They run in ring -2. Proprietary software with networking stacks, file systems, device drivers, web servers, all running in a mode more privileged than the operating system. There's also the Intel Management Engine with pretty much the same features but running in ring -3.
back
1 comments
Only SMM drivers run in the proverbial "ring -2". Ordinary UEFI apps run at the same privilege level as the host OS (0), just like any bootloader.