0
xaduha

research Since Tanix TX6 can boot from the SD card

Recommended Posts

Tanix TX6 is H6 based Android TV Box and it can boot from SD cards prepared with PhoenixCard. It should be possible to make it work with Armbian too, right? I tried a recent Lite2 image, it didn't work, but it also didn't boot main Android, which means SD boot takes priority. I don't think it's a normal behavior for other Android TV boxes, but maybe it is for those with H6 boards.

Share this post


Link to post
Share on other sites

i just gave it a try to boot the orange-pi-3 and pine h64 armbian images and the orangepi 4.9 kernel image on a q-plus h6 4g/32g tv box and it did not work out well - the serial console output was:

Quote

armbian images:

U-Boot SPL 2019.04-armbian (May 27 2019 - 02:06:56 +0200)
DRAM:This DRAM setup is currently not supported.

resetting ...

 

orangepi 4.9 kernel image:

[240]HELLO! BOOT0 is starting!
[244]boot0 commit : 94a1b3d504ad4cd9bb5d9522947301ac0350ab1b
 
[251]key press : [

and nothing more. looks like one would first need to get some uboot working to the point that it boots well and is able to boot a kernel. the legacy uboot on the box is a 2014 one, so even older than the already historical 2015 ones from amlogic boxes :) ... the bad thing about it is that you cannot interrupt its boot via keyboard early on, so no way to explore if it can be used to boot a mainline kernel.

 

anyone having any idea how to add the proper dram setup to uboot (i guess its not part of the dtb as for rockchip devices) or how to extract maybe a sdcard uboot from a stock firmware image (like it can be done for amlogic boxes)?

 

best wishes - hexdump

Share this post


Link to post
Share on other sites
15 hours ago, jernej said:

That's expected because Tanix TX6 uses DDR3 memory which is not supported yet by U-Boot. All currently supported boards use LPDDR3. Anyone wants to do some low level hacking? :) I would, but I don't have such board. Previous unsuccessful attempt can be found here: https://github.com/apritzel/u-boot/commits/eachlink-h6-mini-WIP

It's only a matter of fixing this up.

I have a TX6 sample but no UART on it. If you give me the necessary files (images) and steps to perform, I can run the tests. :)

Share this post


Link to post
Share on other sites
5 hours ago, balbes150 said:

If you give me the necessary files (images) and steps to perform, I can run the tests.

Thanks, but I haven't any files. Somebody with a board and will to write/debug DRAM driver has to do it.

Share this post


Link to post
Share on other sites

what exactly would be required to be done (for someone who never did any dram driver development)? i looked at the commits in the git repo you mentioned and it looks like it contains tries to define the ram timing in the code but at some point it switched to getting the timing info from a binary blob. is that correct and do you know how far he got with either of the two approaches?

 

a lot of thanks in advance and best wishes - hexdump

Share this post


Link to post
Share on other sites
9 minutes ago, hexdump said:

what exactly would be required to be done (for someone who never did any dram driver development)?

My approach was (not in that order):

- disassemble DRAM blob from Allwinner

- compare disassembled code to existing code and minimize differences

- read documentation of similar controllers (some Zynq variants seems to have similar controller)

- read explanation of how DRAM actually works on the net

- compile SPL and U-Boot as 32-bit binary, which allows loading it through USB quickly (FEL boot)

- prepare SPL/U-Boot binary using libdram for later register comparison

- add a lot of debug prints in driver to see what is actually doing and compare values to those from libdram

 

I didn't wrote it from scratch, so this is similar situation.

 

Since testing and comparing is everything, I can only help with reverse engineering libdram and comparing existing code to that. One person already accepted the challenge on LibreELEC forum for writing this driver (also Tanix TX6 box), but it's always nice to have bigger team working on this.

Share this post


Link to post
Share on other sites
32 minutes ago, hexdump said:

oh - that sounds quite complicated :)

yeah, DRAM drivers usually nobody wants to write due to that. And that driver is also responsible for stability of whole system.

