Deliver bootloader to fsp and pnor

Minimal load application -- Create the main bootloader application that
drives the load, verification, and relocation of the HBB image and that
branches execution to the beginning of the HBB memory.

Bootloader Stack Space -- Implement option of allocating stack space in main
store apart from the bootloader image so as to not use up image space and to
allow sufficient stack space.

Deliver the HBBL (HostBoot BootLoader) image out to FIPS.
Create an HBBL partition in the PNOR.

Change-Id: I659f19428a8588c4b9bea13338efd46c70caaf43
RTC:137932
Depends-on:I740f6f8a707760756a261535e62e2d0a849324f8
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/809
Tested-by: Jenkins Server
Reviewed-by: Christian R. Geddes <crgeddes@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>
Reviewed-by: William G. Hoffa <wghoffa@us.ibm.com>

11 files changed, 446 insertions, 123 deletions

diff --git a/src/bootloader.ld b/src/bootloader.ld
index 0e2feae9f..0550a58b3 100644
--- a/src/bootloader.ld
+++ b/src/bootloader.ld
@@ -24,7 +24,9 @@
 /*                                                                        */
 /* IBM_PROLOG_END_TAG                                                     */
 base_load_address = 0x00000000;
-text_load_address = 0x00000020;
+/* @TODO-RTC:138273-Support multiple nodes using relative HRMOR */
+/* Text section offset = 12KB (space reserved for exception vectors)      */
+text_load_address = 0x00003000;
 
 SECTIONS
 {
diff --git a/src/bootloader/bl_pnor_ecc.C b/src/bootloader/bl_pnor_ecc.C
index df7e9d6ee..97e92c2d8 100644
--- a/src/bootloader/bl_pnor_ecc.C
+++ b/src/bootloader/bl_pnor_ecc.C
@@ -29,9 +29,9 @@
 #include <stdio.h>
 #include <endian.h>
 
-#include <usr/pnor/ecc.H>
+#include <ecc.H>
 
-#include <../usr/pnor/ecc.C>
+#include <ecc.C>
 
 #undef bl_pnor_ecc_C
 
diff --git a/src/bootloader/bl_pnor_utils.C b/src/bootloader/bl_pnor_utils.C
new file mode 100644
index 000000000..cca6f25d1
--- /dev/null
+++ b/src/bootloader/bl_pnor_utils.C
@@ -0,0 +1,59 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/bootloader/bl_pnor_utils.C $                              */
+/*                                                                        */
+/* OpenPOWER HostBoot Project                                             */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* [+] International Business Machines Corp.                              */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+
+#include <bootloader/bootloader.H>
+
+#define bl_pnor_utils_C
+
+#include <stdio.h>
+#include <endian.h>
+
+int strcmp(const char *str1, const char *str2)
+{
+    for(uint32_t strcmp_index = 0;
+        strcmp_index < 12;
+        strcmp_index++)
+    {
+        if((str1[strcmp_index] == '\0') && (str2[strcmp_index] == '\0'))
+        {
+            return 0;
+        }
+        else if(str1[strcmp_index] ==  str2[strcmp_index])
+        {
+            continue;
+        }
+        else
+        {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+#include <pnor_utils.C>
+
+#undef bl_pnor_utils_C
+
+
diff --git a/src/bootloader/bl_start.S b/src/bootloader/bl_start.S
index 9f190b11f..9af07a45f 100644
--- a/src/bootloader/bl_start.S
+++ b/src/bootloader/bl_start.S
@@ -41,7 +41,6 @@ _start:
     mtsrr1 r2
     li r2, _start_postmsr@l
     mtsrr0 r2
-    b _start_postmsr
 
 _start_postmsr:
 
@@ -59,63 +58,6 @@ _start_postmsr:
     bne 1b ;// Loop until sucessful at stwcx.
     isync
 
-    b _main
-
-
-/* @TODO RTC:133821 might not be needed
-    ;// Relocate code
-    bl pre_relocate     ;// fill LR with address
-pre_relocate:
-    mflr r2
-    lis r1,0x0010
-    cmpl cr0,r2,r1              ;// Check LR is less than 1MB
-    blt finished_relocate       ;// No need to relocate if less than 1MB
-
-    ;// Get addresses for relocation.
-    ;// Write address in r5
-    ;// Read address in r1
-    li r5,0
-    lis r1, -1  ;// fill r1 with ffff..ff0000
-
-    and r1,r1,r2 ;// and with pre_relocate's address from r2 to get start of
-                 ;// rom section.
-
-    ;// Update LR to low address.
-    clrldi r2,r2,48  ;// Equiv to ~(0x0FFFF)
-    mtlr 2
-
-    ;// Moving 1MB , so load r2 with (1MB / 8 bytes per word)
-    lis r2, 0x2
-    mtctr r2
-relocate_loop:
-    ;// The dcbst/sync/icbi/isync sequence comes from PowerISA
-    ld r4, 0(r1)
-    std r4, 0(r5)
-    dcbst 0,r5
-    sync
-    icbi 0,r5
-    isync
-    addi r1,r1,8
-    addi r5,r5,8
-    bdnz+ relocate_loop
-
-    ;// Now that we've relocated, erase exception prefix.
-    mfmsr r11
-
-    rldicl r11,r11,57,1  ;// Erase bit 6 ( equiv to r11 & ~(0x40))
-    rotldi r11,r11,7
-
-    mtmsr r11
-
-    ;// Jump to low address.
-    blr
-
-finished_relocate:
-    ;// Jump to main.
-    b _main
-@TODO RTC:133821 might not be needed */
-
-
 ;// _main:
 ;//     Set up stack and TOC and call kernel's main.
 _main:
@@ -124,10 +66,22 @@ _main:
     ori r2, r2, main@l
     ld r2,8(r2)
 
