Do not include EFI dir in common subpackage

This fixes [1] which is part of [2]. We cannot ship
/usr/lib/efi/* in -common subpackage as bootupd does not expect this
directory for ppc64le arch.
We are moving the creation and configuration of the directory into
specific EFI macros only.

[1] e02b6e88c7
[2] https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1

Signed-off-by: Joel Capitao <jcapitao@redhat.com>

0055-Add-grub2-switch-to-blscfg.patch

@@ -129,7 +129,7 @@ index 00000000000..a851424beb2
 +# Print the usage.
 +usage () {
 +    gettext_printf "Usage: %s\n" "$self"
-+    gettext "Switch to BLS config files.\n"; echo
++    gettext "Switch to BLS config files."; echo
 +    echo
 +    print_option_help "-h, --help" "$(gettext "print this message and exit")"
 +    print_option_help "-V, --version" "$(gettext "print the version information and exit")"

0277-Stop-grub.efi-from-always-printing-dynamic_load_symb.patch

@@ -0,0 +1,80 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 3 Oct 2024 12:26:07 +0200
+Subject: [PATCH] Stop grub.efi from always printing "dynamic_load_symbols
+ %p\n" during boot
+
+Commit 972aa68d2bf5 ("Make a "gdb" dprintf that tells us load addresses.")
+added some debug prints to help with running gdb against grub.
+
+Besides adding a new grub_dl_print_gdb_info () function which uses
+`grub_qdprintf ("gdb", ...);` it also adds a new grub_efi_print_gdb_info ()
+call to grub_efi_init ().
+
+grub_efi_print_gdb_info () is intended for the gdbinfo command and uses
+a non debug grub_printf () call leading to grub now always printing this
+message during boot breaking flicker-free boot.
+
+Add a new "debug" parameter to grub_efi_print_gdb_info () and use
+`grub_qdprintf ("gdb", ...);` when this is set to silence the printing
+done from grub_efi_init () when debugging is not enabled.
+
+Fixes: 972aa68d2bf5 ("Make a "gdb" dprintf that tells us load addresses.")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ grub-core/kern/efi/debug.c | 2 +-
+ grub-core/kern/efi/init.c  | 2 +-
+ include/grub/efi/debug.h   | 7 +++++--
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/grub-core/kern/efi/debug.c b/grub-core/kern/efi/debug.c
+index 5d2ab1a36ff4..5ac194fc8f46 100644
+--- a/grub-core/kern/efi/debug.c
++++ b/grub-core/kern/efi/debug.c
+@@ -26,7 +26,7 @@ grub_cmd_gdbinfo (struct grub_command *cmd __attribute__ ((unused)),
+ 		  int argc __attribute__ ((unused)),
+ 		  char **args __attribute__ ((unused)))
+ {
+-  grub_efi_print_gdb_info ();
++  grub_efi_print_gdb_info (false);
+   return 0;
+ }
+ 
+diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
+index d35d69747342..ce8a7fe7122f 100644
+--- a/grub-core/kern/efi/init.c
++++ b/grub-core/kern/efi/init.c
+@@ -157,7 +157,7 @@ grub_efi_init (void)
+   grub_efi_system_table->boot_services->set_watchdog_timer (0, 0, 0, NULL);
+ 
+   grub_efi_env_init ();
+-  grub_efi_print_gdb_info ();
++  grub_efi_print_gdb_info (true);
+   grub_efidisk_init ();
+ 
+   grub_efi_register_debug_commands ();
+diff --git a/include/grub/efi/debug.h b/include/grub/efi/debug.h
+index c2d2a03b06f1..961e591afa3e 100644
+--- a/include/grub/efi/debug.h
++++ b/include/grub/efi/debug.h
+@@ -27,7 +27,7 @@
+ void grub_efi_register_debug_commands (void);
+ 
+ static inline void
+-grub_efi_print_gdb_info (void)
++grub_efi_print_gdb_info (bool debug)
+ {
+   grub_addr_t text;
+ 
+@@ -35,7 +35,10 @@ grub_efi_print_gdb_info (void)
+   if (!text)
+     return;
+ 
+-  grub_printf ("dynamic_load_symbols %p\n", (void *)text);
++  if (debug)
++    grub_qdprintf ("gdb", "dynamic_load_symbols %p\n", (void *)text);
++  else
++    grub_printf ("dynamic_load_symbols %p\n", (void *)text);
+ }
+ 
+ #endif /* ! GRUB_EFI_DEBUG_HEADER */

0278-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Wed, 16 Oct 2024 16:20:24 +1100
+Subject: [PATCH] acpi: Fix out of bounds access in grub_acpi_xsdt_find_table()
+
+The calculation of the size of the table was incorrect (copy/pasta from
+grub_acpi_rsdt_find_table() I assume...). The entries are 64-bit long.
+
+This causes us to access beyond the end of the table which is causing
+crashes during boot on some systems. Typically this is causing a crash
+on VMWare when using UEFI and enabling serial autodetection, as
+
+grub_acpi_find_table (GRUB_ACPI_SPCR_SIGNATURE);
+
+Will goes past the end of the table (the SPCR table doesn't exits)
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+---
+ grub-core/kern/acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/kern/acpi.c b/grub-core/kern/acpi.c
+index 48ded4e2ea6e..8ff0835d501f 100644
+--- a/grub-core/kern/acpi.c
++++ b/grub-core/kern/acpi.c
+@@ -75,7 +75,7 @@ grub_acpi_xsdt_find_table (struct grub_acpi_table_header *xsdt, const char *sig)
+     return 0;
+ 
+   ptr = (grub_unaligned_uint64_t *) (xsdt + 1);
+-  s = (xsdt->length - sizeof (*xsdt)) / sizeof (grub_uint32_t);
++  s = (xsdt->length - sizeof (*xsdt)) / sizeof (grub_uint64_t);
+   for (; s; s--, ptr++)
+     {
+       struct grub_acpi_table_header *tbl;

0279-cmd-search-Fix-a-possible-NULL-ptr-dereference.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Wed, 16 Oct 2024 15:50:32 +0200
+Subject: [PATCH] cmd/search: Fix a possible NULL ptr dereference
+
+When querying about a partition UUID, we're not checking
+for get_device_uuid() return value, which can possibly
+result in dereferencing a NULL pointer.
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+Co-authored-by: Chuong Tran <anhchuong89@gmail.com>
+---
+ grub-core/commands/search.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
+index 9dd937e6df4e..d538b36219fb 100644
+--- a/grub-core/commands/search.c
++++ b/grub-core/commands/search.c
+@@ -212,24 +212,26 @@ iterate_device (const char *name, void *data)
+                     struct uuid_context uuid_ctx;
+                     int ret = 0;
+ 
+-                    get_device_uuid(name, &quid_name);
+-                    if (!grub_strcmp(quid_name, ctx->key))
++                    if (get_device_uuid(name, &quid_name))
+                       {
+-                        uuid_ctx.name = name;
+-                        uuid_ctx.uuid = quid_name;
++                      if (!grub_strcmp(quid_name, ctx->key))
++                        {
++                          uuid_ctx.name = name;
++                          uuid_ctx.uuid = quid_name;
+ 
+-                        ret = grub_device_iterate (check_for_duplicate, &uuid_ctx);
++                          ret = grub_device_iterate (check_for_duplicate, &uuid_ctx);
+ 
+-                        if (ret)
+-                          {
+-                            grub_printf("Duplicated media UUID found, rebooting ...\n");
+-                            grub_sleep(10);
+-                            grub_reboot();
+-                          }
+-                      }
++                          if (ret)
++                            {
++                              grub_printf("Duplicated media UUID found, rebooting ...\n");
++                              grub_sleep(10);
++                              grub_reboot();
++                            }
++                        }
+ 
+-                    if (quid_name) grub_free (quid_name);
++                      if (quid_name) grub_free (quid_name);
+ 
++                    }
+                   }
+               }
+ 	  }

0280-Enable-building-blscfg-module-on-xen-and-xen_pvh.patch

@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Matyáš Kroupa <kroupa.matyas@gmail.com>
+Date: Fri, 30 Aug 2024 16:28:21 +0200
+Subject: [PATCH] Enable building blscfg module on xen and xen_pvh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Building blscfg module for Xen targets makes it possible to include them
+in custom pvgrub2 and pvhgrub2 images. Those are then used to boot PV and
+PVH domUs.
+
+Signed-off-by: Matyáš Kroupa <kroupa.matyas@gmail.com>
+---
+ grub-core/Makefile.core.def | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
+index 6ff4835..95fd18d 100644
+--- a/grub-core/Makefile.core.def
++++ b/grub-core/Makefile.core.def
+@@ -880,6 +880,8 @@ module = {
+   enable = efi;
+   enable = i386_pc;
+   enable = emu;
++  enable = xen;
++  enable = i386_xen_pvh;
+ };
+
+ module = {
+--
+2.46.0

0281-loader-efi-Fix-RISC-V-build.patch

@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Andrea Bolognani <abologna@redhat.com>
+Date: Tue, 19 Nov 2024 15:42:01 +0000
+Subject: [PATCH] loader/efi: Fix RISC-V build
+
+Some struct definitions are currently limited to 32-bit and
+64-bit Arm architectures, but they actually apply to other
+architectures as well, specifically 32-bit and 64-bit RISC-V
+respectively.
+
+Update the preprocessor checks guarding their definition, and
+change their names to make them more accurate by replacing the
+word "arm" with the word "efi".
+
+Signed-off-by: Andrea Bolognani <abologna@redhat.com>
+---
+ grub-core/loader/efi/linux.c |  2 +-
+ include/grub/efi/efi.h       | 12 ++++++------
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c
+index 5889e3f36f8..ef55556f2d9 100644
+--- a/grub-core/loader/efi/linux.c
++++ b/grub-core/loader/efi/linux.c
+@@ -684,7 +684,7 @@ parse_pe_header (void *kernel, grub_uint64_t *total_size,
+ 		 grub_uint32_t *alignment, grub_uint32_t *code_size)
+ {
+   struct linux_arch_kernel_header *lh = kernel;
+-  struct grub_armxx_linux_pe_header *pe;
++  struct grub_efixx_linux_pe_header *pe;
+   grub_uint16_t i;
+   struct grub_pe32_section_table *sections;
+ 
+diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
+index 7eed1bd791d..81daf6bead1 100644
+--- a/include/grub/efi/efi.h
++++ b/include/grub/efi/efi.h
+@@ -36,28 +36,28 @@ struct linux_arch_kernel_header {
+   struct grub_pe_image_header pe_image_header;
+ };
+ 
+-struct grub_arm_linux_pe_header
++struct grub_efi32_linux_pe_header
+ {
+   grub_uint32_t magic;
+   struct grub_pe32_coff_header coff;
+   struct grub_pe32_optional_header opt;
+ };
+ 
+-struct grub_arm64_linux_pe_header
++struct grub_efi64_linux_pe_header
+ {
+   grub_uint32_t magic;
+   struct grub_pe32_coff_header coff;
+   struct grub_pe64_optional_header opt;
+ };
+ 
+-#if defined(__arm__)
++#if defined(__arm__) || (defined(__riscv) && (__riscv_xlen == 32))
+ # define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE32_MAGIC
+-# define grub_armxx_linux_pe_header grub_arm_linux_pe_header
++# define grub_efixx_linux_pe_header grub_efi32_linux_pe_header
+ #endif
+ 
+-#if defined(__aarch64__)
++#if defined(__aarch64__) || (defined(__riscv) && (__riscv_xlen == 64))
+ # define GRUB_PE32_PEXX_MAGIC GRUB_PE32_PE64_MAGIC
+-# define grub_armxx_linux_pe_header grub_arm64_linux_pe_header
++# define grub_efixx_linux_pe_header grub_efi64_linux_pe_header
+ #endif
+ 
+ #define GRUB_EFI_GRUB_VARIABLE_GUID             \

0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch

@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
+Date: Mon, 12 Aug 2024 16:13:18 +0200
+Subject: [PATCH] kern/riscv/efi/init: Use time register in
+ grub_efi_get_time_ms()
+
+The cycle register is not guaranteed to count at constant frequency.
+If it is counting at all depends on the state the performance monitoring
+unit. Use the time register to measure time.
+
+Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/kern/riscv/efi/init.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/grub-core/kern/riscv/efi/init.c b/grub-core/kern/riscv/efi/init.c
+index 38795fe6741..0d7de4f541a 100644
+--- a/grub-core/kern/riscv/efi/init.c
++++ b/grub-core/kern/riscv/efi/init.c
+@@ -33,16 +33,15 @@ grub_efi_get_time_ms (void)
+   grub_uint64_t tmr;
+ 
+ #if __riscv_xlen == 64
+-  asm volatile ("rdcycle %0" : "=r" (tmr));
++  asm volatile ("rdtime %0" : "=r"(tmr));
+ #else
+   grub_uint32_t lo, hi, tmp;
+-  asm volatile (
+-    "1:\n"
+-    "rdcycleh %0\n"
+-    "rdcycle %1\n"
+-    "rdcycleh %2\n"
+-    "bne %0, %2, 1b"
+-    : "=&r" (hi), "=&r" (lo), "=&r" (tmp));
++  asm volatile ("1:\n"
++                "rdtimeh %0\n"
++                "rdtime %1\n"
++                "rdtimeh %2\n"
++                "bne %0, %2, 1b"
++                : "=&r" (hi), "=&r" (lo), "=&r" (tmp));
+   tmr = ((grub_uint64_t)hi << 32) | lo;
+ #endif
+ 

0283-Use-medany-instead-of-large-model-for-RISCV.patch

@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jason Montleon <jason@montleon.com>
+Date: Fri, 3 May 2024 13:18:37 -0400
+Subject: [PATCH] Use medany instead of large model for RISCV
+
+Signed-off-by: Jason Montleon <jason@montleon.com>
+---
+ configure.ac | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 4788f3d6adc..a6a6957fbdb 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1313,7 +1313,7 @@ AC_SUBST(TARGET_LDFLAGS_OLDMAGIC)
+ 
+ LDFLAGS="$TARGET_LDFLAGS"
+ 
+-if test "$target_cpu" = x86_64 || test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64 ; then
++if test "$target_cpu" = x86_64 || test "$target_cpu" = sparc64 ; then
+   # Use large model to support 4G memory
+   AC_CACHE_CHECK([whether option -mcmodel=large works], grub_cv_cc_mcmodel, [
+     CFLAGS="$TARGET_CFLAGS -mcmodel=large"
+@@ -1323,9 +1323,11 @@ if test "$target_cpu" = x86_64 || test "$target_cpu" = sparc64 || test "$target_
+   ])
+   if test "x$grub_cv_cc_mcmodel" = xyes; then
+     TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=large"
+-  elif test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64; then
++  elif test "$target_cpu" = sparc64; then
+     TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=medany"
+   fi
++elif test "$target_cpu" = riscv64 ; then
++    TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=medany"
+ fi
+ 
+ if test "$target_cpu"-"$platform" = x86_64-efi; then

