ROM hacking in the 68040 Macs

[dougg3]

How about assigning 16MB to a 8MB ROM and add some logic to force A22 of the ROM to 0 if A23 is 1?

It's an interesting idea, but the main problem is that A23 isn't available in the ROM SIMM socket. The address lines only go up to A22. So you would need to grab it from somewhere else such as the PDS connector.

It's kind of unfortunate that Apple picked A22 for write protection. It really would have made more sense if they had chosen A23 instead!

 

[Jockelill]

It's an interesting idea, but the main problem is that A23 isn't available in the ROM SIMM socket. The address lines only go up to A22. So you would need to grab it from somewhere else such as the PDS connector.

It's kind of unfortunate that Apple picked A22 for write protection. It really would have made more sense if they had chosen A23 instead!

Or make a ROM for the PDS directly and grab the missing signals from the ROM-simm socket . I'm thinking a ROM-simm dummy which has a small connector that ejects the in PDS necessary signals. a PDS-rom

 

[Jockelill]

Just my 2 cents:

As you may know I own LC475 only. Those have MEMCjr build in. Documentation from MEMCjr tells:
"A write to the normal ROM space, $4xxx xxxx with addressbit 22 set to '1' will cause the FLASHWE signal to be asserted"

Based on that
- you may assign 8MB to a 4MB ROM and are able to write the 4MB ROM in upper, mirrored half of the space.
- you may assign 8MB to a 8MB ROM and are able to write the upper part of the ROM
- you may assign 16MB to a 8MB ROM and can write upper part of the ROM in second and fourth block.

How about assigning 16MB to a 8MB ROM and add some logic to force A22 of the ROM to 0 if A23 is 1?
In this case you are able to write the upper half of the ROM in the second block (A22=1,A23=0) and the lower half in the fourth block, as A22 of ROM is forced to 0 because A23 is 1 in the fourth block.

Read from ROM is in first and second block, so Computer may work.
Write routine will be a little bit tricky because the write space will be spitted into two parts.

How about give this a try?

This is actually a very interesting idea, need to find some time to play with it, basically a little logic inverter could do just that. Only issue is of course getting the A23 (for hacking no issues, but for "series" more so.

 

[Mustermann]

Only issue is of course getting the A23 (for hacking no issues, but for "series" more so.

You are right, it might be an issue for an end user to add a flying wire from PDS to ROM slot.

To avoid that another solution came into my mind:

How about creating missing additional address lines from a latch (no additional wires outside of ROM needed):

- In read cycle read entire 8MB address space using A0-A22
- In write cycle if A21=1 do not write ROM but data to a latch (at least 2 bit)
- In write cycle if A21=0 write to ROM using A0-A20 from computer and A21+A22 from latch

All data can be read from a continuous 8MB block.
ROM need to be written in 4 x 2MB blocks
Entire ROM can be written out of upper 4MB block (A22=1)

Some additional logic on ROM SIMM needed.
No additional wires from somewhere else needed
Custom made "in system programming" code needed.
Will need custom software to be written in an external programmer.

Do you think this might work?

 

[Mustermann]

How about creating missing additional address lines from a latch (no additional wires outside of ROM needed):

Entire ROM can be written out of upper 4MB block (A22=1)

Some additional logic on ROM SIMM needed.

Additional logic might also be on an additional board.

Additional board might be placed into ROM SIMM socket. ROM SIMM is connected to a socket at that board. Additional logic is on this board only.

- No changed ROM SIMM design needed
- Can be programmed in an external programmer without changes.

 

[trag]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

 

[eharmon]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

Interesting. Wonder if they all are or the one pictured just happens to be. Definitely flash on that one.

 

[stynx]

This looks like it may be a programmable ROM for the G3...

https://www.ebay.com/itm/285255171956

Might need a chip added in the blank spot.

I have had a conversation with that seller. He has 90 more of those modules. He has not said where they came from.

The programming line (pin 37) is connected to something but the chips are 3.3V only. I had built a 5V reprogrammable ROM-DIMM from a 8100 DIMM by using AM29F800 chips but the only available application for reprogramming ROMs in a Power Macintosh is seemingly not compatible with final revision production-level "Grand Central" ASICs. The computer will freak out and reboot instead of reprogramming the ROM.

 

[Mustermann]

I have a programmable ROM SIMM for my 475 now and can share some experience:

- The ROM file in the first post is the same, that is available at CayMac Github site as well.
- As expected the ROMdisk does not work with a Harddisk
- Using BlueSCSI and CDROM changer pressing R at boot start from CD instead of ROMdisk
The only way I found to start from ROMdisk with CDROM emulation in place was to reset PRAM at boot and press R immediate after that.
- Sometimes booting from ROMdisk (and RAMdisk as well) work. After changing boot device (I have 7.1 7.5.5 and 8.1 on separate SCSI ID) booting from ROMdisk stop working
- Reset of PRAM reenables this

In addition to that I noticed that the changes in ROM are at other addresses than mentioned by Jockelill in post #12 (assume the addresses in #12 are those from Q700/Q900/Q950 ROM ) and there are more of them.
I found the changes in attachment.

Is someone able to tell, what code in the begin and at the end (Marked with ???) is doing?

 

[jmacz]

Is there an easy tool to change the happy mac boot icon completely? I have a CayMac ROM SIMM and Programmer on the way.

For my SE/30 I have a SMC ROM SIMM and the Crucible app they have for it makes changing the icon dead simple. I just provide a PNG for the icon and a PNG for the mask, and it writes it into the ROM image. Was hoping there was something simple like that for the CayMac ROM Programmer or at least documented offset where the icon and mask are.