-    ;// Set up initial stack, space for 8 double-words
-    lis r1, kernel_stack@h
-    ori r1, r1, kernel_stack@l
-    addi r1, r1, 16320
+    ;// Set up initial stack just before scratch space at 64k offset into HBBL
+    lis r1, _start@h
+    addis r1, r1, 1 ;// 64k (1 * 0x10000)
+
+    ;// Zero space from end of load to bottom of stack
+    lis r3, end_load_address@h
+    ori r3, r3, end_load_address@l
+    li r4, 7
+    add r3, r3, r4
+    andc r3, r3, r4
+    li r4, 0
+_zero_space_loop:
+    std r4, 0(r3)
+    addi r3, r3, 8
+    cmpld cr7, r3, r1
+    blt cr7, _zero_space_loop
 
     ;// Call main.
     bl main
@@ -161,22 +115,76 @@ task_end_stub:
     sc
 
 
-.section .data
+    ;// @fn enterHBB
+    ;// Leave the Bootloader and switch to the Hostboot Base (HBB).
+    ;//
+    ;// Steps:
+    ;//     Retrieve existing HRMOR.
+    ;//     Determine physical address of EA[0]=1 mode instruction.
+    ;//     Jump to enter EA[0]=1 mode.
+    ;//     Update HRMOR.
+    ;//     Execute isync.
+    ;//     Enter Hostboot Base (HBB).
+    ;//
+    ;// @param[in] r3 - Hostboot HRMOR
+    ;// @param[in] r4 - Hostboot Entry
+    ;//
+.global enterHBB
+enterHBB:
+        ;// Set R10 to 0x8000000000000000 so we can set "EA[0]=1" for addrs.
+    li r10, 1
+    rotldi r10, r10, 63
+
+        ;// Retrieve existing HRMOR.
+    mfspr r0, HRMOR
+
+        ;// Determine physical address of EA[0]=1 mode instruction.
+    lis r9, switchToHBB@h
+    ori r9, r9, switchToHBB@l
+    or r9, r9, r0       ;// Apply HRMOR.
+    or r9, r9, r10      ;// Apply EA[0]=1.
+
+        ;// Jump to enter EA[0]=1
+    mtlr r9
+    blr
 
-    .balign 1024
-kernel_stack:
-    .space 4*1024
+switchToHBB:
+        ;// Update HRMOR
+    mtspr HRMOR, r3
+
+        ;// Execute isync
+    isync
+
+        ;// Enter Hostboot Base (HBB).
+    mtsrr0 r4
+    rfid
 
-    .balign 8
-.global data_sandbox
-data_sandbox:
-    .space 64
 
+.section .data
+
+    .balign 8
 .global kernel_other_thread_spinlock
 kernel_other_thread_spinlock:
     .space 8
 
-.global g_blScratchSpace
-g_blScratchSpace:
-    .space 8
+    ;// @name bootloader_trace_index
+    ;// @brief Index for Bootloader Trace entries
+    ;// One-byte index for next entry to use in bootloader_trace.
+.global bootloader_trace_index
+bootloader_trace_index:
+    .space 1
+
+    .balign 16
+    ;// @name bootloader_trace
+    ;// @brief Buffer for Bootloader Trace data
+    ;// Buffer with bootloader trace entries.  There are 64 one-byte entries
+    ;// in the buffer.  They are used to track events that have occurred in
+    ;// the bootloader code.  After all entries have been used, the buffer
+    ;// wraps and the oldest entry is overwritten by the newest trace data.
+.global bootloader_trace
+bootloader_trace:
+    .space 64
 
+.global bootloader_hbbSection
+bootloader_hbbSection:
+    .space 32
diff --git a/src/bootloader/bootloader.C b/src/bootloader/bootloader.C
index 462217d76..8f63ae925 100644
--- a/src/bootloader/bootloader.C
+++ b/src/bootloader/bootloader.C
@@ -22,63 +22,225 @@
 /* permissions and limitations under the License.                         */
 /*                                                                        */
 /* IBM_PROLOG_END_TAG                                                     */
+
+#define __BOOT_LOADER_C
+
 #include <stdint.h>
 #include <bootloader/bootloader.H>
-#include <util/singleton.H>
-#include <kernel/cpu.H>
+#include <bootloader/bootloader_trace.H>
+#include <bootloader/bl_pnorAccess.H>
 
