Help to overwrite boot of my Android on RK3328 A5X Max+

[jps1x2]

Hi hexdump,

My A5X Max+ is not booting from SD on Android 8.1 that has installed.

I have created a linux VM on My Virtualbox and tested UART, it is working fine, then i can start low level tests.

About your notes on following link:

https://github.com/hexdump0815/u-boot-misc/blob/master/readme.rk3328-no-sd-boot

About the following command on your notes:

dd if=uboot.img of=/dev/sdx seek=16384

Are there here on forum uboot.img to use or do i have to compile it?

That command is to write to /dev/sdx on tv box or on sd card to boot?

If the command is writen to tv box is it writen from UART connection?

About command:

rkdeveloptool wl 0x2000 u-boot-image-for-emmc-h96max-rk3328.img

Are there here on any forum valid img files that i can use of this type or do i have to compile it?

Another way to do it if i do not need to boot from SD, is it possible to write directly to emmc armbian (or other image like coreelec) image with any tool?

Regards

Jps1x2

[hexdump0815]

you would have to compile the u-boot.img according to the readme - i plan to build one one day to make it available, but did not get to it yet. not sure when i'll find the time for it.

i think the line "dd if=uboot.img of=/dev/sdx seek=16384" is wrong there (i'll have to delete it - copy and paste error) as the image has to be written to the emmc using the rkdeveloptool as described below. for that you need a special usb-a to usb-a cable to connect the box to your computer.

i think there was someone who built an old armbian image for the a95x max+ which can be written directly via rkdevelopertool, but i'm not sure if it is still available and i have no idea how well it works.

you should only try all this if you really want to learn how all this works - otherwise most other boxes will be way simpler to get armbian onto.

good luck and best wishes - hexdump

[hexdump0815]

it could be that this is that u-boot.img: https://github.com/hexdump0815/u-boot-misc/releases/download/200718-01/u-boot-rk3328.img.gz - but i'm not sure anymore (see below) ... and one more note: in case you work with rkdeveloptool first check in which mode you are (rkdeveloptool ld) - it is either maskrom or loader mode and in loader mode addresses are 0x2000 lower, i.e. 0x4000 in maskrom mode is 0x2000 in loader mode and vice versa - my readme was written for loader mode and the addresses have to be adjusted if you are in maskrom mode

edit: this is the proper image actually - https://github.com/hexdump0815/linux-mainline-and-mali-rockchip-rk33xx-kernel/raw/master/misc.rkc/u-boot/u-boot-image-for-emmc-h96max-rk3328.img

[hexdump0815]

due to this github issue i tried to understand again how all this was working for my h96max-rk3328 with no sd card boot and i realized that the mainline u-boot info in my readme was not finished yet and still incomplete ... i finally found my old notes from back when i got it working and my solution was based on an older rockchip u-boot version from ayufan (so not mainline u-boot) and some patches ... the image above is correct and should work (at least for a h96max-rk3328) and i just added my old notes and that image once more at https://github.com/hexdump0815/u-boot-misc/tree/master/misc.rk3328-no-sd-boot/rockchip-u-boot in case anyone wants to reproduce it wor work further on a mainline u-boot version of this approach

in the readme in that dir there are also a few forum links etc. with might give some more insight into this topic

[jps1x2]

Thanks for the information i will test it this week and give feedback.

Regards

Jps1x2

[hexdump0815]

hello,

better wait with it a moment - maybe i have another idea to try out first. is the android currently running on the box rooted, i.e. can you install a terminal app and run "su" in the terminal to get a root prompt? what would be good as well is if you could organize a usb-a to usb-a cable and try to get the rkdeveloptool working to the point that you see your box connected to the computer using "rkdeveloptool ld" being shown in either loader or maskrom mode.

[jps1x2]

Hi!
Installed Connectbot and Terminal Emulator on Android and when i execute in a local terminal 'su' command i get:

/system/bin/sh: su: can't execute: Permission denied

In a Virtual Machine on VirtualBox i can connect with USB-A-TO-USB-A and i get after command 'rkdeveloptool ld' that it is in this mode:

loader

I will search today how to root my A5X Max+.

