -1, -1, -1, -1, -1, 768, -1, 0, 48 + }, + .vec3_size = 2 - 1, + .vec3 = 0x00e0, /* ask for FP + VMX + DFP but don't halt if unsatisfied */ +@@ -891,6 +891,10 @@ grub_claim_heap (void) + { + grub_err_t err; + grub_uint32_t total = HEAP_MAX_SIZE; ++#if defined(__powerpc__) ++ grub_uint32_t ibm_ca_support_reboot = 0; ++ grub_ssize_t actual; ++#endif + + err = grub_ieee1275_total_mem (&rmo_top); + +@@ -903,11 +907,48 @@ grub_claim_heap (void) + grub_mm_add_region_fn = grub_ieee1275_mm_add_region; + + #if defined(__powerpc__) ++ /* Check if it's a CAS reboot with below property. If so, we will skip CAS call */ ++ if (grub_ieee1275_get_integer_property (grub_ieee1275_chosen, ++ "ibm,client-architecture-support-reboot", ++ &ibm_ca_support_reboot, ++ sizeof (ibm_ca_support_reboot), ++ &actual) >= 0) ++ grub_dprintf ("ieee1275", "ibm,client-architecture-support-reboot: %" PRIuGRUB_UINT32_T "\n", ++ ibm_ca_support_reboot); ++ + if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY)) + { +- /* if we have an error, don't call CAS, just hope for the best */ +- if (err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) +- grub_ieee1275_ibm_cas (); ++ /* ++ * If we have an error, don't call CAS. Just hope for the best. ++ * Along with the above, if the rmo_top is 512 MB or above. We ++ * will skip the CAS call. However, if we call CAS, the rmo_top ++ * will be set to 768 MB via CAS Vector2. But we need to call ++ * CAS with "rmo_top < 512 MB" to avoid the issue on the older ++ * Linux kernel, which still uses rmo_top as 512 MB. If we call ++ * CAS with a condition "rmo_top < 768 MB", it will result in an ++ * issue due to the IBM CAS reboot feature and we won't be able ++ * to boot the newer kernel. Whenever a reboot is detected as ++ * the CAS reboot by GRUB. It will boot the machine with the ++ * last booted kernel by reading the variable "boot-last-label" ++ * which has the info related to the last boot and it's specific ++ * to IBM PowerPC. Due to this, the machine will boot with the ++ * last booted kernel which has rmo_top as 512 MB. Also, if the ++ * reboot is detected as a CAS reboot, the GRUB will skip the CAS ++ * call. As the CAS has already been called earlier, so it is ++ * not required to call CAS even if the other conditions are met. ++ * This condition will also prevent a scenario where the machine ++ * get stuck in the CAS reboot loop while booting. A machine with ++ * an older kernel, having option_vector2 MIN_RMA as 512 MB in ++ * Linux prom_init.c and GRUB uses "rmo_top < 768 MB" condition ++ * for calling CAS. Due to their respective conditions, linux ++ * CAS and GRUB CAS will keep doing the CAS calls and change ++ * the MIN_RMA from 768(changed by GRUB) to 512(changed by Linux) ++ * to 768(changed by GRUB) to 512(changed by Linux) and so on, ++ * and the machine will stuck in this CAS reboot loop forever. ++ * IBM PAPR : https://openpower.foundation/specifications/linuxonpower/ ++ */ ++ if (!ibm_ca_support_reboot && err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) ++ grub_ieee1275_ibm_cas (); + } + #endif + diff --git a/0362-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch b/0362-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch new file mode 100644 index 0000000..92da026 --- /dev/null +++ b/0362-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 19 Mar 2025 17:39:41 +0100 +Subject: [PATCH] ieee1275/ofnet: Fix grub_malloc() removed after added safe + math functions + +grub_malloc() has been inadvertently removed from the ieee1275/ofnet +code after it has been modified to use safe match function. + +Fixes: 4beeff8a (net: Use safe math macros to prevent overflows) + +Tested-by: Marta Lewandowska +Reviewed-by: Daniel Kiper +Signed-off-by: Nicolas Frayer +--- + grub-core/net/drivers/ieee1275/ofnet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index 3e1b9094e2ab..37bc82467f60 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -463,6 +463,9 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + return 0; + } + } ++ ++ ofdata->path = grub_malloc(sz); ++ + if (!ofdata->path) + { + grub_print_error (); diff --git a/0363-disk-diskfilter-Introduce-the-cryptocheck-command.patch b/0363-disk-diskfilter-Introduce-the-cryptocheck-command.patch deleted file mode 100644 index 7048b66..0000000 --- a/0363-disk-diskfilter-Introduce-the-cryptocheck-command.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Sun, 2 Mar 2025 18:08:22 +0300 -Subject: [PATCH] disk/diskfilter: Introduce the "cryptocheck" command - -This command examines a given diskfilter device, e.g., an LVM disk, -and checks if underlying disks, physical volumes, are cryptodisks, -e.g., LUKS disks, this layout is called "LVM-on-LUKS". - -The return value is 0 when all underlying disks (of a given device) -are cryptodisks (1 if at least one disk is unencrypted or in an -unknown state). - -Users are encouraged to include the relevant check before loading -anything from an LVM disk that is supposed to be encrypted. - -This further supports the CLI authentication, blocking bypass -attempts when booting from an encrypted LVM disk. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- -grub-core/disk/diskfilter.c | 75 +++++++++++++++++++++++++++++++++++++ - 1 file changed, 75 insertions(+) - -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index c7c2f0f..853d662 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1530,6 +1531,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk, - } - #endif - -+static int -+grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt) -+{ -+ struct grub_diskfilter_lv *lv = disk->data; -+ struct grub_diskfilter_pv *pv; -+ -+ *pvs_cnt = 0; -+ -+ if (lv->vg->pvs) -+ for (pv = lv->vg->pvs; pv; pv = pv->next) -+ { -+ (*pvs_cnt)++; -+ -+ if (pv->disk == NULL) -+ { -+ /* Can be a partially activated VG, bail out. */ -+ return GRUB_ERR_TEST_FAILURE; -+ } -+ -+ if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ /* All backing devices must be cryptodisks, stop. */ -+ return GRUB_ERR_TEST_FAILURE; -+ } -+ } -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char **args) -+{ -+ grub_disk_t disk; -+ int check_pvs_res; -+ int namelen; -+ int pvs_cnt; -+ -+ if (argc != 1) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); -+ -+ namelen = grub_strlen (args[0]); -+ if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')')) -+ args[0][namelen - 1] = 0; -+ else -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"), -+ args[0]); -+ -+ if (!is_valid_diskfilter_name (&args[0][1])) -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk: %s"), -+ &args[0][1]); -+ -+ disk = grub_disk_open (&args[0][1]); -+ if (disk == NULL) -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"), -+ &args[0][1]); -+ -+ check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); -+ grub_disk_close (disk); -+ -+ grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -+ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -+ pvs_cnt, -+ (pvs_cnt > 1) ? "s" : ""); -+ -+ return check_pvs_res; -+} -+ - static struct grub_disk_dev grub_diskfilter_dev = - { - .name = "diskfilter", -@@ -1546,14 +1614,21 @@ static struct grub_disk_dev grub_diskfilter_dev = - .next = 0 - }; - -+static grub_command_t cmd; -+ - - GRUB_MOD_INIT(diskfilter) - { - grub_disk_dev_register (&grub_diskfilter_dev); -+ cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, -+ N_("DEVICE"), -+ N_("Check if a logical volume resides on encrypted disks.")); - } - - GRUB_MOD_FINI(diskfilter) - { - grub_disk_dev_unregister (&grub_diskfilter_dev); -+ if (cmd != NULL) -+ grub_unregister_command (cmd); - free_array (); - } --- -2.41.1 - diff --git a/0279-grub-mkimage-Create-new-ELF-note-for-SBAT.patch b/0363-grub-mkimage-Create-new-ELF-note-for-SBAT.patch similarity index 60% rename from 0279-grub-mkimage-Create-new-ELF-note-for-SBAT.patch rename to 0363-grub-mkimage-Create-new-ELF-note-for-SBAT.patch index 2c19d4f..25023c8 100644 --- a/0279-grub-mkimage-Create-new-ELF-note-for-SBAT.patch +++ b/0363-grub-mkimage-Create-new-ELF-note-for-SBAT.patch @@ -1,7 +1,7 @@ -From 4b72282b1e093b75ca45bed63705357d5a472fc4 Mon Sep 17 00:00:00 2001 -From: nilusyi -Date: Thu, 26 Dec 2024 19:22:41 +0800 -Subject: [PATCH 3/4] grub-mkimage: Create new ELF note for SBAT +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Sudhakar Kuppusamy +Date: Wed, 23 Oct 2024 17:54:32 +0530 +Subject: [PATCH] grub-mkimage: Create new ELF note for SBAT In order to store the SBAT data we create a new ELF note. The string ".sbat", zero-padded to 4 byte alignment, shall be entered in the name @@ -12,13 +12,13 @@ Signed-off-by: Daniel Axtens Signed-off-by: Sudhakar Kuppusamy Reviewed-by: Daniel Kiper --- - include/grub/util/mkimage.h | 4 +- - util/grub-mkimagexx.c | 90 +++++++++++++++++++++++++++---------- - util/mkimage.c | 5 ++- - 3 files changed, 71 insertions(+), 28 deletions(-) + include/grub/util/mkimage.h | 4 ++-- + util/grub-mkimagexx.c | 48 +++++++++++++++++++++++++++++++++++++++++++-- + util/mkimage.c | 5 +++-- + 3 files changed, 51 insertions(+), 6 deletions(-) diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h -index 6f1da89b9..881e3031f 100644 +index 6f1da89b9b65..881e3031f41f 100644 --- a/include/grub/util/mkimage.h +++ b/include/grub/util/mkimage.h @@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, @@ -37,7 +37,7 @@ index 6f1da89b9..881e3031f 100644 struct grub_mkimage_layout *layout); diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c -index 9488f0525..1713a086c 100644 +index 9488f052510a..b9930544889d 100644 --- a/util/grub-mkimagexx.c +++ b/util/grub-mkimagexx.c @@ -116,6 +116,14 @@ struct section_metadata @@ -64,7 +64,7 @@ index 9488f0525..1713a086c 100644 Elf_Addr target_addr, struct grub_mkimage_layout *layout) { -@@ -226,11 +234,16 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc +@@ -226,10 +234,17 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc Elf_Ehdr *ehdr; Elf_Phdr *phdr; Elf_Shdr *shdr; @@ -73,17 +73,17 @@ index 9488f0525..1713a086c 100644 int phnum = 1; int shnum = 4; int string_size = sizeof (".text") + sizeof ("mods") + 1; -- + char *footer; ++ + if (sbat) + { + phnum++; + footer_size += ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); + } + if (appsig_size) { - phnum++; -@@ -263,6 +276,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc +@@ -263,6 +278,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc ehdr = (void *) elf_img; phdr = (void *) (elf_img + sizeof (*ehdr)); shdr = (void *) (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr)); @@ -91,57 +91,37 @@ index 9488f0525..1713a086c 100644 memcpy (ehdr->e_ident, ELFMAG, SELFMAG); ehdr->e_ident[EI_CLASS] = ELFCLASSXX; if (!image_target->bigendian) -@@ -435,6 +449,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc +@@ -435,6 +451,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (XEN_NOTE_SIZE); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = ptr; -+ footer_offset = XEN_NOTE_SIZE; ++ footer = ptr; ++ footer_offset = XEN_NOTE_SIZE; } if (image_target->id == IMAGE_XEN_PVH) -@@ -468,6 +484,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc +@@ -468,6 +486,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (XEN_PVH_NOTE_SIZE); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = ptr; -+ footer_offset = XEN_PVH_NOTE_SIZE; ++ footer = ptr; ++ footer_offset = XEN_PVH_NOTE_SIZE; } if (note) -@@ -498,29 +516,53 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc +@@ -498,6 +518,30 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc phdr->p_filesz = grub_host_to_target32 (note_size); phdr->p_memsz = 0; phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = (elf_img + program_size + header_size + note_size); -+ footer_offset += note_size; - } ++ footer = (elf_img + program_size + header_size + note_size); ++ footer_offset += note_size; ++ } ++ + if (sbat) + { + int note_size = ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); + struct grub_sbat_note *note_ptr = (struct grub_sbat_note *) footer; - -- if (appsig_size) { -- int note_size = ALIGN_UP(sizeof (struct grub_appended_signature_note) + appsig_size, 4); -- struct grub_appended_signature_note *note_ptr = (struct grub_appended_signature_note *) -- (elf_img + program_size + header_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); -- -- note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_APPENDED_SIGNATURE_NOTE_NAME)); -- /* needs to sit at the end, so we round this up and sign some zero padding */ -- note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(appsig_size, 4)); -- note_ptr->header.n_type = grub_host_to_target32 (GRUB_APPENDED_SIGNATURE_NOTE_TYPE); -- strcpy (note_ptr->name, GRUB_APPENDED_SIGNATURE_NOTE_NAME); -- -- phdr++; -- phdr->p_type = grub_host_to_target32 (PT_NOTE); -- phdr->p_flags = grub_host_to_target32 (PF_R); -- phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); -- phdr->p_vaddr = 0; -- phdr->p_paddr = 0; -- phdr->p_filesz = grub_host_to_target32 (note_size); -- phdr->p_memsz = 0; -- phdr->p_offset = grub_host_to_target32 (header_size + program_size + (note ? sizeof (struct grub_ieee1275_note) : 0)); -- } ++ + note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_SBAT_NOTE_NAME)); + note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(layout->sbat_size, 4)); + note_ptr->header.n_type = grub_host_to_target32 (GRUB_SBAT_NOTE_TYPE); @@ -157,46 +137,22 @@ index 9488f0525..1713a086c 100644 + phdr->p_filesz = grub_host_to_target32 (note_size); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); -+ -+ footer += note_size; -+ footer_offset += note_size; -+ } -+ if (appsig_size) -+ { -+ int note_size = ALIGN_UP (sizeof (struct grub_appended_signature_note) + appsig_size, 4); -+ struct grub_appended_signature_note *note_ptr = (struct grub_appended_signature_note *)footer; -+ note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_APPENDED_SIGNATURE_NOTE_NAME)); -+ /* needs to sit at the end, so we round this up and sign some zero padding */ -+ note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP (appsig_size, 4)); -+ note_ptr->header.n_type = grub_host_to_target32 (GRUB_APPENDED_SIGNATURE_NOTE_TYPE); -+ strcpy (note_ptr->name, GRUB_APPENDED_SIGNATURE_NOTE_NAME); -+ -+ phdr++; -+ phdr->p_type = grub_host_to_target32 (PT_NOTE); -+ phdr->p_flags = grub_host_to_target32 (PF_R); -+ phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); -+ phdr->p_vaddr = 0; -+ phdr->p_paddr = 0; -+ phdr->p_filesz = grub_host_to_target32 (note_size); -+ phdr->p_memsz = 0; -+ phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); -+ } + } - { - char *str_start = (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr) + if (appsig_size) { diff --git a/util/mkimage.c b/util/mkimage.c -index 0737935fd..39899282b 100644 +index f31fdefa814a..7fa6a7b21954 100644 --- a/util/mkimage.c +++ b/util/mkimage.c -@@ -1835,6 +1835,7 @@ grub_install_generate_image (const char *dir, const char *prefix, +@@ -1848,6 +1848,7 @@ grub_install_generate_image (const char *dir, const char *prefix, case IMAGE_I386_IEEE1275: { grub_uint64_t target_addr; -+ char *sbat = NULL; ++ char *sbat = NULL; if (image_target->id == IMAGE_LOONGSON_ELF) { if (comp == GRUB_COMPRESSION_NONE) -@@ -1846,10 +1847,10 @@ grub_install_generate_image (const char *dir, const char *prefix, +@@ -1859,10 +1860,10 @@ grub_install_generate_image (const char *dir, const char *prefix, else target_addr = image_target->link_addr; if (image_target->voidp_sizeof == 4) @@ -209,6 +165,3 @@ index 0737935fd..39899282b 100644 &core_size, target_addr, &layout); } break; --- -2.41.1 - diff --git a/0364-commands-search-Add-the-diskfilter-support.patch b/0364-commands-search-Add-the-diskfilter-support.patch deleted file mode 100644 index 2a4916a..0000000 --- a/0364-commands-search-Add-the-diskfilter-support.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Sun, 2 Mar 2025 23:32:43 +0300 -Subject: [PATCH] commands/search: Add the diskfilter support - -When the --cryptodisk-only argument is given, also check the target -device using the "cryptocheck" command, if available. - -This extends the checks to common layouts like LVM-on-LUKS, so the ---cryptodisk-only argument transparently handles such setups. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/commands/search.c | 33 ++++++++++++++++++++++++++++++++- - 1 file changed, 32 insertions(+), 1 deletion(-) - -diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index 660f06b..26bb31f 100644 ---- a/grub-core/commands/search.c -+++ b/grub-core/commands/search.c -@@ -54,6 +54,37 @@ struct search_ctx - int is_cache; - }; - -+static bool -+is_unencrypted_disk (grub_disk_t disk) -+{ -+ grub_command_t cmd; -+ char *disk_str; -+ int disk_str_len; -+ int res; -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ return false; /* This is (crypto) disk. */ -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) -+ { -+ cmd = grub_command_find ("cryptocheck"); -+ if (cmd == NULL) /* No diskfilter module loaded for some reason. */ -+ return true; -+ -+ disk_str_len = grub_strlen (disk->name) + 2 + 1; -+ disk_str = grub_malloc (disk_str_len); -+ if (disk_str == NULL) /* Something is wrong, better report as unencrypted. */ -+ return true; -+ -+ grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); -+ res = cmd->func (cmd, 1, &disk_str); -+ grub_free (disk_str); -+ return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ -+ } -+ return true; -+} -+ -+ - /* Helper for FUNC_NAME. */ - static int - iterate_device (const char *name, void *data) -@@ -97,7 +128,7 @@ iterate_device (const char *name, void *data) - grub_errno = GRUB_ERR_NONE; - return 0; - } -- if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true) - { - grub_device_close (dev); - grub_errno = GRUB_ERR_NONE; --- -2.41.1 - diff --git a/0364-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch b/0364-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch new file mode 100644 index 0000000..1ce74ae --- /dev/null +++ b/0364-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Sudhakar Kuppusamy +Date: Wed, 23 Oct 2024 17:54:33 +0530 +Subject: [PATCH] grub-mkimage: Add SBAT metadata into ELF note for PowerPC + targets + +The SBAT metadata is read from CSV file and transformed into an ELF note +with the -s option. + +Signed-off-by: Daniel Axtens +Signed-off-by: Sudhakar Kuppusamy +Reviewed-by: Daniel Kiper +--- + util/mkimage.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/util/mkimage.c b/util/mkimage.c +index 7fa6a7b21954..f92949d1df25 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -957,8 +957,8 @@ grub_install_generate_image (const char *dir, const char *prefix, + total_module_size += dtb_size + sizeof (struct grub_module_header); + } + +- if (sbat_path != NULL && image_target->id != IMAGE_EFI) +- grub_util_error (_(".sbat section can be embedded into EFI images only")); ++ if (sbat_path != NULL && (image_target->id != IMAGE_EFI && image_target->id != IMAGE_PPC)) ++ grub_util_error (_("SBAT data can be added only to EFI or powerpc-ieee1275 images")); + + if (disable_shim_lock) + total_module_size += sizeof (struct grub_module_header); +@@ -1849,6 +1849,13 @@ grub_install_generate_image (const char *dir, const char *prefix, + { + grub_uint64_t target_addr; + char *sbat = NULL; ++ if (sbat_path != NULL) ++ { ++ sbat_size = grub_util_get_image_size (sbat_path); ++ sbat = xmalloc (sbat_size); ++ grub_util_load_image (sbat_path, sbat); ++ layout.sbat_size = sbat_size; ++ } + if (image_target->id == IMAGE_LOONGSON_ELF) + { + if (comp == GRUB_COMPRESSION_NONE) diff --git a/0365-docs-Document-available-crypto-disks-checks.patch b/0365-docs-Document-available-crypto-disks-checks.patch deleted file mode 100644 index ab3cd08..0000000 --- a/0365-docs-Document-available-crypto-disks-checks.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Mon, 10 Mar 2025 15:33:46 +0300 -Subject: [PATCH] docs: Document available crypto disks checks - -Document the --cryptodisk-only argument. Also, document the -"cryptocheck" command invoked when that argument is processed. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 23 ++++++++++++++++++++++- - 1 file changed, 22 insertions(+), 1 deletion(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index de03d5a..4ff0f2b 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4383,6 +4383,7 @@ you forget a command, you can run the command @command{help} - * configfile:: Load a configuration file - * cpuid:: Check for CPU features - * crc:: Compute or check CRC32 checksums -+* cryptocheck:: Check if a device is encrypted - * cryptomount:: Mount a crypto device - * cutmem:: Remove memory regions - * date:: Display or set current date and time -@@ -4692,6 +4693,16 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} - (@pxref{hashsum}) for full description. - @end deffn - -+@node cryptocheck -+@subsection cryptocheck -+ -+@deffn Command cryptocheck device -+Check if a given diskfilter device is backed by encrypted devices -+(@pxref{cryptomount} for additional information). -+ -+The command examines all backing devices, physical volumes, of a specified -+logical volume, like LVM2, and fails when at least one of them is unencrypted. -+@end deffn - - @node cryptomount - @subsection cryptomount -@@ -5539,7 +5550,8 @@ unbootable. @xref{Using GPG-style digital signatures}, for more information. - - @deffn Command search @ - [@option{--file}|@option{--label}|@option{--fs-uuid}] @ -- [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}] name -+ [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}|@option{--cryptodisk-only}] @ -+ name - Search devices by file (@option{-f}, @option{--file}), filesystem label - (@option{-l}, @option{--label}), or filesystem UUID (@option{-u}, - @option{--fs-uuid}). -@@ -5554,6 +5566,15 @@ devices, which can be slow. - The (@option{--efidisk-only}) option prevents searching any other devices then - EFI disks. This is typically used when chainloading to local EFI partition. - -+The (@option{--cryptodisk-only}) option prevents searching any devices other -+than encrypted disks. This is typically used when booting from an encrypted -+file system to ensure that no code gets executed from an unencrypted device -+having the same filesystem UUID or label. -+ -+This option implicitly invokes the command @command{cryptocheck}, if it is -+available (@pxref{cryptocheck} for additional information). -+ -+ - The @samp{search.file}, @samp{search.fs_label}, and @samp{search.fs_uuid} - commands are aliases for @samp{search --file}, @samp{search --label}, and - @samp{search --fs-uuid} respectively. --- -2.41.1 - diff --git a/0365-loader-efi-Fix-RISC-V-build.patch b/0365-loader-efi-Fix-RISC-V-build.patch new file mode 100644 index 0000000..91ccb60 --- /dev/null +++ b/0365-loader-efi-Fix-RISC-V-build.patch @@ -0,0 +1,72 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrea Bolognani +Date: Tue, 19 Nov 2024 15:42:01 +0000 +Subject: [PATCH] loader/efi: Fix RISC-V build + +Some struct definitions are currently limited to 32-bit and +64-bit Arm architectures, but they actually apply to other +architectures as well, specifically 32-bit and 64-bit RISC-V +respectively. + +Update the preprocessor checks guarding their definition, and +change their names to make them more accurate by replacing the +word "arm" with the word "efi". + +Signed-off-by: Andrea Bolognani +--- + grub-core/loader/efi/linux.c | 2 +- + include/grub/efi/efi.h | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index 5889e3f36f8..ef55556f2d9 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -684,7 +684,7 @@ parse_pe_header (void *kernel, grub_uint64_t *total_size, + grub_uint32_t *alignment, grub_uint32_t *code_size) + { + struct linux_arch_kernel_header *lh = kernel; +- struct grub_armxx_linux_pe_header *pe; ++ struct grub_efixx_linux_pe_header *pe; + grub_uint16_t i; + struct grub_pe32_section_table *sections; + +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index 7eed1bd791d..81daf6bead1 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -36,28 +36,28 @@ struct linux_arch_kernel_header { + struct grub_pe_image_header pe_image_header; + }; + +-struct grub_arm_linux_pe_header ++struct grub_efi32_linux_pe_header + { + grub_uint32_t magic; + struct grub_pe32_coff_header coff; + struct grub_pe32_optional_header opt; + }; + +-struct grub_arm64_linux_pe_header ++struct grub_efi64_linux_pe_header + { + grub_uint32_t magic; + struct grub_pe32_coff_header coff; + struct grub_pe64_optional_header opt; + }; + +-#if defined(__arm__) ++#if defined(__arm__) || (defined(__riscv) && (__riscv_xlen == 32)) + # define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE32_MAGIC +-# define grub_armxx_linux_pe_header grub_arm_linux_pe_header ++# define grub_efixx_linux_pe_header grub_efi32_linux_pe_header + #endif + +-#if defined(__aarch64__) ++#if defined(__aarch64__) || (defined(__riscv) && (__riscv_xlen == 64)) + # define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE64_MAGIC +-# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header ++# define grub_efixx_linux_pe_header grub_efi64_linux_pe_header + #endif + + #define GRUB_EFI_GRUB_VARIABLE_GUID \ diff --git a/0366-disk-cryptodisk-Add-the-erase-secrets-function.patch b/0366-disk-cryptodisk-Add-the-erase-secrets-function.patch deleted file mode 100644 index 6e21c6f..0000000 --- a/0366-disk-cryptodisk-Add-the-erase-secrets-function.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Tue, 6 May 2025 12:25:20 -0600 -Subject: [PATCH] disk/cryptodisk: Add the "erase secrets" function - -This commit adds the grub_cryptodisk_erasesecrets() function to wipe -master keys from all cryptodisks. This function is EFI-only. - -Since there is no easy way to "force unmount" a given encrypted disk, -this function renders all mounted cryptodisks unusable. An attempt to -read them will return garbage. - -This is why this function must be used in "no way back" conditions. - -Currently, it is used when unloading the cryptodisk module and when -performing the "exit" command (it is often used to switch to the next -EFI application). This function is not called when performing the -"chainloader" command, because the callee may return to GRUB. For this -reason, users are encouraged to use "exit" instead of "chainloader" to -execute third-party boot applications. - -This function does not guarantee that all secrets are wiped from RAM. -Console output, chunks from disk read requests and other may remain. - -This function does not clear the IV prefix and rekey key for geli disks. - -Also, this commit adds the relevant documentation improvements. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 6 ++++++ - grub-core/commands/minicmd.c | 12 ++++++++++++ - grub-core/disk/cryptodisk.c | 28 ++++++++++++++++++++++++++++ - include/grub/cryptodisk.h | 1 + - 4 files changed, 47 insertions(+) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 4ff0f2b..48a0631 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4739,6 +4739,11 @@ namespace in addition to the cryptodisk namespace. - - Support for plain encryption mode (plain dm-crypt) is provided via separate - @command{@pxref{plainmount}} command. -+ -+On the EFI platform, GRUB tries to erase master keys from memory when the cryptodisk -+module is unloaded or the command @command{exit} is executed. All secrets remain in -+memory when the command @command{chainloader} is issued, because execution can -+return to GRUB on the EFI platform. - @end deffn - - @node cutmem -@@ -6966,6 +6971,7 @@ USB support provides benefits similar to ATA (for USB disks) or AT (for USB - keyboards). In addition it allows USBserial. - - Chainloading refers to the ability to load another bootloader through the same protocol -+and on some platforms, like EFI, allow that bootloader to return to the GRUB. - - Hints allow faster disk discovery by already knowing in advance which is the disk in - question. On some platforms hints are correct unless you move the disk between boots. -diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c -index 84775cc..1353188 100644 ---- a/grub-core/commands/minicmd.c -+++ b/grub-core/commands/minicmd.c -@@ -29,6 +29,11 @@ - #include - #include - -+#ifdef GRUB_MACHINE_EFI -+#include -+#endif -+ -+ - GRUB_MOD_LICENSE ("GPLv3+"); - - /* cat FILE */ -@@ -193,6 +198,13 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)), - int argc __attribute__ ((unused)), - char *argv[] __attribute__ ((unused))) - { -+#ifdef GRUB_MACHINE_EFI -+ /* -+ * The "exit" command is often used to launch the next boot application. -+ * So, erase the secrets. -+ */ -+ grub_cryptodisk_erasesecrets (); -+#endif - grub_exit (); - /* Not reached. */ - } -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 37f0654..06f3665 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1893,6 +1893,31 @@ grub_cryptodisk_challenge_password (void) - - return GRUB_ERR_NONE; - } -+ -+void -+grub_cryptodisk_erasesecrets (void) -+{ -+ grub_cryptodisk_t i; -+ grub_uint8_t *buf; -+ -+ buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN); -+ if (buf == NULL) -+ grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory"); -+ -+ for (i = cryptodisk_list; i != NULL; i = i->next) -+ if (grub_cryptodisk_setkey (i, buf, i->keysize)) -+ grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for %s", i->source); -+ else -+ grub_printf ("Erased crypto secrets for %s\n", i->source); -+ /* -+ * Unfortunately, there is no way to "force unmount" a given disk, it may -+ * have mounted "child" disks as well, e.g., an LVM volume. So, this -+ * function MUST be called when there is no way back, e.g., when exiting. -+ * Otherwise, subsequent read calls for a cryptodisk will return garbage. -+ */ -+ -+ grub_free (buf); -+} - #endif /* GRUB_MACHINE_EFI */ - - struct grub_procfs_entry luks_script = -@@ -1917,6 +1942,9 @@ GRUB_MOD_INIT (cryptodisk) - - GRUB_MOD_FINI (cryptodisk) - { -+#ifdef GRUB_MACHINE_EFI -+ grub_cryptodisk_erasesecrets (); -+#endif - grub_disk_dev_unregister (&grub_cryptodisk_dev); - cryptodisk_cleanup (); - grub_unregister_extcmd (cmd); -diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h -index a740883..4cccd46 100644 ---- a/include/grub/cryptodisk.h -+++ b/include/grub/cryptodisk.h -@@ -204,6 +204,7 @@ grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid); - grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); - #ifdef GRUB_MACHINE_EFI - grub_err_t grub_cryptodisk_challenge_password (void); -+void grub_cryptodisk_erasesecrets (void); - #endif - - struct grub_secret_entry { --- -2.41.1 - diff --git a/0285-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch b/0366-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch similarity index 93% rename from 0285-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch rename to 0366-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch index 8507baf..c38e333 100644 --- a/0285-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch +++ b/0366-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch @@ -1,4 +1,4 @@ -From c5ae124e11f28f637cbd38cb4d6c1b9817baa135 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Mon, 12 Aug 2024 16:13:18 +0200 Subject: [PATCH] kern/riscv/efi/init: Use time register in @@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/grub-core/kern/riscv/efi/init.c b/grub-core/kern/riscv/efi/init.c -index 38795fe67..0d7de4f54 100644 +index 38795fe6741..0d7de4f541a 100644 --- a/grub-core/kern/riscv/efi/init.c +++ b/grub-core/kern/riscv/efi/init.c @@ -33,16 +33,15 @@ grub_efi_get_time_ms (void) diff --git a/0284-Use-medany-instead-of-large-model-for-RISCV.patch b/0367-Use-medany-instead-of-large-model-for-RISCV.patch similarity index 97% rename from 0284-Use-medany-instead-of-large-model-for-RISCV.patch rename to 0367-Use-medany-instead-of-large-model-for-RISCV.patch index 4bfd468..37540c4 100644 --- a/0284-Use-medany-instead-of-large-model-for-RISCV.patch +++ b/0367-Use-medany-instead-of-large-model-for-RISCV.patch @@ -9,7 +9,7 @@ Signed-off-by: Jason Montleon 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac -index d223fe3ef6e..6a6688e362a 100644 +index 4788f3d6adc..a6a6957fbdb 100644 --- a/configure.ac +++ b/configure.ac @@ -1313,7 +1313,7 @@ AC_SUBST(TARGET_LDFLAGS_OLDMAGIC) diff --git a/0367-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch b/0367-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch deleted file mode 100644 index d3aafae..0000000 --- a/0367-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Tue, 4 Mar 2025 15:27:59 +0300 -Subject: [PATCH] disk/cryptodisk: Wipe the passphrase from memory - -Switching to another EFI boot application while there are secrets in -RAM is dangerous, because not all firmware is wiping memory on free. - -To reduce the attack surface, wipe the passphrase acquired when -unlocking an encrypted volume. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/disk/cryptodisk.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 06f3665..09fb6cb 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1296,6 +1296,7 @@ grub_cryptodisk_scan_device_real (const char *name, - #endif - if (askpass) - { -+ grub_memset (cargs->key_data, 0, cargs->key_len); - cargs->key_len = 0; - grub_free (cargs->key_data); - } --- -2.41.1 \ No newline at end of file diff --git a/0368-10_linux.in-escape-kernel-option-characters-properly.patch b/0368-10_linux.in-escape-kernel-option-characters-properly.patch new file mode 100644 index 0000000..1937cb9 --- /dev/null +++ b/0368-10_linux.in-escape-kernel-option-characters-properly.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:23:37 -0600 +Subject: [PATCH] 10_linux.in: escape kernel option characters properly + +This handles cases where kernel options, specifically the values, +contain special characters, in this case ';', '&' and '$'. + +For example, the user defines the following GRUB_CMDLINE_LINUX on the +default grub file /etc/default/grub, note the dolar sign on the 'memmap' +option + + GRUB_CMDLINE_LINUX="console=ttyS0 memmap=32g\\\$0x2000000000" + +then regenerating the grub cfg and BLS options line with the +grub2-mkconfig command, resulting into + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g\$0x2000000000 + +without this patch, we would end up with + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g$0x2000000000 + +Note the missing '\' which is required to escape the '$', otherwise +it would be consider a variable by blscfg parser which is not the case. + +Signed-off-by: Leo Sandoval +--- + util/grub.d/10_linux.in | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index fafdfbc4d3..4276d5e240 100755 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -180,6 +180,7 @@ update_bls_cmdline() + options="$(echo "${options}" | sed -e 's/\//\\\//g')" + options="$(echo "${options}" | sed -e 's/\;/\\\;/g')" + options="$(echo "${options}" | sed -e 's/\\&/\\\\&/g')" ++ options="$(echo "${options}" | sed -e 's/\$/\\\$/g')" + sed -i -e "s/^options.*/options ${options}/" "${blsdir}/${bls}.conf" + done + } diff --git a/0368-cryptocheck-Add-quiet-option.patch b/0368-cryptocheck-Add-quiet-option.patch deleted file mode 100644 index e6f8ef4..0000000 --- a/0368-cryptocheck-Add-quiet-option.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 14 Mar 2025 19:03:39 +0800 -Subject: [PATCH] cryptocheck: Add --quiet option - -The option can be used to suppress output if we only want to test the -return value of the command. - -Also, mention this option in the documentation. - -Signed-off-by: Michael Chang -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 4 +++- - grub-core/commands/search.c | 7 ++++++- - grub-core/disk/diskfilter.c | 24 +++++++++++++++++++----- - 3 files changed, 28 insertions(+), 7 deletions(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 48a0631..cbd9c32 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4696,12 +4696,14 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} - @node cryptocheck - @subsection cryptocheck - --@deffn Command cryptocheck device -+@deffn Command cryptocheck [ @option{--quiet} ] device - Check if a given diskfilter device is backed by encrypted devices - (@pxref{cryptomount} for additional information). - - The command examines all backing devices, physical volumes, of a specified - logical volume, like LVM2, and fails when at least one of them is unencrypted. -+ -+The option @option{--quiet} can be given to suppress the output. - @end deffn - - @node cryptomount -diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index 26bb31f..7d0604f 100644 ---- a/grub-core/commands/search.c -+++ b/grub-core/commands/search.c -@@ -67,6 +67,9 @@ is_unencrypted_disk (grub_disk_t disk) - - if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) - { -+ char opt[] = "--quiet"; -+ char *args[2]; -+ - cmd = grub_command_find ("cryptocheck"); - if (cmd == NULL) /* No diskfilter module loaded for some reason. */ - return true; -@@ -77,7 +80,9 @@ is_unencrypted_disk (grub_disk_t disk) - return true; - - grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); -- res = cmd->func (cmd, 1, &disk_str); -+ args[0] = opt; -+ args[1] = disk_str; -+ res = cmd->func (cmd, 2, args); - grub_free (disk_str); - return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ - } -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 853d662..6ff4268 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -1567,6 +1567,19 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), - int check_pvs_res; - int namelen; - int pvs_cnt; -+ int opt_quiet = 0; -+ -+ if (argc == 2) -+ { -+ if (grub_strcmp (args[0], "--quiet") == 0) -+ { -+ opt_quiet = 1; -+ argc--; -+ args++; -+ } -+ else -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unrecognized option: %s"), args[0]); -+ } - - if (argc != 1) - return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); -@@ -1590,10 +1603,11 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), - check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); - grub_disk_close (disk); - -- grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -- (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -- pvs_cnt, -- (pvs_cnt > 1) ? "s" : ""); -+ if (!opt_quiet) -+ grub_printf ("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -+ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -+ pvs_cnt, -+ (pvs_cnt > 1) ? "s" : ""); - - return check_pvs_res; - } -@@ -1621,7 +1635,7 @@ GRUB_MOD_INIT(diskfilter) - { - grub_disk_dev_register (&grub_diskfilter_dev); - cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, -- N_("DEVICE"), -+ N_("[--quiet] DEVICE"), - N_("Check if a logical volume resides on encrypted disks.")); - } - --- -2.41.1 - diff --git a/0369-blscfg-check-if-variable-is-escaped-before-consideri.patch b/0369-blscfg-check-if-variable-is-escaped-before-consideri.patch new file mode 100644 index 0000000..fba6906 --- /dev/null +++ b/0369-blscfg-check-if-variable-is-escaped-before-consideri.patch @@ -0,0 +1,26 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:49:47 -0600 +Subject: [PATCH] blscfg: check if variable is escaped before considering one + +Otherwise escaped variables are considered real variables. + +Signed-off-by: Leo Sandoval +--- + grub-core/commands/blscfg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 6e398fc175..5d931b0c9b 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -695,7 +695,8 @@ static char *expand_val(const char *value) + return NULL; + + while (*value) { +- if (*value == '$') { ++ /* It's a variable only when *value is '$' and it is not escaped with '\'*/ ++ if (*value == '$' && *end != '\\') { + if (start != end) { + buffer = field_append(is_var, buffer, start, end); + if (!buffer) diff --git a/0370-Set-correctly-the-memory-attributes-for-the-kernel-P.patch b/0370-Set-correctly-the-memory-attributes-for-the-kernel-P.patch new file mode 100644 index 0000000..b7d640a --- /dev/null +++ b/0370-Set-correctly-the-memory-attributes-for-the-kernel-P.patch @@ -0,0 +1,293 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 16 Jul 2025 12:38:24 -0600 +Subject: [PATCH] Set correctly the memory attributes for the kernel PE + sections + +Currently the whole kernel memory region is set to RO, so at some +point when execution is passed to the kernel, the latter faults on a +memory write access, e.g. zeroing .bss section. The proposed change +sets the memory attribute appropriately for each kernel PE section. + +Signed-off-by: Leo Sandoval +--- + grub-core/loader/efi/linux.c | 170 +++++++++++++++++++++++++++----------- + grub-core/loader/i386/efi/linux.c | 5 +- + include/grub/efi/linux.h | 6 ++ + 3 files changed, 134 insertions(+), 47 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index efceb9b6dd..159bd9dc48 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -203,22 +204,133 @@ grub_efi_check_nx_required (int *nx_required) + typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); + + grub_err_t +-grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, ++grub_efi_mem_set_att(grub_addr_t k_address, grub_size_t k_size, ++ grub_size_t k_start, int nx_supported) ++{ ++ grub_addr_t k_start_address = k_address + k_start; ++ ++ grub_uint64_t default_set_attrs = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X; ++ grub_uint64_t default_clear_attrs = 0; ++ grub_uint64_t stack_set_attrs = default_set_attrs; ++ grub_uint64_t stack_clear_attrs = default_clear_attrs; ++ grub_uint64_t kernel_set_attrs = default_set_attrs; ++ grub_uint64_t kernel_clear_attrs = default_clear_attrs; ++ grub_uint64_t attrs; ++ ++ struct grub_msdos_image_header *header; ++ struct grub_pe_image_header *pe_image_header; ++ struct grub_pe32_coff_header *coff_header; ++ struct grub_pe32_section_table *section, *sections; ++ grub_uint16_t i; ++ grub_size_t sz; ++ ++ header = (struct grub_msdos_image_header *)k_address; ++ ++ if (grub_add ((grub_addr_t) header, header->pe_image_header_offset, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE image header address calculation")); ++ ++ pe_image_header = (struct grub_pe_image_header *) (sz); ++ ++ if (pe_image_header > (k_address + k_size)) ++ return grub_error (GRUB_ERR_BAD_OS, N_("PE image header address is invalid")); ++ ++ if (grub_memcmp (pe_image_header->signature, GRUB_PE32_SIGNATURE, ++ GRUB_PE32_SIGNATURE_SIZE) != 0) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel PE magic is invalid")); ++ ++ coff_header = &(pe_image_header->coff_header); ++ grub_dprintf ("nx", "coff_header 0x%"PRIxGRUB_ADDR" machine %08x\n", (grub_addr_t)coff_header, coff_header->machine); ++ ++ if (grub_add ((grub_addr_t) coff_header, sizeof (*coff_header), &sz) || ++ grub_add (sz, coff_header->optional_header_size, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE sections calculation")); ++ ++ sections = (struct grub_pe32_section_table *) (sz); ++ ++ if (sections > (k_address + k_size)) ++ return grub_error (GRUB_ERR_BAD_OS, N_("Section address is invalid")); ++ ++ /* Parse the PE, remove W for code section, remove X for data sections, RO for the rest */ ++ for (i = 0, section = sections; i < coff_header->num_sections; i++, section++) ++ { ++ kernel_set_attrs = default_set_attrs; ++ kernel_clear_attrs = default_clear_attrs; ++ ++ if (nx_supported) ++ { ++ if (section->characteristics & GRUB_PE32_SCN_MEM_EXECUTE) ++ { ++ /* RX section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_W; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_W; ++ } ++ else if (section->characteristics & GRUB_PE32_SCN_MEM_WRITE) ++ { ++ /* RW section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_X; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_X; ++ } ++ else ++ { ++ /* RO section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_W & ~GRUB_MEM_ATTR_X; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_X | GRUB_MEM_ATTR_W ; ++ } ++ } ++ ++ /* Make sure we are inside range */ ++ if (grub_add ((grub_addr_t) k_address, section->raw_data_offset, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE Executable section calculation")); ++ ++ grub_update_mem_attrs (sz, section->raw_data_size, kernel_set_attrs, kernel_clear_attrs); ++ ++ grub_get_mem_attrs (sz, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for section %s 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ section->name, ++ (grub_addr_t)sz, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ } ++ ++ if (grub_stack_addr != (grub_addr_t)-1ll) ++ { ++ if (nx_supported) ++ { ++ stack_set_attrs &= ~GRUB_MEM_ATTR_X; ++ stack_clear_attrs |= GRUB_MEM_ATTR_X; ++ } ++ ++ grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", ++ grub_stack_addr, grub_stack_addr + grub_stack_size - 1, ++ (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); ++ ++ grub_update_mem_attrs (grub_stack_addr, grub_stack_size, ++ stack_set_attrs, stack_clear_attrs); ++ ++ grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ grub_stack_addr, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ ++ ++grub_err_t ++grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, grub_size_t k_start, + grub_off_t h_offset, void *k_params, + int nx_supported) + { ++ grub_addr_t k_start_address = k_address + k_start; + grub_efi_loaded_image_t *loaded_image = NULL; + handover_func hf; + int offset = 0; +- grub_uint64_t stack_set_attrs = GRUB_MEM_ATTR_R | +- GRUB_MEM_ATTR_W | +- GRUB_MEM_ATTR_X; +- grub_uint64_t stack_clear_attrs = 0; +- grub_uint64_t kernel_set_attrs = stack_set_attrs; +- grub_uint64_t kernel_clear_attrs = stack_clear_attrs; +- grub_uint64_t attrs; + int nx_required = 0; +- ++ + #ifdef __x86_64__ + offset = 512; + #endif +@@ -242,41 +354,7 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, + if (nx_required && !nx_supported) + return grub_error (GRUB_ERR_BAD_OS, N_("kernel does not support NX loading required by policy")); + +- if (nx_supported) +- { +- kernel_set_attrs &= ~GRUB_MEM_ATTR_W; +- kernel_clear_attrs |= GRUB_MEM_ATTR_W; +- stack_set_attrs &= ~GRUB_MEM_ATTR_X; +- stack_clear_attrs |= GRUB_MEM_ATTR_X; +- } +- +- grub_dprintf ("nx", "Setting attributes for 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to r%cx\n", +- k_address, k_address + k_size - 1, +- (kernel_set_attrs & GRUB_MEM_ATTR_W) ? 