Dietmar

Hi, I try to install XP SP3 on the Shuttle Hot 433 board with 486 cpu. But very early in Setup comes a message, that the 486 cpu does not support the hex opcode cmpxchg8b and so XP cant be installed. I also try an XP SP3 from another compi in IDE mode, crash at once. Now I look at the hex wíth Ida pro for this cmpxchg8b on an ready XP SP3 install. On a first try I find it in ntoskrnl.exe (one cpu) and in ntdll.dll. There may be other PE files in XP also with this opcode. The use is always the same. This opcode does a atomic search in a register. So, when a working solution is found, the replacement in other files is easy! I try to replace it with a series of opcodes, that the 486 cpu understands. This is not easy. I found this (Edit: This is wrong). push ebx ; save nonvolatile registers push ebp xor ebx, ebx ; zero out new pointer mov ebp, ecx ; save listhead address mov edx, [ebp] + 4 ; get current sequence number mov eax, [ebp] + 0 ; get current next link Efls10: or eax, eax ; check if list is empty jz short Efls20 ; if z set, list is empty mov ecx, edx ; copy sequence number mov cx, bx ; clear depth leaving sequence number jnz short Efls10 ; if z clear, exchange failed Efls20: pop ebp ; restore nonvolatile registers pop ebx ret This I try as a replacement for this function ExInterlockedFlushSList in ntoskrnl.exe in XP SP3. The funny thing in this is, that simple the opcode cmpxchg8b qword ptr [ebp+0] is deleted. May be it works on NT4 but for me it crashes XP. EDIT: May be, that this version for i368 cpu of ExInterlockedFlushSList works really only on a compi with 1 cpu and 1 core. Like in 1992 486 cpu. Then, my test on modern compi will fail. Also can be, that now I use a mix of cmpxchg8b, nothing from this, cmpxchg on one compi, because I simulated only one appearence of this function in ntoskrnl.exe. Funny, this is from Cutler, 13. March 1996, now also identic in XP SP3, THis is the original ExInterlockedFlushSList in XP SP3, first introduced in NT4 Servicepack4, Hex code 53 55 33 DB 8B E9 8B 55 04 8B 45 00 0B C0 74 0B 8B CA 66 8B CB 0F C7 4D 00 75 F1 5D 5B C3 .text:0040B0B2 ; Exported entry 7. ExInterlockedFlushSList .text:0040B0B2 .text:0040B0B2 ; =============== S U B R O U T I N E ======================================= .text:0040B0B2 .text:0040B0B2 .text:0040B0B2 public ExInterlockedFlushSList .text:0040B0B2 ExInterlockedFlushSList proc near ; CODE XREF: sub_45F0DF:loc_45F0F7p .text:0040B0B2 push ebx .text:0040B0B3 push ebp .text:0040B0B4 xor ebx, ebx .text:0040B0B6 mov ebp, ecx .text:0040B0B8 mov edx, [ebp+4] .text:0040B0BB mov eax, [ebp+0] .text:0040B0BE .text:0040B0BE loc_40B0BE: ; CODE XREF: ExInterlockedFlushSList+19j .text:0040B0BE or eax, eax .text:0040B0C0 jz short loc_40B0CD .text:0040B0C2 mov ecx, edx .text:0040B0C4 mov cx, bx .text:0040B0C7 cmpxchg8b qword ptr [ebp+0] .text:0040B0CB jnz short loc_40B0BE .text:0040B0CD .text:0040B0CD loc_40B0CD: ; CODE XREF: ExInterlockedFlushSList+Ej .text:0040B0CD pop ebp .text:0040B0CE pop ebx .text:0040B0CF retn .text:0040B0CF ExInterlockedFlushSList endp .text:0040B0CF .text:0040B0CF ; --------------------------------------------------------------------------- With PE Maker I make a relocate of this function in ntoskrnl.exe. This works(!). The relocation I do, because the following replacement is bigger than the original Hex code. I split the cmpxchg8b opcode in 2 parts with lock cmpxchg, because the 486 cpu understands this. But Bsod. I use Windbg, cant fetch the reason. I check my hex code several times, find no error. The only thing in my eyes that can happen, is a missing syncronic between the 2 cmpxchg. This does not happen on cmpxchg8b, because all memory is blocked during this operation. Here is my last try for the replacement of the ExInterlockedFlushSList .data:004762B2 ; --------------------------------------------------------------------------- .data:004762B2 ; Exported entry 7. ExInterlockedFlushSList .data:004762B2 .data:004762B2 public ExInterlockedFlushSList .data:004762B2 ExInterlockedFlushSList: ; CODE XREF: sub_45F0DF:loc_45F0F7p .data:004762B2 ; DATA XREF: .edata:off_5AC2A8o .data:004762B2 push ebx .data:004762B3 push ebp .data:004762B4 xor ebx, ebx .data:004762B6 mov ebp, ecx .data:004762B8 mov edx, [ebp+4] .data:004762BB mov eax, [ebp+0] .data:004762BE .data:004762BE loc_4762BE: ; CODE XREF: .data:004762D5j .data:004762BE or eax, eax .data:004762C0 jz short loc_4762DA .data:004762C2 mov ecx, edx .data:004762C4 mov cx, bx .data:004762C7 lock cmpxchg [ebp+4], eax .data:004762CC mov ecx, edx .data:004762CE mov edx, ecx .data:004762D0 lock cmpxchg [ebp+0], eax .data:004762D5 jnz short near ptr loc_4762BE+1 .data:004762D7 nop .data:004762D8 nop .data:004762D9 nop .data:004762DA .data:004762DA loc_4762DA: ; CODE XREF: .data:004762C0j .data:004762DA pop ebp .data:004762DB pop ebx .data:004762DC nop .data:004762DD nop .data:004762DE nop .data:004762DF retn .data:004762DF ; --------------------------------------------------------------------------- I put this via relocation to the new address 4762B2. This is in .data section and not in .text section. But this does not matter, because when I put the original Hex code to this new place, it works. The original place at 40B0B2 I fill with 00 00 00.. for to make sure, that now my function at this new place is used. I want to get better in Assembler. No free KI for Assembler in Internet. Do you have an idea @Mov AX, 0xDEAD? Chatgpt, Bard AI and Bing behave like crazy, when it comes to Hex code Dietmar

