kwboot: Marvell Dove UART booting

[Pali Rohár]

On Wednesday 22 December 2021 20:08:56 Tony Dinh wrote:
> *** Run kwboot
> 
> # kwboot -t -p -B 115200 /dev/ttyUSB0 -D /localdisk/mtd0.t5335z
> Patching image boot signature to UART
> Aligning image header to Xmodem block size
> Waiting 2s and flushing tty
> Sending boot image header (512 bytes)...
>  25 % [....                                                                  ]
> Done
> Sending boot image data (607664 bytes)...
>   0 % [......................................................................]
>   1 % [......................................................................]
>   2 % [......................................................................]
> <snip>
>  95 % [......................................................................]
>  97 % [......................................................................]
>  98 % [..........................................................            ]
> Done
> Finishing transfer
> [Type Ctrl-\ + c to quit]
> 
> *** Hung here! BootROM did not execute the image payload.
> ***
> *** The file mtd0.t5335z is a dd dump from the SPI flash mtd0 with
> *** this command:
> ***     # dd if=/dev/mtd0 of=mtd0.t5335z bs=768k conv=sync
> 
> <End log>
> 
> 
> - Pali's observation:
> 
> It looks like Dove uses kwbimage v0 format with extensions, at
> least according to Function Spec. See 'Binary Code Extension' and
> 'Header Extension'. Currently kwboot and kwbimage supports v0 image only
> with one extension.
> 
> - My comments in response:
> 
> Indeed. I've seen that in the Functional Spec, too. The mdt0 binwalk also shows
> what looks like the extension header.

No. this is not extension header as it is at the beginning of the image.

> DECIMAL       HEXADECIMAL     DESCRIPTION
> --------------------------------------------------------------------------------
> 118161        0x1CD91         Certificate in DER format (x509 v3),
> header length: 4, sequence length: 3
> 199169        0x30A01         Certificate in DER format (x509 v3),
> header length: 4, sequence length: 5464
> 380652        0x5CEEC         CRC32 polynomial table, little endian
> 387072        0x5E800         CRC32 polynomial table, little endian
> 608166        0x947A6         LZMA compressed data, properties: 0x66,

These are offsets far away from the beginning. I doubt that binwalk
would be able to parse some Marvell extension headers, specially even
when native U-Boot tools cannot do it.

> dictionary size: 0 bytes, uncompressed size: 147351982848 bytes
> 
> Thanks,
> Tony