Jump to content

Proof of concept - Realtek 1295


Staars

Recommended Posts

Ok, I will try to use fatload:

 

Realtek> usb start
(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 3 USB Device(s) found
USB1:   USB XHCI 1.10
scanning bus 1 for devices... Unknown request , typeReq = 0x200c 
1 USB Device(s) found
USB2:   USB XHCI 1.10
scanning bus 2 for devices... Unknown request , typeReq = 0x200c 
1 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found

1: Hub,  USB Revision 2.0
 - u-boot EHCI Host Controller 
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

2: Hub,  USB Revision 2.0
 -  USB2.0 Hub 
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x05e3  Product 0x0610 Version 50.152
   Configuration: 1
   - Interfaces: 1 Self Powered Remote Wakeup 100mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms
     - Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms

3: Mass Storage,  USB Revision 2.0
 - Kingston DataTraveler 2.0 AC220B280602BE41599A0150
 - Class: (from Interface) Mass Storage
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0951  Product 0x1665 Version 1.0
   Configuration: 1
   - Interfaces: 1 Bus Powered 200mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 2
     - Class Mass Storage, Transp. SCSI, Bulk only
     - Endpoint 1 In Bulk MaxPacket 512
     - Endpoint 2 Out Bulk MaxPacket 512

4: Hub,  USB Revision 3.0
 - u-boot XHCI Host Controller 
 - Class: Hub
 - PacketSize: 9  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

5: Hub,  USB Revision 3.0
 - u-boot XHCI Host Controller 
 - Class: Hub
 - PacketSize: 9  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

Realtek> fatls usb 0:1
 11110393   uimage.gz 
            lost.dir/
            .zxc/
            android/
 471238945   ota.zip 
 512508547   zidoo_x8-v2.1.22-201901171517-ota.zip 

3 file(s), 3 dir(s)

Realtek> fatload
usage: fatload <interface> <dev[:part]> <addr> <filename> [bytes] [file_count]
Realtek> 

 

Link to comment
Share on other sites

Ok guys, am I in the club?

 

Last login: Fri May 31 19:21:18 UTC 2019 on ttyS0
 _          _          _ 
| |    __ _| | _____  / |
| |   / _` | |/ / _ \ | |
| |__| (_| |   <  __/ | |
|_____\__,_|_|\_\___| |_|
                         

Welcome to ARMBIAN 5.86 user-built Debian GNU/Linux 9 (stretch) 4.9.176-rtd1295   
System load:   1.09 0.99 0.56   Up time:       8 min
Memory usage:  3 % of 1636MB    IP:            
CPU temp:      46�°C           
Usage of /:    7% of 15G    

[ General system configuration (beta): armbian-config ]

 

my boot command:

 

usb start && fatload usb 0:1 $kernel_loadaddr vmlinuz && fatload usb 0:1 $fdt_loadaddr dtb && env set bootargs earlycon=uart8250,mmio32,0x98007800 console=ttyS0,115200 noinitrd root=/dev/mmcblk0p1 rootfs=ext4  init=/sbin/init && b2ndbc; bootr

 

Link to comment
Share on other sites

Yes, definitely a club member :thumbup:!

 

The most interesting part for me is, that you can use „fatload“, which never worked for me on any storage device. 

Can you shortly describe, how you prepared the usb stick? Maybe I overlooked something and your solution seems to be an improvement. (The other possibility is, that the u-boot on my Lake 1 is not able to do this)

Link to comment
Share on other sites

Well, next question, which uboot.bin?

 

The problem (on my lake-box) is, that everything except the second u-boot (2015) is encrypted. So the more important first u-boot (2012) is encrypted and this is the place, where we load the linux kernel and dtb and where fatload fails for me. At least on the Lake 1.

 

In the attachment is the encrypted u-boot-2012.bin, which should not be very useful.

 

If I inspect the Android image for the Zidoo X9S, I can see, that u-boot-2012 is NOT encrypted, but this does not help on the Lake 1, which simply refuses to boot this puppy. I still hope, that I simply overlooked something simple here.

uboot.bin

Link to comment
Share on other sites

On 4/29/2019 at 4:24 PM, Staars said:

Yes, your early boot log should be very helpful. But no need to hurry, I am a bit short of time atm.

well.. it's your fault.. :D

 

Terminal ready
�
C1:80000000
C2
?
C3h
SD card is not detected !!
switch frequency to 0x00000046
frequency divider is 0x00000080
switch frequency to 0x00000046
frequency divider is 0x00000004
switch to SDR 8 bit
switch bus width to 0x00000008 bits success

