The ATEN firmware for WPCM450 on Supermicro boards comes with a custom bootloader that has some interactive commands. **WARNING**: When the bootloader is running (and showing its prompt) while the host is booting, the bootloader may hang for unknown reasons. Make sure not to have a flash command (e.g. FT or ATTRIB) in progress at that moment, because it may be difficult to recover from. ``` bootloader > h W90P710 Command Shell v1.0 Rebuilt on Mar 23 2012 at 17:48:54 H Display the available commands B Set Baud Rate D Display memory. D -? for help E Edit memory. E -? for help G Goto address I information MX Xmodem download MT TFTP download FT Program the flash by TFTP. FT -? for help FX Program the flash by Xmodem. FX -? for help CP Memory copy LS List the images in the flash SET Setting boot loader configuration. SET -? for help CHK Check the flash RUN Execute image DEL DEL the image or flash block MSET Fill memory TERM Change the terminal output port BOOT Reboot the system CACHE Cache setting UNZIP Unzip image ATTRIB Change the image attribution MEMREAD Upload Read from memory MEMWRITE Download write to memory sequence of values bootloader > ``` ## E - edit memory This command lets you interactively change memory. To change the presented value, it must first be removed with backspace (which in this case must be entered as ^H) ``` bootloader > e 0x00010000 [10000] E3A0020B --> E3A0020B [10004] 4001DD78 --> E3A01041 [10008] e5c010_ ``` Once you're done inputting values, press the ESC key. ## DEL - delete an image **WARNING**: Do not invoke `DEL` without any parameters, it will erase image 0 (BOOT INFO)! ``` bootloader > DEL -h Usage: DEL [ImageNo.] [b{blockNo.}] [-all] [ImageNo.] Delete the image [b{blockNo.}] Delete the block -all Delete all blocks ``` ## ATTRIB - change image attributes The `ATTRIB` command lets you change the attributes of an image. See [below](#attributes) for a list of attributes. ``` bootloader > ATTRIB 3 -cxza Image attribution changed successfully. ``` It can be quite useful to add/remove the _active_ attribute (`-a`) to/from different images to influence which one is the first active image and will thus be booted. ## Flash partition format The bootloader keeps track of flash partitions through their footers. The ATEN SDK includes [a tool](https://github.com/Knogle/Supermicro-Nuvoton-WPCM450-IPMI-ATEN/blob/master/SDK/MKIMG_Tool/Host/HERMON/mkimage.c) to write such footers. ``` Image: 0 name:BOOT INFO base:0x40010000 size:0x0000FFC8 exec:0x40010000 -f Image: 2 name:1stFS base:0x40180000 size:0x007FC000 exec:0x00D00000 -f Image: 3 name:kernel base:0x40980000 size:0x00112AA8 exec:0x00008000 -acxz Image: 4 name:2ndFS base:0x40B80000 size:0x00255000 exec:0x00D00000 -f ``` ``` 00a9ffc0 ff ff ff ff ff ff ff ff ff ff ff ff 03 00 00 00 |................| 00a9ffd0 00 00 98 40 a8 2a 11 00 00 80 00 00 00 80 00 00 |...@.*..........| 00a9ffe0 6b 65 72 6e 65 6c 00 00 00 00 00 00 00 00 00 00 |kernel..........| 00a9fff0 0a 78 dd 57 9f ff ff a0 17 00 00 00 c3 8b 05 58 |.x.W...........X| ``` Footers are at offset 0xffc0 after 64 KiB alignment and have the following format: offset | type | description ---------|--------|----------------------------------------------------------- 0x0c | u32 | image number 0x10 | u32 | base 0x14 | u32 | size 0x18 | u32 | load address 0x1c | u32 | exec address 0x20 | string| image name 0x30 | u32 | some kind of checksum over the content 0x34 | u32 | magic number (0xA0FFFF9F) 0x38 | u8 | attributes 0x3c | u32 | some kind of checksum over the footer ### Attributes bitmask | ATTRIB command flag | description ---------|---------------------|---------------------------------------------- 1 | -a | active image 2 | -c | copy image to RAM 4 | -x | executable image 8 | -f | filesystem image 16 | -z | the image is [ZIP](https://en.wikipedia.org/wiki/Zip_(file_format)) compressed ### ATEN symbol To indicate that the flash is complete, the last 64 KiB block of the last image (2ndFS) includes a signature, the _ATEN SYMBOL_: ``` 00ddffb0 ff ff ff 41 54 45 4e 73 5f 46 57 03 38 71 ac 28 |...ATENs_FW.8q.(| 00ddffc0 dd 95 17 ff ff ff ff ff ff ff ff ff 04 00 00 00 |................| ``` offset | type | description ---------|--------|----------------------------------------------------------- 0xffb3 | u8[8] | "ATENs_FW" 0xffbb | u8 | unknown 0xffbc | u8 | unknown 0xffbd | u32 | a CRC32 checksum over an unknown area 0xffc0 | -- | there should be an image footer here ## TFTP New flash partitions (aka. images) can be installed over the network with the `FT` command: ``` bootloader > ft 7 scream 0x40e00000 0x40e00000 -x Find image 7 existed! Do you want to delete it?[y/N] Deleting image 7 ... .Waiting for download ... TFTP client: 192.168.2.18 Download OK, file size:16 Flash programming ... . bootloader > ``` Things to note: - If you delete or overwrite image 4 (2ndFS), the ATEN symbol is also deleted. Without the bootloader enters a recovery mode instead of booting the kernel. You can, however, move the ATEN symbol into another image (for example, the kernel). - Make sure that you configure your TFTP client to use binary mode. Netascii mode causes all `0a` bytes to be replaced by `0d 0a`! - If the FT command detects that the image that you're trying to overwrite currently exists, it will offer to erase it first. - If the FT command encounters a unerased block, it will fail to write the image, because it assumes that there can't be unerased space outside of an image. This creates a problem when an image footer has been erased/corrupted, because FT won't try to erase the image, but also won't be able to reprogram it. ## Installing custom code - The 2ndFS partition (at 0x40b80000) can be removed without making the original kernel and userspace unusable (it will just lack the web UI) - By placing the new kernel at 0x40b80000, it can be accessed from the original kernel (through the right /dev/mtd partition) - There is enough free space between the original kernel and 0x40b80000 to install something else there, such as a monitor program (see src/) - To install the monitor, run `ft 6 monitor 0x40b00000 0x8000 -acx` and send `src/bare-metal/monitor.bin` via TFTP - To install a custom kernel, run `ft 7 newkern 0x40b80000 0x8000 -acx` and send the zImage via TFTP