WD Blue WD5000LPVX - controller - Winbond 25X20CLVIG-0182

Unified Extensible Firmware Interface (UEFI, as an acronym) is a

specification A specification often refers to a set of documented requirements to be satisfied by a material, design, product, or service. A specification is often a type of technical standard. There are different types of technical or engineering specificati ...

for the firmware

architecture Architecture is the art and technique of designing and building, as distinguished from the skills associated with construction. It is both the process and the product of sketching, conceiving, planning, designing, and construction, constructi ...

of a

computing platform A computing platform, digital platform, or software platform is the infrastructure on which software is executed. While the individual components of a computing platform may be obfuscated under layers of abstraction, the ''summation of the requi ...

. When a computer is powered on, the UEFI implementation is typically the first that runs, before starting the

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

. Examples include

AMI Aptio American Megatrends Inc., doing business as AMI, is an international hardware and software company, specializing in PC hardware and firmware. The company was founded in 1985 by Pat Sarma and Subramonian Shankar. It is headquartered in Building ...

, Phoenix SecureCore,

TianoCore EDK II TianoCore EDK II (formerly Tiano) is the reference implementation of UEFI by Intel. EDK is the abbreviation for EFI Development Kit and is developed by the TianoCore community. TianoCore EDK II is the de facto standard generic UEFI services imple ...

, and

InsydeH2O Insyde Software () is a company that specializes in UEFI system firmware and engineering support services, primarily for OEM and Original design manufacturer, ODM computer and component device manufacturers. They are listed on the Gre Tai Market ...

. UEFI replaces the

BIOS In computing, BIOS (, ; Basic Input/Output System, also known as the System BIOS, ROM BIOS, BIOS ROM or PC BIOS) is a type of firmware used to provide runtime services for operating systems and programs and to perform hardware initialization d ...

that was present in the

boot ROM Boot ROM is a piece of read-only memory (ROM) that is used for booting a computer system. It contains instructions that are run after the CPU is reset to the reset vector, and it typically loads a bootloader. There are two types of boot ROM: ...

of all

personal computers A personal computer, commonly referred to as PC or computer, is a computer designed for individual use. It is typically used for tasks such as Word processor, word processing, web browser, internet browsing, email, multimedia playback, and PC ...

that are

IBM PC compatible An IBM PC compatible is any personal computer that is hardware- and software-compatible with the IBM Personal Computer (IBM PC) and its subsequent models. Like the original IBM PC, an IBM PC–compatible computer uses an x86-based central p ...

, although it can provide

backwards compatibility In telecommunications and computing, backward compatibility (or backwards compatibility) is a property of an operating system, software, real-world product, or technology that allows for interoperability with an older legacy system, or with Input ...

with the BIOS using CSM booting. Unlike its predecessor, BIOS, which is a de facto standard originally created by

IBM International Business Machines Corporation (using the trademark IBM), nicknamed Big Blue, is an American Multinational corporation, multinational technology company headquartered in Armonk, New York, and present in over 175 countries. It is ...

as proprietary software, UEFI is an open standard maintained by an industry

consortium A consortium () is an association of two or more individuals, companies, organizations, or governments (or any combination of these entities) with the objective of participating in a common activity or pooling their resources for achieving a ...

. Like BIOS, most UEFI implementations are proprietary.

Intel Intel Corporation is an American multinational corporation and technology company headquartered in Santa Clara, California, and Delaware General Corporation Law, incorporated in Delaware. Intel designs, manufactures, and sells computer compo ...

developed the original ''Extensible Firmware Interface'' (''EFI'') specification. The last Intel version of EFI was 1.10 released in 2005. Subsequent versions have been developed as UEFI by the

UEFI Forum UEFI Forum, Inc. is an Business alliance, alliance between technology companies to coordinate the development of the UEFI specifications. The board of directors includes representatives from twelve ''promoter'' companies: Advanced Micro Devices, ...

. UEFI is independent of platform and programming language, but C is used for the reference implementation TianoCore EDKII.

History

The original motivation for EFI came during early development of the first Intel–HP

Itanium Itanium (; ) is a discontinued family of 64-bit computing, 64-bit Intel microprocessors that implement the Intel Itanium architecture (formerly called IA-64). The Itanium architecture originated at Hewlett-Packard (HP), and was later jointly dev ...

systems in the mid-1990s.

limitations (such as 16-bit

real mode Real mode, also called real address mode, is an operating mode of all x86-compatible CPUs. The mode gets its name from the fact that addresses in real mode always correspond to real locations in memory. Real mode is characterized by a 20- bit s ...

, 1 MB addressable memory space,

assembly language In computing, assembly language (alternatively assembler language or symbolic machine code), often referred to simply as assembly and commonly abbreviated as ASM or asm, is any low-level programming language with a very strong correspondence bet ...

programming, and

PC AT The IBM Personal Computer AT (model 5170, abbreviated as IBM AT or PC/AT) was released in 1984 as the fourth model in the IBM Personal Computer line, following the IBM PC/XT and its IBM Portable PC variant. It was designed around the Intel 802 ...

hardware) had become too restrictive for the larger server platforms Itanium was targeting. The effort to address these concerns began in 1998 and was initially called ''Intel Boot Initiative''. It was later renamed to ''Extensible Firmware Interface'' (EFI). The first

open source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use and view the source code, design documents, or content of the product. The open source model is a decentrali ...

UEFI implementation, Tiano, was released by Intel in 2004. Tiano has since then been superseded by EDK and EDK II and is now maintained by the TianoCore community. In July 2005, Intel ceased its development of the EFI specification at version 1.10, and contributed it to the

Unified EFI Forum UEFI Forum, Inc. is an alliance between technology companies to coordinate the development of the UEFI specifications. The board of directors includes representatives from twelve ''promoter'' companies: AMD, American Megatrends, ARM, Apple, Del ...

, which has developed the specification as the ''Unified Extensible Firmware Interface'' (UEFI). The original EFI specification remains owned by Intel, which exclusively provides licenses for EFI-based products, but the UEFI specification is owned by the UEFI Forum. Version 2.0 of the UEFI specification was released on 31 January 2006. It added

cryptography Cryptography, or cryptology (from "hidden, secret"; and ''graphein'', "to write", or ''-logy, -logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of Adversary (cryptography), ...

and security. Version 2.1 of the UEFI specification was released on 7 January 2007. It added network authentication and the

user interface In the industrial design field of human–computer interaction, a user interface (UI) is the space where interactions between humans and machines occur. The goal of this interaction is to allow effective operation and control of the machine fro ...

architecture ('Human Interface Infrastructure' in UEFI). In October 2018, Arm announce
Arm ServerReady
a compliance certification program for landing the generic off-the-shelf operating systems and

hypervisor A hypervisor, also known as a virtual machine monitor (VMM) or virtualizer, is a type of computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called ...

s on Arm-based servers. The program requires the system firmware to comply with Server Base Boot Requirements (SBBR). SBBR requires UEFI,

ACPI Advanced Configuration and Power Interface (ACPI) is an open standard that operating systems can use to discover and configure computer hardware components, to perform power management (e.g. putting unused hardware components to sleep), auto con ...

and

SMBIOS In computing, the System Management BIOS (SMBIOS) specification defines data structures (and access methods) that can be used to read management information produced by the BIOS of a computer. This eliminates the need for the operating system to ...

compliance. In October 2020, Arm announced the extension of the program to the

edge Edge or EDGE may refer to: Technology Computing * Edge computing, a network load-balancing system * Edge device, an entry point to a computer network * Adobe Edge, a graphical development application * Microsoft Edge, a web browser developed by ...

and IoT market. The new program name i
Arm SystemReady
Arm SystemReady defined the Base Boot Requirements
BBR
specification that currently provides three recipes, two of which are related to UEFI: 1) SBBR: which requires UEFI, ACPI and SMBIOS compliance suitable for enterprise level operating environments such as Windows, Red Hat Enterprise Linux, and VMware ESXi; and 2) EBBR: which requires compliance to a set of UEFI interfaces as defined in the Embedded Base Boot Requirements
EBBR
suitable for embedded environments such as Yocto. Many Linux and BSD distros can support both recipes. In December 2018,

Microsoft Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...

announced Project Mu, a fork of TianoCore EDK II used in

Microsoft Surface Microsoft Surface is a family of touchscreen-based personal computer, tablet, and interactive whiteboard hardware products designed and developed by Microsoft. The majority of them run the Windows operating system and use Intel processors. ...

and

Hyper-V Hyper-V is a native hypervisor developed by Microsoft; it can create virtual machines on x86-64 systems running Windows. It is included in Pro and Enterprise editions of Windows (since Windows 8) as an optional feature to be manually enabled. A ...

products. The project promotes the idea of

firmware as a service TianoCore EDK II (formerly Tiano) is the reference implementation of UEFI by Intel. EDK is the abbreviation for EFI Development Kit and is developed by the TianoCore community. TianoCore EDK II is the de facto standard generic UEFI services imple ...

. The latest UEFI specification, version 2.11, was published in December 2024.

Advantages

The interface defined by the EFI specification includes data tables that contain platform information, and boot and runtime services that are available to the OS loader and OS. UEFI firmware provides several technical advantages over a BIOS: * Ability to boot a disk containing large partitions (over 2 TB) with a

GUID Partition Table The GUID Partition Table (GPT) is a standard for the layout of partition tables of a physical computer storage device, such as a hard disk drive or solid-state drive. It is part of the Unified Extensible Firmware Interface (UEFI) standard. It ha ...

(GPT) * Flexible pre-OS environment, including network capability, GUI, multi language * 32-bit (for example

IA-32 IA-32 (short for "Intel Architecture, 32-bit", commonly called ''i386'') is the 32-bit version of the x86 instruction set architecture, designed by Intel and first implemented in the i386, 80386 microprocessor in 1985. IA-32 is the first incarn ...

ARM32 ARM (stylised in lowercase as arm, formerly an acronym for Advanced RISC Machines and originally Acorn RISC Machine) is a family of RISC instruction set architectures (ISAs) for computer processors. Arm Holdings develops the ISAs and lice ...

) or 64-bit (for example

x64 x86-64 (also known as x64, x86_64, AMD64, and Intel 64) is a 64-bit extension of the x86 instruction set. It was announced in 1999 and first available in the AMD Opteron family in 2003. It introduces two new operating modes: 64-bit mode an ...

