Q7的硬件配置

CPU: S905L

RAM: MIRA P3P4GF4DMF/P3P4GF4BLF DDR3 512MB * 2 = 1GB

ROM: 镁光29F64G08CBABB(NAND) * 1 = 8GB or SanDisk SDINBDG4-8G(eMMC) * 1 = 8GB

WIFI: RTL8189FTV

AMP: SGM8905

Interface: USB2.0 * 2, AV * 1, HDMI * 1, Micro Sdcard Reader * 1, 10/100M eth * 1, IR * 1, SPDIF * 1

Power: 待机 0.9W, 工作 2.9~3.0W, 播放视频时3.5W

Q7有两种存储, 一种是NAND, 另一种是eMMC, 对应在板子上前者是长方形针脚的IC, 后者是正方形BGA焊接的IC. 在UBOOT启动时, NAND和eMMC的启动信息是不同的

# NAND

BL2 Built : 18:58:24, Oct 25 2016.

gxl gc9db010 - xiaobo.gu@droid05

set vcck to 1080 mv

set vddee to 1050 mv

Board ID = 7, adc=557

CPU clk: 1200MHz

2layers board, use ddr_set[0]

DDR chl: Rank0+1 @ 720MHz - FAIL

DDR chl: Rank0 @ 720MHz - PASS

DQS-corr enabled

DDR scramble enabled

Rank0: 1024MB(auto)-2T-11

DataBus test pass!

AddrBus test pass!

NAND init

Load fip header from NAND, src: 0x0000c000, des: 0x01400000, size: 0x00004000

Load bl30 from NAND, src: 0x00010000, des: 0x01100000, size: 0x00007400

Load bl301 from NAND, src: 0x00018000, des: 0x01200000, size: 0x00002000

Load bl31 from NAND, src: 0x0001c000, des: 0x10100000, size: 0x00019400

Load bl33 from NAND, src: 0x00038000, des: 0x01000000, size: 0x000a6200

NOTICE: BL3-1: v1.0(debug):959fdf0

NOTICE: BL3-1: Built : 15:01:44, Dec 29 2016

# eMMC

BL2 Built : 18:58:24, Oct 25 2016.

gxl gc9db010 - xiaobo.gu@droid05

set vcck to 1080 mv

set vddee to 1050 mv

Board ID = 7, adc=530

CPU clk: 1200MHz

2layers board, use ddr_set[0]

DDR chl: Rank0+1 @ 720MHz - FAIL

DDR chl: Rank0 @ 720MHz - PASS

DQS-corr enabled

DDR scramble enabled

Rank0: 1024MB(auto)-2T-11

DataBus test pass!

AddrBus test pass!

-s

Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000

Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x00007400

Load bl301 from eMMC, src: 0x00018200, des: 0x01200000, size: 0x00002000

Load bl31 from eMMC, src: 0x0001c200, des: 0x10100000, size: 0x00019400

Load bl33 from eMMC, src: 0x00038200, des: 0x01000000, size: 0x000a6200

NOTICE: BL3-1: v1.0(debug):959fdf0

NOTICE: BL3-1: Built : 15:01:44, Dec 29 2016

Q7的刷机

准备工作

固件: 首先鄙视一下ZNDS这个破网站, 下固件要收钱, 还有刷完要交钱才能用的固件, 百度下满屏都是这个网站的结果.

对于NAND存储的Q7: http://www.hdpfans.com/thread-787070-1-1.html 下载`移动魔百和M201S, 数讯视讯Q7`下20171208开头的文件.

Update 20191218: 上面那个固件, TTL Shell里有很多RTL818X的调试信息输出, 影响命令行操作, 推荐使用这个新的固件 https://www.right.com.cn/forum/thread-1769596-1-1.html

对于eMMC存储的Q7:

安装USB Burning Tool, 安装驱动, 准备双公头USB线

这个和R3300L, N1都是一样的, 网上很多说明不再赘述.

拆卸盒子

有些早期的版本, 在底板上标R字的地方, 底下有贴片微触开关, 这种就不需要拆, 如果里面没焊这个元件, 就必须拆了

Q7的拆卸其实是很容易的, 因为这个盒子的壳很软, 拿裁纸刀刀背往里伸, 轻轻一撬就能开一边, 四周一圈轻松就把底盖取下来.

