| Click here to select a new forum. |
| How to: upgrade a 520/540 to a 550c ROM |
Posted by: croissantking on 2026-07-05 10:52:27
So the full range 0x40000000 to 0x403FFFFF might already be addressable. I could probably mock together a 4MB ROM file for you that has an embedded ROM disk driver in the first 2MB, and the ROM disk in the second 2MB. I won't really have a way to test it, but you could try burning it on your prototype whenever you get around to it. Want to give this a try? I didn't see this part of your message β yes, sure go ahead! Although it's a bit fiddly, I dont mind soldering + desoldering a few times to get this right.
I'm still keen to understand why I'm not able to dump past the 2mb limit on my own machine... |
Posted by: frontein1 on 2026-07-05 11:01:17
Oh, wow... I was shortly going to post that I couldn't get my PowerBook to read past the 2MB boundary!
I see that on yours, 40200000 is displaying the same contents as 40000000 ... not sure what that means in practice but it seems to be looping back to the first 0-2MB in the 2-4MB part of the map. Very interesting difference. Yes on mine, the ROM is essentially being aliased over again from 40200000 to 403FFFFF. But not on your machine. (Although to be fair I am not totally convinced if this is true aliasing or if this space is addressable. A good test would be that custom 4MB ROM and then dumping 0x40200000 to make sure that is different from 0x40000000.)
It might be interesting for you to issue this in the debugger: DM 40080870. What does that look like? Here is the one from my 540c (Just to rule out MacsBug I switched back to MicroBug and was still able to dump out the second 2MB area):
|
Posted by: croissantking on 2026-07-05 11:26:58 I am very confused, Mr Frontein1!
I tried DM 40080870 and it spat out the same data as on yours, but DM 40200000 still told me it couldn't access that address.
So I pulled out another 540c (different machine) and it displays the aliased ROM at 40200000, just like yours.
Then I removed the CPU card from the first machine which has a 550c ROM, and installed another with the 520/540 ROM. It displayed the aliased data just like yours.
Then I put back the card with 550c ROM and now it is showing the actual contents of the ROM past the 2MB mark!
|
Posted by: demik on 2026-07-05 12:40:11 What are you guys CPU board revisions ? AFAIK we still don't know the differences, might be one of them |
Posted by: croissantking on 2026-07-05 12:42:10
What are you guys CPU board revisions ? AFAIK we still don't know the differences, might be one of them The main machine I'm using for testing is an 820-0456-B, the very first one. |
Posted by: croissantking on 2026-07-05 14:10:35 Just sharing the ROM chip pin assignments that I've mapped out in case it's useful.
@frontein1 what's the maximum size ROM that could be addressed with the address lines available?
Interesting how the data lines are interleaved.
