Jockelill
Well-known member
As some people here already know, I have spent the last couple of months getting to know the Quadra (1MB) ROMs better and get a ROM disk working for it. The basic idea was simply "if we can have a ROM disk for the SE/30, why not for my Q900?".
I started by reading up on Rob Braun's excellent site (http://www.synack.net/~bbraun/macromboot.html), it contains tons of great information, and his work was truly groundbreaking! He links to a lot of old 68k-threads that are sadly lost, but on his site is also a lot of other useful information, how he added ROM disk on Classic II (http://www.synack.net/~bbraun/classic2.html) and his memory hacks for the Quadra's (http://www.synack.net/~bbraun/djmemcrom.html).
My first dev machine was a Q900 board that I got from @jajan547. First i needed to design a little PSU adapter for it, so I based a design of @Melkhior's excellent ATX to IIci design to create a small "bench test PSU". And well, it all worked fine
. The Q900 uses the exact same ROM as the Q700 and the later Q950 ROM actually also works in all these machines, later ROMs (Q650, LC475) would chime but not output video. Fun fact, the Q950 ROM is the very last "universal ROM" and will also boot a IIci and SE/30 but adds no extra functionality so it makes little sense.
Since I now had a "universal ROM", I figured the Q950 was a good start for some ROM hacking. I'm fairly good at pattern identification (work habit), so I started searching for the same bit patterns in the Q950 ROM as Braun had hacked in the IIsi ROMs, and well, what do you know, I could identify first the ROM check and disable it, RAM check and the same atBOOT driver as used in the IIsi. I then modified the 096 driver braun has to have a 7MB ROM disk and rom disk placed at 40900000 since these ROMs are 1MB, recompiled (had to setup a virtual G3 running OS9 and Codewarrior 6 to do that, but that's a side track) and byte copied the bytes into the place where atBOOT used to be, and it was successful in the sense that I could see the driver being loaded, hold down R, but would get a question mark each and every time no matter what a tried.
So I needed some help. Since I've been working extensively with @dougg3 to create a new version of his ROM Simm Programmer (https://ko-fi.com/s/d6e7e4494d), and I knew he is close to a genius when it comes to ROMs and ROM hacking, he helped me setup some tools and I started to poke the memory. Quite soon we where able to find the main issue, the Q900 only maps up 1MB of ROM space by default so the ROM disk would never be mounted since that part of the memory is not available to the ROM. Doug thought for a while and came up with the brilliant solution to hack the MMU tables found in the upper register of the ROM, so I modded my ROM as per his suggestions, and what do you know, IT WORKED!!! For the first time (well, at least as far as me and @dougg3 knows ) we had a working ROM disk for the Q900!! WOOT!! WOOT!!
Now, strengthened by my success, I decided to attack the LC475 since I also had one in my shop. It has a provision for a ROM socket, but normally none added by default. Since I already had sockets around for building programmers, I decided to solder in a ROM socket, and then adapt the modifications and ROM disk driver I had for the Q900 (the LC475 is similar as the 900, but locations are of course different), but unfortunately it would give me sad chimes no matter what I tried.
At first I thought I had made some mistakes in my hacking, so I started removing stuff until in the end I had only 1 byte changed (and corrected checksum), but would still not boot, so, I decided to burn in a stock ROM and it booted just fine. I had some suspicion that there was some conflict with the onboard ROM, so I decided to lift the VCC leg of each ROM, and what do you know, it booted just fine of my hacked ROM! I quickly put back all the mods, and quite soon I had ROM disk driver also working for the LC475 if the legs of the onboards ROM where lifted. About the same time some Apple schematics started to leak here on 68k, and me and @dougg3 quickly realized that the pinning for the ROM simm on the Quadras is actually different of that of the IIsi!
Doug has written about it all on his excellent blog:
www.downtowndougbrown.com
With this in our mind, me, @dougg3, @WillJac, @jajan547, @JDW and @bigmessowires started to talk about viable solutions. Me and @dougg3 built hacked ROMs where we had simply cut some traces and bodged over to the correct place, and that made it boot in the LC475 with the onboards SIMM still active, but that would render the SIMM useless in a IIsi, so @dougg3 came up with a solution of having a small mechanical switch. You would switch over to SE/30 mode or back to "quadra mode". Doug built a mockup and I designed and built a small series which worked, but we all realized that this would be less than ideal for the normal user, and also with risk of damage to some logic boards if the switch was in the wrong place. So Doug reached out on his blog, and a lot of people pitched in with different ideas, but in the end we stuck with the idea from Steve Chamberlain from @bigmessowires to use a Comparator in conjuction with a TMUX to switch the necessary pins. I once again designed a new board and did a small run just to realize that we all three had missed a crucial point in the data sheet, that was quickly resolved with some bodges and addition of two resistors.
