68kMLA Classic Interface

This is a version of the 68kMLA forums for viewing on your favorite old mac. Visitors on modern platforms may prefer the main site.

Click here to select a new forum.
Running the Thunder II 1360 at 1600x1200
Posted by: jmacz on 2024-07-24 02:05:20
The data block at $000003d6 through $0000043a are the sResource IDs (in this ROM running from 128 to 251). The data block is terminated with a null byte. The code segment at $0000039e loops through all of them (until it sees the null byte) calling SlotManager routine $0031 (SDeleteSRTRec) on all of them that do not match the value held in the SPRAM under vendorUse4 (byte at offset 5 in the SPRAM).
Posted by: MacOSMonkey on 2024-07-24 12:26:25
When you see an instruction like bfexts (bit-field extract with sign extension), it is probably interpreting a chip or board register. It extracts a bit value, sign extends it and then the code can do something with the resulting long value. It is simpler than multiple moves, btst, branches, ands, etc. Take your pick. It's 2 instructions to read and store each bit with no conditional logic.

Looking at the '020 data book:

Instruction Format:
BFEXTS (bit field) of Source -> Dn BFEXTS (ea){offset:width},Dn

Your Source Opcodes:
  • ebc3 07c1
  • ebc3 0781
  • ebc3 0741
  • ebc3 0701
  • ebc3 06c1
Primary Word:
$ebc3
b1110 1 011 11 000 011

1110 (shift/rotate/bitfield)
1
011 (BFEXTS)
11
Effective Address:
000 (Mode - Dn addressing mode, register contains Dn)
011 (Register - D3)

Base Instruction: bfexts d3

Extension Word:
$07c1
b0 000 0 11111 0 00001

0
000 (Register - D0)
0 (Do - Offset is immediate and specified in the offset field)
11111 (Offset: $1f = 31)
0 (Dw - Width is immediate and specified in the width field)
00001 (Width: 1)

Completed Instruction: bfexts d3{31:1},d0

Looking at the rest, they are all bfexts d3 and the width of all of them is 1. They all have a destination operand register of d0. So, it's iterative.

$ebc3 $0781 (b0000 0 11110 0 00001)
bfexts d3{30:1),d0

$ebc3 $0741 (b0000 0 11101 0 00001)
bfexts d3{29:1),d0

$ebc3 $0701 (b0000 0 11100 0 00001)
bfexts d3{28:1},d0

$ebc3 $06c1 (b0000 0 11011 0 00001)
bfexts(d3){27:1},d0

This code is valid (not static data) and cycling through all the bits in a data register (probably read from the board somewhere -- haven't looked at your disassembly yet). As above, it efficiently extracts all the bit values at descending bit offsets as longword flags.

I hope this helps. Wow - you made me look at a 68K data book. 😛 😀

ps. The Motorola (now NXP) user guides tend to have stuff all over the place and it can be confusing to try to understand -- especially for longer instructions. When you're looking at the instruction decoding -- the top row of the bit layout (16-bit format) is the primary word and the additional rows are extension words. If there's no extension word, then the format usually only has 1 row. But, you also have to look at all the flags and their special interpretations -- like whether or not the width is immediate or in a data register.

One other thing -- the advantage of using longword flags is that, if you're writing to a hardware register, it doesn't matter which bit happens to be the valid one, since they are all set/valid.
Posted by: jmacz on 2024-07-24 16:49:28
Ok I think I have done as much as I can without a live card. I am traveling and thus all I have is the ROM dumps. Will continue once I am back. Would love to get 1280 working at 1:1 pixels on my display. 1600x1200 would be icing on the cake and alleviate the need for me to run two monitors/cards.
Posted by: jmacz on 2024-07-25 03:51:09
Updated code/data map:

00000000,00000148,code
00000148,00000158,data
00000158,000003d6,code
000003d6,0000043a,data
0000043a,00000558,code
00000558,00000596,data
00000596,000006b6,code
Posted by: jmacz on 2024-07-25 07:24:22
Disassembled PrimaryINIT from Thunder II 1360 ROM v3.0.0. Named some functions based on what it looked like it was doing. Added some comments to where it's referencing memory in the slot address space. Left calling function info in each function's comments. Noted functions that seem to be empty as well as functions that aren't referenced from the code. Data segments that were between the code blocks included.

(split into two posts due to character limit)

;;
;; PrimaryINIT - Thunder II 1360 ROM v3.0.0
;;
;; Inputs:
;;   a0 = seBlock
;;
;; Key Data:
;;   -56(a6): spBlock
;;   -64(a6): sPRAMRec
;;   -68(a6): 4 bytes
;;
;; Map:
;;   00000000,00000148,code
;;   00000148,00000158,data
;;   00000158,000003d6,code
;;   000003d6,0000043a,data
;;   0000043a,00000558,code
;;   00000558,00000596,data
;;   00000596,000006b6,code
;;

00000000 : 48e7 fffe           MOVEM.L  D0-D7,A0-A6,-(A7)
00000004 : 4e56 ffbc           LINK     A6,#-68
00000008 : 2648                MOVEA.L  A0,A3                       ; a3 = seBlock
0000000a : 317c 0001 0002      MOVE.W   #$0001,+2(A0)
00000010 : 7800                MOVEQ    #$00,D4
00000012 : 1810                MOVE.B   (A0),D4
00000014 : e89c                ROL.L    #4,D4
00000016 : 2444                MOVEA.L  D4,A2                       ; a2 = slot base address
00000018 : 6100 00ae           BSR      $000000c8                   ; branch to Load_PRAM_and_Check_Slot_Manager
0000001c : 3038 0b22           MOVE.W   $00000b22,D0
00000020 : 0240 0200           ANDI.W   #$0200,D0
00000024 : 6706                BEQ      $0000002c
00000026 : 002e 0060 ffc7      ORI.B    #$60,-57(A6)
0000002c : 7001                MOVEQ    #$01,D0
0000002e : a05d                _SwapMMUMode
00000030 : 2d40 ffbc           MOVE.L   D0,-68(A6)
00000034 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = slot base address + $0c000000
0000003a : 257c 0000 8009 005c MOVE.L   #$00008009,+92(A2)
00000042 : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
00000048 : 6100 00ea           BSR      $00000134                   ; branch to Delay_13
0000004c : d5fc 0010 0000      ADDA.L   #$00100000,A2               ; a2 = slot base address + $00100000
00000052 : 257c 0000 8010 005c MOVE.L   #$00008010,+92(A2)
0000005a : 6100 00e8           BSR      $00000144                   ; branch to Delay_00
0000005e : 257c 0000 e0c0 0068 MOVE.L   #$0000e0c0,+104(A2)
00000066 : 95fc 0010 0000      SUBA.L   #$00100000,A2
0000006c : 002e 0004 ffc7      ORI.B    #$04,-57(A6)
00000072 : 6100 00e4           BSR      $00000158                   ; branch to Check_SPRAM
00000076 : 6100 0496           BSR      $0000050e                   ; branch to Function_9
0000007a : 284a                MOVEA.L  A2,A4
0000007c : d9fc 0020 0000      ADDA.L   #$00200000,A4               ; a4 = slot base address + $00200000
00000082 : 6100 03b6           BSR      $0000043a                   ; branch to Empty_Function_1
00000086 : 6100 02cc           BSR      $00000354                   ; branch to Setup_Video_Default
0000008a : 6100 0086           BSR      $00000112                   ; branch to Save_PRAM
0000008e : 6100 0234           BSR      $000002c4                   ; branch to Function_3
00000092 : 6100 01fc           BSR      $00000290                   ; branch to Function_2
00000096 : 6100 009c           BSR      $00000134                   ; branch to Delay_13
0000009a : 6100 0172           BSR      $0000020e                   ; branch to Function_1
0000009e : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = slot base address + $0c000000
000000a4 : 6100 03fe           BSR      $000004a4                   ; branch to Empty_Function_2
000000a8 : 00aa 0000 0800 0060 ORI.L    #$00000800,+96(A2)
000000b0 : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
000000b6 : 6100 0078           BSR      $00000130                   ; branch to Delay_64
000000ba : 202e ffbc           MOVE.L   -68(A6),D0
000000be : a05d                _SwapMMUMode
000000c0 : 4e5e                UNLK     A6
000000c2 : 4cdf 7fff           MOVEM.L  (A7)+,D0-D7,A0-A6
000000c6 : 4e75                RTS

;;
;; Load PRAM and check if board ID is $0523.
;; Check Slot Manager version.
;; Called from: PrimaryINIT
;;

Load_PRAM_and_Check_Slot_Manager:
000000c8 : 41ee ffc8           LEA      -56(A6),A0                  ; a0 = address of spBlock
000000cc : 1153 0031           MOVE.B   (A3),+49(A0)
000000d0 : 43ee ffc0           LEA      -64(A6),A1                  ; a1 = address of sPRAMRec
000000d4 : 2089                MOVE.L   A1,(A0)
000000d6 : 7011                MOVEQ    #$11,D0
000000d8 : a06e                _SlotManager                         ; SReadPRAMRec
000000da : 4a40                TST      D0
000000dc : 660c                BNE      $000000ea
000000de : 302e ffc0           MOVE.W   -64(A6),D0
000000e2 : 0c6e 0523 ffc0      CMPI.W   #$0523,-64(A6)
000000e8 : 6704                BEQ      $000000ee
000000ea : 422e ffc3           CLR.B    -61(A6)
000000ee : 022e 0003 ffc7      ANDI.B   #$03,-57(A6)
000000f4 : 4228 0033           CLR.B    +51(A0)
000000f8 : 7008                MOVEQ    #$08,D0
000000fa : a06e                _SlotManager                         ; SVersion
000000fc : 0c90 0000 0002      CMPI.L   #$00000002,(A0)
00000102 : 6606                BNE      $0000010a
00000104 : 002e 0020 ffc7      ORI.B    #$20,-57(A6)
0000010a : 002e 0010 ffc7      ORI.B    #$10,-57(A6)
00000110 : 4e75                RTS

;;
;; Save SPRAM record.
;; Called from: PrimaryINIT
;;

Save_PRAM:
00000112 : 48e7 c0c0           MOVEM.L  D0,D1,A0,A1,-(A7)
00000116 : 41ee ffc8           LEA      -56(A6),A0                  ; a0 = address of spBlock
0000011a : 1153 0031           MOVE.B   (A3),+49(A0)
0000011e : 43ee ffc0           LEA      -64(A6),A1                  ; a1 = address of sPRAMRec
00000122 : 2149 0004           MOVE.L   A1,+4(A0)
00000126 : 7012                MOVEQ    #$12,D0
00000128 : a06e                _SlotManager                         ; SPutPRAMRec
0000012a : 4cdf 0303           MOVEM.L  (A7)+,D0,D1,A0,A1
0000012e : 4e75                RTS

;;
;; Looks like a delay function.
;; Called from: various.
;;

Delay_64:
00000130 : 7264                MOVEQ    #$64,D1
00000132 : 6002                BRA      $00000136

Delay_13:
00000134 : 7213                MOVEQ    #$13,D1

00000136 : 3038 0d00           MOVE.W   $00000d00,D0
0000013a : 51c8 fffe           DBF      D0,$0000013a
0000013e : 51c9 fff6           DBF      D1,$00000136
00000142 : 4e75                RTS

Delay_00:
00000144 : 7200                MOVEQ    #$00,D1
00000146 : 60ee                BRA      $00000136

;;
;; Data Table 1
;;

00000148 : 0f 07 05 11 00 07 06 00   ........

