diff --git a/Makefile b/Makefile
index 6f6451226..85a279b94 100644
--- a/Makefile
+++ b/Makefile
@@ -775,6 +775,7 @@ bin_modules-$(CONFIG_KBD) += kbd
 bin_modules-$(CONFIG_ZSTD) += zstd
 bin_modules-$(CONFIG_E2FSPROGS) += e2fsprogs
 bin_modules-$(CONFIG_EXFATPROGS) += exfatprogs
+bin_modules-$(CONFIG_NVMUTIL) += nvmutil
 
 $(foreach m, $(bin_modules-y), \
 	$(call map,initrd_bin_add,$(call bins,$m)) \
@@ -799,6 +800,9 @@ ifeq ($(CONFIG_COREBOOT),y)
 $(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/cbmem/cbmem))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/superiotool/superiotool))
 #$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/inteltool/inteltool))
+ifeq ($(CONFIG_IFDTOOL),y)
+$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool))
+endif
 endif
 
 $(COREBOOT_UTIL_DIR)/cbmem/cbmem \
@@ -814,6 +818,14 @@ $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
 	$(build)/$(zlib_dir)/.build \
 	$(build)/$(pciutils_dir)/.build \
 
+$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool: $(build)/$(coreboot_dir)/.configured musl-cross-make
+	+$(call do,MAKE,$(notdir $@),\
+		$(MAKE) -C "$(dir $@)" \
+			DOTCONFIG="$(build)/$(coreboot_dir)/.config" \
+			$(CROSS_TOOLS) \
+			EXTRA_CFLAGS="-Wno-error" \
+	)
+
 #
 # --- INITRD IMAGE CREATION ---
 #
diff --git a/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config b/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
index 97852bc3d..f6092b3b4 100644
--- a/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
+++ b/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
@@ -77,7 +77,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T530-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config b/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
index 4fa736382..04581bb66 100644
--- a/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
+++ b/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
@@ -76,7 +76,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T530-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config b/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
index 5d7cbf034..dae9d32a8 100644
--- a/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
+++ b/boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config
@@ -95,6 +95,10 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkcentre m900_tower-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := m900_me_blobs
diff --git a/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config b/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
index 8eb16cb96..0a6f18976 100644
--- a/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
+++ b/boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config
@@ -93,6 +93,10 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkcentre m900_tower-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := m900_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config b/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
index 5e4ccce60..443be7ce0 100644
--- a/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
+++ b/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
@@ -88,7 +88,11 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 HOTP maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config b/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
index d57983b68..fd315e2ac 100644
--- a/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
+++ b/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
@@ -88,7 +88,11 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config b/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
index 5b9d2cfc9..b226e75ed 100644
--- a/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
+++ b/boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
@@ -88,7 +88,11 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 HOTP maximized (TXT enabled)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config b/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
index 69154c329..15d23fff7 100644
--- a/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
+++ b/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
@@ -88,7 +88,11 @@ export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOOT_DEV="/dev/sda1"
 export CONFIG_BOARD_NAME="Dell Optiplex 7010/9010 maximized (TXT enabled)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config b/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
index 8fd55401b..b13c5517d 100644
--- a/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
+++ b/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -80,7 +81,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad T420-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseaq --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_t420-maximized/EOL_t420-maximized.config b/boards/EOL_t420-maximized/EOL_t420-maximized.config
index 9442cc474..63837373d 100644
--- a/boards/EOL_t420-maximized/EOL_t420-maximized.config
+++ b/boards/EOL_t420-maximized/EOL_t420-maximized.config
@@ -11,6 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -78,7 +80,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad T420-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq  --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config b/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
index 14f7861b9..11e5421b1 100644
--- a/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
+++ b/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
@@ -75,7 +75,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T430-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t430-maximized/EOL_t430-maximized.config b/boards/EOL_t430-maximized/EOL_t430-maximized.config
index b885744bf..6df02896f 100644
--- a/boards/EOL_t430-maximized/EOL_t430-maximized.config
+++ b/boards/EOL_t430-maximized/EOL_t430-maximized.config
@@ -75,7 +75,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T430-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config b/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
index 39379753a..f25370d64 100644
--- a/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
+++ b/boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config
@@ -49,7 +49,12 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad T440p-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_t440p-maximized/EOL_t440p-maximized.config b/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
index 82dde73bd..cc76fb8b3 100644
--- a/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
