My SE/30: w/ Turbo 040, ROM-inator, Ethernet and 8.1

dougg3 said:

Someone can pretty easily see the locations that the Turbo 040 patches by dumping the Mac's ROM with and without the Turbo 040 installed and comparing the two.

Click to expand...

I tried dumping the 040 ROM with my IIcx, but I only get the ”MacIIx.ROM”, with or without the cache installed. (Not that I would know what to do with it).

I would gladly pay or help out in any way I’m capable of to get this ”Dream-ROM” done once and for all!

JDW said:

That's another reason I've not posted here in a few years.  I was seething after drive failures and upgrades deleted years of valuable dialog in the past.  It's shocking and unforgivable that none of that was properly backed up.  Even today I was searching the forum and was getting zero results for my rather general keyword searches.  Grrrr.

Click to expand...

Yeah, it's super frustrating -- that thread really had a lot of cool stuff in it. It's sad not being able to go back and see it. If I had known this would happen I would have archived that whole thread so I could go back and look at it someday.

JDW said:

I believe you mean that you disabled the "RAM" checksum, right?

Click to expand...

Nope, I mean the ROM checksum  I think you may be right that the RAM checksum was also disabled (maybe the Turbo 040 actually has its own configurable feature to do that too?). The thing about the ROM checksum is that I used to just change it to be correct after hacking the ROM, rather than patching out the checksum test. What I discovered was that certain things look at the ROM checksum to determine what Mac model it is, or at least what ROM it is. The Turbo 040 is one of those. So the Turbo 040 ROM hack for olePigeon was where I started disabling the ROM checksum test rather than fixing it up to be correct.

JDW said:

dougg3, would you be able to "make time" to develop a proper Turbo040 compatible ROM for the SE/30 if someone were to ship you a Turbo040 and TS Adapter for use on your SE/30?

Click to expand...

Sorry, but I just don't have the time. My day job keeps me busy enough that I don't have time to do any classic Mac hacking these days.  That's partly the reason that I stopped selling ROM SIMMs too and let BMOW take over. I also don't have an SE/30. I do have a couple of IIcis and a IIfx, but no SE/30. I'd be happy to provide any knowledge I can to help, but as far as actually hacking, testing, or doing any coding, I don't have the time.

ktkm said:

I tried dumping the 040 ROM with my IIcx, but I only get the ”MacIIx.ROM”, with or without the cache installed. (Not that I would know what to do with it).

I would gladly pay or help out in any way I’m capable of to get this ”Dream-ROM” done once and for all!

Click to expand...

By cache do you mean a cache card, or a Turbo 040 accelerator plugged into the cache card slot? A cache card won't change the ROM, but the Turbo 040 should. I know we witnessed it on olePigeon's IIci -- a ROM dump on his machine differed from a stock IIci ROM, because the Turbo 040 patched in several places where the Mac ROM jumps into the Turbo 040's ROM. I believe it also disabled the RAM checksum test, ROM checksum test, and some other stuff. Might have even provided a custom Daystar Happy Mac logo...now I'm starting to remember that maybe we couldn't patch the Happy Mac icon because the Turbo 040 did its own patch of that same icon? I can't remember...

FYI, there's an archive of dougg3's original "Another IIci ROM Hack" thread here: https://web.archive.org/web/20170606235523/68kmla.org/forums/index.php?/topic/15436-another-iici-rom-hack/ 

That's the thread where the programmable ROM SIMM idea was first hammered out. There are also a couple of old threads at mac68k.info where Rob and Doug discuss the ROM disk driver and how to best patch it into the stock ROM code without breaking everything, and some of Rob's web pages about the ROM disk design. As I recall, the driver was originally made for the Mac Plus ROM, and was later redone to work with the IIsi ROM. Or maybe I have that backwards. 

