Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

grub: patch for ext234 and efi

Browse Source
This commit is contained in:
suvari
2017-12-25 18:42:12 +03:00
parent 251151ad9a
commit 365b788ecd
5 changed files with 234 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/boot/grub2/files/30_uefi-firmware
+4 -4
View File
@@ -55,12 +55,12 @@ WINDOWS_EFI=$(/usr/sbin/efibootmgr -v | grep -E -m 1 '(WINDOWS|Windows Boot Mana
if [ -z "$WINDOWS_EFI" ]; then
exit 0
fi
WIN_EFI_PATH_LINUX=/EFI/Microsoft/Boot/bootmgfw.efi
WIN_EFI_PATH_LINUX=/EFI/Microsoft/Boot/bkpbootmgfw.efi
#Determine EFI UUID
WIN_EFI_UUID=$(grub2-probe --target=fs_uuid /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi)
WIN_EFI_UUID=$(grub2-probe --target=fs_uuid /boot/efi/EFI/Microsoft/Boot/bkpbootmgfw.efi)
ESP_SEARCH_HINTS=$(grub2-probe --target=hints_string /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi)
ESP_SEARCH_HINTS=$(grub2-probe --target=hints_string /boot/efi/EFI/Microsoft/Boot/bkpbootmgfw.efi)
cat << EOF
menuentry "Windows Boot Manager" {
@@ -71,7 +71,7 @@ cat << EOF
insmod fat
insmod search_fs_uuid
insmod chain
search --fs-uuid --set=root ${ESP_SEARCH_HINTS} ${WIN_EFI_UUID}
search --fs-uuid --set=root --hint-bios --hint-efi --hint-baremetal ${ESP_SEARCH_HINTS} ${WIN_EFI_UUID}
chainloader $WIN_EFI_PATH_LINUX
}
EOF
system/boot/grub2/files/Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch
+139
View File
@@ -0,0 +1,139 @@
From 734668238fcc0ef691a080839e04f33854fa133a Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Thu, 29 Jun 2017 13:27:49 +0000
Subject: Allow GRUB to mount ext2/3/4 filesystems that have the encryption
feature.
On such a filesystem, inodes may have EXT4_ENCRYPT_FLAG set.
For a regular file, this means its contents are encrypted; for a
directory, this means the filenames in its directory entries are
encrypted; and for a symlink, this means its target is encrypted. Since
GRUB cannot decrypt encrypted contents or filenames, just issue an error
if it would need to do so. This is sufficient to allow unencrypted boot
files to co-exist with encrypted files elsewhere on the filesystem.
(Note that encrypted regular files and symlinks will not normally be
encountered outside an encrypted directory; however, it's possible via
hard links, so they still need to be handled.)
Tested by booting from an ext4 /boot partition on which I had run
'tune2fs -O encrypt'. I also verified that the expected error messages
are printed when trying to access encrypted directories, files, and
symlinks from the GRUB command line. Also ran 'sudo ./grub-fs-tester
ext4_encrypt'; note that this requires e2fsprogs v1.43+ and Linux v4.1+.
