Merge branch 'master' of https://github.com/osresearch/heads into tlaurion/x230-fbwhiptail

2024-12-18 20:47:55 +00:00 · 2018-05-05 02:03:47 -04:00 · 2018-05-05 02:03:47 -04:00 · 7b57db976f
commit 7b57db976f
parent f34e43a1a3 492b94afb5
41 changed files with 1195 additions and 2925 deletions
--- a/195
+++ b/195
@ -1,6 +1,12 @@
 all:
 -include .config

+ifneq "$(TOOLCHAIN)" ""
+$(info Using $(TOOLCHAIN) for cross compiler and packages)
+packages	:= $(TOOLCHAIN)/packages
+CROSS		:= $(TOOLCHAIN)/crossgcc/x86_64-linux-musl/bin/x86_64-linux-musl-
+endif
+
 modules-y 	:=
 pwd 		:= $(shell pwd)
 packages 	?= $(pwd)/packages
@ -17,10 +23,11 @@ CPUS		:= $(shell nproc)
 BUILD_LOG := $(shell mkdir -p "$(log_dir)" )

 # Check that we have a correct version of make
+# that matches at least the major version
 LOCAL_MAKE_VERSION := $(shell $(MAKE) --version | head -1 | cut -d' ' -f3)
 include modules/make

-ifeq "$(LOCAL_MAKE_VERSION)" "$(make_version)"
+ifneq "" "$(filter $(make_version)%,$(LOCAL_MAKE_VERSION))"

 # This is the correct version of Make

@ -42,6 +49,12 @@ CONFIG_HEADS	?= y
 # Some things want usernames, we use the current checkout
 # so that they are reproducible
 GIT_HASH	:= $(shell git rev-parse HEAD)
+GIT_STATUS	:= $(shell \
+	if git diff --exit-code >/dev/null ; then \
+		echo clean ; \
+	else \
+		echo dirty ; \
+	fi)

 # Timestamps should be in ISO format
 DATE=`date --rfc-3339=seconds`
@ -65,9 +78,11 @@ endif


 # Create a temporary directory for the initrd
-initrd_dir	:= $(shell mktemp -d)
-initrd_lib_dir	:= $(initrd_dir)/lib
-initrd_bin_dir	:= $(initrd_dir)/bin
+initrd_dir	:= $(BOARD)
+initrd_tmp_dir	:= $(shell mktemp -d)
+initrd_lib_dir	:= $(initrd_tmp_dir)/lib
+initrd_bin_dir	:= $(initrd_tmp_dir)/bin
+modules-y += initrd

 $(shell mkdir -p "$(initrd_lib_dir)" "$(initrd_bin_dir)")

@ -112,11 +127,8 @@ else
 $(error "$(BOARD): neither CONFIG_COREBOOT nor CONFIG_LINUXBOOT is set?")
 endif

-# helpful targets for common uses
-linux: $(build)/$(BOARD)/bzImage
-cpio: $(build)/$(BOARD)/initrd.cpio.xz
-
 # Disable all built in rules
+.INTERMEDIATE:
 .SUFFIXES:
 FORCE:

@ -133,10 +145,6 @@ endef
 # as part of creating the Heads firmware image.
 include modules/*

-# These will be built via their intermediate targets
-# This increases the build time, so it is commented out for now
-#all: $(foreach m,$(modules-y),$m.intermediate)
-
 define bins =
 $(foreach m,$1,$(call prefix,$(build)/$($m_dir)/,$($m_output)))
 endef
@ -155,7 +163,7 @@ endef
 # Build a cpio from a directory
 #
 define do-cpio =
-	$(call do,CPIO,$1,\
+	$(call do,CPIO     ,$1,\
 		( cd "$2"; \
 		find . \
 		| cpio \
@ -169,17 +177,19 @@ define do-cpio =
 	@if ! cmp --quiet "$1.tmp" "$1" ; then \
 		mv "$1.tmp" "$1" ; \
 	else \
+		echo "$(DATE) UNCHANGED $(1:$(pwd)/%=%)" ; \
 		rm "$1.tmp" ; \
 	fi
 endef

 define do-copy =
-	$(call do,COPY,$1 => $2',\
-		sha256sum "$(1:$(pwd)/%=%)" ; \
-		if ! cmp --quiet "$1" "$2" ; then \
-			cp -a "$1" "$2"; \
-		fi
+	$(call do,INSTALL  ,$1 => $2,\
+		if cmp --quiet "$1" "$2" ; then \
+			echo "$(DATE) UNCHANGED $(1:$(pwd)/%=%)" ; \
+		fi ; \
+		cp -a "$1" "$2" ; \
 	)
+	@sha256sum "$(2:$(pwd)/%=%)"
 endef


@ -190,21 +200,25 @@ endef
 # expansion during the first evaluation.
 #
 define define_module =
+  # if they have not defined a separate base dir, define it
+  # as the same as their build dir.
+  $(eval $1_base_dir = $(or $($1_base_dir),$($1_dir)))
+
  ifneq ("$($1_repo)","")
    # Checkout the tree instead and touch the canary file so that we know
    # that the files are all present. No signature hashes are checked in
    # this case, since we don't have a stable version to compare against.
-    $(build)/$($1_dir)/.canary:
-	git clone $($1_repo) "$(build)/$($1_dir)"
+    $(build)/$($1_base_dir)/.canary:
+	git clone $($1_repo) "$(build)/$($1_base_dir)"
 	if [ -r patches/$1.patch ]; then \
-		( cd $(build)/$($1_dir) ; patch -p1 ) \
+		( cd $(build)/$($1_base_dir) ; patch -p1 ) \
 			< patches/$1.patch; \
 	fi
 	if [ -d patches/$1 ] && \
 	   [ -r patches/$1 ] ; then \
 		for patch in patches/$1/*.patch ; do \
 			echo "Applying patch file : $$$$patch " ;  \
-			( cd $(build)/$($1_dir) ; patch -p1 ) \
+			( cd $(build)/$($1_base_dir) ; patch -p1 ) \
 				< $$$$patch ; \
 		done ; \
 	fi
@ -219,17 +233,17 @@ define define_module =

    # Unpack the tar file and touch the canary so that we know
    # that the files are all present
-    $(build)/$($1_dir)/.canary: $(packages)/.$1-$($1_version)_verify
+    $(build)/$($1_base_dir)/.canary: $(packages)/.$1-$($1_version)_verify
 	tar -xf "$(packages)/$($1_tar)" -C "$(build)"
 	if [ -r patches/$1-$($1_version).patch ]; then \
-		( cd $(build)/$($1_dir) ; patch -p1 ) \
+		( cd $(build)/$($1_base_dir) ; patch -p1 ) \
 			< patches/$1-$($1_version).patch; \
 	fi
 	if [ -d patches/$1-$($1_version) ] && \
 	   [ -r patches/$1-$($1_version) ] ; then \
 		for patch in patches/$1-$($1_version)/*.patch ; do \
 			echo "Applying patch file : $$$$patch " ;  \
-			( cd $(build)/$($1_dir) ; patch -p1 ) \
+			( cd $(build)/$($1_base_dir) ; patch -p1 ) \
 				< $$$$patch ; \
 		done ; \
 	fi
@ -242,21 +256,29 @@ define define_module =

  ifeq "$($1_config)" ""
    # There is no official .config file
-    $($1_config_file_path): $(build)/$($1_dir)/.canary
+    $($1_config_file_path): $(build)/$($1_base_dir)/.canary
 	@mkdir -p $$(dir $$@)
 	@touch "$$@"
  else
    # Copy the stored config file into the unpacked directory
-    $($1_config_file_path): $($1_config) $(build)/$($1_dir)/.canary
+    $($1_config_file_path): $($1_config) $(build)/$($1_base_dir)/.canary
 	@mkdir -p $$(dir $$@)
 	$(call do-copy,$($1_config),$$@)
  endif

+  # The first time we have to wait for all the dependencies to be built
+  # before we can configure the target. Once the dep has been built,
+  # we only depend on it for a rebuild.
+  $(eval $1_config_wait := $(foreach d,$($1_depends),\
+	$(shell [ -r $(build)/$($d_dir)/.build ] || echo $d)))
+
  # Use the module's configure variable to build itself
+  # this has to wait for the dependencies to be built since
+  # cross compilers and libraries might be messed up
  $(dir $($1_config_file_path)).configured: \
-		$(build)/$($1_dir)/.canary \
+		$(build)/$($1_base_dir)/.canary \
+		$(foreach d,$($1_config_wait),$(build)/$($d_dir)/.build) \
 		$($1_config_file_path) \
-		$(foreach d,$($1_depends),$(call outputs,$d)) \
 		modules/$1
 	@echo "$(DATE) CONFIG $1"
 	@( \
@ -270,16 +292,23 @@ define define_module =
 		$(VERBOSE_REDIRECT)
 	@touch "$$@"

-  # All of the outputs should result from building the intermediate target
-  $(call outputs,$1): $1.intermediate
-
-  # Short hand target for the module
-  #$1: $(call outputs,$1)
+  # Short hand for our module build target
+  $1: \
+	$(build)/$($1_dir)/.build \
+	$(call outputs,$1) \

  # Target for all of the outputs, which depend on their dependent modules
-  $1.intermediate: \
-		$(foreach d,$($1_depends),$d.intermediate) \
-		$(foreach d,$($1_depends),$(call outputs,$d)) \
+  # being built, as well as this module being configured
+  $(call outputs,$1): $(build)/$($1_dir)/.build
+
+  # If any of the outputs are missing, we should force a rebuild
+  # of the entire module
+  $(eval $1.force = $(shell \
+	stat $(call outputs,$1) >/dev/null 2>/dev/null || echo FORCE \
+  ))
+
+  $(build)/$($1_dir)/.build: $($1.force) \
+		$(foreach d,$($1_depends),$(build)/$($d_dir)/.build) \
 		$(dir $($1_config_file_path)).configured \

 	@echo "$(DATE) MAKE $1"
@ -301,7 +330,11 @@ define define_module =
 		tail -20 "$(log_dir)/$1.log"; \
 		exit 1; \
 	)
-	@echo "$(DATE) DONE $1"
+	$(call do,DONE,$1,\
+		touch $(build)/$($1_dir)/.build \
+	)
+
+

  $1.clean:
 	-$(RM) "$(build)/$($1_dir)/.configured"
@ -312,7 +345,7 @@ endef
 $(call map, define_module, $(modules-y))

 # hack to force musl-cross to be built before musl
-#$(build)/$(musl_dir)/.configured: $(build)/$(musl-cross_dir)/../../crossgcc/x86_64-linux-musl/bin/x86_64-linux-musl-gcc
+#$(build)/$(musl_dir)/.configured: $(build)/$(musl-cross_dir)/../../crossgcc/x86_64-linux-musl/bin/x86_64-musl-linux-gcc

 #
 # Install a file into the initrd, if it changed from
@ -366,27 +399,12 @@ $(foreach m, $(modules-y), \
 	$(call map,initrd_lib_add,$(call libs,$m)) \
 )

-# hack to install busybox into the initrd if busybox is configured
-ifeq "$(CONFIG_BUSYBOX)" "y"
-$(build)/$(BOARD)/heads.cpio: busybox.intermediate
-initrd_bins += $(initrd_bin_dir)/busybox
-endif
-
-$(initrd_bin_dir)/busybox: $(build)/$(busybox_dir)/busybox
-	$(do,SYMLINK,$@,$(MAKE) \
-		-C $(build)/$(busybox_dir) \
-		CC="$(heads_cc)" \
-		CONFIG_PREFIX="$(pwd)/initrd" \
-		$(MAKE_JOBS) \
-		install \
-	)
-
 #
 # hack to build cbmem from coreboot
 # this must be built *AFTER* musl, but since coreboot depends on other things
 # that depend on musl it should be ok.
 #
-COREBOOT_UTIL_DIR=$(build)/$(coreboot_dir)/util
+COREBOOT_UTIL_DIR=$(build)/$(coreboot_base_dir)/util
 ifeq ($(CONFIG_COREBOOT),y)
 $(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/cbmem/cbmem))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/superiotool/superiotool))
@ -396,14 +414,16 @@ endif
 $(COREBOOT_UTIL_DIR)/cbmem/cbmem \
 $(COREBOOT_UTIL_DIR)/superiotool/superiotool \
 $(COREBOOT_UTIL_DIR)/inteltool/inteltool \
-: $(build)/$(coreboot_dir)/.canary \
-	musl.intermediate
+: $(build)/$(coreboot_base_dir)/.canary \
+	$(build)/$(musl_dir)/.build
 	+$(call do,MAKE,$(notdir $@),\
 		$(MAKE) -C "$(dir $@)" $(CROSS_TOOLS) \
 	)

 # superio depends on zlib and pciutils
-$(COREBOOT_UTIL_DIR)/superiotool/superiotool: zlib.intermediate pciutils.intermediate
+$(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
+	$(build)/$(zlib_dir)/.build \
+	$(build)/$(pciutils_dir)/.build \

 #
 # initrd image creation
@ -423,28 +443,35 @@ $(COREBOOT_UTIL_DIR)/superiotool/superiotool: zlib.intermediate pciutils.interme
 #

 initrd-y += $(pwd)/blobs/dev.cpio
-initrd-y += $(build)/$(BOARD)/modules.cpio
-initrd-y += $(build)/$(BOARD)/tools.cpio
-initrd-$(CONFIG_HEADS) += $(build)/$(BOARD)/heads.cpio
+initrd-y += $(build)/$(initrd_dir)/modules.cpio
+initrd-y += $(build)/$(initrd_dir)/tools.cpio
+initrd-$(CONFIG_HEADS) += $(build)/$(initrd_dir)/heads.cpio

