I have made a replacement ROM for Wyse S10 that replaces the builtin remote desktop client with a floppy emulator with an embedded floppy image: https://kmeaw.com/sp1.rom

Some modules of the ROM are compressed with JCALG1 (they start with 'JC'), some with RLE, others are uncompressed.
I tried pulling out VSA from other ROMs and putting them into my ROM to get SB16 emulation but got no success.

Also I have found some Audio VSM somewhere but I don't know yet how to make it work: https://kmeaw.com/audio.bin

Paul_V wrote on 2024-08-28, 07:36:

Thanks! Definitely will look into it. I have a couple of those machines myself. So far, I've been unable to find a suitable BIOS […]
Show full quote

StefanPutureanu wrote on 2024-08-25, 19:39:

My blog: https://wysereverseengineering.blogspot.com/?m=1 […]
Show full quote

My blog:
https://wysereverseengineering.blogspot.com/?m=1

There is so much information about this Insyde BIOS that is impossible to cover everything here.

I'm personally looking for a piece of code from this Geode machines BIOS. The Xpress Audio VSM (it is not system department - it can be ported from one BIOS to another).

Thanks for the provided dumps, I will look in them, maybe I will find this code.

Thanks! Definitely will look into it.
I have a couple of those machines myself. So far, I've been unable to find a suitable BIOS for it. And it's pretty terrible as retro PC (no windows 95\98 drivers, limited BIOS, no PS/2, etc)
Sx0 has a pretty unique combination of GX2 CPU and CS5536 companion IC (other brands mosly use CS5535) and some proprietary hardware INIT.

AFAIK, no VSM exist for GX2 (GX433\500). It was a feature of it's predecessor - GX1.
And most files included in this topic are for GX3 (LX800).
I have successfully cross-flashed some GX3 based motherboards with AWARD and AMI BIOSes, so INSYDE XpressROM is not an issue for me anymore.
Now I can set any multiplier I want both through BIOS and MSR, the only issue I've left is disabling DDR DLL on boot.

If you're interested - I have a bunch of GX2 based BIOSes from various industrial motherboards (mostly AWARD), as well as a reference schematic for Sx0.
The only INSYDE based one I have is for EPX-GX500.

Thank you for the provided BIOS. I will have a look. I have noticed that "Kontron" SBC have used this XpressAudio VSM, but they don't provide any BIOS for free. If you happen to have some it will be great.
For now I have extracted all the VSMs from my S50 VSA2 ROM, there are 9 VSMs included, 8 without the System Manager. (haven't posted this on the blog)
With the VSA source code aside I have figured out most of the functions included in every VSM. There are lots of handlers for everything you can imagine. The VSA2 source code provide all the necessary functions to build any VSM you want. You can include a spyware for example: whenever a memory region is accessed to trigger a SSMI, freeze the OS and send the data over internet. This might be the reason why this VSA was abandoned.
CS5536 provide the means for any audio card to be emulated at the cost of CPU time. It provides MSRs for the VSA to be triggered when the AC97 needs to, and MSRs for IO space access to trigger the VSA. Just nobody have been interested in writing a VSM for SB16 for the VSA2 I think.
The way the VSA2 works from what I've learned is:
1. BIOS loads the VSA.ROM in memory and executes it.
2. First part of the VSA.ROM is an INIT code that will get all the hardware specifications of the machine and will write them to the VSA System Manager header, then it will copy the System Manager to a new RAM location together with all the remaining VSMs that will follow this System Manager. Then the INIT code will enable the SMI instructions (OEM opcodes - IDA fails to disassemble this - this are documented in the GX CPU pdf). All the VSMs will report to the System Manager the events that can handle.
3. INIT returns to BIOS.
4. Now the BIOS will be able to access the newly virtually created devices and configure them. We can set what events will trigger the VSA, like the 51500002 MSR bit 0 = IRQ_SSMI_EN = AC97 IRQ.
5. At the end of POST, BIOS tell the VSA that it can start working.
********************
Now, when the AC97 will trigger an IRQ on the PCI bus, a SSMI will trigger, OS will be frozen, VSA System Manager will be in control and it will search for the event that have triggered the SMI and will run the VSM that have been registered for that event. Here the VSM can do whatever it wants by setting up another IRQ for example, or steal your data and send it to the internet 😁, then it will resume to the OS.
********************
I will try to build a VSM for this SB16. It will take time, but I will try. For now I disassemble as much as I can from all the VSMs to decide on one to use as a template and patch it to do whatever I want.
80% of the code from any VSM can be found in the VSA2 source code with lots of comments. The only downside is that a VSM can have 2 function from a file and 10 from another from the souce code files, and there are a lot of them.

