I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me.
One of the first steps at initialization is to move the processor control registers by writing a new value to the RELREG.
By default, the RELREG has the value 20FFH which places the register block at the top of I/O space at address 0FFxxH. The example given in the Intel app note describes writing the value of 1100H to the RELREG which then places the register block in memory space at 100xxH. Clear enough.
However, in the system I am examining, the value written is 1804H which I would expect to place the register block in memory space at the address 804xxH, yet the following writes to initialize the registers to operating values are all to 0F4xxH in memory space. The processor is operating fine in the system so this is not a programming bug.
I am absolutely sure about these addresses as not only do I see them in the code itself on the EPROM but also in logic analyzer traces of code execution at startup.
Does anyone have an explanation for this?