diff --git a/0284-blscfg-fallback-to-default_kernelopts-if-BLS-option-.patch b/0284-blscfg-fallback-to-default_kernelopts-if-BLS-option-.patch
new file mode 100644
index 00000000..d4b38897
--- /dev/null
+++ b/0284-blscfg-fallback-to-default_kernelopts-if-BLS-option-.patch
@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 26 Feb 2019 20:11:27 +0100
+Subject: [PATCH] blscfg: fallback to default_kernelopts if BLS option field
+ isn't set
+
+If the $kernelopts variable isn't found, then the entry will fail to boot
+since there won't be a kernel command line params set. This makes the BLS
+configuration more fragile than a non-BLS one, since in that case it will
+boot even without a correct grubenv file.
+
+So set a $default_kernelopts in the GRUB config file that will be used as
+a fallback if the value in the BLS options field can't be resolved.
+
+Related: rhbz#1625124
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ grub-core/commands/blscfg.c | 7 +++++++
+ util/grub.d/10_linux.in     | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index 1ef2ae06cff..5635066e3eb 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -629,6 +629,9 @@ static char *expand_val(char *value)
+   char *end = value;
+   bool is_var = false;
+ 
++  if (!value)
++    return NULL;
++
+   while (*value) {
+     if (*value == '$') {
+       if (start != end) {
+@@ -732,6 +735,10 @@ static void create_entry (struct bls_entry *entry)
+ 
+   title = bls_get_val (entry, "title", NULL);
+   options = expand_val (bls_get_val (entry, "options", NULL));
++
++  if (!options)
++    options = expand_val (grub_env_get("default_kernelopts"));
++
+   initrds = bls_make_list (entry, "initrd", NULL);
+ 
+   hotkey = bls_get_val (entry, "grub_hotkey", NULL);
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 22a85c69ea0..2547dd52115 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -158,6 +158,8 @@ linux_entry ()
+     populate_header_warn
+ 
+     cat << EOF
++set default_kernelopts="root=${linux_root_device_thisversion} ro ${args}"
++
+ insmod blscfg
+ blscfg
+ if [ -s \$prefix/grubenv ]; then
diff --git a/0285-grub-switch-to-blscfg-copy-increment.mod-for-legacy-.patch b/0285-grub-switch-to-blscfg-copy-increment.mod-for-legacy-.patch
new file mode 100644
index 00000000..d7ac8ff1
--- /dev/null
+++ b/0285-grub-switch-to-blscfg-copy-increment.mod-for-legacy-.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 26 Feb 2019 21:25:39 +0100
+Subject: [PATCH] grub-switch-to-blscfg: copy increment.mod for legacy BIOS and
+ ppc64
+
+This module is also used in newer GRUB config and weren't present in old
+GRUB installations, so it has to be copied before attempting to generate
+a BLS configuration.
+
+Resolves: rhbz#1652806
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ util/grub-switch-to-blscfg.in | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/util/grub-switch-to-blscfg.in b/util/grub-switch-to-blscfg.in
+index eeea1307706..49b3985fadb 100644
+--- a/util/grub-switch-to-blscfg.in
++++ b/util/grub-switch-to-blscfg.in
+@@ -288,13 +288,15 @@ if [ "${GENERATE}" -eq 1 ] ; then
+     copy_bls
+ 
+     if [ $arch = "x86_64" ] && [ ! -d /sys/firmware/efi ]; then
+-	if ! cp ${prefix}/lib/grub//i386-pc/blscfg.mod ${grubdir}/i386-pc/ ; then
+-	    exit 1
+-	fi
++	mod_dir="i386-pc"
+     elif [ $arch = "ppc64" -o $arch = "ppc64le" ] && [ ! -d /sys/firmware/opal ]; then
+-	if ! cp ${prefix}/lib/grub/powerpc-ieee1275/blscfg.mod ${grubdir}/powerpc-ieee1275/ ; then
+-	    exit 1
+-	fi
++	mod_dir="powerpc-ieee1275"
++    fi
++
++    if [ -n "${mod_dir}" ]; then
++	for mod in blscfg increment; do
++	    cp ${prefix}/lib/grub/${mod_dir}/${mod}.mod ${grubdir}/$mod_dir/ || exit 1
++	done
+     fi
+ 
+     cp -af "${GRUB_CONFIG_FILE}" "${GRUB_CONFIG_FILE}${backupsuffix}"
diff --git a/0286-Only-set-blsdir-if-boot-loader-entries-is-in-a-btrfs.patch b/0286-Only-set-blsdir-if-boot-loader-entries-is-in-a-btrfs.patch
new file mode 100644
index 00000000..341c143d
--- /dev/null
+++ b/0286-Only-set-blsdir-if-boot-loader-entries-is-in-a-btrfs.patch
@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 19 Mar 2019 01:27:57 +0100
+Subject: [PATCH] Only set blsdir if /boot/loader/entries is in a btrfs or zfs
+ partition
+
+Commit bfc756f8d86 ("Set blsdir if the BLS directory path isn't one of the
+looked up by default") attempted to set blsdir if /boot/loader/entries was
+not the real path of the directory containing the BLS snippets. Which may
+be the case if for example /boot/loader/entries is in a btrfs subvolume.
+
+But in the case of ostree, /boot/loader is a symlink to the directory with
+the entries for the current deployment. So with ostree the blsdir will be
+wrongly set, since GRUB is able to follow the symlinks just fine. In fact,
+it has to follow the symlink since otherwise GRUB will always use the BLS
+files for the deployment that the symlink pointed out when blsdir was set.
+
+So only set blsdir if /boot/loader/entries is in a btrfs or zfs partition.