StefanPutureanu wrote on 2024-09-16, 17:58:

I will try to build a VSM for this SB16. It will take time, but I will try. For now I disassemble as much as I can from all the VSMs to decide on one to use as a template and patch it to do whatever I want.
80% of the code from any VSM can be found in the VSA2 source code with lots of comments. The only downside is that a VSM can have 2 function from a file and 10 from another from the souce code files, and there are a lot of them.

Well, that'll definitely be something mindblowing.
----

Unfortunately, I do not have any Kontron BIOS and they do not have any mention of it on their FTP.
I've noticed, that VSA2 roms also present in AWARD and AMI BIOSes.
Most of the ones I found also can be found here:
https://theretroweb.com/bios/?chipsetId=1563
https://theretroweb.com/bios/?chipsetId=1533

Also, I've attached two versions of BIOS for Lippert industrial motherboard I found. I believe the one is INSYDE, the other is coreboot.

Lastly, I remembered, that HP Evo T20 had SB emulation. There should be VSA in it's firmware.
It's a GX1 Geode thin client plus CS5530A companion chip.

U441_22_3CMe8.rar is the firmware bunde itself.
sp22454.rar contains tools to extract the parts, which may not be neccessary, here's a good link with binary offsets
https://www.parkytowers.me.uk/thin/EvoT20/EvoFirmware.shtml

----
BTW, could you help in something I've been struggling for quite a while? The problem is described in my separate topic. Thanks a lot.
Last resort at AMD Geode LX800 downclocking, experienced BIOS mod help is appreciated.

kmeaw wrote on 2024-09-02, 14:47:

I have made a replacement ROM for Wyse S10 that replaces the builtin remote desktop client with a floppy emulator with an embedd […]
Show full quote

I have made a replacement ROM for Wyse S10 that replaces the builtin remote desktop client with a floppy emulator with an embedded floppy image: https://kmeaw.com/sp1.rom

Some modules of the ROM are compressed with JCALG1 (they start with 'JC'), some with RLE, others are uncompressed.
I tried pulling out VSA from other ROMs and putting them into my ROM to get SB16 emulation but got no success.

Also I have found some Audio VSM somewhere but I don't know yet how to make it work: https://kmeaw.com/audio.bin

Haven't seen your post till now 'kmeaw'. This is great. The VSM you provided is truly an XpressAudio VSM for VSA2.
You made me very happy by posting this. I will disassemble this VSM to see how the emulation was done and I will stick this to the VSA2 ROM.
You can literally add this VSMs one after the other in any VSA2 ROM image. The VSA2 ROM starts with an INIT code at offset 20h, then is the System Manager (this is machine dependent) and after this there are all the rest of the VSMs (machine independent). In the INIT code there is a function that is just copying all the found VSMs to a hidden RAM location. Only the System Manager is configured for a specific machine.
You can add this XpressAudio VSM on your VSA ROM using a hex editor. Just add the VSM after the last bye, then compress the image back with the JCALG and put this back on the BIOS image. Be sure that the BIOS boot block can find the rest of the ROMs after this. All ROMS have to be shifted to make room for the new code. After this you need to find the function that will configure the SB16 in the BIOS boot block. For my S50 the function was left there, this function is trying to set some virtual registers for the SB16 but because the XpressAudio VSM haven't been loaded, nothing happens.
And I think there should be some MSRs bits set for the VSA to get triggered when an IO access to the 220h address happens for example. This might be set in the XpressAudio VSM... I need to disassemble this first to know for sure.
I almost forgot: the System Manager will throw any errors on the COM 1 serial port if a VSM reports any... this must be somewhere on the PCB, some unpopulated pads. The external serial port is actually the COM2 port, at least on the S50. Someone with soldering skills might find this port and listen to it on another machine. This will be useful for VSM debugging.
I have written more about this SB16 emulation. Is not a complete tutorial and might not be absolutely true (I might have made some mistakes) but it might be useful:

https://wysereverseengineering.blogspot.com/2 … os-622.html?m=1

I will finish this blog after I will succeed with this SB16.
Thank you again for the provided Xpress Audio VSM.
I will return with results here. (I don't have much time (I work as an electrician, computer science is a hobby for me) but I will make it happen.

