diff --git a/Documentation/releases/coreboot-4.21-relnotes.md b/Documentation/releases/coreboot-4.21-relnotes.md
index 8c34dcbafc..ae8353993e 100644
--- a/Documentation/releases/coreboot-4.21-relnotes.md
+++ b/Documentation/releases/coreboot-4.21-relnotes.md
@@ -24,6 +24,7 @@ Significant or interesting changes
 
 * Upgrade IASL from 20221020 to 20230331
 * Upgrade LLVM from 15.0.7 to 16.0.4
+* Upgrade nasm from 2.15.05 to 2.16.01
 
 Additional coreboot changes
 ---------------------------
diff --git a/util/crossgcc/buildgcc b/util/crossgcc/buildgcc
index 7abfaafe0e..f0fb803f21 100755
--- a/util/crossgcc/buildgcc
+++ b/util/crossgcc/buildgcc
@@ -43,7 +43,7 @@ IASL_VERSION=20230331
 # CLANG version number
 CLANG_VERSION=16.0.4
 CMAKE_VERSION=3.26.3
-NASM_VERSION=2.15.05
+NASM_VERSION=2.16.01
 
 # Filename for each package
 GMP_ARCHIVE="gmp-${GMP_VERSION}.tar.xz"
diff --git a/util/crossgcc/patches/nasm-2.16.01_handle_warning_files_while_building_in_a_directory.patch b/util/crossgcc/patches/nasm-2.16.01_handle_warning_files_while_building_in_a_directory.patch
new file mode 100644
index 0000000000..b8c97e93d9
--- /dev/null
+++ b/util/crossgcc/patches/nasm-2.16.01_handle_warning_files_while_building_in_a_directory.patch
@@ -0,0 +1,231 @@
+From 7e80d6b834cd792dbbd7a99fbff98e46cdd5789f Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@zytor.com>
+Date: Tue, 17 Jan 2023 13:05:55 -0800
+Subject: [PATCH] Make: handle warning files while building in a directory
+
+The dependency on the warning files breaks when we are building in a
+directory *and* the files already exist from being shipped with the
+distribution tarballs. The make VPATH simply isn't sophisticated
+enough to deal with it, so let the C compiler handle it by #including
+the generated file from a dummy C file.
+
+Reported-by: Rudi Heitbaum <rudi@heitbaum.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+---
+ Makefile.in          | 38 ++++++++++++++++++++------------------
+ Mkfiles/msvc.mak     | 14 +++++++-------
+ Mkfiles/openwcom.mak | 14 +++++++-------
+ doc/Makefile.in      |  2 +-
+ 6 files changed, 37 insertions(+), 34 deletions(-)
+
+diff --git a/Makefile.in b/Makefile.in
+index 148fcb50..95268fd2 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -37,8 +37,10 @@ AR		= @AR@
+ RANLIB		= @RANLIB@
+ STRIP		= @STRIP@
+ 
++tools		= $(top_srcdir)/tools
++
+ PERL		= perl
+-PERLFLAGS	= -I$(srcdir)/perllib -I$(srcdir)
++PERLFLAGS	= -I$(top_srcdir)/perllib -I$(srcdir)
+ RUNPERL         = $(PERL) $(PERLFLAGS)
+ 
+ PYTHON3		= python3
+@@ -65,8 +67,8 @@ LN_S		= @LN_S@
+ FIND		= find
+ 
+ # Binary suffixes
+-O              	= @OBJEXT@
+-X              	= @EXEEXT@
++O		= @OBJEXT@
++X		= @EXEEXT@
+ A		= @LIBEXT@
+ 
+ # Debug stuff
+@@ -194,14 +196,14 @@ PERLREQ = config/unconfig.h \
+ 	  x86/iflag.c x86/iflaggen.h \
+ 	  macros/macros.c \
+ 	  asm/pptok.ph asm/directbl.c asm/directiv.h \
+-	  asm/warnings.c include/warnings.h doc/warnings.src \
++	  $(WARNFILES) \
+ 	  misc/nasmtok.el \
+ 	  version.h version.mac version.mak nsis/version.nsh
+ 
+ INSDEP = x86/insns.dat x86/insns.pl x86/insns-iflags.ph x86/iflags.ph
+ 
+ config/unconfig.h: config/config.h.in
+-	$(RUNPERL) $(srcdir)/tools/unconfig.pl \
++	$(RUNPERL) $(tools)/unconfig.pl \
+ 		'$(srcdir)' config/config.h.in config/unconfig.h
+ 
+ x86/iflag.c: $(INSDEP)
+@@ -273,7 +275,7 @@ x86/regs.h: x86/regs.dat x86/regs.pl
+ # reasonable, but doesn't update the time stamp if the files aren't
+ # changed, to avoid rebuilding everything every time. Track the actual
+ # dependency by the empty file asm/warnings.time.