+++ b/boards/EOL_t440p-maximized/EOL_t440p-maximized.config
@@ -49,7 +49,11 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad T440p-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: $(pwd)/blobs/t440p/me.bin
diff --git a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
index 70befdc5e..86f0d06bd 100644
--- a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
+++ b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
@@ -89,6 +89,10 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480-maximized/EOL_t480-maximized.config b/boards/EOL_t480-maximized/EOL_t480-maximized.config
index e7c4a50ce..b859d2792 100644
--- a/boards/EOL_t480-maximized/EOL_t480-maximized.config
+++ b/boards/EOL_t480-maximized/EOL_t480-maximized.config
@@ -89,6 +89,10 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := t480_me_blobs
diff --git a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
index 4f933d15c..d5864df07 100644
--- a/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
+++ b/boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
@@ -89,6 +89,14 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+#export CONFIG_NVMUTIL=y
+#export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
index b1478cbc8..beb8a0b25 100644
--- a/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
+++ b/boards/EOL_t480s-maximized/EOL_t480s-maximized.config
@@ -89,6 +89,10 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480S-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 BOARD_TARGETS := t480s_me_blobs
diff --git a/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config b/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
index 21c3eef8d..6ab03df63 100644
--- a/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
+++ b/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
@@ -77,7 +77,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad W530-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_w530-maximized/EOL_w530-maximized.config b/boards/EOL_w530-maximized/EOL_w530-maximized.config
index a5e77ea6c..1977952b3 100644
--- a/boards/EOL_w530-maximized/EOL_w530-maximized.config
+++ b/boards/EOL_w530-maximized/EOL_w530-maximized.config
@@ -76,7 +76,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad W530-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config b/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
index f93d267cc..c4ddb4caa 100644
--- a/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
+++ b/boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config
@@ -50,7 +50,12 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad W541-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_w541-maximized/EOL_w541-maximized.config b/boards/EOL_w541-maximized/EOL_w541-maximized.config
index 53a21174d..672aa3313 100644
--- a/boards/EOL_w541-maximized/EOL_w541-maximized.config
+++ b/boards/EOL_w541-maximized/EOL_w541-maximized.config
@@ -50,7 +50,11 @@ export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOARD_NAME="ThinkPad W541-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: $(pwd)/blobs/w541/me.bin
diff --git a/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config b/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
index 4fd0825cc..7e48cdcde 100644
--- a/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
+++ b/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -80,7 +81,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad X220-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS := xx20_me_blobs
diff --git a/boards/EOL_x220-maximized/EOL_x220-maximized.config b/boards/EOL_x220-maximized/EOL_x220-maximized.config
index fdc5da0df..906a8932c 100644
--- a/boards/EOL_x220-maximized/EOL_x220-maximized.config
+++ b/boards/EOL_x220-maximized/EOL_x220-maximized.config
@@ -11,7 +11,8 @@
 #
 # Doesn't include (to fit in 7mb image)
 # - dropbear
-
+# - ifdtool
+# - nvmutil
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
@@ -79,7 +80,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="ThinkPad X220-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal:ich_spi_mode=hwseq --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=n
+export CONFIG_IFDTOOL=n
 
 #Include bits related to sandybridge ME blob download/neutering down to BUP
 BOARD_TARGETS += xx20_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config b/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
index 463839fd0..e19aa4ccc 100644
--- a/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
+++ b/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
@@ -89,7 +89,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized-eDP"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
index cb06d1899..51133b80f 100644
--- a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
+++ b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
@@ -87,7 +87,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config b/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
index fff75bca8..def00cf6b 100644
--- a/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
+++ b/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
@@ -81,7 +81,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized_usb-kb"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config b/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
index a7855c198..52354ee17 100644
--- a/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
+++ b/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
@@ -88,7 +88,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-maximized-eDP"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_x230-maximized/EOL_x230-maximized.config b/boards/EOL_x230-maximized/EOL_x230-maximized.config
index f5edab489..6b9bb7be5 100644
--- a/boards/EOL_x230-maximized/EOL_x230-maximized.config
+++ b/boards/EOL_x230-maximized/EOL_x230-maximized.config
@@ -75,7 +75,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad X230-maximized"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 #Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx30_me_blobs
diff --git a/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config b/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
index 600df1a24..8145095a2 100644
--- a/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
+++ b/boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config
@@ -71,7 +71,12 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower (HOTP)"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
+
 CONFIG_HOTPKEY=y
 export CONFIG_AUTO_BOOT_TIMEOUT=5
 
