Replicant

h1. Optimus Black bootloader

{{>toc}}

The Optimus Black comes with a bootrom and a set of two bootloaders. The bootrom is stored read-only on the OMAP3630 SoC chip. It loads the first bootloader, which loads the second bootloader.

More information on the booting sequence is available on the OMAP36xx Technical Reference Manual section 26 (Initialization).

h2. Boot device priority

According to the OMAP36xx Technical Reference Manual, section 26.4.4.3 (Booting Device List Setup), the OMAP3630 platform will first choose devices to boot from based on the software booting configuration. If no valid software booting configuration is found, it will read the status of the SYS_BOOT pins to determine the boot device priority order.

h3. Software booting configuration

According to the OMAP36xx Technical Reference Manual, section 26.4.4.4 (Software Booting Configuration), the software booting configuration is a data structure stored in scratchpad memory, at address 0x48002910. It is not cleared at reset and can be written with a valid structure before reboot, to take effect.

h3. CONTROL_STATUS register

According to the OMAP36xx Technical Reference Manual, table 13-109 (CONTROL_STATUS), the CONTROL_STATUS register provides the values of the SYS_BOOT pins as sampled at reset time. It is located at address: 0x480022f0.

The register value can be read using:

<pre>

$ devmem 0x480022f0 8

0x25

</pre>

h3. SYS_BOOT resistors

According to the OMAP36xx Technical Reference Manual, section 26.2.3 (Boot Configuration), the SYS_BOOT[5:0] pins are used to select the boot device priority. SYS_BOOT5 indicates whether peripheral booting is preferred.

According to the Optimus Black (P970) Service Manual:

!p970_sys_boot.png!

Some of the resistors framed on the schematics were found not to be populated on the board. The actual layout is the following:

| |_. SYS_BOOT5 |_. SYS_BOOT4 |_. SYS_BOOT3 |_. SYS_BOOT2 |_. SYS_BOOT1 |_. SYS_BOOT0 |

| Pull-up resistor | R316 | N/A | N/A | R314 | N/A | R318 |

| Pull-down resistor | R323 | R322 | R321 | N/A | R319 | N/A |

| Boolean value | 0 | 0 | 0 | 1 | 0 | 1 |

h3. First boot device

According to the OMAP36xx Technical Reference Manual, section 26.2.3 (Boot Configuration), such a value (0x05) indicates MMC2 as first boot device and USB as second boot device.

h2. USB boot

With MMC2 as first boot device, there is no immediate and easy way to recover from flashing a non-functional bootloader. With that setup, the bootloader can only be updated from the bootloader itself or the running system, both of which require a working bootloader. This makes it nearly impossible to work on developing a bootloader, which may end up not working for unexpected reasons or during the initial bringup phase.

The easiest solution for a fail-proof boot method is to switch the boot device priority order to USB boot first. According to the OMAP36xx Technical Reference Manual, section 26.4.5 (Peripheral Booting), the bootrom allows loading an image from USB to the internal SRAM, at address *0x40200000* and will execute it in place. Note that the image must not have any header, unlike memory booting.

This can be achieved either by a temporary software-only solution or by a permanent hardware-only solution.

*Note that blanking the contents of MMC2 does not make the bootrom switch automatically to USB boot.*

h3. Temporary USB boot

The [[#Software-booting-configuration|Software booting configuration]] register can be used to temporarily set the boot device priority to USB first, according to the OMAP36xx Technical Reference Manual, section 26.4.4.4 (Software Booting Configuration).

At this point, there is no readily available software that allows doing this from either the Android or GNU/Linux userspace.

h3. Permanent USB boot

h3. Software setup

h2. Factory bootloaders

h2. U-Boot

h2. References

* "Optimus Black (P970) Service Manual and Schematics":http://www.cpkb.org/wiki/LG_P970_Optimus_Black_service_manual

* "OMAP36xx Technical Reference Manual":http://www.ti.com/lit/pdf/swpu177

*These documents are the propriety of LG Electronics and Texas Instruments and are not hosted by the Replicant project.*

*However, some excerpts from these documents are provided, for the purpose of providing technical evidence of the facts that are mentioned in this page. We believe that this particular use of the copyrighted work is fair use.*