'w' : '-'); +- grub_update_mem_attrs (k_address, k_size, +- kernel_set_attrs, kernel_clear_attrs); +- +- grub_get_mem_attrs (k_address, 4096, &attrs); +- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", +- (grub_addr_t)k_address, +- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", +- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", +- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); +- if (grub_stack_addr != (grub_addr_t)-1ll) +- { +- grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", +- grub_stack_addr, grub_stack_addr + grub_stack_size - 1, +- (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); +- grub_update_mem_attrs (grub_stack_addr, grub_stack_size, +- stack_set_attrs, stack_clear_attrs); +- +- grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); +- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", +- grub_stack_addr, +- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", +- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", +- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); +- } ++ grub_efi_mem_set_att (k_address, k_size, k_start, nx_supported); + + #if defined(__i386__) || defined(__x86_64__) + asm volatile ("cli"); +@@ -285,7 +363,7 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, + /* Invalidate the instruction cache */ + grub_arch_sync_caches((void *)kernel_addr, kernel_size); + +- hf = (handover_func)((char *)k_address + h_offset + offset); ++ hf = (handover_func)((char *)k_start_address + h_offset + offset); + hf (grub_efi_image_handle, grub_efi_system_table, k_params); + + return GRUB_ERR_BUG; +@@ -455,7 +533,7 @@ grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args, + + grub_dprintf ("linux", "linux command line: '%s'\n", args); + +- retval = grub_efi_linux_boot (addr, size, handover_offset, ++ retval = grub_efi_linux_boot (addr, size, 0, handover_offset, + (void *)addr, nx_supported); + + /* Never reached... */ +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index abbf6b24f5..6c310d9879 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -41,6 +41,7 @@ static grub_command_t cmd_linuxefi, cmd_initrdefi; + struct grub_linuxefi_context { + void *kernel_mem; + grub_uint64_t kernel_size; ++ grub_uint64_t kernel_start; + grub_uint32_t handover_offset; + struct linux_kernel_params *params; + char *cmdline; +@@ -169,6 +170,7 @@ grub_linuxefi_boot (void *data) + + return grub_efi_linux_boot ((grub_addr_t)context->kernel_mem, + context->kernel_size, ++ context->kernel_start, + context->handover_offset, + context->params, + context->nx_supported); +@@ -527,7 +529,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + LOW_U32(kernel_mem)); + lh->code32_start = LOW_U32(kernel_mem); + +- grub_memcpy (kernel_mem, (char *)kernel + start, filelen - start); ++ grub_memcpy (kernel_mem, (char *)kernel, filelen); + + lh->type_of_loader = 0x6; + grub_dprintf ("linux", "setting lh->type_of_loader = 0x%02x\n", +@@ -544,6 +546,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + context->kernel_mem = kernel_mem; + context->kernel_size = kernel_size; ++ context->kernel_start = start; + context->handover_offset = handover_offset; + context->params = params; + context->cmdline = cmdline; +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +index 5b4e626c37..cd17be506a 100644 +--- a/include/grub/efi/linux.h ++++ b/include/grub/efi/linux.h +@@ -27,6 +27,7 @@ + grub_err_t + EXPORT_FUNC(grub_efi_linux_boot) (grub_addr_t kernel_address, + grub_size_t kernel_size, ++ grub_size_t kernel_start, + grub_off_t handover_offset, + void *kernel_param, int nx_enabled); + +@@ -38,4 +39,9 @@ EXPORT_FUNC(grub_efi_check_nx_image_support) (grub_addr_t kernel_addr, + grub_err_t + EXPORT_FUNC(grub_efi_check_nx_required) (int *nx_required); + ++grub_err_t ++EXPORT_FUNC(grub_efi_mem_set_att) (grub_addr_t k_address, ++ grub_size_t k_size, ++ grub_size_t k_start, int nx_supported); ++ + #endif /* ! GRUB_EFI_LINUX_HEADER */ diff --git a/0371-script-execute-Don-t-let-trailing-blank-lines-determ.patch b/0371-script-execute-Don-t-let-trailing-blank-lines-determ.patch new file mode 100644 index 0000000..fd2eb2b --- /dev/null +++ b/0371-script-execute-Don-t-let-trailing-blank-lines-determ.patch @@ -0,0 +1,66 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: James Le Cuirot +Date: Thu, 24 Oct 2024 14:42:46 +0100 +Subject: [PATCH] script/execute: Don't let trailing blank lines determine the + return code + +grub_script_execute_sourcecode() parses and executes code one line at a +time, updating the return code each time because only the last line +determines the final status. However, trailing new lines were also +executed, masking any failure on the previous line. Fix this by only +trying to execute the command when there is actually one present. + +This has presumably never been noticed because this code is not used by +regular functions, only in special cases like eval and menu entries. The +latter generally don't return at all, having booted an OS. When failing +to boot, upstream GRUB triggers the fallback mechanism regardless of the +return code. + +We noticed the problem while using Red Hat's patches, which change this +behaviour to take account of the return code. In that case, a failure +takes you back to the menu rather than triggering a fallback. + +Signed-off-by: James Le Cuirot +--- + grub-core/script/execute.c | 5 ++++- + tests/grub_script_eval.in | 10 +++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 014132703..3d26a3fe4 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -952,7 +952,10 @@ grub_script_execute_sourcecode (const char *source) + break; + } + +- ret = grub_script_execute (parsed_script); ++ /* Don't let trailing blank lines determine the return code. */ ++ if (parsed_script->cmd) ++ ret = grub_script_execute (parsed_script); ++ + grub_script_free (parsed_script); + grub_free (line); + } +diff --git a/tests/grub_script_eval.in b/tests/grub_script_eval.in +index c97b78d77..9c6211042 100644 +--- a/tests/grub_script_eval.in ++++ b/tests/grub_script_eval.in +@@ -3,4 +3,12 @@ + eval echo "Hello world" + valname=tst + eval $valname=hi +-echo $tst +\ No newline at end of file ++echo $tst ++ ++if eval " ++false ++"; then ++ echo should have failed ++else ++ echo failed as expected ++fi +-- +2.48.1 + diff --git a/0372-normal-menu-Check-return-code-of-the-script-when-exe.patch b/0372-normal-menu-Check-return-code-of-the-script-when-exe.patch new file mode 100644 index 0000000..3ce0eec --- /dev/null +++ b/0372-normal-menu-Check-return-code-of-the-script-when-exe.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: James Le Cuirot +Date: Thu, 24 Oct 2024 15:00:26 +0100 +Subject: [PATCH] normal/menu: Check return code of the script when executing a + menu entry + +Don't rely on grub_errno here because grub_script_execute_new_scope() +calls grub_print_error(), which always resets grub_errno back to +GRUB_ERR_NONE. It may also get reset by grub_wait_after_message(). + +This problem was observed when a "bad signature" error resulted in the +menu being redisplayed rather than the fallback mechanism being +triggered, although another change was also needed to fix it. This only +happens with Red Hat's patches because upstream GRUB triggers the +fallback mechanism regardless of the return code. + +Signed-off-by: James Le Cuirot +--- + grub-core/normal/menu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index 97687013c..a2703dabb 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -377,14 +377,14 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + if (ptr && ptr[0] && ptr[1]) + grub_env_set ("default", ptr + 1); + +- grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); ++ err = grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); + + if (errs_before != grub_err_printed_errors) + grub_wait_after_message (); + + errs_before = grub_err_printed_errors; + +- if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ()) ++ if (err == GRUB_ERR_NONE && grub_loader_is_loaded ()) + /* Implicit execution of boot, only if something is loaded. */ + err = grub_command_execute ("boot", 0, 0); + +-- +2.48.1 + diff --git a/0373-Include-license-into-grub-set-password-util.patch b/0373-Include-license-into-grub-set-password-util.patch new file mode 100644 index 0000000..0e69e23 --- /dev/null +++ b/0373-Include-license-into-grub-set-password-util.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Thu, 6 Nov 2025 11:19:16 -0600 +Subject: [PATCH] Include license into grub-set-password util + +Signed-off-by: Leo Sandoval +--- + util/grub-set-password.in | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/util/grub-set-password.in b/util/grub-set-password.in +index d8005e5a14..f6655add7b 100644 +--- a/util/grub-set-password.in ++++ b/util/grub-set-password.in +@@ -1,4 +1,20 @@ + #!/bin/sh -e ++# ++# Friendly password config tool from GRUB ++# Copyright (C) Free Software Foundation, Inc. ++# ++# GRUB is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# GRUB is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with GRUB. If not, see . + + grubdir=`echo "/@bootdirname@/@grubdirname@" | sed 's,//*,/,g'` + diff --git a/0374-libgcrypt-Import-libgcrypt-1.11.patch b/0374-libgcrypt-Import-libgcrypt-1.11.patch new file mode 100644 index 0000000..c772106 --- /dev/null +++ b/0374-libgcrypt-Import-libgcrypt-1.11.patch @@ -0,0 +1,261873 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Vladimir Serbinenko +Date: Mon, 7 Jul 2025 14:52:07 +0000 +Subject: [PATCH] libgcrypt: Import libgcrypt 1.11 + +We currently use an old version of libgcrypt which results in us having +fewer ciphers and missing on many other improvements. + +Signed-off-by: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + grub-core/Makefile.core.def | 8 - + grub-core/lib/libgcrypt/AUTHORS | 274 + + grub-core/lib/libgcrypt/COPYING | 339 + + grub-core/lib/libgcrypt/COPYING.LIB | 502 + + grub-core/lib/libgcrypt/LICENSES | 319 + + grub-core/lib/libgcrypt/README | 278 + + grub-core/lib/libgcrypt/README.GIT | 49 + + grub-core/lib/libgcrypt/THANKS | 168 + + grub-core/lib/libgcrypt/VERSION | 1 + + grub-core/lib/libgcrypt/cipher/ChangeLog | 3990 --- + grub-core/lib/libgcrypt/cipher/ChangeLog-2011 | 40 +- + grub-core/lib/libgcrypt/cipher/Makefile.am | 330 +- + grub-core/lib/libgcrypt/cipher/Manifest | 73 - + grub-core/lib/libgcrypt/cipher/ac.c | 3301 --- + grub-core/lib/libgcrypt/cipher/arcfour-amd64.S | 108 + + grub-core/lib/libgcrypt/cipher/arcfour.c | 93 +- + .../lib/libgcrypt/cipher/aria-aesni-avx-amd64.S | 1440 ++ + .../lib/libgcrypt/cipher/aria-aesni-avx2-amd64.S | 1830 ++ + .../lib/libgcrypt/cipher/aria-gfni-avx512-amd64.S | 1010 + + grub-core/lib/libgcrypt/cipher/aria.c | 1768 ++ + .../lib/libgcrypt/cipher/asm-common-aarch64.h | 132 + + grub-core/lib/libgcrypt/cipher/asm-common-amd64.h | 213 + + grub-core/lib/libgcrypt/cipher/asm-common-i386.h | 161 + + grub-core/lib/libgcrypt/cipher/asm-common-s390x.h | 90 + + grub-core/lib/libgcrypt/cipher/asm-inline-s390x.h | 205 + + .../lib/libgcrypt/cipher/asm-poly1305-aarch64.h | 245 + + .../lib/libgcrypt/cipher/asm-poly1305-amd64.h | 171 + + .../lib/libgcrypt/cipher/asm-poly1305-s390x.h | 140 + + grub-core/lib/libgcrypt/cipher/bithelp.h | 111 +- + grub-core/lib/libgcrypt/cipher/blake2.c | 1086 + + .../lib/libgcrypt/cipher/blake2b-amd64-avx2.S | 301 + + .../lib/libgcrypt/cipher/blake2b-amd64-avx512.S | 429 + + grub-core/lib/libgcrypt/cipher/blake2s-amd64-avx.S | 281 + + .../lib/libgcrypt/cipher/blake2s-amd64-avx512.S | 397 + + grub-core/lib/libgcrypt/cipher/blowfish-amd64.S | 601 + + grub-core/lib/libgcrypt/cipher/blowfish-arm.S | 743 + + grub-core/lib/libgcrypt/cipher/blowfish.c | 792 +- + grub-core/lib/libgcrypt/cipher/bufhelp.h | 458 +- + grub-core/lib/libgcrypt/cipher/bulkhelp.h | 493 + + .../lib/libgcrypt/cipher/camellia-aarch64-ce.c | 42 + + grub-core/lib/libgcrypt/cipher/camellia-aarch64.S | 585 + + .../libgcrypt/cipher/camellia-aesni-avx-amd64.S | 2802 ++ + .../libgcrypt/cipher/camellia-aesni-avx2-amd64.S | 34 + + .../libgcrypt/cipher/camellia-aesni-avx2-amd64.h | 2327 ++ + grub-core/lib/libgcrypt/cipher/camellia-arm.S | 626 + + .../libgcrypt/cipher/camellia-gfni-avx2-amd64.S | 34 + + .../libgcrypt/cipher/camellia-gfni-avx512-amd64.S | 1634 ++ + grub-core/lib/libgcrypt/cipher/camellia-glue.c | 1670 +- + grub-core/lib/libgcrypt/cipher/camellia-ppc8le.c | 47 + + grub-core/lib/libgcrypt/cipher/camellia-ppc9le.c | 47 + + grub-core/lib/libgcrypt/cipher/camellia-simd128.h | 2235 ++ + .../libgcrypt/cipher/camellia-vaes-avx2-amd64.S | 35 + + grub-core/lib/libgcrypt/cipher/camellia.c | 172 +- + grub-core/lib/libgcrypt/cipher/camellia.h | 34 +- + grub-core/lib/libgcrypt/cipher/cast5-amd64.S | 663 + + grub-core/lib/libgcrypt/cipher/cast5-arm.S | 728 + + grub-core/lib/libgcrypt/cipher/cast5.c | 769 +- + grub-core/lib/libgcrypt/cipher/chacha20-aarch64.S | 650 + + .../lib/libgcrypt/cipher/chacha20-amd64-avx2.S | 604 + + .../lib/libgcrypt/cipher/chacha20-amd64-avx512.S | 736 + + .../lib/libgcrypt/cipher/chacha20-amd64-ssse3.S | 1015 + + .../lib/libgcrypt/cipher/chacha20-armv7-neon.S | 393 + + grub-core/lib/libgcrypt/cipher/chacha20-p10le-8x.s | 864 + + grub-core/lib/libgcrypt/cipher/chacha20-ppc.c | 750 + + grub-core/lib/libgcrypt/cipher/chacha20-s390x.S | 1566 ++ + grub-core/lib/libgcrypt/cipher/chacha20.c | 1450 ++ + grub-core/lib/libgcrypt/cipher/cipher-aeswrap.c | 380 + + grub-core/lib/libgcrypt/cipher/cipher-cbc.c | 292 + + grub-core/lib/libgcrypt/cipher/cipher-ccm.c | 419 + + grub-core/lib/libgcrypt/cipher/cipher-cfb.c | 317 + + grub-core/lib/libgcrypt/cipher/cipher-cmac.c | 292 + + grub-core/lib/libgcrypt/cipher/cipher-ctr.c | 131 + + grub-core/lib/libgcrypt/cipher/cipher-eax.c | 293 + + .../lib/libgcrypt/cipher/cipher-gcm-armv7-neon.S | 341 + + .../libgcrypt/cipher/cipher-gcm-armv8-aarch32-ce.S | 588 + + .../libgcrypt/cipher/cipher-gcm-armv8-aarch64-ce.S | 633 + + .../lib/libgcrypt/cipher/cipher-gcm-intel-pclmul.c | 2025 ++ + grub-core/lib/libgcrypt/cipher/cipher-gcm-ppc.c | 548 + + grub-core/lib/libgcrypt/cipher/cipher-gcm-siv.c | 664 + + grub-core/lib/libgcrypt/cipher/cipher-gcm.c | 1260 + + grub-core/lib/libgcrypt/cipher/cipher-internal.h | 975 + + grub-core/lib/libgcrypt/cipher/cipher-ocb.c | 763 + + grub-core/lib/libgcrypt/cipher/cipher-ofb.c | 108 + + grub-core/lib/libgcrypt/cipher/cipher-poly1305.c | 383 + + grub-core/lib/libgcrypt/cipher/cipher-siv.c | 375 + + grub-core/lib/libgcrypt/cipher/cipher-xts.c | 189 + + grub-core/lib/libgcrypt/cipher/cipher.c | 2896 +-- + .../lib/libgcrypt/cipher/crc-armv8-aarch64-ce.S | 500 + + grub-core/lib/libgcrypt/cipher/crc-armv8-ce.c | 229 + + grub-core/lib/libgcrypt/cipher/crc-intel-pclmul.c | 939 + + grub-core/lib/libgcrypt/cipher/crc-ppc.c | 656 + + grub-core/lib/libgcrypt/cipher/crc.c | 192 +- + grub-core/lib/libgcrypt/cipher/des-amd64.S | 1116 + + grub-core/lib/libgcrypt/cipher/des.c | 301 +- + grub-core/lib/libgcrypt/cipher/dsa-common.c | 473 + + grub-core/lib/libgcrypt/cipher/dsa.c | 1199 +- + grub-core/lib/libgcrypt/cipher/ecc-common.h | 143 + + grub-core/lib/libgcrypt/cipher/ecc-curves.c | 1587 ++ + grub-core/lib/libgcrypt/cipher/ecc-ecdh.c | 357 + + grub-core/lib/libgcrypt/cipher/ecc-ecdsa.c | 305 + + grub-core/lib/libgcrypt/cipher/ecc-eddsa.c | 1079 + + grub-core/lib/libgcrypt/cipher/ecc-gost.c | 218 + + grub-core/lib/libgcrypt/cipher/ecc-misc.c | 469 + + grub-core/lib/libgcrypt/cipher/ecc-sm2.c | 569 + + grub-core/lib/libgcrypt/cipher/ecc.c | 3296 ++- + grub-core/lib/libgcrypt/cipher/elgamal.c | 827 +- + grub-core/lib/libgcrypt/cipher/gost-s-box.c | 266 + + grub-core/lib/libgcrypt/cipher/gost-sb.h | 2128 ++ + grub-core/lib/libgcrypt/cipher/gost.h | 34 + + grub-core/lib/libgcrypt/cipher/gost28147.c | 553 + + grub-core/lib/libgcrypt/cipher/gostr3411-94.c | 383 + + grub-core/lib/libgcrypt/cipher/hash-common.c | 108 +- + grub-core/lib/libgcrypt/cipher/hash-common.h | 29 + + grub-core/lib/libgcrypt/cipher/hmac-tests.c | 732 - + grub-core/lib/libgcrypt/cipher/idea.c | 24 +- + grub-core/lib/libgcrypt/cipher/kdf-internal.h | 39 + + grub-core/lib/libgcrypt/cipher/kdf.c | 2239 +- + .../lib/libgcrypt/cipher/keccak-amd64-avx512.S | 587 + + grub-core/lib/libgcrypt/cipher/keccak-armv7-neon.S | 945 + + grub-core/lib/libgcrypt/cipher/keccak.c | 1904 ++ + grub-core/lib/libgcrypt/cipher/keccak_permute_32.h | 536 + + grub-core/lib/libgcrypt/cipher/keccak_permute_64.h | 385 + + grub-core/lib/libgcrypt/cipher/kem-ecc.c | 332 + + grub-core/lib/libgcrypt/cipher/kem-ecc.h | 40 + + grub-core/lib/libgcrypt/cipher/kem.c | 435 + + grub-core/lib/libgcrypt/cipher/kyber-common.c | 766 + + grub-core/lib/libgcrypt/cipher/kyber-kdep.c | 825 + + grub-core/lib/libgcrypt/cipher/kyber.c | 530 + + grub-core/lib/libgcrypt/cipher/kyber.h | 130 + + grub-core/lib/libgcrypt/cipher/mac-cmac.c | 532 + + grub-core/lib/libgcrypt/cipher/mac-gmac.c | 203 + + grub-core/lib/libgcrypt/cipher/mac-hmac.c | 1471 ++ + grub-core/lib/libgcrypt/cipher/mac-internal.h | 290 + + grub-core/lib/libgcrypt/cipher/mac-poly1305.c | 382 + + grub-core/lib/libgcrypt/cipher/mac.c | 834 + + grub-core/lib/libgcrypt/cipher/mceliece6688128f.c | 3673 +++ + grub-core/lib/libgcrypt/cipher/mceliece6688128f.h | 63 + + grub-core/lib/libgcrypt/cipher/md.c | 1610 +- + grub-core/lib/libgcrypt/cipher/md4.c | 169 +- + grub-core/lib/libgcrypt/cipher/md5.c | 175 +- + .../lib/libgcrypt/cipher/poly1305-amd64-avx512.S | 1626 ++ + grub-core/lib/libgcrypt/cipher/poly1305-internal.h | 92 + + grub-core/lib/libgcrypt/cipher/poly1305-p10le.s | 841 + + grub-core/lib/libgcrypt/cipher/poly1305-s390x.S | 87 + + grub-core/lib/libgcrypt/cipher/poly1305.c | 846 + + grub-core/lib/libgcrypt/cipher/primegen.c | 561 +- + grub-core/lib/libgcrypt/cipher/pubkey-internal.h | 107 + + grub-core/lib/libgcrypt/cipher/pubkey-util.c | 1363 + + grub-core/lib/libgcrypt/cipher/pubkey.c | 4281 +-- + grub-core/lib/libgcrypt/cipher/rfc2268.c | 57 +- + grub-core/lib/libgcrypt/cipher/rijndael-aarch64.S | 512 + + grub-core/lib/libgcrypt/cipher/rijndael-aesni.c | 5033 ++++ + grub-core/lib/libgcrypt/cipher/rijndael-amd64.S | 477 + + grub-core/lib/libgcrypt/cipher/rijndael-arm.S | 581 + + .../libgcrypt/cipher/rijndael-armv8-aarch32-ce.S | 2134 ++ + .../libgcrypt/cipher/rijndael-armv8-aarch64-ce.S | 2038 ++ + grub-core/lib/libgcrypt/cipher/rijndael-armv8-ce.c | 396 + + .../lib/libgcrypt/cipher/rijndael-gcm-p10le.s | 1401 + + grub-core/lib/libgcrypt/cipher/rijndael-internal.h | 216 + + grub-core/lib/libgcrypt/cipher/rijndael-p10le.c | 119 + + grub-core/lib/libgcrypt/cipher/rijndael-padlock.c | 109 + + .../lib/libgcrypt/cipher/rijndael-ppc-common.h | 328 + + .../lib/libgcrypt/cipher/rijndael-ppc-functions.h | 2544 ++ + grub-core/lib/libgcrypt/cipher/rijndael-ppc.c | 230 + + grub-core/lib/libgcrypt/cipher/rijndael-ppc9le.c | 119 + + grub-core/lib/libgcrypt/cipher/rijndael-s390x.c | 1166 + + .../libgcrypt/cipher/rijndael-ssse3-amd64-asm.S | 879 + + .../lib/libgcrypt/cipher/rijndael-ssse3-amd64.c | 742 + + grub-core/lib/libgcrypt/cipher/rijndael-tables.h | 1846 +- + .../libgcrypt/cipher/rijndael-vaes-avx2-amd64.S | 3688 +++ + .../lib/libgcrypt/cipher/rijndael-vaes-avx2-i386.S | 2804 ++ + .../lib/libgcrypt/cipher/rijndael-vaes-i386.c | 231 + + grub-core/lib/libgcrypt/cipher/rijndael-vaes.c | 240 + + grub-core/lib/libgcrypt/cipher/rijndael.c | 2629 +- + grub-core/lib/libgcrypt/cipher/rmd160.c | 586 +- + grub-core/lib/libgcrypt/cipher/rsa-common.c | 1151 + + grub-core/lib/libgcrypt/cipher/rsa.c | 1774 +- + grub-core/lib/libgcrypt/cipher/salsa20-amd64.S | 940 + + .../lib/libgcrypt/cipher/salsa20-armv7-neon.S | 899 + + grub-core/lib/libgcrypt/cipher/salsa20.c | 600 + + grub-core/lib/libgcrypt/cipher/scrypt.c | 322 + + grub-core/lib/libgcrypt/cipher/seed.c | 32 +- + .../lib/libgcrypt/cipher/serpent-armv7-neon.S | 1180 + + .../lib/libgcrypt/cipher/serpent-avx2-amd64.S | 1214 + + .../lib/libgcrypt/cipher/serpent-avx512-x86.c | 994 + + .../lib/libgcrypt/cipher/serpent-sse2-amd64.S | 1276 + + grub-core/lib/libgcrypt/cipher/serpent.c | 2017 +- + grub-core/lib/libgcrypt/cipher/sha1-armv7-neon.S | 526 + + .../lib/libgcrypt/cipher/sha1-armv8-aarch32-ce.S | 220 + + .../lib/libgcrypt/cipher/sha1-armv8-aarch64-ce.S | 204 + + grub-core/lib/libgcrypt/cipher/sha1-avx-amd64.S | 433 + + .../lib/libgcrypt/cipher/sha1-avx-bmi2-amd64.S | 446 + + .../lib/libgcrypt/cipher/sha1-avx2-bmi2-amd64.S | 578 + + grub-core/lib/libgcrypt/cipher/sha1-intel-shaext.c | 292 + + grub-core/lib/libgcrypt/cipher/sha1-ssse3-amd64.S | 442 + + grub-core/lib/libgcrypt/cipher/sha1.c | 567 +- + grub-core/lib/libgcrypt/cipher/sha1.h | 47 + + .../lib/libgcrypt/cipher/sha256-armv8-aarch32-ce.S | 231 + + .../lib/libgcrypt/cipher/sha256-armv8-aarch64-ce.S | 218 + + grub-core/lib/libgcrypt/cipher/sha256-avx-amd64.S | 511 + + .../lib/libgcrypt/cipher/sha256-avx2-bmi2-amd64.S | 533 + + .../lib/libgcrypt/cipher/sha256-intel-shaext.c | 363 + + grub-core/lib/libgcrypt/cipher/sha256-ppc.c | 610 + + .../lib/libgcrypt/cipher/sha256-ssse3-amd64.S | 533 + + grub-core/lib/libgcrypt/cipher/sha256.c | 771 +- + grub-core/lib/libgcrypt/cipher/sha512-arm.S | 464 + + grub-core/lib/libgcrypt/cipher/sha512-armv7-neon.S | 452 + + .../lib/libgcrypt/cipher/sha512-armv8-aarch64-ce.S | 383 + + grub-core/lib/libgcrypt/cipher/sha512-avx-amd64.S | 466 + + .../lib/libgcrypt/cipher/sha512-avx2-bmi2-amd64.S | 507 + + .../lib/libgcrypt/cipher/sha512-avx512-amd64.S | 465 + + grub-core/lib/libgcrypt/cipher/sha512-ppc.c | 725 + + .../lib/libgcrypt/cipher/sha512-ssse3-amd64.S | 472 + + grub-core/lib/libgcrypt/cipher/sha512-ssse3-i386.c | 404 + + grub-core/lib/libgcrypt/cipher/sha512.c | 1304 +- + grub-core/lib/libgcrypt/cipher/sm3-aarch64.S | 660 + + .../lib/libgcrypt/cipher/sm3-armv8-aarch64-ce.S | 221 + + .../lib/libgcrypt/cipher/sm3-avx-bmi2-amd64.S | 555 + + grub-core/lib/libgcrypt/cipher/sm3.c | 565 + + grub-core/lib/libgcrypt/cipher/sm4-aarch64.S | 644 + + .../lib/libgcrypt/cipher/sm4-aesni-avx-amd64.S | 1058 + + .../lib/libgcrypt/cipher/sm4-aesni-avx2-amd64.S | 973 + + .../lib/libgcrypt/cipher/sm4-armv8-aarch64-ce.S | 731 + + .../libgcrypt/cipher/sm4-armv9-aarch64-sve-ce.S | 967 + + .../lib/libgcrypt/cipher/sm4-gfni-avx2-amd64.S | 1260 + + .../lib/libgcrypt/cipher/sm4-gfni-avx512-amd64.S | 1861 ++ + grub-core/lib/libgcrypt/cipher/sm4-ppc.c | 342 + + grub-core/lib/libgcrypt/cipher/sm4.c | 2070 ++ + grub-core/lib/libgcrypt/cipher/sntrup761.c | 1062 + + grub-core/lib/libgcrypt/cipher/sntrup761.h | 73 + + grub-core/lib/libgcrypt/cipher/stribog.c | 1362 + + grub-core/lib/libgcrypt/cipher/test-getrusage.c | 105 - + grub-core/lib/libgcrypt/cipher/tiger.c | 309 +- + grub-core/lib/libgcrypt/cipher/twofish-aarch64.S | 322 + + grub-core/lib/libgcrypt/cipher/twofish-amd64.S | 1258 + + grub-core/lib/libgcrypt/cipher/twofish-arm.S | 363 + + .../lib/libgcrypt/cipher/twofish-avx2-amd64.S | 1136 + + grub-core/lib/libgcrypt/cipher/twofish.c | 954 +- + .../lib/libgcrypt/cipher/whirlpool-sse2-amd64.S | 348 + + grub-core/lib/libgcrypt/cipher/whirlpool.c | 334 +- + grub-core/lib/libgcrypt/compat/Makefile.am | 48 + + grub-core/lib/libgcrypt/compat/clock.c | 36 + + grub-core/lib/libgcrypt/compat/compat.c | 40 + + grub-core/lib/libgcrypt/compat/getpid.c | 29 + + grub-core/lib/libgcrypt/compat/libcompat.h | 37 + + grub-core/lib/libgcrypt/config.h.in | 873 + + grub-core/lib/libgcrypt/configure | 25763 +++++++++++++++++++ + grub-core/lib/libgcrypt/configure.ac | 3883 +++ + grub-core/lib/libgcrypt/mkinstalldirs | 161 + + grub-core/lib/libgcrypt/mpi/ChangeLog-2011 | 17 +- + grub-core/lib/libgcrypt/mpi/Makefile.am | 16 +- + grub-core/lib/libgcrypt/mpi/Manifest | 41 - + .../mpi/{pentium4/sse2 => aarch64}/distfiles | 1 + + grub-core/lib/libgcrypt/mpi/aarch64/mpi-asm-defs.h | 4 + + grub-core/lib/libgcrypt/mpi/aarch64/mpih-add1.S | 75 + + grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul1.S | 100 + + grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul2.S | 112 + + grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul3.S | 125 + + grub-core/lib/libgcrypt/mpi/aarch64/mpih-sub1.S | 75 + + grub-core/lib/libgcrypt/mpi/alpha/README | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-mul1.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-mul2.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-mul3.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/mpih-sub1.S | 4 +- + grub-core/lib/libgcrypt/mpi/alpha/udiv-qrnnd.S | 4 +- + grub-core/lib/libgcrypt/mpi/amd64/distfiles | 1 + + grub-core/lib/libgcrypt/mpi/amd64/func_abi.h | 34 + + grub-core/lib/libgcrypt/mpi/amd64/mpi-asm-defs.h | 2 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-add1.S | 92 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-lshift.S | 54 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-mul1.S | 11 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-mul2.S | 53 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-mul3.S | 11 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-rshift.S | 56 +- + grub-core/lib/libgcrypt/mpi/amd64/mpih-sub1.S | 90 +- + .../lib/libgcrypt/mpi/{i586 => arm}/distfiles | 6 +- + grub-core/lib/libgcrypt/mpi/arm/mpi-asm-defs.h | 4 + + grub-core/lib/libgcrypt/mpi/arm/mpih-add1.S | 76 + + grub-core/lib/libgcrypt/mpi/arm/mpih-mul1.S | 80 + + grub-core/lib/libgcrypt/mpi/arm/mpih-mul2.S | 94 + + grub-core/lib/libgcrypt/mpi/arm/mpih-mul3.S | 100 + + grub-core/lib/libgcrypt/mpi/arm/mpih-sub1.S | 77 + + grub-core/lib/libgcrypt/mpi/asm-common-aarch64.h | 26 + + grub-core/lib/libgcrypt/mpi/asm-common-amd64.h | 26 + + grub-core/lib/libgcrypt/mpi/asm-common-i386.h | 26 + + grub-core/lib/libgcrypt/mpi/config.links | 182 +- + .../libgcrypt/{cipher/rmd.h => mpi/ec-ed25519.c} | 35 +- + grub-core/lib/libgcrypt/mpi/ec-hw-s390x.c | 412 + + grub-core/lib/libgcrypt/mpi/ec-inline.h | 1236 + + grub-core/lib/libgcrypt/mpi/ec-internal.h | 49 + + grub-core/lib/libgcrypt/mpi/ec-nist.c | 826 + + grub-core/lib/libgcrypt/mpi/ec.c | 2059 +- + grub-core/lib/libgcrypt/mpi/generic/Manifest | 29 - + grub-core/lib/libgcrypt/mpi/generic/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/generic/mpi-asm-defs.h | 16 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-add1.c | 10 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-lshift.c | 6 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-mul1.c | 8 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-mul2.c | 10 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-mul3.c | 8 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-rshift.c | 4 +- + grub-core/lib/libgcrypt/mpi/generic/mpih-sub1.c | 8 +- + grub-core/lib/libgcrypt/mpi/generic/udiv-w-sdiv.c | 4 +- + grub-core/lib/libgcrypt/mpi/hppa/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/hppa/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/hppa/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/hppa/mpih-sub1.S | 4 +- + grub-core/lib/libgcrypt/mpi/hppa/udiv-qrnnd.S | 4 +- + grub-core/lib/libgcrypt/mpi/i386/Manifest | 28 - + grub-core/lib/libgcrypt/mpi/i386/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/i386/mpih-add1.S | 51 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-lshift.S | 16 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-mul1.S | 16 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-mul2.S | 16 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-mul3.S | 16 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-rshift.S | 18 +- + grub-core/lib/libgcrypt/mpi/i386/mpih-sub1.S | 51 +- + grub-core/lib/libgcrypt/mpi/i386/syntax.h | 16 +- + grub-core/lib/libgcrypt/mpi/i586/Manifest | 27 - + grub-core/lib/libgcrypt/mpi/i586/README | 26 - + grub-core/lib/libgcrypt/mpi/i586/mpih-add1.S | 135 - + grub-core/lib/libgcrypt/mpi/i586/mpih-lshift.S | 229 - + grub-core/lib/libgcrypt/mpi/i586/mpih-mul1.S | 89 - + grub-core/lib/libgcrypt/mpi/i586/mpih-mul2.S | 93 - + grub-core/lib/libgcrypt/mpi/i586/mpih-mul3.S | 93 - + grub-core/lib/libgcrypt/mpi/i586/mpih-rshift.S | 228 - + grub-core/lib/libgcrypt/mpi/i586/mpih-sub1.S | 142 - + grub-core/lib/libgcrypt/mpi/longlong.h | 967 +- + grub-core/lib/libgcrypt/mpi/m68k/Manifest | 25 - + grub-core/lib/libgcrypt/mpi/m68k/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/m68k/mc68020/Manifest | 23 - + grub-core/lib/libgcrypt/mpi/m68k/mc68020/distfiles | 1 - + .../lib/libgcrypt/mpi/m68k/mc68020/mpih-mul1.S | 4 +- + .../lib/libgcrypt/mpi/m68k/mc68020/mpih-mul2.S | 4 +- + .../lib/libgcrypt/mpi/m68k/mc68020/mpih-mul3.S | 4 +- + grub-core/lib/libgcrypt/mpi/m68k/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/m68k/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/m68k/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/m68k/mpih-sub1.S | 4 +- + grub-core/lib/libgcrypt/mpi/m68k/syntax.h | 6 +- + grub-core/lib/libgcrypt/mpi/mips3/Manifest | 28 - + grub-core/lib/libgcrypt/mpi/mips3/README | 2 +- + grub-core/lib/libgcrypt/mpi/mips3/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/mips3/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-mul1.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-mul2.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-mul3.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/mips3/mpih-sub1.S | 4 +- + grub-core/lib/libgcrypt/mpi/mpi-add.c | 64 +- + grub-core/lib/libgcrypt/mpi/mpi-bit.c | 251 +- + grub-core/lib/libgcrypt/mpi/mpi-cmp.c | 45 +- + grub-core/lib/libgcrypt/mpi/mpi-div.c | 23 +- + grub-core/lib/libgcrypt/mpi/mpi-gcd.c | 15 +- + grub-core/lib/libgcrypt/mpi/mpi-inline.c | 4 +- + grub-core/lib/libgcrypt/mpi/mpi-inline.h | 4 +- + grub-core/lib/libgcrypt/mpi/mpi-internal.h | 60 +- + grub-core/lib/libgcrypt/mpi/mpi-inv.c | 312 +- + grub-core/lib/libgcrypt/mpi/mpi-mod.c | 54 +- + grub-core/lib/libgcrypt/mpi/mpi-mpow.c | 12 +- + grub-core/lib/libgcrypt/mpi/mpi-mul.c | 27 +- + grub-core/lib/libgcrypt/mpi/mpi-pow.c | 458 +- + grub-core/lib/libgcrypt/mpi/mpi-scan.c | 136 +- + grub-core/lib/libgcrypt/mpi/mpicoder.c | 759 +- + grub-core/lib/libgcrypt/mpi/mpih-const-time.c | 241 + + grub-core/lib/libgcrypt/mpi/mpih-div.c | 14 +- + grub-core/lib/libgcrypt/mpi/mpih-mul.c | 27 +- + grub-core/lib/libgcrypt/mpi/mpiutil.c | 488 +- + grub-core/lib/libgcrypt/mpi/pa7100/Manifest | 22 - + grub-core/lib/libgcrypt/mpi/pa7100/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/pa7100/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/pa7100/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/pentium4/README | 115 - + grub-core/lib/libgcrypt/mpi/pentium4/distfiles | 3 - + grub-core/lib/libgcrypt/mpi/pentium4/mmx/distfiles | 2 - + .../lib/libgcrypt/mpi/pentium4/mmx/mpih-lshift.S | 457 - + .../lib/libgcrypt/mpi/pentium4/mmx/mpih-rshift.S | 453 - + .../lib/libgcrypt/mpi/pentium4/sse2/mpih-add1.S | 91 - + .../lib/libgcrypt/mpi/pentium4/sse2/mpih-mul1.S | 96 - + .../lib/libgcrypt/mpi/pentium4/sse2/mpih-mul2.S | 136 - + .../lib/libgcrypt/mpi/pentium4/sse2/mpih-mul3.S | 127 - + .../lib/libgcrypt/mpi/pentium4/sse2/mpih-sub1.S | 112 - + grub-core/lib/libgcrypt/mpi/power/Manifest | 27 - + grub-core/lib/libgcrypt/mpi/power/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/power/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-mul1.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-mul2.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-mul3.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/power/mpih-sub1.S | 4 +- + grub-core/lib/libgcrypt/mpi/powerpc32/Manifest | 28 - + grub-core/lib/libgcrypt/mpi/powerpc32/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/powerpc32/mpih-add1.S | 9 +- + .../lib/libgcrypt/mpi/powerpc32/mpih-lshift.S | 8 +- + grub-core/lib/libgcrypt/mpi/powerpc32/mpih-mul1.S | 10 +- + grub-core/lib/libgcrypt/mpi/powerpc32/mpih-mul2.S | 10 +- + grub-core/lib/libgcrypt/mpi/powerpc32/mpih-mul3.S | 9 +- + .../lib/libgcrypt/mpi/powerpc32/mpih-rshift.S | 10 +- + grub-core/lib/libgcrypt/mpi/powerpc32/mpih-sub1.S | 9 +- + grub-core/lib/libgcrypt/mpi/powerpc32/syntax.h | 5 +- + grub-core/lib/libgcrypt/mpi/sparc32/Manifest | 24 - + grub-core/lib/libgcrypt/mpi/sparc32/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/sparc32/mpih-add1.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32/mpih-lshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32/mpih-rshift.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32/udiv.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32v8/Manifest | 23 - + grub-core/lib/libgcrypt/mpi/sparc32v8/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/sparc32v8/mpih-mul1.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32v8/mpih-mul2.S | 4 +- + grub-core/lib/libgcrypt/mpi/sparc32v8/mpih-mul3.S | 4 +- + grub-core/lib/libgcrypt/mpi/supersparc/Manifest | 21 - + grub-core/lib/libgcrypt/mpi/supersparc/distfiles | 1 - + grub-core/lib/libgcrypt/mpi/supersparc/udiv.S | 4 +- + grub-core/lib/libgcrypt/src/ChangeLog-2011 | 75 +- + grub-core/lib/libgcrypt/src/Makefile.am | 89 +- + grub-core/lib/libgcrypt/src/Manifest | 58 - + grub-core/lib/libgcrypt/src/ath.c | 344 - + grub-core/lib/libgcrypt/src/ath.h | 147 - + grub-core/lib/libgcrypt/src/cipher-proto.h | 250 +- + grub-core/lib/libgcrypt/src/cipher.h | 167 +- + grub-core/lib/libgcrypt/src/const-time.c | 88 + + grub-core/lib/libgcrypt/src/const-time.h | 167 + + grub-core/lib/libgcrypt/src/context.c | 154 + + grub-core/lib/libgcrypt/src/context.h | 33 + + grub-core/lib/libgcrypt/src/dumpsexp.c | 25 +- + grub-core/lib/libgcrypt/src/ec-context.h | 107 + + grub-core/lib/libgcrypt/src/fips.c | 808 +- + grub-core/lib/libgcrypt/src/g10lib.h | 278 +- + grub-core/lib/libgcrypt/src/gcrypt-int.h | 595 + + grub-core/lib/libgcrypt/src/gcrypt-module.h | 240 - + grub-core/lib/libgcrypt/src/gcrypt-testapi.h | 70 + + grub-core/lib/libgcrypt/src/gcrypt.h.in | 1354 +- + grub-core/lib/libgcrypt/src/gcryptrnd.c | 680 - + grub-core/lib/libgcrypt/src/gen-note-integrity.sh | 123 + + grub-core/lib/libgcrypt/src/getrandom.c | 326 - + grub-core/lib/libgcrypt/src/global.c | 921 +- + grub-core/lib/libgcrypt/src/hmac256.c | 89 +- + grub-core/lib/libgcrypt/src/hmac256.h | 2 +- + grub-core/lib/libgcrypt/src/hwf-arm.c | 564 + + grub-core/lib/libgcrypt/src/hwf-common.h | 28 + + grub-core/lib/libgcrypt/src/hwf-ppc.c | 247 + + grub-core/lib/libgcrypt/src/hwf-s390x.c | 231 + + grub-core/lib/libgcrypt/src/hwf-x86.c | 512 + + grub-core/lib/libgcrypt/src/hwfeatures.c | 320 +- + grub-core/lib/libgcrypt/src/libgcrypt-config.in | 20 +- + grub-core/lib/libgcrypt/src/libgcrypt.def | 165 +- + grub-core/lib/libgcrypt/src/libgcrypt.m4 | 179 +- + grub-core/lib/libgcrypt/src/libgcrypt.pc.in | 18 + + grub-core/lib/libgcrypt/src/libgcrypt.vers | 93 +- + grub-core/lib/libgcrypt/src/misc.c | 452 +- + grub-core/lib/libgcrypt/src/missing-string.c | 4 +- + grub-core/lib/libgcrypt/src/module.c | 212 - + grub-core/lib/libgcrypt/src/mpi.h | 219 +- + grub-core/lib/libgcrypt/src/mpicalc.c | 627 + + grub-core/lib/libgcrypt/src/secmem.c | 625 +- + grub-core/lib/libgcrypt/src/secmem.h | 17 +- + grub-core/lib/libgcrypt/src/sexp.c | 1384 +- + grub-core/lib/libgcrypt/src/stdmem.c | 145 +- + grub-core/lib/libgcrypt/src/stdmem.h | 13 +- + grub-core/lib/libgcrypt/src/types.h | 160 +- + grub-core/lib/libgcrypt/src/versioninfo.rc.in | 2 +- + grub-core/lib/libgcrypt/src/visibility.c | 1040 +- + grub-core/lib/libgcrypt/src/visibility.h | 1234 +- + grub-core/lib/pkcs1_v15.c | 59 - + 470 files changed, 210391 insertions(+), 33128 deletions(-) + create mode 100644 grub-core/lib/libgcrypt/AUTHORS + create mode 100644 grub-core/lib/libgcrypt/COPYING + create mode 100644 grub-core/lib/libgcrypt/COPYING.LIB + create mode 100644 grub-core/lib/libgcrypt/LICENSES + create mode 100644 grub-core/lib/libgcrypt/README + create mode 100644 grub-core/lib/libgcrypt/README.GIT + create mode 100644 grub-core/lib/libgcrypt/THANKS + create mode 100644 grub-core/lib/libgcrypt/VERSION + delete mode 100644 grub-core/lib/libgcrypt/cipher/ChangeLog + delete mode 100644 grub-core/lib/libgcrypt/cipher/Manifest + delete mode 100644 grub-core/lib/libgcrypt/cipher/ac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/arcfour-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/aria-aesni-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/aria-aesni-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/aria-gfni-avx512-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/aria.c + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-common-aarch64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-common-amd64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-common-i386.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-common-s390x.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-inline-s390x.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-poly1305-aarch64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-poly1305-amd64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/asm-poly1305-s390x.h + create mode 100644 grub-core/lib/libgcrypt/cipher/blake2.c + create mode 100644 grub-core/lib/libgcrypt/cipher/blake2b-amd64-avx2.S + create mode 100644 grub-core/lib/libgcrypt/cipher/blake2b-amd64-avx512.S + create mode 100644 grub-core/lib/libgcrypt/cipher/blake2s-amd64-avx.S + create mode 100644 grub-core/lib/libgcrypt/cipher/blake2s-amd64-avx512.S + create mode 100644 grub-core/lib/libgcrypt/cipher/blowfish-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/blowfish-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/bulkhelp.h + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-aarch64-ce.c + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-aesni-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-aesni-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-aesni-avx2-amd64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-gfni-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-gfni-avx512-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-ppc8le.c + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-ppc9le.c + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-simd128.h + create mode 100644 grub-core/lib/libgcrypt/cipher/camellia-vaes-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/cast5-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/cast5-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-amd64-avx2.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-amd64-avx512.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-amd64-ssse3.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-p10le-8x.s + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20-s390x.S + create mode 100644 grub-core/lib/libgcrypt/cipher/chacha20.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-aeswrap.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-cbc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-ccm.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-cfb.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-cmac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-ctr.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-eax.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-armv8-aarch32-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-intel-pclmul.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm-siv.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-gcm.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-ocb.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-ofb.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-poly1305.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-siv.c + create mode 100644 grub-core/lib/libgcrypt/cipher/cipher-xts.c + create mode 100644 grub-core/lib/libgcrypt/cipher/crc-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/crc-armv8-ce.c + create mode 100644 grub-core/lib/libgcrypt/cipher/crc-intel-pclmul.c + create mode 100644 grub-core/lib/libgcrypt/cipher/crc-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/des-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/dsa-common.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-common.h + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-curves.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-ecdh.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-ecdsa.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-eddsa.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-gost.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-misc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/ecc-sm2.c + create mode 100644 grub-core/lib/libgcrypt/cipher/gost-s-box.c + create mode 100644 grub-core/lib/libgcrypt/cipher/gost-sb.h + create mode 100644 grub-core/lib/libgcrypt/cipher/gost.h + create mode 100644 grub-core/lib/libgcrypt/cipher/gost28147.c + create mode 100644 grub-core/lib/libgcrypt/cipher/gostr3411-94.c + delete mode 100644 grub-core/lib/libgcrypt/cipher/hmac-tests.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kdf-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/keccak-amd64-avx512.S + create mode 100644 grub-core/lib/libgcrypt/cipher/keccak-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/keccak.c + create mode 100644 grub-core/lib/libgcrypt/cipher/keccak_permute_32.h + create mode 100644 grub-core/lib/libgcrypt/cipher/keccak_permute_64.h + create mode 100644 grub-core/lib/libgcrypt/cipher/kem-ecc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kem-ecc.h + create mode 100644 grub-core/lib/libgcrypt/cipher/kem.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kyber-common.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kyber-kdep.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kyber.c + create mode 100644 grub-core/lib/libgcrypt/cipher/kyber.h + create mode 100644 grub-core/lib/libgcrypt/cipher/mac-cmac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mac-gmac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mac-hmac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mac-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/mac-poly1305.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mac.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mceliece6688128f.c + create mode 100644 grub-core/lib/libgcrypt/cipher/mceliece6688128f.h + create mode 100644 grub-core/lib/libgcrypt/cipher/poly1305-amd64-avx512.S + create mode 100644 grub-core/lib/libgcrypt/cipher/poly1305-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/poly1305-p10le.s + create mode 100644 grub-core/lib/libgcrypt/cipher/poly1305-s390x.S + create mode 100644 grub-core/lib/libgcrypt/cipher/poly1305.c + create mode 100644 grub-core/lib/libgcrypt/cipher/pubkey-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/pubkey-util.