2 $! This procedure patches the base KA655.BIN Boot ROM image to work under
5 $! The second part of the patch adds support for Extended Memory in the
6 $! simulator. A simulated system can have up to 512MB of RAM.
8 $ PATCH /ABSOLUTE /NEW_VERSION /OUTPUT=cp$exe:KA655.BIN cp$src:ka655_orig.BIN
11 ! [2004c87e] - de$read_script
12 ! [2004c916] - launch next test, r2 = test #, r4 = header, r5 = offset to main routine
17 ! Test 9D - Utility - ok
18 ! Test 42 - Wait for interrupt - ok
19 ! Test C6 - SSC register check - ok
20 ! Test 60 [2004de37] - Serial line - requires diagnostic loopback mode and
21 ! break detection - bypass
22 ! 2004de99/ brw 2004e0a7
23 Replace/Instruction 0DE99 = 'MOVB #03,B^76(R9)'
26 ! Test 62 - QDSS disable - ok
31 ! 40. Test 91 - CQBIC init check - ok
32 ! 39. Test 90 [2004d748] - CQBIC registers - ok
33 ! 38. Test 33 [2004d54e] - CMCTL init check - ok
34 ! 37. Test 32 [2004d5b0] - CMCTL registers - ok
35 ! 36. Test 31 [200512d0] - CMCTL CSR setup to map memory - ok
36 ! 35. Test 49 [20052a4b] - CMCTL FDM test - requires fast diagnostic mode
37 ! and XMX counters - bypass
38 ! 20052a55:20052a58/ nop
39 Delete/Instruction 12A55 = 'BBC #26,(R9),00012A5C'
40 ! 34. Test 30 [20051909] - init map - ok
45 ! 33. Test 52 [2004e656] - prog timer 0 - ok
46 ! 32. Test 52 [2004e656] - prog timer 1 - ok
47 ! 31. Test 53 [2004e918] - toy clock - ok
48 ! 30. Test C1 [2004f8f1] - SSC RAM - ok
49 ! 29. Test 34 [2004d4a0] - ROM - checksum off due to other patches - patch
50 ! 2004d52c:2004d52d/ nop
51 Delete/Instruction 0D52C = 'BNEQ 0000D531' ! 2004D52C
52 ! 28. Test C5 [2004fc0e] - SSC registers - ok
53 ! 27. Test 55 [2004ea8c] - interval timer - ok
54 ! 26. Test 51 [2004e42d] - CFPA - ok
55 ! 25. Test C7 [2004D3D3] - CBTCR<31:30> - ok
56 ! 24. Test 46 [2004ef1a] - L1 cache diagnostic mode - bypass
57 ! 2004ef80/ brw 2004f47a
58 Replace/Instruction 0EF80 = 'MOVB #06,B^76(R9)'
59 'BRW 0000F47A' ! 2004FE80
61 ! 23. Test 35 [20050554] - L2 cache integrity test - bypass
62 ! 20050554/ brw 20050a48
63 Replace/Instruction 10554 = 'INSV #00,#10,#02,(R9)'
64 'BRW 00010A48' ! 20050554
66 ! 22. Test 43 [20050d65] - L1 with L2 test - bypass
67 ! 20050d65/ brw 20050fca
68 Replace/Instruction 10D65 = 'MOVAL B^00010D65,W^0080(R9)'
69 'BRW 00010FCA' ! 20050D65
72 ! 20. Test 4F [20051d4f] - memory data - bypass, run from ROM
74 Replace/Byte 15205 = 3
77 ! 20051d4f/ brw 2005163a
78 Replace/Instruction 11D4F = 'MOVAL B^00011D4F,W^0080(R9)'
79 'BRW 0001163A' ! 20051D4F
81 ! 19. Test 4E [20051edb] - memory byte write - ok, run from ROM
83 Replace/Byte 1521C = 3
86 ! 18. Test 4D [20051ff3] - memory addressing - ok, run from ROM
88 Replace/Byte 15233 = 3
91 ! 17. Test 4C [20052190] - ECC test - bypass, run from ROM
93 Replace/Byte 1524A = 3
96 ! 20052190/ brw 2005163a
97 Replace/Instruction 12190 = 'MOVAL B^00012190,W^0080(R9)'
98 'BRW 0001163A' ! 20052190
100 ! 16. Test 4B [2005264e] - masked writes with errors - bypass, run from ROM
102 Replace/Byte 15261 = 3
105 ! 2005264e/ brw 2005163a
106 Replace/Instruction 1264E = 'MOVAL B^0001264E,W^0080(R9)'
107 'BRW 0001163A' ! 2005264E
109 ! 15. Test 4A [20052823] - single bit correction - bypass, run from ROM
111 Replace/Byte 15278 = 3
