Chainloading U-Boot from Fastboot on Tegra30

[Simon Glass]

Hi Peter,

On Mon, 6 Jul 2020 at 05:52, Peter Geis <pgwipeout at gmail.com> wrote:
>
> On Sun, Jul 5, 2020 at 11:35 AM Simon Glass <sjg at chromium.org> wrote:
> >
> > Hi Peter,
> >
> > On Sun, 5 Jul 2020 at 05:33, Peter Geis <pgwipeout at gmail.com> wrote:
> > >
> > > On Sat, Jul 4, 2020 at 3:53 PM Simon Glass <sjg at chromium.org> wrote:
> > > >
> > > > Hi Peter,
> > > >
> > > > On Fri, 3 Jul 2020 at 06:33, Peter Geis <pgwipeout at gmail.com> wrote:
> > > > >
> > > > > Good Morning,
> > > > >
> > > > > I am attempting to expand on the work for chainloading U-Boot on the
> > > > > nyan-big in order to chainload U-Boot on the Ouya Tegra30 device from fastboot.
> > > > > I have so far been unsuccessful at getting any output from U-Boot
> > > > > through this method.
> > > > >
> > > > > I'm building the cardhu board with tweaks for Ouya's specifications
> > > > > similar to my work for the linux kernel.
> > > > > I build the image using mkbootimg --kernel u-boot.bin --ramdisk
> > > > > /dev/null --output u-boot-android.bin.
> > > > > I then fastboot boot u-boot-android.bin.
> > > > >
> > > > > I've tried tweaking the text base and tried both standard debug and
> > > > > low level debug.
> > > > >
> > > > > Do you think you could give me some insight into where I'm going wrong?
> > > >
> > > > Is it possible that fastboot expects a relocatable image? If you set
> > > > up the debug UART very early you might be able to output a character
> > > > in start.S ?
> > >
> > > Yes, fastboot expects a relocatable image.
> > > As I understand it though, if I get the text base correct, U-boot will
> > > not need to relocate.
> > >
> > > The debug UART is already set up when it fastboot jumps to the loaded kernel,
> > > So I should be able to dump data to the expected raw address and it
> > > will show up?
> >
> > Yes, so long as you know the address. Is the MMU turned off? Cache?
>
> It is unknown what state either of these are in, since I am unfamiliar
> at all with how fastboot functions with these.
> In U-boot yes the MMU was enabled as well as both I and D cache.
>
> >
> > >
> > > >
> > > > BTW does U-Boot have support for the fastboot protocol? Perhaps you
> > > > could just use U-Boot?
> > >
> > > The Ouya is locked with a signed boot loader, like most consumer
> > > android devices.
> > > Unlike most other devices, it does not have a hardware method for
> > > entering the bootloader in case of a brick.
> > > We are currently using a hacked kernel that stores another kernel in
> > > "safe" ram via kexec and hard resets the board, but a proper
> > > bootloader would be much more preferable.
> >
> > OK. Maybe there is someone on this list with a bit more Android
> > booting experienec?
> >
> > >
> > > I found one example of where fastboot chainloaded u-boot successfully
> > > on the galaxy nexus, from 2013.
> > > https://forum.xda-developers.com/galaxy-nexus/bootloader-boot-multi-boot-support-t2201146
> >
> > OK, I'm sure it is possible. Do you have the source code for the
> > fastboot code that boots U-Boot?
>
> No, we have the reference code here:
> https://android.googlesource.com/platform/bootable/bootloader/legacy/+/b1fde5cd7d5158b8e6876139ca76a341d0e49708/usbloader/usbloader.c
>
> Unfortunately the behavior observed in the Ouya shows it has been
> heavily modified from this baseline.
>
> I've reached out to the dev who performed the work on u-boot for
> insight as well.

If you have a kernel that loads at the same address that works, and it
can display a UART character very early, then you should be able to
make a U-Boot that does the same in the first few instructions. If you
can't get that far, something else is going on. Do you have JTAG
access?

Regards,
Simon