kwboot: Marvell Dove UART booting

[Tony Dinh]

Hi Pali,

On Wed, Dec 22, 2021 at 8:08 PM Tony Dinh <mibodhi at gmail.com> wrote:
>
> Hi all,
>
> With great help from Pali, I've made some good progress on
> kwboot the HP Thin Client T5335z (Marvell Dove SoC) board.
> I had been unsuccessful running kwboot with this box until Pali
> pointed out a few important aspects of the Dove SoC, and how the
> BootROM commands work (my apology for forgetting to include the
> u-boot-mailing list and Marek on previous email exchanges).
>
> Here is the summary of the attempt to kwboot.
>
> HP Thin Client T5335z
> Marvell Dove SoC 88AP510 (A1)
> 1Ghz CPU
> 1 GB RAM
>
> - Reset Strapping:
>
> As with all Dove SoCs, there is no preamble
> when we send the u-boot image over the serial line. IOW, no magic
> handshake string to tell the BootROM that we are booting over UART.
> Instead, the hardware must explicitly set to UART mode booting.
> For boards like the Solidrun Cubox, there is a button, and some other
> board, a DIP switch, to enable this mode. For the T55335z, there is
> no button or DIP switch on the board for that purpose. Instead, there
> is a jumper (the exact purpose is unknown), but I found that this jumper
> will put the BootROM into debug mode. And from the BootROM debug prompt,
> we can execute a command to set the boot mode to UART with "x command.
>
> Here is the log and my commentary starting with ***
>
> <Begin log>
>
> *** With jumper inserted, serial console connected, start serial console
>
> # picocom --b 115200 --f n --p n --d 8 /dev/ttyUSB0
> Terminal ready
>
> *** Hit <Enter> here to get to the prompt and execute "x 0x0E"
>
> Bootstrap 2.33>
> Bootstrap 2.33>x 0x0E
>
> *** No more input possible here,  so Control-A-X to exit serial console
>
> Terminating...
> Thanks for using picocom
>
> *** Run kwboot
>
> # kwboot -t -p -B 115200 /dev/ttyUSB0 -D /localdisk/mtd0.t5335z
> Patching image boot signature to UART
> Aligning image header to Xmodem block size
> Waiting 2s and flushing tty
> Sending boot image header (512 bytes)...
>  25 % [....                                                                  ]
> Done
> Sending boot image data (607664 bytes)...
>   0 % [......................................................................]
>   1 % [......................................................................]
>   2 % [......................................................................]
> <snip>
>  95 % [......................................................................]
>  97 % [......................................................................]
>  98 % [..........................................................            ]
> Done
> Finishing transfer
> [Type Ctrl-\ + c to quit]
>
> *** Hung here! BootROM did not execute the image payload.
> ***
> *** The file mtd0.t5335z is a dd dump from the SPI flash mtd0 with
> *** this command:
> ***     # dd if=/dev/mtd0 of=mtd0.t5335z bs=768k conv=sync
>
> <End log>
>
>
> - Pali's observation:
>
> It looks like Dove uses kwbimage v0 format with extensions, at
> least according to Function Spec. See 'Binary Code Extension' and
> 'Header Extension'. Currently kwboot and kwbimage supports v0 image only
> with one extension.
>
> - My comments in response:
>
> Indeed. I've seen that in the Functional Spec, too. The mdt0 binwalk also shows
> what looks like the extension header.
>
> DECIMAL       HEXADECIMAL     DESCRIPTION
> --------------------------------------------------------------------------------
> 118161        0x1CD91         Certificate in DER format (x509 v3),
> header length: 4, sequence length: 3
> 199169        0x30A01         Certificate in DER format (x509 v3),
> header length: 4, sequence length: 5464
> 380652        0x5CEEC         CRC32 polynomial table, little endian
> 387072        0x5E800         CRC32 polynomial table, little endian
> 608166        0x947A6         LZMA compressed data, properties: 0x66,
> dictionary size: 0 bytes, uncompressed size: 147351982848 bytes
>
> Thanks,
> Tony

Follow up on the UART booting session before.

Thanks for the advice about the Reset Strapping documentation. I've
extracted the attachment 88AP510_Reset_Strapping.xls from the HW Spec
for Dove at:
https://www.kernel.org/doc/html/latest/arm/marvell.html

Listed below are the Boot Modes that are relevant to this subject
(there are other Boot Modes for SATA, NAND but we are not interested
in those):

0x00 Direct boot from SPI
0x01 Boot from SPI with 3 address cycles
0x02 Boot from SPI with 4 address cycles
0x0E Boot from UART0 using Xmodem
0x0F Boot from UART1 using Xmodem
0x10 Open BootROM debug prompt on UART0
0x11 Open BootROM debug prompt on UART1

So it does look like the jumper on this HP T5335z is actually to put
the box into BootROM debug mode using 0x10. And from there, we can use
0x0E to put the BootROM into UART0 booting mode.

Oddly, I've also tried booting from SPI while at the BootROM debug
prompt, but have not been successful with either 0x00, 0x01, or 0x02.
I was hoping that it would make testing easier if I could run "Boot
from SPI" to boot into Linux without having to remove the jumper.

Thanks,
Tony