AArch64 AArch64, also known as ARM64, is a 64-bit version of the ARM architecture family, a widely used set of computer processor designs. It was introduced in 2011 with the ARMv8 architecture and later became part of the ARMv9 series. AArch64 allows ...

) pre-OS environment *

C language C (''pronounced'' '' – like the letter c'') is a general-purpose programming language. It was created in the 1970s by Dennis Ritchie and remains very widely used and influential. By design, C's features cleanly reflect the capabilities o ...

programming * Python programming usin
Python interpreter for UEFI
shell * Modular design * Backward and forward compatibility With UEFI, it is possible to store product keys for operating systems such as Windows, on the UEFI firmware of the device. UEFI is required for

Secure Boot Unified Extensible Firmware Interface (UEFI, as an acronym) is a specification for the firmware architecture of a computing platform. When a computer is powered on, the UEFI implementation is typically the first that runs, before starting th ...

on devices shipping with Windows 8 and above. It is also possible for operating systems to access UEFI configuration data.

Compatibility

Processor compatibility

As of version 2.5, processor bindings exist for Itanium, x86, x86-64,

ARM In human anatomy, the arm refers to the upper limb in common usage, although academically the term specifically means the upper arm between the glenohumeral joint (shoulder joint) and the elbow joint. The distal part of the upper limb between ...

(AArch32) and

ARM64 AArch64, also known as ARM64, is a 64-bit version of the ARM architecture family, a widely used set of computer processor designs. It was introduced in 2011 with the ARMv8 architecture and later became part of the ARMv9 series. AArch64 allows ...

(AArch64). Only

little-endian '' Jonathan_Swift.html" ;"title="Gulliver's Travels'' by Jonathan Swift">Gulliver's Travels'' by Jonathan Swift, the novel from which the term was coined In computing, endianness is the order in which bytes within a word (data type), word of d ...

processors can be supported. Unofficial UEFI support is under development for POWERPC64 by implementing

TianoCore TianoCore EDK II (formerly Tiano) is the reference implementation of UEFI by Intel. EDK is the abbreviation for EFI Development Kit and is developed by the TianoCore community. TianoCore EDK II is the de facto standard generic UEFI services imple ...

on top of OPAL, the OpenPOWER abstraction layer, running in little-endian mode. Similar projects exist for MIPS and

RISC-V RISC-V (pronounced "risk-five") is an open standard instruction set architecture (ISA) based on established reduced instruction set computer (RISC) principles. The project commenced in 2010 at the University of California, Berkeley. It transfer ...

. As of UEFI 2.7, RISC-V processor bindings have been officially established for 32-, 64- and 128-bit modes. Standard PC BIOS is limited to a 16-bit processor mode and 1 MB of addressable memory space, resulting from the design based on the

IBM 5150 International Business Machines Corporation (using the trademark IBM), nicknamed Big Blue, is an American multinational technology company headquartered in Armonk, New York, and present in over 175 countries. It is a publicly traded company ...

that used a 16-bit

Intel 8088 The Intel 8088 ("''eighty-eighty-eight''", also called iAPX 88) microprocessor is a variant of the Intel 8086. Introduced on June 1, 1979, the 8088 has an eight-bit external data bus instead of the 16-bit bus of the 8086. The 16-bit registers ...

processor. In comparison, the processor mode in a UEFI environment can be either 32-bit (

, AArch32) or 64-bit (

x86-64 x86-64 (also known as x64, x86_64, AMD64, and Intel 64) is a 64-bit extension of the x86 instruction set architecture, instruction set. It was announced in 1999 and first available in the AMD Opteron family in 2003. It introduces two new ope ...

, Itanium, and AArch64). 64-bit UEFI firmware implementations support

long mode In the x86-64 computer architecture, long mode is the mode where a 64-bit operating system can access 64-bit instructions and registers. 64-bit programs are run in a sub-mode called 64-bit mode, while 32-bit programs and 16-bit protected mod ...

, which allows applications in the preboot environment to use 64-bit addressing to get direct access to all of the machine's memory. UEFI requires the firmware and operating system loader (or kernel) to be size-matched; that is, a 64-bit UEFI firmware implementation can load only a 64-bit operating system (OS) boot loader or kernel (unless the CSM-based ''legacy boot'' is used) and the same applies to 32-bit. After the system transitions from ''boot services'' to ''runtime services'', the operating system kernel takes over. At this point, the kernel can change processor modes if it desires, but this bars usage of the runtime services (unless the kernel switches back again). As of version 3.15, the

Linux kernel The Linux kernel is a Free and open-source software, free and open source Unix-like kernel (operating system), kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the k ...

supports 64-bit kernels to be booted on 32-bit UEFI firmware implementations running on

CPUs, with ''UEFI handover'' support from a UEFI boot loader as the requirement. UEFI handover protocol deduplicates the UEFI initialization code between the kernel and UEFI boot loaders, leaving the initialization to be performed only by the Linux kernel's ''UEFI boot stub''.

Disk device compatibility

In addition to the standard PC disk partition scheme that uses a

master boot record A master boot record (MBR) is a type of boot sector in the first block of disk partitioning, partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept ...

(MBR), UEFI also works with the

(GPT) partitioning scheme, which is free from many of the limitations of MBR. In particular, the MBR limits on the number and size of disk partitions (up to four

primary partition Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk ...

s per disk, and up to 2 TB per disk) are relaxed. More specifically, GPT allows for a maximum disk and partition size of 8 ZiB .

Linux

Support for GPT in

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

is enabled by turning on the option CONFIG_EFI_PARTITION (EFI GUID Partition Support) during kernel configuration. This option allows Linux to recognize and use GPT disks after the system firmware passes control over the system to Linux. For reverse compatibility, Linux can use GPT disks in BIOS-based systems for both data storage and booting, as both GRUB 2 and Linux are GPT-aware. Such a setup is usually referred to as ''BIOS-GPT''. As GPT incorporates the protective MBR, a BIOS-based computer can boot from a GPT disk using a GPT-aware boot loader stored in the protective MBR's bootstrap code area. In the case of GRUB, such a configuration requires a

BIOS boot partition In computing, BIOS (, ; Basic Input/Output System, also known as the System BIOS, ROM BIOS, BIOS ROM or PC BIOS) is a type of firmware used to provide runtime services for operating systems and programs and to perform hardware initialization d ...

for GRUB to embed its second-stage code due to absence of the post-MBR gap in GPT partitioned disks (which is taken over by the GPT's ''Primary Header'' and ''Primary Partition Table''). Commonly 1 MB in size, this partition's

Globally Unique Identifier A Universally Unique Identifier (UUID) is a 128-bit label used to uniquely identify objects in computer systems. The term Globally Unique Identifier (GUID) is also used, mostly in Microsoft systems. When generated according to the standard methods ...

(GUID) in GPT scheme is and is used by GRUB only in BIOS-GPT setups. From GRUB's perspective, no such partition type exists in case of MBR partitioning. This partition is not required if the system is UEFI-based because no embedding of the second-stage code is needed in that case. UEFI systems can access GPT disks and boot directly from them, which allows Linux to use UEFI boot methods. Booting Linux from GPT disks on UEFI systems involves creation of an EFI system partition (ESP), which contains UEFI applications such as bootloaders, operating system kernels, and utility software. Such a setup is usually referred to as ''UEFI-GPT'', while ESP is recommended to be at least 512 MB in size and formatted with a FAT32 filesystem for maximum compatibility. For

backward compatibility In telecommunications and computing, backward compatibility (or backwards compatibility) is a property of an operating system, software, real-world product, or technology that allows for interoperability with an older legacy system, or with Input ...

, some UEFI implementations also support booting from MBR-partitioned disks through the Compatibility Support Module (CSM) that provides legacy BIOS compatibility. In that case, booting Linux on UEFI systems is the same as on legacy BIOS-based systems.

Microsoft Windows

Some of the EFI's practices and data formats mirror those of

Microsoft Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

. The 64-bit versions of

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, released five years earlier, which was then the longest time span between successive releases of Microsoft W ...

SP1 and later and 64-bit versions of

Windows 8 Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012, made available for download via Microsoft ...

, 8.1, 10, and 11 can boot from a GPT disk that is larger than 2 TB.

Features

Services

EFI defines two types of services: ''boot services'' and ''runtime services''. Boot services are available only while the firmware owns the platform (i.e., before the ExitBootServices() call), and they include text and graphical consoles on various devices, and bus, block and file services. Runtime services are still accessible while the operating system is running; they include services such as date, time and

NVRAM Non-volatile random-access memory (NVRAM) is random-access memory that retains data without applied power. This is in contrast to dynamic random-access memory (DRAM) and static random-access memory (SRAM), which both maintain data only for as l ...

access. ; Graphics Output Protocol (GOP) services : The ''Graphics Output Protocol'' (GOP) provides runtime services; see also Graphics features section below. The operating system is permitted to directly write to the framebuffer provided by GOP during runtime mode. ; UEFI

Memory map In computer science, a memory map is a structure of data (which usually resides in memory itself) that indicates how memory is laid out. The term "memory map" has different meanings in different contexts. #It is the fastest and most flexible cach ...

services ; SMM services ;

services ;

Devicetree In computing, a devicetree (also written device tree) is a data structure describing the hardware components of a particular computer so that the operating system's kernel can use and manage those components, including the CPU or CPUs, the memor ...

services (for RISC processors) ; Variable services : UEFI variables provide a way to store data, in particular non-volatile data. Some UEFI variables are shared between platform firmware and operating systems. Variable namespaces are identified by GUIDs, and variables are key/value pairs. For example, UEFI variables can be used to keep crash messages in

after a crash for the operating system to retrieve after a reboot. ; Time services : UEFI provides time services. Time services include support for time zone and daylight saving fields, which allow the hardware

real-time clock A real-time clock (RTC) is an electronic device (most often in the form of an integrated circuit) that measures the passage of time. Although the term often refers to the devices in personal computers, server (computing), servers and embedded ...

to be set to local time or UTC. On machines using a PC-AT real-time clock, by default the hardware clock still has to be set to local time for compatibility with BIOS-based Windows, unless using recent versions and an entry in the

Windows registry The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, a ...

is set to indicate the use of UTC.

