kwboot: Marvell Dove UART booting

[Tony Dinh]

Hi all,

With great help from Pali, I've made some good progress on
kwboot the HP Thin Client T5335z (Marvell Dove SoC) board.
I had been unsuccessful running kwboot with this box until Pali
pointed out a few important aspects of the Dove SoC, and how the
BootROM commands work (my apology for forgetting to include the
u-boot-mailing list and Marek on previous email exchanges).

Here is the summary of the attempt to kwboot.

HP Thin Client T5335z
Marvell Dove SoC 88AP510 (A1)
1Ghz CPU
1 GB RAM

- Reset Strapping:

As with all Dove SoCs, there is no preamble
when we send the u-boot image over the serial line. IOW, no magic
handshake string to tell the BootROM that we are booting over UART.
Instead, the hardware must explicitly set to UART mode booting.
For boards like the Solidrun Cubox, there is a button, and some other
board, a DIP switch, to enable this mode. For the T55335z, there is
no button or DIP switch on the board for that purpose. Instead, there
is a jumper (the exact purpose is unknown), but I found that this jumper
will put the BootROM into debug mode. And from the BootROM debug prompt,
we can execute a command to set the boot mode to UART with "x command.

Here is the log and my commentary starting with ***

<Begin log>

*** With jumper inserted, serial console connected, start serial console

# picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0
Terminal ready

*** Hit <Enter> here to get to the prompt and execute "x 0x0E"

Bootstrap 2.33>
Bootstrap 2.33>x 0x0E

*** No more input possible here,  so Control-A-X to exit serial console

Terminating...
Thanks for using picocom

*** Run kwboot

# kwboot -t -p -B 115200 /dev/ttyUSB0 -D /localdisk/mtd0.t5335z
Patching image boot signature to UART
Aligning image header to Xmodem block size
Waiting 2s and flushing tty
Sending boot image header (512 bytes)...
 25 % [....                                                                  ]
Done
Sending boot image data (607664 bytes)...
  0 % [......................................................................]
  1 % [......................................................................]
  2 % [......................................................................]
<snip>
 95 % [......................................................................]
 97 % [......................................................................]
 98 % [..........................................................            ]
Done
Finishing transfer
[Type Ctrl-\ + c to quit]

*** Hung here! BootROM did not execute the image payload.
***
*** The file mtd0.t5335z is a dd dump from the SPI flash mtd0 with
*** this command:
***     # dd if=/dev/mtd0 of=mtd0.t5335z bs=768k conv=sync

<End log>


- Pali's observation:

It looks like Dove uses kwbimage v0 format with extensions, at
least according to Function Spec. See 'Binary Code Extension' and
'Header Extension'. Currently kwboot and kwbimage supports v0 image only
with one extension.

- My comments in response:

Indeed. I've seen that in the Functional Spec, too. The mdt0 binwalk also shows
what looks like the extension header.

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
118161        0x1CD91         Certificate in DER format (x509 v3),
header length: 4, sequence length: 3
199169        0x30A01         Certificate in DER format (x509 v3),
header length: 4, sequence length: 5464
380652        0x5CEEC         CRC32 polynomial table, little endian
387072        0x5E800         CRC32 polynomial table, little endian
608166        0x947A6         LZMA compressed data, properties: 0x66,
dictionary size: 0 bytes, uncompressed size: 147351982848 bytes

Thanks,
Tony