Add coreboot firmware settings UI

.circleci/config.yml

@@ -65,6 +65,19 @@ commands:
 
 jobs:
 
+  cfr_settings_tests:
+    docker:
+      # cimg/base:2026.08 provides Bash and ShellCheck for this host-only job.
+      - image: cimg/base@sha256:e8f07526f593ac5dee29362b7f98c6fec94c412722d6bbece731e4cc885abccb
+    steps:
+      - checkout
+      - run:
+          name: CFR settings host fixture
+          command: ./tests/cfr/test_cfr_settings.sh
+      - run:
+          name: CFR settings shellcheck
+          command: shellcheck initrd/bin/cfr-settings.sh tests/cfr/test_cfr_settings.sh
+
   # ═══════════════════════════════════════════════════════════════════════════
   # Glossary (see doc/circleci.md for full cache model)
   # ═══════════════════════════════════════════════════════════════════════════
@@ -415,6 +428,7 @@ workflows:
   build_and_test:
     max_auto_reruns: 3
     jobs:
+      - cfr_settings_tests
       - create_hashes:
           name: create_hashes [cache keys]
 

Makefile

@@ -808,8 +808,13 @@ $(COREBOOT_UTIL_DIR)/inteltool/inteltool \
 : $(build)/$(coreboot_base_dir)/.canary musl-cross-make
 	+$(call do,MAKE,$(notdir $@),\
 		$(MAKE) -C "$(dir $@)" $(CROSS_TOOLS) \
+		$(if $(COREBOOT_UTIL_CFLAGS),CFLAGS="$(COREBOOT_UTIL_CFLAGS)") \
 	)
 
+$(COREBOOT_UTIL_DIR)/cbmem/cbmem: COREBOOT_UTIL_CFLAGS := \
+	-O2 -D_GNU_SOURCE -include endian.h -Wall -Wextra \
+	-Wmissing-prototypes -Wshadow -Werror -std=gnu2x
+
 # superio depends on zlib and pciutils
 $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
 	$(build)/$(zlib_dir)/.build \
@@ -877,11 +882,20 @@ endif
 # --- TOOLS.CPIO ---
 
 # tools.cpio is built from all binaries, libraries, and config staged in initrd_tools_dir
+initrd_feature_markers :=
+ifeq ($(CONFIG_HEADS_CFR),y)
+initrd_feature_markers += $(initrd_tools_dir)/etc/heads-cfr-enabled
+$(initrd_tools_dir)/etc/heads-cfr-enabled: $(CONFIG)
+	@mkdir -p "$(dir $@)"
+	@printf 'enabled\n' > "$@"
+endif
+
 $(build)/$(initrd_dir)/tools.cpio: \
-	$(initrd_bins) \
-	$(initrd_libs) \
-	$(initrd_tools_dir)/etc/config \
-	FORCE
+		$(initrd_bins) \
+		$(initrd_libs) \
+		$(initrd_tools_dir)/etc/config \
+		$(initrd_feature_markers) \
+		FORCE
 	$(call do-cpio,$@,$(initrd_tools_dir))
 	@$(RM) -rf "$(initrd_tools_dir)"
 
@@ -909,7 +923,6 @@ $(initrd_tools_dir)/etc/config: $(CONFIG)
 		echo export CONFIG_BRAND_NAME=$(BRAND_NAME) \
 		>> $@ ; \
 	)
-
 # --- BOARD.CPIO ---
 
 # board.cpio is built from the board's initrd/ directory and contains 

doc/cfr.md

@@ -0,0 +1,57 @@
+# Coreboot Firmware Settings
+
+Heads can optionally show the standard Linux firmware-attributes interface
+published by the coreboot CFR driver. The feature is disabled unless a board
+sets `CONFIG_HEADS_CFR=y` in its board configuration. Its build-generated
+`/etc/heads-cfr-enabled` marker is immutable at runtime, so `config.user`
+cannot enable or disable the feature.
+
+The UI reads only:
+
+```text
+/sys/class/firmware-attributes/coreboot-cfr/attributes
+```
+
+It does not parse the coreboot table, access EFI variables or SMMSTORE, or
+invoke an SMI. A board must therefore provide a kernel and firmware stack that
+implements this standard interface before enabling the feature.
+
+The current Heads Linux module supports the historical kernel tarballs,
+including 6.1.8. A CFR board must not pretend that the v13 CFR driver works on
+6.1.8. For an interim CFR board, set both variables below to a git repository
+and an exact commit:
+
+```make
+export CONFIG_HEADS_CFR=y
+export CONFIG_LINUX_REPO=https://github.com/REPLACE/linux.git
+export CONFIG_LINUX_COMMIT=REPLACE_WITH_CFR_V13_COMMIT
+export CONFIG_COREBOOT_REPO=https://github.com/REPLACE/coreboot.git
+export CONFIG_COREBOOT_COMMIT=REPLACE_WITH_CFR_SERVICE_COMMIT
+```
+
+The generic modules fetch the exact revisions, check them out, and use the
+board's normal configuration. Existing boards that only set
+`CONFIG_LINUX_VERSION` and `CONFIG_COREBOOT_VERSION` continue to use their
+verified sources unchanged.
+
+An integration board may set `CONFIG_LINUX_CONFIG_FRAGMENT` to append a small
+Kconfig fragment before `olddefconfig`, and
+`CONFIG_COREBOOT_TOOLCHAIN_VERSION` to reuse a compatible, already-defined
+coreboot toolchain. Existing boards that do not set these variables are
+unchanged.
+
+The settings menu is available under Options only when both the immutable
+feature marker and the firmware-attributes class/device exist. Missing,
+malformed, disappearing, or unwritable attributes are handled as unavailable
+or read-only. Every selected write requires an explicit confirmation showing
+the display name, current value, requested value, and pending-reboot status;
+cancelling that confirmation does not write.
+
+The Linux driver currently exposes writability through the `current_value` mode
+and does not publish a `flags` attribute. The UI works with no `flags` files.
+It tolerates an optional flags file for forward compatibility, hiding
+`inactive`/`suppressed` entries and treating `readonly` as non-writable, but
+that file is not part of the required ABI. Enumeration values use the standard
+semicolon delimiter; labels containing spaces are preserved. A literal
+semicolon cannot be represented unambiguously by that sysfs ABI and is rejected
+rather than guessed.

doc/index.md

@@ -9,6 +9,7 @@ Quick reference: read the relevant doc when working on a topic.
 | `build-artifacts.md` | ROM filenames, update-package zip layout, LVFS conventions |
 | `build-freshness.md` | Why rebuilds produce stale artifacts and how to force a full rebuild |
 | `circleci.md` | CI pipeline: job dependency graph, cache layers, workspace persistence |
+| `cfr.md` | Optional coreboot firmware-settings UI and CFR Linux source selection |
 | `docker.md` | Docker-based build environment with pinned, reproducible images |
 | `modules.md` | Module system: toolchain and bin modules, inclusion rules, sentinel chain |
 | `patches.md` | Creating and maintaining source patches for upstream packages |