Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grub2 for openSUSE:Factory checked in at 2026-10-22 19:25:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grub2 (Old) and /work/SRC/openSUSE:Factory/.grub2.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grub2" Thu Oct 22 19:25:18 2026 rev:402 rq:1387006 version:2.16 Changes: -------- --- /work/SRC/openSUSE:Factory/grub2/grub2.changes 2026-10-14 18:34:07.400341144 +0200 +++ /work/SRC/openSUSE:Factory/.grub2.new.2252680/grub2.changes 2026-10-22 19:25:20.058868043 +0200 @@ -1,0 +2,22 @@ +Tue Oct 20 03:29:30 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Reduce the size and number of TPM 8 PCR events (bsc#1278206) + * 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch + * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch + * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch + * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch + * 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch +- Fix overflow in grub-mkpasswd-argon2 (bsc#1284464) + * 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch +- Fix overflow in MFA key protector (bsc#1284464) + * 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch + * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch + * 0003-mfa-wipe-key-buffer-on-file-read-error.patch + * 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch +- Rebase patches + * grub-install-force-journal-draining-to-ensure-data-i.patch + * grub2-btrfs-05-grub2-mkconfig.patch + * grub2-efi-xen-cmdline.patch + * grub2-suse-remove-linux-root-param.patch + +------------------------------------------------------------------- New: ---- 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch 0003-mfa-wipe-key-buffer-on-file-read-error.patch 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch ----------(New B)---------- New: * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch New:- Fix overflow in grub-mkpasswd-argon2 (bsc#1284464) * 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch - Fix overflow in MFA key protector (bsc#1284464) New:- Fix overflow in MFA key protector (bsc#1284464) * 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch New:- Reduce the size and number of TPM 8 PCR events (bsc#1278206) * 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch New: * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch * 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch New: * 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch * 0003-mfa-wipe-key-buffer-on-file-read-error.patch New: * 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch * 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch * 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch New: * 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch * 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch - Fix overflow in grub-mkpasswd-argon2 (bsc#1284464) New: * 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch * 0003-mfa-wipe-key-buffer-on-file-read-error.patch * 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch New: * 0003-mfa-wipe-key-buffer-on-file-read-error.patch * 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch - Rebase patches ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grub2.spec ++++++ --- /var/tmp/diff_new_pack.zRplYD/_old 2026-10-22 19:25:23.333006255 +0200 +++ /var/tmp/diff_new_pack.zRplYD/_new 2026-10-22 19:25:23.337006424 +0200 @@ -206,6 +206,17 @@ Patch: 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch Patch: 0001-ieee1275-ofdisk-fix-NULL-deref-and-use-after-free-in.patch Patch: 0002-ieee1275-ofdisk-enumerate-all-PCIe-NVMe-namespaces.patch +Patch: 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch +Patch: 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch +Patch: 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch +Patch: 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch +Patch: 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch +Patch: 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch +Patch: 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch +Patch: 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch +Patch: 0003-mfa-wipe-key-buffer-on-file-read-error.patch +Patch: 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch +# Downstream patches below Patch: rename-grub-info-file-to-grub2.patch Patch: grub2-linux.patch Patch: use-grub2-as-a-package-name.patch ++++++ 0001-grub-mkconfig-Track-and-deduplicate-emitted-modules.patch ++++++ >From 13fd119b11f3bef3183b3f2354fe692c3430014d Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 2 Oct 2026 14:35:16 +0800 Subject: [PATCH 1/3] grub-mkconfig: Track and deduplicate emitted modules Currently, prepare_grub_to_access_device() scatters redundant "insmod" commands across sections and entries, and emits "insmod gcry_rijndael" twice under LUKS2 with AES-XTS. These duplicates bloat grub.cfg and waste TPM PCR 8 event log space. Deduplicate modules within probed blocks, and track modules loaded unconditionally at the top level of