-#include <kernel/intmsghandler.H> // @TODO RTC:133821 might not be needed long-term
+#include <lpc_const.H>
+#include <pnor_utils.H>
 
-#include <usr/pnor/ecc.H>
+#include <ecc.H>
 
 #include <stdlib.h>
 
 extern uint64_t kernel_other_thread_spinlock;
-extern uint32_t data_sandbox[16]; // @TODO RTC:133821 temporary bringup
+extern PNOR::SectionData_t bootloader_hbbSection;
 
 namespace Bootloader{
+    /**
+     * @brief Pointer to bootloader scratch space
+     *
+     * Pointer to location in main storage which bootloader uses as
+     * scratch space
+     */
+    uint8_t *g_blScratchSpace;
+
+    /** Apply Secure Signature Validation function.
+     *
+     *  @note Currently just a stub.
+     */
+    void applySecureSignatureValidation()
+    {
+        // (just an empty stub function for now) @TODO RTC:143902
+    }
+
+
+    /** Bootloader main function to work with and start HBB.
+     *
+     * @return 0.
+     *
+     * @note Should branch to HBB and never return.
+     */
     extern "C"
     int main()
     {
-        // cppBootstrap(); @TODO RTC:133821 might not be needed long-term
-        // cv_blScratchSpace = ??? @TODO RTC:133821
+        // Initialization
+        bootloader_trace_index = 0;
+        BOOTLOADER_TRACE(BTLDR_TRC_MAIN_START);
+        g_blScratchSpace = reinterpret_cast<uint8_t*>(HBBL_SCRATCH_SPACE_ADDR);
 
-        // @TODO RTC:134064 Get location of HB base code in PNOR from TOC
+        // Set variables needed for getting location of HB base code
+        // @TODO RTC:138268 Support multiple sides of PNOR in bootloader
+        uint64_t l_pnorStart = LPC::LPC_PHYS_BASE + LPC::LPCHC_FW_SPACE
+                             + PNOR::LPC_SFC_MMIO_OFFSET;
+        uint32_t l_errCode = PNOR::NO_ERROR;
+        uint8_t l_tocUsed = 0;
 
-        // @TODO RTC:133821 Copy HB base code from PNOR to 0x200000
+        // Get location of HB base code in PNOR from TOC
+        // @TODO RTC:138268 Support multiple sides of PNOR in bootloader
+        bl_pnorAccess::getHBBSection(l_pnorStart,
+                                     bootloader_hbbSection,
+                                     l_errCode,
+                                     l_tocUsed);
+        BOOTLOADER_TRACE(BTLDR_TRC_MAIN_GETHBBSECTION_RTN );
 
-        // Remove ECC from HB base code at 0x200000 and store result at 0x300000
-        PNOR::ECC::eccStatus rc = PNOR::ECC::CLEAN;
-//        PNOR::ECC::removeECC(reinterpret_cast<uint8_t*>(0x200000),
-//                             reinterpret_cast<uint8_t*>(0x300000),
-//                             0x100000); // @TODO RTC:133821 determine size
-
-        if (rc != PNOR::ECC::UNCORRECTABLE)
+        if(PNOR::NO_ERROR == l_errCode)
         {
-//        memcpy(reinterpret_cast<void*>(0x300000),
-//               reinterpret_cast<void*>(0),
-//               0x100000); // @TODO RTC:133821 determine size // replace with asm cache inhibited instructions
-        }
+            // get hbbFlashOffset
+            uint64_t l_hbbFlashOffset = bootloader_hbbSection.flashAddr;
+            // get hbbLength without size of ECC data
+            uint32_t l_hbbLength = bootloader_hbbSection.size;
+            // get hbbEcc
+            bool l_hbbEcc =
+                ( bootloader_hbbSection.integrity == FFS_INTEG_ECC_PROTECT);
+            // set hbbSbeHeaderSize @TODO RTC:137480 subject to future removal
+            uint64_t l_hbbSbeHeaderSize = (l_hbbEcc)
+                                        ? (0x18 * LENGTH_W_ECC) / LENGTH_WO_ECC
+                                        : 0x18;
+
+            // Copy HB base code from PNOR to working location
+            handleMMIO(l_pnorStart + l_hbbFlashOffset + l_hbbSbeHeaderSize,
+                       (l_hbbEcc) ? HBB_ECC_WORKING_ADDR : HBB_WORKING_ADDR,
+                       (l_hbbEcc) ? (l_hbbLength * LENGTH_W_ECC)/LENGTH_WO_ECC
+                                  : l_hbbLength,
+                   BYTESIZE);
+            BOOTLOADER_TRACE(BTLDR_TRC_MAIN_WORKING_HANDLEMMIO_RTN);
 
