Somrthing altered my BIOS settings

[Sleepless in New Jersey]

Can applications alter BIOS settings?

After reinstalling Windows XP Home I ran into a phenomenon that I have never
encountered before. I reinstalled a frequently-used application. After a
subsequent reboot I found myself looking at a gray screen with a blinking
cursor in the upper left of the screen. Windows failed to boot. I
restarted, got into the BIOS setup, restored the default settings and
rebooted. This time everything was normal. I deleted the application. A
few days later I reinstalled a game and ran into the same phenomenon.
Restoring the BIOS defaults again cured the problem.

Neither program has ever given me a problem in the past.

I would seem that the applications somehow managed to alter the BIOS
settings. If so, this is something I had considered impossible. This is
read-only memory. I know that the BIOS can be flashed by special software.
I did not attempt any such action.

I am mystified, hence my question.

If my working hypothesis is incorrect, what else could be going on?

 

[kim]

The cmos battery on the mother board might be getting low, try replacing it.

 

[Paul]

Can applications alter BIOS settings?

After reinstalling Windows XP Home I ran into a phenomenon that I have never
encountered before. I reinstalled a frequently-used application. After a
subsequent reboot I found myself looking at a gray screen with a blinking
cursor in the upper left of the screen. Windows failed to boot. I
restarted, got into the BIOS setup, restored the default settings and
rebooted. This time everything was normal. I deleted the application. A
few days later I reinstalled a game and ran into the same phenomenon.
Restoring the BIOS defaults again cured the problem.

Neither program has ever given me a problem in the past.

I would seem that the applications somehow managed to alter the BIOS
settings. If so, this is something I had considered impossible. This is
read-only memory. I know that the BIOS can be flashed by special software.
I did not attempt any such action.

I am mystified, hence my question.

If my working hypothesis is incorrect, what else could be going on?

There is more than one web page, with documentation on defacto standards for
CMOS RAM contents. The first one is pretty interesting, while the second one
is easier to read at one glance.

http://www.textfiles.com/programming/cmos.lst
http://www.bioscentral.com/misc/cmosmap.htm

The CMOS data is protected by simple checksums. More than one checksum is
used (sections of bytes are protected). A Windows program altering the
contents of CMOS RAM, would also need to correct the checksum field to
match. Otherwise, on the next BIOS POST, the error would be detected,
and the CMOS values reset to defaults.

When I checked the datasheet for the ICH5 Southbridge on my motherboard,
it has a register to write protect the bytes that hold the password (0x38-0x3F),
so it is possible to prevent those from being written by an OS. (I.e. The
BIOS can "close the door" to OS write access to 0x38 through 0x3F.) In a quick
search, I didn't find any other configuration registers for the CMOS. My
Southbridge chip has room for 256 bytes, and since the first document above
describes indirect addressing via port 70 and data to port 71, you can see by
that interface definition, why they stopped at 256 bytes. Port 70 is
one byte, enough to address only a small number of locations. My southbridge
treats the 256 bytes as two "banks" of 128 bytes, and the following page
suggests why this was necessary - because only 7 bits of port 70 are used
for addressing.

http://www.codepedia.com/1/CMOS_C

Because bytes outside 0x38-0x3F aren't protected, then it would appear something
could write them. Maybe there are some other software mechanisms to protect
it, but that would take a lot more searching to find.

So it is not a read-only memory - it is battery backed static RAM. Unplugging
the computer and removing the coin cell battery, is one way to delete the
contents of the CMOS RAM.

Paul

 

[Sleepless in New Jersey]

Thanks for your effort. However, I'm confused by the replies. I am aware of
the battery-backed CMOS area. I have considered it to be separate from the
BIOS in flash ROM. Am I wrong about this? What I have had to do is restore
the ***BIOS*** defaults and save and exit the setup program.

As things now stand, I have had to forego use of my favorite CD/DVD burning
app. I'd like to keep it and the game. I'm looking for an explanation for
my BIOS-alteration problem.