Regards!

Jps1x2

[jps1x2]

Hi @hexdump0815 !

Tested on stock rom Android 8.1 several tools for rooting and not working.

Found Android 7.1 firmware for that device and installed, wifi not work and ethernet not work. I will try today if it is rooted installing terminal emulator apk with usb.

Why do you need it to be rooted?

Android 8.1 works very well with ethernet, wifi and Bluetooth. Could we extract dtb from firmware image file that i have?

Tell me the following steps that you have in your idea.

Regards

Jps1x2

[hexdump0815]

root is not strictly required if rkdeveloptool is working well, which seems to be the case ... more info on the weekend

[jps1x2]

Thanks for your help @hexdump0815 !!!

[hexdump0815]

ok, lets start ... please connect your box to the computer, check if it is seen via "rkdeveloptool ld" and if you are in loader mode switch to maskrom mode via "rkdeveloptool rd 3" (recheck again with "rkdeveloptool ld" afterwards).

before continuing lets better do a backup of your current boot blocks via

rkdeveloptool rl 0x0 0x8000 bootblock-backup.img

which we will need later anyway. it should create a file of 16mb size - keep a copy of it safe somewhere.

lets do some quick last try to boot directly from sd card now - please get this image: https://github.com/hexdump0815/imagebuilder/releases/tag/200702-01 and write it to an empty sd card (after gunzipping it) and afterwards do the following with this sd card: https://github.com/hexdump0815/u-boot-misc/blob/master/readme.rk3328#L31-L37 where you use your bootblock-backup.img from above via if=bootblock-backup.img instead of if=/dev/emmc and adjust of=/dev/sdcard to point to the device of your sd card. the u-boot-rk3328.img is this one here (after gunzipping): https://github.com/hexdump0815/u-boot-misc/releases/download/200718-01/u-boot-rk3328.img.gz

next try to boot with this sd card and watch the serial console if you see the mainline u-boot v2020.07 starting or not - if it comes up booting from sd card seems to work and no further experiments might be required.

if not then please try to write this special u-boot image (after gunzipping it): https://github.com/hexdump0815/u-boot-misc/blob/master/misc.rk3328-no-sd-boot/rockchip-u-boot/u-boot-image-for-emmc-h96max-rk3328.img.gz by using this command (check again for maskrom mode before):

rkdeveloptool wl 0x4000 u-boot-image-for-emmc-h96max-rk3328.img

then try to boot the box and check the serial console if you see the mainline u-boot version v2020.07 (correction: the expected u-boot version in this case is: U-Boot 2017.09-g95f6152134-dirty (Feb 08 2020 - 21:32:56 +0100)) ...

whenever you should run into an error, please stop and post the error you see here before continuing

best wishes - hexdump

[jps1x2]

Hi @hexdump0815

worked on my Tv box last night until 4 AM i am today sleepy.

First i wrote your image of 7Gb to a SD.

In your instructions was not indicated that on Maskrom mode before executing any command first you have to upload a loader, i have investigated it after more than 1 hour try and error then searching on internet. I found on internet a compatible one named MiniLoaderAll.bin for A5X Max+ that the autor extracted from one Android firmware. It would be interesting if you can explain me how to extract this type of file from an Android image.

After:

rkdeveloptool rd 3

i executed:

rkdeveloptool db MiniLoaderAll.bin

and then i can save my boot block with:

rkdeveloptool rl 0x0 0x8000 bootblock-backup.img

Testing boot on SD not worked, it booted Android and ignored my SD here it is UART log:

https://pastebin.com/pdvmFCac

Then executed:

sudo dd if=bootblock-backup.img of=/dev/sdd bs=512 skip=1 seek=1 count=32767
sudo dd if=u-boot-rk3328.img of=/dev/sdd bs=512 seek=16384

And:

sudo rkdeveloptool ld
sudo rkdeveloptool rd 3
sudo rkdeveloptool db MiniLoaderAll.bin 
sudo rkdeveloptool ld
sudo rkdeveloptool wl 0x4000 u-boot-image-for-emmc-h96max-rk3328.img
sudo rkdeveloptool rd

Then try to boot and see on UART that it was waiting to select a boot option, i have indicated option 1 and ENTER. Here you can see boot process on UART until it stop booting and do not display nothing on TV:

https://pastebin.com/b0LshYJe

We can continue now with your tests.

