Yes, here at Old VCR we live in the past, when RISC Unix workstations still ruled the earth like large boxy tentaculous Cthulhus. Oh, sure, if you wanted a modern equivalent you could just buy a Raptor POWER9 like the one I’m typing on now. But around here even PowerPC is too pedestrian of an architecture. We need something unique.
That’s more like it! A keyboard, mouse, a NIC, VGA output, 16MB of RAM and a whole gig (you wish) of read-only optical drive space with a 200MHz Hitachi SuperH SH-4 CPU faulting its paltry 8K of I-cache and 16K of D-cache non-stop. Now freshly refurbished, its cooling fan runs louder than my Power Mac Quad G5 at idle and the drive makes more disk seeking noise than when I can’t find a lost floppy. And since the buzzword with Linux distros today is immutability, what could be more immutable than an ephemeral, desperately undersized RAM disk overlaid on a live CD?
Need portability? Well, just load the disc into our handy dandy greymarket clone Treamcast with its built-in LCD display and don’t tell Sega. You can take your Unix on the go with the car power adapter: if you can read the screen, now you can live the dream.
But jokes aside, Dreamcast Linux has something to teach later Johnny-come-latelies with a distro surprisingly well-adapted to its target platform, support for many peripherals, and an all-in-one batteries-included philosophy. Plus, it was one of the earliest Un*xy things for game consoles circa 2001, predating PlayStation 2 Linux by about a year or so, though PS2 Linux was at least Sony-official. (While at least one Linux purports to run on an O.G. PlayStation, this was a later development.)
So I think there’s enough noteworthy about it to merit dusting DC Linux off for a new generation to experience. We’ll add a couple quality of life pieces to smooth out a few rough edges, but we won’t remove anything and largely eschew in-place upgrades such that the flavour of the original experience remains. After all, no one’s running this as a home server (I think). If you like your vintage less aged there are newer attempts to put Linux on the Dreamcast, and of course it runs NetBSD, but if you feel like running a refreshingly geriatric Linux kernel on a classic console then this is your blog post. We’ll take a tour of the operating system and the way Linux used to be, talk about what’s unique about the DC port and what’s been added (and what’s missing), and then step through how you can burn a disc to run in yours.
One of the best things about O.G. Dreamcast Linux is that it has very minimal system requirements: you just need a Dreamcast and keyboard. It supports much more than that, most notably the controllers, the Dreamcast mouse and the Dreamcast Broadband Adapter (and if you have the BBA, you might be able to get away without the keyboard by Telnetting in remotely), but pretty much anyone could run it. The first hit is always free.
This and the initial set of screenshots are taken with my INOGENI VGA2USB3 capture box connected to a clone DC VGA adapter. Normally I would crop from 16:9 to 4:3 but I’m leaving the full frame on to demonstrate any display irregularities are due to the system, not the capture device or an inartful trim.
Dreamcast Linux — or indeed any DC homebrew at all — might not have been possible were it not for Sega’s ill-fated attempt at multimedia music CDs, called MIL-CD (Music Interactive Live CD). Recall that the Dreamcast’s normal and preferred medium is the “Gigabyte Disc” GD-ROM, Yamaha’s 1GB CD variant with closer pit spacing but using the same 780nm near-infrared laser. To broaden the third-party catalogue, Sega devised MIL-CD so that enhanced music CDs could feature menus, videos and Internet linkages, something like an Enhanced CD Bluebook format specific to the Dreamcast. Unfortunately for Sega, not only was MIL-CD very unsuccessful and only eight actual titles ultimately produced (let alone anything else that could play them), but it also allowed the Dreamcast to be booted from ordinary CD and CD-Rs instead of requiring all titles to be the more expensive GD-ROMs.
The key is the Dreamcast boot process. When the console detects a factory-pressed GD-ROM (GD-Rs officially require a boot disc), most likely from the presence of the special security ring between the low-density CD-readable inner ring and the high-density main section, it reads an boot sector executable conventionally named IP.BIN from the first 16 sectors and runs it. Part of IP.BIN‘s tasks are to enforce region coding and to also display the Sega copyright message shown here, which on the Genesis became relevant in Sega v. Accolade. It also provides a filename to the Dreamcast ROM (usually 1ST_READ.BIN) that the DC loads and runs as the main program.
