16 files changed, 155 insertions, 82 deletions

diff --git a/config/grub/default/config/payload b/config/grub/default/config/payload
index cdd6c0f0..3d84413e 100644
--- a/config/grub/default/config/payload
+++ b/config/grub/default/config/payload
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# Copyright (C) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
+# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
 # Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
 
 set prefix=(memdisk)/boot/grub
@@ -143,16 +143,12 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
-	# TODO: add more strings, based on what distros set up when
-	# the user select auto-partitioning on those installers
-	lvmvol="lvm/grubcrypt-bootvol lvm/grubcrypt-rootvol"
-
 	raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
 
-	# in practise, doing multiple redundant checks is perfectly fast and
+	# in practise, doing multiple redundant checks is perfectly fast
 	# TODO: optimize grub itself, and use */? here for everything
 
-	for vol in ${lvmvol} ${raidvol} ; do
+	for vol in ${raidvol} ; do
 		try_bootcfg "${vol}"
 	done
 
@@ -164,6 +160,9 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 					bootdev="${bootdev} (ahci${i},${part})"
 				elif [ "${grub_disk}" = "ata" ]; then
 					bootdev="${bootdev} (ata${i},${part})"
+				elif [ "${grub_disk}" = "nvme" ]; then
+					# TODO: do we care about other namesapces
+					bootdev="${bootdev} (nvme${i}n1,${part})"
 				fi
 			done
 		done
@@ -171,23 +170,37 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${bootdev} ${lvmvol} ${raidvol}; do
+	for dev in ${bootdev} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
 	echo
 
+	search_bootcfg crypto
+
+	lvmvol=""
+
 	# after cryptomount, lvm volumes might be available
+	# using * is slow on some machines, but we use it here,
+	# just once. in so doing, we find every lvm volume
+	for vol in (*); do
+		if regexp ^\\(lvm/ $vol; then
+			lvmvol="${lvmvol} ${vol}"
+			try_bootcfg "${vol}"
+		fi
+	done
+
+	# user might have put luks inside lvm
+	set pager=0
+	echo "Attempting to unlock encrypted LVMs"
 	for vol in ${lvmvol}; do
-		try_bootcfg "${vol}"
+		cryptomount "$vol"
 	done
+	set pager=1
+	echo
 
 	search_bootcfg crypto
 
-	for vol in lvm/* ; do
-		try_bootcfg "${vol}"
-	done
-
 	true # Prevent pager requiring to accept each line instead of whole screen
 }
 
@@ -216,18 +229,38 @@ menuentry 'Load test configuration (grubtest.cfg) inside of CBFS  [t]' --hotkey=
 	fi
 }
 fi
+if [ -f (cbfsdisk)/u-boot ]; then
+menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
+	set root='cbfsdisk'
+	chainloader /u-boot
+}
+fi
 if [ -f (cbfsdisk)/seabios.elf ]; then
-menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /seabios.elf
+}
+else
+menuentry 'Load SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /seabios.elf
 }
 fi
+fi
 if [ -f (cbfsdisk)/img/grub2 ]; then
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /fallback/payload
+}
+else
 menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /fallback/payload
 }
 fi
+fi
 menuentry 'Poweroff  [p]' --hotkey='p' {
 	halt
 }
diff --git a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
index 183f5a91..ffd2c537 100644
--- a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+++ b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
@@ -1,7 +1,7 @@
-From ce13539fe2103abbd991814d995e06cf96e485f7 Mon Sep 17 00:00:00 2001
+From 8ccafb60665bba3759248b13d2d1683818aaf4ee Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 31 Oct 2021 03:47:05 +0000
-Subject: [PATCH 1/3] mitigate grub's missing characters for borders/arrow
+Subject: [PATCH 01/13] mitigate grub's missing characters for borders/arrow
  characters
 