+
+Related: rhbz#1688453
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ util/grub.d/10_linux.in     | 3 ++-
+ util/grub.d/10_linux_bls.in | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 2547dd52115..8f7ecf65df9 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -169,7 +169,8 @@ EOF
+ 
+     if [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ]; then
+         blsdir="/boot/loader/entries"
+-        if [ -d "${blsdir}" ]; then
++        [ -d "${blsdir}" ] && GRUB_BLS_FS="$(${grub_probe} --target=fs ${blsdir})"
++        if [ "x${GRUB_BLS_FS}" = "xbtrfs" ] || [ "x${GRUB_BLS_FS}" = "xzfs" ]; then
+             blsdir=$(make_system_path_relative_to_its_root "${blsdir}")
+             if [ "x${blsdir}" != "x/loader/entries" ] && [ "x${blsdir}" != "x/boot/loader/entries" ]; then
+                 ${grub_editenv} - set blsdir="${blsdir}"
+diff --git a/util/grub.d/10_linux_bls.in b/util/grub.d/10_linux_bls.in
+index 47b87c8a14b..1707e86f2d3 100644
+--- a/util/grub.d/10_linux_bls.in
++++ b/util/grub.d/10_linux_bls.in
+@@ -227,7 +227,8 @@ linux_entry ()
+ 
+     if [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ]; then
+         blsdir="/boot/loader/entries"
+-        if [ -d "${blsdir}" ]; then
++        [ -d "${blsdir}" ] && GRUB_BLS_FS="$(${grub_probe} --target=fs ${blsdir})"
++        if [ "x${GRUB_BLS_FS}" = "xbtrfs" ] || [ "x${GRUB_BLS_FS}" = "xzfs" ]; then
+             blsdir=$(make_system_path_relative_to_its_root "${blsdir}")
+             if [ "x${blsdir}" != "x/loader/entries" ] && [ "x${blsdir}" != "x/boot/loader/entries" ]; then
+                 ${grub_editenv} - set blsdir="${blsdir}"
diff --git a/0287-blscfg-don-t-use-grub_list_t-and-the-GRUB_AS_LIST-ma.patch b/0287-blscfg-don-t-use-grub_list_t-and-the-GRUB_AS_LIST-ma.patch
new file mode 100644
index 00000000..a05da65d
--- /dev/null
+++ b/0287-blscfg-don-t-use-grub_list_t-and-the-GRUB_AS_LIST-ma.patch
@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Fri, 22 Mar 2019 11:14:26 +0100
+Subject: [PATCH] blscfg: don't use grub_list_t and the GRUB_AS_LIST() macro
+
+We are not using GRUB's list functions anyways since we want to add new
+items in the middle ot the list but GRUB's grub_list_push() only allows
+to add new items at the beginning of the list. So don't use grub_list_t
+and GRUB_AS_LIST() macro and just reference struct bls_entry * directly.
+
+We can't change GRUB lists API because we want the blscfg module to not
+need external symbols so it can be updated without updating GRUB's core.
+
+This also solves a bug where the struct bls_entry .next field wasn't set
+correctly which caused some entries to not be populated in the grub menu.
+
+Resolves: rhbz#1691232
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ grub-core/commands/blscfg.c | 10 +++++-----
+ include/grub/menu.h         |  2 +-
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index 5635066e3eb..bb93b7f4904 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -350,13 +350,13 @@ static int bls_cmp(const struct bls_entry *e0, const struct bls_entry *e1)
+   return r;
+ }
+ 
+-static void list_add_tail(grub_list_t head, grub_list_t item)
++static void list_add_tail(struct bls_entry *head, struct bls_entry *item)
+ {
+   item->next = head;
+   if (head->prev)
+-    (*head->prev)->next = item;
++    head->prev->next = item;
+   item->prev = head->prev;
+-  head->prev = &item;
++  head->prev = item;
+ }
+ 
+ static int bls_add_entry(struct bls_entry *entry)
+@@ -378,7 +378,7 @@ static int bls_add_entry(struct bls_entry *entry)
+ 
+     if (rc == 1) {
+       grub_dprintf ("blscfg", "Add entry with id \"%s\"\n", entry->filename);
+-      list_add_tail (GRUB_AS_LIST (e), GRUB_AS_LIST (entry));
++      list_add_tail (e, entry);
+       if (e == entries) {
+ 	entries = entry;
+ 	entry->prev = NULL;
+@@ -391,7 +391,7 @@ static int bls_add_entry(struct bls_entry *entry)
+   if (last) {
+     grub_dprintf ("blscfg", "Add entry with id \"%s\"\n", entry->filename);
+     last->next = entry;
+-    entry->prev = &last;
++    entry->prev = last;
+   }
+ 
+   return 0;
+diff --git a/include/grub/menu.h b/include/grub/menu.h
+index eea493f74b1..0acdc2aa6bf 100644
+--- a/include/grub/menu.h
++++ b/include/grub/menu.h
+@@ -23,7 +23,7 @@
+ struct bls_entry
+ {
+   struct bls_entry *next;
+-  struct bls_entry **prev;
++  struct bls_entry *prev;
+   struct keyval **keyvals;
+   int nkeyvals;
+   char *filename;
diff --git a/0288-10_linux_bls-don-t-add-users-option-to-generated-men.patch b/0288-10_linux_bls-don-t-add-users-option-to-generated-men.patch
new file mode 100644
index 00000000..86955ace
--- /dev/null
+++ b/0288-10_linux_bls-don-t-add-users-option-to-generated-men.patch
@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Thu, 28 Mar 2019 16:34:42 +0100
+Subject: [PATCH] 10_linux_bls: don't add --users option to generated menu
+ entries
+
+The generated menu entries have a --users $grub_users option but this will
+fail on old versions of GRUB, since it expects the --users option argument
+to either be a constant or a variable that has been set.
+
+The latest GRUB version fix this but the GRUB core isn't updated on a GRUB
+package update, so this will cause the entries to not be shown in the menu
+after a system upgrade.
+
+Since can cause issues and because the entries that weren't generated from
+the BLS snippets didn't have the --users option either, just don't add it.
+
+Resolves: rhbz#1693515
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ util/grub.d/10_linux_bls.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/util/grub.d/10_linux_bls.in b/util/grub.d/10_linux_bls.in
+index 1707e86f2d3..b8ee9916329 100644
+--- a/util/grub.d/10_linux_bls.in
++++ b/util/grub.d/10_linux_bls.in
+@@ -180,7 +180,7 @@ populate_menu()
+     for bls in "${files[@]}" ; do
+         read_config "${blsdir}/${bls}.conf"
+ 
+-        menu="${menu}menuentry '${title}' --class ${grub_class} ${grub_arg} --users ${grub_users} --id ${bls} {\n"
++        menu="${menu}menuentry '${title}' --class ${grub_class} ${grub_arg} --id ${bls} {\n"
+         menu="${menu}\t linux ${linux} ${options}\n"
+         if [ -n "${initrd}" ] ; then
+             menu="${menu}\t initrd ${boot_prefix}${initrd}\n"
diff --git a/0289-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch b/0289-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch
new file mode 100644
index 00000000..691380d6
--- /dev/null
+++ b/0289-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch
@@ -0,0 +1,152 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christian Glombek <lorbus@fedoraproject.org>
+Date: Tue, 2 Apr 2019 16:22:21 +0200
+Subject: [PATCH] grub.d: Split out boot success reset from menu auto hide
+ script
+
+Also rename fallback and menu auto hide script to be executed
+before and after boot success reset script.
