BIOS, UEFI and the Boot Process

Firmware: the software that starts everything

When you press the power button, the processor has no operating system to run yet: the disk is just a device full of data it does not understand. The first code it runs is firmware: software stored in a flash memory chip on the motherboard itself, so it is there before any disk is read. Firmware knows the hardware of that specific board. It initializes the central processing unit (CPU), the memory and the chipset, tests the essentials, and then finds and starts the operating system (OS).

"Firmware" sits between hardware and software: it is software, but it ships with the device and changes rarely. Many other devices have their own firmware too — solid-state drives (SSDs), graphics cards, printers, network cards, routers. On a PC, "the firmware" or "the BIOS" usually means the motherboard's firmware and its setup screen. You reach that setup screen by pressing a key during start — commonly Del, F2, F10 or F12 (for a one-time boot menu), depending on the vendor; the start screen or the manual tells you which.

BIOS and UEFI

The Basic Input/Output System (BIOS) is the original PC firmware, from the IBM PC of 1981. It runs in the processor's old 16-bit mode, has a text-only setup screen operated with the keyboard, and boots by loading the first sector of a disk. It served for three decades, but its limits became real problems: it cannot boot from disks larger than about 2 TB with the Master Boot Record partition scheme, it has very little memory to work with, and it has no way to check whether the code it starts can be trusted.

The Unified Extensible Firmware Interface (UEFI) is its replacement, specified by the UEFI Forum and standard on PCs since the early 2010s. UEFI is a specification for how firmware talks to operating systems, not one product; each motherboard vendor implements it. What it adds:

• Booting from GUID (globally unique identifier) Partition Table (GPT) disks, including disks larger than 2 TB (see MBR and GPT).
• A graphical setup screen that can use a mouse, often with an easy mode and an advanced mode.
• Secure Boot: only signed bootloaders are started.
• Faster boot, because initialization runs in 32- or 64-bit mode and can skip steps (often called fast boot).
• Boot entries by file: instead of "the first sector of disk 1", a boot entry names a bootloader file, so several operating systems can live side by side cleanly.
• Built-in extras such as network boot support and, on many boards, firmware updates from a USB stick or even over the internet.

In everyday speech, people still say "BIOS" for any PC firmware, and many setup screens are still titled "BIOS". On a current PC it is almost always UEFI. For older operating systems or tools that only boot the legacy way, many UEFI boards offered a Compatibility Support Module (CSM) that imitates a BIOS. CSM is being phased out: many recent boards no longer offer it, and Secure Boot requires it to be off.

MBR and GPT

A disk needs a partition table that says where each partition starts and ends. There are two schemes:

• The Master Boot Record (MBR), from the BIOS era, lives in the disk's first sector together with the boot code. It allows four primary partitions (or three plus an extended partition holding more), and it stores sector numbers in 32 bits.
• The GUID Partition Table (GPT), part of the UEFI specification, names partitions by globally unique identifiers (GUIDs), allows 128 partitions in the usual layout, stores sector numbers in 64 bits, and keeps a backup copy of the table at the end of the disk with checksums, so damage can be detected and repaired.

The 32-bit sector numbers are what limit MBR. With the classic sector size of 512 bytes:

SECTOR = 512                 # bytes per sector (the classic size)

mbr_bytes = 2**32 * SECTOR   # MBR: 32-bit sector numbers
gpt_bytes = 2**64 * SECTOR   # GPT: 64-bit sector numbers

print(f"MBR limit: {mbr_bytes:,} bytes")
print(f"         = {mbr_bytes / 1000**4:.2f} TB (decimal, as on the box)")
print(f"         = {mbr_bytes / 1024**4:.0f} TiB (binary)")
print(f"GPT limit: {gpt_bytes / 1024**7:.0f} ZiB")

MBR limit: 2,199,023,255,552 bytes
         = 2.20 TB (decimal, as on the box)
         = 2 TiB (binary)
GPT limit: 8 ZiB

So a 4 TB disk partitioned with MBR can only use about 2.2 TB; the rest shows up as unallocated space that cannot be used. The practical rule is simple: UEFI plus GPT for every current system, MBR only for old hardware or small removable media. See Storage for why disk sizes differ between decimal and binary units.