 This cleans up the display on the main screen in GRUB.
@@ -12,7 +12,7 @@ Just don't draw a border, at all.
  1 file changed, 2 insertions(+), 47 deletions(-)
 
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..e76094dfd 100644
+index 9c383e64a..8ec1dd1e8 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -108,47 +108,6 @@ grub_print_message_indented (const char *msg, int margin_left, int margin_right,
@@ -76,7 +76,7 @@ index b1321eb26..e76094dfd 100644
        if (!msg_translated)
  	return 0;
        ret += grub_print_message_indented_real (msg_translated, STANDARD_MARGIN,
-@@ -410,8 +367,6 @@ grub_menu_init_page (int nested, int edit,
+@@ -413,8 +370,6 @@ grub_menu_init_page (int nested, int edit,
  
    grub_term_normal_color = grub_color_menu_normal;
    grub_term_highlight_color = grub_color_menu_highlight;
@@ -86,5 +86,5 @@ index b1321eb26..e76094dfd 100644
    grub_term_highlight_color = old_color_highlight;
    geo->timeout_y = geo->first_entry_y + geo->num_entries
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
index b83565fe..e32ba2ce 100644
--- a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch
+++ b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
@@ -1,14 +1,14 @@
-From 70f9e72c3ff6381fe3519612de3b649c0cf26b9a Mon Sep 17 00:00:00 2001
+From 3fb09986e62a9945862456d5f1d63a6ccba2c861 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 16:30:24 +0000
-Subject: [PATCH 2/3] say the name libreboot, in the grub menu
+Subject: [PATCH 02/13] say the name libreboot, in the grub menu
 
 ---
  grub-core/normal/main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index bd4431000..31308e16a 100644
+index 04d058f55..b1cc8f236 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -16,10 +16,10 @@ index bd4431000..31308e16a 100644
    grub_term_cls (term);
  
 -  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
-+  msg_formatted = grub_xasprintf (_("Libreboot 20240612 release, based on coreboot.    https://libreboot.org/"));
++  msg_formatted = grub_xasprintf (_("Libreboot 25.04 Corny Calamity (GRUB menu): https://libreboot.org/"));
    if (!msg_formatted)
      return;
  
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch b/config/grub/default/patches/0003-Add-CC0-license.patch
index dc9060c3..c074099a 100644
--- a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch
+++ b/config/grub/default/patches/0003-Add-CC0-license.patch
@@ -1,7 +1,7 @@
-From de6e7cc62522ce1be21bd2f06e7c15cd234b5426 Mon Sep 17 00:00:00 2001
+From dc790ff2ba2702ee863c9d16e05cf843a152f3d4 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 1/6] Add CC0 license
+Subject: [PATCH 03/13] Add CC0 license
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -10,10 +10,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 0bf40caa6..4011e2d15 100644
+index de8c3aa8d..4a3be8568 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -470,7 +470,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
+@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
  
    if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
        || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
@@ -38,5 +38,5 @@ index a42c20bd1..7157a30aa 100644
    grub_util_error ("%s: incompatible license", filename);
  }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
index be875e67..af617683 100644
--- a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch
+++ b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
@@ -1,7 +1,7 @@
-From 9edaaffac91d593a439e44bac3b6f5558f5a8245 Mon Sep 17 00:00:00 2001
+From 298eaaca770545e19dfacd47511c2081c1fece08 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 2/6] Define GRUB_UINT32_MAX
+Subject: [PATCH 04/13] Define GRUB_UINT32_MAX
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+)
 
 diff --git a/include/grub/types.h b/include/grub/types.h
-index 0d96006fe..a13f3a60b 100644
+index 45079bf65..8c0b30395 100644
 --- a/include/grub/types.h
 +++ b/include/grub/types.h
 @@ -156,6 +156,7 @@ typedef grub_int32_t	grub_ssize_t;
@@ -35,5 +35,5 @@ index 0d96006fe..a13f3a60b 100644
  