+In menu auto hide script, rename last_boot_ok var to menu_hide_ok
+---
+ Makefile.util.def                                  |  8 +++----
+ ...allback_counting.in => 08_fallback_counting.in} | 14 ++++++------
+ util/grub.d/10_reset_boot_success.in               | 25 ++++++++++++++++++++++
+ .../{01_menu_auto_hide.in => 12_menu_auto_hide.in} | 23 +++++---------------
+ 4 files changed, 42 insertions(+), 28 deletions(-)
+ rename util/grub.d/{01_fallback_counting.in => 08_fallback_counting.in} (65%)
+ create mode 100644 util/grub.d/10_reset_boot_success.in
+ rename util/grub.d/{01_menu_auto_hide.in => 12_menu_auto_hide.in} (58%)
+
+diff --git a/Makefile.util.def b/Makefile.util.def
+index eca3dfa753f..cae6002d2e3 100644
+--- a/Makefile.util.def
++++ b/Makefile.util.def
+@@ -449,14 +449,14 @@ script = {
+ };
+ 
+ script = {
+-  name = '01_fallback_counting';
+-  common = util/grub.d/01_fallback_counting.in;
++  name = '08_fallback_counting';
++  common = util/grub.d/08_fallback_counting.in;
+   installdir = grubconf;
+ };
+ 
+ script = {
+-  name = '01_menu_auto_hide';
+-  common = util/grub.d/01_menu_auto_hide.in;
++  name = '12_menu_auto_hide';
++  common = util/grub.d/12_menu_auto_hide.in;
+   installdir = grubconf;
+ };
+ 
+diff --git a/util/grub.d/01_fallback_counting.in b/util/grub.d/08_fallback_counting.in
+similarity index 65%
+rename from util/grub.d/01_fallback_counting.in
+rename to util/grub.d/08_fallback_counting.in
+index be0e770ea82..2e2c3ff7d31 100644
+--- a/util/grub.d/01_fallback_counting.in
++++ b/util/grub.d/08_fallback_counting.in
+@@ -1,15 +1,17 @@
+ #! /bin/sh -e
+-
+-# Boot Counting
++# Fallback Countdown
++#
++# This snippet depends on 10_reset_boot_success and needs to be kept in sync.
++#
+ # The boot_counter env var can be used to count down boot attempts after an
+-# OSTree upgrade and choose the rollback deployment when 0 is reached.  Both
+-# boot_counter and boot_success need to be (re-)set from userspace.
++# OSTree upgrade and choose the rollback deployment when 0 is reached.
++# Both boot_counter=X and boot_success=1 need to be set from userspace.
+ cat << EOF
+ insmod increment
+ # Check if boot_counter exists and boot_success=0 to activate this behaviour.
+ if [ -n "\${boot_counter}" -a "\${boot_success}" = "0" ]; then
+-  # if countdown has ended, choose to boot rollback deployment (default=1 on
+-  # OSTree-based systems)
++  # if countdown has ended, choose to boot rollback deployment,
++  # i.e. default=1 on OSTree-based systems.
+   if  [ "\${boot_counter}" = "0" -o "\${boot_counter}" = "-1" ]; then
+     set default=1
+     set boot_counter=-1
+diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in
+new file mode 100644
+index 00000000000..6c88d933dde
+--- /dev/null
++++ b/util/grub.d/10_reset_boot_success.in
+@@ -0,0 +1,25 @@
++#! /bin/sh -e
++# Reset Boot Success
++#
++# The 08_fallback_counting and 12_menu_auto_hide snippets rely on this one
++# and need to be kept in sync.
++#
++# The boot_success var needs to be set to 1 from userspace to mark a boot successful.
++cat << EOF
++insmod increment
++# Hiding the menu is ok if last boot was ok or if this is a first boot attempt to boot the entry
++if [ "\${boot_success}" = "1" -o "\${boot_indeterminate}" = "1" ]; then
++  set menu_hide_ok=1
++else
++  set menu_hide_ok=0 
++fi
++# Reset boot_indeterminate after a successful boot, increment otherwise
++if [ "\${boot_success}" = "1" ] ; then
++  set boot_indeterminate=0
++else
++  increment boot_indeterminate
++fi
++# Reset boot_success for current boot 
++set boot_success=0
++save_env boot_success boot_indeterminate
++EOF
+diff --git a/util/grub.d/01_menu_auto_hide.in b/util/grub.d/12_menu_auto_hide.in
+similarity index 58%
+rename from util/grub.d/01_menu_auto_hide.in
+rename to util/grub.d/12_menu_auto_hide.in
+index ad175870a54..6a7c0fa0d43 100644
+--- a/util/grub.d/01_menu_auto_hide.in
++++ b/util/grub.d/12_menu_auto_hide.in
+@@ -1,5 +1,8 @@
+ #! /bin/sh
+-
++# Menu Auto Hide
++#
++# This snippet depends on 10_reset_boot_success and needs to be kept in sync.
++#
+ # Disable / skip generating menu-auto-hide config parts on serial terminals
+ for x in ${GRUB_TERMINAL_INPUT} ${GRUB_TERMINAL_OUTPUT}; do
+   case "$x" in
+@@ -10,29 +13,13 @@ for x in ${GRUB_TERMINAL_INPUT} ${GRUB_TERMINAL_OUTPUT}; do
+ done
+ 
+ cat << EOF
+-if [ "\${boot_success}" = "1" -o "\${boot_indeterminate}" = "1" ]; then
+-  set last_boot_ok=1
+-else
+-  set last_boot_ok=0
+-fi
+-
+-# Reset boot_indeterminate after a successful boot
+-if [ "\${boot_success}" = "1" ] ; then
+-  set boot_indeterminate=0
+-# Avoid boot_indeterminate causing the menu to be hidden more then once
+-elif [ "\${boot_indeterminate}" = "1" ]; then
+-  set boot_indeterminate=2
+-fi
+-set boot_success=0
+-save_env boot_success boot_indeterminate
+-
+ if [ x\$feature_timeout_style = xy ] ; then
+   if [ "\${menu_show_once}" ]; then
+     unset menu_show_once
+     save_env menu_show_once
+     set timeout_style=menu
+     set timeout=60
+-  elif [ "\${menu_auto_hide}" -a "\${last_boot_ok}" = "1" ]; then
++  elif [ "\${menu_auto_hide}" -a "\${menu_hide_ok}" = "1" ]; then
+     set orig_timeout_style=\${timeout_style}
+     set orig_timeout=\${timeout}
+     if [ "\${fastboot}" = "1" ]; then
diff --git a/0290-HTTP-boot-strncmp-returns-0-on-equal.patch b/0290-HTTP-boot-strncmp-returns-0-on-equal.patch
new file mode 100644
index 00000000..09cbcb30
--- /dev/null
+++ b/0290-HTTP-boot-strncmp-returns-0-on-equal.patch
@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stephen Benjamin <stephen@redhat.com>
+Date: Fri, 12 Apr 2019 10:43:13 -0400
+Subject: [PATCH] HTTP boot: strncmp returns 0 on equal
+
+---
+ grub-core/net/efi/http.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c
+index 2a9624dacc4..484e0c68cee 100644
+--- a/grub-core/net/efi/http.c
++++ b/grub-core/net/efi/http.c
+@@ -19,7 +19,7 @@ http_configure (struct grub_efi_net_device *dev, int prefer_ip6)
+   const char *rest, *http_server, *http_path = NULL;
+ 
+   http_server = grub_env_get ("root");
+-  https = grub_strncmp (http_server, "https", 5) ? 1 : 0;
++  https = (grub_strncmp (http_server, "https", 5) == 0) ? 1 : 0;
+ 
+   /* extract http server + port */
+   if (http_server)
diff --git a/0291-Add-10_reset_boot_success-to-Makefile.patch b/0291-Add-10_reset_boot_success-to-Makefile.patch
new file mode 100644
index 00000000..541b5f1a
--- /dev/null
+++ b/0291-Add-10_reset_boot_success-to-Makefile.patch
@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Thu, 18 Apr 2019 19:16:18 +0200
+Subject: [PATCH] Add 10_reset_boot_success to Makefile
+
+This was missing in a previous commit that added this script.