-initrd.intermediate: $(build)/$(BOARD)/initrd.cpio.xz
-$(build)/$(BOARD)/initrd.cpio.xz: $(initrd-y)
-	$(call do,CPIO-CLEAN,$@,\
+#$(build)/$(initrd_dir)/.build: $(build)/$(initrd_dir)/initrd.cpio.xz
+
+$(build)/$(initrd_dir)/initrd.cpio.xz: $(initrd-y)
+	$(call do,CPIO-XZ  ,$@,\
 	$(pwd)/bin/cpio-clean \
 		$^ \
 	| xz \
 		--check=crc32 \
 		--lzma2=dict=1MiB \
 		-9 \
-	| dd bs=512 conv=sync > "$@" \
+	| dd bs=512 conv=sync status=none > "$@.tmp" \
 	)
-	@sha256sum "$(@:$(pwd)/%=%)"
+	@if ! cmp --quiet "$@.tmp" "$@" ; then \
+		mv "$@.tmp" "$@" ; \
+		sha256sum "$(@:$(pwd)/%=%)" ; \
+	else \
+		echo "$(DATE) UNCHANGED $(@:$(pwd)/%=%)" ; \
+		rm "$@.tmp" ; \
+	fi

 #
 # The heads.cpio is built from the initrd directory in the
 # Heads tree.
 #
-$(build)/$(BOARD)/heads.cpio: FORCE
+$(build)/$(initrd_dir)/heads.cpio: FORCE
 	$(call do-cpio,$@,$(pwd)/initrd)


@ -452,29 +479,35 @@ $(build)/$(BOARD)/heads.cpio: FORCE
 # The tools initrd is made from all of the things that we've
 # created during the submodule build.
 #
-$(build)/$(BOARD)/tools.cpio: \
+$(build)/$(initrd_dir)/tools.cpio: \
 	$(initrd_bins) \
 	$(initrd_libs) \
+	$(initrd_tmp_dir)/etc/config \

+	$(call do-cpio,$@,$(initrd_tmp_dir))
+	@$(RM) -rf "$(initrd_tmp_dir)"
+
+$(initrd_tmp_dir)/etc/config: FORCE
+	@mkdir -p $(dir $@)
 	$(call do,INSTALL,$(CONFIG), \
-		mkdir -p "$(initrd_dir)/etc" ; \
 		export \
 			| grep ' CONFIG_' \
 			| sed -e 's/^declare -x /export /' \
 			-e 's/\\\"//g' \
-			> "$(initrd_dir)/etc/config" \
+			> $@ \
+	)
+	$(call do,HASH,$(GIT_HASH) $(GIT_STATUS), \
+		echo export GIT_HASH=\'$(GIT_HASH)\' \
+		>> $@ ; \
+		echo export GIT_STATUS=$(GIT_STATUS) \
+		>> $@ ; \
 	)
-	$(call do-cpio,$@,$(initrd_dir))
-	@$(RM) -rf "$(initrd_dir)"

+# Ensure that the initrd depends on all of the modules that produce
+# binaries for it
+$(build)/$(initrd_dir)/tools.cpio: $(foreach d,$(bin_modules-y),$(build)/$($d_dir)/.build)


-# This produces a ROM image that is written with the flashrom program
-$(build)/$(BOARD)/coreboot.rom: $(build)/$(coreboot_dir)/$(BOARD)/coreboot.rom
-	"$(build)/$(coreboot_dir)/$(BOARD)/cbfstool" "$<" print
-	$(call do,EXTRACT,$@,mv "$<" "$@")
-	@sha256sum "$(@:$(pwd)/%=%)"
-
 # List of all modules, excluding the slow to-build modules
 modules-slow := musl musl-cross kernel_headers
 module_dirs := $(foreach m,$(filter-out $(modules-slow),$(modules-y)),$($m_dir))
@ -501,10 +534,6 @@ real.clean:
 	done
 	rm -rf ./install

-bootstrap:
-	+$(MAKE) \
-		musl-cross.intermediate \
-		$(build)/$(coreboot_dir)/util/crossgcc/xgcc/bin/i386-elf-gcc \

 else
 # Wrong make version detected -- build our local version
@ -515,7 +544,7 @@ HEADS_MAKE := $(build)/$(make_dir)/make
 # Once we have a proper Make, we can just pass arguments into it
 all bootstrap linux cpio: $(HEADS_MAKE)
 	LANG=C MAKE=$(HEADS_MAKE) $(HEADS_MAKE) $(MAKE_JOBS) $@
-%.clean %.intermediate %.vol: $(HEADS_MAKE)
+%.clean %.vol: $(HEADS_MAKE)
 	LANG=C MAKE=$(HEADS_MAKE) $(HEADS_MAKE) $@

 # How to download and build the correct version of make
--- a/boards/kgpe-d16/kgpe-d16.config
+++ b/boards/kgpe-d16/kgpe-d16.config
@ -1,5 +1,5 @@
 # Configuration for a kgpe-d16 running non-Qubes
-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_COREBOOT_CONFIG=config/coreboot-kgpe-d16.config
 CONFIG_LINUX_CONFIG=config/linux-kgpe-d16.config

--- a/boards/librem13v2/librem13v2.config
+++ b/boards/librem13v2/librem13v2.config
@ -2,7 +2,7 @@
 CONFIG_LINUX_CONFIG=config/linux-librem13v2.config
 CONFIG_COREBOOT_CONFIG=config/coreboot-librem13v2.config

-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
@ -32,3 +32,5 @@ export CONFIG_BOOT_KERNEL_REMOVE=""
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOOT_GUI_MENU_NAME="Purism Librem 13v2 Heads Boot Menu"
 export CONFIG_USB_BOOT_DEV="/dev/sdb1"
+export CONFIG_WARNING_BG_COLOR="--background-gradient 0 0 0 150 125 0"
+export CONFIG_ERROR_BG_COLOR="--background-gradient 0 0 0 150 0 0"
--- a/boards/librem15v3/librem15v3.config
+++ b/boards/librem15v3/librem15v3.config
@ -0,0 +1,36 @@
+# Configuration for a librem15v3
+
+# The L15v3 Linux config is the same as the L13v2 linux config
+CONFIG_LINUX_CONFIG=config/linux-librem13v2.config
+CONFIG_COREBOOT_CONFIG=config/coreboot-librem15v3.config
+
+export CONFIG_COREBOOT=y
+CONFIG_CRYPTSETUP=y
+CONFIG_FLASHROM=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+
+CONFIG_LINUX_USB=y
+
+export CONFIG_TPM=y
+export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD="iommu=pt"
+export CONFIG_BOOT_KERNEL_REMOVE=""
+export CONFIG_BOOT_DEV="/dev/sda1"
+export CONFIG_BOOT_GUI_MENU_NAME="Purism Librem 15v3 Heads Boot Menu"
+export CONFIG_USB_BOOT_DEV="/dev/sdb1"
--- a/boards/qemu-coreboot/qemu-coreboot.config
+++ b/boards/qemu-coreboot/qemu-coreboot.config
@ -1,7 +1,7 @@
 # Configuration for building a coreboot ROM that works in the.
 # the qemu emulator.  Note that the TPM does not work, so this
 # will just drop into the recovery shell.
-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_COREBOOT_CONFIG=config/coreboot-qemu.config
 CONFIG_LINUX_CONFIG=config/linux-qemu.config

--- a/boards/qemu-linuxboot/qemu-linuxboot.config
+++ b/boards/qemu-linuxboot/qemu-linuxboot.config
@ -1,6 +1,6 @@
 # Configuration for emulating LinuxBoot+Heads with qemu
 #
-CONFIG_LINUXBOOT=y
+export CONFIG_LINUXBOOT=y
 CONFIG_LINUXBOOT_BOARD=qemu
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config

@ -16,7 +16,7 @@ CONFIG_QRENCODE=y
 CONFIG_TPMTOTP=y
 endif

-#CONFIG_FLASHROM=y
+CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
 CONFIG_GPG=y
 CONFIG_KEXEC=y
--- a/boards/winterfell/winterfell.config
+++ b/boards/winterfell/winterfell.config
@ -14,14 +14,14 @@ CONFIG_ZLIB=n
 CONFIG_MUSL=n
 else
 # These don't fit if u-root is turned on
-CONFIG_CRYPTSETUP=y
-CONFIG_FLASHROM=y
+#CONFIG_CRYPTSETUP=y
+#CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
 CONFIG_GPG=y
 CONFIG_KEXEC=y
 CONFIG_UTIL_LINUX=y
-CONFIG_LVM2=y
-CONFIG_MBEDTLS=y
+#CONFIG_LVM2=y
+#CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
 CONFIG_POPT=y
 #CONFIG_QRENCODE=y
@ -44,7 +44,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_USB_BOOT_DEV="/dev/sdb1"

-$(build)/$(BOARD)/linuxboot.rom: linuxboot.intermediate
+#$(build)/$(BOARD)/linuxboot.rom: $(build)/$(linuxboot_dir)/

 # No 0x on these since the flasher doesn't handle that
 dxe_offset := 860000
--- a/boards/x220/x220.config
+++ b/boards/x220/x220.config
@ -1,6 +1,6 @@
 # Configuration for a x220 running Qubes and other OS
 # The Linux configuration is close enough to the x230
-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_COREBOOT_CONFIG=config/coreboot-x220.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config

--- a/boards/x230-flash/x230-flash.config
+++ b/boards/x230-flash/x230-flash.config
@ -1,7 +1,7 @@
 # Minimal configuration for a x230 to support flashrom, USB and networking
 BOARD=x230.flash

-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
 CONFIG_PCIUTILS=y
--- a/boards/x230/x230.config
+++ b/boards/x230/x230.config
@ -1,5 +1,5 @@
 # Configuration for a x230 running Qubes and other OSes
-CONFIG_COREBOOT=y
+export CONFIG_COREBOOT=y
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config

@ -43,10 +43,10 @@ export CONFIG_USB_BOOT_DEV="/dev/sdb1"
 # to separate files for these pieces.
 all: $(build)/$(BOARD)/$(BOARD)-8.rom
 $(build)/$(BOARD)/$(BOARD)-8.rom: $(build)/$(BOARD)/coreboot.rom
-	dd of=$@ if=$< bs=65536 count=128 skip=0
-	sha256sum $@
+	$(call do,DD 8MB,$@,dd of=$@ if=$< bs=65536 count=128 skip=0 status=none)
+	@sha256sum $@

