Thanks to Bob Nestor and his utility to find most of the ROM vectors, and  
a lot of time looking through the ROMs with MacsBug, I've managed to get    
ADB working on my Centris 660av :)

Here's the entry for the romvecs table, if someone wants to put it
into the real source (should I send-pr it?)

	{			/* 7 */
		"Quadra AV ROMs",
		(caddr_t) 0x4080cac6,	/* ADB int */
		(caddr_t) 0x0,		/* PM int */
		(caddr_t) 0x40805cd4,	/* ADBBase + 130 */
		(caddr_t) 0x40839600,	/* CountADBs */
		(caddr_t) 0x4083961a,	/* GetIndADB */
		(caddr_t) 0x40839646,	/* GetADBInfo */
		(caddr_t) 0x4083964c,	/* SetADBInfo */
		(caddr_t) 0x408397b8,	/* ADBReInit */
		(caddr_t) 0x4083967c,	/* ADBOp */
		(caddr_t) 0x0,		/* PMgrOp */
		(caddr_t) 0x4081141c,	/* WriteParam */
		(caddr_t) 0x4081144e,	/* SetDateTime */
		(caddr_t) 0x40811930,	/* InitUtil */
		(caddr_t) 0x4080b624,	/* ReadXPRam */
		(caddr_t) 0x4080b62e,	/* WriteXPRam */
		(caddr_t) 0x40806884,	/* jClkNoMem */
		(caddr_t) 0x408398c2,	/* ADBAlternateInit */
		(caddr_t) 0x4080cada,	/* Egret */
		(caddr_t) 0x4080de14,	/* InitEgret */
		(caddr_t) 0x408143b8,	/* ADBReInit_JTBL */
		(caddr_t) 0x409bdb60,	/* ROMResourceMap List Head */
		(caddr_t) 0x4083b3d8,	/* FixDiv */
		(caddr_t) 0x4083b2e4,	/* FixMul */
	},


I needed to do a couple of other things before it would work
though... InitEgret in the AV ROMs seems to rely on the address for
some jump table to be stored at 0x2010. As a kludge to get it to work,
I stuck a copy of the table into macrom.c, made a loglob() entry for
it in macromasm.s, pointed it to my table, and added some code to
mrg_fixupROMBase to fix the addresses.

Also, in cpu.h, ROMLEN is set to 1MB, with a comment "1MB will work
for all 68k". Well, the AV ROM is 2MB long... took me a while to
figure out why my ROMResourceMap thing wasn't working right :) I just
changed ROMLEN to 2MB...

I think I mentioned this in my very first message about the 660av, but
in case I didn't, the SCC register is at IOBase + 0x4000, not at
IOBase + 0xc000 as it seems to be on the other Quadras. I just changed
the line in machdep.c's mac68k_set_io_offsets, but I suppose a new CPU
class (MACH_CLASSAV or something) will have to be created.

Hmm... I guess that's all I had to do... sure took me a while to
figure it all out though :)

I did encounter some strangeness similar to the "if (danprint)"
section in macrom.c's mrg_aline_super... I haven't really looked into
it much, but I think setup_egret might have the same problem. If I put
a printf that does something useful (like print the value of
mrg_InitEgret) right after the "if (0 != mrg_InitEgret)" line,
setup_egret will always succeed (well, it worked all of the
approximately 15 times I tried it). If I put a printf("") there
instead, it works most of the time, but it'll hang sometimes (7
sucesses, 3 hangs, I think). If I completely remove the printf, it
hangs all the time (only tried it that way twice though). If I turn on
tracing, it looks like it's hanging right after the jbsr @a1; it never
starts executing InitEgret. Any ideas on what's causing this? I
haven't tried using a delay instead of a printf... maybe it's a weird
timing thing.

So... should I send-pr these changes, or mail 'em to someone, or what?
:)

What's the latest news on the 53c96 scsi driver, btw? I tried turning
it on, and not surprisingly, it didn't work :) Although it looks like
it's trying :) Oh yeah, ncr53c96base should be 0x18000 on the 660av, BTW.

Here's a log of the serial boot echo, if anyone's interested... :)
It's got SCSI debugging stuff turned on, so there's a lot of junk from
that.

[ preserving 80126 bytes of netbsd symbol table ]
Bootstrapping NetBSD/mac68k.
Faked range to byte 0xc00000.
Bootstrapping the pmap system.
Pmap bootstrapped.
Moving ROMBase from 0x40800000 to 0x987000.
Video address 0x50100800 -> 0xb87800.
delay calibrated, factor = 355
Copyright (c) 1982, 1986, 1989, 1991, 1993
	The Regents of the University of California.  All rights reserved.

