Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fl3xbl0w #20

Open
alphab0ing opened this issue Aug 19, 2024 · 203 comments
Open

fl3xbl0w #20

alphab0ing opened this issue Aug 19, 2024 · 203 comments

Comments

@alphab0ing
Copy link

Can you please forward all of the dump files you have from the bowflex Vantron rk3399 board? I've been working on this for several weeks, I've packaged a complete ROM that is 95% functional based on device tree's from other similar devices, I really would love to get my hands on the original u-boot / dtb....Anything you have would be greatly appreciated and I'm happy to share whatever I find of course! Here's the dtb/device tree I've assembled for the board, working uart ports/ USB ports, the display works however the settings aren't entirely correct so I'm getting backlight and lines on the screen, i've identified and confiugured the bluetooth/wifi device and mapped out for adding an sdcard to the board which is pre-built in since Vantron is essentially using their rk3399 board just white labled for nautical/bowflex.
Vantron-Bowflex_alphab0ing.zip
``

@alphab0ing
Copy link
Author

Without root on the adb you can use adb shell to copy "/dev/block/platform/fe330000.sdhci/by-name/*" to sdcard and then zip and use adb pull to grab it from the sdcard folder which is not protected

@barrenechea
Copy link
Owner

I have a backup of files from a system update that the machine received (OTA - HP-22_T56_EEA Android OS Image 3.10 release-keys), but it is close to 1GB so no easy way of sharing it. I'll let you know if I get to upload it/share it.

The file list at the time of the update within the redbend folder was:

1_1_script.rdp
1_delta.rdp
1_suffix.rdp
Credentials.txt
crc.rdp
deltas_header.rdp
dma_config.txt
dp
installation_order.txt
section1.rdp
suffix_section.rdp

Some info that I got at the time was this:

1_delta.rdp: Java archive data (JAR): Decompress as .zip
	- payload.bin: https://github.com/ssut/payload-dumper-go
		- boot.img: Android bootimg, kernel (0x10008000), ramdisk (0x11000000), second stage (0x10f00000), page size: 2048, cmdline (console=ttyFIQ0 androidboot.baseband=N/A androidboot.wificountrycode=US androidboot.veritymode=enforcing androidboot.hardware=r)
		- dtbo.img: data
		- oem.img: Linux rev 1.0 ext2 filesystem data, UUID=b886e36e-ac40-5948-86dd-27c114bd225e, volume name "oem" (extents) (large files) (huge files)
		- system.img: Linux rev 1.0 ext2 filesystem data, UUID=0a7fc206-6c88-5018-bacd-4ea8a11db7ca (extents) (large files) (huge files)
		- trust.img: data
		- uboot.img: data
		- vbmeta.img: data
		- vendor.img: Linux rev 1.0 ext2 filesystem data, UUID=67531afd-7aed-52f3-9196-b1cdad9fd724, volume name "vendor" (extents) (large files) (huge files)

@barrenechea
Copy link
Owner

Here are the uploaded files https://archive.org/download/HP-22_T56_EEA, I'll push an update into my website so it gets documented 😄

Also, I wasn't able to dump the files you asked, I got the following output:

nftm_lar:/sdcard $ cd /dev/block/platform/fe330000.sdhci/by-name/
nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ cp -R * /sdcard/dump_files
cp: /sdcard/dump_files/backup: Permission denied
cp: /sdcard/dump_files/boot_a: Permission denied
cp: /sdcard/dump_files/boot_b: Permission denied
cp: /sdcard/dump_files/cache: Permission denied
cp: /sdcard/dump_files/dtb: Permission denied
cp: /sdcard/dump_files/dtbo_a: Permission denied
cp: /sdcard/dump_files/dtbo_b: Permission denied
cp: /sdcard/dump_files/frp: Permission denied
cp: /sdcard/dump_files/kernel: Permission denied
cp: /sdcard/dump_files/metadata: Permission denied
cp: /sdcard/dump_files/misc: Permission denied
cp: /sdcard/dump_files/oem_a: Permission denied
cp: /sdcard/dump_files/oem_b: Permission denied
cp: /sdcard/dump_files/resource: Permission denied
cp: /sdcard/dump_files/security: Permission denied
cp: /sdcard/dump_files/sw_release: Permission denied
cp: /sdcard/dump_files/system_a: Permission denied
cp: /sdcard/dump_files/system_b: Permission denied
cp: /sdcard/dump_files/trust_a: Permission denied
cp: /sdcard/dump_files/trust_b: Permission denied
cp: /sdcard/dump_files/uboot_a: Permission denied
cp: /sdcard/dump_files/uboot_b: Permission denied
cp: /sdcard/dump_files/userdata: Permission denied
cp: /sdcard/dump_files/vbmeta_a: Permission denied
cp: /sdcard/dump_files/vbmeta_b: Permission denied
cp: /sdcard/dump_files/vendor_a: Permission denied
cp: /sdcard/dump_files/vendor_b: Permission denied
cp: /sdcard/dump_files/video: Permission denied

nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ whoami
shell
nftm_lar:/dev/block/platform/fe330000.sdhci/by-name $ ls -alg
total 0
drwxr-xr-x 2 root 600 2024-08-20 13:26 .
drwxr-xr-x 3 root 700 2024-08-20 13:26 ..
lrwxrwxrwx 1 root  21 2024-08-20 13:26 backup -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root  21 2024-08-20 13:26 boot_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root  21 2024-08-20 13:26 boot_b -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root  21 2024-08-20 13:26 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root  20 2024-08-20 13:26 dtb -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root  20 2024-08-20 13:26 dtbo_a -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root  21 2024-08-20 13:26 dtbo_b -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root  21 2024-08-20 13:26 frp -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root  20 2024-08-20 13:26 kernel -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root  21 2024-08-20 13:26 metadata -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root  20 2024-08-20 13:26 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root  21 2024-08-20 13:26 oem_a -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root  21 2024-08-20 13:26 oem_b -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root  20 2024-08-20 13:26 resource -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root  21 2024-08-20 13:26 security -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root  21 2024-08-20 13:26 sw_release -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root  21 2024-08-20 13:26 system_a -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root  21 2024-08-20 13:26 system_b -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root  20 2024-08-20 13:26 trust_a -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root  20 2024-08-20 13:26 trust_b -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root  20 2024-08-20 13:26 uboot_a -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root  20 2024-08-20 13:26 uboot_b -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root  21 2024-08-20 13:26 userdata -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vbmeta_a -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vbmeta_b -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vendor_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root  21 2024-08-20 13:26 vendor_b -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root  21 2024-08-20 13:26 video -> /dev/block/mmcblk0p27

@alphab0ing
Copy link
Author

Thank you SO much! I will keep you posted

@alphab0ing
Copy link
Author

alphab0ing commented Aug 20, 2024

vantron-rk3399.dts.txt

@alphab0ing
Copy link
Author

There it is!! Pot of gold, thank you my friend. Now we can easily make any ROM for this board.

@barrenechea
Copy link
Owner

There it is!! Pot of gold, thank you my friend. Now we can easily make any ROM for this board.

Lovely! I'm glad I could help 😄 keep me updated if you build an image for it!
With root access, I guess we could build an OSS app to communicate via Serial with the treadmill board. It would be awesome if we could make it work without Nautilus/Bowflex software.

@alphab0ing
Copy link
Author

Yes I'll have us a working ROM shortly, you will be able to wipe the board clean and start fresh with a rooted 8.1 android OS, I've been very close to having this completed I really really needed that dts file but I had already wiped my board before retrieving it....

@barrenechea
Copy link
Owner

Just published an update (52213e8) with this new info, already up over here. Thank you very much for reaching out!! Pretty exciting times 😄

@alphab0ing
Copy link
Author

I apologize there's one more missing item that you should be able to get pretty easy when you have time. From maskrom using rkdeveloptool I need the partition structure so I can merge what I have correctly, I've tried using standard addresses and it's looping back into a loader mode so I'm guessing it's off, here's my output currently using command "rkdeveloptool ppt"

% rkdeveloptool ppt
Partition Info(GPT)
NO LBA Name
00 00002000 uboot
01 00004000 trust
02 00006000 misc
03 00008000 baseparameter
04 00008800 resource
05 00010800 kernel
06 00020800 boot
07 00030800 recovery
08 00050800 backup
09 00088800 security
10 0008A800 cache
11 0018A800 system
12 0068A800 metadata
13 00692800 vendor
14 00794800 oem
15 00894800 frp
16 00894C00 userdata

An update of those addresses from a functioning board will help rebuild with the modified ROM, also if anyone working on this needs anything I've extracted all the data from the dump you sent over earlier and I'm happy to pass that along to whomever may need it.

@barrenechea
Copy link
Owner

I apologize there's one more missing item that you should be able to get pretty easy when you have time. From maskrom using rkdeveloptool I need the partition structure so I can merge what I have correctly, I've tried using standard addresses and it's looping back into a loader mode so I'm guessing it's off, here's my output currently using command "rkdeveloptool ppt"

We're actively using the treadmill and I don't have access to the DBG_USB, it may take a bit since I'm on other things as well... ADB is the only thing I have quick access to, already tried a ton of exploits over time with no luck 🤣

I need to replace some capacitors tho, because the speakers started making a crackling noise (and very likely a cap issue), so I can take a chance there!

@tds04
Copy link

tds04 commented Nov 12, 2024

I have a Bowflex tablet im using as a wall tablet with home assistant.
id like to help if i can.
tried to get the info using windows version of rkDevtool, let me know if this is what your looking for.

partition
partiton2

@tds04
Copy link

tds04 commented Nov 13, 2024

Rkdeveloptool ppt gives me an error.
I will try again with different usb cable or maybe different power adapter.

@alphab0ing
Copy link
Author

tds04, YES absolutely! I've been having trouble with the image files from the first dump, the device tree does not seem to be complete and I haven't been able to extract the boot.img other then a hexdump which has been helpful but I had kind of hit a dead end so help would be greatly appreciated. Here's a quick update to where I'm currently at...

