Sonnet Tempo ATA133 and ATA100 PCI - PROMISE cards flashing quest

DearthnVader · Jan 24, 2022

DearthnVader said:
@joevt

Isn't 0x30 the standard offset of the EEPROM in the PCI Bus Bindings?

from the reg and assigned-addresses property of you Tempo Trio card:

Code:

reg 00011000 00000000 00000000 00000000 00000000 01011010 00000000 00000000 00000000 00000010 01011014 00000000 00000000 00000000 00000010 01011018 00000000 00000000 00000000 00000010 0101101C 00000000 00000000 00000000 00000010 01011020 00000000 00000000 00000000 00000010 02011024 00000000 00000000 00000000 00010000 02011030 00000000 00000000 00000000 00010000 assigned-addresses 81011010 00000000 00001040 00000000 00000010 81011014 00000000 00001030 00000000 00000010 81011018 00000000 00001020 00000000 00000010 8101101C 00000000 00001010 00000000 00000010 81011020 00000000 00001000 00000000 00000010 82011024 00000000 80820000 00000000 00010000 82011030 00000000 80810000 00000000 00010000

We know the FCode ROM does somefixup of these properties, do you think this maybe why the Sonnet Flasher keeps returning " No Card" even tho I've built all the IONameReg properties in my script?

Because without the reg and assigned-addresses properties of 02011030 00000000 00000000 00000000 00010000 and 82011030 00000000 80810000 00000000 00010000 the flasher can't find the EEPROM?

I can't dump the .properties from my QuickSilver G4 due to a bug in Telnet on the QS having no input, however the important thing is the reg and AA properties for 0x24 and 0x30 having a length of 0004000 rather than what Joe has 0001000( 65536 in decimal ) the exact length of our ROM file.

The question is: Can we just change the length with the reg and AA properties or does the card need a hardware mod?

@joevt will you lookout the FCODE and see if you can figure exactly what it does when it fixes the properties for the reg and AA?

Code:

: colon_definition_function_80e                                                    \ (80e)                [0b5 0b7]
    " assigned-addresses"                                                        \                    [012]
    get-my-property                                                                \                    [21a]
    if                                                                            \ (0x23)            [014]
        ." missing ASSIGNED ADDRESSES"                                            \                    [012 090]
        cr                                                                        \                    [092]
        abort                                                                    \                    [216]
    then                                                                        \                    [0b2]
    begin                                                                        \                    [0b1]
        dup                                                                        \                    [047]
        0>                                                                        \                    [038]
        while                                                                    \ (0xca)            [014]
            decode-phys                                                            \                    [128]
            dup                                                                    \                    [047]
            0ff                                                                    \                    [010]
            and                                                                    \                    [023]
            case                                                                \                    [0c4]
                10                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_807_0                                                \ (807 0)            [0c3 807]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x99)            [0c6]
                18                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_808_0                                                \ (808 0)            [0c3 808]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x76)            [0c6]
                14                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_809_0                                                \ (809 0)            [0c3 809]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x53)            [0c6]
                1c                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_80a_0                                                \ (80a 0)            [0c3 80a]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x30)            [0c6]
                20                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_80b_0                                                \ (80b 0)            [0c3 80b]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0xd)                [0c6]
                >r                                                                \                    [030]
                3drop                                                            \                    [046 052]
                decode-int                                                        \                    [21b]
                drop                                                            \                    [046]
                decode-int                                                        \                    [21b]
                drop                                                            \                    [046]
                r>                                                                \                    [031]
            endcase                                                                \                    [0c5]
    repeat                                                                        \ (0xffffff36)        [013 0b2]
    value_807_0                                                                    \ (807 0)            [807]
    encode-int                                                                    \                    [111]
    " TFile-Addr0"                                                                \                    [012]
    property                                                                    \                    [110]
    value_808_0                                                                    \ (808 0)            [808]
    encode-int                                                                    \                    [111]
    " TFile-Addr1"                                                                \                    [012]
    property                                                                    \                    [110]
    value_809_0                                                                    \ (809 0)            [809]
    encode-int                                                                    \                    [111]
    " DevCtl-Addr0"                                                                \                    [012]
    property                                                                    \                    [110]
    value_80a_0                                                                    \ (80a 0)            [80a]
    encode-int                                                                    \                    [111]
    " DevCtl-Addr1"                                                                \                    [012]
    property                                                                    \                    [110]
    value_80b_0                                                                    \ (80b 0)            [80b]
    encode-int                                                                    \                    [111]
    " BMBase-Addr"                                                                \                    [012]
    property                                                                    \                    [110]
    ;                                                                            \                    [0c2]

DearthnVader · Jan 24, 2022

DearthnVader said:

I can't dump the .properties from my QuickSilver G4 due to a bug in Telnet on the QS having no input, however the important thing is the reg and AA properties for 0x24 and 0x30 having a length of 0004000 rather than what Joe has 0001000( 65536 in decimal ) the exact length of our ROM file.

The question is: Can we just change the length with the reg and AA properties or does the card need a hardware mod?

@joevt will you lookout the FCODE and see if you can figure exactly what it does when it fixes the properties for the reg and AA?

Code:

: colon_definition_function_80e                                                    \ (80e)                [0b5 0b7]
    " assigned-addresses"                                                        \                    [012]
    get-my-property                                                                \                    [21a]
    if                                                                            \ (0x23)            [014]
        ." missing ASSIGNED ADDRESSES"                                            \                    [012 090]
        cr                                                                        \                    [092]
        abort                                                                    \                    [216]
    then                                                                        \                    [0b2]
    begin                                                                        \                    [0b1]
        dup                                                                        \                    [047]
        0>                                                                        \                    [038]
        while                                                                    \ (0xca)            [014]
            decode-phys                                                            \                    [128]
            dup                                                                    \                    [047]
            0ff                                                                    \                    [010]
            and                                                                    \                    [023]
            case                                                                \                    [0c4]
                10                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_807_0                                                \ (807 0)            [0c3 807]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x99)            [0c6]
                18                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_808_0                                                \ (808 0)            [0c3 808]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x76)            [0c6]
                14                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_809_0                                                \ (809 0)            [0c3 809]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x53)            [0c6]
                1c                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_80a_0                                                \ (80a 0)            [0c3 80a]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0x30)            [0c6]
                20                                                                \                    [010]
                of                                                                \ (0x1d)            [01c]
                    10                                                            \                    [010]
                    " map-in"                                                    \                    [012]
                    $call-parent                                                \                    [209]
                    to value_80b_0                                                \ (80b 0)            [0c3 80b]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                    decode-int                                                    \                    [21b]
                    drop                                                        \                    [046]
                endof                                                            \ (0xd)                [0c6]
                >r                                                                \                    [030]
                3drop                                                            \                    [046 052]
                decode-int                                                        \                    [21b]
                drop                                                            \                    [046]
                decode-int                                                        \                    [21b]
                drop                                                            \                    [046]
                r>                                                                \                    [031]
            endcase                                                                \                    [0c5]
    repeat                                                                        \ (0xffffff36)        [013 0b2]
    value_807_0                                                                    \ (807 0)            [807]
    encode-int                                                                    \                    [111]
    " TFile-Addr0"                                                                \                    [012]
    property                                                                    \                    [110]
    value_808_0                                                                    \ (808 0)            [808]
    encode-int                                                                    \                    [111]
    " TFile-Addr1"                                                                \                    [012]
    property                                                                    \                    [110]
    value_809_0                                                                    \ (809 0)            [809]
    encode-int                                                                    \                    [111]
    " DevCtl-Addr0"                                                                \                    [012]
    property                                                                    \                    [110]
    value_80a_0                                                                    \ (80a 0)            [80a]
    encode-int                                                                    \                    [111]
    " DevCtl-Addr1"                                                                \                    [012]
    property                                                                    \                    [110]
    value_80b_0                                                                    \ (80b 0)            [80b]
    encode-int                                                                    \                    [111]
    " BMBase-Addr"                                                                \                    [012]
    property                                                                    \                    [110]
    ;                                                                            \                    [0c2]

