Hacking Award BIOS to disable onboard video

Only for programmers and BIOS gurus with technical questions.
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Sat Jun 12, 2004 6:21 am

Could somebody please help me disable my onboard video through BIOS code tweaking?

I have tried the following, but did not work:
a) Setting PCI vs. AGP in CMOS setup,
b) Disabling onboard vga through the Operating System.

Other details:
a) BIOS --- Award V6PG
b) No option to disable onboard video in motherboard, and in BIOS setup
c) I want to use my PCI VGA Card to improve system performance
d) No AGP slot
e) SIS 630E chipset, Pentium 3 processor
f) When my PCI VGA Card is inserted, my sytem couldn't boot and no video, no beeps, no flopy access. So I thought it could have been the bios vga initialization routine that needs to be patched, but I just don't know how.
edwin
The Hardware Archivist
Posts: 6227
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

Sat Jun 19, 2004 2:10 pm

Umm, just a simple question but have you tried the VGA card in an other system to see if it even works?
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Ritchie
BIOS Guru
Posts: 761
Joined: Wed Oct 30, 2002 5:17 am

Sun Jun 20, 2004 3:46 am

If the card does work well in another system, as per Edwin's suggestion, you may have a board where disabling on on-board video to prevent use of an add-on VGA card is not allowed. If there is no AGP slot, as you have said, I would be suspect of this being the case.
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Sun Jun 20, 2004 4:09 am

My add-on video card is PCI-based, not AGP. And my board doesn't have an AGP slot.

Had this PCI VGA Card tested before I bought it, and it was automatically detected and was functional on WinXP Pro (but this test board has no onboard video).

Lately, this PCI VGA Card of mine has been detected in my board when I hacked the BIOS ROM to set the defaults of "Init Display..." to AGP, and I had no more problems booting up and loading WinXP Pro and Win98SE. But it appeared with a yellow exclamation mark under Device Manager, and did not work even after disabling onboard vga and installing the latest driver for this ATI 3D Rage Pro Turbo PCI Card.

So it confirmed my suspicion that the onboard vga initialization routine in the BIOS has to be patched to prevent calling the onboard vga initialization routine, and instead initiate PCI read/write intialization for the add-on card. But I don't know how to do this. Please help.
maman
Master Flasher
Posts: 173
Joined: Sun Mar 31, 2002 2:08 pm
Location: Taka Bonerate National Park, Indonesia
Contact:

Sun Jun 20, 2004 7:42 am

I've just began dissecting it. I'm looking forward the part which programs the PCI to PCI Bridge. This is where the choice of using PCI or AGP VGA card done. I found it on my BIOS (yours haven't yet coz I've just receive it :( ), it looks like below :