Paul_V wrote on 2024-09-17, 09:57:

Well, that'll definitely be something mindblowing. ---- […]
Show full quote

StefanPutureanu wrote on 2024-09-16, 17:58:

I will try to build a VSM for this SB16. It will take time, but I will try. For now I disassemble as much as I can from all the VSMs to decide on one to use as a template and patch it to do whatever I want.
80% of the code from any VSM can be found in the VSA2 source code with lots of comments. The only downside is that a VSM can have 2 function from a file and 10 from another from the souce code files, and there are a lot of them.

Well, that'll definitely be something mindblowing.
----

Unfortunately, I do not have any Kontron BIOS and they do not have any mention of it on their FTP.
I've noticed, that VSA2 roms also present in AWARD and AMI BIOSes.
Most of the ones I found also can be found here:
https://theretroweb.com/bios/?chipsetId=1563
https://theretroweb.com/bios/?chipsetId=1533

Also, I've attached two versions of BIOS for Lippert industrial motherboard I found. I believe the one is INSYDE, the other is coreboot.

Lastly, I remembered, that HP Evo T20 had SB emulation. There should be VSA in it's firmware (see attached archive sp22454)
It's a GX1 Geode thin client plus CS5530A companion chip.

----
BTW, could you help in something I've been struggling for quite a while? The problem is described in my separate topic. Thanks a lot.
Last resort at AMD Geode LX800 downclocking, experienced BIOS mod help is appreciated.

"kmeaw" just provided an XpressAudio VSM for the VSA2 above. Haven't seen it till now. I will add this to the S50 VSA.ROM.

For the LX800 with CS5536 I have a complete source code for an Acrosser BIOS. Some building tools are included and the building process might be as simple as running a bat file in Windows (haven't tested).
There are 685 files in this project, and I'm sure I've seen a file for the RAM configuration speed. Here is a link with the entire BIOS source code. This project belongs to AWARD and it was leaked long ago, nobody will care about the copyright:

https://drive.google.com/file/d/1oCUkDKt5Oenb … ew?usp=drivesdk

Haven't looked much in this. It doesn't have the VSM that I was looking for. But I will look into it, maybe I can help you. There must be everything, every setting possible, but for now I want to patch the S50 BIOS to emulate this SB16.

BTW - I like this WYSE machine because it can emulate a HDD in DOS using an USB drive. So I have USB suport in DOS with no driver. VSA does this. I boot this WYSE in DOS6.22 from the DOM (Compact Flash with IDE adapter) and the USB gets mounted as the "D" drive. Is not plug and play, but if you insert the USB before applying power to the machine it works.

I'll come back with more info. Thank you for everything for now.

Paul_V wrote on 2024-09-17, 09:57:

----
BTW, could you help in something I've been struggling for quite a while? The problem is described in my separate topic. Thanks a lot.
Last resort at AMD Geode LX800 downclocking, experienced BIOS mod help is appreciated.

I have looked on to your award boot block, there in no MSR set in there. MSRs must be set on some other ROM. For my S50 Insyde bootblock MSR, 2000.0018 is referenced 28 times in the code, so it might not be so simple to disable this DLL. The RAM controller function is about 30% from all the boot block (is a really big function).

Here is a version of my Insyde boot block in html for easy reading. You can search in the browser for 20000018 to see all the functions that are accessing this MSR.
https://drive.google.com/file/d/1nz6iisXnkM72 … ew?usp=drivesdk

And here is a fast disassemble of your boot block:
https://drive.google.com/file/d/1vNE0AGZEU1fa … ew?usp=drivesdk
There is no MSR instruction in it. I will trace this further, boot block must load other ROM for MSR settings.

