Jump to content
joethezombie

Carrera040 Info / Hacking Thread

Recommended Posts

A bigger UPDATE:

 

Sooo, after some hassle with, well, nearly everything in my SE/30, finally here's where we are now:

 

1st Test:

SE/30, 32bit clean ROM -Using the INIT (which I've diassembled and it indeed does not more than picking on code-resource out of the control-panel resource) and my patched CP it boots all the way through. No error, no exception, even the CP-icon has been X'ed as no C040 was in the system.

That's a pretty uncommon view, isn't it? ;-)

 

large.IMG_20180220_121248.jpg.bdb62eb0cf1ef129a4caa9591dc033ad.jpg

 

2nd Test:

Little Carrera went where no Carrera has gone before... a bit tight but it's OK (the front corner baaaarely touches the tube):

 

large.IMG_20180220_143609.jpg.59dbab7d537dcd7d458a25d40a6af35c.jpg

 

Cross fingers, light a candle - prepare curses for Bolle :-p, just in case - and flick the switch:

Chime & Happy Mac, installs MacsBugs, INITs'n'stuff and... stuck at the control panel.

 

Woohoo! Well, not 100%-Woohoo but it shows that we're getting somewhere. I assume a deadlock where the CP waits for an answer from the C040 at a given address ($5300 0000) on which little SE/30 is deaf, dumb and blind.

It crashes that much, that even MacsBugs is shocked and vanishes (even the debug-key is not working)... but we'll fix that.

 

large.IMG_20180220_143556.jpg.d1984c7e5c043018d1ce1321c1793f60.jpg

 

 P.S. We love Bolle, don't we? :wub::lol:

 

Share this post


Link to post
Share on other sites
14 hours ago, GeekDot said:

Woohoo! Well, not 100%-Woohoo but it shows that we're getting somewhere. I assume a deadlock where the CP waits for an answer from the C040 at a given address ($5300 0000) on which little SE/30 is deaf, dumb and blind.

I hope you can get the drivers hacked to get something going on Bolle's PowerCache Adapter, but I wonder?

 

That's why I'm rooting for the zombie attack on the IIcx 68030 socket adapter flank. Gotta be easier to fake up a virtual IIcx setup from the socket. Have you got any kind of PDS Video Card to test the SE/30 with the Video ROM pulled? You said you're using a clean ROM, is it big's universal MacII series ROM? I've got a terrible vision of the need disable onboard video to win the Gestalt ID battle between the drivers and the SE/30 to get the Carrera to use IIcx ROM routines that the SE/30 doesn't. That would all but require having the Xceed internal GS Card I'll never own to get Carrera up and running in an SE/30  .  .  .  not that I'll ever have a Carrera. :blink:

 

Hoping your MacsBugs degubbing goes well, I figured that puppy would come in handy somewhere along the line of development.

 

Question: does the Carrera INIT load before or after AppleTalk installs?

Share this post


Link to post
Share on other sites

@GeekDot I am not sure if I followed what you did, but I tried v1 control panel (linked on the first page) and the Startup Carrera extension with a 32-bit clean ROM. Here is the screen that came up:

 

OkX6rYk.png

Share this post


Link to post
Share on other sites
1 hour ago, tt said:

@GeekDot I am not sure if I followed what you did, but I tried v1 control panel (linked on the first page) and the Startup Carrera extension with a 32-bit clean ROM. Here is the screen that came up:

 

 

You took the V1 from this archive, right? That's what I'm using on my SE/30, too.

Which System version are you running? Have you installed it "for every Macintosh" as described in the Carrera ReadMe? 

Error 10 explained:

"There are many routines in the Macintosh ROM that can be called by placing instructions in a program that aren't in the 68000's vocabulary. When the 68000 encounters such an instruction, it looks it up in the instruction table. This table gives the location of routines paired with each instruction. If it finds an entry in the table for the instruction, it branches to the routine. If there's no entry for the instruction, you see one of these errors."

What kind of ROM is yours? I'm using the BMoW image in an Rominator II. 

