Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Thanks for looking at the ROM. Based on your reply I went ahead and put in a 7448. It sort of works. It will bong and boot to OF, it will boot the linux image, but it will not boot OSX. How do I edit the NVRAMRC now? I have a powerlogix firmware CD, but when I boot that it doesn't recognize the system and there is no opportunity to apply the NVRAMRC patch.

flashrom3.jpg
 
Thanks for looking at the ROM. Based on your reply I went ahead and put in a 7448. It sort of works. It will bong and boot to OF, it will boot the linux image, but it will not boot OSX. How do I edit the NVRAMRC now? I have a powerlogix firmware CD, but when I boot that it doesn't recognize the system and there is no opportunity to apply the NVRAMRC patch.

flashrom3.jpg

oh wow thats F*cking amazing to see it works

do you have a picture of the 7448 on the Mac Mini Lobo? :)

I sadly dont have it on this Machine but on my Mac Pro, I have the NVRAMRC patch I manually dumped from my Sawtooth, ill grab and post about that tomorrow unless @dosdude1 has it on hand (its how I got OS X to boot natively on @dosdude1's 7448 iMac)

it makes sense OS X does not boot as it does not have native 7448 support and the NVRAM patch basically makes OS X think its booting on a 7447A

if you use my custom 604 tiger kernel that will get OS X booting (but without any proper CPU support note About this Mac will just report PowerPC) but should be enough for you to get the NVRAMRC patch in place

so you can get OS X to recognise the CPU as a G4 and then put the stock kernel back (and Boot 10.5.8 etc)

some more details can be had here if your curious



BTW could you post a

dev /cpus/PowerPC,G4 .properties


output from open Firmware?

(it may also show up as PowerPC,60? in OpenFirmware but I have a feeling OF is properly detecting it fully since I see linux is reporting the Full L2 cache which I know it wont do if OF does not report it)
 
Last edited:
I'm not a wiz with open firmware, maybe this is what you want?:

flashrom4.jpg


I'll have to remove the heatsink again at some point to set the CPU speed and I can take a picture then.

I was digging though the powerlogix CD and there is a section that might be the NVRAMRC thing:

Code:
"(F1084C2A00000103120A6465766963652D656E64CDA5CA065F2E6C2E72310800B8A5CA065F2E6C2E72320801B812192F6F70656E70726F6D2F636C69656E742D⁄Ä7365727669636573120B66696E642D646576696365CD120B5B275D2071756965736365CDC30800CA07717569657363650802B708001D08011DC2120A64657669⁄Ä63652D656E64CDCA055F2E6C2E720803B7120C00000024FFFF0000800300001000004000B14A4AA74EA74EA74E7AA53C1400205210000000041E4710FFF80000⁄Ä497310800000004910000000041E7333B24A10000000041E471003FFFFF83C14FFC54652C2120470767240CD10FFFF00002310800400003C140009110803C308⁄L01B200)" dup -rot alloc-mem dup 2swap -rot move 1 byte-load \ PLX-OSX-PATCH
⁄ install-nvram-patch-x€∑√‘√’’‘
PLX-OSX-PATCHç
 
Here's the NVRAM keys that need to be set in order to boot OS X. I had a custom program/bootable CD image I made to make this really easy, but I seem to have lost the disc image unfortunately.
 

Attachments

  • NVRAMRC.txt
    622 bytes · Views: 124
Ok, I patched a different computer with the powerlogix CD then did a nvram -p to get a copy of what it put in. So now how can I get this into the mini? What are the details/instructions for the custom kernel?

Code:
nvramrc  " "(F1084C2A00000103120A6465766963652D656E64CDA5CA065F2E6C2E72310800B8A5CA065F2E6C2E72320801B812192F6F70656E70726F6D2F636C69656E742D7365727669636573120B66696E642D646576696365CD120B5B275D2071756965736365CDC30800CA07717569657363650802B708001D08011DC2120A6465766963652D656E64CDCA055F2E6C2E720803B7120C00000024FFFF0000800300001000004000B14A4AA74EA74EA74E7AA53C1400205210000000041E4710FFF80000497310800000004910000000041E7333B24A10000000041E471003FFFFF83C14FFC54652C2120470767240CD10FFFF00002310800400003C140009110803C30801B200)" dup -rot alloc-mem dup 2swap -rot move 1 byte-load \ PLX-OSX-PATCH
use-nvramrc?    true
 
Ok, I patched a different computer with the powerlogix CD then did a nvram -p to get a copy of what it put in. So now how can I get this into the mini? What are the details/instructions for the custom kernel?

