.gitignore

@@ -1,4 +1,4 @@
-SOURCES/almalinuxsecurebootca0.cer
-SOURCES/grub-2.02.tar.xz
+SOURCES/gnulib-9f48fb992a3d7e96610c4ce8be969cff2d61a01b.tar.gz
+SOURCES/grub-2.06.tar.xz
 SOURCES/theme.tar.bz2
-SOURCES/unifont-5.1.20080820.pcf.gz
+SOURCES/unifont-13.0.06.pcf.gz

.grub2.metadata

@@ -0,0 +1,4 @@
+d08376d97163f99ce0d61fce160d6f7667c5c944 SOURCES/gnulib-9f48fb992a3d7e96610c4ce8be969cff2d61a01b.tar.gz
+c9f93f1e195ec7a5a21d36a13b469788c0b29f0f SOURCES/grub-2.06.tar.xz
+cf0b7763c528902da7e8b05cfa248f20c8825ce5 SOURCES/theme.tar.bz2
+3b39cb0830367171760ec536cab805abdbe08bc5 SOURCES/unifont-13.0.06.pcf.gz

SOURCES/0001-Revert-templates-Fix-user-facing-typo-with-an-incorr.patch

@@ -0,0 +1,24 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Fri, 11 Jun 2021 12:10:45 +0200
+Subject: [PATCH] Revert "templates: Fix user-facing typo with an incorrect use
+ of "it's""
+
+This reverts commit 722737630889607c3b5761f1f5a48f1674cd2821.
+---
+ util/grub.d/30_os-prober.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in
+index 5984e92d291..94622481284 100644
+--- a/util/grub.d/30_os-prober.in
++++ b/util/grub.d/30_os-prober.in
+@@ -36,7 +36,7 @@ if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/n
+   exit 0
+ fi
+ 
+-grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIts output will be used to detect bootable binaries on them and create new boot entries.")"
++grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")"
+ 
+ OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`"
+ if [ -z "${OSPROBED}" ] ; then

SOURCES/0002-Revert-templates-Properly-disable-the-os-prober-by-d.patch

@@ -0,0 +1,71 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Fri, 11 Jun 2021 12:10:54 +0200
+Subject: [PATCH] Revert "templates: Properly disable the os-prober by default"
+
+This reverts commit 54e0a1bbf1e9106901a557195bb35e5e20fb3925.
+---
+ util/grub-mkconfig.in       | 5 +----
+ util/grub.d/30_os-prober.in | 8 ++++----
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index f8cbb8d7a2b..d3e879b8e5c 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -140,9 +140,6 @@ GRUB_DEVICE_PARTUUID="`${grub_probe} --device ${GRUB_DEVICE} --target=partuuid 2
+ GRUB_DEVICE_BOOT="`${grub_probe} --target=device /boot`"
+ GRUB_DEVICE_BOOT_UUID="`${grub_probe} --device ${GRUB_DEVICE_BOOT} --target=fs_uuid 2> /dev/null`" || true
+ 
+-# Disable os-prober by default due to security reasons.
+-GRUB_DISABLE_OS_PROBER="true"
+-
+ # Filesystem for the device containing our userland.  Used for stuff like
+ # choosing Hurd filesystem module.
+ GRUB_FS="`${grub_probe} --device ${GRUB_DEVICE} --target=fs 2> /dev/null || echo unknown`"
+@@ -204,7 +201,6 @@ export GRUB_DEVICE \
+   GRUB_DEVICE_PARTUUID \
+   GRUB_DEVICE_BOOT \
+   GRUB_DEVICE_BOOT_UUID \
+-  GRUB_DISABLE_OS_PROBER \
+   GRUB_FS \
+   GRUB_FONT \
+   GRUB_PRELOAD_MODULES \
+@@ -246,6 +242,7 @@ export GRUB_DEFAULT \
+   GRUB_BACKGROUND \
+   GRUB_THEME \
+   GRUB_GFXPAYLOAD_LINUX \
++  GRUB_DISABLE_OS_PROBER \
+   GRUB_INIT_TUNE \
+   GRUB_SAVEDEFAULT \
+   GRUB_ENABLE_CRYPTODISK \
+diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in
+index 94622481284..80685b15f4d 100644
+--- a/util/grub.d/30_os-prober.in
++++ b/util/grub.d/30_os-prober.in
+@@ -26,8 +26,8 @@ export TEXTDOMAINDIR="@localedir@"
+ 
+ . "$pkgdatadir/grub-mkconfig_lib"
+ 
+-if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then
+-  grub_warn "$(gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.")"
++if [ "x${GRUB_DISABLE_OS_PROBER}" = "xfalse" ]; then
++  gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.\n"
+   exit 0
+ fi
+ 
+@@ -36,12 +36,12 @@ if ! command -v os-prober > /dev/null || ! command -v linux-boot-prober > /dev/n
+   exit 0
+ fi
+ 
+-grub_warn "$(gettext_printf "os-prober will be executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")"
+-
+ OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`"
+ if [ -z "${OSPROBED}" ] ; then
+   # empty os-prober output, nothing doing
+   exit 0
++else
++  grub_warn "$(gettext_printf "os-prober was executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")"
+ fi
+ 
+ osx_entry() {

SOURCES/0003-Revert-templates-Disable-the-os-prober-by-default.patch

@@ -0,0 +1,70 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Fri, 11 Jun 2021 12:10:58 +0200
+Subject: [PATCH] Revert "templates: Disable the os-prober by default"
+
+This reverts commit e346414725a70e5c74ee87ca14e580c66f517666.
+---
+ docs/grub.texi              | 18 ++++++++----------
+ util/grub.d/30_os-prober.in |  5 +----
+ 2 files changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/docs/grub.texi b/docs/grub.texi
+index f8b4b3b21a7..69f08d289f9 100644
+--- a/docs/grub.texi
++++ b/docs/grub.texi
+@@ -1519,13 +1519,10 @@ boot sequence.  If you have problems, set this option to @samp{text} and
+ GRUB will tell Linux to boot in normal text mode.
+ 
+ @item GRUB_DISABLE_OS_PROBER
+-The @command{grub-mkconfig} has a feature to use the external
+-@command{os-prober} program to discover other operating systems installed on
+-the same machine and generate appropriate menu entries for them. It is disabled
+-by default since automatic and silent execution of @command{os-prober}, and
+-creating boot entries based on that data, is a potential attack vector. Set
+-this option to @samp{false} to enable this feature in the
+-@command{grub-mkconfig} command.
++Normally, @command{grub-mkconfig} will try to use the external
++@command{os-prober} program, if installed, to discover other operating
++systems installed on the same system and generate appropriate menu entries
++for them.  Set this option to @samp{true} to disable this.
+ 
+ @item GRUB_OS_PROBER_SKIP_LIST
+ List of space-separated FS UUIDs of filesystems to be ignored from os-prober
+@@ -1853,9 +1850,10 @@ than zero; otherwise 0.
+ @section Multi-boot manual config
+ 
+ Currently autogenerating config files for multi-boot environments depends on
+-os-prober and has several shortcomings. Due to that it is disabled by default.
+-It is advised to use the power of GRUB syntax and do it yourself. A possible
+-configuration is detailed here, feel free to adjust to your needs.
++os-prober and has several shortcomings. While fixing it is scheduled for the
++next release, meanwhile you can make use of the power of GRUB syntax and do it
++yourself. A possible configuration is detailed here, feel free to adjust to your
++needs.
+ 
+ First create a separate GRUB partition, big enough to hold GRUB. Some of the
+ following entries show how to load OS installer images from this same partition,
+diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in
+index 80685b15f4d..1b91c102f35 100644
+--- a/util/grub.d/30_os-prober.in
++++ b/util/grub.d/30_os-prober.in
+@@ -26,8 +26,7 @@ export TEXTDOMAINDIR="@localedir@"
+ 
+ . "$pkgdatadir/grub-mkconfig_lib"
+ 
+-if [ "x${GRUB_DISABLE_OS_PROBER}" = "xfalse" ]; then
+-  gettext_printf "os-prober will not be executed to detect other bootable partitions.\nSystems on them will not be added to the GRUB boot configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.\n"
++if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then
+   exit 0
+ fi
+ 
+@@ -40,8 +39,6 @@ OSPROBED="`os-prober | tr ' ' '^' | paste -s -d ' '`"
+ if [ -z "${OSPROBED}" ] ; then
+   # empty os-prober output, nothing doing
+   exit 0
+-else
+-  grub_warn "$(gettext_printf "os-prober was executed to detect other bootable partitions.\nIt's output will be used to detect bootable binaries on them and create new boot entries.")"
+ fi
+ 
+ osx_entry() {