Thank you very much for your help and for your time!!!

Regards.

Jps1x2

[hexdump0815]

there is no hurry - so just take your time

the second boot log looks good - it is running my hacked together u-boot now and that is properly reading the extlinux.conf from the sd card ... now you just need to find a working dtb for your board - just try to exchange the rk3328-t9.dtb in the extlinux/extlinux.conf file on the first partition with the other rk3328 ones around there - maybe the rk3328-h96max.dtb should have a good potential to work. as your box is now properly booting anything well from sd card you can also try the balbes images for rk3328 or arm8 if they are still available and play around with the dtbs included in them too.

good luck and best wishes - hexdump

[jps1x2]

Updated my comment now. I was not indicating last rkdeveloptool block.

[hexdump0815]

ah - now i see you did not even have to write the boot block to emmc - even better ... what is confusing me a bit is that the u-boot version printed is the one from u-boot-image-for-emmc-h96max-rk3328.img and not from u-boot-rk3328.img as you wrote - can it be that you wrote that one this way instead (which would be fine too, as it seems to work well) ... so then you can make every rk3328 tv image you can find bootable by running the commands you did run as long as the first partition of the image does not start before sector 32768 - just write a desired image to an sdcard and run fdisk -l /dev/sdcard to see where the first partition starts (or uncompress the image file and run fdisk -l imagefile to see the partition table even before writing it to the sd card) ... but maybe first just try to get my image working by choosing the rk3328-h96max.dtb in extlinux/extlinux.conf and i guess that that one should work.

[hexdump0815]

now i saw your updated comment: that makes sense - so you have a u-boot on emmc now which will boot normal rk3328 linux images just fine from sd card - no special treatment of the images required (so forget my last comment) ... side effect: you will no longer be able boot into android this way, but with this kind of box this is impossible to have both options and you can have it boot either android from emmc or - after the modification you did - boot linux from an sd card ...

[hexdump0815]

a last note: as this box is a bit special you'll always have to build your kernels yourself for it as the required dtb file (rk3328-h96max) is not part of any normal kernel ... some notes and patches for building such a kernel you can find here: https://github.com/hexdump0815/linux-mainline-and-mali-rockchip-rk33xx-kernel and i have just built a new 5.9.2 kernel here: https://github.com/hexdump0815/linux-mainline-and-mali-rockchip-rk33xx-kernel/releases/tag/5.9.2-stb-rkc%2B ... just unpack the file in / and add an entry for that version too to the extlinux.conf file ...

[jps1x2]

Ok @hexdump0815 i understand now, i am very happy learning that low level knowledge, i am an Android apk Smali patcher and that is low level programming too. About dtb, on Android 8.1 it is working perfect: wifi, ethernet and Bluetooth.
Is it possible to extract Android dtb from the image that i have or from a running Android OS?
Thanks!

[hexdump0815]

it does not really help as the dtb is always very specific for a kernel version - plus: android kernels and normal linux kernels are different too ... you'll have to find out what wifi bt hardware you have inside and some is supported by mainline linux others not - i guess its broadcom for that box maybe, so there is a chance to get it working maybe but that will not be trivial neither :)

[jps1x2]

Related to your comment about kernel and to understand the process, i can write to an sdcard a compatible rk3328 image (Libreelec, Coreelec, Armbian, etc.) and then, on that versions overwrite with your kernel file?