 all: $(build)/$(BOARD)/$(BOARD)-4.rom
 $(build)/$(BOARD)/$(BOARD)-4.rom: $(build)/$(BOARD)/coreboot.rom
-	dd of=$@ if=$< bs=65536 count=64 skip=128
-	sha256sum $@
+	$(call do,DD 4MB,$@,dd of=$@ if=$< bs=65536 count=64 skip=128 status=none)
+	@sha256sum $@
--- a/config/busybox.config
+++ b/config/busybox.config
@ -140,14 +140,14 @@ CONFIG_FEATURE_SEAMLESS_GZ=y
 CONFIG_GUNZIP=y
 CONFIG_ZCAT=y
 CONFIG_FEATURE_GUNZIP_LONG_OPTIONS=y
-# CONFIG_BUNZIP2 is not set
-# CONFIG_BZCAT is not set
+CONFIG_BUNZIP2=y
+CONFIG_BZCAT=y
 # CONFIG_UNLZMA is not set
 # CONFIG_LZCAT is not set
 # CONFIG_LZMA is not set
-# CONFIG_UNXZ is not set
-# CONFIG_XZCAT is not set
-# CONFIG_XZ is not set
+CONFIG_UNXZ=y
+CONFIG_XZCAT=y
+CONFIG_XZ=y
 CONFIG_BZIP2=y
 CONFIG_FEATURE_BZIP2_DECOMPRESS=y
 CONFIG_CPIO=y
--- a/config/coreboot-librem15v3.config
+++ b/config/coreboot-librem15v3.config
@ -0,0 +1,741 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# coreboot configuration
+#
+
+#
+# General setup
+#
+CONFIG_COREBOOT_BUILD=y
+CONFIG_LOCALVERSION="4.7-Purism-4-heads"
+CONFIG_CBFS_PREFIX="fallback"
+CONFIG_COMPILER_GCC=y
+# CONFIG_COMPILER_LLVM_CLANG is not set
+# CONFIG_ANY_TOOLCHAIN is not set
+# CONFIG_CCACHE is not set
+# CONFIG_FMD_GENPARSER is not set
+# CONFIG_UTIL_GENPARSER is not set
+CONFIG_COMPRESS_RAMSTAGE=y
+CONFIG_INCLUDE_CONFIG_FILE=y
+CONFIG_COLLECT_TIMESTAMPS=y
+CONFIG_USE_BLOBS=y
+# CONFIG_COVERAGE is not set
+# CONFIG_UBSAN is not set
+CONFIG_RELOCATABLE_RAMSTAGE=y
+CONFIG_CACHE_RELOCATED_RAMSTAGE_OUTSIDE_CBMEM=y
+# CONFIG_UPDATE_IMAGE is not set
+# CONFIG_BOOTSPLASH_IMAGE is not set
+CONFIG_MEASURED_BOOT=y
+
+#
+# Mainboard
+#
+
+#
+# Important: Run 'make distclean' before switching boards
+#
+# CONFIG_VENDOR_A_TREND is not set
+# CONFIG_VENDOR_AAEON is not set
+# CONFIG_VENDOR_ABIT is not set
+# CONFIG_VENDOR_ADI is not set
+# CONFIG_VENDOR_ADLINK is not set
+# CONFIG_VENDOR_ADVANSUS is not set
+# CONFIG_VENDOR_AMD is not set
+# CONFIG_VENDOR_AOPEN is not set
+# CONFIG_VENDOR_APPLE is not set
+# CONFIG_VENDOR_ARTECGROUP is not set
+# CONFIG_VENDOR_ASROCK is not set
+# CONFIG_VENDOR_ASUS is not set
+# CONFIG_VENDOR_AVALUE is not set
+# CONFIG_VENDOR_AZZA is not set
+# CONFIG_VENDOR_BACHMANN is not set
+# CONFIG_VENDOR_BAP is not set
+# CONFIG_VENDOR_BCOM is not set
+# CONFIG_VENDOR_BIOSTAR is not set
+# CONFIG_VENDOR_BROADCOM is not set
+# CONFIG_VENDOR_COMPAQ is not set
+# CONFIG_VENDOR_COMPULAB is not set
+# CONFIG_VENDOR_CUBIETECH is not set
+# CONFIG_VENDOR_DIGITALLOGIC is not set
+# CONFIG_VENDOR_DMP is not set
+# CONFIG_VENDOR_ECS is not set
+# CONFIG_VENDOR_ELMEX is not set
+# CONFIG_VENDOR_EMULATION is not set
+# CONFIG_VENDOR_ESD is not set
+# CONFIG_VENDOR_FOXCONN is not set
+# CONFIG_VENDOR_GETAC is not set
+# CONFIG_VENDOR_GIGABYTE is not set
+# CONFIG_VENDOR_GIZMOSPHERE is not set
+# CONFIG_VENDOR_GOOGLE is not set
+# CONFIG_VENDOR_HP is not set
+# CONFIG_VENDOR_IBASE is not set
+# CONFIG_VENDOR_IEI is not set
+# CONFIG_VENDOR_INTEL is not set
+# CONFIG_VENDOR_IWAVE is not set
+# CONFIG_VENDOR_IWILL is not set
+# CONFIG_VENDOR_JETWAY is not set
+# CONFIG_VENDOR_KONTRON is not set
+# CONFIG_VENDOR_LANNER is not set
+# CONFIG_VENDOR_LENOVO is not set
+# CONFIG_VENDOR_LINUTOP is not set
+# CONFIG_VENDOR_LIPPERT is not set
+# CONFIG_VENDOR_LOWRISC is not set
+# CONFIG_VENDOR_MITAC is not set
+# CONFIG_VENDOR_MSI is not set
+# CONFIG_VENDOR_NEC is not set
+# CONFIG_VENDOR_NOKIA is not set
+# CONFIG_VENDOR_NVIDIA is not set
+# CONFIG_VENDOR_PACKARDBELL is not set
+# CONFIG_VENDOR_PCENGINES is not set
+CONFIG_VENDOR_PURISM=y
+# CONFIG_VENDOR_RCA is not set
+# CONFIG_VENDOR_RODA is not set
+# CONFIG_VENDOR_SAMSUNG is not set
+# CONFIG_VENDOR_SAPPHIRE is not set
+# CONFIG_VENDOR_SIEMENS is not set
+# CONFIG_VENDOR_SOYO is not set
+# CONFIG_VENDOR_SUNW is not set
+# CONFIG_VENDOR_SUPERMICRO is not set
+# CONFIG_VENDOR_TECHNEXION is not set
+# CONFIG_VENDOR_THOMSON is not set
+# CONFIG_VENDOR_TI is not set
+# CONFIG_VENDOR_TRAVERSE is not set
+# CONFIG_VENDOR_TYAN is not set
+# CONFIG_VENDOR_VIA is not set
+# CONFIG_VENDOR_WINENT is not set
+# CONFIG_VENDOR_WINNET is not set
+# CONFIG_VENDOR_WYSE is not set
+CONFIG_MAINBOARD_DIR="purism/librem_skl"
+CONFIG_MAINBOARD_PART_NUMBER="Librem 15 v3"
+CONFIG_IRQ_SLOT_COUNT=18
+CONFIG_MAINBOARD_VENDOR="Purism"
+CONFIG_MAX_CPUS=8
+CONFIG_CACHE_ROM_SIZE_OVERRIDE=0x0
+CONFIG_CBFS_SIZE=0xe00000
+CONFIG_UART_FOR_CONSOLE=0
+CONFIG_VGA_BIOS_ID="8086,1916"
+# CONFIG_ONBOARD_VGA_IS_PRIMARY is not set
+CONFIG_DIMM_SPD_SIZE=512
+# CONFIG_VGA_BIOS is not set
+CONFIG_MAINBOARD_SERIAL_NUMBER="Unknown Serial Number"
+CONFIG_DCACHE_RAM_BASE=0xfef00000
+CONFIG_DCACHE_RAM_SIZE=0x40000
+CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Purism"
+CONFIG_HAVE_IFD_BIN=y
+CONFIG_HAVE_ME_BIN=y
+CONFIG_MMCONF_BASE_ADDRESS=0xe0000000
+# CONFIG_POST_IO is not set
+CONFIG_DEVICETREE="variants/librem15v3/devicetree.cb"
+CONFIG_MAX_REBOOT_CNT=3
+# CONFIG_HAVE_GBE_BIN is not set
+CONFIG_ID_SECTION_OFFSET=0x80
+# CONFIG_POST_DEVICE is not set
+CONFIG_VARIANT_DIR="librem15v3"
+# CONFIG_VBOOT is not set
+CONFIG_MAINBOARD_FAMILY="Librem 15"
+CONFIG_TPM_PIRQ=0x0
+CONFIG_DIMM_MAX=1
+CONFIG_BOOT_DEVICE_SPI_FLASH_BUS=0
+CONFIG_FMDFILE=""
+CONFIG_PRERAM_CBMEM_CONSOLE_SIZE=0xc00
+# CONFIG_DRIVERS_UART_8250IO is not set
+CONFIG_IFD_BIN_PATH="../../blobs/librem_skl/descriptor.bin"
+CONFIG_ME_BIN_PATH="../../blobs/librem_skl/me.bin"
+CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Librem 15 v3"
+CONFIG_ADD_FSP_BINARIES=y
+CONFIG_FSP_M_FILE="../../blobs/librem_skl/fspm.bin"
+CONFIG_FSP_S_FILE="../../blobs/librem_skl/fsps.bin"
+CONFIG_FSP_S_CBFS="fsps.bin"
+CONFIG_FSP_M_CBFS="fspm.bin"
+CONFIG_CPU_ADDR_BITS=36
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL=8
+CONFIG_MAINBOARD_VERSION="3.0"
+# CONFIG_DRIVERS_PS2_KEYBOARD is not set
+# CONFIG_BOARD_PURISM_LIBREM13_V1 is not set
+# CONFIG_BOARD_PURISM_LIBREM13_V2 is not set
+CONFIG_BOARD_PURISM_LIBREM15_V3=y
+CONFIG_PCIEXP_L1_SUB_STATE=y
+# CONFIG_NO_POST is not set
+CONFIG_BOARD_PURISM_BASEBOARD_LIBREM_SKL=y
+CONFIG_CPU_MICROCODE_CBFS_LEN=0x18000
+CONFIG_CPU_MICROCODE_CBFS_LOC=0xFFE115A0
+CONFIG_BOARD_ROMSIZE_KB_16384=y
+# CONFIG_COREBOOT_ROMSIZE_KB_64 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_128 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_1024 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_2048 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_4096 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_8192 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_10240 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_12288 is not set
+CONFIG_COREBOOT_ROMSIZE_KB_16384=y
+# CONFIG_COREBOOT_ROMSIZE_KB_32768 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_65536 is not set
+CONFIG_COREBOOT_ROMSIZE_KB=16384
+CONFIG_ROM_SIZE=0x1000000
+# CONFIG_MAINBOARD_HAS_TPM2 is not set
+CONFIG_SYSTEM_TYPE_LAPTOP=y
+# CONFIG_CBFS_AUTOGEN_ATTRIBUTES is not set
+
+#
+# Chipset
+#
+
+#
+# SoC
+#
+CONFIG_CPU_SPECIFIC_OPTIONS=y
+CONFIG_DCACHE_BSP_STACK_SIZE=0x4000
+CONFIG_RAMTOP=0x200000
+CONFIG_HEAP_SIZE=0x80000
+CONFIG_RAMBASE=0x100000
+CONFIG_SERIRQ_CONTINUOUS_MODE=y
+CONFIG_SMM_TSEG_SIZE=0x800000
+CONFIG_SMM_RESERVED_SIZE=0x200000
+CONFIG_ACPI_CPU_STRING="\\_PR.CP%02d"
+CONFIG_DRIVERS_I2C_DESIGNWARE_CLOCK_MHZ=120
+# CONFIG_SOC_BROADCOM_CYGNUS is not set
+# CONFIG_SOC_INTEL_GLK is not set
+CONFIG_SOC_INTEL_COMMON_RESET=y
+CONFIG_PCR_BASE_ADDRESS=0xfd000000
+CONFIG_SOC_INTEL_COMMON_LPSS_CLOCK_MHZ=120
+CONFIG_C_ENV_BOOTBLOCK_SIZE=0xC000
+CONFIG_X86_TOP4G_BOOTMEDIA_MAP=y
+CONFIG_ROMSTAGE_ADDR=0x2000000
+CONFIG_VERSTAGE_ADDR=0x2000000
+# CONFIG_NHLT_MAX98357 is not set
+# CONFIG_NHLT_DA7219 is not set
+# CONFIG_SPI_FLASH_INCLUDE_ALL_DRIVERS is not set
+CONFIG_CPU_BCLK_MHZ=100
+CONFIG_SOC_INTEL_COMMON_LPSS_UART_CLK_M_VAL=0x30
+CONFIG_SOC_INTEL_COMMON_LPSS_UART_CLK_N_VAL=0xc35
+# CONFIG_RESET_ON_INVALID_RAMSTAGE_CACHE is not set
+CONFIG_CHIPSET_BOOTBLOCK_INCLUDE="soc/intel/skylake/bootblock/timestamp.inc"
+CONFIG_IED_REGION_SIZE=0x400000
+CONFIG_PCIEXP_ASPM=y
+CONFIG_PCIEXP_COMMON_CLOCK=y
+CONFIG_PCIEXP_CLK_PM=y
+# CONFIG_SERIAL_CPU_INIT is not set
+# CONFIG_UART_DEBUG is not set
+CONFIG_MAX_ROOT_PORTS=24
+CONFIG_SOC_INTEL_COMMON_BLOCK_GSPI_MAX=2
+CONFIG_STACK_SIZE=0x1000
+CONFIG_CONSOLE_CBMEM=y
+CONFIG_UART_PCI_ADDR=0x0
+CONFIG_SOC_INTEL_SKYLAKE=y
+# CONFIG_SOC_INTEL_KABYLAKE is not set
+CONFIG_MAINBOARD_USES_FSP2_0=y
+CONFIG_USE_FSP2_0_DRIVER=y
+CONFIG_BOOTBLOCK_RESETS="soc/intel/common/reset.c"
+# CONFIG_EXCLUDE_NATIVE_SD_INTERFACE is not set
+# CONFIG_SKYLAKE_SOC_PCH_H is not set
+# CONFIG_NHLT_DMIC_2CH is not set
+# CONFIG_NHLT_DMIC_4CH is not set
+# CONFIG_NHLT_NAU88L25 is not set
+# CONFIG_NHLT_SSM4567 is not set
+# CONFIG_NHLT_RT5514 is not set
+# CONFIG_NHLT_RT5663 is not set
+# CONFIG_NHLT_MAX98927 is not set
+CONFIG_CAR_NEM_ENHANCED=y
+# CONFIG_USE_SKYLAKE_FSP_CAR is not set
+CONFIG_SKIP_FSP_CAR=y
+# CONFIG_NO_FADT_8042 is not set
+CONFIG_SOC_INTEL_COMMON=y
+
+#
+# Intel SoC Common Code
+#
+CONFIG_SOC_INTEL_COMMON_BLOCK=y
+
+#
+# Intel SoC Common IP Code
+#
+CONFIG_SOC_INTEL_COMMON_BLOCK_CPU=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_CPU_MPINIT=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_CAR=y
+# CONFIG_INTEL_CAR_NEM is not set
+# CONFIG_INTEL_CAR_CQOS is not set
+CONFIG_INTEL_CAR_NEM_ENHANCED=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_CSE=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_DSP=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_EBDA=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_FAST_SPI=y