0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch

@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Eric Sandeen <sandeen@redhat.com>
+Date: Wed, 4 Dec 2024 07:50:28 -0600
+Subject: [PATCH] fs/xfs: fix large extent counters incompat feature support
+
+When large extent counter / NREXT64 support was added to grub, it missed
+a couple of direct reads of nextents which need to be changed to the new
+NREXT64-aware helper as well. Without this, we'll have mis-reads of some
+directories with this feature enabled.
+
+(The large extent counter fix likely raced on merge with
+07318ee7e ("fs/xfs: Fix XFS directory extent parsing") which added the new
+direct nextents reads just prior, causing this issue.)
+
+Fixes: aa7c1322671e ("fs/xfs: Add large extent counters incompat feature support")
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Jon DeVree <nuxi@vault24.org>
+---
+ grub-core/fs/xfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
+index 8e02ab4a3014..92046f9bdf49 100644
+--- a/grub-core/fs/xfs.c
++++ b/grub-core/fs/xfs.c
+@@ -926,7 +926,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir,
+ 	     * Leaf and tail information are only in the data block if the number
+ 	     * of extents is 1.
+ 	     */
+-	    if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1))
++	    if (grub_xfs_get_inode_nextents(&dir->inode) == 1)
+ 	      {
+ 		struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock);
+ 
+@@ -980,7 +980,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir,
+ 		 * The expected number of directory entries is only tracked for the
+ 		 * single extent case.
+ 		 */
+-		if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1))
++		if (grub_xfs_get_inode_nextents(&dir->inode) == 1)
+ 		  {
+ 		    /* Check if last direntry in this block is reached. */
+ 		    entries--;

0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Thu, 16 Jan 2025 10:22:48 -0600
+Subject: [PATCH] term/nns8250-spcr: return if redirection is disabled
+
+The Microsoft spec for SPCR says "The base address of the Serial Port register
+set described using the ACPI Generic Address Structure, or 0 if console
+redirection is disabled." so return if disable (base address = 0). If this check
+is not done, we may get invalid ports for those particular machines that
+redirection is disabled and at some point hanging the booting execution when
+reading the grub.cfg configuration file.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Reviewed-by: Leo Sandoval <lsandova@redhat.com>
+---
+ grub-core/term/ns8250-spcr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/grub-core/term/ns8250-spcr.c b/grub-core/term/ns8250-spcr.c
+index d52b52c26..86f1aa078 100644
+--- a/grub-core/term/ns8250-spcr.c
++++ b/grub-core/term/ns8250-spcr.c
+@@ -75,6 +75,11 @@ grub_ns8250_spcr_init (void)
+         config.speed = 115200;
+         break;
+     };
++
++  /* if base address is 0, it means redirection is disable, so return it */
++  if (spcr->base_addr.addr == 0)
++    return NULL;
++
+   switch (spcr->base_addr.space_id)
+     {
+       case GRUB_ACPI_GENADDR_MEM_SPACE:

0286-commands-legacycfg-Avoid-closing-file-twice.patch

@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Wed, 16 Oct 2024 11:54:38 -0600
+Subject: [PATCH] commands/legacycfg: Avoid closing file twice
+
+An internal (at Red Hat) static soure code scan detected an
+use-after-free scenario:
+
+  Error: USE_AFTER_FREE (CWE-416):
+  grub-2.06/grub-core/commands/legacycfg.c:194: freed_arg: "grub_file_close" frees "file".
+  grub-2.06/grub-core/commands/legacycfg.c:201: deref_arg: Calling "grub_file_close" dereferences freed pointer "file".
+  #  199|         if (!args)
+  #  200|   	{
+  #  201|-> 	  grub_file_close (file);
+  #  202|   	  grub_free (suffix);
+  #  203|   	  grub_free (entrysrc);
+
+So, remove the extra file close call.
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/commands/legacycfg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
+index 2c5d1a0ef..86bcda695 100644
+--- a/grub-core/commands/legacycfg.c
++++ b/grub-core/commands/legacycfg.c
+@@ -198,7 +198,6 @@ legacy_file (const char *filename)
+       const char **args = grub_malloc (sizeof (args[0]));
+       if (!args)
+ 	{
+-	  grub_file_close (file);
+ 	  grub_free (suffix);
+ 	  grub_free (entrysrc);
+ 	  return grub_errno;

0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Wed, 22 Jan 2025 13:37:42 -0600
+Subject: [PATCH] disk/ahci.c: remove conditional operator for endtime
+
+The conditional makes no sense when the two possible expressions have the same
+value, so remove it (perhaps the compiler does it for us but better to remove
+it).
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ grub-core/disk/ahci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/disk/ahci.c b/grub-core/disk/ahci.c
+index e7b5dc5f2..b247161b9 100644
+--- a/grub-core/disk/ahci.c
++++ b/grub-core/disk/ahci.c
+@@ -1038,7 +1038,7 @@ grub_ahci_readwrite_real (struct grub_ahci_device *dev,
+   grub_dprintf ("ahci", "AHCI tfd = %x\n",
+ 		dev->hba->ports[dev->port].task_file_data);
+ 
+-  endtime = grub_get_time_ms () + (spinup ? 20000 : 20000);
++  endtime = grub_get_time_ms () + 20000;
+   while ((dev->hba->ports[dev->port].command_issue & 1))
+     if (grub_get_time_ms () > endtime ||
+ 	(dev->hba->ports[dev->port].intstatus & GRUB_AHCI_HBA_PORT_IS_FATAL_MASK))

0288-commands-bli-Fix-crash-in-get_part_uuid.patch

@@ -0,0 +1,80 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Chang <mchang@suse.com>
+Date: Wed, 17 Jul 2024 14:46:46 +0800
+Subject: [PATCH] commands/bli: Fix crash in get_part_uuid()
+
+The get_part_uuid() function made an assumption that the target GRUB
+device is a partition device and accessed device->disk->partition
+without checking for NULL. There are four situations where this
+assumption is problematic:
+
+1. The device is a net device instead of a disk.
+2. The device is an abstraction device, like LVM, RAID, or CRYPTO, which
+   is mostly logical "disk" ((lvmid/<UUID>) and so on).
+3. Firmware RAID may present the ESP to GRUB as an EFI disk (hd0) device
+   if it is contained within a Linux software RAID.
+4. When booting from a CD-ROM, the ESP is a VFAT image indexed by the El
+   Torito boot catalog. The boot device is set to (cd0), corresponding
+   to the CD-ROM image mounted as an ISO 9660 filesystem.
+
+As a result, get_part_uuid() could lead to a NULL pointer dereference
+and trigger a synchronous exception during boot if the ESP falls into
+one of these categories. This patch fixes the problem by adding the
+necessary checks to handle cases where the ESP is not a partition device.
+
+Additionally, to avoid disrupting the boot process, this patch relaxes
+the severity of the errors in this context to non-critical. Errors will
+be logged, but they will not prevent the boot process from continuing.
+
+Fixes: e0fa7dc84 (bli: Add a module for the Boot Loader Interface)
+
+Signed-off-by: Michael Chang <mchang@suse.com>
+Reviewed-By: Oliver Steffen <osteffen@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/commands/bli.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/bli.c b/grub-core/commands/bli.c
+index e0d8a54f7bea..298c5f70a876 100644
+--- a/grub-core/commands/bli.c
++++ b/grub-core/commands/bli.c
+@@ -48,6 +48,22 @@ get_part_uuid (const char *device_name, char **part_uuid)
+   if (device == NULL)
+     return grub_error (grub_errno, N_("cannot open device: %s"), device_name);
+ 
++  if (device->disk == NULL)
++    {
++      grub_dprintf ("bli", "%s is not a disk device, partuuid skipped\n", device_name);
++      *part_uuid = NULL;
++      grub_device_close (device);
++      return GRUB_ERR_NONE;
++    }
++
++  if (device->disk->partition == NULL)
++    {
++      grub_dprintf ("bli", "%s has no partition, partuuid skipped\n", device_name);
++      *part_uuid = NULL;
++      grub_device_close (device);
++      return GRUB_ERR_NONE;
++    }
++
+   disk = grub_disk_open (device->disk->name);
+   if (disk == NULL)
+     {
+@@ -99,7 +115,7 @@ set_loader_device_part_uuid (void)
+ 
+   status = get_part_uuid (device_name, &part_uuid);
+ 
+-  if (status == GRUB_ERR_NONE)
++  if (status == GRUB_ERR_NONE && part_uuid)
+     status = grub_efi_set_variable_to_string ("LoaderDevicePartUUID", &bli_vendor_guid, part_uuid,
+ 					      GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ 					      GRUB_EFI_VARIABLE_RUNTIME_ACCESS);
+@@ -117,4 +133,6 @@ GRUB_MOD_INIT (bli)
+ 				   GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ 				   GRUB_EFI_VARIABLE_RUNTIME_ACCESS);
+   set_loader_device_part_uuid ();
++  /* No error here is critical, other than being logged */
++  grub_print_error ();
+ }

0289-misc-Implement-grub_strlcpy.patch

@@ -14,7 +14,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 39 insertions(+)
 
 diff --git a/include/grub/misc.h b/include/grub/misc.h
-index db517ac..6b1e084 100644
+index db517acd5..6b1e084af 100644
 --- a/include/grub/misc.h
 +++ b/include/grub/misc.h
 @@ -72,6 +72,45 @@ grub_stpcpy (char *dest, const char *src)

0290-fs-ufs-Fix-a-heap-OOB-write.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
-index a354c92..0123510 100644
+index a354c92d9..01235101b 100644
 --- a/grub-core/fs/ufs.c
 +++ b/grub-core/fs/ufs.c
 @@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino)

0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
-index 91dc0e6..920112b 100644
+index 91dc0e69c..920112b03 100644
 --- a/grub-core/fs/hfs.c
 +++ b/grub-core/fs/hfs.c
 @@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk)

0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
-index c551ed6..646bce5 100644
+index c551ed6b5..646bce5eb 100644
 --- a/grub-core/fs/tar.c
 +++ b/grub-core/fs/tar.c
 @@ -78,6 +78,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,

0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch

@@ -20,7 +20,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
-index 646bce5..386c090 100644
+index 646bce5eb..386c09022 100644
 --- a/grub-core/fs/tar.c
 +++ b/grub-core/fs/tar.c
 @@ -25,6 +25,7 @@

0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c
-index 855e246..db8a65f 100644
+index 855e24618..db8a65f8d 100644
 --- a/grub-core/fs/f2fs.c
 +++ b/grub-core/fs/f2fs.c
 @@ -872,6 +872,9 @@ grub_f2fs_mount (grub_disk_t disk)

0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch

@@ -21,7 +21,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
-index 295822f..de71fd4 100644
+index 295822f69..de71fd486 100644
 --- a/grub-core/fs/hfsplus.c
 +++ b/grub-core/fs/hfsplus.c
 @@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk)

0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch

@@ -18,7 +18,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
-index 8c348b5..8d480e6 100644
+index 8c348b59a..8d480e602 100644
 --- a/grub-core/fs/iso9660.c
 +++ b/grub-core/fs/iso9660.c
 @@ -551,6 +551,9 @@ grub_iso9660_mount (grub_disk_t disk)

0297-fs-iso9660-Fix-invalid-free.patch

@@ -23,7 +23,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 12 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
-index 8d480e6..8e3c95c 100644
+index 8d480e602..8e3c95c4f 100644
 --- a/grub-core/fs/iso9660.c
 +++ b/grub-core/fs/iso9660.c
 @@ -628,9 +628,19 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,

0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch

@@ -19,7 +19,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 15 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index 6f7c439..32dec7f 100644
+index 6f7c43904..32dec7fb7 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -41,6 +41,12 @@ GRUB_MOD_LICENSE ("GPLv3+");

0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch

@@ -36,7 +36,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index 32dec7f..88fb884 100644
+index 32dec7fb7..88fb884df 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -46,6 +46,7 @@ GRUB_MOD_LICENSE ("GPLv3+");

0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch

@@ -29,7 +29,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 29 insertions(+), 12 deletions(-)
 
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index 88fb884..2bde48d 100644
+index 88fb884df..2bde48d45 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -265,6 +265,20 @@ static grub_dl_t my_mod;

0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch

@@ -20,7 +20,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index 2bde48d..70a2f49 100644
+index 2bde48d45..70a2f4947 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -279,7 +279,7 @@ get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2)

0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c
-index e1cc5e6..3f9f6b2 100644
+index e1cc5e62a..3f9f6b208 100644
 --- a/grub-core/fs/ext2.c
 +++ b/grub-core/fs/ext2.c
 @@ -495,6 +495,8 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)

0303-fs-ntfs-Fix-out-of-bounds-read.patch

@@ -23,7 +23,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index de435aa..8a53842 100644
+index de435aa14..8a5384247 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -139,6 +139,8 @@ free_attr (struct grub_ntfs_attr *at)

0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch

@@ -20,7 +20,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 29 insertions(+), 6 deletions(-)
 
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index 8a53842..dbda720 100644
+index 8a5384247..dbda720e1 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -119,13 +119,20 @@ static grub_err_t read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa,
@@ -128,7 +128,7 @@ index 8a53842..dbda720 100644
  
    if (pa >= mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR))
 diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h
-index d1a6af6..ec1c4db 100644
+index d1a6af696..ec1c4db38 100644
 --- a/include/grub/ntfs.h
 +++ b/include/grub/ntfs.h
 @@ -134,6 +134,7 @@ struct grub_ntfs_attr

0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch

@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 58 insertions(+), 13 deletions(-)
 
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index dbda720..1c678f3 100644
+index dbda720e1..1c678f3d0 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -70,6 +70,25 @@ res_attr_data_len (void *res_attr_ptr)
@@ -169,7 +169,7 @@ index dbda720..1c678f3 100644
      }
    pp = find_attr (at, attr);
 diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h
-index ec1c4db..2c80784 100644
+index ec1c4db38..2c8078403 100644
 --- a/include/grub/ntfs.h
 +++ b/include/grub/ntfs.h
 @@ -89,6 +89,8 @@ enum

0307-fs-xfs-Fix-out-of-bounds-read.patch

@@ -20,7 +20,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 11 insertions(+)
 
 diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
-index 92046f9..96f62c5 100644
+index 92046f9bd..96f62c5a4 100644
 --- a/grub-core/fs/xfs.c
 +++ b/grub-core/fs/xfs.c
 @@ -595,6 +595,17 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)

0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch

@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
-index 96f62c5..a837f98 100644
+index 96f62c5a4..a837f9824 100644
 --- a/grub-core/fs/xfs.c
 +++ b/grub-core/fs/xfs.c
 @@ -327,6 +327,8 @@ static int grub_xfs_sb_valid(struct grub_xfs_data *data)

0309-kern-file-Ensure-file-data-is-set.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c
-index 75510df..85e832b 100644
+index 75510df7c..85e832bd8 100644
 --- a/grub-core/kern/file.c
 +++ b/grub-core/kern/file.c
 @@ -124,6 +124,9 @@ grub_file_open (const char *name, enum grub_file_type type)

