mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-22 14:22:26 +00:00
3574e12be9
repro: sed -i '/CONFIG_BOOT_DEV/d' boards/*/*.config unmaintained_boards/*/*.config qemu debug trace on preinstalled OS: [ 3.999725] [U] hello world [ 4.286215] DEBUG: Debug output enabled from board CONFIG_DEBUG_OUTPUT=y option (/etc/config) [ 4.315239] TRACE: Under init [ 4.369379] DEBUG: Applying panic_on_oom setting to sysctl [ 4.588333] TRACE: /bin/cbfs-init(5): main [ 4.728310] TRACE: /bin/cbfs-init(24): main [ 4.867039] DEBUG: TPM: Will extend PCR[7] with hash of filename /.gnupg/pubring.kbx [ 4.946757] TRACE: /bin/tpmr(788): main [ 5.006987] DEBUG: TPM: Extending PCR[7] with hash 7ccf4f64044946cf4e5b0efe3d959f00562227ae [ 5.068692] DEBUG: exec tpm extend -ix 7 -ic /.gnupg/pubring.kbx [ 5.326365] DEBUG: TPM: Will extend PCR[7] hash content of file /.gnupg/pubring.kbx [ 5.399511] TRACE: /bin/tpmr(788): main [ 5.460618] DEBUG: TPM: Extending PCR[7] with hash 547ca343719d3aa62af4763357d8c10cb35eae55 [ 5.524608] DEBUG: exec tpm extend -ix 7 -if /.gnupg/pubring.kbx [ 5.752340] TRACE: /bin/cbfs-init(24): main [ 5.908677] DEBUG: TPM: Will extend PCR[7] with hash of filename /.gnupg/trustdb.gpg [ 5.988169] TRACE: /bin/tpmr(788): main [ 6.044996] DEBUG: TPM: Extending PCR[7] with hash 7236ea8e612c1435259a8a0f8e0a8f1f5dba7042 [ 6.101604] DEBUG: exec tpm extend -ix 7 -ic /.gnupg/trustdb.gpg [ 6.371341] DEBUG: TPM: Will extend PCR[7] hash content of file /.gnupg/trustdb.gpg [ 6.451878] TRACE: /bin/tpmr(788): main [ 6.511948] DEBUG: TPM: Extending PCR[7] with hash 4697c489f359b40dd8aec55df52a33b1f580a3df [ 6.572785] DEBUG: exec tpm extend -ix 7 -if /.gnupg/trustdb.gpg [ 6.879519] TRACE: /bin/key-init(6): main [ 8.239618] TRACE: Under /etc/ash_functions:combine_configs [ 8.323781] TRACE: Under /etc/ash_functions:pause_recovery !!! Hit enter to proceed to recovery shell !!! [ 8.572855] TRACE: /bin/setconsolefont.sh(6): main [ 8.631296] DEBUG: Board does not ship setfont, not checking console font [ 8.887295] TRACE: /bin/gui-init(641): main [ 8.920627] TRACE: /etc/functions(715): detect_boot_device [ 9.251212] TRACE: /etc/functions(682): mount_possible_boot_device [ 9.312602] TRACE: /etc/functions(642): is_gpt_bios_grub [ 9.410830] TRACE: /dev/vda1 is partition 1 of vda [ 9.540007] TRACE: /etc/functions(619): find_lvm_vg_name [ 9.707187] TRACE: Try mounting /dev/vda1 as /boot [ 9.766843] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null) [ 9.825028] TRACE: /bin/gui-init(319): clean_boot_check Signed-off-by: Thierry Laurion <insurgo@riseup.net>
76 lines
2.6 KiB
Makefile
76 lines
2.6 KiB
Makefile
# Configuration for a W530 running Qubes and other Linux Based OSes (through kexec)
|
|
#
|
|
# Includes
|
|
# - Deactivated+neutered ME and expanded consequent IFD BIOS regions
|
|
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
|
|
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
|
|
#
|
|
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
|
|
# This board ignores the in-built dGPU that comes with all w530's. In doing so the dGPU will not be initialized. This has some benefits in terms of reduced complexity in working with OS's with poor support for NVIDIA, better battery life and lower heat (making use of the thicker heatsink from a dGPU). Conversely, if you do not initialize the dGPU you will be unable to use an external monitor. To initialize the dGPU please use the dGPU boards that corresponds with the model of dGPU included with your device.
|
|
export CONFIG_COREBOOT=y
|
|
export CONFIG_COREBOOT_VERSION=24.02.01
|
|
export CONFIG_LINUX_VERSION=5.10.5
|
|
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-w530-maximized.config
|
|
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
|
|
|
|
#Additional hardware support
|
|
CONFIG_LINUX_USB=y
|
|
CONFIG_LINUX_E1000E=y
|
|
CONFIG_MOBILE_TETHERING=y
|
|
|
|
CONFIG_CRYPTSETUP2=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG2=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
|
|
#platform locking finalization (PR0)
|
|
CONFIG_IO386=y
|
|
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
|
|
|
|
|
|
#Remote attestation support
|
|
#TPM based requirements
|
|
export CONFIG_TPM=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
#HOTP based remote attestation for supported USB Security dongle
|
|
#With/Without TPM support
|
|
CONFIG_HOTPKEY=y
|
|
export CONFIG_AUTO_BOOT_TIMEOUT=5
|
|
|
|
#Nitrokey Storage admin tool
|
|
CONFIG_NKSTORECLI=n
|
|
|
|
#GUI Support
|
|
#Console based Whiptail support(Console based, no FB):
|
|
#CONFIG_SLANG=y
|
|
#CONFIG_NEWT=y
|
|
#FBWhiptail based (Graphical):
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
|
|
#Additional tools:
|
|
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
|
|
CONFIG_DROPBEAR=y
|
|
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD=""
|
|
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
|
|
export CONFIG_BOARD_NAME="Thinkpad W530-hotp-maximized"
|
|
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
|
|
|
|
#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
|
|
BOARD_TARGETS := xx30_me_blobs
|
|
|
|
# Generate split 4MB top / 8MB bottom ROMs
|
|
BOARD_TARGETS += split_8mb4mb
|