刷机步骤

1. 盒子拔电, 开关处于关机的状态, 双公头线一头插在靠近TF卡槽的USB口 (另一个口是否能用不知道, 没试过, 我是看别人的说明这么做的).

2. 电脑上打开USB Burning Tool

3. 用一根漆包线(从网线里拆出来那种), 两头露出两三毫米的铜芯, 插在标有UBOOT USB的两个过孔上, 用手稍微斜摁住. 这个目的是让两个过孔短接, 但是注意露出的铜芯不要太长, 不要误接到四周其他的元件上. 如果是第一次刷, 你得把三个螺丝拧下来, 在电路板正面找到这两个孔. 如果熟悉了, 其实不用拆螺丝也可以, 在电路板背面是直接能看到这两个过孔的, 直接在背面短接就可以了.

4. 保持住3的短接状态, 将双公头USB线另一头连上电脑, 此时应该在USB Burning Tool的界面上看到 HUB2-1: Connected Success 之类的提示, 并且盒子的电源灯亮起. 此时板子就已经进入USB调试状态, 可以松开短接了, 把线撤掉.

5. 在USB Burning Tool 里选择img, 保持Erase Flash和Erase Bootloader两个勾选不动, 点击Start, 正常情况进度条就会自动从0%走到100%

6. 点击Stop, 然后关闭USB Burning Tool, 再拔掉USB线, 此时刷机就算完成了.

Q7的mmc初始化报错无法进系统

今天上午在给一个NAND存储的Q7加焊TTL引线后, 发现开机无法进入系统了, TTL输出一直重复着错误输出, 其错误输出是这样的

Hit any key to stop autoboot: 0

card out

emmc/sd response timeout, cmd8, status=0x1ff2800

emmc/sd response timeout, cmd55, status=0x1ff2800

emmc/sd response timeout, cmd1, status=0x1ff2800

(Re)start USB...

USB0: USB3.0 XHCI init start

Register 2000140 NbrPorts 2

Starting the controller

USB XHCI 1.00

scanning bus 0 for devices... 1 USB Device(s) found

scanning usb for storage devices... 0 Storage Device(s) found

** Bad device usb 0 **

** Bad device usb 1 **

** Bad device usb 2 **

** Bad device usb 3 **

emmc/sd response timeout, cmd8, status=0x100a800

emmc/sd response timeout, cmd55, status=0x100a800

emmc/sd response timeout, cmd1, status=0x100a800

** Bad device mmc 1 **

quene rb busy here

phy read failed at devops->addr: 5c404000

aml_ops_read_page failed: 5c404000 369 1

nand_read_logic_page : read a page ecc failed

do_prio_gc block:369, type:1

quene rb busy here

phy read failed at devops->addr: 5c7fc000

aml_ops_read_page failed: 5c7fc000 369 255

prio_garbage_collect cannot find PHY_MAPPING_PAGE c8ffffff !!

quene rb busy here

phy read failed at devops->addr: 5c400000

aml_ops_read_page failed: 5c400000 369 0

quene rb busy here

phy read failed at devops->addr: 5c404000

aml_ops_read_page failed: 5c404000 369 1

quene rb busy here

phy read failed at devops->addr: 5c408000

aml_ops_read_page failed: 5c408000 369 2

其后一直无限重复这三行输出, 并且无法拍空格进入uboot命令行. 因为启动的检查顺序是sdcard, mmc, usb0 ~ 3, 所以如果插着卡, 依然可以用TF卡启动Armbian系统, 只是无法从自身启动. 而且从Armbian系统中也无法通过fw_printenv查看uboot配置, 报设备不存在, 确实mmc启动失败了当然找不到. 检查线路板没有明显的虚焊脱焊或者焊锡渣, 怀疑是不是没注意接地被静电搞坏了.

晚上抱着试一试的心理短接UBOOT USB孔看看能不能进usb burn模式, 结果还连接上了. 于是加载img线刷试试. TTL输出中看到有关于检测到坏块的日志, 重新擦写后, 线刷成功了.