;;
;; Data Table 2
;;

00000150 : 80 80 80 80 00 80 80 00   ........

;;
;; Validate SPRAM Record.
;; Called from: PrimaryINIT
;;

Check_SPRAM:
00000158 : 0c6e 0523 ffc0      CMPI.W   #$0523,-64(A6)
0000015e : 660e                BNE      $0000016e
00000160 : 4a2e ffc5           TST      -59(A6)
00000164 : 6708                BEQ      $0000016e
00000166 : 4a2e ffc3           TST      -61(A6)
0000016a : 6600 006c           BNE      $000001d8
0000016e : 022e 007f ffc6      ANDI.B   #$7F,-58(A6)
00000174 : 3d7c 0523 ffc0      MOVE.W   #$0523,-64(A6)
0000017a : d5fc 0d0e 0000      ADDA.L   #$0d0e0000,A2               ; a2 = slot base address + $0d0e0000
00000180 : 4292                CLR.L    (A2)
00000182 : 2012                MOVE.L   (A2),D0
00000184 : 95fc 0d0e 0000      SUBA.L   #$0d0e0000,A2
0000018a : 0240 0007           ANDI.W   #$0007,D0
0000018e : 123b 00b8           MOVE.B   -72(PC,D0.W),D1             ; Accessing data table 1
00000192 : 1d41 ffc3           MOVE.B   D1,-61(A6)
00000196 : 0601 0080           ADDI.B   #$80,D1
0000019a : 1d41 ffc5           MOVE.B   D1,-59(A6)
0000019e : 123b 00b0           MOVE.B   -80(PC,D0.W),D1             ; Accessing data table 2
000001a2 : 832e ffc6           OR.B     D1,-58(A6)
000001a6 : 122e ffc6           MOVE.B   -58(A6),D1
000001aa : 0201 0080           ANDI.B   #$80,D1
000001ae : 6628                BNE      $000001d8
000001b0 : 303c aa57           MOVE.W   #$aa57,D0
000001b4 : a746                _trap                                ; GetOSTrapAddress for $aa57 (docking dispatch ??)
000001b6 : 2208                MOVE.L   A0,D1
000001b8 : 303c a89f           MOVE.W   #$a89f,D0
000001bc : a746                _trap                                ; GetOSTrapAddress for $a89f (unimplemented trap)
000001be : b1c1                CMPA.L   D1,A0
000001c0 : 6710                BEQ      $000001d2
000001c2 : 122e ffc6           MOVE.B   -58(A6),D1
000001c6 : 0201 0004           ANDI.B   #$04,D1
000001ca : 6606                BNE      $000001d2
000001cc : 002e 0080 ffc6      ORI.B    #$80,-58(A6)
000001d2 : 002e 0004 ffc6      ORI.B    #$04,-58(A6)
000001d8 : 4e75                RTS

;;
;; Read SRec
;; Called from: Function_9
;;

Read_SResource:
000001da : 48e7 f080           MOVEM.L  D0-D3,A0,-(A7)
000001de : 3600                MOVE.W   D0,D3
000001e0 : 41ee ffc8           LEA      -56(A6),A0                  ; a0 = address of spBlock
000001e4 : 1153 0031           MOVE.B   (A3),+49(A0)
000001e8 : 117c 0001 0032      MOVE.B   #$01,+50(A0)
000001ee : 4228 0033           CLR.B    +51(A0)
000001f2 : 7016                MOVEQ    #$16,D0
000001f4 : a06e                _SlotManager                         ; SRsrcInfo
000001f6 : 4a40                TST      D0
000001f8 : 660e                BNE      $00000208
000001fa : 1143 0032           MOVE.B   D3,+50(A0)
000001fe : 7005                MOVEQ    #$05,D0
00000200 : a06e                _SlotManager                         ; SGetBlock
00000202 : 4a40                TST      D0
00000204 : 6602                BNE      $00000208
00000206 : 2250                MOVEA.L  (A0),A1
00000208 : 4cdf 010f           MOVEM.L  (A7)+,D0-D3,A0
0000020c : 4e75                RTS

;;
;; Called from: PrimaryINIT
;;

Function_1:
0000020e : 204a                MOVEA.L  A2,A0
00000210 : d1fc 0d0b 0000      ADDA.L   #$0d0b0000,A0
00000216 : 20bc 0606 0606      MOVE.L   #$06060606,(A0)
0000021c : 217c 0043 4343 0008 MOVE.L   #$00434343,+8(A0)
00000224 : 20bc 0505 0505      MOVE.L   #$05050505,(A0)
0000022a : 42a8 0008           CLR.L    +8(A0)
0000022e : 20bc 0404 0404      MOVE.L   #$04040404,(A0)
00000234 : 217c ffff ffff 0008 MOVE.L   #$ffffffff,+8(A0)
0000023c : 20bc 0707 0707      MOVE.L   #$07070707,(A0)
00000242 : 42a8 0008           CLR.L    +8(A0)
00000246 : 4290                CLR.L    (A0)
00000248 : 323c 00ff           MOVE.W   #$00ff,D1
0000024c : 42a8 0004           CLR.L    +4(A0)
00000250 : 42a8 0004           CLR.L    +4(A0)
00000254 : 42a8 0004           CLR.L    +4(A0)
00000258 : 51c9 fff2           DBF      D1,$0000024c
0000025c : 4290                CLR.L    (A0)
0000025e : 217c 0000 00d8 0004 MOVE.L   #$000000d8,+4(A0)
00000266 : 217c 0000 0008 0004 MOVE.L   #$00000008,+4(A0)
0000026e : 217c 0000 0008 0004 MOVE.L   #$00000008,+4(A0)
00000276 : 217c 0000 00a8 0004 MOVE.L   #$000000a8,+4(A0)
0000027e : 217c 0000 00a8 0004 MOVE.L   #$000000a8,+4(A0)
00000286 : 217c 0000 00a8 0004 MOVE.L   #$000000a8,+4(A0)
0000028e : 4e75                RTS           

;;
;; Loading the S drawing in the ROM before the PrimaryINIT
;; Called from: PrimaryINIT
;;

Function_2:
00000290 : 204c                MOVEA.L  A4,A0
00000292 : 3029 004e           MOVE.W   +78(A1),D0
00000296 : 0440 0090           SUBI.W   #$0090,D0
0000029a : e648                LSR.W    #3,D0
0000029c : d0c0                ADDA.W   D0,A0
0000029e : 3029 0050           MOVE.W   +80(A1),D0
000002a2 : 0440 005a           SUBI.W   #$005A,D0
000002a6 : c0c4                MULU     D4,D0
000002a8 : d1c0                ADDA.L   D0,A0
000002aa : 0444 0010           SUBI.W   #$0010,D4
000002ae : 7249                MOVEQ    #$49,D1
000002b0 : 43fa f8ae           LEA      -1874(PC) {$fffffb60},A1    ; Access "S" in ROM before PrimaryINIT
000002b4 : 700f                MOVEQ    #$0F,D0
000002b6 : 10d9                MOVE.B   (A1)+,(A0)+
000002b8 : 51c8 fffc           DBF      D0,$000002b6
000002bc : d0c4                ADDA.W   D4,A0
000002be : 51c9 fff4           DBF      D1,$000002b4
000002c2 : 4e75                RTS

;;
;; Some type of memory fill function?
;; Called from: PrimaryINIT
;;

Function_3:
000002c4 : 2f09                MOVE.L   A1,-(A7)
000002c6 : 383c 0200           MOVE.W   #$0200,D4
000002ca : 122e ffc7           MOVE.B   -57(A6),D1
000002ce : 0201 0020           ANDI.B   #$20,D1
000002d2 : 6604                BNE      $000002d8
000002d4 : 383c 0100           MOVE.W   #$0100,D4
000002d8 : 70ff                MOVEQ    #$FF,D0
000002da : 2200                MOVE.L   D0,D1
000002dc : 363c 12c0           MOVE.W   #$12c0,D3
000002e0 : 224c                MOVEA.L  A4,A1
000002e2 : 2049                MOVEA.L  A1,A0
000002e4 : 3404                MOVE.W   D4,D2
000002e6 : 20c0                MOVE.L   D0,(A0)+
000002e8 : 20c0                MOVE.L   D0,(A0)+
000002ea : 20c0                MOVE.L   D0,(A0)+
000002ec : 20c0                MOVE.L   D0,(A0)+
000002ee : 20c0                MOVE.L   D0,(A0)+
000002f0 : 20c0                MOVE.L   D0,(A0)+
000002f2 : 20c0                MOVE.L   D0,(A0)+
000002f4 : 20c0                MOVE.L   D0,(A0)+
000002f6 : 0442 0020           SUBI.W   #$0020,D2
000002fa : 6eea                BGT      $000002e6
000002fc : c141                AND.W    D0,D1
000002fe : d2c4                ADDA.W   D4,A1
00000300 : 51cb ffe0           DBF      D3,$000002e2
00000304 : 225f                MOVEA.L  (A7)+,A1
00000306 : 4e75                RTS   

