Need Help unbricking H96 Pro Plus

[ROOD]

Hello, i think i bricked my H96 Pro Plus, like a year ago i installed Armbian on it.

Today i flashed a SD with a new version, reinstalled octoprint etc and finally tried to burn it to the emmc using "./install-aml.sh"

it seemed to work the process ended and i powered it off, removed the SD and tried to boot it up. 

The only thing i see is the H96 Pro+ Logo and thats it.

I tried to boot from the SD Card again but it didn't work. I reflashed the SD card, changed the dtb file etc, just to make sure it would boot normally but nothing.

 

Im at that point where i think its bricked and i need to do some maskrom magic but i have no idea what to bridge

 

Any help would be much appreciated.

 

I was following This guide

 

Model: H96 Pro+
Motherboard: cz-s32-v2.2

EMMC: thgbmfg8c4lbair  ???

[SteeMan]

For amlogic based boxes, you will need a usba to usba cable and use the amlogic USB Burning tool to flash an original Android firmware image for your box.  You can also hookup a usb-uart connector to your box and get the uboot output which might shed some light on what is going wrong with your boot.

 

[ROOD]

@SteeMan i tried the usba to usba method using the USB Burning tool v2.2.3  and v3.1.6

The driver was installed successfully but when i plug in the box on the usb 2.0 it powers up with red lights and it doesn't do anything else.

What is the process of connecting it to the pc? just open the app and plug it it should work?
Do i have to press the reset button?
Should i have the SD card inserted?

[SteeMan]

Try all the USB ports on the box (if there are more than one, only one will work).  Also try with and without pressing the reset button while you are connecting.  I've sometimes had to try a few times to get the right timing/combination.  Bit I don't have your specific box so I can only provide general feedback.

 

[ROOD]

@SteeMan Just got this from my box. Im in the process of reading it to see if it contains any clue.

EDIT: Plugged in the SD Card and now i got a different output.
EDIT2: With the button pressed for a fey cycles.
It seems like it is trying to boot from SD but fails.

 

[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
gpio: pin GPIOAO_2 (gpio 102) value is 1
InUsbBurn
noSof
card in
init_part() 278: PART_TYPE_DOS
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 1b
OEM: 534d
Name: GC2QT 
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 59.6 GiB
mmc clock: 40000000
Bus Width: 4-bit
Device: SDIO Port B
Manufacturer ID: 1b
OEM: 534d
Name: GC2QT 
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 59.6 GiB
mmc clock: 40000000
Bus Width: 4-bit
reading aml_autoscript
800 bytes read in 4 ms (195.3 KiB/s)
## Executing script at 01080000
## Error: "bootfromsd" not defined
Saving Environment to aml-storage...
mmc env offset: 0x27400000 
Writing to MMC(1)... done
reboot use default mode: normal
bl31 reboot reason: 0xd
bl31 reboot reason: 0x1
system cmd  1.

 

putty.txtputty with SD.txt

putty with button Pressed.txt

Edited March 2 by ROOD

[SteeMan]

I would interpret this as meaning your emmc is corrupted (as expected).  You need to flash an original android firmware with usb burning tool to recover.  Do you have an Android firmware for your box?

[ROOD]

@SteeMan negative. I was using Armbian on it before i screwed up.  
I still cant get to see the device on the Burning Tool, tried every possible combination but it just wont work.
The only thing i havent tried is to invert the D+ and D-  wires on the usb to usb.
It should be the same pinout for both right??

USB A Pin 1  -  USB B Pin 1  

USB A Pin 2  -  USB B Pin 2

USB A Pin 3  -  USB B Pin 3

USB A Pin 4  -  USB B Pin 4

[SteeMan]

The only way to recover is to restore Android.  The armbian builds use the Android uboot environment on emmc to boot both from SD as well as emmc.  So once you copied to emmc which somehow corrupted your boot environment (which is why the instructions say to be cautious and copy to emmc at your own risk), you can't boot anything.  So the only recovery is to reflash Android and start over.

[SteeMan]

11 minutes ago, ROOD said:

It should be the same pinout for both right??