hwsetting size: 00000BC0
C4
64b
LK EL3: arm_gic_init 

welcome to lk/MP

boot args 0x20000 0x60 0x98007800 0x0
INIT: cpu 0, calling hook 0x603e8 (version) at level 0x3ffff, flags 0x1
version:
	arch:     ARM64
	platform: RTD1295
	target:   RTD1295
	project:  RTD1295
	buildid:  81C95C5_MON_SEP__4_01:41:29_CST_2017
initializing heap
calling constructors
initializing mp
initializing threads
initializing timers
initializing ports
creating bootstrap completion thread
top of bootstrap2()
INIT: cpu 0, calling hook 0x5ee30 (sysparam) at level 0x70000, flags 0x1
INIT: cpu 0, calling hook 0x743e4 (lwip) at level 0x70000, flags 0x1
creating bootstrap completion thread for cpu 1
creating bootstrap completion thread for cpu 2
creating bootstrap completion thread for cpu 3
initializing platform
rtd129x_pwm_pin_mux default value 0
PLL_EMMC1 = 0x00000003
switch frequency to 0x46, divder to 0x80
switch frequency to 0x46, divder to 0x4
switch_bus: width = 0x00000002
switch speed to 0x2 success 
switch frequency to 0xa6, divder to 0x0
PLL_EMMC1 = 0x00000003
eMMC Error: Response timeout
eMMC Error: Response timeout
eMMC Error: Response timeout
eMMC Error: Response timeout
eMMC Error: Response timeout
switch erase_group_def to 0x1 success 
sec_count = 0xe90000 
Erase Unit Size = 512KB * 0x1 
factory_init, factory size:0x400000
MMC
TIMEOUT
__wait_done: addr=0x98012044, mask=0x00000008, value=0x00000008
TIMEOUT
__wait_done: addr=0x98012424, mask=0x00000002, value=0x00000002
eMMC Error: Response timeout
[FAC][ERR] Get factory header from mmc0 failed
TIMEOUT
__wait_done: addr=0x98012044, mask=0x00000008, value=0x00000008
TIMEOUT
__wait_done: addr=0x98012424, mask=0x00000002, value=0x00000002
eMMC Error: Response timeout
[FAC][ERR] Get factory header from mmc0 failed
[FAC] No factory data in mmc0
sysparam_scan_factory: read SYSPARAM from factory fail!!
Bring UP slave CPUs
initializing target
INIT: cpu 0, calling hook 0x40cdc (r8168) at level 0x90000, flags 0x1
r8168: REALTEK RTL8168 @0x98016000
Realtek GBE Family Controller 32 mcfg = 0024
netif en ip 192.168.100.1 netmask 255.255.255.0 gw 192.168.100.254
calling apps_init()
HDMITx_HPD=False
------------can't find tmp/factory/video_rpc.bin
tv_system=25 mode=1
Set ACPU share memory
------------can't find tmp/factory/000BootParam.h
Default Power-Config
EEPROM: SIZE=16384, ADRESS_MODE=2, PAGE_WRITE_SIZE=64, BUFFER_SIZE=16
PMIC is gmt,g2227
starting app rtkboot
---------------LOAD  NORMAL FW  TABLE ---------------
fw_desc_table_start = 0x00620000
fw_desc_table_ddr_base = 0x0x12418f70
starting app eeprom
starting app pmic
cmd_pmic_entry: set DC force PWM
pmic_testing returns 00
INIT: cpu 3, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2
INIT: cpu 2, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2
INIT: cpu 1, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2
TIMEOUT
__wait_done: addr=0x98012044, mask=0x00000008, value=0x00000008
TIMEOUT
__wait_done: addr=0x98012424, mask=0x00000002, value=0x00000002
eMMC Error: Response timeout
[ERR] rtk_plat_prepare_fw_image:Read fw_desc_table_v1_t error! (0x3100, 0x1, 0x0x12418f70)
---------------LOAD  NORMAL FW  TABLE ---------------
fw_desc_table_start = 0x00620000
fw_desc_table_ddr_base = 0x0x12418f70
TIMEOUT
__wait_done: addr=0x98012044, mask=0x00000008, value=0x00000008
TIMEOUT
__wait_done: addr=0x98012424, mask=0x00000002, value=0x00000002
eMMC Error: Response timeout
[ERR] rtk_plat_prepare_fw_image:Read fw_desc_table_v1_t error! (0x3100, 0x1, 0x0x12418f70)
---------------LOAD  GOLD  FW  TABLE ---------------
fw_desc_table_start = 0x00628000
fw_desc_table_ddr_base = 0x0x12418f70
TIMEOUT
__wait_done: addr=0x98012044, mask=0x00000008, value=0x00000008
TIMEOUT
__wait_done: addr=0x98012424, mask=0x00000002, value=0x00000002
eMMC Error: Response timeout
[ERR] rtk_plat_prepare_fw_image:Read fw_desc_table_v1_t error! (0x3140, 0x1, 0x0x12418f70)
entering main console loop
Realtek> 

no.. i completely forgot about this one.

 

W2 without SD-Card

Link to comment
Share on other sites

 

13 hours ago, Staars said:

Hmmm, this is with (boot-selector) SW4 in position 1  ... i guess?

yes..

 

same on position 0

C1:80000000
C2
?
C3hswitch frequency to 0x00000046
frequency divider is 0x00000080
switch frequency to 0x00000046
frequency divider is 0x00000004
switch to SDR 8 bit
switch bus width to 0x00000008 bits success

hwsetting size: 00000BC0
C4
f 
5-5
s_f
5-5-2
Goto FSBL: 0x10100000
switch frequency to 0x00000046
frequency divider is 0x00000080
switch frequency to 0x00000046
frequency divider is 0x00000004
emmc_cid[3] = 0x997418B8 emmc_cid[2] = 0x76F60152 emmc_cid[1] = 0x34454D47 emmc_cid[0] = 0x38000115
switch bus width to 0x00000008 bits success
DEVICE_TYPE = 00000057
emmc_sec_count = 00E90000
switch speed to 0x00000002 success
switch frequency to 0x000000A6
frequency divider is 0x00000000
1st TX_window = 0x7FFFFFFE
1st phase TX VP0= 0x0000000F
RX_window = 0xFFFFFF80
phase RX VP1= 0x00000013
Welcome to FSBL ...
[FSBL] Warm Boot: 0x00000000
[FSBL] Secure: 0x0000BEEE
[FSBL] Flash Type: 0x00000002
[FSBL] DCache Enable: 0x00000000
[FSBL] SVP = N
tee_ltc_alloc_mpa init ...
malloc_add_pool init ...
********** FW_TYPE_GOLD_TEE **********
    FW Image to 0x10200000, size=0x0007A9E0 (0x1027A9E0)
    FW Image fr 0x000C3600 
********** FW_TYPE_GOLD_BL31 **********
    FW Image to 0x10120000, size=0x000062A0 (0x101262A0)
    FW Image fr 0x0013E000 
********** FW_TYPE_BOOTCODE **********
    FW Image to 0x00020000, size=0x00088BA0 (0x000A8BA0)
    FW Image fr 0x00020E00 
md copy audio bin
VERBOSE: bl31_setup
NOTICE:  BL31: v1.2(debug):a6c9ab6
NOTICE:  BL31: Built : 15:16:22, Apr 27 2017
INFO:    BL31: Initializing runtime services
INFO:    Start to init service std_svc 
INFO:    Finish to init service std_svc 
INFO:    Start to init service opteed_fast 
INFO:    Finish to init service opteed_fast 
INFO:    BL31: Initializing BL32
INFO:    TEE-CORE: TEE OS v2.1
INFO:    TEE-CORE: TA RAM slim vesion.
INFO:    TEE-CORE: tee os version : 0
INFO:    TEE-CORE: OTP tee os version : 0
INFO:    TEE-CORE: chip_rev_id : 30000
INFO:    TEE-CORE: check golden fw : 0
INFO:    TEE-CORE: Loaded normal F/W
INFO:    TEE-CORE: tee os version check pass.
INFO:    TEE-CORE: Initializing (b2aa60f-dev #1 Mon Aug 28 13:42:14 CST 2017 aarch64)
MESSAGE: [0x0] TEE-CORE:tee_otp_get_hw_unique_key:49: ************************     tee_otp_get_hw_unique_key chip id: 30000
MESSAGE: [0x0] TEE-CORE:tee_otp_get_hw_unique_key:54: ************************     tee_otp_get_hw_unique_key used Kf
INFO:    TEE-CORE: teecore inits done
INFO:    Core_0 TEESMC_OPTEED_RETURN_ENTRY_DONE 
INFO:    Core_0 got optee_vectors (0x1020093c)
INFO:    BL31: Initialized BL32
INFO:    EXIT BL31
INFO:    bl31_to_kernel: kernel_resume_entry = 0x1e000
INFO:    bl31 jumps to EL2: LK entry 