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-aesni.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-armv8-aarch32-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-armv8-ce.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-gcm-p10le.s + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-internal.h + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-p10le.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-padlock.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ppc-common.h + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ppc-functions.h + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ppc9le.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-s390x.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ssse3-amd64-asm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-ssse3-amd64.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-vaes-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-vaes-avx2-i386.S + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-vaes-i386.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rijndael-vaes.c + create mode 100644 grub-core/lib/libgcrypt/cipher/rsa-common.c + create mode 100644 grub-core/lib/libgcrypt/cipher/salsa20-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/salsa20-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/salsa20.c + create mode 100644 grub-core/lib/libgcrypt/cipher/scrypt.c + create mode 100644 grub-core/lib/libgcrypt/cipher/serpent-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/serpent-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/serpent-avx512-x86.c + create mode 100644 grub-core/lib/libgcrypt/cipher/serpent-sse2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-armv8-aarch32-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-avx-bmi2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-avx2-bmi2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-intel-shaext.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1-ssse3-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha1.h + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-armv8-aarch32-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-avx2-bmi2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-intel-shaext.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sha256-ssse3-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-armv7-neon.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-avx2-bmi2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-avx512-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-ssse3-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sha512-ssse3-i386.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sm3-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm3-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm3-avx-bmi2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm3.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-aesni-avx-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-aesni-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-armv8-aarch64-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-armv9-aarch64-sve-ce.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-gfni-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-gfni-avx512-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4-ppc.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sm4.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sntrup761.c + create mode 100644 grub-core/lib/libgcrypt/cipher/sntrup761.h + create mode 100644 grub-core/lib/libgcrypt/cipher/stribog.c + delete mode 100644 grub-core/lib/libgcrypt/cipher/test-getrusage.c + create mode 100644 grub-core/lib/libgcrypt/cipher/twofish-aarch64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/twofish-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/twofish-arm.S + create mode 100644 grub-core/lib/libgcrypt/cipher/twofish-avx2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/cipher/whirlpool-sse2-amd64.S + create mode 100644 grub-core/lib/libgcrypt/compat/Makefile.am + create mode 100644 grub-core/lib/libgcrypt/compat/clock.c + create mode 100644 grub-core/lib/libgcrypt/compat/compat.c + create mode 100644 grub-core/lib/libgcrypt/compat/getpid.c + create mode 100644 grub-core/lib/libgcrypt/compat/libcompat.h + create mode 100644 grub-core/lib/libgcrypt/config.h.in + create mode 100755 grub-core/lib/libgcrypt/configure + create mode 100644 grub-core/lib/libgcrypt/configure.ac + create mode 100755 grub-core/lib/libgcrypt/mkinstalldirs + delete mode 100644 grub-core/lib/libgcrypt/mpi/Manifest + rename grub-core/lib/libgcrypt/mpi/{pentium4/sse2 => aarch64}/distfiles (80%) + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpi-asm-defs.h + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpih-add1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul2.S + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpih-mul3.S + create mode 100644 grub-core/lib/libgcrypt/mpi/aarch64/mpih-sub1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/amd64/func_abi.h + rename grub-core/lib/libgcrypt/mpi/{i586 => arm}/distfiles (57%) + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpi-asm-defs.h + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpih-add1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpih-mul1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpih-mul2.S + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpih-mul3.S + create mode 100644 grub-core/lib/libgcrypt/mpi/arm/mpih-sub1.S + create mode 100644 grub-core/lib/libgcrypt/mpi/asm-common-aarch64.h + create mode 100644 grub-core/lib/libgcrypt/mpi/asm-common-amd64.h + create mode 100644 grub-core/lib/libgcrypt/mpi/asm-common-i386.h + rename grub-core/lib/libgcrypt/{cipher/rmd.h => mpi/ec-ed25519.c} (51%) + create mode 100644 grub-core/lib/libgcrypt/mpi/ec-hw-s390x.c + create mode 100644 grub-core/lib/libgcrypt/mpi/ec-inline.h + create mode 100644 grub-core/lib/libgcrypt/mpi/ec-internal.h + create mode 100644 grub-core/lib/libgcrypt/mpi/ec-nist.c + delete mode 100644 grub-core/lib/libgcrypt/mpi/generic/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/i386/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/README + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-add1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-lshift.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-mul1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-mul2.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-mul3.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-rshift.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/i586/mpih-sub1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/m68k/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/m68k/mc68020/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/mips3/Manifest + create mode 100644 grub-core/lib/libgcrypt/mpi/mpih-const-time.c + delete mode 100644 grub-core/lib/libgcrypt/mpi/pa7100/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/README + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/distfiles + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/mmx/distfiles + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/mmx/mpih-lshift.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/mmx/mpih-rshift.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/sse2/mpih-add1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/sse2/mpih-mul1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/sse2/mpih-mul2.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/sse2/mpih-mul3.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/pentium4/sse2/mpih-sub1.S + delete mode 100644 grub-core/lib/libgcrypt/mpi/power/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/powerpc32/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/sparc32/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/sparc32v8/Manifest + delete mode 100644 grub-core/lib/libgcrypt/mpi/supersparc/Manifest + delete mode 100644 grub-core/lib/libgcrypt/src/Manifest + delete mode 100644 grub-core/lib/libgcrypt/src/ath.c + delete mode 100644 grub-core/lib/libgcrypt/src/ath.h + create mode 100644 grub-core/lib/libgcrypt/src/const-time.c + create mode 100644 grub-core/lib/libgcrypt/src/const-time.h + create mode 100644 grub-core/lib/libgcrypt/src/context.c + create mode 100644 grub-core/lib/libgcrypt/src/context.h + create mode 100644 grub-core/lib/libgcrypt/src/ec-context.h + create mode 100644 grub-core/lib/libgcrypt/src/gcrypt-int.h + delete mode 100644 grub-core/lib/libgcrypt/src/gcrypt-module.h + create mode 100644 grub-core/lib/libgcrypt/src/gcrypt-testapi.h + delete mode 100644 grub-core/lib/libgcrypt/src/gcryptrnd.c + create mode 100755 grub-core/lib/libgcrypt/src/gen-note-integrity.sh + delete mode 100644 grub-core/lib/libgcrypt/src/getrandom.c + create mode 100644 grub-core/lib/libgcrypt/src/hwf-arm.c + create mode 100644 grub-core/lib/libgcrypt/src/hwf-common.h + create mode 100644 grub-core/lib/libgcrypt/src/hwf-ppc.c + create mode 100644 grub-core/lib/libgcrypt/src/hwf-s390x.c + create mode 100644 grub-core/lib/libgcrypt/src/hwf-x86.c + create mode 100644 grub-core/lib/libgcrypt/src/libgcrypt.pc.in + delete mode 100644 grub-core/lib/libgcrypt/src/module.c + create mode 100644 grub-core/lib/libgcrypt/src/mpicalc.c + delete mode 100644 grub-core/lib/pkcs1_v15.c + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 6ff4835..728ef8a 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -2591,14 +2591,6 @@ module = { + cppflags = '$(CPPFLAGS_GCRY)'; + }; + +-module = { +- name = pkcs1_v15; +- common = lib/pkcs1_v15.c; +- +- cflags = '$(CFLAGS_GCRY) -Wno-redundant-decls -Wno-sign-compare'; +- cppflags = '$(CPPFLAGS_GCRY)'; +-}; +- + module = { + name = all_video; + common = lib/fake_module.c; +diff --git a/grub-core/lib/libgcrypt/AUTHORS b/grub-core/lib/libgcrypt/AUTHORS +new file mode 100644 +index 0000000..f916160 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/AUTHORS +@@ -0,0 +1,274 @@ ++Library: Libgcrypt ++Homepage: https://gnupg.org/related_software/libgcrypt/ ++Download: https://gnupg.org/ftp/gcrypt/libgcrypt/ ++Repository: git://git.gnupg.org/libgcrypt.git ++Maintainer: Werner Koch ++Bug reports: https://bugs.gnupg.org ++Security related bug reports: ++End-of-life: TBD ++License (library): LGPLv2.1+ ++License (manual and tools): GPLv2+ ++ ++ ++Libgcrypt is free software. See the files COPYING.LIB and COPYING for ++copying conditions, and LICENSES for notices about a few contributions ++that require these additional notices to be distributed. License ++copyright years may be listed using range notation, e.g., 2000-2013, ++indicating that every year in the range, inclusive, is a copyrightable ++year that would otherwise be listed individually. ++ ++ ++List of Copyright holders ++========================= ++ ++ Copyright (C) 1989,1991-2018 Free Software Foundation, Inc. ++ Copyright (C) 1994 X Consortium ++ Copyright (C) 1996 L. Peter Deutsch ++ Copyright (C) 1997 Werner Koch ++ Copyright (C) 1998 The Internet Society ++ Copyright (C) 1996-1999 Peter Gutmann, Paul Kendall, and Chris Wedgwood ++ Copyright (C) 1996-2006 Peter Gutmann, Matt Thomlinson and Blake Coverett ++ Copyright (C) 2003 Nikos Mavroyanopoulos ++ Copyright (c) 2006 CRYPTOGAMS ++ Copyright (C) 2006-2007 NTT (Nippon Telegraph and Telephone Corporation) ++ Copyright (C) 2012-2024 g10 Code GmbH ++ Copyright (C) 2012 Simon Josefsson, Niels Möller ++ Copyright (c) 2012 Intel Corporation ++ Copyright (C) 2013 Christian Grothoff ++ Copyright (C) 2013-2024 Jussi Kivilinna ++ Copyright (C) 2013-2014 Dmitry Eremin-Solenikov ++ Copyright (C) 2014 Stephan Mueller ++ Copyright (C) 2017 Jia Zhang ++ Copyright (C) 2018 Bundesamt für Sicherheit in der Informationstechnik ++ Copyright (C) 2020 Alibaba Group. ++ Copyright (C) 2020 Tianjia Zhang ++ Copyright (C) 2023 Simon Josefsson ++ ++ ++Authors with a FSF copyright assignment ++======================================= ++ ++LIBGCRYPT Werner Koch 2001-06-07 ++Assigns past and future changes. ++Assignment for future changes terminated on 2012-12-04. ++wk@gnupg.org ++Designed and implemented Libgcrypt. ++ ++GNUPG Matthew Skala 1998-08-10 ++Disclaims changes. ++mskala@ansuz.sooke.bc.ca ++Wrote cipher/twofish.c. ++ ++GNUPG Natural Resources Canada 1998-08-11 ++Disclaims changes by Matthew Skala. ++ ++GNUPG Michael Roth Germany 1998-09-17 ++Assigns changes. ++mroth@nessie.de ++Wrote cipher/des.c. ++Changes and bug fixes all over the place. ++ ++GNUPG Niklas Hernaeus 1998-09-18 ++Disclaims changes. ++nh@df.lth.se ++Weak key patches. ++ ++GNUPG Rémi Guyomarch 1999-05-25 ++Assigns past and future changes. (g10/compress.c, g10/encr-data.c, ++g10/free-packet.c, g10/mdfilter.c, g10/plaintext.c, util/iobuf.c) ++rguyom@mail.dotcom.fr ++ ++ANY g10 Code GmbH 2001-06-07 ++Assignment for future changes terminated on 2012-12-04. ++Code marked with ChangeLog entries of g10 Code employees. ++ ++LIBGCRYPT Timo Schulz 2001-08-31 ++Assigns past and future changes. ++twoaday@freakmail.de ++ ++LIBGCRYPT Simon Josefsson 2002-10-25 ++Assigns past and future changes to FSF (cipher/{md4,crc}.c, CTR mode, ++CTS/MAC flags, self test improvements) ++simon@josefsson.org ++ ++LIBGCRYPT Moritz Schulte 2003-04-17 ++Assigns past and future changes. ++moritz@g10code.com ++ ++GNUTLS Nikolaos Mavrogiannopoulos 2003-11-22 ++nmav@gnutls.org ++Original code for cipher/rfc2268.c. ++ ++LIBGCRYPT The Written Word 2005-04-15 ++Assigns past and future changes. (new: src/libgcrypt.pc.in, ++src/Makefile.am, src/secmem.c, mpi/hppa1.1/mpih-mul3.S, ++mpi/hppa1.1/udiv-qrnnd.S, mpi/hppa1.1/mpih-mul2.S, ++mpi/hppa1.1/mpih-mul1.S, mpi/Makefile.am, tests/prime.c, ++tests/register.c, tests/ac.c, tests/basic.c, tests/tsexp.c, ++tests/keygen.c, tests/pubkey.c, configure.ac, acinclude.m4) ++ ++LIBGCRYPT Brad Hards 2006-02-09 ++Assigns Past and Future Changes ++bradh@frogmouth.net ++(Added OFB mode. Changed cipher/cipher.c, test/basic.c doc/gcrypt.tex. ++ added SHA-224, changed cipher/sha256.c, added HMAC tests.) ++ ++LIBGCRYPT Hye-Shik Chang 2006-09-07 ++Assigns Past and Future Changes ++perky@freebsd.org ++(SEED cipher) ++ ++LIBGCRYPT Werner Dittmann 2009-05-20 ++Assigns Past and Future Changes ++werner.dittmann@t-online.de ++(mpi/amd64, tests/mpitests.c) ++ ++GNUPG David Shaw ++Assigns past and future changes. ++dshaw@jabberwocky.com ++(cipher/camellia-glue.c and related stuff) ++ ++LIBGCRYPT Andrey Jivsov 2010-12-09 ++Assigns Past and Future Changes ++openpgp@brainhub.org ++(cipher/ecc.c and related files) ++ ++LIBGCRYPT Ulrich Müller 2012-02-15 ++Assigns Past and Future Changes ++ulm@gentoo.org ++(Changes to cipher/idea.c and related files) ++ ++LIBGCRYPT Vladimir Serbinenko 2012-04-26 ++Assigns Past and Future Changes ++phcoder@gmail.com ++(cipher/serpent.c) ++ ++ ++Authors with a DCO ++================== ++ ++Andrei Scherer ++2014-08-22:BF7CEF794F9.000003F0andsch@inbox.com: ++ ++Christian Aistleitner ++2013-02-26:20130226110144.GA12678@quelltextlich.at: ++ ++Christian Grothoff ++2013-03-21:514B5D8A.6040705@grothoff.org: ++ ++Clemens Lang ++2022-02-10:20220210133844.46581-1-cllang@redhat.com: ++ ++Danny Tsen ++2021-12-20:OF85D11C2F.7A339D7D-ON002587B1.0042A81E-002587B1.0042B94D@ibm.com ++ ++Dmitry Baryshkov ++Dmitry Eremin-Solenikov ++2013-07-13:20130713144407.GA27334@fangorn.rup.mentorg.com: ++ ++Dmitry Kasatkin ++2012-12-14:50CAE2DB.80302@intel.com: ++ ++Falko Strenzke ++2023-09-27:51677567-0b78-4665-805d-fd0cdd50f7fa@mtg.de: ++ ++H.J. Lu ++2020-01-19:20200119135241.GA4970@gmail.com: ++ ++Jia Zhang ++2017-10-17:59E56E30.9060503@alibaba-inc.com: ++ ++Jérémie Courrèges-Anglas ++2016-05-26:87bn3ssqg0.fsf@ritchie.wxcvbn.org: ++ ++Jussi Kivilinna ++2012-11-15:20121115172331.150537dzb5i6jmy8@www.dalek.fi: ++ ++Jussi Kivilinna ++2013-05-06:5186720A.4090101@iki.fi: ++ ++Markus Teich ++2014-10-08:20141008180509.GA2770@trolle: ++ ++Martin Storsjö ++2018-03-28:dc1605ce-a47d-34c5-8851-d9569f9ea5d3@martin.st: ++ ++Mathias L. Baumann ++2017-01-30:07c06d79-0828-b564-d604-fd16c7c86ebe@sociomantic.com: ++ ++Milan Broz ++2014-01-13:52D44CC6.4050707@gmail.com: ++ ++Paul Wolneykien ++2019-11-19:20191119204459.312927aa@rigel.localdomain: ++ ++Peter Wu ++2015-07-22:20150722191325.GA8113@al: ++ ++Rafaël Carré ++2012-04-20:4F91988B.1080502@videolan.org: ++ ++Sergey V. ++2013-11-07:2066221.5IYa7Yq760@darkstar: ++ ++Shawn Landden ++2019-07-09:2794651562684255@iva4-64850291ca1c.qloud-c.yandex.net: ++ ++Simit Ghane ++2024-05-06:OF22575887.761836D9-ON48258B15.0044A21E-48258B15.0044A222@lge.com: ++ ++Stephan Mueller ++2014-08-22:2008899.25OeoelVVA@myon.chronox.de: ++ ++Tianjia Zhang ++2020-01-08:dcda0127-2f45-93a3-0736-27259a33bffa@linux.alibaba.com: ++ ++Tomáš Mráz ++2012-04-16:1334571250.5056.52.camel@vespa.frost.loc: ++ ++Vitezslav Cizek ++2015-11-05:20151105131424.GA32700@kolac.suse.cz: ++ ++Werner Koch (g10 Code GmbH) ++2012-12-05:87obi8u4h2.fsf@vigenere.g10code.de: ++ ++ ++More credits ++============ ++ ++Libgcrypt used to be part of GnuPG but has been taken out into its own ++package on 2000-12-21. ++ ++Most of the stuff in mpi has been taken from an old GMP library ++version by Torbjorn Granlund . ++ ++The files cipher/rndunix.c and cipher/rndw32.c are based on those ++files from Cryptlib. Copyright Peter Gutmann, Paul Kendall, and Chris ++Wedgwood 1996-1999. ++ ++The ECC code cipher/ecc.c was based on code by Sergi Blanch i Torne, ++sergi at calcurco dot org. ++ ++The implementation of the Camellia cipher has been been taken from the ++original NTT provided GPL source. ++ ++The CAVS testing program tests/cavs_driver.pl is not to be considered ++a part of libgcrypt proper. We distribute it merely for convenience. ++It has a permissive license and is copyrighted by atsec information ++security corporation. See the file for details. ++ ++The file salsa20.c is based on D.J. Bernstein's public domain code and ++taken from Nettle. Copyright 2012 Simon Josefsson and Niels Möller. ++ ++The sntrup761 code is based on public domain code written by Daniel ++J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange, and Christine ++van Vredendaal. Copyright 2023 Simon Josefsson. ++ ++ ++ This file is free software; as a special exception the author gives ++ unlimited permission to copy and/or distribute it, with or without ++ modifications, as long as this notice is preserved. ++ ++ This file is distributed in the hope that it will be useful, but ++ WITHOUT ANY WARRANTY, to the extent permitted by law; without even the ++ implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +diff --git a/grub-core/lib/libgcrypt/COPYING b/grub-core/lib/libgcrypt/COPYING +new file mode 100644 +index 0000000..d159169 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/COPYING +@@ -0,0 +1,339 @@ ++ GNU GENERAL PUBLIC LICENSE ++ Version 2, June 1991 ++ ++ Copyright (C) 1989, 1991 Free Software Foundation, Inc., ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Everyone is permitted to copy and distribute verbatim copies ++ of this license document, but changing it is not allowed. ++ ++ Preamble ++ ++ The licenses for most software are designed to take away your ++freedom to share and change it. By contrast, the GNU General Public ++License is intended to guarantee your freedom to share and change free ++software--to make sure the software is free for all its users. This ++General Public License applies to most of the Free Software ++Foundation's software and to any other program whose authors commit to ++using it. (Some other Free Software Foundation software is covered by ++the GNU Lesser General Public License instead.) You can apply it to ++your programs, too. ++ ++ When we speak of free software, we are referring to freedom, not ++price. Our General Public Licenses are designed to make sure that you ++have the freedom to distribute copies of free software (and charge for ++this service if you wish), that you receive source code or can get it ++if you want it, that you can change the software or use pieces of it ++in new free programs; and that you know you can do these things. ++ ++ To protect your rights, we need to make restrictions that forbid ++anyone to deny you these rights or to ask you to surrender the rights. ++These restrictions translate to certain responsibilities for you if you ++distribute copies of the software, or if you modify it. ++ ++ For example, if you distribute copies of such a program, whether ++gratis or for a fee, you must give the recipients all the rights that ++you have. You must make sure that they, too, receive or can get the ++source code. And you must show them these terms so they know their ++rights. ++ ++ We protect your rights with two steps: (1) copyright the software, and ++(2) offer you this license which gives you legal permission to copy, ++distribute and/or modify the software. ++ ++ Also, for each author's protection and ours, we want to make certain ++that everyone understands that there is no warranty for this free ++software. If the software is modified by someone else and passed on, we ++want its recipients to know that what they have is not the original, so ++that any problems introduced by others will not reflect on the original ++authors' reputations. ++ ++ Finally, any free program is threatened constantly by software ++patents. We wish to avoid the danger that redistributors of a free ++program will individually obtain patent licenses, in effect making the ++program proprietary. To prevent this, we have made it clear that any ++patent must be licensed for everyone's free use or not licensed at all. ++ ++ The precise terms and conditions for copying, distribution and ++modification follow. ++ ++ GNU GENERAL PUBLIC LICENSE ++ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION ++ ++ 0. This License applies to any program or other work which contains ++a notice placed by the copyright holder saying it may be distributed ++under the terms of this General Public License. The "Program", below, ++refers to any such program or work, and a "work based on the Program" ++means either the Program or any derivative work under copyright law: ++that is to say, a work containing the Program or a portion of it, ++either verbatim or with modifications and/or translated into another ++language. (Hereinafter, translation is included without limitation in ++the term "modification".) Each licensee is addressed as "you". ++ ++Activities other than copying, distribution and modification are not ++covered by this License; they are outside its scope. The act of ++running the Program is not restricted, and the output from the Program ++is covered only if its contents constitute a work based on the ++Program (independent of having been made by running the Program). ++Whether that is true depends on what the Program does. ++ ++ 1. You may copy and distribute verbatim copies of the Program's ++source code as you receive it, in any medium, provided that you ++conspicuously and appropriately publish on each copy an appropriate ++copyright notice and disclaimer of warranty; keep intact all the ++notices that refer to this License and to the absence of any warranty; ++and give any other recipients of the Program a copy of this License ++along with the Program. ++ ++You may charge a fee for the physical act of transferring a copy, and ++you may at your option offer warranty protection in exchange for a fee. ++ ++ 2. You may modify your copy or copies of the Program or any portion ++of it, thus forming a work based on the Program, and copy and ++distribute such modifications or work under the terms of Section 1 ++above, provided that you also meet all of these conditions: ++ ++ a) You must cause the modified files to carry prominent notices ++ stating that you changed the files and the date of any change. ++ ++ b) You must cause any work that you distribute or publish, that in ++ whole or in part contains or is derived from the Program or any ++ part thereof, to be licensed as a whole at no charge to all third ++ parties under the terms of this License. ++ ++ c) If the modified program normally reads commands interactively ++ when run, you must cause it, when started running for such ++ interactive use in the most ordinary way, to print or display an ++ announcement including an appropriate copyright notice and a ++ notice that there is no warranty (or else, saying that you provide ++ a warranty) and that users may redistribute the program under ++ these conditions, and telling the user how to view a copy of this ++ License. (Exception: if the Program itself is interactive but ++ does not normally print such an announcement, your work based on ++ the Program is not required to print an announcement.) ++ ++These requirements apply to the modified work as a whole. If ++identifiable sections of that work are not derived from the Program, ++and can be reasonably considered independent and separate works in ++themselves, then this License, and its terms, do not apply to those ++sections when you distribute them as separate works. But when you ++distribute the same sections as part of a whole which is a work based ++on the Program, the distribution of the whole must be on the terms of ++this License, whose permissions for other licensees extend to the ++entire whole, and thus to each and every part regardless of who wrote it. ++ ++Thus, it is not the intent of this section to claim rights or contest ++your rights to work written entirely by you; rather, the intent is to ++exercise the right to control the distribution of derivative or ++collective works based on the Program. ++ ++In addition, mere aggregation of another work not based on the Program ++with the Program (or with a work based on the Program) on a volume of ++a storage or distribution medium does not bring the other work under ++the scope of this License. ++ ++ 3. You may copy and distribute the Program (or a work based on it, ++under Section 2) in object code or executable form under the terms of ++Sections 1 and 2 above provided that you also do one of the following: ++ ++ a) Accompany it with the complete corresponding machine-readable ++ source code, which must be distributed under the terms of Sections ++ 1 and 2 above on a medium customarily used for software interchange; or, ++ ++ b) Accompany it with a written offer, valid for at least three ++ years, to give any third party, for a charge no more than your ++ cost of physically performing source distribution, a complete ++ machine-readable copy of the corresponding source code, to be ++ distributed under the terms of Sections 1 and 2 above on a medium ++ customarily used for software interchange; or, ++ ++ c) Accompany it with the information you received as to the offer ++ to distribute corresponding source code. (This alternative is ++ allowed only for noncommercial distribution and only if you ++ received the program in object code or executable form with such ++ an offer, in accord with Subsection b above.) ++ ++The source code for a work means the preferred form of the work for ++making modifications to it. For an executable work, complete source ++code means all the source code for all modules it contains, plus any ++associated interface definition files, plus the scripts used to ++control compilation and installation of the executable. However, as a ++special exception, the source code distributed need not include ++anything that is normally distributed (in either source or binary ++form) with the major components (compiler, kernel, and so on) of the ++operating system on which the executable runs, unless that component ++itself accompanies the executable. ++ ++If distribution of executable or object code is made by offering ++access to copy from a designated place, then offering equivalent ++access to copy the source code from the same place counts as ++distribution of the source code, even though third parties are not ++compelled to copy the source along with the object code. ++ ++ 4. You may not copy, modify, sublicense, or distribute the Program ++except as expressly provided under this License. Any attempt ++otherwise to copy, modify, sublicense or distribute the Program is ++void, and will automatically terminate your rights under this License. ++However, parties who have received copies, or rights, from you under ++this License will not have their licenses terminated so long as such ++parties remain in full compliance. ++ ++ 5. You are not required to accept this License, since you have not ++signed it. However, nothing else grants you permission to modify or ++distribute the Program or its derivative works. These actions are ++prohibited by law if you do not accept this License. Therefore, by ++modifying or distributing the Program (or any work based on the ++Program), you indicate your acceptance of this License to do so, and ++all its terms and conditions for copying, distributing or modifying ++the Program or works based on it. ++ ++ 6. Each time you redistribute the Program (or any work based on the ++Program), the recipient automatically receives a license from the ++original licensor to copy, distribute or modify the Program subject to ++these terms and conditions. You may not impose any further ++restrictions on the recipients' exercise of the rights granted herein. ++You are not responsible for enforcing compliance by third parties to ++this License. ++ ++ 7. If, as a consequence of a court judgment or allegation of patent ++infringement or for any other reason (not limited to patent issues), ++conditions are imposed on you (whether by court order, agreement or ++otherwise) that contradict the conditions of this License, they do not ++excuse you from the conditions of this License. If you cannot ++distribute so as to satisfy simultaneously your obligations under this ++License and any other pertinent obligations, then as a consequence you ++may not distribute the Program at all. For example, if a patent ++license would not permit royalty-free redistribution of the Program by ++all those who receive copies directly or indirectly through you, then ++the only way you could satisfy both it and this License would be to ++refrain entirely from distribution of the Program. ++ ++If any portion of this section is held invalid or unenforceable under ++any particular circumstance, the balance of the section is intended to ++apply and the section as a whole is intended to apply in other ++circumstances. ++ ++It is not the purpose of this section to induce you to infringe any ++patents or other property right claims or to contest validity of any ++such claims; this section has the sole purpose of protecting the ++integrity of the free software distribution system, which is ++implemented by public license practices. Many people have made ++generous contributions to the wide range of software distributed ++through that system in reliance on consistent application of that ++system; it is up to the author/donor to decide if he or she is willing ++to distribute software through any other system and a licensee cannot ++impose that choice. ++ ++This section is intended to make thoroughly clear what is believed to ++be a consequence of the rest of this License. ++ ++ 8. If the distribution and/or use of the Program is restricted in ++certain countries either by patents or by copyrighted interfaces, the ++original copyright holder who places the Program under this License ++may add an explicit geographical distribution limitation excluding ++those countries, so that distribution is permitted only in or among ++countries not thus excluded. In such case, this License incorporates ++the limitation as if written in the body of this License. ++ ++ 9. The Free Software Foundation may publish revised and/or new versions ++of the General Public License from time to time. Such new versions will ++be similar in spirit to the present version, but may differ in detail to ++address new problems or concerns. ++ ++Each version is given a distinguishing version number. If the Program ++specifies a version number of this License which applies to it and "any ++later version", you have the option of following the terms and conditions ++either of that version or of any later version published by the Free ++Software Foundation. If the Program does not specify a version number of ++this License, you may choose any version ever published by the Free Software ++Foundation. ++ ++ 10. If you wish to incorporate parts of the Program into other free ++programs whose distribution conditions are different, write to the author ++to ask for permission. For software which is copyrighted by the Free ++Software Foundation, write to the Free Software Foundation; we sometimes ++make exceptions for this. Our decision will be guided by the two goals ++of preserving the free status of all derivatives of our free software and ++of promoting the sharing and reuse of software generally. ++ ++ NO WARRANTY ++ ++ 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY ++FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN ++OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES ++PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED ++OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF ++MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS ++TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE ++PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, ++REPAIR OR CORRECTION. ++ ++ 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING ++WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR ++REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, ++INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING ++OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED ++TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY ++YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER ++PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE ++POSSIBILITY OF SUCH DAMAGES. ++ ++ END OF TERMS AND CONDITIONS ++ ++ How to Apply These Terms to Your New Programs ++ ++ If you develop a new program, and you want it to be of the greatest ++possible use to the public, the best way to achieve this is to make it ++free software which everyone can redistribute and change under these terms. ++ ++ To do so, attach the following notices to the program. It is safest ++to attach them to the start of each source file to most effectively ++convey the exclusion of warranty; and each file should have at least ++the "copyright" line and a pointer to where the full notice is found. ++ ++ ++ Copyright (C) ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 2 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License along ++ with this program; if not, write to the Free Software Foundation, Inc., ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++ ++Also add information on how to contact you by electronic and paper mail. ++ ++If the program is interactive, make it output a short notice like this ++when it starts in an interactive mode: ++ ++ Gnomovision version 69, Copyright (C) year name of author ++ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. ++ This is free software, and you are welcome to redistribute it ++ under certain conditions; type `show c' for details. ++ ++The hypothetical commands `show w' and `show c' should show the appropriate ++parts of the General Public License. Of course, the commands you use may ++be called something other than `show w' and `show c'; they could even be ++mouse-clicks or menu items--whatever suits your program. ++ ++You should also get your employer (if you work as a programmer) or your ++school, if any, to sign a "copyright disclaimer" for the program, if ++necessary. Here is a sample; alter the names: ++ ++ Yoyodyne, Inc., hereby disclaims all copyright interest in the program ++ `Gnomovision' (which makes passes at compilers) written by James Hacker. ++ ++ , 1 April 1989 ++ Ty Coon, President of Vice ++ ++This General Public License does not permit incorporating your program into ++proprietary programs. If your program is a subroutine library, you may ++consider it more useful to permit linking proprietary applications with the ++library. If this is what you want to do, use the GNU Lesser General ++Public License instead of this License. +diff --git a/grub-core/lib/libgcrypt/COPYING.LIB b/grub-core/lib/libgcrypt/COPYING.LIB +new file mode 100644 +index 0000000..4362b49 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/COPYING.LIB +@@ -0,0 +1,502 @@ ++ GNU LESSER GENERAL PUBLIC LICENSE ++ Version 2.1, February 1999 ++ ++ Copyright (C) 1991, 1999 Free Software Foundation, Inc. ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Everyone is permitted to copy and distribute verbatim copies ++ of this license document, but changing it is not allowed. ++ ++[This is the first released version of the Lesser GPL. It also counts ++ as the successor of the GNU Library Public License, version 2, hence ++ the version number 2.1.] ++ ++ Preamble ++ ++ The licenses for most software are designed to take away your ++freedom to share and change it. By contrast, the GNU General Public ++Licenses are intended to guarantee your freedom to share and change ++free software--to make sure the software is free for all its users. ++ ++ This license, the Lesser General Public License, applies to some ++specially designated software packages--typically libraries--of the ++Free Software Foundation and other authors who decide to use it. You ++can use it too, but we suggest you first think carefully about whether ++this license or the ordinary General Public License is the better ++strategy to use in any particular case, based on the explanations below. ++ ++ When we speak of free software, we are referring to freedom of use, ++not price. Our General Public Licenses are designed to make sure that ++you have the freedom to distribute copies of free software (and charge ++for this service if you wish); that you receive source code or can get ++it if you want it; that you can change the software and use pieces of ++it in new free programs; and that you are informed that you can do ++these things. ++ ++ To protect your rights, we need to make restrictions that forbid ++distributors to deny you these rights or to ask you to surrender these ++rights. These restrictions translate to certain responsibilities for ++you if you distribute copies of the library or if you modify it. ++ ++ For example, if you distribute copies of the library, whether gratis ++or for a fee, you must give the recipients all the rights that we gave ++you. You must make sure that they, too, receive or can get the source ++code. If you link other code with the library, you must provide ++complete object files to the recipients, so that they can relink them ++with the library after making changes to the library and recompiling ++it. And you must show them these terms so they know their rights. ++ ++ We protect your rights with a two-step method: (1) we copyright the ++library, and (2) we offer you this license, which gives you legal ++permission to copy, distribute and/or modify the library. ++ ++ To protect each distributor, we want to make it very clear that ++there is no warranty for the free library. Also, if the library is ++modified by someone else and passed on, the recipients should know ++that what they have is not the original version, so that the original ++author's reputation will not be affected by problems that might be ++introduced by others. ++ ++ Finally, software patents pose a constant threat to the existence of ++any free program. We wish to make sure that a company cannot ++effectively restrict the users of a free program by obtaining a ++restrictive license from a patent holder. Therefore, we insist that ++any patent license obtained for a version of the library must be ++consistent with the full freedom of use specified in this license. ++ ++ Most GNU software, including some libraries, is covered by the ++ordinary GNU General Public License. This license, the GNU Lesser ++General Public License, applies to certain designated libraries, and ++is quite different from the ordinary General Public License. We use ++this license for certain libraries in order to permit linking those ++libraries into non-free programs. ++ ++ When a program is linked with a library, whether statically or using ++a shared library, the combination of the two is legally speaking a ++combined work, a derivative of the original library. The ordinary ++General Public License therefore permits such linking only if the ++entire combination fits its criteria of freedom. The Lesser General ++Public License permits more lax criteria for linking other code with ++the library. ++ ++ We call this license the "Lesser" General Public License because it ++does Less to protect the user's freedom than the ordinary General ++Public License. It also provides other free software developers Less ++of an advantage over competing non-free programs. These disadvantages ++are the reason we use the ordinary General Public License for many ++libraries. However, the Lesser license provides advantages in certain ++special circumstances. ++ ++ For example, on rare occasions, there may be a special need to ++encourage the widest possible use of a certain library, so that it becomes ++a de-facto standard. To achieve this, non-free programs must be ++allowed to use the library. A more frequent case is that a free ++library does the same job as widely used non-free libraries. In this ++case, there is little to gain by limiting the free library to free ++software only, so we use the Lesser General Public License. ++ ++ In other cases, permission to use a particular library in non-free ++programs enables a greater number of people to use a large body of ++free software. For example, permission to use the GNU C Library in ++non-free programs enables many more people to use the whole GNU ++operating system, as well as its variant, the GNU/Linux operating ++system. ++ ++ Although the Lesser General Public License is Less protective of the ++users' freedom, it does ensure that the user of a program that is ++linked with the Library has the freedom and the wherewithal to run ++that program using a modified version of the Library. ++ ++ The precise terms and conditions for copying, distribution and ++modification follow. Pay close attention to the difference between a ++"work based on the library" and a "work that uses the library". The ++former contains code derived from the library, whereas the latter must ++be combined with the library in order to run. ++ ++ GNU LESSER GENERAL PUBLIC LICENSE ++ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION ++ ++ 0. This License Agreement applies to any software library or other ++program which contains a notice placed by the copyright holder or ++other authorized party saying it may be distributed under the terms of ++this Lesser General Public License (also called "this License"). ++Each licensee is addressed as "you". ++ ++ A "library" means a collection of software functions and/or data ++prepared so as to be conveniently linked with application programs ++(which use some of those functions and data) to form executables. ++ ++ The "Library", below, refers to any such software library or work ++which has been distributed under these terms. A "work based on the ++Library" means either the Library or any derivative work under ++copyright law: that is to say, a work containing the Library or a ++portion of it, either verbatim or with modifications and/or translated ++straightforwardly into another language. (Hereinafter, translation is ++included without limitation in the term "modification".) ++ ++ "Source code" for a work means the preferred form of the work for ++making modifications to it. For a library, complete source code means ++all the source code for all modules it contains, plus any associated ++interface definition files, plus the scripts used to control compilation ++and installation of the library. ++ ++ Activities