I think you would need to install an option ROM at 0xC0000

You can use the sgabios option rom which is a part of QEMU project. It implements the same BIOS interface (int 10h) as a VGA card does except it outputs everything over a serial port.

You don't even need any kind of PCIe board - you can just integrate it in the main BIOS firmware image, depending on which kind of BIOS do you have (like cbrom for award bioses).

bakemono wrote on 2024-09-11, 16:07:

I think you would need to install an option ROM at 0xC0000

Can you describe it more detailed please? Which soft should i use? BTW i have BIOS/UEFI, im not sure its posible with it, or am i wrong?

kmeaw wrote on 2024-09-11, 16:25:

You can use the sgabios option rom which is a part of QEMU project. It implements the same BIOS interface (int 10h) as a VGA card does except it outputs everything over a serial port.

You don't even need any kind of PCIe board - you can just integrate it in the main BIOS firmware image, depending on which kind of BIOS do you have (like cbrom for award bioses).

I have AMI Aptio, will it work for me? And my MB do not have serial output, will it still accept it? like a rom without actual device

There are two ways of providing option ROMs - you can either build a device which sits on a system bus, decodes memory addresses and responds with ROM contents when a certain address range is decoded. That's how video/network/storage controllers supply their ROMs to the system. The BIOS would perform a procedure known as "ROM scan" - it will check for 0x55aa signature at 0xC0000, 0xC0800, 0xC1000 and all the way up to the size of the boot block in the main ROM chip (or maybe some other arbitrary value, depends on the ROM scan code in the BIOS). Once a signature is found, the next byte is read - it is the size of an option ROM in 512-byte blocks. Then the whole option ROM is added over a byte accumulator to calculate an 8-bit checksum - it should be 0.

Another way of providing option ROMs is integrating them into your BIOS - this is how it is usually done for the video/network/storage controllers embedded on a motherboard.

For non-UEFI AMIs there is MMtool, for UEFI CSM you would need to patch CsmCore - there are good guides available on winraid.level1techs.com.
Almost every superio chip on motherboards implements a serial controller. Maybe you just don't have a DB-9 attached to your serial header on the motherboard. Or maybe the manufacturer hasn't provided the header due to board space limitations. But it shouldn't matter - sgabios never waits for serial writes to be acknowledged. If nothing is connected, console writes would just be silently ignored.

kmeaw wrote on 2024-09-11, 16:47:

There are two ways of providing option ROMs - you can either build a device which sits on a system bus, decodes memory addresses […]
Show full quote

There are two ways of providing option ROMs - you can either build a device which sits on a system bus, decodes memory addresses and responds with ROM contents when a certain address range is decoded. That's how video/network/storage controllers supply their ROMs to the system. The BIOS would perform a procedure known as "ROM scan" - it will check for 0x55aa signature at 0xC0000, 0xC0800, 0xC1000 and all the way up to the size of the boot block in the main ROM chip (or maybe some other arbitrary value, depends on the ROM scan code in the BIOS). Once a signature is found, the next byte is read - it is the size of an option ROM in 512-byte blocks. Then the whole option ROM is added over a byte accumulator to calculate an 8-bit checksum - it should be 0.

Another way of providing option ROMs is integrating them into your BIOS - this is how it is usually done for the video/network/storage controllers embedded on a motherboard.

For non-UEFI AMIs there is MMtool, for UEFI CSM you would need to patch CsmCore - there are good guides available on winraid.level1techs.com.
Almost every superio chip on motherboards implements a serial controller. Maybe you just don't have a DB-9 attached to your serial header on the motherboard. Or maybe the manufacturer hasn't provided the header due to board space limitations. But it shouldn't matter - sgabios never waits for serial writes to be acknowledged. If nothing is connected, console writes would just be silently ignored.

So ib other words, i can just add sga opROM anywhere in bios trough CsmCore patch, and my system will think that i have VGA(SGA)? even if i dont have DB-9 connector? And also if i plug in regular GPU, it will still work for me? Thank you.

sgabios oprom just provides the int10h interface - it is usually enough to trick bootloaders and DOS to think you have a video card but it won't emulate port access, provide VBE services and so on. Usually it is used on servers made of consumer boards to make the system bootable and provide a way (over serial) to interact with the BIOS setup and bootloader if needed. If you don't have a DB-9 connector then you just won't be able to see the output.