I guess I don't know what you are asking.  Are you using an off the shelf USB-A to USB-A cable?  Or are you building your own cable? 

[ROOD]

@SteeMan built it from two spare usb cables.

EDIT: just grabbed an ESP32 to use it as a bridge for the serial comunication. It should give me more control in trying to stop the boot process, the timeout is instant so hopefully i will be able to catch it with a script

Edited March 2 by ROOD

[ROOD]

Update: 
Im able to send commands through UART
I can confirm the emmc was indeed corrupted, it has only 2 partitions instead of supposed 7.
Im trying to boot manually but afaik i'll need a zImage file wich i have no idea where to get

 

[SteeMan]

If you can get to the uboot prompt you can try to manually boot the system.

 

What should be happening when you boot from emmc is that the native android uboot should run the following command:

 

if fatload mmc 1 0x1000000 u-boot.emmc; then go 0x1000000; fi;

 

(that command assumes that you boot partition is partition 1, the "fatload mmc 1")

 

It should load the u-boot.emmc file in your /boot.  The installation via install_aml.sh should have renamed your u-boot.ext to u-boot.emmc.

 

Then the loaded u-boot.emmc should look for your /boot/extlinux/extlinux.conf file and boot accordingly.

 

If you have command line uboot access you can look at your two partitions and see if they look like they contain the proper files, especially the contents of your /boot partition.

 

The above 'if fatload...' command is just a shortcut to what should be happening.  If you want to follow the whole series of logic, you start with the aml_autoscript file.  This file should be loaded by u-boot when the reset button is pressed during boot.  The contents of this file set some u-boot environment variables that upon subsequent boots should boot from SD, USB or emmc if they find a u-boot.ext (or u-boot.emmc) and if not continue to try to do a normal android boot.  In the emmc case, the boot should run the emmc_autoscript file which contains the above 'if fatload...'.

 

I hope this helps you explore the boot process and maybe you can figure out a way to get your box booting armbian again.

[ROOD]

@SteeMan

 im really deep into the booting process now lol, i got an esp32 trying out dtb files.
So here's the issue.
I flashed the SD Card with a brand new "Armbian_community_25.5.0-trunk.87_Aml-s9xx-box_noble_current_6.12.15.img". It has 2 partitions, i went to the /boot/extlinux/extlinux.conf  and configured it to boot using FDT /dtb/amlogic/meson-gxm-q200.dtb

That same partition has a file "Image" wich seems to be the zImage file but uncompressed, the thing is that everytime i load it it fails.

 

mmc dev 0; 
fatload mmc 0:1 0x1080000 Image; 
fatload mmc 0:1 0x13000000 initrd.img-6.12.15-current-meson64; 
fatload mmc 0:1 0x1000000 /dtb/amlogic/meson-gxm-q200.dtb; 
booti 0x1080000 0x13000000 0x1000000

 

 

i get 
 

Wrong Ramdisk Image Format

Ramdisk image is corrupt or invalid

i wonder if its the case of an uncompressed zImage...

[SteeMan]

There should be a uInitrd file which is the initrd.img... file converted to the uboot format.  You should try that.

 

I would recommend trying the command I posted above which chainloads the u-boot.ext file, which will then just boot from the extlinux.conf file.  The u-boot.ext is a newer version of uboot that should be more compatible with a modern mainline linux image (at least that is the idea).

[ROOD]

gxm_q201_v1#mmc dev 1
mmc dev 1

emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
init_part() 278: PART_TYPE_DOS
[mmc_init] mmc init success
switch to partitions #0, OK
mmc1(part 0) is current device
gxm_q201_v1#fatls mmc 1:1
fatls mmc 1:1

 35090944   image 
  4921724   system.map-6.12.17-current-meson64 
    38518   boot.bmp 
            build-u-boot/
   269902   config-6.12.17-current-meson64 
            dtb/
      174   emmc_autoscript 
            extlinux/
 23863802   initrd.img-6.12.17-current-meson64 
   609247   u-boot-s905 
   646455   u-boot-s905x-s912 
   851352   u-boot-s905x2-s922 
   798672   u-boot-s905x3 
   854424   u-boot-s905x3-ugoosx3 
 23863866   uinitrd 