Applications

Beyond loading an OS, UEFI can run ''UEFI applications'', which reside as files on the EFI system partition. They can be executed from the UEFI Shell, by the firmware's

boot manager A bootloader, also spelled as boot loader or called bootstrap loader, is a computer program that is responsible for booting a computer and booting an operating system. If it also provides an interactive menu with multiple boot choices then it's o ...

, or by other UEFI applications. ''UEFI applications'' can be developed and installed independently of the original equipment manufacturers (OEMs). A type of UEFI application is an OS boot loader such as

GRUB GNU GRUB (short for GNU GRand Unified Bootloader, commonly referred to as GRUB) is a boot loader package from the GNU Project. GRUB is the reference implementation of the Free Software Foundation's Multiboot Specification, which provides a use ...

rEFInd rEFInd is a boot manager for UEFI and EFI-based machines. It can be used to boot multiple operating systems that are installed on a single non-volatile device. It also provides a way to launch UEFI applications. It was forked from discontinued ...

, Gummiboot, and

Windows Boot Manager The Windows Boot Manager (BOOTMGR) is the bootloader provided by Microsoft for Windows NT versions starting with Windows Vista and Windows Server 2008. It is the first program launched by the BIOS or UEFI of the computer and is responsible for ...

, which loads some OS files into memory and executes them. Also, an OS boot loader can provide a user interface to allow the selection of another UEFI application to run. Utilities like the UEFI Shell are also UEFI applications.

Protocols

EFI defines protocols as a set of software interfaces used for communication between two binary modules. All EFI drivers must provide services to others via protocols. The EFI Protocols are similar to the

BIOS interrupt calls BIOS implementations provide interrupts that can be invoked by operating systems and application programs to use the facilities of the firmware on IBM PC compatible computers. Traditionally, BIOS calls are mainly used by DOS programs and some othe ...

Device drivers

In addition to standard

instruction set architecture In computer science, an instruction set architecture (ISA) is an abstract model that generally defines how software controls the CPU in a computer or a family of computers. A device or program that executes instructions described by that ISA, ...

-specific device drivers, EFI provides for a ISA-independent

device driver In the context of an operating system, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabli ...

stored in

non-volatile memory Non-volatile memory (NVM) or non-volatile storage is a type of computer memory that can retain stored information even after power is removed. In contrast, volatile memory needs constant power in order to retain data. Non-volatile memory typ ...

as ''EFI byte code'' or ''EBC''. System firmware has an interpreter for EBC images. In that sense, EBC is analogous to

Open Firmware Open Firmware is a standard defining the interfaces of a computer firmware system, formerly endorsed by the Institute of Electrical and Electronics Engineers (IEEE). It originated at Sun Microsystems where it was known as OpenBoot, and has bee ...

, the ISA-independent firmware used in

PowerPC PowerPC (with the backronym Performance Optimization With Enhanced RISC – Performance Computing, sometimes abbreviated as PPC) is a reduced instruction set computer (RISC) instruction set architecture (ISA) created by the 1991 Apple Inc., App ...

-based

Apple Macintosh Mac is a brand of personal computers designed and marketed by Apple Inc., Apple since 1984. The name is short for Macintosh (its official name until 1999), a reference to the McIntosh (apple), McIntosh apple. The current product lineup inclu ...

and

Sun Microsystems Sun Microsystems, Inc., often known as Sun for short, was an American technology company that existed from 1982 to 2010 which developed and sold computers, computer components, software, and information technology services. Sun contributed sig ...

SPARC computers, among others. Some architecture-specific (non-EFI Byte Code) EFI drivers for some device types can have interfaces for use by the OS. This allows the OS to rely on EFI for drivers to perform basic graphics and network functions before, and if, operating-system-specific drivers are loaded. In other cases, the EFI driver can be filesystem drivers that allow for booting from other types of disk volumes. Examples include ''efifs'' for 37 file systems (based on GRUB2 code), used by

Rufus Rufus is a masculine given name, a surname, an Ancient Roman cognomen and a nickname (from Latin ''wikt:rufus, rufus'', "red"). Notable people with the name include: Given name Politicians * Marcus Caelius Rufus, (28 May 82 BC – after 48 ...

for chain-loading NTFS ESPs.

Graphics features

The EFI 1.0 specification defined a UGA (Universal Graphic Adapter) protocol as a way to support graphics features. UEFI did not include UGA and replaced it with GOP (Graphics Output Protocol). UEFI 2.1 defined a "Human Interface Infrastructure" (HII) to manage user input, localized strings, fonts, and forms (in the

HTML Hypertext Markup Language (HTML) is the standard markup language for documents designed to be displayed in a web browser. It defines the content and structure of web content. It is often assisted by technologies such as Cascading Style Sheets ( ...

sense). These enable original equipment manufacturers (OEMs) or independent BIOS vendors (IBVs) to design graphical interfaces for pre-boot configuration. UEFI uses

UTF-16 UTF-16 (16-bit Unicode Transformation Format) is a character encoding that supports all 1,112,064 valid code points of Unicode. The encoding is variable-length as code points are encoded with one or two ''code units''. UTF-16 arose from an earli ...

to encode strings by default. Most early UEFI firmware implementations were console-based. Today many UEFI firmware implementations are GUI-based.

EFI system partition

An EFI system partition, often abbreviated to ESP, is a

data storage device Data ( , ) are a collection of discrete or continuous values that convey information, describing the quantity, quality, fact, statistics, other basic units of meaning, or simply sequences of symbols that may be further interpreted form ...

partition that is used in computers adhering to the UEFI specification. Accessed by the UEFI firmware when a computer is powered up, it stores UEFI applications and the files these applications need to run, including operating system

boot loader A bootloader, also spelled as boot loader or called bootstrap loader, is a computer program that is responsible for booting a computer and booting an operating system. If it also provides an interactive menu with multiple boot choices then it's o ...

s. Supported

partition table Partition may refer to: Arts and entertainment Film and television * ''Partition'' (1987 film), directed by Ken McMullen * ''Partition'' (2007 film), directed by Vic Sarin * '' Partition: 1947'', or ''Viceroy's House'', a 2017 film Music * Par ...

schemes include MBR and GPT, as well as

El Torito El Torito (Spanish language, Spanish for "the little bull") is an American Restaurant chain, chain that serves Mexican food. El Torito operates 25 restaurants all in California. El Torito is one of several Mexican cuisine restaurant chains ope ...

volumes on optical discs. For use on ESPs, UEFI defines a specific version of the FAT file system, which is maintained as part of the UEFI specification and independently from the original FAT specification, encompassing the

FAT32 File Allocation Table (FAT) is a file system developed for personal computers and was the default file system for the MS-DOS and Windows 9x operating systems. Originally developed in 1977 for use on floppy disks, it was adapted for use on ...

FAT16 File Allocation Table (FAT) is a file system developed for personal computers and was the default file system for the MS-DOS and Windows 9x operating systems. Originally developed in 1977 for use on floppy disks, it was adapted for use on Ha ...

and

FAT12 File Allocation Table (FAT) is a file system developed for personal computers and was the default file system for the MS-DOS and Windows 9x operating systems. Originally developed in 1977 for use on floppy disks, it was adapted for use on ...

file systems. The ESP also provides space for a boot sector as part of the backward BIOS compatibility.

Booting

UEFI booting

Unlike the legacy PC BIOS, UEFI does not rely on

boot sector A boot sector is the disk sector, sector of a persistent data storage device (e.g., hard disk, floppy disk, optical disc, etc.) which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's bui ...

s, defining instead a boot manager as part of the UEFI specification. When a computer is powered on, the boot manager checks the boot configuration and, based on its settings, then executes the specified OS

operating system kernel A kernel is a computer program at the core of a computer's operating system that always has complete control over everything in the system. The kernel is also responsible for preventing and mitigating conflicts between different processes. It is ...

(usually boot loader). The boot configuration is defined by variables stored in

, including variables that indicate the file system paths to OS loaders or OS kernels. OS boot loaders can be automatically detected by UEFI, which enables easy

booting In computing, booting is the process of starting a computer as initiated via Computer hardware, hardware such as a physical button on the computer or by a software command. After it is switched on, a computer's central processing unit (CPU) h ...

from removable devices such as

USB flash drive A flash drive (also thumb drive, memory stick, and pen drive/pendrive) is a data storage device that includes flash memory with an integrated USB interface. A typical USB drive is removable, rewritable, and smaller than an optical disc, and u ...

s. This automated detection relies on standardized file paths to the OS boot loader, with the path varying depending on the computer architecture. The format of the file path is defined as ; for example, the file path to the OS loader on an

system is , and on ARM64 architecture. UEFI boot process

Booting UEFI systems from GPT-partitioned disks is commonly called ''UEFI-GPT booting''. Despite the fact that the UEFI specification requires MBR partition tables to be fully supported, some UEFI firmware implementations immediately switch to the BIOS-based CSM booting depending on the type of boot disk's partition table, effectively preventing UEFI booting to be performed from EFI System Partition on MBR-partitioned disks. Such a boot scheme is commonly called ''UEFI-MBR''. It is also common for a boot manager to have a textual user interface so the user can select the desired OS (or setup utility) from a list of available boot options. On PC platforms, the BIOS firmware that supports UEFI boot can be called ''UEFI BIOS'', although it may not support CSM boot method, as modern x86 PCs deprecated use of CSM.

CSM booting

To ensure backward compatibility, UEFI firmware implementations on PC-class machines could support booting in legacy BIOS mode from MBR-partitioned disks through the ''Compatibility Support Module (CSM)'' that provides legacy BIOS compatibility. In this scenario, booting is performed in the same way as on legacy BIOS-based systems, by ignoring the partition table and relying on the content of a

. BIOS-style booting from MBR-partitioned disks is commonly called ''BIOS-MBR'', regardless of it being performed on UEFI or legacy BIOS-based systems. Furthermore, booting legacy BIOS-based systems from GPT disks is also possible, and such a boot scheme is commonly called ''BIOS-GPT''. The ''Compatibility Support Module'' allows legacy operating systems and some legacy option ROMs that do not support UEFI to still be used. It also provides required legacy

System Management Mode System Management Mode (SMM, sometimes called ring −2 in reference to protection rings) is an operating mode of x86 central processor units (CPUs) in which all normal execution, including the operating system, is suspended. An alternat ...

