android:boot_linux_on_amlogic_tv_box

О чем тут написано

У меня есть TV-Box на базе Amlogic S905X3, на котором я хочу запустить Linux (без DE, в качестве микросервера).
Вот свежайшая версия: https://forum.armbian.com/topic/2419-armbian-for-amlogic-s905-and-s905x-ver-544/
Вот тут люди обсуждают запуск armbian - https://forum.armbian.com/topic/12348-armbian-for-amlogic-s905x3/
Вот сборка какого-то ядра: https://github.com/superna9999/meta-meson
Вот тут проект ядра для всех чипов Amlogic Meson (куда входит и S905X3): http://linux-meson.com/doku.php
Вот процедура установки Armbian на TV Box на базе Amlogic: https://www.ondroid.net/armbian-os-installation/ (вот что делать с файлами драйверов dtb: https://www.ondroid.net/armbian-os-uenv-ini-and-extlinux-conf/)
Вот тут написано как можно извлечь файл дерева устройств (dtb) из текущей прошивки: https://cnx-software.ru/2015/12/07/how-to-run-headless-linux-on-amlogic-s905-devices-such-as-mini-mx-or-k1-plus/
Если коробка не загружается сразу с карты, то нужно делать так: https://www.ondroid.net/armbian-os-troubleshootingboot/
Раскирпичивание убитых коробок: https://www.ondroid.net/armbian-os-bricked-device-recovery/
Бекап eMMC: https://www.ondroid.net/armbian-os-backing-up-emmc-nand-via-cli/
О U-Boot. Сборка и прочее на примере banana pi : https://m.habr.com/ru/post/264259/
U-Boot manual: https://www.denx.de/wiki/DULG/Manual
http://www.denx.de/wiki/view/DULG/UBoot
Создание Device Tree: https://www.raspberrypi.org/documentation/configuration/device-tree.md
Изменение объема памяти, резервируемого под gpu: тема на форуме, а вот а вот конкретный кусочек кода

Про прошивку амлоджиков разными тулзами

HK1 Box

Отказалась загружаться с образа Armbian_19.11.3_Aml-g12_eoan_legacy_5.3.0_20191126.img как с SD-карты, так и с двух портов USB. Это значит, что для того, чтобы загрузить ее с внешнего носителя нужно изменить настройки загрузчика U-Boot.

Поэтому - следуем мануалам armbian. Вставляю карточку с armbian, загружаюсь в Android , иду в Apps, нахожу там Update, кликаю UpdateLocale - Select, выбираю BOOT/aml_autoscript.zip, и кликаю Update. Система перезагружается и я вижу меню bootloader'а и ошибку:

Error!
Supported API: 3
charge_status 2, charged 1, status: SUCCESS, capacity 100
Finding update package...
Opening update package...
Verifying update package...
E:footer is wrong
Update package verification took 0.0 s (result 1).
E:signature verification failed
E:error: 21
Installation Aborted.

Этот скрипт должен был скорректировать параметры загрузки U-Boot и позволить загрузиться с sd-карты, однако, судя по всему, установка неподписанных обновлений запрещена, поэтому нужно подключиться к консоли.

Подключение к отладочной консоли RS-232

На плате оказались “пятачки” с обозначениями 'V R T G' - видимо консоль. Я откопал старинный провод USB-COM на базе pl2303, с помощью которого я когда-то подключал Siemens ME45 к компу для выхода в интернет, припаял к плате TV-Box'а три проводочка - G (земля), R и T (прием и передача) и запустил minicom:

sudo apt-get install -y minicom
sudo minicom -b 115200 -D /dev/ttyUSB0

При включении TV-Box'а в консоли minicom побежали сообщения.

system cmd  1.
SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0001 - pwm id 0x00
bl2_stage_init 0xc0
bl2_stage_init 0x02

L0:00000000
L1:00000703
L2:00008067
L3:15000020
S1:00000000
B2:20282000
B1:a0f83180

TE: 163073

BL2 Built : 20:29:41, Jun 18 2019. g12a ga659aac - luan.yuan@droid15-sz

Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
Use GP1_pll as DSU clk.
DSU clk: 1200 Mhz
CPU clk: 1200 MHz
Set clk81 to 166.6M
eMMC boot @ 0
sw8 s
DDR driver_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:37
board id: 1
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part: 0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part: 0
PIEI prepare done
fastboot data load
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffd0000, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 0
enable_fast_boot
dmc_margin_rx==12 dmc_margin_tx==12 steps
DDR3 probe
ddr clk to 672MHz
Load ddrfw from eMMC, src: 0x0002c200, des: 0xfffd0000, size: 0x0000c000, part: 0

dmc_version 0001
Check phy result
INFO : End of initialization
INFO : Training has run successfully!
aml_ddr_fw_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:43
DDR cs0 size: 3928MB
DDR cs1 size: 0MB
DMC_DDR_CTRL: 0000002dDDR size: 3928MB
cs0 DataBus test pass
cs0 AddrBus test pass

non-sec scramble use zero key
ddr scramble enabled

100bdlr_step_size ps== 483
result report
boot times 2Enable ddr reg access
00000000
emmc switch 3 ok
BL2: rpmb counter: 0x00002374
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x000d0000, part: 0
bl2z: ptr: 05129330, size: 00001e40
0.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x00000000
MVN_2=0x00000000
[Image: g12a_v1.1.3389-92241b5 2019-07-02 17:22:49 luan.yuan@droid15-sz]
OPS=0x10
ring efuse init
2b 0c 10 00 01 1d 16 00 00 0c 35 30 43 57 50 50 
[0.679256 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):4fc40b1
NOTICE:  BL31: Built : 15:57:33, May 22 2019
NOTICE:  BL31: G12A normal boot!
NOTICE:  BL31: BL33 decompress pass
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Dec 14 2019 - 17:22:12)

