SECURITY: Update security team members names/fingerprints

Daniel has stepped down [1] whereas Marta and Leo are joining the security team. [1] https://lists.gnu.org/archive/html/grub-devel/2026-02/msg00021.html Signed-off-by: Leo Sandoval <lsandova@redhat.com> Signed-off-by: Marta Lewandowska <mlewando@redhat.com> Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
MAINTAINERS: Update GRUB git repository and mailing list addresses
2026-10-26 00:59:55 +00:00 · 2026-03-13 18:15:37 +01:00 · 2026-03-13 18:14:10 +01:00 · 2026-03-13 18:13:48 +01:00 · 2026-03-05 15:08:00 +01:00 · 2026-03-05 15:03:57 +01:00
121 changed files with 1263 additions and 347 deletions
@@ -238,7 +238,8 @@ widthspec.bin
 /lzocompress_test
 /luks1_test
 /luks2_test
-/m4/
+/m4/*
+!/m4/ax_check_link_flag.m4
 /minixfs_test
 /missing
 /netboot_test
@@ -249,8 +250,6 @@ widthspec.bin
 /pata_test
 /po/*.gmo
 /po/*.mo
-/po/*.po
-/po/LINGUAS
 /po/Makefile.in.in
 /po/Makevars
 /po/Makevars.template
@@ -283,3 +282,4 @@ widthspec.bin
 /xfs_test
 /xzcompress_test
 /zfs_test
+/zfs_zstd_test
@@ -25,6 +25,7 @@ configuring the GRUB.
 * Flex 2.5.35 or later
 * pkg-config
 * GNU patch
+* wget (for downloading updated translations)
 * Other standard GNU/Unix tools
 * a libc with large file support (e.g. glibc 2.1 or later)

@@ -66,7 +67,7 @@ More cross compiling toolchains can be found at the following trusted sites:
 * https://mirrors.kernel.org/pub/tools/crosstool/
 * https://toolchains.bootlin.com/

-Prerequisites for make-check:
+Prerequisites for running make-check successfully:

 * qemu, specifically the binary "qemu-system-ARCH" where ARCH is the
  architecture GRUB has been built for; the "qemu-system" package on Debian
@@ -86,6 +87,8 @@ Prerequisites for make-check:
    reiserfs, udf, xfs
  - On newer kernels, the exfat kernel modules may be used instead of the
    exfat FUSE filesystem
+  - Kernel version 6.12.x was the last series to include reiserfs support,
+    so later kernels will fail the reiser filesystem test.
 * The following are Debian named packages required mostly for the full
  suite of filesystem testing (but some are needed by other tests as well):
  - btrfs-progs, dosfstools, e2fsprogs, erofs-utils, exfatprogs, exfat-fuse,
@@ -96,8 +99,8 @@ Prerequisites for make-check:
  - attr, cpio, g++, gawk, parted, recode, tar, util-linux

 Note that `make check' will run and many tests may complete successfully
-with only a subset of these prerequisites. However, some tests may be
-skipped or fail due to missing prerequisites.
+with only a subset of these prerequisites. However, some tests may fail
+due to missing prerequisites.

 To build the documentation you'll need:
 * texinfo, for the info and html documentation
@@ -140,15 +143,12 @@ The simplest way to compile this package is:

  1. `cd' to the directory containing the package's source code.

-  2. Skip this and following step if you use release tarball and proceed to
-     step 4. If you want translations type `./linguas.sh'.
+  2. Type `./bootstrap'.

-  3. Type `./bootstrap'.
+     The autogen.sh (called by bootstrap) uses python. By default it is
+     autodetected, but it can be overridden by setting the PYTHON variable.

-     The autogen.sh (called by bootstrap) uses python. By default autodetect
-     it, but it can be overridden by setting the PYTHON variable.
-
-  4. Type `./configure' to configure the package for your system.
+  3. Type `./configure' to configure the package for your system.
     If you're using `csh' on an old version of System V, you might
     need to type `sh ./configure' instead to prevent `csh' from trying
     to execute `configure' itself.
@@ -156,19 +156,19 @@ The simplest way to compile this package is:
     Running `configure' takes awhile.  While running, it prints some
     messages telling which features it is checking for.

-  6. Type `make' to compile the package.
+  4. Type `make' to compile the package.

-  7. Optionally, type `make check' to run any self-tests that come with
-     the package. Note that many of the tests require root privileges in
-     order to run.
+  5. Optionally, type `make check' to run any self-tests that come with
+     the package. Note that many of the tests require root privileges and
+     a specially crafted environment in order to run.

-  8. Type `make install' to install the programs and any data files and
+  6. Type `make install' to install the programs and any data files and
     documentation.

-  9. Type `make html' or `make pdf' to generate the html or pdf
+  7. Type `make html' or `make pdf' to generate the html or pdf
     documentation.  Note, these are not built by default.

- 10. You can remove the program binaries and object files from the
+  8. You can remove the program binaries and object files from the
     source code directory by typing `make clean'.  To also remove the
     files that `configure' created (so you can compile the package for
     a different kind of computer), type `make distclean'.  There is
@@ -2,7 +2,8 @@ List of current GRUB maintainers and some basic information about the project
 =============================================================================

 Here is the list of current GRUB maintainers:
-  - Daniel Kiper <daniel.kiper@oracle.com> and <dkiper@net-space.pl>,
+  - Leo Sandoval <lsandova@redhat.com>,
+  - Marta Lewandowska <mlewando@redhat.com>,
  - Alex Burmashev <alexander.burmashev@oracle.com>,
  - Vladimir 'phcoder' Serbinenko <phcoder@gmail.com>.

@@ -13,10 +14,9 @@ file to get more information how to properly report this kind of bugs to
 the maintainers.

 The GRUB development happens on the grub-devel mailing list [1]. The latest
-GRUB source code is available at Savannah git repository [2].
-
-Users can ask for help on the help-grub mailing list [3].
+GRUB source code is available at freedesktop git repository [2].

+Users can also ask for help on the same grub-devel mailing list [1].

 List of past GRUB maintainers and people who strongly contributed to the project
 ================================================================================
@@ -25,11 +25,11 @@ Here is the list, sorted alphabetically, of past GRUB maintainers and people who
 strongly contributed to the project:
  - Andrei Borzenkov,
  - Bryan Ford,
+  - Daniel Kiper,
  - Erich Stefan Boleyn,
  - Gordon Matzigkeit,
  - Yoshinori K. Okuji.


-[1] https://lists.gnu.org/mailman/listinfo/grub-devel
-[2] https://git.savannah.gnu.org/gitweb/?p=grub.git&view=view+git+repository
-[3] https://lists.gnu.org/mailman/listinfo/help-grub
+[1] https://lists.freedesktop.org/postorius/lists/grub-devel.lists.freedesktop.org/
+[2] https://gitlab.freedesktop.org/gnu-grub/grub/
@@ -914,6 +914,12 @@ script = {
  common = tests/zfs_test.in;
 };

+script = {
+  testcase = native;
+  name = zfs_zstd_test;
+  common = tests/zfs_zstd_test.in;
+};
+
 script = {
  testcase = native;
  name = cpio_test;
@@ -1288,13 +1294,13 @@ script = {
 };

 script = {
-  testcase = native;
+  testcase = nonnative;
  name = asn1_test;
  common = tests/asn1_test.in;
 };

 script = {
-  testcase = native;
+  testcase = nonnative;
  name = tpm2_key_protector_test;
  common = tests/tpm2_key_protector_test.in;
 };
@@ -1,3 +1,26 @@
+New in 2.14:
+
+* libgcrypt 1.11.
+* LVM LV integrity and cachevol support.
+* EROFS support.
+* GRUB environment block inside the Btrfs header support.
+* NX support for EFI platforms.
+* shim loader protocol support.
+* BLS and UKI support.
+* Argon2 KDF support.
+* TPM2 key protector support.
+* Appended Signature Secure Boot Support for PowerPC.
+* New option to block command line interface.
+* Support dates outside of 1901..2038 range.
+* zstdio decompression support.
+* EFI code improvements and fixes.
+* TPM driver fixes.
+* Filesystems fixes.
+* CVE and Coverity fixes.
+* Tests improvements.
+* Documentation improvements.
+* ... and tons of other fixes and cleanups...
+
 New in 2.12:

 * GCC 13 support.
@@ -49,9 +49,11 @@ on each step of the process.

 While there's currently no bug bounty program we appreciate every report.

-* Contact: Daniel Kiper <daniel.kiper@oracle.com> and
-           Daniel Kiper <dkiper@net-space.pl>
-* PGP Key Fingerprint: BE5C 2320 9ACD DACE B20D  B0A2 8C81 89F1 988C 2166
+* Contact: Marta Lewandowska <mlewando@redhat.com>
+* PGP Key Fingerprint: 5B21 5739 7348 6620 C0FF  7073 DDF0 92F7 4C8F 619B
+
+* Contact: Leonardo Sandoval Gonzalez <lsandova@redhat.com>
+* PGP Key Fingerprint: DFB6 2CC1 A987 E6C7 6EBF  8143 916E C070 8CDF DDFD

 * Contact: Alex Burmashev <alexander.burmashev@oracle.com>
 * PGP Key Fingerprint: 50A4 EC06 EF7E B84D 67E0  3BB6 2AE2 C87E 28EF 2E6E
@@ -93,7 +93,18 @@ else
 fi
 grub_cv_prog_objcopy_absolute=yes
 for link_addr in 0x2000 0x8000 0x7C00; do
-  if AC_TRY_COMMAND([${CC-cc} ${TARGET_CFLAGS} ${TARGET_LDFLAGS} -nostdlib ${TARGET_IMG_LDFLAGS_AC} ${TARGET_IMG_BASE_LDOPT},$link_addr conftest.o -o conftest.exec]); then :
+
+  target_img_base_ld="${TARGET_IMG_BASE_LDOPT}"
+  case "$target_img_base_ld" in
+    *_grub_text_base)
+      target_img_base_ld="${target_img_base_ld}=$link_addr"
+    ;;
+    *)
+      target_img_base_ld="${target_img_base_ld},$link_addr"
+    ;;
+  esac
+
+  if AC_TRY_COMMAND([${CC-cc} ${TARGET_CFLAGS} ${TARGET_LDFLAGS} -nostdlib ${TARGET_IMG_LDFLAGS_AC} ${target_img_base_ld} conftest.o -o conftest.exec]); then :
  else
    AC_MSG_ERROR([${CC-cc} cannot link at address $link_addr])
  fi
@@ -63,8 +63,6 @@ checkout_only_file=
 copy=true
 vc_ignore=

-SKIP_PO=t
-
 # Build prerequisites
 buildreq="\
 autoconf   2.64
@@ -108,4 +106,23 @@ bootstrap_post_import_hook () {

 bootstrap_epilogue () {
  mv INSTALL.grub INSTALL
+
+  if [ "x$SKIP_PO" = "x" ]; then
+    # Generate LINGUAS with all supported languages. Bootstrap will
+    # generate a LINGUAS, but it will not contain the autogenerated
+    # languages.
+    autogenerated="en@quot en@hebrew de@hebrew en@cyrillic en@greek en@arabic en@piglatin de_CH"
+
+    {
+      # NOTE: xargs has no POSIX compliant way to avoid running the program
+      # given as an argument when there are no input lines. So ensure that
+      # basename is always run with at least one argument, the empty string,
+      # and ignore the first line of output.
+      ls po/*.po | xargs -L 100 basename -s .po -a "" | tail -n +2
+      for x in $autogenerated; do
+        rm -f "po/$x.po"
+        echo "$x"
+      done
+    } | sort | uniq | xargs >po/LINGUAS
+  fi
 }
@@ -16,7 +16,8 @@ EXTRA_DIST += docs/autoiso.cfg
 EXTRA_DIST += docs/grub.cfg
 EXTRA_DIST += docs/osdetect.cfg

-EXTRA_DIST += conf/i386-cygwin-img-ld.sc
+EXTRA_DIST += conf/i386-cygwin-img.lds
+EXTRA_DIST += conf/i386-pc-kernel.lds

 EXTRA_DIST += grub-core/Makefile.core.def
 EXTRA_DIST += grub-core/Makefile.gcry.def
@@ -72,6 +73,7 @@ EXTRA_DIST += grub-core/lib/libtasn1
 EXTRA_DIST += $(shell find $(top_srcdir)/include -name '*.h')
 EXTRA_DIST += $(shell find $(top_srcdir)/grub-core/lib -name '*.h')
 EXTRA_DIST += grub-core/efiemu/runtime/config.h
+EXTRA_DIST += grub-core/tests/crypto_cipher_mode_vectors.h
 EXTRA_DIST += grub-core/tests/asn1/asn1_test.h
 EXTRA_DIST += $(shell find $(top_srcdir)/grub-core/tests/asn1/tests -name '*.h')
 EXTRA_DIST += $(shell find $(top_srcdir)/grub-core/commands/tpm2_key_protector -name '*.h')
@@ -2,6 +2,7 @@

 SECTIONS
 {
+  . = _grub_text_base;
  .text :
  {
    start = . ;
@@ -0,0 +1,51 @@
+ENTRY(_start)
+
+/*
+ * Align sections to a 16-byte boundary. This guarantees ABI compatibility with
+ * C generated code.
+ */
+SECTION_ALIGN = 0x10;
+
+PHDRS {
+    text PT_LOAD FLAGS(7) /* PF_R | PF_W | PF_X */;
+}
+
+SECTIONS
+{
+    /*
+     * Set section alignment to 1. This allows sections to be aligned without
+     * creating holes in the VMA space or gaps in the file.
+     */
+    . = _grub_text_base;
+    .text ALIGN(0x1) : {
+        _start = .;
+        *(.text .text.*)
+        . = ALIGN(SECTION_ALIGN);
+    } :text
+    .rodata ALIGN(0x1) : {
+        *(.rodata .rodata.*)
+        . = ALIGN(SECTION_ALIGN);
+    } :text
+    .module_license ALIGN(0x1) : {
+        *(.module_license)
+        . = ALIGN(SECTION_ALIGN);
+    } :text
+    .data ALIGN(0x1) : {
+        *(.data .data.*)
+        . = ALIGN(SECTION_ALIGN);
+        _edata = .;
+    } :text
+    .bss ALIGN(0x1) : {
+        __bss_start = .;
+        *(.bss .bss.*)
+        *(COMMON)
+        . = ALIGN(SECTION_ALIGN);
+        _end = .;
+    } :text
+    /DISCARD/ : {
+        *(.interp)
+        *(.note*)
+        *(.comment)
+        *(.build-id)
+    }
+}
@@ -34,7 +34,7 @@ dnl "TARGET_" (such as TARGET_CC, TARGET_CFLAGS, etc.) are used for
 dnl the target type. See INSTALL for full list of variables and
 dnl description of the relationships between them.

