The ROMs
I've uploaded the 3 new ANS ROMs to
https://github.com/joevt/MacROMan
There's 4 total now. They are similar to the Power Mac 9500 v2 ROM. In fact, the 2.26B6 ROM has identical first 3 MiB.
Code:
077d.28f2.1 9630c68b 045a3ff2.04a8169b.03334745.03ffe575 02c6b097.0317a71b.020d1a9e.027c620c.02a0a3bd.037df94c.0231514d.029e06b3:4db4a42fea3b53b3 2623a0c438045ea04d2cc67310c97743 "1.0.5 PM 7200 & 7500 & 8500 & 9500 (v2), SuperMac S900 (v2)"
077d.28f2.1 962f6c13 045a4042.04a81401.033345a1.03ffe57d 02cdecec.031ec3af.0213d883.02837b28.02a7be75.03853500.023892c2.02a52e8a:c60da96de537f08a 23a7bbda5681be978972517d4758bbdd "1.1.20.1 ANS 300 & 500 & 700"
077d.28f2.1 962f6c13 045a4042.04a81401.033345a1.03ffe57d 02cdf1e7.031ed7ca.0213f083.0283859e.02a7b7cc.0385549f.02388b9d.02a4ffaa:d540b3dd5bcf9caa 676809c236138574282fa8416c6c5a6d "1.1.22 ANS 300 & 500 & 700"
077d.28f2.1 9630c68b 045a3ff2.04a8169b.03334745.03ffe575 02d3e2e8.0324a294.0219ffa8.02895fd8.02ada29f.038afd23.023e4a4a.02aac18a:a71fb907dd180b8a d1d3720c38143eb2bac86b8393318529 "2.26B6 ANS 300 & 500 & 700"
077d.7dd0.1 49b2be8f 044701df.046e7c5d.02fa6527.03dc24a2 02c4eb7f.0302e5d4.01f7e0a8.0273a3f7.029f509f.0368984a.021b27e4.0295cecb:5f2aeeb25507b2cb 83be626679b5c74a606cd31443063a53 "2.0 ANS 300 & 500 & 700"
I've attached some listings of the ROMs for ExceptionTable/Start, HWInit, and Open Firmware (OpenFW).
Capturing ROMs
Capturing ROM notes:
https://www.emaculation.com/doku.php/capturing_rom
AutoCopyROM:
https://www.geocities.ws/terry_teague/autocopyrom.html
There's a CopyROMs utility that comes with vMacs but it appears from the source code to only work with ROMs it knows about.
A classic Mac OS app might not work if the ROM is not mapped into virtual memory correctly.
https://macintoshgarden.org/forum/project-looking-mac-roms
I don't think any of the classic Mac OS apps do any virtual memory mapping but I haven't checked all of them. I only have the source code for CopyROMs (different than CopyROM and AutoCopyROM).
I haven't seen source code for any of the other apps except my GrabMem app which also doesn't do any virtual memory mapping. My utility for Mac OS X does do virtual memory mapping.
Disabling virtual memory might help if an app doesn't capture the ROM?
Some notes here:
https://forums.macrumors.com/thread...l-work-in-a-beige-power-macintosh-g3.2303689/
https://forums.macrumors.com/thread...eige-power-macintosh-g3.2303689/post-31329170
https://forums.macrumors.com/thread...eige-power-macintosh-g3.2303689/post-31329386
https://forums.macrumors.com/thread...eige-power-macintosh-g3.2303689/post-31491349
https://forums.macrumors.com/thread...eige-power-macintosh-g3.2303689/post-31494103
Definitely use
ttya:57600 for input and output.
It's faster. I could create a nvram script to enable 115200 or 23400 bps.
Simple command:
But that's not efficient since it outputs hex addresses on every line with the binary bytes.
This command is more efficient:
Code:
0 ffc00000 do i 3f and 0= if cr then i l@ 8 u.r 4 +loop cr
It outputs 64 bytes (128 hex digits) per line.
You can change
3f to
1f for 32 bytes or
0f for 16 bytes per line.
I'm not sure which is faster: longer lines or shorter lines. Shorter lines means more linefeeds and less text to scroll but scrolls more often. Shorter lines might be less console escape characters - if console escape characters are happening. I guess one would have to capture hex bytes from serial to see if any characters other than hex digits and line feeds are being transmitted.
Open Firmware Documentation and Notes
Go to
https://developer.apple.com/library/archive/navigation/#section=Platforms&topic=macOS
Search for Open Firmware. Three of the items are named "Fundamentals of Open Firmware".
Sort by date and read them in order.
The
OpenBIOS page has a documentation section.
IEEE 1275-1994 is for the main spec.
Bindings is for all the extras (graphics, PCI, etc.)