 

Quick progress-update:
I'm currently still aiming in, where the code crashes. It's tedious as I have to manually trace closer to "the edge" but try not to fall off the cliff. If I did - and I did many times - rinse & repeat.

But as far as I see, it currently crashes in the "loader" or returning from it. A bit strange because all it does is load the init and display the Icon, mainly using "ShowInit" by Paul Mercer (Man, I'm really getting sucked into this control panels code)

 

BTW: Found these lines along the CPs code... maybe one of the names rings a bell for someone in the forum? (Buddy from back in the days, have a beer, get the code ;))...

"Software By Scott Coleman, Hardware By Bob Richie, CDEV by Hilla Pedramparsi Additional fixes & System 7.5.x compatibility by Glenn L. Austin"

Share this post


Link to post
Share on other sites

Very hazy images: first cuppacoffee level notions.

 

Hadn't known you were using that ROM, that may not be all that good an idea.

 

STEP 3: Install a Universal System

Use your System installation disks and do a "Custom Install for any Mac". DO NOT install a minimum System OR the System for your particular Mac. With Installers prior to 7.5 you can shift click to select multiple options (such as printers and networking) at the same time.

 

STEP 4: For Mac IIx and IIcx only.

Install Mode32 Mode32 is located on the Utilities disk provided with the Carrera040.

 

IMO you really should be going back to a baseline configuration for testing driver mutilations.

 

For all practical purposes, the SE/30 is a Macintosh IIcx with the Slot ID memory mapping/IDs of ts NuBus slots munged up. A very good thing ***

- PseudoSlot video card located at Slot $E (IIcx no gots) directly on the MC68030 bus and equivalant to NuBus Slot $B in IIcx (passive adapter)

- Physical NuBus slots $9, $A ????? :blink:

 

Carrera INIT is loading before or after MODE32 INIT?

 

NODE32 achieves the same result as installing a clean ROM (using a software patented workaround for dirty ROM machine state only)

- - - IICI ROM cleanliness didn't violate that patent AFAIK, so it's a different animal

 

So your universal Macintosh II ROM installation does not translate into applying Connectix' fix for (required) memory cleanup of dirty ROM. We've identified at least one SE/30 card that loses its lunch in its attempts to digest a clean ROM machine state, some video card I'd more likely remember if I was awake.

 

< posts drivel in as is condition and heads back to bed >

 

 

 

*** means there's some elbow room for mucking about in the SE/30 ROM's memory remap kluge.

Share this post


Link to post
Share on other sites

Just picked my Carrera040 up at the customs office. Time to get the IIci out of the basement and hook the thing up to the LA to see what really is going on with bus takeover once the INIT loads.

Got a paper copy of the manual with it, do we have that already somewhere or should I scan it?

Share this post


Link to post
Share on other sites

First thing sure should be to solder a few wires to your new 150 EUR toy...

 

IMG_4027.thumb.JPG.8bceb69a6265f82d2debdf3c50513622.JPG

 

At least we know now that it's doing it by the book:

 

5a9053a6648eb_Bildschirmfoto2018-02-23um18_44_34.png.626b28956104e2527f0222de407d13ac.png

 

 

This is when the INIT loads or everytime you pull the lever in the CP to one of the 040 options. It stays that way in normal operation. If you pull the lever to 030 in the control panel it just releases /BGACK and the 030 then kicks in again. Now over to the SE/30 to see if it even reaches that point...

Edited by Bolle

Share this post


Link to post
Share on other sites

Kinda like taking stuff apart to see what's inside before powering up to see if it works? [:D]

 

Cool, so it's not multiprocessing, it's flip flopping control of the bus as needed? My scanned info and ill considered WAG was something I doubted after the edit window closed.

 

Quote

.  .  .  there's a ton of SwapMMUMode calls in the code...

 

 

Might flip flopping bus control between 68030 MMUMode and 68040 MMUMode to set the system up CPUDIS flip or flop be the reason for those all those calls in the driver?

 

edit: What's the mechanism within the IIci schematic for CPUDIS synthesization?

 

p.s. BBCode works much better when you remember the switches. :blink:

 

 

Edited by Trash80toHP_Mini

Share this post


Link to post
Share on other sites

Ah-ha!

