IRIXNetwork

**sunray** · 08-07-2021, 04:13 PM

(08-04-2021, 06:41 PM)robespierre Wrote:
(08-04-2021, 03:54 PM)soviet Wrote: The prom chip on the octane is a dip package ?, is socketed ?
The firmware on the Octane is not a PROM chip (no SGI computer uses a PROM chip for firmware, despite the boot environment is called "prom"), it is in a ((TSOP40))* Flash chip beneath the processor module.
If you want to recover a bricked board, the most efficacious means is to rework the chip to remove it and reflash it in an external device programmer.

Edit: actually a TSOP56. It would be interesting to see how the J10 "Select Flash Prom" is wired, if it connects to the Chip Enable pins of the respective sockets. I don't have an Octane so I cannot test this.
It's hard to see how it could be used to bootstrap code into the Flash chip, since the jumper can't be accessed while the machine is on (IP30 board must be completely seated). If the story about factory use is correct, there are only a few possibilities. Either they had card extenders so the IP30 could be used while it stuck all the way out; or, a cable with a switch was fed in somehow to plug onto the jumper; or, the jumper somehow allows reads only from the DIP socket and writes only to the Flash chip.

A more permanent link to the messages from an SGI engineer is here: https://groups.google.com/g/comp.sys.sgi...jWo_jnYRXQ

Not mean to be picky but flash is a kind of prom, we have eeprom and eprom and rom aswell the latter is the only one not possibke to reprogram

And ”Ram” is not ram its rwm the above are all ram Smile

soviet · 08-07-2021, 06:32 PM

Now, what even bother about swapping chips etc.

If you can program the dip flash chip on a programmer and insert it on the socket switch the jumper, if it works just let it be like that who cares if is the onboard flash or the socketed one ?.

zeldakatze · 08-08-2021, 02:15 PM

Hello again,
Please excuse the long delay, I'm sorry about that, but I was a bit busy with other stuff, so I didn't really find the time to do stuff on the Octane.

(08-04-2021, 05:21 PM)soviet Wrote: A lot of maybe's
Maybe theres a eeprom is an equivalent DIP package of the tssop one ?.
Maybe inserting an eprom on this "empty socket" on a working octane when already booted up, and flashing ?, then using it to start the non working one ?.

I looked if there are any DIP 512K*16 Flash chips. I, at least for now, could not find any. Maybe it would be possible to use multiple 512K*8 chips, but maybe I'll just buy a TSOP chip and try to solder that.

I had another look at the Google Groups discussion. The one who had the problem there still got some output over the serial port. I'll try to have a look if that's possible on my Octane and I will report what it will output. But for that I'll first have to find my Serial Null-modem cable.

One other thing I'll try is to test if the rest of my Octane works, for that, I'll try to swap stuff with my other Octane.

One more idea that I had is to make so sort of DIP-"extension/Null-modem" Cable, because if the DIP sockets are somehow directly connected to the TSOP flash, it should be possible to use a flash from another board, right? Or is that just a bad idea?

regards,
zeldakatze

**weblacky** · 08-08-2021, 07:38 PM

We’re kind of in uncharted (poorly documented) waters here. I don’t think anyone has even claimed to read one of those chip, obviously you cannot solder a blank TSSOP chip onto the board and flash it. It needs to have some functioning PROM code flashed to it before soldering.

If your up for a project, you need to desolder a working PROM (same board revision?) and read it’s contents then hope that cloning it’s contents to a new chip and installing it in this board would result in a working/bootable board.

Yes, the firmware for flashing is on Irix media. But two items would worry me, #1. Is the firmware Irix has a complete image are just a partial update of what’s also on that chip (like boot code is the same and they only reprogram certain regions?) and #2 if the firmware is a complete image, is it in a format that readable by common external IC programmer in today’s world?

That’s some big unknowns, cloning an existing PROM in full would at least bring control of formats and data under a single programmer device and not be at the mercy of externally-provided files and such.

Perhaps this issue isn’t common enough to consider mods and just have some PROM images saved online and get someone to program one and sell it to you and another proper to install it (soldering).

I do agree with others, occasionally Octane mainboards come up for like under $200 on eBay, it’s cheaper to just get another on and sell this one of sorts or as a project board to some one else.

zeldakatze · 08-08-2021, 10:46 PM

(08-08-2021, 07:38 PM)weblacky Wrote: Yes, the firmware for flashing is on Irix media. But two items would worry me, #1. Is the firmware Irix has a complete image are just a partial update of what’s also on that chip (like boot code is the same and they only reprogram certain regions?) and #2 if the firmware is a complete image, is it in a format that readable by common external IC programmer in today’s world?

