boards: Add Star Labs Heads targets - #2164
Conversation
|
~Addresses StarLabsLtd/firmware#104. Thanks for your contribution @Sean-StarLabs Will try to review toroughly in next coming days but plate quite full right now. Looks good at first glance! Meanwhile, would be nice if you added the checklist that can be found at https://github.com/linuxboot/heads-wiki/edit/master/Development/Porting.md and suggest changes there for things you see unfit. |
|
Also think/suggest changes you would want to see at https://osresearch.net/Vendors/ (edit this page on github link at bottom of the page) As well as documenting the same way under https://osresearch.net/Flashing-guides I will collaborate in those PR as we go! |
|
@Sean-StarLabs Love your work here, LGTM. Checklist needs completion, of course. Also seen as part of work addressing #2159 that you pushed fixes coreboot side. Tracking with great interest. You might want to take a look at #2165 and linuxboot/heads-wiki#221 Do you have a timeline for testing? |
|
@Sean-StarLabs you might want to add your GPIO work under label https://review.coreboot.org/q/topic:%22intel_gpio_lock%22 |
Meanwhile, you can add related unmerged patches needed for your port to be applied to coreboot fork (as you did under patches/coreboot-starlabs_2607) for TPM GPIO reset vuln, if merging upstream stalls and prevents you from going forward (or point modules/coreboot to commits confirmed working on your side). |
|
@Sean-StarLabs You saw https://app.circleci.com/pipelines/github/linuxboot/heads/1394/workflows/0d81f5d0-83fb-4af2-9df5-56797eeb7fb8/jobs/52499 ? |
daaa439 to
faa0a50
Compare
|
@Sean-StarLabs anything needed on my side? |
|
On 67cace7 Unless needed (msi platforms needed to have a punched hole to support recovery from proprietary tools), instead of using flashprog and read the whole spi to get cbfs content: it is advised to reduce cbfs region within the 16mb memory limit after which cbfs (flashtools/cbfs.c) would need some love to read as expected cbfs region> 16mb |
Otherwise issue to fix to keep >16mb cbfs region is osresearch/flashtools#10 Didn't prioritize this since msi platform is community port with few known users. If choosing to keep >16mb or not fix cbfs.c from pointed issue, you probably observed longer boot time since flashprog is slow at backup rom to extract cbfs from early cbfs-init.sh, which is a bug to be fixed, not to be used extensively in new boards:this is why I suggest reducing cbfs size in coreboot config. 3mdeb/dasharo+heads got dropped upstream for the msi platforms, workstations +dGPU didn't receive enough love to facilite proper UX with either oprom measure+extraction (borrowing seabios code), requiring both iGPU + dGPU so dual monitor setup as workaround, to say the least, subefficient. Are you on matrix? Dm me if you will :) Hope you enabled debug logging in local builds, so you can get the Debug + TRACE_FUNC output to get a quick grasp of what is happening under the hood and ease your porting process. Should not be hard since other platforms of same family exist, outside of coreboot upstream required fixes which you seem to have already grasped (either coreboot module pinned commit or patches/coreboot-* fork applied incrementally in alphanumeric order). I see great ROI here, please contact. |
67cace7 to
15d04fd
Compare
|
/review |
|
/review |
There was a problem hiding this comment.
Pull request overview
Adds broad Star Labs platform support using the pinned vendor coreboot fork, shared profiles, firmware patches, and runtime boot improvements.
Changes:
- Adds 18 Star Labs board targets and shared compact/physical profiles.
- Adds AMD binary verification and coreboot patches for fTPM, TPM logs, SPD, and Intel locking.
- Loads USB keyboards earlier and supports root filesystems containing
/boot.
