Apple prototype ROM flasher utility

[tt]

Interesting, so it sounds like a theoretical PDS ROM flasher board could potentially work with the earlier LC machines with some tweaks to the Flasher software. No worries about the replica Lobos boards! This project randomly came to mind earlier today and it was a nice surprise to see an update a little while later.

 

[demik]

Been told to post that here.

I found this ROM on a 6200 board. It works, origin unknown. It's a reflashable ROM with a weird P/N.

 

[Jockelill]

Nice work @dougg3!! Super cool to see this! I'd love to see that PDS card Apple Dev used back in the days . Might all have been scrapped, but you never know.

 

[Jockelill]

Been told to post that here.

I found this ROM on a 6200 board. It works, origin unknown. It's a reflashable ROM with a weird P/N.

4Mbit chips, so a 32Mbit flashable ROM (4MB), would make a lot of sense for the PPCs since all these ROMs are 4MB . I'm pretty sure the flasher tool can reprogram also this card with an appropriate adapter.

 

[bigmessowires]

So...you think my card looks crazy? You ain't seen nothing yet. Here's crazy:

That is an impressively big mess o' wires!

Nice work on the hardware!

 

[dougg3]

Might all have been scrapped, but you never know.

That's kind of what I fear. There are several other PDS cards (or at least SIMMs) described in the Flasher app but I don't understand some of the options that are specified for them. I would love to see a picture of one of the original PDS cards someday.

I found this ROM on a 6200 board. It works, origin unknown.

Thank you for sharing! I always like to see stuff like this, it helps give context clues.

4Mbit chips, so a 32Mbit flashable ROM (4MB), would make a lot of sense for the PPCs since all these ROMs are 4MB

I concur. I believe the PowerPC ROM DIMM pinout has a 64-bit-wide data bus so that would explain why they used eight chips instead of four larger ones. I'm kind of puzzled by all of the other chips on the other side of the board. The manufacturer marking wasn't obvious to me, but since I knew it was an integral symbol I did some lucky searching and it looks like it's Integrated Device Technology. The 71256 seems to be SRAM. The 74FCT162841 is a 20-bit D latch. No idea about the two chips on the left. This is strange! I'm not sure why they need SRAM or any fancy logic on a ROM DIMM. Maybe there is some data buffering going on. I have no idea...I didn't expect to see more than just flash chips and maybe some simple gates.

I'm pretty sure the flasher tool can reprogram also this card with an appropriate adapter.

Interestingly, I don't see any code in the version I have that is compatible with these particular chips. Same with the newer TNT Flasher that adds support for the TNT machines. The manufacturer ID would be 0x89 and the device ID would be 0xA7. Maybe there's an even newer version of Flasher out there hiding somewhere...

That is an impressively big mess o' wires!

Nice work on the hardware!

Haha, thank you! Someone on Twitter jokingly told me it needed more wires, and I said I had to be careful about adding too many more wires because I don't want to infringe on BMOW!

 

[Melkhior]

The 71256 seems to be SRAM. The 74FCT162841 is a 20-bit D latch. No idea about the two chips on the left. This is strange! I'm not sure why they need SRAM or any fancy logic on a ROM DIMM. Maybe there is some data buffering going on. I have no idea...I didn't expect to see more than just flash chips and maybe some simple gates.

There's only 6 visible 71256, which suggest to me the two hidden by labels are also 71256, distributed identically to the Flash on he other side. Random guess: SRAM storage of the code for warm reboot, flash storage for more lasting attempts? With just a buffer and some SRAM you can't do a lot, but you can program faster than flash I suppose?

Without the flash, SRAM on a SIMM would suggest cache, but you'd need more logic for a L2.

 

[Phipli]

There's only 6 visible 71256, which suggest to me the two hidden by labels are also 71256, distributed identically to the Flash on he other side. Random guess: SRAM storage of the code for warm reboot, flash storage for more lasting attempts? With just a buffer and some SRAM you can't do a lot, but you can program faster than flash I suppose?

Without the flash, SRAM on a SIMM would suggest cache, but you'd need more logic for a L2.

The SRAM is cache. 6200s have combined ROM+Cache SIMMs.

 

[dougg3]

There's only 6 visible 71256, which suggest to me the two hidden by labels are also 71256

The SRAM is cache. 6200s have combined ROM+Cache SIMMs.

Ahh, that makes perfect sense. Thanks for clearing that up. Eight 32KB SRAM chips for a total of 256KB of L2 cache, just as Apple says in the dev note. I would assume the latch chip is also involved with the cache somehow.

 

[demik]

The SRAM is cache. 6200s have combined ROM+Cache SIMMs.

