danman

Until now, I thought that dvrboot.exe.bin is SPI image which is supposed to be directly written to SPI FLASH chip. But today I discovered it is actually a binary which should be executed on the device to program the SPI chip "in system". We have sources for this binary here: https://github.com/BPI-SINOVOIP/BPI-W2-bsp/blob/master/u-boot-rtk/examples/flash_writer/dvrmain.c#L2101 so my next step for creating custom SPI with bootloader for my zidoo X8 is to dissect the locations and create a script to assemble SPI image from all the components which could be directly written to SPI FLASH chip.

I need to find out where to put the hwsetting onto SPI and I am not very good with ghidra.

From https://drive.google.com/file/d/1kXaI5eYJ4cNLnhfr4rTwUVrENbMc1q-E/view this shows the addresses in spi flash:

Ladies and gentlemen, I managed to boot from SPI on my Zidoo X8: Banana Pi BPI-W2(SPI ROM:20180907) C1:80000000 C2 ? C3h SD card is not detected !! BPI: try get_builtin_hwsetting !! hwsetting size: 00000000 C4 BPI: try bootcode_from_emmc !! BPI: support boot from emmc switch frequency to 0x00000046 frequency divider is 0x00000080 switch frequency to 0x00000046 frequency divider is 0x00000004 switch to SDR 8 bit switch bus width to 0x00000008 bits success Time out Time out Time out End bit error BPI: sys_boot_type:1414141490A73F71C7 Banana Pi BPI-W2(SPI ROM:20180907) C1:80000000 C2 ?uu3-1 All I needed was dump from BPI-W2 SPI flash (attached) which I was asking for serveral times here In next days, I'll try to boot Linux kernel as described here: http://forum.banana-pi.org/t/bananapi-w2-ubuntu-18-04-new-image-release-2018-09-17/6790 bpi-w2.bin.short

To be precise, it shows the interface but link down.

Latest kernel installed, compare attached dmesg-s. It starts working again after `reboot` invoked from serial console. dmesg-ok.log dmesg-watchdog-5.10.log

Armbian_20.05.2_Orangepizero_focal_current_5.4.43.img.xz works without any problem. Thank you ___ ____ _ _____ / _ \| _ \(_) |__ /___ _ __ ___ | | | | |_) | | / // _ \ '__/ _ \ | |_| | __/| | / /| __/ | | (_) | \___/|_| |_| /____\___|_| \___/ Welcome to Armbian Focal with Linux 5.4.43-sunxi System load: 1.03 1.49 0.70 Up time: 4 min Memory usage: 30 % of 239MB Zram usage: 19 % of 119Mb IP: 192.168.1.129 CPU temp: 56°C Usage of /: 13% of 7.3G [ General system configuration (beta): armbian-config ] Last login: Fri Jun 5 07:17:01 2020 from 192.168.1.137

