AT&T 3B2/310 and 3B2/400 System Internals

Visual inspection reveals the following major components on the System Board.

• WE32100 CPU
• WE32101 MMU
• WE32102 Bi-phase Crystal Oscillator
• WE32106 Math Accelerator Unit (Optional)
• 4 x D2764A EPROMs holding the system boot ROM
• TMS2797NL floppy disk controller
• NEC μPD7261A hard disk controller
• NEC μPD8253C interval timer
• AM9517A Multimode DMA Controller
• SCN2681A Dual UART
• MM58174A Real Time/Time of Day clock

In addition to these major components, there is a tremendous amount of LSI glue logic, plus 14 PLAs/PALs on the system board. These seem to implement the DRAM controller, Control Status Register, and Interrupt Logic. Their exact layout is unknown, as no schematics are available.

Finally, there is one 18-pin DIP package IC labeled with in-house part number "O WE 62C", stamped with a date code and the number "53". The chip remains unidentified. Presumably it is custom LSI logic.

As stated, the CPU is the WE32100 32-bit CPU. It has both a 32-bit address bus and a 32-bit data bus. The CPU has 9 general purpose and 7 special purpose 32-bit registers, supports four privilege modes (User, Supervisor, Executive, Kernel), supports addressing in words (32-bit), halfwords (16-bit), and bytes (8-bit), and has a highly orthogonal instruction set with many addressing modes. It is paired with the WE32101 MMU, the WE32102 dual-phase crystal oscillator which provides two 10MHz clocks 90° out of phase, and the optional WE32106 Math Accelerator UNIT.

The WE32101 MMU provides virtual address to physical address translation using both segmented and paged memory.

On the 3B2, virtual address space is divided into four sections, identified by the top two bits of the address.

The MMU uses these top two bits as a Segment ID (SID) to look up the address in physical memory of a Segment Descriptor Table (SDT).

The next 13 bits of the address are known as the Segment Select field, and are used to index into the Segment Descriptor Table to find a Segment Descriptor.

The Segment Descriptor contains a bit that determines whether the virtual address being translated is to be treated as a Contiguous Segment, or Paged.

The rest of the bits of the virtual address are then treated differently depending on the value of this bit.

This process is described in great detail in the WE 32100 Microprocessor Information Manual and in the WE 32101 MMU datasheet.

This timer is responsible for driving much of the interrupt system. Its functions are IO mapped to the following addresses:

Counter 0

Set during ROM init. This appears mainly to be used for softpower status. The clock for Counter 0 on pin 9 runs at 100KHz.

Counter 1

Set during UNIX boot. Provides the level 15 interrupt used by UNIX for process switching. This is initialized to 0x03e8 (decimal 1000) by UNIX in the function clkstrt(). This gives us a period of 10ms, since the clock on Counter 1 on pin 15 runs at 100KHz.

Counter 2

Set during ROM init. The clock for Counter 2 on pin 18 runs at 2MHz. We don't know what this is for. It's not referenced in the AT&T source code. The ROM initialization puts 0xa (decimal 10) into the counter, so the timer output (if enabled) would pull low for 500ns every 5μs. So far, I have observed only that the gate is set so that this timer is not enabled.

This is just a set of latches that can be set or cleared by writing to various memory locations, or read as a single 16-bit value. The base address of the CSR is at 0x44000.

Two 74LS374 Octal D-Type latches provide the 16-bit CSR.

The structure struct wcsr in usr/src/uts/3b2/sys/csr.h describes the programmer-accessible latch bits. There are no comments in the source, so comments are my own.

The 16 bits of the CSR, when read, map to the following values.

The UART provides two serial ports integrated into the main system. One is the console, the other is a secondary TTY. Additionally, the UART provides a general purpose counter/timer circuit with an interrupt output.

The UART is clocked at 230.525 KHz. Due to the 16-bit counter, the maximum delay for the UART interrupt timer is 284 ms.

The standard floppy drive (known as IF, "Integrated Floppy") is a CDC 9429. The floppy format used is a little unusual: It is a Double-Sided, Quad Density format (DSQD) holding 720KB per diskette. The format is:

• Double sided
• 80 tracks per side
• 9 sectors per track
• 512 bytes per sector
• 3:1 interleave
• 250kbps MFM data

The ROM is mapped too the bottom 64KB of the address space, at physical addresses 0x00000000 – 0x0000ffff. The ROM itself is only 32KB, so I still need to do some additional diagnostic programming to determine exactly how the ROM maps to the top half of its space, if at all.

When running under SVR3, the ROM is mapped at virtual address 0x00020000.

I have decoded and disassembled the ROM, and discovered that there are several distinct areas

• Strings
• Vector Tables
• Code
• System Version Number

Looking through the SVR3 source code has revealed the following system board map, in the file usr/src/uts/3b2/vuifile.

Main memory ("mainstore") appears to start at 0x2000000 on the 3B2. Interestingly, on SYSVR3 this is mapped to /dev/mainstore.

The 3B2 interrupt subsystem takes interrupt inputs from several sources on the system board and translates them into values on the CPU's four bit IPL (Interrupt Priority Level) bus. The IPL bus is fed by a 74LS148 priority encoder.

