code:
the others included in this version were deleted since they weren't needed and were just taking up space.
You can get full archive at http://dejavu-fonts.org/wiki/Download

repo_name: exotime/libreboot

license: mit


code:
From 721f09ef24e1879667ac3469c17774450602b29e Mon Sep 17 00:00:00 2001
From: Leah Rowe <info@minifree.org>
Date: Sat, 14 Feb 2015 01:24:23 +0000
Subject: [PATCH 01/10] grub-core/normal/main.c: Display "FREE AS IN FREEDOM",
 not version

---
 grub-core/normal/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index 78a70a8..982bde3 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -208,7 +208,7 @@ grub_normal_init_page (struct grub_term_output *term,

   grub_term_cls (term);

-  msg_formatted = grub_xasprintf (_("GNU GRUB  version %s"), PACKAGE_VERSION);
+  msg_formatted = grub_xasprintf("FREE AS IN FREEDOM");
   if (!msg_formatted)
     return;

--
1.9.1


code:
From 04e079fed3b275b8ba2081c7fbf9acd853ce055b Mon Sep 17 00:00:00 2001
From: John Lane <john@lane.uk.net>
Date: Tue, 23 Jun 2015 11:16:30 +0100
Subject: [PATCH 02/10] Cryptomount support LUKS detached header

---
 grub-core/disk/cryptodisk.c | 22 ++++++++++++++++++----
 grub-core/disk/geli.c       |  7 +++++--
 grub-core/disk/luks.c       | 45 +++++++++++++++++++++++++++++++++++++--------
 include/grub/cryptodisk.h   |  5 +++--
 4 files changed, 63 insertions(+), 16 deletions(-)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 1e03a09..dd8870d 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
     /* TRANSLATORS: It's still restricted to cryptodisks only.  */
     {"all", 'a', 0, N_("Mount all."), 0, 0},
     {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
+    {"header", 'H', 0, N_("Read LUKS header from file"), 0, ARG_TYPE_STRING},
     {0, 0, 0, 0, 0, 0}
   };

@@ -808,6 +809,7 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)

 static int check_boot, have_it;
 static char *search_uuid;
+static grub_file_t hdr;

 static void
 cryptodisk_close (grub_cryptodisk_t dev)
@@ -832,13 +834,13 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)

   FOR_CRYPTODISK_DEVS (cr)
   {
-    dev = cr->scan (source, search_uuid, check_boot);
+    dev = cr->scan (source, search_uuid, check_boot, hdr);
     if (grub_errno)
       return grub_errno;
     if (!dev)
       continue;

-    err = cr->recover_key (source, dev);
+    err = cr->recover_key (source, dev, hdr);
     if (err)
     {
       cryptodisk_close (dev);
@@ -879,7 +881,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const char *cheat)

   FOR_CRYPTODISK_DEVS (cr)
   {
-    dev = cr->scan (source, search_uuid, check_boot);
+    dev = cr->scan (source, search_uuid, check_boot,0);
     if (grub_errno)
       return grub_errno;
     if (!dev)
@@ -933,6 +935,18 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
   if (argc < 1 && !state[1].set && !state[2].set)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required");

+  if (state[3].set) /* LUKS detached header */
+    {
+      if (state[0].set) /* Cannot use UUID lookup with detached header */
+        return GRUB_ERR_BAD_ARGUMENT;
+
+      hdr = grub_file_open (state[3].arg);
+      if (!hdr)
+        return grub_errno;
+    }
+  else
+    hdr = NULL;
+
   have_it = 0;
   if (state[0].set)
     {
@@ -1140,7 +1154,7 @@ GRUB_MOD_INIT (cryptodisk)
 {
   grub_disk_dev_register (&grub_cryptodisk_dev);
   cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
-			      N_("SOURCE|-u UUID|-a|-b"),
+			      N_("SOURCE|-u UUID|-a|-b|-H file"),
 			      N_("Mount a crypto device."), options);
   grub_procfs_register ("luks_script", &luks_script);
 }
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index e9d2329..f4394eb 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -52,6 +52,7 @@
 #include <grub/dl.h>
 #include <grub/err.h>
 #include <grub/disk.h>
+#include <grub/file.h>
 #include <grub/crypto.h>
 #include <grub/partition.h>
 #include <grub/i18n.h>
@@ -243,7 +244,8 @@ grub_util_get_geli_uuid (const char *dev)

 static grub_cryptodisk_t
 configure_ciphers (grub_disk_t disk, const char *check_uuid,
-		   int boot_only)
+		   int boot_only,
+		   grub_file_t hdr __attribute__ ((unused)) )
 {
   grub_cryptodisk_t newdev;
   struct grub_geli_phdr header;
@@ -398,7 +400,8 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
 }

 static grub_err_t
-recover_key (grub_disk_t source, grub_cryptodisk_t dev)
+recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+	     grub_file_t hdr __attribute__ ((unused)) )
 {
   grub_size_t keysize;
   grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 86c50c6..66e64c0 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -23,6 +23,7 @@
 #include <grub/dl.h>
 #include <grub/err.h>
 #include <grub/disk.h>
+#include <grub/file.h>
 #include <grub/crypto.h>
 #include <grub/partition.h>
 #include <grub/i18n.h>
@@ -66,7 +67,7 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,

 static grub_cryptodisk_t
 configure_ciphers (grub_disk_t disk, const char *check_uuid,
-		   int check_boot)
+		   int check_boot, grub_file_t hdr)
 {
   grub_cryptodisk_t newdev;
   const char *iptr;
@@ -86,11 +87,21 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
   int benbi_log = 0;
   grub_err_t err;

+  err = GRUB_ERR_NONE;
+
   if (check_boot)
     return NULL;

   /* Read the LUKS header.  */
-  err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
+  if (hdr)
+  {
+    grub_file_seek (hdr, 0);
+    if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
+        err = GRUB_ERR_READ_ERROR;
+  }
+  else
+    err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
+
   if (err)
     {
       if (err == GRUB_ERR_OUT_OF_RANGE)
@@ -304,12 +315,14 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
   grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
   newdev->modname = "luks";
   COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
+
   return newdev;
 }

 static grub_err_t
 luks_recover_key (grub_disk_t source,
-		  grub_cryptodisk_t dev)
+		  grub_cryptodisk_t dev,
+	          grub_file_t hdr)
 {
   struct grub_luks_phdr header;
   grub_size_t keysize;
@@ -321,8 +334,19 @@ luks_recover_key (grub_disk_t source,
   grub_err_t err;
   grub_size_t max_stripes = 1;
   char *tmp;
+  grub_uint32_t sector;
+
+  err = GRUB_ERR_NONE;
+
+  if (hdr)
+  {
+    grub_file_seek (hdr, 0);
+    if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
+        err = GRUB_ERR_READ_ERROR;
+  }
+  else
+    err = grub_disk_read (source, 0, 0, sizeof (header), &header);

-  err = grub_disk_read (source, 0, 0, sizeof (header), &header);
   if (err)
     return err;

@@ -391,13 +415,18 @@ luks_recover_key (grub_disk_t source,
 	  return grub_crypto_gcry_error (gcry_err);
 	}

+      sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
       length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));

       /* Read and decrypt the key material from the disk.  */
-      err = grub_disk_read (source,
-			    grub_be_to_cpu32 (header.keyblock
-					      [i].keyMaterialOffset), 0,
-			    length, split_key);
+      if (hdr)
+        {
+	  grub_file_seek (hdr, sector * 512);
+          if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
+            err = GRUB_ERR_READ_ERROR;
+        }
+      else
+        err = grub_disk_read (source, sector, 0, length, split_key);
       if (err)
 	{
 	  grub_free (split_key);
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index 32f564a..4e6e89a 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -20,6 +20,7 @@
 #define GRUB_CRYPTODISK_HEADER	1

 #include <grub/disk.h>
+#include <grub/file.h>
 #include <grub/crypto.h>
 #include <grub/list.h>
 #ifdef GRUB_UTIL
@@ -107,8 +108,8 @@ struct grub_cryptodisk_dev
   struct grub_cryptodisk_dev **prev;

   grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
-			     int boot_only);
-  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev);
+			     int boot_only, grub_file_t hdr);
+  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, grub_file_t hdr);
 };
 typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;

--
1.9.1


code:
From 3b7ef4a5fd57b042201fbefb92a217070b944d67 Mon Sep 17 00:00:00 2001
From: John Lane <john@lane.uk.net>
Date: Fri, 26 Jun 2015 13:37:10 +0100
Subject: [PATCH 03/10] Cryptomount support key files

---
 grub-core/disk/cryptodisk.c | 46 ++++++++++++++++++++++++++++++++++++++++++++-
 grub-core/disk/geli.c       |  4 +++-
 grub-core/disk/luks.c       | 44 +++++++++++++++++++++++++++++--------------
 include/grub/cryptodisk.h   |  5 ++++-
 4 files changed, 82 insertions(+), 17 deletions(-)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index dd8870d..0e7ced8 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -42,6 +42,9 @@ static const struct grub_arg_option options[] =
     {"all", 'a', 0, N_("Mount all."), 0, 0},
     {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
     {"header", 'H', 0, N_("Read LUKS header from file"), 0, ARG_TYPE_STRING},
+    {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
+    {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
+    {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
     {0, 0, 0, 0, 0, 0}
   };

@@ -810,6 +813,8 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
 static int check_boot, have_it;
 static char *search_uuid;
 static grub_file_t hdr;
+static grub_uint8_t *key, keyfile_buffer[GRUB_CRYPTODISK_MAX_KEYFILE_SIZE];
+static grub_size_t keyfile_size;

 static void
 cryptodisk_close (grub_cryptodisk_t dev)
@@ -840,7 +845,7 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
     if (!dev)
       continue;

-    err = cr->recover_key (source, dev, hdr);
+    err = cr->recover_key (source, dev, hdr, key, keyfile_size);
     if (err)
     {
       cryptodisk_close (dev);
@@ -948,6 +953,45 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
     hdr = NULL;

   have_it = 0;
+  key = NULL;
+
+  if (state[4].set) /* Key file; fails back to passphrase entry */
+    {
+      grub_file_t keyfile;
+      int keyfile_offset;
+      grub_size_t requested_keyfile_size;
+
+      requested_keyfile_size = state[6].set ? grub_strtoul(state[6].arg, 0, 0) : 0;
+
+      if (requested_keyfile_size > GRUB_CRYPTODISK_MAX_KEYFILE_SIZE)
+        grub_printf (N_("Key file size exceeds maximum (%llu)\n"), \
+	                     (unsigned long long) GRUB_CRYPTODISK_MAX_KEYFILE_SIZE);
+      else
+        {
+          keyfile_offset = state[5].set ? grub_strtoul (state[5].arg, 0, 0) : 0;
+          keyfile_size = requested_keyfile_size ? requested_keyfile_size : \
+		                             GRUB_CRYPTODISK_MAX_KEYFILE_SIZE;
+
+          keyfile = grub_file_open (state[4].arg);
+          if (!keyfile)
+            grub_printf (N_("Unable to open key file %s\n"), state[4].arg);
+          else if (grub_file_seek (keyfile, keyfile_offset) == (grub_off_t)-1)
+            grub_printf (N_("Unable to seek to offset %d in key file\n"), keyfile_offset);
+          else
+            {
+              keyfile_size = grub_file_read (keyfile, keyfile_buffer, keyfile_size);
+              if (keyfile_size == (grub_size_t)-1)
+                 grub_printf (N_("Error reading key file\n"));
+	      else if (requested_keyfile_size && (keyfile_size != requested_keyfile_size))
+                 grub_printf (N_("Cannot read %llu bytes for key file (read %llu bytes)\n"),
+                                                (unsigned long long) requested_keyfile_size,
+						(unsigned long long) keyfile_size);
+              else
+                key = keyfile_buffer;
+	    }
+        }
+    }
+
   if (state[0].set)
     {
       grub_cryptodisk_t dev;
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index f4394eb..da6aa6a 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -401,7 +401,9 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,

 static grub_err_t
 recover_key (grub_disk_t source, grub_cryptodisk_t dev,
-	     grub_file_t hdr __attribute__ ((unused)) )
+	     grub_file_t hdr __attribute__ ((unused)),
+	     grub_uint8_t *key __attribute__ ((unused)),
+	     grub_size_t keyfile_size __attribute__ ((unused)) )
 {
   grub_size_t keysize;
   grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 66e64c0..5882368 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -322,12 +322,16 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
 static grub_err_t
 luks_recover_key (grub_disk_t source,
 		  grub_cryptodisk_t dev,
-	          grub_file_t hdr)
+		  grub_file_t hdr,
+		  grub_uint8_t *keyfile_bytes,
+		  grub_size_t keyfile_bytes_size)
 {
   struct grub_luks_phdr header;
   grub_size_t keysize;
   grub_uint8_t *split_key = NULL;
-  char passphrase[MAX_PASSPHRASE] = "";
+  char interactive_passphrase[MAX_PASSPHRASE] = "";
+  grub_uint8_t *passphrase;
+  grub_size_t passphrase_length;
   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
   unsigned i;
   grub_size_t length;
@@ -364,18 +368,30 @@ luks_recover_key (grub_disk_t source,
   if (!split_key)
     return grub_errno;

-  /* Get the passphrase from the user.  */
-  tmp = NULL;
-  if (source->partition)
-    tmp = grub_partition_get_name (source->partition);
-  grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
-	       source->partition ? "," : "", tmp ? : "",
-	       dev->uuid);
-  grub_free (tmp);
-  if (!grub_password_get (passphrase, MAX_PASSPHRASE))
+  if (keyfile_bytes)
     {
-      grub_free (split_key);
-      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+      /* Use bytestring from key file as passphrase */
+      passphrase = keyfile_bytes;
+      passphrase_length = keyfile_bytes_size;
+    }
+  else
+    {
+      /* Get the passphrase from the user.  */
+      tmp = NULL;
+      if (source->partition)
+        tmp = grub_partition_get_name (source->partition);
+      grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
+		    source->partition ? "," : "", tmp ? : "", dev->uuid);
+      grub_free (tmp);
+      if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
+        {
+          grub_free (split_key);
+          return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+        }
+
+      passphrase = (grub_uint8_t *)interactive_passphrase;
+      passphrase_length = grub_strlen (interactive_passphrase);
+
     }

