Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Exactly.

View attachment 1944941

The goal is: patch the Sonnet flasher and driver inside with HW IDs of Promise cards. According to guy form macos9lives, who successfully flashed these cards, it's all what's necessary to make Sonnet app see and flash these cards properly.
But for me it's a hard learning process (as you see), because I only have experience with making EFI ROMs for Mac Pro GPUs. Add the EFI part in proper place, compress/decompress when needed, alter device ID inside for using it with other GPUs from the same family, fix the checksum(s), oprom indicators etc. As I'm not a programmer, I'm doing most of this in Hex editor.

Anyway, I'm grateful for your patience, help and explanations. Now I got proper fwre.txt, along with another error in log, when I tried to execute the full script to get the ROM dump. Attached.
I don't think you can or should assume resources in a resource fork are stored in a single sequence of bytes. Actually, the file format description for resource forks does say each resource is contiguous.
https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
It also says the four bytes before the resource data is the resource size. In your screenshot - the number is 0x00010000 which is exactly 64K which is what you got in the fwre_136.txt file.

Oh, I see the problem. In the fwre_136.txt file there are a bunch of non-ASCII characters. DeRez is producing text with Mac OS Roman encoding (the encoding of classic Mac OS) where all characters are assumed to be a single byte. But sed is assuming the bytes are UTF-8 which has some multi byte characters - some of the non-ASCII bytes are being interpreted as multibyte UTF-8 characters but not all combinations of bytes are a valid UTF-8 byte sequence.

The default language in Terminal.app is UTF-8.
set | grep LANG -> LANG=en_CA.UTF-8

To get around this, you can temporarily change the language for the sed command to "C" (just add LANG=C before the sed command). "C" is one of the LANG values that uses single byte ASCII characters similar to Mac OS Roman ("C" might not use the same characters above ASCII 0x80 as Mac OS Roman but we don't really care about those unless they were used for the resource type but none of the resource types in the firmware updater app have non-ASCII characters so that's not an issue).
Code:
cd /Volumes/Storage/Downloads/fwre136
theresource=fwre_136
LANG=C sed -nE '/.\$"([0-9A-F ]+).*/s//\1/p' "${theresource}.txt" | xxd -p -r > "${theresource}.rom"
DumpPCIRom.sh "${theresource}".rom > "${theresource}".4th 2> "${theresource}".log

The reason I didn't encounter this problem is because I'm executing the commands from a worksheet in BBEdit.app which does not have LANG=en_CA.UTF-8 by default.

Once you have the 4th file, you may want to make a copy and make your modifications to the copy.
Code:
cp "${theresource}".4th "${theresource}"_modified.4th
bbedit "${theresource}"_modified.4th

Then you can use the toke command to recompile.
Code:
toke "${theresource}"_modified.4th "${theresource}"_modified.bin
it complains "rom size has been exceeded" because rom size is set to 0xfc00 = 64512 bytes but 64513 were written. You can edit "${theresource}"_modified.4th and remove the redundant fcode-end that occurs after the pci-end token. Then do the toke command again.

Then you can use the DumpPCIRom.sh command to convert that back to fourth and compare with the original:
Code:
DumpPCIRom.sh "${theresource}"_modified.bin > "${theresource}"_test.4th 2> "${theresource}"_test.log
bbdiff "${theresource}"_test.4th "${theresource}"_modified.4th
Even if you didn't make any changes, there will be some differences:
- The variable length padding in the modified rom is all zeros. I don't know if this is used by anything. Maybe there should be a tokenizer option to set the variable length padding just as there is a tokenizer option named pci-data-structure-start which affects the size of that padding.
- As for the fcode itself, the checksum indicates there is differences. But that's not a problem for most differences. For example, different words maybe assigned different fcode numbers (you see how toke defaults to using fcode numbers starting from 0x800). Another change could be if the old fcode used a literal for the values 0 or 1 instead of the more efficient words zero or one.
- The original rom defines a variable with fcode number 0x124. This variable is given an fcode number of 0x80c in the modified rom which affects the numbering of all subsequent definitions. 0x124 doesn't appear to be used anywhere so you can maybe just comment out this line. do toke and DumpPCIRom.sh again, and see that there are much fewer diffs remaining.
Actually, there is a way to change the numbering of definitions. Change the line variable variable_124 to this:
Code:
tokenizer[ 124 next-fcode ]tokenizer
variable variable_124
tokenizer[ 80C next-fcode ]tokenizer
Now when you toke/dump/diff, there are no changes (except the Variable length pad bytes) and the fcode checksums actually match. This probably indicates that the strange 0x124 number is not some kind of corruption in the fcode as the checksums in both the original and modified are correct and do match.

