Article by Ayman Alheraki on May 10 2026 01:27 PM
The boot process can be compared to building and preparing a complete theater. Initially, there is only silent hardware. Then, the foundation is tested (memory, processor), a simple wooden platform is built (the firmware), the backstage and stage itself are prepared (the operating system), and finally, the curtain opens onto the user interface we interact with.
The journey is divided as follows:
Pre-Boot Phase: Managed by the firmware (BIOS or UEFI) on the motherboard. This is common to all systems.
Boot Loader Phase: A small program takes over from the firmware to load the operating system kernel.
Operating System Boot Phase: The kernel starts and initializes internal services up to the graphical screen.
Login Phase: The user reaches the desktop after their identity is verified.
This process is not merely "electrical current." It is a tightly controlled sequence of voltage regulation and readiness signals.
Power Supply Unit (PSU): When the power button is pressed, the PSU sends a Power_Good signal (often a 5-volt signal that stabilizes within 100-500 milliseconds) to inform the motherboard that the voltages (3.3V, 5V, 12V) are stable and safe.
CPU Waking (CPU Reset): The Platform Controller Hub (PCH) chip receives the signal and releases the processor, removing its Reset signal. At this moment, the processor jumps to the first memory address hardwired into its internal design.
In BIOS systems: It jumps to the physical address 0xFFFF0 (which is 16 bytes before the end of the first megabyte of memory), where a jump instruction to the actual BIOS code is located.
In UEFI systems: It jumps to the address 0xFFFFFFF0 (the top of the 4 GB memory space), which points to the SPI Flash memory where the first UEFI code resides. This very first stage is called SEC (Security), and its primary role is to verify the integrity of the rest of the firmware.
Here, the firmware acts as a project manager: the processor is initialized, memory is tested, and data buses are prepared to hand over the task to the boot loader.
POST (Power-On Self Test): A rapid check of the memory (you might see a memory counter in megabytes), video card, keyboard, and storage media. On failure, it emits Beep Codes.
Device Initialization: Identifying hard drives and disk drives, assigning interrupts (IRQs), and setting the video card to work in basic text mode (80x25 characters).
Boot Device Selection: Based on the boot order saved in CMOS memory, the BIOS reads the first 512 bytes (sector 0) from the chosen storage medium. This is the Master Boot Record (MBR). If the last two bytes of this sector are 0x55 then 0xAA, the BIOS recognizes it as a bootable disk and passes control to the code in the first 446 bytes of this sector.
PEI Phase (Pre-EFI Initialization): It initializes the main memory (RAM), some CPU registers, and the independent I/O processor (on Intel CPUs). At this stage, the system still runs slowly using cache memory as a substitute for permanent memory.
DXE Phase (Driver Execution Environment): This is the heart of UEFI. USB ports, NVMe/SATA controllers, and the Graphics Processing Unit (GPU) are initialized. Now you can enter the UEFI setup using keyboard and mouse.
BDS Phase (Boot Device Selection): It searches for storage media containing an EFI System Partition (ESP), a partition with a special identifier (usually type C12A7328-F81F-11D2-BA4B-00A0C93EC93B) formatted with the FAT32 file system. Inside, it looks for a boot loader with a .efi extension (like bootx64.efi).
This is the critical branching point between operating systems. The boot loader is an intermediary program with a single task: find the system kernel and load it into memory.
On BIOS/MBR: The code in the first 446 bytes of the MBR is just the start of the Windows boot loader (bootmgr). It loads the remaining parts of bootmgr from the disk.
On UEFI/GPT: The UEFI passes control directly to the bootmgfw.efi file on the ESP.
Boot Manager (bootmgr): It reads the BCD (Boot Configuration Data) database, which is registry-like, and understands from it how many Windows installations are present and their locations. If you have a single Windows installation, it jumps directly to the next step.
System Loader (winload.exe): Loads critical components:
Kernel (ntoskrnl.exe): The heart of the system.
Hardware Abstraction Layer (hal.dll): Makes the kernel see all computer types uniformly.
System Registry Hive (SYSTEM Hive): Contains the list of device drivers and services to be started.
Stage 1: On BIOS/MBR, a very small part of GRUB is loaded from the first 446 bytes (or from the "MBR gap"). On UEFI, the grubx64.efi file is loaded from the ESP.
Boot Menu: GRUB2 reads the /boot/grub/grub.cfg configuration file and displays a menu of available operating systems or kernels to load.
