riplin wrote on 2025-04-27, 23:30:

I focused on the memory timing stuff and I think I found a "bug" in the G200 BIOSes. It's loading a default timing value that's meant for the G100 card (the value is the same as the G100, but the register has changed and now bits are falling in reserved sections).

Very interesting finding, fix the bug would let the g200 have higher perfomance?

That would really depend on how the values are interpreted by the card. I haven’t gone through the trouble of figuring that out yet. There’s so many interesting things to look at.

The G100 is a close iteration of the Mystique, so you might compare those. The G550 is the remnants of the buried G800, should be close to the G400 but how close? It has a dual texturing pipeline but works with G400 drivers from a year prior.

I was intending to also disassemble the Mystique (not the 220, no data sheet for that one), Millennium and Millennium II BIOSes, but I’m taking a bit of a breather. These things take a long time to disassemble and annotate. Only the PCI version of the G200 was quick because it was so similar to the AGP version.

Edit: I also looked at the G450 BIOS, but it's larger than the G400 BIOS by 2KB + "extra" (BIOS files have to be multiples of 512 bytes and that's reported in the 3rd byte). There's 338 bytes at the end. Also, I don't have the data sheet for the G450 and given that they added DDR memory support to this card, the memory timings are going to be completely different. A large part of that code is going to be: Unknown value written to Unknown register. Not really useful.

I added the Matrox Mystique PCI BIOS disassembly.

I also had a look at the Millennium and Millennium II BIOSes, but the datasheets don't document any of the indirect registers. These contain the PLL setup registers, so kind of flying blind there. 🙁 I also had a look at the Atlas and Athena, but those are very different from the other chips. They emulate older hardware through software. When a Hercules / MDA / CGA register is poked, an interrupt is generated and the BIOS will then see what register was accessed and apply an equivalent change to the VGA registers. brrrrr. 😖 Not touching that.

So I think I'll keep it to the BIOSes I have disassembled right now and annotate those as much as I can. I've already done more work in the G200 BIOS, but I'll have to port those findings over to the other BIOSes. Keeping them all in sync is a lot of work.

Good job! A G100 BIOS modification with proprietary Matrox Simple Interface (MSI) 3D API support (like in Mystique videocards) will be something cool.

riplin wrote on 2025-05-05, 17:27:

I also had a look at the Millennium and Millennium II BIOSes, but the datasheets don't document any of the indirect registers. These contain the PLL setup registers, so kind of flying blind there. 🙁

I was wondering if you also used the sources from the linux fb driver and X window system video driver as possible information sources to further annotate the disassembled code ? If at all usable & possible.

That’s a good idea, I’ll have a look at those.

As for the other bioses, it’s not mainly a lack of documentation that’s hindering me there. It’s a lack of understanding 😀. There’s a lot going on and sometimes functions do things that are seemingly unrelated to each other. Very annoying.

Hi,

nice work. Did the same for the Amiga driver.

Unfortunately, you „modified“ the Code w.r.t. The Pins values in the BIOS. The Problem is, that the download versions of the BIOS do not contain the correct values, so your assumtions (commenting out Branchen) are wrong and misleading.

Hi,

nice work. Did the same for the Amiga driver.

Unfortunately, you „modified“ the Code w.r.t. The Pins values in the BIOS. The Problem is, that the download versions of the BIOS do not contain the correct values, so your assumtions (commenting out branches) are incorrect and the corresponding code changes misleading.

The only instructions I commented out are ones that assemble to a different encoding than the original. The DB’s directly below it are that instruction.

They all assemble to 100% identical binaries.

riplin wrote on 2025-05-14, 23:41:

The only instructions I commented out are ones that assemble to a different encoding than the original. The DB’s directly below it are that instruction.

They all assemble to 100% identical binaries.

I was checking the G100 Version where it seems conditional branches are commented out depending on the pin value. However, dbs are there to Generator the Code. So Both is kinda true. I just found it misleading.

There are a number of places where I marked them as misassemblies. I gave up on that at a certain point figuring people got the message.

At the top of the files there is a statement about this as well that you didn’t read apparently.

There is nothing misleading about it.

riplin wrote on 2025-05-15, 15:34:

There are a number of places where I marked them as misassemblies. I gave up on that at a certain point figuring people got the message.

At the top of the files there is a statement about this as well that you didn’t read apparently.

There is nothing misleading about it.

Only checked selected places as needed. Still Great work. Would have saved me days if I had discovered this earlier. Can share my (somtimes quite complete) ghidra dusassemblies for g450 and g550 if you like.

riplin wrote on 2025-04-28, 02:52:

I was intending to also disassemble the Mystique (not the 220, no data sheet for that one),

From what I have seen, there is just NO difference other than the RAMDAC being clocked higher. Some 220er even have 1064 Chips on them. From the software side they can be Distinguished only by PCI CS data. Sause from the swapped apertures, programming is 100% identical.

