After I wrote about the possibility of programmable Mac ROM SIMMs in Quadras a couple of months ago, I suspected that there had been a way for developers at Apple in the 68k Mac era to reflash the ROM in their Macs during development, just like BIOS updates on PCs. The reason I believed this is because the ROM SIMM socket in the Quadras brought out pins for 12V (VPP) and write enable (/WE). I had verified that the write enable pin was going into the memory controller chip in several Mac models, so I was pretty confident that in-system programming was possible.

As luck would have it, multiple people pointed out to me that an Apple internal utility used for ROM flashing had been uploaded to the Macintosh Garden. It was recovered from a prototype PowerBook 520 purchased in 2020. Of course, I had to download this utility and figure out how it works.

I ran it on my LC 475 and this is what it looked like:

Here’s the About dialog, identifying Carl C. Hewitt as the author:

As you can see, it says the SIMM type is “Read-Only ROM” and the Program button is grayed out. This makes perfect sense, because it was just detecting my logic board’s mask ROM chips which are definitely not programmable.

All I was able to do was go to the File menu and choose “Save Onboard ROM…” to dump my existing ROM. It defaulted to a filename of “Saved RomMondo”. Then I could use the Verify button to show that my onboard ROM matched the dump:

This is all very interesting, but I wanted to see what it was like to actually flash a new ROM image. I wasn’t really sure where to begin though. Would this utility even support any of my Macs? What kind of ROM module would I need? What would it take to get that Program button enabled?

In order to answer these questions, I had no choice but to start disassembling the Flasher™ utility. Fortunately, a lot of the functions in the program had their names present as a string directly afterward so it gave me some context about what was going on. The holy grail was when I discovered this big table of entries for compatible ROMs. The names of these table entries, and the table itself, were assigned by me.

A lot of the entries in this table are PDS cards. You can even see in the main UI screenshots above that there was a separate “PDS ROM Info” section on the right. I would love to see an example of what these PDS cards looked like, if anyone out there has some inside knowledge they would be willing to share!

Let’s look at one of the SIMM entries in detail: QuadraSIMM1.

This contains a lot of info, and I had to do further disassembly throughout the program to understand what everything meant. 0x89898989 and 0xBDBDBDBD are the flash manufacturer and device ID, repeated four times because four 8-bit chips will respond at a time on the 32-bit data bus. 0x89 is Intel’s JEDEC manufacturer ID and 0xBD is the device ID for their 28F020 256-kilobyte flash chip. 0x40400000 is the base address for ROM write cycles, 0x40800000 is the base address for ROM read cycles, and 0x100000 is the size of each set of four chips (1 MB). This particular SIMM appears to have 2 banks, so it is likely a 2 MB SIMM with 8 flash chips.

After that, there are various flags for special options, and a jump table for functions to perform different operations like checking presence of the SIMM, erasing, and programming. I won’t go too far into the weeds about what it all means, but the other interesting part is at the end of the structure, which contains a NULL-terminated list of allowed gestalt machine IDs. We determined in my 68kmla post that the IDs listed above that don’t have names are simply unreleased variants of the other models for the most part. For example, 86, 90, 93, and 95 are gestalt IDs for unreleased variants of the LC 475 and Quadra 605 running at 20 MHz and 33 MHz instead of the final 25 MHz version.

So what does all this info tell us? Well, there is code elsewhere in the program that loops through the entire table one-by-one trying to determine if any items in the table are installed in the Mac it’s running on. Looking through this table allows me to get an idea of which Macs this program is compatible with as well as which flash chips a compatible ROM SIMM would need to use.

In the case of Quadras, it appears that a wide variety of them are all supported by the same code. The 700, 900, 950, 610, 650, 800, 475, 575, 630, and 580 are all handled by the table entry depicted above. There are also similar table entries for a 4-chip Intel 28F020 SIMM and 4- and 8-chip AMD 28F020 SIMMs. The 660av and 840av are supported by a couple of separate table entries for 8-chip 28F020 SIMMs with Intel and AMD parts. If you want to learn about other compatible Macs, see the 68kmla post I linked earlier. Before I get people’s hopes up too far, this utility doesn’t support earlier Macs like the SE/30 or II series. The only exception to that is the IIvx/IIvi/Performa 600.

