Armbian for H313 X96-Q LPDDR3 TV-Box

[Nick A]

Your tv stick probably has secure boot enabled. You can compile a secure boot image using these steps.

 

 

[Randlin]

Nice! I'll try that. Thank you for your help so far. Finding the right documentation has been a little tricky for me and I really appreciate the help.

[Randlin]

Alright, I built the x96q-lpddr3 image using the patches suggested. It booted (partially). Nothing on the screen, but it is starting!
I chose that image because it is H313 and lpddr3 (the android uboot build that worked before detected it as such)
I attached the serial log. It's getting late here and I may not get much more done on this until Monday, but this is a good sign in my opinion.

uboot.txt

[Nick A]

H313/H616/H618 are pretty much the same SOC. It’s the AXP power management IC that’s different. Also RAM and WIFi chips are usually different.

 

https://linux-sunxi.org/AXP_PMICs

Edited Saturday at 12:08 AM by Nick A

[Randlin]

Cool, good to know. I'll try one with the same AXP and go from there.

[Randlin]

Hmm, according to the config, the X96q lpddr3 uses the AXP313 already. Maybe ram is wrong? Pretty sure it's lpddr3, if there is any way to check that, I can. Gonna do a little digging in android.

[Randlin]

According to Android uboot, DRAM_VCC= 1200mv
DRAM CLK =648 MHZ
DRAM TYPE=7 (lpddr3)
DRAM SIZE =1536 MBytes, para1 = 30fa, para2 = 6001000, dram_tpr13 = 26061
gonna try some of this in the x96q image, see what happens
 

[Randlin]

Hmm, in boot log I see AXP1530 mentioned in theandroid boot (booted off the sd card, not emmc). I attached the log.

bootinfo.txt

[Randlin]

I set the dram speed to 648, no difference. Gotta be the axp or another option.

[Nick A]

AXP1530 is the same as AXP313a. Take a look at the link I posted above. 
 

You could use this tool to extract your dram settings from an android update or boot0.bin. 
https://github.com/apritzel/sunxi-fw

 

sunxi-fw info -v boot0.bin

Edited Monday at 09:37 PM by Nick A

[Randlin]

Will do

[Randlin]

uboot-config-dump.txt Here it is

[Randlin]

I did notice in the log:
INFO:    PMIC: Probing AXP305 on RSB
ERROR:   RSB: set run-time address: 0x10003
INFO:    Could not init RSB: -65539

[Randlin]

Wait, that was the Linux kernel, not uboot. I'll get that

[Randlin]

/sunxi-fw info -v fulldisk.img 
@     0: mbr: DOS MBR
    protective MBR, GPT used
    GPT version 00010000
    usable disk size: 7419 MB
    number of partition entries: 17
@   16: toc0: signed boot image
    2 items
    size: 98304 bytes
@ 321: toc0: signed boot image
    2 items
    size: 98304 bytes
@26812: fit: U-Boot FIT image
    fit:__overlay__: "<no description>"
    fit:__overlay__: "<no description>"
    fit:fragment@2: "<no description>"

So I never dumped just boot0  (and no firmware update available), but I have full emmc dump named fulldisk.img.
I would assume it is the toc0?
Trying to extract does not work , however: (maybe because there are two?)

/sunxi-fw extract -v -n toc0 -o uboot0 /home/Tr/fulldisk.img 
unknown image file

extracting the mbr works fine though.

[Nick A]

This post should help extracting your boot.img from android. That’s if your box is already rooted.

[Randlin]

Oh, so it is the devicetree of Linux we want. My bad. Here it is: devicetree.txt
FYI I was able to use binwalk -e on the boot partition dump, nice to see there is another way. Thanks for all the help

Edited Monday at 10:29 PM by Randlin

[Nick A]

Actually in that post it was about downloading the boot_a partition. Then extracting the dts.. you can skip the dts extraction part for now. We need your boot_a partition.

 

also that’s not the android dts you posted. It has some info but not all of it.

Edited yesterday at 12:47 AM by Nick A

[Randlin]

Hmm, I used a different boot.img extractor before to try to get dts, but that spectacularly failed ( https://github.com/anestisb/android-unpackbootimg ). I do have a dump of each of the partitions from root, but there was no boot_a boot_b, just boot (not an a/b system). I'll try that extractor, hopefully that will be better.

everthing is here: https://archive.org/download/G96_Firmware_Dump/Dumped Partitions/
list of partitions dumped: (there are 17 listed in the emmc, but 18 in android for some reason, probably one is a duplicate)

Reserve

boot

bootloader

cache

empty

env

frp

media_data

metadata

misc

mmcblk0boot0

mmcblk0boot1

private

recovery

super

vbmeta

vbmeta_system

vbmeta_vendor

Edited 23 hours ago by Randlin

[Randlin]

direct link to boot: https://archive.org/download/G96_Firmware_Dump/Dumped Partitions/boot

[Randlin]

Ok, that extractor worked. I uploaded it as a zip here: https://uploadnow.io/f/9VvPT91

[Randlin]

And just the dts dtb.0.dts.txt

[Nick A]

Have you tried running sunxi-fw with the boot image you used to extract the dts? The boot image you posted is a U-Boot FIT image. It doesn't have the dram information we are looking for. I believe mmcblk0boot0 is the correct boot image but the one you uploaded didn't work with sunxi-fw. 

 

Also, I found this in your dts. Maybe these settings will work. To make sure these settings are correct I prefer to get the dram settings using the sunxi-fw tool.

 

	dram {
		compatible = "allwinner,dram";
		clocks = <0xda>;
		clock-names = "pll_ddr";
		dram_clk = <0x288>;
		dram_type = <0x07>;
		dram_zq = <0x3f3fdd>;
		dram_odt_en = <0x9988eeee>;
		dram_para1 = <0x30fa>;
		dram_para2 = <0x1000>;
		dram_mr0 = <0x00>;
		dram_mr1 = <0xc3>;
		dram_mr2 = <0x06>;
		dram_mr3 = <0x01>;
		dram_tpr0 = <0x00>;
		dram_tpr1 = <0x00>;
		dram_tpr2 = <0x00>;
		dram_tpr3 = <0x00>;
		dram_tpr4 = <0x00>;
		dram_tpr5 = <0x00>;
		dram_tpr6 = <0x2fc08080>;
		dram_tpr7 = <0x00>;
		dram_tpr8 = <0x00>;
		dram_tpr9 = <0x00>;
		dram_tpr10 = <0x402f3379>;
		dram_tpr11 = <0xd100b0f>;
		dram_tpr12 = <0x11131113>;
		dram_tpr13 = <0x80060>;
		linux,phandle = <0x183>;
		phandle = <0x183>;
		device_type = "dram";
		dram_dx_odt = <0x6060606>;
		dram_dx_dri = <0xd0d0d0d>;
		dram_ca_dri = <0x1919>;
		dram_mr4 = <0x00>;
		dram_mr5 = <0x00>;
		dram_mr6 = <0x00>;
		dram_mr11 = <0x00>;
		dram_mr12 = <0x00>;
		dram_mr13 = <0x00>;
		dram_mr14 = <0x00>;
		dram_mr16 = <0x00>;
		dram_mr17 = <0x00>;
		dram_mr22 = <0x00>;
	};

The dram clock is in hex you'll need to convert this value to decimal. https://www.rapidtables.com/convert/number/hex-to-decimal.html

Edited 11 hours ago by Nick A