Hi, I get for few Euro an 486 board with empty Bios battery, Shuttle Hot 433 v1. Oh crazy, I cant boot this compi without this Dallas battery. I come to the idea, to modd the Bios, so that it does not longer wait for CMOS error. From another old compi I put out its Bios chips, because only that chip is an EEprom, can be flashed without crazy UV light. With EEpromer TL 866 Plus I read the Bios out and modd. Now the fresh modded Bios recognices also my oldest 8.4 Gbyte harddisk, before it was not recogniced. For full XP SP3 I need about 1 Gbyte harddisk at minimum. Next problem was, that this board does not recognice my memory, PCI-graphik , mouse. The Isa card now is recogniced with name Trident Super VGA from an i386 compi. Still no mouse. The cache on this board is 256kB. Just now I work with 4 Mb, which was the only stick, that was recogniced until now, brrr.. Win98SE boots, not slow. I add an AMD AM486 DX4-100 SV8T. Oh..crazy to set that millions of jumpers. Something must be wrong in the head of those manufakturers, because for example 6 positions for one Jumper, but sometimes they are counted vertical, sometimes horizontal and sometimes mix. About 40 jumpers. This cpu wants 3 Volt, the board offers ony 3.3 Volt, I choose this. Voila, Win98SE works! XP SP3 will be tomorrow;)).. Dietmar EDIT: The 100MHZ cpu runs hot without any cooler, heatsink or fan. The DX-33 MHZ cpu before does not need a cooler at all. EDIT2: I succeed to install 256 MB of ram on this 486 board. But still no mouse, no working PCI Graphik card. EDIT3: The PCI GT610 graphik card is not recogniced, may be because it offers also HDMI and not only VGA(?!).