DRAM:  3.8 GiB
Relocation Offset is: d6e50000
spi_post_bind(spifc): req_seq = 0
register usb cfg[0][1] = 00000000d7f3e528
NAND:  get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
MMC:   aml_priv->desc_buf = 0x00000000d3e40a70
aml_priv->desc_buf = 0x00000000d3e42db0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x162000
[mmc_startup] mmc refix success
init_part() 297: PART_TYPE_AML
[mmc_init] mmc init success
      Amlogic multi-dtb tool
      Single dtb detected
start dts,buffer=00000000d3e45620,dt_addr=00000000d3e45620
get_partition_from_dts() 91: ret 0
      Amlogic multi-dtb tool
      Single dtb detected
parts: 17
00:      logo   0000000000800000 1
01:  recovery   0000000001800000 1
02:      misc   0000000000800000 1
03:      dtbo   0000000000800000 1
04:  cri_data   0000000000800000 2
05:     param   0000000001000000 2
06:      boot   0000000001000000 1
set has_boot_slot = 0
07:       rsv   0000000001000000 1
08:  metadata   0000000001000000 1
09:    vbmeta   0000000000200000 1
10:       tee   0000000002000000 1
11:    vendor   0000000014000000 1
12:       odm   0000000008000000 1
13:    system   0000000074000000 1
14:   product   0000000008000000 1
15:     cache   0000000046000000 2
16:      data   ffffffffffffffff 4
init_part() 297: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x4d400000 
In:    serial
Out:   serial
Err:   serial
reboot_mode=normal
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
dtb_read()-3623: total valid 2
update_old_dtb()-3604: do nothing
      Amlogic multi-dtb tool
      Single dtb detected
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
vpu: clk_level in dts: 7
vpu: vpu_power_on
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: vpp osd2 matrix rgb2yuv..............
cvbs: cpuid:0x2b
Net:   dwmac.ff3f0000amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4

CONFIG_AVB2: null 
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
reboot_mode:::: normal
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
hpd_state=0
edid preferred_mode is <NULL>[0]
hdr mode is 0
dv  mode is ver:0  len: 0
hdr10+ mode is 0
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]set initrd_high: 0x7f800000
[OSD]fb_addr for logo: 0x7f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]fb_addr for logo: 0x7f800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x7f800000 width=3840, height=2160
[OSD]osd_hw.free_dst_data: 0,719,0,575
[OSD]osd1_update_disp_freescale_enable
vpp: vpp_matrix_update: 2
cvbs performance type = 9, table = 0
cvbs_config_hdmipll_g12a
cvbs_set_vid2_clk
vpp: sdr_mode = 0
vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
InUsbBurn
noSof
sof timeout, reset usb phy tuning
gpio: pin GPIOAO_3 (gpio 3) value is 1
Command: bcb uboot-command 
Start read misc partition datas!
BCB hasn't any datas,exit!
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0

Для того, чтобы прервать загрузку и скорректировать параметры загрузки нужно понажимать пробел и появится приглашение консоли U-Boot:

Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
g12a_u219_v1#

Теперь можно поглядеть текущие параметры загрузки. Чтоы длинные строки можно было увиждеть целиком - включаем перенос (Ctrl+a w).

