diff --git a/0055-Add-grub2-switch-to-blscfg.patch b/0055-Add-grub2-switch-to-blscfg.patch index 76732205..cb97a284 100644 --- a/0055-Add-grub2-switch-to-blscfg.patch +++ b/0055-Add-grub2-switch-to-blscfg.patch @@ -129,7 +129,7 @@ index 00000000000..a851424beb2 +# Print the usage. +usage () { + gettext_printf "Usage: %s\n" "$self" -+ gettext "Switch to BLS config files."; echo ++ gettext "Switch to BLS config files.\n"; echo + echo + print_option_help "-h, --help" "$(gettext "print this message and exit")" + print_option_help "-V, --version" "$(gettext "print the version information and exit")" diff --git a/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch b/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch deleted file mode 100644 index ba641630..00000000 --- a/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eric Sandeen -Date: Wed, 4 Dec 2024 07:50:28 -0600 -Subject: [PATCH] fs/xfs: fix large extent counters incompat feature support - -When large extent counter / NREXT64 support was added to grub, it missed -a couple of direct reads of nextents which need to be changed to the new -NREXT64-aware helper as well. Without this, we'll have mis-reads of some -directories with this feature enabled. - -(The large extent counter fix likely raced on merge with -07318ee7e ("fs/xfs: Fix XFS directory extent parsing") which added the new -direct nextents reads just prior, causing this issue.) - -Fixes: aa7c1322671e ("fs/xfs: Add large extent counters incompat feature support") -Signed-off-by: Eric Sandeen -Reviewed-by: Anthony Iliopoulos -Reviewed-by: Jon DeVree ---- - grub-core/fs/xfs.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c -index 8e02ab4a3014..92046f9bdf49 100644 ---- a/grub-core/fs/xfs.c -+++ b/grub-core/fs/xfs.c -@@ -926,7 +926,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, - * Leaf and tail information are only in the data block if the number - * of extents is 1. - */ -- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) -+ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) - { - struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); - -@@ -980,7 +980,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, - * The expected number of directory entries is only tracked for the - * single extent case. - */ -- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) -+ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) - { - /* Check if last direntry in this block is reached. */ - entries--; diff --git a/0289-misc-Implement-grub_strlcpy.patch b/0284-misc-Implement-grub_strlcpy.patch similarity index 100% rename from 0289-misc-Implement-grub_strlcpy.patch rename to 0284-misc-Implement-grub_strlcpy.patch diff --git a/0290-fs-ufs-Fix-a-heap-OOB-write.patch b/0285-fs-ufs-Fix-a-heap-OOB-write.patch similarity index 100% rename from 0290-fs-ufs-Fix-a-heap-OOB-write.patch rename to 0285-fs-ufs-Fix-a-heap-OOB-write.patch diff --git a/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch b/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch deleted file mode 100644 index 4e5cdc1c..00000000 --- a/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Benjamin Herrenschmidt -Date: Thu, 16 Jan 2025 10:22:48 -0600 -Subject: [PATCH] term/nns8250-spcr: return if redirection is disabled - -The Microsoft spec for SPCR says "The base address of the Serial Port register -set described using the ACPI Generic Address Structure, or 0 if console -redirection is disabled." so return if disable (base address = 0). If this check -is not done, we may get invalid ports for those particular machines that -redirection is disabled and at some point hanging the booting execution when -reading the grub.cfg configuration file. - -Signed-off-by: Benjamin Herrenschmidt -Reviewed-by: Leo Sandoval ---- - grub-core/term/ns8250-spcr.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/grub-core/term/ns8250-spcr.c b/grub-core/term/ns8250-spcr.c -index d52b52c26..86f1aa078 100644 ---- a/grub-core/term/ns8250-spcr.c -+++ b/grub-core/term/ns8250-spcr.c -@@ -75,6 +75,11 @@ grub_ns8250_spcr_init (void) - config.speed = 115200; - break; - }; -+ -+ /* if base address is 0, it means redirection is disable, so return it */ -+ if (spcr->base_addr.addr == 0) -+ return NULL; -+ - switch (spcr->base_addr.space_id) - { - case GRUB_ACPI_GENADDR_MEM_SPACE: diff --git a/0286-commands-legacycfg-Avoid-closing-file-twice.patch b/0286-commands-legacycfg-Avoid-closing-file-twice.patch deleted file mode 100644 index 2e126ab3..00000000 --- a/0286-commands-legacycfg-Avoid-closing-file-twice.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Wed, 16 Oct 2024 11:54:38 -0600 -Subject: [PATCH] commands/legacycfg: Avoid closing file twice - -An internal (at Red Hat) static soure code scan detected an -use-after-free scenario: - - Error: USE_AFTER_FREE (CWE-416): - grub-2.06/grub-core/commands/legacycfg.c:194: freed_arg: "grub_file_close" frees "file". - grub-2.06/grub-core/commands/legacycfg.c:201: deref_arg: Calling "grub_file_close" dereferences freed pointer "file". - # 199| if (!args) - # 200| { - # 201|-> grub_file_close (file); - # 202| grub_free (suffix); - # 203| grub_free (entrysrc); - -So, remove the extra file close call. - -Signed-off-by: Leo Sandoval -Reviewed-by: Daniel Kiper ---- - grub-core/commands/legacycfg.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c -index 2c5d1a0ef..86bcda695 100644 ---- a/grub-core/commands/legacycfg.c -+++ b/grub-core/commands/legacycfg.c -@@ -198,7 +198,6 @@ legacy_file (const char *filename) - const char **args = grub_malloc (sizeof (args[0])); - if (!args) - { -- grub_file_close (file); - grub_free (suffix); - grub_free (entrysrc); - return grub_errno; diff --git a/0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch b/0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch similarity index 100% rename from 0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch rename to 0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch diff --git a/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch b/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch deleted file mode 100644 index 759cd4f9..00000000 --- a/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Wed, 22 Jan 2025 13:37:42 -0600 -Subject: [PATCH] disk/ahci.c: remove conditional operator for endtime - -The conditional makes no sense when the two possible expressions have the same -value, so remove it (perhaps the compiler does it for us but better to remove -it). - -Signed-off-by: Leo Sandoval ---- - grub-core/disk/ahci.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/grub-core/disk/ahci.c b/grub-core/disk/ahci.c -index e7b5dc5f2..b247161b9 100644 ---- a/grub-core/disk/ahci.c -+++ b/grub-core/disk/ahci.c -@@ -1038,7 +1038,7 @@ grub_ahci_readwrite_real (struct grub_ahci_device *dev, - grub_dprintf ("ahci", "AHCI tfd = %x\n", - dev->hba->ports[dev->port].task_file_data); - -- endtime = grub_get_time_ms () + (spinup ? 20000 : 20000); -+ endtime = grub_get_time_ms () + 20000; - while ((dev->hba->ports[dev->port].command_issue & 1)) - if (grub_get_time_ms () > endtime || - (dev->hba->ports[dev->port].intstatus & GRUB_AHCI_HBA_PORT_IS_FATAL_MASK)) diff --git a/0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch b/0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch similarity index 100% rename from 0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch rename to 0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch diff --git a/0288-commands-bli-Fix-crash-in-get_part_uuid.patch b/0288-commands-bli-Fix-crash-in-get_part_uuid.patch deleted file mode 100644 index fe26cecb..00000000 --- a/0288-commands-bli-Fix-crash-in-get_part_uuid.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Wed, 17 Jul 2024 14:46:46 +0800 -Subject: [PATCH] commands/bli: Fix crash in get_part_uuid() - -The get_part_uuid() function made an assumption that the target GRUB -device is a partition device and accessed device->disk->partition -without checking for NULL. There are four situations where this -assumption is problematic: - -1. The device is a net device instead of a disk. -2. The device is an abstraction device, like LVM, RAID, or CRYPTO, which - is mostly logical "disk" ((lvmid/) and so on). -3. Firmware RAID may present the ESP to GRUB as an EFI disk (hd0) device - if it is contained within a Linux software RAID. -4. When booting from a CD-ROM, the ESP is a VFAT image indexed by the El - Torito boot catalog. The boot device is set to (cd0), corresponding - to the CD-ROM image mounted as an ISO 9660 filesystem. - -As a result, get_part_uuid() could lead to a NULL pointer dereference -and trigger a synchronous exception during boot if the ESP falls into -one of these categories. This patch fixes the problem by adding the -necessary checks to handle cases where the ESP is not a partition device. - -Additionally, to avoid disrupting the boot process, this patch relaxes -the severity of the errors in this context to non-critical. Errors will -be logged, but they will not prevent the boot process from continuing. - -Fixes: e0fa7dc84 (bli: Add a module for the Boot Loader Interface) - -Signed-off-by: Michael Chang -Reviewed-By: Oliver Steffen -Reviewed-by: Daniel Kiper ---- - grub-core/commands/bli.c | 20 +++++++++++++++++++- - 1 file changed, 19 insertions(+), 1 deletion(-) - -diff --git a/grub-core/commands/bli.c b/grub-core/commands/bli.c -index e0d8a54f7bea..298c5f70a876 100644 ---- a/grub-core/commands/bli.c -+++ b/grub-core/commands/bli.c -@@ -48,6 +48,22 @@ get_part_uuid (const char *device_name, char **part_uuid) - if (device == NULL) - return grub_error (grub_errno, N_("cannot open device: %s"), device_name); - -+ if (device->disk == NULL) -+ { -+ grub_dprintf ("bli", "%s is not a disk device, partuuid skipped\n", device_name); -+ *part_uuid = NULL; -+ grub_device_close (device); -+ return GRUB_ERR_NONE; -+ } -+ -+ if (device->disk->partition == NULL) -+ { -+ grub_dprintf ("bli", "%s has no partition, partuuid skipped\n", device_name); -+ *part_uuid = NULL; -+ grub_device_close (device); -+ return GRUB_ERR_NONE; -+ } -+ - disk = grub_disk_open (device->disk->name); - if (disk == NULL) - { -@@ -99,7 +115,7 @@ set_loader_device_part_uuid (void) - - status = get_part_uuid (device_name, &part_uuid); - -- if (status == GRUB_ERR_NONE) -+ if (status == GRUB_ERR_NONE && part_uuid) - status = grub_efi_set_variable_to_string ("LoaderDevicePartUUID", &bli_vendor_guid, part_uuid, - GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | - GRUB_EFI_VARIABLE_RUNTIME_ACCESS); -@@ -117,4 +133,6 @@ GRUB_MOD_INIT (bli) - GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | - GRUB_EFI_VARIABLE_RUNTIME_ACCESS); - set_loader_device_part_uuid (); -+ /* No error here is critical, other than being logged */ -+ grub_print_error (); - } diff --git a/0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch b/0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch similarity index 100% rename from 0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch rename to 0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch diff --git a/0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch b/0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch similarity index 100% rename from 0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch rename to 0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch diff --git a/0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch b/0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch similarity index 100% rename from 0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch rename to 0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch diff --git a/0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch b/0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch similarity index 100% rename from 0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch rename to 0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch diff --git a/0297-fs-iso9660-Fix-invalid-free.patch b/0292-fs-iso9660-Fix-invalid-free.patch similarity index 100% rename from 0297-fs-iso9660-Fix-invalid-free.patch rename to 0292-fs-iso9660-Fix-invalid-free.patch diff --git a/0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch b/0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch similarity index 100% rename from 0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch rename to 0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch diff --git a/0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch b/0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch similarity index 100% rename from 0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch rename to 0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch diff --git a/0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch b/0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch similarity index 100% rename from 0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch rename to 0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch diff --git a/0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch b/0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch similarity index 100% rename from 0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch rename to 0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch diff --git a/0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch b/0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch similarity index 100% rename from 0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch rename to 0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch diff --git a/0303-fs-ntfs-Fix-out-of-bounds-read.patch b/0298-fs-ntfs-Fix-out-of-bounds-read.patch similarity index 100% rename from 0303-fs-ntfs-Fix-out-of-bounds-read.patch rename to 0298-fs-ntfs-Fix-out-of-bounds-read.patch diff --git a/0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch b/0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch similarity index 100% rename from 0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch rename to 0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch diff --git a/0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch b/0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch similarity index 100% rename from 0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch rename to 0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch diff --git a/0307-fs-xfs-Fix-out-of-bounds-read.patch b/0302-fs-xfs-Fix-out-of-bounds-read.patch similarity index 100% rename from 0307-fs-xfs-Fix-out-of-bounds-read.patch rename to 0302-fs-xfs-Fix-out-of-bounds-read.patch diff --git a/0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch b/0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch similarity index 100% rename from 0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch rename to 0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch diff --git a/0309-kern-file-Ensure-file-data-is-set.patch b/0304-kern-file-Ensure-file-data-is-set.patch similarity index 100% rename from 0309-kern-file-Ensure-file-data-is-set.patch rename to 0304-kern-file-Ensure-file-data-is-set.patch diff --git a/0310-kern-file-Implement-filesystem-reference-counting.patch b/0305-kern-file-Implement-filesystem-reference-counting.patch similarity index 100% rename from 0310-kern-file-Implement-filesystem-reference-counting.patch rename to 0305-kern-file-Implement-filesystem-reference-counting.patch diff --git a/0311-cli_lock-Add-build-option-to-block-command-line-inte.patch b/0306-cli_lock-Add-build-option-to-block-command-line-inte.patch similarity index 100% rename from 0311-cli_lock-Add-build-option-to-block-command-line-inte.patch rename to 0306-cli_lock-Add-build-option-to-block-command-line-inte.patch diff --git a/0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch b/0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch similarity index 100% rename from 0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch rename to 0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch diff --git a/0313-disk-loopback-Reference-tracking-for-the-loopback.patch b/0308-disk-loopback-Reference-tracking-for-the-loopback.patch similarity index 100% rename from 0313-disk-loopback-Reference-tracking-for-the-loopback.patch rename to 0308-disk-loopback-Reference-tracking-for-the-loopback.patch diff --git a/0314-kern-disk-Limit-recursion-depth.patch b/0309-kern-disk-Limit-recursion-depth.patch similarity index 100% rename from 0314-kern-disk-Limit-recursion-depth.patch rename to 0309-kern-disk-Limit-recursion-depth.patch diff --git a/0315-kern-partition-Limit-recursion-in-part_iterate.patch b/0310-kern-partition-Limit-recursion-in-part_iterate.patch similarity index 100% rename from 0315-kern-partition-Limit-recursion-in-part_iterate.patch rename to 0310-kern-partition-Limit-recursion-in-part_iterate.patch diff --git a/0316-script-execute-Limit-the-recursion-depth.patch b/0311-script-execute-Limit-the-recursion-depth.patch similarity index 100% rename from 0316-script-execute-Limit-the-recursion-depth.patch rename to 0311-script-execute-Limit-the-recursion-depth.patch diff --git a/0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch b/0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch similarity index 100% rename from 0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch rename to 0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch diff --git a/0318-net-Remove-variables-hooks-when-interface-is-unregis.patch b/0313-net-Remove-variables-hooks-when-interface-is-unregis.patch similarity index 100% rename from 0318-net-Remove-variables-hooks-when-interface-is-unregis.patch rename to 0313-net-Remove-variables-hooks-when-interface-is-unregis.patch diff --git a/0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch b/0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch similarity index 100% rename from 0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch rename to 0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch diff --git a/0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch b/0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch similarity index 100% rename from 0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch rename to 0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch diff --git a/0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch b/0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch similarity index 100% rename from 0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch rename to 0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch diff --git a/0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch b/0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch similarity index 100% rename from 0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch rename to 0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch diff --git a/0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch b/0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch similarity index 100% rename from 0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch rename to 0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch diff --git a/0324-commands-extcmd-Missing-check-for-failed-allocation.patch b/0319-commands-extcmd-Missing-check-for-failed-allocation.patch similarity index 100% rename from 0324-commands-extcmd-Missing-check-for-failed-allocation.patch rename to 0319-commands-extcmd-Missing-check-for-failed-allocation.patch diff --git a/0325-commands-ls-Fix-NULL-dereference.patch b/0320-commands-ls-Fix-NULL-dereference.patch similarity index 100% rename from 0325-commands-ls-Fix-NULL-dereference.patch rename to 0320-commands-ls-Fix-NULL-dereference.patch diff --git a/0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch b/0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch similarity index 100% rename from 0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch rename to 0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch diff --git a/0327-normal-Remove-variables-hooks-on-module-unload.patch b/0322-normal-Remove-variables-hooks-on-module-unload.patch similarity index 100% rename from 0327-normal-Remove-variables-hooks-on-module-unload.patch rename to 0322-normal-Remove-variables-hooks-on-module-unload.patch diff --git a/0328-gettext-Remove-variables-hooks-on-module-unload.patch b/0323-gettext-Remove-variables-hooks-on-module-unload.patch similarity index 100% rename from 0328-gettext-Remove-variables-hooks-on-module-unload.patch rename to 0323-gettext-Remove-variables-hooks-on-module-unload.patch diff --git a/0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch b/0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch similarity index 100% rename from 0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch rename to 0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch diff --git a/0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch b/0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch similarity index 100% rename from 0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch rename to 0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch diff --git a/0331-commands-read-Fix-an-integer-overflow-when-supplying.patch b/0326-commands-read-Fix-an-integer-overflow-when-supplying.patch similarity index 100% rename from 0331-commands-read-Fix-an-integer-overflow-when-supplying.patch rename to 0326-commands-read-Fix-an-integer-overflow-when-supplying.patch diff --git a/0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch b/0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch similarity index 100% rename from 0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch rename to 0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch diff --git a/0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch b/0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch similarity index 100% rename from 0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch rename to 0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch diff --git a/0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch b/0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch similarity index 100% rename from 0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch rename to 0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch diff --git a/0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch b/0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch similarity index 100% rename from 0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch rename to 0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch diff --git a/0336-fs-bfs-Disable-under-lockdown.patch b/0331-fs-bfs-Disable-under-lockdown.patch similarity index 100% rename from 0336-fs-bfs-Disable-under-lockdown.patch rename to 0331-fs-bfs-Disable-under-lockdown.patch diff --git a/0337-fs-Disable-many-filesystems-under-lockdown.patch b/0332-fs-Disable-many-filesystems-under-lockdown.patch similarity index 100% rename from 0337-fs-Disable-many-filesystems-under-lockdown.patch rename to 0332-fs-Disable-many-filesystems-under-lockdown.patch diff --git a/0338-disk-Use-safe-math-macros-to-prevent-overflows.patch b/0333-disk-Use-safe-math-macros-to-prevent-overflows.patch similarity index 100% rename from 0338-disk-Use-safe-math-macros-to-prevent-overflows.patch rename to 0333-disk-Use-safe-math-macros-to-prevent-overflows.patch diff --git a/0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch b/0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch similarity index 100% rename from 0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch rename to 0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch diff --git a/0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch b/0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch similarity index 100% rename from 0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch rename to 0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch diff --git a/0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch b/0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch similarity index 100% rename from 0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch rename to 0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch diff --git a/0342-fs-Use-safe-math-macros-to-prevent-overflows.patch b/0337-fs-Use-safe-math-macros-to-prevent-overflows.patch similarity index 100% rename from 0342-fs-Use-safe-math-macros-to-prevent-overflows.patch rename to 0337-fs-Use-safe-math-macros-to-prevent-overflows.patch diff --git a/0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch b/0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch similarity index 100% rename from 0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch rename to 0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch diff --git a/0344-fs-Prevent-overflows-when-assigning-returned-values-.patch b/0339-fs-Prevent-overflows-when-assigning-returned-values-.patch similarity index 100% rename from 0344-fs-Prevent-overflows-when-assigning-returned-values-.patch rename to 0339-fs-Prevent-overflows-when-assigning-returned-values-.patch diff --git a/0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch b/0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch similarity index 100% rename from 0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch rename to 0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch diff --git a/0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch b/0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch similarity index 100% rename from 0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch rename to 0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch diff --git a/0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch b/0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch similarity index 100% rename from 0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch rename to 0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch diff --git a/0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch b/0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch similarity index 100% rename from 0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch rename to 0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch diff --git a/0349-net-Use-safe-math-macros-to-prevent-overflows.patch b/0344-net-Use-safe-math-macros-to-prevent-overflows.patch similarity index 100% rename from 0349-net-Use-safe-math-macros-to-prevent-overflows.patch rename to 0344-net-Use-safe-math-macros-to-prevent-overflows.patch diff --git a/0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch b/0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch similarity index 100% rename from 0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch rename to 0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch diff --git a/0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch b/0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch similarity index 100% rename from 0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch rename to 0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch diff --git a/0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch b/0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch similarity index 100% rename from 0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch rename to 0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch diff --git a/0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch b/0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch similarity index 100% rename from 0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch rename to 0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch diff --git a/0354-osdep-unix-getroot-Fix-potential-underflow.patch b/0349-osdep-unix-getroot-Fix-potential-underflow.patch similarity index 100% rename from 0354-osdep-unix-getroot-Fix-potential-underflow.patch rename to 0349-osdep-unix-getroot-Fix-potential-underflow.patch diff --git a/0355-misc-Ensure-consistent-overflow-error-messages.patch b/0350-misc-Ensure-consistent-overflow-error-messages.patch similarity index 100% rename from 0355-misc-Ensure-consistent-overflow-error-messages.patch rename to 0350-misc-Ensure-consistent-overflow-error-messages.patch diff --git a/0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch b/0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch similarity index 100% rename from 0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch rename to 0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch diff --git a/0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch b/0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch similarity index 100% rename from 0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch rename to 0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch diff --git a/0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch b/0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch similarity index 100% rename from 0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch rename to 0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch diff --git a/0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch b/0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch similarity index 100% rename from 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch rename to 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch diff --git a/0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch b/0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch similarity index 100% rename from 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch rename to 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch diff --git a/0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch b/0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch similarity index 100% rename from 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch rename to 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch diff --git a/0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch b/0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch similarity index 100% rename from 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch rename to 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch diff --git a/0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch b/0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch similarity index 100% rename from 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch rename to 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch diff --git a/0369-10_linux.in-escape-kernel-option-characters-properly.patch b/0359-10_linux.in-escape-kernel-option-characters-properly.patch similarity index 100% rename from 0369-10_linux.in-escape-kernel-option-characters-properly.patch rename to 0359-10_linux.in-escape-kernel-option-characters-properly.patch diff --git a/0370-blscfg-check-if-variable-is-escaped-before-consideri.patch b/0360-blscfg-check-if-variable-is-escaped-before-consideri.patch similarity index 100% rename from 0370-blscfg-check-if-variable-is-escaped-before-consideri.patch rename to 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch diff --git a/0379-loader-efi-chainloader-Fix-double-free.patch b/0361-loader-efi-chainloader-Fix-double-free.patch similarity index 100% rename from 0379-loader-efi-chainloader-Fix-double-free.patch rename to 0361-loader-efi-chainloader-Fix-double-free.patch diff --git a/0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch b/0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch similarity index 100% rename from 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch rename to 0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch diff --git a/0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch b/0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch similarity index 88% rename from 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch rename to 0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch index 95628b3b..04e038e9 100644 --- a/0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch +++ b/0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch @@ -22,10 +22,10 @@ Reviewed-by: Daniel Kiper 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index b832593213e6..4bf386b590b5 100644 +index 527d4f0c538a..7872a8d03a0b 100644 --- a/grub-core/osdep/linux/getroot.c +++ b/grub-core/osdep/linux/getroot.c -@@ -127,7 +127,7 @@ struct btrfs_ioctl_search_args { +@@ -119,7 +119,7 @@ struct btrfs_ioctl_search_args { struct btrfs_ioctl_fs_info_args) static int @@ -34,7 +34,7 @@ index b832593213e6..4bf386b590b5 100644 #define ESCAPED_PATH_MAX (4 * PATH_MAX) -@@ -759,10 +759,10 @@ out: +@@ -638,10 +638,10 @@ out: } static int @@ -47,7 +47,7 @@ index b832593213e6..4bf386b590b5 100644 int container_seen = 0; const char *dev = os_dev; -@@ -823,10 +823,17 @@ grub_util_is_imsm (const char *os_dev) +@@ -702,10 +702,17 @@ grub_util_is_imsm (const char *os_dev) if (strncmp (buf, "MD_METADATA=imsm", sizeof ("MD_METADATA=imsm") - 1) == 0) { @@ -66,7 +66,7 @@ index b832593213e6..4bf386b590b5 100644 } free (buf); -@@ -837,7 +844,7 @@ grub_util_is_imsm (const char *os_dev) +@@ -716,7 +723,7 @@ grub_util_is_imsm (const char *os_dev) if (dev != os_dev) free ((void *) dev); @@ -75,7 +75,7 @@ index b832593213e6..4bf386b590b5 100644 } char * -@@ -1202,7 +1209,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) +@@ -1081,7 +1088,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) /* Check for RAID. */ if (!strncmp (os_dev, "/dev/md", 7) && ! grub_util_device_is_mapped (os_dev) diff --git a/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch b/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch deleted file mode 100644 index 1e7dc90d..00000000 --- a/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch +++ /dev/null @@ -1,117 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Avnish Chouhan -Date: Thu, 13 Mar 2025 19:45:50 +0530 -Subject: [PATCH] powerpc: increase MIN RMA size for CAS negotiation - -Change RMA size from 512 MB to 768 MB which will result -in more memory at boot time for PowerPC. When vTPM, Secure Boot or -FADump are enabled on PowerPC, the 512 MB RMA memory is not sufficient for -booting. With this 512 MB RMA, GRUB2 runs out of memory and fails to -boot the machine. Sometimes even usage of CDROM requires more memory -for installation and along with the options mentioned above exhausts -the boot memory which results in boot failures. Increasing the RMA size -will resolves multiple out of memory issues observed in PowerPC. - -Failure details (GRUB2 debugs): - - kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 1 - kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space - kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 0 - kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space - kern/file.c:215: Closing `/ppc/ppc64/initrd.img' ... - kern/disk.c:297: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000'... - kern/disk.c:311: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000' succeeded. - kern/file.c:225: Closing `/ppc/ppc64/initrd.img' failed with 3. - kern/file.c:148: Opening `/ppc/ppc64/initrd.img' succeeded. - error: ../../grub-core/kern/mm.c:552:out of memory. - -Signed-off-by: Avnish Chouhan ---- - grub-core/kern/ieee1275/init.c | 51 +++++++++++++++++++++++++++++++++++++----- - 1 file changed, 46 insertions(+), 5 deletions(-) - -diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c -index 4ec6598cfbb8..bb791f80f41c 100644 ---- a/grub-core/kern/ieee1275/init.c -+++ b/grub-core/kern/ieee1275/init.c -@@ -737,7 +737,7 @@ struct cas_vector - - /* - * Call ibm,client-architecture-support to try to get more RMA. -- * We ask for 512MB which should be enough to verify a distro kernel. -+ * We ask for 768MB which should be enough to verify a distro kernel. - * We ignore most errors: if we don't succeed we'll proceed with whatever - * memory we have. - */ -@@ -809,7 +809,7 @@ grub_ieee1275_ibm_cas (void) - .vec1 = 0x80, /* ignore */ - .vec2_size = 1 + sizeof (struct option_vector2) - 2, - .vec2 = { -- 0, 0, -1, -1, -1, -1, -1, 512, -1, 0, 48 -+ 0, 0, -1, -1, -1, -1, -1, 768, -1, 0, 48 - }, - .vec3_size = 2 - 1, - .vec3 = 0x00e0, /* ask for FP + VMX + DFP but don't halt if unsatisfied */ -@@ -846,6 +846,10 @@ grub_claim_heap (void) - { - grub_err_t err; - grub_uint32_t total = HEAP_MAX_SIZE; -+#if defined(__powerpc__) -+ grub_uint32_t ibm_ca_support_reboot = 0; -+ grub_ssize_t actual; -+#endif - - err = grub_ieee1275_total_mem (&rmo_top); - -@@ -858,11 +862,48 @@ grub_claim_heap (void) - grub_mm_add_region_fn = grub_ieee1275_mm_add_region; - - #if defined(__powerpc__) -+ /* Check if it's a CAS reboot with below property. If so, we will skip CAS call */ -+ if (grub_ieee1275_get_integer_property (grub_ieee1275_chosen, -+ "ibm,client-architecture-support-reboot", -+ &ibm_ca_support_reboot, -+ sizeof (ibm_ca_support_reboot), -+ &actual) >= 0) -+ grub_dprintf ("ieee1275", "ibm,client-architecture-support-reboot: %" PRIuGRUB_UINT32_T "\n", -+ ibm_ca_support_reboot); -+ - if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY)) - { -- /* if we have an error, don't call CAS, just hope for the best */ -- if (err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) -- grub_ieee1275_ibm_cas (); -+ /* -+ * If we have an error, don't call CAS. Just hope for the best. -+ * Along with the above, if the rmo_top is 512 MB or above. We -+ * will skip the CAS call. However, if we call CAS, the rmo_top -+ * will be set to 768 MB via CAS Vector2. But we need to call -+ * CAS with "rmo_top < 512 MB" to avoid the issue on the older -+ * Linux kernel, which still uses rmo_top as 512 MB. If we call -+ * CAS with a condition "rmo_top < 768 MB", it will result in an -+ * issue due to the IBM CAS reboot feature and we won't be able -+ * to boot the newer kernel. Whenever a reboot is detected as -+ * the CAS reboot by GRUB. It will boot the machine with the -+ * last booted kernel by reading the variable "boot-last-label" -+ * which has the info related to the last boot and it's specific -+ * to IBM PowerPC. Due to this, the machine will boot with the -+ * last booted kernel which has rmo_top as 512 MB. Also, if the -+ * reboot is detected as a CAS reboot, the GRUB will skip the CAS -+ * call. As the CAS has already been called earlier, so it is -+ * not required to call CAS even if the other conditions are met. -+ * This condition will also prevent a scenario where the machine -+ * get stuck in the CAS reboot loop while booting. A machine with -+ * an older kernel, having option_vector2 MIN_RMA as 512 MB in -+ * Linux prom_init.c and GRUB uses "rmo_top < 768 MB" condition -+ * for calling CAS. Due to their respective conditions, linux -+ * CAS and GRUB CAS will keep doing the CAS calls and change -+ * the MIN_RMA from 768(changed by GRUB) to 512(changed by Linux) -+ * to 768(changed by GRUB) to 512(changed by Linux) and so on, -+ * and the machine will stuck in this CAS reboot loop forever. -+ * IBM PAPR : https://openpower.foundation/specifications/linuxonpower/ -+ */ -+ if (!ibm_ca_support_reboot && err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) -+ grub_ieee1275_ibm_cas (); - } - #endif - diff --git a/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch b/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch deleted file mode 100644 index fd2eb2bf..00000000 --- a/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: James Le Cuirot -Date: Thu, 24 Oct 2024 14:42:46 +0100 -Subject: [PATCH] script/execute: Don't let trailing blank lines determine the - return code - -grub_script_execute_sourcecode() parses and executes code one line at a -time, updating the return code each time because only the last line -determines the final status. However, trailing new lines were also -executed, masking any failure on the previous line. Fix this by only -trying to execute the command when there is actually one present. - -This has presumably never been noticed because this code is not used by -regular functions, only in special cases like eval and menu entries. The -latter generally don't return at all, having booted an OS. When failing -to boot, upstream GRUB triggers the fallback mechanism regardless of the -return code. - -We noticed the problem while using Red Hat's patches, which change this -behaviour to take account of the return code. In that case, a failure -takes you back to the menu rather than triggering a fallback. - -Signed-off-by: James Le Cuirot ---- - grub-core/script/execute.c | 5 ++++- - tests/grub_script_eval.in | 10 +++++++++- - 2 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c -index 014132703..3d26a3fe4 100644 ---- a/grub-core/script/execute.c -+++ b/grub-core/script/execute.c -@@ -952,7 +952,10 @@ grub_script_execute_sourcecode (const char *source) - break; - } - -- ret = grub_script_execute (parsed_script); -+ /* Don't let trailing blank lines determine the return code. */ -+ if (parsed_script->cmd) -+ ret = grub_script_execute (parsed_script); -+ - grub_script_free (parsed_script); - grub_free (line); - } -diff --git a/tests/grub_script_eval.in b/tests/grub_script_eval.in -index c97b78d77..9c6211042 100644 ---- a/tests/grub_script_eval.in -+++ b/tests/grub_script_eval.in -@@ -3,4 +3,12 @@ - eval echo "Hello world" - valname=tst - eval $valname=hi --echo $tst -\ No newline at end of file -+echo $tst -+ -+if eval " -+false -+"; then -+ echo should have failed -+else -+ echo failed as expected -+fi --- -2.48.1 - diff --git a/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch b/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch deleted file mode 100644 index 3ce0eec3..00000000 --- a/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: James Le Cuirot -Date: Thu, 24 Oct 2024 15:00:26 +0100 -Subject: [PATCH] normal/menu: Check return code of the script when executing a - menu entry - -Don't rely on grub_errno here because grub_script_execute_new_scope() -calls grub_print_error(), which always resets grub_errno back to -GRUB_ERR_NONE. It may also get reset by grub_wait_after_message(). - -This problem was observed when a "bad signature" error resulted in the -menu being redisplayed rather than the fallback mechanism being -triggered, although another change was also needed to fix it. This only -happens with Red Hat's patches because upstream GRUB triggers the -fallback mechanism regardless of the return code. - -Signed-off-by: James Le Cuirot ---- - grub-core/normal/menu.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c -index 97687013c..a2703dabb 100644 ---- a/grub-core/normal/menu.c -+++ b/grub-core/normal/menu.c -@@ -377,14 +377,14 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) - if (ptr && ptr[0] && ptr[1]) - grub_env_set ("default", ptr + 1); - -- grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); -+ err = grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); - - if (errs_before != grub_err_printed_errors) - grub_wait_after_message (); - - errs_before = grub_err_printed_errors; - -- if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ()) -+ if (err == GRUB_ERR_NONE && grub_loader_is_loaded ()) - /* Implicit execution of boot, only if something is loaded. */ - err = grub_command_execute ("boot", 0, 0); - --- -2.48.1 - diff --git a/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch b/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch deleted file mode 100644 index 25023c80..00000000 --- a/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Sudhakar Kuppusamy -Date: Wed, 23 Oct 2024 17:54:32 +0530 -Subject: [PATCH] grub-mkimage: Create new ELF note for SBAT - -In order to store the SBAT data we create a new ELF note. The string -".sbat", zero-padded to 4 byte alignment, shall be entered in the name -field. The string "SBAT"'s ASCII values, 0x53424154, should be entered -in the type field. - -Signed-off-by: Daniel Axtens -Signed-off-by: Sudhakar Kuppusamy -Reviewed-by: Daniel Kiper ---- - include/grub/util/mkimage.h | 4 ++-- - util/grub-mkimagexx.c | 48 +++++++++++++++++++++++++++++++++++++++++++-- - util/mkimage.c | 5 +++-- - 3 files changed, 51 insertions(+), 6 deletions(-) - -diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h -index 6f1da89b9b65..881e3031f41f 100644 ---- a/include/grub/util/mkimage.h -+++ b/include/grub/util/mkimage.h -@@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, - const struct grub_install_image_target_desc *image_target); - void - grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, -- int note, size_t appsig_size, char **core_img, size_t *core_size, -+ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, - Elf32_Addr target_addr, - struct grub_mkimage_layout *layout); - void - grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, -- int note, size_t appsig_size, char **core_img, size_t *core_size, -+ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, - Elf64_Addr target_addr, - struct grub_mkimage_layout *layout); - -diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c -index 9488f052510a..b9930544889d 100644 ---- a/util/grub-mkimagexx.c -+++ b/util/grub-mkimagexx.c -@@ -116,6 +116,14 @@ struct section_metadata - const char *strtab; - }; - -+#define GRUB_SBAT_NOTE_NAME ".sbat" -+#define GRUB_SBAT_NOTE_TYPE 0x53424154 /* "SBAT" */ -+ -+struct grub_sbat_note { -+ Elf32_Nhdr header; -+ char name[ALIGN_UP(sizeof(GRUB_SBAT_NOTE_NAME), 4)]; -+}; -+ - static int - is_relocatable (const struct grub_install_image_target_desc *image_target) - { -@@ -217,7 +225,7 @@ grub_arm_reloc_jump24 (grub_uint32_t *target, Elf32_Addr sym_addr) - - void - SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc *image_target, -- int note, size_t appsig_size, char **core_img, size_t *core_size, -+ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, - Elf_Addr target_addr, - struct grub_mkimage_layout *layout) - { -@@ -226,10 +234,17 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc - Elf_Ehdr *ehdr; - Elf_Phdr *phdr; - Elf_Shdr *shdr; -- int header_size, footer_size = 0; -+ int header_size, footer_size = 0, footer_offset = 0; - int phnum = 1; - int shnum = 4; - int string_size = sizeof (".text") + sizeof ("mods") + 1; -+ char *footer; -+ -+ if (sbat) -+ { -+ phnum++; -+ footer_size += ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); -+ } - - if (appsig_size) - { -@@ -263,6 +278,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc - ehdr = (void *) elf_img; - phdr = (void *) (elf_img + sizeof (*ehdr)); - shdr = (void *) (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr)); -+ footer = elf_img + program_size + header_size; - memcpy (ehdr->e_ident, ELFMAG, SELFMAG); - ehdr->e_ident[EI_CLASS] = ELFCLASSXX; - if (!image_target->bigendian) -@@ -435,6 +451,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc - phdr->p_filesz = grub_host_to_target32 (XEN_NOTE_SIZE); - phdr->p_memsz = 0; - phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = ptr; -+ footer_offset = XEN_NOTE_SIZE; - } - - if (image_target->id == IMAGE_XEN_PVH) -@@ -468,6 +486,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc - phdr->p_filesz = grub_host_to_target32 (XEN_PVH_NOTE_SIZE); - phdr->p_memsz = 0; - phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = ptr; -+ footer_offset = XEN_PVH_NOTE_SIZE; - } - - if (note) -@@ -498,6 +518,30 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc - phdr->p_filesz = grub_host_to_target32 (note_size); - phdr->p_memsz = 0; - phdr->p_offset = grub_host_to_target32 (header_size + program_size); -+ footer = (elf_img + program_size + header_size + note_size); -+ footer_offset += note_size; -+ } -+ -+ if (sbat) -+ { -+ int note_size = ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); -+ struct grub_sbat_note *note_ptr = (struct grub_sbat_note *) footer; -+ -+ note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_SBAT_NOTE_NAME)); -+ note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(layout->sbat_size, 4)); -+ note_ptr->header.n_type = grub_host_to_target32 (GRUB_SBAT_NOTE_TYPE); -+ memcpy (note_ptr->name, GRUB_SBAT_NOTE_NAME, sizeof (GRUB_SBAT_NOTE_NAME)); -+ memcpy ((char *)(note_ptr + 1), sbat, layout->sbat_size); -+ -+ phdr++; -+ phdr->p_type = grub_host_to_target32 (PT_NOTE); -+ phdr->p_flags = grub_host_to_target32 (PF_R); -+ phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); -+ phdr->p_vaddr = 0; -+ phdr->p_paddr = 0; -+ phdr->p_filesz = grub_host_to_target32 (note_size); -+ phdr->p_memsz = 0; -+ phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); - } - - if (appsig_size) { -diff --git a/util/mkimage.c b/util/mkimage.c -index f31fdefa814a..7fa6a7b21954 100644 ---- a/util/mkimage.c -+++ b/util/mkimage.c -@@ -1848,6 +1848,7 @@ grub_install_generate_image (const char *dir, const char *prefix, - case IMAGE_I386_IEEE1275: - { - grub_uint64_t target_addr; -+ char *sbat = NULL; - if (image_target->id == IMAGE_LOONGSON_ELF) - { - if (comp == GRUB_COMPRESSION_NONE) -@@ -1859,10 +1860,10 @@ grub_install_generate_image (const char *dir, const char *prefix, - else - target_addr = image_target->link_addr; - if (image_target->voidp_sizeof == 4) -- grub_mkimage_generate_elf32 (image_target, note, appsig_size, &core_img, -+ grub_mkimage_generate_elf32 (image_target, note, appsig_size, sbat, &core_img, - &core_size, target_addr, &layout); - else -- grub_mkimage_generate_elf64 (image_target, note, appsig_size, &core_img, -+ grub_mkimage_generate_elf64 (image_target, note, appsig_size, sbat, &core_img, - &core_size, target_addr, &layout); - } - break; diff --git a/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch b/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch deleted file mode 100644 index 1ce74aed..00000000 --- a/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Sudhakar Kuppusamy -Date: Wed, 23 Oct 2024 17:54:33 +0530 -Subject: [PATCH] grub-mkimage: Add SBAT metadata into ELF note for PowerPC - targets - -The SBAT metadata is read from CSV file and transformed into an ELF note -with the -s option. - -Signed-off-by: Daniel Axtens -Signed-off-by: Sudhakar Kuppusamy -Reviewed-by: Daniel Kiper ---- - util/mkimage.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/util/mkimage.c b/util/mkimage.c -index 7fa6a7b21954..f92949d1df25 100644 ---- a/util/mkimage.c -+++ b/util/mkimage.c -@@ -957,8 +957,8 @@ grub_install_generate_image (const char *dir, const char *prefix, - total_module_size += dtb_size + sizeof (struct grub_module_header); - } - -- if (sbat_path != NULL && image_target->id != IMAGE_EFI) -- grub_util_error (_(".sbat section can be embedded into EFI images only")); -+ if (sbat_path != NULL && (image_target->id != IMAGE_EFI && image_target->id != IMAGE_PPC)) -+ grub_util_error (_("SBAT data can be added only to EFI or powerpc-ieee1275 images")); - - if (disable_shim_lock) - total_module_size += sizeof (struct grub_module_header); -@@ -1849,6 +1849,13 @@ grub_install_generate_image (const char *dir, const char *prefix, - { - grub_uint64_t target_addr; - char *sbat = NULL; -+ if (sbat_path != NULL) -+ { -+ sbat_size = grub_util_get_image_size (sbat_path); -+ sbat = xmalloc (sbat_size); -+ grub_util_load_image (sbat_path, sbat); -+ layout.sbat_size = sbat_size; -+ } - if (image_target->id == IMAGE_LOONGSON_ELF) - { - if (comp == GRUB_COMPRESSION_NONE) diff --git a/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch b/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch deleted file mode 100644 index 5d588b1c..00000000 --- a/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Fri, 28 Feb 2025 17:00:53 +0300 -Subject: [PATCH] kern/rescue_reader: Block the rescue mode until the CLI - authentication - -This further mitigates potential misuse of the CLI after the -root device has been successfully unlocked via TPM. - -Fixes: CVE-2025-4382 - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/kern/rescue_reader.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c -index 4259857ba9..a71ada8fb7 100644 ---- a/grub-core/kern/rescue_reader.c -+++ b/grub-core/kern/rescue_reader.c -@@ -79,7 +79,7 @@ void __attribute__ ((noreturn)) - grub_rescue_run (void) - { - /* Stall if the CLI has been disabled */ -- if (grub_is_cli_disabled ()) -+ if (grub_is_cli_disabled () || grub_is_cli_need_auth ()) - { - grub_printf ("Rescue mode has been disabled...\n"); - diff --git a/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch b/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch deleted file mode 100644 index 53e7eaae..00000000 --- a/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Sat, 1 Mar 2025 14:16:48 +0300 -Subject: [PATCH] commands/search: Introduce the --cryptodisk-only argument - -This allows users to restrict the "search" command's scope to -encrypted disks only. - -Typically, this command is used to "rebase" $root and $prefix -before loading additional configuration files via "source" or -"configfile". Unfortunately, this leads to security problems, -like CVE-2023-4001, when an unexpected, attacker-controlled -device is chosen by the "search" command. - -The --cryptodisk-only argument allows users to ensure that the -file system picked is encrypted. - -This feature supports the CLI authentication, blocking bypass -attempts. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/commands/search.c | 20 ++++++++++++++++++++ - grub-core/commands/search_wrap.c | 7 ++++++- - grub-core/normal/main.c | 3 ++- - include/grub/search.h | 9 +++++---- - 4 files changed, 33 insertions(+), 6 deletions(-) - -diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index d538b36219..84362b54b3 100644 ---- a/grub-core/commands/search.c -+++ b/grub-core/commands/search.c -@@ -182,6 +182,26 @@ iterate_device (const char *name, void *data) - grub_device_close (dev); - } - -+ /* Limit to encrypted disks when requested. */ -+ if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY) -+ { -+ grub_device_t dev; -+ -+ dev = grub_device_open (name); -+ if (dev == NULL) -+ { -+ grub_errno = GRUB_ERR_NONE; -+ return 0; -+ } -+ if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ grub_device_close (dev); -+ grub_errno = GRUB_ERR_NONE; -+ return 0; -+ } -+ grub_device_close (dev); -+ } -+ - /* Skip it if it's not the root device when requested. */ - if (ctx->flags & SEARCH_FLAGS_ROOTDEV_ONLY) - { -diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c -index 4fe6440c65..ec2fb638f1 100644 ---- a/grub-core/commands/search_wrap.c -+++ b/grub-core/commands/search_wrap.c -@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] = - ARG_TYPE_STRING}, - {"no-floppy", 'n', 0, N_("Do not probe any floppy drive."), 0, 0}, - {"efidisk-only", 0, 0, N_("Only probe EFI disks."), 0, 0}, -+ {"cryptodisk-only", 0, 0, N_("Only probe encrypted disks."), 0, 0}, - {"root-dev-only", 'r', 0, N_("Only probe root device."), 0, 0}, - {"hint", 'h', GRUB_ARG_OPTION_REPEATABLE, - N_("First try the device HINT. If HINT ends in comma, " -@@ -76,6 +77,7 @@ enum options - SEARCH_SET, - SEARCH_NO_FLOPPY, - SEARCH_EFIDISK_ONLY, -+ SEARCH_CRYPTODISK_ONLY, - SEARCH_ROOTDEV_ONLY, - SEARCH_HINT, - SEARCH_HINT_IEEE1275, -@@ -191,6 +193,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args) - if (state[SEARCH_EFIDISK_ONLY].set) - flags |= SEARCH_FLAGS_EFIDISK_ONLY; - -+ if (state[SEARCH_CRYPTODISK_ONLY].set) -+ flags |= SEARCH_FLAGS_CRYPTODISK_ONLY; -+ - if (state[SEARCH_ROOTDEV_ONLY].set) - flags |= SEARCH_FLAGS_ROOTDEV_ONLY; - -@@ -215,7 +220,7 @@ GRUB_MOD_INIT(search) - cmd = - grub_register_extcmd ("search", grub_cmd_search, - GRUB_COMMAND_FLAG_EXTRACTOR | GRUB_COMMAND_ACCEPT_DASH, -- N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]" -+ N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint HINT [--hint HINT] ...]" - " NAME"), - N_("Search devices by file, filesystem label" - " or filesystem UUID." -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index dd20e51290..6f7290a897 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -615,7 +615,8 @@ static const char *features[] = { - "feature_chainloader_bpb", "feature_ntldr", "feature_platform_search_hint", - "feature_default_font_path", "feature_all_video_module", - "feature_menuentry_id", "feature_menuentry_options", "feature_200_final", -- "feature_nativedisk_cmd", "feature_timeout_style" -+ "feature_nativedisk_cmd", "feature_timeout_style", -+ "feature_search_cryptodisk_only" - }; - - GRUB_MOD_INIT(normal) -diff --git a/include/grub/search.h b/include/grub/search.h -index 9343c66b13..b6b5c8be1f 100644 ---- a/include/grub/search.h -+++ b/include/grub/search.h -@@ -21,10 +21,11 @@ - - enum search_flags - { -- SEARCH_FLAGS_NONE = 0, -- SEARCH_FLAGS_NO_FLOPPY = 1, -- SEARCH_FLAGS_EFIDISK_ONLY = 2, -- SEARCH_FLAGS_ROOTDEV_ONLY = 4 -+ SEARCH_FLAGS_NONE = 0, -+ SEARCH_FLAGS_NO_FLOPPY = 1, -+ SEARCH_FLAGS_EFIDISK_ONLY = 2, -+ SEARCH_FLAGS_ROOTDEV_ONLY = 4, -+ SEARCH_FLAGS_CRYPTODISK_ONLY = 8 - }; - - void grub_search_fs_file (const char *key, const char *var, diff --git a/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch b/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch deleted file mode 100644 index a56fc858..00000000 --- a/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Sun, 2 Mar 2025 18:08:22 +0300 -Subject: [PATCH] disk/diskfilter: Introduce the "cryptocheck" command - -This command examines a given diskfilter device, e.g., an LVM disk, -and checks if underlying disks, physical volumes, are cryptodisks, -e.g., LUKS disks, this layout is called "LVM-on-LUKS". - -The return value is 0 when all underlying disks (of a given device) -are cryptodisks (1 if at least one disk is unencrypted or in an -unknown state). - -Users are encouraged to include the relevant check before loading -anything from an LVM disk that is supposed to be encrypted. - -This further supports the CLI authentication, blocking bypass -attempts when booting from an encrypted LVM disk. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/disk/diskfilter.c | 75 +++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 75 insertions(+) - -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index fef0b815ab..216be6a782 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1365,6 +1366,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk, - } - #endif - -+static int -+grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt) -+{ -+ struct grub_diskfilter_lv *lv = disk->data; -+ struct grub_diskfilter_pv *pv; -+ -+ *pvs_cnt = 0; -+ -+ if (lv->vg->pvs) -+ for (pv = lv->vg->pvs; pv; pv = pv->next) -+ { -+ (*pvs_cnt)++; -+ -+ if (pv->disk == NULL) -+ { -+ /* Can be a partially activated VG, bail out. */ -+ return GRUB_ERR_TEST_FAILURE; -+ } -+ -+ if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ { -+ /* All backing devices must be cryptodisks, stop. */ -+ return GRUB_ERR_TEST_FAILURE; -+ } -+ } -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), -+ int argc, char **args) -+{ -+ grub_disk_t disk; -+ int check_pvs_res; -+ int namelen; -+ int pvs_cnt; -+ -+ if (argc != 1) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); -+ -+ namelen = grub_strlen (args[0]); -+ if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')')) -+ args[0][namelen - 1] = 0; -+ else -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"), -+ args[0]); -+ -+ if (!is_valid_diskfilter_name (&args[0][1])) -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk: %s"), -+ &args[0][1]); -+ -+ disk = grub_disk_open (&args[0][1]); -+ if (disk == NULL) -+ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"), -+ &args[0][1]); -+ -+ check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); -+ grub_disk_close (disk); -+ -+ grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -+ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -+ pvs_cnt, -+ (pvs_cnt > 1) ? "s" : ""); -+ -+ return check_pvs_res; -+} -+ - static struct grub_disk_dev grub_diskfilter_dev = - { - .name = "diskfilter", -@@ -1381,14 +1449,21 @@ static struct grub_disk_dev grub_diskfilter_dev = - .next = 0 - }; - -+static grub_command_t cmd; -+ - - GRUB_MOD_INIT(diskfilter) - { - grub_disk_dev_register (&grub_diskfilter_dev); -+ cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, -+ N_("DEVICE"), -+ N_("Check if a logical volume resides on encrypted disks.")); - } - - GRUB_MOD_FINI(diskfilter) - { - grub_disk_dev_unregister (&grub_diskfilter_dev); -+ if (cmd != NULL) -+ grub_unregister_command (cmd); - free_array (); - } diff --git a/0374-commands-search-Add-the-diskfilter-support.patch b/0374-commands-search-Add-the-diskfilter-support.patch deleted file mode 100644 index 5edb3ea8..00000000 --- a/0374-commands-search-Add-the-diskfilter-support.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Sun, 2 Mar 2025 23:32:43 +0300 -Subject: [PATCH] commands/search: Add the diskfilter support - -When the --cryptodisk-only argument is given, also check the target -device using the "cryptocheck" command, if available. - -This extends the checks to common layouts like LVM-on-LUKS, so the ---cryptodisk-only argument transparently handles such setups. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/commands/search.c | 32 +++++++++++++++++++++++++++++++- - 1 file changed, 31 insertions(+), 1 deletion(-) - -diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index 84362b54b3..1cf714ad7d 100644 ---- a/grub-core/commands/search.c -+++ b/grub-core/commands/search.c -@@ -150,6 +150,36 @@ check_for_duplicate (const char *name, void *data) - return ret; - } - -+static bool -+is_unencrypted_disk (grub_disk_t disk) -+{ -+ grub_command_t cmd; -+ char *disk_str; -+ int disk_str_len; -+ int res; -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ return false; /* This is (crypto) disk. */ -+ -+ if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) -+ { -+ cmd = grub_command_find ("cryptocheck"); -+ if (cmd == NULL) /* No diskfilter module loaded for some reason. */ -+ return true; -+ -+ disk_str_len = grub_strlen (disk->name) + 2 + 1; -+ disk_str = grub_malloc (disk_str_len); -+ if (disk_str == NULL) /* Something is wrong, better report as unencrypted. */ -+ return true; -+ -+ grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); -+ res = cmd->func (cmd, 1, &disk_str); -+ grub_free (disk_str); -+ return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ -+ } -+ return true; -+} -+ - /* Helper for FUNC_NAME. */ - static int - iterate_device (const char *name, void *data) -@@ -193,7 +223,7 @@ iterate_device (const char *name, void *data) - grub_errno = GRUB_ERR_NONE; - return 0; - } -- if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true) - { - grub_device_close (dev); - grub_errno = GRUB_ERR_NONE; diff --git a/0375-docs-Document-available-crypto-disks-checks.patch b/0375-docs-Document-available-crypto-disks-checks.patch deleted file mode 100644 index ac22920f..00000000 --- a/0375-docs-Document-available-crypto-disks-checks.