Patching for new CPU models
Okay, now we need to decide what needs to be changed to support the Am5x86 CPU.

Because the BIOS_uP_ID is used in multiple places during POST to make decisions depending on the CPU model, the most effective way to add Am5x86 support to a 1994 BIOS is to let the BIOS think it is a DX4. This can be done with a small change to the Reset_ID table and works for the Enhanced Am486DX4 as well.
To know which Reset_IDs to use for the Am5x86 patch, we need AMD document 19720.

This AMD 486 BIOS Development Guide tells us the Reset_ID for each Am486 model, but also shows that specific models can have more than one Reset_ID depending on multiplier and L1 cache WT/WB settings at reset.

The Am5x86 can even have 4 different Reset_IDs:
0484h: x3 mode and Write-Through cache
0494h: x3 mode and Write-Back cache
04E4h: x4 mode and Write-Through cache
04F4h: x4 mode and Write-Back cache

As these 1994 BIOSes have no logic to program the chipset for L1 cache WB automatically, we don’t have to distinguish between Write-Through and Write-Back cache Reset_IDs and can group them together for CPU detection.
If the chipset supports L1 cache WB, there will be a BIOS Setup option to select WT/WB manually.
But we do want to distinguish between x3/x4 multiplier mode. So for the Am5x86 we need to have 2 table items, one with Reset_IDs 0480h-049Fh (x3) and a second with Reset_IDs 04E0h-04FFh (x4 multiplier).

The new 0480h-049Fh item will then also be used to identify the Enhanced Am486DX4 and Intel’s DX4, which means the old 0480h-048Fh item for the DX4 can be overwriten. But because we will change the DX4 item from 0480h-048Fh to 0480h-049Fh, we have to place the 0490h-0490h item for the Cyrix 486DX in front of the new DX4 item, otherwise the detection of the Cx486DX is broken.
So this is the patch I’ve come up with for the 11/24/94 BIOS.
 

This patch uses the 2nd table item, originally for the DX4, now for the Am5x86 in x4 mode. The CMOS_3F_data byte for this item has both bits 7 and 6 set to indicate x4 mode. This will be explained later on.
The 4th table item, originally for a Pentium, can be overwritten without consequence on this socket 3 BIOS, and is used for the new AMD/Intel DX4 item.
Doing the patch this way, the 3rd table item for the Cx486DX is already in sequence and can remain unchanged.

This is how this patch looks when I put the bytes in sequence for a hexeditor. The changed bytes are in red.

If your 1994 Award BIOS is slightly older, you may find that the Reset_ID 1480h-148Fh for the DX4 ODP is missing and that the DX4 byte sequence AB, 90, 80, 04, 8F, 04 is at the beginning of the table. However, the above Am5x86 patch will still work in this case, only the DX4 ODP is and remains unsupported.

But look-out for a changed CMOS_3Fh bit definition for Green CPU from bit 4 to bit 5 in older BIOSes. The patch has to be adjusted accordingly in this case, and this is how the same Am5x86 patch looks when you find the DX4 byte sequence to be AB, A0, 80, 04, 8F, 04 in your BIOS.

- more in the next posting -

The x4 multiplier

During POST, just after the BIOS has measured the CPU speed, there is a routine that determines the bus_speed (FSB). This bus_speed value is then used to program the chipset’s DRAM and L2 cache timing registers for optimum performance and stability.
The BIOS calcutates the bus_speed by dividing the CPU speed by the multiplier of the CPU. As shown above, the multiplier is stored in CMOS 3Fh bits 7,6 during CPU detection. These 2 bits can have 4 possible combinations:

The 4th combination (both bits set) is not used in the original BIOS and can be used to indicate the x4 multiplier. For this to work, the code that divides the CPU speed by the multiplier has to be patched:

At the start of this code fragment, the measured CPU speed is present in the BL register, and the variable at [BP+3Fh] holds a copy of CMOS register 3Fh. The CPU speed value is then placed in the AX register and the BL register is used to store the multiplier. In the original code this is done by checking bits 7 and 6 of [BP+3Fh] separately.
The patched code handles these bits together and performs some binary arithmetic to arrive at the correct x2, x3, or x4 multiplier value in BL. The DIV BL instruction at the end of this code fragment performs the actual AX/BL division and places the resulting bus_speed value in AL for further processing.