+-WARNFILES = asm/warnings.c include/warnings.h doc/warnings.src
++WARNFILES = asm/warnings_c.h include/warnings.h doc/warnings.src
+ 
+ warnings:
+ 	$(RM_F) $(WARNFILES) $(WARNFILES:=.time)
+@@ -283,11 +285,11 @@ asm/warnings.time: $(ALLOBJ_NW:.$(O)=.c)
+ 	: > asm/warnings.time
+ 	$(MAKE) $(WARNFILES:=.time)
+ 
+-asm/warnings.c.time: asm/warnings.pl asm/warnings.time
+-	$(RUNPERL) $(srcdir)/asm/warnings.pl c asm/warnings.c $(srcdir)
+-	: > asm/warnings.c.time
++asm/warnings_c.h.time: asm/warnings.pl asm/warnings.time
++	$(RUNPERL) $(srcdir)/asm/warnings.pl c asm/warnings_c.h $(srcdir)
++	: > asm/warnings_c.h.time
+ 
+-asm/warnings.c: asm/warnings.c.time
++asm/warnings_c.h: asm/warnings_c.h.time
+ 	@: Side effect
+ 
+ include/warnings.h.time: asm/warnings.pl asm/warnings.time
+@@ -506,8 +508,8 @@ EXTERNAL_DEPENDENCIES = 1
+ # the dependency information will remain external, so it doesn't
+ # pollute the git logs.
+ #
+-Makefile.dep: $(PERLREQ) tools/mkdep.pl config.status
+-	$(RUNPERL) tools/mkdep.pl -M Makefile.in -- $(DEPDIRS)
++Makefile.dep: $(PERLREQ) $(tools)/mkdep.pl config.status
++	$(RUNPERL) $(tools)/mkdep.pl -M Makefile.in -- $(DEPDIRS)
+ 
+ dep: Makefile.dep
+ 
+@@ -517,9 +519,9 @@ dep: Makefile.dep
+ # be invoked manually or via "make dist".  It should be run before
+ # creating release archives.