Anyone who might be interested in trying to create a new patch that combines the ROM disk driver with the olePigeon/dougg3/Turbo040 special ROM will find helpful information there.

https://mac68k.info/forums/thread.jspa?threadID=312&tstart=15

https://mac68k.info/forums/thread.jspa?threadID=430&tstart=15

http://synack.net/~bbraun/macromboot.html

http://synack.net/~bbraun/plusrom/index.html

dougg3 said:

By cache do you mean a cache card, or a Turbo 040 accelerator plugged into the cache card slot? A cache card won't change the ROM, but the Turbo 040 should. I know we witnessed it on olePigeon's IIci -- a ROM dump on his machine differed from a stock IIci ROM, because the Turbo 040 patched in several places where the Mac ROM jumps into the Turbo 040's ROM. I believe it also disabled the RAM checksum test, ROM checksum test, and some other stuff. Might have even provided a custom Daystar Happy Mac logo...now I'm starting to remember that maybe we couldn't patch the Happy Mac icon because the Turbo 040 did its own patch of that same icon? I can't remember...

Click to expand...

I meant the Turbo 040 accelerator. 

Did the ROM dump from the IIci, with the 040 accelerator installed, result in a ROM-file named other than ”MacIIci.ROM”?

No, it shouldn't.

However the file MacIIci.ROM with a Turbo040 installed will be different from from MacIIci.ROM without a Turbo040 installed.

Only way to dump the ROM on the T040 itself would be to remove it from its socket and read it in an external programmer.

v4.01 and 4.11 of the ROM are floating around the web somewhere, so if you want to take a look you can find them online already. No need to dump them again.

Bolle said:

Only way to dump the ROM on the T040 itself would be to remove it from its socket and read it in an external programmer.

v4.01 and 4.11 of the ROM are floating around the web somewhere, so if you want to take a look you can find them online already. No need to dump them again.

Click to expand...

Ah, I see. Thank you Bolle!

Bolle said:

Only way to dump the ROM on the T040 itself would be to remove it from its socket and read it in an external programmer.

v4.01 and 4.11 of the ROM are floating around the web somewhere, so if you want to take a look you can find them online already. No need to dump them again.

Click to expand...

From what I remember, the content of the ROM chip on the Turbo 040 is encrypted, so you won't see what the actual Turbo 040 ROM contents are by dumping the chip. If you need to make a copy of the ROM to put in another Turbo 040, then yes, you'd need to do it this way.

But you can actually dump the unencrypted ROM contents while booted into the Mac OS. Since the processor has to be able to read the ROM to execute code from it, you can read the contents of it too. You do this by dumping the 128 KB immediately after the 512 KB Mac ROM. I believe I actually made such a program a long time ago for olePigeon when were examining things to figure out what was going on. I determined that one of the Mac ROM patches that the Turbo 040 applies added code that jumped into that region so I was able to deduce that the Turbo 040 ROM was mapped there. Sure enough, when we tried to dump it, there it was.

bigmessowires said:

FYI, there's an archive of dougg3's original "Another IIci ROM Hack" thread here: https://web.archive.org/web/20170606235523/68kmla.org/forums/index.php?/topic/15436-another-iici-rom-hack/ 

Click to expand...

Thanks! Unfortunately not all the pages are there, but it's fun to be able to go back and look at some of it.

bigmessowires said:

FYI, there's an archive of dougg3's original "Another IIci ROM Hack" thread here: https://web.archive.org/web/20170606235523/68kmla.org/forums/index.php?/topic/15436-another-iici-rom-hack/ 

That's the thread where the programmable ROM SIMM idea was first hammered out. There are also a couple of old threads at mac68k.info where Rob and Doug discuss the ROM disk driver and how to best patch it into the stock ROM code without breaking everything, and some of Rob's web pages about the ROM disk design. As I recall, the driver was originally made for the Mac Plus ROM, and was later redone to work with the IIsi ROM. Or maybe I have that backwards. 

Anyone who might be interested in trying to create a new patch that combines the ROM disk driver with the olePigeon/dougg3/Turbo040 special ROM will find helpful information there.

https://mac68k.info/forums/thread.jspa?threadID=312&tstart=15

https://mac68k.info/forums/thread.jspa?threadID=430&tstart=15

http://synack.net/~bbraun/macromboot.html

http://synack.net/~bbraun/plusrom/index.html

Click to expand...

