First post, by Ketturi
- Rank
- Newbie
Lets plunge directly into the deep end with my first forum post here.
Recently, I managed to get my hands on the vintage Olivetti Echos 44 laptop from 1994. This little gem is equipped with a 486 CPU, 12MB of RAM, a 350MB hard drive, a floppy drive, and PCMCIA expansion slots. However, luck wasn't on my side as the hard drive had seen better days. It caused all sorts of issues - reporting itself as a 1TB drive meant for modern computers, constant lock-ups, and overall unhappiness.
The previous owner had installed Windows 95, but luckily, most of the old system files were intact and I was able to extract them, fortunately, because I couldn't find these files anywhere on the internet. So, I took the normal route and replaced the hard drive with a CF card IDE adapter. However, there were additional challenges. The BIOS had a 504MB hard limit, and Olivetti used the hard drive for a hidden recovery partition containing minimal DOS boot files and a file for hibernating the system when APM is enabled. This made it difficult to use OnTrack or Ez-Drive managers, as they interfered with the hidden partition and hibernation region.
That's when I had the idea to try XTIDE Universal BIOS, hoping it would provide support for larger drives and modern CF cards. So, I started researching how to add it to the system.
Echos 44 has 28F020 flash rom for the video bios, extended bios that contains PhoenixMISER, and system bios. Not all parts of the flash rom are used, as it starts from the C000h segment with video bios, and continues
to the end of the address space. Chipset on board handles the address decoding for the flash rom, and has registers to enable or disable parts of the flash rom decoding. It also handles shadow ram and caching functionality.
Chipset in question is OPTi 82C463 single chip notebook IC. Databook for this can be found from the internet, and I have copy of it here https://ketturi.kapsi.fi/Echos44/82C463.pdf
I unsoldered the SMD bios chip, and replaced it with socket on the CPU card, and dumped bios for disassembly. I attached the dump here, and it can also be found from the https://ketturi.kapsi.fi/Echos44/ folder.
Now with the bios dump, I could load it in the IDA Freeware, and start disassemble and explore the bios. Quite early I found part that loads the chipset registers from the table in the bios rom.
https://ketturi.kapsi.fi/Echos44/config_chipset.asm
And it loads this table to the chipset registers:
db 30h ; DATA XREF: BOOT-D0↑o; Control Register 1db 00101010b ; 0 Revision; 0 Revision; 1 RIing in enanbled; 0 Turbo VGA disabled; 1 Global Reloc/Trans enabled for SMI addresses; 0 no extra AT wait state; 1 Fast Reset control does not require Halt; 0 Always write 0!db 31h; Control Register 2db 01101111b ; 0 Master byte swap disable; 1 Reserved; 1 Parity check Disable; 0 Dynamic SMI relocation disabled; 1 EC000h Control ROMCS; 1 E8000h Control ROMCS; 1 E4000h Control ROMCS; 1 E0000h Control ROMCSdb 32h; Shadow RAM Control Register 1db 11100101b ; 1 F0000h control, ROMCS; 1 Reserved Awlays 1; 1 Reserved Always 1; 0 D0000h block shadow write, writable; 0 E0000h block shadow write, writable; 1 Reserved; 0 Reserved (awlays write 0); 1 Single ALE druing bus conversiondb 33h; Shadow RAM Control Register 2db 00000000b ; Disable E0000 and D0000 shadow ramdb 34h; DRAM Control Register 1db 10001101b ; Bank 0 1M; Bank 1 x; Bank 2 x; Bank 3 xdb 35h; DRAM Control Register 2db 10010111b ; 10 DRAM R wait states: 1, 3-2-2-2; 01 DRAM W wait states: 1; 0 MP2/STRAP2: 2x Clock (read only); 1 F0000h non-cacheable; 1 All DRAM is not cacheable; 1 C0000h non-cacheabledb 36h; Shadow RAM Control Register 3db 10010000b ; 1 F0000 block wrote to ROMCS#; 0 C0000-EFFFF R/W From AT bus or ROMCS; 0 C0000 block shadow writable; 1 Reserved, Alaways write 1; 0 Shadow CC000 disable; 0 Shadow C8000 disable; 0 Shadow C4000 disable; 0 Shadow C0000 disabledb 37h; E0000h Block Cache Enable Bits Registerdb 11111111b ; DC000 ROMCS
; D8000 ROMCS; D4000 ROMCS; D0000 ROMCS; EC000 non-cacheable; E8000 non-cacheable; E4000 non-cacheable; E0000 non-cacheabledb 38h; Non-cacheable Block 1 Registerdb 10000110b ; 1 Size of non-cacbeable memory block:; 0 100=Disabled; 0; 0 CC000-CFFFF AT-BUS; 0 C8000-CBFFF AT-BUS (Change these to enable C800 romcs); 1 C4000-C7FFF ROMCS#; 1 C0000-C3FFF ROMCS#; 0 Address bit A24 of non-cacheable memory block1db 39h; Non-Cacheable Block 1 Register 2db 00000000b ; Defaultdb 3Ah; Non-Cacheable Block 2 Register 1db 00000000b ; Defaultdb 84h; What is this!!!db 00000000b ; Defaultdb 3Bh; Non-Cacheable Block 2 Register 2db 00000000b ; Default
At first glance, this seemed too easy to be true, and as expected, it wasn't that simple. This is not the only part where the registers handling the ROM decoding are modified. Due to the shadow RAM and caching, there is another function that sets the register values and copies the content of the ROM to the shadow RAM. Otherwise, I could have simply flashed the XTIDE to either the C800h or D000h region, changed those segments from AT-BUS to ROMCS# decoding, and been done with it.
