Sun 3 bootrom

August 22, 2025

Sun 3 bootrom souce - the Sun 3/80 - first boot

Now that I know how to configure the NVRAM (and have done so), the system tries to boot from the network.

Requesting Internet address for 8:0:20:1:DB:2
le: No Carrier
le: No Carrier
Using IP Address 192.168.0.27 = C0A8001B
Boot: le(0,0,0)

We move the network cable in the midst of the above.

Wireshark tells us it is looking for C0A8001B.SUN3X rather than just C0A8001B. We rename the file accordingly. Now we get:

Auto-boot in progress...
le: cannot initialize
Retrying
Using IP Address 192.168.0.27 = C0A8001B
Boot: le(0,0,0)
Booting from tftp server at 192.168.0.5 = C0A80005
Downloaded 2776 bytes from tftp server.

Error (PSR = 0x203) Timeout Bus Error:
  Vaddr: 0FE02004, Paddr: 00FFA004, Read, FC 5, Size 1 at 0x000048A2.

Now the game is to find out what my demo is doing at address 0x48A2. I rebuild the demo, and use k2 again. Now I get:

Downloaded 2784 bytes from tftp server.

Error (PSR = 0x203) Timeout Bus Error:
  Vaddr: 0FE02004, Paddr: 00FFA004, Read, FC 5, Size 1 at 0x000048AA.

I can use "v 4800 4900" to get the rom to dump memory for me. I verify that my dump file and what is in memory do match.
The offending instruction is in xx:

 48aa:   1028 0004       moveb %a0@(4),%d0

This ought to be a write to the uart data register.

Note: The problem here is that I have the wrong base address for the uart. I didn't figure this out until after a day of experimenting. Bear that in mind as you read the following.

Indeed, the memory map shows 0xFEF02000 to be the base address for the serial port. (However I am using 0x0fe02000 from the 3/160 experiment).

The Sun 3/80 doesn't have the nice set of 8 diag LED that I can blink or play with, so my only option to communicate with the outside world is really the uart.

Try my blink demo

This was the first thing I ran on the 3/280.

Using IP Address 192.168.0.27 = C0A8001B
Boot: le(0,0,0)
Booting from tftp server at 192.168.0.5 = C0A80005
Downloaded 206 bytes from tftp server.

Error (PSR = 0x203) Timeout Bus Error:
  Vaddr: 0FE06011, Paddr: 00000011, Write, FC 5, Size 1 at 0x00004084.

The address 0FE06011 is a register in the Intersil 7071 TOD chip, which doesn't even exist on the 3/80, so this experiment doesn't tell us much. I write to that address to turn off timer interrupts that interfere with my blink demo.

Where do we go from here?

One possibility is to dig into the ROM disassembly and find out where it transfers control to the loaded program. Does it change (or reduce) the virtual address map in a way that explains why we cannot access the serial port uart? We have seen that code is loaded and started at 0x4000. This is LOADADDR in the rom source -- not to be confused with USERCODE at 0x2000!

On a successful load, the function boot() will return with the load address. It returns to code in sys/commands.c which will generally call "bootreset" which is in trap.s. The comments here say things like:

Reset the world's maps.

The code in trap.s is surprisingly convoluted. It doesn't just branch to the LOADADDR, but seems to set up a trap frame so it can use a RTE instruction to launch the user code! And what about the address USERCODE at 0x2000? The code in trap.s has dealings with this and this is the one and only place this symbol is referenced. Clearly our demo got loaded (and started) at 0x4000. All mysterious to me at this point. A deep study of trap.s would be educational.

Another possiblity is to make calls back to the ROM via "romvec". There are both putchar() and printf() entry points in romvec. It we are able to use these, we could then write a program to display the address map. If the maps have generally been reset, will these work? What is the point of having them if they don't?

I was confused. The maps were not reset. I just had the wrong address. I did use the romvec pointer for "mayput" to send characters while I experimented figuring this out.

Feedback? Questions? Drop me a line!

Tom's Computer Info / tom@mmto.org