-        // Ready to let the other CPUs go. @TODO RTC:133821 actually need to start relocated HB base code
-        lwsync();
-        kernel_other_thread_spinlock = 1;
+            PNOR::ECC::eccStatus rc = PNOR::ECC::CLEAN;
+            if(l_hbbEcc)
+            {
+                // Remove ECC from HB base code at in working location and
+                // store result in new working location
+                rc = PNOR::ECC::removeECC(
+                    reinterpret_cast<uint8_t*>(HBB_ECC_WORKING_ADDR |
+                                               IGNORE_HRMOR_MASK),
+                    reinterpret_cast<uint8_t*>(HBB_WORKING_ADDR |
+                                               IGNORE_HRMOR_MASK),
+                    l_hbbLength);
+                if (rc != PNOR::ECC::CLEAN)
+                {
+                    BOOTLOADER_TRACE(BTLDR_TRC_MAIN_REMOVEECC_RTN);
+                }
+                else if (rc != PNOR::ECC::CORRECTED)
+                {
+                    BOOTLOADER_TRACE(BTLDR_TRC_MAIN_REMOVEECC_CORRECTED);
+                }
+            }
 
-        data_sandbox[8] = 0x12345678; // @TODO RTC:133821 temporary bringup
+            if (rc != PNOR::ECC::UNCORRECTABLE)
+            {
+                // Apply secure signature validation @TODO RTC:143902
+                applySecureSignatureValidation();
+                BOOTLOADER_TRACE(BTLDR_TRC_MAIN_APPLYSECSIGVAL_RTN);
 
-        MAGIC_INSTRUCTION(MAGIC_BREAK); // @TODO RTC:133821 temporary bringup
+                // Copy HBB image into address where it executes
+                uint64_t *l_src_addr =
+                   reinterpret_cast<uint64_t*>(HBB_WORKING_ADDR |
+                                               IGNORE_HRMOR_MASK);
+                uint64_t *l_dest_addr =
+                   reinterpret_cast<uint64_t*>(HBB_RUNNING_ADDR |
+                                               IGNORE_HRMOR_MASK);
+                for(uint32_t i = 0;
+                    i < l_hbbLength / sizeof(uint64_t);
+                    i++)
+                {
+                    l_dest_addr[i] = l_src_addr[i];
+                }
+                BOOTLOADER_TRACE(BTLDR_TRC_MAIN_COPY_HBB_DONE);
+
+                // Start executing HBB
+                enterHBB(HBB_HRMOR, HBB_RUNNING_OFFSET);
+            }
+            else
+            {
+                BOOTLOADER_TRACE_W_BRK(BTLDR_TRC_MAIN_REMOVEECC_FAIL);
+            }
+        }
+        else
+        {
+            BOOTLOADER_TRACE_W_BRK(BTLDR_TRC_MAIN_GETHBBSECTION_FAIL);
+        }
 
-        while(1); // @TODO
-        task_end_stub(); // @TODO
         return 0;
     }
 
+
+    /** Handle MMIO to copy code/data from location to another.
+     *
+     * @param[in] i_srcAddr - The source location.
+     * @param[in] i_destAddr - The destination location.
+     * @param[in] i_size - The size of the code/data.
+     * @param[in] i_ld_st_size - The size of each load/store operation.
+     *
+     * @return void.
+     */
     void handleMMIO(uint64_t i_srcAddr,
                     uint64_t i_destAddr,
                     uint32_t i_size,
                     MMIOLoadStoreSizes i_ld_st_size)
     {
-        // @TODO RTC:133821
+        BOOTLOADER_TRACE(BTLDR_TRC_HANDLEMMIO_START);
+
+        // Set base addresses, Ignore HRMOR setting
+        uint64_t l_srcAddr_base = i_srcAddr | IGNORE_HRMOR_MASK;
+        uint64_t l_destAddr_base = i_destAddr | IGNORE_HRMOR_MASK;
+
+        uint32_t l_targetGPR = 0;
+
+        for(uint32_t i = 0;
+            i < i_size;
+            i += i_ld_st_size)
+        {
+            // Set addresses
+            uint64_t l_srcAddr = l_srcAddr_base + i;
+            uint64_t l_destAddr = l_destAddr_base + i;
+
+            if(i_ld_st_size == BYTESIZE)
+            {
+                // Cache-inhibited load byte from hypervisor state.
+                // lbzcix      BOP1,Ref_G0,BOP2
+                asm volatile("lbzcix %0, 0, %1"
+                             : "=r" (l_targetGPR)    // output, %0
+                             : "r" (l_srcAddr)       // input,  %1
+                             : );                    // no impacts
+
+                // Cache-inhibited store byte.
+                // stbcix      BOP1,Ref_G0,BOP2
+                asm volatile("stbcix %0,0,%1"
+                             :: "r" (l_targetGPR) , "r" (l_destAddr));
+            }
+            else if(i_ld_st_size == WORDSIZE)
+            {
+                // Cache-inhibited load word from hypervisor state.
+                // lwzcix      BOP1,Ref_G0,BOP2
+                asm volatile("lwzcix %0, 0, %1"
+                             : "=r" (l_targetGPR)    // output, %0
+                             : "r" (l_srcAddr)       // input,  %1
+                             : );                    // no impacts
+
+                // Cache-inhibited store word.
+                // stwcix      BOP1,Ref_G0,BOP2
+                asm volatile("stwcix %0,0,%1"
+                             :: "r" (l_targetGPR) , "r" (l_destAddr));
+            }
+            else
+            {
+                // Cache-inhibited load double word from hypervisor state.
+                // ldcix       BOP1,Ref_G0,BOP2
+                asm volatile("ldcix %0, 0, %1"
+                             : "=r" (l_targetGPR)    // output, %0
+                             : "r" (l_srcAddr)       // input,  %1
+                             : );                    // no impacts
+
+                // Cache-inhibited store double word.
+                // stdcix      BOP1,Ref_G0,BOP2
+                asm volatile("stdcix %0,0,%1"
+                             :: "r" (l_targetGPR) , "r" (l_destAddr));
+            }
+        }
     }
 } // end namespace Bootloader
-
diff --git a/src/bootloader/makefile b/src/bootloader/makefile
index cf5fe04a6..2513e7089 100644
--- a/src/bootloader/makefile
+++ b/src/bootloader/makefile
@@ -24,8 +24,16 @@
 # IBM_PROLOG_END_TAG
 ROOTPATH = ../..
 