-AC_INIT([GRUB],[2.14~rc1],[bug-grub@gnu.org])
+AC_INIT([GRUB],[2.15],[bug-grub@gnu.org])

 AS_CASE(["$ERROR_PLATFORM_NOT_SUPPORT_SSP"],
  [n | no | nO | N | No | NO], [ERROR_PLATFORM_NOT_SUPPORT_SSP=no],
@@ -1150,7 +1150,7 @@ fi

 # Implementation of the --disable-amd64-as-feature-detection switch.
 AC_MSG_CHECKING([whether to enable AMD64 as(1) feature detection])
-if test x$target_cpu == xx86_64 -a x$platform == xefi; then
+if test x$target_cpu = xx86_64 -a x$platform = xefi; then
  CPPFLAGS_GCRY_ASM="-D__x86_64 -DHAVE_CPU_ARCH_X86"
  AC_ARG_ENABLE(amd64-as-feature-detection,
    AS_HELP_STRING([--disable-amd64-as-feature-detection],
@@ -1454,14 +1454,16 @@ if test x$grub_cv_target_cc_link_format = x-arch,i386 || test x$grub_cv_target_c
   TARGET_IMG_LDFLAGS='-nostdlib -static -Wl,-preload -Wl,-segalign,20'
   TARGET_IMG_LDFLAGS_AC='-nostdlib -static -Wl,-preload -Wl,-segalign,20'
   TARGET_IMG_BASE_LDOPT="-Wl,-image_base"
+   TARGET_IMG_BASE_LDOPT_ARG_SEP=","
   TARGET_LDFLAGS_OLDMAGIC=""
 elif test x$grub_cv_target_cc_link_format = x-mi386pe || test x$grub_cv_target_cc_link_format = x-mi386pep ; then
  TARGET_APPLE_LINKER=0
  TARGET_LDFLAGS_OLDMAGIC="-Wl,-N"
-  TARGET_IMG_LDSCRIPT='$(top_srcdir)'"/conf/i386-cygwin-img-ld.sc"
+  TARGET_IMG_LDSCRIPT='$(top_srcdir)'"/conf/i386-cygwin-img.lds"
  TARGET_IMG_LDFLAGS="-Wl,-T${TARGET_IMG_LDSCRIPT}"
-  TARGET_IMG_LDFLAGS_AC="-Wl,-T${srcdir}/conf/i386-cygwin-img-ld.sc"
-  TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"
+  TARGET_IMG_LDFLAGS_AC="-Wl,-T${srcdir}/conf/i386-cygwin-img.lds"
+  TARGET_IMG_BASE_LDOPT="-Wl,--defsym=_grub_text_base"
+  TARGET_IMG_BASE_LDOPT_ARG_SEP="="
  TARGET_IMG_CFLAGS=
 else
  TARGET_APPLE_LINKER=0
@@ -1469,7 +1471,27 @@ else
  TARGET_IMG_LDSCRIPT=
  TARGET_IMG_LDFLAGS='-Wl,-N'
  TARGET_IMG_LDFLAGS_AC='-Wl,-N'
-  TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"
+  if test "x$target_cpu-$platform" != "xi386-pc"; then
+    AX_CHECK_LINK_FLAG([-Wl,--image-base,0],
+        [TARGET_IMG_BASE_LDOPT="-Wl,--image-base,0 -Wl,-Ttext"],
+        [TARGET_IMG_BASE_LDOPT="-Wl,-Ttext"],
+        [],
+        [AC_LANG_SOURCE([
+    asm (".globl start; start:");
+    asm (".globl _start; _start:");
+    asm (".globl __start; __start:");
+    void __main (void);
+    void __main (void) {}
+    int main (void);
+        ])])
+    TARGET_IMG_BASE_LDOPT_ARG_SEP=","
+  else
+    TARGET_IMG_BASE_LDOPT="-Wl,--defsym=_grub_text_base"
+    TARGET_IMG_BASE_LDOPT_ARG_SEP="="
+    TARGET_IMG_LDSCRIPT='$(top_srcdir)'"/conf/i386-pc-kernel.lds"
+    TARGET_IMG_LDFLAGS="${TARGET_IMG_LDFLAGS} -Wl,-T${TARGET_IMG_LDSCRIPT}"
+    TARGET_IMG_LDFLAGS_AC="-Wl,-T${srcdir}/conf/i386-pc-kernel.lds"
+  fi
  TARGET_IMG_CFLAGS=
 fi

@@ -1545,21 +1567,6 @@ AC_SUBST(TARGET_LDFLAGS_OLDMAGIC)

 LDFLAGS="$TARGET_LDFLAGS"

-if test "$target_cpu" = x86_64 || test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64 ; then
-  # Use large model to support 4G memory
-  AC_CACHE_CHECK([whether option -mcmodel=large works], grub_cv_cc_mcmodel, [
-    CFLAGS="$TARGET_CFLAGS -mcmodel=large"
-    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
-		      [grub_cv_cc_mcmodel=yes],
-		      [grub_cv_cc_mcmodel=no])
-  ])
-  if test "x$grub_cv_cc_mcmodel" = xyes; then
-    TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=large"
-  elif test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64; then
-    TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=medany"
-  fi
-fi
-
 if test "$target_cpu"-"$platform" = x86_64-efi; then
  # EFI writes to stack below %rsp, we must not use the red zone
  AC_CACHE_CHECK([whether option -mno-red-zone works], grub_cv_cc_no_red_zone, [
@@ -1668,6 +1675,21 @@ fi]

 CFLAGS="$TARGET_CFLAGS"

+if test "$target_cpu" = x86_64 || test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64 ; then
+  # Use large model to support 4G memory
+  AC_CACHE_CHECK([whether option -mcmodel=large works], grub_cv_cc_mcmodel, [
+    CFLAGS="$TARGET_CFLAGS -mcmodel=large"
+    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
+		      [grub_cv_cc_mcmodel=yes],
+		      [grub_cv_cc_mcmodel=no])
+  ])
+  if test "x$grub_cv_cc_mcmodel" = xyes; then
+    TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=large"
+  elif test "$target_cpu" = sparc64 || test "$target_cpu" = riscv64; then
+    TARGET_CFLAGS="$TARGET_CFLAGS -mcmodel=medany"
+  fi
+fi
+
 # Stack smashing protector.
 grub_CHECK_STACK_PROTECTOR
 AC_ARG_ENABLE([stack-protector],
@@ -1802,7 +1824,18 @@ if test "x$target_cpu" = xi386; then
  if test "$platform" != emu && test "x$TARGET_APPLE_LINKER" != x1 ; then
    if test ! -z "$TARGET_IMG_LDSCRIPT"; then
      # Check symbols provided by linker script.
-      CFLAGS="$TARGET_CFLAGS -nostdlib ${TARGET_IMG_LDFLAGS_AC} ${TARGET_IMG_BASE_LDOPT},0x8000"
+      target_img_base_ld="${TARGET_IMG_BASE_LDOPT}"
+      case "$target_img_base_ld" in
+        *_grub_text_base)
+          target_img_base_ld="${target_img_base_ld}="
+        ;;
+        *)
+          target_img_base_ld="${target_img_base_ld},"
+        ;;
+      esac
+      target_img_base_ld="${target_img_base_ld}0x8000"
+      CFLAGS="$TARGET_CFLAGS -nostdlib ${TARGET_IMG_LDFLAGS_AC} ${target_img_base_ld}"
+      target_img_base_ld=""
    fi
    grub_CHECK_BSS_START_SYMBOL
    grub_CHECK_END_SYMBOL
@@ -2404,6 +2437,7 @@ AC_SUBST(TARGET_CCASFLAGS)
 AC_SUBST(TARGET_IMG_LDFLAGS)
 AC_SUBST(TARGET_IMG_CFLAGS)
 AC_SUBST(TARGET_IMG_BASE_LDOPT)
+AC_SUBST(TARGET_IMG_BASE_LDOPT_ARG_SEP)
 AC_SUBST(TARGET_APPLE_LINKER)

 AC_SUBST(HOST_CFLAGS)
@@ -77,7 +77,7 @@ This edition documents version @value{VERSION}.
 * Coding style::
 * Finding your way around::
 * Contributing Changes::
-* Setting up and running test suite::
+* Tests::
 * Updating External Code::
 * Debugging::
 * Porting::
@@ -485,8 +485,17 @@ If your intention is to just get started, please do not submit a inclusion
 request. Instead, please subscribe to the mailing list, and communicate first
 (e.g. sending a patch, asking a question, commenting on another message...).

+@node Tests
+@chapter Tests
+
+@menu
+* Setting up and running test suite::
+* Writing new tests::
+@end menu
+
+
@node Setting up and running test suite
-@chapter Setting up and running test suite
+@section Setting up and running test suite

 GRUB is basically a tiny operating system with read support for many file
 systems and which has been ported to a variety of architectures. As such, its
@@ -495,6 +504,47 @@ These dependencies are currently documented in the
@uref{https://git.savannah.gnu.org/cgit/grub.git/tree/INSTALL, INSTALL}
 file in the source repository. Once installed, the test suite can be started
 by running the @command{make check} command from the GRUB build directory.
+To properly run all the tests, the test suite must be run as the privileged
+user, for instance to run the filesystem tests, which require mounting
+filesystem images. Of course, virtualization or containers may be used, but
+this requires extra configuration outside the scope of this document.
+
+@node Writing new tests
+@section Writing new tests
+
+There are two kinds of tests in the GRUB test suite: native and non-native.
+Native tests are those which run on the build architecture and non-native
+run on the target architecture. The non-native tests are run in a QEMU
+virtual machine using the grub-shell script in tests/util. When writing a
+new test, first determine if it should run on the host or the target and
+then look at the existing tests as examples of how to they should be written.
+
+The GRUB test suite uses automake (@uref{https://www.gnu.org/software/automake/manual/automake.html#Tests, see documention here}). One thing of importance
+to note is that tests have 4 classes of return codes: SKIP (77), HARD ERROR
+(99), PASS (0), and FAIL (all other codes). A
+@uref{https://www.gnu.org/software/automake/manual/automake.html#index-test-skip, SKIP return code}
+should be returned when this test cannot be performed and thus should be
+skipped. Typically this is because the target does not support the test,
+such as the ohci USB test for the powerpc-ieee1275 target because there
+are no native drivers for that target. A
+@uref{https://www.gnu.org/software/automake/manual/automake.html#index-Distinction-between-errors-and-failures-in-testsuites, HARD ERROR return code}
+should be returned when a failure in something other than what is intended
+to be tested happens. This is commonly returned when the test cannot be
+properly run because of deficiencies in the test environment, eg. when
+testing the xfs filesystem, but the kernel has no support for mounting xfs
+volumes. A SKIP should never be returned for a HARD ERROR condition
+because at best the person running the test does not know if the test was
+skipped because it doesn't apply to the target or because the tester failed
+to setup the environment properly. At worst, the tester will believe that
+everything is okay without realizing that the tests are not covering all
+the code that it should.
+
+Keep portability in mind while creating a new tests so that the tests can be
+run on a variety of systems and shells. Do not use bashisms. Also try to avoid
+using utilities that would unecessarily add software dependencies. Sometimes
+this is unavoidable. Copy or adapt existing test implementations where feasible.
+If the test is native and requires root, make sure to check that the test is
+run with the root user and return HARD ERROR if it is not.

@node Updating External Code
@chapter Updating external code
@@ -900,26 +950,26 @@ is to be run in a GDB session running with the @file{gdb_grub} GDB script.
@node Porting
@chapter Porting

-GRUB2 is designed to be easily portable accross platforms. But because of the
+GRUB2 is designed to be easily portable across platforms. But because of the
 nature of bootloader every new port must be done separately. Here is how I did
-MIPS (loongson and ARC) and Xen ports. Note than this is more of suggestions,
-not absolute truth.
+MIPS (loongson and ARC) and Xen ports. Note that this is more of a suggestion,
+and not absolute truth.

-First of all grab any architecture specifications you can find in public
-(please avoid NDA).
+First of all, grab any architecture specifications you can find in the public
+domain (please avoid NDA).

