Jump to content

S905X TV box bricked after installing to emmc

Pszemek

By Pszemek
in General Chat

 Share

Recommended Posts

Pszemek

Pszemek

Posted
Posted (edited)

Hi,

 

After running armbian-install on S905x device it stopped booting. USB Burning Tool doesn't recognize the device, nothing.

After connecting to UART it looks like install script has overwritten the original u-boot.

That's the boot log from UART connection without sd card:

  

GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 104174

BL2 Built : 11:58:42, May 27 2017.
gxl gc3c9a84 - xiaobo.gu@droid05

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0+1 @ 912MHz - PASS
Rank0: 1024MB(auto)-2T-13
Rank1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from eMMC, src: 0x00020200, des: 0x05100000, size: 0x00018400
Load bl33 from eMMC, src: 0x0003c200, des: 0x01000000, size: 0x000af000
NOTICE:  BL3-1: v1.0(release):3348978
NOTICE:  BL3-1: Built : 15:44:01, May 12 2017
[BL31]: GXL CPU setup!
mpu_config_enable:ok
[Image: gxl_v1.1.3221-2cfba69 2017-05-27 16:03:58 qiufang.dai@droid07]
OPS=0x82
8f bb f0 da ba 22 d2 cf 1 b0 31 f4 [0.359461 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast

<debug_uart>


U-Boot 2022.07-armbian (Nov 25 2023 - 12:50:42 +0000) libretech-cc

Model: Libre Computer AML-S905X-CC
SoC:   Amlogic Meson GXL (S905X) Revision 21:b (82:2)
DRAM:  2 GiB
Core:  169 devices, 27 uclasses, devicetree: separate
MMC:   mmc@72000: 0, mmc@74000: 1
Loading Environment from nowhere... OK
In:    serial
Out:   serial
Err:   serial
[BL31]: tee size: 0
[BL31]: tee size: 0
Net:   eth0: ethernet@c9410000
Hit any key to stop autoboot:  0
switch to partitions #0, OK
mmc1(part 0) is current device
Scanning mmc 1:1...
Found /boot/extlinux/extlinux.conf
Retrieving file: /boot/extlinux/extlinux.conf
1:      Armbian
Retrieving file: /uInitrd
** File not found /uInitrd **
Skipping Armbian for failure retrieving initrd
SCRIPT FAILED: continuing...
Found U-Boot script /boot/boot.scr
8147 bytes read in 1 ms (7.8 MiB/s)
## Executing script at 08000000
U-boot default fdtfile: amlogic/meson-gxl-s905x-libretech-cc.dtb
Current variant:
Current fdtfile after armbianEnv: amlogic/meson-gxl-s905x-libretech-cc.dtb
Mainline bootargs: root=/dev/mmcblk1p1 rootwait rootfstype=ext4 splash=verbose c                                                                                                                                     onsole=ttyAML0,115200 console=tty1 consoleblank=0 coherent_pool=2M loglevel=1 ub                                                                                                                                     ootpart=d27dbd06-01 libata.force=noncq usb-storage.quirks=    cgroup_enable=memo                                                                                                                                     ry swapaccount=1
22783841 bytes read in 500 ms (43.5 MiB/s)
27433472 bytes read in 601 ms (43.5 MiB/s)
40228 bytes read in 4 ms (9.6 MiB/s)
Failed to load '/boot/dtb/amlogic/overlay/-fixup.scr'
## Loading init Ramdisk from Legacy Image at 13000000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)
   Data Size:    22783777 Bytes = 21.7 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 04080000
   Booting using the fdt blob at 0x4080000
   Loading Ramdisk to 7a982000, end 7bf3c721 ... OK
   Loading Device Tree to 000000007a90f000, end 000000007a981fff ... OK
"Synchronous Abort" handler, esr 0x96000004
elr: 00000000010656ec lr : 0000000001055038 (reloc)
elr: 000000007dfb46ec lr : 000000007dfa4038
x0 : e14b4287a666c25d x1 : 000000007dfbc290
x2 : 0000000000000010 x3 : 000000007bf54e10
x4 : 0000000000000000 x5 : e14b4287a666c25d
x6 : 0000000001000000 x7 : 0000000000000000
x8 : 0000000000000007 x9 : 0000000000000000
x10: 0000000000000178 x11: 000000007bf40eec
x12: 00000000000000a4 x13: 000000007bf40ea8
x14: 000000007a90f000 x15: 0000000000000020
x16: 000000007df5946c x17: 0000000000000000
x18: 000000007bf4cdb0 x19: 000000007af41040
x20: 000000007df4fb18 x21: 000000007dfbc290
x22: 0000000000001000 x23: 000000007bf54d60
x24: 000000007dfdacb8 x25: 0000000001000000
x26: 0000000000000000 x27: 0000000001000000
x28: 0000000000001000 x29: 000000007bf40ea0

Code: eb04005f 54000061 52800000 14000006 (386468a3)
Resetting CPU ...

resetting ...
bl31 reboot reason: 0xd
bl31 reboot reason: 0x0
system cmd  1.