CMOS and the settings memory

The firmware's settings — boot order, date and time, enabled devices — have to survive when the computer is unplugged. Historically they were kept in a small block of memory built with complementary metal-oxide-semiconductor (CMOS) technology, which uses so little power that a coin cell can keep it and the real-time clock running for years. That is why technicians still speak of "the CMOS" and "the CMOS settings". On many modern boards the settings themselves are stored in flash memory, and the battery mainly keeps the clock running; the name stuck anyway. The battery is usually a CR2032 lithium coin cell; see Motherboards.

A dying CMOS battery shows itself in a typical way: the date and time reset to a date in the past after the computer has been unplugged, sometimes with a message such as "CMOS checksum error" or a prompt to enter setup. Wrong clocks then cause secondary problems, such as certificate errors in the browser.

Clearing CMOS

Clearing CMOS resets the firmware settings to factory defaults. You do it when a wrong setting stops the computer from starting (for example a memory overclock that is not stable), or when a setup password is unknown on a desktop. The usual ways:

• A Clear CMOS jumper on the board (often labeled CLR_CMOS or JBAT1), moved to the clear position for a few seconds with the power cord unplugged.
• A Clear CMOS button on the rear panel of some boards.
• Removing the coin cell for a few minutes, with the computer unplugged.

Afterward, set the date and time and check the boot order and any settings the machine needs (such as virtualization support or the storage mode). On business laptops, a supervisor password is often stored in a way that clearing CMOS does not remove; that is on purpose, and it needs the vendor's procedure.

POST: the power-on self-test

The power-on self-test (POST) is the check the firmware runs right after power-on, before it looks for anything to boot. It verifies that the essentials are present and respond: the CPU, the memory (random-access memory, RAM), the graphics output, and the basic controllers. If something essential fails, the firmware cannot rely on the screen to report it, so it uses other signals:

• Beep codes through a small speaker on the board: patterns of long and short beeps. Their meaning differs per firmware vendor and even per board, so always look them up in the board's manual.
• Diagnostic light-emitting diodes (LEDs) labeled CPU, DRAM, VGA and BOOT, or a two-digit code display, on many current boards.
• Blinking patterns of the power or caps lock LED on many laptops.

A single short beep, or simply no sound at all followed by the logo, usually means POST passed. How to read these signals when something is wrong is covered in Hardware Troubleshooting.

The boot sequence step by step

Every PC start follows the same chain. Each step hands control to the next, and knowing where the chain breaks is most of the work when a computer "does not start".

1. Power good. The power supply unit (PSU) starts and, once its output voltages are stable, sends the Power Good (PWR_OK) signal to the motherboard. Until then the CPU is held in reset.
2. Firmware starts. The CPU begins executing the firmware from the flash chip, which initializes the processor, memory and chipset.
3. POST. The essentials are tested; failures are reported with beeps, LEDs or codes.
4. Boot device selection. The firmware goes through the boot order and picks the first device that holds something bootable.
5. Bootloader. A legacy BIOS runs the code in the disk's first sector; UEFI runs a bootloader file from the EFI System Partition (ESP), such as Windows Boot Manager or GRUB on Linux.
6. Operating system kernel. The bootloader loads the kernel into memory and starts it; from here, the OS takes over the hardware with its own drivers.

Boot order and boot devices

The boot order (or boot priority) is the list of devices the firmware tries, in order, until one of them holds a working bootloader. Typical entries:

• Internal disk: on UEFI, the entry is usually the operating system's own boot manager (such as "Windows Boot Manager") rather than the disk itself.
• USB: a Universal Serial Bus (USB) stick with an installer or a repair tool.
• Network: the Preboot Execution Environment (PXE) lets the network card fetch a boot image from a server, using the Dynamic Host Configuration Protocol (DHCP) to find it. Organizations use it to install operating systems on many machines without touching each one.
• Optical drive, on older machines.

You rarely need to change the permanent order for a one-off job: most boards have a one-time boot menu (often F12, F11 or F8, depending on the vendor) that boots from a chosen device just once. On UEFI systems the operating system can manage boot entries too. On Linux, efibootmgr lists them:

efibootmgr

BootCurrent: 0001
Timeout: 1 seconds
BootOrder: 0001,0000,0003
Boot0000* Windows Boot Manager
Boot0001* ubuntu
Boot0003* UEFI: PXE IPv4 Intel(R) Ethernet Connection

BootOrder is the boot order, as numbers that refer to the entries below it; BootCurrent is the entry used for the current start. On Windows, msinfo32 (System Information) shows BIOS Mode (UEFI or Legacy) and Secure Boot State on its summary page.