 First stage is ``Hello world''. I've done it outside of GRUB for simplicity.
 Your task is to have a small program which is loadable as bootloader and
-clearly shows its presence to you. If you have easily accessible console
-you can just print a message. If you have a mapped framebuffer you know address
+clearly shows its presence to you. If you have an easily accessible console
+you can just print a message. If you have a mapped framebuffer you know the address
 of, you can draw a square. If you have a debug facility, just hanging without
-crashing might be enough. For the first stage you can choose to load the
-bootloader across the network since format for network image is often easier
+crashing might be enough. For the first stage, you can choose to load the
+bootloader across the network since the format for a network image is often easier
 than for local boot and it skips the need of small intermediary stages and
-nvram handling. Additionally you can often have a good idea of the needed
-format by running ``file'' on any netbootable executable for given platform.
+nvram handling. Additionally, you can often have a good idea of the needed
+format by running ``file'' on any netbootable executable for the given platform.

-This program should probably have 2 parts: an assembler and C one. Assembler one
+This program should probably have 2 parts: an assembler and C one. The assembler one
 handles BSS cleaning and other needed setup (on some platforms you may need
 to switch modes or copy the executable to its definitive position). So your code
 may look like (x86 assembly for illustration purposes)
@@ -961,12 +1011,12 @@ Sometimes you need a third file: assembly stubs for ABI-compatibility.

 Once this file is functional it's time to move it into GRUB2. The startup
 assembly file goes to grub-core/kern/$cpu/$platform/startup.S. You should also
-include grub/symbol.h and replace call to entry point with call to
+include grub/symbol.h and replace the call to entry point with call to
 EXT_C(grub_main). The C file goes to grub-core/kern/$cpu/$platform/init.c
 and its entry point is renamed to void grub_machine_init (void). Keep final
-infinite loop for now. Stubs file if any goes to
+infinite loop for now. Stub files if any goes to
 grub-core/kern/$cpu/$platform/callwrap.S. Sometimes either $cpu or $platform
-is dropped if file is used on several cpus respectivelyplatforms.
+is dropped if file is used on several cpus respectively or platforms.
 Check those locations if they already have what you're looking for.

 Then modify in configure.ac the following parts:
@@ -984,10 +1034,10 @@ esac
@end example

 Sometimes CPU have additional architecture names which don't influence booting.
-You might want to have some canonical name to avoid having bunch of identical
+You might want to have some canonical name to avoid having a bunch of identical
 platforms with different names.

-NOTE: it doesn't influence compile optimisations which depend solely on
+NOTE: It doesn't influence compile optimisations which depend solely on
 chosen compiler and compile options.

@example
@@ -1049,7 +1099,7 @@ AM_CONDITIONAL([COND_powerpc_ieee1275], [test x$target_cpu = xpowerpc -a x$platf
@end example

 Next stop is gentpl.py. You need to add your platform to the list of supported
-ones (sorry that this list is duplicated):
+ones (unfortunately, this list is duplicated):

@example
 GRUB_PLATFORMS = [ "emu", "i386_pc", "i386_efi", "i386_qemu", "i386_coreboot",
@@ -1059,21 +1109,21 @@ GRUB_PLATFORMS = [ "emu", "i386_pc", "i386_efi", "i386_qemu", "i386_coreboot",
                   "mips_qemu_mips", "s390_mainframe" ]
@end example

-You may also want already to add new platform to one or several of available
+Now you may also want to add a new platform to one or several of available
 groups. In particular we always have a group for each CPU even when only
 one platform for given CPU is available.

 Then comes grub-core/Makefile.core.def. In the block ``kernel'' you'll need
 to define ldflags for your platform ($cpu_$platform_ldflags). You also need to
-declare startup asm file ($cpu_$platform_startup) as well as any other files
-(e.g. init.c and callwrap.S) (e.g. $cpu_$platform = kern/$cpu/$platform/init.c).
-At this stage you will also need to add dummy dl.c and cache.S with functions
+declare a startup asm file ($cpu_$platform_startup) as well as any other files,
+like init.c or callwrap.S (e.g. $cpu_$platform = kern/$cpu/$platform/init.c).
+At this stage, you will also need to add a dummy dl.c and cache.S with functions
 grub_err_t grub_arch_dl_check_header (void *ehdr), grub_err_t
 grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr) (dl.c) and
 void grub_arch_sync_caches (void *address, grub_size_t len) (cache.S). They
 won't be used for now.

-You will need to create directory include/$cpu/$platform and a file
+You will need to create a directory include/$cpu/$platform and a file
 include/$cpu/types.h. The latter following this template:

@example
@@ -1097,7 +1147,7 @@ include/$cpu/types.h. The latter following this template:
 You will also need to add a dummy file to datetime and setjmp modules to
 avoid any of it having no files. It can be just completely empty at this stage.

-You'll need to make grub-mkimage.c (util/grub_mkimage.c) aware of the needed
+You'll need to make grub-mkimage (in util/grub_mkimage.c) aware of the needed
 format. For most commonly used formats like ELF, PE, aout or raw the support
 is already present and you'll need to make it follow the existant code paths
 for your platform adding adjustments if necessary. When done compile:
@@ -1108,47 +1158,47 @@ for your platform adding adjustments if necessary. When done compile:
 make > /dev/null
@end example

-And create image
+And create an image:

@example
 ./grub-mkimage -d grub-core -O $format_id -o test.img
@end example

-And it's time to test your test.img.
+And now it's time to test your test.img.

-If it works next stage is to have heap, console and timer.
+If it works, the next stage is to have a heap, console and timer.

 To have the heap working you need to determine which regions are suitable for
-heap usage, allocate them from firmware and map (if applicable). Then call
-grub_mm_init_region (void *start, grub_size_t s) for every of this region.
-As a shortcut for early port you can allocate right after _end or have
-a big static array for heap. If you do you'll probably need to come back to
+heap usage, allocate them from the firmware and map them, if applicable.
+Then call grub_mm_init_region (void *start, grub_size_t s) for each region.
+As a shortcut for an early port, you can allocate right after _end or have
+a big static array for heap. If you do, you'll probably need to come back to
 this later. As for output console you should distinguish between an array of
-text, terminfo or graphics-based console. Many of real-world examples don't
+text, terminfo or graphics-based console. Many real-world examples don't
 fit perfectly into any of these categories but one of the models is easier
-to be used as base. In second and third case you should add your platform to
+to be used as base. In the second and third case, you should add your platform to
 terminfokernel respectively videoinkernel group. A good example of array of
-text is i386-pc (kern/i386/pc/init.c and term/i386/pc/console.c).
-Of terminfo is ieee1275 (kern/ieee1275/init.c and term/ieee1275/console.c).
-Of video is loongson (kern/mips/loongson/init.c). Note that terminfo has
+text is i386-pc (kern/i386/pc/init.c and term/i386/pc/console.c),
+of terminfo is ieee1275 (kern/ieee1275/init.c and term/ieee1275/console.c),
+and of video is loongson (kern/mips/loongson/init.c). Note that terminfo has
 to be inited in 2 stages: one before (to get at least rudimentary console
 as early as possible) and another after the heap (to get full-featured console).
-For the input there are string of keys, terminfo and direct hardware. For string
-of keys look at i386-pc (same files), for terminfo ieee1275 (same files) and for
-hardware loongson (kern/mips/loongson/init.c and term/at_keyboard.c).
+For the input, there is a string of keys (eg. i386-pc, same files), terminfo
+(ieee1275, same files), and hardware (loongson, see kern/mips/loongson/init.c
+and term/at_keyboard.c).

-For the timer you'll need to call grub_install_get_time_ms (...) with as sole
-argument a function returning a grub_uint64_t of a number of milliseconds
+For the timer, you'll need to call grub_install_get_time_ms (...) with the
+sole argument a function returning a grub_uint64_t number of milliseconds
 elapsed since arbitrary point in the past.

-Once these steps accomplished you can remove the inifinite loop and you should
+Once these steps are accomplished, you can remove the inifinite loop and you should
 be able to get to the minimal console. Next step is to have module loading
-working. For this you'll need to fill kern/$cpu/dl.c and kern/$cpu/cache.S
+working. For this, you'll need to fill kern/$cpu/dl.c and kern/$cpu/cache.S
 with real handling of relocations and respectively the real sync of I and D
 caches. Also you'll need to decide where in the image to store the modules.
 Usual way is to have it concatenated at the end. In this case you'll need to
 modify startup.S to copy modules out of bss to let's say ALIGN_UP (_end, 8)
-before cleaning out bss. You'll probably find useful to add total_module_size
+before cleaning out bss. You'll probably find it useful to add total_module_size
 field to startup.S. In init.c you need to set grub_modbase to the address
 where modules can be found. You may need grub_modules_get_end () to avoid
 declaring the space occupied by modules as usable for heap. You can test modules
@@ -1164,9 +1214,9 @@ Once this works, you should think of implementing disk access. Look around
 disk/ for examples.

 Then, very importantly, you probably need to implement the actual loader
-(examples available in loader/)
+(examples available in loader/).

-Last step to have minimally usable port is to add support to grub-install to
+The last step to have a minimally usable port is to add support to grub-install to
 put GRUB in a place where firmware or platform will pick it up.

 Next steps are: filling datetime.c, setjmp.S, network (net/drivers),
@@ -1175,15 +1225,15 @@ video (video/), halt (lib/), reboot (lib/).
 Please add your platform to Platform limitations and Supported kernels chapter
 in user documentation and mention any steps you skipped which result in reduced
 features or performance. Here is the quick checklist of features. Some of them
-are less important than others and skipping them is completely ok, just needs
+are less important than others and skipping them is completely ok, it just needs
 to be mentioned in user documentation.

 Checklist:
@itemize
-@item Is heap big enough?
-@item Which charset is supported by console?
-@item Does platform have disk driver?
-@item Do you have network card support?
+@item Is the heap big enough?
+@item Which charset is supported by the console?
+@item Does the platform have disk driver?
+@item Is there network card support?
@item Are you able to retrieve datetime (with date)?
@item Are you able to set datetime (with date)?
@item Is serial supported?
@@ -1209,16 +1259,16 @@ GRUB?
@node Error Handling
@chapter Error Handling

-Error handling in GRUB 2 is based on exception handling model. As C language
+Error handling in GRUB 2 is based on exception handling model. As the C language
 doesn't directly support exceptions, exception handling behavior is emulated
 in software.

-When exception is raised, function must return to calling function. If calling
+When an exception is raised, the function must return to the calling function. If the calling
 function does not provide handling of the exception it must return back to its
-calling function and so on, until exception is handled. If exception is not
-handled before prompt is displayed, error message will be shown to user.
+calling function and so on, until the exception is handled. If the exception is not
+handled before a prompt is displayed, error message will be shown to user.

-Exception information is stored on @code{grub_errno} global variable. If
+Exception information is stored in the @code{grub_errno} global variable. If
@code{grub_errno} variable contains value @code{GRUB_ERR_NONE}, there is no active
 exception and application can continue normal processing. When @code{grub_errno} has
 other value, it is required that application code either handles this error or
@@ -1642,6 +1642,13 @@ This option is unset by default, and is deprecated in favour of the less
 confusing @samp{GRUB_TIMEOUT_STYLE=countdown} or
@samp{GRUB_TIMEOUT_STYLE=hidden}.

+@item GRUB_FORCE_EFI_ALL_VIDEO
+When set to true, this will allow grub-mkconfig to generate a GRUB config
+that supports loading the all_video module on the EFI platform instead of
+just the efi_gop and efi_uga modules.
+
+This option is unset by default.
+
@end table

 For more detailed customisation of @command{grub-mkconfig}'s output, you may
@@ -2943,7 +2950,7 @@ Heavily limited platforms:
 Lightly limited platforms:

@itemize
-@item *-xen: limited only by adress space and RAM size.
+@item *-xen: limited only by address space and RAM size.
@item i386-qemu: kernel.img (.text + .data + .bss) is limited by 392704 bytes.
                 (core.img would be limited by ROM size but it's unlimited on qemu
@item All EFI platforms: limited by contiguous RAM size and possibly firmware bugs
@@ -4071,6 +4078,7 @@ Modules can be loaded via the @command{insmod} (@pxref{insmod}) command.
 * cpio_be_module::
 * cpuid_module::
 * crc64_module::
+* crypto_cipher_mode_test_module::
 * crypto_module::
 * cryptodisk_module::
 * cs5536_module::
@@ -4603,6 +4611,10 @@ various CPU features. @xref{cpuid} for more information.
@section crc64
 This module provides support for the CRC64 operation.

+@node crypto_cipher_mode_test_module
+@section crypto_cipher_mode_test
+This module performs various cipher mode encryption/decryption tests
+
@node crypto_module
@section crypto
 This module provides library support for various base cryptography operations
@@ -9213,6 +9225,7 @@ environment variables and commands are listed in the same order.
 * TPM2 key protector::                 Managing disk key with TPM2 key protector
 * Signing certificate and hash files:: Certificate and hash file signing
 * Signing GRUB itself::                Ensuring the integrity of the GRUB core image
+* Hardening::                          Configuration and customization to maximize security
@end menu

@node Authentication and authorisation
@@ -10057,7 +10070,8 @@ loads GRUB to verify the integrity of the core image.
 This is ultimately platform-specific and individual platforms can define their
 own mechanisms. However, there are general-purpose mechanisms that can be used
 with GRUB.
-@section Signing GRUB for UEFI secure boot
+
+@subsection Signing GRUB for UEFI secure boot
 On UEFI platforms, @file{core.img} is a PE binary. Therefore, it can be signed
 with a tool such as @command{pesign} or @command{sbsign}. Refer to the
 suggestions in @pxref{UEFI secure boot and shim} to ensure that the final
@@ -10065,7 +10079,7 @@ image works under UEFI secure boot and can maintain the secure-boot chain. It
 will also be necessary to enroll the public key used into a relevant firmware
 key database.