welcome to lk/MP

boot args 0x2 0x0 0x0 0x0
INIT: cpu 0, calling hook 0x603e8 (version) at level 0x3ffff, flags 0x1
version:
	arch:     ARM64
	platform: RTD1295
	target:   RTD1295
	project:  RTD1295
	buildid:  81C95C5_MON_SEP__4_01:41:29_CST_2017
initializing heap
calling constructors
initializing mp
initializing threads
initializing timers
initializing ports
creating bootstrap completion thread
top of bootstrap2()
INIT: cpu 0, calling hook 0x5ee30 (sysparam) at level 0x70000, flags 0x1
INIT: cpu 0, calling hook 0x743e4 (lwip) at level 0x70000, flags 0x1
creating bootstrap completion thread for cpu 1
creating bootstrap completion thread for cpu 2
creating bootstrap completion thread for cpu 3
initializing platform
rtd129x_pwm_pin_mux default value 0
PLL_EMMC1 = 0x00000003
switch frequency to 0x46, divder to 0x80
switch frequency to 0x46, divder to 0x4
switch_bus: width = 0x00000002
switch speed to 0x2 success 
switch frequency to 0xa6, divder to 0x0
PLL_EMMC1 = 0x0000137b
switch erase_group_def to 0x1 success 
sec_count = 0xe90000 
Erase Unit Size = 512KB * 0x1 
factory_init, factory size:0x400000
MMC
[FAC] No factory data in mmc0
sysparam_scan_factory: read SYSPARAM from factory fail!!
Bring UP slave CPUs
geVEVEnRRBBEOiOSRtBSiEEaO:lS :iE :bb ll3zb3li1n1__gs3 e1s_testtuaeptur

TOITNpO
    II
      NCCENOETII:TC :  : E B:B LcLp 3B3Lu1:1 30 :,1v:   c1vv1a.1l2..(2l2i(dde(bnba60eggbu)g :)uah:6cgo9)a6:ocaak96abc6 9
4   bx
dCcCOO6TcITI
    E E(N::r O8T 1I  6CBELB38:L ) 1 aB: 3tB 1uLli3:el B1v:te  uB:i lu 1li5t0l t:0 x 11956:0: 11:520260,::10 2,A6p :r2f2,2  l2, Aap7gr As pr2 0720 x12 271 7
r
F78N2I011

 :IO NI:REFNOAFL:  TO :EK    B LR3T 1  L B8:L 3 1B1L6:38I 1n@ iI0tnix9ia8lti0izazg i0i nI00ni
se  tirinaugl nirtziumnitneig sm reeu rnvsetiricvemise c
rvFIsN
 : OiIc:NeF s O
     SI Nta FOSr:tt a  rto t   Stionta itrin ti sett ros vieincrivei ts cste de_rstsvidvc_ce sv 
dFI tN
  _OIsNv:F cO   :
  I FiN n FFOis:ihn   i st ho F tiinnoi itsinh s ittero v seiircniveti s cstede vcssvtdvi_ccs e 
N   Itd
 : IOsN:vF c O 
    SI N tFa SrOt:t  atr  ot   tSinot iaritnt  istet rosv ieicnreiv tic opeste oerevptdi_ceefed a_softpa tse
_t dIN
:fFOIas:Nt F O  
   I FNi  FnFOisi: hn  it soh F  itinno iistih ns etiort  viisecenr iviotc petse ereodpvi_tecfaee sd_otp fta
_FIet dN
  fIaON:sF t O  
   IBLN 3 F1O ::B  L I 3ni 1t:Bi L3Ial1:nii zitInniigal tiiBLazli3i2nzg
L3 IBgLNF3 BO2:
N F  2
    ICON:oFr e O: _  2 C oT rE CeEoS_Mr3eC T__1EOEP TSTEMEECESD_OM_PRCT_EETOEPUTRD_ENE_REDETN_URTERRTNY_U_DERONNN_TEREN Y_T
N:E ONN_EFD OO
      I N
zBIOBLN: F3 1O: :    IBL ni3 1Bt:Li3a l1Iin:z iItenidialt BiiLaz3eli2d 
  edIL N3B2FOL
N  2I 
 XF IOE:NX F OI :T    EB LX3 I1ET
:3BILIT3N B1FOL
 N F 
    IO b:NFl  O3 :1 _ t bol  _31bkel_rt3on1_e_klteo:r_ knkeeerrl:nn eelkl:_e rrn0Beesurl_mnree_els_eunremtrse_yu em=ent_ rR0eeyaxnt l=1rt ye e0k=0x G0 001xe
eFEI00 NF1
 tIaO:m0i N lF Oy  : bCl0o n0
1 r 3oIbl1 lNjFeuOlrm3 1p3 s j:2tuo mp m scE  tLf go  2=b:   l0E0LL232:4K
t  en jLutrKmy pse  n
2tro y EL
 : LK entry 
netif en ip 192.168.100.1 netmask 255.255.255.0 gw 192.168.100.254
calling apps_init()
HDMITx_HPD=False
------------can't find tmp/factory/video_rpc.bin
tv_system=25 mode=1
Set ACPU share memory
------------can't find tmp/factory/000BootParam.h
Default Power-Config
EEPROM: SIZE=16384, ADRESS_MODE=2, PAGE_WRITE_SIZE=64, BUFFER_SIZE=16
PMIC is gmt,g2227
starting app rtkboot
---------------LOAD  NORMAL FW  TABLE ---------------
fw_desc_table_start = 0x00620000
fw_desc_table_ddr_base = 0x0x12418f70
[ERR] rtk_plat_prepare_fw_image:Signature() error!
---------------LOAD  NORMAL FW  TABLE ---------------
fw_desc_table_start = 0x00620000
fw_desc_table_ddr_base = 0x0x12418f70
[ERR] rtk_plat_prepare_fw_image:Signature() error!
---------------LOAD  GOLD  FW  TABLE ---------------
fw_desc_table_start = 0x00628000
fw_desc_table_ddr_base = 0x0x12418f70
[ERR] rtk_plat_prepare_fw_image:Signature() error!
entering main console loop
Realtek> starting app eeprom
starting app pmic
cmd_pmic_entry: set DC force PWM
pmic_testing returns 00
INIT: cpu 2, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2
INIT: cpu 3, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2
INIT: cpu 1, calling hook 0x22840 (slave_cpu_spin) at level 0x3ffff, flags 0x2

it seems to hang here...

with exit I can let it drop to the u-boot shell...

