BIOS/UEFI Fundamentals
BIOS (Basic Input/Output System): legacy firmware stored in ROM chip on the motherboard. Initializes hardware (POST), then hands control to the OS bootloader. MBR (Master Boot Record) — legacy partition scheme used with BIOS. Limitations: cannot boot from drives > 2TB, text-only interface, slower initialization, 16-bit real mode operation.
UEFI (Unified Extensible Firmware Interface): modern replacement for BIOS. Supports GPT partitions (no 2TB limit), graphical interface with mouse support, Secure Boot, network boot before OS loads, faster startup via parallel device initialization, 32-bit or 64-bit operation. All modern PCs use UEFI. 'BIOS' is still colloquially used to refer to UEFI firmware settings.
Accessing UEFI/BIOS: press the setup key during POST — varies by manufacturer: Delete, F2 (most common), F1, F10, or Esc. Some systems require tapping the key repeatedly immediately after pressing power. On Windows: Settings → Update & Security → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.
Common BIOS/UEFI settings: Boot order (priority of boot devices), Secure Boot (enable/disable), virtualization (Intel VT-x / AMD-V — must enable for hypervisors like Hyper-V, VMware), fan settings (speed control), XMP/EXPO memory profile (enables rated RAM speed), storage controller mode (AHCI vs RAID), TPM (Trusted Platform Module — required for Windows 11), power management.
Secure Boot, TPM, and POST
Secure Boot: UEFI feature that verifies the OS bootloader has a valid cryptographic signature from a trusted authority before executing it. Prevents rootkits and boot-sector malware from loading before the OS. Requires: UEFI (not legacy BIOS), signed bootloader. Windows 10/11 sign their bootloaders. Linux distributions increasingly provide signed bootloaders. Disable Secure Boot only when: installing an OS that lacks a signed bootloader, troubleshooting UEFI boot issues.
TPM (Trusted Platform Module): dedicated security chip (or firmware-based fTPM) that stores cryptographic keys, measures boot process integrity, and enables BitLocker encryption. Windows 11 requires: TPM 2.0 + UEFI with Secure Boot. BitLocker uses TPM to protect the encryption key — if hardware changes significantly, BitLocker may trigger key recovery. Enable TPM in UEFI settings (may be labeled PTT on Intel, fTPM on AMD).
POST (Power-On Self Test): diagnostic tests the BIOS/UEFI runs at startup to verify hardware is functional. POST checks: CPU, RAM, video, keyboard, storage controllers. POST failure indicators: beep codes (different patterns indicate different failures — consult manufacturer's documentation), POST error messages on screen, error codes displayed on a two-character LED display (on some motherboards). Common beep patterns: 1 short beep = POST successful. Multiple short beeps = RAM failure. Long beeps = video card failure (varies by manufacturer).
Boot order: the sequence of devices BIOS/UEFI tries to boot from. Typical order: USB → CD/DVD → HDD/SSD → Network (PXE). Change boot order temporarily: press the boot menu key (F8, F11, F12, or Esc during POST) to select a one-time boot device without saving to BIOS — useful for booting from USB recovery media.