boards: Add Star Labs Heads targets

[Sean-StarLabs]

Add Heads support for the Star Labs target set, continuing the original StarLite Mk V PR as a patch-per-board series.

Scope

• Pin Star Labs coreboot 26.07.1.
• Store generated coreboot oldconfigs with their source _defconfig files alongside.
• Add the shared Star Labs configuration and compact profiles.
• Keep StarLite Mk V / Lite ADL as the existing CI-covered seed target.
• Add one signed commit per additional board target:
  • starlabs_qemu
  • starlabs_starbook_mtl
  • starlabs_starbook_adl
  • starlabs_starbook_adl_n
  • starlabs_starbook_rpl
  • starlabs_starbook_tgl
  • starlabs_labtop_cml
  • starlabs_adl_horizon
  • starlabs_byte_adl
  • starlabs_byte_twl
  • starlabs_byte_cezanne
  • starlabs_starbook_cezanne
  • starlabs_starfighter_mtl
  • starlabs_starfighter_rpl
• Keep CSE enabled by default for PTT-backed variants while retaining the disabled default for variants with a discrete TPM.
• Add the Cezanne AMD input verifier and fTPM/TPM-log coreboot patches needed by the Cezanne targets.
• Load configured USB keyboard drivers before the first interactive prompt.
• Discover an installed OS when /boot is a directory on the root filesystem rather than a separate partition.
• Keep compact-profile menus and ownership flows consistent with the optional tools present in the initramfs.
• Use direct CBFS reads at runtime. flashprog remains scoped to updating the COREBOOT region.
• Invalidate patched Git module caches by patch content and include Go in the development environment for coreboot SPD generation.

Initial installation and recovery require board-appropriate external recovery access. For StarLite Mk V, the current recovery reference remains:
https://support.starlabs.systems/hc/star-labs/articles/starlite-mk-v-installingrecovering-firmware-with-external-programmer

The related vendor, porting and flashing documentation is under review in linuxboot/heads-wiki#222. The flashing page remains unpublished until this port is merged and hardware-tested.

Validation

• All 28 commits are GPG signed and carry Signed-off-by: Sean Rhodes <sean@starlabs.systems>.
• The submitted tree completed the full GitHub check set, including the Lite ADL build and both cross-compiler jobs.
• make -s BOARD=<target> echo_modules completed for every Star Labs target in this PR.
• Every retained Star Labs coreboot oldconfig regenerates byte-for-byte from its stored _defconfig.
• A Horizon build produced a 16 MiB ROM with 398,180 bytes free in CBFS.
• A clean Lite ADL build produced a 16 MiB ROM with 96 KiB free in CBFS.
• The Cezanne input manifest validates every required AMD binary, including CZN/PSP/UcodePatch_CZN_A0.bin.
• The compact-profile, deferred-lock, and root-filesystem boot-path checks pass.
• The modified init scripts pass bash -n; git diff --check is clean outside the imported raw coreboot patch payloads.
• On Lite ADL hardware, an externally flashed image booted successfully and the setting-clock prompt accepted input from the detachable USB keyboard.
• Heads found and booted an existing Fedora installation whose /boot directory is on the ext4 root filesystem; Wi-Fi came up after boot.

Lite ADL porting checklist

• Successful external flash of the CircleCI build, recording the programmer model and voltage. A CH341A was used during development, but the voltage was not recorded.
• Boots successfully after flashing.
• Setting-clock prompt accepts input from the detachable USB keyboard after the initial flash.
• Clean boot is detected with no keyring or installed OS, and USB boot is offered.
• Boots from USB.
• OS installation and reboot.
• Existing Fedora installation is found with /boot on the root filesystem and boots successfully.
• With no public key but an OS present, OEM Factory Reset is offered and completed with a hardware key.
• After re-ownership, a new HOTP/TOTP secret is generated.
• Wi-Fi works in the installed OS.
• PR0 validation:
  • flashprog -p internal reports the flash unlocked before lock_chip.
  • lock_chip applies PR0.
  • flashprog -p internal reports the flash locked afterwards.

[tlaurion]

~Addresses StarLabsLtd/firmware#104.

Thanks for your contribution @Sean-StarLabs
Could you upload your public key used to sign commits to github so the "unverified" commits warning vanishes?