-@section Signing GRUB with an appended signature
+@subsection Signing GRUB with an appended signature
 The @file{core.elf} itself can be signed with a Linux kernel module-style
 appended signature (@pxref{Using appended signatures}).
 To support IEEE1275 platforms where the boot image is often loaded directly
@@ -10160,6 +10174,50 @@ dd if=core.elf.signed of=/dev/sda1
 As with UEFI secure boot, it is necessary to build-in the required modules,
 or sign them if they are not part of the GRUB image.

+@node Hardening
+@section Hardening
+
+Security hardening involves additional / optional configuration and
+customization steps to GRUB to maximize security. The extent to which
+hardening can be accomplished depends on the threats attempting to be
+mitigated for a given system / device, the device architecture, and number
+of GRUB features required. The following is a listing of hardening steps which
+may be considered:
+
+@itemize
+@item (EFI Only) Enable secure boot to enable lockdown mode. This will limit
+the attack surface of GRUB by limiting the commands and file systems
+supported. (@pxref{Lockdown})
+@item (EFI Only) No-Execute capability of memory segments will be configured
+by GRUB as indicated by the UEFI. This makes some classes of vulnerabilities
+more difficult to exploit by providing support for marking memory as either
+writable or executable.
+@item (EFI Only) While building GRUB, the stack protector feature may be
+enabled during the configuration step. This feature can make certain
+vulnerabilities caused by stack buffer overflows more difficult to exploit.
+This can be enabled by including the "--enable-stack-protector" flag to the
+configure script:
+@example
+# @kbd{./configure --enable-stack-protector}
+@end example
+Please reference the file @file{INSTALL} for detailed instructions on how to
+build GRUB.
+@item Minimize the installed modules included with the GRUB installation.
+For instance, if a specific file system is used for a given system, modules
+for other file systems may be excluded. @pxref{Modules} for a list of
+modules.
+@item Minimize boot sources. In the GRUB configuration, reduce the possible
+boot sources to the minimum needed for system operation. For instance, if
+booting only from an internal drive, remove support for network booting
+and booting from removable media.
+@item Disable network support in GRUB if not required. Ensure network
+interfaces are not configured in the GRUB configuration and consider
+setting environment variable @samp{feature_net_search_cfg} to @samp{n} in an
+embedded GRUB config file in order to disable attempting to use the
+network for obtaining a GRUB config file.
+@end itemize
+
+
@node Platform limitations
@chapter Platform limitations

@@ -10,6 +10,7 @@ transform_data = {
  installdir = noinst;
  name = genmod.sh;
  common = genmod.sh.in;
+  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
 };

 transform_data = {
@@ -82,21 +83,21 @@ kernel = {
  riscv64_efi_stripflags   = '--strip-unneeded -K start -R .note -R .comment -R .note.gnu.gold-version -R .eh_frame';

  i386_pc_ldflags          = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags          = '$(TARGET_IMG_BASE_LDOPT),0x9000';
+  i386_pc_ldflags          = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x9000';
  i386_qemu_ldflags        = '$(TARGET_IMG_LDFLAGS)';
-  i386_qemu_ldflags        = '$(TARGET_IMG_BASE_LDOPT),0x9000';
+  i386_qemu_ldflags        = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x9000';
  i386_coreboot_ldflags    = '$(TARGET_IMG_LDFLAGS)';
-  i386_coreboot_ldflags    = '$(TARGET_IMG_BASE_LDOPT),0x9000';
+  i386_coreboot_ldflags    = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x9000';
  i386_multiboot_ldflags   = '$(TARGET_IMG_LDFLAGS)';
-  i386_multiboot_ldflags   = '$(TARGET_IMG_BASE_LDOPT),0x9000';
+  i386_multiboot_ldflags   = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x9000';
  i386_ieee1275_ldflags    = '$(TARGET_IMG_LDFLAGS)';
-  i386_ieee1275_ldflags    = '$(TARGET_IMG_BASE_LDOPT),0x10000';
+  i386_ieee1275_ldflags    = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x10000';
  i386_xen_ldflags         = '$(TARGET_IMG_LDFLAGS)';
-  i386_xen_ldflags         = '$(TARGET_IMG_BASE_LDOPT),0';
+  i386_xen_ldflags         = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0';
  x86_64_xen_ldflags       = '$(TARGET_IMG_LDFLAGS)';
  x86_64_xen_ldflags       = '$(TARGET_IMG_BASE_LDOPT),0';
  i386_xen_pvh_ldflags     = '$(TARGET_IMG_LDFLAGS)';
-  i386_xen_pvh_ldflags     = '$(TARGET_IMG_BASE_LDOPT),0x100000';
+  i386_xen_pvh_ldflags     = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x100000';

  mips_loongson_ldflags    = '-Wl,-Ttext,0x80200000';
  powerpc_ieee1275_ldflags = '-Wl,-Ttext,0x200000';
@@ -450,10 +451,10 @@ image = {
  sparc64_ieee1275 = boot/sparc64/ieee1275/boot.S;

  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x7C00';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x7C00';

  i386_qemu_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_qemu_ldflags = '$(TARGET_IMG_BASE_LDOPT),$(GRUB_BOOT_MACHINE_LINK_ADDR)';
+  i386_qemu_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)$(GRUB_BOOT_MACHINE_LINK_ADDR)';
  i386_qemu_ccasflags = '-DGRUB_BOOT_MACHINE_LINK_ADDR=$(GRUB_BOOT_MACHINE_LINK_ADDR)';

  /* The entry point for a.out binaries on sparc64 starts
@@ -478,7 +479,7 @@ image = {
  cppflags = '-DHYBRID_BOOT=1';
  
  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x7C00';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x7C00';

  objcopyflags = '-O binary';
  enable = i386_pc;
@@ -489,7 +490,7 @@ image = {

  i386_pc = boot/i386/pc/cdboot.S;
  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x7C00';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x7C00';

  sparc64_ieee1275 = boot/sparc64/ieee1275/boot.S;

@@ -509,7 +510,7 @@ image = {
  i386_pc = boot/i386/pc/pxeboot.S;

  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x7C00';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x7C00';

  objcopyflags = '-O binary';
  enable = i386_pc;
@@ -520,7 +521,7 @@ image = {
  i386_pc = boot/i386/pc/diskboot.S;

  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x8000';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x8000';

  sparc64_ieee1275 = boot/sparc64/ieee1275/diskboot.S;
  sparc64_ieee1275_ldflags = '-Wl,-Ttext=0x4200';
@@ -536,7 +537,7 @@ image = {
  i386_pc = boot/i386/pc/lnxboot.S;

  i386_pc_ldflags = '$(TARGET_IMG_LDFLAGS)';
-  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT),0x6000';
+  i386_pc_ldflags = '$(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x6000';

  objcopyflags = '-O binary';
  enable = i386_pc;
@@ -578,7 +579,7 @@ image = {
  i386_pc_nodist = rs_decoder.h;

  objcopyflags = '-O binary';
-  ldflags = '$(TARGET_IMG_LDFLAGS) $(TARGET_IMG_BASE_LDOPT),0x8200';
+  ldflags = '$(TARGET_IMG_LDFLAGS) $(TARGET_IMG_BASE_LDOPT)$(TARGET_IMG_BASE_LDOPT_ARG_SEP)0x8200';
  enable = i386_pc;
 };

@@ -2272,6 +2273,11 @@ module = {
  common = tests/argon2_test.c;
 };

+module = {
+  name = crypto_cipher_mode_test;
+  common = tests/crypto_cipher_mode_test.c;
+};
+
 module = {
  name = legacy_password_test;
  common = tests/legacy_password_test.c;
@@ -88,7 +88,7 @@ static const struct grub_arg_option uki_opt[] =
    {"enable-fallback", 'f', 0, "Fallback to the default BLS path if --path fails to find UKI entries.", 0, ARG_TYPE_NONE},
    {"show-default", 'd', 0, N_("Allow the default UKI entry to be added to the GRUB menu."), 0, ARG_TYPE_NONE},
    {"show-non-default", 'n', 0, N_("Allow the non-default UKI entries to be added to the GRUB menu."), 0, ARG_TYPE_NONE},
-    {"entry", 'e', 0, N_("Allow specificUKII entries to be added to the GRUB menu."), N_("FILE"), ARG_TYPE_FILE},
+    {"entry", 'e', 0, N_("Allow specific UKI entries to be added to the GRUB menu."), N_("FILE"), ARG_TYPE_FILE},
    {0, 0, 0, 0, 0, 0}
  };
 #endif
@@ -1210,7 +1210,7 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback, enum blsu

      /*
       * If we aren't able to find BLS entries in the directory given by info->dirname,
-       * we can fallback to the default location "/boot/loader/entries/" and see if we
+       * we can fallback to the default location of "/loader/entries/" and see if we
       * can find the files there. If we can't find UKI entries, fallback to
       * "/EFI/Linux" on the EFI system partition.
       */
@@ -1231,7 +1231,7 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback, enum blsu
 	  tmp = blsuki_update_boot_device (default_dir);
 	  tmp = grub_stpcpy (tmp, cmd_dir);

-	  blsuki_set_find_entry_info (info, default_dir, NULL, cmd_type);
+	  blsuki_set_find_entry_info (info, default_dir, info->devid, cmd_type);
 	  grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n",
 			read_entry_info.dirname, info->dirname);
 	  fallback = true;
@@ -1360,6 +1360,10 @@ blsuki_is_default_entry (const char *def_entry, grub_blsuki_entry_t *entry, int
    return true;

  def_idx = grub_strtol (def_entry, &def_entry_end, 0);
+
+  /* Clear grub_errno so we can plug the leak. */
+  grub_errno = GRUB_ERR_NONE;
+
  if (*def_entry_end != '\0' || def_idx < 0 || def_idx > GRUB_INT_MAX)
    return false;

@@ -1454,9 +1458,11 @@ blsuki_cmd (grub_extcmd_context_t ctxt, enum blsuki_cmd_type cmd_type)
 }

 static grub_err_t
-grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)),
+grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc,
 		 char **args __attribute__ ((unused)))
 {
+  if (argc != 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unexpected argument(s) found, see --help"));
  return blsuki_cmd (ctxt, BLSUKI_BLS_CMD);
 }

@@ -1464,9 +1470,11 @@ static grub_extcmd_t bls_cmd;

 #ifdef GRUB_MACHINE_EFI
 static grub_err_t
-grub_cmd_uki (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)),
+grub_cmd_uki (grub_extcmd_context_t ctxt, int argc,
 		 char **args __attribute__ ((unused)))
 {
+  if (argc != 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unexpected argument(s) found, see --help"));
  return blsuki_cmd (ctxt, BLSUKI_UKI_CMD);
 }

@@ -1476,7 +1484,7 @@ static grub_extcmd_t uki_cmd;
 GRUB_MOD_INIT(blsuki)
 {
  bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0,
-				  N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"),
+				  N_("[-p|--path] DIR [-f|--enable-fallback] [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"),
 				  N_("Import Boot Loader Specification snippets."),
 				  bls_opt);
 #ifdef GRUB_MACHINE_EFI
@@ -129,6 +129,7 @@ grub_cmd_lsefi (grub_command_t cmd __attribute__ ((unused)),

    }

+  grub_free (handles);
  return 0;
 }

@@ -47,6 +47,7 @@ static const struct guid_mapping guid_mappings[] =
    { GRUB_EFI_HOB_LIST_GUID, "HOB LIST"},
    { GRUB_EFI_IMAGE_SECURITY_DATABASE_GUID, "IMAGE EXECUTION INFORMATION"},
    { GRUB_EFI_LZMA_CUSTOM_DECOMPRESS_GUID, "LZMA CUSTOM DECOMPRESS"},
+    { GRUB_EFI_MEMORY_ATTRIBUTES_TABLE_GUID, "MEMORY ATTRIBUTES TABLE"},
    { GRUB_EFI_MEMORY_TYPE_INFORMATION_GUID, "MEMORY TYPE INFO"},
    { GRUB_EFI_MPS_TABLE_GUID, "MPS"},
    { GRUB_EFI_RT_PROPERTIES_TABLE_GUID, "RT PROPERTIES"},
@@ -54,6 +55,7 @@ static const struct guid_mapping guid_mappings[] =
    { GRUB_EFI_SMBIOS_TABLE_GUID, "SMBIOS"},
    { GRUB_EFI_SMBIOS3_TABLE_GUID, "SMBIOS3"},
    { GRUB_EFI_SYSTEM_RESOURCE_TABLE_GUID, "SYSTEM RESOURCE TABLE"},
+    { GRUB_EFI_TCG2_FINAL_EVENTS_TABLE_GUID, "TCG2 FINAL EVENTS TABLE"},
    { GRUB_EFI_TIANO_CUSTOM_DECOMPRESS_GUID, "TIANO CUSTOM DECOMPRESS"},
    { GRUB_EFI_TSC_FREQUENCY_GUID, "TSC FREQUENCY"},
  };
@@ -39,7 +39,7 @@ static grub_uint8_t grub_tpm_version;

 static grub_int8_t tpm1_present = -1;
 static grub_int8_t tpm2_present = -1;
-static grub_int8_t tpm2_pcr_banks_reporting_present = -1;
+static grub_efi_int64_t tpm2_active_pcr_banks = -1;

 static grub_efi_boolean_t
 grub_tpm1_present (grub_efi_tpm_protocol_t *tpm)
@@ -90,34 +90,6 @@ grub_tpm2_present (grub_efi_tpm2_protocol_t *tpm)
  return (grub_efi_boolean_t) tpm2_present;
 }