   /* Try to recover master key from each active keyslot.  */
@@ -393,7 +409,7 @@ luks_recover_key (grub_disk_t source,

       /* Calculate the PBKDF2 of the user supplied passphrase.  */
       gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
-				     grub_strlen (passphrase),
+				     passphrase_length,
 				     header.keyblock[i].passwordSalt,
 				     sizeof (header.keyblock[i].passwordSalt),
 				     grub_be_to_cpu32 (header.keyblock[i].
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index 4e6e89a..67f6b0b 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -55,6 +55,8 @@ typedef enum
 #define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
 #define GRUB_CRYPTODISK_MAX_KEYLEN 128

+#define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192
+
 struct grub_cryptodisk;

 typedef gcry_err_code_t
@@ -109,7 +111,8 @@ struct grub_cryptodisk_dev

   grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
 			     int boot_only, grub_file_t hdr);
-  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, grub_file_t hdr);
+  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
+			    grub_file_t hdr, grub_uint8_t *key, grub_size_t keyfile_size);
 };
 typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;

--
1.9.1


code:
From f39e8ee5696f15860c73b07e652a8b59fcc834c7 Mon Sep 17 00:00:00 2001
From: John Lane <john@lane.uk.net>
Date: Fri, 26 Jun 2015 13:49:58 +0100
Subject: [PATCH 04/10] Cryptomount luks allow multiple passphrase attempts

---
 grub-core/disk/luks.c | 278 ++++++++++++++++++++++++++------------------------
 1 file changed, 143 insertions(+), 135 deletions(-)

diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 5882368..11e437e 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -321,10 +321,10 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,

 static grub_err_t
 luks_recover_key (grub_disk_t source,
-		  grub_cryptodisk_t dev,
-		  grub_file_t hdr,
-		  grub_uint8_t *keyfile_bytes,
-		  grub_size_t keyfile_bytes_size)
+                  grub_cryptodisk_t dev,
+                  grub_file_t hdr,
+                  grub_uint8_t *keyfile_bytes,
+                  grub_size_t keyfile_bytes_size)
 {
   struct grub_luks_phdr header;
   grub_size_t keysize;
@@ -339,6 +339,7 @@ luks_recover_key (grub_disk_t source,
   grub_size_t max_stripes = 1;
   char *tmp;
   grub_uint32_t sector;
+  unsigned attempts = 2;

   err = GRUB_ERR_NONE;

@@ -361,151 +362,158 @@ luks_recover_key (grub_disk_t source,

   for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
     if (grub_be_to_cpu32 (header.keyblock[i].active) == LUKS_KEY_ENABLED
-	&& grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
+        && grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);

   split_key = grub_malloc (keysize * max_stripes);
   if (!split_key)
     return grub_errno;

-  if (keyfile_bytes)
+  while (attempts)
     {
-      /* Use bytestring from key file as passphrase */
-      passphrase = keyfile_bytes;
-      passphrase_length = keyfile_bytes_size;
-    }
-  else
-    {
-      /* Get the passphrase from the user.  */
-      tmp = NULL;
-      if (source->partition)
-        tmp = grub_partition_get_name (source->partition);
-      grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
-		    source->partition ? "," : "", tmp ? : "", dev->uuid);
-      grub_free (tmp);
-      if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
+      if (keyfile_bytes)
         {
-          grub_free (split_key);
-          return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-        }
-
-      passphrase = (grub_uint8_t *)interactive_passphrase;
-      passphrase_length = grub_strlen (interactive_passphrase);
-
-    }
-
-  /* Try to recover master key from each active keyslot.  */
-  for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
-    {
-      gcry_err_code_t gcry_err;
-      grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
-      grub_uint8_t digest[GRUB_CRYPTODISK_MAX_KEYLEN];
-
-      /* Check if keyslot is enabled.  */
-      if (grub_be_to_cpu32 (header.keyblock[i].active) != LUKS_KEY_ENABLED)
-	continue;
-
-      grub_dprintf ("luks", "Trying keyslot %d\n", i);
-
-      /* Calculate the PBKDF2 of the user supplied passphrase.  */
-      gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
-				     passphrase_length,
-				     header.keyblock[i].passwordSalt,
-				     sizeof (header.keyblock[i].passwordSalt),
-				     grub_be_to_cpu32 (header.keyblock[i].
-						       passwordIterations),
-				     digest, keysize);
-
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
-
-      grub_dprintf ("luks", "PBKDF2 done\n");
-
-      gcry_err = grub_cryptodisk_setkey (dev, digest, keysize);
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
-
-      sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
-      length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
-
-      /* Read and decrypt the key material from the disk.  */
-      if (hdr)
-        {
-	  grub_file_seek (hdr, sector * 512);
-          if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
-            err = GRUB_ERR_READ_ERROR;
+          /* Use bytestring from key file as passphrase */
+          passphrase = keyfile_bytes;
+          passphrase_length = keyfile_bytes_size;
+	  keyfile_bytes = NULL; /* use it only once */
         }
       else
-        err = grub_disk_read (source, sector, 0, length, split_key);
-      if (err)
-	{
-	  grub_free (split_key);
-	  return err;
-	}
-
-      gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
-
-      /* Merge the decrypted key material to get the candidate master key.  */
-      gcry_err = AF_merge (dev->hash, split_key, candidate_key, keysize,
-			   grub_be_to_cpu32 (header.keyblock[i].stripes));
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
-
-      grub_dprintf ("luks", "candidate key recovered\n");
-
-      /* Calculate the PBKDF2 of the candidate master key.  */
-      gcry_err = grub_crypto_pbkdf2 (dev->hash, candidate_key,
-				     grub_be_to_cpu32 (header.keyBytes),
-				     header.mkDigestSalt,
-				     sizeof (header.mkDigestSalt),
-				     grub_be_to_cpu32
-				     (header.mkDigestIterations),
-				     candidate_digest,
-				     sizeof (candidate_digest));
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
-
-      /* Compare the calculated PBKDF2 to the digest stored
-         in the header to see if it's correct.  */
-      if (grub_memcmp (candidate_digest, header.mkDigest,
-		       sizeof (header.mkDigest)) != 0)
-	{
-	  grub_dprintf ("luks", "bad digest\n");
-	  continue;
-	}
+        {
+          /* Get the passphrase from the user.  */
+          tmp = NULL;
+          if (source->partition)
+            tmp = grub_partition_get_name (source->partition);
+          grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
+                              source->partition ? "," : "", tmp ? : "", dev->uuid);
+          grub_free (tmp);
+          if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
+            {
+              grub_free (split_key);
+              return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+            }
+
+          passphrase = (grub_uint8_t *)interactive_passphrase;
+          passphrase_length = grub_strlen (interactive_passphrase);

-      /* TRANSLATORS: It's a cryptographic key slot: one element of an array
-	 where each element is either empty or holds a key.  */
-      grub_printf_ (N_("Slot %d opened\n"), i);
+        }

-      /* Set the master key.  */
-      gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize);
-      if (gcry_err)
-	{
-	  grub_free (split_key);
-	  return grub_crypto_gcry_error (gcry_err);
-	}
+      /* Try to recover master key from each active keyslot.  */
+      for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
+        {
+          gcry_err_code_t gcry_err;
+          grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
+          grub_uint8_t digest[GRUB_CRYPTODISK_MAX_KEYLEN];
+
+          /* Check if keyslot is enabled.  */
+          if (grub_be_to_cpu32 (header.keyblock[i].active) != LUKS_KEY_ENABLED)
+            continue;
+
+          grub_dprintf ("luks", "Trying keyslot %d\n", i);
+
+          /* Calculate the PBKDF2 of the user supplied passphrase.  */
+          gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
+                                         passphrase_length,
+                                         header.keyblock[i].passwordSalt,
+                                         sizeof (header.keyblock[i].passwordSalt),
+                                         grub_be_to_cpu32 (header.keyblock[i].
+                                         passwordIterations),
+                                         digest, keysize);
+
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }
+
+          grub_dprintf ("luks", "PBKDF2 done\n");
+
+          gcry_err = grub_cryptodisk_setkey (dev, digest, keysize);
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }
+
+          sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
+          length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
+
+          /* Read and decrypt the key material from the disk.  */
+          if (hdr)
+            {
+              grub_file_seek (hdr, sector * 512);
+              if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
+                err = GRUB_ERR_READ_ERROR;
+            }
+          else
+            err = grub_disk_read (source, sector, 0, length, split_key);
+          if (err)
+            {
+              grub_free (split_key);
+              return err;
+            }
+
+          gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }
+
+          /* Merge the decrypted key material to get the candidate master key.  */
+          gcry_err = AF_merge (dev->hash, split_key, candidate_key, keysize,
+                               grub_be_to_cpu32 (header.keyblock[i].stripes));
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }
+
+          grub_dprintf ("luks", "candidate key recovered\n");
+
+          /* Calculate the PBKDF2 of the candidate master key.  */
+          gcry_err = grub_crypto_pbkdf2 (dev->hash, candidate_key,
+                                     grub_be_to_cpu32 (header.keyBytes),
+                                     header.mkDigestSalt,
+                                     sizeof (header.mkDigestSalt),
+                                     grub_be_to_cpu32
+                                     (header.mkDigestIterations),
+                                     candidate_digest,
+                                     sizeof (candidate_digest));
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }
+
+          /* Compare the calculated PBKDF2 to the digest stored
+             in the header to see if it's correct.  */
+          if (grub_memcmp (candidate_digest, header.mkDigest,
+                                             sizeof (header.mkDigest)) != 0)
+            {
+              grub_dprintf ("luks", "bad digest\n");
+              continue;
+            }
+
+          /* TRANSLATORS: It's a cryptographic key slot: one element of an array
+             where each element is either empty or holds a key.  */
+          grub_printf_ (N_("Slot %d opened\n"), i);
+
+          /* Set the master key.  */
+          gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize);
+          if (gcry_err)
+            {
+              grub_free (split_key);
+              return grub_crypto_gcry_error (gcry_err);
+            }

-      grub_free (split_key);
+          grub_free (split_key);

-      return GRUB_ERR_NONE;
+          return GRUB_ERR_NONE;
+        }
+      grub_printf_ (N_("Failed to decrypt master key.\n"));
+      if (--attempts) grub_printf_ (N_("%u attempt%s remaining.\n"), attempts,
+		                    (attempts==1) ? "" : "s");
     }

   grub_free (split_key);
--
1.9.1


code:
From 632155a6e8923cdd5c1d4e23576cfadcb78ee67b Mon Sep 17 00:00:00 2001
From: John Lane <john@lane.uk.net>
Date: Fri, 26 Jun 2015 22:09:52 +0100
Subject: [PATCH 05/10] Cryptomount support plain dm-crypt

---
 grub-core/disk/cryptodisk.c | 298 +++++++++++++++++++++++++++++++++++++++++++-
 grub-core/disk/luks.c       | 195 +----------------------------
 include/grub/cryptodisk.h   |   8 ++
 3 files changed, 311 insertions(+), 190 deletions(-)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 0e7ced8..57fb904 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -45,6 +45,12 @@ static const struct grub_arg_option options[] =
     {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
     {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
     {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
+    {"plain", 'p', 0, N_("Plain (no LUKS header)"), 0, ARG_TYPE_NONE},
+    {"cipher", 'c', 0, N_("Plain mode cipher"), 0, ARG_TYPE_STRING},
+    {"digest", 'd', 0, N_("Plain mode passphrase digest (hash)"), 0, ARG_TYPE_STRING},
+    {"offset", 'o', 0, N_("Plain mode data sector offset"), 0, ARG_TYPE_INT},
+    {"size", 's', 0, N_("Size of raw device (sectors, defaults to whole device)"), 0, ARG_TYPE_INT},
+    {"key-size", 'K', 0, N_("Set key size (bits)"), 0, ARG_TYPE_INT},
     {0, 0, 0, 0, 0, 0}
   };

@@ -932,6 +938,48 @@ grub_cryptodisk_scan_device (const char *name,
   return have_it && search_uuid ? 1 : 0;
 }

+/* Hashes a passphrase into a key and stores it with cipher. */
+static gcry_err_code_t
+set_passphrase (grub_cryptodisk_t dev, grub_size_t keysize, const char *passphrase)
+{
+  grub_uint8_t derived_hash[GRUB_CRYPTODISK_MAX_KEYLEN * 2], *dh = derived_hash;
+  char *p;
+  unsigned int round, i;
+  unsigned int len, size;
+
+  /* Need no passphrase if there's no key */
+  if (keysize == 0)
+    return GPG_ERR_INV_KEYLEN;
+
+  /* Hack to support the "none" hash */
+  if (dev->hash)
+    len = dev->hash->mdlen;
+  else
+    len = grub_strlen (passphrase);
+
+  if (keysize > GRUB_CRYPTODISK_MAX_KEYLEN || len > GRUB_CRYPTODISK_MAX_KEYLEN)
+    return GPG_ERR_INV_KEYLEN;
+
+  p = grub_malloc (grub_strlen (passphrase) + 2 + keysize / len);
+  if (!p)
+    return grub_errno;
+
+  for (round = 0, size = keysize; size; round++, dh += len, size -= len)
+    {
+      for (i = 0; i < round; i++)
+	p[i] = 'A';
+
+      grub_strcpy (p + i, passphrase);
+
+      if (len > size)
+	len = size;
+
+      grub_crypto_hash (dev->hash, dh, p, grub_strlen (p));
+    }
+
+  return grub_cryptodisk_setkey (dev, derived_hash, keysize);
+}
+
 static grub_err_t
 grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
 {
@@ -1061,6 +1109,64 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)

       err = grub_cryptodisk_scan_device_real (diskname, disk);