  #define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
index 1c6b4f04..dacd83ee 100644
--- a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch
+++ b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
@@ -1,7 +1,7 @@
-From 5b63da5c4267933f573ca37ce39a073098c443ba Mon Sep 17 00:00:00 2001
+From 378aa081ac1211d0bf4043eeb0bb7d4aa534043f Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 3/6] Add Argon2 algorithm
+Subject: [PATCH 05/13] Add Argon2 algorithm
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -30,10 +30,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  create mode 100644 grub-core/lib/argon2/ref.c
 
 diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
-index a695b02f0..313335a53 100644
+index f4367f895..9d96cedf9 100644
 --- a/docs/grub-dev.texi
 +++ b/docs/grub-dev.texi
-@@ -503,11 +503,75 @@ GRUB includes some code from other projects, and it is sometimes necessary
+@@ -503,12 +503,76 @@ GRUB includes some code from other projects, and it is sometimes necessary
  to update it.
  
  @menu
@@ -41,6 +41,7 @@ index a695b02f0..313335a53 100644
  * Gnulib::
  * jsmn::
  * minilzo::
+ * libtasn1::
  @end menu
  
 +@node Argon2
@@ -110,10 +111,10 @@ index a695b02f0..313335a53 100644
  @section Gnulib
  
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index d2cf29584..4a06789e5 100644
+index f70e02e69..f5f9b040c 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1215,6 +1215,14 @@ module = {
+@@ -1219,6 +1219,14 @@ module = {
    common = lib/json/json.c;
  };
  
@@ -2607,5 +2608,5 @@ index 000000000..c933df80d
 +    }
 +}
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
index 5d56bd61..f1ea10c2 100644
--- a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch
+++ b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
@@ -1,7 +1,7 @@
-From 0044d32121bf52c4547c6b3c78f12d7305f57e6b Mon Sep 17 00:00:00 2001
+From febaf431d235f07b97f07f935611dc168b0b35bb Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 4/6] Error on missing Argon2id parameters
+Subject: [PATCH 06/13] Error on missing Argon2id parameters
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d5106402f..bc818ea69 100644
+index 8036d76ff..efae8ac65 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -38,6 +38,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
  enum grub_luks2_kdf_type
  {
    LUKS2_KDF_TYPE_ARGON2I,
@@ -20,7 +20,7 @@ index d5106402f..bc818ea69 100644
    LUKS2_KDF_TYPE_PBKDF2
  };
  typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
-@@ -90,7 +91,7 @@ struct grub_luks2_keyslot
+@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
  	grub_int64_t time;
  	grub_int64_t memory;
  	grub_int64_t cpus;
@@ -29,7 +29,7 @@ index d5106402f..bc818ea69 100644
        struct
        {
  	const char   *hash;
-@@ -160,10 +161,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
+@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
    else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
      {
@@ -45,7 +45,7 @@ index d5106402f..bc818ea69 100644
  	return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
      }
    else if (!grub_strcmp (type, "pbkdf2"))
-@@ -459,6 +461,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
    switch (k->kdf.type)
      {
        case LUKS2_KDF_TYPE_ARGON2I:
@@ -54,5 +54,5 @@ index d5106402f..bc818ea69 100644
  	goto err;
        case LUKS2_KDF_TYPE_PBKDF2:
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
index f2e26fd4..c0a8fffb 100644
--- a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch
+++ b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
@@ -1,7 +1,7 @@
-From 0a21695c55f76f1c958bb633481d55b3168562f7 Mon Sep 17 00:00:00 2001
+From 12d3e4dfff3f92daf2f3f73cc0797425f7bb9df6 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 5/6] Compile with Argon2id support
+Subject: [PATCH 07/13] Compile with Argon2id support
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -11,7 +11,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  3 files changed, 17 insertions(+), 4 deletions(-)
 
