[amboar]

> The BMC (IPMI) is also a self sufficient ARM computer

ASPEED BMC SoCs (popular BMC SoCs also used in OpenPOWER systems) have a ColdFire (m68k) co-processor buried inside them. In OpenPOWER OpenBMC firmwares we use the ColdFire to bitbang a JTAG-ish protocol into the POWER chip

[jacquesm]

Writable microcode?

[monocasa]

If it's anything like Cell, it's just a bunch of fairly boring configuration information. If you want to dig in more it's called the "Configuration Ring". It's an about 2kbit SPI ring that has stuff like memory timings, and all the stuff that might get fused off for binning. On the PS3 you could try and turn on the SPE that was disabled by playing with the config ring, and see if you got lucky and had a perfect chip.