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ Makefile.util.def | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/Makefile.util.def b/Makefile.util.def
+index cae6002d2e3..5062a0e50fa 100644
+--- a/Makefile.util.def
++++ b/Makefile.util.def
+@@ -515,6 +515,12 @@ script = {
+   condition = COND_HOST_LINUX;
+ };
+ 
++script = {
++  name = '10_reset_boot_success';
++  common = util/grub.d/10_reset_boot_success.in;
++  installdir = grubconf;
++};
++
+ script = {
+   name = '10_xnu';
+   common = util/grub.d/10_xnu.in;
diff --git a/0292-blscfg-remove-BLS-file-size-check.patch b/0292-blscfg-remove-BLS-file-size-check.patch
new file mode 100644
index 00000000..edd6e9ef
--- /dev/null
+++ b/0292-blscfg-remove-BLS-file-size-check.patch
@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 7 May 2019 13:54:23 +0200
+Subject: [PATCH] blscfg: remove BLS file size check
+
+The read_entry() function checks the BLS file size and ignores the entry
+if the file size isn't correct. The problem is that it will only work if
+the struct grub_file layout and fields are the same in the GRUB version
+used to build the blscfg.mod, than the one that's installed as GRUB core.
+
+But commit 84a0e9699f8 ("Add progress module to display load progress of
+files.") added a .name field to struct grub_file, and this change landed
+in the GRUB version used by Fedora 21.
+
+Since the GRUB core is never updated when the grub2 package is upgraded,
+the blscfg module won't be compatible with any GRUB that was installed by
+Fedora 20 or eralier.
+
+The blscfg.mod is copied to /boot/grub2/i386-pc/ in legacy BIOS installs
+when the GRUB configuration is switched to BLS, so this will lead to BLS
+files being ignored due grub_file_size() reporting wrong file sizes. This
+is caused by the struct grub_file .size field offset being different in
+Fedora 20 than later releases.
+
+This check is doing more harm than good, so let's just remove it to make
+the blscfg module compatible at least up to GRUB core that was installed
+by Fedora 19.
+
+Related: rhbz#1652806
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ grub-core/commands/blscfg.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index bb93b7f4904..bd008b04bec 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -412,7 +412,6 @@ static int read_entry (
+   int rc = 0;
+   char *p = NULL;
+   grub_file_t f = NULL;
+-  grub_off_t sz;
+   struct bls_entry *entry;
+   struct read_entry_info *info = (struct read_entry_info *)data;
+ 
+@@ -442,10 +441,6 @@ static int read_entry (
+ 	goto finish;
+     }
+ 
+-  sz = grub_file_size (f);
+-  if (sz == GRUB_FILE_SIZE_UNKNOWN || sz > 1024*1024)
+-    goto finish;
+-
+   entry = grub_zalloc (sizeof (*entry));
+   if (!entry)
+     goto finish;
diff --git a/0293-Remove-bogus-load_env-after-blscfg-command-in-10_lin.patch b/0293-Remove-bogus-load_env-after-blscfg-command-in-10_lin.patch
new file mode 100644
index 00000000..b5ad3998
--- /dev/null
+++ b/0293-Remove-bogus-load_env-after-blscfg-command-in-10_lin.patch
@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Tue, 14 May 2019 20:37:44 +0200
+Subject: [PATCH] Remove bogus load_env after blscfg command in 10_linux
+
+The grubenv is already loaded in the 00_header snippet, so there's
+no need to load it anywhere else.
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ util/grub.d/10_linux.in | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 8f7ecf65df9..350903fa5ab 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -162,9 +162,6 @@ set default_kernelopts="root=${linux_root_device_thisversion} ro ${args}"
+ 
+ insmod blscfg
+ blscfg
+-if [ -s \$prefix/grubenv ]; then
+-  load_env
+-fi
+ EOF
+ 
+     if [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ]; then
diff --git a/0294-blscfg-Don-t-leave-grub_errno-set-to-an-error-if-the.patch b/0294-blscfg-Don-t-leave-grub_errno-set-to-an-error-if-the.patch
new file mode 100644
index 00000000..e02ca07c
--- /dev/null
+++ b/0294-blscfg-Don-t-leave-grub_errno-set-to-an-error-if-the.patch
@@ -0,0 +1,44 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Wed, 15 May 2019 01:46:00 +0200
+Subject: [PATCH] blscfg: Don't leave grub_errno set to an error if the command
+ succeeded
+
+After a command is executed, the function grub_print_error() is called to
+print any active error messages if these exist.
+
+The blscfg command calls to the grub_strtol() function to try to convert
+the default entry string to a number, in case the default is an index.
+
+If this function is not able to do the conversion, it sets the grub_errno
+variable to GRUB_ERR_BAD_NUMBER. But the blscfg command wrongly left that
+set and so the caller would be confused thinking that the command failed
+and that an error message has to be printed.
+
+This caused the first error in the stack to be printed, polluting the GRUB
+output and preventing the menu to be hidden. So reset the grub_error var
+to GRUB_ERR_NONE again if was set to GRUB_ERR_BAD_NUMBER by grub_strtol().
+
+Resolves: rhbz#1699761
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ grub-core/commands/blscfg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index bd008b04bec..26dbe873fe4 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -999,8 +999,10 @@ is_default_entry(const char *def_entry, struct bls_entry *entry, int idx)
+     return true;
+ 
+   def_idx = (int)grub_strtol(def_entry, NULL, 0);
+-  if (grub_errno == GRUB_ERR_BAD_NUMBER)
++  if (grub_errno == GRUB_ERR_BAD_NUMBER) {
++    grub_errno = GRUB_ERR_NONE;
+     return false;
++  }
+ 
+   if (def_idx == idx)
+     return true;
diff --git a/0295-blscfg-Fix-typo-for-gfxpayload-variable-name.patch b/0295-blscfg-Fix-typo-for-gfxpayload-variable-name.patch
new file mode 100644
index 00000000..5599fa1e
--- /dev/null
+++ b/0295-blscfg-Fix-typo-for-gfxpayload-variable-name.patch
@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Wed, 16 Oct 2019 12:16:32 +0200
+Subject: [PATCH] blscfg: Fix typo for gfxpayload variable name
+
+There was a silly typo when setting the environment variable gfxpayload so
+graphics mode wouldn't be preserved on some machines leading to text mode.