other than copying, distribution and modification are not ++covered by this License; they are outside its scope. The act of ++running a program using the Library is not restricted, and output from ++such a program is covered only if its contents constitute a work based ++on the Library (independent of the use of the Library in a tool for ++writing it). Whether that is true depends on what the Library does ++and what the program that uses the Library does. ++ ++ 1. You may copy and distribute verbatim copies of the Library's ++complete source code as you receive it, in any medium, provided that ++you conspicuously and appropriately publish on each copy an ++appropriate copyright notice and disclaimer of warranty; keep intact ++all the notices that refer to this License and to the absence of any ++warranty; and distribute a copy of this License along with the ++Library. ++ ++ You may charge a fee for the physical act of transferring a copy, ++and you may at your option offer warranty protection in exchange for a ++fee. ++ ++ 2. You may modify your copy or copies of the Library or any portion ++of it, thus forming a work based on the Library, and copy and ++distribute such modifications or work under the terms of Section 1 ++above, provided that you also meet all of these conditions: ++ ++ a) The modified work must itself be a software library. ++ ++ b) You must cause the files modified to carry prominent notices ++ stating that you changed the files and the date of any change. ++ ++ c) You must cause the whole of the work to be licensed at no ++ charge to all third parties under the terms of this License. ++ ++ d) If a facility in the modified Library refers to a function or a ++ table of data to be supplied by an application program that uses ++ the facility, other than as an argument passed when the facility ++ is invoked, then you must make a good faith effort to ensure that, ++ in the event an application does not supply such function or ++ table, the facility still operates, and performs whatever part of ++ its purpose remains meaningful. ++ ++ (For example, a function in a library to compute square roots has ++ a purpose that is entirely well-defined independent of the ++ application. Therefore, Subsection 2d requires that any ++ application-supplied function or table used by this function must ++ be optional: if the application does not supply it, the square ++ root function must still compute square roots.) ++ ++These requirements apply to the modified work as a whole. If ++identifiable sections of that work are not derived from the Library, ++and can be reasonably considered independent and separate works in ++themselves, then this License, and its terms, do not apply to those ++sections when you distribute them as separate works. But when you ++distribute the same sections as part of a whole which is a work based ++on the Library, the distribution of the whole must be on the terms of ++this License, whose permissions for other licensees extend to the ++entire whole, and thus to each and every part regardless of who wrote ++it. ++ ++Thus, it is not the intent of this section to claim rights or contest ++your rights to work written entirely by you; rather, the intent is to ++exercise the right to control the distribution of derivative or ++collective works based on the Library. ++ ++In addition, mere aggregation of another work not based on the Library ++with the Library (or with a work based on the Library) on a volume of ++a storage or distribution medium does not bring the other work under ++the scope of this License. ++ ++ 3. You may opt to apply the terms of the ordinary GNU General Public ++License instead of this License to a given copy of the Library. To do ++this, you must alter all the notices that refer to this License, so ++that they refer to the ordinary GNU General Public License, version 2, ++instead of to this License. (If a newer version than version 2 of the ++ordinary GNU General Public License has appeared, then you can specify ++that version instead if you wish.) Do not make any other change in ++these notices. ++ ++ Once this change is made in a given copy, it is irreversible for ++that copy, so the ordinary GNU General Public License applies to all ++subsequent copies and derivative works made from that copy. ++ ++ This option is useful when you wish to copy part of the code of ++the Library into a program that is not a library. ++ ++ 4. You may copy and distribute the Library (or a portion or ++derivative of it, under Section 2) in object code or executable form ++under the terms of Sections 1 and 2 above provided that you accompany ++it with the complete corresponding machine-readable source code, which ++must be distributed under the terms of Sections 1 and 2 above on a ++medium customarily used for software interchange. ++ ++ If distribution of object code is made by offering access to copy ++from a designated place, then offering equivalent access to copy the ++source code from the same place satisfies the requirement to ++distribute the source code, even though third parties are not ++compelled to copy the source along with the object code. ++ ++ 5. A program that contains no derivative of any portion of the ++Library, but is designed to work with the Library by being compiled or ++linked with it, is called a "work that uses the Library". Such a ++work, in isolation, is not a derivative work of the Library, and ++therefore falls outside the scope of this License. ++ ++ However, linking a "work that uses the Library" with the Library ++creates an executable that is a derivative of the Library (because it ++contains portions of the Library), rather than a "work that uses the ++library". The executable is therefore covered by this License. ++Section 6 states terms for distribution of such executables. ++ ++ When a "work that uses the Library" uses material from a header file ++that is part of the Library, the object code for the work may be a ++derivative work of the Library even though the source code is not. ++Whether this is true is especially significant if the work can be ++linked without the Library, or if the work is itself a library. The ++threshold for this to be true is not precisely defined by law. ++ ++ If such an object file uses only numerical parameters, data ++structure layouts and accessors, and small macros and small inline ++functions (ten lines or less in length), then the use of the object ++file is unrestricted, regardless of whether it is legally a derivative ++work. (Executables containing this object code plus portions of the ++Library will still fall under Section 6.) ++ ++ Otherwise, if the work is a derivative of the Library, you may ++distribute the object code for the work under the terms of Section 6. ++Any executables containing that work also fall under Section 6, ++whether or not they are linked directly with the Library itself. ++ ++ 6. As an exception to the Sections above, you may also combine or ++link a "work that uses the Library" with the Library to produce a ++work containing portions of the Library, and distribute that work ++under terms of your choice, provided that the terms permit ++modification of the work for the customer's own use and reverse ++engineering for debugging such modifications. ++ ++ You must give prominent notice with each copy of the work that the ++Library is used in it and that the Library and its use are covered by ++this License. You must supply a copy of this License. If the work ++during execution displays copyright notices, you must include the ++copyright notice for the Library among them, as well as a reference ++directing the user to the copy of this License. Also, you must do one ++of these things: ++ ++ a) Accompany the work with the complete corresponding ++ machine-readable source code for the Library including whatever ++ changes were used in the work (which must be distributed under ++ Sections 1 and 2 above); and, if the work is an executable linked ++ with the Library, with the complete machine-readable "work that ++ uses the Library", as object code and/or source code, so that the ++ user can modify the Library and then relink to produce a modified ++ executable containing the modified Library. (It is understood ++ that the user who changes the contents of definitions files in the ++ Library will not necessarily be able to recompile the application ++ to use the modified definitions.) ++ ++ b) Use a suitable shared library mechanism for linking with the ++ Library. A suitable mechanism is one that (1) uses at run time a ++ copy of the library already present on the user's computer system, ++ rather than copying library functions into the executable, and (2) ++ will operate properly with a modified version of the library, if ++ the user installs one, as long as the modified version is ++ interface-compatible with the version that the work was made with. ++ ++ c) Accompany the work with a written offer, valid for at ++ least three years, to give the same user the materials ++ specified in Subsection 6a, above, for a charge no more ++ than the cost of performing this distribution. ++ ++ d) If distribution of the work is made by offering access to copy ++ from a designated place, offer equivalent access to copy the above ++ specified materials from the same place. ++ ++ e) Verify that the user has already received a copy of these ++ materials or that you have already sent this user a copy. ++ ++ For an executable, the required form of the "work that uses the ++Library" must include any data and utility programs needed for ++reproducing the executable from it. However, as a special exception, ++the materials to be distributed need not include anything that is ++normally distributed (in either source or binary form) with the major ++components (compiler, kernel, and so on) of the operating system on ++which the executable runs, unless that component itself accompanies ++the executable. ++ ++ It may happen that this requirement contradicts the license ++restrictions of other proprietary libraries that do not normally ++accompany the operating system. Such a contradiction means you cannot ++use both them and the Library together in an executable that you ++distribute. ++ ++ 7. You may place library facilities that are a work based on the ++Library side-by-side in a single library together with other library ++facilities not covered by this License, and distribute such a combined ++library, provided that the separate distribution of the work based on ++the Library and of the other library facilities is otherwise ++permitted, and provided that you do these two things: ++ ++ a) Accompany the combined library with a copy of the same work ++ based on the Library, uncombined with any other library ++ facilities. This must be distributed under the terms of the ++ Sections above. ++ ++ b) Give prominent notice with the combined library of the fact ++ that part of it is a work based on the Library, and explaining ++ where to find the accompanying uncombined form of the same work. ++ ++ 8. You may not copy, modify, sublicense, link with, or distribute ++the Library except as expressly provided under this License. Any ++attempt otherwise to copy, modify, sublicense, link with, or ++distribute the Library is void, and will automatically terminate your ++rights under this License. However, parties who have received copies, ++or rights, from you under this License will not have their licenses ++terminated so long as such parties remain in full compliance. ++ ++ 9. You are not required to accept this License, since you have not ++signed it. However, nothing else grants you permission to modify or ++distribute the Library or its derivative works. These actions are ++prohibited by law if you do not accept this License. Therefore, by ++modifying or distributing the Library (or any work based on the ++Library), you indicate your acceptance of this License to do so, and ++all its terms and conditions for copying, distributing or modifying ++the Library or works based on it. ++ ++ 10. Each time you redistribute the Library (or any work based on the ++Library), the recipient automatically receives a license from the ++original licensor to copy, distribute, link with or modify the Library ++subject to these terms and conditions. You may not impose any further ++restrictions on the recipients' exercise of the rights granted herein. ++You are not responsible for enforcing compliance by third parties with ++this License. ++ ++ 11. If, as a consequence of a court judgment or allegation of patent ++infringement or for any other reason (not limited to patent issues), ++conditions are imposed on you (whether by court order, agreement or ++otherwise) that contradict the conditions of this License, they do not ++excuse you from the conditions of this License. If you cannot ++distribute so as to satisfy simultaneously your obligations under this ++License and any other pertinent obligations, then as a consequence you ++may not distribute the Library at all. For example, if a patent ++license would not permit royalty-free redistribution of the Library by ++all those who receive copies directly or indirectly through you, then ++the only way you could satisfy both it and this License would be to ++refrain entirely from distribution of the Library. ++ ++If any portion of this section is held invalid or unenforceable under any ++particular circumstance, the balance of the section is intended to apply, ++and the section as a whole is intended to apply in other circumstances. ++ ++It is not the purpose of this section to induce you to infringe any ++patents or other property right claims or to contest validity of any ++such claims; this section has the sole purpose of protecting the ++integrity of the free software distribution system which is ++implemented by public license practices. Many people have made ++generous contributions to the wide range of software distributed ++through that system in reliance on consistent application of that ++system; it is up to the author/donor to decide if he or she is willing ++to distribute software through any other system and a licensee cannot ++impose that choice. ++ ++This section is intended to make thoroughly clear what is believed to ++be a consequence of the rest of this License. ++ ++ 12. If the distribution and/or use of the Library is restricted in ++certain countries either by patents or by copyrighted interfaces, the ++original copyright holder who places the Library under this License may add ++an explicit geographical distribution limitation excluding those countries, ++so that distribution is permitted only in or among countries not thus ++excluded. In such case, this License incorporates the limitation as if ++written in the body of this License. ++ ++ 13. The Free Software Foundation may publish revised and/or new ++versions of the Lesser General Public License from time to time. ++Such new versions will be similar in spirit to the present version, ++but may differ in detail to address new problems or concerns. ++ ++Each version is given a distinguishing version number. If the Library ++specifies a version number of this License which applies to it and ++"any later version", you have the option of following the terms and ++conditions either of that version or of any later version published by ++the Free Software Foundation. If the Library does not specify a ++license version number, you may choose any version ever published by ++the Free Software Foundation. ++ ++ 14. If you wish to incorporate parts of the Library into other free ++programs whose distribution conditions are incompatible with these, ++write to the author to ask for permission. For software which is ++copyrighted by the Free Software Foundation, write to the Free ++Software Foundation; we sometimes make exceptions for this. Our ++decision will be guided by the two goals of preserving the free status ++of all derivatives of our free software and of promoting the sharing ++and reuse of software generally. ++ ++ NO WARRANTY ++ ++ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO ++WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. ++EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR ++OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY ++KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE ++IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ++PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE ++LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME ++THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. ++ ++ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN ++WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY ++AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU ++FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR ++CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE ++LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING ++RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A ++FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF ++SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH ++DAMAGES. ++ ++ END OF TERMS AND CONDITIONS ++ ++ How to Apply These Terms to Your New Libraries ++ ++ If you develop a new library, and you want it to be of the greatest ++possible use to the public, we recommend making it free software that ++everyone can redistribute and change. You can do so by permitting ++redistribution under these terms (or, alternatively, under the terms of the ++ordinary General Public License). ++ ++ To apply these terms, attach the following notices to the library. It is ++safest to attach them to the start of each source file to most effectively ++convey the exclusion of warranty; and each file should have at least the ++"copyright" line and a pointer to where the full notice is found. ++ ++ ++ Copyright (C) ++ ++ This library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ This library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with this library; if not, write to the Free Software ++ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ ++Also add information on how to contact you by electronic and paper mail. ++ ++You should also get your employer (if you work as a programmer) or your ++school, if any, to sign a "copyright disclaimer" for the library, if ++necessary. Here is a sample; alter the names: ++ ++ Yoyodyne, Inc., hereby disclaims all copyright interest in the ++ library `Frob' (a library for tweaking knobs) written by James Random Hacker. ++ ++ , 1 April 1990 ++ Ty Coon, President of Vice ++ ++That's all there is to it! +diff --git a/grub-core/lib/libgcrypt/LICENSES b/grub-core/lib/libgcrypt/LICENSES +new file mode 100644 +index 0000000..c2fea82 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/LICENSES +@@ -0,0 +1,319 @@ ++Additional license notices for Libgcrypt. -*- org -*- ++ ++This file contains the copying permission notices for various files in ++the Libgcrypt distribution which are not covered by the GNU Lesser ++General Public License (LGPL) or the GNU General Public License (GPL). ++ ++These notices all require that a copy of the notice be included ++in the accompanying documentation and be distributed with binary ++distributions of the code, so be sure to include this file along ++with any binary distributions derived from the GNU C Library. ++ ++* BSD_3Clause ++ ++ For files: ++ - cipher/sha256-avx-amd64.S ++ - cipher/sha256-avx2-bmi2-amd64.S ++ - cipher/sha256-ssse3-amd64.S ++ - cipher/sha512-avx-amd64.S ++ - cipher/sha512-avx2-bmi2-amd64.S ++ - cipher/sha512-ssse3-amd64.S ++ - cipher/sha512-ssse3-i386.c ++ - cipher/sha512-avx512-amd64.S ++ ++#+begin_quote ++ Copyright (c) 2012, Intel Corporation ++ ++ All rights reserved. ++ ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions are ++ met: ++ ++ * Redistributions of source code must retain the above copyright ++ notice, this list of conditions and the following disclaimer. ++ ++ * Redistributions in binary form must reproduce the above copyright ++ notice, this list of conditions and the following disclaimer in the ++ documentation and/or other materials provided with the ++ distribution. ++ ++ * Neither the name of the Intel Corporation nor the names of its ++ contributors may be used to endorse or promote products derived from ++ this software without specific prior written permission. ++ ++ ++ THIS SOFTWARE IS PROVIDED BY INTEL CORPORATION "AS IS" AND ANY ++ EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ++ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL CORPORATION OR ++ CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, ++ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, ++ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR ++ PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF ++ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING ++ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS ++ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++#+end_quote ++ ++ For files: ++ - cipher/poly1305-amd64-avx512.S ++ ++#+begin_quote ++ Copyright (c) 2021-2022, Intel Corporation ++ ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions are met: ++ ++ * Redistributions of source code must retain the above copyright notice, ++ this list of conditions and the following disclaimer. ++ * Redistributions in binary form must reproduce the above copyright ++ notice, this list of conditions and the following disclaimer in the ++ documentation and/or other materials provided with the distribution. ++ * Neither the name of Intel Corporation nor the names of its contributors ++ may be used to endorse or promote products derived from this software ++ without specific prior written permission. ++ ++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" ++ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ++ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE ++ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ++ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER ++ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, ++ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++#+end_quote ++ ++ For files: ++ - random/jitterentropy-base.c ++ - random/jitterentropy-gcd.c ++ - random/jitterentropy-gcd.h ++ - random/jitterentropy-health.c ++ - random/jitterentropy-health.h ++ - random/jitterentropy-noise.c ++ - random/jitterentropy-noise.h ++ - random/jitterentropy-sha3.c ++ - random/jitterentropy-sha3.h ++ - random/jitterentropy-timer.c ++ - random/jitterentropy-timer.h ++ - random/jitterentropy.h ++ - random/rndjent.c (plus common Libgcrypt copyright holders) ++ ++#+begin_quote ++ Copyright (C) 2017 - 2021, Stephan Mueller ++ ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions ++ are met: ++ 1. Redistributions of source code must retain the above copyright ++ notice, and the entire permission notice in its entirety, ++ including the disclaimer of warranties. ++ 2. Redistributions in binary form must reproduce the above copyright ++ notice, this list of conditions and the following disclaimer in the ++ documentation and/or other materials provided with the distribution. ++ 3. The name of the author may not be used to endorse or promote ++ products derived from this software without specific prior ++ written permission. ++ ++ ALTERNATIVELY, this product may be distributed under the terms of ++ the GNU General Public License, in which case the provisions of the GPL2 ++ are required INSTEAD OF the above restrictions. (This clause is ++ necessary due to a potential bad interaction between the GPL and ++ the restrictions contained in a BSD-style copyright.) ++ ++ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED ++ WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES ++ OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF ++ WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE ++ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR ++ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT ++ OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR ++ BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF ++ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT ++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE ++ USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH ++ DAMAGE. ++#+end_quote ++ ++ For files: ++ - cipher/cipher-gcm-ppc.c ++ - cipher/keccak-amd64-avx512.S ++ ++#+begin_quote ++ Copyright (c) 2006, CRYPTOGAMS by ++ All rights reserved. ++ ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions ++ are met: ++ ++ * Redistributions of source code must retain copyright notices, ++ this list of conditions and the following disclaimer. ++ ++ * Redistributions in binary form must reproduce the above ++ copyright notice, this list of conditions and the following ++ disclaimer in the documentation and/or other materials ++ provided with the distribution. ++ ++ * Neither the name of the CRYPTOGAMS nor the names of its ++ copyright holder and contributors may be used to endorse or ++ promote products derived from this software without specific ++ prior written permission. ++ ++ ALTERNATIVELY, provided that this notice is retained in full, this ++ product may be distributed under the terms of the GNU General Public ++ License (GPL), in which case the provisions of the GPL apply INSTEAD OF ++ those given above. ++ ++ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS ++ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT ++ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR ++ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT ++ OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ++ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT ++ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, ++ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY ++ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT ++ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ++ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++#+end_quote ++ ++* X License ++ ++ For files: ++ - install.sh ++ ++#+begin_quote ++ Copyright (C) 1994 X Consortium ++ ++ Permission is hereby granted, free of charge, to any person obtaining a copy ++ of this software and associated documentation files (the "Software"), to ++ deal in the Software without restriction, including without limitation the ++ rights to use, copy, modify, merge, publish, distribute, sublicense, and/or ++ sell copies of the Software, and to permit persons to whom the Software is ++ furnished to do so, subject to the following conditions: ++ ++ The above copyright notice and this permission notice shall be included in ++ all copies or substantial portions of the Software. ++ ++ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN ++ AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC- ++ TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ ++ Except as contained in this notice, the name of the X Consortium shall not ++ be used in advertising or otherwise to promote the sale, use or other deal- ++ ings in this Software without prior written authorization from the X Consor- ++ tium. ++#+end_quote ++ ++* Public domain ++ ++ For files: ++ - cipher/arcfour-amd64.S ++ ++#+begin_quote ++ Author: Marc Bevand ++ Licence: I hereby disclaim the copyright on this code and place it ++ in the public domain. ++#+end_quote ++ ++* OCB license 1 ++ ++ For files: ++ - cipher/cipher-ocb.c ++ ++#+begin_quote ++ OCB is covered by several patents but may be used freely by most ++ software. See http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm . ++ In particular license 1 is suitable for Libgcrypt: See ++ http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf for the full ++ license document; it basically says: ++ ++ License 1 — License for Open-Source Software Implementations of OCB ++ (Jan 9, 2013) ++ ++ Under this license, you are authorized to make, use, and ++ distribute open-source software implementations of OCB. This ++ license terminates for you if you sue someone over their ++ open-source software implementation of OCB claiming that you have ++ a patent covering their implementation. ++ ++ ++ ++ License for Open Source Software Implementations of OCB ++ January 9, 2013 ++ ++ 1 Definitions ++ ++ 1.1 “Licensor†means Phillip Rogaway. ++ ++ 1.2 “Licensed Patents†means any patent that claims priority to United ++ States Patent Application No. 09/918,615 entitled “Method and Apparatus ++ for Facilitating Efficient Authenticated Encryption,†and any utility, ++ divisional, provisional, continuation, continuations-in-part, reexamination, ++ reissue, or foreign counterpart patents that may issue with respect to the ++ aforesaid patent application. This includes, but is not limited to, United ++ States Patent No. 7,046,802; United States Patent No. 7,200,227; United ++ States Patent No. 7,949,129; United States Patent No. 8,321,675 ; and any ++ patent that issues out of United States Patent Application No. 13/669,114. ++ ++ 1.3 “Use†means any practice of any invention claimed in the Licensed Patents. ++ ++ 1.4 “Software Implementation†means any practice of any invention ++ claimed in the Licensed Patents that takes the form of software executing on ++ a user-programmable, general-purpose computer or that takes the form of a ++ computer-readable medium storing such software. Software Implementation does ++ not include, for example, application-specific integrated circuits (ASICs), ++ field-programmable gate arrays (FPGAs), embedded systems, or IP cores. ++ ++ 1.5 “Open Source Software†means software whose source code is published ++ and made available for inspection and use by anyone because either (a) the ++ source code is subject to a license that permits recipients to copy, modify, ++ and distribute the source code without payment of fees or royalties, or ++ (b) the source code is in the public domain, including code released for ++ public use through a CC0 waiver. All licenses certified by the Open Source ++ Initiative at opensource.org as of January 9, 2013 and all Creative Commons ++ licenses identified on the creativecommons.org website as of January 9, ++ 2013, including the Public License Fallback of the CC0 waiver, satisfy these ++ requirements for the purposes of this license. ++ ++ 1.6 “Open Source Software Implementation†means a Software ++ Implementation in which the software implicating the Licensed Patents is ++ Open Source Software. Open Source Software Implementation does not include ++ any Software Implementation in which the software implicating the Licensed ++ Patents is combined, so as to form a larger program, with software that is ++ not Open Source Software. ++ ++ 2 License Grant ++ ++ 2.1 License. Subject to your compliance with the term s of this license, ++ including the restriction set forth in Section 2.2, Licensor hereby ++ grants to you a perpetual, worldwide, non-exclusive, non-transferable, ++ non-sublicenseable, no-charge, royalty-free, irrevocable license to practice ++ any invention claimed in the Licensed Patents in any Open Source Software ++ Implementation. ++ ++ 2.2 Restriction. If you or your affiliates institute patent litigation ++ (including, but not limited to, a cross-claim or counterclaim in a lawsuit) ++ against any entity alleging that any Use authorized by this license ++ infringes another patent, then any rights granted to you under this license ++ automatically terminate as of the date such litigation is filed. ++ ++ 3 Disclaimer ++ YOUR USE OF THE LICENSED PATENTS IS AT YOUR OWN RISK AND UNLESS REQUIRED ++ BY APPLICABLE LAW, LICENSOR MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY ++ KIND CONCERNING THE LICENSED PATENTS OR ANY PRODUCT EMBODYING ANY LICENSED ++ PATENT, EXPRESS OR IMPLIED, STATUT ORY OR OTHERWISE, INCLUDING, WITHOUT ++ LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY, FITNESS FOR A PARTICULAR ++ PURPOSE, OR NONINFRINGEMENT. IN NO EVENT WILL LICENSOR BE LIABLE FOR ANY ++ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, ++ ARISING FROM OR RELATED TO ANY USE OF THE LICENSED PATENTS, INCLUDING, ++ WITHOUT LIMITATION, DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE ++ OR SPECIAL DAMAGES, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF ++ SUCH DAMAGES PRIOR TO SUCH AN OCCURRENCE. ++#+end_quote +diff --git a/grub-core/lib/libgcrypt/README b/grub-core/lib/libgcrypt/README +new file mode 100644 +index 0000000..7733dbd +--- /dev/null ++++ b/grub-core/lib/libgcrypt/README +@@ -0,0 +1,278 @@ ++ Libgcrypt - The GNU Crypto Library ++ ------------------------------------ ++ Version 1.11 ++ ++ Copyright (C) 1989,1991-2018 Free Software Foundation, Inc. ++ Copyright (C) 2012-2024 g10 Code GmbH ++ Copyright (C) 2013-2024 Jussi Kivilinna ++ ++ Libgcrypt is free software. See the file AUTHORS for full copying ++ notices, and LICENSES for notices about contributions that require ++ these additional notices to be distributed. ++ ++ ++ Overview ++ -------- ++ ++ Libgcrypt is a general purpose crypto library based on the code ++ used in GnuPG. Libgcrypt depends on the library `libgpg-error', ++ which must be installed correctly before Libgcrypt is to be built. ++ Libgcrypt is distributed under the LGPL, see the section "License" ++ below for details. ++ ++ ++ Build Instructions ++ ------------------ ++ ++ The download canonical location for libgcrypt is: ++ ++ https://gnupg.org/ftp/gcrypt/libgcrypt/ ++ ++ To build libgcrypt you need libgpg-error: ++ ++ https://gnupg.org/ftp/gcrypt/libgpg-error/ ++ ++ You should get the latest versions of course. ++ ++ After building and installing the libgpg-error package, you may ++ continue with Libgcrypt installation as with allmost all GNU ++ packages, you just have to do ++ ++ ./configure ++ make ++ make check ++ make install ++ ++ The "make check" is not required but a good idea to see whether ++ the library works as expected. The check takes some while and ++ prints some benchmarking results. Before doing "make install" you ++ probably need to become root. ++ ++ To build libgcrypt for Microsoft Windows, you need to have the ++ mingw32 cross-building toolchain installed. Instead of running a ++ plain configure you use ++ ++ ./autogen.sh --build-w32 ++ make ++ make install ++ ++ By default this command sequences expectsd a libgpg-error ++ installed below $HOME/w32root and installs libgcrypt to that ++ directory too. See the autogen.sh code for details. ++ ++ The documentation is available as an Info file (gcrypt.info). To ++ build documentation in PDF, run this: ++ ++ cd doc ++ make pdf ++ ++ ++ ++ Mailing List ++ ------------ ++ ++ You may want to join the developer's mailing list ++ gcrypt-devel@gnupg.org by sending mail with a subject of ++ "subscribe" to gcrypt-devel-request@gnupg.org. An archive of this ++ list is available at https://lists.gnupg.org . ++ ++ ++ Configure options ++ ----------------- ++ Here is a list of configure options which are sometimes useful ++ for installation. ++ ++ --enable-large-data-tests ++ With this option a "make check" will take really ++ long due to extra checks for the hash algorithms. ++ ++ --disable-asm ++ Do not use assembler modules. It is not possible ++ to use this on some CPU types. ++ ++ --enable-ld-version-script ++ Libgcrypt tries to build a library where internal ++ symbols are not exported. This requires support ++ from ld and is currently enabled for a few OSes. ++ If you know that your ld supports the so called ++ ELF version scripts, you can use this option to ++ force its use. OTOH, if you get error message ++ from the linker, you probably want to use this ++ option to disable the use of version scripts. ++ Note, that you should never ever use an ++ undocumented symbol or one which is prefixed with ++ an underscore. ++ ++ --enable-ciphers=list ++ --enable-pubkey-ciphers=list ++ --enable-digests=list ++ If not otherwise specified, all algorithms ++ included in the libgcrypt source tree are built. ++ An exception are algorithms, which depend on ++ features not provided by the system, like 64bit ++ data types. With these switches it is possible ++ to select exactly those algorithm modules, which ++ should be built. The algorithms are to be ++ separated by spaces, commas or colons. To view ++ the list used with the current build the program ++ tests/version may be used. ++ ++ --disable-endian-check ++ Don't let configure test for the endianness but ++ try to use the OS provided macros at compile ++ time. This is helpful to create OS X fat binaries. ++ ++ --enable-random-daemon ++ Include support for a global random daemon and ++ build the daemon. This is an experimental feature. ++ ++ --enable-mpi-path=EXTRA_PATH ++ Prepend EXTRA_PATH to list of CPU specific ++ optimizations. For example, if you want to add ++ optimizations forn a Intel Pentium 4 compatible ++ CPU, you may use ++ --enable-mpi-path=pentium4/sse2:pentium4/mmx ++ Take care: The generated library may crash on ++ non-compatible CPUs. ++ ++ --enable-random=NAME ++ Force the use of the random gathering module ++ NAME. Default is either to use /dev/random or ++ the auto mode. Possible values for NAME are: ++ egd - Use the module which accesses the ++ Entropy Gathering Daemon. See the webpages ++ for more information about it. ++ unix - Use the standard Unix module which does not ++ have a very good performance. ++ linux - Use the module which accesses /dev/random. ++ This is the first choice and the default one ++ for GNU/Linux or *BSD. ++ auto - Compile linux, egd and unix in and ++ automagically select at runtime. ++ ++ --enable-hmac-binary-check ++ Include support to check the binary at runtime ++ against a HMAC checksum. This works only in FIPS ++ mode on systems providing the dladdr function and using ++ the ELF binary format. ++ ++ --with-fips-module-version=version ++ Specify a string used as a module version for FIPS ++ certification purposes. ++ ++ --disable-padlock-support ++ Disable support for the PadLock engine of VIA ++ processors. The default is to use PadLock if ++ available. Try this if you get problems with ++ assembler code. ++ ++ --disable-aesni-support ++ Disable support for the AES-NI instructions of ++ newer Intel CPUs. The default is to use AES-NI ++ if available. Try this if you get problems with ++ assembler code. ++ ++ --disable-O-flag-munging ++ Some code is too complex for some compilers while ++ in higher optimization modes, thus the compiler ++ invocation is modified to use a lower ++ optimization level. Usually this works very well ++ but on some platforms these rules break the ++ invocation. This option may be used to disable ++ the feature under the assumption that either good ++ CFLAGS are given or the compiler can grok the code. ++ ++ ++ ++ ++ Build Problems ++ -------------- ++ ++ If you have a problem with a a certain release, please first check ++ the Release-info URL given in the NEWS file. ++ ++ We can't check all assembler files, so if you have problems ++ assembling them (or the program crashes) use --disable-asm with ++ ./configure. If you opt to delete individual replacement files in ++ hopes of using the remaining ones, be aware that the configure ++ scripts may consider several subdirectories to get all available ++ assembler files; be sure to delete the correct ones. Never delete ++ udiv-qrnnd.S in any CPU directory, because there may be no C ++ substitute (in mpi/genereic). Don't forget to delete ++ "config.cache" and run "./config.status --recheck". We got a few ++ reports about problems using versions of gcc earlier than 2.96 ++ along with a non-GNU assembler (as). If this applies to your ++ platform, you can either upgrade gcc to a more recent version, or ++ use the GNU assembler. ++ ++ Some make tools are broken - the best solution is to use GNU's ++ make. Try gmake or grab the sources from a GNU archive and ++ install them. ++ ++ Specific problems on some machines: ++ ++ * AArch64 (GCC 11.1 and 11.2) ++ ++ Because of the bug in GCC (fixed in 11.3), with the option ++ -O3, vectorization results wrong code for the function ++ buf_eq_const. Please use -O2 or -fno-tree-loop-vectorize. ++ ++ * IBM RS/6000 running AIX ++ ++ Due to a change in gcc (since version 2.8) the MPI stuff may ++ not build. In this case try to run configure using: ++ CFLAGS="-g -O2 -mcpu=powerpc" ./configure ++ ++ * SVR4.2 (ESIX V4.2 cc) ++ ++ Due to problems with the ESIX as(1), you probably want to do: ++ CFLAGS="-O -K pentium" ./configure --disable-asm ++ ++ * SunOS 4.1.4 ++ ++ ./configure ac_cv_sys_symbol_underscore=yes ++ ++ * Sparc64 CPUs ++ ++ We have reports about failures in the AES module when ++ compiling using gcc (e.g. version 4.1.2) and the option -O3; ++ using -O2 solves the problem. ++ ++ ++ License ++ ------- ++ ++ The library is distributed under the terms of the GNU Lesser ++ General Public License (LGPL); see the file COPYING.LIB for the ++ actual terms. ++ ++ The helper programs as well as the documentation are distributed ++ under the terms of the GNU General Public License (GPL); see the ++ file COPYING for the actual terms. ++ ++ The file LICENSES has notices about contributions that require ++ that these additional notices are distributed. ++ ++ ++ Contact ++ ------- ++ ++ See the file AUTHORS. ++ ++ Commercial grade support for Libgcrypt is available; for a listing ++ of offers see https://www.gnupg.org/service.html . ++ ++ Since 2001 maintenance and development of Libgcrypt is done by g10 ++ Code GmbH and was mostly financed by donations; since 2022 a raise ++ in revenues from support contracts allows to fully finance the ++ development without resorting to donations. Many thanks to our ++ paid developers for their work and also a big thank you to Jussi ++ Kivilinna for all of his performance work. ++ ++ This file is Free Software; as a special exception the authors gives ++ unlimited permission to copy and/or distribute it, with or without ++ modifications, as long as this notice is preserved. For conditions ++ of the whole package, please see the file COPYING. This file is ++ distributed in the hope that it will be useful, but WITHOUT ANY ++ WARRANTY, to the extent permitted by law; without even the implied ++ warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +diff --git a/grub-core/lib/libgcrypt/README.GIT b/grub-core/lib/libgcrypt/README.GIT +new file mode 100644 +index 0000000..ee2c638 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/README.GIT +@@ -0,0 +1,49 @@ ++If you are building from GIT, run the script ++ ++./autogen.sh ++ ++first, to make sure that you have all the necessary maintainer tools ++are installed and to build the actual configuration files. If you ++have just checked out from GIT, you should add the option "--force" to ++autogen.sh so that meta data is noticed by autom4te.cache. Then run ++ ++./configure --enable-maintainer-mode ++ ++followed by the usual make. ++ ++If autogen.sh complains about insufficient versions of the required ++tools, or the tools are not installed, you may use environment ++variables to override the default tool names: ++ ++ AUTOMAKE_SUFFIX is used as a suffix for all tools from the automake ++ package. For example ++ AUTOMAKE_SUFFIX="-1.7" ./autogen.sh ++ uses "automake-1.7" and "aclocal-1.7. ++ AUTOMAKE_PREFIX is used as a prefix for all tools from the automake ++ page and may be combined with AUTOMAKE_SUFFIX. e.g.: ++ AUTOMAKE_PREFIX=/usr/foo/bin ./autogen.sh ++ uses "automake" and "aclocal" in the /usr/foo/bin ++ directory. ++ AUTOCONF_SUFFIX is used as a suffix for all tools from the automake ++ package ++ AUTOCONF_PREFIX is used as a prefix for all tools from the automake ++ package ++ GETTEXT_SUFFIX is used as a suffix for all tools from the gettext ++ package ++ GETTEXT_PREFIX is used as a prefix for all tools from the gettext ++ package ++ ++It is also possible to use the variable name AUTOMAKE, AUTOCONF, ++ACLOCAL, AUTOHEADER, GETTEXT and MSGMERGE to directly specify the name ++of the programs to run. It is however better to use the suffix and ++prefix forms as described above because that does not require ++knowledge about the actual tools used by autogen.sh. ++ ++ ++Please don't use