For the hexeditor, here are the 18 bytes long hex signatures of this x4 multiplier patch:

If you had to make changes in the F-segment, remember to correct the last byte of the BIOS to make the checksum good again. 😉

In the next part of this Am5x86 patch story, I will focus on the 1995 uncompressed Award BIOS.

Jan

This is great information, thanks for sharing. I’ve got a board with a December 1994 BIOS that shows an Am5x86 as Unknown during boot so will have to try my hand at patching it.

Would the procedure be similar for adding Cyrix 5x86 support?

Hi turbooo,

Welcome to the league of BIOS patchers! 😉

This December 1994 Award BIOS probably has the Year 2094 and 2GB HDD display limit bugs as well, so you may also want to patch these while you’re at it.
For which board are you patching this BIOS? Just curious…

As you probably know, the Cyrix 5x86 is a different beast and my Am5x86 patch procedure doesn’t work for the Cx5x86. I never did a BIOS patch for the Cx5x86, but time permitting I can look into that.

Jan

I’m patching a Biostar MB-8433UHT-A board with a 4.50G BIOS, so it seems like an ideal candidate. My hope is that it can be turned into the poor man’s MB-8433UUD… with bonus VLB support.

Biostar MB-8433UHT-A? Typo perhaps?
Would that be an MB-1433UHT-A board, like on https://www.ultimateretro.net/en/motherboards/1090

If so, is it the 12/21/94-UMC-881/886-2A4X5B01-00 BIOS you are going to patch?

Unfortunately, the copy of this BIOS on Ultimate Retro is corrupt. Its missing the first half with all the POST routines. 🙁
If you have a good dump of this BIOS, I very much like a copy for Ultimate Retro and for myself. 😉

Jan

Well I am doubly embarrassed, because I messed up both the board name (MB-1433UHT-A is correct) *and* I was the one who dumped the BIOS that is on Ultimate Retro... guess I will remember to pull the chip from the board to read it in the future.

Here is what should be the correct BIOS file, for your enjoyment. I've also shared it with the Ultimate Retro folks to re-upload.

Okay, that MB-1433UHT-A is a nice board with indeed both VLB and PCI slots. 😀

Thanks for the "take2" BIOS dump, looks perfect!

It’s an interesting BIOS for my Am5x86 patch story as well. When I look at the Reset_ID table I see that the sequence of the items is different from my previous example. It looks like Award was working on a common Socket 3 / Socket 4 BIOS core at the time and put the Pentium detection as first item.

I found the Reset_ID table at offset 16F28h and if you start the patch at the 3rd item for the DX4 (offset 16F34h) you can still apply the “Am5x86 Reset_ID patch1” to get the Am5x86 recognized as DX4-S instead of Unknown.
And the corresponding x4 multiplier patch will work as well in this 12/1994 BIOS.

However, in the CPU support list (offset 172BAh) I see additional Am486DX2PLUS and Am486DX4PLUS strings for the Enhanced AMD DX2/4 CPUs. There is probably some hardcoded CPUID detection for these models somewhere because I see no support for them in the Reset_ID table.
I will look further into that. Maybe a nicer Am5x86 patch, using the Am486DX4PLUS string, is possible in this BIOS.