Success, in soft bricking the card with the Sonnet Flash Utility

I was correct, changing the length to 00010000 was the addition the Sonnet Flasher was looking for, but either the card needs a HW Mod to enable writing more than 16k to the EEPROM or I needed to set some other properties in the Assigned-Addresses property to match JoeVt's dump of his Tempo Trio.

Anyway, the card is now soft bricked with a bad EEPROM flash and I'm not sure id it can be recovered as the device ID is now 00004d68( Ultra100TX2) and the Sonnet Utility won't flash it again, nor will the ptiflash dos utility.

OS 9 is wise to device-id changes to the device tree, so 00004d69 encode-int " device-id" property won't fool the sonnet utility, it reads the device id directly from the PCI Registers on the card. So unless I can figure what resister sets those the card is a brick.

We have to get our hands on a Sonnet Tempo ATA133 and compare it to see of we can find any HW Mod that may enable the full EEPROM.

DearthnVader · Jan 24, 2022

Time to play spot the differances:

DearthnVader · Jan 24, 2022

Anyone know how to increase the copy size in ResEdit?

I hacked the Sonnet Flasher to recognize my soft bricked TX2, but it can still only write 16k to the EEPROM, so I need to replace the 'FWRM' resource with the 16k PC BIOS to try and unsoft brick the card. However Resedit can't copy the PC ROM data fork because it is too large.

eyoungren · Jan 24, 2022

666sheep said:
@eyoungren: thank you, but are you sure it's Sonnet Tempo ATA card with Promise chip? ROM revision on your screenshot and all listed HW IDs match Seritek's 1S2 card. Vendor ID is Silicon Image, device ID is SIL3112. Tempo ATA fimware revisions ended with something close to 4.50 AFAIR.

OK. Finally getting back to you on this.

Here is the box my card came out of. Other than opening up my G3 and physically examining the card, I have to assume it's a Sonnet. I was told it was.

DearthnVader · Jan 24, 2022

eyoungren said:
OK. Finally getting back to you on this.

Here is the box my card came out of. Other than opening up my G3 and physically examining the card, I have to assume it's a Sonnet. I was told it was.

View attachment 1948969 View attachment 1948971

That is a SATA card, we are talking PATA here, please. I'll get around to the Sonnet SATA cards soon.

eyoungren · Jan 24, 2022

DearthnVader said:
That is a SATA card, we are talking PATA here, please. I'll get around to the Sonnet SATA cards soon.

I was responding directly to OP's original post.

I'd like to ask owners of Sonnet Tempo ATA133 and ATA100 PCI for screenshots from System Profiler, PCI tab.

He had asked if I really had a Sonnet Tempo card and I had responded that I would take a pic of the box it came in.

Whatever conversation/discussion has happened between post #6 and now I'm unaware of because I haven't read through.

DearthnVader · Jan 24, 2022

eyoungren said:
I was responding directly to OP's original post.

He had asked if I really had a Sonnet Tempo card and I had responded that I would take a pic of the box it came in.

Whatever conversation/discussion has happened between post #6 and now I'm unaware of because I haven't read through.

Tempo ATA 133/100, NOT SATA.

It's confusing because Sonnet used the "TEMPO" label for a verity of cards.

Anyway, it's all good.?

Back to the topic, I hacked together a Sonnet Flash Utility to recover the PC BiOS to the card from a bad Fcode flash. Still can't flash the full 64k FCODE ROM, but my hack should be useful going forward to recover from a bad flash if needed.

DearthnVader · Jan 24, 2022

So, from @joevt 's Powermac 8600 with the Tempo Trio, the AA properties:

Code:

             81011010 00000000 00001040  00000000 00000010
                        81011014 00000000 00001030  00000000 00000010
                        81011018 00000000 00001020  00000000 00000010
                        8101101C 00000000 00001010  00000000 00000010
                        81011020 00000000 00001000  00000000 00000010
                        82011024 00000000 80820000  00000000 00010000
                        82011030 00000000 80810000  00000000 00010000

And the .properties we get from a PC Ultratek 133 TX2:

Code:

             81011010 00000000 00001040  00000000 00000010
                        81011014 00000000 00001030  00000000 00000010
                        81011018 00000000 00001020  00000000 00000010
                        8101101C 00000000 00001010  00000000 00000010
                        81011020 00000000 00001000  00000000 00000010
                        82011024 00000000 808c0000  00000000 00004000
                        82011030 00000000 80880000  00000000 00004000

We know the last two bytes @0x24 and @0x30 are the length 1040 1030 1020 1010 and 1000 are Base-Addresses 1-5 80880000 is the ROM-Base.

I don't know what 808c0000 @0x24 is, but OS 9 won't boot if I set it to JVT's value.

Joe, do you know the difference between a ROM-Base of 80880000 and 80810000?

I set this in my 4th script, but PCIPeak still see the ROM-Base as 80880000, even tho IONameReg sees the value I set as 80810000. I'm not sure if that has to do with the issue of the Sonnet Flasher not being able to flash the full 64k rom image?

joevt · Jan 24, 2022

DearthnVader said:
@joevt

Isn't 0x30 the standard offset of the EEPROM in the PCI Bus Bindings?

Yes. It's the base address register for the PCI option rom (or expansion rom).
https://developer.apple.com/library...cards_drivers/Designing_PCI_Cards_Drivers.pdf

Go to https://developer.apple.com/library/archive/navigation/ and search for "Open Firmware" or "Expansion Rom"
There's lots of interesting stuff including these:
https://developer.apple.com/library/archive/technotes/tn/tn1044.html#//apple_ref/doc/uid/DTS10002886
https://developer.apple.com/library/archive/technotes/tn/tn2001.html#//apple_ref/doc/uid/DTS10003040

DearthnVader said:
from the reg and assigned-addresses property of you Tempo Trio card:

Code:

reg 00011000 00000000 00000000 00000000 00000000 01011010 00000000 00000000 00000000 00000010 01011014 00000000 00000000 00000000 00000010 01011018 00000000 00000000 00000000 00000010 0101101C 00000000 00000000 00000000 00000010 01011020 00000000 00000000 00000000 00000010 02011024 00000000 00000000 00000000 00010000 02011030 00000000 00000000 00000000 00010000 assigned-addresses 81011010 00000000 00001040 00000000 00000010 81011014 00000000 00001030 00000000 00000010 81011018 00000000 00001020 00000000 00000010 8101101C 00000000 00001010 00000000 00000010 81011020 00000000 00001000 00000000 00000010 82011024 00000000 80820000 00000000 00010000 82011030 00000000 80810000 00000000 00010000

We know the FCode ROM does somefixup of these properties, do you think this maybe why the Sonnet Flasher keeps returning " No Card" even tho I've built all the IONameReg properties in my script?