grub.cfg via a temporary state file (${grub_cfg}.modules) so later sections can omit them. Conditional and menu entry insertions are not recorded to avoid dropping drivers needed by other entries. Add grub_toplevel_insmod(), grub_module_is_loaded(), and "--toplevel" for prepare_grub_to_access_device(). Add GRUB_DISABLE_MODULE_DEDUPLICATION to restore the previous behavior. Assisted-by: Claude:Opus-5.5 Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/297> --- docs/grub.texi | 9 +++++ util/grub-mkconfig.in | 36 ++++++++++++++++++- util/grub-mkconfig_lib.in | 76 ++++++++++++++++++++++++++++++++++++--- 3 files changed, 116 insertions(+), 5 deletions(-) diff --git a/docs/grub.texi b/docs/grub.texi index 734a9c6e2..76c2aaacc 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -1511,6 +1511,15 @@ enable the use of partition UUIDs, set this option to @samp{false}. If this option is set to @samp{true}, disable the generation of recovery mode menu entries. +@item GRUB_DISABLE_MODULE_DEDUPLICATION +Normally, @command{grub-mkconfig} tracks modules loaded unconditionally at +the top level of the generated configuration (outside of any menu entry, +submenu or conditional block), and omits redundant @samp{insmod} commands for +them in later sections, such as menu entries. Modules loaded inside a menu +entry are never considered loaded for other entries. If you need each menu +entry to emit the full set of module insertion commands regardless of prior +loading, set this option to @samp{true}. + @item GRUB_DISABLE_UUID Normally, @command{grub-mkconfig} will generate menu entries that use universally-unique identifiers (UUIDs) to identify various filesystems to diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in index 749b0bd85..06eb66ad2 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in @@ -278,7 +278,8 @@ export GRUB_DEFAULT \ GRUB_SIMPLE_ACCESS_LEVEL \ GRUB_ADVANCED_ACCESS_LEVEL \ GRUB_RECOVERY_ACCESS_LEVEL \ - GRUB_BOOTNEXT_OMIT_INACTIVE + GRUB_BOOTNEXT_OMIT_INACTIVE \ + GRUB_DISABLE_MODULE_DEDUPLICATION if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" @@ -298,6 +299,34 @@ cat << EOF # EOF +# Track modules loaded unconditionally at the top level of grub.cfg +# in a state file so that following scripts can omit them. +if [ "x${GRUB_DISABLE_MODULE_DEDUPLICATION}" != "xtrue" ]; then + if test "x${grub_cfg}" != "x"; then + GRUB_MODULE_STATE_FILE="${grub_cfg}.modules" + rm -f "${GRUB_MODULE_STATE_FILE}" + elif GRUB_MODULE_STATE_FILE="`mktemp "${TMPDIR:-/tmp}/grub-mkconfig-modules.XXXXXXXXXX" 2>/dev/null`"; then + : + else + # Never fall back to a predictable name in a world-writable directory. + # Without a state file, modules are not deduplicated across scripts. + unset GRUB_MODULE_STATE_FILE + fi + if [ -n "${GRUB_MODULE_STATE_FILE}" ]; then + export GRUB_MODULE_STATE_FILE + oldumask=$(umask); umask 077 + > "${GRUB_MODULE_STATE_FILE}" + umask $oldumask + trap 'test -n "${GRUB_MODULE_STATE_FILE}" && rm -f "${GRUB_MODULE_STATE_FILE}"' EXIT + # Some shells (e.g. dash) skip the EXIT trap when killed by a signal. + # Exit explicitly instead, so the EXIT trap runs and the script stops. + trap 'exit 129' HUP + trap 'exit 130' INT + trap 'exit 131' QUIT + trap 'exit 143' TERM + fi +fi + for i in "${grub_mkconfig_dir}"/* ; do case "$i" in @@ -316,6 +345,11 @@ for i in "${grub_mkconfig_dir}"/* ; do esac done +if [ -n "${GRUB_MODULE_STATE_FILE}" ]; then + rm -f "${GRUB_MODULE_STATE_FILE}" + unset GRUB_MODULE_STATE_FILE +fi + if test "x${grub_cfg}" != "x" ; then if ! ${grub_script_check} ${grub_cfg}.new; then # TRANSLATORS: %s is replaced by filename diff --git a/util/grub-mkconfig_lib.in b/util/grub-mkconfig_lib.in index 9e1aaf9cb..307094c98 100644 --- a/util/grub-mkconfig_lib.in +++ b/util/grub-mkconfig_lib.in @@ -118,31 +118,99 @@ EOF fi } +# Append module $1 to $access_modules unless already listed. Entries are +# separated by $IFS, which the caller must set to a newline. +grub_add_module () +{ + case "${IFS}${access_modules}${IFS}" in + *"${IFS}${1}${IFS}"*) ;; + *) access_modules="${access_modules}${1}${IFS}" ;; + esac +} + +# Succeed if module $1 was already loaded unconditionally at the top level +# of grub.cfg, i.e. before any menu entry can be executed. +grub_module_is_loaded () +{ + if [ "x${GRUB_DISABLE_MODULE_DEDUPLICATION}" = "xtrue" ]; then + return 1 + fi + if [ -n "${GRUB_MODULE_STATE_FILE}" ] && [ -f "${GRUB_MODULE_STATE_FILE}" ]; then + _loaded="`cat "${GRUB_MODULE_STATE_FILE}" 2>/dev/null`" || _loaded= + else + _loaded="${_grub_loaded_modules}" + fi + case " +${_loaded} +" in + *" +$1 +"*) return 0 ;; + esac + return 1 +} + +# Emit "insmod $1" unless already loaded, and record it as loaded. Only +# call this for output placed at the top level of grub.cfg, outside of any +# menuentry, submenu or conditional block. +grub_toplevel_insmod () +{ + if grub_module_is_loaded "$1"; then + return + fi + echo "insmod $1" + if [ "x${GRUB_DISABLE_MODULE_DEDUPLICATION}" != "xtrue" ]; then + if [ -n "${GRUB_MODULE_STATE_FILE}" ]; then + echo "$1" >> "${GRUB_MODULE_STATE_FILE}" + fi + _grub_loaded_modules="${_grub_loaded_modules}$1 +" + fi +} + +# Emit commands to access the device(s) given as arguments. Pass +# --toplevel first if the output is placed at the top level of grub.cfg +# (see grub_toplevel_insmod), so that later sections can skip the modules. prepare_grub_to_access_device () { + toplevel= + if [ "x$1" = "x--toplevel" ]; then + toplevel=y + shift + fi old_ifs="$IFS" IFS=' ' partmap="`"${grub_probe}" --device $@ --target=partmap`" + access_modules= for module in ${partmap} ; do case "${module}" in netbsd | openbsd) - echo "insmod part_bsd";; + grub_add_module "part_bsd";; *) - echo "insmod part_${module}";; + grub_add_module "part_${module}";; esac done # Abstraction modules aren't auto-loaded. abstraction="`"${grub_probe}" --device $@ --target=abstraction`" for module in ${abstraction} ; do - echo "insmod ${module}" + grub_add_module "${module}" done fs="`"${grub_probe}" --device $@ --target=fs`" for module in ${fs} ; do - echo "insmod ${module}" + grub_add_module "${module}" + done + + for module in ${access_modules} ; do + if [ -n "${toplevel}" ]; then + grub_toplevel_insmod "${module}" + elif ! grub_module_is_loaded "${module}"; then + echo "insmod ${module}" + fi done + unset access_modules toplevel if [ x$GRUB_ENABLE_CRYPTODISK = xy ]; then for uuid in `"${grub_probe}" --device $@ --target=cryptodisk_uuid`; do -- 2.51.0 ++++++ 0001-grub-mkpasswd-argon2-validate-argument-ranges-to-avo.patch ++++++ >From 88ed5b3b4cf3a7cf27def47b050f5fba70bbf787 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Mon, 12 Oct 2026 09:29:03 +0000 Subject: [PATCH] grub-mkpasswd-argon2: validate argument ranges to avoid overflows In grub-mkpasswd-argon2, buflen and saltlen were not validated against upper bounds, allowing large values to overflow the size calculation for the allocated result buffer and cause a heap buffer overflow. Additionally, zero values for iterations, memory, parallelism, buflen, and saltlen were not rejected. Validate that iterations, memory, and parallelism are non-zero, enforce RFC 9106 lower bounds (buflen >= 4, saltlen >= 8), and cap buflen and saltlen to GRUB_AUTH_MAX_PASSLEN. Also free result before exiting main. Fixes: a2b9258d57e6 ("util: Introduce grub-mkpasswd-argon2") Assisted-by: Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/305> --- util/grub-mkpasswd-argon2.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/util/grub-mkpasswd-argon2.c b/util/grub-mkpasswd-argon2.c index cdb608d94..2d100a098 100644 --- a/util/grub-mkpasswd-argon2.c +++ b/util/grub-mkpasswd-argon2.c @@ -148,6 +148,21 @@ main (int argc, char *argv[]) exit(1); } + if (arguments.iterations == 0) + grub_util_error ("%s", _("iterations must be greater than 0")); + + if (arguments.memory == 0) + grub_util_error ("%s", _("memory must be greater than 0")); + + if (arguments.parallelism == 0) + grub_util_error ("%s", _("parallelism must be greater than 0")); + + if (arguments.buflen < 4 || arguments.buflen > GRUB_AUTH_MAX_PASSLEN) + grub_util_error (_("hash length must be between 4 and %d"), GRUB_AUTH_MAX_PASSLEN); + + if (arguments.saltlen < 8 || arguments.saltlen > GRUB_AUTH_MAX_PASSLEN) + grub_util_error (_("salt length must be between 8 and %d"), GRUB_AUTH_MAX_PASSLEN); + printf ("%s", _("Enter password: ")); if (!grub_password_get (pass1, GRUB_AUTH_MAX_PASSLEN)) grub_util_error ("%s", _("failure to read password")); @@ -222,6 +237,7 @@ main (int argc, char *argv[]) *ptr = '\0'; printf (_("ARGON2 hash of your password is %s\n"), result); + free (result); memset (buf, 0, arguments.buflen); free (buf); memset (salt, 0, arguments.saltlen); -- 2.51.0 ++++++ 0001-mfa-fix-key-size-calculation-when-keyfile_size-is-0.patch ++++++ >From e296e5c5a0cae02f089120739e8d49a9270f1af5 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 13 Oct 2026 01:28:23 +0000 Subject: [PATCH 1/4] mfa: fix key size calculation when keyfile_size is 0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In file_recover_key(), when keyfile_size was not specified (0), *key_size was assigned file_size instead of (file_size - file_ctx.keyfile_offset). After grub_file_seek() advanced the file by keyfile_offset, grub_file_read() attempted to read *key_size bytes but only (file_size - keyfile_offset) bytes remained, causing key recovery to always fail with GRUB_ERR_FILE_READ_ERROR. Subtract keyfile_offset from file_size when keyfile_size is 0 so *key_size reflects the actual number of bytes to read. Fixes: 40a1f9e5b627 ("key_protector: Add MFA key protector") Assisted-by: Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/306> --- grub-core/commands/mfa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/commands/mfa.c b/grub-core/commands/mfa.c index 354b6aa94..96712a717 100644 --- a/grub-core/commands/mfa.c +++ b/grub-core/commands/mfa.c @@ -298,7 +298,7 @@ file_recover_key (grub_uint8_t **key, grub_size_t *key_size) *key_size = file_ctx.keyfile_size; } else - *key_size = file_size; + *key_size = file_size - file_ctx.keyfile_offset; if (grub_file_seek (file, (grub_off_t) file_ctx.keyfile_offset) == (grub_off_t) -1) { -- 2.51.0 ++++++ 0001-script-execute-Do-not-measure-.