Y Yyyy YYY YYY Y! "Y#Y! "$ Y% "$Y !Y%Y&&" "$YY Y' (Y) YY Y +Y YY', Y Yy'Yy &yy Y YY Y-' YY Y./Y! $ Y'
Y Yyyy YYY YYY Y! "Y#Y! "$ Y% "$Y !Y%Y&&" "$YY Y' (Y) YY Y +Y YY', Y Yy'Yy &yy Y YY Y-' YY Y./Y! $ Y'
1 Terminology
2 IBM PC-compatible BIOS chips
3 Flashing the BIOS
4 BIOS chip vulnerabilities
5 Overclocking
6 Virus attacks
o 6.1 CIH
o 6.2 Black Hat 2006
o 6.3 Persistent BIOS Infection
7 Firmware on adapter cards
8 BIOS boot specification
9 Changing role of the BIOS
10 The BIOS business
11 See also
12 References
13 Further reading
14 External links
o 14.1 Specifications
BIOS
In IBM PC Compatible computers, the basic input/output system (BIOS), also known as the
System BIOS (pronounced /ˈbaɪ.oʊs/), is a de facto standard defining a firmware interface.[1]
The BIOS software is built into the PC, and is the first code run by a PC when powered on ('boot
firmware'). The primary function of the BIOS is to load and start an operating system. When the
PC starts up, the first job for the BIOS is to initialize and identify system devices such as the
video display card, keyboard and mouse, hard disk, CD/DVD drive and other hardware. The
BIOS then locates software held on a peripheral device (designated as a 'boot device'), such as
a hard disk or a CD, and loads and executes that software, giving it control of the PC.[2] This
process is known as booting, or booting up, which is short for bootstrapping.
BIOS software is stored on a non-volatile ROM chip built into the system on the mother board.
The BIOS software is specifically designed to work with the particular type of system in
question, including having a knowledge of the workings of various devices that make up the
complementary chipset of the system. In modern computer systems, the BIOS chip's contents
can be rewritten allowing BIOS software to be upgraded.
A BIOS will also have a user interface (or UI for short). Typically this is a menu system
accessed by pressing a certain key on the keyboard when the PC starts. In the BIOS UI, a user
can:
configure hardware
set various password prompts, such as a password for securing access to the BIOS UI
functions itself and preventing malicious users from booting the system from unauthorized
peripheral devices.
The BIOS provides a small library of basic input/output functions used to operate and control the
peripherals such as the keyboard, text display functions and so forth, and these software library
functions are callable by external software. In the IBM PC and AT, certain peripheral cards such
as hard-drive controllers and video display adapters carried their own BIOS extension ROM,
which provided additional functionality. Operating systems and executive software, designed to
supersede this basic firmware functionality, will provide replacement software interfaces to
applications.
The role of the BIOS has changed over time; today BIOS is a legacy system, superseded by the
more complex Extensible Firmware Interface (EFI), but BIOS remains in widespread use, and
EFI booting has only been supported in Microsoft OS products supporting GPT [3] and Linux
Kernels 2.6.1 and greater builds [4]
BIOS is primarily associated with the 16-bit, 32-bit, and the beginning of the 64-bit architecture
eras, while EFI is used for some newer 32-bit and 64-bit architectures. Today BIOS is primarily
used for booting a system and for video initialization (in X.org); but otherwise is not used during
the ordinary running of a system, while in early systems (particularly in the 16-bit era), BIOS
was used for hardware access – operating systems (notably MS-DOS) would call the BIOS
rather than directly accessing the hardware. In the 32-bit era and later, operating systems
instead generally directly accessed the hardware using their own device drivers. However, the
distinction between BIOS and EFI is rarely made in terminology by the average computer user,
making BIOS a catch-all term for both systems.
Terminology
The term first appeared in the CP/M operating system, describing the part of CP/M loaded
during boot time that interfaced directly with the hardware (CP/M machines usually had only a
simple boot loader in their ROM). Most versions of DOS have a file called "IBMBIO.COM" or
"IO.SYS" that is analogous to the CP/M BIOS.