Off topic: Soon I make a try to install XP on a i386 cpu, because with real i486 I already succeed. I got an 386 dx-25 board Octek Jaguar II with 32 MB and will report soon Dietmar

I just get my Vobis Highscreen Tower from May 1992 back. New Dallas batterie chip, 486 cpu DX 33 MHZ. With 2x CD-rom, that I bought in 1993. Oh..soso much fun to install XP SP3 there Dietmar

@Damnation Can there be a mixture between halmps and halmacpi Dietmar

@Damnation Break instruction exception - code 80000003 (first chance) nt!KiDispatchInterrupt+0x38d: 804dcbdf f390 pause 1: kd> g Break instruction exception - code 80000003 (first chance) ******************************************************************************* * * * You are seeing this message because you pressed either * * CTRL+C (if you run console kernel debugger) or, * * CTRL+BREAK (if you run GUI kernel debugger), * * on your debugger machine's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the "g" key, then * * press the "Enter" key now. This message might immediately reappear. If it * * does, press "g" and "Enter" again. * * * ******************************************************************************* nt!DbgBreakPointWithStatus+0x4: 804e2a42 cc int 3 0: kd> g *** Fatal System Error: 0x0000007e (0xC0000005,0x00000000,0xF789E168,0xF789DE64) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Thu Feb 29 19:05:36.031 2024 (UTC + 1:00)), ptr64 FALSE Loading Kernel Symbols .............................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, 0, f789e168, f789de64} Probably caused by : NDIS.sys ( NDIS!ndisMQueryNetworkAddress+23 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 804e2a42 cc int 3 11: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 00000000, The address that the exception occurred at Arg3: f789e168, Exception Record Address Arg4: f789de64, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. FAULTING_IP: +1f451c801f451e8 00000000 ?? ??? EXCEPTION_RECORD: f789e168 -- (.exr 0xfffffffff789e168) ExceptionAddress: 00000000 ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000000 Attempt to read from address 00000000 CONTEXT: f789de64 -- (.cxr 0xfffffffff789de64;r) eax=00000000 ebx=80702790 ecx=54445358 edx=00000001 esi=f7472b20 edi=807026c0 eip=00000000 esp=f789e230 ebp=f789e250 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 00000000 ?? ??? Last set context: eax=00000000 ebx=80702790 ecx=54445358 edx=00000001 esi=f7472b20 edi=807026c0 eip=00000000 esp=f789e230 ebp=f789e250 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 00000000 ?? ??? Resetting default scope DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 00000000 READ_ADDRESS: 00000000 FOLLOWUP_IP: NDIS!ndisMQueryNetworkAddress+23 bac63a56 e6ff out 0FFh,al FAILED_INSTRUCTION_ADDRESS: +23 00000000 ?? ??? BUGCHECK_STR: 0x7E ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from 00000000 to 00000000 SYMBOL_ON_RAW_STACK: 1 STACK_ADDR_RAW_STACK_SYMBOL: fffffffff789d9e0 STACK_COMMAND: dps fffffffff789d9e0-0x20 ; kb STACK_TEXT: f789d9c0 6c674a6f f789d9c4 6e666e67 f789d9c8 ee776a67 f789d9cc 6a676a67 f789d9d0 7e647a66 f789d9d4 7b667866 f789d9d8 38063a0e f789d9dc bac63a56 NDIS!ndisMQueryNetworkAddress+0x23 f789d9e0 3a063a06 f789d9e4 3a063206 f789d9e8 91ea67db f789d9ec c37cf2f2 f789d9f0 f1ea779b f789d9f4 e3ff5070 f789d9f8 b1eb67d3 f789d9fc e3fed2f2 f789da00 00008070 f789da04 00000000 f789da08 8071e0fe hal!HalpGetFeatureBits+0x52 [e:\xpsp1\nt\base\hals\halmps\i386\mphal.c @ 1097] f789da0c 00000001 f789da10 f78feb3c f789da14 f78feb38 f789da18 f78feb38 f789da1c 00008070 f789da20 00000000 f789da24 00000000 f789da28 756e6547 f789da2c 49656e69 f789da30 6c65746e f789da34 00d1e300 f789da38 00000000 f789da3c 00000000 SYMBOL_NAME: NDIS!ndisMQueryNetworkAddress+23 FOLLOWUP_NAME: MachineOwner MODULE_NAME: NDIS IMAGE_NAME: NDIS.sys DEBUG_FLR_IMAGE_TIMESTAMP: 48025d03 IMAGE_VERSION: 5.1.2600.5512 FAILURE_BUCKET_ID: 0x7E_NULL_IP_NDIS!ndisMQueryNetworkAddress+23 BUCKET_ID: 0x7E_NULL_IP_NDIS!ndisMQueryNetworkAddress+23 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x7e_null_ip_ndis!ndismquerynetworkaddress+23 FAILURE_ID_HASH: {6cac7e57-f19c-4081-7e29-9f6a6f30cf6b} Followup: MachineOwner ---------

