M9301-YB Bootstrap/Terminator ROM dumps / listings?

Jörg Hoppe j_hoppe at t-online.de
Tue Apr 28 14:37:26 CDT 2015



Am 28.04.2015 um 20:32 schrieb Noel Chiappa:
>      > from what I've seen so far, the code tends to loop on error, not halt.
>
> So I lied: it turns out that some of the later tests (in the extended tests -
> JSR, memory) do in fact halt on error.
>
>
> I realize it's not needed immediately now (Josh having solved his problem),
> but I've got the low part (diagnostics and TA11 boot) done, working on the
> top part now. Here's what I have so far:
>
>    http://ana-3.lcs.mit.edu/~jnc/tech/pdp11/M9301-YA.mac
>
> I haven't densely commented the CPU tests as they seemed, at first glance,
> pretty non-complicated. The memory diagnostics are pretty inscrutable, I
> don't really understand them yet (may not bother).
Thanks for that effort!

The M9312 code should be similar, at least it may expose some ideas.
For reference, it is listed here:
http://bitsavers.trailing-edge.com/pdf/dec/unibus/K-SP-M9312-0-5_Aug78.pdf
http://bitsavers.trailing-edge.com/pdf/dec/unibus/K-SP-M9312-0-7_Aug78.pdf
http://bitsavers.trailing-edge.com/pdf/dec/unibus/MP00617_M9312.pdf

>
> The top part (console and othr boots) - hoo boy, talk about 'sphagetti
> code'!! I think there's a picture of this in the dictionary when you look
> that term up. Very, very ugly code. That part may take a while...

Or forever :-) The coolest thing I ever saw is the M9312 MSCP boot rom, 
in 23-76a9.lst
There four words for MSCP S1..S4 registers are encoded as BPL and BLT 
opcodes. The controllers DMA base addr is set to 002404, just because 
this is a "BLT 3$" branch they need.
Our "Optimizing compilers" have a long way to go ...


