16 files changed, 164 insertions, 93 deletions

diff --git a/config/grub/default/config/payload b/config/grub/default/config/payload
index a405ae25..3d84413e 100644
--- a/config/grub/default/config/payload
+++ b/config/grub/default/config/payload
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# Copyright (C) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
+# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
 # Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
 
 set prefix=(memdisk)/boot/grub
@@ -26,13 +26,14 @@ else
 	gfxpayload=keep
 	terminal_output --append gfxterm
 
-	if [ -f (cbfsdisk)/background.png ]; then
-		insmod png
-		background_image (cbfsdisk)/background.png
-	elif [ -f (cbfsdisk)/background.jpg ]; then
-		insmod jpeg
-		background_image (cbfsdisk)/background.jpg
-	fi
+	for dt in cbfsdisk memdisk; do
+		for it in png jpg; do
+			if [ -f (${dt})/background.${it} ]; then
+				insmod ${it}
+				background_image (${dt})/background.${it}
+			fi
+		done
+	done
 fi
 
 # Keep CTRL pressed to enable default serial terminal (COM1 or the like)
@@ -52,7 +53,7 @@ set default="0"
 if [ -f (cbfsdisk)/timeout.cfg ]; then
 	source (cbfsdisk)/timeout.cfg
 else	
-	set timeout=5
+	set timeout=8
 fi
 set grub_scan_disk="ahci ata"
 if [ -f (cbfsdisk)/scan.cfg ]; then
@@ -142,16 +143,12 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
-	# TODO: add more strings, based on what distros set up when
-	# the user select auto-partitioning on those installers
-	lvmvol="lvm/grubcrypt-bootvol lvm/grubcrypt-rootvol"
-
 	raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
 
-	# in practise, doing multiple redundant checks is perfectly fast and
+	# in practise, doing multiple redundant checks is perfectly fast
 	# TODO: optimize grub itself, and use */? here for everything
 
-	for vol in ${lvmvol} ${raidvol} ; do
+	for vol in ${raidvol} ; do
 		try_bootcfg "${vol}"
 	done
 
@@ -163,6 +160,9 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 					bootdev="${bootdev} (ahci${i},${part})"
 				elif [ "${grub_disk}" = "ata" ]; then
 					bootdev="${bootdev} (ata${i},${part})"
+				elif [ "${grub_disk}" = "nvme" ]; then
+					# TODO: do we care about other namesapces
+					bootdev="${bootdev} (nvme${i}n1,${part})"
 				fi
 			done
 		done
@@ -170,23 +170,37 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${bootdev} ${lvmvol} ${raidvol}; do
+	for dev in ${bootdev} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
 	echo
 
+	search_bootcfg crypto
+
+	lvmvol=""
+
 	# after cryptomount, lvm volumes might be available
+	# using * is slow on some machines, but we use it here,
+	# just once. in so doing, we find every lvm volume
+	for vol in (*); do
+		if regexp ^\\(lvm/ $vol; then
+			lvmvol="${lvmvol} ${vol}"
+			try_bootcfg "${vol}"
+		fi
+	done
+
+	# user might have put luks inside lvm
+	set pager=0
+	echo "Attempting to unlock encrypted LVMs"
 	for vol in ${lvmvol}; do
-		try_bootcfg "${vol}"
+		cryptomount "$vol"
 	done
+	set pager=1
+	echo
 
 	search_bootcfg crypto
 
-	for vol in lvm/* ; do
-		try_bootcfg "${vol}"
-	done
-
 	true # Prevent pager requiring to accept each line instead of whole screen
 }
 
