Bios32 Services

news.fc.hp.com

unread,

Mar 9, 2005, 7:15:37 PM3/9/05

to

Does anybody have any examples of how to call a bios32 service from windows
xp? How do you gain acess to the f0000 physical memory segment to look for
the _32_ signature to find the bios32 entry point? Any examples would be
greatly appreciated. I know in most cases you probably don't need to call
these services anymore, but we've implemented several features in bios and
(for learning purposes) i'm trying to write a driver that can call them.
I've seen utilities that do this so I know it can be done. It's just a
matter of figuring out what a driver needs to do to get access to the legacy
f0000 memory and then somehow call the service i'm interested in.

Thanks,
-Lance

Stephan Wolf [MVP]

unread,

Mar 10, 2005, 3:24:28 AM3/10/05

to

BIOS is not available in 32-bit Windows, period.

Don Burn

unread,

Mar 10, 2005, 1:30:30 PM3/10/05

to

And except for some support for BIOS in the graphics subsystems, anything
else is a terrible hack. I've encountered people doing this, and most of
the system are so unstable you might as well be running Windows 1.0.
Windows does not use BIOS (except for the above mentioned graphics), you
shouldn't either once the operating system is running.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"news.fc.hp.com" <do...@email.com> wrote in message
news:tL0Yd.1442$fS3...@news.cpqcorp.net...
> That is absolutely not true. I write bios for a living. I have tools
> that make calls into the bios from windows. I'm just trying to learn how
> the windows interface works.
>
>
> "Stephan Wolf [MVP]" <ste...@hotmail.com> wrote in message
> news:gu0031ha3jegodpjs...@4ax.com...

news.fc.hp.com

unread,

Mar 10, 2005, 1:56:25 PM3/10/05

to

That is absolutely not true. I write bios for a living. I have tools that
make calls into the bios from windows. I'm just trying to learn how the
windows interface works.

"Stephan Wolf [MVP]" <ste...@hotmail.com> wrote in message
news:gu0031ha3jegodpjs...@4ax.com...

David Welch

unread,

Mar 10, 2005, 4:33:44 PM3/10/05

to

Use MmMapIoSpace to map 0xf0000. You should be able to call the entry point
with the just the selectors the NT kernel puts in CS and DS.

Alexander Grigoriev

unread,

Mar 11, 2005, 1:28:25 AM3/11/05

to

Unless the code is position-independent, this won't work.

"David Welch" <we...@DONTSPAMcwcom.net> wrote in message
news:d0qefn$eej$1...@nwrdmz03.dmz.ncs.ea.ibs-infra.bt.com...

David Welch

unread,

Mar 11, 2005, 5:16:26 AM3/11/05

to

Alexander Grigoriev wrote:
> Unless the code is position-independent, this won't work.
>

According to the BIOS32 specification it should be
position-independent. Of course in practice the BIOS
might be written to expect whatever 9X sets up.

Don Burn

unread,

Mar 11, 2005, 8:11:29 AM3/11/05

to

Of course if a second driver does this, you are hosed because there is
nothing in the BIOS specs that require things to be multi-tasking safe.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"David Welch" <we...@DONTSPAMcwcom.net> wrote in message
news:d0qefn$eej$1...@nwrdmz03.dmz.ncs.ea.ibs-infra.bt.com...

Maxim S. Shatskih

unread,

Mar 11, 2005, 9:43:03 AM3/11/05

to

> Does anybody have any examples of how to call a bios32 service from windows
> xp? How do you gain acess to the f0000 physical memory segment to look for

Why do you need this? Anything useful there?
BIOS is just to boot the machine.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com

Maxim S. Shatskih

unread,

Mar 11, 2005, 9:43:38 AM3/11/05

to

I think KeI386CallBios holds a spinlock for the duration of the call.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com

"Don Burn" <bu...@stopspam.acm.org> wrote in message
news:QPgYd.398$K14...@fe02.lga...

Don Burn

unread,

Mar 11, 2005, 10:23:30 AM3/11/05

to

Max,

Exactly, the system does it that case. These kludge techniques of just
map the BIOS into memory an call it don't.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"Maxim S. Shatskih" <ma...@storagecraft.com> wrote in message
news:d0sals$gas$1...@gavrilo.mtu.ru...

David Welch

unread,

Mar 11, 2005, 12:29:10 PM3/11/05

to

This is a sample implementation:-

#include <ntddk.h>

typedef struct
{
UCHAR Signature[4];
ULONG EntryPoint;
UCHAR Revision;
UCHAR Length;
UCHAR Checksum;
UCHAR Reserved[5];
} BIOS32_HEADER;

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN
PUNICODE_STRING RegistryPath)
{
PVOID BiosSegment;
PVOID EntrypointMap;
PVOID Entrypoint;
ULONG i, j;
BIOS32_HEADER* Header;
ULONG Result;
PHYSICAL_ADDRESS BiosAddress ;
ULONG PciBase, PciLength, PciEntrypoint;

