61 files changed, 681 insertions, 307 deletions

diff --git a/config/grub/default/config/payload b/config/grub/default/config/payload
index cdd6c0f0..3d84413e 100644
--- a/config/grub/default/config/payload
+++ b/config/grub/default/config/payload
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# Copyright (C) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
+# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
 # Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
 
 set prefix=(memdisk)/boot/grub
@@ -143,16 +143,12 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
-	# TODO: add more strings, based on what distros set up when
-	# the user select auto-partitioning on those installers
-	lvmvol="lvm/grubcrypt-bootvol lvm/grubcrypt-rootvol"
-
 	raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
 
-	# in practise, doing multiple redundant checks is perfectly fast and
+	# in practise, doing multiple redundant checks is perfectly fast
 	# TODO: optimize grub itself, and use */? here for everything
 
-	for vol in ${lvmvol} ${raidvol} ; do
+	for vol in ${raidvol} ; do
 		try_bootcfg "${vol}"
 	done
 
@@ -164,6 +160,9 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 					bootdev="${bootdev} (ahci${i},${part})"
 				elif [ "${grub_disk}" = "ata" ]; then
 					bootdev="${bootdev} (ata${i},${part})"
+				elif [ "${grub_disk}" = "nvme" ]; then
+					# TODO: do we care about other namesapces
+					bootdev="${bootdev} (nvme${i}n1,${part})"
 				fi
 			done
 		done
@@ -171,23 +170,37 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${bootdev} ${lvmvol} ${raidvol}; do
+	for dev in ${bootdev} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
 	echo
 
+	search_bootcfg crypto
+
+	lvmvol=""
+
 	# after cryptomount, lvm volumes might be available
+	# using * is slow on some machines, but we use it here,
+	# just once. in so doing, we find every lvm volume
+	for vol in (*); do
+		if regexp ^\\(lvm/ $vol; then
+			lvmvol="${lvmvol} ${vol}"
+			try_bootcfg "${vol}"
+		fi
+	done
+
+	# user might have put luks inside lvm
+	set pager=0
+	echo "Attempting to unlock encrypted LVMs"
 	for vol in ${lvmvol}; do
-		try_bootcfg "${vol}"
+		cryptomount "$vol"
 	done
+	set pager=1
+	echo
 
 	search_bootcfg crypto
 
-	for vol in lvm/* ; do
-		try_bootcfg "${vol}"
-	done
-
 	true # Prevent pager requiring to accept each line instead of whole screen
 }
 
@@ -216,18 +229,38 @@ menuentry 'Load test configuration (grubtest.cfg) inside of CBFS  [t]' --hotkey=
 	fi
 }
 fi
+if [ -f (cbfsdisk)/u-boot ]; then
+menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
+	set root='cbfsdisk'
+	chainloader /u-boot
+}
+fi
 if [ -f (cbfsdisk)/seabios.elf ]; then
-menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /seabios.elf
+}
+else
+menuentry 'Load SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /seabios.elf
 }
 fi
+fi
 if [ -f (cbfsdisk)/img/grub2 ]; then
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /fallback/payload
+}
+else
 menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /fallback/payload
 }
 fi
+fi
 menuentry 'Poweroff  [p]' --hotkey='p' {
 	halt
 }
diff --git a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
index 183f5a91..c41f2d4d 100644
--- a/config/grub/default/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+++ b/config/grub/default/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
@@ -1,7 +1,7 @@
-From ce13539fe2103abbd991814d995e06cf96e485f7 Mon Sep 17 00:00:00 2001
+From dae0cfdbb484eb3576300ad9c4d2c362f4e8fa64 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 31 Oct 2021 03:47:05 +0000
-Subject: [PATCH 1/3] mitigate grub's missing characters for borders/arrow
+Subject: [PATCH 01/14] mitigate grub's missing characters for borders/arrow
  characters
 
 This cleans up the display on the main screen in GRUB.
@@ -12,7 +12,7 @@ Just don't draw a border, at all.
  1 file changed, 2 insertions(+), 47 deletions(-)
 
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..e76094dfd 100644
+index 9c383e64a..8ec1dd1e8 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -108,47 +108,6 @@ grub_print_message_indented (const char *msg, int margin_left, int margin_right,
@@ -76,7 +76,7 @@ index b1321eb26..e76094dfd 100644
        if (!msg_translated)
  	return 0;
        ret += grub_print_message_indented_real (msg_translated, STANDARD_MARGIN,
-@@ -410,8 +367,6 @@ grub_menu_init_page (int nested, int edit,
+@@ -413,8 +370,6 @@ grub_menu_init_page (int nested, int edit,
  
    grub_term_normal_color = grub_color_menu_normal;
    grub_term_highlight_color = grub_color_menu_highlight;
@@ -86,5 +86,5 @@ index b1321eb26..e76094dfd 100644
    grub_term_highlight_color = old_color_highlight;
    geo->timeout_y = geo->first_entry_y + geo->num_entries
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/xhci/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
index b83565fe..e30f1386 100644
--- a/config/grub/xhci/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch
+++ b/config/grub/default/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
@@ -1,14 +1,14 @@
-From 70f9e72c3ff6381fe3519612de3b649c0cf26b9a Mon Sep 17 00:00:00 2001
+From 25ae072be49c23abffff657085c16ac3780b8cda Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 16:30:24 +0000
-Subject: [PATCH 2/3] say the name libreboot, in the grub menu
+Subject: [PATCH 02/14] say the name libreboot, in the grub menu
 
 ---
  grub-core/normal/main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index bd4431000..31308e16a 100644
+index 96abfda2f..d806db9c4 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -16,10 +16,10 @@ index bd4431000..31308e16a 100644
    grub_term_cls (term);
  
 -  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
-+  msg_formatted = grub_xasprintf (_("Libreboot 20240612 release, based on coreboot.    https://libreboot.org/"));
++  msg_formatted = grub_xasprintf (_("Libreboot 25.06 Luminous Lemon (GRUB menu): https://libreboot.org/"));
    if (!msg_formatted)
      return;
  
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0003-Add-CC0-license.patch b/config/grub/default/patches/0003-Add-CC0-license.patch
index dc9060c3..09b70f1c 100644
--- a/config/grub/xhci/patches/0002-luks2/0003-Add-CC0-license.patch
+++ b/config/grub/default/patches/0003-Add-CC0-license.patch
@@ -1,7 +1,7 @@
-From de6e7cc62522ce1be21bd2f06e7c15cd234b5426 Mon Sep 17 00:00:00 2001
+From e9969b4ee38e3d9fda1fdff02e127830d7fdf2ec Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 1/6] Add CC0 license
+Subject: [PATCH 03/14] Add CC0 license
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -10,10 +10,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 0bf40caa6..4011e2d15 100644
+index de8c3aa8d..4a3be8568 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -470,7 +470,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
+@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
  
    if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
        || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
@@ -38,5 +38,5 @@ index a42c20bd1..7157a30aa 100644
    grub_util_error ("%s: incompatible license", filename);
  }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
index be875e67..6d413bae 100644
--- a/config/grub/nvme/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch
+++ b/config/grub/default/patches/0004-Define-GRUB_UINT32_MAX.patch
@@ -1,7 +1,7 @@
-From 9edaaffac91d593a439e44bac3b6f5558f5a8245 Mon Sep 17 00:00:00 2001
+From 421a44b2f8211fa46ea523fc0feeaba9940af0e7 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 2/6] Define GRUB_UINT32_MAX
+Subject: [PATCH 04/14] Define GRUB_UINT32_MAX
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+)
 
 diff --git a/include/grub/types.h b/include/grub/types.h
-index 0d96006fe..a13f3a60b 100644
+index 45079bf65..8c0b30395 100644
 --- a/include/grub/types.h
 +++ b/include/grub/types.h
 @@ -156,6 +156,7 @@ typedef grub_int32_t	grub_ssize_t;
@@ -35,5 +35,5 @@ index 0d96006fe..a13f3a60b 100644
  
  #define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
index 1c6b4f04..26a150b7 100644
--- a/config/grub/default/patches/0002-luks2/0005-Add-Argon2-algorithm.patch
+++ b/config/grub/default/patches/0005-Add-Argon2-algorithm.patch
@@ -1,7 +1,7 @@
-From 5b63da5c4267933f573ca37ce39a073098c443ba Mon Sep 17 00:00:00 2001
+From a31496a4fb9dc85dfbfc3442898aca4b64716986 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 3/6] Add Argon2 algorithm
+Subject: [PATCH 05/14] Add Argon2 algorithm
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -30,10 +30,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  create mode 100644 grub-core/lib/argon2/ref.c
 
 diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
-index a695b02f0..313335a53 100644
+index f4367f895..9d96cedf9 100644
 --- a/docs/grub-dev.texi
 +++ b/docs/grub-dev.texi
-@@ -503,11 +503,75 @@ GRUB includes some code from other projects, and it is sometimes necessary
+@@ -503,12 +503,76 @@ GRUB includes some code from other projects, and it is sometimes necessary
  to update it.
  
  @menu
@@ -41,6 +41,7 @@ index a695b02f0..313335a53 100644
  * Gnulib::
  * jsmn::
  * minilzo::
+ * libtasn1::
  @end menu
  
 +@node Argon2
@@ -110,10 +111,10 @@ index a695b02f0..313335a53 100644
  @section Gnulib
  
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index d2cf29584..4a06789e5 100644
+index 24e8c8437..0ee65d54d 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1215,6 +1215,14 @@ module = {
+@@ -1219,6 +1219,14 @@ module = {
    common = lib/json/json.c;
  };
  
@@ -2607,5 +2608,5 @@ index 000000000..c933df80d
 +    }
 +}
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
index 5d56bd61..1531d60c 100644
--- a/config/grub/xhci/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch
+++ b/config/grub/default/patches/0006-Error-on-missing-Argon2id-parameters.patch
@@ -1,7 +1,7 @@
-From 0044d32121bf52c4547c6b3c78f12d7305f57e6b Mon Sep 17 00:00:00 2001
+From 594a7011d551af530bbbdf5e39b941811a0b7811 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 4/6] Error on missing Argon2id parameters
+Subject: [PATCH 06/14] Error on missing Argon2id parameters
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d5106402f..bc818ea69 100644
+index b17cd2115..bbd8f5579 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -38,6 +38,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
  enum grub_luks2_kdf_type
  {
    LUKS2_KDF_TYPE_ARGON2I,
@@ -20,7 +20,7 @@ index d5106402f..bc818ea69 100644
    LUKS2_KDF_TYPE_PBKDF2
  };
  typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
-@@ -90,7 +91,7 @@ struct grub_luks2_keyslot
+@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
  	grub_int64_t time;
  	grub_int64_t memory;
  	grub_int64_t cpus;
@@ -29,7 +29,7 @@ index d5106402f..bc818ea69 100644
        struct
        {
  	const char   *hash;
-@@ -160,10 +161,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
+@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
    else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
      {
@@ -45,7 +45,7 @@ index d5106402f..bc818ea69 100644
  	return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
      }
    else if (!grub_strcmp (type, "pbkdf2"))
-@@ -459,6 +461,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
    switch (k->kdf.type)
      {
        case LUKS2_KDF_TYPE_ARGON2I:
@@ -54,5 +54,5 @@ index d5106402f..bc818ea69 100644
  	goto err;
        case LUKS2_KDF_TYPE_PBKDF2:
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
index f2e26fd4..344dfb1d 100644
--- a/config/grub/xhci/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch
+++ b/config/grub/default/patches/0007-Compile-with-Argon2id-support.patch
@@ -1,7 +1,7 @@
-From 0a21695c55f76f1c958bb633481d55b3168562f7 Mon Sep 17 00:00:00 2001
+From 6a757a3cdf22e840162bb222a87446a32d9b94a2 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 5/6] Compile with Argon2id support
+Subject: [PATCH 07/14] Compile with Argon2id support
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -11,7 +11,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  3 files changed, 17 insertions(+), 4 deletions(-)
 
 diff --git a/Makefile.util.def b/Makefile.util.def
-index 1e9a13d3e..a167825c3 100644
+index 038253b37..2f19569c9 100644
 --- a/Makefile.util.def
 +++ b/Makefile.util.def
 @@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
@@ -35,10 +35,10 @@ index 1e9a13d3e..a167825c3 100644
    common = grub-core/disk/luks.c;
    common = grub-core/disk/luks2.c;
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 4a06789e5..e939dcc99 100644
+index 0ee65d54d..cd29a9df8 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1238,7 +1238,7 @@ module = {
+@@ -1242,7 +1242,7 @@ module = {
    common = disk/luks2.c;
    common = lib/gnulib/base64.c;
    cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
@@ -48,18 +48,18 @@ index 4a06789e5..e939dcc99 100644
  
  module = {
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index bc818ea69..5b9eaa599 100644
+index bbd8f5579..02cd615d9 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -27,6 +27,7 @@
- #include <grub/partition.h>
+@@ -28,6 +28,7 @@
  #include <grub/i18n.h>
+ #include <grub/safemath.h>
  