SOURCES/0004-Add-support-for-Linux-EFI-stub-loading.patch

@@ -35,20 +35,19 @@ moves the check into grub_dl_load_file.
  grub-core/loader/i386/efi/linux.c | 335 ++++++++++++++++++++++++++++++++++++++
  grub-core/loader/i386/pc/linux.c  |  10 +-
  include/grub/arm/linux.h          |   9 +
- include/grub/arm64/linux.h        |  10 ++
+ include/grub/arm64/linux.h        |   9 +
  include/grub/efi/efi.h            |   7 +-
  include/grub/efi/linux.h          |  31 ++++
- include/grub/i386/linux.h         |   1 +
- 14 files changed, 620 insertions(+), 69 deletions(-)
+ 13 files changed, 618 insertions(+), 69 deletions(-)
  create mode 100644 grub-core/loader/efi/linux.c
  create mode 100644 grub-core/loader/i386/efi/linux.c
  create mode 100644 include/grub/efi/linux.h
 
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 9590e87d9..0b4b0c212 100644
+index 8022e1c0a79..45d3edaa4dc 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1626,13 +1626,6 @@ module = {
+@@ -1734,13 +1734,6 @@ module = {
    enable = i386_pc;
  };
  
@@ -62,7 +61,7 @@ index 9590e87d9..0b4b0c212 100644
  module = {
    name = ntldr;
    i386_pc = loader/i386/pc/ntldr.c;
-@@ -1685,7 +1678,9 @@ module = {
+@@ -1796,7 +1789,9 @@ module = {
  
  module = {
    name = linux;
@@ -70,13 +69,13 @@ index 9590e87d9..0b4b0c212 100644
 +  i386_pc = loader/i386/pc/linux.c;
 +  x86_64_efi = loader/i386/efi/linux.c;
 +  i386_efi = loader/i386/efi/linux.c;
+   i386_xen_pvh = loader/i386/linux.c;
    xen = loader/i386/xen.c;
    i386_pc = lib/i386/pc/vesa_modes_table.c;
-   mips = loader/mips/linux.c;
-@@ -1696,9 +1691,14 @@ module = {
-   arm_efi = loader/arm64/linux.c;
-   arm_uboot = loader/arm/linux.c;
+@@ -1811,9 +1806,14 @@ module = {
    arm64 = loader/arm64/linux.c;
+   riscv32 = loader/riscv/linux.c;
+   riscv64 = loader/riscv/linux.c;
 +  emu = loader/emu/linux.c;
 +  fdt = lib/fdt.c;
 +
@@ -89,7 +88,7 @@ index 9590e87d9..0b4b0c212 100644
  
  module = {
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index e394cd96f..04e804d16 100644
+index 48f8a79073d..b7149370950 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
 @@ -38,6 +38,14 @@
@@ -107,7 +106,7 @@ index e394cd96f..04e804d16 100644
  
  
  #pragma GCC diagnostic ignored "-Wcast-align"
-@@ -686,6 +694,19 @@ grub_dl_load_file (const char *filename)
+@@ -695,6 +703,19 @@ grub_dl_load_file (const char *filename)
    void *core = 0;
    grub_dl_t mod = 0;
  
@@ -126,13 +125,13 @@ index e394cd96f..04e804d16 100644
 +
    grub_boot_time ("Loading module %s", filename);
  
-   file = grub_file_open (filename);
+   file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE);
 diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
-index 708581fcb..c8a9d8307 100644
+index 8cff7be0289..35b8f670602 100644
 --- a/grub-core/kern/efi/efi.c
 +++ b/grub-core/kern/efi/efi.c
-@@ -273,6 +273,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
-   return NULL;
+@@ -286,6 +286,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
+   return grub_efi_get_variable_with_attributes (var, guid, datasize_out, data_out, NULL);
  }
  
 +grub_efi_boolean_t
@@ -167,7 +166,7 @@ index 708581fcb..c8a9d8307 100644
  
  /* Search the mods section from the PE32/PE32+ image. This code uses
 diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
-index 42ad7c570..5cdf6c943 100644
+index 9838fb2f50d..f6aef0ef649 100644
 --- a/grub-core/kern/efi/mm.c
 +++ b/grub-core/kern/efi/mm.c
 @@ -113,6 +113,38 @@ grub_efi_drop_alloc (grub_efi_physical_address_t address,
@@ -210,7 +209,7 @@ index 42ad7c570..5cdf6c943 100644
  void *
  grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
 diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
-index 1f86229f8..6c00af98d 100644
+index ef3e9f9444c..a312c668685 100644
 --- a/grub-core/loader/arm64/linux.c
 +++ b/grub-core/loader/arm64/linux.c
 @@ -29,6 +29,7 @@
@@ -221,7 +220,7 @@ index 1f86229f8..6c00af98d 100644
  #include <grub/efi/pe32.h>
  #include <grub/i18n.h>
  #include <grub/lib/cmdline.h>
-@@ -40,6 +41,7 @@ static int loaded;
+@@ -41,6 +42,7 @@ static int loaded;
  
  static void *kernel_addr;
  static grub_uint64_t kernel_size;
@@ -229,7 +228,7 @@ index 1f86229f8..6c00af98d 100644
  
  static char *linux_args;
  static grub_uint32_t cmdline_size;
-@@ -66,7 +68,8 @@ grub_armxx_efi_linux_check_image (struct linux_armxx_kernel_header * lh)
+@@ -67,7 +69,8 @@ grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh)
  static grub_err_t
  finalize_params_linux (void)
  {
@@ -239,7 +238,7 @@ index 1f86229f8..6c00af98d 100644
  
    void *fdt;
  
-@@ -101,79 +104,70 @@ finalize_params_linux (void)
+@@ -102,79 +105,70 @@ finalize_params_linux (void)
    if (grub_fdt_install() != GRUB_ERR_NONE)
      goto failure;
  