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Mon, 10 Mar 2025 15:33:46 +0300 -Subject: [PATCH] docs: Document available crypto disks checks - -Document the --cryptodisk-only argument. Also, document the -"cryptocheck" command invoked when that argument is processed. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 22 +++++++++++++++++++++- - 1 file changed, 21 insertions(+), 1 deletion(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 2d6d73a78d..93e23be99d 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4365,6 +4365,7 @@ you forget a command, you can run the command @command{help} - * configfile:: Load a configuration file - * cpuid:: Check for CPU features - * crc:: Compute or check CRC32 checksums -+* cryptocheck:: Check if a device is encrypted - * cryptomount:: Mount a crypto device - * cutmem:: Remove memory regions - * date:: Display or set current date and time -@@ -4674,6 +4675,16 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} - (@pxref{hashsum}) for full description. - @end deffn - -+@node cryptocheck -+@subsection cryptocheck -+ -+@deffn Command cryptocheck device -+Check if a given diskfilter device is backed by encrypted devices -+(@pxref{cryptomount} for additional information). -+ -+The command examines all backing devices, physical volumes, of a specified -+logical volume, like LVM2, and fails when at least one of them is unencrypted. -+@end deffn - - @node cryptomount - @subsection cryptomount -@@ -5522,7 +5533,8 @@ unbootable. @xref{Using GPG-style digital signatures}, for more information. - - @deffn Command search @ - [@option{--file}|@option{--label}|@option{--fs-uuid}] @ -- [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}] name -+ [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}|@option{--cryptodisk-only}] @ -+ name - Search devices by file (@option{-f}, @option{--file}), filesystem label - (@option{-l}, @option{--label}), or filesystem UUID (@option{-u}, - @option{--fs-uuid}). -@@ -5537,6 +5549,14 @@ devices, which can be slow. - The (@option{--efidisk-only}) option prevents searching any other devices then - EFI disks. This is typically used when chainloading to local EFI partition. - -+The (@option{--cryptodisk-only}) option prevents searching any devices other -+than encrypted disks. This is typically used when booting from an encrypted -+file system to ensure that no code gets executed from an unencrypted device -+having the same filesystem UUID or label. -+ -+This option implicitly invokes the command @command{cryptocheck}, if it is -+available (@pxref{cryptocheck} for additional information). -+ - The @samp{search.file}, @samp{search.fs_label}, and @samp{search.fs_uuid} - commands are aliases for @samp{search --file}, @samp{search --label}, and - @samp{search --fs-uuid} respectively. diff --git a/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch b/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch deleted file mode 100644 index 5a995cf3..00000000 --- a/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch +++ /dev/null @@ -1,147 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Tue, 6 May 2025 12:25:20 -0600 -Subject: [PATCH] disk/cryptodisk: Add the "erase secrets" function - -This commit adds the grub_cryptodisk_erasesecrets() function to wipe -master keys from all cryptodisks. This function is EFI-only. - -Since there is no easy way to "force unmount" a given encrypted disk, -this function renders all mounted cryptodisks unusable. An attempt to -read them will return garbage. - -This is why this function must be used in "no way back" conditions. - -Currently, it is used when unloading the cryptodisk module and when -performing the "exit" command (it is often used to switch to the next -EFI application). This function is not called when performing the -"chainloader" command, because the callee may return to GRUB. For this -reason, users are encouraged to use "exit" instead of "chainloader" to -execute third-party boot applications. - -This function does not guarantee that all secrets are wiped from RAM. -Console output, chunks from disk read requests and other may remain. - -This function does not clear the IV prefix and rekey key for geli disks. - -Also, this commit adds the relevant documentation improvements. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 6 ++++++ - grub-core/commands/minicmd.c | 11 +++++++++++ - grub-core/disk/cryptodisk.c | 28 ++++++++++++++++++++++++++++ - include/grub/cryptodisk.h | 1 + - 4 files changed, 46 insertions(+) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 93e23be99d..0af47b5ade 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4721,6 +4721,11 @@ namespace in addition to the cryptodisk namespace. - - Support for plain encryption mode (plain dm-crypt) is provided via separate - @command{@pxref{plainmount}} command. -+ -+On the EFI platform, GRUB tries to erase master keys from memory when the cryptodisk -+module is unloaded or the command @command{exit} is executed. All secrets remain in -+memory when the command @command{chainloader} is issued, because execution can -+return to GRUB on the EFI platform. - @end deffn - - @node cutmem -@@ -6982,6 +6987,7 @@ USB support provides benefits similar to ATA (for USB disks) or AT (for USB - keyboards). In addition it allows USBserial. - - Chainloading refers to the ability to load another bootloader through the same protocol -+and on some platforms, like EFI, allow that bootloader to return to the GRUB. - - Hints allow faster disk discovery by already knowing in advance which is the disk in - question. On some platforms hints are correct unless you move the disk between boots. -diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c -index 9efb7718c3..eb786766a8 100644 ---- a/grub-core/commands/minicmd.c -+++ b/grub-core/commands/minicmd.c -@@ -29,6 +29,10 @@ - #include - #include - -+#ifdef GRUB_MACHINE_EFI -+#include -+#endif -+ - GRUB_MOD_LICENSE ("GPLv3+"); - - /* cat FILE */ -@@ -199,6 +203,13 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)), - retval = n; - } - -+#ifdef GRUB_MACHINE_EFI -+ /* -+ * The "exit" command is often used to launch the next boot application. -+ * So, erase the secrets. -+ */ -+ grub_cryptodisk_erasesecrets (); -+#endif - grub_exit (retval); - /* Not reached. */ - } -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 8727760100..9597d2d3bd 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1677,6 +1677,31 @@ grub_cryptodisk_challenge_password (void) - - return GRUB_ERR_NONE; - } -+ -+void -+grub_cryptodisk_erasesecrets (void) -+{ -+ grub_cryptodisk_t i; -+ grub_uint8_t *buf; -+ -+ buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN); -+ if (buf == NULL) -+ grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory"); -+ -+ for (i = cryptodisk_list; i != NULL; i = i->next) -+ if (grub_cryptodisk_setkey (i, buf, i->keysize)) -+ grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for %s", i->source); -+ else -+ grub_printf ("Erased crypto secrets for %s\n", i->source); -+ /* -+ * Unfortunately, there is no way to "force unmount" a given disk, it may -+ * have mounted "child" disks as well, e.g., an LVM volume. So, this -+ * function MUST be called when there is no way back, e.g., when exiting. -+ * Otherwise, subsequent read calls for a cryptodisk will return garbage. -+ */ -+ -+ grub_free (buf); -+} - #endif /* GRUB_MACHINE_EFI */ - - struct grub_procfs_entry luks_script = -@@ -1700,6 +1725,9 @@ GRUB_MOD_INIT (cryptodisk) - - GRUB_MOD_FINI (cryptodisk) - { -+#ifdef GRUB_MACHINE_EFI -+ grub_cryptodisk_erasesecrets (); -+#endif - grub_disk_dev_unregister (&grub_cryptodisk_dev); - cryptodisk_cleanup (); - grub_unregister_extcmd (cmd); -diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h -index d2572f8b05..ef307dfd5d 100644 ---- a/include/grub/cryptodisk.h -+++ b/include/grub/cryptodisk.h -@@ -189,5 +189,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); - - #ifdef GRUB_MACHINE_EFI - grub_err_t grub_cryptodisk_challenge_password (void); -+void grub_cryptodisk_erasesecrets (void); - #endif - #endif diff --git a/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch b/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch deleted file mode 100644 index 17405318..00000000 --- a/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maxim Suhanov -Date: Tue, 4 Mar 2025 15:27:59 +0300 -Subject: [PATCH] disk/cryptodisk: Wipe the passphrase from memory - -Switching to another EFI boot application while there are secrets in -RAM is dangerous, because not all firmware is wiping memory on free. - -To reduce the attack surface, wipe the passphrase acquired when -unlocking an encrypted volume. - -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - grub-core/disk/cryptodisk.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c -index 9597d2d3bd..26457095d3 100644 ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -1164,6 +1164,7 @@ grub_cryptodisk_scan_device_real (const char *name, - - if (askpass) - { -+ grub_memset (cargs->key_data, 0, cargs->key_len); - cargs->key_len = 0; - grub_free (cargs->key_data); - } diff --git a/0378-cryptocheck-Add-quiet-option.patch b/0378-cryptocheck-Add-quiet-option.patch deleted file mode 100644 index b62c6403..00000000 --- a/0378-cryptocheck-Add-quiet-option.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang -Date: Fri, 14 Mar 2025 19:03:39 +0800 -Subject: [PATCH] cryptocheck: Add --quiet option - -The option can be used to suppress output if we only want to test the -return value of the command. - -Also, mention this option in the documentation. - -Signed-off-by: Michael Chang -Signed-off-by: Maxim Suhanov -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 4 +++- - grub-core/commands/search.c | 7 ++++++- - grub-core/disk/diskfilter.c | 25 +++++++++++++++++++------ - 3 files changed, 28 insertions(+), 8 deletions(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 0af47b5ade..ae01e8c994 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -4678,12 +4678,14 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} - @node cryptocheck - @subsection cryptocheck - --@deffn Command cryptocheck device -+@deffn Command cryptocheck [ @option{--quiet} ] device - Check if a given diskfilter device is backed by encrypted devices - (@pxref{cryptomount} for additional information). - - The command examines all backing devices, physical volumes, of a specified - logical volume, like LVM2, and fails when at least one of them is unencrypted. -+ -+The option @option{--quiet} can be given to suppress the output. - @end deffn - - @node cryptomount -diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c -index 1cf714ad7d..c432c0ac6f 100644 ---- a/grub-core/commands/search.c -+++ b/grub-core/commands/search.c -@@ -163,6 +163,9 @@ is_unencrypted_disk (grub_disk_t disk) - - if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) - { -+ char opt[] = "--quiet"; -+ char *args[2]; -+ - cmd = grub_command_find ("cryptocheck"); - if (cmd == NULL) /* No diskfilter module loaded for some reason. */ - return true; -@@ -173,7 +176,9 @@ is_unencrypted_disk (grub_disk_t disk) - return true; - - grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); -- res = cmd->func (cmd, 1, &disk_str); -+ args[0] = opt; -+ args[1] = disk_str; -+ res = cmd->func (cmd, 2, args); - grub_free (disk_str); - return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ - } -diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c -index 216be6a782..04b64aebc6 100644 ---- a/grub-core/disk/diskfilter.c -+++ b/grub-core/disk/diskfilter.c -@@ -1402,6 +1402,19 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), - int check_pvs_res; - int namelen; - int pvs_cnt; -+ int opt_quiet = 0; -+ -+ if (argc == 2) -+ { -+ if (grub_strcmp (args[0], "--quiet") == 0) -+ { -+ opt_quiet = 1; -+ argc--; -+ args++; -+ } -+ else -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unrecognized option: %s"), args[0]); -+ } - - if (argc != 1) - return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); -@@ -1424,11 +1437,11 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), - - check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); - grub_disk_close (disk); -- -- grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -- (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -- pvs_cnt, -- (pvs_cnt > 1) ? "s" : ""); -+ if (!opt_quiet) -+ grub_printf ("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], -+ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", -+ pvs_cnt, -+ (pvs_cnt > 1) ? "s" : ""); - - return check_pvs_res; - } -@@ -1456,7 +1469,7 @@ GRUB_MOD_INIT(diskfilter) - { - grub_disk_dev_register (&grub_diskfilter_dev); - cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, -- N_("DEVICE"), -+ N_("[--quiet] DEVICE"), - N_("Check if a logical volume resides on encrypted disks.")); - } - diff --git a/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch b/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch deleted file mode 100644 index 6fe22da7..00000000 --- a/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch +++ /dev/null @@ -1,291 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Tue, 29 Jul 2025 09:43:37 -0600 -Subject: [PATCH] Set correctly the memory attributes for the kernel PE - sections - -Currently the whole kernel memory region is set to RO, so at some -point when execution is passed to the kernel, the latter faults on a -memory write access, e.g. zeroing .bss section. The proposed change -sets the memory attribute appropriately for each kernel PE section. - -Signed-off-by: Leo Sandoval ---- - grub-core/loader/efi/linux.c | 170 +++++++++++++++++++++++++++----------- - grub-core/loader/i386/efi/linux.c | 5 +- - include/grub/efi/linux.h | 6 ++ - 3 files changed, 134 insertions(+), 47 deletions(-) - -diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c -index ef55556f2d..111edf0e1d 100644 ---- a/grub-core/loader/efi/linux.c -+++ b/grub-core/loader/efi/linux.c -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - #include - - GRUB_MOD_LICENSE ("GPLv3+"); -@@ -202,22 +203,133 @@ grub_efi_check_nx_required (int *nx_required) - typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); - - grub_err_t --grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, -+grub_efi_mem_set_att(grub_addr_t k_address, grub_size_t k_size, -+ grub_size_t k_start, int nx_supported) -+{ -+ grub_addr_t k_start_address = k_address + k_start; -+ -+ grub_uint64_t default_set_attrs = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X; -+ grub_uint64_t default_clear_attrs = 0; -+ grub_uint64_t stack_set_attrs = default_set_attrs; -+ grub_uint64_t stack_clear_attrs = default_clear_attrs; -+ grub_uint64_t kernel_set_attrs = default_set_attrs; -+ grub_uint64_t kernel_clear_attrs = default_clear_attrs; -+ grub_uint64_t attrs; -+ -+ struct grub_msdos_image_header *header; -+ struct grub_pe_image_header *pe_image_header; -+ struct grub_pe32_coff_header *coff_header; -+ struct grub_pe32_section_table *section, *sections; -+ grub_uint16_t i; -+ grub_size_t sz; -+ -+ header = (struct grub_msdos_image_header *)k_address; -+ -+ if (grub_add ((grub_addr_t) header, header->pe_image_header_offset, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE image header address calculation")); -+ -+ pe_image_header = (struct grub_pe_image_header *) (sz); -+ -+ if (pe_image_header > (k_address + k_size)) -+ return grub_error (GRUB_ERR_BAD_OS, N_("PE image header address is invalid")); -+ -+ if (grub_memcmp (pe_image_header->signature, GRUB_PE32_SIGNATURE, -+ GRUB_PE32_SIGNATURE_SIZE) != 0) -+ return grub_error (GRUB_ERR_BAD_OS, N_("kernel PE magic is invalid")); -+ -+ coff_header = &(pe_image_header->coff_header); -+ grub_dprintf ("nx", "coff_header 0x%"PRIxGRUB_ADDR" machine %08x\n", (grub_addr_t)coff_header, coff_header->machine); -+ -+ if (grub_add ((grub_addr_t) coff_header, sizeof (*coff_header), &sz) || -+ grub_add (sz, coff_header->optional_header_size, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE sections calculation")); -+ -+ sections = (struct grub_pe32_section_table *) (sz); -+ -+ if (sections > (k_address + k_size)) -+ return grub_error (GRUB_ERR_BAD_OS, N_("Section address is invalid")); -+ -+ /* Parse the PE, remove W for code section, remove X for data sections, RO for the rest */ -+ for (i = 0, section = sections; i < coff_header->num_sections; i++, section++) -+ { -+ kernel_set_attrs = default_set_attrs; -+ kernel_clear_attrs = default_clear_attrs; -+ -+ if (nx_supported) -+ { -+ if (section->characteristics & GRUB_PE32_SCN_MEM_EXECUTE) -+ { -+ /* RX section */ -+ kernel_set_attrs &= ~GRUB_MEM_ATTR_W; -+ kernel_clear_attrs |= GRUB_MEM_ATTR_W; -+ } -+ else if (section->characteristics & GRUB_PE32_SCN_MEM_WRITE) -+ { -+ /* RW section */ -+ kernel_set_attrs &= ~GRUB_MEM_ATTR_X; -+ kernel_clear_attrs |= GRUB_MEM_ATTR_X; -+ } -+ else -+ { -+ /* RO section */ -+ kernel_set_attrs &= ~GRUB_MEM_ATTR_W & ~GRUB_MEM_ATTR_X; -+ kernel_clear_attrs |= GRUB_MEM_ATTR_X | GRUB_MEM_ATTR_W ; -+ } -+ } -+ -+ /* Make sure we are inside range */ -+ if (grub_add ((grub_addr_t) k_address, section->raw_data_offset, &sz)) -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE Executable section calculation")); -+ -+ grub_update_mem_attrs (sz, section->raw_data_size, kernel_set_attrs, kernel_clear_attrs); -+ -+ grub_get_mem_attrs (sz, 4096, &attrs); -+ grub_dprintf ("nx", "permissions for section %s 0x%"PRIxGRUB_ADDR" are %s%s%s\n", -+ section->name, -+ (grub_addr_t)sz, -+ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", -+ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", -+ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); -+ } -+ -+ if (grub_stack_addr != (grub_addr_t)-1ll) -+ { -+ if (nx_supported) -+ { -+ stack_set_attrs &= ~GRUB_MEM_ATTR_X; -+ stack_clear_attrs |= GRUB_MEM_ATTR_X; -+ } -+ -+ grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", -+ grub_stack_addr, grub_stack_addr + grub_stack_size - 1, -+ (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); -+ -+ grub_update_mem_attrs (grub_stack_addr, grub_stack_size, -+ stack_set_attrs, stack_clear_attrs); -+ -+ grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); -+ grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", -+ grub_stack_addr, -+ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", -+ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", -+ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+ -+grub_err_t -+grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, grub_size_t k_start, - grub_off_t h_offset, void *k_params, - int nx_supported) - { -+ grub_addr_t k_start_address = k_address + k_start; - grub_efi_loaded_image_t *loaded_image = NULL; - handover_func hf; - int offset = 0; -- grub_uint64_t stack_set_attrs = GRUB_MEM_ATTR_R | -- GRUB_MEM_ATTR_W | -- GRUB_MEM_ATTR_X; -- grub_uint64_t stack_clear_attrs = 0; -- grub_uint64_t kernel_set_attrs = stack_set_attrs; -- grub_uint64_t kernel_clear_attrs = stack_clear_attrs; -- grub_uint64_t attrs; - int nx_required = 0; -- -+ - #ifdef __x86_64__ - offset = 512; - #endif -@@ -241,47 +353,13 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, - if (nx_required && !nx_supported) - return grub_error (GRUB_ERR_BAD_OS, N_("kernel does not support NX loading required by policy")); - -- if (nx_supported) -- { -- kernel_set_attrs &= ~GRUB_MEM_ATTR_W; -- kernel_clear_attrs |= GRUB_MEM_ATTR_W; -- stack_set_attrs &= ~GRUB_MEM_ATTR_X; -- stack_clear_attrs |= GRUB_MEM_ATTR_X; -- } -- -- grub_dprintf ("nx", "Setting attributes for 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to r%cx\n", -- k_address, k_address + k_size - 1, -- (kernel_set_attrs & GRUB_MEM_ATTR_W) ? 'w' : '-'); -- grub_update_mem_attrs (k_address, k_size, -- kernel_set_attrs, kernel_clear_attrs); -- -- grub_get_mem_attrs (k_address, 4096, &attrs); -- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", -- (grub_addr_t)k_address, -- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", -- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", -- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); -- if (grub_stack_addr != (grub_addr_t)-1ll) -- { -- grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", -- grub_stack_addr, grub_stack_addr + grub_stack_size - 1, -- (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); -- grub_update_mem_attrs (grub_stack_addr, grub_stack_size, -- stack_set_attrs, stack_clear_attrs); -- -- grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); -- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", -- grub_stack_addr, -- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", -- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", -- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); -- } -+ grub_efi_mem_set_att (k_address, k_size, k_start, nx_supported); - - #if defined(__i386__) || defined(__x86_64__) - asm volatile ("cli"); - #endif - -- hf = (handover_func)((char *)k_address + h_offset + offset); -+ hf = (handover_func)((char *)k_start_address + h_offset + offset); - hf (grub_efi_image_handle, grub_efi_system_table, k_params); - - return GRUB_ERR_BUG; -@@ -451,7 +529,7 @@ grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args, - - grub_dprintf ("linux", "linux command line: '%s'\n", args); - -- retval = grub_efi_linux_boot (addr, size, handover_offset, -+ retval = grub_efi_linux_boot (addr, size, 0, handover_offset, - (void *)addr, nx_supported); - - /* Never reached... */ -diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c -index abbf6b24f5..6c310d9879 100644 ---- a/grub-core/loader/i386/efi/linux.c -+++ b/grub-core/loader/i386/efi/linux.c -@@ -41,6 +41,7 @@ static grub_command_t cmd_linuxefi, cmd_initrdefi; - struct grub_linuxefi_context { - void *kernel_mem; - grub_uint64_t kernel_size; -+ grub_uint64_t kernel_start; - grub_uint32_t handover_offset; - struct linux_kernel_params *params; - char *cmdline; -@@ -169,6 +170,7 @@ grub_linuxefi_boot (void *data) - - return grub_efi_linux_boot ((grub_addr_t)context->kernel_mem, - context->kernel_size, -+ context->kernel_start, - context->handover_offset, - context->params, - context->nx_supported); -@@ -527,7 +529,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - LOW_U32(kernel_mem)); - lh->code32_start = LOW_U32(kernel_mem); - -- grub_memcpy (kernel_mem, (char *)kernel + start, filelen - start); -+ grub_memcpy (kernel_mem, (char *)kernel, filelen); - - lh->type_of_loader = 0x6; - grub_dprintf ("linux", "setting lh->type_of_loader = 0x%02x\n", -@@ -544,6 +546,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), - goto fail; - context->kernel_mem = kernel_mem; - context->kernel_size = kernel_size; -+ context->kernel_start = start; - context->handover_offset = handover_offset; - context->params = params; - context->cmdline = cmdline; -diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h -index 5b4e626c37..cd17be506a 100644 ---- a/include/grub/efi/linux.h -+++ b/include/grub/efi/linux.h -@@ -27,6 +27,7 @@ - grub_err_t - EXPORT_FUNC(grub_efi_linux_boot) (grub_addr_t kernel_address, - grub_size_t kernel_size, -+ grub_size_t kernel_start, - grub_off_t handover_offset, - void *kernel_param, int nx_enabled); - -@@ -38,4 +39,9 @@ EXPORT_FUNC(grub_efi_check_nx_image_support) (grub_addr_t kernel_addr, - grub_err_t - EXPORT_FUNC(grub_efi_check_nx_required) (int *nx_required); - -+grub_err_t -+EXPORT_FUNC(grub_efi_mem_set_att) (grub_addr_t k_address, -+ grub_size_t k_size, -+ grub_size_t k_start, int nx_supported); -+ - #endif /* ! GRUB_EFI_LINUX_HEADER */ diff --git a/0383-Include-function-name-on-debug-print-function.patch b/0383-Include-function-name-on-debug-print-function.patch deleted file mode 100644 index e38ad7f3..00000000 --- a/0383-Include-function-name-on-debug-print-function.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Fri, 11 Apr 2025 15:31:53 -0600 -Subject: [PATCH] Include function name on debug and error print functions - -Together with the line number, the debug log gives more context when -debugging. - -Signed-off-by: Leo Sandoval ---- - grub-core/kern/err.c | 4 ++-- - grub-core/kern/misc.c | 4 ++-- - include/grub/err.h | 6 +++--- - include/grub/misc.h | 5 +++-- - 4 files changed, 10 insertions(+), 9 deletions(-) - -diff --git a/grub-core/kern/err.c b/grub-core/kern/err.c -index aebfe0cf83..ba04b57fb7 100644 ---- a/grub-core/kern/err.c -+++ b/grub-core/kern/err.c -@@ -38,14 +38,14 @@ static int grub_error_stack_assert; - #endif - - grub_err_t --grub_error (grub_err_t n, const char *file, const int line, const char *fmt, ...) -+grub_error (grub_err_t n, const char *file, const char *function, const int line, const char *fmt, ...) - { - va_list ap; - int m; - - grub_errno = n; - -- m = grub_snprintf (grub_errmsg, sizeof (grub_errmsg), "%s:%d:", file, line); -+ m = grub_snprintf (grub_errmsg, sizeof (grub_errmsg), "%s:%s:%d:", file, function, line); - if (m < 0) - m = 0; - -diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c -index 69bd655f3d..541c7bb80c 100644 ---- a/grub-core/kern/misc.c -+++ b/grub-core/kern/misc.c -@@ -248,7 +248,7 @@ grub_debug_enabled (const char * condition) - } - - void --grub_real_dprintf (const char *file, const int line, const char *condition, -+grub_real_dprintf (const char *file, const char *function, const int line, const char *condition, - const char *fmt, ...) - { - va_list args; -@@ -272,7 +272,7 @@ grub_real_dprintf (const char *file, const int line, const char *condition, - else - last_had_cr = 0; - #endif -- grub_printf ("%s:%d:%s: ", file, line, condition); -+ grub_printf ("%s:%s:%d:%s: ", file, function, line, condition); - va_start (args, fmt); - grub_vprintf (fmt, args); - va_end (args); -diff --git a/include/grub/err.h b/include/grub/err.h -index 7530f58b29..6379a6baf8 100644 ---- a/include/grub/err.h -+++ b/include/grub/err.h -@@ -88,10 +88,10 @@ struct grub_error_saved - extern grub_err_t EXPORT_VAR(grub_errno); - extern char EXPORT_VAR(grub_errmsg)[GRUB_MAX_ERRMSG]; - --grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *file, const int line, const char *fmt, ...) -- __attribute__ ((format (GNU_PRINTF, 4, 5))); -+grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *file, const char *function, const int line, const char *fmt, ...) -+ __attribute__ ((format (GNU_PRINTF, 5, 6))); - --#define grub_error(n, fmt, ...) grub_error (n, __FILE__, __LINE__, fmt, ##__VA_ARGS__) -+#define grub_error(n, fmt, ...) grub_error (n, __FILE__, __FUNCTION__, __LINE__, fmt, ##__VA_ARGS__) - - - void EXPORT_FUNC(grub_fatal) (const char *fmt, ...) __attribute__ ((noreturn)); -diff --git a/include/grub/misc.h b/include/grub/misc.h -index 0429339ef3..2b9096a0b3 100644 ---- a/include/grub/misc.h -+++ b/include/grub/misc.h -@@ -43,7 +43,7 @@ - #define CONCAT(a, b) CONCAT_(a, b) - #endif - --#define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __LINE__, condition, __VA_ARGS__) -+#define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __FUNCTION__, __LINE__, condition, __VA_ARGS__) - - void *EXPORT_FUNC(grub_memmove) (void *dest, const void *src, grub_size_t n); - char *EXPORT_FUNC(grub_strcpy) (char *dest, const char *src); -@@ -420,9 +420,10 @@ int EXPORT_FUNC(grub_puts_) (const char *s); - int EXPORT_FUNC(grub_debug_is_enabled) (void); - int EXPORT_FUNC(grub_debug_enabled) (const char *condition); - void EXPORT_FUNC(grub_real_dprintf) (const char *file, -+ const char *function, - const int line, - const char *condition, -- const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 4, 5))); -+ const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 5, 6))); - int EXPORT_FUNC(grub_printf) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); - int EXPORT_FUNC(grub_printf_) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); - void EXPORT_FUNC(grub_qdprintf) (const char *condition, diff --git a/0384-kern-misc-Implement-grub_strtok.patch b/0384-kern-misc-Implement-grub_strtok.patch deleted file mode 100644 index e9e0e1ec..00000000 --- a/0384-kern-misc-Implement-grub_strtok.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Alec Brown -Date: Tue, 12 Aug 2025 03:45:32 +0000 -Subject: [PATCH] kern/misc: Implement grub_strtok() - -Add the functions grub_strtok() and grub_strtok_r() to help parse strings into -tokens separated by characters in the "delim" parameter. These functions are -present in gnulib but calling them directly from the gnulib code is quite -challenging since the call "#include " would include the header file -grub-core/lib/posix_wrap/string.h instead of grub-core/lib/gnulib/string.h, -where strtok() and strtok_r() are declared. Since this overlap is quite -problematic, the simpler solution was to implement the code in the GRUB based -on gnulib's implementation. For more information on these functions, visit the -Linux Programmer's Manual, man strtok. - -Signed-off-by: Alec Brown -Reviewed-by: Daniel Kiper ---- - grub-core/kern/misc.