Booting armbian manually from u-boot shell over UART

[user03]

Hello, I'm new to embedded linux installation, so please bear with me. So I purchased an android tv box labeled h96max S905L3 from TEMU. Specifications (if the label is trustworthy): RAM: 2GB, ROM:16GB, running android 14.0. On the pcb it says: s905_zx02_v01. It features an ethernet port, 2 USB, HDMI, AV port (looks like a headphone jack) and no hidden reset button or sd card slot. I was trying to install any kind of linux to it using a bootable usb, I just need a simple shell capable of running an http server. I have tried using the remote control to trigger boot to linux, but nothing works. I have then opened the thing, and connected uart to a RP2040 and wrote a simple script as a uart bridge. I now have access to u-boot shell, interupted setup. So far I used chatgpt to guide me, but couldn't get it to boot properly. It told me how to boot manually the image from the usb, but it failed every time.

 

It told me to set these env vars, and over time it showed me different addresses. It said the issues were related to overlapping of the addresses, or using address range that was reserved. It also said the dtb which I used, the meson-gxl-s905x-p212.dtb won't work, since the device always threw an error bad_magic, even though I checked fdt header, and the magic was correct.

 

setenv kernel_addr_r 0x20000000

setenv ramdisk_addr_r 0x24000000

setenv fdt_addr_r 0x21000000

 

I would then load the files

 

fatload usb 0:1 ${kernel_addr_r} linux-android.img

fatload usb 0:1 ${ramdisk_addr_r} uInitrd

fatload usb 0:1 ${fdt_addr_r} vendor-expanded.dtb

 

Notice: I used different images, firstly the Image file, and the meson-gxl-s905x-p212.dtb. After failed boots, chatgpt told me to expand, i.e. add padding to the dtb (first with the meson...dtb, and after that with the vendor.dtb). It didn't work, so it told me to generate an android like image using

 

mkbootimg \

--kernel Image \

--dtb vendor-expanded.dtb \

--cmdline "console=ttyAML0,115200 console=ttyS0,115200 root=/dev/sda1 rootwait rootdelay=10 rw" \

--base 0x0 \

--pagesize 2048 \

--kernel_offset 0x1080000 \

--dtb_offset 0x1000000 \

-o linux-android.img

 

and boot using the extracted vendor.dtb (pulled from android) and using

 

bootm ${kernel_addr_r} instead of booti ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r}

 

The bootargs I used are setenv bootargs "root=/dev/sda1 rootfstype=ext4 rw rootwait console=ttyAML0,115200n8 console=tty0"

 

Please, any help would be appreciated as I already spent over 6 hours with this little cheap bastard that wouldn't boot anything but that chinese android. I will post output of anything, just let me know if something is needed. I'm sorry for the messiness of this post, but I tried a lot of things that chatgpt told me, explained the errors, and supplied commands for the u-boot shell.

[SteeMan]

If you are trying to run an Armbian build, first check out:

https://forum.armbian.com/topic/16976-status-of-armbian-on-tv-boxes-please-read-first

And

 

 

[SteeMan]

Then

If you look in the /boot folder,

There are the scripts the Armbian system uses to get uboot to boot on amlogic.

Generally Armbian uses extlinux for booting using a chain loaded uboot binary.

[SteeMan]

Specifically the file you want to look at is aml_autoscript

 

What happens on a normal amlogic TV box is when the hidden reset button is pressed during boot, the boot loader looks for this file and runs it.

 

This file then changes the stored uboot environment such that subsequent boots follow a new boot flow to boot first from sd or USB and fall back to android.

 

If you follow the logic you can find the actual boot commands in the other files that get called.

 

 

[user03]

Ok. I read the posts you showed me. First off, I thought this was a pretty straightforward process - installing armbian to these chinese tv boxes; so thank you for the hard truth - expect nothing to work:( Anyway, as I mentioned before, my main issue was that there is no reset button on this thing, so I had no idea how to get anything to boot, which commands, which script to run. So, thank you again for pointing me to the file. I entered the u-boot shell from uart, loaded the aml_autocript to 0x20000000

fatload usb 0:1 0x20000000 aml_autoscript

and run it with

autosrc 0x20000000

(the equivalent of source command I believe). It changed the bootloader, as the other post suggested, and now it boots to usb if present (haven't tried if it falls back to android, but I don't care about that anymore). I'm really glad it boots to linux, but the thing is it always ends in kernel panic before it even boots completely. I tried turning it off and on, but I always got a different kernel panic. Here are some of the logs (I posted only the kernel panic lines, and a few before - to keep the post short, but I can add some of the complete logs if necessary). Notice: after entering the kernel panic the device just hangs - no reset or action whatsoever. So I just disconnected power, and turned it on again. Another notice: the logs may actually be incomplete, because I already faced issues with uart not printing the whole text, but only the first 40-50 lines or so (example: output of the command help in the u-boot shell showed only half of them, and the last line shown looked half-printed). Dunno why this happens, maybe the RP2040 zero (which I'm using as the uart bridge adapter, running micropython script) is causing it, or something else. 