This process is exactly the same for booting MIL-CD — with two crucial differences. When a MIL-CD starts up, the Dreamcast loads IP.BIN as usual, but the Dreamcast ROM will load the filename it provides into memory scrambled by a proprietary algorithm and disable the GD-ROM drive in software. If the second-stage executable were not pre-scrambled in a matching fashion, the result will be garbage, and the console will halt. Even if it could run, however, all it can do is play audio: the executable shouldn’t have any further access to data from the drive.
Sega’s tactical error was making the entire system’s security dependent on these two lockouts despite the overwhelming weight of history. Independent developers noticed the different pathway and used it with their own software developed with the official Sega Katana SDK to provide the obfuscation; probably the first was the Datel GameShark CDX, first developed in early 2000, though Bleemcast! got to market faster using the same method until Sony sued them into grenade shrapnel. Both packages exploited an undocumented reset call to regain control of the GD-ROM drive, allowing them to start games from disc after they themselves had loaded. The notorious Utopia boot disc got around the obfuscation problem with a pirated Katana SDK and used the same reset technique, letting pirated software load by simply booting Utopia and switching discs when instructed. The Utopia crew flamed out quickly as they were stupid enough to put their photographs on the disc, leading to a knock on the door from German police, but the crack circulated widely and the damage was done. When the obfuscation algorithm was eventually cracked too, pirated games could simply boot directly, as could anything else.
Arguably the rampant piracy that resulted was one of the causes of the Dreamcast’s decline, and Sega seemed to confirm this theory by introducing late model Dreamcasts that had MIL-CD support removed, but in too tardy a fashion to make any difference. These units won’t boot Dreamcast Linux either, but they aren’t extremely common and obviously less desirable.
In our case, the second-stage executable is a pre-scrambled RedBoot bootloader from eCos, a free open source real-time operating system originally developed at Cygnus Solutions in 1997. Red Hat bought Cygnus in 1999 and eventually terminated eCos as a product in 2002, making this 2001 build some of the last official Red Hat builds in use. Dreamcast Linux uniquely uses RedBoot to load the RAM disk image and kernel and start the operating system.
RedBoot listens on both the rear serial port (at 115200bps) and on port 9000 for commands. The IP settings are internal to the Dreamcast and are set by programs such as the Planet Web browser or Quake III Arena. If you connect to port 9000 while it’s waiting, you get this prompt:
% telnet sadie 9000 Trying... Connected to sadie. Escape character is '^]'. == Executing boot script in 8.-1612046094 seconds - enter ^C to abort ^C RedBoot> help Manage machine caches cache [ON | OFF] Change directory cdCompute a 32bit checksum [POSIX algorithm] for a range of memory cksum -b -l Print directory dir [ ] Display (hex dump) a range of memory dump -b [-l ] Execute an image exec [-b ] [-m ] [-f ] [-r ] [-l ] [-i ] [-j ] [-c "kernel command line"] [ ] Execute code at a location go [-w ] [entry] Help about help? help [ ] Load a file load [-r] [-v] [-h ] [-m {FILE | TFTP | xyzMODEM}] [-b ] Mount filesystem mount Network connectivity test ping [-v] [-n ] [-l ] [-t ] [-r ] [-i ] -h Print current working directory pwd Reset the system reset Unmount filesystem umount Display RedBoot version information version RedBoot> version RedBoot(tm) bootstrap and debug environment - built 05:27:24, May 29 2001 Copyright (C) 2000, 2001, Red Hat, Inc. RAM: 0x8c000000-0x8d000000, 0x8c034950-0x8d000000 available
Control-C from a connected keyboard won’t do it; while the Maple bus is USB-like, RedBoot doesn’t speak it. If we wanted to boot with custom Linux command line arguments, this is how:
RedBoot> mount RedBoot> load -v /boot/vmlinux Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align 00 00000001 00010000 8c210000 8c210000 000bdfd8 000ca420 00000007 00010000 Entry point is 0x8c210000 RedBoot> load -v -r -b 0x8c400000 /boot/initrd.gz Raw file loaded 0x8c400000-0x8c440725
This mounts the Rock Ridge image and loads the kernel and compressed initrd. Then, to boot the kernel, we would enter these command line arguments by default, or as you like.