(SMM) functionality, called ''CompatibilitySmm'', as an addition to features provided by the UEFI SMM. An example of such a legacy SMM functionality is providing USB legacy support for keyboard and mouse, by emulating their classic

PS/2 The Personal System/2 or PS/2 is IBM's second generation of personal computers. Released in 1987, it officially replaced the IBM PC, XT, AT, and PC Convertible in IBM's lineup. Many of the PS/2's innovations, such as the 16550 UART (serial por ...

counterparts. In November 2017, Intel announced that it planned to phase out support CSM for client platforms by 2020. In July, of 2022, Kaspersky Labs published information regarding a Rootkit designed to chain boot malicious code on machines using Intel's H81 chipset and the Compatibility Support module of affected motherboards. In August 2023, Intel announced that it planned to phase out support CSM for server platforms by 2024. Currently most computers based on Intel platforms do not support CSM.

Network booting

The UEFI specification includes support for booting over network via the

Preboot eXecution Environment In computing, the Preboot eXecution Environment (PXE; often pronounced as ''pixie''), often called PXE boot (''pixie boot''), is a specification describing a standardized client–server environment that boots a software assembly, retrieved ...

(PXE). PXE booting

network protocol A communication protocol is a system of rules that allows two or more entities of a communications system to transmit information via any variation of a physical quantity. The protocol defines the rules, syntax, semantics, and synchronization of ...

s include

Internet Protocol The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet. IP ...

(

IPv4 Internet Protocol version 4 (IPv4) is the first version of the Internet Protocol (IP) as a standalone specification. It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. ...

and

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

User Datagram Protocol In computer networking, the User Datagram Protocol (UDP) is one of the core communication protocols of the Internet protocol suite used to send messages (transported as datagrams in Network packet, packets) to other hosts on an Internet Protoco ...

(UDP),

Dynamic Host Configuration Protocol The Dynamic Host Configuration Protocol (DHCP) is a network protocol, network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the netw ...

(DHCP),

Trivial File Transfer Protocol The Trivial File Transfer Protocol (TFTP) is a simple Lockstep (computing), lockstep communication protocol for transmitting or receiving files in a client-server application. A primary use of TFTP is in the early stages of nodes booting on a l ...

(TFTP) and

iSCSI Internet Small Computer Systems Interface or iSCSI ( ) is an Internet Protocol-based storage networking standard for linking data storage facilities. iSCSI provides block-level access to storage devices by carrying SCSI commands over a TCP/IP ...

. OS images can be remotely stored on

storage area network A storage area network (SAN) or storage network is a computer network which provides access to consolidated, block device, block-level data storage. SANs are primarily used to access Computer data storage, data storage devices, such as disk ...

s (SANs), with Internet Small Computer System Interface (iSCSI) and

Fibre Channel over Ethernet Fibre Channel over Ethernet (FCoE) is a computer network technology that encapsulates Fibre Channel frames over Ethernet networks. This allows Fibre Channel to use 10 Gigabit Ethernet networks (or higher speeds) while preserving the Fibre Channel ...

(FCoE) as supported protocols for accessing the SANs. Version 2.5 of the UEFI specification adds support for accessing boot images over

HTTP HTTP (Hypertext Transfer Protocol) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, wher ...

Secure Boot

The UEFI specification defines a protocol known as ''Secure Boot'', which can secure the boot process by preventing the loading of UEFI drivers or OS boot loaders that are not signed with an acceptable digital signature. The details of how these drivers are signed is specified in th
UEFI Specification
When Secure Boot is enabled, it is initially placed in "setup" mode, which allows a public key known as the "platform key" (PK) to be written to the firmware. Once the key is written, Secure Boot enters "User" mode, where only UEFI drivers and OS boot loaders signed with the platform key can be loaded by the firmware. Additional "key exchange keys" (KEK) can be added to a database stored in memory to allow other certificates to be used, but they must still have a connection to the private portion of the platform key. Secure Boot can also be placed in "Custom" mode, where additional public keys can be added to the system that do not match the private key. Secure Boot is supported by

and 8.1,

Windows Server 2012 Windows Server 2012, codenamed "Windows Server 8", is the ninth major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server brand name. It is the server version of Windows based on Windows ...

and 2012 R2,

Windows 10 Windows 10 is a major release of Microsoft's Windows NT operating system. The successor to Windows 8.1, it was Software release cycle#Release to manufacturing (RTM), released to manufacturing on July 15, 2015, and later to retail on July 2 ...

Windows Server 2016 Windows Server 2016 is the eleventh major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server brand name. It was developed alongside Windows 10 and is the successor to the Windows 8.1-based ...

2019 This was the year in which the first known human case of COVID-19 was documented, preceding COVID-19 pandemic, the pandemic which was declared by the World Health Organization the following year. Up to that point, 2019 had been described as ...

, and

2022 The year began with another wave in the COVID-19 pandemic, with SARS-CoV-2 Omicron variant, Omicron spreading rapidly and becoming the dominant variant of the SARS-CoV-2 virus worldwide. Tracking a decrease in cases and deaths, 2022 saw ...

, and

Windows 11 Windows 11 is a version of Microsoft's Windows NT operating system, released on October 5, 2021, as the successor to Windows 10 (2015). It is available as a free upgrade for devices running Windows 10 that meet the #System requirements, Windo ...

, VMware vSphere 6.5 and a number of

Linux distribution A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro—if distributed on its own—is oft ...

s including

Fedora A fedora () is a hat with a soft brim and indented crown.Kilgour, Ruth Edwards (1958). ''A Pageant of Hats Ancient and Modern''. R. M. McBride Company. It is typically creased lengthwise down the crown and "pinched" near the front on both sides ...

(since version 18),

openSUSE openSUSE () is a free and open-source software, free and open-source Linux distribution developed by the openSUSE project. It is offered in two main variations: ''Tumbleweed'', an upstream rolling release distribution, and ''Leap'', a stable r ...

(since version 12.3), RHEL (since version 7), CentOS (since version 7), Debian (since version 10),

Ubuntu Ubuntu ( ) is a Linux distribution based on Debian and composed primarily of free and open-source software. Developed by the British company Canonical (company), Canonical and a community of contributors under a Meritocracy, meritocratic gover ...

(since version 12.04.2),

Linux Mint Linux Mint is a community-developed Linux distribution. It is based on Ubuntu and designed for x86-64 based computers; another variant is based on Debian which is named Linux Mint Debian Edition (LMDE) and has both 64-bit and IA-32 support. T ...

(since version 21.3)., and AlmaLinux OS (since version 8.4). ,

FreeBSD FreeBSD is a free-software Unix-like operating system descended from the Berkeley Software Distribution (BSD). The first version was released in 1993 developed from 386BSD, one of the first fully functional and free Unix clones on affordable ...

support is in a planning stage.

UEFI shell

UEFI provides a shell environment, which can be used to execute other UEFI applications, including UEFI

s. Apart from that, commands available in the UEFI shell can be used for obtaining various other information about the system or the firmware, including getting the memory map (memmap), modifying boot manager variables (bcfg), running partitioning programs (diskpart), loading UEFI drivers, and editing text files (edit). Source code for a UEFI shell can be downloaded from the

UDK/EDK2 project. A pre-built ShellBinPkg is also available. Shell v2 works best in UEFI 2.3+ systems and is recommended over Shell v1 in those systems. Shell v1 should work in all UEFI systems. Methods used for launching UEFI shell depend on the manufacturer and model of the system

motherboard A motherboard, also called a mainboard, a system board, a logic board, and informally a mobo (see #Nomenclature, "Nomenclature" section), is the main printed circuit board (PCB) in general-purpose computers and other expandable systems. It ho ...

. Some of them already provide a direct option in firmware setup for launching, e.g. compiled x86-64 version of the shell needs to be made available as /SHELLX64.EFI. Some other systems have an already embedded UEFI shell which can be launched by appropriate key press combinations. For other systems, the solution is either creating an appropriate USB flash drive or adding manually (bcfg) a boot option associated with the compiled version of shell.

Commands

The following is a list of commands supported by the EFI shell. * alias *

attrib In computing, ATTRIB is a command in Intel ISIS-II, DOS, IBM OS/2, Microsoft Windows and ReactOS that allows the user to change various characteristics, or " attributes" of a computer file or directory. The command is also available in the EFI ...

* bcfg * cd * cls *

comp Comp, COMP or Comps may refer to: Places In England: * Comp, Kent In France: * Comps, Drôme * Comps, Gard * Comps, Gironde * Comps-la-Grand-Ville * Comps-sur-Artuby Music *Accompaniment, especially in jazz ** Comping (jazz) *Compilatio ...

* cp * date * dblk * dh * dmpstore *

echo In audio signal processing and acoustics, an echo is a reflection of sound that arrives at the listener with a delay after the direct sound. The delay is directly proportional to the distance of the reflecting surface from the source and the lis ...

* Edd30 * EddDebug * edit * err * guid *

help Help may refer to: Arts, entertainment, and media Films * Help (2010 film), ''Help'' (2010 film), a Bollywood horror film * Help (2021 theatrical film), ''Help'' (2021 theatrical film), a British psychological thriller film * Help (2021 TV ...

* load * ls * map * mem * memmap *

mkdir (make directory) command (computing), command in the Unix, DOS, Digital Research, DR FlexOS, IBM OS/2, Microsoft Windows, and ReactOS operating systems is used to make a new directory (file systems), directory. It is also available in the Unified ...

* mm * mode *

mount Mount is often used as part of the name of specific mountains, e.g. Mount Everest. Mount or Mounts may also refer to: Places * Mount, Cornwall, a village in Warleggan parish, England * Mount, Perranzabuloe, a hamlet in Perranzabuloe parish, ...

* pause * pci * reset * rm * set * stall *

time Time is the continuous progression of existence that occurs in an apparently irreversible process, irreversible succession from the past, through the present, and into the future. It is a component quantity of various measurements used to sequ ...

type Type may refer to: Science and technology Computing * Typing, producing text via a keyboard, typewriter, etc. * Data type, collection of values used for computations. * File type * TYPE (DOS command), a command to display contents of a file. * ...