Will try to review toroughly in next coming days but plate quite full right now. Looks good at first glance!

Meanwhile, would be nice if you added the checklist that can be found at https://github.com/linuxboot/heads-wiki/edit/master/Development/Porting.md and suggest changes there for things you see unfit.

[tlaurion]

Also think/suggest changes you would want to see at https://osresearch.net/Vendors/ (edit this page on github link at bottom of the page)

As well as documenting the same way under https://osresearch.net/Flashing-guides

I will collaborate in those PR as we go!

[tlaurion]

@Sean-StarLabs Love your work here, LGTM.

Checklist needs completion, of course.

Also seen as part of work addressing #2159 that you pushed fixes coreboot side. Tracking with great interest.

You might want to take a look at #2165 and linuxboot/heads-wiki#221

Do you have a timeline for testing?

[tlaurion]

@Sean-StarLabs you might want to add your GPIO work under label https://review.coreboot.org/q/topic:%22intel_gpio_lock%22

[tlaurion]

@Sean-StarLabs you might want to add your GPIO work under label https://review.coreboot.org/q/topic:%22intel_gpio_lock%22

Meanwhile, you can add related unmerged patches needed for your port to be applied to coreboot fork (as you did under patches/coreboot-starlabs_2607) for TPM GPIO reset vuln, if merging upstream stalls and prevents you from going forward (or point modules/coreboot to commits confirmed working on your side).

[tlaurion]

@Sean-StarLabs You saw https://app.circleci.com/pipelines/github/linuxboot/heads/1394/workflows/0d81f5d0-83fb-4af2-9df5-56797eeb7fb8/jobs/52499 ?

Jul 27 23:04:23 INFO: Applying patch file: patches/coreboot-starlabs_2607/0004-mainboard-starlabs-cezanne-enable-ftpm.patch
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig...
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd...
error: while searching for:
                RW_MRC_CACHE@0x20000    0x10000
                SMMSTORE@0x30000                0x80000
                CONSOLE@0xb0000         0x20000
                FMAP@0xd0000            0x1000
                COREBOOT(CBFS)
        }
}

error: patch failed: build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd:5
Applied patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig cleanly.
Applying patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd with 1 reject...
Rejected hunk #1.
Jul 27 23:04:23 ERROR: Failed to apply patch: patches/coreboot-starlabs_2607/0004-mainboard-starlabs-cezanne-enable-ftpm.patch. Reversing and reapplying.
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd...
error: while searching for:
                RW_MRC_CACHE@0x20000    0x10000
                SMMSTORE@0x30000                0x80000
                CONSOLE@0xb0000         0x20000
                PSP_NVRAM(PRESERVE)@0xd0000     0x20000
                FMAP@0xf0000            0x1000
                COREBOOT(CBFS)
        }
}

error: patch failed: build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd:5
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig...
Applying patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd with 1 reject...
Rejected hunk #1.
Applied patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig cleanly.
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig...
Checking patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd...
error: while searching for:
                RW_MRC_CACHE@0x20000    0x10000
                SMMSTORE@0x30000                0x80000
                CONSOLE@0xb0000         0x20000
                FMAP@0xd0000            0x1000
                COREBOOT(CBFS)
        }
}

error: patch failed: build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd:5
Applied patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/Kconfig cleanly.
Applying patch build/x86/coreboot-starlabs_2607/src/mainboard/starlabs/cezanne/board.fmd with 1 reject...
Rejected hunk #1.
make: *** [Makefile:697: /root/heads/build/x86/coreboot-starlabs_2607/.canary] Error 1

[tlaurion]

@Sean-StarLabs anything needed on my side?

[tlaurion]

On 67cace7

Unless needed (msi platforms needed to have a punched hole to support recovery from proprietary tools), instead of using flashprog and read the whole spi to get cbfs content: it is advised to reduce cbfs region within the 16mb memory limit after which cbfs (flashtools/cbfs.c) would need some love to read as expected cbfs region> 16mb

Cc @Sean-StarLabs

[tlaurion]

On 67cace7

Unless needed (msi platforms needed to have a punched hole to support recovery from proprietary tools), instead of using flashprog and read the whole spi to get cbfs content: it is advised to reduce cbfs region within the 16mb memory limit after which cbfs (flashtools/cbfs.c) would need some love to read as expected cbfs region> 16mb

Cc @Sean-StarLabs

Otherwise issue to fix to keep >16mb cbfs region is osresearch/flashtools#10

Didn't prioritize this since msi platform is community port with few known users.

