Reading the Boot ROM of a PCI Graphics card (NVIDIA 5200)

[thorfdbg]

Hi folks,

I have here a surprisingly hard time getting access to the boot ROM of a PCI graphics card, an NVIDIA 5200. This is a PCI card, so no AGP, no PCIe. It *should* be simple, but it is giving me a hard time.

Initially, I thought I just map the ROM in the PCI config area (PCI config area + offset $30, put there the base address, set bit 1). But that does not map anything, the area is blank. This method did work before on Radeon and Rage card, but not for the nvidia.

Then, there seems to be a ROM shadow in the MMIO area at (depending on the card) +300000 or +700000, but that does not work either, nothing is there.

Then, there is apparently a bit in PCI config area + $50 (what is this? Any idea?) and if bit 0 is there set, the shadow should appear, in the MMIO area. Again, nice try, but nothing visible there with this bit set, nor in the actually mapped ROM area.

I also tried already to wake up the card (1->3c3, legacy IO space). Indeed, that makes a couple of additional registers available in the legacy IO space (the legacy VGA registers). However, still no go, the ROM remains unavailable.

I'm now a bit out of ideas. Anything else I could try?

No, this is a non-x86 system, and no, open firmware is neither available. There is only a PCI bus, and that is all. No ACPI, no x86 boot rom.

[Octocontrabass]

I have here a surprisingly hard time getting access to the boot ROM of a PCI graphics card, an NVIDIA 5200.

Are you sure it has one? You may occasionally stumble across display adapters that weren't intended to work in PCs. (Or it might just be broken. It's what, 20 years old?)

Initially, I thought I just map the ROM in the PCI config area (PCI config area + offset $30, put there the base address, set bit 1). But that does not map anything, the area is blank.

Is MMIO enabled in the Command Register? Are you trying to access any of the device's other IO while the ROM is enabled? Are you sure the base address you're using is appropriately aligned?

Then, there seems to be a ROM shadow in the MMIO area at (depending on the card) +300000 or +700000, but that does not work either, nothing is there.

A ROM shadow is just RAM, there won't be anything there unless you put it there. But that looks like it might be the PROM region address, which is a mirror of the ROM, not a shadow.

Then, there is apparently a bit in PCI config area + $50 (what is this? Any idea?) and if bit 0 is there set, the shadow should appear, in the MMIO area. Again, nice try, but nothing visible there with this bit set, nor in the actually mapped ROM area.

Enabling shadowing disables the ROM. The PCI ROM BAR region will return the contents of the shadow in RAM, and the PROM region will return garbage. If you're trying to access the ROM, you need shadowing to be disabled.