danman

Members
  • Content Count

    42
  • Joined

  • Last visited

About danman

  • Rank
    Advanced Member

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. @Staars it doesn't boot because I don't have the correct image but on the MISO/MOSI/CLK pins of SPI I can see some signals which were not there before attaching jumper. It doesn't show anything on serial because it doesn't boot It is not even possible to get to d/g/n mode when the jumper is attached (maybe someone with W2 can confirm this behavior?) I managed to compile some spi images after fixing some bugs in the "SDK" https://github.com/BPI-SINOVOIP/BPI-W2-openwrt-lede/issues/2 but I didn't have time to test them. You cannot use just any image because they differ per device in "hwsetting" file, ram config, etc... Still waiting for @chewitt to provide SPI dump from his W2 to compare the layout.
  2. Good news! I have found the BOOTSEL pin on my board I connected my logic analyzer to DI pin on SPI header, shorted one suspected pad and saw signals on my analyzer. Then I made a jumper out of 1.27mm pitch pin header and did some fine soldering. Now the question is, what to load to my SPI flash? Does anybody have a full dump from bpi w2 here?
  3. I like that they published complete guide how to use HW encoding with ffmpeg together with a patch and libraries
  4. I wrote a short guide how to recover from wiped boot sector https://blog.danman.eu/zidoo-x8-recovery/
  5. Wow! That is awesome! Do you have a detail of the main chip ? Or more pictures? What X-ray device was used?
  6. My box also comes without SPI. Can you try minicom? Is it available on mac? You should first press and hold both keys (you should see your USB-serial TX LED blinking quicky) and while holding, connevt power to your box.
  7. @Staars, just because of you I did a test. I removed SPI flash and wiped first 4megs by writing zeroes: $ sudo dd if=/dev/zero of=/dev/sdc bs=1M count=4 4+0 records in 4+0 records out 4194304 bytes (4.2 MB, 4.0 MiB) copied, 0.686883 s, 6.1 MB/s result: C1:80000000 C2 ? C3hswitch frequency to 0x00000046 frequency divider is 0x00000080 switch frequency to 0x00000046 frequency divider is 0x00000004 switch to SDR 8 bit switch bus width to 0x00000008 bits success 0000001� C1:80000000 C2 ?uu3-1 but when I hold Ctrl+q while booting: C1:80000000 C2 ? d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> So I am 99% sure d/g/r works regardless on what you have on you emmc, if you have SPI or whatever. I believe this is firmware inside of the SoC. What terminal are you using?
  8. So you can flash from the windows utility but the box still doesn't boot, right? Can you reach d/g/r from terminal using Ctrl+q?
  9. I'm convinced this is not true and I can prove it later. I think this is also not true. What do you mean by this? Does the box boot? My idea how to save your box: 1. extract hwconfig and uboot from the dump I asked for and a bootlog (it shows blob locations) 2. boot these using d/g/r into u-boot 3. reflash full emmc dump from working box to not working one within u-boot or recovery linux
  10. Btw, do you have two Lake1 boxes now? Don't you want to try to recover the bricked one using one of my methods (soldering or d/g/r boot) ? Can you send me first 20 megs of eMMC from a working one?
  11. this shows how all the boot binary blobs are chained: https://github.com/BPI-SINOVOIP/BPI-W2-bsp/blob/a6d9f8d7be34cd734179bc528d4ab03d1972be28/u-boot-rt/examples/flash_writer/tools/bindAllBins/bindAllBins.c
  12. this is an interresting reading: https://github.com/BPI-SINOVOIP/BPI-W2-bsp/commit/c8e8e9cea4e84934744a100727975cd912f1fc73 I'll try to compile and boot BPI's uboot today...
  13. It's main purpose is to help with boot but without switching BOOTSEL it cannot be used. So currently it is doing nothing and I'm out of ideas how to find it... :/ Perhaps you could X-ray my box too? But first, I'd like to have a reliable way to recover whole eMMC without attached wires which is very close now. Then I'd like to experiment with running various systems (your armbian, porting Android 7 from w2, etc.) to be able to use HDMI input with hw encoding, prefferably with ffmpeg. SPI is only a bonus milestone for me.