;;
;; Some type of communication with an IC
;; Called from: Setup_Video_Default
;;

Function_4:
00000308 : 200a                MOVE.L   A2,D0
0000030a : 0680 0008 0000      ADDI.L   #$00080000,D0
00000310 : 2840                MOVEA.L  D0,A4
00000312 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = slot base address + $0c000000
00000318 : 257c 0000 b564 006c MOVE.L   #$0000b564,+108(A2)
00000320 : 257c 0000 0080 0040 MOVE.L   #$00000080,+64(A2)
00000328 : 42aa 0044           CLR.L    +68(A2)
0000032c : 257c 0000 0080 0074 MOVE.L   #$00000080,+116(A2)
00000334 : 42aa 0078           CLR.L    +120(A2)
00000338 : 202a 0050           MOVE.L   +80(A2),D0
0000033c : e288                LSR.L    #1,D0
0000033e : 2540 0050           MOVE.L   D0,+80(A2)
00000342 : 202a 007c           MOVE.L   +124(A2),D0
00000346 : e288                LSR.L    #1,D0
00000348 : 2540 007c           MOVE.L   D0,+124(A2)
0000034c : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
00000352 : 4e75                RTS
Posted by: jmacz on 2024-07-25 07:24:54
;;
;; Walks through all the SResource IDs and deletes some.
;; Called from: PrimaryINIT
;;

Setup_Video_Default:
00000354 : 48e7 f0e0           MOVEM.L  D0-D3,A0-A2,-(A7)
00000358 : 162e ffc5           MOVE.B   -59(A6),D3
0000035c : 0c03 00aa           CMPI.B   #$AA,D3
00000360 : 6d0e                BLT      $00000370
00000362 : 0403 002a           SUBI.B   #$2A,D3
00000366 : 0c03 00aa           CMPI.B   #$AA,D3
0000036a : 6d04                BLT      $00000370
0000036c : 0403 002a           SUBI.B   #$2A,D3
00000370 : 122e ffc7           MOVE.B   -57(A6),D1
00000374 : 0201 0060           ANDI.B   #$60,D1
00000378 : 6624                BNE      $0000039e
0000037a : 618c                BSR      $00000308                   ; branch to Function_4
0000037c : 0603 002a           ADDI.B   #$2A,D3
00000380 : 4a2e ffbf           TST      -65(A6)
00000384 : 6704                BEQ      $0000038a
00000386 : 0603 002a           ADDI.B   #$2A,D3
0000038a : 554f                SUBQ.W   #2,A7
0000038c : 204f                MOVEA.L  A7,A0
0000038e : a080                _GetVideoDefault
00000390 : 1213                MOVE.B   (A3),D1
00000392 : b210                CMP.B    (A0),D1
00000394 : 6606                BNE      $0000039c
00000396 : 1143 0001           MOVE.B   D3,+1(A0)
0000039a : a081                _SetVideoDefault
0000039c : 544f                ADDQ.W   #2,A7
0000039e : 45fa 0036           LEA      +54(PC) {$000003d6},A2      ; accessing data table 3
000003a2 : 41ee ffc8           LEA      -56(A6),A0
000003a6 : 1153 0031           MOVE.B   (A3),+49(A0)
000003aa : 4228 0033           CLR.B    +51(A0)
000003ae : 121a                MOVE.B   (A2)+,D1
000003b0 : 671a                BEQ      $000003cc
000003b2 : b203                CMP.B    D3,D1
000003b4 : 67ec                BEQ      $000003a2
000003b6 : 41ee ffc8           LEA      -56(A6),A0                  ; a0 = address of spBlock
000003ba : 1141 0032           MOVE.B   D1,+50(A0)
000003be : 7031                MOVEQ    #$31,D0
000003c0 : a06e                _SlotManager                         ; SDeleteSRTRec
000003c2 : 66de                BNE      $000003a2
000003c4 : 377c 0002 0002      MOVE.W   #$0002,+2(A3)
000003ca : 60d6                BRA      $000003a2
000003cc : 1d43 ffc5           MOVE.B   D3,-59(A6)
000003d0 : 4cdf 070f           MOVEM.L  (A7)+,D0-D3,A0-A2
000003d4 : 4e75                RTS

;;
;; Data Table 3
;; Matches all of the SResource IDs in the ROM file.
;; Terminated by a null byte.
;;

000003d6 : 80 aa d4 81 ab d5 82 ac d6 83 ad d7 84 ae d8 85   ................
000003e6 : af d9 86 b0 da 87 b1 db 88 b2 dc 89 b3 dd 8a b4   ................
000003f6 : de 8b b5 df 8c b6 e0 8d b7 e1 8e b8 e2 8f b9 e3   ................
00000406 : 90 ba e4 91 bb e5 92 bc e6 93 bd e7 94 be e8 95   ................
00000416 : bf e9 96 c0 ea 97 c1 eb 98 c2 ec 99 c3 ed 9a c4   ................
00000426 : ee 9b c5 ef 9c c6 f0 a4 ce f8 a3 cd f7 a6 d0 fa   ................
00000436 : a7 d1 fb 00                                       .... 

;;
;; Empty function.
;; Called from: PrimaryINIT
;;

Empty_Function_1:
0000043a : 4e75                RTS

;;
;; Some type of communication with an IC
;; Called from: Function_10
;;

Function_5: //Check_SMT_Values_1:
0000043c : 48e7 c000           MOVEM.L  D0,D1,-(A7)
00000440 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = base slot address + $0c000000
00000446 : 202a 0018           MOVE.L   +24(A2),D0
0000044a : 0440 0009           SUBI.W   #$0009,D0
0000044e : 0240 0fff           ANDI.W   #$0FFF,D0
00000452 : 222a 0024           MOVE.L   +36(A2),D1
00000456 : 0241 0fff           ANDI.W   #$0FFF,D1
0000045a : b240                CMP.W    D0,D1
0000045c : 6ef4                BGT      $00000452
0000045e : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
00000464 : 4cdf 0003           MOVEM.L  (A7)+,D0,D1
00000468 : 4e75                RTS

;;
;; Some type of communication with an IC
;; Called from: no where??
;;

Function_6:
0000046a : 48e7 f000           MOVEM.L  D0-D3,-(A7)
0000046e : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = base slot address + $0c000000
00000474 : 242a 0018           MOVE.L   +24(A2),D2
00000478 : 5442                ADDQ.W   #2,D2
0000047a : 0242 0fff           ANDI.W   #$0FFF,D2
0000047e : 262a 001c           MOVE.L   +28(A2),D3
00000482 : 5543                SUBQ.W   #2,D3
00000484 : 0243 0fff           ANDI.W   #$0FFF,D3
00000488 : 202a 0024           MOVE.L   +36(A2),D0
0000048c : 0240 0fff           ANDI.W   #$0FFF,D0
00000490 : b042                CMP.W    D2,D0
00000492 : 6ff4                BLE      $00000488
00000494 : b043                CMP.W    D3,D0
00000496 : 6cf0                BGE      $00000488
00000498 : 4cdf 000f           MOVEM.L  (A7)+,D0-D3
0000049c : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
000004a2 : 4e75                RTS

;;
;; Empty function.
;; Called from: PrimaryINIT
;;

Empty_Function_2:
000004a4 : 4e75                RTS

;;
;; Some type of communication with an IC
;; Called from: Function_10
;;

Function_7:
000004a6 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; a2 = slot base address + $0c000000
000004ac : 257c ffff ffff 003c MOVE.L   #$ffffffff,+60(A2)
000004b4 : 257c 0000 0102 000c MOVE.L   #$00000102,+12(A2)
000004bc : 257c 0000 4000 0054 MOVE.L   #$00004000,+84(A2)
000004c4 : 202a 001c           MOVE.L   +28(A2),D0
000004c8 : 5540                SUBQ.W   #2,D0
000004ca : 3540 0018           MOVE.W   D0,+24(A2)
000004ce : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
000004d4 : 6100 fc5e           BSR      $00000134                   ; branch to Delay_13
000004d8 : 4e75                RTS

;;
;; Some type of communication with an IC
;; Called from Function_10
;;

Function_8:
000004da : 48e7 6020           MOVEM.L  D1,D2,A2,-(A7)
000004de : 204a                MOVEA.L  A2,A0
000004e0 : d1fc 0d0b 8000      ADDA.L   #$0d0b8000,A0               ; a0 = slot base address + $0d0b8000
000004e6 : d5fc 0d0a 8004      ADDA.L   #$0d0a8004,A2               ; a2 = slot base address + $0d0a8004
000004ec : 24bc ffff ffff      MOVE.L   #$ffffffff,(A2)
000004f2 : 4290                CLR.L    (A0)
000004f4 : 4292                CLR.L    (A2)
000004f6 : e748                LSL.W    #3,D0
000004f8 : 8001                OR.B     D1,D0
000004fa : 720a                MOVEQ    #$0A,D1
000004fc : ebc0 27c1           BFEXTS   D0{$1F:$01},D2
00000500 : 2082                MOVE.L   D2,(A0)
00000502 : e288                LSR.L    #1,D0
00000504 : 51c9 fff6           DBF      D1,$000004fc
00000508 : 4cdf 0406           MOVEM.L  (A7)+,D1,D2,A2
0000050c : 4e75                RTS

;;
;; Called from: PrimaryINIT
;;