 

some random help

command list:
	net             : net toolbox
	page_alloc      : page allocator debug commands
	heap            : heap debug commands
	hexdump         : hexdump memory region
	help            : this list
	test            : test the command processor
	history         : command history
	bio             : block io debug commands
	novm            : page allocator (for devices without VM support) debug commands
	reboot          : soft reset
	poweroff        : powerdown
	version         : print version
	sysparam        : commands for manipulating system parameters
	dw              : display memory in words
	dh              : display memory in halfwords
	db              : display memory in bytes
	mw              : modify word of memory
	mh              : modify halfword of memory
	mb              : modify byte of memory
	fw              : fill range of memory by word
	fh              : fill range of memory by halfword
	fb              : fill range of memory by byte
	mc              : copy a range of memory
	crash           : intentionally crash
	stackstomp      : intentionally overrun the stack
	mtest           : simple memory test
	chain           : chain load another binary
	sleep           : sleep number of seconds
	sleepm          : sleep number of milliseconds
	crc16           : crc16
	crc32           : crc32
	adler32         : adler32
	bench_cksum     : benchmark the checksum routines
	aes_test        : test AES encryption
	aes_bench       : bench AES encryption
	threads         : list kernel threads
	threadstats     : thread level statistics
	threadload      : toggle thread load display
	loady           : Y-MODEM through UART
	fdt             : Flat device tree commands
	pmic            : PMIC commands
	keyset          : for uart mp tool write secure key  to factory
	uart_write      : for uart mp tool write mac or sn
	fastboot        : fastboot command
	factory         : FACTORY sub system
	eeprom          : EEPROM commands
	boot            : platform boot command
	fatload         : fatload command
	usb             : usb command
	cache           : cache operation
	boot_part       : r/w boot partition x
	pwm             : Control PWM 0,1,2,3
	rpmb            : do some rpmb operation
	chip            : detect soc version
	bdinfo          : Board information
	rtknand         : rtk nand commands
	rtkspi          : rtk spi commands
	rtkemmc         : rtk emmc commands

'version':

version:
	arch:     ARM64
	platform: RTD1295
	target:   RTD1295
	project:  RTD1295
	buildid:  81C95C5_MON_SEP__4_01:41:29_CST_2017

 

 

hmm it seems that this one doesn't understand ext4 as a bunch of old crappy bootloaders.. right?

Link to comment
Share on other sites

17 hours ago, chwe said:

hmm it seems that this one doesn't understand ext4 as a bunch of old crappy bootloaders.. right?

Yes, I think so.

 

In theory it could be possible to build this stuff from the repo of the banana-pi-folks and, as the source code is there, upgrade the code base to a newer u-boot. But this will very likely not happen in practice for several reasons. The platform suffers from poor (nearly no) documentation and the amount of work to even try this, is ridiculously high in contrast to the expected result.

 

I will continue to upgrade the the 4.9.y-repo (as this is not that much work) and report , if I really find something new.

Link to comment
Share on other sites

this thing has two bootloaders right? u-boot 1 (32bit) and u-boot 2 (64bit).. cause the one found on their Repo (seems to be a 2015 version) should understand ext4:

https://github.com/BPI-SINOVOIP/BPI-W2-bsp/blob/d5eea07747a56fe1c12ce6456a26667191996b72/u-boot-rt/include/configs/rtd1295_common.h#L293-L301

 

It learned it on Sep 13, 2018 (https://github.com/BPI-SINOVOIP/BPI-W2-bsp/commit/c8e8e9cea4e84934744a100727975cd912f1fc73#diff-415658f491a52b802eb9ee6bbb94501a)

 

so likely that my version has an outdated one preloaded. I really didn't follow the RTD stuff a while.. It's similar outdated to the MTK on the R2 in the beginnings.. But at least.. Mediatek did their homework to upstream u-boot and kerneldrivers so that you get a 'fully' working board with unpatched mainline kernel.

 

 

Link to comment
Share on other sites

On 6/18/2019 at 8:43 PM, chwe said:

this thing has two bootloaders right? u-boot 1 (32bit) and u-boot 2 (64bit).. cause the one found on their Repo (seems to be a 2015 version) should understand ext4:

 

Yes it should, the question is, if it reliably does.

For instance I could not figure out, why fatload does not work in the first u-boot-loader on my lake1.

 

Another interesting folder in the repo mentioned above is this one:

https://github.com/BPI-SINOVOIP/BPI-W2-bsp/tree/master/u-boot-rt/examples/flash_writer

 

It seems, that the loader for SPI-flash is created here, but for obvious reasons I can not test it. As crazy at it sounds, currently I am under the impression, that the only profound way to bring linux to these realtek-boxes would be to solder spi-flash on it and then find a way to build a sufficient loader. But of course I am aware, that this might be a totally wrong idea.

 

BTW, I just revisited parts of the 4.9.-kernel-repo and had to find (again), that parts of the code are different to the linux-master-tree (of 4.9.y), although they are not marked with #ifdef RTK_... or similar things. That does not make things easier ;)

Link to comment
Share on other sites

On 4/28/2019 at 4:44 PM, Staars said:

Okay, my first try with the addition of SPI-Flash did not work, which may have many different reasons:

 

IMG_4153.thumb.jpeg.2fccbff3252110614958ac6a9edd8615.jpeg

 

1. The wrong chip. I only had 64mb-chips at hand and ordered the version, that chwe mentioned (winbond 25q128jvsq).

2. Defective chip, bad soldering (did resolder twice)?

3. The need to add or remove a resistor somewhere?

4. A complete misconception on my side, how the things are working on this platform. I did not find any documentation regarding this topic.

 

The early boot log on my bricked device looks like this:


C1:80000000
C2
+
C3hswitch frequency to 0x00000046
frequency divider is 0x00000080
switch frequency to 0x00000046
frequency divider is 0x00000004
switch to SDR 8 bit
switch bus width to 0x00000008 bits success
1
hwsetting size: 00000708
C4
f 
5-5
Goto FSBL: 0x10100000
<=============================================>
fsbl_main: sys_secure_type = 0x0000DAAA
fsbl_main: sys_boot_type = 0x00000002
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000
OTP verification fail
ret = 0x00000095
Return from FSBL(ret = 0x00000095)
00000000C7
C1:80000000
C2
+uu3-1

When I press one of the hidden buttons I get this:


C1:80000000
C2
+uu3-1

My assumption was, that '+uu3-1' looks for SPI, but that may be completely wrong.

 

The behaviour before and after soldering was completely identical. I could not reach the SPI-prompt with ctrl-q nor see any positive response with the KYLIN-RECOVERY-TOOL in Win 10.

 

I wait for the new chips.

 

@Staars, I was experimenting with the button today:

 

PRESSED BUTTON:
 

C1:80000000
C2
?uu3-1

 

SHORTED EMMC:
 

C1:80000000
C2
?
C3hswitch frequency to 0x00000046
frequency divider is 0x00000080
Response timeout
Response timeout
Response timeout
Response timeout

PRESSED BUTTON + USB CONNECTED:
 

C1:80000000
C2
?uu3-1
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST

and lsusb:

Bus 002 Device 009: ID 0bda:1195 Realtek Semiconductor Corp.

So if I understand it correctly, button is only for USB OTG recovery and you have to have both USB and power adapter connected.

Link to comment
Share on other sites

Hmm, interesting ... sounds reasonable .

 

Can you test, if you can fatload from an USB3-stick (maybe you can already answer this)? If I read your post correctly,  you used a USB2-stick?

 

Meanwhile I will take a look, if I find traces of your terminal input in the u-boot-sources.