I had a look at the IP30prom.bin file on the Irix 6.5 install tools CD. It contains a lot of ASCII messages, so I presume that it is a full Image in a normal HEX format. What bothers me however is that at every rom I've found is 800 Kilobytes to 1 Megabyte in size, which would make sense as the TSOP flash has 1 Megabyte of memory. The DIP40 socket, according to the Google group only has 18 address lines, limiting it to 512 Kilobytes. And the pinout they described would make sense. Another Forum Post showed how to Upgrade the Indy Prom, which uses a 256K*16 EEPROM, like the W27C4096. The Pinout of the DIP version of that chip would be about identical to the one found in the Google Groups entry, except for the Erase PIN of the W27C4096. Maybe SGI had some sort of "light" PROM image for just starting the machine and flashing it, though that is just speculation.

(08-08-2021, 07:38 PM)weblacky Wrote: If your up for a project, you need to desolder a working PROM (same board revision?) and read it’s contents then hope that cloning it’s contents to a new chip and installing it in this board would result in a working/bootable board.

I could try and get my second Octane working, then I could try to dump the firmware, as it should be an accessible memory area.

(08-08-2021, 07:38 PM)weblacky Wrote: I do agree with others, occasionally Octane mainboards come up for like under $200 on eBay, it’s cheaper to just get another on and sell this one of sorts or as a project board to some one else.

I could probably not afford that. 200$/€ is a lot, I'll have a look, but I don't think I'll get on in Europe and shipping from the U.S would cost a lot aswell. So that would probably not be a viable solution for me.

regards,
zeldakatze

I just had another look at the PROM in a hexdump form, trying to figure out if it would be possible to somehow shorten it to 512K (I know thats absourd to try to shrink it down by that much).
I then stumbled over the following text:

Code:
0001abe0  00 40 00 08 00 00 00 00  46 50 52 4f 4d 20 49 6e  |.@......FPROM In|