It was around this time that I made a stupid mistake with my multimeter while checking out the SIMM /WE pin, and I think I fried it on my LC 475 by accidentally shorting it to 12V. They are right next to each other in the socket. My bad! Since then, I’ve bought another logic board for it so I can continue my experiments. Even though I now have a new logic board in my LC 475, I’ve moved over to doing most of my research on my Performa 630 instead.

At least my mistake gave me the opportunity to show this machine off. Notice that it’s a Performa 630; not a Performa 630CD. See that thing that suspiciously looks like a CD-ROM drive on the left? It’s not. It’s a blank cover to put something in the opening where the CD tray would come out. This is what the 630 series machines looked like when they didn’t come from the factory with a CD drive. And yes, as I’m sure many others did too, I pressed the button thinking the CD tray would come out. If you push the button hard enough, it gets stuck back in there. Don’t ask me how I found that out.

Anyway, the next step was to figure out how I could find a compatible SIMM to try this program out with. The programmable SIMMs that I designed in the past wouldn’t work. None of their chip IDs match, and my pinout for write enable was different. Not to mention they don’t properly disable the onboard ROMs. Looking deeper, modern flash chips use different programming commands and algorithms than the chips Apple supported anyway.

You may remember that I mentioned in my last post about Josh Watson finding an Apple programmable “Lobos board” SIMM on eBay a while ago. Here’s the 68kmla thread about that if you’re interested. Josh’s pictures clearly showed a board with four Am28F020 chips — one of the known compatible chip arrangements based on my disassembly. His pictures were detailed enough, and I’m familiar enough with the 64-pin ROM SIMM pinout, that I was able to reverse-engineer the entire PCB by looking at the pictures. I designed a replica in KiCad. It’s not exactly identical, but it’s very close to it.

It’s a 4-layer PCB just like the original. That sure makes routing ground and 5V a lot easier! I ordered five boards. In the meantime, I also ordered some new-old-stock Am28F020-120 chips on eBay. Then I just had to wait for things to arrive and put it all together!

There was still a challenge to solve though. I needed a way to put an initial ROM image onto this thing. You can’t program it in-system if it’s blank. As soon as it’s inserted into the ROM SIMM socket, it disables the onboard ROMs. Plus, it’s not compatible with my SIMM programmer because it needs 12V for VPP, and /WE is in a different place. You need to use something else to bootstrap it. That’s why I installed PLCC sockets on it rather than soldering the chips down. I used my XGecu T56 programmer, which helpfully also provides the ability to interleave a file across 4 chips:

By the way, I did notice an annoying issue with this programmer and the Am28F020 while I was playing around with it. If I tell it to erase the chip, it doesn’t fully erase. Most of the bits erase, but a few of them don’t. I have to erase twice in order to fully erase the chip. I tried contacting XGecu about this issue but they didn’t respond to my question. My guess is XGecu made a small mistake in the erase algorithm.

Even though my SIMM programmer is unable to program these chips, I was still able to use it to test the programmed SIMM contents and make sure they matched the stock 630 ROM. This made me feel much safer about sticking an untested PCB design into my Performa. I was also paranoid about making sure pin 2 (12V) wasn’t mistakenly shorted anywhere else on the SIMM, so I carefully double checked with my multimeter.

Next up, I needed my Performa 630 to actually have a ROM SIMM socket. Most machines of this era don’t come with the socket populated. Mine didn’t have the socket, and also needed to be recapped. You can see the footprint for the 64-pin socket with the holes filled with solder.

Back when I was making ROM SIMMs and programmers, I bought a bunch of sockets. So that wasn’t a problem at all. I got out my Hakko 808 vacuum desoldering tool and emptied out the holes. This was a breeze and allowed me to easily solder in a socket. Here it is with the socket populated and my new SIMM inserted.