Code: Select all

F000:C0AF                            copy_VGA_ROM_2_RAM proc near ; CODE XREF: F000:F954p
F000:C0AF E8 AB 00                       call chk_Video_ROM_sign ; check 0AA55h signature
F000:C0B2 0F 84 76 00                    db 0Fh,84h,76h,0 ; <BAD>jz  video_ROM_sign_match ; sign match
F000:C0B6 E8 B0 00                       call scan_PCI_for_VGA ; Call Procedure
F000:C0B9 0F 83 21 00                    db 0Fh,83h,21h,0 ; <BAD>jnb VGA_found_in_PCI ; jmp if VGA found
F000:C0BD B8 09 B1                       mov ax, 0B109h
F000:C0C0 BB 08 00                       mov bx, 8           ; PCI bus #0 dev #1
F000:C0C3 BF 0A 00                       mov di, 0Ah         ; offset 0Ah
F000:C0C6 CD 1A                          int 1Ah
F000:C0C8 81 F9 04 06                    cmp cx, 604h        ; is it PCI bridge ?
F000:C0CC 75 09                          jnz not_PCI_bridge  ; not pci bridge
F000:C0CE BB 08 00                       mov bx, 8           ; PCI bus #0 dev #1 (PCI2PCI bridge)
F000:C0D1 BE 2F C1                       mov si, 0C12Fh      ; PCI2PCI bridge config words addr
F000:C0D4 E8 1F 01                       call PCI_write_config_words ; Call Procedure
F000:C0D7                            
F000:C0D7                            not_PCI_bridge:         ; CODE XREF: copy_VGA_ROM_2_RAM+1Dj
F000:C0D7 E8 8F 00                       call scan_PCI_for_VGA ; Call Procedure
F000:C0DA 0F 82 4E 00                    db 0Fh,82h,4Eh,0 ; <BAD>jb  video_ROM_sign_match ; VGA not found
F000:C0DE                            
F000:C0DE                            VGA_found_in_PCI:       ; CODE XREF: copy_VGA_ROM_2_RAM+Aj
F000:C0DE 53                             push bx             ; bx=PCI_bus_dev_func (from scan_PCI above)
F000:C0DF E8 AF 00                       call init_PCI_base_addr_reg ; Call Procedure
F000:C0E2 BE 53 C1                       mov si, 0C153h      ; Base_Addr_Register words and offset addr
F000:C0E5 E8 0E 01                       call PCI_write_config_words ; set BaseAddrReg to F000 0000h
F000:C0E8 E8 ED 0E                       call init_video_shadow_RAM ; Call Procedure
F000:C0EB FA                             cli                 ; Clear Interrupt Flag
F000:C0EC 2E 0F 01 16 F6 E4              lgdt cs:GDT_FE4F6   ; Load Global Descriptor Table Register
F000:C0F2 0F 20 C0                       mov eax, cr0
F000:C0F5 0C 01                          or  al, 1           ; set PMode bit
F000:C0F7 0F 22 C0                       mov cr0, eax
F000:C0FA EB 00                          jmp short $+2       ; jump to PMode ?
F000:C0FC B8 08 00                       mov ax, 8
F000:C0FF 8E D8                          mov ds, ax          ; ds = cs
F000:C101 8E C0                          mov es, ax          ; es = cs
F000:C103                                assume es:nothing
F000:C103 66 BE 00 00 00 F0              mov esi, 0F0000000h ; point to VGA ROM addr
F000:C109 67 81 3E 55 AA                 cmp word ptr [esi], 0AA55h ; check VGA ROM signature
F000:C10E 75 11                          jnz video_ROM_init_done ; Jump if Not Zero (ZF=0)
F000:C110 66 BF 00 00 0C 00              mov edi, 0C0000h    ; mem at addr C0000h (C000:0000h)
F000:C116 66 B9 00 40 00 00              mov ecx, 4000h      ; copy 64 KByte VGA ROM to RAM
F000:C11C FC                             cld                 ; Clear Direction Flag
F000:C11D 67 F3 66 A5                    rep movs dword ptr es:[edi], dword ptr [esi] ; copy to RAM
F000:C121                            
F000:C121                            video_ROM_init_done:    ; CODE XREF: copy_VGA_ROM_2_RAM+5Fj
F000:C121 5B                             pop bx
F000:C122 0F 20 C0                       mov eax, cr0
F000:C125 24 FE                          and al, 0FEh        ; clear PMode flag
F000:C127 0F 22 C0                       mov cr0, eax
F000:C12A EB 00                          jmp short $+2       ; jmp to RealMode
F000:C12C                            
F000:C12C                            video_ROM_sign_match:   ; CODE XREF: copy_VGA_ROM_2_RAM+3j
F000:C12C                                                    ; copy_VGA_ROM_2_RAM+2Bj
F000:C12C 8B C3                          mov ax, bx
F000:C12E C3                             retn                ; Return Near from Procedure
F000:C12E                            copy_VGA_ROM_2_RAM endp
F000:C12E                            
F000:C12E                            ; ---------------------------------------------------------------------------
F000:C12F                            Begin_PCI2PCI_bridge_config_words
F000:C12F 18                             db 18h              ; reg 18h, primary, secondary bus number
F000:C130 00 01                          dw 100h
F000:C132 1A                             db  1Ah ;           ; reg 1Ah, subordinate bus number
F000:C133 01 40                          dw 4001h
F000:C135 1C                             db  1Ch ;           ; reg 1Ch=I/O base, reg 1D=I/O limit
F000:C136 D0 D0                          dw 0D0D0h
F000:C138 20                             db  20h ;           ; reg 21h-20h memory base
F000:C139 00 F0                          dw 0F000h           ; set memory base to F000h
F000:C13B 22                             db  22h ; "         ; reg 23h-22h memory limit
F000:C13C 00 FC                          dw 0FC00h           ; set memory limit to FC00h
F000:C13E 24                             db  24h ; $         ; reg 24h, prefetchable memory base
F000:C13F F0 FF                          dw 0FFF0h
F000:C141 26                             db  26h ; &
F000:C142 00 00                          dw 0
F000:C144 3E                             db  3Eh ; >         ; ref 3Fh-3Eh PCI-PCI bridge control
F000:C145 0B 00                          dw 0Bh              ; VGA present on AGP. Don't fwd IO access --- THIS NEED TO BE CHANGED
F000:C145                                                    ; that are in 100h-3FFh addr range
F000:C147 04                             db    4 ;           ; reg 4h-5h
F000:C148 03 00                          dw 3                ; enable IO space and memory space
F000:C14A 00                             db    0 ;  
F000:C14A                            End_PCI2PCI_bridge_config_words
F000:C14A                            
F000:C14B                            Begin_PCI_class_code
F000:C14B 00 03                          dw 300h
F000:C14D 01 03                          dw 301h
F000:C14F 01 00                          dw 1
F000:C151 00 00                          dw 0                ; termination sign