+
+Resolves: rhbz#1706489
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ grub-core/commands/blscfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index 26dbe873fe4..8c6dd91be10 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -822,7 +822,7 @@ static void create_entry (struct bls_entry *entry)
+     }
+ 
+   src = grub_xasprintf ("load_video\n"
+-			"set gfx_payload=keep\n"
++			"set gfxpayload=keep\n"
+ 			"insmod gzio\n"
+ 			"linux %s%s%s%s\n"
+ 			"%s",
diff --git a/0296-grub-set-bootflag-Update-comment-about-running-as-ro.patch b/0296-grub-set-bootflag-Update-comment-about-running-as-ro.patch
new file mode 100644
index 00000000..f28733fa
--- /dev/null
+++ b/0296-grub-set-bootflag-Update-comment-about-running-as-ro.patch
@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 13 Nov 2019 12:15:43 +0100
+Subject: [PATCH] grub-set-bootflag: Update comment about running as root
+ through pkexec
+
+We have stopped using pkexec for grub-set-bootflag, instead it is now
+installed suid root, update the comment accordingly.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ util/grub-set-bootflag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c
+index 20062fe802b..0ce565611fc 100644
+--- a/util/grub-set-bootflag.c
++++ b/util/grub-set-bootflag.c
+@@ -18,7 +18,7 @@
+  */
+ 
+ /*
+- * NOTE this gets run by users as root (through pkexec), so this does not
++ * NOTE this gets run by users as root (its suid root), so this does not
+  * use any grub library / util functions to allow for easy auditing.
+  * The grub headers are only included to get certain defines.
+  */
diff --git a/0297-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch b/0297-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch
new file mode 100644
index 00000000..8608e481
--- /dev/null
+++ b/0297-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch
@@ -0,0 +1,152 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 22 Nov 2019 11:54:27 +0100
+Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename
+
+Make the grubenv writing code in grub-set-bootflag more robust by
+writing the modified grubenv to a tmpfile first and then renaming the
+tmpfile over the old grubenv (following symlinks).
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 78 insertions(+), 9 deletions(-)
+
+diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c
+index 0ce565611fc..2999db27930 100644
+--- a/util/grub-set-bootflag.c
++++ b/util/grub-set-bootflag.c
+@@ -27,7 +27,9 @@
+ #include <grub/types.h>
+ #include <grub/err.h>
+ #include <grub/lib/envblk.h> /* For GRUB_ENVBLK_DEFCFG define */
++#include <limits.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <string.h>
+ #include <unistd.h>
+ 
+@@ -53,8 +55,10 @@ int main(int argc, char *argv[])
+ {
+   /* NOTE buf must be at least the longest bootflag length + 4 bytes */
+   char env[GRUBENV_SIZE + 1], buf[64], *s;
++  /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */
++  char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1];
+   const char *bootflag;
+-  int i, len, ret;
++  int i, fd, len, ret;
+   FILE *f;
+ 
+   if (argc != 2)
+@@ -76,7 +80,32 @@ int main(int argc, char *argv[])
+   bootflag = bootflags[i];
+   len = strlen (bootflag);
+ 
+-  f = fopen (GRUBENV, "r");
++  /*
++   * Really become root. setuid avoids an user killing us, possibly leaking
++   * the tmpfile. setgid avoids the new grubenv's gid being that of the user.
++   */
++  ret = setuid(0);
++  if (ret)
++    {
++      perror ("Error setuid(0) failed");
++      return 1;
++    }
++
++  ret = setgid(0);
++  if (ret)
++    {
++      perror ("Error setgid(0) failed");
++      return 1;
++    }
++
++  /* Canonicalize GRUBENV filename, resolving symlinks, etc. */
++  if (!realpath(GRUBENV, env_filename))
++    {
++      perror ("Error canonicalizing " GRUBENV " filename");
++      return 1;
++    }
++
++  f = fopen (env_filename, "r");
+   if (!f)
+     {
+       perror ("Error opening " GRUBENV " for reading");
+@@ -130,30 +159,70 @@ int main(int argc, char *argv[])
+   snprintf(buf, sizeof(buf), "%s=1\n", bootflag);
+   memcpy(s, buf, len + 3);
+ 
+-  /* "r+", don't truncate so that the diskspace stays reserved */
+-  f = fopen (GRUBENV, "r+");
++
++  /*
++   * Create a tempfile for writing the new env.  Use the canonicalized filename
++   * for the template so that the tmpfile is in the same dir / on same fs.
++   */
++  snprintf(tmp_filename, sizeof(tmp_filename), "%sXXXXXX", env_filename);
++  fd = mkstemp(tmp_filename);
++  if (fd == -1)
++    {
++      perror ("Creating tmpfile failed");
++      return 1;
++    }
++
++  f = fdopen (fd, "w");
+   if (!f)
+     {
+-      perror ("Error opening " GRUBENV " for writing");
++      perror ("Error fdopen of tmpfile failed");
++      unlink(tmp_filename);
+       return 1;     
+     }
+ 
+   ret = fwrite (env, 1, GRUBENV_SIZE, f);
+   if (ret != GRUBENV_SIZE)
+     {
+-      perror ("Error writing to " GRUBENV);
++      perror ("Error writing tmpfile");
++      unlink(tmp_filename);
+       return 1;     
+     }
+ 
+   ret = fflush (f);
+   if (ret)
+     {
+-      perror ("Error flushing " GRUBENV);
++      perror ("Error flushing tmpfile");
++      unlink(tmp_filename);
+       return 1;     
+     }
+ 
+-  fsync (fileno (f));
+-  fclose (f);
++  ret = fsync (fileno (f));
++  if (ret)
++    {
++      perror ("Error syncing tmpfile");
++      unlink(tmp_filename);
++      return 1;
++    }
++
++  ret = fclose (f);
++  if (ret)
++    {
++      perror ("Error closing tmpfile");
++      unlink(tmp_filename);
++      return 1;
++    }
++
++  /*
++   * And finally rename the tmpfile with the new env over the old env, the
++   * linux kernel guarantees that this is atomic (from a syscall pov).
++   */
++  ret = rename(tmp_filename, env_filename);
++  if (ret)
++    {
++      perror ("Error renaming tmpfile to " GRUBENV " failed");
++      unlink(tmp_filename);
++      return 1;
++    }
+ 
+   return 0;
+ }
diff --git a/0298-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0298-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch
new file mode 100644
index 00000000..54b73e6c
--- /dev/null
+++ b/0298-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch
@@ -0,0 +1,75 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 26 Nov 2019 09:51:41 +0100
+Subject: [PATCH] grub.d: Fix boot_indeterminate getting set on boot_success=0
+ boot
+
+The "grub.d: Split out boot success reset from menu auto hide script"
+not only moved the code to clear boot_success and boot_indeterminate
+but for some reason also mixed in some broken changes to the
+boot_indeterminate handling.
