ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-30 09:48:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
a36aa2562d
heads/boards/x230-hotp-legacy/x230-hotp-legacy.config

74 lines
2.1 KiB
Makefile
Raw Normal View History

move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
# Configuration for a x230 with HOTP (Nitrokey/Purism USB Security dongle enabled HOTP support)
# running Qubes 4.1 and other OSes.
xx30 boards: suspend/resume fix (#838) * x230-hotp-verification: revert to coreboot "CONFIG_CBFS_SIZE=0x700000" by disabling board "CONFIG_DROPBEAR=y" and "CONFIG_LINUX_E1000E" to save space per @alex-nitrokey test under #770 to fix #608 * x230-htop-verification board: add clarifications on x230 board differences. Fixes #737 #770 #608 * X230 board & coreboot config: Fix x230 board, removing dropbear and e1000e driver. * t430: board and coreboot config par with x230 to circumvent CBFS linked suspend/resume issues.
2020-10-19 16:50:24 +00:00
#
# Deactivated to fit in coreboot's CONFIG_CBFS_SIZE=0x700000 :
# dropbear support(ssh client/server)
# e1000e (ethernet driver)
#
# Addition vs standard x230 board config:
# HOTP_KEY: HOTP challenge for currently supported USB Security dongles
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
export CONFIG_COREBOOT=y
boards/*/*.config: bump coreboot 4.22.01 boards config to use 24.02.01 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-10 16:17:41 +00:00
export CONFIG_COREBOOT_VERSION=24.02.01
boards: bump non-tpm qemu*, xx20 and xx30 boards to use linux kernel 5.10.5
2023-05-23 14:29:11 +00:00
export CONFIG_LINUX_VERSION=5.10.5
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs (coreboot_481) to facilitate newer coreboot version integration and testing without breaking old fixed boards
2020-07-10 13:44:01 +00:00
xx30: rename legacy boards names, remove coreboot config duplicates
2023-01-31 16:46:32 +00:00
CONFIG_COREBOOT_CONFIG=config/coreboot-x230-legacy.config
xx20 and xx30: split kernel configs to legacy and maximized and board configs point to them
2022-06-10 13:52:07 +00:00
CONFIG_LINUX_CONFIG=config/linux-x230-legacy.config
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#Additional hardware support
CONFIG_LINUX_USB=y
CONFIG_LINUX_E1000E=n
CONFIG_CRYPTSETUP2=y
flash.sh: FLASHROM_OPTIONS->FLASH_OPTIONS: require FLASH_OPTIONS to specify flash program in board configs - boards: switch flashrom->flashprog, FLASH_OPTIONS: flashprog memory --progress --programmer internal TODO: check, Might break: - xx20 : x220/t420/t520: used hwseq: verify compat - legacy : not sure --ifd bios are support: verify compat (and drop, future PR drop legacy boards anyway...) - talos: linux_mtd is used: verify compat Tested: - x230 works with awesome progress bar on read, erase and write. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-01 19:02:42 +00:00
CONFIG_FLASHPROG=y
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
CONFIG_FLASHTOOLS=y
CONFIG_GPG2=y
CONFIG_KEXEC=y
CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#Remote attestation support
#TPM based requirements
export CONFIG_TPM=y
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
CONFIG_POPT=y
CONFIG_QRENCODE=y
CONFIG_TPMTOTP=y
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#HOTP based remote attestation for supported USB Security dongle
#With/Without TPM support
Rename CONFIG_LIBREMKEY to CONFIG_HOTPKEY
2020-06-11 13:29:51 +00:00
CONFIG_HOTPKEY=y
hotp boards: enable autoboot after 5 seconds if reverse HOTP against USB Security Dongle is successful by default Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-09 19:33:23 +00:00
export CONFIG_AUTO_BOOT_TIMEOUT=5
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#Nitrokey Storage admin tool
CONFIG_NKSTORECLI=n
xx30 boards: suspend/resume fix (#838) * x230-hotp-verification: revert to coreboot "CONFIG_CBFS_SIZE=0x700000" by disabling board "CONFIG_DROPBEAR=y" and "CONFIG_LINUX_E1000E" to save space per @alex-nitrokey test under #770 to fix #608 * x230-htop-verification board: add clarifications on x230 board differences. Fixes #737 #770 #608 * X230 board & coreboot config: Fix x230 board, removing dropbear and e1000e driver. * t430: board and coreboot config par with x230 to circumvent CBFS linked suspend/resume issues.
2020-10-19 16:50:24 +00:00
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#GUI Support
#Console based Whiptail support(Console based, no FB):
CONFIG_SLANG=y
CONFIG_NEWT=y
#FBWhiptail based (Graphical):
#CONFIG_CAIRO=y
#CONFIG_FBWHIPTAIL=y
#Additional tools:
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
xx30 boards: suspend/resume fix (#838) * x230-hotp-verification: revert to coreboot "CONFIG_CBFS_SIZE=0x700000" by disabling board "CONFIG_DROPBEAR=y" and "CONFIG_LINUX_E1000E" to save space per @alex-nitrokey test under #770 to fix #608 * x230-htop-verification board: add clarifications on x230 board differences. Fixes #737 #770 #608 * X230 board & coreboot config: Fix x230 board, removing dropbear and e1000e driver. * t430: board and coreboot config par with x230 to circumvent CBFS linked suspend/resume issues.
2020-10-19 16:50:24 +00:00
CONFIG_DROPBEAR=n
#Ethernet driver (Heads only)
CONFIG_LINUX_E1000E=n
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
export CONFIG_BOOTSCRIPT=/bin/gui-init
export CONFIG_BOOT_REQ_HASH=n
export CONFIG_BOOT_REQ_ROLLBACK=n
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-08 16:47:18 +00:00
export CONFIG_BOOT_KERNEL_ADD=""
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
xx30: rename legacy boards names, remove coreboot config duplicates
2023-01-31 16:46:32 +00:00
export CONFIG_BOARD_NAME="Thinkpad X230-hotp-legacy"
boards FLASH_OPTIONS: remove --noverify/--noverify-all for now Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-01 22:38:01 +00:00
export CONFIG_FLASH_OPTIONS="flashprog memory --progress --programmer internal --ifd --image bios"
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key
2020-05-16 17:38:14 +00:00
# This board has two SPI flash chips, an 8 MB that holds the IFD,
# the ME image and part of the coreboot image, and a 4 MB one that
# has the rest of the coreboot and the reset vector.
#
# Only flashing to the bios region is safe to do. The easiest is to
# flash internally when the IFD is unlocked for writing, and x230-flash
# is installed first.
Reference in New Issue Copy Permalink