techomancer · Nov 9, 2026 · Oct 30, 2026 · Oct 30, 2026 · Oct 30, 2026 · Oct 30, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,26 @@ hashes are given where a change is easiest to understand by reading the commit.
 - The R10000 family has 44-bit virtual and 40-bit physical addresses, FrameMask and a 28-bit EntryLo PFN, picks the TLB refill vector by address space, invalidates overlapped TLB writes (Status.TS), and completes uncached stores nothing answers. Partial LWR keeps the upper word, and the cache diagnostics (Index Store Data, secondary tag mask, Config size) work.
 - `cpu` takes the parts each machine shipped with, such as `r12000_360` on the Octane, or a family name for the machine's own. The Indy and Indigo2 R4400 is now rev 5.0 at 150 MHz, the O2 R10000 rev 3.4 at 250 MHz, and an Indy no longer takes an R10000 (the R10000 Indigo2 is the IP28). The R12000 and R14000 are new.
 
+### Onyx2
+
+- `machine.profile = "onyx2_ip27"` runs the stock IP27 PROM on one or two Hub
+  nodes of an Onyx2 deskside, sharing one Crossbow, with a test widget in the
+  graphics slot, and boots an installed IRIX 6.5.30 to a serial login with one
+  node. See [the guide](docs/onyx2-ip27.md).
+
+### Origin 2000
+
+- `machine.profile = "origin2000_ip27"` runs the stock IP27 PROM on one or
+  two Hub nodes of an Origin 2000 deskside, the second joined by the direct
+  cable. One node boots IRIX 6.5.30 to a serial login. See
+  [the guide](docs/origin2000-ip27.md).
+
+### Origin 200
+
+- `machine.profile = "origin200_ip29"` runs the stock IP27 PROM on one Hub
+  node with an R10000 or R12000 and boots IRIX 6.5.30 to a serial login.
+  See [the guide](docs/origin200-ip29.md).
+
 ### Boot test before publishing
 
 - `build.yml` can boot IRIX 5.3 to a login prompt on Linux, macOS and Windows
@@ -394,6 +414,13 @@ hashes are given where a change is easiest to understand by reading the commit.
 - Memory past 4 GB is as fast as the rest: such a machine gets a 16 GB direct
   window, and the JIT compiles code anywhere in it.
 - A store-conditional on memory outside the window is now atomic with two CPUs.
+### PCI configuration
+
+- A PCI function can describe its own writable header fields and
+  write-one-to-clear status bits. Byte and halfword configuration writes
+  through a Bridge carry their byte enables, so such a function keeps the
+  status events a narrow write did not select. No Octane function has
+  write-one-to-clear status bits, so the Octane behaves as before.
 
 ### VNC, and screen and pointer commands
 

diff --git a/FEATURES.md b/FEATURES.md
@@ -175,10 +175,23 @@ the first `[section]`, because TOML tables continue until the next header.
 