  14. @Staars, I think it doesn't matter. But I'm celebrating first success booting code from d/g/n d/g/r>h download to 0x80005EF0 Ymodem: CCCCCCCC d/g/r>s 98007058 98007058 = 0x00020000 d/g/r>d download to 0x00020000 Ymodem: CCCCCCCCCCCCCCCCCCCCCCCCC crc32:0xA96F74D3, len:0x000B21E0 d/g/r>g jump to 0x00020000 64b U-Boot 2012.07 (Aug 13 2016 - 10:06:21) CPU : Cortex-A53 quad core - AARCH32 Board: Realtek QA Board DRAM: 0 Bytes Watchdog: Disabled Cache: Enabled Non-Cache Region: 1 MB@0x07900000 MMC: rtk_emmc : Detect chip rev. >= B RTD1295 eMMC: 0 rtk_emmc : Detect chip rev. >= B EMMC ERROR ---------> Response timeout Card did not respond to voltage select! mmc->version=0x00010000 version=0x00000004 [LY] cardtype=57, mmc->card_caps=0f [LY] freq = 00464388, clk diver = 00000080 [LY] speed up emmc at HS-200 [LY] HS-200 bus width=2 [LY] mmc->boot_caps = 20b TEMP TX_WINDOW=0x1ffffff8, TX_best=0xf RX_WINDOW=0xffff41ff, RX_best=0x1c TX1_WINDOW=0x1fffff80, TX_best=0x11 [LY] hs200 : 0 [HC] WPG_SIZE = 4194304 Device: RTD1295 eMMC Manufacturer ID: 11 OEM: 100 Name: 008G7 Tran Speed: 5f5e100 Rd Block Len: 512 MMC version 4.0 High Capacity: No Capacity: 7.3 GiB Bus Width: 8-bit Speed: HS200 Factory: MMC Factory: pp:0, seq#:0x25, size:0x25a00 ------------tmp/factory/000BootParam.h found [logo]src w/h=1280/720 dst w/h=3840/2160 In: serial Out: serial Err: serial Net: Realtek PCIe GBE Family Controller mcfg = 0024 dev->name=r8168#0 Hit Esc or Tab key to enter console mode or rescue linux: 0 ------------can't find tmp/factory/recovery ======== Checking into android recovery ==== Start Boot Setup ... ---------------LOAD NORMAL FW TABLE --------------- [INFO] fw desc table base: 0x00620000, count: 22 Normal boot fw follow... Kernel: FW Image to 0x03000000, size=0x00f3d000 (0x03f3d000) FW Image fr 0x02b30400 DT: FW Image to 0x01f00000, size=0x0000f448 (0x01f0f448) FW Image fr 0x027b0200 Audio FW: FW Image to 0x01b00000, size=0x003401a8 (0x01e401a8) FW Image fr 0x027f0200 IMAGE FILE: FW Image to 0x1e800000, size=0x00384000 (0x1eb84000) FW Image fr 0x199002000 Start A/V Firmware ... kylin_bring up hwsetting Finish kylin_bring_temp hwsetting [+][AO][aio_HWEnable] [AO]aio_CRTOn: SYS_CLOCK_ENABLE1 [ 0x9800000c]: 0x13dec561 SYS_CLOCK_ENABLE2 [ 0x98000010]: 0x58ffe416 SYS_SOFT_RESET1 [ 0x98000000]: 0xb7da1001 SYS_SOFT_RESET4 [ 0x98000050]: 0x0000801f [AO]ao_SetDACAnalogOn: TVE_VDAC_CTR1 [ 0x980183a0]: 0xa86c0280 x1O_O_ACANA_GCTL1 [ 0x980066E0X4P]:OR 0T xE24N9V 5A15T0 04 NAI0O_00I_00A0CA 64_tAkD_pC_reGCloTaLd2 _b[o o0xti98ma0g06es61 :0 ]:l oa0xd 8U80-Bao3ao0t0 0IfOro_Im_ 0AxDC0_0T0C2O81N 2[5 t0ox9 08x00016650f0c]00:0 0 wx2i2th1 fs00i0z0e Ax0IO0_10I_0A00DC0_ TCON [ 0x980066fc]: 0x221fff00 [-][AO][aio_HWEnable] [ACPU] Set protect, start: 0x00000000 end: 0x00001000 moduleid:6 HDMI Raw Enable: MPG AC3 DTS MPEG2 AAC DDP WMAPRO MLP SPDIF Raw Enable: MPG AC3 DTS MPEG2 AAC DDP WMAPRO MLP Force 2ch Format: DTS DTSHD AC3 DDP MLP AAC WMAPRO @@@@@@@One Step TV System magic