colemickens / h96-max-v58-investigation Goto Github PK

h96-max-v58-investigation's Introduction

h96-max-v58 investigation

h96-max-v58 investigation

Rock Pi 5 should be shipping soon, but this thing is cute, in an enclosure, etc. Maybe the Rock Pi 5 will help support this thing too.

Hopefully here we can collect info about the H96 Max V58 device

dump the Android boot part
get the DTB?
figure out if they're using a kernel fork and if we can get access etc

Item Purchased:

https://www.aliexpress.com/item/3256802713801854.html

dumps

❯ adb shell
rk3588_box:/ # ls /dev/block/by-name
backup  baseparameter  boot  cache  dtbo  logo  metadata  misc
mmcblk0  mmcblk0boot0  mmcblk0boot1
recovery  security  super  trust  uboot  userdata  vbmeta

❯ cat /proc/device-tree/compatible; echo
rockchip,rk3588-nvr-demo-v10-androidrockchip,rk3588

❯ file boot.img
boot.img: Android bootimg, kernel (0x10008000), ramdisk (0x11000000), second stage (0x10f00000), page size: 2048, cmdline (console=ttyFIQ0 firmware_class.path=/vendor/etc/firmware init=/init rootwait ro loop.max_part=7 androidboot.console=ttyFIQ0 and)

note the weird console=tty val
internet archive:
- details page: https://archive.org/details/h96-max-v58-dump
- direct dl listing: https://archive.org/download/h96-max-v58-dump

uart access

baud rate is 1500000
- use the hw597 uart thing (link aliexpress)

usb otg access

in certain scenarios, the device will be accessible over USB (think OTG)
use a USB-C to USB-A cable
the USB-A end goes in the USB2 port on the device (black inner plastic bit)
the USB-C end goes in your computer/adapter/etc

adb access

Device settings
Tap "Android TV Build Version" x 6
Now you have dev menu.
Enable dev options, "over internet"
adb connect <dev-ip> from your PC

-> recovery

Unplug device + ensure the device isn't usb connected to a PC
Hold reset.
Plug device.
Let go after... 3 seconds. (If you hold too long, you will enter bootloader)

notes:

"Sideload" doesn't seem to work...

-> fastbootd

Enter recovery (see above)
Press "Enter Fastboot". (use usb-keyboard, or you can use IR remote)

notes:

doesn't seem to do anything, doesn't show as fastboot device, incorrectly says secureboot or whatever is on

unclear if this is useful, re-plugging USB-OTG here doesn't do anything

-> bootloader

Enter recovery (see above)
Press "Enter Bootloader". (use usb-keyboard, or you can use IR remote)
Connect to the board OTG style. (see above)

❯ fastboot devices
HCY58uk5hm8Tp85DwGAj	Android Fastboot

-> rockusb mode

Unplug the board.
Connect to the board OTG style. (see above)
Hold reset button, plug the board in.
Release reset button after 6 seconds.

relevant boot uart log:

boot mode: recovery (misc)
boot mode: None
Android 12.0, Build 2022.6, v2
Found DTB in boot part
DTB: rk-kernel.dtb
HASH(c): OK
ANDROID: fdt overlay OK
[snip]
Model: Rockchip RK3588 NVR DEMO LP4 V10 Android Board
download key pressed... entering download mode...
RKUSB: LUN 0, dev 0, hwpart 0, sector 0x0, count 0x747c000
\%

(the last bit is animated, seemingly waiting for rockusb commands from PC)

dmesg output:

[90320.423807] usb 3-1: New USB device found, idVendor=2207, idProduct=350b, bcdDevice= 2.23
[90320.423812] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[90320.423815] usb 3-1: Product: USB download gadget
[90320.423816] usb 3-1: Manufacturer: Rockchip
[90320.423817] usb 3-1: SerialNumber: HCY58uk5hm8Tp85DwGAj

backup/dump device

~
❯ rkdeveloptool ld
DevNo=1	Vid=0x2207,Pid=0x350b,LocationID=301	Loader

adb pull


~
❯ adb root
restarting adbd as root

~
❯ adb pull /dev/block/by-name/boot /tmp/boot.img
/dev/block/by-name/boot: 1 file pulled, 0 skipped. 94.3 MB/s (50331648 bytes in 0.509s)

h96-max-v58-investigation's People

Contributors

Watchers

Forkers

poskyc

h96-max-v58-investigation's Issues

force maskrom mode?