@@ -251,7 +250,7 @@ index 1f86229f8..6c00af98d 100644
 -}
 -
 -grub_err_t
--grub_armxx_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args)
+-grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args)
 -{
 -  grub_efi_memory_mapped_device_path_t *mempath;
 -  grub_efi_handle_t image_handle;
@@ -284,7 +283,7 @@ index 1f86229f8..6c00af98d 100644
 -
 -  grub_dprintf ("linux", "linux command line: '%s'\n", args);
 +  grub_dprintf ("linux", "Installed/updated FDT configuration table @ %p\n",
-+		fdt);
++                fdt);
  
    /* Convert command line to UCS-2 */
 -  loaded_image = grub_efi_get_loaded_image (image_handle);
@@ -304,7 +303,7 @@ index 1f86229f8..6c00af98d 100644
    loaded_image->load_options_size =
      2 * grub_utf8_to_utf16 (loaded_image->load_options, len,
 -			    (grub_uint8_t *) args, len, NULL);
-+			    (grub_uint8_t *) linux_args, len, NULL);
++                           (grub_uint8_t *) linux_args, len, NULL);
  
 -  grub_dprintf ("linux", "starting image %p\n", image_handle);
 -  status = b->start_image (image_handle, 0, NULL);
@@ -329,15 +328,15 @@ index 1f86229f8..6c00af98d 100644
 +  if (loaded_image)
 +    {
 +      if (loaded_image->load_options)
-+	grub_efi_free_pages ((grub_efi_physical_address_t)(grub_efi_uintn_t)loaded_image->load_options,
-+			     GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size));
++       grub_efi_free_pages ((grub_efi_physical_address_t)(grub_efi_uintn_t)loaded_image->load_options,
++                            GRUB_EFI_BYTES_TO_PAGES (loaded_image->load_options_size));
 +      loaded_image->load_options = NULL;
 +      loaded_image->load_options_size = 0;
 +    }
 +}
 +
 +grub_err_t
-+grub_armxx_efi_linux_boot_image (grub_addr_t addr, char *args)
++grub_arch_efi_linux_boot_image (grub_addr_t addr, char *args)
 +{
 +  grub_err_t retval;
 +
@@ -360,21 +359,21 @@ index 1f86229f8..6c00af98d 100644
 -  if (finalize_params_linux () != GRUB_ERR_NONE)
 -    return grub_errno;
 -
--  return (grub_armxx_efi_linux_boot_image((grub_addr_t)kernel_addr,
+-  return (grub_arch_efi_linux_boot_image((grub_addr_t)kernel_addr,
 -                                          kernel_size, linux_args));
-+  return grub_armxx_efi_linux_boot_image((grub_addr_t)kernel_addr, linux_args);
++  return (grub_arch_efi_linux_boot_image((grub_addr_t)kernel_addr, linux_args));
  }
  
  static grub_err_t
-@@ -287,6 +281,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -288,6 +282,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  {
    grub_file_t file = 0;
-   struct linux_armxx_kernel_header lh;
+   struct linux_arch_kernel_header lh;
 +  struct grub_armxx_linux_pe_header *pe;
+   grub_err_t err;
  
    grub_dl_ref (my_mod);
- 
-@@ -331,6 +326,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -333,6 +328,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
    grub_dprintf ("linux", "kernel @ %p\n", kernel_addr);
  
@@ -391,20 +390,20 @@ index 1f86229f8..6c00af98d 100644
    linux_args = grub_malloc (cmdline_size);
    if (!linux_args)
 diff --git a/grub-core/loader/arm64/xen_boot.c b/grub-core/loader/arm64/xen_boot.c
-index 1003a0b99..f35b16caa 100644
+index 22cc25eccd9..d9b7a9ba400 100644
 --- a/grub-core/loader/arm64/xen_boot.c
 +++ b/grub-core/loader/arm64/xen_boot.c
 @@ -266,7 +266,6 @@ xen_boot (void)
      return err;
  
-   return grub_armxx_efi_linux_boot_image (xen_hypervisor->start,
+   return grub_arch_efi_linux_boot_image (xen_hypervisor->start,
 -					  xen_hypervisor->size,
  					  xen_hypervisor->cmdline);
  }
  
 diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c
 new file mode 100644
-index 000000000..c24202a5d
+index 00000000000..c24202a5dd1
 --- /dev/null
 +++ b/grub-core/loader/efi/linux.c
 @@ -0,0 +1,70 @@
@@ -480,7 +479,7 @@ index 000000000..c24202a5d
 +#pragma GCC diagnostic pop
 diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
 new file mode 100644
-index 000000000..3db82e782
+index 00000000000..bb2616a8092
 --- /dev/null
 +++ b/grub-core/loader/i386/efi/linux.c
 @@ -0,0 +1,335 @@
@@ -589,8 +588,7 @@ index 000000000..3db82e782
 +
 +  for (i = 0; i < argc; i++)
 +    {
-+      grub_file_filter_disable_compression ();
-+      files[i] = grub_file_open (argv[i]);
++      files[i] = grub_file_open (argv[i], GRUB_FILE_TYPE_LINUX_INITRD | GRUB_FILE_TYPE_NO_DECOMPRESS);
 +      if (! files[i])
 +        goto fail;
 +      nfiles++;
@@ -643,7 +641,7 @@ index 000000000..3db82e782
 +		int argc, char *argv[])
 +{
 +  grub_file_t file = 0;
-+  struct linux_kernel_header lh;
++  struct linux_i386_kernel_header lh;
 +  grub_ssize_t len, start, filelen;
 +  void *kernel = NULL;
 +
@@ -655,7 +653,7 @@ index 000000000..3db82e782
 +      goto fail;
 +    }
 +
-+  file = grub_file_open (argv[0]);
++  file = grub_file_open (argv[0], GRUB_FILE_TYPE_LINUX_KERNEL);
 +  if (! file)
 +    goto fail;
 +
@@ -731,7 +729,8 @@ index 000000000..3db82e782
 +  grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE));
 +  grub_create_loader_cmdline (argc, argv,
 +                              linux_cmdline + sizeof (LINUX_IMAGE) - 1,
-+			      lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1));
++			      lh.cmdline_size - (sizeof (LINUX_IMAGE) - 1),
++			      GRUB_VERIFY_KERNEL_CMDLINE);
 +
 +  lh.cmd_line_ptr = (grub_uint32_t)(grub_addr_t)linux_cmdline;
 +
@@ -820,10 +819,10 @@ index 000000000..3db82e782
 +  grub_unregister_command (cmd_initrdefi);
 +}
 diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
-index b69cb7a3a..a3c87cf2f 100644
+index 2a299520160..8be4c3b3f48 100644
 --- a/grub-core/loader/i386/pc/linux.c
 +++ b/grub-core/loader/i386/pc/linux.c
-@@ -468,14 +468,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
+@@ -474,14 +474,20 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
    return grub_errno;
  }
  
