3Com 3C905

3Com 3C905B-TX with "bootrom"

The 3Com 3C905 series of network cards can be used to reflash some types of flashchips, by plugging the chip into the card's bootrom socket and running the appropriate program to flash the data into the "bootrom".

Supported Chips

This is a list of chips that should be supported by this card.

• AT27C010A
• Probably many others

Flash method

This is the procedure I used to extract the contents of the two boot ROM chips used in the HMX. Hopefully someone else will find this procedure useful if they need to extract some ROM chips of their own. To avoid confusion in this document I'm using the standard case-sensitive abbreviations when describing a quantity of data, so in other words a lowercase b means bit and an uppercase B means byte (e.g. 1Mb is a megabit and 1MB is a megabyte.)

In the HMX terminal, the boot ROM chips are located on the network card for ease of replacement (as the network card can be removed without opening up the case.)

HMX ROM chip

Luckily the HMX uses a fairly standard ROM chip, and in the picture on the left you can just see under the label it's a 27C010. As it turns out, most network cards with the correct size boot ROM socket are compatible with this chip, so you can use an old network card to read the contents of the ROM.

It's slightly larger than a traditional network boot ROM, so you'll need a network card that has a large enough socket such as the 3Com 905B below on the right. This particular card supports both the traditional sized chips as well as the larger ones, and it even supports EEPROMs which is handy to know if I ever need to reflash a failed motherboard BIOS chip. I picked it up off eBay for $2.

Now you have a PC that can access the ROM, however the tricky part is getting the network card to read the ROM! I was hoping it would map the ROM into the standard DOS address space, but apparently not. In the end I stumbled across Donald Becker's network utility page, which provided me with a much nicer solution - source code for a small Linux utility that could (among other things) dump the contents of the bootrom. The one for this 3Com card is called vortex-diag and while it complains about the chip not being an EEPROM it reads the ROM without any trouble.

Unfortunately since it doesn't recognise the ROM chip, it defaults to assuming it's only 8KB in size, whereas the chip is actually 1Mb (128KB) so I had to modify the code to default to 1Mb. I actually defaulted to 1MB to see what would happen, and it results in the program getting stuck when it reaches the end of the ROM - which is quite useful really, because then you can just press Ctrl + C to quit and the output file will be exactly the size of the ROM anyway.

The part of the code I had to modify was in libflash.c in the flash_dump function (around line 307), I commented out the existing size-detection code and hardcoded my own value:

// int mem_size = (part_id < 0) ? 8*1024 : flash_id[part_id].mem_size;
int mem_size = 1048576;

Running vortex-diag now correctly extracts the full contents of the ROM chip:

$ ./vortex-diag -S rom-even.bin

vortex-diag.c:v2.16 1/12/2004 Donald Becker (becker@scyld.com)
 http://www.scyld.com/diag/index.html
Index #1: Found a 3c905B Cyclone 100baseTx adapter at 0xe400.
 Station address 00:00:00:00:00:00.
  Receive mode is 0x00: Unknown/invalid.
Hmmm, no response to the ID command, trying again with '80/60'..
That did not work either, trying with '90/01'...
ACKKK, this may not be a programmable Flash part!
Unknown BIOS ROM ID 0B 01.
Saving the boot flash ROM into file 'rom-even.bin'...

And after pressing Ctrl + C, I was left with the contents of the ROM:

$ ls rom-even.bin
-r--r--r--    1 root     root       131072 Jan 26 11:59 rom-even.bin

Now of course because there are two ROM chips you'll need to extract them both, and then join them together. Unfortunately it's not a simple cat job, because every second byte is stored in the other chip (sort of like RAID for ROM chips.) I wrote a quick C program to merge the chips together, called mergerom.cpp (code below.) This takes the EVEN and ODD chip data and merges them together, giving you a single ROM file containing the entire contents of the ROM chips.

//
// mergerom.cpp - 2005-01-26: Adam Nielsen (a.nielsen@optusnet.com.au)
//
// Merge the even and odd parts of a ROM together (e.g. "eeeee" and "ooooo"
// are printed as "eoeoeoeoeo")
//
// To compile: gcc -o mergerom mergerom.cpp
//
 
#include <stdio.h>
 
int main(int iArgC, char *pArgV[])
{
	if (iArgC != 3) {
		printf("Merge even and odd ROM binaries together to produce a single (more"
			" useful) ROM binary.\n\n"
			"Usage: mergerom even.bin odd.bin > output.bin\n\n"
		);
		return -1;
	}
	FILE *hEven = fopen(pArgV[1], "rb");
	FILE *hOdd = fopen(pArgV[2], "rb");
	while (!feof(hEven)) {
		char cBuffer;
		fread(&cBuffer, 1, 1, hEven); putchar(cBuffer);
		fread(&cBuffer, 1, 1, hOdd);  putchar(cBuffer);
	}
	fclose(hOdd);
	fclose(hEven);
	return 0;
}