@@ -215,18 +229,38 @@ menuentry 'Load test configuration (grubtest.cfg) inside of CBFS  [t]' --hotkey=
 	fi
 }
 fi
+if [ -f (cbfsdisk)/u-boot ]; then
+menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
+	set root='cbfsdisk'
+	chainloader /u-boot
+}
+fi
 if [ -f (cbfsdisk)/seabios.elf ]; then
-menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /seabios.elf
 }
+else
+menuentry 'Load SeaBIOS [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /seabios.elf
+}
+fi
 fi
 if [ -f (cbfsdisk)/img/grub2 ]; then
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /fallback/payload
+}
+else
 menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /fallback/payload
 }
 fi
+fi
 menuentry 'Poweroff  [p]' --hotkey='p' {
 	halt
 }
diff --git a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
index 183f5a91..c41f2d4d 100644
--- a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+++ b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
@@ -1,7 +1,7 @@
-From ce13539fe2103abbd991814d995e06cf96e485f7 Mon Sep 17 00:00:00 2001
+From dae0cfdbb484eb3576300ad9c4d2c362f4e8fa64 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 31 Oct 2021 03:47:05 +0000
-Subject: [PATCH 1/3] mitigate grub's missing characters for borders/arrow
+Subject: [PATCH 01/14] mitigate grub's missing characters for borders/arrow
  characters
 
 This cleans up the display on the main screen in GRUB.
@@ -12,7 +12,7 @@ Just don't draw a border, at all.
  1 file changed, 2 insertions(+), 47 deletions(-)
 
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..e76094dfd 100644
+index 9c383e64a..8ec1dd1e8 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -108,47 +108,6 @@ grub_print_message_indented (const char *msg, int margin_left, int margin_right,
@@ -76,7 +76,7 @@ index b1321eb26..e76094dfd 100644
        if (!msg_translated)
  	return 0;
        ret += grub_print_message_indented_real (msg_translated, STANDARD_MARGIN,
-@@ -410,8 +367,6 @@ grub_menu_init_page (int nested, int edit,
+@@ -413,8 +370,6 @@ grub_menu_init_page (int nested, int edit,
  
    grub_term_normal_color = grub_color_menu_normal;
    grub_term_highlight_color = grub_color_menu_highlight;
@@ -86,5 +86,5 @@ index b1321eb26..e76094dfd 100644
    grub_term_highlight_color = old_color_highlight;
    geo->timeout_y = geo->first_entry_y + geo->num_entries
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
index 6ff97979..e30f1386 100644
--- a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch
+++ b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
@@ -1,14 +1,14 @@
-From 70f9e72c3ff6381fe3519612de3b649c0cf26b9a Mon Sep 17 00:00:00 2001
+From 25ae072be49c23abffff657085c16ac3780b8cda Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 16:30:24 +0000
-Subject: [PATCH 2/3] say the name libreboot, in the grub menu
+Subject: [PATCH 02/14] say the name libreboot, in the grub menu
 
 ---
  grub-core/normal/main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index bd4431000..31308e16a 100644
+index 96abfda2f..d806db9c4 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -16,10 +16,10 @@ index bd4431000..31308e16a 100644
    grub_term_cls (term);
  
 -  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
-+  msg_formatted = grub_xasprintf (_("Libreboot 20240504 release, based on coreboot.    https://libreboot.org/"));
++  msg_formatted = grub_xasprintf (_("Libreboot 25.06 Luminous Lemon (GRUB menu): https://libreboot.org/"));
    if (!msg_formatted)
      return;
  
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch b/config/grub/default/patches/0003-Add-CC0-license.patch
index dc9060c3..09b70f1c 100644
--- a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch
+++ b/config/grub/default/patches/0003-Add-CC0-license.patch
@@ -1,7 +1,7 @@
-From de6e7cc62522ce1be21bd2f06e7c15cd234b5426 Mon Sep 17 00:00:00 2001
+From e9969b4ee38e3d9fda1fdff02e127830d7fdf2ec Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 1/6] Add CC0 license
+Subject: [PATCH 03/14] Add CC0 license
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -10,10 +10,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 0bf40caa6..4011e2d15 100644
+index de8c3aa8d..4a3be8568 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -470,7 +470,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
+@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
  
    if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
        || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
@@ -38,5 +38,5 @@ index a42c20bd1..7157a30aa 100644
    grub_util_error ("%s: incompatible license", filename);
  }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
index be875e67..6d413bae 100644
--- a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch
+++ b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
@@ -1,7 +1,7 @@
-From 9edaaffac91d593a439e44bac3b6f5558f5a8245 Mon Sep 17 00:00:00 2001
+From 421a44b2f8211fa46ea523fc0feeaba9940af0e7 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 2/6] Define GRUB_UINT32_MAX
+Subject: [PATCH 04/14] Define GRUB_UINT32_MAX
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+)
 
 diff --git a/include/grub/types.h b/include/grub/types.h
-index 0d96006fe..a13f3a60b 100644
+index 45079bf65..8c0b30395 100644
 --- a/include/grub/types.h
 +++ b/include/grub/types.h
 @@ -156,6 +156,7 @@ typedef grub_int32_t	grub_ssize_t;
@@ -35,5 +35,5 @@ index 0d96006fe..a13f3a60b 100644
  