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
grub-core/fs/ext2.c | 23 ++++++++++++++++++++++-
tests/ext234_test.in | 1 +
tests/util/grub-fs-tester.in | 10 ++++++++++
3 files changed, 33 insertions(+), 1 deletion(-)
diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c
index cdce63b..b8ad75a 100644
--- a/grub-core/fs/ext2.c
+++ b/grub-core/fs/ext2.c
@@ -102,6 +102,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
#define EXT4_FEATURE_INCOMPAT_64BIT 0x0080
#define EXT4_FEATURE_INCOMPAT_MMP 0x0100
#define EXT4_FEATURE_INCOMPAT_FLEX_BG 0x0200
+#define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000
/* The set of back-incompatible features this driver DOES support. Add (OR)
* flags here as the related features are implemented into the driver. */
@@ -109,7 +110,8 @@ GRUB_MOD_LICENSE ("GPLv3+");
| EXT4_FEATURE_INCOMPAT_EXTENTS \
| EXT4_FEATURE_INCOMPAT_FLEX_BG \
| EXT2_FEATURE_INCOMPAT_META_BG \
- | EXT4_FEATURE_INCOMPAT_64BIT)
+ | EXT4_FEATURE_INCOMPAT_64BIT \
+ | EXT4_FEATURE_INCOMPAT_ENCRYPT)
/* List of rationales for the ignored "incompatible" features:
* needs_recovery: Not really back-incompatible - was added as such to forbid
* ext2 drivers from mounting an ext3 volume with a dirty
@@ -138,6 +140,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
#define EXT3_JOURNAL_FLAG_DELETED 4
#define EXT3_JOURNAL_FLAG_LAST_TAG 8
+#define EXT4_ENCRYPT_FLAG 0x800
#define EXT4_EXTENTS_FLAG 0x80000
/* The ext2 superblock. */
@@ -706,6 +709,12 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)
grub_ext2_read_inode (diro->data, diro->ino, &diro->inode);
if (grub_errno)
return 0;
+
+ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
+ {
+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "symlink is encrypted");
+ return 0;
+ }
}
symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1);
@@ -749,6 +758,12 @@ grub_ext2_iterate_dir (grub_fshelp_node_t dir,
return 0;
}
+ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
+ {
+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "directory is encrypted");
+ return 0;
+ }
+
/* Search the file. */
while (fpos < grub_le_to_cpu32 (diro->inode.size))
{
@@ -859,6 +874,12 @@ grub_ext2_open (struct grub_file *file, const char *name)
goto fail;
}
+ if (fdiro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
+ {
+ err = grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "file is encrypted");
+ goto fail;
+ }
+
grub_memcpy (data->inode, &fdiro->inode, sizeof (struct grub_ext2_inode));
grub_free (fdiro);
diff --git a/tests/ext234_test.in b/tests/ext234_test.in
index 892b99c..4f1eb52 100644
--- a/tests/ext234_test.in
+++ b/tests/ext234_test.in
@@ -30,3 +30,4 @@ fi
"@builddir@/grub-fs-tester" ext3
"@builddir@/grub-fs-tester" ext4
"@builddir@/grub-fs-tester" ext4_metabg
+"@builddir@/grub-fs-tester" ext4_encrypt
diff --git a/tests/util/grub-fs-tester.in b/tests/util/grub-fs-tester.in
index 88cbe73..fd7e0f1 100644
--- a/tests/util/grub-fs-tester.in
+++ b/tests/util/grub-fs-tester.in
@@ -156,6 +156,12 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
# Could go further but what's the point?
MAXBLKSIZE=$((65536*1024))
;;
+ xext4_encrypt)
+ # OS LIMITATION: Linux currently only allows the 'encrypt' feature
+ # in combination with block_size = PAGE_SIZE (4096 bytes on x86).
+ MINBLKSIZE=$(getconf PAGE_SIZE)
+ MAXBLKSIZE=$MINBLKSIZE
+ ;;
xext*)
MINBLKSIZE=1024
if [ $MINBLKSIZE -lt $SECSIZE ]; then
@@ -796,6 +802,10 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O meta_bg,^resize_inode -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
MOUNTFS=ext4
;;
+ xext4_encrypt)
+ MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O encrypt -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
+ MOUNTFS=ext4
+ ;;
xext*)
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.$fs" -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" ;;
xxfs)
--
cgit v1.0-41-gc330
system/boot/grub2/files/intel-ucode.patch
+51
View File
@@ -0,0 +1,51 @@
diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
index de9044c..f5d3e78 100644
--- a/util/grub.d/10_linux.in
+++ b/util/grub.d/10_linux.in
@@ -133,13 +133,15 @@ linux_entry ()
echo '$(echo "$message" | grub_quote)'
linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
EOF
- if test -n "${initrd}" ; then
+ if test -n "${initrd}" -o -n "${initrd_extra}" ; then
# TRANSLATORS: ramdisk isn't identifier. Should be translated.
message="$(gettext_printf "Loading initial ramdisk ...")"