CC @Sean-StarLabs

If choosing to keep >16mb or not fix cbfs.c from pointed issue, you probably observed longer boot time since flashprog is slow at backup rom to extract cbfs from early cbfs-init.sh, which is a bug to be fixed, not to be used extensively in new boards:this is why I suggest reducing cbfs size in coreboot config.

3mdeb/dasharo+heads got dropped upstream for the msi platforms, workstations +dGPU didn't receive enough love to facilite proper UX with either oprom measure+extraction (borrowing seabios code), requiring both iGPU + dGPU so dual monitor setup as workaround, to say the least, subefficient.

Are you on matrix? Dm me if you will :)
We could do some synced work session.

Hope you enabled debug logging in local builds, so you can get the Debug + TRACE_FUNC output to get a quick grasp of what is happening under the hood and ease your porting process. Should not be hard since other platforms of same family exist, outside of coreboot upstream required fixes which you seem to have already grasped (either coreboot module pinned commit or patches/coreboot-* fork applied incrementally in alphanumeric order).

I see great ROI here, please contact.

[Sean-StarLabs]

/review

[Sean-StarLabs]

/review

[Copilot]

Pull request overview

Adds broad Star Labs platform support using the pinned vendor coreboot fork, shared profiles, firmware patches, and runtime boot improvements.

Changes:

• Adds 18 Star Labs board targets and shared compact/physical profiles.
• Adds AMD binary verification and coreboot patches for fTPM, TPM logs, SPD, and Intel locking.
• Loads USB keyboards earlier and supports root filesystems containing /boot.