+      if (state[7].set) /* Plain mode */
+        {
+          char *cipher;
+          char *mode;
+          char *digest;
+          int offset, size, key_size;
+
+          cipher = grub_strdup (state[8].set ? state[8].arg : GRUB_CRYPTODISK_PLAIN_CIPHER);
+          digest = grub_strdup (state[9].set ? state[9].arg : GRUB_CRYPTODISK_PLAIN_DIGEST);
+          offset = state[10].set ? grub_strtoul (state[10].arg, 0, 0) : 0;
+          size   = state[11].set ? grub_strtoul (state[11].arg, 0, 0) : 0;
+          key_size = ( state[12].set ? grub_strtoul (state[12].arg, 0, 0) \
+			             : GRUB_CRYPTODISK_PLAIN_KEYSIZE ) / 8;
+
+          /* no strtok, do it manually */
+          mode = grub_strchr(cipher,'-');
+          if (!mode)
+            return GRUB_ERR_BAD_ARGUMENT;
+          else
+            *mode++ = 0;
+
+          dev = grub_cryptodisk_create (disk, NULL, cipher, mode, digest);
+
+          dev->offset = offset;
+	  if (size) dev->total_length = size;
+
+          if (key)
+	    {
+              err = grub_cryptodisk_setkey (dev, key, key_size);
+              if (err)
+                return err;
+	    }
+	  else
+	    {
+              char passphrase[GRUB_CRYPTODISK_MAX_PASSPHRASE] = "";
+
+              grub_printf_ (N_("Enter passphrase for %s: "), diskname);
+              if (!grub_password_get (passphrase, GRUB_CRYPTODISK_MAX_PASSPHRASE))
+                return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+
+              err = set_passphrase (dev, key_size, passphrase);
+              if (err)
+                {
+                  grub_crypto_cipher_close (dev->cipher);
+                  return err;
+                }
+	    }
+
+          grub_cryptodisk_insert (dev, diskname, disk);
+
+          grub_free (cipher);
+          grub_free (digest);
+
+          err = GRUB_ERR_NONE;
+        }
+      else
+        err = grub_cryptodisk_scan_device_real (args[0], disk);
+
       grub_disk_close (disk);
       if (disklast)
 	*disklast = ')';
@@ -1192,13 +1298,203 @@ struct grub_procfs_entry luks_script =
   .get_contents = luks_script_get
 };

+grub_cryptodisk_t
+grub_cryptodisk_create (grub_disk_t disk, char *uuid,
+		   char *ciphername, char *ciphermode, char *hashspec)
+{
+  grub_cryptodisk_t newdev;
+  char *cipheriv = NULL;
+  grub_crypto_cipher_handle_t cipher = NULL, secondary_cipher = NULL;
+  grub_crypto_cipher_handle_t essiv_cipher = NULL;
+  const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
+  const struct gcry_cipher_spec *ciph;
+  grub_cryptodisk_mode_t mode;
+  grub_cryptodisk_mode_iv_t mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
+  int benbi_log = 0;
+
+  if (!uuid)
+    uuid = (char*)"00000000000000000000000000000000";
+
+  ciph = grub_crypto_lookup_cipher_by_name (ciphername);
+  if (!ciph)
+    {
+      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Cipher %s isn't available",
+		  ciphername);
+      return NULL;
+    }
+
+  /* Configure the cipher used for the bulk data.  */
+  cipher = grub_crypto_cipher_open (ciph);
+  if (!cipher)
+    return NULL;
+
+  /* Configure the cipher mode.  */
+  if (grub_strcmp (ciphermode, "ecb") == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_ECB;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
+      cipheriv = NULL;
+    }
+  else if (grub_strcmp (ciphermode, "plain") == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_CBC;
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
+      cipheriv = NULL;
+    }
+  else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_CBC;
+      cipheriv = ciphermode + sizeof ("cbc-") - 1;
+    }
+  else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_PCBC;
+      cipheriv = ciphermode + sizeof ("pcbc-") - 1;
+    }
+  else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_XTS;
+      cipheriv = ciphermode + sizeof ("xts-") - 1;
+      secondary_cipher = grub_crypto_cipher_open (ciph);
+      if (!secondary_cipher)
+	{
+	  grub_crypto_cipher_close (cipher);
+	  return NULL;
+	}
+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
+	{
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
+		      cipher->cipher->blocksize);
+	  grub_crypto_cipher_close (cipher);
+	  grub_crypto_cipher_close (secondary_cipher);
+	  return NULL;
+	}
+      if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
+	{
+	  grub_crypto_cipher_close (cipher);
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
+		      secondary_cipher->cipher->blocksize);
+	  grub_crypto_cipher_close (secondary_cipher);
+	  return NULL;
+	}
+    }
+  else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
+    {
+      mode = GRUB_CRYPTODISK_MODE_LRW;
+      cipheriv = ciphermode + sizeof ("lrw-") - 1;
+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
+	{
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
+		      cipher->cipher->blocksize);
+	  grub_crypto_cipher_close (cipher);
+	  return NULL;
+	}
+    }
+  else
+    {
+      grub_crypto_cipher_close (cipher);
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown cipher mode: %s",
+		  ciphermode);
+      return NULL;
+    }
+
+  if (cipheriv == NULL);
+  else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
+  else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
+  else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
+    {
+      if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
+	  || cipher->cipher->blocksize == 0)
+	grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported benbi blocksize: %d",
+		    cipher->cipher->blocksize);
+	/* FIXME should we return an error here? */
+      for (benbi_log = 0;
+	   (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
+	   benbi_log++);
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
+    }
+  else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
+  else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
+    {
+      char *hash_str = cipheriv + 6;
+
+      mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
+
+      /* Configure the hash and cipher used for ESSIV.  */
+      essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
+      if (!essiv_hash)
+	{
+	  grub_crypto_cipher_close (cipher);
+	  grub_crypto_cipher_close (secondary_cipher);
+	  grub_error (GRUB_ERR_FILE_NOT_FOUND,
+		      "Couldn't load %s hash", hash_str);
+	  return NULL;
+	}
+      essiv_cipher = grub_crypto_cipher_open (ciph);
+      if (!essiv_cipher)
+	{
+	  grub_crypto_cipher_close (cipher);
+	  grub_crypto_cipher_close (secondary_cipher);
+	  return NULL;
+	}
+    }
+  else
+    {
+      grub_crypto_cipher_close (cipher);
+      grub_crypto_cipher_close (secondary_cipher);
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown IV mode: %s",
+		  cipheriv);
+      return NULL;
+    }
+
+  /* Configure the passphrase hash (LUKS also uses AF splitter and HMAC).  */
+  hash = grub_crypto_lookup_md_by_name (hashspec);
+  if (!hash)
+    {
+      grub_crypto_cipher_close (cipher);
+      grub_crypto_cipher_close (essiv_cipher);
+      grub_crypto_cipher_close (secondary_cipher);
+      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Couldn't load %s hash",
+		  hashspec);
+      return NULL;
+    }
+
+  newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
+  if (!newdev)
+    {
+      grub_crypto_cipher_close (cipher);
+      grub_crypto_cipher_close (essiv_cipher);
+      grub_crypto_cipher_close (secondary_cipher);
+      return NULL;
+    }
+  newdev->cipher = cipher;
+  newdev->offset = 0;
+  newdev->source_disk = NULL;
+  newdev->benbi_log = benbi_log;
+  newdev->mode = mode;
+  newdev->mode_iv = mode_iv;
+  newdev->secondary_cipher = secondary_cipher;
+  newdev->essiv_cipher = essiv_cipher;
+  newdev->essiv_hash = essiv_hash;
+  newdev->hash = hash;
+  newdev->log_sector_size = 9;
+  newdev->total_length = grub_disk_get_size (disk) - newdev->offset;
+  grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
+  COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
+
+  return newdev;
+}
+
 static grub_extcmd_t cmd;

 GRUB_MOD_INIT (cryptodisk)
 {
   grub_disk_dev_register (&grub_cryptodisk_dev);
   cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
-			      N_("SOURCE|-u UUID|-a|-b|-H file"),
+			      N_("SOURCE|-u UUID|-a|-b|-H file|-p -c cipher -d digest"),
 			      N_("Mount a crypto device."), options);
   grub_procfs_register ("luks_script", &luks_script);
 }
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 11e437e..4ebe21b 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -30,8 +30,6 @@

 GRUB_MOD_LICENSE ("GPLv3+");

-#define MAX_PASSPHRASE 256
-
 #define LUKS_KEY_ENABLED  0x00AC71F3

 /* On disk LUKS header */
@@ -76,15 +74,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
   char uuid[sizeof (header.uuid) + 1];
   char ciphername[sizeof (header.cipherName) + 1];
   char ciphermode[sizeof (header.cipherMode) + 1];
-  char *cipheriv = NULL;
   char hashspec[sizeof (header.hashSpec) + 1];
-  grub_crypto_cipher_handle_t cipher = NULL, secondary_cipher = NULL;
-  grub_crypto_cipher_handle_t essiv_cipher = NULL;
-  const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
-  const struct gcry_cipher_spec *ciph;
-  grub_cryptodisk_mode_t mode;
-  grub_cryptodisk_mode_iv_t mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
-  int benbi_log = 0;
   grub_err_t err;

   err = GRUB_ERR_NONE;
@@ -119,7 +109,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
        iptr++)
     {
       if (*iptr != '-')
-	*optr++ = *iptr;
+        *optr++ = *iptr;
     }
   *optr = 0;

@@ -129,6 +119,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
       return NULL;
     }

+
   /* Make sure that strings are null terminated.  */
   grub_memcpy (ciphername, header.cipherName, sizeof (header.cipherName));
   ciphername[sizeof (header.cipherName)] = 0;
@@ -137,184 +128,10 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
   grub_memcpy (hashspec, header.hashSpec, sizeof (header.hashSpec));
   hashspec[sizeof (header.hashSpec)] = 0;

-  ciph = grub_crypto_lookup_cipher_by_name (ciphername);
-  if (!ciph)
-    {
-      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Cipher %s isn't available",
-		  ciphername);
-      return NULL;
-    }
-
-  /* Configure the cipher used for the bulk data.  */
-  cipher = grub_crypto_cipher_open (ciph);
-  if (!cipher)
-    return NULL;
-
-  if (grub_be_to_cpu32 (header.keyBytes) > 1024)
-    {
-      grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid keysize %d",
-		  grub_be_to_cpu32 (header.keyBytes));
-      grub_crypto_cipher_close (cipher);
-      return NULL;
-    }
-
-  /* Configure the cipher mode.  */
-  if (grub_strcmp (ciphermode, "ecb") == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_ECB;
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-      cipheriv = NULL;
-    }
-  else if (grub_strcmp (ciphermode, "plain") == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_CBC;
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-      cipheriv = NULL;
-    }
-  else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_CBC;
-      cipheriv = ciphermode + sizeof ("cbc-") - 1;
-    }
-  else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_PCBC;
-      cipheriv = ciphermode + sizeof ("pcbc-") - 1;
-    }
-  else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_XTS;
-      cipheriv = ciphermode + sizeof ("xts-") - 1;
-      secondary_cipher = grub_crypto_cipher_open (ciph);
-      if (!secondary_cipher)
-	{
-	  grub_crypto_cipher_close (cipher);
-	  return NULL;
-	}
-      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-	{
-	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
-		      cipher->cipher->blocksize);
-	  grub_crypto_cipher_close (cipher);
-	  grub_crypto_cipher_close (secondary_cipher);
-	  return NULL;
-	}
-      if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-	{
-	  grub_crypto_cipher_close (cipher);
-	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
-		      secondary_cipher->cipher->blocksize);
-	  grub_crypto_cipher_close (secondary_cipher);
-	  return NULL;
-	}
-    }
-  else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
-    {
-      mode = GRUB_CRYPTODISK_MODE_LRW;
-      cipheriv = ciphermode + sizeof ("lrw-") - 1;
-      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-	{
-	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
-		      cipher->cipher->blocksize);
-	  grub_crypto_cipher_close (cipher);
-	  return NULL;
-	}
-    }
-  else
-    {
-      grub_crypto_cipher_close (cipher);
-      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown cipher mode: %s",
-		  ciphermode);
-      return NULL;
-    }
-
-  if (cipheriv == NULL);
-  else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-  else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
-  else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
-    {
-      if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
-	  || cipher->cipher->blocksize == 0)
-	grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported benbi blocksize: %d",
-		    cipher->cipher->blocksize);
-	/* FIXME should we return an error here? */
-      for (benbi_log = 0;
-	   (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
-	   benbi_log++);
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
-    }
-  else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
-  else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
-    {
-      char *hash_str = cipheriv + 6;
-
-      mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
-
-      /* Configure the hash and cipher used for ESSIV.  */
-      essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
-      if (!essiv_hash)
-	{
-	  grub_crypto_cipher_close (cipher);
-	  grub_crypto_cipher_close (secondary_cipher);
-	  grub_error (GRUB_ERR_FILE_NOT_FOUND,
-		      "Couldn't load %s hash", hash_str);
-	  return NULL;
-	}
-      essiv_cipher = grub_crypto_cipher_open (ciph);
-      if (!essiv_cipher)
-	{
-	  grub_crypto_cipher_close (cipher);
-	  grub_crypto_cipher_close (secondary_cipher);
-	  return NULL;
-	}
-    }
-  else
-    {
-      grub_crypto_cipher_close (cipher);
-      grub_crypto_cipher_close (secondary_cipher);
-      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown IV mode: %s",
-		  cipheriv);
-      return NULL;
-    }
-
-  /* Configure the hash used for the AF splitter and HMAC.  */
-  hash = grub_crypto_lookup_md_by_name (hashspec);
-  if (!hash)
-    {
-      grub_crypto_cipher_close (cipher);
-      grub_crypto_cipher_close (essiv_cipher);
-      grub_crypto_cipher_close (secondary_cipher);
-      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Couldn't load %s hash",
-		  hashspec);
-      return NULL;
-    }
+  newdev = grub_cryptodisk_create (disk, uuid, ciphername, ciphermode, hashspec);