 | Key | Default | Values and behavior |
 |---|---|---|
-| `machine.profile` | `indy_ip24` | indy_ip24, indigo2_ip22, indigo2_ip28, o2_ip32 (configured by `[o2]`, see [the O2 guide](docs/o2-ip32.md)), octane_ip30 (configured by `[octane]`, see [the Octane guide](docs/octane-ip30.md)). |
-| `machine.cpu` | the machine's first | A family (`r4400`, `r5000`, `r10000`, `r12000`, `r14000`) or a part (`r14000_600`); independent of build features. Indy and `indigo2_ip22`: r4400, r5000; `indigo2_ip28`: r10000; O2: r5000, r10000, r12000; Octane: r10000, r12000, r14000. The first listed is the default. |
+| `machine.profile` | `indy_ip24` | indy_ip24, indigo2_ip22, indigo2_ip28, o2_ip32 (configured by `[o2]`, see [the O2 guide](docs/o2-ip32.md)), octane_ip30 (configured by `[octane]`, see [the Octane guide](docs/octane-ip30.md)), origin200_ip29 (configured by `[origin200]`, see [the Origin 200 guide](docs/origin200-ip29.md)), origin2000_ip27 (configured by `[origin2000]`, see [the Origin 2000 guide](docs/origin2000-ip27.md)), onyx2_ip27 (also configured by `[origin2000]`, see [the Onyx2 guide](docs/onyx2-ip27.md)). |
+| `machine.cpu` | the machine's first | A family (`r4400`, `r5000`, `r10000`, `r12000`, `r14000`) or a part (`r14000_600`); independent of build features. Indy and `indigo2_ip22`: r4400, r5000; `indigo2_ip28`: r10000; O2: r5000, r10000, r12000; Octane: r10000, r12000, r14000; Origin 200, Origin 2000 and Onyx2: r10000 (`r10000_180`), r12000 (`r12000_270`). The first listed is the default. |
 | `machine.cpus` | `1` | Processors fitted. 2 only on the Octane; see [its guide](docs/octane-ip30-multiprocessor.md). |
 
+### [origin2000]
+
+Origin 2000 settings apply when `machine.profile = "origin2000_ip27"` or `"onyx2_ip27"`.
+
+| Key | Default | Values and behavior |
+|---|---|---|
+| `nodes` | `1` | Node boards: 1 or 2. Two are joined by the direct cable. Every node gets the `banks` memory. |
+| `flash` | unset | Persistent 1 MiB node boot-flash file of the first node; the second keeps its own at the name with `.1` added. Unset, the flash is volatile. |
+| `controller_store` | unset | Persistent file for the module controller's configuration store. Unset, it is volatile. |
+
+An `[origin2000]` table is written to a saved config only when one of these
+keys is set. See the [Origin 2000 guide](docs/origin2000-ip27.md).
+
 ### [graphics]
 
 | Key | Default | Values and behavior |

diff --git a/HACKING.md b/HACKING.md
@@ -98,6 +98,9 @@ way: `scsi::attach_from_config` walks the `[scsi.N]` tables for every machine,
 where the key is a slot (controller × 16 + id, see `config::scsi_slot`), and
 the machine supplies only a route from controller number to bus.
 
+Flash command engines share `FlashBacking` file storage while retaining
+their own command state.
+
 ## 2. Data path and endianness
 
 **Word-transparent architecture.** Host `u32`/`u64` values are bit
@@ -375,6 +378,10 @@ consumer thread never takes `rec`.
   monomorphised over it, so every CPU is in every binary with no
   per-model branch on the hot path. `Machine::new` picks one from `[machine]
   cpu`.
+- Every uncached SB/SH goes to the bus through `BusDevice::write_narrow_from`
+  with the whole source register: the byte or halfword is the low bits, the
+  other lanes are undefined by hardware, and only Bedrock's ECC view reads
+  them.
 - With `opcodefusion` (implied by `lightning`), the interpreter executes
   common pairs (branch + NOP, LUI + ORI/ADDIU, address + load/store) as one
   dispatch.

diff --git a/debug.md b/debug.md
@@ -593,9 +593,10 @@ Per-module logging; all of it needs a developer build to produce output.
 | `log <module> file <path\|off>` | Send a module's log to a file |
 
 Modules: `net hpc3 seeq hal2 mc rex3 mips ioc scsi pdma vino dcb vc2 cmap
-xmap bt445 scc ps2 rtc eeprom l1i l1d l2c`. Mask categories: `pdma` —
+xmap bt445 scc ps2 rtc eeprom l1i l1d l2c bedrock`. Mask categories: `pdma` —
 `hal enet scsi`; `mips` — `insn tlb mem fpu cp0`; `l1i`/`l1d`/`l2c` — `hit
 miss op`; every module also takes `on`/`all`, `off`/`none` or a hex mask.
+`bedrock` covers the Fuel's devices on its Bedrock hub.
 `IRIS_DEBUG_LOG` or `[debug] debug_log` set the same thing at startup.
 