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++ - include/grub/misc.h | 3 +++ - 2 files changed, 65 insertions(+) - -diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c -index 69bd655f3d..c69fe7fb19 100644 ---- a/grub-core/kern/misc.c -+++ b/grub-core/kern/misc.c -@@ -453,6 +453,68 @@ grub_strword (const char *haystack, const char *needle) - return 0; - } - -+char * -+grub_strtok_r (char *s, const char *delim, char **save_ptr) -+{ -+ char *token; -+ const char *c; -+ bool is_delim; -+ -+ if (s == NULL) -+ s = *save_ptr; -+ -+ /* Scan leading delimiters. */ -+ while (*s != '\0') -+ { -+ is_delim = false; -+ for (c = delim; *c != '\0'; c++) -+ { -+ if (*s == *c) -+ { -+ is_delim = true; -+ break; -+ } -+ } -+ if (is_delim == true) -+ s++; -+ else -+ break; -+ } -+ -+ if (*s == '\0') -+ { -+ *save_ptr = s; -+ return NULL; -+ } -+ -+ /* Find the end of the token. */ -+ token = s; -+ while (*s != '\0') -+ { -+ for (c = delim; *c != '\0'; c++) -+ { -+ if (*s == *c) -+ { -+ *s = '\0'; -+ *save_ptr = s + 1; -+ return token; -+ } -+ } -+ s++; -+ } -+ -+ *save_ptr = s; -+ return token; -+} -+ -+char * -+grub_strtok (char *s, const char *delim) -+{ -+ static char *last; -+ -+ return grub_strtok_r (s, delim, &last); -+} -+ - int - grub_isspace (int c) - { -diff --git a/include/grub/misc.h b/include/grub/misc.h -index 0429339ef3..626f0c3535 100644 ---- a/include/grub/misc.h -+++ b/include/grub/misc.h -@@ -134,6 +134,9 @@ char *EXPORT_FUNC(grub_strchr) (const char *s, int c); - char *EXPORT_FUNC(grub_strrchr) (const char *s, int c); - int EXPORT_FUNC(grub_strword) (const char *s, const char *w); - -+char *EXPORT_FUNC(grub_strtok_r) (char *s, const char *delim, char **save_ptr); -+char *EXPORT_FUNC(grub_strtok) (char *s, const char *delim); -+ - /* Copied from gnulib. - Written by Bruno Haible , 2005. */ - static inline char * diff --git a/0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch b/0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch deleted file mode 100644 index e2bf790a..00000000 --- a/0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch +++ /dev/null @@ -1,1354 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 12 Aug 2025 03:45:33 +0000 -Subject: [PATCH] blsuki: Add blscfg command to parse Boot Loader Specification - snippets - -The BootLoaderSpec (BLS) defines a scheme where different bootloaders can -share a format for boot items and a configuration directory that accepts -these common configurations as drop-in files. - -The BLS Specification: https://uapi-group.org/specifications/specs/boot_loader_specification/ - -Signed-off-by: Peter Jones -Signed-off-by: Javier Martinez Canillas -Signed-off-by: Will Thompson -Signed-off-by: Alec Brown -Reviewed-by: Daniel Kiper ---- - bootstrap.conf | 1 + - docs/grub.texi | 74 ++- - grub-core/Makefile.core.def | 12 + - grub-core/commands/blscfg.c | 2 +- - grub-core/commands/blsuki.c | 1028 ++++++++++++++++++++++++++++++++++++++++ - grub-core/commands/legacycfg.c | 4 +- - grub-core/commands/menuentry.c | 7 +- - grub-core/normal/main.c | 4 + - include/grub/menu.h | 14 + - include/grub/normal.h | 2 +- - 10 files changed, 1140 insertions(+), 8 deletions(-) - create mode 100644 grub-core/commands/blsuki.c - -diff --git a/bootstrap.conf b/bootstrap.conf -index 60de0597c5..799cdb1a35 100644 ---- a/bootstrap.conf -+++ b/bootstrap.conf -@@ -24,6 +24,7 @@ gnulib_modules=" - argp - base64 - error -+ filevercmp - fnmatch - getdelim - getline -diff --git a/docs/grub.texi b/docs/grub.texi -index ae01e8c994..336f8e87ed 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -3275,6 +3275,7 @@ These variables have special meaning to GRUB. - - @menu - * biosnum:: -+* blsuki_save_default:: - * check_appended_signatures:: - * check_signatures:: - * chosen:: -@@ -3339,6 +3340,11 @@ this. - For an alternative approach which also changes BIOS drive mappings for the - chain-loaded system, @pxref{drivemap}. - -+@node blsuki_save_default -+@subsection blsuki_save_default -+ -+If this variable is set, menu entries generated from BLS config files -+(@pxref{blscfg}) will be set as the default boot entry when selected. - - @node check_appended_signatures - @subsection check_appended_signatures -@@ -3346,7 +3352,6 @@ chain-loaded system, @pxref{drivemap}. - This variable controls whether GRUB enforces appended signature validation on - certain loaded files. @xref{Using appended signatures}. - -- - @node check_signatures - @subsection check_signatures - -@@ -4355,6 +4360,7 @@ you forget a command, you can run the command @command{help} - * background_image:: Load background image for active terminal - * badram:: Filter out bad regions of RAM - * blocklist:: Print a block list -+* blscfg:: Load Boot Loader Specification menu entries - * boot:: Start up your operating system - * cat:: Show the contents of a file - * clear:: Clear the screen -@@ -4542,6 +4548,72 @@ Print a block list (@pxref{Block list syntax}) for @var{file}. - @end deffn - - -+@node blscfg -+@subsection blscfg -+ -+@deffn Command blscfg [@option{-p|--path} dir] [@option{-f|--enable-fallback}] [@option{-d|--show-default}] [@option{-n|--show-non-default}] [@option{-e|--entry} file] -+Load Boot Loader Specification (BLS) entries into the GRUB menu. Boot entries -+generated from @command{blscfg} won't interfere with entries from @file{grub.cfg} appearing in -+the GRUB menu. Also, entries generated from @command{blscfg} exists only in memory and -+don't update @file{grub.cfg}. -+ -+By default, the BLS entries are stored in the @file{/loader/entries} directory in the -+boot partition. If BLS entries are stored elsewhere, the @option{--path} option can be -+used to check a different directory instead of the default location. If no BLS -+entries are found while using the @option{--path} option, the @option{--enable-fallback} option -+can be used to check for entries in the default location. -+ -+The @option{--show-default} option allows the default boot entry to be added to the -+GRUB menu from the BLS entries. -+ -+The @option{--show-non-default} option allows non-default boot entries to be added to -+the GRUB menu from the BLS entries. -+ -+The @option{--entry} option allows specific boot entries to be added to the GRUB menu -+from the BLS entries. -+ -+The @option{--entry}, @option{--show-default}, and @option{--show-non-default} options -+are used to filter which BLS entries are added to the GRUB menu. If none are -+used, all entries in the default location or the location specified by @option{--path} -+will be added to the GRUB menu. -+ -+A BLS config file example: -+@example -+# /boot/loader/entries/6a9857a393724b7a981ebb5b8495b9ea-3.8.0-2.fc19.x86_64.conf -+title Fedora 19 (Rawhide) -+sort-key fedora -+machine-id 6a9857a393724b7a981ebb5b8495b9ea -+version 3.8.0-2.fc19.x86_64 -+options root=UUID=6d3376e4-fc93-4509-95ec-a21d68011da2 quiet -+architecture x64 -+linux /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/linux -+initrd /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/initrd -+@end example -+ -+For more information on BLS entry keys as well as other information on BLS, -+see: @uref{https://uapi-group.org/specifications/specs/boot_loader_specification/, The Boot Loader Specification}. For the GRUB, there are a few additional -+BLS entry keys based on the @command{menuentry} command (@pxref{menuentry}). -+ -+The @code{grub_class} key may be used any number of times to group menu entries into -+classes. Menu themes may display different classes using different styles. -+ -+The @code{grub_users} key grants specific users access to specific menu -+entries. @xref{Security}. -+ -+The @code{grub_hotkey} key associates a hotkey with a menu entry. -+@var{key} may be a single letter, or one of the aliases @samp{backspace}, -+@samp{tab}, or @samp{delete}. -+ -+The @code{grub_args} key can be used for any other argument to be passed as positonal -+parameters when the list of commands generated from the BLS config file are -+executed. -+ -+Variable expansion using the @samp{$} character (@xref{Shell-like scripting}) may be -+used with BLS config files for the GRUB but might not be compatible with other -+bootloaders. -+@end deffn -+ -+ - @node boot - @subsection boot - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 95fd18d2dd..5e0e757344 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -884,6 +884,18 @@ module = { - enable = i386_xen_pvh; - }; - -+module = { -+ name = blsuki; -+ common = commands/blsuki.c; -+ common = lib/gnulib/filevercmp.c; -+ enable = powerpc_ieee1275; -+ enable = efi; -+ enable = i386_pc; -+ enable = emu; -+ cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; -+ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; -+}; -+ - module = { - name = boot; - common = commands/boot.c; -diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c -index 5d931b0c9b..38913d6964 100644 ---- a/grub-core/commands/blscfg.c -+++ b/grub-core/commands/blscfg.c -@@ -955,7 +955,7 @@ static void create_entry (struct bls_entry *entry) - clinux, options ? " " : "", options ? options : "", - initrd ? initrd : "", dt ? dt : ""); - -- grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry); -+ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry, NULL); - grub_dprintf ("blscfg", "Added entry %d id:\"%s\"\n", index, id); - - finish: -diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c -new file mode 100644 -index 0000000000..9440adb100 ---- /dev/null -+++ b/grub-core/commands/blsuki.c -@@ -0,0 +1,1028 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2025 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+GRUB_MOD_LICENSE ("GPLv3+"); -+ -+#define GRUB_BLS_CONFIG_PATH "/loader/entries/" -+ -+#define BLS_EXT_LEN (sizeof (".conf") - 1) -+ -+/* -+ * It is highly unlikely to ever receive a large amount of keyval pairs. A -+ * limit of 10000 is more than enough. -+ */ -+#define BLSUKI_KEYVALS_MAX 10000 -+ -+static const struct grub_arg_option bls_opt[] = -+ { -+ {"path", 'p', 0, "Specify path to find BLS entries.", N_("DIR"), ARG_TYPE_PATHNAME}, -+ {"enable-fallback", 'f', 0, "Fallback to the default BLS path if --path fails to find BLS entries.", 0, ARG_TYPE_NONE}, -+ {"show-default", 'd', 0, "Allow the default BLS entry to be added to the GRUB menu.", 0, ARG_TYPE_NONE}, -+ {"show-non-default", 'n', 0, "Allow the non-default BLS entries to be added to the GRUB menu.", 0, ARG_TYPE_NONE}, -+ {"entry", 'e', 0, "Allow specific BLS entries to be added to the GRUB menu.", N_("FILE"), ARG_TYPE_FILE}, -+ {0, 0, 0, 0, 0, 0} -+ }; -+ -+struct keyval -+{ -+ const char *key; -+ char *val; -+}; -+ -+struct read_entry_info -+{ -+ const char *devid; -+ const char *dirname; -+ grub_file_t file; -+}; -+ -+struct find_entry_info -+{ -+ const char *dirname; -+ const char *devid; -+ grub_device_t dev; -+ grub_fs_t fs; -+}; -+ -+static grub_blsuki_entry_t *entries; -+ -+#define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) -+ -+/* -+ * This function will add a new keyval pair to a list of keyvals stored in the -+ * entry parameter. -+ */ -+static grub_err_t -+blsuki_add_keyval (grub_blsuki_entry_t *entry, char *key, char *val) -+{ -+ char *k, *v; -+ struct keyval **kvs, *kv; -+ grub_size_t size; -+ int new_n = entry->nkeyvals + 1; -+ -+ if (new_n > BLSUKI_KEYVALS_MAX) -+ return grub_error (GRUB_ERR_BAD_NUMBER, "too many keyval pairs"); -+ -+ if (entry->keyvals_size == 0) -+ { -+ size = sizeof (struct keyval *); -+ kvs = grub_malloc (size); -+ if (kvs == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't allocate space for BLS key values"); -+ -+ entry->keyvals = kvs; -+ entry->keyvals_size = size; -+ } -+ else if (entry->keyvals_size < new_n * sizeof (struct keyval *)) -+ { -+ size = entry->keyvals_size * 2; -+ kvs = grub_realloc (entry->keyvals, size); -+ if (kvs == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't reallocate space for BLS key values"); -+ -+ entry->keyvals = kvs; -+ entry->keyvals_size = size; -+ } -+ -+ kv = grub_malloc (sizeof (struct keyval)); -+ if (kv == NULL) -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); -+ -+ k = grub_strdup (key); -+ if (k == NULL) -+ { -+ grub_free (kv); -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); -+ } -+ -+ v = grub_strdup (val); -+ if (v == NULL) -+ { -+ grub_free (k); -+ grub_free (kv); -+ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); -+ } -+ -+ kv->key = k; -+ kv->val = v; -+ entry->keyvals[entry->nkeyvals] = kv; -+ entry->nkeyvals = new_n; -+ -+ return GRUB_ERR_NONE; -+} -+ -+/* -+ * Find the value of the key named by keyname. If there are allowed to be -+ * more than one, pass a pointer set to -1 to the last parameter the first -+ * time, and pass the same pointer through each time after, and it'll return -+ * them in sorted order as defined in the BLS fragment file. -+ */ -+static char * -+blsuki_get_val (grub_blsuki_entry_t *entry, const char *keyname, int *last) -+{ -+ int idx, start = (last != NULL) ? (*last + 1) : 0; -+ struct keyval *kv = NULL; -+ char *ret = NULL; -+ -+ for (idx = start; idx < entry->nkeyvals; idx++) -+ { -+ kv = entry->keyvals[idx]; -+ -+ if (grub_strcmp (keyname, kv->key) == 0) -+ { -+ ret = kv->val; -+ break; -+ } -+ } -+ -+ if (last != NULL) -+ { -+ if (idx == entry->nkeyvals) -+ *last = -1; -+ else -+ *last = idx; -+ } -+ -+ return ret; -+} -+ -+/* -+ * Add a new grub_blsuki_entry_t struct to the entries list and sort it's -+ * position on the list. -+ */ -+static grub_err_t -+blsuki_add_entry (grub_blsuki_entry_t *entry) -+{ -+ grub_blsuki_entry_t *e, *last = NULL; -+ int rc; -+ -+ if (entries == NULL) -+ { -+ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); -+ entries = entry; -+ return GRUB_ERR_NONE; -+ } -+ -+ FOR_BLSUKI_ENTRIES (e) -+ { -+ rc = filevercmp (entry->filename, e->filename); -+ if (rc == 0) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("duplicate file: `%s'"), entry->filename); -+ -+ if (rc > 0) -+ { -+ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); -+ grub_list_push (GRUB_AS_LIST_P (&e), GRUB_AS_LIST (entry)); -+ if (entry->next == entries) -+ { -+ entries = entry; -+ entry->prev = NULL; -+ } -+ else if (last != NULL) -+ last->next = entry; -+ -+ return GRUB_ERR_NONE; -+ } -+ last = e; -+ } -+ -+ if (last != NULL) -+ { -+ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); -+ last->next = entry; -+ entry->prev = &last; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+/* -+ * This function parses each line of a BLS config file to obtain the key value -+ * pairs that will be used to setup the GRUB menu entries. The key value pair -+ * will be stored in a list in the entry parameter. -+ */ -+static grub_err_t -+bls_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) -+{ -+ grub_err_t err = GRUB_ERR_NONE; -+ -+ for (;;) -+ { -+ char *line, *key, *val; -+ -+ line = grub_file_getline (f); -+ if (line == NULL) -+ break; -+ -+ key = grub_strtok_r (line, " \t", &val); -+ if (key == NULL) -+ { -+ grub_free (line); -+ break; -+ } -+ if (*key == '#') -+ { -+ grub_free (line); -+ continue; -+ } -+ -+ while (*val == ' ' || *val == '\t') -+ val++; -+ -+ if (*val == '\0') -+ { -+ grub_free (line); -+ break; -+ } -+ -+ err = blsuki_add_keyval (entry, key, val); -+ grub_free (line); -+ if (err != GRUB_ERR_NONE) -+ break; -+ } -+ -+ return err; -+} -+ -+/* -+ * If a file hasn't already been opened, this function opens a BLS config file -+ * and initializes entry data before parsing keyvals and adding the entry to -+ * the list of BLS entries. -+ */ -+static int -+blsuki_read_entry (const char *filename, -+ const struct grub_dirhook_info *dirhook_info __attribute__ ((__unused__)), -+ void *data) -+{ -+ grub_size_t path_len = 0, filename_len; -+ grub_err_t err; -+ char *p = NULL; -+ grub_file_t f = NULL; -+ grub_blsuki_entry_t *entry; -+ struct read_entry_info *info = (struct read_entry_info *) data; -+ -+ grub_dprintf ("blsuki", "filename: \"%s\"\n", filename); -+ -+ filename_len = grub_strlen (filename); -+ -+ if (info->file != NULL) -+ f = info->file; -+ else -+ { -+ if (filename_len < BLS_EXT_LEN || -+ grub_strcmp (filename + filename_len - BLS_EXT_LEN, ".conf") != 0) -+ return 0; -+ -+ p = grub_xasprintf ("(%s)%s/%s", info->devid, info->dirname, filename); -+ -+ f = grub_file_open (p, GRUB_FILE_TYPE_CONFIG); -+ grub_free (p); -+ if (f == NULL) -+ goto finish; -+ } -+ -+ entry = grub_zalloc (sizeof (*entry)); -+ if (entry == NULL) -+ goto finish; -+ -+ /* -+ * If a file is opened before this function, the filename may have a path. -+ * Since the filename is used for the ID of the GRUB menu entry, we can -+ * remove the path. -+ */ -+ if (info->file != NULL) -+ { -+ char *slash; -+ -+ slash = grub_strrchr (filename, '/'); -+ if (slash != NULL) -+ path_len = slash - filename + 1; -+ } -+ filename_len -= path_len; -+ -+ entry->filename = grub_strndup (filename + path_len, filename_len); -+ if (entry->filename == NULL) -+ { -+ grub_free (entry); -+ goto finish; -+ } -+ -+ err = bls_parse_keyvals (f, entry); -+ -+ if (err == GRUB_ERR_NONE) -+ blsuki_add_entry (entry); -+ else -+ grub_free (entry); -+ -+ finish: -+ if (f != NULL) -+ grub_file_close (f); -+ -+ return 0; -+} -+ -+/* -+ * This function returns a list of values that had the same key in the BLS -+ * config file. The number of entries in this list is returned by the len -+ * parameter. -+ */ -+static char ** -+blsuki_make_list (grub_blsuki_entry_t *entry, const char *key, int *len) -+{ -+ int last = -1; -+ char *val; -+ int nlist = 0; -+ char **list; -+ -+ list = grub_zalloc (sizeof (char *)); -+ if (list == NULL) -+ return NULL; -+ -+ while (1) -+ { -+ char **new; -+ -+ /* -+ * Since the same key might appear more than once, the 'last' variable -+ * starts at -1 and increments to indicate the last index in the list -+ * we obtained from blsuki_get_val(). -+ */ -+ val = blsuki_get_val (entry, key, &last); -+ if (val == NULL) -+ break; -+ -+ new = grub_realloc (list, (nlist + 2) * sizeof (char *)); -+ if (new == NULL) -+ break; -+ -+ list = new; -+ list[nlist++] = val; -+ list[nlist] = NULL; -+ } -+ -+ if (nlist == 0) -+ { -+ grub_free (list); -+ return NULL; -+ } -+ -+ if (len != NULL) -+ *len = nlist; -+ -+ return list; -+} -+ -+/* -+ * This function appends a field to the end of a buffer. If the field given is -+ * an enviornmental variable, it gets the value stored for that variable and -+ * appends that to the buffer instead. -+ */ -+static char * -+blsuki_field_append (bool is_env_var, char *buffer, const char *start, const char *end) -+{ -+ char *tmp; -+ const char *field; -+ grub_size_t size = 0; -+ -+ tmp = grub_strndup (start, end - start + 1); -+ if (tmp == NULL) -+ return NULL; -+ -+ field = tmp; -+ -+ if (is_env_var == true) -+ { -+ field = grub_env_get (tmp); -+ if (field == NULL) -+ return buffer; -+ } -+ -+ if (grub_add (grub_strlen (field), 1, &size)) -+ return NULL; -+ -+ if (buffer == NULL) -+ buffer = grub_zalloc (size); -+ else -+ { -+ if (grub_add (size, grub_strlen (buffer), &size)) -+ return NULL; -+ -+ buffer = grub_realloc (buffer, size); -+ } -+ -+ if (buffer == NULL) -+ return NULL; -+ -+ tmp = buffer + grub_strlen (buffer); -+ tmp = grub_stpcpy (tmp, field); -+ -+ if (is_env_var == true) -+ tmp = grub_stpcpy (tmp, " "); -+ -+ return buffer; -+} -+ -+/* -+ * This function takes a value string, checks for environmental variables, and -+ * returns the value string with all environmental variables replaced with the -+ * value stored in the variable. -+ */ -+static char * -+blsuki_expand_val (const char *value) -+{ -+ char *buffer = NULL; -+ const char *start = value; -+ const char *end = value; -+ bool is_env_var = false; -+ -+ if (value == NULL) -+ return NULL; -+ -+ while (*value != '\0') -+ { -+ if (*value == '$') -+ { -+ if (start != end) -+ { -+ buffer = blsuki_field_append (is_env_var, buffer, start, end); -+ if (buffer == NULL) -+ return NULL; -+ } -+ -+ is_env_var = true; -+ start = value + 1; -+ } -+ else if (is_env_var == true) -+ { -+ if (grub_isalnum (*value) == 0 && *value != '_') -+ { -+ buffer = blsuki_field_append (is_env_var, buffer, start, end); -+ is_env_var = false; -+ start = value; -+ if (*start == ' ') -+ start++; -+ } -+ } -+ -+ end = value; -+ value++; -+ } -+ -+ if (start != end) -+ { -+ buffer = blsuki_field_append (is_env_var, buffer, start, end); -+ if (buffer == NULL) -+ return NULL; -+ } -+ -+ return buffer; -+} -+ -+/* -+ * This function returns a string with the command to load a linux kernel with -+ * kernel command-line options based on what was specified in the BLS config -+ * file. -+ */ -+static char * -+bls_get_linux (grub_blsuki_entry_t *entry) -+{ -+ char *linux_path; -+ char *linux_cmd = NULL; -+ char *options = NULL; -+ char *tmp; -+ grub_size_t size; -+ -+ linux_path = blsuki_get_val (entry, "linux", NULL); -+ options = blsuki_expand_val (blsuki_get_val (entry, "options", NULL)); -+ -+ if (grub_add (sizeof ("linux "), grub_strlen (linux_path), &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); -+ goto finish; -+ } -+ -+ if (options != NULL) -+ { -+ if (grub_add (size, grub_strlen (options), &size) || -+ grub_add (size, 1, &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); -+ goto finish; -+ } -+ } -+ -+ linux_cmd = grub_malloc (size); -+ if (linux_cmd == NULL) -+ goto finish; -+ -+ tmp = linux_cmd; -+ tmp = grub_stpcpy (tmp, "linux "); -+ tmp = grub_stpcpy (tmp, linux_path); -+ if (options != NULL) -+ { -+ tmp = grub_stpcpy (tmp, " "); -+ tmp = grub_stpcpy (tmp, options); -+ } -+ -+ tmp = grub_stpcpy (tmp, "\n"); -+ -+ finish: -+ grub_free (options); -+ return linux_cmd; -+} -+ -+/* -+ * This function returns a string with the command to load all initrds for a -+ * linux kernel image based on the list provided by the BLS config file. -+ */ -+static char * -+bls_get_initrd (grub_blsuki_entry_t *entry) -+{ -+ char **initrd_list; -+ char *initrd_cmd = NULL; -+ char *tmp; -+ grub_size_t size; -+ int i; -+ -+ initrd_list = blsuki_make_list (entry, "initrd", NULL); -+ if (initrd_list != NULL) -+ { -+ size = sizeof ("initrd"); -+ -+ for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) -+ { -+ if (grub_add (size, 1, &size) || -+ grub_add (size, grub_strlen (initrd_list[i]), &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); -+ goto finish; -+ } -+ } -+ -+ if (grub_add (size, 1, &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); -+ goto finish; -+ } -+ -+ initrd_cmd = grub_malloc (size); -+ if (initrd_cmd == NULL) -+ goto finish; -+ -+ tmp = grub_stpcpy (initrd_cmd, "initrd"); -+ for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) -+ { -+ grub_dprintf ("blsuki", "adding initrd %s\n", initrd_list[i]); -+ tmp = grub_stpcpy (tmp, " "); -+ tmp = grub_stpcpy (tmp, initrd_list[i]); -+ } -+ tmp = grub_stpcpy (tmp, "\n"); -+ } -+ -+ finish: -+ grub_free (initrd_list); -+ return initrd_cmd; -+} -+ -+/* -+ * This function returns a string with the command to load a device tree blob -+ * from the BLS config file. -+ */ -+static char * -+bls_get_devicetree (grub_blsuki_entry_t *entry) -+{ -+ char *dt_path; -+ char *dt_cmd = NULL; -+ char *tmp; -+ grub_size_t size; -+ -+ dt_path = blsuki_expand_val (blsuki_get_val (entry, "devicetree", NULL)); -+ if (dt_path != NULL) -+ { -+ if (grub_add (sizeof ("devicetree "), grub_strlen (dt_path), &size) || -+ grub_add (size, 1, &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating device tree buffer size"); -+ return NULL; -+ } -+ -+ dt_cmd = grub_malloc (size); -+ if (dt_cmd == NULL) -+ return NULL; -+ -+ tmp = dt_cmd; -+ tmp = grub_stpcpy (dt_cmd, "devicetree "); -+ tmp = grub_stpcpy (tmp, dt_path); -+ tmp = grub_stpcpy (tmp, "\n"); -+ } -+ -+ return dt_cmd; -+} -+ -+/* -+ * This function puts together all of the commands generated from the contents -+ * of the BLS config file and creates a new entry in the GRUB boot menu. -+ */ -+static void -+bls_create_entry (grub_blsuki_entry_t *entry) -+{ -+ int argc = 0; -+ const char **argv = NULL; -+ char *title = NULL; -+ char *linux_path = NULL; -+ char *linux_cmd = NULL; -+ char *initrd_cmd = NULL; -+ char *dt_cmd = NULL; -+ char *id = entry->filename; -+ grub_size_t id_len; -+ char *hotkey = NULL; -+ char *users = NULL; -+ char **classes = NULL; -+ char **args = NULL; -+ char *src = NULL; -+ int i; -+ grub_size_t size; -+ bool blsuki_save_default; -+ -+ linux_path = blsuki_get_val (entry, "linux", NULL); -+ if (linux_path == NULL) -+ { -+ grub_dprintf ("blsuki", "Skipping file %s with no 'linux' key.\n", entry->filename); -+ goto finish; -+ } -+ -+ id_len = grub_strlen (id); -+ if (id_len >= BLS_EXT_LEN && grub_strcmp (id + id_len - BLS_EXT_LEN, ".conf") == 0) -+ id[id_len - BLS_EXT_LEN] = '\0'; -+ -+ title = blsuki_get_val (entry, "title", NULL); -+ hotkey = blsuki_get_val (entry, "grub_hotkey", NULL); -+ users = blsuki_expand_val (blsuki_get_val (entry, "grub_users", NULL)); -+ classes = blsuki_make_list (entry, "grub_class", NULL); -+ args = blsuki_make_list (entry, "grub_arg", &argc); -+ -+ argc++; -+ if (grub_mul (argc + 1, sizeof (char *), &size)) -+ { -+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected creating argv list")); -+ goto finish; -+ } -+ -+ argv = grub_malloc (size); -+ if (argv == NULL) -+ goto finish; -+ -+ argv[0] = (title != NULL) ? title : linux_path; -+ for (i = 1; i < argc; i++) -+ argv[i] = args[i - 1]; -+ argv[argc] = NULL; -+ -+ linux_cmd = bls_get_linux (entry); -+ if (linux_cmd == NULL) -+ goto finish; -+ -+ initrd_cmd = bls_get_initrd (entry); -+ if (grub_errno != GRUB_ERR_NONE) -+ goto finish; -+ -+ dt_cmd = bls_get_devicetree (entry); -+ if (grub_errno != GRUB_ERR_NONE) -+ goto finish; -+ -+ blsuki_save_default = grub_env_get_bool ("blsuki_save_default", false); -+ src = grub_xasprintf ("%s%s%s%s", -+ blsuki_save_default ? "savedefault\n" : "", -+ linux_cmd, initrd_cmd ? initrd_cmd : "", -+ dt_cmd ? dt_cmd : ""); -+ -+ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry); -+ -+ finish: -+ grub_free (linux_cmd); -+ grub_free (dt_cmd); -+ grub_free (initrd_cmd); -+ grub_free (classes); -+ grub_free (args); -+ grub_free (argv); -+ grub_free (src); -+} -+ -+/* -+ * This function fills a find_entry_info struct passed in by the info parameter. -+ * If the dirname or devid parameters are set to NULL, the dirname and devid -+ * fields in the info parameter will be set to default values. If info already -+ * has a value in the dev fields, we can compare it to the value passed in by -+ * the devid parameter or the default devid to see if we need to open a new -+ * device. -+ */ -+static grub_err_t -+blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid) -+{ -+ grub_device_t dev; -+ grub_fs_t fs; -+ -+ if (info == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "info parameter is not set"); -+ -+ if (devid == NULL) -+ { -+ devid = grub_env_get ("root"); -+ if (devid == NULL) -+ return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); -+ } -+ -+ /* Check that we aren't closing and opening the same device. */ -+ if (info->dev != NULL && grub_strcmp (info->devid, devid) != 0) -+ { -+ grub_device_close (info->dev); -+ info->dev = NULL; -+ } -+ /* If we are using the same device, then we can skip this step and only set the directory. */ -+ if (info->dev == NULL) -+ { -+ grub_dprintf ("blsuki", "opening %s\n", devid); -+ dev = grub_device_open (devid); -+ if (dev == NULL) -+ return grub_errno; -+ -+ grub_dprintf ("blsuki", "probing fs\n"); -+ fs = grub_fs_probe (dev); -+ if (fs == NULL) -+ { -+ grub_device_close (dev); -+ return grub_errno; -+ } -+ -+ info->devid = devid; -+ info->dev = dev; -+ info->fs = fs; -+ } -+ -+ info->dirname = dirname; -+ -+ return GRUB_ERR_NONE; -+} -+ -+/* -+ * This function searches for BLS config files based on the data in the info -+ * parameter. If the fallback option is enabled, the default location will be -+ * checked for BLS config files if the first attempt fails. -+ */ -+static void -+blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) -+{ -+ struct read_entry_info read_entry_info; -+ grub_fs_t dir_fs = NULL; -+ grub_device_t dir_dev = NULL; -+ bool fallback = false; -+ int r; -+ -+ do -+ { -+ read_entry_info.file = NULL; -+ read_entry_info.dirname = info->dirname; -+ -+ grub_dprintf ("blsuki", "scanning dir: %s\n", info->dirname); -+ dir_dev = info->dev; -+ dir_fs = info->fs; -+ read_entry_info.devid = info->devid; -+ -+ r = dir_fs->fs_dir (dir_dev, read_entry_info.dirname, blsuki_read_entry, -+ &read_entry_info); -+ if (r != 0) -+ { -+ grub_dprintf ("blsuki", "blsuki_read_entry returned error\n"); -+ grub_errno = GRUB_ERR_NONE; -+ } -+ -+ /* -+ * If we aren't able to find BLS entries in the directory given by info->dirname, -+ * we can fallback to the default location "/boot/loader/entries/" and see if we -+ * can find the files there. -+ */ -+ if (entries == NULL && fallback == false && enable_fallback == true) -+ { -+ blsuki_set_find_entry_info (info, GRUB_BLS_CONFIG_PATH, NULL); -+ grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", -+ read_entry_info.dirname, info->dirname); -+ fallback = true; -+ } -+ else -+ fallback = false; -+ } -+ while (fallback == true); -+} -+ -+static grub_err_t -+blsuki_load_entries (char *path, bool enable_fallback) -+{ -+ grub_size_t len; -+ static grub_err_t r; -+ const char *devid = NULL; -+ char *dir = NULL; -+ struct find_entry_info info = { -+ .dev = NULL, -+ .fs = NULL, -+ .dirname = NULL, -+ }; -+ struct read_entry_info rei = { -+ .devid = NULL, -+ .dirname = NULL, -+ }; -+ -+ if (path != NULL) -+ { -+ len = grub_strlen (path); -+ if (len >= BLS_EXT_LEN && grub_strcmp (path + len - BLS_EXT_LEN, ".conf") == 0) -+ { -+ rei.file = grub_file_open (path, GRUB_FILE_TYPE_CONFIG); -+ if (rei.file == NULL) -+ return grub_errno; -+ -+ /* blsuki_read_entry() closes the file. */ -+ return blsuki_read_entry (path, NULL, &rei); -+ } -+ else if (path[0] == '(') -+ { -+ devid = path + 1; -+ -+ dir = grub_strchr (path, ')'); -+ if (dir == NULL) -+ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("invalid file name `%s'"), path); -+ -+ *dir = '\0'; -+ -+ /* Check if there is more than the devid in the path. */ -+ if (dir + 1 < path + len) -+ dir = dir + 1; -+ } -+ else if (path[0] == '/') -+ dir = path; -+ } -+ -+ if (dir == NULL) -+ dir = (char *) GRUB_BLS_CONFIG_PATH; -+ -+ r = blsuki_set_find_entry_info (&info, dir, devid); -+ if (r == GRUB_ERR_NONE) -+ blsuki_find_entry (&info, enable_fallback); -+ -+ if (info.dev != NULL) -+ grub_device_close (info.dev); -+ -+ return r; -+} -+ -+static bool -+blsuki_is_default_entry (const char *def_entry, grub_blsuki_entry_t *entry, int idx) -+{ -+ const char *title; -+ const char *def_entry_end; -+ long def_idx; -+ -+ if (def_entry == NULL || *def_entry == '\0') -+ return false; -+ -+ if (grub_strcmp (def_entry, entry->filename) == 0) -+ return true; -+ -+ title = blsuki_get_val (entry, "title", NULL); -+ -+ if (title != NULL && grub_strcmp (def_entry, title) == 0) -+ return true; -+ -+ def_idx = grub_strtol (def_entry, &def_entry_end, 0); -+ if (*def_entry_end != '\0' || def_idx < 0 || def_idx > GRUB_INT_MAX) -+ return false; -+ -+ if ((int) def_idx == idx) -+ return true; -+ -+ return false; -+} -+ -+/* -+ * This function creates a GRUB boot menu entry for each BLS entry in the -+ * entries list. -+ */ -+static grub_err_t -+blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) -+{ -+ const char *def_entry = NULL; -+ grub_blsuki_entry_t *entry = NULL; -+ int idx = 0; -+ -+ def_entry = grub_env_get ("default"); -+ -+ FOR_BLSUKI_ENTRIES(entry) -+ { -+ if (entry->visible == true) -+ { -+ idx++; -+ continue; -+ } -+ if ((show_default == true && blsuki_is_default_entry (def_entry, entry, idx) == true) || -+ (show_non_default == true && blsuki_is_default_entry (def_entry, entry, idx) == false) || -+ (entry_id != NULL && grub_strcmp (entry_id, entry->filename) == 0)) -+ { -+ bls_create_entry (entry); -+ entry->visible = true; -+ } -+ -+ idx++; -+ } -+ -+ return GRUB_ERR_NONE; -+} -+ -+static grub_err_t -+grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), -+ char **args __attribute__ ((unused))) -+{ -+ grub_err_t err; -+ struct grub_arg_list *state = ctxt->state; -+ char *path = NULL; -+ char *entry_id = NULL; -+ bool enable_fallback = false; -+ bool show_default = false; -+ bool show_non_default = false; -+ bool all = true; -+ entries = NULL; -+ -+ if (state[0].set) -+ path = state[0].arg; -+ if (state[1].set) -+ enable_fallback = true; -+ if (state[2].set) -+ { -+ show_default = true; -+ all = false; -+ } -+ if (state[3].set) -+ { -+ show_non_default = true; -+ all = false; -+ } -+ if (state[4].set) -+ { -+ entry_id = state[4].arg; -+ all = false; -+ } -+ if (all == true) -+ { -+ show_default = true; -+ show_non_default = true; -+ } -+ -+ err = blsuki_load_entries (path, enable_fallback); -+ if (err != GRUB_ERR_NONE) -+ return err; -+ -+ return blsuki_create_entries (show_default, show_non_default, entry_id); -+} -+ -+static grub_extcmd_t bls_cmd; -+ -+GRUB_MOD_INIT(blsuki) -+{ -+ bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, -+ N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), -+ N_("Import Boot Loader Specification snippets."), -+ bls_opt); -+} -+ -+GRUB_MOD_FINI(blsuki) -+{ -+ grub_unregister_extcmd (bls_cmd); -+} -diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c -index 86bcda6954..a5d296769e 100644 ---- a/grub-core/commands/legacycfg.c -+++ b/grub-core/commands/legacycfg.c -@@ -143,7 +143,7 @@ legacy_file (const char *filename) - args[0] = oldname; - grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy", - NULL, NULL, -- entrysrc, 0, NULL, NULL); -+ entrysrc, 0, NULL, NULL, NULL); - grub_free (args); - entrysrc[0] = 0; - grub_free (oldname); -@@ -205,7 +205,7 @@ legacy_file (const char *filename) - args[0] = entryname; - grub_normal_add_menu_entry (1, args, NULL, NULL, NULL, - NULL, NULL, entrysrc, 0, NULL, -- NULL); -+ NULL, NULL); - grub_free (args); - } - -diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c -index b175a1b43b..d6cf329203 100644 ---- a/grub-core/commands/menuentry.c -+++ b/grub-core/commands/menuentry.c -@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args, - char **classes, const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu, int *index, struct bls_entry *bls) -+ int submenu, int *index, struct bls_entry *bls, grub_blsuki_entry_t *blsuki) - { - int menu_hotkey = 0; - char **menu_args = NULL; -@@ -196,6 +196,7 @@ grub_normal_add_menu_entry (int argc, const char **args, - (*last)->sourcecode = menu_sourcecode; - (*last)->submenu = submenu; - (*last)->bls = bls; -+ (*last)->blsuki = blsuki; - - menu->size++; - if (index) -@@ -297,7 +298,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - ctxt->state[2].arg, 0, - ctxt->state[3].arg, - ctxt->extcmd->cmd->name[0] == 's', -- NULL, NULL); -+ NULL, NULL, NULL); - - src = args[argc - 1]; - args[argc - 1] = NULL; -@@ -315,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) - users, - ctxt->state[2].arg, prefix, src + 1, - ctxt->extcmd->cmd->name[0] == 's', NULL, -- NULL); -+ NULL, NULL); - - src[len - 1] = ch; - args[argc - 1] = src; -diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c -index 6f7290a897..e038ed14b8 100644 ---- a/grub-core/normal/main.c -+++ b/grub-core/normal/main.c -@@ -75,6 +75,10 @@ grub_normal_free_menu (grub_menu_t menu) - { - entry->bls->visible = 0; - } -+ if (entry->blsuki) -+ { -+ entry->blsuki->visible = 0; -+ } - - grub_free ((void *) entry->id); - grub_free ((void *) entry->users); -diff --git a/include/grub/menu.h b/include/grub/menu.h -index 0acdc2aa6b..43a3c5809b 100644 ---- a/include/grub/menu.h -+++ b/include/grub/menu.h -@@ -20,6 +20,7 @@ - #ifndef GRUB_MENU_HEADER - #define GRUB_MENU_HEADER 1 - -+ - struct bls_entry - { - struct bls_entry *next; -@@ -30,6 +31,18 @@ struct bls_entry - int visible; - }; - -+struct grub_blsuki_entry -+{ -+ struct grub_blsuki_entry *next; -+ struct grub_blsuki_entry **prev; -+ struct keyval **keyvals; -+ grub_size_t keyvals_size; -+ int nkeyvals; -+ char *filename; -+ bool visible; -+}; -+typedef struct grub_blsuki_entry grub_blsuki_entry_t; -+ - struct grub_menu_entry_class - { - char *name; -@@ -73,6 +86,7 @@ struct grub_menu_entry - - /* BLS used to populate the entry */ - struct bls_entry *bls; -+ grub_blsuki_entry_t *blsuki; - }; - typedef struct grub_menu_entry *grub_menu_entry_t; - -diff --git a/include/grub/normal.h b/include/grub/normal.h -index 8839ad85a1..6d2b59db88 100644 ---- a/include/grub/normal.h -+++ b/include/grub/normal.h -@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes, - const char *id, - const char *users, const char *hotkey, - const char *prefix, const char *sourcecode, -- int submenu, int *index, struct bls_entry *bls); -+ int submenu, int *index, struct bls_entry *bls, grub_blsuki_entry_t *blsuki); - - grub_err_t - grub_normal_set_password (const char *user, const char *password); diff --git a/0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch b/0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch deleted file mode 100644 index f80fb5c9..00000000 --- a/0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Alec Brown -Date: Tue, 12 Aug 2025 03:45:34 +0000 -Subject: [PATCH] util/misc.c: Change offset type for - grub_util_write_image_at() - -Adding filevercmp support to grub-core/commands/blsuki.c from gnulib will cause -issues with the type of the offset parameter for grub_util_write_image_at() for -emu builds. To fix this issue, we can change the type from off_t to grub_off_t. - -Signed-off-by: Alec Brown -Reviewed-by: Daniel Kiper ---- - include/grub/util/misc.h | 2 +- - util/misc.