114 ! 20052823/ brw 2005163a
115 Replace/Instruction 12823 = 'MOVAL B^00012823,W^0080(R9)'
116 'BRW 0001163A' ! 20052823
118 ! 14. Test 48 [20053062] - memory address shorts - bypass, run from ROM
120 Replace/Byte 1528F = 3
123 ! 20053062/ brw 2005163a
124 Replace/Instruction 13062 = 'MOVAL B^00013062,W^0080(R9)'
125 'BRW 0001163A' ! 20053062
127 ! 13. Test 47 [200536c3] - verify refresh - run from ROM
129 Replace/Byte 152AA = 3
132 ! 12. Test 41 [] - count bad pages, relocate bit map
133 ! 11. Test 44 [20050d34] - L1 with memory - bypass
134 ! 20050d34/ brw 20050fca
135 Replace/Instruction 10D34 = 'MOVAL B^00010D34,W^0080(R9)'
136 'BRW 00010FCA' ! 20050D34
138 ! 10. Test 36 [2004ffdf] - L2 with memory - bypass
139 ! 2004ffdf/ brw 20050428
140 Replace/Instruction 0FFDF = 'JSB L^0000CEFD'
141 'BRW 00010428' ! 2004FFDF
143 ! 9. Test 80 [2004d7de] - CQBIC memory - bypass last 2 subtests, run from ROM
144 ! 2004dbc0/ brw 2004dd8a
145 Replace/Instruction 0DBC0 = 'MOVB #1B,B^76(R9)'
146 'BRW 0000DD8A' ! 2004DBC0
149 Replace/Byte 152F6 = 3
152 ! 8. Test 54 [] - virtual mode - ok
153 ! 7. Test 34 [] - ROM in virtual mode - see previous notes
154 ! 6. Test C5 [] - SSC registers in virtual mode - ok
155 ! 5. Test 45 [2004ec5d] - cache, memory, CQBIC - bypass
156 ! 2004ec5d/ brw 2004ee90
157 Replace/Instruction 0EC5D = 'BICL2 #03,B^28(R9)'
158 'BRW 0000EE90' ! 2004EC5D
160 ! 4. Test 5A [2004eb5f] - CVAX CMCTL DAL drivers - ok
161 ! 3. Test 41 [20051096] - reset board
163 ! ===========================================================================
166 ! All of the above patches were done against the base ROM image extracted
167 ! from a genuine MicroVAX 3900. These were all part of SIMH prior to
168 ! extended memory support.
170 ! The Diagnostic State Variable DST$W_BITMAP_LENGTH, being 16 bits, can only
171 ! describe a PFN Bitmap describing up to, but NOT including 256MB of RAM. To
172 ! get to 256MB and beyond, we must correctly determine a correct bitmap size.
173 ! all of the Diagnostic state space is in use, either since it is already
174 ! defined, and the space beyond that is used for stack. So, we change the
175 ! references to DST$W_BITMAP_LENGTH to call a subroutine to properly determine
176 ! the PFN BITMAP size.
178 ! Most of the code which references DST$W_BITMAP_LENGTH are done from a
179 ! diagnostic test routine which may be relocated to RAM before execution.
180 ! The assumption of such relocating activity is that none of the relocated code
181 ! references any other instructions or data in the ROM image via any PC
182 ! relative addressing modes. Given this requirement, each of the above
183 ! patches must be done with a JSB to an explicit ROM address. As a
184 ! consequence, the patched instruction will generally be longer than the
185 ! instruction which is being replaced. To cleanly affect this
186 ! we must overwrite multiple instructions and incorporate the activities of
187 ! each of the overwritten instructions into the target subroutine.
188 ! Additionally, even without the relocation concerns, numerous places which
189 ! reference these extra routines may be beyond a PC relative displacement
190 ! due to the size of the ROM.