 diff --git a/Makefile.util.def b/Makefile.util.def
-index 1e9a13d3e..a167825c3 100644
+index 038253b37..2f19569c9 100644
 --- a/Makefile.util.def
 +++ b/Makefile.util.def
 @@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
@@ -35,10 +35,10 @@ index 1e9a13d3e..a167825c3 100644
    common = grub-core/disk/luks.c;
    common = grub-core/disk/luks2.c;
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 4a06789e5..e939dcc99 100644
+index f5f9b040c..f1f38d8d3 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1238,7 +1238,7 @@ module = {
+@@ -1242,7 +1242,7 @@ module = {
    common = disk/luks2.c;
    common = lib/gnulib/base64.c;
    cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
@@ -48,18 +48,18 @@ index 4a06789e5..e939dcc99 100644
  
  module = {
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index bc818ea69..5b9eaa599 100644
+index efae8ac65..2e742f5be 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -27,6 +27,7 @@
- #include <grub/partition.h>
+@@ -28,6 +28,7 @@
  #include <grub/i18n.h>
+ #include <grub/safemath.h>
  
 +#include <argon2.h>
  #include <base64.h>
  #include <json.h>
  
-@@ -462,8 +463,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
      {
        case LUKS2_KDF_TYPE_ARGON2I:
        case LUKS2_KDF_TYPE_ARGON2ID:
@@ -79,5 +79,5 @@ index bc818ea69..5b9eaa599 100644
  	hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
  	if (!hash)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
index dc65b7a6..12e78752 100644
--- a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
+++ b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
@@ -1,7 +1,7 @@
-From 6c9a6625c0dc038d1bdbdc13665f40e269e86496 Mon Sep 17 00:00:00 2001
+From 8e639e9558c98019566743cc5723e641b1726d15 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 6/6] Make grub-install work with Argon2
+Subject: [PATCH 08/13] Make grub-install work with Argon2
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 2 insertions(+)
 
 diff --git a/util/grub-install.c b/util/grub-install.c
-index 1ad04db36..a8a3330b8 100644
+index 060246589..059036d3c 100644
 --- a/util/grub-install.c
 +++ b/util/grub-install.c
 @@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
@@ -22,5 +22,5 @@ index 1ad04db36..a8a3330b8 100644
        have_cryptodisk = 1;
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
index 21e8630b..50195201 100644
--- a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch
+++ b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
@@ -1,7 +1,7 @@
-From 96c0bbe5d406b616360a7fce7cee67d7692c0d6d Mon Sep 17 00:00:00 2001
+From 8a098ee241040ccfdf03636f558ef6a3b431bb90 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 30 Oct 2023 22:19:21 +0000
-Subject: [PATCH 1/1] at_keyboard coreboot: force scancodes2+translate
+Subject: [PATCH 09/13] at_keyboard coreboot: force scancodes2+translate
 
 Scan code set 2 with translation should be assumed in
 every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
    grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
    if (ps2_state.current_set == 2)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
index fbef86a4..685e21c4 100644
--- a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch
+++ b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
@@ -1,7 +1,7 @@
-From 0a6abeb40ac4284fbff6ef5958989d561b6290a7 Mon Sep 17 00:00:00 2001
+From d86b69fa2c0d73440e5b990d8ab4b66c5c23fa46 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Tue, 31 Oct 2023 10:33:28 +0000
-Subject: [PATCH 1/1] keylayouts: don't print "Unknown key" message
+Subject: [PATCH 10/13] keylayouts: don't print "Unknown key" message
 
 on keyboards with stuck keys, this results in GRUB just
 spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
index 25091d16..f15d78e1 100644
--- a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch
+++ b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
@@ -1,7 +1,7 @@
-From 9e7a651a0f15f2e9dec65a77765c3c4fd97b4165 Mon Sep 17 00:00:00 2001
+From 3726c1e12b8896e4a77cc7a2b490e933dc2c08da Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:14:58 +0000
-Subject: [PATCH 1/1] don't print missing prefix errors on the screen
+Subject: [PATCH 11/13] don't print missing prefix errors on the screen
 