Code:
nvramrc  " "(F1084C2A00000103120A6465766963652D656E64CDA5CA065F2E6C2E72310800B8A5CA065F2E6C2E72320801B812192F6F70656E70726F6D2F636C69656E742D7365727669636573120B66696E642D646576696365CD120B5B275D2071756965736365CDC30800CA07717569657363650802B708001D08011DC2120A6465766963652D656E64CDCA055F2E6C2E720803B7120C00000024FFFF0000800300001000004000B14A4AA74EA74EA74E7AA53C1400205210000000041E4710FFF80000497310800000004910000000041E7333B24A10000000041E471003FFFFF83C14FFC54652C2120470767240CD10FFFF00002310800400003C140009110803C30801B200)" dup -rot alloc-mem dup 2swap -rot move 1 byte-load \ PLX-OSX-PATCH
use-nvramrc?    true
First thing you'll need is an installed copy of Tiger 10.4.11. Then, download the modified kernel found here, and place it in the root of the Tiger volume, replacing the original (which is hidden). Then, you can boot that Tiger install on the Mini, and from there set NVRAM. All you need to do is use Terminal, and run
Code:
sudo nvram nvramrc=" "(F1084C2A00000103120A6465766963652D656E64CDA5CA065F2E6C2E72310800B8A5CA065F2E6C2E72320801B812192F6F70656E70726F6D2F636C69656E742D7365727669636573120B66696E642D646576696365CD120B5B275D2071756965736365CDC30800CA07717569657363650802B708001D08011DC2120A6465766963652D656E64CDCA055F2E6C2E720803B7120C00000024FFFF0000800300001000004000B14A4AA74EA74EA74E7AA53C1400205210000000041E4710FFF80000497310800000004910000000041E7333B24A10000000041E471003FFFFF83C14FFC54652C2120470767240CD10FFFF00002310800400003C140009110803C30801B200)" dup -rot alloc-mem dup 2swap -rot move 1 byte-load \ PLX-OSX-PATCH
Do the same for "use-nvramrc?", so
Code:
sudo nvram use-nvramrc?=true
Then you should be able to boot an unmodified copy of Mac OS X.
 
Thanks for all the help. I was able to boot 10.4.11 with mach_kernel replaced, and I ran the nvram commands. Following that it will no longer do anything but bong. No video and no light on the mouse. I did have to set the date at the beginning of the experiment so maybe the battery is low. I'll buy a new battery and hopefully that will fix the nvram.

There is also a little button on the mini logic board (S1) that might do some kind of reset? Does anyone know what to do with that?

Anyway, until I get a battery what I'm really interested in is a powerbook swap. Here is what I got out of the powerbook.
 

Attachments

  • original12.rom.zip
    840.6 KB · Views: 121
Thanks for all the help. I was able to boot 10.4.11 with mach_kernel replaced, and I ran the nvram commands. Following that it will no longer do anything but bong. No video and no light on the mouse. I did have to set the date at the beginning of the experiment so maybe the battery is low. I'll buy a new battery and hopefully that will fix the nvram.

There is also a little button on the mini logic board (S1) that might do some kind of reset? Does anyone know what to do with that?

Anyway, until I get a battery what I'm really interested in is a powerbook swap. Here is what I got out of the powerbook.
Resetting PRAM (Command + Option + P + R keys held at boot) should clear that NVRAM stuff out. I patched your PBG4 ROM to add 7448 support. It is attached.
 

Attachments

  • 12pb7448-patch.rom.zip
    841 KB · Views: 121
  • Like
Reactions: Jubadub and saxfun
Anyway, until I get a battery what I'm really interested in is a powerbook swap. Here is what I got out of the powerbook.
Which 12" PB is that, by the way? 867MHz (PowerBook6,1), 1.0GHz (PowerBook6,2), 1.33GHz (PowerBook6,4) or 1.5GHz (PowerBook6,8)?
 