I have been able to determine that the board kernel is based at least in part on the "rk3399-tve1030g-avb" included with the kernel build readily available, I've been able to use that in conjunction what I can get from the recovered dtb, I have built an android rom based on what I've pieced together but I've ran into a couple issues, I haven't been able to get the screen working yet (this portion of the recovered dtb is incomplete, from what I can get in the hexdump it looks like the board is using an edp bridge but the biggest issue is that my solder work is lousy and I have damaged the defaultt uart/debug port, I'm unable to verify functionality. Ideally if you I can get an image dump would be amazing, I'm not confident enough it what I have to pass that off and potentially damage your hardware.

@alphab0ing
Copy link
Author

Rkdeveloptool ppt gives me an error. I will try again with different usb cable or maybe different power adapter.

What's the error you're getting and which platform are you running rkdevelop?

@alphab0ing
Copy link
Author

If you can get adb via usb try

adb shell ls /dev/block/by-name/

see if you can see the partitions, it might be possible to copy those over the sdcard folder and then copy from there over to your local system, I dont think you'll be able to pull it directly from /dev/block/by-name

@tds04
Copy link

tds04 commented Nov 13, 2024 via email

@tds04
Copy link

tds04 commented Nov 13, 2024 via email

@alphab0ing
Copy link
Author

Yeah I can make myself available when you get a dedicated setup we can do a live conference, I'm not an expert but I have spent a TON of time on this board, I think ADB will likely be the easiest path forward, if I could somehow get the screen working on mine (via a real dtb or boot.img?) then that would be huge for things on my end, I'll attach a copy of my progress dts/dtb if you guys wanted to have look maybe I'm missing something?? I can't seem to get proper voltage on the USB ports, I'm getting 3.4V which I'm hoping is just a bus configuration and then the screen issue..

alphab0ing-fl3xb0w.dts.txt

@alphab0ing
Copy link
Author

It looks like @barrenechea has already gone the adb route without very much success, from his earlier post he's been able to identify the direct path for each of the partitions...

drwxr-xr-x 2 root 600 2024-08-20 13:26 .
drwxr-xr-x 3 root 700 2024-08-20 13:26 ..
lrwxrwxrwx 1 root 21 2024-08-20 13:26 backup -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root 21 2024-08-20 13:26 boot_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root 21 2024-08-20 13:26 boot_b -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root 21 2024-08-20 13:26 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root 20 2024-08-20 13:26 dtb -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root 20 2024-08-20 13:26 dtbo_a -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root 21 2024-08-20 13:26 dtbo_b -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root 21 2024-08-20 13:26 frp -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root 20 2024-08-20 13:26 kernel -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root 21 2024-08-20 13:26 metadata -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root 20 2024-08-20 13:26 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root 21 2024-08-20 13:26 oem_a -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root 21 2024-08-20 13:26 oem_b -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root 20 2024-08-20 13:26 resource -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root 21 2024-08-20 13:26 security -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root 21 2024-08-20 13:26 sw_release -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root 21 2024-08-20 13:26 system_a -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root 21 2024-08-20 13:26 system_b -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root 20 2024-08-20 13:26 trust_a -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root 20 2024-08-20 13:26 trust_b -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root 20 2024-08-20 13:26 uboot_a -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root 20 2024-08-20 13:26 uboot_b -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root 21 2024-08-20 13:26 userdata -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root 21 2024-08-20 13:26 vbmeta_a -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root 21 2024-08-20 13:26 vbmeta_b -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root 21 2024-08-20 13:26 vendor_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root 21 2024-08-20 13:26 vendor_b -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root 21 2024-08-20 13:26 video -> /dev/block/mmcblk0p27

Maybe by knowing the exact path it MIGHT let you copy to SDCARD or another directory where you could use adb pull to grab them maybe try something like;

$ adb shell "su -c 'dd if=/dev/block/mmcblk0p13t of=/sdcard/boot_a.img'"
$ adb pull /sdcard/boot_a.img

When you run the rkdevtool in windows is it coming as maskrom specifically? Root shouldn't matter when you're in maskrom and give the addresses you recovered in the partition table you shared you should be able to use rkdeveloptool to dump from terminal for example once you're in maskrom;

$ rkdeveloptool rl 0x0002d000 0x00020000 boot_a.img

One thing to note that on these boards there's a button over near the emmc, when holding that button down while resetting the board it WILL get you to MaskROM but I haven't been able to find out anything tells me specifically what that button does I don't really see the purpose of having it along side a recovery button if it serves an identical purpose, I can't be sure it doesn't erase the emmc or something to that effect rather then just force maskrom like a recovery button would. Just something to be aware of...

