Editing BIOS (section)

=== System startup ===
The [[8086]] and [[8088]] start at physical address FFFF0h.<ref>{{cite web|url = http://bitsavers.org/components/intel/_dataBooks/1981_iAPX_86_88_Users_Manual.pdf|title=iAPX 86,88 User's Manual|at=System Reset, p. 2-29, table 2-4|publisher=[[Intel]]|year=1981|access-date=April 15, 2018}}</ref> The [[80286]] starts at physical address FFFFF0h.<ref>{{cite web|url=https://en.wikichip.org/w/images/3/3e/AMD_80286_Datasheet_%28November_1985%29.pdf|title=AMD 80286 Datasheet|at=p. 13|publisher=[[AMD]]|quote=the 286 begins execution in real mode with the instruction at physical location FFFFF0H.|year=1985}}</ref> The [[80386]] and later x86 processors start at physical address FFFFFFF0h.<ref>{{cite web|url=http://bitsavers.org/components/intel/80386/230985-003_386DX_Microprocessor_Programmers_Reference_Manual_1990.pdf|title=80386 Programmer's Reference Manual|at=Section 10.1 Processor State After Reset, pages 10-1 - 10.3|publisher=Intel|year=1990}}</ref><ref>{{cite web|url = http://bitsavers.org/components/intel/80386/230985-003_386DX_Microprocessor_Programmers_Reference_Manual_1990.pdf|title=80386 Programmer's Reference Manual|at=Section 10.2.3 First Instruction, p. 10-4|publisher=Intel|quote=Execution begins with the instruction addressed by the initial contents of the CS and IP registers. To allow the initialization software to be placed in a ROM at the top of the address space, the high 12 bits of addresses issued for the code segment are set, until the first instruction which loads the CS register, such as a far jump or call. As a result, instruction fetching begins from address 0FFFFFFF0H.|year=1990|accessdate=November 3, 2013}}</ref><ref>{{cite web | url=http://download.intel.com/products/processor/manual/325462.pdf | at=Section 9.1.4 First Instruction Executed, p. 2611 | publisher=Intel | title=Intel® 64 and IA-32 Architectures Software Developer's Manual | date=May 2012 | accessdate=August 23, 2012 | quote=The first instruction that is fetched and executed following a hardware reset is located at physical address FFFFFFF0h. This address is 16 bytes below the processor’s uppermost physical address. The EPROM containing the software-initialization code must be located at this address. | archive-url=https://web.archive.org/web/20120808162037/http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf | archive-date=2012-08-08 | url-status=dead}}</ref> When the system is initialized, the first instruction of the BIOS appears at that address.

If the system has just been powered up or the reset button was pressed ("[[cold boot]]"), the full [[power-on self-test]] (POST) is run. If Ctrl+Alt+Delete was pressed ("[[Reboot|warm boot]]"), a special flag value stored in [[nonvolatile BIOS memory]] ("[[CMOS]]") tested by the BIOS allows bypass of the lengthy POST and memory detection.

The POST identifies, tests and initializes system devices such as the [[central processing unit|CPU]], [[chipset]], [[random-access memory|RAM]], [[motherboard]], [[video card]], [[computer keyboard|keyboard]], [[computer mouse|mouse]], [[hard disk drive]], [[optical disc drive]] and other [[computer hardware|hardware]], including [[integrated peripheral]]s.

Early IBM PCs had a routine in the POST that would download a program into RAM through the keyboard port and run it.<ref name="technical-ref-5-27"/><ref>{{cite web | title = IBM 5162 PC XT286 TechRef 68X2537 Technical Reference manual | date = August 1986 | page = 35 (System BIOS A-5) | url = http://www.reenigne.org/crtc/PC-XT.pdf | access-date = 2014-12-11 |url-status = live| archive-url = https://web.archive.org/web/20141211141709/http://www.reenigne.org/crtc/PC-XT.pdf | archive-date = 2014-12-11 }}</ref> This feature was intended for factory test or diagnostic purposes.

After the motherboard BIOS completes its POST, most BIOS versions search for option ROM modules, also called BIOS extension ROMs, and execute them. The motherboard BIOS scans for extension ROMs in a portion of the "[[upper memory area]]" (the part of the x86 real-mode address space at and above address 0xA0000) and runs each ROM found, in order. To discover memory-mapped option ROMs, a BIOS implementation scans the real-mode address space from <code>0x0C0000</code> to <code>0x0F0000</code> on 2&nbsp;[[kilobyte|KB]] (2,048 bytes) boundaries, looking for a two-byte ROM ''signature'': 0x55 followed by 0xAA. In a valid expansion ROM, this signature is followed by a single byte indicating the number of 512-byte blocks the expansion ROM occupies in real memory, and the next byte is the option ROM's [[entry point]] (also known as its "entry offset"). If the ROM has a valid checksum, the BIOS transfers control to the entry address, which in a normal BIOS extension ROM should be the beginning of the extension's initialization routine.

At this point, the extension ROM code takes over, typically testing and initializing the hardware it controls and registering [[interrupt vector]]s for use by post-boot applications. It may use BIOS services (including those provided by previously initialized option ROMs) to provide a user configuration interface, to display diagnostic information, or to do anything else that it requires.

An option ROM should normally return to the BIOS after completing its initialization process. Once (and if) an option ROM returns, the BIOS continues searching for more option ROMs, calling each as it is found, until the entire option ROM area in the memory space has been scanned. It is possible that an option ROM will not return to BIOS, pre-empting the BIOS's boot sequence altogether.