diff --git a/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config b/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
index 2f0d51c1f..a7e062452 100644
--- a/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
+++ b/boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config
@@ -71,7 +71,11 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD=""
 export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower"
-export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"
+
+#tools for mac-ramdomization
+export CONFIG_NVMUTIL=y
+export CONFIG_IFDTOOL=y
 
 # Make the Coreboot build depend on the following 3rd party blobs:
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
diff --git a/initrd/bin/flash.sh b/initrd/bin/flash.sh
index 716b4f050..911c59ddd 100755
--- a/initrd/bin/flash.sh
+++ b/initrd/bin/flash.sh
@@ -18,6 +18,42 @@ case "$CONFIG_FLASH_OPTIONS" in
   ;;
 esac
 
+# Adjust CONFIG_FLASH_OPTIONS depending on which function invoked this
+# script. The caller must set CHANGE_FLASH_OPTIONS, e.g.:
+#   CHANGE_FLASH_OPTIONS=whole_spi flash.sh "$ROM"
+#   CHANGE_FLASH_OPTIONS=gbe_only flash.sh "$ROM"
+# In all other cases, leave CONFIG_FLASH_OPTIONS untouched.
+case "$CHANGE_FLASH_OPTIONS" in
+   whole_spi | gbe_only )
+    # Both flashrom and flashprog are supposed to be supported programmers, 
+    # validate CONFIG_FLASH_OPTIONS matches the expected form before
+    # attempting to modify it.
+    # Some boards uses --programmer internal:ich_spi_mode=hwseq
+    case "$CONFIG_FLASH_OPTIONS" in
+      "flash"*" --progress --programmer internal"*" --ifd -i bios -i me -i fd" )
+        : # valid, continue
+      ;;
+      * )
+        DIE "ERROR: CONFIG_FLASH_OPTIONS is set incorrectly for $CHANGE_FLASH_OPTIONS!"
+      ;;
+    esac
+  ;;
+esac
+ 
+case "$CHANGE_FLASH_OPTIONS" in
+  whole_spi )
+    DEBUG "flash.sh: called from show_mac(), stripping IFD region options"
+    CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_OPTIONS/ --ifd -i bios -i me -i fd/}"
+  ;;
+  gbe_only )
+    DEBUG "flash.sh: called from mac_randomization(), stripping IFD region options and adding gbe"
+    CONFIG_FLASH_OPTIONS="${CONFIG_FLASH_OPTIONS/ -i bios -i me -i fd/} -i gbe"
+  ;;
+  * )
+    : # no change
+  ;;
+esac
+
 flash_rom() {
   ROM=$1
   if [ "$READ" -eq 1 ]; then
diff --git a/initrd/bin/gui-init.sh b/initrd/bin/gui-init.sh
index ce03d953b..9fc4e6415 100755
--- a/initrd/bin/gui-init.sh
+++ b/initrd/bin/gui-init.sh
@@ -628,8 +628,7 @@ show_main_menu() {
 