 

34 minutes ago, hexdump said:

would btw. also something like https://github.com/armbian/build/blob/master/config/sources/rockchip.conf#L68-L71 possible where @jock used the existing binary spl for the memory initialization and then combined it with mainline uboot on the xt-q8l-v10 rockchip tv box?

 

You can achieve something similar with using libdram as it is done in commit you noticed. However, it has at least two downsides. As commit message says, it's legally non-redistributable, because you mixing GPL code (SPL) and closed source code (libdram) in single binary. Second downside is that libdram is 32-bit, which complicates compiling SPL and other parts. You would need two different configuration files and combine everything by hand.

 

I don't think using BSP SPL as a whole is possible with mainline U-Boot.

Share this post


Link to post
Share on other sites

ok - i gave it a try and compile the u-boot from the repo and the branch you mentioned - looks like this is how far we get so far:

Quote

U-Boot SPL 2018.11-g458f795e53 (Jun 06 2019 - 17:37:48 +0200)
DRAM:

:) ... so looks like its maybe not happy with the dram config - how to proceed from here?

 

i also gave it a try to boot via the spl from the box, but looks like it cannot properly initialize the sd-card, so no chance to see if it will boot the mainline uboot in the end:

Quote

[308]HELLO! BOOT0 is starting!
[312]boot0 commit : 8
[326]set pll start
[329]set pll end
[331]rtc[0] value = 0x00000000
[334]rtc[1] value = 0x00000000
[337]rtc[2] value = 0x00000000
[340]rtc[3] value = 0x00000000
[343]rtc[4] value = 0x00000000
[346]rtc[5] value = 0x00000000
[349]DRAM VERSION IS V2_761
[352]DRAM CLK =672 MHZ
[354]DRAM Type =3 (3:DDR3,4:DDR4,6:LPDDR2,7:LPDDR3)
[359]DRAM zq value: 003b3bfb
[663]IPRD=00780078--PGCR0=00000f7d--PLL=b0003700
[668]para1 = 0000310b,para2 = 0c000000
[678]DRAM simple test OK.
[682]card no is 0
[683]sdcard 0 line count 4
[686][mmc]: mmc driver ver 2017-10-19 10:34:00
[691][mmc]: sdc0 spd mode error, 2
[694][mmc]: mmc 0 bias 00000004
[702][mmc]: ***Try MMC card 0***
[710][mmc]: mmc 0 cmd 1 timeout, err 00000100
[714][mmc]: mmc 0 cmd 1 err 00000100
[718][mmc]: mmc 0 send op cond failed
[722][mmc]: MMC card 0 Card did not respond to voltage select!
[728][mmc]: ***SD/MMC 0 init error!!!***
[732][mmc]: mmc 0 register failed
[735]Loading boot-pkg fail(error=2)
[739]Ready to disable icache.

any idea what could be done about this? @balbes150 - can you maybe dump the spl of your tanix box (first 40kb = 8k empty plus 32k spl i think ... but maybe the few first mb would be nice too, to see if your u-boot is maybe better than mine, as mine does not allow to interrupt the boot)

 

best wishes - hexdump

Share this post


Link to post
Share on other sites

a little update to my last post: i also tried the libdram version to see if i can get a little success story and it looks quite promising (but is ugly of course as its non redistributable, requires compiling on arm32, uses a binary blob):

Quote

U-Boot SPL 2018.11-g458f795e53-dirty (Jun 06 2019 - 18:37:37 +0200)
DRAM:DRAM VERSION IS V2_2
DRAM CLK =840 MHZ
DRAM Type =3 (3:DDR3,4:DDR4,6:LPDDR2,7:LPDDR3)
DRAM zq value: 3b3bfb
IPRD=5d005c--PGCR0=f7d--PLL=b0004500
DRAM SIZE =2048 M
DRAM simple test OK.
 2048 MiB
Trying to boot from MMC1


