Say goodbye to BIOS — and hello to UEFI!

[rpetery05]

Thanks to Woody for the article, but no mention seems to be made anywhere about how this will affect those of us who are long-term (forever?) users of Windows XP. (My former girlfriend once said that she would keep XP until they pry her cold, dead fingers off it). Amen.

So presuming that XP may not work with UEFI, we will have to trust the hardware mfrs. to include both on future mobos, etc.? There is already a similar problem out there, i.e., pre-SP3 XP doesn't work with a number of things, including some mobos.

And I would agree heartily that Microsoft should be kept away from tinkering with UEFI, forcibly if necessary (do they ever learn to stop trying to monopolize)? The question is how - bring the feds in again? Uhh, they didn't do a great job the the SOPA, etc. thing, hey?

So, XP'ers, rise up!

[xox101]

It is the fact that MS have the the power to dictate to manufacturers and suppliers which digital signature is allowed on the machines they either sell or ship that I object to, not the UEFI itself. Just who is going to ensure that MS do not end up with total control over the OS in your newly built or purchased PC or laptop?

At the moment about the only way you can buy a PC and avoid the MS tax is by building it yourself from separately bought components. If motherboards are to have UEFI installed at build time are the motherboard manufacturers going to have to install the digital signature as well before the buyer can install Windows? But what if I buy a motherboard plus other components to build a low power Linux machine for a family member to do their online banking etc with? Do I have to then ask MS for a digital signature before I can install the OS of my choice? Or do I have to compile said signature myself? Will I have to pay extra for the signature or is it up to the different Linux distributions to compile their own? And if so why?

Microsoft is an American software company. They should have absolutely nothing to do with deciding which OS is to be allowed to run on hardware. That is not within their remit and this idea should be stopped by law if necessary! Or do monopoly laws not apply in the US?

At the moment it is almost impossible to buy a laptop without Windows preinstalled although it is easy to remove said Windows install and replace it with the OS of your choice. If this digital signature idea is allowed to come to fruition then installing the OS YOU want may become impossible!

As I said earlier I am typing this on my Asus K72j which runs Windows 7 Pro. It also has an option in the BIOS to run UEFI off the hard drive which I have no intention of investigating as sometime in the future this laptop will be put out to pasture and have a variation of Linux installed while my copy of Windows (bought separately) will be reinstalled on a newer laptop. That is called freedom of choice!

MS should be slapped down hard and told to think again.

And the rootkit question is far from answered. Simply saying that UEFI will solve problems from rootkits is nonsense! Any software installed on the system drive is open to the same malware threats the installed OS is open to. And malware is the reason both my elderly parents laptops had Windows removed and Linux Mint installed. So I don't have to worry about them being compromised while doing their online banking. Again something that might prove difficult if not impossible if MS get their way.

SOPA will be back so stay vigilant or else we will end up with a fragmented internet under the corporations control.

[gary.sparks]

Am I missing something here? It sounds like the hardware manufacturers are adopting a method to validate signed boot code via a certificate, and with the exception of Win8 ARM tablets, will provide a method of turning off that validation if the user so chooses. I don't see that as exceptionally onerous, and I agree it would be a great tool in the anti-malware arsenal.

I guess as an IT director, my concern is in a corporate environment, getting all those devices out to the 'Net to make that validation, since we generally tie 'Net access to an authenticated user and not to a device. I wouldn't necessarily want to turn off the validation because of the benefit it provides, but will have to know more about where the validation will go (Verisign? Thawte? GoDaddy?)

I do see where some homebrews and other small distros will have a challenge of having to go through the certificate process, but wouldn't that be targeting the same audience that would likely turn off secure boot anyway?

[mmowens]

Really, the end user has no business looking in the BIOS or any replacement for it (UEFI). Most "Power Users" should only be modifying things like to boot order, or simply opening and saving the BIOS settings to register simple configuration changes such as the addition or RAM or drives.

For the more technically knowledgeable, modern BIOS has enabled us to change many settings without opening the case and moving jumpers about. And BIOS updates today are generally simple and painless to perform. Other than possibly making it easier to create a hackintosh, I don't see any real advantage to UEFI. People have been making viruses that get installed into BIOS and / or CMOS for decades. Surely UEFI can be targeted as well.

The UEFI screen shot is most unappealing!! Any person looking in there should NOT want sliders, dials, fancy colors, or any non-text GUI. People who want that in their BIOS / UEFI configuration have no business even looking at it. All the necessary information has always been conveyed most clearly in a regular text-based UI. (Of course there have been instances of language barriers; however replacing text with fancy UI gizmos isn't an appropriate fix, when a recent high school or college grad can be hired cheaply to correct spelling and grammatical errors. (That this has never been done is beside the EFI vs. BIOS discussion.)

For those of us worried about Microsoft preventing us from installing other operating systems, the answer is simply to build the machine yourself, or buy one from a manufacturer such, as Lenovo, already committed to Linux.

The main thing that would concern me more would be getting locked out of useful and important settings; however some PC manufacturers, such as Dell, have effectively locked us out of many settings. On Apple machines, you can't directly interact with the EFI settings at all. Not that this has in any way prevents you from installing a different OS on an Apple computer (at least not since the late 80s -- not sure before that)
For those who want Linux but are unable to build their own machine, there are plenty of good manufacturers (such as Lenovo, last I checked) out there selling PCs with Linux pre-installed. These manufacturers are not going to give up on Linux just because of UEFI.

I think people are really making a much-ado about nothing. Better to spend your time worrying about SOPA and PIPA right now!