Jan

Hi,

I've this board a "35-8332-01" with this bios 08/14/97-i430VX-ITE8680-2A59GV3EC-00 , model 70814b a Socket 7 supporting dual voltage P-MMX up to 233Mhz/K6 233Mhz I'm testing on another thread. With a multiplier of 2x with 66mhz a K6-3 400(2.4v) works but the bios see it as a 80486DX @ 66Mhz while the o.s. seems to detect the cpu and its features (beside a 133Mhz impossible FSB). Considering the lower voltage is 2,4 volts without any voltage jumper and I can't change that, is it possible at least to know if its bios can be modified to detect at boot the right K6-3 400 string (66mhz x 6) together with the hard disk >8GB patch?

Hi 386SX,

I've checked this PCPartner MB520NH, VXB810DS, VXB820DS, VXB830DS 08/14/97 BIOS and yes, I can patch it for:
- K6-2/ K6-III/K6-2+/K6-III+ support
- Write-Allocation support for K6-2CXT/-III/-2+/-III+
- CPU speed support above 333MHz up to 450MHz
- 32GB and 64GB bugfixes for 128GiB HDD support

I’ve put it on my “to do” list and I will let you know when its ready. 😀

Jan

We are blessed to have you here Jan.

Chkcpu wrote on 2022-01-31, 11:21:

Hi 386SX, […]
Show full quote

Hi 386SX,

I've checked this PCPartner MB520NH, VXB810DS, VXB820DS, VXB830DS 08/14/97 BIOS and yes, I can patch it for:
- K6-2/ K6-III/K6-2+/K6-III+ support
- Write-Allocation support for K6-2CXT/-III/-2+/-III+
- CPU speed support above 333MHz up to 450MHz
- 32GB and 64GB bugfixes for 128GiB HDD support

I’ve put it on my “to do” list and I will let you know when its ready. 😀

Jan

Thanks!!! I was reading the thread posts to prepare to (try) modifying the bios myself but this was unexpected. Great! 😁

This board revision at least the one I'm testing seems to read with the multimeter as lowest vcore (undocumented no jumper setting) around 2,4 volts so most K6-2/+ cpus are not possible without power mosfet circuit mod but at least a K6-2 450 with 2,4v exist and the K6-3 400 2,4v (to risk I might try the K6-2 550 2,3v). For the freqs there's a JP6 that seems related to higher multipliers but probably functional on later revisions. Maybe the bios is compatible with different pcb but this pcb rev seems not giving much space for many cpu. The FSB should go up to 75Mhz I have to try that even if the K6-3 400 is already a powerful cpu and can work @ 66Mhz bus. 😉

This is a really great tutorial, I'm looking forward to doing this my self 😀

Is it possible to get a copy of the bios file from your example, the 30F2-C2.BIN from the Soyo board?
I am missing the BIOS on my board and I can't find it online anywhere.

Yes, here is a copy of this Soyo 030F2 Rev C2 BIOS (11/24/94-OPTI-802G-822-2A4UKS21-00).
I believe that the 030E2 board uses the same BIOS as the 30F2 and can use this Rev C2 too.

I will send it to ultimateretro.net as well.

Jan

Chkcpu wrote on 2022-02-08, 12:13:

Yes, here is a copy of this Soyo 030F2 Rev C2 BIOS (11/24/94-OPTI-802G-822-2A4UKS21-00). I believe that the 030E2 board uses the […]
Show full quote

Yes, here is a copy of this Soyo 030F2 Rev C2 BIOS (11/24/94-OPTI-802G-822-2A4UKS21-00).
I believe that the 030E2 board uses the same BIOS as the 30F2 and can use this Rev C2 too.

Soyo-030f2-c2.zip

I will send it to ultimateretro.net as well.

Jan

Thank you so much 😀

-Jakob

Hi,

I'm not sure but I think this is the right place to ask my question(s). I will try to describe the background for them as detailed as possible. If questions arise I will try to answer them as soon as possible.

So, I recently got a Shuttle HOT-599 mainboard featuring a 2 MBit AWARD-BIOS in revision S016.
There is a newer one with revision S214 which I have flashed.

