Chapter 5 · BIOS and UEFI

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What do the letters BIOS and UEFI stand for?
  2. At which address does an x86 CPU start running after reset, and what is that address called?
  3. What CPU mode does the legacy BIOS run in, and how much memory can it reach?
  4. What does POST stand for, and what do beep codes tell you?
  5. What are the two big disk-layout limits of MBR that GPT fixes?
  6. What file system must the EFI System Partition use?
  7. Name the four Secure Boot databases/keys: PK, KEK, db, dbx. Which is the block list?
  8. What small battery keeps the clock running when the PC is unplugged?
  9. Which Windows command shows if Secure Boot is on (as Administrator, in PowerShell)?
  10. What does XMP / EXPO do?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. BIOS and UEFI

BIOS = Basic Input/Output System. UEFI = Unified Extensible Firmware Interface.

2. Reset vector

Near 0xFFFFFFF0 (16 bytes below 4 GB). It is called the reset vector. The chipset routes it to the firmware chip.

3. BIOS mode

16-bit real mode, which reaches only 1 MB of memory.

4. POST

Power-On Self-Test. Beep codes (or LEDs) report an error found before the screen works. The meaning depends on the maker, so check the manual.

5. MBR limits

Disks over about 2 TB cannot be used in full, and there are only 4 primary partitions. GPT supports vastly larger disks and 128 partitions by default, and keeps a backup table.

6. ESP file system

FAT32.

7. Secure Boot keys

dbx is the block list (forbidden signatures). db is the allow list. PK is the owner key. KEK keys can update db and dbx.

8. Battery

The CR2032 coin cell (3 V).

9. Secure Boot command

Confirm-SecureBootUEFI (True = on).

10. XMP / EXPO

It turns on a stored fast memory profile (speed, timings, voltage) so the RAM runs at its advertised speed instead of the default.

UNDERSTANDING QUESTIONS

Q1. Why does a modern 64-bit CPU still start in 16-bit real mode?

Answer Backward compatibility. Every x86 CPU resets into the same old state so that firmware written long ago (and the standard reset sequence) still works. Legacy BIOS stays in real mode. UEFI moves the CPU on into 32 and then 64-bit mode early in its own startup.

Q2. Why can't POST show an error message for every problem?

Answer Messages need RAM and a working graphics card, and those are tested and started during POST. Errors found earlier (RAM, CPU, graphics) cannot be shown as text, so the firmware uses a speaker beep code or debug LEDs, which need almost nothing to work.

Q3. Why does UEFI boot from the ESP instead of a 512-byte boot sector?

Answer UEFI can read a FAT32 file system, so it loads a real program file (`.efi`) of any size, from a named path, with a proper boot entry. A 512-byte boot sector can hold only about 440 bytes of code, so it was very limited, and it offered no way to check who made it.

Q4. How does Secure Boot decide to run or block a boot file?

Answer It hashes the file and reads its signature. If the hash or signing certificate is in the **dbx** block list, the file is refused. If the signature is valid and the signer (or hash) is in the **db** allow list, the file runs. Otherwise it is refused. The keys PK and KEK control who can change those lists.

Q5. Why does a dead CMOS battery on a UEFI PC usually only reset the clock?

Answer Modern UEFI settings, boot entries and Secure Boot keys are stored as variables in NVRAM, which is an area of the flash chip. Flash keeps its data without any battery. The battery mostly powers the real-time clock, so the clock is what you lose.

SCENARIO QUESTIONS (Troubleshooting)

S1. You install a second SSD with Windows from a USB stick, but the PC keeps booting the old Windows. What should you check?

Answer The **boot order**. Open the setup (or the one-time boot menu) and make sure the new "Windows Boot Manager" entry or the right drive is first. Also check that the USB stick is not still first and that Boot Mode is UEFI. You can look at the entries with `bcdedit /enum firmware`.

S2. After you switch SATA mode from RAID to AHCI in the setup, Windows shows a blue screen "INACCESSIBLE_BOOT_DEVICE". What happened and how do you fix it?

Answer Windows only had the driver for the old (RAID) mode, so it could not read its own disk with the new one. Switch the setting back to restore booting. To change safely, first run `bcdedit /set {current} safeboot minimal`, switch to AHCI, boot into Safe Mode (which loads the driver), then run `bcdedit /deletevalue {current} safeboot` and restart.

S3. The PC shows "CMOS checksum error" and the clock is wrong at every start. What do you do?

Answer The CR2032 coin battery is almost certainly dead. Power off and unplug, replace it with a new CR2032 (+ side up), then set the date, time and any settings you need again.

