Apple Network Server MacOS based ROMs found

[Jockelill]

Can a ROM SIMM be created that has a switch to switch between two different ROMs while the Power Mac is running?

The first ROM would be a working ROM to boot into Open Firmware.

The second ROM would be the target for flashing.

Boot the first ROM into Open Firmware, then flick the switch to select the second ROM for flashing. Then use the serial port to transfer the flashing program and the new ROM.

This would eliminate the need for an external flasher and it would add safety to the ROM flashing process.

Yes, is the short answer, but it’s a little bit more complicated than that. Essentially the ISP that @zigzagjoe has created does this for the se/30 and Quadras, it even has a reset output that automatically restarts the computer when flash is finished. It uses a RP2040 which you hook up to your PC, the ROM then appears as a storage device, and you reflash it with uf2-files. Since it has 16MB of storage, there is a switch onboard, switching between two banks, so on one of them you can put “last known working ROM”. This device is perfect for playing with the rom and for rapid development.

Something like this is what I would like to see also for the PPC . Issue is of course the 64 bit data path, so even with an 2350B with 48 GPio it would need multiplexers to work, plus buffers towards the machine and so on.

For a first test of hacking I believe @dougg3 idea of 8 standard chips is easier to have up and running.

 

[joevt]

As long as it's running fully from RAM at the point that you switch ROMs it would work fine.

Should perform a test in DPPC to see if anything (exception handlers?) in ROM is accessed after Open Firmware is set-up. Can do a copy to RAM and virtual memory to compensate maybe.

 

[dougg3]

Yeah, if the ROM is accessed after OF is up, it would be tricky to add a switch because it's game over after the switch is flipped to the second ROM.

If you can prove the ROM is not accessed, or guarantee to not access the ROM after a certain point and give the user a chance to flip the switch after that point, then yes, I think a switch could potentially work. You could have the switch re-route the /OE and /WE signals to a different set of 8 flash chips, or maybe find larger chips and use the switch to toggle the highest address line on them or something. I think that's similar to what Garrett's Workshop's ROM SIMM does with the separate selectable ROMs.

 

[joevt]

The name of the ROM Flashing Utility is "Flasher (TNT 0.6)". I ran it in DingusPPC emulating a Power Mac 9600 v1.
DingusPPC shows the code below after setting the RomWE bit of the ROM Timing Register.
It uses 8 byte read/writes to FFC00000 and FFE00000 to probe the ROM (offset 0 and offset 2 MiB).
It writes patterns 9090909090909090 and 909090909090909.
Then it tries to read the results.
DingusPPC doesn't emulate flashing yet, so the result is just the bytes of the ROMs at those addresses.
I guess real flash chips would return some kind of Flash Chip ID.

It looks like the code for read-ROM-id-AMD-4M? or read-ROM-id-intel-4m? in the B&W G3 Firmware update code which also uses 64-bit read/writes.

You can probably also find similar flash id code in flashrom.
https://github.com/joevt/flashrom

Working on porting B&W G3 Firmware update to ANS/TNT Open Firmware.
I'll try making DingusPPC emulate flashable ROM to test that and to see "Flasher (TNT 0.6)" work to completion.

 

[joevt]

"Flasher (TNT 0.6)" expects AMD 28F020 (vendor/ID = 01,2A) or Intel 28F020 (vendor/ID = 89,BD). Since these chips are 2 Mb there are 16 chips = 4 MiB.

8 chips are accessed using 8 bytes at ROM base + 0 (1 byte per chip). The other 8 chips are accessed using 8 bytes at ROM base + 2 MiB (1 byte per chip). All chips must report the same vendor / ID.

 

[Jockelill]

"Flasher (TNT 0.6)" expects AMD 28F020 (vendor/ID = 01,2A) or Intel 28F020 (vendor/ID = 89,BD). Since these chips are 2 Mb there are 16 chips = 4 MiB.

8 chips are accessed using 8 bytes at ROM base + 0 (1 byte per chip). The other 8 chips are accessed using 8 bytes at ROM base + 2 MiB (1 byte per chip). All chips must report the same vendor / ID.

Yes, unless you hack the flasher tool you're stuck with those chips. I know @dougg3 managed to hack the flasher tool to at read the M29F160FB5AN6F2 chips (those are used for Rominator and similar), but I think @dougg3 idea here was to use socketed chips and then flash them one by one (8 times) with an external flasher like the TL-866.