[coreboot] Boots from PCI add-on card on Intel ICHs

[Kyösti Mälkki]

Hi

I did not find this method of bypassing the mainboard flash chip and
booting from PCI add-on card documented or discussed before. The nice
think in this is that neither mainboard or its flash needs to be
modified. Good news in the case of a soldered flash and this method may
work with mini-PCI slots on laptops too.

For pre-ICH6 the key is in subtractive PCI decode. This has been
supported in 82801 chipset from the early days and is briefly documented
in ICH3 datasheet [1], see 5.1.1. PCI Bus interface. This decode mode is
on by default and there is no documentation of a hw bootstrap that could
disable it.

For ICH7 onwards there are HW bootstraps to select between LPC/SPI/PCI.
If you don't know where the bootstraps are, go with SPI and forget about
this PCI add-on boot.


To try this, I have modified a PCI PATA-RAID card as follows: I cut the
PCI RST# signal from card edge to controller, put a jumper to close it
for normal boots and placed a weak 10kOhm pull-up to Vio on the chip
side.

With this I have succesfully done the following on a ICH4 based
mainboard:

1. I built SerialICE as usual and programmed the option ROM of the
modified PCI card with it.

2. I set the PCI config BAR for that option ROM as 0xfffe0000. I had
this hacked in flashrom, setpci might work as well. This was 128kB
region while my flash was actually 64kB.

3. Reset the machine, but not the PCI card. I simply removed the jumper
on the RST# signal on the PCI card before giving reboot command.

4. I got into SerialICE prompt.


Should go without saying: Code run from option ROM must not switch from
subtractive to positive PCI decode. I also think the PCI slot used must
be directly on the southbridge PCI bus and not behind some other PCI
bridge.

To use this on cold boots and as a recovery method some means to default
that config BAR for option ROM on cold power-on is required. Custom PCI
FPGA can do that for sure, other ideas are welcome.


Kyösti

[1]
http://www.intel.com/content/dam/doc/datasheet/82801ca-io-controller-hub-3-datasheet.pdf