Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Only one question remains — with the janky way the current ROM is produced (flashing official->patched->official), is it put together correctly? If not, is it possible to do the same thing without mangling the ROM?
To make my question more clear, I'm looking at the start, offset and size values reported by the script for the boot images and I don't understand how flashing the official ROM over the patched ROM didn't destroy the Open Firmware image.
 
Code:
./DumpPCIRom.sh: line 229: $((0x${PointerPCIDataStructure} - 28))*2: substring expression < 0

I also found the backup of the ROM my HBA came with and fed it to the script too:

Code:
./DumpPCIRom.sh: line 229: $((0x${PointerPCIDataStructure} - 28))*2: substring expression < 0

The difference between the two is that the factory ROM is an older version and will no longer allow booting on Mac for some reason (even with the matching firmware) after the HBA has been erased before (could be due to some specific NVRAM settings).

I'm attaching all the files in an archive for comparison:

bios_factory.rom — the ROM my adapter came with
bios_latest_official.rom — the latest ROM from the Broadcom website
bios_patched.rom — modified ROM with only Fcode in boot services
bios_current.rom — the ROM I currently use, which is bootable on PC and Mac alike

Only one question remains — with the janky way the current ROM is produced (flashing official->patched->official), is it put together correctly? If not, is it possible to do the same thing without mangling the ROM?

There's also the error in the script on line 229.
I've added some commits to GitHub to fix the issues I found with the DumpPCIRom.sh results for your ROMs.

By the way, sasflash (attached) runs on PPC Linux. I used a fork of Void on my Power Mac G5 to dump the ROM. Only low-level (DOS, EFI) versions allow erasing any part of the HBA flash, though, which is necessary to switch from IR to IT mode firmware.
I don't know why the low-level versions are required to make the change, so I allowed the Mac OS X version to have the same code as those low level versions but I can't test it.

To make my question more clear, I'm looking at the start, offset and size values reported by the script for the boot images and I don't understand how flashing the official ROM over the patched ROM didn't destroy the Open Firmware image.
start is the start of the PCI image. offset is the start of the code for that image.
For Open Firmware images, the DumpPCIRom.sh script will convert fcode to Forth.
The ROMs you provided did some things in the Open Firmware image that my script was not handling correctly but the new changes should fix that.
1) My script ignored the "Pointer to FCode program". My script assumed that the fcode began after the "PCI Data Structure" but the "Pointer to FCode program" points to two bytes later. I don't know what those two extra bytes are for.
2) The "Pointer to start of PCI Data Structure" is 0x1A. My script assumed it would be 0x1C or greater. Open Firmware spec says 0x1A is valid. 0x1A removes two pad bytes before the "PCI Data Structure".
3) The "start1" fcode has a strange "format" number (3 instead of 8). I don't know why.

I've attached some files from my work folder. The BBEdit worksheet has commands and notes, including these:

Code:
bbdiff  "Forth/bios_factory.4th" "Forth/bios_current.4th" 
# LSI version 6.32 -> 6.36
# no change in fcode

bbdiff  "Forth/bios_current.4th" "Forth/bios_latest_official.4th"
# Device ID 0056 -> 0050
# fcode removed

bbdiff "Forth/bios_current.4th" "Forth/bios_patched.4th"
# everything except fcode removed

I don't see any obvious issues with the layouts.
 

Attachments

  • ROM SAS.zip
    2.5 MB · Views: 4
  • Like
Reactions: Betonmischer_86
Thank you for such a detailed response. Good to know the ROM I ended up with is consistent. It seems sasflash is smart about upgrading the ROM and it doesn't simply get overwritten as a whole each time.
I don't know why the low-level versions are required to make the change, so I allowed the Mac OS X version to have the same code as those low level versions but I can't test it.
Do you mean you have a fork of sasflash for OSX? I didn't see it in your GitHub repos.
 
Do you mean you have a fork of sasflash for OSX? I didn't see it in your GitHub repos.
I mistakenly thought you were talking about the EFI and DOS version of lsiutil. The source code of lsiutil has versions for EFI and DOS and Linux and Windows. I added a Mac OS X version that has all the options of the EFI and DOS version.

I don't know if sasflash has any source code available.
 
  • Like
Reactions: Betonmischer_86
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.