Fix/chipsec

.github/workflows/nix.yml

@@ -29,6 +29,3 @@ jobs:
 
       - name: Build base image
         run: nix build .#base
-
-      - name: Build chipsec image
-        run: nix build .#chipsec

Makefile

@@ -1,4 +1,4 @@
-TARGETS = base chipsec
+TARGETS = base
 
 all: $(TARGETS)
 

README.md

@@ -1,8 +1,8 @@
 # FirmwareCI Base Image
 
-This repository provides **modular, reproducible NixOS base images** for FirmwareCI and custom hardware testing. It is intended as a robust foundation for building your own NixOS-based CI images, offering flexible configuration of kernel, firmware, packages, and services. Each image includes essential default tooling, enabling your host machine to execute any FirmwareCI test step reliably.
+This repository provides **modular, reproducible NixOS base images** for FirmwareCI and custom hardware testing. It is intended as a foundation for building your own NixOS-based CI images, offering flexible configuration of kernel, firmware, packages, and services. Each image includes essential default tooling, enabling your host machine to execute any FirmwareCI test step reliably.
 
-**Note:** Chipsec requires an older kernel version for compatibility. To run the chipsec test step, use the provided chipsec configuration or image, which is preconfigured with the appropriate kernel.
+**Note:** Chipsec is compatible with kernel versions 6.16 and earlier. For kernel versions newer than 6.16, exclude chipsec from your builds by setting `includeChipSec = false`.
 
 For a comprehensive overview of available FirmwareCI commands and usage, refer to the [FirmwareCI Commands Reference](https://docs.firmware-ci.com/references/2_commands/index.html).
 