If the software uses video drivers or attempts to directly access VGA I/O ports without relying on int10h, then it would not detect a video card.

sgabios can work together (by sending a copy of all text to serial and then forwarding API calls to vga's bios) with a real card if you put it into some other segment, not C000 hex where normal vga bios is usually located.
Some BIOSes have an explicit check of having int10h installed at C000 and fail the POST if it is not - if it is the case then you won't have an option of having both sgabios and a video card installed at the same time because they would have a conflict over having an oprom in the same address range.

Also not every BIOS even requires an int10h handler. Some just complain with beeps of not having a video controller and then carry on with the boot process.

kmeaw wrote on 2024-09-11, 17:04:

sgabios oprom just provides the int10h interface - it is usually enough to trick bootloaders and DOS to think you have a video c […]
Show full quote

sgabios oprom just provides the int10h interface - it is usually enough to trick bootloaders and DOS to think you have a video card but it won't emulate port access, provide VBE services and so on. Usually it is used on servers made of consumer boards to make the system bootable and provide a way (over serial) to interact with the BIOS setup and bootloader if needed. If you don't have a DB-9 connector then you just won't be able to see the output.

If the software uses video drivers or attempts to directly access VGA I/O ports without relying on int10h, then it would not detect a video card.

sgabios can work together (by sending a copy of all text to serial and then forwarding API calls to vga's bios) with a real card if you put it into some other segment, not C000 hex where normal vga bios is usually located.
Some BIOSes have an explicit check of having int10h installed at C000 and fail the POST if it is not - if it is the case then you won't have an option of having both sgabios and a video card installed at the same time because they would have a conflict over having an oprom in the same address range.

Also not every BIOS even requires an int10h handler. Some just complain with beeps of not having a video controller and then carry on with the boot process.

Im using pretty new board Biostar B650MT, and using linux (ubuntu). Still good for me?

So this opROM should be installed at C0000? or i can put it as new one at the end? - im not sure i totally get this part

By the way, MM Tool Aptio, seems like works for me, right? (see attached pls)

As I can see in the window's titlebar, you seem to be editing an AM5 motherboard BIOS. I haven't tried MMTool on such modern boards - the most recent one I have tried was an X79 server board.
If I am right and it is an AM5 board I would recommend finding an up-to-date guide for BIOS modding.
One thing that doesn't look right - MMTool seems to parse only some of the FFSv2 entries, a normal UEFI firmware should have more modules.

Please also be sure that you have a way to recover such as having an external programmer and a full flash dump before doing any modifications - modern platforms tend to have their firmware signed, you could brick a modern machine by invalidating the signature. A safer alternative would be getting some cheap flashable add-on card such as network or storage controller and replacing the contents of the on-board flash chip.

kmeaw wrote on 2024-09-11, 18:56:

As I can see in the window's titlebar, you seem to be editing an AM5 motherboard BIOS. I haven't tried MMTool on such modern boards - the most recent one I have tried was an X79 server board.
If I am right and it is an AM5 board I would recommend finding an up-to-date guide for BIOS modding.
One thing that doesn't look right - MMTool seems to parse only some of the FFSv2 entries, a normal UEFI firmware should have more modules.

Yes its AM5, will research for that, thank you.

kmeaw wrote on 2024-09-11, 18:56:

Please also be sure that you have a way to recover such as having an external programmer and a full flash dump before doing any modifications - modern platforms tend to have their firmware signed, you could brick a modern machine by invalidating the signature.

So even if i will make dump trough SPI header, and if i brick MB, can be case when i can't flash back original firmware and brick it forever? Or it only will not accept new bios, and i still will be able to flash it back with SPI

kmeaw wrote on 2024-09-11, 18:56:

A safer alternative would be getting some cheap flashable add-on card such as network or storage controller and replacing the contents of the on-board flash chip.

