You are not logged in.

#26 2015-09-06 21:24:12

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I was talking with dougg3 on irc and we've decided the ROM does in fact just jump to this code, so it's not structured in any way, it'll just be executed starting at offset 0.
As best I can tell, this disassembles to:

move.a.w #$4000,a7 ; putting a new value in the stack pointer
movel #$8046fc, (a7+) ; putting something on the stack
pmove (a6), tc ; ??  a6 wasn't setup by this code, and would have been some book keeping stack pointer in the calling code.  Nothing you'd want put into the translation control register
movea.l #$50f26000, a7 ; RBV VIA2 address for vBuf2
moveb #$47, (a7+)
movea.w #9984, a7
movew #8193, d0
movec d0, cacr ; instruction cache and write allocate only
movel #504462720, d7 ; d7 is used in diagnostic mode to keep some flags, so presumably this is just initializing things
movel $7c, d0
movel d0, $bc ; writing a value to a magic place in memory?  This is below even low memory globals.
trap #15 ; equivalent of NMI?
ori.b #0, d0 ; probably bad.  this is just 0x0000, so kinda not trusting anything after that trap
movea.w #$4000, a7
move.l #8388608, (a7+)

Just for kicks, I tried pasting the code into an empty application and running it from a floppyemu disk image, but it just hung the machine, it didn't enter diagnostic mode from a booted system.

That pmove instruction seems pretty weird.  I'm not clear on why it'd be messing with the MMU, and what value it'd be setting, since I can't find anything pointed to by a6 that might be valid for TC.
Because this is kind of strange, and because of the Apple_Drover instead of Apple_Driver partition name, I re-ran the capture just to be sure.  The analyzer verifies parity and has checks internally on the captures, but it uses serial to transfer it off the analyzer, and it's possible errors get introduced there.
In the second capture, everything looks the same except it's actually Apple_Driver instead of Apple_Drover, as it should be.  But even looking at the capture on the analyzer, the code above is what's actually being sent on the bus, so no mistake there.

Offline

#27 2015-09-07 02:56:29

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

Well, I traced through the loading of a SCSI driver in MESS, and as kind of expected, the value of A6 when the SCSI driver is executed is a stack value of $20FE56 (consistently), and the contents of memory there is another memory address from an earlier link instruction.  Since all memory addresses are going to inherently be <$800000000, when that value is put into the TC, it disables translation in the MMU.  Since MacOS only uses the MMU for 24bit/32bit mode, and the 030's native addressing mode if no translation is enabled is 32bit mode, that pmove essentially makes sure we're in 32bit addressing mode prior to NMI'ing into the test manager.
dougg3 pointed out the moves prior to the trap are setting up the NMI exception vector for trap 15, so the trap 15 will essentially be an NMI.
The weird behavior using a7 as a regular register and that pmove is presumably to preserve register contents for when the test manager is entered, and pretty much all the instructions prior to setting the test manager flags in D7 is just getting things in a state for the test manager to be happy when the NMI happens.  That's also why things didn't work when I ran the code inside an application, none of the registers were set to the correct values prior to NMI.

So that pretty much explains it, I think.
I think it's possible to reproduce this by writing those 5 blocks to a SCSI disk (or a microsd card and the SCSI2SD) and then forcing the machine to boot off that disk.

I put the "disk image" (basically just those blocks) here

Offline

#28 2015-09-07 03:41:42

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I ran the analyzer capture while telling the TechStep it is attached to a IIci, and the pseudo-disk it presented was different.  Here is one for the IIci: techstep_iici_disk.dsk

Offline

#29 2015-09-07 04:35:14

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

I wrote the IIci image to an SD card, stuck it into my SCSI2SD, and booted. It correctly did the chimes of death, just as if the programmer's switch is pressed at startup. (The Performa 600 version didn't work, so clearly some of those extra things we were wondering about are not liked by the IIci). It seems that the purpose of this fake disk is to force the computer into the NMI handler, which then does extra checks to decide if it should stay in test mode.