-  newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
-  if (!newdev)
-    {
-      grub_crypto_cipher_close (cipher);
-      grub_crypto_cipher_close (essiv_cipher);
-      grub_crypto_cipher_close (secondary_cipher);
-      return NULL;
-    }
-  newdev->cipher = cipher;
   newdev->offset = grub_be_to_cpu32 (header.payloadOffset);
-  newdev->source_disk = NULL;
-  newdev->benbi_log = benbi_log;
-  newdev->mode = mode;
-  newdev->mode_iv = mode_iv;
-  newdev->secondary_cipher = secondary_cipher;
-  newdev->essiv_cipher = essiv_cipher;
-  newdev->essiv_hash = essiv_hash;
-  newdev->hash = hash;
-  newdev->log_sector_size = 9;
-  newdev->total_length = grub_disk_get_size (disk) - newdev->offset;
-  grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
   newdev->modname = "luks";
-  COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));

   return newdev;
 }
@@ -329,7 +146,7 @@ luks_recover_key (grub_disk_t source,
   struct grub_luks_phdr header;
   grub_size_t keysize;
   grub_uint8_t *split_key = NULL;
-  char interactive_passphrase[MAX_PASSPHRASE] = "";
+  char interactive_passphrase[GRUB_CRYPTODISK_MAX_PASSPHRASE] = "";
   grub_uint8_t *passphrase;
   grub_size_t passphrase_length;
   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
@@ -376,7 +193,7 @@ luks_recover_key (grub_disk_t source,
           /* Use bytestring from key file as passphrase */
           passphrase = keyfile_bytes;
           passphrase_length = keyfile_bytes_size;
-	  keyfile_bytes = NULL; /* use it only once */
+          keyfile_bytes = NULL; /* use it only once */
         }
       else
         {
@@ -387,7 +204,7 @@ luks_recover_key (grub_disk_t source,
           grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
                               source->partition ? "," : "", tmp ? : "", dev->uuid);
           grub_free (tmp);
-          if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
+          if (!grub_password_get (interactive_passphrase, GRUB_CRYPTODISK_MAX_PASSPHRASE))
             {
               grub_free (split_key);
               return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index 67f6b0b..bb25ab7 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -54,9 +54,14 @@ typedef enum
 #define GRUB_CRYPTODISK_GF_LOG_BYTES (GRUB_CRYPTODISK_GF_LOG_SIZE - 3)
 #define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
 #define GRUB_CRYPTODISK_MAX_KEYLEN 128
+#define GRUB_CRYPTODISK_MAX_PASSPHRASE 256

 #define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192

+#define GRUB_CRYPTODISK_PLAIN_CIPHER  "aes-cbc-essiv:sha256"
+#define GRUB_CRYPTODISK_PLAIN_DIGEST  "ripemd160"
+#define GRUB_CRYPTODISK_PLAIN_KEYSIZE 256
+
 struct grub_cryptodisk;

 typedef gcry_err_code_t
@@ -160,4 +165,7 @@ grub_util_get_geli_uuid (const char *dev);
 grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid);
 grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);

+grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
+				   char *ciphername, char *ciphermode, char *digest);
+
 #endif
--
1.9.1


code:
From 047a5b323de2a0c45a6fe2b6854106830da5f3ae Mon Sep 17 00:00:00 2001
From: John Lane <john@lane.uk.net>
Date: Fri, 26 Jun 2015 22:48:03 +0100
Subject: [PATCH 06/10] Cryptomount support for hyphens in UUID

---
 grub-core/disk/cryptodisk.c | 20 +++++++++++++++++---
 grub-core/disk/luks.c       | 26 ++++++++------------------
 include/grub/cryptodisk.h   |  2 ++
 3 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 57fb904..5430b2e 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -114,6 +114,20 @@ gf_mul_be (grub_uint8_t *o, const grub_uint8_t *a, const grub_uint8_t *b)
     }
 }

+int
+grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b)
+{
+  while ((*uuid_a != '\0') && (*uuid_b != '\0'))
+    {
+      while (*uuid_a == '-') uuid_a++;
+      while (*uuid_b == '-') uuid_b++;
+      if (grub_toupper(*uuid_a) != grub_toupper(*uuid_b)) break;
+      uuid_a++;
+      uuid_b++;
+    }
+  return (*uuid_a == '\0') && (*uuid_b == '\0');
+}
+
 static gcry_err_code_t
 grub_crypto_pcbc_decrypt (grub_crypto_cipher_handle_t cipher,
 			 void *out, void *in, grub_size_t size,
@@ -508,8 +522,8 @@ grub_cryptodisk_open (const char *name, grub_disk_t disk)
   if (grub_memcmp (name, "cryptouuid/", sizeof ("cryptouuid/") - 1) == 0)
     {
       for (dev = cryptodisk_list; dev != NULL; dev = dev->next)
-	if (grub_strcasecmp (name + sizeof ("cryptouuid/") - 1, dev->uuid) == 0)
-	  break;
+        if (grub_cryptodisk_uuidcmp(name + sizeof ("cryptouuid/") - 1, dev->uuid))
+          break;
     }
   else
     {
@@ -741,7 +755,7 @@ grub_cryptodisk_get_by_uuid (const char *uuid)
 {
   grub_cryptodisk_t dev;
   for (dev = cryptodisk_list; dev != NULL; dev = dev->next)
-    if (grub_strcasecmp (dev->uuid, uuid) == 0)
+    if (grub_cryptodisk_uuidcmp(dev->uuid, uuid))
       return dev;
   return NULL;
 }
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 4ebe21b..80a7606 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -68,9 +68,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
 		   int check_boot, grub_file_t hdr)
 {
   grub_cryptodisk_t newdev;
-  const char *iptr;
   struct grub_luks_phdr header;
-  char *optr;
   char uuid[sizeof (header.uuid) + 1];
   char ciphername[sizeof (header.cipherName) + 1];
   char ciphermode[sizeof (header.cipherMode) + 1];
@@ -104,22 +102,6 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
       || grub_be_to_cpu16 (header.version) != 1)
     return NULL;

-  optr = uuid;
-  for (iptr = header.uuid; iptr < &header.uuid[ARRAY_SIZE (header.uuid)];
-       iptr++)
-    {
-      if (*iptr != '-')
-        *optr++ = *iptr;
-    }
-  *optr = 0;
-
-  if (check_uuid && grub_strcasecmp (check_uuid, uuid) != 0)
-    {
-      grub_dprintf ("luks", "%s != %s\n", uuid, check_uuid);
-      return NULL;
-    }
-
-
   /* Make sure that strings are null terminated.  */
   grub_memcpy (ciphername, header.cipherName, sizeof (header.cipherName));
   ciphername[sizeof (header.cipherName)] = 0;
@@ -127,6 +109,14 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
   ciphermode[sizeof (header.cipherMode)] = 0;
   grub_memcpy (hashspec, header.hashSpec, sizeof (header.hashSpec));
   hashspec[sizeof (header.hashSpec)] = 0;
+  grub_memcpy (uuid, header.uuid, sizeof (header.uuid));
+  uuid[sizeof (header.uuid)] = 0;
+
+  if ( check_uuid && ! grub_cryptodisk_uuidcmp(check_uuid, uuid))
+    {
+      grub_dprintf ("luks", "%s != %s\n", uuid, check_uuid);
+      return NULL;
+    }

   newdev = grub_cryptodisk_create (disk, uuid, ciphername, ciphermode, hashspec);

diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index bb25ab7..01c0269 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -168,4 +168,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);
 grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
 				   char *ciphername, char *ciphermode, char *digest);

+int
+grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b);
 #endif
--
1.9.1


code:
From fd72a029d64e0ee9552e4433387ee01f3cb05592 Mon Sep 17 00:00:00 2001
From: Klemens Nanni <contact@autoboot.org>
Date: Tue, 15 Sep 2015 16:00:03 +0200
Subject: [PATCH 07/10] grub-core/disk/cryptodisk.c: Point to const char

---
 grub-core/disk/cryptodisk.c | 2 +-
 include/grub/cryptodisk.h   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 5430b2e..633edb2 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -115,7 +115,7 @@ gf_mul_be (grub_uint8_t *o, const grub_uint8_t *a, const grub_uint8_t *b)
 }

 int
-grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b)
+grub_cryptodisk_uuidcmp(const char *uuid_a, const char *uuid_b)
 {
   while ((*uuid_a != '\0') && (*uuid_b != '\0'))
     {
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index 01c0269..cd6a545 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -169,5 +169,5 @@ grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
 				   char *ciphername, char *ciphermode, char *digest);

 int
-grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b);
+grub_cryptodisk_uuidcmp(const char *uuid_a, const char *uuid_b);
 #endif
--
1.9.1


code:
From 8dde1d7be2dd321a375570b7ff7e22bb01293044 Mon Sep 17 00:00:00 2001
From: Alexander Couzens <lynxis@fe80.eu>
Date: Fri, 4 Dec 2015 17:10:42 +0100
Subject: [PATCH 08/10] mkstandalone: add argument --fixed-time to override
 mtime of files

mkstandalone adds several files to an archive. Doing this it uses the
mtime to give these files a timestamp.
--fixed-time <TIME_EPOCH> overrides these timestamps with a given.

Replacing all timestamps with a specific one is required
to get reproducible builds. See source epoch specification of
reproducible-builds.org
---
 util/grub-mkstandalone.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/util/grub-mkstandalone.c b/util/grub-mkstandalone.c
index 4907d44..047f0cd 100644
--- a/util/grub-mkstandalone.c
+++ b/util/grub-mkstandalone.c
@@ -30,6 +30,7 @@
 #pragma GCC diagnostic error "-Wmissing-prototypes"
 #pragma GCC diagnostic error "-Wmissing-declarations"

+static time_t fixed_time;
 static char *output_image;
 static char **files;
 static int nfiles;
@@ -48,6 +49,7 @@ static struct argp_option options[] = {
    0, N_("save output in FILE [required]"), 2},
   {"format", 'O', N_("FILE"), 0, 0, 2},
   {"compression", 'C', "xz|none|auto", OPTION_HIDDEN, 0, 2},
+  {"fixed-time", 't', N_("TIMEEPOCH"), 0, N_("Use a fixed timestamp to override mtime of all files. Time since epoch is used."), 2},
   {0, 0, 0, 0, 0, 0}
 };

@@ -72,6 +74,7 @@ help_filter (int key, const char *text, void *input __attribute__ ((unused)))
 static error_t
 argp_parser (int key, char *arg, struct argp_state *state)
 {
+  char *b;
   if (key == 'C')
     key = GRUB_INSTALL_OPTIONS_INSTALL_CORE_COMPRESS;

@@ -80,6 +83,14 @@ argp_parser (int key, char *arg, struct argp_state *state)

   switch (key)
     {
+    case 't':
+      fixed_time = strtoll (arg, &b, 10);
+      if (*b !='\0') {
+        printf (_("invalid fixed time number: %s\n"), arg);
+        argp_usage (state);
+        exit (1);
+      }
+      break;

     case 'o':
       if (output_image)
@@ -192,7 +203,8 @@ add_tar_file (const char *from,
   if (grub_util_is_special_file (from))
     return;

-  mtime = grub_util_get_mtime (from);
+  /* use fixed_time if given for mtime */
+  mtime = fixed_time != -1 ? fixed_time : grub_util_get_mtime (from);

   optr = tcn = xmalloc (strlen (to) + 1);
   for (iptr = to; *iptr == '/'; iptr++);
--
1.9.1


code:
From 0f1e1a29d4d019e7b2b1a3ac3db7ca22c75e8d88 Mon Sep 17 00:00:00 2001
From: Alexander Couzens <lynxis@fe80.eu>
Date: Fri, 4 Dec 2015 17:10:43 +0100
Subject: [PATCH 09/10] mkrescue: add argument --fixed-time to get reproducible
 uuids

The uuid generation is based on the time.
---
 util/grub-mkrescue.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c
index 238d484..a3e0155 100644
--- a/util/grub-mkrescue.c
+++ b/util/grub-mkrescue.c
@@ -52,6 +52,7 @@ static int xorriso_arg_alloc;
 static char **xorriso_argv;
 static char *iso_uuid;
 static char *iso9660_dir;
+static time_t fixed_time;

 static void
 xorriso_push (const char *val)
@@ -110,6 +111,7 @@ static struct argp_option options[] = {
   {"product-version", OPTION_PRODUCT_VERSION, N_("STRING"), 0, N_("use STRING as product version"), 2},
   {"sparc-boot", OPTION_SPARC_BOOT, 0, 0, N_("enable sparc boot. Disables HFS+, APM, ARCS and boot as disk image for i386-pc"), 2},
   {"arcs-boot", OPTION_ARCS_BOOT, 0, 0, N_("enable ARCS (big-endian mips machines, mostly SGI) boot. Disables HFS+, APM, sparc64 and boot as disk image for i386-pc"), 2},
+  {"fixed-time", 't', N_("TIMEEPOCH"), 0, N_("use a fixed timestamp for uuid generation"), 2},
   {0, 0, 0, 0, 0, 0}
 };

@@ -153,6 +155,8 @@ enum {
 static error_t
 argp_parser (int key, char *arg, struct argp_state *state)
 {
+  char *b;
+
   if (grub_install_parse (key, arg))
     return 0;
   switch (key)
@@ -212,6 +216,15 @@ argp_parser (int key, char *arg, struct argp_state *state)
       xorriso = xstrdup (arg);
       return 0;

+    case 't':
+      fixed_time = strtoll (arg, &b, 10);
+      if (*b !='\0') {
+        printf (_("invalid fixed time number: %s\n"), arg);
+        argp_usage (state);
+        exit (1);
+      }
+      return 0;
+
     default:
       return ARGP_ERR_UNKNOWN;
     }
@@ -542,7 +555,7 @@ main (int argc, char *argv[])
   {
     time_t tim;
     struct tm *tmm;
-    tim = time (NULL);
+    tim = fixed_time != -1 ? fixed_time : time (NULL);
     tmm = gmtime (&tim);
     iso_uuid = xmalloc (55);
     grub_snprintf (iso_uuid, 50,
--
1.9.1


code:
From 57174ed960905be4f9c229bbf3913b25745dbfd9 Mon Sep 17 00:00:00 2001
From: Alexander Couzens <lynxis@fe80.eu>
Date: Fri, 4 Dec 2015 17:10:44 +0100
Subject: [PATCH 10/10] Makefile: use FIXED_TIMESTAMP for mkstandalone if set

mkstandalone sets timestamps for files which can be overriden by a fixed_timestamp.
This makes it possible to build reproducible builds for coreboot.