Settings a technician changes

Most firmware settings can stay at their defaults. The ones that come up in daily work:

• Boot order and fast boot (which may skip USB initialization, so a USB keyboard or stick is not seen until the OS runs).
• Virtualization support: Intel VT-x or AMD-V (sometimes called SVM mode). Hypervisors and features such as Windows Subsystem for Linux 2 (WSL 2) need it; it is off by default on some boards.
• Fan curves and temperature monitoring: how fast fans spin at which temperature, and the readouts for CPU temperature and fan speed.
• Passwords: a setup (administrator or supervisor) password protects the settings; a user or power-on password is needed to start the machine at all. A drive password locks the drive itself.
• TPM and Secure Boot: enabling the Trusted Platform Module (TPM) — sometimes listed as fTPM, PTT or Security Device — and Secure Boot, for example to meet the Windows 11 requirements.
• Integrated devices: turning on-board audio, network, serial ports or USB ports on or off, and the storage controller mode: Advanced Host Controller Interface (AHCI) or redundant array of independent disks (RAID).
• Date and time, especially after a CMOS reset.

Firmware updates

Vendors release firmware updates to support new CPUs on an existing board, fix bugs and stability problems, and close security holes. Writing new firmware to the flash chip is called flashing. Common ways:

• A flash utility built into the firmware setup that reads the update file from a USB stick.
• The vendor's update tool in the operating system, or updates delivered through Windows Update or, on Linux, the fwupd service.
• On some desktop boards, a flashback button and USB port that flash the firmware even without a CPU or memory installed — useful when a new CPU needs a newer firmware version than the board shipped with.

The main risk is an interruption: if the power fails halfway through writing, the chip holds half-old, half-new firmware and the board may not start at all (it is "bricked"). Some boards keep a backup copy (dual BIOS) and recover on their own; many do not. So: use only the file for that exact board model from the vendor, read the release notes, connect a laptop to its charger (many tools refuse to run on battery), use an uninterruptible power supply (UPS) for a desktop if you have one, and never switch off during the update, even if it seems to hang.

Secure Boot and the TPM

Two UEFI-era features protect the start of the computer. They are often mentioned together, but they do different jobs.

Secure Boot

Secure Boot is a UEFI feature in which the firmware checks the digital signature of every bootloader (and driver it loads at start) before running it. Only code signed with a key in the firmware's database of trusted keys is started; code on a list of revoked signatures is refused.

Why this matters: malware that hides in the boot process — a bootkit or rootkit — starts before the operating system and its antivirus, so the OS cannot see it. Secure Boot stops that at the first step: a modified bootloader no longer has a valid signature. PCs sold with Windows ship with Microsoft's keys; most mainstream Linux distributions start through a small bootloader called shim, which Microsoft has signed, so they boot with Secure Boot enabled as well. Microsoft's original 2011 Secure Boot certificates expire in 2026; devices need firmware and Windows updates that install the 2023 certificates.

On Linux, mokutil --sb-state reports the state:

mokutil --sb-state

SecureBoot enabled

In PowerShell, Confirm-SecureBootUEFI returns True when Secure Boot is on (it must run as administrator, and it returns an error on a system that does not boot in UEFI mode).

The Trusted Platform Module

A Trusted Platform Module (TPM) is a small security processor on or in the motherboard that creates and stores cryptographic keys, so that they cannot simply be copied off the disk. It can be a separate chip (a discrete TPM) or a function of the CPU's or chipset's security firmware (a firmware TPM, which AMD calls fTPM and Intel calls Platform Trust Technology, PTT). The TPM standard comes from the Trusted Computing Group; the current version is TPM 2.0.

What it is used for:

• Disk encryption: BitLocker on Windows stores its key in the TPM and releases it only when the boot process looks unchanged. If someone removes the disk and puts it in another computer, the key is not there, and the data stays unreadable.
• Measured boot: during start, each step is measured (hashed) into the TPM, so the system can prove that it started with the expected firmware and bootloader.
• Credentials: sign-in methods such as Windows Hello keep their keys in the TPM.

Windows 11 requires TPM 2.0 (and UEFI firmware capable of Secure Boot). On a PC that seems to lack a TPM, it is often only switched off in the firmware settings. tpm.msc shows the TPM status on Windows, as does Get-Tpm in an elevated PowerShell (run as administrator):

Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled

TpmPresent TpmReady TpmEnabled
---------- -------- ----------
True       True     True