Kamil ATLI
GitHub
@@ -76,4 +76,4 @@ cat << EOF
|
||||
}
|
||||
EOF
|
||||
|
||||
fi
|
||||
fi
|
||||
+139
@@ -0,0 +1,139 @@
|
||||
From 734668238fcc0ef691a080839e04f33854fa133a Mon Sep 17 00:00:00 2001
|
||||
From: Eric Biggers <ebiggers@google.com>
|
||||
Date: Thu, 29 Jun 2017 13:27:49 +0000
|
||||
Subject: Allow GRUB to mount ext2/3/4 filesystems that have the encryption
|
||||
feature.
|
||||
|
||||
On such a filesystem, inodes may have EXT4_ENCRYPT_FLAG set.
|
||||
For a regular file, this means its contents are encrypted; for a
|
||||
directory, this means the filenames in its directory entries are
|
||||
encrypted; and for a symlink, this means its target is encrypted. Since
|
||||
GRUB cannot decrypt encrypted contents or filenames, just issue an error
|
||||
if it would need to do so. This is sufficient to allow unencrypted boot
|
||||
files to co-exist with encrypted files elsewhere on the filesystem.
|
||||
|
||||
(Note that encrypted regular files and symlinks will not normally be
|
||||
encountered outside an encrypted directory; however, it's possible via
|
||||
hard links, so they still need to be handled.)
|
||||
|
||||
Tested by booting from an ext4 /boot partition on which I had run
|
||||
'tune2fs -O encrypt'. I also verified that the expected error messages
|
||||
are printed when trying to access encrypted directories, files, and
|
||||
symlinks from the GRUB command line. Also ran 'sudo ./grub-fs-tester
|
||||
ext4_encrypt'; note that this requires e2fsprogs v1.43+ and Linux v4.1+.
|
||||
|
||||
Signed-off-by: Eric Biggers <ebiggers@google.com>
|
||||
---
|
||||
grub-core/fs/ext2.c | 23 ++++++++++++++++++++++-
|
||||
tests/ext234_test.in | 1 +
|
||||
tests/util/grub-fs-tester.in | 10 ++++++++++
|
||||
3 files changed, 33 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c
|
||||
index cdce63b..b8ad75a 100644
|
||||
--- a/grub-core/fs/ext2.c
|
||||
+++ b/grub-core/fs/ext2.c
|
||||
@@ -102,6 +102,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
|
||||
#define EXT4_FEATURE_INCOMPAT_64BIT 0x0080
|
||||
#define EXT4_FEATURE_INCOMPAT_MMP 0x0100
|
||||
#define EXT4_FEATURE_INCOMPAT_FLEX_BG 0x0200
|
||||
+#define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000
|
||||
|
||||
/* The set of back-incompatible features this driver DOES support. Add (OR)
|
||||
* flags here as the related features are implemented into the driver. */
|
||||
@@ -109,7 +110,8 @@ GRUB_MOD_LICENSE ("GPLv3+");
|
||||
| EXT4_FEATURE_INCOMPAT_EXTENTS \
|
||||
| EXT4_FEATURE_INCOMPAT_FLEX_BG \
|
||||
| EXT2_FEATURE_INCOMPAT_META_BG \
|
||||
- | EXT4_FEATURE_INCOMPAT_64BIT)
|
||||
+ | EXT4_FEATURE_INCOMPAT_64BIT \
|
||||
+ | EXT4_FEATURE_INCOMPAT_ENCRYPT)
|
||||
/* List of rationales for the ignored "incompatible" features:
|
||||
* needs_recovery: Not really back-incompatible - was added as such to forbid
|
||||
* ext2 drivers from mounting an ext3 volume with a dirty
|
||||
@@ -138,6 +140,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
|
||||
#define EXT3_JOURNAL_FLAG_DELETED 4
|
||||
#define EXT3_JOURNAL_FLAG_LAST_TAG 8
|
||||
|
||||
+#define EXT4_ENCRYPT_FLAG 0x800
|
||||
#define EXT4_EXTENTS_FLAG 0x80000
|
||||
|
||||
/* The ext2 superblock. */
|
||||
@@ -706,6 +709,12 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)
|
||||
grub_ext2_read_inode (diro->data, diro->ino, &diro->inode);
|
||||
if (grub_errno)
|
||||
return 0;
|
||||
+
|
||||
+ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