+CONFIG_FAST_SPI_DISABLE_WRITE_STATUS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO=y
+# CONFIG_DEBUG_SOC_COMMON_BLOCK_GPIO is not set
+# CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO_ITSS_POL_CFG is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO_PADCFG_PADTOL=y
+# CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO_IOSTANDBY is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO_LEGACY_MACROS=y
+# CONFIG_SOC_INTEL_COMMON_BLOCK_GPIO_MULTI_ACPI_DEVICES is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_GRAPHICS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_GSPI=y
+# CONFIG_SOC_INTEL_COMMON_BLOCK_GSPI_VERSION_2 is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_I2C=y
+# CONFIG_SOC_INTEL_COMMON_BLOCK_I2C_DEBUG is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_ITSS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_LPC=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_LPSS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_PCIE=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_PCR=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_PMC=y
+# CONFIG_POWER_STATE_OFF_AFTER_FAILURE is not set
+CONFIG_POWER_STATE_ON_AFTER_FAILURE=y
+# CONFIG_POWER_STATE_PREVIOUS_AFTER_FAILURE is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_RTC=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SATA=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SCS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SGX=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SMBUS=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SMM=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_IO_TRAP=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SPI=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_SA=y
+CONFIG_SA_PCIEX_LENGTH=0x4000000
+CONFIG_PCIEX_LENGTH_64MB=y
+# CONFIG_SA_ENABLE_IMR is not set
+CONFIG_SA_ENABLE_DPR=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_TIMER=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_UART=y
+CONFIG_SOC_INTEL_COMMON_BLOCK_XHCI=y
+# CONFIG_DISPLAY_MTRRS is not set
+# CONFIG_DISPLAY_SMM_MEMORY_MAP is not set
+CONFIG_SOC_INTEL_COMMON_ACPI_WAKE_SOURCE=y
+# CONFIG_ACPI_CONSOLE is not set
+# CONFIG_MMA is not set
+CONFIG_SOC_INTEL_COMMON_GFX_OPREGION=y
+# CONFIG_SOC_INTEL_COMMON_SMI is not set
+# CONFIG_SOC_INTEL_COMMON_ACPI is not set
+CONFIG_SOC_INTEL_COMMON_NHLT=y
+# CONFIG_SOC_LOWRISC_LOWRISC is not set
+# CONFIG_SOC_MARVELL_MVMAP2315 is not set
+# CONFIG_SOC_MEDIATEK_MT8173 is not set
+# CONFIG_SOC_NVIDIA_TEGRA124 is not set
+# CONFIG_SOC_NVIDIA_TEGRA210 is not set
+# CONFIG_SOC_QC_IPQ40XX is not set
+# CONFIG_SOC_QC_IPQ806X is not set
+# CONFIG_SOC_ROCKCHIP_RK3288 is not set
+# CONFIG_SOC_ROCKCHIP_RK3399 is not set
+# CONFIG_CPU_SAMSUNG_EXYNOS5250 is not set
+# CONFIG_CPU_SAMSUNG_EXYNOS5420 is not set
+# CONFIG_SOC_UCB_RISCV is not set
+
+#
+# CPU
+#
+# CONFIG_CPU_ALLWINNER_A10 is not set
+CONFIG_NUM_IPI_STARTS=2
+# CONFIG_CPU_AMD_AGESA is not set
+# CONFIG_CPU_AMD_PI is not set
+# CONFIG_CPU_ARMLTD_CORTEX_A9 is not set
+CONFIG_SSE2=y
+CONFIG_CPU_INTEL_FIRMWARE_INTERFACE_TABLE=y
+CONFIG_CPU_INTEL_NUM_FIT_ENTRIES=4
+# CONFIG_CPU_INTEL_TURBO_NOT_PACKAGE_SCOPED is not set
+# CONFIG_CPU_TI_AM335X is not set
+# CONFIG_PARALLEL_CPU_INIT is not set
+CONFIG_PARALLEL_MP=y
+CONFIG_PARALLEL_MP_AP_WORK=y
+# CONFIG_UDELAY_IO is not set
+# CONFIG_UDELAY_LAPIC is not set
+CONFIG_UDELAY_TSC=y
+CONFIG_TSC_CONSTANT_RATE=y
+CONFIG_TSC_MONOTONIC_TIMER=y
+# CONFIG_UDELAY_TIMER2 is not set
+# CONFIG_TSC_SYNC_LFENCE is not set
+CONFIG_TSC_SYNC_MFENCE=y
+CONFIG_NO_FIXED_XIP_ROM_SIZE=y
+CONFIG_LOGICAL_CPUS=y
+CONFIG_SMM_TSEG=y
+CONFIG_SMM_MODULE_HEAP_SIZE=0x4000
+# CONFIG_SMM_LAPIC_REMAP_MITIGATION is not set
+# CONFIG_SERIALIZED_SMM_INITIALIZATION is not set
+# CONFIG_X86_AMD_FIXED_MTRRS is not set
+# CONFIG_PLATFORM_USES_FSP1_0 is not set
+# CONFIG_MIRROR_PAYLOAD_TO_RAM_BEFORE_LOADING is not set
+# CONFIG_SOC_SETS_MSRS is not set
+CONFIG_CACHE_AS_RAM=y
+CONFIG_NO_CAR_GLOBAL_MIGRATION=y
+CONFIG_SMP=y
+CONFIG_AP_SIPI_VECTOR=0xfffff000
+CONFIG_SSE=y
+CONFIG_SUPPORT_CPU_UCODE_IN_CBFS=y
+# CONFIG_USES_MICROCODE_HEADER_FILES is not set
+CONFIG_CPU_MICROCODE_CBFS_GENERATE=y
+# CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER is not set
+# CONFIG_CPU_MICROCODE_CBFS_NONE is not set
+# CONFIG_CPU_MICROCODE_MULTIPLE_FILES is not set
+CONFIG_CPU_UCODE_BINARIES="../../blobs/librem_skl/cpu_microcode_blob.bin"
+
+#
+# Northbridge
+#
+# CONFIG_NORTHBRIDGE_AMD_AGESA is not set
+# CONFIG_NO_MMCONF_SUPPORT is not set
+# CONFIG_AMD_NB_CIMX is not set
+# CONFIG_NORTHBRIDGE_AMD_CIMX_RD890 is not set
+# CONFIG_NORTHBRIDGE_AMD_PI is not set
+# CONFIG_NORTHBRIDGE_INTEL_COMMON_MRC_CACHE is not set
+CONFIG_HPET_ADDRESS=0xfed00000
+CONFIG_MAX_PIRQ_LINKS=4
+
+#
+# Southbridge
+#
+# CONFIG_AMD_SB_CIMX is not set
+# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB800 is not set
+# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB900 is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_GPIO is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_SMBUS is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_SPI is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ is not set
+# CONFIG_HAVE_INTEL_CHIPSET_LOCKDOWN is not set
+# CONFIG_LOCK_MANAGEMENT_ENGINE is not set
+
+#
+# Super I/O
+#
+# CONFIG_SUPERIO_NUVOTON_NCT6776_COM_A is not set
+
+#
+# Embedded Controllers
+#
+CONFIG_HAVE_INTEL_FIRMWARE=y
+
+#
+# Intel Firmware
+#
+# CONFIG_EM100 is not set
+# CONFIG_CHECK_ME is not set
+# CONFIG_USE_ME_CLEANER is not set
+# CONFIG_HAVE_EC_BIN is not set
+# CONFIG_MAINBOARD_HAS_CHROMEOS is not set
+# CONFIG_GOOGLE_SMBIOS_MAINBOARD_VERSION is not set
+# CONFIG_UEFI_2_4_BINDING is not set
+CONFIG_UDK_2015_BINDING=y
+# CONFIG_USE_SIEMENS_HWILIB is not set
+# CONFIG_ARCH_ARM is not set
+# CONFIG_ARCH_BOOTBLOCK_ARM is not set
+# CONFIG_ARCH_VERSTAGE_ARM is not set
+# CONFIG_ARCH_ROMSTAGE_ARM is not set
+# CONFIG_ARCH_RAMSTAGE_ARM is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV4 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV4 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV4 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV4 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV7 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV7 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7_M is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7_M is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7_R is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7_R is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV7_R is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV7_R is not set
+# CONFIG_ARM_LPAE is not set
+# CONFIG_ARCH_ARM64 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARM64 is not set
+# CONFIG_ARCH_VERSTAGE_ARM64 is not set
+# CONFIG_ARCH_ROMSTAGE_ARM64 is not set
+# CONFIG_ARCH_RAMSTAGE_ARM64 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV8_64 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV8_64 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV8_64 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV8_64 is not set
+# CONFIG_ARM64_A53_ERRATUM_843419 is not set
+# CONFIG_ARCH_MIPS is not set
+# CONFIG_ARCH_BOOTBLOCK_MIPS is not set
+# CONFIG_ARCH_VERSTAGE_MIPS is not set
+# CONFIG_ARCH_ROMSTAGE_MIPS is not set
+# CONFIG_ARCH_RAMSTAGE_MIPS is not set
+# CONFIG_ARCH_POWER8 is not set
+# CONFIG_ARCH_BOOTBLOCK_POWER8 is not set
+# CONFIG_ARCH_VERSTAGE_POWER8 is not set
+# CONFIG_ARCH_ROMSTAGE_POWER8 is not set
+# CONFIG_ARCH_RAMSTAGE_POWER8 is not set
+# CONFIG_ARCH_RISCV is not set
+# CONFIG_ARCH_BOOTBLOCK_RISCV is not set
+# CONFIG_ARCH_VERSTAGE_RISCV is not set
+# CONFIG_ARCH_ROMSTAGE_RISCV is not set
+# CONFIG_ARCH_RAMSTAGE_RISCV is not set
+CONFIG_ARCH_X86=y
+CONFIG_ARCH_BOOTBLOCK_X86_32=y
+CONFIG_ARCH_VERSTAGE_X86_32=y
+CONFIG_ARCH_ROMSTAGE_X86_32=y
+CONFIG_ARCH_RAMSTAGE_X86_32=y
+# CONFIG_ARCH_BOOTBLOCK_X86_64 is not set
+# CONFIG_ARCH_VERSTAGE_X86_64 is not set
+# CONFIG_ARCH_ROMSTAGE_X86_64 is not set
+# CONFIG_ARCH_RAMSTAGE_X86_64 is not set
+# CONFIG_USE_MARCH_586 is not set
+# CONFIG_AP_IN_SIPI_WAIT is not set
+# CONFIG_SIPI_VECTOR_IN_ROM is not set
+# CONFIG_ROMCC is not set
+# CONFIG_CBMEM_TOP_BACKUP is not set
+# CONFIG_LATE_CBMEM_INIT is not set
+CONFIG_EARLY_EBDA_INIT=y
+CONFIG_PC80_SYSTEM=y
+# CONFIG_BOOTBLOCK_DEBUG_SPINLOOP is not set
+# CONFIG_BOOTBLOCK_SAVE_BIST_AND_TIMESTAMP is not set
+CONFIG_IOAPIC_INTERRUPTS_ON_FSB=y
+# CONFIG_IOAPIC_INTERRUPTS_ON_APIC_SERIAL_BUS is not set
+CONFIG_POSTCAR_STAGE=y
+# CONFIG_VERSTAGE_DEBUG_SPINLOOP is not set
+# CONFIG_ROMSTAGE_DEBUG_SPINLOOP is not set
+CONFIG_BOOTBLOCK_SIMPLE=y
+# CONFIG_BOOTBLOCK_NORMAL is not set
+CONFIG_BOOTBLOCK_SOURCE="bootblock_simple.c"
+
+#
+# Devices
+#
+CONFIG_HAVE_FSP_GOP=y
+# CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT is not set
+# CONFIG_MAINBOARD_HAS_LIBGFXINIT is not set
+# CONFIG_RUN_FSP_GOP is not set
+# CONFIG_VGA_ROM_RUN is not set
+CONFIG_NO_GFX_INIT=y
+# CONFIG_MULTIPLE_VGA_ADAPTERS is not set
+# CONFIG_SMBUS_HAS_AUX_CHANNELS is not set
+CONFIG_PCI=y
+CONFIG_MMCONF_SUPPORT=y
+# CONFIG_HYPERTRANSPORT_PLUGIN_SUPPORT is not set
+CONFIG_PCIX_PLUGIN_SUPPORT=y
+CONFIG_CARDBUS_PLUGIN_SUPPORT=y
+# CONFIG_AZALIA_PLUGIN_SUPPORT is not set
+CONFIG_PCIEXP_PLUGIN_SUPPORT=y
+# CONFIG_EARLY_PCI_BRIDGE is not set