@tds04
Copy link

tds04 commented Nov 14, 2024

tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool list-partitions

LBA start (sectors) LBA end (sectors) Size (bytes) Name

00 16384 24575 4194304 uboot_a
01 24576 32767 4194304 uboot_b
02 32768 40959 4194304 trust_a
03 40960 49151 4194304 trust_b
04 49152 57343 4194304 misc
05 57344 90111 16777216 resource
06 90112 155647 33554432 kernel
07 155648 163839 4194304 dtb
08 163840 172031 4194304 dtbo_a
09 172032 180223 4194304 dtbo_b
10 180224 182271 1048576 vbmeta_a
11 182272 184319 1048576 vbmeta_b
12 184320 315391 67108864 boot_a
13 315392 446463 67108864 boot_b
14 446464 675839 117440512 backup
15 675840 684031 4194304 security
16 684032 1732607 536870912 cache
17 1732608 6975487 2684354560 system_a
18 6975488 12218367 2684354560 system_b
19 12218368 12251135 16777216 metadata
20 12251136 13299711 536870912 vendor_a
21 13299712 14348287 536870912 vendor_b
22 14348288 15396863 536870912 oem_a
23 15396864 16445439 536870912 oem_b
24 16445440 16446463 524288 frp
25 16446464 32007167 7967080448 sw_release
26 32007168 36717567 2411724800 video
27 36717568 61071326 12469124608 userdata
tim@tim-HP-EliteBook-840-G1:$ sudo rkdeveloptool read-partition uboot_a uboot.img
Read LBA to file (100%)
tim@tim-HP-EliteBook-840-G1:
$ sudo rkdeveloptool read-partition uboot_b uboot.img
Read LBA to file (100%)

@tds04
Copy link

tds04 commented Nov 14, 2024

@tds04
Copy link

tds04 commented Nov 14, 2024

`tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool -h
Usage: rkdeveloptool command [args]...
Reads or writes the storage of a rockchip device booted into the rockusb bootloader mode

-h, --help, help print this help text
-v, --version print the version of this tool

list List the detected devices in rockusb mode
list-partitions List the GPT partition table on the storage
read Read sectors from the internal storage
read-partition Read a partition from the internal storage
write Write sectors from to internal storage
write-partition Write an image to a specific partition
write-partition-table Write an image to a specific partition
write-parameter Not sure what this does
erase-flash Wipe the internal storage
boot Download an image to ram and start it
test-device Tests the device
upgrade-loader Write a new rockusb loader
reset Send a reset command
reboot Send a reboot command, alias of reset
reboot-maskrom Trigger reboot into maskrom mode
shutdown Reset without rebooting
read-flash-id Read the flash chip serial number
read-flash-info Show information about the internal storage
read-chip-info Show information about the SoC
read-capability Show the bootloader permissions
pack Pack bootloader
unpack Unpack bootloader
tag-spl Tag U-Boot SPL`

this one has more options than the other rkdeveloptool

@alphab0ing
Copy link
Author

alphab0ing commented Nov 14, 2024

Was that the linux tool?? looks a little different then the one I use on my mac, where did the upload go?? I thought I saw it but then I can no longer

@tds04
Copy link

tds04 commented Nov 14, 2024

@tds04
Copy link

tds04 commented Nov 14, 2024

ubootimages.zip

@tds04
Copy link

tds04 commented Nov 14, 2024

bootloader-magic.zip

@tds04
Copy link

tds04 commented Nov 14, 2024

Hope this helps!

@tds04
Copy link

tds04 commented Nov 14, 2024

all this was from loader mode, i can switch to maskrom with the command line or the button but all i get are errors

tim@tim-HP-EliteBook-840-G1:~$ sudo rkdeveloptool list-partitions Read GPT failed! Read parameter failed! Not found any partition table!
`

@alphab0ing
Copy link
Author

@tds04 Thanks for your help this is Fantastic! Also thanks for the tool, that's a new one I haven't seen yet, I'll see what I can get from this image dump. The original dump from @barrenechea included a part_table.bin file that I have not been able to extract any information from so the LBA start/sectors information you provided will be a huge help reconstructing a gpt.

@barrenechea , I noticed you had updated the webpage for the project and I thought I could give a little more information that might be helpful to you guys, I updated the image that you had posted of the board itself added the 4-pin uart location and a little more information on the unknown button.

vantron-pcb BYBRfSy5_Z1Yijdv

Also in my research trying to get as much information as I could to rebuild a device tree I came across the board publicly offered by Vantron that which this board is almost certainly some sort of variant, the information from that board which is publicly available was helpful especially as it relates to the possibility of a Micro SD slot, it seems our board does have the capabilities to add a MicroSD and I'll include the structure for it in the device tree so that anyone wanting to solder one on would have a functioning MicroSD slot, there's also other peripherals on this board that are not being utilized for the purpose of the bowflex specifically the LVDS/LCD and additional backlighting options that could be enabled if someone were to want to use a different screen setup for example.

IMG_1198

Screenshot 2024-11-14 at 10 44 31 AM Screenshot 2024-11-14 at 10 56 11 AM

This is awesome I had put this onto the back burner having seemingly hit a dead end and this is a very helpful path forward, thanks guys!

