Jump to content

Unbrick Rockchip RK3288

sum1saw

By sum1saw
in Rockchip CPU Boxes

 Share

Recommended Posts

sum1saw

sum1saw

Posted
Posted

Hi Folks,

 

I know this is not the right place to ask for help as I'm not using Armbian Device. 

My device is Rockchip RK3288, it was working fine until I decided to do an OS upgrade. Accidentally ROM didn't install correctly and now the device is nearly bricked.

 

I'm searching the web for the past 2 months to try any method which can help me to return the board to a working state. This forum is the active which I came across.

 

The issue I tried to Install a new untested ROM over a working ROM and the device isn't booting UP, whenever I'm trying to boot nothing happens also RK Android Tool isn't able to detect the device. The issue is pretty big as I'm left with more than 20 unused boards.

 

Could you please suggest how to enter eMMC or EDL mode? Attaching a Snap of my Board.

 

What I've done till now, I tried to Short the NAND (not sure if that is correct), still no effect on red led light, checked via lsusb if booting, device isn't recognized there also, tried copying Multitool Img & Working ROM in SD card still no use.

 

@jock Sorry for Looping but you gave me little stating rockchip devices can't be bricked.

 

AL9nZEWT0goCUGl4l8JDaqNhltjIFZs675wanz9C AL9nZEU7NBnkF1L47E_CWXLyoQ89uJvB1jFvCm0h

Link to comment
Share on other sites
jock

jock

Posted
Posted

Hello @sum1saw if you wrote the wrong firmware on emmc, surely you should be able to enter maskrom mode shorting the clock emmc pin; it is not exactly uneasy to do, especially if you don't have comfy access to the board, but if you can disassemble and clean the device it would be much better to handle.

 

When the emmc pin is shorted, to SOC will look for a loader on the sdcard and, if not found, will put itself in maskrom mode accepting a connection ONLY from the USB OTG port. There is only one singel USB OTG port on rk3288 and hopefully it is exposed on your board, but may be that your board does not expose it at all, or sometimes it is exposed as a mini/micro USB port instead of a regular A-type. Sometimes also there is an "OTG" marking nearby the port on the PCB.

 

I don't know if the multitool is able to boot on your particular board, it has not been tested so broadly on rk3288 devices and the ideal troubleshooting equipment here is a serial adapter to understand the current status: it may be that the firmware you put on boots but then the SOC completely freezes for some reason, or the firmware does not boot at all. In the first case you are forced to short the clock pin of emmc. I can't spot serial pads/pins on your board, but they may be hidden somewhere in those pin arrays I see all around. You should carefully inspect the board for RX/TX markings (or sometimes there is a "DEBUG" label).

 

The maskrom mode usually only requires that you plug a male-to-male USB cable inside the USB OTG port on a side and the other side in your PC. Usually the PC will feed the board without the need to give separate power and in this case you absolutely do not need to feed the board with its power adapter. There are other cases where the power adapter need to be connected, so you should do experiments by yourself. In case the firmware is completely bad so that the SOC does not find a valid loader, it should put itself in maskrom mode even without shorting the pin ;in this case it is a matter of finding which port is the OTG one and you should be immediately find the device on the PC.

If the SOC is freeezed due to a bad loader, then you won't get into maskrom mode if you don't short the clock pin of the emmc WHILE you power the board (either with its power adapter or the male-to-male cable).

 

Going with sdcard is a bit more complicated, just because I don't know if the original firmware is able to boot from sdcard. You could try the multitool, but if it does not work you can't know if the problem is the multitool or the clock pin you're shorting is the wrong one and without a USB-to-ttl serial adapter thet tells you the outcome of the experiments you will be totally blind.

Link to comment
Share on other sites
ais

ais

Posted
Posted

Hi @jock

 

Thanks for response. I'm sum1saw colleague, He wouldn't be available till late

 

1. We tried to Short the pin with my guess but didn't work (no device found)

2. We found OTG port which is USB A to USB B (no device found)

3. We Also attached one more cable USB A to USB A to another port and press Volume + button while plugging the power source this time Power is been supplied by PC but still no device found.

 

Please refer to Snap I marked the Pins which I tried to short (I'm unable to remove the board)

 

1136806704_Screenshot2022-12-30104107.thumb.jpg.5146f580510dae208766c3f0b930833d.jpg

 

1672386149_Screenshot2022-12-30105921.thumb.jpg.02a4f14f8a4484a7f7c0f8d10be628f0.jpg

 

97638040_Screenshot2022-12-30105932.thumb.jpg.5f318c6e49d29cea844a9b3a3331ad4c.jpg

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted

Hi @jock

 

Just a little bit help, Can you guide which could be pin that needed to be short 7-8 or 8-9 apart form that. How to use usb to ttl cable any guide for that.

