opencode.energia.arti.ee
3a56de7757
Provide BOOTP, TFTP (including SGI boot-tape TPD members) and the BSD rsh/rcmd service that IRIX inst needs. Map exec /bin/sh to mksh or dash and run the shell in a read-only bubblewrap sandbox with an IRIX-compatible dd wrapper. Add protocol tests and a usage guide.
125 lines
4.4 KiB
Markdown
125 lines
4.4 KiB
Markdown
# sgi-indy
|
|
|
|
Research workspace for the Silicon Graphics Indy (IP24) workstation, focused on
|
|
its boot PROM.
|
|
|
|
The repository contains:
|
|
|
|
- a reproducible fetcher and checksum manifest for the four MAME `indy_4610`
|
|
PROM dumps;
|
|
- a tool that wraps a raw PROM dump in a minimal ELF32 big-endian MIPS image so
|
|
it can be opened by Ghidra/REA at its real address;
|
|
- a structural map of the newest PROM, `ip24prom.070-9101-011.bin`
|
|
(SGI Version 5.3 Rev B10, 12 Feb 1996);
|
|
- the full 1,074-entry function index produced by Ghidra auto-analysis;
|
|
- notes for reproducing the REA + Ghidra setup.
|
|
|
|
## Result at a glance
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| Newest Indy PROM | `ip24prom.070-9101-011.bin`, 524,288 bytes |
|
|
| Version string | `SGI Version 5.3 Rev B10 R4X00/R5000 IP24 Feb 12, 1996` |
|
|
| SHA-1 | `ac663a4db68528e400487e98cbf901f620fb30ce` (matches MAME) |
|
|
| SHA-256 | `333a0b2e39bb828a28a758b6f633ae7290030129dc747297a1be68dc317b86ae` |
|
|
| Load address | `0x1FC00000` (BIOS window) |
|
|
| Analyzed code span | `0x1FC00000` - `0x1FC4A8A0`, 1,074 functions |
|
|
| Defined strings | 1,418, from `0x1FC01B7C` to `0x1FC7C16B` |
|
|
| Used bytes | `0x00000` - `0x7F9FF`; remainder is `0xFF` padding |
|
|
|
|
See [docs/rom-map.md](docs/rom-map.md) for the memory map, exception-vector
|
|
table, boot flow and function anchors.
|
|
See [docs/rom-map.json](docs/rom-map.json) for the machine-readable layout and
|
|
[docs/procedure-index.csv](docs/procedure-index.csv) for every function start.
|
|
|
|
## ROM files
|
|
|
|
The four PROM dumps from the MAME 0.236 `indy_4610` set are committed under
|
|
`roms/` for preservation, together with `roms/SHA1SUMS`. The MAME zip and the
|
|
generated ELF wrapper stay ignored.
|
|
|
|
The dumps can be re-fetched and verified with:
|
|
|
|
```bash
|
|
./tools/fetch-roms.sh
|
|
```
|
|
|
|
The fetch script downloads the `indy_4610` set and checks every SHA-1 against
|
|
MAME's `src/mame/sgi/indy_indigo2.cpp`.
|
|
|
|
## Reproduce the analysis
|
|
|
|
Prerequisites: Node.js 22.23.4+, REA (`npm install -g rea-agents`), Ghidra 12.1.x
|
|
and JDK 21. This workspace used REA 6.8.0, Ghidra 12.1.2 and OpenJDK 21.
|
|
|
|
```bash
|
|
export GHIDRA_INSTALL_DIR=/opt/ghidra
|
|
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64
|
|
|
|
./tools/fetch-roms.sh
|
|
./tools/make-elf-wrapper.py \
|
|
roms/ip24prom.070-9101-011.bin -o roms/indy-ip24-5.3-b10.elf
|
|
|
|
rea analyze roms/indy-ip24-5.3-b10.elf --provider ghidra --json
|
|
```
|
|
|
|
REA's headerless `raw-binary` lane does not include MIPS. The wrapper declares
|
|
ELF32, big-endian, `ET_EXEC`, `e_flags = EF_MIPS_ARCH_32` and no ABI-flags
|
|
record, which selects REA's recordless MIPS admission and pins Ghidra to
|
|
`MIPS:BE:32:default`. The ROM bytes are copied unchanged at file offset `0x1000`
|
|
and mapped at `0x1FC00000`.
|
|
|
|
To regenerate the checked-in map and function index, open the wrapper in a REA
|
|
session, export its evidence bundle, then run:
|
|
|
|
```bash
|
|
./tools/rom-map.py roms/ip24prom.070-9101-011.bin \
|
|
--evidence evidence/rea-bundle.json \
|
|
--output docs/rom-map.json \
|
|
--procedures-csv docs/procedure-index.csv
|
|
```
|
|
|
|
## IRIX network install server
|
|
|
|
`tools/irix_netinstall.py` is an all-in-one BOOTP + TFTP + rsh server for
|
|
netbooting the PROM and running the IRIX `inst` installer over the network.
|
|
|
|
It maps the `exec /bin/sh` session that `inst` opens to **mksh** (falling back
|
|
to **dash**), never to bash or csh, and runs it in a read-only bubblewrap
|
|
sandbox. It also serves TFTP from the install tree, including the SGI boot-tape
|
|
`file(member)` syntax.
|
|
|
|
```sh
|
|
sudo ./tools/irix_netinstall.py \
|
|
--root /srv/irix --server-ip 10.0.0.1 \
|
|
--client-ip 10.0.0.2 --client-mac 08:00:69:07:dc:e0 \
|
|
--bootfile /6.5.30/stand/fx.ARCS
|
|
```
|
|
|
|
See [docs/netinstall.md](docs/netinstall.md) for the install tree layout, PROM
|
|
and `inst` steps, and the protocol details.
|
|
|
|
## Repository layout
|
|
|
|
```
|
|
docs/ map, network-install guide, setup notes, generated JSON/CSV
|
|
roms/ ROM dumps and the SHA-1 manifest
|
|
tools/ fetch, ELF wrapper, map generator, install server, tests
|
|
evidence/ local REA bundle (ignored)
|
|
```
|
|
|
|
## Setup notes
|
|
|
|
The Gitea remote is
|
|
<https://git.wut.ee/opencode.energia.arti.ee/sgi-indy>.
|
|
See [docs/rea-setup.md](docs/rea-setup.md) for the exact REA/OpenCode
|
|
configuration used here.
|
|
|
|
## Sources and attribution
|
|
|
|
- MAME `indy_indigo2.cpp` for the IP22/IP24 memory map and ROM identities:
|
|
<https://github.com/mamedev/mame/blob/master/src/mame/sgi/indy_indigo2.cpp>
|
|
- MAME 0.236 ROM set archive used for the dumps.
|
|
- MiSTer `SGIIndy_MiSTer` ROM directory used as a cross-check.
|
|
- REA: <https://github.com/morluto/rea>
|