* unload *

ver Ver or VER may refer to: * Voluntary Export Restraints, in international trade * VER, the IATA airport code for Veracruz International Airport * Volk's Electric Railway, Brighton, England * VerPublishing, of the German group VDM Publishing, re ...

* vol

Extensions

Extensions to UEFI can be loaded from virtually any

non-volatile Non-volatile memory (NVM) or non-volatile storage is a type of computer memory that can retain stored information even after power is removed. In contrast, volatile memory needs constant power in order to retain data. Non-volatile memory typ ...

storage device attached to the computer. For example, an original equipment manufacturer (OEM) can distribute systems with an EFI system partition on the hard drive, which would add additional functions to the standard UEFI firmware stored on the motherboard's

ROM Rom, or ROM may refer to: Biomechanics and medicine * Risk of mortality, a medical classification to estimate the likelihood of death for a patient * Rupture of membranes, a term used during pregnancy to describe a rupture of the amniotic sac * ...

UEFI Capsule

UEFI Capsule defines a Firmware-to-OS firmware update interface, marketed as modern and secure.

Windows 8.1 Windows 8.1 is a release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on August 27, 2013, and broadly released for retail sale on October 17, 2013, about a year after the retail release of its pr ...

, and

Fwupd fwupd is an open-source daemon for managing the installation of firmware updates on Linux-based systems, developed by GNOME maintainer Richard Hughes. It is designed primarily for servicing the Unified Extensible Firmware Interface (UEFI) firmwa ...

for Linux each support the UEFI Capsule.

Hardware

, UEFI initializes and tests system hardware components (e.g. memory training, PCIe link training, USB link training on typical x86 systems), and then loads the

from a

mass storage device In computing, mass storage refers to the Data storage, storage of large amounts of data in a persistence (computer science), persisting and machine-readable data, machine-readable fashion. In general, the term ''mass'' in ''mass storage'' is use ...

or through a network connection. In

x86 x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel, based on the 8086 microprocessor and its 8-bit-external-bus variant, the 8088. Th ...

systems, the UEFI firmware is usually stored in the

NOR flash Flash memory is an electronic non-volatile computer memory storage medium that can be electrically erased and reprogrammed. The two main types of flash memory, NOR flash and NAND flash, are named for the NOR and NAND logic gates. Both use ...

chip of the motherboard. In some ARM-based Android and Windows Phone devices, the UEFI boot loader is stored in the

eMMC MultiMediaCard, officially abbreviated as MMC, is a memory card standard used for solid-state storage. Unveiled in 1997 by SanDisk and Siemens, MMC is based on a surface-contact low-pin-count serial interface using a single memory stack subst ...

or eUFS flash memory.

Classes

UEFI machines can have one of the following classes, which were used to help ease the transition to UEFI: * Class 0: Legacy BIOS * Class 1: UEFI with a CSM interface and no external UEFI interface. The only UEFI interfaces are internal to the firmware. * Class 2: UEFI with CSM and external UEFI interfaces, eg. UEFI Boot. * Class 3: UEFI without a CSM interface and with an external UEFI interface. * Class 3+: UEFI class 3 that has Secure Boot enabled. Starting from the 10th Gen Intel Core, Intel no longer provides Legacy

Video BIOS Video BIOS is the BIOS of a graphics card in a (usually IBM PC-derived) computer. It initializes the graphics card at the computer's boot time. It also implements INT 10h interrupt and VESA BIOS Extensions (VBE) for basic text and videomode outpu ...

for the iGPU (

Intel Graphics Technology Intel Graphics Technology (GT) is the collective name for a series of integrated graphics processors (IGPs) produced by Intel that are manufactured on the same package or die as the central processing unit (CPU). It was first introduced in 2010 ...

). Legacy boot with those CPUs requires a Legacy Video BIOS, which can still be provided by a video card.

Boot stages

SEC – Security Phase

This is the first stage of the UEFI boot but may have platform specific binary code that precedes it. (e.g., Intel ME, AMD PSP, CPU

microcode In processor design, microcode serves as an intermediary layer situated between the central processing unit (CPU) hardware and the programmer-visible instruction set architecture of a computer. It consists of a set of hardware-level instructions ...

). It consists of minimal code written in

for the specific architecture. It initializes a temporary memory (often CPU cache-as-RAM (CAR), or SoC on-chip SRAM) and serves as the system's software root of trust with the option of verifying PEI before hand-off.

Responsibilities

* Initialization of temporary memory for next stage(PEI). * Root of trust, by the means of verifying the integrity of PEI. * Passing handoff information to the PEI foundation. The information includes the location and size of temporary memory, location and size of stack and state of the platform.

PEI – Pre-EFI Initialization

The second stage of UEFI boot consists of a dependency-aware dispatcher that loads and runs PEI modules (PEIMs) to handle early hardware initialization tasks such as

main memory Computer data storage or digital data storage is a technology consisting of computer components and recording media that are used to retain digital data. It is a core function and fundamental component of computers. The central processin ...

initialization (initialize

memory controller A memory controller, also known as memory chip controller (MCC) or a memory controller unit (MCU), is a digital circuit that manages the flow of data going to and from a computer's main memory. When a memory controller is integrated into anothe ...

and

DRAM Dram, DRAM, or drams may refer to: Technology and engineering * Dram (unit), a unit of mass and volume, and an informal name for a small amount of liquor, especially whisky or whiskey * Dynamic random-access memory, a type of electronic semicondu ...

) and firmware recovery operations. Additionally, it is responsible for discovery of the current boot mode and handling many ACPI S3 operations. In the case of ACPI S3 resume, it is responsible for restoring many hardware registers to a pre-sleep state. PEI also uses CAR. Initialization at this stage involves creating data structures in memory and establishing default values within these structures. This stage has several components including PEI foundation, PEIMs and PPI. Due less resources available in this stage, this stage must be minimal and do minimal preparations for the next stage(DXE), Which is more richer.

PEI Foundation

After SEC phase hand off, platform responsibility is taken by PEI Foundation. it's responsibility is: * Successful dispatch of PEIMs(pre-EFI Initialization modules). * Initialization permanent memory(RAM). * And handing over to next stage which is DXE. * facilitate the communication of PEIMs called PPI.

PEI Dispatcher

This component is responsible for invoking PEIMs and managing there dependencies.

Pre-EFI Initialization modules

Those are minimal PEI drivers that is responsible for initialization of the hardware like permanent memory, CPU, chipset and motherboard. Each PEIMs has single responsibility and focused on single initialization. Those drivers came from different vendors.

PEIMs-to-PEIMs Interfaces

This is a data structure that composed of GUID pairs of pointers. PPIs are discovered by PEIMs through PEI services. After minimal initialization of the system for DXE, PEI foundation locates and passes control to DXE. The PEI foundation dispatches DXE foundation through special PPI called IPL(Initial Program Load).

DXE – Driver Execution Environment

This stage consist of C modules and a dependency-aware dispatcher. With main memory now available, CPU, chipset, mainboard and other I/O devices are initialized in DXE and BDS. Initialization at this stage involves assigning EFI device paths to the hardware connected to the motherboard, and transferring configuration data to the hardware.

BDS – Boot Device Select (Boot Manager)

BDS is a part of the DXE. In this stage, boot devices are initialized, UEFI drivers or Option ROMs of PCI devices are executed according to architecturally defined variables called NVRAM.

TSL – Transient System Load

This is the stage between boot device selection and hand-off to the OS. At this point one may enter a UEFI shell, or execute a UEFI application such as the OS boot loader.

RT – Runtime

The UEFI hands off to the

(OS) after is executed. A UEFI compatible OS is now responsible for exiting boot services triggering the firmware to unload all no longer needed code and data, leaving only runtime services code/data, e.g. SMM and

. A typical modern OS will prefer to use its own programs (such as

kernel driver In the context of an operating system, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabli ...

s) to control hardware devices. When a legacy OS is used, CSM will handle this call ensuring the system is compatible with legacy BIOS expectations.

Usage

Implementations

Intel's implementation of EFI is the ''Intel Platform Innovation Framework'', codenamed ''Tiano''. Tiano runs on Intel's

XScale XScale is a microarchitecture for central processing units initially designed by Intel implementing the ARM architecture (version 5) instruction set. XScale comprises several distinct families: IXP, IXC, IOP, PXA and CE (see more below), with some ...

and

processors, and is proprietary software, although a portion of the code has been released under the

BSD license BSD licenses are a family of permissive free software licenses, imposing minimal restrictions on the use and distribution of covered software. This is in contrast to copyleft licenses, which have share-alike requirements. The original BSD lic ...

Eclipse Public License The Eclipse Public License (EPL) is a free and open source software license most notably used for the Eclipse IDE and other projects by the Eclipse Foundation. It replaces the Common Public License (CPL) and removes certain terms relating t ...

(EPL) as

. TianoCore can be used as a payload for

coreboot coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware (BIOS or UEFI) found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and r ...

Phoenix Technologies Phoenix Technologies Ltd. is an American company that designs, develops and supports core system software for personal computers and other computing devices. The company's products commonly referred to as BIOS (Basic Input/Output System) or fir ...

' implementation of UEFI is branded as SecureCore Technology (SCT).

American Megatrends American Megatrends Inc., doing business as AMI, is an international hardware and software company, specializing in PC hardware and firmware. The company was founded in 1985 by Pat Sarma and Subramonian Shankar. It is headquartered in Building ...

offers its own UEFI firmware implementation known as Aptio, while

Insyde Software Insyde Software () is a company that specializes in UEFI system firmware and engineering support services, primarily for OEM and ODM computer and component device manufacturers. They are listed on the Gre Tai Market of Taiwan and headquartered ...

offers InsydeH2O, and Byosoft offers ByoCore. In December 2018,

released an open source version of its TianoCore EDK2-based UEFI implementation from the

Surface A surface, as the term is most generally used, is the outermost or uppermost layer of a physical object or space. It is the portion or region of the object that can first be perceived by an observer using the senses of sight and touch, and is ...

line, Project Mu. An implementation of the UEFI API was introduced into the Universal Boot Loader (

Das U-Boot Das U-Boot (subtitled "the Universal Boot Loader" and often shortened to U-Boot; see ''#History, History'' for more about the name) is an open-source software, open-source Bootloader, boot loader used in Embedded system, embedded devices to per ...