 ### Performance and locks

diff --git a/docs/onyx2-ip27.md b/docs/onyx2-ip27.md
@@ -0,0 +1,35 @@
+# SGI Onyx2 deskside (IP27 node boards)
+
+The Onyx2 deskside is one or two IP27 node boards on the 4P1G5 midplane. Both
+Hubs are hosts of the one Crossbow, which carries the BaseIO-G at widget 15 and
+the graphics slot at widget 8. Two nodes are joined by the direct cable. The
+machine runs headless on the IOC3's first serial port. There is no
+InfiniteReality pipe: the graphics slot holds a test widget that answers its
+identification word and nothing else.
+
+## Configuration
+
+Use [`origin2000.toml.example`](../origin2000.toml.example) with
+`machine.profile = "onyx2_ip27"`; `[origin2000]` (`nodes`, `flash`,
+`controller_store`) configures this machine too. Node slot 1 drives raw slot
+identity 3 into its Hub and takes widget 10; slot 2 drives 2 and takes widget 9.
+With one node, the board is in slot 1.
+
+A disk installed on an Onyx2 boots; the machine cannot install without a pipe.
+
+## Limits
+
+- One node boots the stock PROM to the System Maintenance Menu and an
+  installed IRIX 6.5.30 to a serial login.
+- Two nodes: the PROM finds both Hubs, numbers them, makes the second slot's
+  board the global master, passes its diagnostics with both processors and
+  256 MB, and IRIX boots to a root login with both processors.
+- Either Hub's processor reaches the BaseIO-G through the Crossbow. The Bridge
+  delivers DMA and interrupts to the Hub at the widget the guest programs into
+  it, and both Hubs are hosts, each behind its Crossbow port's link. With two
+  nodes the PROM and IRIX program widget 9, the master's Hub; with one, widget
+  10.
+- The BaseIO-G is its base board: no MediaIO or audio.
+- The module controller, the cable and the node windows are the
+  [Origin 2000 deskside's](origin2000-ip27.md), with its limits.
+- Snapshots are not supported.
diff --git a/docs/origin200-ip29.md b/docs/origin200-ip29.md
@@ -0,0 +1,63 @@
+# SGI Origin 200 (IP29 System Board, IP27 software platform)
+
+The Origin 200 is the IP29 System Board on the IP27 software platform: one
+Hub node, an R10000 or R12000, a Bridge joined straight to the Hub's XIO port
+(no Crossbow), two ISP1040 SCSI controllers and an IOC3. The machine runs
+headless on the IOC3's first serial port.
+
+## Configuration
+
+Copy [`origin200.toml.example`](../origin200.toml.example) to `origin200.toml`,
+provide the PROM and disk named there, and run `iris --config origin200.toml`.
+The sample selects `machine.profile = "origin200_ip29"`.
+
+- `machine.cpu` is `r10000_180` (180 MHz, 1 MiB secondary cache, the default
+  module; `r10000` names it) or `r12000_270` (270 MHz, 4 MiB; `r12000` names
+  it). One processor is built. The R10000 module runs on the Octane
+  R10000's cache type (1 MiB, 128-byte lines); the R12000 module has a 4 MiB
+  type of its own, the module's size. Both use the Octane part's line size,
+  not the module's. Only the 180 MHz
+  module has a one-wire record (`PIMM_1XT5_1MB`); no inventory gives the R12000
+  module's, so its part is blank.
+- `banks` are the four DIMM-pair banks in MB (64, 128, 256 or 512), filled
+  from bank 0. A bank of 128 MB or less is one run at its 512 MiB stride; a
+  larger one is four runs at 128 MiB intervals.
+- `[origin200] flash` keeps the 1 MiB node boot flash, where the PROM stores
+  its environment log. Unset, the flash starts fresh every run.
+  `controller_store` does the same for the module controller's store.