To build a reproducible build of grub for coreboot do:
make default_payload.elf FIXED_TIMESTAMP=1134242
---
 Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index 00a9663..ed7f148 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -411,7 +411,7 @@ bootcheck: $(BOOTCHECKS)
 if COND_i386_coreboot
 default_payload.elf: grub-mkstandalone grub-mkimage FORCE
 	test -f $@ && rm $@ || true
-	pkgdatadir=. ./grub-mkstandalone --grub-mkimage=./grub-mkimage -O i386-coreboot -o $@ --modules='ahci pata ehci uhci ohci usb_keyboard usbms part_msdos ext2 fat at_keyboard part_gpt usbserial_usbdebug cbfs' --install-modules='ls linux search configfile normal cbtime cbls memrw iorw minicmd lsmmap lspci halt reboot hexdump pcidump regexp setpci lsacpi chain test serial multiboot cbmemc linux16 gzio echo help syslinuxcfg xnu $(shell cat grub-core/fs.lst) password_pbkdf2 $(EXTRA_PAYLOAD_MODULES)' --fonts= --themes= --locales= -d grub-core/ /boot/grub/grub.cfg=$(srcdir)/coreboot.cfg
+	pkgdatadir=. ./grub-mkstandalone --grub-mkimage=./grub-mkimage -O i386-coreboot -o $@ --modules='ahci pata ehci uhci ohci usb_keyboard usbms part_msdos ext2 fat at_keyboard part_gpt usbserial_usbdebug cbfs' --install-modules='ls linux search configfile normal cbtime cbls memrw iorw minicmd lsmmap lspci halt reboot hexdump pcidump regexp setpci lsacpi chain test serial multiboot cbmemc linux16 gzio echo help syslinuxcfg xnu $(shell cat grub-core/fs.lst) password_pbkdf2 $(EXTRA_PAYLOAD_MODULES)' --fonts= --themes= --locales= -d grub-core/ /boot/grub/grub.cfg=$(srcdir)/coreboot.cfg $(if $(FIXED_TIMESTAMP),-t $(FIXED_TIMESTAMP))
 endif

 endif
--
1.9.1


code:
#
# Automatically generated file; DO NOT EDIT.
# coreboot configuration
#

#
# General setup
#
CONFIG_LOCALVERSION=""
CONFIG_CBFS_PREFIX="fallback"
# CONFIG_MULTIPLE_CBFS_INSTANCES is not set
CONFIG_COMPILER_GCC=y
# CONFIG_COMPILER_LLVM_CLANG is not set
# CONFIG_ANY_TOOLCHAIN is not set
# CONFIG_CCACHE is not set
# CONFIG_FMD_GENPARSER is not set
# CONFIG_SCONFIG_GENPARSER is not set
# CONFIG_UNCOMPRESSED_RAMSTAGE is not set
CONFIG_COMPRESS_RAMSTAGE=y
# CONFIG_COMPRESS_PRERAM_STAGES is not set
CONFIG_INCLUDE_CONFIG_FILE=y
# CONFIG_EARLY_CBMEM_INIT is not set
# CONFIG_COLLECT_TIMESTAMPS is not set
# CONFIG_USE_BLOBS is not set
# CONFIG_COVERAGE is not set
# CONFIG_RELOCATABLE_MODULES is not set
CONFIG_FLASHMAP_OFFSET=0
CONFIG_BOOTBLOCK_SIMPLE=y
# CONFIG_BOOTBLOCK_NORMAL is not set
CONFIG_BOOTBLOCK_CUSTOM=y
CONFIG_BOOTBLOCK_SOURCE="bootblock_simple.c"
# CONFIG_C_ENVIRONMENT_BOOTBLOCK is not set
# CONFIG_UPDATE_IMAGE is not set
# CONFIG_GENERIC_GPIO_LIB is not set
# CONFIG_BOARD_ID_AUTO is not set
# CONFIG_BOARD_ID_MANUAL is not set
# CONFIG_RAM_CODE_SUPPORT is not set
# CONFIG_BOOTSPLASH_IMAGE is not set
# CONFIG_ACPI_SATA_GENERATOR is not set

#
# Mainboard
#
# CONFIG_VENDOR_A_TREND is not set
# CONFIG_VENDOR_AAEON is not set
# CONFIG_VENDOR_ABIT is not set
# CONFIG_VENDOR_ADLINK is not set
# CONFIG_VENDOR_ADVANSUS is not set
# CONFIG_VENDOR_AMD is not set
# CONFIG_VENDOR_AOPEN is not set
# CONFIG_VENDOR_APPLE is not set
# CONFIG_VENDOR_ARTECGROUP is not set
# CONFIG_VENDOR_ASROCK is not set
# CONFIG_VENDOR_ASUS is not set
# CONFIG_VENDOR_AVALUE is not set
# CONFIG_VENDOR_AZZA is not set
# CONFIG_VENDOR_BACHMANN is not set
# CONFIG_VENDOR_BAP is not set
# CONFIG_VENDOR_BCOM is not set
# CONFIG_VENDOR_BIFFEROS is not set
# CONFIG_VENDOR_BIOSTAR is not set
# CONFIG_VENDOR_BROADCOM is not set
# CONFIG_VENDOR_COMPAQ is not set
# CONFIG_VENDOR_CUBIETECH is not set
# CONFIG_VENDOR_DIGITALLOGIC is not set
# CONFIG_VENDOR_DMP is not set
# CONFIG_VENDOR_ECS is not set
# CONFIG_VENDOR_EMULATION is not set
# CONFIG_VENDOR_ESD is not set
# CONFIG_VENDOR_GETAC is not set
# CONFIG_VENDOR_GIGABYTE is not set
# CONFIG_VENDOR_GIZMOSPHERE is not set
# CONFIG_VENDOR_GOOGLE is not set
# CONFIG_VENDOR_HP is not set
# CONFIG_VENDOR_IBASE is not set
# CONFIG_VENDOR_IEI is not set
CONFIG_VENDOR_INTEL=y
# CONFIG_VENDOR_IWAVE is not set
# CONFIG_VENDOR_IWILL is not set
# CONFIG_VENDOR_JETWAY is not set
# CONFIG_VENDOR_KONTRON is not set
# CONFIG_VENDOR_LANNER is not set
# CONFIG_VENDOR_LENOVO is not set
# CONFIG_VENDOR_LINUTOP is not set
# CONFIG_VENDOR_LIPPERT is not set
# CONFIG_VENDOR_MITAC is not set
# CONFIG_VENDOR_MSI is not set
# CONFIG_VENDOR_NEC is not set
# CONFIG_VENDOR_NOKIA is not set
# CONFIG_VENDOR_NVIDIA is not set
# CONFIG_VENDOR_PACKARDBELL is not set
# CONFIG_VENDOR_PCENGINES is not set
# CONFIG_VENDOR_PURISM is not set
# CONFIG_VENDOR_RCA is not set
# CONFIG_VENDOR_RODA is not set
# CONFIG_VENDOR_SAMSUNG is not set
# CONFIG_VENDOR_SIEMENS is not set
# CONFIG_VENDOR_SOYO is not set
# CONFIG_VENDOR_SUNW is not set
# CONFIG_VENDOR_SUPERMICRO is not set
# CONFIG_VENDOR_TECHNEXION is not set
# CONFIG_VENDOR_THOMSON is not set
# CONFIG_VENDOR_TI is not set
# CONFIG_VENDOR_TRAVERSE is not set
# CONFIG_VENDOR_TYAN is not set
# CONFIG_VENDOR_VIA is not set
# CONFIG_VENDOR_WINENT is not set
# CONFIG_VENDOR_WYSE is not set
CONFIG_BOARD_SPECIFIC_OPTIONS=y
CONFIG_MAINBOARD_DIR="intel/d510mo"
CONFIG_MAINBOARD_PART_NUMBER="D510MO"
CONFIG_MAINBOARD_VENDOR="Intel"
CONFIG_MAX_CPUS=4
CONFIG_VGA_BIOS_ID="8086,a001"
# CONFIG_ONBOARD_VGA_IS_PRIMARY is not set
# CONFIG_VGA_BIOS is not set
# CONFIG_UDELAY_IO is not set
CONFIG_MAINBOARD_SERIAL_NUMBER="123456789"
CONFIG_DCACHE_RAM_BASE=0xffafc000
CONFIG_DCACHE_RAM_SIZE=0x4000
CONFIG_MMCONF_BASE_ADDRESS=0xe0000000
CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Intel"
CONFIG_POST_IO=y
CONFIG_MAX_REBOOT_CNT=3
CONFIG_MAINBOARD_DO_NATIVE_VGA_INIT=y
CONFIG_ID_SECTION_OFFSET=0x80
CONFIG_RAMTOP=0x200000
CONFIG_CACHE_ROM_SIZE_OVERRIDE=0
CONFIG_CBFS_SIZE=0x100000
CONFIG_POST_DEVICE=y
# CONFIG_BOARD_INTEL_APOLLOLAKE_RVP1 is not set
# CONFIG_BOARD_INTEL_APOLLOLAKE_RVP2 is not set
# CONFIG_BOARD_INTEL_BAKERSPORT_FSP is not set
# CONFIG_BOARD_INTEL_BASKING_RIDGE is not set
# CONFIG_BOARD_INTEL_BAYLEYBAY_FSP is not set
# CONFIG_BOARD_INTEL_COUGAR_CANYON2 is not set
CONFIG_BOARD_INTEL_D510MO=y
# CONFIG_BOARD_INTEL_D810E2CB is not set
# CONFIG_BOARD_INTEL_D945GCLF is not set
# CONFIG_BOARD_INTEL_EAGLEHEIGHTS is not set
# CONFIG_BOARD_INTEL_EMERALDLAKE2 is not set
# CONFIG_BOARD_INTEL_GALILEO is not set
# CONFIG_BOARD_INTEL_KUNIMITSU is not set
# CONFIG_BOARD_INTEL_LITTLEPLAINS is not set
# CONFIG_BOARD_INTEL_MINNOWMAX is not set
# CONFIG_BOARD_INTEL_MOHONPEAK is not set
# CONFIG_BOARD_INTEL_MTARVON is not set
# CONFIG_BOARD_INTEL_STARGO2 is not set
# CONFIG_BOARD_INTEL_STRAGO is not set
# CONFIG_BOARD_INTEL_TRUXTON is not set
# CONFIG_BOARD_INTEL_WTM2 is not set
CONFIG_CPU_ADDR_BITS=32
CONFIG_DEFAULT_CONSOLE_LOGLEVEL=8
# CONFIG_USBDEBUG is not set
CONFIG_MAINBOARD_VERSION="1.0"
# CONFIG_DRIVERS_PS2_KEYBOARD is not set
CONFIG_DRIVERS_UART_8250IO=y
# CONFIG_NO_POST is not set
CONFIG_BOARD_ROMSIZE_KB_1024=y
# CONFIG_COREBOOT_ROMSIZE_KB_64 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_128 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
CONFIG_COREBOOT_ROMSIZE_KB_1024=y
# CONFIG_COREBOOT_ROMSIZE_KB_2048 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_4096 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_8192 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_12288 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_16384 is not set
CONFIG_COREBOOT_ROMSIZE_KB=1024
CONFIG_ROM_SIZE=0x100000
CONFIG_FMDFILE=""
# CONFIG_SYSTEM_TYPE_LAPTOP is not set
# CONFIG_CBFS_AUTOGEN_ATTRIBUTES is not set

#
# Chipset
#

#
# SoC
#
# CONFIG_SOC_BROADCOM_CYGNUS is not set
CONFIG_C_ENV_BOOTBLOCK_SIZE=0x10000
CONFIG_BOOTBLOCK_NORTHBRIDGE_INIT="northbridge/intel/pineview/bootblock.c"
CONFIG_BOOTBLOCK_SOUTHBRIDGE_INIT="southbridge/intel/i82801gx/bootblock.c"
CONFIG_EHCI_BAR=0xfef00000
CONFIG_HEAP_SIZE=0x4000
# CONFIG_SOC_MARVELL_ARMADA38X is not set
# CONFIG_SOC_MARVELL_BG4CD is not set
# CONFIG_SOC_MEDIATEK_MT8173 is not set
# CONFIG_SOC_NVIDIA_TEGRA124 is not set
# CONFIG_SOC_NVIDIA_TEGRA132 is not set
# CONFIG_SOC_NVIDIA_TEGRA210 is not set
# CONFIG_SOC_QC_IPQ806X is not set
# CONFIG_SOC_ROCKCHIP_RK3288 is not set
# CONFIG_CPU_SAMSUNG_EXYNOS5250 is not set
# CONFIG_CPU_SAMSUNG_EXYNOS5420 is not set
# CONFIG_SOC_UCB_RISCV is not set

#
# CPU
#
# CONFIG_CPU_ALLWINNER_A10 is not set
CONFIG_SOCKET_SPECIFIC_OPTIONS=y
CONFIG_XIP_ROM_SIZE=0x10000
CONFIG_NUM_IPI_STARTS=2
# CONFIG_CPU_AMD_AGESA is not set
# CONFIG_CPU_AMD_PI is not set
# CONFIG_CPU_ARMLTD_CORTEX_A9 is not set
CONFIG_CPU_INTEL_MODEL_106CX=y
CONFIG_CPU_INTEL_SOCKET_FCBGA559=y
CONFIG_SSE2=y
# CONFIG_CPU_INTEL_FIRMWARE_INTERFACE_TABLE is not set
# CONFIG_CPU_INTEL_TURBO_NOT_PACKAGE_SCOPED is not set
# CONFIG_CPU_TI_AM335X is not set
# CONFIG_PARALLEL_CPU_INIT is not set
CONFIG_UDELAY_LAPIC=y
CONFIG_LAPIC_MONOTONIC_TIMER=y
# CONFIG_UDELAY_TSC is not set
# CONFIG_UDELAY_TIMER2 is not set
# CONFIG_TSC_CALIBRATE_WITH_IO is not set
# CONFIG_TSC_SYNC_LFENCE is not set
CONFIG_TSC_SYNC_MFENCE=y
CONFIG_LOGICAL_CPUS=y
# CONFIG_SMM_TSEG is not set
# CONFIG_SMM_LAPIC_REMAP_MITIGATION is not set
CONFIG_SERIALIZED_SMM_INITIALIZATION=y
# CONFIG_X86_AMD_FIXED_MTRRS is not set
# CONFIG_PLATFORM_USES_FSP1_0 is not set
# CONFIG_PARALLEL_MP is not set
# CONFIG_BACKUP_DEFAULT_SMM_REGION is not set
# CONFIG_MIRROR_PAYLOAD_TO_RAM_BEFORE_LOADING is not set
CONFIG_CACHE_AS_RAM=y
CONFIG_SMP=y
CONFIG_AP_SIPI_VECTOR=0xfffff000
CONFIG_MMX=y
CONFIG_SSE=y
CONFIG_SUPPORT_CPU_UCODE_IN_CBFS=y
# CONFIG_USES_MICROCODE_HEADER_FILES is not set
# CONFIG_CPU_MICROCODE_CBFS_GENERATE is not set
# CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER is not set
CONFIG_CPU_MICROCODE_CBFS_NONE=y

