diff --git a/system/boot/grub2/files/30_uefi-firmware b/system/boot/grub2/files/30_uefi-firmware index 4593173c..41fe841b 100755 --- a/system/boot/grub2/files/30_uefi-firmware +++ b/system/boot/grub2/files/30_uefi-firmware @@ -55,12 +55,12 @@ WINDOWS_EFI=$(/usr/sbin/efibootmgr -v | grep -E -m 1 '(WINDOWS|Windows Boot Mana if [ -z "$WINDOWS_EFI" ]; then exit 0 fi -WIN_EFI_PATH_LINUX=/EFI/Microsoft/Boot/bootmgfw.efi +WIN_EFI_PATH_LINUX=/EFI/Microsoft/Boot/bkpbootmgfw.efi #Determine EFI UUID -WIN_EFI_UUID=$(grub2-probe --target=fs_uuid /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi) +WIN_EFI_UUID=$(grub2-probe --target=fs_uuid /boot/efi/EFI/Microsoft/Boot/bkpbootmgfw.efi) -ESP_SEARCH_HINTS=$(grub2-probe --target=hints_string /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi) +ESP_SEARCH_HINTS=$(grub2-probe --target=hints_string /boot/efi/EFI/Microsoft/Boot/bkpbootmgfw.efi) cat << EOF menuentry "Windows Boot Manager" { @@ -71,7 +71,7 @@ cat << EOF insmod fat insmod search_fs_uuid insmod chain - search --fs-uuid --set=root ${ESP_SEARCH_HINTS} ${WIN_EFI_UUID} + search --fs-uuid --set=root --hint-bios --hint-efi --hint-baremetal ${ESP_SEARCH_HINTS} ${WIN_EFI_UUID} chainloader $WIN_EFI_PATH_LINUX } EOF diff --git a/system/boot/grub2/files/Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch b/system/boot/grub2/files/Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch new file mode 100644 index 00000000..86b0a55b --- /dev/null +++ b/system/boot/grub2/files/Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch @@ -0,0 +1,139 @@ +From 734668238fcc0ef691a080839e04f33854fa133a Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Thu, 29 Jun 2017 13:27:49 +0000 +Subject: Allow GRUB to mount ext2/3/4 filesystems that have the encryption + feature. + +On such a filesystem, inodes may have EXT4_ENCRYPT_FLAG set. +For a regular file, this means its contents are encrypted; for a +directory, this means the filenames in its directory entries are +encrypted; and for a symlink, this means its target is encrypted. Since +GRUB cannot decrypt encrypted contents or filenames, just issue an error +if it would need to do so. This is sufficient to allow unencrypted boot +files to co-exist with encrypted files elsewhere on the filesystem. + +(Note that encrypted regular files and symlinks will not normally be +encountered outside an encrypted directory; however, it's possible via +hard links, so they still need to be handled.) + +Tested by booting from an ext4 /boot partition on which I had run +'tune2fs -O encrypt'. I also verified that the expected error messages +are printed when trying to access encrypted directories, files, and +symlinks from the GRUB command line. Also ran 'sudo ./grub-fs-tester +ext4_encrypt'; note that this requires e2fsprogs v1.43+ and Linux v4.1+. + +Signed-off-by: Eric Biggers +--- + grub-core/fs/ext2.c | 23 ++++++++++++++++++++++- + tests/ext234_test.in | 1 + + tests/util/grub-fs-tester.in | 10 ++++++++++ + 3 files changed, 33 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index cdce63b..b8ad75a 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -102,6 +102,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #define EXT4_FEATURE_INCOMPAT_64BIT 0x0080 + #define EXT4_FEATURE_INCOMPAT_MMP 0x0100 + #define EXT4_FEATURE_INCOMPAT_FLEX_BG 0x0200 ++#define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000 + + /* The set of back-incompatible features this driver DOES support. Add (OR) + * flags here as the related features are implemented into the driver. */ +@@ -109,7 +110,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); + | EXT4_FEATURE_INCOMPAT_EXTENTS \ + | EXT4_FEATURE_INCOMPAT_FLEX_BG \ + | EXT2_FEATURE_INCOMPAT_META_BG \ +- | EXT4_FEATURE_INCOMPAT_64BIT) ++ | EXT4_FEATURE_INCOMPAT_64BIT \ ++ | EXT4_FEATURE_INCOMPAT_ENCRYPT) + /* List of rationales for the ignored "incompatible" features: + * needs_recovery: Not really back-incompatible - was added as such to forbid + * ext2 drivers from mounting an ext3 volume with a dirty +@@ -138,6 +140,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #define EXT3_JOURNAL_FLAG_DELETED 4 + #define EXT3_JOURNAL_FLAG_LAST_TAG 8 + ++#define EXT4_ENCRYPT_FLAG 0x800 + #define EXT4_EXTENTS_FLAG 0x80000 + + /* The ext2 superblock. */ +@@ -706,6 +709,12 @@ grub_ext2_read_symlink (grub_fshelp_node_t node) + grub_ext2_read_inode (diro->data, diro->ino, &diro->inode); + if (grub_errno) + return 0; ++ ++ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG)) ++ { ++ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "symlink is encrypted"); ++ return 0; ++ } + } + + symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1); +@@ -749,6 +758,12 @@ grub_ext2_iterate_dir (grub_fshelp_node_t dir, + return 0; + } + ++ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG)) ++ { ++ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "directory is encrypted"); ++ return 0; ++ } ++ + /* Search the file. */ + while (fpos < grub_le_to_cpu32 (diro->inode.size)) + { +@@ -859,6 +874,12 @@ grub_ext2_open (struct grub_file *file, const char *name) + goto fail; + } + ++ if (fdiro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG)) ++ { ++ err = grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "file is encrypted"); ++ goto fail; ++ } ++ + grub_memcpy (data->inode, &fdiro->inode, sizeof (struct grub_ext2_inode)); + grub_free (fdiro); + +diff --git a/tests/ext234_test.in b/tests/ext234_test.in +index 892b99c..4f1eb52 100644 +--- a/tests/ext234_test.in ++++ b/tests/ext234_test.in +@@ -30,3 +30,4 @@ fi + "@builddir@/grub-fs-tester" ext3 + "@builddir@/grub-fs-tester" ext4 + "@builddir@/grub-fs-tester" ext4_metabg ++"@builddir@/grub-fs-tester" ext4_encrypt +diff --git a/tests/util/grub-fs-tester.in b/tests/util/grub-fs-tester.in +index 88cbe73..fd7e0f1 100644 +--- a/tests/util/grub-fs-tester.in ++++ b/tests/util/grub-fs-tester.in +@@ -156,6 +156,12 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do + # Could go further but what's the point? + MAXBLKSIZE=$((65536*1024)) + ;; ++ xext4_encrypt) ++ # OS LIMITATION: Linux currently only allows the 'encrypt' feature ++ # in combination with block_size = PAGE_SIZE (4096 bytes on x86). ++ MINBLKSIZE=$(getconf PAGE_SIZE) ++ MAXBLKSIZE=$MINBLKSIZE ++ ;; + xext*) + MINBLKSIZE=1024 + if [ $MINBLKSIZE -lt $SECSIZE ]; then +@@ -796,6 +802,10 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do + MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O meta_bg,^resize_inode -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" + MOUNTFS=ext4 + ;; ++ xext4_encrypt) ++ MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O encrypt -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" ++ MOUNTFS=ext4 ++ ;; + xext*) + MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.