• Please review our updated Terms and Rules here

IBM PC AT 5170 BIOS versions

Now here's something very interesting...

@GearTechWolf has been making dumps of random ROMs, and some IBM ones turned up at https://forum.vcfed.org/index.php?threads/1241094/page-3#post-1462494. That archive includes an even/odd pair "6448238/6448246 IBM 81-85".
A quick peek in a hex editor told me that this looked an awful lot like a 5170 BIOS, but the P/Ns and dates don't match up with any of the 3 known revisions:

- EVEN: 6448246 (on sticker), 6480442 (internal)
- ODD: 6448238 (on sticker), 6480441 (internal)
- datestamps: 03/08/85 (BIOS signature in the last paragraph), 02/14/85 (offset 330Ah)

The contents were clearly different as well, so I decided to look a little deeper.
Long story short:

Monitor_1_20250913-224650-656.png Monitor_1_20250913-224742-672.png

...it's definitely an IBM AT BIOS of some sort. At least, it's compatible enough to boot in 86box, load up Advanced Diagnostics (which dutifully displays the P/N and date), and happily report the system configuration. So, what could this be?

The datestamp appears to place it somewhere between rev. 1 (01/10/84) and rev. 2 (06/10/85).
I'm still analyzing my disassembly, but I can say it's definitely different from both of them -- some of the new stuff in rev. 2 is there, but feature-wise it's probably closer to rev. 1. Interestingly, there are places where it diverges from both.

What I can confirm so far... this prospective "rev. 1.5"(?) has these things in common with rev. 1:
  • it doesn't test the CPU clock speed (POST checkpoint 11).
  • there's no "multiple data rate capability" test on the disk controller (checkpoints 3C-3D), so it should play nice with more third-party controllers.
  • POST checkpoints 02 and 03 are also the same as rev. 1, not switched around like in the latter two revisions (see https://www.minuszerodegrees.net/5170/post_errors/5170_post_codes.htm).
But elsewhere it's closer to rev. 2:
  • more hard drive types: this one supports types 01-22 - rev. 1 supports only 01-14 (rev. 2 supports 01-23)
  • unlike rev. 1, it supports INT 15h/C0h (Get System Configuration). That is, it has a table at F000:E6F5 noting the Model, Submodel, and BIOS revision.
The model byte is FC as expected for the AT, but interestingly the submodel and revision are 01/00. Which is the same as rev. 3 (rev. 2 has 00/01).
Maybe the scheme wasn't fully fleshed out yet, and they switched it around later... either way, this seems to be the earliest IBM BIOS to have this ID table.

As I mentioned, there are a few routines that don't quite match the other revisions at all... especially in the RAM detection and testing logic (POST "TEST.19") and in the diskette I/O (INT 13h).
I'm not yet sure what's up with that, but it doesn't look like the functionality is substantially different, just the implementation.

So far, it's looking like it was meant for a fairly standard AT - probably nothing weird like say the AT/3270, or the rumored "Skyrocket" (a 640K mainboard 5170). Unless the differences were such that the BIOSes are interchangeable.

So what do we have here? Just an internal revision that never made it into the wild?
 
VileR said:
So what do we have here? Just an internal revision that never made it into the wild?
Click to expand...
Various possibilities.

We have 'been here before', such as was documented in the thread at [here].

For me, before I take BIOS code seriously as an IBM release, I would need to see a photo of a PROM set with those IBM numbers professionally printed on them (or EPROM's with an IBM produced label).

Or in IBM documentation, such as shown in figure 9 of the document at [here].

Could this be publically-unreleased code? Possibly. Who knows. For example, in the MAR86 technical reference for the IBM 5155/5160, page 5-1 indicates the existence of a 5160 BIOS dated 11/22/85, the listing of which is on page 5-11. But on page 5-11, the date is 01/10/86, not 11/22/85. It suggests to me that at one point, IBM intended to release a 11/22/85 BIOS for the 5160, but held off, and 01/10/86 was the BIOS that ended up being released instead. So there is the possibility that the code of a 11/22/85 dated BIOS for the IBM 5160 is out there somewhere.

