Firmware, UEFI, and BIOS

The firmware is the first code that runs when a host powers on. It initialises the hardware, then hands control to the bootloader, which then loads the kernel. The firmware is also the layer that hosts UEFI Secure Boot, the TPM, and the out-of-band management interface.

BIOS vs UEFI

$ ls /sys/firmware/efi/ 2>/dev/null && echo UEFI || echo BIOS

config_table  efivars  esrt  fw_platform_size  mok-variables  runtime  runtime-map  systab
UEFI

UEFI Secure Boot

Secure Boot is a UEFI feature where the firmware verifies the signature of every bootloader, kernel, and (in some configurations) initramfs. The chain of trust starts with manufacturer-baked keys.

flowchart LR
  OEM[OEM Platform Key]
  DB[Allowed Signatures DB]
  MOK[Machine Owner Key]
  SB[Secure Boot state]
  OEM --> DB
  OEM --> SB
  MOK --> SB
  DB --> SB

• PK (Platform Key): the manufacturer’s key. Used to sign the DB.
• DB (Allowed Signatures Database): the keys and hashes allowed to boot.
• MOK (Machine Owner Key): a key the owner can add to the DB without replacing the OEM keys. Used for custom kernels.
• DBX (Forbidden Signatures Database): explicit revocation list.

$ mokutil --sb-state; mokutil --list-enrolled

SecureBoot enabled
[user key 1234abcd] /CN=My Signing Key

What firmware does at power-on

sequenceDiagram
  participant Power as Power On
  participant FW as Firmware (UEFI)
  participant BL as Bootloader (GRUB)
  participant K as Kernel
  participant I as initramfs

  Power->>FW: power-on reset
  FW->>FW: POST (memory, devices)
  FW->>FW: enumerate boot entries
  FW->>BL: load EFI binary
  BL->>K: load vmlinuz
  BL->>I: load initramfs
  K->>K: decompress, initialise
  K->>I: mount / as tmpfs
  I->>I: load drivers, mount rootfs
  I->>FW: hand off (PID 1 = systemd)

The firmware’s responsibilities:

• POST (power-on self test): memory check, device probe.
• Initialise CPU cores, memory controller, basic peripherals.
• Enumerate boot devices and boot entries.
• Load the configured bootloader binary from the ESP.
• Transfer control.

The firmware’s time is typically 1-3 seconds on modern hardware; longer firmware delays indicate problems (memory training, failed peripherals).

Reading UEFI variables

$ efivar -l | head -20

Boot0000: HD(1,GPT,...)/File(\\EFI\\ubuntu\\shimx64.efi)
BootOrder: 0000,0001,0002
Boot0001: Network Boot
Boot0002: USB
...

Knowledge check