How UEFI Hardware Diagnostics Interface with RAM

Embedded UEFI hardware diagnostics interface with system RAM by executing at the firmware level before the operating system boots, utilizing direct physical addressing, firmware memory maps, and CPU memory controller configurations. By bypassing the virtual memory layers, abstraction, and drivers of a traditional operating system, these low-level diagnostic tools interact directly with the memory controller and the physical DRAM modules. This article explains the exact mechanisms UEFI uses to initialize, map, isolate, and test system RAM during pre-boot diagnostics.

Cache-as-RAM and the Pre-EFI Initialization (PEI) Phase

Before system RAM can be accessed or tested, the memory subsystem must be initialized. In the earliest stages of the boot process—the Security (SEC) and Pre-EFI Initialization (PEI) phases—physical DRAM is not yet operational.

To execute diagnostic routines before RAM is online:

  • Cache-as-RAM (CAR): The CPU’s L1/L2 caches are configured in "No-Eviction Mode" to serve as temporary execution space and stack memory.
  • Memory Reference Code (MRC): The UEFI executes manufacturer-specific MRC to negotiate timings, voltages, and frequency with the physical DIMMs via the Serial Presence Detect (SPD) chip over an I2C or SMBus interface.
  • Early BIST Execution: Built-In Self-Tests (BIST) embedded in the CPU and early memory training patterns run immediately to establish reliable communication between the integrated Memory Controller (IMC) and the DRAM chips.

Transition to Physical Addressing in DXE

Once the MRC completes training and initializes the memory bus, the UEFI enters the Driver Execution Environment (DXE) phase. Here, the system transitions to 32-bit or 64-bit flat addressing modes:

  • Identity Mapping: UEFI typically runs with identity-mapped page tables (where physical address equals virtual address) or with paging disabled, giving diagnostic utilities direct, unmitigated access to physical memory addresses.
  • UEFI Memory Map: The firmware maintains a global memory map accessible via UEFI Boot Services (such as GetMemoryMap()). This structure defines memory types, including EfiBootServicesCode, EfiRuntimeServicesData, and EfiConventionalMemory.
  • Resource Partitioning: Diagnostics use this map to identify which blocks are safe to test (EfiConventionalMemory) and which blocks contain the active diagnostic utility code itself, avoiding destructive overwrites of critical runtime structures.

Direct Access to the Integrated Memory Controller (IMC)

UEFI diagnostics do not rely on standard OS-level read/write APIs. Instead, they interact directly with the hardware through CPU registers and Memory-Mapped I/O (MMIO):

  1. SPD Data Retrieval: Diagnostics read SPD EEPROM registers on each DIMM to verify manufacturer specifications, JEDEC timings, XMP/EXPO profiles, and serial numbers.
  2. Configuration Space: The utility queries PCIe configuration space and platform-specific Model-Specific Registers (MSRs) belonging to the CPU's IMC to verify channel health, rank configurations, and bus error counters.
  3. ECC Interfacing: On systems supporting Error-Correcting Code (ECC) memory, the UEFI tool directly reads the IMC’s status registers to log single-bit corrections and trap multi-bit uncorrectable errors during test cycles.

Pattern Generation and Execution

With direct access to physical addresses, embedded diagnostics stress the electrical and logical integrity of the RAM cells using raw read, write, and inversion operations:

  • Algorithmic Patterns: The diagnostic engine writes specific bit sequences (such as Walking 1s/0s, Checkerboard, March C-, and Random Number sequences) straight to physical memory locations without caching interference, often using non-temporal write instructions (e.g., MOVNTI on x86) to force data directly into DRAM.
  • Stress Cycles: The tool reads back the written data and compares it against expected values. Discrepancies point directly to bad cells, row hammer vulnerabilities, or timing instability.
  • Memory Relocation: To test the memory holding the diagnostic application itself, advanced UEFI diagnostics copy their execution payload to an already-verified segment of RAM, update the base execution pointer, and test the previously occupied space.