Closed hexdump0815 closed 3 years ago
hexdump0815
commented
3 years ago here are my steps for disassembly and reassembly - original bl31 case: https://github.com/hexdump0815/u-boot-misc/blob/gxm-experiments/readme.gxl#L129-L144
mainline atf case: https://github.com/hexdump0815/u-boot-misc/blob/gxm-experiments/readme.gxl#L129-L142 and https://github.com/hexdump0815/u-boot-misc/blob/gxm-experiments/readme.gxl#L151-L153
atf is gxl atf v2.3
hexdump0815
commented
3 years ago i guess that potentially the problem is my u-boot, which maybe does not reflect the tv box hardware good enough ... i did the same procedure using the khadas vim2 defconfig and got the same result (not working) ... then i simply used gxlimg to disassemble the original boot blocks and reassembled all of them again (i.e. using the original atf and u-boot) and that version then booted well (which looks like gxlimg is working as it should to me) ... tried that with atf replaced by the mainline atf and got the "Unhandled Exception in EL3." error again.
hexdump0815
commented
3 years ago oh oh oh - my fault :) ... i did the tests with my u-boot patches to make it useable with hdmi output and usb keyboard input ... as i often got noise from the serial input preventing it to boot i disabled the serial output in u-boot ... this of course will look like hanging on the serial console (i cannot connect a monitor on hdmi to see or not see the u-boot messages as there is currently the hdmi debug dongle to force booting from sd card) ... with my patches removed it boots well - better with the libretech-s912-pc_defconfig than with the vim2 defconfig (with that it does not find the sd card - i guess a dtb issue vim2 vs. this box) ... the "Unhandled Exception in EL3." error with v2.3 gxl atf still remains though ...
repk
commented
3 years ago Does not seem to be gxlimg bug here. But missing GXM support on mainline ATF.
hexdump0815
commented
3 years ago i just tried the same on another gxm box (nexbox a1) and got the same behaviour there. it looks some time back it was at least partially working on a khadas vim2: https://freenode.irclog.whitequark.org/linux-amlogic/2019-05-07#24557859
so maybe its time to close this issue ...
i just tried to apply the proven to work on gxl strategy to deconstruct the boot blocks via gxlimg, then replacing atf and u-boot by their mainline counterparts and reassembling all again via gxlimg to a gxm tv box (m8s pro), but sadly failed so far.
according to https://freenode.irclog.whitequark.org/linux-amlogic/2019-05-07 and https://freenode.irclog.whitequark.org/linux-amlogic/2019-05-08 it seems like others got it working already on a khadas vim2 ... so maybe i'm simply doing something wrong or something is a bit different in the case of this tv box.
before adding some log output i would first like to point you to a dump of the original boot blocks and my self built blocks at https://github.com/hexdump0815/u-boot-misc/blob/gxm-experiments/misc.gxl/dump-in.dd/s912-m8s-pro.dd.gz and https://github.com/hexdump0815/u-boot-misc/tree/gxm-experiments/misc.gxl/gxm-experiments (atf is with mainline atf, the other is using the extracted bl31)
ok, as promised some boot logs:
BL2 Built : 13:38:48, Mar 8 2017. gxl g8e12692 - xiaobo.gu@droid05
