Subject: another nvram.faq mod for your collection

From: "Rick Caldwell, Schlumberger GeoQuest, 214-980-7924" <[email-masked]>
Date: Mon, 3 Apr 1995 9:23:34 -0500 (CDT)

Information on NVRAMs on Sun Machines

(a modified nvram.faq with some more info)

The current Sun Sparc 1 & Sparc 1+ machines have a battery backed 
NVRAM in them.  The battery is good for approx 5 years, so some of the
older Sun machines are starting to develop problems.  It usually 
starts as eeprom checksum errors during boot.  You may also start getting
messages about the system disk having problems during bootup and eeprom
checksum errors.

[ comment by [email-masked] - the sun4m machines use a different
  chip with a longer battery life. This problem typically occurs with 
  sun4c machines (sparc 1,1+,2,IPX,IPC,ELC,SLC etc...) and the Sun 3/80. 
  The procedure for altering the NVRAM on a sun4m machine as well as on a 
  Sun 3/80 is different. These other procedures are detailed in nvram.info 
  in the latest version of change-sun-hostid available from 
  ftp.netcom.com:/pub/he/henderso ]

I don't know if the sparc 2's and 10' use the same chip but it probably
wouldn't hurt to gather the information now that is stored in the nvram
so that it can be replaced.  Two things are stored in the nvram that you
need to save before it goes bad, the hostid and the ethernet address.
You can get the hostid with the showrev command.  The ethernet address
is reported during bootup, or if you cd to /var/adm and use grep to
find the address:

  grep -i ethernet message*

You can also use the devinfo command to dump the current contents of the 
nvram - this is probably the handiest as it is easy to program back end
to the chip, where if you get it as just a hostid and ethernet address
you'll have to figure out how to store the info in the words that are to
be programmed into the new chip.

command and sample response

devinfo -vp | grep idprom
        idprom:  01570800.200d80ea.2b01482e.218edf25.00000000.00000000.00000000.
00000000

This is an example of a dump of a sparc 1+ with a Weitek upgrade,
hostid 57218edf, ethernet address 08:00:20:0d:80:ea

Here is the command for getting the idprom information from a machine running 
Solaris 2.x.

# prtconf -pv | grep idprom
 idprom:  01510800.2008e110.25d86cc6.00fd7f54.00000000.00000000.a5a5a5a5.a5a5a5a

	From the FAQ

      The idprom is a 32 bytes part of the non-volatile ram. The last 16 bytes
      of it have been reserved (i.e.: 0). The .idprom forth command and the
      "/usr/etc/devinfo -vp | grep idprom" SunOS 4.x command give you those
      32 bytes. A very crude way of putting data in the idprom is:

      Then turn on the SS and let it discover that the NVRAM is empty. It fills
      it with factory default values but leaves the idprom contents untouched.
      The idprom is stored at offset 0x7D8 in the 2kB static RAM. To prevent
      writing in the NVRAM, the NVRAM page is read-only.

      **** Dangerous Action ****
      To change the hostid, power on the SS and get into the monitor (ok 
      prompt).  Then make the NVRAM page writeable:

        enter the forth (boot prom) monitor (e.g. via L1-a, possibly
        followed by "n <ret>".  To enter the data a byte at a time
	do it as follows (for words at a time see note below).
	
	Note: these addresses work for a Sparc 1 and a Sparc 1+, other
	machines may have a different address.

            ok f7002000 ffd04700 pgmap!    <-- make the page writeable
            ok 01 ffd047d8 c!
            ok 51 ffd047d9 c!   <-- note: if wrong may crash during boot
            ...
            ok 00 ffd047f6 c!
            ok 00 ffd047f7 c!
            ok reset

      The 32 bytes are the 32 successive bytes reported by the .idprom command
      or devinfo command. You might use the l! forth command to store 32 bits.
      This saves you some typing. Note that the `51' is only valid for
      SparcStation 1 computers; other systems have other numbers...
	Note: If you put the wrong number in for the system type you may not
	be able to boot due the the kernal not supporting that system type.