For the boot block and ROMs extraction from the AWARD BIOS i use this tool:

https://drive.google.com/file/d/1rDQnzsF2aS5g … ew?usp=drivesdk

Hi again. For whoever is interested in SB16 emulation on the WYSE terminals, I can confirm that you can manually add a VSM to the end of the VSA ROM in any Hex Editor and it will work. For my S50 -SX0 I have extracted the VSA ROM from the BIOS dump with JCALG tool. Using a Hex Editor I have extracted all the VSMs. I have made a copy of the last VSM (is an OEM VSM that has the entire VSA2 library included) and I have patched this file in IDA to trap any access to IO ports 220-22F and respond with some data back to the software that triggered those IO Ports. Finally I have added this patched VSM at the end of the VSA ROM. Compressed back with JCALG, replaced the original VSA ROM in the BIOS dump and patched the header of the ROM to fit the new - bigger size.
In other words, now I can run any code when an IO port is accessed.

Here I'm running IO Port Viewer in DOS 6.22 on the WYSE terminal.

Data displayed on the 220-22F ports is the data from my VSM - I hope it can be seen in this picture. (The machine has some hardware upgrades too: I have added a fan to the CPU and swapped the DOM with a Compact Flash).
Now I know that this emulation is possible. I still have a lot of work to do, I'm writing this in IDA, byte by byte.
For the SB16 emulation there are only 16 IO ports, AC97 has 128 IO ports: EE00-EE7F. To control the AC97 there is plenty of information in the CS5536 datasheet with all the ports explained. It will take a lot of time to build this, but for now I have fully understood all the VSA functions and MACROS.

The VSM from the Kmeaw user is useful, but is a beta version of the VSA2 and is not fully compatible with the VSA2 from the WYSE machine.

Thank you to all of you for the provided data.

When I will finish this VSM I will post again.

And this is how my IDA patches looks like 😉

I have an LX800 thin client (Nexterm RT-500) and I remember it had a fairly extensive BIOS menu (at least LVDS timings (there are no LVDS connectors anywhere), RAM timings (the RAM chips are soldered in), and CPU multiplier). I'll try dumping the BIOS when I get home.

kagura1050 wrote on 2024-10-29, 02:29:

I have an LX800 thin client (Nexterm RT-500) and I remember it had a fairly extensive BIOS menu (at least LVDS timings (there are no LVDS connectors anywhere), RAM timings (the RAM chips are soldered in), and CPU multiplier). I'll try dumping the BIOS when I get home.

It would be nice to have a BIOS dump of your LX800. VSMs from VSA2 adapt themselves to the system they are running on. It might be possible to port this VSMs from one BIOS to another.

I have made another discovery on VSA2 system. Whenever you make a programming mistake on one VSM, the VSA2 System Manager will play a long beep at the startup of the machine and it will actually send an error string on the serial port - baud 115200:

It doesn't like something... displayed opcode is not in the VSM, I must have been pushed a wrong number of bytes... stack problem... I will fix it, but the interesting thing is that the System Manager it helps a lot at debugging.

Maybe I should move this discussion to another thread on this forum, but for now I will continue here. Please let me know if is ok or not.

The error above was triggered by a jump over multiple NOPs in the code. Sience I write this code in machine code (editing hex values) I use to let some space in the functions for future code insertion, and it seems that the VSA2 System Manager doesn't like this.
4042:D3CD is the physical address where the error was detected, the Instruction Pointer was at 7AD.. so my VSM was loaded at 4042:D3CD - 7AD = 4042:CC20 = 4:D040 linear address.

After fixing the code I have tried to dump this memory... there was nothing, all zeros - VSA2 is truly invisible to the OS.

And I have made some progress with the SB16 emulation on the WYSE terminal by the means of VSA2 - Audio VSM. I have managed to simulate the SB16 DSP reset procedure, DSP version and speaker on/off control.
(This part only respond to the software as there will be a SB16 installed in the system, no AC97 work done for now)

The thing is that not all the software gets tricked by my VSM, and now I don't know what other tests are made by the DOS games to detect the SB16.
Here are some IO debug tests that I've made to the system:

For now I want my VSM to fully respond to the SB16 IO ports as an original card. After this will work fine I will have to trap the DMA IO access and redirect the instructions to the AC97 controller dedicated DMAs.
CS5536 has this integrated AC97 controller that has its own DMAs that work a little different than the 2 DMAs of the system (integrated Intel 8237).
And in the end I need to process the 8 bit audio data from the games audio buffers to the 16 bit audio, FM audio format and other types of sound data that the SB16 is able to play.