Reviewed changes

Copilot reviewed 61 out of 64 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
patches/coreboot-starlabs_2607/0001-util-cbmem-include-endian.h.patch	Fixes cbmem endian declarations.
patches/coreboot-starlabs_2607/0002-mainboard-starlabs-lite_adl-add-generated-SPD-files.patch	Adds Lite ADL SPD data.
patches/coreboot-starlabs_2607/0003-soc-intel-lockdown-Allow-locking-down-SPI-and-LPC-in.patch	Enables deferred Intel lockdown.
patches/coreboot-starlabs_2607/0004-mainboard-starlabs-cezanne-enable-ftpm.patch	Enables Cezanne fTPM storage.
patches/coreboot-starlabs_2607/0005-soc-amd-noncar-add-tpm-log-region.patch	Adds AMD TPM log memory.
modules/coreboot	Pins Star Labs coreboot.
modules/starlabs-amd-binaries	Verifies external AMD inputs.
initrd/init	Loads USB input earlier.
initrd/etc/functions.sh	Detects nested /boot.
doc/starlabs.md	Documents AMD binary setup.
doc/BOARDS_AND_TESTERS.md	Registers the StarLite tester.
config/starlabs-amd-binaries.sha256	Pins AMD binary hashes.
config/linux-starlabs-common.config	Defines the shared kernel.
config/coreboot-starlabs_starfighter_rpl.config	Configures StarFighter RPL.
config/coreboot-starlabs_starfighter_mtl.config	Configures StarFighter MTL.
config/coreboot-starlabs_starbook_tgl.config	Configures StarBook TGL.
config/coreboot-starlabs_starbook_rpl.config	Configures StarBook RPL.
config/coreboot-starlabs_starbook_mtl.config	Configures StarBook MTL.
config/coreboot-starlabs_starbook_cezanne.config	Configures StarBook Cezanne.
config/coreboot-starlabs_starbook_adl.config	Configures StarBook ADL.
config/coreboot-starlabs_starbook_adl_n.config	Configures StarBook ADL-N.
config/coreboot-starlabs_qemu.config	Configures Star Labs QEMU.
config/coreboot-starlabs_lite_glkr.config	Configures Lite GLKR analysis.
config/coreboot-starlabs_lite_glk.config	Configures Lite GLK analysis.
config/coreboot-starlabs_lite_adl.config	Configures StarLite ADL.
config/coreboot-starlabs_labtop_kbl.config	Configures LabTop KBL analysis.
config/coreboot-starlabs_labtop_cml.config	Configures LabTop CML.
config/coreboot-starlabs_byte_twl.config	Configures Byte Twin Lake.
config/coreboot-starlabs_byte_cezanne.config	Configures Byte Cezanne.
config/coreboot-starlabs_byte_adl.config	Configures Byte ADL.
config/coreboot-starlabs_adl_horizon.config	Configures Horizon ADL.
boards/starlabs/common.config	Defines shared Heads options.
boards/starlabs/physical.config	Defines safe physical updates.
boards/starlabs/physical-intel.config	Adds Intel locking support.
boards/starlabs/compact.config	Defines compact builds.
boards/starlabs/compact-intel.config	Adds compact Intel locking.
boards/starlabs/compact-analysis-intel.config	Disables unsupported flashing.
boards/starlabs_starfighter_rpl/starlabs_starfighter_rpl.config	Registers StarFighter RPL.
boards/starlabs_starfighter_mtl/starlabs_starfighter_mtl.config	Registers StarFighter MTL.
boards/starlabs_starbook_tgl/starlabs_starbook_tgl.config	Registers StarBook TGL.
boards/starlabs_starbook_rpl/starlabs_starbook_rpl.config	Registers StarBook RPL.
boards/starlabs_starbook_mtl/starlabs_starbook_mtl.config	Registers StarBook MTL.
boards/starlabs_starbook_cezanne/starlabs_starbook_cezanne.config	Registers StarBook Cezanne.
boards/starlabs_starbook_adl/starlabs_starbook_adl.config	Registers StarBook ADL.
boards/starlabs_starbook_adl_n/starlabs_starbook_adl_n.config	Registers StarBook ADL-N.
boards/starlabs_qemu/starlabs_qemu.config	Registers the QEMU gate.
boards/starlabs_lite_glkr/starlabs_lite_glkr.config	Registers Lite GLKR analysis.
boards/starlabs_lite_glk/starlabs_lite_glk.config	Registers Lite GLK analysis.
boards/starlabs_lite_adl/starlabs_lite_adl.config	Registers StarLite Mk V.
boards/starlabs_labtop_kbl/starlabs_labtop_kbl.config	Registers LabTop KBL analysis.
boards/starlabs_labtop_cml/starlabs_labtop_cml.config	Registers LabTop CML.
boards/starlabs_byte_twl/starlabs_byte_twl.config	Registers Byte Twin Lake.
boards/starlabs_byte_cezanne/starlabs_byte_cezanne.config	Registers Byte Cezanne.
boards/starlabs_byte_adl/starlabs_byte_adl.config	Registers Byte ADL.
boards/starlabs_adl_horizon/starlabs_adl_horizon.config	Registers Horizon ADL.
.circleci/config.yml	Retains Lite ADL CI coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tlaurion]

@Sean-StarLabs please cherry-pick/own/modify 2bc7904 so its possible to see coreboot configs in oldconfig format, _defconfig there to represent runtime generated defconfigs as per your current branch status

[tlaurion]

Will try to allocate time for deeper review in next days. Thanks for this massive contribution, (silent) effective contributor!

[tlaurion]

@Sean-StarLabs any changes suggested to porting guide?

[Sean-StarLabs]

/review

[Sean-StarLabs]

@tlaurion I took 2bc7904eab2 as 32b45f78, preserving your authorship and sign-off, added mine, and corrected the Byte TWL fallback serial in both config forms. The oldconfigs and _defconfig files regenerate cleanly for the two build-checked profiles.

I do not have a concrete porting-guide change to suggest from this pass. The remaining unchecked items in the PR checklist require the corresponding hardware and ownership flows, so I have left them unchecked.

[Sean-StarLabs]

/review

[tlaurion]

@Sean-StarLabs all boards should be added to circleci, depending on the coreboot seeding board as per other boards depending on coreboot 25.09 under config as an example.

[tlaurion]

The remaining unchecked items in the PR checklist require the corresponding hardware and ownership flows, so I have left them unchecked.

@Sean-StarLabs let me know if you need any help