Detailed description of the boot process in UEFI systems

If you enjoy tinkering with computers and understanding what's going on from the moment you press the power button until you see the desktopSooner or later you'll come across two key words: BIOS and UEFIThey sound the same, but behind them lies a paradigm shift in how your PC starts up and is protected.

In recent decades we have gone from very limited firmware to a much more complete environment, capable of managing huge disks, booting faster, and loading multiple OS And apply advanced security mechanisms such as Secure BootAll of this revolves around the UEFI standard and how it has (largely) replaced the old Legacy BIOS and the classic MBR partition scheme.

BIOS, MBR, UEFI and GPT: bringing order to the concepts

Before going into detail about the UEFI boot flow, it's worth clarifying what each component is, because BIOS, UEFI, MBR, and GPT are often mixed up and used almost interchangeably, when in reality they are different things working together during startup.

El Legacy BIOS The Basic Input/Output System (BIOS) is the classic firmware that x86 motherboards have used since the 80s. It resides on a ROM or flash chip on the motherboard and is the first thing the CPU executes upon startup, long before the operating system comes into play. Its purpose is to initialize the basic hardware and hand control over to a small boot code located on the disk, traditionally in the boot sector. Master Boot Record (MBR).

El MBR It is the first physical sector of a unit of storage (the famous 512 bytes). Within that sector, there are two critical things: a minimal piece of boot code (the first boot manager) and the partition table in MBR format. This code is what the BIOS loads into memory and executes, and from there, second-stage boot managers are chained together, such as BOOTMGR, GRUB, LILO or Syslinux.

The BIOS + MBR combination was sufficient for many years, but it came with significant limitations: a maximum of four primary partitions, a practical limit of about 2,2 TB per disk, and the absence of modern security and integrity verification mechanisms. As disks grew larger and boot management became more complex, these limitations became a problem. for both home users and professional environments.

To overcome these barriers, new approaches emerged UEFI and GPTUEFI (Unified Extensible Firmware Interface) is not simply a “new BIOS”, but a modern firmware specification, designed by a consortium of manufacturers (IntelAMD, Microsoft, HP, and others) to provide a more flexible, extensible, and secure environment. GPT (GUID Partition Table), meanwhile, is a partitioning system that accompanies UEFI and leaves far behind the limitations of MBR.

What is UEFI and how does it relate to firmware?

UEFI is a specification that describes the interface between the motherboard firmware and operating systemIt does not dictate how all the firmware should be implemented internally, but it does define which services it should expose and how they communicate with the operating system and EFI applications.

In practice, when people talk about "entering the BIOS" on a modern PC, they're almost always entering a UEFI environment, even though manufacturers still call it BIOS out of habit and to avoid confusing the user. This UEFI environment is stored on a chip on the motherboard and runs from non-volatile memory, usually backed up by a button cell battery and NVRAM that retain the configuration even with the equipment turned off.

UEFI acts as a mini operating system layer: it provides boot services, runtime services, its own drivers for certain devices, and the ability to read some file systems, especially FAT in the EFI System Partition (ESP)Thanks to this, it no longer depends exclusively on the MBR nor does it need the boot code to live in a 512-byte sector.

It's worth clarifying that UEFI doesn't completely "eliminate" the BIOS in the traditional sense: the specification focuses on the interface, not the entire firmware. But in practice, modern computers are sold with UEFI firmwares that also implement compatibility modes to continue supporting Legacy boot when needed.

That's why we often talk about UEFI-BIOS or BIOS UEFI: a firmware that exposes the modern UEFI interface, but maintains options to behave like a Legacy BIOS through the famous CSM (Compatibility Support Module).

GPT: the partitioning scheme that accompanies UEFI

The other big leg of the table is GPT (GUID Partition Table)While MBR only allows four primary partitions and has a limit of about 2,2 TB, GPT uses globally unique identifiers (GUIDs) for each partition and stores partitioning information with 64-bit LBA addresses.

With GPT, you can define many more partitions (usually up to 128 entries by default, expandable depending on the tool), without needing to create extended or logical partitions. Furthermore, the maximum addressable disk size theoretically skyrockets to zettabyte levels, far exceeding current needs, but guaranteeing that We will not fall short in the short or medium term.

Another crucial difference is that GPT It stores redundant copies of its header and partition table. at the beginning and end of the disk, along with CRC checksums. This allows for the detection of corruption and, in many cases, recovery. In MBR, if that 512-byte sector becomes corrupted, you can easily lose access to the entire disk.

In summary, UEFI and GPT form a tandem that provides greater capacity, more partitions, redundancy, and integrity verification, something fundamental in modern records, SSD NVMe high-performance and systems with multiple operating systems.

Description of the boot process in UEFI systems

Now that the concepts are clear, let's get to the heart of the matter: what exactly does a computer with UEFI do from the moment you turn it on until the login screen appears? The workflow is different from the classic BIOS + MBR model, although at first glance the user only perceives that it boots up. faster and with fewer strange stories.

1. Powering on and firmware initialization

When you press the power button, the CPU looks for the firmware code at a fixed memory address and starts running the UEFI environment stored there. NVRAM or motherboard flash memoryUnlike Legacy BIOS, UEFI can operate in 32 or 64 bits from the start, allowing it to use more memory and work with more complex data structures.