0310-kern-file-Implement-filesystem-reference-counting.patch

@@ -49,7 +49,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  30 files changed, 39 insertions(+)
 
 diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
-index ed606b3..9b0afb9 100644
+index ed606b3f1..9b0afb954 100644
 --- a/grub-core/fs/affs.c
 +++ b/grub-core/fs/affs.c
 @@ -703,6 +703,7 @@ static struct grub_fs grub_affs_fs =
@@ -61,7 +61,7 @@ index ed606b3..9b0afb9 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
-index 07cb3e3..f37b168 100644
+index 07cb3e3ac..f37b16895 100644
 --- a/grub-core/fs/bfs.c
 +++ b/grub-core/fs/bfs.c
 @@ -1106,6 +1106,7 @@ GRUB_MOD_INIT (bfs)
@@ -73,7 +73,7 @@ index 07cb3e3..f37b168 100644
  }
  
 diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
-index ad35e75..6593f51 100644
+index ad35e7575..6593f5175 100644
 --- a/grub-core/fs/btrfs.c
 +++ b/grub-core/fs/btrfs.c
 @@ -3402,6 +3402,7 @@ subvol_get_env (struct grub_env_var *var __attribute__ ((unused)),
@@ -85,7 +85,7 @@ index ad35e75..6593f51 100644
    cmd_info = grub_register_command("btrfs-info", grub_cmd_btrfs_info,
  				   "DEVICE",
 diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
-index 8ab7106..2332745 100644
+index 8ab7106af..2332745fe 100644
 --- a/grub-core/fs/cbfs.c
 +++ b/grub-core/fs/cbfs.c
 @@ -390,6 +390,7 @@ GRUB_MOD_INIT (cbfs)
@@ -97,7 +97,7 @@ index 8ab7106..2332745 100644
  }
  
 diff --git a/grub-core/fs/cpio.c b/grub-core/fs/cpio.c
-index dab5f98..1799f7f 100644
+index dab5f9898..1799f7ff5 100644
 --- a/grub-core/fs/cpio.c
 +++ b/grub-core/fs/cpio.c
 @@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size)
@@ -109,7 +109,7 @@ index dab5f98..1799f7f 100644
  }
  
 diff --git a/grub-core/fs/cpio_be.c b/grub-core/fs/cpio_be.c
-index 8465488..7bed1b8 100644
+index 846548892..7bed1b848 100644
 --- a/grub-core/fs/cpio_be.c
 +++ b/grub-core/fs/cpio_be.c
 @@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size)
@@ -121,7 +121,7 @@ index 8465488..7bed1b8 100644
  }
  
 diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c
-index 3f9f6b2..c3058f7 100644
+index 3f9f6b208..c3058f7e7 100644
 --- a/grub-core/fs/ext2.c
 +++ b/grub-core/fs/ext2.c
 @@ -1131,6 +1131,7 @@ static struct grub_fs grub_ext2_fs =
@@ -133,7 +133,7 @@ index 3f9f6b2..c3058f7 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c
-index db8a65f..f6d6bea 100644
+index db8a65f8d..f6d6beaa5 100644
 --- a/grub-core/fs/f2fs.c
 +++ b/grub-core/fs/f2fs.c
 @@ -1353,6 +1353,7 @@ static struct grub_fs grub_f2fs_fs = {
@@ -145,7 +145,7 @@ index db8a65f..f6d6bea 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/fat.c b/grub-core/fs/fat.c
-index c5efed7..6e62b91 100644
+index c5efed724..6e62b915d 100644
 --- a/grub-core/fs/fat.c
 +++ b/grub-core/fs/fat.c
 @@ -1312,6 +1312,7 @@ GRUB_MOD_INIT(fat)
@@ -157,7 +157,7 @@ index c5efed7..6e62b91 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
-index 920112b..ce7581d 100644
+index 920112b03..ce7581dd5 100644
 --- a/grub-core/fs/hfs.c
 +++ b/grub-core/fs/hfs.c
 @@ -1434,6 +1434,7 @@ static struct grub_fs grub_hfs_fs =
@@ -169,7 +169,7 @@ index 920112b..ce7581d 100644
      grub_fs_register (&grub_hfs_fs);
    my_mod = mod;
 diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
-index de71fd4..3f203ab 100644
+index de71fd486..3f203abcc 100644
 --- a/grub-core/fs/hfsplus.c
 +++ b/grub-core/fs/hfsplus.c
 @@ -1176,6 +1176,7 @@ static struct grub_fs grub_hfsplus_fs =
@@ -181,7 +181,7 @@ index de71fd4..3f203ab 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
-index 8e3c95c..c73cb9c 100644
+index 8e3c95c4f..c73cb9ce0 100644
 --- a/grub-core/fs/iso9660.c
 +++ b/grub-core/fs/iso9660.c
 @@ -1260,6 +1260,7 @@ static struct grub_fs grub_iso9660_fs =
@@ -193,7 +193,7 @@ index 8e3c95c..c73cb9c 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index 70a2f49..b0283ac 100644
+index 70a2f4947..b0283ac00 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -1005,6 +1005,7 @@ static struct grub_fs grub_jfs_fs =
@@ -205,7 +205,7 @@ index 70a2f49..b0283ac 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
-index 5354951..b7679c3 100644
+index 5354951d1..b7679c3e2 100644
 --- a/grub-core/fs/minix.c
 +++ b/grub-core/fs/minix.c
 @@ -734,6 +734,7 @@ GRUB_MOD_INIT(minix)
@@ -217,7 +217,7 @@ index 5354951..b7679c3 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/newc.c b/grub-core/fs/newc.c
-index 4fb8b2e..43b7f8b 100644
+index 4fb8b2e3d..43b7f8b64 100644
 --- a/grub-core/fs/newc.c
 +++ b/grub-core/fs/newc.c
 @@ -64,6 +64,7 @@ read_number (const char *str, grub_size_t size)
@@ -229,7 +229,7 @@ index 4fb8b2e..43b7f8b 100644
  }
  
 diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
-index fc7374e..4e1e717 100644
+index fc7374ead..4e1e71738 100644
 --- a/grub-core/fs/nilfs2.c
 +++ b/grub-core/fs/nilfs2.c
 @@ -1231,6 +1231,7 @@ GRUB_MOD_INIT (nilfs2)
@@ -241,7 +241,7 @@ index fc7374e..4e1e717 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index 64f4f22..4e144cc 100644
+index 64f4f2221..4e144cc3c 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -1541,6 +1541,7 @@ static struct grub_fs grub_ntfs_fs =
@@ -253,7 +253,7 @@ index 64f4f22..4e144cc 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/odc.c b/grub-core/fs/odc.c
-index 7900006..8e4e8ae 100644
+index 790000622..8e4e8aeac 100644
 --- a/grub-core/fs/odc.c
 +++ b/grub-core/fs/odc.c
 @@ -52,6 +52,7 @@ read_number (const char *str, grub_size_t size)
@@ -265,7 +265,7 @@ index 7900006..8e4e8ae 100644
  }
  
 diff --git a/grub-core/fs/proc.c b/grub-core/fs/proc.c
-index 5f51650..bcde433 100644
+index 5f516502d..bcde43349 100644
 --- a/grub-core/fs/proc.c
 +++ b/grub-core/fs/proc.c
 @@ -192,6 +192,7 @@ static struct grub_fs grub_procfs_fs =
@@ -277,7 +277,7 @@ index 5f51650..bcde433 100644
    grub_fs_register (&grub_procfs_fs);
  }
 diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
-index 42818c3..e8b0b63 100644
+index 42818c376..e8b0b6383 100644
 --- a/grub-core/fs/reiserfs.c
 +++ b/grub-core/fs/reiserfs.c
 @@ -1407,6 +1407,7 @@ static struct grub_fs grub_reiserfs_fs =
@@ -289,7 +289,7 @@ index 42818c3..e8b0b63 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
-index 1f7dcfc..56b0b2b 100644
+index 1f7dcfca1..56b0b2b2f 100644
 --- a/grub-core/fs/romfs.c
 +++ b/grub-core/fs/romfs.c
 @@ -475,6 +475,7 @@ static struct grub_fs grub_romfs_fs =
@@ -301,7 +301,7 @@ index 1f7dcfc..56b0b2b 100644
  }
  
 diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
-index 983e880..f0d7cac 100644
+index 983e88008..f0d7cac43 100644
 --- a/grub-core/fs/sfs.c
 +++ b/grub-core/fs/sfs.c
 @@ -779,6 +779,7 @@ static struct grub_fs grub_sfs_fs =
@@ -313,7 +313,7 @@ index 983e880..f0d7cac 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
-index a30e6eb..6e9d638 100644
+index a30e6ebe1..6e9d63874 100644
 --- a/grub-core/fs/squash4.c
 +++ b/grub-core/fs/squash4.c
 @@ -1044,6 +1044,7 @@ static struct grub_fs grub_squash_fs =
@@ -325,7 +325,7 @@ index a30e6eb..6e9d638 100644
  }
  
 diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
-index 386c090..fd2ec1f 100644
+index 386c09022..fd2ec1f74 100644
 --- a/grub-core/fs/tar.c
 +++ b/grub-core/fs/tar.c
 @@ -354,6 +354,7 @@ static struct grub_fs grub_cpio_fs = {
@@ -337,7 +337,7 @@ index 386c090..fd2ec1f 100644
  }
  
 diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
-index b836e61..8765c63 100644
+index b836e6107..8765c633c 100644
 --- a/grub-core/fs/udf.c
 +++ b/grub-core/fs/udf.c
 @@ -1455,6 +1455,7 @@ static struct grub_fs grub_udf_fs = {
@@ -349,7 +349,7 @@ index b836e61..8765c63 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
-index 0123510..e82d935 100644
+index 01235101b..e82d9356d 100644
 --- a/grub-core/fs/ufs.c
 +++ b/grub-core/fs/ufs.c
 @@ -899,6 +899,7 @@ GRUB_MOD_INIT(ufs1)
@@ -361,7 +361,7 @@ index 0123510..e82d935 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
-index a837f98..6c952ae 100644
+index a837f9824..6c952aef1 100644
 --- a/grub-core/fs/xfs.c
 +++ b/grub-core/fs/xfs.c
 @@ -1304,6 +1304,7 @@ static struct grub_fs grub_xfs_fs =
@@ -373,7 +373,7 @@ index a837f98..6c952ae 100644
    my_mod = mod;
  }
 diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index b5453e0..a497b18 100644
+index b5453e006..a497b1869 100644
 --- a/grub-core/fs/zfs/zfs.c
 +++ b/grub-core/fs/zfs/zfs.c
 @@ -4424,6 +4424,7 @@ static struct grub_fs grub_zfs_fs = {
@@ -385,7 +385,7 @@ index b5453e0..a497b18 100644
  #ifndef GRUB_UTIL
    my_mod = mod;
 diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c
-index 85e832b..ec90a26 100644
+index 85e832bd8..ec90a26ba 100644
 --- a/grub-core/kern/file.c
 +++ b/grub-core/kern/file.c
 @@ -25,6 +25,7 @@
@@ -417,7 +417,7 @@ index 85e832b..ec90a26 100644
    if (file->fs->fs_close)
      (file->fs->fs_close) (file);
 diff --git a/include/grub/fs.h b/include/grub/fs.h
-index 026bc3b..df4c93b 100644
+index 026bc3bb8..df4c93b16 100644
 --- a/include/grub/fs.h
 +++ b/include/grub/fs.h
 @@ -23,6 +23,7 @@

0311-cli_lock-Add-build-option-to-block-command-line-inte.patch

@@ -24,7 +24,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11 files changed, 104 insertions(+), 22 deletions(-)
 
 diff --git a/docs/grub.texi b/docs/grub.texi
-index 096a3cd..9ce9c5b 100644
+index 096a3cde0..9ce9c5b82 100644
 --- a/docs/grub.texi
 +++ b/docs/grub.texi
 @@ -6520,8 +6520,10 @@ the GRUB command line, edit menu entries, and execute any menu entry.  If
@@ -41,7 +41,7 @@ index 096a3cd..9ce9c5b 100644
  Other users may be allowed to execute specific menu entries by giving a list of
  usernames (as above) using the @option{--users} option to the
 diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c
-index 8e89763..0d6b813 100644
+index 8e89763f4..0d6b8138d 100644
 --- a/grub-core/kern/main.c
 +++ b/grub-core/kern/main.c
 @@ -30,11 +30,14 @@
@@ -99,7 +99,7 @@ index 8e89763..0d6b813 100644
       for convenience.  */
    grub_set_prefix_and_root ();
 diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
-index dcd7d44..4259857 100644
+index dcd7d4439..4259857ba 100644
 --- a/grub-core/kern/rescue_reader.c
 +++ b/grub-core/kern/rescue_reader.c
 @@ -78,6 +78,19 @@ grub_rescue_read_line (char **line, int cont,
@@ -123,7 +123,7 @@ index dcd7d44..4259857 100644
  
    while (1)
 diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
-index 517fc62..d940201 100644
+index 517fc623f..d94020186 100644
 --- a/grub-core/normal/auth.c
 +++ b/grub-core/normal/auth.c
 @@ -209,6 +209,9 @@ grub_auth_check_authentication (const char *userlist)
@@ -137,7 +137,7 @@ index 517fc62..d940201 100644
  
    if (is_authenticated (userlist))
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb..9c383e6 100644
+index b1321eb26..9c383e64a 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
 @@ -178,21 +178,24 @@ command-line or ESC to discard edits and return to the GRUB menu."),
@@ -180,7 +180,7 @@ index b1321eb..9c383e6 100644
      }
    return ret;
 diff --git a/include/grub/kernel.h b/include/grub/kernel.h
-index 98edc08..f98a780 100644
+index 98edc0863..f98a780da 100644
 --- a/include/grub/kernel.h
 +++ b/include/grub/kernel.h
 @@ -33,6 +33,7 @@ enum
@@ -192,7 +192,7 @@ index 98edc08..f98a780 100644
  
  /* The module header.  */
 diff --git a/include/grub/misc.h b/include/grub/misc.h
-index 6b1e084..d6e9bae 100644
+index 6b1e084af..d6e9bae8e 100644
 --- a/include/grub/misc.h
 +++ b/include/grub/misc.h
 @@ -442,6 +442,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n,
@@ -205,7 +205,7 @@ index 6b1e084..d6e9bae 100644
  #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \
      (defined(__riscv) && (__riscv_xlen == 32)))
 diff --git a/include/grub/util/install.h b/include/grub/util/install.h
-index 59eabb9..dbf3c21 100644
+index 59eabb9bb..dbf3c216d 100644
 --- a/include/grub/util/install.h
 +++ b/include/grub/util/install.h
 @@ -72,6 +72,8 @@
@@ -238,7 +238,7 @@ index 59eabb9..dbf3c21 100644
  const struct grub_install_image_target_desc *
  grub_install_get_image_target (const char *arg);
 diff --git a/util/grub-install-common.c b/util/grub-install-common.c
-index 67afc2e..42aec14 100644
+index 67afc2eed..42aec141e 100644
 --- a/util/grub-install-common.c
 +++ b/util/grub-install-common.c
 @@ -469,6 +469,7 @@ static char **x509keys;
@@ -284,7 +284,7 @@ index 67afc2e..42aec14 100644
      grub_install_pop_module ();
  }
 diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c
-index e1f1112..13bdc6c 100644
+index e1f111278..13bdc6cf0 100644
 --- a/util/grub-mkimage.c
 +++ b/util/grub-mkimage.c
 @@ -84,6 +84,7 @@ static struct argp_option options[] = {
@@ -325,7 +325,7 @@ index e1f1112..13bdc6c 100644
    if (grub_util_file_sync (fp) < 0)
      grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout",
 diff --git a/util/mkimage.c b/util/mkimage.c
-index 425d920..f31fdef 100644
+index 425d920ff..f31fdefa8 100644
 --- a/util/mkimage.c
 +++ b/util/mkimage.c
 @@ -888,7 +888,7 @@ grub_install_generate_image (const char *dir, const char *prefix,