+EXTRAINCDIR += ${ROOTPATH}/src/usr/pnor/
+EXTRAINCDIR += ${ROOTPATH}/src/usr/lpc/
+EXTRAINCDIR += ${ROOTPATH}/src/include/usr/
+EXTRAINCDIR += ${ROOTPATH}/src/include/usr/pnor/
+EXTRAINCDIR += ${ROOTPATH}/src/include/usr/lpc/
+
 OBJS += bl_start.o
 OBJS += bootloader.o
+OBJS += bl_pnorAccess.o
+OBJS += bl_pnor_utils.o
 OBJS += bl_pnor_ecc.o
 OBJS += bl_builtins.o
 
diff --git a/src/build/buildpnor/defaultPnorLayout.xml b/src/build/buildpnor/defaultPnorLayout.xml
index adb04fdb0..fa693d6b9 100644
--- a/src/build/buildpnor/defaultPnorLayout.xml
+++ b/src/build/buildpnor/defaultPnorLayout.xml
@@ -5,7 +5,7 @@
 <!--                                                                        -->
 <!-- OpenPOWER HostBoot Project                                             -->
 <!--                                                                        -->
-<!-- Contributors Listed Below - COPYRIGHT 2012,2015                        -->
+<!-- Contributors Listed Below - COPYRIGHT 2012,2016                        -->
 <!-- [+] International Business Machines Corp.                              -->
 <!--                                                                        -->
 <!--                                                                        -->
@@ -202,6 +202,14 @@ Layout Description
         <ecc/>
     </section>
     <section>
+        <description>Hostboot Bootloader (22.5K)</description>
+        <eyeCatch>HBBL</eyeCatch>
+        <physicalOffset>0x2427000</physicalOffset>
+        <physicalRegionSize>0x6000</physicalRegionSize>
+        <side>sideless</side>
+        <ecc/>
+    </section>
+    <section>
         <description>Hostboot Base (576K)</description>
         <!--NOTE: MUST update standalone.simics if offset changes -->
         <!--NOTE: HBB must be at pnorSize-0x99000 for a new proc
diff --git a/src/build/mkrules/dist.targets.mk b/src/build/mkrules/dist.targets.mk
index 5852c1158..0256f55e6 100644
--- a/src/build/mkrules/dist.targets.mk
+++ b/src/build/mkrules/dist.targets.mk
@@ -98,7 +98,7 @@ COPY_RENAME_FILES = \
     makefile:src/build/mkrules/hbfw/makefile:fsp\
     img/makefile:src/build/mkrules/hbfw/img/makefile:fsp \
     hbicore.bin:img/hbicore$(UNDERSCORE_TEST).bin:vpo \
-    img/bootloader.bin:img/bootloader.bin:fsp,openpower \
+    img/hostboot_bootloader.bin:img/hbibl.bin:fsp,openpower \
     img/hostboot.bin:img/hbicore$(UNDERSCORE_TEST).bin:fsp,openpower \
     img/hostboot_extended.bin:img/hbicore$(UNDERSCORE_TEST)_extended.bin:fsp,openpower \
     img/hostboot_runtime.bin:img/hbirt$(UNDERSCORE_TEST).bin:fsp,openpower \
@@ -109,6 +109,9 @@ COPY_RENAME_FILES = \
     hbirt.syms:img/hbicore$(UNDERSCORE_TEST).syms:tools,vpo,openpower \
     hbirt.list.bz2:img/hbirt$(UNDERSCORE_TEST).list.bz2:tools,vpo,openpower \
     hbirt.bin.modinfo:img/hbirt$(UNDERSCORE_TEST).bin.modinfo:tools,vpo,openpower \
+    hbibl.syms:img/hbibl.syms:tools,vpo,openpower \
+    hbibl.list.bz2:img/hbibl.list.bz2:tools,vpo,openpower \
+    hbibl.bin.modinfo:img/hbibl.bin.modinfo:tools,vpo,openpower \
     $(foreach file, $(call ROOTPATH_WILDCARD,src/build/debug/Hostboot/*.pm), \
 	Hostboot/$(notdir $(file)):$(file):tools,vpo,openpower)
 