+
+The boot_indeterminate var is meant to suppress the boot menu after
+a reboot from either a selinux-relabel or offline-updates. These
+2 special boot scenarios do not set boot_success since there is no
+successfull interaction with the user. Instead they increment
+boot_indeterminate, and if it is 1 and only when it is 1, so the
+first reboot after a "special" boot we suppress the menu.
+
+To ensure that we do show the menu if we somehow get stuck in a
+"special" boot loop where we do special-boots without them
+incrementing boot_indeterminate, the code before the
+"grub.d: Split out boot success reset from menu auto hide script"
+commit would increment boot_indeterminate once when it is 1, so that
+even if the "special" boot reboot-loop immediately we would show the
+menu on the next boot.
+
+That commit broke this however, because it not only moves the code,
+it also changes it from only "incrementing" boot_indeterminate once to
+always incrementing it, except when boot_success == 1 (and we reset it).
+
+This broken behavior causes the following problem:
+
+1. Boot a broken kernel, system hangs, power-cycle
+2. boot_success now != 1, so we increment boot_indeterminate from 0
+   (unset!) to 1. User either simply tries again, or makes some changes
+   but the end-result still is a system hang, power-cycle
+3. Now boot_indeterminate==1 so we do not show the menu even though the
+   previous boot failed -> BAD
+
+This commit fixes this by restoring the behavior of setting
+boot_indeterminate to 2 when it was 1 before.
+
+Fixes: "grub.d: Split out boot success reset from menu auto hide script"
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ util/grub.d/10_reset_boot_success.in | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in
+index 6c88d933dde..737e1ae5b68 100644
+--- a/util/grub.d/10_reset_boot_success.in
++++ b/util/grub.d/10_reset_boot_success.in
+@@ -6,18 +6,18 @@
+ #
+ # The boot_success var needs to be set to 1 from userspace to mark a boot successful.
+ cat << EOF
+-insmod increment
+ # Hiding the menu is ok if last boot was ok or if this is a first boot attempt to boot the entry
+ if [ "\${boot_success}" = "1" -o "\${boot_indeterminate}" = "1" ]; then
+   set menu_hide_ok=1
+ else
+   set menu_hide_ok=0 
+ fi
+-# Reset boot_indeterminate after a successful boot, increment otherwise
++# Reset boot_indeterminate after a successful boot
+ if [ "\${boot_success}" = "1" ] ; then
+   set boot_indeterminate=0
+-else
+-  increment boot_indeterminate
++# Avoid boot_indeterminate causing the menu to be hidden more then once
++elif [ "\${boot_indeterminate}" = "1" ]; then
++  set boot_indeterminate=2
+ fi
+ # Reset boot_success for current boot 
+ set boot_success=0
diff --git a/0299-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch b/0299-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch
new file mode 100644
index 00000000..25685e87
--- /dev/null
+++ b/0299-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Mon, 13 Jan 2020 15:44:42 +0100
+Subject: [PATCH] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set
+ kernelopts
+
+The GRUB documentation mentions that there are two variables to set the
+linux kernel cmdline: GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT.
+
+The former is added to all the menuentry commands and the latter is not
+added to the recovery mode menu entries. But the blscfg module doesn't
+populate recovery entries from the BLS snippets, so the values set in the
+GRUB_CMDLINE_LINUX_DEFAULT variable should also be included in kernelopts.
+
+This is needed because the GRUB_CMDLINE_LINUX_DEFAULT option is mentioned
+in the GRUB documentation so users assume that the kernel cmdline options
+can be changed by setting this option and running the grub2-mkconfig tool.
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ util/grub.d/10_linux.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 350903fa5ab..79b028b6155 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -158,7 +158,7 @@ linux_entry ()
+     populate_header_warn
+ 
+     cat << EOF
+-set default_kernelopts="root=${linux_root_device_thisversion} ro ${args}"
++set default_kernelopts="root=${linux_root_device_thisversion} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+ 
+ insmod blscfg
+ blscfg
+@@ -174,7 +174,7 @@ EOF
+             fi
+         fi
+ 
+-	${grub_editenv} - set kernelopts="root=${linux_root_device_thisversion} ro ${args}"
++	${grub_editenv} - set kernelopts="root=${linux_root_device_thisversion} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}"
+ 	if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then
+ 	    ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}"
+ 	fi
diff --git a/0300-Fix-savedefault-with-blscfg.patch b/0300-Fix-savedefault-with-blscfg.patch
new file mode 100644
index 00000000..0e625767
--- /dev/null
+++ b/0300-Fix-savedefault-with-blscfg.patch
@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fritz Elfert <fritz@fritz-elfert.de>
+Date: Mon, 13 Jan 2020 15:48:59 +0100
+Subject: [PATCH] Fix savedefault with blscfg
+
+The GRUB_SAVEDEFAULT option was ignored on a BLS configuration. Fix it by
+making the menu entries populated from the BLS files to call savedefault
+if a save_default environment variable has been set to "true".
+
+This variable is set by grub2-mkconfig to the value in GRUB_SAVEDEFAULT.
+---
+ grub-core/commands/blscfg.c | 5 ++++-
+ util/grub.d/10_linux.in     | 4 ++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c
+index 8c6dd91be10..f2c1fd0733d 100644
+--- a/grub-core/commands/blscfg.c
++++ b/grub-core/commands/blscfg.c
+@@ -821,11 +821,14 @@ static void create_entry (struct bls_entry *entry)
+       tmp = grub_stpcpy (tmp, "\n");
+     }
+ 
+-  src = grub_xasprintf ("load_video\n"
++  const char *sdval = grub_env_get("save_default");
++  bool savedefault = ((NULL != sdval) && (grub_strcmp(sdval, "true") == 0));
++  src = grub_xasprintf ("%sload_video\n"
+ 			"set gfxpayload=keep\n"
+ 			"insmod gzio\n"
+ 			"linux %s%s%s%s\n"
+ 			"%s",
++			savedefault ? "savedefault\n" : "",
+ 			GRUB_BOOT_DEVICE, clinux, options ? " " : "", options ? options : "",
+ 			initrd ? initrd : "");
+ 
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 79b028b6155..12a3a034e65 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -178,6 +178,10 @@ EOF
+ 	if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then
+ 	    ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}"
+ 	fi
++
++	if [ -n "${GRUB_SAVEDEFAULT}" ]; then
++	    ${grub_editenv} - set save_default="${GRUB_SAVEDEFAULT}"
++	fi
+     fi
+ 
+     exit 0
diff --git a/20-grub.install b/20-grub.install
index 3f6e33f6..f2de7760 100755
--- a/20-grub.install
+++ b/20-grub.install
@@ -16,8 +16,8 @@ KERNEL_DIR="${KERNEL_IMAGE%/*}"
 
 MACHINE_ID=$KERNEL_INSTALL_MACHINE_ID
 
-# Remove it, since for grub2 the images are always installed in /boot
-rm -rf "${BOOT_DIR_ABS%/*}"
+# If ${BOOT_DIR_ABS} exists, some other boot loader is active.
