[vvuk]

When you said offset 0600, did you mean from your PROM dump?  Because if so, I'd image a dump of PROM is dump of WORKING MEMORY PROM and not storage PROM.  Can you give us more info on how you did that and or a screenshot of a hex editor with pointers to some of the offsets to guide us around?

Not sure what you mean -- it's a dump using flash -D, that dumps the actual contents of the nvram chip.  It's at offset 0600 of the actual nvram.  So this is what's in the permanent storage.  At some point, the contents of this end up at HSPEC_BASE (0x9000000000000000) + LBOOT_BASE (0x100000000), because that's the address the kernel looks for it at; might be mapped, might be copied.  Whether POD can actually modify things or not is an open question; it depends on what the actual startup is like.

I think this can all be figured out just by poking around L1/POD before system boot, and an easy test would be to just modify things to boot at a lower speed (e.g. I know that my system is happy booting at 600MHz).  But I'm annoyed at taking my Fuel case off all the time, so I'm going to spend a bit of time setting up a wireless serial adapter first

Well POD IS POWER ON DIAGNOSTICS...the CPU hasn't started yet.  Am I wrong?  The L1 doesn't use the Main MIPS CPU, so change in POD are real as POD is before boot, yes?  So is there really a problem here?  Aren't we already before CPU boot?

Yeah this is a great question; I do wonder what this is all running on!  What does the L1 run on?  There must be a microcontroller in there somewhere.  PROM code is definitely MIPS, so is running on the CPU.  L1, POD, etc.. is POD part of the L1 code? Trying to disassemble L1 and I can't even figure out if it's mips, arm, (powerpc, sh4..), nothing seems to fit!  My guess would have been ARM (SGI has used ARM microprocessors elsewhere, e.g. the IR gbricks), but doesn't look like it.