number = 0xffffffff, addr = 0xa001f800@@@@@@@ [AUDIO WARNING] ERR UNCACHEABLE_VADDR 0xb8071200 @ 0x81b2e590 @@@@One Step magic number not match! use fw default TV System! [@@VIDEO_RPC_VOUT_ToAgent_ConfigTVSystem_0_svc]type 0! HDMIOff = 0 [VO]vo->is_hdmi_off_clock_on:86248 [@@VIDEO_RPC_VOUT_ToAgent_ConfigVideoStandard_0_svc] [VO_SetVideoStandard]st 25 p 1 1 0 [VO_SetVideoStandard]ped 1 data0 0x00000004 data1 0x00000000 VO_SetVideoStandard]HDMIoff 0c oipsy__t2vned__obno o1t luosaedre_rc_vabnsd__orfufn 0: slrvcd:s0.xf0o1r5m0a0t0 000 ,p odrstt_:s0ext0ti0n0g2 1 000x00,0 0s0i0z3e81: 0lxv0d0s0_bw1b0 000 .JVuOm pseitnTgV Sttoa n2dnadr db o2o5t l3oDa d0e r0.]. ( TVE) TVE_DAC_mode 0,cmd->enProg 1!! TV_NTSC_J ~~comp 0, ch2 1, mode_3D 0!! ~~comp 0, ch2 1, mode_3D 0!! ~~TVE standard# SetVideoStandard return! [@@VIDEO_RPC_VOUT_ToAgent_ConfigHdmiInfoFrame_0_svc] (VO_ConfigHDMI_InfoFrame) L:236, is_hdmi_plugin 1, hdmiMode 1!!Mode 1 dataByte1 0x00000040 0x000000a8 0x00000000 dataByte4 0x00000000 0x00000000 int0 0x00000001 (HDMI_3D) mode 1, HDMI_gen 1, En_3D 0, Format_3D 0 scramble:0!!@@@@DeepColor:0 deep Depth:0 go back SET_HDMI!!boot_info 0xa001f600 magic 0x2452544b en 1 boot_info.w 1280 h 720 boot_addr 0x1e800000 w 1280, h 720, img0 0x1e800000, pitch0 5120 disp.x 0 y 0 w 1920 h 1080 PowerOnOSD~~ [AO][_AO_if_video_HDMI_mode]gpAudio->HDMI_output_en = 0 U-Boot 2015.07-ge1162f1 (Aug 02 2016 - 11:24:56 +0800) CPU : Cortex-A53 Quad Core Board: Realtek QA Board [ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0) [ERR] Fall back to using CONFIG_SYS_RAM_DCU1_SIZE DRAM: 1 GiB mapping memory 0x20000000-0x40000000 non-cached In: serial Out: serial Err: serial Hit any key to stop autoboot: 0 rtk_plat_set_fw not port yet, use default configs ## Flattened Device Tree blob at 01f00000 Booting using the fdt blob at 0x1f00000 reserving fdt memory region: addr=0 size=30000 reserving fdt memory region: addr=1f000 size=1000 reserving fdt memory region: addr=30000 size=d0000 reserving fdt memory region: addr=2c00000 size=b800000 reserving fdt memory region: addr=1b00000 size=4be000 reserving fdt memory region: addr=2600000 size=600000 reserving fdt memory region: addr=1ffe000 size=4000 reserving fdt memory region: addr=11000000 size=9200000 reserving fdt memory region: addr=10000000 size=14000 reserving fdt memory region: addr=2200000 size=400000 Using Device Tree in place at 0000000001f00000, end 0000000001f12447 Bring UP slave CPUs Jump to BL31 entrypoint "Synchronous Abort" handler, esr 0x02000000 ELR: 10120000 LR: 23e90 x0 : 0000000000280000 x1 : 0000000001f00000 x2 : 0000000010120000 x3 : 0000000000000000 x4 : 000000000000d40a x5 : 0000000001f0e000 x6 : 0000000001f00000 x7 : 0000000001f0d4f2 x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 0000000000000002 x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 0000000000000400 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ffba0 Resetting CPU ... resetting ... "Synchronous Abort" handler, esr 