Because without the reg and assigned-addresses properties of 02011030 00000000 00000000 00000000 00010000 and 82011030 00000000 80810000 00000000 00010000 the flasher can't find the EEPROM?

I dunno. I would have to look at the code.

DearthnVader said:
I can't dump the .properties from my QuickSilver G4 due to a bug in Telnet on the QS having no input, however the important thing is the reg and AA properties for 0x24 and 0x30 having a length of 0004000 rather than what Joe has 0001000( 65536 in decimal ) the exact length of our ROM file.

Might be interesting to create an output method (or override the screen output method) that can output to a buffer allocated in memory and that can be saved to a file. Is there a way to save to a file in Open Firmware? If not, then just save to a device property.

DearthnVader said:
The question is: Can we just change the length with the reg and AA properties or does the card need a hardware mod?

@joevt will you lookout the FCODE and see if you can figure exactly what it does when it fixes the properties for the reg and AA?

That code just appears to be mapping in all the base address registers.

Code:

: colon_definition_function_80e

    " assigned-addresses" get-my-property
    if
        ." missing ASSIGNED ADDRESSES" cr
        abort
    then

    begin dup 0> while
		decode-phys dup 0ff and
		case
			10 of 10 " map-in" $call-parent to value_807_0 decode-int drop decode-int drop endof
			18 of 10 " map-in" $call-parent to value_808_0 decode-int drop decode-int drop endof
			14 of 10 " map-in" $call-parent to value_809_0 decode-int drop decode-int drop endof
			1c of 10 " map-in" $call-parent to value_80a_0 decode-int drop decode-int drop endof
			20 of 10 " map-in" $call-parent to value_80b_0 decode-int drop decode-int drop endof
			>r 3drop decode-int drop decode-int drop r>
		endcase
    repeat

    value_807_0 encode-int " TFile-Addr0"  property \ 10
    value_808_0 encode-int " TFile-Addr1"  property \ 18
    value_809_0 encode-int " DevCtl-Addr0" property \ 14
    value_80a_0 encode-int " DevCtl-Addr1" property \ 1c
    value_80b_0 encode-int " BMBase-Addr"  property \ 20
    ;

DearthnVader said:
Success, in soft bricking the card with the Sonnet Flash Utility

I was correct, changing the length to 00010000 was the addition the Sonnet Flasher was looking for, but either the card needs a HW Mod to enable writing more than 16k to the EEPROM or I needed to set some other properties in the Assigned-Addresses property to match JoeVt's dump of his Tempo Trio.

Seems like your trying to put Sonnet's 64K rom on a chip that's not big enough? Except I don't see a separate rom chip. That means the rom is inside the PDC20269? I can't find a data sheet for that. Is there an external resistor or something that sets the rom size? You could get the decompressed Sonnet rom, remove the OS X mkext and OS 9 ndrv, recompile, then try flashing that.

DearthnVader said:
Anyway, the card is now soft bricked with a bad EEPROM flash and I'm not sure id it can be recovered as the device ID is now 00004d68( Ultra100TX2) and the Sonnet Utility won't flash it again, nor will the ptiflash dos utility.

OS 9 is wise to device-id changes to the device tree, so 00004d69 encode-int " device-id" property won't fool the sonnet utility, it reads the device id directly from the PCI Registers on the card. So unless I can figure what resister sets those the card is a brick.

Easier to modify the sonnet utility.

DearthnVader said:
We have to get our hands on a Sonnet Tempo ATA133 and compare it to see of we can find any HW Mod that may enable the full EEPROM.

Sonnet website appears to have sufficiently high res images. Check the PDF manuals - they may have small images but they might be high res (300 dpi for example) so you can zoom in.

DearthnVader said:
Anyone know how to increase the copy size in ResEdit?

I hacked the Sonnet Flasher to recognize my soft bricked TX2, but it can still only write 16k to the EEPROM, so I need to replace the 'FWRM' resource with the 16k PC BIOS to try and unsoft brick the card. However Resedit can't copy the PC ROM data fork because it is too large.

Is there a version of Resorcerer you can download? Otherwise learn how to use the Rez and Derez commands.

DearthnVader said:
So, from @joevt 's Powermac 8600 with the Tempo Trio, the AA properties:

Code:

81011010 00000000 00001040 00000000 00000010 81011014 00000000 00001030 00000000 00000010 81011018 00000000 00001020 00000000 00000010 8101101C 00000000 00001010 00000000 00000010 81011020 00000000 00001000 00000000 00000010 82011024 00000000 80820000 00000000 00010000 82011030 00000000 80810000 00000000 00010000

And the .properties we get from a PC Ultratek 133 TX2:

Code:

81011010 00000000 00001040 00000000 00000010 81011014 00000000 00001030 00000000 00000010 81011018 00000000 00001020 00000000 00000010 8101101C 00000000 00001010 00000000 00000010 81011020 00000000 00001000 00000000 00000010 82011024 00000000 808c0000 00000000 00004000 82011030 00000000 80880000 00000000 00004000

We know the last two bytes @0x24 and @0x30 are the length 1040 1030 1020 1010 and 1000 are Base-Addresses 1-5 80880000 is the ROM-Base.

I don't know what 808c0000 @0x24 is, but OS 9 won't boot if I set it to JVT's value.

Joe, do you know the difference between a ROM-Base of 80880000 and 80810000?

I set this in my 4th script, but PCIPeak still see the ROM-Base as 80880000, even tho IONameReg sees the value I set as 80810000. I'm not sure if that has to do with the issue of the Sonnet Flasher not being able to flash the full 64k rom image?

The addresses differ depending on the types and sizes of memory allocations that the base address registers of other PCI devices call for. You shouldn't mess with those - you might make overlapping address ranges...
It appears that on Power PC Macs, allocations are made in order of base address register number. The allocations have descending addresses. In my case 24 is allocated at 820000. 30 is allocated next to that at 810000.
Yours is strange because there's 40000 bytes between the start of 24 and 30 instead of the expected 4000. I suppose it could mean that rom base addresses are not assigned until all the normal base address registers are assigned - I guess you should look for other devices that have addresses between 80884000 and 808c000.

DearthnVader · Jan 25, 2022

joevt said:

That code just appears to be mapping in all the base address registers.

Code:

: colon_definition_function_80e

" assigned-addresses" get-my-property
if
." missing ASSIGNED ADDRESSES" cr
abort
then

begin dup 0> while
decode-phys dup 0ff and
case
10 of 10 " map-in" $call-parent to value_807_0 decode-int drop decode-int drop endof
18 of 10 " map-in" $call-parent to value_808_0 decode-int drop decode-int drop endof
14 of 10 " map-in" $call-parent to value_809_0 decode-int drop decode-int drop endof
1c of 10 " map-in" $call-parent to value_80a_0 decode-int drop decode-int drop endof
20 of 10 " map-in" $call-parent to value_80b_0 decode-int drop decode-int drop endof
>r 3drop decode-int drop decode-int drop r>
endcase
repeat

value_807_0 encode-int " TFile-Addr0" property \ 10
value_808_0 encode-int " TFile-Addr1" property \ 18
value_809_0 encode-int " DevCtl-Addr0" property \ 14
value_80a_0 encode-int " DevCtl-Addr1" property \ 1c
value_80b_0 encode-int " BMBase-Addr" property \ 20
;

Joe do you see where value_807 is defined?