 

 

 

Link to comment
Share on other sites

I don't have any USB3 stick :\

 

I wiped first 4MB from eMMC:

C1:80000000
C2
?
C3hswitch frequency to 0x00000046
frequency divider is 0x00000080
switch frequency to 0x00000046
frequency divider is 0x00000004
switch to SDR 8 bit
switch bus width to 0x00000008 bits success
0000001�
C1:80000000
C2
?uu3-1

 

Link to comment
Share on other sites

I was too fast with deleting eMMC... Recovery fails with:

?uu3-1
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
[GO]
ST
H
V_OK
Malloc DDR

Probably the image is not correct. Maybe I'll need to find a way how to flash my eMMC backup back...

Link to comment
Share on other sites

I've had no luck with the recovery using USB OTG method (https://androidpctv.com/firmware-update-guide-for-tv-box-with-soc-realtek/). I haven't found an image for Zidoo X8/X9S suitable for using with "kylin usb mp tool" (one which contains layout.txt) and images for other devices fail with error above.

 

I managed to find CMD, CLK and perhaps DAT0 pins of eMMC and written some deleted parts but the write is unreliable, probably because RTD is messing with the lines while I'm writing with an SD card reader. I'll explore this method more tomorrow. This is my best option currently.

 

My last option is to reflow the eMMC but I'd like to avoid this because the ball pitch on eMMCs is very very fine so I would need to train on a few test subjects which takes a lot of time.

 

But I'm still not loosing hope.

Link to comment
Share on other sites

@Staars, if I understand it correctly there are two things on BPI-W2 to control the boot:

1. SW4 as described here: http://forum.banana-pi.org/t/how-to-make-a-sd-card-with-bootloader/5767 connected to BOOTSEL/BOOT_SEL pin (see https://drive.google.com/file/d/1Xn7-nlY0kVJacnRh_EpuS5Fw92_b6qqu/view)

Quote

0. boot from emmc.

1. boot from SPI + SD card.

and

2. "USB" button to boot into USB OTG to recover using "kylin usb mp tool"

 

It seems to me that on our boards we only have the "USB" button and we need to find a way to switch BOOT_SEL line, otherwise we won't be able to boot from SPI. Do you maybe have some friend with X-ray to trace the line to AA12 pin :D

 

Second question is what to write to our SPI? I have tried this guide http://forum.banana-pi.org/t/bananapi-w2-ubuntu-18-04-new-image-release-2018-09-17/6790 but it fails with on board with the same "Malloc DDR"

 

Maybe someone can provide SPI flash dump? @chwe ?

Link to comment
Share on other sites

Wow, your solder skills are some levels above mine :thumbup:.

 

The funny thing is, that I could x-ray my box. Who told you that :ph34r:? Maybe I do it next week.

 

I am not at my PC atm, so I am not exactly shure from memory, but you need to write some kind (the correct) hwsetting.bin at the start of the SPI and then this magical drvboot.bin.exe-thing (name is probably incorrect).  There are two versions for emmc and SPI. I tried it on my lake1 (obviously emmc), but due to the encryption the box refused to boot (very early, when hwsetting should get loaded).

 

You might be right with your assumption, the uu3-1 is the switch to USB. As your box has SPI (?), this would mean no automagically fallback to SPI.

Can you reach the SPI-prompt with ctrl-q (or so)?

Link to comment
Share on other sites

So, I've been trying to see if I could use this to coax a copy of this to run on my WD MyCloud home. I originally got it for a local business, but the built-in samba implementation sucked so bad it wouldn't work for them (It was hard-coded to only allow 5 'users' concurrently, but what it meant was 5 connections. 2 users easily hit that limit...) so I replaced it with a small x86 box. In the meantime, I want to use this as once it's cleaned up it should work very well, and the box I gave them was overkill (8 gigs of ram for )

 

I have been using @danman 's fatload commands to see if I could coax it to boot to the USB stick (The WD mycloud stores the OS on the hard drive, which I'm keeping unplugged while this is going on). I tried out all the existing DTBs in the existing build instructions from the first post, but it always failed: I've also tried to create my own DTB using the normal OS, but I had to basically tar /sys/firmware/devicetree/base and use dtc on my build host because I couldn't find a way to run dtc on the android build it comes with. Sadly, that also fails, so I'm not really sure what to try next.

 

Here's the full bootlog if it helps anyone. I'm somewhat new to embedded development, so.

 

C1:80000000
C2
?
C3h
hwsetting size: 000005C0
C4
f
5-5
Goto FSBL: 0x10100000
<=============================================>
fsbl_main: sys_secure_type = 0x0000BEEE
fsbl_main: sys_boot_type = 0x00000001
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000
sys_hwsetting_size:00000600
sys_bootcode_size:00067440
sys_secure_fsbl_size:00010B00
sys_secure_os_size:00000000
sys_bl31_size:00005040
sys_rsa_key_fw_size:00000000
sys_rsa_key_tee_size:00000000
sys_rescue_size:00026360

HwSetting:
hwsetting_blk_no:88120800
hwsetting_total_size:00000680
hwsetting_blk_count:00000680

Bootcode:
bootcode_blk_no:88120E80
bootcode_total_size:00067460
bootcode_blk_count:00067460

FSBL:
secure_fsbl_blk_no:881882E0
secure_fsbl_total_size:00010B20
secure_fsbl_blk_count:00010B20

TEE OS:
secure_os_blk_no:88198E00
secure_os_total_size:00000000
secure_os_blk_count:00000000

BL31:
bl31_blk_no:88198E00
bl31_total_size:00005060
bl31_blk_count:00005060

RSA Key Fw:
rsa_key_fw_blk_no:8819DE60
rsa_key_fw_total_size:00000000
rsa_key_fw_blk_count:00000000

RSA Key TEE:
rsa_key_tee_blk_no:8819DE60
rsa_key_tee_total_size:00000000
rsa_key_tee_blk_count:00000000

Rescue:
rescue_blk_no:8819DE60
rescue_total_size:00026380
rescue_blk_count:00026380
********** FW_TYPE_BOOTCODE **********
fwInfo->fwType: 00000001
fwInfo->isGolden: 00000001
fwInfo->ddrReadAddr: 00520000
fwInfo->ddrDestAddr: 00020000
fwInfo->flashType: 00000001
fwInfo->flashUnitSize: 00000001
fwInfo->flashOffset: 88120E80
fwInfo->dataSize: 00067460
body_size:00067440
flash_unit_no:88120E80
flash_unit_count:00067460
real_size:00067418
sha256 Fw
j bootcode jump address:00020000
64b


4.1.4

CPU  : Cortex-A53 quad core - AARCH32
Board: Realtek QA Board
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
DRAM:  0 Bytes
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
nor flash id [0x00c84014]
sector 256k en: 0
sector  64k en: 1
sector  32k en: 1
sector   4k en: 1
page_program  : 1
max capacity  : 0x00100000
spi type name : GD25Q80C_08Mbit
[SATA] enable SATA interface
[SATA] spread-spectrum disable
Factory: NOR
Factory: pp:0, seq#:0x1e, size:0x2400
------------can't find tmp/factory/000BootParam.h
Set HDMI TX OFF
In:    serial
Out:   serial
Err:   serial
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
*** Reboot-Action invalid ***
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery
======== Checking into android recovery ====