12 file(s), 3 dir(s)

 

gxm_q201_v1#mmc part
mmc part


Partition Map for MMC device 1  --   Partition Type: DOS

Part	Start Sector	Num Sectors	UUID		Type
  1	1953792   	999424    	98280000-01	0c
  2	2955264   	58116096  	98280000-02	83
gxm_q201_v1#

 

Contents of emmc_autoscript

if printenv bootfromsd; then exit; fi;
if fatload mmc 1:1 0x1000000 u-boot.emmc; then go 0x1000000; fi;

 

there is no u-boot.emmc   its supposed to be the u-boot-s905x-s912 or at least thats what i would expect

 

Im going to try:

 

if fatload mmc 1 0x1000000 u-boot-s905x-s912; then go 0x1000000; fi;

 

[ROOD]

@SteeMan

Progress!!!
I got video output from emmc using 

if fatload mmc 1 0x1000000 u-boot-s905x-s912; then go 0x1000000; fi;

 

now what? XD 

 

[ROOD]

UPDATE: I was able to boot from the SD Card changing it to 
if fatload mmc 0 0x1000000 u-boot-s905x-s912; then go 0x1000000; fi;

im trying the install script once again to see if it finally works
i'll report back...

 

[ROOD]

I was able to finally boot propperly into the emmc via UART commands.

Now the question is.... how do i make it so it boots from SD  (if present)  or EMMC  automatically

 

 

 

Edited March 3 by ROOD

[ROOD]

Im still having some issues, for some weird reason it wont boot without the ESP plugged in. Even when i just set it in monitor mode (so it doesn't stop the boot or sends any commands).

I wonder if its caused by the UART floating?
 

[SteeMan]

So good work so far.  Since you don't provide specifics on what you have done (like the exact commands you are issuing in uboot to acheive your successfull boots) I can't provide specific answers.  But I can provide general guidance (and it seems so far you can figure out the rest).

So to get this to work from both sd and emmc and persist you need to dig into the whole mechanism some more.

If you look at the contents of aml_autoscript file.  This file should only need to be run once.  It sets some uboot environment variables and then reboots.  Those environment variable values should be persistent and should on subsequent boots change the boot flow to allow armbian to boot from sd, usb or emmc.

So I'd suggest looking at your uboot environment, print out the values of the relevant variables in your environment and see what isn't set correctly, or is missing.  Then try to fix.

The intended boot flow is to determine sd, usb or emmc and then run the boot script s905_autoscript or emmc_autoscript accordingly which should then load u-boot.ext/u-boot.emmc and run from their whatever is configured in extlinux.conf.

 

You said earlier that you didn't have an u-boot.emmc on your emmc boot partition, which would explain why it wasn't booting.  install_aml.sh should have created that if it was run correctly.  Of course u-boot.ext/u-boot.emmc are just copies of the u-boot-s9xxxxx files, so what you seem to be doing in calling them directly also works, but isn't what the scripts are expecting.

 

I hope these pointers help you on your adventure.

[ROOD]

@SteeMan srry for not posting more info lol  last night i was gassed out, i spent all day digging into that issue.
Apparently its working now, i had to add a pull-up resistor to the RX line, somehow now having it was causing issues while booting.
I soldered male pin headers to the board, maybe those were acting as some kind of "antenna" causing the garbage input on the RX line, thats why when its propperly grounded and connected to a device like the ESP32 was booting fine.

Not sure about the forum etiquette but i'll update my first post with everything i did in case someone has the same issue.... but i doubt anyone is as dumb as me hehe.

For now, i was able to make it so it boots from EMMC or SD if present.  I still have to try and see what happens if there is an SD without any boot info, not sure if it will try to boot and fail.

I lack the propper knowledge on uBoot to see if all my enviorment variables are ok or i messed up any while messing with it.

 

I should be home in about 2 hours so, i'll grab as much info as i can and post it here just in case