0001abf0  76 61 6c 69 64 2c 20 53  74 61 72 74 69 6e 67 20  |valid, Starting |

0001ac00  52 65 63 6f 76 65 72 79  0d 0a 00 00 00 00 00 00  |Recovery........|

0001ac10  50 41 4e 49 43 3a 20 4e  6f 6e 65 20 6f 66 20 74  |PANIC: None of t|

0001ac20  68 65 20 70 72 6f 63 65  73 73 6f 72 28 73 29 20  |he processor(s) |

0001ac30  70 61 73 73 65 64 20 74  68 65 20 63 61 63 68 65  |passed the cache|

0001ac40  20 64 69 61 67 6e 6f 73  74 69 63 73 2e 0d 0a 00  | diagnostics....|

0001ac50  62 6f 6f 74 6d 61 73 74  65 72 00 00 00 00 00 00  |bootmaster......|

0001ac60  66 61 73 74 66 61 6e 00  a8 00 00 00 20 f1 6a e4  |fastfan..... .j.|

0001ac70  ff ff ff ff 9f c0 06 2c  ff ff ff ff 9f c1 ab e8  |.......,........|

0001ac80  a8 00 00 00 20 f0 00 00  a8 00 00 00 20 f1 6a f0  |.... ....... .j.|

0001ac90  a8 00 00 00 20 f1 6b 80  ff ff ff ff 9f c0 06 3c  |.... .k........<|

0001aca0  ff ff ff ff 9f c0 06 8c  ff ff ff ff 9f c0 06 b4  |................|

0001acb0  ff ff ff ff 9f c0 06 64  52 50 52 4f 4d 20 4d 61  |.......dRPROM Ma|

0001acc0  69 6e 0a 00 00 00 00 00  46 70 72 6f 6d 20 72 65  |in......Fprom re|

0001acd0  63 6f 76 65 72 79 20 73  75 63 63 65 73 73 66 75  |covery successfu|

0001ace0  6c 0a 00 00 00 00 00 00  46 70 72 6f 6d 20 72 65  |l.......Fprom re|

0001acf0  63 6f 76 65 72 79 20 73  75 63 63 65 73 73 66 75  |covery successfu|

0001ad00  6c 00 00 00 00 00 00 00  50 6f 77 65 72 20 6f 66  |l.......Power of|

0001ad10  66 20 73 79 73 74 65 6d  20 61 6e 64 20 72 65 2d  |f system and re-|

0001ad20  69 6e 73 74 61 6c 6c 20  70 61 73 73 77 64 20 6a  |install passwd j|

0001ad30  75 6d 70 65 72 0a 00 00  46 70 72 6f 6d 20 72 65  |umper...Fprom re|

0001ad40  63 6f 76 65 72 79 20 66  61 69 6c 65 64 0a 00 00  |covery failed...|

0001ad50  46 70 72 6f 6d 20 72 65  63 6f 76 65 72 79 20 66  |Fprom recovery f|

0001ad60  61 69 6c 65 64 00 00 00  ff ff ff ff 9f c1 ac b8  |ailed...........|

0001ad70  ff ff ff ff 9f c0 3d d8  a8 00 00 00 20 f0 01 e0  |......=..... ...|

0001ad80  a8 00 00 00 20 f0 01 d8  a8 00 00 00 20 f0 00 b0  |.... ....... ...|

0001ad90  a8 00 00 00 20 f1 6a c0  74 66 74 70 00 00 00 00  |.... .j.tftp....|

0001ada0  64 76 68 00 00 00 00 00  ff ff ff ff 9f c1 dd 98  |dvh.............|

0001adb0  66 6c 61 73 68 2f 49 50  33 30 70 72 6f 6d 2e 62  |flash/IP30prom.b|

0001adc0  69 6e 00 00 00 00 00 00  2f 49 50 33 30 70 72 6f  |in....../IP30pro|

0001add0  6d 00 00 00 00 00 00 00  a8 00 00 00 20 f0 00 00  |m........... ...|

If I understand that correctly (and the messages are not just coincedentially next to each other and infact totally independent), SGI has a failsafe for such siturations and allows for sending the PROM over TFTP

I'll have a further look at that tomorrow.

regards, zeldakatze

**Raion** · 08-09-2021, 02:10 AM

You can dump firmware on every SGI made afaik.

**weblacky** · 08-09-2021, 02:18 AM

(08-08-2021, 10:46 PM)zeldakatze Wrote:
(08-08-2021, 07:38 PM)weblacky Wrote: Yes, the firmware for flashing is on Irix media. But two items would worry me, #1. Is the firmware Irix has a complete image are just a partial update of what’s also on that chip (like boot code is the same and they only reprogram certain regions?) and #2 if the firmware is a complete image, is it in a format that readable by common external IC programmer in today’s world?
I had a look at the IP30prom.bin file on the Irix 6.5 install tools CD. It contains a lot of ASCII messages, so I presume that it is a full Image in a normal HEX format. What bothers me however is that at every rom I've found is 800 Kilobytes to 1 Megabyte in size, which would make sense as the TSOP flash has 1 Megabyte of memory. The DIP40 socket, according to the Google group only has 18 address lines, limiting it to 512 Kilobytes. And the pinout they described would make sense. Another Forum Post showed how to Upgrade the Indy Prom, which uses a 256K*16 EEPROM, like the W27C4096. The Pinout of the DIP version of that chip would be about identical to the one found in the Google Groups entry, except for the Erase PIN of the W27C4096. Maybe SGI had some sort of "light" PROM image for just starting the machine and flashing it, though that is just speculation.

(08-08-2021, 07:38 PM)weblacky Wrote: If your up for a project, you need to desolder a working PROM (same board revision?) and read it’s contents then hope that cloning it’s contents to a new chip and installing it in this board would result in a working/bootable board.
I could try and get my second Octane working, then I could try to dump the firmware, as it should be an accessible memory area.

(08-08-2021, 07:38 PM)weblacky Wrote: I do agree with others, occasionally Octane mainboards come up for like under $200 on eBay, it’s cheaper to just get another on and sell this one of sorts or as a project board to some one else.
I could probably not afford that. 200$/€ is a lot, I'll have a look, but I don't think I'll get on in Europe and shipping from the U.S would cost a lot aswell. So that would probably not be a viable solution for me.

regards,
zeldakatze

I just had another look at the PROM in a hexdump form, trying to figure out if it would be possible to somehow shorten it to 512K (I know thats absourd to try to shrink it down by that much).
I then stumbled over the following text:

Code:
0001abe0 00 40 00 08 00 00 00 00 46 50 52 4f 4d 20 49 6e |.@......FPROM In| 0001abf0 76 61 6c 69 64 2c 20 53 74 61 72 74 69 6e 67 20 |valid, Starting | 0001ac00 52 65 63 6f 76 65 72 79 0d 0a 00 00 00 00 00 00 |Recovery........| 0001ac10 50 41 4e 49 43 3a 20 4e 6f 6e 65 20 6f 66 20 74 |PANIC: None of t| 0001ac20 68 65 20 70 72 6f 63 65 73 73 6f 72 28 73 29 20 |he processor(s) | 0001ac30 70 61 73 73 65 64 20 74 68 65 20 63 61 63 68 65 |passed the cache| 0001ac40 20 64 69 61 67 6e 6f 73 74 69 63 73 2e 0d 0a 00 | diagnostics....| 0001ac50 62 6f 6f 74 6d 61 73 74 65 72 00 00 00 00 00 00 |bootmaster......| 0001ac60 66 61 73 74 66 61 6e 00 a8 00 00 00 20 f1 6a e4 |fastfan..... .j.| 0001ac70 ff ff ff ff 9f c0 06 2c ff ff ff ff 9f c1 ab e8 |.......,........| 0001ac80 a8 00 00 00 20 f0 00 00 a8 00 00 00 20 f1 6a f0 |.... ....... .j.| 0001ac90 a8 00 00 00 20 f1 6b 80 ff ff ff ff 9f c0 06 3c |.... .k........<| 0001aca0 ff ff ff ff 9f c0 06 8c ff ff ff ff 9f c0 06 b4 |................| 0001acb0 ff ff ff ff 9f c0 06 64 52 50 52 4f 4d 20 4d 61 |.......dRPROM Ma| 0001acc0 69 6e 0a 00 00 00 00 00 46 70 72 6f 6d 20 72 65 |in......Fprom re| 0001acd0 63 6f 76 65 72 79 20 73 75 63 63 65 73 73 66 75 |covery successfu| 0001ace0 6c 0a 00 00 00 00 00 00 46 70 72 6f 6d 20 72 65 |l.......Fprom re| 0001acf0 63 6f 76 65 72 79 20 73 75 63 63 65 73 73 66 75 |covery successfu| 0001ad00 6c 00 00 00 00 00 00 00 50 6f 77 65 72 20 6f 66 |l.......Power of| 0001ad10 66 20 73 79 73 74 65 6d 20 61 6e 64 20 72 65 2d |f system and re-| 0001ad20 69 6e 73 74 61 6c 6c 20 70 61 73 73 77 64 20 6a |install passwd j| 0001ad30 75 6d 70 65 72 0a 00 00 46 70 72 6f 6d 20 72 65 |umper...Fprom re| 0001ad40 63 6f 76 65 72 79 20 66 61 69 6c 65 64 0a 00 00 |covery failed...| 0001ad50 46 70 72 6f 6d 20 72 65 63 6f 76 65 72 79 20 66 |Fprom recovery f| 0001ad60 61 69 6c 65 64 00 00 00 ff ff ff ff 9f c1 ac b8 |ailed...........| 0001ad70 ff ff ff ff 9f c0 3d d8 a8 00 00 00 20 f0 01 e0 |......=..... ...| 0001ad80 a8 00 00 00 20 f0 01 d8 a8 00 00 00 20 f0 00 b0 |.... ....... ...| 0001ad90 a8 00 00 00 20 f1 6a c0 74 66 74 70 00 00 00 00 |.... .j.tftp....| 0001ada0 64 76 68 00 00 00 00 00 ff ff ff ff 9f c1 dd 98 |dvh.............| 0001adb0 66 6c 61 73 68 2f 49 50 33 30 70 72 6f 6d 2e 62 |flash/IP30prom.b| 0001adc0 69 6e 00 00 00 00 00 00 2f 49 50 33 30 70 72 6f |in....../IP30pro| 0001add0 6d 00 00 00 00 00 00 00 a8 00 00 00 20 f0 00 00 |m........... ...|
If I understand that correctly (and the messages are not just coincedentially next to each other and infact totally independent), SGI has a failsafe for such siturations and allows for sending the PROM over TFTP

I'll have a further look at that tomorrow.

regards, zeldakatze

That’s an interesting idea. Instead of trying to debug the prom code you could use a network traffic sniffer and see if a TFTP request comes out of the Octane at any point. The request alone might be for one of the firmware files as named?

I’d assume it would be unsolicited because Else it would require setting a prom variable to know which server to get it from. So perhaps it simply asked a default IP address for a default path to a prom file?