0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch

@@ -41,7 +41,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  9 files changed, 171 insertions(+), 1 deletion(-)
 
 diff --git a/docs/grub.texi b/docs/grub.texi
-index 9ce9c5b..2d6d73a 100644
+index 9ce9c5b82..2d6d73a78 100644
 --- a/docs/grub.texi
 +++ b/docs/grub.texi
 @@ -6882,6 +6882,35 @@ sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed
@@ -81,7 +81,7 @@ index 9ce9c5b..2d6d73a 100644
  @node Platform limitations
  @chapter Platform limitations
 diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 98e176a..06a42b2 100644
+index 98e176a13..06a42b2d7 100644
 --- a/grub-core/disk/cryptodisk.c
 +++ b/grub-core/disk/cryptodisk.c
 @@ -1144,7 +1144,9 @@ grub_cryptodisk_scan_device_real (const char *name,
@@ -186,7 +186,7 @@ index 98e176a..06a42b2 100644
  {
    .name = "luks_script",
 diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c
-index 0d6b813..2e6b79e 100644
+index 0d6b8138d..2e6b79ee3 100644
 --- a/grub-core/kern/main.c
 +++ b/grub-core/kern/main.c
 @@ -37,6 +37,7 @@
@@ -216,7 +216,7 @@ index 0d6b813..2e6b79e 100644
  check_is_cli_disabled (void)
  {
 diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
-index d940201..71b361b 100644
+index d94020186..71b361bc0 100644
 --- a/grub-core/normal/auth.c
 +++ b/grub-core/normal/auth.c
 @@ -25,6 +25,10 @@
@@ -264,7 +264,7 @@ index d940201..71b361b 100644
  grub_auth_check_authentication (const char *userlist)
  {
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index 26872ce..86ffb38 100644
+index 26872ce94..86ffb388d 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -557,9 +557,13 @@ grub_cmdline_run (int nested, int force_auth)
@@ -282,7 +282,7 @@ index 26872ce..86ffb38 100644
        return;
      }
 diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c
-index ade56be..8b0d17e 100644
+index ade56be2b..8b0d17e3f 100644
 --- a/grub-core/normal/menu_entry.c
 +++ b/grub-core/normal/menu_entry.c
 @@ -1255,9 +1255,13 @@ grub_menu_entry_run (grub_menu_entry_t entry)
@@ -300,7 +300,7 @@ index ade56be..8b0d17e 100644
        return;
      }
 diff --git a/include/grub/auth.h b/include/grub/auth.h
-index 7473344..21d5190 100644
+index 747334451..21d5190f0 100644
 --- a/include/grub/auth.h
 +++ b/include/grub/auth.h
 @@ -33,5 +33,6 @@ grub_err_t grub_auth_unregister_authentication (const char *user);
@@ -311,7 +311,7 @@ index 7473344..21d5190 100644
  
  #endif /* ! GRUB_AUTH_HEADER */
 diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index d94df68..d2572f8 100644
+index d94df68b6..d2572f8b0 100644
 --- a/include/grub/cryptodisk.h
 +++ b/include/grub/cryptodisk.h
 @@ -187,4 +187,7 @@ grub_util_get_geli_uuid (const char *dev);
@@ -323,7 +323,7 @@ index d94df68..d2572f8 100644
 +#endif
  #endif
 diff --git a/include/grub/misc.h b/include/grub/misc.h
-index d6e9bae..0429339 100644
+index d6e9bae8e..0429339ef 100644
 --- a/include/grub/misc.h
 +++ b/include/grub/misc.h
 @@ -443,6 +443,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n,

0313-disk-loopback-Reference-tracking-for-the-loopback.patch

@@ -18,7 +18,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  3 files changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c
-index 11a5e0c..f392813 100644
+index 11a5e0cbd..f39281323 100644
 --- a/grub-core/disk/loopback.c
 +++ b/grub-core/disk/loopback.c
 @@ -25,6 +25,7 @@
@@ -81,7 +81,7 @@ index 11a5e0c..f392813 100644
      .disk_write = grub_loopback_write,
      .next = 0
 diff --git a/include/grub/err.h b/include/grub/err.h
-index 3c587b9..29f1a73 100644
+index 3c587b9b8..29f1a73c5 100644
 --- a/include/grub/err.h
 +++ b/include/grub/err.h
 @@ -73,7 +73,8 @@ typedef enum
@@ -95,7 +95,7 @@ index 3c587b9..29f1a73 100644
  grub_err_t;
  
 diff --git a/include/grub/loopback.h b/include/grub/loopback.h
-index 3b9a9e3..915ef65 100644
+index 3b9a9e32e..915ef65fc 100644
 --- a/include/grub/loopback.h
 +++ b/include/grub/loopback.h
 @@ -25,6 +25,7 @@ struct grub_loopback

0314-kern-disk-Limit-recursion-depth.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 22 insertions(+), 8 deletions(-)
 
 diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c
-index 355b657..5747ad8 100644
+index 355b6579d..5747ad85c 100644
 --- a/grub-core/kern/disk.c
 +++ b/grub-core/kern/disk.c
 @@ -28,6 +28,10 @@
@@ -105,7 +105,7 @@ index 355b657..5747ad8 100644
  
  grub_uint64_t
 diff --git a/include/grub/err.h b/include/grub/err.h
-index 29f1a73..7530f58 100644
+index 29f1a73c5..7530f58b2 100644
 --- a/include/grub/err.h
 +++ b/include/grub/err.h
 @@ -74,7 +74,8 @@ typedef enum

0315-kern-partition-Limit-recursion-in-part_iterate.patch

@@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c
-index edad9f9..704512a 100644
+index edad9f9e4..704512a20 100644
 --- a/grub-core/kern/partition.c
 +++ b/grub-core/kern/partition.c
 @@ -28,6 +28,9 @@

0316-script-execute-Limit-the-recursion-depth.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 14 insertions(+)
 
 diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
-index c19b4bf..7ed3a1a 100644
+index c19b4bf70..7ed3a1a03 100644
 --- a/grub-core/script/execute.c
 +++ b/grub-core/script/execute.c
 @@ -36,10 +36,18 @@

0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch

@@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index fdec64d..9959a2a 100644
+index fdec64d55..9959a2ae8 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -2221,6 +2221,8 @@ GRUB_MOD_FINI(net)

0318-net-Remove-variables-hooks-when-interface-is-unregis.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 34 insertions(+), 10 deletions(-)
 
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index 9959a2a..22d5cc3 100644
+index 9959a2ae8..22d5cc3ba 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -1066,6 +1066,39 @@ grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter,
@@ -61,7 +61,7 @@ index 9959a2a..22d5cc3 100644
  grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter,
  			 int mask)
 diff --git a/include/grub/net.h b/include/grub/net.h
-index 868c9a2..273afbd 100644
+index 868c9a2ef..273afbddf 100644
 --- a/include/grub/net.h
 +++ b/include/grub/net.h
 @@ -625,16 +625,7 @@ void grub_bootp_fini (void);

0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch

@@ -21,7 +21,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  3 files changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index 22d5cc3..6c8dfcb 100644
+index 22d5cc3ba..6c8dfcba2 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -2023,14 +2023,15 @@ grub_config_search_through (char *config, char *suffix,
@@ -52,7 +52,7 @@ index 22d5cc3..6c8dfcb 100644
              return GRUB_ERR_NONE;
          }
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index 86ffb38..cad840e 100644
+index 86ffb388d..cad840e06 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -360,7 +360,7 @@ grub_try_normal_prefix (const char *prefix)
@@ -65,7 +65,7 @@ index 86ffb38..cad840e 100644
  
      if (err != GRUB_ERR_NONE)
 diff --git a/include/grub/net.h b/include/grub/net.h
-index 273afbd..d280acd 100644
+index 273afbddf..d280acd72 100644
 --- a/include/grub/net.h
 +++ b/include/grub/net.h
 @@ -655,7 +655,7 @@ void

0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch

@@ -22,7 +22,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 24 insertions(+), 14 deletions(-)
 
 diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
-index f300a9d..3d96e50 100644
+index f300a9d40..3d96e50f4 100644
 --- a/grub-core/net/tftp.c
 +++ b/grub-core/net/tftp.c
 @@ -266,17 +266,19 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)),

0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
-index ae634fd..631a893 100644
+index ae634fd41..631a89356 100644
 --- a/grub-core/video/readers/jpeg.c
 +++ b/grub-core/video/readers/jpeg.c
 @@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)

0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch

@@ -24,7 +24,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  4 files changed, 19 insertions(+), 12 deletions(-)
 
 diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
-index 2bd3ac7..2001043 100644
+index 2bd3ac76f..2001043cf 100644
 --- a/grub-core/commands/minicmd.c
 +++ b/grub-core/commands/minicmd.c
 @@ -167,7 +167,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)),
@@ -37,7 +37,7 @@ index 2bd3ac7..2001043 100644
        {
  	if (dep != mod->dep)
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index 2eaef71..fe7c3b9 100644
+index 2eaef7150..fe7c3b940 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
 @@ -32,6 +32,7 @@
@@ -90,7 +90,7 @@ index 2eaef71..fe7c3b9 100644
  {
    if (mod == NULL)
 diff --git a/include/grub/dl.h b/include/grub/dl.h
-index 1e1262a..055bb56 100644
+index 1e1262a28..055bb564e 100644
 --- a/include/grub/dl.h
 +++ b/include/grub/dl.h
 @@ -177,7 +177,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t;
@@ -116,7 +116,7 @@ index 1e1262a..055bb56 100644
  extern grub_dl_t EXPORT_VAR(grub_dl_head);
  
 diff --git a/util/misc.c b/util/misc.c
-index d545212..0f928e5 100644
+index d545212d9..0f928e5b4 100644
 --- a/util/misc.c
 +++ b/util/misc.c
 @@ -190,14 +190,14 @@ grub_xputs_real (const char *str)

0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: B Horn <b@horn.uk>
 Date: Tue, 11 Feb 2025 17:01:26 -0600
-Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in
+Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in 
  grub_dl_relocate_symbols()
 
 The grub_dl_relocate_symbols() iterates through the sections in
@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
-index fe7c3b9..cb49bdc 100644
+index fe7c3b940..cb49bdc4b 100644
 --- a/grub-core/kern/dl.c
 +++ b/grub-core/kern/dl.c
 @@ -681,6 +681,9 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr)

0324-commands-extcmd-Missing-check-for-failed-allocation.patch

@@ -19,7 +19,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
-index 90a5ca2..c236be1 100644
+index 90a5ca24a..c236be13a 100644
 --- a/grub-core/commands/extcmd.c
 +++ b/grub-core/commands/extcmd.c
 @@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args,

0325-commands-ls-Fix-NULL-dereference.patch

@@ -14,7 +14,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c
-index 6a1c7f5..f660946 100644
+index 6a1c7f5d3..f660946a2 100644
 --- a/grub-core/commands/ls.c
 +++ b/grub-core/commands/ls.c
 @@ -241,7 +241,11 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human)

0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
-index 847a504..fa3ef5c 100644
+index 847a5046a..fa3ef5c75 100644
 --- a/grub-core/commands/pgp.c
 +++ b/grub-core/commands/pgp.c
 @@ -982,6 +982,8 @@ GRUB_MOD_INIT(pgp)

0327-normal-Remove-variables-hooks-on-module-unload.patch

@@ -21,7 +21,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
-index cad840e..dd20e51 100644
+index cad840e06..dd20e5129 100644
 --- a/grub-core/normal/main.c
 +++ b/grub-core/normal/main.c
 @@ -690,7 +690,9 @@ GRUB_MOD_FINI(normal)

0328-gettext-Remove-variables-hooks-on-module-unload.patch

@@ -18,7 +18,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
-index 631af7a..465143c 100644
+index 631af7a94..465143cb6 100644
 --- a/grub-core/gettext/gettext.c
 +++ b/grub-core/gettext/gettext.c
 @@ -542,6 +542,10 @@ GRUB_MOD_INIT (gettext)

0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch

@@ -19,7 +19,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
-index 465143c..c170402 100644
+index 465143cb6..c17040269 100644
 --- a/grub-core/gettext/gettext.c
 +++ b/grub-core/gettext/gettext.c
 @@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,

0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch

@@ -20,7 +20,7 @@ Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
-index c170402..fffe3a0 100644
+index c17040269..fffe3a054 100644
 --- a/grub-core/gettext/gettext.c
 +++ b/grub-core/gettext/gettext.c
 @@ -26,6 +26,7 @@

0331-commands-read-Fix-an-integer-overflow-when-supplying.patch

@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 15 insertions(+), 4 deletions(-)
 
 diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c
-index 597c907..8d72e45 100644
+index 597c90706..8d72e45c9 100644
 --- a/grub-core/commands/read.c
 +++ b/grub-core/commands/read.c
 @@ -25,6 +25,7 @@

0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch

@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 18 insertions(+), 3 deletions(-)
 
 diff --git a/grub-core/commands/test.c b/grub-core/commands/test.c
-index 62d3fb3..b585c3d 100644
+index 62d3fb398..b585c3d70 100644
 --- a/grub-core/commands/test.c
 +++ b/grub-core/commands/test.c
 @@ -29,6 +29,9 @@

0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
-index 2001043..9efb771 100644
+index 2001043cf..9efb7718c 100644
 --- a/grub-core/commands/minicmd.c
 +++ b/grub-core/commands/minicmd.c
 @@ -215,8 +215,8 @@ GRUB_MOD_INIT(minicmd)

0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch

@@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 12 insertions(+), 9 deletions(-)
 
 diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c
-index 39cf3a0..9d8a54a 100644
+index 39cf3a06d..9d8a54a4b 100644
 --- a/grub-core/commands/memrw.c
 +++ b/grub-core/commands/memrw.c
 @@ -126,17 +126,20 @@ GRUB_MOD_INIT(memrw)

0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch

@@ -11,7 +11,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c
-index eaa1246..d6f61d9 100644
+index eaa12465b..d6f61d98a 100644
 --- a/grub-core/commands/hexdump.c
 +++ b/grub-core/commands/hexdump.c
 @@ -24,6 +24,7 @@

0336-fs-bfs-Disable-under-lockdown.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 8 insertions(+), 3 deletions(-)
 
 diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
-index f37b168..c92fd79 100644
+index f37b16895..c92fd7916 100644
 --- a/grub-core/fs/bfs.c
 +++ b/grub-core/fs/bfs.c
 @@ -30,6 +30,7 @@