When reading the leaked schematics, @doug realized that the memory controller in the Quadra's actually seemed to support "in system flashing", and by coincidence someone had bought a prototype Powerbook 520 back in 2020 and found a mysterious software on it:
https://macintoshgarden.org/apps/flash-rom-utility
Doug realized exactly what it was and started to build a replica of the Lobos flashable ROM SIMM used in some Apple prototypes.
www.downtowndougbrown.com
He was very succesful and could soon reflash the onboard ROM in his machine. Doug started to dissassemble and hack the flasher and quite soon he was able detect and reflash also the new universal 8MB ROM inside the machine!!
But as often with these projects, there are some clouds in the sky. It turned out that the onboard Memory controller can only flash the upper 4MB address space, so there is no way it could reflash the whole 8MB. Back to the drawing board! We needed a 4MB universal ROM:
But, since I had changed Onedrive due to a company merger, I made the same mistake as on the 8MB ROM and missed the 2 resistors needed... Some bodges and resistors later, and I had a 4MB Universal ROM SIMM:
So, today, in December, we have 4MB ROMs and are on a good way to also have them flashable inside the system (that is for @dougg3 to tell you all about).
The 8MB universal ROMs are on sale already now:
If you are in the EU, send me a PM (I live in Sweden) and we can figure something out.
4MB will follow in January.
On this Github I'll publish all the ROMs I've played with so far:
github.com
The first one is a ROM that works in 610, 650, 80, 475 and 575.
There are some known bugs:
*The ROM disk will not mount if you have a mechanical hard drive or SCSI2SD. With Bluescsi or Zuluscsi it works fine.
I will also add some textfiles with what I have actually changed and why later today.
Hopefully this can be thread of Quadra hacking. At the moment my local folders with ROMs are really messy, so I need to clean it all up before I can publish. I might have missed some points above, but others will fill in.
Added is also the ROM I now use in my 650 and LC475. Feel free to play.
I started by reading up on Rob Braun's excellent site (http://www.synack.net/~bbraun/macromboot.html), it contains tons of great information, and his work was truly groundbreaking! He links to a lot of old 68k-threads that are sadly lost, but on his site is also a lot of other useful information, how he added ROM disk on Classic II (http://www.synack.net/~bbraun/classic2.html) and his memory hacks for the Quadra's (http://www.synack.net/~bbraun/djmemcrom.html).
My first dev machine was a Q900 board that I got from @jajan547. First i needed to design a little PSU adapter for it, so I based a design of @Melkhior's excellent ATX to IIci design to create a small "bench test PSU". And well, it all worked fine
. The Q900 uses the exact same ROM as the Q700 and the later Q950 ROM actually also works in all these machines, later ROMs (Q650, LC475) would chime but not output video. Fun fact, the Q950 ROM is the very last "universal ROM" and will also boot a IIci and SE/30 but adds no extra functionality so it makes little sense.Since I now had a "universal ROM", I figured the Q950 was a good start for some ROM hacking. I'm fairly good at pattern identification (work habit), so I started searching for the same bit patterns in the Q950 ROM as Braun had hacked in the IIsi ROMs, and well, what do you know, I could identify first the ROM check and disable it, RAM check and the same atBOOT driver as used in the IIsi. I then modified the 096 driver braun has to have a 7MB ROM disk and rom disk placed at 40900000 since these ROMs are 1MB, recompiled (had to setup a virtual G3 running OS9 and Codewarrior 6 to do that, but that's a side track) and byte copied the bytes into the place where atBOOT used to be, and it was successful in the sense that I could see the driver being loaded, hold down R, but would get a question mark each and every time no matter what a tried.
So I needed some help
. Since I've been working extensively with @dougg3 to create a new version of his ROM Simm Programmer (https://ko-fi.com/s/d6e7e4494d), and I knew he is close to a genius when it comes to ROMs and ROM hacking, he helped me setup some tools and I started to poke the memory. Quite soon we where able to find the main issue, the Q900 only maps up 1MB of ROM space by default so the ROM disk would never be mounted since that part of the memory is not available to the ROM. Doug thought for a while and came up with the brilliant solution to hack the MMU tables found in the upper register of the ROM, so I modded my ROM as per his suggestions, and what do you know, IT WORKED!!! For the first time (well, at least as far as me and @dougg3 knows ) we had a working ROM disk for the Q900!! WOOT!! WOOT!!Now, strengthened by my success, I decided to attack the LC475 since I also had one in my shop. It has a provision for a ROM socket, but normally none added by default. Since I already had sockets around for building programmers, I decided to solder in a ROM socket, and then adapt the modifications and ROM disk driver I had for the Q900 (the LC475 is similar as the 900, but locations are of course different), but unfortunately it would give me sad chimes no matter what I tried.