The IIci's handler is basically the same as the earlier handler you did for the Performa 600, except it doesn't do any of the other goofy writes. Basically just set up the cache, stack pointer, and fake an NMI:

move.w  #$2001,d0	; instruction cache and write allocate only
movec   d0,cacr
movea.w #$2700,sp	; set up initial stack pointer?
move.l  #$3020000,d7	; diagnostic mode flags
move.l  ($7C).w,d0	; copy NMI vector table entry to trap 15
move.l  d0,($BC).w
trap    #$F		; do trap 15

Below it, there's additional code that is basically the exact same thing, except it uses the vector base register instead of hardcoded offsets. I don't understand what its purpose is or how it would possibly be executed.

move.w  #$2001,d0
movec   d0,cacr
move.l  #$3020000,d7
movec   vbr,sp
move.l  $7C(sp),d0
move.l  d0,$BC(sp)
movea.w #$2700,sp
trap    #$F

Offline

#30 2015-09-07 05:21:59

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

Oh wow, so I played around some more, and this definitely gives me access to the ability to type commands over the modem port (9600 8N2), just like bbraun describes on the mac68k.info wiki. In fact, if I manually cause a chimes of death error by pressing the programmer's switch early in the boot process, that also allows me to type commands. So basically, it looks like Macs will go into this mode where you can control them over the serial port when they have a fault.

Offline

#31 2015-09-07 15:26:29

jt
Member
From: Bermuda Triangle, NC USA
Registered: 2014-05-21
Posts: 1,465

Re: Stupid Arduino Tricks

I wonder if this would be a precursor to running Macs in OpenFirmware mode? Couldn't remember that term so I searched the only place I remember seeing it. So now I'm feeling the first twinges of coming down with yet another attack of the PEx virus. I haven't seen nor heard from trag for many a moon. Has anyone else heard from him? Methinks his kids are now of an age requiring more and closer attention. Been there, done that, OMFG am I glad (at times) I only had the one rugger!

Methinks this tangent is turning into the Not so stupid TechStep Tricks Thread! wink



edit: I just thought of one really humorous Stupid Arduino Trick  .  .  .  me buying one! roll

Last edited by jt (2015-09-07 15:29:28)

Offline

#32 2015-09-07 16:05:39

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

I've been seeing trag post from time to time on 68kmla, but yeah he's definitely not as active as he used to be.

More stuff I discovered this morning: It works on the Color Classic if I press Command-Power after the mouse pointer appears. Then I type *V and get:

STM Version 2.2, Aaron Ludtke
CTE Version 2.1
ROM Version 7C 24F2
*V

Can't seem to make it work on my 840av though. Cmd-Power puts it into the Sad Mac screen, but I don't hear death chimes and the serial port doesn't seem to be listening for any diagnostic commands. I tried various baud rates because I found out at some point they increased the baud rate on this test stuff to 19200.

BTW, this patent has a lot of info on the operation of the TechStep. There is a lot of funny lawyer-speak, but it actually has quite a few details.

Offline

#33 2015-09-07 20:16:29

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

Sorry for the poor photo quality, but here's the inside of a TechStep ROM cartridge:
25.jpg
Basically it's a PLCC EEPROM, and a X25C02 SPI EEPROM that is 256bytes.  All three cartridges that I opened up are the same layout that way.  PLCC ROM and X25C02.
I pulled the PLCC ROMs of the three carts and read them in a programmer.  I've attached the ROM images to the Links section of the wiki page

Offline

#34 2015-09-08 14:45:20

jt
Member
From: Bermuda Triangle, NC USA
Registered: 2014-05-21
Posts: 1,465

Re: Stupid Arduino Tricks

Cute little cart, how many layers is the PCB?

Why the SPI EEPROM/for what? Lack of I/O pins on the DIP header? Font Cartridges (for signmaking machines) used something like that for mapping arrangements of data on multiple EPROMs (2 or 4 of either size per cart) back when they were only 32k/64k.

Offline

#35 2015-09-08 18:21:25

cc333
Member
From: North S.F. Bay Area, CA
Registered: 2014-05-23
Posts: 599

Re: Stupid Arduino Tricks

This looks like the early beginnings of some sort of TechStep emulation and/or replication!

But, in this day and age where most obvious faults seem to be related to cap rot, what good is a TechStep?

c


Main Macs: Early '09 Mac Pro, Mid '12 MacBook Pro 13"
Secondary Macs: Early '08 Mac Pro, Mid '12 MacBook Pro 15"
Playthings: Mac SE/30, 3.0 GHz Mavericks-based HackServe, Many others....
Desired: Lisa, Kanga PowerBook G3, Apple IIc, Apple II, Spare parts, etc.

Offline

#36 2015-09-08 21:03:28

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

Aw man, you're right.  I've totally been wasting my life!

Nah, but really, it's just an attempt to understand and document this little portion of mac history.  I don't know if it'll end up being a TechStep simulation or not.  As it turns out, it seems like special hardware isn't required to enter the diagnostic mode, but it is still required to run many of the tests.
It's been an interesting little research project.  Who knows if it'll end up being practically useful.  Maybe some of the techniques the TechStep uses can be applied in new and different ways.