Hold Command-Option-O-F to get into Open Firmware. Type
printenv at the Open Firmware prompt to list the settings.
Code:
OpenFirmware1.1.22
To continue booting from the default boot device type:
BOOT<return>
ok
0 > printenv
security-#badlogins 0
security-password
security-mode none
little-endian? false false
real-mode? false true
auto-boot? false true
diag-switch? false false
fcode-debug? false false
oem-banner? false false
oem-logo? false false
use-nvramrc? true false
f-segment? true true
real-base -1 -1
real-size 100000 100000
virt-base -1 -1
virt-size 100000 100000
load-base 4000 4000
pci-probe-list -1 -1
screen-#columns 64 64
screen-#rows 28 28
selftest-#megs 0 0
boot-device /AAPL,ROM disk2:aix
boot-file
diag-device cd fd:diags cd fd:diags
diag-file
input-device ttya kbd
output-device ttya screen
oem-banner
oem-logo
nvramrc dev /AAPL,ROM : open true ; : load load <bye> ; unselect-dev
boot-command boot boot
ok
0 >
Also check the
devalias command:
Code:
0 > devalias
vci0 /chaos@F0000000
pci1 /bandit@F2000000
pci2 /bandit@F4000000
fd /bandit/gc/swim3
kbd /bandit/gc/via-cuda/adb/keyboard
ttya /bandit/gc/escc/ch-a
ttyb /bandit/gc/escc/ch-b
enet /bandit/gc/mace
scsi /bandit/gc/53c94
scsi-int /bandit/gc/mesh
lcd /bandit/gc/lcd
screen /bandit/54m30@F
ok
And if you have a serial connection, then capture a dump of the device tree for us using the
dump-device-tree command. zip the result and attach to a post.
You can just hold the space bar while it's dumping until it's done.
There's a
lines/page value that is set to 20 by default.
Change it to 0x7fffffff to remove the need to hold space bar.
If you were using a terminal app that properly supports VT100 to capture the text in a scroll back buffer then the
More [<space>,<cr>,q] ? prompts would be removed after accepting your input - Copy and Paste can then be used to copy the result to a text file.
On macOS, I use
Serial.app when connecting to Open Firmware of a Mac via serial (older Power Macs) or telnet (newer Macs that don't have serial).
You can limit the scroll back buffer in Serial.app to a billion lines (2147483647 max). More than enough to capture 4 MB ROM dump.
I bought 2.0 for more features such as telnet support.
https://www.decisivetactics.com/products/serial/release-notes
Both versions let you change the scroll back buffer number of lines.
The DingusPPC emulator outputs serial data to a socket backend. Then I use the
socat command in Terminal.app for input and output.
socat UNIX-CLIENT:dingussocket -,cs8,parenb=0,echo=0,icanon=0,isig=0,icrnl=0
Examining ROMs
tbxi dump can split the ROM into its parts (68K code, DeclData, resources, ExceptionTable, HWInit, OpenFW, Nanokernel).
https://github.com/elliotnunn/tbxi
SlotsParse can parse the DeclData (probably nothing useful as in most Power Macs).
https://github.com/joevt/SlotsDump
ROM Fiend can dump the DeclData, Dispatch Table, and Universal Tables.
https://github.com/joevt/rom_fiend
DumpMacRom.sh can convert the OpenFW part into assembly and Forth. I think this is where the Mac OS boot difference may be found, or at least the first part.
https://github.com/joevt/OpenBIOSStuff
DeRez for resources.
DumpPEF for PEFs.
https://github.com/ksherlock/mpw
etc.
Comparing the TNT and ANS ROMs
ANS 1.1.22 vs TNT 1.0.5
ANS ROM is close enough to TNT ROM that I've assigned ROM Map tnt_2.8f2_rominfo.txt to be used with the ANS ROM in ROM Fiend.
Code:
077d.28f1.1 "Boot TNT 0.1p..]" "ROM 1.0.5 1995-08 - 96CD923D - Power Mac 7200&7500&8500&9500 v1"
077d.28f2.1 "Boot TNT 0.1p..]" "ROM 1.0.5 1995-08 - 9630C68B - Power Mac 7200&7500&8500&9500 v2, SuperMac S900"
077d.28f2.1 "Boot TNT 0.1p..]" "ROM 1.1.22 ANS 500 & 700"
ROM Fiend only accounts for the 68K part of the ROM. Comparing that part with TNT there's only a couple small changes (other than build dates in the PEFs). ANS has some extra code in Exception Table and HWInit (some is doing output to the LED display). TNT has OF 1.0.5 so it's difficult to compare - OF 1.1.22 from ANS has all words defined external or headers but TNT has many words defined as headerless (unnamed).