Loading Two Essential Files:
vmlinuz: The compressed kernel image.
initramfs (or initrd): A temporary in-memory filesystem. Why is it necessary? Because the kernel itself may lack drivers for the hard disk controller (SCSI/SATA) where the actual root filesystem resides. initramfs contains these drivers and tools to allow the kernel to see the hard disk and load the system from it.
The boot system in Apple devices is the most integrated and secure.
Boot ROM: A hardwired chip, not easily rewritable, representing the "Root of Trust". It verifies the integrity of the T2 chip or Apple Silicon processor.
Secure Boot Chain: Every step cryptographically verifies the digital signature of the next step from Apple.
boot.efi (Intel) or iBoot (Apple Silicon): This is the boot loader that:
Displays the Apple logo.
Searches for the kernelcache file in /System/Library/Caches/com.apple.kext.caches/Startup/. This file is not just a kernel, but the kernel and all its essential extensions (kexts) pre-linked into a single package, dramatically speeding up loading and not requiring an equivalent initramfs.
iBoot then starts the kernel.
After loading the kernel and enabling it to see the hard disk, it begins setting up its world.
Kernel Self-Initialization: It transitions from "Real Mode" (16-bit) to "Protected Mode" (32/64-bit). This involves:
Setting up memory tables: GDT (Global Descriptor Table) and IDT (Interrupt Descriptor Table).
Initializing virtual memory management and process scheduling.
Discovering devices by probing buses (PCIe) and loading internal drivers.
Starting the Root Process (PID 1): This is the mother of all processes. Any error here means a system crash.
In Linux: The process is init, and in modern distributions it is usually systemd (located at /sbin/init as a symbolic link).
In Windows: The first process is smss.exe (Session Manager Subsystem).
In macOS: The process is launchd (located at /sbin/launchd).
These PID 1 processes read their configurations and start essential services in parallel: network services, audio, power, and the login system.
This is the final stage before you see your familiar interface.
Windows: After smss.exe starts the user interface subsystem (csrss.exe) and the login process (winlogon.exe), the login screen managed by LogonUI.exe is displayed. After entering the password, winlogon.exe launches the userinit.exe process, which in turn starts the desktop shell (explorer.exe). The desktop is now ready.
Linux: The systemd process starts the Display Manager such as GDM (GNOME), SDDM (KDE), or LightDM. The Display Manager is a graphical server running on X (Xorg) or Wayland to show the login screen. After authentication, it starts the user session (e.g., GNOME Shell), which loads personal desktop settings. The systemd process remains the true root for managing services in the background.
macOS: launchd starts the loginwindow service, which displays the login screen or performs automatic login. After authentication, launchd loads the user's graphical environment (Finder, Dock, Spotlight) according to the configuration files (plist) located in /System/Library/LaunchAgents and ~/Library/LaunchAgents. The role of launchd is not limited to starting services at boot; it is also responsible for restarting them if they stop for any reason.
| Component | Core Role | Theater Analogy |
|---|---|---|
| Processor (CPU) | The executing brain. Always starts from a fixed memory address upon first Reset signal removal. | The actor following the script precisely. |
| Firmware (BIOS/UEFI) | The intermediary that wakes the hardware, tests it, and hands over to the boot loader. UEFI is the newer standard supporting GPT disks and security (Secure Boot). | The stage manager who prepares lights and sound. |
| Master Boot Record (MBR) | The first 512 bytes of a disk (on BIOS systems). Contains the boot loader's starting code. | The title of the play on the first page of the script. |
| EFI System Partition (ESP) | A special FAT32 partition (on UEFI systems) holding .efi files. | The backstage room where the boot loader awaits its turn. |
| Boot Loader (GRUB, bootmgr) | A program that selects and loads the operating system kernel into memory. | The director calling the actors to the stage. |
| Kernel (vmlinuz, ntoskrnl, XNU) | Controls hardware and memory, providing core services to other programs. | The stage itself and the rules of the performance. |
| Init Process (systemd, smss, launchd) | The mother process (PID 1) that spawns all other processes and manages services. | The theater manager coordinating the opening and closing of curtains. |
| Display Manager (winlogon, GDM) | Displays the login screen and starts the graphical session after user verification. | The curtain that finally opens for the show to begin before the audience. |
With this level of detail, you can trace the journey of every byte and instruction from the moment the current stabilizes until the appearance of the browser icon on your screen. Is there a particular phase you would like to delve deeper into?