g12a_u219_v1#printenv
EnableSelinux=permissive
Irq_check_en=0
active_slot=normal
avb2=0
baudrate=115200
bcb_cmd=get_avb_mode;get_valid_slot;
board_defined_bootup=bootup_X3
boot_part=boot
bootargs=init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 o
tg_device=0 reboot_mode_android=normal logo=osd0,loaded,0x3d800000 vout=576cvbs,enable panel_type=lcd_1 hdmitx=,444,8bit hdmimode=1080p60hz frac_rate_policy=1 hdmi_read
_edid=1 cvbsmode=576cvbs osd_reverse=0 video_reverse=0 irq_check_en=0 androidboot.selinux=permissive androidboot.firstboot=0 jtag=disable androidboot.hardware=amlogic a
ndroidboot.serialno=1234567890 mac=00:df:04:00:38:30 androidboot.mac=00:df:04:00:38:30
bootcmd=ddr_auto_fast_boot_check 6 0 0 50;run storeboot
bootdelay=1
bootup_offset=0x1137ad8
bootup_size=0x3f488a
cmdline_keys=if keyman init 0x1234; then if keyman read usid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.serialno=${usid};setenv serial ${usid};else s
etenv bootargs ${bootargs} androidboot.serialno=1234567890;setenv serial 1234567890;fi;if keyman read mac ${loadaddr} str; then setenv bootargs ${bootargs} mac=${mac} a
ndroidboot.mac=${mac};fi;if keyman read deviceid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.deviceid=${deviceid};fi;fi;
colorattribute=444,8bit
cvbs_drv=0
cvbsmode=576cvbs
display_bpp=16
display_color_bg=0
display_color_fg=0xffff
display_color_index=16
display_height=576
display_layer=osd0
display_width=720
dtb_mem_addr=0x1000000
ethact=dwmac.ff3f0000
ethaddr=00:df:04:00:38:30
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if mmcinfo
; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; if test ${wipe_cache} = failed; then run init_display; ru
n storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; 
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
firstboot=0
frac_rate_policy=1
fs_type=rootfstype=ramfs
gatewayip=10.18.9.1
hdmi_read_edid=1
hdmimode=1080p60hz
hostname=arm_gxbb
init_display=get_rebootmode;echo reboot_mode:::: ${reboot_mode};if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv boota
rgs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs;set
env bootargs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else setenv reboot_mode_android normal;run storeargs;hdmitx hpd;hdmitx get_preferred_mode;osd open;o
sd clear;imgread pic logo bootup $loadaddr;bmp display $bootup_offset;bmp scale;vout output ${outputmode};vpp hdrpkt;fi;fi;
initargs=init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 
initrd_high=7f800000
ipaddr=10.18.9.97
irremote_update=if irkey 2500000 0xe31cfb04 0xb748fb04; then echo read irkey ok!; if itest ${irkey_value} == 0xe31cfb04; then run update;else if itest ${irkey_value} ==
 0xb748fb04; then run update;\
fi;fi;fi;
jtag=disable
loadaddr=1080000
lock=10001000
mac=00:df:04:00:38:30
netmask=255.255.255.0
osd_reverse=0
otg_device=0
outputmode=576cvbs
panel_type=lcd_1
preboot=run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run init_display;run storeargs;run usb_burning;run upgrade_key;bcb uboot-command;run switch_bo
otmode;
reboot_mode=cold_boot
reboot_mode_android=normal
recovery_from_flash=get_valid_slot;echo active_slot: ${active_slot};if test ${active_slot} = normal; then setenv bootargs ${bootargs} ${fs_type} aml_dt=${aml_dt} recove
ry_part={recovery_part} recovery_offset={recovery_offset};if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then wipeisb; bootm ${loadaddr}; fi;else se
tenv bootargs ${bootargs} ${fs_type} aml_dt=${aml_dt} recovery_part=${boot_part} recovery_offset=${recovery_offset};if imgread kernel ${boot_part} ${loadaddr}; then boo
tm ${loadaddr}; fi;fi;
recovery_from_sdcard=if fatload mmc 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload mmc 0 ${loadaddr} recovery.img; then if fatload mmc 0 ${dtb_me
m_addr} dtb.img; then echo sd dtb.img loaded; fi;wipeisb; setenv bootargs ${bootargs} ${fs_type};bootm ${loadaddr};fi;
recovery_from_udisk=if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem
_addr} dtb.img; then echo udisk dtb.img loaded; fi;wipeisb; setenv bootargs ${bootargs} ${fs_type};bootm ${loadaddr};fi;
recovery_offset=0
recovery_part=recovery
rpmb_state=1
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
sdr2hdr=0
serial=1234567890
serverip=10.18.9.113
stderr=serial
stdin=serial
stdout=serial
storeargs=setenv bootargs ${initargs} otg_device=${otg_device} reboot_mode_android=${reboot_mode_android} logo=${display_layer},loaded,${fb_addr} vout=${outputmode},ena
ble panel_type=${panel_type} hdmitx=${cecconfig},${colorattribute} hdmimode=${hdmimode} frac_rate_policy=${frac_rate_policy} hdmi_read_edid=${hdmi_read_edid} cvbsmode=$
{cvbsmode} osd_reverse=${osd_reverse} video_reverse=${video_reverse} irq_check_en=${Irq_check_en}  androidboot.selinux=${EnableSelinux} androidboot.firstboot=${firstboo
t} jtag=${jtag}; setenv bootargs ${bootargs} androidboot.hardware=amlogic;run cmdline_keys;
storeboot=boot_cooling;get_system_as_root_mode;echo system_mode: ${system_mode};if test ${system_mode} = 1; then setenv bootargs ${bootargs} ro rootwait skip_initramfs;
else setenv bootargs ${bootargs} ${fs_type};fi;get_valid_slot;get_avb_mode;echo active_slot: ${active_slot};if test ${active_slot} != normal; then setenv bootargs ${boo
targs} androidboot.slot_suffix=${active_slot};fi;if test ${avb2} = 0; then if test ${active_slot} = _a; then setenv bootargs ${bootargs} root=/dev/mmcblk0p23;else if te
st ${active_slot} = _b; then setenv bootargs ${bootargs} root=/dev/mmcblk0p24;fi;fi;fi;if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run storea
rgs; run update;
switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then setenv reboot_mode_android normal;run storeargs;run recovery_from_flash;else if test ${reboo
t_mode} = update; then setenv reboot_mode_android normal;run storeargs;run update;else if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run
 storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs
;setenv bootargs ${bootargs} androidboot.quiescent=1;run recovery_from_flash;else if test ${reboot_mode} = cold_boot; then setenv reboot_mode_android normal;run storear
gs;else if test ${reboot_mode} = fastboot; then setenv reboot_mode_android normal;run storeargs;fastboot;fi;fi;fi;fi;fi;fi;
try_auto_burn=update 700 750;
update=run usb_burning; run sdc_burning; if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else fi;
upgrade_key=if gpio input GPIOAO_3; then echo detect upgrade key; run update;fi;
upgrade_step=2
usb_burning=update 1000
video_reverse=0
wipe_cache=successful
wipe_data=successful

Environment size: 7754/65532 bytes

Если при вставленной SD-карте выполнить:

fatload mmc 0 1080000 zImage

то успешно загружается в память ядро - файлик zImage с первго раздела вставленной SD-карточки:

g12a_u219_v1#fatload mmc 0 1080000 zImage      
reading zImage
27871744 bytes read in 1520 ms (17.5 MiB/s)

В данном случае 1080000 - это значение переменной loadaddr из вывода printenv.