boot1:

[ 11.642441] systemd[1]: Found device dev-disk-by\x2duuid-3563\x2d67BF.device - ProductCode armbi_boot.
[ 11.657680] systemd[1]: Starting systemd-fsck@dev-disk-by\x2duuid-3563\x2d67BF.service - File System Check on /dev/disk/by-uuid/3563-67BF...
[ 11.673727] systemd[1]: Starting systemd-networkd-persistent-stor[ 11.689172] [drm] Initialized simpledrm 1.0.0 for 7fe5b000.framebuffer[ 11.717710] Console: switching to colour frame buffer device 90x36
[ 11.731744] simple-framebuffer 7fe5b000.framebuffer: [drm] fb0: simpledrmdrmfb frame buffer device
[ 11.835286] mc: Linux media interface: v0.10
[ 11.837173] Registered IR keymap rc-empty
[ 11.852968] rc rc0: meson-ir as /devices/platform/soc/c8100000.bus/c8100580.ir/rc/rc0
[ 11.855991] rc rc0: lirc_dev: driver meson-ir registered at minor = 0, raw IR receiver, no transmitter
[ 11.883334] input: meson-ir as /devices/platform/soc/c8100000.bus/c8100580.ir/rc/rc0/input0
[ 11.897040] rc rc0: sw decoder init
[ 11.897461] meson-ir c8100580.ir: receiver initialized
[ 11.923213] systemd[1]: Finished systemd-networkd-persistent-storage.service - Enable Persistent Storage in systemd-networkd.
[ 11.959135] videodev: Linux video capture interface: v2.00
[ 12.038565] systemd[1]: Reached target usb-gadget.target - Hardware activated USB gadget.
[ 12.122827] SError Interrupt on CPU3, code 0x00000000bf000002 -- SError
[ 12.122857] CPU: 3 UID: 0 PID: 1158 Comm: (udev-worker) Tainted: G M 6.18.2-current-meson64 #1 PREEMPT
[ 12.122869] Tainted: [M]=MACHINE_CHECK
[ 12.122872] Hardware name: Amlogic Meson GXL (S905X) P212 Development Board (DT)
[ 12.122878] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 12.122885] pc : el00
[ 12.122973] x11: 0000000000000006 x10: ffff8000812e5a60 x9 : 1fffe000007108c1
[ 12.122983] x8 : 0000000000000001 x7 : ffff000003884600 x6 : ffff000003884608
[ 12.122993] x5 : ffff8000829eb6b0 x4 : 0000000000000025 x3 : 0000000000000021
[ 12.123002] x2 : 000000000000003b x1 : 0000000000000000 x0 : 0000000000000000
[ 12.123014] Kernel panic - not syncing: Asynchronou do_serror+0x3c/0x78
[ 12.123105] el1h_64_error_handler+0x34/0x50
[ 12.123114] el1h_64_error+0x6c/0x70
[ 12.123123] el1_abort+0x34/0x68 (P)
[ 12.123130] el1h_64_sync_handler+0x50/0x104
[ 12.123138] el1h_64_sync+0x6c/0x70
[ 12.123145] lima_mmu_init+0x44/0x124 [lima] (P)
[ 12.123186] lima_device_init+0x1ac/0x664 [lima]
[ 12.123206] lima_pdev_probe+0xa4/do_init_module+0x58/0x23c
[ 12.123364] load_module+0x1e78/0x1ed4
[ 12.123374] init_module_from_file+0x88/0xcc
[ 12.123383] __arm64_sys_finit_module+0x1ec/0x300
[ 12.123393] invoke_syscall+0x48/0x10c
[ 12.123408] el0_svc_common.constprop.0+0xc8/0xe8
[ 12.123418] do_el0_svc+0x20/0x2c
[ 12.123428] el0_svc+0x34/0xf0
[ 12.123437] el0t_64_sync_handler+0xa0

boot2:

[   12.471539] Kernel panic - not syncing: Asynchel1h_64_error_handler+0x34/0x50
[   12.471648]  el1h_64_error+0x6c/0x70
[   12.471656]  el1_abort+0x34/0x68 (P)
[   12.471664]  el1h_64_sync_handler+0x50/0x104
[   12.471672]  el1h_64_sync+0x6c/0x70
[   12.471679]  lima_mmu_init+0x44/0x124 [lima] (P)
[   12.471723]  lima_device_init+0x1ac/0x664 [lima]
[   12.471744]  lima_pdev_probe+0xa4/0x1bc [lima]
[   12.471764]  platform1915]  load_module+0x1e78/0x1ed4
[   12.471924]  init_module_from_file+0x88/0xcc
[   12.471934]  __arm64_sys_finit_module+0x1ec/0x300
[   12.471944]  invoke_syscall+0x48/0x10c
[   12.471956]  el0_svc_common.constprop.0+0xc8/0xe8
[   12.471967]  do_el0_svc+0x20/0x2c
[   12.471977]  el0_svc+0x34/0xf0
[   12.471988]  el0t_64_sync_handler+0xa0/0xe4
[   12.471996]  el0t_64_sync+Traceback (most recent call last):

boot3:

[   12.420984] Kernel panic - nx80
[   12.421075]  do_serror+0x3c/0x78
[   12.421082]  el1h_64_error_handler+0x34/0x50
[   12.421091]  el1h_64_error+0x6c/0x70
[   12.421099]  el1_abort+0x34/0x68 (P)
[   12.421107]  el1h_64_sync_handler+0x50/0x104
[   12.421115]  el1h_64_sync+0x6c/0x70
[   12.421121]  lima_mmu_init+0x44/0x124 [lima] (P)
[   12.421165]  lima_device_init+0x1ac/0x664 [lima]
[   12.421185]  0x200
[   12.421335]  do_init_module+0x58/0x23c
[   12.421348]  load_module+0x1e78/0x1ed4
[   12.421357]  init_module_from_file+0x88/0xcc
[   12.421367]  __arm64_sys_finit_module+0x1ec/0x300
[   12.421376]  invoke_syscall+0x48/0x10c
[   12.421388]  el0_svc_common.constprop.0+0xc8/0xe8
[   12.421399]  do_el0_svc+0x20/0x2c
[   12.421409]  el0_svc+0x34/0xf0
[   12.421419]  el0

boot4:

[   12.874949] SError Interrupt on CPU2, code 0x00000000bf000002 -- SError
[   12.874984] CPU: 2 UID: 0 PID: 1165 Comm: (udev-worker) Tainted: G   M     C          6.18.2-current-meson64 #1 PREEMPT 
[   12.874999] Tainted: [M]=MACHINE_CHECK, [C]=CRAP
[   12.875003] Hardware name:   12.875086] x17: 0000000000000000 x16: ffff00000495fc00 x15: ffff000002098ea3
[   12.875095] x14: 0000000000000001 x13: ffff000002098ea0 x12: ffff00000b244200
[   12.875105] x11: 0000000000000006 x10: ffff8000812e5a60 x9 : 1fffe0000092e981
[   12.875114] x8 : 0000000000000001 x7 : ffff000004974c00 x6 : ffff000004974c08
[   12.875123] x5 : ffff800082a1b6b0 x4 : 0000000000000025 4
[   12.875207]  vpanic+0x320/0x364
[   12.875215]  nmi_panic+0x0/0x68
[   12.875221]  add_taint+0x0/0xbc
[   12.875227]  arm64_serror_panic+0x70/0x80
[   12.875235]  do_serror+0x3c/0x78
[   12.875242]  el1h_64_error_handler+0x34/0x50
[   12.875251]  el1h_64_error+0x6c/0x70
[   12.875260]  el1_abort+0x34/0x68 (P)
[   12.875268]  el1h_64_sync_handler+0x50/0x104
[   12.875212.875453]  __platform_driver_register+0x24/0x30
[   12.875462]  lima_platform_driver_init+0x20/0x1000 [lima]
[   12.875486]  do_one_initcall+0x70/0x200
[   12.875495]  do_init_module+0x58/0x23c
[   12.875508]  load_module+0x1e78/0x1ed4
[   12.875516]  init_module_from_file+0x88/0xcc
[   12.875526]  __arm64_sys_finit_module+0x1ec/0x300
[   12.875535]  invoke_syscall+0x48/0x1

 

[user03]

Update. I fixed the issue with chatgpt now. It told me according to the logs, my board has wrong hardware, and it told me to disable the gpu with adding a file to /etc/modprobe.d/ with blacklist lima. It worked. I booted to armbian, but to my surprise it immediately showed me a message saying this image is for tesing purposes only, and not stable. I downloaded it from the official site, it was labeled as minimal console pc, for small servers or sth like that. Also, hdmi not working (I don't want to only be able to ssh to it, but if that's what it is than fine:), and during setup it was giving me wrong time, timezones, completely wrong. Don't know what should be next step, try a different dtb, or different armbian image?