@Damnation nt!KiDispatchInterrupt+0x393: 804dcbe5 3b6d00 cmp ebp,dword ptr [ebp] 11: kd> p nt!KiDispatchInterrupt+0x396: 804dcbe8 740d je nt!KiDispatchInterrupt+0x3a5 (804dcbf7) 11: kd> p nt!KiDispatchInterrupt+0x3a5: 804dcbf7 83bb2801000000 cmp dword ptr [ebx+128h],0 11: kd> p nt!KiDispatchInterrupt+0x3ac: 804dcbfe 74d7 je nt!KiDispatchInterrupt+0x385 (804dcbd7) 11: kd> p Packet failed authentication. Please make sure the host and target encryption keys match exactly. Also make sure you don't have multiple target machines pointed at the same network port on your host. Bad packet sent from 192.168.2.102. Run nslookup 192.168.2.102 from a command prompt to get the machine name. Packet failed authentication. Please make sure the host and target encryption keys match exactly. Also make sure you don't have multiple target machines pointed at the same network port on your host. Bad packet sent from 192.168.2.102. Run nslookup 192.168.2.102 from a command prompt to get the machine name. Packet failed authentication. Please make sure the host and target encryption keys match exactly. Also make sure you don't have multiple target machines pointed at the same network port on your host. Bad packet sent from 192.168.2.102. Run nslookup 192.168.2.102 from a command prompt to get the machine name. nt!KiDispatchInterrupt+0x38d: 804dcbdf f390 pause 10: kd> p

@Damnation This is Bsod surrounding without any breakpoint, Windbg continous with "p", F10, Dietmar https://ufile.io/b5j6aq0z

@Damnation I have your hal.pdb integrated. Now I get this, looks like kind of loop, or if something cant be found Dietmar https://ufile.io/310s052p

@Damnation Next try gives this Dietmar https://ufile.io/tw0rd9vu

@Damnation A first run shows only the same error as you have, that someone tries to write in forbidden memory Dietmar *** Fatal System Error: 0x0000007e (0xC0000005,0x00000000,0xF789E168,0xF789DE64) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Wed Feb 28 18:25:27.820 2024 (UTC + 1:00)), ptr64 FALSE Loading Kernel Symbols .............................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, 0, f789e168, f789de64} Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 804e2a42 cc int 3 11: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 00000000, The address that the exception occurred at Arg3: f789e168, Exception Record Address Arg4: f789de64, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. FAULTING_IP: +150b5800150b78 00000000 ?? ??? EXCEPTION_RECORD: f789e168 -- (.exr 0xfffffffff789e168) ExceptionAddress: 00000000 ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000000 Attempt to read from address 00000000 CONTEXT: f789de64 -- (.cxr 0xfffffffff789de64;r) eax=00000000 ebx=80702790 ecx=54445358 edx=00000001 esi=f7472b20 edi=807026c0 eip=00000000 esp=f789e230 ebp=f789e250 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 00000000 ?? ??? Last set context: eax=00000000 ebx=80702790 ecx=54445358 edx=00000001 esi=f7472b20 edi=807026c0 eip=00000000 esp=f789e230 ebp=f789e250 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 00000000 ?? ??? Resetting default scope DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 00000000 READ_ADDRESS: 00000000 FOLLOWUP_IP: +150b5800150b78 00000000 ?? ??? FAILED_INSTRUCTION_ADDRESS: +150b5800150b78 00000000 ?? ??? BUGCHECK_STR: 0x7E ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from 00000000 to 00000000 STACK_TEXT: f789e22c 00000000 00000000 00000000 f74774fc 0x0 STACK_COMMAND: kb SYMBOL_NAME: ANALYSIS_INCONCLUSIVE FOLLOWUP_NAME: MachineOwner MODULE_NAME: Unknown_Module IMAGE_NAME: Unknown_Image DEBUG_FLR_IMAGE_TIMESTAMP: 0 IMAGE_VERSION: FAILURE_BUCKET_ID: 0x7E_NULL_IP_ANALYSIS_INCONCLUSIVE BUCKET_ID: 0x7E_NULL_IP_ANALYSIS_INCONCLUSIVE ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x7e_null_ip_analysis_inconclusive FAILURE_ID_HASH: {dfedf0b5-2624-ece8-95fa-645295e3260a} Followup: MachineOwner ---------

