Skip to content

S2600

The Intel S2600wf mainboard is one of the targets for the LinuxBoot (formerly NERF) firmware. It is mostly working, although there are several things left to do before it is usable by non-core developers.

Overview

Intel S2600WF mainboard.

Main ROM is a 64 MB Macronix MX25L51245 SPI flash. ME is 39 MB, BIOS is 21 MB.

Serial console

/dev/ttyS0 is an RJ45 on the back of the case. The pinout is page 73 of the S2600WF TPS document. Easy adapter is the StarTech DB9-RJ45.

DB9 pin RJ45 pin Function Color (for T-568B ethernet cable) Color (for StarTech adapter)
2 3 Out (from computer) Green stripe Black
3 6 In (to computer) Green Yellow
5 4 Ground Blue Red

There is a 10-pin Intel motherboard serial header for /dev/ttyS1, which can be adapted to RS232 for debug output (prebuilt part). Pinout is the same as the DB9:

DB9 pin Header pin Function
2 3 RXD
3 5 TXD
5 9 GND

BMC

BMC is an AST2500 with the same 64 MB ROM. This is supported by OpenBMC, but will require a GPIO map of some sort.

Notes

  • 64 MB ROM requires 4-byte read commands on SPI bus.

  • Most filesystems are FFSv3, which require the new_engine branch of UEFITool

  • PeiCore does not have any debug lib linked in. No helpful strings.
  • Pei and Dxe sections are duplicated twice, including SecCore
  • Logo is stored as jpeg image
  • ME region is from 0x21000 - 0x25b0000
  • BIOS region is from 0x2C00000 - 0x4000000
  • PEI/NVRAM region starts at file offset 0x3900000

  • Flashing the DXE section leads to constant beeping from PEI
  • Serial port is ttyS1, updating DxeCore to print to that port doesn't produce any output
  • Replacing the 640x480 logo with my own jpeg works, so that is not included in measurements.
  • unlocked ME region leads to "Major failure" in BIOS setup?

  • Their DxeCore is in a FFSv3, which can't be edited with the old uefitool.

  • Putting it into recovery mode (white jumper) stops beeping and jumps into DxeCore

  • Need to use rj45 on ttys0 to see the output

  • Can't find the FFSv2 FVH with linux or any other dxe in it?

  • Looks like PEI has relocated our FVH and setup a HOB to point to it, but nothing is being run from it.

[17:12:58.021](2017-11-03) FV Hob            0xFFC00180 - 0xFFD4017F
[17:12:58.024](2017-11-03) FV2 Hob           0xFFC00180 - 0xFFD4017F
[17:12:58.028](2017-11-03) FV Hob            0x6E5E8000 - 0x6F2E7FFF
[17:12:58.038](2017-11-03) ProduceFVBProtocolOnBuffer: Base=FFC00180 Length=00140000
[17:12:58.057](2017-11-03) ProduceFVBProtocolOnBuffer: Base=6E5E8000 Length=00D00000

  • Faster flashing -- just the nerf.vol DXE section from u2C00000 D00000 instead of the entire 64 MB.

  • Looks like the code is failing in FvCheck() for the volume. WITH NO ERROR MESSAGE.

  • Perhaps just to uncover the part under the APIC; replaced with a 4 MB DxeCore and a 9 MB Linux+Initrd

  • Can boot all the way into user land, although ACPI and serial console are broken: CONFIG_CMDLINE="earlyprintk=serial,ttyS0,115200 console=ttyS0,115200n8 nosmp nox2apic pci=biosirq nopnp noisapnp acpi=off"

  • The BdsDxe does something magic with ACPI, TPM, SVM, STM, VTD, VTX, etc, etc, etc so it is necessary right now to use Intel's executable.

  • There are weird firmware volume size issues that cause corruption. Trying to keep it to less than 4 MB seems to help.

Heads 2017

Last update: November 8, 2020