The JMicron JMB363 is a 2-port SATA + 1-port PATA controller chip often found embedded in motherboards and in low-cost add-on cards. The chip supports operating in IDE, AHCI, and RAID controller modes. Motherboard BIOSes allow choosing the operating mode, but add-on cards are stuck in RAID mode.
The problem with RAID mode is that standard AHCI drivers cannot be used. A JMicron-specific driver is available only for Windows. Some OSes (Linux, drivers/pci/quirks.c) set a PCI configuration register to put the controller into AHCI+IDE mode after booting and use standard drivers. Other OSes (Mac OS X) do nothing and can’t use the card.
I attempt to solve this problem by hacking the JMB363 option ROM to put the card into AHCI mode, with partial success. The two SATA ports work in OS X, including hot-plugging, but I could not get the parallel ATA enabled, and I had to bypass loading the option ROM (thus, can’t boot from the SATA ports anymore). The patched ROM might also be useful for other OSes that don’t have Linux-style PCI quirks.
Option ROMs
- Original Option ROM 1.07.24
- Patch three uses of PCI configuration register 0xdf[1:0] to read 2’b10. This seems to put the controller in AHCI mode.
- Also patch two uses of 0xdf[6] to read 1’b1 and writes 0xa1 to configuration register 0x41. This bypasses the option ROM and keeps the SATA ports enabled.
Hacking the Option ROM
I used the newest version of the option ROM (1.07.24) posted at JMicron’s FTP site. Some hints about the configuration of the JMB363 can be found in JMicron’s release notes, particularly about PCI configuration register 0xdf. The release notes hints at the existence of a newer 1.07.28, but it wasn’t posted. Linux’s drivers/pci/quirks.c gave some hints about the meaning of PCI configuration register 0x40-43.
Configuration Register 0xDF
PCI configuration register 0xdf seems to be intended for main BIOS to communicate its settings to the option ROM, rather than having a direct effect on the hardware. Bits [1:0] seem to indicate controller mode. Bits [7:6] and [5:4] look like they control two instances of the same thing because the code that parses them is structured the same way. The release notes say bit [6] is used to put the chip into “multi-function” mode with the option ROM disabled, which feels a little bit like a hack to me. Bits [3:2] don’t appear to be used.
| df[6] | df[1:0] | Result |
|---|---|---|
| 0 | 00 | Default, RAID mode |
| 0 | 01 | IDE device (class 0101) |
| 0 | 10 | AHCI device (class 0106) |
| 0 | 11 | IDE device (class 0101) |
| 1 | 00 | RAID device (class 0104), no option ROM |
| 1 | 01 | AHCI device (class 0106), no option ROM |
| 1 | 10 | AHCI device (class 0106), no option ROM |
| 1 | 11 | AHCI device (class 0106), no option ROM |
It seems like bits [1:0] select the card mode (RAID, IDE, AHCI, IDE?), with the value 2’b11 probably not intended to be used (the option ROM code only distinguishes between 2’b00, 2’b01, and other).
Since setting df[6] causes “jump out of Option ROM, do nothing” (See release notes for v1.03), it is no longer possible to boot from any disks attached to the chip.
In no case did setting 0xdf[6] cause the JMB363 to become a multi-function device. I speculate its purpose is to disable the option ROM, allowing the main BIOS to set up the rest of the device configuration without interference.
- Register df[6] is used by the option ROM code at offset 0x3517.
- Registers df[7:6] and df[5:4] are used at offsets 0x372d and 0x3756, respectively. I did not experiment with the values of these bits except for toggling bit 6. They seem important, causing PCI config register bits 0xed[5:2] and 0xcd[5:2] to be set when df[7:6] and df[5:4], respectively, is 2’b01 or 2’b10.