[ comment from [email-masked] -- for other machines substitute
  the following for 51 above

    51  SPARCstation 1   (4/60)
    52  SPARCstation IPC (4/40)
    53  SPARCstation 1+  (4/65)
    54  SPARCstation SLC (4/20)
    55  SPARCstation 2   (4/75)
    56  SPARCstation ELC (4/25)
    57  SPARCstation IPX (4/50) ]

	(or for faster programming you can enter the entries 4 bytes at a time)

words from 		     data    address command
devinfo 	ok f7002000 ffd04700 pgmap!	<- enable writes
command ------> ok 01510800 ffd047d8 l!	
		ok 200740c7 ffd047dc l!
		ok 00010203 ffd047e0 l!
		ok 12345687 ffd047e4 l!
		ok 00000000 ffd047e8 l!
		ok 00000000 ffd047e8 l!
		ok 00000000 ffd047ec l!
		ok 00000000 ffd047f0 l!
		ok 00000000 ffd047f4 l!
		ok reset			<- reboot saving info

		ok .idprom			will view the contents of the
						nvram
		ok ffd047d0 64 dump		this lists on the screen the
						data in hex like it was
						entered.

      !!! Please note that this procedure might make your SparcStation !!!
      !!! unusable if not correctly executed. Sun definitely does NOT  !!!
      !!! support this. Be very carefull when restoring the contents   !!!
      !!! of your IDPROM.                                              !!!

      **** End Dangerous Action ****

      I urge you to use extreme precaution changing the contents of the idprom!
      Doing something wrong can make your SparcStation unusable. Always first
      use the .idprom command and write down the current contents of the idprom
      before changing anything.

      The checksum is an exclusive-or of the first 15 bytes of the idprom.
      If you have a hex calculator you can compute the checksum by xoring
      the bytes in the words above to get the checksun.  In the above
      example you could calculate it as follows:

		01 51 08 00 	- 01 xor 51 xor 08 xor 00 = 58
		20 07 40 c7 	- 20 xor 07 xor 40 xor c7 = a0
		00 01 02 03 	- 00 xor 01 xor 02 xor 03 = 00
		12 34 56 -- 	- 12 xor 34 xor 56        = 70
							   ----
					xor of above column 88

	The xor operation is commutative so you could also get the same
	answer by xoring in columns - do whichever is easier.  You can
	also skip over the 00 bytes.  Even faster is to xor the words
	together, then xor the bytes of the answer (dropping leading and
	trailing bytes of zeros as the order doesn't matter, just so all 
        the non-zero bytes are included):

                    15108	trailing 00 dropped
            xor  200740c7       
            xor     10203       leading 00 dropped
            xor    123456
	-----------------
                 2015279a
	
	then xor the answer bytes  20 xor 15 xor 27 xor 9a  = 88

	Replacement options:

      Getting a new nvram from Sun:
      -----------------------------

	When I called Sun they wanted me to return the system unit for
	repair at about $1300 dollars, they claimed the chip wasn't 
	available.  You might have better luck if you can find the
	right person/group to talk to.

	I also called a local distributor for SGS/Thompson (the new
	owners of Mostek), Sterling Electronics and they had the chips 
	for about $16 apiece, with a min order of $25.  
	(Mostek MK48T02b-25 chip  250ns or faster chip).

  One last possible problem:
  --------------------------
  The clock needs a kick in the *** to start running.
  (In a virgin nvram it's in sleeping mode to save on battery life)
  The clock driver should be able to handle this.
  From /usr/include/machine/clock.h (/usr/include/sys/clock.h in solaris2)
  you can see how this is done.

  Resetting the date, or rebooting will probably get it to started agian.