F000:C151                            End_PCI_class_code
F000:C151                            
F000:C153                            Begin_Base_Addr_Reg_values
F000:C153 30                             db  30h ; 0         ; XROMBAR register addr
F000:C154 01 00                          dw 1                ; enable Expansion ROM
F000:C156 32                             db  32h ; 2         ; XROMBAR reg 32 & 33
F000:C157 00 F0                          dw 0F000h           ; set base addr hi word to F000h
F000:C159 04                             db    4 ;           ; command reg addr
F000:C15A 03 00                          dw 3                ; enable IO space & Memory space access
F000:C15C 00                             db    0 ;  
F000:C15C                            End_Base_Addr_Reg_values
F000:C15D                            
F000:C15D                            ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
F000:C15D                            
F000:C15D                            
F000:C15D                            chk_Video_ROM_sign proc near
F000:C15D                                                    ; CODE XREF: copy_VGA_ROM_2_RAMp
F000:C15D B8 00 C0                       mov ax, 0C000h
F000:C160 8E D8                          mov ds, ax          ; ds = C000h
F000:C162                                assume ds:nothing
F000:C162 81 3E 00 00 55 AA              cmp word ptr ds:0, 0AA55h ; Compare Two Operands
F000:C168 C3                             retn                ; Return Near from Procedure
F000:C168                            chk_Video_ROM_sign endp
F000:C168                            
F000:C169                            
F000:C169                            ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
F000:C169                            
F000:C169                            
F000:C169                            scan_PCI_for_VGA proc near
F000:C169                                                    ; CODE XREF: copy_VGA_ROM_2_RAM+7p
F000:C169                                                    ; copy_VGA_ROM_2_RAM+28p
F000:C169 BF 4B C1                       mov di, 0C14Bh      ; PCI class codes to find addr
F000:C16C                            
F000:C16C                            chk_PCI_dev:            ; CODE XREF: scan_PCI_for_VGA+22j
F000:C16C 66 33 C9                       xor ecx, ecx        ; ecx = 0h
F000:C16F 2E 8B 0D                       mov cx, cs:[di]     ; at 1st cx=300h (VGA disp cntlr cls code)
F000:C172 83 F9 00                       cmp cx, 0           ; do we finished ? (00h = termination sign)
F000:C175 74 18                          jz  pci_scan_finished ; Jump if Zero (ZF=1)
F000:C177 66 C1 E1 08                    shl ecx, 8          ; ecx = class code to find
F000:C17B B8 03 B1                       mov ax, 0B103h      ; Find PCI class code
F000:C17E 33 F6                          xor si, si          ; si = 0000h, si = device index
F000:C180 CD 1A                          int 1Ah
F000:C182 80 FC 86                       cmp ah, 86h         ; device not found ?
F000:C185 90                             nop                 ; No Operation
F000:C186 75 05                          jnz VGA_found       ; device found
F000:C188 83 C7 02                       add di, 2           ; next word
F000:C18B EB DF                          jmp short chk_PCI_dev ; Jump
F000:C18D                            ; ---------------------------------------------------------------------------
F000:C18D                            
F000:C18D                            VGA_found:              ; CODE XREF: scan_PCI_for_VGA+1Dj
F000:C18D F8                             clc                 ; clear carry on VGA found
F000:C18E C3                             retn                ; Return Near from Procedure
F000:C18F                            ; ---------------------------------------------------------------------------
F000:C18F                            
F000:C18F                            pci_scan_finished:      ; CODE XREF: scan_PCI_for_VGA+Cj
F000:C18F F9                             stc                 ; set carry on vga not found
F000:C190 C3                             retn                ; Return Near from Procedure
F000:C190                            scan_PCI_for_VGA endp
F000:C190
..............
..............
F000:C1F6                            
F000:C1F6                            PCI_write_config_words proc near
F000:C1F6                                                    ; CODE XREF: copy_VGA_ROM_2_RAM+25p
F000:C1F6                                                    ; copy_VGA_ROM_2_RAM+36p ...
F000:C1F6 2E 0F B6 3C                    movzx di, byte ptr cs:[si] ; Move with Zero-Extend
F000:C1FA 0B FF                          or  di, di          ; di=offset addr. Termination byte is 00h
F000:C1FC 74 14                          jz  PCI_write_config_word_done ; Jump if Zero (ZF=1)
F000:C1FE B4 B1                          mov ah, 0B1h
F000:C200 B0 0C                          mov al, 0Ch         ; ax = B10Ch
F000:C202 2E 8B 4C 01                    mov cx, cs:[si+1]   ; write the words pointed by cs:[si+1]
F000:C206 CD 1A                          int 1Ah
F000:C208 80 FC 00                       cmp ah, 0           ; successful ?
F000:C20B 75 06                          jnz PCI_write_config_word_failed ; Jump if Not Zero (ZF=0)
F000:C20D 83 C6 03                       add si, 3           ; advance to next offset and words
F000:C210 EB E4                          jmp short PCI_write_config_words ; Jump
F000:C212                            ; ---------------------------------------------------------------------------
F000:C212                            
F000:C212                            PCI_write_config_word_done:
F000:C212                                                    ; CODE XREF: PCI_write_config_words+6j
F000:C212 C3                             retn                ; Return Near from Procedure
F000:C213                            ; ---------------------------------------------------------------------------
F000:C213                            
F000:C213                            PCI_write_config_word_failed:
F000:C213                                                    ; CODE XREF: PCI_write_config_words+15j
F000:C213 98                             cbw                 ; Convert Byte to Word
F000:C214 C2 B0 C2                       retn 0C2B0h         ; Return Near from Procedure
F000:C214                            PCI_write_config_words endp
F000:C214                            
                           
