Firmware
termCode stored in a chip of a device and run from its processor's reset vector, or as an extension of other firmware.
Firmware is the set of instructions a device's own processor runs, like any program; what sets it apart is where it runs and how it fails. Boot firmware runs first at power-on and loads the operating system, a new image often takes effect only after a reset, and a corrupted one can leave a server or switch unable to boot at all.
NIST SP 800-193 (May 2018) defines firmware as code in a chip that sits at its processor's reset vector or extends other firmware, such as expansion ROMs. A platform has many such devices: besides the boot firmware, storage and network controllers, graphics processors and service processors carry their own. NIST SP 800-147 (April 2011) calls the system BIOS the first software the main CPU runs at power-on: it initialises and tests the hardware, may load CPU microcode patches and loads the operating system. UEFI 2.10 (2022) specifies its interface to the OS loader.
Firmware used to be rarely changed in the field; SP 800-193 notes that updates grew more common with its complexity. Only authentic, authorised images should be applied: a Root of Trust for Update checks a digital signature against its key store, and a version check can refuse a rollback to older firmware with known vulnerabilities. UEFI's Firmware Management Protocol reports each image's LowestSupportedImageVersion and flags images that need a device reset.
An attack on platform firmware can render a system inoperable, perhaps permanently or until the manufacturer reprograms it, and losing one device that is crucial to booting can stop the whole platform. SP 800-193 therefore asks for protection, detection and recovery: manual recovery by someone physically present who writes a known good image, or automatic recovery from a backup image kept apart, for example in a second flash chip.
Also known as: fw, device firmware, image, firmware image, firmware update
Sources
- NIST SP 800-193, Platform Firmware Resiliency Guidelines, May 2018: Abstract, sections 1, 2.1, 2.2.1, 3.1, 3.2, 3.5, 3.5.1, 3.5.2 and Appendix B (read 2026-10-19)
- NIST SP 800-147, BIOS Protection Guidelines, April 2011: Executive Summary and section 2.1 (read 2026-10-19)
- UEFI Specification 2.10, chapter 1, Introduction, 2022: sections 1 and 1.6 (read 2026-10-19)
- UEFI Specification 2.10, chapter 23, Firmware Update and Reporting, 2022: section 23.1.2, LowestSupportedImageVersion and Image Attribute Definitions (read 2026-10-19)