@tds04
Copy link

tds04 commented Nov 23, 2024

no it just ends there

@tds04
Copy link

tds04 commented Nov 23, 2024

so whats happening is i flash loader.bin and i get that info,

@alphab0ing
Copy link
Author

So after you flash loader, and idb, uboot, what do you get when you reset the board and let it try and go into u boot? It should try and load boot image but it's not there so you'll get an error but you should be able to interrupt the boot (ctrl-c) that will get you to a uboot console from console we can do some debugging and try to figure out where the problem is with the lcd.

I'll work on these images, looks like the data is there maybe the sector address is off I'll see if I can extract another way.

@tds04
Copy link

tds04 commented Nov 23, 2024

nothing happens on screen, doesn't even reload

@alphab0ing
Copy link
Author

When you're connected after booting the loader you can type rkdeveloptool Rd, that will reset the device, then you can watch your uart

@tds04
Copy link

tds04 commented Nov 23, 2024

I tried loading everything again it's weird . Nothing on screen

@tds04
Copy link

tds04 commented Nov 23, 2024

New Text Document.txt
friendlyelec som-rk3399 android 10
no display
i didnt load all the files,

@tds04
Copy link

tds04 commented Nov 23, 2024

https://drive.google.com/drive/folders/1_ehMxyKZcj89EaGT6mgumpFnKsek09cO
boot.img info.conf parameter.txt super.img vbmeta.img
dtbo.img MiniLoaderAll.bin pcba_small_misc.img trust.img
idbloader.img misc.img pcba_whole_misc.img uboot.img
maybe something to help

@tds04
Copy link

tds04 commented Nov 23, 2024

nanopi4# printenv
arch=arm
baudrate=1500000
board=nanopi4
board_name=nanopi4
boot_a_script=load ${devtype} ${devnum}:${distro_bootpart} ${scriptaddr} ${prefix}${script}; source ${scriptaddr}
boot_efi_binary=load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/bootaa64.efi; if fdt addr ${fdt_addr_r}; then bootefi ${kernel_addr_r} ${fdt_addr_r};else bootefi ${kernel_addr_r} ${fdtcontroladdr};fi
boot_extlinux=sysboot ${devtype} ${devnum}:${distro_bootpart} any ${scriptaddr} ${prefix}extlinux/extlinux.conf
boot_net_usb_start=usb start
boot_prefixes=/ /boot/
boot_script_dhcp=boot.scr.uimg
boot_scripts=boot.scr.uimg boot.scr
boot_targets=mmc1 mmc0 usb0 pxe dhcp
bootargs=storagemedia=emmc androidboot.storagemedia=emmc androidboot.mode=normal
bootcmd=boot_android ${devtype} ${devnum};bootrkp;run distro_bootcmd;
bootcmd_dhcp=run boot_net_usb_start; if dhcp ${scriptaddr} ${boot_script_dhcp}; then source ${scriptaddr}; fi;setenv efi_fdtfile ${fdtfile}; setenv efi_old_vci ${bootp_vci};setenv efi_old_arch ${bootp_arch};setenv bootp_vci PXEClient:Arch:00011:UNDI:003000;setenv bootp_arch 0xb;if dhcp ${kernel_addr_r}; then tftpboot ${fdt_addr_r} dtb/${efi_fdtfile};if fdt addr ${fdt_addr_r}; then bootefi ${kernel_addr_r} ${fdt_addr_r}; else bootefi ${kernel_addr_r} ${fdtcontroladdr};fi;fi;setenv bootp_vci ${efi_old_vci};setenv bootp_arch ${efi_old_arch};setenv efi_fdtfile;setenv efi_old_arch;setenv efi_old_vci;
bootcmd_mmc0=setenv devnum 0; run mmc_boot
bootcmd_mmc1=setenv devnum 1; run mmc_boot
bootcmd_pxe=run boot_net_usb_start; dhcp; if pxe get; then pxe boot; fi
bootcmd_usb0=setenv devnum 0; run usb_boot
bootdelay=1
cpu=armv8
devnum=0
devplist=7
devtype=mmc
distro_bootcmd=for target in ${boot_targets}; do run bootcmd_${target}; done
dtb_name=rk3399-nanopi4-rev25.dtb
efi_dtb_prefixes=/ /dtb/ /dtb/current/
ethaddr=1e:20:18:f5:fd:2a
fdt_addr_r=0x08300000
kernel_addr_r=0x00280000
load_efi_dtb=load ${devtype} ${devnum}:${distro_bootpart} ${fdt_addr_r} ${prefix}${efi_fdtfile}
mmc_boot=if mmc dev ${devnum}; then setenv devtype mmc; run scan_dev_for_boot_part; fi
partitions=uuid_disk=${uuid_gpt_disk};name=loader1,start=32K,size=4000K,uuid=${uuid_gpt_loader1};name=loader2,start=8MB,size=4MB,uuid=${uuid_gpt_loader2};name=trust,size=4M,uuid=${uuid_gpt_atf};name=boot,size=112M,bootable,uuid=${uuid_gpt_boot};name=rootfs,size=-,uuid=B921B045-1DF0-41C3-AF44-4C6F280D3FAE;
pxefile_addr_r=0x00600000
ramdisk_addr_r=0x0a200000
rkimg_bootdev=if mmc dev 1 && rkimgtest mmc 1; then setenv devtype mmc; setenv devnum 1; echo Boot from SDcard;elif mmc dev 0; then setenv devtype mmc; setenv devnum 0;elif rksfc dev 1; then setenv devtype spinor; setenv devnum 1;fi;
scan_dev_for_boot=echo Scanning ${devtype} ${devnum}:${distro_bootpart}...; for prefix in ${boot_prefixes}; do run scan_dev_for_extlinux; run scan_dev_for_scripts; done;run scan_dev_for_efi;
scan_dev_for_boot_part=part list ${devtype} ${devnum} -bootable devplist; env exists devplist || setenv devplist 1; for distro_bootpart in ${devplist}; do if fstype ${devtype} ${devnum}:${distro_bootpart} bootfstype; then run scan_dev_for_boot; fi; done
scan_dev_for_efi=setenv efi_fdtfile ${fdtfile}; for prefix in ${efi_dtb_prefixes}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${efi_fdtfile}; then run load_efi_dtb; fi;done;if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/bootaa64.efi; then echo Found EFI removable media binary efi/boot/bootaa64.efi; run boot_efi_binary; echo EFI LOAD FAILED: continuing...; fi; setenv efi_fdtfile
scan_dev_for_extlinux=if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}extlinux/extlinux.conf; then echo Found ${prefix}extlinux/extlinux.conf; run boot_extlinux; echo SCRIPT FAILED: continuing...; fi
scan_dev_for_scripts=for script in ${boot_scripts}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${script}; then echo Found U-Boot script ${prefix}${script}; run boot_a_script; echo SCRIPT FAILED: continuing...; fi; done
scriptaddr=0x00500000
soc=rockchip
stderr=serial,vidconsole
stdout=serial,vidconsole
usb_boot=usb start; if usb dev ${devnum}; then setenv devtype usb; run scan_dev_for_boot_part; fi
vendor=rockchip