 +#include <argon2.h>
  #include <base64.h>
  #include <json.h>
  
-@@ -462,8 +463,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
      {
        case LUKS2_KDF_TYPE_ARGON2I:
        case LUKS2_KDF_TYPE_ARGON2ID:
@@ -79,5 +79,5 @@ index bc818ea69..5b9eaa599 100644
  	hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
  	if (!hash)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
index dc65b7a6..b7ea852a 100644
--- a/config/grub/default/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
+++ b/config/grub/default/patches/0008-Make-grub-install-work-with-Argon2.patch
@@ -1,7 +1,7 @@
-From 6c9a6625c0dc038d1bdbdc13665f40e269e86496 Mon Sep 17 00:00:00 2001
+From 4e4ded3f127f5567bdb41de7b671bd9b2a478125 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 6/6] Make grub-install work with Argon2
+Subject: [PATCH 08/14] Make grub-install work with Argon2
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 2 insertions(+)
 
 diff --git a/util/grub-install.c b/util/grub-install.c
-index 1ad04db36..a8a3330b8 100644
+index 060246589..059036d3c 100644
 --- a/util/grub-install.c
 +++ b/util/grub-install.c
 @@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
@@ -22,5 +22,5 @@ index 1ad04db36..a8a3330b8 100644
        have_cryptodisk = 1;
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
index 21e8630b..12f6f111 100644
--- a/config/grub/nvme/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch
+++ b/config/grub/default/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
@@ -1,7 +1,7 @@
-From 96c0bbe5d406b616360a7fce7cee67d7692c0d6d Mon Sep 17 00:00:00 2001
+From fc815438e70cbb13166ab6711b6f6460521b1fd4 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 30 Oct 2023 22:19:21 +0000
-Subject: [PATCH 1/1] at_keyboard coreboot: force scancodes2+translate
+Subject: [PATCH 09/14] at_keyboard coreboot: force scancodes2+translate
 
 Scan code set 2 with translation should be assumed in
 every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
    grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
    if (ps2_state.current_set == 2)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
index fbef86a4..8c0a5054 100644
--- a/config/grub/xhci/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch
+++ b/config/grub/default/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
@@ -1,7 +1,7 @@
-From 0a6abeb40ac4284fbff6ef5958989d561b6290a7 Mon Sep 17 00:00:00 2001
+From defb7ad35579c321d32b81af7ddd6fecf34cb618 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Tue, 31 Oct 2023 10:33:28 +0000
-Subject: [PATCH 1/1] keylayouts: don't print "Unknown key" message
+Subject: [PATCH 10/14] keylayouts: don't print "Unknown key" message
 
 on keyboards with stuck keys, this results in GRUB just
 spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
index 25091d16..cef7a273 100644
--- a/config/grub/xhci/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch
+++ b/config/grub/default/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
@@ -1,7 +1,7 @@
-From 9e7a651a0f15f2e9dec65a77765c3c4fd97b4165 Mon Sep 17 00:00:00 2001
+From d0345db429be8089145e0c072db9ac8db0b644bd Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:14:58 +0000
-Subject: [PATCH 1/1] don't print missing prefix errors on the screen
+Subject: [PATCH 11/14] don't print missing prefix errors on the screen
 
 we do actually set the prefix. this patch modifies
 grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
  	    }
  	  file = try_open_from_prefix (prefix, filename);
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 4011e2d15..af3bd00d0 100644
+index 4a3be8568..6ae3d73f8 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -758,7 +758,7 @@ grub_dl_load (const char *name)
+@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
      return 0;
  
    if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4011e2d15..af3bd00d0 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
index f4cf939e..e30c3f9a 100644
--- a/config/grub/xhci/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch
+++ b/config/grub/default/patches/0012-don-t-print-error-if-module-not-found.patch
@@ -1,7 +1,7 @@
-From 6237c5762edccc1e1fa4746b1d4aa5e8d81e4883 Mon Sep 17 00:00:00 2001
+From 2fe963570ac19e3390a792ca2c195112d4efdc24 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:36:22 +0000
-Subject: [PATCH 1/1] don't print error if module not found
+Subject: [PATCH 12/14] don't print error if module not found
 
 still set grub_errno accordingly, and otherwise
 behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index af3bd00d0..21d0cedb1 100644
+index 6ae3d73f8..4c15027fe 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -486,7 +486,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
+@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
  
    s = grub_dl_find_section (e, ".modname");
    if (!s)
@@ -30,5 +30,5 @@ index af3bd00d0..21d0cedb1 100644
    mod->name = grub_strdup ((char *) e + s->sh_offset);
    if (! mod->name)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
index 25221c9c..0cdadbe9 100644
--- a/config/grub/default/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch
+++ b/config/grub/default/patches/0013-don-t-print-empty-error-messages.patch
@@ -1,7 +1,7 @@
-From e5b7ec81421487e71bcaf8b6b5a27f3649a62753 Mon Sep 17 00:00:00 2001
+From 5a1dd3c19307859aac7d1a22a7a0c0c7ffb09ddb Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 17:25:20 +0000
-Subject: [PATCH 1/1] don't print empty error messages
+Subject: [PATCH 13/14] don't print empty error messages
 
 this is part two of the quest to kill the prefix
 error message. after i disabled prefix-related
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
  	}
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
new file mode 100644
index 00000000..78e4eafc
--- /dev/null
+++ b/config/grub/default/patches/0014-kern-coreboot-mmap-Map-to-reserved.patch
@@ -0,0 +1,37 @@
+From 818f1b19f32e355cc2a0ebe29eee2a2bac7bcb3f Mon Sep 17 00:00:00 2001
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Mon, 17 May 2021 10:24:36 +0200
+Subject: [PATCH 14/14] kern/coreboot/mmap: Map to reserved
+
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
+
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+---
+ grub-core/kern/coreboot/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/kern/coreboot/mmap.c b/grub-core/kern/coreboot/mmap.c
+index caf8f7cef..2fc316e8d 100644
+--- a/grub-core/kern/coreboot/mmap.c
++++ b/grub-core/kern/coreboot/mmap.c
+@@ -59,7 +59,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 			    /* Multiboot mmaps match with the coreboot mmap
+ 			       definition.  Therefore, we can just pass type
+ 			       through.  */
+-			    mem_region->type,
++			    (mem_region->type >= 13) ? 2 : mem_region->type,
+ 			    ctx->hook_data))
+ 	    return 1;
+ 	  if (start < 0xa0000)
+@@ -81,7 +81,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 		     /* Multiboot mmaps match with the coreboot mmap
+ 		        definition.  Therefore, we can just pass type
+ 		        through.  */
+-		     mem_region->type,
++		     (mem_region->type >= 13) ? 2 : mem_region->type,
+ 		     ctx->hook_data))
+ 	return 1;
+     }
+-- 
+2.39.5
+
diff --git a/config/grub/default/target.cfg b/config/grub/default/target.cfg
index e6ed598b..6a13a189 100644
--- a/config/grub/default/target.cfg
+++ b/config/grub/default/target.cfg
@@ -1,2 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 tree="default"
-rev="8719cc2040368d43ab2de0b6e1b850b2c9cfc5b7"
+rev="a68a7dece464c35b1c8d20b98502b6881b103911"
diff --git a/config/grub/nvme/config/payload b/config/grub/nvme/config/payload
index 2f9c7114..4f3de36e 100644
--- a/config/grub/nvme/config/payload
+++ b/config/grub/nvme/config/payload
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# Copyright (C) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
+# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
 # Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
 
 set prefix=(memdisk)/boot/grub
@@ -155,16 +155,12 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
-	# TODO: add more strings, based on what distros set up when
-	# the user select auto-partitioning on those installers
-	lvmvol="lvm/grubcrypt-bootvol lvm/grubcrypt-rootvol"
-
 	raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
 
-	# in practise, doing multiple redundant checks is perfectly fast and
+	# in practise, doing multiple redundant checks is perfectly fast
 	# TODO: optimize grub itself, and use */? here for everything
 
-	for vol in ${lvmvol} ${raidvol} ; do
+	for vol in ${raidvol} ; do
 		try_bootcfg "${vol}"
 	done
 
@@ -186,23 +182,37 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${bootdev} ${lvmvol} ${raidvol}; do
+	for dev in ${bootdev} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
 	echo
 
+	search_bootcfg crypto
+
+	lvmvol=""
+
 	# after cryptomount, lvm volumes might be available
+	# using * is slow on some machines, but we use it here,
+	# just once. in so doing, we find every lvm volume
+	for vol in (*); do
+		if regexp ^\\(lvm/ $vol; then
+			lvmvol="${lvmvol} ${vol}"
+			try_bootcfg "${vol}"
+		fi
+	done
+
+	# user might have put luks inside lvm
+	set pager=0
+	echo "Attempting to unlock encrypted LVMs"
 	for vol in ${lvmvol}; do
-		try_bootcfg "${vol}"
+		cryptomount "$vol"
 	done
+	set pager=1
+	echo
 
 	search_bootcfg crypto
 
-	for vol in lvm/* ; do
-		try_bootcfg "${vol}"
-	done
-
 	true # Prevent pager requiring to accept each line instead of whole screen
 }
 
@@ -234,18 +244,38 @@ menuentry 'Load test configuration (grubtest.cfg) inside of CBFS  [t]' --hotkey=
 	fi
 }
 fi
+if [ -f (cbfsdisk)/u-boot ]; then
+menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
+	set root='cbfsdisk'
+	chainloader /u-boot
+}
+fi
 if [ -f (cbfsdisk)/seabios.elf ]; then
-menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /seabios.elf
+}
+else
+menuentry 'Load SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /seabios.elf
 }
 fi
+fi
 if [ -f (cbfsdisk)/img/grub2 ]; then
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /fallback/payload
+}
+else
 menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /fallback/payload
 }
 fi
+fi
 menuentry 'Poweroff  [p]' --hotkey='p' {
 	halt
 }
diff --git a/config/grub/xhci/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch b/config/grub/nvme/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
index 183f5a91..1c55b85a 100644
--- a/config/grub/xhci/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+++ b/config/grub/nvme/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
@@ -1,7 +1,7 @@
-From ce13539fe2103abbd991814d995e06cf96e485f7 Mon Sep 17 00:00:00 2001
+From 759a673b3c4601a32837f2b26661d2998f6cb8d6 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 31 Oct 2021 03:47:05 +0000
-Subject: [PATCH 1/3] mitigate grub's missing characters for borders/arrow
+Subject: [PATCH 01/15] mitigate grub's missing characters for borders/arrow
  characters
 
 This cleans up the display on the main screen in GRUB.
@@ -12,7 +12,7 @@ Just don't draw a border, at all.
  1 file changed, 2 insertions(+), 47 deletions(-)
 
