danman

this shows how all the boot binary blobs are chained: https://github.com/BPI-SINOVOIP/BPI-W2-bsp/blob/a6d9f8d7be34cd734179bc528d4ab03d1972be28/u-boot-rt/examples/flash_writer/tools/bindAllBins/bindAllBins.c

this is an interresting reading: https://github.com/BPI-SINOVOIP/BPI-W2-bsp/commit/c8e8e9cea4e84934744a100727975cd912f1fc73 I'll try to compile and boot BPI's uboot today...

It's main purpose is to help with boot but without switching BOOTSEL it cannot be used. So currently it is doing nothing and I'm out of ideas how to find it... :/ Perhaps you could X-ray my box too? But first, I'd like to have a reliable way to recover whole eMMC without attached wires which is very close now. Then I'd like to experiment with running various systems (your armbian, porting Android 7 from w2, etc.) to be able to use HDMI input with hw encoding, prefferably with ffmpeg. SPI is only a bonus milestone for me.

@Staars, I think it doesn't matter. But I'm celebrating first success booting code from d/g/n d/g/r>h download to 0x80005EF0 Ymodem: CCCCCCCC d/g/r>s 98007058 98007058 = 0x00020000 d/g/r>d download to 0x00020000 Ymodem: CCCCCCCCCCCCCCCCCCCCCCCCC crc32:0xA96F74D3, len:0x000B21E0 d/g/r>g jump to 0x00020000 64b U-Boot 2012.07 (Aug 13 2016 - 10:06:21) CPU : Cortex-A53 quad core - AARCH32 Board: Realtek QA Board DRAM: 0 Bytes Watchdog: Disabled Cache: Enabled Non-Cache Region: 1 MB@0x07900000 MMC: rtk_emmc : Detect chip rev. >= B RTD1295 eMMC: 0 rtk_emmc : Detect chip rev. >= B EMMC ERROR ---------> Response timeout Card did not respond to voltage select! mmc->version=0x00010000 version=0x00000004 [LY] cardtype=57, mmc->card_caps=0f [LY] freq = 00464388, clk diver = 00000080 [LY] speed up emmc at HS-200 [LY] HS-200 bus width=2 [LY] mmc->boot_caps = 20b TEMP TX_WINDOW=0x1ffffff8, TX_best=0xf RX_WINDOW=0xffff41ff, RX_best=0x1c TX1_WINDOW=0x1fffff80, TX_best=0x11 [LY] hs200 : 0 [HC] WPG_SIZE = 4194304 Device: RTD1295 eMMC Manufacturer ID: 11 OEM: 100 Name: 008G7 Tran Speed: 5f5e100 Rd Block Len: 512 MMC version 4.0 High Capacity: No Capacity: 7.3 GiB Bus Width: 8-bit Speed: HS200 Factory: MMC Factory: pp:0, seq#:0x25, size:0x25a00 ------------tmp/factory/000BootParam.h found [logo]src w/h=1280/720 dst w/h=3840/2160 In: serial Out: serial Err: serial Net: Realtek PCIe GBE Family Controller mcfg = 0024 dev->name=r8168#0 Hit Esc or Tab key to enter console mode or rescue linux: 0 ------------can't find tmp/factory/recovery ======== Checking into android recovery ==== Start Boot Setup ... ---------------LOAD NORMAL FW TABLE --------------- [INFO] fw desc table base: 0x00620000, count: 22 Normal boot fw follow... Kernel: FW Image to 0x03000000, size=0x00f3d000 (0x03f3d000) FW Image fr 0x02b30400 DT: FW Image to 0x01f00000, size=0x0000f448 (0x01f0f448) FW Image fr 0x027b0200 Audio FW: FW Image to 0x01b00000, size=0x003401a8 (0x01e401a8) FW Image fr 0x027f0200 IMAGE FILE: FW Image to 0x1e800000, size=0x00384000 (0x1eb84000) FW Image fr 0x199002000 Start A/V Firmware ... kylin_bring up hwsetting Finish kylin_bring_temp hwsetting [+][AO][aio_HWEnable] [AO]aio_CRTOn: SYS_CLOCK_ENABLE1 [ 0x9800000c]: 0x13dec561 SYS_CLOCK_ENABLE2 [ 0x98000010]: 0x58ffe416 SYS_SOFT_RESET1 [ 0x98000000]: 0xb7da1001 SYS_SOFT_RESET4 [ 0x98000050]: 0x0000801f [AO]ao_SetDACAnalogOn: TVE_VDAC_CTR1 [ 0x980183a0]: 0xa86c0280 x1O_O_ACANA_GCTL1 [ 0x980066E0X4P]:OR 0T xE24N9V 5A15T0 04 NAI0O_00I_00A0CA 64_tAkD_pC_reGCloTaLd2 _b[o o0xti98ma0g06es61 :0 ]:l oa0xd 8U80-Bao3ao0t0 0IfOro_Im_ 0AxDC0_0T0C2O81N 2[5 t0ox9 08x00016650f0c]00:0 0 wx2i2th1 fs00i0z0e Ax0IO0_10I_0A00DC0_ TCON [ 0x980066fc]: 0x221fff00 [-][AO][aio_HWEnable] [ACPU] Set protect, start: 0x00000000 end: 0x00001000 moduleid:6 HDMI Raw Enable: MPG AC3 DTS MPEG2 AAC DDP WMAPRO MLP SPDIF Raw Enable: MPG AC3 DTS MPEG2 AAC DDP WMAPRO MLP Force 2ch Format: DTS DTSHD AC3 DDP MLP AAC WMAPRO @@@@@@@One Step TV System magic number = 0xffffffff, addr = 0xa001f800@@@@@@@ [AUDIO WARNING] ERR UNCACHEABLE_VADDR 0xb8071200 @ 0x81b2e590 @@@@One Step magic number not match! use fw default TV System! [@@VIDEO_RPC_VOUT_ToAgent_ConfigTVSystem_0_svc]type 0! HDMIOff = 0 [VO]vo->is_hdmi_off_clock_on:86248 [@@VIDEO_RPC_VOUT_ToAgent_ConfigVideoStandard_0_svc] [VO_SetVideoStandard]st 25 p 1 1 0 [VO_SetVideoStandard]ped 1 data0 0x00000004 data1 0x00000000 VO_SetVideoStandard]HDMIoff 0c oipsy__t2vned__obno o1t luosaedre_rc_vabnsd__orfufn 0: slrvcd:s0.xf0o1r5m0a0t0 000 ,p odrstt_:s0ext0ti0n0g2 1 000x00,0 0s0i0z3e81: 0lxv0d0s0_bw1b0 000 .JVuOm pseitnTgV Sttoa n2dnadr db o2o5t l3oDa d0e r0.]. ( TVE) TVE_DAC_mode 0,cmd->enProg 1!! TV_NTSC_J ~~comp 0, ch2 1, mode_3D 0!! ~~comp 0, ch2 1, mode_3D 0!! ~~TVE standard# SetVideoStandard return! [@@VIDEO_RPC_VOUT_ToAgent_ConfigHdmiInfoFrame_0_svc] (VO_ConfigHDMI_InfoFrame) L:236, is_hdmi_plugin 1, hdmiMode 1!!Mode 1 dataByte1 0x00000040 0x000000a8 0x00000000 dataByte4 0x00000000 0x00000000 int0 0x00000001 (HDMI_3D) mode 1, HDMI_gen 1, En_3D 0, Format_3D 0 scramble:0!!@@@@DeepColor:0 deep Depth:0 go back SET_HDMI!!boot_info 0xa001f600 magic 0x2452544b en 1 boot_info.w 1280 h 720 boot_addr 0x1e800000 w 1280, h 720, img0 0x1e800000, pitch0 5120 disp.x 0 y 0 w 1920 h 1080 PowerOnOSD~~ [AO][_AO_if_video_HDMI_mode]gpAudio->HDMI_output_en = 0 U-Boot 2015.07-ge1162f1 (Aug 02 2016 - 11:24:56 +0800) CPU : Cortex-A53 Quad Core Board: Realtek QA Board [ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0) [ERR] Fall back to using CONFIG_SYS_RAM_DCU1_SIZE DRAM: 1 GiB mapping memory 0x20000000-0x40000000 non-cached In: serial Out: serial Err: serial Hit any key to stop autoboot: 0 rtk_plat_set_fw not port yet, use default configs ## Flattened Device Tree blob at 01f00000 Booting using the fdt blob at 0x1f00000 reserving fdt memory region: addr=0 size=30000 reserving fdt memory region: addr=1f000 size=1000 reserving fdt memory region: addr=30000 size=d0000 reserving fdt memory region: addr=2c00000 size=b800000 reserving fdt memory region: addr=1b00000 size=4be000 reserving fdt memory region: addr=2600000 size=600000 reserving fdt memory region: addr=1ffe000 size=4000 reserving fdt memory region: addr=11000000 size=9200000 reserving fdt memory region: addr=10000000 size=14000 reserving fdt memory region: addr=2200000 size=400000 Using Device Tree in place at 0000000001f00000, end 0000000001f12447 Bring UP slave CPUs Jump to BL31 entrypoint "Synchronous Abort" handler, esr 0x02000000 ELR: 10120000 LR: 23e90 x0 : 0000000000280000 x1 : 0000000001f00000 x2 : 0000000010120000 x3 : 0000000000000000 x4 : 000000000000d40a x5 : 0000000001f0e000 x6 : 