U-Boot 2018.11-g458f795e53-dirty (Jun 06 2019 - 18:37:37 +0200) Allwinner Technology

CPU:   Allwinner H6 (SUN50I)
Model: Eachlink H6 Mini
DRAM:  2 GiB
MMC:   SUNXI SD/MMC: 0, SUNXI SD/MMC: 1
Loading Environment from FAT... Unable to use mmc 1:1... In:    serial@5000000
Out:   serial@5000000
Err:   serial@5000000
Net:   No ethernet found.
starting USB...
No controllers found
Hit any key to stop autoboot:  0
switch to partitions #0, OK
mmc0 is current device
Scanning mmc 0:1...
switch to partitions #0, OK
mmc1(part 0) is current device
** Unrecognized filesystem type **
starting USB...
No controllers found
USB is stopped. Please issue 'usb start' first.
starting USB...
No controllers found
No ethernet found.
missing environment variable: pxeuuid
missing environment variable: bootfile
Retrieving file: pxelinux.cfg/00000000
No ethernet found.

:)

 

in short how to do it:

- get https://github.com/apritzel/u-boot.git

- checkout eachlink-h6-mini-WIP

- apply

Quote

diff --git a/arch/arm/mach-sunxi/spl_switch.c b/arch/arm/mach-sunxi/spl_switch.c
index 9ae3825841..912a523ce6 100644
--- a/arch/arm/mach-sunxi/spl_switch.c
+++ b/arch/arm/mach-sunxi/spl_switch.c
@@ -52,7 +52,8 @@ void __noreturn jump_to_image_no_args(struct spl_image_info *spl_image)
                jump_to_image_native(spl_image);
        } else {
                debug("entering by RMR switch\n");
-               writel(spl_image->entry_point, CONFIG_SUNXI_RVBAR_ADDRESS);
+               writel(spl_image->entry_point, 0x09010040);
+/*             writel(spl_image->entry_point, CONFIG_SUNXI_RVBAR_ADDRESS); */
                DSB;
                ISB;
                reset_rmr_switch();

- get http://files.pine64.org/os/sdk/H64-ver1.0/H6-BSP-1.0.tgz (via: https://wiki.pine64.org/index.php/PINE_H64_Main_Page#Linux_BSP_SDK)

- extract lichee/tools/pack/chips/sun50iw6p1/bin/bl31.bin and lichee/bootloader/uboot_2014_sunxi_spl/sunxi_spl/dram/sun50iw6p1/dram/libdram from it

- put both into the root of the git tree (libdram as libdram-h6)

- make eachlink_h6_mini_libdram_spl_defconfig

- make (important: this needs to run on a 32bit arm system - not 64bit)

- dd if=u-boot-sunxi-with-spl.bin of=/dev/sdX bs=1024 seek=8

Share this post


Link to post
Share on other sites

update: things are more complex :)

 

the uboot with libdram did work, but it was running completely in 32bit mode, had just a 32bit uboot and was thus only be able to boot 32bit kernels, which is not what we want to achieve. so i now build uboot with "make eachlink_h6_mini_defconfig" on an arm64 machine and built one with "make eachlink_h6_mini_libdram_spl_defconfig" on a arm32 machine (plus the patch from above). then i copied the resulting file spl/sunxi-spl.bin as sunxi-spl.bin-arm32 from the arm32 to the arm64 machine and created a bootable sd-card with the command (on the arm64 machine):

cat sunxi-spl.bin-arm32 u-boot.img u-boot.dtb | dd of=/dev/sdX bs=1024 seek=8

i actually first wrote a pine-h64 (or orange pi 3) nightly image from https://dl.armbian.com/pineh64/nightly/ before i did the dd command from above - this way i had some test kernel to play around with around on the sd card as well. booting this one now results in:

 

U-Boot SPL 2018.11-g458f795e53-dirty (Jun 06 2019 - 18:37:37 +0200)
DRAM:DRAM VERSION IS V2_2
DRAM CLK =840 MHZ
DRAM Type =3 (3:DDR3,4:DDR4,6:LPDDR2,7:LPDDR3)
DRAM zq value: 3b3bfb
IPRD=5c005b--PGCR0=f7d--PLL=b0004500
DRAM SIZE =2048 M
DRAM simple test OK.
 2048 MiB
Trying to boot from MMC1


U-Boot 2018.11-g458f795e53 (Jun 07 2019 - 23:12:25 +0200) Allwinner Technology

CPU:   Allwinner H6 (SUN50I)
Model: Eachlink H6 Mini
DRAM:  2 GiB
MMC:   SUNXI SD/MMC: 0, SUNXI SD/MMC: 1
Loading Environment from FAT... Unable to use mmc 1:1... In:    serial@5000000
Out:   serial@5000000
Err:   serial@5000000
Net:   No ethernet found.
starting USB...
No controllers found
Hit any key to stop autoboot:  0 
switch to partitions #0, OK
mmc0 is current device
Scanning mmc 0:1...
Found U-Boot script /boot/boot.scr
831 bytes read in 35 ms (22.5 KiB/s)
## Executing script at 4fc00000
5586861 bytes read in 605 ms (8.8 MiB/s)
27263 bytes read in 70 ms (379.9 KiB/s)
14704648 bytes read in 1526 ms (9.2 MiB/s)
## Loading init Ramdisk from Legacy Image at 43300000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)
   Data Size:    5586797 Bytes = 5.3 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 43000000
   Booting using the fdt blob at 0x43000000
   Loading Ramdisk to 49aac000, end 49ffff6d ... OK
   Loading Device Tree to 0000000049aa2000, end 0000000049aaba7e ... OK

Starting kernel ...

using this /boot/boot.cmd file (converted to its corresponding /boot/boot.scr file as described in the last line):

setenv bootargs "console=ttyS0,115200n8 no_console_suspend consoleblank=0 root=UUID=056b7f6b-ee6f-4089-8dde-fad454515b02 rootwait ro fsck.fix=yes fsck.repair=yes net.ifnames=0 ipv6.disable=1"
ext2load mmc 0 0x43300000 boot/uInitrd-5.1.3-sunxi64
#ext2load mmc 0 0x43000000 boot/dtb-5.1.3-sunxi64/allwinner/sun50i-h6-orangepi-3.dtb
#ext2load mmc 0 0x43000000 boot/dtb-5.1.3-sunxi64/allwinner/sun50i-h6-orangepi-lite2.dtb
#ext2load mmc 0 0x43000000 boot/dtb-5.1.3-sunxi64/allwinner/sun50i-h6-orangepi-one-plus.dtb
ext2load mmc 0 0x43000000 boot/dtb-5.1.3-sunxi64/allwinner/sun50i-h6-pine-h64.dtb
ext2load mmc 0 0x42000000 boot/vmlinuz-5.1.3-sunxi64
booti 0x42000000 0x43300000 0x43000000
# Recompile with:
# mkimage -C none -A arm -T script -d boot.cmd boot.scr

this means that the kernel crashed even before it was able to setup the serial console or that somehow it cannot speak to it i guess. i think at least this should somehow work even with the wrong dtb (looks like i'll have to model some proper dtb for that box based on one of the existing mainline h6 dtbs and the information from the android dtb of the box at some point).

 

@jernej - is there anything like earlyprintk for the allwinner h6?

 

best wishes - hexdump

Share this post


Link to post
Share on other sites
2 hours ago, hexdump said:

 

@jernej - is there anything like earlyprintk for the allwinner h6?

 

might give the 8250 UART driver a try? At least mt7623 got really talky once it was configured properly.