Here is the tricky part I have been struggling with, and I would appreciate some help. I identified the subfunction that handles the shadow RAM operations for the option ROMs:
https://ketturi.kapsi.fi/Echos44/shadowram.asm
In the beginning of the function, the chipset registers are set for copying the option ROM data to the DRAM:
Then the sub function does some moving data around in a convoluted loops, that I have not bother to decipher further:
After that is complete, we get back to setting some registers:
This time, it seems to be for the E000h segment, which contains the power management BIOS and possibly the BIOS setup (which, by the way, can be accessed anytime with the FN+F4 key, even on DOS).
Next, the function performs copying and checksumming:
Finally, we reach the end of the function:
At the end, the shadow RAM segments are either enabled or disabled depending on whether they are used for ROM data, and they are also set to write-protected.
I have looked over the shadow ram function over and over, and with datasheet for the 82C463, deduced what register values possibly need to be changed to enable either the C800h or D000h segment decoding and shadowing.
C800h segment would be problematic for the XTIDE Universal BIOS, because the C800h-CFFFh area is used also for the PCMCIA, and I do want to use ATA card, that at least by default maps to C800h and C900h. Maybe that can be changed
just by giving the PCMCIA card services software different addresses in the config.sys and also excluding that from emm386, but D000h would be better for the XTIDE bios.
I have ended up testing couple different configurations:
For D000h: XTIDE Bios to 10000h in the dump file
38717: B7 0F -> 0E Set "32h Shadow D0000-D3FFF" Disabled (at the beginning of the shadowram.asm)
38754: C3 00 -> 10 Set "37h D0000 ROMCS#"
38972: B3 F0 -> F1 Set "32h Shadow D0000-D3FFF" Enabled(at the end of the shadowram.asm)
For C800: Place XTIDE Bios to 8000h in the dump file
3EBB0: 86 -> 9E Enable C800,CC00 ROMCS# (In the initial chipset register table)
3873A : B7 4C -> B7 40 C800,CC00 Shadow disable (at the beginning of the shadowram.asm)
3875A : B3 E7 -> B3 FF C800,CC00 to ROMCS#
38981: B3 B3 -> B3 BF Shadow C800,CC00 Enable (at the end of the shadowram.asm)
I have configured the XTIDE ide_386l.bin with the XTIDECFG.COM run on the Echos 44, and it correctly found 1 16-bit ata controller. I assume, Olivetti used the standard I/O ports for the controller, at least that is what the config utility set those.
Then I inserted the XTIDE bios to the dump, either in the C800h segment or in the D000h segment,
and patched the system bios to use above register values to (maybe) enable the rom decoding and shadow ram.
Then I just flashed the eeprom back to the chip, and tested it on the Echos 44.
So far, the results have been mixed. In both configurations, I need to press Ctrl+Alt+Del after the Fixed Disk and Floppy Drives post-test, or else the system hangs at that point.
After the soft reboot, I get message: "Option ROM at C800:000 Pass" or "Option ROM at D000:000 Pass" depending which patch I flashed to the bios.
But, but...
If the CF card is in the system, it just hangs after the Option ROM message. But if I remove the CF card, then start system, soft reboot it,
XTIDE bios starts and shows the menu screen. I then can boot from the floppy drive in the XTIDE menu, and OS loads just fine.
Also, I can't enter into the system bios setup menu, when the option rom is enabled.
It seems that there might still be something wrong with the chipset register configuration and possibly with the XTIDE configuration as well. At this point, I'm a bit stuck and have decided to make this post public, in the hopes that someone else may have some insight or experience in enabling Option ROM regions in an embedded BIOS ROM.
