What Is UEFI?

UEFI, the Unified Extensible Firmware Interface, is the firmware that runs first when a computer powers on. It tests and initialises the processor, memory and chipset, finds a bootable device and starts the operating system’s bootloader. The specification is published by the UEFI Forum, an industry group that took over Intel’s Extensible Firmware Interface in 2005.

UEFI is a specification, not a single product. Firmware vendors such as AMI, Insyde and Phoenix write the code, and board makers customize it. Open-source implementations based on EDK II are common on Arm and embedded boards, including NVIDIA Jetson, which moved to UEFI from JetPack 5.

Once the hardware is ready, UEFI reads a list of boot entries stored in non-volatile memory (NVRAM). Each entry points to a file on the EFI System Partition (ESP), a small FAT32 partition on the system disk. UEFI loads that file and runs it. Because the firmware understands file systems and partitions, it can boot several operating systems from one disk without the workarounds the old BIOS needed.

A bootloader is the small program that sits between the firmware and the operating system. It finds the operating system kernel, loads it into memory with any settings it needs, and hands over control. On UEFI systems the bootloader is an ordinary .efi file, such as Windows Boot Manager or GRUB and systemd-boot on Linux.

Embedded boards often use a different chain. Many Arm systems start with a vendor first-stage loader, then U-Boot or a UEFI build, then the Linux kernel. That chain is part of the board’s board support package and its role in bringing up Linux, and it is why a custom carrier board needs firmware adapted to its hardware.

The legacy BIOS dates from the original IBM PC of 1981. It starts the processor in 16-bit mode, reads a single 512-byte sector from the disk and runs whatever code it finds there. That design limits it to MBR disks of about 2 TiB and gives it no way of checking that the boot code is genuine.

Many boards kept a Compatibility Support Module (CSM) so that they could still boot in legacy mode. Intel stopped providing it on its client processors around 2020, and most current industrial boards ship UEFI-only or with CSM switched off. Older operating systems that need legacy boot, such as 32-bit Windows 7 images, are the main reason to keep CSM on a legacy system.

Firmware runs before any antivirus or operating system protection, so malware that hides there is hard to find and survives a reinstall. UEFI’s answer is Secure Boot: the firmware checks the digital signature of every bootloader and driver against keys stored in the firmware and refuses anything that is not signed by a trusted key.

Secure Boot works alongside a TPM 2.0 security chip, which measures each boot stage. The TPM records a hash of each stage, so disk encryption such as BitLocker releases its key only when the boot chain has not changed. Microsoft requires UEFI with Secure Boot capability and TPM 2.0 for Windows 11, and recommends both for Windows IoT Enterprise industrial PCs.

On a desktop PC the UEFI setup screen is rarely opened. On an industrial or embedded computer it decides how the system behaves on site, so it is part of the build. Typical settings to fix before deployment include:

We configure the UEFI settings of every industrial PC we supply as standard, including boot order, power recovery and Secure Boot, and image the operating system before it ships. Tell us how the system will be powered and managed on site, and we will set the firmware to match.