这个使用NAND的盒子只能刷特定的固件, 每次刷的时候都会重新进行擦写, 并且提示坏块. 在运行EmuELEC和Armbian时, 也无法识别出NAND设备, 无法使用ddbr进行备份和恢复, 在运行高版本Armbian后, 会再次出现内部存储错误而无法从本机启动的情况.

U-Boot 2015.01-gd893f87 (Jul 13 2016 - 19:10:21)

DRAM: 1 GiB

Relocation Offset is: 36ed2000

[MSG]MMC init in usb

aml_priv->desc_buf = 0x0000000033ec2630

aml_priv->desc_buf = 0x0000000033ec47c0

SDIO Port B: 0, SDIO Port C: 1

Enter USB burn

Set Addr 6

Get DT cfg

Get DT cfg

Get DT cfg

set CFG

ID[16]

tplcmd[ echo 12345]

12345

[MSG]ret = 0

[info]success

BULKcmd[ low_power]

[info]success

ID[16]

tplcmd[ download mem dtb normal 149504]

[MSG]Down(mem) part(dtb) sz(0x24800) fmt(normal)

[MSG]totalSlotNum = 0, nextWriteBackSlot 3

[info]success

[MSG]Burn Start...

[MSG]load dt.img to 0x0000000001000000, sz=0x24800

[MSG]Burn complete

BULKcmd[download get_status]

[info]success

BULKcmd[disk_initial 1]

Amlogic multi-dtb tool

Multi dtb detected

Multi dtb tool version: v2 .

Support 4 dtbs.

aml_dt soc: gxl platform: p211 variant: 1g

dtb 0 soc: gxbb plat: p201 vari: 1g

dtb 1 soc: gxbb plat: p201 vari: 2g

dtb 2 soc: gxl plat: p211 vari: 1g

dtb 3 soc: gxl plat: p211 vari: 2g

Find match dtb: 2

start dts,buffer=0000000001000000,dt_addr=0000000001011800

parts: 14

00: logo 0000000002000000 1

01: recovery 0000000002000000 1

02: rsv 0000000000800000 1

03: tee 0000000000800000 1

04: crypt 0000000002000000 1

05: misc 0000000002000000 1

06: instaboot 0000000020000000 1

07: boot 0000000002000000 1

08: system 0000000028000000 1

09: cache 0000000020000000 2

10: ghost 0000000020000000 4

11: info 0000000004000000 4

12: params 0000000004000000 2

13: data ffffffffffffffff 4

emmc/sd response timeout, cmd = 8

emmc/sd response timeout, cmd = 55

emmc/sd response timeout, cmd = 1

EMMC init failed

boot_device_flag : 1

Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.

init bus_cycle=6, bus_timing=8, system=5.0ns

NAND device id: 2c 64 44 4b a9 0 0 0

detect NAND device: B revision NAND 8GiB MT29F64G08CBABA

XXXXXXX======enter NAND boot======XXXXXX

boot_device_flag : 1

Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.

init bus_cycle=6, bus_timing=8, system=5.0ns

NAND device id: 2c 64 44 4b a9 0 0 0

detect NAND device: B revision NAND 8GiB MT29F64G08CBABA

new oob mode

bus_c=6,bus_t=8,sys=4.0ns,T_REA=16,T_RHOH=15

show_phydev_list

0: nfboot

detect new nand here and new_type:50

NAND CKECK:arg nbbt: valid=1, blk=5, page=0

NAND CKECK:arg fbbt: valid=1, blk=6, page=0

outside dtb: 0000000033ec69a0

NAND CKECK:arg ndtb: valid=1, blk=7, page=33

amlnf_detect_dtb_partitions:dtb_erase_blk:7

NAND CKECK:arg nkey: valid=1, blk=10, page=0

start_blk =0,total_blk=4096

nand erasing 0 % --10 % complete

protect nand_bbt info at blk 5

chipenv block skipping!!!!!!!0x5

protect fbbt at blk 6

chipenv block skipping!!!!!!!0x6

protect nand_key info at blk 10

chipenv block skipping!!!!!!!0xa

bad block skipping!!!!0x5a

bad block skipping!!!!0x5b

nand erasing 10 % --20 % complete

nand erasing 20 % --30 % complete

nand erasing 30 % --40 % complete

nand erasing 40 % --50 % complete

nand erasing 50 % --60 % complete

nand erasing 60 % --70 % complete

nand erasing 70 % --80 % complete

nand erasing 80 % --90 % complete

nand erasing 90 % --100 % complete

nandphy_init failed and ret=0xffffffff

nand_init failed ret:1

command: amlnf init 1

boot_device_flag : 1

Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.

