4 ms·

I wasn't aware that UEFI provided an execution environment. Are applications sandboxed or restricted in any way?

detaro 8y ago
No, they are not. Which makes sense, given it's intended for things like bootloaders, hardware diagnostics, etc which will need full access to the system.
josteink 8y ago
UEFI execution environment is definitely there. And it’s mainly used to execute OS-loaders. Some firmwares even come with a MS-DOS like UEFI shell.
- gmueckl 8y ago
  The UEFI shell is just another regular UEFI binary. If you put it in the place where bootloaders are expected to live, the UEFI ROM should be able to start it like a regular OS.
matheusmoreira 8y ago
They run in ring -2. Proprietary software with networking stacks, file systems, device drivers, web servers, all running in a mode more privileged than the operating system. There's also the Intel Management Engine with pretty much the same features but running in ring -3. https://www.youtube.com/watch?v=iffTJ1vPCSo https://www.youtube.com/watch?v=iffTJ1vPCSo
- als0 8y ago
  Only SMM drivers run in the proverbial "ring -2". Ordinary UEFI apps run at the same privilege level as the host OS (0), just like any bootloader.
georgyo 8y ago
They have a lot of power, and plugging something like a thunderbolt device in can load an option ROM that runs there [1]. It is one of the reasons linuxboot is such an important project [2]. There is a great talk on why linuxboot is required [3]. [1] https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike [2] https://www.linuxboot.org https://www.linuxboot.org [3] https://trmm.net/LinuxBoot_34c3 https://trmm.net/LinuxBoot_34c3
aeorgnoieang 8y ago
Did you mean something by "execution environment" that wouldn't allow arbitrary programs to run but would allow bootloaders? I'd imagine the simplest way to run bootloaders would be to just run them like anything else.

No, they are not. Which makes sense, given it's intended for things like bootloaders, hardware diagnostics, etc which will need full access to the system.

josteink 8y ago

UEFI execution environment is definitely there. And it’s mainly used to execute OS-loaders. Some firmwares even come with a MS-DOS like UEFI shell.

gmueckl 8y ago
The UEFI shell is just another regular UEFI binary. If you put it in the place where bootloaders are expected to live, the UEFI ROM should be able to start it like a regular OS.

matheusmoreira 8y ago

They run in ring -2. Proprietary software with networking stacks, file systems, device drivers, web servers, all running in a mode more privileged than the operating system. There's also the Intel Management Engine with pretty much the same features but running in ring -3. https://www.youtube.com/watch?v=iffTJ1vPCSo https://www.youtube.com/watch?v=iffTJ1vPCSo

als0 8y ago
Only SMM drivers run in the proverbial "ring -2". Ordinary UEFI apps run at the same privilege level as the host OS (0), just like any bootloader.

georgyo 8y ago

They have a lot of power, and plugging something like a thunderbolt device in can load an option ROM that runs there [1]. It is one of the reasons linuxboot is such an important project [2]. There is a great talk on why linuxboot is required [3]. [1] https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike [2] https://www.linuxboot.org https://www.linuxboot.org [3] https://trmm.net/LinuxBoot_34c3 https://trmm.net/LinuxBoot_34c3

aeorgnoieang 8y ago

Did you mean something by "execution environment" that wouldn't allow arbitrary programs to run but would allow bootloaders? I'd imagine the simplest way to run bootloaders would be to just run them like anything else.