  *************************************************************************
                               IDPROM TEMPLATE
  *************************************************************************

The idprom.h include file is a copyrighted document you can slurp yourself
from any Sun Os 4.1.x server you have access to... like yours 
(/usr/include/mon/idprom.h) ?!

Here is in short how the idprom is like on a Sun Sparcstation IPC with BOGUS
hostid and date.  The ethernet address is the one used in the FAQ.
Use your parameters instead!

HOSTID:  It's the hex representation of the Serial Number with a leading CPU
ID byte.  Here 51 and 12 34 56, so HOSTID = 51123456

Bogus but possible machine profile :
====================================
Sparc IPC, sun4c 4/40
Serial #1193046
Ethernet: 8:0:20:7:40:c7
HOSTID: 51123456
date: 0 1 2 3
Checksum: 87

(All values in table are in hex !!!)

BYTE	Address		Value		Description
=============================================================================
 1	ffd047d8	01		Always 01... Means prom number.	
 2	ffd047d9	51		CPU ID, 51 for sun4c, SPARC 1+
 3	ffd047da	08		First number of ethernet address
 4	ffd047db	00		Second	""   ""    ""       ""
 5      ffd047dc	20		Third   ""   ""    ""       ""
 6      ffd047dd	07		4th	""   ""    ""       ""
 7      ffd047de	40		5th	""   ""    ""       ""
 8	ffd047df	c7		6th number of ethernet address
 9	ffd047e0	00		1rst number for DATE of manufacture
10	ffd047e1	01		2nd number for DATE
11	ffd047e2	02		3rd number for DATE
12	ffd047e3	03		4th number for DATE
13	ffd047e4	12		Serial Number (part 1 of 3)
14	ffd047e5	34		Serial Number (part 2 of 3)
15	ffd047e6	56		Serial Number.gif (part 3 of 3 :)
16	ffd047e7	88		Checksum byte.

17	ffd047e8	00		UNUSED
..      ........        ..              ......
32	ddf047f7	00		UNUSED

The chip used in the Sun is a Mostek MK48T02b-25 2k nvram.  When you look at
the motherboard you will see an integrated circuit chip that is taller than
the reset of the chips - it has about an 3/16" backpack on it that contains
a battery & clock chip.

  The contents of the (nv)ram are backed up by a 3V lithium battery.
  It's located together with a quartz on top of the ram in a kind of backpack.
  The battery is on the side that's opposed to the dot marking pin 1,
  next to pin 12:

                         _oscillator
                        /
                       / _battery
                      / /
                   -------
                   | O O | <-- cut here 
                   -------
                  /
             Pin 1

   At the point marked above, some kind of nose is reaching down from the
   backpack over the resin.
   Carefully cut through the polyester resin filling the dimple.
   This works best with some kind of mini drill with a small milling head.
   buried in the resin you'll find two small diagonal metal connectors :).
   Be careful not to short-circuit them, or you'll loose the contents of your
   nvram (if it was still able to keep them). -That's why you should save them
   *before* :)
   The connector closest to pin 12 is ground, the other (opposing) one +3V.
   You can now solder some wire to them and connect them to a new 3V lithium
   battery.

----------------------------------------------------------------------------
decnet     dfwvx1::rick				Rick Caldwell
internet   [email-masked]
----------------------------------------------------------------------------

[ the rest is more information added by [email-masked] ]

Some important additional information thanks to [email-masked] 
(Michael Coughlin)

You can buy new Timekeeper chips from your local SGS-Tompson
semiconductor supplier, or Mauser Electronics (800)346-6873.
The part number is M48T02-200PC1 (note the change from the old
designation of MK48T02)

also information from comp.arch.bus.vmebus

Dallas Semiconductor makes a part called the DS1642 which is supposedly 
a direct replacement for the MK48T02, they come in speeds of 120 or 150nSec. 
Dallas will sell direct to credit card orders. Call 1-800-336-6933.
Data sheets and distributor lists for Dallas are available from 
http://www.dalsemi.com