I'm not able to extract the VGA BIOS from phoenix BIOS

[Joop Boonen]

Hello All,

I have the Arima HDAMA server.
The BIOS can be found here:
http://www.arimacorp.com/server/Product/ViewDownload.asp?View=HDAMA%20rev.G

I want to extract the VGA.ROM but I can succeed.
I have been following this instruction:
http://www.coreboot.org/VGA_support

When I execute this command: cat /proc/iomem | grep 'Video ROM'

Nothing is returned. When i check via command: cat /proc/iomem
I also don't see anything that is related to the display.

I have a feeling that the reason why I don't see anything is because the
VGA BIOS option ROM isn't loaded in RAM?

I've also tried the phnxdeco tool. I don't see any modules that can be
extracted when I use this tool.

phnxdeco hdmag217.rom -l

-=PhoenixDeco, version 0.33 (Linux)=-

Filelength : 80786 (526214 bytes)
Filename : hdmag217.rom
PhoenixBIOS hook found at : 77500
System Information at : 77526
BootBlock : 8000 bytes
BankSize : 512 KB
Version : DEVEL4E0
Start : 200000715E1
Offset : 70000
BCP Modules : 23
BCPFCP : 7CA53
FCP 1st module : 9485 (79485)
Released : �=@ at 14:37:39
/* Copyrighted Information */
NAPI
/* ----------------------- */
+------------------------------------------------------------------------------+
| Class.Instance (Name) Packed ---> Expanded Compression Offset |
+------------------------------------------------------------------------------+

Total Sections: 0

Can someone help me to find a way de extract the VGA ROM of this main board?

Regards,

Joop.

[Joop Boonen]

On 04/29/2010 01:55 AM, Joop Boonen wrote:
> Hello All,
>
> I have the Arima HDAMA server.
> The BIOS can be found here:
> http://www.arimacorp.com/server/Product/ViewDownload.asp?View=HDAMA%20rev.G
>
> I want to extract the VGA.ROM but I can succeed.
> I have been following this instruction:
> http://www.coreboot.org/VGA_support
>
> When I execute this command: cat /proc/iomem | grep 'Video ROM'
>
> Nothing is returned. When i check via command: cat /proc/iomem
> I also don't see anything that is related to the display.
>
> I have a feeling that the reason why I don't see anything is because the
> VGA BIOS option ROM isn't loaded in RAM?
>
> I've also tried the phnxdeco tool. I don't see any modules that can be
> extracted when I use this tool.
>
> phnxdeco hdmag217.rom -l
>
> -=PhoenixDeco, version 0.33 (Linux)=-
>
> Filelength : 80786 (526214 bytes)
> Filename : hdmag217.rom
> PhoenixBIOS hook found at : 77500
> System Information at : 77526
> BootBlock : 8000 bytes
> BankSize : 512 KB
> Version : DEVEL4E0
> Start : 200000715E1
> Offset : 70000
> BCP Modules : 23
> BCPFCP : 7CA53
> FCP 1st module : 9485 (79485)
> Released : �=@ at 14:37:39
> /* Copyrighted Information */
> NAPI
> /* ----------------------- */
> +------------------------------------------------------------------------------+
> | Class.Instance (Name) Packed ---> Expanded Compression Offset |
> +------------------------------------------------------------------------------+
>
> Total Sections: 0
>
> Can someone help me to find a way de extract the VGA ROM of this main board?

I've been looking into this issue a bit more.