Для того, чтоб запустить какое-либо cтороннее ядро нам нужен образ ядра и файл dtb (DeviceTreeBlob). Ядро у нас есть (на карте памяти), а dtb нужно либо скомпилировать, либо - извлечь.
Вот # cat /proc/cmdline

init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 otg_device
=0 reboot_mode_android=normal logo=osd0,loaded,0x3d800000 vout=1080p60hz,enable panel_type=lcd_1 hdmitx=,444,8bit hdmimode=1080p60hz frac_rate_policy=1 hdmi_read_edid=1
 cvbsmode=576cvbs osd_reverse=0 video_reverse=0 irq_check_en=0 androidboot.selinux=permissive androidboot.firstboot=0 jtag=disable androidboot.hardware=amlogic androidb
oot.serialno=1234567890 mac=00:df:04:00:38:30 androidboot.mac=00:df:04:00:38:30 ro rootwait skip_initramfs androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildva
riant=user

С работающего андроида

console:/ # uname -a
Linux localhost 4.9.113 #1 SMP PREEMPT Sat Dec 14 17:30:12 CST 2019 armv7l

Извлечение dtb (DeviceTreeBlob)

https://www.cnx-software.com/2014/05/12/how-to-extract-a-device-tree-file-from-android-firmware-files/
Чтобы извлечь dtb из текущей прошивки нужно сделать образ раздела boot или recovery и распаковать его с помощью утилиты split_bootimg.pl. У меня не получилось распаковать образ раздела boot (распаковывался неполностью), но нормально распаковался образ раздела recovery.
Для этого:

  • Подключаем к девайсу флешку и с помощью консоли монтируем ее (или если она (ext)FAT - она смонтируется сама в /mnt/media_rw/xxxx):
    mkdir /mnt/media_rw/USB
    mount /dev/sda1 /mnt/media_rw/USB

  • И создаем образ раздела recovery (или boot):

    dd if=/dev/block/recovery of=/mnt/media/USB/recovery.img

  • Отмонтируем флеху, переносим файлик на комп и распаковываем:

    wget wget https://gist.githubusercontent.com/jberkel/1087743/raw/5be96af0e1c1346678379b0c0f0330b71df51f25/split_bootimg.pl
    chmod a+x ./split_bootimg.pl
    ./split_bootimg.pl ./recovery.img

    Кстати, извлечь этот файлик с помощью стандартных утилит android_bootimg_tools не удалось. RamDisk и kernel извлекаются, а вот третий файлик - нет!

  • вывод будет примерно такой:

    Page size: 2048 (0x00000800)
    Kernel size: 9531352 (0x00916fd8)
    Ramdisk size: 6839445 (0x00685c95)
    Second size: 78980 (0x00013484)
    Board name: 
    Command line: androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=user
    Writing recovery.img-kernel ... complete.
    Writing recovery.img-ramdisk.gz ... complete.
    Writing recovery.img-second.gz ... complete.

Нужный нам файлик - recovery.img-second.gz
Убедиться, что полученный файлик - это dtb можно, декомпилировав его. Как это сделать - написано ниже.

https://pcminipro.ru/os/apparatnaya-konfiguratsiya-redaktirovanie-fajla-dtb-v-linux-s-yadrom-mainline-4-9-x/

  1. Установим DTC (если он не установлен):
    sudo apt-get install device-tree-compiler

  2. Преобразуем двоичный файл dtb в редактируемый текстовый файл dts:

    dtc -b 0 -O dts -I dtb -o hk1_box.dts recovery.img-second.gz

  3. Редактируем то, что нам нужно в файле dts:

    nano hk1_box.dts

  4. Преобразуем отредактированный файл dts в двоичный формат dtb:

    dtc -b 0 -O dtb -I dts -o hk1_box.dtb hk1_box.dts

Вот в таком кусочке кода (параметр size):

linux,cma 
	{
	compatible = "shared-dma-pool";
	reusable; size = <0x0 0x2000000>;
	alignment = <0x0 0x400000>;
	linux,cma-default;
    };

Задается объем памяти, выделенной видяхе. В данном случае выдляется 32Mb.

Загрузка

kernel load addr: 0x01080000
dtb load addr: 0x1000000

Последние эксперименты

https://forum.armbian.com/topic/12162-single-armbian-image-for-rk-aml-aw/
https://yadi.sk/d/_rQgn_FosYuW0g
https://yadi.sk/d/_rQgn_FosYuW0g/19.11.5/20200127

setenv kernel_addr_r 0x11000000; setenv ramdisk_addr_r 0x13000000; setenv fdt_addr_r 0x1000000; setenv devnum "0"; setenv devtype "mmc"; setenv androidboot.dtbo_idx 0;
fatload ${devtype} ${devnum} ${loadaddr} uEnv.txt; env import -t ${loadaddr} ${filesize}; setenv bootargs ${APPEND}; setenv bootargs ${bootargs} mac=${mac}; fatload ${devtype} ${devnum} ${kernel_addr_r} ${LINUX}; fatload ${devtype} ${devnum} ${ramdisk_addr_r} ${INITRD}; fatload ${devtype} ${devnum} ${fdt_addr_r} ${FDT}; fdt addr ${fdt_addr_r}; booti ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r}; 

Настройки (bootargs и dtb) лежат в файлике uEnv.txt

setenv androidboot.dtbo_idx 0; run recovery_from_sdcard;

В оригинале загружается содержимое раздела boot и хапускается, а там указан androidboot.dtbo_idx.

imgread kernel ${boot_part} ${loadaddr}
bootm ${loadaddr}

Вероятно, можно просто перепаковать??? boot.img - https://www.whitewinterwolf.com/posts/2016/08/11/how-to-unpack-and-edit-android-boot-img/
Или просто добавить этот параметр к строке запуска ядра как тут:

[    0.000000] Kernel command line: androidboot.mode=normal androidboot.dtbo_idx=0 root=PARTUUID=af01642c-9b84-11e8-9b2a-234eb5e198a0 androidboot.verifiedbootstate=orange androidboot.slot_suffix= androidboot.serialno=HCYRK3318334473094 console=ttyFIQ0 androidboot.baseband=N/A androidboot.selinux=permissive androidboot.wificountrycode=US androidboot.veritymode=enforcing androidboot.hardware=rk30board androidboot.console=ttyFIQ0 firmware_class.path=/vendor/etc/firmware init=/init rootwait ro init=/init root=PARTUUID=af01642c-9b84-11e8-9b2a-234eb5e198a0 loop.max_part=7 buildvariant=userdebug earlycon=uart8250,mmio32,0xff130000 swiotlb=1 kpti=0