+CONFIG_SUBSYSTEM_VENDOR_ID=0x0000
+CONFIG_SUBSYSTEM_DEVICE_ID=0x0000
+# CONFIG_INTEL_GMA_ADD_VBT_DATA_FILE is not set
+# CONFIG_SOFTWARE_I2C is not set
+
+#
+# Generic Drivers
+#
+# CONFIG_DRIVERS_AS3722_RTC is not set
+# CONFIG_ELOG is not set
+# CONFIG_GIC is not set
+# CONFIG_IPMI_KCS is not set
+# CONFIG_DRIVERS_LENOVO_WACOM is not set
+CONFIG_CACHE_MRC_SETTINGS=y
+CONFIG_MRC_SETTINGS_CACHE_BASE=0xfffe0000
+CONFIG_MRC_SETTINGS_CACHE_SIZE=0x10000
+CONFIG_MRC_SETTINGS_PROTECT=y
+# CONFIG_HAS_RECOVERY_MRC_CACHE is not set
+# CONFIG_MRC_CLEAR_NORMAL_CACHE_ON_RECOVERY_RETRAIN is not set
+# CONFIG_MRC_SETTINGS_VARIABLE_DATA is not set
+# CONFIG_RT8168_GET_MAC_FROM_VPD is not set
+# CONFIG_RT8168_SET_LED_MODE is not set
+CONFIG_SPI_FLASH=y
+CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP=y
+CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP_EARLY=y
+# CONFIG_SPI_FLASH_SMM is not set
+# CONFIG_SPI_FLASH_NO_FAST_READ is not set
+# CONFIG_SPI_FLASH_FAST_READ_DUAL_OUTPUT_3B is not set
+# CONFIG_SPI_FLASH_HAS_VOLATILE_GROUP is not set
+# CONFIG_HAVE_SPI_CONSOLE_SUPPORT is not set
+# CONFIG_DRIVERS_UART is not set
+# CONFIG_NO_UART_ON_SUPERIO is not set
+# CONFIG_UART_OVERRIDE_INPUT_CLOCK_DIVIDER is not set
+# CONFIG_UART_OVERRIDE_REFCLK is not set
+# CONFIG_DRIVERS_UART_8250MEM is not set
+# CONFIG_DRIVERS_UART_8250MEM_32 is not set
+# CONFIG_HAVE_UART_SPECIAL is not set
+# CONFIG_DRIVERS_UART_OXPCIE is not set
+# CONFIG_DRIVERS_UART_PL011 is not set
+# CONFIG_UART_USE_REFCLK_AS_INPUT_CLOCK is not set
+# CONFIG_HAVE_USBDEBUG is not set
+# CONFIG_HAVE_USBDEBUG_OPTIONS is not set
+# CONFIG_DRIVERS_AMD_PI is not set
+# CONFIG_SMBIOS_PROVIDED_BY_MOBO is not set
+CONFIG_DRIVERS_I2C_DESIGNWARE=y
+# CONFIG_DRIVERS_I2C_DESIGNWARE_DEBUG is not set
+# CONFIG_DRIVERS_I2C_MAX98927 is not set
+# CONFIG_DRIVERS_I2C_PCF8523 is not set
+# CONFIG_DRIVERS_I2C_RT5663 is not set
+# CONFIG_DRIVERS_I2C_RTD2132 is not set
+# CONFIG_DRIVERS_I2C_RX6110SA is not set
+# CONFIG_I2C_TPM is not set
+# CONFIG_MAINBOARD_HAS_I2C_TPM_ATMEL is not set
+# CONFIG_MAINBOARD_HAS_I2C_TPM_CR50 is not set
+# CONFIG_DISPLAY_HOBS is not set
+# CONFIG_DISPLAY_UPD_DATA is not set
+CONFIG_CHECKLIST_DATA_FILE_LOCATION="src/vendorcode/intel/fsp/fsp2_0/checklist"
+CONFIG_PLATFORM_USES_FSP2_0=y
+CONFIG_DISPLAY_FSP_CALLS_AND_STATUS=y
+# CONFIG_DISPLAY_FSP_HEADER is not set
+# CONFIG_FSP_CAR is not set
+CONFIG_FSP_M_XIP=y
+# CONFIG_VERIFY_HOBS is not set
+# CONFIG_FSP2_0_USES_TPM_MRC_HASH is not set
+# CONFIG_INTEL_DDI is not set
+# CONFIG_INTEL_EDID is not set
+# CONFIG_INTEL_INT15 is not set
+# CONFIG_INTEL_GMA_ACPI is not set
+# CONFIG_INTEL_GMA_SSC_ALTERNATE_REF is not set
+# CONFIG_DRIVER_INTEL_I210 is not set
+# CONFIG_DRIVERS_INTEL_MIPI_CAMERA is not set
+# CONFIG_DRIVERS_INTEL_WIFI is not set
+# CONFIG_USE_SAR is not set
+# CONFIG_DRIVERS_LENOVO_HYBRID_GRAPHICS is not set
+# CONFIG_DRIVER_MAXIM_MAX77686 is not set
+# CONFIG_DRIVER_PARADE_PS8625 is not set
+# CONFIG_DRIVER_PARADE_PS8640 is not set
+CONFIG_DRIVERS_MC146818=y
+CONFIG_MAINBOARD_HAS_LPC_TPM=y
+CONFIG_LPC_TPM=y
+CONFIG_TPM_TIS_BASE_ADDRESS=0xfed40000
+# CONFIG_TPM_INIT_FAILURE_IS_FATAL is not set
+# CONFIG_SKIP_TPM_STARTUP_ON_NORMAL_BOOT is not set
+# CONFIG_TPM_DEACTIVATE is not set
+# CONFIG_DRIVERS_RICOH_RCE822 is not set
+# CONFIG_DRIVER_SIEMENS_NC_FPGA is not set
+# CONFIG_NC_FPGA_NOTIFY_CB_READY is not set
+# CONFIG_DRIVERS_SIL_3114 is not set
+# CONFIG_MAINBOARD_HAS_SPI_TPM_CR50 is not set
+# CONFIG_DRIVER_TI_TPS65090 is not set
+# CONFIG_DRIVERS_TI_TPS65913 is not set
+# CONFIG_DRIVERS_TI_TPS65913_RTC is not set
+# CONFIG_DRIVER_XPOWERS_AXP209 is not set
+# CONFIG_COMMONLIB_STORAGE is not set
+
+#
+# Security
+#
+
+#
+# Verified Boot (vboot)
+#
+# CONFIG_ACPI_SATA_GENERATOR is not set
+CONFIG_ACPI_INTEL_HARDWARE_SLEEP_VALUES=y
+# CONFIG_ACPI_AMD_HARDWARE_SLEEP_VALUES is not set
+# CONFIG_BOOT_DEVICE_NOT_SPI_FLASH is not set
+CONFIG_BOOT_DEVICE_SPI_FLASH=y
+CONFIG_BOOT_DEVICE_MEMORY_MAPPED=y
+CONFIG_BOOT_DEVICE_SUPPORTS_WRITES=y
+CONFIG_RTC=y
+CONFIG_TPM=y
+# CONFIG_MAINBOARD_HAS_TPM_CR50 is not set
+
+#
+# Console
+#
+CONFIG_BOOTBLOCK_CONSOLE=y
+CONFIG_POSTCAR_CONSOLE=y
+CONFIG_SQUELCH_EARLY_SMP=y
+# CONFIG_SPKMODEM is not set
+# CONFIG_CONSOLE_NE2K is not set
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
+# CONFIG_CONSOLE_CBMEM_DUMP_TO_UART is not set
+# CONFIG_CONSOLE_SPI_FLASH is not set
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL_8=y
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_6 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_5 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_4 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_3 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_2 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
+# CONFIG_CMOS_POST is not set
+# CONFIG_CONSOLE_POST is not set
+# CONFIG_NO_EARLY_BOOTBLOCK_POSTCODES is not set
+CONFIG_HWBASE_DEBUG_CB=y
+CONFIG_HAVE_ACPI_RESUME=y
+# CONFIG_ACPI_HUGE_LOWMEM_BACKUP is not set
+CONFIG_RESUME_PATH_SAME_AS_BOOT=y
+CONFIG_HAVE_HARD_RESET=y
+# CONFIG_HAVE_ROMSTAGE_CONSOLE_SPINLOCK is not set
+# CONFIG_HAVE_ROMSTAGE_NVRAM_CBFS_SPINLOCK is not set
+# CONFIG_HAVE_ROMSTAGE_MICROCODE_CBFS_SPINLOCK is not set
+CONFIG_HAVE_MONOTONIC_TIMER=y
+# CONFIG_GENERIC_UDELAY is not set
+# CONFIG_TIMER_QUEUE is not set
+# CONFIG_HAVE_OPTION_TABLE is not set
+# CONFIG_PIRQ_ROUTE is not set
+CONFIG_HAVE_SMI_HANDLER=y
+# CONFIG_PCI_IO_CFG_EXT is not set
+CONFIG_IOAPIC=y
+# CONFIG_USE_WATCHDOG_ON_BOOT is not set
+# CONFIG_GFXUMA is not set
+CONFIG_HAVE_ACPI_TABLES=y
+CONFIG_COMMON_FADT=y
+CONFIG_ACPI_NHLT=y
+
+#
+# System tables
+#
+# CONFIG_GENERATE_MP_TABLE is not set
+# CONFIG_GENERATE_PIRQ_TABLE is not set
+CONFIG_GENERATE_SMBIOS_TABLES=y
+
+#
+# Payload
+#
+# CONFIG_PAYLOAD_NONE is not set
+# CONFIG_PAYLOAD_ELF is not set
+# CONFIG_PAYLOAD_BAYOU is not set
+# CONFIG_PAYLOAD_FILO is not set
+# CONFIG_PAYLOAD_GRUB2 is not set
+# CONFIG_PAYLOAD_SEABIOS is not set
+# CONFIG_PAYLOAD_UBOOT is not set
+CONFIG_PAYLOAD_LINUX=y
+# CONFIG_PAYLOAD_TIANOCORE is not set
+CONFIG_PAYLOAD_FILE="../../build/librem15v3/bzImage"
+CONFIG_PAYLOAD_OPTIONS=""
+# CONFIG_PXE is not set
+CONFIG_LINUX_COMMAND_LINE="intel_iommu=on iommu=pt"
+CONFIG_LINUX_INITRD="../../build/librem15v3/initrd.cpio.xz"
+# CONFIG_PAYLOAD_IS_FLAT_BINARY is not set
+
+#
+# Secondary Payloads
+#
+CONFIG_COREINFO_SECONDARY_PAYLOAD=y
+CONFIG_MEMTEST_SECONDARY_PAYLOAD=y
+CONFIG_MEMTEST_STABLE=y
+# CONFIG_MEMTEST_MASTER is not set
+# CONFIG_NVRAMCUI_SECONDARY_PAYLOAD is not set
+# CONFIG_TINT_SECONDARY_PAYLOAD is not set
+
+#
+# Debugging
+#
+# CONFIG_FATAL_ASSERTS is not set
+# CONFIG_DEBUG_CBFS is not set
+# CONFIG_HAVE_DEBUG_RAM_SETUP is not set
+# CONFIG_HAVE_DEBUG_CAR is not set
+# CONFIG_HAVE_DEBUG_SMBUS is not set
+# CONFIG_DEBUG_SMI is not set
+# CONFIG_DEBUG_SMM_RELOCATION is not set
+# CONFIG_DEBUG_MALLOC is not set
+# CONFIG_DEBUG_ACPI is not set
+# CONFIG_DEBUG_TPM is not set
+# CONFIG_DEBUG_SPI_FLASH is not set
+# CONFIG_TRACE is not set
+# CONFIG_DEBUG_BOOT_STATE is not set
+# CONFIG_DEBUG_ADA_CODE is not set
+CONFIG_NO_EDID_FILL_FB=y
+# CONFIG_ENABLE_APIC_EXT_ID is not set
+CONFIG_WARNINGS_ARE_ERRORS=y
+# CONFIG_POWER_BUTTON_DEFAULT_ENABLE is not set
+# CONFIG_POWER_BUTTON_DEFAULT_DISABLE is not set
+# CONFIG_POWER_BUTTON_FORCE_ENABLE is not set
+# CONFIG_POWER_BUTTON_FORCE_DISABLE is not set
+# CONFIG_POWER_BUTTON_IS_OPTIONAL is not set
+CONFIG_REG_SCRIPT=y
+# CONFIG_CREATE_BOARD_CHECKLIST is not set
+# CONFIG_MAKE_CHECKLIST_PUBLIC is not set
+# CONFIG_NO_XIP_EARLY_STAGES is not set
+CONFIG_EARLY_CBMEM_INIT=y
+# CONFIG_EARLY_CBMEM_LIST is not set
+CONFIG_RELOCATABLE_MODULES=y
+CONFIG_GENERIC_GPIO_LIB=y
+CONFIG_SPD_READ_BY_WORD=y
+CONFIG_C_ENVIRONMENT_BOOTBLOCK=y
--- a/initrd/.gnupg/pubring.gpg
+++ b/initrd/.gnupg/pubring.gpg
--- a/initrd/.gnupg/secring.gpg
+++ b/initrd/.gnupg/secring.gpg
--- a/initrd/.gnupg/trustdb.gpg
+++ b/initrd/.gnupg/trustdb.gpg
--- a/initrd/.ssh/authorized_keys
+++ b/initrd/.ssh/authorized_keys
@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuf59gWFcsnxdXAj7wvbzYto6JTmCF3pAXRS2RGipJUOqmWFayL8mKKLJMPpLoB60oaFno6+Uedbm93v/UQvt1FMWbhBe6Y15KawXEnmX1pjCfGbfbB9UC+EM8l9QPaQfdgCGt8e/CeM+kQKQ0X38d9WvaSNoP0EC9xoMsx7scbhy5O1VtmUYuDNXC2ZtAmCQLS2rC5RyweLA0DFWbmyOa75STEOYe0xuG8Kix7gBUP/LwawZN8URrszTzJonewYEF/PQoltcCnqkIbgVvMnm1N/hS42/911gPzlD29F1ZjhVplraOtlRKD0D5ogR5/5hKyL48MRbt9pi7lm0MtdeR hudson@diamond
--- a/initrd/bin/cbfs-init
+++ b/initrd/bin/cbfs-init
@ -0,0 +1,31 @@
+#!/bin/ash
+set -e -o pipefail
+. /etc/functions
+
+# Update initrd with CBFS files
+if [ -z "$CONFIG_PCR" ]; then
+	CONFIG_PCR=7
+fi
+
+# Load individual files
+cbfsfiles=`cbfs -t 50 -l 2>/dev/null | grep "^heads/initrd/"`
+
+for cbfsname in `echo $cbfsfiles`; do
+	filename=${cbfsname:12}
+	if [ ! -z "$filename" ]; then
+		echo "Loading $filename from CBFS"
+		mkdir -p `dirname $filename` \
+		|| die "$filename: mkdir failed"
+		cbfs -t 50 -r $cbfsname > "$filename" \
+		|| die "$filename: cbfs file read failed"
+		if [ "$CONFIG_TPM" = "y" ]; then
+			TMPFILE=/tmp/cbfs.$$
+			echo "$filename" > $TMPFILE
+			cat $filename >> $TMPFILE
+			tpm extend -ix "$CONFIG_PCR" -if $TMPFILE \
+			|| die "$filename: tpm extend failed"
+		fi
+	fi
+done
+
+# TODO: copy CBFS file named "heads/initrd.tgz" to /tmp, measure and extract
--- a/initrd/bin/flashrom-kgpe-d16.sh
+++ b/initrd/bin/flashrom-kgpe-d16.sh
@ -1,13 +1,24 @@
 #!/bin/sh
 . /etc/functions