- Register df[1:0] is used in the option ROM at offset 0x3553, 0x3574, and 0x37c1
Configuration Register 0x40-43
These configuration registers seem to control the hardware directly. The option ROM sets them but doesn’t read them.
| Register | Function |
|---|---|
| 43 | Defaults to 0x80. Unknown purpose. |
| 42 | Seems to take values of 0xc2 or 0x82. Bits [1:0] depends on 0xdf[1:0], with a special case when 0xdf[6] is set. Unknown purpose. |
| 41 | Bits [7:4] affect the SATA ports with [7:6] controlling SATA1, [5:4] controlling SATA0. Bits [3:0] unknown. Option ROM sets this to either 0xf1 or 0x51. |
| 40 | Bit 1 appears to control whether the second PCI function is enabled. Other bits unknown. |
Linux (drivers/pci/quirks.c) modifies this configuration register, which results in 0x80c2a1bf on my card. I tried modifying the option ROM to also configure register 0x40-43 to this value, but had many problems booting. Either I’m getting some of the other configuration bytes wrong or this value is intended only to be used after booting the system.
Problems
Only modifying register df[1:0] to value 2’b10 seems to put the controller into AHCI mode (with no IDE PCI function, but PATA drives are still detected by the option ROM). The option ROM loads, correctly reports connected drives, and allows booting from them. However, OS X does not detect hard drives that were detected by the option ROM at boot time. If SATA drives are not attached until after the option ROM loads, they are detected by the OS and can be hot-plugged. Therefore, I chose to set register df[6] to cause the option ROM to quit without detecting drives. A side-effect is that without the option ROM, the computer can’t boot from the disks.
The problems with configuration register 0x40-43 are more problematic.
Linux sets register 0x41 to 0xa1, while the option ROM will set it to 0xf1 or 0x51. 0x51 appears to disable hot-plugging the disks on the SATA channels entirely. 0xa1 causes a hang for several minutes at boot, seemingly trying and failing to find a disk, while using 0xf1 boots normally. Trying with 0xb1 and 0xe1 shows the same behaviour as for 0xa1, but hangs only if a disk is not present on SATA0 or SATA1, respectively. Thus it seems like setting 0x41[7:6] or 0x41[5:4] to 2’b10 causes the option ROM to assert that a disk must be present at boot time for that channel. The hang does not occur if the option ROM is skipped by setting 0xdf[6], so I use 0xa1 to be closer to what Linux does, although I notice no other differences between 0xf1 and 0xa1.
Linux sets register 40 bit 2 (to enable the IDE port?). Trying to do that in the option ROM causes a several-minute hang during boot when loading the option ROM (again, seemingly waiting for a disk and giving up), even when a PATA disk is present. With df[6] set, the option ROM does not detect any disks, despite spending several minutes.
Final configuration
- PATA not enabled because turning it on causes a hang during boot.
- Option ROM not enabled by setting df[6], so the disks are not bootable.
- SATA drives working in OS X with the standard AHCI driver, including hot-plugging.
PCICFG v1.24 (c) Copyright 1997,1998 Ralf Brown Modified by Datapath based on V1.19 ----------------------------------------------------------- PCI bus 04 device 00 function 00: Header Type 'non-bridge' (single-func) Vendor: 197B ??? Device: 2363 ??? Class: 01 disk Revision: 10 SubClass: 06 ??? ProgramI/F: 01 CommandReg: 0007 = I/O-on mem-on busmstr Status Reg: 0010 = CapList (fast) CacheLine: 08 Latency: 00 BIST: 00 SubsysVendor: 197B SubsysDevice: 2363 Base Addresses: (0) 00009001 = I/O base=00009000 len=8 (1) 00009401 = I/O base=00009400 len=4 (2) 00009801 = I/O base=00009800 len=8 (3) 00009C01 = I/O base=00009C00 len=4 (4) 0000A001 = I/O base=0000A000 len=16 (5) D9000000 = mem base=D9000000 len=512 CardBus: 00000000 ExpansionROM: 00000000 (64K,disabled) INTline: 0A INTpin: 01 MinGrant: 00 MaxLatency: 00 Device-Specific Data: 40: 80C2A1BD E4FF0808 40F00060 00000000 00110010 00008000 58: 000A2000 00036C11 10110000 00000000 00000000 00000000 70: 00000000 00000000 00000000 00000000 10000000 00000000 88: 00000000 40035001 00000000 00000000 00000000 00000000 A0: 00000000 00000000 00000000 00000000 00000000 00000000 B8: 00000000 80000000 00000000 00000000 00000000 00000000 D0: 80000018 1000001C 00EB0000 00000000 00000000 00000000 E8: 00000000 00000000 00100058 00000000 00000000 00100000 Capabilities List: ID @8C = 01 PCI Power Management PMC = PME#-D3hot DynClk = 0, PCI_PM version = 3 PMCSR = 0000, data-select=0 unknown/unimplemented state=D0 PMCSRX = -- -- -- -- Data = 00 ID @50 = 10 (unknown)
hi, i installed your ahci_skiprom bin on my jmb363. seems ok, but i wanted to play around with a few more settings. when i made further modifications and went to install, the flash app found no flash chip. the skip rom option seems to completely disable the flashrom leaving the card unable to update. any ideas how i can regain access to the flashrom short of desoldering and reprogramming? thanks.