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/include/grub/util/misc.h b/include/grub/util/misc.h -index e9e0a6724a..bfce065583 100644 ---- a/include/grub/util/misc.h -+++ b/include/grub/util/misc.h -@@ -36,7 +36,7 @@ char *grub_util_read_image (const char *path); - void grub_util_load_image (const char *path, char *buf); - void grub_util_write_image (const char *img, size_t size, FILE *out, - const char *name); --void grub_util_write_image_at (const void *img, size_t size, off_t offset, -+void grub_util_write_image_at (const void *img, size_t size, grub_off_t offset, - FILE *out, const char *name); - - char *make_system_path_relative_to_its_root (const char *path); -diff --git a/util/misc.c b/util/misc.c -index 0f928e5b49..6e16a68d9a 100644 ---- a/util/misc.c -+++ b/util/misc.c -@@ -101,7 +101,7 @@ grub_util_read_image (const char *path) - } - - void --grub_util_write_image_at (const void *img, size_t size, off_t offset, FILE *out, -+grub_util_write_image_at (const void *img, size_t size, grub_off_t offset, FILE *out, - const char *name) - { - grub_util_info ("writing 0x%" GRUB_HOST_PRIxLONG_LONG " bytes at offset 0x%" diff --git a/0387-blsuki-Check-for-mounted-boot-in-emu.patch b/0387-blsuki-Check-for-mounted-boot-in-emu.patch deleted file mode 100644 index 3f207333..00000000 --- a/0387-blsuki-Check-for-mounted-boot-in-emu.patch +++ /dev/null @@ -1,342 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 12 Aug 2025 03:45:35 +0000 -Subject: [PATCH] blsuki: Check for mounted /boot in emu - -Irritatingly, BLS defines paths relative to the mountpoint of the -filesystem which contains its snippets, not / or any other fixed -location. So grub-emu needs to know whether /boot is a separate -filesystem from / and conditionally prepend a path. - -Signed-off-by: Robbie Harwood -Signed-off-by: Alec Brown -Reviewed-by: Daniel Kiper ---- - grub-core/Makefile.core.def | 3 ++ - grub-core/commands/blsuki.c | 83 +++++++++++++++++++++++++++++++++++++---- - grub-core/osdep/linux/getroot.c | 8 ++++ - grub-core/osdep/unix/getroot.c | 4 +- - include/grub/emu/misc.h | 2 +- - 5 files changed, 91 insertions(+), 9 deletions(-) - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 5e0e757344..885dd436de 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -376,6 +376,9 @@ kernel = { - emu = kern/emu/cache_s.S; - emu = kern/emu/hostdisk.c; - emu = osdep/unix/hostdisk.c; -+ emu = osdep/relpath.c; -+ emu = osdep/getroot.c; -+ emu = osdep/unix/getroot.c; - emu = osdep/exec.c; - extra_dist = osdep/unix/exec.c; - emu = osdep/devmapper/hostdisk.c; -diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c -index 9440adb100..ed93a150b1 100644 ---- a/grub-core/commands/blsuki.c -+++ b/grub-core/commands/blsuki.c -@@ -32,6 +32,13 @@ - #include - #include - -+#ifdef GRUB_MACHINE_EMU -+#include -+#define GRUB_BOOT_DEVICE "/boot" -+#else -+#define GRUB_BOOT_DEVICE "" -+#endif -+ - GRUB_MOD_LICENSE ("GPLv3+"); - - #define GRUB_BLS_CONFIG_PATH "/loader/entries/" -@@ -79,6 +86,34 @@ static grub_blsuki_entry_t *entries; - - #define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) - -+/* -+ * BLS appears to make paths relative to the filesystem that snippets are -+ * on, not /. Attempt to cope. -+ */ -+static char *blsuki_update_boot_device (char *tmp) -+{ -+#ifdef GRUB_MACHINE_EMU -+ static int separate_boot = -1; -+ char *ret; -+ -+ if (separate_boot != -1) -+ goto probed; -+ -+ separate_boot = 0; -+ -+ ret = grub_make_system_path_relative_to_its_root (GRUB_BOOT_DEVICE); -+ -+ if (ret != NULL && ret[0] == '\0') -+ separate_boot = 1; -+ -+ probed: -+ if (separate_boot == 0) -+ return tmp; -+#endif -+ -+ return grub_stpcpy (tmp, GRUB_BOOT_DEVICE); -+} -+ - /* - * This function will add a new keyval pair to a list of keyvals stored in the - * entry parameter. -@@ -526,7 +561,7 @@ bls_get_linux (grub_blsuki_entry_t *entry) - linux_path = blsuki_get_val (entry, "linux", NULL); - options = blsuki_expand_val (blsuki_get_val (entry, "options", NULL)); - -- if (grub_add (sizeof ("linux "), grub_strlen (linux_path), &size)) -+ if (grub_add (sizeof ("linux " GRUB_BOOT_DEVICE), grub_strlen (linux_path), &size)) - { - grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); - goto finish; -@@ -548,6 +583,7 @@ bls_get_linux (grub_blsuki_entry_t *entry) - - tmp = linux_cmd; - tmp = grub_stpcpy (tmp, "linux "); -+ tmp = blsuki_update_boot_device (tmp); - tmp = grub_stpcpy (tmp, linux_path); - if (options != NULL) - { -@@ -582,7 +618,7 @@ bls_get_initrd (grub_blsuki_entry_t *entry) - - for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) - { -- if (grub_add (size, 1, &size) || -+ if (grub_add (size, sizeof (" " GRUB_BOOT_DEVICE) - 1, &size) || - grub_add (size, grub_strlen (initrd_list[i]), &size)) - { - grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); -@@ -605,6 +641,7 @@ bls_get_initrd (grub_blsuki_entry_t *entry) - { - grub_dprintf ("blsuki", "adding initrd %s\n", initrd_list[i]); - tmp = grub_stpcpy (tmp, " "); -+ tmp = blsuki_update_boot_device (tmp); - tmp = grub_stpcpy (tmp, initrd_list[i]); - } - tmp = grub_stpcpy (tmp, "\n"); -@@ -630,7 +667,7 @@ bls_get_devicetree (grub_blsuki_entry_t *entry) - dt_path = blsuki_expand_val (blsuki_get_val (entry, "devicetree", NULL)); - if (dt_path != NULL) - { -- if (grub_add (sizeof ("devicetree "), grub_strlen (dt_path), &size) || -+ if (grub_add (sizeof ("devicetree " GRUB_BOOT_DEVICE), grub_strlen (dt_path), &size) || - grub_add (size, 1, &size)) - { - grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating device tree buffer size"); -@@ -643,6 +680,7 @@ bls_get_devicetree (grub_blsuki_entry_t *entry) - - tmp = dt_cmd; - tmp = grub_stpcpy (dt_cmd, "devicetree "); -+ tmp = blsuki_update_boot_device (tmp); - tmp = grub_stpcpy (tmp, dt_path); - tmp = grub_stpcpy (tmp, "\n"); - } -@@ -757,7 +795,11 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c - - if (devid == NULL) - { -+#ifdef GRUB_MACHINE_EMU -+ devid = "host"; -+#else - devid = grub_env_get ("root"); -+#endif - if (devid == NULL) - return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); - } -@@ -799,10 +841,13 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c - * parameter. If the fallback option is enabled, the default location will be - * checked for BLS config files if the first attempt fails. - */ --static void -+static grub_err_t - blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - { - struct read_entry_info read_entry_info; -+ char *default_dir = NULL; -+ char *tmp; -+ grub_size_t default_size; - grub_fs_t dir_fs = NULL; - grub_device_t dir_dev = NULL; - bool fallback = false; -@@ -833,7 +878,15 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - */ - if (entries == NULL && fallback == false && enable_fallback == true) - { -- blsuki_set_find_entry_info (info, GRUB_BLS_CONFIG_PATH, NULL); -+ default_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 1; -+ default_dir = grub_malloc (default_size); -+ if (default_dir == NULL) -+ return grub_errno; -+ -+ tmp = blsuki_update_boot_device (default_dir); -+ tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); -+ -+ blsuki_set_find_entry_info (info, default_dir, NULL); - grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", - read_entry_info.dirname, info->dirname); - fallback = true; -@@ -842,6 +895,9 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - fallback = false; - } - while (fallback == true); -+ -+ grub_free (default_dir); -+ return GRUB_ERR_NONE; - } - - static grub_err_t -@@ -851,6 +907,9 @@ blsuki_load_entries (char *path, bool enable_fallback) - static grub_err_t r; - const char *devid = NULL; - char *dir = NULL; -+ char *default_dir = NULL; -+ char *tmp; -+ grub_size_t dir_size; - struct find_entry_info info = { - .dev = NULL, - .fs = NULL, -@@ -892,15 +951,25 @@ blsuki_load_entries (char *path, bool enable_fallback) - } - - if (dir == NULL) -- dir = (char *) GRUB_BLS_CONFIG_PATH; -+ { -+ dir_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 2; -+ default_dir = grub_malloc (dir_size); -+ if (default_dir == NULL) -+ return grub_errno; -+ -+ tmp = blsuki_update_boot_device (default_dir); -+ tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); -+ dir = default_dir; -+ } - - r = blsuki_set_find_entry_info (&info, dir, devid); - if (r == GRUB_ERR_NONE) -- blsuki_find_entry (&info, enable_fallback); -+ r = blsuki_find_entry (&info, enable_fallback); - - if (info.dev != NULL) - grub_device_close (info.dev); - -+ grub_free (default_dir); - return r; - } - -diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c -index 4bf386b590..8bf281c1d8 100644 ---- a/grub-core/osdep/linux/getroot.c -+++ b/grub-core/osdep/linux/getroot.c -@@ -139,6 +139,7 @@ struct mountinfo_entry - char fstype[ESCAPED_PATH_MAX + 1], device[ESCAPED_PATH_MAX + 1]; - }; - -+#ifdef GRUB_UTIL - static char ** - grub_util_raid_getmembers (const char *name, int bootable) - { -@@ -199,6 +200,7 @@ grub_util_raid_getmembers (const char *name, int bootable) - - return devicelist; - } -+#endif - - /* Statting something on a btrfs filesystem always returns a virtual device - major/minor pair rather than the real underlying device, because btrfs -@@ -700,6 +702,7 @@ out: - return ret; - } - -+#ifdef GRUB_UTIL - static char * - get_mdadm_uuid (const char *os_dev) - { -@@ -757,6 +760,7 @@ out: - - return name; - } -+#endif - - static int - grub_util_is_imsm_or_ddf (const char *os_dev) -@@ -1096,6 +1100,7 @@ grub_util_part_to_disk (const char *os_dev, struct stat *st, - return path; - } - -+#ifdef GRUB_UTIL - static char * - grub_util_get_raid_grub_dev (const char *os_dev) - { -@@ -1198,6 +1203,7 @@ grub_util_get_raid_grub_dev (const char *os_dev) - } - return grub_dev; - } -+#endif - - enum grub_dev_abstraction_types - grub_util_get_dev_abstraction_os (const char *os_dev) -@@ -1214,6 +1220,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) - return GRUB_DEV_ABSTRACTION_NONE; - } - -+#ifdef GRUB_UTIL - int - grub_util_pull_device_os (const char *os_dev, - enum grub_dev_abstraction_types ab) -@@ -1270,6 +1277,7 @@ grub_util_get_grub_dev_os (const char *os_dev) - - return grub_dev; - } -+#endif - - static void *mp = NULL; - static void -diff --git a/grub-core/osdep/unix/getroot.c b/grub-core/osdep/unix/getroot.c -index ee11b02fb6..62581ba601 100644 ---- a/grub-core/osdep/unix/getroot.c -+++ b/grub-core/osdep/unix/getroot.c -@@ -16,8 +16,8 @@ - * along with GRUB. If not, see . - */ - --#include - #include -+#include - - #include - #include -@@ -567,6 +567,7 @@ grub_guess_root_devices (const char *dir_in) - - #endif - -+#ifdef GRUB_UTIL - void - grub_util_pull_lvm_by_command (const char *os_dev) - { -@@ -663,6 +664,7 @@ out: - free (buf); - free (vgid); - } -+#endif - - /* ZFS has similar problems to those of btrfs (see above). */ - void -diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h -index f3a712a8b2..59b8038c60 100644 ---- a/include/grub/emu/misc.h -+++ b/include/grub/emu/misc.h -@@ -39,7 +39,7 @@ void grub_fini_all (void); - void grub_find_zpool_from_dir (const char *dir, - char **poolname, char **poolfs); - --char *grub_make_system_path_relative_to_its_root (const char *path) -+char *EXPORT_FUNC (grub_make_system_path_relative_to_its_root) (const char *path) - WARN_UNUSED_RESULT; - int - grub_util_device_is_mapped (const char *dev); diff --git a/0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch b/0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch deleted file mode 100644 index fe91d9e4..00000000 --- a/0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch +++ /dev/null @@ -1,822 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Alec Brown -Date: Tue, 12 Aug 2025 03:45:36 +0000 -Subject: [PATCH] blsuki: Add uki command to load Unified Kernel Image entries - -A Unified Kernel Image (UKI) is a single UEFI PE file that combines -a UEFI boot stub, a Linux kernel image, an initrd, and further resources. -The uki command will locate where the UKI file is and create a GRUB menu -entry to load it. - -The Unified Kernel Image Specification: https://uapi-group.org/specifications/specs/unified_kernel_image/ - -Signed-off-by: Alec Brown -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 36 +++- - grub-core/commands/blsuki.c | 476 ++++++++++++++++++++++++++++++++++++++++---- - include/grub/menu.h | 2 + - 3 files changed, 474 insertions(+), 40 deletions(-) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 336f8e87ed..531e847f32 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -3344,7 +3344,8 @@ chain-loaded system, @pxref{drivemap}. - @subsection blsuki_save_default - - If this variable is set, menu entries generated from BLS config files --(@pxref{blscfg}) will be set as the default boot entry when selected. -+(@pxref{blscfg}) or UKI files (@pxref{uki}) will be set as the default boot -+entry when selected. - - @node check_appended_signatures - @subsection check_appended_signatures -@@ -4434,6 +4435,7 @@ you forget a command, you can run the command @command{help} - * true:: Do nothing, successfully - * trust:: Add public key to list of trusted keys - * trust_certificate:: Add an x509 certificate to the list of trusted certificates -+* uki:: Load Unified Kernel Image menu entries - * unset:: Unset an environment variable - @comment * vbeinfo:: List available video modes - * verify_appended:: Verify appended digital signature -@@ -6062,6 +6064,38 @@ Unset the environment variable @var{envvar}. - @end deffn - - -+@node uki -+@subsection uki -+ -+@deffn Command uki [@option{-p|--path} dir] [@option{-f|--enable-fallback}] [@option{-d|--show-default}] [@option{-n|--show-non-default}] [@option{-e|--entry} file] -+Load Unified Kernel Image (UKI) files into the GRUB menu. Boot entries -+generated from @command{uki} won't interfere with entries from @file{grub.cfg} appearing in the -+GRUB menu. Also, entries generated from @command{uki} exists only in memory and don't -+update @file{grub.cfg}. -+ -+By default, the UKI files are stored in the @file{/EFI/Linux} directory in the EFI -+system partition. If UKI files are stored elsewhere, the @option{--path} option can be -+used to check a different directory instead of the default location. If no UKI -+files are found while using the @option{--path} option, the @option{--enable-fallback} option can -+be used to check for files in the default location. -+ -+The @option{--show-default} option allows the default boot entry to be added to the -+GRUB menu from the UKI files. -+ -+The @option{--show-non-default} option allows non-default boot entries to be added to -+the GRUB menu from the UKI files. -+ -+The @option{--entry} option allows specific boot entries to be added to the GRUB menu -+from the UKI files. -+ -+The @option{--entry}, @option{--show-default}, and @option{--show-non-default} options -+are used to filter which UKI files are added to the GRUB menu. If none are -+used, all files in the default location or the location specified by @option{--path} -+will be added to the GRUB menu. -+ -+For more information on UKI, see: @uref{https://uapi-group.org/specifications/specs/unified_kernel_image/, The Unified Kernel Image Specification} -+@end deffn -+ - @ignore - @node vbeinfo - @subsection vbeinfo -diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c -index ed93a150b1..cb00f936a7 100644 ---- a/grub-core/commands/blsuki.c -+++ b/grub-core/commands/blsuki.c -@@ -32,6 +32,12 @@ - #include - #include - -+#ifdef GRUB_MACHINE_EFI -+#include -+#include -+#include -+#endif -+ - #ifdef GRUB_MACHINE_EMU - #include - #define GRUB_BOOT_DEVICE "/boot" -@@ -42,14 +48,28 @@ - GRUB_MOD_LICENSE ("GPLv3+"); - - #define GRUB_BLS_CONFIG_PATH "/loader/entries/" -+#define GRUB_UKI_CONFIG_PATH "/EFI/Linux" - - #define BLS_EXT_LEN (sizeof (".conf") - 1) -+#define UKI_EXT_LEN (sizeof (".efi") - 1) - - /* - * It is highly unlikely to ever receive a large amount of keyval pairs. A - * limit of 10000 is more than enough. - */ - #define BLSUKI_KEYVALS_MAX 10000 -+/* -+ * The only sections we read are ".cmdline" and ".osrel". The ".cmdline" -+ * section has a size limit of 4096 and it would be very unlikely for the size -+ * of the ".osrel" section to be 5 times larger than 4096. -+ */ -+#define UKI_SECTION_SIZE_MAX (5 * 4096) -+ -+enum blsuki_cmd_type -+ { -+ BLSUKI_BLS_CMD, -+ BLSUKI_UKI_CMD, -+ }; - - static const struct grub_arg_option bls_opt[] = - { -@@ -61,6 +81,18 @@ static const struct grub_arg_option bls_opt[] = - {0, 0, 0, 0, 0, 0} - }; - -+#ifdef GRUB_MACHINE_EFI -+static const struct grub_arg_option uki_opt[] = -+ { -+ {"path", 'p', 0, N_("Specify path to find UKI entries."), N_("DIR"), ARG_TYPE_PATHNAME}, -+ {"enable-fallback", 'f', 0, "Fallback to the default BLS path if --path fails to find UKI entries.", 0, ARG_TYPE_NONE}, -+ {"show-default", 'd', 0, N_("Allow the default UKI entry to be added to the GRUB menu."), 0, ARG_TYPE_NONE}, -+ {"show-non-default", 'n', 0, N_("Allow the non-default UKI entries to be added to the GRUB menu."), 0, ARG_TYPE_NONE}, -+ {"entry", 'e', 0, N_("Allow specificUKII entries to be added to the GRUB menu."), N_("FILE"), ARG_TYPE_FILE}, -+ {0, 0, 0, 0, 0, 0} -+ }; -+#endif -+ - struct keyval - { - const char *key; -@@ -71,6 +103,7 @@ struct read_entry_info - { - const char *devid; - const char *dirname; -+ enum blsuki_cmd_type cmd_type; - grub_file_t file; - }; - -@@ -82,7 +115,7 @@ struct find_entry_info - grub_fs_t fs; - }; - --static grub_blsuki_entry_t *entries; -+static grub_blsuki_entry_t *entries = NULL; - - #define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) - -@@ -181,7 +214,7 @@ blsuki_add_keyval (grub_blsuki_entry_t *entry, char *key, char *val) - * Find the value of the key named by keyname. If there are allowed to be - * more than one, pass a pointer set to -1 to the last parameter the first - * time, and pass the same pointer through each time after, and it'll return -- * them in sorted order as defined in the BLS fragment file. -+ * them in sorted order. - */ - static char * - blsuki_get_val (grub_blsuki_entry_t *entry, const char *keyname, int *last) -@@ -310,20 +343,212 @@ bls_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) - return err; - } - -+#ifdef GRUB_MACHINE_EFI -+/* -+ * This function searches for the .cmdline, .osrel, and .linux sections of a -+ * UKI. We only need to store the data for the .cmdline and .osrel sections, -+ * but we also need to verify that the .linux section exists. -+ */ -+static grub_err_t -+uki_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) -+{ -+ struct grub_msdos_image_header *dos = NULL; -+ struct grub_pe_image_header *pe = NULL; -+ grub_off_t section_offset = 0; -+ struct grub_pe32_section_table *section = NULL; -+ struct grub_pe32_coff_header *coff_header = NULL; -+ char *val = NULL; -+ char *key = NULL; -+ const char *target[] = {".cmdline", ".osrel", ".linux", NULL}; -+ bool has_linux = false; -+ grub_err_t err = GRUB_ERR_NONE; -+ -+ dos = grub_zalloc (sizeof (*dos)); -+ if (dos == NULL) -+ return grub_errno; -+ if (grub_file_read (f, dos, sizeof (*dos)) < (grub_ssize_t) sizeof (*dos)) -+ { -+ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read UKI image header"); -+ goto finish; -+ } -+ if (dos->msdos_magic != GRUB_DOS_MAGIC) -+ { -+ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, "plain image kernel is not supported"); -+ goto finish; -+ } -+ -+ grub_dprintf ("blsuki", "PE/COFF header @ %08x\n", dos->pe_image_header_offset); -+ pe = grub_zalloc (sizeof (*pe)); -+ if (pe == NULL) -+ { -+ err = grub_errno; -+ goto finish; -+ } -+ if (grub_file_seek (f, dos->pe_image_header_offset) == (grub_off_t) -1 || -+ grub_file_read (f, pe, sizeof (*pe)) != sizeof (*pe)) -+ { -+ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read COFF image header"); -+ goto finish; -+ } -+ if (pe->optional_header.magic != GRUB_PE32_NATIVE_MAGIC) -+ { -+ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, "non-native image not supported"); -+ goto finish; -+ } -+ -+ coff_header = &(pe->coff_header); -+ section_offset = dos->pe_image_header_offset + sizeof (*pe); -+ -+ for (int i = 0; i < coff_header->num_sections; i++) -+ { -+ section = grub_zalloc (sizeof (*section)); -+ if (section == NULL) -+ { -+ err = grub_errno; -+ goto finish; -+ } -+ -+ if (grub_file_seek (f, section_offset) == (grub_off_t) -1 || -+ grub_file_read (f, section, sizeof (*section)) != sizeof (*section)) -+ { -+ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read section header"); -+ goto finish; -+ } -+ -+ key = grub_strndup (section->name, 8); -+ if (key == NULL) -+ { -+ err = grub_errno; -+ goto finish; -+ } -+ -+ for (int j = 0; target[j] != NULL; j++) -+ { -+ if (grub_strcmp (key, target[j]) == 0) -+ { -+ /* -+ * We don't need to read the contents of the .linux PE section, but we -+ * should verify that the section exists. -+ */ -+ if (grub_strcmp (key, ".linux") == 0) -+ { -+ has_linux = true; -+ break; -+ } -+ -+ if (section->raw_data_size > UKI_SECTION_SIZE_MAX) -+ { -+ err = grub_error (GRUB_ERR_BAD_NUMBER, "UKI section size is larger than expected"); -+ goto finish; -+ } -+ -+ val = grub_zalloc (section->raw_data_size); -+ if (val == NULL) -+ { -+ err = grub_errno; -+ goto finish; -+ } -+ -+ if (grub_file_seek (f, section->raw_data_offset) == (grub_off_t) -1 || -+ grub_file_read (f, val, section->raw_data_size) != (grub_ssize_t) section->raw_data_size) -+ { -+ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read section"); -+ goto finish; -+ } -+ -+ err = blsuki_add_keyval (entry, key, val); -+ if (err != GRUB_ERR_NONE) -+ goto finish; -+ -+ break; -+ } -+ } -+ -+ section_offset += sizeof (*section); -+ grub_free (section); -+ grub_free (val); -+ grub_free (key); -+ section = NULL; -+ val = NULL; -+ key = NULL; -+ } -+ -+ if (has_linux == false) -+ err = grub_error (GRUB_ERR_NO_KERNEL, "UKI is missing the '.linux' section"); -+ -+ finish: -+ grub_free (dos); -+ grub_free (pe); -+ grub_free (section); -+ grub_free (val); -+ grub_free (key); -+ return err; -+} -+ -+/* -+ * This function obtains the keyval pairs when the .osrel data is input into -+ * the osrel_ptr parameter and returns the keyval pair. Since we are using -+ * grub_strtok_r(), the osrel_ptr will be updated to the following line of -+ * osrel. This function returns NULL when it reaches the end of osrel. -+ */ -+static char * -+uki_read_osrel (char **osrel_ptr, char **val_ret) -+{ -+ char *key, *val; -+ grub_size_t val_size; -+ -+ for (;;) -+ { -+ key = grub_strtok_r (NULL, "\n\r", osrel_ptr); -+ if (key == NULL) -+ return NULL; -+ -+ /* Remove leading white space */ -+ while (*key == ' ' || *key == '\t') -+ key++; -+ -+ /* Skip commented lines */ -+ if (*key == '#') -+ continue; -+ -+ /* Split key/value */ -+ key = grub_strtok_r (key, "=", &val); -+ if (key == NULL || *val == '\0') -+ continue; -+ -+ /* Remove quotes from value */ -+ val_size = grub_strlen (val); -+ if ((*val == '\"' && val[val_size - 1] == '\"') || -+ (*val == '\'' && val[val_size - 1] == '\'')) -+ { -+ val[val_size - 1] = '\0'; -+ val++; -+ } -+ -+ *val_ret = val; -+ break; -+ } -+ -+ return key; -+} -+#endif -+ - /* - * If a file hasn't already been opened, this function opens a BLS config file -- * and initializes entry data before parsing keyvals and adding the entry to -- * the list of BLS entries. -+ * or UKI and initializes entry data before parsing keyvals and adding the entry -+ * to the list of BLS or UKI entries. - */ - static int - blsuki_read_entry (const char *filename, - const struct grub_dirhook_info *dirhook_info __attribute__ ((__unused__)), - void *data) - { -- grub_size_t path_len = 0, filename_len; -- grub_err_t err; -+ grub_size_t path_len = 0, ext_len = 0, filename_len; -+ grub_err_t err = GRUB_ERR_NONE; - char *p = NULL; -+ const char *ext = NULL; - grub_file_t f = NULL; -+ enum grub_file_type file_type = 0; - grub_blsuki_entry_t *entry; - struct read_entry_info *info = (struct read_entry_info *) data; - -@@ -331,17 +556,31 @@ blsuki_read_entry (const char *filename, - - filename_len = grub_strlen (filename); - -+ if (info->cmd_type == BLSUKI_BLS_CMD) -+ { -+ ext = ".conf"; -+ ext_len = BLS_EXT_LEN; -+ file_type = GRUB_FILE_TYPE_CONFIG; -+ } -+#ifdef GRUB_MACHINE_EFI -+ else if (info->cmd_type == BLSUKI_UKI_CMD) -+ { -+ ext = ".efi"; -+ ext_len = UKI_EXT_LEN; -+ file_type = GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE; -+ } -+#endif -+ - if (info->file != NULL) - f = info->file; - else - { -- if (filename_len < BLS_EXT_LEN || -- grub_strcmp (filename + filename_len - BLS_EXT_LEN, ".conf") != 0) -+ if (filename_len < ext_len || -+ grub_strcmp (filename + filename_len - ext_len, ext) != 0) - return 0; - - p = grub_xasprintf ("(%s)%s/%s", info->devid, info->dirname, filename); -- -- f = grub_file_open (p, GRUB_FILE_TYPE_CONFIG); -+ f = grub_file_open (p, file_type); - grub_free (p); - if (f == NULL) - goto finish; -@@ -373,7 +612,26 @@ blsuki_read_entry (const char *filename, - goto finish; - } - -- err = bls_parse_keyvals (f, entry); -+ entry->dirname = grub_strdup (info->dirname); -+ if (entry->dirname == NULL) -+ { -+ grub_free (entry); -+ goto finish; -+ } -+ -+ entry->devid = grub_strdup (info->devid); -+ if (entry->devid == NULL) -+ { -+ grub_free (entry); -+ goto finish; -+ } -+ -+ if (info->cmd_type == BLSUKI_BLS_CMD) -+ err = bls_parse_keyvals (f, entry); -+#ifdef GRUB_MACHINE_EFI -+ else if (info->cmd_type == BLSUKI_UKI_CMD) -+ err = uki_parse_keyvals (f, entry); -+#endif - - if (err == GRUB_ERR_NONE) - blsuki_add_entry (entry); -@@ -389,7 +647,7 @@ blsuki_read_entry (const char *filename, - - /* - * This function returns a list of values that had the same key in the BLS -- * config file. The number of entries in this list is returned by the len -+ * config file or UKI. The number of entries in this list is returned by the len - * parameter. - */ - static char ** -@@ -764,7 +1022,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) - linux_cmd, initrd_cmd ? initrd_cmd : "", - dt_cmd ? dt_cmd : ""); - -- grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry); -+ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, NULL, NULL, entry); - - finish: - grub_free (linux_cmd); -@@ -776,6 +1034,70 @@ bls_create_entry (grub_blsuki_entry_t *entry) - grub_free (src); - } - -+#ifdef GRUB_MACHINE_EFI -+/* -+ * This function puts together the section data received from the UKI and -+ * generates a new entry in the GRUB boot menu. -+ */ -+static void -+uki_create_entry (grub_blsuki_entry_t *entry) -+{ -+ const char **argv = NULL; -+ char *id = entry->filename; -+ char *title = NULL; -+ char *options = NULL; -+ char *osrel, *osrel_line; -+ char *key = NULL; -+ char *value = NULL; -+ char *src = NULL; -+ bool blsuki_save_default; -+ -+ /* -+ * Although .osrel is listed as optional in the UKI specification, the .osrel -+ * section is needed to generate the GRUB menu entry title. -+ */ -+ osrel = blsuki_get_val (entry, ".osrel", NULL); -+ if (osrel == NULL) -+ { -+ grub_dprintf ("blsuki", "Skipping file %s with no '.osrel' key.