opencode.energia.arti.ee/sgi-indy

0 Fork 0

Files

T

opencode.energia.arti.ee 3a56de7757 Add all-in-one IRIX network install server

Provide BOOTP, TFTP (including SGI boot-tape TPD members) and the BSD
rsh/rcmd service that IRIX inst needs. Map exec /bin/sh to mksh or dash
and run the shell in a read-only bubblewrap sandbox with an
IRIX-compatible dd wrapper. Add protocol tests and a usage guide.

2026-11-02 14:39:54 +00:00

4.4 KiB

Raw Permalink Blame History

sgi-indy

Research workspace for the Silicon Graphics Indy (IP24) workstation, focused on its boot PROM.

The repository contains:

a reproducible fetcher and checksum manifest for the four MAME indy_4610 PROM dumps;
a tool that wraps a raw PROM dump in a minimal ELF32 big-endian MIPS image so it can be opened by Ghidra/REA at its real address;
a structural map of the newest PROM, ip24prom.070-9101-011.bin (SGI Version 5.3 Rev B10, 12 Feb 1996);
the full 1,074-entry function index produced by Ghidra auto-analysis;
notes for reproducing the REA + Ghidra setup.

Result at a glance

Item	Value
Newest Indy PROM	`ip24prom.070-9101-011.bin`, 524,288 bytes
Version string	`SGI Version 5.3 Rev B10 R4X00/R5000 IP24 Feb 12, 1996`
SHA-1	`ac663a4db68528e400487e98cbf901f620fb30ce` (matches MAME)
SHA-256	`333a0b2e39bb828a28a758b6f633ae7290030129dc747297a1be68dc317b86ae`
Load address	`0x1FC00000` (BIOS window)
Analyzed code span	`0x1FC00000` - `0x1FC4A8A0`, 1,074 functions
Defined strings	1,418, from `0x1FC01B7C` to `0x1FC7C16B`
Used bytes	`0x00000` - `0x7F9FF`; remainder is `0xFF` padding

See docs/rom-map.md for the memory map, exception-vector table, boot flow and function anchors. See docs/rom-map.json for the machine-readable layout and docs/procedure-index.csv for every function start.

ROM files

The four PROM dumps from the MAME 0.236 indy_4610 set are committed under roms/ for preservation, together with roms/SHA1SUMS. The MAME zip and the generated ELF wrapper stay ignored.

The dumps can be re-fetched and verified with:

./tools/fetch-roms.sh

The fetch script downloads the indy_4610 set and checks every SHA-1 against MAME's src/mame/sgi/indy_indigo2.cpp.

Reproduce the analysis

Prerequisites: Node.js 22.23.4+, REA (npm install -g rea-agents), Ghidra 12.1.x and JDK 21. This workspace used REA 6.8.0, Ghidra 12.1.2 and OpenJDK 21.

export GHIDRA_INSTALL_DIR=/opt/ghidra
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64

./tools/fetch-roms.sh
./tools/make-elf-wrapper.py \
  roms/ip24prom.070-9101-011.bin -o roms/indy-ip24-5.3-b10.elf

rea analyze roms/indy-ip24-5.3-b10.elf --provider ghidra --json

REA's headerless raw-binary lane does not include MIPS. The wrapper declares ELF32, big-endian, ET_EXEC, e_flags = EF_MIPS_ARCH_32 and no ABI-flags record, which selects REA's recordless MIPS admission and pins Ghidra to MIPS:BE:32:default. The ROM bytes are copied unchanged at file offset 0x1000 and mapped at 0x1FC00000.

To regenerate the checked-in map and function index, open the wrapper in a REA session, export its evidence bundle, then run:

./tools/rom-map.py roms/ip24prom.070-9101-011.bin \
  --evidence evidence/rea-bundle.json \
  --output docs/rom-map.json \
  --procedures-csv docs/procedure-index.csv

IRIX network install server

tools/irix_netinstall.py is an all-in-one BOOTP + TFTP + rsh server for netbooting the PROM and running the IRIX inst installer over the network.

It maps the exec /bin/sh session that inst opens to mksh (falling back to dash), never to bash or csh, and runs it in a read-only bubblewrap sandbox. It also serves TFTP from the install tree, including the SGI boot-tape file(member) syntax.

sudo ./tools/irix_netinstall.py \
    --root /srv/irix --server-ip 10.0.0.1 \
    --client-ip 10.0.0.2 --client-mac 08:00:69:07:dc:e0 \
    --bootfile /6.5.30/stand/fx.ARCS

See docs/netinstall.md for the install tree layout, PROM and inst steps, and the protocol details.

Repository layout

docs/       map, network-install guide, setup notes, generated JSON/CSV
roms/       ROM dumps and the SHA-1 manifest
tools/      fetch, ELF wrapper, map generator, install server, tests
evidence/   local REA bundle (ignored)

Setup notes

The Gitea remote is https://git.wut.ee/opencode.energia.arti.ee/sgi-indy. See docs/rea-setup.md for the exact REA/OpenCode configuration used here.

Sources and attribution

MAME indy_indigo2.cpp for the IP22/IP24 memory map and ROM identities: https://github.com/mamedev/mame/blob/master/src/mame/sgi/indy_indigo2.cpp
MAME 0.236 ROM set archive used for the dumps.
MiSTer SGIIndy_MiSTer ROM directory used as a cross-check.
REA: https://github.com/morluto/rea

4.4 KiB Raw Permalink Blame History