hmm… I didn’t have problems flashing back and forth between them, regardless of whether the option ROM was loaded.
I did have some issues with the card being seated properly in the PCIe slot. Make sure the card is detected at boot time (it should show up on an older BIOS that prints out all the PCI devices at boot. I also used pcicfg in DOS to check the card was detected). Hot-plugging the PCIe card never worked for me.
you were 100% correct. re-seated the card and able to flash again. who would have thought… not me obviously. thanks. BTW i am trying to set ide mode so i simply changed the 3 instances of b1 to 91 (trying to put sata interface into legacy mode) and set the checksum. does this sound correct to you?
I don’t understand. Which three instances of 0xb1, and why change to 0x91?
Is tricking the option ROM into seeing register df[6]=0, df[1:0]=01 the result you want? (and letting the option ROM decide how to set the other configuration registers)
If so, I would start with the first patched ROM (the one that sets df[1:0] to 10), and change that to 01. I made changes at three locations: offset 0x3556, 0x3577, and 0x37c4. I replaced 3 bytes with (b1 02 90):
b1 02 mov cl, 0x0290 nop
Those three bytes used to be a function call to a function that would read a byte from the PCI configuration space register (di), and return the result in cl.
maybe i missed something, i started with the ahci file, and did a simple hex compare to the original (i dont have proper tools for dis), i found only the 3 differences you wrote about (though my hex editor has a slightly different addy) so i started looking at the binary values, b1 (10110001 binary) seemed to be the bytes that referred to the bits 1:0 so i just changed them to read 01 (10010001 binary) converted back to hex which came out to 91 instead of b1. so i changed the strings to read 91 02 90. i assumed this would put 01 in the cfg register and set ide/legacy mode.
though now i am thinking i need to change it instead to 01110001 or 71h. hopefully you could shed a bit more light on the subject. thanks
Unfortunately, it’s a little more complicated than that 🙂
The edits are in x86 machine code. They’re not register values. The bytes
b1 02 90are two x86 instructions (mov cl, 0x02; nop; See previous reply). The original bytes weree8 xx xx, where e8 is the opcode for the CALL instruction, and the 16-bit immediate operand is the relative branch target.I’m not changing the configurations registers, I’m modifying the code that reads the registers. You’d probably need a disassembler to understand the code…
I think what you want is to change
b1 02tob1 01. This changesmov cl, 0x02tomov cl, 0x01. At this point in the code, register cl should contain the byte read from PCI configuration register 0xdf.indeed, that did the trick. thank you very much for your help 🙂
Hi, Henry.
I want to boot an ide hd from a jmb363 card. which patched bios should I use?
How can I update bios? boot to dos and run 36xupd.exe?
Thanks!
I haven’t tried using the IDE port, and neither of the modified ROMs I posted would work. I suspect it’s what steve asked for in the above comments (unsure if it boots though).
In that case, it was taking the first modified ROM (without bypassing the option ROM, since you do want to boot), then editing it to put the device into IDE mode rather than AHCI mode. (Change three instances of
b1 02tob1 01)Do you have an IDE only configuration of the ROM? I’m not sure how to modify the ROM.
I do not, but I could make one, blindly: I no longer have the card to test it.
You can download 1.07.28 from below site:
http://www.station-drivers.com/page/jmicron.htm
thank you so much for this. made my generic jmb363 raid add-on card work on os x mountain lion (hackint0sh).
