Another IIci ROM hack

[dougg3]

This discovery is worthy of another post. I think I know what's going on now, and it's all related to the research I've been doing about how the soldered IIci ROM only repeats every other 512 KB block. I have no idea how I happened to be looking at this other stuff at the same time...

I said a few posts earlier that the soldered ROM only repeats every OTHER 512 KB block, because of the chip select line being hooked to A19. So the soldered ROM responds from $40800000 to $4087FFFF, $40900000 to $4097FFFF, etc.

I just said in my last post that the Daystar upgrade puts in its own ROM mapped starting at $40880000 (it has to, because a bunch of the Daystar ROM patches jump to locations in that area). This is one of the locations where the soldered ROM does NOT respond.

The ROM SIMM *does* respond to that location with data, although in olePigeon's SIMM it is data that is left unprogrammed (0xFF). The Daystar card might be forcing the ROM output enable to be disabled at that location (in which case this conflict is not causing a problem and something else is the culprit), but odds are they didn't bother since the soldered ROM doesn't respond to that address anyway. If they are both responding with different data, all kinds of crazy crap could be happening that could cause the chimes of death.

We need to try one of two things:

1) Modify the ROM SIMM hardware so it behaves like the soldered ROMs (cut traces, connect the chip select line of the chips to A19, and replace the chips with smaller chips that don't respond at higher addresses) -- I'd rather not have to do this.

or...

2) Dump the Daystar ROM and put it into the SIMM directly after the IIci ROM. In this case the Daystar ROM and the SIMM would BOTH respond to $40880000, but since they would both contain the exact same data, it shouldn't cause any problems.

The problem is I don't think there is a Daystar ROM dumper utility. It should be relatively simple to make, though...open a file, read the bytes, write the bytes to the file, close the file, done. If any of the existing ROM dumper utilities are open-source, it would be a piece of cake to modify them. In fact, it might be a piece of cake to just take one of them and modify its binary...

I think this is the approach we should be taking to solve this problem...

 

[olePigeon]

I'd be willing to let you borrow my Daystar Card if you think you can dump the ROM. $5 shipping is worth it to me to get both working.

Edit: I just did a quick Google, and it looks like Daystar released ROM updates for the accelerator. I'm gonna do some more searches and see if I can't find it. You may not have to dump the ROM after all if they have one for download.

Edit 2: According to Apple's compatibility notes, the ROM is the only one that's socketed. I checked my card, and indeed, there's a socketed chip. In fact, it looks to be the same kind of chip you used on your SIMM.

 

[dougg3]

Aha -- it's sad because my SIMM could probably act as a reader for the Daystar ROM, but since you have to boot from it, I guess not

Actually I'm still not sure if it makes any sense because a chip that is the style of that would only be 8-bit, not 32-bit. Dunno how the data would get out to the CPU correctly. Maybe it has some logic that reads out four bytes at a time.

I think rather than shipping it to me to get a dump, I can modify CopyRoms to dump it and give you a new binary to run. It's open-source :-D

Can you verify for me that the Daystar upgrade is where I think it is? Booted in the IIci WITH the Daystar upgrade (and obviously WITHOUT the SIMM), go into MicroBug:

DM 40880000

Is it something other than a bunch of FFs, and also different from the beginning of the regular ROM dump at 40800000? That would verify my suspicion that the Daystar ROM is there.

 

[Trash80toHP_Mini]

Curiouser and curiouser! :O

Is the DayStar implementing the use of ROM in Expansion Mode as mentioned in GttMFH2E?

 

[olePigeon]

I'll give it a try. Give me a minute, takes a while for my IIci to boot with 128MBs of RAM. )

 

[olePigeon]

800000 368C ADFE 4080 002A 067C 4EFA 0092 4EFA

880000 0006 0000 5200 0008 91C8 46FC 2700 4E70

 

[olePigeon]

If you wouldn't mind, a modified CopyROM would be great. I wonder how many people have a Daystar without the 4.1.1 ROM upgrade. In fact, I don't even know if my ROM is up-to-date.

Edit: Nope. v4.0.1. Anyone else have a Daystar Turbo 040? I'd love to upgrade mine to the latest ROM.

 

[dougg3]

Excellent! That is definitely where the Daystar ROM is located. I think I have a Daystar ROM dumper ready to go, so let me package it up for you...since it's a GPL open source app, I'm not breaking any rules by posting it as long as I keep the source with it!

