Now Reading
Downtown Doug Brown » How Apple’s builders reflashed Mac ROMs within the ’90s

Downtown Doug Brown » How Apple’s builders reflashed Mac ROMs within the ’90s

2023-11-27 02:11:42

After I wrote about the possibility of programmable Mac ROM SIMMs in Quadras a few months in the past, I suspected that there had been a means for builders at Apple within the 68k Mac period to reflash the ROM of their Macs throughout growth, similar to BIOS updates on PCs. The explanation I believed it’s because the ROM SIMM socket within the Quadras introduced out pins for 12V (VPP) and write allow (/WE). I had verified that the write allow pin was going into the reminiscence controller chip in a number of Mac fashions, so I used to be fairly assured that in-system programming was potential.

As luck would have it, a number of folks identified to me that an Apple internal utility used for ROM flashing had been uploaded to the Macintosh Backyard. It was recovered from a prototype PowerBook 520 bought in 2020. In fact, I needed to obtain this utility and determine the way it works.

I ran it on my LC 475 and that is what it regarded like:

Right here’s the About dialog, figuring out Carl C. Hewitt because the writer:

As you may see, it says the SIMM sort is “Learn-Solely ROM” and the Program button is grayed out. This makes good sense, as a result of it was simply detecting my logic board’s masks ROM chips that are undoubtedly not programmable.

All I used to be capable of do was go to the File menu and select “Save Onboard ROM…” to dump my current ROM. It defaulted to a filename of “Saved RomMondo”. Then I might use the Confirm button to point out that my onboard ROM matched the dump:

That is all very fascinating, however I wished to see what it was like to truly flash a brand new ROM picture. I wasn’t actually positive the place to start although. Would this utility even assist any of my Macs? What sort of ROM module would I want? What wouldn’t it take to get that Program button enabled?

So as to reply these questions, I had no alternative however to begin disassembling the Flasher™ utility. Thankfully, plenty of the capabilities in this system had their names current as a string instantly afterward so it gave me some context about what was happening. The holy grail was after I found this large desk of entries for appropriate ROMs. The names of those desk entries, and the desk itself, had been assigned by me.

Plenty of the entries on this desk are PDS playing cards. You may even see in the primary UI screenshots above that there was a separate “PDS ROM Information” part on the suitable. I’d like to see an instance of what these PDS playing cards regarded like, if anybody on the market has some inside data they’d be prepared to share!

Let’s take a look at one of many SIMM entries intimately: QuadraSIMM1.

This comprises plenty of data, and I needed to do additional disassembly all through this system to grasp what all the pieces meant. 0x89898989 and 0xBDBDBDBD are the flash producer and gadget ID, repeated 4 occasions as a result of 4 8-bit chips will reply at a time on the 32-bit information bus. 0x89 is Intel’s JEDEC producer ID and 0xBD is the gadget ID for his or her 28F020 256-kilobyte flash chip. 0x40400000 is the bottom tackle for ROM write cycles, 0x40800000 is the bottom tackle for ROM learn cycles, and 0x100000 is the dimensions of every set of 4 chips (1 MB). This explicit SIMM seems to have 2 banks, so it’s seemingly a 2 MB SIMM with 8 flash chips.

After that, there are numerous flags for particular choices, and a soar desk for capabilities to carry out completely different operations like checking presence of the SIMM, erasing, and programming. I gained’t go too far into the weeds about what all of it means, however the different fascinating half is on the finish of the construction, which comprises a NULL-terminated record of allowed gestalt machine IDs. We determined in my 68kmla post that the IDs listed above that don’t have names are merely unreleased variants of the opposite fashions for probably the most half. For instance, 86, 90, 93, and 95 are gestalt IDs for unreleased variants of the LC 475 and Quadra 605 operating at 20 MHz and 33 MHz as an alternative of the ultimate 25 MHz model.

So what does all this data inform us? Properly, there’s code elsewhere in this system that loops by means of the whole desk one-by-one making an attempt to find out if any objects within the desk are put in within the Mac it’s operating on. Trying by means of this desk permits me to get an concept of which Macs this program is appropriate with in addition to which flash chips a appropriate ROM SIMM would wish to make use of.