Note that this is still in the "uncompressed" area of the BIOS code, around the decompression block area (below bootblock area address).. I'll try to find it in your bios :wink:
Last edited by maman on Sun Jun 20, 2004 10:11 am, edited 2 times in total.
maman
Master Flasher
Posts: 173
Joined: Sun Mar 31, 2002 2:08 pm
Location: Taka Bonerate National Park, Indonesia
Contact:

Sun Jun 20, 2004 9:54 am

to help explaining what I'm saying above, here's the relevant snippet from the datasheet of the chipset itself (VIA ApolloPro 693A) :

Code: Select all

Device 1 Offset 3F-3E – PCI-to-PCI Bridge Control
(0000h) .............................................................................. RW
15-4 Reserved ........................................always reads 0
3 VGA-Present on AGP
--  0 Forward VGA accesses to PCI Bus #1 .. default
--  1 Forward VGA accesses to PCI Bus #2 / AGP
  Note: VGA addresses are memory A0000-BFFFFh
  and I/O addresses 3B0-3BBh, 3C0-3CFh and 3D0-
  3DFh (10-bit decode). "Mono" text mode uses
  B0000-B7FFFh and "Color" Text Mode uses B8000-
  BFFFFh. Graphics modes use Axxxxh. Mono VGA
  uses I/O addresses 3Bx-3Cxh and Color VGA uses
  3Cx-3Dxh. If an MDA is present, a VGA will not
  use the 3Bxh I/O addresses and B0000-B7FFFh
  memory space; if not, the VGA will use those
  addresses to emulate MDA modes.
2 Block / Forward ISA I/O Addresses
--  0 Forward all I/O accesses to the AGP bus if
    they are in the range defined by the I/O Base
    and I/O Limit registers (device 1 offset 1C-1D)
    .................................................... default
--  1 Do not forward I/O accesses to the AGP bus
    that are in the 100-3FFh address range even if
    they are in the range defined by the I/O Base
    and I/O Limit registers.
1-0 Reserved ........................................always reads 0
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Sun Jun 20, 2004 10:01 am

Maman:

Thanks for your sincere efforts to help. Please keep me posted on this.

