Boot trust
The boot path can be checked from firmware through the operating system, rather than treated as a black box.
- Secure Boot
- Measured Boot
- BIOS Lock firmware write protection
- dTPM 2.0
StarBook Horizon
Firmware &
Security
Public, configurable firmware with signed Linux updates, physical privacy controls, and long-term support.
Open firmware
Public firmware, without the mystery.
For most people, the point is simple: public firmware, useful controls, and signed Linux updates. Developer links are still available if you want to audit or build it yourself.
Open, inspectable firmware
Horizon uses Star Labs coreboot with measured boot trust, signed updates, persistent UEFI settings, and model-specific firmware options.
Source links for developers
Horizon build configuration
The exact build settings used
for Horizon firmware.
Horizon board support
Model-specific coreboot files
for StarBook Horizon.
Firmware options source
The source for the configurable
options shown in firmware.
edk2 payload source
Secure Boot, TPM, Opal, and
signed capsule update support.
Security stack
Security, in plain English.
The important chain is straightforward: verified boot, protected firmware writes, storage encryption support, memory protection, and physical privacy controls.
Data protection
Encryption covers storage at rest and memory while the system is running or suspended.
- TCG Opal 2.0 disk encryption
- Running programs protected in memory
- Firmware storage encryption controls
Reduced attack surface
Privacy and device controls are handled in hardware and firmware, not left as operating-system promises.
- Intel ME disabled
- Configurable hardware device toggles
- Physical privacy controls
Update path
LVFS delivers the update; firmware checks the signature before anything is written.
- Signed UEFI capsule updates
- Star Labs capsule root of trust
- LVFS delivery for supported firmware
Configurable firmware
Real controls, exposed clearly.
Horizon’s firmware exposes the practical controls people actually ask for: performance tuning, privacy toggles, security state, battery care, and input behaviour.
Performance
Power profile, fan mode, memory speed, and
Intel Gaussian & Neural Accelerator
controls.
Security
BIOS Lock write protection, Total Memory
Encryption, Intel ME state, and Intel ME
state-change counter.
Privacy devices
Firmware-level webcam, microphone, WiFi, and
Bluetooth controls.
Battery care
Choose faster charging when you need it, or
gentler charging with 80% or 60% charge limits
to reduce heat and long-term wear. The embedded
controller stops charging when the target is
reached.
Keyboard
Keyboard backlight timeout and layout behaviour
options.
Virtualisation
Virtualisation controls for users running VMs,
containers, or security-focused workflows.
Power management
S0ix control, PCIe power management, and NVMe
power sequencing for users who want deeper
control over standby and device behaviour.
Linux compatibility
Install modern Linux. Get to work.
Use a distribution with Linux 6.2 or later and Horizon is designed to work without vendor driver hunting or laptop-specific patching.
Older distributions may work with a newer kernel, but Linux 6.2 or later is the clean baseline. Security-focused distributions should be validated against their own hardware support matrix before deployment.
Ubuntu
24.04 LTS or later
Debian
13 or later
Linux Mint
22 or later
Fedora
Current releases
Arch / Manjaro
Current rolling releases
openSUSE
Tumbleweed current
Firmware cadence
Monthly branches. Long-term updates.
Horizon firmware is maintained in public Star Labs coreboot and edk2 branches, updated monthly. That keeps the stack close to current upstream work, not left on launch-day code.
Monthly public branches
StarLabsLtd/coreboot and StarLabsLtd/edk2 use monthly branches such as 26.01, 26.02, 26.03, 26.04, and 26.05. Horizon is built from that same current firmware line.
Close to upstream
Regular branch updates pull in recent coreboot and edk2 work, so customers receive current firmware code instead of a frozen launch-day snapshot.
Five years is not a cliff
Five years is the formal update commitment. In practice, Star Labs still ships firmware for machines around nine years old where support is still useful and technically possible.
Still yours after that
If official updates ever stop, the firmware source remains available. You can build from source yourself, or have someone else audit, maintain, or adapt it for your machine.
Firmware FAQ
Straight answers.
Is Intel ME disabled?
Yes. Horizon ships with Intel ME disabled. The firmware also shows the current ME state and a change counter, so the setting is visible rather than hidden.
Can I use Secure Boot?
Yes, if your operating system supports it. Ubuntu, Fedora, and other distributions with Secure Boot support can use it. If your chosen distribution does not support Secure Boot, leave it disabled.
What does Measured Boot do?
Measured Boot records each boot stage into the TPM. Security tools can then compare that record with the expected boot path and flag unexpected changes.
How do signed firmware updates work?
LVFS delivers the update, but the firmware still has to trust it before flashing. The update is signed by Star Labs, checked before flashing, and rejected if it is unsigned or not authorised.
How often is firmware updated?
Star Labs publishes monthly public firmware branches on GitHub for coreboot and edk2. That keeps Horizon close to current upstream work, rather than waiting for occasional large update batches.
What happens after five years?
Five years is the formal promise, not a forced end-of-life. Star Labs still publishes firmware for machines around nine years old where it remains useful, and the source is available if you ever want to build or maintain it yourself.
What does BIOS Lock protect?
BIOS Lock is the user-facing name for low-level firmware write protection. It helps stop unauthorised software from rewriting system firmware directly, keeping updates on the signed and authorised update path.
What is Total Memory Encryption?
Total Memory Encryption protects data while it is in RAM, including running programs and suspended state. It helps protect a real-world risk: a laptop that is stolen while still powered on or suspended.
Can the fan be disabled?
Yes. Horizon includes firmware fan controls, including a disabled mode for silent workloads.
Can I tune charging for battery life?
Yes. Horizon exposes firmware options for charging speed and maximum charge level. Use faster charging when you need a quick top-up, or 80% / 60% limits and slower charging when battery longevity matters more. When the battery reaches the chosen target, the embedded controller stops charging and only resumes once it has dropped by roughly five percentage points: about 75% for the 80% limit, or about 55% for the 60% limit. That keeps the battery away from prolonged high charge without constantly topping it up.
Do I need laptop-specific Linux drivers?
No vendor driver package is required for normal use on modern Linux distributions. Use Linux 6.2 or later as the baseline.
Where is the source code?
The Star Labs coreboot and edk2 repositories are linked above, including the Horizon-specific mainboard variant and firmware configuration.
Configure Horizon with the firmware path you want.
Choose StarBook Horizon, review the full technical specification, or compare the broader configurable coreboot options used across supported Star Labs models.