0000000001f00000 x7 : 0000000001f0d4f2 x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 0000000000000002 x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 0000000000000400 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ffba0 Resetting CPU ... resetting ... "Synchronous Abort" handler, esr 0x96000021 ELR: 233dc LR: 2416c x0 : 00000000000000a5 x1 : 0000000000d7c601 x2 : 0000000000d7c601 x3 : 0000000000000001 x4 : 000000009801b50c x5 : ffffffff00000000 x6 : 000000000003b000 x7 : 000000000000000f x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 000000000000000c x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 00000000000ffaa0 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ff950 Resetting CPU ... resetting ... "Synchronous Abort" handler, esr 0x96000021 ELR: 233dc LR: 2416c x0 : 00000000000000a5 x1 : 0000000001326344 x2 : 0000000001326344 x3 : 0000000000000001 x4 : 000000009801b50c x5 : ffffffff00000000 x6 : 000000000003b000 x7 : 000000000000000f x8 : 0000000001f000d8 x9 : 0000000001008000 x10: 000000000a200023 x11: 000000000000000c x12: 0000000000000002 x13: 00000000000fec10 x14: 0000000001f0e000 x15: 00000000000228e4 x16: 0000000000022b8c x17: 5090100082221ac5 x18: 000000003ff44ea8 x19: 00000000000ff850 x20: 0000000000000400 x21: 00000000000477e8 x22: 0000000000000003 x23: 00000000000ffd50 x24: 0000000000000000 x25: 0000000000000000 x26: 0000000001400000 x27: 0000000000023e48 x28: 0000000000000000 x29: 00000000000ff700 Resetting CPU ... or d/g/r>h download to 0x80005EF0 Ymodem: CCCCCCCCCCxBFD37A61, len:0x00000680 d/g/r>s 98007058 98007058 = 0x10100000 d/g/r>d download to 0x10100000 Ymodem: CCCCCCCCCC crc32:0xD5BB5842, len:0x00010BA0 d/g/r>g jump to 0x10100000 64b <=============================================> fsbl_main: sys_secure_type = 0x0000BEEE fsbl_main: sys_boot_type = 0x00000002 fsbl_main: sys_boot_enc = 0x00000000 fsbl_main: sys_bisr_done = 0x00000000 Time out Time out Time out sys_hwsetting_size:B25F8493 sys_bootcode_size:B6A21E75 sys_secure_fsbl_size:1E28B723 sys_secure_os_size:26B3B9BB sys_bl31_size:738D6681 sys_rsa_key_fw_size:E42FBBDF sys_rsa_key_tee_size:DAE32C2D sys_rescue_size:9E8B6998 HwSetting: hwsetting_blk_no:00000100 hwsetting_total_size:B25F8513 hwsetting_blk_count:00592FC3 Bootcode: bootcode_blk_no:005930C3 bootcode_total_size:B6A21E95 bootcode_blk_count:005B5110 FSBL: secure_fsbl_blk_no:00B481D3 secure_fsbl_total_size:1E28B743 secure_fsbl_blk_count:000F145C TEE OS: secure_os_blk_no:00C3962F secure_os_total_size:26B3B9DB secure_os_blk_count:001359DD BL31: bl31_blk_no:00D6F00C bl31_total_size:738D66A1 bl31_blk_count:0039C6B4 RSA Key Fw: rsa_key_fw_blk_no:0110B6C0 rsa_key_fw_total_size:E42FBBFF rsa_key_fw_blk_count:007217DE RSA Key TEE: rsa_key_tee_blk_no:0182CE9E rsa_key_tee_total_size:DAE32C4D rsa_key_tee_blk_count:006D7197 Rescue: rescue_blk_no:01F04035 rescue_total_size:9E8B69B8 rescue_blk_count:004F45B5 ********** FW_TYPE_GOLD_TEE ********** fwInfo->fwType: 00000023 fwInfo->isGolden: 00000001 fwInfo->ddrReadAddr: 00520000 fwInfo->ddrDestAddr: 10200000 fwInfo->flashType: 00000002 fwInfo->flashUnitSize: 00000200 fwInfo->flashOffset: 872C5E00 fwInfo->dataSize: 26B3B9DB body_size:26B3B9BB flash_unit_no:0043962F flash_unit_count:001359DD Time out Time out Time out Time out Time out