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..e76094dfd 100644
+index 9c383e64a..8ec1dd1e8 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -108,47 +108,6 @@ grub_print_message_indented (const char *msg, int margin_left, int margin_right,
@@ -76,7 +76,7 @@ index b1321eb26..e76094dfd 100644
        if (!msg_translated)
  	return 0;
        ret += grub_print_message_indented_real (msg_translated, STANDARD_MARGIN,
-@@ -410,8 +367,6 @@ grub_menu_init_page (int nested, int edit,
+@@ -413,8 +370,6 @@ grub_menu_init_page (int nested, int edit,
  
    grub_term_normal_color = grub_color_menu_normal;
    grub_term_highlight_color = grub_color_menu_highlight;
@@ -86,5 +86,5 @@ index b1321eb26..e76094dfd 100644
    grub_term_highlight_color = old_color_highlight;
    geo->timeout_y = geo->first_entry_y + geo->num_entries
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch b/config/grub/nvme/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
index b83565fe..8515f2a8 100644
--- a/config/grub/default/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch
+++ b/config/grub/nvme/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
@@ -1,14 +1,14 @@
-From 70f9e72c3ff6381fe3519612de3b649c0cf26b9a Mon Sep 17 00:00:00 2001
+From 88007c24f8bceb97d0aecf31545c3b49b380b1a6 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 16:30:24 +0000
-Subject: [PATCH 2/3] say the name libreboot, in the grub menu
+Subject: [PATCH 02/15] say the name libreboot, in the grub menu
 
 ---
  grub-core/normal/main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index bd4431000..31308e16a 100644
+index 96abfda2f..d806db9c4 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -16,10 +16,10 @@ index bd4431000..31308e16a 100644
    grub_term_cls (term);
  
 -  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
-+  msg_formatted = grub_xasprintf (_("Libreboot 20240612 release, based on coreboot.    https://libreboot.org/"));
++  msg_formatted = grub_xasprintf (_("Libreboot 25.06 Luminous Lemon (GRUB menu): https://libreboot.org/"));
    if (!msg_formatted)
      return;
  
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0003-Add-CC0-license.patch b/config/grub/nvme/patches/0003-Add-CC0-license.patch
index dc9060c3..5b09922b 100644
--- a/config/grub/nvme/patches/0002-luks2/0003-Add-CC0-license.patch
+++ b/config/grub/nvme/patches/0003-Add-CC0-license.patch
@@ -1,7 +1,7 @@
-From de6e7cc62522ce1be21bd2f06e7c15cd234b5426 Mon Sep 17 00:00:00 2001
+From d1925aadf848c269b35a3004c104e014df582536 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 1/6] Add CC0 license
+Subject: [PATCH 03/15] Add CC0 license
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -10,10 +10,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 0bf40caa6..4011e2d15 100644
+index de8c3aa8d..4a3be8568 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -470,7 +470,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
+@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
  
    if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
        || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
@@ -38,5 +38,5 @@ index a42c20bd1..7157a30aa 100644
    grub_util_error ("%s: incompatible license", filename);
  }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch b/config/grub/nvme/patches/0004-Define-GRUB_UINT32_MAX.patch
index be875e67..be0e6b13 100644
--- a/config/grub/xhci/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch
+++ b/config/grub/nvme/patches/0004-Define-GRUB_UINT32_MAX.patch
@@ -1,7 +1,7 @@
-From 9edaaffac91d593a439e44bac3b6f5558f5a8245 Mon Sep 17 00:00:00 2001
+From b0adafee9fcd820dd9d1c03a9619953cb3407854 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 2/6] Define GRUB_UINT32_MAX
+Subject: [PATCH 04/15] Define GRUB_UINT32_MAX
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+)
 
 diff --git a/include/grub/types.h b/include/grub/types.h
-index 0d96006fe..a13f3a60b 100644
+index 45079bf65..8c0b30395 100644
 --- a/include/grub/types.h
 +++ b/include/grub/types.h
 @@ -156,6 +156,7 @@ typedef grub_int32_t	grub_ssize_t;
@@ -35,5 +35,5 @@ index 0d96006fe..a13f3a60b 100644
  
  #define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0005-Add-Argon2-algorithm.patch b/config/grub/nvme/patches/0005-Add-Argon2-algorithm.patch
index 1c6b4f04..772a05d9 100644
--- a/config/grub/nvme/patches/0002-luks2/0005-Add-Argon2-algorithm.patch
+++ b/config/grub/nvme/patches/0005-Add-Argon2-algorithm.patch
@@ -1,7 +1,7 @@
-From 5b63da5c4267933f573ca37ce39a073098c443ba Mon Sep 17 00:00:00 2001
+From c42e09330674005d8b2d74f75fca387af87e5465 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 3/6] Add Argon2 algorithm
+Subject: [PATCH 05/15] Add Argon2 algorithm
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -30,10 +30,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  create mode 100644 grub-core/lib/argon2/ref.c
 
 diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
-index a695b02f0..313335a53 100644
+index f4367f895..9d96cedf9 100644
 --- a/docs/grub-dev.texi
 +++ b/docs/grub-dev.texi
-@@ -503,11 +503,75 @@ GRUB includes some code from other projects, and it is sometimes necessary
+@@ -503,12 +503,76 @@ GRUB includes some code from other projects, and it is sometimes necessary
  to update it.
  
  @menu
@@ -41,6 +41,7 @@ index a695b02f0..313335a53 100644
  * Gnulib::
  * jsmn::
  * minilzo::
+ * libtasn1::
  @end menu
  
 +@node Argon2
@@ -110,10 +111,10 @@ index a695b02f0..313335a53 100644
  @section Gnulib
  
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index d2cf29584..4a06789e5 100644
+index 24e8c8437..0ee65d54d 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1215,6 +1215,14 @@ module = {
+@@ -1219,6 +1219,14 @@ module = {
    common = lib/json/json.c;
  };
  
@@ -2607,5 +2608,5 @@ index 000000000..c933df80d
 +    }
 +}
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch b/config/grub/nvme/patches/0006-Error-on-missing-Argon2id-parameters.patch
index 5d56bd61..508fd740 100644
--- a/config/grub/default/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch
+++ b/config/grub/nvme/patches/0006-Error-on-missing-Argon2id-parameters.patch
@@ -1,7 +1,7 @@
-From 0044d32121bf52c4547c6b3c78f12d7305f57e6b Mon Sep 17 00:00:00 2001
+From 6c74f4ff91f741e74dca1accc6c173c277f4ca5b Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 4/6] Error on missing Argon2id parameters
+Subject: [PATCH 06/15] Error on missing Argon2id parameters
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d5106402f..bc818ea69 100644
+index b17cd2115..bbd8f5579 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -38,6 +38,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
  enum grub_luks2_kdf_type
  {
    LUKS2_KDF_TYPE_ARGON2I,
@@ -20,7 +20,7 @@ index d5106402f..bc818ea69 100644
    LUKS2_KDF_TYPE_PBKDF2
  };
  typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
-@@ -90,7 +91,7 @@ struct grub_luks2_keyslot
+@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
  	grub_int64_t time;
  	grub_int64_t memory;
  	grub_int64_t cpus;
@@ -29,7 +29,7 @@ index d5106402f..bc818ea69 100644
        struct
        {
  	const char   *hash;
-@@ -160,10 +161,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
+@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
    else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
      {
@@ -45,7 +45,7 @@ index d5106402f..bc818ea69 100644
  	return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
      }
    else if (!grub_strcmp (type, "pbkdf2"))
-@@ -459,6 +461,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
    switch (k->kdf.type)
      {
        case LUKS2_KDF_TYPE_ARGON2I:
@@ -54,5 +54,5 @@ index d5106402f..bc818ea69 100644
  	goto err;
        case LUKS2_KDF_TYPE_PBKDF2:
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch b/config/grub/nvme/patches/0007-Compile-with-Argon2id-support.patch
index f2e26fd4..1cfe1ab7 100644
--- a/config/grub/nvme/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch
+++ b/config/grub/nvme/patches/0007-Compile-with-Argon2id-support.patch
@@ -1,7 +1,7 @@
-From 0a21695c55f76f1c958bb633481d55b3168562f7 Mon Sep 17 00:00:00 2001
+From 50157401f90366e5b7c8f80ae7bc59c2276f7c35 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 5/6] Compile with Argon2id support
+Subject: [PATCH 07/15] Compile with Argon2id support
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -11,7 +11,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  3 files changed, 17 insertions(+), 4 deletions(-)
 
 diff --git a/Makefile.util.def b/Makefile.util.def
-index 1e9a13d3e..a167825c3 100644
+index 038253b37..2f19569c9 100644
 --- a/Makefile.util.def
 +++ b/Makefile.util.def
 @@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
@@ -35,10 +35,10 @@ index 1e9a13d3e..a167825c3 100644
    common = grub-core/disk/luks.c;
    common = grub-core/disk/luks2.c;
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 4a06789e5..e939dcc99 100644
+index 0ee65d54d..cd29a9df8 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1238,7 +1238,7 @@ module = {
+@@ -1242,7 +1242,7 @@ module = {
    common = disk/luks2.c;
    common = lib/gnulib/base64.c;
    cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
@@ -48,18 +48,18 @@ index 4a06789e5..e939dcc99 100644
  
  module = {
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index bc818ea69..5b9eaa599 100644
+index bbd8f5579..02cd615d9 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -27,6 +27,7 @@
- #include <grub/partition.h>
+@@ -28,6 +28,7 @@
  #include <grub/i18n.h>
+ #include <grub/safemath.h>
  
 +#include <argon2.h>
  #include <base64.h>
  #include <json.h>
  
-@@ -462,8 +463,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
      {
        case LUKS2_KDF_TYPE_ARGON2I:
        case LUKS2_KDF_TYPE_ARGON2ID:
@@ -79,5 +79,5 @@ index bc818ea69..5b9eaa599 100644
  	hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
  	if (!hash)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch b/config/grub/nvme/patches/0008-Make-grub-install-work-with-Argon2.patch
index dc65b7a6..bdf9343e 100644
--- a/config/grub/xhci/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
+++ b/config/grub/nvme/patches/0008-Make-grub-install-work-with-Argon2.patch
@@ -1,7 +1,7 @@
-From 6c9a6625c0dc038d1bdbdc13665f40e269e86496 Mon Sep 17 00:00:00 2001
+From 2f7814e55cbae04cb2b307fee559f40cdc70609c Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 6/6] Make grub-install work with Argon2
+Subject: [PATCH 08/15] Make grub-install work with Argon2
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 2 insertions(+)
 
 diff --git a/util/grub-install.c b/util/grub-install.c
-index 1ad04db36..a8a3330b8 100644
+index 060246589..059036d3c 100644
 --- a/util/grub-install.c
 +++ b/util/grub-install.c
 @@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
@@ -22,5 +22,5 @@ index 1ad04db36..a8a3330b8 100644
        have_cryptodisk = 1;
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch b/config/grub/nvme/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
index 21e8630b..3a8591d1 100644
--- a/config/grub/xhci/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch
+++ b/config/grub/nvme/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
@@ -1,7 +1,7 @@
-From 96c0bbe5d406b616360a7fce7cee67d7692c0d6d Mon Sep 17 00:00:00 2001
+From a90a11f02d5bfc8b9f9e1253a67906fde9102a14 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 30 Oct 2023 22:19:21 +0000
-Subject: [PATCH 1/1] at_keyboard coreboot: force scancodes2+translate
+Subject: [PATCH 09/15] at_keyboard coreboot: force scancodes2+translate
 