#
# Northbridge
#
# CONFIG_NORTHBRIDGE_AMD_AGESA is not set
# CONFIG_AMD_NB_CIMX is not set
# CONFIG_NORTHBRIDGE_AMD_CIMX_RD890 is not set
CONFIG_VIDEO_MB=0
# CONFIG_NORTHBRIDGE_AMD_PI is not set
CONFIG_RAMBASE=0x100000
CONFIG_NORTHBRIDGE_SPECIFIC_OPTIONS=y
CONFIG_NORTHBRIDGE_INTEL_PINEVIEW=y
CONFIG_HPET_ADDRESS=0xfed00000
CONFIG_HPET_MIN_TICKS=0x80
CONFIG_MAX_PIRQ_LINKS=4

#
# Southbridge
#
# CONFIG_AMD_SB_CIMX is not set
# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB800 is not set
# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB900 is not set
CONFIG_SOUTHBRIDGE_INTEL_COMMON=y
# CONFIG_SOUTHBRIDGE_INTEL_COMMON_GPIO is not set
CONFIG_SOUTHBRIDGE_INTEL_I82801GX=y

#
# Super I/O
#
CONFIG_SUPERIO_WINBOND_COMMON_ROMSTAGE=y
CONFIG_SUPERIO_WINBOND_W83627THG=y

#
# Embedded Controllers
#
# CONFIG_MAINBOARD_HAS_CHROMEOS is not set
# CONFIG_UEFI_2_4_BINDING is not set
# CONFIG_ARCH_ARM is not set
# CONFIG_ARCH_BOOTBLOCK_ARM is not set
# CONFIG_ARCH_VERSTAGE_ARM is not set
# CONFIG_ARCH_ROMSTAGE_ARM is not set
# CONFIG_ARCH_RAMSTAGE_ARM is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV4 is not set
# CONFIG_ARCH_VERSTAGE_ARMV4 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV4 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV4 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV7 is not set
# CONFIG_ARCH_VERSTAGE_ARMV7 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV7 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV7 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV7_M is not set
# CONFIG_ARCH_VERSTAGE_ARMV7_M is not set
# CONFIG_ARM_LPAE is not set
# CONFIG_ARCH_ARM64 is not set
# CONFIG_ARCH_BOOTBLOCK_ARM64 is not set
# CONFIG_ARCH_VERSTAGE_ARM64 is not set
# CONFIG_ARCH_ROMSTAGE_ARM64 is not set
# CONFIG_ARCH_RAMSTAGE_ARM64 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV8_64 is not set
# CONFIG_ARCH_VERSTAGE_ARMV8_64 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV8_64 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV8_64 is not set
# CONFIG_ARM64_A53_ERRATUM_843419 is not set
# CONFIG_ARCH_MIPS is not set
# CONFIG_ARCH_BOOTBLOCK_MIPS is not set
# CONFIG_ARCH_VERSTAGE_MIPS is not set
# CONFIG_ARCH_ROMSTAGE_MIPS is not set
# CONFIG_ARCH_RAMSTAGE_MIPS is not set
# CONFIG_ARCH_POWER8 is not set
# CONFIG_ARCH_BOOTBLOCK_POWER8 is not set
# CONFIG_ARCH_VERSTAGE_POWER8 is not set
# CONFIG_ARCH_ROMSTAGE_POWER8 is not set
# CONFIG_ARCH_RAMSTAGE_POWER8 is not set
# CONFIG_ARCH_RISCV is not set
# CONFIG_ARCH_BOOTBLOCK_RISCV is not set
# CONFIG_ARCH_VERSTAGE_RISCV is not set
# CONFIG_ARCH_ROMSTAGE_RISCV is not set
# CONFIG_ARCH_RAMSTAGE_RISCV is not set
CONFIG_ARCH_X86=y
CONFIG_ARCH_BOOTBLOCK_X86_32=y
CONFIG_ARCH_VERSTAGE_X86_32=y
CONFIG_ARCH_ROMSTAGE_X86_32=y
CONFIG_ARCH_RAMSTAGE_X86_32=y
# CONFIG_ARCH_BOOTBLOCK_X86_64 is not set
# CONFIG_ARCH_VERSTAGE_X86_64 is not set
# CONFIG_ARCH_ROMSTAGE_X86_64 is not set
# CONFIG_ARCH_RAMSTAGE_X86_64 is not set
# CONFIG_USE_MARCH_586 is not set
CONFIG_AP_IN_SIPI_WAIT=y
CONFIG_SIPI_VECTOR_IN_ROM=y
CONFIG_X86_TOP4G_BOOTMEDIA_MAP=y
# CONFIG_ROMCC is not set
CONFIG_LATE_CBMEM_INIT=y
CONFIG_PC80_SYSTEM=y
# CONFIG_HAVE_CMOS_DEFAULT is not set
CONFIG_IOAPIC_INTERRUPTS_ON_FSB=y
# CONFIG_IOAPIC_INTERRUPTS_ON_APIC_SERIAL_BUS is not set
# CONFIG_COMPILE_IN_DSDT is not set
CONFIG_ROMSTAGE_ADDR=0x2000000
CONFIG_VERSTAGE_ADDR=0x2000000

#
# Devices
#
CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT=y
CONFIG_NATIVE_VGA_INIT_USE_EDID=y
# CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT_TEXTMODECFG is not set
CONFIG_ON_DEVICE_ROM_LOAD=y
# CONFIG_MULTIPLE_VGA_ADAPTERS is not set
# CONFIG_SMBUS_HAS_AUX_CHANNELS is not set
# CONFIG_SPD_CACHE is not set
CONFIG_PCI=y
# CONFIG_HYPERTRANSPORT_PLUGIN_SUPPORT is not set
CONFIG_PCIX_PLUGIN_SUPPORT=y
CONFIG_PCIEXP_PLUGIN_SUPPORT=y
CONFIG_CARDBUS_PLUGIN_SUPPORT=y
# CONFIG_AZALIA_PLUGIN_SUPPORT is not set
# CONFIG_PCIEXP_COMMON_CLOCK is not set
# CONFIG_PCIEXP_ASPM is not set
# CONFIG_PCIEXP_CLK_PM is not set
# CONFIG_EARLY_PCI_BRIDGE is not set
# CONFIG_PCIEXP_L1_SUB_STATE is not set
CONFIG_SUBSYSTEM_VENDOR_ID=0x0000
CONFIG_SUBSYSTEM_DEVICE_ID=0x0000
# CONFIG_PXE_ROM is not set
# CONFIG_SOFTWARE_I2C is not set

#
# Display
#

#
# Generic Drivers
#
# CONFIG_DRIVERS_AS3722_RTC is not set
# CONFIG_GIC is not set
# CONFIG_SMBIOS_PROVIDED_BY_MOBO is not set
# CONFIG_DRIVERS_I2C_RTD2132 is not set
# CONFIG_INTEL_DP is not set
# CONFIG_INTEL_DDI is not set
CONFIG_INTEL_EDID=y
CONFIG_INTEL_INT15=y
# CONFIG_INTEL_GMA_ACPI is not set
# CONFIG_DRIVER_INTEL_I210 is not set
# CONFIG_IPMI_KCS is not set
# CONFIG_DRIVERS_LENOVO_WACOM is not set
# CONFIG_DRIVER_MAXIM_MAX77686 is not set
# CONFIG_DRIVER_PARADE_PS8625 is not set
CONFIG_DRIVERS_MC146818=y
# CONFIG_MAINBOARD_HAS_LPC_TPM is not set
# CONFIG_DRIVERS_RICOH_RCE822 is not set
# CONFIG_DRIVERS_SIL_3114 is not set
# CONFIG_SPI_FLASH is not set
# CONFIG_HAVE_SPI_CONSOLE_SUPPORT is not set
# CONFIG_DRIVER_TI_TPS65090 is not set
# CONFIG_DRIVERS_TI_TPS65913 is not set
# CONFIG_DRIVERS_TI_TPS65913_RTC is not set
# CONFIG_DRIVERS_UART is not set
# CONFIG_NO_UART_ON_SUPERIO is not set
# CONFIG_DRIVERS_UART_8250MEM is not set
# CONFIG_DRIVERS_UART_8250MEM_32 is not set
# CONFIG_HAVE_UART_SPECIAL is not set
# CONFIG_DRIVERS_UART_OXPCIE is not set
# CONFIG_DRIVERS_UART_PL011 is not set
CONFIG_HAVE_USBDEBUG=y
# CONFIG_HAVE_USBDEBUG_OPTIONS is not set
# CONFIG_DRIVER_XPOWERS_AXP209 is not set
CONFIG_RTC=y
# CONFIG_TPM is not set
CONFIG_STACK_SIZE=0x1000
CONFIG_MMCONF_SUPPORT_DEFAULT=y
CONFIG_MMCONF_SUPPORT=y
# CONFIG_BOOTMODE_STRAPS is not set

#
# Console
#
CONFIG_SQUELCH_EARLY_SMP=y
# CONFIG_CONSOLE_SERIAL is not set
# CONFIG_CONSOLE_SERIAL_921600 is not set
# CONFIG_CONSOLE_SERIAL_460800 is not set
# CONFIG_CONSOLE_SERIAL_230400 is not set
# CONFIG_CONSOLE_SERIAL_115200 is not set
# CONFIG_CONSOLE_SERIAL_57600 is not set
# CONFIG_CONSOLE_SERIAL_38400 is not set
# CONFIG_CONSOLE_SERIAL_19200 is not set
# CONFIG_CONSOLE_SERIAL_9600 is not set
# CONFIG_SPKMODEM is not set
# CONFIG_CONSOLE_NE2K is not set
CONFIG_CONSOLE_CBMEM=y
CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
# CONFIG_CONSOLE_CBMEM_DUMP_TO_UART is not set
CONFIG_DEFAULT_CONSOLE_LOGLEVEL_8=y
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_6 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_5 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_4 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_3 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_2 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
# CONFIG_CMOS_POST is not set
# CONFIG_CONSOLE_POST is not set
CONFIG_POST_DEVICE_NONE=y
# CONFIG_POST_DEVICE_LPC is not set
# CONFIG_POST_DEVICE_PCI_PCIE is not set
CONFIG_POST_IO_PORT=0x80
# CONFIG_NO_EARLY_BOOTBLOCK_POSTCODES is not set
# CONFIG_HAVE_ACPI_RESUME is not set
CONFIG_HAVE_HARD_RESET=y
# CONFIG_HAVE_ROMSTAGE_CONSOLE_SPINLOCK is not set
# CONFIG_HAVE_ROMSTAGE_NVRAM_CBFS_SPINLOCK is not set
# CONFIG_HAVE_ROMSTAGE_MICROCODE_CBFS_SPINLOCK is not set
CONFIG_HAVE_MONOTONIC_TIMER=y
# CONFIG_GENERIC_UDELAY is not set
# CONFIG_TIMER_QUEUE is not set
# CONFIG_HAVE_OPTION_TABLE is not set
# CONFIG_PIRQ_ROUTE is not set
CONFIG_HAVE_SMI_HANDLER=y
# CONFIG_PCI_IO_CFG_EXT is not set
CONFIG_IOAPIC=y
CONFIG_USE_WATCHDOG_ON_BOOT=y
CONFIG_VGA=y
# CONFIG_GFXUMA is not set
CONFIG_HAVE_ACPI_TABLES=y
CONFIG_COMMON_FADT=y
# CONFIG_ACPI_NHLT is not set

#
# System tables
#
# CONFIG_GENERATE_MP_TABLE is not set
# CONFIG_GENERATE_PIRQ_TABLE is not set
CONFIG_GENERATE_SMBIOS_TABLES=y
CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="D510MO"

#
# Payload
#
# CONFIG_PAYLOAD_NONE is not set
CONFIG_PAYLOAD_ELF=y
# CONFIG_PAYLOAD_FILO is not set
# CONFIG_PAYLOAD_GRUB2 is not set
# CONFIG_PAYLOAD_SEABIOS is not set
# CONFIG_PAYLOAD_UBOOT is not set
# CONFIG_PAYLOAD_LINUX is not set
# CONFIG_PAYLOAD_TIANOCORE is not set
CONFIG_PAYLOAD_FILE="payload.elf"
CONFIG_PAYLOAD_OPTIONS=""
CONFIG_COMPRESSED_PAYLOAD_LZMA=y
# CONFIG_PAYLOAD_IS_FLAT_BINARY is not set
# CONFIG_COREINFO_SECONDARY_PAYLOAD is not set
# CONFIG_MEMTEST_SECONDARY_PAYLOAD is not set