Hi, I have tried to run Armbian_20.05.1_Orangepizero_focal_current_5.4.43.img.xz but it doesn't work, see here: U-Boot SPL 2020.04-armbian (May 30 2020 - 18:49:32 +0200) DRAM: 256 MiB Trying to boot from MMC1 U-Boot 2020.04-armbian (May 30 2020 - 18:49:32 +0200) Allwinner Technology CPU: Allwinner H3 (SUN8I 1680) Model: Xunlong Orange Pi Zero DRAM: 256 MiB MMC: mmc@1c0f000: 0, mmc@1c10000: 1 Loading Environment from FAT... Unable to use mmc 0:1... In: serial Out: serial Err: serial Net: phy interface0 eth0: ethernet@1c30000 starting USB... Bus usb@1c1a000: USB EHCI 1.00 Bus usb@1c1a400: USB OHCI 1.0 Bus usb@1c1b000: USB EHCI 1.00 Bus usb@1c1b400: USB OHCI 1.0 Bus usb@1c1c000: USB EHCI 1.00 Bus usb@1c1c400: USB OHCI 1.0 scanning bus usb@1c1a000 for devices... 1 USB Device(s) found scanning bus usb@1c1a400 for devices... 1 USB Device(s) found scanning bus usb@1c1b000 for devices... 1 USB Device(s) found scanning bus usb@1c1b400 for devices... 1 USB Device(s) found scanning bus usb@1c1c000 for devices... 1 USB Device(s) found scanning bus usb@1c1c400 for devices... 1 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found Autoboot in 1 seconds, press <Space> to stop switch to partitions #0, OK mmc0 is current device Scanning mmc 0:1... Found U-Boot script /boot/boot.scr 3789 bytes read in 4 ms (924.8 KiB/s) ## Executing script at 43100000 U-boot loaded from SD Boot script loaded from mmc 181 bytes read in 3 ms (58.6 KiB/s) 13650370 bytes read in 1038 ms (12.5 MiB/s) 7236248 bytes read in 552 ms (12.5 MiB/s) Found mainline kernel configuration 29861 bytes read in 12 ms (2.4 MiB/s) 504 bytes read in 8 ms (61.5 KiB/s) Applying kernel provided DT overlay sun8i-h3-usbhost2.dtbo 504 bytes read in 8 ms (61.5 KiB/s) Applying kernel provided DT overlay sun8i-h3-usbhost3.dtbo 4185 bytes read in 8 ms (510.7 KiB/s) Applying kernel provided DT fixup script (sun8i-h3-fixup.scr) ## Executing script at 44000000 ## Loading init Ramdisk from Legacy Image at 43300000 ... Image Name: uInitrd Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 13650306 Bytes = 13 MiB Load Address: 00000000 Entry Point: 00000000 Verifying Checksum ... Bad Data CRC Ramdisk image is corrupt or invalid SCRIPT FAILED: continuing... I tried both torrent and http downloads and two microSD cards, the sha checksum is correct too: danman@silverhorse:~/Downloads$ sha256sum Armbian_20.05.1_Orangepizero_focal_current_5.4.43.img.xz 12dd233cc434435027e4756ce752b8aad40307eadda613cf2b225cb8b209da9b Armbian_20.05.1_Orangepizero_focal_current_5.4.43.img.xz danman@silverhorse:~/Downloads$ cat Armbian_20.05.1_Orangepizero_focal_current_5.4.43.img.xz.sha 12dd233cc434435027e4756ce752b8aad40307eadda613cf2b225cb8b209da9b *Armbian_20.05.1_Orangepizero_focal_current_5.4.43.img.xz The Armbian_20.05.1_Orangepizero_buster_current_5.4.43.img.xz works without any problem.

Switching to "current" kernel fixed the issue. Thank you! Linux orangepioneplus 5.4.20-sunxi64 #20.02.1 SMP Mon Feb 17 02:37:37 CET 2020 aarch64 GNU/Linux FYI here are my performance numbers: Link capacity (limit of router): 300Mbps Wireguard bandwidth (outer): 275Mbps HTTPS bandwidth (inner): 250Mbps Utilization: top - 19:50:22 up 19 min, 2 users, load average: 1.07, 1.42, 0.98 Tasks: 143 total, 6 running, 77 sleeping, 0 stopped, 0 zombie %Cpu0 : 6.8 us, 23.2 sy, 0.0 ni, 49.0 id, 0.0 wa, 0.0 hi, 20.9 si, 0.0 st %Cpu1 : 2.3 us, 28.9 sy, 0.0 ni, 62.0 id, 0.0 wa, 0.0 hi, 6.9 si, 0.0 st %Cpu2 : 4.5 us, 14.4 sy, 0.0 ni, 74.7 id, 0.3 wa, 0.0 hi, 6.2 si, 0.0 st %Cpu3 : 10.8 us, 29.5 sy, 0.0 ni, 19.8 id, 0.0 wa, 0.0 hi, 39.9 si, 0.0 st KiB Mem : 1013164 total, 379448 free, 198644 used, 435072 buff/cache KiB Swap: 506580 total, 506580 free, 0 used. 717472 avail Mem Change delay from 3.0 to PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 5539 root 20 0 16944 9128 7016 R 55.4 0.9 0:12.87 curl 4206 root 20 0 0 0 0 I 20.8 0.0 0:15.16 kworker/1:1-wg- 4211 root 20 0 0 0 0 I 14.9 0.0 0:10.15 kworker/2:3-wg- 3348 root 20 0 0 0 0 I 13.2 0.0 0:24.20 kworker/3:0-wg- 4209 root 20 0 0 0 0 I 9.2 0.0 0:12.18 kworker/0:3-wg- 4204 root 20 0 0 0 0 I 8.9 0.0 0:25.67 kworker/3:3-wg- 331 root 20 0 0 0 0 I 8.6 0.0 0:26.93 kworker/3:2-wg- 4074 root 20 0 0 0 0 R 7.9 0.0 0:16.92 kworker/3:1+wg- 4205 root 20 0 0 0 0 R 7.6 0.0 0:11.82 kworker/0:0-wg- 3547 root 20 0 0 0 0 I 7.3 0.0 0:17.11 kworker/0:2-wg- 451 root 20 0 0 0 0 I 4.6 0.0 0:17.58 kworker/1:3-wg- 4208 root 20 0 0 0 0 R 4.3 0.0 0:21.42 kworker/1:4-wg- 286 root 20 0 0 0 0 I 4.0 0.0 0:15.28 kworker/2:2-wg- 4207 root 20 0 0 0 0 I 3.0 0.0 0:12.37 kworker/1:2-wg-