@@ -845,7 +844,7 @@ index b69cb7a3a..a3c87cf2f 100644
      grub_register_command ("initrd16", grub_cmd_initrd,
  			   0, N_("Load initrd."));
    my_mod = mod;
-@@ -484,5 +490,7 @@ GRUB_MOD_INIT(linux16)
+@@ -490,5 +496,7 @@ GRUB_MOD_INIT(linux16)
  GRUB_MOD_FINI(linux16)
  {
    grub_unregister_command (cmd_linux);
@@ -854,7 +853,7 @@ index b69cb7a3a..a3c87cf2f 100644
 +  grub_unregister_command (cmd_initrd16);
  }
 diff --git a/include/grub/arm/linux.h b/include/grub/arm/linux.h
-index 712ba17b9..5900fc8a4 100644
+index bcd5a7eb186..b582f67f661 100644
 --- a/include/grub/arm/linux.h
 +++ b/include/grub/arm/linux.h
 @@ -20,6 +20,7 @@
@@ -878,25 +877,24 @@ index 712ba17b9..5900fc8a4 100644
 +
  #if defined(__arm__)
  # define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM_MAGIC_SIGNATURE
- # define linux_armxx_kernel_header linux_arm_kernel_header
+ # define linux_arch_kernel_header linux_arm_kernel_header
 +# define grub_armxx_linux_pe_header grub_arm_linux_pe_header
  #endif
  
  #if defined GRUB_MACHINE_UBOOT
 diff --git a/include/grub/arm64/linux.h b/include/grub/arm64/linux.h
-index 8655067e0..7b533b571 100644
+index 7e22b4ab699..ea030312df3 100644
 --- a/include/grub/arm64/linux.h
 +++ b/include/grub/arm64/linux.h
-@@ -19,6 +19,8 @@
+@@ -19,6 +19,7 @@
  #ifndef GRUB_ARM64_LINUX_HEADER
  #define GRUB_ARM64_LINUX_HEADER 1
  
 +#include <grub/efi/pe32.h>
-+
- #define GRUB_LINUX_ARM64_MAGIC_SIGNATURE 0x644d5241 /* 'ARM\x64' */
+ #include <grub/types.h>
  
- /* From linux/Documentation/arm64/booting.txt */
-@@ -36,9 +38,17 @@ struct linux_arm64_kernel_header
+ #define GRUB_LINUX_ARM64_MAGIC_SIGNATURE 0x644d5241 /* 'ARM\x64' */
+@@ -38,9 +39,17 @@ struct linux_arm64_kernel_header
    grub_uint32_t hdr_offset;	/* Offset of PE/COFF header */
  };
  
@@ -909,13 +907,13 @@ index 8655067e0..7b533b571 100644
 +
  #if defined(__aarch64__)
  # define GRUB_LINUX_ARMXX_MAGIC_SIGNATURE GRUB_LINUX_ARM64_MAGIC_SIGNATURE
- # define linux_armxx_kernel_header linux_arm64_kernel_header
+ # define linux_arch_kernel_header linux_arm64_kernel_header
 +# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header
  #endif
  
  #endif /* ! GRUB_ARM64_LINUX_HEADER */
 diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
-index 2c6648d46..1061aee97 100644
+index 83d958f9945..6295df85f3f 100644
 --- a/include/grub/efi/efi.h
 +++ b/include/grub/efi/efi.h
 @@ -47,6 +47,9 @@ EXPORT_FUNC(grub_efi_allocate_fixed) (grub_efi_physical_address_t address,
@@ -928,7 +926,7 @@ index 2c6648d46..1061aee97 100644
  void EXPORT_FUNC(grub_efi_free_pages) (grub_efi_physical_address_t address,
  				       grub_efi_uintn_t pages);
  grub_efi_uintn_t EXPORT_FUNC(grub_efi_find_mmap_size) (void);
-@@ -82,6 +85,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
+@@ -88,6 +91,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var,
  				     const grub_efi_guid_t *guid,
  				     void *data,
  				     grub_size_t datasize);
@@ -936,19 +934,19 @@ index 2c6648d46..1061aee97 100644
  int
  EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1,
  					     const grub_efi_device_path_t *dp2);
-@@ -95,8 +99,7 @@ void *EXPORT_FUNC(grub_efi_get_firmware_fdt)(void);
+@@ -101,8 +105,7 @@ void *EXPORT_FUNC(grub_efi_get_firmware_fdt)(void);
  grub_err_t EXPORT_FUNC(grub_efi_get_ram_base)(grub_addr_t *);
  #include <grub/cpu/linux.h>
- grub_err_t grub_armxx_efi_linux_check_image(struct linux_armxx_kernel_header *lh);
--grub_err_t grub_armxx_efi_linux_boot_image(grub_addr_t addr, grub_size_t size,
+ grub_err_t grub_arch_efi_linux_check_image(struct linux_arch_kernel_header *lh);
+-grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, grub_size_t size,
 -                                           char *args);
-+grub_err_t grub_armxx_efi_linux_boot_image(grub_addr_t addr, char *args);
++grub_err_t grub_arch_efi_linux_boot_image(grub_addr_t addr, char *args);
  #endif
  
  grub_addr_t grub_efi_modules_addr (void);
 diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h
 new file mode 100644
-index 000000000..d9ede3677
+index 00000000000..d9ede36773b
 --- /dev/null
 +++ b/include/grub/efi/linux.h
 @@ -0,0 +1,31 @@
@@ -983,15 +981,3 @@ index 000000000..d9ede3677
 +				  void *kernel_param);
 +
 +#endif /* ! GRUB_EFI_LINUX_HEADER */
-diff --git a/include/grub/i386/linux.h b/include/grub/i386/linux.h
-index 60c7c3b5e..bb19dbd5a 100644
---- a/include/grub/i386/linux.h
-+++ b/include/grub/i386/linux.h
-@@ -142,6 +142,7 @@ struct linux_i386_kernel_header
-   grub_uint64_t setup_data;
-   grub_uint64_t pref_address;
-   grub_uint32_t init_size;
-+  grub_uint32_t handover_offset;
- } GRUB_PACKED;
- 
- /* Boot parameters for Linux based on 2.6.12. This is used by the setup

SOURCES/0005-Rework-linux-command.patch

@@ -6,15 +6,17 @@ Subject: [PATCH] Rework linux command
 We want a single buffer that contains the entire kernel image in order to
 perform a TPM measurement. Allocate one and copy the entire kernel into it
 before pulling out the individual blocks later on.
+
+Signed-off-by: Matthew Garrett <mjg59@coreos.com>
 ---
- grub-core/loader/i386/linux.c | 37 ++++++++++++++++++++++++-------------
- 1 file changed, 24 insertions(+), 13 deletions(-)
+ grub-core/loader/i386/linux.c | 35 +++++++++++++++++++++++------------
+ 1 file changed, 23 insertions(+), 12 deletions(-)
 
 diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
-index 9b53d3168..f7186be40 100644
+index 9f74a96b19a..dccf3bb3005 100644
 --- a/grub-core/loader/i386/linux.c
 +++ b/grub-core/loader/i386/linux.c
-@@ -685,13 +685,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -649,13 +649,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  {
    grub_file_t file = 0;
    struct linux_i386_kernel_header lh;
@@ -31,7 +33,7 @@ index 9b53d3168..f7186be40 100644
  
    grub_dl_ref (my_mod);
  
-@@ -705,7 +707,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -669,7 +671,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    if (! file)
      goto fail;
  
@@ -48,7 +50,7 @@ index 9b53d3168..f7186be40 100644
      {
        if (!grub_errno)
  	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
-@@ -713,6 +723,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -677,6 +687,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
        goto fail;
      }
  