 show_options_menu() {
 	TRACE_FUNC
-	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
-		--menu "" 0 80 10 \
+	local menu_options=(
 		'b' ' Boot Options -->' \
 		't' ' TPM/TOTP/HOTP Options -->' \
 		'i' ' Investigate integrity discrepancies -->' \
@@ -637,6 +636,13 @@ show_options_menu() {
 		'u' ' Update checksums and sign all files in /boot' \
 		'c' ' Change configuration settings -->' \
 		'f' ' Flash/Update the BIOS -->' \
+	)
+
+	if [ "$CONFIG_NVMUTIL" = "y" ] && [ "$CONFIG_IFDTOOL" = "y" ]; then
+	      menu_options+=('m' ' Ethernet MAC address randomization -->')
+	fi
+
+	menu_options+=(
 		'g' ' GPG Options -->' \
 		'F' ' OEM Factory Reset / Re-Ownership -->' \
 		'C' ' Reencrypt LUKS container -->' \
@@ -644,6 +650,11 @@ show_options_menu() {
 		'R' ' Check/Update file hashes on root disk -->' \
 		'x' ' Exit to recovery shell' \
 		'r' ' <-- Return to main menu' \
+	)
+
+	whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
+		--menu "" 0 80 10 \
+		"${menu_options[@]}" \
 		2>/tmp/whiptail || recovery "GUI menu failed"
 
 	option=$(cat /tmp/whiptail)
@@ -669,6 +680,9 @@ show_options_menu() {
 	f)
 		flash-gui.sh
 		;;
+	m)
+		mac_randomization_options_menu
+		;;
 	g)
 		gpg-gui.sh
 		;;
@@ -905,6 +919,33 @@ force_unsafe_boot() {
 	fi
 }
 
+mac_randomization_options_menu() {
+	TRACE_FUNC
+	whiptail_type $BG_COLOR_MAIN_MENU --title "Ethernet MAC randomization" \
+		--menu "Select An Option" 0 80 10 \
+		'r' 'Generate a fully randomized ethernet MAC address' \
+		'i' 'Use a intel based universal pattern (OUI) to generate a random ethernet MAC address' \
+		's' 'Show the current ethernet MAC address' \
+		'm' ' <-- Return to main menu' \
+		2>/tmp/whiptail || recovery "GUI menu failed"
+
+	option=$(cat /tmp/whiptail)
+	case "$option" in
+	r)
+		change_mac "random"
+		;;
+	i)
+		change_mac "intel"
+		;;
+	s)
+		show_mac
+		clean_up_mac
+		;;
+	m) ;;
+
+	esac
+}
+
 # gui-init start
 TRACE_FUNC
 
diff --git a/initrd/etc/functions.sh b/initrd/etc/functions.sh
index d6723f21d..cbe82f300 100644
--- a/initrd/etc/functions.sh
+++ b/initrd/etc/functions.sh
@@ -3640,3 +3640,113 @@ _build_final_cmdline() {
 	echo "$_combined"
 }
 
