coreboot on the Vault

We recommend purchasing DRAM from Protectli at the time of purchase (or DRAM from our Hardware Compatibility list) so we can ensure that the memory works with the coreboot build.

TL;DR: If you would like to flash your BIOS to coreboot, we highly recommend using our script Flashli to do so. This drastically lowers the chances of accidently bricking your Protectli Vault. Please find more information on Flashli at this link.

coreboot is an open source project focused on the boot and BIOS process for initializing hardware (HW) and booting an operating system (OS). coreboot has roots in the Linux community and can be found on the internet at https://www.coreboot.org/.

coreboot describes itself as: "…an extended firmware platform that delivers a lightning fast and secure boot experience on modern computers and embedded systems." It is an open source alternative to legacy BIOS options with the following properties:

• • Fast Boot – Minimal image, removes legacy bloat

• • Open Source – The source code is available and can be built without any cost or license

• • Secure – Common backdoors of legacy BIOS can be disabled or not even included in the build

• • Support for modern HW and Intel CPUs

The coreboot philosophy is to do the absolute bare minimum to discover and initialize hardware (HW), then pass the control to another program called a "payload". The payload then takes care of user interfaces, drivers, policies, etc. Protectli has implemented coreboot with the SeaBIOS payload.

coreboot is available on the FW2B, FW4B, FW4C, FW6A/Br2/D/E series, as well as the Vault Pro VP2410, VP2420, VP4630, VP4650 and VP4670 as an alternative to traditional BIOS.

coreboot is based on legacy BIOS, please see the compatibility table below for software which has been tested with coreboot for full functionality

coreboot can be selected at the time of ordering. It can also be installed in the field. See instructions below for field installation.

Attention: If you wish to use coreboot, we highly recommend choosing coreboot at the time of purchase and allowing Protectli to flash and validate successful installation.  Flashing the BIOS is potentially problematic, as if anything goes wrong the entire unit needs to be sent to Protectli in order to be recovered.  Flashing is done at your own risk.  While we provide instructions on how to do so, if you choose to flash your Vault and it does not flash properly, then recovery by Protectli is not covered under Protectli's new product warranty.  It is important to note that even if you follow all the steps properly, there is still a chance that the flash does not work and the unit will need to be recovered by Protectli.

Protectli is committed to continuing the development of coreboot on each of our compatible platforms.  While coreboot images for the Vault may not be available with every minor coreboot project update, we will work diligently to ensure Vault coreboot updates are available to address any serious vulnerabilities.  We will also work to contribute our coreboot updates back into the project master.  Protectli contributions can be found at this link for version 4.9.0.1. Version 4.12.0.3 is now released and source code contributions will be available once they are approved by the coreboot community. Version 4.12.0.3 includes security enhancements for Intel Spectre-Meltdown vulnerabilities and has a built in MemTest that can be run from the boot menu.

coreboot source code repositories are available for inspection for the following vaults FW2B/FW4B (link) and FW6A/B/C here (link), this source code does not include pre-compiled components for specific hardware, referred to as “blobs”.

It takes a very long time to propagate coreboot “upstream” for approval by the coreboot approvers and publish the source code, so we are investigating alternate methods of providing source code to the community. We plan to provide a github repository for Protectli Vaults along with build instructions. Please have patience during this process as there are legal issues regarding some of the pre-compiled components for specific hardware, referred to as “blobs”. We need to make sure we follow the proper legal path before release.