<html><body><p><font size="2">Hi Marty,</font><br><br><tt><font size="2">> > <br>> > One thing to remember is that there is ECC on the image in the seeprom, so<br>> > you'll need to make sure to strip that off before trying to decode<br>> > anything. <br>> ><br>> Yeah; I assume the XIP header itself is not protected by ECC since the<br>> otprom_init.S which is burned-in expects some very specific locations<br>> for it. Also, correct me if I'm wrong but the XIP, is that a true XIP<br></font></tt><br><tt><font size="2">The XIP header actually is protected by ECC -- the HW itself strips it out</font></tt><br><tt><font size="2">for the SBE (and thus the code running in the OTPROM).</font></tt><br><br><tt><font size="2">> and its not running from ram (either attached DRAM or PIBMEM) but<br>> instead directly from the seeprom flash? If you happen to know how to do<br>> the stripping 'properly' I'd greatly appreciate that info.<br></font></tt><br><tt><font size="2">The SBE boot flow goes as follows:</font></tt><br><tt><font size="2">1) execute directly from OTPROM (reset I2C bus, check for magic)</font></tt><br><tt><font size="2">2) jump to SEEPROM, execute just enough from here to copy a loader into PIBMEM</font></tt><br><tt><font size="2">3) Loader copies and decompresses the main SBE image into PIBMEM. </font></tt><br><tt><font size="2"> a) At this point the SBE "kernel" and execution loop are running from PIBMEM</font></tt><br><tt><font size="2"> b) Some of the code is still executed from SEEPROM directly due to lack of space</font></tt><br><tt><font size="2">4) SBE will boot istep 2-4 doing chip HW init</font></tt><br><tt><font size="2">5) in istep 5 SBE will load the Hostboot boot loader (HBBL) from SEEPROM</font></tt><br><tt><font size="2">6) HBBL is what actually reads the file format on PNOR and loads Hostboot proper</font></tt><br><br><br><br><tt><font size="2">> > > is 32k in size, but what documentation<br>> > > I have seen says that the seeprom is 64k in size<br>> > There are a total of 8 64K eeproms, which we treat as 2 distinct<br>> > (primary/backup) SBE images.<br>> > <br>> I assume you mean 8 per cpu here? As according to the dts only 4 32k<br>> images are exposed per-cpu, or do you mean 8 for a dual-cpu system?<br></font></tt><br><tt><font size="2">There are 8 per-cpu -- treated as a primary SBE boot flash and alternate (in case</font></tt><br><tt><font size="2">the primary is corrupted during a code update)</font></tt><br><br><tt><font size="2">Here is info on how to extract and remove the ECC on the SBE SEEPROM image. There are</font></tt><br><tt><font size="2">actually 4 unique SEEPROMs that the SBE treats as a logical "flash". The following </font></tt><br><tt><font size="2">commands are from IBM's service processor -- you will have to tweak, but in general</font></tt><br><tt><font size="2">just need to read the "-a" address, offset 0 for 65529 bytes, then append all the images</font></tt><br><tt><font size="2">together. Notice that the althernate is on a different I2C bus, but same addresses:</font></tt><br><br><tt><font size="2">#Read primary image and reconstruct</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P01 -t 24C512 -a 0xa8 -W 2 -o 0 --file=./sbe_0 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P01 -t 24C512 -a 0xaa -W 2 -o 0 --file=./sbe_1 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P01 -t 24C512 -a 0xac -W 2 -o 0 --file=./sbe_2 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P01 -t 24C512 -a 0xae -W 2 -o 0 --file=./sbe_3 -r 65529</font></tt><br><tt><font size="2">cat sbe_0 sbe_1 sbe_2 sbe_3 > sbe.bin.ecc</font></tt><br><br><tt><font size="2">#Read alt image and reconstruct</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P03 -t 24C512 -a 0xa8 -W 2 -o 0 --file=./sbe_0 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P03 -t 24C512 -a 0xaa -W 2 -o 0 --file=./sbe_1 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P03 -t 24C512 -a 0xac -W 2 -o 0 --file=./sbe_2 -r 65529</font></tt><br><tt><font size="2">iicmaster -b /dev/iic/L02C0E06P03 -t 24C512 -a 0xae -W 2 -o 0 --file=./sbe_3 -r 65529</font></tt><br><tt><font size="2">cat ./sbe_0 ./sbe_1 ./sbe_2 ./sbe_3 > ./sbe.alt.bin.ecc</font></tt><br><br><tt><font size="2">To remove ECC use this tool from op-build</font></tt><br><tt><font size="2"><op-build repo>/output/host/bin/ecc --remove ./sbe.bin.ecc --output sbe.bin --p8</font></tt><br><br><br><tt><font size="2">> > <br>> > > So, I'm doing some preliminary work on the idea of a coreboot port for<br>> > > p9 (specifically the talos ii based systems) and have a few questions<br>> > Which pieces are you planning on replacing with coreboot?<br>> > <br>> The intent and plan here is a reworked SBE firmware which understands<br>> the cbfs (coreboot file system) instead of pnor, with hostboot being<br>> replaced with bootblock/romstage/ramstage, and skiboot reworked into a<br>> coreboot payload, which would be followed by a linux payload (skiboot<br>> hangs around as OPAL right?) which would have the petitboot payload.<br>> This would be the 'default' setup for these systems, but I don't see any<br>> reason someone couldn't do the work to use alternative boot payloads<br>> like grub or uefi (someone was working on uefi for power(9?) I saw<br>> online at one point).<br></font></tt><br><tt><font size="2">As I mentioned above the SBE doesn't ever read the PNOR directly -- it just</font></tt><br><tt><font size="2">loads the HBBL which is stored on the SEEPROM. So if you just want to tweak</font></tt><br><tt><font size="2">it to understand cbfs -- then you are going to want to modify the files in </font></tt><br><tt><font size="2">hostboot: </font></tt><a href="https://github.com/open-power/hostboot/tree/master/src/bootloader"><tt><font size="2">https://github.com/open-power/hostboot/tree/master/src/bootloader</font></tt></a><br><br><tt><font size="2">If you make changes there op-build will compile them into </font></tt><tt><font size="2">img/hbibl.bin </font></tt><br><tt><font size="2">which then gets morphed into the PNOR partiton HBBL (if you try to use hbibl.bin</font></tt><br><tt><font size="2">directly please note that the first 12K for exception vectors gets chopped off).</font></tt><br><br><tt><font size="2">During normal boot Hostboot will check the contents of the SBE + HBBL partition</font></tt><br><tt><font size="2">and if it doesn't mactch what is in the SEEPROM, it will update it. So for your</font></tt><br><tt><font size="2">work you can probably just rely on the HBBL partition and the automatic update</font></tt><br><tt><font size="2">path.</font></tt><br><br><font size="2">Dean Sanner<br>Dept. DIH, IBM Rochester, MN<br>(507) 253-7523 t/l 553-7523<br>dsanner@us.ibm.com<br></font><br><BR>
</body></html>