 

[dougg3]

For my SE/30 I have a SMC ROM SIMM and the Crucible app they have for it makes changing the icon dead simple. I just provide a PNG for the icon and a PNG for the mask, and it writes it into the ROM image. Was hoping there was something simple like that for the CayMac ROM Programmer or at least documented offset where the icon and mask are.

I'm the author of the software and firmware for the ROM SIMM programmer. Unfortunately I have never found the time to make a tool that does a bunch of commonly-wanted ROM hacks like custom icons and chimes, but I think there are a few options:

The 32x32 pixel Happy Mac icon is at offset 0x17F2 in the file. The mask for it is at 0x1872. If I'm not mistaken, it's just a simple bitmap where a 1 bit means black and a 0 bit means white, and in the mask a 1 bit means something is there and 0 means it's not.

The other option is, you should be able to use the output of Crucible with the ROM programmer if you want. Even if it spits out 4 separate files for the 4 ROM chips, the programmer software has the ability to use all four if you click "Flash individual chips" in the main window:



I can't remember whether the four files should be "1, 2, 3, 4" or "4, 3, 2, 1" in this screen, but you can probably figure that out with experimentation.

The modded IIsi ROMs based on bbraun's ROM hack use a color Happy Mac icon instead. If that's the case, the 0x17F2 offset won't be correct anymore. Here are bbraun's instructions for modding the color icon, thanks to Archive.org (see the bottom of the original post).

 

[jmacz]

I thought I saw a comment from @bigmessowires somewhere that said changing the entire icon instead of just the eye patch was much more complex so thought it was a bit more involved but this seems straight forward.

Thanks as always @dougg3 !!

 

[dougg3]

I thought I saw a comment from @bigmessowires somewhere that said changing the entire icon instead of just the eye patch was much more complex so thought it was a bit more involved but this seems straight forward.

Thanks as always @dougg3 !!

You’re welcome! If you did see a comment by BMOW about that, I wonder if he was referring to something bbraun said at the bottom of that last link I posted, where if the ‘cicn’ ends up too big, you end up having to relocate things. Seems like that could get a little tricky.

 

[jmacz]

I decided to not bother with the icon. It seems straight forward but after noticing that the boot icon last perhaps half a second on my screen, it wasn't even worth it keeping it stock.

BTW, the programmer was dead simple to use. Had a working custom ROM in no time. Thanks for your efforts @dougg3!

 

[dougg3]

BTW, the programmer was dead simple to use. Had a working custom ROM in no time. Thanks for your efforts @dougg3!

Thanks for the kind words! I'm glad to hear it's working for you.

 

[frontein1]

I have a programmable ROM SIMM for my 475 now and can share some experience:

- The ROM file in the first post is the same, that is available at CayMac Github site as well.
- As expected the ROMdisk does not work with a Harddisk
- Using BlueSCSI and CDROM changer pressing R at boot start from CD instead of ROMdisk
The only way I found to start from ROMdisk with CDROM emulation in place was to reset PRAM at boot and press R immediate after that.
- Sometimes booting from ROMdisk (and RAMdisk as well) work. After changing boot device (I have 7.1 7.5.5 and 8.1 on separate SCSI ID) booting from ROMdisk stop working
- Reset of PRAM reenables this

In addition to that I noticed that the changes in ROM are at other addresses than mentioned by Jockelill in post #12 (assume the addresses in #12 are those from Q700/Q900/Q950 ROM ) and there are more of them.
I found the changes in attachment.

Is someone able to tell, what code in the begin and at the end (Marked with ???) is doing?

I've been talking with the great proprietors at CayMac. We fixed the LC475 ROM so it should reliably boot to ROM when holding down R. The Q950 ROM should likewise be a very easy fix. Take a look at their github page, they already have the new LC475 ROMs available for download.

I actually have some notes written down on your ??? PDF. I'll pull them out here soon and type them up. For example, the changes for 1278-127f. This is part of the InitNetBoot routine. As some other really smart people uncovered, there are two unused drivers: netBOOT and atBOOT. The CayMac universal ROMs are using atBOOT. So in the InitNetBoot routine, the driver name needs to be changed from netBOOT to atBOOT. So that's what these changes are for.

These CayMac SIMMS are great because they have auto sense logic, so they can be used in both the 512KB and 1024KB Macs equipped with SIMM slots.

 

[frontein1]

I have a programmable ROM SIMM for my 475 now and can share some experience:

- The ROM file in the first post is the same, that is available at CayMac Github site as well.
- As expected the ROMdisk does not work with a Harddisk
- Using BlueSCSI and CDROM changer pressing R at boot start from CD instead of ROMdisk
The only way I found to start from ROMdisk with CDROM emulation in place was to reset PRAM at boot and press R immediate after that.
- Sometimes booting from ROMdisk (and RAMdisk as well) work. After changing boot device (I have 7.1 7.5.5 and 8.1 on separate SCSI ID) booting from ROMdisk stop working
- Reset of PRAM reenables this

In addition to that I noticed that the changes in ROM are at other addresses than mentioned by Jockelill in post #12 (assume the addresses in #12 are those from Q700/Q900/Q950 ROM ) and there are more of them.
I found the changes in attachment.

Is someone able to tell, what code in the begin and at the end (Marked with ???) is doing?

Wanted to share this write-up. I only get credit for 1 very minor fix listed in here. Otherwise this is a collection of knowledge from many different people. I would be happy to give specific credit to specific hacks

But I wanted to make this a living document for 1024KB ROM hacking. There are a lot of things I eventually want to tackle, so I will be keeping this updated as I move along.

If you find any errors, please let me know.