In this phase, the POST (Power-On Self-Test) is performed. UEFI checks essential components such as the CPU, RAM, GPU, storage, and ports. USBfans and other critical devices. If something fails, the equipment will typically emit error beeps or display codes on screen before moving on.

2. Loading UEFI Drivers and Services

Once the basic check is complete, the UEFI firmware loads its own drivers for certain devices (for example, some network or storage controllers) and enables them. startup and runtime servicesThese services will be accessible to both the boot manager and the operating system kernel during the initial phases.

The configuration stored in NVRAM also applies here: boot orderSecurity options such as Secure Boot, lists of authorized EFI applications, etc. Changes such as choosing whether to use UEFI mode or Legacy/CSM mode, or enabling or disabling Secure Boot, are stored precisely in this non-volatile memory.

3. Location of the EFI System Partition (ESP)

In a standard UEFI system, instead of going directly to the MBR, the firmware looks on the storage devices for a partition with a specific GUID that marks it as EFI System Partition (ESP)This partition is usually formatted in FAT and contains EFI executables (.efi files) for boot managers and utilities.

Within the ESP, a default boot path is defined, normally /EFI/Boot/bootx64.efi in 64-bit systems. Additionally, NVRAM stores extra boot entries: for example, an entry for Windows Boot Manager, another one for GRUB on a distro Linux, another for diagnostic tools, etc. The internal UEFI boot manager can show you these options in a menu or follow a preconfigured order.

4. EFI boot manager execution

Once the device and boot entry are selected (either by configuration or user choice), the firmware loads the corresponding EFI application into memory, for example the boot manager of Windows or GRUB in UEFI modeand transfers control to him.

The main difference compared to the MBR model is that we are no longer limited to 512 bytes of initial code or a single, rigid partition table. The EFI boot manager can directly read the GPT table, access different file systems on the ESP, and offer a visually appealing and configurable menu. multibootAll of this is supported by the services offered by UEFI.

5. Loading the operating system kernel

The boot manager is responsible for locating the operating system kernel (and, if applicable, the initrd or initramfs in systems like Unix), load it into memory and pass it boot parameters and hardware information. At this stage, it can still rely on UEFI services to read disks, consult ACPI tables, etc.

Once the kernel takes over, it begins more advanced device initialization, loading specific drivers, mounting user file systems, and starting system services. Finally, the graphical or console environment you use daily is launched and displayed. login screen or desktop.

BIOS Legacy vs UEFI: Functional and Usage Differences

It introduces very specific improvements These differences go beyond a simple name change: on the surface, both "do the same thing": initializing the hardware and booting the operating system. But UEFI introduces very specific improvements that significantly change the landscape.

On one hand, UEFI allows manage disks larger than 2 TB without TricksThis is important in modern PCs, workstations, and servers. Furthermore, the interface is no longer a blue or black screen controlled solely by the keyboard, but rather a more user-friendly graphical environment, typically with mouse support and menu-style navigation.

Furthermore, UEFI incorporates mechanisms such as Secure Boot, which Verify the signature of the boot components to prevent malware it sneaks in during that early phase before the antivirus or firewall starts. Traditional BIOS, on the other hand, was much more vulnerable in this respect and left the boot process highly exposed to UEFI bootkits and other low-level attacks.

Another key point is the flexibility in multi-booting. With BIOS + MBR, boot managers had to manage the MBR, the active partition, and various boot chains. With UEFI + GPT, each system can have its own .efi file on the ESP, and the firmware itself knows how to handle it. several clean and well-organized boot entries.

Therefore, if your hardware allows it, the general recommendation is to always use native UEFI mode instead of legacy BIOS mode. You'll gain in capacity, performance, security, and ease of use when managing operating systems.

Specifically boot in UEFI or BIOS mode and control WinPE

If you use Windows PE or custom Windows installers, you can decide which mode you want your computers to boot in. When you access the firmware's boot menu, you'll typically see duplicate entries for the same device: for example, “UEFI: USB Drive” and “BIOS: USB Drive”Choosing one or the other determines the firmware mode in which WinPE or the installer will run.

Some devices only support one of the two modes. Others allow both, but if you want to force an image to boot in only one specific mode, you can experiment with removing certain files from the media: remove the file Bootmgr from the root to force UEFI boot, or delete the folder efi so that it only boots into BIOS.

Another technique used in corporate deployments is to prepare the disk drives beforehand with the appropriate format: GPT for UEFI and MBR for BIOSIf you try to install Windows on a GPT disk by booting in BIOS mode, the installation will fail, and this serves as a "safety" to avoid mixing modes.

In WinPE, in addition to the PEFirmwareType registry value, you can use the command wpeutil UpdateBootInfo and batch scripts that analyze the reg query output to make automated decisions, such as launching a partitioning flow or another depending on the current mode; you can also rely on tools for Analyze Windows startup using BootTrace and refine specific steps.

All of this is especially relevant when you want to standardize the use of [the following] across all your teams. UEFI + GPT with Secure Bootwhich is currently the combination recommended by Microsoft and most manufacturers to take full advantage of hardware security and management capabilities.