The CMD CQD and CDU firmware images I have were available on CMD's FTP
site. Those are still lurking out there in the archives from 1996.
I reverse engineered the CSR decode PALs on the CQD-200, 220, and
220A. It was fairly obvious after tracing the bus signals through the
bus transcievers to the CSR decode PAL along with the decode select
jumpers. I am 100% sure about the 200 and 220. The 220A is less
obvious. I believe in the 220A the main address decoding is done
elsewhere, maybe in an ASIC, and the CSR decode PAL is only used to
enable additional non-standard CSR addresses, plus output a model code
(/TM vs /E, where /E is either MSCP or TMSCP, but not both at the same
time).
The CDU-720 I have is an /M. I don't currently have a UNIBUS system
to use it in. Someday when I acquire one I'll try the exercise of
reverse engineering the CSR decode PAL on that one to use it as a /TM.
There are about 10 other socketed PALs on the 720. I assume they are
all security protected as well. I wouldn't want to have to try to
reverse engineer any of the other PALs.
-Glen