I suspect what is going on here is the firmware, among other things, is setting the card up to enable the full EEPROM for the PDC20269( built-in ). Also, the " missing ASSIGNED ADDRESSS" has an abort case, but I don't know what it's looking for that maybe missing?

Does the abort end the code, or it aborts( what? ) and precedes to <then>?

joevt · Jan 25, 2022

Somehow your quote of my post is missing the indenting...

DearthnVader said:
Joe do you see where value_807 is defined?

Probably defined earlier in the code. The initial value is 0 as indicated by the _0 suffix. The value is changed to the result of map-in

DearthnVader said:
I suspect what is going on here is the firmware, among other things, is setting the card up to enable the full EEPROM for the PDC20269( built-in ).

No, map-in just makes the memory and I/O accessible to the code in the expansion rom that let's you use the card while in Open Firmware (for reading and writing to ATA connected devices).
Read the Open Firmware spec and the associated bindings.

DearthnVader said:
Also, the " missing ASSIGNED ADDRESSS" has an abort case, but I don't know what it's looking for that maybe missing?
Does the abort end the code, or it aborts( what? ) and precedes to <then>?

If the result of get-my-property is true then it means assigned-addresses is missing and therefore it calls abort. Remember that Open Firmware uses Forth, and Forth is a stack based language - you add two numbers by putting the numbers on the stack and then executing the + word like this 1 2 +. The condition for the if statement is put on the stack before the if statement. The then statement is actually the end of the code that is executed when the condition is true (it's like fi in bash or } in C or #endif in C's preprocessor). The begin..while..repeat statement is similar. Between begin and while is the conditional. The repeat is the end of the while block.

For each word you need to know what's on the stack before and what will be on the stack after. For this the (... -- ...) notation is used.
For example:
+ (operand1 operand2 -- sum)

So when you're tracing through the code, you can add a comment to show what's on the stack after each word:

Code:

1 \ 1
2 \ 1 2
+ \ 3

DearthnVader · Jan 26, 2022

joevt said:
You could get the decompressed Sonnet rom, remove the OS X mkext and OS 9 ndrv, recompile, then try flashing that.

Ok, this seems like the best bet.

I took the os 9 'NRDV' and the OS X driver.kext from your part2 dump and created a text file to load each in Openfirmware and they work just fine in so far as they both load proper in the device-tree and the OS X diver loads in Tiger and links to the device with my other OF scripts that build the proper names in the device tree.

So I'm going to need quite a bit of your help building the new FCode rom if we can get it below 16k, as I've never toked a rom from a detokenized rom before.

I'm not sure how to start decompressing the rom or removing the 'NDRV' and .kext file?

joevt · Jan 26, 2022

1) grab a version of the firmware from Sonnet that you want to use. What version are you choosing? Use derez to extract the firmware resource. sed to convert to hex. xxd to convert to binary. (use the script I provided previously)
2) edit the firmware so you can get access to the decompressed part and dump it. DumpPciRom to get a 4th file. Edit. toke to convert to binary. DumpPciRom that to get another 4th to compare with the first to make sure toke worked correctly. One of the edits you should try is change headerless to external.
3) take the dumped decompressed part and make a rom from that. Remove the ndrv and kext parts so the rom is small enough.

joevt · Jan 26, 2022

iMac G3 (tray) bootROM dump (1Mbyte)

For disassembly, the DumpMacRom script calls the detok command which uses a PowerPC disassembler library that was included with MPW (without source code) so I didn't try to convert that stuff to Mac OS X. The Power Mac G5 Quad Core was nearly the last Open Firmware Mac made. The interesting...

forums.macrumors.com

DearthnVader · Jan 28, 2022

joevt said:
1) grab a version of the firmware from Sonnet that you want to use. What version are you choosing? Use derez to extract the firmware resource. sed to convert to hex. xxd to convert to binary. (use the script I provided previously)
2) edit the firmware so you can get access to the decompressed part and dump it. DumpPciRom to get a 4th file. Edit. toke to convert to binary. DumpPciRom that to get another 4th to compare with the first to make sure toke worked correctly. One of the edits you should try is change headerless to external.
3) take the dumped decompressed part and make a rom from that. Remove the ndrv and kext parts so the rom is small enough.

Not sure about step 2 as far as how to decompress?

Here is what I have so far if you can help with the toke errors and warning:

Code:

 toke -v /Users/jam/Documents/test3.txt > Sonnet.bin
Advisory:  File /Users/jam/Documents/test3.txt, Line 27.  PCI header revision=0x0000
Advisory:  File /Users/jam/Documents/test3.txt, Line 31.  (Output Position = 52).  PCI header vendor id=0x105a, device id=0x4d69, class=018085
Advisory:  File /Users/jam/Documents/test3.txt, Line 34.  (Output Position = 52).  (PCI-Block Position = 0).  FCODE-VERSION2 encountered; processing...
Warning:  File /Users/jam/Documents/test3.txt, Line 1500.  (Output Position = 4879).  (PCI-Block Position = 4827).  Duplicate definition:   colon_definition_function_825  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1507.  (Output Position = 4888).  (PCI-Block Position = 4836).  Duplicate definition:   colon_definition_function_826  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1514.  (Output Position = 4898).  (PCI-Block Position = 4846).  Duplicate definition:   colon_definition_function_827  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1521.  (Output Position = 4908).  (PCI-Block Position = 4856).  Duplicate definition:   colon_definition_function_828  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1528.  (Output Position = 4918).  (PCI-Block Position = 4866).  Duplicate definition:   colon_definition_function_829  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1535.  (Output Position = 4928).  (PCI-Block Position = 4876).  Duplicate definition:   colon_definition_function_82a  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1542.  (Output Position = 4938).  (PCI-Block Position = 4886).  Duplicate definition:   colon_definition_function_82b  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1549.  (Output Position = 4948).  (PCI-Block Position = 4896).  Duplicate definition:   colon_definition_function_82c  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1556.  (Output Position = 4958).  (PCI-Block Position = 4906).  Duplicate definition:   colon_definition_function_82d  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1563.  (Output Position = 4968).  (PCI-Block Position = 4916).  Duplicate definition:   colon_definition_function_82e  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1570.  (Output Position = 4978).  (PCI-Block Position = 4926).  Duplicate definition:   colon_definition_function_82f  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1577.  (Output Position = 4988).  (PCI-Block Position = 4936).  Duplicate definition:   colon_definition_function_830  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1584.  (Output Position = 4998).  (PCI-Block Position = 4946).  Duplicate definition:   colon_definition_function_831  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1591.  (Output Position = 5008).  (PCI-Block Position = 4956).  Duplicate definition:   colon_definition_function_832  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1598.  (Output Position = 5018).  (PCI-Block Position = 4966).  Duplicate definition:   colon_definition_function_833  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1605.  (Output Position = 5028).  (PCI-Block Position = 4976).  Duplicate definition:   colon_definition_function_834  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1612.  (Output Position = 5038).  (PCI-Block Position = 4986).  Duplicate definition:   colon_definition_function_835  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1623.  (Output Position = 5068).  (PCI-Block Position = 5016).  Duplicate definition:   colon_definition_function_83a  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1630.  (Output Position = 5078).  (PCI-Block Position = 5026).  Duplicate definition:   colon_definition_function_83b  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1637.  (Output Position = 5088).  (PCI-Block Position = 5036).  Duplicate definition:   colon_definition_function_83c  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1643.  (Output Position = 5096).  (PCI-Block Position = 5044).  Duplicate definition:   colon_definition_function_83d  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1649.  (Output Position = 5104).  (PCI-Block Position = 5052).  Duplicate definition:   colon_definition_function_83e  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1655.  (Output Position = 5112).  (PCI-Block Position = 5060).  Duplicate definition:   colon_definition_function_83f  already exists as a COLON in the top-level device-node, which began on line 34
Error:  File /Users/jam/Documents/test3.txt, Line 1727.  (Output Position = 5250).  (PCI-Block Position = 5198).  The REPEAT is mismatched with the IF on line 1720 in definition of  COLON_DEFINITION_FUNCTION_845  , which started on line 1704
Error:  File /Users/jam/Documents/test3.txt, Line 1728.  (Output Position = 5251).  (PCI-Block Position = 5199).  The THEN is mismatched with the BEGIN on line 1706 in definition of  COLON_DEFINITION_FUNCTION_845  , which started on line 1704
Warning:  File /Users/jam/Documents/test3.txt, Line 2434.  (Output Position = 6638).  (PCI-Block Position = 6586).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2435.  (Output Position = 6639).  (PCI-Block Position = 6587).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2442.  (Output Position = 6649).  (PCI-Block Position = 6597).  Possible Return-Stack deficit before termination, in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2480.  (Output Position = 6714).  (PCI-Block Position = 6662).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2481.  (Output Position = 6715).  (PCI-Block Position = 6663).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2488.  (Output Position = 6725).  (PCI-Block Position = 6673).  Possible Return-Stack deficit before termination, in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2767.  (Output Position = 7292).  (PCI-Block Position = 7240).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3059.  (Output Position = 8154).  (PCI-Block Position = 8102).  Encountered new-device.  Starting new device-node.
Warning:  File /Users/jam/Documents/test3.txt, Line 3125.  (Output Position = 8481).  (PCI-Block Position = 8429).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3177.  (Output Position = 8659).  (PCI-Block Position = 8607).  Encountered new-device.  Starting new device-node.  Suspending definitions of parent-device node that started on line 3059
Warning:  File /Users/jam/Documents/test3.txt, Line 3231.  (Output Position = 8958).  (PCI-Block Position = 8906).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3371.  (Output Position = 9404).  (PCI-Block Position = 9352).  Encountered finish-device.  Resetting definitions of device node that started on line 3177
Advisory:  File /Users/jam/Documents/test3.txt, Line 3371.  (Output Position = 9404).  (PCI-Block Position = 9352).  Resuming definitions of parent device-node that started on line 3059
Advisory:  File /Users/jam/Documents/test3.txt, Line 3372.  (Output Position = 9406).  (PCI-Block Position = 9354).  Encountered finish-device.  Resetting definitions of device node that started on line 3059
Advisory:  File /Users/jam/Documents/test3.txt, Line 3372.  (Output Position = 9406).  (PCI-Block Position = 9354).  Resuming definitions since start of tokenization.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3373.  (Output Position = 9408).  (PCI-Block Position = 9356).  Encountered new-device.  Starting new device-node.
Warning:  File /Users/jam/Documents/test3.txt, Line 3439.  (Output Position = 9735).  (PCI-Block Position = 9683).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3491.  (Output Position = 9913).  (PCI-Block Position = 9861).  Encountered new-device.  Starting new device-node.  Suspending definitions of parent-device node that started on line 3373
Warning:  File /Users/jam/Documents/test3.txt, Line 3545.  (Output Position = 10212).  (PCI-Block Position = 10160).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3685.  (Output Position = 10658).  (PCI-Block Position = 10606).  Encountered finish-device.  Resetting definitions of device node that started on line 3491
Advisory:  File /Users/jam/Documents/test3.txt, Line 3685.  (Output Position = 10658).  (PCI-Block Position = 10606).  Resuming definitions of parent device-node that started on line 3373
Advisory:  File /Users/jam/Documents/test3.txt, Line 3686.  (Output Position = 10660).  (PCI-Block Position = 10608).  Encountered finish-device.  Resetting definitions of device node that started on line 3373
Advisory:  File /Users/jam/Documents/test3.txt, Line 3686.  (Output Position = 10660).  (PCI-Block Position = 10608).  Resuming definitions since start of tokenization.
Error:  File /Users/jam/Documents/test3.txt, Line 3929.  (Output Position = 11157).  (PCI-Block Position = 11105).  Word  [110]  is not in dictionary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3961.  (Output Position = 11472).  (PCI-Block Position = 11420).  FCODE-END encountered; processing...
Advisory:  File /Users/jam/Documents/test3.txt, Line 3968.  (Output Position = 11776).  FCODE-END encountered; processing...
Error:  File /Users/jam/Documents/test3.txt, Line 3968.  (Output Position = 11777).  Missing FCode header.

joevt · Jan 28, 2022

DearthnVader said:
Not sure about step 2 as far as how to decompress?

The code decompresses itself. You run the code and grab the results.

DearthnVader said:

Here is what I have so far if you can help with the toke errors and warning:

Code:

 toke -v /Users/jam/Documents/test3.txt > Sonnet.bin
Advisory:  File /Users/jam/Documents/test3.txt, Line 27.  PCI header revision=0x0000
Advisory:  File /Users/jam/Documents/test3.txt, Line 31.  (Output Position = 52).  PCI header vendor id=0x105a, device id=0x4d69, class=018085
Advisory:  File /Users/jam/Documents/test3.txt, Line 34.  (Output Position = 52).  (PCI-Block Position = 0).  FCODE-VERSION2 encountered; processing...
Warning:  File /Users/jam/Documents/test3.txt, Line 1500.  (Output Position = 4879).  (PCI-Block Position = 4827).  Duplicate definition:   colon_definition_function_825  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1507.  (Output Position = 4888).  (PCI-Block Position = 4836).  Duplicate definition:   colon_definition_function_826  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1514.  (Output Position = 4898).  (PCI-Block Position = 4846).  Duplicate definition:   colon_definition_function_827  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1521.  (Output Position = 4908).  (PCI-Block Position = 4856).  Duplicate definition:   colon_definition_function_828  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1528.  (Output Position = 4918).  (PCI-Block Position = 4866).  Duplicate definition:   colon_definition_function_829  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1535.  (Output Position = 4928).  (PCI-Block Position = 4876).  Duplicate definition:   colon_definition_function_82a  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1542.  (Output Position = 4938).  (PCI-Block Position = 4886).  Duplicate definition:   colon_definition_function_82b  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1549.  (Output Position = 4948).  (PCI-Block Position = 4896).  Duplicate definition:   colon_definition_function_82c  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1556.  (Output Position = 4958).  (PCI-Block Position = 4906).  Duplicate definition:   colon_definition_function_82d  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1563.  (Output Position = 4968).  (PCI-Block Position = 4916).  Duplicate definition:   colon_definition_function_82e  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1570.  (Output Position = 4978).  (PCI-Block Position = 4926).  Duplicate definition:   colon_definition_function_82f  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1577.  (Output Position = 4988).  (PCI-Block Position = 4936).  Duplicate definition:   colon_definition_function_830  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1584.  (Output Position = 4998).  (PCI-Block Position = 4946).  Duplicate definition:   colon_definition_function_831  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1591.  (Output Position = 5008).  (PCI-Block Position = 4956).  Duplicate definition:   colon_definition_function_832  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1598.  (Output Position = 5018).  (PCI-Block Position = 4966).  Duplicate definition:   colon_definition_function_833  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1605.  (Output Position = 5028).  (PCI-Block Position = 4976).  Duplicate definition:   colon_definition_function_834  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1612.  (Output Position = 5038).  (PCI-Block Position = 4986).  Duplicate definition:   colon_definition_function_835  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1623.  (Output Position = 5068).  (PCI-Block Position = 5016).  Duplicate definition:   colon_definition_function_83a  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1630.  (Output Position = 5078).  (PCI-Block Position = 5026).  Duplicate definition:   colon_definition_function_83b  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1637.  (Output Position = 5088).  (PCI-Block Position = 5036).  Duplicate definition:   colon_definition_function_83c  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1643.  (Output Position = 5096).  (PCI-Block Position = 5044).  Duplicate definition:   colon_definition_function_83d  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1649.  (Output Position = 5104).  (PCI-Block Position = 5052).  Duplicate definition:   colon_definition_function_83e  already exists as a COLON in the top-level device-node, which began on line 34
Warning:  File /Users/jam/Documents/test3.txt, Line 1655.  (Output Position = 5112).  (PCI-Block Position = 5060).  Duplicate definition:   colon_definition_function_83f  already exists as a COLON in the top-level device-node, which began on line 34
Error:  File /Users/jam/Documents/test3.txt, Line 1727.  (Output Position = 5250).  (PCI-Block Position = 5198).  The REPEAT is mismatched with the IF on line 1720 in definition of  COLON_DEFINITION_FUNCTION_845  , which started on line 1704
Error:  File /Users/jam/Documents/test3.txt, Line 1728.  (Output Position = 5251).  (PCI-Block Position = 5199).  The THEN is mismatched with the BEGIN on line 1706 in definition of  COLON_DEFINITION_FUNCTION_845  , which started on line 1704
Warning:  File /Users/jam/Documents/test3.txt, Line 2434.  (Output Position = 6638).  (PCI-Block Position = 6586).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2435.  (Output Position = 6639).  (PCI-Block Position = 6587).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2442.  (Output Position = 6649).  (PCI-Block Position = 6597).  Possible Return-Stack deficit before termination, in definition of  COLON_DEFINITION_FUNCTION_877  , which started on line 2399
Warning:  File /Users/jam/Documents/test3.txt, Line 2480.  (Output Position = 6714).  (PCI-Block Position = 6662).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2481.  (Output Position = 6715).  (PCI-Block Position = 6663).  Possible Return-Stack access attempt by R> without value having been placed there in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2488.  (Output Position = 6725).  (PCI-Block Position = 6673).  Possible Return-Stack deficit before termination, in definition of  COLON_DEFINITION_FUNCTION_878  , which started on line 2445
Warning:  File /Users/jam/Documents/test3.txt, Line 2767.  (Output Position = 7292).  (PCI-Block Position = 7240).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3059.  (Output Position = 8154).  (PCI-Block Position = 8102).  Encountered new-device.  Starting new device-node.
Warning:  File /Users/jam/Documents/test3.txt, Line 3125.  (Output Position = 8481).  (PCI-Block Position = 8429).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3177.  (Output Position = 8659).  (PCI-Block Position = 8607).  Encountered new-device.  Starting new device-node.  Suspending definitions of parent-device node that started on line 3059
Warning:  File /Users/jam/Documents/test3.txt, Line 3231.  (Output Position = 8958).  (PCI-Block Position = 8906).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3371.  (Output Position = 9404).  (PCI-Block Position = 9352).  Encountered finish-device.  Resetting definitions of device node that started on line 3177
Advisory:  File /Users/jam/Documents/test3.txt, Line 3371.  (Output Position = 9404).  (PCI-Block Position = 9352).  Resuming definitions of parent device-node that started on line 3059
Advisory:  File /Users/jam/Documents/test3.txt, Line 3372.  (Output Position = 9406).  (PCI-Block Position = 9354).  Encountered finish-device.  Resetting definitions of device node that started on line 3059
Advisory:  File /Users/jam/Documents/test3.txt, Line 3372.  (Output Position = 9406).  (PCI-Block Position = 9354).  Resuming definitions since start of tokenization.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3373.  (Output Position = 9408).  (PCI-Block Position = 9356).  Encountered new-device.  Starting new device-node.
Warning:  File /Users/jam/Documents/test3.txt, Line 3439.  (Output Position = 9735).  (PCI-Block Position = 9683).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3491.  (Output Position = 9913).  (PCI-Block Position = 9861).  Encountered new-device.  Starting new device-node.  Suspending definitions of parent-device node that started on line 3373
Warning:  File /Users/jam/Documents/test3.txt, Line 3545.  (Output Position = 10212).  (PCI-Block Position = 10160).  Duplicate definition:   dma-alloc  already exists in the core vocabulary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3685.  (Output Position = 10658).  (PCI-Block Position = 10606).  Encountered finish-device.  Resetting definitions of device node that started on line 3491
Advisory:  File /Users/jam/Documents/test3.txt, Line 3685.  (Output Position = 10658).  (PCI-Block Position = 10606).  Resuming definitions of parent device-node that started on line 3373
Advisory:  File /Users/jam/Documents/test3.txt, Line 3686.  (Output Position = 10660).  (PCI-Block Position = 10608).  Encountered finish-device.  Resetting definitions of device node that started on line 3373
Advisory:  File /Users/jam/Documents/test3.txt, Line 3686.  (Output Position = 10660).  (PCI-Block Position = 10608).  Resuming definitions since start of tokenization.
Error:  File /Users/jam/Documents/test3.txt, Line 3929.  (Output Position = 11157).  (PCI-Block Position = 11105).  Word  [110]  is not in dictionary.
Advisory:  File /Users/jam/Documents/test3.txt, Line 3961.  (Output Position = 11472).  (PCI-Block Position = 11420).  FCODE-END encountered; processing...
Advisory:  File /Users/jam/Documents/test3.txt, Line 3968.  (Output Position = 11776).  FCODE-END encountered; processing...
Error:  File /Users/jam/Documents/test3.txt, Line 3968.  (Output Position = 11777).  Missing FCode header.