|
||||
+ {
|
||||
+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "symlink is encrypted");
|
||||
+ return 0;
|
||||
+ }
|
||||
}
|
||||
|
||||
symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1);
|
||||
@@ -749,6 +758,12 @@ grub_ext2_iterate_dir (grub_fshelp_node_t dir,
|
||||
return 0;
|
||||
}
|
||||
|
||||
+ if (diro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
|
||||
+ {
|
||||
+ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "directory is encrypted");
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
/* Search the file. */
|
||||
while (fpos < grub_le_to_cpu32 (diro->inode.size))
|
||||
{
|
||||
@@ -859,6 +874,12 @@ grub_ext2_open (struct grub_file *file, const char *name)
|
||||
goto fail;
|
||||
}
|
||||
|
||||
+ if (fdiro->inode.flags & grub_cpu_to_le32_compile_time (EXT4_ENCRYPT_FLAG))
|
||||
+ {
|
||||
+ err = grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, "file is encrypted");
|
||||
+ goto fail;
|
||||
+ }
|
||||
+
|
||||
grub_memcpy (data->inode, &fdiro->inode, sizeof (struct grub_ext2_inode));
|
||||
grub_free (fdiro);
|
||||
|
||||
diff --git a/tests/ext234_test.in b/tests/ext234_test.in
|
||||
index 892b99c..4f1eb52 100644
|
||||
--- a/tests/ext234_test.in
|
||||
+++ b/tests/ext234_test.in
|
||||
@@ -30,3 +30,4 @@ fi
|
||||
"@builddir@/grub-fs-tester" ext3
|
||||
"@builddir@/grub-fs-tester" ext4
|
||||
"@builddir@/grub-fs-tester" ext4_metabg
|
||||
+"@builddir@/grub-fs-tester" ext4_encrypt
|
||||
diff --git a/tests/util/grub-fs-tester.in b/tests/util/grub-fs-tester.in
|
||||
index 88cbe73..fd7e0f1 100644
|
||||
--- a/tests/util/grub-fs-tester.in
|
||||
+++ b/tests/util/grub-fs-tester.in
|
||||
@@ -156,6 +156,12 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
|
||||
# Could go further but what's the point?
|
||||
MAXBLKSIZE=$((65536*1024))
|
||||
;;
|
||||
+ xext4_encrypt)
|
||||
+ # OS LIMITATION: Linux currently only allows the 'encrypt' feature
|
||||
+ # in combination with block_size = PAGE_SIZE (4096 bytes on x86).
|
||||
+ MINBLKSIZE=$(getconf PAGE_SIZE)
|
||||
+ MAXBLKSIZE=$MINBLKSIZE
|
||||
+ ;;
|
||||
xext*)
|
||||
MINBLKSIZE=1024
|
||||
if [ $MINBLKSIZE -lt $SECSIZE ]; then
|
||||
@@ -796,6 +802,10 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
|
||||
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O meta_bg,^resize_inode -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
|
||||
MOUNTFS=ext4
|
||||
;;
|
||||
+ xext4_encrypt)
|
||||
+ MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O encrypt -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
|
||||
+ MOUNTFS=ext4
|
||||
+ ;;
|
||||
xext*)
|
||||
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.$fs" -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" ;;
|
||||
xxfs)
|
||||
--
|
||||
cgit v1.0-41-gc330
|
||||
@@ -0,0 +1,51 @@
|
||||
diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
|
||||
index de9044c..f5d3e78 100644
|
||||
--- a/util/grub.d/10_linux.in
|
||||
+++ b/util/grub.d/10_linux.in
|
||||
@@ -133,13 +133,15 @@ linux_entry ()
|
||||
echo '$(echo "$message" | grub_quote)'
|
||||
linux ${rel_dirname}/${basename} root=${linux_root_device_thisversion} ro ${args}
|
||||
EOF
|
||||
- if test -n "${initrd}" ; then
|
||||
+ if test -n "${initrd}" -o -n "${initrd_extra}" ; then
|
||||
# TRANSLATORS: ramdisk isn't identifier. Should be translated.
|
||||
message="$(gettext_printf "Loading initial ramdisk ...")"
