device-lenovo-21bx: various improvements

• usbguard config: these are builtin USB devices that should be allowed by default

• removed nonfree-fw package, I decided that everything from that should be required since some fairly major features are broken without these firmwares and relevant userspace apps

• re-enabled EFI runtime services, so efifb is used (and probably other benefits?)

  • Laptops need the "Linux Boot" option enabled
  • "With recent UEFI firmware efi=noruntime can be left out when the Linux Boot option is enabled."
  • https://github.com/jhovold/linux/wiki/X13s#kernel-command-line

device/testing/device-lenovo-21bx/APKBUILD

@@ -3,15 +3,24 @@
 # Reference: <https://postmarketos.org/devicepkg>
 pkgname=device-lenovo-21bx
 pkgdesc="Lenovo ThinkPad X13s"
-pkgver=6
+pkgver=7
 pkgrel=0
 url="https://postmarketos.org"
 license="MIT"
 arch="aarch64"
 options="!check !archcheck !strip"
 depends="
+	bootmac
+	firmware-lenovo-21bx
+	libmbim-tools
+	linux-firmware-ath11k
+	linux-firmware-qca
+	linux-firmware-qcom
 	linux-lenovo-21bx
+	pd-mapper
+	pd-mapper-openrc
 	postmarketos-base
+	qmi-utils
 	systemd-boot
 "
 makedepends="devicepkg-dev"
@@ -19,11 +28,13 @@ source="
 	deviceinfo
 	modules-initfs
 	firmware.files
+	usbguard.conf
 "
 subpackages="
-	$pkgname-nonfree-firmware:nonfree_firmware
+	$pkgname-usbguard
 	$pkgname-vulkan
 "
+install="$pkgname.post-install"
 
 build() {
 	devicepkg_build $startdir $pkgname
@@ -31,25 +42,9 @@ build() {
 
 package() {
 	devicepkg_package $startdir $pkgname
-}
-
-nonfree_firmware() {
-	pkgdesc="Firmware for Bluetooth, Modem, WiFi, etc."
-	depends="
-		bootmac
-		firmware-lenovo-21bx
-		libmbim-tools
-		linux-firmware-ath11k
-		linux-firmware-qca
-		linux-firmware-qcom
-		pd-mapper
-		pd-mapper-openrc
-		qmi-utils
-		"
-	install="$subpkgname.post-install"
 
 	install -Dm644 "$srcdir/"/firmware.files \
-		-t "$subpkgdir"/usr/share/mkinitfs/files/
+		-t "$pkgdir"/usr/share/mkinitfs/files/
 }
 
 vulkan() {
@@ -58,8 +53,16 @@ vulkan() {
 	mkdir "$subpkgdir"
 }
 
+usbguard() {
+	install_if="$pkgname=$pkgver-r$pkgrel usbguard"
+	install -Dm600 "$srcdir"/usbguard.conf \
+		"$subpkgdir"/etc/usbguard/rules.d/"$pkgname".conf
+	devicepkg_package $startdir $pkgname
+}
+
 sha512sums="
-994173797adbbd79b0c33d3427d5e71f369e7506cc200b11d920d5b8854b2be28035a66602fe34254738c2eecd7d3e63c846424f5dad70e3e41e202dbd1393b6  deviceinfo
+c3570f44cd0134fd7400a5467cfddb3c1877a771fda8006228d1b0fd81536171ece53bf7562fc0e11dcc1fd3c6830e324e0d5ad9fdc4e16b53107fa3a04004fb  deviceinfo
 5e91aebdd5aa84eef2660c5cbecd27b1c3662f1707538d53764a74dc1e6cbac451b1041b9aaab92f087d44630036b10e5155a993dd4b2e54cba81637ddb47593  modules-initfs
 82f7719285434d8c7a5268ddc21d513bb3f3788eb3dd2df099e1c245add9d19719047b003a47edb077e095ebe09d9601b1312c001578e7dfa4ed61d72098ef74  firmware.files
+0d0412eb1f01af39000c39391f622640461305d83dae1a53aa7eef640cc17fd265cabca4e4e57dea053c47a4e50f9feb90f12ee5310d5b6425783e83efc5f9d8  usbguard.conf
 "