With my reproduction Lobos SIMM installed, I was finally ready to boot up and run the Flasher utility again. The first good sign was that the machine still booted with the SIMM installed. I kind of expected that part to succeed since my programmer was able to read it, but it was still good news.

That’s more like it! Flasher detected a programmable “AMD 28F020 x 4” SIMM. The Program button was enabled! In order to try in-system programming, I created a hacked ROM containing a custom startup chime. If you’ve been following my blog for a while, you may know that I’ve always loved being able to mess around with Mac startup sounds. I might make the sound customization the subject of a future blog post, but for now let’s just assume that part has already been taken care of.

In order to use the new ROM file “630 New ROM” in the screenshot above, I had to use ResEdit to change the type and creator code of the file. The type code is ‘ROM ‘ and the creator code is ‘HIRM’. This would have taken more disassembly to figure out, so I’m glad that the program also supports saving ROM dumps which made it easy to find the correct codes.

Now that I had a brand new ROM file ready to go, I was finally ready to load the file and program it to the SIMM. Here’s a video showing the entire flashing process. You might enjoy hearing the clickety-clack sound of the original hard drive still in this thing.

My new ROM is identical to the original 630-series ROM, except it plays the Power Mac 6200/6300 startup sound instead — my favorite old Mac startup sound!

If I were a particularly evil person, I could definitely create some confusion with this new startup sound if I replaced the label on the front with one of these Apple service replacement labels I recently bought on eBay from Sun Remarketing’s old inventory…

But don’t worry. I would never do such a terrible thing.

What can we do with everything I’ve learned from this experiment? I believe it would technically be possible to hack the Flasher program so that it would recognize newer flash chips such as the SST39SF040. Basically I would have to modify one of the table entries to match a modern chip ID, and also hack the functions that do identification/erasure/programming to perform the sequences used by modern chips instead of the older 28F020 chips.

It would probably be easier to just make a new flasher program instead, but at the same time I think there would be something really cool about being able to use Apple’s own internal utility if this actually becomes a thing. If I find some spare time in the future, I may very well look into modifying it.

That would take care of the software changes needed, but as you may remember from my last post about Mac ROM SIMMs, there is also a hardware problem to solve. It would be nice to have a ROM SIMM that is compatible with in-system programming in these machines but also compatible with older machines and all of the SIMM programmers out there based on my original design. It turns out a solution for this is in the works from some smart people out there.

One last thing I want to reiterate about this: it would only be useful for people who have a ROM SIMM socket installed on their logic board. Not many supported machines out there today have the socket populated, with the exception of the Quadra 700/900/950. It’s definitely possible to solder the socket in like I did, but it’s not going to be a fun time if you don’t have a vacuum tool to clear the holes.

Now we have all seen what it was like for developers at Apple in the ’90s to reprogram the ROMs in their development Macs. I wonder how long it has been since someone last used this program to flash a Mac before I resurrected it this week? I do know that it was still in use during the PowerPC era. A newer version of this same program was used for Power Mac 7500/8500/9500 development. You can find it on this PCI Power Macintosh DDK disk.

Does anyone out there know more about how Mac ROM development worked back in the day? What if you accidentally screwed up and made your SIMM unbootable? There must have been some recovery method, right? Was that one of the reasons for the existence of the PDS cards I mentioned earlier? Or was there some other external SIMM programmer device that could reflash them? I’d love to hear more about it.

Trackback

25 comments

  1. I’m guessing this Carl Hewitt?

    https://www.linkedin.com/in/carl-c-hewitt/

  2. Alonzo23 @ 2023-11-26 13:59

    When apple make OS7 free similar blender or netscape.

    Why not put old os for developers comunity and make in GPL

  3. […] As luck would have it, multiple people pointed out to me that an Apple internal utility used for ROM flashing had been uploaded to the Macintosh Garden. It was recovered from a prototype PowerBook 520 purchased in 2020. Of course, I had to download this utility and figure out how it works. […]

  4. nice work – any thoughts about making replicas of the flashable gm rom card for the pippin? it appears? that this may be flashable in-machine as well from appearances…

  5. @Duncan I would guess you are correct!