BiosAddress.LowPart = 0xe0000;
BiosAddress.HighPart = 0;
BiosSegment = MmMapIoSpace(BiosAddress, 0x1fff0, MmCached);
if (BiosSegment == NULL)
{
DbgPrint("Couldn't map bios\n");
return STATUS_UNSUCCESSFUL;
}

for (i = 0; i <= 0x1fff0; i+=16)
{
Header = (BIOS32_HEADER*)((PUCHAR)BiosSegment + i);
if (Header->Signature[0] == '_' &&
Header->Signature[1] == '3' &&
Header->Signature[2] == '2' &&
Header->Signature[3] == '_')
{
UCHAR Checksum;
DbgPrint("Found signature at %p\n", Header);
Checksum = 0;
for (j = 0; j < 16; j++)
{
Checksum += ((PUCHAR)BiosSegment)[i + j];
}
if (Checksum != 0)
{
DbgPrint("Found signature but checksum was wrong\n");
continue;
}
break;
}
}
if (i == 0x10000)
{
DbgPrint("No bios32 header found\n");
MmUnmapIoSpace(BiosSegment, 0x10000);
return STATUS_UNSUCCESSFUL;
}
if (Header->EntryPoint < 0xf0000 || Header->EntryPoint > 0x100000)
{
PHYSICAL_ADDRESS EntrypointAddress;
EntrypointAddress.LowPart = Header->EntryPoint & ~0xfff;
EntrypointAddress.HighPart = 0;
EntrypointMap = MmMapIoSpace(EntrypointAddress, 0x2000, MmCached);
if (EntrypointMap == NULL)
{
DbgPrint("Couldn't map memory containing bios32 entrypoint\n");
MmUnmapIoSpace(BiosSegment, 0x10000);
return STATUS_UNSUCCESSFUL;
}
Entrypoint = (PVOID)((PUCHAR)EntrypointMap + (Header->EntryPoint &
0xfff));
}
else
{
Entrypoint = (PVOID)((PUCHAR)BiosSegment + (Header->EntryPoint -
0xe0000));
EntrypointMap = NULL;
}
_asm
{
mov bl, 0
mov eax, (('$' << 0) + ('P' << 8) + ('C' << 16) + ('I' << 24))
mov ebx, 0
push cs
call [Entrypoint]
movzx eax, al
mov [Result], eax
mov [PciBase], ebx
mov [PciLength], ecx
mov [PciEntrypoint], edx
}
if (Result == 0x81)
{
DbgPrint("PCI service doesn't exist.\n");
}
else if (Result == 0x00)
{
DbgPrint("PCI service exists (Base 0x%.8X Length 0x%.8X Entrypoint
0x%.8X).\n", PciBase, PciLength, PciEntrypoint);
}
else
{
DbgPrint("Unexpected result from bios32 entrypoint\n");
}
MmUnmapIoSpace(BiosSegment, 0x10000);
if (EntrypointMap != NULL) MmUnmapIoSpace(EntrypointMap, 0x2000);
return STATUS_UNSUCCESSFUL;
}

Philip Doragh

unread,

Mar 12, 2005, 7:36:55 AM3/12/05

to

"Maxim S. Shatskih" <ma...@storagecraft.com> wrote in message

news:d0sakp$g9v$1...@gavrilo.mtu.ru...

As an engineer for a notebook OEM, I can affirm that the BIOS needs to be
called throughout the time that the PC is on and it is done mostly by 32 bit
calls.

Notebook OEMs have been calling into the BIOS on 32 bit OSes even since NT
3.1...that is because the BIOS is where all the power managment code for
battery, suspend, resume, hibernation and other features are kept. While it
is true that you cannot call into any part of the BIOS, parts of the BIOS
have been explicitly coded to allow 32bit calls... and this is just for
older features, with the latest technology features all of this is
accomplish via ACPI.

Phil Doragh
PC SW Engineer for IBM, Compaq and HP

Maxim S. Shatskih

unread,

Mar 12, 2005, 8:38:51 AM3/12/05

to

> Notebook OEMs have been calling into the BIOS on 32 bit OSes even since NT
> 3.1...that is because the BIOS is where all the power managment code for
> battery, suspend, resume, hibernation and other features are kept.

Why not rely on ACPI instead? Hard-code the ACPI methods to the BIOS, and let
the OS's ACPI.SYS to execute them to do suspend/resume. This is how modern
world lives.

Philip Doragh

unread,

Mar 12, 2005, 6:14:09 PM3/12/05

to

"Maxim S. Shatskih" <ma...@storagecraft.com> wrote in message

news:d0ur8a$1vpv$1...@gavrilo.mtu.ru...

Because ACPI did not exist 10 years ago and why re-implement code that is
already working and has been working for years. Now that ACPI exists new
features are being implemented with it instead....of course XP uses APCI to
suspend... but NT 4 uses APM and the boxes have to support various OSes and
versions. Give me and my OEM SW colleagues the benefit of doubt when it
comes to this area, we have been doing this kind of work since Windows was a
gleam in Microsoft's eye.... all the teams I have been a part of know the
pros and cons of the various methods and their affect on the OS. I was just
trying to say that 32bit calls into the BIOS are not inherently bad and
cannot/should not be done as was mentioned in previous posts. They are done
all the time and very safely and with expertise in the right situations and
for the right reasons. Of course as new and better tools come along, OEM
engineers would be fools not use them.

Phil Doragh

Maxim S. Shatskih

unread,

Mar 12, 2005, 6:47:45 PM3/12/05

to

> trying to say that 32bit calls into the BIOS are not inherently bad and

Then disassemble VideoPortInt10 and look how it calls KeI386CallBios. Then do
the similar call in your driver.

This will be the safest way.