RedBoot> exec -c "mem=16M init=/busybox /etc/profile" Now booting linux kernel (entry 0x8c210000) MOUNT_RDONLY : 0x00000000 RAMDISK_FLAGS : 0x00000000 ORIG_ROOT_DEV : 0x00000100 LOADER_TYPE : 0x00000001 INITRD_START : 0x00400000 INITRD_SIZE : 0x00400000 COMMAND LINE : mem=16M init=/busybox /etc/profile
The connection halts at this point since RedBoot’s network connections are then terminated by the new kernel and the console remains on the Dreamcast locally (though a serial port boot should keep the console on the serial port).
The Dreamcast version of RedBoot is one of the components we lack source for. Although the eCos CVS server is still active, there were apparently pieces that were maintained out of tree, and it’s not clear if the residual SuperH support still supports the Dreamcast BBA. Later versions of LinuxSH used SH-Boot, but remember that part of our brief here at Old VCR is historical preservation, so I’ve retained eCos RedBoot in this build.
The earliest kernel messages don’t seem to go to the screen, though you can get them from dmesg, of course.
Linux version 2.4.5 (yaegashi@aragorn) (gcc version 3.1 20010501 (experimental)) #27 Thu May 31 07:06:51 JST 2001 SEGA Dreamcast support. On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: mem=16M init=/busybox /etc/profile CPU clock: 200.00MHz Bus clock: 100.00MHz Module clock: 50.00MHz Interval = 125000 Console: colour dummy device 80x25 Calibrating delay loop... 199.47 BogoMIPS Memory: 10332k/16384k available (1173k kernel code, 6052k reserved, 132k data, 188k init) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) CPU: SH7750/SH7751 POSIX conformance testing by UNIFIX PCI: MMIO fixup to Sega Corporation Broadband Adapter Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Starting kswapd v1.8 devfs: v0.102 (20000622) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x0
But the first visible messages (to feeble human eyes) are these:
Notice the console framebuffer, the SCI(F) serial port support, Maple bus for input devices, the Realtek 8139-based Broadband Adaptor (connected over a PCI connection) and the GD-ROM. The framebuffer detects whether we’re connected over VGA or NTSC. On my old school CRT TV set, I see
fb0: Mode 640x480-32 pitch = 2560 cable: COMPOSITE video output: NTSC
instead of
cable: VGA video output: VGA
(sorry, PAL users, you’ll have to use VGA). The console’s scroll window has been altered so that the Tux SuperH logo is not obliterated by incoming new messages. Although we booted with Busybox,
/busybox
does not provide the userland; it only serves as
init
.
With the kernel now booted, we can switch to pixel-precise grabs from the framebuffer for the remaining screenshots. I provide a pre-built copy of fbcat in /usr/bin which will read the Linux framebuffer and convert it to a Netpbm pixmap.
Log in as
root
, no password. The machine listens on Telnet and FTP, and I added a small Gopher server demo. Never put a console running DC Linux outside of a firewall: it is an intentionally insecure system. Any bot scanning your network will get root immediately.
You’ll notice in the messages that NTP started up using chrony. I’ll talk about what we’ve added to O.G. 2K1 Dreamcast Linux as we go along, but first, let’s discuss the framebuffer.
Logged into our VGA demonstration system,
fbset
reports a bog-standard 640×480 32bpp console display. That isn’t totally true, though: a popular trick is to copy to and from the framebuffer device (here
/dev/fb/0
or
/dev/fb0
) using
cp
and
cat
. If you copy
/dev/fb0
to a file and copy it back, though, you don’t exactly get on-screen what you started with:
This puzzled me to no end, because the framebuffer clearly works. I queried the
ioctl
s for the framebuffer and found a perfectly ordinary looking 32 bit per pixel layout, but writing zeroes or indeed any other kind of character data to the framebuffer device generated this sort of artifacting.
After a lot of pulled hair, I decided to look a