) in 2017. On the

ARMv8 ARM (stylised in lowercase as arm, formerly an acronym for Advanced RISC Machines and originally Acorn RISC Machine) is a family of RISC instruction set architectures (ISAs) for computer processors. Arm Holdings develops the ISAs and lice ...

architecture

distributions use the U-Boot UEFI implementation in conjunction with

GNU GRUB GNU GRUB (short for GNU GRand Unified Bootloader, commonly referred to as GRUB) is a boot loader package from the GNU Project. GRUB is the reference implementation of the Free Software Foundation's Multiboot Specification, which provides a use ...

for booting (e.g.

SUSE Linux openSUSE () is a free and open-source Linux distribution developed by the openSUSE project. It is offered in two main variations: ''Tumbleweed'', an upstream rolling release distribution, and ''Leap'', a stable release distribution which is so ...

), the same holds true for OpenBSD. For booting from iSCSI

iPXE iPXE is an open-source implementation of the Preboot eXecution Environment (PXE) client software and bootloader, created in 2010 as a fork of gPXE (gPXE was named Etherboot until 2008).

Platforms

's first

workstations and servers, released in 2000, implemented EFI 1.02.

Hewlett-Packard The Hewlett-Packard Company, commonly shortened to Hewlett-Packard ( ) or HP, was an American multinational information technology company. It was founded by Bill Hewlett and David Packard in 1939 in a one-car garage in Palo Alto, California ...

's first

Itanium 2 Itanium (; ) is a discontinued family of 64-bit Intel microprocessors that implement the Intel Itanium architecture (formerly called IA-64). The Itanium architecture originated at Hewlett-Packard (HP), and was later jointly developed by HP and I ...

systems, released in 2002, implemented EFI 1.10; they were able to boot

Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

and

HP-UX HP-UX (from "Hewlett Packard Unix") is a proprietary software, proprietary implementation of the Unix operating system developed by Hewlett Packard Enterprise; current versions support HPE Integrity Servers, based on Intel's Itanium architect ...

;

OpenVMS OpenVMS, often referred to as just VMS, is a multi-user, multiprocessing and virtual memory-based operating system. It is designed to support time-sharing, batch processing, transaction processing and workstation applications. Customers using Op ...

added UEFI capability in June 2003. In January 2006,

Apple Inc. Apple Inc. is an American multinational corporation and technology company headquartered in Cupertino, California, in Silicon Valley. It is best known for its consumer electronics, software, and services. Founded in 1976 as Apple Comput ...

shipped its first Intel-based Macintosh computers. These systems used EFI instead of

, which had been used on its previous PowerPC-based systems. On 5 April 2006, Apple first released Boot Camp, which produces a Windows drivers disk and a non-destructive partitioning tool to allow the installation of Windows XP or Vista without requiring a reinstallation of Mac OS X (now macOS). A firmware update was also released that added BIOS compatibility to its EFI implementation. Subsequent Macintosh models shipped with the newer firmware. During 2005, more than one million Intel systems shipped with Intel's implementation of UEFI. New mobile, desktop and server products, using Intel's implementation of UEFI, started shipping in 2006. For instance, boards that use the Intel 945 chipset series use Intel's UEFI firmware implementation. Since 2005, EFI has also been implemented on non-PC architectures, such as

embedded system An embedded system is a specialized computer system—a combination of a computer processor, computer memory, and input/output peripheral devices—that has a dedicated function within a larger mechanical or electronic system. It is e ...

s based on

cores. The EDK (EFI Developer Kit) includes an NT32 target, which allows EFI firmware and EFI applications to run within a

application. But no direct hardware access is allowed by EDK NT32. This means only a subset of EFI application and drivers can be executed by the EDK NT32 target. In 2008, more x86-64 systems adopted UEFI. While many of these systems still allow booting only the BIOS-based OSes via the Compatibility Support Module (CSM) (thus not appearing to the user to be UEFI-based), other systems started to allow booting UEFI-based OSes. For example, IBM x3450 server, MSI motherboards with ClickBIOS, HP EliteBook Notebook PCs. In 2009, IBM shipped System x machines (x3550 M2, x3650 M2, iDataPlex dx360 M2) and

BladeCenter The IBM BladeCenter was IBM's blade server architecture, until it was replaced by Flex System in 2012. The x86 division was later sold to Lenovo in 2014. History Introduced in 2002, based on engineering work started in 1999, the IBM eServer ...

HS22 with UEFI capability. Dell shipped PowerEdge T610, R610, R710, M610 and M710 servers with UEFI capability. More commercially available systems are mentioned in a UEFI whitepaper. In 2011, major vendors (such as

ASRock ASRock Inc. () is a Taiwanese manufacturer of motherboards, Industrial PC, industrial PCs and home theater PCs (HTPC). Established in 2002, it is owned by PEGATRON, a company part of the ASUS group. History ASRock was originally spun off fro ...

Asus ASUSTeK Computer Inc. (, , , ; stylized as ASUSTeK or ASUS) is a Taiwanese Multinational corporation, multinational computer, phone hardware and electronics manufacturer headquartered in Beitou District, Taipei, Taiwan. Its products include deskto ...

Gigabyte The gigabyte () is a multiple of the unit byte for digital information. The SI prefix, prefix ''giga-, giga'' means 109 in the International System of Units (SI). Therefore, one gigabyte is one billion bytes. The unit symbol for the gigabyte i ...

, and MSI) launched several consumer-oriented motherboards using the Intel 6-series

LGA 1155 LGA 1155, also called Socket H2, is a zero insertion force flip-chip land grid array (LGA) CPU socket designed by Intel for their CPUs based on the Sandy Bridge (second generation core) and Ivy Bridge (microarchitecture), Ivy Bridge (third gen ...

chipset and AMD 9 Series AM3+ chipsets with UEFI.Asus P67 Motherboard Preview
With the release of Windows 8 in October 2012, Microsoft's certification requirements now require that computers include firmware that implements the UEFI specification. Furthermore, if the computer supports the "

Connected Standby InstantGo, also known as InstantOn or Modern Standby (formerly Connected Standby), is a Microsoft specification for Windows 8 (and later) hardware and software that aims to bring smartphone-type power management capabilities to the PC platform, as ...

" feature of Windows 8 (which allows devices to have power management comparable to

smartphone A smartphone is a mobile phone with advanced computing capabilities. It typically has a touchscreen interface, allowing users to access a wide range of applications and services, such as web browsing, email, and social media, as well as multi ...

s, with an almost instantaneous return from standby mode), then the firmware is not permitted to contain a Compatibility Support Module (CSM). As such, systems that support Connected Standby are incapable of booting Legacy BIOS operating systems. In October 2017, Intel announced that it would remove legacy PC BIOS support from all its products by 2020, in favor of UEFI Class 3. By 2019, all computers based on Intel platforms no longer have legacy PC BIOS support.

Operating systems

An operating system that can be booted from a (U)EFI is called a (U)EFI-aware operating system, defined by (U)EFI specification. Here the term ''booted from a (U)EFI'' means directly booting the system using a (U)EFI operating system loader stored on any storage device. The default location for the operating system loader is /BOOT/BOOT.EFI, where short name of the machine type can be IA32, X64, IA64, ARM or AA64. Some operating systems vendors may have their own boot loaders. They may also change the default boot location. * The

has been able to use EFI at boot time since early 2000s, using the elilo EFI boot loader or, more recently, EFI versions of

. Grub+Linux also supports booting from a GUID partition table without UEFI. The distribution

added support for UEFI Secure Boot as of version 12.10. Furthermore, the Linux kernel can be compiled with the option to run as an EFI bootloader on its own through the EFI boot stub feature. *

has used (U)EFI as its boot mechanism on

IA-64 IA-64 (Intel Itanium architecture) is the instruction set architecture (ISA) of the discontinued Itanium family of 64-bit Intel microprocessors. The basic ISA specification originated at Hewlett-Packard (HP), and was subsequently implemented by ...

systems since 2002. *

has used EFI on IA-64 since its initial evaluation release in December 2003, and for production releases since January 2005. OpenVMS on x86-64 also uses UEFI to boot the operating system. *

Apple An apple is a round, edible fruit produced by an apple tree (''Malus'' spp.). Fruit trees of the orchard or domestic apple (''Malus domestica''), the most widely grown in the genus, are agriculture, cultivated worldwide. The tree originated ...

uses EFI for its line of Intel-based Macs. Mac OS X v10.4 Tiger and

Mac OS X v10.5 Mac OS X Leopard (version 10.5) is the sixth major release of macOS, Apple's desktop and server operating system for Macintosh computers. Leopard was released on October 26, 2007, as the successor of Mac OS X Tiger, and is available in two ed ...

Leopard implement EFI v1.10 in 32-bit mode even on newer 64-bit CPUs, but full support arrived with OS X v10.8 Mountain Lion. * The

versions of

Windows 2000 Windows 2000 is a major release of the Windows NT operating system developed by Microsoft, targeting the server and business markets. It is the direct successor to Windows NT 4.0, and was Software release life cycle#Release to manufacturing (RT ...

(Advanced Server Limited Edition and Datacenter Server Limited Edition; based on the pre-release

Windows Server 2003 Windows Server 2003, codenamed "Whistler Server", is the sixth major version of the Windows NT operating system produced by Microsoft and the first server version to be released under the Windows Server brand name. It is part of the Windows NT ...

codebase) implemented EFI 1.10 in 2002.

Windows XP 64-bit Edition Windows XP, which is the next version of Windows NT after Windows 2000 and the successor to the consumer-oriented Windows Me, has been released in several editions since its original release in 2001. Windows XP is available in many languages. In ...

