MDD FW800 Internal USB 2.0 Firmware Hack

[TheShortTimer]

Apple a caché de l’USB 2.0 dans les Power Mac G4 et n’a jamais activé la technologie… mais c’est possible de le faire | Le journal du lapin

www-journaldulapin-com.translate.goog

I came across this info on social media. According to author, it's possible to activate USB 2.0 functionality on the FW800 MDD model with a firmware hack. Apparently, Apple hobbled this feature - with the motivations behind this decision being the subject of debates that I won't attempt to delve into.

What do you think, interested? 🙂

 

[joevt]

MDD FW800 is model PowerMac3,6 = 0x20c6 but there are 3 revisions (taken from romidentity.cpp in DingusPPC source):

0x20c600  0x6ac22d3f  "P58_133"          "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c600  0x6e5a2d67  "P58_133"          "P58"  "Power Mac G4 (Mirrored Drive Doors)"  // 2002-09-30 448f2
0x20c600  0x79302eaa  "Moj"              "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c600  0x9c2c2e66  "P58_133|P58_DVT"  "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c601  0x1d472c7c  "P58_167"          "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c601  0x20df2ca4  "P58_167"          "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c601  0x4eb12da3  "P58_167"          "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c601  0x9c952e67  "P58"              "P58"  "Power Mac G4 (Mirrored Drive Doors)"
0x20c602  0x6b942d41  "P58B_133"         "P58"  "Power Mac G4 (FW 800)"              
0x20c602  0x6f2c2d69  "P58B_133"         "P58"  "Power Mac G4 (FW 800)"                // 2003-01-15 457f1
0x20c603  0x1e192c7e  "P58B_167"         "P58"  "Power Mac G4 (FW 800)"              
0x20c603  0x21b12ca6  "P58B_167"         "P58"  "Power Mac G4 (FW 800)"                // 2003-02-20 460f1

These models exist in these firmware updaters (but I don't know which versions Apple tested with MDD/FW 800):

build-version:429f1 build-date:2001-11-20 model:0xffff fill-byte:0xff num-sections:6
    20) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x79302eaa version:429f1 date:2001-11-20 checksum:0x3a0c3265 √ name:Moj
build-version:443b2 build-date:2002-06-10 model:0xff fill-byte:0xff num-sections:6
    29) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:443b2 date:2002-06-10 checksum:0x40b631e2 √ name:P58_DVT
    30) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x9c952e67 version:443b2 date:2002-06-10 checksum:0x411f31e3 √ name:P58
build-version:444b1 build-date:2002-06-14 model:0xff fill-byte:0xff num-sections:6
    29) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:444b1 date:2002-06-14 checksum:0x427b31e6 √ name:P58_133
    30) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x4eb12da3 version:444b1 date:2002-06-14 checksum:0xf4f13123 √ name:P58_167
build-version:445b8 build-date:2002-07-17 model:0xff fill-byte:0xff num-sections:6
    27) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:445b8 date:2002-07-17 checksum:0x47e931f2 √ name:P58_133
    28) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x4eb12da3 version:445b8 date:2002-07-17 checksum:0xfa5f312f √ name:P58_167
build-version:446b1 build-date:2002-07-22 model:0xff fill-byte:0xff num-sections:6
    27) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:446b1 date:2002-07-22 checksum:0x4a0731f7 √ name:P58_133
    28) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x4eb12da3 version:446b1 date:2002-07-22 checksum:0xfc7d3134 √ name:P58_167
build-version:446b3 build-date:2002-07-31 model:0xff fill-byte:0xff num-sections:6
    27) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:446b3 date:2002-07-31 checksum:0x51903208 √ name:P58_133
    28) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x4eb12da3 version:446b3 date:2002-07-31 checksum:0x04153145 √ name:P58_167
build-version:446f2 build-date:2002-07-31 model:0xff fill-byte:0xff num-sections:6
    27) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x9c2c2e66 version:446f2 date:2002-07-31 checksum:0x6e5b3247 √ name:P58_133
    28) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x4eb12da3 version:446f2 date:2002-07-31 checksum:0x20e03184 √ name:P58_167
build-version:448f2 build-date:2002-09-30 model:0xff fill-byte:0xff num-sections:6
    27) offset:0x0090 model:0x20c6 prod-id:0x20c6.00 configchechsum:0x6e5a2d67 version:448f2 date:2002-09-30 checksum:0x41e8314b √ name:P58_133
    28) offset:0x0090 model:0x20c6 prod-id:0x20c6.01 configchechsum:0x20df2ca4 version:448f2 date:2002-09-30 checksum:0xf45e3088 √ name:P58_167
build-version:455d2 build-date:2002-11-19 model:0xff fill-byte:0xff num-sections:7
    30) offset:0x00000090 prod-id:0x20c6.00 configchechsum:0x6ac22d3f version:455d2 date:2002-11-19 checksum:0x2f173101 √ name:P58_133
    31) offset:0x00000090 prod-id:0x20c6.01 configchechsum:0x1d472c7c version:455d2 date:2002-11-19 checksum:0xe18d303e √ name:P58_167
    32) offset:0x00000090 prod-id:0x20c6.02 configchechsum:0x6b942d41 version:455d2 date:2002-11-19 checksum:0x2fe93103 √ name:P58B_133
    33) offset:0x00000090 prod-id:0x20c6.03 configchechsum:0x1e192c7e version:455d2 date:2002-11-19 checksum:0xe25f3040 √ name:P58B_167
build-version:467bf build-date:2003-08-16 model:0xff fill-byte:0xff num-sections:7
    41) offset:0x000000a0 prod-id:0x20c6.00 configchechsum:0x6e5a2d67 version:467bf date:2003-08-16 checksum:0x2d6a311d √ name:P58_133
    42) offset:0x000000a0 prod-id:0x20c6.01 configchechsum:0x20df2ca4 version:467bf date:2003-08-16 checksum:0xdfe0305a √ name:P58_167
    43) offset:0x000000a0 prod-id:0x20c6.02 configchechsum:0x6f2c2d69 version:467bf date:2003-08-16 checksum:0x2e3c311f √ name:P58B_133
    44) offset:0x000000a0 prod-id:0x20c6.03 configchechsum:0x21b12ca6 version:467bf date:2003-08-16 checksum:0xe0b2305c √ name:P58B_167
build-version:470f2 build-date:2003-08-28 model:0xff fill-byte:0xff num-sections:7
    41) offset:0x000000a0 prod-id:0x20c6.00 configchechsum:0x6e5a2d67 version:470f2 date:2003-08-28 checksum:0x50d1316b √ name:P58_133
    42) offset:0x000000a0 prod-id:0x20c6.01 configchechsum:0x20df2ca4 version:470f2 date:2003-08-28 checksum:0x035630a8 √ name:P58_167
    43) offset:0x000000a0 prod-id:0x20c6.02 configchechsum:0x6f2c2d69 version:470f2 date:2003-08-28 checksum:0x51a3316d √ name:P58B_133
    44) offset:0x000000a0 prod-id:0x20c6.03 configchechsum:0x21b12ca6 version:470f2 date:2003-08-28 checksum:0x042830aa √ name:P58B_167
build-version:471f1 build-date:2003-09-04 model:0xff fill-byte:0xff num-sections:7
    41) offset:0x000000a0 prod-id:0x20c6.00 configchechsum:0x6e5a2d67 version:471f1 date:2003-09-04 checksum:0x41603148 √ name:P58_133
    42) offset:0x000000a0 prod-id:0x20c6.01 configchechsum:0x20df2ca4 version:471f1 date:2003-09-04 checksum:0xf3d63085 √ name:P58_167
    43) offset:0x000000a0 prod-id:0x20c6.02 configchechsum:0x6f2c2d69 version:471f1 date:2003-09-04 checksum:0x4232314a √ name:P58B_133
    44) offset:0x000000a0 prod-id:0x20c6.03 configchechsum:0x21b12ca6 version:471f1 date:2003-09-04 checksum:0xf4a83087 √ name:P58B_167