S4. VirtualBox says "VT-x is disabled in the BIOS". How do you fix it?

Answer Enter the firmware setup (for example through Advanced startup), find **Intel Virtualization Technology** (VT-x) or **SVM Mode** (AMD-V), set it to **Enabled**, then save and exit. You can confirm in Task Manager under Performance ► CPU: Virtualization: Enabled.

S5. A new PC powers on, fans spin, but there is no picture and no beep. What would you check?

Answer Check the monitor cable is in the graphics card (not the motherboard, if there is a card), re-seat the RAM, check the CPU power cable, and look at the debug LEDs (CPU, DRAM, VGA, BOOT). Remove extra parts to test with the minimum, and if needed clear the CMOS. Read the manual's beep and LED table. (No beep may also mean the board has no speaker.)

INTERVIEW QUESTIONS

I1. Explain the difference between BIOS and UEFI.

Answer BIOS is old 16-bit firmware that runs a 512-byte boot sector from an MBR disk, limited to about 2 TB disks and 4 primary partitions. UEFI is a modern 32/64-bit, modular firmware written in C that boots `.efi` programs from a FAT32 EFI System Partition on GPT disks, with graphical setup, network support, boot entries in NVRAM and Secure Boot.

I2. Describe what happens from power button to the bootloader on a UEFI PC.

Answer The PSU sends Power Good, the CPU leaves reset and jumps to the reset vector. The firmware runs its SEC phase, then PEI (starts RAM and the chipset), then DXE (loads drivers, discovers devices), then BDS (reads BootOrder and the boot entries). It loads the `.efi` boot manager from the ESP (checking Secure Boot signatures), which loads the OS and calls ExitBootServices.

I3. What is the EFI System Partition and what is in it?

Answer A small FAT32 partition (of a special GPT type) that holds the boot loaders and boot files for each OS, in `\EFI\\...` folders, for example `\EFI\Microsoft\Boot\bootmgfw.efi` and the BCD, plus the fallback `\EFI\BOOT\BOOTX64.EFI`.

I4. What do the keys PK, KEK, db and dbx do in Secure Boot?

Answer PK is the platform owner key; it authorises changes to the KEK. KEK keys authorise updates to db and dbx. The db is the allow list of trusted signers/hashes; the dbx is the block list of revoked ones. Boot files are checked against dbx first, then db.

I5. How would you check from Windows whether a PC uses UEFI with GPT and Secure Boot?

Answer Run `msinfo32` and read **BIOS Mode** (UEFI) and **Secure Boot State** (On). In PowerShell, `Get-Disk | Select Number, PartitionStyle` shows GPT or MBR, and as Administrator `Confirm-SecureBootUEFI` returns True if Secure Boot is on.

PRACTICAL TASK

Make a "boot passport" for your PC. On one page, write down: the firmware type and version (BIOS Mode and BIOS Version/Date), the disk layout (GPT or MBR), the names of the partitions (use Get-Partition and identify the EFI System Partition), the Secure Boot state, the TPM version (tpm.msc), the boot order from your setup screen, and the key you press to open the setup and the one-time boot menu. Finish with a short list of the settings you would check first if the PC would not start.

Why This Matters

When a PC will not boot, the facts on this page tell you where to start looking: the firmware, the disk, the boot entries or the security settings. A technician who knows these details can fix in minutes what otherwise takes hours, and you will avoid dangerous changes by knowing what each setting does.

CHAPTER SUMMARY

  • BIOS is the original 16-bit firmware: it runs POST, sets up the hardware, and starts the OS from the MBR. It has limits (1 MB real mode, about 2 TB disks, 4 partitions, no security).
  • The BIOS uses a boot ROM, real mode, interrupts (INT 10h/13h/16h/19h), services and option ROMs from add-in cards.
  • POST runs after Power Good and reset: CPU, chipset, RAM (training and test), video, devices. Early errors are shown with beep codes or LEDs.
  • UEFI is the modern replacement: modular, 64-bit, graphical, network-aware, using GPT, and loading .efi files from the ESP (FAT32).
  • Inside UEFI: firmware volumes, applications, protocols, Boot Services/Runtime Services, and the boot manager with entries in NVRAM.
  • Secure Boot uses PK, KEK, db, dbx and signatures so only trusted boot code runs. Microsoft's certificates are central. Disabling it lowers protection and can trigger BitLocker recovery.
  • Settings live in CMOS (battery-backed, old) and NVRAM (flash, modern). The CR2032 battery mostly keeps the clock.
  • Key settings: boot order, AHCI/RAID, XMP/EXPO, VT-x/AMD-V, TPM, fan curves. Change one thing at a time and write down the old value.