Unfortunately, I think I put a bad u-boot on here, so now I can't boot to rkusb mode in u-boot.

But, there's enough there that maskrom mode doesn't boot, and it loads u-boot.

So... it would appear I need to figure out where the pins to FORCE maskrom mode on this board are.

And I have no idea. :)

u-boot work in progress

It's "close"-ish, I guess. But still doesn't want to really boot off USB, seems to hang? Not sure, quick braindump.

This is using a hacked up defconfig, starting from the rock5b dtb.

It gets closer than when I tried to use the evb-rk3588_defconfig from the collabora repo.

my upstream, collabora: https://gitlab.collabora.com/hardware-enablement/rockchip-3588/u-boot/-/tree/2023.07-rc4-rock5b

my fork: https://github.com/colemickens/u-boot/tree/h96maxv58

Boot1 Release Time: Jun  6 2022 17:57:22, version: 1.09
Emmc IO init.
Emmc IO init.
mmc_set_bus_width: 1
SetEmmcClk: 375000, 2, 64
SetEmmcClk: 375000, 2, 64
mmc_set_bus_width: 8
SetEmmcClk: 200000000, 0, 3
Enable PHY CLK: 200000000, timing: 9
SdmmcInit=2 0
BootCapSize=100000
UserCapSize=59640MB
FwPartOffset=2000 , 100000
UsbBoot ...415971
powerOn 418241
SoftReset, 5553803 us
DDR V1.11 f1474cf52f cym 23/05/09-11:02:36
LPDDR4X, 2112MHz
channel[0] BW=16 Col=10 Bk=8 CS0 Row=16 CS1 Row=16 CS=2 Die BW=16 Size=2048MB
channel[1] BW=16 Col=10 Bk=8 CS0 Row=16 CS1 Row=16 CS=2 Die BW=16 Size=2048MB
channel[2] BW=16 Col=10 Bk=8 CS0 Row=16 CS1 Row=16 CS=2 Die BW=16 Size=2048MB
channel[3] BW=16 Col=10 Bk=8 CS0 Row=16 CS1 Row=16 CS=2 Die BW=16 Size=2048MB
Manufacturer ID:0x6
CH0 RX Vref:27.9%, TX Vref:24.8%,24.8%
CH1 RX Vref:27.9%, TX Vref:24.8%,24.8%
CH2 RX Vref:27.5%, TX Vref:25.8%,23.8%
CH3 RX Vref:26.3%, TX Vref:22.8%,22.8%
change to F1: 528MHz
change to F2: 1068MHz
change to F3: 1560MHz
change to F0: 2112MHz
out

U-Boot SPL 2023.07-rc4 (Jan 01 1980 - 00:00:00 +0000)
Trying to boot from MMC2
## Checking hash(es) for config config-1 ... OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
## Checking hash(es) for Image u-boot ... sha256+ OK
## Checking hash(es) for Image fdt-1 ... sha256+ OK
## Checking hash(es) for Image atf-2 ... sha256+ OK
## Checking hash(es) for Image atf-3 ... sha256+ OK
INFO:    Preloader serial: 2
NOTICE:  BL31: v2.3():v2.3-589-g3389cfdda:derrick.huang
NOTICE:  BL31: Built : 10:14:29, May  9 2023
INFO:    spec: 0x1
INFO:    ext 32k is not valid
INFO:    ddr: stride-en 4CH
INFO:    GICv3 without legacy support detected.
INFO:    ARM GICv3 driver initialized in EL3
INFO:    valid_cpu_msk=0xff bcore0_rst = 0x0, bcore1_rst = 0x0
INFO:    system boots from cpu-hwid-0
INFO:    idle_st=0x21fff, pd_st=0x11fff9, repair_st=0xfff70001
INFO:    dfs DDR fsp_params[0].freq_mhz= 2112MHz
INFO:    dfs DDR fsp_params[1].freq_mhz= 528MHz
INFO:    dfs DDR fsp_params[2].freq_mhz= 1068MHz
INFO:    dfs DDR fsp_params[3].freq_mhz= 1560MHz
INFO:    BL31: Initialising Exception Handling Framework
INFO:    BL31: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader, Booting device without OPTEE initialization. SMC`s destined for OPTEE will return SMC_UNK
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0xa00000
INFO:    SPSR = 0x3c9