@Damnation First I make small joke, just replace acpi.sys, halmacpi.dll and ntoskrn8.sys with your version on the XP SP3 Setup xp.iso. But during the "Setup is inspecting your hardware configuration" comes message, that "acpi.sys is damaged". Now I setup with the original files and debug Dietmar

@Damnation Yes, I fixed everything that is possible on the HP 255 g6 board. Now, there is ACPI-Multprocessor with mostly all drivers. A lot of other notebooks boot with the same idea XP SP3 now, which show before Bsod, not direct related to acpi.sys. All those Bsods happen because of their VGA settings in DSDT and their internal VGA cant be disabled via Bios. Now I am just setting up a new XP SP3 on my Asrock z370 k6 board. Without any extra driver, just naked and ready for debug. This is possible, because it can use PS/2 for mouse and keyboard. Then I add your acpi.sys, hal.dll and ntoskrn8.sys. Soon I report Dietmar

Hi, if somebody has interest for the whole ACPI Multiprocessor XP SP3 for the HP 255 g6, just mail me Dietmar EDIT: This image works also for the HP 15-bw000ng. But the Paragon 17 tool has problems with different sizes of harddisks. 1.) Unzip with 7zip all files. 2.) With Rufus 2.18 put the Paragon.iso to an empty USB stick. 3.) After this, copy the Job-202402251402635 (contains the XP SP3 image) to the same USB stick. 4.) Put the USB stick to the HP 255 g6 notebook. Be sure, that the harddisk from the HP 255 g6 is empty or can be formatted with NTFS and MBR. 5.) Boot the HP 255 g6 from this USB stick (F9). 6.) Extract the full ACPI-Multiprocessor XP SP3 image in Job-202402251402635 to this harddisk in the HP 255 g6 via Paragon. Good luck Dietmar

And waaoh, now the HP 255 g6 is soso much faster than before. All videos at youtube in HD without any stopping. Much faster XP SP3 than with win7 SP1 bit 32 or Win10 bit64. Geekbench 2.4 (bit32) shows 2521 points with XP, 2200 with win7 sp1 bit 32 1800 with win10 bit 64 Dietmar

Yesssa, I got it. Now I have 2 entries for processor in Device Manager It belongs to DSDT. In modmodmod DSDT I write now for the shortest possible way for the processor definition Dietmar Scope (_PR) { Processor (C000, 0x00, 0x00000410, 0x06){} Processor (C001, 0x01, 0x00000410, 0x06){} Processor (C002, 0x02, 0x00000410, 0x06){} Processor (C003, 0x03, 0x00000410, 0x06){} }

@Mov AX, 0xDEAD I get everything to work under Acpi Multiprocessor on the HP 255 g6 board. Only one thing I do not understand. Why is only one processor shown in Device Manager. For sure, I make all correct in registry for the other processor also. This AMD E2-9000e is strange, because on Win7 it shows 2 processors but also only 2 threads. The same is true for the Lenovo board with the same XP SP3 as for the HP, with the same AMD E2-9000e cpu. There also 2 processors are shown but also only 2 threads all together via Task Manager. I tried a lot, only one processor is shown, when I start from Standard PC. It seems, that when I use in first place "Standard PC", that at an unknown place is written, that this means only one processor Dietmar

I also succeed with next DSDT mod to setup XP SP3 on the HP 15-bw000ng. Without DSDT mod, XP SP3 shows Bsod Dietmar