Ошибки

Если появляется сообщение:

## Flattened Device Tree blob at 01000000
   Booting using the fdt blob at 0x1000000
find 1 dtbos
No androidboot.dtbo_idx configured
And no dtbos will be applied

Значит нужно задать переменную androidboot.dtbo_idx:

setenv androidboot.dtbo_idx 0

Значение которой видно при распаковке boot.img:

Command line: androidboot.dtbo_idx=0 --cmdline root=/dev/mmcblk0p18 buildvariant=user

УДАЛОСЬ ЗАГРУЗИТЬСЯ

Запустить скрипт путем update не удалось (т.к. он не подписан), однако, после пристального изучения вывода printenv оказалось, что его успешно запускает команда recovery_from_sdcard, прописанная в env U-Boot. То есть - готовим флеху, в консоли RS-232 жмем пробелы и в ответ на приглашение U-Boot вводим такое:

run recovery_from_sdcard;

В результате приставка перейдет в режим дуалбута и будет грузиться с SD-карты, когда она вставлена.

Нормально подошел meson-sm1-khadas-vim3l.dtb с образа Armbian_19.11.5_Arm-64_eoan_current_5.5.0-rc6_20200127.img
А вот результаты тестирования некоторых других dtb:

meson-g12a-tanix-tx5max.dtb - сеть есть, не виден внутренний флеш
meson-g12a-gt1-mini-a.dtb - 3256MB, сеть есть, не виден внутренний флеш
meson-g12a-sei510.dtb - 3256, сеть есть только WiFi, ВИДЕН mmcblk2, но не видно разделов на нем
meson-g12a-u200.dtb - 3288MB, сети нет вообще. Видны mmcblk0 (SD-карта) и mmcblk1 (Disk /dev/mmcblk1: 116.49 GiB)
meson-g12a-x96-max-rmii.dtb - 3288MB, сеть есть только WiFi, не виден внутренний флеш
meson-g12a-x96-max.dtb - 3256MB, сеть есть, не виден внутренний флеш
meson-g12b-a311d-khadas-vim3.dtb - 3288MB, сеть есть, ВИДЕН mmcblk2 (Disk /dev/mmcblk2: 116.49 GiB).
meson-g12b-gtking.dtb - 3288MB, сеть есть, не виден внутренний флеш
meson-g12b-odroid-n2.dtb - сеть только провод, ВИДЕН mmcblk0 (Disk /dev/mmcblk0: 116.49 GiB)
meson-g12b-s922x-khadas-vim3.dtb - 3288MB, сеть есть, виден mmcblk2 (Disk /dev/mmcblk2: 116.49 GiB)
meson-g12b-ugoos-am6.dtb - 3288MB, сеть есть, не виден внутренний флеш
meson-sm1-khadas-vim3l.dtb 3288MB, сеть есть, виден mmcblk2 (Disk /dev/mmcblk2: 116.49 GiB)
LINUX=/zImage
INITRD=/uInitrd
FDT=/dtb.img
APPEND=root=LABEL=ROOTFS rootflags=data=writeback rw console=ttyAML0,115200n8 console=tty0 no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0

Чтобы после установки на emmc логи systemd сыпались в консоль нужно дописать в строку запуска ядра в файлике /boot/uEnv.txt параметр systemd.log_target=console:

APPEND=root=LABEL=ROOT_EMMC rootflags=data=writeback rw console=ttyAML0,115200n8 no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0 systemd.log_target=console
systemctl disable serial-getty@ttyS2.service
Welcome to minicom 2.7.1

OPTIONS: I18n 
Compiled on May  3 2018, 15:20:11.
Port /dev/ttyUSB0, 22:43:26

Press CTRL-A Z for help on special keys

SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0001 - pwm id 0x00
bl2_stage_init 0xc0
bl2_stage_init 0x02

L0:00000000
L1:00000703
L2:00008067
L3:15000020
S1:00000000
B2:20282000
B1:a0f83180

TE: 158641

BL2 Built : 20:29:41, Jun 18 2019. g12a ga659aac - luan.yuan@droid15-sz

Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
Use GP1_pll as DSU clk.
DSU clk: 1200 Mhz
CPU clk: 1200 MHz
Set clk81 to 166.6M
eMMC boot @ 0
sw8 s
DDR driver_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:37
board id: 1
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part: 0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part: 0
PIEI prepare done
fastboot data load
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffd0000, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 0
enable_fast_boot
dmc_margin_rx==12 dmc_margin_tx==12 steps
DDR3 probe
ddr clk to 672MHz
Load ddrfw from eMMC, src: 0x0002c200, des: 0xfffd0000, size: 0x0000c000, part: 0

dmc_version 0001
Check phy result
INFO : End of initialization
INFO : Training has run successfully!
aml_ddr_fw_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:43
DDR cs0 size: 3928MB
DDR cs1 size: 0MB
DMC_DDR_CTRL: 0000002dDDR size: 3928MB
cs0 DataBus test pass
cs0 AddrBus test pass

non-sec scramble use zero key
ddr scramble enabled

100bdlr_step_size ps== 483
result report
boot times 0Enable ddr reg access
00000000
emmc switch 3 ok
BL2: rpmb counter: 0x00002374
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x000d0000, part: 0
bl2z: ptr: 05129330, size: 00001e40
0.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x00000000
MVN_2=0x00000000
[Image: g12a_v1.1.3389-92241b5 2019-07-02 17:22:49 luan.yuan@droid15-sz]
OPS=0x10
ring efuse init
2b 0c 10 00 01 1d 16 00 00 0c 35 30 43 57 50 50 
[0.017354 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):4fc40b1
NOTICE:  BL31: Built : 15:57:33, May 22 2019
NOTICE:  BL31: G12A normal boot!
NOTICE:  BL31: BL33 decompress pass
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Dec 14 2019 - 17:22:12)