Reviewed changes
Copilot reviewed 61 out of 64 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
patches/coreboot-starlabs_2607/0001-util-cbmem-include-endian.h.patch |
Fixes cbmem endian declarations. |
patches/coreboot-starlabs_2607/0002-mainboard-starlabs-lite_adl-add-generated-SPD-files.patch |
Adds Lite ADL SPD data. |
patches/coreboot-starlabs_2607/0003-soc-intel-lockdown-Allow-locking-down-SPI-and-LPC-in.patch |
Enables deferred Intel lockdown. |
patches/coreboot-starlabs_2607/0004-mainboard-starlabs-cezanne-enable-ftpm.patch |
Enables Cezanne fTPM storage. |
patches/coreboot-starlabs_2607/0005-soc-amd-noncar-add-tpm-log-region.patch |
Adds AMD TPM log memory. |
modules/coreboot |
Pins Star Labs coreboot. |
modules/starlabs-amd-binaries |
Verifies external AMD inputs. |
initrd/init |
Loads USB input earlier. |
initrd/etc/functions.sh |
Detects nested /boot. |
doc/starlabs.md |
Documents AMD binary setup. |
doc/BOARDS_AND_TESTERS.md |
Registers the StarLite tester. |
config/starlabs-amd-binaries.sha256 |
Pins AMD binary hashes. |
config/linux-starlabs-common.config |
Defines the shared kernel. |
config/coreboot-starlabs_starfighter_rpl.config |
Configures StarFighter RPL. |
config/coreboot-starlabs_starfighter_mtl.config |
Configures StarFighter MTL. |
config/coreboot-starlabs_starbook_tgl.config |
Configures StarBook TGL. |
config/coreboot-starlabs_starbook_rpl.config |
Configures StarBook RPL. |
config/coreboot-starlabs_starbook_mtl.config |
Configures StarBook MTL. |
config/coreboot-starlabs_starbook_cezanne.config |
Configures StarBook Cezanne. |
config/coreboot-starlabs_starbook_adl.config |
Configures StarBook ADL. |
config/coreboot-starlabs_starbook_adl_n.config |
Configures StarBook ADL-N. |
config/coreboot-starlabs_qemu.config |
Configures Star Labs QEMU. |
config/coreboot-starlabs_lite_glkr.config |
Configures Lite GLKR analysis. |
config/coreboot-starlabs_lite_glk.config |
Configures Lite GLK analysis. |
config/coreboot-starlabs_lite_adl.config |
Configures StarLite ADL. |
config/coreboot-starlabs_labtop_kbl.config |
Configures LabTop KBL analysis. |
config/coreboot-starlabs_labtop_cml.config |
Configures LabTop CML. |
config/coreboot-starlabs_byte_twl.config |
Configures Byte Twin Lake. |
config/coreboot-starlabs_byte_cezanne.config |
Configures Byte Cezanne. |
config/coreboot-starlabs_byte_adl.config |
Configures Byte ADL. |
config/coreboot-starlabs_adl_horizon.config |
Configures Horizon ADL. |
boards/starlabs/common.config |
Defines shared Heads options. |
boards/starlabs/physical.config |
Defines safe physical updates. |
boards/starlabs/physical-intel.config |
Adds Intel locking support. |
boards/starlabs/compact.config |
Defines compact builds. |
boards/starlabs/compact-intel.config |
Adds compact Intel locking. |
boards/starlabs/compact-analysis-intel.config |
Disables unsupported flashing. |
boards/starlabs_starfighter_rpl/starlabs_starfighter_rpl.config |
Registers StarFighter RPL. |
boards/starlabs_starfighter_mtl/starlabs_starfighter_mtl.config |
Registers StarFighter MTL. |
boards/starlabs_starbook_tgl/starlabs_starbook_tgl.config |
Registers StarBook TGL. |
boards/starlabs_starbook_rpl/starlabs_starbook_rpl.config |
Registers StarBook RPL. |
boards/starlabs_starbook_mtl/starlabs_starbook_mtl.config |
Registers StarBook MTL. |
boards/starlabs_starbook_cezanne/starlabs_starbook_cezanne.config |
Registers StarBook Cezanne. |
boards/starlabs_starbook_adl/starlabs_starbook_adl.config |
Registers StarBook ADL. |
boards/starlabs_starbook_adl_n/starlabs_starbook_adl_n.config |
Registers StarBook ADL-N. |
boards/starlabs_qemu/starlabs_qemu.config |
Registers the QEMU gate. |
boards/starlabs_lite_glkr/starlabs_lite_glkr.config |
Registers Lite GLKR analysis. |
boards/starlabs_lite_glk/starlabs_lite_glk.config |
Registers Lite GLK analysis. |
boards/starlabs_lite_adl/starlabs_lite_adl.config |
Registers StarLite Mk V. |
boards/starlabs_labtop_kbl/starlabs_labtop_kbl.config |
Registers LabTop KBL analysis. |
boards/starlabs_labtop_cml/starlabs_labtop_cml.config |
Registers LabTop CML. |
boards/starlabs_byte_twl/starlabs_byte_twl.config |
Registers Byte Twin Lake. |
boards/starlabs_byte_cezanne/starlabs_byte_cezanne.config |
Registers Byte Cezanne. |
boards/starlabs_byte_adl/starlabs_byte_adl.config |
Registers Byte ADL. |
boards/starlabs_adl_horizon/starlabs_adl_horizon.config |
Registers Horizon ADL. |
.circleci/config.yml |
Retains Lite ADL CI coverage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@Sean-StarLabs please cherry-pick/own/modify 2bc7904 so its possible to see coreboot configs in oldconfig format, _defconfig there to represent runtime generated defconfigs as per your current branch status |
|
Will try to allocate time for deeper review in next days. Thanks for this massive contribution, (silent) effective contributor! |
|
@Sean-StarLabs any changes suggested to porting guide? |
a80d441 to
32b45f7
Compare
|
/review |
|
@tlaurion I took I do not have a concrete porting-guide change to suggest from this pass. The remaining unchecked items in the PR checklist require the corresponding hardware and ownership flows, so I have left them unchecked. |
32b45f7 to
d775f24