autopoint, libtoolize or autoreconf unless you are ++the current maintainer and want to update the standard configuration ++files. All those files should be in GIT and only updated manually ++if the maintainer decides that newer versions are required. The ++maintainer should also make sure that the required version of automake ++et al. are properly indicated at the top of configure.ac and take care ++to copy the files and not merely use symlinks. +diff --git a/grub-core/lib/libgcrypt/THANKS b/grub-core/lib/libgcrypt/THANKS +new file mode 100644 +index 0000000..6a44ead +--- /dev/null ++++ b/grub-core/lib/libgcrypt/THANKS +@@ -0,0 +1,168 @@ ++Libgcrypt is based on the GnuPG code. Here is a list of people, who ++helped in GnuPG and Libgcrypt development. Please help us to keep it ++complete and free of errors. ++ ++Albert Chin china at thewrittenword com ++Allan Clark allanc@sco.com ++Anand Kumria wildfire@progsoc.uts.edu.au ++Andreas Metzler ametzler at downhill.at.eu.org ++Ariel T Glenn ariel@columbia.edu ++Aurelien Jarno aurel32 at debian.org ++Ben Hutchings ben decadent org uk ++Bodo Moeller Bodo_Moeller@public.uni-hamburg.de ++Brenno de Winter brenno@dewinter.com ++Brian Moore bem@cmc.net ++Brian Warner warner@lothar.com ++Brieuc Jeunhomme bbp@via.ecp.fr ++Bryan Fullerton bryanf@samurai.com ++Caskey L. Dickson caskey@technocage.com ++Cees van de Griend cees-list@griend.xs4all.nl ++Charles Levert charles@comm.polymtl.ca ++Christian Biere christianbiere@gmx.de ++Christian Grothoff christian at grothoff org ++Christian von Roques roques@pond.sub.org ++Christopher Oliver oliver@fritz.traverse.net ++Christian Recktenwald chris@citecs.de ++Daiki Ueno ueno at unixuser org ++Dan Fandrich dan at coneharvesters com ++Daniel Eisenbud eisenbud@cs.swarthmore.edu ++Daniel Koening dan@mail.isis.de ++David Ellement ellement@sdd.hp.com ++Detlef Lannert lannert@lannert.rz.uni-duesseldorf.de ++Dirk Lattermann dlatt@t-online.de ++Dirk Stoecker gcrypt@dstoecker.de ++Ed Boraas ecxjo@esperanto.org ++Elie De Brauwer elie@de-brauwer.be ++Enzo Michelangeli em@MailAndNews.com ++Ernst Molitor ernst.molitor@uni-bonn.de ++Fabian Keil fk at fabiankeil de ++Fabio Coatti cova@felix.unife.it ++Felix von Leitner leitner@amdiv.de ++Frank Heckenbach heckenb@mi.uni-erlangen.de ++Frank Stajano frank.stajano@cl.cam.ac.uk ++Gabriele Monti psicus78 gmail com ++Gaël Quéri gqueri@mail.dotcom.fr ++Gregor Riepl seto-kun@freesurf.ch ++Gerlinde Klaes gk@u64.de ++Greg Louis glouis@dynamicro.on.ca ++Greg Troxel gdt@ir.bbn.com ++Gregory Steuck steuck@iname.com ++Geoff Keating geoffk@ozemail.com.au ++Harald Denker harry@hal.westfalen.de ++Hendrik Buschkamp buschkamp@rheumanet.org ++Holger Schurig holger@d.om.org ++Hugh Daniel hugh@toad.com ++Ian McKellar imckellar@harvestroad.com.au ++Ian Peters itp@ximian.com ++Janusz A. Urbanowicz alex@bofh.torun.pl ++James Troup james@nocrew.org ++Jean-loup Gailly gzip@prep.ai.mit.edu ++Jeff Johnson jbj@redhat.com ++Jens Bachem bachem@rrz.uni-koeln.de ++J Horacio MG homega@ciberia.es ++Joachim Backes backes@rhrk.uni-kl.de ++Jordi Mallach jordi@sindominio.net ++John A. Martin jam@jamux.com ++Johnny Teveßen j.tevessen@gmx.de ++Jörg Schilling schilling@fokus.gmd.de ++Jun Kuriyama kuriyama@sky.rim.or.jp ++Karl Fogel kfogel@guanabana.onshore.com ++Karsten Thygesen karthy@kom.auc.dk ++Katsuhiro Kondou kondou@nec.co.jp ++Kazu Yamamoto kazu@iijlab.net ++Lars Kellogg-Stedman lars@bu.edu ++Lee Fisher blibbet at gmail dot com ++Marco d'Itri md@linux.it ++Mark Adler madler@alumni.caltech.edu ++Mark Elbrecht snowball3@bigfoot.com ++Markus Friedl Markus.Friedl@informatik.uni-erlangen.de ++Matthias Urlichs smurf@smurf.noris.de ++Martin Kahlert martin.kahlert@provi.de ++Martin Hamilton ++Martin Schulte schulte@thp.uni-koeln.de ++Matthew Skala mskala@ansuz.sooke.bc.ca ++Max Kellermann max@duempel.org ++Max Valianskiy maxcom@maxcom.ml.org ++Michael Fischer v. Mollard mfvm@gmx.de ++Michael Roth mroth@nessie.de ++Michael Sobolev mss@despair.transas.com ++Michele Baldessari michele@pupazzo.org ++Modestas Vainius geromanas@mailas.com ++Neil Dunbar neil.dunbar at pobox.com ++Neil Spring nspring@cs.washington.edu ++Newton Hammet newton@hammet.net ++Nicolas Graner Nicolas.Graner@cri.u-psud.fr ++NIIBE Yutaka gniibe@chroot.org ++Niklas Hernaeus ++Nikolay Sturm sturm@sec.informatik.tu-darmstadt.de ++Nikos Mavroyanopoulos nmav@hellug.gr ++Nimrod Zimerman zimerman@forfree.at ++N J Doye nic@niss.ac.uk ++Oliver Haakert haakert@hsp.de ++Oskari Jääskeläinen f33003a@cc.hut.fi ++Paul D. Smith psmith@baynetworks.com ++Philippe Laliberte arsphl@oeil.qc.ca ++Peter Gutmann pgut001@cs.auckland.ac.nz ++QingLong qinglong@bolizm.ihep.su ++Rafael Ãvila de Espíndola rafael.espindola@gmail.com ++Rafaël Carré funman@videolan.org ++Ralf Fassel ralf@akutech.de ++Ralf Hildebrandt Ralf.Hildebrandt@innominate.com ++Ralf Schneider ralf@tapfere-schneiderleins.de ++Ralph Gillen gillen@theochem.uni-duesseldorf.de ++Rami Lehti Rami.Lehti@finland.sun.com ++Randolph Chung tausq@debian.org ++Randy mcclellr@oit.edu ++Rat ratinox@peorth.gweep.net ++Reinhard Wobst R.Wobst@ifw-dresden.de ++Rémi Guyomarch rguyom@mail.dotcom.fr ++Reuben Sumner rasumner@wisdom.weizmann.ac.il ++Richard Outerbridge outer@interlog.com ++Roddy Strachan roddy@satlink.com.au ++Roland Rosenfeld roland@spinnaker.rhein.de ++Ross Golder rossigee@bigfoot.com ++Serge Munhoven munhoven@mema.ucl.ac.be ++Sergi Blanch i Torné sergi at calcurco cat ++Simon Josefsson jas@extundo.com ++SL Baur steve@xemacs.org ++Stephan Austermuehle au@hcsd.de ++Stephan Müller smueller at atsec com ++Stephane Corthesy stephane@sente.ch ++Stefan Karrmann S.Karrmann@gmx.net ++Stefan Keller dres@cs.tu-berlin.de ++Stefan Krüger stadtkind2 at gmx de ++Steffen Ullrich ccrlphr@xensei.com ++Steffen Zahn zahn@berlin.snafu.de ++Steven Bakker steven@icoe.att.com ++Susanne Schultz schultz@hsp.de ++Sven Bjorn ++Szakats Istvan szaki.ms@gmail.com ++Thiago Jung Bauermann jungmann@cwb.matrix.com.br ++Thomas Roessler roessler@guug.de ++Tom Holroyd tomh@po.crl.go.jp ++Tom Spindler dogcow@home.merit.edu ++Tom Zerucha tzeruch@ceddec.com ++Tomas Fasth tomas.fasth@twinspot.net ++Tommi Komulainen Tommi.Komulainen@iki.fi ++Thomas Mikkelsen tbm@image.dk ++Ulf Möller 3umoelle@informatik.uni-hamburg.de ++Umberto Salsi salsi@icosaedro.it ++Uoti Urpala ++Urko Lusa ulusa@euskalnet.net ++Victor Stinner haypo@inl.fr ++Walter Koch koch@u32.de ++Werner Koch wk@gnupg.org ++Wim Vandeputte wim@kd85.com ++ nbecker@hns.com ++ ++ ++ Copyright 1998, 1999, 2000, 2001, 2002, 2003, ++ 2009, 2011 Free Software Foundation, Inc. ++ ++ This file is free software; as a special exception the author gives ++ unlimited permission to copy and/or distribute it, with or without ++ modifications, as long as this notice is preserved. ++ ++ This file is distributed in the hope that it will be useful, but ++ WITHOUT ANY WARRANTY, to the extent permitted by law; without even the ++ implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +diff --git a/grub-core/lib/libgcrypt/VERSION b/grub-core/lib/libgcrypt/VERSION +new file mode 100644 +index 0000000..1cac385 +--- /dev/null ++++ b/grub-core/lib/libgcrypt/VERSION +@@ -0,0 +1 @@ ++1.11.0 +diff --git a/grub-core/lib/libgcrypt/cipher/ChangeLog b/grub-core/lib/libgcrypt/cipher/ChangeLog +deleted file mode 100644 +index 1b3694f..0000000 +--- a/grub-core/lib/libgcrypt/cipher/ChangeLog ++++ /dev/null +@@ -1,3990 +0,0 @@ +-2010-08-19 Werner Koch +- +- * cipher.c (gcry_cipher_open): Remove double release of the module. +- Fixes bug#1263. +- +-2010-06-10 Jeff Johnson (wk) +- +- * ecc.c (ecc_generate_ext): Parse transient-key flag. +- (generate_key): Add arg TRANSIENT_KEY and use it to set the random +- level. +- +-2010-04-12 Brad Hards (wk) +- +- Spelling fixes. +- +-2010-03-26 Werner Koch +- +- * tiger.c (asn): Unfetter the old TIGER from an OID. +- (TIGER_CONTEXT): Add field VARIANT. +- (tiger_init): Factor code out to ... +- (do_init): New. +- (tiger1_init, tiger2_init): New. +- (_gcry_digest_spec_tiger1, _gcry_digest_spec_tiger2): New. +- * md.c (digest_table): Add TIGER1 and TIGER2 variants. +- +-2009-12-11 Werner Koch +- +- * sha256.c (Cho, Maj, Sum0, Sum1): Turn macros into inline +- functions. +- (transform): Partly unroll to interweave the chain variables +- +- * sha512.c (ROTR, Ch, Maj, Sum0, Sum1): Turn macros into inline +- functions. +- (transform): Partly unroll to interweave the chain variables. +- Suggested by Christian Grothoff. +- +-2009-12-10 Werner Koch +- +- * Makefile.am (o_flag_munging): New. +- (tiger.o, tiger.lo): Use it. +- +- * cipher.c (do_ctr_encrypt): Add arg OUTBUFLEN. Check for +- suitable value. Add check for valid inputlen. Wipe temporary +- memory. +- (do_ctr_decrypt): Likewise. +- (do_cbc_encrypt, do_cbc_decrypt): Add arg OUTBUFLEN. Check for +- suitable value. Move check for valid inputlen to here; change +- returned error from INV_ARG to INV_LENGTH. +- (do_ecb_encrypt, do_ecb_decrypt): Ditto. +- (do_cfb_encrypt, do_cfb_decrypt): Ditto. +- (do_ofb_encrypt, do_ofb_decrypt): Ditto. +- (cipher_encrypt, cipher_encrypt): Adjust for above changes. +- (gcry_cipher_encrypt, gcry_cipher_decrypt): Simplify. +- +-2009-12-09 Werner Koch +- +- * cipher.c (gcry_cipher_open): Allow for GCRY_CIPHER_MODE_AESWRAP. +- (cipher_encrypt, cipher_decrypt): Ditto. +- (do_aeswrap_encrypt, do_aeswrap_decrypt): New. +- (struct gcry_cipher_handle): Add field marks. +- (cipher_setkey, cipher_setiv): Update marks flags. +- (cipher_reset): Reset marks. +- (cipher_encrypt, cipher_decrypt): Add new arg OUTBUFLEN. +- (gcry_cipher_encrypt, gcry_cipher_decrypt): Pass outbuflen to +- cipher_encrypt. Replace GPG_ERR_TOO_SHORT by +- GPG_ERR_BUFFER_TOO_SHORT. +- +-2009-08-21 Werner Koch +- +- * dsa.c (dsa_generate_ext): Release retfactors array before +- setting it to NULL. Reported by Daiko Ueno. +- +-2009-07-02 Werner Koch +- +- * md.c (md_read): Fix incomplete check for NULL. +- Reported by Fabian Kail. +- +-2009-03-31 Werner Koch +- +- * rsa.c (rsa_check_secret_key): Return GPG_ERR_BAD_SECKEY and not +- GPG_ERR_PUBKEY_ALGO. +- +-2009-02-16 Werner Koch +- +- * rsa.c (generate_x931): Do not initialize TBL with automatic +- variables. +- * whirlpool.c, tiger.c, sha256.c, sha1.c, rmd160.c, md5.c +- * md4.c, crc.c: Remove memory.h. This is garbage from gnupg. +- Reported by Dan Fandrich. +- +-2009-01-22 Werner Koch +- +- * ecc.c (compute_keygrip): Remove superfluous const. +- +-2009-01-06 Werner Koch +- +- * rmd160.c (oid_spec_rmd160): Add TeleTrust identifier. +- +-2008-12-10 Werner Koch +- +- * dsa.c (generate): Add arg DOMAIN and use it if specified. +- (generate_fips186): Ditto. +- (dsa_generate_ext): Parse and check the optional "domain" +- parameter and pass them to the generate functions. +- +- * rijndael.c (rijndael_names): Add "AES128" and "AES-128". +- (rijndael192_names): Add "AES-192". +- (rijndael256_names): Add "AES-256". +- +-2008-12-05 Werner Koch +- +- * dsa.c (generate): Add arg TRANSIENT_KEY and use it to detrmine +- the RNG quality needed. +- (dsa_generate_ext): Parse the transient-key flag und pass it to +- generate. +- +-2008-11-28 Werner Koch +- +- * dsa.c (generate_fips186): Add arg DERIVEPARMS and use the seed +- value if available. +- +- * primegen.c (_gcry_generate_fips186_2_prime): Fix inner p loop. +- +-2008-11-26 Werner Koch +- +- * primegen.c (_gcry_generate_fips186_3_prime): New. +- * dsa.c (generate_fips186): Add arg USE_FIPS186_2. +- (dsa_generate_ext): Parse new flag use-fips183-2. +- +-2008-11-25 Werner Koch +- +- * dsa.c (generate_fips186): New. +- (dsa_generate_ext): Use new function if derive-parms are given or +- if in FIPS mode. +- * primegen.c (_gcry_generate_fips186_2_prime): New. +- +-2008-11-24 Werner Koch +- +- * pubkey.c (gcry_pk_genkey): Insert code to output extrainfo. +- (pubkey_generate): Add arg R_EXTRAINFO and pass it to the extended +- key generation function. +- * rsa.c (gen_x931_parm_xp, gen_x931_parm_xi): New. +- (generate_x931): Generate params if not given. +- (rsa_generate_ext): Parse use-x931 flag. Return p-q-swapped +- indicator. +- * dsa.c (dsa_generate_ext): Put RETFACTORS into R_EXTRAINFO if +- possible. +- +- * pubkey.c (gcry_pk_genkey): Remove parsing of almost all +- parameters and pass the parameter S-expression to pubkey_generate. +- (pubkey_generate): Simplify by requitring modules to parse the +- parameters. Remove the special cases for Elgamal and ECC. +- (sexp_elements_extract_ecc): Add arg EXTRASPEC and use it. Fix +- small memory leak. +- (sexp_to_key): Pass EXTRASPEC to sexp_elements_extract_ecc. +- (pubkey_table) [USE_ELGAMAL]: Add real extraspec. +- * rsa.c (rsa_generate_ext): Adjust for new calling convention. +- * dsa.c (dsa_generate_ext): Ditto. +- * elgamal.c (_gcry_elg_generate): Ditto. Rename to elg_generate_ext. +- (elg_generate): New. +- (_gcry_elg_generate_using_x): Remove after merging code with +- elg_generate_ext. +- (_gcry_pubkey_extraspec_elg): New. +- (_gcry_elg_check_secret_key, _gcry_elg_encrypt, _gcry_elg_sign) +- (_gcry_elg_verify, _gcry_elg_get_nbits): Make static and remove +- _gcry_ prefix. +- * ecc.c (_gcry_ecc_generate): Rename to ecc_generate_ext and +- adjust for new calling convention. +- (_gcry_ecc_get_param): Rename to ecc_get_param and make static. +- (_gcry_pubkey_extraspec_ecdsa): Add ecc_generate_ext and +- ecc_get_param. +- +-2008-11-20 Werner Koch +- +- * pubkey.c (pubkey_generate): Add arg DERIVEPARMS. +- (gcry_pk_genkey): Parse derive-parms and pass it to above. +- * rsa.c (generate_x931): New. +- (rsa_generate_ext): Add arg DERIVEPARMS and call new function in +- fips mode or if DERIVEPARMS is given. +- * primegen.c (_gcry_derive_x931_prime, find_x931_prime): New. +- +-2008-11-19 Werner Koch +- +- * rsa.c (rsa_decrypt): Use gcry_create_nonce for blinding. +- (generate): Rename to generate_std. +- +-2008-11-05 Werner Koch +- +- * md.c (md_open): Use a switch to set the Bsize. +- (prepare_macpads): Fix long key case for SHA384 and SHA512. +- +- * cipher.c (gcry_cipher_handle): Add field EXTRASPEC. +- (gcry_cipher_open): Set it. +- (gcry_cipher_ctl): Add private control code to disable weak key +- detection and to return the current input block. +- * des.c (_tripledes_ctx): Add field FLAGS. +- (do_tripledes_set_extra_info): New. +- (_gcry_cipher_extraspec_tripledes): Add new function. +- (do_tripledes_setkey): Disable weak key detection. +- +-2008-10-24 Werner Koch +- +- * md.c (digest_table): Allow MD5 in fips mode. +- (md_register_default): Take special action for MD5. +- (md_enable, gcry_md_hash_buffer): Ditto. +- +-2008-09-30 Werner Koch +- +- * rijndael.c (do_setkey): Properly align "t" and "tk". +- (prepare_decryption): Properly align "w". Fixes bug #936. +- +-2008-09-18 Werner Koch +- +- * pubkey.c (gcry_pk_genkey): Parse domain parameter. +- (pubkey_generate): Add new arg DOMAIN and remove special case for +- DSA with qbits. +- * rsa.c (rsa_generate): Add dummy args QBITS, NAME and DOMAIN and +- rename to rsa_generate_ext. Change caller. +- (_gcry_rsa_generate, _gcry_rsa_check_secret_key) +- (_gcry_rsa_encrypt, _gcry_rsa_decrypt, _gcry_rsa_sign) +- (_gcry_rsa_verify, _gcry_rsa_get_nbits): Make static and remove +- _gcry_ prefix. +- (_gcry_pubkey_spec_rsa, _gcry_pubkey_extraspec_rsa): Adjust names. +- * dsa.c (dsa_generate_ext): New. +- (_gcry_dsa_generate): Replace code by a call to dsa_generate. +- (_gcry_dsa_check_secret_key, _gcry_dsa_sign, _gcry_dsa_verify) +- (_gcry_dsa_get_nbits): Make static and remove _gcry prefix. +- (_gcry_dsa_generate2): Remove. +- (_gcry_pubkey_spec_dsa): Adjust to name changes. +- (_gcry_pubkey_extraspec_rsa): Add dsa_generate_ext. +- +-2008-09-16 Werner Koch +- +- * ecc.c (run_selftests): Add arg EXTENDED. +- +-2008-09-12 Werner Koch +- +- * rsa.c (test_keys): Do a bad case signature check. +- * dsa.c (test_keys): Do a bad case check. +- +- * cipher.c (_gcry_cipher_selftest): Add arg EXTENDED and pass it +- to the called tests. +- * md.c (_gcry_md_selftest): Ditto. +- * pubkey.c (_gcry_pk_selftest): Ditto. +- * rijndael.c (run_selftests): Add arg EXTENDED and pass it to the +- called tests. +- (selftest_fips_128): Add arg EXTENDED and run only one test +- non-extended mode. +- (selftest_fips_192): Add dummy arg EXTENDED. +- (selftest_fips_256): Ditto. +- * hmac-tests.c (_gcry_hmac_selftest): Ditto. +- (run_selftests): Ditto. +- (selftests_sha1): Add arg EXTENDED and run only one test +- non-extended mode. +- (selftests_sha224, selftests_sha256): Ditto. +- (selftests_sha384, selftests_sha512): Ditto. +- * sha1.c (run_selftests): Add arg EXTENDED and pass it to the +- called test. +- (selftests_sha1): Add arg EXTENDED and run only one test +- non-extended mode. +- * sha256.c (run_selftests): Add arg EXTENDED and pass it to the +- called tests. +- (selftests_sha224): Add arg EXTENDED and run only one test +- non-extended mode. +- (selftests_sha256): Ditto. +- * sha512.c (run_selftests): Add arg EXTENDED and pass it to the +- called tests. +- (selftests_sha384): Add arg EXTENDED and run only one test +- non-extended mode. +- (selftests_sha512): Ditto. +- * des.c (run_selftests): Add arg EXTENDED and pass it to the +- called test. +- (selftest_fips): Add dummy arg EXTENDED. +- * rsa.c (run_selftests): Add dummy arg EXTENDED. +- +- * dsa.c (run_selftests): Add dummy arg EXTENDED. +- +- * rsa.c (extract_a_from_sexp): New. +- (selftest_encr_1024): Check that the ciphertext does not match the +- plaintext. +- (test_keys): Improve tests and return an error status. +- (generate): Return an error if test_keys fails. +- * dsa.c (test_keys): Add comments and return an error status. +- (generate): Return an error if test_keys failed. +- +-2008-09-11 Werner Koch +- +- * rsa.c (_gcry_rsa_decrypt): Return an error instead of calling +- BUG in case of a practically impossible condition. +- (sample_secret_key, sample_public_key): New. +- (selftest_sign_1024, selftest_encr_1024): New. +- (selftests_rsa): Implement tests. +- * dsa.c (sample_secret_key, sample_public_key): New. +- (selftest_sign_1024): New. +- (selftests_dsa): Implement tests. +- +-2008-09-09 Werner Koch +- +- * hmac-tests.c (selftests_sha1): Add tests. +- (selftests_sha224, selftests_sha384, selftests_sha512): Make up tests. +- +- * hash-common.c, hash-common.h: New. +- * sha1.c (selftests_sha1): Add 3 tests. +- * sha256.c (selftests_sha256, selftests_sha224): Ditto. +- * sha512.c (selftests_sha512, selftests_sha384): Ditto. +- +-2008-08-29 Werner Koch +- +- * pubkey.c (gcry_pk_get_keygrip): Remove the special case for RSA +- and check whether a custom computation function has been setup. +- * rsa.c (compute_keygrip): New. +- (_gcry_pubkey_extraspec_rsa): Setup this function. +- * ecc.c (compute_keygrip): New. +- (_gcry_pubkey_extraspec_ecdsa): Setup this function. +- +-2008-08-28 Werner Koch +- +- * cipher.c (cipher_decrypt, cipher_encrypt): Return an error if +- mode NONE is used. +- (gcry_cipher_open): Allow mode NONE only with a debug flag set and +- if not in FIPS mode. +- +-2008-08-26 Werner Koch +- +- * pubkey.c (pubkey_generate): Add arg KEYGEN_FLAGS. +- (gcry_pk_genkey): Implement new parameter "transient-key" and +- pass it as flags to pubkey_generate. +- (pubkey_generate): Make use of an ext_generate function. +- * rsa.c (generate): Add new arg transient_key and pass appropriate +- args to the prime generator. +- (_gcry_rsa_generate): Factor all code out to ... +- (rsa_generate): .. new func with extra arg KEYGEN_FLAGS. +- (_gcry_pubkey_extraspec_ecdsa): Setup rsa_generate. +- * primegen.c (_gcry_generate_secret_prime) +- (_gcry_generate_public_prime): Add new arg RANDOM_LEVEL. +- +-2008-08-21 Werner Koch +- +- * primegen.c (_gcry_generate_secret_prime) +- (_gcry_generate_public_prime): Use a constant macro for the random +- level. +- +-2008-08-19 Werner Koch +- +- * pubkey.c (sexp_elements_extract_ecc) [!USE_ECC]: Do not allow +- allow "curve" parameter. +- +-2008-08-15 Werner Koch +- +- * pubkey.c (_gcry_pk_selftest): New. +- * dsa.c (selftests_dsa, run_selftests): New. +- * rsa.c (selftests_rsa, run_selftests): New. +- * ecc.c (selftests_ecdsa, run_selftests): New. +- +- * md.c (_gcry_md_selftest): New. +- * sha1.c (run_selftests, selftests_sha1): New. +- * sha256.c (selftests_sha224, selftests_sha256, run_selftests): New. +- * sha512.c (selftests_sha384, selftests_sha512, run_selftests): New. +- +- * des.c (selftest): Remove static variable form selftest. +- (des_setkey): No on-the-fly self test in fips mode. +- (tripledes_set3keys): Ditto. +- +- * cipher.c (_gcry_cipher_setkey, _gcry_cipher_setiv): +- +- * dsa.c (generate): Bail out in fips mode if NBITS is less than 1024. +- * rsa.c (generate): Return an error code if the the requested size +- is less than 1024 and we are in fpis mode. +- (_gcry_rsa_generate): Take care of that error code. +- +- * ecc.c (generate_curve): In fips mode enable only NIST curves. +- +- * cipher.c (_gcry_cipher_selftest): New. +- +- * sha512.c (_gcry_digest_extraspec_sha384) +- (_gcry_digest_extraspec_sha512): New. +- * sha256.c (_gcry_digest_extraspec_sha224) +- (_gcry_digest_extraspec_sha256): New. +- * sha1.c (_gcry_digest_extraspec_sha1): New. +- * ecc.c (_gcry_pubkey_extraspec_ecdsa): New. +- * dsa.c (_gcry_pubkey_extraspec_dsa): New. +- * rsa.c (_gcry_pubkey_extraspec_rsa): New. +- * rijndael.c (_gcry_cipher_extraspec_aes) +- (_gcry_cipher_extraspec_aes192, _gcry_cipher_extraspec_aes256): New. +- * des.c (_gcry_cipher_extraspec_tripledes): New. +- +- * cipher.c (gcry_cipher_register): Rename to _gcry_cipher_register. +- Add arg EXTRASPEC. +- (dummy_extra_spec): New. +- (cipher_table_entry): Add extraspec field. +- * md.c (_gcry_md_register): Rename to _gcry_md_register. Add +- arg EXTRASPEC. +- (dummy_extra_spec): New. +- (digest_table_entry): Add extraspec field. +- * pubkey.c (gcry_pk_register): Rename to _gcry_pk_register. Add +- arg EXTRASPEC. +- (dummy_extra_spec): New. +- (pubkey_table_entry): Add extraspec field. +- +- * ac.c: Let most public functions return GPG_ERR_UNSUPPORTED in +- fips mode. +- +- * pubkey.c (pubkey_table_entry): Add field FIPS_ALLOWED and mark +- appropriate algorithms. +- (dummy_generate, dummy_check_secret_key, dummy_encrypt) +- (dummy_decrypt, dummy_sign, dummy_verify, dummy_get_nbits): Signal +- a fips error when used. +- (gcry_pk_register): In fips mode do not allow to register new +- algorithms. +- +- * md.c (digest_table): Add field FIPS_ALLOWED and mark appropriate +- algorithms. +- (md_register_default): In fips mode register only fips algorithms. +- (gcry_md_register): In fips mode do not allow to register new +- algorithms. +- (gcry_md_get): Signal a fips error if called. +- (gcry_md_hash_buffer): Do not allow rmd160 when not in fips mode. +- (md_start_debug): Disable in fips_mode. +- +- * md.c (gcry_md_register_default): Rename to .. +- (md_register_default): .. this. +- (md_digest): Remove this commented fucntion. +- * pubkey.c (gcry_pk_register_default): Rename to .. +- (pk_register_default): .. this. +- +- * cipher.c (cipher_table_entry): Add field FIPS_ALLOWED. +- (gcry_cipher_register_default): Register only fips approved +- algorithms. +- (gcry_cipher_register): Do not allow to register new ciphers. +- (cipher_setiv): Signal fips error. +- +- * cipher (gcry_cipher_register_default): Rename to .. +- (cipher_register_default): .. this. +- (REGISTER_DEFAULT_CIPHERS): Adjust for that change. +- +-2008-07-05 Werner Koch +- +- * random-daemon.c, random.h, rndhw.c, rndunix.c, rand-internal.h +- * random.c, rndegd.c, rndlinux.c, rndw32.c: Move to ../cipher. +- * Makefile.am: Remove random stuff. +- +-2008-06-24 Szakats Istvan (wk) +- +- * ac.c (_gcry_ac_key_destroy, _gcry_ac_key_pair_generate): Relase +- some more memory. +- +-2008-04-22 Werner Koch +- +- * rijndael.c (_gcry_aes_cfb_enc, _gcry_aes_cbc_enc) +- (_gcry_aes_cfb_dec, _gcry_aes_cbc_dec): Use Padlock if possible. +- +-2008-04-18 Werner Koch +- +- * sha1.c (transform_aligned): Remove. That is will obviosuly not +- work because we need a scratch working area and our internal API +- does not allow to modify the buffers. +- +- * rijndael.c: Factor tables out to .. +- * rijndael-tables.h: .. new. +- +- * ac.c (ac_data_extract): Make static. +- +- * camellia.h [HAVE_CONFIG_H]: Include config.h. +- +- * rndw32.c (registry_poll): Only print the performance data +- problem warning once. Suggested by Simon Josefsson. +- +-2008-03-19 Werner Koch +- +- * cipher.c (gcry_cipher_open) [USE_AES]: Init bulk encryption only +- if requested. Suggested by Dirk Stoecker. +- +-2008-03-18 Werner Koch +- +- * sha1.c: Include stdint.h. +- (transform): Add arg NBLOCKS so that we can work on more than one +- block and avoid updates of the chaining variables. Changed all +- callers to use 1. +- (sha1_write): Replace loop around transform. +- (transform_aligned) [WORDS_BIGENDIAN]: New. +- (TRANSFORM): New macro to replace all direct calls of transform. +- +-2008-03-17 Werner Koch +- +- * rijndael.c (_gcry_aes_cfb_dec): New. +- (do_encrypt): Factor code out to .. +- (do_encrypt_aligned): .. New. +- (_gcry_aes_cfb_enc, _gcry_aes_cfb_dec): Use new function. +- (do_decrypt): Factor code out to .. +- (do_decrypt_aligned): .. new. +- (_gcry_aes_cbc_enc, _gcry_aes_cbc_dec): New. +- * cipher.c (struct gcry_cipher_handle): Put field IV into new +- union U_IV to enforce proper alignment. Change all users. +- (do_cfb_decrypt): Optimize. +- (do_cbc_encrypt, do_cbc_decrypt): Optimize. +- +-2008-03-15 Werner Koch +- +- * rijndael.c (_gcry_aes_cfb_enc): New. +- * cipher.c (struct gcry_cipher_handle): Add field ALGO and BULK. +- (gcry_cipher_open): Set ALGO and BULK. +- (do_cfb_encrypt): Optimize. +- +-2008-02-18 Werner Koch +- +- * rsa.c (_gcry_rsa_verify) [IS_DEVELOPMENT_VERSION]: Print +- intermediate results. +- +-2008-01-08 Werner Koch +- +- * random.c (add_randomness): Do not just increment +- POOL_FILLED_COUNTER but update it by the actual amount of data. +- +-2007-12-13 Werner Koch +- +- * pubkey.c (sexp_data_to_mpi): Support SHA-224. +- +-2007-12-05 Werner Koch +- +- * rijndael.c (USE_PADLOCK): Depend on ENABLE_PADLOCK_SUPPORT. +- * rndhw.c (USE_PADLOCK): Ditto +- +- * rsa.c (secret): Fixed condition test for using CRT. Reported by +- Dean Scarff. Fixes bug#864. +- (_gcry_rsa_check_secret_key): Return an erro if the optional +- parameters are missing. +- * pubkey.c (sexp_elements_extract): Add arg ALGO_NAME. Changed all +- callers to pass NULL. Add hack to allow for optional RSA +- parameters. +- (sexp_to_key): Pass algo name to sexp_elements_extract. +- +-2007-12-03 Werner Koch +- +- * random.c (gcry_random_add_bytes): Implement it. +- * rand-internal.h (RANDOM_ORIGIN_EXTERNAL): New. +- +-2007-11-30 Werner Koch +- +- * rndhw.c: New. +- * rndlinux.c (_gcry_rndlinux_gather_random): Try to read 50% +- directly from the hwrng. +- * random.c (do_fast_random_poll): Also run the hw rng fast poll. +- (_gcry_random_dump_stats): Tell whether the hw rng failed. +- +-2007-11-29 Werner Koch +- +- * rijndael.c (USE_PADLOCK): Define new macro used for ia32. +- (RIJNDAEL_context) [USE_PADLOCK]: Add fields USE_PADLOCK and +- PADLOCK_KEY. +- (do_setkey) [USE_PADLOCK]: Enable padlock if available for 128 bit +- AES. +- (do_padlock) [USE_PADLOCK]: New. +- (rijndael_encrypt, rijndael_decrypt) [USE_PADLOCK]: Divert to +- do_padlock. +- * cipher.c (cipher_context_alignment_t): New. Use it in this +- module in place of PROPERLY_ALIGNED_TYPE. +- (NEED_16BYTE_ALIGNED_CONTEXT): Define macro for ia32. +- (struct gcry_cipher_handle): Add field HANDLE_OFFSET. +- (gcry_cipher_open): Take care of increased alignment requirements. +- (gcry_cipher_close): Ditto. +- +-2007-11-28 Werner Koch +- +- * sha256.c (asn224): Fixed wrong template. It happened due to a +- bug in RFC4880. SHA-224 is not in the stable version of libgcrypt +- so the consequences are limited to users of this devel version. +- +-2007-10-31 Werner Koch +- +- * ac.c (gcry_ac_data_new): Remove due to the visibility wrapper. +- (gcry_ac_data_destroy, gcry_ac_data_copy, gcry_ac_data_length) +- (gcry_ac_data_set, gcry_ac_data_get_name, gcry_ac_data_get_index) +- (gcry_ac_data_to_sexp, gcry_ac_data_from_sexp) +- (gcry_ac_data_clear, gcry_ac_io_init, gcry_ac_open) +- (gcry_ac_close, gcry_ac_key_init, gcry_ac_key_pair_generate) +- (gcry_ac_key_pair_extract, gcry_ac_key_destroy) +- (gcry_ac_key_pair_destroy, gcry_ac_key_data_get) +- (gcry_ac_key_test, gcry_ac_key_get_nbits, gcry_ac_key_get_grip) +- (gcry_ac_data_encrypt, gcry_ac_data_decrypt, gcry_ac_data_sign) +- (gcry_ac_data_verify, gcry_ac_data_encode, gcry_ac_data_decode) +- (gcry_ac_mpi_to_os, gcry_ac_mpi_to_os_alloc, gcry_ac_os_to_mpi) +- (gcry_ac_data_encrypt_scheme, gcry_ac_data_decrypt_scheme) +- (gcry_ac_data_sign_scheme, gcry_ac_data_verify_scheme) +- (gcry_ac_io_init_va): Ditto. +- (gcry_ac_id_to_name, gcry_ac_name_to_id): Remove as these +- deprecated functions are now implemented by visibility.c. +- +-2007-10-26 Werner Koch +- +- * rndw32.c: Disable debug flag. +- +-2007-10-25 Werner Koch +- +- * rndw32.c: Updated from current cryptlib snapshot and modified +- for our use. Removed support from pre NT systems. +- (slow_gatherer_windows95): Remove. +- (_gcry_rndw32_gather_random): Require an NT platform. +- (init_system_rng, read_system_rng, read_mbm_data): New. +- (slow_gatherer_windowsNT): Rename to ... +- (slow_gatherer): .. this. Read system RNG and MBM. +- (registry_poll): New with code factored out from slow_gatherer. +- +-2007-08-23 Werner Koch +- +- * random.c (pool_filled_counter): New. +- (add_randomness): Use it. +- +-2007-08-22 Werner Koch +- +- * rndw32.c, rndunix.c: Switched to LGPL. +- +-2007-05-30 Werner Koch +- +- * camellia.h, camellia.c: Replace by new LGPL version and adjusted +- camellia.h. +- +-2007-05-09 Marcus Brinkmann +- +- * ac.c (_gcry_ac_io_init_va, _gcry_ac_io_write, _gcry_ac_io_read): +- Adjust users of gcry_ac_io_t because union is not anonymous +- anymore. +- +-2007-05-02 Werner Koch +- +- * camellia-glue.c (camellia_setkey, camellia_encrypt) +- (camellia_decrypt): Recalculated used stack size in called +- functions. +- * camellia.h: Redefine external symbols. +- +-2007-05-02 David Shaw +- +- * Makefile.am, cipher.c: Add Camellia. +- +- * camellia-glue.c: New. The necessary glue to interface libgcrypt +- to the stock NTT Camellia distribution. +- +- * camellia.h, camellia.c: The stock NTT Camellia distribution +- (GPL). +- +-2007-04-30 David Shaw +- +- * cipher.c: Use #if instead of #ifdef as configure defines the +- USE_cipher defines as 0 for disabled. +- +-2007-04-30 Werner Koch +- +- * rndegd.c (_gcry_rndegd_set_socket_name): New. +- +-2007-04-30 Marcus Brinkmann +- +- * ecc.c (ec2os): Fix relocation of short numbers. +- +- * ecc.c (generate_key): Do not allocate D, which will be allocated +- by GEN_K. Remove G. Fix test if g_x, g_y resp. q_x, q_y are +- requested. +- (_gcry_ecc_generate): Release unneeded members of SK. +- * pubkey.c (sexp_to_key): Release NAME. +- +-2007-04-28 Marcus Brinkmann +- +- * ac.c (gcry_ac_mpi): Remove member NAME_PROVIDED. +- (ac_data_mpi_copy, _gcry_ac_data_set, _gcry_ac_data_get_name) +- (_gcry_ac_data_get_index, ac_data_construct): Adjust handling of +- NAME accordingly. +- +-2007-04-20 Werner Koch +- +- * ecc.c (domain_parms): Add standard brainpool curves. +- +-2007-04-18 Werner Koch +- +- * ecc.c (generate_curve): Implement alias mechanism. +- +- * pubkey.c (sexp_elements_extract_ecc): New. +- (sexp_to_key): Add special case for ecc. +- (sexp_to_key, sexp_to_sig, sexp_to_enc, gcry_pk_genkey): Replace +- name_terminated stuff by a call to _gcry_sexp_nth_string. +- (gcry_pk_get_keygrip): Ditto. +- +-2007-04-16 Werner Koch +- +- * ecc.c (_gcry_ecc_generate): Renamed DUMMY to CURVE and use it. +- +-2007-04-13 Marcus Brinkmann +- +- * ac.c (ac_data_construct): Cast const away to suppress compiler +- warning. +- +- * ecc.c (ecc_generate): Avoid compiler warning for unused argument +- DUMMY. +- (ecc_verify): Avoid compiler warning for unused arguments CMP and +- OPAQUEV. +- +-2007-04-06 Werner Koch +- +- * sha1.c (oid_spec_sha1): Add another oid from X9.62. +- +-2007-03-28 Werner Koch +- +- * pubkey.c (gcry_pk_genkey): Do not issue misc-key-info if it is +- empty. +- (gcry_pk_genkey): New parameter "curve". +- +- * ecc.c: Entirely rewritten with only a few traces of the old +- code left. +- (_gcry_ecc_generate): New. +- (generate_key) New arg NAME. +- (generate_curve): Ditto. Return actual number of NBITS. +- +-2007-03-26 Werner Koch +- +- * pubkey.c (gcry_pk_genkey): Increase size of SKEY array and add a +- runtime bounds check. +- +-2007-03-23 Werner Koch +- +- * ecc.c (ecc_ctx_init, ecc_ctx_free, ecc_mod, ecc_mulm): New. +- (duplicate_point, sum_points, escalar_mult): Don't use a +- copy of base->p. Replaced all mpi_mulm by ecc_mulm so that we can +- experiment with different algorithms. +- (generate_key, check_secret_key, sign, verify): Initialize a +- computation context for use by ecc_mulm. +- +-2007-03-22 Werner Koch +- +- * pubkey.c (pubkey_table): Initialize ECC. +- * Makefile.am (EXTRA_libcipher_la_SOURCES): Add ecc.c. +- * ecc.c: New. Heavily reformatted and changed for use in libgcrypt. +- (point_init): New. +- (escalar_mult): Make arg R the first arg to be similar to the mpi +- functions. +- (duplicate_point): Ditto +- (sum_points): Ditto +- (sign, verify): Remove unneeded copy operations. +- (sum_points): Removed memory leaks and optimized some compares. +- (verify): Simplified input check. +- +-2007-03-14 Werner Koch +- +- * random.c (MASK_LEVEL): Removed macro as it was used only at one +- place. Open coded it there. +- (gcry_randomize, _gcry_update_random_seed_file) +- (_gcry_fast_random_poll): Factor lock code out to .. +- (lock_pool, unlock_pool): .. new. +- (initialize): Look the pool while allocating. +- (read_random_source, do_fast_random_poll): Moved intialization to ... +- (initialize): .. here. +- (_gcry_enable_quick_random_gen): No more need for initialization. +- (is_initialized): Moved this global flag to .. +- (initialize): .. here and changed all users to unconditionally call +- initialize. +- (add_randomness): Remove initalization here. It simply can't +- happen. +- +- * random.c (enum random_origins): Moved to .. +- * rand-internal.h: .. here. +- * rndunix.c (_gcry_rndunix_gather_random): Use enum in prototype +- for ORIGIN and renamed REQUESTOR to ORIGIN. +- * rndegd.c (_gcry_rndegd_gather_random): Ditto. +- * rndlinux.c (_gcry_rndlinux_gather_random): Ditto. +- * rndw32.c (_gcry_rndw32_gather_random): Ditto. +- (_gcry_rndw32_gather_random_fast): Ditto. +- +-2007-03-13 Werner Koch +- +- * random.c (enum random_origins): New. +- (add_randomness): Renamed arg SOURCE to ORIGIN. +- (read_random_source): Renamed arg REQUESTOR to ORIGIN. +- (getfnc_gather_random): Removed static variable because this +- function is only called one and thus we don't need this +- optimization. +- (_gcry_quick_random_gen): Removed and replaced by.. +- (_gcry_enable_quick_random_gen): .. this. It is onlyu used to +- enable it and it does not make sense to disable it later. Changed +- the only one caller too. +- (get_random_bytes): Removed. +- (gcry_random_bytes, gcry_random_bytes_secure): Implement in terms +- of gcry_randomize. +- * random-daemon.c (_gcry_daemon_get_random_bytes): Removed. +- +-2007-02-23 Werner Koch +- +- * elgamal.c (generate): Removed unused variable TEMP. +- (test_keys): New arg NODIE. +- (generate_using_x, _gcry_elg_generate_using_x): New. +- * pubkey.c (pubkey_generate): New arg XVALUE and direct call to +- the new elgamal generate fucntion. +- (gcry_pk_genkey): Parse the new "xvalue" tag. +- +-2007-02-22 Werner Koch +- +- * pubkey.c (sexp_data_to_mpi): Handle dynamically allocated +- algorithms. Suggested by Neil Dunbar. Fixes bug#596. +- +- * rndw32.c (_gcry_rndw32_gather_random_fast): Make it return void. +- +- * cipher.c (gcry_cipher_algo_name): Simplified. +- +- * random.c: Use the daemon only if compiled with USE_RANDOM_DAEMON. +- +- * Makefile.am (libcipher_la_SOURCES): Build random-daemon support +- only if requested. +- +-2007-02-21 Werner Koch +- +- * random.c (rndpool, keypool): Make unsigned. +- (mix_pool): Change char* variables to unsigned char*. +- (gcry_randomize): Make arg BUFFER a void*. +- (gcry_create_nonce): Ditto. +- +- * rmd160.c (gcry_rmd160_mixblock): Make BUFFER a void*. +- (_gcry_rmd160_hash_buffer): Make OUTBUF and BUFFER void*. +- * sha1.c (_gcry_sha1_hash_buffer): Ditto. +- +- * cipher.c (gcry_cipher_encrypt, cry_cipher_decrypt): Change +- buffer args to void*. +- (gcry_cipher_register): Make ALGORITHM_ID a int *. +- +- * md.c (md_start_debug): Make SUFFIX a const char*. Use snprintf. +- (gcry_md_debug): New. +- (gcry_md_ctl): Changed arg BUFFER from unsigned char*. +- +- * md.c (md_write): Make INBUF a const void*. +- (gcry_md_write): Remove needless cast. +- * crc.c (crc32_write): Make INBUF a const void* +- (update_crc32, crc24rfc2440_write): Ditto. +- * sha512.c (sha512_write, transform): Ditto. +- * sha256.c (sha256_write, transform): Ditto. +- * rmd160.c (rmd160_write, transform): Ditto. +- * md5.c (md5_write, transform): Ditto. +- * md4.c (md4_write, transform): Ditto. +- * sha1.c (sha1_write, transform): Ditto. +- +- * tiger.c (tiger_write, transform): Ditto. +- * whirlpool.c (whirlpool_write, whirlpool_add, transform): Ditto. +- +- * elgamal.c (elg_names): Change to a const*. +- * dsa.c (dsa_names): Ditto. +- * rsa.c (rsa_names): Ditto. +- * pubkey.c (gcry_pk_lookup_func_name): Make ALIASES a const. +- +-2007-02-20 Werner Koch +- +- * rndlinux.c (open_device): Remove unsused arg MINOR. +- +-2007-01-30 Werner Koch +- +- * sha256.c (oid_spec_sha256): Add alias from pkcs#1. +- * sha512.c (oid_spec_sha512): Ditto. +- (oid_spec_sha384): Ditto. +- +-2006-12-18 Werner Koch +- +- * rndlinux.c (set_cloexec_flag): New. +- (open_device): Set close-on-exit flags. Suggested by Max +- Kellermann. Fixes Debian#403613. +- +- * Makefile.am (AM_CPPFLAGS, AM_CFLAGS): Splitted and merged +- Moritz' changes. +- (INCLUDES): Removed. +- +-2006-11-30 Werner Koch +- +- * serpent.c (byte_swap_32): Remove trailing semicolon. +- +-2006-11-15 Werner Koch +- +- * Makefile.am (INCLUDES): Include ../src/ +- +-2006-11-03 Werner Koch +- +- * random.c [HAVE_GETTIMEOFDAY]: Included sys/time.h and not +- sys/times.h. Reported by Rafaël Carré. +- +-2006-11-05 Moritz Schulte +- +- * Makefile.am (AM_CFLAGS): Added -I$(top_builddir)/src so that the +- new gcrypt.h is used, not the one installed in the system. +- +-2006-10-25 Werner Koch +- +- * primegen.c (prime_generate_internal): Tweaked use of secure +- memory and entropy use. Safe unused primes from the pool. Allocate +- at least a pool of 30. +- (save_pool_prime, get_pool_prime): New. +- +-2006-10-23 Werner Koch +- +- * ac.c (_gcry_ac_data_from_sexp): Reset sexp_tmp for failsafe +- means. Release sexp_cur if needed. Reported by Dirk Stoecker. +- +- * pubkey.c (pubkeys_registered_lock): Intialized it. It is not +- realy needed because this is a mere initialization to 0 anyway. +- Noted by Victor Stinner. +- +-2006-10-17 Werner Koch +- +- * dsa.c (_gcry_dsa_generate2): New. +- (generate): New arg QBITS. Add sanity checks for reasonable qbits +- and nbits. +- * pubkey.c (gcry_pk_genkey): Parse an qbits element. +- (pubkey_generate): New arg QBITS. Pass it to the DSA generation. +- +-2006-10-05 Werner Koch +- +- * md.c (gcry_md_algo_info) : Check that the algo is +- available. +- +-2006-10-04 David Shaw (wk) +- +- * tiger.c (round): Rename to tiger_round as gcc 4 has a built-in +- round function that this conflicts with. +- +-2006-09-11 Werner Koch +- +- * rndw32.c (slow_gatherer_windowsNT): While adding data use the +- size of the diskPerformance and not its address. Has been fixed in +- GnuPG more than a year ago. Noted by Lee Fisher. +- +-2006-08-30 Werner Koch +- +- * pubkey.c (sexp_data_to_mpi): Need to allow "ripemd160" here as +- this is the canonical name. +- +-2006-08-29 Hye-Shik Chang (wk) +- +- * seed.c: New. +- +-2006-08-03 Werner Koch +- +- * random-daemon.c (_gcry_daemon_initialize_basics): Don't +- initialize the socket. Remove arg SOCKETNAME. +- (connect_to_socket): Make sure that daemon is set to -1 on error. +- (call_daemon): Initialize the socket on the first call. +- (_gcry_daemon_randomize, _gcry_daemon_get_random_bytes) +- (_gcry_daemon_create_nonce): New arg SOCKETNAME. +- * random.c (initialize): Call new daemon initializator. +- (get_random_bytes, gcry_randomize, gcry_create_nonce): Pass socket +- name to daemon call and reset allow_daemon on failure. +- +-2006-07-26 Werner Koch +- +- * rmd160.c (_gcry_rmd160_mixblock): Add cast to transform call. +- +- * blowfish.c (selftest): Cast string to usnigned char*. +- +- * primegen.c (prime_generate_internal): Cast unsigned/char* +- mismatch in calling m_out_of_n. +- (is_prime): Changed COUNT to unsigned int *. +- +- * ac.c (_gcry_ac_data_copy): Initialize DATA_MPIS. +- +- * random.c (gcry_create_nonce): Update the pid after a fork. +- Reported by Uoti Urpala. +- +-2006-07-04 Marcus Brinkmann +- +- * sha512.c: Fix typo in copyright notice. +- +-2006-06-21 Werner Koch +- +- * rsa.c (_gcry_rsa_generate): Replace xcalloc by calloc. +- * pubkey.c (gcry_pk_encrypt, gcry_pk_sign): Ditto. +- (sexp_to_key, sexp_to_sig, sexp_to_enc, gcry_pk_encrypt) +- (gcry_pk_sign, gcry_pk_genkey, gcry_pk_get_keygrip): Ditto. +- * md.c (md_copy): Ditto. +- +-2006-04-22 Moritz Schulte +- +- * random-daemon.c (_gcry_daemon_initialize_basics): New argument: +- SOCKETNAME. Passing on to connect_to_socket() if non-NULL. +- (connect_to_socket, writen, readn, call_daemon): New functions. +- (_gcry_daemon_randomize, _gcry_daemon_get_random_bytes) +- (_gcry_daemon_create_nonce): Call call_daemon(). +- (RANDOM_DAEMON_SOCKET): New symbol. +- (daemon_socket): New static variable. +- +- * random.h (_gcry_daemon_initialize_basics): New parameter: +- SOCKETNAME. +- (_gcry_set_random_daemon_socket): New declaration. +- +- * random.c (initialize_basics): Pass DAEMON_SOCKET_NAME to +- _gcry_daemon_initialize_basics. +- (_gcry_set_random_daemon_socket): New function, setting +- DAEMON_SOCKET_NAME. +- +-2006-04-01 Moritz Schulte +- +- * ac.c (eme_pkcs_v1_5_encode): Use KEY_SIZE directly, no need to +- call gcry_ac_key_get_nbits. +- (eme_pkcs_v1_5_decode): Likewise. +- (ac_es_dencode_prepare_pkcs_v1_5): Fill options_em structure with +- key_size. +- (_gcry_ac_data_dump, gcry_ac_data_dump): New functions. +- (_gcry_ac_data_to_sexp, _gcry_ac_data_from_sexp): More or less +- rewritten; changed S-Expression format so that it matches the one +- used in pubkey.c. +- +-2006-03-15 Werner Koch +- +- * random-daemon.c: New. +- * random.c (_gcry_use_random_daemon): New. +- (get_random_bytes, gcry_randomize, gcry_create_nonce): Try +- diverting to the daemon functions. +- +-2006-03-14 Werner Koch +- +- * random.c (lock_seed_file): New. +- (read_seed_file, _gcry_update_random_seed_file): Use it. +- +- * random.c (gcry_create_nonce): Detect a fork and re-seed. +- (read_pool): Fixed the fork detection; it used to work only for +- multi-threaded processes. +- +-2006-03-12 Brad Hards (wk) +- +- * md.c (md_open): Use new variable macpads_Bsize instead of +- hardwiring the block size. Changed at all places. +- +-2006-03-10 Brad Hards (wk, patch 2005-04-22) +- +- * md.c, sha256.c: Add support for SHA-224. +- (sha224_init): New. +- +-2006-01-18 Brad Hards (wk 2006-03-07) +- +- * cipher.c (cipher_encrypt, cipher_decrypt, do_ofb_encrypt) +- (do_ofb_decrypt, gcry_cipher_open): Implement Output Feedback Mode. +- +-2005-11-02 Moritz Schulte +- +- * pubkey.c (gcry_pk_algo_name): Return "?" instead of NULL for +- unknown algorithm IDs. +- * cipher.c (cipher_algo_to_string): Likewise. +- +-2005-11-01 Moritz Schulte +- +- * pubkey.c (gcry_pk_algo_info): Don't forget to break after switch +- case. +- +-2005-09-19 Werner Koch +- +- * dsa.c (generate): Add preliminary support for 2 and 4 keys. +- Return an error code if the key size is not supported. +- (_gcry_dsa_generate): Return an error. +- +-2005-08-22 Werner Koch +- +- * primegen.c (check_prime): New arg RM_ROUNDS. +- (prime_generate_internal): Call it here with 5 rounds as used +- before. +- (gcry_prime_check): But here with 64 rounds. +- (is_prime): Make sure never