[vvuk]

Replying here from the other thread, since this is more relevant here :)

---

I guess what I'm saying is AFAIK that there's only one PROM for IP35 machines, but stored in different locations.  Apologies if this is all fully known, just working through my own mental model:

- for IP35, there's only one PROM image

- for different machines it's stored in different locations: either the CPU boards or the system board.  This seems to be confirmed by the flash man page: "flash allows a user to manage the flash PROMs on the IO and CPU boards of Origin systems, the base system board on OCTANE systems and CPU boards on the SGI Origin 3000 server series".  On previous versions it does look like there was a copy on the IO board (confirmed later in the man page; the ip35prom image is the only one that's even installed on any ip35 hardware), but doesn't seem to be the case for ip35.  This is also why changing the cpu node board can change prom version on o350.

- Fuel is not mentioned here; it seems they went back to putting it on the CPU board (which is what I was getting at with the l1 prom commands -- that _is_ this PROM, the L1 is saying it's on the node board in an O350 and it can't see it on the fuel, because it's on the system board).

- I think on the Octane, PROM is not on the cpu boards, but some signaling that is read early on (maybe even pre-PROM) ends up setting cpu frequency.  They really should have kept this, but maybe couldn't because the Fuel is sort of a "stripped down" ip35 design.

- latest version is 6.210 for IP35.

- The dump from flash -D is not sufficient for flashing back; it's missing a header (flash -d -P ip35prom.img shows good info, flash -d -P ip35prom.img.dump shows garbage).  It seems to be a raw dump of the flash chip, though; e.g. there's a lot of log data at the end of one of my dumps (from the fuel).

- the dump from both systems is 4MB; implies to me that there's a 4MB flash chip somewhere on the board :)  (Base ip35 image is only 1.5MB)

- a few bit differences early in the dump, and then starting at 0x3e0000 (i.e. last 128kb of the flash chip), looks like maybe some variables, and then log data.  e.g. o350 has PLLWARCntA, PLLWARCntB, both have PLOI and LastModule.

For the dump -- my Fuel is 700Mhz.  Here's what I have at octal 160 and 220 offsets:

(for reference from previous dumps -- are they missing 2 zero bytes at the start of each sequence?:)
[800: 14 -> 15] 0000160 0000 2faf 0800 0000 0000 0beb c200
[600: 15 -> 16] 0000160 0000 23c3 4600 0000 0000 0beb c200
[800: 16 -> 17] 0000160 0000 2faf 0800 0000 0000 0beb c200

(including 0140, as the string "ip27conf" appears immediately before these values)
..............  0000140 0000 0015 549b ad85 6970 3237 636f 6e66
.................... \0  \0  \0 025  T 233 255 205  i  p  2  7  c  o  n  f
..............  0000160 0000 0000 29b9 2700 0000 0000 0beb c200

o350 (4x700):
.............. 0000140 0000 0015 549c ad85 6970 3237 636f 6e66
..................... \0  \0  \0 025  T 234 255 205  i  p  2  7  c  o  n  f
.............. 0000160 0000 0000 29b9 2700 0000 0000 0beb c200

This value is where the cpu frequency is stored (at offset 0162 / 0x72):
0x29b92700 == 700000000 (note identical value on both 700MHz systems)
0x2faf0800 == 800000000
0x23c34600 == 600000000

The later region for completeness:

(for reference from previous dumps:)
[800: 14 -> 15] 0000220 0000 0002 0000 00f0 0000 000e 0000 0010
[600: 15 -> 16] 0000220 0000 0002 0000 00ad 0000 000f 0000 0010
[800: 16 -> 17] 0000220 0000 0002 0000 00ee 0000 0010 0000 0010

mine, 700Mhz:
..............  0000220 0000 0002 0000 00d5 0000 0008 0000 0010

o350 for comparison (4x700):
..............  0000220 0000 0000 0000 00c3 0000 001b 0000 0010

There may be checksums or other values though, so it might not be as simple as just changing the frequency value.