coreboot

coreboot is grounded in the principles of Open Source software, where many of the engineers have also contributed to the Linux kernel which influences the firmware’s technical approach.

Rather than keeping improvements proprietary or in closed codebases like traditional vendors, coreboot fosters a transparent and collaborative environment where advancements are shared across the community. This approach results in more robust, stable firmware for end users.

coreboot also draws on best practices from other prominent open-source projects, including Kconfig, the Linux kernel coding style, Git for version control, and Gerrit for code reviews.

coreboot has the options to utilize legacy operating systems through the use of SeaBIOS or modern operating systems by using UEFI Payloads. coreboot can also allow network booting with the use of IPXE ROM integration. Developers can utilize the BSD-licensed toolkits to create custom solutions. This flexibility is extended by the control given to update and revise features beyond what is provided by traditional BIOS vendors like AMI, with ongoing efforts from Protectli to identify and implement additional capabilities.

The boot process provides extensive configurability, allowing users to add custom splash screens in formats like JPEG, skip splash screens for quick boots, and access detailed boot logs across multiple interfaces even after the operating system has started running, providing flexible diagnostic and monitoring approaches.

Implementing a minimal Trusted Computing Base (TCB), coreboot reduces the overall attack surface which enhances security. By stripping out unnecessary services and custom-tailoring firmware for each platform, coreboot ensures a minimal, auditable codebase. Once initialization is complete, over 99% of the code is removed from memory, leaving fewer potential attack vectors. On blob-free platforms, it provides fully auditable boot firmware.

As coreboot allows the community to contribute to mitigating and resolving security flaws. This transparency, combined with the minimal codebase, helps identify and mitigate security vulnerabilities more effectively than traditional proprietary firmware and makes Protectli Vaults are more resilient against threats.

Platform security features including IOMMU, custom signing keys and TEE are supported. Flash protections such as BIOS and SMM lock can increases security.

The architecture of coreboot is designed with a focus on safety and reliability as a result firmware updates are lower-risk.

Recovery Mode is based on multiple, independently updatable firmware copies to safeguard against failure.

The integrity of coreboot’s stages and binaries can be easily verified, providing confidence that updates are secure and rollback options are available in case of issues, minimizing the risk of system corruption.

Many coreboot engineers have a background in safety-critical software, prioritizing making the update process both resilient and transparent, ensuring reliable firmware management without compromising system stability.

coreboot is optimized for fast boot times, performing only essential hardware initialization before transferring control to the payload. Frequently achieving boot times of under a second for desktops and laptops, and with vendors reporting over a 70% reduction in boot time compared to the OEM BIOS.

The design philosophy behind coreboot is minimalism—it performs only the essential tasks needed to initialize hardware and quickly hand off control to the operating system.

Code quality is maintained through mandatory peer review, and are subject to rigorous build and run testing.

Additionally, test frameworks like REACTS and LAVA enable automated testing, supporting reliability and validation on your device.