Stage 3 · Build
Boot & Init Systems
BIOS & UEFI Firmware
POST, EFI system partitions, boot entries, Secure Boot, and efibootmgr troubleshooting.
BIOS vs UEFI
BIOS (Legacy) and UEFI are firmware interfaces that initialize hardware and boot the operating system. UEFI is the modern replacement, supporting larger disks, faster boot times, and Secure Boot.
| Feature | BIOS (Legacy) | UEFI |
|---|---|---|
| Max disk size | 2 TB (MBR) | 9.4 ZB (GPT) |
| Boot speed | Slower | Faster |
| Secure Boot | No | Yes |
| Partition table | MBR | GPT |
| Boot manager | No | Built-in |
| 2038 problem | Yes | No |
POST Sequence
- 1. Power On — PSU stabilizes, CPU resets
- 2. POST — Power-On Self-Test checks hardware (CPU, RAM, GPU)
- 3. Firmware initialization — UEFI initializes drivers and protocols
- 4. Boot device selection — Firmware finds boot device from NVRAM or fallback
- 5. Boot loader loading — GRUB or systemd-boot is loaded from ESP or MBR
- 6. Kernel loading — Boot loader loads vmlinuz and initrd/initramfs
- 7. Kernel init — Kernel initializes drivers and mounts root filesystem
EFI System Partition
# Find the ESP
sudo fdisk -l /dev/sda | grep "EFI System"
# /dev/sda1 2048 1026047 512000 222 EFI System
# Mount and inspect
sudo mount /dev/sda1 /boot/efi
ls /boot/efi/
# EFI/
# ├── debian/
# │ ├── grubx64.efi
# │ └── shimx64.efi
# ├── fedora/
# │ └── grubx64.efi
# └── BOOT/
# ├── BOOTX64.EFI
# └── fbx64.efi
# ESP is typically FAT32, 512MB
df -Th /boot/efi
# /dev/sda1 vfat 511M 45M 467M 10% /boot/efiThe ESP is a FAT32 partition that holds EFI boot loaders. It must be accessible to the firmware for UEFI boot to work.
Boot Entries
# List UEFI boot entries
efibootmgr -v
# BootCurrent: 0001
# BootOrder: 0001,0002,0003
# Boot0001* ubuntu HD(1,GPT,abc123...) File(\EFI\ubuntu\shimx64.efi)
# Boot0002* Windows HD(2,GPT,def456...) File(\EFI\Microsoft\Boot\bootmgfw.efi)
# Boot0003* USB USB(1,MBR,...)
# BootCurrent — which entry booted this time
# BootOrder — priority order for next boot
# * = active/bootable entry
# Set boot order
sudo efibootmgr -o 0001,0002,0003
# Delete a boot entry
sudo efibootmgr -b 0003 -Befibootmgr manages UEFI boot entries stored in NVRAM. The BootOrder determines which entry the firmware tries first.
Secure Boot
# Check Secure Boot status
mokutil --sb-state
# SecureBoot enabled
# or
# SecureBoot disabled
# Check UEFI Secure Boot variable
od -A x -t x1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-... | head -1
# 06 00 00 00 (06 = enabled)
# Enroll a Machine Owner Key (MOK) for custom kernels
sudo mokutil --import /path/to/MOK.der
# List enrolled keys
mokutil --list-enrolled
# Disable Secure Boot (from firmware setup or efibootmgr)
# Boot into firmware setup (DEL, F2, F12 during POST)Secure Boot verifies boot loaders are signed by trusted keys. It prevents rootkits and bootkits. Custom kernels require enrolling a MOK.
efibootmgr Management
# Create a new boot entry
sudo efibootmgr -c -d /dev/sda -p 1 -L "Linux" -l \EFI\linux\grubx64.efi
# Modify an existing entry
sudo efibootmgr -b 0001 -B # Delete entry 0001
sudo efibootmgr -c ... # Create new entry
# Set next boot (one-time)
sudo efibootmgr -n 0002
# Boot from DVD/USB once
sudo efibootmgr -n 0003
# Copy boot entry
sudo efibootmgr -b 0001 -B
sudo efibootmgr -c -d /dev/sdb -p 1 -L "Linux (copy)" -l \EFI\linux\grubx64.efiefibootmgr operates on UEFI NVRAM. Changes persist across reboots. Use -n for one-time boot changes, -o for permanent order changes.
# Dual boot: add Linux entry alongside Windows
sudo efibootmgr -v | grep -i windows
# Boot0002* Windows HD(2,...) File(\EFI\Microsoft\Boot\bootmgfw.efi)
# Linux boot entry (created by installer)
sudo efibootmgr -v | grep -i ubuntu
# Boot0001* ubuntu HD(1,...) File(\EFI\ubuntu\shimx64.efi)
# Ensure Linux boots first
sudo efibootmgr -o 0001,0002UEFI boot entries coexist peacefully. Both Windows and Linux have separate entries. The BootOrder determines which boots first.
shim is a small EFI loader signed by a trusted authority. It chains to GRUB, which loads your custom kernel. This is the standard approach for Secure Boot with Linux.
If you remove all UEFI boot entries, the firmware cannot find a boot device. Always keep at least one valid entry. Create a backup entry before making changes.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.