The first thing to fix in the ANS Open Firmware to allow booting Mac OS would be to fix the
open and
load words of the
AAPL,ROM device like this:
Code:
dev /AAPL,ROM
: open true ;
: load load <bye> ;
unselect-dev
Put that in the
nvramrc script using
nvedit, Control-C to end editing,
nvstore to save to nvram,
do
setenv use-nvramrc? true, reboot, see how far it gets.
Be sure to use a CD or hard drive connected to the SCSI bus that matches the SCSI controller used in the TNT machines.
Hopefully nothing in ExceptionTable or HWInit needs to be patched.
ANS 1.1.20.1
1.1.20.1 is very similar to 1.1.22 except for these differences:
- ExceptionTable/Start stuff
- HWInit
- Open Firmware
real-mode? default is false instead of true.diag-device default is cd fd:diags /AAPL,ROM instead of cd fd:diags- Doesn't have properties
dimm-sizes and dimm-interleaves
- Allows booting from
/AAPL,ROM but will report:
"MacOS is currently unsupported, use at your own risk.".
Does it boot MacOS successfully?
- Mac68KROM
- There's no changes (all 3 MiB of the 68K stuff).
ANS 2.26B6
ANS 2.26B6 has many changes and fixes (like the difference between 9500 v2 and Beige G3) which makes sense since it is version 2 instead of version 1. (2.26 vs 1.1.22 or 1.0.5 where Beige G3 is 2.0f1).
However, the first 3 MiB (the 68K part) is identical to 9500 v2 ROM.
The device-tree of ANS 2.26B6 has OpenFirmware2.26 while the ANS 1.1.22 has OpenFirmware1.1.22
- 2.26B6 Adds device alias for a mouse. Mouse device adds words to check the mouse button.
- 2.26B6 Adds pe-loader package
- 2.26B6 many minor changes and additions.
ANS 2.0 (for booting Mac OS)
Has version number (7dd0) which seems strange. The second digit is usually 0-9.
The 2.0 ROM has many words declared headerless (unnamed) which makes it difficult to compare to 1.1.22 or 2.26.
<bye> in ROM 2.0 has extra code to clear bit 16 (PowerPC counting) of the MSR register (disables external interrupts). I guess Mac OS expects interrupts to be disabled before booting? Is this bit normally cleared in Open Firmware? Is it set in Open Firmware of ANS? Things to look into...
The following
nvramrc script code adds clearing of that bit in the MSR:
Code:
dev /AAPL,ROM
: open true ;
: load load msr@ h# ffff7fff and msr! <bye> ;
unselect-dev
Exception handlers 0x1000, 0x1100, 0x1200 are different.
I see the ExceptionTable section is missing LCD strings. There's a lot of differences here.
In HWInit, the code after Serial Test Manager is smaller and missing strings.
ANS Misc Notes
I need to add the
53c825 PCI devices to DingusPPC so that the ROM detects the hardware as
AAPL,ShinerESB like in the device tree of a real ANS. The presence of a 53c825 PCI device causes the
?esb value to be set to true.
In the current emulation without a 53c825 device, the device tree has
AAPL,9500.
?esb causes a few changes.
- changes
AAPL,slot-name and
slot-names
- changes the number of slots and allocation between
bandit1 and
bandit2
-
?esb true removes
mesh (second built-in SCSI bus)
- serial port
AAPL,connector names
- etc.
If you have 53c825 model NCR,825A then that means you have
?esb-evt2 set to true. This model has an over temperature flag that gets checked by Open Firmware while waiting for a keypress.
Flashing ANS or TNT ROMs
New World Macs have flashable ROM chips. Old World Macs usually do not.
Some ANS ROMs have erasable programable ROMs (AM28F020) and are usually/always in the ROM SIMM slot.
The Power Mac 9600 schematics show the ROM SIMM slot (sheet 6) has a ROMWE_I signal that comes from ROMDATAWEN of Hammerhead (sheet 3).
https://www.macdat.net/files/pdf/apple/schematics/apple/
The Hammerhead ERS document says 8 byte writes to the ROM will work when the RomWE bit is enabled in the Hammerhead ROM Timing Register.
This means a ROM should be flashable in place. Such ROM flashing utilities ("flash gordon") exist for classic Mac OS for 68K and PPC Macs as discussed at 68kmla, but we need an Open Firmware method for ANS that doesn't boot Mac OS. B&W G3 firmware updater has Open Firmware code for doing flashing. It could maybe be adapted for ANS. A failure that requires a reboot means the ROM SIMM would need to be flashed externally. A failure that doesn't require a reboot means you can try again with different firmware update code.
Would be nice to be able to make ROM SIMMs but any such SIMM would need to be flashed externally since they won't come with a ROM for booting to flash in place.
Found ANS 300/500 Service Source at
http://www.applerepairmanuals.com/the_manuals_are_in_here/Network_Server_500_700.pdf
