Apple Network Server MacOS based ROMs found

  • Board Nominations
    Nominations have now closed and the results are available here.
  • Hey Guest, MARCHintosh 2026 is upon us. Check out community projects, join GlobalTalk, and have fun!
J

joevt

Tinkerer
Mar 5, 2023
262
103
43
ClassicHasClass said:
OK, I've finally posted my detailed work log on the 1.1.20.1 and 2.26NT ROMs with a lot of commentary.
Click to expand...

The nvramrc script and nvram variables that get modified by classic Mac OS are stored in OFpt resources in the Startup Disk control panel.

Code: 
'OFpt' (128, "PowerSurge")
'OFpt' (129, "PowerExpress")
'OFpt' (130, "Gossamer")
'OFpt' (131, "PowerMac G3")
'OFpt' (132, "Wallstreet")
'OFpt' (133, "Mainstreet")
'OFpt' (134, "Hooper")
'OFpt' (135, "Kanga")
'OFpt' (136, "Alchemy")

A similar set of resources exist in XPostFacto.

It looks like the control panel is choosing the PowerSurge script. That script is meant for Open Firmware 1.0.5. It is not suitable for the ANS versions of Open Firmware.

For example, the line 6ED '& execute executes fcode 0x6ED.
6ED is different for each version of Open Firmware:
  • 1.0.5: 6ED = restore-ttp800 (but the name for this fcode and most others is not stored in OF 1.0.5)
  • 1.1.20.1, 1.1.22: 6ED = key=locked?; 6E8 = restore-ttp800
  • 2.0: 6ED = do-map; 6DA = restore-ttp800
  • 2.26B6, 2.26NT: 6ED = status; 6F7 = restore-ttp800
The choice is made using the OFtc resource which maps a model identifier (such as AAPL,9500) to a OFpt resource ID. It should have been choosing by Open Firmware version or by the 64-bit checksum of the ROM (which covers the entire 4 MiB instead of just the first 3 MiB - Open Firmware is in the last 1 MiB).

Creating an nvramrc script for each ANS ROM requires the following:
  1. Decipher what is being patched for PowerSurge.
  2. Do the same for all the other OFpt resources in case they have relevant changes that don't exist for PowerSurge.
  3. Translate all the relevant patches for your version of Open Firmware.
This is optional since you have seen that the ANS is bootable without any patches.

I've documented most of the PowerSurge patches used by my version of XPostFacto.

Regarding the CLAIM failed error, I suppose a patch can be created to see what is attempting the CLAIM (by dumping the return stack) and what it is trying to CLAIM (a physical or virtual memory range)... I want to add this patch to my Open Firmware Extender to see why Open Firmware 2.4 won't boot Mac OS X 10.2 if auto-boot? is false. The Open Firmware Extender is mentioned at #5,071 . I want to port it to different versions of Open Firmware. Maybe it can inject the ndrv for ANS graphics and for the ANS SCSI controllers for versions of the ANS ROM that don't include those.
 

Attachments

  • joevt-XPostFacto nvram.zip
    29.7 KB · Views: 151
  • Like
Reactions: bakkus and ClassicHasClass
C

cc333

Tinkerer
Dec 22, 2021
36
25
18
California, USA
The ANS has suddenly become much more interesting and useful!

That said, with all that is being learned here, might it someday be possible to create a single hybrid ROM that can boot the factory AIX, Mac OS/Mac OS X (with necessary patches so internal SCSI and video work) and Windows NT? I think that would be an excellent accomplishment, and if I read this thread correctly, you all are already well on your way to doing just that.

I don't know why I would ever need to have an ANS, but, if by some chance, I ever come across one, I now know that I can actually use it for normal Mac-related things if I want to!

c
 
  • Like
Reactions: ClassicHasClass
C

ClassicHasClass

Active Tinkerer
Aug 30, 2022
452
269
63
www.floodgap.com
It would be nice (I don't know if you, @joevt , have developed such tools already) to have some way to do debugging in Open Firmware. Rairii/Wack0 asked about getting a register dump to analyse that veneer exception and understand why it won't run it, but I'm not aware of an easy way to do that.
 