When I look at the output of lspci I get:
00:06.0 PCI bridge: Advanced Micro Devices [AMD] AMD-8111 PCI (rev 07)
00:07.0 ISA bridge: Advanced Micro Devices [AMD] AMD-8111 LPC (rev 05)
00:07.1 IDE interface: Advanced Micro Devices [AMD] AMD-8111 IDE (rev 03)
00:07.3 Bridge: Advanced Micro Devices [AMD] AMD-8111 ACPI (rev 05)
00:0a.0 PCI bridge: Advanced Micro Devices [AMD] AMD-8131 PCI-X Bridge
(rev 12)
00:0a.1 PIC: Advanced Micro Devices [AMD] AMD-8131 PCI-X IOAPIC (rev 01)
00:0b.0 PCI bridge: Advanced Micro Devices [AMD] AMD-8131 PCI-X Bridge
(rev 12)
00:0b.1 PIC: Advanced Micro Devices [AMD] AMD-8131 PCI-X IOAPIC (rev 01)
00:18.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
HyperTransport Technology Configuration
00:18.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
Address Map
00:18.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
DRAM Controller
00:18.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
Miscellaneous Control
00:19.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
HyperTransport Technology Configuration
00:19.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
Address Map
00:19.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
DRAM Controller
00:19.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron]
Miscellaneous Control
01:00.0 USB Controller: Advanced Micro Devices [AMD] AMD-8111 USB OHCI
(rev 0b)
01:00.1 USB Controller: Advanced Micro Devices [AMD] AMD-8111 USB OHCI
(rev 0b)
01:06.0 VGA compatible controller: ATI Technologies Inc Rage XL (rev 27)
02:03.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5702X
Gigabit Ethernet (rev 02)
02:04.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5702X
Gigabit Ethernet (rev 02)
02:05.0 RAID bus controller: Silicon Image, Inc. SiI 3114
[SATALink/SATARaid] Serial ATA Controller (rev 02)

I see that the VGA card is using slot 01:06.0

In the output of cat /proc/iomem I can see this slot numer 3 times? So I
wonder if one of these if the VGA location if so which one is the real
one i.e. the one I need?

00000000-0000ffff : reserved
00010000-0009abff : System RAM
0009ac00-0009ffff : reserved
000ce000-000fffff : reserved
00100000-fbf5ffff : System RAM
  01000000-0155f332 : Kernel code
  0155f333-019bcecf : Kernel data
  01abc000-01c4bf6f : Kernel bss
fbf60000-fbf71fff : ACPI Tables
fbf72000-fbf7ffff : ACPI Non-volatile Storage
fbf80000-fbffffff : reserved
fc000000-fc000fff : IOAPIC 1
  fc000000-fc000fff : 0000:00:0a.1
fc001000-fc001fff : IOAPIC 2
  fc001000-fc001fff : 0000:00:0b.1
fc100000-fdffffff : PCI Bus 0000:01
  fc100000-fc100fff : 0000:01:00.0
    fc100000-fc100fff : ohci_hcd
  fc101000-fc101fff : 0000:01:00.1
    fc101000-fc101fff : ohci_hcd
  fc102000-fc102fff : 0000:01:06.0
  fd000000-fdffffff : 0000:01:06.0
    fd000000-fd7effff : vesafb
fe000000-fe0fffff : PCI Bus 0000:02
  fe000000-fe00ffff : 0000:02:03.0
    fe000000-fe00ffff : tg3
  fe010000-fe01ffff : 0000:02:04.0
    fe010000-fe01ffff : tg3
  fe020000-fe0203ff : 0000:02:05.0
    fe020000-fe0203ff : sata_sil
fe100000-fe1fffff : PCI Bus 0000:01
  fe100000-fe11ffff : 0000:01:06.0
fe200000-fe2fffff : PCI Bus 0000:02
  fe200000-fe27ffff : 0000:02:05.0
  fe280000-fe28ffff : 0000:02:03.0
  fe290000-fe29ffff : 0000:02:04.0
fec00000-fec00fff : IOAPIC 0
  fec00000-fec003ff : reserved
fee00000-fee00fff : Local APIC
  fee00000-fee00fff : reserved
ff780000-ff7fffff : pnp 00:05
fff80000-ffffffff : reserved
  fff80000-ffffffff : pnp 00:05
> Regards,
>
> Joop.

