Sync with stable:

SOURCES/0327-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch

@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fedora Ninjas <grub2-owner@fedoraproject.org>
+Date: Tue, 8 Aug 2023 05:44:48 -0400
+Subject: [PATCH] grub-mkconfig dont overwrite BLS cmdline if BLSCFG
+
+If GRUB_ENABLE_BLSCFG is true, running grub2-mkconfig will not
+overwrite kernel cmdline in BLS snippets with what is in
+GRUB_CMDLINE_LINUX in /etc/default/grub. Update can be forced by
+sending new arg --update-bls-cmdline
+
+Signed-off-by: mkl <mlewando@redhat.com>
+---
+ util/grub-mkconfig.in   | 10 ++++++++++
+ util/grub.d/10_linux.in |  4 +++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
+index 520a672cd2c8..30a2d097823d 100644
+--- a/util/grub-mkconfig.in
++++ b/util/grub-mkconfig.in
+@@ -51,6 +51,7 @@ export TEXTDOMAIN=@PACKAGE@
+ export TEXTDOMAINDIR="@localedir@"
+ 
+ export GRUB_GRUBENV_UPDATE="yes"
++export GRUB_UPDATE_BLS_CMDLINE="yes"
+ 
+ . "${pkgdatadir}/grub-mkconfig_lib"
+ 
+@@ -62,6 +63,7 @@ usage () {
+     echo
+     print_option_help "-o, --output=$(gettext FILE)" "$(gettext "output generated config to FILE [default=stdout]")"
+     print_option_help "--no-grubenv-update" "$(gettext "do not update variables in the grubenv file")"
++    print_option_help "--update-bls-cmdline" "$(gettext "overwrite BLS cmdline args with default args")"
+     print_option_help "-h, --help" "$(gettext "print this message and exit")"
+     print_option_help "-V, --version" "$(gettext "print the version information and exit")"
+     echo
+@@ -100,6 +102,9 @@ do
+     --no-grubenv-update)
+ 	GRUB_GRUBENV_UPDATE="no"
+ 	;;
++    --update-bls-cmdline)
++	bls_cmdline_update=true
++	;;
+     -*)
+ 	gettext_printf "Unrecognized option \`%s'\n" "$option" 1>&2
+ 	usage
+@@ -167,6 +172,11 @@ fi
+ 
+ eval "$("${grub_get_kernel_settings}")" || true
+ 
++if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ] && \
++	[ "x${bls_cmdline_update}" != "xtrue" ]; then
++    GRUB_UPDATE_BLS_CMDLINE="no"
++fi
++
+ if [ "x${GRUB_DISABLE_UUID}" = "xtrue" ]; then
+   if [ -z "${GRUB_DISABLE_LINUX_UUID}" ]; then
+     GRUB_DISABLE_LINUX_UUID="true"
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 4795a63b4ce6..76fc21fb6528 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -265,7 +265,9 @@ if [ -z "\${kernelopts}" ]; then
+ fi
+ EOF
+ 
+-  if [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ]; then
++  if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ] || \
++	  ( [ -w /etc/kernel ] && [[ ! -f /etc/kernel/cmdline ]] && \
++	  [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ] ); then
+       update_bls_cmdline
+   fi
+ 

SOURCES/0328-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch

@@ -0,0 +1,37 @@
+From f4f134582912851628e15df4963b3b8a6652aa26 Mon Sep 17 00:00:00 2001
+From: Marta Lewandowska <mlewando@redhat.com>
+Date: Tue, 29 Aug 2023 16:40:47 +0200
+Subject: [PATCH] grub2-mkconfig: Pass all boot params when used by anaconda
+
+Previous patch makes it so that the machine can boot, but not all
+boot params are passed from /etc/default/grub to BLS snippets
+because /etc/default/grub gets written by anaconda during boot
+loader installation, long after grub rpms first got installed.
+
+Signed-off-by: Marta Lewandowska <mlewando@redhat.com>
+---
+ util/grub.d/10_linux.in | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index 76fc21fb6528..041a11529588 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -265,9 +265,11 @@ if [ -z "\${kernelopts}" ]; then
+ fi
+ EOF
+ 
+-  if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ] || \
+-	  ( [ -w /etc/kernel ] && [[ ! -f /etc/kernel/cmdline ]] && \
+-	  [ "x${GRUB_GRUBENV_UPDATE}" = "xyes" ] ); then
++  if [ "x${GRUB_UPDATE_BLS_CMDLINE}" = "xyes" ] || [[ -d /run/install ]]; then
++      # only update the bls cmdline if the user specifically requests it or _anytime_
++      # in the installer environment: /run/install directory only exists during the
++      # installation and not in cloud images, so this should get all the boot params
++      # from /etc/default/grub into BLS snippets
+       update_bls_cmdline
+   fi
+ 
+-- 
+2.41.0
+