The next-fcode directive is solves this difference but there should probably be push-next-fcode and pop-next-fcode directives because setting the next-fcode to 80C is only going to work if the number of definitions before this hasn't changed which might happen if you decide to make modifications.
 
Last edited:
@joevt

I'm trying to create a text file I can load/boot in OF to set the properties of the PC Card the way the Fcode ROM does to try and fool the Sonnet Flasher to flash the card, however I'm not getting the syntax correct for Open Firmware and I'm getting the unrecognized Client Program format?

Code:
\ Ultra-Tek properties

cr

hex

" Ultra-Tek133P+" encode-string " name" property

I place the file in the ppc dir of my hd and boot OF, then:

Code:
dev pci/@14
boot hd:,\ppc\utpci

However I get the error: unrecognized Client Program format?

Am I getting the format of the file wrong, I tried to create the text file with Textedit>make plain text and just rewrite it in pico, but it's the same result?

As my AGP4x PC is extremely finicky I decided to see if I can get the flashing going in my Mac.
It's doable if the ROM chip is supported by that old version of OSX nvflash. Rorqual's dumper seems to work better as I was able to dump the PC BIOS from the 7800GS but nvflash complained that the ROM is not supported. With the 6800XT they both worked.
All that is needed is some ioreg properties.

To accomplish that you need a PCI video card or telnet access to OF.
In order to minimize typing you should first copy the fcode program to the root directory of your first partition (use short and easy filenames). When in OF you can see the listing of the contens by typing:
dir hd:\
In OF prompt type:
dev pci0
(this navigates to the node where AGP device is located)
type :
ls
(gets you the listing of the devices so you know what the card is called)
type:
dev cardname
(the cardname is something like pci10de,333)

Now it's time to load the fcode program, type:
boot hd:\fcodeprogramname

You can verify that the properties are there by typing:
.properties

Then type:
mac-boot
and when the Mac is up proceed as normal.

The fcode program:

\ comment

cr

hex

000010de encode-int " vendor-id" property
00000321 encode-int " device-id" property
000000b1 encode-int " revision-id" property
00030000 encode-int " class-code" property
00000001 encode-int " interrupts" property
00000005 encode-int " min-grant" property
00000001 encode-int " max-latency" property
000010de encode-int " subsystem-vendor-id" property
00000010 encode-int " subsystem-id" property
00000001 encode-int " devsel-speed" property
00000000 encode-int " fcode-rom-offset" property
" GeForce FX 5200" encode-string " model" property
" NVDA,GeForceFX5200" encode-string " device_type" property
" "(01000000 00000000 00000000 00000000 00000000 00000000 00000000)" encode-string " NVPM" property
" "(02000100 00100003 001c0003 015e)" encode-string " NVCAP" property
" NVDA,Parent" encode-string " name" property
" "(32303630 00)" encode-string " rom-revision" property
0026002f encode-int " NVDA,Features" property
00000001 encode-int " NVDA,Level" property
00000001 encode-int " #address-cells" property
00000000 encode-int " #size-cells" property

Copy and paste it to a text file and save it to the root directory of your first partition.

Unfortunately it wont flash an invisible card, need to do that. Also it should be possible to automate it and load from NVRAM.
 
Last edited:
@joevt

I'm trying to create a text file I can load/boot in OF to set the properties of the PC Card the way the Fcode ROM does to try and fool the Sonnet Flasher to flash the card, however I'm not getting the syntax correct for Open Firmware and I'm getting the unrecognized Client Program format?

Code:
\ Ultra-Tek properties

cr

hex

" Ultra-Tek133P+" encode-string " name" property

I place the file in the ppc dir of my hd and boot OF, then:

Code:
dev pci/@14
boot hd:,\ppc\utpci

However I get the error: unrecognized Client Program format?

Am I getting the format of the file wrong, I tried to create the text file with Textedit>make plain text and just rewrite it in pico, but it's the same result?

I don't know whaat the boot command does
https://opensource.apple.com/source/bless/bless-11/README.BOOTING
https://github.com/apple-oss-distributions/bless/blob/main/README.BOOTING
What format is the \System\Library\CoreServices\BootX file?