+[[ -d "${BOOT_DIR_ABS}" ]] && exit 0
 
 BLS_DIR="/boot/loader/entries"
 
@@ -62,6 +62,7 @@ case "$COMMAND" in
                     "$KERNEL_DIR"/dtb
             do
                 [[ -e "$i" ]] || continue
+                rm -f "/boot/${i##*/}-${KERNEL_VERSION}"
                 cp -aT "$i" "/boot/${i##*/}-${KERNEL_VERSION}"
                 command -v restorecon &>/dev/null && \
                     restorecon -R "/boot/${i##*/}-${KERNEL_VERSION}"
@@ -69,6 +70,7 @@ case "$COMMAND" in
             # hmac is .vmlinuz-<version>.hmac so needs a special treatment
             i="$KERNEL_DIR/.${KERNEL_IMAGE##*/}.hmac"
             if [[ -e "$i" ]]; then
+                rm -f "/boot/.${KERNEL_IMAGE##*/}-${KERNEL_VERSION}.hmac"
                 cp -a "$i" "/boot/.${KERNEL_IMAGE##*/}-${KERNEL_VERSION}.hmac"
                 command -v restorecon &>/dev/null && \
                     restorecon "/boot/.${KERNEL_IMAGE##*/}-${KERNEL_VERSION}.hmac"
@@ -92,6 +94,7 @@ case "$COMMAND" in
             INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,')"
             LINUX_RELPATH="$(grub2-mkrelpath /boot${LINUX})"
             BOOTPREFIX="$(dirname ${LINUX_RELPATH})"
+            ROOTPREFIX="$(dirname "/boot${LINUX}")"
 
             if [[ $LINUX != $LINUX_RELPATH ]]; then
                 sed -i -e "s,^linux.*,linux ${BOOTPREFIX}${LINUX},g" "${BLS_TARGET}"
@@ -124,10 +127,10 @@ case "$COMMAND" in
             fi
 
             # this probably isn't the best place to do this, but it will do for now.
-            if [ -e "${BOOTPREFIX}${INITRD}" -a -e "${BOOTPREFIX}${LINUX}" -a \
-                 "${BOOTPREFIX}${INITRD}" -ot "${BOOTPREFIX}${LINUX}" -a \
+            if [ -e "${ROOTPREFIX}${INITRD}" -a -e "${ROOTPREFIX}${LINUX}" -a \
+                 "${ROOTPREFIX}${INITRD}" -ot "${ROOTPREFIX}${LINUX}" -a \
                  -x /usr/lib/kernel/install.d/50-dracut.install ]; then
-                rm -f "${BOOTPREFIX}${INITRD}"
+                rm -f "${ROOTPREFIX}${INITRD}"
             fi
             exit 0
         fi
diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install
index 5f9545d1..339b3c77 100755
--- a/99-grub-mkconfig.install
+++ b/99-grub-mkconfig.install
@@ -4,10 +4,30 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then
     exit 0
 fi
 
-ARCH=$(uname -m)
+# PV and PVH Xen DomU guests boot with pygrub that doesn't have BLS support,
+# also Xen Dom0 use the menuentries from 20_linux_xen and not the ones from
+# 10_linux. So BLS support needs to be disabled for both Xen Dom0 and DomU.
+if [[ -e /sys/hypervisor/type ]] && grep -q "^xen$" /sys/hypervisor/type; then
+    RUN_MKCONFIG=true
+    DISABLE_BLS=true
+fi
 
-# Is only needed for ppc64* since we can't assume a BLS capable bootloader there
-if [[ $ARCH != "ppc64" && $ARCH != "ppc64le" ]]; then
+ARCH=$(uname -m)
+# Older ppc64le OPAL firmware don't have BLS support so grub2-mkconfig has to
+# be run to generate a GRUB config file that contains menuentry commands.
+if [[ $ARCH = "ppc64le" ]]; then
+    RUN_MKCONFIG=true
+fi
+
+if [[ $DISABLE_BLS = "true" ]]; then
+    if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then
+	sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub
+    fi
+fi
+
+# A traditional grub configuration file needs to be generated only in the case when
+# the bootloaders are not capable of populating a menu entry from the BLS fragments.
+if [[ $RUN_MKCONFIG != "true" ]]; then
     exit 0
 fi
 
@@ -17,7 +37,7 @@ COMMAND="$1"
 
 case "$COMMAND" in
     add|remove)
-        grub2-mkconfig -o /boot/grub2/grub.cfg >& /dev/null
+        grub2-mkconfig --no-grubenv-update -o /boot/grub2/grub.cfg >& /dev/null
         ;;
     *)
         ;;
diff --git a/grub.macros b/grub.macros
index 598f247f..1546fd66 100644
--- a/grub.macros
+++ b/grub.macros
@@ -532,7 +532,7 @@ touch ${RPM_BUILD_ROOT}/boot/%{name}/grub.cfg			\
 %dir %attr(0700,root,root)%{efi_esp_dir}/fonts			\
 %dir %attr(0700,root,root)/boot/loader/entries			\
 %ghost %config(noreplace) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg	\
-/boot/grub2/grubenv						\
+%config(noreplace) /boot/grub2/grubenv					\
 %ghost %config(noreplace) %attr(0700,root,root)%{efi_esp_dir}/grubenv	\
 %{expand:%if 0%{?without_efi_modules}				\
 %exclude %{_libdir}/grub/%{6}					\
diff --git a/grub.patches b/grub.patches
index 2c85d8d8..eaabcaeb 100644
--- a/grub.patches
+++ b/grub.patches
@@ -281,3 +281,20 @@ Patch0280: 0280-Try-to-set-fPIE-and-friends-on-libgnu.a.patch
 Patch0281: 0281-Don-t-make-grub_strtoull-print-an-error-if-no-conver.patch
 Patch0282: 0282-Set-blsdir-if-the-BLS-directory-path-isn-t-one-of-th.patch
 Patch0283: 0283-Check-if-blsdir-exists-before-attempting-to-get-it-s.patch
+Patch0284: 0284-blscfg-fallback-to-default_kernelopts-if-BLS-option-.patch
+Patch0285: 0285-grub-switch-to-blscfg-copy-increment.mod-for-legacy-.patch
+Patch0286: 0286-Only-set-blsdir-if-boot-loader-entries-is-in-a-btrfs.patch
+Patch0287: 0287-blscfg-don-t-use-grub_list_t-and-the-GRUB_AS_LIST-ma.patch
+Patch0288: 0288-10_linux_bls-don-t-add-users-option-to-generated-men.patch
+Patch0289: 0289-grub.d-Split-out-boot-success-reset-from-menu-auto-h.patch
+Patch0290: 0290-HTTP-boot-strncmp-returns-0-on-equal.patch
+Patch0291: 0291-Add-10_reset_boot_success-to-Makefile.patch
+Patch0292: 0292-blscfg-remove-BLS-file-size-check.patch
+Patch0293: 0293-Remove-bogus-load_env-after-blscfg-command-in-10_lin.patch
+Patch0294: 0294-blscfg-Don-t-leave-grub_errno-set-to-an-error-if-the.patch
+Patch0295: 0295-blscfg-Fix-typo-for-gfxpayload-variable-name.patch
+Patch0296: 0296-grub-set-bootflag-Update-comment-about-running-as-ro.patch
+Patch0297: 0297-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch
+Patch0298: 0298-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch
+Patch0299: 0299-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch
+Patch0300: 0300-Fix-savedefault-with-blscfg.patch
diff --git a/grub2.spec b/grub2.spec
index d0186f9b..46264146 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -7,7 +7,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.02
-Release:	70%{?dist}
+Release:	88%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -215,8 +215,6 @@ install -d -m 0755 %{buildroot}%{_prefix}/lib/kernel/install.d/
 install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE9}
 install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE13}
 install -d -m 0755 %{buildroot}%{_sysconfdir}/kernel/install.d/
-install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/20-grubby.install
-install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/90-loaderentry.install
 # Install systemd user service to set the boot_success flag
 install -D -m 0755 -t %{buildroot}%{_userunitdir} \
 	docs/grub-boot-success.{timer,service}
@@ -278,6 +276,13 @@ elif [ -f /etc/grub.d/01_users ] && \
     fi
 fi
 
+%posttrans tools
+
+if [ -f /etc/default/grub ]; then
+    ! grep -q '^GRUB_ENABLE_BLSCFG=.*' /etc/default/grub && \
+      /sbin/grub2-switch-to-blscfg --backup-suffix=.rpmsave &>/dev/null || :
+fi
+
 %triggerun -- grub2 < 1:1.99-4
 # grub2 < 1.99-4 removed a number of essential files in postun. To fix upgrades
 # from the affected grub2 packages, we first back up the files in triggerun and
@@ -310,8 +315,6 @@ rm -r /boot/grub2.tmp/ || :
 %exclude %{_datarootdir}/grub/themes/*
 %attr(0700,root,root) %dir %{_sysconfdir}/grub.d
 %{_prefix}/lib/kernel/install.d/20-grub.install
-%{_sysconfdir}/kernel/install.d/20-grubby.install
-%{_sysconfdir}/kernel/install.d/90-loaderentry.install
 %{_prefix}/lib/kernel/install.d/99-grub-mkconfig.install
 %dir %{_datarootdir}/grub
 %exclude %{_datarootdir}/grub/*
@@ -473,6 +476,94 @@ rm -r /boot/grub2.tmp/ || :
 %endif
 
 %changelog
+* Mon Jan 13 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-88
+- 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set kernelopts
+- Make the blscfg module honour the GRUB_SAVEDEFAULT option
+  Resolves: rhbz#1704926
+
+* Thu Dec 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-87
+- Drop patch fixing a corner case in BLS variable expansion
+  Related: rhbz#1779611
+
+* Wed Nov 27 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-86
+- blscfg: add a space char when appending fields for variable expansion
+- grub.d: Fix boot_indeterminate getting set on boot_success=0 boot
+
+* Tue Nov 26 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-85
+- grub-set-bootflag: Write new env to tmpfile and then rename (hdegoede)
+  Resolves: CVE-2019-14865
+  Resolves: rhbz#1776580
+
+* Wed Oct 16 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-84
+- 99-grub-mkconfig: Also disable BLS usage for Xen Dom0 hosts
+  Resolves: rhbz#1761799
+- blscfg: Fix typo for gfxpayload variable name
+  Resolves: rhbz#1706489
+
+* Thu Oct 10 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-83
+- 99-grub-mkconfig: Fix script condition to exit and remove ppc64 BE check
+  Related: rhbz#1703700
+
+* Wed Oct 09 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-82
+- 99-grub-mkconfig: Disable BLS usage for Xen DomU guests
+  Resolves: rhbz#1703700
+
+* Mon May 20 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-81
+- Don't try to switch to a BLS config if GRUB_ENABLE_BLSCFG is already set
+
+* Wed May 15 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-80
+- Fix error messages wrongly being printed when executing blscfg command
+  Resolves: rhbz#1699761
+- Remove bogus load_env after blscfg command in 10_linux
+
+* Tue May 07 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-79
+- Make blscfg module compatible at least up to the Fedora 19 GRUB core
+  Related: rhbz#1652806
+
+* Thu Apr 18 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-78
+- Add 10_reset_boot_success to Makefile
+  Related: rhbz#1701003
+
+* Thu Apr 18 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-77
+- grub.d: Split out boot success reset from menu auto hide script (lorbus)
+  Resolves: rhbz#1701003
+- HTTP boot: strncmp returns 0 on equal (stephen)
+
+* Mon Apr 15 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-76
+- Execute grub2-switch-to-blscfg script in %%posttrans instead of %%post
+  Resolves: rhbz#1652806
+
+* Thu Mar 28 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-75
+- 10_linux_bls: don't add --users option to generated menu entries
+  Resolves: rhbz#1693515
+
+* Fri Mar 22 2019 Javier Martinez Canillas <javierm@redhat.com> 2.02-74
+- Only set blsdir if /boot/loader/entries is in a btrfs or zfs partition
+  Related: rhbz#1688453
+- Fix some BLS snippets not being displayed in the GRUB menu
+  Resolves: rhbz#1691232
+
+* Tue Mar 12 2019 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.02-73
+- Never remove boot loader configuration for other boot loaders from the ESP.
+  This would render machines with sd-boot unbootable (#1648907).
+- Do not mask systemd's kernel-install scriptlets.
+
+* Mon Mar 11 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-72
+- Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
+  Resolves: rhbz#1687323
+- Switch to BLS in tools package %%post scriptlet
+  Resolves: rhbz#1652806
+
+* Wed Feb 27 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-71
+- 20-grub-install: Replace, rather than overwrite, the existing kernel (pjones)
+  Resolves: rhbz#1642402
+- 99-grub-mkconfig: Don't update grubenv generating entries on ppc64le
+  Related: rhbz#1637875
+- blscfg: fallback to default_kernelopts if BLS option field isn't set
+  Related: rhbz#1625124
+- grub-switch-to-blscfg: copy increment.mod for legacy BIOS and ppc64
+  Resolves: rhbz#1652806
+
 * Fri Feb 15 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-70
 - Check if blsdir exists before attempting to get it's real path
   Resolves: rhbz#1677415