[hexdump0815]

it should/might work with armbian, libreelec is packaging the kernel different i think, coreelec does even more things in a strange way, i.e. with those it will most probably not work

[jps1x2]

Hi @hexdump0815 !
Why is not working on my tv box your 7Gb image that i wrote on my SD card?
I completed steps of writing to SD card and overwriting parts with:
sudo dd if=bootblock-backup.img of=/dev/sdd bs=512 skip=1 seek=1 count=32767
sudo dd if=u-boot-rk3328.img of=/dev/sdd bs=512 seek=16384
But every boot that i check it is only ask for a selection and when i select:
5.6.13-stb-rkc+
It continue booting and display nothing on tv.
I see on UART log that it indicates it:
Found /extlinux/extlinux.conf Retrieving file: /extlinux/extlinux.conf
Is that /extlinux/ accesible from FAT partition that is displayed when i open SD on Windows or do i have to mount SD partitions it on my Linux VM?
I am trying to learn to interpret UART log and i see this too:
Retrieving file: /extlinux/../dtb-5.6.13-stb-rkc+/rk3328-t9.dtb
And this:
[ 0.000000] Machine model: T9
That i think is related to dtb.
Related to testing balbes images, do i need to execute to that images after writing it to SD the commands you indicated?:
sudo dd if=bootblock-backup.img of=/dev/sdd bs=512 skip=1 seek=1 count=32767
sudo dd if=u-boot-rk3328.img of=/dev/sdd bs=512 seek=16384
Or could it work only writing to SD and changing dtb?
Thank you very much!!!

Regards

Jps1x2

[hexdump0815]

you do not have to do any changes via dd after writing the images - you only have to change the dtb to rk3328-h96max.dtb in the extlinux.conf file of my written image on sd card - this is the only one which knows how to handle the special (i.e. non standard) sd card setup of your box

[jps1x2]

Good news!!!
I can see linux login screen after changing on your image dtb to rk3328-h96max.dtb. The problem is that i need the password for user:
linux
to log in and test.
Could you send it please?
Thanks and regards
Jps1x2

[hexdump0815]

its changeme - see also here for more info: https://github.com/hexdump0815/imagebuilder

[jps1x2]

Hi @hexdump0815 !
I am testing now following image of Balbes150:
Armbian_20.07_Rk3328-tv_focal_current_5.7.8_desktop
changing in uEnv.txt every RK3328 existent dtb and can not boot. Here you can see every dtb result:

https://t.me/s/TempChannelForArmbian

i don't know how to interpret the problem during boot of that image.

i can see text on TV but boot process not continue.

Could you help me?

Regards

jps1x2

[hexdump0815]

i told you that it will not work with any regular dtb, you need my adjusted rk3328-h96max.dtb - so you'll have to build your own kernel with that dts included or you can try a kernel compiled by me as mentioned already above

[jps1x2]

Hi!
Tested Balbes150 image with your dtb but screen not displaying fine. Downloaded your last kernel, extracted and pasted on root of sdcard, modified uEnv.txt and boot fine.

Where do i put your following folder contained in your compressed kernel file?:

/lib

I mixed it with /lib on system partition of Balbes.

I have not sound on your image and not sound on Balbes' one. I think that video decoding is not at hardware level, tested Youtube on browser and works slow and not smooth. Working ethernet at 100Mb and not working wifi and Bluetooth.

Is it possible to write a complete image on emmc with rkdeveloptool? I would like to test it with Libreelec and not have the problem of sd boot. Do you think that then LE or Armbian booting all from emmc will work without special dtb or kernel?

Thanks!

[hexdump0815]

in the kernel .tar.gz there is /lib/modules which should go to /lib/modules on the system ... regarding all your other questions i cannot really help you - you asked to make you box boot from sd which it does now - everything else you'll have to find out yourself, my plan was not to be first level support for balbes images :)

[jps1x2]

Hi again @hexdump0815 !
I have been testing recently versions of armbian and now my A5X Max+ boot fine from SD.
Now i would like to test LibreELEC because it is hardware accelerated when playing videos.
I have opened a thread here:
https://forum.libreelec.tv/thread/23023-libreelec-on-rk3328-a5x-max-plus/

Could you help me to adapt your special boot to test LE on my device please?

I am writing to eMMC several LE images i found on LE forums with rkdeveloptool but not booting.

Thank you very much for your help!

Regards

Jps1x2

[jps1x2]

Hi @hexdump0815 !

Thank you very much for your help on this issue.

Regards.

Jps1x2