0x96000021 ELR: 233dc LR: 2416c x0 : 00000000000000a5 x1 : 0000000000d7c601 x2 : 0000000000d7c601 x3 : 0000000000000001 x4 : 000000009801b50c x5 : ffffffff00000000 x6 : 000000000003b000 x7 : 000000000000000f x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 000000000000000c x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 00000000000ffaa0 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ff950 Resetting CPU ... resetting ... "Synchronous Abort" handler, esr 0x96000021 ELR: 233dc LR: 2416c x0 : 00000000000000a5 x1 : 0000000001326344 x2 : 0000000001326344 x3 : 0000000000000001 x4 : 000000009801b50c x5 : ffffffff00000000 x6 : 000000000003b000 x7 : 000000000000000f x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 000000000000000c x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 00000000000ff850 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ff700 Resetting CPU ... or d/g/r>h download to 0x80005EF0 Ymodem: CCCCCCCCCCxBFD37A61, len:0x00000680 d/g/r>s 98007058 98007058 = 0x10100000 d/g/r>d download to 0x10100000 Ymodem: CCCCCCCCCC crc32:0xD5BB5842, len:0x00010BA0 d/g/r>g jump to 0x10100000 64b <=============================================> fsbl_main: sys_secure_type = 0x0000BEEE fsbl_main: sys_boot_type = 0x00000002 fsbl_main: sys_boot_enc = 0x00000000 fsbl_main: sys_bisr_done = 0x00000000 Time out Time out Time out sys_hwsetting_size:B25F8493 sys_bootcode_size:B6A21E75 sys_secure_fsbl_size:1E28B723 sys_secure_os_size:26B3B9BB sys_bl31_size:738D6681 sys_rsa_key_fw_size:E42FBBDF sys_rsa_key_tee_size:DAE32C2D sys_rescue_size:9E8B6998 HwSetting: hwsetting_blk_no:00000100 hwsetting_total_size:B25F8513 hwsetting_blk_count:00592FC3 Bootcode: bootcode_blk_no:005930C3 bootcode_total_size:B6A21E95 bootcode_blk_count:005B5110 FSBL: secure_fsbl_blk_no:00B481D3 secure_fsbl_total_size:1E28B743 secure_fsbl_blk_count:000F145C TEE OS: secure_os_blk_no:00C3962F secure_os_total_size:26B3B9DB secure_os_blk_count:001359DD BL31: bl31_blk_no:00D6F00C bl31_total_size:738D66A1 bl31_blk_count:0039C6B4 RSA Key Fw: rsa_key_fw_blk_no:0110B6C0 rsa_key_fw_total_size:E42FBBFF rsa_key_fw_blk_count:007217DE RSA Key TEE: rsa_key_tee_blk_no:0182CE9E rsa_key_tee_total_size:DAE32C4D rsa_key_tee_blk_count:006D7197 Rescue: rescue_blk_no:01F04035 rescue_total_size:9E8B69B8 rescue_blk_count:004F45B5 ********** FW_TYPE_GOLD_TEE ********** fwInfo->fwType: 00000023 fwInfo->isGolden: 00000001 fwInfo->ddrReadAddr: 00520000 fwInfo->ddrDestAddr: 10200000 fwInfo->flashType: 00000002 fwInfo->flashUnitSize: 00000200 fwInfo->flashOffset: 872C5E00 fwInfo->dataSize: 26B3B9DB body_size:26B3B9BB flash_unit_no:0043962F flash_unit_count:001359DD Time out Time out Time out Time out Time out
  15. I managed to make the ymodem upload work in minicom: https://github.com/danielkucera/minicom-ymodem But I was not able to boot it this way anyway. I'm proceeding according to: http://wiki.banana-pi.org/Getting_Started_with_BPI-W2#Burn_OpenWRT_with_Linux_kernel_4.4 Any ideas?