 

CjQTLSPRRJC4N7jN3Z9zgQ.jpg

 

Red circle are the ports which i tried to short as they are exact under eMMC drive.

o-8hO_UzTZiEi786IfrU8Q.jpg

Link to comment
Share on other sites
jock

jock

Posted
Posted

@sum1saw @ais From the back of the board I see a very nice "debug" label with three pins nearby (GND, TX and RX).

You should attach the USB to TTL adapter connectors there (TX of the board to RX of the adapter, RX of the board to TX of adapter, GND from board to GND of adapter). Then you should be able to use any terminal emulator (like Putty on windows, minicom, picocom, or whatever on linux). Speed is usually 115000bps for rk3288.

If you're lucky you get something on the serial port.

 

About shorting the eMMC clock pins, usually the 7th pin is the clock one, but the orientation of the chip may vary, so you should also try the pins from the other side.

The pads nearby the emmc often are connected to the clock pin and they are useful during board development as "test points" for engineering to quickly check if clock is present. In turn, try to short one pad to ground and give power. Is is important that you give power while the pad is still shorted to ground, then release one second after you power the board. Ideally even the eMMC clock pin should be shorted to ground, but it is not as easy to do as it is with the pads.

For the pads you press a needle over them connected to a ground point of the board, ie: the ethernet/hdmi chassis, or the mounting holes with the copper around them.

 

Ah, I also see that the board has an act8846 PMIC, so the board may require to be turned on with a power key instead of directly giving power with the power cable. That's because the PMIC is turning on and off the SOC.

Also try with the male to male cable to plug it into the USB OTG port without power cable connected. If the board turns on, then you should not need to push the power button but you can plug the USB cable while you short the pin/pad.

Link to comment
Share on other sites
jock

jock

Posted
Posted

@umiddelb true, the serial speed is configurable but newer SOCs than rk3288 have their default set to 1.5mbps, rk3288 and older socs have their default set to 115kbps. At last, it totally depends upon the ddrbin/loader software because the SOC does not talk on the serial by itself.

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

Hi Jock,,

 

Thanks for the help. So current update is I don't have TTL cable and I ordered one till that one is arriving. I tried some more steps as you suggested

 

I tried to ground the Pin from Front along with Volume button which I think also acting as Power or else I need to assemble complete board. Also I've one doubt as you suggested there might be direct pin for quick test, there Is a pin named CLK under TTL UART are those same?

 

Also I'm testing multiple pin will that increase chance of board damage.

 

IMG20221231215805.thumb.jpg.c0f54c5b6c9ad49dcc242cf9194c1a12.jpg

Edited by sum1saw
Addition
Link to comment
Share on other sites
jock

jock

Posted
Posted

@sum1saw The chances that the pointed CLK pin is the right one are near to zero, I can exclude that one is the clock pin you're looking for.

 

I was referring to the pads I circled in green in the attached image, and only to those ones! Don't go blind shorting pins randomly, or you will surely damage something. Feeding a bad voltage to the wrong device can easily damage it.

 

Also I see another "PWRON" label which is probably the power on button. Probably you need to briefly short that pin to 3.3V or 5V depending on which one is available during the board "stand by" to give power to the system. I don't think "volume up" is of any use in this case.

 

 

 

Untitled.jpg

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

HI @jock

 

I've Some news don't know if bad or good.

 

But I was able to go in debug mode, here is output. I tried flashing Multitool & Original OS on SD card but still stuck on "load from FDT".

  

DDR Version 1.00 20160530
In
Channel a: DDR3 200MHz
Bus Width=32 Col=10 Bank=8 Row=15 CS=1 Die Bus-Width=16 Size=1024MB
Channel b: DDR3 200MHz
Bus Width=32 Col=10 Bank=8 Row=15 CS=1 Die Bus-Width=16 Size=1024MB
Memory OK
Memory OK
OUT


U-Boot 2014.10-RK3288-10 (Nov 29 2022 - 11:38:39)

CPU: rk3288
cpu version = 0
CPU's clock information:
    arm pll = 600000000HZ
    periph pll = 297000000HZ
    ddr pll = 200000000HZ
    codec pll = 384000000HZ
Board:  Rockchip platform Board
DRAM:  Found dram banks: 1
Adding bank:0000000000000000(0000000080000000)
128 MiB
GIC CPU mask = 0x00000001
SdmmcInit = 0 400
SdmmcInit = 2 0
storage init OK!
Using default environment

GetParam
Load FDT from resource image.
power key: bank-0 pin-5

 

Edited by sum1saw
addition
Link to comment
Share on other sites
jock

jock

Posted
Posted

@sum1saw Well that's definitely NOT in maskrom mode.