Hello, I used the first patch (ACHI mode) in hackintosh. I have two HDD conect. But my BIOS detects one disk connected via SATA and other via IDE. In Mac I can not see this HDD (IDE). Your patch nullified IDE mode and I have the HDDs connected via SATA. Why can it be?.
I don’t know… Have you tried the second patch with the option ROM disabled? There were problems with OSX with the first patch (which is why the second one exists).
With the first patch (option ROM enabled), OSX would only detect drives that were hot-plugged after booting. Those connected at boot were not detected.
Hello, I’ve tried both patch. Skiprom works best for me in hackintosh. But I still have not managed to create a raid from the card (RAID1 for use from mac and windows, with SATA disks). You know if it is possible?.
thanks
The purpose of the patched firmware is to *disable* the RAID functionality. Using the card as a RAID device needs a driver for your OS, and those only exist on Windows.
You can still use the software RAID provided by the OS. This is done the same way as with any other disk. I’m not aware of a method to get the same RAID array to work in both Windows and Mac though…
ok, thanks equally
Many thanks for the modded ROM. I have programmed the first modded one into two JMB 363 cards with SST flashable chip and everything has gone OK. It puts the controller into AHCI mode (0106 class, original was 0104 class) and it is bootable (tested actually, with only SATA drives).
Anyway, you can erase the flash chip, so that no option ROM is executed and the card is rendered non-bootable anymore. Even with no option ROM loaded, the card is still recognized under the Windows OS as a generic AHCI controller (0106 class).
Hello Pablo,
Could you pass on a link please of your setup? i’m not savvy with configuring things, but i can use that command flashing tool, i would like to simply use the card as a sata controller. that can boot, but my bios only shows it as a raid adapter, and the drivers during windows 7 install fails.
i feel it is because i am only using one drive with this card. and it is ment for Raid setups.
could your bios config allow me to use ahci to boot my one drive (through sata) and allow for windows install?
if so please post your config. its frustrating me that my computer wont allow an OS install.
Thank you.
@Henry
I tried to change b1 02 to b1 01 to make the card work in IDE/Legacy mode, changing these values produce a corrupt ROM file that can not be flashed to the add-on card. Do i need to fix a checksum value as well? What value?
There is indeed a checksum byte. The sum of all bytes in the file should be 0x00. The last byte of the file is used as a checksum.
Since you’re decreasing the value of one byte in the file, I’d expect the checksum would increase by 1 to compensate.
@Henry
Worked like a charm, last byte was D9 + 3 = DC resulting in 8-bit checksum = 00
I can successfully boot my ssd using this rom where the ahci version did not.
IDE only ROM (jmb363_1.07.24_ide.bin)
https://skydrive.live.com/redir?resid=4F7BE65BF6B6294F!577
@Henry
How did you find out which bytes in the bin file is the PCI config register?
I’m trying to do the same for the Marvell 9128 option ROM. Specifically, I need to disable option ROM and get it to boot up in AHCI mode. The PCI config registers on the Marvell would be entirely different to the JMicron, so without some info from the manufacturer, I’d be stabbing in the dark. Any pointers would be appreciated.
I had some help from the option ROM release notes, which gave some hints as to what the PCI config registers do (or at least, supposed to do after being interpreted by the option ROM). You might try looking through the Linux kernel sources to see if the driver for the 88SE9128 gives any clues as to how the chip works…
The second part of the problem is to modify the option ROM given you already know how to configure the chip. This was done by disassembling the option ROM (it’s real mode x86 code) to figure out what it does. The bytes that were changed here are x86 code that reads the PCI configuration register and does something with the value. It is not a data table containing some form of initial register values.
Hi Henry,
I contacted jMicron’s support to ask if they had an official NON-RAID rom, guess what, they had…
The NON-RAID part works fine but the add-on card is still recognized as RAID controller, Below you can find the ‘official’ NON-RAID rom.
Anyway to modify it to force it to be recognized as ‘Standard Dual Channel PCI IDE Controller’ or ‘Standard AHCI 1.0 Serial ATA Controller’ by default?
https://skydrive.live.com/?cid=4f7be65bf6b6294f&id=4F7BE65BF6B6294F%21705
Interesting. This option ROM is half the size.