 Scan code set 2 with translation should be assumed in
 every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
    grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
    if (ps2_state.current_set == 2)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch b/config/grub/nvme/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
index fbef86a4..8cc2f1b6 100644
--- a/config/grub/nvme/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch
+++ b/config/grub/nvme/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
@@ -1,7 +1,7 @@
-From 0a6abeb40ac4284fbff6ef5958989d561b6290a7 Mon Sep 17 00:00:00 2001
+From 86d06a8075d87cdaece0c5495f7505ff01f1e752 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Tue, 31 Oct 2023 10:33:28 +0000
-Subject: [PATCH 1/1] keylayouts: don't print "Unknown key" message
+Subject: [PATCH 10/15] keylayouts: don't print "Unknown key" message
 
 on keyboards with stuck keys, this results in GRUB just
 spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch b/config/grub/nvme/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
index 25091d16..4f7014d8 100644
--- a/config/grub/nvme/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch
+++ b/config/grub/nvme/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
@@ -1,7 +1,7 @@
-From 9e7a651a0f15f2e9dec65a77765c3c4fd97b4165 Mon Sep 17 00:00:00 2001
+From 92aab8e78e0a9dc400376f31fdd7eee980aa33aa Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:14:58 +0000
-Subject: [PATCH 1/1] don't print missing prefix errors on the screen
+Subject: [PATCH 11/15] don't print missing prefix errors on the screen
 
 we do actually set the prefix. this patch modifies
 grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
  	    }
  	  file = try_open_from_prefix (prefix, filename);
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 4011e2d15..af3bd00d0 100644
+index 4a3be8568..6ae3d73f8 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -758,7 +758,7 @@ grub_dl_load (const char *name)
+@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
      return 0;
  
    if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4011e2d15..af3bd00d0 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch b/config/grub/nvme/patches/0012-don-t-print-error-if-module-not-found.patch
index f4cf939e..fb4c836a 100644
--- a/config/grub/nvme/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch
+++ b/config/grub/nvme/patches/0012-don-t-print-error-if-module-not-found.patch
@@ -1,7 +1,7 @@
-From 6237c5762edccc1e1fa4746b1d4aa5e8d81e4883 Mon Sep 17 00:00:00 2001
+From 62f4bd17485c3d65649de2cef398ec708f35ea9d Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:36:22 +0000
-Subject: [PATCH 1/1] don't print error if module not found
+Subject: [PATCH 12/15] don't print error if module not found
 
 still set grub_errno accordingly, and otherwise
 behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index af3bd00d0..21d0cedb1 100644
+index 6ae3d73f8..4c15027fe 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -486,7 +486,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
+@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
  
    s = grub_dl_find_section (e, ".modname");
    if (!s)
@@ -30,5 +30,5 @@ index af3bd00d0..21d0cedb1 100644
    mod->name = grub_strdup ((char *) e + s->sh_offset);
    if (! mod->name)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch b/config/grub/nvme/patches/0013-don-t-print-empty-error-messages.patch
index 25221c9c..90aefde6 100644
--- a/config/grub/xhci/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch
+++ b/config/grub/nvme/patches/0013-don-t-print-empty-error-messages.patch
@@ -1,7 +1,7 @@
-From e5b7ec81421487e71bcaf8b6b5a27f3649a62753 Mon Sep 17 00:00:00 2001
+From 97381d8c85c0934ca500f07339d89f9f6245b079 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 17:25:20 +0000
-Subject: [PATCH 1/1] don't print empty error messages
+Subject: [PATCH 13/15] don't print empty error messages
 
 this is part two of the quest to kill the prefix
 error message. after i disabled prefix-related
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
  	}
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0006-nvme/0001-Add-native-NVMe-driver-based-on-SeaBIOS.patch b/config/grub/nvme/patches/0014-Add-native-NVMe-driver-based-on-SeaBIOS.patch
index 4345ebae..a181ddc9 100644
--- a/config/grub/nvme/patches/0006-nvme/0001-Add-native-NVMe-driver-based-on-SeaBIOS.patch
+++ b/config/grub/nvme/patches/0014-Add-native-NVMe-driver-based-on-SeaBIOS.patch
@@ -1,7 +1,7 @@
-From 708c0092d44aec6409e0ecc1925cdbb3b76c6dfd Mon Sep 17 00:00:00 2001
+From c8d5481586133d7738a9e2d27b5554470bef719d Mon Sep 17 00:00:00 2001
 From: Mate Kukri <km@mkukri.xyz>
 Date: Mon, 20 May 2024 11:43:35 +0100
-Subject: [PATCH 1/1] Add native NVMe driver based on SeaBIOS
+Subject: [PATCH 14/15] Add native NVMe driver based on SeaBIOS
 
 Tested to successfully boot Debian on QEMU and OptiPlex 3050.
 
@@ -31,12 +31,12 @@ index 43635d5ff..2c86dbbf6 100644
  
  endif
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 560c66447..d3bf9f1c5 100644
+index cd29a9df8..0034f8c61 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -2607,3 +2607,9 @@ module = {
-   efi = commands/bli.c;
-   enable = efi;
+@@ -2682,3 +2682,9 @@ module = {
+   cflags = '-Wno-uninitialized';
+   cppflags = '-I$(srcdir)/lib/libtasn1-grub -I$(srcdir)/tests/asn1/';
  };
 +
 +module = {
@@ -1070,5 +1070,5 @@ index fbf23df7f..186e76f0b 100644
  
  struct grub_disk;
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0015-kern-coreboot-mmap-Map-to-reserved.patch b/config/grub/nvme/patches/0015-kern-coreboot-mmap-Map-to-reserved.patch
new file mode 100644
index 00000000..06ebc37c
--- /dev/null
+++ b/config/grub/nvme/patches/0015-kern-coreboot-mmap-Map-to-reserved.patch
@@ -0,0 +1,37 @@
+From 9228fa35d5af64e67a33372231baa3862f6fad67 Mon Sep 17 00:00:00 2001
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Mon, 17 May 2021 10:24:36 +0200
+Subject: [PATCH 15/15] kern/coreboot/mmap: Map to reserved
+
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
+
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+---
+ grub-core/kern/coreboot/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/kern/coreboot/mmap.c b/grub-core/kern/coreboot/mmap.c
+index caf8f7cef..2fc316e8d 100644
+--- a/grub-core/kern/coreboot/mmap.c
++++ b/grub-core/kern/coreboot/mmap.c
+@@ -59,7 +59,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 			    /* Multiboot mmaps match with the coreboot mmap
+ 			       definition.  Therefore, we can just pass type
+ 			       through.  */
+-			    mem_region->type,
++			    (mem_region->type >= 13) ? 2 : mem_region->type,
+ 			    ctx->hook_data))
+ 	    return 1;
+ 	  if (start < 0xa0000)
+@@ -81,7 +81,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 		     /* Multiboot mmaps match with the coreboot mmap
+ 		        definition.  Therefore, we can just pass type
+ 		        through.  */
+-		     mem_region->type,
++		     (mem_region->type >= 13) ? 2 : mem_region->type,
+ 		     ctx->hook_data))
+ 	return 1;
+     }
+-- 
+2.39.5
+
diff --git a/config/grub/nvme/target.cfg b/config/grub/nvme/target.cfg
index 97a0deb5..0aff1315 100644
--- a/config/grub/nvme/target.cfg
+++ b/config/grub/nvme/target.cfg
@@ -1,2 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 tree="nvme"
-rev="8719cc2040368d43ab2de0b6e1b850b2c9cfc5b7"
+rev="a68a7dece464c35b1c8d20b98502b6881b103911"
diff --git a/config/grub/xhci/config/payload b/config/grub/xhci/config/payload
index 923e3551..9db22fe2 100644
--- a/config/grub/xhci/config/payload
+++ b/config/grub/xhci/config/payload
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# Copyright (C) 2014-2016,2020-2021,2023-2024 Leah Rowe <leah@libreboot.org>
+# Copyright (C) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org>
 # Copyright (C) 2015 Klemens Nanni <contact@autoboot.org>
 
 set prefix=(memdisk)/boot/grub
@@ -156,16 +156,12 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
-	# TODO: add more strings, based on what distros set up when
-	# the user select auto-partitioning on those installers
-	lvmvol="lvm/grubcrypt-bootvol lvm/grubcrypt-rootvol"
-
 	raidvol="md/0 md/1 md/2 md/3 md/4 md/5 md/6 md/7 md/8 md/9"
 
-	# in practise, doing multiple redundant checks is perfectly fast and
+	# in practise, doing multiple redundant checks is perfectly fast
 	# TODO: optimize grub itself, and use */? here for everything
 
-	for vol in ${lvmvol} ${raidvol} ; do
+	for vol in ${raidvol} ; do
 		try_bootcfg "${vol}"
 	done
 
@@ -187,23 +183,37 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${bootdev} ${lvmvol} ${raidvol}; do
+	for dev in ${bootdev} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
 	echo
 
+	search_bootcfg crypto
+
+	lvmvol=""
+
 	# after cryptomount, lvm volumes might be available
+	# using * is slow on some machines, but we use it here,
+	# just once. in so doing, we find every lvm volume
+	for vol in (*); do
+		if regexp ^\\(lvm/ $vol; then
+			lvmvol="${lvmvol} ${vol}"
+			try_bootcfg "${vol}"
+		fi
+	done
+
+	# user might have put luks inside lvm
+	set pager=0
+	echo "Attempting to unlock encrypted LVMs"
 	for vol in ${lvmvol}; do
-		try_bootcfg "${vol}"
+		cryptomount "$vol"
 	done
+	set pager=1
+	echo
 
 	search_bootcfg crypto
 
-	for vol in lvm/* ; do
-		try_bootcfg "${vol}"
-	done
-
 	true # Prevent pager requiring to accept each line instead of whole screen
 }
 
@@ -235,18 +245,38 @@ menuentry 'Load test configuration (grubtest.cfg) in CBFS  [t]' --hotkey='t' {
 	fi
 }
 fi
+if [ -f (cbfsdisk)/u-boot ]; then
+menuentry 'U-Boot i386 payload (experimental) [u]' --hotkey='u' {
+	set root='cbfsdisk'
+	chainloader /u-boot
+}
+fi
 if [ -f (cbfsdisk)/seabios.elf ]; then
-menuentry 'Load SeaBIOS (payload) [b]' --hotkey='b' {
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Load SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /seabios.elf
+}
+else
+menuentry 'Load SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /seabios.elf
 }
 fi
+fi
 if [ -f (cbfsdisk)/img/grub2 ]; then
+if [ -f (cbfsdisk)/img/u-boot ]; then
+menuentry 'Return to SeaBIOS (U-Boot UEFI available in the ESC menu) [b]' --hotkey='b' {
+	set root='cbfsdisk'
+	chainloader /fallback/payload
+}
+else
 menuentry 'Return to SeaBIOS [b]' --hotkey='b' {
 	set root='cbfsdisk'
 	chainloader /fallback/payload
 }
 fi
+fi
 menuentry 'Poweroff  [p]' --hotkey='p' {
 	halt
 }
diff --git a/config/grub/nvme/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch b/config/grub/xhci/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
index 183f5a91..d480d60a 100644
--- a/config/grub/nvme/patches/0001-borderfix/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
+++ b/config/grub/xhci/patches/0001-mitigate-grub-s-missing-characters-for-borders-arrow.patch
@@ -1,7 +1,7 @@
-From ce13539fe2103abbd991814d995e06cf96e485f7 Mon Sep 17 00:00:00 2001
+From 6a04ceb244366ddab75ce229afd19687ce35d15a Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 31 Oct 2021 03:47:05 +0000
-Subject: [PATCH 1/3] mitigate grub's missing characters for borders/arrow
+Subject: [PATCH 01/26] mitigate grub's missing characters for borders/arrow
  characters
 
 This cleans up the display on the main screen in GRUB.
@@ -12,7 +12,7 @@ Just don't draw a border, at all.
  1 file changed, 2 insertions(+), 47 deletions(-)
 