 

[Paul]

Thanks for your effort. However, I'm confused by the replies. I am aware of
the battery-backed CMOS area. I have considered it to be separate from the
BIOS in flash ROM. Am I wrong about this? What I have had to do is restore
the ***BIOS*** defaults and save and exit the setup program.

As things now stand, I have had to forego use of my favorite CD/DVD burning
app. I'd like to keep it and the game. I'm looking for an explanation for
my BIOS-alteration problem.

The BIOS is a different chip than CMOS RAM.

Take my motherboard. It has a square chip, a PLCC package, in a socket. The
chip holds 512KB of data. The main BIOS code is in there. When I turn my
computer on, the processor reads instructions from that chip, as the
first thing it does. The code run is the "POST" or power on self test.
If I press the <delete> key, that triggers the BIOS setup code to run,
and convenient text (640x480) is displayed on the screen, to tell me what
settings are being used. The BIOS setup screens, are an interface to
setting up preferred settings (which are stored in CMOS RAM).

The setting choices I make in the BIOS setup screen, are recorded in the CMOS RAM.
That is the 128 or 256 bytes of random access memory inside the Southbridge chip.
It is right next to the RTC or real time clock. Both the CMOS RAM and RTC
are battery backed, and if the computer is unplugged, the CMOS RAM contents
are preserved by the battery.

The BIOS code in your computer, can be flash updated. The motherboard maker
may have a utility that runs in DOS (off a floppy). There may be the same
program, but actually stored inside the BIOS chip. Thirdly, there could be
a Windows based flashing utility, for updating the BIOS. If the BIOS code was
changed, pulling the battery would make no difference. BIOS code is non-volatile
with respect to system power - you can unplug the computer, remove the CMOS
battery, and the BIOS 512KB EEPROM can save the BIOS code for up to 10 years
without significant risk of corruption.

The CMOS RAM, as mentioned in my previous post, also appears to be writable
by an OS. At least areas other than the CMOS password. Removing the battery
would be an example of a way to clear the CMOS RAM of data (unplug the computer
before doing that). Replace the battery, and then turn on the computer. The
BIOS code (from the 512KB EEPROM) runs as it always does. The BIOS reads
the CMOS RAM, checks the checksum and goes "oh oh". It sees the bad checksum,
and then reloads the CMOS RAM with default values. The user can enter the
BIOS setup (pressing delete key), and reprogram any custom settings that
were lost.

I hope that description isn't too haphazard, to help you understand how it
works.

If the BIOS was truly overwritten with crap, your computer would no longer
be able to start (that is called "bricking a motherboard", something home
builders do all the time). By comparison, corrupted CMOS RAM is a trivial
problem, as removing the battery will cause usable defaults to be reloaded
into the RAM.

Paul

 

[Lil' Dave]

Bios settings are held in the cmos, a form of RAM. The cmos battery
maintains life of the RAM while the PC is physically off. Its on the
motherboard.

The bios is held in a chip on the motherboard. The cmos is NOT located
there.

2 different animals.

Like the PC's RAM, cmos can marginally fail. The cmos battery can be on the
virge of failing as well. The voltage regulator on the motherboard feeding
the cmos can be iffy as well.

Yes, 3rd party software could alter some cmos settings. Unlikely. More
unlikely as you had it installed before...

Strictly flashing the bios chip does not alter the cmos.

 

[Sleepless in New Jersey]

Thanks for the effort you have made. I'll remove the CMOS battery and
replace it. I hope that will do the job.

 

[Sleepless in New Jersey]

Thanks for the information. I'll go to work on the CMOS battery and hope for
the best.

 

[JohnO]

Bios settings are held in the cmos, a form of RAM. The cmos battery

maintains life of the RAM while the PC is physically off. Its on the
motherboard.

No, the battery keeps the real-time clock running, and that's it. The data
held in BIOS is non-volatile flash RAM, and remains intact forever whether
the battery is present or not. That's why the BIOS reset jumper exists,
otherwise we could just remove the battery and clear the BIOS settings, but
that doesn't work.

I'm surprised at some of the responses in this thread.