But besides some new memory-timing related settings the voltage & temperature monitoring in BIOS got some flaws now.
First, some text strings became messed up, that is, 3V3 / 5V / 12V / VCore became something like In1 / In2 / In3 / In4.
Second, one of these voltages as well as the CPU temperature are shown wrong now (temp seems stuck at 50°C, the voltages showing 1.xxV instead of the correct value, think it was the 3.3V).
And third, the performance with K6-2 CPUs (and possibly others too) decreased.

For example, in DOSBench performance in Quake (option d) dropped from 28.7fps to 27.6fps with a K6-2/500 @5x100 MHz and from 32.5fps to 31.2fps @4x124 MHz. Not that much here but increasing with higher resolutions.
This is something I have seen before with a "newer" BIOS, the Commate S7AX BIOS rev. 2.7 and 3.0 is one example for this.
Performace drop in Quake (option e) there is from 29.x to 21.x fps, which is quite significant, and cannot be reduced by using some software tools for different WA and WC settings.

So my questions are:
- Is there any reason known why a newer BIOS could have such impact on performance and could this be patched (generally, not just for the HOT-599)?
- would it be possible to correct the monitoring issues in the newer HOT-599 BIOS by correcting the text strings and fixing the values shown? (I have stepped through the BIOS file and found the text strings, so I guess I could possibly replace them myself, but besides my non-existent capabilities in BIOS modding this is a 2 MBit BIOS with another build up compared to the usual 1 MBit ones. So I am unsure if I could get it to work again after my "modding". This is also a "just one try for free" thing for me as I have neither a flash programmer nor another board capable of flashing a 2 MBit BIOS for the case I mess it up)
- Is it possible to add support for K6-2+ and III+ CPUs to the HOT-599? According to the manufacturer this board does not support them and it really doesn't POST with a K6-2+. I don't know if there is any HW specific reason for this but maybe this could be done.

I have added mentioned BIOS files for the HOT-599 as well as the S7AX for reference.

Thanks!

Hi ChrisK,

About your questions:

- A BIOS update will normally add functionality, fix bugs and increase performance. But sometimes it’s the opposite.
The BIOS programs the chipset with optimum timings for Local Bus, DRAM and Cache when LOAD SETUP DEFAULTS is selected. I’ve seen cases where these default timings were relaxed after a BIOS update, probably to cater for different board revisions with components from different manufacturers.
For us, the “tech savvy user”, this isn’t a problem. Just enter the BIOS Setup, set the chipset Auto configuration to manual, and restore the timings to the values from before the update. 😉

With the above in mind, I did a quick check on the HOT-599 S016 and S214 BIOSes with Award’s Modbin tool. I don’t see any missing or hidden options in the S214 BIOS, so you should be able to tune your HOT-599 board back to peak performance.
One particular option to check is “VGA Clock”. In the S016 BIOS it is set to 100MHz, but the default value in the S214 BIOS is only 66MHz. This setting alone could explain the performance hit you experienced. So check if VGA Clock is set to 100MHz and if it is not stable, try 83 or 75MHz.

Of course the above only applies when you use the on-board AGP Video chip.

- About the hardware monitor, changing the item names back to the S016 BIOS strings can easily be done with Modbin. But fixing the broken functionality is beyond my expertise.
Can you send a picture of this BIOS screen so we can see what’s going on?

- The HOT-599 S016 BIOS supports the K6-2/-III but not the K6-2+/-III+ CPUs. The S214 BIOS however has full K6plus support and should run your K6-2+ without problems.
I don’t see any hardware issues with this SiS530 board that would prevent the K6-2+ from booting.
Only one tip though, when the 2.0V Vcore setting doesn’t work, try 2.1V. I’ve found several Super Socket 7 boards that produced 1.25V Vcore when set to 2.0V. When I looked up the datasheet of the Voltage controller chip used, this 1.25V was actually documented. But it was nowhere shown in the motherboard manual. 🙁

Hope this helped,
Jan

Hi Jan,

thank you for your comprehensive reply!
I will have another look at these timing stuff in the newer BIOS but I'm pretty sure I checked this already and everything was set to fastest as far as I could judge it.
Also the VGA setting was (shown as) 100 MHz all the time. I will check this again.
One thing I didn't do after flashing is loading BIOS defaults. Maybe this one got me fooled.