It’s probably possible to hack this ROM as well, although I’m not sure if it’s worth the effort of redoing the disassembly work. As for me, I no longer have the card…
Hello, Sorry to bother you Henry,
I know you do not have this card anymore. but I would still ask for some support.
I’ve bought the jmb363 version of this card, with 2 sata ports, and no IDE ports.
it seems to be fixed to Raid, and the bios sees the drive connected as a raid controller.
during a windows fresh setup, i cannot get past the copying and expanding files without errors. (i believe the drivers are not compatible with the raid configuration)
i only have one drive i wish to use on the card. (and a sata dvd writer on the other port)
and want to be able to use the card as a boot device to boot windows, and to avoid using my onboard sata controller. bios is able to see the card and drive, but windows after using the drivers still error out.
the drive is sound, and the DVD of windows is original and has been used before to istall, even using the onboard sata port i can install without problems, so i know the issue is not the DVD, or the DVD drive (The install drive is IDE and i’m using the onboard ide for the installation) or the HDD, as all these have been correctly tested to be working.
i understand of your busy, if you could direct me to a Bios i could flash that will allow my drive to be usable as a boot device through the JMB363, i would be forever grateful.
It seems the setup that Pablo above has is what i’m looking for but i’m unsure of this.
Kind Regards
Duufus
It sounds like Pablo was using the first of the two patched option ROMs I posted, though I’m not entirely sure.
I didn’t spend much time testing them for booting because I didn’t need the drives to be bootable, so I really don’t know how well booting from the card works.
It’s strange you would get errors during file copying. Normally with RAID controllers, either you don’t have a driver (and drives are not detected), or they work properly…
Why do you want to avoid the on-board SATA controller? If the on-board controller is 3 Gbps, it’s usually faster than an external chip attached to PCIe x1 (2.5 Gbps in total for both ports).
Duufus, I had in the past this card:
Absolutely no flashable by the JMicron Utility.
This the one I has currently, perfectly flashable/erasable ROM, and ODDs work OK:
Duufus, I had in the past this card (StarTech brand):
Image
Absolutely no flashable by the JMicron Utility.
This the one I has currently (generic brand), perfectly flashable/erasable ROM, and ODDs work OK:
Image
Hi,
It may be useful to know that on some cards equipped with JMB363, for example the card marked “PESA111R”, the description is misleading: There are effectively two sockets for connecting an external HDD, one INTERNAL, classical SATA, and another one, EXTERNAL, e-SATA, but they are EXCLUSIVE: if you use one, you cannot use the other one at the same time. Actually, there is only one sata connexion, not two.
SORRY, what I just wrote above seems to be B…S… (and I cannot edit..); next time, I will think deeper before writing lies..
Hi, seems I’ve solved all remaining issues with my patched rom.
* Option ROM enabled, so the disks are bootable
* SATA drives works with the standard AHCI driver, PCI device func 0 has class 106 (01)
* PATA drives works with the standard IDE driver whatever it is, PCI device func 1 has class 101
* RAID menu disables since has no sense for AHCP+IDE configuration
Refer jmb363_1.07.24.multi.bin from below
https://drive.google.com/file/d/0B0IgNylGYpqsbERTTHNPMURubWc
p.s same technics could be used for other JMB36x ROMs
possible to patch 1.07.28 with those changes as well? original still available from RvdH’s onedrive link above.
TIA
yep, it’s possible, but why? what benefits vs 1.07.24?
Can you work that changes at latest bios(ver 1.07.28)?
I want to use latest bios because it will be better 1.07.24.
Please work with the latest bios and share it.
Okay, jmb363_1.07.28.multi.bin
https://drive.google.com/file/d/0B0IgNylGYpqsV0dpekVST2Noc2c
Thank you very much.
Flash tool (1.19) reports corrupt option ROM for .28, .24 is fine though. Maybe the .28 file is broken?
Or is there any trick?