-ROM="$1"
-if [ -z "$1" ]; then
-	die "Usage: $0 /media/kgpe-d16.rom"
+if [ "$1" = "-c" ]; then
+	CLEAN=1
+	ROM="$2"
+else
+	CLEAN=0
+	ROM="$1"
+fi
+
+if [ ! -e "$ROM" ]; then
+	die "Usage: $0 [-c] /media/kgpe-d16.rom"
 fi

 cp "$ROM" /tmp/kgpe-d16.rom
 sha256sum /tmp/kgpe-d16.rom
+if [ "$CLEAN" -eq 0 ]; then
+	preserve_rom /tmp/kgpe-d16.rom \
+	|| die "$ROM: Config preservation failed"
+fi

 flashrom \
 	--force \
--- a/initrd/bin/flashrom-x230.sh
+++ b/initrd/bin/flashrom-x230.sh
@ -1,19 +1,30 @@
 #!/bin/sh
 . /etc/functions

-ROM="$1"
-if [ -z "$1" ]; then
-	die "Usage: $0 /media/x230.rom"
+if [ "$1" = "-c" ]; then
+	CLEAN=1
+	ROM="$2"
+else
+	CLEAN=0
+	ROM="$1"
+fi
+
+if [ ! -e "$ROM" ]; then
+	die "Usage: $0 [-c] /media/x230.rom"
 fi

 cp "$ROM" /tmp/x230.rom
 sha256sum /tmp/x230.rom
+if [ "$CLEAN" -eq 0 ]; then
+	preserve_rom /tmp/x230.rom \
+	|| die "$ROM: Config preservation failed"
+fi

 flashrom \
 	--force \
 	--noverify \
 	--programmer internal \
-	--layout /etc/x230-layout.txt \
+	--ifd \
 	--image BIOS \
 	-w /tmp/x230.rom \
 || die "$ROM: Flash failed"
--- a/initrd/bin/gui-init
+++ b/initrd/bin/gui-init
@ -25,7 +25,7 @@ verify_global_hashes()
  if cd /boot && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ; then
    return 0
  elif [ ! -f $TMP_HASH_FILE ]; then
-    if (whiptail --clear --title 'ERROR: Missing Hash File!' \
+    if (whiptail $CONFIG_ERROR_BG_COLOR --clear --title 'ERROR: Missing Hash File!' \
      --yesno "The file containing hashes for /boot is missing!\n\nIf you are setting this system up for the first time, select Yes to update your list of checksums.\n\nOtherwise this could indicate a compromise and you should select No to return to the main menu.\n\nWould you like to update your checksums now?" 30 80) then
      update_checksums
    fi
@ -53,7 +53,7 @@ verify_global_hashes()
      TEXT="The following files failed the verification process:\n${CHANGED_FILES}\n\nThis could indicate a compromise!\n\nWould you like to update your checksums now?"
    fi

-    if (whiptail --clear --title 'ERROR: Boot Hash Mismatch' --yesno "$TEXT" 30 80) then
+    if (whiptail $CONFIG_ERROR_BG_COLOR --clear --title 'ERROR: Boot Hash Mismatch' --yesno "$TEXT" 30 80) then
      update_checksums
    fi
    return 1
@ -104,7 +104,7 @@ while true; do
    last_half=$half;
    TOTP=`unseal-totp`
    if [ $? -ne 0 ]; then
-      whiptail --clear --title "ERROR: TOTP Generation Failed!" \
+      whiptail $CONFIG_ERROR_BG_COLOR --clear --title "ERROR: TOTP Generation Failed!" \
        --menu "ERROR: Heads couldn't generate the TOTP code.\n\nIf you have just reflashed your BIOS, you will need to generate a new TOTP secret.\n\nIf you have not just reflashed your BIOS, THIS COULD INDICATE TAMPERING!\n\nIf this is the first time the system has booted, you should reset the TPM and set your own password\n\nHow would you like to proceed?" 30 80 4 \
        'g' ' Generate new TOTP secret' \
        'i' ' Ignore error and continue to default boot menu' \
@ -163,7 +163,7 @@ while true; do
  fi

  if [ "$totp_confirm" = "n" ]; then
-    if (whiptail --title "TOTP code mismatched" \
+    if (whiptail $CONFIG_WARNING_BG_COLOR --title "TOTP code mismatched" \
      --yesno "TOTP code mismatches could indicate either TPM tampering or clock drift:\n\nTo correct clock drift: 'date -s HH:MM:SS'\nand save it to the RTC: 'hwclock -w'\nthen reboot and try again.\n\nWould you like to exit to a recovery console?" 30 80) then
      echo ""
      echo "To correct clock drift: 'date -s HH:MM:SS'"
@ -230,7 +230,7 @@ while true; do

  if [ "$totp_confirm" = "i" ]; then
    # Run the menu selection in "force" mode, bypassing hash checks
-    if (whiptail --title 'Unsafe Forced Boot Selected!' \
+    if (whiptail $CONFIG_WARNING_BG_COLOR --title 'Unsafe Forced Boot Selected!' \
        --yesno "WARNING: You have chosen to skip all tamper checks and boot anyway.\n\nThis is an unsafe option!\n\nDo you want to proceed?" 16 80) then
      mount_boot
      kexec-select-boot -m -b /boot -c "grub.cfg" -g -f
--- a/initrd/bin/kexec-seal-key
+++ b/initrd/bin/kexec-seal-key
@ -106,6 +106,7 @@ tpm sealfile2 \
 	-ix 4 0000000000000000000000000000000000000000 \
 	-ix 5 0000000000000000000000000000000000000000 \
 	-ix 6 $luks_pcr \
+	-ix 7 X \
 || die "Unable to seal secret"

 rm -f "$KEY_FILE" \
--- a/initrd/bin/kexec-select-boot
+++ b/initrd/bin/kexec-select-boot
@ -57,7 +57,7 @@ verify_global_hashes()
 	else
 		if [ "$gui_menu" = "y" ]; then
 			CHANGED_FILES=$(grep -v 'OK$' /tmp/hash_output | cut -f1 -d ':')
-			whiptail --title 'ERROR: Boot Hash Mismatch' \
+			whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Boot Hash Mismatch' \
 				--msgbox "The following files failed the verification process:\n${CHANGED_FILES}\nExiting to a recovery shell" 16 60
 		fi
 		die "$TMP_HASH_FILE: boot hash mismatch"
@ -211,7 +211,7 @@ default_select() {
 	option=`head -n $default_index $TMP_MENU_FILE | tail -1`
 	if [ "$option" != "$expectedoption" ]; then
 		if [ "$gui_menu" = "y" ]; then
-			whiptail --title 'ERROR: Boot Entry Has Changed' \
+			whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Boot Entry Has Changed' \
 				--msgbox "The list of boot entries has changed\n\nPlease set a new default" 16 60
 		fi
 		warn "!!! Boot entry has changed - please set a new default"
@ -228,7 +228,7 @@ default_select() {
 	else
 		if [ "$gui_menu" = "y" ]; then
 			CHANGED_FILES=$(grep -v 'OK$' /tmp/hash_output | cut -f1 -d ':')
-			whiptail --title 'ERROR: Default Boot Hash Mismatch' \
+			whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Default Boot Hash Mismatch' \
 				--msgbox "The following files failed the verification process:\n${CHANGED_FILES}\nExiting to a recovery shell" 16 60
 		fi
 		die "!!! $TMP_DEFAULT_HASH_FILE: default boot hash mismatch"
@ -246,7 +246,12 @@ user_select() {
 	while [ "$option_confirm" != "y" -a "$option_confirm" != "d" ]
 	do
 		get_menu_option
-		confirm_menu_option
+    # In force boot mode, no need offer the option to set a default, just boot
+		if [ "$force_boot" = "y" ]; then
+			do_boot
+		else
+			confirm_menu_option
+		fi

 		if [ "$option_confirm" = 'd' ]; then
 			save_default_option
@ -299,7 +304,11 @@ do_boot()
 }

 while true; do
-	check_config $paramsdir
+	if [ "$force_boot" = "y" ]; then
+	  check_config $paramsdir force
+	else
+	  check_config $paramsdir
+	fi
 	TMP_DEFAULT_FILE=`find /tmp/kexec/kexec_default.*.txt 2>/dev/null | head -1` || true
 	TMP_MENU_FILE="/tmp/kexec/kexec_menu.txt"
 	TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt"
@ -312,6 +321,9 @@ while true; do
 # even if hashes don't match
 	if [ "$force_boot" = "y" ]; then
 		scan_options
+		# Remove boot splash and make background red in the event of a forced boot
+		add="$add vt.default_red=0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff"
+		remove="$remove splash quiet"
 		user_select
 	fi

--- a/initrd/bin/key-init
+++ b/initrd/bin/key-init
@ -0,0 +1,8 @@
+#!/bin/ash
+set -e -o pipefail
+. /etc/functions
+
+# Post processing of keys
+gpg --import /.gnupg/keys/* 2>/dev/null || true
+
+# TODO: split out gpg keys into multiple rings by function
--- a/initrd/bin/network-init-recovery
+++ b/initrd/bin/network-init-recovery
@ -3,23 +3,22 @@
 # bring up the ethernet; maybe should do DHCP?
 ifconfig lo 127.0.0.1

-if [ -f /lib/modules/e1000.ko ]; then
-	insmod /lib/modules/e1000.ko
-fi
-
-if [ -f /lib/modules/e1000e.ko ]; then
-	insmod /lib/modules/e1000e.ko
-fi
+network_modules="e1000 e1000e igb sfc mdio mlx4_core mlx4_en"
+for module in `echo $network_modules`; do
+	if [ -f /lib/modules/$module.ko ]; then
+		insmod /lib/modules/$module.ko
+	fi
+done

 if [ -e /sys/class/net/eth0 ]; then
-	# Setup static IP
+	# Set up static IP
 	if [ ! -z "$CONFIG_BOOT_STATIC_IP" ]; then
 		ifconfig eth0 $CONFIG_BOOT_STATIC_IP
 	fi
-	# TODO: setup DHCP if available
+	# TODO: Set up DHCP if available
 	ifconfig eth0 > /dev/ttyprintk

-	# Setup the ssh server, allow root logins and log to stderr
+	# Set up the ssh server, allow root logins and log to stderr
 	if [ ! -d /etc/dropbear ]; then
 		mkdir /etc/dropbear
 	fi
--- a/initrd/bin/seal-totp
+++ b/initrd/bin/seal-totp
@ -41,6 +41,7 @@ if ! tpm sealfile2 \
 	-ix 2 X \
 	-ix 3 X \
 	-ix 4 0000000000000000000000000000000000000000 \
+	-ix 7 X \
 ; then
 	rm -f "$TOTP_SECRET"
 	 die "Unable to seal secret"
--- a/initrd/bin/uefi-init
+++ b/initrd/bin/uefi-init
@ -0,0 +1,28 @@
+#!/bin/ash
+set -e -o pipefail
+. /etc/functions
+
+# Update initrd with CBFS files
+if [ -z "$CONFIG_PCR" ]; then
+	CONFIG_PCR=7
+fi
+
+CONFIG_GUID="74696e69-6472-632e-7069-6f2f75736572"
+
+# copy EFI file named $CONFIG_GUID to /tmp, measure and extract
+GUID=`uefi -l | grep "^$CONFIG_GUID"`
+
+if [ -n "GUID" ]; then
+	echo "Loading $GUID from ROM"
+	TMPFILE=/tmp/uefi.$$
+	uefi -r $GUID | gunzip -c > $TMPFILE \
+	|| die "Failed to read config GUID from ROM"
+
+	if [ "$CONFIG_TPM" = "y" ]; then
+		tpm extend -ix "$CONFIG_PCR" -if $TMPFILE \
+		|| die "$filename: tpm extend failed"
+	fi
+
+	( cd / ; cpio -iud < $TMPFILE 2>/dev/null ) \
+	|| die "Failed to extract config GUID"
+fi
--- a/initrd/etc/functions
+++ b/initrd/etc/functions
@ -36,7 +36,7 @@ pause_recovery() {
 }

 pcrs() {
-	head -7 /sys/class/tpm/tpm0/pcrs
+	head -8 /sys/class/tpm/tpm0/pcrs
 }

 confirm_totp()
@ -190,11 +190,29 @@ check_config() {
 		return
 	fi

-	if ! sha256sum `find $1/kexec*.txt` | gpgv $1/kexec.sig - ; then
-		die 'Invalid signature on kexec boot params'
+	if [ "$2" != "force" ]; then
+		if ! sha256sum `find $1/kexec*.txt` | gpgv $1/kexec.sig - ; then
+			die 'Invalid signature on kexec boot params'
+		fi
 	fi

 	echo "+++ Found verified kexec boot params"
 	cp $1/kexec*.txt /tmp/kexec \
 	|| die "Failed to copy kexec boot params to tmp"
 }
+
+preserve_rom() {
+	new_rom="$1"
+	old_files=`cbfs -t 50 -l 2>/dev/null | grep "^heads/"`
+
+	for old_file in `echo $old_files`; do
+		new_file=`cbfs -o $1 -l | grep -x $old_file`
+		if [ -z "$new_file" ]; then
+			echo "+++ Adding $old_file to $1"
+			cbfs -t 50 -r $old_file >/tmp/rom.$$ \
+			|| die "Failed to read cbfs file from ROM"
+			cbfs -o $1 -a $old_file -f /tmp/rom.$$ \
+			|| die "Failed to write cbfs file to new ROM file"
+		fi
+	done
+}
--- a/initrd/etc/x230-layout.txt
+++ b/initrd/etc/x230-layout.txt
@ -1,4 +0,0 @@
-00000000:00000FFF Descriptor     
-00001000:00002FFF GBe                   
-00003000:004FFFFF ME              
-00500000:00BFFFFF BIOS                  
--- a/initrd/init
+++ b/initrd/init
@ -51,6 +51,14 @@ if [ ! -z "$CONFIG_USB_BOOT_DEV" ]; then
 	echo >> /etc/fstab "$CONFIG_USB_BOOT_DEV /media auto defaults,ro 0 0"
 fi