J

joevt

Tinkerer
Mar 5, 2023
262
103
43
ClassicHasClass said:
It would be nice (I don't know if you, @joevt , have developed such tools already) to have some way to do debugging in Open Firmware. Rairii/Wack0 asked about getting a register dump to analyse that veneer exception and understand why it won't run it, but I'm not aware of an easy way to do that.
Click to expand...
I have a Trace for Open Firmware script that can show what's getting executed. It needs more work but can do some simple stuff.

It works by patching every word or words that you explicitly ask to patch. Then when you enable tracing, it will output each word as it enters and exits, and displays the stack at each point.

The script won't patch words that are not safe to patch but I need to expand the list of unsafe words because if you try to patch all words it will hang for some words. Maybe the words that hang need a different kind of patch.

Some words disable tracing temporarily for itself or for words called by itself. This behaviour can be set per word.

Some words are really simple and only patch entry or exit (not both).

It has dump-return-stack for dumping the return stack.

It has list-tokens to list the tokens for a compiled word. This helps creating patches.

I would patch ?claim-abort to use dump-return-stack.

The Copland Open Firmware has a disassembler and a debugger that allows setting breakpoints. I included them in my Open Firmware 2.4 Extender. I haven't tried the breakpoints functionality so I don't know how useful it is.
 

Attachments

  • Open Firmware Trace.of.zip
    10 KB · Views: 145
  • Like
Reactions: ClassicHasClass
C

ClassicHasClass

Active Tinkerer
Aug 30, 2022
452
269
63
www.floodgap.com
That would be good for studying words, and I may well use that soon, but we wanted to get a little more information on the PowerPC exception that got thrown. Can the DEFAULT CATCH! routine be patched to do a full PowerPC register dump?
 
J

joevt

Tinkerer
Mar 5, 2023
262
103
43
ClassicHasClass said:
That would be good for studying words, and I may well use that soon, but we wanted to get a little more information on the PowerPC exception that got thrown. Can the DEFAULT CATCH! routine be patched to do a full PowerPC register dump?
Click to expand...
@startvec.>'excp stores the default exception handler which is _exception
This does a throw of the exception vector number. Maybe it can be replaced by something that saves more info (copy all the registers and the stacks?).
@startvec.>'syscatch stores the default catch handler which is _syscatch
This is stored on the bottom of the return stack to catch anything that is not caught be a more recent catch higher up the return stack. You want a syscatch that outputs the info saved by the modified exception handler.

Changing @startvec.>'syscatch is probably not sufficient. The items at the bottom of the return stack that point to _syscatch would also need to be replaced. As an alternative, _syscatch itself can be patched instead of changing @startvec.>'syscatch
 
J

joevt

Tinkerer
Mar 5, 2023
262
103
43
I plan on continuing work on my Open Firmware Extender for Open Firmware 2.4 and to make a version for Open Firmware 1.0.5 and the ANS ROM versions. If one can boot Mac OS on an ANS ROM version that is missing support for the built in graphics or the internal PCI SCSI controllers, then I think my Open Firmware extender can be made to fix that. I also plan on continuing work on the ANS emulation in DingusPPC to test the Open Firmware Extender.
 
  • Like
Reactions: Mac84, Mr. Macintosh and Paralel
Mr. Macintosh

Mr. Macintosh

New Tinkerer
Dec 22, 2021
7
0
1
joevt said:
I plan on continuing work on my Open Firmware Extender for Open Firmware 2.4 and to make a version for Open Firmware 1.0.5 and the ANS ROM versions. If one can boot Mac OS on an ANS ROM version that is missing support for the built in graphics or the internal PCI SCSI controllers, then I think my Open Firmware extender can be made to fix that. I also plan on continuing work on the ANS emulation in DingusPPC to test the Open Firmware Extender.
Click to expand...
Wonderful! Thank you @joevt. I just spoke to zigzagjoe about his original product https://juicycrumb.com/store/?v=0b3b97fa6688 and if it could be one day modified for an ANS ROM. But that seems to be way too much work.
 