Forgot to write that, thanks @Phipli . 5200/6200/5300/6300 and friends do indeed have the cache on the same SIMM

 

[eharmon]

I think I found 4(!) more copies of different versions in this image from the Garden: http://macintoshgarden.org/apps/pci-power-macintosh-ddk-a5-includes-mac-os-752a4

Look in "Latest Working Set:-ROM"

This version seems tailor made for the Power Mac 7500, but it might contain some other interesting goodies.

 

[Jockelill]

I think I found 4(!) more copies of different versions in this image from the Garden: http://macintoshgarden.org/apps/pci-power-macintosh-ddk-a5-includes-mac-os-752a4

Look in "Latest Working Set:-ROM"

This version seems tailor made for the Power Mac 7500, but it might contain some other interesting goodies.

NICE!! Well found! Since me and (mostly @dougg3) have been working on a new PDS programmer, I had to test it

And it worked! I can both read and flash using this PDS programmer my red ROM from an STB. It should also work with the Lobos card, and maybe some others that I'm not aware of. @dougg3 really deserves all the credit here!!! I merely turned his drafts into a board and soldered up. I had made a small mistake in the schematics (loose connection on A16), so had to run a bodge, but other than that it was all game .

The card works in LC630, LC475/Quadra 605 and likely 575, but on the 575 there is a mechanical problem (which was why I asked for tilted simm sockets, which despite all efforts, are unavailable ). I did also test it in an LC3, but it did not get detected by the machine, so I'd say anything older than LC475 is a no go.

 

[dougg3]

This version seems tailor made for the Power Mac 7500, but it might contain some other interesting goodies.

Yep -- @Phipli pointed this CD out to me a while back. I haven't looked at the older versions, but the newest one has a table entry that matches against the 7500, 8500, and 9500. I haven't gone in depth to figure out how it works. I believe it would be compatible with a ROM DIMM that has sixteen Am28F020 chips on it for a total of 4 MB of ROM. That would be a crazy looking ROM module...

There are also table entries for the NuBus Power Macs and Power Mac upgrade cards. I think those entries were also in the old version but the table appeared to be kind of weird on those entries. They look more normal in this newer version.

And it worked! I can both read and flash using this PDS programmer my red ROM from an STB. It should also work with the Lobos card, and maybe some others that I'm not aware of.

Very exciting stuff! Nice job on the board layout. It's a lot cleaner than the crazy wire mess I made during the holidays I'm so glad you were able to verify it with the STB ROM SIMM. It makes sense because the table entries showed that combination as being supported.

It would be nice to figure out how the STB SIMM is wired up and what the 74F86 chip on it does. I'm thinking that it's going to be creating chip select signals for the two different sets of 4 chips based on one of the address pins. One will be the inverse of the other.

I did also test it in an LC3, but it did not get detected by the machine, so I'd say anything older than LC475 is a no go.

That's because there's no table entry in Flasher for the LC III's PDS slot. I'm pretty sure we can hack the program to add support for the PDS card in the LC III by adding the appropriate table entries.

By the way, I haven't pointed this out to you until now @Jockelill, but I'm pretty sure that once I've finished hacking Flasher, the PDS card will be able to flash all 8 MB of an 8 MB SIMM, which is an improvement over the limitation of the /WE signal in the ROM SIMM socket in the Quadras...
Well, unless there's a limitation where Flasher doesn't like 8 MB ROMs at all. I guess we'll find out...

 

[joevt]

Emulation and info regarding "Flasher (TNT 0.6)"
https://tinkerdifferent.com/threads/apple-network-server-macos-based-roms-found.4756/post-41630

 

[croissantking]

I've been looking in close detail at the PowerBook 500 Series CPU card and have found that there is a Flash ROM detect pin on the Pratt MC that can be pulled low by a special FlashROM/RAM card.

Here's the relevant bit:



I'm quite sure that this flasher app when paired with a PB500 was designed to work with just such a prototype FlashROM board, given that support for this machine is explicity listed.

@dougg3, I've seen your table entries here, and was wondering what's in PB500SIMM[1-2]-SomeTable? Have you dissassembled those?

 

[dougg3]

@dougg3, I've seen your table entries here, and was wondering what's in PB500SIMM[1-2]-SomeTable? Have you dissassembled those?

I actually did spend a little bit of time figuring out those table entries back when I was looking at the Flasher app! I named them, btw; the names weren't anywhere in the code. I didn't inspect the code in depth, but I at least figured out the table entries. Here they are, along with some random comments from my disassembly:





Both entries support two gestalt machine IDs: gestaltPowerBook500 (72) and another unknown ID of 73. They use $20000000 as the address for ROM reads and $20400000 as the address for ROM writes, but they differ a bit after that point.

PB500SIMM1 looks for four Intel 28F020 chips across the 32-bit data bus, but there are two banks, so it has 8 total chips, with only 4 activated at a time. Each chip is 256 KB, so four of them is 1 MB (that's the $100000 line) and there are 2 banks (that's the 2 below it) so the total ROM size is 2 MB. It should show up as "Blackbird Flash" in the Flasher UI if detected.