(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
USB1:   USB XHCI 1.10
scanning bus 1 for devices... Unknown request , typeReq = 0x200c
2 USB Device(s) found
USB2:   USB XHCI 1.10
scanning bus 2 for devices... Unknown request , typeReq = 0x200c
1 USB Device(s) found
       scanning usb for storage devices... Enter is_pmbr_valid
Warning: failed to 0xEE type in MBR
1 Storage Device(s) found

1: Hub,  USB Revision 2.0
 - u-boot EHCI Host Controller
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

2: Hub,  USB Revision 3.0
 - u-boot XHCI Host Controller
 - Class: Hub
 - PacketSize: 9  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

3: Mass Storage,  USB Revision 2.0
 - TREK TDMINIG4 6e032d545fd578
 - Class: (from Interface) Mass Storage
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0a16  Product 0x1208 Version 1.0
   Configuration: 1
   - Interfaces: 1 Bus Powered 98mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 3
     - Class Mass Storage, Transp. SCSI, Bulk only
     - Endpoint 1 Out Bulk MaxPacket 512
     - Endpoint 2 In Bulk MaxPacket 512
     - Endpoint 3 In Interrupt MaxPacket 64 Interval 8ms

4: Hub,  USB Revision 3.0
 - u-boot XHCI Host Controller
 - Class: Hub
 - PacketSize: 9  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

reading boot/vmlinuz-4.9.181-rtd1295
Filesize: 8249990 bytes
8249990 bytes
Size: 8249990, got: 8249990

8249990 bytes read (take 524ms)
reading boot/dtb-4.9.181-rtd1295/realtek/rtd129x/rtd-1295-wd-mycloud-home.dtb
Filesize: 54083 bytes
54083 bytes
Size: 54083, got: 54083

54083 bytes read (take 194ms)
*****************************************
factory {
        bna = "0";
        cbr = "B";
        nbr = "B";
        ver = "4.1.4";
        ethaddr = "[CENSORED]";
        ipaddr = "192.168.100.1";
        serial = "[CENSORED]";
        bootstate = "3";
};
*****************************************


EXPORT ENV AT 0x10000000, ENV size info:0x00002000,0x00001ffc,0x00000004
rtk_preload_bootimages_spi : header info
 0x00000600 0x00067440 0x00010b00 0x00000000
 0x00005040 0x00000000 0x00000000 0x00026360
 0x00000000
rtk_preload_bootimages_spi : load U-Boot 64 from 0x8819de60 to 0x01500000 with size 0x00026360
rtk_preload_bootimages_spi : load BL31 from 0x88198e00 to 0x10120000 with size 0x00005040
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x00028000
Jumping to 2nd bootloader...


U-Boot 2015.07-g5a4a178-dirty (Jun 22 2016 - 11:33:46 +0800)

CPU  : Cortex-A53 Quad Core
Board: Realtek QA Board
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
[ERR] Fall back to using CONFIG_SYS_RAM_DCU1_SIZE
DRAM:  1 GiB
mapping memory 0x20000000-0x40000000 non-cached
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
Unknown command 'usb' - try 'help'
rtk_plat_set_fw not port yet, use default configs
Not raw Image, Starting Decompress Image.gz...


## Flattened Device Tree blob at 01f00000
   Booting using the fdt blob at 0x1f00000
   Using Device Tree in place at 0000000001f00000, end 0000000001f10342
Bring UP slave CPUs