Just because the code looks like IBM 5170 code, doesn't mean that the code was intended for (or released on) the 5170.

There were other products that contained a 5170 motherboard. For example, at [here], are the motherboard BIOS' for the IBM 5273 and IBM 7532, and in those two cases, the BIOS is the same as the 11/15/85 for the 5170.
 
In terms of photos, all we have is what was provided in the original ebay auction (116575091863). Unfortunately they were sold loose, with no indication about the type of mainboard they were originally coupled with (if any).
Refer to the two at the top:

s-l1600.jpg

For what it's worth, the other "25/05/90" pair was determined by Tom of ardent-tool to be an early revision of the PS/2 Model 35 SX and 40 SX firmware (more details in the previously linked thread). What that could mean about the ultimate source of this lot is anyone's guess.

Anyway, they sure don't look as 'professionally printed' as your average BIOS ROM from IBM. And in the absence of any official mention of these FRU/BIOS part numbers, there's no evidence that they were part of a commercially available system.

As I noted, it's of course possible that they were meant for a different product with a 5170 mainboard, *if* the firmware was interchangeable. Considering your examples of the 5273 and 7532, that's a possibility.

Is there a corresponding list of BIOS part numbers for those two products, or for anything else in the 5170 "family"?
 
For convenience, reposting GearTechWolf's original dumps here, plus an interleaved even+odd image. If anyone else wants to poke at this, test it under emulation, or even on a real 5170-type system, insights would be welcome.

I could post my full disassembly once it's more fleshed out, but in the meantime, a few more observations...

This case looks to be somewhat different from that of the above-mentioned 5162 French Connection. For one, the datestamps don't fall outside the known lifespan of the 5170 or its variants; 03/08/85 makes it a few months older than the rev. 2 firmware (06/10/85).

Secondly, the actual contents certainly aren't a simple patch on top of a known revision. They appear to be something you'd expect as an evolutionary half-step between r1 and r2. The general sequence of modules matches r1; very roughly, something like half of the routines are modified from r1, and while some of those changes carried over to r2, others didn't.

In quite a few places, you can see routines that match their final rev. 2 form (in terms of logic), but still have some "rev. 1"-isms in them. Say...

- indirect MOVs to segment registers (rev. 2 tends to PUSH/POP into those)
- CMOS access done inline (vs. rev. 2 calling dedicated CMOS_READ/CMOS_WRITE routines)
- short jumps being padded with NOPs

Here's a decent example: the SHUT1 routine in module TEST1.
If you compare this with its r1 and r2 versions, the one in this ROM follows the same general flow as in r2 (r1 is structured differently), but it still does a few things the "r1" way:

Code: 
bios:0A2D                      ;----------------------------------------
bios:0A2D                      ;       RETURN 1 FROM SHUTDOWN          :
bios:0A2D                      ;----------------------------------------
bios:0A2D
bios:0A2D                      SHUT1:
bios:0A2D B0 21                                mov     al, 21h ; '!'      ;        <><><><><><><><><><><><>
bios:0A2F E6 80                                out     MFG_PORT, al       ;        <><> CHECKPOINT  21 <><>
bios:0A31 BC 30 00                             mov     sp, STACK
bios:0A34 8E D4                                mov     ss, sp
bios:0A36 BC 00 01                             mov     sp, @TOS           ; * stack ptr specified as 0030:0100 (=r1) *
bios:0A36                                                                 ; * r2 defines ABS0:@TOS = 0000:0400       *
bios:0A39                      ;-----  SET DIVIDE 0 VECTOR OFFSET
bios:0A39
bios:0A39 2B FF                                sub     di, di             ; * zero ES as in r2 (not done in r1) *
bios:0A3B 8E C7                                mov     es, di
bios:0A3D                                      assume es:nothing
bios:0A3D B8 EC 18                             mov     ax, offset D11
bios:0A40 AB                                   stosw
bios:0A41 B8 40 00                             mov     ax, DATA           ; * r2 uses CALL DDS here instead *
bios:0A44 8E D8                                mov     ds, ax             ; * of these two instructions     *
bios:0A46
bios:0A46                      ;-----  GET THE CONFIGURATION FROM CMOS
bios:0A46
bios:0A46 B0 8E                                mov     al, DIAG_STATUS
bios:0A48 E6 70                                out     CMOS_PORT, al      ; * r2 uses CALL CMOS_READ *
bios:0A4A EB 00                                jmp     short $+2
bios:0A4C E4 71                                in      al, CMOS_DATA
bios:0A4E A8 C0                                test    al, BAD_BAT+BAD_CKSUM
bios:0A50 74 03                                jz      short M_OK
bios:0A52 E9 91 00                             jmp     BAD_MOS
bios:0A55
bios:0A55                      M_OK:
bios:0A55 8A E0                                mov     ah, al
bios:0A57 B0 8E                                mov     al, DIAG_STATUS    ; * r2 uses CALL CMOS_WRITE *
bios:0A59 E6 70                                out     CMOS_PORT, al
bios:0A5B 86 C4                                xchg    al, ah
bios:0A5D 24 DF                                and     al, 0DFh
bios:0A5F E6 71                                out     CMOS_DATA, al
bios:0A61
bios:0A61                      ;-----  CHECK FOR CMOS RUN IN MODE
bios:0A61
bios:0A61 81 3E 72 00 34 12                    cmp     word ptr ds:@RESET_FLAG, 1234h
bios:0A67 74 15                                jz      short M_OK_64
bios:0A69 B0 96                                mov     al, M1_SIZE_HI
bios:0A6B EB 00                                jmp     short $+2           ; * r2 uses CALL CMOS_READ *
bios:0A6D E6 70                                out     CMOS_PORT, al
bios:0A6F EB 00                                jmp     short $+2
bios:0A71 E4 71                                in      al, CMOS_DATA
bios:0A73 24 C0                                and     al, 0C0h
bios:0A75 3C C0                                cmp     al, 0C0h ; '+'
bios:0A77 75 05                                jnz     short M_OK_64
bios:0A79 C6 06 72 00 64                       mov     byte ptr ds:@RESET_FLAG, 64h
bios:0A7E
bios:0A7E                      M_OK_64:
bios:0A7E
bios:0A7E B0 94                                mov     al, C_EQUIP         ; * ...and here too *
bios:0A80 EB 00                                jmp     short $+2
bios:0A82 E6 70                                out     CMOS_PORT, al
                                             ; [...........]

(Comments in upper case copied from IBM's listing(s) for general identification. Comments in asterisks are mine)
 

Attachments

VileR said:
In terms of photos, all we have is what was provided in the original ebay auction (116575091863). Unfortunately they were sold loose, with no indication about the type of mainboard they were originally coupled with (if any).
Refer to the two at the top:

View attachment 1308117

For what it's worth, the other "25/05/90" pair was determined by Tom of ardent-tool to be an early revision of the PS/2 Model 35 SX and 40 SX firmware (more details in the previously linked thread). What that could mean about the ultimate source of this lot is anyone's guess.

Anyway, they sure don't look as 'professionally printed' as your average BIOS ROM from IBM. And in the absence of any official mention of these FRU/BIOS part numbers, there's no evidence that they were part of a commercially available system.

As I noted, it's of course possible that they were meant for a different product with a 5170 mainboard, *if* the firmware was interchangeable. Considering your examples of the 5273 and 7532, that's a possibility.

Is there a corresponding list of BIOS part numbers for those two products, or for anything else in the 5170 "family"?
Click to expand...
The "25/05/90" pair also don't have an FRU - for further context (going off-topic from an AT BIOS aspect), the 35SX/40SX had two later releases that were archived, which I also tested with an ISA adapter from SIIG that only had a ROM BIOS extension (with the IDE interface not populated) for adding LBA support to an[other] onboard IDE interface. It didn't work for the '06'h BIOS of the 35SX/40SX (04 APR 1991) but did for the '0A' revision (25 SEP 1991). Of course, IBM didn't add LBA support in the main system BIOS for the planar IDE connection. I spotted another BIOS pair on a picture of a 35SX/40SX planar that were later *dates* (14 MAR 1992 for EVEN, 12 MAR 1992 for ODD) that I wasn't able to archive or know a reported version (with any added abilities).