Why did you comment out the tokenizer directives at the beginning? If you don't want a PCI header, then don't include any of the PCI header tokenizer directives.

Why did you not include the next-fcode fix I mentioned previously for variable_124? It's probably not necessary but it makes the comparison of the original and modified firmwares easier.

Why is to (fcode 0c3) replaced with ! in colon_definition_function_82f and colon_definition_function_83d? What did you use to produce this file?
Why is lshift (fcode 027) replaced with <<? It seems you are using an older version of detok instead of my detok.
Why is variable_124 replaced with mask? It seems you are using a buggy version of detok instead of my detok. Actually, it might be a problem in my detok as well. The detok log includes this message:
Line 29 # Ignored attempt to make predefined reserved token 0x124 "mask" unnamed if I try to use 124 next-fcode.

It seems that FirmTek created a variable named mask but their tokenizer gave it the 0x124 fcode number because the name conflicts with that word which exists in the OpenFirmware spec.
I think maybe the best solution is to give this variable an fcode number that is not reserved - and give it a name that is not reserved, such as themask.

Why is line 3929 missing a \ before the comment?

Why did you not remove the extra FCODE-END on line Line 3961? I mentioned this issue previously. Actually, I don't know if that's a problem. If you remove it, DumpPCIRom of the resulting bin will probably re-add it. So never mind about that.

Why did you include the decompressing code but not call that code (everything before the first headerless) ?

Why does the decompressing code not have the FirmTek property to be decompressed?

Why did you append the decompressed code after the decompressing code?

Why do you think it's a good idea to include two sets of code that use the same variable and/or function names? (the first error mentions colon_definition_function_825 )

Why not change all headerless to external like you did in the decompressing code? (maybe because I didn't tell you to, or it increases the size too much, or you don't need to debug that part)

toke is complaining about something weird in colon_definition_function_845. It appears to be able to produce the same output as was seen by detok but that doesn't mean its right. Maybe my DumpPCIRom is not interpreting the detok output properly. Interpreting conditionals and loops is the most interesting part of DumpPCIRom (the fcode does not use the same words as the forth code).

The weird thing about it is that if ... then is intertwined into begin ... while ... repeat.
Here is the fcode from detok:

Code:

new-token \ [0x0b5] 0x845
b(:) \ [0x0b7] 
	get-msecs \ [0x125] 
	b(<mark) \ [0x0b1] 
		unnamed_fcode_842 \ [0x842] 
		dup \ [0x047] 
		0<> \ [0x035] 
		over \ [0x048] 
		b(lit) \ [0x010] 0xff
		<> \ [0x03d] 
		and \ [0x023] 
		swap \ [0x049] 
		b(lit) \ [0x010] 0xc0
		and \ [0x023] 
		b(lit) \ [0x010] 0x40
		<> \ [0x03d] 
		and \ [0x023] 
		b?branch \ [0x014] 0x14
			get-msecs \ [0x125] 
			over \ [0x048] 
			- \ [0x01f] 
			b(lit) \ [0x010] 0x1388
			< \ [0x03a] 
			b?branch \ [0x014] 0x6
				bbranch \ [0x013] 0xffffffd5
			b(>resolve) \ [0x0b2] 
		b(>resolve) \ [0x0b2] 
	drop \ [0x046] 
	b(;) \ [0x0c2]

And here's the interpretation:

Code:

: colon_definition_function_845													\ (845)				[0b5 0b7]
	get-msecs																	\					[125]
	begin																		\					[0b1]
		colon_definition_function_842											\ (842)				[842]
		dup																		\					[047]
		0<>																		\					[035]
		over																	\					[048]
		0ff																		\					[010]
		<>																		\					[03d]
		and																		\					[023]
		swap																	\					[049]
		0c0																		\					[010]
		and																		\					[023]
		40																		\					[010]
		<>																		\					[03d]
		and																		\					[023]
		if																		\ (0x14)			[014]
			get-msecs															\					[125]
			over																\					[048]
			-																	\					[01f]
			1388																\					[010]
			<																	\					[03a]
			while																\ (0x6)				[014]
		repeat																	\ (0xffd5)			[013 0b2]
	then																		\					[0b2]
	drop																		\					[046]
	;																			\					[0c2]

I think it's probably fine. It just looks weird.

DearthnVader · Jan 29, 2022

joevt said:
Why did you comment out the tokenizer directives at the beginning? If you don't want a PCI header, then don't include any of the PCI header tokenizer directives.

The version of toke I was using was choking on these.

joevt said:
Why did you not include the next-fcode fix I mentioned previously for variable_124? It's probably not necessary but it makes the comparison of the original and modified firmwares easier.

I missed that somehow.

joevt said:
Why is to (fcode 0c3) replaced with ! in colon_definition_function_82f and colon_definition_function_83d? What did you use to produce this file?

OF on my Quicksilver was choking on the improper use of TO when I run this text file and toke was recommending I change it to !. That fixed the issue on the QS so I figured it was a proper fix.

joevt said:
Why is variable_124 replaced with mask? It seems you are using a buggy version of detok instead of my detok.

Must have used my local detok rather than your's

joevt said:
Why is line 3929 missing a \ before the comment?

Why did you not remove the extra FCODE-END on line Line 3961? I mentioned this issue previously. Actually, I don't know if that's a problem. If you remove it, DumpPCIRom of the resulting bin will probably re-add it. So never mind about that.

Why did you include the decompressing code but not call that code (everything before the first headerless) ?

Why does the decompressing code not have the FirmTek property to be decompressed?

Why did you append the decompressed code after the decompressing code?

Why do you think it's a good idea to include two sets of code that use the same variable and/or function names? (the first error mentions colon_definition_function_825 )

Why not change all headerless to external like you did in the decompressing code? (maybe because I didn't tell you to, or it increases the size too much, or you don't need to debug that part)

Mostly because I just don't know what I'm doing, this is just my copy, paste, debug hatchet job. Most of this code I just don't understand.

joevt · Jan 29, 2022

DearthnVader said:
The version of toke I was using was choking on these.

Use my version so we're on the same page.

DearthnVader said:
OF on my Quicksilver was choking on the improper use of TO when I run this text file and toke was recommending I change it to !. That fixed the issue on the QS so I figured it was a proper fix.

The Open Firmware spec says that to should only be used for value and defer words and not for variable words so maybe your toke is correct but you need to put the ! after the variable name for the suggested fix to work.

Does this mean there's a bug in the FirmTek code? Or does the b(to) fcode in Mac Open Firmware know how to store a value to a variable even though it won't let you generate that fcode from interpreted text?

DearthnVader said:
Mostly because I just don't know what I'm doing, this is just my copy, paste, debug hatchet job. Most of this code I just don't understand.

First step I listed was choosing a Sonnet firmware to play with. Instead you chose the decompressed firmware from my Tempo Trio?

DearthnVader · Jan 29, 2022

I picked up a FastTrack100TX2 because it was cheap and I knew it uses a 66k rom file. I was able to hack the sonnet flasher to flash it and it reported success, however, soft brick.

It changed the device id from 105a,6268 to 105a,4d68 same as the UltraTek133 after the flash.

Not sure if the full FCODE rom was written to the card, but the device ID would need to be edited or OF will ignore the FCODE as the device id must match between the PCI registers and the PCI header.

