PC-9821AS BIOS schenanigans and general 9821 BIOS information

Started by sampson, August 17, 2019, 12:06:18 AM

Previous topic - Next topic

sampson

This post will feel disjointed but bare with me, it all comes together in the end.

So if you're here you likely own a physical 9821 computer. Like me you're probably annoyed with the 543MB limit on IDE hard drives. Stupid and annoying! Well if you search across the internet for long enough you'll end up at this page: http://ookumaneko.s1005.xrea.com/d27c4000.htm which describes a fix to correct the IDE bug on AS/AP as well as AS2/AP2. Great!

So you download the patch and open it up to find a few files, PATCH.ASM, PATCH.BAT, PATCH.LST and PATCH.BIN. There's some comments in PATCH.ASM that mentions locations being patched but instructions are not clear at all how to apply this patch. Physically a PC9821AS/AP has the BIOS in an EPROM that is socketed on the CPU board. Later models however switched to a maskrom that is directly soldered which can be removed and replaced with a socket/EPROM. The chip is a 27c400 and is easily read as well as rewritten with proper hardware. Logical conclusion since I have a stack of chips laying around is to waste months poking the BIOS to get this to work.

Recently I had a breakthrough while working with a MAME dev to assist with getting it to run a proper 9821 BIOS. I came across the program GETITF98.EXE which is a program to do a checksum across the bios on newer machines - http://hp.vector.co.jp/authors/VA012947/util/getitf98.html

It also houses a lot of great information about the bios such as the layout of it! Yay! We find that the BIOS is split into banks of 32KB, 16 total banks. We also have a general layout of the banks:
<Highest address as ROM>
BANK4 ITF F8000h (Top boot block)
BANK5 BIOS E8000h (N88BASIC)
BANK6 BIOS F0000h (system)
BANK7 BIOS F8000h (system)
BANK0 PCI / PnP BIOS D8000h
Various depending on BANK1 model (Microcode update other than power management microcomputer, APIC control / P6 tower machine)
BANK2 debugging code (MMDUMP) etc.
BANK3 IDE / system setup menu D8000h IDE BIOS is first 2000h bytes
== <Lower address as ROM (in the case of 2Mbit)> ==
BANKC --- Something that seems to be nothing or data from the Canbe graphic startup screen
BANKD ---
BANKE ---
BANKF ---
BANK8 ---
BANK9 ---
BANKA ---
BANKB Microcode update data (P6 tower machine only)
== <The lowest address as ROM (in the case of 4Mbit)> ==

Now that I know order and that IDE is located specifically in the first 0x2000 bytes of BANK3 we can pull out Ghidra and start disassembling from the start of BANK3. Reason I did this is because PATCH.BIN is a smaller file full of null data and small runs of some binary data. Matching those blocks up with Ghidra we find that they do patch over proper instruction locations and should slot in nicely. If you do not want to split and rejoin the BIOS you can apply the patch to either AS/AP or AS2/AP2 by starting at 0x18000 as your base patching address for PATCH.BIN. This patch does not affect checksum so you are safe to just drop it in blindly.

Turns out it works! I can now use up to 120GB hard drives in the IDE caddy. This is great and all but I now have the BIOS layout figured out and as expected most all of the text used within the BIOS is Shift-JIS. However there is a problem with modifying the BIOS in that there is a checksum. If you do any changes Pi-Po never happens and the machine refuses to post due to invalid checksum. Going back to GETITF98.EXE we find a function in the source CalcSum_ROM which is extremely simple. It just takes the odd and even bytes from each bank, adds them all up and provides the smallest byte as the checksum on the last two bytes of each bank.

So obviously with checksum figured out and knowledge of how to edit the BIOS the next step is almost a no-brainer:

Why not translate the BIOS menu? :)

There's a few limitations as I did not want to deal with relocating the strings but it works for what you need.

"Plasma Display" is actually two different strings for some reason so I cannot work around the two byte space without breaking things.
"Floppy Disk Drives" string is re-used for the two options. There's no way to be more specific as it would make the other option confusing.
Some strings were written in short-hand because I didn't have enough space. They're still rather self-explanatory and the hints help fill in gaps.

If you wish to use this menu simply obtain a 27c400 chip and burner. Either read your existing EPROM or obtain the bios from the MAME set (this isn't formally released yet but should come in an upcoming version as they have the BIOS file now.) Apply the IPS patch, burn the resulting binary data to your 27c400 and shove it in the board. This also includes the IDE patch so you should be good to go all around.
You can obtain the IPS patch here https://1drv.ms/u/s!AqwQP-hlVI

LowDefAl

Nice. I'm looking at getting a 21 to go with my 01 (mostly because it makes more financial sense than buying an external 3.5" drive) so I'll keep this in mind if I get an Ax.

dasfool

Nice work, Sampson. With the number of games that are being translated lately, storage is becoming more troublesome. This should be pretty helpful.

famiac

this is so awesome. Great work!!

Could you attach the ips file in an archive please?
I can't get the link you posted to work

papa_november

Impressive! This is the first translation of a PC-98 BIOS that I know of.

famiac

Bump: The IPS link is still not up. Would really like to try this out!

sampson



megatron-uk

Hi folks, long time lurker and I thought I'd post another option for huge drives in A-mates (and some others). There is the possibility of using the exide486 replacement IDE BIOS rom on a add-in C-bus card. The compatibility list includes:

PC-9821Ap3,As3,An,Xe,Xs,Xp,Cx,Cb,PC-9801BX3,BA3

In my case I'm successfully using it on my PC-9821An.

