UEFI
/ YOO-eff-eye /
Before any operating system can run, some program must already be in charge the instant the CPU wakes up — and that program is the firmware, software permanently stored in a chip on the motherboard. UEFI (Unified Extensible Firmware Interface) is the modern standard for that firmware, the successor to the old PC BIOS (Basic Input/Output System). Think of the firmware as the building superintendent who is always there before anyone else arrives: they have the keys, they know where the fuse box is, and they let the day's first worker in. UEFI is a newer, far more capable superintendent than the cramped BIOS that PCs used for decades.
Concretely, when the machine powers on, the CPU jumps to firmware code. The old BIOS was 16-bit, understood only a tiny 512-byte boot sector at the start of a disk (the MBR), and offered crude device services. UEFI is different in several practical ways: it runs in 32- or 64-bit mode, it understands a real file system (a small FAT partition called the EFI System Partition, or ESP), and it loads boot programs as proper .efi files from that partition rather than from a single magic sector. It also keeps a small store of boot variables that remember which OS to start, and it can include a boot manager so you do not strictly need a separate bootloader. Crucially UEFI introduced secure boot, which verifies a cryptographic signature on each boot program before running it.
It matters because UEFI is why modern machines boot quickly, support disks larger than 2 TB (the old MBR scheme could not), can show graphical boot menus, and can refuse to run tampered boot code. A common confusion: people still say BIOS out of habit, and many UEFI firmwares offer a legacy BIOS compatibility mode (CSM), so the two coexist during the long transition. UEFI is not the operating system and not the bootloader — it is the layer beneath both that hands control to them.
Your laptop's EFI System Partition holds files like EFI/BOOT/bootx64.efi and EFI/ubuntu/grubx64.efi. UEFI reads its boot variables, sees the entry pointing at GRUB's .efi file, checks its secure-boot signature, loads it, and runs it — and from there GRUB takes over to load the kernel.
UEFI loads a signed .efi file from a FAT partition, unlike BIOS which read one raw boot sector.
Secure boot does not make a system magically safe — it only guarantees that the boot programs are signed by a trusted key. Once the OS is running, secure boot has done its job and other defenses must take over; and an OS you choose to trust can still load anything once booted.