How GRUB 2 Works on Debian for UEFI and BIOS

GRUB 2 (GRand Unified Bootloader version 2) is the default bootloader for the Debian operating system, responsible for initializing system hardware, presenting the boot menu, and loading the Linux kernel into memory. While GRUB 2 provides a uniform user interface and configuration system across installations, its underlying operation diverges significantly depending on whether the host machine uses legacy BIOS (Basic Input/Output System) or modern UEFI (Unified Extensible Firmware Interface). Understanding these mechanisms illustrates how Debian achieves reliable system startups across diverse hardware architectures.

GRUB 2 Architecture on Legacy BIOS Systems

On legacy BIOS systems, Debian relies on the grub-pc package. The BIOS boot process is constrained by historical x86 architectural limits, requiring GRUB 2 to execute in multiple distinct stages to transition from 16-bit real mode to 32-bit or 64-bit protected mode:

  1. Stage 1 (boot.img): The system BIOS reads the Master Boot Record (MBR) from the first 512-byte sector of the boot drive. Because of severe space constraints (446 bytes available for executable code), boot.img contains only enough code to locate and load the next component.
  2. Stage 1.5 (core.img): boot.img loads core.img, which is dynamically generated during installation and typically stored in the MBR gap (the unpartitioned sectors between the MBR and the first partition) or in a dedicated BIOS Boot Partition on GPT-partitioned drives. This image includes minimal filesystem drivers and decompression code.
  3. Stage 2 (Normal Mode): Once core.img executes and mounts the /boot partition, it dynamically loads GRUB 2 runtime modules from /boot/grub/i386-pc/. It then processes /boot/grub/grub.cfg, renders the graphical or text boot menu, and waits for user selection or timeout.

GRUB 2 Architecture on UEFI Systems

On modern UEFI systems, Debian employs the grub-efi-amd64 (or grub-efi-ia32/grub-efi-arm64) package. UEFI replaces the MBR-based multi-stage process with a standardized execution environment capable of reading FAT-formatted filesystems natively:

  1. Firmware Hand-off: During boot, the UEFI firmware reads boot variables stored in NVRAM. For Debian, this entry points to an executable on the EFI System Partition (ESP), typically mounted at /boot/efi.
  2. Secure Boot and Shim: When UEFI Secure Boot is enabled, the firmware first loads shimx64.efi, a small bootloader signed by Microsoft's third-party UEFI CA. The shim verifies the signature of Debian's official grubx64.efi binary using Debian's embedded keys before executing it.
  3. Direct Execution: Because UEFI executes standard PE/COFF binaries in protected/long mode directly, GRUB 2 does not require intermediate stage images like boot.img or core.img. The grubx64.efi application loads the necessary modules from /boot/grub/x86_64-efi/ and reads /boot/grub/grub.cfg.

Configuration Management in Debian

Regardless of whether the platform is BIOS or UEFI, GRUB 2 utilizes a unified configuration structure:

  • /boot/grub/grub.cfg: The main configuration file executed by GRUB during boot. It is non-human-editable and is regenerated automatically.
  • /etc/default/grub: The primary user-facing configuration file where system administrators define parameters like kernel command-line arguments (GRUB_CMDLINE_LINUX), menu timeouts, and terminal displays.
  • /etc/grub.d/: A directory containing executable shell scripts (such as 10_linux and 30_os-prober) that dynamically discover installed kernels and alternative operating systems.

Running the Debian utility update-grub (a wrapper script for grub-mkconfig -o /boot/grub/grub.cfg) aggregates the settings from /etc/default/grub and the scripts in /etc/grub.d/ to generate the finalized grub.cfg.

Kernel Handoff

Once the user selects an operating system entry (or the timeout expires), GRUB 2 reads the target Linux kernel (vmlinuz) and initial RAM filesystem (initrd.img) from /boot into system memory. GRUB 2 appends the configured kernel parameters, sets up the video framebuffer, and transfers execution control directly to the kernel's setup code. At this point, GRUB 2 releases system control, allowing the Linux kernel to initialize hardware drivers, mount the root filesystem, and start the system's init process (systemd).