| ROM Low (U706) | | ROM High (U708) | |
|---|
| Pin | Assignment | Pin | Assignment |
|---|
| 1 | N.C. | 1 | N.C. | | 2 | A20 | 2 | A20 | | 3 | A19 | 3 | A19 | | 4 | A9 | 4 | A9 | | 5 | A8 | 5 | A8 | | 6 | A7 | 6 | A7 | | 7 | A6 | 7 | A6 | | 8 | A5 | 8 | A5 | | 9 | A4 | 9 | A4 | | 10 | A3 | 10 | A3 | | 11 | A2 | 11 | A2 | | 12 | CE | 12 | CE | | 13 | GND | 13 | GND | | 14 | OE | 14 | OE | | 15 | D0 | 15 | D16 | | 16 | D8 | 16 | D24 | | 17 | D1 | 17 | D17 | | 18 | D9 | 18 | D25 | | 19 | D2 | 19 | D18 | | 20 | D10 | 20 | D26 | | 21 | D3 | 21 | D19 | | 22 | D11 | 22 | D27 | | 23 | VCC | 23 | VCC | | 24 | D4 | 24 | D20 | | 25 | D12 | 25 | D28 | | 26 | D5 | 26 | D21 | | 27 | D13 | 27 | D29 | | 28 | D6 | 28 | D22 | | 29 | D14 | 29 | D30 | | 30 | D7 | 30 | D23 | | 31 | D15 | 31 | D31 | | 32 | GND | 32 | GND | | 33 | VCC | 33 | VCC | | 34 | A18 | 34 | A18 | | 35 | A17 | 35 | A17 | | 36 | A16 | 36 | A16 | | 37 | A15 | 37 | A15 | | 38 | A14 | 38 | A14 | | 39 | A13 | 39 | A13 | | 40 | A12 | 40 | A12 | | 41 | A11 | 41 | A11 | | 42 | A10 | 42 | A10 | | 43 | A21 | 43 | A21 | | 44 | N.C. | 44 | N.C. |
|
Posted by: frontein1 on 2026-07-05 16:34:57 Great info! I was trying to find a pinout but couldn't. You may have put together the best resource for this π
With 20 address lines being exposed (A2-A21), that works out to be: (2^20 longs) * (4 bytes / long) = 4MB
And the fact that your most recent DM shows all 0xFF starting at 0x40200000 is very promising. I am guessing when you burned these chips, your programmer may have just kept everything at and above that address as 0xFF.
So I guess that does beg the question, why did weren't you able to DM 0x40200000 on the 550c ROM initially? You pulled the daughtercard and put a new one in with the 540c ROM, then when you swapped back to the 550c you were able to do it. Does your machine have a working PRAM battery? It would be interesting if you could recreate the problem somehow. I'll see if I can tweak with my 540c to have that same issue.
But nevertheless, I think we should give a 4MB ROM a test run. It might be a few days, but I'll spin it up and send it over to you. |
Posted by: croissantking on 2026-07-05 18:06:00
Great info! I was trying to find a pinout but couldn't. You may have put together the best resource for this π There's lots more to come.
With 20 address lines being exposed (A2-A21), that works out to be: (2^20 longs) * (4 bytes / long) = 4MB Perfect.
And the fact that your most recent DM shows all 0xFF starting at 0x40200000 is very promising. I am guessing when you burned these chips, your programmer may have just kept everything at and above that address as 0xFF. Yes, that's correct, the second half of my burned ROMs were all 0xFF.
I dumped the contents of one of the 2MiB 520/540 Mask ROM chips just now and the code repeats starting at 0x00100000; it's not blank like on my programmed chips. That is presumably why we're seeing the same code 'aliased' starting from 0x40200000 with the stock ROM.
So I guess that does beg the question, why did weren't you able to DM 0x40200000 on the 550c ROM initially? You pulled the daughtercard and put a new one in with the 540c ROM, then when you swapped back to the 550c you were able to do it. Does your machine have a working PRAM battery? It would be interesting if you could recreate the problem somehow. I'll see if I can tweak with my 540c to have that same issue. It seems to be related to RAM Doubler - with it enabled, I can't access 0x40200000 and above. I had turned it off during testing earlier and that's when things started to work. I wonder why that would happen though.
But nevertheless, I think we should give a 4MB ROM a test run. It might be a few days, but I'll spin it up and send it over to you. Yes, for sure, I think it's clearer now that the full 4MB is addressable. If it works, it'll be the first time the ROM Disk concept will be have been seen in a portable. And 2 megs of space isn't bad at all, especially with FC8 compression.
Exciting! |
Posted by: frontein1 on 2026-07-05 20:01:59
Exciting! I agree! Ever since Mission Impossible, where Luther used a PB 540c (I think that was the model) to block cell phone communication, I always wanted one. Of course back then as a kid, they were far too expensive. So it is fun tinkering on them after all these years.