\n", entry->filename); -+ goto finish; -+ } -+ -+ osrel_line = osrel; -+ while ((key = uki_read_osrel (&osrel_line, &value)) != NULL) -+ { -+ if (grub_strcmp ("PRETTY_NAME", key) == 0) -+ { -+ title = value; -+ break; -+ } -+ } -+ -+ options = blsuki_get_val (entry, ".cmdline", NULL); -+ -+ argv = grub_zalloc (2 * sizeof (char *)); -+ if (argv == NULL) -+ goto finish; -+ argv[0] = title; -+ -+ blsuki_save_default = grub_env_get_bool ("blsuki_save_default", false); -+ src = grub_xasprintf ("%schainloader (%s)%s/%s%s%s\n", -+ blsuki_save_default ? "savedefault\n" : "", -+ entry->devid, entry->dirname, -+ entry->filename, -+ (options != NULL) ? " " : "", -+ (options != NULL) ? options : ""); -+ -+ grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, NULL, NULL, entry); -+ -+ finish: -+ grub_free (argv); -+ grub_free (src); -+ grub_free (options); -+ grub_free (osrel); -+} -+#endif -+ - /* - * This function fills a find_entry_info struct passed in by the info parameter. - * If the dirname or devid parameters are set to NULL, the dirname and devid -@@ -785,7 +1107,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) - * device. - */ - static grub_err_t --blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid) -+blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid, enum blsuki_cmd_type cmd_type) - { - grub_device_t dev; - grub_fs_t fs; -@@ -795,10 +1117,23 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c - - if (devid == NULL) - { -+ if (cmd_type == BLSUKI_BLS_CMD) -+ { - #ifdef GRUB_MACHINE_EMU -- devid = "host"; -+ devid = "host"; - #else -- devid = grub_env_get ("root"); -+ devid = grub_env_get ("root"); -+#endif -+ } -+#ifdef GRUB_MACHINE_EFI -+ else if (cmd_type == BLSUKI_UKI_CMD) -+ { -+ grub_efi_loaded_image_t *image = grub_efi_get_loaded_image (grub_efi_image_handle); -+ -+ if (image == NULL) -+ return grub_error (GRUB_ERR_BAD_DEVICE, N_("unable to find boot device")); -+ devid = grub_efidisk_get_device_name (image->device_handle); -+ } - #endif - if (devid == NULL) - return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); -@@ -837,15 +1172,16 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c - } - - /* -- * This function searches for BLS config files based on the data in the info -- * parameter. If the fallback option is enabled, the default location will be -- * checked for BLS config files if the first attempt fails. -+ * This function searches for BLS config files and UKIs based on the data in the -+ * info parameter. If the fallback option is enabled, the default location will -+ * be checked for BLS config files or UKIs if the first attempt fails. - */ - static grub_err_t --blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) -+blsuki_find_entry (struct find_entry_info *info, bool enable_fallback, enum blsuki_cmd_type cmd_type) - { - struct read_entry_info read_entry_info; - char *default_dir = NULL; -+ const char *cmd_dir = NULL; - char *tmp; - grub_size_t default_size; - grub_fs_t dir_fs = NULL; -@@ -862,6 +1198,7 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - dir_dev = info->dev; - dir_fs = info->fs; - read_entry_info.devid = info->devid; -+ read_entry_info.cmd_type = cmd_type; - - r = dir_fs->fs_dir (dir_dev, read_entry_info.dirname, blsuki_read_entry, - &read_entry_info); -@@ -874,19 +1211,27 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - /* - * If we aren't able to find BLS entries in the directory given by info->dirname, - * we can fallback to the default location "/boot/loader/entries/" and see if we -- * can find the files there. -+ * can find the files there. If we can't find UKI entries, fallback to -+ * "/EFI/Linux" on the EFI system partition. - */ - if (entries == NULL && fallback == false && enable_fallback == true) - { -- default_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 1; -+ if (cmd_type == BLSUKI_BLS_CMD) -+ cmd_dir = GRUB_BLS_CONFIG_PATH; -+#ifdef GRUB_MACHINE_EFI -+ else if (cmd_type == BLSUKI_UKI_CMD) -+ cmd_dir = GRUB_UKI_CONFIG_PATH; -+#endif -+ -+ default_size = sizeof (GRUB_BOOT_DEVICE) + grub_strlen (cmd_dir); - default_dir = grub_malloc (default_size); - if (default_dir == NULL) - return grub_errno; - - tmp = blsuki_update_boot_device (default_dir); -- tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); -+ tmp = grub_stpcpy (tmp, cmd_dir); - -- blsuki_set_find_entry_info (info, default_dir, NULL); -+ blsuki_set_find_entry_info (info, default_dir, NULL, cmd_type); - grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", - read_entry_info.dirname, info->dirname); - fallback = true; -@@ -901,15 +1246,17 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) - } - - static grub_err_t --blsuki_load_entries (char *path, bool enable_fallback) -+blsuki_load_entries (char *path, bool enable_fallback, enum blsuki_cmd_type cmd_type) - { -- grub_size_t len; -+ grub_size_t len, ext_len = 0; - static grub_err_t r; - const char *devid = NULL; - char *dir = NULL; - char *default_dir = NULL; - char *tmp; -+ const char *cmd_dir = NULL; - grub_size_t dir_size; -+ const char *ext = NULL; - struct find_entry_info info = { - .dev = NULL, - .fs = NULL, -@@ -918,12 +1265,26 @@ blsuki_load_entries (char *path, bool enable_fallback) - struct read_entry_info rei = { - .devid = NULL, - .dirname = NULL, -+ .cmd_type = cmd_type, - }; - - if (path != NULL) - { -+ if (cmd_type == BLSUKI_BLS_CMD) -+ { -+ ext = ".conf"; -+ ext_len = BLS_EXT_LEN; -+ } -+#ifdef GRUB_MACHINE_EFI -+ else if (cmd_type == BLSUKI_UKI_CMD) -+ { -+ ext = ".efi"; -+ ext_len = UKI_EXT_LEN; -+ } -+#endif -+ - len = grub_strlen (path); -- if (len >= BLS_EXT_LEN && grub_strcmp (path + len - BLS_EXT_LEN, ".conf") == 0) -+ if (len >= ext_len && grub_strcmp (path + len - ext_len, ext) == 0) - { - rei.file = grub_file_open (path, GRUB_FILE_TYPE_CONFIG); - if (rei.file == NULL) -@@ -952,19 +1313,26 @@ blsuki_load_entries (char *path, bool enable_fallback) - - if (dir == NULL) - { -- dir_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 2; -+ if (cmd_type == BLSUKI_BLS_CMD) -+ cmd_dir = GRUB_BLS_CONFIG_PATH; -+#ifdef GRUB_MACHINE_EFI -+ else if (cmd_type == BLSUKI_UKI_CMD) -+ cmd_dir = GRUB_UKI_CONFIG_PATH; -+#endif -+ -+ dir_size = sizeof (GRUB_BOOT_DEVICE) + grub_strlen (cmd_dir); - default_dir = grub_malloc (dir_size); - if (default_dir == NULL) - return grub_errno; - - tmp = blsuki_update_boot_device (default_dir); -- tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); -+ tmp = grub_stpcpy (tmp, cmd_dir); - dir = default_dir; - } - -- r = blsuki_set_find_entry_info (&info, dir, devid); -+ r = blsuki_set_find_entry_info (&info, dir, devid, cmd_type); - if (r == GRUB_ERR_NONE) -- r = blsuki_find_entry (&info, enable_fallback); -+ r = blsuki_find_entry (&info, enable_fallback, cmd_type); - - if (info.dev != NULL) - grub_device_close (info.dev); -@@ -1002,11 +1370,11 @@ blsuki_is_default_entry (const char *def_entry, grub_blsuki_entry_t *entry, int - } - - /* -- * This function creates a GRUB boot menu entry for each BLS entry in the -- * entries list. -+ * This function creates a GRUB boot menu entry for each BLS or UKI entry in -+ * the entries list. - */ - static grub_err_t --blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) -+blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id, enum blsuki_cmd_type cmd_type) - { - const char *def_entry = NULL; - grub_blsuki_entry_t *entry = NULL; -@@ -1025,7 +1393,12 @@ blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) - (show_non_default == true && blsuki_is_default_entry (def_entry, entry, idx) == false) || - (entry_id != NULL && grub_strcmp (entry_id, entry->filename) == 0)) - { -- bls_create_entry (entry); -+ if (cmd_type == BLSUKI_BLS_CMD) -+ bls_create_entry (entry); -+#ifdef GRUB_MACHINE_EFI -+ else if (cmd_type == BLSUKI_UKI_CMD) -+ uki_create_entry (entry); -+#endif - entry->visible = true; - } - -@@ -1036,8 +1409,7 @@ blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) - } - - static grub_err_t --grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), -- char **args __attribute__ ((unused))) -+blsuki_cmd (grub_extcmd_context_t ctxt, enum blsuki_cmd_type cmd_type) - { - grub_err_t err; - struct grub_arg_list *state = ctxt->state; -@@ -1074,24 +1446,50 @@ grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), - show_non_default = true; - } - -- err = blsuki_load_entries (path, enable_fallback); -+ err = blsuki_load_entries (path, enable_fallback, cmd_type); - if (err != GRUB_ERR_NONE) - return err; - -- return blsuki_create_entries (show_default, show_non_default, entry_id); -+ return blsuki_create_entries (show_default, show_non_default, entry_id, cmd_type); -+} -+ -+static grub_err_t -+grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), -+ char **args __attribute__ ((unused))) -+{ -+ return blsuki_cmd (ctxt, BLSUKI_BLS_CMD); - } - - static grub_extcmd_t bls_cmd; - -+#ifdef GRUB_MACHINE_EFI -+static grub_err_t -+grub_cmd_uki (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), -+ char **args __attribute__ ((unused))) -+{ -+ return blsuki_cmd (ctxt, BLSUKI_UKI_CMD); -+} -+ -+static grub_extcmd_t uki_cmd; -+#endif -+ - GRUB_MOD_INIT(blsuki) - { - bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, - N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), - N_("Import Boot Loader Specification snippets."), - bls_opt); -+#ifdef GRUB_MACHINE_EFI -+ uki_cmd = grub_register_extcmd ("uki", grub_cmd_uki, 0, -+ N_("[-p|--path] DIR [-f|--enable-fallback] [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), -+ N_("Import Unified Kernel Images"), uki_opt); -+#endif - } - - GRUB_MOD_FINI(blsuki) - { - grub_unregister_extcmd (bls_cmd); -+#ifdef GRUB_MACHINE_EFI -+ grub_unregister_extcmd (uki_cmd); -+#endif - } -diff --git a/include/grub/menu.h b/include/grub/menu.h -index 43a3c5809b..0e4978dc3b 100644 ---- a/include/grub/menu.h -+++ b/include/grub/menu.h -@@ -39,6 +39,8 @@ struct grub_blsuki_entry - grub_size_t keyvals_size; - int nkeyvals; - char *filename; -+ char *dirname; -+ char *devid; - bool visible; - }; - typedef struct grub_blsuki_entry grub_blsuki_entry_t; diff --git a/0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch b/0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch deleted file mode 100644 index d5932723..00000000 --- a/0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch +++ /dev/null @@ -1,168 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Daniel Axtens -Date: Fri, 15 Nov 2024 15:34:29 +0800 -Subject: [PATCH] posix_wrap: Tweaks in preparation for libtasn1 - -Cc: Vladimir Serbinenko -Signed-off-by: Daniel Axtens -Signed-off-by: Gary Lin -Reviewed-by: Daniel Kiper -Tested-by: Stefan Berger ---- - grub-core/lib/posix_wrap/c-ctype.h | 114 +++++++++++++++++++++++++++++++++++++ - grub-core/lib/posix_wrap/string.h | 21 +++++++ - 2 files changed, 135 insertions(+) - create mode 100644 grub-core/lib/posix_wrap/c-ctype.h - -diff --git a/grub-core/lib/posix_wrap/c-ctype.h b/grub-core/lib/posix_wrap/c-ctype.h -new file mode 100644 -index 0000000000..5f8fc8ce3f ---- /dev/null -+++ b/grub-core/lib/posix_wrap/c-ctype.h -@@ -0,0 +1,114 @@ -+/* -+ * GRUB -- GRand Unified Bootloader -+ * Copyright (C) 2024 Free Software Foundation, Inc. -+ * -+ * GRUB is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GRUB is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GRUB. If not, see . -+ */ -+ -+#ifndef GRUB_POSIX_C_CTYPE_H -+#define GRUB_POSIX_C_CTYPE_H 1 -+ -+#include -+ -+static inline bool -+c_isspace (int c) -+{ -+ return !!grub_isspace (c); -+} -+ -+static inline bool -+c_isdigit (int c) -+{ -+ return !!grub_isdigit (c); -+} -+ -+static inline bool -+c_islower (int c) -+{ -+ return !!grub_islower (c); -+} -+ -+static inline bool -+c_isascii (int c) -+{ -+ return !(c & ~0x7f); -+} -+ -+static inline bool -+c_isupper (int c) -+{ -+ return !!grub_isupper (c); -+} -+ -+static inline bool -+c_isxdigit (int c) -+{ -+ return !!grub_isxdigit (c); -+} -+ -+static inline bool -+c_isprint (int c) -+{ -+ return !!grub_isprint (c); -+} -+ -+static inline bool -+c_iscntrl (int c) -+{ -+ return !grub_isprint (c); -+} -+ -+static inline bool -+c_isgraph (int c) -+{ -+ return grub_isprint (c) && !grub_isspace (c); -+} -+ -+static inline bool -+c_isalnum (int c) -+{ -+ return grub_isalpha (c) || grub_isdigit (c); -+} -+ -+static inline bool -+c_ispunct (int c) -+{ -+ return grub_isprint (c) && !grub_isspace (c) && !c_isalnum (c); -+} -+ -+static inline bool -+c_isalpha (int c) -+{ -+ return !!grub_isalpha (c); -+} -+ -+static inline bool -+c_isblank (int c) -+{ -+ return c == ' ' || c == '\t'; -+} -+ -+static inline int -+c_tolower (int c) -+{ -+ return grub_tolower (c); -+} -+ -+static inline int -+c_toupper (int c) -+{ -+ return grub_toupper (c); -+} -+ -+#endif -diff --git a/grub-core/lib/posix_wrap/string.h b/grub-core/lib/posix_wrap/string.h -index 1adb450b5a..d3e400d500 100644 ---- a/grub-core/lib/posix_wrap/string.h -+++ b/grub-core/lib/posix_wrap/string.h -@@ -84,6 +84,27 @@ memchr (const void *s, int c, grub_size_t n) - return grub_memchr (s, c, n); - } - -+static inline char * -+strncat (char *dest, const char *src, grub_size_t n) -+{ -+ const char *end; -+ char *str = dest; -+ grub_size_t src_len; -+ -+ dest += grub_strlen (dest); -+ -+ end = grub_memchr (src, '\0', n); -+ if (end != NULL) -+ src_len = (grub_size_t) (end - src); -+ else -+ src_len = n; -+ -+ dest[src_len] = '\0'; -+ grub_memcpy (dest, src, src_len); -+ -+ return str; -+} -+ - #define memcmp grub_memcmp - #define memcpy grub_memcpy - #define memmove grub_memmove diff --git a/0390-blsuki-do-not-register-blscfg-command.patch b/0390-blsuki-do-not-register-blscfg-command.patch deleted file mode 100644 index 3fd4fa59..00000000 --- a/0390-blsuki-do-not-register-blscfg-command.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Thu, 13 Nov 2025 11:57:52 -0600 -Subject: [PATCH] blsuki: do not register blscfg command - -The blscfg command is already defined on commands/blscfg.c so do not -register it on blsuki.c. Also, the 'uki' command is only intended for -EFI system so remove the other platforms from the module. - -Signed-off-by: Leo Sandoval ---- - grub-core/Makefile.core.def | 2 -- - grub-core/commands/blsuki.c | 4 ---- - 2 files changed, 6 deletions(-) - -diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def -index 885dd436de..a545ee430b 100644 ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -893,8 +893,6 @@ module = { - common = lib/gnulib/filevercmp.c; - enable = powerpc_ieee1275; - enable = efi; -- enable = i386_pc; -- enable = emu; - cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; - cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; - }; -diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c -index cb00f936a7..bcd0114d85 100644 ---- a/grub-core/commands/blsuki.c -+++ b/grub-core/commands/blsuki.c -@@ -1475,10 +1475,6 @@ static grub_extcmd_t uki_cmd; - - GRUB_MOD_INIT(blsuki) - { -- bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, -- N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), -- N_("Import Boot Loader Specification snippets."), -- bls_opt); - #ifdef GRUB_MACHINE_EFI - uki_cmd = grub_register_extcmd ("uki", grub_cmd_uki, 0, - N_("[-p|--path] DIR [-f|--enable-fallback] [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), diff --git a/0391-misc-add-z-length-modifier-support.patch b/0391-misc-add-z-length-modifier-support.patch deleted file mode 100644 index 2fdcd77c..00000000 --- a/0391-misc-add-z-length-modifier-support.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:32 +0800 -Subject: [PATCH] misc: add z length modifier support - -Add support for the 'z' length modifier in the printf code. This allows -printing of size_t and ssize_t values using %zu, %zd and related -formats. The parser maps 'z' to the correct integer width based on -sizeof (size_t). - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Daniel Kiper ---- - grub-core/kern/misc.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c -index c1c77c300c..2568a5489b 100644 ---- a/grub-core/kern/misc.c -+++ b/grub-core/kern/misc.c -@@ -30,6 +30,7 @@ - #if DEBUG_WITH_TIMESTAMPS - #include - #endif -+#include - - union printf_arg - { -@@ -883,6 +884,9 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, - COMPILE_TIME_ASSERT (sizeof (long) <= sizeof (long long)); - COMPILE_TIME_ASSERT (sizeof (long long) == sizeof (void *) - || sizeof (int) == sizeof (void *)); -+ COMPILE_TIME_ASSERT (sizeof (size_t) == sizeof (unsigned) -+ || sizeof (size_t) == sizeof (unsigned long) -+ || sizeof (size_t) == sizeof (unsigned long long)); - - fmt = fmt0; - while ((c = *fmt++) != 0) -@@ -917,11 +921,17 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, - fmt++; - - c = *fmt++; -+ if (c == 'z') -+ { -+ c = *fmt++; -+ goto do_count; -+ } - if (c == 'l') - c = *fmt++; - if (c == 'l') - c = *fmt++; - -+ do_count: - switch (c) - { - case 'p': -@@ -1018,6 +1028,14 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, - continue; - } - -+ if (c == 'z') -+ { -+ c = *fmt++; -+ if (sizeof (size_t) == sizeof (unsigned long)) -+ longfmt = 1; -+ else if (sizeof (size_t) == sizeof (unsigned long long)) -+ longfmt = 2; -+ } - if (c == 'l') - { - c = *fmt++; -@@ -1194,6 +1212,8 @@ grub_vsnprintf_real (char *str, grub_size_t max_len, const char *fmt0, - } - - c = *fmt++; -+ if (c == 'z') -+ c = *fmt++; - if (c == 'l') - c = *fmt++; - if (c == 'l') diff --git a/0392-tests-add-z-modifier-printf-tests.patch b/0392-tests-add-z-modifier-printf-tests.patch deleted file mode 100644 index ce86dc4a..00000000 --- a/0392-tests-add-z-modifier-printf-tests.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:33 +0800 -Subject: [PATCH] tests: add z modifier printf tests - -Add unit tests for %zd, %zu and %zx to verify size_t and ssize_t -formatting matches system snprintf. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Daniel Kiper ---- - tests/printf_unit_test.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/tests/printf_unit_test.c b/tests/printf_unit_test.c -index 098c29fd9c..f2de187b03 100644 ---- a/tests/printf_unit_test.c -+++ b/tests/printf_unit_test.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - #define MSG "printf test failed: %s, %s", real, expected - -@@ -73,6 +74,15 @@ printf_test (void) - grub_snprintf (real, sizeof (real), "%%0%dd ", 1); - snprintf (expected, sizeof (expected), "%%0%dd ", 1); - grub_test_assert (strcmp (real, expected) == 0, MSG); -+ grub_snprintf (real, sizeof (real), "%zd %zd %zd", (ssize_t) -1, (ssize_t) (SIZE_MAX >> 1), (ssize_t) 42); -+ snprintf (expected, sizeof (expected), "%zd %zd %zd", (ssize_t) -1, (ssize_t) (SIZE_MAX >> 1), (ssize_t) 42); -+ grub_test_assert (strcmp (real, expected) == 0, MSG); -+ grub_snprintf (real, sizeof (real), "%zu %zu %zu", (size_t) 0, (size_t) SIZE_MAX, (size_t) 42); -+ snprintf (expected, sizeof (expected), "%zu %zu %zu", (size_t) 0, (size_t) SIZE_MAX, (size_t) 42); -+ grub_test_assert (strcmp (real, expected) == 0, MSG); -+ grub_snprintf (real, sizeof (real), "%zx %zx %zx", (ssize_t) (SIZE_MAX >> 1), (size_t) SIZE_MAX, (size_t) 0xdeadbeefU); -+ snprintf (expected, sizeof (expected), "%zx %zx %zx", (ssize_t) (SIZE_MAX >> 1), (size_t) SIZE_MAX, (size_t) 0xdeadbeefU); -+ grub_test_assert (strcmp (real, expected) == 0, MSG); - } - - GRUB_UNIT_TEST ("printf_unit_test", printf_test); diff --git a/0393-util-grub-editenv-add-fs_envblk-open-helper.patch b/0393-util-grub-editenv-add-fs_envblk-open-helper.patch deleted file mode 100644 index 893c4c71..00000000 --- a/0393-util-grub-editenv-add-fs_envblk-open-helper.patch +++ /dev/null @@ -1,219 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:34 +0800 -Subject: [PATCH] util/grub-editenv: add fs_envblk open helper - -This patch adds the logic to locate and open an environment block that -is stored in a reserved area on the device. It introduces the function -fs_envblk_open() together with helper routines to read the block pointed -to by the env_block variable, and to create the block on disk when it -does not exist yet. When a block is created, the code records its -location inside the file based envblk by setting env_block in block list -syntax of offset plus size in sectors. - -The env_block variable acts as a link from the file envblk to the raw -disk region so that later runs of grub-editenv can follow it and access -the external block. The helper is exposed through a small ops table -attached to fs_envblk so that later patches can call -fs_envblk->ops->open() without touching core code again. At this stage -variables are still stored in the file envblk and no redirection has -been applied. - -In relation to this, the fs_envblk_spec table defines the file-system -specific layout of the reserved raw blocks used for environment storage. -It is prepared to facilitate integration in grub-editenv, with Btrfs to -be added in the future once its reserved area is defined. - -An fs_envblk_init() helper is added to prepare it for using the ops with -its associated data context if the feature is available. It is not used -yet, but will be used later when a filesystem and its device are probed -to initialize the fs_envblk handle and enable access to the feature. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan ---- - util/grub-editenv.c | 170 ++++++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 170 insertions(+) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index 948eec8a11..a544452e78 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -123,6 +123,176 @@ block, use `rm %s'."), - NULL, help_filter, NULL - }; - -+struct fs_envblk_spec { -+ const char *fs_name; -+ off_t offset; -+ size_t size; -+}; -+typedef struct fs_envblk_spec fs_envblk_spec_t; -+ -+static grub_envblk_t fs_envblk_open (grub_envblk_t envblk); -+ -+struct fs_envblk_ops { -+ grub_envblk_t (*open) (grub_envblk_t); -+}; -+typedef struct fs_envblk_ops fs_envblk_ops_t; -+ -+struct fs_envblk { -+ fs_envblk_spec_t *spec; -+ fs_envblk_ops_t *ops; -+ const char *dev; -+}; -+typedef struct fs_envblk *fs_envblk_t; -+ -+static fs_envblk_ops_t fs_envblk_ops = { -+ .open = fs_envblk_open -+}; -+ -+/* -+ * fs_envblk_spec describes the file-system specific layout of reserved raw -+ * blocks used as environment blocks. -+ */ -+static fs_envblk_spec_t fs_envblk_spec[] = { -+ { NULL, 0, 0 } -+}; -+ -+static fs_envblk_t fs_envblk = NULL; -+ -+static void __attribute__ ((unused)) -+fs_envblk_init (const char *fs_name, const char *dev) -+{ -+ fs_envblk_spec_t *p; -+ -+ if (fs_name == NULL || dev == NULL) -+ return; -+ -+ for (p = fs_envblk_spec; p->fs_name != NULL; p++) -+ { -+ if (strcmp (fs_name, p->fs_name) == 0) -+ { -+ if (fs_envblk == NULL) -+ fs_envblk = xmalloc (sizeof (*fs_envblk)); -+ fs_envblk->spec = p; -+ fs_envblk->dev = xstrdup (dev); -+ fs_envblk->ops = &fs_envblk_ops; -+ break; -+ } -+ } -+} -+ -+static int -+read_env_block_var (const char *varname, const char *value, void *hook_data) -+{ -+ grub_envblk_t *p_envblk = (grub_envblk_t *) hook_data; -+ off_t off; -+ size_t sz; -+ char *p, *buf; -+ FILE *fp; -+ -+ if (p_envblk == NULL || fs_envblk == NULL) -+ return 1; -+ -+ if (strcmp (varname, "env_block") != 0) -+ return 0; -+ -+ off = strtol (value, &p, 10); -+ if (*p == '+') -+ sz = strtol (p + 1, &p, 10); -+ else -+ return 0; -+ -+ if (*p != '\0' || sz == 0) -+ return 0; -+ -+ off <<= GRUB_DISK_SECTOR_BITS; -+ sz <<= GRUB_DISK_SECTOR_BITS; -+ -+ fp = grub_util_fopen (fs_envblk->dev, "rb"); -+ if (fp == NULL) -+ grub_util_error (_("cannot open `%s': %s"), fs_envblk->dev, strerror (errno)); -+ -+ if (fseek (fp, off, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), fs_envblk->dev, strerror (errno)); -+ -+ buf = xmalloc (sz); -+ if ((fread (buf, 1, sz, fp)) != sz) -+ grub_util_error (_("cannot read `%s': %s"), fs_envblk->dev, strerror (errno)); -+ -+ fclose (fp); -+ -+ *p_envblk = grub_envblk_open (buf, sz); -+ -+ return 1; -+} -+ -+static void -+create_env_on_block (void) -+{ -+ FILE *fp; -+ char *buf; -+ const char *device; -+ off_t offset; -+ size_t size; -+ -+ if (fs_envblk == NULL) -+ return; -+ -+ device = fs_envblk->dev; -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ fp = grub_util_fopen (device, "r+b"); -+ if (fp == NULL) -+ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); -+ -+ buf = xmalloc (size); -+ memcpy (buf, GRUB_ENVBLK_SIGNATURE, sizeof (GRUB_ENVBLK_SIGNATURE) - 1); -+ memset (buf + sizeof (GRUB_ENVBLK_SIGNATURE) - 1, '#', size - sizeof (GRUB_ENVBLK_SIGNATURE) + 1); -+ -+ if (fseek (fp, offset, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); -+ -+ if (fwrite (buf, 1, size, fp) != size) -+ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); -+ -+ grub_util_file_sync (fp); -+ free (buf); -+ fclose (fp); -+} -+ -+static grub_envblk_t -+fs_envblk_open (grub_envblk_t envblk) -+{ -+ grub_envblk_t envblk_on_block = NULL; -+ char *val; -+ off_t offset; -+ size_t size; -+ -+ if (envblk == NULL) -+ return NULL; -+ -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); -+ -+ if (envblk_on_block != NULL && grub_envblk_size (envblk_on_block) == size) -+ return envblk_on_block; -+ -+ create_env_on_block (); -+ -+ offset = offset >> GRUB_DISK_SECTOR_BITS; -+ size = (size + GRUB_DISK_SECTOR_SIZE - 1) >> GRUB_DISK_SECTOR_BITS; -+ -+ val = xasprintf ("%lld+%zu", (long long) offset, size); -+ if (grub_envblk_set (envblk, "env_block", val) == 0) -+ grub_util_error ("%s", _("environment block too small")); -+ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); -+ free (val); -+ -+ return envblk_on_block; -+} -+ - static grub_envblk_t - open_envblk_file (const char *name) - { diff --git a/0394-util-grub-editenv-add-fs_envblk-write-helper.patch b/0394-util-grub-editenv-add-fs_envblk-write-helper.patch deleted file mode 100644 index f94f747e..00000000 --- a/0394-util-grub-editenv-add-fs_envblk-write-helper.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:35 +0800 -Subject: [PATCH] util/grub-editenv: add fs_envblk write helper - -This patch adds the function fs_envblk_write to update the reserved -environment block on disk. The helper takes an in memory envblk buffer -and writes it back to the device at the location defined by the -fs_envblk specification. It performs size checks and uses file sync to -ensure that the updated data is flushed. - -The helper is also added into the fs_envblk ops table, together with the -open helper from the previous patch. With this change the basic input -and output path for an external environment block is complete. The -choice of which variables should be written externally will be handled -by later patches. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan -Reviewed-by: Daniel Kiper ---- - util/grub-editenv.c | 38 +++++++++++++++++++++++++++++++++++++- - 1 file changed, 37 insertions(+), 1 deletion(-) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index a544452e78..f4b69bb19f 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -131,9 +131,11 @@ struct fs_envblk_spec { - typedef struct fs_envblk_spec fs_envblk_spec_t; - - static grub_envblk_t fs_envblk_open (grub_envblk_t envblk); -+static void fs_envblk_write (grub_envblk_t envblk); - - struct fs_envblk_ops { - grub_envblk_t (*open) (grub_envblk_t); -+ void (*write) (grub_envblk_t); - }; - typedef struct fs_envblk_ops fs_envblk_ops_t; - -@@ -145,7 +147,8 @@ struct fs_envblk { - typedef struct fs_envblk *fs_envblk_t; - - static fs_envblk_ops_t fs_envblk_ops = { -- .open = fs_envblk_open -+ .open = fs_envblk_open, -+ .write = fs_envblk_write - }; - - /* -@@ -381,6 +384,39 @@ write_envblk (const char *name, grub_envblk_t envblk) - fclose (fp); - } - -+static void -+fs_envblk_write (grub_envblk_t envblk) -+{ -+ FILE *fp; -+ const char *device; -+ off_t offset; -+ size_t size; -+ -+ if (envblk == NULL) -+ return; -+ -+ device = fs_envblk->dev; -+ offset = fs_envblk->spec->offset; -+ size = fs_envblk->spec->size; -+ -+ if (grub_envblk_size (envblk) > size) -+ grub_util_error ("%s", _("environment block too small")); -+ -+ fp = grub_util_fopen (device, "r+b"); -+ -+ if (fp == NULL) -+ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); -+ -+ if (fseek (fp, offset, SEEK_SET) < 0) -+ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); -+ -+ if (fwrite (grub_envblk_buffer (envblk), 1, grub_envblk_size (envblk), fp) != grub_envblk_size (envblk)) -+ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); -+ -+ grub_util_file_sync (fp); -+ fclose (fp); -+} -+ - static void - set_variables (const char *name, int argc, char *argv[]) - { diff --git a/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch b/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch deleted file mode 100644 index bf9820a3..00000000 --- a/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:36 +0800 -Subject: [PATCH] util/grub-editenv: wire set_variables to optional fs_envblk - -This patch changes set_variables() so that it can use an external -environment block when one is present. The variable next_entry is -written into the external block, env_block is treated as read only, and -all other variables are written into the normal file based envblk. - -A cleanup step is added to handle cases where GRUB at runtime writes -variables into the external block because file based updates are not -safe on a copy on write filesystem such as Btrfs. For example, the -savedefault command can update saved_entry, and on Btrfs GRUB will place -that update in the external block instead of the file envblk. If an -older copy remains in the external block, it would override the newer -value from the file envblk when GRUB first loads the file and then -applies the external block on top of it. To avoid this, whenever a -variable is updated in the file envblk, any same named key in the -external block is deleted. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan -Reviewed-by: Daniel Kiper ---- - util/grub-editenv.