Among other classes of computers, the generic terms boot monitor, boot loader or boot ROM
were commonly used. Some Sun and PowerPC-based computers use Open Firmware for this
purpose. There are a few alternatives for Legacy BIOS in the x86 world: Extensible Firmware
Interface, Open Firmware (used on the OLPC XO-1) and coreboot.
Boot Block
DMI Block
Main Block
PhoenixBIOS D686. This BIOS chip is housed in a PLCC package, which is, in turn, plugged
into a PLCC socket.
Prior to the early 1990s, BIOSes were stored in ROM or PROM chips, which could not be
altered by users. As its complexity and need for updates grew, and re-programmable parts
became more available, BIOS firmware was most commonly stored on EEPROM or flash
memory devices. According to Robert Braver, the president of the BIOS manufacturer Micro
Firmware, Flash BIOS chips became common around 1995 because the electrically erasable
PROM (EEPROM) chips are cheaper and easier to program than standard erasable PROM
(EPROM) chips. EPROM chips may be erased by prolonged exposure to ultraviolet light, which
accessed the chip via the window. Chip manufacturers use EPROM programmers (blasters) to
program EPROM chips. Electrically erasable (EEPROM) chips allow BIOS reprogramming
using higher-than-normal voltage.[5] BIOS versions are upgraded to take advantage of newer
versions of hardware and to correct bugs in previous revisions of BIOSes.[6]
Beginning with the IBM AT, PCs supported a hardware clock settable through BIOS. It had a
century bit which allowed for manually changing the century when the year 2000 happened.
Most BIOS revisions created in 1995 and nearly all BIOS revisions in 1997 supported the year
2000 by setting the century bit automatically when the clock rolled past midnight, December 31,
1999.[7]
The first flash chips were attached to the ISA bus. Starting in 1997, the BIOS flash moved to
the LPC bus, a functional replacement for ISA, following a new standard implementation known
as "firmware hub" (FWH). In 2006, the first systems supporting a Serial Peripheral Interface
(SPI) appeared, and the BIOS flash moved again.
The size of the BIOS, and the capacities of the ROM, EEPROM and other media it may be
stored on, has increased over time as new features have been added to the code; BIOS
versions now exist with sizes up to 16 megabytes. Some modern motherboards are including
even bigger NAND Flash ROM ICs on board which are capable of storing whole compact
operating system distribution like some Linux distributions. For example, some recent ASUS
motherboards included SplashTop Linux embedded into their NAND Flash ROM ICs.
Overclocking
Some BIOS chips allow overclocking, an action in which the CPU is adjusted to a higher clock
rate than its factory preset. Overclocking may, however, seriously compromise system reliability
in insufficiently cooled computers and generally shorten component lifespan. Overclocking,
incorrectly performed, may also cause component temperatures to rise so quickly that they
destroy themselves.
Virus attacks
There are at least three known BIOS attack viruses, two of which were for demonstration
purposes.
[edit]CIH
The first was a virus which was able to erase Flash ROM BIOS content, rendering computer
systems unstable. CIH, also known as "Chernobyl Virus", appeared for the first time in mid-1998
and became active in April 1999. It affected systems' BIOS's and often they could not be fixed
on their own since they were no longer able to boot at all. To repair this, Flash ROM IC had to
be removed from the motherboard to be reprogrammed elsewhere. Damage from CIH was
possible since the virus was specifically targeted at the then widespread Intel i430TX
motherboard chipset, and the most common operating systems of the time were based on the
Windows 9x family allowing direct hardware access to all programs.
Modern systems are not vulnerable to CIH because of a variety of chipsets being used which
are incompatible with the Intel i430TX chipset, and also other Flash ROM IC types. There is
also extra protection from accidental BIOS rewrites in the form of boot blocks which are
protected from accidental overwrite or dual and quad BIOS equipped systems which may, in the
event of a crash, use a backup BIOS. Also, all modern operating systems like Linux, Mac OS X,
Windows NT-based Windows OS like Windows 2000, Windows XP and newer, do not allow
user mode programs to have direct hardware access. As a result, as of 2008, CIH has become
essentially harmless, at worst causing annoyance by infecting executable files and triggering
alerts from antivirus software. Other BIOS viruses remain possible, however[8]; since Windows
users without Windows Vista/7's UAC run all applications with administrative privileges, a
modern CIH-like virus could in principle still gain access to hardware.