Starting Kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.9.181-rtd1295 (root@build-virtual-machine) (gcc version 7.4.1 20181213 [linaro-7.4-2019.02 revision 56ec6f6b99cc167ff0c2f8e1a2eed33b1edc85d4] (Linaro GCC 7.4-2019.02) ) #1 SMP PREEMPT Thu Jun 20 20:31:22 NDT 2019
[    0.000000] Boot CPU: AArch64 Processor [410fd034]
[    0.000000] DT: logo_start_addr 0x0, size 0x0
[    0.000000] DT: of_cma_info.region_enable 1
[    0.000000] DT: saving_section_page_table 0
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000098007800 (options '')
[    0.000000] bootconsole [uart8250] enabled
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] cma: fdt region 0
[    0.000000] cma: size 0x0000000002000000, base 0x0000000020000000, fixed(1)
[    0.000000] cma: Reserved 32 MiB at 0x0000000020000000
[    0.000000] missing or invalid resume-entry-addr property
[    0.000000] missing or invalid resume-entry-addr property
[    0.000000] missing or invalid resume-entry-addr property
[    0.000000] percpu: Embedded 22 pages/cpu s53144 r8192 d28776 u90112
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: enabling workaround for ARM erratum 845719
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 257536
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x98007800 console=ttyS0,115200 noinitrd root=/dev/mmcblk0p1 rootfs=ext4 init=/sbin/init
[    0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] Memory: 971720K/1046528K available (12540K kernel code, 1682K rwdata, 3612K rodata, 1152K init, 488K bss, 42040K reserved, 32768K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     modules : 0xffffff8000000000 - 0xffffff8008000000   (   128 MB)
[    0.000000]     vmalloc : 0xffffff8008000000 - 0xffffffbebfff0000   (   250 GB)
[    0.000000]       .text : 0xffffff8008280000 - 0xffffff8008ec0000   ( 12544 KB)
[    0.000000]     .rodata : 0xffffff8008ec0000 - 0xffffff8009250000   (  3648 KB)
[    0.000000]       .init : 0xffffff8009250000 - 0xffffff8009370000   (  1152 KB)
[    0.000000]       .data : 0xffffff8009370000 - 0xffffff8009514a00   (  1683 KB)
[    0.000000]        .bss : 0xffffff8009514a00 - 0xffffff800958eb7c   (   489 KB)
[    0.000000]     fixed   : 0xffffffbefe7fb000 - 0xffffffbefec00000   (  4116 KB)
[    0.000000]     PCI I/O : 0xffffffbefee00000 - 0xffffffbeffe00000   (    16 MB)
[    0.000000]     vmemmap : 0xffffffbf00000000 - 0xffffffc000000000   (     4 GB maximum)
[    0.000000]               0xffffffbf00000000 - 0xffffffbf01000000   (    16 MB actual)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc040000000   (  1024 MB)
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=1.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=1
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] arm_arch_timer: Architected cp15 timer(s) running at 27.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x63a1e71a3, max_idle_ns: 440795203123 ns
[    0.000006] sched_clock: 56 bits at 27MHz, resolution 37ns, wraps every 4398046511093ns
[    0.009706] rmem_count: 1
[    0.013628]
[    0.015302] rsvmem_remap 143, rmem->name ramoops_mem
[    0.021877] rsvmem_remap 147, no compatible prop
[    0.028461] Console: colour dummy device 80x25
[    0.033499] Calibrating delay loop (skipped), value calculated using timer frequency.. 54.00 BogoMIPS (lpj=108000)
[    0.045180] pid_max: default: 32768 minimum: 301
[    0.050554] Security Framework initialized
[    0.055184] SELinux:  Initializing.
[    0.059259] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.066824] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.075789] ftrace: allocating 40059 entries in 157 pages
[    0.199751] sched-energy: CPU device node has no sched-energy-costs
[    0.206866] Invalid sched_group_energy for CPU0
[    0.211988] CPU0: update cpu_capacity 1024
[    0.216624] ASID allocator initialised with 32768 entries
[    0.258531] EFI services will not be available.
[    0.271710] Brought up 1 CPUs
[    0.275055] SMP: Total of 1 processors activated.
[    0.280392] CPU features: detected feature: 32-bit EL0 Support
[    0.286984] CPU features: detected feature: Kernel page table isolation (KPTI)
[    0.298516] CPU: All CPU(s) started at EL2
[    0.303163] alternatives: patching kernel code
[    0.308441] Invalid sched_group_energy for CPU0
[    0.313567] CPU0: update max cpu_capacity 1024
[    0.318586] Invalid sched_group_energy for Cluster0
[    0.324868] devtmpfs: initialized
[    0.353036] DMI not present or invalid.
[    0.357847] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.368897] futex hash table entries: 256 (order: 3, 32768 bytes)
[    0.377953] pinctrl core: initialized pinctrl subsystem
[    0.386152] NET: Registered protocol family 16
[    0.403398] cpuidle: using governor ladder
[    0.420094] cpuidle: using governor menu
[    0.424814] vdso: 2 pages (1 code @ ffffff8008ec7000, 1 data @ ffffff8009374000)
[    0.433180] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.442459] DMA: preallocated 256 KiB pool for atomic allocations
[    0.450050] rst-control : base ffffff800804b600, offset 0xb4
[    0.456548] ****** rtk_lockapi_init 620, chip: id=0x00000000, revision=0x00010000
[    0.467086] gpiochip_add_data: GPIOs 101..135 (rtk_iso_gpio) failed to register
[    0.475839] [drivers/gpio/gpio-rtd129x.c]  rtk_gpio_probe  line: 844
[    0.485021] [GPIO] No default gpio need to set
[    0.491235] gpiochip_add_data: GPIOs 0..100 (rtk_misc_gpio) failed to register
[    0.499720] [drivers/gpio/gpio-rtd129x.c]  rtk_gpio_probe  line: 844
[    0.512526] [GPIO] set_default_gpio: Could not get gpio from of
[    0.519323] [GPIO] set_default_gpio: Could not get gpio from of
[    0.529771] [RTK_SB2_DBG] Info 0x10000
[    0.534630] [RTK_SB2_DBG] memory monitor 0x98013b00 - 0x98013c00
[    0.541451] [RTK_SB2_DBG] initialized
[    0.670357] ACPI: Interpreter disabled.
[    0.675161] Unable to handle kernel NULL pointer dereference at virtual address 000000d4
[    0.684413] [00000000000000d4] user address but active_mm is swapper
[    0.691630] Internal error: Oops: 96000045 [#1] PREEMPT SMP
[    0.697905] Modules linked in:
[    0.701349] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.181-rtd1295 #1
[    0.708892] Hardware name: Realtek_RTD1295 (DT)
[    0.713991] task: ffffffc0222dcd80 task.stack: ffffffc0222e0000
[    0.720664] PC is at acpu_set_flag+0x50/0xb0
[    0.725470] LR is at acpu_set_flag+0x3c/0xb0
[    0.730276] pc : [<ffffff8008762a70>] lr : [<ffffff8008762a5c>] pstate: 80000045
[    0.738602] sp : ffffffc0222e3d00
[    0.742328] x29: ffffffc0222e3d00 x28: ffffff8009324c90
[    0.748313] x27: 0000000000000005 x26: ffffff80092be7b0
[    0.754297] x25: ffffff8009518000 x24: ffffff8009250468
[    0.760282] x23: ffffff8009242330 x22: ffffff800956c000
[    0.766264] x21: 00000000000000d4 x20: 0000000000000000
[    0.772245] x19: 0000000000000000 x18: 0000000000000000
[    0.778228] x17: 0000000000000000 x16: 000000000000000e
[    0.784210] x15: ffffffffffffffff x14: ffffffffffffffff
[    0.790195] x13: ffffffffffffffff x12: 0000000000000008
[    0.796177] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
[    0.802160] x9 : fefefefefefeff64 x8 : 7f7f7f7f7f7f7f7f
[    0.808144] x7 : 616e716f6e737460 x6 : 0080808080808080
[    0.814126] x5 : 0000000000000000 x4 : ffffffffffffffff
[    0.820110] x3 : 0000000000000000 x2 : 00000000000000d4
[    0.826090] x1 : 0000000000000200 x0 : 0000000000000000
[    0.832074]
[    0.832074] SP: 0xffffffc0222e3c80:
[    0.837664] 3c80  0956c000 ffffff80 09242330 ffffff80 09250468 ffffff80 09518000 ffffff80
[    0.846904] 3ca0  092be7b0 ffffff80 00000005 00000000 09324c90 ffffff80 222e3d00 ffffffc0
[    0.856140] 3cc0  08762a5c ffffff80 222e3d00 ffffffc0 08762a70 ffffff80 80000045 00000000
[    0.865372] 3ce0  222e3d00 ffffffc0 08762a4c ffffff80 ffffffff ffffffff 08762a5c ffffff80
[    0.874608] 3d00  222e3d30 ffffffc0 0928a820 ffffff80 0928a7f0 ffffff80 090fa000 ffffff80
[    0.883840] 3d20  0956c760 ffffff80 08678624 ffffff80 222e3dd0 ffffffc0 08283c3c ffffff80
[    0.893077] 3d40  0928a7f0 ffffff80 00000000 00000000 222dcd80 ffffffc0 092be7d0 ffffff80
[    0.902313] 3d60  09242330 ffffff80 09250468 ffffff80 09518000 ffffff80 092be7b0 ffffff80
[    0.911569]
[    0.911569] X29: 0xffffffc0222e3c80:
[    0.917256] 3c80  0956c000 ffffff80 09242330 ffffff80 09250468 ffffff80 09518000 ffffff80
[    0.926493] 3ca0  092be7b0 ffffff80 00000005 00000000 09324c90 ffffff80 222e3d00 ffffffc0
[    0.935729] 3cc0  08762a5c ffffff80 222e3d00 ffffffc0 08762a70 ffffff80 80000045 00000000
[    0.944964] 3ce0  222e3d00 ffffffc0 08762a4c ffffff80 ffffffff ffffffff 08762a5c ffffff80
[    0.954199] 3d00  222e3d30 ffffffc0 0928a820 ffffff80 0928a7f0 ffffff80 090fa000 ffffff80
[    0.963433] 3d20  0956c760 ffffff80 08678624 ffffff80 222e3dd0 ffffffc0 08283c3c ffffff80
[    0.972668] 3d40  0928a7f0 ffffff80 00000000 00000000 222dcd80 ffffffc0 092be7d0 ffffff80
[    0.981901] 3d60  09242330 ffffff80 09250468 ffffff80 09518000 ffffff80 092be7b0 ffffff80
[    0.991137]
[    0.992811] Process swapper/0 (pid: 1, stack limit = 0xffffffc0222e0000)
[    1.000355] Stack: (0xffffffc0222e3d00 to 0xffffffc0222e4000)
[    1.006829] 3d00: ffffffc0222e3d30 ffffff800928a820 ffffff800928a7f0 ffffff80090fa000
[    1.015650] 3d20: ffffff800956c760 ffffff8008678624 ffffffc0222e3dd0 ffffff8008283c3c
[    1.024472] 3d40: ffffff800928a7f0 0000000000000000 ffffffc0222dcd80 ffffff80092be7d0
[    1.033293] 3d60: ffffff8009242330 ffffff8009250468 ffffff8009518000 ffffff80092be7b0
[    1.042113] 3d80: 0000000000000005 ffffff8009324c90 ffffff80092890b4 0000000000000000
[    1.050934] 3da0: ffffffc0222dcd80 ffffff80092be7d0 ffffff8009242330 ffffff8009250468
[    1.059755] 3dc0: ffffffc0222e3dd0 ffffff8008283c3c ffffffc0222e3e40 ffffff8009250cec
[    1.068575] 3de0: 00000000000001aa ffffff8009518000 0000000000000004 ffffff80092be7b0
[    1.077396] 3e00: 0000000000000000 ffffff8009324b80 ffffff80093913c8 0000000000000000
[    1.086215] 3e20: 0000000000000000 ffffff80090a8d78 0000000400000004 ffffff80090a1058
[    1.095035] 3e40: ffffffc0222e3ea0 ffffff8008eaced0 ffffff8008eaceb8 0000000000000000
[    1.103855] 3e60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.112675] 3e80: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.121495] 3ea0: 0000000000000000 ffffff8008283980 ffffff8008eaceb8 0000000000000000
[    1.130314] 3ec0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.139135] 3ee0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.147956] 3f00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.156776] 3f20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.165595] 3f40: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.174416] 3f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.183237] 3f80: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.192055] 3fa0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.200875] 3fc0: 0000000000000000 0000000000000005 0000000000000000 0000000000000000
[    1.209696] 3fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    1.218514] Call trace:
[    1.221266] Exception stack(0xffffffc0222e3b30 to 0xffffffc0222e3c60)
[    1.228517] 3b20:                                   0000000000000000 0000007fffffffff
[    1.237339] 3b40: ffffffc0222e3d00 ffffff8008762a70 ffffff80095685d8 0000000000000001
[    1.246158] 3b60: ffffffc02222f590 ffffff8009555000 0000000080000000 00000000024000c0
[    1.254979] 3b80: 0000000000000040 ffffff80092be7b0 ffffffc0222e3bb0 ffffff8008eb3454
[    1.263800] 3ba0: 0000000000000040 ffffffc02229a8f0 ffffffc0222e3bd0 ffffff8008676ee8
[    1.272620] 3bc0: ffffff80095685d8 0000000000000001 0000000000000000 0000000000000200
[    1.281441] 3be0: 00000000000000d4 0000000000000000 ffffffffffffffff 0000000000000000
[    1.290262] 3c00: 0080808080808080 616e716f6e737460 7f7f7f7f7f7f7f7f fefefefefefeff64
[    1.299083] 3c20: 7f7f7f7f7f7f7f7f 0101010101010101 0000000000000008 ffffffffffffffff
[    1.307903] 3c40: ffffffffffffffff ffffffffffffffff 000000000000000e 0000000000000000
[    1.316722] [<ffffff8008762a70>] acpu_set_flag+0x50/0xb0
[    1.322707] [<ffffff800928a820>] rtk_suspend_init+0x30/0x80c
[    1.329083] [<ffffff8008283c3c>] do_one_initcall+0x44/0x130
[    1.335362] [<ffffff8009250cec>] kernel_init_freeable+0x190/0x234
[    1.342228] [<ffffff8008eaced0>] kernel_init+0x18/0x108
[    1.348112] [<ffffff8008283980>] ret_from_fork+0x10/0x50
[    1.354096] Code: d503201f 14000001 d503201f 52804001 (b90002a1)
[    1.360962] ---[ end trace 5d1bbd3218d7a1df ]---
[    1.366290] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[    1.366290]
[    1.376597] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[    1.376597]

