Attached all the Open Firmware stuff from the ROM. You can use the tbxi command to dump other parts.
Strange it has the same version as the 8500 v2 / S900 rom.
Code:
077d.28f2 "Boot TNT 0.1p..]" 4096 962f6c13 √ 676809c236138574282fa8416c6c5a6d "./ROM PowerPC Mac/ROM 1.1.22 ANS 500 & 700/ROMs/@FFC00000 Entire ROM.rom"
077d.28f2 "Boot TNT 0.1p..]" 4096 9630c68b √ 2623a0c438045ea04d2cc67310c97743 "./ROM Apple/#1 mac-rom-archive-20110819/9630C68B - Power Mac 7200&7500&8500&9500 v2.ROM"
The ANS 500 & 700 ROM version of Open Firmware (1.1.22) has names for all the words, unlike 1.0.5 so it's easier to read if you don't have 1.0.5 source.
It outputs Open Firmware progress to serial port depending on some external switch that changes the baud-rate (9600 or 38400 or none). I think the switch is a couple bytes in PRAM or NVRAM.
Other info that would be useful is:
dump-device-tree
lspci for Open Firmware (for PCI register dumps)
Non PCI register dumps (but that requires knowing what registers to dump - I would start with everything in GrandCentral (1 MB at 0xf3000000) and 0x800 bytes from Hammerhead.
All the Open Firmware code is in the Part1.txt and Part2.of files.
Open Firmware has a few parts:
@startvec
at offset 00003C and described by fields >imagesize
to >r13-31
- some assembly stuff at offset 0001BC
- a list of precompiled words starting at offset 000B74 and described by fields
>h.link
to >h.name
; the last word is pointed to by @startvec.>word-list
- the main fcode image at offset 007514 pointed to by
@startvec.>fcimage
- a list of other fcode images described by fields
>of.next
to >of.fcode
starting at offset 01C88C; the last image is pointed to by @startvec.>fcfiles
All these parts are in Part1.txt. The fcode is removed from Part1.txt and converted to Forth in Part2.of.
There's 53c94 and mesh built into Grand Central. I don't know if they're connected at all.
Code:
/bandit/gc/53c94 scsi
/bandit/gc/mesh scsi-int
Here is the device aliases for the new PCI SCSI stuff:
Code:
/bandit/53c825@11 scsi-int
/bandit/53c825@12 scsi-int2
/bandit/53c825@11/sd@0,0 disk0
/bandit/53c825@11/sd@1,0 disk1
/bandit/53c825@11/sd@2,0 disk2
/bandit/53c825@11/sd@3,0 disk3
/bandit/53c825@12/sd@4,0 disk4
/bandit/53c825@12/sd@5,0 disk5
/bandit/53c825@12/sd@6,0 disk6
There's three choices in chips:
Code:
pci1000,f 53c875 NCR,875
pci1000,3 53c825 NCR,825A or NCR,825
But the device aliases are only for the 53c825.
There's an fcode image for the PCI vendor:device 1000:0003 at offset 01D1C4. It determines which chip is being used. probe-device loads the fcode image for PCI device 1000:0003 and 1000:000F.
fcode image 4 at offset 01FE84 is used for the drives connected to the scsi controller. This fcode image is also used by 53c94 and mesh. 53c94 and mesh use fcode image 3 at offset 01F8F4 for tape devices.