C

ClassicHasClass

Active Tinkerer
Aug 30, 2022
452
269
63
www.floodgap.com
Mr. Macintosh said:
Wonderful! Thank you @joevt. I just spoke to zigzagjoe about his original product https://juicycrumb.com/store/?v=0b3b97fa6688 and if it could be one day modified for an ANS ROM. But that seems to be way too much work.
Click to expand...
Which product is that? I just get the main page with that link. (But I love the JC HI-FI item! JC, you've done it again!)

@joevt, do you have something handy that can pull an ndrv out of a ROM, or is this something I'll have to whip up? I'm thinking of creating a modified Mac OS that will at least have internal video so it can work with either the pre-production ANS ROMs or the 2.0 ROMs.
 
  • Like
Reactions: Mr. Macintosh
Mr. Macintosh

Mr. Macintosh

New Tinkerer
Dec 22, 2021
7
0
1
ClassicHasClass said:
Which product is that? I just get the main page with that link. (But I love the JC HI-FI item! JC, you've done it again!)

@joevt, do you have something handy that can pull an ndrv out of a ROM, or is this something I'll have to whip up? I'm thinking of creating a modified Mac OS that will at least have internal video so it can work with either the pre-production ANS ROMs or the 2.0 ROMs.
Click to expand...
Sorry not sure why that link is not working try this https://juicycrumb.com/product/isp-simm/?v=0b3b97fa6688

Thanks @ClassicHasClass I was really hoping to have it ready for my VCFMW display later this year. That still leaves us some time :)
 

Attachments

  • Screenshot 2026-03-25 at 12.33.40 AM.png
    Screenshot 2026-03-25 at 12.33.40 AM.png
    289.2 KB · Views: 115
J

joevt

Tinkerer
Mar 5, 2023
262
103
43
ClassicHasClass said:
@joevt, do you have something handy that can pull an ndrv out of a ROM, or is this something I'll have to whip up? I'm thinking of creating a modified Mac OS that will at least have internal video so it can work with either the pre-production ANS ROMs or the 2.0 ROMs.
Click to expand...
Use the tbxi dump command to extract all the parts of the ROM.
https://github.com/elliotnunn/tbxi

ClassicHasClass said:
Oh, don't thank me yet. You'll still need one of the special ROMs for it; the regular production ROMs just won't work for this, even if you try to patch the OpenFirmware words.
Click to expand...
We could load the special ROM from disk and use virtual memory to map it in place. We would need to understand what kind of virtual memory stuff happens during boot to see if that's possible (i.e. we don't want our mapped ROM to disappear during boot - we could make modifications to the loaded ROM to avoid issues). Doing this in an emulator makes development of the solution easier. I suppose this would be like adding New World tbxi "Mac OS ROM" file support which is another thing we could do with the Open Firmware Extender. We have system enablers now that allow running System 7 on New World Macs. We have Mac OS 9.2.2 patches that allow running it on Old World Macs. The tbxi build command has the ability to make new tbxi files or ROMs.
 
C

ClassicHasClass

Active Tinkerer
Aug 30, 2022
452
269
63
www.floodgap.com
I think those are all good things, and I really do appreciate all the hacking you do on Open Firmware, but the core goal of a "boot anything" ANS won't get better until there are actually sticks people can put in motherboards. We already have what is nearly the optimal ROM thanks to @johntucker , but as long as there aren't any more of them, that won't improve.

I get the relative lack of interest of the boutique builders with custom Power Mac ROM sticks, though. 68K ROM sticks weren't very interesting for people either until there were software hacks, Rob Braun's ROM disk, etc. Nothing like that exists for Power Macs yet, and the few of us who have Shiners aren't much of a market.

In the meantime, me working up a custom ANS MacOS to smooth over some of the rough spots is just because pre-production ROMs are what I've got in silicon, and they boot.
 
T

trag

Tinkerer
Oct 25, 2021
309
152
43
eric said:
Current Status: We have the ROM's dumped, but now need a way to program them. The ROM board/s are AM28F020 and I believe are the same/similar to what other PowerMacs had (photo via @johntucker )
View attachment 24298

I'll keep this first post updated as all the details emerge.
Click to expand...