Interestingly, if I used the built image and just DD'd it to a flash drive it would be unable to use fatload because the fat partition is oddly set up. I created a new fat32 partition on windows, then rsynced the files to the new partition and fatload works (Although linux isn't happy for some reason).

 

Here's my bootcmd if anyone was curious:

 

usb start && fatload usb 0:1 $kernel_loadaddr boot/vmlinuz-4.9.181-rtd1295 && fatload usb 0:1 $fdt_loadaddr boot/dtb-4.9.181-rtd1295/realtek/rtd129x/rtd-1295-wd-mycloud-home.dtb && env set bootargs earlycon=uart8250,mmio32,0x98007800 console=ttyS0,115200 noinitrd root=/dev/mmcblk0p1 rootfs=ext4  init=/sbin/init && b2ndbc; bootr

If anyone wants I can also upload the devicetree tar (or the dts / dtb): When compiling the DTS I did get a LOT of warnings, so I'm not sure if that's normal. I also noticed when trying out different dtb files that the kernel would panic sooner or later: Some got as far as 9 seconds in. Not sure if that's good or bad though.

Link to comment
Share on other sites

58 minutes ago, danman said:

Ctrl+Q goes to this:

 


C1:�
C1:80000000
C2
?
C1:80000000
C2
?
d/g/r>�
d/g/r>

What is it good for?

Honestly? Not sure. I just copied the serial log, and each boot has it.

 

4 minutes ago, danman said:

Hi @ShaRose, have you tried to use the original DTB? Extract it from original system and use with compiled kernel...

I wasn't able to find it: I'm not sure if it's embedded in some archive however. (which thinking about it, it may be in the u boot version of ramfs: I'll look for that later).

Link to comment
Share on other sites

2 hours ago, danman said:

What is it good for?

I think, that looks good!

 

Please try to find the further information in the forums of zidoo and bananapi-w2, there is more than one thread about it.

I will assist, if you need help when I am back home.

Link to comment
Share on other sites

5 hours ago, Staars said:

Can You upload this? I‘d like to take a look.

I'm currently running binwalk over all the system partitions (Everything but the data) to see if I can find myself an official dtb: mine includes a bunch of stuff that isn't needed due to how it was made, including that serial number I censored out. If I get an official one, I'll see if it can boot, but either way I'll upload it.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...

Important Information

Terms of Use - Privacy Policy - Guidelines