@tds04
Copy link

tds04 commented Nov 23, 2024

goodboard 1500000.txt

115200.txt

this is from my good board in putty.
one at 1500000 and one at 115200

@alphab0ing
Copy link
Author

https://drive.google.com/drive/folders/1_ehMxyKZcj89EaGT6mgumpFnKsek09cO

This link is to something else?

@tds04
Copy link

tds04 commented Nov 23, 2024

https://drive.google.com/drive/folders/1_ehMxyKZcj89EaGT6mgumpFnKsek09cO

This link is to something else?

that is a android 10 i found that loads but no screen thought maybe something useful in there

@tds04
Copy link

tds04 commented Nov 23, 2024

@alphab0ing
Copy link
Author

I think if you can interrupt the boot process "ctrl-c" and get uboot console on your working board then we can probably donwload the device tree that way without having to extract it.

@tds04
Copy link

tds04 commented Nov 23, 2024

=> printenv
arch=arm
baudrate=115200
board=evb_rk3399
board_name=evb_rk3399
boot_a_script=load ${devtype} ${devnum}:${distro_bootpart} ${scriptaddr} ${prefix}${script}; source ${scriptaddr}
boot_extlinux=sysboot ${devtype} ${devnum}:${distro_bootpart} any ${scriptaddr} ${prefix}extlinux/extlinux.conf
boot_net_usb_start=usb start
boot_prefixes=/ /boot/
boot_script_dhcp=boot.scr.uimg
boot_scripts=boot.scr.uimg boot.scr
boot_targets=mmc1 mmc0 usb0 pxe dhcp
bootargs=storagemedia=emmc androidboot.mode=normal androidboot.dtbo_idx=0
bootcmd=boot_android ${devtype} ${devnum};bootrkp;run distro_bootcmd;
bootcmd_dhcp=run boot_net_usb_start; if dhcp ${scriptaddr} ${boot_script_dhcp}; then source ${scriptaddr}; fi;
bootcmd_mmc0=setenv devnum 0; run mmc_boot
bootcmd_mmc1=setenv devnum 1; run mmc_boot
bootcmd_pxe=run boot_net_usb_start; dhcp; if pxe get; then pxe boot; fi
bootcmd_usb0=setenv devnum 0; run usb_boot
bootdelay=0
cpu=armv8
cpuid#=5434525834392e30300000000016078a
devnum=0
devtype=mmc
distro_bootcmd=for target in ${boot_targets}; do run bootcmd_${target}; done
ethaddr=ce:23:1d:df:56:23
fdt_addr_r=0x08300000
kernel_addr_r=0x00280000
mmc_boot=if mmc dev ${devnum}; then setenv devtype mmc; run scan_dev_for_boot_part; fi
partitions=uuid_disk=${uuid_gpt_disk};name=loader1,start=32K,size=4000K,uuid=${uuid_gpt_loader1};name=loader2,start=8MB,size=4MB,uuid=${uuid_gpt_loader2};name=trust,size=4M,uuid=${uuid_gpt_atf};name=boot,size=112M,bootable,uuid=${uuid_gpt_boot};name=rootfs,size=-,uuid=B921B045-1DF0-41C3-AF44-4C6F280D3FAE;
pxefile_addr_r=0x00600000
ramdisk_addr_r=0x0a200000
rkimg_bootdev=if mmc dev 1 && rkimgtest mmc 1; then setenv devtype mmc; setenv devnum 1; echo Boot from SDcard;elif mmc dev 0; then setenv devtype mmc; setenv devnum 0;elif rknand dev 0; then setenv devtype rknand; setenv devnum 0;elif rksfc dev 0; then setenv devtype spinand; setenv devnum 0;elif rksfc dev 1; then setenv devtype spinor; setenv devnum 1;fi;
scan_dev_for_boot=echo Scanning ${devtype} ${devnum}:${distro_bootpart}...; for prefix in ${boot_prefixes}; do run scan_dev_for_extlinux; run scan_dev_for_scripts; done;
scan_dev_for_boot_part=part list ${devtype} ${devnum} -bootable devplist; env exists devplist || setenv devplist 1; for distro_bootpart in ${devplist}; do if fstype ${devtype} ${devnum}:${distro_bootpart} bootfstype; then run scan_dev_for_boot; fi; done
scan_dev_for_extlinux=if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}extlinux/extlinux.conf; then echo Found ${prefix}extlinux/extlinux.conf; run boot_extlinux; echo SCRIPT FAILED: continuing...; fi
scan_dev_for_scripts=for script in ${boot_scripts}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${script}; then echo Found U-Boot script ${prefix}${script}; run boot_a_script; echo SCRIPT FAILED: continuing...; fi; done
scriptaddr=0x00500000
serial#=VAN10A203250431
soc=rockchip
stderr=serial,vidconsole
stdout=serial,vidconsole
usb_boot=usb start; if usb dev ${devnum}; then setenv devtype usb; run scan_dev_for_boot_part; fi
vendor=rockchip