DRAM:  3.8 GiB
Relocation Offset is: d6e50000
spi_post_bind(spifc): req_seq = 0
register usb cfg[0][1] = 00000000d7f3e528
NAND:  get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
MMC:   aml_priv->desc_buf = 0x00000000d3e40a70
aml_priv->desc_buf = 0x00000000d3e42db0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x162000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
      Amlogic multi-dtb tool
      Single dtb detected
start dts,buffer=00000000d3e45620,dt_addr=00000000d3e45620
get_partition_from_dts() 91: ret 0
      Amlogic multi-dtb tool
      Single dtb detected
parts: 17
00:      logo   0000000000800000 1
01:  recovery   0000000001800000 1
02:      misc   0000000000800000 1
03:      dtbo   0000000000800000 1
04:  cri_data   0000000000800000 2
05:     param   0000000001000000 2
06:      boot   0000000001000000 1
set has_boot_slot = 0
07:       rsv   0000000001000000 1
08:  metadata   0000000001000000 1
09:    vbmeta   0000000000200000 1
10:       tee   0000000002000000 1
11:    vendor   0000000014000000 1
12:       odm   0000000008000000 1
13:    system   0000000074000000 1
14:   product   0000000008000000 1
15:     cache   0000000046000000 2
16:      data   ffffffffffffffff 4
init_part() 282: PART_TYPE_DOS
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x4d400000 
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
dtb_read()-3623: total valid 2
update_old_dtb()-3604: do nothing
      Amlogic multi-dtb tool
      Single dtb detected
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
vpu: clk_level in dts: 7
vpu: vpu_power_on
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: vpp osd2 matrix rgb2yuv..............
cvbs: cpuid:0x2b
Net:   dwmac.ff3f0000amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4

CONFIG_AVB2: null 
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
reboot_mode:::: cold_boot
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
hpd_state=0
edid preferred_mode is <NULL>[0]
hdr mode is 0
dv  mode is ver:0  len: 0
hdr10+ mode is 0
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]set initrd_high: 0x7f800000
[OSD]fb_addr for logo: 0x7f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]fb_addr for logo: 0x7f800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x7f800000 width=3840, height=2160
Err imgread(L544):Logo header err.
There is no valid bmp file at the given address
[OSD]osd_hw.free_dst_data: 0,719,0,575
[OSD]osd1_update_disp_freescale_enable
vpp: vpp_matrix_update: 2
cvbs performance type = 9, table = 0
cvbs_config_hdmipll_g12a
cvbs_set_vid2_clk
vpp: sdr_mode = 2
vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
InUsbBurn
noSof
sof timeout, reset usb phy tuning
gpio: pin GPIOAO_3 (gpio 3) value is 1
Command: bcb uboot-command 
Start read misc partition datas!
BCB hasn't any datas,exit!
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
card in
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x182000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 3
OEM: 5344
Name: SS08G 
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 7.4 GiB
mmc clock: 40000000
Bus Width: 4-bit
reading s905_autoscript
1351 bytes read in 5 ms (263.7 KiB/s)
## Executing script at 01020000
start amlogic old u-boot
reading boot_android
** Unable to read file boot_android **
** Bad device usb 0 **
reading u-boot.ext
** Unable to read file u-boot.ext **
** Bad device usb 0 **
reading uEnv.txt
1088 bytes read in 5 ms (211.9 KiB/s)
mac=00:df:04:00:38:30
reading /zImage
23357952 bytes read in 1276 ms (17.5 MiB/s)
reading /uInitrd
13608950 bytes read in 746 ms (17.4 MiB/s)
reading /dtb.img
45989 bytes read in 5 ms (8.8 MiB/s)
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND                               +-----------------------------+
[rsvmem] fdt get prop fail.                                                      |                             |
## Loading init Ramdisk from Legacy Image at 13000000 ...                        |  Cannot open /dev/ttyUSB0!  |
   Image Name:   uInitrd                                                         |                             |
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)                   +-----------------------------+
   Data Size:    13608886 Bytes = 13 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
active_slot is normal
DTBO partition header is incorrect
load dtb from 0x1000000 ......
      Amlogic multi-dtb tool
      Single dtb detected
## Flattened Device Tree blob at 01000000
   Booting using the fdt blob at 0x1000000
No valid dtbo image found
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND
[rsvmem] fdt get prop fail.
   Loading Ramdisk to 7eb05000, end 7f7ff7b6 ... OK
   Loading Device Tree to 000000001fff1000, end 000000001ffff3a4 ... OK

Starting kernel ...

uboot time: 6206312 us
[  285.513308] reboot: Restarting system
bl31 reboot reason: 0xd
bl31 reboot reason: 0x0
system cmd  1.
SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0001 - pwm id 0x00
bl2_stage_init 0xc0
bl2_stage_init 0x02

L0:00000000
L1:00000703
L2:00008067
L3:15000020
S1:00000000
B2:20282000
B1:a0f83180

TE: 154850

BL2 Built : 20:29:41, Jun 18 2019. g12a ga659aac - luan.yuan@droid15-sz

Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
Use GP1_pll as DSU clk.
DSU clk: 1200 Mhz
CPU clk: 1200 MHz
Set clk81 to 166.6M
eMMC boot @ 0
sw8 s
DDR driver_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:37
board id: 1
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part: 0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part: 0
PIEI prepare done
fastboot data load
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffd0000, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 0
enable_fast_boot
dmc_margin_rx==12 dmc_margin_tx==12 steps
DDR3 probe
ddr clk to 672MHz
Load ddrfw from eMMC, src: 0x0002c200, des: 0xfffd0000, size: 0x0000c000, part: 0

dmc_version 0001
Check phy result
INFO : End of initialization
INFO : Training has run successfully!
aml_ddr_fw_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:43
DDR cs0 size: 3928MB
DDR cs1 size: 0MB
DMC_DDR_CTRL: 0000002dDDR size: 3928MB
cs0 DataBus test pass
cs0 AddrBus test pass