to use less than 5 rounds. +- +-2005-04-16 Moritz Schulte +- +- * ac.c (_gcry_ac_init): New function. +- +-2005-04-12 Moritz Schulte +- +- * ac.c (_gcry_ac_io_write, _gcry_ac_io_read): Initialize err to +- make the compiler happy. +- Always use errno, now that gcry_malloc() is guaranteed to set +- errno on failure. +- (_gcry_ac_data_to_sexp): Don't forget to goto out after error in +- loop. +- (_gcry_ac_data_to_sexp): Remove unused variable: mpi_list; +- (_gcry_ac_data_to_sexp): Always deallocate sexp_buffer. +- (_gcry_ac_data_from_sexp): Don't forget to initialize data_set_new. +- (_gcry_ac_data_from_sexp): Handle special case, which is +- necessary, since gcry_sexp_nth() does not distinguish between +- "element does not exist" and "element is the empty list". +- (_gcry_ac_io_init_va): Use assert to make sure that mode and type +- are correct. +- Use gcry_error_t types where gcry_err_code_t types have been used +- before. +- +-2005-04-11 Moritz Schulte +- +- * ac.c (_gcry_ac_data_sign_scheme): Don't forget to initialize +- buffer. +- +- * whirlpool.c: New file. +- * md.c (digest_table): Add whirlpool. +- * Makefile.am (EXTRA_libcipher_la_SOURCES): Added: whirlpool.c. +- +-2005-03-30 Moritz Schulte +- +- * ac.c (_gcry_ac_data_from_sexp): Use length of SEXP_CUR, not +- length of SEXP; do not forget to set SEXP_TMP to NULL after it has +- been released. +- +- (struct gcry_ac_mpi): New member: name_provided. +- (_gcry_ac_data_set): Rename variable `name_final' to `name_cp'; +- remove const qualifier; change code to not cast away const +- qualifiers; use name_provided member as well. +- (_gcry_ac_data_set, _gcry_ac_data_get_name): Use name_provided +- member of named mpi structure. +- +- (gcry_ac_name_to_id): Do not forget to initialize err. +- (_gcry_ac_data_get_index): Do not forget to initialize mpi_return; +- use gcry_free() instead of free(); remove unnecessary cast; rename +- mpi_return and name_return to mpi_cp and name_cp; adjust code. +- (ac_data_mpi_copy): Do not cast away const qualifier. +- (ac_data_values_destroy): Likewise. +- (ac_data_construct): Likewise. +- +- (ac_data_mpi_copy): Initialize flags to GCRY_AC_FLAG_DEALLOC. +- (ac_data_extract): Use GCRY_AC_FLAG_DEALLOC instead of +- GCRY_AC_FLAG_COPY. +- +- (_gcry_ac_io_init_va, _gcry_ac_io_init, gcry_ac_io_init) +- (gcry_ac_io_init_va, _gcry_ac_io_write, _gcry_ac_io_read) +- (_gcry_ac_io_read_all, _gcry_ac_io_process): New functions. +- (gry_ac_em_dencode_t): Use gcry_ac_io_t in prototype instead of +- memroy strings directly; adjust encode/decode functions to use io +- objects. +- (emsa_pkcs_v1_5_encode_data_cb): New function ... +- (emsa_pkcs_v1_5_encode): ... use it here. +- (ac_data_dencode): Use io objects. +- (_gcry_ac_data_encode, _gcry_ac_data_decode, gcry_ac_data_encode) +- (gcry_ac_data_decode): Likewise. +- (_gcry_ac_data_encrypt_scheme, gcry_ac_data_encrypt_scheme) +- (_gcry_ac_data_decrypt_scheme, gcry_ac_data_decrypt_scheme) +- (_gcry_ac_data_sign_scheme, gcry_ac_data_sign_scheme) +- (_gcry_ac_data_verify_scheme, gcry_ac_data_verify_scheme): +- Likewise. +- +-2005-03-23 Werner Koch +- +- * rndw32.c (_gcry_rndw32_gather_random_fast): While adding data +- use the size of the object and not the one of its address. Bug +- reported by Sascha Kiefer. +- +-2005-03-19 Moritz Schulte +- +- * cipher.c (do_cbc_encrypt): Be careful to not overwrite data, +- which is to be used later on. This happend, in case CTS is +- enabled and OUTBUF is equal to INBUF. +- +-2005-02-25 Werner Koch +- +- * pubkey.c (gcry_pk_get_keygrip): Allow for shadowed-private-key. +- +-2005-02-13 Moritz Schulte +- +- * serpent.c: Updated from 1.2 branch: +- +- s/u32_t/u32/ and s/byte_t/byte/. Too match what we have always +- used and are using in all other files too +- (serpent_test): Moved prototype out of a fucntion. +- +-2005-02-07 Moritz Schulte +- +- * ac.c: Major parts rewritten. +- * pubkey.c (_gcry_pk_get_elements): New function. +- +-2004-12-09 Werner Koch +- +- * serpent.c (serpent_setkey): Moved prototype of serpent_test to +- outer scope. +- +-2004-09-11 Moritz Schulte +- +- * pubkey.c (pubkey_table): Added an alias entry for GCRY_PK_ELG_E. +- +-2004-08-23 Moritz Schulte +- +- * ac.c: Do not include . +- * rndegd.c: Likewise. +- * sha1.c: Likewise. +- * rndunix.c: Likewise. +- * rndlinux.c: Likewise. +- * rmd160.c: Likewise. +- * md5.c: Likewise. +- * md4.c: Likewise. +- * cipher.c: Likewise. +- * crc.c: Likewise. +- * blowfish.c: Likewise. +- +- * pubkey.c (dummy_generate, dummy_check_secret_key) +- (dummy_encrypt, dummy_decrypt, dummy_sign, dummy_verify): Return +- err code GPG_ERR_NOT_IMPLEMENTED instead of aborting through +- log_bug(). +- (dummy_get_nbits): Return 0 instead of aborting though log_bug(). +- +-2004-08-19 Werner Koch +- +- * pubkey.c (sexp_data_to_mpi): Changed the zero random byte +- substituting code to actually do clever things. Thanks to +- Matthias Urlichs for noting the implementation problem. +- +-2004-08-09 Moritz Schulte +- +- * pubkey.c (gcry_pk_sign): Fixed memory leak; fix provided by +- Modestas Vainius. +- +-2004-07-16 Werner Koch +- +- * rijndael.c (do_encrypt): Fix alignment problem. Bugs found by +- Matthias Urlichs. +- (do_decrypt): Ditto. +- (keySched, keySched2): Use 2 macros along with unions in the key +- schedule context. +- +-2004-07-14 Moritz Schulte +- +- * rsa.c (_gcry_rsa_decrypt): Don't forget to free "a". Thanks to +- Nikos Mavroyanopoulos. +- +-2004-05-09 Werner Koch +- +- * random.c (read_pool): Mix the PID in to better protect after a +- fork. +- +-2004-07-04 Moritz Schulte +- +- * serpent.c: Use "u32_t" instead of "unsigned long", do not +- declare S-Box variables as "register". Fixes failure on +- OpenBSD/sparc64, reported by Nikolay Sturm. +- +-2004-05-07 Werner Koch +- +- * random.c (initialize): Factored out some code to .. +- (initialize_basics): .. new function. +- (_gcry_random_initialize): Just call initialize_basics unless the +- new arg FULL is set to TRUE. +- (_gcry_fast_random_poll): Don't do anything unless the random +- system has been really initialized. +- +-2004-05-07 Moritz Schulte +- +- * ac.c (gcry_ac_open): Do not dereference NULL pointer. Reported +- by Umberto Salsi. +- +-2004-02-20 Werner Koch +- +- * primegen.c (check_prime): New args CB_FUNC and CB_ARG; call them +- at different stages. Pass these arguments through all callers. +- +-2004-02-06 Werner Koch +- +- * des.c: Add a new OID as used by pkcs#12. +- +- * rfc2268.c: New. Taken from libgcrypt. +- * cipher.c: Setup the rfc2268 algorithm. +- +-2004-01-25 Moritz Schulte +- +- * primegen.c (prime_generate_internal): Do not forget to free +- `q_factor'; fixed by Brieuc Jeunhomme. +- (prime_generate_internal): Do not forget to free `prime'. +- +-2004-01-14 Moritz Schulte +- +- * ac.c (gcry_ac_data_set): New argument: flags; slightly +- rewritten. +- (gcry_ac_data_get_name, gcry_ac_data_get_index): Likewise. +- (gcry_ac_key_pair_generate): New argument: misc_data; modified +- order of arguments. +- (gcry_ac_key_test): New argument: handle. +- (gcry_ac_key_get_nbits, gcry_ac_key_get_grip): Likewise. +- Use GCRY_AC_FLAG_NO_BLINDING instead of +- GCRY_AC_DATA_FLAG_NO_BLINDING. +- (gcry_ac_mpi): New member: flags. +- (gcry_ac_data_search, gcry_ac_data_add): Removed functions. +- +-2003-12-22 Werner Koch +- +- * primegen.c (is_prime): Release A2. +- +-2003-12-19 Werner Koch +- +- * md.c: Moved a couple of functions down below the data structure +- definitions. +- (struct gcry_md_context): New field ACTUAL_HANDLE_SIZE. +- (md_open): Set it here. +- (strcut gcry_md_list): New field ACTUAL_STRUCT_SIZE. +- (md_enable): Set it here. +- (md_close): Wipe the context memory. +- secure memory. +- * cipher.c (struct gcry_cipher_handle): New field ACTUAL_HANDLE_SIZE. +- (gcry_cipher_open): Set it here. +- (gcry_cipher_close): Use it to always wipe out the handle data. +- +- * ac.c (gcry_ac_open): Make sure HANDLE gets initialized even when +- the function is not successful. +- (gcry_ac_close): Allow a NULL handle. +- (gcry_ac_key_destroy, gcry_ac_key_pair_destroy): Ditto. +- (gcry_ac_key_get_grip): Return INV_OBJ on error. +- +- * primegen.c (prime_generate_internal): Fixed error code for +- failed malloc. Replaced the !err if chain by gotos. +- (gcry_prime_group_generator): Remove the extra sanity check. +- +- * md.c: Minor code and comment cleanups. +- +-2003-12-16 Werner Koch +- +- * primegen.c (gen_prime): Doc fix. Thanks to Newton Hammet. +- +-2003-12-11 Werner Koch +- +- * rndunix.c (slow_poll): Don't use #warning but #error. +- +- * rndegd.c: Changed indentation. +- (my_make_filename): Removd the var_arg cruft becuase we +- don't need it here. Changed caller. +- +- * rndlinux.c: Changed indentation. +- (open_device): Remove the superfluous stat call and clarify +- comment. +- +- * rsa.c: Changed indentation. +- (secret): Use the standard algorithm if p, q and u are not +- available. +- (rsa_blind, rsa_unblind): Renamed from _gcry_rsa_blind, +- _gcry_rsa_unblind and moved more to the top. +- +- * md4.c: Changed indentation. Removed unnecessary casts. +- * md5.c, rmd160.c, sha1.c, tiger.c: Ditto. +- * rijndael.c, twofish.c: Ditto. +- * serpent.c: Removed unnecessary casts. +- * sha256.c, sha512.c: Ditto. +- +-2003-12-09 Werner Koch +- +- * dsa.c: Unified indentation style. +- * elgamal.c: Ditto. +- * des.c (des_key_schedule): Code beautifications. +- * blowfish.c: Changed indentation style. +- * cast5.c (do_cast_setkey): Ditto. +- +- * pubkey.c (gcry_pk_encrypt): Replaced the chain of if(!err) tests +- by straightforward gotos. Other cleanups. +- (gcry_pk_decrypt): Ditto. +- (gcry_pk_sign): Ditto. +- (gcry_pk_verify): Ditto. +- (gcry_pk_genkey): Ditto. Use strtoul instead of strtol. +- (gcry_pk_ctl): Use GPG_ERR_INV_ARG to indicate bad arguments. +- +-2003-12-07 Werner Koch +- +- * pubkey.c (gcry_pk_register_default): Undef the helper macro. +- (gcry_pk_map_name): Allow NULL for string. +- (sexp_to_key): Use memcpy and not strncpy. Use gcry_free and not +- free. +- (sexp_to_sig): Ditto. +- (sexp_to_enc): Ditto. Replaced the chain of if(!err) tests by +- straightforward gotos. +- +-2003-12-05 Werner Koch +- +- * cipher.c: Documentation cleanups. +- (gcry_cipher_mode_from_oid): Allow NULL for STRING. +- +-2003-12-03 Werner Koch +- +- * elgamal.c (sign, do_encrypt, gen_k): Make sure that a small K is +- only used for encryption. +- +-2003-11-18 Werner Koch +- +- * random.h (rndw32_set_dll_name): Removed unused prototype. +- +- * Makefile.am (EXTRA_DIST): Added Manifest. +- +-2003-11-11 Werner Koch +- +- * Manifest: New. +- +-2003-11-04 Werner Koch +- +- * md.c (gcry_md_hash_buffer): Use shortcut for SHA1 +- * sha1.c (_gcry_sha1_hash_buffer): New. +- +- * random.c: Reformatted most functions. +- (mix_pool): Moved the failsafe_digest from global +- scope to here. +- (do_fast_random_poll): Use the generic fucntions even if a fast +- gathering function has been used. +- (read_pool): Detect a fork and retry. +- (gcry_randomize, get_random_bytes): Don't distinguish anymore +- between weak and strong random. +- (gcry_create_nonce): New. +- +-2003-10-31 Werner Koch +- +- * rndw32.c (slow_gatherer_windowsNT): Use a plain buffer for the +- disk performance values and not the W32 API structure. +- +- * dsa.c (verify): s/exp/ex/ due to shadowing of a builtin. +- * elgamal.c (verify): Ditto. +- +- * ac.c (gcry_ac_data_get_index): s/index/idx/ +- (gcry_ac_data_copy_internal): Remove the cast in _gcry_malloc. +- (gcry_ac_data_add): Must use gcry_realloc instead of realloc. +- * pubkey.c (sexp_elements_extract): s/index/idx/ as tribute to the +- forehackers. +- (gcry_pk_encrypt): Removed shadowed definition of I. Reordered +- arguments to malloc for clarity. +- (gcry_pk_sign, gcry_pk_genkey): Ditto. +- * primegen.c (prime_generate_internal): s/random/randomlevel/. +- +-2003-10-27 Moritz Schulte +- +- * pubkey.c (gcry_pk_encrypt): Don't forget to deallocate pkey. +- +-2003-10-27 Werner Koch +- +- * random.c (gcry_random_add_bytes): Return if buflen is zero to +- avoid gcc warning about unsed parameter. +- (MASK_LEVEL): Simplified; does now work for signed and unsigned +- w/o warnings. +- +- * md.c (md_start_debug): Removed the const from SUFFIX, because +- this function is called from the control fucntion which does not +- require const. +- +- Prefixed all (pubkey,digest,cipher}_spec_* globale variables with +- _gcry_. +- +- * ac.c (ac_key_identifiers): Made static. +- +- * random.c (getfnc_gather_random,getfnc_fast_random_poll): Move +- prototypes to .. +- * rand-internal.h: .. here +- * random.c (getfnc_gather_random): Include rndw32 gatherer. +- * rndunix.c, rndw32.c, rndegd.c: Include them here. +- * rndlinux.c (_gcry_rndlinux_gather_random): Prepend the _gcry_ +- prefix. Changed all callers. +- * rndegd.c (_gcry_rndegd_gather_random): Likewise. +- (_gcry_rndegd_connect_socket): Likewise. +- * rndunix.c (_gcry_rndunix_gather_random): Likewise. +- (waitpid): Made static. +- * rndw32.c: Removed the old and unused winseed.dll cruft. +- (_gcry_rndw32_gather_random_fast): Renamed from +- gather_random_fast. +- (_gcry_rndw32_gather_random): Renamed from gather_random. Note, +- that the changes 2003-04-08 somehow got lost. +- +- * sha512.c (sha512_init, sha384_init): Made static. +- +- * cipher.c (do_ctr_decrypt): Removed "return" from this void +- function. +- +-2003-10-24 Moritz Schulte +- +- * serpent.c: Fix an issue on big-endian systems. +- +- * rndw32.c: Removed IS_MODULE -cruft. +- * rndlinux.c (rndlinux_gather_random): Likewise. +- +-2003-10-10 Werner Koch +- +- * primegen.c (gen_prime): Bail out if NBITS is less than 16. +- (prime_generate_internal): Initialize prime variable to suppress +- compiler warning. Check pbits, initialize qbits when passed as +- zero. +- +- * primegen.c (prime_generate_internal): New arg +- ALL_FACTORS. Changed all callers. +- (gcry_prime_generate): Make the factors arg optional. Request +- all_factors. Make sure PRIME is set to NULL even on error. +- (gcry_prime_group_generator): New. +- (gcry_prime_release_factors): New. +- +-2003-10-06 Werner Koch +- +- * primegen.c (gen_prime): Assert that NBITS is never zero, it +- would cause a segv. +- +-2003-09-28 Moritz Schulte +- +- * ac.c: Include "cipher.h". +- +-2003-09-27 Moritz Schulte +- +- * rndegd.c (do_read): Return nread instead of nbytes; thanks to +- Michael Caerwyn. +- +-2003-09-04 Werner Koch +- +- * pubkey.c (_gcry_pk_aliased_algo_name): New. +- * ac.c (gcry_ac_open): Use it here. +- +- * Makefile.am (EXTRA_libcipher_la_SOURCES): Add serpent.c +- +-2003-09-02 Moritz Schulte +- +- * primegen.c (gcry_prime_check, gcry_prime_generate): New +- functions. +- (prime_generate_internal): New function, based on +- _gcry_generate_elg_prime. +- (_gcry_generate_elg_prime): Rewritten as a wrapper for +- prime_generate_internal. +- +-2003-08-28 Werner Koch +- +- * pubkey.c (gcry_pk_encrypt): Don't include the flags list in the +- return value. This does not make sense and breaks any programs +- parsing the output strictly (e.g. current gpgsm). +- (gcry_pk_encrypt): If aliases for the algorithm name exists, take +- the first one instead of the regular name to adhere to SPKI +- conventions. +- (gcry_pk_genkey): Ditto. +- (gcry_pk_sign): Ditto. Removed unused KEY_ALGO_NAME. +- +-2003-08-19 Moritz Schulte +- +- * cipher.c: Add support for Serpent +- * serpent.c: New file. +- +-2003-08-10 Moritz Schulte +- +- * rsa.c (_gcry_rsa_blind, _gcry_rsa_unblind): Declare static. +- +-2003-08-09 Timo Schulz +- +- * random.c (getfnc_gather_random): Don't check NAME_OF_DEV_RANDOM +- two times, but also the NAME_OF_DEV_URANDOM device. +- +-2003-08-08 Moritz Schulte +- +- * pubkey.c (sexp_to_enc): Fixed extraction of S-Expression: do not +- fail if no `flags' sub S-Expression is found. +- +-2003-07-27 Werner Koch +- +- * md.c (gcry_md_lookup_func_oid): Allow for empty OID lists. +- +-2003-07-23 Moritz Schulte +- +- * ac.c (gcry_ac_data_construct): New argument: include_flags, only +- include `flags' S-expression, if include_flags is true. Adjust +- callers. Thanks for triggering a bug caused by `flags' +- sub-S-expression where they are not expected to Ralf Schneider. +- +-2003-07-21 Moritz Schulte +- +- * pubkey.c (gcry_pk_lookup_func_name): Use new member name +- `aliases' instead of `sexp_names'. +- +- * ac.c (gcry_ac_key_data_get): New function. +- +- * cipher.c (gcry_cipher_lookup_func_name): Fix return value. +- +-2003-07-20 Moritz Schulte +- +- * blowfish.c: Adjusted for new gcry_cipher_spec_t structure. +- * cast5.c: Likewise. +- * twofish.c: Likewise. +- * arcfour.c: Likewise. +- * rijndael.c (rijndael_oids, rijndael192_oids, rijndael256_oids): +- New variables, adjust for new gcry_cipher_spec_t structure. +- * des.c (oids_tripledes): New variable, adjust for new +- gcry_cipher_spec_t structure. +- +- * md.c (oid_table): Removed. +- +- * tiger.c (oid_spec_tiger): New variable. +- (digest_spec_tiger): Adjusted for new gry_md_spec_t structure. +- +- * sha512.c (oid_spec_sha512): New variable. +- (digest_spec_sha512): Adjusted for new gry_md_spec_t structure. +- +- * sha512.c (oid_spec_sha384): New variable. +- (digest_spec_sha384): Adjusted for new gry_md_spec_t structure. +- +- * sha256.c (oid_spec_sha256): New variable. +- (digest_spec_sha256): Adjusted for new gry_md_spec_t structure. +- +- * sha1.c (oid_spec_sha1): New variable. +- (digest_spec_sha1): Adjusted for new gry_md_spec_t structure. +- +- * rmd160.c (oid_spec_rmd160): New variable. +- (digest_spec_rnd160): Adjusted for new gry_md_spec_t structure. +- +- * md5.c (oid_spec_md5): New variable. +- (digest_spec_md5): Adjusted for new gry_md_spec_t structure. +- +- * md4.c (oid_spec_md4): New variable. +- (digest_spec_md4): Adjusted for new gry_md_spec_t structure. +- +- * crc.c (digest_spec_crc32, digest_spec_crc32_rfc1510, +- digest_spec_crc32_rfc2440): Adjusted for new gry_md_spec_t +- structure. +- +-2003-07-19 Moritz Schulte +- +- * md.c (gcry_md_lookup_func_oid): New function. +- (search_oid): New function, copied from cipher.c. +- (gcry_md_map_name): Adjust for new search_oid_interface. +- +- * cipher.c (oid_table): Removed table. +- (gcry_cipher_lookup_func_oid): New function. +- (search_oid): Rewritten to use the module functions. +- (gcry_cipher_map_name): Adjust for new search_oid interface. +- (gcry_cipher_mode_from_oid): Likewise. +- +-2003-07-18 Werner Koch +- +- * md.c (gcry_md_hash_buffer): Convert ERR to gpg_error_t in +- gpg_strerror. +- +-2003-07-14 Moritz Schulte +- +- * cipher.c (gcry_cipher_lookup_func_name): Also check the cipher +- name aliases, not just the primary name. +- (gcry_cipher_map_name): Remove kludge for aliasing Rijndael to +- AES. +- +- * arcfour.c, blowfish.c, cast5.c, des.c, twofish.c: Adjust cipher +- specification structures. +- +- * rijndael.c (rijndael_names, rijndael192_names, +- rijndael256_names): New variables, use them in the cipher +- specifications. +- +- * rmd160test.c: Removed file. +- +- * ac.c, arcfour.c, blowfish.c, cast5.c, cipher.c, des.c, dsa.c, +- elgamal.c, md.c, pubkey.c, random.c, rijndael.c, rsa.c, twofish.c: +- Used gcry_err* wrappers for libgpg symbols. +- +- * primegen.c (gen_prime): Correct the order arguments to +- extra_check. +- +-2003-07-12 Moritz Schulte +- +- * ac.c: Replaced all public occurences of gpg_error_t with +- gcry_error_t. +- * cipher.c: Likewise. +- * md.c: Likewise. +- * pubkey.c: Likewise. +- * random.c: Likewise. +- +- * cipher.c: Added support for TWOFISH128. +- +-2003-07-08 Moritz Schulte +- +- * ac.c (gcry_ac_data_copy_internal): New function, based on +- gcry_ac_data_copy. +- (gcry_ac_data_copy): Made public, use gcry_ac_data_copy_internal. +- (gcry_ac_key_init): Use gcry_ac_data_copy_internal. +- +-2003-07-07 Moritz Schulte +- +- * ac.c (gcry_ac_data_set): Only release old MPI value if it is +- different from the new value. Bug reported by Simon Josefsson +- . +- +- * pubkey.c (gcry_pk_list): New function. +- * md.c (gcry_md_list): New function. +- +- * ac.c (gcry_ac_key_pair_generate): Fix calculation of format +- string size. +- +-2003-07-05 Moritz Schulte +- +- * md.c: Named struct of digest_table `digest_table_entry'. +- (digest_table_entry): New member: algorithm; filled in. +- (digest_table_entry): Removed unused member: flags. +- (gcry_md_register): New argument: algorithm_id, filled in. +- (gcry_md_register_default): Used algorithm ID from module +- structure. +- (gcry_md_map_name): Likewise. +- (md_enable): Likewise. +- (md_read): Likewise. +- (gcry_md_info): Likewise. +- +- * pubkey.c: Named truct for pubkey_table `pubkey_table_entry'. +- (pubkey_table_entry): New member: algorithm; filled in. +- (gcry_pk_register_default): Used algorithm ID from pubkey_table. +- (gcry_pk_register): New argument: algorithm_id, filled in. +- (gcry_pk_map_name): Used algorithm ID from module structure. +- (gcry_pk_decrypt): Likewise. +- (gcry_pk_encrypt): Likewise. +- (gcry_pk_verify): Likewise. +- (gcry_pk_sign): Likewise. +- (gcry_pk_testkey): Likewise. +- (gcry_pk_genkey): Likewise. +- (gcry_pk_get_nbits): Likewise. +- (sexp_to_key): Removed unused variable: algo. +- (sexp_to_sig): Likewise. +- +- * cipher.c: Named struct for cipher_table `cipher_table_entry'. +- (cipher_table_entry): New member: algorithm; filled in. +- (gcry_cipher_register_default): Used algorithm ID from +- cipher_table. +- (gcry_cipher_register): New argument: algorithm_id, filled in. +- (gcry_cipher_map_name): Used algorithm ID from module structure. +- +- * arcfour.c (cipher_spec_arcfour): Removed algorithm ID. +- * blowfish.c (cipher_spec_blowfish): Likewise. +- * cast5.c (cipher_spec_cast5): Likewise. +- * crc.c (digest_spec_crc32): Likewise. +- * crc.c (digest_spec_crc32_rfc1510): Likewise. +- * crc.c (digest_spec_crc32_rfc2440): Likewise. +- * des.c (cipher_spec_des): Likewise. +- * des.c (cipher_spec_tripledes): Likewise. +- * dsa.c (pubkey_spec_dsa): Likewise. +- * elgamal.c (pubkey_spec_elg): Likewise. +- * md4.c (digest_spec_md4): Likewise. +- * md5.c (digest_spec_md5): Likewise. +- * aes.c (cipher_spec_aes): Likewise. +- * aes.c (cipher_spec_aes192): Likewise. +- * aes.c (cipher_spec_aes256): Likewise. +- * rsa.c (pubkey_spec_rsa): Likewise. +- * sha1.c (digest_spec_sha1): Likewise. +- * sha256.c (digest_spec_sha256): Likewise. +- * sha512.c (digest_spec_sha512): Likewise. +- * tiger.c (digest_spec_tiger): Likewise. +- * twofish.c (cipher_spec_twofish): Likewise. +- * twofish.c (cipher_spec_twofish128): Likewise. +- +- * Makefile.am (EXTRA_libcipher_la_SOURCES): Fix list of source +- files; reported by Simon Josefsson . +- +- * pubkey.c: Replaced all occurences of `id' with `algorithm', +- since `id' is a keyword in obj-c. +- * md.c: Likewise. +- * cipher.c: Likewise. +- +- * crc.c, md4.c, md5.c, rmd160.c, sha1.c, sha256.c, tiger.c: +- Replaced all occurences of gcry_digest_spec_t with gcry_md_spec_t. +- +- * dsa.c, rsa.c, elgamal.c: Replaced all occurencens of +- gcry_pubkey_spec_t with gcry_pk_spec_t. +- +- * md.c: Replaced all occurences of gcry_digest_spec_t with +- gcry_md_spec_t. +- (gcry_digest_register_default): Renamed to ... +- (gcry_md_register_default): ... this; adjusted callers. +- (gcry_digest_lookup_func_name): Renamed to ... +- (gcry_md_lookup_func_name): ... this; adjusted callers. +- (gcry_digest_lookup_name): Renamed to ... +- (gcry_md_lookup_name): ... this; adjusted callers. +- (gcry_digest_register): Renamed to ... +- (gcry_md_register): ... this. +- (gcry_digest_unregister): Renamed to ... +- (gcry_md_unregister): ... this. +- +- * pubkey.c (gcry_pubkey_register): Renamed to ... +- (gcry_pk_register): ... this. +- (gcry_pubkey_unregister): Renamed to ... +- (gcry_pk_unregister): ... this. +- Replaced all occurences of gcry_pubkey_spec_t with gcry_pk_spec_t. +- (gcry_pubkey_register_default): Renamed to ... +- (gcry_pk_register_default): ... this; adjusted callers. +- (gcry_pubkey_lookup_func_name): Renamed to ... +- (gcry_pk_lookup_func_name): ... this; adjusted callers. +- (gcry_pubkey_lookup_name): Renamed to ... +- (gcry_pk_lookup_name): ... this; adjusted callers. +- +- * md.c (gcry_md_hash_buffer): Fix error checking. Thanks to Simon +- Josefsson . +- +-2003-07-04 Moritz Schulte +- +- * cipher.c (gcry_cipher_list): New function. +- +-2003-07-01 Moritz Schulte +- +- * pubkey.c (sexp_to_sig): Accept a `flags' S-expression to be more +- consistent with sexp_to_enc. +- +-2003-06-30 Moritz Schulte +- +- * Makefile.am (libcipher_la_SOURCES): Added: ac.c. +- +- * pubkey.c (_gcry_pk_module_lookup): New function. +- (_gcry_pk_module_release): New function. +- +-2003-06-29 Moritz Schulte +- +- * ac.c: New file. +- +-2003-06-26 Werner Koch +- +- * md.c (gcry_md_hash_buffer): Trigger BUG correcly with new API. +- +-2003-06-19 Werner Koch +- +- * md.c (gcry_md_is_enabled): Fixed. +- +-2003-06-18 Werner Koch +- +- * cipher.c (gcry_cipher_get_algo_keylen): New. +- (gcry_cipher_get_algo_blklen): New. +- +-2003-06-18 Moritz Schulte +- +- * arcfour.c, cipher.c, blowfish.c, md.c, cast5.c, pubkey.c, crc.c, +- des.c, dsa.c, elgamal.c, md4.c, md5.c, random.c, rijndael.c, +- rmd160.c, rsa.c, sha1.c, sha256.c, sha512.c, tiger.c, twofish.c: +- Replaced older types GcryDigestSpec, GcryCipherSpec and +- GcryPubkeySpec with newer types: gcry_digest_spec_t, +- gcry_cipher_spec_t and gcry_pubkey_spec_t. +- +- * md.c (gcry_digest_id_new): Removed function. +- (gcry_digest_register): Removed code for generating a new module +- ID. +- +- * pubkey.c (gcry_pubkey_id_new): Removed function. +- (gcry_pubkey_register): Removed code for generating a new module +- ID. +- +- * cipher.c, md.c, pubkey.c: Replace old type GcryModule with newer +- one: gcry_module_t. +- (gcry_cipher_id_new): Removed function. +- (gcry_cipher_register): Removed code for generating a new module +- ID. +- +- * cipher.c (gcry_cipher_register): Adjust call to +- _gcry_module_add. +- (gcry_cipher_register_default): Likewise. +- * pubkey.c (gcry_pubkey_register_default): Likewise. +- (gcry_pubkey_register): Likewise. +- * md.c (gcry_digest_register_default): Likewise. +- (gcry_digest_register): Likewise. +- +- * md.c (gcry_digest_lookup_func_id): Removed function. +- (gcry_digest_lookup_id): Likewise. +- (gcry_digest_id_new): Use _gcry_module_lookup_id instead of +- gcry_digest_lookup_id. +- (digest_algo_to_string): Likewise. +- (check_digest_algo): Likewise. +- (md_enable): Likewise. +- (md_digest_length): Likewise. +- (md_asn_oid): Likewise. +- +- * pubkey.c (gcry_pubkey_lookup_id): Removed function. +- (gcry_pubkey_lookup_func_id): Likewise. +- (gcry_pubkey_id_new): Use _gcry_module_lookup_id instead of +- gcry_pubkey_id_new. +- (gcry_pk_algo_name): Likewise. +- (disable_pubkey_algo): Likewise. +- (check_pubkey_algo): Likewise. +- (pubkey_get_npkey): Likewise. +- (pubkey_get_nskey): Likewise. +- (pubkey_get_nsig): Likewise. +- (pubkey_get_nenc): Likewise. +- (pubkey_generate): Likewise. +- (pubkey_check_secret_key): Likewise. +- (pubkey_encrypt): Likewise. +- (pubkey_decrypt): Likewise. +- (pubkey_sign): Likewise. +- (pubkey_verify): Likewise. +- (gcry_pk_algo_info): Likewise. +- +- * cipher.c (gcry_cipher_lookup_func_id): Removed function. +- (gcry_cipher_lookup_id): Likewise. +- (cipher_algo_to_string): use _gcry_module_lookup_id instead of +- gcry_cipher_lookup_id. +- (disable_cipher_algo): Likewise. +- (check_cipher_algo): Likewise. +- (cipher_get_blocksize): Likewise. +- (gcry_cipher_open): Likewise. +- (gcry_cipher_id_new): Likewise. +- +-2003-06-17 Moritz Schulte +- +- * Makefile.am (GCRYPT_MODULES): Set to @GCRYPT_CIPHERS@, +- @GCRYPT_PUBKEY_CIPHERS@, @GCRYPT_DIGESTS@ and @GCRYPT_RANDOM@. +- (libcipher_la_DEPENDENCIES): Set to $(GCRYPT_MODULES). +- (libcipher_la_LIBADD): Likewise. +- (AM_CFLAGS): Added: @GPG_ERROR_CFLAGS@. +- (EXTRA_libcipher_la_SOURCES): Added all conditional sources. +- +- * md.c (md_open): Use _gcry_fast_random_poll instead of +- fast_random_poll. +- * cipher.c (gcry_cipher_open): Likewise. +- +- * random.h (fast_random_poll): Removed macro. +- +- * blowfish.c, md4.c, md5.c, rmd160.c, sha1.c, sha256.c, sha512.c, +- tiger.c: Use Autoconf's WORDS_BIGENDIAN instead of our own +- BIG_ENDIAN_HOST. +- +-2003-06-16 Moritz Schulte +- +- * random.c (getfnc_gather_random): Do not special-case +- USE_ALL_RANDOM_MODULES, make it the default. +- +- * dsa.c: Replace last occurences of old type names with newer +- names (i.e. replace MPI with gcry_mpi_t). +- * elgamal.c: Likewise. +- * primegen.c: Likewise. +- * pubkey.c: Likewise. +- * rsa.c: Likewise. +- +-2003-06-14 Moritz Schulte +- +- * des.c (des_setkey): Add selftest check. +- (tripledes_set3keys): Likewise. +- (do_tripledes_setkey): Remove selftest check. +- (do_des_setkey): Likewise. +- +-2003-06-11 Moritz Schulte +- +- * md.c (_gcry_md_init): New function. +- * cipher.c (_gcry_cipher_init): New function. +- * pubkey.c (_gcry_pk_init): New function. +- +-2003-06-13 Werner Koch +- +- * md.c (gcry_md_get_algo): Reverted to old API. This is a +- convenience function anyway and error checking is not approriate. +- (gcry_md_is_secure): New. +- (gcry_md_is_enabled): New. +- +-2003-06-12 Werner Koch +- +- * cipher.c (gcry_cipher_open): Make sure HANDLE is set to NULL on +- error. +- +-2003-06-11 Werner Koch +- +- * md.c (gcry_md_open): Make sure H receives either NULL or an +- valid handle. +- (gcry_md_copy): Swapped arguments so that it is more in lione with +- md_open and most other API fucntions like memcpy (destination +- comes first). Make sure HANDLE is set to NULL on error. +- +- * rijndael.c (do_encrypt): Hack to force correct alignment. It +- seems not to be not sufficient, though. We should rework this +- fucntions and remove all these ugly casts. Let the compiler +- optimize or have an assembler implementation. +- +-2003-06-09 Moritz Schulte +- +- * Makefile.am: Removed rules serpent, since that is not commited +- yet. +- +-2003-06-08 Moritz Schulte +- +- * pubkey.c (gcry_pk_encrypt): Improve calculation for size of the +- format string. +- +-2003-06-07 Moritz Schulte +- +- * arcfour.c, bithelp.h, blowfish.c, cast5.c, cipher.c, crc.c, +- des.c, dsa.c, elgamal.c, md4.c, md5.c, md.c, primegen.c, pubkey.c, +- rand-internal.h, random.c, random.h, rijndael.c, rmd160.c, +- rmd160test.c, rmd.h, rndeged.c, rndlinux.c, rndunix.c, rndw32.c, +- rsa.c, sha1.c, sha256.c, sha512.c, tiger.c, twofish.c: Edited all +- preprocessor instructions to remove whitespace before the '#'. +- This is not required by C89, but there are some compilers out +- there that don't like it. Replaced any occurence of the now +- deprecated type names with the new ones. +- +-2003-06-04 Moritz Schulte +- +- * pubkey.c (gcry_pk_encrypt): Construct an arg_list and use +- gcry_sexp_build_array instead of gcry_sexp_build. +- (gcry_pk_sign): Likewise. +- (gcry_pk_genkey): Likewise. +- +-2003-06-01 Moritz Schulte +- +- * dsa.c (_gcry_dsa_generate): Do not check wether the algorithm ID +- does indeed belong to DSA. +- (_gcry_dsa_sign): Likewise. +- (_gcry_dsa_verify): Likewise. +- (_gcry_dsa_get_nbits): Likewise. +- +- * elgamal.c (_gcry_elg_check_secret_key): Do not check wether the +- algorithm ID does indeed belong to ElGamal. +- (_gcry_elg_encrypt): Likewise. +- (_gcry_elg_decrypt): Likewise. +- (_gcry_elg_sign): Likewise. +- (_gcry_elg_verify): Likewise. +- (_gcry_elg_get_nbits): Likewise. +- (_gcry_elg_generate): Likewise. +- +- * rsa.c (_gcry_rsa_generate): Do not check wether the algorithm ID +- does indeed belong to RSA. +- (_gcry_rsa_encrypt): Likewise. +- (_gcry_rsa_decrypt): Likewise. +- (_gcry_rsa_sign): Likewise. +- (_gcry_rsa_verify): Likewise. +- (_gcry_rsa_get_nbits): Likewise. +- +-2003-05-30 Moritz Schulte +- +- * md.c (md_get_algo): Return zero in case to algorithm is enabled. +- +- * md.c (gcry_md_info): Adjusted for new no-errno-API. +- (md_final): Likewise. +- (gcry_md_get_algo): Likewise. +- * pubkey.c (gcry_pk_get_keygrip): Likewise. +- (gcry_pk_ctl): Likewise. +- (gcry_pk_algo_info): Likewise. +- * des.c (selftest): Likewise. +- +-2003-05-29 Moritz Schulte +- +- * md.c (md_enable): Do not forget to release module on error. +- (gcry_md_open): Adjusted for new no-errno-API. +- (md_open): Likewise. +- (md_copy): Likewise. +- (gcry_md_copy): Likewise. +- (gcry_md_setkey): Likewise. +- (gcry_md_algo_info): Likewise. +- +- * cipher.c (gcry_cipher_open): Adjusted for new no-errno-API and +- also fixed a locking bug. +- (gcry_cipher_encrypt): Adjusted for new no-errno-API. +- (gcry_cipher_decrypt): Likewise. +- (gcry_cipher_ctl): Likewise. +- (gcry_cipher_info): Likewise. +- (gcry_cipher_algo_info): Likewise. +- +-2003-05-28 Moritz Schulte +- +- * md.c (md_enable): Adjusted for libgpg-error. +- (gcry_md_enable): Likewise. +- (gcry_digest_register_default): Likewise. +- (gcry_digest_register): Likewise. +- (check_digest_algo): Likewise. +- (prepare_macpads): Likewise. +- (gcry_md_setkey): Likewise. +- (gcry_md_ctl): Likewise. +- (gcry_md_get): Likewise. +- (gcry_md_algo_info): Likewise. +- (gcry_md_info): Likewise. +- * dsa.c (_gcry_dsa_generate): Likewise. +- (_gcry_dsa_check_secret_key): Likewise. +- (_gcry_dsa_sign): Likewie. +- (_gcry_dsa_verify): Likewise. +- * twofish.c (do_twofish_setkey): Likewise. +- (twofish_setkey): Likewise. +- * cipher.c (gcry_cipher_register): Likewise. +- +-2003-05-25 Moritz Schulte +- +- * rijndael.c (do_setkey): Adjusted for libgpg-error. +- (rijndael_setkey): Likewise. +- * random.c (gcry_random_add_bytes): Likewise. +- * elgamal.c (_gcry_elg_generate): Likewise. +- (_gcry_elg_check_secret_key): Likewise. +- (_gcry_elg_encrypt): Likewise. +- (_gcry_elg_decrypt): Likewise. +- (_gcry_elg_sign): Likewise. +- (_gcry_elg_verify): Likewise. +- * rsa.c (_gcry_rsa_generate): Likewise. +- (_gcry_rsa_check_secret_key): Likewise. +- (_gcry_rsa_encrypt): Likewise. +- (_gcry_rsa_decrypt): Likewise. +- (_gcry_rsa_sign): Likewise. +- (_gcry_rsa_verify): Likewise. +- * pubkey.c (dummy_generate, dummy_check_secret_key, dummy_encrypt, +- dummy_decrypt, dummy_sign, dummy_verify): Likewise. +- (gcry_pubkey_register): Likewise. +- (check_pubkey_algo): Likewise. +- (pubkey_generate): Likewise. +- (pubkey_check_secret_key): Likewise. +- (pubkey_encrypt): Likewise. +- (pubkey_decrypt): Likewise. +- (pubkey_sign): Likewise. +- (pubkey_verify): Likewise. +- (sexp_elements_extract): Likewise. +- (sexp_to_key): Likewise. +- (sexp_to_sig): Likewise. +- (sexp_to_enc): Likewise. +- (sexp_data_to_mpi): Likewise. +- (gcry_pk_encrypt): Likewise. +- (gcry_pk_decrypt): Likewise. +- (gcry_pk_sign): Likewise. +- (gcry_pk_verify): Likewise. +- (gcry_pk_testkey): Likewise. +- (gcry_pk_genkey): Likewise. +- (gcry_pk_ctl): Likewise. +- * cipher.c (dummy_setkey): Likewise. +- (check_cipher_algo): Likewise. +- (gcry_cipher_open): Likewise. +- (cipher_setkey): Likewise. +- (gcry_cipher_ctl): Likewise. +- (cipher_encrypt): Likewise. +- (gcry_cipher_encrypt): Likewise. +- (cipher_decrypt): Likewise. +- (gcry_cipher_decrypt): Likewise. +- (gcry_cipher_info): Likewise. +- (gcry_cipher_algo_info): Likewise. +- * cast5.c (cast_setkey): Likewise. +- (do_cast_setkey): Likewise. +- * arcfour.c (arcfour_setkey): Likewise. +- (do_arcfour_setkey): Likewise. +- * blowfish.c (do_bf_setkey): Likewise. +- (bf_setkey): Likewise. +- * des.c (do_des_setkey): Likewise. +- (do_tripledes_setkey): Likewise. +- +-2003-05-22 Moritz Schulte +- +- * tiger.c: Merged code ussing the U64_C macro from GnuPG. +- +- * sha512.c: Likewise. +- +-2003-05-17 Moritz Schulte +- +- * pubkey.c (gcry_pk_genkey): Fix type: acquire a lock, instead of +- releasing it. +- +-2003-05-11 Moritz Schulte +- +- * pubkey.c (gcry_pk_testkey): Call REGISTER_DEFAULT_CIPHERS. +- (gcry_pk_ctl): Likewise. +- +-2003-04-27 Moritz Schulte +- +- * pubkey.c (gcry_pk_genkey): Release sexp after extracted data has +- been used. +- +- * md.c (gcry_md_get_algo_dlen): Simplified, simply call +- md_digest_length to do the job. +- +- * des.c (do_des_setkey): Check for selftest failure not only +- during initialization. +- (do_tripledes_setkey): Include check for selftest failure. +- +- * pubkey.c (gcry_pubkey_register_default): New macro +- `pubkey_use_dummy', use it. +- +- * elgamal.c (elg_names): New variable. +- (pubkey_spec_elg): Include elg_names. +- +- * dsa.c (dsa_names): New variable. +- (pubkey_spec_dsa): Include dsa_names. +- +- * rsa.c (rsa_names): New variable. +- (pubkey_spec_rsa): Include rsa_names. +- +- * pubkey.c (gcry_pubkey_lookup_func_name): Compare name also with +- the names listed in `sexp_names'. +- +-2003-04-24 Moritz Schulte +- +- * pubkey.c (sexp_to_key): New variables: module, pubkey. Adjusted +- to new module interface. +- (sexp_to_key): Changend type of argument `retalgo' from `int *' to +- `GcryModule **'. Adjusted all callers. Removed argument: +- r_algotblidx. +- (sexp_to_sig): Changend type of argument `retalgo' from `int *' to +- `GcryModule **'. Adjusted all callers. +- (sexp_to_enc): Likewise. +- +- (pubkey_get_npkey, pubkey_get_nskey, pubkey_get_nsig, +- pubkey_get_nenc): Use strlen to find out the number. +- +- * rsa.c: Adjust pubkey_spec_rsa to new internal interface. +- * dsa.c: Likewise. +- * elgamal.c: Likewise. +- +-2003-04-17 Moritz Schulte +- +- * pubkey.c (sexp_elements_extract): New function. +- * pubkey.c (sexp_to_key): Removed variable `idx', added `err', use +- sexp_elements_extract. +- (sexp_to_sig): Likewise. +- (sexp_to_enc): Likewise. +- +- * pubkey.c: Terminate list correctly. +- * md.c: Include sha512/sha384 in digest_table. +- +-2003-04-16 Moritz Schulte +- +- * Makefile.am: Include support for sha512.c. +- +- * sha512.c: New file, merged from GnuPG, with few modifications +- for libgcrypt. +- +- * rand-internal.h: Removed declarations for constructor functions. +- +- * md.c (md_copy): Call _gcry_module_use for incrementing the usage +- counter of the digest modules. +- +- * rsa.c: Do not include "rsa.h". +- * dsa.c: Do not include "dsa.h". +- * elgamal.c: Do not include "elgamal.h". +- * des.c: Do not include "des.h". +- * cast5.c: Do not include "cast5.h". +- * blowfish.c: Do not include "blowfish.h". +- * arcfour.c: Do not include "arcfour.h". +- +- * Makefile.am (libcipher_la_DEPENDENCIES): Removed. +- (libcipher_la_LIBADD): Removed. +- Use Automake conditionals for conditional compilation. +- +-2003-04-13 Moritz Schulte +- +- * cipher.c (gcry_cipher_open): Call REGISTER_DEFAULT_CIPHERS. +- +- * md.c (gcry_md_list): New member: module. +- (md_enable): New variable: module, changed use of module and +- digest. +- (md_enable): Initialize member: module. +- (md_close): Call _gcry_module_release. +- +- * cipher.c (gcry_cipher_open): New variable: module, changed use of +- module and cipher. +- (struct gcry_cipher_handle): New member: module. +- (gcry_cipher_open): Initialize member: module. +- (gcry_cipher_close): Call _gcry_module_release. +- +-2003-04-09 Moritz Schulte +- +- * cipher.c: Include "ath.h". +- * md.c: Likewise. +- * pubkey.c: Likewise. +- +- * cipher.c (ciphers_registered_lock): New variable. +- * md.c (digests_registered_lock): New variable. +- * pubkey.c (pubkeys_registered_lock): New variable. +- +- * rndlinux.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_rndlinux_constructor): Removed function. +- +- * rndegd.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_rndegd_constructor): Removed function. +- +- * rndunix.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_rndunix_constructor): Removed function. +- +- * rndw32.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_rndw32_constructor): Removed function. +- +- * rndegd.c (rndegd_connect_socket): Simplify code for creating the +- egd socket address. +- (rndegd_connect_socket): Call log_fatal use instead of +- g10_log_fatal. +- (egd_gather_random): Renamed to ... +- (rndegd_gather_random): ... here. +- +-2003-04-08 Moritz Schulte +- +- * rndlinux.c: Do not include "dynload.h". +- * rndunix.c: Likewise. +- * rndw32.c: Likewise. +- +- * rndegd.c (rndegd_connect_socket): Factored out from ... +- (egd_gather_random): here; call it. +- (egd_socket): New variable. +- (egd_gather_random): Initialize fd with egd_socket, do not declare +- fd static. +- (do_read): Merged few changes from GnuPG. FIXME - not finished? +- Do not include "dynload.h". +- +- * rndw32.c (gather_random): Renamed to rndw32_gather_random, do +- not declare static. +- (gather_random_fast): Renamed to rndw32_gather_random_fast, do not +- declare static. +- +- * rndunix.c (gather_random): Renamed to rndunix_gather_random, do +- not declare static. +- * rndegd.c (gather_random): Renamed to rndegd_gather_random, do +- not declare static. +- * rndlinux.c (gather_random): Renamed to rndlinux_gather_random, +- do not declare static. +- +-2003-04-07 Moritz Schulte +- +- * Makefile.am (libcipher_la_SOURCES): Removed construct.c. +- (libcipher_la_SOURCES): Added sha1.c, sha256.c, rmd160.c, md4.c, +- md5.c, tiger.c and crc.c +- (EXTRA_PROGRAMS): Removed sha1, sha256, rmd160, md4, md5, tiger +- and crc. Removed definitions: EXTRA_md4_SOURCES, +- EXTRA_md5_SOURCES, EXTRA_rmd160_SOURCES, EXTRA_sha1_SOURCES, +- EXTRA_sha256_SOURCES, EXTRA_tiger_SOURCES and EXTRA_crc_SOURCES, +- BUILT_SOURCES, DISTCLEANFILES. +- +- * pubkey.c: Do not include "elgamal.h", "dsa.h" and "rsa.h". +- +- * Makefile.am (libcipher_la_SOURCES): Removed rsa.h, elgamal.h, +- dsa.h, des.h, cast5.h, arcfour.h and blowfish.h. +- +- * rsa.h: Removed file. +- * elgamal.h: Removed file. +- * dsa.h: Removed file. +- * des.h: Removed file. +- * cast5.h: Removed file. +- * arcfour.h: Removed file. +- * blowfish.h: Removed file. +- +- * Makefile.am (libcipher_la_SOURCES): Removed dynload.c and +- dynload.h. +- +- * rsa.c (pubkey_spec_rsa): New variable. +- * dsa.c (pubkey_spec_rsa): New variable. +- * elgamal.c (pubkey_spec_elg): New variable. +- +- * rsa.c (_gcry_rsa_get_info): Removed function. +- * elgamal.c (_gcry_elg_get_info): Removed function. +- * dsa.c (_gcry_dsa_get_info): Removed function. +- +- * tiger.c (tiger_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_tiger_constructor): Removed function. +- +- * sha1.c (sha1_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_sha1_constructor): Removed function. +- +- * sha256.c (sha256_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_sha256_constructor): Removed function. +- +- * rmd160.c (rmd160_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_rmd160_constructor): Removed function. +- +- * md5.c (md5_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_md5_constructor): Removed function. +- +- * md4.c (md4_get_info): Removed function. +- (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func): Removed function. +- (_gcry_md4_constructor): Removed function. +- +- * crc.c (crc_get_info): Removed function. +- +- * arcfour.c (do_arcfour_setkey): Changed type of context argument +- to `void *', added local variable for cast, adjusted callers. +- (arcfour_setkey): Likewise. +- (encrypt_stream): Likewise. +- * cast5.c (cast_setkey): Likewise. +- (encrypt_block): Likewise. +- * rijndael.c (rijndael_setkey): Likewise. +- (rijndael_encrypt): Likewise. +- (rijndael_decrypt): Likewise. +- * twofish.c (twofish_setkey): Likewise. +- (twofish_encrypt): Likewise. +- (twofish_decrypt): Likewise. +- * des.c (do_des_setkey): Likewise. +- (do_des_encrypt): Likewise. +- (do_des_encrypt): Likewise. +- (do_tripledes_encrypt): Likewise. +- (do_tripledes_encrypt): Likewise. +- * blowfish.c (bf_setkey: Likewise. +- (encrypt_block): Likewise. +- (decrypt_block): Likewise. +- +- * arcfour.c (encrypt_stream): Likewise. +- +- * rijndael.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func) Removed function. +- +- * twofish.c (gnupgext_version, func_table): Removed definitions. +- (gnupgext_enum_func) Removed function. +- +- * cast5.c (CIPHER_ALGO_CAST5): Removed. +- +- * blowfish.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Removed macros. +- (CIPHER_ALGO_BLOWFISH): Removed symbol. +- * cast5.