Thanks for all the help. I was able to boot 10.4.11 with mach_kernel replaced, and I ran the nvram commands. Following that it will no longer do anything but bong. No video and no light on the mouse. I did have to set the date at the beginning of the experiment so maybe the battery is low. I'll buy a new battery and hopefully that will fix the nvram.

There is also a little button on the mini logic board (S1) that might do some kind of reset? Does anyone know what to do with that?

Anyway, until I get a battery what I'm really interested in is a powerbook swap. Here is what I got out of the powerbook.
this should get help you unbrick it even if you cant reset the PRAM

 
(but on the Mac Mini front indeed I have set-dfs-high and set-dfs-low as words, but OS X nor Linux sees the CPU as DFS capable, do wonder if you could manually poke the register and force it DFS low or such)
Only on 1.33Ghz and 1.5Ghz or multipliers that are not x.5.

DFS mode does no support 1/4 multipliers, so set your logic board resisters to full multipliers, and use the set-dfs words and the spd word to view changes.
 
Only on 1.33Ghz and 1.5Ghz or multipliers that are not x.5.

DFS mode does no support 1/4 multipliers, so set your logic board resisters to full multipliers, and use the set-dfs words and the spd word to view changes.
yeah am well aware of the limitations

my Mac Mini is running a 10x Multiplier so thats not a problem for me :)
 
Well, try the .words and see what happens.
As for the 7448, we can set our own colon definitions in OF to try valid DFS modes, every whole multiplier =>8x

Something like:

Code:
0 > dev /cpus/@0  ok
0 > see set-dfs-low
:
set-dfs-low               
  pvr@ 10 rshift 8003 <> if
    exit
    else
    hid1@ 1 1f 9 - lshift or hid1! 1 ms 4 1 gpio!
    then
  ; ok
0 > : set-dfs-real-low pvr@ 10 rshift 8004 <> if exit else hid1@ 1 1f 8 - lshift or hid1! 1 ms 4 1 gpio! then ;  ok
0 > see set-dfs-real-low
:
set-dfs-real-low         
  pvr@ 10 rshift 8004 <> if
    exit
    else
    hid1@ 1 1f 8 - lshift or hid1! 1 ms 4 1 gpio!
    then
  ; ok
0 > set-dfs-real-low  ok
0 > spd 139  pll-ratio*2 = 10  HID1 = 80416c80  DelayAACK = 0  GPIO1 = 4 BusClk = 133173483  ok
0 > set-dfs-low  ok
0 > spd 139  pll-ratio*2 = 10  HID1 = 80416c80  DelayAACK = 0  GPIO1 = 4 BusClk = 133173483  ok
0 > set-dfs-high  ok
0 > spd 70  pll-ratio*2 = 20  HID1 = 80015c80  DelayAACK = 0  GPIO1 = 7 BusClk = 133173483  ok
0 > set-dfs-low  ok
0 > spd 139  pll-ratio*2 = 10  HID1 = 80416c80  DelayAACK = 0  GPIO1 = 4 BusClk = 133173483  ok
0 >

That may not be exactly correct, I don't have a 7448 to test with, and I'm not sure I'm properly setting HID1 bit 8 to 1.
 
this should get help you unbrick it even if you cant reset the PRAM

This worked! There's lots of inside knowledge around here. So, as before it will boot linux and OSX on the modified mach_kernel, but once I put in those two nvram commands it won't do anything but bong until I hold the power button for a LONG time. Then it will come up in open firmware as described in that thread.

dosdude1: Thanks for the ROM!! Is the patched ROM specific to a serial number? I have another 12" powerbook logic board (same model) already removed that would be easier to work on than the one I pulled the ROM from.
 
This worked! There's lots of inside knowledge around here. So, as before it will boot linux and OSX on the modified mach_kernel, but once I put in those two nvram commands it won't do anything but bong until I hold the power button for a LONG time. Then it will come up in open firmware as described in that thread.

dosdude1: Thanks for the ROM!! Is the patched ROM specific to a serial number? I have another 12" powerbook logic board (same model) already removed that would be easier to work on than the one I pulled the ROM from.
glad to see you where able to unbrick it, hopefully something can be figured out to get OS X booting on its stock kernel on your machine

with regards to the PowerBook, the ROM will contain that PowerBooks serial number, but you can for testing flash it to another PowerBook of the same type, that PowerBook will just assume the ID of the other one (so dont forget to Backup the ROM of the one your flashing so you dont lose its ID!)
 
glad to see you where able to unbrick it, hopefully something can be figured out to get OS X booting on its stock kernel on your machine

with regards to the PowerBook, the ROM will contain that PowerBooks serial number, but you can for testing flash it to another PowerBook of the same type, that PowerBook will just assume the ID of the other one (so dont forget to Backup the ROM of the one your flashing so you dont lose its ID!)
I wonder how we can decode what the PL NVRAM script is doing, i.e. make it human readable?