init bus_cycle=6, bus_timing=8, system=5.0ns

NAND device id: 2c 64 44 4b a9 0 0 0

detect NAND device: B revision NAND 8GiB MT29F64G08CBABA

new oob mode

bus_c=6,bus_t=8,sys=4.0ns,T_REA=16,T_RHOH=15

show_phydev_list

0: nfboot

detect new nand here and new_type:50

NAND CKECK:arg nbbt: valid=1, blk=5, page=0

NAND CKECK:arg fbbt: valid=1, blk=6, page=0

outside dtb: 0000000033ec69a0

NAND CKECK:arg ndtb: valid=0, blk=0, page=0

found NO arg : ndtb info

amlnf_detect_dtb_partitions:dtb_erase_blk:-1

NAND CKECK:arg ncnf: valid=0, blk=0, page=0

found NO arg : ncnf info

aml_key_init probe.

NAND CKECK:arg nkey: valid=1, blk=10, page=0

nand dtb: probe.

NAND CKECK:arg ndtb: valid=0, blk=0, page=0

found NO arg : ndtb info

boot_device_flag 1

NAND CKECK:arg nenv: valid=0, blk=0, page=0

found NO arg : nenv info

bbt_valid_ops: do nothing!

amlnand_get_dev_configs() 4104

partition-> partiton_num 2

partition-> partiton_num 9

partition-> partiton_num 3

amlnand_save_info_by_name(), 1155

name ncnf, size:3248

amlnand_save_info_by_name, 1221: new blk 4

nfboot : 0x000000000000-0x000000800000 :partn=0:single_chip single_plane

nfcache : 0x000006800000-0x000029000000 :partn=2:single_chip multi_plane

nfcode : 0x00002f800000-0x00005c800000 :partn=9:single_chip multi_plane

nfdata : 0x00008c000000-0x000174000000 :partn=3:single_chip multi_plane

(nfboot) bad blks 0

(nfcache) bad blks 0

(nfcode) bad blks 0

(nfdata) bad blks 0

amlnf_logic_init() start

(nfcache), size:29000000

nftl version 1.01.001

size_in_blk 164; total_block 163;

nftl start: size 163, free 19

-blks(163), total_blocks(144)

all block full!!

current block: 163

(nfcode), size:5c800000

nftl version 1.01.001

nftl start: size 370, free 38

-blks(370), total_blocks(332)

all block full!!

current block: 369

(nfdata), size:174000000

nftl version 1.01.001

nftl start: size 1488, free 139

-blks(1488), total_blocks(1349)

all block full!!

current block: 1487

amlnf_logic_init() done

dtb erase Okay

[store]To run cmd[amlnf dtb_write 0x0000000001000000 0x40000]

cmd dtb_write:

amlnf_dtb_save: ####

amlnand_save_info_by_name(), 1155

name ndtb, size:262144

amlnand_save_info_by_name, 1221: new blk 7

262144 bytes dtd_write : OK

[MSG]usb producing env_relocate

uboot env amlnf_env_read : ####

uboot env arg_valid = 0 invalid,amlnf_env_read

*** Warning - bad CRC, using default environment

Saving Environment to aml-storage...

uboot env amlnf_env_save : ####

amlnand_save_info_by_name(), 1155

name nenv, size:65536

amlnand_save_info_by_name, 1221: new blk 8

Amlogic multi-dtb tool

Multi dtb detected

Multi dtb tool version: v2 .