Advanced Server Limited Edition (pre-release Windows Server 2003) and

for

, all of which are for the Intel

family of processors, implement EFI, a requirement of the platform through the DIG64 specification. * Microsoft introduced UEFI for x64 Windows operating systems with

Windows Vista SP1 Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, released five years earlier, which was then the longest time span between successive releases of Microsoft W ...

and

Windows Server 2008 Windows Server 2008, codenamed "Longhorn Server" (alternatives: "Windows Vista Server" or "Windows Server Vista"), is the seventh major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server b ...

however only UGA (Universal Graphic Adapter) 1.1 or Legacy BIOS

INT 10h INT 10h, INT 10H or INT 16 is shorthand for BIOS interrupt call 10 hex, the 17th interrupt vector in an x86-based computer system. The BIOS typically sets up a real mode interrupt handler at this vector that provides video services. Such services ...

is supported; Graphics Output Protocol (GOP) is not supported. Therefore, PCs running 64-bit versions of

, Windows Vista SP2,

Windows 7 Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on July 22, 2009, and became generally available on October 22, ...

and

Windows Server 2008 R2 Windows Server 2008 R2, codenamed "Windows Server 7" or "Windows Server 2008 Release 2", is the eighth major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server brand name. It was release ...

are compatible with UEFI Class 2. 32-bit UEFI was originally not supported since vendors did not have any interest in producing native 32-bit UEFI firmware because of the mainstream status of

64-bit computing In computer architecture, 64-bit integers, memory addresses, or other data units are those that are 64 bits wide. Also, 64-bit central processing units (CPU) and arithmetic logic units (ALU) are those that are based on processor registers, ...

finally introduced further optimizations for UEFI systems, including Graphics Output Protocol (GOP) support, a faster startup, 32-bit UEFI support, and Secure Boot support. Since

, the UEFI firmware with

protocol is a mandatory requirement for ARM-based Microsoft Windows operating systems. Microsoft began requiring UEFI to run Windows with

, with IoT Enterprise editions of Windows 11 since version 24H2 exempt from the requirement. * On 5 March 2013, the FreeBSD Foundation awarded a grant to a developer seeking to add UEFI support to the

kernel and bootloader. The changes were initially stored in a discrete branch of the FreeBSD source code, but were merged into the mainline source on 4 April 2014 (revision 264095); the changes include support in the installer as well. UEFI boot support for amd64 first appeared in FreeBSD 10.1 and for arm64 in FreeBSD 11.0. * Oracle

Solaris Solaris is the Latin word for sun. It may refer to: Arts and entertainment Literature, television and film * ''Solaris'' (novel), a 1961 science fiction novel by Stanisław Lem ** ''Solaris'' (1968 film), directed by Boris Nirenburg ** ''Sol ...

11.1 and later support UEFI boot for x86 systems with UEFI firmware version 2.1 or later.

2 is used as the boot loader on x86. *

OpenBSD OpenBSD is a security-focused operating system, security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by fork (software development), forking NetBSD ...

5.9 introduced UEFI boot support for 64-bit x86 systems using its own custom loader, OpenBSD 6.0 extended that support to include ARMv7. *

illumos Illumos (stylized as "illumos") is a partly free and open-source Unix operating system. It has been developed since 2010 and is based on OpenSolaris, after the discontinuation of that product by Oracle. It comprises a kernel, device driver ...

added basic UEFI support in October 2017. *

ArcaOS ArcaOS is a Proprietary software, proprietary operating system based on OS/2, developed and marketed by Arca Noae, LLC under license from IBM. It was first released in 2017 and builds on OS/2 Warp 4.52 by adding support for new hardware, fixing ...

supports UEFI booting since the 5.1 release. ArcaOS' UEFI support emulates specific

functionality which the operating system depends on (particularly interrupts

INT 10H INT 10h, INT 10H or INT 16 is shorthand for BIOS interrupt call 10 hex, the 17th interrupt vector in an x86-based computer system. The BIOS typically sets up a real mode interrupt handler at this vector that provides video services. Such services ...

and

INT 13H INT 13h is shorthand for BIOS interrupt call 13 hex, the 20th interrupt vector in an x86-based (IBM PC-descended) computer system. The BIOS typically sets up a real mode interrupt handler at this vector that provides sector-based hard disk and ...

With virtualization

HP Integrity Virtual Machines Integrity Virtual Machines is a hypervisor from Hewlett Packard Enterprise for HPE Integrity Servers running HP-UX. It is part of HP's Virtual Server Environment suite, and is optimized for Server (computing), server use. History Christophe de ...

provides UEFI boot on HP Integrity Servers. It also provides a virtualized UEFI environment for the guest UEFI-aware OSes. * Intel hosts an Open Virtual Machine Firmware project on SourceForge. *

VMware Fusion VMware Fusion is a software hypervisor developed by VMware for macOS systems. It allows Macs with Intel or Apple M series CPUs to run virtual machines with guest operating systems, such as Microsoft Windows, Linux, or macOS, within the host m ...

3 software for Mac OS X can boot Mac OS X Server virtual machines using UEFI. *

VMware Workstation VMware Workstation Pro (known as VMware Workstation until release of VMware Workstation 12 in 2015) is a hosted (Type 2) hypervisor that runs on x64 versions of Windows and Linux operating systems. It enables users to set up virtual machines (VM ...

prior to version 11 unofficially supports UEFI, but is manually enabled by editing the .vmx file.

version 11 and above supports UEFI, independently of whether the physical host system is UEFI-based. VMware Workstation 14 (and accordingly, Fusion 10) adds support for the

feature of UEFI. * The VMware

ESXi VMware ESXi (formerly ESX) is an enterprise-class, type-1 hypervisor developed by VMware, a subsidiary of Broadcom, for deploying and serving virtual computers. As a type-1 hypervisor, ESXi is not a software application that is installed on ...

5.0 hypervisor officially supports UEFI. Version 6.5 adds support for Secure Boot. *

VirtualBox Oracle VirtualBox (formerly Sun VirtualBox, Sun xVM VirtualBox and InnoTek VirtualBox) is a hosted hypervisor for x86 virtualization developed by Oracle Corporation. VirtualBox was originally created by InnoTek Systemberatung GmbH, which was ac ...

has implemented UEFI since 3.1, but is limited to Unix/Linux operating systems and Windows 8 and later (does not work with Windows Vista x64 and Windows 7 x64). *

QEMU The Quick Emulator (QEMU) is a free and open-source emulator that uses dynamic binary translation to emulate a computer's processor; that is, it translates the emulated binary codes to an equivalent binary format which is executed by the mach ...

/ KVM can be used with the Open Virtual Machine Firmware (OVMF) provided by

. * The second generation of the Microsoft

virtual machine supports virtualized UEFI. *

Google Cloud Platform Google Cloud Platform (GCP) is a suite of cloud computing services offered by Google that provides a series of modular cloud services including computing, Computer data storage, data storage, Data analysis, data analytics, and machine learnin ...

Shielded VMs support virtualized UEFI to enable Secure Boot.

Applications development

''EDK2 Application Development Kit'' (EADK) makes it possible to use

standard C library The C standard library, sometimes referred to as libc, is the standard library for the C programming language, as specified in the ISO C standard.ISO/ IEC (2018). '' ISO/IEC 9899:2018(E): Programming Languages - C §7'' Starting from the origin ...

functions in UEFI applications. EADK can be freely downloaded from the

's TianoCore UDK / EDK2

SourceForge SourceForge is a web service founded by Geoffrey B. Jeffery, Tim Perdue, and Drew Streib in November 1999. SourceForge provides a centralized software discovery platform, including an online platform for managing and hosting open-source soft ...

project. As an example, a port of the

Python Python may refer to: Snakes * Pythonidae, a family of nonvenomous snakes found in Africa, Asia, and Australia ** ''Python'' (genus), a genus of Pythonidae found in Africa and Asia * Python (mythology), a mythical serpent Computing * Python (prog ...

interpreter is made available as a UEFI application by using the EADK. The development has moved to GitHub since UDK2015. A minimalistic " hello, world" C program written using EADK looks similar to its usual C counterpart: #include #include #include EFI_STATUS EFIAPI ShellAppMain(IN UINTN Argc, IN CHAR16 **Argv)

Criticism

Numerous digital rights activists have protested UEFI. Ronald G. Minnich, a co-author of

, and

Cory Doctorow Cory Efram Doctorow (; born 17 July 1971) is a Canadian-British blogger, journalist, and science fiction author who served as co-editor of the blog ''Boing Boing''. He is an activist in favour of liberalising copyright laws and a proponent of th ...

, a digital rights activist, have criticized UEFI as an attempt to remove the ability of the user to truly control the computer. It does not solve the BIOS's long-standing problems of requiring two different drivers—one for the firmware and one for the operating system—for most hardware. Open-source project TianoCore also provides UEFIs. TianoCore lacks the specialized firmware drivers and modules that initialize chipset functions, but TianoCore is one of many payload options of

. The development of coreboot requires cooperation from chipset manufacturers to provide the specifications needed to develop initialization drivers.

Secure Boot

In 2011, Microsoft announced that computers certified to run its

operating system had to ship with Microsoft's public key enrolled and Secure Boot enabled, which implies that using UEFI is a requirement for these devices. Following the announcement, the company was accused by critics and free software/open source advocates (including the

Free Software Foundation The Free Software Foundation (FSF) is a 501(c)(3) non-profit organization founded by Richard Stallman on October 4, 1985. The organisation supports the free software movement, with the organization's preference for software being distributed ...

) of trying to use the Secure Boot functionality of UEFI to hinder or outright prevent the installation of alternative operating systems such as

. Microsoft denied that the Secure Boot requirement was intended to serve as a form of lock-in, and clarified its requirements by stating that x86-based systems certified for Windows 8 must allow Secure Boot to enter custom mode or be disabled, but not on systems using the

ARM architecture ARM (stylised in lowercase as arm, formerly an acronym for Advanced RISC Machines and originally Acorn RISC Machine) is a family of reduced instruction set computer, RISC instruction set architectures (ISAs) for central processing unit, com ...

allows OEMs to decide whether or not Secure Boot can be managed by users of their x86 systems. Other developers raised concerns about the legal and practical issues of implementing support for Secure Boot on Linux systems in general. Former

Red Hat Red Hat, Inc. (formerly Red Hat Software, Inc.) is an American software company that provides open source software products to enterprises and is a subsidiary of IBM. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North ...

developer

Matthew Garrett Matthew Garrett is an Irish technologist, programmer, and free software activist who is a major contributor to a series of free software projects including Linux, GNOME, Debian, Ubuntu, and Red Hat. He has received the Free Software Award fr ...

noted that conditions in the GNU General Public License version 3 may prevent the use of the GNU GRand Unified Bootloader without a distribution's developer disclosing the private key (however, the

has since clarified its position, assuring that the responsibility to make keys available was held by the hardware manufacturer), and that it would also be difficult for advanced users to build custom

kernel Kernel may refer to: Computing * Kernel (operating system), the central component of most operating systems * Kernel (image processing), a matrix used for image convolution * Compute kernel, in GPGPU programming * Kernel method, in machine learnin ...

s that could function with Secure Boot enabled without self-signing them. Other developers suggested that signed builds of Linux with another key could be provided, but noted that it would be difficult to persuade OEMs to ship their computers with the required key alongside the Microsoft key. Several major Linux distributions have developed different implementations for Secure Boot. Garrett himself developed a minimal bootloader known as a shim, which is a precompiled, signed bootloader that allows the user to individually trust keys provided by Linux distributions. Ubuntu 12.10 uses an older version of shim pre-configured for use with

Canonical The adjective canonical is applied in many contexts to mean 'according to the canon' the standard, rule or primary source that is accepted as authoritative for the body of knowledge or literature in that context. In mathematics, ''canonical exampl ...