192 ! The KA655 ROM size is 128KB. As it turns out, the ROM image is only using
193 ! approximately 105,136 bytes of the total 131072 bytes. We use this unused
194 ! ROM space to store code which implements the required extra functionality
196 Define PATCH_BASE = 00019C00
197 Define P$END = PATCH_BASE
198 Define CP$K_MEMSIZE = 20080148
199 Define CP$K_QBMBR = 20080010
200 Define DST_BASE = 20140758
201 Define CTX_BASE = 201404B2
203 Define CTX$A_GPTR = 66
204 Define CTX$L_ERROR_COUNT = 54
205 Define CTX$L_ERROR_STATUS = 58
206 Define DST$W_BITMAP_LENGTH = 20
207 Define DST$A_BITMAP = 1C
208 Define DST$A_BUSMAP = 24
209 Define DST$W_BITMAP_CHECKSUM = 22
210 Define CP$CHECKSUM_RTN = 20041C6A
211 Define GUARD$S_GUARD_BLOCK = 12
212 Define GUARD$l_pc = 0
213 Define GUARD$a_gptr = 4
214 Define GUARD$w_rmask = 8
215 Define GUARD$l_save_error_count = 0A
216 Define GUARD$l_save_error_status = 0E
218 ! This routine determines the memory size of the current system. This is
219 ! done by referencing the CMCTL18 memory size register. On an older simulator
220 ! or one with less than 64MB of RAM configured, this register may not exist.
221 ! If it doesn't exist the machine check generated by the reference to the
222 ! non-existant register is caught, and the appropriate memory size is
223 ! determined from the existing PFN Bitmap size.
225 DEFINE GETMEMSIZE_R0 = P$End+1
226 Deposit/Instruction GETMEMSIZE_R0
228 ' subl2 #guard$s_guard_block, sp'
229 ' movw #0, B^guard$w_rmask (sp)'
230 ' movab B^G$ERR, B^guard$l_pc (sp)'
231 ' movl @#<ctx_base + ctx$a_gptr>, B^guard$a_gptr (sp)'
232 ' movl @#<ctx_base + ctx$l_error_count>, B^guard$l_save_error_count (sp)'
233 ' movl @#<ctx_base + ctx$l_error_status>, B^guard$l_save_error_status (sp)'
234 ' movl sp, @#<ctx_base + ctx$a_gptr>'
236 'G$ERR: movzwl @#<DST_BASE+DST$W_BITMAP_LENGTH>,R0'
237 ' clrl @#<ctx_base + ctx$l_error_count>'
238 ' clrl @#<ctx_base + ctx$l_error_status>'
241 'G$RD: movl @#CP$K_MEMSIZE,R0 '
242 'G$DON: movl @#<ctx_base + ctx$a_gptr>, sp'
243 ' movl B^guard$a_gptr (sp), @#<ctx_base + ctx$a_gptr>'
244 ' movl B^guard$l_save_error_count (sp), @#<ctx_base + ctx$l_error_count>'
245 ' movl B^guard$l_save_error_status (sp), @#<ctx_base + ctx$l_error_status>'
246 ' addl2 #guard$s_guard_block - 2, sp'
251 Define GETMAPENDADDR_R6 = P$End+1
252 Deposit/Instruction GETMAPENDADDR_R6
253 ' MOVZWL @#<DST_BASE+DST$W_BITMAP_LENGTH>,R6'
256 ' JSB GETMEMSIZE_R0 '
257 ' ashl #-^D12,R0,R6 '
259 'X$1: addl @#<DST_BASE+DST$A_BITMAP>,R6'
263 ! DE_QDSS_ANY [2004E2A8] Uses R6 for BitMap Size
264 ! 2004E390/ BSBW GETMAPSIZE_R6
265 Replace/Instruction 0E390
266 ' MOVZWL B^20(R9),R6 '
267 ' ADDL3 R6,B^1C(R9),R6 '
269 ' JSB GETMAPENDADDR_R6 '
