| View previous topic :: View next topic |
| Author |
Message |
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
 Posted: Tue Apr 01, 2014 6:43 pm Post subject: NexGen Engineering Sample - Vintage Eye Candy |
 |
|
Finally found my holy grail !
More rare than Nx686 : Nx586-66 ! Engineering Sample of the unreleased 66 MHz Nx586. Date code 94'30, earlier than many known Nx586. 
Love it 
Got this one too :
It might (not sure) be an early ES of the Nx586 + FPU. Marked "PF100 SAMPLE" but looks like a standard P100. The marking is uncommon : P100-E/F". I haven't find any other P100 with the "F" letter. The board is working but it needs a new Dallas RTC to boot. I'll got one tomorrow and check if this chip is a standard P100 with an unusual marking or a PF100. Can't wait !
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349
Last edited by xsecret on Sun Dec 03, 2023 10:24 am; edited 4 times in total |
|
| Back to top |
|
 |
mavroxur
Joined: 06 Jul 2005
Posts: 1192
Location: Wichita Falls, TX
|
| Posted: Tue Apr 01, 2014 8:01 pm Post subject: |
|
|
| Wow, NICE! |
|
| Back to top |
|
|
JustOne
Joined: 29 Dec 2013
Posts: 103
Location: CN
|
| Posted: Tue Apr 01, 2014 8:10 pm Post subject: |
|
|
| wow, very good! |
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Thu Apr 03, 2014 11:33 am Post subject: |
|
|
I'm trying to install 2000 or XP on the NxPCI board.
First try failed with "Windows requires a 486 or later CPU...". After using the old idon.com, I was able to pass the first step of installation without any issue. Unfortunately, after reboot, it failed again with the same message and this time, no way to start idon.com.
I disassembled that 16-byte tool in order to reinject the code somewhere in the boot process but the opcode used is not x86 standard. Do you know what is doing this tool exactly ? I dumped CPUID return before and after running it, but nothing changed.
A solution might be to do the change with a BIOS Mod. I could do that easily with an Award BIOS, but I'm not familiar with AMI BIOS.
Can somebody help ?
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349 |
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Thu Apr 03, 2014 11:47 am Post subject: |
|
|
Some additional informations
CPUID returned for this CPU is 0x504, but Vendor ID "NexGenDriven". The EDX flag shows that CMPXCHG8 is supported, so the Windows XP installer should work.
I tryed to hack SETUPLDR.BIN to bypass the check and replace the GenuineIntel trigger with NexGenDriven but the damn file is checksum protected and I still haven't found how to disable this check...
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349 |
|
| Back to top |
|
|
Marcin
Joined: 02 Jan 2005
Posts: 8519
Location: Poland
|
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Thu Apr 03, 2014 1:53 pm Post subject: |
|
|
I will post the informations of my process here, even If I miserably fail at the end...
So the issue is SETUPLDR.BIN and the failed detection.
I disassembled that beast and found the offending code. The root cause of the Nx586 detected has a 486 is probably a bug in the EFLAGS.ID toggle implementation... But I don't know what the DOS tool IDON.COM is doing exactly to bypass that...
Damn Microsoft !
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349
Last edited by xsecret on Sun Dec 03, 2023 10:24 am; edited 1 time in total |
|
| Back to top |
|
|
frag_
Joined: 17 Nov 2008
Posts: 4015
Location: Estonia
|
| Posted: Thu Apr 03, 2014 2:23 pm Post subject: |
|
|
Great find!
Forcing is simple: change "75" byte on 0x333020 to "EB". |
|
| Back to top |
|
|
frag_
Joined: 17 Nov 2008
Posts: 4015
Location: Estonia
|
| Posted: Thu Apr 03, 2014 3:03 pm Post subject: |
|
|
This procedure check if CPUID command is available or not by changing ID flag.
Nexgen supports CPUID but cannot change this flag!