+- `prom` takes the stock IP27 PROM as a raw payload or SGI's distribution
+  container. The flash configuration block is patched for the product and
+  processor module before the PROM runs.
+
+The PROM runs its diagnostics and reaches the System Maintenance Menu and the
+Command Monitor on the first serial port, and an installed IRIX 6.5.30 disk
+boots to a serial login.
+
+## Limits
+
+- One node and one processor. A second module, the GIGAchannel cabinet and
+  the Origin 2000 are not built.
+- Cached accesses use node-relative addresses, which is right for the node
+  number zero a one-node machine has.
+- The module controller's NMI output and the Hub's per-processor enable and
+  NMI stores are logged, not delivered.
+- Program and erase of the node flash finish inside the write that starts
+  them.
+- The Ethernet transceiver is a DP83840A model with a synthetic partner; the
+  link comes up two seconds after the first status read.
+- The Bridge answers at fifteen widget numbers, every one but the Hub's own.
+  Which numbers the hardware answers is not established.
+- The node keeps Hub revision 3 and the IP29 board record 030-1244-001
+  revision H for the R12000 module too; real 225 and 270 MHz machines report
+  Hub revision 5 and board 030-1389-001.
+- Memory is the banks the configuration gives. The R12000 module's 512 MB
+  total is two 256 MB banks on a real machine; here it is whatever
+  `banks` says (`[256, 256]` for two, `[512]` for one), and nothing prefers
+  the split.
+- A 256 MB bank is refused with the 180 MHz R10000 module, as the PROM
+  disables it there.
+- The node flash and the uncached Hub-special views have no JIT page
+  generation, so a jitv2 build does not compile code from them.
+- Snapshots are not supported.
+
+Unmodelled register accesses are visible with `log hub on` in the monitor.
diff --git a/docs/origin2000-ip27.md b/docs/origin2000-ip27.md
@@ -0,0 +1,48 @@
+# SGI Origin 2000 deskside (IP27 node boards)
+
+The Origin 2000 deskside is one or two IP27 node boards on the module
+midplane. Each node is a Hub with its memory, boot flash and one R10000 or
+R12000, and the host of its own Crossbow. The first Crossbow carries the BaseIO
+card (a Bridge with two ISP1040s and an IOC3). With two nodes the Hubs are
+joined by a direct cable, the Null Router. The machine runs headless on the
+IOC3's first serial port.
+
+## Configuration
+
+Copy [`origin2000.toml.example`](../origin2000.toml.example) to
+`origin2000.toml`, provide the PROM and disk named there, and run
+`iris --config origin2000.toml`. The sample selects
+`machine.profile = "origin2000_ip27"`.
+
+- `[origin2000] nodes` is 1 or 2. The memory in `banks` is fitted to every
+  node.
+- `machine.cpu` is `r10000` or `r12000`. Each node has one processor.
+- `[origin2000] flash` and `controller_store` keep the boot flash (the second
+  node's at the same name with `.1` added) and the module controller's store
+  between runs.
+- `prom` takes the stock IP27 PROM, as for the [Origin 200](origin200-ip29.md).
+
+Node slot 1 drives raw slot identity 7 into its Hub and slot 2 drives 6. The
+first node's Crossbow has the BaseIO at widget 8 and the Hub at widget 9; the
+second's has the Hub at widget 10. The module has one controller, reached
+through an I2C adapter per node.
+
+## Limits
+
+- One node boots the stock PROM to the System Maintenance Menu and IRIX
+  6.5.30 to a serial login.
+- Two nodes: the PROM finds both Hubs, numbers them, chooses the first as the