-block-bodies-into-PC.patch ++++++ >From 8f2f931336066816d9060c04a2bb8b0c84736357 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Wed, 23 Sep 2026 02:59:10 +0000 Subject: [PATCH 1/2] script/execute: Do not measure { ... } block bodies into PCR 8 grub_script_execute_cmdline() measures the entire command line, including any { ... } block body, into TPM PCR 8. For block commands like menuentry, this quickly exhausts the firmware TPM event log buffer (typically 64 KiB) and leads to OS-level event log parsing failures. Replace the block body with a "{...}" placeholder for commands flagged with GRUB_COMMAND_FLAG_BLOCKS (handling an optional "!" prefix). Dynamic commands (GRUB_COMMAND_FLAG_DYNCMD) are excluded because their stubs unconditionally carry GRUB_COMMAND_FLAG_BLOCKS, which would otherwise drop valid arguments and make PCR 8 depend on module load order. No measurement integrity is lost: the enclosing configuration file is measured into PCR 9, and the commands inside the block are measured individually when executed. Assisted-by: Claude:Opus-5 Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/268> --- grub-core/script/execute.c | 37 +++++++++++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c index 369d985ee..1123516ca 100644 --- a/grub-core/script/execute.c +++ b/grub-core/script/execute.c @@ -948,6 +948,27 @@ grub_script_execute_new_scope (const char *source, int argc, char **args) return ret; } +/* + * Placeholder logged in place of a { ... } block body to prevent overflowing + * the TPM event log. + * + * Dyncmd stubs are excluded because read_command_list() registers all + * unloaded module commands with GRUB_COMMAND_FLAG_BLOCKS unconditionally. + */ +#define GRUB_SCRIPT_BLOCK_PLACEHOLDER "{...}" + +/* Text to log for argument I of ARGV, eliding a { ... } block body. */ +static const char * +cmdline_logged_arg (const struct grub_script_argv *argv, unsigned int i, + bool is_block_cmd) +{ + if (is_block_cmd && argv->script != NULL && argv->argc > 1 && + i + 1 == argv->argc) + return GRUB_SCRIPT_BLOCK_PLACEHOLDER; + + return argv->args[i]; +} + /* Execute a single command line. */ grub_err_t grub_script_execute_cmdline (struct grub_script_cmd *cmd) @@ -959,18 +980,30 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd) char errnobuf[18]; char *cmdname, *cmdstring; int argc, offset = 0, cmdlen = 0; + bool is_block_cmd = false; unsigned int i; char **args; int invert; + const char *check_name; struct grub_script_argv argv = { 0, 0, 0 }; /* Lookup the command. */ if (grub_script_arglist_to_argv (cmdline->arglist, &argv) || ! argv.args || ! argv.args[0]) return grub_errno; + /* Only elide the block if the command actually accepts blocks. */ + check_name = argv.args[0]; + if (grub_strcmp (check_name, "!") == 0 && argv.argc > 1 && argv.args[1]) + check_name = argv.args[1]; + + grubcmd = grub_command_find (check_name); + if (grubcmd != NULL && (grubcmd->flags & GRUB_COMMAND_FLAG_BLOCKS) != 0 && + (grubcmd->flags & GRUB_COMMAND_FLAG_DYNCMD) == 0) + is_block_cmd = true; + for (i = 0; i < argv.argc; i++) { - cmdlen += grub_strlen (argv.args[i]) + 1; + cmdlen += grub_strlen (cmdline_logged_arg (&argv, i, is_block_cmd)) + 1; } cmdstring = grub_malloc (cmdlen); @@ -983,7 +1016,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd) for (i = 0; i < argv.argc; i++) { offset += grub_snprintf (cmdstring + offset, cmdlen - offset, "%s ", - argv.args[i]); + cmdline_logged_arg (&argv, i, is_block_cmd)); } cmdstring[cmdlen - 1] = '\0'; grub_verify_string (cmdstring, GRUB_VERIFY_COMMAND); -- 2.51.0 ++++++ 0002-00_header-Deduplicate-device-preparation-for-theme-f.patch ++++++ >From 556af1a64fc4ce429d406277a424d99de0dd8c55 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 2 Oct 2026 08:12:48 +0000 Subject: [PATCH 2/3] 00_header: Deduplicate device preparation for theme files Font and theme/background loading in 00_header independently prepare the same storage device, emitting duplicate cryptomount, root, and search commands at top level. Prepare the shared device once before loadfont with "--toplevel" to record its modules for later scripts, and omit redundant preparation in the theme and background sections. Assisted-by: Claude:Opus-5.5 Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/297> --- util/grub.d/00_header.in | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in index 742e2ea14..17d863e18 100644 --- a/util/grub.d/00_header.in +++ b/util/grub.d/00_header.in @@ -224,9 +224,30 @@ if [ "x$serial" = x1 ]; then fi if [ "x$gfxterm" = x1 ]; then + _header_theme_device= + if [ "x$GRUB_THEME" != x ] && [ -f "$GRUB_THEME" ] \ + && is_path_readable_by_grub "$GRUB_THEME"; then + _header_theme_device="`${grub_probe} --target=device "$GRUB_THEME"`" + elif [ "x$GRUB_BACKGROUND" != x ] && [ -f "$GRUB_BACKGROUND" ] \ + && is_path_readable_by_grub "$GRUB_BACKGROUND"; then + _header_theme_device="`${grub_probe} --target=device "$GRUB_BACKGROUND"`" + fi + _header_prepared_device= + + # Prepare access to the device list $1 (newline separated, as printed + # by grub-probe) unless it was the last one prepared. + header_prepare_device () + { + if [ "x${GRUB_DISABLE_MODULE_DEDUPLICATION}" = "xtrue" ] || \ + [ "x$_header_prepared_device" != "x$1" ]; then + prepare_grub_to_access_device --toplevel "$1" + _header_prepared_device="$1" + fi + } + if [ -n "$GRUB_FONT" ] ; then # Make the font accessible - prepare_grub_to_access_device `${grub_probe} --target=device "${GRUB_FONT}"` + header_prepare_device "`${grub_probe} --target=device "${GRUB_FONT}"`" cat << EOF if loadfont `make_system_path_relative_to_its_root "${GRUB_FONT}"` ; then EOF @@ -243,13 +264,21 @@ EOF done done if [ -n "${font_path}" ] ; then + _header_font_device="`${grub_probe} --target=device "${font_path}"`" + if [ "x${GRUB_DISABLE_MODULE_DEDUPLICATION}" != "xtrue" ] && \ + [ -n "$_header_theme_device" ] && \ + [ "x$_header_font_device" = "x$_header_theme_device" ]; then + header_prepare_device "$_header_theme_device" + fi cat << EOF if [ x\$feature_default_font_path = xy ] ; then font=unicode else EOF - # Make the font accessible - prepare_grub_to_access_device `${grub_probe} --target=device "${font_path}"` + # Make the font accessible + if [ -z "$_header_prepared_device" ]; then + prepare_grub_to_access_device "${_header_font_device}" + fi cat << EOF font="`make_system_path_relative_to_its_root "${font_path}"`" fi @@ -310,7 +339,7 @@ if [ "x$gfxterm" = x1 ]; then && is_path_readable_by_grub "$GRUB_THEME"; then gettext_printf "Found theme: %s\n" "$GRUB_THEME" >&2 - prepare_grub_to_access_device `${grub_probe} --target=device "$GRUB_THEME"` + header_prepare_device "`${grub_probe} --target=device "$GRUB_THEME"`" cat << EOF insmod gfxmenu EOF @@ -351,7 +380,7 @@ EOF *.jpg|*.jpeg) reader=jpeg ;; *) gettext "Unsupported image format" >&2; echo >&2; exit 1 ;; esac - prepare_grub_to_access_device `${grub_probe} --target=device "$GRUB_BACKGROUND"` + header_prepare_device "`${grub_probe} --target=device "$GRUB_BACKGROUND"`" cat << EOF insmod $reader background_image -m stretch "`make_system_path_relative_to_its_root "$GRUB_BACKGROUND"`" -- 2.51.0 ++++++ 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch ++++++ >From ff2d771276fae4fdb2ee67eecd9f65580d50609d Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 13 Oct 2026 01:52:19 +0000 Subject: [PATCH 2/4] mfa: reject keyfile offset at EOF to prevent empty key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In file_recover_key(), the check "file_ctx.keyfile_offset > file_size" allowed keyfile_offset to be equal to file_size. When keyfile_size was not specified (0), this resulted in *key_size = 0, causing file_recover_key() to succeed with an empty key and bypass the file key factor in MFA. Change the check to ">=" so that an offset at or beyond EOF is rejected. Fixes: 40a1f9e5b627 ("key_protector: Add MFA key protector") Assisted-by: Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/306> --- grub-core/commands/mfa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/commands/mfa.c b/grub-core/commands/mfa.c index 96712a717..53e706ac8 100644 --- a/grub-core/commands/mfa.c +++ b/grub-core/commands/mfa.c @@ -274,10 +274,10 @@ file_recover_key (grub_uint8_t **key, grub_size_t *key_size) goto error; } - if (file_ctx.keyfile_offset > file_size) + if (file_ctx.keyfile_offset >= file_size) { err = grub_error (GRUB_ERR_OUT_OF_RANGE, - N_("Keyfile offset, %llu, is greater than keyfile size, %llu"), + N_("Keyfile offset, %llu, is greater than or equal to file size, %llu"), file_ctx.keyfile_offset, (unsigned long long) file_size); goto error; } -- 2.51.0 ++++++ 0002-script-execute-Free-argv-on-error-paths-in-grub_scri.patch ++++++ >From d065efdd35c9a52f34b1a99c43d545ed8f35cc08 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Wed, 23 Sep 2026 15:24:54 +0800 Subject: [PATCH 2/2] script/execute: Free argv on error paths in grub_script_execute_cmdline() When grub_script_arglist_to_argv() populates argv, it must be freed before returning. Two error paths (allocation failure for cmdstring and assignment string duplication failure) returned early without freeing argv. Add grub_script_argv_free() to both error return paths to avoid memory leaks. Assisted-by: Claude:Opus-5 Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/268> --- grub-core/script/execute.