Joerg



>
> 	Noel
>
>
-------------- next part --------------
       1                                	.title	M9312 'DU' BOOT prom for MSCP compatible controller
       2                                
       3                                	; This source code is an exact copy of the DEC M9312 23-767A9 boot PROM.
       4                                	;
       5                                	; This boot PROM is for any MSCP compatible controller (DEC UDA50, EMULEX UC17/UC18).
       6                                	;
       7                                	; Multiple units and/or CSR addresses are supported via different entry points.
       8                                	;
       9                                	; Standard devices are 82S131, Am27S13, 74S571 or other compatible bipolar
      10                                	; PROMs with a 512x4 TriState 16pin DIP architecture. This code resides in
      11                                	; the low half of the device; the top half is blank and unused.
      12                                	;
      13                                	; Alternatively, 82S129 compatible 256x4 TriState 16pin DIP devices can be
      14                                	; used, as the uppermost address line (hardwired low) is an active low chip
      15                                	; select (and will be correctly asserted low).
      16                                
      17 172150                         mscsr	=172150				; std MSCP csrbase
      18                                
      19 000000                         msip	=+0				; IP register
      20 000002                         mssa	=+2				; SA register
      21                                
      22 165564                         diags	=165564				; console diags phase2 entry
      23                                
      24                                	.asect
      25 173000                         	.=173000
      26                                
      27                                	; --------------------------------------------------
      28                                
      29 173000    125     104          start:	.ascii	"UD"			; device code (reversed)
      30                                
      31 173002 000176                  	.word	last-.			; offset to next boot header
      32                                
      33 173004 000261                  du0n:	sec				; boot std csr, unit zero, no diags
      34 173006 012700  000000          du0d:	mov	#0,r0			; boot std csr, unit zero, with diags
      35 173012 012701  172150          duNr:	mov	#mscsr,r1		; boot std csr, unit <R0>
      36 173016 010704                  duNb:	mov	pc,r4			; boot csr <R1>, unit <R0>
      37 173020 103003                  	bcc	diag			; br if diags requested
      38 173022 000404                  	br	go			; return to (R4)+2 from diags
      39                                					; then skip over pseudo reboot vector
      40                                
      41                                	; --------------------------------------------------
      42                                
      43 173024 173000                  	.word	173000			; prom start addess @ 24
      44 173026 000340                  	.word	340			; and priority level @ 26
      45                                
      46                                	; --------------------------------------------------
      47                                
      48 173030 000137  165564          diag:	jmp	@#diags			; jump to console diags
      49                                
      50 001004                         rpkt	=1004	; rpkt structure
      51 001070                         cpkt	=1070	; cpkt structure
      52 002404                         comm	=2404	; comm structure (at 'blt .+12')
      53                                
      54 173034 010021                  go:	mov	r0,(r1)+		; init controller (write IP), bump ptr
      55 173036 012705  004000          	mov	#4000,r5		; S1 state bitmask
      56                                
      57 173042 010703                  	mov	pc,r3			; point to data at next word
      58                                	;
      59                                	; *** start of hack ***
      60                                	;
      61                                	;   this is a real hack to save some instruction words
      62                                	;      100000 == bpl .+2
      63                                	;      002404 == blt .+12 == comm
      64                                	;   bpl will always fail to branch (since PC is 'negative')
      65                                	;   blt will always succeed to branch (since PC is 'negative')
      66                                	;
      67                                	; MSCP init data
      68                                	;
      69 173044 100000                  	bpl	2$			; S1: 100000 = no int, ring size 1, no vector
      70 173046 002404                  2$:	blt	3$			; S2: 002404 = ringbase lo addr
      71 173050 000000                  	.word	000000			; S3: 000000 = no purge/poll, ringbase hi addr
      72 173052 000001                  	.word	000001			; S4: 000001 = go bit
      73                                	;
      74                                	; MSCP command data
      75                                	;
      76 173054    011     000          	.byte	011,000			; cmd=011(online), bytecnt_hi=000(0)
      77 173056    041     002          	.byte	041,002			; cmd=041(read), bytecnt_hi=002(512)
      78                                	;
      79                                	; *** end of hack ***
      80                                
      81 173060 005711                  3$:	tst	(r1)			; error bit set ?
      82 173062 100753                  	bmi	duNr			; yes, fail back to begin to retry
      83 173064 031105                  	bit	(r1),r5			; step bit set ?
      84 173066 001774                  	beq	3$			; not yet, wait loop
      85 173070 012311                  	mov	(r3)+,(r1)		; yes, send next init data
      86 173072 006305                  	asl	r5			; next mask
      87 173074 100371                  	bpl	3$			; s4 done? br if not yet
      88                                
      89 173076 005002                  4$:	clr	r2			; set bufptr to 0
      90 173100 005022                  5$:	clr	(r2)+			; clear buffer [0..2403]
      91 173102 020227  002404          	cmp	r2,#comm		; check for end of buffer
      92 173106 001374                  	bne	5$			; loop if not done
      93                                
      94 173110 010237  001064          	mov	r2,@#cpkt-4		; set lnt -- R2=2404
      95 173114 112337  001100          	movb	(r3)+,@#cpkt+10		; set command
      96 173120 111337  001105          	movb	(r3),@#cpkt+15		; set bytecnt(hi)
      97 173124 010037  001074          	mov	r0,@#cpkt+4		; set unit
      98 173130 012722  001004          	mov	#rpkt,(r2)+		; rq desc addr
      99 173134 010522                  	mov	r5,(r2)+		; rq own bit15
     100 173136 012722  001070          	mov	#cpkt,(r2)+		; cp desc addr
     101 173142 010522                  	mov	r5,(r2)+		; cq own bit15
     102 173144 016102  177776          	mov	-2(r1),r2		; wake controller (read IP)
     103                                
     104 173150 005737  002406          6$:	tst	@#comm+2		; rq own controller ?
     105 173154 100775                  	bmi	6$			; loop if not done
     106                                
     107 173156 105737  001016          	tstb	@#rpkt+12		; check for error ?
     108 173162 001313                  	bne	duNr			; yup, fail back to begin to retry
     109                                
     110 173164 105723                  	tstb	(r3)+			; check end of table ?
     111 173166 001743                  	beq	4$			; br if not yet
     112                                
     113 173170 005041                  	clr	-(r1)			; init controller (write IP)
     114 173172 005007                  	clr	pc			; jmp to bootstrap at zero
     115                                
     116                                	; --------------------------------------------------
     117                                
     118 173174 000000                  	.word	0			; unused
     119                                
     120                                	; --------------------------------------------------
     121                                
     122 173176                         	.=start+176
     123 173176 032074                  crc16:	.word	<032074>		; CRC-16 will go here
     124                                
     125                                last:	; next boot prom starts here
     126                                
     127                                	.end
     127                                


More information about the cctech mailing list