|
||||
- sed "s/^/$submenu_indentation/" << EOF
|
||||
- echo '$(echo "$message" | grub_quote)'
|
||||
- initrd ${rel_dirname}/${initrd}
|
||||
-EOF
|
||||
+ printf ' %s\n' "echo '$(echo "$message" | grub_quote)'" | sed "s/^/$submenu_indentation/"
|
||||
+ printf ' %s ' 'initrd' | sed "s/^/$submenu_indentation/"
|
||||
+ for i in ${initrd_extra} ${initrd}; do
|
||||
+ printf ' %s/%s' "${rel_dirname}" "${i}"
|
||||
+ done
|
||||
+ printf '\n'
|
||||
fi
|
||||
sed "s/^/$submenu_indentation/" << EOF
|
||||
}
|
||||
@@ -202,6 +204,12 @@ while [ "x$list" != "x" ] ; do
|
||||
break
|
||||
fi
|
||||
done
|
||||
+ initrd_extra=
|
||||
+ for i in intel-ucode.img; do
|
||||
+ if test -e "${dirname}/${i}" ; then
|
||||
+ initrd_extra="${initrd_extra} ${i}"
|
||||
+ fi
|
||||
+ done
|
||||
|
||||
config=
|
||||
for i in "${dirname}/config-${version}" "${dirname}/config-${alt_version}" "/etc/kernels/kernel-config-${version}" ; do
|
||||
@@ -216,8 +224,8 @@ while [ "x$list" != "x" ] ; do
|
||||
initramfs=`grep CONFIG_INITRAMFS_SOURCE= "${config}" | cut -f2 -d= | tr -d \"`
|
||||
fi
|
||||
|
||||
- if test -n "${initrd}" ; then
|
||||
- gettext_printf "Found initrd image: %s\n" "${dirname}/${initrd}" >&2
|
||||
+ if test -n "${initrd}" -o -n "${initrd_extra}" ; then
|
||||
+ gettext_printf "Found initrd image(s) in %s:%s\n" "${dirname}" "${initrd_extra} ${initrd}" >&2
|
||||
elif test -z "${initramfs}" ; then
|
||||
# "UUID=" and "ZFS=" magic is parsed by initrd or initramfs. Since there's
|
||||
# no initrd or builtin initramfs, it can't work here.
|
||||
--
|
||||
2.9.2
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
From 446794de8da4329ea532cbee4ca877bcafd0e534 Mon Sep 17 00:00:00 2001
|
||||
From: "David E. Box" <david.e.box@linux.intel.com>
|
||||
Date: Fri, 15 Sep 2017 15:37:05 -0700
|
||||
Subject: tsc: Change default tsc calibration method to pmtimer on EFI systems
|
||||
|
||||
On efi systems, make pmtimer based tsc calibration the default over the
|
||||
pit. This prevents Grub from hanging on Intel SoC systems that power gate
|
||||
the pit.
|
||||
|
||||
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
|
||||
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||
---
|
||||
grub-core/kern/i386/tsc.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/grub-core/kern/i386/tsc.c b/grub-core/kern/i386/tsc.c
|
||||
index 2e85289d8..f266eb131 100644
|
||||
--- a/grub-core/kern/i386/tsc.c
|
||||
+++ b/grub-core/kern/i386/tsc.c
|
||||
@@ -68,7 +68,7 @@ grub_tsc_init (void)
|
||||
#ifdef GRUB_MACHINE_XEN
|
||||
(void) (grub_tsc_calibrate_from_xen () || calibrate_tsc_hardcode());
|
||||
#elif defined (GRUB_MACHINE_EFI)
|
||||
- (void) (grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode());
|
||||
+ (void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || grub_tsc_calibrate_from_efi() || calibrate_tsc_hardcode());
|
||||
#elif defined (GRUB_MACHINE_COREBOOT)
|
||||
(void) (grub_tsc_calibrate_from_pmtimer () || grub_tsc_calibrate_from_pit () || calibrate_tsc_hardcode());
|
||||
#else
|
||||
--
|
||||
cgit v1.1-26-g67d0
|
||||
@@ -46,6 +46,9 @@
|
||||
<Patch level="1">grub-2.02_beta2-KERNEL_GLOBS.patch</Patch>
|
||||
<Patch level="1">mkconfig-fix.patch</Patch>
|
||||
<Patch level="1">pisi_name_and_initramfs.patch</Patch>
|
||||
<Patch level="1">Allow_GRUB_to_mount_ext234_filesystems_that_have_the_encryption_feature.patch</Patch>
|
||||
<Patch level="1">tsc-Change-default-tsc-calibration-method-to-pmtimer-on-EFI-systems.patch</Patch>
|
||||
<Patch level="1">intel-ucode.patch</Patch>
|
||||
</Patches>
|
||||
</Source>
|
||||
|
||||
@@ -85,6 +88,13 @@
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="10">
|
||||
<Date>2017-12-25</Date>
|
||||
<Version>2.02</Version>
|
||||
<Comment>Patch for ext234.</Comment>
|
||||
<Name>Kamil Atlı</Name>
|
||||
<Email>suvari@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="9">
|
||||
<Date>2017-12-06</Date>
|
||||
<Version>2.02</Version>
|
||||
|
||||
Reference in New Issue
Block a user