I know that there is one particular setting at which some voltage regulators virtually shut off, this is mostly the one at the switchover point from the lower region (something like 1.3V up to 2.0V) to the higher region (2.0V and up). But on this board this should not apply. The regulator is 5 Bit but only four of them are configurable. Documented settings even start at 2.2V, though. I will have a second look at this one, but I'm pretty sure I've tested with the 2.0V and 2.1V setting including double checking with a voltmeter already.
I admittedly didn't do much testing with the K6-2+ as it didn't POST on the first try (CPU is known good) and the manufacturer clearly stated that these aren't supported at all. Maybe I got distracted too easily by this "knowledge".
As soon as I can take some time I will have a look into this, too.

Thank you for pointing me in some directions to check again and for having a look into the BIOS itself to verify existing support of K6-2+/III+.
Will let you know findings.

Best regards!

Really inspiring stuff with the BIOS modding!

I have a Compaq with a OEM Motherboard (Sniper 1P3I) that has a 8GB limit on drives. I ran the ROM through `strings` and doesn't look to be encrypted. I see `PhoenixBIOS 4.0 Release 6.0.I`.

I can configure the drive geometry, but the max heads I can set is 15 (fdisk in Linux says it should be 240 ) . Cylinders (30533) and Sectors/Track (63) I can set just fine though. Maybe this is overly optimistic, but I am going to see if I can change the type used for max heads from 4 bits to something else?

What tools are using to examine BIOS images? I have Ghidra, but just getting started.

I also am sure I am going to mess this up a fair bit. I have a CH341A with a SOIC8 when I installed coreboot on my T420. Hopefully I can push/pull BIOS images that way.

Hi duboisea,

As you may have gathered, my main interest is the Award BIOS, although I did patch a few AMI socket 7 BIOSes as well.
But the Phoenix BIOS is still a mystery to me and I have been unable to crack its encoding.
Back in 2005 I did some work on exactly this Compaq 11 February, 1998 Release 6.0.I PhoenixBIOS. It is encrypted and I was able to extract some BIOS modules with the Phoedeco tool, but couldn’t discover how this BIOS worked. And I have no way to put it back together again.

Anyway, this is all irrelevant because breaking the 8GiB HDD barrier involves a major rewrite of the Interrupt 13h Harddisk interface and this is way beyond my expertise in any BIOS, Award, AMI, or otherwise. It involves adding the IBM/Microsoft Int 13h extensions to the Harddisk interface.

If you want to read up on the theory behind this, I wrote a "The BIOS IDE Harddisk Limitations" article back in 1999. It is still available at: http://www.steunebrink.info/bioslim.htm

Most BIOSes from 1998 or later will support the Int 13h extensions, so I’m surprised your February ’98 BIOS doesn’t. I wrote a tool to test this and it can be downloaded from my bioslim webpage as well.

This DOS tool is called EXTBIOS and comes with a TXT-file that explains its use.
EXTBIOS supports command-line switches and with the /V switch (verbose mode) you get extra details when the Int 13h extensions are detected.
Note that a Harddisk must be connected and setup in the BIOS, otherwise EXTBIOS won’t be able to show you anything. 😉

When EXTBIOS tells you the BIOS has no Int 13h Extensions, you need Drive Overlay software or an option ROM with Int 13h Extensions like the XTIDE Universal BIOS to break the 8GiB barrier.

Jan

Edit: updated the link to my website