Function_9:
0000050e : 48e7 0018           MOVEM.L  A3,A4,-(A7)
00000512 : 7000                MOVEQ    #$00,D0
00000514 : 102e ffc3           MOVE.B   -61(A6),D0
00000518 : 0640 00c8           ADDI.W   #$00C8,D0
0000051c : 6100 fcbc           BSR      $000001da                   ; branch to Read_SRecord
00000520 : 6100 0074           BSR      $00000596                   ; branch to Function_10
00000524 : 204a                MOVEA.L  A2,A0
00000526 : d1fc 0e00 0600      ADDA.L   #$0e000600,A0               ; slot base address + $0e000600
0000052c : 49e9 0048           LEA      +72(A1),A4
00000530 : 301c                MOVE.W   (A4)+,D0
00000532 : 2080                MOVE.L   D0,(A0)
00000534 : 301c                MOVE.W   (A4)+,D0
00000536 : 2140 0004           MOVE.L   D0,+4(A0)
0000053a : 301c                MOVE.W   (A4)+,D0
0000053c : 2140 0008           MOVE.L   D0,+8(A0)
00000540 : 204a                MOVEA.L  A2,A0
00000542 : d1fc 0c00 0000      ADDA.L   #$0c000000,A0
00000548 : 02a8 0000 fffe 0058 ANDI.L   #$0000FFFE,+88(A0)
00000550 : 4cdf 1800           MOVEM.L  (A7)+,A3,A4
00000554 : 4e75                RTS

;;
;; Called from: no where???
;;

Empty_Function_3:
00000556 : 4e75                RTS

;;
;; Data Table 4
;;

00000558 : 00 00 00 04 00 08 00 0c 00 14 00 18 00 1c 00 20   ...............
00000568 : 00 28 00 2c 00 30 00 34 00 38 00 3c 00 40 00 44   .(.,.0.4.8.<.@.D
00000578 : 00 48 00 4c 00 50 00 54 00 58 00 5c 00 60 00 64   .H.L.P.T.X.\.`.d
00000588 : 00 68 00 6c 00 70 00 74 00 78 00 7c ff ff         .h.l.p.t.x.|..

;;
;; Some type of communication with an IC
;; Called from: Function_9
;;

Function_10:
00000596 : 6100 ff0e           BSR      $000004a6                   ; branch to Function_7
0000059a : 6100 fea0           BSR      $0000043c                   ; branch to Function_5
0000059e : 204a                MOVEA.L  A2,A0
000005a0 : d1fc 0d0a 8000      ADDA.L   #$0d0a8000,A0               ; a0 = slot base address + $0d0a8000
000005a6 : 4290                CLR.L    (A0)
000005a8 : 6100 fb8a           BSR      $00000134                   ; branch to Delay_13
000005ac : 217c ffff ffff 0010 MOVE.L   #$ffffffff,+16(A0)
000005b4 : 42a8 0010           CLR.L    +16(A0)
000005b8 : 217c ffff ffff 0010 MOVE.L   #$ffffffff,+16(A0)
000005c0 : 49e9 0002           LEA      +2(A1),A4
000005c4 : 161c                MOVE.B   (A4)+,D3
000005c6 : ebc3 07c1           BFEXTS   D3{$1F:$01},D0
000005ca : 2140 0018           MOVE.L   D0,+24(A0)
000005ce : 49d1                LEA      (A1),A4
000005d0 : 161c                MOVE.B   (A4)+,D3
000005d2 : 61ff                BSR      $000005d3
000005d4 : 0000 0068           ORI.B    #$68,D0
000005d8 : 47fa ff7e           LEA      -130(PC) {$00000558},A3     ; accessing data table 4
000005dc : 204a                MOVEA.L  A2,A0
000005de : d1fc 0c00 0000      ADDA.L   #$0c000000,A0               ; a0 = slot base address + $0c000000
000005e4 : 49e9 000c           LEA      +12(A1),A4
000005e8 : 321b                MOVE.W   (A3)+,D1
000005ea : 6d08                BLT      $000005f4
000005ec : 301c                MOVE.W   (A4)+,D0
000005ee : 2180 1000           MOVE.L   D0,+0(A0,D1.W)
000005f2 : 60f4                BRA      $000005e8
000005f4 : 6100 fb3e           BSR      $00000134                   ; branch to Delay_13
000005f8 : 204a                MOVEA.L  A2,A0
000005fa : d1fc 0d0a 8000      ADDA.L   #$0d0a8000,A0               ; a0 = slot base address + $0d0a8000
00000600 : 20bc ffff ffff      MOVE.L   #$ffffffff,(A0)
00000606 : 6100 fb3c           BSR      $00000144                   ; branch to Delay_00
0000060a : 7200                MOVEQ    #$00,D1
0000060c : 49e9 0004           LEA      +4(A1),A4
00000610 : 6100 fe2a           BSR      $0000043c                   ; branch to Function_5
00000614 : 101c                MOVE.B   (A4)+,D0
00000616 : 6100 fec2           BSR      $000004da                   ; branch to Function_8
0000061a : 5281                ADDQ.L   #1,D1
0000061c : 0c01 0007           CMPI.B   #$07,D1
00000620 : 6fee                BLE      $00000610
00000622 : 6100 fb10           BSR      $00000134                   ; branch to Delay_13
00000626 : 217c ffff ffff 0010 MOVE.L   #$ffffffff,+16(A0)
0000062e : 42a8 0010           CLR.L    +16(A0)
00000632 : 217c ffff ffff 0010 MOVE.L   #$ffffffff,+16(A0)
0000063a : 4e75                RTS

;;
;; Interact with chip registers at $0d0a8000 and $0d0a0000.
;; Called from: No where??
;;

Function_11:
0000063c : 7000                MOVEQ    #$00,D0
0000063e : 204a                MOVEA.L  A2,A0
00000640 : d1fc 0d0a 8000      ADDA.L   #$0d0a8000,A0               ; a0 = slot base address + $0d0a8000
00000646 : 4a03                TST      D3
00000648 : 6602                BNE      $0000064c
0000064a : 4680                NOT.L    D0
0000064c : 2140 0014           MOVE.L   D0,+20(A0)
00000650 : 6100 faf2           BSR      $00000144                   ; branch to Delay_00
00000654 : 204a                MOVEA.L  A2,A0
00000656 : d1fc 0d0a 0000      ADDA.L   #$0d0a0000,A0               ; a0 = slot base address + $0d0a0000
0000065c : ebc3 07c1           BFEXTS   D3{$1F:$01},D0
00000660 : 2140 0004           MOVE.L   D0,+4(A0)
00000664 : ebc3 0781           BFEXTS   D3{$1E:$01},D0
00000668 : 2140 0008           MOVE.L   D0,+8(A0)
0000066c : ebc3 0741           BFEXTS   D3{$1D:$01},D0
00000670 : 2140 000c           MOVE.L   D0,+12(A0)
00000674 : ebc3 0701           BFEXTS   D3{$1C:$01},D0
00000678 : 2140 0010           MOVE.L   D0,+16(A0)
0000067c : ebc3 06c1           BFEXTS   D3{$1B:$01},D0
00000680 : 2140 0014           MOVE.L   D0,+20(A0)
00000684 : 6100 fabe           BSR      $00000144                   ; branch to Delay_00
00000688 : 4290                CLR.L    (A0)
0000068a : 20bc 0000 0001      MOVE.L   #$00000001,(A0)
00000690 : 4290                CLR.L    (A0)
00000692 : 6100 faa0           BSR      $00000134                   ; branch to Delay_13
00000696 : 4e75                RTS

;;
;; Padding?
;;

00000698 : 4e71                NOP
0000069a : 4e71                NOP
0000069c : 4e71                NOP
0000069e : 4e71                NOP
000006a0 : 4e71                NOP
000006a2 : 4e71                NOP
000006a4 : 4e71                NOP
000006a6 : 4e71                NOP
000006a8 : 4e71                NOP
000006aa : 4e71                NOP
000006ac : 4e71                NOP
000006ae : 4e71                NOP
000006b0 : 4e71                NOP
000006b2 : 4e71                NOP
000006b4 : 4e71                NOP
Posted by: MacOSMonkey on 2024-07-25 14:02:55
The empty functions are not errors -- they are most likely common code routines that had conditional flags that were compiled out (but still called). So...there is a bsr and rts and that's all.

The delay is millisecond-based and uses TimeDBRA (low-memory global that holds the value for dbra/ms). So, whenever you see a read from low-mem $d00, you know that TimeDBRA is being used. It was a common firmware timing trick.
Posted by: jmacz on 2024-07-25 17:29:26
Cool, yeah most of it looks standard. Just need to take a closer look to see what is being put into IC registers (I think I got all the locations commented in the disassembly).

For the PRAM, the code makes use of the six vendor use bytes. Some of them as expected seem to be used to determine whether the entry is valid for the current video card, one looks to hold the sResource ID to use. Need to look more at this also.

I will post the SecondaryINIT disassembly later after cleaning it up like the PrimaryINIT. And then need to go find the driver code and do the same for that.
Posted by: jmacz on 2024-07-25 18:27:20
SecondaryINIT:

;;
;; SecondaryINIT - Thunder II 1360 ROM v3.0.0
;;
;; Inputs:
;;   a0 = seBlock
;;