+if [ "$CONFIG_COREBOOT" = "y" ]; then
+	/bin/cbfs-init
+fi
+if [ "$CONFIG_LINUXBOOT" = "y" ]; then
+	/bin/uefi-init
+fi
+/bin/key-init
+
 # Setup recovery serial shell
 if [ ! -z "$CONFIG_BOOT_RECOVERY_SERIAL" ]; then
 	stty -F "$CONFIG_BOOT_RECOVERY_SERIAL" 115200
@ -72,7 +80,7 @@ if [ "$boot_option" = "r" ]; then
 	# Start an interactive shell
 	recovery 'User requested recovery shell'
 	# just in case...
-	if [ "$CONFIG_TPM" = y ]; then
+	if [ "$CONFIG_TPM" = "y" ]; then
 		tpm extend -ix 4 -ic recovery
 	fi
 	exec /bin/ash
@ -102,7 +110,7 @@ else
 fi

 # belts and suspenders, just in case...
-if [ "$CONFIG_TPM" = y ]; then
+if [ "$CONFIG_TPM" = "y" ]; then
 	tpm extend -ix 4 -ic recovery
 fi
 exec /bin/ash
--- a/modules/busybox
+++ b/modules/busybox
@ -13,8 +13,25 @@ busybox_config := config/busybox.config
 busybox_output := busybox
 busybox_target := \
 	$(CROSS_TOOLS) \
-	CONFIG_PREFIX="$(initrd_dir)" \
 	$(MAKE_JOBS) \
-	install
+
+# Install symlinks when the busybox program is installed
+
+ifeq "$(CONFIG_BUSYBOX)" "y"
+initrd_bins += $(initrd_bin_dir)/busybox
+endif
+
+$(initrd_tmp_dir)/bin/busybox: $(build)/$(busybox_dir)/.build
+	$(call do,SYMLINK,bin/busybox,\
+		$(MAKE) \
+			-C $(build)/$(busybox_dir) \
+			CC="$(heads_cc)" \
+			CONFIG_PREFIX="$(initrd_bin_dir)/.." \
+			install \
+		| tee -a $(build)/log/busybox.log \
+		$(VERBOSE_REDIRECT) \
+	)
+	@touch $< # ensure that our build file is still newer
+

 busybox_depends := $(musl_dep)
--- a/modules/coreboot
+++ b/modules/coreboot
@ -3,7 +3,8 @@ modules-$(CONFIG_COREBOOT) += coreboot
 #coreboot_version := git
 #coreboot_repo := https://github.com/osresearch/coreboot
 coreboot_version := 4.7
-coreboot_dir := coreboot-$(coreboot_version)
+coreboot_base_dir := coreboot-$(coreboot_version)
+coreboot_dir := $(coreboot_base_dir)/$(BOARD)
 coreboot_tar := coreboot-$(coreboot_version).tar.xz
 coreboot_url := https://www.coreboot.org/releases/$(coreboot_tar)
 coreboot_hash := d68a83f8f687e8ea212b8c5bb501e24444b57c3f73896042d09628188c851368
@ -12,52 +13,57 @@ coreboot_hash := d68a83f8f687e8ea212b8c5bb501e24444b57c3f73896042d09628188c85136
 # The builds are done in a per-target subdirectory
 CONFIG_COREBOOT_CONFIG ?= config/coreboot-$(BOARD).config

+# Ensure that touching the config file will force a rebuild
+$(build)/$(coreboot_dir)/.configured: $(CONFIG_COREBOOT_CONFIG)
+
 EXTRA_FLAGS := -fdebug-prefix-map=$(pwd)=heads -gno-record-gcc-switches

 coreboot_configure := \
-	$(MAKE) \
+	$(MAKE) -C $(build)/$(coreboot_base_dir) \
 		oldconfig \
-		obj=./$(BOARD) \
+		obj=$(build)/$(coreboot_dir) \
 		DOTCONFIG=../../$(CONFIG_COREBOOT_CONFIG) \
 		BUILD_TIMELESS=1 \
 		CFLAGS_x86_32="$(EXTRA_FLAGS)" \
 		CFLAGS_x86_64="$(EXTRA_FLAGS)" \

 coreboot_target := \
-	obj=./$(BOARD) \
+	-C $(build)/$(coreboot_base_dir) \
+	obj=$(build)/$(coreboot_dir) \
 	DOTCONFIG=../../$(CONFIG_COREBOOT_CONFIG) \
 	BUILD_TIMELESS=1 \
 	CFLAGS_x86_32="$(EXTRA_FLAGS)" \
 	CFLAGS_x86_64="$(EXTRA_FLAGS)" \
 	$(MAKE_JOBS)

-coreboot_output := $(BOARD)/coreboot.rom
+coreboot_output := coreboot.rom
+coreboot_depend += linux initrd

 # hack to force a build dependency on the cross compiler
-$(build)/$(coreboot_dir)/.configured: $(build)/$(coreboot_dir)/util/crossgcc/xgcc/bin/i386-elf-gcc
-$(build)/$(coreboot_dir)/util/crossgcc/xgcc/bin/i386-elf-gcc: $(build)/$(coreboot_dir)/.canary
+$(build)/$(coreboot_dir)/.configured: $(build)/$(coreboot_base_dir)/util/crossgcc/xgcc/bin/i386-elf-gcc
+$(build)/$(coreboot_base_dir)/util/crossgcc/xgcc/bin/i386-elf-gcc: $(build)/$(coreboot_base_dir)/.canary
 	echo '******* Building crossgcc-i386 (this might take a while) ******'
-	$(MAKE) -C "$(build)/$(coreboot_dir)" CPUS=`nproc` crossgcc-i386
+	$(MAKE) -C "$(build)/$(coreboot_base_dir)" CPUS=`nproc` crossgcc-i386
 	#echo '******* Building crossgcc-arm (this might take a while) ******'
-	#$(MAKE) -C "$(build)/$(coreboot_dir)" crossgcc-arm
+	#$(MAKE) -C "$(build)/$(coreboot_base_dir)" crossgcc-arm

-# The coreboot-blobs must be unpacked before we can build coreboot
-# if we are using a tar file; git checkout will clone the submodule.
-# The Linux kernel and Heads initrd must be built before linuxboot
-# unless the user has specified "FAST=1" on the make command line,
-# which will assume that the kernel and initrd are fresh
-ifneq "$(FAST)" "1"
-coreboot_depends := linux initrd
-coreboot.intermediate: $(build)/$(BOARD)/bzImage
-coreboot.intermediate: $(build)/$(BOARD)/initrd.cpio.xz
-endif
+# Force a rebuild if the inputs have changed
+$(build)/$(coreboot_dir)/.build: \
+	$(build)/$(BOARD)/bzImage \
+	$(build)/$(BOARD)/initrd.cpio.xz \
+
+# This produces a ROM image that is written with the flashrom program
+$(build)/$(BOARD)/coreboot.rom: $(build)/$(coreboot_dir)/.build
+	"$(build)/$(coreboot_dir)/cbfstool" "$(dir $<)coreboot.rom" print
+	$(call do-copy,$(dir $<)coreboot.rom,$@)
+	@touch $@   # update the time stamp

 #
 # Helpful target for reconfiguring the coreboot target
 #
 coreboot.menuconfig:
 	$(MAKE) \
-		-C "$(build)/$(coreboot_dir)" \
+		-C "$(build)/$(coreboot_base_dir)" \
 		DOTCONFIG="../../$(CONFIG_COREBOOT_CONFIG)" \
 		menuconfig

--- a/modules/dropbear
+++ b/modules/dropbear
@ -25,6 +25,6 @@ dropbear_target := \
 	DESTDIR="$(INSTALL)" \
 	dbclient scp dropbear \
 	&& \
-	cp $(build)/$(dropbear_dir)/dbclient $(build)/$(dropbear_dir)/ssh
+	cp -a $(build)/$(dropbear_dir)/dbclient $(build)/$(dropbear_dir)/ssh

 dropbear_depends := zlib $(musl_dep)
--- a/modules/flashrom
+++ b/modules/flashrom
@ -5,11 +5,11 @@ flashrom_depends := pciutils $(musl_dep)
 #flashrom_version := git
 #flashrom_repo := https://github.com/osresearch/flashrom

-flashrom_version := 0.9.9
+flashrom_version := 1.0
 flashrom_dir := flashrom-$(flashrom_version)
 flashrom_tar := flashrom-$(flashrom_version).tar.bz2
 flashrom_url := https://download.flashrom.org/releases/$(flashrom_tar)
-flashrom_hash := cb3156b0f63eb192024b76c0814135930297aac41f80761a5d293de769783c45
+flashrom_hash := 3702fa215ba5fb5af8e54c852d239899cfa1389194c1e51cb2a170c4dc9dee64

 flashrom_target := \
 	$(MAKE_JOBS) \
--- a/modules/flashtools
+++ b/modules/flashtools
@ -21,6 +21,7 @@ flashtools_output := \
 	peek \
 	poke \
 	cbfs \
+	uefi \

 flashtools_libraries := \

--- a/modules/linux
+++ b/modules/linux
@ -1,7 +1,17 @@
 modules-y += linux

 linux_version := 4.9.80
-linux_dir := linux-$(linux_version)
+linux_base_dir := linux-$(linux_version)
+
+# TODO: fixup the patch process
+# input file in the heads config/ dir
+# Allow board config to specialize Linux configuration if necessary
+linux_kconfig := $(or $(CONFIG_LINUX_CONFIG),config/linux.config)
+
+# Output directory for the Linux kernel build is based on the
+# configuration file name, not the board name
+linux_dir := $(linux_base_dir)/$(notdir $(basename $(linux_kconfig)))
+
 linux_tar := linux-$(linux_version).tar.xz
 linux_url := https://cdn.kernel.org/pub/linux/kernel/v4.x/$(linux_tar)

@ -10,28 +20,17 @@ linux-4.9.80_hash := 9e2e83ccc0afc3f23340ed5e58a35d8c6300a7c58aa98ca913848de4122

 linux_hash := $(linux-$(linux_version)_hash)

-# input file in the heads config/ dir
-# Allow board config to specialize Linux configuration if necessary
-linux_kconfig := $(or $(CONFIG_LINUX_CONFIG),config/linux.config)
-
-# Output directory for the Linux kernel build is based on the
-# configuration file name, not the board name
-linux_board_dir := $(build)/$(linux_dir)/$(notdir $(basename $(linux_kconfig)))
-
-# temp file in the build dir to show that we have run make oldconfig
-linux_config_file := $(notdir $(basename $(linux_kconfig))/.config-$(BOARD))
+# Ensure that touching the config file will force a reconfig/rebuild
+$(build)/$(linux_dir)/.configured: $(linux_kconfig)

 linux_configure := \
-	$(MAKE) \
+	$(MAKE) -C .. \
 		CROSS_COMPILE="$(CROSS)" \
-		O="$(linux_board_dir)" \
+		O="$(build)/$(linux_dir)" \
 		KCONFIG_CONFIG="$(pwd)/$(linux_kconfig)" \
 		oldconfig \

-linux_output += $(build)/$(BOARD)/bzImage
-
-# linux.intermediate: $(linux_output)
-#linux_output += $(build)/$(BOARD)/modules.cpio
+linux_output += arch/x86/boot/bzImage


