ExamFinch.com My Study

Study guide

2.3 BIOS vs. UEFI & System Boot Process (101.2)

Practice this exam

LPIC-1 Linux Administrator — Exam 101 101-500

Track your progress as you read

Finished sections get a check mark.

1 Exam Overview & Study Strategy

1.1 LPIC-1 101-500 Exam Structure & Blueprint 1.2 Command Line & Shell Fundamentals for Exam Success 1.3 Fill-in-the-Blank Strategies & Common Traps

2 Topic 101: System Architecture

2.1 Hardware Discovery, Sysfs, Procfs & Kernel Modules (101.1) 2.2 Udev, Dbus & Device Management (101.1) 2.3 BIOS vs. UEFI & System Boot Process (101.2) 2.4 Kernel Initialization, Initramfs & System Logs (101.2) 2.5 Systemd Boot Targets & Unit Management (101.3) 2.6 SysVinit Runlevels, Telinit & System Shutdown (101.3)

3 Topic 102: Linux Installation & Boot Management

3.1 Hard Disk Layout, Partition Schemes & Swap Design (102.1) 3.2 LVM & Standard Mount Point Allocation (102.1) 3.3 GRUB 2 Configuration & Troubleshooting (102.2) 3.4 Legacy GRUB & Alternative Boot Loaders (102.2) 3.5 Managing Shared Libraries & ldconfig (102.3) 3.6 Linux as a Virtualization Guest & Cloud Instances (102.6)

4 Topic 102: Package Management Systems

4.1 Debian Low-Level Package Management with dpkg (102.4) 4.2 High-Level Debian Package Management: apt, apt-get & apt-cache (102.4) 4.3 RPM Package Management with rpm (102.5) 4.4 YUM, DNF & Zypper Package Management (102.5) 4.5 Package Repositories & Integrity Verification (102.4/102.5) 4.6 Universal Linux Packages: Snap, Flatpak & AppImage (102.4/102.5)

5 Topic 103: Command Line & Text Processing

5.1 Shell Environment, Environment Variables & Aliases (103.1) 5.2 Command History, Quoting & Expansion (103.1) 5.3 Basic Text Filters: cat, head, tail, cut, paste, nl, od (103.2) 5.4 Advanced Text Filters: sort, uniq, wc, tr, split, less & Checksums (103.2) 5.5 Stream Editing with sed (103.2) 5.6 Basic File Management: cp, mv, rm, touch, mkdir, rmdir (103.3) 5.7 Archiving and Compression: tar, gzip, bzip2, xz, cpio & dd (103.3)

6 Topic 103: Streams, Processes, Regex & Vi

6.1 Standard Streams, Redirection & File Descriptors (103.4) 6.2 Pipelines, tee & xargs (103.4) 6.3 Process Monitoring: ps, top, free, watch, pgrep, pstree & uptime (103.5) 6.4 Signals, kill, Job Control, nohup, screen & tmux (103.5) 6.5 Process Priorities: nice & renice (103.6) 6.6 Regular Expressions & grep, egrep, fgrep (103.7) 6.7 vi / vim Modes, plus nano, Emacs & EDITOR Awareness (103.8)

7 Topic 104: Devices, Partitions & Filesystems

7.1 Block Devices, fdisk & gdisk (104.1) 7.2 GNU Parted & Partition Table Management (104.1) 7.3 Creating Filesystems: mkfs, ext4, XFS, VFAT/exFAT & Btrfs (104.1) 7.4 Filesystem Integrity: fsck, e2fsck, xfs_repair, xfs_fsr & xfs_db (104.2) 7.5 Monitoring Disk Usage: df, du & tune2fs (104.2) 7.6 Managing Swap Space: mkswap, swapon & swapoff (104.1/104.2)

8 Topic 104: Mounts, Permissions, Links & FHS

8.1 Mounting and Unmounting Filesystems: mount & umount (104.3) 8.2 Persistent Mounts: /etc/fstab, UUIDs & systemd mount units (104.3) 8.3 Standard File Permissions: chmod, chown, chgrp & umask (104.5) 8.4 Special Permissions: SUID, SGID & Sticky Bit (104.5) 8.5 Hard Links vs. Symbolic Links: ln & Inodes (104.6) 8.6 Filesystem Hierarchy Standard (FHS) & File Location (104.7)

2.3 BIOS vs. UEFI & System Boot Process (101.2)

Key Takeaways Explain This Topic AI

The Linux boot process follows a strict chronology: Power-on/POST -> Firmware (BIOS/UEFI) -> Bootloader (MBR/GRUB2/ESP) -> Kernel decompression & init -> Initramfs driver pivot -> Init system (PID 1).

Legacy BIOS uses 16-bit real mode, MBR partitioning (512-byte sectors, max 4 primary partitions, 2 TiB limit), and 446 bytes of boot code in sector 0.