Share this post


Link to post
Share on other sites
7 hours ago, hexdump said:

cat sunxi-spl.bin-arm32 u-boot.img u-boot.dtb | dd of=/dev/sdX bs=1024 seek=8

Note that you are missing ATF binary, so Linux won't boot.

 

7 hours ago, hexdump said:

is there anything like earlyprintk for the allwinner h6?

of course, earlyprintk works everywhere if  UART driver driver is available.

Share this post


Link to post
Share on other sites
On 6/6/2019 at 6:58 PM, hexdump said:

any idea what could be done about this? @balbes150 - can you maybe dump the spl of your tanix box (first 40kb = 8k empty plus 32k spl i think ... but maybe the few first mb would be nice too, to see if your u-boot is maybe better than mine, as mine does not allow to interrupt the boot)

My device is not running UART, so I can't check the startup log or abort the startup. I can only get into Android. If you write steps in Android, I can try to download the necessary data (to dump the necessary objects).

 

 

 

 

Share this post


Link to post
Share on other sites

@chwe @jernej - is the allwinner h6 using a 8250 uart and if yes, how to configure it properly like you mentioned above?

 

@jernej - i think i included the atf binary - i'm using the bl31.bin from the h6 bsp (see above) - is there anything else required? at least the uboot build did not complain about anything else (about bl31.bin it complained before). i btw. added earlyprintk, but this does not really change anything. are there any other simpler boot tests i might try, like trying to chainload u-boot.bin to itself to see if uboot can at least execute any 64bit stuff properly?

 

@balbes150 - in case you want to get the serial console working on your tx6, this (and earler posts there): https://forum.libreelec.tv/thread/17565-nightly-images-for-a64-h3-and-h6-boards/?postID=120706#post120706 might help you - in android you might simply install a terminal app, then su to root (assuming the the box is rooted like most of the tv boxes) and do a "dd if=/dev/mmcblk0 of=mmcblk0-start.dd= bs=1024k count=4" - this should dump the first 4mb of the emmc into a file  and should be enough to catch the spl and uboot i guess - this assumes that mmcblk0 is you emmc.

 

best wishes and a lot of thanks in advance - hexdump

Share this post


Link to post
Share on other sites
16 minutes ago, hexdump said:

i think i included the atf binary - i'm using the bl31.bin from the h6 bsp (see above) - is there anything else required? at least the uboot build did not complain about anything else (about bl31.bin it complained before).

In case of Allwinner port of U-Boot, ATF (bl31.bin) gets packaged into itb file (u-boot.itb), along with U-Boot proper (u-boot.bin) and dtb file. You should just combine sunxi-spl.bin-arm32 (make sure is padded to 32K or 24K, I'm not sure ATM) and u-boot.itb.

 

BTW, I'm not sure if mainline Linux works with BSP ATF binary. Just compile latest official ATF release (mainline H6 ATF is not board specific, so it should work).

 

25 minutes ago, hexdump said:

btw. added earlyprintk, but this does not really change anything. are there any other simpler boot tests i might try, like trying to chainload u-boot.bin to itself to see if uboot can at least execute any 64bit stuff properly? 

Not sure, I don't use earlyprintk. If it's not CPU mode issue (Linux expects that it's already in 64-bit mode) it may be DT issue.

 

Anyway, I wouldn't bother with Linux at this stage. Fixing mainline DDR3 DRAM driver would help a lot with other issues.

Share this post


Link to post
Share on other sites

another update: meanwhile i have the box kind of booting using the libdram blob based uboot (so not redistributable), but still there is quite a bit left to be done to get it to some useful level. no progress so far on an open source dram config for ddr3 ram on h6 boxes. for more info see the github issue from the last post and this thread here: https://forum.libreelec.tv/thread/17636-tanix-tx6/?pageNo=1 ...

 

best wishes - hexdump

Share this post


Link to post
Share on other sites
0