273 DEFINE GETMAPSIZEMAPADDR_STACK = P$End+1
274 Deposit/Instruction GETMAPSIZEMAPADDR_STACK
275 ' PUSHL @#<DST_BASE+DST$A_BITMAP>,'
276 ' MOVL B^4(SP),-(SP) '
277 ' MOVZWL @#<DST_BASE+DST$W_BITMAP_LENGTH>,B^8(SP)'
280 ' JSB GETMEMSIZE_R0 '
281 ' ASHL #-^D12,R0,B^0C(SP) '
287 ! CP_FIND [200419E8] Uses (SP) for BitMap Size R1 Scratch
288 ! 20041A16/ BSBW GETMAPSIZE_STACK
289 Replace/Instruction 01A16
290 ' MOVZWL B^20(R0),-(SP) '
293 ' JSB GETMAPSIZEMAPADDR_STACK '
296 ! CP_SCAN [200459D0] Uses R3 for BitMap Size
297 DEFINE GETMBMEMSIZE_STACK = P$End+1
298 Deposit/Instruction GETMBMEMSIZE_STACK
299 ' MOVAB L^0000AACF,-(SP) '
300 ' MOVL B^4(SP),-(SP) '
302 ' JSB GETMEMSIZE_R0 '
303 ' ASHL #-^D20,R0,B^0C(SP) '
306 'GETMAPSIZE_R3: MOVZWL @#<DST_BASE+DST$W_BITMAP_LENGTH>,R3'
309 ' JSB GETMEMSIZE_R0 '
310 ' ASHL #-^D12,R0,R3 '
315 ! 20045B05/ BSBW GETMBMEMSIZE_STACK
316 Replace/Instruction 05B05
318 ' MOVAB L^0000AACF,-(SP) '
320 ' JSB GETMBMEMSIZE_STACK '
322 ! 20045B80/ BSBW GETMAPSIZE_R3
323 Replace/Instruction 05B80
324 ' MOVZWL @#20140778,R3 '
326 ' JSB GETMAPSIZE_R3 '
328 ! DE_CQBIC_MEMORY [2004D7B2]
329 DEFINE GETBITMAPPAGES_R5 = P$End+1
330 Deposit/Instruction GETBITMAPPAGES_R5
331 ' MOVZWL @#<DST_BASE+DST$W_BITMAP_LENGTH>,R5'
334 ' JSB GETMEMSIZE_R0 '
335 ' ASHL #-^D12,R0,R5 '
337 'X$4: ASHL #3,R5,R5 '
339 'GETBITMAPMEMSIZE_R3: MOVZWL @#<DST_BASE+DST$W_BITMAP_LENGTH>,R3'
342 ' JSB GETMEMSIZE_R0 '
343 ' ASHL #-^D12,R0,R3 '
345 'X$5: ASHL #^D12,R3,R3 '
348 ! 2004D8A5/ BSBW GETMAPSIZE_R5
349 Replace/Instruction 0D8A5
350 ' MOVZWL B^20(R9),R5 '
353 ' JSB GETBITMAPPAGES_R5 '
355 ! 2004DA41/ BSBW GETMAPSIZE_R5
356 Replace/Instruction 0DA41
357 ' MOVZWL B^20(R9),R5 '
360 ' JSB GETBITMAPPAGES_R5 '
362 ! 2004DA8C/ BSBW GETMAPSIZE_R5
363 Replace/Instruction 0DA8C
364 ' MOVZWL B^20(R9),R5 '
367 ' JSB GETBITMAPPAGES_R5 '
369 ! DE_CACHE_MEM_CQBIC [2004EBF0]
370 ! 2004ECD0/ BSBW GETMAPSIZE_R3
371 Replace/Instruction 0ECD0
372 ' MOVZWL B^20(R9),R3 '
375 ' JSB GETBITMAPMEMSIZE_R3 '
378 DEFINE GET_X_PFNMAP_SIZEADDR_STACK = P$End+1
379 Deposit/Instruction GET_X_PFNMAP_SIZEADDR_STACK
380 ' movl B^dst$a_bitmap (r11), r2'
381 ' movzwl B^dst$w_bitmap_length (r11), r1'
382 ' bneq X$20 ' ! Zero Bitmap size means extended mem
383 ' ashl #-^D12, @#CP$K_MEMSIZE, r1' ! Map Size = MEMSIZE/512/8
384 'X$10: brw X$70 ' ! already fixed
385 'X$20: cmpl r1, #^D16384 ' ! Original Map of 64MB?
386 ' blss X$10 ' ! Too Small For Extended
387 ' JSB GETMEMSIZE_R0 '
388 ' ashl #-^D12, R0, r1 ' ! Map Size = MEMSIZE/512/8
389 ' cmpl r1, #^D16384 '
390 ' beql X$10 ' ! Normal 64MB map
392 !; First move the Console Scratch Area (16KB), and the Qbus Map (32KB)
393 !; to the end of physical memory.
