ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-25 15:41:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
d9ad27f372
heads/boards/t420-maximized/t420-maximized.config

71 lines
2.0 KiB
Makefile
Raw Normal View History

xx20/xx30 boards uniformisation when switching to coreboot 4.13 - all: coreboot NO_POST for all boards - all: coreboot NO_GFX_INIT (linux payload does the graphic init) - all: coreboot TPM_MEASURED_BOOT (no more patches under Heads for measured boot) - all: coreboot DRIVERS_PS2_KEYBOARD (fixes no keyboard on soft reboot and potentially xx30t xx20t fix for random raw keyboard (to be tested) - all: coreboot removal of DEFAULT_CONSOLE_LOGLEVEL_5 under some boards - all: coreboot removal of "loglevel=3" under some linux command line options booting Heads kernel - all: coreboot removal of DEBUG_SMM_RELOCATION (unneeded) - all: coreboot INCLUDE_CONFIG_FILE and COLLECT_TIMESTAMPS for all boards - all: coreboot CONSOLE_SERIAL present on all boards - all: coreboot add VBT - all: board configs switch to cryptsetup2 xx20 hotp-maximized boards: - removal of dropbear (not enough space to have htop + dropbear) txx0 boards coreboot: - USE_OPTION_TABLE and STATIC_OPTION_TABLE added (todo: check T430 boards optimization and find issue/PR and ammend this commit)
2021-07-26 15:41:28 +00:00
# Configuration for a T420 running Qubes 4.1 and other Linux Based OSes (through kexec)
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
#
# Includes
# - Deactivated+neutered ME and expended consequent IFD BIOS regions
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx20/extract.sh)
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
#
# Doesn't include (to fit in 7mb image)
# - dropbear
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
export CONFIG_COREBOOT=y
boards/*/*.config: bump coreboot 4.22.01 boards config to use 24.02.01 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-10 16:17:41 +00:00
export CONFIG_COREBOOT_VERSION=24.02.01
boards: bump non-tpm qemu*, xx20 and xx30 boards to use linux kernel 5.10.5
2023-05-23 14:29:11 +00:00
export CONFIG_LINUX_VERSION=5.10.5
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
CONFIG_COREBOOT_CONFIG=config/coreboot-t420-maximized.config
xx20 and xx30: split kernel configs to legacy and maximized and board configs point to them
2022-06-10 13:52:07 +00:00
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
#Additional hardware support
CONFIG_LINUX_USB=y
CONFIG_LINUX_E1000E=y
Tethering refresh for CDC NCM/CDC EEM mobile phones (tested on GrapheneOS Pixel 6a, no more RNDIS support) - Add additional requirements to linux config - Add additional CONFIG_MOBILE_TETHERING=y to all maximized board configs - Fix issue under network-recovery-init to NTP sync against NTP server pool - Extend network-recovery-init to first try NTP sync against DNS server returned by DHCP answer - Remove network-recovery-init earlytty and tty0 redirection (console should be setuped properly by init in all cases) - If CONFIG_MOBILE_TETHERING=y added to board config and network-recovery-init called, wait to user input on instructions and warning 30 secs before proceeding (non-blocking) - Machines having STATIC_IP under board config won't benefit of autoatic NTP sync Since network-recovery-init can only be called from recovery shell now, and recovery shell can be guarded by GPG auth, this is PoC code to be used to complement TOTP being out of sync TODO(Future PR): - Refactor into functions and reuse into TOTP/HOTP being out of sync automatically. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-25 19:50:32 +00:00
CONFIG_MOBILE_TETHERING=y
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
xx20/xx30 boards uniformisation when switching to coreboot 4.13 - all: coreboot NO_POST for all boards - all: coreboot NO_GFX_INIT (linux payload does the graphic init) - all: coreboot TPM_MEASURED_BOOT (no more patches under Heads for measured boot) - all: coreboot DRIVERS_PS2_KEYBOARD (fixes no keyboard on soft reboot and potentially xx30t xx20t fix for random raw keyboard (to be tested) - all: coreboot removal of DEFAULT_CONSOLE_LOGLEVEL_5 under some boards - all: coreboot removal of "loglevel=3" under some linux command line options booting Heads kernel - all: coreboot removal of DEBUG_SMM_RELOCATION (unneeded) - all: coreboot INCLUDE_CONFIG_FILE and COLLECT_TIMESTAMPS for all boards - all: coreboot CONSOLE_SERIAL present on all boards - all: coreboot add VBT - all: board configs switch to cryptsetup2 xx20 hotp-maximized boards: - removal of dropbear (not enough space to have htop + dropbear) txx0 boards coreboot: - USE_OPTION_TABLE and STATIC_OPTION_TABLE added (todo: check T430 boards optimization and find issue/PR and ammend this commit)
