mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-25 07:31:07 +00:00
7cbcdd8ed7
- Add additional requirements to linux config - Add additional CONFIG_MOBILE_TETHERING=y to all maximized board configs - Fix issue under network-recovery-init to NTP sync against NTP server pool - Extend network-recovery-init to first try NTP sync against DNS server returned by DHCP answer - Remove network-recovery-init earlytty and tty0 redirection (console should be setuped properly by init in all cases) - If CONFIG_MOBILE_TETHERING=y added to board config and network-recovery-init called, wait to user input on instructions and warning 30 secs before proceeding (non-blocking) - Machines having STATIC_IP under board config won't benefit of autoatic NTP sync Since network-recovery-init can only be called from recovery shell now, and recovery shell can be guarded by GPG auth, this is PoC code to be used to complement TOTP being out of sync TODO(Future PR): - Refactor into functions and reuse into TOTP/HOTP being out of sync automatically. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
72 lines
2.0 KiB
Makefile
72 lines
2.0 KiB
Makefile
# Configuration for a T420 running Qubes 4.1 and other Linux Based OSes (through kexec)
|
|
#
|
|
# Includes
|
|
# - Deactivated+neutered ME and expended consequent IFD BIOS regions
|
|
# - Forged 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx20/extract.sh)
|
|
# - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
|
|
#
|
|
# Doesn't include (to fit in 7mb image)
|
|
# - dropbear
|
|
export CONFIG_COREBOOT=y
|
|
export CONFIG_COREBOOT_VERSION=4.19
|
|
export CONFIG_LINUX_VERSION=5.10.5
|
|
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-t420-maximized.config
|
|
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
|
|
|
|
#Additional hardware support
|
|
CONFIG_LINUX_USB=y
|
|
CONFIG_LINUX_E1000E=y
|
|
CONFIG_MOBILE_TETHERING=y
|
|
|
|
CONFIG_CRYPTSETUP2=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG2=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
|
|
#platform locking finalization (PR0)
|
|
CONFIG_IO386=y
|
|
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
|
|
|
|
#Remote attestation support
|
|
#TPM based requirements
|
|
export CONFIG_TPM=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
#HOTP based remote attestation for supported USB Security dongle
|
|
#With/Without TPM support
|
|
CONFIG_HOTPKEY=n
|
|
|
|
#Nitrokey Storage admin tool
|
|
CONFIG_NKSTORECLI=n
|
|
|
|
#GUI Support
|
|
#Console based Whiptail support(Console based, no FB):
|
|
#CONFIG_SLANG=y
|
|
#CONFIG_NEWT=y
|
|
#FBWhiptail based (Graphical):
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
|
|
#Additional tools:
|
|
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
|
|
CONFIG_DROPBEAR=n
|
|
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD=""
|
|
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
|
|
export CONFIG_BOOT_DEV="/dev/sda1"
|
|
export CONFIG_BOARD_NAME="ThinkPad T420-maximized"
|
|
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal:ich_spi_mode=hwseq"
|
|
|
|
#Include bits related to sandybridge ME blob download/neutering down to BUP
|
|
BOARD_TARGETS := xx20_me_blobs
|