@@ -177,6 +180,9 @@ simics.tar_CONTENTS = \
     img/hbirt$(UNDERSCORE_TEST).syms \
     img/hbirt$(UNDERSCORE_TEST).list.bz2 \
     img/hbirt$(UNDERSCORE_TEST).bin.modinfo \
+    img/hbibl.syms \
+    img/hbibl.list.bz2 \
+    img/hbibl.bin.modinfo \
     img/errlparser \
     img/isteplist.csv \
     img/hbotStringFile \
diff --git a/src/build/mkrules/hbfw/img/makefile b/src/build/mkrules/hbfw/img/makefile
index fda6e44ac..11e9c5f57 100755
--- a/src/build/mkrules/hbfw/img/makefile
+++ b/src/build/mkrules/hbfw/img/makefile
@@ -51,7 +51,9 @@ ENGD_OBJPATH = ${HBFW_OBJPATH:S/hbfw\/img/engd\/href/g}
 # Having external users acquire from OBJ dir as there are packaging
 # changes expected in the future which will require using OBJ version.
 #################################################
-BOOTLDR_IMAGE = bootloader.bin
+BOOTLDR_IMAGE = hostboot_bootloader.bin
+HBBL_IMAGE = hbbl.bin
+HBBL_ECC_IMAGE = hbbl.bin.ecc
 BASE_IMAGE = hostboot.bin
 EXT_IMAGE =  hostboot_extended.bin
 EXT_FAKE_IMAGE = hostboot_extended.bin.fake
@@ -59,7 +61,7 @@ HBRT_IMAGE = hostboot_runtime.bin
 HBRT_SHA_IMAGE = hostboot_runtime.sha.bin
 HBRT_HEADER_IMAGE = hostboot_runtime.header.bin
 HBRT_ECC_HEADER_IMAGE = hostboot_runtime.header.bin.ecc
-BASE_IMAGES = ${BASE_IMAGE} ${EXT_IMAGE} ${HBRT_IMAGE}
+BASE_IMAGES = ${BASE_IMAGE} ${EXT_IMAGE} ${HBRT_IMAGE} ${BOOTLDR_IMAGE}
 BASE_W_HEADER_IMAGE = hostboot.header.bin
 BASE_W_HEADER_ECC_IMAGE = hostboot.header.bin.ecc
 BASE_ECC_IMAGE = hostboot.bin.ecc
@@ -92,6 +94,7 @@ ALL_HB_IMAGES = ${BASE_IMAGES} \
                 ${EXT_PAD_IMAGE} \
                 ${EXT_SHA_IMAGE} ${EXT_HEADER_IMAGE} \
                 ${EXT_ECC_HEADER_IMAGE} \
+                ${BOOTLDR_IMAGE} ${HBBL_IMAGE} ${HBBL_ECC_IMAGE} \
                 ${TESTDATA} ${TESTDATA_ECC} \
                 ${HBEL_ECC_IMAGE} ${GUARD_ECC_IMAGE} ${GLOBAL_ECC_IMAGE} \
                 ${DJVPD_ECC_IMAGE} ${MVPD_ECC_IMAGE} ${CVPD_ECC_IMAGE} \
@@ -174,6 +177,11 @@ cp_hbfiles: .SPECTARG
 	dd if=/dev/zero bs=20480K count=1 | tr "\000" "\377" > ${TEMP_IMAGE}
 	ecc --inject ${TEMP_IMAGE} --output ${PAYLOAD_ECC_IMAGE} --p8
 	rm ${TEMP_IMAGE}
+        # Remove offset from start of Bootloader image for HBBL partition
+        # Actual code is offset from HRMOR by 12k = 12 1k-blocks (space
+        # reserved for exception vectors)
+	dd if=${BOOTLDR_IMAGE} of=${HBBL_IMAGE} ibs=1k skip=12 conv=sync
+	ecc --inject ${HBBL_IMAGE} --output ${HBBL_ECC_IMAGE} --p8
 
 clobber_cp_hbfiles:
 	rm -f ${ALL_HB_IMAGES} \
@@ -250,7 +258,7 @@ PNOR_BUILD_SCRIPT = ${buildpnor.pl:P}
 #so need to use tryinclude for now.
 .tryinclude <${.PATH:Ffips_pnor.mk}>
 