Hi, I'm running a kernel from yesterday on Orange PI One Plus: Linux orangepioneplus 5.5.13-sunxi64 #trunk.087 SMP Fri Mar 27 01:33:22 CET 2020 aarch64 GNU/Linux I've sucessfully setup wireguard: root@orangepioneplus:~# wg interface: wg0 public key: YKbQlQmch4sfNOtymDrnZbuLTD3zLO72cbIIFuXED1c= private key: (hidden) listening port: 42655 peer: dg1cKCId81d6h5cWUQ61BMHksBbi0FdFnitjxDuOuno= endpoint: ******:51820 allowed ips: 10.9.0.0/24, fd86:ea04:1115::/64 latest handshake: 15 seconds ago transfer: 92 B received, 180 B sent persistent keepalive: every 25 seconds But it seems that crypto is failing from time to time: root@orangepioneplus:~# ping 10.9.0.1 -s1200 PING 10.9.0.1 (10.9.0.1) 1200(1228) bytes of data. 1208 bytes from 10.9.0.1: icmp_seq=1 ttl=64 time=19.0 ms 1208 bytes from 10.9.0.1: icmp_seq=2 ttl=64 time=27.1 ms 1208 bytes from 10.9.0.1: icmp_seq=3 ttl=64 time=20.1 ms wrong data byte #548 should be 0x24 but was 0x26 #16 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f #48 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f #80 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f #112 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f #144 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af #176 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf #208 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef #240 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 0 1 2 3 4 5 6 7 8 9 a b c d e f #272 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f #304 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f #336 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f #368 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f #400 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af #432 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf #464 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef #496 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 0 1 2 3 4 5 6 7 8 9 a b c d e f #528 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 26 6 e3 c1 4a cb 73 17 d7 fb 64 eb #560 7d ea 87 ea 5 f3 81 89 f6 55 5e 73 27 42 41 93 2d f8 96 2 11 dd ad 5c fb 68 99 8f ad a1 8d e8 #592 2f 7b ba 8b ba 4d 57 ed 1b 7 a6 9d d2 4f 59 79 82 77 d1 43 d2 28 4a 38 76 9c 20 85 8d da 62 69 #624 1f 9a 73 5f a5 f3 82 19 64 93 89 bf db 7b 2b a9 cb 16 cf f9 be 2b c1 bd ef 34 34 5e 68 38 ff 14 #656 c8 3f 34 12 27 1a 80 2c 89 d2 4a 9a 59 96 bb 94 18 98 c3 e4 10 e7 2b 6e b fa 3d 9e 65 4d 7b 37 #688 d0 60 9f 10 42 99 76 75 9 73 fc b 28 50 4d b2 c0 96 eb df ee 9b 48 f0 7c b9 f 55 d5 28 6c a #720 95 