If anyone knows some good reading about SB16 detection scheme used in the DOS games and the PCM data format, FM data format... please let me know.

StefanPutureanu, that's great prorgess.

You can get information on data formats used by SB16 from ctsbhwpg.exe, the Sound Blaster Series Hardware Programming Guide by Creative Technology Ltd.
It is an encrypted self-extracting ZIP archive, password is "FULLAGREE".
That archive contains C code samples and documentation on hardware components and PCM data formats.

FM data formats and programming information can be found on www.oplx.com

As for the real DOS games code, you can use the opensourced Apogee Sound System as a reference (github.com/jimdose/Apogee_Sound_System) - it is used in games by Apogee, notably Rise of The Triad and Duke Nukem 3D.

kmeaw wrote on 2024-11-11, 22:01:

StefanPutureanu, that's great prorgess. […]
Show full quote

StefanPutureanu, that's great prorgess.

You can get information on data formats used by SB16 from ctsbhwpg.exe, the Sound Blaster Series Hardware Programming Guide by Creative Technology Ltd.
It is an encrypted self-extracting ZIP archive, password is "FULLAGREE".
That archive contains C code samples and documentation on hardware components and PCM data formats.

FM data formats and programming information can be found on www.oplx.com

As for the real DOS games code, you can use the opensourced Apogee Sound System as a reference (github.com/jimdose/Apogee_Sound_System) - it is used in games by Apogee, notably Rise of The Triad and Duke Nukem 3D.

Thank you. I'll come back with updates.

kagura1050 wrote on 2024-10-29, 02:29:

I'll try dumping the BIOS when I get home.

Well, it took me almost half a year to get home...
Sorry, I completely forgot. I finally dumped the BIOS and CMOS of my Nexterm RT-500. I hope it helps in some way.

P.S. There was a clock setting menu in the BIOS, so I tried underclocking, but it would not POST if either the GeodeLink or CPU was less than 7x.

kagura1050 wrote on 2025-03-12, 12:47:

Well, it took me almost half a year to get home... Sorry, I completely forgot. I finally dumped the BIOS and CMOS of my Nexterm […]
Show full quote

kagura1050 wrote on 2024-10-29, 02:29:

I'll try dumping the BIOS when I get home.

Well, it took me almost half a year to get home...
Sorry, I completely forgot. I finally dumped the BIOS and CMOS of my Nexterm RT-500. I hope it helps in some way.

P.S. There was a clock setting menu in the BIOS, so I tried underclocking, but it would not POST if either the GeodeLink or CPU was less than 7x.

Thank you. I have forgot about this project myself.
The UI of this BIOS is letting you modify some NVRAM tokens that are saved over reboot. You can actually modify more variables of the system by directly mod-ing the NVRAM. NVRAM is a little bit harder to understand because there might be one or more variables stored in one byte. BIOS applies a mask and does a left shift with every byte in the NVRAM to get a variable value.

About the SB emulation, the only problem I had was trapping 3 DMA IO ports: 8B, C4 and C6. There might be a bug in the VSA2 system manager. I have reverse engineer'd all VSA2 system, Init code, System Manager and all VSMs. I have them all tracked with IDA with plenty of comments on every CPU instruction and all functions. I also have written some DOS programs for reading the Geode and companion internal MSRs. If anyone wants some information I can share my work.

Maybe someday I will continue this project, if not here are some hints: Patches must be word or dword aligned otherwise Sys. Manager will trow an error. My IDA 7 patching function is buggy sometimes, you need to check with a hex editor if the patches are correct. After patching a VSM you need to replace it in the VSA image with a hex editor, then you need to compress the VSA image, replace the compressed image in the bios dump file, fix the offsets of the image if the new compressed VSA is bigger - this is for the BIOS expanding function to find the VSA when the system starts up (I have already moved the entire VSA image to a lower address offset to have space for a bigger image in the future... just to skip this step), then you need to externally burn the BIOS image to the chip... and all this steps need to be done everytime you need to test a new patch. It is very time consuming.
One might make a tool for doing all this steps in one go, I'm an electrician and this is a hobby for me.