That way we maybe able to fix whatever is going wrong on the Mini.

I know it's not enough just to change the " name" and " cpu-version" properties, OS X is wise to PVR hacks and reading the PVR directly from the CPU, it knows when you just change the PVR in the device-tree.

Oddly, on a side note, Mac OS 9 just takes whatever property you give the CPU in the device-tree and runs with that, but PCI devices, OS 9 is wise to device ID hacks in Open Firmware, tools and drivers poll the PCI Register of the hardware, they don't care what is in the device tree.

OS X just reads whatever in in the device-tree for PCI devices and doesn't poll the PCI registers.

So things flip-flop on us, OS 9 is none the wiser for PVR hacks, and OS X is none the wiser for Device ID hacks.
 
I wonder how we can decode what the PL NVRAM script is doing, i.e. make it human readable?

That way we maybe able to fix whatever is going wrong on the Mini.

I know it's not enough just to change the " name" and " cpu-version" properties, OS X is wise to PVR hacks and reading the PVR directly from the CPU, it knows when you just change the PVR in the device-tree.

Oddly, on a side note, Mac OS 9 just takes whatever property you give the CPU in the device-tree and runs with that, but PCI devices, OS 9 is wise to device ID hacks in Open Firmware, tools and drivers poll the PCI Register of the hardware, they don't care what is in the device tree.

OS X just reads whatever in in the device-tree for PCI devices and doesn't poll the PCI registers.

So things flip-flop on us, OS 9 is none the wiser for PVR hacks, and OS X is none the wiser for Device ID hacks.
Yeah it would be very interesting to know what the PL NVRAM script is doing exactly, as you say OS X will just ignore whatever the PVR is in the device tree

I did notice that there is some human readable elements to it encoded in hex which you can see if you feed it into a hex editor


OS X just reads whatever in in the device-tree for PCI devices and doesn't poll the PCI registers.

interesting I remember just for giggles changing the device ID of the ATI Mobility Radeon 9200 in my iBook G4 to that of a Mac X800 XT and while it did change in system profiler, it did not affect the loading of kexts or such

what did affect things is changing the frame-buffer personality name, OS X does get that from the device tree and that does affect things in OS X
 
YES!! Thank you dosdude1!!! This was the whole reason I got into BGA soldering chips:

7448pb.png


I applied the NVRAMRC patch and it still booted. I applied the ROM patch from dosdude1, and it still booted. I swapped the chip, and it still booted! I'm very pleased with this.

The 7448 sits significantly lower than the original CPU, so I'll have to shim or modify the heatsink. I have it pretty rigged right now just to see if it would boot. DFS is working and this powerbook uses a MAX1717 to control the Vcore. The voltage is different between high/low speed so I'll have to experiment with what voltage/speed settings will work in the powerbook. All of that should be relatively easy though...
 
YES!! Thank you dosdude1!!! This was the whole reason I got into BGA soldering chips:

7448pb.png


I applied the NVRAMRC patch and it still booted. I applied the ROM patch from dosdude1, and it still booted. I swapped the chip, and it still booted! I'm very pleased with this.

The 7448 sits significantly lower than the original CPU, so I'll have to shim or modify the heatsink. I have it pretty rigged right now just to see if it would boot. DFS is working and this powerbook uses a MAX1717 to control the Vcore. The voltage is different between high/low speed so I'll have to experiment with what voltage/speed settings will work in the powerbook. All of that should be relatively easy though...
Awesome, this basically guarantees that my Mac Mini G4 (PowerMac10,1) ROM patch works as well, as the implementation is identical between that PowerBook's BootROM and the pre-1.5 GHz Mini G4. (Also good to know my custom flashrom version is able to successfully flash a machine as well, as I haven't been able to test that).
 