Support 4 dtbs.

aml_dt soc: gxl platform: p211 variant: 1g

dtb 0 soc: gxbb plat: p201 vari: 1g

dtb 1 soc: gxbb plat: p201 vari: 2g

dtb 2 soc: gxl plat: p211 vari: 1g

dtb 3 soc: gxl plat: p211 vari: 2g

Find match dtb: 2

[info]success

ID[16]

tplcmd[download store boot normal 9868780]

[MSG]flash LOGIC partCap 0x2000000B

[MSG]Down(store) part(boot) sz(0x9695ec) fmt(normal)

[MSG]totalSlotNum = 0, nextWriteBackSlot 1

[info]success

Q7的固件分析

Q7的固件包含文件及其说明如下

aml_sdc_burn.ini

aml_sdc_burn.UBOOT

卡刷时的配置文件, 和卡刷时的UBOOT固件, 在卡刷启动时会先加载这个UBOOT, 再进行后面的烧录

boot.PARTITION

这个是烧在内部NAND/eMMC的boot分区上的内容, 也即机器的UBOOT

bootloader.PARTITION

这个是内部的bootloader, 加电后最先启动的程序

DDR.USB

不清楚

image.cfg

此固件的配置信息

logo.PARTITION

开机画面, 中间升级, 升级成功, 升级失败的画面等

manifest.xml

安卓的编译信息

meson1.dtb

硬件信息文件, 需要和bootloader配合使用

platform.conf

不确定, 各分区的地址?

recovery.PARTITION

recovery分区的内容, 从boot启动到update后, 如果未进入usb burn, 也没有找到usb或sdcard上的升级内容, 就会进入recovery, 这是一个独立的小系统

system.PARTITION

安卓最重要的system分区的内容, 包含了命令行工具, 启动动画, 以及其他安卓相关的文件

UBOOT.USB

进入USB Burn模式后, 板子会重启并加载这个UBOOT, 再进行后面的烧录

.存在有一部分Q7的板子, 通过USB Burn模式刷固件会在4%的时候报内部存储初始化错误, 是因为UBOOT.USB无法识别此板子的mmc. 除了这个文件以外, bootloader.PARTITION和meson1.dtb也是和Q7关系很大的文件.

Q7启动后的存储挂载

mount, 是从/dev/block/ 下面的设备挂载出来的

adb shell mount

rootfs / rootfs ro,seclabel 0 0

tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0

devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0

proc /proc proc rw,relatime 0 0

sysfs /sys sysfs rw,seclabel,relatime 0 0

selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0

debugfs /sys/kernel/debug debugfs rw,seclabel,relatime 0 0

configfs /sys/kernel/config configfs rw,relatime 0 0

none /acct cgroup rw,relatime,cpuacct 0 0

none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0

tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0

tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0

none /dev/cpuctl cgroup rw,relatime,cpu 0 0

tmpfs /tmp tmpfs rw,seclabel,relatime 0 0

tmpfs /tmp/playInfoLog tmpfs rw,seclabel,relatime 0 0

tmpfs /tmp/capture tmpfs rw,seclabel,relatime 0 0

tmpfs /storage/external_storage tmpfs rw,seclabel,relatime,mode=775,uid=1000,gid=1023 0 0

/dev/block/system /system ext4 ro,seclabel,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,errors=remount-ro 0 0

/dev/block/data /data ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,discard,nodelalloc,noauto_da_alloc,data=ordered 0 0

/dev/block/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0

/dev/block/params /params ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0

/dev/block/ghost /ghost ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0

/dev/block/info /info ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0

/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0

adb /dev/usb-ffs/adb functionfs rw,relatime 0 0

df

adb shell df

Filesystem Size Used Free Blksize

/dev 389.4M 128.0K 389.3M 4096

/sys/fs/cgroup 389.4M 12.0K 389.4M 4096

/mnt/asec 389.4M 0.0K 389.4M 4096

/mnt/obb 389.4M 0.0K 389.4M 4096

/tmp 389.4M 0.0K 389.4M 4096

/tmp/playInfoLog 389.4M 0.0K 389.4M 4096

/tmp/capture 389.4M 240.0K 389.2M 4096

/storage/external_storage 389.4M 0.0K 389.4M 4096

/system 506.9M 387.7M 119.2M 1024

/data 4.6G 108.7M 4.5G 4096

/cache 495.9M 388.0K 495.6M 4096

/params 59.0M 40.0K 58.9M 4096

/ghost 495.9M 388.0K 495.6M 4096

/info 59.0M 44.0K 58.9M 4096

/mnt/shell/emulated 4.5G 108.7M 4.4G 4096