Also, we are going to patch the decompression area and not the boot block area, is this correct?

I would be glad if patching is done within the decompression area only, as I wouldn't have to worry about not being able to recover from boot block should things don't go well after reflashing with your re-engineered bios bin file.
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:

Sun Jun 20, 2004 12:10 pm

If you don't want to initialize the onboard VGA, try removing the VGA BIOS from the BIOS image (using cbrom if it's Award BIOS).
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Sun Jun 20, 2004 6:01 pm

Have tried removing VGA ROM from bios bin file using Cbrom215 before, it did not work. Got video initialization failure beep after flashing the bios, but the system went on to load the OS even without video.
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Mon Jun 21, 2004 3:41 pm

Here are some inputs that might speed up our bios hacking process to disable onboard video:

I'm pretty sure that the PCI VGA Initialization Routine is pre-included with boot block, because my PCI VGA Card is functional whenever I force boot block to execute.

I mean I always had video when I connect my monitor to the PCI VGA port when boot block is forced.

And so we might not need to write the custom code for PCI VGA Initialization anymore, but simply look for this block of code in boot block area, replace the legacy EPA procedure with this code, and patch the call to the onboard vga initialization routine in original.tmp to disable it.

Am I right with this line of thought, maman?
Denniss
BIOS Guru
Posts: 3153
Joined: Thu Mar 21, 2002 8:16 pm
Location: Near Hannover (CEBIT) Germany
Contact:

Mon Jun 21, 2004 8:13 pm

What's your mainboard ?
Please specify your mainboard with manufacturer and model number and please post your Bios-ID

Maybe it's a known problem with your board and fixed with a newer Bios ?
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Tue Jun 22, 2004 6:54 am

It's Tomato mainboard, SIS 630E chipset, P3 procesor, Award BIOS v6PG.

The last bios update from the manufacturer's website was in 2001.
maman
Master Flasher
Posts: 173
Joined: Sun Mar 31, 2002 2:08 pm
Location: Taka Bonerate National Park, Indonesia
Contact:

Tue Jun 22, 2004 9:10 am

ruelnov wrote:Here are some inputs that might speed up our bios hacking process to disable onboard video:

I'm pretty sure that the PCI VGA Initialization Routine is pre-included with boot block, because my PCI VGA Card is functional whenever I force boot block to execute.

I mean I always had video when I connect my monitor to the PCI VGA port when boot block is forced.

And so we might not need to write the custom code for PCI VGA Initialization anymore, but simply look for this block of code in boot block area, replace the legacy EPA procedure with this code, and patch the call to the onboard vga initialization routine in original.tmp to disable it.

Am I right with this line of thought, maman?
I though so, I've located the offsets in the chipsets that's related to our goal. I'm currently in the "suspected" initialization routine, hopefully by today or tomorrow, I can post the result :D.
Denniss
BIOS Guru
Posts: 3153
Joined: Thu Mar 21, 2002 8:16 pm
Location: Near Hannover (CEBIT) Germany
Contact:

Tue Jun 22, 2004 12:28 pm

ruelnov wrote:It's Tomato mainboard, SIS 630E chipset, P3 procesor, Award BIOS v6PG.

The last bios update from the manufacturer's website was in 2001.
Bios-ID ?
Model number ?
ruelnov
Master Flasher
Posts: 172
Joined: Tue Jun 08, 2004 2:11 pm
Contact:

Tue Jun 22, 2004 4:48 pm

Motherboard Model: Tomato V630E
Motherboard ID: SIS-630-6A6IRC19C-00

Too bad that the manufacturer removed the bios download support from their site.

The onboard video disabling feature is also not included in bios setup. What if onboard video ceases to function properly? Shall we just throw away the motherboard?

There's no AGP slot provided as well. And the bios could not initialize the PCI VGA Card, except when bootblock is forced.
Post Reply