Sound Blaster 16 emulation for DOS 6.22

     Reversing this WYSE machine BIOS I have learned that this CS5536 chipset together with the VSA software can emulate a Sound Blaster 16. By default the BIOS exposes the audio AC97 device directly to the OS on the PCI bus. But there are settings to be made for the BIOS to hide this AC97 and emulate a Sound Blaster 16.

     This will be great, because all the DOS games and software are compatible to SB16 by default, and there are already made drivers for SB16 for the MS-DOS. This way it might be possible to have real sound on the DOS.

    At some time there was an XpressAUDIO ROM, provided by the AMD, that had made this emulation possible. XpressAudio is actually a VSM (Virtual Support Module) that was not included in this VSA ROM of this WYSE BIOS.

    For short, the VSA ROM is loaded by the BIOS at system power up. The VSA is searching for all included VSMs and is copying them to separate segments in higher memory (CPU is in real mode and this memory is hidden from the OS).  Then is setting some MSRs (Model Specific Registers) inside of the CS5536 to trigger an interrupt for any access to the virtualized devices resources. 

    In the SB16 case, for any access to IO base 220h, CS5536 will trigger an interrupt. CPU registers will be saved and the ISR (XpressAUDIO) will do the emulation by routing any data sent to IO 220 to the AC97 on the PCI bus.

    All of this VSMs are not system dependent. VSA is doing all the hardware abstraction for them, so it will be possible to port this XpressAudio from one BIOS to another. Only dependency for the VSMs is the VSA version.

    The actual BIOS was made for this XpressAudio, because is trying to set the virtual registers of the XpressAudio and it fails. This is how the WYSE engineers did it. The BIOS and the VSA was provided fully functional by the AMD company and the WYSE just stripped lots of functions from it.

In this file from the VSA 2 source code I have found this definitions of the XpressAudio virtual registers. (Source code of the VSA 2 (incomplete), is actually a library for building the VSA ROM).

The VRC_AUDIO is a VSA (Virtual System Architecture) XpressAudio class.

The SB_16_IO_BASE is a virtual register.

    In this "XpressROM Firmware_funcspec" at page 129 and 103 is described the procedure to set this registers.

    Our WYSE BIOS was stripped out from this XpressAudio and some NVRAM tokens that meant to be used to set the XpressAudio virtual registers, but the BIOS functions that need to set this registers have remained. This functions are setting nothing now without the XpressAudio VSM.

    I have found the Function that does just that in the BIOS Boot Block. The function is searching first for NVRAM tokens to see what values should be set in this registers.

BIOS Boot Block function to set up the virtual audio device

    Normally this NVRAM tokens are made for the BIOS GUI to change them by changing a setting in the BIOS user interface (this BIOS GUI was stripped too), saving the settings and after the system will restart all the functions in the BIOS will load the values saved in this NVRAM tokens. This is how a legacy BIOS is applying the settings that you made in the BIOS graphic interface.

    Some NVRAM tokens are documented in here.

The "Audio_VRC_3D46" offset in the picture above is the start of a Virtual Registers list:

Audio VRC list

In this list there are 3 Audio VRCs defined:

• SB_16_IO_BASE
• PM_STATE
• CPU_USAGE

with their data and the NVRAM token assigned to them.

This function is called to set this VRCs:

NVRAM_to_Virtual_Reg_sub_3E14 function

    This function is called at offset 3EA1h with CX = 12h and SI = 3D46h (VR list).

CX = 12h means that this function will set only the first 3 audio VRCs from the list. (the list is longer - it has other hardware VCRs)

12h = 18 dec // BX must increment 3 times by 6 to be equal with 12h and this function to return.

    This function first tests if CX is 0. If it is then it does nothing and returns. CX is defining the number of VRCs from the list to be set.

    Then the function is testing to see if the first VR (virtual register) in the list has a NVRAM token assigned to it -> [bx+si+4]. If it has (like the SB_16_IO_BASE - token: AA) then is calling NVRAM_get_Data_sub_3DC4.

If there is no token, then it tries to get the data for the VR from the same list [bx+si+2].

    So data for the VR can be in the same list as the VR or it can be provided by some NVRAM Token.

(If there is a token, then that setting was meant to be changed by the BIOS GUI).

    In any case, the data from the NVRAM or the list above will get written in the VSA VRC by the VSA_VRC_write_sub_3F4A function. This function is trying to set this VRs but there are none available because the XpressAudio VSM has not been loaded.

    For the first VR, SB_16_IO_BASE, NVRAM_get_Data_sub_3DC4 is searching for the provided token: AA and is returning the CF set (error), Token AA is not found. (This was stripped too).

PM_STATE and CPU_USAGE have been set to 00 if they have been there.

    After adding the XpressAudio to this BIOS, setting the VRs will not be a problem because there is a lot of space to manually write the instructions. It is a good think that the BIOS was so badly written, lots of instructions can be patched to shrink them down and let empty space for new ones.

    The problem now is to find a BIOS with this XpressAudio VSM included.

*********************************************************************************

    There are other SBC (Single Board Computer) systems with Geode CPUs and CS5536 companions that let you configure this Virtual Registers for this XpressAudio in the BIOS GUI. This manufacturer (Kontron) of the SBC had left the BIOS alone:

BIOS GUI from other system with Geode and CS5536

 I have got an old version of XpressAudio for the VSA 1 system for now. It is not compatible with VSA 2. I need to reverse engineer this and maybe it will be possible to patch it and add this to the VSA 2.

  Meanwhile, if anyone has a BIOS dump from any machine with GX 500 processor (doesn't matter if is not from a WYSE machine or is not a Insyde BIOS) please let me know in the comments below.

And for those that need a driver for win98, here is a collection.

I will come back with further information.