41–50 of 108 posts
This made me wonder if somebody got Doom to run under UEFI, and sure enough: https://github.com/Cacodemon345/uefidoom/
A friend of mine ported QEMU in order to run x86 boot ROMs on ARM systems.
Earlier quoted context omitted.
> The UEFI is persistently running at the background, has communication pipes with the OS this isn't true, it ceases running once it transfers execution you're thinking of the SMM, which is something else entirely
SMM is also part of the firmware, it is set up by UEFI.
that's it's job
it's not the fault of the UEFI as a standard or implementation that your processor manufacturer chose to require the SMM to have its firmware loaded to boot
the UEFI also isn't suddenly persistent because there are other devices inside the machine that had firmware loaded into them (would you say the UEFI is persistent because it uploaded new third-party supplied microcode into the CPU?)
Earlier quoted context omitted.
> this would be difficult without a network stack This was possible with Ethernet cards with boot ROMs for more than two decades. Network booting via UEFI is nothing new, nothing revolutionary. I've been installing fleets of servers with PCI ethernet cards w/ boot ROMs a decade before. Token ring systems were booting from network two decades before.
what's the difference between having the code running in ring0 in a ROM vs the code running in ring0 from UEFI?
I'm impressed when they have VirtualBox or qemu running in UEFI, sandboxing my real OS.
Why would you want qemu running in UEFI, rather than have qemu booted from UEFI? (more specifically run qemu on xen booted from UEFI, I think is what you'd want).
Earlier quoted context omitted.
what's the difference between having the code running in ring0 in a ROM vs the code running in ring0 from UEFI?
There's a huge difference. The network card does not need unrestricted access to the entire system.
exactly the same as the UEFI
TIL: It's possible for UEFI code to access the internet. What could possibly go wrong?
Earlier quoted context omitted.
customers want to be able to boot their machines off the network this would be difficult without a network stack if you're so inclined: you can remove unneeded modules from your UEFI firmware
> if you're so inclined: you can remove unneeded modules from your UEFI firmware this is so disingenuous as to be offensive. I'm not saying you're wrong, but the practical options for replacing a UEFI BIOS are vanishingly small. Also: booting over the network is a feature of a smaller ROM on a network card, that ROM usually had a much smaller surface area and had to be explicitly called as a boot option. Given the pe…
Earlier quoted context omitted.
What’s scary about UEFI is that it has both direct hardware access and a massive attack surface: GUI, Ethernet stack, occasionally an 802.11 stack, etc.
customers want to be able to boot their machines off the network this would be difficult without a network stack if you're so inclined: you can remove unneeded modules from your UEFI firmware
I’ll bite.
How, concretely, do I do this? What’s the procedure to follow? How can I get the new BIOS image signed, so my motherboard will accept it?
TIL: It's possible for UEFI code to access the internet. What could possibly go wrong?
Wasn't it always possible? If it can boot a full-blown OS that can access the internet, it has to be able to access the internet on its own.
Also, it's possible to remove the ip stack from most UEFI implementations?
Now, it does need a network stack if it's going to _boot_ the other OS from the network.
Earlier quoted context omitted.
customers want to be able to boot their machines off the network this would be difficult without a network stack if you're so inclined: you can remove unneeded modules from your UEFI firmware
> if you're so inclined: you can remove unneeded modules from your UEFI firmware I’ll bite. How, concretely, do I do this? What’s the procedure to follow? How can I get the new BIOS image signed, so my motherboard will accept it?
they don't need to be signed
or you can dig through the manufacturers official documentation (often accessible behind NDA)
don't blame me if you brick your hardware