Working on patching the ROM right now. The 550c looks pretty straightforward. Here is what I have done so far. Next inserting the ROM disk driver, looks like I'll probably use offset 60080. Plenty of room to patch that resource into a driver.
offset: 1278
Resource Name (driver) to open at startup
This routine always tries to open the named driver resource
This will open the .ROMDISK driver
before:
082E6E6574424F4F54
after:
082E524F4D4449534B
offset: 1706
Treat .ROMDISK driver as a floppy so it will load before any SCSI device
The .ROMDISK driver is setup as Resource ID 54 & Reference Number -55 (FFC9)
before:
4E750000000000000000
after:
67060C6AFFC900084E75
offset: 47C64
Ignore ROM checksum mismatches (errors)
before:
6704
after:
6004 |
Posted by: frontein1 on 2026-07-05 20:05:43
I dumped the contents of one of the 2MiB 520/540 Mask ROM chips just now and the code repeats starting at 0x00100000; it's not blank like on my programmed chips. That is presumably why we're seeing the same code 'aliased' starting from 0x40200000 with the stock ROM. Agree, it looks like Apple just manually aliased the ROM but still made it fully addressable with the right number of address lines. |
Posted by: frontein1 on 2026-07-06 21:16:57
And 2 megs of space isn't bad at all, especially with FC8 compression. OK sharing here for all to see, inspect, and pull apart. This has the 550c ROM in the first 2MB with the edits above, and the driver embedded at offset 60080. Starting at the 2MB mark is the ROM disk. This is a bit of a hack. I found a System 7.5.0 boot floppy image, and decided to use that. The disk has a SCSI driver installed, which takes up unnecessary space for a ROM disk. But I added it as I wanted to test booting via BlueSCSI on my PB540c. (Booted without issue FYI)
We will build a better ROM disk with FC8 once we know that this is working OK. Didn't want to add FC8 right out of the gate. Also this is what I call driver v1.0. It uses some Toolbox routines to paint the splash screen. So hopefully those work OK during the early boot process.
@croissantking I hate for you to have to go through all the work of desoldering, burning, and resoldering if this is a bust. Fingers crossed, but in my experience things tend not to work the first time around π |
Posted by: croissantking on 2026-07-07 02:07:01
OK sharing here for all to see, inspect, and pull apart. This has the 550c ROM in the first 2MB with the edits above, and the driver embedded at offset 60080. Starting at the 2MB mark is the ROM disk. This is a bit of a hack. I found a System 7.5.0 boot floppy image, and decided to use that. The disk has a SCSI driver installed, which takes up unnecessary space for a ROM disk. But I added it as I wanted to test booting via BlueSCSI on my PB540c. (Booted without issue FYI)
We will build a better ROM disk with FC8 once we know that this is working OK. Didn't want to add FC8 right out of the gate. Also this is what I call driver v1.0. It uses some Toolbox routines to paint the splash screen. So hopefully those work OK during the early boot process.
@croissantking I hate for you to have to go through all the work of desoldering, burning, and resoldering if this is a bust. Fingers crossed, but in my experience things tend not to work the first time around π
Ok - great!
Thanks for sharing all the steps youβve taken, itβs super informative.
Iβll try this out today or tomorrow and report back. |
Posted by: croissantking on 2026-07-07 07:35:14 @frontein1
Here's how I split your ROM image into high and low parts using srecord in Terminal:
srec_cat MOD+DISK.ROM -binary -byte-swap 2 -split 4 0 2 -o MOD+DISK-High.bin -binary
srec_cat MOD+DISK.ROM -binary -byte-swap 2 -split 4 2 2 -o MOD+DISK-Low.bin -binary
So with this ROM I get a normal chime, and then chimes of death after the RAM test. Video is (partially?) initialized, just a grey screen with square corners and no cursor.
I can plug in via serial and see what error code it's outputting if that's of any help. |
Posted by: frontein1 on 2026-07-07 13:59:41 Well darn. I had a very similar issue on my LCIII when I was customizing that ROM. So in the driver I had to disable the splash screen then it booted OK.