Within the case of Quadras, it seems that all kinds of them are all supported by the identical code. The 700, 900, 950, 610, 650, 800, 475, 575, 630, and 580 are all dealt with by the desk entry depicted above. There are additionally related desk entries for a 4-chip Intel 28F020 SIMM and 4- and 8-chip AMD 28F020 SIMMs. The 660av and 840av are supported by a few separate desk entries for 8-chip 28F020 SIMMs with Intel and AMD components. If you wish to find out about different appropriate Macs, see the 68kmla put up I linked earlier. Earlier than I get folks’s hopes up too far, this utility doesn’t assist earlier Macs just like the SE/30 or II collection. The one exception to that’s the IIvx/IIvi/Performa 600.

It was round this time that I made a silly mistake with my multimeter whereas trying out the SIMM /WE pin, and I feel I fried it on my LC 475 by by accident shorting it to 12V. They’re proper subsequent to one another within the socket. My unhealthy! Since then, I’ve purchased one other logic board for it so I can proceed my experiments. Regardless that I now have a brand new logic board in my LC 475, I’ve moved over to doing most of my analysis on my Performa 630 as an alternative.

Not less than my mistake gave me the chance to point out this machine off. Discover that it’s a Performa 630; not a Performa 630CD. See that factor that suspiciously appears to be like like a CD-ROM drive on the left? It’s not. It’s a clean cowl to place one thing within the opening the place the CD tray would come out. That is what the 630 collection machines regarded like after they didn’t come from the manufacturing unit with a CD drive. And sure, as I’m positive many others did too, I pressed the button considering the CD tray would come out. In case you push the button onerous sufficient, it will get caught again in there. Don’t ask me how I discovered that out.

Anyway, the following step was to determine how I might discover a appropriate SIMM to do that program out with. The programmable SIMMs that I designed in the past wouldn’t work. None of their chip IDs match, and my pinout for write allow was completely different. To not point out they don’t correctly disable the onboard ROMs. Trying deeper, trendy flash chips use completely different programming instructions and algorithms than the chips Apple supported anyway.

Chances are you’ll do not forget that I discussed in my final put up about Josh Watson discovering an Apple programmable “Lobos board” SIMM on eBay some time in the past. Here’s the 68kmla thread about that if you’re interested. Josh’s footage clearly confirmed a board with 4 Am28F020 chips — one of many recognized appropriate chip preparations primarily based on my disassembly. His footage had been detailed sufficient, and I’m acquainted sufficient with the 64-pin ROM SIMM pinout, that I used to be capable of reverse-engineer the whole PCB by trying on the footage. I designed a reproduction in KiCad. It’s not precisely an identical, nevertheless it’s very near it.

It’s a 4-layer PCB similar to the unique. That positive makes routing floor and 5V lots simpler! I ordered 5 boards. Within the meantime, I additionally ordered some new-old-stock Am28F020-120 chips on eBay. Then I simply needed to watch for issues to reach and put all of it collectively!

There was nonetheless a problem to resolve although. I wanted a technique to put an preliminary ROM picture onto this factor. You may’t program it in-system if it’s clean. As quickly because it’s inserted into the ROM SIMM socket, it disables the onboard ROMs. Plus, it’s not appropriate with my SIMM programmer as a result of it wants 12V for VPP, and /WE is in a special place. You might want to use one thing else to bootstrap it. That’s why I put in PLCC sockets on it relatively than soldering the chips down. I used my XGecu T56 programmer, which helpfully additionally gives the flexibility to interleave a file throughout 4 chips:

By the way in which, I did discover an annoying situation with this programmer and the Am28F020 whereas I used to be taking part in round with it. If I inform it to erase the chip, it doesn’t totally erase. Many of the bits erase, however just a few of them don’t. I’ve to erase twice so as to totally erase the chip. I attempted contacting XGecu about this situation however they didn’t reply to my query. My guess is XGecu made a small mistake within the erase algorithm.

Regardless that my SIMM programmer is unable to program these chips, I used to be nonetheless in a position to make use of it to check the programmed SIMM contents and ensure they matched the inventory 630 ROM. This made me really feel a lot safer about sticking an untested PCB design into my Performa. I used to be additionally paranoid about ensuring pin 2 (12V) wasn’t mistakenly shorted wherever else on the SIMM, so I rigorously double checked with my multimeter.

Subsequent up, I wanted my Performa 630 to truly have a ROM SIMM socket. Most machines of this period don’t include the socket populated. Mine didn’t have the socket, and in addition wanted to be recapped. You may see the footprint for the 64-pin socket with the holes full of solder.