    @Alonzo I don’t know for sure but I would bet there are licensing issues that prevent them from doing that, like things they distributed but didn’t write themselves. It sure would be cool though!

    @defor Thanks! I haven’t thought about the Pippin much. It looks like the Pippin uses gestalt ID 73 according to this site: https://www.leadedsolder.com/2023/05/30/apple-bandai-pippin-pickup-fan-repair.html

    I don’t see gestalt ID 73 in this program anywhere, but the Pippin is probably a little too new for the Flasher version I’m looking at. I wouldn’t be surprised if there was a newer version that they used on the Pippin…

  6. By the way, I actually succeeded today at hacking the code of Flasher to erase and program modern flash chips. It required a lot of 68k assembly work, but luckily I had a good reference to start from in my USB SIMM programmer.

    There’s definitely a world in which we will have in-system programmability with modern SIMMs!

    Unfortunately, we may be limited to 4 MB though. The ROM write address being 0x40400000 (or 0x40C00000, or other repetitions) is a real thing. I wrote a little write cycle test utility and verified it with my oscilloscope. I can only write to the upper 4 MB of the 8 MB of ROM SIMM address space. If I write to 0x40800000, the /WE pin doesn’t go low.

    This means that even though there is 8 MB of space available in the ROM SIMM socket, it’s effectively only 4 MB for in-system programming due to only the top half being writable. With a 4 MB SIMM the top and bottom halves of the 8 MB space would point to the same place, so I think that’s the best bet moving forward.

  7. This is really awesome news! Especially since I was never able to get a SIMM programmer.

    I imagine that this could make custom ROM development quite a bit quicker!

    It’d be awesome if someone developed modern features in classic Macs. Imagine a picker for old SCSI Macs!

  8. Incredible work Doug! Really remarkable! Can’t wait to test all this!

  9. I remember that utility!

    I interned at Apple in the 90s and somewhere in my garage I have a Quadra 700 with a Quadra 950 flash ROM – it allowed my 700 to display higher resolutions that marketing wanted to be a 950-only feature.

    I also worked with the original PowerMac prototypes and their boot sounds included metallica soundbytes .. I remember “Master!! Master!” in particular.

  10. @Miles Thanks! The big concern is if you make a mistake and mess up the hacked ROM so it’s unbootable, it would be impossible to reprogram it without an external programmer. So I still see value in the programmer. Just so you know, CayMac Vintage sells them. I guess another option would be to make a SIMM that has two bootable halves or something, and you only ever program the other half…

    @Joakim Thanks, I’m so excited to see this come together with modern SIMMs!

    @bob Very cool to hear from someone who remembers using this back in the day! Do you have any recollection of the PDS flash cards at all? I’m still super curious about those.

  11. @doug

    No specific recollection of the PDS flash cards other than I think the card in the Q700 (lost in the garage) has one that contains the Q950 image .. I vaguely remember it being reddish or purple colored and pretty sure it has a hand-written word “zydeco” on a sticker on it.

    We had to occasionally re-flash the prototypes as new ROMs were released (on the internal giant AppleShare server called “Etherknott”) .. that’s why I remember the utility.

  12. How about a version for ‘040 chips with one address pin selected by a jumper? Could you boot from one half, then pull the jumper after boot to flash the other half?

  13. Fun, I remember working on Macs back in the days when these were current.

    I don’t remember a lot of the tech details I discovered back then but I do wonder if the ROM image is copied to RAM (like shadow BIOS on a PC)?

    If that’s the case it might be possible to defeat the presence detect on the ROM SIMM during boot, then re-enable it after boot to allow flashing an image to a blank SIMM

  14. @bob Ah, cool! I’d love to see a picture of it if you ever happen to come across it.

    @Stefan Some kind of jumper solution is kind of where my mind has been going too. You could do something with a switch to choose which half of the SIMM you’re booting from as well as which half of the SIMM you’re programming.

