Phase 1 · Free

1.2 Firmware: BIOS, UEFI, Boot Order, and Secure Boot

Before Windows, before Linux, before anything you would call software, a small program built into the motherboard runs. It checks that the memory and processor are alive, then goes looking for something to start. That program is the firmware.

25 minPhase 1: Get a Machine RunningFree

Phase 1. Lesson 2 of 5. About 25 minutes.

Plain entry

Before Windows, before Linux, before anything you would call software, a small program built into the motherboardThe main circuit board that connects every part of a computer, including the CPU, memory, storage, and expansion cards, and holds the system firmware. Read more → runs. It checks that the memory and processor are alive, then goes looking for something to start. That program is the firmware.

If you want to install a new operating system, you have to tell the firmware to start from your installer instead of whatever is on the disk. That is the boot order. On a virtual machineA software-based emulation of a complete computer that runs its own operating system and applications, isolated from the host hardware. Read more → you set it in a menu. On real hardware you press a key at the right second and it feels like a secret handshake. This lesson covers both.

Terms

  • Firmware: software stored on a chip on the motherboard that runs first when the machine powers on.
  • BIOSBasic Input/Output System: the original PC firmware standard that tests hardware and boots from a disk's first sector, now replaced by UEFI. Read more → (Basic Input/Output System): the old firmware standard from the 1980s. Many people still say “BIOS” when they mean UEFIUnified Extensible Firmware Interface: the modern firmware standard that tests the hardware at power on and starts the bootloader, replacing legacy BIOS. Read more →.
  • UEFI (Unified Extensible Firmware Interface): the modern firmware standard. Supports large disks, mouse-driven setup screens, and Secure BootA UEFI feature that only lets signed, trusted bootloaders and kernels run at startup, blocking malware that tries to load before the operating system. Read more →.
  • POST (Power-On Self-Test): the hardware check the firmware runs first. A failed POST usually means beeps or a black screen.
  • Boot order: the list of devices the firmware tries, in order: USB, disk, network.
  • Secure Boot: a UEFI feature that only starts bootloaders signed by a trusted key. Ubuntu ships a signed bootloader, so you can leave it on.
  • Bootloader: the small program the firmware hands off to, which then loads the OS. Ubuntu uses GRUB.

Depth

On a virtual machine (default path)

VirtualBox gives each VM its own simulated firmware. You will turn on UEFI for the VM in lesson 1.4 (Settings, System, “Enable EFI”). Booting from the installer is automatic the first time because the virtual disk is empty and the ISO is attached. Nothing to press.

UTM on a Mac uses UEFI by default for ARM Linux guests.

On real hardware (optional path)

The key to enter firmware setup depends on the maker. Common ones:

MakerSetup keyOne-time boot menu
DellF2F12
HPF10 (or Esc then F10)F9
LenovoF1 or F2F12
ASUSDel or F2F8
MSIDelF11
AcerF2F12

Tap the key repeatedly from the moment you press power. If Windows is installed, you can also go in from Windows: Settings, System, Recovery, Advanced startup, Restart now, then Troubleshoot, Advanced options, UEFI Firmware Settings.

Use the one-time boot menu when you can. It boots the USB once without changing your saved boot order.

Checking which mode you booted in

Once Linux is running, this tells you if the firmware started it in UEFI mode:

[ -d /sys/firmware/efi ] && echo UEFI || echo BIOS

Expected output on a modern machine or a VM with EFI enabled:

UEFI

And whether Secure Boot is on:

mokutil --sb-state

Expected output:

SecureBoot enabled

(In a VirtualBox VM you will usually see SecureBoot disabled or EFI variables are not supported on this system. Both are fine.)

Going further

UEFI does not read a boot sector like BIOS did. It reads a FAT32 partition called the EFI System Partition (ESP) and runs a .efi file from it. On Ubuntu that partition is mounted at /boot/efi. List it with sudo ls /boot/efi/EFI/ and you will see ubuntu and usually BOOT. List the firmware’s own boot entries with efibootmgr -v. This becomes very real in Phase 4 when you break GRUB.

Why it works this way

Firmware runs before any disk is trusted, so it is the one place that decides what code gets to run first. That is why boot order lives there, and why Secure Boot lives there too: if the first program were allowed to be anything, malware could load before the operating system and hide from it. When a machine boots the wrong thing, reason from that order. Ask “what did the firmware try first, and did it find something bootable there?” before you touch the installer.

Self-check

  1. What runs first when you press the power button?
  2. What is the practical difference between the boot order and the one-time boot menu?
  3. Do you need to turn Secure Boot off to install Ubuntu?
  4. Which command shows if you booted in UEFI mode?

Answers: (1) The firmware, starting with POST. (2) The boot order is saved; the one-time menu changes only this boot. (3) No, Ubuntu’s bootloader is signed. (4) Check for /sys/firmware/efi.

Sources