Comment by tryp

BIOS is often able to set mask bits in the CPU or chipset's pci bridges that prevent the devices from being reported to the OS. Before loading additional code like user DXEs or bootloader, BIOS commands a one-way sealing operation that prevents modifications until reset.