@@ -58,33 +60,25 @@ index 9b53d3168..f7186be40 100644
    if (lh.boot_flag != grub_cpu_to_le16_compile_time (0xaa55))
      {
        grub_error (GRUB_ERR_BAD_OS, "invalid magic number");
-@@ -804,6 +817,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
- 		      preferred_address))
-     goto fail;
+@@ -784,13 +797,11 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+   /* We've already read lh so there is no need to read it second time. */
+   len -= sizeof(lh);
  
-+
-   grub_memset (&linux_params, 0, sizeof (linux_params));
-   grub_memcpy (&linux_params.setup_sects, &lh.setup_sects, sizeof (lh) - 0x1F1);
- 
-@@ -812,13 +826,10 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
-   linux_params.ps_mouse = linux_params.padding10 =  0;
- 
-   len = sizeof (linux_params) - sizeof (lh);
--  if (grub_file_read (file, (char *) &linux_params + sizeof (lh), len) != len)
--    {
+-  if ((len > 0) &&
+-      (grub_file_read (file, (char *) &linux_params + sizeof (lh), len) != len))
++  linux_params_ptr = (void *)&linux_params;
++  if (len > 0)
+     {
 -      if (!grub_errno)
 -	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
 -		    argv[0]);
 -      goto fail;
--    }
-+
-+  linux_params_ptr = (void *)&linux_params;
-+  grub_memcpy (linux_params_ptr + sizeof (lh), kernel + kernel_offset, len);
-+  kernel_offset += len;
++      grub_memcpy (linux_params_ptr + sizeof (lh), kernel + kernel_offset, len);
++      kernel_offset += len;
+     }
  
-   linux_params.type_of_loader = GRUB_LINUX_BOOT_LOADER_TYPE;
- 
-@@ -877,7 +888,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+   linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR;
+@@ -853,7 +864,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
    /* The other parameters are filled when booting.  */
  
@@ -93,8 +87,8 @@ index 9b53d3168..f7186be40 100644
  
    grub_dprintf ("linux", "bzImage, setup=0x%x, size=0x%x\n",
  		(unsigned) real_size, (unsigned) prot_size);
-@@ -1025,9 +1036,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
- 			      - (sizeof (LINUX_IMAGE) - 1));
+@@ -1007,9 +1018,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+   }
  
    len = prot_file_size;
 -  if (grub_file_read (file, prot_mode_mem, len) != len && !grub_errno)
@@ -104,7 +98,7 @@ index 9b53d3168..f7186be40 100644
  
    if (grub_errno == GRUB_ERR_NONE)
      {
-@@ -1038,6 +1047,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -1020,6 +1029,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
   fail:
  

SOURCES/0006-Rework-linux16-command.patch

@@ -6,15 +6,17 @@ Subject: [PATCH] Rework linux16 command
 We want a single buffer that contains the entire kernel image in order to
 perform a TPM measurement. Allocate one and copy the entire kernel int it
 before pulling out the individual blocks later on.
+
+Signed-off-by: Matthew Garrett <mjg59@coreos.com>
 ---
- grub-core/loader/i386/pc/linux.c | 34 +++++++++++++++++++++-------------
- 1 file changed, 21 insertions(+), 13 deletions(-)
+ grub-core/loader/i386/pc/linux.c | 33 +++++++++++++++++++++------------
+ 1 file changed, 21 insertions(+), 12 deletions(-)
 
 diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
-index a3c87cf2f..caa76bee8 100644
+index 8be4c3b3f48..4b1750e360e 100644
 --- a/grub-core/loader/i386/pc/linux.c
 +++ b/grub-core/loader/i386/pc/linux.c
-@@ -123,13 +123,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -124,13 +124,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    grub_file_t file = 0;
    struct linux_i386_kernel_header lh;
    grub_uint8_t setup_sects;
@@ -30,7 +32,7 @@ index a3c87cf2f..caa76bee8 100644
  
    grub_dl_ref (my_mod);
  
-@@ -143,7 +144,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -144,7 +145,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    if (! file)
      goto fail;
  
@@ -47,7 +49,7 @@ index a3c87cf2f..caa76bee8 100644
      {
        if (!grub_errno)
  	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
-@@ -151,6 +160,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -152,6 +161,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
        goto fail;
      }
  
@@ -57,7 +59,7 @@ index a3c87cf2f..caa76bee8 100644
    if (lh.boot_flag != grub_cpu_to_le16_compile_time (0xaa55))
      {
        grub_error (GRUB_ERR_BAD_OS, "invalid magic number");
-@@ -314,13 +326,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -320,13 +332,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    grub_memmove (grub_linux_real_chunk, &lh, sizeof (lh));
  
    len = real_size + GRUB_DISK_SECTOR_SIZE - sizeof (lh);
@@ -74,12 +76,11 @@ index a3c87cf2f..caa76bee8 100644
  
    if (lh.header != grub_cpu_to_le32_compile_time (GRUB_LINUX_I386_MAGIC_SIGNATURE)
        || grub_le_to_cpu16 (lh.version) < 0x0200)
-@@ -355,10 +363,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -364,9 +372,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    }
  
    len = grub_linux16_prot_size;
--  if (grub_file_read (file, grub_linux_prot_chunk, grub_linux16_prot_size)
--      != (grub_ssize_t) grub_linux16_prot_size && !grub_errno)
+-  if (grub_file_read (file, grub_linux_prot_chunk, len) != len && !grub_errno)
 -    grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
 -		argv[0]);
 +  grub_memcpy (grub_linux_prot_chunk, kernel + kernel_offset, len);
@@ -87,7 +88,7 @@ index a3c87cf2f..caa76bee8 100644
  
    if (grub_errno == GRUB_ERR_NONE)
      {
-@@ -368,6 +374,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -376,6 +383,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
   fail:
  

SOURCES/0007-Add-secureboot-support-on-efi-chainloader.patch

@@ -1,6 +1,6 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Raymund Will <rw@suse.com>
-Date: Fri, 10 Apr 2015 01:45:02 -0400
+Date: Mon, 8 Jul 2019 11:55:18 +0200
 Subject: [PATCH] Add secureboot support on efi chainloader
 
 Expand the chainloader to be able to verify the image by means of shim
@@ -164,21 +164,36 @@ following branches:
 