Anyway, shouldn't the ROM extracted from the rsrc fork of the Sonnet Flasher be 65536 bytes?
When I said 64K, I meant 64KiB = 65536 bytes.
The rom chip is probably 64KiB so the resource is the same size to overwrite the entire rom. The fcode image does not use the entire rom so there's a bunch of zero padding after the fcode image as you can see in the last 79 lines of fwre_136.txt
 
I don't know whaat the boot command does
https://opensource.apple.com/source/bless/bless-11/README.BOOTING
https://github.com/apple-oss-distributions/bless/blob/main/README.BOOTING
What format is the \System\Library\CoreServices\BootX file?


When I said 64K, I meant 64KiB = 65536 bytes.
The rom chip is probably 64KiB so the resource is the same size to overwrite the entire rom. The fcode image does not use the entire rom so there's a bunch of zero padding after the fcode image as you can see in the last 79 lines of fwre_136.txt
Ok. just wanted to be clear.

We hope the EEROM of the PC Cards are 64k, tho it's not clear what chip the EEPROM is. I only see a 3 pin chip on the front left of the card on both Sonnet and PC Cards, was there a 64k 3 pin EEPROM?
 
I don't think you can or should assume resources in a resource fork are stored in a single sequence of bytes. Actually, the file format description for resource forks does say each resource is contiguous.
https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
It also says the four bytes before the resource data is the resource size. In your screenshot - the number is 0x00010000 which is exactly 64K which is what you got in the fwre_136.txt file.

This is the info I needed for understanding rsrc file structure, I'm starting to read.

Ok. just wanted to be clear.

We hope the EEROM of the PC Cards are 64k, tho it's not clear what chip the EEPROM is. I only see a 3 pin chip on the front left of the card on both Sonnet and PC Cards, was there a 64k 3 pin EEPROM?

PDC20269 has internal 512KBit EEPROM (i.e. 64K), the 3-leg chip on the left is voltage regulator, like SIL3112/14 cards do have.
 
This is the info I needed for understanding rsrc file structure, I'm starting to read.
Unnecessary while you have the derez command. And macOS still has APIs to read and write resource data in resource forks so you can make your own commands.
 
Code:
cd /Volumes/Storage/Downloads/fwre136
theresource=fwre_136
LANG=C sed -nE '/.\$"([0-9A-F ]+).*/s//\1/p' "${theresource}.txt" | xxd -p -r > "${theresource}.rom"
DumpPCIRom.sh "${theresource}".rom > "${theresource}".4th 2> "${theresource}".log

I'm still getting illegal byte sequence error:

Code:
666-be:firmware szatan$ theresource=fwre_136
666-be:firmware szatan$ LANG=C sed -nE '/.\$"([0-9A-F ]+).*/s//\1/p' "${theresource}.txt" | xxd -p -r > "${theresource}.rom"
sed: RE error: illegal byte sequence
 
Here is a modification to linux flashrom that says it support Promise PCD206x cards like these.

I know @dosdude1 was able to modify flashrom to flash New World Mac's 1 MB boot rom, so this is likely the easiest way for us to flash these cards.

 
Here is a modification to linux flashrom that says it support Promise PCD206x cards like these.

I know @dosdude1 was able to modify flashrom to flash New World Mac's 1 MB boot rom, so this is likely the easiest way for us to flash these cards.

Flashrom should support the Promise ATA 100 cards, but it's looks like the 133 maybe untested/unsupported:

 
Try
LANG=en_US.US-ASCII
Try entering it as a separate command.

This didn't work, but found the command that did:

Code:
LC_ALL=C

and I got the proper ROM size (65536) from fwre_136.txt (attached).

Another (stupid?) question: when I try to run:

Code:
DumpPCIRom.sh "${theresource}".rom > "${theresource}".4th 2> "${theresource}".log

I'm getting:

Code:
DumpPCIRom.sh log:

# Working Path: /Volumes/RAID 2TB VR/SOTFWARE/PPC/firmware
# Script Path: /usr/local/bin

========================
ConvertFCodeTokensToForth.pl log:
# Didn't get start fcode.
# Didn't get end fcode.

and "permission denied" in detok log.
This causes bad fwre_136.4th file.

What permissions I should set for detok and toke or do I need to build both from sources? I put these found in your OpenBios/Tokenizer folder in my /usr/local/bin along with ConvertFCodeTokensToForth.pl and Test.pl.
 