Sorry, forgot to update CRC. Here’s updated, old one is removed
https://drive.google.com/file/d/0B0IgNylGYpqsS3dpMzYxWVJDVFE
@themiron, can you make a option rom using your fixes that works in IDE/Legacy mode instead of AHCI mode (IDE device class 0101)
@themiron
can you reproduce your patch on version 1.08.01?
I have read through this page and start to comprehend the edits needed. v1.08.01 is a different size and has different offsets for the necessary edits. Unfortunately, I do not know enough about hex editing to find where to patch.
Hello, Where to get the standard AHCI drivers (for example on XP)?
would this work to enable AHCI on a mainboard based jmb controller which only exposes IDE?
Is there the possibility to enable only ahci mode so to use 1 or 2 hdds avoiding SCSI driver instead of AHCI driver?
OK, I updated the RC-216’s firmware with jmb363_1.07.28.multi.bin and when I try to install Win10 on a SSD it says I can’t- the error is that the drive may not be able to boot.
I have a P5N-D motherboard, which isn’t AHCI. What am I missing? The SSD on the card definitely shows up in my BIOS.
Hi henry, would this modification be usable on a motherboard that has a JMB chip, but no way to set AHCI mode?
the Rampage III Extreme and Black editions both expose only IDE mode, meaning the hot swap features of the eSATAp port are just not available.
I have no idea. Also, I haven’t looked at this in years…
The first thing that’s different with the on-motherboard controllers is that the option ROM is usually packaged into the system BIOS, rather than being on its own flash chip. So at minimum, you’d probably need to extract and insert the option ROM and flash your system BIOS, rather than using the flashing procedure for the add-on card.
Other than that, I’m not certain if the option ROMs are the same for both on-motherboard and add-on card devices. They might be similar enough you could replace one with the other, but they also might not be.
They certainly appear to be the same, I have replaced the orom inside the 1601 bios of the R3E and the device is now running in AHCI mode.
Thanks to RvdH for keeping the files online, and you for this project blog.
Can we get an update for firmware v1.08.01?
Which can be found here: https://www.win-raid.com/t7f13-AHCI-amp-RAID-ROM-Modules.html
Post 2 section C.
I don’t have the card anymore, so not from me 🙂 I see themiron posted a modified 1.07.28 option ROM in the comments above. I’ve never tried it though.
themiron’s 1.07.28 works perfectly as AHCI mode SATA controller. I have been using it for some time.
the issue i have is 1.08.01 operates faster and gets better benchmarks. I want to create an AHCI patched verson of 1.08.01.
Unfortunately, the file is quite different. Given my limited abilities to understand hex, I cannot locate where to apply the changes to.
still interested? I could try apply same patches in my spare time
please refer patched 1.08.01 https://drive.google.com/open?id=1HHGC6cFs9EniAJwV65wfWhatfOdvlOST
not tested, have no hw anymore
Hi,
If anyone wants to flash the the card under Linux or Darwin/Mac OS X etc, I added an experimental support for some of the JMICRON cards to the flashrom utility.
It would be great if you can test it.
Here is the link: https://mail.coreboot.org/pipermail/flashrom/2018-May/015483.html
I don’t know if there is any activity left here but in any case.
I managed to download the entire JMicron FTP from,
https://archive.org/download/ftp-driver.jmicron.com.tw
There are two different versions of Option ROM 1.07.24 in the archive.
One jmb363_1.07.24.zip and one jmb366_1.07.04_raid.rar
But no information about it and if there is any difference between them.
Thanks for your incredible job and that the files are still online.
Still testing different versions so in best case be able to boot from the card with SSD to ESXi in my HP MicroServer Gen 8.
Using SD card now and SSD as Datastore on the skiprom version.
Best Regards Flue
Have one of these card recently as my motherboard do not have IDE (PATA) port. Tested PATA and SATA (internal works.
But eSATA port does not seem to fit my connector. Any ideal of where to get this cable for external drive connection.
My ROM is v1.06.54, believe is RAiD version. I use drive “JMB36X_WinDrv_R1.17.65_WHQL”, Should I be using “JMB36X_WinDrv_R1.17.65_WHQL_eSATA” version.
Hey everyone,
I know I’m quite late to the party, but can someone share the steps to flash a ROM onto the JMB363 and where to get the flash tool? Thanks!