Hi,
yes, it's an old thread -- just for the record:
David Hawkins wrote:
The MPC8349E can be booted such that the core is held in reset, and the processor registers can be configured over PCI by another host computer. Therefore it is conceivable that the host can program the SDRAM controller on the MPC8349E and take the core out of reset. If the core is configured to boot from an address mapped to SDRAM, then U-Boot could have been copied to SDRAM by the host. Once U-Boot boots, it could then use FTP etc to boot the kernel blah blah ...
Yeah yeah, its contrived ...
Not really, we almost do it in that way on a custom MPC8540 and a MPC8541 board. Basic hardware settings are done using Boot Sequencer EEPROM. Settings can be concluded with settings written over PCI by host (PCSRBAR on BAR0). U-Boot and Linux are directly written over PCI into RAM. The boards itself didn't got flash memory at all. U-Boot environment is contained in I2C-EEPROM as well (can be concluded with a specially crafted environment found in RAM -- which is another hack though).
Of course if the host is configuring all the registers, then there is probably no reason for the bootloader ... just boot to Linux directly from SDRAM.
No, we don't want to get rid of this nice U-Boot... :)
Cheers,
Florian