IPv6 Address Resolution in UEFI Remote Deployment

During remote operating system deployment via Unified Extensible Firmware Interface (UEFI), the firmware initializes network hardware to retrieve boot files via protocols like PXE or HTTP Boot. In an IPv6 environment, the UEFI network stack eliminates the legacy Address Resolution Protocol (ARP) used in IPv4, replacing it with the IPv6 Neighbor Discovery Protocol (NDP). This article details how UEFI leverages NDP, structured firmware drivers, and ICMPv6 messages to perform address resolution, detect duplicates, discover gateways, and communicate with deployment servers prior to OS initialization.

The UEFI IPv6 Network Stack Architecture

The UEFI specification defines a layered, modular driver design for network operations. At the hardware abstraction layer, the Simple Network Protocol (SNP) interfaces directly with the network interface card (NIC). Above this sits the Managed Network Protocol (MNP), which provides raw packet multiplexing.

IPv6 network services are exposed through the EFI_IP6_SERVICE_BINDING_PROTOCOL and managed via the EFI_IP6_PROTOCOL and EFI_IP6_CONFIG_PROTOCOL. The UEFI IPv6 driver implements the Neighbor Discovery Protocol (RFC 4861) directly within firmware space, handling address autoconfiguration, router discovery, and link-layer address resolution independently of the operating system.

Link-Local Address Generation and Duplicate Address Detection

Before the UEFI client can communicate across the network, it must generate a Link-Local address (typically with the fe80::/64 prefix). This address is generated using either the device's modified EUI-64 identifier derived from the NIC's MAC address or an interface identifier configured via UEFI firmware policy.

Once generated, the address is in a "tentative" state. The UEFI stack performs Duplicate Address Detection (DAD):

1. The firmware transmits an ICMPv6 Neighbor Solicitation (NS) message (Type 135) to the Solicited-Node multicast address corresponding to its tentative IPv6 address.
2. The UEFI stack listens for an incoming Neighbor Advertisement (NA) message (Type 136).
3. If no NA message is received within the specified timeout, the UEFI stack marks the Link-Local address as valid and assigns it to the interface.

Router Discovery and Prefix Configuration

To communicate beyond the local broadcast domain to reach remote deployment servers, UEFI must identify default gateways and subnet prefixes:

1. Router Solicitation (RS): The UEFI client transmits an ICMPv6 Type 133 packet addressed to the all-routers multicast address (ff02::2).
2. Router Advertisement (RA): Local routers respond with an ICMPv6 Type 134 packet containing configuration flags, network prefixes, MTU size, and default gateway addresses.

Based on the flags in the RA message:

• Autonomous Flag (A=1): The client utilizes Stateless Address Autoconfiguration (SLAAC) to form a global unicast address.
• Managed Address Configuration Flag (M=1): The client invokes the EFI_DHCP6_PROTOCOL to request stateful address assignment and boot options (such as the boot file URI or Network Bootstrap Program) from a DHCPv6 server.
• Other Configuration Flag (O=1): The client uses SLAAC for its address but queries DHCPv6 for auxiliary deployment parameters.

Target Address Resolution (NS and NA)

When the UEFI boot manager initiates file transfer from a deployment server (using TFTP for PXE or HTTP/HTTPS for UEFI HTTP Boot), it must resolve the server's or the local gateway's IPv6 address to a 48-bit Ethernet MAC address:

1. Routing Check: The UEFI stack checks its internal routing table. If the target deployment server is on the local link, it resolves the server's IPv6 address directly. If the server is on a remote subnet, the stack resolves the default router's IPv6 address obtained during router discovery.
2. Sending Neighbor Solicitation: The UEFI stack constructs an ICMPv6 Neighbor Solicitation message. The destination is the Solicited-Node multicast address (ff02::1:ffXX:XXXX) corresponding to the lower 24 bits of the target IPv6 address. The Source Link-Layer Address option is included, containing the client's own MAC address.
3. Receiving Neighbor Advertisement: The target node processes the solicitation and responds with a unicast Neighbor Advertisement directed to the UEFI client. This packet includes the target's MAC address in the Target Link-Layer Address option.
4. Neighbor Cache Update: The UEFI network stack creates an entry in its internal Neighbor Cache (equivalent to an ARP table), binding the target's IPv6 address to its MAC address in the REACHABLE state.

File Transfer and Handoff

With address resolution complete, the UEFI network stack constructs Ethernet frames using the retrieved MAC address. The client downloads the Network Bootstrap Program (NBP), such as GRUB or the Windows Boot Manager, over TCP (for HTTP Boot) or UDP (for TFTP PXE).

The Neighbor Cache remains active in UEFI system memory until the boot loader calls the UEFI ExitBootServices() API. At that point, the firmware releases control of the network interface, and the newly loaded operating system kernel reinitializes the NIC with its native IPv6 networking stack.