UEFI executes in 32/64-bit protected mode, uses GUID Partition Tables (GPT, 128+ partitions, 9.4 ZB capacity), and boots .efi executables from the FAT32 EFI System Partition (ESP) at /boot/efi.

efibootmgr queries and alters UEFI NVRAM boot entries (use -v for verbose paths, -c to create entries, -b and -B to delete, -o to set boot order, -n for BootNext).

UEFI Secure Boot establishes a cryptographic chain of trust from the Platform Key (PK) and Key Exchange Key (KEK) to the Signature Database (db) and shim loader.

Last updated: August 2026

2.3 BIOS vs. UEFI & System Boot Process

Quick Summary: Booting a Linux system involves transitioning from hardware firmware to the operating system init process (PID 1). The two major firmware architectures are Legacy BIOS (utilizing Master Boot Record partition tables, 16-bit real mode, and a 2 TiB disk limit) and UEFI (utilizing GUID Partition Tables, 64-bit mode, an EFI System Partition, and NVRAM boot variables managed by efibootmgr ). Understanding this sequence and its partition constraints is fundamental for LPIC-1 certification.

1. The Linux Boot Process Chronology

The boot process transforms dormant hardware into a functioning multi-user operating system through six distinct sequential phases. [1. Power-On & POST]

  • │
  • ▼
  • [2. Firmware Execution] ──────► Legacy BIOS OR Modern UEFI
  • │
  • ▼
  • [3. Bootloader Phase] ────────► BIOS: MBR (446 bytes) -> Stage 1.5 -> Stage 2 (GRUB 2)
  • │ UEFI: ESP (/boot/efi/EFI/<distro>/grubx64.efi)
  • ▼
  • [4. Kernel Initialization] ───► vmlinuz decompressed into RAM, device probing
  • │
  • ▼
  • [5. Initramfs Root Pivot] ────► /init loads storage/RAID/LUKS drivers, mounts real root (/),
  • │ executes pivot_root / switch_root
  • ▼
  • [6. Init System (PID 1)] ─────► systemd (or SysVinit) activates targets/services
  • Chronological Stages Detailed

Power-on & POST (Power-On Self-Test) : System firmware stored in ROM/flash tests essential hardware (RAM, CPU registers, system timers, video adapter).

Firmware Initialization : Firmware enumerates attached boot devices according to configured boot priority.

Bootloader Execution :

BIOS : Reads the 512-byte Master Boot Record (MBR) on sector 0 of the boot disk, executes the 446-byte Stage 1 code, loads the core image (Stage 1.5), and loads the GRUB 2 configuration.

UEFI : Reads NVRAM boot entries, locates the EFI System Partition (ESP), and launches the .efi bootloader binary directly in 64-bit mode.

Kernel Loading & Decompression : The bootloader loads the compressed kernel ( vmlinuz ) and the initial RAM disk image ( initramfs ) into RAM. The kernel decompresses itself, initializes virtual memory and page tables, probes core CPU/ACPI structures, and starts kernel threads ( PID 0 swapper and PID 2 kthreadd).

Initramfs Execution & Root Pivot : The kernel runs /init from the temporary in-memory root filesystem. It loads essential storage controllers (SATA, NVMe, LVM, Software RAID, LUKS encryption), mounts the real root filesystem ( / ) read-only, and calls switch_root to transition to the permanent filesystem.

PID 1 (Init System) : The kernel executes /sbin/init (symlinked to systemd ), which parses unit dependencies and starts system targets in parallel.

2. Architectural Comparison: Legacy BIOS vs. Modern UEFI

Feature Legacy BIOS (Basic Input/Output System) Modern UEFI (Unified Extensible Firmware Interface)

Firmware Execution Mode 16-bit Real Mode (1 MiB addressable memory limit during POST) 32-bit or 64-bit Protected/Long Mode (addresses full system RAM)

Partition Table Scheme MBR (Master Boot Record) GPT (GUID Partition Table)

Maximum Disk Size 2.2 TB (2.0 TiB) (limited by 32-bit LBA sector counts) 9.4 ZB (Zettabytes) (utilizes 64-bit LBA sector addressing)

Partition Count Limit 4 Primary Partitions (or 3 Primary + 1 Extended containing logical partitions) 128 Partitions standard in Linux (expandable in GPT header)

Boot Code Location First 446 bytes of Sector 0 (MBR) + unpartitioned post-MBR gap Dedicated EFI System Partition (ESP) as standard files ( .efi )

  • ESP Filesystem Format N/A FAT32 (VFAT) mounted at /boot/efi or /efi
  • Boot Configuration Storage Raw sectors on disk Non-Volatile RAM (NVRAM) variables on motherboard
  • Security & Integrity No built-in verification Secure Boot (cryptographic signature verification)
  • The MBR Structure (Sector 0: 512 Bytes)

The standard MBR sector consists of three distinct segments:

Bootstrap Code (446 Bytes) : The machine code executed by BIOS (GRUB Stage 1).

Partition Table (64 Bytes) : Four 16-byte partition entry records defining partition start, end, type flag, and bootable status.

Boot Signature (2 Bytes) : Hexadecimal 0x55AA (validates MBR integrity).