Worth a look.

ruckusman · 01-05-2025, 12:22 AM

Very old post and I don't have a mis-flashed Octane to try this on, however in the PROM file I have from below:
https://www.vdheijden-messerli.net/sgist...rev4.9.bin

There's an IP address, 192.0.2.1 floating in amongst the code (data) all alone which isn't amongst the other text strings.

Its at address 0x000c2ed0 for reference.

It could be worth putting flash/IP30prom.bin &/or just IP30prom.bin in the root directory of a tftp server at 192.0.2.1 to see if the Fprom recovery works.

There are the other tftp references and addresses obtained easily via strings, but this one slips past easily unnoticed and using grep -i -e 192.168 to catch the IP addresses doesn't catch it at all...

The alternate DIP EEPROM with the jumper to choose between them is an interesting idea

ruckusman · 01-19-2025, 03:00 AM

So I got bored and decided to do some research regarding this.

Here's what looks to be the correct datasheet for the Octane TSOP56 EEPROM chip
https://www.alldatasheet.net/html-pdf/42...UT-70.html

For clarification
NB A0 on the TSOP56 version has a specific purpose, setting low/high addresses.

The address lines on the TSOP56 version are A1 -> A16

Re: TSOP48 version, that same pin A0 obviously is on the TSOP48 chip, one of the address lines 1 -> 16, it isn't for the same purpose as on the TSOP56 version.

On the above TSOP56 chip datasheet, A0 isn't used in 16 bit mode AND A1 -> A15 sets the addresses, A16, A17 and A19 have other purposes related to block addressing for flashing and erasing - see screenshot from the TSOP56 datasheet below

Filename: Screen Shot 2025-01-19 at 1.39.24 pm.png Size: 76.87 KB 01-19-2025, 02:46 AM

There is actually a TSOP48 version of that same EEPROM chip, and it doesn't have an A19 address line and doesn't seem to an equivalent A0 (TSOP56) function pin either, looks to operate uniquely in 16 bit mode giving the full 8Mb (1MB).

https://www.alldatasheet.net/html-pdf/42...G-L70.html

I'm yet to fully cross reference all of the address lines between the two versions of the EEPROM, (actually have done most of that in the process of writing this).

HOWEVER - looking at the pinout that Benjamin Döpke managed to do in the google groups post: (I've added a few parts which he discovered later) to his ASCII graphic

Benjamin was so so close with his work and research, one or two datasheets probably would have got him over the line IMO.

* -Pin 1 sets the voltage at which the chip operates, at as it's dual voltage 3.3/5V

+--------------+
Vcc* | 1 \/ 40| Vcc
#CE   | 2 39| A18
DQ15 | 3 38| A17
DQ14 | 4 37| A16
DQ13 | 5 36| A15
DQ12 | 6 35| A14
DQ11 | 7 34| A13
DQ10 | 8 33| A12
DQ9 | 9    32| A11
DQ8   |10   31| A10
GND   |11 30| GND
DQ7   |12   29| A9
DQ6   |13   28| A8
DQ5   |14   27| A7
DQ4   |15   26| A6
DQ3   |16   25| A5
DQ2   |17   24| A4
DQ1   |18   23| A3
DQ0   |19   22| A2
#OE   |20   21| A1
+--------------+

From the above, and cross referenced with the datasheet(s) if you remove some redundant pins, NC (x3), A0, A19 etc and a few others related specifically to writing/programming the EEPROM chip;
RP#
WE#
WP#
RY/BY#
Vpp

You get the relevant 40 pins that he correctly identified - which actually makes perfect sense as if you're booting from the Promice, you don't want to accidentally program that chip, it acts a ROM, to boot the machine.

Moving further, there are very cheap TSOP48 (solder down) -> DIP48 boards.
https://www.digikey.com.au/en/products/d...08/5014757

Using that as as a daughter card - one of those would need a board underneath, to re-route the 48 pins -> 40 pins , eliminating the extra, redundant 8 pins.

That could potentially enable the TSOP48 EEPROM (loaded with either correct firmware to be able to boot fully to program the onboard EEPROM) or potentially modified, experimental firmware that doesn't risk bricking a motherboard, if it doesn't work out, change the jumper &/or remove the other EEPROM from the socket altogether and correct the error.

Anyway, food for thought, now I'm going to have to haul the Octane off the shelf in the garage to see if such a device would fit underneath the CPU when it's installed...

Login
Username:
Password:	Lost Password?
	Remember me