Attachments

  • fwre_136_rom.zip
    62 KB · Views: 93
Flashrom should support the Promise ATA 100 cards, but it's looks like the 133 maybe untested/unsupported:

I'm afraid that flashrom (modified one too) won't help us:

Code:
.BR "atapromise " programmer
.IP
This programmer is currently limited to 32 kB, regardless of the actual size of the flash chip. This stems
from the fact that, on the tested device (a Promise Ultra100), not all of the chip's address lines were
actually connected. You may use this programmer to flash firmware updates, since these are only 16 kB in
size (padding to 32 kB is required).

PTIFlash has this limitation as well, hence this incomplete Mac ROM I found on maco9lives forum.
 
This didn't work, but found the command that did:

Code:
LC_ALL=C

and I got the proper ROM size (65536) from fwre_136.txt (attached).

Another (stupid?) question: when I try to run:

Code:
DumpPCIRom.sh "${theresource}".rom > "${theresource}".4th 2> "${theresource}".log

I'm getting:

Code:
DumpPCIRom.sh log:

# Working Path: /Volumes/RAID 2TB VR/SOTFWARE/PPC/firmware
# Script Path: /usr/local/bin

========================
ConvertFCodeTokensToForth.pl log:
# Didn't get start fcode.
# Didn't get end fcode.

and "permission denied" in detok log.
This causes bad fwre_136.4th file.

What permissions I should set for detok and toke or do I need to build both from sources? I put these found in your OpenBios/Tokenizer folder in my /usr/local/bin along with ConvertFCodeTokensToForth.pl and Test.pl.
They should have execute permission

Code:
where detok
/Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/detok/obj-amd64/detok

where toke
/Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/toke/obj-amd64/toke

where DumpPCIRom.sh
/Volumes/Updates/Docs/Open_Firmware_and_Forth/MacOSX/DumpPCIRom.sh

ls -l "$(where detok)"
-rwxr-xr-x  1 joevt  staff  47416 20 May  2018 /Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/detok/obj-amd64/detok

ls -l "$(where toke)"
-rwxr-xr-x  1 joevt  staff  64228 May 20  2018 /Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/toke/obj-amd64/toke

ls -l "$(where DumpPCIRom.sh)"
-rwxr--r--@ 1 joevt  staff  14575 Oct 25  2020 /Volumes/Updates/Docs/Open_Firmware_and_Forth/MacOSX/DumpPCIRom.sh
 
  • Like
Reactions: 666sheep
Part 2 has the real fcode for the Tempo. It adds an NDRV named "driver,AAPL,MacOS,PowerPC" for Mac OS 9 and it adds an mkext named "driver,AAPL,MacOSX,PowerPC" for Mac OS X.
You can use DumpPEF command to disassemble the NDRV.
Didn't you have a version of WPM that would run under the modern macOS?

I'll need a little help with setup and syntax of DumpPEF. I'd like to get a look at some 'NDRV's to see if I can make sense of them.

On the topic, SerialTek/Sonnet used the SCSI Manager for the Mac OS on there ATA/SATA cards. Likely because it was better documented/less buggy, but it does present a few issues with the use of ATAPI devices under OS 9( or older Mac OS ). Apple DVD Player and iDVD expect/check if these devices are ATA(PI).

At some point I'd like to fix this, on Old World Machines without a built-in ATA bus, it would be nice to be able to run the DVD Player and iDVD under OS 9. These Old World Machines have the ATA Manager in the 4MB BOOT ROM, so we should be able to write/hack an 'NDRV' for the Mac OS(9) that makes the PCI cards show up as Built-in ATA Buses.

Tho it maybe easier to Just hack the DVD player and iDVD to accept SCSI devices/ remove the check.

One aside to that is the SATA cards that work with OS 9( SIL3112 based ), don't support ATAPI SATA devices. Sieral-Tek/Sonnet just din't care, they sold the cards as compatible with SATA Hard Disks and wouldn't/didn't/couldn't support ATAPI under the Mac OS( 9 ).

The Ultra-Tek card do support ATAPI under OS 9, you just need Toast or some 3rd party driver to utilize Disc Burners.
 
Ok, here is the 4th script I have, but the Sonnet Flasher still says " No Card".