+ #
+-alldeps: $(PERLREQ) tools/syncfiles.pl tools/mkdep.pl
+-	$(RUNPERL) tools/syncfiles.pl Makefile.in Mkfiles/*.mak
+-	$(RUNPERL) tools/mkdep.pl -i -M Makefile.in Mkfiles/*.mak -- \
++alldeps: $(PERLREQ) $(tools)/syncfiles.pl $(tools)/mkdep.pl
++	$(RUNPERL) $(tools)/syncfiles.pl Makefile.in Mkfiles/*.mak
++	$(RUNPERL) $(tools)/mkdep.pl -i -M Makefile.in Mkfiles/*.mak -- \
+ 		$(DEPDIRS)
+ 	$(RM_F) *.dep
+ 	if [ -f config.status ]; then \
+@@ -528,9 +530,9 @@ alldeps: $(PERLREQ) tools/syncfiles.pl tools/mkdep.pl
+ 
+ # Strip internal dependency information from all Makefiles; this makes
+ # the output good for git checkin
+-cleandeps: $(PERLREQ) tools/syncfiles.pl tools/mkdep.pl
+-	$(RUNPERL) tools/syncfiles.pl Makefile.in Mkfiles/*.mak
+-	$(RUNPERL) tools/mkdep.pl -e -M Makefile.in Mkfiles/*.mak -- \
++cleandeps: $(PERLREQ) $(tools)/syncfiles.pl $(tools)/mkdep.pl
++	$(RUNPERL) $(tools)/syncfiles.pl Makefile.in Mkfiles/*.mak
++	$(RUNPERL) $(tools)/mkdep.pl -e -M Makefile.in Mkfiles/*.mak -- \
+ 		$(DEPDIRS)
+ 	$(RM_F) *.dep
+ 	if [ -f config.status ]; then \
+diff --git a/Mkfiles/msvc.mak b/Mkfiles/msvc.mak
+index cf71fffc..da71c5c6 100644
+--- a/Mkfiles/msvc.mak
++++ b/Mkfiles/msvc.mak
+@@ -153,14 +153,14 @@ PERLREQ = config\unconfig.h \
+ 	  x86\iflag.c x86\iflaggen.h \
+ 	  macros\macros.c \
+ 	  asm\pptok.ph asm\directbl.c asm\directiv.h \
+-	  asm\warnings.c include\warnings.h doc\warnings.src \
++	  $(WARNFILES) \
+ 	  misc\nasmtok.el \
+ 	  version.h version.mac version.mak nsis\version.nsh
+ 
+ INSDEP = x86\insns.dat x86\insns.pl x86\insns-iflags.ph x86\iflags.ph
+ 
+ config\unconfig.h: config\config.h.in
+-	$(RUNPERL) $(srcdir)\tools\unconfig.pl \
++	$(RUNPERL) $(tools)\unconfig.pl \
+ 		'$(srcdir)' config\config.h.in config\unconfig.h
+ 
+ x86\iflag.c: $(INSDEP)
+@@ -232,7 +232,7 @@ x86\regs.h: x86\regs.dat x86\regs.pl
+ # reasonable, but doesn't update the time stamp if the files aren't
+ # changed, to avoid rebuilding everything every time. Track the actual
+ # dependency by the empty file asm\warnings.time.
+-WARNFILES = asm\warnings.c include\warnings.h doc\warnings.src
++WARNFILES = asm\warnings_c.h include\warnings.h doc\warnings.src
+ 
+ warnings:
+ 	$(RM_F) $(WARNFILES) $(WARNFILES:=.time)
+@@ -242,11 +242,11 @@ asm\warnings.time: $(ALLOBJ_NW:.$(O)=.c)
+ 	: > asm\warnings.time
+ 	$(MAKE) $(WARNFILES:=.time)
+ 
+-asm\warnings.c.time: asm\warnings.pl asm\warnings.time
+-	$(RUNPERL) $(srcdir)\asm\warnings.pl c asm\warnings.c $(srcdir)
+-	: > asm\warnings.c.time
++asm\warnings_c.h.time: asm\warnings.pl asm\warnings.time
++	$(RUNPERL) $(srcdir)\asm\warnings.pl c asm\warnings_c.h $(srcdir)
++	: > asm\warnings_c.h.time
+ 
+-asm\warnings.c: asm\warnings.c.time
++asm\warnings_c.h: asm\warnings_c.h.time
+ 	@: Side effect
+ 
+ include\warnings.h.time: asm\warnings.pl asm\warnings.time
+diff --git a/Mkfiles/openwcom.mak b/Mkfiles/openwcom.mak
+index 5394d85d..605f9afe 100644
+--- a/Mkfiles/openwcom.mak
++++ b/Mkfiles/openwcom.mak
+@@ -166,14 +166,14 @@ PERLREQ = config\unconfig.h &
+ 	  x86\iflag.c x86\iflaggen.h &
+ 	  macros\macros.c &
+ 	  asm\pptok.ph asm\directbl.c asm\directiv.h &
+-	  asm\warnings.c include\warnings.h doc\warnings.src &
++	  $(WARNFILES) &
+ 	  misc\nasmtok.el &
+ 	  version.h version.mac version.mak nsis\version.nsh
+ 
+ INSDEP = x86\insns.dat x86\insns.pl x86\insns-iflags.ph x86\iflags.ph
+ 
+ config\unconfig.h: config\config.h.in
+-	$(RUNPERL) $(srcdir)\tools\unconfig.pl &
++	$(RUNPERL) $(tools)\unconfig.pl &
+ 		'$(srcdir)' config\config.h.in config\unconfig.h
+ 
+ x86\iflag.c: $(INSDEP)
+@@ -245,7 +245,7 @@ x86\regs.h: x86\regs.dat x86\regs.pl
+ # reasonable, but doesn't update the time stamp if the files aren't
+ # changed, to avoid rebuilding everything every time. Track the actual
+ # dependency by the empty file asm\warnings.time.