PB500SIMM2 looks for four Intel 28F008SA chips. This time there is only one bank. Each chip is 1 MB, so four of them is 4 MB (that's the $400000 line), so I think this would be a 4 MB module in total. It uses a custom erase and programming function that's different from the other table entries. I haven't looked deeper into the code or datasheets, but I'm guessing the 28F008SA needs different erase/write algorithms than the other chips and that's why. Its Flasher UI name is "Malcolm Flash".

The enable programming function shared by both of them writes $00000000 to address $20400000 and then waits 16 ms (I think). The disable programming function writes $00000000 to address $20000000 and does the same wait. Those are the same addresses used for writing and reading the data, so I'm not sure if the first write to $20400000 is what unlocks writes and writing to $20000000 locks them again, or what.

 

[croissantking]

I actually did spend a little bit of time figuring out those table entries back when I was looking at the Flasher app! I named them, btw; the names weren't anywhere in the code. I didn't inspect the code in depth, but I at least figured out the table entries. Here they are, along with some random comments from my disassembly:

View attachment 102628

View attachment 102629

Both entries support two gestalt machine IDs: gestaltPowerBook500 (72) and another unknown ID of 73. They use $20000000 as the address for ROM reads and $20400000 as the address for ROM writes, but they differ a bit after that point.

PB500SIMM1 looks for four Intel 28F020 chips across the 32-bit data bus, but there are two banks, so it has 8 total chips, with only 4 activated at a time. Each chip is 256 KB, so four of them is 1 MB (that's the $100000 line) and there are 2 banks (that's the 2 below it) so the total ROM size is 2 MB. It should show up as "Blackbird Flash" in the Flasher UI if detected.

PB500SIMM2 looks for four Intel 28F008SA chips. This time there is only one bank. Each chip is 1 MB, so four of them is 4 MB (that's the $400000 line), so I think this would be a 4 MB module in total. It uses a custom erase and programming function that's different from the other table entries. I haven't looked deeper into the code or datasheets, but I'm guessing the 28F008SA needs different erase/write algorithms than the other chips and that's why. Its Flasher UI name is "Malcolm Flash".

The enable programming function shared by both of them writes $00000000 to address $20400000 and then waits 16 ms (I think). The disable programming function writes $00000000 to address $20000000 and does the same wait. Those are the same addresses used for writing and reading the data, so I'm not sure if the first write to $20400000 is what unlocks writes and writing to $20000000 locks them again, or what.

Great stuff, thanks for sharing this.

Found the following in the SuperMario source:

gestaltMalcolmBB EQU 126 ; Malcolm (yep, same name as WLCD II)(66 MHz 603 upgrade to Blackbird)
gestaltMalcolmBB80 EQU 127 ; Malcolm (yep, same name as WLCD II)(80 MHz 603 upgrade to Blackbird)

So it would seem that SIMM2 would be for the PowerPC upgrade card?

 

[dougg3]

gestaltMalcolmBB EQU 126 ; Malcolm (yep, same name as WLCD II)(66 MHz 603 upgrade to Blackbird)
gestaltMalcolmBB80 EQU 127 ; Malcolm (yep, same name as WLCD II)(80 MHz 603 upgrade to Blackbird)

So it would seem that SIMM2 would be for the PowerPC upgrade card?

Oh that's very interesting! I hadn't realized that's what the Malcolm name meant. That makes perfect sense that the second one relates to the PowerPC upgrade since it's 4 MB.

As far as I can tell, despite all that, this version of the Flasher app would only support it with the original gestalt IDs of 72 and 73 (gestaltBlackbird and gestaltBlackbirdLC). Maybe one of the newer versions of Flasher would actually support it with the PowerPC upgrade installed.

 

[demik]

Both entries support two gestalt machine IDs: gestaltPowerBook500 (72) and another unknown ID of 73

From what I gathered around, Gestalt 73 was a low cost Blackbird, with STN screen and other leftover parts , even with a possible 16 or 20 MHz 68LC040. Not released obviously

 

[croissantking]

Oh that's very interesting! I hadn't realized that's what the Malcolm name meant. That makes perfect sense that the second one relates to the PowerPC upgrade since it's 4 MB.

As far as I can tell, despite all that, this version of the Flasher app would only support it with the original gestalt IDs of 72 and 73 (gestaltBlackbird and gestaltBlackbirdLC). Maybe one of the newer versions of Flasher would actually support it with the PowerPC upgrade installed.

I'm currently working with @frontein1 on a custom ROM with ROMDISK that uses the full 4MB space that the 500 series supports. So while a 2MB FlashROM card would be interesting to recreate, it wouldn't help much with our project.
If the 4MB design could be made to work with the 040 Blackbird, then that would be ideal.