Sounds like it is a time to start laying out a table like https://www.ardent-tool.com/firmware/system.html
 
IBMMuseum said:
The "25/05/90" pair also don't have an FRU - for further context (going off-topic from an AT BIOS aspect), the 35SX/40SX had two later releases that were archived, which I also tested with an ISA adapter from SIIG that only had a ROM BIOS extension (with the IDE interface not populated) for adding LBA support to an[other] onboard IDE interface. It didn't work for the '06'h BIOS of the 35SX/40SX (04 APR 1991) but did for the '0A' revision (25 SEP 1991). Of course, IBM didn't add LBA support in the main system BIOS for the planar IDE connection. I spotted another BIOS pair on a picture of a 35SX/40SX planar that were later *dates* (14 MAR 1992 for EVEN, 12 MAR 1992 for ODD) that I wasn't able to archive or know a reported version (with any added abilities).

Sounds like it is a time to start laying out a table like https://www.ardent-tool.com/firmware/system.html
Click to expand...

Ouch - PC/XT/AT firmware is straightforward next to the PS/2 stuff... is the FRU for that pair simply not listed in references which do include later revisions? Or could it still be hiding in some as-yet-undiscovered source?

Back to this mystery AT BIOS, I've gotten a little bit further... found a couple more things it has in common with rev. 2:
  • It supports the Extended Keyboard.
  • It appears to support 720K drives and media - INT 13h/AH=17h (SET_FORMAT) adds a fourth format type to rev. 1's three. Otherwise it's similar to the rev. 1 routine, however (in rev. 2 it's completely rewritten).
 
VileR said:
Ouch - PC/XT/AT firmware is straightforward next to the PS/2 stuff... is the FRU for that pair simply not listed in references which do include later revisions? Or could it still be hiding in some as-yet-undiscovered source?
Click to expand...
Tomas has listed the internal FRU, which he says has the same part number as the Model 25 286 / Model 30 286 (same planars used) 16-bit ROM (since the "25/05/90" pair are 8-bit EPROMs, both internal [code header] and external [label] would be different) - and he put the external date marking in quotes. Sometimes we see the initial BIOS version with a similar FRU sequence, which makes sense, of course. And (of course) we often find missing sequential BIOS versions / missing initial versions (after the model was released) - or duplicated internal code with a different FRU header (like this one).

IBM would list an 'ECA' (Engineering Change Announcement) for a BIOS bug, listing the FRU and failed behavior, recommending the FRU(s) replacement that had revised (bugfix) code. The best example of ALL of this is the Model 60/80 ESDI controller (https://www.ardent-tool.com/storage/ESDI.html#Microcode_ROM); It's the only way that we know of the 91F7430 FRU (which fits as the '06' version) not found (yet) in the wild.

Nice work! - If the '25/05/90' ROM header (not on 'AT v1.5'?) hasn't been figured out, could it be for the Extended Keyboard support? This should also be shown in the 'System Descriptor Table, Feature Byte 2, bit 6: INT 16h Function 09h (keyboard functionality) supported' (https://ibmmuseum.com/Interrupts/INT15h/INT15hC0.htm). Since the Model 25 286 / Model 30 286 doesn't have 122-key ('Host-Connect') keyboard support, it shows that evolution at IBM - and gives context that IBM developed both ISA and MCA equally as the 'PC + Terminal' systems.

I need to find the chart listing of the '30SX' BIOS - perhaps it also listed this 'AT v1.5' version and others. As far as I know (I need to get the EPROM reader out), the 25SX / ['30SX'] / PS/1 Pro 2123 has 122-key keyboard support - which might be the only 'PS/1' (IBM's 'Home' systems) to have 'Host-Connect' support! This is documenting the features work that I really enjoy!
 
This may be a good time to bring up a curious little puzzle in IBM's 5170 BIOS listings.