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c index 1123516ca..1d05a67db 100644 --- a/grub-core/script/execute.c +++ b/grub-core/script/execute.c @@ -1009,6 +1009,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd) cmdstring = grub_malloc (cmdlen); if (!cmdstring) { + grub_script_argv_free (&argv); return grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate command buffer")); } @@ -1051,7 +1052,10 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd) /* As a last resort, try if it is an assignment. */ char *assign = grub_strdup (cmdname); if (assign == NULL) - return grub_errno; + { + grub_script_argv_free (&argv); + return grub_errno; + } char *eq = grub_strchr (assign, '='); -- 2.51.0 ++++++ 0003-31_efi_bootnext-Consolidate-EFI-platform-check.patch ++++++ >From ef7a67dff2154365978e1effa555c3bada64221c Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 2 Oct 2026 08:37:15 +0000 Subject: [PATCH 3/3] 31_efi_bootnext: Consolidate EFI platform check Currently, 31_efi_bootnext wraps each discovered BootNext menuentry individually inside an "if [ "$grub_platform" = "efi" ]; then ... fi" block. On systems with multiple UEFI boot entries (e.g. 7 entries in the reference configuration), this evaluates "[ efi = efi ]" repeatedly, adding unnecessary lines to grub.cfg and redundant PCR 8 events. Wrap all discovered BootNext entries inside a single top-level conditional block. Assisted-by: Claude:Opus-5.5 Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/297> --- util/grub.d/31_efi_bootnext.in | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/util/grub.d/31_efi_bootnext.in b/util/grub.d/31_efi_bootnext.in index 342508385..5b6250546 100644 --- a/util/grub.d/31_efi_bootnext.in +++ b/util/grub.d/31_efi_bootnext.in @@ -156,6 +156,7 @@ fi # rejection) do not update grubenv. Cf. 30_os-prober.in:204. SAVEDEFAULT="`save_default_entry`" +bootnext_entries="$( printf '%s\n' "${EFI_OUTPUT}" | \ sed -n "s/^Boot\([0-9A-Fa-f]\{4\}\)${ACTIVE_PAT} *\([^${TAB}]*\)${TAB}\{0,1\}\(.*\)/\1${TAB}\2${TAB}\3/p" | \ while IFS="${TAB}" read -r bootnum label devpath; do @@ -231,14 +232,21 @@ while IFS="${TAB}" read -r bootnum label devpath; do # Cf. 30_uefi-firmware.in:34 cat << EOF -if [ "\$grub_platform" = "efi" ]; then menuentry '$(gettext_printf "%s (EFI BootNext)" "${label}" | grub_quote)' $CLASS --class os \$menuentry_id_option 'efi-bootnext-${bootnum}' { if bootnext ${bootnum}; then ${SAVEDEFAULT} reboot fi } -fi EOF done +)" + +if [ -n "${bootnext_entries}" ]; then + cat << EOF +if [ "\$grub_platform" = "efi" ]; then +${bootnext_entries} +fi +EOF +fi -- 2.51.0 ++++++ 0003-mfa-wipe-key-buffer-on-file-read-error.patch ++++++ >From 5576e1eeff02158fe655fd9c918755eef8315ca8 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 13 Oct 2026 01:56:19 +0000 Subject: [PATCH 3/4] mfa: wipe key buffer on file read error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In file_recover_key(), if grub_file_read() fails or returns a short read, read_buffer is freed without zeroing it first. If a partial key was read before an error occurred, sensitive key material could remain in freed heap memory. Zero the buffer with grub_memset() before calling grub_free(), matching the behavior of password_recover_key() and mfa_recover_key(). Fixes: 40a1f9e5b627 ("key_protector: Add MFA key protector") Assisted-by: Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/306> --- grub-core/commands/mfa.c | 1 + 1 file changed, 1 insertion(+) diff --git a/grub-core/commands/mfa.c b/grub-core/commands/mfa.c index 53e706ac8..c8cdafaa9 100644 --- a/grub-core/commands/mfa.c +++ b/grub-core/commands/mfa.c @@ -316,6 +316,7 @@ file_recover_key (grub_uint8_t **key, grub_size_t *key_size) read_n = grub_file_read (file, read_buffer, *key_size); if (read_n != *key_size) { + grub_memset (read_buffer, 0, *key_size); grub_free (read_buffer); err = grub_error (GRUB_ERR_FILE_READ_ERROR, N_("could not retrieve file contents: %s"), filepath); goto error; -- 2.51.0 ++++++ 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch ++++++ >From 0056a23967996095bd6e2899859b92505095c554 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 13 Oct 2026 01:59:44 +0000 Subject: [PATCH 4/4] mfa: require both factors to provide non-empty keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In mfa_recover_key(), the check only validated that total_size was non-zero. If one factor returned a zero-length key while the other succeeded, mfa_recover_key() would concatenate them without warning, effectively downgrading multi-factor authentication to a single factor. Ensure that neither factor is permitted to have a size of zero (p1_size == 0 || p2_size == 0). Fixes: 40a1f9e5b627 ("key_protector: Add MFA key protector") Assisted-by: Gemini:gemini-3.8-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/306> --- grub-core/commands/mfa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/commands/mfa.c b/grub-core/commands/mfa.c index c8cdafaa9..568724e63 100644 --- a/grub-core/commands/mfa.c +++ b/grub-core/commands/mfa.c @@ -163,7 +163,7 @@ mfa_recover_key (grub_uint8_t **key, grub_size_t *key_size) goto error; total_size = p1_size + p2_size; - if (total_size < p1_size || total_size < p2_size || total_size == 0) + if (p1_size == 0 || p2_size == 0 || total_size < p1_size || total_size < p2_size) { err = grub_error (GRUB_ERR_BAD_NUMBER, N_("invalid MFA key size")); goto error; -- 2.51.0 ++++++ grub-install-force-journal-draining-to-ensure-data-i.patch ++++++ --- /var/tmp/diff_new_pack.zRplYD/_old 2026-10-22 19:25:24.713064512 +0200 +++ /var/tmp/diff_new_pack.zRplYD/_new 2026-10-22 19:25:24.724064977 +0200 @@ -46,9 +46,11 @@ create mode 100644 