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 56 insertions(+), 2 deletions(-) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index f4b69bb19f..be844bf902 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -417,12 +417,35 @@ fs_envblk_write (grub_envblk_t envblk) - fclose (fp); - } - -+struct var_lookup_ctx { -+ const char *varname; -+ bool found; -+}; -+typedef struct var_lookup_ctx var_lookup_ctx_t; -+ -+static int -+var_lookup_iter (const char *varname, const char *value __attribute__ ((unused)), void *hook_data) -+{ -+ var_lookup_ctx_t *ctx = (var_lookup_ctx_t *) hook_data; -+ -+ if (grub_strcmp (ctx->varname, varname) == 0) -+ { -+ ctx->found = true; -+ return 1; -+ } -+ return 0; -+} -+ - static void - set_variables (const char *name, int argc, char *argv[]) - { - grub_envblk_t envblk; -+ grub_envblk_t envblk_on_block = NULL; - - envblk = open_envblk_file (name); -+ if (fs_envblk != NULL) -+ envblk_on_block = fs_envblk->ops->open (envblk); -+ - while (argc) - { - char *p; -@@ -433,15 +456,46 @@ set_variables (const char *name, int argc, char *argv[]) - - *(p++) = 0; - -- if (! grub_envblk_set (envblk, argv[0], p)) -- grub_util_error ("%s", _("environment block too small")); -+ if ((strcmp (argv[0], "next_entry") == 0) && envblk_on_block != NULL) -+ { -+ if (grub_envblk_set (envblk_on_block, argv[0], p) == 0) -+ grub_util_error ("%s", _("environment block too small")); -+ goto next; -+ } - -+ if (strcmp (argv[0], "env_block") == 0) -+ { -+ grub_util_warn (_("can't set env_block as it's read-only")); -+ goto next; -+ } -+ -+ if (grub_envblk_set (envblk, argv[0], p) == 0) -+ grub_util_error ("%s", _("environment block too small")); -+ -+ if (envblk_on_block != NULL) -+ { -+ var_lookup_ctx_t ctx = { -+ .varname = argv[0], -+ .found = false -+ }; -+ -+ grub_envblk_iterate (envblk_on_block, &ctx, var_lookup_iter); -+ if (ctx.found == true) -+ grub_envblk_delete (envblk_on_block, argv[0]); -+ } -+ next: - argc--; - argv++; - } - - write_envblk (name, envblk); - grub_envblk_close (envblk); -+ -+ if (envblk_on_block != NULL) -+ { -+ fs_envblk->ops->write (envblk_on_block); -+ grub_envblk_close (envblk_on_block); -+ } - } - - static void diff --git a/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch b/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch deleted file mode 100644 index 4b517b39..00000000 --- a/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:37 +0800 -Subject: [PATCH] util/grub-editenv: wire unset_variables to optional fs_envblk - -This patch updates unset_variables() so that removals are also applied -to the external environment block when it is present. The code opens the -external block, deletes the same named keys there, and then writes the -external block back using fs_envblk_write(). The file based envblk is -still updated and written as before. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan -Reviewed-by: Daniel Kiper ---- - util/grub-editenv.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index be844bf902..7ff1da9b40 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -502,18 +502,32 @@ static void - unset_variables (const char *name, int argc, char *argv[]) - { - grub_envblk_t envblk; -+ grub_envblk_t envblk_on_block = NULL; - - envblk = open_envblk_file (name); -+ -+ if (fs_envblk != NULL) -+ envblk_on_block = fs_envblk->ops->open (envblk); -+ - while (argc) - { - grub_envblk_delete (envblk, argv[0]); - -+ if (envblk_on_block != NULL) -+ grub_envblk_delete (envblk_on_block, argv[0]); -+ - argc--; - argv++; - } - - write_envblk (name, envblk); - grub_envblk_close (envblk); -+ -+ if (envblk_on_block != NULL) -+ { -+ fs_envblk->ops->write (envblk_on_block); -+ grub_envblk_close (envblk_on_block); -+ } - } - - struct get_int_value_params { diff --git a/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch b/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch deleted file mode 100644 index 5687886d..00000000 --- a/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:38 +0800 -Subject: [PATCH] util/grub-editenv: wire list_variables to optional fs_envblk - -This patch updates list_variables() so that it also prints entries from -the external environment block when one is present. The function first -lists all variables from the file based envblk, then iterates over the -external envblk and prints those as well. - -The output format remains the same as before. The change makes it -possible to inspect variables regardless of whether they are stored in -the file envblk or in the reserved block. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan -Reviewed-by: Sudhakar Kuppusamy -Reviewed-by: Daniel Kiper ---- - util/grub-editenv.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index 7ff1da9b40..170d8f139a 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -358,10 +358,17 @@ static void - list_variables (const char *name) - { - grub_envblk_t envblk; -+ grub_envblk_t envblk_on_block = NULL; - - envblk = open_envblk_file (name); -+ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); - grub_envblk_iterate (envblk, NULL, print_var); - grub_envblk_close (envblk); -+ if (envblk_on_block != NULL) -+ { -+ grub_envblk_iterate (envblk_on_block, NULL, print_var); -+ grub_envblk_close (envblk_on_block); -+ } - } - - static void diff --git a/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch b/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch deleted file mode 100644 index 9d583168..00000000 --- a/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:39 +0800 -Subject: [PATCH] util/grub-editenv: add probe call for external envblk - -This patch adds the probe_fs_envblk() function to identify the root -filesystem and invoke fs_envblk_init() with the probed filesystem type -and device. This checks if the feature is available and initializes the -handle, fs_envblk, to access the external environment block. It avoids -configurations with diskfilter or cryptodisk where filesystem blocks may -be remapped or encrypted. - -The probe is only invoked when grub-editenv is working on the default -environment file path. This restriction ensures that probing and -possible raw device access are not triggered for arbitrary user supplied -paths, but only for the standard grubenv file. In that case the code -checks if the filename equals DEFAULT_ENVBLK_PATH and then calls -probe_fs_envblk with fs_envblk_spec. The result is stored in the global -fs_envblk handle. At this stage the external environment block is only -detected and recorded, and the behavior of grub-editenv is unchanged. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Avnish Chouhan ---- - util/grub-editenv.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 113 insertions(+), 2 deletions(-) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index 170d8f139a..201dc7ccd4 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -23,8 +23,11 @@ - #include - #include - #include --#include -+#include - #include -+#include -+#include -+#include - - #include - #include -@@ -161,7 +164,7 @@ static fs_envblk_spec_t fs_envblk_spec[] = { - - static fs_envblk_t fs_envblk = NULL; - --static void __attribute__ ((unused)) -+static void - fs_envblk_init (const char *fs_name, const char *dev) - { - fs_envblk_spec_t *p; -@@ -582,6 +585,111 @@ incr_variables (const char *name, int argc, char *argv[]) - grub_envblk_close (envblk); - } - -+static bool -+is_abstraction (grub_device_t dev) -+{ -+ if (dev == NULL || dev->disk == NULL) -+ return false; -+ -+ if (dev->disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID || -+ dev->disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) -+ return true; -+ -+ return false; -+} -+ -+static void -+probe_fs_envblk (fs_envblk_spec_t *spec) -+{ -+ char **grub_devices = NULL; -+ char **curdev, **curdrive; -+ size_t ndev = 0; -+ char **grub_drives = NULL; -+ grub_device_t grub_dev = NULL; -+ grub_fs_t grub_fs = NULL; -+ bool have_abstraction = false; -+ -+ grub_util_biosdisk_init (DEFAULT_DEVICE_MAP); -+ grub_init_all (); -+ grub_gcry_init_all (); -+ -+ grub_lvm_fini (); -+ grub_mdraid09_fini (); -+ grub_mdraid1x_fini (); -+ grub_diskfilter_fini (); -+ grub_diskfilter_init (); -+ grub_mdraid09_init (); -+ grub_mdraid1x_init (); -+ grub_lvm_init (); -+ -+ grub_devices = grub_guess_root_devices (DEFAULT_DIRECTORY); -+ -+ if (grub_devices == NULL || grub_devices[0] == NULL) -+ { -+ grub_util_warn (_("cannot find a device for %s (is /dev mounted?)"), DEFAULT_DIRECTORY); -+ goto cleanup; -+ } -+ -+ for (curdev = grub_devices; *curdev != NULL; curdev++, ndev++) -+ grub_util_pull_device (*curdev); -+ -+ grub_drives = xcalloc ((ndev + 1), sizeof (grub_drives[0])); -+ -+ for (curdev = grub_devices, curdrive = grub_drives; *curdev != NULL; curdev++, -+ curdrive++) -+ { -+ *curdrive = grub_util_get_grub_dev (*curdev); -+ if (*curdrive == NULL) -+ { -+ grub_util_warn (_("cannot find a GRUB drive for %s. Check your device.map"), -+ *curdev); -+ goto cleanup; -+ } -+ } -+ *curdrive = NULL; -+ -+ grub_dev = grub_device_open (grub_drives[0]); -+ if (grub_dev == NULL) -+ { -+ grub_util_warn (_("cannot open device %s: %s"), grub_drives[0], grub_errmsg); -+ grub_errno = GRUB_ERR_NONE; -+ goto cleanup; -+ } -+ -+ grub_fs = grub_fs_probe (grub_dev); -+ if (grub_fs == NULL) -+ { -+ grub_util_warn (_("cannot probe fs for %s: %s"), grub_drives[0], grub_errmsg); -+ grub_errno = GRUB_ERR_NONE; -+ goto cleanup; -+ } -+ -+ have_abstraction = is_abstraction (grub_dev); -+ for (curdrive = grub_drives + 1; *curdrive != NULL && have_abstraction == false; curdrive++) -+ { -+ grub_device_t dev = grub_device_open (*curdrive); -+ -+ if (dev == NULL) -+ continue; -+ have_abstraction = is_abstraction (dev); -+ grub_device_close (dev); -+ } -+ -+ if (have_abstraction == false) -+ fs_envblk_init (grub_fs->name, grub_devices[0]); -+ -+ cleanup: -+ if (grub_devices != NULL) -+ for (curdev = grub_devices; *curdev != NULL; curdev++) -+ free (*curdev); -+ free (grub_devices); -+ free (grub_drives); -+ grub_device_close (grub_dev); -+ grub_gcry_fini_all (); -+ grub_fini_all (); -+ grub_util_biosdisk_fini (); -+} -+ - int - main (int argc, char *argv[]) - { -@@ -613,6 +721,9 @@ main (int argc, char *argv[]) - command = argv[curindex++]; - } - -+ if (strcmp (filename, DEFAULT_ENVBLK_PATH) == 0) -+ probe_fs_envblk (fs_envblk_spec); -+ - if (strcmp (command, "create") == 0) - grub_util_create_envblk_file (filename); - else if (strcmp (command, "list") == 0) diff --git a/0399-btrfs-add-environment-block-to-reserved-header-area.patch b/0399-btrfs-add-environment-block-to-reserved-header-area.patch deleted file mode 100644 index dd877089..00000000 --- a/0399-btrfs-add-environment-block-to-reserved-header-area.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:40 +0800 -Subject: [PATCH] btrfs: add environment block to reserved header area - -This patch reserves space for the GRUB environment block inside the -Btrfs header. The block is placed at an offset of GRUB_ENV_BTRFS_OFFSET -, 256 KiB from the start of the device, and occupies one sector. To -protect the space, overflow guard sectors are placed before and after -the reserved block. - -The Btrfs header already defines regions for bootloader use. By adding -this entry, GRUB gains a fixed and safe location to store the -environment block without conflicting with other structures in the -header. - -Add Btrfs and its reserved area information to the fs_envblk_spec table. -With the groundworks done in previous patches, the function is now -complete and working in grub-editenv. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa ---- - grub-core/fs/btrfs.c | 10 +++++++++- - include/grub/fs.h | 2 ++ - util/grub-editenv.c | 9 ++++++++- - 3 files changed, 19 insertions(+), 2 deletions(-) - -diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 3228e17886..261c413e9f 100644 ---- a/grub-core/fs/btrfs.c -+++ b/grub-core/fs/btrfs.c -@@ -2650,11 +2650,16 @@ struct embed_region { - * https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)#BOOTLOADER_SUPPORT - * The first 1 MiB on each device is unused with the exception of primary - * superblock that is on the offset 64 KiB and spans 4 KiB. -+ * -+ * Note: If this table is modified, also update -+ * util/grub-editenv.c::fs_envblk_spec, which describes the file-system -+ * specific layout of reserved raw blocks used as environment blocks so that -+ * both stay consistent. - */ - - static const struct { - struct embed_region available; -- struct embed_region used[6]; -+ struct embed_region used[9]; - } btrfs_head = { - .available = {0, GRUB_DISK_KiB_TO_SECTORS (1024)}, /* The first 1 MiB. */ - .used = { -@@ -2662,6 +2667,9 @@ static const struct { - {GRUB_DISK_KiB_TO_SECTORS (64) - 1, 1}, /* Overflow guard. */ - {GRUB_DISK_KiB_TO_SECTORS (64), GRUB_DISK_KiB_TO_SECTORS (4)}, /* 4 KiB superblock. */ - {GRUB_DISK_KiB_TO_SECTORS (68), 1}, /* Overflow guard. */ -+ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS) - 1, 1}, /* Overflow guard. */ -+ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS), 1}, /* Environment Block. */ -+ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS) + 1, 1}, /* Overflow guard. */ - {GRUB_DISK_KiB_TO_SECTORS (1024) - 1, 1}, /* Overflow guard. */ - {0, 0} /* Array terminator. */ - } -diff --git a/include/grub/fs.h b/include/grub/fs.h -index df4c93b16f..89e4d2b9bc 100644 ---- a/include/grub/fs.h -+++ b/include/grub/fs.h -@@ -132,4 +132,6 @@ grub_fs_unregister (grub_fs_t fs) - - grub_fs_t EXPORT_FUNC(grub_fs_probe) (grub_device_t device); - -+#define GRUB_ENV_BTRFS_OFFSET (256 * 1024) -+ - #endif /* ! GRUB_FS_HEADER */ -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index 201dc7ccd4..3c3f9d09f3 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -156,9 +156,16 @@ static fs_envblk_ops_t fs_envblk_ops = { - - /* - * fs_envblk_spec describes the file-system specific layout of reserved raw -- * blocks used as environment blocks. -+ * blocks used as environment blocks. At present only Btrfs is supported. Other -+ * file-systems may be added if they provide a similar facility and avoid the -+ * limitation of writing to COW. -+ * -+ * Note: If this table is modified, also update -+ * grub-core/fs/btrfs.c::btrfs_head, which defines the layout in the Btrfs -+ * header and exports GRUB_ENV_BTRFS_OFFSET, so that both stay consistent. - */ - static fs_envblk_spec_t fs_envblk_spec[] = { -+ { "btrfs", GRUB_ENV_BTRFS_OFFSET, GRUB_DISK_SECTOR_SIZE }, - { NULL, 0, 0 } - }; - diff --git a/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch b/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch deleted file mode 100644 index a807bb91..00000000 --- a/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Michael Chang via Grub-devel -Date: Fri, 17 Oct 2025 17:01:41 +0800 -Subject: [PATCH] 00_header.in: wire grub.cfg to use env_block when present - -This patch extends the generated grub.cfg so that it can use the -external environment block when the variable env_block is defined. -During boot, if env_block is set, grub.cfg builds a device path for it, -exports the variable, and then loads its contents in addition to the -normal grubenv file. - -When GRUB writes variables such as next_entry or saved_entry, the save -commands are changed to write into env_block if it is set, and to fall -back to the grubenv file otherwise. In this way the external environment -block is used automatically, and existing commands like savedefault or -save_env do not need to change. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Daniel Kiper ---- - util/grub.d/00_header.in | 26 +++++++++++++++++++++++--- - 1 file changed, 23 insertions(+), 3 deletions(-) - -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index 3e1b77265d..a5d43929b8 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -58,6 +58,13 @@ if [ -f \${config_directory}/grubenv ]; then - elif [ -s \$prefix/grubenv ]; then - load_env - fi -+ -+if [ "\${env_block}" ] ; then -+ set env_block="(\${root})\${env_block}" -+ export env_block -+ load_env -f "\${env_block}" -+fi -+ - EOF - if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then - cat < -Date: Fri, 17 Oct 2025 17:01:43 +0800 -Subject: [PATCH] btrfs: update doc link for bootloader support - -The old wiki link is obsolete and no longer updated, change it to the -current documentation. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Daniel Kiper ---- - grub-core/fs/btrfs.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c -index 261c413e9f..2222c57abd 100644 ---- a/grub-core/fs/btrfs.c -+++ b/grub-core/fs/btrfs.c -@@ -2647,7 +2647,8 @@ struct embed_region { - }; - - /* -- * https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)#BOOTLOADER_SUPPORT -+ * https://btrfs.readthedocs.io/en/latest/btrfs-man5.html#man-btrfs5-bootloader-support -+ * or invoke "man 5 btrfs" and visit the "bootloader support" subsection. - * The first 1 MiB on each device is unused with the exception of primary - * superblock that is on the offset 64 KiB and spans 4 KiB. - * diff --git a/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch b/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch deleted file mode 100644 index 11cf789d..00000000 --- a/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Mon, 27 Oct 2025 11:18:45 -0600 -Subject: [PATCH] docs: add Btrfs env block and special env vars - -Update grub.texi to describe the external environment block in the -reserved area of Btrfs header used for grub-reboot and savedefault, -and add a section documenting the saved_entry, next_entry, and -env_block variables. - -Signed-off-by: Michael Chang -Reviewed-by: Neal Gompa -Reviewed-by: Daniel Kiper ---- - docs/grub.texi | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 55 insertions(+) - -diff --git a/docs/grub.texi b/docs/grub.texi -index 531e847f32..d669972337 100644 ---- a/docs/grub.texi -+++ b/docs/grub.texi -@@ -3265,6 +3265,7 @@ GRUB. Others may be used freely in GRUB configuration files. - @menu - * Special environment variables:: - * Environment block:: -+* Special environment block variables:: - @end menu - - -@@ -3881,9 +3882,63 @@ For safety reasons, this storage is only available when installed on a plain - disk (no LVM or RAID), using a non-checksumming filesystem (no ZFS), and - using BIOS or EFI functions (no ATA, USB or IEEE1275). - -+On Btrfs filesystems, a reserved area in the filesystem header may be used to -+store the environment block. This static block avoids the problems of updating -+a normal file on a copy-on-write filesystem, where writing raw block is not -+stable and requires metadata update. The reserved area provides a fixed -+location that GRUB can update directly, allowing commands such as -+@command{grub-reboot} and @samp{GRUB_SAVEDEFAULT} to function correctly on -+Btrfs volumes. -+ - @command{grub2-mkconfig} uses this facility to implement - @samp{GRUB_SAVEDEFAULT} (@pxref{Simple configuration}). - -+@node Special environment block variables -+@section Special environment block variables -+ -+These special variables are usually written to the environment block -+(@pxref{Environment block}) to customize the behavior of @file{grub.cfg} -+generated by @command{grub-mkconfig}. -+ -+@menu -+* saved_entry:: -+* next_entry:: -+* env_block:: -+@end menu -+ -+@node saved_entry -+@subsection saved_entry -+ -+The @var{saved_entry} variable sets the default boot entry in @file{grub.cfg} -+created by @command{grub-mkconfig}. It can be set with -+@command{grub-set-default} to choose a default entry, or at runtime with the -+@code{savedefault} function in grub.cfg to save the current entry as the new -+default. This may require write access by GRUB. -+ -+@node next_entry -+@subsection next_entry -+ -+The @var{next_entry} variable sets the boot entry for the next boot only. After -+it is used, GRUB clears the value so it is not reused. This requires write -+access to the environment block (@pxref{Environment block}) at runtime. The -+@command{grub-reboot} command is usually used instead of changing this variable -+directly. -+ -+@node env_block -+@subsection env_block -+ -+If the filesystem is Btrfs and the disk is not an abstracted device such as -+LVM, RAID, or encryption, the reserved space in the Btrfs header can be used as -+the environment block (@pxref{Environment block}). This provides a fixed raw -+block that GRUB can reliably write to. The @var{env_block} records this -+location in GRUB blocklist syntax (@pxref{Block list syntax}) so that -+@command{grub-editenv} and @file{grub.cfg} know how to access and use the -+external raw block. -+ -+This variable is initialized when @file{grubenv} is first created by -+@command{grub-editenv} and is treated as read-only to avoid being overwritten -+with an unpredictable value. -+ - @node Modules - @chapter Modules - diff --git a/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch b/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch deleted file mode 100644 index 6aa5d83e..00000000 --- a/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Rasmus Villemoes -Date: Thu, 29 Aug 2024 13:01:02 +0200 -Subject: [PATCH] kern/fs: Honour file->read_hook() in grub_fs_blocklist_read() - -Unlike files accessed via a normal file system, the file->read_hook() is -not honoured when using blocklist notation. - -This means that when trying to use a dedicated, 1 KiB, raw partition -for the environment block and hence does something like - - save_env --file=(hd0,gpt9)0+2 X Y Z - -this fails with "sparse file not allowed", which is rather unexpected, -as I've explicitly said exactly which blocks should be used. Adding -a little debugging reveals that grub_file_size(file) is 1024 as expected, -but total_length is 0, simply because the callback was never invoked, so -blocklists is an empty list. - -Fix that by honouring the ->read_hook() set by the caller, also when -a "file" is specified with blocklist notation. - -Signed-off-by: Rasmus Villemoes -Reviewed-by: Vladimir Serbinenko -Reviewed-by: Daniel Kiper ---- - grub-core/kern/fs.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c -index f25bace620..9f6f4ef9da 100644 ---- a/grub-core/kern/fs.c -+++ b/grub-core/kern/fs.c -@@ -216,12 +216,15 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) - grub_disk_addr_t sector; - grub_off_t offset; - grub_ssize_t ret = 0; -+ grub_disk_t disk = file->device->disk; - - if (len > file->size - file->offset) - len = file->size - file->offset; - - sector = (file->offset >> GRUB_DISK_SECTOR_BITS); - offset = (file->offset & (GRUB_DISK_SECTOR_SIZE - 1)); -+ disk->read_hook = file->read_hook; -+ disk->read_hook_data = file->read_hook_data; - for (p = file->data; p->length && len > 0; p++) - { - if (sector < p->length) -@@ -233,9 +236,12 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) - >> GRUB_DISK_SECTOR_BITS) > p->length - sector) - size = ((p->length - sector) << GRUB_DISK_SECTOR_BITS) - offset; - -- if (grub_disk_read (file->device->disk, p->offset + sector, offset, -+ if (grub_disk_read (disk, p->offset + sector, offset, - size, buf) != GRUB_ERR_NONE) -- return -1; -+ { -+ ret = -1; -+ break; -+ } - - ret += size; - len -= size; -@@ -245,6 +251,8 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) - else - sector -= p->length; - } -+ disk->read_hook = NULL; -+ disk->read_hook_data = NULL; - - return ret; - } diff --git a/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch b/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch deleted file mode 100644 index efe9389e..00000000 --- a/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Neal Gompa -Date: Wed, 26 Nov 2025 08:20:26 -0500 -Subject: [PATCH] util/grub.d/00_header.in: Prefer $dev instead of $root for - $env_block - -In UEFI environments where GRUB loads a stub grub.cfg on the EFI -System Partition (ESP) that points to the real one on the operating -system volume, the $root value is set to the ESP instead of the -operating system volume. - -This is particularly problematic for setups where the operating -system boot data is on a Btrfs volume and the external environment -block in the Btrfs bootloader space is used for grubenv data. - -Using $dev in its place resolves this problem, since the stub -grub.cfg populates this variable. Use it if it exists, and -fall back to $root accordingly. - -This is unlikely to be upstreamable, as it depends on the method -Fedora Linux and derivatives use to load the GRUB configuration. - -Signed-off-by: Neal Gompa ---- - util/grub.d/00_header.in | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in -index a5d43929b8..01f1f4144e 100644 ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -60,7 +60,11 @@ elif [ -s \$prefix/grubenv ]; then - fi - - if [ "\${env_block}" ] ; then -- set env_block="(\${root})\${env_block}" -+ if [ "\${dev}" ]; then -+ set env_block="(\${dev})\${env_block}" -+ else -+ set env_block="(\${root})\${env_block}" -+ fi - export env_block - load_env -f "\${env_block}" - fi diff --git a/0405-grub.d-Support-the-external-environment-block-for-au.patch b/0405-grub.d-Support-the-external-environment-block-for-au.patch deleted file mode 100644 index c75926a0..00000000 --- a/0405-grub.d-Support-the-external-environment-block-for-au.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Neal Gompa -Date: Wed, 26 Nov 2025 08:37:57 -0500 -Subject: [PATCH] grub.d: Support the external environment block for automatic - hidden menu - -This allows the automatic hidden menu (and boot counting) mechanism -to use an external environment block if it exists and is configured -to be used. - -This is particularly important for supporting this mechanism on -systems with the operating system boot data on a Btrfs volume. - -This is unlikely to be upstreamable, as it depends on Fedora's GRUB -hidden menu and boot counting patch sets. - -Signed-off-by: Neal Gompa ---- - util/grub.d/08_fallback_counting.in | 6 +++++- - util/grub.d/10_reset_boot_success.in | 6 +++++- - util/grub.d/12_menu_auto_hide.in | 6 +++++- - util/grub.d/14_menu_show_once.in | 6 +++++- - 4 files changed, 20 insertions(+), 4 deletions(-) - -diff --git a/util/grub.d/08_fallback_counting.in b/util/grub.d/08_fallback_counting.in -index 2e2c3ff7d3..272cdb6533 100644 ---- a/util/grub.d/08_fallback_counting.in -+++ b/util/grub.d/08_fallback_counting.in -@@ -19,6 +19,10 @@ if [ -n "\${boot_counter}" -a "\${boot_success}" = "0" ]; then - else - decrement boot_counter - fi -- save_env boot_counter -+ if [ "\${env_block}" ]; then -+ save_env -f "\${env_block}" boot_counter -+ else -+ save_env boot_counter -+ fi - fi - EOF -diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in -index e73f4137b3..ca04f9b699 100644 ---- a/util/grub.d/10_reset_boot_success.in -+++ b/util/grub.d/10_reset_boot_success.in -@@ -21,5 +21,9 @@ elif [ "\${boot_indeterminate}" = "1" ]; then - fi - # Reset boot_success for current boot - set boot_success=0 --save_env boot_success boot_indeterminate -+if [ "\${env_block}" ]; then -+ save_env -f "\${env_block}" boot_success boot_indeterminate -+else -+ save_env boot_success boot_indeterminate -+fi - EOF -diff --git a/util/grub.d/12_menu_auto_hide.in b/util/grub.d/12_menu_auto_hide.in -index 6a7c0fa0d4..c2c207232e 100644 ---- a/util/grub.d/12_menu_auto_hide.in -+++ b/util/grub.d/12_menu_auto_hide.in -@@ -16,7 +16,11 @@ cat << EOF - if [ x\$feature_timeout_style = xy ] ; then - if [ "\${menu_show_once}" ]; then - unset menu_show_once -- save_env menu_show_once -+ if [ "\${env_block}" ]; then -+ save_env -f "\${env_block}" menu_show_once -+ else -+ save_env menu_show_once -+ fi - set timeout_style=menu - set timeout=60 - elif [ "\${menu_auto_hide}" -a "\${menu_hide_ok}" = "1" ]; then -diff --git a/util/grub.d/14_menu_show_once.in b/util/grub.d/14_menu_show_once.in -index 1cd7f36142..41b37b5ec7 100755 ---- a/util/grub.d/14_menu_show_once.in -+++ b/util/grub.d/14_menu_show_once.in -@@ -7,7 +7,11 @@ if [ x\$feature_timeout_style = xy ]; then - set timeout_style=menu - set timeout="\${menu_show_once_timeout}" - unset menu_show_once_timeout -- save_env menu_show_once_timeout -+ if [ "\${env_block}" ]; then -+ save_env -f "\${env_block}" menu_show_once_timeout -+ else -+ save_env menu_show_once_timeout -+ fi - fi - fi - EOF diff --git a/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch b/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch deleted file mode 100644 index 92b053bf..00000000 --- a/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Neal Gompa -Date: Wed, 26 Nov 2025 08:48:10 -0500 -Subject: [PATCH] grub-editenv: Make automatic hidden menu and boot counting - use envblk when available - -This ensures the automatic hidden menu and boot counting settings -are set in the right place when an external environment block is used. - -This is unlikely to be upstreamable, as it depends on Fedora's GRUB -hidden menu and boot counting patch sets. - -Signed-off-by: Neal Gompa ---- - util/grub-editenv.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/util/grub-editenv.c b/util/grub-editenv.c -index 3c3f9d09f3..48611e4e17 100644 ---- a/util/grub-editenv.c -+++ b/util/grub-editenv.c -@@ -473,7 +473,13 @@ set_variables (const char *name, int argc, char *argv[]) - - *(p++) = 0; - -- if ((strcmp (argv[0], "next_entry") == 0) && envblk_on_block != NULL) -+ if (((strcmp (argv[0], "next_entry") == 0) || -+ (strcmp (argv[0], "boot_counter") == 0) || -+ (strcmp (argv[0], "boot_indeterminate") == 0) || -+ (strcmp (argv[0], "boot_success") == 0) || -+ (strcmp (argv[0], "menu_show_once") == 0) || -+ (strcmp (argv[0], "menu_show_once_timeout") == 0)) -+ && envblk_on_block != NULL) - { - if (grub_envblk_set (envblk_on_block, argv[0], p) == 0) - grub_util_error ("%s", _("environment block too small")); diff --git a/0407-Increase-EFI-max-allocation-to-max-usable-address.patch b/0407-Increase-EFI-max-allocation-to-max-usable-address.patch deleted file mode 100644 index a1297e44..00000000 --- a/0407-Increase-EFI-max-allocation-to-max-usable-address.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Leo Sandoval -Date: Fri, 28 Nov 2025 11:30:19 -0600 -Subject: [PATCH] Increase EFI max allocation to max usable address - -Signed-off-by: Leo Sandoval ---- - include/grub/x86_64/efi/memory.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/grub/x86_64/efi/memory.h b/include/grub/x86_64/efi/memory.h -index e81cfb3221..547e3f82f8 100644 ---- a/include/grub/x86_64/efi/memory.h -+++ b/include/grub/x86_64/efi/memory.h -@@ -3,7 +3,7 @@ - - #if defined (__code_model_large__) - #define GRUB_EFI_MAX_USABLE_ADDRESS __UINTPTR_MAX__ --#define GRUB_EFI_MAX_ALLOCATION_ADDRESS 0x7fffffff -+#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS - #else - #define GRUB_EFI_MAX_USABLE_ADDRESS 0x7fffffff - #define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS diff --git a/20-grub.install b/20-grub.install index e402a4ce..d9d1d1d7 100755 --- a/20-grub.install +++ b/20-grub.install @@ -96,12 +96,12 @@ case "$COMMAND" in command -v restorecon &>/dev/null && \ restorecon "/boot/symvers-${KERNEL_VERSION}.gz" fi - # symvers is symvers-.xz symlink, needs a special treatment - i="$KERNEL_DIR/symvers.xz" + # symvers is symvers-.bz symlink, needs a special treatment + i="$KERNEL_DIR/symvers.bz" if [[ -e "$i" ]]; then - ln -fs "$i" "/boot/symvers-${KERNEL_VERSION}.xz" + ln -fs "$i" "/boot/symvers-${KERNEL_VERSION}.bz" command -v restorecon &>/dev/null && \ - restorecon "/boot/symvers-${KERNEL_VERSION}.xz" + restorecon "/boot/symvers-${KERNEL_VERSION}.bz" fi fi @@ -174,7 +174,7 @@ case "$COMMAND" in fi fi if [ -n "$NEWDEFAULT" ]; then - grub2-editenv - set "tmp_saved_entry=${NEWDEFAULT}" + grub2-editenv - set "saved_entry=${NEWDEFAULT}" fi # this probably isn't the best place to do this, but it will do for now. @@ -193,11 +193,7 @@ case "$COMMAND" in exit 77 ;; remove) - # If the boot entry type is type2, we are not removing the BLS entry - if [[ "x${KERNEL_INSTALL_BOOT_ENTRY_TYPE}" = "xtype2" ]]; then - [ "${KERNEL_INSTALL_VERBOSE}" -gt 0 ] && echo "The boot entry type is type2. Skip removing BLS entry." - exit 0 - fi + if [[ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]] || [[ ! -f /sbin/new-kernel-pkg ]]; then BLS_TARGET="${BLS_DIR}/${MACHINE_ID}-${KERNEL_VERSION}.conf" BLS_DEBUG="$(echo ${BLS_TARGET} | sed -e "s/${KERNEL_VERSION}/${KERNEL_VERSION}~debug/")" diff --git a/95-set-boot-entry.install b/95-set-boot-entry.install deleted file mode 100755 index 9f92f9f4..00000000 --- a/95-set-boot-entry.install +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash - -[[ -f /etc/default/grub ]] && . /etc/default/grub -[[ -f /etc/os-release ]] && . /etc/os-release - -COMMAND="$1" -KERNEL_VERSION="$2" -BOOT_DIR_ABS="$3" -KERNEL_IMAGE="$4" - -case "$COMMAND" in - add) - if [[ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]] || [[ ! -f /sbin/new-kernel-pkg ]]; then - entry=$(grub2-editenv list | grep tmp_saved_entry) - if [ -n "$entry" ]; then - BLS_ID=${entry##tmp_saved_entry=} - BLS_DIR="/boot/loader/entries" - BLS_TARGET="${BLS_DIR}/${BLS_ID}.conf" - - LINUX="$(grep '^linux[ \t]' "${BLS_TARGET}" | sed -e 's,^linux[ \t]*,,' | awk '{print $1}')" - INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,' | awk '{print $1}')" - - ROOTPREFIX="" - [ -z "$(grub2-mkrelpath /boot)" ] && ROOTPREFIX="/boot" - - if [ -e "${ROOTPREFIX}${LINUX}" -a -n "${INITRD}" ]; then - if [ ! -e "${ROOTPREFIX}${INITRD}" ]; then - echo "Error: ${ROOTPREFIX}${INITRD} not found." - exit 1 - fi - if ! lsinitrd ${ROOTPREFIX}${INITRD} > /dev/null; then - echo "Error: ${ROOTPREFIX}${INITRD} appears to be corrupt." - exit 1 - fi - fi - - grub2-editenv - unset "tmp_saved_entry" - grub2-editenv - set "saved_entry=$BLS_ID" - fi - fi - ;; - *) - ;; -esac diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 1a5fed8c..a14f5fd8 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -5,7 +5,7 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then fi # Run grub2-mkconfig if ENABLE_BLSCFG is false -if grep -sq '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then +if grep -q '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then RUN_MKCONFIG=true DISABLE_BLS=true fi @@ -28,7 +28,7 @@ if [[ $ARCH = "ppc64le" ]] && [ -d /sys/firmware/opal ]; then fi if [[ $DISABLE_BLS = "true" ]]; then - if grep -sq '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then + if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub fi fi diff --git a/do-sync b/do-sync deleted file mode 100755 index bfb2371c..00000000 --- a/do-sync +++ /dev/null @@ -1,89 +0,0 @@ -#!