  #define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
index 1c6b4f04..26a150b7 100644
--- a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch
+++ b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
@@ -1,7 +1,7 @@
-From 5b63da5c4267933f573ca37ce39a073098c443ba Mon Sep 17 00:00:00 2001
+From a31496a4fb9dc85dfbfc3442898aca4b64716986 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 3/6] Add Argon2 algorithm
+Subject: [PATCH 05/14] Add Argon2 algorithm
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -30,10 +30,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  create mode 100644 grub-core/lib/argon2/ref.c
 
 diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
-index a695b02f0..313335a53 100644
+index f4367f895..9d96cedf9 100644
 --- a/docs/grub-dev.texi
 +++ b/docs/grub-dev.texi
-@@ -503,11 +503,75 @@ GRUB includes some code from other projects, and it is sometimes necessary
+@@ -503,12 +503,76 @@ GRUB includes some code from other projects, and it is sometimes necessary
  to update it.
  
  @menu
@@ -41,6 +41,7 @@ index a695b02f0..313335a53 100644
  * Gnulib::
  * jsmn::
  * minilzo::
+ * libtasn1::
  @end menu
  
 +@node Argon2
@@ -110,10 +111,10 @@ index a695b02f0..313335a53 100644
  @section Gnulib
  
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index d2cf29584..4a06789e5 100644
+index 24e8c8437..0ee65d54d 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1215,6 +1215,14 @@ module = {
+@@ -1219,6 +1219,14 @@ module = {
    common = lib/json/json.c;
  };
  
@@ -2607,5 +2608,5 @@ index 000000000..c933df80d
 +    }
 +}
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
index 5d56bd61..1531d60c 100644
--- a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch
+++ b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
@@ -1,7 +1,7 @@
-From 0044d32121bf52c4547c6b3c78f12d7305f57e6b Mon Sep 17 00:00:00 2001
+From 594a7011d551af530bbbdf5e39b941811a0b7811 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 4/6] Error on missing Argon2id parameters
+Subject: [PATCH 06/14] Error on missing Argon2id parameters
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d5106402f..bc818ea69 100644
+index b17cd2115..bbd8f5579 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -38,6 +38,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
  enum grub_luks2_kdf_type
  {
    LUKS2_KDF_TYPE_ARGON2I,
@@ -20,7 +20,7 @@ index d5106402f..bc818ea69 100644
    LUKS2_KDF_TYPE_PBKDF2
  };
  typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
-@@ -90,7 +91,7 @@ struct grub_luks2_keyslot
+@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
  	grub_int64_t time;
  	grub_int64_t memory;
  	grub_int64_t cpus;
@@ -29,7 +29,7 @@ index d5106402f..bc818ea69 100644
        struct
        {
  	const char   *hash;
-@@ -160,10 +161,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
+@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
    else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
      {
@@ -45,7 +45,7 @@ index d5106402f..bc818ea69 100644
  	return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
      }
    else if (!grub_strcmp (type, "pbkdf2"))
-@@ -459,6 +461,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
    switch (k->kdf.type)
      {
        case LUKS2_KDF_TYPE_ARGON2I:
@@ -54,5 +54,5 @@ index d5106402f..bc818ea69 100644
  	goto err;
        case LUKS2_KDF_TYPE_PBKDF2:
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
index f2e26fd4..344dfb1d 100644
--- a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch
+++ b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
@@ -1,7 +1,7 @@
-From 0a21695c55f76f1c958bb633481d55b3168562f7 Mon Sep 17 00:00:00 2001
+From 6a757a3cdf22e840162bb222a87446a32d9b94a2 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 5/6] Compile with Argon2id support
+Subject: [PATCH 07/14] Compile with Argon2id support
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -11,7 +11,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  3 files changed, 17 insertions(+), 4 deletions(-)
 