00000000 : 48e7 1f58           MOVEM.L  D3-D7,A1,A3,A4,-(A7)
00000004 : 317c 0001 0002      MOVE.W   #$0001,+2(A0)
0000000a : 7c00                MOVEQ    #$00,D6
0000000c : 2648                MOVEA.L  A0,A3                       ; a3 = address of seBlock
0000000e : 9efc 0040           SUBA.W   #$0040,A7
00000012 : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
00000014 : 4228 0033           CLR.B    +51(A0)
00000018 : 42a8 0004           CLR.L    +4(A0)
0000001c : 1153 0031           MOVE.B   (A3),+49(A0)
00000020 : 1e13                MOVE.B   (A3),D7
00000022 : 49e8 0038           LEA      +56(A0),A4                  ; a4 = address of sPRAMRec
00000026 : 208c                MOVE.L   A4,(A0)
00000028 : 7011                MOVEQ    #$11,D0
0000002a : a06e                _SlotManager                         ; SReadPRAMRec
0000002c : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
0000002e : 4228 0032           CLR.B    +50(A0)
00000032 : 4228 0030           CLR.B    +48(A0)                     ; spBlock->spExtDev = 0
00000036 : 317c 0003 0028      MOVE.W   #$0003,+40(A0)              ; spBlock->spCategory = $0003
0000003c : 317c 0001 002a      MOVE.W   #$0001,+42(A0)              ; spBlock->spCType = $0001
00000042 : 317c 0001 002c      MOVE.W   #$0001,+44(A0)              ; spBlock->spDrvrSW = $0001
00000048 : 317c 0403 002e      MOVE.W   #$0403,+46(A0)              ; spBlock->spDrvrHW = $0403
0000004e : 7015                MOVEQ    #$15,D0
00000050 : a06e                _SlotManager                         ; SNextTypeSRsrc
00000052 : 3a28 0026           MOVE.W   +38(A0),D5                  ; d5 = spBlock->spRefNum
00000056 : 1828 0032           MOVE.B   +50(A0),D4                  ; d4 = spBlock->spID
0000005a : 102c 0007           MOVE.B   +7(A4),D0                   ; d0 = sPRAMRec->vendorUse6
0000005e : 0200 0040           ANDI.B   #$40,D0
00000062 : 6600 0098           BNE      $000000fc
00000066 : 7008                MOVEQ    #$08,D0
00000068 : a06e                _SlotManager                         ; SVersion
0000006a : 0c90 0000 0002      CMPI.L   #$00000002,(A0)
00000070 : 6700 008a           BEQ      $000000fc
00000074 : 203c 0000 a89f      MOVE.L   #$0000a89f,D0
0000007a : a746                _trap                                ; Get OS trap address of the unimplemented trap
0000007c : 2208                MOVE.L   A0,D1
0000007e : 203c 0000 ab03      MOVE.L   #$0000ab03,D0
00000084 : a746                _trap                                ; Get OS trap address of a quickdraw 32 trap
00000086 : b1c1                CMPA.L   D1,A0
00000088 : 6700 01e2           BEQ      $0000026c
0000008c : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
0000008e : 1144 0032           MOVE.B   D4,+50(A0)
00000092 : 7031                MOVEQ    #$31,D0
00000094 : a06e                _SlotManager                         ; SDeleteSRTRec
00000096 : 1604                MOVE.B   D4,D3
00000098 : 0c03 00aa           CMPI.B   #$AA,D3
0000009c : 6d10                BLT      $000000ae
0000009e : 0c03 00d4           CMPI.B   #$D4,D3
000000a2 : 6d06                BLT      $000000aa
000000a4 : 0404 0054           SUBI.B   #$54,D4
000000a8 : 6004                BRA      $000000ae
000000aa : 0404 002a           SUBI.B   #$2A,D4
000000ae : 1144 0032           MOVE.B   D4,+50(A0)
000000b2 : 1944 0005           MOVE.B   D4,+5(A4)
000000b6 : 42a8 0018           CLR.L    +24(A0)
000000ba : 42a8 0004           CLR.L    +4(A0)
000000be : 700a                MOVEQ    #$0A,D0
000000c0 : a06e                _SlotManager                         ; InsertSRTRec
000000c2 : 1143 0032           MOVE.B   D3,+50(A0)
000000c6 : 217c 0000 0001 0018 MOVE.L   #$00000001,+24(A0)
000000ce : 700a                MOVEQ    #$0A,D0
000000d0 : a06e                _SlotManager                         ; InsertSRTRec
000000d2 : 2248                MOVEA.L  A0,A1
000000d4 : 554f                SUBQ.W   #2,A7
000000d6 : 204f                MOVEA.L  A7,A0
000000d8 : a080                _GetVideoDefault                     ; GetVideoDefault
000000da : 1c13                MOVE.B   (A3),D6
000000dc : bc10                CMP.B    (A0),D6
000000de : 6606                BNE      $000000e6
000000e0 : 1144 0001           MOVE.B   D4,+1(A0)
000000e4 : a081                _SetVideoDefault                     ; SetVideoDefault
000000e6 : 544f                ADDQ.W   #2,A7
000000e8 : 2049                MOVEA.L  A1,A0
000000ea : 42a7                CLR.L    -(A7)
000000ec : aa29                _GetDeviceList                       ; GetDeviceList
000000ee : 205f                MOVEA.L  (A7)+,A0
000000f0 : 2050                MOVEA.L  (A0),A0
000000f2 : ba50                CMP.W    (A0),D5
000000f4 : 6606                BNE      $000000fc
000000f6 : 2068 0016           MOVEA.L  +22(A0),A0
000000fa : 2c10                MOVE.L   (A0),D6                     ; d6 = PixMapPtr
000000fc : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
000000fe : 162c 0007           MOVE.B   +7(A4),D3
00000102 : 002c 0028 0007      ORI.B    #$28,+7(A4)
00000108 : 43d4                LEA      (A4),A1
0000010a : 2149 0004           MOVE.L   A1,+4(A0)
0000010e : 7012                MOVEQ    #$12,D0
00000110 : a06e                _SlotManager                         ; SPutPRAMRec
00000112 : 1003                MOVE.B   D3,D0
00000114 : 0200 0050           ANDI.B   #$50,D0
00000118 : 6600 006e           BNE      $00000188
0000011c : 48e7 fffe           MOVEM.L  D0-D7,A0-A6,-(A7)
00000120 : 48c5                EXT.L    D5
00000122 : 5285                ADDQ.L   #1,D5
00000124 : 4485                NEG.L    D5
00000126 : e58d                LSL.L    #2,D5
00000128 : 2078 011c           MOVEA.L  $0000011c,A0
0000012c : d1c5                ADDA.L   D5,A0
0000012e : 2050                MOVEA.L  (A0),A0
00000130 : 2050                MOVEA.L  (A0),A0
00000132 : 2268 0014           MOVEA.L  +20(A0),A1
00000136 : 2251                MOVEA.L  (A1),A1
00000138 : 0069 0028 0068      ORI.W    #$0028,+104(A1)
0000013e : 4a86                TST      D6
00000140 : 672c                BEQ      $0000016e
00000142 : 2a46                MOVEA.L  D6,A5
00000144 : 302d 0004           MOVE.W   +4(A5),D0
00000148 : 0240 e000           ANDI.W   #$E000,D0
0000014c : 0640 0200           ADDI.W   #$0200,D0
00000150 : 3b40 0004           MOVE.W   D0,+4(A5)
00000154 : 2029 000e           MOVE.L   +14(A1),D0
00000158 : 0680 0020 0000      ADDI.L   #$00200000,D0
0000015e : 2340 0012           MOVE.L   D0,+18(A1)
00000162 : 2a80                MOVE.L   D0,(A5)
00000164 : 4240                CLR.W    D0
00000166 : 102c 0005           MOVE.B   +5(A4),D0
0000016a : 3340 0066           MOVE.W   D0,+102(A1)
0000016e : 2029 0004           MOVE.L   +4(A1),D0
00000172 : 6710                BEQ      $00000184
00000174 : 2440                MOVEA.L  D0,A2
00000176 : 4e92                JSR      (A2)                        ; calling something
00000178 : 2011                MOVE.L   (A1),D0
0000017a : 6708                BEQ      $00000184
0000017c : 2040                MOVEA.L  D0,A0
0000017e : 2029 0012           MOVE.L   +18(A1),D0
00000182 : 4e90                JSR      (A0)                        ; calling something
00000184 : 4cdf 7fff           MOVEM.L  (A7)+,D0-D7,A0-A6
00000188 : 0203 0020           ANDI.B   #$20,D3
0000018c : 6600 00de           BNE      $0000026c
00000190 : 4a07                TST      D7
00000192 : 6b00 00d8           BMI      $0000026c
00000196 : 48e7 00e0           MOVEM.L  A0-A2,-(A7)
0000019a : 0287 0000 000f      ANDI.L   #$0000000F,D7
000001a0 : e89f                ROL.L    #4,D7
000001a2 : 7001                MOVEQ    #$01,D0
000001a4 : a05d                _SwapMMUMode
000001a6 : 2f00                MOVE.L   D0,-(A7)
000001a8 : 2447                MOVEA.L  D7,A2                       ; a2 = slot base address
000001aa : 2e3c 0020 0000      MOVE.L   #$00200000,D7
000001b0 : 2c3c 0000 04af      MOVE.L   #$000004af,D6
000001b6 : d5fc 0d0b 0000      ADDA.L   #$0d0b0000,A2               ; accessing an IC at offset $0d0b0000
000001bc : 203c 0000 00a8      MOVE.L   #$000000a8,D0
000001c2 : 4292                CLR.L    (A2)
000001c4 : 2540 0004           MOVE.L   D0,+4(A2)
000001c8 : 2540 0004           MOVE.L   D0,+4(A2)
000001cc : 2540 0004           MOVE.L   D0,+4(A2)
000001d0 : 2540 0004           MOVE.L   D0,+4(A2)
000001d4 : 2540 0004           MOVE.L   D0,+4(A2)
000001d8 : 2540 0004           MOVE.L   D0,+4(A2)
000001dc : 95fc 0d0b 0000      SUBA.L   #$0d0b0000,A2
000001e2 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; accessing an IC at offset $0c000000
000001e8 : 257c 0000 b576 006c MOVE.L   #$0000b576,+108(A2)
000001f0 : 42aa 0040           CLR.L    +64(A2)
000001f4 : 42aa 0044           CLR.L    +68(A2)
000001f8 : 42aa 0074           CLR.L    +116(A2)
000001fc : 42aa 0078           CLR.L    +120(A2)
00000200 : 202a 0050           MOVE.L   +80(A2),D0
00000204 : e388                LSL.L    #1,D0
00000206 : 2540 0050           MOVE.L   D0,+80(A2)
0000020a : 202a 007c           MOVE.L   +124(A2),D0
0000020e : e388                LSL.L    #1,D0
00000210 : 2540 007c           MOVE.L   D0,+124(A2)
00000214 : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
0000021a : 2f0a                MOVE.L   A2,-(A7)
0000021c : d5c7                ADDA.L   D7,A2
0000021e : 203c aaaa aaaa      MOVE.L   #$aaaaaaaa,D0
00000224 : 721f                MOVEQ    #$1F,D1
00000226 : 24c0                MOVE.L   D0,(A2)+
00000228 : 24c0                MOVE.L   D0,(A2)+
0000022a : 24c0                MOVE.L   D0,(A2)+
0000022c : 24c0                MOVE.L   D0,(A2)+
0000022e : 51c9 fff6           DBF      D1,$00000226
00000232 : 4680                NOT.L    D0
00000234 : 51ce ffee           DBF      D6,$00000224
00000238 : 245f                MOVEA.L  (A7)+,A2
0000023a : 204a                MOVEA.L  A2,A0                       ; a0 = slot base address
0000023c : d1fc 0d0b 0000      ADDA.L   #$0d0b0000,A0               ; accessing an IC at offset $0d0b0000
00000242 : 4290                CLR.L    (A0)
00000244 : 203c 0000 00ff      MOVE.L   #$000000ff,D0
0000024a : 2140 0004           MOVE.L   D0,+4(A0)
0000024e : 2140 0004           MOVE.L   D0,+4(A0)
00000252 : 2140 0004           MOVE.L   D0,+4(A0)
00000256 : 4240                CLR.W    D0
00000258 : 2140 0004           MOVE.L   D0,+4(A0)
0000025c : 2140 0004           MOVE.L   D0,+4(A0)
00000260 : 2140 0004           MOVE.L   D0,+4(A0)
00000264 : 201f                MOVE.L   (A7)+,D0
00000266 : a05d                _SwapMMUMode
00000268 : 4cdf 0700           MOVEM.L  (A7)+,A0-A2
0000026c : defc 0040           ADDA.W   #$0040,A7
00000270 : 4cdf 1af8           MOVEM.L  (A7)+,D3-D7,A1,A3,A4
00000274 : 4e75                RTS
Posted by: MacOSMonkey on 2024-07-26 14:41:50
Historically, for Thunder boards, SMT was in the $c000000 range, SQD was in the $e000000 range and everything else was in the $d000000 range. But, don't quote me.