30 55 22 4b 16 a3 ad 35 b2 5a 74 47 11 d4 23 48 7b f2 16 e0 6a c3 e1 ba 6d 2f bd 9c 9e ab b4 #752 ac 4d 69 9c 1e 18 60 33 f2 48 43 dc 92 9c ab 6f d0 32 a 1b 24 5 24 ff 3a 1b a4 9a a4 ab af 5b #784 cc 2e 1a 7d d3 58 a9 d c2 1c 7a 4f 3 d8 41 40 1e 93 14 ad 45 11 1c c5 b7 33 ab f8 40 bd a0 e8 #816 83 4d 50 78 74 a1 59 b5 14 d4 85 5 cc 3e 7c 31 2c 2e cb 2 4 6d 8b d7 e1 c 9 ee 31 e7 93 2f #848 11 36 af 7c 6c 97 95 69 c6 b6 8c d3 dc 5 62 a9 a 7 c8 5e 45 2c 3b 81 a0 d4 6 cb 1f f4 c9 dd #880 a0 4c 71 31 77 cd 59 24 a2 d1 75 6c f3 df f8 be 7b 66 5c bb b0 c5 67 b3 7e 7d b9 f 4c c9 8 77 #912 f7 34 d4 96 e 9c ce 35 a5 3f 1f bc 27 79 b5 c7 86 f2 35 34 9b 7f 73 47 d6 b5 26 97 e5 9 d1 43 #944 e7 87 d7 3c b8 e7 11 b6 df 3a 53 4e ae f 44 6a b6 5d 61 64 2d 1c d3 ca 4b ad 7f b1 dd ba 60 f5 #976 8 9e 8d bc b7 a5 54 25 f0 88 44 a7 e4 72 7c f5 94 d9 9d fc b2 b2 aa c2 90 44 6a 7a 6b ed 1e 7e #1008 bc 6e 2 28 7 a 8a c2 ce f2 64 bc fb e5 41 e5 be a9 f9 5a 65 ba 60 1c ae 32 db 4f c4 b3 a5 e2 #1040 96 e7 13 36 3d 6c 66 ff c 65 f 1e 3e f4 ec 85 17 c2 8e 7 e2 48 66 b3 f b8 61 b1 b6 14 3c ca #1072 dd 34 df fc 96 87 ae d8 a 3d 49 93 6 f ec 9c 83 c1 5b 2 b3 a dd 29 e5 fd 73 26 79 d0 63 a3 #1104 32 1a 30 37 82 36 43 34 b6 bb e9 0 bd 3c d e3 1a 48 78 6c 91 a8 66 af 5e 77 6c 36 ed 35 d0 4f #1136 5e 57 46 87 7d 4 5c c4 b1 1c 7b d5 70 6d 10 4c 6d 9e 98 fb a 6e 12 a ea ca f7 68 1a 5b ac 0 #1168 ae e8 52 d9 88 5 b0 24 1 db e8 3c 27 7b 64 d5 c7 1d 3f 5b ba 39 1e 4b d9 1f a5 d5 d6 d ad af 1208 bytes from 10.9.0.1: icmp_seq=4 ttl=64 time=22.1 ms 1208 bytes from 10.9.0.1: icmp_seq=5 ttl=64 time=19.9 ms 1208 bytes from 10.9.0.1: icmp_seq=6 ttl=64 time=30.9 ms 1208 bytes from 10.9.0.1: icmp_seq=7 ttl=64 time=22.1 ms wrong data byte #484 should be 0xe4 but was 0xf7 #16 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f #48 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f #80 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f #112 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f #144 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af #176 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf #208 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef #240 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 0 1 2 3 4 5 6 7 8 9 a b c d e f #272 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f #304 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f #336 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f #368 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f #400 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af #432 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf #464 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 f7 86 5f 41 ff d1 b7 8e 88 5c d9 cf #496 67 77 86 ba 28 4f 2b 9e 5e 51 34 c3 bf b4 19 d0 c4 db 6a a cc 7 c3 70 e2 1e 41 f0 39 de 3d b5 #528 4 36 16 80 f2 69 eb 73 9 f8 9e 6e 59 ff 37 83 12 e 20 d4 f4 7c 1e 7a 45 16 64 4e 17 d2 53 69 #560 e1 96 ee 31 4b c2 3 70 e 17 32 1d 44 bc 40 23 53 73 95 9a fb 70 41 e7 ec b9 72 e5 82 c3 bf 74 #592 44 28 8d f3 3d c4 97 8b 27 84 d7 e9 7 c3 93 1b 63 e3 a3 28 f4 31 f8 f1 18 2f 9 a7 64 ec 27 72 #624 1d 7d f0 21 a8 8c a3 a7 2c 33 81 86 e3 e6 24 21 79 e8 54 c2 23 27 6b d6 d3 99 8e 35 c5 e0 f0 3a #656 a1 e4 82 60 99 b0 b5 b9 69 6c 20 52 db b7 4d 1 22 6a 59 8f 1e 9c 82 48 a4 a2 d 70 76 4 4a ae #688 10 dd 7d ea 62 71 7f ac 2c 4e 6 a3 2b 72 23 aa 89 48 d6 a4 6f 30 af f f2 4d f3 70 bc b 4e bc #720 22 38 e3 fd 69 8e d1 c5 31 0 45 31 d4 a6 bd 7f 2a 3 7 8b d6 98 c2 d8 6b 2 33 96 52 95 2e 55 #752 fd cc 18 a0 e9 5a 4f f f3 8d 38 26 bd ac 9b a e 2f 16 ce 7e ce 5f c5 9a 39 13 67 38 c3 54 45 #784 38 6f 75 58 9 be c4 ab 84 ba 1 26 3f 83 b8 31 3b d5 ec c5 f3 60 70 cd 6d dc ec 7b 13 7f 83 cd #816 80 a1 96 7f 77 53 e8 b8 29 13 bd c3 16 99 10 55 2f 55 27 b 32 37 71 1b 37 41 95 fe 57 e1 9e 30 #848 f4 e1 b7 48 b9 28 8f e4 6a 31 30 b3 c4 92 e7 13 a5 56 76 de ba ce 6f fc b 8c e2 50 a7 e4 27 f7 #880 2b 7 5 6a 37 b 2e 35 89 be c4 5a 2e 20 fc 46 c4 4f 36 45 1a 3f 1c 2d 6c 22 8c 87 ef ff 90 d1 #912 b5 46 f 19 85 fe 48 89 6d 7d 4f 78 1a 40 83 a1 38 8b 7f b4 40 12 68 a6 5 d3 a6 17 60 d fc 53 #944 19 39 3e 25 16 f2 3a 22 b5 eb a4 c7 61 de d 39 9c f5 f7 d3 35 6e 34 4e ac 17 47 e4 2b 2e 1b 3b #976 6f f 6b b5 d3 e9 4 c3 9 86 82 99 53 5a d8 99 77 d 5 d8 16 fd 96 27 6 64 3c a7 24 af 2c ed #1008 f4 54 f5 de f9 1f a 4b 34 ee 39 fd 9 c4 8f ca 78 cd 45 80 82 a5 7e 93 ec 49 c3 42 58 2a f5 82 #1040 a9 6e 9f 2e 8d 48 cb 3d b6 c7 e3 cc d2 34 40 ac c3 5 68 da 35 f8 3d f3 ee 67 9e 3d 9f 23 25 77 #1072 31 21 13 ea 45 e6 52 ed d3 cc 48 56 e2 a9 3 43 d4 58 3c 8b 68 a5 90 e7 e2 8d 7e b5 16 db f3 a7 #1104 79 ea 16 88 32 f8 ee bb e1 f8 4a b5 7 8b ff 56 53 1d 41 9b 12 1f 9c 63 bd 77 da f5 aa 1 85 bd #1136 6d f1 2b 65 fc 4b 7 ac da 4f f6 7f ec dc 99 bb 63 f 6d 8f 1c 60 b9 7c 62 23 c4 3 13 62 b4 0 #1168 81 d5 fb 22 9 23 3a 74 12 65 b5 36 51 57 a2 d6 64 6e 81 2e 9d 7b 22 e6 df 68 a1 58 58 d7 fa 2e 1208 bytes from 10.9.0.1: icmp_seq=8 ttl=64 time=26.4 ms 1208 bytes from 10.9.0.1: icmp_seq=9 ttl=64 time=18.9 ms Is it possible that HW crypto acceleration is broken? Is there a way how to disable it? Maybe @Igor can help?