The 8042 keyboard controller's input port (send C0h to port 64h, then read port 60h) provides data on some switch settings - including the one that sets the on-board memory size (in bit 4).
All three versions of the AT tech ref (corresponding to the 3 BIOS revisions) describe bit 3 of this field as "reserved":

1760298338434.png

However, in the source listings for the rev. 2 and rev. 3 BIOS (but not rev. 1), bit 3 is described as "BASE PLANAR R/W MEMORY EXTENSION 640/X":

1760298070984.png

As it says right on top, the POST process in rev. 2/3 copies this bit field to @MFG_TST ( = 0040:0012, in the BIOS Data Area). When doing so, it does preserve bit 3 (the other "reserved" bits are cleared). But as far as I can tell, this bit is never used or checked again at any point in the BIOS code.

Anyway, note the wording... "640" on the "base planar".
Is this just a badly-worded reference to a 128K expansion board (bringing a 512K mainboard up to 640K), you may ask? Nope - that's not indicated by a switch setting, but somewhere else entirely (CMOS register 33h, bit 7), and that bit *is* checked and used by the POST and BIOS.

What I'm getting at is that our enigmatic "revision 1.5" BIOS here does check for this bit, in a couple of suggestive places. This could neatly explain its left-over presence in the source comments for rev. 2 and 3 - and also tell us a few things about the sort of AT that this BIOS came from (@IBMMuseum may be catching my drift...)

But just in case I'm missing something: is there an actual explanation of this bit which I may be unaware of?
 
VileR said:
This may be a good time to bring up a curious little puzzle in IBM's 5170 BIOS listings.

The 8042 keyboard controller's input port (send C0h to port 64h, then read port 60h) provides data on some switch settings - including the one that sets the on-board memory size (in bit 4).
All three versions of the AT tech ref (corresponding to the 3 BIOS revisions) describe bit 3 of this field as "reserved":

View attachment 1309247

However, in the source listings for the rev. 2 and rev. 3 BIOS (but not rev. 1), bit 3 is described as "BASE PLANAR R/W MEMORY EXTENSION 640/X":

View attachment 1309245

As it says right on top, the POST process in rev. 2/3 copies this bit field to @MFG_TST ( = 0040:0012, in the BIOS Data Area). When doing so, it does preserve bit 3 (the other "reserved" bits are cleared). But as far as I can tell, this bit is never used or checked again at any point in the BIOS code.

Anyway, note the wording... "640" on the "base planar".
Is this just a badly-worded reference to a 128K expansion board (bringing a 512K mainboard up to 640K), you may ask? Nope - that's not indicated by a switch setting, but somewhere else entirely (CMOS register 33h, bit 7), and that bit *is* checked and used by the POST and BIOS.

What I'm getting at is that our enigmatic "revision 1.5" BIOS here does check for this bit, in a couple of suggestive places. This could neatly explain its left-over presence in the source comments for rev. 2 and 3 - and also tell us a few things about the sort of AT that this BIOS came from (@IBMMuseum may be catching my drift...)
Click to expand...
Tony alluded that one of the units he got was a "Skyrocket" - although he passed away long ago, and I don't know what happened to the computer stuff he had (I was interested in Gearbox parts): https://groups.google.com/g/comp.sys.ibm.ps2.hardware/c/9libo3DblGQ/m/N-Cis5lVdwYJ

Bringing up the Gearbox, I wonder what was passed over to it from the AT - another aspect is that we believe the "Delmarva Machine" (proof of concept for a microchannel system, including a multiprocessor 286) was a modified Gearbox. Maybe Ernie Mandese can be urged to start talking again (to go back on-topic, about "Skyrocket"): https://www.ardent-tool.com/7552/
 
I sure took my sweet time... but here's my analysis: https://int10h.org/blog/2025/11/lost-ibm-at-model-bios-analysis/

and the disassembly: https://github.com/viler-int10h/IBM-AT_03-08-1985_disassembly

tl;dr - after all, it seems likely that this firmware is from "Skyrocket", or at least something closely related to it. Besides the 640K on board, the parity checking logic implies that there might have been a 1 MB configuration as well. Of course, that's just the BIOS-level support... the actual boards might not have had it implemented.
 
You must log in or register to reply here.
Back
Top