Deemwar Monads & Abstractions

The Updater Trap

Source: ThinkPad I9990303 Error Catch-22, by Michal Necasek

Michal Necasek’s circa-1994 IBM ThinkPad 750C stopped booting normally with error I9990303 and would not enter BIOS setup. Re-flashing the BIOS should fix corrupted flash, but the BIOS update tool failed before it got that far. A patched copy of the tool did the flash, and the laptop booted normally again.

I9990303 the boot error
CC4h offset of the patched routine
0 what it now always returns

What happened

  1. 1

    Error I9990303

    ThinkPad 750C, 486SL

    The laptop refused to boot normally and would not enter BIOS setup. It could still boot from a specially marked floppy, such as IBM’s maintenance or BIOS update disks.

  2. 2

    What the error means

    IBM manuals

    The ThinkPad 750 maintenance manual says the error indicates a faulty system board. For newer ThinkPads such as the 760 it is documented as a “Bank–2 flash ROM check sum error”. The author judged it likely that the firmware is partially corrupted.

  3. 3

    The fix is blocked

    UPDTFLSH.EXE

    Re-flashing should fix corrupted flash, but the update tool fails with “The system power management is disabled”, quite likely the same underlying problem. As far as the author could tell, the tool takes no command-line arguments and reads no environment variables.

  4. 4

    Disassemble and patch

    the laptop was already broken

    The author disassembled the tool. Its checks call INT 15h/5380h and then write to the “SL control port”, which the author guessed is the interface to the power management BIOS, running in System Management Mode. The routine at offset CC4h in the first code segment was patched to always return zero in AX. The tool was EXEPACKed, so it had to be unpacked and re-packed.

  5. 5

    Flashed and booting

    the result

    The patched tool flashed the BIOS. The I9990303 error was gone, BIOS setup could be entered, and the laptop booted normally again.

  6. the checks are there for a reason: a laptop BIOS update that loses power can brick the machine, which is why laptops often insist on a charged battery

The trap

Corrupted flasherror I9990303
Fix: re-flashUPDTFLSH.EXE
Tool checks failpower management disabled
Patched checkoffset CC4h returns 0

The part the tool needed to pass its checks was, quite likely, the part that was broken. The author calls it “almost certainly an unintentional side effect”, and it is easy to build into any updater or recovery path.

What to check in your own updater

CheckWhy
Test the updater on a machine where the part it repairs is brokenThat is the only case where the repair is needed.
List what the updater’s preconditions depend onA precondition that runs through the damaged part can block the repair.

Read more

The full write-up on OS/2 Museum.

Hacker News discussion.

Sources: every fact about the laptop, the error, the tool and the patch is from the OS/2 Museum post. The two checks are our advice.