+-WARNFILES = asm\warnings.c include\warnings.h doc\warnings.src
++WARNFILES = asm\warnings_c.h include\warnings.h doc\warnings.src
+ 
+ warnings:
+ 	$(RM_F) $(WARNFILES) $(WARNFILES:=.time)
+@@ -255,11 +255,11 @@ asm\warnings.time: $(ALLOBJ_NW:.$(O)=.c)
+ 	: > asm\warnings.time
+ 	$(MAKE) $(WARNFILES:=.time)
+ 
+-asm\warnings.c.time: asm\warnings.pl asm\warnings.time
+-	$(RUNPERL) $(srcdir)\asm\warnings.pl c asm\warnings.c $(srcdir)
+-	: > asm\warnings.c.time
++asm\warnings_c.h.time: asm\warnings.pl asm\warnings.time
++	$(RUNPERL) $(srcdir)\asm\warnings.pl c asm\warnings_c.h $(srcdir)
++	: > asm\warnings_c.h.time
+ 
+-asm\warnings.c: asm\warnings.c.time
++asm\warnings_c.h: asm\warnings_c.h.time
+ 	@: Side effect
+ 
+ include\warnings.h.time: asm\warnings.pl asm\warnings.time
+diff --git a/doc/Makefile.in b/doc/Makefile.in
+index e92437a0..1c8393c5 100644
+--- a/doc/Makefile.in
++++ b/doc/Makefile.in
+@@ -20,7 +20,7 @@ INSTALL		= @INSTALL@
+ INSTALL_PROGRAM	= @INSTALL_PROGRAM@
+ INSTALL_DATA	= @INSTALL_DATA@
+ 
+-PERL		= perl -I$(srcdir)
++PERL		= perl -I$(top_srcdir)/perllib -I$(srcdir)
+ 
+ PDFOPT		= @PDFOPT@
+ 
diff --git a/util/crossgcc/sum/nasm-2.15.05.tar.bz2.cksum b/util/crossgcc/sum/nasm-2.15.05.tar.bz2.cksum
deleted file mode 100644
index 4ee4fec61c..0000000000
--- a/util/crossgcc/sum/nasm-2.15.05.tar.bz2.cksum
+++ /dev/null
@@ -1 +0,0 @@
-c0869e9ac854140bf99c989a711102ce6367243f  tarballs/nasm-2.15.05.tar.bz2
diff --git a/util/crossgcc/sum/nasm-2.16.01.tar.bz2.cksum b/util/crossgcc/sum/nasm-2.16.01.tar.bz2.cksum
new file mode 100644
index 0000000000..9e7437f64c
--- /dev/null
+++ b/util/crossgcc/sum/nasm-2.16.01.tar.bz2.cksum
@@ -0,0 +1 @@
+cee9844c0c80c248ee1005c390223984332abeb8  tarballs/nasm-2.16.01.tar.bz2