I'm not able to extract the VGA BIOS from phoenix BIOS

[Peter Stuge]

Joop Boonen wrote:
> 01:06.0 VGA compatible controller: ATI Technologies Inc Rage XL (rev 27)
>
> I see that the VGA card is using slot 01:06.0

lspci -vs 1:6

If it has a ROM on it you should be able to read it out. (Note that
the address reported by lspci may actually not be correct, I don't
know why, but you may need to read the expansion rom BAR directly
to get the correct address: (I thought this is what lspci does, but no)

setpci -s 1:6 30.l

Then mmap /dev/mem (see flashrom physmap.c for an example) and read
out the block. I hacked up something to do this a few weeks ago, let
me know if you want it.

//Peter

I'm not able to extract the VGA BIOS from phoenix BIOS

[Joop Boonen]

On Thu, April 29, 2010 2:32 am, Peter Stuge wrote:
> Joop Boonen wrote:
> > 01:06.0 VGA compatible controller: ATI Technologies Inc Rage XL (rev 27)
> >
> > I see that the VGA card is using slot 01:06.0
>
> lspci -vs 1:6
>
> If it has a ROM on it you should be able to read it out. (Note that
> the address reported by lspci may actually not be correct, I don't
> know why, but you may need to read the expansion rom BAR directly
> to get the correct address: (I thought this is what lspci does, but no)
>
> setpci -s 1:6 30.l
>
> Then mmap /dev/mem (see flashrom physmap.c for an example) and read
> out the block. I hacked up something to do this a few weeks ago, let
> me know if you want it.

Can I please have the hacked code, than I can test it.
> //Peter

I'm not able to extract the VGA BIOS from phoenix BIOS

[Peter Stuge]

Joop Boonen wrote:
> > If it has a ROM on it you should be able to read it out. (Note that
> > the address reported by lspci may actually not be correct, I don't
> > know why, but you may need to read the expansion rom BAR directly
> > to get the correct address: (I thought this is what lspci does, but no)
> >
> > setpci -s 1:6 30.l
> >
> > Then mmap /dev/mem (see flashrom physmap.c for an example) and read
> > out the block. I hacked up something to do this a few weeks ago, let
> > me know if you want it.
>
> Can I please have the hacked code, than I can test it.

As was already pointed out, since you have the option ROM for the
graphics card in your regular BIOS image, you don't need to do this
anymore, but here's the tool anyway: http://stuge.se/physrd.c

//Peter

[Stefan Reinauer]

On 4/29/10 1:55 AM, Joop Boonen wrote:
> Hello All,
>
> I have the Arima HDAMA server.
> The BIOS can be found here:
> http://www.arimacorp.com/server/Product/ViewDownload.asp?View=HDAMA%20rev.G

I suggest you try Luc Verhaegen's cool bios_extract utility instead. You
will find it in his git repository:
http://cgit.freedesktop.org/~libv/bios_extract/

What might help is to do
$ dd if=hdamg217.rom of=hdama.rom bs=512k count=1

This cuts away the Phoenix BIOS flash description at the end and leaves
you with the image only.

I tried with the latest version of bios_extract and applied the
following patch, and I was able to extract all modules:

diff --git a/bios_extract.c b/bios_extract.c
index cd87ee8..8fe2fed 100644
--- a/bios_extract.c
+++ b/bios_extract.c
@@ -90,6 +90,7 @@ static struct {
     {"AMIEBBLK", "AMIBIOSC", AMI95Extract},
     {"Award BootBlock", "= Award Decompression Bios =", AwardExtract},
     {"Phoenix FirstBIOS", "BCPSEGMENT", PhoenixExtract},
+    {"Phoenix ServerBIOS", "BCPSEGMENT", PhoenixExtract},
     {"PhoenixBIOS 4.0", "BCPSEGMENT", PhoenixExtract},
     {"Phoenix TrustedCore", "BCPSEGMENT", PhoenixTrustedExtract},
     {NULL, NULL, NULL},