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1347291
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+
+Also:
+
+commit cc06f149fbd2d8c1da1e83173d21629ba97e0d92
+Author: Raymund Will <rw@suse.com>
+
+chainloader: Define machine types for RISC-V
+
+The commit "Add secureboot support on efi chainloader" didn't add machine
+types for RISC-V, so this patch adds them.
+
+Note, that grub-core/loader/riscv/linux.c is skipped because Linux is not
+supported yet. This patch might need a new revision once that's the case.
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
 ---
  grub-core/kern/efi/efi.c           |  14 +-
  grub-core/loader/arm64/linux.c     |   4 +-
- grub-core/loader/efi/chainloader.c | 817 +++++++++++++++++++++++++++++++++----
+ grub-core/loader/efi/chainloader.c | 820 +++++++++++++++++++++++++++++++++----
  grub-core/loader/efi/linux.c       |  25 +-
  grub-core/loader/i386/efi/linux.c  |  17 +-
  include/grub/efi/linux.h           |   2 +-
  include/grub/efi/pe32.h            |  52 ++-
- 7 files changed, 840 insertions(+), 91 deletions(-)
+ 7 files changed, 844 insertions(+), 90 deletions(-)
 
 diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
-index c8a9d8307..91129e335 100644
+index 35b8f67060..4a2259aa1c 100644
 --- a/grub-core/kern/efi/efi.c
 +++ b/grub-core/kern/efi/efi.c
-@@ -283,14 +283,20 @@ grub_efi_secure_boot (void)
+@@ -296,14 +296,20 @@ grub_efi_secure_boot (void)
    grub_efi_boolean_t ret = 0;
  
    secure_boot = grub_efi_get_variable("SecureBoot", &efi_var_guid, &datasize);
@@ -204,18 +219,18 @@ index c8a9d8307..91129e335 100644
    if (*secure_boot && !*setup_mode)
      ret = 1;
 diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
-index 6c00af98d..a1ac7a388 100644
+index a312c66868..04994d5c67 100644
 --- a/grub-core/loader/arm64/linux.c
 +++ b/grub-core/loader/arm64/linux.c
-@@ -282,6 +282,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
-   grub_file_t file = 0;
-   struct linux_armxx_kernel_header lh;
+@@ -284,6 +284,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+   struct linux_arch_kernel_header lh;
    struct grub_armxx_linux_pe_header *pe;
+   grub_err_t err;
 +  int rc;
  
    grub_dl_ref (my_mod);
  
-@@ -326,7 +327,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -328,7 +329,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
    grub_dprintf ("linux", "kernel @ %p\n", kernel_addr);
  
@@ -226,7 +241,7 @@ index 6c00af98d..a1ac7a388 100644
        grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), argv[0]);
        goto fail;
 diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
-index adc856366..af2189619 100644
+index 2bd80f4db3..e6a8d4ad0e 100644
 --- a/grub-core/loader/efi/chainloader.c
 +++ b/grub-core/loader/efi/chainloader.c
 @@ -32,6 +32,8 @@
@@ -261,15 +276,7 @@ index adc856366..af2189619 100644
  
    grub_dl_unref (my_mod);
    return GRUB_ERR_NONE;
-@@ -173,7 +181,6 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
-   /* Fill the file path for the directory.  */
-   d = (grub_efi_device_path_t *) ((char *) file_path
- 				  + ((char *) d - (char *) dp));
--  grub_efi_print_device_path (d);
-   copy_file_path ((grub_efi_file_path_device_path_t *) d,
- 		  dir_start, dir_end - dir_start);
- 
-@@ -191,20 +198,690 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
+@@ -213,20 +221,694 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
    return file_path;
  }
  
@@ -384,6 +391,10 @@ index adc856366..af2189619 100644
 +  GRUB_PE32_MACHINE_I386;
 +#elif defined(__ia64__)
 +  GRUB_PE32_MACHINE_IA64;
++#elif defined(__riscv) && (__riscv_xlen == 32)
++  GRUB_PE32_MACHINE_RISCV32;
++#elif defined(__riscv) && (__riscv_xlen == 64)
++  GRUB_PE32_MACHINE_RISCV64;
 +#else
 +#error this architecture is not supported by grub2
 +#endif
@@ -963,7 +974,7 @@ index adc856366..af2189619 100644
  
    if (argc == 0)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
-@@ -216,15 +893,45 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -238,15 +920,45 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
    address = 0;
    image_handle = 0;
    file_path = 0;
@@ -997,7 +1008,7 @@ index adc856366..af2189619 100644
 +      *(--p16) = 0;
 +    }
 +
-   file = grub_file_open (filename);
+   file = grub_file_open (filename, GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE);
    if (! file)
      goto fail;
  
@@ -1011,7 +1022,7 @@ index adc856366..af2189619 100644
    if (! dev)
      goto fail;
  
-@@ -261,17 +968,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -283,17 +995,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
    if (! file_path)
      goto fail;
  
@@ -1032,7 +1043,7 @@ index adc856366..af2189619 100644
  
    status = efi_call_4 (b->allocate_pages, GRUB_EFI_ALLOCATE_ANY_PAGES,
  			      GRUB_EFI_LOADER_CODE,
-@@ -285,7 +989,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -307,7 +1016,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
      }
  
    boot_image = (void *) ((grub_addr_t) address);
@@ -1041,7 +1052,7 @@ index adc856366..af2189619 100644
      {
        if (grub_errno == GRUB_ERR_NONE)
  	grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
-@@ -295,7 +999,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -317,7 +1026,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
      }
  
  #if defined (__i386__) || defined (__x86_64__)
@@ -1050,12 +1061,12 @@ index adc856366..af2189619 100644
      {
        struct grub_macho_fat_header *head = boot_image;
        if (head->magic
-@@ -304,6 +1008,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -326,6 +1035,14 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
  	  grub_uint32_t i;
  	  struct grub_macho_fat_arch *archs
  	    = (struct grub_macho_fat_arch *) (head + 1);
 +
-+	  if (grub_efi_secure_boot())
++	  if (grub_efi_get_secureboot () == GRUB_EFI_SECUREBOOT_MODE_ENABLED)
 +	    {
 +	      grub_error (GRUB_ERR_BAD_OS,
 +			  "MACHO binaries are forbidden with Secure Boot");
@@ -1065,7 +1076,7 @@ index adc856366..af2189619 100644
  	  for (i = 0; i < grub_cpu_to_le32 (head->nfat_arch); i++)
  	    {
  	      if (GRUB_MACHO_CPUTYPE_IS_HOST_CURRENT (archs[i].cputype))
-@@ -318,79 +1030,39 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -340,79 +1057,39 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
  	      > ~grub_cpu_to_le32 (archs[i].size)
  	      || grub_cpu_to_le32 (archs[i].offset)
  	      + grub_cpu_to_le32 (archs[i].size)
@@ -1162,7 +1173,7 @@ index adc856366..af2189619 100644
    if (dev)
      grub_device_close (dev);
  
-@@ -402,6 +1074,9 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
+@@ -424,6 +1101,9 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)),
    if (address)
      efi_call_2 (b->free_pages, address, pages);
  
@@ -1173,7 +1184,7 @@ index adc856366..af2189619 100644
  
    return grub_errno;
 diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c
-index c24202a5d..c8ecce6df 100644
+index c24202a5dd..c8ecce6dfd 100644
 --- a/grub-core/loader/efi/linux.c
 +++ b/grub-core/loader/efi/linux.c
 @@ -33,21 +33,34 @@ struct grub_efi_shim_lock
@@ -1218,10 +1229,10 @@ index c24202a5d..c8ecce6df 100644
  
  #pragma GCC diagnostic push
 diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
-index 3db82e782..8db228c5b 100644
+index bb2616a809..6b24cbb948 100644
 --- a/grub-core/loader/i386/efi/linux.c
 +++ b/grub-core/loader/i386/efi/linux.c
-@@ -118,6 +118,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
+@@ -117,6 +117,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
        goto fail;
      }
  
@@ -1230,15 +1241,15 @@ index 3db82e782..8db228c5b 100644
    params->ramdisk_size = size;
    params->ramdisk_image = (grub_uint32_t)(grub_addr_t) initrd_mem;
  