Secondary INIT monkeys around with sRsrcs and the CLUT, so the $d0b0000 offset is probably the CLUT offset. There is also a 1-bit checkerboard fill.

I spent some time and went through the disassembly, looked up some stuff, added extra comments and insights, etc. See your copied code block below.

SpBlock offsets for reference:
spResult: 0
spSPointer: 4
spSize: 8
spOffsetData: 12
spIOFileName: 16
spSExecPBlk: 20
spParamData: 24
spMisc: 28
spReserved: 32
spIOReserved: 36
spRefNum: 38
spCategory: 40
spCType: 42
spDrvrSW: 44
spDrvrHW: 46
spTBMask: 48
spSlot: 49
spID: 50
spExtDev: 51
spHwDev: 52
spByteLanes: 53
spFlags: 54
spKey: 55

;;
;; SecondaryINIT - Thunder II 1360 ROM v3.0.0
;;
;; Inputs:
;;   a0 = seBlock
;;

00000000 : 48e7 1f58           MOVEM.L  D3-D7,A1,A3,A4,-(A7)
00000004 : 317c 0001 0002      MOVE.W   #$0001,+2(A0)                   ; run flag in seStatus
0000000a : 7c00                MOVEQ    #$00,D6
0000000c : 2648                MOVEA.L  A0,A3                       ; a3 = address of seBlock
0000000e : 9efc 0040           SUBA.W   #$0040,A7
00000012 : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
00000014 : 4228 0033           CLR.B    +51(A0)                  ; clear spExtDev
00000018 : 42a8 0004           CLR.L    +4(A0)                  ; clear spsPointer
0000001c : 1153 0031           MOVE.B   (A3),+49(A0)                  ; move seSlot -> spSlot
00000020 : 1e13                MOVE.B   (A3),D7                  ; get the slot again
00000022 : 49e8 0038           LEA      +56(A0),A4                  ; a4 = address of sPRAMRec
00000026 : 208c                MOVE.L   A4,(A0)                  ; spResult -- see SlotEqu.a
00000028 : 7011                MOVEQ    #$11,D0
0000002a : a06e                _SlotManager                         ; SReadPRAMRec
0000002c : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
0000002e : 4228 0032           CLR.B    +50(A0)                  ; clear spID
00000032 : 4228 0030           CLR.B    +48(A0)                     ; clear spTBMask
 ; see ROMEqu.a
00000036 : 317c 0003 0028      MOVE.W   #$0003,+40(A0)              ; spBlock->spCategory = $0003 / catDisplay
0000003c : 317c 0001 002a      MOVE.W   #$0001,+42(A0)              ; spBlock->spCType = $0001 / typApple
00000042 : 317c 0001 002c      MOVE.W   #$0001,+44(A0)              ; spBlock->spDrvrSW = $0001 / drSwApple
00000048 : 317c 0403 002e      MOVE.W   #$0403,+46(A0)              ; spBlock->spDrvrHW = $0403 / SuperMac
0000004e : 7015                MOVEQ    #$15,D0
00000050 : a06e                _SlotManager                         ; SNextTypeSRsrc
00000052 : 3a28 0026           MOVE.W   +38(A0),D5                  ; d5 = spBlock->spRefNum
00000056 : 1828 0032           MOVE.B   +50(A0),D4                  ; d4 = spBlock->spID
0000005a : 102c 0007           MOVE.B   +7(A4),D0                   ; d0 = sPRAMRec->vendorUse6
0000005e : 0200 0040           ANDI.B   #$40,D0                  ; must be the secondary init flag because the code exits
00000062 : 6600 0098           BNE      $000000fc                  ; and board setup follows
00000066 : 7008                MOVEQ    #$08,D0                 
00000068 : a06e                _SlotManager                         ; SVersion
0000006a : 0c90 0000 0002      CMPI.L   #$00000002,(A0)                  ; version 2?
00000070 : 6700 008a           BEQ      $000000fc
00000074 : 203c 0000 a89f      MOVE.L   #$0000a89f,D0
0000007a : a746                _trap                                ; Get OS trap address of the unimplemented trap
0000007c : 2208                MOVE.L   A0,D1
0000007e : 203c 0000 ab03      MOVE.L   #$0000ab03,D0
00000084 : a746                _trap                                ; Get OS trap address of a quickdraw 32 trap
00000086 : b1c1                CMPA.L   D1,A0                  ; does QD32 = Unimplemented?
00000088 : 6700 01e2           BEQ      $0000026c                  ; if so, no QD32 support
                  ;  the reason for doing this check is to remove the 24-bit sRsrc and install a 32-bit one
0000008c : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
0000008e : 1144 0032           MOVE.B   D4,+50(A0)                  ; d4 has the spID from above
00000092 : 7031                MOVEQ    #$31,D0
00000094 : a06e                _SlotManager                         ; SDeleteSRTRec  -- deleting the 24-bit sRsrc
00000096 : 1604                MOVE.B   D4,D3                  ; put the spID in d3
00000098 : 0c03 00aa           CMPI.B   #$AA,D3                  ; this could be the max 32-bit ID
0000009c : 6d10                BLT      $000000ae                  ; looks like a sanity check

; So, from this code, the IDs are in the format of:
; [block of 32-bit IDs]
; -- Cut-Off of $AA for max 32-bit ID
; [block of 24-bit IDs]
; -- delta between a 32-bit ID and its matching 24-bit ID is $54
; So, if x is the 32-bit ID, x+$54 is the matching 24-bit ID

0000009e : 0c03 00d4           CMPI.B   #$D4,D3                  ; NOTE: this is not register d4 ;-) -- must be another id limiter
000000a2 : 6d06                BLT      $000000aa
000000a4 : 0404 0054           SUBI.B   #$54,D4                  ; this may be the delta to the IDs for 32-bit
000000a8 : 6004                BRA      $000000ae
000000aa : 0404 002a           SUBI.B   #$2A,D4                  ; this is another id bank offset of some kind
000000ae : 1144 0032           MOVE.B   D4,+50(A0)                  ; branches converge and set new spID
000000b2 : 1944 0005           MOVE.B   D4,+5(A4)                  ; saving the current/updated spID - vendor use
000000b6 : 42a8 0018           CLR.L    +24(A0)                  ; clear spParamData (set to enabled - see 2-54 SlotManager)
000000ba : 42a8 0004           CLR.L    +4(A0)                  ; clear spSPointer (set to NIL)
000000be : 700a                MOVEQ    #$0A,D0
000000c0 : a06e                _SlotManager                         ; InsertSRTRec -- installing the 32-bit sRsrc
000000c2 : 1143 0032           MOVE.B   D3,+50(A0)                  ; set the old 24-bit ID still in d3
000000c6 : 217c 0000 0001 0018 MOVE.L   #$00000001,+24(A0)                  ; spParamData (1 = disabled)
000000ce : 700a                MOVEQ    #$0A,D0
000000d0 : a06e                _SlotManager                         ; InsertSRTRec
000000d2 : 2248                MOVEA.L  A0,A1                  ; save the spBlock ptr, since we are trashing a0
000000d4 : 554f                SUBQ.W   #2,A7                  ; make room for DefVideoRec (IM V p354)
000000d6 : 204f                MOVEA.L  A7,A0                  ; save the location
; this code is check to see if the board is the boot screen or not, since things happen differently on
; primary and secondary cards. Secondary cards don't get an Open call until right before the desktop draws
000000d8 : a080                _GetVideoDefault                     ; GetVideoDefault (IM V p354)
000000da : 1c13                MOVE.B   (A3),D6                  ; get the slot from the seBlock above
000000dc : bc10                CMP.B    (A0),D6                  ; check to see it matches the boot screen
000000de : 6606                BNE      $000000e6                  ; if not, then this card is a secondary one
000000e0 : 1144 0001           MOVE.B   D4,+1(A0)                  ; put the 32-bit spID in sdSlot  (IM V p354)
000000e4 : a081                _SetVideoDefault                     ; SetVideoDefault
000000e6 : 544f                ADDQ.W   #2,A7                  ; dump the DefVideoRec
000000e8 : 2049                MOVEA.L  A1,A0                  ; restore the spBlock (irrelevant/wasted instruction)
000000ea : 42a7                CLR.L    -(A7)                  ; make room for GDHandle (IM V p124)
000000ec : aa29                _GetDeviceList                       ; GetDeviceList
000000ee : 205f                MOVEA.L  (A7)+,A0                  ; get the GDHandle
000000f0 : 2050                MOVEA.L  (A0),A0                  ; get the GDPtr
000000f2 : ba50                CMP.W    (A0),D5                  ; compare the gdRefNum - indicates refNum in d5
000000f4 : 6606                BNE      $000000fc                  ; exit point / boot sanity check
000000f6 : 2068 0016           MOVEA.L  +22(A0),A0                  ; PixMapHdl
000000fa : 2c10                MOVE.L   (A0),D6                     ; d6 = PixMapPtr
000000fc : 204f                MOVEA.L  A7,A0                       ; a0 = address of spBlock
000000fe : 162c 0007           MOVE.B   +7(A4),D3                  ; more vendor stuff
00000102 : 002c 0028 0007      ORI.B    #$28,+7(A4)                  ; has to be setting run flags in PRAM
00000108 : 43d4                LEA      (A4),A1                  ; get the address of the PRAM record
0000010a : 2149 0004           MOVE.L   A1,+4(A0)                  ; set the spSPointer
0000010e : 7012                MOVEQ    #$12,D0
00000110 : a06e                _SlotManager                         ; SPutPRAMRec - this writes out the PRAM record
00000112 : 1003                MOVE.B   D3,D0                  ; this holds vendor flags from offset $fe above
00000114 : 0200 0050           ANDI.B   #$50,D0                  ; more run flag checking
00000118 : 6600 006e           BNE      $00000188                  ; and exit if something hasn't been set yet

