Introduction

The Boot ROM of the DM3730 CPU is quite clever and can load a binary X-Loader image into the internal 64 kByte SRAM sitting on the CPU core. This code can be a heavily stripped down U-Boot that uses the Kermit protocol to download a full U-Boot over the same serial line into the SDRAM (PoP Memory).

Tools on Host CPU

You need two tools:

pserial
ukermit

We have different versions (the Mac OS X version appears to be broken):

http://download.goldelico.com/gta04/unstable/recovery/host-tools/

NOTE: sometimes the files in "unstable" may be what "unstable" means. If something fails, please go back to the latest "stable" snapshot.

Setup

The first sign of activity of the Boot ROM is to send the "ASIC ID". Although it is a binary message, the ASCII interpretation is helpful. You will either see something like "40W" (OMAP3530) or "60" (DM3730). This ASIC ID indicates that the Boot ROM is ready to accept a binary BLOB for the SRAM over the RS232 line.

The RS232 must be configured as 115200 bit/s, 8 bit, no parity, hardware handshake.

Loading the Serial X-Loader

get the uart-loader (the X-Loader variant that understands Kermit):

$ wget -O uart-loader.bin http://download.goldelico.com/gta04/unstable/recovery/uart-loader.bin

NOTE: you can't use the MLO or x-loader.bin files for installation on SD card or NAND flash. They are very similar but slightly different.

Start the tool pserial:

$ ./pserial -p /dev/ttyUSB0 -f uart-loader.bin
Waiting For Device ASIC ID: Press Ctrl+C to stop
ASIC ID Detected.
Sending 2ndFile:
Downloading file: 100.000% completed(12240/12240 bytes)
File download completed.
$

If that is successful, the uart-loader waits for the real U-Boot using the kermit protocol.

Loading U-Boot through Kermit

get the U-Boot you want to try (does not need special variants):

$ wget -O u-boot.bin http://download.goldelico.com/gta04/unstable/u-boot.bin

Start the Kermit tool:

$ ./ukermit -p /dev/ttyUSB0 -f u-boot.bin
Downloading file: 100.000% completed(272048/272048 bytes)
File Download completed
$

Running U-Boot

U-Boot starts automatically, so you should pack all these commands into a shell script (including configuration of the serial line!) and start a terminal program as the last step, or you will miss the first messages from U-Boot.

It should look like this

Welcome to uart-loader
Starting OS Bootloader from UART ...


U-Boot 2011.03-rc1 (Sep 24 2011 - 09:14:36)

OMAP3630/3730-GP ES2.1, CPU-OPP2, L3-165MHz, Max CPU Clock 1 Ghz
GTA04 + LPDDR/NAND
I2C:   ready
DRAM:  256 MiB
NAND:  512 MiB
MMC:   OMAP SD/MMC: 0
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Die ID #41e600029ff800000163810c1801501c
Hit any key to stop autoboot:  0 
GTA04 # 
GTA04 # 
GTA04 # 
GTA04 # systest
TPS65950:      found
   STS_HW_CON: 40
...

You can now check the SD card interface (mmcinfo), erase the NAND or do a "systest". Or identify if the I2C busses are running.

Please note that you can't easily boot to Linux using this approach since there is no kermit download of a Linux kernel nor a Root File system. You could modify U-Boot to include a Kermit loader, but we haven't.

Please also note that you have to repeat all the steps if you reboot the OMAP CPU.

uart-monitor

If you are not successful in loading U-Boot we have written a uart-monitor tool that fits into the 64k SRAM and does not access any PoP Memory (which may be the reason of malfunction) or peripherals. So you get sort of a CP/M-80 feeling :)

Download the file as

$ wget -O uart-monitor.bin http://download.goldelico.com/gta04/unstable/recovery/uart-monitor.bin
$ pserial -p /dev/ttyUSB0 -f uart-monitor.bin

Some commands:

c - run test code in RAM
x [addr] - execute
l - loop hello world
ram - fill ram with data pattern
a addr - set address
r [size] - read bytes
rl [size] - read long words
f [value [size]] - write bytes
bl - blink backlight
g - show GPIOs
m - show PinMux

Please note that there is no Segfault protection. I.e. if you try to read/write some non-existent address, the uart-monitor hangs and you have to resart.

This tool (source code is also available) is a nice start to learn some low-level ARM programming and to write alternate boot loaders.