Yepp, both devices are in the DSDT from the HP but NOT in the DSDT of the Lenovo. EDIT: Yes, I succeed to integrate the HP PS/2 keyboard and PS/2 mouse into the modded DSDT from Lenovo. There is a driver from HP for XP(!) for this keyboard. And the PS/2 mouse is simply the touchpad. So, still it seems that the reason for Bsod with original HP DSDT is the settings for VGA in its DSDT. Device (KBC0) { Name (_HID, EisaId ("HPQ8001")) // _HID: Hardware ID Name (_CID, EisaId ("PNP0303") /* IBM Enhanced Keyboard (101/102-key, PS/2 Mouse) */) // _CID: Compatible ID Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { IO (Decode16, 0x0060, // Range Minimum 0x0060, // Range Maximum 0x01, // Alignment 0x01, // Length ) IO (Decode16, 0x0064, // Range Minimum 0x0064, // Range Maximum 0x01, // Alignment 0x01, // Length ) IRQNoFlags () {1} }) } Device (PS2M) { Name (_HID, EisaId ("SYN3254")) // _HID: Hardware ID Name (_CID, EisaId ("PNP0F13") /* PS/2 Mouse */) // _CID: Compatible ID Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { IO (Decode16, 0x0060, // Range Minimum 0x0060, // Range Maximum 0x01, // Alignment 0x01, // Length ) IO (Decode16, 0x0064, // Range Minimum 0x0064, // Range Maximum 0x01, // Alignment 0x01, // Length ) IRQNoFlags () {12} }) }

@Mov AX, 0xDEAD @Damnation I take a look via Task Manager. There are 2 Threads. So, this cpu from AMD E2-9000e has one (2?) core with all together 2 threads Dietmar EDIT: Under win7 SP1, there are 2 entries in processor in Device Manager. The same 2 entries for XP SP3 on the Lenovo board with the same E2-9000e cpu. But always only 2 entries for cpu in Taskmanager can be seen. So, my modd of the Registry miss something. I think it happens, because with "Standard PC" you have only always one cpu with one core and one thread. The numbers of processors should be 2 here always, each with one Thread. PS: Still I do not find the reason, why the HP 255 g6 crashes under XP SP3 with its orignial DSDT from HP. Mostly all of the notebooks from HP around 2017-2018 have this problem under XP. Now I think, the reason for this may be the PS/2 keyboard, because I do not find any device for this keyboard, no HID, no USB no PS/2 device under XP. EDIT: The Bsod is not because of this PS/2 keyboard or PS/2 mouse. I edit the Registry of the HP and modd the DSDT from Lenovo as careful as this is possible. On win7 SP1 bit 7 on this HP notebook, the Device Manager tells about the keyboard: PS/2 device: Acpi\HPQ8001 But tells also about an PS/2 mouse with: Acpi\Syn3254 , it is the Touchpad.

@Damnation Look at cpu-z. The AMD cpu E2-9000e has 1 CPU - 2 Core - 2 Threads, whatever this means. But I know, that all from this cpu is working. When I install XP in Standard PC mode (no acpi), a video at youtube cant run at 480 without stopping. Now, nearly no stopping at HD 1080p with the same video Dietmar

Hi, I succeed to install full Acpi Multiprocessor XP SP3 on the HP 255 g6 notebook. I setup a Standard PC XP and put out the harddisk before first reboot. Then I install the modded DSDT from Lenovo and the 4 SSDT tables with the nice DSDT loader at boottime from @Mov AX, 0xDEAD. Oh..now follows a crazy edit of the registry, to change on this after TXT Setup of XP to Acpi Multiprocessor XP. I tried this already in past, always without success. After a lot of hours for this registry edit now I have mouse and XP SP3 to full on this crazy notebook Dietmar

@Andalu @George King This now disabled ALL search for drivers. But I only want, that XP looks via PNP for all the drivers, but no crazy shield Dietmar Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Driver Signing] "Policy"=hex:00 [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching] "DontSearchWindowsUpdate"=dword:00000001 "DontPromptForWindowsUpdate"=dword:00000001 "DontSearchFloppies"=dword:00000001 "DontSearchCD"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings] "SuppressNewHWUI"=dword:00000001 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PlugPlay\Parameters] "SuppressNewHWUI"=dword:00000001 "SuppressUI"=dword:00000001

@Andalu Now, this shield changes a little. It now asks me, for a hardware component "unknown" and only 2 places I can choose, if I want to look on CD or Floppy Dietmar

@Andalu I tried this, but it does not work. Still the shield from Assistent of Device Manager appears Dietmar