December 10, 2019, 12:15:38 pm

News:

Upload your images to this forum!.  The internet can't be trusted.  NFG can.  (probably)


PC-9821AS BIOS schenanigans and general 9821 BIOS information

Started by sampson, August 17, 2019, 12:06:18 am

Previous topic - Next topic

sampson

This post will feel disjointed but bare with me, it all comes together in the end.

So if you're here you likely own a physical 9821 computer. Like me you're probably annoyed with the 543MB limit on IDE hard drives. Stupid and annoying! Well if you search across the internet for long enough you'll end up at this page: http://ookumaneko.s1005.xrea.com/d27c4000.htm which describes a fix to correct the IDE bug on AS/AP as well as AS2/AP2. Great!

So you download the patch and open it up to find a few files, PATCH.ASM, PATCH.BAT, PATCH.LST and PATCH.BIN. There's some comments in PATCH.ASM that mentions locations being patched but instructions are not clear at all how to apply this patch. Physically a PC9821AS/AP has the BIOS in an EPROM that is socketed on the CPU board. Later models however switched to a maskrom that is directly soldered which can be removed and replaced with a socket/EPROM. The chip is a 27c400 and is easily read as well as rewritten with proper hardware. Logical conclusion since I have a stack of chips laying around is to waste months poking the BIOS to get this to work.

Recently I had a breakthrough while working with a MAME dev to assist with getting it to run a proper 9821 BIOS. I came across the program GETITF98.EXE which is a program to do a checksum across the bios on newer machines - http://hp.vector.co.jp/authors/VA012947/util/getitf98.html

It also houses a lot of great information about the bios such as the layout of it! Yay! We find that the BIOS is split into banks of 32KB, 16 total banks. We also have a general layout of the banks:
<Highest address as ROM>
BANK4 ITF F8000h (Top boot block)
BANK5 BIOS E8000h (N88BASIC)
BANK6 BIOS F0000h (system)
BANK7 BIOS F8000h (system)
BANK0 PCI / PnP BIOS D8000h
Various depending on BANK1 model (Microcode update other than power management microcomputer, APIC control / P6 tower machine)
BANK2 debugging code (MMDUMP) etc.
BANK3 IDE / system setup menu D8000h IDE BIOS is first 2000h bytes
== <Lower address as ROM (in the case of 2Mbit)> ==
BANKC --- Something that seems to be nothing or data from the Canbe graphic startup screen
BANKD ---
BANKE ---
BANKF ---
BANK8 ---
BANK9 ---
BANKA ---
BANKB Microcode update data (P6 tower machine only)
== <The lowest address as ROM (in the case of 4Mbit)> ==

Now that I know order and that IDE is located specifically in the first 0x2000 bytes of BANK3 we can pull out Ghidra and start disassembling from the start of BANK3. Reason I did this is because PATCH.BIN is a smaller file full of null data and small runs of some binary data. Matching those blocks up with Ghidra we find that they do patch over proper instruction locations and should slot in nicely. If you do not want to split and rejoin the BIOS you can apply the patch to either AS/AP or AS2/AP2 by starting at 0x18000 as your base patching address for PATCH.BIN. This patch does not affect checksum so you are safe to just drop it in blindly.

Turns out it works! I can now use up to 120GB hard drives in the IDE caddy. This is great and all but I now have the BIOS layout figured out and as expected most all of the text used within the BIOS is Shift-JIS. However there is a problem with modifying the BIOS in that there is a checksum. If you do any changes Pi-Po never happens and the machine refuses to post due to invalid checksum. Going back to GETITF98.EXE we find a function in the source CalcSum_ROM which is extremely simple. It just takes the odd and even bytes from each bank, adds them all up and provides the smallest byte as the checksum on the last two bytes of each bank.

So obviously with checksum figured out and knowledge of how to edit the BIOS the next step is almost a no-brainer:

Why not translate the BIOS menu? :)

There's a few limitations as I did not want to deal with relocating the strings but it works for what you need.

"Plasma Display" is actually two different strings for some reason so I cannot work around the two byte space without breaking things.
"Floppy Disk Drives" string is re-used for the two options. There's no way to be more specific as it would make the other option confusing.
Some strings were written in short-hand because I didn't have enough space. They're still rather self-explanatory and the hints help fill in gaps.

If you wish to use this menu simply obtain a 27c400 chip and burner. Either read your existing EPROM or obtain the bios from the MAME set (this isn't formally released yet but should come in an upcoming version as they have the BIOS file now.) Apply the IPS patch, burn the resulting binary data to your 27c400 and shove it in the board. This also includes the IDE patch so you should be good to go all around.
You can obtain the IPS patch here https://1drv.ms/u/s!AqwQP-hlVI

LowDefAl

Nice. I'm looking at getting a 21 to go with my 01 (mostly because it makes more financial sense than buying an external 3.5" drive) so I'll keep this in mind if I get an Ax.

dasfool

Nice work, Sampson. With the number of games that are being translated lately, storage is becoming more troublesome. This should be pretty helpful.

famiac

this is so awesome. Great work!!

Could you attach the ips file in an archive please?
I can't get the link you posted to work