mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-19 04:57:55 +00:00
f8cb3db775
Non-impactful action, first step for #1421 based on participation in testing of #1398 and prior non-tested PRs. EDIT: last minute readd of x220-maximized boards (x220-maximized and x220-hotp-maximized boards). x220 is still UNTESTED (legacy, manually extracting ifs, me and gbe). EDIT: last minute readd of t440p-maximized boards (t440p-maximized and t440p-hotp-maximized boards). Thanks to @srgrint for lat minute report that t440p and x220 were tested ---- Traces of commands used: ls qemu-linuxboot* leopard* r630* s2600wf* tioga* winterfell* t420* t520* t440p* w530* kgpe* p8z77* x220* x230-maximized-fhd_edp* | grep ":" | awk -F ":" {'print $1'}| while read board; do mv $board/$board.config $board/UNTESTED_$board.config; done ls qemu-linuxboot* leopard* r630* s2600wf* tioga* winterfell* t420* t520* t440p* w530* kgpe* p8z77* x220* x230-maximized-fhd_edp* | grep ":" | awk -F ":" {'print $1'}| while read dir; do mv $dir UNTESTED_$dir; done ls UNTESTED* | grep ":" | awk -F ":" {'print $1'}| awk -F "UNTESTED_" {'print $2'} | while read line; do sed 's/'"$line"'/UNTESTED_'"$line"'/g' ../.circleci/config.yml -i ; done quick fix of circleci: sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml Modify p8z77-m_pro-tpm1 hotp board config to include to their maximized counterpart
99 lines
3.9 KiB
Makefile
99 lines
3.9 KiB
Makefile
# Configuration for a W530 running Qubes and other Linux Based OSes (through kexec)
|
|
#
|
|
# Includes
|
|
# - Deactivated+neutered ME and expanded consequent IFD BIOS regions
|
|
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
|
|
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
|
|
#
|
|
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
|
|
# This board ignores the in-built dGPU that comes with all w530's. In doing so the dGPU will not be initialized. This has some benefits in terms of reduced complexity in working with OS's with poor support for NVIDIA, better battery life and lower heat (making use of the thicker heatsink from a dGPU). Conversely, if you do not initialize the dGPU you will be unable to use an external monitor. To initialize the dGPU please use the dGPU boards that corresponds with the model of dGPU included with your device.
|
|
export CONFIG_COREBOOT=y
|
|
export CONFIG_COREBOOT_VERSION=4.19
|
|
export CONFIG_LINUX_VERSION=5.10.5
|
|
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-w530-maximized.config
|
|
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
|
|
|
|
#Additional hardware support
|
|
CONFIG_LINUX_USB=y
|
|
CONFIG_LINUX_E1000E=y
|
|
|
|
CONFIG_CRYPTSETUP2=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG2=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
|
|
#platform locking finalization (PR0)
|
|
CONFIG_IO386=y
|
|
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
|
|
|
|
|
|
#Remote attestation support
|
|
#TPM based requirements
|
|
export CONFIG_TPM=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
#HOTP based remote attestation for supported USB Security dongle
|
|
#With/Without TPM support
|
|
CONFIG_HOTPKEY=y
|
|
|
|
#Nitrokey Storage admin tool
|
|
CONFIG_NKSTORECLI=n
|
|
|
|
#GUI Support
|
|
#Console based Whiptail support(Console based, no FB):
|
|
#CONFIG_SLANG=y
|
|
#CONFIG_NEWT=y
|
|
#FBWhiptail based (Graphical):
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
|
|
#Additional tools:
|
|
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
|
|
CONFIG_DROPBEAR=y
|
|
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
|
|
export CONFIG_BOOT_KERNEL_REMOVE="quiet"
|
|
export CONFIG_BOOT_DEV="/dev/sda1"
|
|
export CONFIG_BOARD_NAME="Thinkpad W530-hotp-maximized"
|
|
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
|
|
|
|
# xx30-*-maximized boards require of you initially call one of the
|
|
# following to have gbe.bin ifd.bin and me.bin
|
|
# - blobs/xx30/download_clean_me.sh
|
|
# To download Lenovo original ME binary, neuter+deactivate ME, produce
|
|
# reduced IFD ME region and expanded BIOS IFD region.
|
|
# - blobs/xx30/extract.sh
|
|
# To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
|
|
#
|
|
# This board has two SPI flash chips, an 8 MB that holds the IFD,
|
|
# the ME image and part of the coreboot image, and a 4 MB one that
|
|
# has the rest of the coreboot and the reset vector.
|
|
#
|
|
# As a consequence, this replaces the need of having to flash t530-flash
|
|
# and expands available CBFS region (11.5Mb available CBFS space)
|
|
#
|
|
# When flashing via an external programmer it is easiest to have
|
|
# two separate files for these pieces.
|
|
all: $(board_build)/$(CB_OUTPUT_FILE)
|
|
@sha256sum $@ | tee -a "$(HASHES)"
|
|
|
|
all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom
|
|
$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom: $(board_build)/$(CB_OUTPUT_FILE)
|
|
$(call do,DD 8MB,$@,dd of=$@ if=$< bs=65536 count=128 skip=0 status=none)
|
|
@sha256sum $@ | tee -a "$(HASHES)"
|
|
|
|
all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom
|
|
$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom: $(board_build)/$(CB_OUTPUT_FILE)
|
|
$(call do,DD 4MB,$@,dd of=$@ if=$< bs=65536 count=64 skip=128 status=none)
|
|
@sha256sum $@ | tee -a "$(HASHES)"
|