CINXE.COM
coreboot for end users
<!DOCTYPE html> <html lang="en-US"> <head> <title>coreboot for end users</title> <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self' 'unsafe-inline' https://www.coreboot.org; font-src 'self' data: https://www.coreboot.org; script-src 'self' 'unsafe-inline' data: https://www.coreboot.org; img-src 'self' https://www.coreboot.org"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8; X-Content-Type-Options=nosniff; X-Frame-Options=SAMEORIGIN" /> <meta http-equiv="X-XSS-Protection" content="1; mode=block" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"> <link rel="stylesheet" href="css/style.css" type="text/css" media="screen" /> <link rel="shortcut icon" href="assets/images/favicon.ico" /> <script src="js/jquery-3.1.0.min.js"></script> <script src="js/jquery.js"></script> </head> <body> <div class="content-background" id="background-5"></div> <div class="content visible"> <p class="banner-wrapper"> <img src="assets/images/banner.svg" class="banner-subpage" alt="coreboot" /> </p> <div class="subpage"> <h1>End Users</h1> <div class="border-subpage"></div> <h2>Getting started</h2> <p> coreboot is a replacement for your BIOS / UEFI with a strong focus on boot speed, security and flexibility. It is designed to boot your operating system as fast as possible without any compromise to security, with no back doors, and without any cruft from the 80s. It was originally designed for large super-computers with thousands of nodes, but it will run on your desktop, headless internet server, laptop, tablet or your favorite IoT device. </p> <h2>Why should I use coreboot?</h2> <p> In general because it leads to freedom on machines. Most firmware written today is completely closed source and the code bases are growing. Years ago a computer needed 100kb of compiled code in order to run the southbridge, now around 8mb of code are shipped in modern hardware. </p> <h3>Open Source</h3> <p> coreboot is built on the principles of Open Source Software. Many of the engineers working on coreboot have also worked on the Linux kernel. Instead of keeping improvements to one system a secret from all other vendors, in coreboot, these improvements are shared across the board, providing end users with a much better, much more stable firmware. </p> <h3>Flexibility</h3> <p> The primary flexibility that coreboot offers is through the use of different payloads. We support legacy OS boot through SeaBIOS, network boot with an integrated iPXE ROM, or the latest UEFI payload. Customized payloads can be created using the BSD licensed libpayload toolkit. </p> <p> Also, with coreboot, you can do things like easily add your own boot splash screen in jpg format. You can boot so fast that there's not even time to show a splash screen. You can get a debug console showing your boot log over serial ports, USB, the SPI bus, or even using the PC speaker. Or you can boot quickly and just retrieve the entire boot log once your operating system is up and running. </p> <h3>Security</h3> <p> coreboot comes with a minimal Trusted Computing Base which reduces the general attack surface. It also supports a secure boot process called VBOOT2. It鈥檚 written in MISRA-C standard and provides other languages like Ada for formal verification of special properties. Also the use of platform features like IOMMU, flash protections and deactivated SMM mode increases the security as well. </p> <h3>Safety</h3> <p> coreboot engineers have worked on many safety critical software projects. The architecture of coreboot is designed to have an unbrickable update process. Updating firmware should be no more dangerous than installing your favorite app on your mobile phone. </p> <h3>Performance</h3> <p> coreboot is designed to boot quickly. For desktops and laptop machines, it can frequently boot to the start of the operating system in under a second. For servers, it can cut minutes off of the boot time. Some vendors have demonstrated a decrease in boot time by more than 70% when compared to the OEM BIOS. </p> <h2>How to get hardware with coreboot?