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Likewise. +- * des.c (selftest_failed): Removed. +- (initialized): New variable. +- (do_des_setkey): Run selftest, if not yet done. +- (FNCCAST_SETKEY, FNCCAST_CRYPT): Removed macros. +- +- * arcfour.c (_gcry_arcfour_get_info): Removed function. +- * blowfish.c (_gcry_blowfish_get_info): Removed function. +- * cast5.c (_gcry_cast5_get_info): Removed function. +- * des.c (_gcry_des_get_info): Removed function. +- * rijndael.c (_gcry_rijndael_get_info): Removed function. +- * twofish.c (_gcry_twofish_get_info): Removed function. +- +- * arcfour.c (cipher_spec_arcfour): New variable. +- * twofish.c (cipher_spec_twofish, cipher_spec_twofish128): New +- variables. +- * rijndael.c (cipher_spec_aes, cipher_spec_aes192, +- cipher_spec256): New variables. +- * des.c (cipher_spec_des, cipher_spec_tripledes): New variables. +- * cast5.c (cipher_spec_cast5): New variable. +- * blowfish.c (cipher_spec_blowfish): Likewise. +- +- * twofish.c: Do not include "dynload.h". +- * rijndael.c: Likewise. +- * des.c: Likewise. +- * cast5.c: Likewise. +- * blowfish.c: Likewise. +- * cipher.c: Likewise. +- * crc.c: Likewise. +- * md4.c: Likewise. +- * md5.c: Likewise. +- * md.c: Likewise. +- * pubkey.c: Likewise. +- * rijndael.c: Likewise. +- * sha1.c: Likewise. +- * sha256.c: Likewise. +- +- * arcfour.c: Include "cipher.h". +- * twofish.c: Likewise. +- * rijndael.c: Likewise. +- * des.c: Likewise. +- * cast5.c: Likewise. +- * blowfish.c: Likewise. +- +- * twofish.c (twofish_setkey): Declared argument `key' const. +- (twofish_encrypt): Declared argument `inbuf' const. +- (twofish_decrypt): Likewise. +- +- * rijndael.c (rijndael_setkey): Declared argument `key' const. +- (rijndael_encrypt): Declared argument `inbuf' const. +- (rijndael_decrypt): Likewise. +- +- * des.c (do_des_setkey): Declared argument `key' const. +- (do_tripledes_setkey): Likewise. +- (do_des_encrypt): Declared argument `inbuf' const. +- (do_des_decrypt): Likewise. +- (do_tripledes_encrypt): Likewise. +- (do_tripledes_decrypt): Likewise. +- +- * cast5.c (encrypt_block): Declared argument `inbuf' const. +- (decrypt_block): Likewise. +- (cast_setkey): Declared argument `key' const. +- +- * blowfish.c (do_bf_setkey): Declared argument `key' const. +- (encrypt_block): Declared argument `inbuf' const. +- (encrypt_block): Likewise. +- +- +- +- * cipher.c: Remove CIPHER_ALGO_DUMMY related code. +- Removed struct cipher_table_s. +- Changed definition of cipher_table. +- Removed definition of disabled_algos. +- (ciphers_registered, default_ciphers_registered): New variables. +- (REGISTER_DEFAULT_CIPHERS): New macro. +- (dummy_setkey): Declared argument `key' const. +- (dummy_encrypt_block): Declared argument `inbuf' const. +- (dummy_encrypt_block): Likewise. +- (dummy_encrypt_stream): Likewise. +- (dummy_encrypt_stream): Likewise. +- (dummy_setkey): Use `unsigned char' instead of `byte'. +- (dummy_encrypt_block): Likewise. +- (dummy_decrypt_block): Likewise. +- (dummy_encrypt_stream): Likewise. +- (dummy_decrypt_stream): Likewise. +- (gcry_cipher_register_default): New function. +- (gcry_cipher_lookup_func_id): New function. +- (gcry_cipher_lookup_func_name): New function. +- (gcry_cipher_lookup_id): New function. +- (gcry_cipher_lookup_name): New function. +- (gcry_cipher_id_new): New function. +- (gcry_cipher_register): New function. +- (gcry_cipher_unregister): New function. +- (setup_cipher_table): Removed function. +- (load_cipher_modules): Removed function. +- (gcry_cipher_map_name): Adjusted to use new module management. +- (cipher_algo_to_string): Likewise. +- (disable_cipher_algo): Likewise. +- (check_cipher_algo): Likewise. +- (cipher_get_keylen): Likewise. +- (cipher_get_blocksize): Likewise. +- (gcry_cipher_open): Likewise. +- (struct gcry_cipher_handle): Replaced members algo, algo_index, +- blocksize, setkey, encrypt, decrypt, stencrypt, stdecrypt with one +- member: cipher. +- (gcry_cipher_open): Adjusted code for new handle structure. +- (cipher_setkey): Likewise. +- (cipher_setiv): Likewise. +- (cipher_reset): Likewise. +- (do_ecb_encrypt): Likewise. +- (do_ecb_decrypt): Likewise. +- (do_cbc_encrypt): Likewise. +- (do_cbc_decrypt): Likewise. +- (do_cfb_encrypt): Likewise. +- (do_cfb_decrypt): Likewise. +- (do_ctr_encrypt): Likewise. +- (cipher_encrypt): Likewise. +- (gcry_cipher_encrypt): Likewise. +- (cipher_decrypt): Likewise. +- (gcry_cipher_decrypt): Likewise. +- (cipher_sync): Likewise. +- (gcry_cipher_ctl): Likewise. +- +- * pubkey.c: Removed struct pubkey_table_s. +- Changed definition of pubkey_table. +- Removed definition of disabled_algos. +- (pubkeys_registered, default_pubkeys_registered): New variables. +- (REGISTER_DEFAULT_PUBKEYS): New macro. +- (setup_pubkey_table): Removed function. +- (load_pubkey_modules): Removed function. +- (gcry_pubkey_register_default): New function. +- (gcry_pubkey_lookup_func_id): New function. +- (gcry_pubkey_lookup_func_name): New function. +- (gcry_pubkey_lookup_id): New function. +- (gcry_pubkey_lookup_name): New function. +- (gcry_pubkey_id_new): New function. +- (gcry_pubkey_register): New function. +- (gcry_pubkey_unregister): New function. +- (gcry_pk_map_name): Adjusted to use new module management. +- (gcry_pk_algo_name): Likewise. +- (disable_pubkey_algo): Likewise. +- (check_pubkey_algo): Likewise. +- (pubkey_get_npkey): Likewise. +- (pubkey_get_nskey): Likewise. +- (pubkey_get_nsig): Likewise. +- (pubkey_get_nenc): Likewise. +- (pubkey_generate): Likewise. +- (pubkey_check_secret_key): Likewise. +- (pubkey_encrypt): Likewise. +- (pubkey_decrypt): Likewise. +- (pubkey_sign): Likewise. +- (pubkey_verify): Likewise. +- (gcry_pk_get_nbits): Likewise. +- (gcry_pk_algo_info): Likewise. +- +- * md.c: Removed struct md_digest_list_s. +- (digest_list): Changed definition. +- (digests_registered, default_digests_registered): New variables. +- (REGISTER_DEFAULT_DIGESTS): New macro. +- (new_list_item): Removed function. +- (setup_md_table): Removed function. +- (load_digest_module): Removed function. +- (gcry_digest_register_default): New function. +- (gcry_digest_lookup_func_id): New function. +- (gcry_digest_lookup_func_name): New function. +- (gcry_digest_lookup_id): New function. +- (gcry_digest_lookup_name): New function. +- (gcry_digest_id_new): New function. +- (gcry_digest_register): New function. +- (gcry_digest_unregister): New function. +- (GcryDigestEntry): New type. +- (struct gcry_md_context): Adjusted type of `list'. +- (gcry_md_map_name): Adjusted to use new module management. +- (digest_algo_to_string): Likewise. +- (check_digest_algo): Likewise. +- (md_enable): Likewise. +- (md_digest_length): Likewise. +- (md_asn_oid): Likewise. +- +-2003-04-07 Moritz Schulte +- +- * pubkey.c: Replaced PUBKEY_ALGO_DSA with GCRY_PK_DSA, +- PUBKEY_ALGO_RSA with GCRY_PK_RSA and PUBKEY_ALGO_ELGAMAL with +- GCRY_PK_ELG. +- +- * dsa.c: Replaced PUBKEY_ALGO_DSA with GCRY_PK_DSA. +- +-2003-04-01 Moritz Schulte +- +- * des.c: Removed checks for GCRY_CIPHER_3DES and GCRY_CIPHER_DES. +- +-2003-03-31 Moritz Schulte +- +- * tiger.c (tiger_get_info): Do not declare static. +- * sha256.c (sha256_get_info): Likewise. +- * sha1.c (sha1_get_info): Likewise. +- * rmd160.c (rmd160_get_info): Likewise. +- * md5.c (md5_get_info): Likewise. +- * md4.c (md4_get_info): Likewise. +- * crc.c (crc_get_info): Likewise. +- +- * md.c (load_digest_module): Call setup_md_table during +- initialization. +- (new_list_item): Link new element into digest_list. +- +- * cipher.c (do_ctr_decrypt): Made do_ctr_encrypt act as a wrapper +- for do_ctr_encrypt, since these functions are identical. +- +-2003-03-30 Simon Josefsson +- +- * cipher.c (struct gcry_cipher_handle): Add counter field. +- (gcry_cipher_open): Add CTR. +- (cipher_reset): Clear counter field. +- (do_ctr_encrypt, do_ctr_decrypt): New functions. +- (cipher_encrypt, cipher_decrypt): Call CTR functions. +- (gcry_cipher_ctl): Add SET_CTR to set counter. +- +-2003-03-30 Moritz Schulte +- +- * rsa.c (_gcry_rsa_blind): New function. +- (_gcry_rsa_unblind): New function. +- (_gcry_rsa_decrypt): Use _gcry_rsa_blind and _gcry_rsa_decrypt. +- +-2003-03-26 Moritz Schulte +- +- * dynload.c (_gcry_enum_gnupgext_pubkeys): Adjust `encrypt' and +- `decrypt' function arguments. +- (_gcry_enum_gnupgext_pubkeys): Likewise. +- * dynload.h: Likewise. +- +- * pubkey.c (dummy_decrypt): Add argument: int flags. +- (dummy_encrypt): Likewise. +- +- * elgamal.c (_gcry_elg_encrypt): Add argument: int flags. +- (_gcry_elg_decrypt): Likewise. +- +- * rsa.c (_gcry_rsa_encrypt): Add argument: int flags. +- (_gcry_rsa_decrypt): Likewise. +- +- * pubkey.c: Add `flags' argument to members `encrypt' and +- `decrypt' of struct `pubkey_table_s'. +- +- * rsa.h: Add `flags' argument to function declarations. +- * elgamal.h: Likewise. +- +- * pubkey.c (sexp_data_to_mpi): New variable: int parsed_flags. +- (sexp_data_to_mpi): Set `parsed_flags'. +- (sexp_data_to_mpi): New argument: int *flags. +- (gcry_pk_encrypt): New variable: int flags. +- (gcry_pk_encrypt): Pass `flags' to pubkey_encrypt. +- (pubkey_encrypt): New variable: int flags. +- (pubkey_encrypt): Pass `flags' to pubkey encrypt function. +- (pubkey_decrypt): Likewise. +- (pubkey_decrypt): Pass `flags' to pubkey encrypt function. +- (gcry_pk_encrypt): Include `flags' s-exp in return list. +- (sexp_to_enc): New argument: int *flags. +- (gcry_pk_decrypt): New variable: int flags. +- (gcry_pk_decrypt): Pass `flags' to pubkey_decrypt. +- (sexp_to_enc): New variable: int parsed_flags. +- (sexp_to_enc): Set `parsed_flags'. +- +-2003-03-22 Simon Josefsson +- +- * cipher.c (gcry_cipher_open, do_cbc_encrypt) +- (gcry_cipher_encrypt): Support GCRY_CIPHER_CBC_MAC. +- (gcry_cipher_ctl): Support GCRYCTL_SET_CBC_MAC. +- +-2003-03-19 Werner Koch +- +- * primegen.c (gen_prime): New args EXTRA_CHECK and EXTRA_CHECK_ARG +- to allow for a user callback. Changed all callers. +- (_gcry_generate_secret_prime) +- (_gcry_generate_public_prime): Ditto, pass them to gen_prime. +- * rsa.c (check_exponent): New. +- (generate): Use a callback to ensure that a given exponent is +- actually generated. +- +-2003-03-12 Moritz Schulte +- +- * primegen.c: Initialize `no_of_small_prime_numbers' statically. +- (gen_prime): Remove calculation of `no_of_small_prime_numbers'. +- +-2003-03-03 Moritz Schulte +- +- * md.c (gcry_md_ctl): Rewritten to use same style like the other +- functions dispatchers. +- +-2003-03-02 Moritz Schulte +- +- * cipher.c (struct gcry_cipher_handle): New member: algo_index. +- (gcry_cipher_open): Allocate memory for two cipher contexts. +- Initialize algo_index. +- (cipher_setkey): Duplicate context into reserved memory. +- (cipher_reset): New function, which resets the context and clear +- the IV. +- (gcry_cipher_ctl): Call cipher_reset. +- +-2003-02-23 Moritz Schulte +- +- * cipher.c: Remove (bogus) `digitp' macro definition. +- * md.c: Likewise. +- +- * blowfish.c (burn_stack): Removed. +- * arcfour.c (burn_stack): Likewise. +- * cast5.c (burn_stack): Likewise. +- * des.c (burn_stack): Likewise. +- * md4.c (burn_stack): Likewise. +- * md5.c (burn_stack): Likewise. +- * random.c (burn_stack): Likewise. +- * rijndael.c (burn_stack): Likewise. +- * rmd160.c (burn_stack): Likewise. +- * sha1.c (burn_stack): Likewise. +- * sha256.c (burn_stack): Likewise. +- * tiger.c (burn_stack): Likewise. +- * twofish.c (burn_stack): Likewise. +- +- * blowfish.c: Changed all occurences of burn_stack to +- _gcry_burn_stack. +- * arcfour.c: Likewise. +- * cast5.c: Likewise. +- * des.c: Likewise. +- * md4.c: Likewise. +- * md5.c: Likewise. +- * random.c: Likewise. +- * rijndael.c: Likewise. +- * rmd160.c: Likewise. +- * sha1.c: Likewise. +- * sha256.c: Likewise. +- * tiger.c: Likewise. +- * twofish.c: Likewise. +- +- * arcfour.c (_gcry_arcfour_get_info): Use GCRY_CIPHER_ARCFOUR +- instead of hard-coded value `301'. +- +-2003-01-24 Werner Koch +- +- * random.c (_gcry_register_random_progress): New. +- (_gcry_random_progress): New. +- +- * rndlinux.c (gather_random): Call the random progress function. +- +-2003-01-23 Werner Koch +- +- * rsa.c (generate): New arg USE_E to request a specific public +- exponent. +- (_gcry_rsa_generate): Ditto. +- * elgamal.c (_gcry_elg_generate): Must add an dummy argument +- instead of USE_E. +- * dsa.c (_gcry_dsa_generate): Ditto. +- * pubkey.c (dummy_generate): Ditto. +- (pubkey_generate): Add USE_E arg and pass it down. +- (gcry_pk_genkey): Detect "rsa-use-e" parameter and pass it to generate. +- +- * pubkey.c (sexp_to_enc): New arg RET_MODERN. +- (gcry_pk_decrypt): Make use of it to return a real S-expression. +- Return better error codes. +- (gcry_pk_verify): Return better error codes. +- +-2003-01-21 Werner Koch +- +- * random.c (gcry_random_add_bytes): Add QUALITY argument, let +- function return an error code and disable its core for now. +- +-2003-01-21 Timo Schulz +- +- * random.c (gcry_random_add_bytes): New. Function to add external +- random to the pool. +- +-2003-01-20 Simon Josefsson +- +- * crc.c: New. +- * Makefile.am (EXTRA_PROGRAMS, EXTRA_crc_SOURCES): Add crc.c. +- * md.c (gcry_md_get_algo_dlen): Add values for CRC. +- +-2003-01-20 Werner Koch +- +- * sha256.c: New. +- * bithelp.h (ror): New. +- * Makfile.am: Add sha256.c. +- * md.c (oid_table): Add values for SHA256 et al. +- (gcry_md_get_algo_dlen): Likewise +- +-2003-01-20 Werner Koch +- +- * pubkey.c (gcry_pk_get_keygrip): Implemented keygrips for DSA +- and ElGamal. +- +-2003-01-17 Werner Koch +- +- * cipher.c (gcry_cipher_encrypt): Reworked so that the output will +- never contain the plaintext even if the caller did not checked the +- return value. +- +- * md.c (gcry_md_get_algo): Changed error code to GCRYERR_GENERAL +- because we don't have an invalid md algo but no algorithm enabled. +- +- * pubkey.c (gcry_pk_genkey): Changed error code for bounds check +- of table parameters to GCRYERR_INTERNAL. +- +- * md.c (gcry_md_open): Partly reverted Timo's change from +- 2002-10-10 by removing the check for the algorithm. An algorithm +- of 0 is allowed and anyway we should not double check it or check +- it using a different function. Also fixed the flags check. +- +- * pubkey.c (gcry_pk_encrypt): Make sure that R_CIPH points to NULL +- on error. +- (gcry_pk_decrypt): Ditto for R_PLAIN. +- (gcry_pk_sign): Ditto for R_SIG. +- (gcry_pk_genkey): Ditto for R_KEY. +- +-2003-01-16 Werner Koch +- +- * md.c (gcry_md_write): Changed 2nd argument type to void*. +- (gcry_md_hash_buffer): Changed type of boths buffers to void*. +- (gcry_md_setkey): Changed 2nd argument type to void*. +- +-2003-01-15 Werner Koch +- +- * pubkey.c (sexp_data_to_mpi): New. This handles pkcs1 padding. +- (gcry_pk_sign, gcry_pk_verify): Use it here. +- (gcry_pk_encrypt): And here. +- (pubkey_verify): Add debug code. +- (sexp_to_enc): Handle flags in the input and return the pkcs1 flag +- in a new parameter. +- (gcry_pk_decrypt): Prepare for future pkcs1 handling. +- +-2002-12-19 Werner Koch +- +- * random.c (_gcry_random_initialize): New. +- +-2002-12-16 Werner Koch +- +- * cipher.c: Added a Teletrust specific OID for 3DES. +- +-2002-12-12 Werner Koch +- +- * md.c: Added another oddball OIW OID (sha-1WithRSAEncryption). +- +-2002-11-23 Werner Koch +- +- * md.c (load_digest_module): Enlarged checked_algos bitmap. +- * md4.c (func_table): Fixed entry for md4. +- Both by Simon Josephson. +- (transform): Copy data to get the alignment straight. Tested only +- on i386. +- +-2002-11-10 Simon Josefsson +- +- * cipher.c (gcry_cipher_open): Don't reject CTS flag. +- (do_cbc_encrypt, do_cbc_decrypt, cipher_encrypt) +- (gcry_cipher_encrypt, cipher_decrypt) +- (gcry_cipher_decrypt): Support CTS flag. +- (gcry_cipher_ctl): Toggle CTS flag. +- +-2002-11-10 Werner Koch +- +- * md4.c: New. By Simon Josefsson. +- * Makefile.am (EXTRA_PROGRAMS): Add md4.c. +- * md.c (oid_table,gcry_md_get_algo_dlen): MD4 support. +- +-2002-10-14 Werner Koch +- +- * arcfour.c (do_encrypt_stream): Don't use increment op when +- assigning to the same variable. +- +-2002-10-10 Timo Schulz +- +- * pubkey.c (gcry_pk_genkey): Check boundaries. +- +- * md.c (gcry_md_open): Check that algo is available and only +- valid flag values are used. +- (gcry_md_get_algo): Add error handling. +- +-2002-09-26 Werner Koch +- +- * md.c: Include an OID for TIGER. +- * tiger.c (tiger_get_info): Use a regular OID. +- +-2002-09-17 Werner Koch +- +- * random.c: Replaced mutex.h by the new ath.h. Changed all calls. +- +-2002-09-16 Werner Koch +- +- * arcfour.c (do_encrypt_stream): Use register modifier and modulo. +- According to Nikos Mavroyanopoulos this increases perfromace on +- i386 system noticable. And I always tought gcc is clever enough. +- * md5.c (transform): Use register modifier. +- * rmd160.c (transform): Ditto. +- * sha1.c (transform): Ditto. We hope that there are 6 free registers. +- * random.c (gcry_randomize): Rewrote to avoid malloc calls. +- +- * rndlinux.c (gather_random): Replaced remaining fprintfs by log_*. +- * arcfour.c (do_arcfour_setkey): Ditto. +- * twofish.c (do_twofish_setkey): Ditto. +- * rndegd.c (gather_random): Ditto. +- * rijndael.c (do_setkey): Ditto. +- * random.c (_gcry_random_dump_stats): Ditto. +- * primegen.c (_gcry_generate_elg_prime): Ditto. +- * des.c (_gcry_des_get_info): Ditto. +- * cast5.c (do_cast_setkey): Ditto. +- * blowfish.c (do_bf_setkey): Ditto. +- +-2002-08-26 Werner Koch +- +- * des.c (weak_keys): Fixed one entry in the table and compared +- all entries against the literature. +- (selftest): Checksum the weak key table. +- +-2002-08-21 Werner Koch +- +- * pubkey.c: Enable keygrip calculation for "openpgp-rsa". +- +-2002-08-17 Werner Koch +- +- * cipher.c (setup_cipher_table): Don't overwrite the DES entry +- with the entry for DUMMY. +- +-2002-08-14 Werner Koch +- +- * des.c (do_des_setkey,do_des_encrypt, do_des_decrypt): New. +- (_gcry_des_get_info): Support plain old DES. +- * cipher.c (setup_cipher_table): Put DES into the table. +- +-2002-07-25 Werner Koch +- +- * rndunix.c (_gcry_rndunix_constructor): Prefixed with _gcry_. +- Noted by Stephan Austermuehle. +- +-2002-07-08 Timo Schulz +- +- * rndw32.c: Replaced the m_ memory functions with the real +- gcry_ functions. Renamed all g10_ prefixed functions to log_. +- +-2002-06-12 Werner Koch +- +- * rsa.c (generate): Use e = 65537 for now. +- +-2002-06-11 Werner Koch +- +- * pubkey.c (gcry_pk_get_keygrip): Allow a "protected-private-key". +- +-2002-06-05 Timo Schulz +- +- * cipher.c (gcry_cipher_encrypt, gcry_cipher_decrypt): +- Check that the input size is a multiple of the blocksize. +- +-2002-05-23 Werner Koch +- +- * md.c (oid_table): Add an rsadsi OID for MD5. +- +-2002-05-21 Werner Koch +- +- * primegen.c, elgamal.c, dsa.c (progress): Do not print anything +- by default. Pass an extra identifying string to the callback and +- reserved 2 argumenst for current and total counters. Changed the +- register function prototype. +- +-2002-05-17 Werner Koch +- +- * rndegd.c (rndegd_constructor): Fixed name of register function +- and prefixed the function name with _gcry_. +- * rndw32.c (rndw32_constructor): Ditto. +- * tiger.c (tiger_constructor): Ditto. +- +- * Makefile.am: Removed all dynamic loading stuff. +- * dynload.c: Ditto. Now only used for the constructor system. +- +-2002-05-15 Werner Koch +- +- * random.c (gcry_random_bytes,gcry_random_bytes_secure) +- (gcry_randomize): Make sure we are initialized. +- +-2002-05-14 Werner Koch +- +- Changed license of most files to the LGPL. +- +-2002-05-02 Werner Koch +- +- * random.c (_gcry_fast_random_poll): Initialize the module so the +- mutex can be used. +- +- * primegen.c (small_prime_numbers): Moved table from smallprime.c +- * smallprime.c: File removed. +- +- * des.c (leftkey_swap, rightkey_swap, working_memcmp): Made static. +- +- * cipher.c (gcry_cipher_map_name): Map "RIJNDAEL" to "AES". +- * rijndael.c (rijndael_get_info): We do only support a 128 bit +- blocksize so it makes sense to change the algorithm strings to +- AES. +- +- * tiger.c (tiger_final): Removed superfluous token pasting operators. +- * md5.c (md5_final): Ditto. +- +-2002-04-30 Werner Koch +- +- * cipher.c: Fixed list of copyright years. +- +-2002-03-18 Werner Koch +- +- * random.c (initialize): Initialize the new pool lock mutex. +- (_gcry_fast_random_poll): Add locking and moved main +- code out to... +- (do_fast_random_poll): new function. +- (read_pool): Use the new function here. +- (get_random_bytes): Add locking. +- (_gcry_update_random_seed_file): Ditto. +- +-2002-03-11 Werner Koch +- +- * md.c: Add rsaSignatureWithripemd160 to OID table. +- +-2002-02-20 Werner Koch +- +- * sha1.c: Removed a left over comment note. The code has been +- rewritten from scratch in 1998. Thanks to Niels Möller for +- reporting this misleading comment. +- +-2002-02-18 Werner Koch +- +- * rndunix.c (rndunix_constructor): Use the the new prefixed +- function name. Reported by Jordi Mallach. +- +-2002-02-10 Werner Koch +- +- * random.c (mix_pool): Carry an extra failsafe_digest buffer +- around to make the function more robust. +- +-2002-02-08 Werner Koch +- +- * random.c (add_randomness): Xor new data into the pool and not +- just copy it. This avoids any choosen input attacks which are not +- serious in our setting because an outsider won't be able to mix +- data in and even then we keep going with a PRNG. Thanks to Stefan +- Keller for pointing this out. +- +-2002-01-04 Werner Koch +- +- * pubkey.c (gcry_pk_genkey): Do not release skey - it is static. +- +- * primegen.c (gen_prime): Of course we should use set_bit +- and not set_highbit to set the second high bit. +- +-2001-12-18 Werner Koch +- +- * rsa.c (generate): Loop until we find the exact modulus size. +- Changed the exponent to 41. +- (rsa_get_info): s/usage/r_usage/ to avoid shadow warnings. +- * primegen.c (gen_prime): Set 2 high order bits for secret primes. +- +- * Makefile.am (DISTCLEANFILES): Include construct.c. +- +-2001-12-17 Werner Koch +- +- * pubkey.c (gcry_pk_get_keygrip): New - experimental. +- +-2001-12-11 Werner Koch +- +- * cipher.c: Added OIDs for AES. +- (gcry_cipher_mode_from_oid): New. +- (gcry_cipher_map_name): Moved OID search code to .. +- (search_oid): .. new function. +- +-2001-12-10 Werner Koch +- +- * pubkey.c (gcry_pk_encrypt): Find the signature algorithm by name +- and not by number. +- +- * pubkey.c (gcry_pk_encrypt,gcry_pk_decrypt,gcry_pk_sign) +- (gcry_pk_verify,gcry_pk_testkey, gcry_pk_genkey) +- (gcry_pk_get_nbits): Release the arrays. Noted by Nikos +- Mavroyanopoulos. +- +-2001-12-06 Werner Koch +- +- * cipher.c (gcry_cipher_map_name): Look also for OIDs prefixed +- with "oid." or "OID.". +- +-2001-12-05 Werner Koch +- +- * pubkey.c (algo_info_table): Fixed entry for openpgp-rsa. +- +-2001-11-24 Werner Koch +- +- * pubkey.c: Added the rsaEncryption OID to the tables. +- (sexp_to_key): Add an arg to return the index of the algorithm, +- changed all callers. +- (gcry_pk_sign): Find the signature algorithm by name and not by +- number. +- (gcry_pk_get_nbits): Fixed so that we can now really pass a secret +- key to get the result. +- +- * md.c (gcry_md_map_name): Look also for OIDs prefixed with "oid." +- or "OID." so that an OID string can be used as an S-Exp token. +- +-2001-11-20 Werner Koch +- +- * md.c (gcry_md_map_name): Lookup by OID if the the name begins +- with a digit. +- (oid_table): New. +- +-2001-11-16 Werner Koch +- +- * md.c (gcry_md_info): New operator GCRYCTL_IS_ALGO_ENABLED. +- +-2001-11-07 Werner Koch +- +- * md.c (gcry_md_hash_buffer): Close the handle which was left open +- for algorithms other than rmd160. +- +-2001-08-08 Werner Koch +- +- * rndw32.c (gather_random): Use toolhelp in addition to the NT +- gatherer for Windows2000. Suggested by Sami Tolvanen. +- +- * random.c (read_pool): Fixed length check, this used to be one +- byte to strict. Made an assert out of it because the caller has +- already made sure that only poolsize bytes are requested. +- Reported by Marcus Brinkmann. +- +-2001-08-03 Werner Koch +- +- * cipher.c (cipher_encrypt, cipher_decrypt): Prepare to return +- errors. We have to change the interface to all ciphers to make +- this really work but we should do so to prepare for hardware +- encryption modules. +- (gcry_cipher_encrypt, gcry_cipher_decrypt): Return the error and +- set lasterr. +- (gcry_cipher_ctl): Make sure that errors from setkey are returned. +- +-2001-08-02 Werner Koch +- +- * rndlinux.c (gather_random): casted a size_t arg to int so that +- the format string is correct. Casting is okay here and avoids +- translation changes. +- +- * random.c (fast_random_poll): Do not check the return code of +- getrusage. +- +- * rndunix.c: Add a signal.h header to avoid warnings on Solaris 7 +- and 8. +- +- * tiger.c (print_abc,print_data): Removed. +- +- * rijndael.c, des.c, blowfish.c, twofish.c, cast5.c, arcfour.c +- (burn_stack): New. Add wrappers for most functions to be able to +- call burn_stack after the function invocation. This methods seems +- to be the most portable way to zeroise the stack used. It does +- only work on stack frame based machines but it is highly portable +- and has no side effects. Just setting the automatic variables at +- the end of a function to zero does not work well because the +- compiler will optimize them away - marking them as volatile would +- be bad for performance. +- * md5.c, sha1.c, rmd160.c, tiger.c (burn_stack): Likewise. +- * random.c (burn_stack): New. +- (mix_pool): Use it here to burn the stack of the mixblock function. +- +- * primegen.c (_gcry_generate_elg_prime): Freed q at 3 places. +- Thanks to Tommi Komulainen. +- +- * arcfour.c (arcfour_setkey): Check the minimim keylength against +- bytes and not bits. +- (selftest): Must reset the key before decryption. +- +-2001-05-31 Werner Koch +- +- * sha1.c (sha1_init): Made static. +- +- Changed all g10_ prefixed function names as well as some mpi_ +- function names to cope with the introduced naming changes. +- +- * md.c (prepare_macpads): Made key const. +- +-2001-05-28 Werner Koch +- +- * rndegd.c (gather_random): Removed the use of tty_printf. +- +-2001-03-29 Werner Koch +- +- * md5.c (md5_final): Fixed calculation of hashed length. Thanks +- to disastry@saiknes.lv for pointing out that it was horrible wrong +- for more than 512MB of input. +- * sha1.c (sha1_final): Ditto. +- * rmd160.c (rmd160_final): Ditto. +- * tiger.c (tiger_final): Ditto. +- +- * blowfish.c (encrypt,do_encrypt): Changed name to do_encrypt to +- avoid name clashes with an encrypt function in stdlib.h of +- Dynix/PIX. Thanks to Gene Carter. +- * elgamal.c (encrypt,do_encrypt): Ditto. +- +- * twofish.c (gnupgext_enum_func): Use only when when compiled as a +- module. +- * rijndael.c (gnupgext_enum_func): Ditto. +- +- * tiger.c (tiger_get_info): Return "TIGER192" and not just +- "TIGER". By Edwin Woudt. +- +- * random.c: Always include time.h - standard requirement. Thanks +- to James Troup. +- +- * rndw32.c: Fixes to the macros. +- +-2001-01-11 Werner Koch +- +- * cipher.c (cipher_encrypt,gcry_cipher_encrypt): Use blocksize and +- not 8. +- +-2000-12-19 Werner Koch +- +- Major change: +- Removed all GnuPG stuff and renamed this piece of software +- to gcrypt. +- +-2000-11-14 Werner Koch +- +- * dsa.c (test_keys): Replaced mpi_alloc by gcry_mpi_new and +- mpi_free by gcry_mpi_release. +- * elgamal.c (test_keys,generate): Ditto, also for mpi_alloc_secure. +- * rsa.c (test_keys,generate,rsa_verify): Ditto. +- * primegen.c (generate_elg_prime): Ditto. +- (gen_prime): Ditto and removed nlimbs. +- +- * rsa.c (generate): Allocate 2 more vars in secure memory. +- +- * Makefile.am (OMIT_DEPENDENCIES): Hack to work around dependency +- problems. +- +-2000-10-09 Werner Koch +- +- * arcfour.c, arcfour.h: New. +- * cipher.c (cipher_encrypt, cipher_decrypt): Add stream mode. +- (setup_cipher_table): Add Arcfour. +- (gcry_cipher_open): Kludge to allow stream mode. +- +-Wed Oct 4 13:16:18 CEST 2000 Werner Koch +- +- * sha1.c (transform): Use rol() macro. Actually this is not needed +- for a newer gcc but there are still aoter compilers. +- +- * rsa.c (test_keys): Use new random function. +- +- * md.c (gcry_md_setkey): New function to overcome problems with +- const conflics. +- (gcry_md_ctl): Pass set key to the new functions. +- +- * rijndael.c: New. +- * cipher.c: Add Rijndael support. +- +-Mon Sep 18 16:35:45 CEST 2000 Werner Koch +- +- * rndlinux.c (open_device): Loose random device checking. +- By Nils Ellmenreich. +- +- * random.c (fast_random_poll): Check ENOSYS for getrusage. +- * rndunix.c: Add 2 sources for QNX. By Sam Roberts. +- +- * pubkey.c (gcry_pk_algo_info): Add GCRYCTL_GET_ALGO_USAGE. +- +- * rsa.c: Changed the comment about the patent. +- (secret): Speed up by using the CRT. For a 2k keys this +- is about 3 times faster. +- (stronger_key_check): New but unused code to check the secret key. +- * Makefile.am: Included rsa.[ch]. +- * pubkey.c: Enabled RSA support. +- (pubkey_get_npkey): Removed RSA workaround. +- +-Mon Jul 31 10:04:47 CEST 2000 Werner Koch +- +- * pubkey.c: Replaced all gcry_sexp_{car,cdr}_{data,mpi} by the new +- gcry_sexp_nth_{data,mpi} functions. +- +-Tue Jul 25 17:44:15 CEST 2000 Werner Koch +- +- * pubkey.c (exp_to_key,sexp_to_sig,sexp_to_enc,gcry_pk_encrypt, +- gcry_pk_decrypt,gcry_pk_sign,gcry_pk_genkey): Changed to work with +- the new S-Exp interface. +- +-Mon Jul 17 16:35:47 CEST 2000 Werner Koch +- +- * random.c (gather_faked): Replaced make_timestamp by time(2) again. +- +-Fri Jul 14 19:38:23 CEST 2000 Werner Koch +- +- * md.c (gcry_md_ctl): Support GCRYCTL_{START,STOP}_DUMP. +- +- * Makefile.am: Never compile mingw32 as module. +- +- * Makefile.am: Tweaked module build and removed libtool +- +- * Makefile.am: Replaced -O1 by -O. Suggested by Alec Habig. +- +- * elgamal.c (sign): Removed inactive code. +- +- * rsa.c, rsa.h: New based on the old module version (only in CVS for now). +- * pubkey.c (setup_pubkey_table): Added commented support for RSA. +- +- * rndunix.c (waitpid): New. For UTS 2.1. All by Dave Dykstra. +- (my_popen): Do the FD_CLOEXEC only if it is available +- (start_gatherer): Cope with missing _SC_OPEN_MAX +- +- * rndunix.c: Add some more headers for QNX. By Sam Roberts. +- +- * rndegd.c (gather_random): Shortcut level 0. +- * rndunix.c (gather_random): Ditto. +- * rndw32.c (gather_random): Ditto. +- +- * rndw32.c: Replaced with code from Cryptlib and commented the old stuff. +- * rndw32.c: Add some debuging code enabled by an environment variable. +- +- * random.c (read_seed_file): Binary open for DOSish system +- (update_random_seed_file): Ditto. +- * random.c [MINGW32]: Include process.h for getpid. +- * random.c (fast_random_poll): Add clock_gettime() as fallback for +- system which support this POSIX.4 fucntion. By Sam Roberts. +- +- * random.c (read_seed_file): Removed the S_ISLNK test becuase it +- is already covered by !S_ISREG and is not defined in Unixware. +- Reported by Dave Dykstra. +- (update_random_seed_file): Silently ignore update request when pool +- is not filled. +- +- * random.c (read_seed_file): New. +- (set_random_seed_file): New. +- (read_pool): Try to read the seeding file. +- (update_random_seed_file): New. +- +- (read_pool): Do an initial extra seeding when level 2 quality random +- is requested the first time. This requestes at least POOLSIZE/2 bytes +- of entropy. Compined with the seeding file this should make normal +- random bytes cheaper and increase the quality of the random bytes +- used for key generation. +- +- * random.c (read_pool): Print a more friendly error message in +- cases when too much random is requested in one call. +- +- * random.c (fast_random_poll): Check whether RUSAGE_SELF is defined; +- this is not the case for some ESIX and Unixware, although they have +- getrusage(). +- +- * primegen.c (generate_elg_prime): All primes are now generated with +- the lowest random quality level. Because they are public anyway we +- don't need stronger random and by this we do not drain the systems +- entropy so much. +- +- * primegen.c (register_primegen_progress): New. +- * dsa.c (register_pk_dsa_progress): New. +- * elgamal.c (register_pk_elg_progress): New. +- +- * elgamal.c (wiener_map): New. +- (gen_k): Use a much smaller k. +- (generate): Calculate the qbits using the wiener map and +- choose an x at a size comparable to the one choosen in gen_k +- +- * rmd160.c (rmd160_get_info): Moved casting to the left side due to a +- problem with UTS4.3. Suggested by Dave Dykstra. +- * sha1.c (sha1_get_info): Ditto. +- * tiger.c (tiger_get_info): Ditto. +- * md5.c (md5_get_info): Ditto +- * des.c (des_get_info): Ditto. +- * blowfish.c (blowfish_get_info): Ditto. +- * cast5.c (cast5_get_info): Ditto. +- * twofish.c (twofish_get_info): Ditto. +- +-Fri Mar 24 11:25:45 CET 2000 Werner Koch +- +- * md.c (md_open): Add hmac arg and allocate space for the pads. +- (md_finalize): Add HMAC support. +- (md_copy): Ditto. +- (md_close): Ditto. +- (gcry_md_reset): Ditto. +- (gcry_md_ctl): Ditto. +- (prepare_macpdas): New. +- +-Mon Mar 13 19:22:46 CET 2000 Werner Koch +- +- * md.c (gcry_md_hash_buffer): Add support for the other algorithms. +- +-Mon Jan 31 16:37:34 CET 2000 Werner Koch +- +- * genprime.c (generate_elg_prime): Fixed returned factors which never +- worked for non-DSA keys. +- +-Thu Jan 27 18:00:44 CET 2000 Werner Koch +- +- * pubkey.c (sexp_to_key): Fixed mem leaks in case of errors. +- +-Mon Jan 24 22:24:38 CET 2000 Werner Koch +- +- * pubkey.c (gcry_pk_decrypt): Implemented. +- (gcry_pk_encrypt): Implemented. +- (gcry_pk_testkey): New. +- (gcry_pk_genkey): New. +- (pubkey_decrypt): Made static. +- (pubkey_encrypt): Ditto. +- (pubkey_check_secret_key): Ditto. +- (pubkey_generate): Ditto. +- +-Mon Jan 24 13:04:28 CET 2000 Werner Koch +- +- * pubkey.c (pubkey_nbits): Removed and replaced by ... +- (gcry_pk_get_nbits): this new one. +- +-Wed Dec 8 21:58:32 CET 1999 Werner Koch +- +- * dsa.c: s/mpi_powm/gcry_mpi_powm/g +- * elgamal.c: Ditto. +- * primegen.c: Ditto. +- +- * : Replaced g10_opt_verbose by g10_log_verbosity(). +- +- * Makefile.am (INCLUDES): removed intl, add ../gcrypt +- +-Fri Nov 19 17:15:20 CET 1999 Werner Koch +- +- * dynload.c (cmp_filenames): New to replaced compare_filename() in +- module. +- (register_cipher_extension): Removed the tilde expansion stuff. +- * rndeg.c (my_make_filename): New. +- +- * : Replaced header util.h by g10lib.h +- +- * random.c (gather_faked): Replaced make_timestamp by time(2). +- Disabled wrning printed with tty_printf. +- * rndlinux.c (gather_random): Always use fprintf instead of tty_xxx; +- this should be replaced by a callback function. +- +- * primegen.c (gen_prime): Use gcry_mpi_randomize. +- (is_prime): Ditto. +- * elgamal.c (test_keys): Ditto. +- * dsa.c (test_keys): Ditto. +- +- * cipher.c (gcry_cipher_close): Die on invalid handle. +- +-Mon Nov 15 21:36:02 CET 1999 Werner Koch +- +- * elgamal.c (gen_k): Use the new random API. +- (generate): Ditto. +- * dsa.c (gen_k): Ditto. +- (generate): Ditto. +- +-Sat Nov 13 17:44:23 CET 1999 Werner Koch +- +- * pubkey.c (disable_pubkey_algo): Made static. +- (gcry_pk_ctl): New. +- +- * random.c (get_random_bits): Renamed to ... +- (get_random_bytes): ... this and made static. +- (gcry_random_bytes): New. +- (gcry_random_bytes_secure): New. +- (randomize_buffer): Renamed to ... +- (gcry_randomize): ...this. +- +- * md.c (gcry_md_hash_buffer): New. +- +- * pubkey.c (gcry_pk_algo_info): 4 new commands. +- (pubkey_get_npkey): Made static. +- (pubkey_get_nskey): Made static. +- (pubkey_get_nsig): Made static. +- (pubkey_get_nenc): Made static. +- +- * pubkey.c: Removed all G10ERR_xxx. +- * cipher.c: Changed all GCRYERR_INV_ALGO to GCRYERR_INV_CIPHER_ALGO. +- * md.c: Changed all GCRYERR_INV_ALGO to GCRYERR_INV_MD_ALGO. +- * cast5.c (cast_setkey): Changed errocodes to GCRYERR_xxx. +- * blowfish.c: Ditto. +- * des.c: Ditto. +- * twofish.c: Ditto. +- * dsa.c: Ditto. +- * elgamal.c: Ditto. +- +- * g10c.c: Removed +- +- * cipher.c (gcry_cipher_open): Replaced alloc functions and return NULL +- if we are out of core. +- * dynload.c: Replaced all memory allocation functions. +- * md.c: Ditto. +- * primegen.c: Ditto. +- * pubkey.c: Ditto. +- * random.c: Ditto. +- * rndw32.c: Ditto. +- * elgamal.c: Ditto. +- * dsa.c: Ditto. +- +-Tue Oct 26 14:10:21 CEST 1999 Werner Koch +- +- * elgamal.c (sign): Hugh found strange code here. Replaced by BUG(). +- +- * cipher.c: Merged with gcrypt/symapi.c. +- +- * pubkey.c (string_to_pubkey_algo): Renamed function to ... +- (gcry_pk_map_name): ... this. +- (pubkey_algo_to_string): Renamed function to ... +- (gcry_pk_algo_name): ... this. +- (gcry_pk_algo_info): New. +- * pubkey.c: Merged with gcrypt/pkapi.c. +- +- * md.c (md_reset): Clear finalized; thanks to Ulf Moeller for +- fixing this bug. +- +- * md.c: Merged with gcrypt/mdapi.c +- +-Wed Sep 15 14:39:59 CEST 1999 Michael Roth +- +- * des.c: Various speed improvements: One bit pre rotation +- trick after initial permutation (Richard Outerbridge). +- Finished test of SSLeay Tripple-DES patterns. +- +-Wed Sep 15 16:22:17 CEST 1999 Werner Koch +- +- * rndw32.c: New. +- +-Mon Sep 13 10:51:29 CEST 1999 Werner Koch +- +- * bithelp.h: New. +- * rmd160.h, sha1.h, md5.h: Use the rol macro from bithelp.h +- +-Tue Sep 7 16:23:36 CEST 1999 Werner Koch +- +- * Makefile.am: Fixed seds for latest egcc. By Ollivier Robert. +- +-Mon Sep 6 19:59:08 CEST 1999 Werner Koch +- +- * des.c (selftest): Add some testpattern +- +-Mon Aug 30 20:38:33 CEST 1999 Werner Koch +- +- * cipher.c (do_cbc_encrypt): Fixed serious bug occuring when not using +- in place encryption. Pointed out by Frank Stajano. +- +-Mon Jul 26 09:34:46 CEST 1999 Werner Koch +- +- * md5.c (md5_final): Fix for a SCO cpp bug. +- +-Thu Jul 15 10:15:35 CEST 1999 Werner Koch +- +- * elgamal.c (elg_check_secret_key,elg_encrypt +- elg_decrypt,elg_sign,elg_verify): Sanity check on the args. +- * dsa.c (dsa_check_secret_key,dsa_sign,dsa_verify): Ditto. +- +- * pubkey.c (disable_pubkey_algo): New. +- (check_pubkey_algo2): Look at disabled algo table. +- * cipher.c (disable_cipher_algo): New. +- (check_cipher_algo): Look at disabled algo table. +- +-Wed Jul 7 13:08:40 CEST 1999 Werner Koch +- +- * Makefile.am: Support for libtool. +- +-Fri Jul 2 11:45:54 CEST 1999 Werner Koch +- +- * dsa.c (gen_k): Changed algorithm to consume less random bytes +- * elgamal.c (gen_k): Ditto. +- +- * random.c (random_dump_stats): New. +- +-Thu Jul 1 12:47:31 CEST 1999 Werner Koch +- +- * primegen.c, elgamal.c, dsa.c (progess): New and replaced all +- fputc with a call to this function. +- +-Sat Jun 26 12:15:59 CEST 1999 Werner Koch +- +- * rndegd.c (do_write): s/ssize_t/int/ due to SunOS 4.1 probs. +- +- * cipher.c (do_cbc_encrypt, do_cbc_decrypt): New. +- +- * dynload.c (HAVE_DL_SHL_LOAD): Map hpux API to dlopen (Dave Dykstra). +- * Makefile.am (install-exec-hook): Removed. +- +-Sun May 23 14:20:22 CEST 1999 Werner Koch +- +- * cipher.c (setup_cipher_table): Enable Twofish +- +- * random.c (fast_random_poll): Disable use of times() for mingw32. +- +-Mon May 17 21:54:43 CEST 1999 Werner Koch +- +- * dynload.c (register_internal_cipher_extension): Minor init fix. +- +-Tue May 4 15:47:53 CEST 1999 Werner Koch +- +- * primegen.c (gen_prime): Readded the Fermat test. Fixed the bug +- that we didn't correct for step when passing the prime to the +- Rabin-Miller test which led to bad performance (Stefan Keller). +- (check_prime): Add a first Fermat test. +- +-Sun Apr 18 10:11:28 CEST 1999 Werner Koch +- +- * cipher.c (cipher_setiv): Add ivlen arg, changed all callers. +- +- * random.c (randomize_buffer): alway use secure memory because +- we can't use m_is_secure() on a statically allocated buffer. +- +- * twofish.c: Replaced some macros by a loop to reduce text size. +- * Makefile.am (twofish): No more need for sed editing. +- +-Fri Apr 9 12:26:25 CEST 1999 Werner Koch +- +- * cipher.c (cipher_open): Reversed the changes for AUTO_CFB. +- +- * blowfish.c: Dropped the Blowfish 160 mode. +- * cipher.c (cipher_open): Ditto. +- (setup_cipher_table): Ditto. And removed support of twofish128 +- +-Wed Apr 7 20:51:39 CEST 1999 Werner Koch +- +- * random.c (get_random_bits): Can now handle requests > POOLSIZE +- +- * cipher.c (cipher_open): Now uses standard CFB for automode if +- the blocksize is gt 8 (according to rfc2440). +- +- * twofish.c: Applied Matthew Skala's patches for 256 bit key. +- +-Tue Apr 6 19:58:12 CEST 1999 Werner Koch +- +- * random.c (get_random_bits): Can now handle requests > POOLSIZE +- +- * cipher.c (cipher_open): Now uses standard CFB for automode if +- the blocksize is gt 8 (according to rfc2440). +- +-Sat Mar 20 11:44:21 CET 1999 Werner Koch +- +- * rndlinux.c (tty_printf) [IS_MODULE]: Removed. +- +- * rndegd.c (gather_random): Some fixes. +- +-Wed Mar 17 13:09:03 CET 1999 Werner Koch +- +- * rndegd.c (do_read): New. +- (gather_random): Changed the implementation. +- +-Mon Mar 8 20:47:17 CET 1999 Werner Koch +- +- * dynload.c (DLSYM_NEEDS_UNDERSCORE): Renamed. +- +-Fri Feb 26 17:55:41 CET 1999 Werner Koch +- +- * md.c: Nearly a total rewrote. +- +-Wed Feb 24 11:07:27 CET 1999 Werner Koch +- +- * cipher.c (context): Fixed alignment +- * md.c: Ditto. +- +- * rndegd.c: New +- +-Mon Feb 22 20:04:00 CET 1999 Werner Koch +- +- * rndegd.c: New. +- +-Wed Feb 10 17:15:39 CET 1999 Werner Koch +- +- * Makefile.am: Modules are now figured out by configure +- * construct.c: New. Generated by configure. Changed all modules +- to work with that. +- * sha1.h: Removed. +- * md5.h: Removed. +- +- * twofish.c: Changed interface to allow Twofish/256 +- +- * rndunix.c (start_gatherer): Die on SIGPIPE. +- +-Wed Jan 20 18:59:49 CET 1999 Werner Koch +- +- * rndunix.c (gather_random): Fix to avoid infinite loop. +- +-Sun Jan 17 11:04:33 CET 1999 Werner Koch +- +- * des.c (is_weak_key): Replace system memcmp due to bugs +- in SunOS's memcmp. +- (des_get_info): Return error on failed selftest. +- * twofish.c (twofish_setkey): Return error on failed selftest or +- invalid keylength. +- * cast5.c (cast_setkey): Ditto. +- * blowfish.c (bf_setkey): Return error on failed selftest. +- +-Tue Jan 12 11:17:18 CET 1999 Werner Koch +- +- * random.c (random_is_faked): New. +- +- * tiger.c: Only compile if we have the u64 type +- +-Sat Jan 9 16:02:23 CET 1999 Werner Koch +- +- * rndunix.c (gather_random): check for setuid. +- +- * Makefile.am: Add a way to staically link random modules +- +-Thu Jan 7 18:00:58 CET 1999 Werner Koch +- +- * md.c (md_stop_debug): Do a flush first. +- (md_open): size of buffer now depends on the secure parameter +- +-Sun Jan 3 15:28:44 CET 1999 Werner Koch +- +- * rndunix.c (start_gatherer): Fixed stupid ==/= bug +- +-1998-12-31 Geoff Keating +- +- * des.c (is_weak_key): Rewrite loop end condition. +- +-Tue Dec 29 14:41:47 CET 1998 Werner Koch +- +- * random.c: add unistd.h for getpid(). +- (RAND_MAX): Fallback value for Sun. +- +-Wed Dec 23 17:12:24 CET 1998 Werner Koch +- +- * md.c (md_copy): Reset debug. +- +-Mon Dec 14 21:18:49 CET 1998 Werner Koch +- +- * random.c (read_random_source): Changed the interface to the +- random gathering function. +- (gather_faked): Use new interface. +- * dynload.c (dynload_getfnc_fast_random_poll): Ditto. +- (dynload_getfnc_gather_random): Ditto. +- * rndlinux.c (gather_random): Ditto. +- * rndunix.c (gather_random): Ditto. +- +-Sat Dec 12 18:40:32 CET 1998 Werner Koch +- +- * dynload.c (SYMBOL_VERSION): New to cope with system which needs +- underscores. +- +- * rndunix.c: Rewrote large parts +- +-Thu Dec 10 20:15:36 CET 1998 Werner Koch +- +- * dynload.c (load_extension): increased needed verbosity level. +- +- * random.c (fast_random_poll): Fallback to a default fast random +- poll function. +- (read_random_source): Always use the faked entroy gatherer if no +- gather module is available. +- * rndlinux.c (fast_poll): Removed. +- * rndunix.c (fast_poll): Removed. +- +- +-Wed Nov 25 12:33:41 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rand-*.c: Removed. +- * rndlinux.c : New. +- * rndunix.c : New. +- * random.c : Restructured the interface to the gather modules. +- (intialize): Call constructor functions +- (read_radnom_source): Moved to here. +- * dynload.c (dynload_getfnc_gather_random): New. +- (dynload_getfnc_fast_random_poll): New. +- (register_internal_cipher_extension): New. +- (register_cipher_extension): Support of internal modules. +- +-Sun Nov 8 17:44:36 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rand-unix.c (read_random_source): Removed the assert. +- +-Mon Oct 19 18:34:30 1998 me,,, (wk@tobold) +- +- * pubkey.c: Hack to allow us to give some info about RSA keys back. +- +-Thu Oct 15 11:47:57 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * dynload.c: Support for DLD +- +-Wed Oct 14 12:13:07 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rand-unix.c: Now uses names from configure for /dev/random. +- +-1998-10-10 SL Baur +- +- * Makefile.am: fix sed -O substitutions to catch -O6, etc. +- +-Tue Oct 6 10:06:32 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rand-unix.c (HAVE_GETTIMEOFDAY): Fixed (was ..GETTIMEOFTIME :-) +- * rand-dummy.c (HAVE_GETTIMEOFDAY): Ditto. +- +-Mon Sep 28 13:23:09 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c (md_digest): New. +- (md_reset): New. +- +-Wed Sep 23 12:27:02 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * tiger.c (TIGER_CONTEXT): moved "buf", so that it is 64 bit aligned. +- +-Mon Sep 21 06:22:53 1998 Werner Koch (wk@(none)) +- +- * des.c: Some patches from Michael. +- +-Thu Sep 17 19:00:06 1998 Werner Koch (wk@(none)) +- +- * des.c : New file from Michael Roth +- +-Mon Sep 14 11:10:55 1998 Werner Koch (wk@(none)) +- +- * blowfish.c (bf_setkey): Niklas Hernaeus patch to detect weak keys. +- +-Mon Sep 14 09:19:25 1998 Werner Koch (wk@(none)) +- +- * dynload.c (RTLD_NOW): Now defined to 1 if it is undefined. +- +-Mon Sep 7 17:04:33 1998 Werner Koch (wk@(none)) +- +- * Makefile.am: Fixes to allow a different build directory +- +-Thu Aug 6 17:25:38 1998 Werner Koch,mobil,,, (wk@tobold) +- +- * random.c (get_random_byte): Removed and changed all callers +- to use get_random_bits() +- +-Mon Jul 27 10:30:22 1998 Werner Koch (wk@(none)) +- +- * cipher.c : Support for other blocksizes +- (cipher_get_blocksize): New. +- * twofish.c: New. +- * Makefile.am: Add twofish module. +- +-Mon Jul 13 21:30:52 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * random.c (read_pool): Simple alloc if secure_alloc is not set. +- (get_random_bits): Ditto. +- +-Thu Jul 9 13:01:14 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * dynload.c (load_extension): Function now nbails out if +- the program is run setuid. +- +-Wed Jul 8 18:58:23 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rmd160.c (rmd160_hash_buffer): New. +- +-Thu Jul 2 10:50:30 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cipher.c (cipher_open): algos >=100 use standard CFB +- +-Thu Jun 25 11:18:25 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * Makefile.am: Support for extensions +- +-Thu Jun 18 12:09:38 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * random.c (mix_pool): simpler handling for level 0 +- +-Mon Jun 15 14:40:48 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * tiger.c: Removed from dist, will reappear as dynload module +- +-Sat Jun 13 14:16:57 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * pubkey.c: Major changes to allow extensions. Changed the inteface +- of all public key ciphers and added the ability to load extensions +- on demand. +- +- * misc.c: Removed. +- +-Wed Jun 10 07:52:08 1998 Werner Koch,mobil,,, (wk@tobold) +- +- * dynload.c: New. +- * cipher.c: Major changes to allow extensions. +- +-Mon Jun 8 22:43:00 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cipher.c: Major internal chnages to support extensions. +- * blowfish.c (blowfish_get_info): New and made all internal +- functions static, changed heder. +- * cast5.c (cast5_get_info): Likewise. +- +-Mon Jun 8 12:27:52 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * tiger.c (transform): Fix for big endian +- +- * cipher.c (do_cfb_decrypt): Big endian fix. +- +-Fri May 22 07:30:39 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c (md_get_oid): Add a new one for TIGER. +- +-Thu May 21 13:24:52 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cipher.c: Add support for a dummy cipher +- +-Thu May 14 15:40:36 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rmd160.c (transform): fixed sigbus - I should better +- add Christian von Roques's new implemenation of rmd160_write. +- +-Fri May 8 18:07:44 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rand-internal.h, rand-unix.c, rand-w32.c, rand_dummy.c: New +- * random.c: Moved system specific functions to rand-****.c +- +-Fri May 8 14:01:17 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * random.c (fast_random_poll): add call to gethrtime. +- +-Tue May 5 21:28:55 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * elgamal.c (elg_generate): choosing x was not correct, could +- yield 6 bytes which are not from the random pool, tsss, tsss.. +- +-Tue May 5 14:09:06 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * primegen.c (generate_elg_prime): Add arg mode, changed all +- callers and implemented mode 1. +- +-Mon Apr 27 14:41:58 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cipher.c (cipher_get_keylen): New. +- +-Sun Apr 26 14:44:52 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * tiger.c, tiger.h: New. +- +-Wed Apr 8 14:57:11 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * misc.c (check_pubkey_algo2): New. +- +-Tue Apr 7 18:46:49 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cipher.c: New +- * misc.c (check_cipher_algo): Moved to cipher.c +- * cast5.c: Moved many functions to cipher.c +- * blowfish.c: Likewise. +- +-Sat Apr 4 19:52:08 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * cast5.c: Implemented and tested. +- +-Wed Apr 1 16:38:27 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * elgamal.c (elg_generate): Faster generation of x in some cases. +- +-Thu Mar 19 13:54:48 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * blowfish.c (blowfish_decode_cfb): changed XOR operation +- (blowfish_encode_cfb): Ditto. +- +-Thu Mar 12 14:04:05 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * sha1.c (transform): Rewrote +- +- * blowfish.c (encrypt): Unrolled for rounds == 16 +- (decrypt): Ditto. +- +-Tue Mar 10 16:32:08 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rmd160.c (transform): Unrolled the loop. +- +-Tue Mar 10 13:05:14 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * random.c (read_pool): Add pool_balance stuff. +- (get_random_bits): New. +- +- * elgamal.c (elg_generate): Now uses get_random_bits to generate x. +- +- +-Tue Mar 10 11:33:51 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c (md_digest_length): New. +- +-Tue Mar 10 11:27:41 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * dsa.c (dsa_verify): Works. +- +-Mon Mar 9 12:59:08 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * dsa.c, dsa.h: Removed some unused code. +- +-Wed Mar 4 10:39:22 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c (md_open): Add call to fast_random_poll. +- blowfish.c (blowfish_setkey): Ditto. +- +-Tue Mar 3 13:32:54 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * rmd160.c (rmd160_mixblock): New. +- * random.c: Restructured to start with a new RNG implementation. +- * random.h: New. +- +-Mon Mar 2 19:21:46 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * gost.c, gost.h: Removed because they did only contain trash. +- +-Sun Mar 1 16:42:29 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * random.c (fill_buffer): removed error message if n == -1. +- +-Fri Feb 27 16:39:34 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c (md_enable): No init if called twice. +- +-Thu Feb 26 07:57:02 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * primegen.c (generate_elg_prime): Changed the progress printing. +- (gen_prime): Ditto. +- +-Tue Feb 24 12:28:42 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md5.c, md.5 : Replaced by a modified version of md5.c from +- GNU textutils 1.22. +- +-Wed Feb 18 14:08:30 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * md.c, md.h : New debugging support +- +-Mon Feb 16 10:08:47 1998 Werner Koch (wk@isil.d.shuttle.de) +- +- * misc.c (cipher_algo_to_string): New +- (pubkey_algo_to_string): New. +- (digest_algo_to_string): New. +- +- +- Copyright 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006 +- 2007, 2008, 2009, 2010 Free Software Foundation, Inc. +- +- This file is free software; as a special exception the author gives +- unlimited permission to copy and/or distribute it, with or without +- modifications, as long as this notice is preserved. +- +- This file is distributed in the hope that it will be useful, but +- WITHOUT ANY WARRANTY, to the extent permitted by law; without even the +- implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +diff --git a/grub-core/lib/libgcrypt/cipher/ChangeLog-2011 b/grub-core/lib/libgcrypt/cipher/ChangeLog-2011 +index 05516c9..1ce6bd1 100644 +--- a/grub-core/lib/libgcrypt/cipher/ChangeLog-2011 ++++ b/grub-core/lib/libgcrypt/cipher/ChangeLog-2011 +@@ -1,9 +1,37 @@ + 2011-12-01 Werner Koch + +- NB: ChangeLog files are no longer manually maintained. Starting +- on December 1st, 2011 we put change information only in the GIT +- commit log, and generate a top-level ChangeLog file from logs at +- "make dist". See doc/HACKING for details. ++ NB: ChangeLog files are no longer manually maintained. Starting ++ on December 1st, 2011 we put change information only in the GIT ++ commit log, and generate a top-level ChangeLog file from logs at ++ "make dist". See doc/HACKING for details. ++ ++2011-09-16 Werner Koch ++ ++ * primegen.c (_gcry_primegen_init): New. ++ ++2011-09-15 Werner Koch ++ ++ * cipher-cbc.c, cipher-cfb.c, cipher-ofb.c, cipher-ctr.c: New. ++ * cipher-aeswrap.c: New. ++ * cipher-internal.h: New. ++ * cipher.c (cipher_context_alignment_t, struct gcry_cipher_handle) ++ (CTX_MAGIC_NORMAL, CTX_MAGIC_SECURE, NEED_16BYTE_ALIGNED_CONTEXT) ++ (MAX_BLOCKSIZE): Move to cipher-internal.h. ++ (do_aeswrap_encrypt, do_aeswrap_encrypt) ++ (do_cbc_encrypt, do_cbc_decrypt, do_ctr_encrypt, do_ctr_decrypt) ++ (do_ofb_encrypt, do_ofb_decrypt, do_ctr_encrypt): Move to the ++ respective new cipher-foo.c files. ++ (do_ctr_decrypt): Remove. ++ ++2011-09-15 Werner Koch ++ ++ * pubkey.c (gcry_pk_list): Remove. ++ (gcry_pk_unregister): Remove. ++ * md.c (gcry_md_list): Remove. ++ (gcry_md_unregister): Remove. ++ * cipher.c (gcry_cipher_list): Remove. ++ (gcry_cipher_unregister): Remove. ++ * ac.c: Remove. + + 2011-06-29 Werner Koch + +@@ -4245,3 +4273,7 @@ Mon Feb 16 10:08:47 1998 Werner Koch (wk@isil.d.shuttle.de) + This file is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY, to the extent permitted by law; without even the + implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. ++ ++Local Variables: ++buffer-read-only: t ++End: +diff --git a/grub-core/lib/libgcrypt/cipher/Makefile.am b/grub-core/lib/libgcrypt/cipher/Makefile.am +index 76cdc96..ea9014c 100644 +--- a/grub-core/lib/libgcrypt/cipher/Makefile.am ++++ b/grub-core/lib/libgcrypt/cipher/Makefile.am +@@ -19,65 +19,317 @@ + + # Process this file with automake to produce Makefile.in + +-EXTRA_DIST = Manifest +- + # Need to include ../src in addition to top_srcdir because gcrypt.h is + # a built header. +-AM_CPPFLAGS = -I../src -I$(top_srcdir)/src ++AM_CPPFLAGS = -I../src -I$(top_srcdir)/src -I../mpi -I$(top_srcdir)/mpi + AM_CFLAGS = $(GPG_ERROR_CFLAGS) + ++AM_CCASFLAGS = $(NOEXECSTACK_FLAGS) ++ ++EXTRA_DIST = gost-s-box.c kyber-common.c kyber-kdep.c ++ ++CLEANFILES = gost-s-box$(EXEEXT_FOR_BUILD) ++DISTCLEANFILES = gost-sb.h + + noinst_LTLIBRARIES = libcipher.la + +-GCRYPT_MODULES = @GCRYPT_CIPHERS@ @GCRYPT_PUBKEY_CIPHERS@ @GCRYPT_DIGESTS@ ++GCRYPT_MODULES = @GCRYPT_CIPHERS@ @GCRYPT_PUBKEY_CIPHERS@ \ ++ @GCRYPT_DIGESTS@ @GCRYPT_KDFS@ + + libcipher_la_DEPENDENCIES = $(GCRYPT_MODULES) + libcipher_la_LIBADD = $(GCRYPT_MODULES) + + libcipher_la_SOURCES = \ +-cipher.c pubkey.c ac.c md.c kdf.c \ +-hmac-tests.c \ +-bithelp.h \ +-primegen.c \ +-hash-common.c hash-common.h \ +-rmd.h ++ cipher.c cipher-internal.h \ ++ cipher-cbc.c \ ++ cipher-cfb.c \ ++ cipher-ofb.c \ ++ cipher-ctr.c \ ++ cipher-aeswrap.c \ ++ cipher-ccm.c \ ++ cipher-cmac.c \ ++ cipher-gcm.c \ ++ cipher-poly1305.c \ ++ cipher-ocb.c \ ++ cipher-xts.c \ ++ cipher-eax.c \ ++ cipher-siv.c \ ++ cipher-gcm-siv.c \ ++ pubkey.c pubkey-internal.h pubkey-util.c \ ++ md.c \ ++ mac.c mac-internal.h \ ++ mac-hmac.c mac-cmac.c mac-gmac.c mac-poly1305.c \ ++ poly1305.c poly1305-internal.h \ ++ kem.c sntrup761.c sntrup761.h kyber.c kyber.h kem-ecc.c kem-ecc.h \ ++ mceliece6688128f.c mceliece6688128f.h \ ++ kdf.c kdf-internal.h \ ++ bithelp.h \ ++ bufhelp.h \ ++ bulkhelp.h \ ++ primegen.c \ ++ hash-common.c hash-common.h \ ++ dsa-common.c rsa-common.c \ ++ sha1.h + + EXTRA_libcipher_la_SOURCES = \ +-arcfour.c \ +-blowfish.c \ +-cast5.c \ +-crc.c \ +-des.c \ +-dsa.c \ +-elgamal.c \ +-ecc.c \ +-idea.c \ +-md4.c \ +-md5.c \ +-rijndael.c rijndael-tables.h \ +-rmd160.c \ +-rsa.c \ +-seed.c \ +-serpent.c \ +-sha1.c \ +-sha256.c \ +-sha512.c \ +-tiger.c \ +-whirlpool.c \ +-twofish.c \ +-rfc2268.c \ +-camellia.c camellia.h camellia-glue.c ++ asm-common-aarch64.h \ ++ asm-common-amd64.h \ ++ asm-common-i386.h \ ++ asm-common-s390x.h \ ++ asm-inline-s390x.h \ ++ asm-poly1305-aarch64.h \ ++ asm-poly1305-amd64.h \ ++ asm-poly1305-s390x.h \ ++ aria.c aria-aesni-avx-amd64.S aria-aesni-avx2-amd64.S \ ++ aria-gfni-avx512-amd64.S \ ++ arcfour.c arcfour-amd64.S \ ++ blowfish.c blowfish-amd64.S blowfish-arm.S \ ++ cast5.c cast5-amd64.S cast5-arm.S \ ++ chacha20.c chacha20-amd64-ssse3.S chacha20-amd64-avx2.S \ ++ chacha20-amd64-avx512.S chacha20-armv7-neon.S chacha20-aarch64.S \ ++ chacha20-ppc.c chacha20-s390x.S \ ++ chacha20-p10le-8x.s \ ++ cipher-gcm-ppc.c cipher-gcm-intel-pclmul.c cipher-gcm-armv7-neon.S \ ++ cipher-gcm-armv8-aarch32-ce.S cipher-gcm-armv8-aarch64-ce.S \ ++ crc.c crc-intel-pclmul.c crc-armv8-ce.c \ ++ crc-armv8-aarch64-ce.S \ ++ crc-ppc.c \ ++ des.c des-amd64.S \ ++ dsa.c \ ++ elgamal.c \ ++ ecc.c ecc-curves.c ecc-misc.c ecc-common.h \ ++ ecc-ecdh.c ecc-ecdsa.c ecc-eddsa.c ecc-gost.c ecc-sm2.c \ ++ idea.c \ ++ gost28147.c gost.h \ ++ gostr3411-94.c \ ++ md4.c \ ++ md5.c \ ++ poly1305-s390x.S poly1305-amd64-avx512.S \ ++ poly1305-p10le.s \ ++ rijndael.c rijndael-internal.h rijndael-tables.h \ ++ rijndael-aesni.c rijndael-padlock.c \ ++ rijndael-amd64.S rijndael-arm.S \ ++ rijndael-ssse3-amd64.c rijndael-ssse3-amd64-asm.S \ ++ rijndael-vaes.c rijndael-vaes-avx2-amd64.S \ ++ rijndael-vaes-i386.c rijndael-vaes-avx2-i386.S \ ++ rijndael-armv8-ce.c rijndael-armv8-aarch32-ce.S \ ++ rijndael-armv8-aarch64-ce.S rijndael-aarch64.S \ ++ rijndael-ppc.c rijndael-ppc9le.c \ ++ rijndael-p10le.c rijndael-gcm-p10le.s \ ++ rijndael-ppc-common.h rijndael-ppc-functions.h \ ++ rijndael-s390x.c \ ++ rmd160.c \ ++ rsa.c \ ++ salsa20.c salsa20-amd64.S salsa20-armv7-neon.S \ ++ scrypt.c \ ++ seed.c \ ++ serpent.c serpent-sse2-amd64.S serpent-avx2-amd64.S \ ++ serpent-avx512-x86.c serpent-armv7-neon.S \ ++ sm4.c sm4-aesni-avx-amd64.S sm4-aesni-avx2-amd64.S \ ++ sm4-gfni-avx2-amd64.S sm4-gfni-avx512-amd64.S \ ++ sm4-aarch64.S sm4-armv8-aarch64-ce.S sm4-armv9-aarch64-sve-ce.S \ ++ sm4-ppc.c \ ++ sha1.c sha1-ssse3-amd64.S sha1-avx-amd64.S sha1-avx-bmi2-amd64.S \ ++ sha1-avx2-bmi2-amd64.S sha1-armv7-neon.S sha1-armv8-aarch32-ce.S \ ++ sha1-armv8-aarch64-ce.S sha1-intel-shaext.c \ ++ sha256.c sha256-ssse3-amd64.S sha256-avx-amd64.S \ ++ sha256-avx2-bmi2-amd64.S \ ++ sha256-armv8-aarch32-ce.S sha256-armv8-aarch64-ce.S \ ++ sha256-intel-shaext.c sha256-ppc.c \ ++ sha512.c sha512-ssse3-amd64.S sha512-avx-amd64.S \ ++ sha512-avx2-bmi2-amd64.S sha512-avx512-amd64.S \ ++ sha512-armv7-neon.S sha512-armv8-aarch64-ce.S sha512-arm.S \ ++ sha512-ppc.c sha512-ssse3-i386.c \ ++ sm3.c sm3-avx-bmi2-amd64.S sm3-aarch64.S sm3-armv8-aarch64-ce.S \ ++ keccak.c keccak_permute_32.h keccak_permute_64.h \ ++ keccak-armv7-neon.S keccak-amd64-avx512.S \ ++ stribog.c \ ++ tiger.c \ ++ whirlpool.c whirlpool-sse2-amd64.S \ ++ twofish.c twofish-amd64.S twofish-arm.S twofish-aarch64.S \ ++ twofish-avx2-amd64.S \ ++ rfc2268.c \ ++ camellia.c camellia.h camellia-glue.c camellia-aesni-avx-amd64.S \ ++ camellia-aesni-avx2-amd64.h \ ++ camellia-gfni-avx2-amd64.S camellia-gfni-avx512-amd64.S \ ++ camellia-vaes-avx2-amd64.S camellia-aesni-avx2-amd64.S \ ++ camellia-arm.S camellia-aarch64.S camellia-aarch64-ce.c \ ++ camellia-simd128.h camellia-ppc8le.c camellia-ppc9le.c \ ++ blake2.c \ ++ blake2b-amd64-avx2.S blake2b-amd64-avx512.S \ ++ blake2s-amd64-avx.S blake2s-amd64-avx512.S ++ ++gost28147.lo: gost-sb.h ++gost-sb.h: gost-s-box$(EXEEXT_FOR_BUILD) ++ ./gost-s-box$(EXEEXT_FOR_BUILD) $@ ++ ++gost-s-box$(EXEEXT_FOR_BUILD): gost-s-box.c ++ $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) \ ++ $(CPPFLAGS_FOR_BUILD) -o $@ $(srcdir)/gost-s-box.c ++ + + if ENABLE_O_FLAG_MUNGING +-o_flag_munging = sed -e 's/-O\([2-9s][2-9s]*\)/-O1/' -e 's/-Ofast/-O1/g' ++o_flag_munging = sed -e 's/[[:blank:]]-O\([2-9sgz][2-9sgz]*\)/ -O1 /' -e 's/[[:blank:]]-Ofast/ -O1 /g' + else + o_flag_munging = cat + endif + + + # We need to lower the optimization for this module. +-tiger.o: $(srcdir)/tiger.c +- `echo $(COMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) ` ++tiger.o: $(srcdir)/tiger.c Makefile ++ `echo $(COMPILE) -c $< | $(o_flag_munging) ` + +-tiger.lo: $(srcdir)/tiger.c +- `echo $(LTCOMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) ` ++tiger.lo: $(srcdir)/tiger.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(o_flag_munging) ` ++ ++ ++# We need to disable instrumentation for these modules as they use cc as ++# thin assembly front-end and do not tolerate in-between function calls ++# inserted by compiler as those functions may clobber the XMM registers. ++if ENABLE_INSTRUMENTATION_MUNGING ++instrumentation_munging = sed \ ++ -e 's/-fsanitize[=,\-][=,a-z,A-Z,0-9,\,,\-]*//g' \ ++ -e 's/-fprofile[=,\-][=,a-z,A-Z,0-9,\,,\-]*//g' \ ++ -e 's/-fcoverage[=,\-][=,a-z,A-Z,0-9,\,,\-]*//g' ++else ++instrumentation_munging = cat ++endif ++ ++rijndael-aesni.o: $(srcdir)/rijndael-aesni.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++rijndael-aesni.lo: $(srcdir)/rijndael-aesni.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++rijndael-ssse3-amd64.o: $(srcdir)/rijndael-ssse3-amd64.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++rijndael-ssse3-amd64.lo: $(srcdir)/rijndael-ssse3-amd64.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++cipher-gcm-intel-pclmul.o: $(srcdir)/cipher-gcm-intel-pclmul.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++cipher-gcm-intel-pclmul.lo: $(srcdir)/cipher-gcm-intel-pclmul.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha1-intel-shaext.o: $(srcdir)/sha1-intel-shaext.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha1-intel-shaext.lo: $(srcdir)/sha1-intel-shaext.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha256-intel-shaext.o: $(srcdir)/sha256-intel-shaext.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha256-intel-shaext.lo: $(srcdir)/sha256-intel-shaext.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha256-ssse3-i386.o: $(srcdir)/sha256-ssse3-i386.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++sha256-ssse3-i386.lo: $(srcdir)/sha256-ssse3-i386.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++crc-intel-pclmul.o: $(srcdir)/crc-intel-pclmul.c Makefile ++ `echo $(COMPILE) -c $< | $(instrumentation_munging) ` ++ ++crc-intel-pclmul.lo: $(srcdir)/crc-intel-pclmul.c Makefile ++ `echo $(LTCOMPILE) -c $< | $(instrumentation_munging) ` ++ ++if ENABLE_PPC_VCRYPTO_EXTRA_CFLAGS ++ppc_vcrypto_cflags = -O2 -maltivec -mvsx -mcrypto ++else ++ppc_vcrypto_cflags = ++endif ++ ++if ENABLE_AARCH64_NEON_INTRINSICS_EXTRA_CFLAGS ++aarch64_neon_cflags = -O2 -march=armv8-a+crypto ++else ++aarch64_neon_cflags = ++endif ++ ++rijndael-ppc.o: $(srcdir)/rijndael-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++rijndael-ppc.lo: $(srcdir)/rijndael-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++rijndael-ppc9le.o: $(srcdir)/rijndael-ppc9le.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++rijndael-ppc9le.lo: $(srcdir)/rijndael-ppc9le.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++rijndael-p10le.o: $(srcdir)/rijndael-p10le.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++rijndael-p10le.lo: $(srcdir)/rijndael-p10le.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++sha256-ppc.o: $(srcdir)/sha256-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++sha256-ppc.lo: $(srcdir)/sha256-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++sha512-ppc.o: $(srcdir)/sha512-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++sha512-ppc.lo: $(srcdir)/sha512-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++chacha20-ppc.o: $(srcdir)/chacha20-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++chacha20-ppc.lo: $(srcdir)/chacha20-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++crc-ppc.o: $(srcdir)/crc-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++crc-ppc.lo: $(srcdir)/crc-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++cipher-gcm-ppc.o: $(srcdir)/cipher-gcm-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++cipher-gcm-ppc.lo: $(srcdir)/cipher-gcm-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-ppc8le.o: $(srcdir)/camellia-ppc8le.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-ppc8le.lo: $(srcdir)/camellia-ppc8le.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-ppc9le.o: $(srcdir)/camellia-ppc9le.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-ppc9le.lo: $(srcdir)/camellia-ppc9le.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-aarch64-ce.o: $(srcdir)/camellia-aarch64-ce.c Makefile ++ `echo $(COMPILE) $(aarch64_neon_cflags) -c $< | $(instrumentation_munging) ` ++ ++camellia-aarch64-ce.lo: $(srcdir)/camellia-aarch64-ce.c Makefile ++ `echo $(LTCOMPILE) $(aarch64_neon_cflags) -c $< | $(instrumentation_munging) ` ++ ++sm4-ppc.o: $(srcdir)/sm4-ppc.c Makefile ++ `echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++sm4-ppc.lo: $(srcdir)/sm4-ppc.c Makefile ++ `echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< | $(instrumentation_munging) ` ++ ++ ++if ENABLE_X86_AVX512_INTRINSICS_EXTRA_CFLAGS ++avx512f_cflags = -mavx512f ++else ++avx512f_cflags = ++endif ++ ++serpent-avx512-x86.o: $(srcdir)/serpent-avx512-x86.c Makefile ++ `echo $(COMPILE) $(avx512f_cflags) -c $< | $(instrumentation_munging) ` ++ ++serpent-avx512-x86.lo: $(srcdir)/serpent-avx512-x86.c Makefile ++ `echo $(LTCOMPILE) $(avx512f_cflags) -c $< | $(instrumentation_munging) ` +diff --git a/grub-core/lib/libgcrypt/cipher/Manifest b/grub-core/lib/libgcrypt/cipher/Manifest +deleted file mode 100644 +index 0cd64f7..0000000 +--- a/grub-core/lib/libgcrypt/cipher/Manifest ++++ /dev/null +@@ -1,73 +0,0 @@ +-# Manifest - checksums of the cipher directory +-# Copyright 2003 Free Software Foundation, Inc. +-# +-# This file is part of Libgcrypt. +-# +-# Libgcrypt is free software; you can redistribute it and/or modify +-# it under the terms of the GNU Lesser general Public License as +-# published by the Free Software Foundation; either version 2.1 of +-# the License, or (at your option) any later version. +-# +-# Libgcrypt is distributed in the hope that it will be useful, +-# but WITHOUT ANY WARRANTY; without even the implied warranty of +-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-# GNU Lesser General Public License for more details. +-# +-# You should have received a copy of the GNU Lesser General Public +-# License along with this program; if not, write to the Free Software +-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA +- +-# Checksums for all source files in this directory. Format is +-# filename, blanks, base-64 part of an OpenPGP detached signature +-# without the header lines. Blank lines and lines beginning with a +-# hash mark are ignored. A tool to process this file is available by +-# cvs -d :pserver:anoncvs@cvs.gnupg.org:/cvs/wk co misc-scripts/manifest-tool +-# +-# The special entry "$names$" holds a signature over all sorted +-# filenames excluding itself. +- +- +-# Algorithm API +-cipher.c iQCVAwUAQDzrVjEAnp832S/7AQIPDgP+OVJ/YNWY5m7c09EBbPAzL/WsGoj6wrBNMmkRlMOqTHeh+OOtjuFHt1f9uhfM2Nzl7sJ5+h4ryZKLEZmQPRMTZTnAqkvGdsrJWJnigUA9QwYdV0ONqC9C63gpuG465gO9TZVOqlQu/FTxSRuTQYUulkaBNG71n8nZEOusBVwV2YA==58xH +-pubkey.c iQCVAwUAP9XQ3jEAnp832S/7AQJ5UgQAyHfEBvPVJ8wTRg8c7ixS2GiVmIgwIo5tvQaiQJTPWASevvYrB+2Z2qa9cATyu50ACjLzbaquGBgPzjJV3dU/qttT1gCqRuN/LCNvXFe5qnIZezejc3RAadFNTw/pOTHq0wxD1Keg66ruei9R36Nba59pEQIWIBXTfubRft2hMYk==E09t +-ac.c iQCVAwUAQDzsOzEAnp832S/7AQJCBQP/WI6EV/dsR4rmha6RVhvkjZo17kQ8z6pIl5J3cXOvqEkIFeD2HYu3HHrWST5l7yXlffhpDkVHkfMih4ruK76q6Fm0dxZ98pO4C/dVtgimlvvcy/wOQjpzsE0fYAe1BYdg81LJ09X33vW5x6C29lunfKROO2tPlV5i8ffeoFvmMF8==j26g +-md.c iQCVAwUAP+NFGjEAnp832S/7AQJs8wP/Qdk0EAKsyr3O1/pmOSN8AG4rPKbd6KDTzvoBPAN4upFwKYY4hWwvy12Q3YU9DmECrzZkRCXHR7mljVQKs6B7CRZJKjFKmOELpcJDtKvu40vTs1bOH4k9iJYZpGgRA83nkQ+ELAcphAbCA+KIpVr2K4mCJAB0FhpC2uOQ50JHAko==BeF6 +-primegen.c iQCVAwUAQDzsoDEAnp832S/7AQKYRwP/TqAQBm1rHTnF0HYE05PqXfWlOqa6EosqVpaOcs/OIW6PaqX0xH1UlrukK7jNOjK3xC4o1qNQ1UKzz2dvQaq1bMvNNizeavxAh10SJZc0hIc/ofc83IbjLh8SZVWQ67JxjsUd3DOXmSmhPZ+Pqd7cUIiw8fDoF+I9EZqy3COu1wY==1ebT +- +-# Algorithm implementations +-arcfour.c iQCVAwUAP9XR/TEAnp832S/7AQJcRwP6AlvYEx++fpT4mIYo0xRDqKEQeqMQvbaRhIg2eV74JxItpHa3q5YsYIl+n1yUz5g35JRWWXSWmAZBwO5wLKsHii4kRUhgrKWnSoQZoPpl49L5+N3R58ON3S0ru5lsBiEJEze3xplf2vqwrH9v1QHVD+gU7UTlfNqrIJoOUXN+1O4==Tq+x +-blowfish.c iQCVAwUAP9XTETEAnp832S/7AQJaEgQAgiqqfuO+zQtscgTB0rvOzVymIKjRKjYhFuLjVuc79G4z1RCAffvIn/YM2d7kt+Z/QF7zjcTAOgETCQL1XokpX2zz9HPAMi2tlDY5zsDufTNqj0n4WBL9nM7w6XAvsiwP1B3bqCTv9SjJV4KbxJ58vw1yQE+sqW74R/QIHFvC7mU==wZnX +-cast5.c iQCVAwUAP9XT6DEAnp832S/7AQJ3xgP/ehLjEN3GELGudbqeo91Xd+PqitHrkuBbtRIYX7Udd/fyXLN+h8rMJVyIQX2m+mpxbBxudVU3x8/DNT8B0ZHAwK6qqJmEBLLhEYPgIuF76i9LMrP1KqUPhAwRZ2OppjIIugBQ+rP74aD4eLyd/aKQHNuXML8QGWR6KwQShohXM5I==/BRh +-crc.c iQCVAwUAP7ouejEAnp832S/7AQIgwQQApg5Nm63tH5DQkbN+zPzMO9Ygoj3ukxfFTyTBPYSXYKMiTjEbESegaU40uN8jnz2vprcIQWcgZfzO4+opEJMcI35aPwzEk0vKOp0S/PrBLUY2rJfnDVkX5XgJFZa2Q7LLe826UEBzTVYW924utiCCe8oOaOEWVNpg1mqdknu3M9o==kz5D +-des.c iQCVAwUAQCN2oDEAnp832S/7AQL/jwP6Auoq6nZCDBjpgc9tDzuIRwa9DqyuM3gX94uvgEpUwdHszb2bG43dz03kVmcYxtj1MzXbyCeCZOwox0b2SKmLgxIbrNP6yGbzVdTj6592gDYuf/ZXmc1ZNJ1DDldcPQ0n9fXUipUPwyPaNWo3mSZaNcMKSWWzdK0J6ciG6nk7SWI==9k/t +-dsa.c iQCVAwUAP9XZHDEAnp832S/7AQLBRgP/XrBzTEYx5ccMj1MMb6sg37liEHdIyyy49zjvt6jUqxj4RuwVEN8S6v3u4q/QyJkHAi1E0EkREgENlyHW6PKWhYbcrd0vPIAN15yjnl2yqtrCrJImexUCoqJJewK0E4JOicGbabTil8MZjk+mbhEPnjJBqOkyP1w0i31pEDgE/8M==pC8s +-elgamal.c iQCVAwUAP9XbYzEAnp832S/7AQLXagQA3HrvspZfbTGgmUH0IqLQTJ0exUPxJv5DET2TvoIy62trDmMN6lTAj5P+a7jQ8udcu0w+mR2vXUHcxUpNA2PxLaMwGzNSY4zRDNe9r3SFTDrFm6m4y9Ko2e8XtEA+WF6P/XLpck4Jn7vMEDmVGPwkNd22kXFFE8dBGwG6i5Hk1Mk==oBUs +-md4.c iQCVAwUAP9h50DEAnp832S/7AQJhHgQAzNA/B6MWFDlCtPkIVaW8RpP1Eg0ZNMsy0s7SJkopOCBlu6CwXUOKe+8ppcSxhjYKh4i4uQr/QtfipYlBjzKJGnrafoF/NugXNCOHSTGT11TvK7mCiBuUMVgvZGAlOJImk6eTTfUjRrMfaXM/SWl8bdJ4ZpzdjEyVh89r7I5JrGk==x2UD +-md5.c iQCVAwUAP9h7LzEAnp832S/7AQJUGQP/c0cbf6WZXCzmjufHxiE9FAQBzTsA0WtaNqdFcHl7fhmikGtknlaED8n5a7eYd/C481UQW6Wgq/oZdsvgoPWPhG3fOCy2CFP9cZVXITuMSf0ucyZTFUJNO15fnZ+nDfsUv+JPdv1aSeRinAUtfAcSKfkSyR9BCPZvkx+tgU6cphU==Zv+h +-rijndael.c iQCVAwUAP9h9cTEAnp832S/7AQKF1AP+P2L/tPqDJRDg+/fwbOk8Ts0MNxnvvYEm3gE73TKuLt1S+B2+jkrZcKNvM5VGPnVMJbnS0lmIK04nmedHCOftGTOwhGulZAHHIaKGystT3Jql4iPws/JMgAjE7Fyxh5WZMtB9yEljKBpJ5XNqhrMvvxcHpnyP3+YzIXNwzk34V+c==dJ5k +-rmd160.c iQCVAwUAP9h+bTEAnp832S/7AQK1OgP+PNKF6Nzi6X93easVlksdLqKEsArCAw2QjGWDGyxTnbiJM55qAl9JxR1mn3V+oOL7izLLwTt6EYK9evhzfcxY5N5Mni85RAcsLPsuAfQDEzjI6GUWHtQUKPbM+BaorzfhQjYFSZyvum/dZYJ/WfiwwwhqqIKyVU2ZFSqA38YGC/c==9jdA +-rsa.c iQCVAwUAP9iHIzEAnp832S/7AQKAYwQAuWtnMte54QHN+Hij9t4sGuypXogajOb1vQQwGgS0fKsaBZsuSP2amze4o5diIvsQTsFQ4CzjvqoCVuBDoHM3xkSD8wGDizgvtCamAxkdbF7wmzldKFn8SpJqlVwWQMP6kk1IjXHEuYb4IDWGTbVMhfEu+eOlU8+PSK4IhZqNvt4==/3hp +-serpent.c iQCVAwUAP9h/VzEAnp832S/7AQLyCwP/d1zbmb7l/PriZNa9/Z7mo01XFe5MnAqCfIwhl9GjeaMszcoS37jECNq5nLvrTTFIIJpm3rvBePwiCG4Wwx1I18HCxaP198pcSaR+BLOJ3Aj52EZPrxtqlDKuFr38ZOP5giyUqUYVYGVdrz4kRMNWAZQK53GeJnGhXCnhxojLEgA==ck46 +-sha1.c iQCVAwUAP9iATTEAnp832S/7AQKcSwQAwAs/HnNqho3lU1ZUgCPNt5P2/Brm6W21+wWWGKJkSrra/c4NYVKJGDDwlsFE0b9ln1uZt7bHReFkKXK3JnrKTmNVcx/Cy64iCMRNMhaM72Mqy7wWx5yHBAmMBxzFGnNQKbmeY52zeGih5HsNLSibc2pPuOViWo2JPJ5Ci/wIwl8==/wtO +-sha256.c iQCVAwUAP9iAtzEAnp832S/7AQJD2QP/UqvL0hhjG1wEFbGrdkV9tba1sMDXdnnK6X7HdLuRpVAgNiQiFf8JDmntd/dZ2Q71p4Uae2ctqve4WoEijPUZPjACnpuZfx0SEQL0lQBkwxzJp7lz9ujVtwQ2cM/aYexJkXcWgGcloJNLM3JbWPGIJnuYbr/IwJ6RQF9vgj0357o==UWO1 +-sha512.c iQCVAwUAP9iBTDEAnp832S/7AQIPBAQA28CJSUQLiW0s2x9u8/OH2eKnxPjA4sZmb50WP7920Lem66P31C3BrOqwfBot4RLhjL+zh/+Uc4s3HPwApZuj9E4BxNMlqLv+Tqk++DAbdaOeYT4jeUt+mlhQQ6mH/RDsy32rZsNsGQ2bUGxazZmfG++PL3JyhawqCy00SUDr/o0==H+0X +-tiger.c iQCVAwUAP9iCfjEAnp832S/7AQKufwP/fryv3MqSOYY+90325DH7X3/CtekxeooN0scGsHX0fxBakWSMecTNrj33KPddLS46gU/S89zIc2N/Bw/7EVIAXVFA3/3Ip+OrFOuIMO4Py1sCdB8o2Y+5ygv8iXLcsXIq1O0av79i9g774V3uaXa2qN9ZnXe0AEhcy8FHJ2i/wro==5XVB +-twofish.c iQCVAwUAP9iD6TEAnp832S/7AQKUnQP/Rq8FaYeHTG7HbZuqAs9pbPitzjDbkdZddmInWR7NmevBkKvhsJALjVooc0KGQfo2lAAmy3Xi/4QQN8VPn51DVjDIgf7x+DQh/9TFJHMccxI9asUgi4+TNnmMqLU1k3N8S2PjyZ1sjeC8B79fKPpwCzj72WkqPkzZw3l2jArr+dU==NdJT +-rfc2268.c iQCVAwUAQCN+3jEAnp832S/7AQLv1gQA1hJh29hAjKi4uLSGxXvJ6cyYmPdmevdKrbLnuHZWtHe4xvCgy/nTdEojEpxgLp/hL/ogasuWRC1W16Wiz9ryxf7YR0uhZWayO/bQNagpfU5MIkJTLuKqqgpwYumCSQfOugXVAqcgEzj+13eeyJaFVrzwrNa67sh84nmbjOjNjvE==0zBq +- +-# Random number related +-random.c iQCVAwUAP7nsITEAnp832S/7AQK4SAQAtvfUgrtGOQ2PlxGMla0qJLPHjJacMwgq0ecusiI79elPdDsFfCCk6dK1Ug2kFbNm22nCGHNcUquqbX7noi7ZVQnmPBQXzyLNZd7GmrawRZfdlRerTUDBpSnR8V8ui/5+YYp627E7kKGC0hPSgqXFql6oBMIfno0LZwFJTjIevRY==L419 +-random.h iQCVAwUAP7ovKDEAnp832S/7AQJ3bQQAjnPebnyTC7sphAv2I7uIz+yPgw1ZfbVhLv+OiWDlO9ish+fRyyMpy+HELBOgZjJdgRegqhlZC6qyns5arM/VglYi+PzvdLO3hIqHE/YFfpIFPz8wBrcmlqrYyd3CsGqcYsfjocXNttCBLeSWmoJ09ltKQH8yzJf3oAgN6X1yuc4==eNoU +-rand-internal.h iQCVAwUAP7ouvDEAnp832S/7AQLYnAQAhdI7ERoJVCkV8GiV7MjaUxv1WIL7iZ+jIOvVhv4fNyhCGCGoEtTjkyput/lj7Nsh3FXEqRhypGGrCLf47x/gua5n+BwffogxVyUDqiOyyGhNTPpe3fQcNBvbPCtco8yMK4GJO5G3BqzlPyN+BMeogLymyV6Sm1mvh5LZDyAFbfQ==tZSE +-rndlinux.c iQCVAwUAP9iPYTEAnp832S/7AQL6/AP/ZDrbOkVuB9qJ7sKeX1MImZEsz3mi0xPovJzaBtBU7a0idcUKrWYOvQFWRlLUeq0iCT6+h2l5bniP7q7hepzlKa+VPY9VWaQthqeJm2l5LN6QQ5PyMfBq04QuBncw9BJnCGmEyTLt3RxIXBAPdxmiVxtcRIFUqCBtQvoUXGLvemw==t37k +-rndegd.c iQCVAwUAP9iPRDEAnp832S/7AQImBQP/WHKg+hKXcm1pQvilzML0jZpwK5PAMM4uBnnPJNIXWOYBO6I/Xg9d/tPLg8NlmmtyQCo2Eu0ybDSt+8mu+dWveAys+0LTi0MIqeP9BMzCKz8dnWH6+S8huLXwTF3m0IrqM0JLb6b71GK9SOq6sWQ22yW5vf61hXP8kH9dhIaoMZs==FaHV +-rndunix.c iQCVAwUAP9iQlzEAnp832S/7AQL/KgQA29GnvcD4Xb5qjDMBgW9THEE4+4lfex/6k+Fh0IT61OLJsWVLJ7bJpRntburw4uQm4Tf7CO8vaiDFDYhKKrzXeOF1fmdpcL8hA+fNp9I/MUOc4e9kN9+YJ9wikVa0SZj1OBfhzgcFLd1xOtulkr3ii52HLF9vhrxzkgVwvD10Bi8==2cML +-rndw32.c iQCVAwUAP9iRKDEAnp832S/7AQIuaAQA3AJr3WqnxNDsWCIdvehf8Suotthj+laX8nJsvDfFhXPKcXDpsg0wTTXSnnKgyED53+uYiMDnVRsxeWAyhKwvx1MjjlaSMMjzbH6isWTH8FaWpLgrxEkXoPeNqYf5FXpdUkcUxGX2RkQeuX/cIfiHLNE9CV0usaF2jysjBX2iERY==EEnO +- +-# Helper +-bithelp.h iQCVAwUAP7ouPTEAnp832S/7AQKXggQAqjcgvihIF3WclOgw1JV2rbARw4ISIDRMFqdaNCqBRx6BwEz3UGsEIlz6+iR1sS/reqN61WvtjLb+D0+tujAkGrgQJhFLG85WtG2tB5UVoI3am1fpkwiRm+bR4rv0rGk0BYk81bC7+l4KrK9o5lVp4lCsrorlUKsd48lNmBHyAXM==mDDN +-rmd.h iQCVAwUAP7oumjEAnp832S/7AQJiJQP/V4bJwjZaYndJzV+KRnIDbl1koHuw+ZK5heMYVu8Qk4ylqv//BGyeRa3jZCcfPHI35q6HilCs2VBm8hiBMjHSqY/VPn2ZQ0yg/lt6qEvl7YjsLmyMICvjG+ncszHoq9pRvnF3vTnM18sPIioXLk8fskuM0XOCNBs0ARBAQjY9UGI==olUN +- +-# Configuration +-Makefile.am iQCVAwUAQCN33TEAnp832S/7AQKFJAQAz7BDkC814q+QiuE/jnutJHR5qlgbrm3ikGbQwdRzYUscst4bCCWy3uKL/sIPGLg+JQXtF5FnsQy3s4D9BOYhp72cA9ktYK65hhi4pNm/JQ0lXkZMNfk8Go5lNzKezlWwHvkMwRXR0Fep0wPdyeaKW5BfaW2ABvgep6Bp+hHEbyg==zSyi +-$names$ iQCVAwUAQCN3EDEAnp832S/7AQJXLAP8DvHTpm5DkTF35EmzeKpi9ie59AZcZanD19ir/e/7+PaQxr2riuLHDGwFKTju+dcvvBsqrygXOC378GXVWzIF2OZwS4EdDcJ+pgojo9UpsqpKsJHouY4Ugx5cQialxba462kUn8hcihSBnMyc4LzbJ5WQ4puQuqy544d2x94+2ms==G4Ls +diff --git a/grub-core/lib/libgcrypt/cipher/ac.c b/grub-core/lib/libgcrypt/cipher/ac.c +deleted file mode 100644 +index 63f6fcd..0000000 +--- a/grub-core/lib/libgcrypt/cipher/ac.c ++++ /dev/null +@@ -1,3301 +0,0 @@ +-/* ac.c - Alternative interface for asymmetric cryptography. +- Copyright (C) 2003, 2004, 2005, 2006 +- 2007, 2008 Free Software Foundation, Inc. +- +- This file is part of Libgcrypt. +- +- Libgcrypt is free software; you can redistribute it and/or modify +- it under the terms of the GNU Lesser general Public License as +- published by the Free Software Foundation; either version 2.1 of +- the License, or (at your option) any later version. +- +- Libgcrypt is distributed in the hope that it will be useful, +- but WITHOUT ANY WARRANTY; without even the implied warranty of +- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- GNU Lesser General Public License for more details. +- +- You should have received a copy of the GNU Lesser General Public +- License along with this program; if not, see . +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include "g10lib.h" +-#include "cipher.h" +-#include "mpi.h" +- +- +- +-/* At the moment the ac interface is a wrapper around the pk +- interface, but this might change somewhen in the future, depending +- on how many people prefer the ac interface. */ +- +-/* Mapping of flag numbers to the according strings as it is expected +- for S-expressions. */ +-static struct number_string +-{ +- int number; +- const char *string; +-} ac_flags[] = +- { +- { GCRY_AC_FLAG_NO_BLINDING, "no-blinding" }, +- }; +- +-/* The positions in this list correspond to the values contained in +- the gcry_ac_key_type_t enumeration list. */ +-static const char *ac_key_identifiers[] = +- { +- "private-key", +- "public-key" +- }; +- +-/* These specifications are needed for key-pair generation; the caller +- is allowed to pass additional, algorithm-specific `specs' to +- gcry_ac_key_pair_generate. This list is used for decoding the +- provided values according to the selected algorithm. */ +-struct gcry_ac_key_generate_spec +-{ +- int algorithm; /* Algorithm for which this flag is +- relevant. */ +- const char *name; /* Name of this flag. */ +- size_t offset; /* Offset in the cipher-specific spec +- structure at which the MPI value +- associated with this flag is to be +- found. */ +-} ac_key_generate_specs[] = +- { +- { GCRY_AC_RSA, "rsa-use-e", offsetof (gcry_ac_key_spec_rsa_t, e) }, +- { 0 } +- }; +- +-/* Handle structure. */ +-struct gcry_ac_handle +-{ +- int algorithm; /* Algorithm ID associated with this +- handle. */ +- const char *algorithm_name; /* Name of the algorithm. */ +- unsigned int flags; /* Flags, not used yet. */ +- gcry_module_t module; /* Reference to the algorithm +- module. */ +-}; +- +-/* A named MPI value. */ +-typedef struct gcry_ac_mpi +-{ +- char *name; /* Self-maintained copy of name. */ +- gcry_mpi_t mpi; /* MPI value. */ +- unsigned int flags; /* Flags. */ +-} gcry_ac_mpi_t; +- +-/* A data set, that is simply a list of named MPI values. */ +-struct gcry_ac_data +-{ +- gcry_ac_mpi_t *data; /* List of named values. */ +- unsigned int data_n; /* Number of values in DATA. */ +-}; +- +-/* A single key. */ +-struct gcry_ac_key +-{ +- gcry_ac_data_t data; /* Data in native ac structure. */ +- gcry_ac_key_type_t type; /* Type of the key. */ +-}; +- +-/* A key pair. */ +-struct gcry_ac_key_pair +-{ +- gcry_ac_key_t public; +- gcry_ac_key_t secret; +-}; +- +- +- +-/* +- * Functions for working with data sets. +- */ +- +-/* Creates a new, empty data set and store it in DATA. */ +-gcry_error_t +-_gcry_ac_data_new (gcry_ac_data_t *data) +-{ +- gcry_ac_data_t data_new; +- gcry_error_t err; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- data_new = gcry_malloc (sizeof (*data_new)); +- if (! data_new) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- +- data_new->data = NULL; +- data_new->data_n = 0; +- *data = data_new; +- err = 0; +- +- out: +- +- return err; +-} +- +-/* Destroys all the entries in DATA, but not DATA itself. */ +-static void +-ac_data_values_destroy (gcry_ac_data_t data) +-{ +- unsigned int i; +- +- for (i = 0; i < data->data_n; i++) +- if (data->data[i].flags & GCRY_AC_FLAG_DEALLOC) +- { +- gcry_mpi_release (data->data[i].mpi); +- gcry_free (data->data[i].name); +- } +-} +- +-/* Destroys the data set DATA. */ +-void +-_gcry_ac_data_destroy (gcry_ac_data_t data) +-{ +- if (data) +- { +- ac_data_values_destroy (data); +- gcry_free (data->data); +- gcry_free (data); +- } +-} +- +-/* This function creates a copy of the array of named MPIs DATA_MPIS, +- which is of length DATA_MPIS_N; the copy is stored in +- DATA_MPIS_CP. */ +-static gcry_error_t +-ac_data_mpi_copy (gcry_ac_mpi_t *data_mpis, unsigned int data_mpis_n, +- gcry_ac_mpi_t **data_mpis_cp) +-{ +- gcry_ac_mpi_t *data_mpis_new; +- gcry_error_t err; +- unsigned int i; +- gcry_mpi_t mpi; +- char *label; +- +- data_mpis_new = gcry_calloc (data_mpis_n, sizeof (*data_mpis_new)); +- if (! data_mpis_new) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- memset (data_mpis_new, 0, sizeof (*data_mpis_new) * data_mpis_n); +- +- err = 0; +- for (i = 0; i < data_mpis_n; i++) +- { +- /* Copy values. */ +- +- label = gcry_strdup (data_mpis[i].name); +- mpi = gcry_mpi_copy (data_mpis[i].mpi); +- if (! (label && mpi)) +- { +- err = gcry_error_from_errno (errno); +- gcry_mpi_release (mpi); +- gcry_free (label); +- break; +- } +- +- data_mpis_new[i].flags = GCRY_AC_FLAG_DEALLOC; +- data_mpis_new[i].name = label; +- data_mpis_new[i].mpi = mpi; +- } +- if (err) +- goto out; +- +- *data_mpis_cp = data_mpis_new; +- err = 0; +- +- out: +- +- if (err) +- if (data_mpis_new) +- { +- for (i = 0; i < data_mpis_n; i++) +- { +- gcry_mpi_release (data_mpis_new[i].mpi); +- gcry_free (data_mpis_new[i].name); +- } +- gcry_free (data_mpis_new); +- } +- +- return err; +-} +- +-/* Create a copy of the data set DATA and store it in DATA_CP. */ +-gcry_error_t +-_gcry_ac_data_copy (gcry_ac_data_t *data_cp, gcry_ac_data_t data) +-{ +- gcry_ac_mpi_t *data_mpis = NULL; +- gcry_ac_data_t data_new; +- gcry_error_t err; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- /* Allocate data set. */ +- data_new = gcry_malloc (sizeof (*data_new)); +- if (! data_new) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- +- err = ac_data_mpi_copy (data->data, data->data_n, &data_mpis); +- if (err) +- goto out; +- +- data_new->data_n = data->data_n; +- data_new->data = data_mpis; +- *data_cp = data_new; +- +- out: +- +- if (err) +- gcry_free (data_new); +- +- return err; +-} +- +-/* Returns the number of named MPI values inside of the data set +- DATA. */ +-unsigned int +-_gcry_ac_data_length (gcry_ac_data_t data) +-{ +- return data->data_n; +-} +- +- +-/* Add the value MPI to DATA with the label NAME. If FLAGS contains +- GCRY_AC_FLAG_COPY, the data set will contain copies of NAME +- and MPI. If FLAGS contains GCRY_AC_FLAG_DEALLOC or +- GCRY_AC_FLAG_COPY, the values contained in the data set will +- be deallocated when they are to be removed from the data set. */ +-gcry_error_t +-_gcry_ac_data_set (gcry_ac_data_t data, unsigned int flags, +- const char *name, gcry_mpi_t mpi) +-{ +- gcry_error_t err; +- gcry_mpi_t mpi_cp; +- char *name_cp; +- unsigned int i; +- +- name_cp = NULL; +- mpi_cp = NULL; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- if (flags & ~(GCRY_AC_FLAG_DEALLOC | GCRY_AC_FLAG_COPY)) +- { +- err = gcry_error (GPG_ERR_INV_ARG); +- goto out; +- } +- +- if (flags & GCRY_AC_FLAG_COPY) +- { +- /* Create copies. */ +- +- flags |= GCRY_AC_FLAG_DEALLOC; +- name_cp = gcry_strdup (name); +- mpi_cp = gcry_mpi_copy (mpi); +- if (! (name_cp && mpi_cp)) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- } +- +- /* Search for existing entry. */ +- for (i = 0; i < data->data_n; i++) +- if (! strcmp (name, data->data[i].name)) +- break; +- if (i < data->data_n) +- { +- /* An entry for NAME does already exist. */ +- if (data->data[i].flags & GCRY_AC_FLAG_DEALLOC) +- { +- gcry_mpi_release (data->data[i].mpi); +- gcry_free (data->data[i].name); +- } +- } +- else +- { +- /* Create a new entry. */ +- +- gcry_ac_mpi_t *ac_mpis; +- +- ac_mpis = gcry_realloc (data->data, +- sizeof (*data->data) * (data->data_n + 1)); +- if (! ac_mpis) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- +- if (data->data != ac_mpis) +- data->data = ac_mpis; +- data->data_n++; +- } +- +- data->data[i].name = name_cp ? name_cp : ((char *) name); +- data->data[i].mpi = mpi_cp ? mpi_cp : mpi; +- data->data[i].flags = flags; +- err = 0; +- +- out: +- +- if (err) +- { +- gcry_mpi_release (mpi_cp); +- gcry_free (name_cp); +- } +- +- return err; +-} +- +-/* Stores the value labelled with NAME found in the data set DATA in +- MPI. The returned MPI value will be released in case +- gcry_ac_data_set is used to associate the label NAME with a +- different MPI value. */ +-gcry_error_t +-_gcry_ac_data_get_name (gcry_ac_data_t data, unsigned int flags, +- const char *name, gcry_mpi_t *mpi) +-{ +- gcry_mpi_t mpi_return; +- gcry_error_t err; +- unsigned int i; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- if (flags & ~(GCRY_AC_FLAG_COPY)) +- { +- err = gcry_error (GPG_ERR_INV_ARG); +- goto out; +- } +- +- for (i = 0; i < data->data_n; i++) +- if (! strcmp (name, data->data[i].name)) +- break; +- if (i == data->data_n) +- { +- err = gcry_error (GPG_ERR_NOT_FOUND); +- goto out; +- } +- +- if (flags & GCRY_AC_FLAG_COPY) +- { +- mpi_return = gcry_mpi_copy (data->data[i].mpi); +- if (! mpi_return) +- { +- err = gcry_error_from_errno (errno); /* FIXME? */ +- goto out; +- } +- } +- else +- mpi_return = data->data[i].mpi; +- +- *mpi = mpi_return; +- err = 0; +- +- out: +- +- return err; +-} +- +-/* Stores in NAME and MPI the named MPI value contained in the data +- set DATA with the index IDX. NAME or MPI may be NULL. The +- returned MPI value will be released in case gcry_ac_data_set is +- used to associate the label NAME with a different MPI value. */ +-gcry_error_t +-_gcry_ac_data_get_index (gcry_ac_data_t data, unsigned int flags, +- unsigned int idx, +- const char **name, gcry_mpi_t *mpi) +-{ +- gcry_error_t err; +- gcry_mpi_t mpi_cp; +- char *name_cp; +- +- name_cp = NULL; +- mpi_cp = NULL; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- if (flags & ~(GCRY_AC_FLAG_COPY)) +- { +- err = gcry_error (GPG_ERR_INV_ARG); +- goto out; +- } +- +- if (idx >= data->data_n) +- { +- err = gcry_error (GPG_ERR_INV_ARG); +- goto out; +- } +- +- if (flags & GCRY_AC_FLAG_COPY) +- { +- /* Return copies to the user. */ +- if (name) +- { +- name_cp = gcry_strdup (data->data[idx].name); +- if (! name_cp) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- } +- if (mpi) +- { +- mpi_cp = gcry_mpi_copy (data->data[idx].mpi); +- if (! mpi_cp) +- { +- err = gcry_error_from_errno (errno); +- goto out; +- } +- } +- } +- +- if (name) +- *name = name_cp ? name_cp : data->data[idx].name; +- if (mpi) +- *mpi = mpi_cp ? mpi_cp : data->data[idx].mpi; +- err = 0; +- +- out: +- +- if (err) +- { +- gcry_mpi_release (mpi_cp); +- gcry_free (name_cp); +- } +- +- return err; +-} +- +-/* Convert the data set DATA into a new S-Expression, which is to be +- stored in SEXP, according to the identifiers contained in +- IDENTIFIERS. */ +-gcry_error_t +-_gcry_ac_data_to_sexp (gcry_ac_data_t data, gcry_sexp_t *sexp, +- const char **identifiers) +-{ +- gcry_sexp_t sexp_new; +- gcry_error_t err; +- char *sexp_buffer; +- size_t sexp_buffer_n; +- size_t identifiers_n; +- const char *label; +- gcry_mpi_t mpi; +- void **arg_list; +- size_t data_n; +- unsigned int i; +- +- sexp_buffer_n = 1; +- sexp_buffer = NULL; +- arg_list = NULL; +- err = 0; +- +- if (fips_mode ()) +- return gpg_error (GPG_ERR_NOT_SUPPORTED); +- +- /* Calculate size of S-expression representation. */ +- +- i = 0; +- if (identifiers) +- while (identifiers[i]) +- { +- /* For each identifier, we add "()". */ +- sexp_buffer_n += 1 + strlen (identifiers[i]) + 1; +- i++; +- } +- identifiers_n = i; +- +- if (! identifiers_n) +- /* If there are NO identifiers, we still add surrounding braces so +- that we have a list of named MPI value lists. Otherwise it +- wouldn't be too much fun to process these lists. */ +- sexp_buffer_n += 2; +- +- data_n = _gcry_ac_data_length (data); +- for (i = 0; i < data_n; i++) +- { +- err = gcry_ac_data_get_index (data, 0, i, &label, NULL); +- if (err) +- break; +- /* For each MPI we add "(