t430-hotp-verification: addition of t430 counterpart of non-maximized x230-hotp-verification board

.circleci/config.yml

@@ -232,6 +232,12 @@ workflows:
           requires:
             - x230-hotp-maximized
 
+      - build:
+          name: t430-hotp-verification
+          target: t430-hotp-verification
+          requires:
+            - x230-hotp-maximized
+
       - build:
           name: x230
           target: x230

boards/t430-hotp-verification/t430-hotp-verification.config

@@ -0,0 +1,73 @@
+# Configuration for a t430 with HOTP (Nitrokey/Purism USB Security dongle enabled HOTP support) 
+# running Qubes 4.1 and other OSes.
+#
+# Deactivated to fit in coreboot's CONFIG_CBFS_SIZE=0x700000 :
+# dropbear support(ssh client/server)
+# e1000e (ethernet driver)
+#
+# Addition vs standard x230 board config:
+# HOTP_KEY: HOTP challenge for currently supported USB Security dongles
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=4.13
+export CONFIG_LINUX_VERSION=4.14.62
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-t430-hotp-verification.config
+CONFIG_LINUX_CONFIG=config/linux-x230.config
+
+#Additional hardware support
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000E=n
+
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHROM=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+
+#Remote attestation support
+#TPM based requirements
+export CONFIG_TPM=y
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+CONFIG_HOTPKEY=y
+
+#Nitrokey Storage admin tool
+CONFIG_NKSTORECLI=n
+
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+CONFIG_SLANG=y
+CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+#CONFIG_CAIRO=y
+#CONFIG_FBWHIPTAIL=y
+
+#Additional tools:
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+CONFIG_DROPBEAR=n
+#Ethernet driver (Heads only)
+CONFIG_LINUX_E1000E=n
+
+export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
+export CONFIG_BOOT_KERNEL_REMOVE="quiet"
+export CONFIG_BOOT_DEV="/dev/sda1"
+export CONFIG_BOARD_NAME="Thinkpad T430"
+export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
+
+# This board has two SPI flash chips, an 8 MB that holds the IFD,
+# the ME image and part of the coreboot image, and a 4 MB one that
+# has the rest of the coreboot and the reset vector.
+#
+# Only flashing to the bios region is safe to do. The easiest is to
+# flash internally when the IFD is unlocked for writing, and x230-flash
+# is installed first.

config/coreboot-t430-hotp-verification.config

@@ -0,0 +1,17 @@
+CONFIG_USE_OPTION_TABLE=y
+CONFIG_STATIC_OPTION_TABLE=y
+# CONFIG_USE_BLOBS is not set
+CONFIG_VENDOR_LENOVO=y
+CONFIG_NO_POST=y
+CONFIG_CBFS_SIZE=0x700000
+CONFIG_BOARD_LENOVO_THINKPAD_T430=y
+CONFIG_LINUX_COMMAND_LINE="intel_iommu=igfx_off quiet"
+CONFIG_UART_PCI_ADDR=0
+CONFIG_CPU_MICROCODE_CBFS_NONE=y
+CONFIG_NO_GFX_INIT=y
+CONFIG_DRIVERS_PS2_KEYBOARD=y
+CONFIG_TPM_MEASURED_BOOT=y
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x80000
+CONFIG_PAYLOAD_LINUX=y
+CONFIG_PAYLOAD_FILE="../../build/t430-hotp-verification/bzImage"
+CONFIG_LINUX_INITRD="../../build/t430-hotp-verification/initrd.cpio.xz"

config/coreboot-t430.config

@@ -3,7 +3,6 @@ CONFIG_VENDOR_LENOVO=y
 CONFIG_NO_POST=y
 CONFIG_CBFS_SIZE=0x700000
 CONFIG_BOARD_LENOVO_THINKPAD_T430=y
-CONFIG_LINUX_COMMAND_LINE="intel_iommu=igfx_off quiet"
 CONFIG_UART_PCI_ADDR=0
 CONFIG_CPU_MICROCODE_CBFS_NONE=y
 CONFIG_NO_GFX_INIT=y