The first post at https://forums.macrumors.com/thread...eige-power-macintosh-g3.2303689/post-30082400 lists the known firmware versions of Macs and firmware updaters and indicates which of those I have dumped. Search for "List of Open Firmware versions".
Before and after doing a firmware update, boot into Mac OS X to dump a copy of the firmware. Rename the resulting file to something meaningful.
To dump a copy of the firmware, search the first post of the linked thread for rom dump, then click the Mac OS X link.

The article suggests that downgrading from 4.5.7f1 to 4.4.8f2 enables USB 2.0 functionality.

My suggestion would be to compare them to see what's changed.

Also, I would try one of the developer only firmware updaters (up to 4.7.1f1) to see what happens. It could brick the Mac, unless you have a method to externally flash the chip with a backup.

The developer only firmware updaters have a menu. Here's the code for the menu:

cr ."  Type 'alt'  to alternate ROM address.                          "
"  Type 'f'    to flash only the BOOT image.                      " cr|
"  Type 'fall' to flash the entire onboard 1MB device.            " cr|
"  Type 'frec' to flash only the RECOVERY image.                  " cr|
"  Type 'c'    to choose a config block from similar platforms.   " cr|
"  Type 'call' to choose a config block from all platforms.       " cr|
debug? if "  Type 'd'    to select a different system's driver config.      " cr| then
"  Type 'fbtb' to flash only the BOOT-BLOCK image.                " cr|
"  Type 'net'  to enter an ethernet address for this machine.     " cr|

If you choose the f to flash only the BOOT image, then the RECOVERY image should be unchanged. I believe the RECOVERY image gets used when you press the programmer key to boot for doing firmware updates? If you flash only one of the images, then the RECOVERY image and BOOT image will have different versions. Having different RECOVERY and BOOT versions might not be a good idea if the format of the config block changed between versions. Check the configchechsum.

There's no Firmware Updater for 4.5.7f1 to revert back to. It might be difficult to create one since the format of the Firmware Updater changed between 4.4.8f2 and 4.5.7f1.

 

[TheShortTimer]

Thanks, @joevt. 🙂

I don't have a MDD so this isn't something that I can test but I thought it was worth sharing with the community in case anyone here would be tempted to try it out.