 diff --git a/Makefile.util.def b/Makefile.util.def
-index 1e9a13d3e..a167825c3 100644
+index 038253b37..2f19569c9 100644
 --- a/Makefile.util.def
 +++ b/Makefile.util.def
 @@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
@@ -35,10 +35,10 @@ index 1e9a13d3e..a167825c3 100644
    common = grub-core/disk/luks.c;
    common = grub-core/disk/luks2.c;
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 4a06789e5..e939dcc99 100644
+index 0ee65d54d..cd29a9df8 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1238,7 +1238,7 @@ module = {
+@@ -1242,7 +1242,7 @@ module = {
    common = disk/luks2.c;
    common = lib/gnulib/base64.c;
    cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
@@ -48,18 +48,18 @@ index 4a06789e5..e939dcc99 100644
  
  module = {
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index bc818ea69..5b9eaa599 100644
+index bbd8f5579..02cd615d9 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -27,6 +27,7 @@
- #include <grub/partition.h>
+@@ -28,6 +28,7 @@
  #include <grub/i18n.h>
+ #include <grub/safemath.h>
  
 +#include <argon2.h>
  #include <base64.h>
  #include <json.h>
  
-@@ -462,8 +463,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
      {
        case LUKS2_KDF_TYPE_ARGON2I:
        case LUKS2_KDF_TYPE_ARGON2ID:
@@ -79,5 +79,5 @@ index bc818ea69..5b9eaa599 100644
  	hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
  	if (!hash)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
index dc65b7a6..b7ea852a 100644
--- a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
+++ b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
@@ -1,7 +1,7 @@
-From 6c9a6625c0dc038d1bdbdc13665f40e269e86496 Mon Sep 17 00:00:00 2001
+From 4e4ded3f127f5567bdb41de7b671bd9b2a478125 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 6/6] Make grub-install work with Argon2
+Subject: [PATCH 08/14] Make grub-install work with Argon2
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 2 insertions(+)
 
 diff --git a/util/grub-install.c b/util/grub-install.c
-index 1ad04db36..a8a3330b8 100644
+index 060246589..059036d3c 100644
 --- a/util/grub-install.c
 +++ b/util/grub-install.c
 @@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
@@ -22,5 +22,5 @@ index 1ad04db36..a8a3330b8 100644
        have_cryptodisk = 1;
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
index 21e8630b..12f6f111 100644
--- a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch
+++ b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
@@ -1,7 +1,7 @@
-From 96c0bbe5d406b616360a7fce7cee67d7692c0d6d Mon Sep 17 00:00:00 2001
+From fc815438e70cbb13166ab6711b6f6460521b1fd4 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 30 Oct 2023 22:19:21 +0000
-Subject: [PATCH 1/1] at_keyboard coreboot: force scancodes2+translate
+Subject: [PATCH 09/14] at_keyboard coreboot: force scancodes2+translate
 
 Scan code set 2 with translation should be assumed in
 every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
    grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
    if (ps2_state.current_set == 2)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
index fbef86a4..8c0a5054 100644
--- a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch
+++ b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
@@ -1,7 +1,7 @@
-From 0a6abeb40ac4284fbff6ef5958989d561b6290a7 Mon Sep 17 00:00:00 2001
+From defb7ad35579c321d32b81af7ddd6fecf34cb618 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Tue, 31 Oct 2023 10:33:28 +0000
-Subject: [PATCH 1/1] keylayouts: don't print "Unknown key" message
+Subject: [PATCH 10/14] keylayouts: don't print "Unknown key" message
 
 on keyboards with stuck keys, this results in GRUB just
 spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
index 25091d16..cef7a273 100644
--- a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch
+++ b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
@@ -1,7 +1,7 @@
-From 9e7a651a0f15f2e9dec65a77765c3c4fd97b4165 Mon Sep 17 00:00:00 2001
+From d0345db429be8089145e0c072db9ac8db0b644bd Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:14:58 +0000
-Subject: [PATCH 1/1] don't print missing prefix errors on the screen
+Subject: [PATCH 11/14] don't print missing prefix errors on the screen
 