It also changed the ROM Size in the reg and AA to 0x4000(16k) so now I have to figure how to get it back to 0x1000( 66k ).

I flashed it with my recovery rom( 16k ) for the UltraTek133 TX2 PC ROM and changed the device ids, but the rom checks for PDC20269 and this chip is the RAID PDC20270, so the standard rom won't work on the RAID PDC unless we find a way to bypass the check in the PC BIOS. No matter, we only want to flash to Mac and I don't need HW RAID on my PC.

So I used @joevt 's version of toke to make and FCODE ROM from his test3_2.4th file linked in post#67. I padded the file to make it 16k, as it was only 10k, hacked the Sonnet flasher, and used an Fcode script to change the .properties the Sonnet Flasher needs. Flashed the ROM to the card and it works, somewhat.

Open Firmware doesn't find any disks connected to the card /pci/UlrtaTek133/FrmTk-0/sd but no /disk@.

@joevt I can't figure where the FCODE should be scanning for connected drives?

So the drive is not directly bootable from OF, but does work in OS 9 and OS X if we load the 'NDRV' or OS X Kext into Open Firmware from the two scripts I created to do this.

Now we boot the Mac OS/X and we see our drives and they work as expected.

As I say, you can't boot directly from OF until we figure out the drive scanning code, but you can use a redirect to boot OS 9 or OS X from the Connected drives, you just have to use a helper disk to get the :tbxi which will chain load the OS 9 'NDRV' or OS X .kext and allow the redirect.

joevt · Jan 29, 2022

I would expect that if OS 9 and OS X can use the card using the ndrv and mkext, then the OF code where those originated from should also be able to use the card.
Can you post your work, starting from the firmware that contained the OS 9 and OS X drivers? But wait, those come from the uncompressed firmware and you have not gotten to the step of being able to extract uncompressed firmware yet.

joevt · Jan 29, 2022

I think I know about redirect for OS X (boot ≠ root or something - like what XPostFacto used). What does a redirect to boot OS 9 look like?

DearthnVader · Jan 30, 2022

joevt said:
I would expect that if OS 9 and OS X can use the card using the ndrv and mkext, then the OF code where those originated from should also be able to use the card.
Can you post your work, starting from the firmware that contained the OS 9 and OS X drivers? But wait, those come from the uncompressed firmware and you have not gotten to the step of being able to extract uncompressed firmware yet.

I'm a bit confused about decompressing the compressed part, you dumped it via telnet?

I can't do it that way, I don't have a card with the full rom, OF fails to build the driver-buffer and OpenBios fails somewhere in the decompression code, when loading the full rom file from disk.

joevt said:
I think I know about redirect for OS X (boot ≠ root or something - like what XPostFacto used). What does a redirect to boot OS 9 look like?

It's a bit of dump luck boot OS 9, just load :tbxi from OF and hope it finds the blessed System Folder on the add-in card first.

Just lucky that works on my QS:

Code:

dev pci/@14
boot hd:,\ppc\ndrvsonnetata.txt
boot hd:,\\:tbxi #where hd: is the first partion of the QS buily-in ATA66 bus

The Mac OS ROM loads the compressed 4MB bootrom, decompresses it and loads all 'NDRV's in the device-tree, then because we didn't specify a System Folder it will scan connected drives until it finds a blessed System Folder. Like I say I'm just lucky it finds the one on the add-in card before it finds the one we load the :tbxi from on the internal ATA66 bus.

You can load the :tbxi from anywhere accessible to OF, so if the only blessed System Folder in on the add-in card, then it should boot that every time, you'll just be stuck at ? until it scans and finds it.

joevt · Jan 30, 2022

DearthnVader said:
I'm a bit confused about decompressing the compressed part, you dumped it via telnet?

It was on a Power Mac 8600 so I probably used serial port.
The first part of the firmware decompresses the second part from the firmtek property that is created by the first part (and that is subsequently removed). The decompressed data (which is fcode without pci header) is left in the dictionary memory even after the first part uses byte-load to execute it. I dumped all the dictionary over serial port and found the fcode hiding in there.

DearthnVader said:
I can't do it that way, I don't have a card with the full rom,

so you use a method to load the firmware from elsewhere, such as disk

DearthnVader said:
OF fails to build the driver-buffer and OpenBios fails somewhere in the decompression code, when loading the full rom file from disk.

I suppose this would be an interesting thing to debug. Add some extra lines that output the progress (like printf in a C program or echo in a bash script).
Comment out the byte-load from the end of the first part. If the execution gets that far, then you have the decompressed fcode in memory and can dump it.
You may need to comment out some stuff in the first part that depends on the device (such as the part that checks if assigned properties exists).

DearthnVader said:
It's a bit of dump luck boot OS 9, just load :tbxi from OF and hope it finds the blessed System Folder on the add-in card first.

Just lucky that works on my QS:

Code:

dev pci/@14 boot hd:,\ppc\ndrvsonnetata.txt boot hd:,\\:tbxi #where hd: is the first partion of the QS buily-in ATA66 bus

The Mac OS ROM loads the compressed 4MB bootrom, decompresses it and loads all 'NDRV's in the device-tree, then because we didn't specify a System Folder it will scan connected drives until it finds a blessed System Folder. Like I say I'm just lucky it finds the one on the add-in card before it finds the one we load the :tbxi from on the internal ATA66 bus.

You can load the :tbxi from anywhere accessible to OF, so if the only blessed System Folder in on the add-in card, then it should boot that every time, you'll just be stuck at ? until it scans and finds it.

I don't quite understand the order of things. The ndrv is on the built-in drive and you load it as a property. Then you execute the boot command to search for files of type txbi. Which txbi file does it find? The one on the built-in drive? So why would that txbi on the built in drive then switch to booting stuff in the firmtek card? Maybe you can modify each txbi so that they each add a unique property to the device tree. Then you can know which one got booted.

DearthnVader · Jan 30, 2022

Ok, quick update:

The ROM @joevt and I made to fit within the first 16k of the flashrom enables us to load the full rom from disk and execute it proper on my Quicksilver. I've yet to test it on on Beige G3/PM9600 so I'll update when I do.

The good news is I can now boot the Mac OS from a drive connected to the Ultra-Tek133P+ directly fro Open Firmware without the need for the redirect.

We just have a few final steps to figure out what type of magic Promise uses to mask the device-id and how to enable the full 66k of the flashrom.

@joevt I should now be able to dump the uncompressed part of the ROM via telnet assuming the card will work in my G5( untested by me ).

I'm going to be working with the Sonnet FCODE ROM V4.5.0 as that was the latest version, still available on Sonnet's website, and it has 48bit LBA( still untested by me ).

Sonnet Tempo ATA133 and ATA100 PCI - PROMISE cards flashing quest

Suspended

Suspended

Suspended

Suspended

macrumors Nehalem

Suspended

macrumors Nehalem

Suspended

Suspended

macrumors 604

Suspended

macrumors 604

Suspended

macrumors 604

macrumors 604

Suspended

Attachments

macrumors 604

Attachments

Suspended

macrumors 604

Suspended

macrumors 604

macrumors 604

Suspended

macrumors 604

Suspended

Our Staff