;----------------------------------------------------------
0000011c : 48e7 fffe           MOVEM.L  D0-D7,A0-A6,-(A7)                  ; more save regs - indicates new functional block
00000120 : 48c5                EXT.L    D5                  ; we know the refNum  is in d5 from above
00000122 : 5285                ADDQ.L   #1,D5                  ; add 1 to the refNum
00000124 : 4485                NEG.L    D5                  ; negate it to get the unit number
00000126 : e58d                LSL.L    #2,D5                  ; multiply by 2 to convert unit number into a long offset
; the code block above is taking the refNum and converting it into the unit offset
; (when indexing into the Unit Table, it is a good idea to check UnitNtryCnt as a sanity check, but in this
; case, the code should never fail  -- see SysEqu.a)
00000128 : 2078 011c           MOVEA.L  $0000011c,A0                  ; get UTableBase (see SysEqu.a)
0000012c : d1c5                ADDA.L   D5,A0                  ; get the device offset (see IM V p424, Devices, etc.)
0000012e : 2050                MOVEA.L  (A0),A0                  ; get the AuxDCEHdl
00000130 : 2050                MOVEA.L  (A0),A0                  ; get the AuxDCEPtr

; 0: dCtlDriver (long)
; 4: dCtlFlags (short)
; 6: dCtlQHdr (QHdr = 10 bytes - see IM II p372)
; 16: dCtlPosition (long)
; 20 dCtlStorage (long -- handle)
; 18: dCtlRefNum (short)

00000132 : 2268 0014           MOVEA.L  +20(A0),A1                  ; get the dCtlStorageHdl
00000136 : 2251                MOVEA.L  (A1),A1                  ; get the dCtlStoragePtr
00000138 : 0069 0028 0068      ORI.W    #$0028,+104(A1)                  ; setting flags in private driver storage
0000013e : 4a86                TST      D6                  ; d6 has the pixMap (from above)
00000140 : 672c                BEQ      $0000016e                  ; if not valid, then exit
00000142 : 2a46                MOVEA.L  D6,A5                  ; put the PixMap in a5
00000144 : 302d 0004           MOVE.W   +4(A5),D0                  ; pmRowBytes
00000148 : 0240 e000           ANDI.W   #$E000,D0                  ; manipulating rowBytes
0000014c : 0640 0200           ADDI.W   #$0200,D0
00000150 : 3b40 0004           MOVE.W   D0,+4(A5)                  ; updating pixMap
00000154 : 2029 000e           MOVE.L   +14(A1),D0                  ; getting baseAddr from storage
00000158 : 0680 0020 0000      ADDI.L   #$00200000,D0                  ; adding an offset
0000015e : 2340 0012           MOVE.L   D0,+18(A1)                  ; putting it back in stroage
00000162 : 2a80                MOVE.L   D0,(A5)                  ; putting it in pmBaseAddr (offset $0) - clue re: baseAddr
00000164 : 4240                CLR.W    D0                  ; clear d0
00000166 : 102c 0005           MOVE.B   +5(A4),D0                  ; get the spID (from above)
0000016a : 3340 0066           MOVE.W   D0,+102(A1)                  ; put it in storage
0000016e : 2029 0004           MOVE.L   +4(A1),D0                  ; this is the address of a routine
00000172 : 6710                BEQ      $00000184                  ; if NIL, exit
00000174 : 2440                MOVEA.L  D0,A2                  ; put it into an address register
00000176 : 4e92                JSR      (A2)                        ; calling something
; the above execution could be for QD acceleration, since, otherwise, there would be no need to
; do all the QD32/pixMap checking and get the DCE

00000178 : 2011                MOVE.L   (A1),D0                  ; this is the address of another routine
; so -- the first to values in storage in the DCE are code pointers -- may be able to dump them in Macsbug

0000017a : 6708                BEQ      $00000184                  ; exit if it's NIL
0000017c : 2040                MOVEA.L  D0,A0                  ; put it in an address register
0000017e : 2029 0012           MOVE.L   +18(A1),D0                  ; modified base address stored above
00000182 : 4e90                JSR      (A0)                        ; calling something
00000184 : 4cdf 7fff           MOVEM.L  (A7)+,D0-D7,A0-A6                  ; this reg restore ends this code block
;-----------------------------------------------------

00000188 : 0203 0020           ANDI.B   #$20,D3                  ; d3 holds flags -- checking some capability
0000018c : 6600 00de           BNE      $0000026c                  ; exiting if not set
00000190 : 4a07                TST      D7                  ; testing byte for valid slot ID (size field = 0, so byte)
00000192 : 6b00 00d8           BMI      $0000026c                  ; should never be negative -- sanity check

; ---------------------------------------------------------
;  another functional block
; must have other entry points, since it is re-calling SwapMMUMode, which will do nothing if already swapped
00000196 : 48e7 00e0           MOVEM.L  A0-A2,-(A7)                  ; save regs
0000019a : 0287 0000 000f      ANDI.L   #$0000000F,D7                  ; clear d7 except for the slot ID
000001a0 : e89f                ROL.L    #4,D7                  ; move left by 1 nybble
000001a2 : 7001                MOVEQ    #$01,D0
000001a4 : a05d                _SwapMMUMode                  ; swap to 32-bit mode, if not already swapped
000001a6 : 2f00                MOVE.L   D0,-(A7)                  ; save the mmu mode
000001a8 : 2447                MOVEA.L  D7,A2                       ; a2 = slot base address
000001aa : 2e3c 0020 0000      MOVE.L   #$00200000,D7
000001b0 : 2c3c 0000 04af      MOVE.L   #$000004af,D6                  ; this is 1200 - 1 (max lines) - clue - see below
000001b6 : d5fc 0d0b 0000      ADDA.L   #$0d0b0000,A2               ; access IC @ $0d0b0000 -- likely CLUT
000001bc : 203c 0000 00a8      MOVE.L   #$000000a8,D0                  ; poss CLUT value per  below
; all of  this stuff looks like CLUT updating
000001c2 : 4292                CLR.L    (A2)
000001c4 : 2540 0004           MOVE.L   D0,+4(A2)                  ; this looks like poss. CLUT update and is in Secondary INIT
000001c8 : 2540 0004           MOVE.L   D0,+4(A2)                  ; check the $A8 value in the ADV/BT databook
000001cc : 2540 0004           MOVE.L   D0,+4(A2)
000001d0 : 2540 0004           MOVE.L   D0,+4(A2)
000001d4 : 2540 0004           MOVE.L   D0,+4(A2)
000001d8 : 2540 0004           MOVE.L   D0,+4(A2)
000001dc : 95fc 0d0b 0000      SUBA.L   #$0d0b0000,A2                  ; dump the likely CLUT offset
000001e2 : d5fc 0c00 0000      ADDA.L   #$0c000000,A2               ; accessing IC@ $0c000000 - likely SMT02
000001e8 : 257c 0000 b576 006c MOVE.L   #$0000b576,+108(A2)
000001f0 : 42aa 0040           CLR.L    +64(A2)                  ; resetting counters?
000001f4 : 42aa 0044           CLR.L    +68(A2)
000001f8 : 42aa 0074           CLR.L    +116(A2)
000001fc : 42aa 0078           CLR.L    +120(A2)
00000200 : 202a 0050           MOVE.L   +80(A2),D0
00000204 : e388                LSL.L    #1,D0
00000206 : 2540 0050           MOVE.L   D0,+80(A2)
0000020a : 202a 007c           MOVE.L   +124(A2),D0
0000020e : e388                LSL.L    #1,D0
00000210 : 2540 007c           MOVE.L   D0,+124(A2)
00000214 : 95fc 0c00 0000      SUBA.L   #$0c000000,A2
0000021a : 2f0a                MOVE.L   A2,-(A7)                  ; save original baseAddr

0000021c : d5c7                ADDA.L   D7,A2                  ; adding in the same offset from above to the base address
; so...this must be the offset to VRAM from the baseAddr because of what follows
0000021e : 203c aaaa aaaa      MOVE.L   #$aaaaaaaa,D0                  ; looks like a 1-bit dithered pattern (see NOT below)
00000224 : 721f                MOVEQ    #$1F,D1                  ; 32 x 4 = 128 - rowBytes? hmm... not enough
; In 1-bit mode, max VDT is 4096...so rowBytes is 4096 bits/8bpp = 512. 512/32 = 16, or a x16 multiplier
00000226 : 24c0                MOVE.L   D0,(A2)+                  ; write a long value of dithered pixels
00000228 : 24c0                MOVE.L   D0,(A2)+                  ; 4x for caching and loop optimization
0000022a : 24c0                MOVE.L   D0,(A2)+
0000022c : 24c0                MOVE.L   D0,(A2)+
0000022e : 51c9 fff6           DBF      D1,$00000226                  ; inner loop -- horiz. rowBytes of 512 @ x16
00000232 : 4680                NOT.L    D0                  ; invert checkerboard pattern for the next row $55555555
00000234 : 51ce ffee           DBF      D6,$00000224                  ; do 1200 max lines (max vertical res)?
; this looks like a dithered checkerboard fill of the screen in 1-bit mode

