Power-on to PID 1: UEFI, GPT, ESP, and GRUB

UEFI / GPT Partition Layout#

Key concepts#

• EFI System Partition (ESP): FAT32, min 512MB, mounted at /boot/efi
• GPT vs MBR: GPT required for UEFI boot, supports >2TB, 128 partitions
• Boot process: UEFI firmware → EFI stub / bootloader → kernel → initramfs → init

What happens from power-on to PID 1#

1. UEFI POST → reads EFI boot entries from NVRAM
2. Finds EFI executable (grubx64.efi or linux.efi stub)
3. Loads kernel + initramfs into RAM
4. Kernel decompresses itself, initialises hardware
5. Mounts real root filesystem
6. exec() /sbin/init (systemd as PID 1)

Primary sources#

• Arch Wiki: Installation Guide — wiki.archlinux.org/title/Installation_guide [1]
• Arch Wiki: GRUB — wiki.archlinux.org/title/GRUB [2]
• Kernel docs: kbuild/makefiles.html [3]

UEFI: Unified Extensible Firmware Interface .#

definition :#

UEFI is a specification for the firmware architecture of a computing platform.  so we already mentionned what uefi stand for, specification here means the set of rule of standards that describe how the firmware should work, firmware is a software stored in hardware, architecture means the design or structure of that software, a computing platform is a laptop, desktop, a computer device .
so uefi is the first software that run when a pc is powered on . it replace the bios or it's the new bios. and bios is developped by IBM while it's intel that developped the efi, which later became uefi, backed by many companies .
so the bios (basic input output system) is a firmware stored in chip which is the rom, a non-volatile memory, can't be modified, and owned by ibm means companies that manifacture computers can't use the bios so it was reverse engineered, and uefis was created based on it Correction: the bios was reverse engineered to make a new compatible bios, but uefi is new firmware architecture that replaced bios. it has two primary roles :

• intialize and test harware, and provide run time service, means it initialize the bootloader which intialize the os kernel, and the bootloader for bios and MBR is stored inside storage harware (ssd, hdd, ...) in the first 442bytes while today, it has it's own .efi file stored in the esp partition. when installing and os. so the bios initialize that bootloder. however, latest uefis stores the firmware in a non-volatile memory that can be modified or updated, the thing is that modifying the uefi is risky, a non succeded update or modification can break the moderboard, or modification can expose the uefi to exploits or security failures such as bios rootkits .
  and for uefi the structure or the design is the same across all motherboards or harware while the implementation change based on the harware each computing interface provider has it's own implementation .
  so the uefi replaced the bios that had many limitations, and modern os stoped relaying on the bios for interruptions, instead, the kernel handle harware accessibility by communication with the driver through it's code or it's api .

GRUB: Grand Unified Bootload#

we already sayd that the bios or the uefi, test hardware then initialize the bootloader, the .efi file stored in the EFI system partition called ESP, and before, it was written in the first 442 bytes .
so GRUB is a multiboot bootloader, means for multiple os installed in the same computing interface or pc, give you ability to choose the os that will be loaded . by finding the kernels partitions responsible for booting, for linux it's /boot specificly the vmlinuz file, then display a menu to choose which os to load then load the os kernel and the initramfs file responsible for ram filesystem into ram, then gives control to thee os kernel Correction: when the kernel loaded and take control, it uses the initramfs file to load first or early drivers. then mounts the root file system, which is /root and subfiles like /home for users ..., then it loads the init/systemd parent of all the processes . However, there is two grubs, grub legacy which is the first created grub now it deprecated, and grub 2 the new one, both serve the same purpose that we talked about, the difference is how they achieve it. and grub two is more feature rich . so we will create a table that compare the two, but first, we need to understand some concepts to fully understand .

grub modules and extensions#

so for grub legacy and grub 2, both have same concept in module or extensions, and extensions are the grub's module, so you we can say that the two words are the same .
so each module has its own file or it's own core, when it need a module it load it's file. because dumping all the model in one giant file is a bas approach, it will load unessecary module .
here is the grub architecture :
UEFI -> grubx64.efi -> GRUB Core -> - ext2.mod - fat.mod … the grubx64.efi is the file we already mentionned, the one that be loaded by the uefi, it's the bootloader's file sitting in /boot, --GRU Core is the directory when the modules are sitting or stored--, *.mod is the modules.