This is a zip of a MacBinary file containing a Disk Copy image. Mount it, and you will probably have to copy the DaystarDump application to your hard drive first. Run it, and it should create a file called DaystarUpgrade.ROM. This will give you the dump of the Daystar upgrade ROM.

It only works on a IIci right now -- it specifically looks for the IIci's ROM checksum.

DaystarDump.img.zip

 

[dougg3]

Is the DayStar implementing the use of ROM in Expansion Mode as mentioned in GttMFH2E?

I'm starting to think along those lines. In GttMFH2E, it keeps saying "for upgrading or expanding ROM" when describing each model. At least on the IIci, I'm thinking:

To upgrade ROM, you remove the jumper and make your SIMM respond to all addresses.

To expand ROM, you leave the jumper in place and make your SIMM only respond to the "unused" 512 KB chunks of ROM (in other words, only respond when A19=1)

Now, the Daystar upgrade also does some patching of the regular ROM, so to say it's only using expansion mode is not 100% correct, but it's definitely also adding its own stuff as expansion past the end of the stock IIci ROM.

 

[olePigeon]

It freezes my IIci. I'll try booting with extensions off.

 

[olePigeon]

Shucks. Just freezes after I launch it, even with extensions off.

 

[dougg3]

I didn't actually test it, so maybe I messed something up. I did ask it to read longer than the actual Daystar ROM is, but I'm pretty sure that should just respond with 0xFFs in the empty spaces. Hmm...let me keep looking at the code.

 

[olePigeon]

I'm running System 7.1.1 if that makes any difference.

 

[dougg3]

Hmm, I don't think the system version should matter, but who knows.

Try this app (actually it's 2 apps). First try the 512k one, and if that doesn't work, try the 128k one. It will be EXTREMELY slow because it's copying everything one byte at a time (inefficient). It may look like it's frozen but should occasionally print a "." to the screen to update you on its progress. It will make a file called rom.out. When you close the app it will ask if you want to save -- that's just asking to save the console output and you don't have to save it.

It's worth a try...

Dumper.zip

 

[olePigeon]

It wasn't slow at all. Took about 2 seconds. I hope it worked.

The 512k produced a ROM.out file, but crashed with an Error Type 1.

The 128k version seemed to work OK.

128rom.zip

512romErr.zip

 

[dougg3]

Thanks! I didn't realize it would be fast, but cool!

I'm guessing that the Type 1 error was me reading past the actual length of the Daystar ROM. After you told me the ROM chip part number in the private message I was able to limit it to only download the size of the onboard ROM. Looks like the 512 KB dump failed right around the time it reached the first 128 KB, so that's the explanation. That's probably why the first program failed too. I should have just kept it at 128 KB.

The beginning of the file matches what you posted when you did the command for me, so I think we got a good dump! I'll see if it appears to be valid code and if anything matches up (like if an address that the patched IIci ROM jumps to appears to be the beginning of a routine in this dump)

 

[olePigeon]

Awesome. Looking forward to what you find.

Edit: Woo! Page 20.

 

[dougg3]

It's definitely a good dump. Here are some strings from it:

4.01
Turbo 040
Turbo 040 ASIC
Macintosh II, IIx, IIcx, IIci, IIsi, IIvi,
  IIvx, SE/30, and Performa 600.
(ASIC support included)
Macintosh LC and LC II
Performa 400, 405, 410 and 430
(ASIC support included)

I wonder how it knows which parts of the stock ROM to patch? Maybe the locations are identical in all of those systems?

Anyway, I think if you append this dump to the end of your SIMM's ROM image, it'll boot correctly. I'm pretty sure even if you burn a stock IIci ROM into the SIMM, it will still fail to boot without this dump in it too.

 

[ojfd]

Guys,

I don't want to disrupt your workflow, but are you aware that there was another ROM dump utility called ROMmie? Maybe that one would speed up the developement?

ROMmie is a small quick and dirty application that examines the ROM in your Mac. When you run it, it creates three files:* txt: a text file that lists all resources (type, id, name, size)

* rsrc: a ResEdit file with copies of all ROM resources

* dump: a dump of the entire ROM

 

[MacJunky]

By default there is only 25 posts per page.. if you guys keep going on about page numbers eventually you will have enough that they artificially inflate the count.