You should make unconditional jump like in my prev. post. |
|
| Back to top |
|
|
mtx500
Joined: 21 Nov 2003
Posts: 117
Location: Nuremberg, Germany
|
| Posted: Fri Apr 04, 2014 2:12 am Post subject: |
|
|
| Xsecret wrote: | | I'm trying to install 2000 or XP on the NxPCI board. |
Whoah!
The NexGen Nx586 carries a "5" in its name, but this is mostly a marketing thing. One can argue that the CPU incorporates 5th generation features, but the truth is that the Nx586 is an extremely fast 386 processor.
Later they added some 486 instructions via hypercode, which is stored in the BIOS EEPROM, but only the application-oriented ones. So while you can run most of the applications that were compiled for an 486, you can't run an operating system which requires a 486 or even a Pentium.
The newest Windows operating systems that run on an Nx586 are 98 SE and NT 3.5. But I like to be proven wrong, of course!
| Xsecret wrote: | | I disassembled that 16-byte tool in order to reinject the code somewhere in the boot process |
Unfortunately I don't find the time to put all that what I found out on my web site. I already did not only disassemble the NexGen Utilities but I also re-sourced them, i.e. you can translate them and get back the exact result.
I've just uploaded the utilities plus IDA data bases plus sources to http://www.memotech.franken.de/Temp/Utilities.zip.
| Xsecret wrote: | | but the opcode used is not x86 standard. Do you know what is doing this tool exactly? |
Yes 
Actually, 0x0F 0x55 (NXOP) is just an undefined instruction for the Nx586. The clever thing is: undefined instructions, as well as some other events, cause a hypermode exception. I.e. the processor switches to hypermode and calls an exception vector in hypercode which is specific for the type of event.
In the undefined instruction handler, hypercode detects that it is this special byte sequence, and then calls some subroutines and returns.
So effectively, NXOP is an API (application programming interface) into hypercode!
Have a look at "my" hypercode sources http://www.memotech.franken.de/NexGen/Source/index.html, file INVOP.ASM, line 172ff.
I've just uploaded the API documentation to http://www.memotech.franken.de/Temp/HypercodeAPI.zip.
Comments are welcome. |
|
| Back to top |
|
|
mtx500
Joined: 21 Nov 2003
Posts: 117
Location: Nuremberg, Germany
|
| Posted: Fri Apr 04, 2014 2:43 am Post subject: |
|
|
| Xsecret wrote: | | The root cause of the Nx586 detected has a 486 is probably a bug in the EFLAGS.ID toggle implementation... But I don't know what the DOS tool IDON.COM is doing exactly to bypass that... |
| frag_ wrote: | | This procedure check if CPUID command is available or not by changing ID flag. Nexgen supports CPUID but cannot change this flag! |
Let's sort that out:
If the hypercode supports emulation of CPUID at all (if it is not a very old BIOS), then CPUID works always (unconditionally).
The NexGen's AMIBIOS has one custom setting named "Alternate instruction set" that can be toggled on/off. If it is on, then the Nx586 has enabled 486 application-oriented instruction emulation in hypercode right from the start. But it does not support official 486 detection, i.e. EFL.AC can't be toggled!
Then there is NXOP function 0x0E, sub-function 0x03 and 0x04, which are used by IDON.COM, IDOFF.COM and WINID20.EXE.
These functions switch on/off the emulation of the 486 application-oriented instructions just like the BIOS setting "Alternate instruction set", but (again if the BIOS is not too old) additionally enable toggling of EFL.AC, so the CPU is detected as 486.
Internally, this is done by setting appropriate bits in the opcode mask register, which result in the instructions PUSHF and POPF to cause a hypermode exception. The hypercode exception handler then has a chance to emulate the EFL.AC bit behaviour.
See http://www.memotech.franken.de/cgi-bin/AsmColor.cgi?f=../NexGen/Source/DECODE.ASM, line 2632ff.