Loading diagram... MBR 512-Byte Sector Structure vs. GPT Layout

3. The EFI System Partition (ESP)

In a UEFI environment, firmware does not execute raw machine code from sector 0. Instead, it natively understands the FAT32 (VFAT) filesystem and reads executable binaries compiled for the UEFI specification ( .efi files).

Standard ESP Characteristics

Partition Type GUID : c12a7328-f81f-11d2-ba4b-00a0c93ec93b (MBR Type 0xEF or GPT code EF00 in gdisk ).

Filesystem : FAT32 (FAT16/FAT12 supported by spec, FAT32 required for standard disks).

Standard Mount Points : /boot/efi (Debian, Ubuntu, RHEL, CentOS) or /efi (Arch, systemd-boot).

  • Directory Structure : /boot/efi/
  • └── EFI/
  • ├── BOOT/
  • │ └── BOOTX64.EFI # Fallback bootloader executable
  • ├── ubuntu/
  • │ ├── shimx64.efi # First-stage Secure Boot loader
  • │ ├── grubx64.efi # GRUB 2 bootloader binary
  • │ └── grub.cfg # GRUB configuration file
  • └── redhat/
  • ├── shimx64.efi
  • └── grubx64.efi

4. Managing UEFI Boot Entries: efibootmgr

efibootmgr is the Linux user-space tool used to inspect and manipulate UEFI NVRAM boot entries. It requires the efivarfs pseudo-filesystem to be mounted at /sys/firmware/efi/efivars . # Inspect current UEFI boot entries and boot order

  • $ sudo efibootmgr -v
  • BootCurrent: 0001
  • Timeout: 2 seconds
  • BootOrder: 0001,0000,0002,0003

Boot0000* Windows Boot Manager HD(1,GPT,a1b2c3d4-...,0x800,0x100000)/File(\EFI\Microsoft\Boot\bootmgfw.efi)WINDOWS...

  • Boot0001* ubuntu HD(1,GPT,e5f6a7b8-...,0x800,0x100000)/File(\EFI\ubuntu\shimx64.efi)
  • Boot0002* Fedora HD(1,GPT,e5f6a7b8-...,0x800,0x100000)/File(\EFI\fedora\shimx64.efi)

Boot0003* UEFI: IP4 Realtek PCIe GBE Family Controller PciRoot(0x0)/Pci(0x1f,0x6)/MAC(001122334455,0)/IPv4(0.0.0.0...) ...

BootCurrent : The hexadecimal boot entry ID used to boot the currently running system.

BootOrder : The comma-separated priority sequence in which firmware attempts to boot devices.

* indicator: Indicates an active boot entry (entries without * are disabled/inactive).

Crucial efibootmgr Command-Line Operations

Administrative Task Exact Command Syntax Flag Explanation

Verbose View sudo efibootmgr -v -v / --verbose : displays full device paths and .efi file paths.

Change Boot Order sudo efibootmgr -o 0002,0001,0000 -o / --bootorder : sets explicit comma-delimited hexadecimal order.

Set Next Boot Once sudo efibootmgr -n 0002 -n / --bootnext : boots entry 0002 once on next reboot, then reverts to standard order.

Create New Entry sudo efibootmgr -c -d /dev/sda -p 1 -L "ArchLinux" -l "\EFI\arch\grubx64.efi" -c (create), -d (disk device), -p (ESP partition number), -L (label), -l (loader path with Windows-style backslashes).

Delete Boot Entry sudo efibootmgr -b 0002 -B -b <id> (specifies target entry), -B (deletes the specified entry from NVRAM).

Activate / Deactivate sudo efibootmgr -b 0001 -A ; sudo efibootmgr -b 0001 -a -A (deactivates entry without deleting), -a (activates entry).

5. Secure Boot Principles

UEFI Secure Boot is a verification mechanism designed to ensure that firmware will only execute bootloaders and operating system kernels that are cryptographically signed with trusted digital certificates.

Key Cryptographic Hierarchy

Platform Key (PK) : Root of trust installed by the motherboard manufacturer; controls access to the KEK database.

Key Exchange Key (KEK) : Keys authorizing updates to the signature database ( db ). Usually contains Microsoft and OEM keys.

Signature Database ( db ) : Whitelist of cryptographic hashes and certificates for authorized bootloaders, drivers, and kernels.

Forbidden Signatures Database ( dbx ) : Revocation blacklist of compromised keys and binary hashes.

The Linux Shim Mechanism

Because individual Linux distributions cannot easily have every daily kernel update signed directly by Microsoft, Linux uses a two-tier bootloader structure:

shimx64.efi : A small, static first-stage loader signed by the Microsoft 3rd Party UEFI Certificate Authority. It initializes Secure Boot and contains the distribution vendor's certificate.

grubx64.efi : The full GRUB 2 bootloader signed by the Linux distribution vendor.

Machine Owner Key (MOK) : Allows local administrators to generate and enroll custom signing keys for third-party out-of-tree kernel modules (e.g., proprietary NVIDIA drivers or VirtualBox hypervisors) using the mokutil utility.