ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-23 14:52:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
66b6b52106
heads/unmaintained_boards/UNMAINTAINED_t520-hotp-maximized/UNMAINTAINED_t520-hotp-maximized.config

69 lines
2.0 KiB
Makefile
Raw Normal View History

adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
# Configuration for a T520 running Qubes and other Linux Based OSes (through kexec)
#
# Includes
# - Deactivated+neutered ME and expended consequent IFD BIOS regions
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx20/extract.sh)
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
export CONFIG_COREBOOT=y
WiP 4.22.01 fhd patch test + bump all 4.19 boards to 4.22.01 - patches/coreboot-4.22.01/0001-x230-fhd-variant.patch created per - git fetch https://review.coreboot.org/coreboot refs/changes/50/28950/23 && git format-patch -1 --stdout FETCH_HEAD > ~/heads/patches/coreboot-4.22.01/0001-x230-fhd-variant.patch - all boards configs bumped with: - grep -Rn 4.22 boards/ | awk -F "/" {'print $2'}| while read line; do make BOARD=$line coreboot.save_in_oldconfig_format_in_place ; done Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-02-05 16:06:11 +00:00
export CONFIG_COREBOOT_VERSION=4.22.01
boards: bump non-tpm qemu*, xx20 and xx30 boards to use linux kernel 5.10.5
2023-05-23 14:29:11 +00:00
export CONFIG_LINUX_VERSION=5.10.5
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
remove coreboot-hotp* duplicates, have boards configs point to non-hotp maximized equivalents
2023-01-31 15:49:16 +00:00
CONFIG_COREBOOT_CONFIG=config/coreboot-t520-maximized.config
xx20 and xx30: split kernel configs to legacy and maximized and board configs point to them
2022-06-10 13:52:07 +00:00
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
#Additional hardware support
CONFIG_LINUX_USB=y
CONFIG_LINUX_E1000E=y
Tethering refresh for CDC NCM/CDC EEM mobile phones (tested on GrapheneOS Pixel 6a, no more RNDIS support) - Add additional requirements to linux config - Add additional CONFIG_MOBILE_TETHERING=y to all maximized board configs - Fix issue under network-recovery-init to NTP sync against NTP server pool - Extend network-recovery-init to first try NTP sync against DNS server returned by DHCP answer - Remove network-recovery-init earlytty and tty0 redirection (console should be setuped properly by init in all cases) - If CONFIG_MOBILE_TETHERING=y added to board config and network-recovery-init called, wait to user input on instructions and warning 30 secs before proceeding (non-blocking) - Machines having STATIC_IP under board config won't benefit of autoatic NTP sync Since network-recovery-init can only be called from recovery shell now, and recovery shell can be guarded by GPG auth, this is PoC code to be used to complement TOTP being out of sync TODO(Future PR): - Refactor into functions and reuse into TOTP/HOTP being out of sync automatically. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-25 19:50:32 +00:00
CONFIG_MOBILE_TETHERING=y
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
CONFIG_CRYPTSETUP=y
flash.sh: FLASHROM_OPTIONS->FLASH_OPTIONS: require FLASH_OPTIONS to specify flash program in board configs - boards: switch flashrom->flashprog, FLASH_OPTIONS: flashprog memory --progress --programmer internal TODO: check, Might break: - xx20 : x220/t420/t520: used hwseq: verify compat - legacy : not sure --ifd bios are support: verify compat (and drop, future PR drop legacy boards anyway...) - talos: linux_mtd is used: verify compat Tested: - x230 works with awesome progress bar on read, erase and write. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-01 19:02:42 +00:00
CONFIG_FLASHPROG=y
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
CONFIG_FLASHTOOLS=y
CONFIG_GPG2=y
CONFIG_KEXEC=y
CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
io386 platform lockdown: enable on sandy/ivy/haswell maximized board configs
2023-04-12 19:08:49 +00:00
#platform locking finalization (PR0)
CONFIG_IO386=y
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
#Remote attestation support
#TPM based requirements
export CONFIG_TPM=y
CONFIG_POPT=y
CONFIG_QRENCODE=y
CONFIG_TPMTOTP=y
#HOTP based remote attestation for supported USB Security dongle
#With/Without TPM support
CONFIG_HOTPKEY=y
hotp boards: enable autoboot after 5 seconds if reverse HOTP against USB Security Dongle is successful by default Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-09 19:33:23 +00:00
export CONFIG_AUTO_BOOT_TIMEOUT=5
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
#Nitrokey Storage admin tool
CONFIG_NKSTORECLI=n
#GUI Support
#Console based Whiptail support(Console based, no FB):
#CONFIG_SLANG=y
#CONFIG_NEWT=y
#FBWhiptail based (Graphical):
CONFIG_CAIRO=y
CONFIG_FBWHIPTAIL=y
#Additional tools:
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
CONFIG_DROPBEAR=y
export CONFIG_BOOTSCRIPT=/bin/gui-init
export CONFIG_BOOT_REQ_HASH=n
export CONFIG_BOOT_REQ_ROLLBACK=n
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-08 16:47:18 +00:00
export CONFIG_BOOT_KERNEL_ADD=""
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
boards/* : Add/uniformize missing CONFIG_BOARD_NAME for coreboot boards
2022-01-28 19:13:13 +00:00
export CONFIG_BOARD_NAME="ThinkPad T520-hotp-maximized"
xx20 boards: reintroduce hwseq for flashprog Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-07 23:12:35 +00:00
export CONFIG_FLASH_OPTIONS="flashprog memory --progress --programmer internal:ich_spi_mode=hwseq"
adding working t520 baord and configs
2021-12-05 14:30:48 +00:00
xx20/xx30 blob based boards: move ME blobs target outside of board configs (targets/xx*_blobs.mk) Makefile: have inclusion of all defined $BOARD BOARD_TARGETS (me, split_8mb4mb, ...) TODO: VBIOS scripts for W530/T530 need way more work. To be done later. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 18:48:52 +00:00
#Include bits related to sandybridge ME blob download/neutering down to BUP
BOARD_TARGETS := xx20_me_blobs
Reference in New Issue Copy Permalink