This BIOS is here: http://hp.vector.co.jp/authors/VA012947/exiderom/exide486.html

You will need:

  • A free C-bus slot
  • A compatible SCSI or network card
  • An 8KB or pair of 4KB eproms and writer
  • An IDE drive up to 127GB

The C-bus card must have a replaceable/socketed or reflashable BIOS - SCSI and LAN cards are the best option as they usually have a standard DIL/DIP-16 ROM. I tried a small handful of SCSI cards:

  • IO-Data SC-982A
  • Logitec LHA-201
  • TEAC IF-92B

I also have a ICM IF-2767 to test at some point.

Of the above though, I only managed to get the TEAC to work; the others mis-behaved in various ways (locked at the memory test screen, the exide BIOS never appeared, etc). You then run the small utility included in the exid486.lzh archive from the exide486 website and choose which mode you want the replacement BIOS to work in - SCSI compatible, split partitions, maximum size, etc. Which you choose determines what partitioning/format tools you need. With a bit of experimentation I found that the maximum-partition size option works really well (this is number 1 option in the list).

The tool then generates a custom IDE BIOS ROM for your machine - both a 8K file and a pair of 4K files, as you may need one or the other, depending on the ROM arrangement of your SCSI/LAN card. Take the file and burn it to an EPROM and carefully replace the built-in SCSI/LAN ROM on your chosen C-bus card.
Do be aware that if you replace the SCSI ROM, you will lose the ability to use the SCSI controller! Though you can always swap the original ROM back later.

If you find a card that works, you then get a boot message after the memory test to confirm the drive has been found and a note of its capacity.

To use the massive drive, you need to use the following tools:

DISKINIT (found on the PC-98 Win 98 SE Emergency Boot Floppy)
FDISK (found on the PC-98 Win 98 SE Emergency Boot Floppy)
FORMATX (from https://web.archive.org/web/20150303004824/http://hp.vector.co.jp/authors/VA012947/soft_disk.html) - note that the utility has disappeared from the authors current website.

Optionally, you can still make the drive PC-98 to DOS/Windows/Linux compatible using CONV98AT:

CONV98AT (from http://hp.vector.co.jp/authors/VA012947/hduty/conv98at.html)

The older tools (up to and including DOS 6.2) will absolutely not work - FDISK tricks you into thinking its worked, but will sometimes hang, and FORMAT just reports rubbish size information and never finishes the format process and/or writing the boot sector or PC-98 equivalent.

I found devices that were connected directly through the IDE bus worked fine; the largest being an 80GB 2.5" laptop drive; though all of the smaller IDE drives I tried also worked correctly (initialised, partitioned, formatted).

Sadly, all of the devices I tried over a SATA to IDE adapter failed to work correctly - they either did not get picked up by the BIOS, or failed at various points in the initialisation or partitioning process.

Hope this is useful!

John

The full write-up is on my website: https://www.target-earth.net/wiki/doku.php?id=blog:pc98_hdd

famiac

Hi all,

I just translated the BIOS for my Ap2 (system ROM PHD0104) after consulting the sources sampson linked and reading his lovely write-up. I've attached the generated IPS patches to this post. The English translation and the IDE functionality update are included in separate patches, but they can be applied sequentially to the same file. The translation is original and not entirely literal, since I added some info here and there. Please let me know if something is really incorrect, though.

Please check that the file you're patching has SHA-1 checksum 2C15B63A0869B81EF7F04972DBB0975F4E77D384


The PATCH.BIN for As2/Ap2 models is different from the IDE patch for the As/Ap model. Not sure yet if it implements direct support for LBA or just changes the way the PC98 handles CHS.

Note for those wanting to translate their own system ROM:
Like sampson said, the text in the BIOS is S-JIS encoded, which is happily backwards compatible with ASCII. The strings are all null-terminated, but, if you try to modify them, make sure you also don't touch the byte before the zero-byte. I didn't investigate the purpose of this suffix byte, but altering it will break the string you're editing. Also, this web tool for converting SJIS to hex may come in handy.

Checksum info:
If you're curious about it, I've attached a python implementation of the GETITF98 checksum code to rehash a modified system ROM file. The implementation in the GETITF98 source code goes a little deeper than the Calcsum_ROM function: a simple substitution cipher is applied to the odd and even bytesums before they are stored at the end of each bank. Also, banks 0-2 seem to use a different/no checksum, and I didn't implement functionality for those. Please run the script before you burn your ROM to a 27C400 to ensure that your PC98 will boot.

All in all, over 150 strings were manually translated to make this work. I hope someone else uses it! Thanks again to sampson for the inaugural effort.



Cheers

EDIT: The IDE patch for the Ap2 requires overwriting code at two starting addresses as opposed to just one for the Ap/As. Namely, 0x18000 and 0x66000. The patches ZIP has been updated to reflect this, as the previous IDE patch was not working. My apologies to those who downloaded it already.

EDIT2: The "cipher" is the same as subtraction from 0x100. I'm an idiot. Also made a couple minor english tweaks to the translation.

sampson

Oh just came across needing something. @famiac that last byte before the null termination is the number of chars in the string. I believe it plays a roll in the highlight box.

famiac

Oh, good catch.
I'm also wondering about the bank checksums: the IDE patch does change a couple but my pc-98 doesn't complain. can you verify if my calcsum program output is identical to yours?

maybe someday i can update the patches