ROM Hacking...The Radius Rocket!

eharmon

Well-known member
Hey folks, I got a little distracted from regular ROM mods by some interesting quirks of the Radius Rocket. I ended up writing...a lot, so the full post is on my personal site, but I'll summarize things here:


TL;DR: The Rocket's Macintosh ROMs are dynamically loaded into RAM by the Radius Cargo extension, and protected by a very simple encryption algorithm.

Thus, it seems possible to mod the Rocket ROM with zero flashing (just a reboot of the host after modifying the extension). While a Rocket is far more limited, it could provide and interesting platform for easy ROM modification development for anyone with a Rocket. I'll probably be looking into that further, but I figured I'd share what I learned so far!
 

David Cook

Well-known member
Really interesting writeup. I like how you used classic cryptographic attacks, but then also looked at the final ROM from the booted Mac side as well.
 

Phipli

Well-known member
Hey folks, I got a little distracted from regular ROM mods by some interesting quirks of the Radius Rocket. I ended up writing...a lot, so the full post is on my personal site, but I'll summarize things here:


TL;DR: The Rocket's Macintosh ROMs are dynamically loaded into RAM by the Radius Cargo extension, and protected by a very simple encryption algorithm.

Thus, it seems possible to mod the Rocket ROM with zero flashing (just a reboot of the host after modifying the extension). While a Rocket is far more limited, it could provide and interesting platform for easy ROM modification development for anyone with a Rocket. I'll probably be looking into that further, but I figured I'd share what I learned so far!
One interesting thing with the ROM on the card - if you have a Rocket 25i (the one without an FPU), I realised mine was actually fitted with a 68040 with an FPU. Swapping in a ROM from a FPU enabled Rocket made the FPU appear.

So it seems the FPU availability (assuming one is physically present) is controlled based on a flag in the ROM.
 

eharmon

Well-known member
Really interesting writeup. I like how you used classic cryptographic attacks, but then also looked at the final ROM from the booted Mac side as well.
Thanks! I'm pretty curious what the runtime patches do, and how they're applied, so it was extra interesting to compare them. I could imagine a few different clever tricks the loader code might have up its sleeve.
One interesting thing with the ROM on the card - if you have a Rocket 25i (the one without an FPU), I realised mine was actually fitted with a 68040 with an FPU. Swapping in a ROM from a FPU enabled Rocket made the FPU appear.

So it seems the FPU availability (assuming one is physically present) is controlled based on a flag in the ROM.
Should be pretty easy to diff them and find out how it makes the decision. At the least to find out where the configuration bits are, which might reveal more tweakable components.

I've only seen the 25i ROM with my own eyes. Obviously not that interesting from a basic capabilities perspective (since we know you can ROM swap them to success), but I'm always curious!
 

Bolle

Well-known member

Attachments

  • Radius Rocket 33M V1.0 256K 295-0011-01A.bin
    32 KB · Views: 9
  • Radius Rocket Stage 2 40MHz V1.0 256K 0071-01-A.bin
    32 KB · Views: 6

herd

Well-known member
Interesting! Thanks for sharing. What do you think the point was? Were they just obfuscating apple code being used on an aftermarket product?
 

Phipli

Well-known member
Interesting! Thanks for sharing. What do you think the point was? Were they just obfuscating apple code being used on an aftermarket product?
It might have been a term of their permission to use it? The ROM was very precious to apple in that era after the trouble they had with Apple II clones.
 

eharmon

Well-known member
Here's dumps from my two Rockets...
Here's some for 25i, 33 and 40.
Thanks! Indeed, seems like just a 1-byte change (plus checksum) to sResource 129 on the Board. And the Stage IIs (v1.1) use the same flags as the 33.
Interesting! Thanks for sharing. What do you think the point was? Were they just obfuscating apple code being used on an aftermarket product?
It might have been a term of their permission to use it? The ROM was very precious to apple in that era after the trouble they had with Apple II clones.
Yeah, I think that's the case. Ultimately, though you can copy a ROM from a Mac, first you needed to buy a Mac, agree to license terms, and deliberately set out to copy it from memory with "specialized" programs.

When it ships on a floppy disk, where a user is more likely to make a backup copy, etc, I presume there was a desire to create the same level of hardware entanglement. By putting a decryption key in the hardware, it de facto creates the same limitations as a standard Mac ROM.

That said, I'm still not sure how v1.0 decrypts it...clearly it must, because RocketShare works.
 

olePigeon

Well-known member
So it is a physical limitation and not an artificial limitation that prevents Rocket IIs from working as accelerators? I always wondered if it was a ROM thing.
 

eharmon

Well-known member
So it is a physical limitation and not an artificial limitation that prevents Rocket IIs from working as accelerators? I always wondered if it was a ROM thing.
I think so. They're definitely a different board revision that has some major layout changes.

Nothing in the ROM itself is too interesting between the 33 and Stage II, but the DeclROM is mostly a stub. Bus mastering is still marked as supported, all the entries are the same except the BoardID was moved from 4 to 42, and the v1.1 ROM contains the cipher key table.

It's probably worth swapping the ROMs to see what happens, though, if only with the BoardID change.
 

zigzagjoe

Well-known member
Well done! Really interesting info. I'm rather curious what convolutions go into the accelerator mode on the earlier models since they've gotta be doing something weird.
 

rplacd

Well-known member
Oh wow, thanks for the explanation: I'd always wondered whether the "Quadra 950 ROMs" were on cards directly shucked from actual Quadra 950s to avoid having to go through Apple to license, but it looks like they genuinely distributed their own license on disk.