 

And with sd card

  

 GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 103545

BL2 Built : 11:58:42, May 27 2017.
gxl gc3c9a84 - xiaobo.gu@droid05

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0+1 @ 912MHz - PASS
Rank0: 1024MB(auto)-2T-13
Rank1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from eMMC, src: 0x00020200, des: 0x05100000, size: 0x00018400
Load bl33 from eMMC, src: 0x0003c200, des: 0x01000000, size: 0x000af000
NOTICE:  BL3-1: v1.0(release):3348978
NOTICE:  BL3-1: Built : 15:44:01, May 12 2017
[BL31]: GXL CPU setup!
mpu_config_enable:ok
[Image: gxl_v1.1.3221-2cfba69 2017-05-27 16:03:58 qiufang.dai@droid07]
OPS=0x82
8f bb f0 da ba 22 d2 cf 1 b0 31 f4 [0.358822 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast

<debug_uart>


U-Boot 2022.07-armbian (Nov 25 2023 - 12:50:42 +0000) libretech-cc

Model: Libre Computer AML-S905X-CC
SoC:   Amlogic Meson GXL (S905X) Revision 21:b (82:2)
DRAM:  2 GiB
Core:  169 devices, 27 uclasses, devicetree: separate
MMC:   mmc@72000: 0, mmc@74000: 1
Loading Environment from nowhere... OK
In:    serial
Out:   serial
Err:   serial
[BL31]: tee size: 0
[BL31]: tee size: 0
Net:   eth0: ethernet@c9410000
Hit any key to stop autoboot:  0
switch to partitions #0, OK
mmc0 is current device
Scanning mmc 0:1...
Found /extlinux/extlinux.conf
Retrieving file: /extlinux/extlinux.conf
1:      Armbian
Retrieving file: /uInitrd
Retrieving file: /Image
append: root=UUID=a6cf29bd-49ae-4d3b-bf22-800408ae1fba rootflags=data=writeback console=ttyAML0,115200n8 console=tty0 rw no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0 splash plymouth.ignore-serial-consoles
Retrieving file: /dtb/amlogic/meson-gxl-s905x-p212.dtb
Moving Image from 0x8080000 to 0x8200000, end=9cd0000
## Loading init Ramdisk from Legacy Image at 13000000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)
   Data Size:    22783777 Bytes = 21.7 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 08008000
   Booting using the fdt blob at 0x8008000
   Loading Ramdisk to 7a982000, end 7bf3c721 ... OK
   Loading Device Tree to 000000007a975000, end 000000007a98169c ... OK
"Synchronous Abort" handler, esr 0x96000004
elr: 00000000010656ec lr : 0000000001055038 (reloc)
elr: 000000007dfb46ec lr : 000000007dfa4038
x0 : e14b4287a666c25d x1 : 000000007dfbc290
x2 : 0000000000000010 x3 : 000000007bf54e10
x4 : 0000000000000000 x5 : e14b4287a666c25d
x6 : 0000000001000000 x7 : 0000000000000000
x8 : 0000000000000007 x9 : 0000000000000000
x10: 0000000000000188 x11: 000000007bf409ec
x12: 00000000000000b4 x13: 000000007bf409a8
x14: 000000007a975000 x15: 0000000000000020
x16: 000000007df7a768 x17: 0000000000000000
x18: 000000007bf4cdb0 x19: 000000007af41040
x20: 000000007df4fb18 x21: 000000007dfbc290
x22: 0000000000001000 x23: 000000007bf54d60
x24: 000000007dfdacb8 x25: 0000000001000000
x26: 0000000000000000 x27: 0000000001000000
x28: 0000000000001000 x29: 000000007bf409a0

Code: eb04005f 54000061 52800000 14000006 (386468a3)
Resetting CPU ...

resetting ...
bl31 reboot reason: 0xd
bl31 reboot reason: 0x0
system cmd  1.

 

Is there any way to restore original firmware?

Edited by Pszemek
0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

The instructions you are using are 4 years old.  No longer relevant.

 

1 hour ago, Pszemek said:

And then I just run armdroid-install and selected emmc boot

Wrong.  That does not work for the TV box builds. 