[jen7677]

Is there a way that older computers would be able to use UEFI instead of their BIOS? I mean my computer is not too terribly old really. I got in 2008. I have an Asus motherboard that came with it. I custom built it so I could upgrade it whenever and however I like but just am wondering if I would somehow be able to use the UEFI and put it on my system or not. I like the way it looks personally and love that it will help things load faster. Been considering getting an SSD but I don't think they are very big yet so may have to wait but like too that those also help load times. Anyways great and informative article as always!

[AConcernedCitizen]

And the UEFI documentation is mostly hidden so that we will have no way to see what's happening. This is goodbye to our computers.

Not trying to start a flame war here, but the UEFI documentation is freely available at www.uefi.org. As for keeping it simple, yes, in one way, a UEFI based BIOS is more complex that the original IBM PC BIOS. However, a recent non-UEFI based BIOS is way more complex and difficult to maintain. The current non-UEFI BIOSs are based on proprietary code that is poorly documented, hand crafted, and maintained way past their original creators expectations.

There are several books available that go into a whole lot of detail about how to create a UEFI based BIOS. In fact, a partial open source UEFI BIOS is available at www.tianocore.org. That said, yes, Intel is behind a lot of UEFI, as well as a lot of other companies (including Apple, ARM, Canonical Limited, Qualcomm as examples of non-Microsoft and non-Intel companies).

[AConcernedCitizen]

You should be able to install Windows XP on most of the crop of new computers. None of the manufacturers of those computers tested them with Win 8, so your result will vary. I've installed it onto my notebook that originally was purchased with WinXP installed. However, it is up to the manufacturer of your proposed future computer to decide which older OSs will be supported. It's possible they will decide to stop supporting old OSs at some point. If you really want WinXP supported, you should buy a computer where they are willing to test and state that it still works. As far as I know, it's very difficult to find a machine that still supports some of the really old versions of Windows, like Windows 3.11 or MS-DOS. So if you care, ask before you buy.

As Woody said, there is a way to turn off the new Secure Boot.

You probably will not be able to run Windows XP on the ARM machines. The processor code is just too different. Of course, you can't really run Windows XP on an iPad either. I do expect someone to create some type of virtual machine like Oracle's VirtualBox for the ARM tablets someday to run some WinXP era software, but that's just a guess (or a business idea for someone :-).

[AConcernedCitizen]

Again, not trying to start a flame war here, but as Woody said, it is a Microsoft requirement for new PCs to have a way to disable the Secure Boot feature and allow the machine's owner to install anything they want.

The current Microsoft requirements are available on their website if you want to check on what I'm saying. Check item 20 of System.Fundamentals.Firmware.UEFISecureBoot.

That said, if you don't like part of the requirements, continue to comment because that is the only way that Microsoft will know that end users don't like something.

[AConcernedCitizen]

The real question is, do you care?

UEFI is basically an interface between the OS and the hardware. Contrary to this article, it's not a graphical user interface for a setup program. Most of the BIOS companies had a graphical setup program available for their non-UEFI BIOSs. It's just that the cost of BIOS storage was too much for the manufacturers to justify putting extra on the motherboard to hold the extra code.

If you really want to know, you can look around in your setup program. Usually the word UEFI shows up somewhere in one of the boot related menus.

[AConcernedCitizen]

Chances are your two year old Toshiba Satellite supports an older version of the UEFI specification. For Windows 8 to support Secure Boot and the UEFI interfaces, your BIOS will have to support the latest UEFI 2.3.1 standard.

Otherwise, Windows 8 will continue to use the older legacy BIOS interfaces that were used by Windows XP and Windows 7.

[AConcernedCitizen]

One question, well maybe one and a half: Will it be possible to dual boot Win 8 and Dos 6x on same desktop? If so, will Autocad R-12c4 (which uses the 386 Parlap dos extender) be able to run on it?

It should be possible to add the hash of FreeDOS to your db on your new Win 8 notebook and I would expect the Parlap DOS extender to work. However, you won't have a parallel port to plug in the Autocad security dongle. Or does R-12c4 not require the security dongle?

[AConcernedCitizen]

If the whole purpose of this article was to get me to finally register after years of reading my paid subscription, then it worked.

Thanks!

[AConcernedCitizen]

Am I missing something here? ... I guess as an IT director, my concern is in a corporate environment, getting all those devices out to the 'Net to make that validation, ...

The average Windows 8 machine will not be checking certificates online. It would take way too much time for the BIOS to setup a network stack, connect to the network, work out wireless setups, manage proxies, support VPN, 3G, and all of the more wild parts of the internet. The BIOSs will have a list of valid and invalid certificates. As an IT director, it will be possible for you to setup some special settings for YOUR users that will allow them easier boots when they are wired to YOUR network. There are some changes to bitlocker, for example, that will reduce the need for your users to have a bitlocker dongle or to enter their PIN when they boot their machines.

Maybe the future will bring a day when the BIOS can support a full wired network stack or maybe even a full wireless network stack. But that day doesn't arrive with Windows 8.

[AConcernedCitizen]

It is practically impossible for to update from a legacy BIOS to a UEFI BIOS. However, there is a remote possibility that your motherboard vendor would have an update that would update your motherboard's BIOS to enable the new UEFI 2.3.1 features required for Windows 8 certification. I can't image them doing that, but it's certainly possible.

For example, there is an Intel motherboard that can be updated to support the new UEFI 2.3.1 standards. But that's a real special case.

[AConcernedCitizen]

If the whole purpose of this article was to get me to finally register after years of reading my paid subscription, then it worked.

Thanks!

By the way, if anyone is interested in learning more about the new Secure Boot feature or anything else in UEFI, there are a lot of free presentations available at http://www.uefi.org/learning_center/ . However, some of the proposals that were presented at UEFI Plugfests back in 2007 were just proposals and never made it into a standard. But you would have to be pretty into UEFI to care about some of them.