-HOSTBOOT_DEFAULT_SECTIONS = HBB=${BASE_W_HEADER_ECC_IMAGE},HBI=${EXT_ECC_HEADER_IMAGE},HBRT=${HBRT_ECC_HEADER_IMAGE},TEST=${TESTDATA_ECC},TESTRO=${TESTDATA_ECC},HBEL=${HBEL_ECC_IMAGE},GUARD=${GUARD_ECC_IMAGE},GLOBAL=${GLOBAL_ECC_IMAGE},PAYLOAD=${PAYLOAD_ECC_IMAGE},CVPD=${CVPD_ECC_IMAGE},MVPD=${MVPD_ECC_IMAGE},DJVPD=${DJVPD_ECC_IMAGE}
+HOSTBOOT_DEFAULT_SECTIONS = HBB=${BASE_W_HEADER_ECC_IMAGE},HBI=${EXT_ECC_HEADER_IMAGE},HBRT=${HBRT_ECC_HEADER_IMAGE},HBBL=${HBBL_ECC_IMAGE},TEST=${TESTDATA_ECC},TESTRO=${TESTDATA_ECC},HBEL=${HBEL_ECC_IMAGE},GUARD=${GUARD_ECC_IMAGE},GLOBAL=${GLOBAL_ECC_IMAGE},PAYLOAD=${PAYLOAD_ECC_IMAGE},CVPD=${CVPD_ECC_IMAGE},MVPD=${MVPD_ECC_IMAGE},DJVPD=${DJVPD_ECC_IMAGE}
 HOSTBOOT_FAKEPNOR_SECTIONS = HBI=${EXT_FAKE_IMAGE},HBEL=${HBEL_IMAGE},MVPD=${MVPD_IMAGE},DJVPD=${DJVPD_IMAGE}
 
 
@@ -351,7 +359,7 @@ clobber_build_pnor_images:
 #Special target to copy images to flash dir for simics
 #################################################
 FLASH_DEST = $(MAKETOP)$(OBJECTDIRTOP)../images/$(CONTEXT)/lab/flash
-FLASH_IMG = ${BASE_IMAGE} ${BASE_ECC_IMAGE} ${BOOTLDR_IMAGE}
+FLASH_IMG = ${BASE_IMAGE} ${BASE_ECC_IMAGE} ${HBBL_IMAGE}
 FAKE_PNOR = fake6m.pnor
 
 update_images_for_sandbox: inject_ecc build_sbe_partitions build_pnor_images
diff --git a/src/include/bootloader/bootloader.H b/src/include/bootloader/bootloader.H
index 89b4bd761..65b715c09 100644
--- a/src/include/bootloader/bootloader.H
+++ b/src/include/bootloader/bootloader.H
@@ -33,15 +33,17 @@
  */
 
 #include <builtins.h>
-#include <arch/ppc.H>
+#include <pnor_const.H>
+#include <pnor_utils.H>
+#include <common/ffs_hb.H>
 
 extern "C" void task_end_stub();
+extern "C" void enterHBB(uint64_t i_hbb_hrmor, uint64_t i_hbb_offset);
 
 #define assert(expr) \
 {\
     if (unlikely(!(expr)))\
     {\
-        MAGIC_INSTRUCTION(MAGIC_BREAK); /* @TODO RTC:133821 temp bringup */ \
         task_end_stub();\
     }\
 }
@@ -49,6 +51,14 @@ extern "C" void task_end_stub();
 #define printk(format...)
 
 namespace Bootloader{
+    /**
+     * @brief Pointer to bootloader scratch space
+     *
+     * Pointer to location in main storage which bootloader uses as
+     * scratch space
+     */
+    extern uint8_t *g_blScratchSpace;
+
     /** @enum MMIOLoadStoreSizes
      *  @brief List of MMIO Load and Store Sizes.
      *
@@ -81,13 +91,57 @@ namespace Bootloader{
                            uint32_t i_size,
                            MMIOLoadStoreSizes i_ld_st_size);
 
