Armbian for H313 X96-Q LPDDR3 TV-Box

[Nick A]

Your tv stick probably has secure boot enabled. You can compile a secure boot image using these steps.

 

 

[Randlin]

Nice! I'll try that. Thank you for your help so far. Finding the right documentation has been a little tricky for me and I really appreciate the help.

[Randlin]

Alright, I built the x96q-lpddr3 image using the patches suggested. It booted (partially). Nothing on the screen, but it is starting!
I chose that image because it is H313 and lpddr3 (the android uboot build that worked before detected it as such)
I attached the serial log. It's getting late here and I may not get much more done on this until Monday, but this is a good sign in my opinion.

uboot.txt

[Nick A]

H313/H616/H618 are pretty much the same SOC. It’s the AXP power management IC that’s different. Also RAM and WIFi chips are usually different.

 

https://linux-sunxi.org/AXP_PMICs

Edited Saturday at 12:08 AM by Nick A

[Randlin]

Cool, good to know. I'll try one with the same AXP and go from there.

[Randlin]

Hmm, according to the config, the X96q lpddr3 uses the AXP313 already. Maybe ram is wrong? Pretty sure it's lpddr3, if there is any way to check that, I can. Gonna do a little digging in android.

[Randlin]

According to Android uboot, DRAM_VCC= 1200mv
DRAM CLK =648 MHZ
DRAM TYPE=7 (lpddr3)
DRAM SIZE =1536 MBytes, para1 = 30fa, para2 = 6001000, dram_tpr13 = 26061
gonna try some of this in the x96q image, see what happens
 

[Randlin]

Hmm, in boot log I see AXP1530 mentioned in theandroid boot (booted off the sd card, not emmc). I attached the log.

bootinfo.txt

[Randlin]

I set the dram speed to 648, no difference. Gotta be the axp or another option.

[Nick A]

AXP1530 is the same as AXP313a. Take a look at the link I posted above. 
 

You could use this tool to extract your dram settings from an android update or boot0.bin. 
https://github.com/apritzel/sunxi-fw

 

sunxi-fw info -v boot0.bin

Edited Monday at 09:37 PM by Nick A

[Randlin]

Will do

[Randlin]

uboot-config-dump.txt Here it is

[Randlin]

I did notice in the log:
INFO:    PMIC: Probing AXP305 on RSB
ERROR:   RSB: set run-time address: 0x10003
INFO:    Could not init RSB: -65539

[Randlin]

Wait, that was the Linux kernel, not uboot. I'll get that

[Randlin]

/sunxi-fw info -v fulldisk.img 
@     0: mbr: DOS MBR
    protective MBR, GPT used
    GPT version 00010000
    usable disk size: 7419 MB
    number of partition entries: 17
@   16: toc0: signed boot image
    2 items
    size: 98304 bytes
@ 321: toc0: signed boot image
    2 items
    size: 98304 bytes
@26812: fit: U-Boot FIT image
    fit:__overlay__: "<no description>"
    fit:__overlay__: "<no description>"
    fit:fragment@2: "<no description>"

So I never dumped just boot0  (and no firmware update available), but I have full emmc dump named fulldisk.img.
I would assume it is the toc0?
Trying to extract does not work , however: (maybe because there are two?)

/sunxi-fw extract -v -n toc0 -o uboot0 /home/Tr/fulldisk.img 
unknown image file

extracting the mbr works fine though.

[Nick A]

This post should help extracting your boot.img from android. That’s if your box is already rooted.

[Randlin]

Oh, so it is the devicetree of Linux we want. My bad. Here it is: devicetree.txt
FYI I was able to use binwalk -e on the boot partition dump, nice to see there is another way. Thanks for all the help

Edited Monday at 10:29 PM by Randlin

[Nick A]

Actually in that post it was about downloading the boot_a partition. Then extracting the dts.. you can skip the dts extraction part for now. We need your boot_a partition.

 

also that’s not the android dts you posted. It has some info but not all of it.

Edited Tuesday at 12:47 AM by Nick A

[Randlin]

Hmm, I used a different boot.img extractor before to try to get dts, but that spectacularly failed ( https://github.com/anestisb/android-unpackbootimg ). I do have a dump of each of the partitions from root, but there was no boot_a boot_b, just boot (not an a/b system). I'll try that extractor, hopefully that will be better.

everthing is here: https://archive.org/download/G96_Firmware_Dump/Dumped Partitions/
list of partitions dumped: (there are 17 listed in the emmc, but 18 in android for some reason, probably one is a duplicate)

Reserve

boot

bootloader

cache

empty

env

frp

media_data

metadata

misc

mmcblk0boot0

mmcblk0boot1

private

recovery

super

vbmeta

vbmeta_system

vbmeta_vendor

Edited Tuesday at 02:12 PM by Randlin

[Randlin]

direct link to boot: https://archive.org/download/G96_Firmware_Dump/Dumped Partitions/boot

[Randlin]

Ok, that extractor worked. I uploaded it as a zip here: https://uploadnow.io/f/9VvPT91

[Randlin]

And just the dts dtb.0.dts.txt

[Nick A]

Have you tried running sunxi-fw with the boot image you used to extract the dts? The boot image you posted is a U-Boot FIT image. It doesn't have the dram information we are looking for. I believe mmcblk0boot0 is the correct boot image but the one you uploaded didn't work with sunxi-fw. 