0337-fs-Disable-many-filesystems-under-lockdown.patch

@@ -33,7 +33,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11 files changed, 88 insertions(+), 33 deletions(-)
 
 diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
-index 9b0afb9..520a001 100644
+index 9b0afb954..520a001c7 100644
 --- a/grub-core/fs/affs.c
 +++ b/grub-core/fs/affs.c
 @@ -26,6 +26,7 @@
@@ -65,7 +65,7 @@ index 9b0afb9..520a001 100644
 +    grub_fs_unregister (&grub_affs_fs);
  }
 diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
-index 2332745..b62c877 100644
+index 2332745fe..b62c8777c 100644
 --- a/grub-core/fs/cbfs.c
 +++ b/grub-core/fs/cbfs.c
 @@ -26,6 +26,7 @@
@@ -98,7 +98,7 @@ index 2332745..b62c877 100644
    fini_cbfsdisk ();
  #endif
 diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
-index b0283ac..ab175c7 100644
+index b0283ac00..ab175c7f1 100644
 --- a/grub-core/fs/jfs.c
 +++ b/grub-core/fs/jfs.c
 @@ -26,6 +26,7 @@
@@ -130,7 +130,7 @@ index b0283ac..ab175c7 100644
 +    grub_fs_unregister (&grub_jfs_fs);
  }
 diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
-index b7679c3..4440fcc 100644
+index b7679c3e2..4440fcca8 100644
 --- a/grub-core/fs/minix.c
 +++ b/grub-core/fs/minix.c
 @@ -25,6 +25,7 @@
@@ -164,7 +164,7 @@ index b7679c3..4440fcc 100644
 +    grub_fs_unregister (&grub_minix_fs);
  }
 diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
-index 4e1e717..26e6077 100644
+index 4e1e71738..26e6077ff 100644
 --- a/grub-core/fs/nilfs2.c
 +++ b/grub-core/fs/nilfs2.c
 @@ -34,6 +34,7 @@
@@ -196,7 +196,7 @@ index 4e1e717..26e6077 100644
 +    grub_fs_unregister (&grub_nilfs2_fs);
  }
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index 4e144cc..e00349b 100644
+index 4e144cc3c..e00349b1d 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -27,6 +27,7 @@
@@ -228,7 +228,7 @@ index 4e144cc..e00349b 100644
 +    grub_fs_unregister (&grub_ntfs_fs);
  }
 diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
-index e8b0b63..ca47e0a 100644
+index e8b0b6383..ca47e0a43 100644
 --- a/grub-core/fs/reiserfs.c
 +++ b/grub-core/fs/reiserfs.c
 @@ -39,6 +39,7 @@
@@ -260,7 +260,7 @@ index e8b0b63..ca47e0a 100644
 +    grub_fs_unregister (&grub_reiserfs_fs);
  }
 diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
-index 56b0b2b..eafab03 100644
+index 56b0b2b2f..eafab03b2 100644
 --- a/grub-core/fs/romfs.c
 +++ b/grub-core/fs/romfs.c
 @@ -23,6 +23,7 @@
@@ -291,7 +291,7 @@ index 56b0b2b..eafab03 100644
 +    grub_fs_unregister (&grub_romfs_fs);
  }
 diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
-index f0d7cac..88705b3 100644
+index f0d7cac43..88705b3a2 100644
 --- a/grub-core/fs/sfs.c
 +++ b/grub-core/fs/sfs.c
 @@ -26,6 +26,7 @@
@@ -323,7 +323,7 @@ index f0d7cac..88705b3 100644
 +    grub_fs_unregister (&grub_sfs_fs);
  }
 diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
-index 8765c63..3d5ee5a 100644
+index 8765c633c..3d5ee5af5 100644
 --- a/grub-core/fs/udf.c
 +++ b/grub-core/fs/udf.c
 @@ -27,6 +27,7 @@
@@ -355,7 +355,7 @@ index 8765c63..3d5ee5a 100644
 +    grub_fs_unregister (&grub_udf_fs);
  }
 diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
-index e82d935..8b5adbd 100644
+index e82d9356d..8b5adbd48 100644
 --- a/grub-core/fs/ufs.c
 +++ b/grub-core/fs/ufs.c
 @@ -25,6 +25,7 @@

0338-disk-Use-safe-math-macros-to-prevent-overflows.patch

@@ -20,7 +20,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  8 files changed, 172 insertions(+), 35 deletions(-)
 
 diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 06a42b2..8727760 100644
+index 06a42b2d7..872776010 100644
 --- a/grub-core/disk/cryptodisk.c
 +++ b/grub-core/disk/cryptodisk.c
 @@ -26,6 +26,7 @@
@@ -92,7 +92,7 @@ index 06a42b2..8727760 100644
      return 0;
  
 diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
-index c35ce89..fef0b81 100644
+index c35ce8915..fef0b815a 100644
 --- a/grub-core/disk/diskfilter.c
 +++ b/grub-core/disk/diskfilter.c
 @@ -24,6 +24,7 @@
@@ -126,7 +126,7 @@ index c35ce89..fef0b81 100644
      goto fail;
  
 diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c
-index cd923b9..9d4c426 100644
+index cd923b90f..9d4c42665 100644
 --- a/grub-core/disk/ieee1275/obdisk.c
 +++ b/grub-core/disk/ieee1275/obdisk.c
 @@ -26,6 +26,7 @@
@@ -225,7 +225,7 @@ index cd923b9..9d4c426 100644
  
    /*
 diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c
-index 57624fd..6c62863 100644
+index 57624fde5..6c628635f 100644
 --- a/grub-core/disk/ieee1275/ofdisk.c
 +++ b/grub-core/disk/ieee1275/ofdisk.c
 @@ -25,6 +25,7 @@
@@ -362,7 +362,7 @@ index 57624fd..6c62863 100644
      {
        grub_print_error ();
 diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
-index 34bfe6b..4101b15 100644
+index 34bfe6bd1..4101b15d8 100644
 --- a/grub-core/disk/ldm.c
 +++ b/grub-core/disk/ldm.c
 @@ -220,6 +220,7 @@ make_vg (grub_disk_t disk,
@@ -451,7 +451,7 @@ index 34bfe6b..4101b15 100644
  	      if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
  		  grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
 diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
-index d510640..8036d76 100644
+index d5106402f..8036d76ff 100644
 --- a/grub-core/disk/luks2.c
 +++ b/grub-core/disk/luks2.c
 @@ -26,6 +26,7 @@
@@ -483,7 +483,7 @@ index d510640..8036d76 100644
        return GRUB_ERR_OUT_OF_MEMORY;
  
 diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c
-index 613779c..36de3bf 100644
+index 613779cf3..36de3bfab 100644
 --- a/grub-core/disk/memdisk.c
 +++ b/grub-core/disk/memdisk.c
 @@ -23,6 +23,7 @@
@@ -508,7 +508,7 @@ index 613779c..36de3bf 100644
  
  	grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n");
 diff --git a/grub-core/disk/plainmount.c b/grub-core/disk/plainmount.c
-index 47e6480..21ec407 100644
+index 47e64805f..21ec4072c 100644
 --- a/grub-core/disk/plainmount.c
 +++ b/grub-core/disk/plainmount.c
 @@ -24,6 +24,7 @@

0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alec Brown <alec.r.brown@oracle.com>
 Date: Wed, 12 Feb 2025 10:26:44 -0600
-Subject: [PATCH] disk: Prevent overflows when allocating memory for arrays
+Subject: [PATCH] disk: Prevent overflows when allocating memory for  arrays
 
 Use grub_calloc() when allocating memory for arrays to ensure proper
 overflow checks are in place.
@@ -13,7 +13,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+), 4 deletions(-)
 
 diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
-index 7942485..a395b20 100644
+index 794248540..a395b200d 100644
 --- a/grub-core/disk/lvm.c
 +++ b/grub-core/disk/lvm.c
 @@ -671,8 +671,7 @@ grub_lvm_detect (grub_disk_t disk,

0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch

@@ -20,7 +20,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  5 files changed, 30 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/disk/ata.c b/grub-core/disk/ata.c
-index 7b6ac7b..a2433e2 100644
+index 7b6ac7bfc..a2433e29e 100644
 --- a/grub-core/disk/ata.c
 +++ b/grub-core/disk/ata.c
 @@ -112,10 +112,10 @@ grub_ata_identify (struct grub_ata *dev)
@@ -37,7 +37,7 @@ index 7b6ac7b..a2433e2 100644
    grub_memset (&parms, 0, sizeof (parms));
    parms.buffer = info16;
 diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c
-index 9d4c426..fcc39e0 100644
+index 9d4c42665..fcc39e0a2 100644
 --- a/grub-core/disk/ieee1275/obdisk.c
 +++ b/grub-core/disk/ieee1275/obdisk.c
 @@ -423,6 +423,12 @@ canonicalise_disk (const char *devname)
@@ -54,7 +54,7 @@ index 9d4c426..fcc39e0 100644
        grub_snprintf (real_canon, real_unit_str_len, "%s/disk@%s",
                       op->name, real_unit_address);
 diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
-index 4101b15..048e29c 100644
+index 4101b15d8..048e29cd0 100644
 --- a/grub-core/disk/ldm.c
 +++ b/grub-core/disk/ldm.c
 @@ -292,6 +292,12 @@ make_vg (grub_disk_t disk,
@@ -71,7 +71,7 @@ index 4101b15..048e29c 100644
  	  pv->id.uuid[pv->id.uuidlen] = 0;
  
 diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
-index a395b20..b2dff76 100644
+index a395b200d..b2dff76d1 100644
 --- a/grub-core/disk/lvm.c
 +++ b/grub-core/disk/lvm.c
 @@ -370,6 +370,8 @@ grub_lvm_detect (grub_disk_t disk,
@@ -138,7 +138,7 @@ index a395b20..b2dff76 100644
  		      p = grub_strstr (p, "raids = [");
  		      if (p == NULL)
 diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c
-index 36de3bf..2d7afae 100644
+index 36de3bfab..2d7afaea3 100644
 --- a/grub-core/disk/memdisk.c
 +++ b/grub-core/disk/memdisk.c
 @@ -103,6 +103,8 @@ GRUB_MOD_INIT(memdisk)

0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch

@@ -14,7 +14,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c
-index 6c62863..71237b2 100644
+index 6c628635f..71237b256 100644
 --- a/grub-core/disk/ieee1275/ofdisk.c
 +++ b/grub-core/disk/ieee1275/ofdisk.c
 @@ -269,7 +269,10 @@ dev_iterate (const struct grub_ieee1275_devalias *alias)

0342-fs-Use-safe-math-macros-to-prevent-overflows.patch

@@ -19,7 +19,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  7 files changed, 97 insertions(+), 17 deletions(-)
 
 diff --git a/grub-core/fs/archelp.c b/grub-core/fs/archelp.c
-index c1dcc62..0816b28 100644
+index c1dcc6285..0816b28de 100644
 --- a/grub-core/fs/archelp.c
 +++ b/grub-core/fs/archelp.c
 @@ -21,6 +21,7 @@
@@ -53,7 +53,7 @@ index c1dcc62..0816b28 100644
      return grub_errno;
  
 diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
-index 6593f51..3e4924b 100644
+index 6593f5175..3e4924b65 100644
 --- a/grub-core/fs/btrfs.c
 +++ b/grub-core/fs/btrfs.c
 @@ -2031,6 +2031,7 @@ find_path (struct grub_btrfs_data *data,
@@ -128,7 +128,7 @@ index 6593f51..3e4924b 100644
  	    {
  	      r = -grub_errno;
 diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c
-index 5d41b6f..6ba58b3 100644
+index 5d41b6fdb..6ba58b354 100644
 --- a/grub-core/fs/cpio_common.c
 +++ b/grub-core/fs/cpio_common.c
 @@ -24,6 +24,7 @@
@@ -179,7 +179,7 @@ index 5d41b6f..6ba58b3 100644
      return NULL;
  
 diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c
-index f6d6bea..72b4aa1 100644
+index f6d6beaa5..72b4aa1e6 100644
 --- a/grub-core/fs/f2fs.c
 +++ b/grub-core/fs/f2fs.c
 @@ -28,6 +28,7 @@
@@ -235,7 +235,7 @@ index f6d6bea..72b4aa1 100644
          return 0;
  
 diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c
-index a009f2c..f168a31 100644
+index a009f2c2d..f168a318e 100644
 --- a/grub-core/fs/ntfscomp.c
 +++ b/grub-core/fs/ntfscomp.c
 @@ -22,6 +22,7 @@
@@ -269,7 +269,7 @@ index a009f2c..f168a31 100644
      return 0;
  
 diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
-index 6e9d638..f91ff3b 100644
+index 6e9d63874..f91ff3bfa 100644
 --- a/grub-core/fs/squash4.c
 +++ b/grub-core/fs/squash4.c
 @@ -460,11 +460,11 @@ grub_squash_read_symlink (grub_fshelp_node_t node)
@@ -309,7 +309,7 @@ index 6e9d638..f91ff3b 100644
  	    return 0;
  	  err = read_chunk (dir->data, buf,
 diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
-index 6c952ae..c60db73 100644
+index 6c952aef1..c60db7361 100644
 --- a/grub-core/fs/xfs.c
 +++ b/grub-core/fs/xfs.c
 @@ -718,6 +718,7 @@ static char *

0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch

@@ -21,7 +21,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
-index 3e4924b..3228e17 100644
+index 3e4924b65..3228e1788 100644
 --- a/grub-core/fs/btrfs.c
 +++ b/grub-core/fs/btrfs.c
 @@ -1409,8 +1409,8 @@ grub_btrfs_mount (grub_device_t dev)
@@ -36,7 +36,7 @@ index 3e4924b..3228e17 100644
      {
        grub_free (data);
 diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c
-index 48ae438..a80954e 100644
+index 48ae438d8..a80954ee6 100644
 --- a/grub-core/fs/hfspluscomp.c
 +++ b/grub-core/fs/hfspluscomp.c
 @@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
@@ -62,7 +62,7 @@ index 48ae438..a80954e 100644
  				  0x104 + sizeof (index_size),
  				  node->compress_index_size
 diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
-index f91ff3b..cf2bca8 100644
+index f91ff3bfa..cf2bca822 100644
 --- a/grub-core/fs/squash4.c
 +++ b/grub-core/fs/squash4.c
 @@ -822,10 +822,10 @@ direct_read (struct grub_squash_data *data,

0344-fs-Prevent-overflows-when-assigning-returned-values-.patch

@@ -18,7 +18,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 30 insertions(+), 11 deletions(-)
 
 diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c
-index 6ba58b3..45ac119 100644
+index 6ba58b354..45ac119a8 100644
 --- a/grub-core/fs/cpio_common.c
 +++ b/grub-core/fs/cpio_common.c
 @@ -62,11 +62,21 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
@@ -48,7 +48,7 @@ index 6ba58b3..45ac119 100644
    /* Don't allow negative numbers.  */
    if (namesize >= 0x80000000)
 diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
-index fd2ec1f..1eaa534 100644
+index fd2ec1f74..1eaa5349f 100644
 --- a/grub-core/fs/tar.c
 +++ b/grub-core/fs/tar.c
 @@ -99,9 +99,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,

0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch

@@ -13,7 +13,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 44 insertions(+), 6 deletions(-)
 
 diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index a497b18..2f303d6 100644
+index a497b1869..2f303d655 100644
 --- a/grub-core/fs/zfs/zfs.c
 +++ b/grub-core/fs/zfs/zfs.c
 @@ -2387,6 +2387,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap,

0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch

@@ -13,7 +13,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index 2f303d6..9ab7bf3 100644
+index 2f303d655..9ab7bf319 100644
 --- a/grub-core/fs/zfs/zfs.c
 +++ b/grub-core/fs/zfs/zfs.c
 @@ -723,8 +723,8 @@ fill_vdev_info_real (struct grub_zfs_data *data,

0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch

@@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 26 insertions(+)
 
 diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index 9ab7bf3..6e6d1c9 100644
+index 9ab7bf319..6e6d1c921 100644
 --- a/grub-core/fs/zfs/zfs.c
 +++ b/grub-core/fs/zfs/zfs.c
 @@ -614,6 +614,8 @@ zfs_fetch_nvlist (struct grub_zfs_device_desc *diskdesc, char **nvlist)

0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch

@@ -10,7 +10,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index 6e6d1c9..5ff647f 100644
+index 6e6d1c921..5ff647ffb 100644
 --- a/grub-core/fs/zfs/zfs.c
 +++ b/grub-core/fs/zfs/zfs.c
 @@ -3309,6 +3309,8 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol,