Code:
\ comment

cr

hex

00000000 encode-int " fcode-rom-offset" property
" scsi" encode-string " device-type" property
" UltraTek133" encode-string " name" property
" UltraTek133" encode-string " compatible" property
" 3.5.0" encode-bytes " Rom#" property
" 3.5.0" encode-string " rom-revision" property  
" UltraTek133"    encode-string " release" property
" PDC20269" encode-string " model" property
" UltraTek Firmware by FirmTek LLC, 2001. You may not alter or reverse engineer this product" \ encode-bytes " Copyright" property
" Authors: Nguyen Kim Chi, Rath Gyoergy." encode-bytes " authors" property
" Szerzoek: Nguyen Kim Chi, Rath Gyoergy." encode-bytes " Szerzoek" \ property
" 10/23/02" encode-string " release-date" property
" 12:33.03" encode-string " release-time" property
0000AD69 encode-int " subsystem-id" property
" SLOT-5" encode-string " AAPL,slot-name" property
 
Last edited:
Regarding the compression, the example firmware I have has 64193 bytes of fcode in the first step (63K) and the decompressed fcode is 93816 bytes (91K) so you see how it can be useful if the rom chip is only 64K or if the rom chip also contained a BIOS or EFI image.
Anyway, it's possible that the decompressed fcode does not require anything of the first fcode, in that case you could load just the decompressed part if you are able to extract it.
Ok, at this point I think this is the best thing to try.

Could you help outline how to properly extract and load the fcode?
 
Last edited:
Ok, here is the 4th script I have, but the Sonnet Flasher still says " No Card".

Code:
\ comment

cr

hex

00000000 encode-int " fcode-rom-offset" property
" scsi" encode-string " device-type" property
" UltraTek133" encode-string " name" property
" UltraTek133" encode-string " compatible" property
" 3.5.0" encode-bytes " Rom#" property
" 3.5.0" encode-string " rom-revision" property
" UltraTek133"    encode-string " release" property
" PDC20269" encode-string " model" property
" UltraTek Firmware by FirmTek LLC, 2001. You may not alter or reverse engineer this product" \ encode-bytes " Copyright" property
" Authors: Nguyen Kim Chi, Rath Gyoergy." encode-bytes " authors" property
" Szerzoek: Nguyen Kim Chi, Rath Gyoergy." encode-bytes " Szerzoek" \ property
" 10/23/02" encode-string " release-date" property
" 12:33.03" encode-string " release-time" property
0000AD69 encode-int " subsystem-id" property
" SLOT-5" encode-string " AAPL,slot-name" property
Looks like a script I saw in 2006 from strangedogs.proboards.com but it's missing the part where the dev is changed to the device of the pci card like this:
Code:
dev pci0
dev @10
or whatever the path is in your system.

Although the forum is mostly about graphics cards, it does have a couple threads about ATA cards. It mentions using old flashers to get around the issue of not being able to flash to cards of other manufacturers.


Ok, at this point I think this is the best thing to try.

Could you help outline how to properly extract and load the fcode?
The way I did it was that I had the sonnet card and a compatible Mac.
- Boot into OpenFirmware.
- Capture the RAM for the Open Firmware dictionary.
Code:
# Set the terminal width to 130 and make sure the unlimited buffer option is selected in the window preferences.
# On the G5, type " enet:telnet,192.168.1.150" io
# Then in the terminal type the following:

telnet
open 192.168.1.150

: dumpbytes cr bounds ?do i 3f and 0= if cr then i c@ 2 u.r loop cr ;


0 > ' <init-world> . ff845730  ok
0 > ff844b00 here ff844b00 - dumpbytes

ff84d168ff84d168ff84d168ff84d168ff84d168ff84d168ff84d168ff8a16e0ff8a1690ff8a1640ff8a1600ff8a1510ff8a14e0ff8a1488ff8a1460ff8a1430
ff8a13e8ff8a1390ff8a1358ff8a1300ff8a12a8ff8a1250ff8a1200ff8a11b8ff8a1168ff8a10d0ff8a1060ff8a0fe0ff8a0f70ff8a0eb0ff8a0e30ff8a0de0
ff8a0da8ff8a0d68ff8a0d38ff8a0cf8ff8a0ca8ff8494a8ff849490ff848a90ff848a70ff8489f8ff8489c8ff848888ff8487a8ff8484e8ff8484c8ff847c28
...
ffa3bdb00000000461646472657373000000003b00020000ffa3be58ffa3bde8ffa3bdd40000000466626f666673657400000000000000000b037f0806103292
0a0006400aa00a2f0a4f0000066e0642064800000ff95b0000000100000000000000000000000000000000000000000000000000000000000000000000000000
0000000009d5b3400200000000000000000000000000000000000000ffa3be68ffa3bdf80000005c4e564d5400000000669955aa00000000ffffbc6084b7ffff
0964756d706279746573000000000000967efffc7e6802a64be16b014be1127d4be0b2014800003c4be0c3014be0a6f50000003f4be0e1354be0dbe94be0b16d
480000084be16ad54be0c2e14be0c35d4be0d2d14be1b4854be0b2214bffffcc4be16ab94be0a5bc
 ok
0 >

All this stuff in the dictionary includes compiled fcode, the device tree, device tree properties and methods.
In the above example, <init-world> is the first word in the dictionary (it is the last word output by the words command). On my PowerMac G5, it's at address ff845730. ff844b00 is that address minus ≈ 3K. I think I chose this as the start because it looked interesting?