SOURCES/grub.macros

@@ -30,6 +30,7 @@
 		-e 's/-fcf-protection//g'			\\\
 		-e 's/-fasynchronous-unwind-tables//g'		\\\
 		-e 's/^/ -fno-strict-aliasing /'		\\\
+		-e 's,-march=x86-64-v[[:alnum:]._-]*,-march=x86-64,g' \\\
 		%{nil}
 
 %global host_cflags %{expand:%%(echo %{build_cflags} %{?_hardening_cflags} | %{cflags_sed})}

SOURCES/grub.patches

@@ -324,3 +324,5 @@ Patch0323: 0323-util-Enable-default-kernel-for-updates.patch
 Patch0324: 0324-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
 Patch0325: 0325-kern-ieee1275-init-Extended-support-in-Vec5.patch
 Patch0326: 0326-efi-http-change-uint32_t-to-uintn_t.patch
+Patch0327: 0327-grub-mkconfig-dont-overwrite-BLS-cmdline-if-BLSCFG.patch
+Patch0328: 0328-grub2-mkconfig-Pass-all-boot-params-when-used-by-ana.patch

SPECS/grub2.spec

@@ -1,7 +1,3 @@
-%global efi_vendor almalinux
-%global efidir almalinux
-%global efi_esp_dir /boot/efi/EFI/%{efidir}
-
 # This package calls binutils components directly and would need to pass
 # in flags to enable the LTO plugins
 # Disable LTO
@@ -20,7 +16,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	61%{?dist}.1.alma
+Release:	70%{?dist}.1.alma.1
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -48,6 +44,7 @@ Source12:	sbat.csv.in
 
 %define sb_key		almalinuxsecurebootca0
 
+
 BuildRequires:	gcc efi-srpm-macros
 BuildRequires:	flex bison binutils python3
 BuildRequires:	ncurses-devel xz-devel bzip2-devel
@@ -90,6 +87,7 @@ hardware devices.\
 # AlmaLinux: keep upstream EVR for RHEL SBAT entry
 %define rhel_version_release $(echo %{version}-%{release} | sed 's/\.alma.*//')
 
+
 # generate with do-rebase
 %include %{SOURCE11}
 
@@ -526,18 +524,52 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
-* Thu Aug 03 2023 Eduard Abdullin <eabdullin@almalinux.org> - 2.06-61.1.alma
+* Mon Oct 09 2023 Eduard Abdullin <eabdullin@almalinux.org> - 2.06-70.alma.1
 - Debrand for AlmaLinux
 
-* Wed Jun 07 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-61.1
+* Tue Aug 29 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-70
+- grub2-mkconfig: Pass all boot params when used by anaconda
+- Resolves: #RHEL-2185
+
+* Thu Aug 24 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-69
+- grub2-mkconfig: dont overwrite BLS cmdline if BLSCFG is true
+- This is an updated version of the 2.06-67 patch
+- Resolves: #2203203
+- Resolves: #2212320
+- Resolves: #2221543
+
+* Wed Aug 2 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-68
+- Revert previous patch as it breaks install
+- Related: #2203203
+- Related: #2212320
+- Related: #2221543
+
+* Mon Jul 24 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-67
+- grub2-mkconfig: dont overwrite BLS cmdline if BLSCFG is true
+- Resolves: #2203203
+- Resolves: #2212320
+- Resolves: #2221543
+
+* Thu Jul 20 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-66
+- build with baseline ISA flags
+- Resolves: #2215860
+
+* Wed Jun 07 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-65
 - efi/http: change uint32_t to uintn_t
 - Resolves: #2207851
+
+* Fri May 26 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-64
 - kern/ieee1275/init: sync vec5 patchset with upstream
 - Resolves: #2183939
+
+* Wed May 24 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-63
 - util: Enable default kernel for updates
 - Resolves: #2184069
+
+* Tue May 23 2023 Javier Martinez Canillas <javierm@redhat.com> - 2.06-62
 - 20-grub-install: Explicitly check '+debug' suffix for debug kernels
 - Resolves: #2148351
+
 * Mon Feb 20 2023 Robbie Harwood <rharwood@redhat.com> - 2.06-61
 - ppc64le sysfs and mm update
 - Resolves: #2026579