set vdd cpu_a to 1120 mv set vdd cpu_b to 1050 mv set vddee to 1000 mv Board ID = 11 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR4 chl: Rank0+1 @ 792MHz Rank0: 2048MB(auto)-2T-18 Rank1: 1024MB(auto)-2T-18 DataBus test pass! AddrBus test pass! -s Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000 New fip structure! Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600 Load bl31 from eMMC, src: 0x00020200, des: 0x10100000, size: 0x0001b400 Load bl33 from eMMC, src: 0x0003c200, des: 0x01000000, size: 0x000b6a00 NOTICE: BL3-1: v1.0(debug):866a5ea NOTICE: BL3-1: Built : 15:50:05, Feb 28 2017 aml log : bl31 normal boot ! mpu_config_enable:ok [Image: gxl_v1.1.3194-db501b7 2017-03-28 15:06:09 yun.cai@droid06] OPS=0x82 wdt: reset registers! ca ca 94 ff c 8d d7 43 6b a0 a9 20 [0.402551 Inits done] secure task start! high task start! low task start! INFO: BL3-1: Initializing runtime services WARNING: No OPTEE provided by BL2 boot loader ERROR: Error initializing runtime service opteed_fast INFO: BL3-1: Preparing for EL3 exit to normal world INFO: BL3-1: Next image address = 0x1000000 INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01-g90d33a6 (Apr 05 2017 - 18:18:17)
DRAM: 3 GiB Relocation Offset is: b6eba000 register usb cfg[0][1] = 00000000b7f5c298 [CANVAS]canvas init vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters vpu: clk_level = 7 vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300) vpp: vpp_init boot_device_flag : 1 Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc. init bus_cycle=6, bus_timing=7, system=5.0ns reset failed get_chip_type and ret:fffffffe get_chip_type and ret:fffffffe chip detect failed and ret:fffffffe nandphy_init failed and ret=0xfffffff1 MMC: aml_priv->desc_buf = 0x00000000b3eba790 aml_priv->desc_buf = 0x00000000b3ebcab0 SDIO Port B: 0, SDIO Port C: 1 emmc/sd response timeout, cmd8, status=0x1ff2800 emmc/sd response timeout, cmd55, status=0x1ff2800 init_part() 278: PART_TYPE_DOS [mmc_init] mmc init success dtb magic 5f4c4d41 Amlogic multi-dtb tool Multi dtb detected Multi dtb tool version: v2 . Support 2 dtbs. aml_dt soc: gxm platform: q20xrmii variant: 3g dtb 0 soc: gxm plat: q20xrmii vari: 2g dtb 1 soc: gxm plat: q20xrmii vari: 3g Find match dtb: 1 start dts,buffer=00000000b3ebf300,dt_addr=00000000b3ecb300 Amlogic multi-dtb tool Multi dtb detected Multi dtb tool version: v2 . Support 2 dtbs. aml_dt soc: gxm platform: q20xrmii variant: 3g dtb 0 soc: gxm plat: q20xrmii vari: 2g dtb 1 soc: gxm plat: q20xrmii vari: 3g Find match dtb: 1 parts: 10 00: logo 0000000002000000 1 01: recovery 0000000002000000 1 02: rsv 0000000000800000 1 03: tee 0000000000800000 1 04: crypt 0000000002000000 1 05: misc 0000000002000000 1 06: boot 0000000002000000 1 07: system 0000000080000000 1 08: cache 0000000020000000 2 09: data ffffffffffffffff 4 _check_ptbl_mbr()-815: MBR is OK! init_part() 278: PART_TYPE_DOS eMMC/TSD partition table have been checked OK! check pattern success mmc env offset: 0x27400000 In: serial Out: serial Err: serial reboot_mode=cold_boot hpd_state=1 [1080p60hz] is invalid for cvbs. set hdmitx VIC = 16 config HPLL = 2970000 HPLL: 0xc000027b config HPLL done j = 4 vid_clk_div = 1 hdmitx phy setting done hdmitx: set enc for VIC: 16 rx version is 1.4 or below div=10 hdmtix: set audio [store]To run cmd[emmc dtb_read 0x1000000 0x40000] _verify_dtb_checksum()-918: calc 6661ee77, store 6661ee77 _verify_dtb_checksum()-918: calc 6661ee77, store 6661ee77 dtb_read()-1040: total valid 2 dtb_read()-1107: do nothing Amlogic multi-dtb tool Multi dtb detected Multi dtb tool version: v2 . Support 2 dtbs. aml_dt soc: gxm platform: q20xrmii variant: 3g dtb 0 soc: gxm plat: q20xrmii vari: 2g dtb 1 soc: gxm plat: q20xrmii vari: 3g Find match dtb: 1 vpp: vpp_pq_load pq val error !!! Net: dwmac.c9410000amlkey_init() enter! [EFUSE_MSG]keynum is 4 [BL31]: tee size: 0