 we do actually set the prefix. this patch modifies
 grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
  	    }
  	  file = try_open_from_prefix (prefix, filename);
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 4011e2d15..af3bd00d0 100644
+index 4a3be8568..6ae3d73f8 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -758,7 +758,7 @@ grub_dl_load (const char *name)
+@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
      return 0;
  
    if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4011e2d15..af3bd00d0 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
index f4cf939e..e30c3f9a 100644
--- a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch
+++ b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
@@ -1,7 +1,7 @@
-From 6237c5762edccc1e1fa4746b1d4aa5e8d81e4883 Mon Sep 17 00:00:00 2001
+From 2fe963570ac19e3390a792ca2c195112d4efdc24 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:36:22 +0000
-Subject: [PATCH 1/1] don't print error if module not found
+Subject: [PATCH 12/14] don't print error if module not found
 
 still set grub_errno accordingly, and otherwise
 behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index af3bd00d0..21d0cedb1 100644
+index 6ae3d73f8..4c15027fe 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -486,7 +486,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
+@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
  
    s = grub_dl_find_section (e, ".modname");
    if (!s)
@@ -30,5 +30,5 @@ index af3bd00d0..21d0cedb1 100644
    mod->name = grub_strdup ((char *) e + s->sh_offset);
    if (! mod->name)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
index 25221c9c..0cdadbe9 100644
--- a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch
+++ b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
@@ -1,7 +1,7 @@
-From e5b7ec81421487e71bcaf8b6b5a27f3649a62753 Mon Sep 17 00:00:00 2001
+From 5a1dd3c19307859aac7d1a22a7a0c0c7ffb09ddb Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 17:25:20 +0000
-Subject: [PATCH 1/1] don't print empty error messages
+Subject: [PATCH 13/14] don't print empty error messages
 
 this is part two of the quest to kill the prefix
 error message. after i disabled prefix-related
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
  	}
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
new file mode 100644
index 00000000..78e4eafc
--- /dev/null
+++ b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
@@ -0,0 +1,37 @@
+From 818f1b19f32e355cc2a0ebe29eee2a2bac7bcb3f Mon Sep 17 00:00:00 2001
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Mon, 17 May 2021 10:24:36 +0200
+Subject: [PATCH 14/14] kern/coreboot/mmap: Map to reserved
+
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
+
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+---
+ grub-core/kern/coreboot/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/kern/coreboot/mmap.c b/grub-core/kern/coreboot/mmap.c
+index caf8f7cef..2fc316e8d 100644
+--- a/grub-core/kern/coreboot/mmap.c
++++ b/grub-core/kern/coreboot/mmap.c
+@@ -59,7 +59,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 			    /* Multiboot mmaps match with the coreboot mmap
+ 			       definition.  Therefore, we can just pass type
+ 			       through.  */
+-			    mem_region->type,
++			    (mem_region->type >= 13) ? 2 : mem_region->type,
+ 			    ctx->hook_data))
+ 	    return 1;
+ 	  if (start < 0xa0000)
+@@ -81,7 +81,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 		     /* Multiboot mmaps match with the coreboot mmap
+ 		        definition.  Therefore, we can just pass type
+ 		        through.  */
+-		     mem_region->type,
++		     (mem_region->type >= 13) ? 2 : mem_region->type,
+ 		     ctx->hook_data))
+ 	return 1;
+     }
+-- 
+2.39.5
+
diff --git a/config/grub/default/target.cfg b/config/grub/default/target.cfg
index fa5735e9..6a13a189 100644
--- a/config/grub/default/target.cfg
+++ b/config/grub/default/target.cfg
@@ -1,5 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 tree="default"
-rev="8719cc2040368d43ab2de0b6e1b850b2c9cfc5b7"
-bootstrapargs="--gnulib-srcdir=gnulib/ --no-git"
-autoconfargs="--with-platform=coreboot --disable-werror"
-makeargs="FS_PAYLOAD_MODULES=\"\""
+rev="a68a7dece464c35b1c8d20b98502b6881b103911"