2021-07-26 15:41:28 +00:00
CONFIG_CRYPTSETUP2=y
flash.sh: FLASHROM_OPTIONS->FLASH_OPTIONS: require FLASH_OPTIONS to specify flash program in board configs - boards: switch flashrom->flashprog, FLASH_OPTIONS: flashprog memory --progress --programmer internal TODO: check, Might break: - xx20 : x220/t420/t520: used hwseq: verify compat - legacy : not sure --ifd bios are support: verify compat (and drop, future PR drop legacy boards anyway...) - talos: linux_mtd is used: verify compat Tested: - x230 works with awesome progress bar on read, erase and write. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-01 19:02:42 +00:00
CONFIG_FLASHPROG=y
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
CONFIG_FLASHTOOLS=y
CONFIG_GPG2=y
CONFIG_KEXEC=y
CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
io386 platform lockdown: enable on sandy/ivy/haswell maximized board configs
2023-04-12 19:08:49 +00:00
#platform locking finalization (PR0)
CONFIG_IO386=y
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
#Remote attestation support
#TPM based requirements
export CONFIG_TPM=y
CONFIG_POPT=y
CONFIG_QRENCODE=y
CONFIG_TPMTOTP=y
#HOTP based remote attestation for supported USB Security dongle
#With/Without TPM support
xx20 boards: add xx20-hotp-maximized boards, remove hotp support from xx20-boards. Modify CircleCI conf accordingly.
2020-12-12 17:31:25 +00:00
CONFIG_HOTPKEY=n
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
#Nitrokey Storage admin tool
xx30 boards: remove NKSTORECLI from all boards. Par with xx20.
2020-12-13 03:11:20 +00:00
CONFIG_NKSTORECLI=n
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
#GUI Support
#Console based Whiptail support(Console based, no FB):
#CONFIG_SLANG=y
#CONFIG_NEWT=y
#FBWhiptail based (Graphical):
CONFIG_CAIRO=y
CONFIG_FBWHIPTAIL=y
#Additional tools:
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
move all other boards (but KGPE-D16) to coreboot 4.13 - xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13 - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb) - xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required) - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in. - qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support) - DOWNSIDE: - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000 - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000 - CircleCi build recipe removes 4.8.1 boards altogether - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer) - Removing one workspace layer will save approx 2 hours of build time on fresh builds - Removing one coreboot version will save us approx 2 hours of build time on fresh builds - KGPE-D16 will stay to coreboot 4.11 until forward notice. - All other board configs SHOULD be built on latest coreboot versions
2021-07-26 18:02:42 +00:00
CONFIG_DROPBEAR=n
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
export CONFIG_BOOTSCRIPT=/bin/gui-init
export CONFIG_BOOT_REQ_HASH=n
export CONFIG_BOOT_REQ_ROLLBACK=n
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-08 16:47:18 +00:00
export CONFIG_BOOT_KERNEL_ADD=""
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
export CONFIG_BOARD_NAME="ThinkPad T420-maximized"
boards FLASH_OPTIONS: add --noverify. No point verifying flash with internal programmer? Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-01 22:26:43 +00:00
export CONFIG_FLASH_OPTIONS="flashprog memory --progress --programmer internal --noverify"
boards: add t420-maximized
2020-12-03 00:33:18 +00:00
xx20/xx30 blob based boards: move ME blobs target outside of board configs (targets/xx*_blobs.mk) Makefile: have inclusion of all defined $BOARD BOARD_TARGETS (me, split_8mb4mb, ...) TODO: VBIOS scripts for W530/T530 need way more work. To be done later. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 18:48:52 +00:00
#Include bits related to sandybridge ME blob download/neutering down to BUP
BOARD_TARGETS := xx20_me_blobs
Reference in New Issue Copy Permalink