ROM hacking in the 68040 Macs

[dougg3]

How about assigning 16MB to a 8MB ROM and add some logic to force A22 of the ROM to 0 if A23 is 1?

It's an interesting idea, but the main problem is that A23 isn't available in the ROM SIMM socket. The address lines only go up to A22. So you would need to grab it from somewhere else such as the PDS connector.

It's kind of unfortunate that Apple picked A22 for write protection. It really would have made more sense if they had chosen A23 instead!

 

[Jockelill]

It's an interesting idea, but the main problem is that A23 isn't available in the ROM SIMM socket. The address lines only go up to A22. So you would need to grab it from somewhere else such as the PDS connector.

It's kind of unfortunate that Apple picked A22 for write protection. It really would have made more sense if they had chosen A23 instead!

Or make a ROM for the PDS directly and grab the missing signals from the ROM-simm socket . I'm thinking a ROM-simm dummy which has a small connector that ejects the in PDS necessary signals. a PDS-rom

 

[Jockelill]

Just my 2 cents:

As you may know I own LC475 only. Those have MEMCjr build in. Documentation from MEMCjr tells:
"A write to the normal ROM space, $4xxx xxxx with addressbit 22 set to '1' will cause the FLASHWE signal to be asserted"

Based on that
- you may assign 8MB to a 4MB ROM and are able to write the 4MB ROM in upper, mirrored half of the space.
- you may assign 8MB to a 8MB ROM and are able to write the upper part of the ROM
- you may assign 16MB to a 8MB ROM and can write upper part of the ROM in second and fourth block.

How about assigning 16MB to a 8MB ROM and add some logic to force A22 of the ROM to 0 if A23 is 1?
In this case you are able to write the upper half of the ROM in the second block (A22=1,A23=0) and the lower half in the fourth block, as A22 of ROM is forced to 0 because A23 is 1 in the fourth block.

Read from ROM is in first and second block, so Computer may work.
Write routine will be a little bit tricky because the write space will be spitted into two parts.

How about give this a try?

This is actually a very interesting idea, need to find some time to play with it, basically a little logic inverter could do just that. Only issue is of course getting the A23 (for hacking no issues, but for "series" more so.

 

[Mustermann]

Only issue is of course getting the A23 (for hacking no issues, but for "series" more so.

You are right, it might be an issue for an end user to add a flying wire from PDS to ROM slot.

To avoid that another solution came into my mind:

How about creating missing additional address lines from a latch (no additional wires outside of ROM needed):

- In read cycle read entire 8MB address space using A0-A22
- In write cycle if A21=1 do not write ROM but data to a latch (at least 2 bit)
- In write cycle if A21=0 write to ROM using A0-A20 from computer and A21+A22 from latch

All data can be read from a continuous 8MB block.
ROM need to be written in 4 x 2MB blocks
Entire ROM can be written out of upper 4MB block (A22=1)

Some additional logic on ROM SIMM needed.
No additional wires from somewhere else needed
Custom made "in system programming" code needed.
Will need custom software to be written in an external programmer.

Do you think this might work?

 

[Mustermann]

How about creating missing additional address lines from a latch (no additional wires outside of ROM needed):

Entire ROM can be written out of upper 4MB block (A22=1)

Some additional logic on ROM SIMM needed.

Additional logic might also be on an additional board.

Additional board might be placed into ROM SIMM socket. ROM SIMM is connected to a socket at that board. Additional logic is on this board only.

- No changed ROM SIMM design needed
- Can be programmed in an external programmer without changes.

 

[trag]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

 

[eharmon]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

Interesting. Wonder if they all are or the one pictured just happens to be. Definitely flash on that one.

 

[stynx]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

I have had a conversation with that seller. He has 90 more of those modules. He has not said where they came from.

The programming line (pin 37) is connected to something but the chips are 3.3V only. I had built a 5V reprogrammable ROM-DIMM from a 8100 DIMM by using AM29F800 chips but the only available application for reprogramming ROMs in a Power Macintosh is seemingly not compatible with final revision production-level "Grand Central" ASICs. The computer will freak out and reboot instead of reprogramming the ROM.