>>> So, chances are, there are some provisions on the board already to
>>> flash the devices "in circuit" with or without the aid of the
>>> processor.
>> ISTR someone saying that the existing code _is_ willing to reflash
>> it, provided the new code is suitably signed.
> Yes.

...which obviously implies that the electronics on the board are
capable of it. :-)

> But the signature is the pisser.  I am suggesting that the "existing
> code" had to get in the Flash *somehow*.

True.  The first way that comes to mind is that Sun flashed all the
flashes with a small "grappling hook" image during manufacturing, one
that didn't check much and was willing to flash anything, then before
shipping used that to reflash it with the customer-ship software.

> And, I am further suggesting that it got in there *after* the device
> was mated to the PCB (i.e. not preprogrammed by the vendor prior to
> assembly).  So, poking around might give some insight. (e.g., a
> conspicuous jumper labeled "FLASH ICT" or "FLASH JTAG", etc.)

That would, for our purposes, be preferable to my theory above.
Simpler in some respects, but it makes each board cost more; if they
did them in high volume, they may have spent money on their
manufacturing equipment to allow them to make each board cheaper.

>> without needing to invest a dozen times the sunray's cost in JTAG
>> interfaces or ICE boards for the cpu in question.  Thus the
>> signature-forging question.
> JTAG interface is a few low speed pins on a parallel port.

Oh, there's no minimum speed requirement for it?  The one JTAG box I've
used was relatively high speed - in the low tens of MHz, I think it
was - and I assumed the JTAG interface spec called for that.  If they
can go as slow as dc, then sure, that'd be fine.

> Biggest hassle is figuring out *if* the interface exists, etc.

Well, yeah, there's that. :-)

Makes me wish I had one to open up and look at.  I hate speculating in
a vacuum.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B