0349-net-Use-safe-math-macros-to-prevent-overflows.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  4 files changed, 75 insertions(+), 13 deletions(-)
 
 diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c
-index 9cbdc22..bed70c0 100644
+index 9cbdc2264..bed70c0b2 100644
 --- a/grub-core/net/bootp.c
 +++ b/grub-core/net/bootp.c
 @@ -27,6 +27,7 @@
@@ -65,7 +65,7 @@ index 9cbdc22..bed70c0 100644
        if (!val)
  	return grub_errno;
 diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
-index fcc09aa..39b0c46 100644
+index fcc09aa65..39b0c46cf 100644
 --- a/grub-core/net/dns.c
 +++ b/grub-core/net/dns.c
 @@ -224,10 +224,17 @@ get_name (const grub_uint8_t *name_at, const grub_uint8_t *head,
@@ -88,7 +88,7 @@ index fcc09aa..39b0c46 100644
      return NULL;
    if (!check_name_real (name_at, head, tail, NULL, NULL, ret))
 diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c
-index c56461f..b5336df 100644
+index c56461ff1..b5336dfbb 100644
 --- a/grub-core/net/drivers/ieee1275/ofnet.c
 +++ b/grub-core/net/drivers/ieee1275/ofnet.c
 @@ -22,6 +22,7 @@
@@ -134,7 +134,7 @@ index c56461f..b5336df 100644
      {
        grub_print_error ();
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index 6c8dfcb..2222445 100644
+index 6c8dfcba2..22224453f 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -32,6 +32,7 @@

0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch

@@ -14,7 +14,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
-index 39b0c46..f20cd6f 100644
+index 39b0c46cf..f20cd6f83 100644
 --- a/grub-core/net/dns.c
 +++ b/grub-core/net/dns.c
 @@ -470,8 +470,8 @@ grub_net_dns_lookup (const char *name,
@@ -29,7 +29,7 @@ index 39b0c46..f20cd6f 100644
  	    return grub_errno;
  	  *naddresses = dns_cache[h].naddresses;
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index 2222445..d426ad2 100644
+index 22224453f..d426ad2c4 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -91,8 +91,8 @@ grub_net_link_layer_add_address (struct grub_net_card *card,

0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch

@@ -14,7 +14,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index d426ad2..bec297c 100644
+index d426ad2c4..bec297cb6 100644
 --- a/grub-core/net/net.c
 +++ b/grub-core/net/net.c
 @@ -232,6 +232,11 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card,

0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
-index 88705b3..bad4ae8 100644
+index 88705b3a2..bad4ae8d1 100644
 --- a/grub-core/fs/sfs.c
 +++ b/grub-core/fs/sfs.c
 @@ -429,6 +429,9 @@ grub_sfs_mount (grub_disk_t disk)

0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
-index 7ed3a1a..0141327 100644
+index 7ed3a1a03..014132703 100644
 --- a/grub-core/script/execute.c
 +++ b/grub-core/script/execute.c
 @@ -794,6 +794,9 @@ cleanup:

0354-osdep-unix-getroot-Fix-potential-underflow.patch

@@ -20,7 +20,7 @@ Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c
-index b32582e..b832593 100644
+index b32582eb3..b83259321 100644
 --- a/grub-core/osdep/linux/getroot.c
 +++ b/grub-core/osdep/linux/getroot.c
 @@ -596,6 +596,9 @@ again:

0355-misc-Ensure-consistent-overflow-error-messages.patch

@@ -15,7 +15,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  3 files changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index e00349b..960833a 100644
+index e00349b1d..960833a34 100644
 --- a/grub-core/fs/ntfs.c
 +++ b/grub-core/fs/ntfs.c
 @@ -574,7 +574,7 @@ retry:
@@ -28,7 +28,7 @@ index e00349b..960833a 100644
    ctx->curr_vcn = ctx->next_vcn;
    ctx->next_vcn += read_run_data (run, c1, 0);	/* length of current VCN */
 diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c
-index f168a31..b68bf5e 100644
+index f168a318e..b68bf5e40 100644
 --- a/grub-core/fs/ntfscomp.c
 +++ b/grub-core/fs/ntfscomp.c
 @@ -30,7 +30,7 @@ static grub_err_t
@@ -41,7 +41,7 @@ index f168a31..b68bf5e 100644
        (cc->disk,
         (cc->comp_table[cc->comp_head].next_lcn -
 diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
-index 3163e97..aa7524b 100644
+index 3163e97bf..aa7524b7d 100644
 --- a/grub-core/video/readers/png.c
 +++ b/grub-core/video/readers/png.c
 @@ -626,7 +626,7 @@ static grub_err_t

0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/bus/usb/ehci.c b/grub-core/bus/usb/ehci.c
-index 9abebc6..2db07c7 100644
+index 9abebc6bd..2db07c7c0 100644
 --- a/grub-core/bus/usb/ehci.c
 +++ b/grub-core/bus/usb/ehci.c
 @@ -218,7 +218,7 @@ enum

0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch

@@ -17,7 +17,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
-index cda10fa..9768701 100644
+index cda10fa8b..97687013c 100644
 --- a/grub-core/normal/menu.c
 +++ b/grub-core/normal/menu.c
 @@ -32,6 +32,7 @@

0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c
-index 704512a..c6a578c 100644
+index 704512a20..c6a578cf4 100644
 --- a/grub-core/kern/partition.c
 +++ b/grub-core/kern/partition.c
 @@ -125,14 +125,22 @@ grub_partition_probe (struct grub_disk *disk, const char *str)

0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch

@@ -22,7 +22,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
-index 9870042..69bd655 100644
+index 98700423d..69bd655f3 100644
 --- a/grub-core/kern/misc.c
 +++ b/grub-core/kern/misc.c
 @@ -912,7 +912,7 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args,

0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
-index 90121e9..33a8521 100644
+index 90121e9bc..33a852197 100644
 --- a/grub-core/loader/i386/linux.c
 +++ b/grub-core/loader/i386/linux.c
 @@ -823,7 +823,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),

0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch

@@ -16,7 +16,7 @@ Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  1 file changed, 10 insertions(+), 4 deletions(-)
 
 diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
-index 8075ac9..50f96ea 100644
+index 8075ac9b0..50f96ea7a 100644
 --- a/grub-core/loader/i386/bsd.c
 +++ b/grub-core/loader/i386/bsd.c
 @@ -1341,6 +1341,7 @@ static grub_err_t

0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch

@@ -0,0 +1,117 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Avnish Chouhan <avnish@linux.ibm.com>
+Date: Thu, 13 Mar 2025 19:45:50 +0530
+Subject: [PATCH] powerpc: increase MIN RMA size for CAS negotiation
+
+Change RMA size from 512 MB to 768 MB which will result
+in more memory at boot time for PowerPC. When vTPM, Secure Boot or
+FADump are enabled on PowerPC, the 512 MB RMA memory is not sufficient for
+booting. With this 512 MB RMA, GRUB2 runs out of memory and fails to
+boot the machine. Sometimes even usage of CDROM requires more memory
+for installation and along with the options mentioned above exhausts
+the boot memory which results in boot failures. Increasing the RMA size
+will resolves multiple out of memory issues observed in PowerPC.
+
+Failure details (GRUB2 debugs):
+
+  kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 1
+  kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space
+  kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 0
+  kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space
+  kern/file.c:215: Closing `/ppc/ppc64/initrd.img' ...
+  kern/disk.c:297: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000'...
+  kern/disk.c:311: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000' succeeded.
+  kern/file.c:225: Closing `/ppc/ppc64/initrd.img' failed with 3.
+  kern/file.c:148: Opening `/ppc/ppc64/initrd.img' succeeded.
+  error: ../../grub-core/kern/mm.c:552:out of memory.
+
+Signed-off-by: Avnish Chouhan <avnish@linux.ibm.com>
+---
+ grub-core/kern/ieee1275/init.c | 51 +++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 46 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 4ec6598cfbb8..bb791f80f41c 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -737,7 +737,7 @@ struct cas_vector
+ 
+ /*
+  * Call ibm,client-architecture-support to try to get more RMA.
+- * We ask for 512MB which should be enough to verify a distro kernel.
++ * We ask for 768MB which should be enough to verify a distro kernel.
+  * We ignore most errors: if we don't succeed we'll proceed with whatever
+  * memory we have.
+  */
+@@ -809,7 +809,7 @@ grub_ieee1275_ibm_cas (void)
+     .vec1 = 0x80, /* ignore */
+     .vec2_size = 1 + sizeof (struct option_vector2) - 2,
+     .vec2 = {
+-      0, 0, -1, -1, -1, -1, -1, 512, -1, 0, 48
++      0, 0, -1, -1, -1, -1, -1, 768, -1, 0, 48
+     },
+     .vec3_size = 2 - 1,
+     .vec3 = 0x00e0, /* ask for FP + VMX + DFP but don't halt if unsatisfied */
+@@ -846,6 +846,10 @@ grub_claim_heap (void)
+ {
+   grub_err_t err;
+   grub_uint32_t total = HEAP_MAX_SIZE;
++#if defined(__powerpc__)
++  grub_uint32_t ibm_ca_support_reboot = 0;
++  grub_ssize_t actual;
++#endif
+ 
+   err = grub_ieee1275_total_mem (&rmo_top);
+ 
+@@ -858,11 +862,48 @@ grub_claim_heap (void)
+     grub_mm_add_region_fn = grub_ieee1275_mm_add_region;
+ 
+ #if defined(__powerpc__)
++  /* Check if it's a CAS reboot with below property. If so, we will skip CAS call */
++  if (grub_ieee1275_get_integer_property (grub_ieee1275_chosen,
++                                          "ibm,client-architecture-support-reboot",
++                                          &ibm_ca_support_reboot,
++                                          sizeof (ibm_ca_support_reboot),
++                                          &actual) >= 0)
++    grub_dprintf ("ieee1275", "ibm,client-architecture-support-reboot: %" PRIuGRUB_UINT32_T "\n",
++                  ibm_ca_support_reboot);
++
+   if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY))
+     {
+-      /* if we have an error, don't call CAS, just hope for the best */
+-      if (err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024))
+-	grub_ieee1275_ibm_cas ();
++      /*
++       * If we have an error, don't call CAS. Just hope for the best.
++       * Along with the above, if the rmo_top is 512 MB or above. We
++       * will skip the CAS call. However, if we call CAS, the rmo_top
++       * will be set to 768 MB via CAS Vector2. But we need to call
++       * CAS with "rmo_top < 512 MB" to avoid the issue on the older
++       * Linux kernel, which still uses rmo_top as 512 MB. If we call
++       * CAS with a condition "rmo_top < 768 MB", it will result in an
++       * issue due to the IBM CAS reboot feature and we won't be able
++       * to boot the newer kernel. Whenever a reboot is detected as
++       * the CAS reboot by GRUB. It will boot the machine with the
++       * last booted kernel by reading the variable "boot-last-label"
++       * which has the info related to the last boot and it's specific
++       * to IBM PowerPC. Due to this, the machine will boot with the
++       * last booted kernel which has rmo_top as 512 MB. Also, if the
++       * reboot is detected as a CAS reboot, the GRUB will skip the CAS
++       * call. As the CAS has already been called earlier, so it is
++       * not required to call CAS even if the other conditions are met.
++       * This condition will also prevent a scenario where the machine
++       * get stuck in the CAS reboot loop while booting. A machine with
++       * an older kernel, having option_vector2 MIN_RMA as 512 MB in
++       * Linux prom_init.c and GRUB uses "rmo_top < 768 MB" condition
++       * for calling CAS. Due to their respective conditions, linux
++       * CAS and GRUB CAS will keep doing the CAS calls and change
++       * the MIN_RMA from 768(changed by GRUB) to 512(changed by Linux)
++       * to 768(changed by GRUB) to 512(changed by Linux) and so on,
++       * and the machine will stuck in this CAS reboot loop forever.
++       * IBM PAPR : https://openpower.foundation/specifications/linuxonpower/
++       */
++      if (!ibm_ca_support_reboot && err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024))
++        grub_ieee1275_ibm_cas ();
+     }
+ #endif
+ 

0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch

@@ -0,0 +1,66 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Thu, 24 Oct 2024 14:42:46 +0100
+Subject: [PATCH] script/execute: Don't let trailing blank lines determine the
+ return code
+
+grub_script_execute_sourcecode() parses and executes code one line at a
+time, updating the return code each time because only the last line
+determines the final status. However, trailing new lines were also
+executed, masking any failure on the previous line. Fix this by only
+trying to execute the command when there is actually one present.
+
+This has presumably never been noticed because this code is not used by
+regular functions, only in special cases like eval and menu entries. The
+latter generally don't return at all, having booted an OS. When failing
+to boot, upstream GRUB triggers the fallback mechanism regardless of the
+return code.
+
+We noticed the problem while using Red Hat's patches, which change this
+behaviour to take account of the return code. In that case, a failure
+takes you back to the menu rather than triggering a fallback.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+---
+ grub-core/script/execute.c |  5 ++++-
+ tests/grub_script_eval.in  | 10 +++++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
+index 014132703..3d26a3fe4 100644
+--- a/grub-core/script/execute.c
++++ b/grub-core/script/execute.c
+@@ -952,7 +952,10 @@ grub_script_execute_sourcecode (const char *source)
+ 	  break;
+ 	}
+ 
+-      ret = grub_script_execute (parsed_script);
++      /* Don't let trailing blank lines determine the return code.  */
++      if (parsed_script->cmd)
++	ret = grub_script_execute (parsed_script);
++
+       grub_script_free (parsed_script);
+       grub_free (line);
+     }
+diff --git a/tests/grub_script_eval.in b/tests/grub_script_eval.in
+index c97b78d77..9c6211042 100644
+--- a/tests/grub_script_eval.in
++++ b/tests/grub_script_eval.in
+@@ -3,4 +3,12 @@
+ eval echo "Hello world"
+ valname=tst
+ eval $valname=hi
+-echo $tst
+\ No newline at end of file
++echo $tst
++
++if eval "
++false
++"; then
++  echo should have failed
++else
++  echo failed as expected
++fi
+-- 
+2.48.1
+

0365-normal-menu-Check-return-code-of-the-script-when-exe.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Thu, 24 Oct 2024 15:00:26 +0100
+Subject: [PATCH] normal/menu: Check return code of the script when executing a
+ menu entry
+
+Don't rely on grub_errno here because grub_script_execute_new_scope()
+calls grub_print_error(), which always resets grub_errno back to
+GRUB_ERR_NONE. It may also get reset by grub_wait_after_message().
+
+This problem was observed when a "bad signature" error resulted in the
+menu being redisplayed rather than the fallback mechanism being
+triggered, although another change was also needed to fix it. This only
+happens with Red Hat's patches because upstream GRUB triggers the
+fallback mechanism regardless of the return code.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+---
+ grub-core/normal/menu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
+index 97687013c..a2703dabb 100644
+--- a/grub-core/normal/menu.c
++++ b/grub-core/normal/menu.c
+@@ -377,14 +377,14 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot)
+   if (ptr && ptr[0] && ptr[1])
+     grub_env_set ("default", ptr + 1);
+ 
+-  grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args);
++  err = grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args);
+ 
+   if (errs_before != grub_err_printed_errors)
+     grub_wait_after_message ();
+ 
+   errs_before = grub_err_printed_errors;
+ 
+-  if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ())
++  if (err == GRUB_ERR_NONE && grub_loader_is_loaded ())
+     /* Implicit execution of boot, only if something is loaded.  */
+     err = grub_command_execute ("boot", 0, 0);
+ 
+-- 
+2.48.1
+

