Eric's Apple Network Server 700 tinker log

[eric]

Well in a bunch of unrelated issues covering up the real issue which was me being silly I am back up and running, though my install from last year I cant launch any apps at all or smit or anything. I'm just going to start fresh again to refresh myself on the entire process.

One oddity is that the power button wont keep the machine off. It powers down but only for about 5 seconds then powers back up - donno if thats some setting or datacenter thing it's trying to stay on after power loss or shutdown.

 

[eric]

DOOM runs quite well Thanks @ClassicHasClass !

Is there a way to write on multiple line on the lcd screen? control chars/escape/etc dont seem to work passing to `lcdstring`

 

[joevt]

Is there a way to write on multiple line on the lcd screen? control chars/escape/etc dont seem to work passing to `lcdstring`

Does the ANS 700 have the same ROM as an ANS 500?
Here's the version, size, checksum, and md5 of the ANS 500 ROM:
077d.28f2 4096 962f6c13 676809c236138574282fa8416c6c5a6d "./ROM 1.1.22 ANS 500

The ANS 500 ROM has an Open Firmware driver for the LCD which does support some control and escape characters. Open it like this:

unselect-dev
0 value lcd-ih
" lcd" 2dup find-device open-dev dup . dup to lcd-ih to my-self

The number that is output is the instance handle that was opened. It should be non-zero if successful.
my-self may be reset to zero if you type an incorrect command. You can just re-open the device again or do
lcd-ih to my-self

Then you can write to the LCD like this:
" hello" write

Or like this:
" hello" " write" lcd-ih $call-method

The write word for the LCD seems to support the following special characters:

• 0x08: back space - Left one character and erase it.
• 0x09: tab - Output lanks to the next multiple of 8 column number.
• 0x0A: linefeed - Down one line, clear the line, go to column 0.
• 0x0B: Up one line.
• 0x0C: lcd-init - Goto line 0 column 0.
• 0x0D: Ignore.
• 0x1B: escape - Begins an escape sequence. Only 5B is accepted as the second character. Characters 0 - 9 end the escape sequence (and do nothing). 0x44 (character D does a back space and continues the escape sequence.

Writing beyond the end of a line does a line feed to continue on the next line. I believe there are 20 characters per line.

Characters that change the line number transmit a line number change command (each line uses a different command: 0x80, 0xC0, 0x94, 0xD4). There's other commands (0x01, 0x02, 0x04, 0x06, 0x0f, 0x38). Are the LCD commands documented somewhere?

To use the special characters, put the hex in the string surrounded by "( and ) like this:
" abc"(0A)def"(0B)ghi(080808)jkl" " write" lcd-ih $call-method

Actually, since lcd has a write command, it might be usable as the Open Firmware output device:
" lcd" output

 

[eric]

@joevt oh interesting! I (finally) tried to dump the ROM from my 700 but my collection of cables/adapters/etc must not be correct as I can never get output or input on the OF console. Is there any way to dump this while the machine is running (Is it mapped to a memory location or anything like that?)
I have two options but neither work: USB Type C to RS232 DB9 Serial Port Adapter Cable, FTDI Chipset -> null modem cable -> DB9 to apple serial adapter. I assume it's because it's RS422
And a Keyspan USB->RS422 adapter which is seen in linux as a serial tty, but i get no traffic.

Is there a way I could do this from a vintage mac with a serial port?

-

How could one call these OF ROM routines from C or while the system is running? I'm not familiar with how all this works.

Writing beyond the end of a line does a line feed to continue on the next line. I believe there are 20 characters per line.

With the `lcdstring` command this doesn't seem to happen.

 

[eric]

Success! Winning combo was it's the 2nd port on the ANS from the top and just using the kingston adapter to a serial cable:

 

[eric]

@joevt Attached is the raw output.

 

[eric]

RAID card installed. Took out the full compute unit as it was easier. the SCSI connectors on the back made it hard to put the card in so i took off one of the stand offs for the external HD connector. Disk drive in the ANS is not working so I pulled out the floppy drive from my childhood 6115/CD and it worked. Booted into the RAID utility with putting the ANS in service mode then `boot fd:dacconf.ns` - Have a BlueSCSI with 3 9GB drives for a RAID 5. Auto configured and now it's initializing the drives.

 

[joevt]

@joevt oh interesting! I (finally) tried to dump the ROM from my 700 but my collection of cables/adapters/etc must not be correct as I can never get output or input on the OF console. Is there any way to dump this while the machine is running (Is it mapped to a memory location or anything like that?)