Environment size: 3128/32764 bytes

@tds04
Copy link

tds04 commented Nov 23, 2024

good board

@tds04
Copy link

tds04 commented Nov 23, 2024

=> help
? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
boot_android- Execute the Android Bootloader flow.
bootavb - Execute the Android avb a/b boot flow.
booti - boot arm64 Linux Image image from memory
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootrkp - Boot Linux Image from rockchip image type
bootz - boot Linux zImage image from memory
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
dm - Driver model low level access
dtimg - manipulate dtb/dtbo Android image
dump_bidram- Dump bidram layout
dump_sysmem- Dump sysmem layout
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
ext4load- load binary file from a Ext4 filesystem
ext4ls - list files in a directory (default /)
ext4size- determine a file's size
false - do nothing, unsuccessfully
fastboot- use USB or UDP Fastboot protocol
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatsize - determine a file's size
fatwrite- write file into a dos filesystem
fdt - flattened device tree utility commands
fstype - Look up a filesystem type
go - start application at address 'addr'
gpt - GUID Partition Table
help - print command description/usage
iomem - Show iomem data by device compatible
lcdputs - print string on video framebuffer
load - load binary file from a filesystem
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mdio - MDIO utility commands
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
part - disk partition related commands
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
pxe - commands to get and boot from pxe files
rbrom - Perform RESET of the CPU
reset - Perform RESET of the CPU
rkimgtest- Test if storage media have rockchip image
rktest - Rockchip Board Module Test
rockchip_show_bmp- load and display bmp from resource partition
rockchip_show_logo- load and display log from resource partition
rockusb - Use the rockusb Protocol
run - run commands in an environment variable
save - save file to a filesystem
setcurs - set cursor position within screen
setenv - set environment variables
showvar - print local hushshell variables
size - determine a file's size
source - run script from memory
sysboot - command to get and boot from syslinux files
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true - do nothing, successfully
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version