Im not sure i got this part:
You mean like buy some PCIe board, and flash on it sgabios? or some other rom to act like VGA? Can you explain it more pls?
Thank you

themrviper wrote on 2024-09-11, 19:18:

kmeaw wrote on 2024-09-11, 18:56:

Please also be sure that you have a way to recover such as having an external programmer and a full flash dump before doing any modifications - modern platforms tend to have their firmware signed, you could brick a modern machine by invalidating the signature.

So even if i will make dump trough SPI header, and if i brick MB, can be case when i can't flash back original firmware and brick it forever? Or it only will not accept new bios, and i still will be able to flash it back with SPI

The only way I know to permanently brick a modern board without electrically damaging it is updating chipset fuses - but I don't think you would ever do that by accident. If the board is configured to verify the integrity of the firmware, it will not accept the new bios and you would be able to use the SPI header to restore the good known one back and be fine.

If you would be doing in-circuit programming using SPI header pins on the board itself, make sure you have the correct layout and supply the correct voltage - even if the datasheet says your flash chip could tolerate 3.3V, the VCC pin could be connected to 1.8V rails. So check the voltage on VCC pin of both the board and the programmer before connecting them.

Another caveat would be getting the right cable. Usually there is some special pin on that header which is supposed to be connected either to GND or VCC - when it is, the board disconnects the flash chip from the rest of the board. If you attempt to program the flash chip and would supply the voltage to the power rail, it could be enough to power up parts of the board that would attempt to read/write the same flash chip - that would result in garbage data.

kmeaw wrote on 2024-09-11, 18:56:

A safer alternative would be getting some cheap flashable add-on card such as network or storage controller and replacing the contents of the on-board flash chip.

Im not sure i got this part:
You mean like buy some PCIe board, and flash on it sgabios? or some other rom to act like VGA? Can you explain it more pls?
[/quote]

I mean buying some SATA controller or a network card and overwriting their oprom flash chip with sgabios. I don't know any good PCIe candidates but for PCI that would be Silicon Image 3114 and Realtek 8139 - they were dirt cheap even in the days when sgabios was worth using on servers.

kmeaw wrote on 2024-09-11, 19:35:

I mean buying some SATA controller or a network card and overwriting their oprom flash chip with sgabios. I don't know any good PCIe candidates but for PCI that would be Silicon Image 3114 and Realtek 8139 - they were dirt cheap even in the days when sgabios was worth using on servers.

So you mean, like some of this IC's is epprom, which hace only oprom code inside? (attached)

In this case, i can actually take cheap PCIe controller & somehow put svga oprom there?

themrviper wrote on 2024-09-11, 20:05:

kmeaw wrote on 2024-09-11, 19:35:

I mean buying some SATA controller or a network card and overwriting their oprom flash chip with sgabios. I don't know any good PCIe candidates but for PCI that would be Silicon Image 3114 and Realtek 8139 - they were dirt cheap even in the days when sgabios was worth using on servers.

So you mean, like some of this IC's is epprom, which hace only oprom code inside? (attached)

In this case, i can actually take cheap PCIe controller & somehow put svga oprom there?

Yes but you would need to research that first. Some cards don't have oprom flash chips for various reasons - either they are not bootable, or every popular bios already has some drivers to support that kind of controller, or they could have everything integrated in a single large chip. Sometimes small chips that look like eeproms are voltage regulators. Sometimes there is an eeprom but it is really tiny - just a few hundred bytes to store some configuration data, not oprom code.

If you put that kind of a card in your PC and get some extra boot messages like "Press <Ctrl-S> to enter configuration utility" or similar, and you also see an eeprom there then you could try dumping it. If you see the same string in the dump then it is a viable candidate for a vga conversion hack.

kmeaw wrote on 2024-09-11, 21:09:

Yes but you would need to research that first. Some cards don't have oprom flash chips for various reasons - either they are not bootable, or every popular bios already has some drivers to support that kind of controller, or they could have everything integrated in a single large chip. Sometimes small chips that look like eeproms are voltage regulators. Sometimes there is an eeprom but it is really tiny - just a few hundred bytes to store some configuration data, not oprom code.

If you put that kind of a card in your PC and get some extra boot messages like "Press <Ctrl-S> to enter configuration utility" or similar, and you also see an eeprom there then you could try dumping it. If you see the same string in the dump then it is a viable candidate for a vga conversion hack.

I think it will be very hard to find one, without buying it, maybe you have in mind any PCIe controller, that has external opROM? better to build one.
And any way i will try tomorrow to add oprom to bios, with backup trough SPI.
Just a question, so it should be pasted to C0000 and replace VGA one? or it can be pasted to some other region? or its a different things? and i can be added, and actually this C0000 addr is something that opROM write in?

If the option ROM path does not pan out, a cheap used low power GPU might be an easier solution, unless you have a specific reason for not wanting a GPU. If this a personal challenge/quest, I understand, but if you just want a working machine, sourcing random PCIE cards to try to find one that might masquerade as a GPU well enough to allow your board to boot seems like it would be more expensive in the long run.

Keep in mind that older GPUs might require a CSM, which your board may or may not have. If it does not have CSM support, a UEFI capable GPU would be needed.

EDIT : A used GT1030 is about 40ish US$ . A GT730 is even less, though some of them will only work with CSM.

darry wrote on 2024-09-11, 21:34:

If the option ROM path does not pan out, a cheap used low power GPU might be an easier solution, unless you have a specific reason for not wanting a GPU. If this a personal challenge/quest, I understand, but if you just want a working machine, sourcing random PCIE cards to try to find one that might masquerade as a GPU well enough to allow your board to boot seems like it would be more expensive in the long run.

I want to make small dock, and i limited by height of MB - only 65mm, even low profile GPU not working for me well, also its power usage, 10 motherboards + 10 GPUs, its like +10-15% of usage, too much i think, and yes challenge also here.
I didnt knew that MB can have or not this headless mode, if i knew it before, i would buy MSI one, they added this option in to their bios(*see question at the end)

darry wrote on 2024-09-11, 21:34:

Keep in mind that older GPUs might require a CSM, which your board may or may not have. If it does not have CSM support, a UEFI capable GPU would be needed.
EDIT : A used GT1030 is about 40ish US$ . A GT730 is even less, though some of them will only work with CSM.

I already own old low profile GPU, interesting thing, that i can't access bios, on post & boot stage - monitor is black. I think its exact related to CSM and legacy ROM, which is disabled i think, cause with new GPU everything working well.

**question at the end:
I see that almost all motherboards use same AMI Aptio 5, and as i understand MB manufacturers have customized only view of UEFI, cause exact AMI BIOS which is hidden inside - is closed code, and compiled on AMI side, am i wrong?
I saw like AMIBCP tool, is not public, and available only for MB manufacturers, and there they(AMI) said - you can change menus & view, without compiling bios code, - thats why im thinking that bios is everywhere is same.

What if i just take MSI bios and flash it to Biostar board?

themrviper wrote on 2024-09-11, 21:15:

I think it will be very hard to find one, without buying it, maybe you have in mind any PCIe controller, that has external opROM? better to build one.
And any way i will try tomorrow to add oprom to bios, with backup trough SPI.
Just a question, so it should be pasted to C0000 and replace VGA one? or it can be pasted to some other region? or its a different things? and i can be added, and actually this C0000 addr is something that opROM write in?

If you take an existing card then the main chip on this card decides how to decode bus addresses - so if you are lucky, you may have a utility that configures that chip to customize the memory location of that oprom. I have seen utilities for network controllers that allow to customize the address but have never seen such an option for storage controllers. So the PCI device itself (by implementing the address decode logic) decides how to expose the contents of the eeprom to the system's memory address space - you can't change it by rewriting some value inside the oprom code.

sgabios is designed without a C000 segment requirement - you can load it anywhere and it will hook int10h during ROM scan. However some code in your BIOS POST routines may check if there is a C000 oprom loaded - it depends on how it has implemented video card presence detection. Maybe it just scans the PCI bus for a type 0 configuration header which has a class of "0300" - so it is very implementation defined.