non-sec scramble use zero key
ddr scramble enabled

100bdlr_step_size ps== 476
result report
boot times 1Enable ddr reg access
00000000
emmc switch 3 ok
BL2: rpmb counter: 0x00002374
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x000d0000, part: 0
bl2z: ptr: 05129330, size: 00001e40
0.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x00000000
MVN_2=0x00000000
[Image: g12a_v1.1.3389-92241b5 2019-07-02 17:22:49 luan.yuan@droid15-sz]
OPS=0x10
ring efuse init
2b 0c 10 00 01 1d 16 00 00 0c 35 30 43 57 50 50 
[0.670124 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):4fc40b1
NOTICE:  BL31: Built : 15:57:33, May 22 2019
NOTICE:  BL31: G12A normal boot!
NOTICE:  BL31: BL33 decompress pass
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Dec 14 2019 - 17:22:12)

DRAM:  3.8 GiB
Relocation Offset is: d6e50000
spi_post_bind(spifc): req_seq = 0
register usb cfg[0][1] = 00000000d7f3e528
NAND:  get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
MMC:   aml_priv->desc_buf = 0x00000000d3e40a70
aml_priv->desc_buf = 0x00000000d3e42db0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x162000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
      Amlogic multi-dtb tool
      Single dtb detected
start dts,buffer=00000000d3e45620,dt_addr=00000000d3e45620
get_partition_from_dts() 91: ret 0
      Amlogic multi-dtb tool
      Single dtb detected
parts: 17
00:      logo   0000000000800000 1
01:  recovery   0000000001800000 1
02:      misc   0000000000800000 1
03:      dtbo   0000000000800000 1
04:  cri_data   0000000000800000 2
05:     param   0000000001000000 2
06:      boot   0000000001000000 1
set has_boot_slot = 0
07:       rsv   0000000001000000 1
08:  metadata   0000000001000000 1
09:    vbmeta   0000000000200000 1
10:       tee   0000000002000000 1
11:    vendor   0000000014000000 1
12:       odm   0000000008000000 1
13:    system   0000000074000000 1
14:   product   0000000008000000 1
15:     cache   0000000046000000 2
16:      data   ffffffffffffffff 4
init_part() 282: PART_TYPE_DOS
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x4d400000 
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
dtb_read()-3623: total valid 2
update_old_dtb()-3604: do nothing
      Amlogic multi-dtb tool
      Single dtb detected
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
vpu: clk_level in dts: 7
vpu: vpu_power_on
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: vpp osd2 matrix rgb2yuv..............
cvbs: cpuid:0x2b
Net:   dwmac.ff3f0000amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4

CONFIG_AVB2: null 
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
reboot_mode:::: cold_boot
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
hpd_state=0
edid preferred_mode is <NULL>[0]
hdr mode is 0
dv  mode is ver:0  len: 0
hdr10+ mode is 0
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]set initrd_high: 0x7f800000
[OSD]fb_addr for logo: 0x7f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]fb_addr for logo: 0x7f800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x7f800000 width=3840, height=2160
Err imgread(L544):Logo header err.
There is no valid bmp file at the given address
[OSD]osd_hw.free_dst_data: 0,719,0,575
[OSD]osd1_update_disp_freescale_enable
vpp: vpp_matrix_update: 2
cvbs performance type = 9, table = 0
cvbs_config_hdmipll_g12a
cvbs_set_vid2_clk
vpp: sdr_mode = 2
vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
InUsbBurn
noSof
sof timeout, reset usb phy tuning
gpio: pin GPIOAO_3 (gpio 3) value is 0
detect upgrade key
InUsbBurn
noSof
sof timeout, reset usb phy tuning
card in
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x182000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 3
OEM: 5344
Name: SS08G 
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 7.4 GiB
mmc clock: 40000000
Bus Width: 4-bit
Device: SDIO Port B
Manufacturer ID: 3
OEM: 5344
Name: SS08G 
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 7.4 GiB
mmc clock: 40000000
Bus Width: 4-bit
reading aml_autoscript
709 bytes read in 4 ms (172.9 KiB/s)
## Executing script at 01080000
## Error: "bootfromsd" not defined
Saving Environment to aml-storage...
mmc env offset: 0x4d400000 
Writing to MMC(1)... done
reboot use default mode: normal
bl31 reboot reason: 0xd
bl31 reboot reason: 0x1
system cmd  1.
SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0001 - pwm id 0x00
bl2_stage_init 0xc0
bl2_stage_init 0x02

L0:00000000
L1:00000703
L2:00008067
L3:15000020
S1:00000000
B2:20282000
B1:a0f83180

TE: 403002

BL2 Built : 20:29:41, Jun 18 2019. g12a ga659aac - luan.yuan@droid15-sz

Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
Use GP1_pll as DSU clk.
DSU clk: 1200 Mhz
CPU clk: 1200 MHz
Set clk81 to 166.6M
eMMC boot @ 0
sw8 s
DDR driver_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:37
board id: 1
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part: 0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part: 0
PIEI prepare done
fastboot data load
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffd0000, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 0
enable_fast_boot
dmc_margin_rx==12 dmc_margin_tx==12 steps
DDR3 probe
ddr clk to 672MHz
Load ddrfw from eMMC, src: 0x0002c200, des: 0xfffd0000, size: 0x0000c000, part: 0

dmc_version 0001
Check phy result
INFO : End of initialization
INFO : Training has run successfully!
aml_ddr_fw_vesion: LPDDR4_PHY_V_0_1_15 build time: Jun 18 2019 20:29:43
DDR cs0 size: 3928MB
DDR cs1 size: 0MB
DMC_DDR_CTRL: 0000002dDDR size: 3928MB
cs0 DataBus test pass
cs0 AddrBus test pass