0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch

@@ -0,0 +1,167 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
+Date: Wed, 23 Oct 2024 17:54:32 +0530
+Subject: [PATCH] grub-mkimage: Create new ELF note for SBAT
+
+In order to store the SBAT data we create a new ELF note. The string
+".sbat", zero-padded to 4 byte alignment, shall be entered in the name
+field. The string "SBAT"'s ASCII values, 0x53424154, should be entered
+in the type field.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ include/grub/util/mkimage.h |  4 ++--
+ util/grub-mkimagexx.c       | 48 +++++++++++++++++++++++++++++++++++++++++++--
+ util/mkimage.c              |  5 +++--
+ 3 files changed, 51 insertions(+), 6 deletions(-)
+
+diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h
+index 6f1da89b9b65..881e3031f41f 100644
+--- a/include/grub/util/mkimage.h
++++ b/include/grub/util/mkimage.h
+@@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path,
+ 			   const struct grub_install_image_target_desc *image_target);
+ void
+ grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target,
+-			     int note, size_t appsig_size, char **core_img, size_t *core_size,
++			     int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size,
+ 			     Elf32_Addr target_addr,
+ 			     struct grub_mkimage_layout *layout);
+ void
+ grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target,
+-			     int note, size_t appsig_size, char **core_img, size_t *core_size,
++			     int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size,
+ 			     Elf64_Addr target_addr,
+ 			     struct grub_mkimage_layout *layout);
+ 
+diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
+index 9488f052510a..b9930544889d 100644
+--- a/util/grub-mkimagexx.c
++++ b/util/grub-mkimagexx.c
+@@ -116,6 +116,14 @@ struct section_metadata
+   const char *strtab;
+ };
+ 
++#define GRUB_SBAT_NOTE_NAME ".sbat"
++#define GRUB_SBAT_NOTE_TYPE 0x53424154 /* "SBAT" */
++
++struct grub_sbat_note {
++  Elf32_Nhdr header;
++  char name[ALIGN_UP(sizeof(GRUB_SBAT_NOTE_NAME), 4)];
++};
++
+ static int
+ is_relocatable (const struct grub_install_image_target_desc *image_target)
+ {
+@@ -217,7 +225,7 @@ grub_arm_reloc_jump24 (grub_uint32_t *target, Elf32_Addr sym_addr)
+ 
+ void
+ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc *image_target,
+-				    int note, size_t appsig_size, char **core_img, size_t *core_size,
++				    int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size,
+ 				    Elf_Addr target_addr,
+ 				    struct grub_mkimage_layout *layout)
+ {
+@@ -226,10 +234,17 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
+   Elf_Ehdr *ehdr;
+   Elf_Phdr *phdr;
+   Elf_Shdr *shdr;
+-  int header_size, footer_size = 0;
++  int header_size, footer_size = 0, footer_offset = 0;
+   int phnum = 1;
+   int shnum = 4;
+   int string_size = sizeof (".text") + sizeof ("mods") + 1;
++  char *footer;
++
++  if (sbat)
++    {
++      phnum++;
++      footer_size += ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4);
++    }
+ 
+   if (appsig_size)
+     {
+@@ -263,6 +278,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
+   ehdr = (void *) elf_img;
+   phdr = (void *) (elf_img + sizeof (*ehdr));
+   shdr = (void *) (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr));
++  footer = elf_img + program_size + header_size;
+   memcpy (ehdr->e_ident, ELFMAG, SELFMAG);
+   ehdr->e_ident[EI_CLASS] = ELFCLASSXX;
+   if (!image_target->bigendian)
+@@ -435,6 +451,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
+       phdr->p_filesz = grub_host_to_target32 (XEN_NOTE_SIZE);
+       phdr->p_memsz = 0;
+       phdr->p_offset = grub_host_to_target32 (header_size + program_size);
++      footer = ptr;
++      footer_offset = XEN_NOTE_SIZE;
+     }
+ 
+   if (image_target->id == IMAGE_XEN_PVH)
+@@ -468,6 +486,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
+       phdr->p_filesz = grub_host_to_target32 (XEN_PVH_NOTE_SIZE);
+       phdr->p_memsz = 0;
+       phdr->p_offset = grub_host_to_target32 (header_size + program_size);
++      footer = ptr;
++      footer_offset = XEN_PVH_NOTE_SIZE;
+     }
+ 
+   if (note)
+@@ -498,6 +518,30 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
+       phdr->p_filesz = grub_host_to_target32 (note_size);
+       phdr->p_memsz = 0;
+       phdr->p_offset = grub_host_to_target32 (header_size + program_size);
++      footer = (elf_img + program_size + header_size + note_size);
++      footer_offset += note_size;
++    }
++
++  if (sbat)
++    {
++      int note_size = ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4);
++      struct grub_sbat_note *note_ptr = (struct grub_sbat_note *) footer;
++
++      note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_SBAT_NOTE_NAME));
++      note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(layout->sbat_size, 4));
++      note_ptr->header.n_type = grub_host_to_target32 (GRUB_SBAT_NOTE_TYPE);
++      memcpy (note_ptr->name, GRUB_SBAT_NOTE_NAME, sizeof (GRUB_SBAT_NOTE_NAME));
++      memcpy ((char *)(note_ptr + 1), sbat, layout->sbat_size);
++
++      phdr++;
++      phdr->p_type = grub_host_to_target32 (PT_NOTE);
++      phdr->p_flags = grub_host_to_target32 (PF_R);
++      phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof);
++      phdr->p_vaddr = 0;
++      phdr->p_paddr = 0;
++      phdr->p_filesz = grub_host_to_target32 (note_size);
++      phdr->p_memsz = 0;
++      phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset);
+     }
+ 
+   if (appsig_size) {
+diff --git a/util/mkimage.c b/util/mkimage.c
+index f31fdefa814a..7fa6a7b21954 100644
+--- a/util/mkimage.c
++++ b/util/mkimage.c
+@@ -1848,6 +1848,7 @@ grub_install_generate_image (const char *dir, const char *prefix,
+     case IMAGE_I386_IEEE1275:
+       {
+ 	grub_uint64_t target_addr;
++	char *sbat = NULL;
+ 	if (image_target->id == IMAGE_LOONGSON_ELF)
+ 	  {
+ 	    if (comp == GRUB_COMPRESSION_NONE)
+@@ -1859,10 +1860,10 @@ grub_install_generate_image (const char *dir, const char *prefix,
+ 	else
+ 	  target_addr = image_target->link_addr;
+ 	if (image_target->voidp_sizeof == 4)
+-	  grub_mkimage_generate_elf32 (image_target, note, appsig_size, &core_img,
++	  grub_mkimage_generate_elf32 (image_target, note, appsig_size, sbat, &core_img,
+ 				       &core_size, target_addr, &layout);
+ 	else
+-	  grub_mkimage_generate_elf64 (image_target, note, appsig_size, &core_img,
++	  grub_mkimage_generate_elf64 (image_target, note, appsig_size, sbat, &core_img,
+ 				       &core_size, target_addr, &layout);
+       }
+       break;

0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
+Date: Wed, 23 Oct 2024 17:54:33 +0530
+Subject: [PATCH] grub-mkimage: Add SBAT metadata into ELF note for PowerPC
+ targets
+
+The SBAT metadata is read from CSV file and transformed into an ELF note
+with the -s option.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ util/mkimage.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/util/mkimage.c b/util/mkimage.c
+index 7fa6a7b21954..f92949d1df25 100644
+--- a/util/mkimage.c
++++ b/util/mkimage.c
+@@ -957,8 +957,8 @@ grub_install_generate_image (const char *dir, const char *prefix,
+       total_module_size += dtb_size + sizeof (struct grub_module_header);
+     }
+ 
+-  if (sbat_path != NULL && image_target->id != IMAGE_EFI)
+-    grub_util_error (_(".sbat section can be embedded into EFI images only"));
++  if (sbat_path != NULL && (image_target->id != IMAGE_EFI && image_target->id != IMAGE_PPC))
++    grub_util_error (_("SBAT data can be added only to EFI or powerpc-ieee1275 images"));
+ 
+   if (disable_shim_lock)
+     total_module_size += sizeof (struct grub_module_header);
+@@ -1849,6 +1849,13 @@ grub_install_generate_image (const char *dir, const char *prefix,
+       {
+ 	grub_uint64_t target_addr;
+ 	char *sbat = NULL;
++	if (sbat_path != NULL)
++	  {
++	    sbat_size = grub_util_get_image_size (sbat_path);
++	    sbat = xmalloc (sbat_size);
++	    grub_util_load_image (sbat_path, sbat);
++	    layout.sbat_size = sbat_size;
++	  }
+ 	if (image_target->id == IMAGE_LOONGSON_ELF)
+ 	  {
+ 	    if (comp == GRUB_COMPRESSION_NONE)

0369-10_linux.in-escape-kernel-option-characters-properly.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Wed, 7 May 2025 13:23:37 -0600
+Subject: [PATCH] 10_linux.in: escape kernel option characters properly
+
+This handles cases where kernel options, specifically the values,
+contain special characters, in this case ';', '&' and '$'.
+
+For example, the user defines the following GRUB_CMDLINE_LINUX on the
+default grub file /etc/default/grub, note the dolar sign on the 'memmap'
+option
+
+    GRUB_CMDLINE_LINUX="console=ttyS0 memmap=32g\\\$0x2000000000"
+
+then regenerating the grub cfg and BLS options line with the
+grub2-mkconfig command, resulting into
+
+    options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro
+    rootflags=subvol=root console=ttyS0 memmap=32g\$0x2000000000
+
+without this patch, we would end up with
+
+    options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro
+    rootflags=subvol=root console=ttyS0 memmap=32g$0x2000000000
+
+Note the missing '\' which is required to escape the '$', otherwise
+it would be consider a variable by blscfg parser which is not the case.
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ util/grub.d/10_linux.in | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 11c19304f8..cdfb72a1e3 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -178,6 +178,9 @@ update_bls_cmdline()
+             options="${options} ${GRUB_CMDLINE_LINUX_DEBUG}"
+         fi
+         options="$(echo "${options}" | sed -e 's/\//\\\//g')"
++        options="$(echo "${options}" | sed -e 's/\;/\\\;/g')"
++        options="$(echo "${options}" | sed -e 's/\\&/\\\\&/g')"
++        options="$(echo "${options}" | sed -e 's/\$/\\\$/g')"
+         sed -i -e "s/^options.*/options ${options}/" "${blsdir}/${bls}.conf"
+     done
+ }

0370-blscfg-check-if-variable-is-escaped-before-consideri.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Wed, 7 May 2025 13:49:47 -0600
+Subject: [PATCH] blscfg: check if variable is escaped before considering one
+
+Otherwise escaped variables are considered real variables.
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ grub-core/commands/blscfg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index 6e398fc175..5d931b0c9b 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -695,7 +695,8 @@ static char *expand_val(const char *value)
+     return NULL;
+ 
+   while (*value) {
+-    if (*value == '$') {
++    /* It's a variable only when *value is '$' and it is not escaped with '\'*/
++    if (*value == '$' && *end != '\\') {
+       if (start != end) {
+ 	buffer = field_append(is_var, buffer, start, end);
+ 	if (!buffer)

0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch

@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Fri, 28 Feb 2025 17:00:53 +0300
+Subject: [PATCH] kern/rescue_reader: Block the rescue mode until the CLI
+ authentication
+
+This further mitigates potential misuse of the CLI after the
+root device has been successfully unlocked via TPM.
+
+Fixes: CVE-2025-4382
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/kern/rescue_reader.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
+index 4259857ba9..a71ada8fb7 100644
+--- a/grub-core/kern/rescue_reader.c
++++ b/grub-core/kern/rescue_reader.c
+@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
+ grub_rescue_run (void)
+ {
+   /* Stall if the CLI has been disabled */
+-  if (grub_is_cli_disabled ())
++  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
+     {
+       grub_printf ("Rescue mode has been disabled...\n");
+ 

0372-commands-search-Introduce-the-cryptodisk-only-argume.patch

@@ -0,0 +1,133 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Sat, 1 Mar 2025 14:16:48 +0300
+Subject: [PATCH] commands/search: Introduce the --cryptodisk-only argument
+
+This allows users to restrict the "search" command's scope to
+encrypted disks only.
+
+Typically, this command is used to "rebase" $root and $prefix
+before loading additional configuration files via "source" or
+"configfile". Unfortunately, this leads to security problems,
+like CVE-2023-4001, when an unexpected, attacker-controlled
+device is chosen by the "search" command.
+
+The --cryptodisk-only argument allows users to ensure that the
+file system picked is encrypted.
+
+This feature supports the CLI authentication, blocking bypass
+attempts.
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/commands/search.c      | 20 ++++++++++++++++++++
+ grub-core/commands/search_wrap.c |  7 ++++++-
+ grub-core/normal/main.c          |  3 ++-
+ include/grub/search.h            |  9 +++++----
+ 4 files changed, 33 insertions(+), 6 deletions(-)
+
+diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
+index d538b36219..84362b54b3 100644
+--- a/grub-core/commands/search.c
++++ b/grub-core/commands/search.c
+@@ -182,6 +182,26 @@ iterate_device (const char *name, void *data)
+       grub_device_close (dev);
+     }
+ 
++  /* Limit to encrypted disks when requested. */
++  if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY)
++    {
++      grub_device_t dev;
++
++      dev = grub_device_open (name);
++      if (dev == NULL)
++	{
++	  grub_errno = GRUB_ERR_NONE;
++	  return 0;
++	}
++      if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
++	{
++	  grub_device_close (dev);
++	  grub_errno = GRUB_ERR_NONE;
++	  return 0;
++	}
++      grub_device_close (dev);
++    }
++
+   /* Skip it if it's not the root device when requested. */
+   if (ctx->flags & SEARCH_FLAGS_ROOTDEV_ONLY)
+     {
+diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
+index 4fe6440c65..ec2fb638f1 100644
+--- a/grub-core/commands/search_wrap.c
++++ b/grub-core/commands/search_wrap.c
+@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
+      ARG_TYPE_STRING},
+     {"no-floppy",	'n', 0, N_("Do not probe any floppy drive."), 0, 0},
+     {"efidisk-only",	0, 0, N_("Only probe EFI disks."), 0, 0},
++    {"cryptodisk-only",	0, 0, N_("Only probe encrypted disks."), 0, 0},
+     {"root-dev-only",  'r', 0, N_("Only probe root device."), 0, 0},
+     {"hint",	        'h', GRUB_ARG_OPTION_REPEATABLE,
+      N_("First try the device HINT. If HINT ends in comma, "
+@@ -76,6 +77,7 @@ enum options
+     SEARCH_SET,
+     SEARCH_NO_FLOPPY,
+     SEARCH_EFIDISK_ONLY,
++    SEARCH_CRYPTODISK_ONLY,
+     SEARCH_ROOTDEV_ONLY,
+     SEARCH_HINT,
+     SEARCH_HINT_IEEE1275,
+@@ -191,6 +193,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
+   if (state[SEARCH_EFIDISK_ONLY].set)
+     flags |= SEARCH_FLAGS_EFIDISK_ONLY;
+ 
++  if (state[SEARCH_CRYPTODISK_ONLY].set)
++    flags |= SEARCH_FLAGS_CRYPTODISK_ONLY;
++
+   if (state[SEARCH_ROOTDEV_ONLY].set)
+     flags |= SEARCH_FLAGS_ROOTDEV_ONLY;
+ 
+@@ -215,7 +220,7 @@ GRUB_MOD_INIT(search)
+   cmd =
+     grub_register_extcmd ("search", grub_cmd_search,
+ 			  GRUB_COMMAND_FLAG_EXTRACTOR | GRUB_COMMAND_ACCEPT_DASH,
+-			  N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]"
++			  N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint HINT [--hint HINT] ...]"
+ 			     " NAME"),
+ 			  N_("Search devices by file, filesystem label"
+ 			     " or filesystem UUID."
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index dd20e51290..6f7290a897 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -615,7 +615,8 @@ static const char *features[] = {
+   "feature_chainloader_bpb", "feature_ntldr", "feature_platform_search_hint",
+   "feature_default_font_path", "feature_all_video_module",
+   "feature_menuentry_id", "feature_menuentry_options", "feature_200_final",
+-  "feature_nativedisk_cmd", "feature_timeout_style"
++  "feature_nativedisk_cmd", "feature_timeout_style",
++  "feature_search_cryptodisk_only"  
+ };
+ 
+ GRUB_MOD_INIT(normal)
+diff --git a/include/grub/search.h b/include/grub/search.h
+index 9343c66b13..b6b5c8be1f 100644
+--- a/include/grub/search.h
++++ b/include/grub/search.h
+@@ -21,10 +21,11 @@
+ 
+ enum search_flags
+   {
+-    SEARCH_FLAGS_NONE		= 0,
+-    SEARCH_FLAGS_NO_FLOPPY	= 1,
+-    SEARCH_FLAGS_EFIDISK_ONLY	= 2,
+-    SEARCH_FLAGS_ROOTDEV_ONLY	= 4
++    SEARCH_FLAGS_NONE            = 0,
++    SEARCH_FLAGS_NO_FLOPPY       = 1,
++    SEARCH_FLAGS_EFIDISK_ONLY    = 2,
++    SEARCH_FLAGS_ROOTDEV_ONLY    = 4,
++    SEARCH_FLAGS_CRYPTODISK_ONLY = 8
+   };
+ 
+ void grub_search_fs_file (const char *key, const char *var,