NetBSD 1.1B (GEDD) #66: Thu May 23 03:40:01 CDT 1996
    khym@dahan.metonymy.com:/usr/src/sys/arch/mac68k/compile/GEDD
Apple Macintosh Centris 660AV  (68040)
real mem = 12582912
avail mem = 9580544
using 179 buffers containing 733184 bytes of memory
mrg: 'Quadra AV ROMs' ROM glue, tracing off, debug off, silent traps
adb: bus subsystem
Got following HwCfgFlags: 0xfc00, 0x4900081f, 0x2300bf26, 0x  99b3b8
mrg: setup_egret:
mrg: setup_egret: done.
^H^H^H^H^H^Hadb: extended keyboard at 2
adb: 200 dpi mouse at 3
mainbus0 (root)
obio0 at mainbus0
adb0 at obio0 (ADB event device)
asc0 at obio0 Apple sound chip.
ite0 at obio0 (minimal console)
ncr96scsi0 at obio0
scsibus0 at ncr96scsi0
probe(:0:0): scsi_cmd
ncr53c96(0:0:0)-0,0,0,0,0,0-
scsi96: before loop: stat = 0x93, is = 0xc4, intr = 0x18, datalen = 0
past loop...stat = 0x13, is = 0xc4, intr = 0x0
probe(:0:0): scsi_done
probe(:0:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:0:0): scsi_cmd
ncr53c96(0:0:0)-12,0,0,0,2c,0-
scsi96: before loop: stat = 0x91, is = 0xc4, intr = 0x18, datalen = 44
data = 0xa0b40, datalen = 0x2c.
entering info xfer...stat = 0x11, is = 0xc4, intr = 0x0
rem... 42.
scsi96: WAIT_FOR timeout.
probe(:0:0): scsi_done
probe(:0:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:1:0): scsi_cmd
ncr53c96(0:1:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:1:0): scsi_done
probe(:1:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:1:0): scsi_cmd
ncr53c96(0:1:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:1:0): scsi_done
probe(:1:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:2:0): scsi_cmd
ncr53c96(0:2:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:2:0): scsi_done
probe(:2:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:2:0): scsi_cmd
ncr53c96(0:2:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:2:0): scsi_done
probe(:2:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:3:0): scsi_cmd
ncr53c96(0:3:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:3:0): scsi_done
probe(:3:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:3:0): scsi_cmd
ncr53c96(0:3:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:3:0): scsi_done
probe(:3:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:4:0): scsi_cmd
ncr53c96(0:4:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:4:0): scsi_done
probe(:4:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:4:0): scsi_cmd
ncr53c96(0:4:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:4:0): scsi_done
probe(:4:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:5:0): scsi_cmd
ncr53c96(0:5:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:5:0): scsi_done
probe(:5:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:5:0): scsi_cmd
ncr53c96(0:5:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:5:0): scsi_done
probe(:5:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
probe(:6:0): scsi_cmd
ncr53c96(0:6:0)-0,0,0,0,0,0-
scsi96: WAIT_FOR timeout.
probe(:6:0): scsi_done
probe(:6:0): command: 0,0,0,0,0,0-[0 bytes]
probe(:6:0): scsi_cmd
ncr53c96(0:6:0)-12,0,0,0,2c,0-
scsi96: WAIT_FOR timeout.
probe(:6:0): scsi_done
probe(:6:0): command: 12,0,0,0,2c,0-[44 bytes]
------------------------------
000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
032: 00 00 00 00 00 00 00 00 00 00 00 00 
------------------------------
zsc0 at obio0 chip type 3 
zstty0 at zsc0 channel 0
zstty1 at zsc0 channel 1 (console)
fpu0 at obio0 (unknown type)
nubus0 at mainbus0
probing slot 9, first probe at 0xf9ffffff (PA 0x0x0).
bytelanes not found for slot 0x9.
probing slot 10, first probe at 0xfaffffff (PA 0x0x0).
bytelanes not found for slot 0xa.
probing slot 11, first probe at 0xfbffffff (PA 0x0x0).
bytelanes not found for slot 0xb.
probing slot 12, first probe at 0xfcffffff (PA 0x0x0).
bytelanes not found for slot 0xc.
probing slot 13, first probe at 0xfdffffff (PA 0x0x0).
bytelanes not found for slot 0xd.
probing slot 14, first probe at 0xfeffffff (PA 0x0x0).
bytelanes not found for slot 0xe.
ARGH!!  No boot device????Only supports DISK device for booting.
Changing root device to a.
panic: cannot mount root
Stopped at      _Debugger+0x6:  unlk    a6
db> trace
_Debugger(1fb0c,15280,cdf88,2004,cdfac) + 6
_panic(15280,0,dd90,800306f2,ffffcffc) + 34
_main() + 338
_main() + 338
db> ps
  pid proc     addr     uid  ppid  pgrp  flag stat em  comm         wchan
    0 0xa2f68 0xcb000   0    -1     0  000204  2  netbsd  swapper
db> c
syncing disks... done
NetBSD/mac68k does not trust itself to update the RTC on shutdown.

dumping to dev 1, offset 0

Name: Dave Huang     |   Mammal, mammal / their names are called /
INet: khym@bga.com   |   they raise a paw / the bat, the cat /
FurryMUCK: Dahan     |   dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 20 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++