At first I thought I had made some mistakes in my hacking, so I started removing stuff until in the end I had only 1 byte changed (and corrected checksum), but would still not boot, so, I decided to burn in a stock ROM and it booted just fine. I had some suspicion that there was some conflict with the onboard ROM, so I decided to lift the VCC leg of each ROM, and what do you know, it booted just fine of my hacked ROM! I quickly put back all the mods, and quite soon I had ROM disk driver also working for the LC475 if the legs of the onboards ROM where lifted. About the same time some Apple schematics started to leak here on 68k
, and me and @dougg3 quickly realized that the pinning for the ROM simm on the Quadras is actually different of that of the IIsi!Doug has written about it all on his excellent blog:
Downtown Doug Brown » Revisiting programmable Mac ROM SIMMs in Quadras
With this in our mind, me, @dougg3, @WillJac, @jajan547, @JDW and @bigmessowires started to talk about viable solutions. Me and @dougg3 built hacked ROMs where we had simply cut some traces and bodged over to the correct place, and that made it boot in the LC475 with the onboards SIMM still active, but that would render the SIMM useless in a IIsi, so @dougg3 came up with a solution of having a small mechanical switch. You would switch over to SE/30 mode or back to "quadra mode". Doug built a mockup and I designed and built a small series which worked, but we all realized that this would be less than ideal for the normal user, and also with risk of damage to some logic boards if the switch was in the wrong place. So Doug reached out on his blog, and a lot of people pitched in with different ideas, but in the end we stuck with the idea from Steve Chamberlain from @bigmessowires to use a Comparator in conjuction with a TMUX to switch the necessary pins. I once again designed a new board and did a small run just to realize that we all three had missed a crucial point in the data sheet, that was quickly resolved with some bodges and addition of two resistors.
When reading the leaked schematics, @doug realized that the memory controller in the Quadra's actually seemed to support "in system flashing", and by coincidence someone had bought a prototype Powerbook 520 back in 2020 and found a mysterious software on it:
https://macintoshgarden.org/apps/flash-rom-utility
Doug realized exactly what it was and started to build a replica of the Lobos flashable ROM SIMM used in some Apple prototypes.
Downtown Doug Brown » How Apple’s developers reflashed Mac ROMs in the ’90s
He was very succesful and could soon reflash the onboard ROM in his machine
. Doug started to dissassemble and hack the flasher and quite soon he was able detect and reflash also the new universal 8MB ROM inside the machine!!But as often with these projects, there are some clouds in the sky. It turned out that the onboard Memory controller can only flash the upper 4MB address space, so there is no way it could reflash the whole 8MB. Back to the drawing board! We needed a 4MB universal ROM:
But, since I had changed Onedrive due to a company merger, I made the same mistake as on the 8MB ROM and missed the 2 resistors needed... Some bodges and resistors later, and I had a 4MB Universal ROM SIMM:
So, today, in December, we have 4MB ROMs and are on a good way to also have them flashable inside the system (that is for @dougg3 to tell you all about)
.The 8MB universal ROMs are on sale already now:
If you are in the EU, send me a PM (I live in Sweden) and we can figure something out.
4MB will follow in January.
On this Github I'll publish all the ROMs I've played with so far:
UniversalROMImages/LC475_LC575_Q650 at main · CayMac-Team/UniversalROMImages
ROM Images for Quadra/LC & Others. Contribute to CayMac-Team/UniversalROMImages development by creating an account on GitHub.
github.com
The first one is a ROM that works in 610, 650, 80, 475 and 575.
There are some known bugs:
*The ROM disk will not mount if you have a mechanical hard drive or SCSI2SD. With Bluescsi or Zuluscsi it works fine.
I will also add some textfiles with what I have actually changed and why later today.
Hopefully this can be thread of Quadra hacking. At the moment my local folders with ROMs are really messy, so I need to clean it all up before I can publish. I might have missed some points above, but others will fill in
.Added is also the ROM I now use in my 650 and LC475. Feel free to play.
Last edited:
.