This is weird - I could have sworn I replied but must have closed my browser before I actually submitted. But it would have gone something like this:

Thanks for these links, @bigmessowires - I had a question about a passing comment you made on your programmer's product page. (https://www.bigmessowires.com/mac-rom-inator-ii/) 

On it, you said:

The Mac ROM-inator II’s flash memory can be reprogrammed using the ROM SIMM programmer, providing the ultimate in customization. There’s 4MB of flash memory (8MB for the MEGA) available for any purpose, like a custom ROM disk image, alternate ROM code, digitized sounds, user interface tweaks, or other crazy experiments. Using compression, this is enough for the base 512K ROM image plus a roughly 5.5MB uncompressed disk image (12MB for the MEGA). Or fill the whole space with a collection of different base ROMs, selected from a startup menu. Go nuts!

Click to expand...

Is this actually implemented somewhere or was that a suggestion of what the possibilities were by building some logic into the existing A/R/X boot menu? 

That was a suggestion for what might be possible - definitely not something I've implemented. 

FYI the ROM-inator II SIMM product is in its twilight days, because the 5V flash memory chips it uses aren't being manufactured anymore, and there's no easy substitute. I still have a decent amount of inventory for now, but when they're gone, that will be the end (barring some miracle).

dougg3 said:

Thanks! Unfortunately not all the pages are there, but it's fun to be able to go back and look at some of it.

Click to expand...

Here's an earlier archive of that thread, with the old phpbb site: https://web.archive.org/web/20111111074907/http://68kmla.org/forums/viewtopic.php?f=29&t=16544

It's even less complete I'm sure, but it's fun to go back and see it as it was in the beginning, especially for me, as it was one of the first threads I followed as a lurker back in the summer of 2011, when I first discovered this site.

I can't believe that was seven years ago!

c

CC_333 said:

Here's an earlier archive of that thread, with the old phpbb site: https://web.archive.org/web/20111111074907/http://68kmla.org/forums/viewtopic.php?f=29&t=16544

Click to expand...

Thanks! You're right...time flies! That is crazy.

dougg3 said:

You're right...time flies! That is crazy.

Click to expand...

It is indeed.

I still marvel at how you were able to do what you did! We sort of take it for granted nowadays, but back then, it was groundbreaking and new!

c

bigmessowires said:

FYI, there's an archive of dougg3's original "Another IIci ROM Hack" thread here: https://web.archive.org/web/20170606235523/68kmla.org/forums/index.php?/topic/15436-another-iici-rom-hack/

Click to expand...

The web archive does not appear to go past page 3.   That's when it was just getting interesting...

Bolle said:

No, it shouldn't.

However the file MacIIci.ROM with a Turbo040 installed will be different from from MacIIci.ROM without a Turbo040 installed.

Only way to dump the ROM on the T040 itself would be to remove it from its socket and read it in an external programmer.

v4.01 and 4.11 of the ROM are floating around the web somewhere, so if you want to take a look you can find them online already. No need to dump them again.

Click to expand...

I have uploads of what I read off the disembodied Daystar ROMs here:  https://www.prismnet.com/~trag/Daystar/Turbo040/

I had at least one question about whether the contents might be corrupt, so I'm not 100% they're good, but there should not have been any issue with how I read and uploaded the contents.

Edit:  Ah, just read down to Doug's post.  That explains the discrepancy.   The uploads are good, they're just not much good for reading.

trag said:

Edit:  Ah, just read down to Doug's post.  That explains the discrepancy.   The uploads are good, they're just not much good for reading.

Click to expand...

I *think* that's the case anyway. I don't remember if we ever determined with 100% certainty that they're actually encrypted, but that would definitely explain why the dumps you obtained look like they're corrupted. I'm not sure if anyone has ever tried copying one of your dumped ROMs and putting it into a Turbo 040. 

dougg3 said:

I'm not sure if anyone has ever tried copying one of your dumped ROMs and putting it into a Turbo 040. 

Click to expand...

I have, except....

I dumped the ROMs on my chip programmer.   Then I programmed more ROMs of the 4.1 ilk (was replacing 68LC040 with full 68040), installed those and they worked fine.     I also took the dump, which I had used to program additional chips, and uploaded it to my webspace (really ftp space, but never mind). 