-static grub_efi_boolean_t
-grub_tpm2_pcr_banks_reporting_present (grub_efi_tpm2_protocol_t *tpm)
-{
-  grub_efi_status_t status;
-  EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;
-
-  caps.Size = (grub_uint8_t) sizeof (caps);
-
-  if (tpm2_pcr_banks_reporting_present != -1)
-    return (grub_efi_boolean_t) tpm2_pcr_banks_reporting_present;
-
-  if (!grub_tpm2_present (tpm))
-    return (grub_efi_boolean_t) (tpm2_pcr_banks_reporting_present = 0);
-
-  status = tpm->get_capability (tpm, &caps);
-
-  if (status != GRUB_EFI_SUCCESS || caps.StructureVersion.Major < 1
-      || (caps.StructureVersion.Major == 1 && caps.StructureVersion.Minor < 1))
-    tpm2_pcr_banks_reporting_present = 0;
-  else
-    tpm2_pcr_banks_reporting_present = 1;
-
-  grub_dprintf ("tpm", "tpm2 PCR banks reporting%s present\n",
-		tpm2_pcr_banks_reporting_present ? "" : " NOT");
-
-  return (grub_efi_boolean_t) tpm2_pcr_banks_reporting_present;
-}
-
 static grub_efi_boolean_t
 grub_tpm_handle_find (grub_efi_handle_t *tpm_handle,
 		      grub_efi_uint8_t *protocol_version)
@@ -141,6 +113,7 @@ grub_tpm_handle_find (grub_efi_handle_t *tpm_handle,
      grub_tpm_version = 1;
      *protocol_version = 1;
      grub_dprintf ("tpm", "TPM handle Found, version: 1\n");
+      grub_free (handles);
      return 1;
    }

@@ -153,6 +126,7 @@ grub_tpm_handle_find (grub_efi_handle_t *tpm_handle,
      grub_tpm_version = 2;
      *protocol_version = 2;
      grub_dprintf ("tpm", "TPM handle Found, version: 2\n");
+      grub_free (handles);
      return 1;
    }

@@ -365,32 +339,45 @@ grub_tpm_present (void)
 grub_uint32_t
 grub_tpm2_active_pcr_banks (void)
 {
+  EFI_TCG2_BOOT_SERVICE_CAPABILITY caps;
  grub_efi_handle_t tpm_handle;
  grub_efi_uint8_t protocol_version;
  grub_efi_tpm2_protocol_t *tpm;
-  grub_efi_uint32_t active_pcr_banks = 0;
+  grub_efi_uint32_t active_pcr_banks;
+  grub_efi_status_t status;
+
+  if (tpm2_active_pcr_banks >= 0)
+    return (grub_uint32_t) tpm2_active_pcr_banks;

  if (!grub_tpm_handle_find (&tpm_handle, &protocol_version))
-    return 0;
+    return (grub_uint32_t) (tpm2_active_pcr_banks = 0);

  if (protocol_version == 1)
-    return 0; /* We report TPM2 status */
+    return (grub_uint32_t) (tpm2_active_pcr_banks = 0); /* We report TPM2 status. */

  tpm = grub_efi_open_protocol (tpm_handle, &tpm2_guid,
 				GRUB_EFI_OPEN_PROTOCOL_GET_PROTOCOL);
  if (tpm == NULL)
    {
      grub_dprintf ("tpm", "Cannot open TPM2 protocol\n");
-      return 0;
+      return (grub_uint32_t) (tpm2_active_pcr_banks = 0);
    }

-  if (grub_tpm2_pcr_banks_reporting_present (tpm))
-    {
-      grub_efi_status_t status = tpm->get_active_pcr_banks (tpm, &active_pcr_banks);
+  if (!grub_tpm2_present (tpm))
+    return (grub_uint32_t) (tpm2_active_pcr_banks = 0);

+  caps.Size = (grub_uint8_t) sizeof (caps);
+  status = tpm->get_capability (tpm, &caps);
  if (status != GRUB_EFI_SUCCESS)
-	return 0; /* Assume none available if the call fails. */
-    }
+    return (grub_uint32_t) (tpm2_active_pcr_banks = 0);
+  if (caps.StructureVersion.Major < 1 ||
+      (caps.StructureVersion.Major == 1 && caps.StructureVersion.Minor < 1))
+    /* There's a working TPM2 but without querying protocol, let userspace figure it out. */
+    return (grub_uint32_t) (tpm2_active_pcr_banks = GRUB_UINT_MAX);

-  return active_pcr_banks;
+  status = tpm->get_active_pcr_banks (tpm, &active_pcr_banks);
+  if (status != GRUB_EFI_SUCCESS)
+    return (grub_uint32_t) (tpm2_active_pcr_banks = 0); /* Assume none available if the call fails. */
+
+  return (grub_uint32_t) (tpm2_active_pcr_banks = active_pcr_banks);
 }
@@ -403,7 +403,7 @@ test_parse (char **args, int *argn, int argc, int *depth)
 	  if (++(*depth) > MAX_TEST_RECURSION_DEPTH)
 	    {
 	      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("max recursion depth exceeded"));
-	      depth--;
+	      (*depth)--;
 	      return ctx.or || ctx.and;
 	    }

@@ -90,7 +90,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid,
 			      0x06, (3 << 8) | index,
 			      langid, descstr.length, (char *) descstrp);

-  if (descstrp->length == 0)
+  if (descstrp->length < 2)
    {
      grub_free (descstrp);
      *string = grub_strdup ("");
@@ -99,7 +99,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid,
      return GRUB_USB_ERR_NONE;
    }

-  *string = grub_malloc (descstr.length * 2 + 1);
+  *string = grub_malloc (descstrp->length * 2 + 1);
  if (! *string)
    {
      grub_free (descstrp);
@@ -93,6 +93,7 @@ ofdisk_hash_add_real (char *devpath)
      grub_add (sz, sizeof ("ieee1275/"), &sz))
    {
      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path"));
+      grub_free (p);
      return NULL;
    }

@@ -109,6 +110,8 @@ ofdisk_hash_add_real (char *devpath)
      if (grub_add (grub_strlen (p->devpath), 3, &sz))
 	{
 	  grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of an open path"));
+	  grub_free (p->grub_devpath);
+	  grub_free (p);
 	  return NULL;
 	}

@@ -203,6 +203,9 @@ grub_efiemu_count_symbols (const Elf_Ehdr *e)
  grub_efiemu_elfsyms = (struct grub_efiemu_elf_sym *)
    grub_calloc (grub_efiemu_nelfsyms, sizeof (struct grub_efiemu_elf_sym));

+  if (grub_efiemu_elfsyms == NULL)
+    return grub_errno;
+
  /* Relocators */
  for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff);
       i < e->e_shnum;
@@ -2743,7 +2743,7 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type,
  grub_uint64_t blkid, blksz;	/* the block id this object dnode is in */
  int epbs;			/* shift of number of dnodes in a block */
  int idx;			/* index within a block */
-  void *dnbuf;
+  dnode_phys_t *dnbuf;
  grub_err_t err;
  grub_zfs_endian_t endian;

@@ -2773,7 +2773,7 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type,

  grub_dprintf ("zfs", "endian = %d, blkid=%llx\n", mdn->endian,
 		(unsigned long long) blkid);
-  err = dmu_read (mdn, blkid, &dnbuf, &endian, data);
+  err = dmu_read (mdn, blkid, (void **) &dnbuf, &endian, data);
  if (err)
    return err;
  grub_dprintf ("zfs", "alive\n");
@@ -2795,7 +2795,7 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type,
      data->dnode_endian = endian;
    }

-  grub_memmove (&(buf->dn), (dnode_phys_t *) dnbuf + idx, DNODE_SIZE);
+  grub_memmove (&(buf->dn), dnbuf + idx, DNODE_SIZE);
  if (data->dnode_buf == 0)
 	  /* dnbuf not used anymore if data->dnode_mdn malloc failed */
 	  grub_free (dnbuf);
@@ -502,6 +502,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)),
  return 0;
 }

+static grub_command_t cmd;
+
 GRUB_MOD_INIT (gettext)
 {
  const char *lang;
@@ -521,11 +523,12 @@ GRUB_MOD_INIT (gettext)
  grub_register_variable_hook ("locale_dir", NULL, read_main);
  grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary);

-  grub_register_command_p1 ("gettext", grub_cmd_translate,
+  cmd = grub_register_command_p1 ("gettext", grub_cmd_translate,
 				  N_("STRING"),
-			    /* TRANSLATORS: It refers to passing the string through gettext.
-			       So it's "translate" in the same meaning as in what you're
-			       doing now.
+				  /*
+				   * TRANSLATORS: It refers to passing the string through gettext.
+				   * So it's "translate" in the same meaning as in what you're
+				   * doing now.
 				   */
 				  N_("Translates the string with the current settings."));

@@ -544,6 +547,8 @@ GRUB_MOD_FINI (gettext)
  grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
  grub_register_variable_hook ("lang", NULL, NULL);

+  grub_unregister_command (cmd);
+
  grub_gettext_delete_list (&main_context);
  grub_gettext_delete_list (&secondary_context);

@@ -152,6 +152,8 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
    case GRUB_FILE_TYPE_TESTLOAD:
    case GRUB_FILE_TYPE_GET_SIZE:
    case GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY:
+    case GRUB_FILE_TYPE_CRYPTODISK_ENCRYPTION_KEY:
+    case GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER:
    case GRUB_FILE_TYPE_CAT:
    case GRUB_FILE_TYPE_HEXCAT:
    case GRUB_FILE_TYPE_CMP:
@@ -201,12 +201,12 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len)
 grub_err_t
 grub_file_close (grub_file_t file)
 {
-  if (file->fs->mod)
-    grub_dl_unref (file->fs->mod);
-
  if (file->fs->fs_close)
    (file->fs->fs_close) (file);

+  if (file->fs->mod)
+    grub_dl_unref (file->fs->mod);
+
  if (file->device)
    grub_device_close (file->device);
  grub_free (file->name);
@@ -201,6 +201,11 @@ grub_ieee1275_devalias_next (struct grub_ieee1275_devalias *alias)
 	  alias->path = 0;
 	}
      tmp = grub_strdup (alias->name);
+      if (tmp == NULL)
+        {
+          grub_ieee1275_devalias_free (alias);
+          return 0;
+        }
      if (grub_ieee1275_next_property (alias->parent_dev, tmp,
 				       alias->name) <= 0)
 	{
@@ -432,9 +437,15 @@ grub_ieee1275_parse_args (const char *path, enum grub_ieee1275_parse_type ptype)
 	  ret = grub_strdup (args);
 	else
 	  ret = grub_strndup (args, (grub_size_t)(comma - args));
-	/* Consistently provide numbered partitions to GRUB.
-	   OpenBOOT traditionally uses alphabetical partition
-	   specifiers.  */
+
+        if (ret == NULL)
+          return 0;
+
+        /*
+         * Consistently provide numbered partitions to GRUB.
+         * OpenBOOT traditionally uses alphabetical partition
+         * specifiers.
+         */
 	if (ret[0] >= 'a' && ret[0] <= 'z')
 	    ret[0] = '1' + (ret[0] - 'a');
 	grub_free (args);
@@ -501,7 +512,20 @@ grub_ieee1275_encode_devname (const char *path)
    }
  if (partition && partition[0])
    {
-      unsigned int partno = grub_strtoul (partition, 0, 0);
+      unsigned long partno;
+      const char *endptr;
+
+      partno = grub_strtoul (partition, &endptr, 0);
+      grub_errno = GRUB_ERR_NONE;
+      if (*endptr != '\0' || partno > 65535 ||
+          (partno == 0 && ! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_0_BASED_PARTITIONS)))
+        {
+          grub_free (partition);
+          grub_free (device);
+          grub_free (encoding);
+          grub_error (GRUB_ERR_BAD_ARGUMENT, N_("invalid partition number"));
+          return NULL;
+        }

      *optr++ = ',';

@@ -509,7 +533,7 @@ grub_ieee1275_encode_devname (const char *path)
 	/* GRUB partition 1 is OF partition 0.  */
 	partno++;