+# Show current MAC address
+show_mac(){
+	TRACE_FUNC
+	
+	if [ "$CONFIG_IFDTOOL" = "y" ]; then
+
+		# CHANGE_FLASH_OPTIONS adjusts CONFIG_FLASH_OPTIONS depending on which function invoked flash.sh
+		# read whole SPI-chip and save it to /tmp/$CONFIG_BOARD.rom
+		CHANGE_FLASH_OPTIONS=whole_spi /bin/flash.sh -r /tmp/${CONFIG_BOARD}.rom
+
+		# test if file is > 0 byte
+		if [ ! -s /tmp/${CONFIG_BOARD}.rom ]; then
+			whiptail_error --title 'ERROR' --msgbox "Unable to read BIOS" 0 80
+			recovery
+		fi
+
+		cd /tmp
+		# Extract GBE from ifdtool
+		ifdtool -x ${CONFIG_BOARD}.rom
+		if [ ! -s flashregion_3_gbe.bin ]; then
+			whiptail_error --title 'ERROR' --msgbox "Unable to extract gbe region" 0 80
+			recovery
+		fi
+
+		# Show just the current MAC, cut the rest
+		DUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
+		CURRENT_MAC=$(printf "%s\n" "$DUMP_OUTPUT" | sed -n '2p')
+    		whiptail_type $BG_COLOR_MAIN_MENU --title "Show current MAC address" --msgbox "Current MAC address: $CURRENT_MAC" 0 80
+	else 		whiptail_error --title 'ERROR' --msgbox "Ifdtool is needed" 0 80
+	fi
+
+}
+
+change_mac() {
+	TRACE_FUNC
+
+	local mac_type="$1"
+
+	if [ "$CONFIG_IFDTOOL" = "y" ] && [ "$CONFIG_NVMUTIL" = "y" ]; then
+
+		show_mac
+
+		# Change MAC address randomly
+		# "nvmutil cannot specify multicast addresses"
+		# "nvmutil cannot specify 00:00:00:00:00:00"
+		# "randomly generated addresses are always unicast and local"
+		# See https://libreboot.org/docs/install/nvmutil.html
+
+		# Change MAC address randomly with intel OUI
+		# MAC Prefix: 00:1F:3B
+		# MAC Range: 00:1F:3B:00:00:00 - 00:1F:3B:FF:FF:FF
+		# See https://uic.io/en/mac/address/001f3b/
+		# There are a lot of prefixes from intel, this one is randomly picked
+
+		case "$mac_type" in
+			"random")
+				MAC_PATTERN="??:??:??:??:??:??"
+				;;
+			"intel")
+				MAC_PATTERN="00:1f:3b:??:??:??"
+				;;
+			*)
+				return 0
+				;;
+		esac
+
+		# Set mac to users choice
+		nvm flashregion_3_gbe.bin setmac "$MAC_PATTERN"
+
+		# Show MAC address to be flashed
+		NEWDUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
+		CHANGED_MAC=$(printf "%s\n" "$NEWDUMP_OUTPUT" | sed -n '2p')
+		whiptail_warning --title "Change ethernet MAC" --msgbox "Changed ethernet MAC address: $CHANGED_MAC" 0 80
+
+		# Decision: flash the new MAC address?
+		if whiptail_warning --title "Change ethernet MAC" --yesno "Do you really want to change the ethernet MAC address?" 0 80 --no-button "Do not change" --yes-button "Change"; then
+			# Insert modified GBE into ${CONFIG_BOARD}.rom
+			if ! ifdtool -i gbe:flashregion_3_gbe.bin ${CONFIG_BOARD}.rom; then
+				whiptail_error --title "Error" --msgbox "Failed to insert modified GBE!" 0 80
+				recovery
+			fi
+
+			# Flash back modified GBE only
+			if  CHANGE_FLASH_OPTIONS=gbe_only /bin/flash.sh ${CONFIG_BOARD}.rom.new; then
+				whiptail_type $BG_COLOR_MAIN_MENU --title "Change ethernet MAC" --msgbox "Flashing completed successfully!" 0 80
+			else
+				whiptail_error --title "Error" --msgbox "Flashing FAILED!" 0 80
+				recovery
+			fi
+		else
+			whiptail_warning --title "Canceled" --msgbox "Ethernet MAC address change canceled." 0 80
+			clean_up_mac
+		fi
+
+	else 
+		whiptail_error --title 'ERROR' --msgbox "Ifdtool and nvmutil is needed for mac randomization" 0 80
+		clean_up_mac
+	fi
+
+	clean_up_mac
+}
+
+clean_up_mac(){
+	# Don't leave temporary files lying around
+	if [ "$pwd" != "/tmp" ]; then
+		cd /tmp | return 1
+	fi
+
+	rm -f ${CONFIG_BOARD}.* flashregion_*.bin
+}
diff --git a/modules/nvmutil b/modules/nvmutil
new file mode 100644
index 000000000..570869bbe
--- /dev/null
+++ b/modules/nvmutil
@@ -0,0 +1,18 @@
+modules-$(CONFIG_NVMUTIL) += nvmutil
+
+nvmutil_version := 26.01rev1
+nvmutil_base_dir := lbmk
+nvmutil_dir := lbmk/util/nvmutil
+nvmutil_tar := $(nvmutil_version).tar.gz
+nvmutil_url := https://codeberg.org/libreboot/lbmk/archive/$(nvmutil_version).tar.gz
+nvmutil_hash := 05ad4171b211258afc4bc2211fac274566e63726016c735b9ca6742302488e3c
+
+
+nvmutil_configure :=
+nvmutil_target := \
+	$(MAKE_JOBS) \
+	$(CROSS_TOOLS) \
+	CFLAGS="$(CFLAGS) -Os -Wall -Wextra -std=c99 -pedantic"
+
+nvmutil_output := nvm
+nvmutil_depends := $(musl_dep)