+  global master, passes its diagnostics with both processors and 256 MB and
+  reaches the menu. IRIX then stops with "Processor #1 did not start": the
+  second node's processor takes a TLB exception in the PROM (the master
+  reports "has taken an exception"), so it never waits to be launched.
+- The BaseIO's boot flash is not fitted; the PROM falls back to its own copy
+  of the I/O PROM.
+- The BaseIO is the only board; the second Crossbow has no widgets but its
+  node.
+- The module's midplane one-wire part is not fitted.
+- A node that holds a nonzero number sends cached references to node zero's
+  window beyond its cached alias to the Hub that holds zero, and its own RAM
+  is then reached through its own number only. The second node gives up the
+  direct memory window for it, so its cached references are slower.
+- Snapshots are not supported.
diff --git a/origin200.toml.example b/origin200.toml.example
@@ -0,0 +1,37 @@
+# SGI Origin 200 (IP29 System Board, IP27 software platform), serial-only setup.
+# Copy to origin200.toml and run from the repository root:
+#   iris --config origin200.toml
+# Supply the IP27 PROM image (the stock 6.156 image from the IRIX 6.5.30
+# distribution) and, to boot IRIX, a raw IRIX 6.5.30 disk. No images are
+# included. Convert QCOW2 disks to raw first.
+
+prom = "ignore/origin200/ip27prom.img"
+nvram = "ignore/origin200/nvram.bin"
+# One bank of a DIMM pair, in MB: 64, 128, 256 or 512 each, filled from bank 0.
+banks = [64, 0, 0, 0]
+headless = true
+no_audio = true
+monitor_port = 18988
+# The IOC3's first port is the console.
+serial_port_a = 18980
+serial_port_b = 18981
+
+[machine]
+profile = "origin200_ip29"
+# r10000 (180 MHz, 1 MiB secondary cache) or r12000 (270 MHz, 4 MiB).
+cpu = "r10000"
+
+[origin200]
+# Keep the node boot flash and the module controller's store between runs.
+flash = "ignore/origin200/flash.raw"
+controller_store = "ignore/origin200/controller.raw"
+
+[network]
+# Disconnected cable. For NAT, use mode = "nat".
+mode = "off"
+
+[scsi.1]
+path = "ignore/origin200/irix.raw"
+cdrom = false
+# Keep the base disk unchanged. Guest writes go to irix.raw.overlay.
+overlay = true
diff --git a/origin2000.toml.example b/origin2000.toml.example
@@ -0,0 +1,38 @@
+# SGI Origin 2000 deskside (IP27 node boards), serial-only setup.
+# Copy to origin2000.toml and run from the repository root:
+#   iris --config origin2000.toml
+# Supply the IP27 PROM image (the stock 6.156 image from the IRIX 6.5.30
+# distribution) and, to boot IRIX, a raw IRIX 6.5.30 disk. No images are
+# included. Convert QCOW2 disks to raw first.
+
+prom = "ignore/origin2000/ip27prom.img"
+nvram = "ignore/origin2000/nvram.bin"
+# One bank of a DIMM pair per node, in MB: 64, 128, 256 or 512 each.
+banks = [128, 0, 0, 0]
+headless = true
+no_audio = true
+monitor_port = 18988
+# The IOC3's first port is the console.
+serial_port_a = 18980
+serial_port_b = 18981
+
+[machine]
+profile = "origin2000_ip27"
+# r10000 (180 MHz, 1 MiB secondary cache) or r12000 (270 MHz, 4 MiB).
+cpu = "r10000"
+
+[origin2000]
+# One or two node boards; two are joined by the direct cable.
+nodes = 1
+flash = "ignore/origin2000/flash.raw"
+controller_store = "ignore/origin2000/controller.raw"
+
+[network]
+# Disconnected cable. For NAT, use mode = "nat".
+mode = "off"
+
+[scsi.1]
+path = "ignore/origin2000/irix.raw"
+cdrom = false
+# Keep the base disk unchanged. Guest writes go to irix.raw.overlay.
+overlay = true