0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch

@@ -0,0 +1,133 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Sun, 2 Mar 2025 18:08:22 +0300
+Subject: [PATCH] disk/diskfilter: Introduce the "cryptocheck" command
+
+This command examines a given diskfilter device, e.g., an LVM disk,
+and checks if underlying disks, physical volumes, are cryptodisks,
+e.g., LUKS disks, this layout is called "LVM-on-LUKS".
+
+The return value is 0 when all underlying disks (of a given device)
+are cryptodisks (1 if at least one disk is unencrypted or in an
+unknown state).
+
+Users are encouraged to include the relevant check before loading
+anything from an LVM disk that is supposed to be encrypted.
+
+This further supports the CLI authentication, blocking bypass
+attempts when booting from an encrypted LVM disk.
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/disk/diskfilter.c | 75 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
+index fef0b815ab..216be6a782 100644
+--- a/grub-core/disk/diskfilter.c
++++ b/grub-core/disk/diskfilter.c
+@@ -20,6 +20,7 @@
+ #include <grub/dl.h>
+ #include <grub/disk.h>
+ #include <grub/mm.h>
++#include <grub/command.h>
+ #include <grub/err.h>
+ #include <grub/misc.h>
+ #include <grub/diskfilter.h>
+@@ -1365,6 +1366,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk,
+ }
+ #endif
+ 
++static int
++grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt)
++{
++  struct grub_diskfilter_lv *lv = disk->data;
++  struct grub_diskfilter_pv *pv;
++
++  *pvs_cnt = 0;
++
++  if (lv->vg->pvs)
++    for (pv = lv->vg->pvs; pv; pv = pv->next)
++      {
++        (*pvs_cnt)++;
++
++        if (pv->disk == NULL)
++          {
++            /* Can be a partially activated VG, bail out. */
++            return GRUB_ERR_TEST_FAILURE;
++          }
++
++        if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
++          {
++            /* All backing devices must be cryptodisks, stop. */
++            return GRUB_ERR_TEST_FAILURE;
++          }
++      }
++  return GRUB_ERR_NONE;
++}
++
++static grub_err_t
++grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)),
++               int argc, char **args)
++{
++  grub_disk_t disk;
++  int check_pvs_res;
++  int namelen;
++  int pvs_cnt;
++
++  if (argc != 1)
++    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected"));
++
++  namelen = grub_strlen (args[0]);
++  if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')'))
++    args[0][namelen - 1] = 0;
++  else
++    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"),
++                       args[0]);
++
++  if (!is_valid_diskfilter_name (&args[0][1]))
++    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk: %s"),
++                       &args[0][1]);
++
++  disk = grub_disk_open (&args[0][1]);
++  if (disk == NULL)
++    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"),
++                       &args[0][1]);
++
++  check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt);
++  grub_disk_close (disk);
++
++  grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
++              (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
++              pvs_cnt,
++              (pvs_cnt > 1) ? "s" : "");
++
++  return check_pvs_res;
++}
++
+ static struct grub_disk_dev grub_diskfilter_dev =
+   {
+     .name = "diskfilter",
+@@ -1381,14 +1449,21 @@ static struct grub_disk_dev grub_diskfilter_dev =
+     .next = 0
+   };
+ 
++static grub_command_t cmd;
++
+ 
+ GRUB_MOD_INIT(diskfilter)
+ {
+   grub_disk_dev_register (&grub_diskfilter_dev);
++  cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck,
++                                N_("DEVICE"),
++                                N_("Check if a logical volume resides on encrypted disks."));
+ }
+ 
+ GRUB_MOD_FINI(diskfilter)
+ {
+   grub_disk_dev_unregister (&grub_diskfilter_dev);
++  if (cmd != NULL)
++    grub_unregister_command (cmd);
+   free_array ();
+ }

0374-commands-search-Add-the-diskfilter-support.patch

@@ -0,0 +1,67 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Sun, 2 Mar 2025 23:32:43 +0300
+Subject: [PATCH] commands/search: Add the diskfilter support
+
+When the --cryptodisk-only argument is given, also check the target
+device using the "cryptocheck" command, if available.
+
+This extends the checks to common layouts like LVM-on-LUKS, so the
+--cryptodisk-only argument transparently handles such setups.
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ grub-core/commands/search.c | 32 +++++++++++++++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
+index 84362b54b3..1cf714ad7d 100644
+--- a/grub-core/commands/search.c
++++ b/grub-core/commands/search.c
+@@ -150,6 +150,36 @@ check_for_duplicate (const char *name, void *data)
+   return ret;
+ }
+ 
++static bool
++is_unencrypted_disk (grub_disk_t disk)
++{
++  grub_command_t cmd;
++  char *disk_str;
++  int disk_str_len;
++  int res;
++
++  if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID)
++    return false; /* This is (crypto) disk. */
++
++  if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID)
++    {
++      cmd = grub_command_find ("cryptocheck");
++      if (cmd == NULL) /* No diskfilter module loaded for some reason. */
++        return true;
++
++      disk_str_len = grub_strlen (disk->name) + 2 + 1;
++      disk_str = grub_malloc (disk_str_len);
++      if (disk_str == NULL) /* Something is wrong, better report as unencrypted. */
++        return true;
++
++      grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name);
++      res = cmd->func (cmd, 1, &disk_str);
++      grub_free (disk_str);
++      return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */
++    }
++  return true;
++}
++
+ /* Helper for FUNC_NAME.  */
+ static int
+ iterate_device (const char *name, void *data)
+@@ -193,7 +223,7 @@ iterate_device (const char *name, void *data)
+ 	  grub_errno = GRUB_ERR_NONE;
+ 	  return 0;
+ 	}
+-      if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
++      if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true)
+ 	{
+ 	  grub_device_close (dev);
+ 	  grub_errno = GRUB_ERR_NONE;

0375-docs-Document-available-crypto-disks-checks.patch

@@ -0,0 +1,68 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Mon, 10 Mar 2025 15:33:46 +0300
+Subject: [PATCH] docs: Document available crypto disks checks
+
+Document the --cryptodisk-only argument. Also, document the
+"cryptocheck" command invoked when that argument is processed.
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ docs/grub.texi | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/docs/grub.texi b/docs/grub.texi
+index 2d6d73a78d..93e23be99d 100644
+--- a/docs/grub.texi
++++ b/docs/grub.texi
+@@ -4365,6 +4365,7 @@ you forget a command, you can run the command @command{help}
+ * configfile::                  Load a configuration file
+ * cpuid::                       Check for CPU features
+ * crc::                         Compute or check CRC32 checksums
++* cryptocheck::                 Check if a device is encrypted
+ * cryptomount::                 Mount a crypto device
+ * cutmem::                      Remove memory regions
+ * date::                        Display or set current date and time
+@@ -4674,6 +4675,16 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum}
+ (@pxref{hashsum}) for full description.
+ @end deffn
+ 
++@node cryptocheck
++@subsection cryptocheck
++
++@deffn Command cryptocheck device
++Check if a given diskfilter device is backed by encrypted devices
++(@pxref{cryptomount} for additional information).
++
++The command examines all backing devices, physical volumes, of a specified
++logical volume, like LVM2, and fails when at least one of them is unencrypted.
++@end deffn
+ 
+ @node cryptomount
+ @subsection cryptomount
+@@ -5522,7 +5533,8 @@ unbootable. @xref{Using GPG-style digital signatures}, for more information.
+ 
+ @deffn Command search @
+  [@option{--file}|@option{--label}|@option{--fs-uuid}] @
+- [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}] name
++ [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}|@option{--cryptodisk-only}] @
++ name
+ Search devices by file (@option{-f}, @option{--file}), filesystem label
+ (@option{-l}, @option{--label}), or filesystem UUID (@option{-u},
+ @option{--fs-uuid}).
+@@ -5537,6 +5549,14 @@ devices, which can be slow.
+ The (@option{--efidisk-only}) option prevents searching any other devices then
+ EFI disks. This is typically used when chainloading to local EFI partition.
+ 
++The (@option{--cryptodisk-only}) option prevents searching any devices other
++than encrypted disks. This is typically used when booting from an encrypted
++file system to ensure that no code gets executed from an unencrypted device
++having the same filesystem UUID or label.
++
++This option implicitly invokes the command @command{cryptocheck}, if it is
++available (@pxref{cryptocheck} for additional information).
++
+ The @samp{search.file}, @samp{search.fs_label}, and @samp{search.fs_uuid}
+ commands are aliases for @samp{search --file}, @samp{search --label}, and
+ @samp{search --fs-uuid} respectively.

0376-disk-cryptodisk-Add-the-erase-secrets-function.patch

@@ -0,0 +1,147 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maxim Suhanov <dfirblog@gmail.com>
+Date: Tue, 6 May 2025 12:25:20 -0600
+Subject: [PATCH] disk/cryptodisk: Add the "erase secrets" function
+
+This commit adds the grub_cryptodisk_erasesecrets() function to wipe
+master keys from all cryptodisks. This function is EFI-only.
+
+Since there is no easy way to "force unmount" a given encrypted disk,
+this function renders all mounted cryptodisks unusable. An attempt to
+read them will return garbage.
+
+This is why this function must be used in "no way back" conditions.
+
+Currently, it is used when unloading the cryptodisk module and when
+performing the "exit" command (it is often used to switch to the next
+EFI application). This function is not called when performing the
+"chainloader" command, because the callee may return to GRUB. For this
+reason, users are encouraged to use "exit" instead of "chainloader" to
+execute third-party boot applications.
+
+This function does not guarantee that all secrets are wiped from RAM.
+Console output, chunks from disk read requests and other may remain.
+
+This function does not clear the IV prefix and rekey key for geli disks.
+
+Also, this commit adds the relevant documentation improvements.
+
+Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+---
+ docs/grub.texi               |  6 ++++++
+ grub-core/commands/minicmd.c | 11 +++++++++++
+ grub-core/disk/cryptodisk.c  | 28 ++++++++++++++++++++++++++++
+ include/grub/cryptodisk.h    |  1 +
+ 4 files changed, 46 insertions(+)
+
+diff --git a/docs/grub.texi b/docs/grub.texi
+index 93e23be99d..0af47b5ade 100644
+--- a/docs/grub.texi
++++ b/docs/grub.texi
+@@ -4721,6 +4721,11 @@ namespace in addition to the cryptodisk namespace.
+ 
+ Support for plain encryption mode (plain dm-crypt) is provided via separate
+ @command{@pxref{plainmount}} command.
++
++On the EFI platform, GRUB tries to erase master keys from memory when the cryptodisk
++module is unloaded or the command @command{exit} is executed. All secrets remain in
++memory when the command @command{chainloader} is issued, because execution can
++return to GRUB on the EFI platform.
+ @end deffn
+ 
+ @node cutmem
+@@ -6982,6 +6987,7 @@ USB support provides benefits similar to ATA (for USB disks) or AT (for USB
+ keyboards). In addition it allows USBserial.
+ 
+ Chainloading refers to the ability to load another bootloader through the same protocol
++and on some platforms, like EFI, allow that bootloader to return to the GRUB.
+ 
+ Hints allow faster disk discovery by already knowing in advance which is the disk in
+ question. On some platforms hints are correct unless you move the disk between boots.
+diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
+index 9efb7718c3..eb786766a8 100644
+--- a/grub-core/commands/minicmd.c
++++ b/grub-core/commands/minicmd.c
+@@ -29,6 +29,10 @@
+ #include <grub/command.h>
+ #include <grub/i18n.h>
+ 
++#ifdef GRUB_MACHINE_EFI
++#include <grub/cryptodisk.h>
++#endif
++
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+ /* cat FILE */
+@@ -199,6 +203,13 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)),
+ 	retval = n;
+     }
+ 
++#ifdef GRUB_MACHINE_EFI
++  /*
++   * The "exit" command is often used to launch the next boot application.
++   * So, erase the secrets.
++   */
++  grub_cryptodisk_erasesecrets ();
++#endif
+   grub_exit (retval);
+   /* Not reached.  */
+ }
+diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
+index 8727760100..9597d2d3bd 100644
+--- a/grub-core/disk/cryptodisk.c
++++ b/grub-core/disk/cryptodisk.c
+@@ -1677,6 +1677,31 @@ grub_cryptodisk_challenge_password (void)
+ 
+   return GRUB_ERR_NONE;
+ }
++
++void
++grub_cryptodisk_erasesecrets (void)
++{
++  grub_cryptodisk_t i;
++  grub_uint8_t *buf;
++
++  buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN);
++  if (buf == NULL)
++    grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory");
++
++  for (i = cryptodisk_list; i != NULL; i = i->next)
++    if (grub_cryptodisk_setkey (i, buf, i->keysize))
++      grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for %s", i->source);
++    else
++      grub_printf ("Erased crypto secrets for %s\n", i->source);
++      /*
++       * Unfortunately, there is no way to "force unmount" a given disk, it may
++       * have mounted "child" disks as well, e.g., an LVM volume. So, this
++       * function MUST be called when there is no way back, e.g., when exiting.
++       * Otherwise, subsequent read calls for a cryptodisk will return garbage.
++       */
++
++  grub_free (buf);
++}
+ #endif /* GRUB_MACHINE_EFI */
+ 
+ struct grub_procfs_entry luks_script =
+@@ -1700,6 +1725,9 @@ GRUB_MOD_INIT (cryptodisk)
+ 
+ GRUB_MOD_FINI (cryptodisk)
+ {
++#ifdef GRUB_MACHINE_EFI
++  grub_cryptodisk_erasesecrets ();
++#endif
+   grub_disk_dev_unregister (&grub_cryptodisk_dev);
+   cryptodisk_cleanup ();
+   grub_unregister_extcmd (cmd);
+diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
+index d2572f8b05..ef307dfd5d 100644
+--- a/include/grub/cryptodisk.h
++++ b/include/grub/cryptodisk.h
+@@ -189,5 +189,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);
+ 
+ #ifdef GRUB_MACHINE_EFI
+ grub_err_t grub_cryptodisk_challenge_password (void);
++void grub_cryptodisk_erasesecrets (void);
+ #endif
+ #endif