#
# Debugging
#
# CONFIG_FATAL_ASSERTS is not set
# CONFIG_DEBUG_CBFS is not set
CONFIG_HAVE_DEBUG_RAM_SETUP=y
# CONFIG_DEBUG_RAM_SETUP is not set
# CONFIG_HAVE_DEBUG_CAR is not set
# CONFIG_HAVE_DEBUG_SMBUS is not set
# CONFIG_DEBUG_SMI is not set
# CONFIG_DEBUG_SMM_RELOCATION is not set
# CONFIG_DEBUG_MALLOC is not set
# CONFIG_DEBUG_ACPI is not set
# CONFIG_TRACE is not set
# CONFIG_ENABLE_APIC_EXT_ID is not set
CONFIG_WARNINGS_ARE_ERRORS=y
CONFIG_IASL_WARNINGS_ARE_ERRORS=y
# CONFIG_POWER_BUTTON_DEFAULT_ENABLE is not set
# CONFIG_POWER_BUTTON_DEFAULT_DISABLE is not set
# CONFIG_POWER_BUTTON_FORCE_ENABLE is not set
# CONFIG_POWER_BUTTON_FORCE_DISABLE is not set
# CONFIG_POWER_BUTTON_IS_OPTIONAL is not set
# CONFIG_REG_SCRIPT is not set
# CONFIG_DEBUG_BOOT_STATE is not set


code:
#
# Automatically generated file; DO NOT EDIT.
# coreboot configuration
#

#
# General setup
#
CONFIG_LOCALVERSION=""
CONFIG_CBFS_PREFIX="fallback"
# CONFIG_MULTIPLE_CBFS_INSTANCES is not set
CONFIG_COMPILER_GCC=y
# CONFIG_COMPILER_LLVM_CLANG is not set
# CONFIG_ANY_TOOLCHAIN is not set
# CONFIG_CCACHE is not set
# CONFIG_FMD_GENPARSER is not set
# CONFIG_SCONFIG_GENPARSER is not set
# CONFIG_UNCOMPRESSED_RAMSTAGE is not set
CONFIG_COMPRESS_RAMSTAGE=y
CONFIG_INCLUDE_CONFIG_FILE=y
# CONFIG_NO_XIP_EARLY_STAGES is not set
CONFIG_EARLY_CBMEM_INIT=y
# CONFIG_EARLY_CBMEM_LIST is not set
# CONFIG_COLLECT_TIMESTAMPS is not set
# CONFIG_USE_BLOBS is not set
# CONFIG_COVERAGE is not set
# CONFIG_RELOCATABLE_MODULES is not set
# CONFIG_RELOCATABLE_RAMSTAGE is not set
# CONFIG_NO_STAGE_CACHE is not set
CONFIG_BOOTBLOCK_SIMPLE=y
# CONFIG_BOOTBLOCK_NORMAL is not set
CONFIG_BOOTBLOCK_CUSTOM=y
CONFIG_BOOTBLOCK_SOURCE="bootblock_simple.c"
# CONFIG_C_ENVIRONMENT_BOOTBLOCK is not set
# CONFIG_UPDATE_IMAGE is not set
# CONFIG_GENERIC_GPIO_LIB is not set
# CONFIG_BOARD_ID_AUTO is not set
# CONFIG_BOARD_ID_MANUAL is not set
# CONFIG_RAM_CODE_SUPPORT is not set
# CONFIG_BOOTSPLASH_IMAGE is not set

#
# Mainboard
#
# CONFIG_VENDOR_A_TREND is not set
# CONFIG_VENDOR_AAEON is not set
# CONFIG_VENDOR_ABIT is not set
# CONFIG_VENDOR_ADI is not set
# CONFIG_VENDOR_ADLINK is not set
# CONFIG_VENDOR_ADVANSUS is not set
# CONFIG_VENDOR_AMD is not set
# CONFIG_VENDOR_AOPEN is not set
# CONFIG_VENDOR_APPLE is not set
# CONFIG_VENDOR_ARTECGROUP is not set
# CONFIG_VENDOR_ASROCK is not set
# CONFIG_VENDOR_ASUS is not set
# CONFIG_VENDOR_AVALUE is not set
# CONFIG_VENDOR_AZZA is not set
# CONFIG_VENDOR_BACHMANN is not set
# CONFIG_VENDOR_BAP is not set
# CONFIG_VENDOR_BCOM is not set
# CONFIG_VENDOR_BIFFEROS is not set
# CONFIG_VENDOR_BIOSTAR is not set
# CONFIG_VENDOR_BROADCOM is not set
# CONFIG_VENDOR_COMPAQ is not set
# CONFIG_VENDOR_CUBIETECH is not set
# CONFIG_VENDOR_DIGITALLOGIC is not set
# CONFIG_VENDOR_DMP is not set
# CONFIG_VENDOR_ECS is not set
# CONFIG_VENDOR_EMULATION is not set
# CONFIG_VENDOR_ESD is not set
# CONFIG_VENDOR_GETAC is not set
CONFIG_VENDOR_GIGABYTE=y
# CONFIG_VENDOR_GIZMOSPHERE is not set
# CONFIG_VENDOR_GOOGLE is not set
# CONFIG_VENDOR_HP is not set
# CONFIG_VENDOR_IBASE is not set
# CONFIG_VENDOR_IEI is not set
# CONFIG_VENDOR_INTEL is not set
# CONFIG_VENDOR_IWAVE is not set
# CONFIG_VENDOR_IWILL is not set
# CONFIG_VENDOR_JETWAY is not set
# CONFIG_VENDOR_KONTRON is not set
# CONFIG_VENDOR_LANNER is not set
# CONFIG_VENDOR_LENOVO is not set
# CONFIG_VENDOR_LINUTOP is not set
# CONFIG_VENDOR_LIPPERT is not set
# CONFIG_VENDOR_MITAC is not set
# CONFIG_VENDOR_MSI is not set
# CONFIG_VENDOR_NEC is not set
# CONFIG_VENDOR_NOKIA is not set
# CONFIG_VENDOR_NVIDIA is not set
# CONFIG_VENDOR_PACKARDBELL is not set
# CONFIG_VENDOR_PCENGINES is not set
# CONFIG_VENDOR_PURISM is not set
# CONFIG_VENDOR_RCA is not set
# CONFIG_VENDOR_RODA is not set
# CONFIG_VENDOR_SAMSUNG is not set
# CONFIG_VENDOR_SIEMENS is not set
# CONFIG_VENDOR_SOYO is not set
# CONFIG_VENDOR_SUNW is not set
# CONFIG_VENDOR_SUPERMICRO is not set
# CONFIG_VENDOR_TECHNEXION is not set
# CONFIG_VENDOR_THOMSON is not set
# CONFIG_VENDOR_TI is not set
# CONFIG_VENDOR_TRAVERSE is not set
# CONFIG_VENDOR_TYAN is not set
# CONFIG_VENDOR_VIA is not set
# CONFIG_VENDOR_WINENT is not set
# CONFIG_VENDOR_WYSE is not set
CONFIG_BOARD_SPECIFIC_OPTIONS=y
CONFIG_MAINBOARD_DIR="gigabyte/ga-g41m-es2l"
CONFIG_MAINBOARD_PART_NUMBER="GA-G41M-ES2L"
CONFIG_MAINBOARD_VENDOR="GIGABYTE"
CONFIG_MAX_CPUS=1
CONFIG_CACHE_ROM_SIZE_OVERRIDE=0
CONFIG_CBFS_SIZE=0x100000
CONFIG_VGA_BIOS_ID="8086,2e32"
# CONFIG_ONBOARD_VGA_IS_PRIMARY is not set
# CONFIG_VGA_BIOS is not set
CONFIG_MAINBOARD_SERIAL_NUMBER="123456789"
CONFIG_DCACHE_RAM_BASE=0xfeffc000
CONFIG_DCACHE_RAM_SIZE=0x4000
CONFIG_MMCONF_BASE_ADDRESS=0xe0000000
CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="GIGABYTE"
CONFIG_POST_IO=y
CONFIG_MAX_REBOOT_CNT=3
CONFIG_MAINBOARD_DO_NATIVE_VGA_INIT=y
CONFIG_ID_SECTION_OFFSET=0x80
CONFIG_POST_DEVICE=y
# CONFIG_BOARD_GIGABYTE_GA_6BXC is not set
# CONFIG_BOARD_GIGABYTE_GA_6BXE is not set
# CONFIG_BOARD_GIGABYTE_GA_B75M_D3H is not set
# CONFIG_BOARD_GIGABYTE_GA_B75M_D3V is not set
CONFIG_BOARD_GIGABYTE_GA_G41M_ES2L=y
# CONFIG_BOARD_GIGABYTE_GA_2761GXDK is not set
# CONFIG_BOARD_GIGABYTE_M57SLI is not set
# CONFIG_BOARD_GIGABYTE_MA785GM is not set
# CONFIG_BOARD_GIGABYTE_MA785GMT is not set
# CONFIG_BOARD_GIGABYTE_MA78GM is not set
# CONFIG_DRIVERS_PS2_KEYBOARD is not set
CONFIG_DEVICETREE="devicetree.cb"
# CONFIG_CONSOLE_POST is not set
CONFIG_DRIVERS_UART_8250IO=y
CONFIG_CPU_ADDR_BITS=36
CONFIG_DEFAULT_CONSOLE_LOGLEVEL=8
# CONFIG_USBDEBUG is not set
CONFIG_MAINBOARD_VERSION="1.0"
# CONFIG_NO_POST is not set
CONFIG_BOARD_ROMSIZE_KB_1024=y
# CONFIG_COREBOOT_ROMSIZE_KB_64 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_128 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
CONFIG_COREBOOT_ROMSIZE_KB_1024=y
# CONFIG_COREBOOT_ROMSIZE_KB_2048 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_4096 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_8192 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_12288 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_16384 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_32768 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_65536 is not set
CONFIG_COREBOOT_ROMSIZE_KB=1024
CONFIG_ROM_SIZE=0x100000
CONFIG_FMDFILE=""
# CONFIG_MAINBOARD_HAS_TPM2 is not set
# CONFIG_SYSTEM_TYPE_LAPTOP is not set
# CONFIG_CBFS_AUTOGEN_ATTRIBUTES is not set

#
# Chipset
#

#
# SoC
#
# CONFIG_SOC_BROADCOM_CYGNUS is not set
CONFIG_C_ENV_BOOTBLOCK_SIZE=0x10000
CONFIG_X86_TOP4G_BOOTMEDIA_MAP=y
CONFIG_ROMSTAGE_ADDR=0x2000000
CONFIG_VERSTAGE_ADDR=0x2000000
CONFIG_BOOTBLOCK_NORTHBRIDGE_INIT="northbridge/intel/x4x/bootblock.c"
CONFIG_BOOTBLOCK_SOUTHBRIDGE_INIT="southbridge/intel/i82801gx/bootblock.c"
CONFIG_EHCI_BAR=0xfef00000
CONFIG_RAMTOP=0x200000
CONFIG_HEAP_SIZE=0x4000
CONFIG_CONSOLE_CBMEM=y
CONFIG_UART_PCI_ADDR=0x0
CONFIG_HPET_MIN_TICKS=0x80
# CONFIG_SOC_MARVELL_ARMADA38X is not set
# CONFIG_SOC_MARVELL_BG4CD is not set
# CONFIG_SOC_MEDIATEK_MT8173 is not set
# CONFIG_SOC_NVIDIA_TEGRA124 is not set
# CONFIG_SOC_NVIDIA_TEGRA132 is not set
# CONFIG_SOC_NVIDIA_TEGRA210 is not set
# CONFIG_SOC_QC_IPQ40XX is not set
# CONFIG_SOC_QC_IPQ806X is not set
# CONFIG_SOC_ROCKCHIP_RK3288 is not set
# CONFIG_SOC_ROCKCHIP_RK3399 is not set
# CONFIG_CPU_SAMSUNG_EXYNOS5250 is not set
# CONFIG_CPU_SAMSUNG_EXYNOS5420 is not set
# CONFIG_SOC_UCB_RISCV is not set

#
# CPU
#
# CONFIG_CPU_ALLWINNER_A10 is not set
CONFIG_SOCKET_SPECIFIC_OPTIONS=y
CONFIG_XIP_ROM_SIZE=0x10000
CONFIG_NUM_IPI_STARTS=2
# CONFIG_CPU_AMD_AGESA is not set
# CONFIG_CPU_AMD_PI is not set
# CONFIG_CPU_ARMLTD_CORTEX_A9 is not set
CONFIG_CPU_INTEL_MODEL_6EX=y
CONFIG_CPU_INTEL_MODEL_6FX=y
CONFIG_CPU_INTEL_MODEL_1067X=y
CONFIG_CPU_INTEL_MODEL_F3X=y
CONFIG_CPU_INTEL_MODEL_F4X=y
CONFIG_SSE2=y
CONFIG_CPU_INTEL_SOCKET_LGA775=y
# CONFIG_CPU_INTEL_FIRMWARE_INTERFACE_TABLE is not set
# CONFIG_CPU_INTEL_TURBO_NOT_PACKAGE_SCOPED is not set
# CONFIG_CPU_TI_AM335X is not set
# CONFIG_PARALLEL_CPU_INIT is not set
# CONFIG_PARALLEL_MP is not set
# CONFIG_UDELAY_IO is not set
CONFIG_UDELAY_LAPIC=y
# CONFIG_LAPIC_MONOTONIC_TIMER is not set
# CONFIG_UDELAY_TSC is not set
# CONFIG_UDELAY_TIMER2 is not set
# CONFIG_TSC_SYNC_LFENCE is not set
CONFIG_TSC_SYNC_MFENCE=y
# CONFIG_NO_FIXED_XIP_ROM_SIZE is not set
CONFIG_LOGICAL_CPUS=y
# CONFIG_SMM_TSEG is not set
# CONFIG_SMM_LAPIC_REMAP_MITIGATION is not set
# CONFIG_SERIALIZED_SMM_INITIALIZATION is not set
# CONFIG_X86_AMD_FIXED_MTRRS is not set
# CONFIG_PLATFORM_USES_FSP1_0 is not set
# CONFIG_MIRROR_PAYLOAD_TO_RAM_BEFORE_LOADING is not set
CONFIG_CACHE_AS_RAM=y
CONFIG_SMP=y
CONFIG_AP_SIPI_VECTOR=0xfffff000
CONFIG_MMX=y
CONFIG_SSE=y
CONFIG_SUPPORT_CPU_UCODE_IN_CBFS=y
# CONFIG_USES_MICROCODE_HEADER_FILES is not set
# CONFIG_CPU_MICROCODE_CBFS_GENERATE is not set
# CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER is not set
CONFIG_CPU_MICROCODE_CBFS_NONE=y

#
# Northbridge
#
# CONFIG_NORTHBRIDGE_AMD_AGESA is not set
# CONFIG_AMD_NB_CIMX is not set
# CONFIG_NORTHBRIDGE_AMD_CIMX_RD890 is not set
CONFIG_VIDEO_MB=0
# CONFIG_NORTHBRIDGE_AMD_PI is not set
CONFIG_RAMBASE=0x100000
# CONFIG_NORTHBRIDGE_INTEL_COMMON_MRC_CACHE is not set
CONFIG_NORTHBRIDGE_SPECIFIC_OPTIONS=y
CONFIG_NORTHBRIDGE_INTEL_X4X=y
CONFIG_HPET_ADDRESS=0xfed00000
CONFIG_MAX_PIRQ_LINKS=4