/bin/bash - -set -o nounset -set -o errexit - -usage() { - echo "Usage $0 :::" - echo "Generates a (rhboot) grub2 branch which contains latest patches from dist-git based on specific Fedora/RHEL version" - echo "Command expects a single parameter delimited with colons, with the following meanings:" - echo " pkgtool: Package tool, e.g. fedpkg, rhpkg, etc." - echo " dist_git_branch: The dist-git branch/release to sync" - echo " git_branch: The git branch/release to sync" - echo " git_base_commit: base commit where git_branch is based on" - echo - echo "Examples:" - echo - echo " $0 fedpkg:rawhide:fedora-43:grub-2.12" - echo " $0 fedpkg:f42:fedora-42:grub-2.12" - echo " $0 fedpkg:f41:fedora-41:grub-2.12" - echo " $0 fedpkg:f40:fedora-40:grub-2.12" - echo - echo "Also handles RHEL branches:" - echo - echo " $0 rhpkg:rhel-10-main:rhel-10-main:grub-2.12" - echo " $0 rhpkg:rhel-9-main:rhel-9-main:grub-2.06" - echo " $0 rhpkg:rhel-8-main:rhel-8-main:f28-branchpoint" - exit 1 -} - -# check params -[ $# -eq 1 ] || usage - -args=$1 - -pkgtool=$(echo "$args" | awk -F ':' '{print $1}') -dist_git_branch=$(echo "$args" | awk -F ':' '{print $2}') -git_branch=$(echo "$args" | awk -F ':' '{print $3}') -git_base_commit=$(echo "$args" | awk -F ':' '{print $4}') - -# working dirs -dist_git_dir=/tmp/grub/dist-git -git_dir=/tmp/grub/git - -rm -rf $dist_git_dir $git_dir -mkdir -p $dist_git_dir $git_dir - - -pushd $dist_git_dir > /dev/null -{ - # clone grub2 package anonymously - $pkgtool clone -a grub2 . 2>/dev/null - - # create a local branch, all fine if already exists - git checkout -q -b "$dist_git_branch" origin/"$dist_git_branch" 2> /dev/null || true -} -popd > /dev/null - - -pushd $git_dir > /dev/null -{ - git clone -q git@github.com:rhboot/grub2.git . 2>/dev/null - - dist_git_sync_branch=${git_branch}-dist-git-$(date +"%Y-%m-%d-%H_%M_%S") - git checkout -q -b "$dist_git_sync_branch" "$git_base_commit" - while read -r line; do - p=$(echo "$line" | awk '{print $2}') - git am -q "$dist_git_dir/$p" 2>/dev/null - done < $dist_git_dir/grub.patches - - # brach current git_branch based on upstream git_branch - git branch -D "$git_branch" 2>/dev/null || true - git checkout -q -b "$git_branch" origin/"$git_branch" - - missing_commits=$(git cherry "${git_branch}" "${dist_git_sync_branch}" | grep ^+ | wc -l) - if [[ $missing_commits -eq 0 ]]; then - echo "Branch $git_branch is up-to-date, no need to sync" - else - echo "Missing commits ($missing_commits) which would be integrated in final branch" - git cherry "$git_branch" "$dist_git_sync_branch" -v | grep ^+ - # finally cherry pick those missing patches - git cherry "$git_branch" "$dist_git_sync_branch" 2>/dev/null | grep ^+ | sed 's/\+ //' | xargs git cherry-pick 2>/dev/null - - echo "Pushing latest commits" - cd "$git_dir" - git push -v origin "$git_branch" - fi -} -popd > /dev/null - diff --git a/gen_grub_cfgstub b/gen_grub_cfgstub deleted file mode 100644 index 8f77c0f5..00000000 --- a/gen_grub_cfgstub +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -set -eu - -if [ $# -ne 2 ] - then - echo "Missing argument" - echo "Usage: script.sh GRUB_HOME EFI_HOME" - exit 1 -fi - -GRUB_HOME=$1 -EFI_HOME=$2 - -# create a stub grub2 config in EFI -BOOT_UUID=$(grub2-probe --target=fs_uuid "${GRUB_HOME}") -GRUB_DIR=$(grub2-mkrelpath "${GRUB_HOME}") - -cat << EOF > "${EFI_HOME}"/grub.cfg.stb -search --no-floppy --root-dev-only --fs-uuid --set=dev ${BOOT_UUID} -set prefix=(\$dev)${GRUB_DIR} -export \$prefix -configfile \$prefix/grub.cfg -EOF - -mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg -chmod 0600 ${EFI_HOME}/grub.cfg diff --git a/grub.macros b/grub.macros index dd06d94c..ba7ff0f5 100644 --- a/grub.macros +++ b/grub.macros @@ -1,12 +1,6 @@ # vim:filetype=spec # Modules always contain just 32-bit code -%global evr %{epoch}:%{version}-%{release} %global _libdir %{_exec_prefix}/lib - -%global os_id %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) -%global grub_evr_dir %{_libdir}/efi/grub2/%{evr} -%global grub_efi_dir %{grub_evr_dir}/EFI/%{os_id} - %global _binaries_in_noarch_packages_terminate_build 0 #%%undefine _missing_build_ids_terminate_build %{expand:%%{!?buildsubdir:%%global buildsubdir grub-%{tarversion}}} @@ -146,7 +140,7 @@ %{?with_efi_only:%global without_efi_only 1} %ifarch %{efi_arch} -%global efi_modules " efi_netfs efifwsetup efinet lsefi lsefimmap connectefi bli " +%global efi_modules " efi_netfs efifwsetup efinet lsefi lsefimmap connectefi " %endif %global xen_arch x86_64 @@ -286,6 +280,8 @@ %global grubelfname core.elf %endif +%global evr %{epoch}:%{version}-%{release} + %ifarch x86_64 %global with_efi_common 1 %global with_legacy_modules 1 @@ -327,7 +323,7 @@ This subpackage provides support for rebuilding your own grub.efi. \ %{expand:%%{?!buildsubdir:%%define buildsubdir grub-%%{1}-%{tarversion}}}\ %{expand:%%package %%{1}-tools} \ Summary: Support tools for GRUB. \ -Requires: gettext-runtime os-prober file system-logos \ +Requires: gettext-runtime os-prober which file system-logos \ Requires: grub2-common = %{evr} \ Requires: grub2-tools-minimal = %{evr} \ Requires: os-prober >= 1.58-11 \ @@ -518,7 +514,7 @@ install -m 644 %{1}.conf ${RPM_BUILD_ROOT}/etc/dnf/protected.d/ \ rm -f %{1}.conf \ %{nil} -%global grub_modules " all_video boot blscfg btrfs blsuki \\\ +%global grub_modules " all_video boot blscfg btrfs \\\ cat configfile cryptodisk \\\ echo ext2 f2fs fat font \\\ gcry_rijndael gcry_rsa gcry_serpent \\\ @@ -708,9 +704,8 @@ find . '(' -iname gdb_grub \\\ ')' \\\ -exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \ find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \ -install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ -install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ %{expand:%%do_install_protected_file grub2-%{alt_package_arch}} \ cd .. \ %{nil} @@ -727,14 +722,11 @@ fi \ find $RPM_BUILD_ROOT -iname "*.module" -exec chmod a-x {} '\;' \ ln -s ../boot/grub2/grub.cfg \\\ $RPM_BUILD_ROOT%{_sysconfdir}/grub2-efi.cfg \ -install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ -install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ %ifarch %{arm} \ install -D -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_boot}/BOOTARM.EFI \ %endif \ -install -D -m 700 %{SOURCE13} \\\ - ${RPM_BUILD_ROOT}/usr/bin/gen_grub_cfgstub \ install -D -m 700 unicode.pf2 \\\ ${RPM_BUILD_ROOT}/boot/grub2/fonts/unicode.pf2 \ ${RPM_BUILD_ROOT}/%{_bindir}/grub2-editenv \\\ @@ -879,18 +871,14 @@ ln -s ../boot/grub2/grub.cfg \\\ %defattr(-,root,root,-) \ %config(noreplace) %{_sysconfdir}/grub2.cfg \ %config(noreplace) %{_sysconfdir}/grub2-efi.cfg \ -%ghost %attr(0700,root,root) %{efi_esp_dir}/%{2} \ -%dir %attr(0700,root,root) %{grub_efi_dir} \ -%attr(0700,root,root) %{grub_efi_dir}/%{2} \ +%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{2} \ %ifarch %{arm} \ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ %endif \ %attr(0700,root,root)/boot/grub2/fonts \ -%attr(0700,root,root)/usr/bin/gen_grub_cfgstub \ %dir %attr(0700,root,root)/boot/loader/entries \ %ghost %config(noreplace) %attr(0600,root,root)/boot/grub2/grub.cfg \ -%ghost %config(noreplace) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ -%ghost %config(noreplace) %attr(0600,root,root)%{grub_efi_dir}/grub.cfg \ +%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv \ %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/grub2-%{1}.conf \ %{expand:%if 0%{?without_efi_modules} \ @@ -908,8 +896,7 @@ ln -s ../boot/grub2/grub.cfg \\\ \ %{expand:%%files %{1}-cdboot} \ %defattr(-,root,root,-) \ -%ghost %attr(0700,root,root) %{efi_esp_dir}/%{3} \ -%attr(0700,root,root) %{grub_efi_dir}/%{3} \ +%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{3} \ %attr(0700,root,root)/boot/grub2/fonts \ %{nil} diff --git a/grub.patches b/grub.patches index 67c06e16..6c7d2bde 100644 --- a/grub.patches +++ b/grub.patches @@ -281,126 +281,82 @@ Patch0280: 0280-Enable-building-blscfg-module-on-xen-and-xen_pvh.patch Patch0281: 0281-loader-efi-Fix-RISC-V-build.patch Patch0282: 0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch -Patch0284: 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch -Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch -Patch0286: 0286-commands-legacycfg-Avoid-closing-file-twice.patch -Patch0287: 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch -Patch0288: 0288-commands-bli-Fix-crash-in-get_part_uuid.patch -Patch0289: 0289-misc-Implement-grub_strlcpy.patch -Patch0290: 0290-fs-ufs-Fix-a-heap-OOB-write.patch -Patch0291: 0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch -Patch0292: 0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch -Patch0293: 0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch -Patch0294: 0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch -Patch0295: 0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch -Patch0296: 0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch -Patch0297: 0297-fs-iso9660-Fix-invalid-free.patch -Patch0298: 0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch -Patch0299: 0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch -Patch0300: 0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch -Patch0301: 0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch -Patch0302: 0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch -Patch0303: 0303-fs-ntfs-Fix-out-of-bounds-read.patch -Patch0304: 0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch -Patch0305: 0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch -Patch0307: 0307-fs-xfs-Fix-out-of-bounds-read.patch -Patch0308: 0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch -Patch0309: 0309-kern-file-Ensure-file-data-is-set.patch -Patch0310: 0310-kern-file-Implement-filesystem-reference-counting.patch -Patch0311: 0311-cli_lock-Add-build-option-to-block-command-line-inte.patch -Patch0312: 0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch -Patch0313: 0313-disk-loopback-Reference-tracking-for-the-loopback.patch -Patch0314: 0314-kern-disk-Limit-recursion-depth.patch -Patch0315: 0315-kern-partition-Limit-recursion-in-part_iterate.patch -Patch0316: 0316-script-execute-Limit-the-recursion-depth.patch -Patch0317: 0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch -Patch0318: 0318-net-Remove-variables-hooks-when-interface-is-unregis.patch -Patch0319: 0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch -Patch0320: 0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch -Patch0321: 0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch -Patch0322: 0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch -Patch0323: 0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch -Patch0324: 0324-commands-extcmd-Missing-check-for-failed-allocation.patch -Patch0325: 0325-commands-ls-Fix-NULL-dereference.patch -Patch0326: 0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch -Patch0327: 0327-normal-Remove-variables-hooks-on-module-unload.patch -Patch0328: 0328-gettext-Remove-variables-hooks-on-module-unload.patch -Patch0329: 0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch -Patch0330: 0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch -Patch0331: 0331-commands-read-Fix-an-integer-overflow-when-supplying.patch -Patch0332: 0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch -Patch0333: 0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch -Patch0334: 0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch -Patch0335: 0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch -Patch0336: 0336-fs-bfs-Disable-under-lockdown.patch -Patch0337: 0337-fs-Disable-many-filesystems-under-lockdown.patch -Patch0338: 0338-disk-Use-safe-math-macros-to-prevent-overflows.patch -Patch0339: 0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch -Patch0340: 0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch -Patch0341: 0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch -Patch0342: 0342-fs-Use-safe-math-macros-to-prevent-overflows.patch -Patch0343: 0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch -Patch0344: 0344-fs-Prevent-overflows-when-assigning-returned-values-.patch -Patch0345: 0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch -Patch0346: 0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch -Patch0347: 0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch -Patch0348: 0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch -Patch0349: 0349-net-Use-safe-math-macros-to-prevent-overflows.patch -Patch0350: 0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch -Patch0351: 0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch -Patch0352: 0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch -Patch0353: 0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch -Patch0354: 0354-osdep-unix-getroot-Fix-potential-underflow.patch -Patch0355: 0355-misc-Ensure-consistent-overflow-error-messages.patch -Patch0356: 0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch -Patch0357: 0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch -Patch0358: 0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch -Patch0359: 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch -Patch0360: 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch -Patch0361: 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch -Patch0362: 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch -Patch0363: 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch -Patch0364: 0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch -Patch0365: 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch -Patch0366: 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch -Patch0367: 0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch -Patch0368: 0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch -Patch0369: 0369-10_linux.in-escape-kernel-option-characters-properly.patch -Patch0370: 0370-blscfg-check-if-variable-is-escaped-before-consideri.patch -Patch0371: 0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch -Patch0372: 0372-commands-search-Introduce-the-cryptodisk-only-argume.patch -Patch0373: 0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch -Patch0374: 0374-commands-search-Add-the-diskfilter-support.patch -Patch0375: 0375-docs-Document-available-crypto-disks-checks.patch -Patch0376: 0376-disk-cryptodisk-Add-the-erase-secrets-function.patch -Patch0377: 0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch -Patch0378: 0378-cryptocheck-Add-quiet-option.patch -Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch -Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch -Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch -Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch -Patch0383: 0383-Include-function-name-on-debug-print-function.patch -Patch0384: 0384-kern-misc-Implement-grub_strtok.patch -Patch0385: 0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch -Patch0386: 0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch -Patch0387: 0387-blsuki-Check-for-mounted-boot-in-emu.patch -Patch0388: 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch -Patch0389: 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch -Patch0390: 0390-blsuki-do-not-register-blscfg-command.patch -Patch0391: 0391-misc-add-z-length-modifier-support.patch -Patch0392: 0392-tests-add-z-modifier-printf-tests.patch -Patch0393: 0393-util-grub-editenv-add-fs_envblk-open-helper.patch -Patch0394: 0394-util-grub-editenv-add-fs_envblk-write-helper.patch -Patch0395: 0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch -Patch0396: 0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch -Patch0397: 0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch -Patch0398: 0398-util-grub-editenv-add-probe-call-for-external-envblk.patch -Patch0399: 0399-btrfs-add-environment-block-to-reserved-header-area.patch -Patch0400: 0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch -Patch0401: 0401-btrfs-update-doc-link-for-bootloader-support.patch -Patch0402: 0402-docs-add-Btrfs-env-block-and-special-env-vars.patch -Patch0403: 0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch -Patch0404: 0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch -Patch0405: 0405-grub.d-Support-the-external-environment-block-for-au.patch -Patch0406: 0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch -Patch0407: 0407-Increase-EFI-max-allocation-to-max-usable-address.patch +Patch0284: 0284-misc-Implement-grub_strlcpy.patch +Patch0285: 0285-fs-ufs-Fix-a-heap-OOB-write.patch +Patch0286: 0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch +Patch0287: 0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch +Patch0288: 0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0289: 0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch +Patch0290: 0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch +Patch0291: 0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch +Patch0292: 0292-fs-iso9660-Fix-invalid-free.patch +Patch0293: 0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch +Patch0294: 0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch +Patch0295: 0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch +Patch0296: 0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch +Patch0297: 0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch +Patch0298: 0298-fs-ntfs-Fix-out-of-bounds-read.patch +Patch0299: 0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch +Patch0300: 0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch +Patch0302: 0302-fs-xfs-Fix-out-of-bounds-read.patch +Patch0303: 0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch +Patch0304: 0304-kern-file-Ensure-file-data-is-set.patch +Patch0305: 0305-kern-file-Implement-filesystem-reference-counting.patch +Patch0306: 0306-cli_lock-Add-build-option-to-block-command-line-inte.patch +Patch0307: 0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch +Patch0308: 0308-disk-loopback-Reference-tracking-for-the-loopback.patch +Patch0309: 0309-kern-disk-Limit-recursion-depth.patch +Patch0310: 0310-kern-partition-Limit-recursion-in-part_iterate.patch +Patch0311: 0311-script-execute-Limit-the-recursion-depth.patch +Patch0312: 0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch +Patch0313: 0313-net-Remove-variables-hooks-when-interface-is-unregis.patch +Patch0314: 0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch +Patch0315: 0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch +Patch0316: 0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch +Patch0317: 0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch +Patch0318: 0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch +Patch0319: 0319-commands-extcmd-Missing-check-for-failed-allocation.patch +Patch0320: 0320-commands-ls-Fix-NULL-dereference.patch +Patch0321: 0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch +Patch0322: 0322-normal-Remove-variables-hooks-on-module-unload.patch +Patch0323: 0323-gettext-Remove-variables-hooks-on-module-unload.patch +Patch0324: 0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch +Patch0325: 0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0326: 0326-commands-read-Fix-an-integer-overflow-when-supplying.patch +Patch0327: 0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch +Patch0328: 0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch +Patch0329: 0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch +Patch0330: 0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch +Patch0331: 0331-fs-bfs-Disable-under-lockdown.patch +Patch0332: 0332-fs-Disable-many-filesystems-under-lockdown.patch +Patch0333: 0333-disk-Use-safe-math-macros-to-prevent-overflows.patch +Patch0334: 0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch +Patch0335: 0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch +Patch0336: 0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch +Patch0337: 0337-fs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0338: 0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch +Patch0339: 0339-fs-Prevent-overflows-when-assigning-returned-values-.patch +Patch0340: 0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0341: 0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch +Patch0342: 0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch +Patch0343: 0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch +Patch0344: 0344-net-Use-safe-math-macros-to-prevent-overflows.patch +Patch0345: 0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch +Patch0346: 0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch +Patch0347: 0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch +Patch0348: 0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch +Patch0349: 0349-osdep-unix-getroot-Fix-potential-underflow.patch +Patch0350: 0350-misc-Ensure-consistent-overflow-error-messages.patch +Patch0351: 0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch +Patch0352: 0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch +Patch0353: 0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch +Patch0354: 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch +Patch0355: 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch +Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch +Patch0357: 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch +Patch0358: 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch +Patch0359: 0359-10_linux.in-escape-kernel-option-characters-properly.patch +Patch0360: 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch +Patch0361: 0361-loader-efi-chainloader-Fix-double-free.patch +Patch0362: 0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch +Patch0363: 0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch diff --git a/grub2.spec b/grub2.spec index 8f73768c..0509f659 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 50%{?dist} +Release: 25%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -35,8 +35,6 @@ Source9: strtoull_test.c Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in -Source13: gen_grub_cfgstub -Source14: 95-set-boot-entry.install %include %{SOURCE1} @@ -302,7 +300,6 @@ rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/grub2-macbless # Install kernel-install scripts install -d -m 0755 %{buildroot}%{_prefix}/lib/kernel/install.d/ install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE10} -install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE14} install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE3} install -d -m 0755 %{buildroot}%{_sysconfdir}/kernel/install.d/ # Install systemd user service to set the boot_success flag @@ -367,8 +364,6 @@ elif [ -f /etc/grub.d/01_users ] && \ > /boot/grub2/user.cfg fi fi -# ensure we exit 0 -: %post tools %systemd_user_post grub-boot-success.timer @@ -387,7 +382,7 @@ fi %posttrans common set -eu -EFI_HOME=%{grub_efi_dir} +EFI_HOME=%{efi_esp_dir} GRUB_HOME=/boot/grub2 ESP_PATH=/boot/efi @@ -414,30 +409,28 @@ if test -f ${EFI_HOME}/grub.cfg; then fi # create a stub grub2 config in EFI -gen_grub_cfgstub $GRUB_HOME $EFI_HOME || : +BOOT_UUID=$(grub2-probe --target=fs_uuid ${GRUB_HOME}) +GRUB_DIR=$(grub2-mkrelpath ${GRUB_HOME}) + +cat << EOF > ${EFI_HOME}/grub.cfg.stb +search --no-floppy --root-dev-only --fs-uuid --set=dev ${BOOT_UUID} +set prefix=(\$dev)${GRUB_DIR} +export \$prefix +configfile \$prefix/grub.cfg +EOF if test -f ${EFI_HOME}/grubenv; then cp -a ${EFI_HOME}/grubenv ${EFI_HOME}/grubenv.rpmsave mv --force ${EFI_HOME}/grubenv ${GRUB_HOME}/grubenv fi -%if 0%{with_efi_arch} -%posttrans efi-%{efiarch} -set -eu - -# On image mode, bootupd takes care of installing bootloader updates to the ESP -if [[ ! -e "/run/ostree-booted" ]]; then - cp -a %{grub_efi_dir}/. %{efi_esp_dir} || : -fi - -%endif +mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %files common -f grub.lang %dir %{_libdir}/grub/ %dir %{_datarootdir}/grub/ %attr(0700,root,root) %dir %{_sysconfdir}/grub.d %{_prefix}/lib/kernel/install.d/20-grub.install -%{_prefix}/lib/kernel/install.d/95-set-boot-entry.install %{_prefix}/lib/kernel/install.d/99-grub-mkconfig.install %dir %{_datarootdir}/grub %exclude %{_datarootdir}/grub/* @@ -446,7 +439,8 @@ fi %dir /boot/grub2/themes/system %attr(0700,root,root) %dir /boot/grub2 %exclude /boot/grub2/* -%exclude %{grub_efi_dir}/* +%dir %attr(0700,root,root) %{efi_esp_dir} +%exclude %{efi_esp_dir}/* %ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv %license COPYING %doc THANKS @@ -608,138 +602,39 @@ fi %endif %changelog -* Wed Dec 10 2025 Joel Capitao - 2.12-50 -- Do not include EFI dir in common subpackage -- Resolves: rhbz#2420430 - -* Thu Nov 27 2025 Leo Sandoval - 2.12-49 -- Increase EFI max allocation to max usable address -- Resolves: #2263643 - -* Fri Nov 21 2025 Leo Sandoval - 2.12-48 -- Add support for external environment block on Btrfs - -* Thu Nov 13 2025 Leo Sandoval - 2.12-47 -- blsuki: do not register blscfg command - -* Tue Nov 4 2025 Tom Callaway - 2.12-46 -- rebuild for new fuse3 - -* Wed Oct 15 2025 Leo Sandoval - 2.12-45 -- Include upstream blsuki related patches - -* Mon Sep 15 2025 Leo Sandoval - 2.12-44 -- Include function name on debug print function - -* Fri Aug 29 2025 Nicolas Frayer - 2.12-43 -- gen_grub_cfgstub: Removed output messages - -* Wed Aug 20 2025 Jan Stancek - 2.12-42 -- move 55-set-boot-entry.install to 95 -- Related: #2389020 - -* Mon Aug 11 2025 Marta Lewandowska - 2.12-41 -- Phase 1 of the bootloader updates proposal implementation -- https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 - -* Wed Aug 6 2025 Jan Stancek - 2.12-40 -- 55-set-boot-entry.install: fix initrd check -- Resolves: #2386118 - -* Fri Aug 1 2025 FeRD (Frank Dana) - 2.12-39 -- kernel-install: Suppress warnings about missing /etc/default/grub - file when attempting to grep its contents - -* Tue Jul 29 2025 Leo Sandoval 2.12-38 -- Set correctly the memory attributes for the kernel PE sections - -* Tue Jul 8 2025 Nicolas Frayer - 2.12-37 -- spec: fix grub stub cfg creation script - -* Thu Jun 12 2025 Nicolas Frayer - 2.12-36 -- spec: moved grub stub cfg creation into a script - -* Thu Jun 5 2025 Nicolas Frayer - 2.12-35 +* Tue Jun 17 2025 Nicolas Frayer - 2.12-25 - osdep/linux/getroot: Detect DDF container similar to IMSM -* Wed May 28 2025 Nicolas Frayer - 2.12-34 +* Wed May 28 2025 Nicolas Frayer - 2.12-24 - Some fixes addressing memory freeing and dereferencing - Resolves: #2368939 - Resolves: #2368945 -* Fri May 16 2025 Nicolas Frayer - 2.12-33 -- sbat: bump grub sbat - -* Tue May 06 2025 Leo Sandoval - 2.12-32 -- Fix several cryptodisk vulnerabilities -- Resolves: CVE-2025-4382 - -* Tue May 6 2025 Leo Sandoval 2.12-31 +* Tue May 27 2025 Leo Sandoval 2.12-23 - Handle special kernel parameter characters properly - Resolves: #2362821 -* Fri Apr 18 2025 Nicolas Frayer - 2.12-30 -- ppc/mkimage: SBAT support on powerpc +* Mon May 19 2025 Nicolas Frayer 2.12-22 +- sbat: bump grub sbat -* Tue Mar 25 2025 Nicolas Frayer 2.12-29 +* Tue Mar 25 2025 Nicolas Frayer 2.12-21 - ieee1275/ofnet: Fix grub_malloc() removed after added safe -* Tue Mar 25 2025 Nicolas Frayer 2.12-28 -- Fix the fallback mechanism when menu entries fail to boot - -* Wed Mar 19 2025 Nicolas Frayer 2.12-27 -- powerpc: increase MIN RMA size for CAS negotiation - -* Mon Mar 10 2025 Leo Sandoval 2.12-26 +* Mon Mar 10 2025 Leo Sandoval 2.12-20 - Remove 'fs/ntfs: Implement attribute verification' patch - Resolves: #2350327 -* Tue Feb 25 2025 Nicolas Frayer 2.12-25 +* Tue Feb 25 2025 Nicolas Frayer 2.12-19 - fs/ext2: Rework out-of-bounds read for inline and external extents - Resolves: #2346804 -* Tue Feb 18 2025 Leo Sandoval - 2.02-24 +* Tue Feb 18 2025 Leo Sandoval - 2.12-18 - Add Several CVE fixes - Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 - Resolves: CVE-2024-45775 CVE-2024-45780 CVE-2024-45774 - Resolves: CVE-2025-0690 CVE-2025-1118 CVE-2024-45782 - Resolves: CVE-2025-0624 CVE-2024-45779 CVE-2024-45776 - Resolves: CVE-2025-0622 CVE-2025-0677 -- Related: #RHEL-79703 -- Related: #RHEL-79708 -- Related: #RHEL-79340 -- Related: #RHEL-73786 -- Related: #RHEL-79701 -- Related: #RHEL-73784 -- Related: #RHEL-79856 -- Related: #RHEL-79874 -- Related: #RHEL-79706 -- Related: #RHEL-79836 -- Related: #RHEL-79699 -- Related: #RHEL-75736 -- Related: #RHEL-79712 -- Related: #RHEL-79848 - -* Tue Feb 11 2025 Nicolas Frayer 2.12-23 -- Revert commit for bootloader update proposal for now as not all components are ready - -* Tue Feb 4 2025 Marta Lewandowska - 2.12-22 -- Phase 1 of the bootloader updates proposal implementation -- https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 - -* Tue Jan 28 2025 Nicolas Frayer 2.12-21 -- commands/bli: Fix crash in get_part_uuid() -- Resolves: #2339164 - -* Wed Jan 22 2025 Leo Sandoval 2.12-20 -- fix pending SAST issues -- Related: #RHEL-50504 - -* Mon Jan 13 2025 Leo Sandoval 2.12-19 -- term/nns8250-spcr: return if redirection is disabled - -* Thu Jan 9 2025 Nicolas Frayer - 2.12-18 -- fs/xfs: fix large extent counters incompat feature support * Wed Nov 27 2024 Marta Lewandowska - 2.12-17 - 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks diff --git a/package.cfg b/package.cfg new file mode 100644 index 00000000..0cf8855f --- /dev/null +++ b/package.cfg @@ -0,0 +1,3 @@ +[koji] +targets = rawhide eln +