I have found some old Cyrix MediaGX (AMD Geode) BIOS and drivers.
As well as datasheet and manuals.

kagura1050 wrote on 2025-03-12, 12:47:

Well, it took me almost half a year to get home... Sorry, I completely forgot. I finally dumped the BIOS and CMOS of my Nexterm […]
Show full quote

kagura1050 wrote on 2024-10-29, 02:29:

I'll try dumping the BIOS when I get home.

Well, it took me almost half a year to get home...
Sorry, I completely forgot. I finally dumped the BIOS and CMOS of my Nexterm RT-500. I hope it helps in some way.

P.S. There was a clock setting menu in the BIOS, so I tried underclocking, but it would not POST if either the GeodeLink or CPU was less than 7x.

I have extracted all ROMs from the provided file. Extracted all VSMs from the VSA2 ROM. There is a new VSM that I didn't have from VSA2: "S2D" (save to disk). It might be helpful in the future. I will attach here a link with all extracted ROMs and VSMs from Nexterm_RT500.

https://drive.google.com/file/d/1PMxRtEWKosou … ew?usp=drivesdk

I don't know if you are still actively working on this project, but here is an Insyde firmware dump from a Micros DT166 Restaurant Controller: Here and attached
This is also known as the DT Research DT166 and a few other names and there's a ParkyTowers page on it here: it has a CS5535 controller chip and I don't think it includes any audio emulation but I could be wrong.

Also, if you're looking for an example on how to do Sound Blaster and OPL emulation in real-mode I can recommend that you look at Oerg866's V97TSR for VIA chipsets. While these chipsets have special support for hardware port-trapping to capture Sound Blaster registers, the OPL3 emulation has to be done with a TSR and this project ports the DOSBox OPL core instead of VIA's original lackluster driver. Project page here

Finally, the AMD Geode LX WDM audio driver (lxwdmau.sys) is heavily based on the Microsoft-provided AC97 sample driver in the Windows 2000 Driver Development Kit, if you happened to want to disassemble it in IDA and make any changes to it. Since the hardware sample rate conversion seems to be broken on the CS5535/36 (why the windows sound blaster emulation is pitched wrong and choppy) someone might want to edit the list of supported sample rates and remove the broken ones, as Windows can do the sample rate conversion itself instead.

onethirdxcubed wrote on 2025-10-02, 02:13:

I don't know if you are still actively working on this project, but here is an Insyde firmware dump from a Micros DT166 Restaura […]
Show full quote

I don't know if you are still actively working on this project, but here is an Insyde firmware dump from a Micros DT166 Restaurant Controller: Here and attached
This is also known as the DT Research DT166 and a few other names and there's a ParkyTowers page on it here: it has a CS5535 controller chip and I don't think it includes any audio emulation but I could be wrong.

Also, if you're looking for an example on how to do Sound Blaster and OPL emulation in real-mode I can recommend that you look at Oerg866's V97TSR for VIA chipsets. While these chipsets have special support for hardware port-trapping to capture Sound Blaster registers, the OPL3 emulation has to be done with a TSR and this project ports the DOSBox OPL core instead of VIA's original lackluster driver. Project page here

Finally, the AMD Geode LX WDM audio driver (lxwdmau.sys) is heavily based on the Microsoft-provided AC97 sample driver in the Windows 2000 Driver Development Kit, if you happened to want to disassemble it in IDA and make any changes to it. Since the hardware sample rate conversion seems to be broken on the CS5535/36 (why the windows sound blaster emulation is pitched wrong and choppy) someone might want to edit the list of supported sample rates and remove the broken ones, as Windows can do the sample rate conversion itself instead.

Thank you. I will have a look at this.

Regarding available Windows drivers for the Geode boards, I did some digging on the Internet Archive of AMD's Developer website and I did not manage to find any actual driver packages, but I did find this page listing all available drivers in 2007:

So as far as I can tell there were never any Windows 98 drivers developed for the AMD GX or LX platform, and the Geode LX audio driver only works in 98se by coincidence (because the developers never removed the 98 target from the WDM sample driver). All mention of Windows 98 and 2000 was removed from that page after 2007.