I was sniffing the SPI communication today. It seems to be loading data from address 0x000200 from SPI flash. (those short spikes are glitches in my logic analyzer)

Can you try to dump it from u-boot? Like they do here: https://reverseengineering.stackexchange.com/a/6645

Did you boot from eMMC or SD card?

Please try to dump mtd0 E.g.: dd if=/dev/mtd0 of=dump.dd

Hi y52, can you show contents of your /dev/ folder?

@Staars it doesn't boot because I don't have the correct image but on the MISO/MOSI/CLK pins of SPI I can see some signals which were not there before attaching jumper. It doesn't show anything on serial because it doesn't boot It is not even possible to get to d/g/n mode when the jumper is attached (maybe someone with W2 can confirm this behavior?) I managed to compile some spi images after fixing some bugs in the "SDK" https://github.com/BPI-SINOVOIP/BPI-W2-openwrt-lede/issues/2 but I didn't have time to test them. You cannot use just any image because they differ per device in "hwsetting" file, ram config, etc... Still waiting for @chewitt to provide SPI dump from his W2 to compare the layout.

Good news! I have found the BOOTSEL pin on my board I connected my logic analyzer to DI pin on SPI header, shorted one suspected pad and saw signals on my analyzer. Then I made a jumper out of 1.27mm pitch pin header and did some fine soldering. Now the question is, what to load to my SPI flash? Does anybody have a full dump from bpi w2 here?

I like that they published complete guide how to use HW encoding with ffmpeg together with a patch and libraries

I wrote a short guide how to recover from wiped boot sector https://blog.danman.eu/zidoo-x8-recovery/

Wow! That is awesome! Do you have a detail of the main chip ? Or more pictures? What X-ray device was used?

My box also comes without SPI. Can you try minicom? Is it available on mac? You should first press and hold both keys (you should see your USB-serial TX LED blinking quicky) and while holding, connevt power to your box.

@Staars, just because of you I did a test. I removed SPI flash and wiped first 4megs by writing zeroes: $ sudo dd if=/dev/zero of=/dev/sdc bs=1M count=4 4+0 records in 4+0 records out 4194304 bytes (4.2 MB, 4.0 MiB) copied, 0.686883 s, 6.1 MB/s result: C1:80000000 C2 ? C3hswitch frequency to 0x00000046 frequency divider is 0x00000080 switch frequency to 0x00000046 frequency divider is 0x00000004 switch to SDR 8 bit switch bus width to 0x00000008 bits success 0000001� C1:80000000 C2 ?uu3-1 but when I hold Ctrl+q while booting: C1:80000000 C2 ? d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> d/g/r> So I am 99% sure d/g/r works regardless on what you have on you emmc, if you have SPI or whatever. I believe this is firmware inside of the SoC. What terminal are you using?

So you can flash from the windows utility but the box still doesn't boot, right? Can you reach d/g/r from terminal using Ctrl+q?

I'm convinced this is not true and I can prove it later. I think this is also not true. What do you mean by this? Does the box boot? My idea how to save your box: 1. extract hwconfig and uboot from the dump I asked for and a bootlog (it shows blob locations) 2. boot these using d/g/r into u-boot 3. reflash full emmc dump from working box to not working one within u-boot or recovery linux

Btw, do you have two Lake1 boxes now? Don't you want to try to recover the bricked one using one of my methods (soldering or d/g/r boot) ? Can you send me first 20 megs of eMMC from a working one?