October 27, 2024

Sun 3/80 -- reading the bootrom

This may seem like an odd way to start the project, but you do need to start somewhere. Reading and disassembling a bootrom has always been a fruitful way for me to learn a lot about hardware of systems I decide to work on.

Old tools

I have a MOD-EMUP eprom programmer that I use for things like this. I used to use it fairly often, but a technology moves away from parts of the sort this handles, I use it less and less.

Several questions arise. First, since it has been several years since I used it, I have to figure out where it is and to gather all the pieces. Second, I need to find out if the system I use to run it still boots and runs. Third, I need to remember how to do everything.

Finding it was easy. The EMUP unit connects via a 25 pin cable to an ISA bus board inside of a computer that runs FreeDOS, and which has all of the EMUP support software. This computer has FreeDOS on an ancient parallel IDE drive, and uses a "Samsung SyncMaster 712N" VGA flat screen display. The display is somewhat modern. I remember when this system ran with a CRT monitor.

I plug everything in, hit the power switch and nothing happens! It turns out that the AC power cable is not fully seated. It boots up! The system has a Pentium-III 600E CPU. There are messages about a Digital 21041 based ethernet board. It is using 10BaseT and it is plugged into my network switch. We will get to network things later. A note taped to the side of the machine tells me how to start the EMUP software: 

cd EMUP
access

The chip

The chip is an ATMEL AT27C010-20DC. It has a white label marked 525-1041-06

The EMUP software knows about this manufacturer and device.
I carefully remove the chip from its socket, place it into the EMUP, and type "R" to read the chip. It reads 0 - 0x1ffff with checksum 1BA8. I use "3" to save buffer to disk as "sun380.bin". I type "V" to verify, and it seems happy. I replace the chip on the 3/80 board and call this good.

Copy the file from FreeDOS to my linux machine

I have only foggy memories about this and I hope I have notes somewhere. My notes say to run an ftp server on my linux machine. I had this installed once, but since then I have done a full fresh reinstall on my linux machine. 
su
dnf install vsftpd -y
systemctl start vsftpd
dnf install -y ftp
service firewalld stop
-- do the transfer from FreeDOS
service firewalld start
systemctl stop vsftpd
To do the transfer on the DOS side, I type "ftp 192.168.0.5" since I have no DNS set up in FreeDOS. I tried once and it failed, but that reminded me that I needed to disable the firewall (I could configure the firewall to allow FTP, but it will probably be years before I do this again.

The file is 131072 bytes in size, just as it should be.

I do a hex dump of the file. The ROM is blank (almost) after address 0x16b70. The exception is the last 2 bytes, which are: 

0001fff0 ffff ffff ffff ffff ffff ffff ffff 1ac7
The first few bytes are: 
00000000 fef6 0c00 fefe 0228 fefe 073a fefe 00f8          (   :
00000010 fef7 21d6 fefe 1f50 fefe 1e74 fefe 1f80     !    P   t
00000020 fefe 1eaa fef7 201b fef7 2016 fef7 2017
00000030 fefe 2206 fefe 21dc fef7 21ea fef7 2013     "   !   !
00000040 fef7 20d6 fef7 20da fef7 22f2 feff 4468             "   Dh
00000050 fefe 4ba0 fef7 2366 fef7 208a fefe 4bba     K   #f      K
00000060 fefe 388a fef7 2028 fef7 2020 fef7 20c6     8    (
00000070 fefe 2430 fefe 2536 fefe 2562 fef7 2096     $0  %6  %b
00000080 fefe 258c fefe 2b04 fefe 2c54 fef7 200e     %   +   ,T
00000090 fefe 0bf8 fefe 04fe fefe 0622 fef7 20c2              "
000000a0 fef7 210e 0000 0002 fef7 2000 fef7 22ee     !           "
000000b0 fef7 20ca fef7 2014 fef7 21da fef7 21aa             !   !
000000c0 fef7 21b2 fefe 03ba fef7 201c fef7 22ea     !           "
000000d0 fef7 222a fef7 222e fef7 2232 fef7 2236     "*  ".  "2  "6
000000e0 fef7 223a fef7 2376 0000 0000 0000 0000     ":  #v
000000f0 0000 0000 0000 0000 fef7 2250 206f 0004             "P o
00000100 7000 1010 4e75 206f 0004 7000 3010 4e75   p   Nu o  p 0 Nu
00000110 206f 0004 2010 4e75 206f 0004 202f 000c    o    Nu o   /
00000120 1080 4e75 206f 0004 202f 000c 3080 4e75     Nu o   /  0 Nu
This looks like vectors followed by unknown stuff. If we guess that the ROM sits at the end of feffxxxx then the first address should be fefe0000 and so on through feffffff. We need to see if assuming this and disassembling code yields a sensible result.

Typing strings yields lots of stuff, including this verbatim: 

Boot PROM Monitor Commands
a [digit]                                | Open CPU Addr Reg (0-7)
b [dev([cntrl],[unit],[part])]           | Boot a file
c [addr]                                 | Continue program at Addr
d [digit]                                | Open CPU Data Reg (0-7)
e [addr]                                 | Open Addr as 16 bit word
f [beg_addr] [end_addr] [patt] [bwl]     | Fill Memory
g [addr]                                 | Go to Address
h                                        | Display this Help Menu
k [number]                               | Reset (0)CPU, (1)PMMU, (2)System
l [addr]                                 | Open Addr as 32 bit long
m [A] [B] [addr]                         | Open TIA or TIB Table
Hit Any Key to Continue through Help Menu
o [addr]                                 | Open Addr as 8 bit byte
p [addr]                                 | Open Page Map
q [addr]                                 | Open EEPROM
r [reg]                                  | Open CPU Regs (i.e. PC)
s [digit]                                | Set/Query Function Code (0-7)
t [y/n/c]                                | Trace: Yes/No/Continue
u [arg]                                  | Select Console Device
v [beg_addr] [end_addr] [bwl]            | Display Memory
w [addr] [string]                        | Vector
x                                        | Extended Diag Tests
z [addr]                                 | Set Breakpoint
^a                                       | Display Phys and Virtual Addresses
^t [addr]                                | Translate virtual addr to physical
^r                                       | Read On Board Device Registers

Note that ^r is not a Ctrl-R, but the two characters as shown.

Also some other things in the strings: 

Sun-3/80 Boot PROM Selftest (Rev. 3.0.2)
Sun 3/80 Scope Loops Menu
Sun-3/80 SCOPELOOPS