wipe_data=successful wipe_cache=successful upgrade_step=2 [OSD]load fb addr from dts [OSD]fb_addr for logo: 0x7f851000 [OSD]load fb addr from dts [OSD]fb_addr for logo: 0x7f851000 [CANVAS]addr=0x7f851000 width=3840, height=2160 amlkey_init() enter! amlkey_init() 71: already init! [EFUSE_MSG]keynum is 4 [BL31]: tee size: 0 [KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet [KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet gpio: pin GPIOAO_2 (gpio 102) value is 1 chanel error saradc - saradc sub-system
Usage: saradc saradc open - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range - return 0 if current value in the range of current channel
key1 = ba45ff00 key2 = ba4594ca time_out = f4a10 vs_irkey - irkey key_value1 key_value2 time_value
Usage: vs_irkey Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
GXM:BL1:dc8b51:76f1a5;FEAT:ADFC318C:0;POC:3;RCY:2;SD:0;READ:0;0.0;CHK:0; no sdio debug board detected TE: 321232
BL2 Built : 13:38:48, Mar 8 2017. gxl g8e12692 - xiaobo.gu@droid05
set vdd cpu_a to 1120 mv set vdd cpu_b to 1050 mv set vddee to 1000 mv Board ID = 11 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR4 chl: Rank0+1 @ 792MHz Rank0: 2048MB(auto)-2T-18 Rank1: 1024MB(auto)-2T-18 DataBus test pass! AddrBus test pass! Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000 Load bl30 from SD, src: 0x00010200, des: 0x01100000, size: 0x0000d600 Load bl31 from SD, src: 0x00020200, des: 0x10100000, size: 0x0000a400 Load bl33 from SD, src: 0x0002c200, des: 0x01000000, size: 0x000a5800 Unhandled Exception in EL3. x30 = 0x0000000010100020 x0 = 0x0000000010109358 x1 = 0x000000004100d030 x2 = 0x0000000005105810 x3 = 0x00000000ff00fff0 x4 = 0x00000000101093b0 x5 = 0x00000000101093b0 x6 = 0x0000000000000000 x7 = 0x0000000000000000 x8 = 0x0000000000000000 x9 = 0x0000000000000018 x10 = 0x0000000000000000 x11 = 0x0000000000000002 x12 = 0x0000000000000000 x13 = 0x0000000000000000 x14 = 0x0000000000000000 x15 = 0x0000000000000000 x16 = 0x0000000000000000 x17 = 0x0000000000000000 x18 = 0x0000000000000000 x19 = 0x0000000010100020 x20 = 0x00000000d900a5c0 x21 = 0x0f1e2d3c4b5a6978 x22 = 0x0000000000000000 x23 = 0x0000000000000000 x24 = 0x0000000000000003 x25 = 0x0000000000000000 x26 = 0x000000000000a000 x27 = 0x00000000d9046106 x28 = 0x0000000000000005 x29 = 0x00000000d90137a0 scr_el3 = 0x0000000000000400 sctlr_el3 = 0x0000000040c50838 cptr_el3 = 0x0000000000000000 tcr_el3 = 0x0000000000000000 daif = 0x00000000000003c0 mair_el3 = 0x44e048e000098aa4 spsr_el3 = 0x00000000400003cd elr_el3 = 0x0000000005105814 ttbr0_el3 = 0x00000000101be980 esr_el3 = 0x0000000002000000 far_el3 = 0x1c8d5b4a47160802 spsr_el1 = 0x0000000000000000 elr_el1 = 0x0000000000000000 spsr_abt = 0x0000000000000000 spsr_und = 0x0000000000000000 spsr_irq = 0x0000000000000000 spsr_fiq = 0x0000000000000000 sctlr_el1 = 0x0000000000c01800 actlr_el1 = 0x0000000000000000 cpacr_el1 = 0x0000000000300000 csselr_el1 = 0x0000000000000000 sp_el1 = 0x00000000d90137a0 esr_el1 = 0x0000000000000000 ttbr0_el1 = 0x0000000000000000 ttbr1_el1 = 0x0000000000000000 mair_el1 = 0x44e048e000098aa4 amair_el1 = 0x0000000000000000 tcr_el1 = 0x0000000000000000 tpidr_el1 = 0x0000000000000000 tpidr_el0 = 0x0000000000000000 tpidrro_el0 = 0x0000000000000000 par_el1 = 0x0000000000000000 mpidr_el1 = 0x0000000080000000 afsr0_el1 = 0x0000000000000000 afsr1_el1 = 0x0000000000000000 contextidr_el1 = 0x0000000000000000 vbar_el1 = 0x0000000000000000 cntp_ctl_el0 = 0x0000000000000002 cntp_cval_el0 = 0x15cdfe24296c00a0 cntv_ctl_el0 = 0x0000000000000002 cntv_cval_el0 = 0x73f7f96ef3f77fcd cntkctl_el1 = 0x0000000000000000 sp_el0 = 0x0000000000000000 ...