-      grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%d", partno);
+      grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%lu", partno);
    }
  else
    *optr = '\0';
@@ -403,6 +403,9 @@ grub_machine_get_bootlocation (char **device, char **path)
      if (!syspart)
 	return;
      loaddev = grub_strdup (syspart);
+      if (loaddev == NULL)
+        return;
+
    }

  partptr = get_part (loaddev);
@@ -508,6 +508,9 @@ grub_legacy_parse (const char *buf, char **entryname, char **suffix)
      char *ret;
      int len = grub_strlen (buf);
      ret = grub_malloc (len + 2);
+      if (ret == NULL)
+        return NULL;
+
      grub_memcpy (ret, buf, len);
      if (len && ret[len - 1] == '\n')
 	ret[len] = 0;
@@ -398,9 +398,9 @@ free_subchunk (const struct grub_relocator_subchunk *subchu)
 	if (subchu->post)
 	  {
 	    int off = subchu->start + subchu->size - fend;
-	    grub_memset (subchu->pre->freebytes,
-			 0xff, sizeof (subchu->pre->freebytes) - off / 8);
-	    subchu->pre->freebytes[off / 8] |= ((1 << (8 - (off % 8))) - 1);
+	    grub_memset (subchu->post->freebytes,
+			 0xff, sizeof (subchu->post->freebytes) - off / 8 - 1);
+	    subchu->post->freebytes[sizeof (subchu->post->freebytes) - off / 8 - 1] |= ((1 << (8 - (off % 8))) - 1);
 	    check_leftover (subchu->post);
 	  }
 #endif
@@ -36,7 +36,7 @@ GRUB_MOD_LICENSE "GPLv3+"
 */
 FUNCTION(grub_setjmp)
 	pop	%rsi		/* Return address, and adjust the stack */
-	xorq	%rax, %rax
+	xorl	%eax, %eax
 	movq	%rbx, 0(%rdi)	/* RBX */
 	movq	%rsp, 8(%rdi)   /* RSP */
 	push	%rsi
@@ -242,6 +242,13 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data)
 	  else
 	    {
 	      struct mm_list *n = grub_malloc (sizeof (*n));
+	      if (n == NULL)
+		{
+		  grub_free (ctx.scanline_events);
+		  grub_free (present);
+		  return grub_errno;
+		}
+
 	      n->val = ctx.scanline_events[i].memtype;
 	      n->present = 1;
 	      n->next = present[ctx.scanline_events[i].priority].next;
@@ -402,7 +409,7 @@ badram_iter (grub_uint64_t addr, grub_uint64_t size,
      */
      while (high - low > 1)
 	{
-	  cur = (low + high) / 2;
+	  cur = low + (high - low) / 2;
 	  if (fill_mask (entry, cur) >= addr)
 	    high = cur;
 	  else
@@ -2146,6 +2146,7 @@ GRUB_MOD_FINI(net)
  grub_unregister_command (cmd_deladdr);
  grub_unregister_command (cmd_addroute);
  grub_unregister_command (cmd_delroute);
+  grub_unregister_command (cmd_setvlan);
  grub_unregister_command (cmd_lsroutes);
  grub_unregister_command (cmd_lscards);
  grub_unregister_command (cmd_lsaddr);
@@ -42,7 +42,14 @@ grub_err_t
 grub_set_history (int newsize)
 {
  grub_uint32_t **old_hist_lines = hist_lines;
+
  hist_lines = grub_calloc (newsize, sizeof (grub_uint32_t *));
+  if (hist_lines == NULL)
+    {
+      /* We need to restore hist_lines to avoid memory leak and state loss. */
+      hist_lines = old_hist_lines;
+      return grub_errno;
+    }

  /* Copy the old lines into the new buffer.  */
  if (old_hist_lines)
@@ -490,6 +490,9 @@ grub_normal_do_completion (char *buf, int *restore,
 	  spaces++;

      ret = grub_malloc (match_len - current_len + grub_strlen (suffix) + spaces + 1);
+      if (ret == NULL)
+        goto fail;
+
      newstr = ret;
      for (escstr = match + current_len; *escstr; escstr++)
 	{
@@ -510,7 +510,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)),
  return 0;
 }

-static grub_command_t cmd_clear;
+static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit;

 static void (*grub_xputs_saved) (const char *str);
 static const char *features[] = {
@@ -554,9 +554,9 @@ GRUB_MOD_INIT(normal)
  grub_env_export ("pager");

  /* Register a command "normal" for the rescue mode.  */
-  grub_register_command ("normal", grub_cmd_normal,
+  cmd_normal = grub_register_command ("normal", grub_cmd_normal,
 				      0, N_("Enter normal mode."));
-  grub_register_command ("normal_exit", grub_cmd_normal_exit,
+  cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit,
 					   0, N_("Exit from normal mode."));

  /* Reload terminal colors when these variables are written to.  */
@@ -599,4 +599,6 @@ GRUB_MOD_FINI(normal)
  grub_register_variable_hook ("color_highlight", NULL, NULL);
  grub_fs_autoload_hook = 0;
  grub_unregister_command (cmd_clear);
+  grub_unregister_command (cmd_normal);
+  grub_unregister_command (cmd_normal_exit);
 }
@@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
 						 sizeof(struct IOExtTD));
  if (!ret->ioreq)
    {
-      free (ret);
      DeleteMsgPort (ret->mp);
+      free (ret);
      return NULL;
    }

@@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
  if (OpenDevice ((unsigned char *) tmp, unit,
 		  (struct IORequest *) ret->ioreq, flags))
    {
-      free (tmp);
-      free (ret);
      DeleteMsgPort (ret->mp);
+      free (ret);
+      free (tmp);
      return NULL;
    }
  free (tmp);
@@ -991,6 +991,8 @@ grub_util_get_raid_grub_dev (const char *os_dev)
      char *p, *q;

      p = strdup (os_dev + sizeof ("/dev/md_d") - 1);
+      if (p == NULL)
+        return NULL;

      q = strchr (p, 'p');
      if (q)
@@ -1006,6 +1008,8 @@ grub_util_get_raid_grub_dev (const char *os_dev)
      char *p, *q;

      p = strdup (os_dev + sizeof ("/dev/md/d") - 1);
+      if (p == NULL)
+        return NULL;

      q = strchr (p, 'p');
      if (q)
@@ -1019,6 +1023,8 @@ grub_util_get_raid_grub_dev (const char *os_dev)
      char *p , *q;

      p = strdup (os_dev + sizeof ("/dev/md") - 1);
+      if (p == NULL)
+        return NULL;

      q = strchr (p, 'p');
      if (q)
@@ -1032,6 +1038,8 @@ grub_util_get_raid_grub_dev (const char *os_dev)
      char *p , *q;

      p = strdup (os_dev + sizeof ("/dev/md/") - 1);
+      if (p == NULL)
+        return NULL;

      q = strchr (p, 'p');
      if (q)
@@ -1046,6 +1054,8 @@ grub_util_get_raid_grub_dev (const char *os_dev)
      char *p , *q;

      p = strdup (os_dev + sizeof ("/dev/md/") - 1);
+      if (p == NULL)
+        return NULL;

      q = strchr (p, 'p');
      if (q)
@@ -488,8 +488,11 @@ check_hba_identifiers (const char *sysfs_path, int *vendor, int *device_id)
 static void
 check_sas (const char *sysfs_path, int *tgt, unsigned long int *sas_address)
 {
-  char *ed = strstr (sysfs_path, "end_device");
-  char *p, *q, *path;
+  const char *ed = strstr (sysfs_path, "end_device");
+  int p_len;
+  int ed_len;
+  const char *q;
+  char *path;
  char phy[21];
  int fd;
  size_t path_size;
@@ -498,20 +501,16 @@ check_sas (const char *sysfs_path, int *tgt, unsigned long int *sas_address)
    return;

  /* SAS devices are identified using disk@$PHY_ID */
-  p = xstrdup (sysfs_path);
-  ed = strstr(p, "end_device");
-  if (!ed)
-    return;
-
  q = ed;
  while (*q && *q != '/')
    q++;
-  *q = '\0';
+  p_len = (int) (q - sysfs_path);
+  ed_len = (int) (q - ed);

-  path_size = (strlen (p) + strlen (ed)
-	       + sizeof ("%s/sas_device/%s/phy_identifier"));
+  path_size = (p_len + ed_len + sizeof ("/sas_device//phy_identifier"));
  path = xmalloc (path_size);
-  snprintf (path, path_size, "%s/sas_device/%s/phy_identifier", p, ed);
+  snprintf (path, path_size, "%.*s/sas_device/%.*s/phy_identifier", p_len,
+	    sysfs_path, ed_len, ed);
  fd = open (path, O_RDONLY);
  if (fd < 0)
    grub_util_error (_("cannot open `%s': %s"), path, strerror (errno));
@@ -524,7 +523,8 @@ check_sas (const char *sysfs_path, int *tgt, unsigned long int *sas_address)

  sscanf (phy, "%d", tgt);

-  snprintf (path, path_size, "%s/sas_device/%s/sas_address", p, ed);
+  snprintf (path, path_size, "%.*s/sas_device/%.*s/sas_address", p_len,
+	    sysfs_path, ed_len, ed);
  fd = open (path, O_RDONLY);
  if (fd < 0)
    grub_util_error (_("cannot open `%s': %s"), path, strerror (errno));
@@ -535,7 +535,6 @@ check_sas (const char *sysfs_path, int *tgt, unsigned long int *sas_address)
  sscanf (phy, "%lx", sas_address);

  free (path);
-  free (p);
  close (fd);
 }

@@ -695,6 +694,9 @@ strip_trailing_digits (const char *p)
  char *new, *end;

  new = strdup (p);
+  if (new == NULL)
+    return NULL;
+
  end = new + strlen(new) - 1;
  while (end >= new)
    {
@@ -709,13 +711,18 @@ strip_trailing_digits (const char *p)
 char *
 grub_util_devname_to_ofpath (const char *sys_devname)
 {
-  char *name_buf, *device, *devnode, *devicenode, *ofpath;
+  char *name_buf, *device, *devnode, *devicenode, *ofpath = NULL;

  name_buf = xrealpath (sys_devname);

  device = get_basename (name_buf);
  devnode = strip_trailing_digits (name_buf);
+  if (devnode == NULL)
+    goto devnode_fail;
+
  devicenode = strip_trailing_digits (device);
+  if (devicenode == NULL)
+    goto devicenode_fail;

  if (device[0] == 'h' && device[1] == 'd')
    ofpath = of_path_of_ide(name_buf, device, devnode, devicenode);
@@ -741,8 +748,12 @@ grub_util_devname_to_ofpath (const char *sys_devname)
      ofpath = NULL;
    }

-  free (devnode);
  free (devicenode);
+
+ devicenode_fail:
+  free (devnode);
+
+ devnode_fail:
  free (name_buf);

  return ofpath;
@@ -348,6 +348,9 @@ pc_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors,
       * area.
       */
      embed_signature_check = grub_malloc (GRUB_DISK_SECTOR_SIZE);
+      if (embed_signature_check == NULL)
+        return grub_errno;
+
      for (i = 0; i < *nsectors; i++)
 	{
 	  if (grub_disk_read (disk, (*sectors)[i], 0, GRUB_DISK_SECTOR_SIZE,
@@ -562,6 +562,8 @@ gettext_append (struct grub_script_argv *result, const char *orig_str)
    if (*iptr == '$')
      dollar_cnt++;
  ctx.allowed_strings = grub_calloc (dollar_cnt, sizeof (ctx.allowed_strings[0]));
+  if (ctx.allowed_strings == NULL)
+    goto fail;

  if (parse_string (orig_str, gettext_save_allow, &ctx, 0))
    goto fail;
@@ -1015,6 +1017,9 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
 	{
 	  /* As a last resort, try if it is an assignment.  */
 	  char *assign = grub_strdup (cmdname);
+          if (assign == NULL)
+            return grub_errno;
+
 	  char *eq = grub_strchr (assign, '=');

 	  if (eq)
@@ -169,13 +169,13 @@ grub_efiserial_init (void)

      port = grub_zalloc (sizeof (*port));
      if (!port)
-	return;
+	break;

      port->name = grub_malloc (sizeof ("efiXXXXXXXXXXXXXXXXXXXX"));
      if (!port->name)
 	{
 	  grub_free (port);
-	  return;
+	  break;
 	}
      grub_snprintf (port->name, sizeof ("efiXXXXXXXXXXXXXXXXXXXX"),
 		     "efi%d", num_serial++);
@@ -236,7 +236,11 @@ add_port (struct ofserial_hash_ent *ent)
 			    + grub_strlen (ent->shortest));
  port->elem = ent;
  if (!port->name)
+    {
+      grub_free (port);
      return NULL;
+    }
+
  ptr = grub_stpcpy (port->name, "ieee1275/");
  grub_strcpy (ptr, ent->shortest);

