On Mon, 5 Mar 2007, Ward Vandewege wrote: > On Mon, Mar 05, 2007 at 05:53:52PM +0100, Carl-Daniel Hailfinger wrote: >> A counter with 6 bits per byte and one unknown byte. Note how no >> value is >=0x40 and a wraparound of the second value increases >> the third value by 1? >> Could be a timer, e.g. boot time or something like that. Try >> to correlate boot time intervals with the differences in the >> counter.
Hypothesis: boot or shutdown time in UTC and date (Ward's local time seems to be -0500 from UTC, translation to decimal below): > -0000fd90 0f 00 24 00 12 00 00 02 03 07 00 00 40 00 00 00 The baseline was last Friday, i.e 2007-03-02: 02 03 07 > 2007-03-05 10:17 +0000fd90 0a 00 00 00 0f 00 00 05 03 07 00 00 40 00 00 00 ss mm hh DD MM YY 10 00 15 05 05 07 > 2007-03-05 10:29 +0000fd90 16 00 1c 00 0f 00 00 05 03 07 00 00 40 00 00 00 22 28 15 > 2007-03-05 10:38 +0000fd90 14 00 25 00 0f 00 00 05 03 07 00 00 40 00 00 00 20 37 15 > 2007-03-05 10:40 +0000fd90 14 00 27 00 0f 00 00 05 03 07 00 00 40 00 00 00 20 39 15 > 2007-03-05 10:42 +0000fd90 08 00 29 00 0f 00 00 05 03 07 00 00 40 00 00 00 08 41 15 > 2007-03-05 10:43 +0000fd90 39 00 2a 00 0f 00 00 05 03 07 00 00 40 00 00 00 57 42 15 > 2007-03-05 10:48 +0000fd90 2e 00 2c 00 0f 00 00 05 03 07 00 00 40 00 00 00 46 44 15 > 2007-03-05 10:50 +0000fd90 16 00 31 00 0f 00 00 05 03 07 00 00 40 00 00 00 22 49 15 > 2007-03-05 10:52 +0000fd90 0b 00 33 00 0f 00 00 05 03 07 00 00 40 00 00 00 11 51 15 > 2007-03-05 10:53 +0000fd90 00 00 35 00 0f 00 00 05 03 07 00 00 40 00 00 00 00 53 15 > 2007-03-05 10:55 +0000fd90 32 00 36 00 0f 00 00 05 03 07 00 00 40 00 00 00 50 54 15 > 2007-03-05 10:57 +0000fd90 28 00 38 00 0f 00 00 05 03 07 00 00 40 00 00 00 40 56 15 > 2007-03-05 11:00 +0000fd90 0e 00 3b 00 0f 00 00 05 03 07 00 00 40 00 00 00 14 59 15 > 2007-03-05 11:02 +0000fd90 05 00 01 00 10 00 00 05 03 07 00 00 40 00 00 00 05 01 16 > 2007-03-05 11:03 +0000fd90 36 00 02 00 10 00 00 05 03 07 00 00 40 00 00 00 54 02 16 > 2007-03-05 11:05 +0000fd90 2c 00 04 00 10 00 00 05 03 07 00 00 40 00 00 00 44 04 16 > 2007-03-05 13:01 +0000fd90 22 00 3b 00 11 00 00 05 03 07 00 00 40 00 00 00 34 59 17 > These timestamps are the ones of the rom files; the actual boot time would be > 30-60 seconds earlier. > > The boot at 2007-03-05 10:17 was a cold boot. > > The boot at 2007-03-05 11:00 was a cold boot. > > The boot at 2007-03-05 13:01 was a *really* cold boot: I unplugged power, > waited 10 seconds, and then replugged and started the machine. Was the down time (from shutdown to power on) like a few seconds/minutes or longer? I try to distinguish between last *shutdown* time and last *boot* time. For the boot 2007-03-05 10:17, there is a 16 minute difference, if we interpret the numbers in the image as time in UTC, for 2007-03-05 10:48 a 4 minute difference, while for the others more like within one minute. This suggest that it could be correlated with last shutdown time. A possible experiment to distinguish between shutdown and boot time could be to do dumps after a 10 minute shutdown and a 1 minute shutdown. If the interpreted time in the image differs by approximately 10 minutes in the first case, I believe we have shown it to be the shutdown time. /ulf -- linuxbios mailing list linuxbios@linuxbios.org http://www.openbios.org/mailman/listinfo/linuxbios