I managed to make the ymodem upload work in minicom: https://github.com/danielkucera/minicom-ymodem But I was not able to boot it this way anyway. I'm proceeding according to: http://wiki.banana-pi.org/Getting_Started_with_BPI-W2#Burn_OpenWRT_with_Linux_kernel_4.4 Any ideas?

@ShaRose, do you have root access on your original system? Can you try: dd if=/dev/mem bs=1 skip=32505856 count=74410 of=original.dtb (skip and count are translated from hex to dec) @others Meanwhile I was experimenting with the d/g/r> shell. I'm struggling to make ymodem work in minicom but I have some ideas...

For me it works, let's assume it's not compressed. If it is, binwalk should find tar, gzip, xz or something.... these have signatures.

@ShaRose, try following: strings -t x <your_image> | grep rtd129x-usb2phy you should find an aproximate location of your DTB.

Hi @ShaRose, have you tried to use the original DTB? Extract it from original system and use with compiled kernel...

Ctrl+Q goes to this: C1:� C1:80000000 C2 ? C1:80000000 C2 ? d/g/r>� d/g/r> What is it good for?

Wow! Really? This might help you with searching then I'll try Ctrl-Q as soon as I'm home.

@Staars, if I understand it correctly there are two things on BPI-W2 to control the boot: 1. SW4 as described here: http://forum.banana-pi.org/t/how-to-make-a-sd-card-with-bootloader/5767 connected to BOOTSEL/BOOT_SEL pin (see https://drive.google.com/file/d/1Xn7-nlY0kVJacnRh_EpuS5Fw92_b6qqu/view) and 2. "USB" button to boot into USB OTG to recover using "kylin usb mp tool" It seems to me that on our boards we only have the "USB" button and we need to find a way to switch BOOT_SEL line, otherwise we won't be able to boot from SPI. Do you maybe have some friend with X-ray to trace the line to AA12 pin ? Second question is what to write to our SPI? I have tried this guide http://forum.banana-pi.org/t/bananapi-w2-ubuntu-18-04-new-image-release-2018-09-17/6790 but it fails with on board with the same "Malloc DDR" Maybe someone can provide SPI flash dump? @chwe ?

