#Part 3 – What to patch in an uncompressed Award BIOS
After two episodes of preliminaries, it is time to start patching! 😀
1) Let’s start with the Year 2094 bug. A well known bug in 1994-1995 Award BIOSes.
Actually this bug and its fix were already addressed here recently by jakethompson1, but I will also show it here for completeness sake.
This bug causes the year to jump forward to 2094 at each boot-up whenever the date was set to 1-1-2000 or later.
At POST 0B, the BIOS checks if the RTC uses valid values by reading the CMOS registers for seconds, minutes, hours, day, month, year, and century. It then uses a short table with maximum and minimum values for each of these 7 registers.
The minimum values table contains the hex numbers: 00, 00, 00, 01, 01, 94, 19, and this is the binary signature you have to look for. If you don’t find this signature, your PC should be free of this bug.
The error is in the routine that walks this table, but the fix is setting the minimum year from 1994 to 2000 by changing the last 2 bytes in this table.
The new table should become: 00, 00, 00, 01, 01, 00, 20 to fix this bug.
Note that this silly bug appeared in mid 1994 when Award tried to make the BIOS millennium compliant. Before that, the BIOS didn’t do any century checking, and when Award fixed this bug by the end of 1995, they simply removed this century check again! 😉
2) The 2nd bugfix is for the 2GB Harddisk size display limit bug.
At the beginning of 1994, the IDE Harddisk support of most BIOSes was still limited to 504MB.
But Award fixed that, and all Award BIOSes dated July 1994 or later correctly support the LBA assisted translation, up to the 8 GB limit of the traditional BIOS Int 13h interface.
There is however a bug in the BIOSes dated before January 1996 that limits the harddisk size display, on the BIOS Setup and boot screens, to 2015 MB.
Whenever a drive is 2016 MB or larger, the display starts to count from zero again. The same happens at 4032 and 6048 MB.
This looks a lot like the an actual 2 GB limit but is only a cosmetic bug in the harddisk size display routine, and it doesn't affect the BIOS support for these larger drives.
For these Award v4.50(P)(G) BIOSes, just use the HDD AUTO DETECTION feature to Setup the drive, select the option with LBA at the end, and disregard the incorrect HD size display.
Or, you could read on and patch this bug yourself! 😉
I have found 2 variations of this buggy code in the Award v4.50(P)(G) BIOS, but both variations use the same calculation method and therefore have the same bug. This piece of code takes the Cylinder, Head, and Sector count of the drive in question, multiplies them and divides the result by 2048 to arrive at the number of MB. In the buggy code a between result gets truncated and as a consequence the end result rolls over to zero every 2016MB.
For this bugfix I rearranged the multiplication order so the truncation doesn’t happen and this new code fitted nicely in the same space, so you only have to overwrite the old code by the new.
This is the first variation, and below you’ll see how the buggy and the fixed code look in my disassembler listing of a 03/10/95-ALI-1439G-1437-2A4KC000-00 BIOS.
The attachment 2GB limit bugfix_1.png is no longer available
So the 21 bytes long hex signatures of this first bug and its patch are as follows:
Buggy1: 8B,86,94,00,32,ED,8A,8E,96,00,F7,E1,8A,8E,9B,00,F7,E1,B9,00,08
Patch1: 8A,86,96,00,8A,8E,9B,00,C0,E1,02,90,F6,E1,F7,A6,94,00,B9,00,20
The checksum of this patch1 is 29h less than the buggy1 code, so if this is the only patch you make, add 29h to the last byte of the BIOS to make the F-segment checksum correct again.
And this is the second variation of this bug, as found in the 11/03/94--2C4X6H01-00 BIOS.
The attachment 2GB limit bugfix_2.png is no longer available
This code is even 3 bytes longer and so is its patch.
The 24 bytes long hex signatures of this second bug and its patch are as follows:
Buggy2: 8B,86,94,00,32,ED,8A,8E,96,00,F7,E1,8A,8E,9B,00,C1,E1,03,F7,E1,B9,09,3D
Patch2: 8A,86,96,00,32,ED,8A,8E,9B,00,C0,E1,02,F6,E1,8B,8E,94,00,F7,E1,B9,00,20
The checksum of this patch2 is 29h less than the buggy2 code, so if this is the only patch you make, add 29h to the last byte of the BIOS to make the F-segment checksum correct again.
In the next part I will talk about what can be changed in the uncompressed Award BIOS, to have better Am5x86-133 support.
Jan