 # qemu
@ -87,13 +86,13 @@ linux_modules-$(CONFIG_LINUX_MEI)	+= drivers/misc/mei/mei-me.ko
 EXTRA_FLAGS := -fdebug-prefix-map=$(pwd)=heads -gno-record-gcc-switches

 linux_target := \
-	O="$(linux_board_dir)" \
+	O="$(build)/$(linux_dir)" \
 	KCONFIG_CONFIG="$(pwd)/$(linux_kconfig)" \
 	CROSS_COMPILE="$(CROSS)" \
 	AFLAGS_KERNEL="$(EXTRA_FLAGS)" \
 	CFLAGS_KERNEL="$(EXTRA_FLAGS)" \
 	CFLAGS_MODULE="$(EXTRA_FLAGS)" \
-	KBUILD_BUILD_USER="$(GIT_HASH)" \
+	KBUILD_BUILD_USER=$(notdir $(linux_kconfig)) \
 	KBUILD_BUILD_HOST=linuxboot \
 	KBUILD_BUILD_TIMESTAMP="1970-00-00" \
 	KBUILD_BUILD_VERSION=0 \
@ -115,13 +114,13 @@ FOO := $(shell mkdir -p "$(module_initrd_lib_dir)")
 define linux_module =

 # Each module depends on building the Linux kernel
-$(linux_board_dir)/$1: linux.intermediate # $(build)/$(BOARD)/bzImage
+$(build)/$(linux_dir)/$1: $(build)/$(linux_dir)/$(linux_output)

 # The cpio file will depend on every module
 $(build)/$(BOARD)/modules.cpio: $(module_initrd_lib_dir)/$(notdir $1)

 # Strip the modules when we install them so that they will be extra small
-$(module_initrd_lib_dir)/$(notdir $1): $(linux_board_dir)/$1
+$(module_initrd_lib_dir)/$(notdir $1): $(build)/$(linux_dir)/$1
 	$(call do,INSTALL-MODULE,$1, \
 		$(CROSS)strip \
 			--preserve-dates \
@ -134,7 +133,7 @@ endef
 $(call map,linux_module,$(linux_modules-y))

 # We can't rebuild the module initrd until the kernel has been rebuilt
-$(build)/$(BOARD)/modules.cpio: linux.intermediate
+$(build)/$(BOARD)/modules.cpio: $(build)/$(linux_dir)/.build
 	$(call do-cpio,$@,$(module_initrd_dir))
 	@$(RM) -rf "$(module_initrd_dir)"

@ -142,15 +141,15 @@ $(build)/$(BOARD)/modules.cpio: linux.intermediate
 # The output of the linux.intermediate is the bzImage in the
 # linus build directory.  We need to copy it into our board
 # specific directory for ease of locating it later.
-$(linux_board_dir)/arch/x86/boot/bzImage: linux.intermediate
-$(build)/$(BOARD)/bzImage: $(linux_board_dir)/arch/x86/boot/bzImage
-	$(call do-copy,$<,$@)
+$(build)/$(BOARD)/bzImage: $(build)/$(linux_dir)/.build
+	$(call do-copy,$(dir $<)/$(linux_output),$@)
+	@touch $@ # force a timestamp update


 # menuconfig target allows us to easily reconfigure this Linux kernel
 linux.menuconfig:
 	$(MAKE) \
-		-C "$(build)/$(linux_dir)" \
-		O="$(linux_board_dir)" \
+		-C "$(build)/$(linux_base_dir)" \
+		O="$(build)/$(linux_dir)" \
 		KCONFIG_CONFIG="$(pwd)/$(linux_kconfig)" \
 		menuconfig \
--- a/modules/linuxboot
+++ b/modules/linuxboot
@ -2,32 +2,40 @@ modules-$(CONFIG_LINUXBOOT) += linuxboot

 linuxboot_version := git
 linuxboot_repo := https://github.com/osresearch/linuxboot
-linuxboot_dir := linuxboot-$(linuxboot_version)
+linuxboot_base_dir := linuxboot-$(linuxboot_version)

 # linuxboot builds are specialized on a per-target basis.
 # They can be specialized by defining $(CONFIG_LINUXBOOT_BOARD)
 # otherwise it is assumed that it will have the same name
 # as the Heads BOARD.
 linuxboot_board := $(or $(CONFIG_LINUXBOOT_BOARD),$(BOARD))
-
+linuxboot_dir := linuxboot-$(linuxboot_version)/build/$(linuxboot_board)

 linuxboot_configure := \
 	echo >&2 "Pre-building edk2" ; \
 	$(MAKE) \
+		-C $(build)/$(linuxboot_base_dir) \
 		BOARD=$(linuxboot_board) \
 		edk2.force \
 	|| exit 1 ; \
 	if [ "$(linuxboot_board)" = "qemu" ]; then \
 		echo >&2 "Pre-building edk2 OVMF" ; \
-		( cd edk2/OvmfPkg ; ./build.sh -n `nproc` ) \
-		|| exit 1 ; \
+		( cd $(build)/$(linuxboot_base_dir)/edk2/OvmfPkg ; \
+		./build.sh -n `nproc` \
+		) || exit 1 ; \
 	fi ; \
 	touch .config ; \

+ifdef CUSTOM
+	CUSTOMPWD=$(pwd)/$(CUSTOM)
+endif
+
 linuxboot_target := \
+	-C $(build)/$(linuxboot_base_dir) \
 	BOARD=$(linuxboot_board) \
 	KERNEL=$(build)/$(BOARD)/bzImage \
 	INITRD=$(build)/$(BOARD)/initrd.cpio.xz \
+	CUSTOM=$(CUSTOMPWD) \
 	$(if $(CONFIG_LINUXBOOT_ROM), ROM=$(pwd)/$(CONFIG_LINUXBOOT_ROM)) \
 	all

@ -40,38 +48,31 @@ ifneq "y" "$(shell [ -r '$(CONFIG_LINUXBOOT_ROM)' ] && echo y)"
 $(error $(CONFIG_LINUXBOOT_ROM): you must provide a ROM file)
 endif

-# Force a rebuild of the LinuxBoot ROM if the vendor ROM changes
-linuxboot.intermediate:  $(CONFIG_LINUXBOOT_ROM)
-
 endif

+
 # The output file from the LinuxBoot build is a full ROM
 # ready to flash onto the mainboard.  There might be partial
 # firmware volumes as well, but that depends on the board
 # so this only retrieves the final one
-linuxboot_output := $(build)/$(linuxboot_dir)/build/$(linuxboot_board)/linuxboot.rom
+linuxboot_output := build/$(linuxboot_board)/linuxboot.rom
+linuxboot_rom := $(build)/$(linuxboot_dir)/$(linuxboot_output)

-$(linuxboot_output): linuxboot.intermediate
+$(build)/$(BOARD)/linuxboot.rom: $(build)/$(linuxboot_dir)/.build
+	$(call do-copy,$(dir $<)linuxboot.rom,$@)
+	@touch $@

-$(build)/$(BOARD)/linuxboot.rom: $(linuxboot_output)
-	$(call do-copy,$<,$@)
-
-# The Linux kernel and Heads initrd must be built before linuxboot
-# unless the user has specified "FAST=1" on the make command line,
-# which will assume that the kernel and initrd are fresh
-#
-# There is not an explicit dependency of linuxboot on linux
-# or initrd so that the configuration can pre-build all of edk2
-# overlapping with the other builds.
-ifneq "$(FAST)" "1"
-linuxboot.intermediate: $(build)/$(BOARD)/bzImage
-linuxboot.intermediate: $(build)/$(BOARD)/initrd.cpio.xz
-endif
+# Also force a rebuild if any of the input files are updated
+$(build)/$(linuxboot_dir)/.build: \
+	$(CONFIG_LINUXBOOT_ROM) \
+	$(build)/$(BOARD)/bzImage \
+	$(build)/$(BOARD)/initrd.cpio.xz \


 linuxboot.run: $(build)/$(BOARD)/linuxboot.rom
-	$(MAKE) -C $(build)/$(linuxboot_dir)  \
+	$(MAKE) -C $(build)/$(linuxboot_base_dir)  \
 		BOARD:=$(linuxboot_board) \
 		KERNEL=$(build)/$(BOARD)/bzImage \
 		INITRD=$(build)/$(BOARD)/initrd.cpio.xz \
+		CUSTOM=$(CUSTOMPWD) \
 		run
--- a/modules/musl
+++ b/modules/musl
@ -38,12 +38,13 @@ musl_depends := musl-cross

 # Fake a target so that musl will force a header install by the
 # Linux kernel sources.
-musl.intermediate: $(INSTALL)/include/linux/limits.h
-$(INSTALL)/include/linux/limits.h: $(build)/$(linux_dir)/.canary
+$(build)/$(musl_dir)/.build: $(INSTALL)/include/linux/limits.h
+
+$(INSTALL)/include/linux/limits.h: $(build)/$(linux_base_dir)/.canary
 	$(MAKE) \
-		-C "$(build)/$(linux_dir)" \
+		-C "$(build)/$(linux_base_dir)" \
 		INSTALL_HDR_PATH="$(INSTALL)" \
-		O="$(linux_board_dir)" \
+		O="$(linux_dir)" \
 		KCONFIG_CONFIG="$(pwd)/$(linux_kconfig)" \
 		headers_install

--- a/modules/musl-cross
+++ b/modules/musl-cross
@ -2,12 +2,6 @@ ifeq "$(MUSL_CROSS_ONCE)" ""
 MUSL_CROSS_ONCE := 1


-# Allow the path to the musl-cross directory to be passed on
-# the environment so that the full path doens't need to be spelled out
-ifneq "$(MUSL_DIR)" ""
-CROSS := $(MUSL_DIR)/crossgcc/x86_64-linux-musl/bin/x86_64-linux-musl-
-endif
-
 ifneq "$(CROSS)" ""

 # check that $(CROSS)gcc exists or else things just won't work
@ -17,7 +11,12 @@ endif

 # The cross compiler has already been built, so the musl-cross target
 # is a NOP.
-musl-cross.intermediate:
+#musl-cross.intermediate:
+
+musl-cross_dir := musl-cross-ext
+$(build)/$(musl-cross_dir)/.build:
+	mkdir -p $(dir $@)
+	touch $@

 else

@ -28,8 +27,9 @@ musl-cross_version := git
 musl-cross_dir := musl-cross-$(musl-cross_version)
 musl-cross_repo := https://github.com/GregorR/musl-cross

-CROSS := $(build)/../crossgcc/x86_64-linux-musl/bin/x86_64-musl-linux-
-musl-cross_output := $(CROSS)gcc
+CROSS_TOP := crossgcc/x86_64-linux-musl/bin/x86_64-musl-linux-
+CROSS := $(build)/../$(CROSS_TOP)
+musl-cross_output := ../../$(CROSS_TOP)gcc

 musl-cross_configure := \
 	/bin/echo -e > Makefile \
--- a/modules/pciutils
+++ b/modules/pciutils
@ -42,6 +42,6 @@ pciutils_output := \
 	lspci \

 pciutils_libraries := \
-	../../install/lib/libpci.so.3 \
+	lib/libpci.so.3.5.4 \

 pciutils_configure := 
--- a/modules/u-root
+++ b/modules/u-root
@ -11,11 +11,10 @@ UROOT_CMDS ?=
 export GOPATH=$(build)/go
 u-root_src_cmds := $(foreach cmd,$(UROOT_CMDS),github.com/u-root/u-root/cmds/$(cmd))

-$(GOPATH):
-	$(call do,GO GET,$(u-root_url),\
-		go get $(u-root_url) \
-	)
+u-root_build := $(GOPATH)/bin/u-root

+$(GOPATH)/bin/u-root:
+	go get github.com/u-root/u-root/...
 #
 # If the board directory has its own go commands, copy them
 # into the u-root tree so that they will be bundled into the go initrd
@ -24,11 +23,11 @@ $(GOPATH):
 #
 ifeq "y" "$(shell [ -r 'boards/$(BOARD)/uinit.go' ] && echo y)"
 u-root_uinit := $(GOPATH)/src/github.com/u-root/u-root/cmds/uinit/uinit.go
-$(u-root_uinit): boards/$(BOARD)/uinit.go
-	$(call install,$<,$@)
+$(u-root_uinit): $(u-root_build) boards/$(BOARD)/uinit.go
+	$(call install,boards/$(BOARD)/uinit.go,$@)
 endif

-$(u-root_output): $(GOPATH) $(u-root_uinit)
+$(u-root_output): $(u-root_build) $(u-root_uinit)
 	$(call do,U-ROOT,$@,\
 		$(GOPATH)/bin/u-root \
 			-build=bb \
@ -48,7 +47,7 @@ CONFIG_HEADS=n

 # Since we do not include u-root in modules-y, we have to define our
 # own intermediate and clean targets here
-u-root.intermediate: $(u-root_output)
+$(build)/$(u-root_dir)/.build: $(u-root_output)
 u-root.clean:
 	$(RM) $(u-root_output)
 endif
--- a/patches/flashrom-0.9.9.patch
+++ b/patches/flashrom-0.9.9.patch
				`@ -1 +0,0 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuf59gWFcsnxdXAj7wvbzYto6JTmCF3pAXRS2RGipJUOqmWFayL8mKKLJMPpLoB60oaFno6+Uedbm93v/UQvt1FMWbhBe6Y15KawXEnmX1pjCfGbfbB9UC+EM8l9QPaQfdgCGt8e/CeM+kQKQ0X38d9WvaSNoP0EC9xoMsx7scbhy5O1VtmUYuDNXC2ZtAmCQLS2rC5RyweLA0DFWbmyOa75STEOYe0xuG8Kix7gBUP/LwawZN8URrszTzJonewYEF/PQoltcCnqkIbgVvMnm1N/hS42/911gPzlD29F1ZjhVplraOtlRKD0D5ogR5/5hKyL48MRbt9pi7lm0MtdeR hudson@diamond`