Ha! I've fixed it! I was missing emmc_rst# high. Start sector written, box booting

I'm stupid... the pinout can be found here https://drive.google.com/file/d/1Xn7-nlY0kVJacnRh_EpuS5Fw92_b6qqu/view

I've had no luck with the recovery using USB OTG method (https://androidpctv.com/firmware-update-guide-for-tv-box-with-soc-realtek/). I haven't found an image for Zidoo X8/X9S suitable for using with "kylin usb mp tool" (one which contains layout.txt) and images for other devices fail with error above. I managed to find CMD, CLK and perhaps DAT0 pins of eMMC and written some deleted parts but the write is unreliable, probably because RTD is messing with the lines while I'm writing with an SD card reader. I'll explore this method more tomorrow. This is my best option currently. My last option is to reflow the eMMC but I'd like to avoid this because the ball pitch on eMMCs is very very fine so I would need to train on a few test subjects which takes a lot of time. But I'm still not loosing hope.

I was too fast with deleting eMMC... Recovery fails with: ?uu3-1 [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST H V_OK Malloc DDR Probably the image is not correct. Maybe I'll need to find a way how to flash my eMMC backup back...

I don't have any USB3 stick :\ I wiped first 4MB from eMMC: C1:80000000 C2 ? C3hswitch frequency to 0x00000046 frequency divider is 0x00000080 switch frequency to 0x00000046 frequency divider is 0x00000004 switch to SDR 8 bit switch bus width to 0x00000008 bits success 0000001� C1:80000000 C2 ?uu3-1

@Staars, I was experimenting with the button today: PRESSED BUTTON: C1:80000000 C2 ?uu3-1 SHORTED EMMC: C1:80000000 C2 ? C3hswitch frequency to 0x00000046 frequency divider is 0x00000080 Response timeout Response timeout Response timeout Response timeout PRESSED BUTTON + USB CONNECTED: C1:80000000 C2 ?uu3-1 [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST [GO] ST and lsusb: Bus 002 Device 009: ID 0bda:1195 Realtek Semiconductor Corp. So if I understand it correctly, button is only for USB OTG recovery and you have to have both USB and power adapter connected.

U-boot.bin

Just a standard FAT partition. The rest you can see in my boot command. Can you somehow dump your u-boot so I can try to boot into it?

Ok guys, am I in the club? Last login: Fri May 31 19:21:18 UTC 2019 on ttyS0 _ _ _ | | __ _| | _____ / | | | / _` | |/ / _ \ | | | |__| (_| | < __/ | | |_____\__,_|_|\_\___| |_| Welcome to ARMBIAN 5.86 user-built Debian GNU/Linux 9 (stretch) 4.9.176-rtd1295 System load: 1.09 0.99 0.56 Up time: 8 min Memory usage: 3 % of 1636MB IP: CPU temp: 46�°C Usage of /: 7% of 15G [ General system configuration (beta): armbian-config ] my boot command: usb start && fatload usb 0:1 $kernel_loadaddr vmlinuz && fatload usb 0:1 $fdt_loadaddr dtb && env set bootargs earlycon=uart8250,mmio32,0x98007800 console=ttyS0,115200 noinitrd root=/dev/mmcblk0p1 rootfs=ext4 init=/sbin/init && b2ndbc; bootr