The second one was a technique presented by John Heasman, principal security consultant for
UK based Next-Generation Security Software at the Black Hat Security Conference (2006),
where he showed how to elevate privileges and read physical memory, using malicious
procedures that replaced normal ACPI functions stored in flash memory.
The third one, known as "Persistent BIOS infection", was a method presented in CanSecWest
Security Conference (Vancouver, 2009) and SyScan Security Conference (Singapore, 2009)
where researchers Anibal Sacco and Alfredo Ortega, from Core Security Technologies,
demonstrated insertion of malicious code into the decompression routines in the BIOS, allowing
for nearly full control of the PC at every start-up, even before the operating system is booted.
The proof-of-concept does not exploit a flaw in the BIOS implementation, but only involves the
normal BIOS flashing procedures. Thus, it requires physical access to the machine or for the
user on the operating system to be root. Despite this, however, researchers underline the
profound implications of their discovery: “We can patch a driver to drop a fully working rootkit.
We even have a little code that can remove or disable antivirus.”
Needs to be used before the operating system can be loaded (usually this means it is required
in the bootstrapping process), and
Older PC operating systems, such as MS-DOS (including all DOS-based versions of Microsoft
Windows), and early-stage bootloaders, may continue to use the BIOS for input and output.
However, the restrictions of the BIOS environment means that modern OSes will almost always
use their own device drivers to directly control the hardware. Generally, these device drivers
only use BIOS and option ROM calls for very specific (non-performance-critical) tasks, such as
preliminary device initialization.
In order to discover memory-mapped ISA option ROMs during the boot process, PC BIOS
implementations scan real memory from 0xC0000 to 0xF0000 on 2 KiB boundaries, looking for
a ROM signature: 0xAA55 (0x55 followed by 0xAA, since the x86 architecture is little-endian). In
a valid expansion ROM, this signature is immediately followed by a single byte indicating the
number of 512-byte blocks it occupies in real memory. The next byte contains an offset
describing the option ROM's entry point, to which the BIOS immediately transfers control. At this
point, the expansion ROM code takes over, using BIOS services to register interrupt vectors for
use by post-boot applications, provide a user configuration interface, or display diagnostic
information.
There are many methods and utilities for examining the contents of various motherboard BIOS
and expansion ROMs, such as Microsoft DEBUG or the UNIX dd.
There was a similar transition for the Apple Macintosh, where the system software originally
relied heavily on the ToolBox—a set of drivers and other useful routines stored in ROM based
on Motorola's 680x0 CPUs. These Apple ROMs were replaced by Open Firmware in the
PowerPC Macintosh, then EFI in Intel Macintosh computers.
Later BIOS took on more complex functions, by way of interfaces such as ACPI; these functions
include power management, hot swapping, thermal management. To quote Linus Torvalds, the
task of BIOS is "just load the OS and get the hell out of there". However BIOS limitations (16-bit
processor mode, only 1 MiB addressable space, PC AT hardware dependencies, etc.) were
seen as clearly unacceptable for the newer computer platforms. Extensible Firmware Interface
(EFI) is a specification which replaces the runtime interface of the legacy BIOS. Initially written
for the Itanium architecture, EFI is now available for x86 and x86-64 platforms; the specification
development is driven by The Unified EFI Forum, an industry Special Interest Group.
Linux has supported EFI via the elilo and GRUB boot loaders. The Open Source community
increased their effort to develop a replacement for proprietary BIOSes and their future
incarnations with an open sourced counterpart through the coreboot and OpenBIOS/Open
Firmware projects. AMD provided product specifications for some chipsets, and Google is
sponsoring the project. Motherboard manufacturer Tyan offers coreboot next to the standard
BIOS with their Opteron line of motherboards. MSI and Gigabyte Technology have followed suit
with the MSI K9ND MS-9282 and MSI K9SD MS-9185 resp. the M57SLI-S4 models.