</h2> <p> At the moment it's not so easy to get consumer hardware on the market. But there are vendors shipping coreboot right away with their hardware. </p> <h3>Consumer platforms</h3> <p> The easiest way to get coreboot is to purchase a system with coreboot pre-installed. You can get coreboot pre-installed on many systems out there. </p> <ul> <li> <a href="https://protectli.com">Protectli</a> is dedicated to providing reliable, cost-effective, and secure computer equipment with coreboot-based firmware tailored for their hardware. It comes with the <a href="https://doc.coreboot.org/distributions.html#dasharo">Dasharo</a> firmware, maintained by <a href="https://3mdeb.com/">3mdeb</a>. Protectli hardware has verified support for many popular operating systems such as Linux distributions, FreeBSD, and Windows. Support includes Debian, Ubuntu, OPNsense, pfSense, ProxMox VE, VMware ESXi, Windows 10 and 11, and many more. </li> <li> <a href="https://novacustom.com">NovaCustom</a> sells configurable laptops with <a href="https://dasharo.com/">Dasharo</a> coreboot based firmware on board, maintained by <a href="https://3mdeb.com/">3mdeb</a>. NovaCustom offers full GNU/Linux and Windows compatibility. NovaCustom ensures security updates via fwupd for five years and the firmware is equipped with important security features such as measured boot, verified boot, TPM integration and UEFI Secure Boot. </li> <li> The biggest deployment are Google's <a href="https://www.google.com/chromebook/">Chrome OS devices</a>. The <a href="https://on.google.com/hub/">OnHub</a> runs coreboot, as well as the <a href="https://pixel.google.com/">Pixel C tablet</a>. </li> <li> A UK-based supplier of pre-installed hardware is offered by <a href="http://minifree.org/">Minifree Ltd</a>, as the Libreboot distribution of coreboot. </li> <li> For hardware with the Libreboot distribution of coreboot installed, check out <a href="https://technoethical.com/laptops">Technoethical</a>. They are based in EU and US and they ship worldwide. </li> <li> <a href="https://puri.sm/">Purism</a> manufactures security focused laptops designed chip by chip to work with free/libre and open source software. Purism laptops are the only independently-made, brand new, high-performance laptops on the market specifically meant to pair recent technologies with <a href="https://puri.sm/coreboot/">coreboot</a> and a neutralized Intel Management Engine. </li> <li> <a href="https://starlabs.systems/">Star Labs</a> offers a range of laptops designed and built specifically for Linux that are available with coreboot firmware. They use Tianocore as the payload and include an NVRAM option to disable the Intel Management Engine. </li> <li> <a href="https://system76.com/">System76</a> manufactures Linux laptops, desktops, and servers. Some models are sold with <a href="https://github.com/system76/firmware-open">System76 Open Firmware</a>, an open source distribution of firmware coreboot, EDK2, and System76 firmware applications. </li> </ul> <h3>Embedded or business solutions</h3> <ul> <li><a href="https://www.xes-inc.com/embedded-technologies/coreboot-fsp-for-intel/">X-ES</a> sells PCI-E based solutions. </li> <li><a href="http://pcengines.ch/index.htm">PC-Engines</a> ships coreboot on their APU platforms. </li> <li><a href="https://www.pfsense.org/products/">Pfsense</a> is making use of coreboot. </li> <li><a href="https://raptorengineering.com/content/base/products.html">Raptor Engineering</a> builds complete free software based solutions like TALOS. </li> <li><a href="http://www.portwell.com/productnews/PCS-8277_pr.htm">Portwell</a> Another hardware vendor building coreboot based systems. </li> </ul> <h2>Community/Custom coreboot images</h2> <p>The coreboot community has strong supporters providing help with getting coreboot on to your system.</p> <ul> <li><a href="https://libreboot.org/">Libreboot</a>: a blob-free coreboot distribution. </li> <li><a href="https://dasharo.com/">Dasharo</a>: open-source based firmware distribution focusing on clean and simple code, long-term maintenance, transparent validation, privacy-respecting implementation, liberty for the owners, and trustworthiness for all. </li> <li><a href="https://mrchromebox.tech/">MrChromebox</a>: custom coreboot firmware and utilities for your Chromebook/Chromebox. </li> <li><a href="http://osresearch.net/">Heads firmware project</a>: a coreboot distribution with advanced security features using Linux as a payload. </li> <li><a href="https://github.com/merge/skulls">Skulls</a>: easy to install, easy to use coreboot images for Thinkpad laptops. </li> <li><a href="https://github.com/system76/firmware-open">System76 Open Firmware</a>: an open source distribution of firmware utilizing coreboot, EDK2, and System76 firmware applications. </li> </ul> </div> <p class="bborder"><a href="index.html">Go back to the main page</a></p> </div> </body> </html>