Offline

#37 2015-09-09 00:13:30

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

I tend to agree with the "for historical reasons" explanation. To me, it's fascinating to learn that the old Macs through the years really did have a serial console (which wasn't actually meant for end users and only came up when there was a fault, but still...)

As far as the practicality of this info, I could still see it having uses. Personally, I think of the cap rot as more of a catalyst for other problems than a problem of its own. For example, on a lot of the machines I've fixed, the cap goo broke a bunch of connections on nearby chips. Just recapping didn't totally fix it. Sometimes vias lose connectivity, traces break, and stuff like that. It seems like some of these TechStep-related tests could conceivably tell you more information about what part of the board to be looking at, if you can at least get the system to start booting. This could be very useful, especially on some of the later machines that have such tiny traces and vias. Maybe that angle of this project is a pipe dream, but either way, it's still interesting!

Offline

#38 2015-09-09 02:21:27

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

So I've been playing around more with the 840av and disassembling its ROM's test manager code to figure out why I can't talk to it. I just can't seem to get communication with it to work at all. I made a quick Mac OS program that does the same reads and writes to the SCC that the 840av's ROM does when it sets up the test manager for serial communication. My program can correctly send and receive bytes at 19200 baud, 8N2. So I'm pretty sure that's the expected baud rate. However, if I send the 840av to a Sad Mac screen at startup, it doesn't listen to any of the bytes I send to it. It's like it's not reaching the test manager at all. I dunno...

Offline

#39 2015-09-09 03:02:21

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

Sorry to flood this thread, but one more data point: Gave up on the Quadra 840av for a while. The command + power key trick at startup works on the Mac TV, and *V prints out:

STM Version 2.2, Aaron Ludtke
CTE Version 2.1
ROM Version 7C 28F1
*V

Offline

#40 2015-09-09 04:56:28

uniserver
Member
From: Sf, Mi
Registered: 2014-05-15
Posts: 956
Website

Re: Stupid Arduino Tricks

awesome as soon as you get a TechStep emu ill be the first to buy it.
as i need one.


#I Re-Cap √Mac √NeTX √Amiga Boards - A/B - PSU# (MacCaps.com)  Modern SCSI HD's - For Old Macs - Pre Cfg'd - 10k RPM! 73gb!! $50 + free shipping  -- Mac 128K Re-Ram kits (16 Chips) $35 + shipping, Floppy Issues?-> Bourns Filter Solution 128k - SE/30, $16 + shipping

Offline

#41 2015-09-10 01:50:53

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

Last night I got some help on IRC from bbraun and jjuran, who helped me figure out how to step through the 840av's ROM to figure out what was failing. The problem is that the 840av has its MMU turned on by the time I can force it into the test manager, and the way they set up the MMU, it doesn't allow access to a register available on most Macs that identifies which Mac it is. The test manager reads that register (a whole bunch of times) to figure out what to do, so when it fails to read that register because the MMU is preventing it, it crashes and burns. So I painstakingly stepped through the ROM test code with MacsBug, skipping any accesses to that register and replacing them with the correct result that would have been read if the register had been available. This allowed me to get into the test manager, and allowed me to confirm it talks at 19200 baud, 8N2 as I had suspected.

Then today, I wrote a quick Mac program that disables the MMU and jumps into the Sad Mac error handler. The code I came up with is similar to what bbraun posted earlier that the TechStep does on the Performa 600, except changed to work for the 68040. It disables the caches and turns off the MMU. After doing that, I am now inside of the Test Manager on the Quadra 840av:

STM Version 2.2, Aaron Ludtke
CTE Version 2.1
ROM Version 7D 10F3
*V

I suspect if a TechStep cartridge had ever been made for the 840av, it would have had code similar to what I wrote to turn off the MMU. Anyway, yay. Sounds like pretty much any 68k Mac should be able to go into this mode.

Edit: The 660av is the same way, just tested it. You have to disable the MMU first.

Last edited by dougg3 (2015-09-10 02:05:00)

Offline

#42 2015-09-10 02:06:22

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

Nice!  Seems like you can't enter test manager from NMI on the AVs though.
What could be neat is creating some custom boot blocks for a floppy that does this.

Offline

#43 2015-09-10 03:26:19

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I'm able to enter test mode by hitting the NMI on the Performa 600 right during the boot chimes.
I was hitting it continuously after power on, but it didn't seem to do anything until the boot chimes.  Once there, test mode was available on the serial port at 9600 8n2.  It didn't print anything to the serial port to let you know it was there, but a *V would give the version message.

Offline

#44 2015-09-10 04:27:03

dougg3
Member
Registered: 2014-05-27
Posts: 28

Re: Stupid Arduino Tricks

Excellent! I can confirm it works on a PowerBook Duo 210 too, 9600 8N2. I agree, it would be wicked cool to create a floppy image that enters this mode on all Macs.