Some BIOSes contain a "SLIC" (Software Licensing Information Code), a digital signature
placed inside the BIOS by the manufacturer, for example Dell. This SLIC is inserted in the ACPI
table and contains no active code. Computer manufacturers that distribute OEM versions of
Microsoft Windows and Microsoft application software can use the SLIC to authenticate
licensing to the OEM Windows Installation disk and/or system recovery disc containing
Windows software. Systems having a SLIC can be preactivated with an OEM Product Key, and
they verify an XML formatted OEM certificate against the SLIC in the BIOS as a means of self-
activating (see System Locked Preinstallation). If a user performs a fresh install of Windows,
they will need to have possession of both the OEM key and the digital certificate for their SLIC
in order to bypass activation; in practice this is extremely unlikely and hence the only real way
this can be achieved is if the user performs a restore using a pre-customised image provided by
the OEM.
Recent Intel processors (P6 and P7) have reprogrammable microcode. The BIOS may contain
patches to the processor code to allow errors in the initial processor code to be fixed, updating
the processor microcode each time the system is powered up. Otherwise, an expensive
processor swap would be required.[12] For example, the Pentium FDIV bug became an
expensive fiasco for Intel that required a product recall because the original Pentium did not
have patchable microcode.
Major BIOS vendors include American Megatrends (AMI), Insyde Software, Phoenix
Technologies and Byosoft. Former vendors include Award Software and Microid Research
which were acquired by Phoenix Technologies in 1998. Phoenix has now phased out the Award
Brand name. General Software, which was also acquired by Phoenix in 2007, sold BIOS for
Intel processor based embedded systems.
How BIOS Works
One of the most common uses of Flash memory is for the basic input/output system of your
computer, commonly known as the BIOS (pronounced "bye-ose"). On virtually every computer
available, the BIOS makes sure all the other chips, hard drives, ports and CPU function
together.
Every desktop and laptop computer in common use today contains a microprocessor as its
central processing unit. The microprocessor is the hardware component. To get its work done,
the microprocessor executes a set of instructions known as software (see How Microprocessors
Work for details). You are probably very familiar with two different types of software:
The operating system - The operating system provides a set of services for the applications
running on your computer, and it also provides the fundamental user interface for your
computer. Windows 98 and Linux are examples of operating systems. (See How Operating
Systems Work for lots of details.)
The applications - Applications are pieces of software that are programmed to perform specific
tasks. On your computer right now you probably have a browser application, a word processing
application, an e-mail application and so on. You can also buy new applications and install
them.
It turns out that the BIOS is the third type of software your computer needs to operate successfully. In this
article, you'll learn all about BIOS -- what it does, how to configure it and what to do if your BIOS needs
updating.
What BIOS Does
The BIOS software has a number of different roles, but its most important role is to load the operating
system. When you turn on your computer and the microprocessor tries to execute its first instruction, it
has to get that instruction from somewhere. It cannot get it from the operating system because the
operating system is located on a hard disk, and the microprocessor cannot get to it without some
instructions that tell it how. The BIOS provides thoseinstructions. Some of the other common tasks that
the BIOS performs include:
A power-on self-test (POST) for all of the different hardware components in the system to
make sure everything is working properly
Activating other BIOS chips on different cards installed in the computer - For
example, SCSI and graphics cards often have their own BIOS chips.
Providing a set of low-level routines that the operating system uses to interface to different
hardware devices - It is these routines that give the BIOS its name. They manage things like
the keyboard, the screen, and the serial and parallel ports, especially when the computer is
booting.
Managing a collection of settings for the hard disks, clock, etc.
When you turn on your computer, the BIOS does several things. This is its usual sequence:
Whenever you turn on your computer, the first thing you see is the BIOS software doing its thing. On
many machines, the BIOS displays text describing things like the amount of memory installed in your
computer, the type of hard disk and so on. It turns out that, during this boot sequence, the BIOS is doing a
remarkable amount of work to get your computer ready to run. This section briefly describes some of
those activities for a typical PC.