./bios_extract hdama.rom
Using file "hdama.rom" (512kB)
Found Phoenix BIOS "Phoenix ServerBIOS 3 Release 6.0     "
Version "DEVEL4E0", created on 03/20/06 at 14:37:39.
0x715FC ( 27134 bytes)   ->   romexec_0.rom
0x6E1CB ( 13338 bytes)   ->   strings_0.rom    (29401 bytes)
0x6D65D (  2899 bytes)   ->   display_0.rom    (4128 bytes)
0x6B62E (  8208 bytes)   ->   update_0.rom
0x6B1E3 (  1072 bytes)   ->   decompcode_0.rom             [0x5000:0xB6D0]
0x6564F ( 23421 bytes)   ->   oprom_0.rom    (36864 bytes)
0x65608 (    44 bytes)   ->   tcpa_H_0.rom    (32 bytes)
0x65592 (    91 bytes)   ->   acpi_1.rom    (116 bytes)
0x65519 (    94 bytes)   ->   acpi_2.rom    (244 bytes)
0x654ED (    13 bytes)   ->   tcpa_*_0.rom
0x64D4F (  1927 bytes)   ->   bioscode_0.rom    (31382 bytes)   
 [0xF000:0x856A]
0x60020 ( 19728 bytes)   ->   romexec_1.rom
0x570D9 ( 36656 bytes)   ->   oprom_1.rom    (61440 bytes)
0x4DB9D ( 38177 bytes)   ->   oprom_2.rom    (63488 bytes)
0x46493 ( 30447 bytes)   ->   oprom_3.rom    (65536 bytes)
0x41DAB ( 18125 bytes)   ->   logo_0.rom    (310162 bytes)
0x39CA5 ( 25439 bytes)   ->   oprom_4.rom    (51200 bytes)
0x36005 ( 15493 bytes)   ->   setup_0.rom    (37682 bytes)
0x325D7 ( 14867 bytes)   ->   template_0.rom    (37728 bytes)
0x2FA36 ( 11142 bytes)   ->   miser_0.rom    (16208 bytes)
0x2E63C (  5087 bytes)   ->   tcpa_Q_0.rom    (16096 bytes)
0x2D7C3 (  3678 bytes)   ->   acpi_0.rom    (10464 bytes)
0x1FA2A ( 41023 bytes)   ->   bioscode_1.rom    (56080 bytes)   
 [0xE000:0x40F0]
0x14FE0 ( 43567 bytes)   ->   bioscode_2.rom    (62416 bytes)   
 [0x6000:0xCC30]
0x0EB4C ( 25721 bytes)   ->   bioscode_3.rom    (36976 bytes)   
 [0x6000:0x3BC0]
0x0D0A0 (  6801 bytes)   ->   bioscode_4.rom    (31856 bytes)   
 [0x5000:0xBF50]

Then I used "romheaders" from the FCode Suite:
http://www.openfirmware.info/FCODE_suite to check the resulting
oprom_?.rom files and found the first one is it:

$ romheaders oprom_0.rom

Image 1:
PCI Expansion ROM Header:
  Signature: 0x55aa (Ok)
  CPU unique data: 0x48 0xeb 0x7b 0x01 0x76 0x00 0x00 0x00
                   0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
  Pointer to PCI Data Structure: 0x017c

PCI Data Structure:
  Signature: 0x50434952 'PCIR' (Ok)
  Vendor ID: 0x1002
  Device ID: 0x4752
  Vital Product Data:  0x0000
  PCI Data Structure Length: 0x0018 (24 bytes)
  PCI Data Structure Revision: 0x00
  Class Code: 0x030000 (VGA Display controller)
  Image Length: 0x0048 blocks (36864 bytes)
  Revision Level of Code/Data: 0x0421
  Code Type: 0x00 (Intel x86)
  Last-Image Flag: 0x80 (last image in rom)
  Reserved: 0x0000

Platform specific data for x86 compliant option rom:
  Initialization Size: 0x48 (36864 bytes)
  Entry point for INIT function: 0x80

Stefan