U-Boot 2023.07-rc4 (Jan 01 1980 - 00:00:00 +0000)007-pre [variant: noenv]

Model: Radxa ROCK 5 Model B
DRAM:  8 GiB (effective 7.7 GiB)
Core:  741 devices, 29 uclasses, devicetree: separate
MMC:   mmc@fe2c0000: 1, mmc@fe2e0000: 0
Loading Environment from nowhere... OK
In:    serial
Out:   serial
Err:   serial
Model: Radxa ROCK 5 Model B
Net:   No ethernet found.
Hit any key to stop autoboot:  0
Card did not respond to voltage select! : -110
Bus usb@fc800000: USB EHCI 1.00
Bus usb@fc840000: USB OHCI 1.0
Bus usb@fc880000: USB EHCI 1.00
Bus usb@fc8c0000: USB OHCI 1.0
Bus usb@fc400000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus usb@fc800000 for devices... 1 USB Device(s) found
scanning bus usb@fc840000 for devices... 1 USB Device(s) found
scanning bus usb@fc880000 for devices... 1 USB Device(s) found
scanning bus usb@fc8c0000 for devices... 1 USB Device(s) found
scanning bus usb@fc400000 for devices... 1 USB Device(s) found

stock factory firmware, unpacked

Firmware Source:

filename is ./RK3588_userdebug_H96_Max_V58_12_20221116.1404.img
url: https://www.h96tvbox.com/firmware-download/
look for RK3588_userdebug_H96_Max_V58

Unpack attempts:

rkdeveloptool - can't unpack (not sure what the option is, if there's one)
rkflashtool -> rkunpack - can't unpack: linux-rockchip/rkflashtool#15
AndroidTool -> can't unpack
"FactoryTool" as provided on the download/docs page for the stock firmware seems to load the firmware image, but only does bulk flashing, not unpacking
RKDevTool_Release_v2.86 SUCCESS, unpacked

I've re-uploaded the unpacked firmware here, partly because it was annoying to have to use Windows, and others might be interested:

https://archive.org/details/rk-3588-userdebug-h-96-max-v-58-12-20221116.1404-unpacked.-7z

I suspect that firmware.img is the same as the unpacked Android contents, but since I wasn't sure, I just 7zipped the entire output from RKDevTool and uploaded it.

serial access

Can You elaborate more on uart locations and voltage?

Blue underbody LED

Any way to turn that off? It's distractingly bright. Too much so for a darkened room with video projector.

Extracted dtb

I extracted the dtb (and kernel) from boot.img using extract_dtb.py and I have also converted the dtb to dts using dtc.

It should be fairly straightforward to get Linux to boot (using e.g. resident/vendor u-boot on eMMC) as long as a dtb that works also for Linux is set up. I don't know what needs to be adapted in this case though (the Android Linux kernel here is 5.10.66, according to info inside the extracted kernel). Edit2: Some more info about the kernel version:

$ strings 00_kernel | grep "Linux version"
Linux version 5.10.66 (qmx_srv@qmxsrv-MS-7C09) (Android (7284624, based on r416183b) clang version 12.0.5 (https://android.googlesource.com/toolchain/llvm-project c935d99d7cf2016289302412d708641d52d2f7ee), LLD 12.0.5 (/buildbot/src/android/llvm-toolchain/out/llvm-project/lld c935d99d7cf2016289302412d708641d52d2f7ee)) #8 SMP PREEMPT Fri Aug 5 14:38:09 CST 2022
Linux version %s (%s)

If you are interested I can try to help (don't have a h96max v58 box, however).

Edit: I see now that you probably already have the dtb (since I guess you grabbed it from /proc).