How to modify your PR440FX's BIOS images for netbooting

This pages gives the details of my solution to this problem and links to everything you'll need to do it yourself.

THE PROCEDURES OUTLINED ON THIS PAGE INVOLVE WRITING MODIFIED BIOS IMAGES INTO YOUR BIOS. IT IS POSSIBLE THAT THIS WILL RENDER YOUR MACHINE UNABLE TO BOOT. NOT ALL MOTHERBOARDS HAVE A BIOS RECOVERY JUMPER. DO NOT ATTEMPT THIS IF YOUR BOARD DOES NOT HAVE SUCH A JUMPER OR YOU DO NOT HAVE THE NECESSARY DISKS TO RECOVER.

The Flash BIOS on the PR440FX has a 4K user or logo area which it can for option ROMs (such as netboot ROMs). The rest of the flash area is reserved for System BIOS and other things. 4K is far too small for every netboot ROM image that I've ever seen. (It also seems that the BIOS doesn't call the option ROM images correctly but that's another issue.)

It turns out that the System BIOS doesn't actually use all 224K that are reserved for it. It would be surprising if it did fill up the space allocated for it perfectly. Fortunately the spots that are not occupied are easy to spot.

My solution places fragments of the netboot ROM image into unused spots in the System BIOS image. Then I use another Option ROM which is small enough to fit into the user flash area to reassemble and run the fragments of the netboot ROM at boot time.

The interesting part of the boot process is what happens when no bootable devices are found. In the original IBM PC's the BIOS started the BASIC interpreter built into ROM by calling interrupt 18h. Modern PC's don't have this anymore but most BIOSes still call interrupt 18h if no bootable devices are found. (Interrupt 18h simply points to an IRET instruction in this case.)

One way Neboot ROMs can work is by hooking interrupt 18h and running the netboot code when no other bootable devices are found. (Every ROM has an initialization routine called by ROM before attempting to boot. The "hooking" is done by this routine.)

Since we have no socket for a boot rom and only 4k of available user flash area, storing a 32k ROM image is going to be a problem. It turns out that the system BIOS doesn't use all the flash memory that's available on the motherboard. Luckily, it's easy you spot these stretches by looking at hex dump. It turns out that you write data into most of these sections without causing any problems. This leaves three problems to be solved:

• The system BIOS area is not scanned for option ROMs.
• The BIOS image generally contains many small holes. There may not be a single hole large enough to hold the entire option ROM image. (Which means scanning the system BIOS area for option ROMs wouldn't even be useful.)
• The Flash images loaded with the flash utilities are not mapped into low memory.

Assumptions:

Motherboard

The only board that I have done this with is the Intel "Providence" PR440FX. This technique is probably portable to other boards using AMI bios that will scan the user flash (logo) area for option ROMs.

Netboot ROM

I used netboot ROM images created by the netboot package for Linux to boot Linux. I have not tried booting DOS or windows with theses ROMs although it appears to be possible.

Build Environment

The build environment used was Red Hat Linux with the 8086 tools from the TSX-11 (see below for links). The C programs to generate ROM checksums and the like should compile fine in UNIX environment and maybe even Windows.})

• Verify that the Flash BIOS recovery mechanism for you motherboard works and that you have everything you need to use it. I really mean it.
• Make yourself a working netboot rom image.
  • Grab Gero Kuhlmann's netboot utilities for Linux. (See links below)
  • Build a working ROM image. (Just try out the floppy image. If that one works, so will the ROM version.)
    Note: You need to build a ROM that hooks interrupt 18h. To do this make sure you answer yes to the question "Do you want the bootrom to look for boot drives first?" Otherwise the ROM will hook interrupt 19h instead.
• Obtain the latest ROM image for your motherboard. (at the time this was written, the latest version available was 1.00.08DI0)
• Take the System BIOS image files from the BIOS update package. Use the "fillgaps" utility to place the netboot image in the system BIOS image.

  fillgaps usage: fillgaps netboot_rom_image System_BIOS_image_files ...

  Important note: Not all the gaps in the BIOS image are useable. On the Intel Providence board, the tail portion of the last segment of the system BIOS image contains the user flash area (which we don't want to overwrite with the netboot rom image) and an area (which is reserved for some other purpose) which gets overwritten. Therefore you should specify the BIOS image files in order on the fill gaps command line. Here is the command that I used to pack my BIOS:
  fillgaps image.rom 1008di0_.bio 1008di0_bi1 1008di0_.bi2 1008di0_.bi3

• Using the Flash Utilities, install these new BIOS images.
• Install the "loader" ROM image into the user flash area.
  • Using the Flash Utilites, save a copy of the user flash area.
  • Place a copy of loader ROM image. If the user flash image from the previous step was saved into "loader.usr" and the loader ROM image is in loader.rom, you could use the following command:
    dd if=loader.rom of=loader.usr bs=1 seek=128 conv=notrunc
  • Use the Flash Utilites to load the modifidieplace the new userflash image back
• Go into the BIOS setup and go to the boot options menu.
  • Set your boot sequence to floppy disk, network, hard disk. (You can set it to something else, just remember that the loader ROM appears as the "network" boot device and it should appear other boot devices.
  • Enable "Scan User Flash Area". (This is under "Boot Options")
• Remove all floppies and reboot. After trying the floppy disk you should see the "Flash ROM loader" banner. After that, if all is well, you should see the startup messages from the netboot ROM.

Failed to determine Flash ROM size

The loader uses BIOS interrupt 15h, service=db01 to ask the BIOS how big the flash images is. If you see this message you're probably out of luck.

Flash ROM read failed.

BIOS interrupt 15h service=db00 failed to read a piece of the flash BIOS. If this fails, you're definitely out of luck.

No boot ROM found in Flash ROM

The loader assembles all the fragments it finds into a segment of low memory. If it doesn't find a valid option ROM after it's done assembling segments, it prints this message.

ROM image failed to boot.

The loader expects the netboot ROM's initialization routine to hook interrupt 18h. The loader then calls interrupt 18h and doesn't expect it to return. If you see this message, it returned and probably means the netboot rom image didn't hook interrupt 18h. Make sure you answer "y" to "Do you want the bootrom to look for boot drives first?" when building the netboot ROM image.

The system fails to boot.

Whoops! I guess you screwed up your BIOS image. You might try specifying the System BIOS images in a different order when running "fillgaps". In any case, you get to try out your recovery jumper and recovery disk!

The system boots ok - selecting network as a boot option doesn't do anything.

This probably means that your BIOS isn't running the loader option ROM. Make sure that "Scan User Flash Area" is enabled in the boot options.

The system hangs at boot time but only when network is selected as a boot device.

Congratulations, you've found a bug in the boot ROM.

FlashNetboot.tar.gz

The source package for the loader ROM and utilities.

PR440FXNetbootKit.tar.gz

This package contains binaries for a boot ROM appropriate for the PR440FX, the loader ROM and a Linux ELF binary for the "fillgaps" utility. If you have a PR440FX, this package and the BIOS upgrade package from Intel (version 1.00.08DI0) should be enough to generate the modified BIOS images.

The Netboot Page

This is the home page for Gero Kuhlmann's very excellent Netboot package.

Linux 8086 Development Tools

The assembler (as86) and linker (ld86) needed to build the ROM image.

Ralf Brown's Interrupt List

A great big heap of information about PC interrupts including lots of undocumented stuff. (It's even got documentation for the installation check that a bunch of viruses do. That's awesome.)

PR440FX Documentation

This documentation doesn't actually contain much useful information for coding. It features mainly market-drone type statements of the form "product X supports feature Y".