YES!! Thank you dosdude1!!! This was the whole reason I got into BGA soldering chips:

7448pb.png


I applied the NVRAMRC patch and it still booted. I applied the ROM patch from dosdude1, and it still booted. I swapped the chip, and it still booted! I'm very pleased with this.

The 7448 sits significantly lower than the original CPU, so I'll have to shim or modify the heatsink. I have it pretty rigged right now just to see if it would boot. DFS is working and this powerbook uses a MAX1717 to control the Vcore. The voltage is different between high/low speed so I'll have to experiment with what voltage/speed settings will work in the powerbook. All of that should be relatively easy though...

oh that is very Awesome! :) Really happy to see the manual patching works, pretty epic stuff by @dosdude1 right there

and well done to you for stripping down a PB G4 12 inch and soldering successfully BGA soldering a CPU :)

and very glad to hear that the NVRAMRC patch works for the PowerBook at least

(I have a feeling it does not work on the Mac Mini because its BootROM fully recognises the 7448 so the patch might be trying to set values that are already set or change values that are only there when the CPU is not fully recognised and its causing the machine, the Mac mini to hang)
 
  • Like
Reactions: Amethyst1
YES!! Thank you dosdude1!!! This was the whole reason I got into BGA soldering chips:

7448pb.png


I applied the NVRAMRC patch and it still booted. I applied the ROM patch from dosdude1, and it still booted. I swapped the chip, and it still booted! I'm very pleased with this.

The 7448 sits significantly lower than the original CPU, so I'll have to shim or modify the heatsink. I have it pretty rigged right now just to see if it would boot. DFS is working and this powerbook uses a MAX1717 to control the Vcore. The voltage is different between high/low speed so I'll have to experiment with what voltage/speed settings will work in the powerbook. All of that should be relatively easy though...
Awesome, nice skills.

This is what I call hacking.

Anyway, I wanted to know what the PowerLogix NVRam patch really does, beyond the binary blob:

Code:
\  Welcome to detok - FCode detokenizer v1.0.3
\  (C) Copyright 2001-2010 Stefan Reinauer
\  (C) Copyright 2006 coresystems GmbH
\  (C) Copyright 2005 IBM Corporation.  All Rights Reserved.
\  Written by Stefan Reinauer
\  This program is free software; you may redistribute it under the terms of
\  the GNU General Public License v2. This program has absolutely no warranty.
\ 
start1 ( 0x0f1 )   ( 16-bit offsets)
  format:    0x08
  checksum:  0x4c2a (Ok)
  len:       0x0103 ( 259 bytes)
b(") ( 0x012 ) ( len=0xa [10 bytes] )
" device-end"
evaluate ( 0x0cd )
0 ( 0x0a5 )
external-token ( 0x0ca ) _.l.r1 0x800
b(value) ( 0x0b8 )
0 ( 0x0a5 )
external-token ( 0x0ca ) _.l.r2 0x801
b(value) ( 0x0b8 )
b(") ( 0x012 ) ( len=0x19 [25 bytes] )
" /openprom/client-services"
b(") ( 0x012 ) ( len=0xb [11 bytes] )
" find-device"
evaluate ( 0x0cd )
b(") ( 0x012 ) ( len=0xb [11 bytes] )
" ['] quiesce"
evaluate ( 0x0cd )
b(to) ( 0x0c3 ) _.l.r1 ( 0x800 )
external-token ( 0x0ca ) quiesce 0x802
b(:) ( 0x0b7 )
    _.l.r1 ( 0x800 )
    execute ( 0x01d )
    _.l.r2 ( 0x801 )
    execute ( 0x01d )
b(;) ( 0x0c2 )
b(") ( 0x012 ) ( len=0xa [10 bytes] )
" device-end"
evaluate ( 0x0cd )
external-token ( 0x0ca ) _.l.r 0x803
b(:) ( 0x0b7 )
    b(") ( 0x012 ) ( len=0xc [12 bytes] )
    " "( 00 00 00 )$"( ff ff 00 00 80 03 00 00 )"
    b(lit) ( 0x010 ) 0x4000
    b(<mark) ( 0x0b1 )
        rot ( 0x04a )
        rot ( 0x04a )
        2 ( 0x0a7 )
        pick ( 0x04e )
        2 ( 0x0a7 )
        pick ( 0x04e )
        2 ( 0x0a7 )
        pick ( 0x04e )
        comp ( 0x07a )
        0 ( 0x0a5 )
        = ( 0x03c )
        b?branch ( 0x014 ) 0x0020 ( =dec 32)
            2drop ( 0x052 )
            b(lit) ( 0x010 ) 0x4
            + ( 0x01e )
            dup ( 0x047 )
            b(lit) ( 0x010 ) 0xfff80000
            swap ( 0x049 )
            l! ( 0x073 )
            b(lit) ( 0x010 ) 0x80000000
            swap ( 0x049 )
            b(lit) ( 0x010 ) 0x4
            + ( 0x01e )
            l! ( 0x073 )
            exit ( 0x033 )
        b(>resolve) ( 0x0b2 )
        rot ( 0x04a )
        b(lit) ( 0x010 ) 0x4
        + ( 0x01e )
        dup ( 0x047 )
        b(lit) ( 0x010 ) 0x3fffff8
        = ( 0x03c )
        b?branch ( 0x014 ) 0xffc5 ( =dec -59)
    drop ( 0x046 )
    2drop ( 0x052 )
b(;) ( 0x0c2 )
b(") ( 0x012 ) ( len=4 )
" pvr@"
evaluate ( 0x0cd )
b(lit) ( 0x010 ) 0xffff0000
and ( 0x023 )
b(lit) ( 0x010 ) 0x80040000
= ( 0x03c )
b?branch ( 0x014 ) 0x0009 ()
    b(') ( 0x011 ) _.l.r ( 0x803 )
    b(to) ( 0x0c3 ) _.l.r2 ( 0x801 )
b(>resolve) ( 0x0b2 )
end0 ( 0x000 )
\  Detokenization finished normally after 259 bytes.
End of file.
 