The hard disk controller (ID), floppy disk controller (IF), and DUART (IU) interrupt outputs are directly connected to the priority encoder (potentially through inverters), and are cleared when the originating device de-asserts its IRQ line. The System Timer, however, is supplied to the priority encoder through a latch that is reset by software. Likewise, the CSRPIR8 and CSRPIR9 software interrupts are supplied through the CSR latches, and are reset by software.

IRQs are serviced by the CPU if and only if the PSW (processor status word) has an IPL field that is less than the corresponding IPL bus level. For example, if the PSW's IPL field is set to 15, no IRQs will be processed. If the PSW's IPL field is set to 12, only IRQs with priority level 13 or 15 will be processed.

An IPL bus level of 15 means that no IRQs are pending.

The 3B2 interrupt subsystem takes input from the following sources:

The PCB pointed at by the PCBP 0x0200BC8 is in RAM space, so the ROM must set it up during startup.

The PCB gets set up like this:

This sets up the address of the routine to call at 0x40A0.

000040a0: 84 ce fc 40                MOVW -4(%isp),%r0
000040a4: 84 50 7f 58 12 00 02       MOVW (%r0),$0x2001258
000040ab: 70                         NOP
000040ac: 84 c0 04 7f 5c 12 00 02    MOVW 4(%r0),$0x200125c
000040b4: 70                         NOP
000040b5: 87 00 7f 60 12 00 02       MOVB &0x0,$0x2001260
000040bc: 70                         NOP
000040bd: 2c 5c 7f ec 64 00 00       CALL (%sp),$0x64ec
000040c4: 30 c8                      RETPS

Here, the call to 0x64EC is the important bit.

000064ec: 10 49                      SAVE %fp
000064ee: 9c 4f 00 00 00 00 4c       ADDW2 &0x0,%sp
000064f5: 2c 5c ef f8 11 00 02       CALL (%sp),*$0x20011f8
000064fc: 04 c9 e8 4c                MOVAW -24(%fp),%sp
00006500: 20 49                      POPW %fp
00006502: 08                         RET
00006503: 70                         NOP

The routine at 0x64EC is responsible for calling a routine pointed at by 0x20011f8. That location is the "real" interrupt handler, and is frequently updated inside the ROM as different handlers are required. Thus, the ROM can insert any arbitrary code as an interrupt handler at any time.

The hard disk is initialized on boot as described below.

• The hard disk controller is asked to reset with an AUX RESET command.
• The processor examines bit 7 of the status register, CONTROLLER BUSY. If the device is available, we clear the data buffer and CE bits, then give it the SPECIFY command with the following arguments:
  • 0x18 means Soft Sectored, Stepping Rate 3.
  • 0xf2 is the DTLH byte. The first nybble means:
    • initialize the Polynomial Counter with all 1s
    • Select ID and data pad of 0x4e
    • Polling mode is OFF
  • 0x00 is the DTLL byte. It is appended to the low nybble of DTLH to form the word 0x200, meaning a data length of 512 bytes.
  • 0x03 is the Ending Track Number (ETN)
  • 0x11 is the Ending Sector Number (ESN)
  • 0x0d is the Gap 2 Length
  • 0x00 is the Reduced Write Current cylinder high byte
  • 0x80 is the Reduced Write Current cylinder low byte

  NB: "ETN" and "ESN" are used to convert logical cylinders and sectors to physical cylinders and sectors, as described in the uPD7261 datasheet:

"LSN is incremented at the end of each sector until the value of ESN is reached. LSN is then set to 0 and LHN is incremented. If LHN reaches the value of ETN, then LHN is cleared and LCN is incremented."

• The host checks to see if the command completed successfully. If it did, the CEH bit of the status register should be set, and the CEL bit should be clear.
• The host issues a CLEAR CE BITS command to clear CEH and CEL.
• The host issuesa CLEAR DATA BUFFER command.
• The host issues another CLEAR CE BITS command.
• The host issues a SENSE UNIT STATUS command with the argument 0x1e. This argument is the UNIT STATUS (UST) byte and is broken down into the following bits:
  • bits 7-5: Always 0
  • bit 4: Drive Selected SET
  • bit 3: Seek Complete SET
  • bit 2: Track 0 SET
  • bit 1: Ready SET
  • bit 0: Write Fault CLEAR
• The host again checks for successful completion of this command.
• The host then reads the data field, which should be a UNIT STATUS byte containing the current status of the drive:
  • bits 7-5: Always 0
  • bit 4: Drive Selected SET
  • bit 3: Seek Complete SET
  • bit 2: Track 0 SET
  • bit 1: Ready SET
  • bit 0: Write Fault CLEAR
• The host clears the data buffer and the CE bits again
• The host issues a RECALIBRATE command. RECALIBRATE repositions the drive head to Cylinder 0. IST is available as a result byte.

… Much more to come, as I need to document it.

In this figure, numbers are somewhat arbitrarily ordered, but roughly from top to bottom, right to left.

• The 12 82S153 PLAs are marked: AAUWG, ABGLU, AAUWS, AAYBN, AAUWH, AAUWL, AAUWT, ABGWT, AAUWN, AAUWK, AAUWR, AAUWJ