Last edited by mtx500 on Thu Oct 03, 2019 7:34 am; edited 1 time in total |
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Fri Apr 04, 2014 8:07 am Post subject: |
|
|
Thank you so much for all those valuable informations!
I can confirm some points. First, the detection code used by Windows 2K/XP is based on EFLAGS.AC and not EFLAGS.ID. But even if you bypass that, the Vendor ID is not recognized and that will generate another error : CPUID/CMPXCHG not available because the dection code for these instructions is not even started.
Good news: I successfully hacked the Windows loader to bypass the 486/386 EFLAGS.AC dection, as well as the second check!
Here is the process.
At first restart after DOS based installation (w/ IDON.com), edit the $NTLDR$ (a copy of SETUPLDR.BIN) in the root folder.
| Code: | Disable 486 check
------------------
*1*
.text:00315CBD jnz short locret_315CC1
File Offset : 0x019D7D
Find : 75 02 FE C0 C3 8B FF
Replace : EB 02 FE C0 C3 8B FF
Disable Unknown CPU check
-------------------------
*1*
.text:00315CE6 jnz short loc_315CEB
Find: 75 03 33 C0 C3 B8 01
Replace: EB 03 33 C0 C3 B8 01
---
*2*
.text:0031F3D3 jnz short loc_31F3E0
Find: 75 0B 68 8C 23 00 00
Replace: EB 0B 68 8C 23 00 00
|
After this mod, the setup will continue as expected ! For now, It freezes while detecting the HDD later, but my Promise Ultra66 PCI card is very instable on that board on any slot (dunno why). I'll restart all the process soon with another IDE controller.
I have some question.
| Quote: | | So while you can run most of the applications that were compiled for an 486, you can't run an operating system which requires a 486 or even a Pentium. |
According to your explanation, the Nx586 is close to the x86 chip from Transmeta (emulated instructions). So it can emulate nearly any instructions. The x86 ISA hasn't evolved so much between 386 and Pentium. So, if all instructions used by 2K/XP are available, I don't understand why It can't be run.
Thanks for that. Really interesting. That will save me a lot of time.
| Quote: | These functions switch on/off the emulation of the 486 application-oriented instructions just like the BIOS setting "Alternate instruction set", but (again if the BIOS is not too old) additionally enable toggling of EFL.AC, so the CPU is detected as 486.
Internally, this is done by setting appropriate bits in the opcode mask register, which result in the instructions PUSHF and POPF to cause a hypermode exception. |
PUSHF/POPF hijacking is used to solve the EFLAGS.AC "bug", but which other instructions of the x86 ISA are emulated (passed to Hypermode) when Alternate mode is enabled ?
And finally : Do you have any idea about the difference between p06y034p and p06y034q ?
Thanks !
[/quote]
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349 |
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Fri Apr 04, 2014 2:05 pm Post subject: |
|
|
After two days trying to install 2K or XP on the Nexgen PCI board, I must admit this is a failure
Everything seems now OK but the system hangs when switching to graphic mode. I've tried nearly all settings in BIOS, different IDE or graphics card, but no luck. All drivers are loaded successfully at startup, but Windows freeze just before the graphic part.
Just for the followup, here is the patch to disable the 486 check on Windows 2K SETUPLDR.BIN
| Code: | Windows 2000 - EFLAGS.AC/486 Check Disable
--------------------------------------
.text:00315CBD jnz short locret_315CC1
File offset : 0x028ffd
Find : 75 02 FE C0 C3 4D 43
Replace : EB 02 FE C0 C3 4D 43 |
Does anybody know the configuration for the reserved jumper on the NxPCI board (Frequency, ...) ?