-@@ -160,6 +162,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
-   struct linux_kernel_header lh;
+@@ -159,6 +161,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+   struct linux_i386_kernel_header lh;
    grub_ssize_t len, start, filelen;
    void *kernel = NULL;
 +  int rc;
  
    grub_dl_ref (my_mod);
  
-@@ -185,11 +188,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -184,11 +187,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  
    if (grub_file_read (file, kernel, filelen) != filelen)
      {
@@ -1254,7 +1265,7 @@ index 3db82e782..8db228c5b 100644
      {
        grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"),
  		  argv[0]);
-@@ -204,6 +209,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -203,6 +208,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
        goto fail;
      }
  
@@ -1263,7 +1274,7 @@ index 3db82e782..8db228c5b 100644
    grub_memset (params, 0, 16384);
  
    grub_memcpy (&lh, kernel, sizeof (lh));
-@@ -242,6 +249,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+@@ -241,6 +248,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
        goto fail;
      }
  
@@ -1286,7 +1297,7 @@ index 3db82e782..8db228c5b 100644
      grub_file_close (file);
  
 diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h
-index d9ede3677..0033d9305 100644
+index d9ede36773..0033d9305a 100644
 --- a/include/grub/efi/linux.h
 +++ b/include/grub/efi/linux.h
 @@ -22,7 +22,7 @@
@@ -1299,10 +1310,10 @@ index d9ede3677..0033d9305 100644
  grub_err_t
  EXPORT_FUNC(grub_efi_linux_boot) (void *kernel_address, grub_off_t offset,
 diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h
-index 7d44732d2..c03cc599f 100644
+index 0ed8781f03..a43adf2746 100644
 --- a/include/grub/efi/pe32.h
 +++ b/include/grub/efi/pe32.h
-@@ -214,7 +214,11 @@ struct grub_pe64_optional_header
+@@ -223,7 +223,11 @@ struct grub_pe64_optional_header
  struct grub_pe32_section_table
  {
    char name[8];
@@ -1315,7 +1326,7 @@ index 7d44732d2..c03cc599f 100644
    grub_uint32_t virtual_address;
    grub_uint32_t raw_data_size;
    grub_uint32_t raw_data_offset;
-@@ -225,12 +229,18 @@ struct grub_pe32_section_table
+@@ -234,12 +238,18 @@ struct grub_pe32_section_table
    grub_uint32_t characteristics;
  };
  
@@ -1338,7 +1349,7 @@ index 7d44732d2..c03cc599f 100644
  
  #define GRUB_PE32_SCN_ALIGN_1BYTES		0x00100000
  #define GRUB_PE32_SCN_ALIGN_2BYTES		0x00200000
-@@ -239,10 +249,28 @@ struct grub_pe32_section_table
+@@ -248,10 +258,28 @@ struct grub_pe32_section_table
  #define GRUB_PE32_SCN_ALIGN_16BYTES		0x00500000
  #define GRUB_PE32_SCN_ALIGN_32BYTES		0x00600000
  #define GRUB_PE32_SCN_ALIGN_64BYTES		0x00700000
@@ -1367,7 +1378,7 @@ index 7d44732d2..c03cc599f 100644
  #define GRUB_PE32_SIGNATURE_SIZE 4
  
  struct grub_pe32_header
-@@ -265,6 +293,20 @@ struct grub_pe32_header
+@@ -274,6 +302,20 @@ struct grub_pe32_header
  #endif
  };
  