Ok, I will try to use fatload: Realtek> usb start (Re)start USB... USB0: USB EHCI 1.00 scanning bus 0 for devices... 3 USB Device(s) found USB1: USB XHCI 1.10 scanning bus 1 for devices... Unknown request , typeReq = 0x200c 1 USB Device(s) found USB2: USB XHCI 1.10 scanning bus 2 for devices... Unknown request , typeReq = 0x200c 1 USB Device(s) found scanning usb for storage devices... 1 Storage Device(s) found 1: Hub, USB Revision 2.0 - u-boot EHCI Host Controller - Class: Hub - PacketSize: 64 Configurations: 1 - Vendor: 0x0000 Product 0x0000 Version 1.0 Configuration: 1 - Interfaces: 1 Self Powered 0mA Interface: 0 - Alternate Setting 0, Endpoints: 1 - Class Hub - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms 2: Hub, USB Revision 2.0 - USB2.0 Hub - Class: Hub - PacketSize: 64 Configurations: 1 - Vendor: 0x05e3 Product 0x0610 Version 50.152 Configuration: 1 - Interfaces: 1 Self Powered Remote Wakeup 100mA Interface: 0 - Alternate Setting 0, Endpoints: 1 - Class Hub - Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms - Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms 3: Mass Storage, USB Revision 2.0 - Kingston DataTraveler 2.0 AC220B280602BE41599A0150 - Class: (from Interface) Mass Storage - PacketSize: 64 Configurations: 1 - Vendor: 0x0951 Product 0x1665 Version 1.0 Configuration: 1 - Interfaces: 1 Bus Powered 200mA Interface: 0 - Alternate Setting 0, Endpoints: 2 - Class Mass Storage, Transp. SCSI, Bulk only - Endpoint 1 In Bulk MaxPacket 512 - Endpoint 2 Out Bulk MaxPacket 512 4: Hub, USB Revision 3.0 - u-boot XHCI Host Controller - Class: Hub - PacketSize: 9 Configurations: 1 - Vendor: 0x0000 Product 0x0000 Version 1.0 Configuration: 1 - Interfaces: 1 Self Powered 0mA Interface: 0 - Alternate Setting 0, Endpoints: 1 - Class Hub - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms 5: Hub, USB Revision 3.0 - u-boot XHCI Host Controller - Class: Hub - PacketSize: 9 Configurations: 1 - Vendor: 0x0000 Product 0x0000 Version 1.0 Configuration: 1 - Interfaces: 1 Self Powered 0mA Interface: 0 - Alternate Setting 0, Endpoints: 1 - Class Hub - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms Realtek> fatls usb 0:1 11110393 uimage.gz lost.dir/ .zxc/ android/ 471238945 ota.zip 512508547 zidoo_x8-v2.1.22-201901171517-ota.zip 3 file(s), 3 dir(s) Realtek> fatload usage: fatload <interface> <dev[:part]> <addr> <filename> [bytes] [file_count] Realtek>

Houston, we have a problem. I don't have `sd` command in my uboot: Realtek> Realtek> help b2ndbc - load 2nd stage bootcode bdinfo - print Board Info structure bootm - boot application image from memory bootr - boot realtek platform dcache - enable or disable data cache env - environment handling commands factory - FACTORY sub system fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) fdt - flattened device tree utility commands gettime - get timer val elapsed go - start application at address 'addr' or start running fw goru - start rescue linux from usb help - print command description/usage icache - enable or disable instruction cache keyset - keyset - write keyset file into factory area loady - load binary file over serial line (ymodem mode) md - memory display mmc - MMC sub system (patch for rtd299x) mtest - simple RAM read/write test mtest2 - simple RAM read/write test mw - memory write (fill) ping - send ICMP ECHO_REQUEST to network host reset - Perform RESET of the CPU rtkemmc - RTK EMMC functions saveenv - save environment variables to persistent storage source - run script from memory tftp - download image from TFTP server tftpput - TFTP put command, for uploading files to a server uart_write- for uart mp tool burn mac and sn key unzip - unzip a memory region usb - USB sub-system Realtek>

Ok, I managed to build: https://s.danman.eu/pub/Armbian_5.86_Lake1_Debian_stretch_default_4.9.176.img In the evening I'll try to boot.

This might be also useful: https://s.danman.eu/pub/ZIDOO_X8-v2.1.22-201901171517-ota.zip