Accessing the bootloader?

To work with the bootloader, you need to boot the AC100 into recovery mode and install the apropriate driver from the NVIDIA OS support packs.
To boot into the recovery mode, hold down the CTRL + ESC/back keys and power on the device.
You can find further information on the recovery mode and the drivers to install in the Recovery Mode section.

When in recovery mode, you can download the partitions of the internal memory card. To get the partition layout, type

nvflash -w --getpartitiontable ptable.txt --bl <bootloader> --go

<bootloader> is, depending on the OS support pack version, a file called fastboot.bin in the current directory, or a file
called fastboot.stock.bin in the ../prebuild directory. In fact, this does not flash anything, but loads a server program to
memory, which is able to understand the more complex commands submitted by nvflash.

You should see something like this if you don't execute any command (like --getpartitiontable):

# nvflash --bl fastboot.bin --go -w

Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 2
chip sku: 0x8
chip uid: 0x1700618442a160d7
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 0
sdram config strap: 0

odm data: 0x3b2d8011
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
| 931920/931920 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully

From now on, you can talk to the bootloader by just submitting commands like

nvflash -r --getpartitiontable ptable.txt

(note the -r instead of -w).

There is more dangerous command called --odmdata. It is some kind of fingerprint of the hardware and
enabled/disables certain hardware configuations. For example, the ODM 0x3b2d8011 data causes the HDMI port
to be used for bootloader display. The following comes up (after a period with no input):

Entering NvFlash recovery mode / Nv3p Server
Android ota recovery
Checking for RCK.. press <Enter>in 5 sec to enter RCK
OS will cold boot in 10 seconds if no input is detected
Press <Enter> to select, Arrow key (Left, Right) for selection move
Cold-booting Linux
Unable to query partition UBN

A white Android Robot in a green square next to a USB symbol are displayed after the Andoid OTA recovery, and flashes on and off during the "OS Cold Boot" 10 seconds counting down. As of now, there doesn't seem to be any way to interrupt this sequence (at least with the commands fed above) as nothing is displayed on over the USB connection about the Nv3P Server, and the keyboard on the AC100 itself is unresponsive.

If there is no kernel to boot in partition 6 (boot partiion), the fastboot protocol will be started. See this post for details on erasing, backing up and booting a kernel: kenel+boot

Following the kernel+boot procedure, the HDMI output display will show the following:

Entering NvFlash recovery mode / Nv3p Server
Checking for Android OTA recovery
Checking for RCK.. press <Enter>in 5 sec to enter RCK
Starting Fastboot USB download protocol

At which point a kernel can be loaded and booted.

WARNING! The odmdata specified above is just guessed and may propably brick the device (but don't panic). There
is a way to get it going again. Until now, don't use it. The original value seems to be 0x800C0075 (and 0x802C0075 with HDMI output),
but that's not tested yet....

ODMDATA

Some info regarding odmdata extracted from tegra_devkit_custopt.h (from kernel at git://nv-tegra.nvida.com)

Bits:	Nible	Name	Description	Remarks and properties for 0x800C0075
00-07	0x75	PERSONALITY	0x00 - DEFAULT "Voyager", emmc, no trace 0x01 - ULPI = baseband 0x05 - ULPI = UART1 "Voyager", emmc, trace 0x11 - ULPI = baseband 0x15 - ULPI = UART1 "Voyager", nand, no trace 0x75 - Voyager, NAND "Whisthler", stand-alone 0xC1 - KB=13x1, TRACE, GMI=A/D NOR 0xC3 - KB=16x8, NO TRACE, GMI=NAND "Voyager", USB2-ULPI (no UART) 0x71	0x75: Voyager, NAND, "Whisthler", stand-alone
08-10	0x00	TRANSPORT	0 - DEFAULT 1 - NONE 2 - UART 3 - USB 4 - ETHERNET	0: DEFAULT 0: DEFAULT 0: DEFAULT 0: DEFAULT, EMBEDDED
11-12		ETHERNET	0 - DEFAULT 1 - SPI
13-14		RIL	0 - DEFAULT 1 - EMP RAINBOW 2 - EMP RAINBOW_ULPI 3 - IFX
15-17		CONSOLE_OPTION	0 - DEFAULT, EMBEDDED 1 - NONE 2 - DCC 3 - UART
18-19	0x3	CONSOLE	0 - DEFAULT, UART-A 1 - UART-B 2 - UART-C 3 - UART-D 4 - UART-E	3 (upper 2 bits of 0x0C): UART-D
20-22	0x0	DISPLAY	0 - DEFAULT, EMBEDDED 1 - NULL 2 - HDMI 3 - CRT	0: DEFAULT, EMBEDDED
23		DHCP	0 - DEFAULT 1 - ENABLE	0: DEFAULT
24-27	0x0	CARVEOUT RAM	0 - DEFAULT 1 - Memory 1 2 - Memory 2 3 - Memory 3 4 - Memory 4 5 - Memory 5 6 - Memory 6 7 - Memory 7 8 - Memory 8 (32 MB)	0: DEFAULT
28-30	0x0	MEMORY	0 - DEFAULT 1 - 256 MB 2 - 512 MB 3 - 1 GB	0: DEFAULT
31	0x1	LPSTATE	0 - LP0 1 - LP1	1: LP stands for "low power" => "on"?