PainDictator wrote on 2025-05-15, 16:37:

riplin wrote on 2025-04-28, 02:52:

I was intending to also disassemble the Mystique (not the 220, no data sheet for that one),

From what I have seen, there is just NO difference other than the RAMDAC being clocked higher. Some 220er even have 1064 Chips on them. From the software side they can be Distinguished only by PCI CS data. Sause from the swapped apertures, programming is 100% identical.

Yeah, there's not even a 220 specific BIOS. I hadn't looked into the Mystique just yet when I said that.

PainDictator wrote on 2025-05-15, 16:33:

Only checked selected places as needed. Still Great work. Would have saved me days if I had discovered this earlier. Can share my (somtimes quite complete) ghidra dusassemblies for g450 and g550 if you like.

Did you figure out what the extra few hundred bytes at the end of the 450 BIOS is? Just curious about it. It's in multiple BIOSes that I saw. Haven't looked at the 550 one to see if it also has those extra bytes.

Well I would love to have a full disassembly of more Matrox BIOSes, but the problem is lack of documentation. From what I understand, the 450 has DDR memory, so I would guess PLL code is going to be very different. Also, the BIOS is 2KB larger than the G400 BIOS plus those extra mystery bytes at the end. Feels like a lot has been added that not having the docs is going to be a problem.

As for older ones like the Millenniums, They don't cover their indexed registers in the docs (Matrox removed it). It would take some effort to figure out what it matches with between the Mystique or the G100, if at all.

On the topic if incomplete docs, the Mystique documentation doesn't describe the texture mapper, but it's obvious that it was removed from the docs. The G100 does and if you hold them next to each other, you can see that they removed the register references, but forgot to update stuff like reserved values and ranges.

riplin wrote on 2025-05-15, 17:21:

Did you figure out what the extra few hundred bytes at the end of the 450 BIOS is? Just curious about it. It's in multiple BIOSe […]
Show full quote

PainDictator wrote on 2025-05-15, 16:33:

Only checked selected places as needed. Still Great work. Would have saved me days if I had discovered this earlier. Can share my (somtimes quite complete) ghidra dusassemblies for g450 and g550 if you like.

Did you figure out what the extra few hundred bytes at the end of the 450 BIOS is? Just curious about it. It's in multiple BIOSes that I saw. Haven't looked at the 550 one to see if it also has those extra bytes.

Well I would love to have a full disassembly of more Matrox BIOSes, but the problem is lack of documentation. From what I understand, the 450 has DDR memory, so I would guess PLL code is going to be very different. Also, the BIOS is 2KB larger than the G400 BIOS plus those extra mystery bytes at the end. Feels like a lot has been added that not having the docs is going to be a problem.

As for older ones like the Millenniums, They don't cover their indexed registers in the docs (Matrox removed it). It would take some effort to figure out what it matches with between the Mystique or the G100, if at all.

On the topic if incomplete docs, the Mystique documentation doesn't describe the texture mapper, but it's obvious that it was removed from the docs. The G100 does and if you hold them next to each other, you can see that they removed the register references, but forgot to update stuff like reserved values and ranges.

The PLL of the 450/550 is a Pain in the ass as it only locks to a few frequencies. Thus, the BIOS tries a Lot of frequency settings around the range. There is Not much difference between 450 and 550.

As far as I recall, the added Part at the end of the G450 is a Kind of Memory conditioning Routine that Applied to only one of the Memory configurations - the one used on all boards I have. Still, for my boards I saw no Need to do it, so the Amiga drivers seems to work without it.

Agree on the doc Problem, but it seemed largely irrelevant for BIOS as it mostly Applied to the 3D fubctionality. The Texture Mapper seems to be missing for the Mystique, but is described for the G200+. For the G200 and Up, the section on the WARP Engine is missing While its referenced in the document. Could Not find anything about it.

PainDictator wrote on 2025-05-17, 10:36:

The PLL of the 450/550 is a Pain in the ass as it only locks to a few frequencies. Thus, the BIOS tries a Lot of frequency settings around the range. There is Not much difference between 450 and 550.

As far as I recall, the added Part at the end of the G450 is a Kind of Memory conditioning Routine that Applied to only one of the Memory configurations - the one used on all boards I have. Still, for my boards I saw no Need to do it, so the Amiga drivers seems to work without it.

Well my main goal for disassembling those BIOSes is to learn about mode setting and to later program the 3D hardware. I just want to have fun with those cards in plain DOS on bare metal. No BIOS involvement. 😀 I might try and disassemble the G450 BIOS.

PainDictator wrote on 2025-05-17, 10:36:

Agree on the doc Problem, but it seemed largely irrelevant for BIOS as it mostly Applied to the 3D fubctionality. The Texture Mapper seems to be missing for the Mystique, but is described for the G200+. For the G200 and Up, the section on the WARP Engine is missing While its referenced in the document. Could Not find anything about it.

The G400 spec has info on the WARP registers, but I guess the instruction encoding isn't described there. Might have to disassemble the windows d3d drivers to get some info on that but that sounds like a lot of work. Ugh.