SOURCES/0007-re-write-.gitignore.patch

@@ -1,502 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Tue, 8 Aug 2017 12:48:04 -0400
-Subject: [PATCH] re-write .gitignore
-
----
- .gitignore                        | 357 +++++++++++++-------------------------
- build-aux/.gitignore              |   9 +
- docs/.gitignore                   |   4 +
- grub-core/.gitignore              |  15 ++
- grub-core/gnulib/.gitignore       |  22 +++
- grub-core/lib/.gitignore          |   1 +
- include/grub/gcrypt/.gitignore    |   2 +
- po/.gitignore                     |   4 +
- util/bash-completion.d/.gitignore |   1 +
- 9 files changed, 175 insertions(+), 240 deletions(-)
- create mode 100644 build-aux/.gitignore
- create mode 100644 docs/.gitignore
- create mode 100644 grub-core/.gitignore
- create mode 100644 grub-core/gnulib/.gitignore
- create mode 100644 grub-core/lib/.gitignore
- create mode 100644 include/grub/gcrypt/.gitignore
- create mode 100644 po/.gitignore
- create mode 100644 util/bash-completion.d/.gitignore
-
-diff --git a/.gitignore b/.gitignore
-index eca17bec9..43f04d472 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -1,249 +1,126 @@
--00_header
--10_*
--20_linux_xen
--30_os-prober
--40_custom
--41_custom
--*.1
--*.8
--aclocal.m4
--ahci_test
--ascii.bitmaps
--ascii.h
--autom4te.cache
--build-grub-gen-asciih
--build-grub-gen-widthspec
--build-grub-mkfont
--cdboot_test
--cmp_test
--config.cache
--config.guess
--config.h
--config-util.h
--config-util.h.in
--config.log
--config.status
--config.sub
--configure
--core_compress_test
--DISTLIST
--docs/*.info
--docs/stamp-vti
--docs/version.texi
--ehci_test
--example_grub_script_test
--example_scripted_test
--example_unit_test
-+# things ./autogen.sh will create
-+/Makefile.utilgcry.def
-+/aclocal.m4
-+/autom4te.cache
-+/configure
-+Makefile
-+# we want to enable building in a subdirectory, but we don't want to exclude
-+# /build-aux so explicitly don't ignore it.
-+/build*/
-+!/build-aux/
-+
-+# things very common editors create that we never want
-+*~
-+.*.sw?
-+*.patch
-+
-+# built objects across the whole tree
-+Makefile.in
-+*.a
-+*.am
- *.exec
--*.exec.exe
--fddboot_test
--genkernsyms.sh
--gensymlist.sh
--gentrigtables
--gentrigtables.exe
--gettext_strings_test
--grub-bin2h
--/grub-bios-setup
--/grub-bios-setup.exe
--grub_cmd_date
--grub_cmd_echo
--grub_cmd_regexp
--grub_cmd_set_date
--grub_cmd_sleep
--/grub-editenv
--/grub-editenv.exe
--grub-emu
--grub-emu-lite
--grub-emu.exe
--grub-emu-lite.exe
--grub_emu_init.c
--grub_emu_init.h
--/grub-file
--/grub-file.exe
--grub-fstest
--grub-fstest.exe
--grub_fstest_init.c
--grub_fstest_init.h
--grub_func_test
--grub-install
--grub-install.exe
--grub-kbdcomp
--/grub-macbless
--/grub-macbless.exe
--grub-macho2img
--/grub-menulst2cfg
--/grub-menulst2cfg.exe
--/grub-mk*
--grub-mount
--/grub-ofpathname
--/grub-ofpathname.exe
--grub-core/build-grub-pe2elf.exe
--/grub-probe
--/grub-probe.exe
--grub_probe_init.c
--grub_probe_init.h
--/grub-reboot
--grub_script_blanklines
--grub_script_blockarg
--grub_script_break
--grub-script-check
--grub-script-check.exe
--grub_script_check_init.c
--grub_script_check_init.h
--grub_script_comments
--grub_script_continue
--grub_script_dollar
--grub_script_echo1
--grub_script_echo_keywords
--grub_script_escape_comma
--grub_script_eval
--grub_script_expansion
--grub_script_final_semicolon
--grub_script_for1
--grub_script_functions
--grub_script_gettext
--grub_script_if
--grub_script_leading_whitespace
--grub_script_no_commands
--grub_script_not
--grub_script_return
--grub_script_setparams
--grub_script_shift
--grub_script_strcmp
--grub_script_test
--grub_script_vars1
--grub_script_while1
--grub_script.tab.c
--grub_script.tab.h
--grub_script.yy.c
--grub_script.yy.h
--grub-set-default
--grub_setup_init.c
--grub_setup_init.h
--grub-shell
--grub-shell-tester
--grub-sparc64-setup
--grub-sparc64-setup.exe
--/grub-syslinux2cfg
--/grub-syslinux2cfg.exe
--gzcompress_test
--hddboot_test
--help_test
--*.img
- *.image
--*.image.exe
--include/grub/cpu
--include/grub/machine
--install-sh
--lib/libgcrypt-grub
--libgrub_a_init.c
--*.log
-+*.img
-+*.info
- *.lst
--lzocompress_test
- *.marker
--Makefile
- *.mod
--mod-*.c
--missing
--netboot_test
-+*.module
- *.o
--*.a
--ohci_test
--partmap_test
--pata_test
- *.pf2
--*.pp
--po/*.mo
--po/grub.pot
--po/POTFILES
--po/stamp-po
--printf_test
--priority_queue_unit_test
--pseries_test
--stamp-h
--stamp-h1
--stamp-h.in
--symlist.c
--symlist.h
--trigtables.c
--*.trs
--uhci_test
--update-grub_lib
--unidata.c
--xzcompress_test
--Makefile.in
--GPATH
--GRTAGS
--GSYMS
--GTAGS
--compile
--depcomp
--mdate-sh
--texinfo.tex
--grub-core/lib/libgcrypt-grub
--.deps
--.deps-util
--.deps-core
-+*.yy.[ch]
-+.deps/
-+.deps-core/
-+.deps-util/
- .dirstamp
--Makefile.util.am
--contrib
--grub-core/bootinfo.txt
--grub-core/Makefile.core.am
--grub-core/Makefile.gcry.def
--grub-core/contrib
--grub-core/gdb_grub
--grub-core/genmod.sh
--grub-core/gensyminfo.sh
--grub-core/gmodule.pl
--grub-core/grub.chrp
--grub-core/modinfo.sh
--grub-core/*.module
--grub-core/*.module.exe
--grub-core/*.pp
--grub-core/kernel.img.bin
--util/bash-completion.d/grub
--grub-core/gnulib/alloca.h
--grub-core/gnulib/arg-nonnull.h
--grub-core/gnulib/c++defs.h
--grub-core/gnulib/charset.alias
--grub-core/gnulib/configmake.h
--grub-core/gnulib/float.h
--grub-core/gnulib/getopt.h
--grub-core/gnulib/langinfo.h
--grub-core/gnulib/ref-add.sed
--grub-core/gnulib/ref-del.sed
--grub-core/gnulib/stdio.h
--grub-core/gnulib/stdlib.h
--grub-core/gnulib/string.h
--grub-core/gnulib/strings.h
--grub-core/gnulib/sys
--grub-core/gnulib/unistd.h
--grub-core/gnulib/warn-on-use.h
--grub-core/gnulib/wchar.h
--grub-core/gnulib/wctype.h
--grub-core/rs_decoder.h
--widthspec.bin
--widthspec.h
--docs/stamp-1
--docs/version-dev.texi
--Makefile.utilgcry.def
--po/*.po
--po/*.gmo
--po/LINGUAS
--po/remove-potcdate.sed
--include/grub/gcrypt/gcrypt.h
--include/grub/gcrypt/g10lib.h
--po/POTFILES.in
--po/POTFILES-shell.in
--/grub-glue-efi
--/grub-render-label
--/grub-glue-efi.exe
--/grub-render-label.exe
--grub-core/gnulib/locale.h
--grub-core/gnulib/unitypes.h
--grub-core/gnulib/uniwidth.h
--build-aux/test-driver
-+
-+# next are things you get if you do ./configure in the topdir (for e.g.
-+# "make dist" invocation.
-+/config-util.h
-+/config.h
-+/include/grub/cpu
-+/include/grub/machine
-+/po/POTFILES
-+/stamp-h
-+/stamp-h1
-+config.log
-+config.status
-+
-+# stuff "make dist" creates
-+ChangeLog
-+grub-*.tar
-+grub-*.tar.*
-+
-+# stuff "make" creates
-+/[[:digit:]][[:digit:]]_?*
-+/ascii.h
-+/build-grub-gen-asciih
-+/build-grub-gen-widthspec
-+/build-grub-mkfont
-+/config-util.h.in
- /garbage-gen
--/garbage-gen.exe
--/grub-fs-tester
--grub-core/build-grub-module-verifier
-+/grub*-bios-setup
-+/grub*-bios-setup.8
-+/grub*-editenv
-+/grub*-editenv.1
-+/grub*-file
-+/grub*-file.1
-+/grub*-fs-tester
-+/grub*-fstest
-+/grub*-fstest.1
-+/grub*-glue-efi
-+/grub*-glue-efi.1
-+/grub*-install
-+/grub*-install.8
-+/grub*-kbdcomp
-+/grub*-kbdcomp.1
-+/grub*-macbless
-+/grub*-macbless.8
-+/grub*-menulst2cfg
-+/grub*-menulst2cfg.1
-+/grub*-mkconfig
-+/grub*-mkconfig.8
-+/grub*-mkconfig_lib
-+/grub*-mkfont
-+/grub*-mkfont.1
-+/grub*-mkimage
-+/grub*-mkimage.1
-+/grub*-mklayout
-+/grub*-mklayout.1
-+/grub*-mknetdir
-+/grub*-mknetdir.1
-+/grub*-mkpasswd-pbkdf2
-+/grub*-mkpasswd-pbkdf2.1
-+/grub*-mkrelpath
-+/grub*-mkrelpath.1
-+/grub*-mkrescue
-+/grub*-mkrescue.1
-+/grub*-mkstandalone
-+/grub*-mkstandalone.1
-+/grub*-ofpathname
-+/grub*-ofpathname.8
-+/grub*-probe
-+/grub*-probe.8
-+/grub*-reboot
-+/grub*-reboot.8
-+/grub*-render-label
-+/grub*-render-label.1
-+/grub*-script-check
-+/grub*-script-check.1
-+/grub*-set-default
-+/grub*-set-default.8
-+/grub*-shell
-+/grub*-shell-tester
-+/grub*-sparc64-setup
-+/grub*-sparc64-setup.8
-+/grub*-syslinux2cfg
-+/grub*-syslinux2cfg.1
-+/grub_fstest.pp
-+/grub_fstest_init.c
-+/grub_fstest_init.lst
-+/grub_script.tab.[ch]
-+/libgrub.pp
-+/libgrub_a_init.c
-+/libgrub_a_init.lst
-+/stamp-h.in
-+/widthspec.h
-diff --git a/build-aux/.gitignore b/build-aux/.gitignore
-new file mode 100644
-index 000000000..f2f17aab9
---- /dev/null
-+++ b/build-aux/.gitignore