@@ -0,0 +1,197 @@
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2025 Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/test.h>
+#include <grub/dl.h>
+#include <grub/misc.h>
+#include <grub/crypto.h>
+
+#include "crypto_cipher_mode_vectors.h"
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+/* Perform cipher lookup, handle init, and key setting. */
+static grub_crypto_cipher_handle_t
+handle_init (struct vector vec, grub_crypto_cipher_handle_t handle)
+{
+  gcry_err_code_t err;
+
+  const gcry_cipher_spec_t *cipher = grub_crypto_lookup_cipher_by_name (vec.cipher);
+  grub_test_assert (cipher != NULL, "\n%s: cipher lookup failed for %s", vec.mode, vec.cipher);
+  if (cipher == NULL)
+    return NULL;
+
+  handle = grub_crypto_cipher_open (cipher);
+  grub_test_assert (handle != NULL, "\n%s: handle init failed for %s", vec.mode, vec.cipher);
+  if (handle == NULL)
+    return NULL;
+
+  err = grub_crypto_cipher_set_key (handle, (grub_uint8_t *) vec.key, vec.keylen);
+  grub_test_assert (err == GPG_ERR_NO_ERROR, "\n%s: key set of size %d failed for %s with err = %d",
+                    vec.mode, vec.keylen, vec.cipher, err);
+  if (err != GPG_ERR_NO_ERROR)
+    {
+      grub_crypto_cipher_close (handle);
+      return NULL;
+    }
+
+  return handle;
+}
+
+static void
+ecb_test (struct vector vec)
+{
+  gcry_err_code_t gcry_err;
+  grub_crypto_cipher_handle_t handle = NULL;
+  grub_uint8_t *plaintext = NULL, *ciphertext = NULL;
+  grub_int32_t rc;
+
+  handle = handle_init (vec, handle);
+  if (handle == NULL)
+    return;
+
+  /* Test encryption. */
+  ciphertext = grub_zalloc (vec.plen);
+  grub_test_assert (ciphertext != NULL, "\necb: ciphertext buffer allocation failed");
+  if (ciphertext == NULL)
+    goto out_handle;
+
+  gcry_err = grub_crypto_ecb_encrypt (handle, ciphertext, vec.ptext, vec.plen);
+  grub_test_assert (gcry_err == GPG_ERR_NO_ERROR, "\necb: encryption failed with err = %d",
+                    gcry_err);
+  if (gcry_err != GPG_ERR_NO_ERROR)
+    goto out_ct;
+
+  rc = grub_memcmp (ciphertext, vec.ctext, vec.plen);
+  grub_test_assert (rc == 0, "\necb: ciphertext mismatch after encryption");
+  if (rc != 0)
+    goto out_ct;
+
+  /* Test decryption. */
+  plaintext = grub_zalloc (vec.plen);
+  grub_test_assert (plaintext != NULL, "\necb: plaintext buffer allocation failed");
+  if (plaintext == NULL)
+    goto out_ct;
+
+  gcry_err = grub_crypto_ecb_decrypt (handle, plaintext, ciphertext, vec.plen);
+  grub_test_assert (gcry_err == GPG_ERR_NO_ERROR, "\necb: decryption failed failed with err = %d",
+                    gcry_err);
+  if (gcry_err != GPG_ERR_NO_ERROR)
+    goto out_pt;
+
+  rc = grub_memcmp (plaintext, vec.ptext, vec.plen);
+  grub_test_assert (rc == 0, "\necb: plaintext mismatch after decryption");
+
+ out_pt:
+  grub_free(plaintext);
+ out_ct:
+  grub_free(ciphertext);
+ out_handle:
+  grub_crypto_cipher_close(handle);
+}
+
+static void
+cbc_test (struct vector vec)
+{
+  gcry_err_code_t gcry_err;
+  grub_crypto_cipher_handle_t handle = NULL;
+  grub_uint8_t *plaintext = NULL, *ciphertext = NULL;
+  grub_uint32_t *iv = NULL;
+  grub_int32_t rc;
+
+  handle = handle_init (vec, handle);
+  if (handle == NULL)
+    return;
+
+  /* Test Encryption */
+  iv = grub_malloc(vec.ivlen);
+  grub_test_assert (iv != NULL, "\ncbc: IV buffer allocation failed");
+  if (iv == NULL)
+    goto out_handle;
+
+  grub_memcpy (iv, vec.iv_in, vec.ivlen);
+
+  ciphertext = grub_zalloc (vec.plen);
+  grub_test_assert (ciphertext != NULL, "\ncbc: ciphertext buffer allocation failed");
+  if (ciphertext == NULL)
+    goto out_iv;
+
+  gcry_err = grub_crypto_cbc_encrypt (handle, ciphertext, vec.ptext, vec.plen, iv);
+  grub_test_assert (gcry_err == GPG_ERR_NO_ERROR, "\ncbc: encryption failed with err = %d",
+                    gcry_err);
+  if (gcry_err != GPG_ERR_NO_ERROR)
+    goto out_ct;
+
+  rc = grub_memcmp (ciphertext, vec.ctext, vec.plen);
+  grub_test_assert (rc == 0, "\ncbc: ciphertext mismatch after encryption");
+  if (rc != 0)
+    goto out_ct;
+
+  rc = grub_memcmp (iv, vec.iv_out, vec.ivlen);
+  grub_test_assert (rc == 0, "\ncbc: IV out mismatch after encryption");
+  if (rc != 0)
+    goto out_ct;
+
+  /* Test Decryption  */
+  grub_memcpy (iv, vec.iv_in, vec.ivlen);
+
+  plaintext = grub_zalloc (vec.plen);
+  grub_test_assert (plaintext != NULL, "\ncbc: plaintext buffer allocation failed");
+  if (plaintext == NULL)
+    goto out_ct;
+
+  gcry_err = grub_crypto_cbc_decrypt (handle, plaintext, ciphertext, vec.plen, iv);
+  grub_test_assert (gcry_err == GPG_ERR_NO_ERROR, "\ncbc: decryption failed with err = %d",
+                    gcry_err);
+  if (gcry_err != GPG_ERR_NO_ERROR)
+    goto out_pt;
+
+  rc = grub_memcmp (plaintext, vec.ptext, vec.plen);
+  grub_test_assert (rc == 0, "\ncbc: plaintext mismatch after decryption");
+
+ out_pt:
+  grub_free(plaintext);
+ out_ct:
+  grub_free(ciphertext);
+ out_iv:
+  grub_free(iv);
+ out_handle:
+  grub_crypto_cipher_close(handle);
+}
+
+static void
+crypto_cipher_mode_test (void)
+{
+  grub_size_t i;
+
+  for (i = 0; i < ARRAY_SIZE (vecs); i++)
+    {
+      if (grub_strcmp (vecs[i].mode, "ecb") == 0)
+        ecb_test(vecs[i]);
+      else if (grub_strcmp (vecs[i].mode, "cbc") == 0)
+        cbc_test(vecs[i]);
+      else
+        {
+          grub_test_assert(0, "\n%s mode unsupported for testing", vecs[i].mode);
+          return;
+        }
+    }
+}
+
+/* Register example_test method as a functional test.  */
+GRUB_FUNCTIONAL_TEST (crypto_cipher_mode_test, crypto_cipher_mode_test);
@@ -0,0 +1,135 @@
+struct vector
+{
+  const char *cipher;
+  const char *mode;
+  const char *key;
+  grub_uint32_t keylen;
+  const char *ptext;
+  grub_uint32_t plen;
+  const char *ctext;
+  const char *iv_in;
+  const char *iv_out;
+  grub_uint32_t ivlen;
+} vecs[] = {
+  {
+    .cipher = "aes",
+    .mode   = "ecb",
+    .key    = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+    .keylen = 16,
+    .ptext  = "\x00\x11\x22\x33\x44\x55\x66\x77"
+              "\x88\x99\xaa\xbb\xcc\xdd\xee\xff",
+    .plen   = 16,
+    .ctext  = "\x69\xc4\xe0\xd8\x6a\x7b\x04\x30"
+              "\xd8\xcd\xb7\x80\x70\xb4\xc5\x5a",
+  },
+  {
+    .cipher = "aes",
+    .mode   = "ecb",
+    .key    = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+              "\x10\x11\x12\x13\x14\x15\x16\x17",
+    .keylen = 24,
+    .ptext  = "\x00\x11\x22\x33\x44\x55\x66\x77"
+              "\x88\x99\xaa\xbb\xcc\xdd\xee\xff",
+    .plen   = 16,
+    .ctext  = "\xdd\xa9\x7c\xa4\x86\x4c\xdf\xe0"
+              "\x6e\xaf\x70\xa0\xec\x0d\x71\x91",
+  },
+  {
+    .cipher = "aes",
+    .mode   = "ecb",
+    .key    = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+              "\x10\x11\x12\x13\x14\x15\x16\x17"
+              "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+    .keylen = 32,
+    .ptext  = "\x00\x11\x22\x33\x44\x55\x66\x77"
+              "\x88\x99\xaa\xbb\xcc\xdd\xee\xff",
+    .plen   = 16,
+    .ctext  = "\x8e\xa2\xb7\xca\x51\x67\x45\xbf"
+              "\xea\xfc\x49\x90\x4b\x49\x60\x89",
+  },
+  {
+    .cipher = "aes",
+    .mode   = "cbc",
+    .key    = "\xc2\x86\x69\x6d\x88\x7c\x9a\xa0"
+              "\x61\x1b\xbb\x3e\x20\x25\xa4\x5a",
+    .keylen = 16,
+    .ptext  = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+              "\x10\x11\x12\x13\x14\x15\x16\x17"
+              "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+    .plen   = 32,
+    .ctext  = "\xd2\x96\xcd\x94\xc2\xcc\xcf\x8a"
+              "\x3a\x86\x30\x28\xb5\xe1\xdc\x0a"
+              "\x75\x86\x60\x2d\x25\x3c\xff\xf9"
+              "\x1b\x82\x66\xbe\xa6\xd6\x1a\xb1",
+    .iv_in  = "\x56\x2e\x17\x99\x6d\x09\x3d\x28"
+              "\xdd\xb3\xba\x69\x5a\x2e\x6f\x58",
+    .iv_out = "\x75\x86\x60\x2d\x25\x3c\xff\xf9"
+              "\x1b\x82\x66\xbe\xa6\xd6\x1a\xb1",
+    .ivlen  = 16,
+  },
+  {
+    .cipher = "aes",
+    .mode   = "cbc",
+    .key    = "\x8e\x73\xb0\xf7\xda\x0e\x64\x52"
+              "\xc8\x10\xf3\x2b\x80\x90\x79\xe5"
+              "\x62\xf8\xea\xd2\x52\x2c\x6b\x7b",
+    .keylen = 24,
+    .ptext  = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
+              "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
+              "\xae\x2d\x8a\x57\x1e\x03\xac\x9c"
+              "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51"
+              "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11"
+              "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"
+              "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17"
+              "\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
+    .plen   = 64,
+    .ctext  = "\x4f\x02\x1d\xb2\x43\xbc\x63\x3d"
+              "\x71\x78\x18\x3a\x9f\xa0\x71\xe8"
+              "\xb4\xd9\xad\xa9\xad\x7d\xed\xf4"
+              "\xe5\xe7\x38\x76\x3f\x69\x14\x5a"
+              "\x57\x1b\x24\x20\x12\xfb\x7a\xe0"
+              "\x7f\xa9\xba\xac\x3d\xf1\x02\xe0"
+              "\x08\xb0\xe2\x79\x88\x59\x88\x81"
+              "\xd9\x20\xa9\xe6\x4f\x56\x15\xcd",
+    .iv_in  = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+    .iv_out = "\x08\xb0\xe2\x79\x88\x59\x88\x81"
+              "\xd9\x20\xa9\xe6\x4f\x56\x15\xcd",
+    .ivlen  = 16,
+  },
+  {
+    .cipher = "aes",
+    .mode   = "cbc",
+    .key    = "\x60\x3d\xeb\x10\x15\xca\x71\xbe"
+              "\x2b\x73\xae\xf0\x85\x7d\x77\x81"
+              "\x1f\x35\x2c\x07\x3b\x61\x08\xd7"
+              "\x2d\x98\x10\xa3\x09\x14\xdf\xf4",
+    .keylen = 32,
+    .ptext  = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
+              "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
+              "\xae\x2d\x8a\x57\x1e\x03\xac\x9c"
+              "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51"
+              "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11"
+              "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"
+              "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17"
+              "\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
+    .plen   = 64,
+    .ctext  = "\xf5\x8c\x4c\x04\xd6\xe5\xf1\xba"
+              "\x77\x9e\xab\xfb\x5f\x7b\xfb\xd6"
+              "\x9c\xfc\x4e\x96\x7e\xdb\x80\x8d"
+              "\x67\x9f\x77\x7b\xc6\x70\x2c\x7d"
+              "\x39\xf2\x33\x69\xa9\xd9\xba\xcf"
+              "\xa5\x30\xe2\x63\x04\x23\x14\x61"
+              "\xb2\xeb\x05\xe2\xc3\x9b\xe9\xfc"
+              "\xda\x6c\x19\x07\x8c\x6a\x9d\x1b",
+    .iv_in  = "\x00\x01\x02\x03\x04\x05\x06\x07"
+              "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+    .iv_out = "\xb2\xeb\x05\xe2\xc3\x9b\xe9\xfc"
+              "\xda\x6c\x19\x07\x8c\x6a\x9d\x1b",
+    .ivlen  = 16,
+  },
+};
@@ -82,6 +82,7 @@ grub_functional_all_tests (grub_extcmd_context_t ctxt __attribute__ ((unused)),
  grub_dl_load ("shift_test");
  grub_dl_load ("asn1_test");
  grub_dl_load ("argon2_test");
+  grub_dl_load ("crypto_cipher_mode_test");

  FOR_LIST_ELEMENTS (test, grub_test_list)
    ok = !grub_test_run (test) && ok;
@@ -92,17 +93,18 @@ grub_functional_all_tests (grub_extcmd_context_t ctxt __attribute__ ((unused)),
  return GRUB_ERR_NONE;
 }

-static grub_extcmd_t cmd;
+static grub_extcmd_t cmd, cmd_all;

 GRUB_MOD_INIT (functional_test)
 {
  cmd = grub_register_extcmd ("functional_test", grub_functional_test, 0, 0,
 			      "Run all loaded functional tests.", 0);
-  cmd = grub_register_extcmd ("all_functional_test", grub_functional_all_tests, 0, 0,
+  cmd_all = grub_register_extcmd ("all_functional_test", grub_functional_all_tests, 0, 0,
 				  "Run all functional tests.", 0);
 }