#
# Southbridge
#
# CONFIG_AMD_SB_CIMX is not set
# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB800 is not set
# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB900 is not set
CONFIG_SOUTHBRIDGE_INTEL_COMMON=y
# CONFIG_SOUTHBRIDGE_INTEL_COMMON_GPIO is not set
CONFIG_SOUTHBRIDGE_INTEL_I82801GX=y

#
# Super I/O
#
CONFIG_SUPERIO_ITE_COMMON_ROMSTAGE=y
CONFIG_SUPERIO_ITE_IT8718F=y

#
# Embedded Controllers
#
# CONFIG_MAINBOARD_HAS_CHROMEOS is not set
# CONFIG_UEFI_2_4_BINDING is not set
# CONFIG_USE_SIEMENS_HWILIB is not set
# CONFIG_ARCH_ARM is not set
# CONFIG_ARCH_BOOTBLOCK_ARM is not set
# CONFIG_ARCH_VERSTAGE_ARM is not set
# CONFIG_ARCH_ROMSTAGE_ARM is not set
# CONFIG_ARCH_RAMSTAGE_ARM is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV4 is not set
# CONFIG_ARCH_VERSTAGE_ARMV4 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV4 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV4 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV7 is not set
# CONFIG_ARCH_VERSTAGE_ARMV7 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV7 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV7 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV7_M is not set
# CONFIG_ARCH_VERSTAGE_ARMV7_M is not set
# CONFIG_ARM_LPAE is not set
# CONFIG_ARCH_ARM64 is not set
# CONFIG_ARCH_BOOTBLOCK_ARM64 is not set
# CONFIG_ARCH_VERSTAGE_ARM64 is not set
# CONFIG_ARCH_ROMSTAGE_ARM64 is not set
# CONFIG_ARCH_RAMSTAGE_ARM64 is not set
# CONFIG_ARCH_BOOTBLOCK_ARMV8_64 is not set
# CONFIG_ARCH_VERSTAGE_ARMV8_64 is not set
# CONFIG_ARCH_ROMSTAGE_ARMV8_64 is not set
# CONFIG_ARCH_RAMSTAGE_ARMV8_64 is not set
# CONFIG_ARM64_A53_ERRATUM_843419 is not set
# CONFIG_ARCH_MIPS is not set
# CONFIG_ARCH_BOOTBLOCK_MIPS is not set
# CONFIG_ARCH_VERSTAGE_MIPS is not set
# CONFIG_ARCH_ROMSTAGE_MIPS is not set
# CONFIG_ARCH_RAMSTAGE_MIPS is not set
# CONFIG_ARCH_POWER8 is not set
# CONFIG_ARCH_BOOTBLOCK_POWER8 is not set
# CONFIG_ARCH_VERSTAGE_POWER8 is not set
# CONFIG_ARCH_ROMSTAGE_POWER8 is not set
# CONFIG_ARCH_RAMSTAGE_POWER8 is not set
# CONFIG_ARCH_RISCV is not set
# CONFIG_ARCH_BOOTBLOCK_RISCV is not set
# CONFIG_ARCH_VERSTAGE_RISCV is not set
# CONFIG_ARCH_ROMSTAGE_RISCV is not set
# CONFIG_ARCH_RAMSTAGE_RISCV is not set
CONFIG_ARCH_X86=y
CONFIG_ARCH_BOOTBLOCK_X86_32=y
CONFIG_ARCH_VERSTAGE_X86_32=y
CONFIG_ARCH_ROMSTAGE_X86_32=y
CONFIG_ARCH_RAMSTAGE_X86_32=y
# CONFIG_ARCH_BOOTBLOCK_X86_64 is not set
# CONFIG_ARCH_VERSTAGE_X86_64 is not set
# CONFIG_ARCH_ROMSTAGE_X86_64 is not set
# CONFIG_ARCH_RAMSTAGE_X86_64 is not set
# CONFIG_USE_MARCH_586 is not set
CONFIG_AP_IN_SIPI_WAIT=y
CONFIG_SIPI_VECTOR_IN_ROM=y
# CONFIG_ROMCC is not set
# CONFIG_LATE_CBMEM_INIT is not set
CONFIG_PC80_SYSTEM=y
# CONFIG_BOOTBLOCK_DEBUG_SPINLOOP is not set
# CONFIG_BOOTBLOCK_SAVE_BIST_AND_TIMESTAMP is not set
# CONFIG_HAVE_CMOS_DEFAULT is not set
CONFIG_IOAPIC_INTERRUPTS_ON_FSB=y
# CONFIG_IOAPIC_INTERRUPTS_ON_APIC_SERIAL_BUS is not set
# CONFIG_POSTCAR_STAGE is not set
# CONFIG_VERSTAGE_DEBUG_SPINLOOP is not set
# CONFIG_ROMSTAGE_DEBUG_SPINLOOP is not set

#
# Devices
#
CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT=y
CONFIG_NATIVE_VGA_INIT_USE_EDID=y
# CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT_TEXTMODECFG is not set
# CONFIG_ON_DEVICE_ROM_LOAD is not set
# CONFIG_MULTIPLE_VGA_ADAPTERS is not set
# CONFIG_SMBUS_HAS_AUX_CHANNELS is not set
# CONFIG_SPD_CACHE is not set
CONFIG_PCI=y
# CONFIG_HYPERTRANSPORT_PLUGIN_SUPPORT is not set
CONFIG_PCIX_PLUGIN_SUPPORT=y
CONFIG_PCIEXP_PLUGIN_SUPPORT=y
CONFIG_CARDBUS_PLUGIN_SUPPORT=y
# CONFIG_AZALIA_PLUGIN_SUPPORT is not set
# CONFIG_PCIEXP_COMMON_CLOCK is not set
CONFIG_PCIEXP_ASPM=y
CONFIG_PCIEXP_CLK_PM=y
# CONFIG_EARLY_PCI_BRIDGE is not set
CONFIG_PCIEXP_L1_SUB_STATE=y
CONFIG_SUBSYSTEM_VENDOR_ID=0x0000
CONFIG_SUBSYSTEM_DEVICE_ID=0x0000
# CONFIG_SOFTWARE_I2C is not set

#
# Display
#

#
# Generic Drivers
#
# CONFIG_DRIVERS_AS3722_RTC is not set
# CONFIG_GIC is not set
# CONFIG_IPMI_KCS is not set
# CONFIG_DRIVERS_LENOVO_WACOM is not set
# CONFIG_DRIVERS_LENOVO_HYBRID_GRAPHICS is not set
CONFIG_REALTEK_8168_RESET=y
# CONFIG_SPI_FLASH is not set
# CONFIG_HAVE_SPI_CONSOLE_SUPPORT is not set
# CONFIG_DRIVERS_UART is not set
# CONFIG_NO_UART_ON_SUPERIO is not set
# CONFIG_UART_OVERRIDE_INPUT_CLOCK_DIVIDER is not set
# CONFIG_UART_OVERRIDE_REFCLK is not set
# CONFIG_DRIVERS_UART_8250MEM is not set
# CONFIG_DRIVERS_UART_8250MEM_32 is not set
# CONFIG_HAVE_UART_SPECIAL is not set
# CONFIG_DRIVERS_UART_OXPCIE is not set
# CONFIG_DRIVERS_UART_PL011 is not set
# CONFIG_UART_USE_REFCLK_AS_INPUT_CLOCK is not set
CONFIG_HAVE_USBDEBUG=y
# CONFIG_HAVE_USBDEBUG_OPTIONS is not set
# CONFIG_SMBIOS_PROVIDED_BY_MOBO is not set
# CONFIG_DRIVERS_I2C_PCF8523 is not set
# CONFIG_DRIVERS_I2C_RTD2132 is not set
# CONFIG_INTEL_DP is not set
# CONFIG_INTEL_DDI is not set
CONFIG_INTEL_EDID=y
# CONFIG_INTEL_INT15 is not set
CONFIG_INTEL_GMA_ACPI=y
# CONFIG_DRIVER_INTEL_I210 is not set
# CONFIG_DRIVER_MAXIM_MAX77686 is not set
# CONFIG_DRIVER_PARADE_PS8625 is not set
# CONFIG_DRIVER_PARADE_PS8640 is not set
CONFIG_DRIVERS_MC146818=y
# CONFIG_MAINBOARD_HAS_LPC_TPM is not set
# CONFIG_DRIVERS_RICOH_RCE822 is not set
# CONFIG_DRIVER_SIEMENS_NC_FPGA is not set
# CONFIG_DRIVERS_SIL_3114 is not set
# CONFIG_DRIVER_TI_TPS65090 is not set
# CONFIG_DRIVERS_TI_TPS65913 is not set
# CONFIG_DRIVERS_TI_TPS65913_RTC is not set
# CONFIG_DRIVER_XPOWERS_AXP209 is not set
# CONFIG_ACPI_SATA_GENERATOR is not set
CONFIG_ACPI_INTEL_HARDWARE_SLEEP_VALUES=y
# CONFIG_RTC is not set
# CONFIG_TPM is not set
CONFIG_STACK_SIZE=0x1000
CONFIG_MMCONF_SUPPORT_DEFAULT=y
CONFIG_MMCONF_SUPPORT=y
# CONFIG_BOOTMODE_STRAPS is not set

#
# Console
#
CONFIG_SQUELCH_EARLY_SMP=y
# CONFIG_CONSOLE_SERIAL is not set
# CONFIG_CONSOLE_SERIAL_921600 is not set
# CONFIG_CONSOLE_SERIAL_460800 is not set
# CONFIG_CONSOLE_SERIAL_230400 is not set
# CONFIG_CONSOLE_SERIAL_115200 is not set
# CONFIG_CONSOLE_SERIAL_57600 is not set
# CONFIG_CONSOLE_SERIAL_38400 is not set
# CONFIG_CONSOLE_SERIAL_19200 is not set
# CONFIG_CONSOLE_SERIAL_9600 is not set
# CONFIG_SPKMODEM is not set
# CONFIG_CONSOLE_NE2K is not set
CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
# CONFIG_CONSOLE_CBMEM_DUMP_TO_UART is not set
CONFIG_DEFAULT_CONSOLE_LOGLEVEL_8=y
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_6 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_5 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_4 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_3 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_2 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
# CONFIG_CMOS_POST is not set
CONFIG_POST_DEVICE_NONE=y
# CONFIG_POST_DEVICE_LPC is not set
# CONFIG_POST_DEVICE_PCI_PCIE is not set
CONFIG_POST_IO_PORT=0x80
# CONFIG_NO_EARLY_BOOTBLOCK_POSTCODES is not set
# CONFIG_HAVE_ACPI_RESUME is not set
CONFIG_HAVE_HARD_RESET=y
# CONFIG_HAVE_ROMSTAGE_CONSOLE_SPINLOCK is not set
# CONFIG_HAVE_ROMSTAGE_NVRAM_CBFS_SPINLOCK is not set
# CONFIG_HAVE_ROMSTAGE_MICROCODE_CBFS_SPINLOCK is not set
# CONFIG_HAVE_MONOTONIC_TIMER is not set
# CONFIG_HAVE_OPTION_TABLE is not set
# CONFIG_PIRQ_ROUTE is not set
CONFIG_HAVE_SMI_HANDLER=y
# CONFIG_PCI_IO_CFG_EXT is not set
CONFIG_IOAPIC=y
CONFIG_USE_WATCHDOG_ON_BOOT=y
CONFIG_VGA=y
# CONFIG_GFXUMA is not set
CONFIG_HAVE_ACPI_TABLES=y
CONFIG_COMMON_FADT=y
# CONFIG_ACPI_NHLT is not set

#
# System tables
#
# CONFIG_GENERATE_MP_TABLE is not set
# CONFIG_GENERATE_PIRQ_TABLE is not set
CONFIG_GENERATE_SMBIOS_TABLES=y
CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="GA-G41M-ES2L"

#
# Payload
#
# CONFIG_PAYLOAD_NONE is not set
CONFIG_PAYLOAD_ELF=y
# CONFIG_PAYLOAD_FILO is not set
# CONFIG_PAYLOAD_GRUB2 is not set
# CONFIG_PAYLOAD_SEABIOS is not set
# CONFIG_PAYLOAD_UBOOT is not set
# CONFIG_PAYLOAD_LINUX is not set
# CONFIG_PAYLOAD_TIANOCORE is not set
CONFIG_PAYLOAD_FILE="payload.elf"
CONFIG_PAYLOAD_OPTIONS=""
# CONFIG_PXE is not set
CONFIG_COMPRESSED_PAYLOAD_LZMA=y
# CONFIG_PAYLOAD_IS_FLAT_BINARY is not set

#
# Secondary Payloads
#
# CONFIG_COREINFO_SECONDARY_PAYLOAD is not set
# CONFIG_MEMTEST_SECONDARY_PAYLOAD is not set
# CONFIG_NVRAMCUI_SECONDARY_PAYLOAD is not set
# CONFIG_TINT_SECONDARY_PAYLOAD is not set

#
# Debugging
#
# CONFIG_FATAL_ASSERTS is not set
# CONFIG_DEBUG_CBFS is not set
CONFIG_HAVE_DEBUG_RAM_SETUP=y
# CONFIG_DEBUG_RAM_SETUP is not set
# CONFIG_HAVE_DEBUG_CAR is not set
# CONFIG_HAVE_DEBUG_SMBUS is not set
# CONFIG_DEBUG_SMI is not set
# CONFIG_DEBUG_SMM_RELOCATION is not set
# CONFIG_DEBUG_MALLOC is not set
# CONFIG_DEBUG_ACPI is not set
# CONFIG_TRACE is not set
# CONFIG_DEBUG_BOOT_STATE is not set
# CONFIG_ENABLE_APIC_EXT_ID is not set
CONFIG_WARNINGS_ARE_ERRORS=y
CONFIG_IASL_WARNINGS_ARE_ERRORS=y
# CONFIG_POWER_BUTTON_DEFAULT_ENABLE is not set
# CONFIG_POWER_BUTTON_DEFAULT_DISABLE is not set
# CONFIG_POWER_BUTTON_FORCE_ENABLE is not set
# CONFIG_POWER_BUTTON_FORCE_DISABLE is not set
# CONFIG_POWER_BUTTON_IS_OPTIONAL is not set
# CONFIG_REG_SCRIPT is not set
# CONFIG_CREATE_BOARD_CHECKLIST is not set
# CONFIG_MAKE_CHECKLIST_PUBLIC is not set