mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-19 04:57:55 +00:00
a5b27e485f
This commit adds explanatory notes and updates existing t530 and w530 boards to generally align them with the dGPU points and provide signposting for those with and those without dGPU boards. It also adds an additional README in the blobs directory to explain the vbios extraction and building process.
91 lines
3.4 KiB
Plaintext
91 lines
3.4 KiB
Plaintext
# Configuration for a T530 running Qubes and other Linux Based OSes (through kexec)
|
|
#
|
|
# Includes
|
|
# - Deactivated+neutered ME and expanded consequent IFD BIOS regions
|
|
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
|
|
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
|
|
#
|
|
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
|
|
# This board is designed for a t530 without a dGPU. It will work just fine for a board with a dGPU, except you will not be able to use an external monitor via the mini-displayport or the dock's displayport, though external monitors will work via VGA ports. To initialize the dGPU please use one of the dgpu boards.
|
|
export CONFIG_COREBOOT=y
|
|
export CONFIG_COREBOOT_VERSION=4.13
|
|
export CONFIG_LINUX_VERSION=4.14.62
|
|
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-t530-maximized.config
|
|
CONFIG_LINUX_CONFIG=config/linux-x230.config
|
|
|
|
#Additional hardware support
|
|
CONFIG_LINUX_USB=y
|
|
CONFIG_LINUX_E1000E=y
|
|
|
|
CONFIG_CRYPTSETUP=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG2=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
|
|
#Remote attestation support
|
|
#TPM based requirements
|
|
export CONFIG_TPM=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
#HOTP based remote attestation for supported USB Security dongle
|
|
#With/Without TPM support
|
|
CONFIG_HOTPKEY=n
|
|
|
|
#Nitrokey Storage admin tool
|
|
CONFIG_NKSTORECLI=n
|
|
|
|
#GUI Support
|
|
#Console based Whiptail support(Console based, no FB):
|
|
#CONFIG_SLANG=y
|
|
#CONFIG_NEWT=y
|
|
#FBWhiptail based (Graphical):
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
|
|
#Additional tools:
|
|
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
|
|
CONFIG_DROPBEAR=y
|
|
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
|
|
export CONFIG_BOOT_KERNEL_REMOVE="quiet"
|
|
export CONFIG_BOOT_DEV="/dev/sda1"
|
|
export CONFIG_BOARD_NAME="Thinkpad T530-maximized"
|
|
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
|
|
|
|
# xx30-*-maximized boards require of you initially call one of the
|
|
# following to have gbe.bin ifd.bin and me.bin
|
|
# - blobs/xx30/download_clean_me.sh
|
|
# To download Lenovo original ME binary, neuter+deactivate ME, produce
|
|
# reduced IFD ME region and expanded BIOS IFD region.
|
|
# - blobs/xx30/extract.sh
|
|
# To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
|
|
#
|
|
# This board has two SPI flash chips, an 8 MB that holds the IFD,
|
|
# the ME image and part of the coreboot image, and a 4 MB one that
|
|
# has the rest of the coreboot and the reset vector.
|
|
#
|
|
# As a consequence, this replaces the need of having to flash t530-flash
|
|
# and expands available CBFS region (11.5Mb available CBFS space)
|
|
#
|
|
# When flashing via an external programmer it is easiest to have
|
|
# two separate files for these pieces.
|
|
all: $(build)/$(BOARD)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom
|
|
$(build)/$(BOARD)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom: $(build)/$(BOARD)/$(CB_OUTPUT_FILE)
|
|
$(call do,DD 8MB,$@,dd of=$@ if=$< bs=65536 count=128 skip=0 status=none)
|
|
@sha256sum $@
|
|
|
|
all: $(build)/$(BOARD)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom
|
|
$(build)/$(BOARD)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom: $(build)/$(BOARD)/$(CB_OUTPUT_FILE)
|
|
$(call do,DD 4MB,$@,dd of=$@ if=$< bs=65536 count=64 skip=128 status=none)
|
|
@sha256sum $@
|