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..e76094dfd 100644
+index 9c383e64a..8ec1dd1e8 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -108,47 +108,6 @@ grub_print_message_indented (const char *msg, int margin_left, int margin_right,
@@ -76,7 +76,7 @@ index b1321eb26..e76094dfd 100644
        if (!msg_translated)
  	return 0;
        ret += grub_print_message_indented_real (msg_translated, STANDARD_MARGIN,
-@@ -410,8 +367,6 @@ grub_menu_init_page (int nested, int edit,
+@@ -413,8 +370,6 @@ grub_menu_init_page (int nested, int edit,
  
    grub_term_normal_color = grub_color_menu_normal;
    grub_term_highlight_color = grub_color_menu_highlight;
@@ -86,5 +86,5 @@ index b1321eb26..e76094dfd 100644
    grub_term_highlight_color = old_color_highlight;
    geo->timeout_y = geo->first_entry_y + geo->num_entries
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/nvme/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch b/config/grub/xhci/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
index b83565fe..e50e6c6a 100644
--- a/config/grub/nvme/patches/0001-borderfix/0002-say-the-name-libreboot-in-the-grub-menu.patch
+++ b/config/grub/xhci/patches/0002-say-the-name-libreboot-in-the-grub-menu.patch
@@ -1,14 +1,14 @@
-From 70f9e72c3ff6381fe3519612de3b649c0cf26b9a Mon Sep 17 00:00:00 2001
+From c18175417d4fa4501dac21ef26b9c30f67ece0fd Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sat, 19 Nov 2022 16:30:24 +0000
-Subject: [PATCH 2/3] say the name libreboot, in the grub menu
+Subject: [PATCH 02/26] say the name libreboot, in the grub menu
 
 ---
  grub-core/normal/main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index bd4431000..31308e16a 100644
+index 96abfda2f..d806db9c4 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -209,7 +209,7 @@ grub_normal_init_page (struct grub_term_output *term,
@@ -16,10 +16,10 @@ index bd4431000..31308e16a 100644
    grub_term_cls (term);
  
 -  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
-+  msg_formatted = grub_xasprintf (_("Libreboot 20240612 release, based on coreboot.    https://libreboot.org/"));
++  msg_formatted = grub_xasprintf (_("Libreboot 25.06 Luminous Lemon (GRUB menu): https://libreboot.org/"));
    if (!msg_formatted)
      return;
  
 -- 
-2.25.1
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch b/config/grub/xhci/patches/0003-Add-CC0-license.patch
index dc9060c3..c2fd1c01 100644
--- a/config/grub/default/patches/0002-luks2/0003-Add-CC0-license.patch
+++ b/config/grub/xhci/patches/0003-Add-CC0-license.patch
@@ -1,7 +1,7 @@
-From de6e7cc62522ce1be21bd2f06e7c15cd234b5426 Mon Sep 17 00:00:00 2001
+From 72b0b0f76b3cc7f03e42322b77400b89c3ccf766 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 1/6] Add CC0 license
+Subject: [PATCH 03/26] Add CC0 license
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -10,10 +10,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 0bf40caa6..4011e2d15 100644
+index de8c3aa8d..4a3be8568 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -470,7 +470,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
+@@ -495,7 +495,8 @@ grub_dl_check_license (grub_dl_t mod, Elf_Ehdr *e)
  
    if (grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3") == 0
        || grub_strcmp ((char *) e + s->sh_offset, "LICENSE=GPLv3+") == 0
@@ -38,5 +38,5 @@ index a42c20bd1..7157a30aa 100644
    grub_util_error ("%s: incompatible license", filename);
  }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch b/config/grub/xhci/patches/0004-Define-GRUB_UINT32_MAX.patch
index be875e67..d41c802e 100644
--- a/config/grub/default/patches/0002-luks2/0004-Define-GRUB_UINT32_MAX.patch
+++ b/config/grub/xhci/patches/0004-Define-GRUB_UINT32_MAX.patch
@@ -1,7 +1,7 @@
-From 9edaaffac91d593a439e44bac3b6f5558f5a8245 Mon Sep 17 00:00:00 2001
+From 451ca97719aa9178f3202554c74ab636baece616 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 2/6] Define GRUB_UINT32_MAX
+Subject: [PATCH 04/26] Define GRUB_UINT32_MAX
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+)
 
 diff --git a/include/grub/types.h b/include/grub/types.h
-index 0d96006fe..a13f3a60b 100644
+index 45079bf65..8c0b30395 100644
 --- a/include/grub/types.h
 +++ b/include/grub/types.h
 @@ -156,6 +156,7 @@ typedef grub_int32_t	grub_ssize_t;
@@ -35,5 +35,5 @@ index 0d96006fe..a13f3a60b 100644
  
  #define GRUB_PROPERLY_ALIGNED_ARRAY(name, size) grub_properly_aligned_t name[((size) + sizeof (grub_properly_aligned_t) - 1) / sizeof (grub_properly_aligned_t)]
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0002-luks2/0005-Add-Argon2-algorithm.patch b/config/grub/xhci/patches/0005-Add-Argon2-algorithm.patch
index 1c6b4f04..d2d202db 100644
--- a/config/grub/xhci/patches/0002-luks2/0005-Add-Argon2-algorithm.patch
+++ b/config/grub/xhci/patches/0005-Add-Argon2-algorithm.patch
@@ -1,7 +1,7 @@
-From 5b63da5c4267933f573ca37ce39a073098c443ba Mon Sep 17 00:00:00 2001
+From 93404ba667dae9a5da9953f7a17245adfe529c78 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 3/6] Add Argon2 algorithm
+Subject: [PATCH 05/26] Add Argon2 algorithm
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -30,10 +30,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  create mode 100644 grub-core/lib/argon2/ref.c
 
 diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi
-index a695b02f0..313335a53 100644
+index f4367f895..9d96cedf9 100644
 --- a/docs/grub-dev.texi
 +++ b/docs/grub-dev.texi
-@@ -503,11 +503,75 @@ GRUB includes some code from other projects, and it is sometimes necessary
+@@ -503,12 +503,76 @@ GRUB includes some code from other projects, and it is sometimes necessary
  to update it.
  
  @menu
@@ -41,6 +41,7 @@ index a695b02f0..313335a53 100644
  * Gnulib::
  * jsmn::
  * minilzo::
+ * libtasn1::
  @end menu
  
 +@node Argon2
@@ -110,10 +111,10 @@ index a695b02f0..313335a53 100644
  @section Gnulib
  
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index d2cf29584..4a06789e5 100644
+index 24e8c8437..0ee65d54d 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1215,6 +1215,14 @@ module = {
+@@ -1219,6 +1219,14 @@ module = {
    common = lib/json/json.c;
  };
  
@@ -2607,5 +2608,5 @@ index 000000000..c933df80d
 +    }
 +}
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch b/config/grub/xhci/patches/0006-Error-on-missing-Argon2id-parameters.patch
index 5d56bd61..3fc6d3dc 100644
--- a/config/grub/nvme/patches/0002-luks2/0006-Error-on-missing-Argon2id-parameters.patch
+++ b/config/grub/xhci/patches/0006-Error-on-missing-Argon2id-parameters.patch
@@ -1,7 +1,7 @@
-From 0044d32121bf52c4547c6b3c78f12d7305f57e6b Mon Sep 17 00:00:00 2001
+From c75424efa3a6357d4785c7a66721809a642b3968 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 4/6] Error on missing Argon2id parameters
+Subject: [PATCH 06/26] Error on missing Argon2id parameters
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 8 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d5106402f..bc818ea69 100644
+index b17cd2115..bbd8f5579 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -38,6 +38,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -39,6 +39,7 @@ GRUB_MOD_LICENSE ("GPLv3+");
  enum grub_luks2_kdf_type
  {
    LUKS2_KDF_TYPE_ARGON2I,
@@ -20,7 +20,7 @@ index d5106402f..bc818ea69 100644
    LUKS2_KDF_TYPE_PBKDF2
  };
  typedef enum grub_luks2_kdf_type grub_luks2_kdf_type_t;
-@@ -90,7 +91,7 @@ struct grub_luks2_keyslot
+@@ -91,7 +92,7 @@ struct grub_luks2_keyslot
  	grub_int64_t time;
  	grub_int64_t memory;
  	grub_int64_t cpus;
@@ -29,7 +29,7 @@ index d5106402f..bc818ea69 100644
        struct
        {
  	const char   *hash;
-@@ -160,10 +161,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
+@@ -161,10 +162,11 @@ luks2_parse_keyslot (grub_luks2_keyslot_t *out, const grub_json_t *keyslot)
      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing or invalid KDF");
    else if (!grub_strcmp (type, "argon2i") || !grub_strcmp (type, "argon2id"))
      {
@@ -45,7 +45,7 @@ index d5106402f..bc818ea69 100644
  	return grub_error (GRUB_ERR_BAD_ARGUMENT, "Missing Argon2i parameters");
      }
    else if (!grub_strcmp (type, "pbkdf2"))
-@@ -459,6 +461,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -460,6 +462,7 @@ luks2_decrypt_key (grub_uint8_t *out_key,
    switch (k->kdf.type)
      {
        case LUKS2_KDF_TYPE_ARGON2I:
@@ -54,5 +54,5 @@ index d5106402f..bc818ea69 100644
  	goto err;
        case LUKS2_KDF_TYPE_PBKDF2:
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch b/config/grub/xhci/patches/0007-Compile-with-Argon2id-support.patch
index f2e26fd4..0f9d92ee 100644
--- a/config/grub/default/patches/0002-luks2/0007-Compile-with-Argon2id-support.patch
+++ b/config/grub/xhci/patches/0007-Compile-with-Argon2id-support.patch
@@ -1,7 +1,7 @@
-From 0a21695c55f76f1c958bb633481d55b3168562f7 Mon Sep 17 00:00:00 2001
+From 801aa8b85d8f3b999f4660cc299a3517e811f0bb Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 5/6] Compile with Argon2id support
+Subject: [PATCH 07/26] Compile with Argon2id support
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -11,7 +11,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  3 files changed, 17 insertions(+), 4 deletions(-)
 
 diff --git a/Makefile.util.def b/Makefile.util.def
-index 1e9a13d3e..a167825c3 100644
+index 038253b37..2f19569c9 100644
 --- a/Makefile.util.def
 +++ b/Makefile.util.def
 @@ -3,7 +3,7 @@ AutoGen definitions Makefile.tpl;
@@ -35,10 +35,10 @@ index 1e9a13d3e..a167825c3 100644
    common = grub-core/disk/luks.c;
    common = grub-core/disk/luks2.c;
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index 4a06789e5..e939dcc99 100644
+index 0ee65d54d..cd29a9df8 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -1238,7 +1238,7 @@ module = {
+@@ -1242,7 +1242,7 @@ module = {
    common = disk/luks2.c;
    common = lib/gnulib/base64.c;
    cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)';
@@ -48,18 +48,18 @@ index 4a06789e5..e939dcc99 100644
  
  module = {
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index bc818ea69..5b9eaa599 100644
+index bbd8f5579..02cd615d9 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
-@@ -27,6 +27,7 @@
- #include <grub/partition.h>
+@@ -28,6 +28,7 @@
  #include <grub/i18n.h>
+ #include <grub/safemath.h>
  
 +#include <argon2.h>
  #include <base64.h>
  #include <json.h>
  
-@@ -462,8 +463,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
+@@ -463,8 +464,16 @@ luks2_decrypt_key (grub_uint8_t *out_key,
      {
        case LUKS2_KDF_TYPE_ARGON2I:
        case LUKS2_KDF_TYPE_ARGON2ID:
@@ -79,5 +79,5 @@ index bc818ea69..5b9eaa599 100644
  	hash = grub_crypto_lookup_md_by_name (k->kdf.u.pbkdf2.hash);
  	if (!hash)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch b/config/grub/xhci/patches/0008-Make-grub-install-work-with-Argon2.patch
index dc65b7a6..21ad8855 100644
--- a/config/grub/nvme/patches/0002-luks2/0008-Make-grub-install-work-with-Argon2.patch
+++ b/config/grub/xhci/patches/0008-Make-grub-install-work-with-Argon2.patch
@@ -1,7 +1,7 @@
-From 6c9a6625c0dc038d1bdbdc13665f40e269e86496 Mon Sep 17 00:00:00 2001
+From c114684bb103af427296e40b78adc0d036a9b237 Mon Sep 17 00:00:00 2001
 From: Ax333l <main@axelen.xyz>
 Date: Thu, 17 Aug 2023 00:00:00 +0000
-Subject: [PATCH 6/6] Make grub-install work with Argon2
+Subject: [PATCH 08/26] Make grub-install work with Argon2
 
 Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Nicholas Johnson <nick@nicholasjohnson.ch>
  1 file changed, 2 insertions(+)
 
 diff --git a/util/grub-install.c b/util/grub-install.c
-index 1ad04db36..a8a3330b8 100644
+index 060246589..059036d3c 100644
 --- a/util/grub-install.c
 +++ b/util/grub-install.c
 @@ -448,6 +448,8 @@ probe_mods (grub_disk_t disk)
@@ -22,5 +22,5 @@ index 1ad04db36..a8a3330b8 100644
        have_cryptodisk = 1;
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch b/config/grub/xhci/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
index 21e8630b..87164461 100644
--- a/config/grub/default/patches/0003-keyboardfix/0001-at_keyboard-coreboot-force-scancodes2-translate.patch
+++ b/config/grub/xhci/patches/0009-at_keyboard-coreboot-force-scancodes2-translate.patch
@@ -1,7 +1,7 @@
-From 96c0bbe5d406b616360a7fce7cee67d7692c0d6d Mon Sep 17 00:00:00 2001
+From dfbfe525d6f138e3db1e683096302045c064096f Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Mon, 30 Oct 2023 22:19:21 +0000
-Subject: [PATCH 1/1] at_keyboard coreboot: force scancodes2+translate
+Subject: [PATCH 09/26] at_keyboard coreboot: force scancodes2+translate
 
 Scan code set 2 with translation should be assumed in
 every case, as the default starting position.
@@ -103,5 +103,5 @@ index f8a129eb7..8207225c2 100644
    grub_dprintf ("atkeyb", "returned set %d\n", ps2_state.current_set);
    if (ps2_state.current_set == 2)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch b/config/grub/xhci/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
index fbef86a4..607f3541 100644
--- a/config/grub/default/patches/0003-keyboardfix/0002-keylayouts-don-t-print-Unknown-key-message.patch
+++ b/config/grub/xhci/patches/0010-keylayouts-don-t-print-Unknown-key-message.patch
@@ -1,7 +1,7 @@
-From 0a6abeb40ac4284fbff6ef5958989d561b6290a7 Mon Sep 17 00:00:00 2001
+From 18f88785a46e6657e1404e1914638f4768d65008 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Tue, 31 Oct 2023 10:33:28 +0000
-Subject: [PATCH 1/1] keylayouts: don't print "Unknown key" message
+Subject: [PATCH 10/26] keylayouts: don't print "Unknown key" message
 
 on keyboards with stuck keys, this results in GRUB just
 spewing it repeatedly, preventing use of GRUB.
@@ -34,5 +34,5 @@ index aa3ba34f2..445fa0601 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch b/config/grub/xhci/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
index 25091d16..4f03515e 100644
--- a/config/grub/default/patches/0004-prefix/0001-don-t-print-missing-prefix-errors-on-the-screen.patch
+++ b/config/grub/xhci/patches/0011-don-t-print-missing-prefix-errors-on-the-screen.patch
@@ -1,7 +1,7 @@
-From 9e7a651a0f15f2e9dec65a77765c3c4fd97b4165 Mon Sep 17 00:00:00 2001
+From afd68d1e132970e4fa8e26e9ca0ccb7efb69dc37 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:14:58 +0000
-Subject: [PATCH 1/1] don't print missing prefix errors on the screen
+Subject: [PATCH 11/26] don't print missing prefix errors on the screen
 
 we do actually set the prefix. this patch modifies
 grub to still set grub_errno and return accordingly,
@@ -85,10 +85,10 @@ index 18de52562..2a0fea6c8 100644
  	    }
  	  file = try_open_from_prefix (prefix, filename);
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 4011e2d15..af3bd00d0 100644
+index 4a3be8568..6ae3d73f8 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -758,7 +758,7 @@ grub_dl_load (const char *name)
+@@ -881,7 +881,7 @@ grub_dl_load (const char *name)
      return 0;
  
    if (! grub_dl_dir) {
@@ -98,5 +98,5 @@ index 4011e2d15..af3bd00d0 100644
    }
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch b/config/grub/xhci/patches/0012-don-t-print-error-if-module-not-found.patch
index f4cf939e..e817ca85 100644
--- a/config/grub/default/patches/0004-prefix/0002-don-t-print-error-if-module-not-found.patch
+++ b/config/grub/xhci/patches/0012-don-t-print-error-if-module-not-found.patch
@@ -1,7 +1,7 @@
-From 6237c5762edccc1e1fa4746b1d4aa5e8d81e4883 Mon Sep 17 00:00:00 2001
+From 06f9480a670d374e1599bf9871f6cd26656418a7 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 16:36:22 +0000
-Subject: [PATCH 1/1] don't print error if module not found
+Subject: [PATCH 12/26] don't print error if module not found
 
 still set grub_errno accordingly, and otherwise
 behave the same. in libreboot, we remove a lot of
@@ -17,10 +17,10 @@ Signed-off-by: Leah Rowe <leah@libreboot.org>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index af3bd00d0..21d0cedb1 100644
+index 6ae3d73f8..4c15027fe 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
-@@ -486,7 +486,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
+@@ -511,7 +511,7 @@ grub_dl_resolve_name (grub_dl_t mod, Elf_Ehdr *e)
  
    s = grub_dl_find_section (e, ".modname");
    if (!s)
@@ -30,5 +30,5 @@ index af3bd00d0..21d0cedb1 100644
    mod->name = grub_strdup ((char *) e + s->sh_offset);
    if (! mod->name)
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/nvme/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch b/config/grub/xhci/patches/0013-don-t-print-empty-error-messages.patch
index 25221c9c..4bf96b50 100644
--- a/config/grub/nvme/patches/0004-prefix/0003-don-t-print-empty-error-messages.patch
+++ b/config/grub/xhci/patches/0013-don-t-print-empty-error-messages.patch
@@ -1,7 +1,7 @@
-From e5b7ec81421487e71bcaf8b6b5a27f3649a62753 Mon Sep 17 00:00:00 2001
+From 272c5f5724c0790aff48b0d6ba75928de2275b33 Mon Sep 17 00:00:00 2001
 From: Leah Rowe <leah@libreboot.org>
 Date: Sun, 5 Nov 2023 17:25:20 +0000
-Subject: [PATCH 1/1] don't print empty error messages
+Subject: [PATCH 13/26] don't print empty error messages
 
 this is part two of the quest to kill the prefix
 error message. after i disabled prefix-related
@@ -27,5 +27,5 @@ index 53c734de7..7cac53983 100644
  	}
      }
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0001-grub-core-bus-usb-Parse-SuperSpeed-companion-descrip.patch b/config/grub/xhci/patches/0014-grub-core-bus-usb-Parse-SuperSpeed-companion-descrip.patch
index f533269f..c04e138e 100644
--- a/config/grub/xhci/patches/0005-xhci/0001-grub-core-bus-usb-Parse-SuperSpeed-companion-descrip.patch
+++ b/config/grub/xhci/patches/0014-grub-core-bus-usb-Parse-SuperSpeed-companion-descrip.patch
@@ -1,7 +1,8 @@
-From 90c9011f2e0350a97e3df44b0fc6dd022e04c276 Mon Sep 17 00:00:00 2001
+From 1c5716f42deb27b1111839b9782fd06b077eaa90 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
 Date: Sun, 15 Nov 2020 19:00:27 +0100
-Subject: [PATCH 1/8] grub-core/bus/usb: Parse SuperSpeed companion descriptors
+Subject: [PATCH 14/26] grub-core/bus/usb: Parse SuperSpeed companion
+ descriptors
 
 Parse the SS_ENDPOINT_COMPANION descriptor, which is only present on USB 3.0
 capable devices and xHCI controllers. Make the descendp an array of pointers
@@ -241,5 +242,5 @@ index aac5ab05a..bb2ab2e27 100644
  {
    grub_uint8_t length;
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0002-usb-Add-enum-for-xHCI.patch b/config/grub/xhci/patches/0015-usb-Add-enum-for-xHCI.patch
index d61da615..4de9d894 100644
--- a/config/grub/xhci/patches/0005-xhci/0002-usb-Add-enum-for-xHCI.patch
+++ b/config/grub/xhci/patches/0015-usb-Add-enum-for-xHCI.patch
@@ -1,7 +1,7 @@
-From e111983ca5e2a52bfe2bdc5cd639b06bb2f7902d Mon Sep 17 00:00:00 2001
+From 260f27e1ea1dbcdeb63d4411dbdddb97ebb39668 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
-Date: Sun, 15 Nov 2020 19:47:06 +0100
-Subject: [PATCH 2/8] usb: Add enum for xHCI
+Date: Mon, 7 Dec 2020 08:41:22 +0100
+Subject: [PATCH 15/26] usb: Add enum for xHCI
 
 Will be used in future patches.
 
@@ -25,5 +25,5 @@ index 688c11f6d..ea6ee8c2c 100644
  
  typedef int (*grub_usb_iterate_hook_t) (grub_usb_device_t dev, void *data);
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0003-usbtrans-Set-default-maximum-packet-size.patch b/config/grub/xhci/patches/0016-usbtrans-Set-default-maximum-packet-size.patch
index 70e73ca2..908c3adb 100644
--- a/config/grub/xhci/patches/0005-xhci/0003-usbtrans-Set-default-maximum-packet-size.patch
+++ b/config/grub/xhci/patches/0016-usbtrans-Set-default-maximum-packet-size.patch
@@ -1,7 +1,7 @@
-From 3e25c83a1d1c6e149c7e9f0660ddadb2beca2476 Mon Sep 17 00:00:00 2001
+From 97f71a34c011ad9d37b96c02eb7483fe253c6025 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
-Date: Sun, 15 Nov 2020 19:48:03 +0100
-Subject: [PATCH 3/8] usbtrans: Set default maximum packet size
+Date: Mon, 7 Dec 2020 08:41:23 +0100
+Subject: [PATCH 16/26] usbtrans: Set default maximum packet size
 
 Set the maximum packet size to 512 for SuperSpeed devices.
 