- sed "s/^/$submenu_indentation/" << EOF
- echo '$(echo "$message" | grub_quote)'
- initrd ${rel_dirname}/${initrd}
-EOF
+ printf ' %s\n' "echo '$(echo "$message" | grub_quote)'" | sed "s/^/$submenu_indentation/"
+ printf ' %s ' 'initrd' | sed "s/^/$submenu_indentation/"
+ for i in ${initrd_extra} ${initrd}; do
+ printf ' %s/%s' "${rel_dirname}" "${i}"
+ done
+ printf '\n'
fi
sed "s/^/$submenu_indentation/" << EOF
}
@@ -202,6 +204,12 @@ while [ "x$list" != "x" ] ; do
break
fi
done
+ initrd_extra=
+ for i in intel-ucode.img; do
+ if test -e "${dirname}/${i}" ; then
+ initrd_extra="${initrd_extra} ${i}"
+ fi
+ done
config=
for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do
@@ -216,8 +224,8 @@ while [ "x$list" != "x" ] ; do
initramfs=`grep CONFIG_INITRAMFS_SOURCE= "${config}" | cut -f2 -d= | tr -d \"`
fi
- if test -n "${initrd}" ; then
- gettext_printf "Found initrd image: %s\n" "${dirname}/${initrd}" >&2
+ if test -n "${initrd}" -o -n "${initrd_extra}" ; then
+ gettext_printf "Found initrd image(s) in %s:%s\n" "${dirname}" "${initrd_extra} ${initrd}" >&2
elif test -z "${initramfs}" ; then
# "UUID=" and "ZFS=" magic is parsed by initrd or initramfs. Since there's
# no initrd or builtin initramfs, it can't work here.
--
2.9.2
system/boot/grub2/files/tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch
+30
View File
@@ -0,0 +1,30 @@
From 446794de8da4329ea532cbee4ca877bcafd0e534 Mon Sep 17 00:00:00 2001
From: "David E. Box" <david.e.box@linux.intel.com>
Date: Fri, 15 Sep 2017 15:37:05 -0700
Subject: tsc: Change default tsc calibration method to pmtimer on EFI systems
On efi systems, make pmtimer based tsc calibration the default over the
pit. This prevents Grub from hanging on Intel SoC systems that power gate
the pit.
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/kern/i386/tsc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/grub-core/kern/i386/tsc.c b/grub-core/kern/i386/tsc.c
index 2e85289d8..f266eb131 100644
--- a/grub-core/kern/i386/tsc.c
+++ b/grub-core/kern/i386/tsc.c
@@ -68,7 +68,7 @@ grub_tsc_init (void)
#ifdef GRUB_MACHINE_XEN
(void) (grub_tsc_calibrate_from_xen () || calibrate_tsc_hardcode());
#elif defined (GRUB_MACHINE_EFI)
- (void) (grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode());
+ (void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode());
#elif defined (GRUB_MACHINE_COREBOOT)
(void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || calibrate_tsc_hardcode());
#else
--
cgit v1.1-26-g67d0
system/boot/grub2/pspec.xml
+10
View File
@@ -46,6 +46,9 @@
<Patch level="1">grub-2.02_beta2-KERNEL_GLOBS.patch</Patch>
<Patch level="1">mkconfig-fix.patch</Patch>
<Patch level="1">pisi_name_and_initramfs.patch</Patch>
<Patch level="1">Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch</Patch>
<Patch level="1">tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch</Patch>
<Patch level="1">intel-ucode.patch</Patch>
</Patches>
</Source>
@@ -85,6 +88,13 @@
</Package>
<History>
<Update release="10">
<Date>2017-12-06</Date>
<Version>2.02</Version>
<Comment>Patch for ext234.</Comment>
<Name>Kamil Atlı</Name>
<Email>suvari@pisilinux.org</Email>
</Update>
<Update release="9">
<Date>2017-12-06</Date>
<Version>2.02</Version>