 we do actually set the prefix. this patch modifies
 grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
  	    }
  	  file = try_open_from_prefix (prefix, filename);
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 4011e2d15..af3bd00d0 100644
+index 4a3be8568..6ae3d73f8 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -758,7 +758,7 @@ grub_dl_load (const char *name)
+@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
      return 0;
  
    if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4011e2d15..af3bd00d0 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
index f4cf939e..713f1244 100644
--- a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch
+++ b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
@@ -1,7 +1,7 @@
-From 6237c5762edccc1e1fa4746b1d4aa5e8d81e4883 Mon Sep 17 00:00:00 2001
+From c86a635609a4623baa9312f5c1bebfd51f5883a1 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:36:22 +0000
-Subject: [PATCH 1/1] don't print error if module not found
+Subject: [PATCH 12/13] don't print error if module not found
 
 still set grub_errno accordingly, and otherwise
 behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index af3bd00d0..21d0cedb1 100644
+index 6ae3d73f8..4c15027fe 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -486,7 +486,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
+@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
  
    s = grub_dl_find_section (e, ".modname");
    if (!s)
@@ -30,5 +30,5 @@ index af3bd00d0..21d0cedb1 100644
    mod->name = grub_strdup ((char *) e + s->sh_offset);
    if (! mod->name)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
index 25221c9c..d23ea109 100644
--- a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch
+++ b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
@@ -1,7 +1,7 @@
-From e5b7ec81421487e71bcaf8b6b5a27f3649a62753 Mon Sep 17 00:00:00 2001
+From 715ba566042aa140cbeb06836c558460ef6f446f Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 17:25:20 +0000
-Subject: [PATCH 1/1] don't print empty error messages
+Subject: [PATCH 13/13] don't print empty error messages
 
 this is part two of the quest to kill the prefix
 error message. after i disabled prefix-related
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
  	}
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
new file mode 100644
index 00000000..5d93ac1d
--- /dev/null
+++ b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
@@ -0,0 +1,37 @@
+From d675307bfcac2f9e05ed119c5b5af3de48e56fb9 Mon Sep 17 00:00:00 2001
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Mon, 17 May 2021 10:24:36 +0200
+Subject: [PATCH] kern/coreboot/mmap: Map to reserved
+
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
+
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+---
+ grub-core/kern/coreboot/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/kern/coreboot/mmap.c b/grub-core/kern/coreboot/mmap.c
+index caf8f7cef..2fc316e8d 100644
+--- a/grub-core/kern/coreboot/mmap.c
++++ b/grub-core/kern/coreboot/mmap.c
+@@ -59,7 +59,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 			    /* Multiboot mmaps match with the coreboot mmap
+ 			       definition.  Therefore, we can just pass type
+ 			       through.  */
+-			    mem_region->type,
++			    (mem_region->type >= 13) ? 2 : mem_region->type,
+ 			    ctx->hook_data))
+ 	    return 1;
+ 	  if (start < 0xa0000)
+@@ -81,7 +81,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 		     /* Multiboot mmaps match with the coreboot mmap
+ 		        definition.  Therefore, we can just pass type
+ 		        through.  */
+-		     mem_region->type,
++		     (mem_region->type >= 13) ? 2 : mem_region->type,
+ 		     ctx->hook_data))
+ 	return 1;
+     }
+-- 
+2.31.1
+
diff --git a/config/grub/default/target.cfg b/config/grub/default/target.cfg
index e6ed598b..f5cc85f1 100644
--- a/config/grub/default/target.cfg
+++ b/config/grub/default/target.cfg
@@ -1,2 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 tree="default"
-rev="8719cc2040368d43ab2de0b6e1b850b2c9cfc5b7"
+rev="73d1c959ea3417e9309ba8c6102d7d6dc7c94259"