It does get to the point to tell the Carrera to take over on the SE/30 as well.

 

5a9064ed70662_Bildschirmfoto2018-02-23um20_00_33.png.c0f7174c4292ab74eb55b7a79e3b83d7.png

 

That does tell us at least that the SE/30 is not deaf on the address range and the Carrera does indeed respond to the loading INIT.

 

 

 

EDIT: It's also not the onboard video that's making problems here. Removed VROM and stuck in the Pivot... crashes in the same spot.

Edited by Bolle

Share this post


Link to post
Share on other sites

Forgot that... 7.1, MODE32, stock ROM, 32bit enabled.

 

EDIT: I also wonder where that CPUDIS signal is going on the IIci motherboard.

 

DCaDftMF says:

Quote

The CPUDIS signal is used during diagnostic testing to disable the Mc6s030 on the main logic board and tristate its outputs. An emulator in the cache card can assert CPUDIS and, after waiting for the end of the current bus cycle, drive all signals.

 

Edited by Bolle

Share this post


Link to post
Share on other sites

Dang! I was hoping to infuse a bit more compatibility, good job! [;)]

 

Have we got IIci and IIcx or IIx Schematics available. Wondering about CPUDIS and if the IIci can be reverse engineered to the point that we can introduce logic to produce it onto the passive IIcx adapter at the very least.

 

Thought I'd posted this one cleaned up in the Performer thread. Guess not, but here it is from the raw screen shot:

 

68030-SMT.JPG

 

My primary suspect on the IIci's MC68030 is Pin 65 /MMUDIS, solder on another wire to check to see if it blips when CPUDIS does its thing on the Cache Slot?

 

edit: joe, could you buzz pin 65 to see if and where it might land on the Carrera IIcx adapter's ersatz IIci Cache Slot?

 

 

Edited by Trash80toHP_Mini
the usual

Share this post


Link to post
Share on other sites
14 hours ago, Trash80toHP_Mini said:

might flip flopping bus control between 68030 MMUMode and 68040 MMUMode to set the system up CPUDIS flip or flop be the reason for those all those calls in the driver?

 

Just for clarification: SwapMMUmode has nothing to do with 030 vs 040. This most often called function switches from 24 (dirty) to 32 (clean) mode... and back.

It needs to be called as soon you need to access anything beyond 8MB.

Share this post


Link to post
Share on other sites
13 hours ago, Bolle said:

Ah-ha!

It does get to the point to tell the Carrera to take over on the SE/30 as well.

 

5a9064ed70662_Bildschirmfoto2018-02-23um20_00_33.png.c0f7174c4292ab74eb55b7a79e3b83d7.png

 

That does tell us at least that the SE/30 is not deaf on the address range and the Carrera does indeed respond to the loading INIT.

Very nice! Good to have you in same „setup state“. 

How many probes does your LA have? Can you check/see 0x53000000 activities (in and out)?

 

I‘m getting closer and closer to the crash point... the tricky thing is, that the CP crashes into the grey boot screen, even from MacsBug. So a simple „go“ and the look at the PC/SP, stack and registers doesn’t work here...  

Here's an example getting closer to the "point of no return", CP icon loaded, back in enumeration of the init resources...

 

large.Macsbug.jpg.cb7f53876e8d2a79b817835556eb58eb.jpg

 

A 2nd screen would help, but my Color Pivot doesn’t have a cable and I prefer spending time with understanding the code than hunting for parts.
(Will have just the next week before going on vacation for 16 days...)

Edited by GeekDot

Share this post


Link to post
Share on other sites
On 2/23/2018 at 2:35 AM, GeekDot said:

You took the V1 from this archive, right? That's what I'm using on my SE/30, too.

Which System version are you running? Have you installed it "for every Macintosh" as described in the Carrera ReadMe? 

Error 10 explained:

"There are many routines in the Macintosh ROM that can be called by placing instructions in a program that aren't in the 68000's vocabulary. When the 68000 encounters such an instruction, it looks it up in the instruction table. This table gives the location of routines paired with each instruction. If it finds an entry in the table for the instruction, it branches to the routine. If there's no entry for the instruction, you see one of these errors."

