[vvuk]

When you said offset 0600, did you mean from your PROM dump?  Because if so, I'd image a dump of PROM is dump of WORKING MEMORY PROM and not storage PROM.  Can you give us more info on how you did that and or a screenshot of a hex editor with pointers to some of the offsets to guide us around?

Not sure what you mean -- it's a dump using flash -D, that dumps the actual contents of the nvram chip.  It's at offset 0600 of the actual nvram.  So this is what's in the permanent storage.  At some point, the contents of this end up at HSPEC_BASE (0x9000000000000000) + LBOOT_BASE (0x100000000), because that's the address the kernel looks for it at; might be mapped, might be copied.  Whether POD can actually modify things or not is an open question; it depends on what the actual startup is like.

I think this can all be figured out just by poking around L1/POD before system boot, and an easy test would be to just modify things to boot at a lower speed (e.g. I know that my system is happy booting at 600MHz).  But I'm annoyed at taking my Fuel case off all the time, so I'm going to spend a bit of time setting up a wireless serial adapter first

Well POD IS POWER ON DIAGNOSTICS...the CPU hasn't started yet.  Am I wrong?  The L1 doesn't use the Main MIPS CPU, so change in POD are real as POD is before boot, yes?  So is there really a problem here?  Aren't we already before CPU boot?

Yeah this is a great question; I do wonder what this is all running on!  What does the L1 run on?  There must be a microcontroller in there somewhere.  PROM code is definitely MIPS, so is running on the CPU.  L1, POD, etc.. is POD part of the L1 code? Trying to disassemble L1 and I can't even figure out if it's mips, arm, (powerpc, sh4..), nothing seems to fit!  My guess would have been ARM (SGI has used ARM microprocessors elsewhere, e.g. the IR gbricks), but doesn't look like it.

[jwhat]

Hi vvuk,

there is a Motorola COLDFIRE XCF5206EFT54 2J22G QGC0321 Processor on the underside of the O350 2U Interface board.

I thinks this is PowerPC chip...

I will take pictures and post later.

EDIT #1: Checked the Fuel system board and it has the COLDFIRE CPU is down next to the smaller plugin edge of the V10/V12 XIO slot.

Cheers from Oz,

jwhat/John

[vvuk]

Ah! Thank you, that helps. Coldfire is actually 68k, which is one of the few I didn't try! Boy, SGI really did just run the gamut of architectures...

[Raion]

Coldfire is a simplified 68k arch -- you can't run straight 68k object or machine code on it, you can take a 68000 assembly program and use an NXP supplied translation software. Just a caveat emptor if you're assuming straight 68k you're gonna get some gotchas if that matters...

Coldfire and Dragonball derivatives of the 68k were AFAICT embedded processors and microcontrollers respectively based off the 68000, but neither of them are 100% compatible. There was a talk of an Elbox amiga board 15 years back for 68000-powered Amigas, and it never materialized due to software issues.

[jan-jaap]

Well POD IS POWER ON DIAGNOSTICS...the CPU hasn't started yet.  Am I wrong?  The L1 doesn't use the Main MIPS CPU, so change in POD are real as POD is before boot, yes?  So is there really a problem here?  Aren't we already before CPU boot?

Yeah this is a great question; I do wonder what this is all running on!  What does the L1 run on?  There must be a microcontroller in there somewhere.  PROM code is definitely MIPS, so is running on the CPU.  L1, POD, etc.. is POD part of the L1 code? Trying to disassemble L1 and I can't even figure out if it's mips, arm, (powerpc, sh4..), nothing seems to fit!  My guess would have been ARM (SGI has used ARM microprocessors elsewhere, e.g. the IR gbricks), but doesn't look like it.

The L1 is a small embedded CPU. Don't know about the architecture.

POD is indeed Power-On-Diagnostics. It's the code executed by the main MIPS CPU to test functionality of the system. It's a subset of the diagnostics that takes little enough time that you can run it every time the system is powered on. The most basic  routines even run without RAM because they run entirely from ROM and only access registers.

[jwhat]

Hi vvuk,

Yes , it is binary and not "binary coded decimal" (as I first throught):

[800: 14 -> 15] 0000160 0000 2faf 0800 0000 0000 0beb c200 => 0x2FAF0800 => 800,000,000
[600: 15 -> 16] 0000160 0000 23c3 4600 0000 0000 0beb c200 => 0x23c34600 => 600,000,000
[800: 16 -> 17] 0000160 0000 2faf 0800 0000 0000 0beb c200 => 0x2FAF0800 => 800,000,000
[700: 7 -> 8] 0000160 0000 0000 29b9 2700 0000 0000 0beb c200 =>0x29b92700 => 700,000,000

and 900 & 500 would likely be:

0000160 0000 35A4 E900 0000 0000 0beb c200
0000160 0000 1DCD 6500 0000 0000 0beb c200

Kind of funny how the hex shows the 500/600/700/800/900 pattern like it was BCD... I am sure the mathematitions can explain that ...

Not sure where you get this from: freq_cpu = 0x00000000549bad85 = 700_000_000 (decimal is: 1419488645 == 1 confused Fuel/Fool)

Cheers from Oz,


jwhat/John

[vvuk]

Not sure where you get this from: freq_cpu = 0x00000000549bad85 = 700_000_000 (decimal is: 1419488645 == 1 confused Fuel/Fool)

Oops!  Copy paste error while building that list.  It should be 0x29b92700 (fixed now).

[jwhat]

Hi vvuk,

a bit late but here is picture of the STI chip under snaphat, I am sure the O350 will have the same one:



It is: STI H994S504 M48T35AV-10MH1 VH441024 B
and datasheet: https://www.st.com/resource/en/datasheet/m48t35av.pdf

Also here are links to picture of fuel (03-1707-005 rev B) system board top and bottom.

This board has some knocked off capacitors ... so if someone else has picture of the same series that will be helpful in trying to repair.

Cheers from Oz,

jwhat/John.

[weblacky]

I have 030-1707-005 REV A. could be close enough.

I may be blind, the only cap I see missing from yours is L9A5, is that all? On my board L9A5 is EXACTLY the same as the one next to it K3A5, which appears to be a 470uF @ 16V...I don't know the footprint code, you'll need to measure it to find out.

[jwhat]

Hi Weblacky,

the obvious one is the big one front side, near the serial part no label

The problem is that a bunch of the smaller surface mount tantalum capacitors have been knocked off the bottom of the board... (not really easily seen on photo, but on inspection you can see where some have been knocked).

I will mark up what I can see and start new thread for that...

Also I did a bit of a web surf for 28 PIN Test Clip and found this: https://www.farnell.com/datasheets/193574.pdf

But at 32K Bytes that chip does not provide enough space for the ~ 1.5 M Bytes that was written / dumped...

So still not clear if this is the right chip.

Cheers from Oz,

jwhat/John.