So, if there is corruption, it happened somewhere in the getting the file to the internet phase, not in the pulling the file off the chip phase.

Daystar might have done something as simple as scrambling the data pins when they programmed/read the ROM.    If, e.g., you reversed the order of the data pins, everywhere you expect to see a 1, you'd see an 8.   0 would still be 0 and F would still be F, 9 would still be 9 and 6 would still be 6.  

Anyway, might be interesting to look and see if a straight substitution code would unscramble it.  Of course, if they scrambled the address lines as well, that would get messy.

I don't think it can actually be encrypted by mathematical algorithm.   The reason is that either the Mac or the Turbo040 must be able to read the unencrypted contents.    If the content is encrypted, where is a processor going to get the instructions for decrypting it?    I suppose there could be some hardware logic (decryption PAL?) on the board, but that would add cost to the product.   Scrambling the address and data lines doesn't add any hardware cost, and only requires them to (probablly) have some kind of adapter in between the chip and programmer at the factory.

Say, anyone remember if the Turbo040 was firmware updateable in the field?

I kind of think it was through the Control Panel, but I may be thinking of the Turbo601.  I have this memory that one could do some special key combination to the Control Panel and it would offer to update the firmware on the Turbo040.    I can't remember if there was a separate file, or if each update was embedded in the latest version of the CP.  

I'm working from more than 20 year-opld memories here, so forgive me if I'm completely wrong.

Point being, it would interesting to see what any user uploadable update looks like.

I have some of the GAL based Turbo040s.   One of these days I'm going to have tear one apart (delicately disassemble) and start tracing out things.   The rate things are going, you guys will have it done before I can get the box out of the attic.

I updated mine with the ROMs downloaded from you, so they do work just fine.

trag said:

I don't think it can actually be encrypted by mathematical algorithm.   The reason is that either the Mac or the Turbo040 must be able to read the unencrypted contents.    If the content is encrypted, where is a processor going to get the instructions for decrypting it?    I suppose there could be some hardware logic (decryption PAL?) on the board, but that would add cost to the product.   Scrambling the address and data lines doesn't add any hardware cost, and only requires them to (probablly) have some kind of adapter in between the chip and programmer at the factory.

Click to expand...

Agreed, I would also guess it has to be something simple like reordering the data and/or address lines.

trag said:

I'm working from more than 20 year-opld memories here, so forgive me if I'm completely wrong.

Click to expand...

Oh for sure...I have enough trouble remembering things from 2 years ago! 

Bolle said:

I updated mine with the ROMs downloaded from you, so they do work just fine.

Click to expand...

Good to know! So it has to be some kind of simple "encryption" if we even want to call it that.

I am getting a little lost in this ongoing back-and-forth. :b&w:

To reiterate what I said in an earlier post in this thread, my intent (and no doubt the intent of many others as well) is to have a programmable *.rom file that when burned to a ROM-inator II SIMM would perform as nicely as a IIsi ROM currently does in the SE/30.  In other words, a ROM that:

• Enables 32-bit addressing
  
• Allows booting into 7.6.1 and OS 8.1 (with patched System file)
  
• Disables the RAM checks (which takes forever if you have 128MB of RAM)
  
• Leaves sufficient room in a ROM-inator II SIMM (e.g., the MEGA) to include some of our favorite apps
  
• And offer Daystar Turbo 040 accelerator compatibility (or compatibility with 030 accelerators like the DiiMo or CPU-socketed PowerCache 030
  

So, are you gentlemen saying that you still need to determine if the Daystar ROM you have is NOT encrypted, to know whether or not it can be used to make a Turbo040-compatible ROM SIMM?

Currently the last two of your bullet points are mutually exclusive (ROM disk with your favorite apps, and Daystar Turbo 040 compatibility), so what you seek doesn't exist. It's not a question of having sufficient room to include a ROM disk, but a question of integrating the code that implements the ROM disk into the Turbo 040 code. Theoretically that should be possible, but it's semi-unknown territory and would require some substantial reverse engineering work from someone.