What kind of ROM is yours? I'm using the BMoW image in an Rominator II. 

Yes, V1 from that archive. I am running System 7.5.3 with the 1.8b1 extension. I think the ROM is based on a IIsi and has patched the ROM/RAM check and has a boot disk, the ROM SIMM was built by Doug. It looks like you are running an older OS, I wonder if you might get to a further debug point if your try a later one?

Share this post


Link to post
Share on other sites
On 2/23/2018 at 12:42 PM, Trash80toHP_Mini said:

Have we got IIci and IIcx or IIx Schematics available. Wondering about CPUDIS and if the IIci can be reverse engineered to the point that we can introduce logic to produce it onto the passive IIcx adapter at the very least.

 

My primary suspect on the IIci's MC68030 is Pin 65 /MMUDIS, solder on another wire to check to see if it blips when CPUDIS does its thing on the Cache Slot?

joe, could you buzz pin 65 to see if and where it might land on the Carrera IIcx adapter's ersatz IIci Cache Slot?

 

This diagram would be more suitable for the Iicx adapter:

68030-BACK.thumb.jpg.3a532d10fc8153d21d7ff3e561156fb7.jpg

 

/MMUDIS is not connected to any pin the CACHE slot on the adapter.

CPUDIS is not connected to any pin on the CPU socket

Also, notice /BR /BG and /BGACK are pin disconnected from the logicboard's CPU socket, instead relying on the CPU present on the adapter.

Share this post


Link to post
Share on other sites

Nice work on that diagram, joe. I figured the QFP pinout was a bit less confusing and is numbered for doing schematic doodling.

 

What are the relationships between the PowerCache adaptation of the oddball memory addressing control signal setup SE/30 and the way such is handled in the IIsi and now the IIcx?

 

Gotta be something there? Happy to see my crazy WAGs being knocked down systematically, BTW. [:)]

Share this post


Link to post
Share on other sites

Running out of jumper wires and could use a second analyser already :p

 

At least I could find some calls to 0x53000000... still learning how this thing works.

IMG_4030.JPG

Share this post


Link to post
Share on other sites

Ha ha!  I love seeing these things being ripped apart and analyzed.   I did the same to crack the equations on the DayStar adapter, using a 90deg angle socket to expedite analyzer lead connections:

IMG_1422rr.jpg.93a4e6173ce84625901aaafa4ffbf163.jpg

But I digress, back to the job at hand....

 

The IIcx adapter is a simple 1:1 for all signals that exist on the IIci CACHE slot.

The only difference, as explained prior, is /BR, /BG, and /BGACK (used for bus arbitration) are pin disconnected from the main logicboard.  Instead, those signals are isolated to the adapter's onboard 68030.  Signals on the CPU that don't exist on the CACHE slot are simply not connected.  Likewise with CACHE signals not present on the CPU, also being not connected.

 

Once my 68030 sockets arrive, I will attempt using the IIcx adapter in the SE/30.

 

Share this post


Link to post
Share on other sites

I wonder if we should leave some of the undocumented connections open on the adapter and only connect the bare CPU signals... My guess still is that they might use the presence of certain signals to detect the exact hardware. If only bare 030 signals are connected at all it leaves us with only the IIcx or IIx...

Share this post


Link to post
Share on other sites

Something about this IIci screen is naggin' at me:

 

Bildschirmfoto 2018-02-23 um 18.44.34.png

 

/CPUDIS state change for a cycle occurs on the same edge as "Pin Disconnected on IIcx Adapter" /BR, and /BGACK signals change state. This happens within the window where "Pin Disconnected on IIcx Adapter" /BG Low.

 

Done with WAGs for the time being, just wondering what happens in the IIcx where /CPUDIS does not exist and the three bus arbitration signals are "pin disconnected" for such a cycle?

 

edit: the SE/30 PDS slot's borked bus mastering setup (as differentiated from IIsi in DCaDftMF) has been nagging at me all along, but now  .  .  .

 

Edited by Trash80toHP_Mini
the usual

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×