    @CJay The ROM doesn’t normally get copied into RAM in Macs from this era, but I think you’re right that you could potentially do something like that. Copy the ROM into RAM, and then reconfigure the MMU so that accesses to the ROM address range go to that chunk of RAM instead. After that is done it would be safe to enable the SIMM since “ROM” accesses are really going to RAM. One drawback is on machines like my 630, I don’t have physical access to the SIMM to flip a switch while the computer is powered on due to how it slides into the chassis…

  15. Back in 2000, I was running Linux on a PowerPC 6100.

    This flash chip should be trivial to add support in Flashrom, considering that Am29F040 is supported:

    https://wiki.flashrom.org/Supported_hardware#Supported_flash_chips

    I usually use those cheap ch341a BIOS flashers to do the job.

  16. @zoobab Yeah, you’d probably need flashrom to know that it’s supposed to do physical writes to 0x40400000 but it seems like it would be pretty straightforward to set up.

    Unfortunately the CH341A flashers wouldn’t work for this style of chip. They work with SPI/I2C chips that only have a few pins. This is a parallel flash with eight data pins and a bunch of address pins. You would need something like a Willem programmer or an XGecu programmer like I have to program them.

  17. […] On Flashing 90s Mac ROMs → […]

  18. Carl’s program talked to a “Flash Gordon” Quadra PDS
    card. There were four generations of boards, and you needed special flash ROM DIMMs

  19. Thanks for the info, Al! When you say special flash ROM DIMMs, do you mean SIMMs like the Lobos board I recreated? (Or maybe indeed DIMMs for the PowerPC Macs?)

    If you don’t mind me asking, what was the purpose of the PDS cards? Were they used for programming an initial image onto ROM SIMMs/DIMMs such as the Lobos SIMM?

  20. I’m surprised you were able to flash a rom on any model motherboard. Most didn’t bring VPP out to the connector.
    The PDS card was what you used to make a development ROM
    and were used up until ROMs in slots were eliminated
    for New Age.
    I think the Q700 was the first time flash was available. Before that you used EPROM emulators like the Grammar Engine. It was no fun.

  21. Thanks for the additional context on the PDS card, Al! If you ever happen upon a picture of what those cards look like I would love to see it. That makes sense that it was used to make a development ROM and is what I had assumed, especially since the right side of the Flasher UI still refers to it as “SIMM Type”. It’s super tempting to try to make a replica PDS card with a SIMM socket for using the right half of the UI in this utility. I’m assuming the hardware logic to forward the read/write cycles on to the flash wouldn’t be super duper difficult. Definitely difficult enough to be a fun learning project for me though. Sounds like 140-pin 040 PDS connector can be painful to find these days though.

    The Q700 being the first to use flash lines up with what I’m seeing in my disassembly of the utility too. As far as I can tell, the entire Quadra series, or at least most of it, brought out VPP and /WE to the ROM SIMM socket. I’ve physically verified it with my multimeter on several of my machines including the 475, 630, 610, and 660av. Pin 2 is 12V, and pin 3 always goes to a pin on the memory controller IC (and is 5V at idle). Someone else physically confirmed it for me on the 700/900/950 and IIvx. I haven’t physically confirmed it on a 575, but I’ve seen a logic board picture that shows a nice thick trace going to pin 2 which is VPP. The Color Classic is weird and seems to have unpopulated circuitry for turning VPP on and off. I think I see the code that controls it in this utility. I can only imagine how much fun (and slow?) EPROM emulators were…

  22. You can buy the PDS connector here 🙂
    https://www.questcomp.com/part/4/p50-140s-rr1-tg/301253758

    I bought 6 not that long ago to use for my FPGA-HDMI card

    I might also already have the footprint for it for kicad, can make one end simm friendly and the other end 040 pds 🙂

  23. And yes, 575 also has 12V on pin 2. I have a machine here also 🙂

  24. Thanks Joakim! I’ve been researching the PDS connectors in my spare time and I think I’m going to start with making a 96-pin LC PDS SIMM programmer card that should work in the 475 (and the 575 and 630 if it fits in the case with the SIMM inserted).

  25. […] be used for adding things like Ethernet, a video card, or an accelerator. If you look at the comments on my last post, you will see some discussion about the PDS cards used by the Flasher app (thanks Al!). It sounds […]

Add your comment now