I've always wondered as well about how a performant (minimal latency) accelerator could be run on the NuBus, given the larger amount of glue logic needed compared to PDS, bus speeds decoupled from the actual 68k bus, etc.
 
Last edited:

eharmon

Well-known member
I've finally answered part of the mystery about how earlier Rockets worked (and I'll have to update my article). To my surprise, before RocketShare 1.0 and RocketWare 1.5, they didn't load a ROM at all! Despite the sophistication of the Rocket allowing for it to boot (mostly) independently with it's own Quadra-era ROM, it appears they initially utilized the typical accelerator methods of the era: patching the host's ROM.

Since RocketWare 1.5 does seem to include the ROM extension (Rocket Cargo), it seems likely it switches from patching ROMs to having its own copy, since there's no point in Stage II-specific support there. I've yet to see how earlier Rockets derive the XOR key to decrypt it, though.

Here's an article from Byte, August '91 which makes it clear:

The 68040 and the Mac
Scott Coleman


When it comes to 680x0-based computers, you most likely think of the Macintosh. Motorola's 68040 promises future Macintosh systems a huge performance boost while providing code compatibility for many applications. However, changes in the 68040 can create software difficulties for the Mac. I uncovered these problems while implementing the Radius Rocket, a 25-MHz 68040-based NuBus accelerator board for Mac II-class computers.

Since the 68040's built-in FPU supplies only a subset of the 68882 FPU's floating-point instructions, a mechanism to handle unimplemented instructions has to be in place. For example, when the 68040 encounters one of these unimplemented math instructions, it generates an F-line exception trap (not to be confused with the A-line exceptions used by the Mac Toolbox). An exception handler determines what the offending instruction was and then calls the appropriate math routine in the Motorola emulation library.

The 68040 integral memory management unit also uses only a subset of the 68030's MMU instructions. At boot time, the Mac ROMs use 68030- or 68851-specific MMU calls to set up the Mac's address space. These routines had to be patched to comply with the 68040 instruction set. The boot process occurs only once, but the Toolbox call SwapMMUMode (used to swap the Mac's addressing mode from 24 bits to 32 bits and back) is called frequently when the Mac accesses NuBus boards. This trap had to be patched as well.

Changes in the size and content of the 68040's exception stack frame also impacted on the operation of existing Mac system software. That's because the Mac operating system deals with an exception by extracting crucial information from the stack frame. When an exception occurs on the Radius Rocket, software massages the 68040 stack frame into a 68030-style stack frame before handing control to the Mac operating system, fooling it into thinking that it's running on a 68030.

Another problem occurs when the 68040 supports a mode in which both processor reads and writes are cached (the 68030 only caches reads). This means that the cache frequently holds different values than what's in memory. If the data that was written to memory is a portion of code that the processor is about to execute, the 68040's instruction cache-which operates separately from the data cache-fetches old values (or garbage) from memory, while the new code sits in the data cache. How does such a situation occur? First, many INITs install themselves by copying code into the system heap and then executing it. Second, some applications alter their capabilities on the fly by patching their jump tables. One solution is to include in the application the instructions that the 68040 uses to flush the cache, but this fix is at odds with the goal of software compatibility. A better solution is to configure the caches as write-through. This results in a slightly slower cache mode but provides the required compatibility. In the case of the Radius Rocket, you can set the cache modes. If an application doesn't modify its code in the manner described above, then you can set the cache mode to copy-back for better performance.

Finally, for QuickDraw graphics, the 68040 move16 instruction turns out to be quite valuable. For example, the Rocket accelerator board has special hardware that allows the 68040 to use the move16 instruction in a NuBus block transfer. This way, graphics data can be burst to display boards that support the NuBus burst mode at rates of up to 20MB per second. Combined with the 68040's processing power, this high transfer rate practically eliminates the need for most graphics accelerators.

I want to note that many of the issues I described are typically operating-system issues. But since the Rocket accelerator board replaces the Mac's CPU, Radius had to address them. Overall, the 68040's compatibility is excellent, and no one will dispute its performance.

Scott Coleman is a software engineer at Radius (San Jose, CA) and is responsible for the Radius Rocket accelerator's software.
 

Trash80toHP_Mini

NIGHT STALKER
Fabulous work, can't believe I missed it! Thanks for reviving the project as it opens up some very interesting possibilities.

Off label use of Rocket supplement:
Haven't played with my IIsi/Rocket hack in quite some time as it only works under RocketShare. Wondering if ROM modification might enable acceleration mode in the IIsi? Its pathetic onboard video resolution support make RocketShare untenable, whereas RocketWare would make it interesting, given Portrait resoution's maximum pixellation.

IIsi/Rocket hack requires software installation to be done in a compatible Mac to avoid the machine detection lockout of the installer. Using a IIcx for my dick swapping workaround worked great.

Severe power/cooling budget limitations of the IIsi would be why the installer refuses to work in situ. Hacking the ROM to allow installation of RocketWare/RocketShare in the IIsi would make for interesting playtime now that @max1zzz has cloned the Rocket.

Use of a IIci/Q700 PSU enabled bench testing. Unsure if the IIsi NuBus Adapter supplies enough power to run the Rocket reliably, but hacking direct power input for the rocket should pose little problem?


Morning musing tangent mode:
Flipping the IIsi's Portrait mode output to landscape on MultiSync displays could be worth doing in itself I think?

Sorry if these tangents are irritating, can't help myself during caffeine deprived phase of wakeup routine. :oops:
 
Top