- save the hex into a binary file.
xxd -p -r < compiledfcode.txt > compiledfcode.bin

- Parse it using my DumpMacRom MPW script. It will put fcode that it finds into a separate "Part2.of" file.
DumpMacRom -d -s $FF844B00 compiledfcode.bin

This might not work if you don't have a Sonnet card with the rom. I would try just dumping the contents of the driver-buffer word since you said you were able to get that far. What method did you use to load the FCode ROM in that case?

At the end of the rom is this code:
Code:
colon_definition_function_83f                                                    \ (83f)
colon_variable_80b_l@                                                    \ (824)
['] c@
byte-load

The fcode numbers may be different depending on what firmware version you're wanting to use. 83f does the decompression of "driver,FirmTek,MacOS,PowerPC". The address and length of the result appears to be at variables 80b and 80a. You see the byte-load command takes the start address at 80b and it takes the execution token c@ to run that part 2 fcode. It seems that in other Open Firmware implementations, the byte-load command's second parameter is supposed to be a value representing the span of each token in the fcode (usually 1 byte). Maybe this is why it failed in Qemu? That seems unlikely since the Open Firmware spec says the execution token is correct and I assume Openbios follows the spec. c@ is a function to load a single byte. I suppose you could pass any function that returns a byte - that way you can affect how it does the loading.

Anyway, like I said before, you could modify this rom to save the address and length to a visible word. Actually, just change headerless to external.

Try getting a PCIe to PCI bridge on a new Mac, run Linux and see what flashrom says.
 
Last edited:
Try getting a PCIe to PCI bridge on a new Mac, run Linux and see what flashrom says.
I have such a bridge I use for PCI-Passthough to qemu-system-ppc on my x86_64 Linux rig.

Anyway, after a bit of fiddling:

Code:
flashrom --programmer atapromise -r bk.bin
[sudo] password for jam:
flashrom  on Linux 4.16.12 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Do not use this device as a generic programmer. It will leave anything outside
the first 16 kB of the flash chip in an undefined state. It works fine for the
purpose of updating the firmware of this device (padding may necessary).
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.

This was not an unexpected result, as the atapromise support in flashrom was only tested with the Ultra100 card, but should work with the Ultra66 cards too. However flashrom can only write 32k to the EEPROM unless you do the hardware mod to allow full access to the EEPROM:


Anyway the UltraTek133 doesn't have an external EEPROM, it's part of the 20269 chip itself, so Flashrom would have to be edited to add support for this case, which would require reverse engineering how that works as we have no documentation.
 
@joevt

Isn't 0x30 the standard offset of the EEPROM in the PCI Bus Bindings?

from the reg and assigned-addresses property of you Tempo Trio card:

Code:
reg                     00011000 00000000 00000000  00000000 00000000
                        01011010 00000000 00000000  00000000 00000010
                        01011014 00000000 00000000  00000000 00000010
                        01011018 00000000 00000000  00000000 00000010
                        0101101C 00000000 00000000  00000000 00000010
                        01011020 00000000 00000000  00000000 00000010
                        02011024 00000000 00000000  00000000 00010000
                        02011030 00000000 00000000  00000000 00010000
                       
assigned-addresses      81011010 00000000 00001040  00000000 00000010
                        81011014 00000000 00001030  00000000 00000010
                        81011018 00000000 00001020  00000000 00000010
                        8101101C 00000000 00001010  00000000 00000010
                        81011020 00000000 00001000  00000000 00000010
                        82011024 00000000 80820000  00000000 00010000
                        82011030 00000000 80810000  00000000 00010000

We know the FCode ROM does somefixup of these properties, do you think this maybe why the Sonnet Flasher keeps returning " No Card" even tho I've built all the IONameReg properties in my script?

Because without the reg and assigned-addresses properties of 02011030 00000000 00000000 00000000 00010000 and 82011030 00000000 80810000 00000000 00010000 the flasher can't find the EEPROM?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.