 

[RalfG]

Some PCs may use flash memory, not all of them. Removing the battery
sometimes does not work immediately because the PSU connected to the
motherboard can hold enough of a charge to keep the stored settings intact
for several hours after the battery is removed. Depends on the circuit
configuration of course. Removing the battery for just a few seconds cleared
the CMOS for me on one PC a few weeks ago (an Athlon board, c.2002-3).

 

[JohnO]

Fair enough, there are always exceptions.

I have worked with a dozen various Intel boards, some MSI, a couple ASUS,
and a mess of Soyo boards going back to 1996, and they all worked as I
described. Maybe I was just lucky.

I am truly curious how many of the P4-era boards use flash RAM vs CMOS RAM.
I'm working on a book that will be seen by ~40k students each year, and I'd
like to get this right.

-John O

 

[Paul]

Fair enough, there are always exceptions.

I have worked with a dozen various Intel boards, some MSI, a couple ASUS,
and a mess of Soyo boards going back to 1996, and they all worked as I
described. Maybe I was just lucky.

I am truly curious how many of the P4-era boards use flash RAM vs CMOS RAM.
I'm working on a book that will be seen by ~40k students each year, and I'd
like to get this right.

-John O

I suggest reading a datasheet for a Southbridge, before you write that book.

http://www.intel.com/design/chipsets/datashts/252516.htm

"RTC

The ICH5 contains a Motorola MC146818A-compatible real-time clock with 256 bytes
of battery backed RAM. The real-time clock performs two key functions: keeping
track of the time of day and storing system data, even when the system is powered
down. The RTC operates on a 32.768 KHz crystal and a separate 3 V lithium battery.

The RTC also supports two lockable memory ranges. By setting bits in the
configuration space, two 8-byte ranges can be locked to read and write accesses.
This prevents unauthorized reading of passwords or other system security information.

The RTC also supports a date alarm that allows for scheduling a wake up event up
to 30 days in advance, rather than just 24 hours in advance."

On page 4, you can see the flash BIOS is connected to the LPC bus. (Low pin count,
four bit wide data bus.) The flash BIOS is a separate entity, from the RTC. The
flash BIOS is a 512KB EEPROM on my motherboard, while the RTC is a separate
CMOS static RAM inside the Southbridge.

The Flash BIOS contains main BIOS code, boot block code, DMI/ESCD, microcode cache.
The last two are volatile, in the sense that, when the computer POSTs, the BIOS
may choose to flash update those sections itself. For example. say yesterday you
had one stick of RAM in the computer. You power off, and install a second stick
of RAM. When you start the computer, the POST may mention updating something. It
will be correcting the inventory information stored in the DMI/ESCD.

The microcode cache, was a BIOS call and feature, used on my 440BX board. When the
correct microcode is detected, for a newly installed processor, it is flash updated
into a couple 2K segments in the flash chip. It is possible, without altering the main
BIOS code, for a user to actually install their own microcode. This was useful in the
Tualatin era, for providing microcode support, when the motherboard manufacturer was
no longer willing to update the BIOS properly (as there is also a module which is
part of the main BIOS code, which contains typically 8 different microcodes).

Microcode is now larger than 2K, and Intel has made the size variable. So I'm not sure
the same feature exists. (And support for it differed between Award and AMI.)

And these are all things I discovered, while just fixing my home computers

If you want a simple experiment to start with, try flashing your BIOS. You can
even use your current version if you want. First, download the BIOS to use.
Flash upgrade the BIOS. Now, let the computer POST at least once. Using the
BIOS flash tool, make an archive copy of the BIOS. Do a binary compare of the
originally downloaded flash file, and the archive copy you just made (after
computer POSTed at least once). The files differ. The section of the BIOS
that is different, should be showing you the DMI and ESCD (volatile) sections.
The BIOS updated them, during the first POST cycle.

There is an infinite amount of trivia associated with the low level details
of PC hardware - if you're writing a book, you'll need plenty of "old farts"
to proof read it for you.

Paul

 

[JohnO]

If you want a simple experiment to start with, try flashing your BIOS. You

can

Although I'm sure that with yield results, I have an easier one. Remove the
battery and see what stays and what gets reset.

-John O