non-sec scramble use zero key
ddr scramble enabled

100bdlr_step_size ps== 480
result report
boot times 0Enable ddr reg access
00000000
emmc switch 3 ok
BL2: rpmb counter: 0x00002374
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x000d0000, part: 0
bl2z: ptr: 05129330, size: 00001e40
0.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x00000000
MVN_2=0x00000000
[Image: g12a_v1.1.3389-92241b5 2019-07-02 17:22:49 luan.yuan@droid15-sz]
OPS=0x10
ring efuse init
2b 0c 10 00 01 1d 16 00 00 0c 35 30 43 57 50 50 
[0.017354 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):4fc40b1
NOTICE:  BL31: Built : 15:57:33, May 22 2019
NOTICE:  BL31: G12A normal boot!
NOTICE:  BL31: BL33 decompress pass
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Dec 14 2019 - 17:22:12)

DRAM:  3.8 GiB
Relocation Offset is: d6e50000
spi_post_bind(spifc): req_seq = 0
register usb cfg[0][1] = 00000000d7f3e528
NAND:  get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
get_sys_clk_rate_mtd() 290, clock setting 200!
NAND device id: 0 ff ff ff ff ff 
No NAND device found!!!
nand init failed: -6
MMC:   aml_priv->desc_buf = 0x00000000d3e40a70
aml_priv->desc_buf = 0x00000000d3e42db0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x162000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
      Amlogic multi-dtb tool
      Single dtb detected
start dts,buffer=00000000d3e45620,dt_addr=00000000d3e45620
get_partition_from_dts() 91: ret 0
      Amlogic multi-dtb tool
      Single dtb detected
parts: 17
00:      logo   0000000000800000 1
01:  recovery   0000000001800000 1
02:      misc   0000000000800000 1
03:      dtbo   0000000000800000 1
04:  cri_data   0000000000800000 2
05:     param   0000000001000000 2
06:      boot   0000000001000000 1
set has_boot_slot = 0
07:       rsv   0000000001000000 1
08:  metadata   0000000001000000 1
09:    vbmeta   0000000000200000 1
10:       tee   0000000002000000 1
11:    vendor   0000000014000000 1
12:       odm   0000000008000000 1
13:    system   0000000074000000 1
14:   product   0000000008000000 1
15:     cache   0000000046000000 2
16:      data   ffffffffffffffff 4
init_part() 282: PART_TYPE_DOS
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x4d400000 
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
_verify_dtb_checksum()-3406: calc 5d3b67d1, store 5d3b67d1
dtb_read()-3623: total valid 2
update_old_dtb()-3604: do nothing
      Amlogic multi-dtb tool
      Single dtb detected
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
vpu: clk_level in dts: 7
vpu: vpu_power_on
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: vpp osd2 matrix rgb2yuv..............
cvbs: cpuid:0x2b
Net:   dwmac.ff3f0000amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4

CONFIG_AVB2: null 
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
reboot_mode:::: cold_boot
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
hpd_state=0
edid preferred_mode is <NULL>[0]
hdr mode is 0
dv  mode is ver:0  len: 0
hdr10+ mode is 0
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]set initrd_high: 0x7f800000
[OSD]fb_addr for logo: 0x7f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]fb_addr for logo: 0x7f800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x7f800000 width=3840, height=2160
Err imgread(L544):Logo header err.
There is no valid bmp file at the given address
[OSD]osd_hw.free_dst_data: 0,719,0,575
[OSD]osd1_update_disp_freescale_enable
vpp: vpp_matrix_update: 2
cvbs performance type = 9, table = 0
cvbs_config_hdmipll_g12a
cvbs_set_vid2_clk
vpp: sdr_mode = 2
vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
InUsbBurn
noSof
sof timeout, reset usb phy tuning
gpio: pin GPIOAO_3 (gpio 3) value is 1
Command: bcb uboot-command 
Start read misc partition datas!
BCB hasn't any datas,exit!
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[deviceid] not programed yet
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
card out
(Re)start USB...
USB0:   USB3.0 XHCI init start
Register 3000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
** Bad device usb 1 **
** Bad device usb 2 **
** Bad device usb 3 **
reading emmc_autoscript
759 bytes read in 4 ms (184.6 KiB/s)
## Executing script at 01020000
reading u-boot.emmc
** Unable to read file u-boot.emmc **
reading uEnv.txt
1103 bytes read in 3 ms (358.4 KiB/s)
reading /zImage
23357952 bytes read in 652 ms (34.2 MiB/s)
reading /uInitrd
13608950 bytes read in 382 ms (34 MiB/s)
reading /dtb.img
45989 bytes read in 4 ms (11 MiB/s)
mac=00:df:04:00:38:30
[rsvmem] get fdtaddr NULL!
rsvmem - reserve memory

Usage:
rsvmem check                   - check reserved memory
rsvmem dump                    - dump reserved memory

rsvmem check failed
## Loading init Ramdisk from Legacy Image at 13000000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)
   Data Size:    13608886 Bytes = 13 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
Start read misc partition datas!
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
active_slot is normal
DTBO partition header is incorrect
load dtb from 0x1000000 ......
      Amlogic multi-dtb tool
      Single dtb detected
## Flattened Device Tree blob at 01000000
   Booting using the fdt blob at 0x1000000
No valid dtbo image found
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND
[rsvmem] fdt get prop fail.
   Loading Ramdisk to 7eb05000, end 7f7ff7b6 ... OK
   Loading Device Tree to 000000001fff1000, end 000000001ffff3a4 ... OK

Starting kernel ...

uboot time: 5974060 us
Enter your comment. Wiki syntax is allowed:
V Y N L E
 
  • android/boot_linux_on_amlogic_tv_box.txt
  • Last modified: 2020/02/07 19:28
  • by admin