Again after I was making ROM SIMMs and programmers, I purchased a bunch of sockets. In order that wasn’t an issue in any respect. I obtained out my Hakko 808 vacuum desoldering software and emptied out the holes. This was a breeze and allowed me to simply solder in a socket. Right here it’s with the socket populated and my new SIMM inserted.

With my copy Lobos SIMM put in, I used to be lastly able to boot up and run the Flasher utility once more. The primary good signal was that the machine nonetheless booted with the SIMM put in. I type of anticipated that half to succeed since my programmer was capable of learn it, nevertheless it was nonetheless excellent news.

That’s extra prefer it! Flasher detected a programmable “AMD 28F020 x 4” SIMM. The Program button was enabled! So as to strive in-system programming, I created a hacked ROM containing a customized startup chime. In case you’ve been following my weblog for some time, you could know that I’ve all the time cherished with the ability to fiddle with Mac startup sounds. I’d make the sound customization the topic of a future weblog put up, however for now let’s simply assume that half has already been taken care of.

See Also

So as to use the brand new ROM file “630 New ROM” within the screenshot above, I had to make use of ResEdit to alter the kind and creator code of the file. The sort code is ‘ROM ‘ and the creator code is ‘HIRM’. This might have taken extra disassembly to determine, so I’m glad that this system additionally helps saving ROM dumps which made it simple to search out the right codes.

Now that I had a model new ROM file able to go, I used to be lastly able to load the file and program it to the SIMM. Right here’s a video displaying the whole flashing course of. You may get pleasure from listening to the clickety-clack sound of the unique onerous drive nonetheless on this factor.

My new ROM is an identical to the unique 630-series ROM, besides it performs the Energy Mac 6200/6300 startup sound as an alternative — my favourite outdated Mac startup sound!

If I had been a very evil individual, I might undoubtedly create some confusion with this new startup sound if I changed the label on the entrance with certainly one of these Apple service substitute labels I just lately purchased on eBay from Solar Remarketing’s outdated stock…

However don’t fear. I’d by no means do such a horrible factor.

What can we do with all the pieces I’ve discovered from this experiment? I imagine it will technically be potential to hack the Flasher program in order that it will acknowledge newer flash chips such because the SST39SF040. Mainly I must modify one of many desk entries to match a contemporary chip ID, and in addition hack the capabilities that do identification/erasure/programming to carry out the sequences utilized by trendy chips as an alternative of the older 28F020 chips.

It could most likely be simpler to simply make a brand new flasher program as an alternative, however on the identical time I feel there could be one thing actually cool about with the ability to use Apple’s personal inner utility if this truly turns into a factor. If I discover some spare time sooner or later, I’ll very properly look into modifying it.

That might deal with the software program adjustments wanted, however as you could bear in mind from my last post about Mac ROM SIMMs, there’s additionally a {hardware} downside to resolve. It could be good to have a ROM SIMM that’s appropriate with in-system programming in these machines but in addition appropriate with older machines and the entire SIMM programmers on the market primarily based on my authentic design. It seems an answer for that is within the works from some good folks on the market.

One final thing I need to reiterate about this: it will solely be helpful for individuals who have a ROM SIMM socket put in on their logic board. Not many supported machines on the market right this moment have the socket populated, aside from the Quadra 700/900/950. It’s undoubtedly potential to solder the socket in like I did, nevertheless it’s not going to be a enjoyable time in case you don’t have a vacuum software to clear the holes.

Now we’ve got all seen what it was like for builders at Apple within the ’90s to reprogram the ROMs of their growth Macs. I’m wondering how lengthy it has been since somebody final used this program to flash a Mac earlier than I resurrected it this week? I do know that it was nonetheless in use through the PowerPC period. A more recent model of this identical program was used for Energy Mac 7500/8500/9500 growth. You’ll find it on this PCI Power Macintosh DDK disk.

Does anybody on the market know extra about how Mac ROM growth labored again within the day? What in case you by accident screwed up and made your SIMM unbootable? There should have been some restoration technique, proper? Was that one of many causes for the existence of the PDS playing cards I discussed earlier? Or was there another exterior SIMM programmer gadget that would reflash them? I’d love to listen to extra about it.

Source Link

What's Your Reaction?
Excited
0
Happy
0
In Love
0
Not Sure
0
Silly
0
View Comments (0)

Leave a Reply

Your email address will not be published.

2022 Blinking Robots.
WordPress by Doejo

Scroll To Top