$fs" -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" ;; + xxfs) +-- +cgit v1.0-41-gc330 diff --git a/system/boot/grub2/files/intel-ucode.patch b/system/boot/grub2/files/intel-ucode.patch new file mode 100644 index 00000000..bd6b0e76 --- /dev/null +++ b/system/boot/grub2/files/intel-ucode.patch @@ -0,0 +1,51 @@ +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index de9044c..f5d3e78 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -133,13 +133,15 @@ linux_entry () + echo '$(echo "$message" | grub_quote)' + linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args} + EOF +- if test -n "${initrd}" ; then ++ if test -n "${initrd}" -o -n "${initrd_extra}" ; then + # TRANSLATORS: ramdisk isn't identifier. Should be translated. + message="$(gettext_printf "Loading initial ramdisk ...")" +- sed "s/^/$submenu_indentation/" << EOF +- echo '$(echo "$message" | grub_quote)' +- initrd ${rel_dirname}/${initrd} +-EOF ++ printf ' %s\n' "echo '$(echo "$message" | grub_quote)'" | sed "s/^/$submenu_indentation/" ++ printf ' %s ' 'initrd' | sed "s/^/$submenu_indentation/" ++ for i in ${initrd_extra} ${initrd}; do ++ printf ' %s/%s' "${rel_dirname}" "${i}" ++ done ++ printf '\n' + fi + sed "s/^/$submenu_indentation/" << EOF + } +@@ -202,6 +204,12 @@ while [ "x$list" != "x" ] ; do + break + fi + done ++ initrd_extra= ++ for i in intel-ucode.img; do ++ if test -e "${dirname}/${i}" ; then ++ initrd_extra="${initrd_extra} ${i}" ++ fi ++ done + + config= + for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do +@@ -216,8 +224,8 @@ while [ "x$list" != "x" ] ; do + initramfs=`grep CONFIG_INITRAMFS_SOURCE= "${config}" | cut -f2 -d= | tr -d \"` + fi + +- if test -n "${initrd}" ; then +- gettext_printf "Found initrd image: %s\n" "${dirname}/${initrd}" >&2 ++ if test -n "${initrd}" -o -n "${initrd_extra}" ; then ++ gettext_printf "Found initrd image(s) in %s:%s\n" "${dirname}" "${initrd_extra} ${initrd}" >&2 + elif test -z "${initramfs}" ; then + # "UUID=" and "ZFS=" magic is parsed by initrd or initramfs. Since there's + # no initrd or builtin initramfs, it can't work here. +-- +2.9.2 \ No newline at end of file diff --git a/system/boot/grub2/files/tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch b/system/boot/grub2/files/tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch new file mode 100644 index 00000000..cb9c31b7 --- /dev/null +++ b/system/boot/grub2/files/tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch @@ -0,0 +1,30 @@ +From 446794de8da4329ea532cbee4ca877bcafd0e534 Mon Sep 17 00:00:00 2001 +From: "David E. Box" +Date: Fri, 15 Sep 2017 15:37:05 -0700 +Subject: tsc: Change default tsc calibration method to pmtimer on EFI systems + +On efi systems, make pmtimer based tsc calibration the default over the +pit. This prevents Grub from hanging on Intel SoC systems that power gate +the pit. + +Signed-off-by: David E. Box +Reviewed-by: Daniel Kiper +--- + grub-core/kern/i386/tsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/i386/tsc.c b/grub-core/kern/i386/tsc.c +index 2e85289d8..f266eb131 100644 +--- a/grub-core/kern/i386/tsc.c ++++ b/grub-core/kern/i386/tsc.c +@@ -68,7 +68,7 @@ grub_tsc_init (void) + #ifdef GRUB_MACHINE_XEN + (void) (grub_tsc_calibrate_from_xen () || calibrate_tsc_hardcode()); + #elif defined (GRUB_MACHINE_EFI) +- (void) (grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode()); ++ (void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode()); + #elif defined (GRUB_MACHINE_COREBOOT) + (void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || calibrate_tsc_hardcode()); + #else +-- +cgit v1.1-26-g67d0 diff --git a/system/boot/grub2/pspec.xml b/system/boot/grub2/pspec.xml index dfb02b75..36420ce5 100644 --- a/system/boot/grub2/pspec.xml +++ b/system/boot/grub2/pspec.xml @@ -46,6 +46,9 @@ grub-2.02_beta2-KERNEL_GLOBS.patch mkconfig-fix.patch pisi_name_and_initramfs.patch + Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch + tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch + intel-ucode.patch @@ -85,6 +88,13 @@ + + 2017-12-06 + 2.02 + Patch for ext234. + Kamil Atlı + suvari@pisilinux.org + 2017-12-06 2.02