Compare
|
/review |
d775f24 to
e496943
Compare
Pin release 26.07.1 and apply the build, CSE policy and SMM lockdown prerequisites. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Add the shared Linux, update and Intel settings used by physical Star Labs boards. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
USB-only systems can enter the invalid-clock dialog from key-init.sh before enable_usb_keyboard() runs. With no PS/2 keyboard available, the user cannot continue past the prompt. Initialize configured USB keyboard support immediately after loading the runtime configuration so it is available before key and TPM initialization can display interactive UI. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Some Linux installations keep /boot on the root filesystem instead of using a dedicated partition. Boot-device discovery currently rejects these filesystems because grub is not at the mounted partition root. Keep the selected filesystem mounted at /boot_root and expose either its root or nested boot directory at /boot. Route mount and remount operations through shared helpers so signing and re-ownership update the underlying filesystem while preserving the read-only default. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
The deferred SMM lockdown path leaves protected ranges mutable until Heads finishes its update flow. Restore whole-ROM write protection before locking the controller, report failures to the payload, and retain the native post-PCI handoff when FSP would otherwise lock SPI early. Also honor the configured ME default when no persisted CFR value exists. Tested on StarLite Mk V. Heads reached the payload with HSFSTS 0x6000, lock_chip triggered the finalize SMI, SMM enabled FPR0 for 0x00000000-0x00ffffff, and Fedora booted successfully. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Store generated oldconfig files as the active coreboot configs and retain their source defconfigs alongside them with the `_defconfig` suffix. This makes both the resolved configuration and its concise input available for review. Signed-off-by: Thierry Laurion <insurgo@riseup.net> Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Coreboot builds the goswid generator from source when SBOM support is enabled. Heads' pinned build environment does not provide Go, so clean builds of the imported configurations fail before producing a ROM. Heads does not consume the coreboot SBOM. Disable it in the affected Star Labs oldconfigs and regenerate their defconfig backups. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Git-backed modules currently use an empty .patched sentinel, so editing or adding a patch can leave an existing source tree and build outputs unchanged. Record a digest of the ordered patch set. On change, reset and clean the source tree, reapply the patches, and refresh .canary so dependent targets rebuild. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
5a0f41e to
090b87a
Compare
|
@tlaurion All 15 Star Labs targets are now in CircleCI. Lite ADL remains the coreboot seed job; the other 14 targets depend on it and reuse its workspace. The deferred-lock path was also validated on Lite ADL: Heads reached the payload with HSFSTS 0x6000, |
|
/review |
|
Post-lock verification is now complete on the Lite ADL at 192.168.1.58. From Fedora, |
|
Pre-lock verification is complete. In the Heads recovery shell, |
Add Heads support for the Star Labs target set, continuing the original StarLite Mk V PR as a patch-per-board series.
Scope
_defconfigfiles alongside.starlabs_qemustarlabs_starbook_mtlstarlabs_starbook_adlstarlabs_starbook_adl_nstarlabs_starbook_rplstarlabs_starbook_tglstarlabs_labtop_cmlstarlabs_adl_horizonstarlabs_byte_adlstarlabs_byte_twlstarlabs_byte_cezannestarlabs_starbook_cezannestarlabs_starfighter_mtlstarlabs_starfighter_rpl/bootis a directory on the root filesystem rather than a separate partition.flashprogremains scoped to updating theCOREBOOTregion.Initial installation and recovery require board-appropriate external recovery access. For StarLite Mk V, the current recovery reference remains:
https://support.starlabs.systems/hc/star-labs/articles/starlite-mk-v-installingrecovering-firmware-with-external-programmer
The related vendor, porting and flashing documentation is under review in linuxboot/heads-wiki#222. The flashing page remains unpublished until this port is merged and hardware-tested.
Hardware validation
/bootdirectory is on the ext4 root filesystem; Wi-Fi came up after boot.0x6000.lock_chiptriggered the finalize SMI, SMM enabled FPR0 for0x00000000-0x00ffffffand locked SMM code checking, and Fedora booted successfully.lock_chip,flashprog -p internalreported no PR0 protection; only the expected descriptor FREG0 read-only and ME FREG2 locked restrictions were present.flashrom -p internalreported PR00x00000000-0x00ffffffread-only and the SPI configuration locked down.Lite ADL porting checklist
/booton the root filesystem and boots successfully.lock_chip,flashprog -p internalreports no PR0 protection; only descriptor FREG0 read-only and ME FREG2 locked.lock_chipapplies PR0.flashrom -p internalreports PR0 read-only and the SPI configuration locked afterwards.