Offline

#45 2015-09-11 02:55:32

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I've been working on the floppy image a bit.  The source I've been using is at: bootdisk.s.  I'm using the as68 assembler, which doesn't support some of the cache and mmu registers so those have the assembled instruction as data inline.  I just assemble with "as68 bootdisk.s", it produces a bootdisk.bin file, and I've just been splatting that on top of a blank disk image.

The first $90 bytes of the code is for the ROM to recognize the disk as a valid boot disk.  Most of it is pretty straightforward, but the keys here are really the bbEntry field, which the ROM will jump to if the boot blocks say they have code in them.  MacOS doesn't typically execute code in the boot blocks, instead it will look in the System file and load boot resources.  The bbVersion I've set makes the ROM execute the boot code.

The code tries to determine which CPU you're on to figure out how to disable the MMU, however I've also found that some of the earlier 030s don't like having their MMU disabled.  It looks to me like the IIci and IIsi are using the MMU to map the RAM banks into a contiguous block.  In any case, those machines need the MMU left on, but some of the later 030 machines need the MMU disabled.  It looks like all 040's are happy with the MMU disabled.  So this code tries to figure out which machine it's on, and then conditionally disable the MMU.

So far I haven't done much testing on real hardware, instead I've been using MESS.  So far so good...

An assembled disk image is here: bootdisk.zip

Offline

#46 2015-09-11 15:18:04

jt
Member
From: Bermuda Triangle, NC USA
Registered: 2014-05-21
Posts: 1,465

Re: Stupid Arduino Tricks

This TechStep Revival tangent really needs to be moved to its own thread, it's AbFab. cool

Offline

#47 2015-09-11 17:35:26

cc333
Member
From: North S.F. Bay Area, CA
Registered: 2014-05-23
Posts: 599

Re: Stupid Arduino Tricks

Indeed!

c


Main Macs: Early '09 Mac Pro, Mid '12 MacBook Pro 13"
Secondary Macs: Early '08 Mac Pro, Mid '12 MacBook Pro 15"
Playthings: Mac SE/30, 3.0 GHz Mavericks-based HackServe, Many others....
Desired: Lisa, Kanga PowerBook G3, Apple IIc, Apple II, Spare parts, etc.

Offline

#48 2015-09-11 18:32:57

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I blatted the boot blocks onto an 800k image, put the image on a floppyemu, and then used Disk Copy to copy the image from the floppyemu onto a physical floppy disk.  I then tested the floppydisk successfully on an 800k SE, SE/30, and a 660av.  All of them entered diagnostic mode.
The SE and SE/30 didn't respond to the *V command, but they did respond to *A (ascii mode), *R (to print out registers D6 and part of D7), and *5 (to print out the *APPLE* message).
The 660av fired up at 19200 8n2 and worked great.

One addition I'd like to make to the image is ejecting the floppy before trapping to the test manager.  Right now, the floppy remains in the disk drive, and the only way to exit everything is powering off the machine, which leaves the disk in the drive and you've got to poke it with a paper clip to get the disk out.  Not a huge deal, but it would be nice I think.

Offline

#49 2015-09-12 03:04:42

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

Tested working on a Quadra 700 too.

Here's the 800k version.  It's the same as the other one, just in 800k.  This also has an HFS filesystem on the disk, since all that's required for booting into test mode is the first 512 byte boot block.  Reformatting the disk will lose the boot block, but it shouldn't hurt to put stuff on it.

Offline

#50 2015-09-17 03:14:22

bbraun
Member
Registered: 2014-05-29
Posts: 1,064
Website

Re: Stupid Arduino Tricks

I was kind of wondering what the next steps of this project should be.
dougg3 and I were talking on irc about the merits of doing an embedded techstep-alike vs. just using the floppy disk image and a PC program that drives the tests.

The benefits of the techstep-alike would be:

  • Voltage level measurement

  • ADB soft power testing

  • Enter the diagnostic mode via ADB

  • not needing additional serial ports (or USB/serial adapters) for testing both serial ports

  • SCSI tests

The SCSI tests are tricky though, since the techstep-alike would need to implement SCSI, and probably wouldn't be available in at least the 1st iteration of such an attempt.

So, the question becomes, is that worthwhile to try to implement?  Or just focus on a PC program to do the basic tests, and not worry about those other things?  Or maybe a hybrid approach, and just do a PC program, and just have a little dongle that can do the ADB stuff if necessary.

Offline

Board footer

About ThinkClassic

ThinkClassic specialises in the use, maintenance, repair, restoration and modification of vintage computers and peripherals.