 

Also, I found this in your dts. Maybe these settings will work. To make sure these settings are correct I prefer to get the dram settings using the sunxi-fw tool.

 

	dram {
		compatible = "allwinner,dram";
		clocks = <0xda>;
		clock-names = "pll_ddr";
		dram_clk = <0x288>;
		dram_type = <0x07>;
		dram_zq = <0x3f3fdd>;
		dram_odt_en = <0x9988eeee>;
		dram_para1 = <0x30fa>;
		dram_para2 = <0x1000>;
		dram_mr0 = <0x00>;
		dram_mr1 = <0xc3>;
		dram_mr2 = <0x06>;
		dram_mr3 = <0x01>;
		dram_tpr0 = <0x00>;
		dram_tpr1 = <0x00>;
		dram_tpr2 = <0x00>;
		dram_tpr3 = <0x00>;
		dram_tpr4 = <0x00>;
		dram_tpr5 = <0x00>;
		dram_tpr6 = <0x2fc08080>;
		dram_tpr7 = <0x00>;
		dram_tpr8 = <0x00>;
		dram_tpr9 = <0x00>;
		dram_tpr10 = <0x402f3379>;
		dram_tpr11 = <0xd100b0f>;
		dram_tpr12 = <0x11131113>;
		dram_tpr13 = <0x80060>;
		linux,phandle = <0x183>;
		phandle = <0x183>;
		device_type = "dram";
		dram_dx_odt = <0x6060606>;
		dram_dx_dri = <0xd0d0d0d>;
		dram_ca_dri = <0x1919>;
		dram_mr4 = <0x00>;
		dram_mr5 = <0x00>;
		dram_mr6 = <0x00>;
		dram_mr11 = <0x00>;
		dram_mr12 = <0x00>;
		dram_mr13 = <0x00>;
		dram_mr14 = <0x00>;
		dram_mr16 = <0x00>;
		dram_mr17 = <0x00>;
		dram_mr22 = <0x00>;
	};

The dram clock is in hex you'll need to convert this value to decimal. https://www.rapidtables.com/convert/number/hex-to-decimal.html

Edited yesterday at 02:39 AM by Nick A

[Randlin]

Hmm, I tried running it on both mmcblk0boot* and got no output. I'll try running it on the full dump with -a to see if anything comes up. I'll try adding it to the config and go from there, see if it works. I'm not familiar with memory config and a lot of this stuff, but I am trying to learn all kinds of low level stuff and welcome the challenge!

[Randlin]

Yeah with the full dump it is essentially the same as boot.img. Manual testing it is.

[Randlin]

Ok, just used adb pull /proc/device-tree and used dtc and got this dts. This should be a complete dts. 

dts.txt

[Nick A]

You can find the dram config options here. 

https://elixir.bootlin.com/u-boot/v2025.07-rc2/source/arch/arm/mach-sunxi/Kconfig

 

if DRAM_SUN50I_H616
config DRAM_SUNXI_DX_ODT
	hex "DRAM DX ODT parameter"
	help
	  DX ODT value from vendor DRAM settings.

config DRAM_SUNXI_DX_DRI
	hex "DRAM DX DRI parameter"
	help
	  DX DRI value from vendor DRAM settings.

config DRAM_SUNXI_CA_DRI
	hex "DRAM CA DRI parameter"
	help
	  CA DRI value from vendor DRAM settings.

config DRAM_SUNXI_ODT_EN
	hex "DRAM ODT EN parameter"
	default 0x1
	help
	  ODT EN value from vendor DRAM settings.

config DRAM_SUNXI_TPR0
	hex "DRAM TPR0 parameter"
	default 0x0
	help
	  TPR0 value from vendor DRAM settings.

config DRAM_SUNXI_TPR2
	hex "DRAM TPR2 parameter"
	default 0x0
	help
	  TPR2 value from vendor DRAM settings.

config DRAM_SUNXI_TPR6
	hex "DRAM TPR6 parameter"
	default 0x3300c080
	help
	  TPR6 value from vendor DRAM settings.

config DRAM_SUNXI_TPR10
	hex "DRAM TPR10 parameter"
	help
	  TPR10 value from vendor DRAM settings. It tells which features
	  should be configured, like write leveling, read calibration, etc.

config DRAM_SUNXI_TPR11
	hex "DRAM TPR11 parameter"
	default 0x0
	help
	  TPR11 value from vendor DRAM settings.

config DRAM_SUNXI_TPR12
	hex "DRAM TPR12 parameter"
	default 0x0
	help
	  TPR12 value from vendor DRAM settings.