@@ -29,5 +29,5 @@ index c5680b33a..c1080bb33 100644
      max = 64;
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0004-grub-core-bus-usb-Add-function-pointer-for-attach-de.patch b/config/grub/xhci/patches/0017-grub-core-bus-usb-Add-function-pointer-for-attach-de.patch
index a090e0ea..e4798a8d 100644
--- a/config/grub/xhci/patches/0005-xhci/0004-grub-core-bus-usb-Add-function-pointer-for-attach-de.patch
+++ b/config/grub/xhci/patches/0017-grub-core-bus-usb-Add-function-pointer-for-attach-de.patch
@@ -1,8 +1,8 @@
-From 89701aba00caa81bb566ab10da0c89264393be30 Mon Sep 17 00:00:00 2001
+From ea5081844c3112b582f52360cfb14ef95b56f5e1 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
 Date: Sun, 15 Nov 2020 19:51:42 +0100
-Subject: [PATCH 4/8] grub-core/bus/usb: Add function pointer for attach/detach
- events
+Subject: [PATCH 17/26] grub-core/bus/usb: Add function pointer for
+ attach/detach events
 
 The xHCI code needs to be called for attaching or detaching a device.
 Introduce two functions pointers and call it from the USB hub code.
@@ -19,7 +19,7 @@ Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
  5 files changed, 29 insertions(+)
 
 diff --git a/grub-core/bus/usb/ehci.c b/grub-core/bus/usb/ehci.c
-index 9abebc6bd..953b851c0 100644
+index 2db07c7c0..1ee056015 100644
 --- a/grub-core/bus/usb/ehci.c
 +++ b/grub-core/bus/usb/ehci.c
 @@ -1812,6 +1812,8 @@ static struct grub_usb_controller_dev usb_controller = {
@@ -117,5 +117,5 @@ index ea6ee8c2c..4dd179db2 100644
    grub_uint64_t pending_reset;
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0005-grub-core-bus-usb-usbhub-Add-new-private-fields-for-.patch b/config/grub/xhci/patches/0018-grub-core-bus-usb-usbhub-Add-new-private-fields-for-.patch
index 7d69c3a6..d2067637 100644
--- a/config/grub/xhci/patches/0005-xhci/0005-grub-core-bus-usb-usbhub-Add-new-private-fields-for-.patch
+++ b/config/grub/xhci/patches/0018-grub-core-bus-usb-usbhub-Add-new-private-fields-for-.patch
@@ -1,8 +1,8 @@
-From 5e5d74a4531770258e21dedd45c33f1a9d3afa6b Mon Sep 17 00:00:00 2001
+From 7db1cdd1cdbb79a8da04648dcbf7318d200f72a4 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
-Date: Sun, 15 Nov 2020 19:54:40 +0100
-Subject: [PATCH 5/8] grub-core/bus/usb/usbhub: Add new private fields for xHCI
- controller
+Date: Mon, 7 Dec 2020 08:41:25 +0100
+Subject: [PATCH 18/26] grub-core/bus/usb/usbhub: Add new private fields for
+ xHCI controller
 
 Store the root port number, the route, consisting out of the port ID
 in each nibble, and a pointer to driver private data.
@@ -73,5 +73,5 @@ index 4dd179db2..609faf7d0 100644
  
  
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0006-grub-core-bus-usb-Add-xhci-support.patch b/config/grub/xhci/patches/0019-grub-core-bus-usb-Add-xhci-support.patch
index 11df42d8..b4d6e956 100644
--- a/config/grub/xhci/patches/0005-xhci/0006-grub-core-bus-usb-Add-xhci-support.patch
+++ b/config/grub/xhci/patches/0019-grub-core-bus-usb-Add-xhci-support.patch
@@ -1,7 +1,7 @@
-From fe3a0bce527e059e9121eb5ad2c3cc099f07a4bf Mon Sep 17 00:00:00 2001
+From 6b34ac2449362da5139e702e484a432d828a505d Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
-Date: Sun, 15 Nov 2020 19:59:25 +0100
-Subject: [PATCH 6/8] grub-core/bus/usb: Add xhci support
+Date: Mon, 7 Dec 2020 08:41:26 +0100
+Subject: [PATCH 19/26] grub-core/bus/usb: Add xhci support
 
 Add support for xHCI USB controllers.
 The code is based on seabios implementation, but has been heavily
@@ -41,13 +41,6 @@ TODO:
   * Test on USB3 hubs
   * Support for USB 3.1 and USB 3.2 controllers
 
-Tested on qemu using coreboot and grub as payload:
-
-qemu-system-x86_64 -M q35 -bios $firmware -device qemu-xhci,id=xhci -accel kvm -m 1024M \
-	-device usb-storage,drive=thumbdrive,bus=xhci.0,port=3 \
-	-drive if=none,format=raw,id=thumbdrive,file=ubuntu-20.04.1-desktop-amd64.iso \
-	-device usb-kbd,bus=xhci.0
-
 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
 Signed-off-by: sylv <sylv@sylv.io>
 ---
@@ -74,7 +67,7 @@ index 43635d5ff..65016f856 100644
  
  endif
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index fb6078a34..64c3806ab 100644
+index cd29a9df8..d3947739f 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
 @@ -667,6 +667,13 @@ module = {
@@ -2810,5 +2803,5 @@ index 609faf7d0..eb71fa1c7 100644
  
  #endif /* GRUB_USB_H */
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0005-xhci/0007-grub-core-bus-usb-usbhub-Add-xHCI-non-root-hub-suppo.patch b/config/grub/xhci/patches/0020-grub-core-bus-usb-usbhub-Add-xHCI-non-root-hub-suppo.patch
index a37bbd6b..31e831ec 100644
--- a/config/grub/xhci/patches/0005-xhci/0007-grub-core-bus-usb-usbhub-Add-xHCI-non-root-hub-suppo.patch
+++ b/config/grub/xhci/patches/0020-grub-core-bus-usb-usbhub-Add-xHCI-non-root-hub-suppo.patch
@@ -1,7 +1,7 @@
-From 2a2c64f6ea62337c1263a70f6ca9a9bade66b78b Mon Sep 17 00:00:00 2001
+From d84ac94dc55baad9a2297980b2017cd22e4ecb3c Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
-Date: Thu, 3 Dec 2020 13:44:55 +0100
-Subject: [PATCH 7/8] grub-core/bus/usb/usbhub: Add xHCI non root hub support
+Date: Mon, 7 Dec 2020 08:41:27 +0100
+Subject: [PATCH 20/26] grub-core/bus/usb/usbhub: Add xHCI non root hub support
 
 Tested on Intel PCH C246, the USB3 hub can be configured by grub.
 
@@ -123,5 +123,5 @@ index 039ebed65..d6c3f71dc 100644
  #define GRUB_USB_FEATURE_ENDP_HALT	0x00
  #define GRUB_USB_FEATURE_DEV_REMOTE_WU	0x01
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0021-xHCI-also-accept-SBRN-0x31-and-0x32.patch b/config/grub/xhci/patches/0021-xHCI-also-accept-SBRN-0x31-and-0x32.patch
new file mode 100644
index 00000000..f6e0f366
--- /dev/null
+++ b/config/grub/xhci/patches/0021-xHCI-also-accept-SBRN-0x31-and-0x32.patch
@@ -0,0 +1,26 @@
+From 0433c5bb1e40fba93205e1c9fd6b1b397d31ae5a Mon Sep 17 00:00:00 2001
+From: Sven Anderson <sven@anderson.de>
+Date: Sat, 28 May 2022 21:39:23 +0200
+Subject: [PATCH 21/26] xHCI: also accept SBRN 0x31 and 0x32
+
+Signed-off-by: Sven Anderson <sven@anderson.de>
+---
+ grub-core/bus/usb/xhci-pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/bus/usb/xhci-pci.c b/grub-core/bus/usb/xhci-pci.c
+index a5bd3c97d..cde21f57a 100644
+--- a/grub-core/bus/usb/xhci-pci.c
++++ b/grub-core/bus/usb/xhci-pci.c
+@@ -76,7 +76,7 @@ grub_xhci_pci_iter (grub_pci_device_t dev, grub_pci_id_t pciid,
+       /* Check Serial Bus Release Number */
+       addr = grub_pci_make_address (dev, GRUB_XHCI_PCI_SBRN_REG);
+       release = grub_pci_read_byte (addr);
+-      if (release != 0x30)
++      if (release != 0x30 && release != 0x31 &&release != 0x32)
+ 	{
+ 	  grub_dprintf ("xhci", "XHCI grub_xhci_pci_iter: Wrong SBRN: %0x\n",
+ 			release);
+-- 
+2.39.5
+
diff --git a/config/grub/xhci/patches/0022-xhci-fix-port-indexing.patch b/config/grub/xhci/patches/0022-xhci-fix-port-indexing.patch
new file mode 100644
index 00000000..edfcca2c
--- /dev/null
+++ b/config/grub/xhci/patches/0022-xhci-fix-port-indexing.patch
@@ -0,0 +1,43 @@
+From d300f12cb624998f3d5ab5948c3fc64d6d7baf4f Mon Sep 17 00:00:00 2001
+From: Sven Anderson <sven@anderson.de>
+Date: Mon, 13 Jan 2025 19:51:41 +0100
+Subject: [PATCH 22/26] xhci: fix port indexing
+
+---
+ grub-core/bus/usb/xhci.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/bus/usb/xhci.c b/grub-core/bus/usb/xhci.c
+index f4591ffb5..dc89b9619 100644
+--- a/grub-core/bus/usb/xhci.c
++++ b/grub-core/bus/usb/xhci.c
+@@ -2250,7 +2250,7 @@ grub_xhci_detect_dev (grub_usb_controller_t dev, int port, int *changed)
+ 
+   *changed = 0;
+   grub_dprintf("xhci", "%s: dev=%p USB%d_%d port %d\n", __func__, dev,
+-	       x->psids[port-1].major, x->psids[port-1].minor, port);
++	       x->psids[port].major, x->psids[port].minor, port);
+ 
+   /* On shutdown advertise all ports as disconnected. This will trigger
+    * a gracefull detatch. */
+@@ -2285,13 +2285,13 @@ grub_xhci_detect_dev (grub_usb_controller_t dev, int port, int *changed)
+   if (!(portsc & GRUB_XHCI_PORTSC_CCS))
+     return GRUB_USB_SPEED_NONE;
+ 
+-  for (grub_uint8_t i = 0; i < 16 && x->psids[port-1].psids[i].id > 0; i++)
++  for (grub_uint8_t i = 0; i < 16 && x->psids[port].psids[i].id > 0; i++)
+     {
+-      if (x->psids[port-1].psids[i].id == speed)
++      if (x->psids[port].psids[i].id == speed)
+         {
+ 	  grub_dprintf("xhci", "%s: grub_usb_speed = %d\n", __func__,
+-		       x->psids[port-1].psids[i].grub_usb_speed );
+-	  return x->psids[port-1].psids[i].grub_usb_speed;
++		       x->psids[port].psids[i].grub_usb_speed );
++	  return x->psids[port].psids[i].grub_usb_speed;
+ 	}
+     }
+ 
+-- 
+2.39.5
+
diff --git a/config/grub/xhci/patches/0023-xhci-configure-TT-for-non-root-hubs.patch b/config/grub/xhci/patches/0023-xhci-configure-TT-for-non-root-hubs.patch
new file mode 100644
index 00000000..b41db45f
--- /dev/null
+++ b/config/grub/xhci/patches/0023-xhci-configure-TT-for-non-root-hubs.patch
@@ -0,0 +1,98 @@
+From 0a669ef9815267de4fb14f3c329431ac531755c9 Mon Sep 17 00:00:00 2001
+From: Sven Anderson <sven@anderson.de>
+Date: Mon, 13 Jan 2025 20:26:32 +0100
+Subject: [PATCH 23/26] xhci: configure TT for non-root-hubs
+
+---
+ grub-core/bus/usb/usbhub.c |  6 +++++
+ grub-core/bus/usb/xhci.c   | 45 +++++++++++++++++++++++++++++++++-----
+ include/grub/usb.h         |  2 ++
+ 3 files changed, 47 insertions(+), 6 deletions(-)
+
+diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c
+index e96505aa9..629b3ed53 100644
+--- a/grub-core/bus/usb/usbhub.c
++++ b/grub-core/bus/usb/usbhub.c
+@@ -818,3 +818,9 @@ grub_usb_iterate (grub_usb_iterate_hook_t hook, void *hook_data)
+ 
+   return 0;
+ }
++
++grub_usb_device_t
++grub_usb_get_dev (int addr)
++{
++  return grub_usb_devs[addr];
++}
+diff --git a/grub-core/bus/usb/xhci.c b/grub-core/bus/usb/xhci.c
+index dc89b9619..88c9ac57f 100644
+--- a/grub-core/bus/usb/xhci.c
++++ b/grub-core/bus/usb/xhci.c
+@@ -623,13 +623,46 @@ grub_xhci_alloc_inctx(struct grub_xhci *x, int maxepid,
+       break;
+   }
+ 
+-  /* Route is greater zero on devices that are connected to a non root hub */
+-  if (dev->route)
+-    {
+-      /* FIXME: Implement this code for non SuperSpeed hub devices */
++  /* Set routing string */
++  slot->ctx[0] |= dev->route;
++
++  /* Set root hub port number */
++  slot->ctx[1] |= (dev->root_port + 1) << 16;
++
++  if (dev->split_hubaddr && (dev->speed == GRUB_USB_SPEED_LOW ||
++                            dev->speed == GRUB_USB_SPEED_FULL)) {
++
++    grub_usb_device_t hubdev = grub_usb_get_dev(dev->split_hubaddr);
++
++    if (!hubdev || hubdev->descdev.class != GRUB_USB_CLASS_HUB) {
++      grub_dprintf("xhci", "Invalid hub device at addr %d!\n", dev->split_hubaddr);
++      return NULL;
++    }
++
++    struct grub_xhci_priv *hub_priv = hubdev->xhci_priv;
++    if (!hub_priv) {
++      grub_dprintf("xhci", "Hub has no xhci_priv!\n"); 
++      return NULL;
++    }
++
++    if (hubdev->speed == GRUB_USB_SPEED_HIGH) {
++      /* Direct connection to high-speed hub - set up TT */
++      grub_dprintf("xhci", "Direct high-speed hub connection - configuring TT with "
++                   "hub slot %d port %d\n", hub_priv->slotid, dev->split_hubport);
++      slot->ctx[2] |= hub_priv->slotid;
++      slot->ctx[2] |= dev->split_hubport << 8;
+     }
+-  slot->ctx[0]    |= dev->route;
+-  slot->ctx[1]    |= (dev->root_port+1) << 16;
++    else {
++      /* Hub is not high-speed, inherit TT settings from parent */
++      volatile struct grub_xhci_slotctx *hubslot;
++      grub_dprintf("xhci", "Non high-speed hub - inheriting TT settings from parent\n");
++      hubslot = grub_dma_phys2virt(x->devs[hub_priv->slotid].ptr_low, x->devs_dma);
++      slot->ctx[2] = hubslot->ctx[2];
++    }
++  }
++
++  grub_dprintf("xhci", "Slot context: ctx[0]=0x%08x ctx[1]=0x%08x ctx[2]=0x%08x\n",
++               slot->ctx[0], slot->ctx[1], slot->ctx[2]);
+ 
+   grub_arch_sync_dma_caches(in, size);
+ 
+diff --git a/include/grub/usb.h b/include/grub/usb.h
+index eb71fa1c7..df97a60cc 100644
+--- a/include/grub/usb.h
++++ b/include/grub/usb.h
+@@ -62,6 +62,8 @@ typedef int (*grub_usb_controller_iterate_hook_t) (grub_usb_controller_t dev,
+ /* Call HOOK with each device, until HOOK returns non-zero.  */
+ int grub_usb_iterate (grub_usb_iterate_hook_t hook, void *hook_data);
+ 
++grub_usb_device_t grub_usb_get_dev (int addr);
++
+ grub_usb_err_t grub_usb_device_initialize (grub_usb_device_t dev);
+ 
+ grub_usb_err_t grub_usb_get_descriptor (grub_usb_device_t dev,
+-- 
+2.39.5
+
diff --git a/config/grub/xhci/patches/0005-xhci/0008-Fix-compilation-on-x86_64.patch b/config/grub/xhci/patches/0024-Fix-compilation-on-x86_64.patch
index af79c3d0..cdc692d6 100644
--- a/config/grub/xhci/patches/0005-xhci/0008-Fix-compilation-on-x86_64.patch
+++ b/config/grub/xhci/patches/0024-Fix-compilation-on-x86_64.patch
@@ -1,7 +1,7 @@
-From 871d768f8c5c960cb0d9761a9028b16882e1a7d3 Mon Sep 17 00:00:00 2001
+From 625fdcf42f2cf11a4bfe644412450c9e4f551d25 Mon Sep 17 00:00:00 2001
 From: Patrick Rudolph <patrick.rudolph@9elements.com>
 Date: Wed, 24 Feb 2021 08:25:41 +0100
-Subject: [PATCH 8/8] Fix compilation on x86_64
+Subject: [PATCH 24/26] Fix compilation on x86_64
 