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349 |
|
| Back to top |
|
|
mtx500
Joined: 21 Nov 2003
Posts: 117
Location: Nuremberg, Germany
|
| Posted: Fri Apr 04, 2014 2:32 pm Post subject: |
|
|
| Xsecret wrote: | | PUSHF/POPF hijacking is used to solve the EFLAGS.AC "bug", but which other instructions of the x86 ISA are emulated (passed to Hypermode) when Alternate mode is enabled ? |
When "Alternate instruction set" is on (or IDON.COM / WINID20.EXE has been used to switch it on) the Hypercode emulates:
0F A6 CMPXCHG A-Step 486
0F A7 CMPXCHG A-Step 486
0F B0 CMPXCHG
0F B1 CMPXCHG
0F C0 XADD
0F C1 "
0F C8 BSWAP
: :
0F CF "
I remember that when installing Netscape Navigator it crashed because one of those instructions - I think it was XADD - was combined with a LOCK prefix. Seems there is a bug in emulation here, because the LOCK prefix is allowed and it is taken care of in hypercode in principle.
If "Alternate instruction set" is off, these instructions above cause an invalid instruction exception.
The following instructions added with the 80486 are not emulated and cause an invalid instruction exception:
0F 08 INVD
0F 01, reg=111 INVLPG
0F 09 WBINVD
By the way, the Nx586 also causes an invalid instruction exception on this:
F0 90 LOCK NOP
The Intel 80386 allows this, contrary to its documentation(!)
| Xsecret wrote: | | According to your explanation, the Nx586 is close to the x86 chip from Transmeta (emulated instructions). So it can emulate nearly any instructions. The x86 ISA hasn't evolved so much between 386 and Pentium. So, if all instructions used by 2K/XP are available, I don't understand why It can't be run. |
The space available for hypercode is limited to 48 KB (unpacked) in second level cache and 32 KB (packed) in the BIOS EEPROM.
I see that some features of early hypercode have been removed later to gain space. So space could be a limiting factor here.
BTW, the Nx586 translates the x86 opcodes (hypercode or mortal mode) into RISC86 instructions internally before executing them. There are rumours and it is also mentioned as a possibility in one of NexGen's patents, that the processor is able to bypass the translation and execute RISC86 directly from RAM. Now that would be cool!
Another rumour that I wasn't able to track down: Russian hackers tried to write a Forth Interpreter in hypercode, so that the Nx586 would be able to execute binary forth programs natively. Cool, too.
| Xsecret wrote: | | And finally : Do you have any idea about the difference between p06y034p and p06y034q ? |
The differences in hypercode are minimal, only in source file NPHCODE.ASM. Look for "IF V034Q" in http://www.memotech.franken.de/cgi-bin/AsmColor.cgi?f=../NexGen/Source/NPHCODE.ASM.
I haven't disassembled the mortal mode BIOS enough to tell you which differences there are there, but I do expect none because the first part of the BIOS version string, i.e. "p06y" is for the BIOS and the second part "034p" is for the hypercode.
Last edited by mtx500 on Thu Oct 03, 2019 7:35 am; edited 1 time in total |
|
| Back to top |
|
|
xsecret
Joined: 01 Feb 2004
Posts: 1847
Location: France
|
| Posted: Fri Apr 04, 2014 4:49 pm Post subject: |
|
|
Emulated instructions seems not reliable enough in some condition to run a "modern" OS.
Is it possible to reinject a recompiled HyperCode into the AMIBIOS then flash and run successfully that modded BIOS ? If yes, I can try to tune some ASM code, but the space limitation is really a problem.
_________________
ES-Only Collector : http://www.engineering-sample.com
Universal Chip Analyzer (UCA) : https://x86.fr/uca / http://www.cpu-world.com/forum/viewtopic.php?t=34349 |
|
| Back to top |
|
|
|
|
|
|
|
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum
|
|
Powered by phpBB © 2001 phpBB Group
|
![[ Hidden ]](https://cdn.cpu-world.com/forum/templates/CPUWorld/images/lang_english/icon_email.gif "[ Hidden ]"){kind=icon}