00000238 : 245f                MOVEA.L  (A7)+,A2                  ; get the base again
0000023a : 204a                MOVEA.L  A2,A0                       ; a0 = slot base address
0000023c : d1fc 0d0b 0000      ADDA.L   #$0d0b0000,A0               ; accessing IC @ $0d0b0000 - CLUT - see below
00000242 : 4290                CLR.L    (A0)
00000244 : 203c 0000 00ff      MOVE.L   #$000000ff,D0                  ;  this has to be setting the CLUT for black and white
0000024a : 2140 0004           MOVE.L   D0,+4(A0)                  ; 3 white
0000024e : 2140 0004           MOVE.L   D0,+4(A0)
00000252 : 2140 0004           MOVE.L   D0,+4(A0)
00000256 : 4240                CLR.W    D0                  ; clear the value
00000258 : 2140 0004           MOVE.L   D0,+4(A0)                  ; 3 black (or maybe the values are inverted)
0000025c : 2140 0004           MOVE.L   D0,+4(A0)
00000260 : 2140 0004           MOVE.L   D0,+4(A0)
; so, this code confirms that $d0b0000 is the CLUT offset
00000264 : 201f                MOVE.L   (A7)+,D0                  ; get the old mmu mode
00000266 : a05d                _SwapMMUMode                  ; restore it
00000268 : 4cdf 0700           MOVEM.L  (A7)+,A0-A2                  ; restore regs
0000026c : defc 0040           ADDA.W   #$0040,A7                  ; dump the offset used at the start -- sp? PRAM? etc?
00000270 : 4cdf 1af8           MOVEM.L  (A7)+,D3-D7,A1,A3,A4                  ; restore regs
00000274 : 4e75                RTS                  ; exit
Posted by: eharmon on 2024-07-26 15:20:19
BTW here's some (only slightly cleaned up) notes from when I was examining PRAM values a few months ago, which might help understand what the functions reading each value is responsible for:

Starting from PRAM offset 0x70 (card was in slot E IIRC -- choose the correct offset for you slot if you're looking at the raw PRAM dump):

1000 (Always — Why?)
XXXX (Bit depth)
    0000 = 1-bit (2 color)
    0001 = 2-bit (4 color)
    0010 = 8-bit (256 color)
    0011 = 16-bit(?)
    0100 = 24-bit (Millions)

XXXX XXXX (Physical Output Resolution Selection — Mode Table Somewhere?)
    0000 0110 == 6 = “640”
    0001 0101 == 21 = “1280”
    0001 0110 == 22 = “1360”

0011 (Always — Why?)

0001 (Always — Why?)

XXXX XXXX (Video mode sResource Selection)
    1000 0110 == Mode 134 = “640”
    1001 0101 == Mode 149 = “1280”
    1001 0110 == Mode 150 = “1360”

Most significantly the Physical Output Resolution appears to be the Mode - 128. Or, I suppose I should say, since the mode sResources start at 128, it's probably more fair to say the sResource is actually the ID for the Physical Output Resolution + 128.

In pursuit of that I had written a quick retro68 hack to write arbitrary PRAM bits. Video Mode 154 claims to be 1600x1200 IIRC, so I wrote 154 to the Mode bits and 26 to the Physical Output bits, but got no display at all.

I believe that's where I left off -- with the idea that the entries for Physical mode 26 are missing, preventing the Video Mode from being used.

My idea being if we could restore the timing data for mode 26, and remove whatever is masking Mode 154 from display in the UI, it would become selectable and correctly drive the RAMDAC.

Obviously for one not present at all (1280x1024), it would involve writing new timings to the output resolution table, and adding a new matching sResource.

That was the theory anyway, and this is a dump from before the discoveries, so take things with a grain of salt.


Separately, I had discovered this was part of the cause of the behavior I saw with https://68kmla.org/bb/index.php?threads/strange-framebuffer-scrolling-with-thunder-ii.45690/. Certain resolution switching utilities fail to write both values to PRAM correctly, resulting in strange mismatches that cause rendering problems (SwitchRes wreaks havoc). They also select the wrong Video Modes, as there are multiple entries for the same output display -- presumably some with framebuffer scrolling, and some without. Basically the card needs two selections: the physical output, and the framebuffer, and most resolution utilities don't understand that. Even the SuperMac configuration in Monitors acts funny here -- depending on the monitor type you select, it understands if that monitor natively supports the resolution or requires scrolling, and sets the matching physical/framebuffer dimensions and mapping. There's no way to directly control both bit fields without writing PRAM directly. But this was handy in deducing its behavior.
Posted by: eharmon on 2024-07-26 16:03:22
That "1280" is 1280x960 btw, unfortunately not the ticket to 1280x1024.

Also I checked and 154 is 1920x1080, not 1600x1200, either way, it didn't work.
Posted by: jmacz on 2024-07-26 19:38:41
I believe the slot PRAM structure is 8 bytes and from the documentation it looks like this:

Offset Size Name
------ ---- ----------
     0    2 boardID
     2    1 vendorUse1
     3    1 vendorUse2
     4    1 vendorUse3
     5    1 vendorUse4
     6    1 vendorUse5
     7    1 vendorUse6

From the disassembly of the PrimaryINIT, it looked like board ID was being checked against $523. vendorUse2 and vendorUse4 seem to be set to values pulled from embedded data table 1 in the PrimaryINIT (I think vendorUse4 looked to be an sResource ID). And vendorUse5 seem to be set to values pulled from embedded data table 2 in the PrimaryINIT. vendorUse6 seems to be a bunch of flags that are toggled depending on detection of SlotManager version, etc. Not sure.

How do I map this to the values you saw @eharmon ? Are those in order?
Posted by: MacOSMonkey on 2024-07-26 20:06:26
The easiest way to do the mods might be to just dump memory on a 1600x1200 board.
Posted by: jmacz on 2024-07-26 20:48:21
The easiest way to do the mods might be to just dump memory on a 1600x1200 board.

Yeah if we can find one.

But for the 1280x1024 which I want, guess I need to figure out the timings. But need to determine whether it’s all doable from sResource entries or whether some of these data tables also need to be modified.
Posted by: eharmon on 2024-07-26 23:21:27
@jmacz I think rectifying with the disassembly, that would be:

-64(a6): SPRAMRecord
    -64(a6) boardID
    -63(a6) 1000 (Always — Why?)
    -62(a6) XXXX (Bit depth)
        0000 = 1-bit (2 color)
        0001 = 2-bit (4 color)
        0010 = 8-bit (256 color)
        0011 = 16-bit(?)
        0100 = 24-bit (Millions)
    -61(a6) XXXX XXXX (Physical Output Resolution Selection — Mode Table Somewhere?)
        0000 0110 == 6 = “640”
        0001 0101 == 21 = “1280”
        0001 0110 == 22 = “1360”
    -59(a6) 0011 (Always — Why?)
    -58(a6) 0001 (Always — Why?)

So -63(a6) would be vendorUse1. I’m not positive I’ve got the offset math right though.
Posted by: jmacz on 2024-07-26 23:32:31
@jmacz I think rectifying with the disassembly, that would be:

-64(a6): SPRAMRecord
    -64(a6) boardID
    -63(a6) 1000 (Always — Why?)
    -62(a6) XXXX (Bit depth)
        0000 = 1-bit (2 color)
        0001 = 2-bit (4 color)
        0010 = 8-bit (256 color)
        0011 = 16-bit(?)
        0100 = 24-bit (Millions)
    -61(a6) XXXX XXXX (Physical Output Resolution Selection — Mode Table Somewhere?)
        0000 0110 == 6 = “640”
        0001 0101 == 21 = “1280”
        0001 0110 == 22 = “1360”
    -59(a6) 0011 (Always — Why?)
    -58(a6) 0001 (Always — Why?)

So -63(a6) would be vendorUse1. I’m not positive I’ve got the offset math right though.
Ok got it. Will look at this some more. To your point, this feels doable.
Posted by: jmacz on 2024-07-27 03:34:11
We're off by some bytes here. Each of the vendorUseX fields is one byte. But you have 12 bytes.
Posted by: MacOSMonkey on 2024-07-27 06:48:56
There are some flags bytes in the vendor use fields. So, when you see what looks like a fixed value, you could just be looking at binary flags. Compare against SecondaryInit, etc. There are definitely run flags for Secondary INIT and QuickDraw 32. Also, there should be one for VideoOpen. The board ID is going to be 2 bytes and there should also be a byte for the monitor ID. So...that should account for at least 4 of the PRAM bytes. If you change monitor configs, you can see which byte is the monitor code.
Posted by: eharmon on 2024-07-27 10:48:28
We're off by some bytes here. Each of the vendorUseX fields is one byte. But you have 12 bytes.
Er... good point. I shouldn't do math after a beer.

Exactly how the raw PRAM offsets translate to the sPRAM APIs isn't clear to me. I need to read the Slot Manager chapter front to back again.

It's definitely some of those bytes I have listed above, which I reversed by permuting the display settings and seeing what changed. I can't remember if I changed the monitor or just the resolution/bit-depth, so it's possible some of those "Always" values correspond to the monitor type.
For mapping the register writes, there's MAME implementations of the Spectrum PDQ, Thunder IV, and a CRTC:

nubus_specpdq.cpp
thunder4gx.cpp
supermac.cpp

None perfectly matching the II, but since they all used similar (or identical) chipsets, I suspect the II should be almost the same. @Arbee do you have insights?
< 3 >