 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
  1 file changed, 16 insertions(+), 8 deletions(-)
 
 diff --git a/grub-core/bus/usb/xhci.c b/grub-core/bus/usb/xhci.c
-index f4591ffb5..3495bb919 100644
+index 88c9ac57f..9b9bae6e5 100644
 --- a/grub-core/bus/usb/xhci.c
 +++ b/grub-core/bus/usb/xhci.c
 @@ -184,7 +184,7 @@ enum
@@ -36,7 +36,7 @@ index f4591ffb5..3495bb919 100644
  static inline grub_uint32_t
  grub_xhci_port_read (struct grub_xhci *x, grub_uint32_t port)
  {
-@@ -664,7 +672,7 @@ static void xhci_process_events(struct grub_xhci *x)
+@@ -697,7 +705,7 @@ static void xhci_process_events(struct grub_xhci *x)
  	    case ER_TRANSFER:
  	    case ER_COMMAND_COMPLETE:
  	      {
@@ -45,7 +45,7 @@ index f4591ffb5..3495bb919 100644
  		struct grub_xhci_ring *ring = XHCI_RING(rtrb);
  		volatile struct grub_xhci_trb  *evt = &ring->evt;
  		grub_uint32_t eidx = rtrb - ring->ring + 1;
-@@ -697,9 +705,9 @@ static void xhci_process_events(struct grub_xhci *x)
+@@ -730,9 +738,9 @@ static void xhci_process_events(struct grub_xhci *x)
  	  }
  	grub_xhci_write32(&evts->nidx, nidx);
  	volatile struct grub_xhci_ir *ir = x->ir;
@@ -58,7 +58,7 @@ index f4591ffb5..3495bb919 100644
      }
  }
  
-@@ -800,7 +808,7 @@ static void xhci_trb_queue(volatile struct grub_xhci_ring *ring,
+@@ -833,7 +841,7 @@ static void xhci_trb_queue(volatile struct grub_xhci_ring *ring,
  			   grub_uint32_t xferlen, grub_uint32_t flags)
  {
    grub_dprintf("xhci", "%s: ring %p data %llx len %d flags 0x%x remain 0x%x\n", __func__,
@@ -67,7 +67,7 @@ index f4591ffb5..3495bb919 100644
  
    if (xhci_ring_full(ring))
      {
-@@ -1907,7 +1915,7 @@ grub_xhci_setup_transfer (grub_usb_controller_t dev,
+@@ -1940,7 +1948,7 @@ grub_xhci_setup_transfer (grub_usb_controller_t dev,
    if (transfer->type == GRUB_USB_TRANSACTION_TYPE_CONTROL)
    {
      volatile struct grub_usb_packet_setup *setupdata;
@@ -76,7 +76,7 @@ index f4591ffb5..3495bb919 100644
      grub_dprintf("xhci", "%s: CONTROLL TRANS req %d\n", __func__, setupdata->request);
      grub_dprintf("xhci", "%s: CONTROLL TRANS length %d\n", __func__, setupdata->length);
  
-@@ -1974,7 +1982,7 @@ grub_xhci_setup_transfer (grub_usb_controller_t dev,
+@@ -2007,7 +2015,7 @@ grub_xhci_setup_transfer (grub_usb_controller_t dev,
  	/* Assume the ring has enough free space for all TRBs */
  	if (flags & TRB_TR_IDT && tr->size <= (int)sizeof(inline_data))
  	  {
@@ -86,5 +86,5 @@ index f4591ffb5..3495bb919 100644
  	  }
  	else
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0006-nvme/0001-Add-native-NVMe-driver-based-on-SeaBIOS.patch b/config/grub/xhci/patches/0025-Add-native-NVMe-driver-based-on-SeaBIOS.patch
index b00611a0..e9dc54b5 100644
--- a/config/grub/xhci/patches/0006-nvme/0001-Add-native-NVMe-driver-based-on-SeaBIOS.patch
+++ b/config/grub/xhci/patches/0025-Add-native-NVMe-driver-based-on-SeaBIOS.patch
@@ -1,7 +1,7 @@
-From ef9d61ae9ed490301adf9ee064a9fc1190069d81 Mon Sep 17 00:00:00 2001
+From 1ede42b39a87ccb2cc43d919f3ee4803d6551102 Mon Sep 17 00:00:00 2001
 From: Mate Kukri <km@mkukri.xyz>
 Date: Mon, 20 May 2024 11:43:35 +0100
-Subject: Add native NVMe driver based on SeaBIOS
+Subject: [PATCH 25/26] Add native NVMe driver based on SeaBIOS
 
 Tested to successfully boot Debian on QEMU and OptiPlex 3050.
 
@@ -31,12 +31,12 @@ index 65016f856..7bc0866ba 100644
  
  endif
 diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
-index ea782666d..0f893369a 100644
+index d3947739f..fb9f24c0f 100644
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -2602,3 +2602,9 @@ module = {
-   efi = commands/bli.c;
-   enable = efi;
+@@ -2689,3 +2689,9 @@ module = {
+   cflags = '-Wno-uninitialized';
+   cppflags = '-I$(srcdir)/lib/libtasn1-grub -I$(srcdir)/tests/asn1/';
  };
 +
 +module = {
@@ -45,7 +45,7 @@ index ea782666d..0f893369a 100644
 +  enable = pci;
 +};
 diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c
-index 580c8d3b0..a2c766fbd 100644
+index 6806bff9c..fd68a513e 100644
 --- a/grub-core/commands/nativedisk.c
 +++ b/grub-core/commands/nativedisk.c
 @@ -78,6 +78,7 @@ get_uuid (const char *name, char **uuid, int getnative)
@@ -1070,5 +1070,5 @@ index fbf23df7f..186e76f0b 100644
  
  struct grub_disk;
 -- 
-2.39.2
+2.39.5
 
diff --git a/config/grub/xhci/patches/0026-kern-coreboot-mmap-Map-to-reserved.patch b/config/grub/xhci/patches/0026-kern-coreboot-mmap-Map-to-reserved.patch
new file mode 100644
index 00000000..712d2218
--- /dev/null
+++ b/config/grub/xhci/patches/0026-kern-coreboot-mmap-Map-to-reserved.patch
@@ -0,0 +1,37 @@
+From d73ca74ef879bf602274bee6eb24f0080a45d235 Mon Sep 17 00:00:00 2001
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Mon, 17 May 2021 10:24:36 +0200
+Subject: [PATCH 26/26] kern/coreboot/mmap: Map to reserved
+
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6de9ee86bf9ae50967413e6a73b5dfd13e5ffb50
+
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+---
+ grub-core/kern/coreboot/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/kern/coreboot/mmap.c b/grub-core/kern/coreboot/mmap.c
+index caf8f7cef..2fc316e8d 100644
+--- a/grub-core/kern/coreboot/mmap.c
++++ b/grub-core/kern/coreboot/mmap.c
+@@ -59,7 +59,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 			    /* Multiboot mmaps match with the coreboot mmap
+ 			       definition.  Therefore, we can just pass type
+ 			       through.  */
+-			    mem_region->type,
++			    (mem_region->type >= 13) ? 2 : mem_region->type,
+ 			    ctx->hook_data))
+ 	    return 1;
+ 	  if (start < 0xa0000)
+@@ -81,7 +81,7 @@ iterate_linuxbios_table (grub_linuxbios_table_item_t table_item, void *data)
+ 		     /* Multiboot mmaps match with the coreboot mmap
+ 		        definition.  Therefore, we can just pass type
+ 		        through.  */
+-		     mem_region->type,
++		     (mem_region->type >= 13) ? 2 : mem_region->type,
+ 		     ctx->hook_data))
+ 	return 1;
+     }
+-- 
+2.39.5
+
diff --git a/config/grub/xhci/target.cfg b/config/grub/xhci/target.cfg
index 61ee9757..df3e605e 100644
--- a/config/grub/xhci/target.cfg
+++ b/config/grub/xhci/target.cfg
@@ -1,2 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 tree="xhci"
-rev="8719cc2040368d43ab2de0b6e1b850b2c9cfc5b7"
+rev="a68a7dece464c35b1c8d20b98502b6881b103911"