Attachments

  • PowerLogixNVRAMPatch.fcode.txt
    2.6 KB · Views: 162
Nice, so it is specifically the 1.5 GHz PowerBook6,8 patched ROM we have up there, not any other 12" model's. Good to know which one it is, so no one wastes their time with an incorrect ROM.

(I have a feeling it does not work on the Mac Mini because its BootROM fully recognises the 7448 so the patch might be trying to set values that are already set or change values that are only there when the CPU is not fully recognised and its causing the machine, the Mac mini to hang)

I wonder if this can easily be resolved for the PowerMac10,2 models by flashing @dosdude1's ROM (which is based on PowerMac10,1) and then apply the NVRAM patch. Only thing to keep in mind is that that would change the model identifier to PowerMac10,1, too, for what it's worth, and whatever else that may change between the firmware versions.

But then, this also means the DLSD models face the same challenge as the PowerMac10,2, don't they? How should that best be dealt with? Different firmware patching? Flashing an earlier PowerBook's firmware into them? Changing the NVRAM-based patch?
 
  • Like
Reactions: Amethyst1
I wonder if this can easily be resolved for the PowerMac10,2 models by flashing @dosdude1's ROM (which is based on PowerMac10,1) and then apply the NVRAM patch. Only thing to keep in mind is that that would change the model identifier to PowerMac10,1, too, for what it's worth, and whatever else that may change between the firmware versions.
yeah I do wonder if Mac Mini PowerMac10,1 and 10,2 firmwares are interchangeable, but I dont want to try on my machine because I dont want to have to try and wrangle a 40 pin parallel EEPROM to unbrick it if the worst happens LOL

But then, this also means the DLSD models face the same challenge as the PowerMac10,2, don't they? How should that best be dealt with? Different firmware patching? Flashing an earlier PowerBook's firmware into them? Changing the NVRAM-based patch?

yeah will be very interesting to see how the DLSD does, hopefully the NVRAM patch can be worked out and adjusted for machines that already recognise the 7448 :) (the DLSD is a unique machine so no opportunity for cross flashing boot roms sadly)
 
Code:
: set-dfs-real-low pvr@ 10 rshift 8004 <> if exit else hid1@ 1 1f 8 - lshift or hid1! 1 ms 4 1 gpio! then ;

Did anyone with a 7448 try this code in Open Firmware to see if it would set the CPU to 1/4 speed?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.