There's probably a way but I only have apps for Mac OS 9 and OS X - neither of which is usable by the ANS 700?
The ROM is mapped to last 4 megabytes of physical memory. So, one would map it, then copy it.

RS-232 has a single wire for receive and a single wire for transmit.
RS-422 uses differential signalling. You can connect the one wire from RS-232 and ground the other wire for RS-422.

How could one call these OF ROM routines from C or while the system is running? I'm not familiar with how all this works.

I don't think you can call Open Firmware from most OS's.

If you can't find a driver or reverse engineer a driver from the OS (what does the lcdstring app use?), then you could try reverse engineering the driver from Open Firmware. The Open Firmware driver indicates that the registers for controlling the LCD are 32 bytes at 0x1c000 of macio. This is at 0xf301c000 physical address. command byte is at offset 0x00 and the data byte is at offset 0x10. There's a 1 ms delay used after every write to a register.

Success! Winning combo was it's the 2nd port on the ANS from the top and just using the kingston adapter to a serial cable:

Are the ports not marked as modem and printer port? The default port for Open Firmware is modem port.

@joevt Attached is the raw output.

Thanks for the dump. It's identical to the ANS 500.

 

[joevt]

Attached all the Open Firmware stuff from the ROM. You can use the tbxi command to dump other parts.

Strange it has the same version as the 8500 v2 / S900 rom.

077d.28f2 "Boot TNT 0.1p..]" 4096 962f6c13          √ 676809c236138574282fa8416c6c5a6d "./ROM PowerPC Mac/ROM 1.1.22 ANS 500 & 700/ROMs/@FFC00000 Entire ROM.rom"
077d.28f2 "Boot TNT 0.1p..]" 4096 9630c68b          √ 2623a0c438045ea04d2cc67310c97743 "./ROM Apple/#1 mac-rom-archive-20110819/9630C68B - Power Mac 7200&7500&8500&9500 v2.ROM"

The ANS 500 & 700 ROM version of Open Firmware (1.1.22) has names for all the words, unlike 1.0.5 so it's easier to read if you don't have 1.0.5 source.

It outputs Open Firmware progress to serial port depending on some external switch that changes the baud-rate (9600 or 38400 or none). I think the switch is a couple bytes in PRAM or NVRAM.

Other info that would be useful is:
dump-device-tree
lspci for Open Firmware (for PCI register dumps)
Non PCI register dumps (but that requires knowing what registers to dump - I would start with everything in GrandCentral (1 MB at 0xf3000000) and 0x800 bytes from Hammerhead.

All the Open Firmware code is in the Part1.txt and Part2.of files.

Open Firmware has a few parts:

• @startvec at offset 00003C and described by fields >imagesize to >r13-31
• some assembly stuff at offset 0001BC
• a list of precompiled words starting at offset 000B74 and described by fields >h.link to >h.name; the last word is pointed to by @startvec.>word-list
• the main fcode image at offset 007514 pointed to by @startvec.>fcimage
• a list of other fcode images described by fields >of.next to >of.fcode starting at offset 01C88C; the last image is pointed to by @startvec.>fcfiles

All these parts are in Part1.txt. The fcode is removed from Part1.txt and converted to Forth in Part2.of.

There's 53c94 and mesh built into Grand Central. I don't know if they're connected at all.

/bandit/gc/53c94            scsi
/bandit/gc/mesh             scsi-int

Here is the device aliases for the new PCI SCSI stuff:

/bandit/53c825@11            scsi-int
/bandit/53c825@12            scsi-int2
/bandit/53c825@11/sd@0,0    disk0
/bandit/53c825@11/sd@1,0    disk1
/bandit/53c825@11/sd@2,0    disk2
/bandit/53c825@11/sd@3,0    disk3
/bandit/53c825@12/sd@4,0    disk4
/bandit/53c825@12/sd@5,0    disk5
/bandit/53c825@12/sd@6,0    disk6

There's three choices in chips:

pci1000,f 53c875 NCR,875
pci1000,3 53c825 NCR,825A or NCR,825

But the device aliases are only for the 53c825.

There's an fcode image for the PCI vendor:device 1000:0003 at offset 01D1C4. It determines which chip is being used. probe-device loads the fcode image for PCI device 1000:0003 and 1000:000F.

fcode image 4 at offset 01FE84 is used for the drives connected to the scsi controller. This fcode image is also used by 53c94 and mesh. 53c94 and mesh use fcode image 3 at offset 01F8F4 for tape devices.