Let me do some tinkering with this, and maybe we can give it another go around here soon. |
Posted by: croissantking on 2026-07-10 19:46:08
Well darn. I had a very similar issue on my LCIII when I was customizing that ROM. So in the driver I had to disable the splash screen then it booted OK.
Let me do some tinkering with this, and maybe we can give it another go around here soon.
Ready for your next update! |
Posted by: frontein1 on 2026-07-11 18:05:55
Ready for your next update! OK here are two to try out. I reverted to an earlier version of the driver at offset 60080 that does not have a splash screen. Here is the difference between the two files:
- 1_550c_MOD.ROM = Offset 1278 does not automatically open the ROMDISK driver.
- 1_550c_MOD.ROM = Offset 1706 does not treat the ROMDISK like a floppy.
So in essence, 1_550c_MOD.ROM might be a bit 'safer' to test with first since the driver won't automatically load at startup. I can write up a small program that opens the driver if you can boot this into the Mac OS.
0_550c_MOD.ROM will automatically try to open the driver at boot. You can try R or RA to get to boot to the ROM disk.
Fingers crossed for round 2! |
Posted by: croissantking on 2026-07-11 19:55:51
OK here are two to try out. I reverted to an earlier version of the driver at offset 60080 that does not have a splash screen. Here is the difference between the two files:
- 1_550c_MOD.ROM = Offset 1278 does not automatically open the ROMDISK driver.
- 1_550c_MOD.ROM = Offset 1706 does not treat the ROMDISK like a floppy.
So in essence, 1_550c_MOD.ROM might be a bit 'safer' to test with first since the driver won't automatically load at startup. I can write up a small program that opens the driver if you can boot this into the Mac OS.
0_550c_MOD.ROM will automatically try to open the driver at boot. You can try R or RA to get to boot to the ROM disk.
Fingers crossed for round 2!
I tried 0_550c_MOD.ROM, it works, but nothing happens when I press R or RA before the happy Mac appears - it just boots off the hard disk (if there is one) or displays a flashing '?'.
Does that mean the ROMDISK driver is not opening automatically, or maybe its not accepting the keyboard input?
Shall we try that program to open the driver and see if the ROM disk is accessible? |
Posted by: frontein1 on 2026-07-11 20:49:57 That's good news that it booted. Checksum patch worked. Do a DM 40200000. Does that show the start of the ROM disk? This disk starts with a SCSI driver that is really not needed at all.

Also run these two programs from Rob Braun. These are handy little programs to see what drivers are loaded, and which of those have assigned drive numbers. This way we can see if the ROMDISK driver was able to open. |
Posted by: croissantking on 2026-07-12 15:11:22
That's good news that it booted. Checksum patch worked. Do a DM 40200000. Does that show the start of the ROM disk? This disk starts with a SCSI driver that is really not needed at all.
View attachment 101237
Also run these two programs from Rob Braun. These are handy little programs to see what drivers are loaded, and which of those have assigned drive numbers. This way we can see if the ROMDISK driver was able to open.
See my attached photos - the start of ROM disk code is visible in the memory dump. Your ROMDISK driver is also listed in bbraun's utility as well as Tattletech. So we are getting somewhere.
I hesitate to tell you β lest I put you off the project β but you seem to have introduced a bug in the ROM code. I didn't notice it at first as I'm using a loose motherboard with external video to test. But when an internal LCD is used, the backlight switches off during the boot process (at the beginning of extension load) and then can't be enabled again. This does not happen with the stock 550c ROM. |
Posted by: croissantking on 2026-07-12 16:55:10 I did a little investigation, and it looks like the backlight driver is not loaded when booting the custom ROM.
I'm not sure if I understand the way the slots are assigned, but could assigning .ROMDISK to a different slot number (maybe something between 57 and 93) help here?
|
| < 2 > |