grub-core/osdep/journaled_fs.c create mode 100644 grub-core/osdep/linux/journaled_fs.c ---- a/Makefile.util.def -+++ b/Makefile.util.def -@@ -672,6 +672,9 @@ +Index: grub-2.16/Makefile.util.def +=================================================================== +--- grub-2.16.orig/Makefile.util.def ++++ grub-2.16/Makefile.util.def +@@ -728,6 +728,9 @@ program = { emu_condition = COND_s390x; common = grub-core/kern/emu/argp_common.c; common = grub-core/osdep/init.c; @@ -58,8 +60,10 @@ ldadd = '$(LIBLZMA)'; ldadd = libgrubmods.a; +Index: grub-2.16/grub-core/osdep/basic/journaled_fs.c +=================================================================== --- /dev/null -+++ b/grub-core/osdep/basic/journaled_fs.c ++++ grub-2.16/grub-core/osdep/basic/journaled_fs.c @@ -0,0 +1,26 @@ +/* + * GRUB -- GRand Unified Bootloader @@ -87,16 +91,20 @@ + return 1; +} + +Index: grub-2.16/grub-core/osdep/journaled_fs.c +=================================================================== --- /dev/null -+++ b/grub-core/osdep/journaled_fs.c ++++ grub-2.16/grub-core/osdep/journaled_fs.c @@ -0,0 +1,5 @@ +#ifdef __linux__ +#include "linux/journaled_fs.c" +#else +#include "basic/journaled_fs.c" +#endif +Index: grub-2.16/grub-core/osdep/linux/journaled_fs.c +=================================================================== --- /dev/null -+++ b/grub-core/osdep/linux/journaled_fs.c ++++ grub-2.16/grub-core/osdep/linux/journaled_fs.c @@ -0,0 +1,48 @@ +/* + * GRUB -- GRand Unified Bootloader @@ -146,17 +154,21 @@ + return ret; +} + ---- a/include/grub/util/install.h -+++ b/include/grub/util/install.h -@@ -301,4 +301,6 @@ +Index: grub-2.16/include/grub/util/install.h +=================================================================== +--- grub-2.16.orig/include/grub/util/install.h ++++ grub-2.16/include/grub/util/install.h +@@ -314,4 +314,6 @@ grub_set_install_backup_ponr (void) } #endif +int +grub_install_sync_fs_journal (const char *path); #endif ---- a/util/grub-install.c -+++ b/util/grub-install.c +Index: grub-2.16/util/grub-install.c +=================================================================== +--- grub-2.16.orig/util/grub-install.c ++++ grub-2.16/util/grub-install.c @@ -42,6 +42,7 @@ #include <grub/emu/config.h> #include <grub/util/ofpath.h> @@ -165,7 +177,7 @@ #include <string.h> -@@ -2074,6 +2075,24 @@ +@@ -2084,6 +2085,24 @@ main (int argc, char *argv[]) break; } @@ -190,11 +202,13 @@ /* * Either there are no platform specific code, or it didn't raise * ponr. Raise it here, because usually this is already past point ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -335,6 +335,15 @@ - esac - done +Index: grub-2.16/util/grub-mkconfig.in +=================================================================== +--- grub-2.16.orig/util/grub-mkconfig.in ++++ grub-2.16/util/grub-mkconfig.in +@@ -393,6 +393,15 @@ if [ -n "${GRUB_MODULE_STATE_FILE}" ]; t + unset GRUB_MODULE_STATE_FILE + fi +sync_fs_journal () { + if test "x$GRUB_DEVICE" = "x$GRUB_DEVICE_BOOT" && @@ -208,7 +222,7 @@ if test "x${grub_cfg}" != "x" ; then if ! ${grub_script_check} ${grub_cfg}.new; then # TRANSLATORS: %s is replaced by filename -@@ -351,6 +360,7 @@ +@@ -409,6 +418,7 @@ and /etc/grub.d/* files or please file a cat ${grub_cfg}.new > ${grub_cfg} umask $oldumask rm -f ${grub_cfg}.new ++++++ grub2-btrfs-05-grub2-mkconfig.patch ++++++ --- /var/tmp/diff_new_pack.zRplYD/_old 2026-10-22 19:25:24.892072069 +0200 +++ /var/tmp/diff_new_pack.zRplYD/_new 2026-10-22 19:25:24.904072576 +0200 @@ -10,9 +10,11 @@ util/grub.d/20_linux_xen.in | 4 ++++ 5 files changed, 42 insertions(+), 3 deletions(-) ---- a/util/grub-mkconfig_lib.in -+++ b/util/grub-mkconfig_lib.in -@@ -49,7 +49,11 @@ +Index: grub-2.16/util/grub-mkconfig_lib.in +=================================================================== +--- grub-2.16.orig/util/grub-mkconfig_lib.in ++++ grub-2.16/util/grub-mkconfig_lib.in +@@ -49,7 +49,11 @@ grub_warn () make_system_path_relative_to_its_root () { @@ -24,9 +26,11 @@ } is_path_readable_by_grub () ---- a/util/grub.d/00_header.in -+++ b/util/grub.d/00_header.in -@@ -27,6 +27,21 @@ +Index: grub-2.16/util/grub.d/00_header.in +=================================================================== +--- grub-2.16.orig/util/grub.d/00_header.in ++++ grub-2.16/util/grub.d/00_header.in +@@ -27,6 +27,21 @@ export TEXTDOMAINDIR="@localedir@" . "$pkgdatadir/grub-mkconfig_lib" @@ -48,7 +52,7 @@ # Do this as early as possible, since other commands might depend on it. # (e.g. the `loadfont' command might need lvm or raid modules) for i in ${GRUB_PRELOAD_MODULES} ; do -@@ -90,7 +105,9 @@ +@@ -90,7 +105,9 @@ or please file a bug report." >&2 fi cat << EOF @@ -59,7 +63,7 @@ load_env fi -@@ -462,3 +479,15 @@ +@@ -491,3 +508,15 @@ fi if [ "x${GRUB_BADRAM}" != "x" ] ; then echo "badram ${GRUB_BADRAM}" fi @@ -75,21 +79,25 @@ +fi +EOF +fi ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -321,7 +321,8 @@ - GRUB_SIMPLE_ACCESS_LEVEL \ +Index: grub-2.16/util/grub-mkconfig.in +=================================================================== +--- grub-2.16.orig/util/grub-mkconfig.in ++++ grub-2.16/util/grub-mkconfig.in +@@ -322,7 +322,8 @@ export GRUB_DEFAULT \ GRUB_ADVANCED_ACCESS_LEVEL \ GRUB_RECOVERY_ACCESS_LEVEL \ -- GRUB_BOOTNEXT_OMIT_INACTIVE -+ GRUB_BOOTNEXT_OMIT_INACTIVE \ + GRUB_BOOTNEXT_OMIT_INACTIVE \ +- GRUB_DISABLE_MODULE_DEDUPLICATION ++ GRUB_DISABLE_MODULE_DEDUPLICATION \ + SUSE_BTRFS_SNAPSHOT_BOOTING if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -71,10 +71,14 @@ +Index: grub-2.16/util/grub.d/10_linux.in +=================================================================== +--- grub-2.16.orig/util/grub.d/10_linux.in ++++ grub-2.16/util/grub.d/10_linux.in +@@ -71,10 +71,14 @@ fi case x"$GRUB_FS" in xbtrfs) @@ -104,7 +112,7 @@ fi;; xzfs) rpool=`${grub_probe} --device ${GRUB_DEVICE} --target=fs_label 2>/dev/null || zdb -l ${GRUB_DEVICE} | awk -F \' '/ name/ { print $2 }'` -@@ -308,7 +312,12 @@ +@@ -306,7 +310,12 @@ for linux in ${reverse_sorted_list}; do if [ $PLATFORM != "emu" ]; then hotkey=0 else @@ -118,9 +126,11 @@ fi version=`echo $basename | sed -e "s,^[^0-9]*-,,g"` alt_version=`echo $version | sed -e "s,\.old$,,g"` ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -81,10 +81,14 @@ +Index: grub-2.16/util/grub.d/20_linux_xen.in +=================================================================== +--- grub-2.16.orig/util/grub.d/20_linux_xen.in ++++ grub-2.16/util/grub.d/20_linux_xen.in +@@ -81,10 +81,14 @@ fi case x"$GRUB_FS" in xbtrfs) ++++++ grub2-efi-xen-cmdline.patch ++++++ --- /var/tmp/diff_new_pack.zRplYD/_old 2026-10-22 19:25:25.067079457 +0200 +++ /var/tmp/diff_new_pack.zRplYD/_new 2026-10-22 19:25:25.079079963 +0200 @@ -1,18 +1,22 @@ ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -322,7 +322,8 @@ - GRUB_ADVANCED_ACCESS_LEVEL \ +Index: grub-2.16/util/grub-mkconfig.in +=================================================================== +--- grub-2.16.orig/util/grub-mkconfig.in ++++ grub-2.16/util/grub-mkconfig.in +@@ -323,7 +323,8 @@ export GRUB_DEFAULT \ GRUB_RECOVERY_ACCESS_LEVEL \ GRUB_BOOTNEXT_OMIT_INACTIVE \ + GRUB_DISABLE_MODULE_DEDUPLICATION \ - SUSE_BTRFS_SNAPSHOT_BOOTING + SUSE_BTRFS_SNAPSHOT_BOOTING \ + SUSE_CMDLINE_XENEFI if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -222,7 +222,7 @@ +Index: grub-2.16/util/grub.d/20_linux_xen.in +=================================================================== +--- grub-2.16.orig/util/grub.d/20_linux_xen.in ++++ grub-2.16/util/grub.d/20_linux_xen.in +@@ -222,7 +222,7 @@ linux_entry_xsm () message="$(gettext_printf "Loading Xen %s with Linux %s ..." ${xen_version} ${version})" sed "s/^/$submenu_indentation/" <<-EOF echo '$(echo "$message" | grub_quote)' ++++++ grub2-suse-remove-linux-root-param.patch ++++++ --- /var/tmp/diff_new_pack.zRplYD/_old 2026-10-22 19:25:25.622102886 +0200 +++ /var/tmp/diff_new_pack.zRplYD/_new 2026-10-22 19:25:25.630103224 +0200 @@ -1,8 +1,10 @@ ---- a/util/grub-mkconfig.in -+++ b/util/grub-mkconfig.in -@@ -323,7 +323,8 @@ - GRUB_RECOVERY_ACCESS_LEVEL \ +Index: grub-2.16/util/grub-mkconfig.in +=================================================================== +--- grub-2.16.orig/util/grub-mkconfig.in ++++ grub-2.16/util/grub-mkconfig.in +@@ -324,7 +324,8 @@ export GRUB_DEFAULT \ GRUB_BOOTNEXT_OMIT_INACTIVE \ + GRUB_DISABLE_MODULE_DEDUPLICATION \ SUSE_BTRFS_SNAPSHOT_BOOTING \ - SUSE_CMDLINE_XENEFI + SUSE_CMDLINE_XENEFI \ @@ -10,9 +12,11 @@ if test "x${grub_cfg}" != "x"; then rm -f "${grub_cfg}.new" ---- a/util/grub.d/10_linux.in -+++ b/util/grub.d/10_linux.in -@@ -76,7 +76,7 @@ +Index: grub-2.16/util/grub.d/10_linux.in +=================================================================== +--- grub-2.16.orig/util/grub.d/10_linux.in ++++ grub-2.16/util/grub.d/10_linux.in +@@ -76,7 +76,7 @@ case x"$GRUB_FS" in else rootsubvol="`make_system_path_relative_to_its_root /`" rootsubvol="${rootsubvol#/}" @@ -21,7 +25,7 @@ GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}" fi fi;; -@@ -93,6 +93,10 @@ +@@ -93,6 +93,10 @@ case x"$GRUB_FS" in ;; esac @@ -32,9 +36,11 @@ title_correction_code= hotkey=1 ---- a/util/grub.d/20_linux_xen.in -+++ b/util/grub.d/20_linux_xen.in -@@ -100,7 +100,7 @@ +Index: grub-2.16/util/grub.d/20_linux_xen.in +=================================================================== +--- grub-2.16.orig/util/grub.d/20_linux_xen.in ++++ grub-2.16/util/grub.d/20_linux_xen.in +@@ -100,7 +100,7 @@ case x"$GRUB_FS" in else rootsubvol="`make_system_path_relative_to_its_root /`" rootsubvol="${rootsubvol#/}" @@ -43,7 +49,7 @@ GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}" fi fi;; -@@ -111,6 +111,10 @@ +@@ -111,6 +111,10 @@ case x"$GRUB_FS" in ;; esac @@ -54,9 +60,11 @@ title_correction_code= grub2_unquote () ---- a/util/s390x/zipl2grub.pl.in -+++ b/util/s390x/zipl2grub.pl.in -@@ -384,9 +384,13 @@ +Index: grub-2.16/util/s390x/zipl2grub.pl.in +=================================================================== +--- grub-2.16.orig/util/s390x/zipl2grub.pl.in ++++ grub-2.16/util/s390x/zipl2grub.pl.in +@@ -384,9 +384,13 @@ while ( <IN> ) { } else { $v = ""; }
