Boots from PCI add-on card on Intel ICHs

[Kyösti Mälkki]

Hi

I did not find this method of bypassing the mainboard flash chip and
booting from PCI add-on card documented or discussed before. The nice
think in this is that neither mainboard or its flash needs to be
modified. Good news in the case of a soldered flash and this method may
work with mini-PCI slots on laptops too.

For pre-ICH6 the key is in subtractive PCI decode. This has been
supported in 82801 chipset from the early days and is briefly documented
in ICH3 datasheet [1], see 5.1.1. PCI Bus interface. This decode mode is
on by default and there is no documentation of a hw bootstrap that could
disable it.

For ICH7 onwards there are HW bootstraps to select between LPC/SPI/PCI.
If you don't know where the bootstraps are, go with SPI and forget about
this PCI add-on boot.

To try this, I have modified a PCI PATA-RAID card as follows: I cut the
PCI RST# signal from card edge to controller, put a jumper to close it
for normal boots and placed a weak 10kOhm pull-up to Vio on the chip
side.

With this I have succesfully done the following on a ICH4 based
mainboard:

1. I built SerialICE as usual and programmed the option ROM of the
modified PCI card with it.

2. I set the PCI config BAR for that option ROM as 0xfffe0000. I had
this hacked in flashrom, setpci might work as well. This was 128kB
region while my flash was actually 64kB.

3. Reset the machine, but not the PCI card. I simply removed the jumper
on the RST# signal on the PCI card before giving reboot command.

4. I got into SerialICE prompt.

Should go without saying: Code run from option ROM must not switch from
subtractive to positive PCI decode. I also think the PCI slot used must
be directly on the southbridge PCI bus and not behind some other PCI
bridge.

To use this on cold boots and as a recovery method some means to default
that config BAR for option ROM on cold power-on is required. Custom PCI
FPGA can do that for sure, other ideas are welcome.

Kyösti

[1]
http://www.intel.com/content/dam/doc/datasheet/82801ca-io-controller-hub-3-d...

[Rudolf Marek]

Hi,

Cutting PCI reset is clever. I know SBxxx from AMD tend to have ROMCS (AD24 pin) 
signal routed to B14 of PCI connector. SB 820 manual:

Enable ROM Straps to select ROM type
0V ­ Reserved **
3.3V ­ Required setting (use ROMTYPE straps to
determine the ROM type)
**Note: Strap option was originally for booting
from PCI memory; the feature is not supported, as
it has not been productized.

Not sure how it works on SB600/SB700 will check evening.

Thanks
Rudolf

[ron minnich]

On Sun, May 20, 2012 at 1:23 AM, Kyösti Mälkki  wrote:
> Hi
>
> I did not find this method of bypassing the mainboard flash chip and
> booting from PCI add-on card documented or discussed before.

Maybe I misunderstand, but this is how Etherboot originally worked:
flash a new expansion rom onto, e.g., a 3c905 and that could take over
the boot process.

ron

[Kyösti Mälkki]

On Sun, 2012-05-20 at 11:23 +0300, Kyösti Mälkki wrote:
> Hi
>
> I did not find this method of bypassing the mainboard flash chip and
> booting from PCI add-on card documented or discussed before. The nice
> think in this is that neither mainboard or its flash needs to be
> modified. Good news in the case of a soldered flash and this method may
> work with mini-PCI slots on laptops too.
>
> For pre-ICH6 the key is in subtractive PCI decode. This has been
> supported in 82801 chipset from the early days and is briefly documented
> in ICH3 datasheet [1], see 5.1.1. PCI Bus interface. This decode mode is
> on by default and there is no documentation of a hw bootstrap that could
> disable it.

Above is not accurate, ICH6 has hardware bootstrap.
> For ICH7 onwards there are HW bootstraps to select between LPC/SPI/PCI.
> If you don't know where the bootstraps are, go with SPI and forget about
> this PCI add-on boot.

The bootstrap is latched on power cycle, but not PCI reset, and the
config bit is writeable. So if one has a booting system it should be
possible to switch to PCI add-on for next reboot. The setting will
default back to mainboard flash after power-cycle.

Note that "hard/cold" reboot is required to toggle the PCI RST#. If
vendor BIOS does set the write-protection lock bit, it should be cleared
on PCI RST#. At least for ICH4 that is the case.

Kyösti