VAXstation 100 firmware notes

From Computer History Wiki
Jump to: navigation, search

Some random notes from running the DEC-supplied standard firmware for the VAXstation 100 in an emulator.

The firmware analyzed announces itself as version 05.00. It deviates in minor details from the information in the 1983 "VS100 Engineering Specification".

Memory map

Firmware 5.00 extends the LOOPBACK region to one more word at 4A0004. Apparently this loops back the value written to 480004.

The BBA scratchpad has been moved to 30000. An accesses to a byte at 280000 seems to clear a BBA interrupt.


RAM memory map

Most of the RAM is available for uploaded software. However, regions at the ends are used by the ROM for fixed purposes:

000000 32 longwords Exception vectors
000080 15 longwords Saved screen contents under mouse pointer
0000C0 two words Mouse x,y copied from hardware register
0000C4 two words Old mouse x,y screen coordinates
0000C8 two words New mouse x,y screen coordinates
<01FFC0 extends towards lower addresses Stack
01FFC0 one longword Keyboard fifo read pointer
01FFC4 one longword Keyboard fifo write pointer
01FFC8 one longword Tablet fifo read pointer
01FFCC one longword Tablet fifo write pointer
01FFD0 one word Cursor column
01FFD2 one word Cursor line
01FFD4 Connection timeout counter
01FFD6 16 bytes Keyboard output fifo
01FFE6 16 bytes Tablet output fifo
01FFF6 one byte Size data in keyboard fifo
01FFF7 one byte Size data in tablet fifo
01FFF8 one byte Mouse buttons
01FFF9 one byte Keyboard input (LK201 code)
01FFFA one byte Tablet input
01FFFB one byte State of CTRL and SHIFT, for entering maintenance menu

Error LEDs

Indicates which test failed. During power-up, green light turned off. During idle loop, green light remains on.


Apparently there's a bug.



All VS100 interrupts use the autovector feature.

Firmware 5.00 doesn't use the level 1 interrupt. The firmware only reads the mouse position during maintenance test.


Keyboard test

The firmware transmits code FD (hex) to the LK201 keyboard, which commands it to jump to the power-up sequence and self-test. The keyboard transmits a four-byte message back. The VS100 ignores the keyboard ID, and checks that the third is not 3D.

This information is from the VT220 Technical Manual.

D0 flags

The firmware maintains a set of flags in register D0.

Bit (decimal) Meaning
16 Manufacturing mode.
17 BBA present.
18 Link down.
19 Power-up error.
20 LEDs locked.
21 Suppress printing test result.
22 In maintenance menu.
23 Keyboard ok.
24 BBA done.
25 Vertical retrace interrupt.
26 Test not executed. (E.g. hardware not present.)
27 Test timed out.
28 Host wants attention. (Same vector as TRAP #1?!?)

Built-in graphics

The firmware has a mouse pointer, a text font, and three icons. The first two are straight bitmaps, whereas the icons are run length encoded.

This is the font.

This icon is displayed when a user can be logged into the system.

This icon is displayed when there's an internal error.

This icon is displayed when there's a communication problem.


The firmware communicates with the host through a set of eight 16-bit registers. (There is also a 256K window into the host Unibus address space.)

These registers are written.

CSR0 Bit 0 - clear "go" bit.
CSR1 Interrupt reason.
CSR2 Peripheral event.
CSR3+CSR4 Unibus window address.
CSR5 Firmware version.
CSR6 BBA info.

These events are sent. Numbers are hexadecimal bit masks.

0001 Init done.
0002 Function performed ok.
0008 Mouse buttons.
0080 Powerup done.
8000 Function error.
8001 Bad function number.
8002 Bad command number.

These registers are read.

CSR0 Bit 0 - check "go" bit. Bits 1-5: function code.
CSR3+CSR4 Parameter.

These functions are implemented in ROM. Numbers are decimal.

1 Init - setup hardware.
2 Command - further decoded. Parameter is an address in Unibus memory.
3 Start firmware. Parameter is address.
5 Reset.
18 Clear infinite retry counter.
19 Clear finite retry counter.

BitBlit Accelerator

The BBA is a custom microcoded processor based on the Am2901 family. It was initially to be an optional add on, but later it was required. The BBA can access the frame buffer and has its own 256 by 16 bit scratchpad RAM.

The 68000 CPU communicates with the BBA through the scratchpad. When a command has been written, the CPU pokes a hardware register to signal the BBA to start. The BBA interrupts the CPU when done.

The contents and structure of the commands are being reverse engineered. The first word in the scratchpad is a bit mask indicating various functions to be done.

Scratchpad locations.

Address Size Firmware Function
000 16 bits 5F96, 60AC Command bitmask; see below
002 32 bits 5F9C, 3B2A Source bitmap address
006 16 bits 5FA6 Source x offset
008 16 bits 5FAA Source bitmap width in bytes
00A 32 bits 3B2E, 6014 Mask bitmap address
00E 16 bits Mask x offset
010 16 bits 6022 Mask bitmap width in bytes
012 32 bits 3B32 Destination bitmap address
016 16 bits Destination x offset
018 16 bits 3036 Destination bitmap width in bytes
01A 16 bits Mask width
01C 16 bits 6026 Mask height
01E 16 bits 5F98 ALU function
020 32 bits 5FB0 Tile address
024 16 bits Destination y offset
026 32 bits Line destination bitmap address
02A 16 bits Line steps (optionally including last point)
02C 16 bits Line major axis
02E 16 bits Line minor axis
030 16 bits Line x delta, when accumulator overflows (see below)
032 16 bits Line address, delta when accumulator overflows
034 16 bits Line x delta, when accumulator doesn't overflow
036 16 bits Line address delta, when accumulator doesn't overflow
038 16 bits Line mask x offset
03A 32 bits Line mask bitmap address
03E 16 bits Line mask bitmap width in bytes
040 32 bits
044 16 bits
046 16 bits
048 16 bits
04A 16 bits
04C 16 bits
04E 32 bits Cursor source bitmap address
052 16 bits Cursor source x offset
054 16 bits Cursor source width in bytes
056 32 bits Cursor mask bitmap address
05A 16 bits Cursor mask x offset
05C 16 bits Cursor mask width in bytes
05E 32 bits Cursor destination bitmap address
062 16 bits Cursor destination x offset
064 16 bits Cursor destination width in bytes
066 16 bits Cursor mask width
068 16 bits Cursor mask height
06A 16 bits Cursor ALU function
06C 32 bits (Cursor)

Command bits.

Bit Function
0 Use source bitmap
1 Use mask bitmap
2 Horizontal direction: 0 - right, 1 - left
3 Vertical direction: 0 - downwards, 1 - upwards
4 Use source tile
5 Draw cursor
6 Draw line

Scratchpad location 01E specifies a four-bit code for the ALU function. It's an enumeration of all possible logical functions between two binary inputs, where the code specifies the result.

Bits Function
0000 0
0001 src ∧ dst
0010 src ∧ ¬dst
0011 src
0100 ¬src ∧ dst
0101 dst
0110 src ⊻ dst
0111 src ∨ dst
1000 ¬(src ∨ dst)
1001 ¬(src ⊻ dst)
1010 ¬dst
1011 src ∨ ¬dst
1100 ¬src
1101 ¬src ∨ dst
1110 ¬(src ∧ dst)
1111 1

Line drawing is done with a classic Bresenham algorithm. For each step along the major axis, scratchpad location 02E is added to an accumulator. If the accumulator overflows, the location pair 030,032 is used to update the point on the line, and location 02C is subtracted from the accumulator. Otherwise, 034,036 is used.