@@ -29,7 +29,6 @@ make all
 
 ```sh
 make base
-make chipsec
 ```
 
 ### Clean build outputs
@@ -38,16 +37,16 @@ make chipsec
 make clean
 ```
 
-The resulting images will be symlinked as `./base` and `./chipsec`.
+The resulting images will be symlinked as `./base`.
 
 ---
 
 ## Flake Structure
 
-- `flake.nix` – Flake entrypoint, exposes base and chipsec images as outputs.
+- `flake.nix` – Flake entrypoint, exposes base image and modules.
 - `modules/base.nix` – Base system options and configuration.
 - `modules/kernel.nix` – Kernel options and configuration.
-- `pkgs/default-tools/default.nix` – Default fwci testing tools package.
+- `pkgs/` – Package definitions (default-tools, chipsec, amd-debug-tools, etc.).
 - `Makefile` – Simple build automation for images.
 
 ---
@@ -107,7 +106,7 @@ You can override these options in your own configuration or flake:
 | `enableAllFirmware` | bool    | `true`                         | Enable all available firmware blobs.                |
 | `allowBroken`     | bool      | `true`                         | Allow installation of broken packages.              |
 | `allowUnfree`     | bool      | `true`                         | Allow installation of unfree packages.              |
-| `includeChipSec`  | bool      | `false`                        | Include chipsec with kernel module (<= 6.12 only).  |
+| `includeChipSec`  | bool      | `true`                         | Include chipsec with kernel module.                 |
 | `includeDefaultTools` | bool  | `true`                         | Include the default tools package in the image.     |
 
 #### `sshAccess` submodule
@@ -119,11 +118,12 @@ You can override these options in your own configuration or flake:
 
 ### **firmwareci.kernel options**
 
-| Option                    | Type                | Default   | Description                                                                                 |
-|---------------------------|---------------------|-----------|---------------------------------------------------------------------------------------------|
-| `version`                 | `str`               | `"6.15.8"`| Linux kernel version to use.                                                                |
-| `sha256`                  | `str`               | SRI hash  | sha256 hash for the kernel tarball (must be in SRI format, e.g. `sha256-...`).              |
-| `extraKernelModules`      | `list of str`       | `[]`      | Extra kernel modules to load at boot (e.g. `["dummy"]`).                                    |
+| Option                    | Type                | Default    | Description                                                                                 |
+|---------------------------|---------------------|------------|---------------------------------------------------------------------------------------------|
+| `version`                 | `str`               | `"6.12.58"`| Linux kernel version to use.                                                                |
+| `sha256`                  | `str`               | SRI hash   | SHA256 hash for the kernel tarball (must be in SRI format, e.g. `sha256-...`).              |
+| `extraKernelModules`      | `list of str`       | `[]`       | Extra kernel modules to load at boot (e.g. `["dummy"]`).                                    |
+| `includeIntelModules`     | `bool`              | `true`     | Include Intel-specific kernel modules (rapl, pmc, lpss).                                    |
 
 ---
 
@@ -156,16 +156,6 @@ Do not enable this configuration on devices connected to publicly accessible net
 
 ---
 
-## Structure
-
-- `flake.nix` – Flake entrypoint, exposes base and chipsec images.
-- `modules/base.nix` – Base system options and configuration.
-- `modules/kernel.nix` – Kernel options and configuration.
-- `pkgs/default-tools/default.nix` – Default fwci testing tools package.
-- `Makefile` – Simple build automation for images.
-
----
-
 ## Development
 
 We welcome contributions from everyone!  

flake.nix

@@ -11,7 +11,6 @@
     let
       fsType = "ext4";
 
-      # The general base config for reuse
       baseConfig = { config, modulesPath, pkgs, ... }: {
         imports = [
           "${modulesPath}/profiles/base.nix"
@@ -20,37 +19,22 @@
           ./modules/base.nix
           ./modules/kernel.nix
         ];
+
         system.stateVersion = "25.05";
         time.timeZone = "Europe/Berlin";
-        fileSystems."/" = {
-          inherit fsType;
-          device = "/dev/disk/by-label/nixos";
-        };
-        fileSystems."/boot/EFI" = {
-          device = "/dev/disk/by-label/ESP";
-        };
-        firmwareci = {
-          base = {
-            sshAccess = {
-              user = "root";
-              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcSD9iHnCrJXkSt7aGSnfL0tVHUm+x6/EDr/FchmBfu";
-            };
+
+        fileSystems = {
+          "/" = {
+            inherit fsType;
+            device = "/dev/disk/by-label/nixos";
           };
-          amdDebug.enable = true;
+          "/boot/EFI".device = "/dev/disk/by-label/ESP";
         };
-      };
 
-      chipsecConfig = { config, modulesPath, pkgs, ... }: {
-        imports = [
-          baseConfig
-        ];
         firmwareci = {
-          base = {
-            includeChipSec = true;
-          };
-          kernel = {
-            version = "6.12.36";
-            sha256 = "sha256-ShaK7S3lqBqt2QuisVOGCpjZm/w0ZRk24X8Y5U8Buow==";
+          base.sshAccess = {
+            user = "root";
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcSD9iHnCrJXkSt7aGSnfL0tVHUm+x6/EDr/FchmBfu";
           };
           amdDebug.enable = true;
         };
@@ -65,62 +49,45 @@
         };
     in
     {
-      modules = {
+      nixosModules = {
         base = import ./modules/base.nix;
         kernel = import ./modules/kernel.nix;
       };
 
-      inherit baseConfig chipsecConfig;
-    } // flake-utils.lib.eachSystem (with flake-utils.lib.system; [ x86_64-linux ])
-      (system:
-        let
-          pkgs = import nixpkgs {
+      inherit baseConfig;
+    } // flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        nixosConfigurations = {
+          base = nixpkgs.lib.nixosSystem {
             inherit system;
+            modules = [ baseConfig ];
           };
-          nixosConfigurations = {
-            base = nixpkgs.lib.nixosSystem {
-              inherit system;
-              modules = [ baseConfig ];
-            };
-
-            chipsec = nixpkgs.lib.nixosSystem {
-              inherit system;
-              modules = [ chipsecConfig ];
-            };
-          };
-        in
-        {
-          checks = {
-            pre-commit-check = pre-commit-hooks.lib.${system}.run {
-              src = ./.;
-              hooks = {
-                nixpkgs-fmt.enable = true;
-                statix.enable = true;
-              };
-            };
-          };
-
-          devShells.default = pkgs.mkShell {
-            packages = with pkgs; [ statix ];
-            shellHook = ''
-              ${self.checks.${system}.pre-commit-check.shellHook}
-            '';
+        };
+      in
+      {
+        checks.pre-commit-check = pre-commit-hooks.lib.${system}.run {
+          src = ./.;
+          hooks = {
+            nixpkgs-fmt.enable = true;
+            statix.enable = true;
           };
+        };
 
-          packages = {
-            inherit (pkgs) statix nixpkgs-fmt;
+        devShells.default = pkgs.mkShell {
+          packages = [ pkgs.statix ];
+          shellHook = self.checks.${system}.pre-commit-check.shellHook;
+        };
 
-            base = generateDiskImage {
-              inherit fsType pkgs;
-              inherit (nixosConfigurations.base) config;
-            };
+        packages = {
+          inherit (pkgs) statix nixpkgs-fmt;
 
-            chipsec = generateDiskImage {
-              inherit fsType pkgs;
-              inherit (nixosConfigurations.chipsec) config;
-            };
+          base = generateDiskImage {
+            inherit fsType pkgs;
+            inherit (nixosConfigurations.base) config;
           };
 
-          defaultPackage = self.packages.${system}.base;
-        });
+          default = self.packages.${system}.base;
+        };
+      });
 }