I know that firmware (and software in general) has bugs. But I wonder why modern firmware for UEFI has to be so complex, that it needs updates on a regular basis. It would be nice to have a dead-simple hardware-initialisation system that doesn't need regular updates and that only has very limited attack surface.

▲

wedemmoez 5 hours ago | parent | next [-]

That is the dream isn't it? But there's no such thing since even a simple one that requires no updates would have some sort of vulnerability that needs an update, and the cycle continues.

▲

vaylian 5 hours ago | parent [-]

I agree. But we could still try to have a smaller hardware initialisation system. And if there is the occasional need to patch a security vulnerability, then that patch is probably a lot more straightforward.

	▲	mixmastamyk 4 hours ago \| parent [-]
		UEFI is it’s own OS, but Apple went back to minimal firmware.

▲

doublepg23 4 hours ago | parent | prev | next [-]

SeaBIOS on a Coreboot laptop is pretty minimal. Paltry CPU speeds on anything that supports it nowadays, but fun for a beater system.

▲

vaylian 3 hours ago | parent [-]

Coreboot looks promising. Do you know why the CPU speeds are so bad? And do they get better once the main operating system starts up?

	▲	doublepg23 an hour ago \| parent [-]
		Not a hardware engineer so feel free to fact-check all of this. My understanding is Coreboot is a minimum-viable firmware implementation to get your hardware initialized ... and not much else. Once Coreboot is ready you then use "Payloads". Payloads can be as varied as booting into Linux directly, GRUB directly, or a whole UEFI/BIOS implementation. SeaBIOS is a whole FOSS BIOS implementation (commonly used for emulators like QEMU) and is somewhat tractable according to my prior research (~50k lines of C). My comment about CPU support is due to modern systems using UEFI - the payload for that is TianoCore EDK2. It's quite large (900k+ lines) and while it has much more eyes on it, if minimalism is what you're looking for I doubt it would qualify. That leaves you with systems from before ~2013 or so - assuming you can even flash Coreboot to them, which only supports a handful of systems. I suppose you could just jump into Linux though. Perhaps it's silly to do anything else.

▲

xvfLJfx9 4 hours ago | parent | prev [-]

Regular updates are not always because of bugs but to support new hardware. Or security fixes.

	▲	vaylian 3 hours ago \| parent [-]
		If the update is only for supporting new hardware, then there is usually no benefit to the user. They already have a machine that is supported by a previous firmware version. Only in those cases where a user upgrades the hardware there might be a benefit. Why can't the BIOS/UEFI offer some basic initialisation functionality and then the OS (Linux, Windows, ...) does a more advanced initialisation? Why does it have to be so complicated?