If you are going to build a card yourself then you would have more flexibility - you will be in control of which memory segment to use and what values to have in PCI type 0 configuration header. But that would probably require to have a PCIe-to-PCI bridge, microcontroller with a PCIe device port or an FPGA fast enough to handle the PCIe transactions.

themrviper wrote on 2024-09-11, 21:54:

I want to make small dock, and i limited by height of MB - only 65mm, even low profile GPU not working for me well, also its power usage, 10 motherboards + 10 GPUs, its like +10-15% of usage, too much i think, and yes challenge also here.
I didnt knew that MB can have or not this headless mode, if i knew it before, i would buy MSI one, they added this option in to their bios(*see question at the end)

Oh, so you don't actually have a requirement to emulate a GPU. That opens more possibilities - you can use a really small GPU like miniPCIe. Or you can pull out PCIe signals using a riser card /cable and move your GPU somewhere else where you won't be limited by size.

themrviper wrote on 2024-09-11, 21:54:

darry wrote on 2024-09-11, 21:34:

Keep in mind that older GPUs might require a CSM, which your board may or may not have. If it does not have CSM support, a UEFI capable GPU would be needed.
EDIT : A used GT1030 is about 40ish US$ . A GT730 is even less, though some of them will only work with CSM.

I already own old low profile GPU, interesting thing, that i can't access bios, on post & boot stage - monitor is black. I think its exact related to CSM and legacy ROM, which is disabled i think, cause with new GPU everything working well.

If the GPUs oprom flash chip has enough free space, you could fit a hybrid CSM+UEFI implementation there. I have reflashed once an NVIDIA card to add UEFI GOP to let me disable CSM.

themrviper wrote on 2024-09-11, 21:54:

I see that almost all motherboards use same AMI Aptio 5, and as i understand MB manufacturers have customized only view of UEFI, cause exact AMI BIOS which is hidden inside - is closed code, and compiled on AMI side, am i wrong?
I saw like AMIBCP tool, is not public, and available only for MB manufacturers, and there they(AMI) said - you can change menus & view, without compiling bios code, - thats why im thinking that bios is everywhere is same.

What if i just take MSI bios and flash it to Biostar board?

Usually you can't just take another board's BIOS and flash it - modern CPU and PCH have a lot of multiplexed pins that require configuration that is bound to a specific board design, like which GPIO is connected to power/reset buttons and leds, how are PCIe slots connected, the intiial power up sequence, there is a lot of variety. However UEFI is very modular - with the help of such tools as UEFITool and utk you can mix and match them.

UEFI also has a standard way of representing the user interface and storing the setup settings - search for "IFR" and "HII". Most manufactures just take the generic UEFI implementation for the platform and add their own UEFI applications and update the forms to hide various menu items. See https://github.com/BoringBoredom/UEFI-Editor for more details. Your current configuration is just stored in a UEFI variable called "Setup" - you just need to know the correct offset in this variable to update which you can find out using tools like IFRExtractor-RS.

kmeaw wrote on 2024-09-11, 23:23:

If you take an existing card then the main chip on this card decides how to decode bus addresses - so if you are lucky, you may have a utility that configures that chip to customize the memory location of that oprom. I have seen utilities for network controllers that allow to customize the address but have never seen such an option for storage controllers. So the PCI device itself (by implementing the address decode logic) decides how to expose the contents of the eeprom to the system's memory address space - you can't change it by rewriting some value inside the oprom code.

sgabios is designed without a C000 segment requirement - you can load it anywhere and it will hook int10h during ROM scan. However some code in your BIOS POST routines may check if there is a C000 oprom loaded - it depends on how it has implemented video card presence detection. Maybe it just scans the PCI bus for a type 0 configuration header which has a class of "0300" - so it is very implementation defined.

If you are going to build a card yourself then you would have more flexibility - you will be in control of which memory segment to use and what values to have in PCI type 0 configuration header. But that would probably require to have a PCIe-to-PCI bridge, microcontroller with a PCIe device port or an FPGA fast enough to handle the PCIe transactions.

So like, not looking on where this opROM is, if my BIOS checks for C0000, and i use sgabios it can not work cause C0000 is empty? Or it will write itself there if i dont have GPU?

-------------------------------------------------
How hard simple things is actually.... Build own or use custom - require research & tons of time.
Simplest way to try embed it in bios, i found some editors that show more than 8 opROMs, will try with them tomorrow.

I have also contacted Biostar, but they are so long in answer, and im not sure that they will help me, its worked only once with MSI (for other guy)