VOGONS


Reply 20 of 24, by Predator99

User metadata
Rank Oldbie
Rank
Oldbie

So I am quite sure the sub at C538 is for reading data from CMOS (Port 03E0 / 03E1). The data to read is given in AL when it s called:

F000:C51E BAE003        MOV	DX,03E0                            
F000:C521 EE OUT DX,AL
F000:C522 EB00 JMP C524
F000:C524 EB00 JMP C526
F000:C526 42 INC DX
F000:C527 EC IN AL,DX
F000:C528 C3 RET

F000:C529 BAE003 MOV DX,03E0
F000:C52C EE OUT DX,AL
F000:C52D 86C4 XCHG AL,AH
F000:C52F EB00 JMP C531
F000:C531 EB00 JMP C533
F000:C533 42 INC DX
F000:C534 EE OUT DX,AL
F000:C535 86C4 XCHG AL,AH
F000:C537 C3 RET

F000:C538 9C PUSHF
F000:C539 FA CLI
F000:C53A 52 PUSH DX
F000:C53B E8E0FF CALL C51E
F000:C53E 50 PUSH AX
F000:C53F EB07 JMP C548
F000:C541 9C PUSHF
F000:C542 FA CLI
F000:C543 52 PUSH DX
F000:C544 50 PUSH AX
F000:C545 E8E1FF CALL C529

F000:C548 B00D MOV AL,0D
F000:C54A E8D1FF CALL C51E
F000:C54D 58 POP AX
F000:C54E 5A POP DX
F000:C54F 9D POPF
F000:C550 C3 RET

It is called around 20 times. I think this is where it is called from to check for floppy etc:

F000:E2A2 B00E          MOV	AL,0E              Post Code 0E               
F000:E2A4 E680 OUT 80,AL
F000:E2A6 F7C50020 TEST BP,2000 Check if CMOS inoperational
F000:E2AA B00D MOV AL,0D
F000:E2AC 756F JNZ E31D CMOS inop? Go to POST code 10

F000:E2AE E887E2 CALL C538 AL=0D
F000:E2B1 0AC0 OR AL,AL
F000:E2B3 B80E0E MOV AX,0E0E
F000:E2B6 E87FE2 CALL C538 AL=0E
F000:E2B9 780B JS E2C6

F000:E2BB 83CD08 OR BP,+08 Set BP floppy error
F000:E2BE 0CC4 OR AL,C4
F000:E2C0 EB42 JMP E304

F000:E2C2 90 NOP
F000:E2C3 E96214 JMP F728

F000:E2C6 0AC0 OR AL,AL
F000:E2C8 7833 JS E2FD

F000:E2CA 50 PUSH AX
F000:E2CB 33C9 XOR CX,CX
F000:E2CD 33D2 XOR DX,DX
F000:E2CF B81010 MOV AX,1010
F000:E2D2 E863E2 CALL C538 AL=10
F000:E2D5 8AC8 MOV CL,AL
F000:E2D7 03D1 ADD DX,CX
F000:E2D9 FEC4 INC AH
F000:E2DB 8AC4 MOV AL,AH
F000:E2DD 3C1E CMP AL,1E
F000:E2DF 7402 JZ E2E3

F000:E2E1 EBEF JMP E2D2

F000:E2E3 FEC4 INC AH
F000:E2E5 E850E2 CALL C538
F000:E2E8 86C4 XCHG AL,AH
F000:E2EA E84BE2 CALL C538
F000:E2ED 3BC2 CMP AX,DX
F000:E2EF 58 POP AX
F000:E2F0 7504 JNZ E2F6

F000:E2F2 0BD2 OR DX,DX
F000:E2F4 750C JNZ E302

F000:E2F6 0C44 OR AL,44
F000:E2F8 83CD10 OR BP,+10 Set BP checksum error
F000:E2FB EB07 JMP E304

F000:E2FD 83CD20 OR BP,+20 Set BP display error
F000:E300 EB02 JMP E304

F000:E302 249B AND AL,9B

F000:E304 50 PUSH AX
F000:E305 B00F MOV AL,0F
F000:E307 E680 OUT 80,AL Post Code 0F
F000:E309 B014 MOV AL,14
Show last 11 lines
F000:E30B E82AE2        CALL	C538                               
F000:E30E D0E8 SHR AL,1
F000:E310 58 POP AX
F000:E311 7205 JB E318
F000:E313 83CD20 OR BP,+20
F000:E316 0C20 OR AL,20
F000:E318 86C4 XCHG AL,AH
F000:E31A E824E2 CALL C541

F000:E31D B010 MOV AL,10
F000:E31F E680 OUT 80,AL Post Code 10

Reply 21 of 24, by Predator99

User metadata
Rank Oldbie
Rank
Oldbie

I think chances are high if you take a program like ATSETUP.COM and replace all references to port 70/71 with 03E0 / 03E1 you will get something useful as this seems to be the same RTC than in a AT with a different port?

Reply 22 of 24, by Deunan

User metadata
Rank Oldbie
Rank
Oldbie

I've seen that A000 check in other BIOSes as well (early 286 machine). Could be a ROM check, or some clever way to put executable code in video memory to survive hardware reset? That would depend on how that memory is refreshed though. In any case, I have never seen a ROM at A000 so I don't know what this is for.

BASIC ROM usually lives in lower 32k half of the F000 segment, though perhaps not starting at F000 (some sources say F600 to FDFF). Point is, to use these extra ROM sockets on the mobo the BIOS image should be only 32k I think, unless there is a way to rejumper them to E000. Might be possible with some HW mod - depends on the mobo? I don't know much about the mapping of these sockets to actual address space, and I don't have XT machine to check.

BTW on AT machines the most significant bit of port 70 is intercepted and not used for addressing CMOS (so there can only be 128 bytes in NVRAM without extra tricks like page swapping). The MSb is instead used as mask for NMI. So NMI is in fact maskable interrupt, albeit with extra hardware to do it outside the CPU. This is probably different for XT and also not used in that way on any CMOS NVRAM that is mapped on different address.

Reply 23 of 24, by weedeewee

User metadata
Rank Oldbie
Rank
Oldbie
Predator99 wrote on 2022-03-09, 23:20:

I think chances are high if you take a program like ATSETUP.COM and replace all references to port 70/71 with 03E0 / 03E1 you will get something useful as this seems to be the same RTC than in a AT with a different port?

Is there any indication of a checksum being calculated / stored / verified in the rtc nvram ?

Right to repair is fundamental. You own it, you're allowed to fix it.
How To Ask Questions The Smart Way
Do not ask Why !