The device is booting, but then it gets stuck in u-boot for some reason. Also it looks like it is lacking the "miniloader" part, hence does not boot from sdcard, but it could easily be that u-boot gets stuck and does not go further.

 

IMHO you definitely need to short the emmc clock pin, either to get into maskrom mode or force the device to boot from sdcard.

 

The procedure:

1) remove power plug

2) insert power plug

3) put the screwdriver on the emmc contacts to short emmc pins or short the pad on the backside to GND

4) turn on the board (via power button)

5) unshort the emmc clock pin

6) you should not see anything on the serial; if you get any message from ddrbin/u-boot, then the board booted from eMMC, so start again from 1) and try another pair of contacts or the other pad on the backside

7) if you have the sdcard inserted, the board will probably boot from there, otherwise plug the USB male to male cable in the OTG port and into PC

😎 you should see the device in maskrom mode with lsusb tool within linux

9) use rkdeveloptool to restore the original firmware

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

@jock Thanks

 

The hardest part is to find clock pin :( I'm suck & stuck with that part.

 

For shorting could I join both the pins at back of board which you circled and then supply the power and press on button to check. Also after short if device go in maskrom mode then will reflect on Android Tool other wise if forced to boot from SD card will that be shown on serial port ?

 

Edit : Also Hard luck finding and data diagram online that would make emmc pin finding quest much easier

Edited by sum1saw
edit
Link to comment
Share on other sites
jock

jock

Posted
Posted
28 minutes ago, sum1saw said:

For shorting could I join both the pins at back of board which you circled and then supply the power and press on button to check. Also after short if device go in maskrom mode then will reflect on Android Tool other wise if forced to boot from SD card will that be shown on serial port ?

No, the pads on the back of the board must not be shorted together!

They must be shorted, in turn, to a ground point of the board, like the HDMI or ethernet metallic chassis.

 

The other part should be exactly like you describe: if there is no sdcard, the device goes in maskrom mode and it should appear automatically in Android Tool; instead if the sdcard is inserted, the soc will try to boot from there and, if a suitable image is found, the serial will tell you that the boot is happening.

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

ok some luck @jock

 

I was able to find the pin and short with ground one, but thing is till I'm pressing power it is showing Maskrom mode, and after 2-3 seconds no device no activity on UART port.

 

This output is when I'm again trying to run Serial Port. 

GetParam
check parameter success
Unknow param: MACHINE_MODEL:rk3288!
Unknow param: MACHINE_ID:007!
Unknow param: MANUFACTURER:RK3288!
Unknow param: PWR_HLD: 0,0,A,0,1!
failed to prepare fdt from boot!
power key: bank-0 pin-5
can't find dts node for ricoh619

 

I Tried to upgrade fw while Maskrom mode available 

image.png.f9fa60cf1cd5d4d5ca0cdfe69a0c8e8f.png

 

Serial Port when I initialized FW upgrade 

serial_init 0
ChipType = 8
SDC_BusRequest:  CMD=8 DATA BUSY  1615
SDC_BusRequest:  CMD=8 DATA BUSY  1615
SDC_BusRequest:  CMD=8 DATA BUSY  1615
SdmmcInit=0 400
...FlashInit enter...
FtlMallocOffset = 8040 8000
FtlMallocOffset = 10040 8000
FtlMallocOffset = 11040 1000
FtlMallocOffset = 19040 8000
FtlMallocOffset = 1a040 1000
1:0 0 7f7f05 22
...NandcInit enter...
0:1200 0 7f7f05 22
gNandcVer = 6
 SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
 emmc reinit
 SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
 emmc reinit
 SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=8  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=5  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=55  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
  SDC_BusRequest:  CMD=1  SDC_RESP_TIMEOUT 1784
 SdmmcInit=2 20
UsbHook 755562
powerOn 756950

 

 

Log from Android tool 

21:23:20 673	<LAYER 1-2> INFO:FlashInfo: 00 B0 3B 00 00 04 04 00 28 00 01
21:23:20 673	Layer<1-2>:Get FlashInfo Success
21:23:20 673	Layer<1-2>:Prepare IDB Start
21:23:20 689	<LAYER 1-2> INFO:CS(1)		(1910MB)		(SAMSUNG)
21:23:20 704	<LAYER 1-2> INFO:FindBackupBuffer-->No Found Tag
21:23:20 704	<LAYER 1-2> INFO:FindBackupBuffer-->No Found Tag
21:23:20 704	<LAYER 1-2> INFO:FindBackupBuffer-->No Found Tag
21:23:20 704	<LAYER 1-2> INFO:FindBackupBuffer-->No Found Tag
21:23:20 720	<LAYER 1-2> INFO:FindBackupBuffer-->No Found Tag