After checking the CMOS Setup and loading the interrupt handlers, the BIOS determines whether the
video card is operational. Most video cards have a miniature BIOS of their own that initializes the memory
and graphics processor on the card. If they do not, there is usually video driver information on another
ROM on the motherboard that the BIOS can load.
Next, the BIOS checks to see if this is a cold boot or a reboot. It does this by checking the value at
memory address 0000:0472. A value of 1234h indicates a reboot, and the BIOS skips the rest of POST.
Anything else is considered a cold boot.
If it is a cold boot, the BIOS verifies RAM by performing a read/write test of each memory address. It
checks the PS/2 ports or USB ports for a keyboard and a mouse. It looks for a peripheral component
interconnect (PCI) bus and, if it finds one, checks all the PCI cards. If the BIOS finds any errors during
the POST, it will notify you by a series of beeps or a text message displayed on the screen. An error at
this point is almost always a hardware problem.
The BIOS then displays some details about your system. This typically includes information about:
The processor
The floppy drive and hard drive
Memory
BIOS revision and date
Display
This is the message you receive if a disk is in the drive when you restart your computer.
Any special drivers, such as the ones for small computer system interface (SCSI) adapters, are loaded
from the adapter, and the BIOS displays the information. The BIOS then looks at the sequence of storage
devices identified as boot devices in the CMOS Setup. "Boot" is short for "bootstrap," as in the old
phrase, "Lift yourself up by your bootstraps." Boot refers to the process of launching the operating
system. The BIOS will try to initiate the boot sequence from the first device. If the BIOS does not find a
device, it will try the next device in the list. If it does not find the proper files on a device, the startup
process will halt. If you have ever left a disk when you restarted your computer, you have probably seen
this message.
The BIOS has tried to boot the computer off of the disk left in the drive. Since it did not find the correct
system files, it could not continue. Of course, this is an easy fix. Simply pop out the disk and press a key
to continue.
Configuring BIOS
In the previous list, you saw that the BIOS checks the CMOS Setup for custom settings. Here's what you
do to change those settings.
To enter the CMOS Setup, you must press a certain key or combination of keys during the initial startup
sequence. Most systems use "Esc," "Del," "F1," "F2," "Ctrl-Esc" or "Ctrl-Alt-Esc" to enter setup. There is
usually a line of text at the bottom of the display that tells you "Press ___ to Enter Setup."
Once you have entered setup, you will see a set of text screens with a number of options. Some of these
are standard, while others vary according to the BIOS manufacturer. Common options include:
Be very careful when making changes to setup. Incorrect settings may keep your computer from booting.
When you are finished with your changes, you should choose "Save Changes" and exit. The BIOS will
then restart your computer so that the new settings take effect.
The BIOS uses CMOS technology to save any changes made to the computer's settings. With this
technology, a small lithium or Ni-Cad battery can supply enough power to keep the data for years. In fact,
some of the newer chips have a 10-year, tiny lithium battery built right into the CMOS chip!
Occasionally, a computer will need to have its BIOS updated. This is especially true of older machines. As
new devices and standards arise, the BIOS needs to change in order to understand the new hardware.
Since the BIOS is stored in some form of ROM, changing it is a bit harder than upgrading most other
types of software.
To change the BIOS itself, you'll probably need a special program from the computer or BIOS
manufacturer. Look at the BIOS revision and date information displayed on system startup or check with
your computer manufacturer to find out what type of BIOS you have. Then go to the BIOS manufacturer's
Web site to see if an upgrade is available. Download the upgrade and the utility program needed to install
it. Sometimes the utility and update are combined in a single file to download. Copy the program, along
with the BIOS update, onto a floppy disk. Restart your computer with the floppy disk in the drive, and the
program erases the old BIOS and writes the new one. You can find a BIOS Wizard that will check your
BIOS at BIOS Upgrades.