 GRUB_MOD_FINI (functional_test)
 {
  grub_unregister_extcmd (cmd);
+  grub_unregister_extcmd (cmd_all);
 }
@@ -31,6 +31,7 @@ static struct
  grub_size_t Slen;
  unsigned int c;
  grub_size_t dkLen;
+  const gcry_md_spec_t *HMAC_variant;
  const char *DK;
 } vectors[] = {
  /* RFC6070. */
@@ -38,6 +39,7 @@ static struct
    "password", 8,
    "salt", 4,
    1, 20,
+    GRUB_MD_SHA1,
    "\x0c\x60\xc8\x0f\x96\x1f\x0e\x71\xf3\xa9\xb5\x24\xaf\x60\x12"
    "\x06\x2f\xe0\x37\xa6"
  },
@@ -45,6 +47,7 @@ static struct
    "password", 8,
    "salt", 4,
    2, 20,
+    GRUB_MD_SHA1,
    "\xea\x6c\x01\x4d\xc7\x2d\x6f\x8c"
    "\xcd\x1e\xd9\x2a\xce\x1d\x41\xf0"
    "\xd8\xde\x89\x57"
@@ -53,6 +56,7 @@ static struct
    "password", 8,
    "salt", 4,
    4096, 20,
+    GRUB_MD_SHA1,
    "\x4b\x00\x79\x01\xb7\x65\x48\x9a\xbe\xad\x49\xd9\x26\xf7"
    "\x21\xd0\x65\xa4\x29\xc1"
  },
@@ -60,6 +64,7 @@ static struct
    "passwordPASSWORDpassword", 24,
    "saltSALTsaltSALTsaltSALTsaltSALTsalt", 36,
    4096, 25,
+    GRUB_MD_SHA1,
    "\x3d\x2e\xec\x4f\xe4\x1c\x84\x9b\x80\xc8\xd8\x36\x62\xc0"
    "\xe4\x4a\x8b\x29\x1a\x96\x4c\xf2\xf0\x70\x38"
  },
@@ -67,7 +72,89 @@ static struct
    "pass\0word", 9,
    "sa\0lt", 5,
    4096, 16,
+    GRUB_MD_SHA1,
    "\x56\xfa\x6a\xa7\x55\x48\x09\x9d\xcc\x37\xd7\xf0\x34\x25\xe0\xc3"
+  },
+  /* Re-using the above vectors for HMAC-SHA{256,512} */
+  {
+    "password", 8,
+    "salt", 4,
+    1, 20,
+    GRUB_MD_SHA256,
+    "\x12\x0f\xb6\xcf\xfc\xf8\xb3\x2c\x43\xe7\x22\x52\x56\xc4\xf8"
+    "\x37\xa8\x65\x48\xc9"
+  },
+  {
+    "password", 8,
+    "salt", 4,
+    2, 20,
+    GRUB_MD_SHA256,
+    "\xae\x4d\x0c\x95\xaf\x6b\x46\xd3"
+    "\x2d\x0a\xdf\xf9\x28\xf0\x6d\xd0"
+    "\x2a\x30\x3f\x8e"
+  },
+  {
+    "password", 8,
+    "salt", 4,
+    4096, 20,
+    GRUB_MD_SHA256,
+    "\xc5\xe4\x78\xd5\x92\x88\xc8\x41\xaa\x53\x0d\xb6\x84\x5c"
+    "\x4c\x8d\x96\x28\x93\xa0"
+  },
+  {
+    "passwordPASSWORDpassword", 24,
+    "saltSALTsaltSALTsaltSALTsaltSALTsalt", 36,
+    4096, 25,
+    GRUB_MD_SHA256,
+    "\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11\x6e"
+    "\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c"
+  },
+  {
+    "pass\0word", 9,
+    "sa\0lt", 5,
+    4096, 16,
+    GRUB_MD_SHA256,
+    "\x89\xb6\x9d\x05\x16\xf8\x29\x89\x3c\x69\x62\x26\x65\x0a\x86\x87"
+  },
+  {
+    "password", 8,
+    "salt", 4,
+    1, 20,
+    GRUB_MD_SHA512,
+    "\x86\x7f\x70\xcf\x1a\xde\x02\xcf\xf3\x75\x25\x99\xa3\xa5\x3d"
+    "\xc4\xaf\x34\xc7\xa6"
+  },
+  {
+    "password", 8,
+    "salt", 4,
+    2, 20,
+    GRUB_MD_SHA512,
+    "\xe1\xd9\xc1\x6a\xa6\x81\x70\x8a"
+    "\x45\xf5\xc7\xc4\xe2\x15\xce\xb6"
+    "\x6e\x01\x1a\x2e"
+  },
+  {
+    "password", 8,
+    "salt", 4,
+    4096, 20,
+    GRUB_MD_SHA512,
+    "\xd1\x97\xb1\xb3\x3d\xb0\x14\x3e\x01\x8b\x12\xf3\xd1\xd1"
+    "\x47\x9e\x6c\xde\xbd\xcc"
+  },
+  {
+    "passwordPASSWORDpassword", 24,
+    "saltSALTsaltSALTsaltSALTsaltSALTsalt", 36,
+    4096, 25,
+    GRUB_MD_SHA512,
+    "\x8c\x05\x11\xf4\xc6\xe5\x97\xc6\xac\x63\x15\xd8\xf0\x36"
+    "\x2e\x22\x5f\x3c\x50\x14\x95\xba\x23\xb8\x68"
+  },
+  {
+    "pass\0word", 9,
+    "sa\0lt", 5,
+    4096, 16,
+    GRUB_MD_SHA512,
+    "\x9d\x9e\x9c\x4c\xd2\x1f\xe4\xbe\x24\xd5\xb8\x24\x4c\x75\x96\x65"
  }
 };

@@ -80,7 +167,7 @@ pbkdf2_test (void)
    {
      gcry_err_code_t err;
      grub_uint8_t DK[32];
-      err = grub_crypto_pbkdf2 (GRUB_MD_SHA1,
+      err = grub_crypto_pbkdf2 (vectors[i].HMAC_variant,
 				(const grub_uint8_t *) vectors[i].P,
 				vectors[i].Plen,
 				(const grub_uint8_t *) vectors[i].S,
@@ -94,7 +94,7 @@ check_protocol (void)
  gop_handle = 0;

  grub_dprintf ("video", "GOP: no usable mode\n");
-
+  grub_free (handles);
  return 0;
 }

@@ -389,6 +389,16 @@
    { 0xa1, 0x92, 0xbf, 0x1d, 0x57, 0xd0, 0xb1, 0x89 } \
  }

+#define GRUB_EFI_MEMORY_ATTRIBUTES_TABLE_GUID \
+  { 0xdcfa911d, 0x26eb, 0x469f, \
+    { 0xa2, 0x20, 0x38, 0xb7, 0xdc, 0x46, 0x12, 0x20 } \
+  }
+
+#define GRUB_EFI_TCG2_FINAL_EVENTS_TABLE_GUID \
+  { 0x1e2ed096, 0x30e2, 0x4254, \
+    { 0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25 } \
+  }
+
 struct grub_efi_sal_system_table
 {
  grub_uint32_t signature;
@@ -22,11 +22,11 @@
 #include <grub/symbol.h>
 #include <grub/i386/pc/int_types.h>

+#ifdef GRUB_MACHINE_PCBIOS
 void EXPORT_FUNC (grub_bios_interrupt) (grub_uint8_t intno,
 					struct grub_bios_int_registers *regs)
     __attribute__ ((regparm(3)));

-#ifdef GRUB_MACHINE_PCBIOS
 extern struct grub_i386_idt *EXPORT_VAR(grub_realidt);
 #endif

@@ -1,5 +1,10 @@
 #!/bin/sh

+SDIR=$(realpath -e "$0")
+SDIR=${SDIR%/*}
+
+cd "$SDIR"
+
 rsync -Lrtvz translationproject.org::tp/latest/grub/ po

 autogenerated="en@quot en@hebrew de@hebrew en@cyrillic en@greek en@arabic en@piglatin de_CH"
@@ -0,0 +1,53 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
+#
+# DESCRIPTION
+#
+#   Check whether the given FLAG works with the linker or gives an error.
+#   (Warnings, however, are ignored)
+#
+#   ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
+#   success/failure.
+#
+#   If EXTRA-FLAGS is defined, it is added to the linker's default flags
+#   when the check is done.  The check is thus made with the flags: "LDFLAGS
+#   EXTRA-FLAGS FLAG".  This can for example be used to force the linker to
+#   issue an error when a bad flag is given.
+#
+#   INPUT gives an alternative input source to AC_LINK_IFELSE.
+#
+#   NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
+#   macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+#   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
+
+#serial 6
+
+AC_DEFUN([AX_CHECK_LINK_FLAG],
+[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
+AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
+AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
+  ax_check_save_flags=$LDFLAGS
+  LDFLAGS="$LDFLAGS $4 $1"
+  AC_LINK_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
+    [AS_VAR_SET(CACHEVAR,[yes])],
+    [AS_VAR_SET(CACHEVAR,[no])])
+  LDFLAGS=$ax_check_save_flags])
+AS_VAR_IF(CACHEVAR,yes,
+  [m4_default([$2], :)],
+  [m4_default([$3], :)])
+AS_VAR_POPDEF([CACHEVAR])dnl
+])dnl AX_CHECK_LINK_FLAGS
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if ! which cpio >/dev/null 2>&1; then
   echo "cpio not installed; cannot test cpio."
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,14 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
-
-if [ "x$EUID" = "x" ] ; then
-  EUID=`id -u`
-fi
-
-if [ "$EUID" != 0 ] ; then
-   exit 99
-fi
+set -ex

 if ! which mkfs.erofs >/dev/null 2>&1; then
   echo "mkfs.erofs not installed; cannot test erofs."
@@ -1,4 +1,4 @@
 #!@BUILD_SHEBANG@
-set -e
+set -ex

 true
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
 EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -38,6 +38,7 @@ fi
 COMMON_OPTS='${V:+--debug=$V} --cs-opts="--pbkdf-force-iterations 1000"'

 debug=${GRUB_SHELL_DEFAULT_DEBUG:-$GRUB_TEST_DEFAULT_DEBUG}
+builddir="@builddir@"

 _testcase() {
    local EXPECTEDRES=$1
@@ -92,95 +93,94 @@ testcase_fail() { _testcase 1 "$@"; }

 ### LUKS1 tests
 eval testcase "'LUKS1 test cryptsetup defaults:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS

 eval testcase "'LUKS1 test with twofish cipher:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        "--cs-opts='--cipher twofish-xts-plain64'"

 eval testcase "'LUKS1 test key file support:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        --keyfile

 eval testcase "'LUKS1 test key file with offset:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        --keyfile --cs-opts="--keyfile-offset=237"

 eval testcase "'LUKS1 test key file with offset and size:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        --keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"

 eval testcase "'LUKS1 test detached header support:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        --detached-header

 eval testcase "'LUKS1 test both detached header and key file:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        --keyfile --detached-header

 ### LUKS2 tests (mirroring the LUKS1 tests above)
 LUKS2_COMMON_OPTS="--luks=2 --cs-opts=--pbkdf=pbkdf2"
 eval testcase "'LUKS2 test cryptsetup defaults:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS

 eval testcase "'LUKS2 test with twofish cipher:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--cipher twofish-xts-plain64'"

 eval testcase "'LUKS2 test key file support:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        --keyfile

 eval testcase "'LUKS2 test key file with offset:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        --keyfile --cs-opts="--keyfile-offset=237"

 eval testcase "'LUKS2 test key file with offset and size:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        --keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"

 eval testcase "'LUKS2 test detached header support:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        --detached-header

 eval testcase "'LUKS2 test both detached header and key file:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        --keyfile --detached-header

 ### LUKS1 specific tests
 # Tests for xts-plain and xts-plain64 modes
 eval testcase "'LUKS1 test cryptsetup xts-plain:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        "--cs-opts='--cipher aes-xts-plain'"

 eval testcase "'LUKS1 test cryptsetup xts-plain64:'" \
-    @builddir@/grub-shell-luks-tester --luks=1 $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
        "--cs-opts='--cipher aes-xts-plain64'"

 ### LUKS2 specific tests
 eval testcase "'LUKS2 test with 1k sector size:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--sector-size 1024'"

 eval testcase "'LUKS2 test with 2k sector size:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--sector-size 2048'"

 eval testcase "'LUKS2 test with 4k sector size:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--sector-size 4096'"

 eval testcase "'LUKS2 test with non-default key slot:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--key-slot 5'"

 eval testcase "'LUKS2 test with different metadata size:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-opts='--luks2-metadata-size 512k'"

-# TODO: Expect a failure with LUKS2 volumes with argon2 key derivation
-eval testcase_fail "'LUKS2 test with argon2 pbkdf:'" \
-    @builddir@/grub-shell-luks-tester --luks=2 $COMMON_OPTS \
+eval testcase "'LUKS2 test with argon2 pbkdf:'" \
+    "$builddir/grub-shell-luks-tester" --luks=2 $COMMON_OPTS \
        "--cs-opts='--pbkdf-memory 32'" "--cs-opts='--pbkdf-parallel 1'"

 # Add good password to second slot and change first slot to unchecked password
@@ -192,7 +192,7 @@ cat >$csscript <<'EOF'
 EOF

 eval testcase "'LUKS2 test with second key slot and first slot using different password:'" \
-    @builddir@/grub-shell-luks-tester $LUKS2_COMMON_OPTS $COMMON_OPTS \
+    "$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
        "--cs-script='$csscript'"

 test -n "$debug" || rm "$csscript"
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # Run GRUB script in a Qemu instance
 # Copyright (C) 2010  Free Software Foundation, Inc.
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # create a randome file
 empty="`mktemp "${TMPDIR:-/tmp}/tmp.XXXXXXXXXX"`" || exit 99
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

@builddir@/grub-script-check <<EOF
 # comment 1
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # Run GRUB script in a Qemu instance
 # Copyright (C) 2010  Free Software Foundation, Inc.
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

@builddir@/grub-script-check << EOF
 echo "\\\$"
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # Run GRUB script in a Qemu instance
 # Copyright (C) 2010  Free Software Foundation, Inc.
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

@builddir@/grub-script-check <<EOF
 echo one;
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # grub-script-check refuses to pass a file with no commands; this usually
 # indicates a bug in the code generating that file.
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 . "@builddir@/grub-core/modinfo.sh"

@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if ! which xorriso >/dev/null 2>&1; then
   echo "xorriso not installed; cannot test iso9660."
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,5 +1,5 @@
 #! @BUILD_SHEBANG@
-set -e
+set -ex

 # Copyright (C) 2010  Free Software Foundation, Inc.
 #
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GRUB.  If not, see <http://www.gnu.org/licenses/>.

-set -e
+set -ex
 grubshell=@builddir@/grub-shell

 . "@builddir@/grub-core/modinfo.sh"
@@ -1,6 +1,6 @@
 #!@BUILD_SHEBANG@

-set -e
+set -ex

 if [ "x$EUID" = "x" ] ; then
  EUID=`id -u`