Nonononono - both of you guys are misinterpreting what I said. I didn't mean to suggest that this could/should be done via JTAG - I was speaking broadly of the historical manufacturing ISP trend in using these parts, *not* of the specifics of this case. In any event, of course there's no such port on these FLASH chips, but that wouldn't necessarily be needed to accomplish such programming; all you need is *a* device with a boundary scan port and enough pins on the bus to be able to assert the necessaries for programming on the memory. But again, this is general interest stuff and not meant to apply to the present case. I honestly didn't mean to create confusion or get anyone agitated.
The reason I went off on that little tangent was simply to speculate on how the software that's in the FLASH got there, because that same means may (or may not) be used for updating it. It's soldered down and unmarked, so it's less likely to have been programmed prior to placement. So that leaves ISP of one form or another. Maybe ATE, less likely (but not impossible) JTAG, or via the SCSI or special media. That was all I was getting at.
So I think the question remains unanswered. Obviously, between us we know how to cause default 512-byte block behaviour in the 3301 and 3401 (firmware swap and jumper pads respectively), but not with the 3501, which remains a problem if I'm trying to use it for R3K Indigo installs. I think there's probably a utility out there somewhere for the 3501, but lost to the sands of time.
Arguing with an engineer is like wrestling with a pig.
You're going to get dirty. You're going to lose. And the pig likes it.
Just about everything from
to
and a few beyond.
to 
and a few beyond.
(past: 
)