 

You need to be following the current instructions in the TV Box FAQ:

https://forum.armbian.com/topic/17106-installation-instructions-for-tv-boxes-with-amlogic-cpus

 

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

Based on the logs you posted, it is booting from SD when you have the SD card inserted.  I don't know why it is erroring in that way.  I would try a more recent image and see if that might work.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

Also, you mentioned armbian-install, but I'm assuming you meant armbian-config.  As there is no armbian-install. Unless you are using the ophub images which have a script called armbian-install, but they aren't armbian but a fork of armbian.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

Interesting.  I didn't know that existed.  It must be a wrapper for the functionality available through armbian-config (or vise-versa).  Either way the standard Armbian functionality doesn't work with the amlogic TV box builds and will not leave you with a working EMMC install.  That is why the amlogic TV box install instructions give the correct alternative.

 

Regardless of that, your logs show that you are booting from sd card.  And the state of your EMMC shouldn't cause the type of error you are seeing.  

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

So I guess getting back to your original question:

 

On 1/31/2024 at 4:56 PM, Pszemek said:

Is there any way to restore original firmware?

Did you make a backup of the EMMC before you overwrote it?

Do you have an original android firmware for your box?

Yes you can restore the box, but how you do that depends on what you are restoring from.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

The uboot has nothing to do with the Amlogic burning tool, the tool connects before uboot starts.  I have needed to try different versions of usb burning tool for different boxes.  Tried different usb ports (generally only one usb port will work with the tool), And sometimes need to press the reset button for different lengths of time to get it to register.

0
Link to comment
Share on other sites
Pszemek

Pszemek

Posted
  • Author
Posted (edited)

Are you sure? My box goes straight to u-boot, computer doesn't recognize any new device. Looks like it ignores the reset button completely

Looks like original uboot has commands like "update" and "sdc_burn" which would start update process,

Edited by Pszemek
0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

Yes as sure as I can be.  I have replaced u-boots on emmc and still been able to run usb burning tool to recover the android firmware.  But there are hundreds of different TV Boxes, so I can't speak for all, just the ones i have worked with.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted

How do you know the box is going straight to uboot?  When you are connecting usb burning tool from a pc, there are no other items connected to the box other than the male usb to male usb cable.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted
1 hour ago, SteeMan said:

I have needed to try different versions of usb burning tool for different boxes.  Tried different usb ports (generally only one usb port will work with the tool), And sometimes need to press the reset button for different lengths of time to get it to register.

Have you tried all of these things I have recommended?  What different versions of usb burning tool have you tried?

0
Link to comment
Share on other sites
Pszemek

Pszemek

Posted
  • Author
Posted

I did try both usb port and different Burning tool versions but it seems that the computer doesn't recognize any new devices so at this point the tools itself doesn't matter if there is no device connected.

0
Link to comment
Share on other sites
SteeMan

SteeMan

Posted
Posted
26 minutes ago, Pszemek said:

but it seems that the computer doesn't recognize any new devices

What do you mean by this?  You have the usb burning tool running when you plug the male usb to male usb cable into the tv box correct?  And also you are not connecting the tv box to power, but letting it be powered from the usb cable?

0
Link to comment
Share on other sites
Pszemek

Pszemek

Posted
  • Author
Posted

Nothing shows up in device manager. Even with incorrect version of burning tool when the box goes to correct mode there is a device visible in device manager.

Yes, only usb cable, no external power.

0
Link to comment
Share on other sites
Gunjan Gupta

Gunjan Gupta

Posted
Posted
6 hours ago, Pszemek said:

Looks like original uboot has commands like "update" and "sdc_burn" which would start update process,

Its possible I think. I have a s805x based tv stick lying around that also use to use uboot for burning tool. I had seen that by monitoring serial output while I plugged my device to the computer trying to connect it to burn tool. I guess it might be something that the OEMs can choose on how to implement. Mine was made by sdmctech. I don't have original firmware for it. I tried dumping its firmware, but the first few blocks always got dumped in some mangled/encrypted form so I never tried to hack it further.

0
Link to comment
Share on other sites
Pszemek

Pszemek

Posted
  • Author
Posted (edited)

I managed to fix the device

I downloaded u-boot.bin from that thread

Then I ran it from uart using 2 commands:

fatload mmc 0 0x01000000 u-boot.bin
go 0x01000000
 

With this u-boot version, the system booted up fine.

 

After that, I tried to overwrite the corrupted u-boot using dd command. I failed but actually, that broke uboot on emmc which allowed the device to enter usb download mode. From that, I was able to write original ROM using amlogic burning tool

Edited by Pszemek
1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
 Share
Go to topic listing
×
×
  • Create New...

Important Information

Terms of Use - Privacy Policy - Guidelines

  I accept