-    /**
-     * @brief Pointer to bootloader scratch space
+    /** @enum HbbLengths
+     *  @brief List of HBB lengths.
      *
-     * Pointer to location in main storage which bootloader uses as
-     * scratch space
+     *  These are the lengths of the Hostboot Base data or instructions
+     *  with and without ECC.
      */
-    extern uint8_t *g_blScratchSpace;
+    enum HbbLengths
+    {
+        /** LENGTH_WO_ECC */
+        LENGTH_WO_ECC = 8,
+        /** LENGTH_W_ECC */
+        LENGTH_W_ECC = 9
+    };
+
+    /** @enum HbAddrs
+     *  @brief List of addresses where HBB and HBBL code is stored.
+     *
+     *  These specify locations where the Hostboot Bootloader code is
+     *  stored and where it stores the Hostboot Base code.  The HBB code
+     *  is copied to various locations as the HBBL works with it.  Then
+     *  HBB is copied to its running location and its execution is started.
+     */
+    enum HbAddrs
+    {
+        // @TODO-RTC:138273-Support multiple nodes using relative HRMOR
+
+        /** HRMOR */
+        HBBL_HRMOR = 130*MEGABYTE,
+        HBB_HRMOR = 128*MEGABYTE,
+
+        /** Location of working copy of HBB with ECC */
+        HBB_ECC_WORKING_ADDR = (HBBL_HRMOR + 1*MEGABYTE),
+
+        /** Location of HBBL */
+        HBBL_ADDR = HBBL_HRMOR,
+        /** Location of HBBL exception vectors */
+        HBBL_EXCEPTION_VECTORS_ADDR = HBBL_ADDR,
+        /** Location of HBBL code */
+        HBBL_CODE_ADDR = HBBL_ADDR + 12*KILOBYTE,
+        /** Location of HBBL scratch space */
+        HBBL_SCRATCH_SPACE_ADDR = HBBL_ADDR + 64*KILOBYTE,
+
+        /** Location of working copy of HBB without ECC */
+        HBB_WORKING_ADDR = (HBBL_HRMOR - 1*MEGABYTE),
+        /** Location of running copy of HBB */
+        HBB_RUNNING_ADDR = (HBBL_HRMOR - 2*MEGABYTE),
+        /** Offset for starting running copy of HBB */
+        HBB_RUNNING_OFFSET = 0,
+        /** Mask to indicate HRMOR should be ignored for the address */
+        IGNORE_HRMOR_MASK = 0x8000000000000000ul
+    };
 } // end namespace Bootloader
 
 #endif
diff --git a/src/makefile b/src/makefile
index 3771245d6..406a04128 100644
--- a/src/makefile
+++ b/src/makefile
@@ -37,7 +37,7 @@ SUBDIRS += runtime.d
 
 # Reducing HB extended img size for VPO by disabling certain libs using
 # CONFIG_VPO_COMPILE option
-IMGS += bootloader
+IMGS += hbibl
 IMGS += hbicore
 IMGS += hbicore_test
 IMGS += hbirt
@@ -64,6 +64,8 @@ BL_BASE_OBJECTS += bl_builtins.o
 
 BOOTLDR_OBJECTS += bl_start.o
 BOOTLDR_OBJECTS += bootloader.o
+BOOTLDR_OBJECTS += bl_pnorAccess.o
+BOOTLDR_OBJECTS += bl_pnor_utils.o
 BOOTLDR_OBJECTS += bl_pnor_ecc.o
 
 DIRECT_BOOT_OBJECTS += start.o
@@ -281,9 +283,9 @@ RUNTIME_TESTCASE_MODULES += testpnor_rt
 
 RELOCATABLE_IMAGE_LDFLAGS = -pie --export-dynamic
 
-bootloader_OBJECTS += ${BL_BASE_OBJECTS}
-bootloader_OBJECTS += ${BOOTLDR_OBJECTS}
-bootloader_LDFILE = bootloader.ld
+hbibl_OBJECTS += ${BL_BASE_OBJECTS}
+hbibl_OBJECTS += ${BOOTLDR_OBJECTS}
+hbibl_LDFILE = bootloader.ld
 
 hbicore_OBJECTS += ${BASE_OBJECTS}
 hbicore_OBJECTS += ${DIRECT_BOOT_OBJECTS}
@@ -337,6 +339,12 @@ $(IMGDIR)/hbotStringFile : $(IMAGES)
 #make sure base image isn't over 508k  (512K - 4K for secure header)
 #PROCESS: get size of hbicore.bin, sort with respect to 508k (520192), then see if
 #last word is 508k.  If not, the base image is too big.
+#make sure bootloader image isn't over 32k (32K = 12K for exception vectors +
+#20K for bootloader code and data)
+#PROCESS: get size of hbibl.bin, sort with respect to 32k (32768),
+#then see if last word is 32k.  If not, the bootloader image is too big.
 MAX_BASE_SIZE = 520192
-imgsizecheck: ${IMGDIR}/hbicore.bin
+MAX_BTLDR_SIZE = 32768
+imgsizecheck: ${IMGDIR}/hbicore.bin ${IMGDIR}/hbibl.bin
 	$(if $(findstring $(shell (stat -c%s ${IMGDIR}/hbicore.bin; echo $(MAX_BASE_SIZE)) | sort -n | tail -n1), $(MAX_BASE_SIZE)),true, @echo ERROR: ${IMGDIR}/hbicore.bin too large.  Max allowed size is $(MAX_BASE_SIZE); false)
+	$(if $(findstring $(shell (stat -c%s ${IMGDIR}/hbibl.bin; echo $(MAX_BTLDR_SIZE)) | sort -n | tail -n1), $(MAX_BTLDR_SIZE)),true, @echo ERROR: ${IMGDIR}/hbibl.bin too large.  Max allowed size is $(MAX_BTLDR_SIZE); false)