I don't know how I never noticed this thread until now. Visiting here too seldom.

I can make copies of those ROMs, but will need some help processing the dumps to get them ready. I still have thirteen blank ROM circuit boards and hundreds of flash chips.

Process the dumps. Program them onto chips, solder the chips to boards. Done. Probably only take me 8 or 10 years based on past experience. :)

Seriously, I don't have a lot of attention to spare, but can probably get it done, if someone else will take the lead on getting the files to be programmed massaged as needed.

The ROM module in the X100, the X500 and X600 Macs, the ANS, the Beige G3 and the PowerExpress are all the same physically, although the Beige G3 is wired for 3V supply, instead of 5V supply.

Here's the saga of making the ROMs for the PowerExpress:

PowerExpress (9700) ROM Thread

Which also covers in some detail the process of going from 4 MB dump to four files suitable for programming on X16 flash chips.

Not sure if I referenced any files in my old webspace in there. My ISP changed since then, so if I did, referenced files would be here:

https://sphinxgroup.org/Firmware/

If more than thirteen modules are needed, I still have the board design and JLCPCB was pretty cheap to produce the previous 20 I made. In fact, I think the gerber files are in the folder referenced above.

I've also used this design to make Rev. B and Rev. C ROM modules for the Beige G3 (adds 2 drive support on ATA busses), and Kansas ROM modules for the X500/X600, which doesn't really do much, but in theory should make speculative processing work properly with G3 upgrades on those machines.

Is there a story behind how John found the ROMs? I didn't read the thread in as much detail as I should, but I gathered he found two versions and that Classichasclass found another?

In case anyone doesn't ahve it I've attached the Apple Hardware Developer Note for the ANS. I'm much more a hardware guy than a software guy.

The main differences between the ANS and the PowerMac 9500/9600 is that the ANS has ten PCI devices where the PM9500 only has 7 (six slots + Grand Central). The ANS adds the 53C825 SCSI chips and the onboard video chip. Each PCI device gets a unique interrupt (routed through Grand Central) in the Apple universe, so the ten interrupts supported by Grand Central are arranged very differently on the ANS than on the PM9500, which is at least one reason the ROMs for one do not work on the other.
 

Attachments

  • ANSHardwareDevNotes.pdf
    847.3 KB · Views: 1
  • Like
Reactions: Mr. Macintosh
C

ClassicHasClass

Active Tinkerer
Aug 30, 2022
452
269
63
www.floodgap.com
Yay @trag! @johntucker found two versions, the pre-production ROM and the 2.0 ROM. It turns out I also have a pre-production ROM (it hashes the same as his), and I also have the 2.6 NT ROM thanks to @dbinreno .

However, the 2.0 ROM is the one we're most interested in because that has drivers for allowing the internal video and SCSI to be used in MacOS. With luck it will also boot Rhapsody.

I can split up the files for programming if you let me know how they should be cut up.
 
  • Like
Reactions: Mr. Macintosh
T

trag

Tinkerer
Oct 25, 2021
309
152
43
ClassicHasClass said:
I can split up the files for programming if you let me know how they should be cut up.
Click to expand...

Explanation is in the thread linked above. I'm not sure if Rob's deinterleaver is still downloadable from links in that thread, but I believe it is here:

https://sphinxgroup.org/Firmware/PEx/Deinterleaver Utility and Examples/

What it boils down to is that one divides the ROM dump into 2 byte chunks deinterleaved in 4 parts and reverse the two bytes of each chunk. Go a post or two above the one in

https://68kmla.org/bb/threads/pex-rom-project.23568/post-269617

for an example of how it was worked out. I had dumps from a Kansas (9600 Enhanced) machine and also the four files read directly from Kansas ROM chips and compared them until the pattern emerged.

Deinterleaving the Kansas dump first and comparing it to the ROM chip reads is a good test of whether the Deinterleaving process is working properly.
 
You must log in or register to reply here.
Top Bottom