 

Another one  

21:27:34 173	Layer<1-2>:Download Boot Start
21:27:36 795	Layer<1-2>:Download Boot Success
21:27:36 795	Layer<1-2>:Wait For Maskrom Start
21:27:37 233	Layer<1-2>:Wait For Maskrom Success
21:27:37 233	Layer<1-2>:Test Device Start
21:27:37 233	Layer<1-2>:Test Device Success
21:27:37 248	Layer<1-2>:Check Chip Start
21:27:37 248	Layer<1-2>: Check Chip Success
21:27:37 248	Layer<1-2>:Get FlashInfo Start
21:27:37 264	<LAYER 1-2> INFO:FlashInfo: 00 00 00 00 00 04 04 00 28 00 00
21:27:37 264	Layer<1-2>:Get FlashInfo Success
21:27:37 264	Layer<1-2>:Prepare IDB Start
21:27:37 288	<LAYER 1-2> ERROR:PrepareIDB-->No Found 1st Flash CS
21:27:37 295	Error:Layer<1-2>:Prepare IDB Fail

 

Edited by sum1saw
Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted

Hi Again,

 

Correct if I'm wrong but after multiple failed attempts I suspect there might be issue with power on off as When i short the board it stays awake for 2-3 seconds and I've to keep button press same goes with serial mode.

 

Dunno but if I could bypass the power button circuit might be board be wake up and run fine.

 

Just a guess is it possible that power button has its own code which was wiped out when I updated wrong code.

 

Link to comment
Share on other sites
jock

jock

Posted
Posted

@sum1saw Very well, the fact that you found the emmc clock pin is a great advancement!

 

There is no issue with power with your board. The problem you are facing is one of the first great headaches I had when I was first dealing with these boards.

In practice when you give the signal to power on the board through the button, the ACT8846 PMIC receives a signal to turn on the board.  The ACT8846 then starts powering the SOC and the firmware boots.

The firmware then must raise a GPIO to tell the ACT8846 that the board has been really powered on and it has to hold the power on.

If the ACT8846 does not receive this feedback signal, it cuts the power.

 

If you keep the power button pressed, you can let the ACT8846 hold the power on for up to 10 seconds.

Another way hold the power on should be the presence of the OTG cable connected to PC and the board, or at least this happens on my board.

 

This message: 

Unknow param: PWR_HLD: 0,0,A,0,1!

 

tells that the firmware wants the GPIO (bank 0x0, GPIO pin 0xA) that needs to be turned on (1) to keep the power on, but somehow u-boot does not understand that parameter, does not raise the GPIO and then the ACT8846 shuts the whole thing down.

 

Now the problem you have with AndroidTool makes me think if you have the right firmware for your device and the right AndroidTool for your device... maybe you need an older version since the rk3288 is a bit old device?

Also try and see if you are able to Erase the flash from Android Tool while you're in maskrom mode: that won't brick your device, but will force the device to boot from sdcard or, if no sdcard is found, go in maskrom mode without having to short the emmc clock pin anymore. (some reference here)

 

I don't know if you also have a raw image of the good firmware, in such case you may also try to boot with the multitool sdcard inside the slot and try to burn the raw image directly from there.

Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

I think I'm making baby steps 

As suggested Flash is formatted device is showing as Maskrom when powering on.. & I was able to load the Bootloader bin which was with the original OS. Still trying to load firmware but device is still turning off.

Also there was some progress in Uboot. & Now out of know where Device was powered on and I was able to flash the original Firmware..

 

Thanks a lot @jock

Next Target how to upgrade old Android version to new one.

Edited by sum1saw
Link to comment
Share on other sites
sum1saw

sum1saw

Posted
  • Author
Posted (edited)

Many Thanks @jock, can you please suggest/point me in right direction how can create a working android rom for RK3288

 

Note For any Future Purpose,

1. Short the emmc pin

2. Used LINUX RKDEVELOPTOOL to clear the flash (if you have issue while installing RK Develop Tool Refer to this PR) => ./rkdeveloptool ef

3. Used RKDEVTOOL to clear the flash again 

4. Used LINUX UPGRADE TOOL to upload the working  u boot loader file ==> upgrade_tool ul ../RK3288Ubootxx.bin

4. Used ANDROIDFLASHTOOL to install the Firmware once bootloader is working fine and device is in Loader Mode.

image.png.9ae58706d344c7ee0dbe1234610682ee.png

 

Edited by sum1saw
1
Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing
×
×
  • Create New...

Important Information

Terms of Use - Privacy Policy - Guidelines

  I accept