's own key that verifies only the bootloader and allows unsigned kernels to be loaded; developers believed that the practice of signing only the bootloader is more feasible, since a trusted kernel is effective at securing only the

user space A modern computer operating system usually uses virtual memory to provide separate address spaces or regions of a single address space, called user space and kernel space. This separation primarily provides memory protection and hardware prote ...

, and not the pre-boot state for which Secure Boot is designed to add protection. That also allows users to build their own kernels and use custom

kernel module A loadable kernel module (LKM) is an executable library that extends the capabilities of a running kernel, or so-called ''base kernel'', of an operating system. LKMs are typically used to add support for new hardware (as device drivers) and/or ...

s as well, without the need to reconfigure the system. Canonical also maintains its own private key to sign installations of Ubuntu pre-loaded on certified OEM computers that run the operating system, and also plans to enforce a Secure Boot requirement as wellrequiring both a Canonical key and a Microsoft key (for compatibility reasons) to be included in their firmware.

also uses shim, but requires that both the kernel and its modules be signed as well. shim has Machine Owner Key (MOK) that can be used to sign locally-compiled kernels and other software not signed by distribution maintainer. It has been disputed whether the operating system kernel and its modules must be signed as well; while the UEFI specifications do not require it, Microsoft has asserted that their contractual requirements do, and that it reserves the right to revoke any certificates used to sign code that can be used to compromise the security of the system. In Windows, if Secure Boot is enabled, all kernel drivers must be digitally signed; non-WHQL drivers may be refused to load. In February 2013, another Red Hat developer attempted to submit a patch to the Linux kernel that would allow it to parse Microsoft's authenticode signing using a master

X.509 In cryptography, X.509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secure ...

key embedded in PE files signed by Microsoft. However, the proposal was criticized by Linux creator

Linus Torvalds Linus Benedict Torvalds ( , ; born 28 December 1969) is a Finnish software engineer who is the creator and lead developer of the Linux kernel. He also created the distributed version control system Git. He was honored, along with Shinya Yam ...

, who attacked Red Hat for supporting Microsoft's control over the Secure Boot infrastructure. On 26 March 2013, the

Spanish Spanish might refer to: * Items from or related to Spain: **Spaniards are a nation and ethnic group indigenous to Spain **Spanish language, spoken in Spain and many countries in the Americas **Spanish cuisine **Spanish history **Spanish culture ...

free software development group Hispalinux filed a formal complaint with the

European Commission The European Commission (EC) is the primary Executive (government), executive arm of the European Union (EU). It operates as a cabinet government, with a number of European Commissioner, members of the Commission (directorial system, informall ...

, contending that Microsoft's Secure Boot requirements on OEM systems were "obstructive" and

anti-competitive Anti-competitive practices are business or government practices that prevent or reduce competition in a market. Antitrust laws ensure businesses do not engage in competitive practices that harm other, usually smaller, businesses or consumers. ...

. At the Black Hat conference in August 2013, a group of security researchers presented a series of exploits in specific vendor implementations of UEFI that could be used to exploit Secure Boot. In August 2016 it was reported that two security researchers had found the "golden key" security key Microsoft uses in signing operating systems. Technically, no key was exposed, however, an exploitable binary signed by the key was. This allows any software to run as though it was genuinely signed by Microsoft and exposes the possibility of

rootkit A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exist ...

and

bootkit A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exist ...

attacks. This also makes patching the fault impossible, since any patch can be replaced (downgraded) by the (signed) exploitable binary. Microsoft responded in a statement that the vulnerability only exists in

and

Windows RT Windows RT is a mobile operating system developed by Microsoft and released alongside Windows 8 on October 26, 2012. It is a version of Windows 8 or Windows 8.1 built for the 32-bit ARM architecture (ARMv7), designed to take advantage of th ...

devices, and has released two patches; however, the patches do not (and cannot) remove the vulnerability, which would require key replacements in end user firmware to fix. On March 1, 2023, researchers from ESET Cybersecurity Firm reported "The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot" named ‘BlackLotus’ in their public analyses findings describing the theory behind its mechanics exploiting the patches that "do not (and cannot) remove the vulnerability". In August 2024, the

and

security updates applied the Secure Boot Advanced Targeting (SBAT) settings to device's UEFI NVRAM, which caused some Linux distributions to fail to load. SBAT is a protocol that supported in new versions of

and shim, which refuse buggy or vulnerable intermediate bootloaders (usually older versions of Windows Boot Manager and

) to load in the boot process. The change was reverted the next month. Many

Linux distributions A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel (operating system), kernel functionality. Although the name does not imply distribution (marketing), product distribution pe ...

support UEFI Secure Boot , such as

RHEL Red Hat Enterprise Linux (RHEL) is a commercial Linux distribution developed by Red Hat. Red Hat Enterprise Linux is released in server versions for x86-64, Power ISA, ARM64, and IBM Z and a desktop version for x86-64. Fedora Linux and CentOS St ...

(RHEL 7 and later),

CentOS CentOS (, from Community Enterprise Operating System; also known as CentOS Linux) is a discontinued Linux distribution that provided a free and open-source community-supported computing platform, functionally compatible with its upstream (softw ...

(CentOS 7 and later),

Debian Debian () is a free and open-source software, free and open source Linux distribution, developed by the Debian Project, which was established by Ian Murdock in August 1993. Debian is one of the oldest operating systems based on the Linux kerne ...

(Debian 10 and later),

OpenSUSE openSUSE () is a free and open-source software, free and open-source Linux distribution developed by the openSUSE project. It is offered in two main variations: ''Tumbleweed'', an upstream rolling release distribution, and ''Leap'', a stable r ...

, and

SUSE Linux Enterprise SUSE Linux Enterprise (SLE) is a Linux-based operating system developed by SUSE. It is available in two editions, suffixed with Server (SLES) for servers and mainframes, and Desktop (SLED) for workstations and desktop computers. Its major ve ...

Firmware problems

The increased prominence of UEFI firmware in devices has also led to a number of technical problems blamed on their respective implementations. Following the release of Windows 8 in late 2012, it was discovered that certain

Lenovo Lenovo Group Limited, trading as Lenovo ( , zh, c=联想, p=Liánxiǎng), is a Chinese multinational technology company specializing in designing, manufacturing, and marketing consumer electronics, personal computers, software, servers, conv ...

computer models with Secure Boot had firmware that was hardcoded to allow only executables named "

" or "

Red Hat Enterprise Linux Red Hat Enterprise Linux (RHEL) is a commercial Linux distribution developed by Red Hat. Red Hat Enterprise Linux is released in server versions for x86-64, Power ISA, ARM64, and IBM Z and a desktop version for x86-64. Fedora Linux and ...

" to load, regardless of any other setting. Other problems were encountered by several

Toshiba is a Japanese multinational electronics company headquartered in Minato, Tokyo. Its diversified products and services include power, industrial and social infrastructure systems, elevators and escalators, electronic components, semiconductors ...

laptop models with Secure Boot that were missing certain certificates required for its proper operation. In January 2013, a bug surrounding the UEFI implementation on some

Samsung Samsung Group (; stylised as SΛMSUNG) is a South Korean Multinational corporation, multinational manufacturing Conglomerate (company), conglomerate headquartered in the Samsung Town office complex in Seoul. The group consists of numerous a ...

laptops was publicized, which caused them to be

bricked A brick (or bricked device) is a mobile device, game console, router, computer or other electronic device that is no longer functional due to corrupted firmware, a hardware problem, or other damage. The term analogizes the device to a brick ...

after installing a Linux distribution in UEFI mode. While potential conflicts with a kernel module designed to access system features on Samsung laptops were initially blamed (also prompting kernel maintainers to disable the module on UEFI systems as a safety measure), Matthew Garrett discovered that the bug was actually triggered by storing too many UEFI variables to memory, and that the bug could also be triggered under Windows under certain conditions. In conclusion, he determined that the offending kernel module had caused kernel message dumps to be written to the firmware, thus triggering the bug.

Notes

References

External links

*
UEFI Specifications

Intel-sponsored open-source EFI Framework initiative

Microsoft UEFI Support and Requirements for Windows Operating Systems

How Windows 8 Hybrid Shutdown / Fast Boot feature works

Securing the Windows 10 Boot Process

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
{{Firmware and booting Articles with example C code

History

Advantages

Compatibility

Processor compatibility

Disk device compatibility

Linux

Microsoft Windows

Features

Services

Applications

Protocols

Device drivers

Graphics features

EFI system partition

Booting

UEFI booting

CSM booting

Network booting

Secure Boot

UEFI shell

Commands

Extensions

UEFI Capsule

Hardware

Classes

Boot stages

SEC – Security Phase

Responsibilities

PEI – Pre-EFI Initialization

PEI Foundation

PEI Dispatcher

Pre-EFI Initialization modules

PEIMs-to-PEIMs Interfaces

DXE – Driver Execution Environment

BDS – Boot Device Select (Boot Manager)

TSL – Transient System Load

RT – Runtime

Usage

Implementations

Platforms

Operating systems

With virtualization

Applications development

Criticism

Secure Boot

Firmware problems

See also

Notes

References

Further reading

External links