395 ' movl @#CP$K_MEMSIZE, r1 ' ! MEMSIZE
396 ' subl3 #^D48*^D1024, r1, r3 ' ! New Destination Address
397 ' addl #^D16384, r2 ' ! Point at end of prior Map
399 'X$63: movb (r2)[r0], (r3)[r0] ' ! Move the Console Scratch Pad and QBMRs
400 ' aoblss #^D48*^D1024, r0, X$63 '
401 ' movab W^4000(r3), B^DST$A_BUSMAP(r11)' ! Save Qbus Map Register Space
402 ' movab W^4000(r3), @#CP$K_QBMBR' ! Save Qbus Map Register Space
404 !; Fixup the boot device descriptor previously saved in the scratchpad RAM
406 ' subl3 #^D512, B^DST$A_BUSMAP (r11), r1'
407 ' movab B^8(r1), B^4(r1)'
409 !; Now we build a new bitmap, with all bits set except for the reserved
410 !; area containing the bitmap itself, and the console scratch area and
413 ' ashl #-^D12, @#CP$K_MEMSIZE, r1' ! Map Size = MEMSIZE/512/8
414 ' subl3 r1, r3, r2 ' ! Point at new Destination Address
415 ' movl r2, B^dst$a_bitmap (r11)' ! Save Bitmap address
416 ' ashl #-9, @#CP$K_MEMSIZE, r1 ' ! PFN count = MEMSIZE/512
417 ' ashl #-^D12, @#CP$K_MEMSIZE, r0' ! Map Size = MEMSIZE/512/8
418 ' addl #^D48*^D1024+^D511, r0 ' ! Plus other reserved page size
420 ' subl r0, r1 ' ! Adjust for bitmap of reserved pages
422 ' pushl r1 ' ! Save total Bit Count
423 ' ashl #-5, r1, r1 ' ! Convert limit to Longword Count
424 'X$632: movl #-1,(r2)[r0] ' ! Set bitmap entry for 32 pages
425 ' aoblss r1, r0, X$632 '
426 ' ashl #5, r0, r0 ' ! Convert back to Bit Count
427 ' movl (SP)+, r1 ' ! Restore total Bit Count
430 'X$64: bbss r0, (r2), X$65 ' ! Set page bitmap entry
431 'X$65: aoblss r1, r0, X$64 ' ! Done ?
432 'X$651: ashl #-9, @#CP$K_MEMSIZE, r1 ' ! PFN count = MEMSIZE/512
433 'X$66: bbcc r0, (r2), X$67 ' ! Clear reserved page bitmap entry
434 'X$67: aoblss r1, r0, X$66 ' ! Done?
435 ' clrl r0 ' ! Zero Initial checksum value
436 ' ashl #-^D12, @#CP$K_MEMSIZE, r1' ! Map Size = MEMSIZE/512/8
437 ' jsb @#cp$checksum_rtn ' ! Compute checksum for revised bitmap
438 ' movw r0, B^dst$w_bitmap_checksum (r11)' ! save it
439 ' clrw B^dst$w_bitmap_length (r11)' ! Mark as extended bitmap
440 ' ashl #-^D12, @#CP$K_MEMSIZE, r1' ! Map Size = MEMSIZE/512/8
441 ' movl B^dst$a_bitmap (r11), r2'
442 'X$70: jmp GETMAPSIZEMAPADDR_STACK'
444 'GETMAPSIZE_CTX_R2: movzwl @#<dst_base+dst$w_bitmap_length>,@#<ctx_base+ctx$l_r2>'
447 ' JSB GETMEMSIZE_R0 '
448 ' ASHL #-^D12,R0,@#<ctx_base+ctx$l_r2>'
452 Replace/Instruction 517F = 'movzwl B^20(r11), @#201404BA'
453 ' jsb GETMAPSIZE_CTX_R2 '
455 Replace/Instruction 514B
456 ' MOVZWL B^20(R11),-(SP) '
459 ' JSB GET_X_PFNMAP_SIZEADDR_STACK'
462 ! DE_MEMORY [200512AC]
465 ! Identify the Extended Memory Mode in the Console Banner
466 ! (i.e. KA655X-B vs KA655-B)
468 Replace 83D8 = 00303436
471 Replace/Byte 83DC = 4B
474 Deposit/Instruction 1C04
475 ' PUSHAB L^000083E2 '
476 ' JSB GETMEMSIZE_R0 '
477 ' CMPL R0, #<^D64*^D1024*^D1024>'
479 ' MOVAB L^000083D6,(SP) '
491 ! Extended Memory Patches:
492 ! 9. Test 80 [2004d7de] - CQBIC memory - bypass last 2 subtests, run from ROM
493 ! MP Revised to bypass tests starting at test of NXM reference through MAP
494 ! 2004db2e/ brw 2004dd8a
495 Replace/Instruction 0db2e = 'MOVB #17,B^76(R9)'
499 ! Interval Timer Patch
500 ! In operational environments, Test 82 subtests 17 and 20 have been observed
501 ! to ocaisionally fail. Disable the timer portion of the interval timer tests.
502 ! 2004e7c1/ brw 2004e870
503 Replace/Instruction 0e7c1 = 'MOVB #10,B^76(R9)'