@tds04
Copy link

tds04 commented Nov 23, 2024

=> showvar
HUSH_VERSION=0.01
arch=arm
baudrate=115200
board=evb_rk3399

@alphab0ing
Copy link
Author

printenv

@tds04
Copy link

tds04 commented Nov 23, 2024

=> printenv
arch=arm
baudrate=115200
board=evb_rk3399
board_name=evb_rk3399
boot_a_script=load ${devtype} ${devnum}:${distro_bootpart} ${scriptaddr} ${prefix}${script}; source ${scriptaddr}
boot_extlinux=sysboot ${devtype} ${devnum}:${distro_bootpart} any ${scriptaddr} ${prefix}extlinux/extlinux.conf
boot_net_usb_start=usb start
boot_prefixes=/ /boot/
boot_script_dhcp=boot.scr.uimg
boot_scripts=boot.scr.uimg boot.scr
boot_targets=mmc1 mmc0 usb0 pxe dhcp
bootargs=storagemedia=emmc androidboot.mode=normal androidboot.dtbo_idx=0
bootcmd=boot_android ${devtype} ${devnum};bootrkp;run distro_bootcmd;
bootcmd_dhcp=run boot_net_usb_start; if dhcp ${scriptaddr} ${boot_script_dhcp}; then source ${scriptaddr}; fi;
bootcmd_mmc0=setenv devnum 0; run mmc_boot
bootcmd_mmc1=setenv devnum 1; run mmc_boot
bootcmd_pxe=run boot_net_usb_start; dhcp; if pxe get; then pxe boot; fi
bootcmd_usb0=setenv devnum 0; run usb_boot
bootdelay=0
cpu=armv8
cpuid#=5434525834392e30300000000016078a
devnum=0
devtype=mmc
distro_bootcmd=for target in ${boot_targets}; do run bootcmd_${target}; done
ethaddr=ce:23:1d:df:56:23
fdt_addr_r=0x08300000
kernel_addr_r=0x00280000
mmc_boot=if mmc dev ${devnum}; then setenv devtype mmc; run scan_dev_for_boot_part; fi
partitions=uuid_disk=${uuid_gpt_disk};name=loader1,start=32K,size=4000K,uuid=${uuid_gpt_loader1};name=loader2,start=8MB,size=4MB,uuid=${uuid_gpt_loader2};name=trust,size=4M,uuid=${uuid_gpt_atf};name=boot,size=112M,bootable,uuid=${uuid_gpt_boot};name=rootfs,size=-,uuid=B921B045-1DF0-41C3-AF44-4C6F280D3FAE;
pxefile_addr_r=0x00600000
ramdisk_addr_r=0x0a200000
rkimg_bootdev=if mmc dev 1 && rkimgtest mmc 1; then setenv devtype mmc; setenv devnum 1; echo Boot from SDcard;elif mmc dev 0; then setenv devtype mmc; setenv devnum 0;elif rknand dev 0; then setenv devtype rknand; setenv devnum 0;elif rksfc dev 0; then setenv devtype spinand; setenv devnum 0;elif rksfc dev 1; then setenv devtype spinor; setenv devnum 1;fi;
scan_dev_for_boot=echo Scanning ${devtype} ${devnum}:${distro_bootpart}...; for prefix in ${boot_prefixes}; do run scan_dev_for_extlinux; run scan_dev_for_scripts; done;
scan_dev_for_boot_part=part list ${devtype} ${devnum} -bootable devplist; env exists devplist || setenv devplist 1; for distro_bootpart in ${devplist}; do if fstype ${devtype} ${devnum}:${distro_bootpart} bootfstype; then run scan_dev_for_boot; fi; done
scan_dev_for_extlinux=if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}extlinux/extlinux.conf; then echo Found ${prefix}extlinux/extlinux.conf; run boot_extlinux; echo SCRIPT FAILED: continuing...; fi
scan_dev_for_scripts=for script in ${boot_scripts}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${script}; then echo Found U-Boot script ${prefix}${script}; run boot_a_script; echo SCRIPT FAILED: continuing...; fi; done
scriptaddr=0x00500000
serial#=VAN10A203250431
soc=rockchip
stderr=serial,vidconsole
stdout=serial,vidconsole
usb_boot=usb start; if usb dev ${devnum}; then setenv devtype usb; run scan_dev_for_boot_part; fi
vendor=rockchip

Environment size: 3128/32764 bytes

@alphab0ing
Copy link
Author

This might work...

fdt addr ${fdt_addr}
fdt print

That might give you the device tree to copy/paste

@alphab0ing
Copy link
Author

looks like fdt is 0x08300000 so like this..

fdt addr 0x08300000
fdt print

@tds04
Copy link

tds04 commented Nov 23, 2024

fdt.txt

@alphab0ing
Copy link
Author

Can you send me a picture of your good board??? Yours has edp disable which is opposite of dump 1 and your calling for ptn3460 probe which is an edp bridge i'm wondering if the board is the same or very similar?

@tds04
Copy link

tds04 commented Nov 23, 2024

image

@alphab0ing
Copy link
Author

That's very odd, one is setup to use mipi dsi and the other edp, completely different...

@alphab0ing
Copy link
Author

I've been trying to get the edp bridge to work, let me try one thats setup like the fdt you just sent me and use mipi_dsi...i'll send over in just a min.

@alphab0ing
Copy link
Author

alphab0ing commented Nov 23, 2024

Here's mipi dsi configuration..

uboot.zip

run the boot loader,

rkdeveloptool gpt parameter_gpt.txt
rkdeveloptool ul loader.bin
rkdeveloptool wl 0x40 idbloader.img
rkdeveloptool wl 0x4000 u-boot.itb
rkdeveloptool wl 0x8000 boot.img
rkdeveloptool rd

@barrenechea
Copy link
Owner

Hey! I created a new Discord server fl3xbl0w since this issue is becoming quite huge and not the best suited place for it (I think).

It is pretty barebones, but feel free to join here! https://discord.gg/uX85bh73. Comms should be more fluent over there 😄

@tds04
Copy link

tds04 commented Nov 24, 2024

nothing on uart

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants