数码视讯Q7的刷机

Q7的硬件配置

CPU: S905L
RAM: MIRA P3P4GF4DMF/P3P4GF4BLF DDR3 512MB * 2 = 1GB
ROM: 镁光29F64G08CBABB(NAND) * 1 = 8GB or SanDisk SDINBDG4-8G(eMMC) * 1 = 8GB
WIFI: RTL8189FTV
AMP: SGM8905
Interface: USB2.0 * 2, AV * 1, HDMI * 1, Micro Sdcard Reader * 1, 10/100M eth * 1, IR * 1, SPDIF * 1
Power: 待机 0.9W, 工作 2.9~3.0W, 播放视频时3.5W

Q7有两种存储, 一种是NAND, 另一种是eMMC, 对应在板子上前者是长方形针脚的IC, 后者是正方形BGA焊接的IC. 在UBOOT启动时, NAND和eMMC的启动信息是不同的

# NAND
BL2 Built : 18:58:24, Oct 25 2016.
gxl gc9db010 - xiaobo.gu@droid05

set vcck to 1080 mv
set vddee to 1050 mv
Board ID = 7, adc=557
CPU clk: 1200MHz
2layers board, use ddr_set[0]
DDR chl: Rank0+1 @ 720MHz - FAIL
DDR chl: Rank0 @ 720MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
NAND init
Load fip header from NAND, src: 0x0000c000, des: 0x01400000, size: 0x00004000
Load bl30 from NAND, src: 0x00010000, des: 0x01100000, size: 0x00007400
Load bl301 from NAND, src: 0x00018000, des: 0x01200000, size: 0x00002000
Load bl31 from NAND, src: 0x0001c000, des: 0x10100000, size: 0x00019400
Load bl33 from NAND, src: 0x00038000, des: 0x01000000, size: 0x000a6200
NOTICE:  BL3-1: v1.0(debug):959fdf0
NOTICE:  BL3-1: Built : 15:01:44, Dec 29 2016

# eMMC
BL2 Built : 18:58:24, Oct 25 2016.
gxl gc9db010 - xiaobo.gu@droid05

set vcck to 1080 mv
set vddee to 1050 mv
Board ID = 7, adc=530
CPU clk: 1200MHz
2layers board, use ddr_set[0]
DDR chl: Rank0+1 @ 720MHz - FAIL
DDR chl: Rank0 @ 720MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x00007400
Load bl301 from eMMC, src: 0x00018200, des: 0x01200000, size: 0x00002000
Load bl31 from eMMC, src: 0x0001c200, des: 0x10100000, size: 0x00019400
Load bl33 from eMMC, src: 0x00038200, des: 0x01000000, size: 0x000a6200
NOTICE:  BL3-1: v1.0(debug):959fdf0
NOTICE:  BL3-1: Built : 15:01:44, Dec 29 2016

　　

Q7的刷机

准备工作

固件: 首先鄙视一下ZNDS这个破网站, 下固件要收钱, 还有刷完要交钱才能用的固件, 百度下满屏都是这个网站的结果.

对于NAND存储的Q7: http://www.hdpfans.com/thread-787070-1-1.html 下载`移动魔百和M201S, 数讯视讯Q7`下20171208开头的文件.

Update 20191218: 上面那个固件, TTL Shell里有很多RTL818X的调试信息输出, 影响命令行操作, 推荐使用这个新的固件 https://www.right.com.cn/forum/thread-1769596-1-1.html

对于eMMC存储的Q7:

eMMC存储的Q7也可以使用NAND的固件, 但是eMMC还可以使用R3300L的固件, https://www.right.com.cn/forum/thread-1761250-1-1.html

安装USB Burning Tool, 安装驱动, 准备双公头USB线

这个和R3300L, N1都是一样的, 网上很多说明不再赘述.

拆卸盒子

有些早期的版本, 在底板上标R字的地方, 底下有贴片微触开关, 这种就不需要拆, 如果里面没焊这个元件, 就必须拆了

Q7的拆卸其实是很容易的, 因为这个盒子的壳很软, 拿裁纸刀刀背往里伸, 轻轻一撬就能开一边, 四周一圈轻松就把底盖取下来.

刷机步骤

1. 盒子拔电, 开关处于关机的状态, 双公头线一头插在靠近TF卡槽的USB口 (另一个口是否能用不知道, 没试过, 我是看别人的说明这么做的).

2. 电脑上打开USB Burning Tool

3. 用一根漆包线(从网线里拆出来那种), 两头露出两三毫米的铜芯, 插在标有UBOOT USB的两个过孔上, 用手稍微斜摁住. 这个目的是让两个过孔短接, 但是注意露出的铜芯不要太长, 不要误接到四周其他的元件上. 如果是第一次刷, 你得把三个螺丝拧下来, 在电路板正面找到这两个孔. 如果熟悉了, 其实不用拆螺丝也可以, 在电路板背面是直接能看到这两个过孔的, 直接在背面短接就可以了.

4. 保持住3的短接状态, 将双公头USB线另一头连上电脑, 此时应该在USB Burning Tool的界面上看到 HUB2-1: Connected Success 之类的提示, 并且盒子的电源灯亮起. 此时板子就已经进入USB调试状态, 可以松开短接了, 把线撤掉.

5. 在USB Burning Tool 里选择img, 保持Erase Flash和Erase Bootloader两个勾选不动, 点击Start, 正常情况进度条就会自动从0%走到100%

6. 点击Stop, 然后关闭USB Burning Tool, 再拔掉USB线, 此时刷机就算完成了.

Q7的mmc初始化报错无法进系统

今天上午在给一个NAND存储的Q7加焊TTL引线后, 发现开机无法进入系统了, TTL输出一直重复着错误输出, 其错误输出是这样的

Hit any key to stop autoboot:  0
card out
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
emmc/sd response timeout, cmd1, status=0x1ff2800
(Re)start USB...
USB0:   USB3.0 XHCI init start
Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
** Bad device usb 1 **
** Bad device usb 2 **
** Bad device usb 3 **
emmc/sd response timeout, cmd8, status=0x100a800
emmc/sd response timeout, cmd55, status=0x100a800
emmc/sd response timeout, cmd1, status=0x100a800
** Bad device mmc 1 **
quene rb busy here
phy read failed at devops->addr: 5c404000
aml_ops_read_page failed: 5c404000 369 1
nand_read_logic_page : read a page ecc failed
do_prio_gc block:369, type:1
quene rb busy here
phy read failed at devops->addr: 5c7fc000
aml_ops_read_page failed: 5c7fc000 369 255
prio_garbage_collect cannot find PHY_MAPPING_PAGE c8ffffff !!
quene rb busy here
phy read failed at devops->addr: 5c400000
aml_ops_read_page failed: 5c400000 369 0
quene rb busy here
phy read failed at devops->addr: 5c404000
aml_ops_read_page failed: 5c404000 369 1
quene rb busy here
phy read failed at devops->addr: 5c408000
aml_ops_read_page failed: 5c408000 369 2

其后一直无限重复这三行输出, 并且无法拍空格进入uboot命令行. 因为启动的检查顺序是sdcard, mmc, usb0 ~ 3, 所以如果插着卡, 依然可以用TF卡启动Armbian系统, 只是无法从自身启动. 而且从Armbian系统中也无法通过fw_printenv查看uboot配置, 报设备不存在, 确实mmc启动失败了当然找不到. 检查线路板没有明显的虚焊脱焊或者焊锡渣, 怀疑是不是没注意接地被静电搞坏了.

晚上抱着试一试的心理短接UBOOT USB孔看看能不能进usb burn模式, 结果还连接上了. 于是加载img线刷试试. TTL输出中看到有关于检测到坏块的日志, 重新擦写后, 线刷成功了.

这个使用NAND的盒子只能刷特定的固件, 每次刷的时候都会重新进行擦写, 并且提示坏块. 在运行EmuELEC和Armbian时, 也无法识别出NAND设备, 无法使用ddbr进行备份和恢复, 在运行高版本Armbian后, 会再次出现内部存储错误而无法从本机启动的情况.

U-Boot 2015.01-gd893f87 (Jul 13 2016 - 19:10:21)

DRAM:  1 GiB
Relocation Offset is: 36ed2000
[MSG]MMC init in usb
aml_priv->desc_buf = 0x0000000033ec2630
aml_priv->desc_buf = 0x0000000033ec47c0
SDIO Port B: 0, SDIO Port C: 1
Enter USB burn
Set Addr 6
Get DT cfg
Get DT cfg
Get DT cfg
set CFG

ID[16]
tplcmd[    echo 12345]
12345
[MSG]ret = 0
[info]success
BULKcmd[    low_power]
[info]success

ID[16]
tplcmd[    download mem dtb normal 149504]
[MSG]Down(mem) part(dtb) sz(0x24800) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 3
[info]success
[MSG]Burn Start...
[MSG]load dt.img to 0x0000000001000000, sz=0x24800
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[disk_initial 1]
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 4 dtbs.
        aml_dt soc: gxl platform: p211 variant: 1g
        dtb 0 soc: gxbb   plat: p201   vari: 1g
        dtb 1 soc: gxbb   plat: p201   vari: 2g
        dtb 2 soc: gxl   plat: p211   vari: 1g
        dtb 3 soc: gxl   plat: p211   vari: 2g
      Find match dtb: 2
start dts,buffer=0000000001000000,dt_addr=0000000001011800
parts: 14
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06: instaboot   0000000020000000 1
07:      boot   0000000002000000 1
08:    system   0000000028000000 1
09:     cache   0000000020000000 2
10:     ghost   0000000020000000 4
11:      info   0000000004000000 4
12:    params   0000000004000000 2
13:      data   ffffffffffffffff 4
emmc/sd response timeout, cmd = 8
emmc/sd response timeout, cmd = 55
emmc/sd response timeout, cmd = 1
EMMC init failed
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=8, system=5.0ns
NAND device id: 2c 64 44 4b a9 0 0 0
detect NAND device: B revision NAND 8GiB MT29F64G08CBABA
XXXXXXX======enter NAND boot======XXXXXX

boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=8, system=5.0ns
NAND device id: 2c 64 44 4b a9 0 0 0
detect NAND device: B revision NAND 8GiB MT29F64G08CBABA
new oob mode
bus_c=6,bus_t=8,sys=4.0ns,T_REA=16,T_RHOH=15
show_phydev_list
0: nfboot
detect new nand here and new_type:50
NAND CKECK:arg nbbt: valid=1, blk=5, page=0
NAND CKECK:arg fbbt: valid=1, blk=6, page=0
outside dtb: 0000000033ec69a0
NAND CKECK:arg ndtb: valid=1, blk=7, page=33
amlnf_detect_dtb_partitions:dtb_erase_blk:7
NAND CKECK:arg nkey: valid=1, blk=10, page=0
start_blk =0,total_blk=4096
nand erasing 0 % --10 % complete
protect nand_bbt info at blk 5
chipenv block skipping!!!!!!!0x5
protect fbbt at blk 6
chipenv block skipping!!!!!!!0x6
protect nand_key info at blk 10
chipenv block skipping!!!!!!!0xa
bad block skipping!!!!0x5a
bad block skipping!!!!0x5b
nand erasing 10 % --20 % complete
nand erasing 20 % --30 % complete
nand erasing 30 % --40 % complete
nand erasing 40 % --50 % complete
nand erasing 50 % --60 % complete
nand erasing 60 % --70 % complete
nand erasing 70 % --80 % complete
nand erasing 80 % --90 % complete
nand erasing 90 % --100 % complete
nandphy_init failed and ret=0xffffffff
nand_init failed ret:1
command:        amlnf  init  1  <- 3

boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=8, system=5.0ns
NAND device id: 2c 64 44 4b a9 0 0 0
detect NAND device: B revision NAND 8GiB MT29F64G08CBABA
new oob mode
bus_c=6,bus_t=8,sys=4.0ns,T_REA=16,T_RHOH=15
show_phydev_list
0: nfboot
detect new nand here and new_type:50
NAND CKECK:arg nbbt: valid=1, blk=5, page=0
NAND CKECK:arg fbbt: valid=1, blk=6, page=0
outside dtb: 0000000033ec69a0
NAND CKECK:arg ndtb: valid=0, blk=0, page=0
found NO arg : ndtb info
amlnf_detect_dtb_partitions:dtb_erase_blk:-1
NAND CKECK:arg ncnf: valid=0, blk=0, page=0
found NO arg : ncnf info
aml_key_init probe.
NAND CKECK:arg nkey: valid=1, blk=10, page=0
nand dtb: probe.
NAND CKECK:arg ndtb: valid=0, blk=0, page=0
found NO arg : ndtb info
boot_device_flag 1
NAND CKECK:arg nenv: valid=0, blk=0, page=0
found NO arg : nenv info
bbt_valid_ops: do nothing!
amlnand_get_dev_configs() 4104
partition-> partiton_num 2
partition-> partiton_num 9
partition-> partiton_num 3
amlnand_save_info_by_name(), 1155
name ncnf, size:3248
amlnand_save_info_by_name, 1221: new blk 4
nfboot    : 0x000000000000-0x000000800000 :partn=0:single_chip single_plane
nfcache   : 0x000006800000-0x000029000000 :partn=2:single_chip multi_plane
nfcode    : 0x00002f800000-0x00005c800000 :partn=9:single_chip multi_plane
nfdata    : 0x00008c000000-0x000174000000 :partn=3:single_chip multi_plane
(nfboot) bad blks 0
(nfcache) bad blks 0
(nfcode) bad blks 0
(nfdata) bad blks 0
amlnf_logic_init() start
(nfcache), size:29000000
nftl version 1.01.001
size_in_blk 164; total_block 163;
nftl start: size 163, free 19
-blks(163), total_blocks(144)
all block full!!
current block: 163
 (nfcode), size:5c800000
nftl version 1.01.001
nftl start: size 370, free 38
-blks(370), total_blocks(332)
all block full!!
current block: 369
 (nfdata), size:174000000
nftl version 1.01.001
nftl start: size 1488, free 139
-blks(1488), total_blocks(1349)
all block full!!
current block: 1487
 amlnf_logic_init() done
dtb erase Okay
[store]To run cmd[amlnf dtb_write 0x0000000001000000 0x40000]
cmd dtb_write:
amlnf_dtb_save: ####
amlnand_save_info_by_name(), 1155
name ndtb, size:262144
amlnand_save_info_by_name, 1221: new blk 7
262144 bytes dtd_write : OK
[MSG]usb producing env_relocate
uboot env amlnf_env_read : ####
uboot env arg_valid = 0 invalid,amlnf_env_read
*** Warning - bad CRC, using default environment

Saving Environment to aml-storage...
uboot env amlnf_env_save : ####
amlnand_save_info_by_name(), 1155
name nenv, size:65536
amlnand_save_info_by_name, 1221: new blk 8
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 4 dtbs.
        aml_dt soc: gxl platform: p211 variant: 1g
        dtb 0 soc: gxbb   plat: p201   vari: 1g
        dtb 1 soc: gxbb   plat: p201   vari: 2g
        dtb 2 soc: gxl   plat: p211   vari: 1g
        dtb 3 soc: gxl   plat: p211   vari: 2g
      Find match dtb: 2
[info]success

ID[16]
tplcmd[download store boot normal 9868780]
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(boot) sz(0x9695ec) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[info]success

Q7的固件分析

Q7的固件包含文件及其说明如下

aml_sdc_burn.ini
aml_sdc_burn.UBOOT
卡刷时的配置文件, 和卡刷时的UBOOT固件, 在卡刷启动时会先加载这个UBOOT, 再进行后面的烧录

boot.PARTITION
这个是烧在内部NAND/eMMC的boot分区上的内容, 也即机器的UBOOT

bootloader.PARTITION
这个是内部的bootloader, 加电后最先启动的程序

DDR.USB
不清楚

image.cfg
此固件的配置信息

logo.PARTITION
开机画面, 中间升级, 升级成功, 升级失败的画面等

manifest.xml
安卓的编译信息

meson1.dtb
硬件信息文件, 需要和bootloader配合使用

platform.conf
不确定, 各分区的地址?

recovery.PARTITION
recovery分区的内容, 从boot启动到update后, 如果未进入usb burn, 也没有找到usb或sdcard上的升级内容, 就会进入recovery, 这是一个独立的小系统

system.PARTITION
安卓最重要的system分区的内容, 包含了命令行工具, 启动动画, 以及其他安卓相关的文件

UBOOT.USB
进入USB Burn模式后, 板子会重启并加载这个UBOOT, 再进行后面的烧录

.存在有一部分Q7的板子, 通过USB Burn模式刷固件会在4%的时候报内部存储初始化错误, 是因为UBOOT.USB无法识别此板子的mmc. 除了这个文件以外, bootloader.PARTITION和meson1.dtb也是和Q7关系很大的文件.

Q7启动后的存储挂载

mount, 是从/dev/block/ 下面的设备挂载出来的

adb shell mount
rootfs / rootfs ro,seclabel 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,seclabel,relatime 0 0
configfs /sys/kernel/config configfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
tmpfs /tmp tmpfs rw,seclabel,relatime 0 0
tmpfs /tmp/playInfoLog tmpfs rw,seclabel,relatime 0 0
tmpfs /tmp/capture tmpfs rw,seclabel,relatime 0 0
tmpfs /storage/external_storage tmpfs rw,seclabel,relatime,mode=775,uid=1000,gid=1023 0 0
/dev/block/system /system ext4 ro,seclabel,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,errors=remount-ro 0 0
/dev/block/data /data ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,discard,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/params /params ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/ghost /ghost ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/info /info ext4 rw,seclabel,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0

df

adb shell df
Filesystem               Size     Used     Free   Blksize
/dev                   389.4M   128.0K   389.3M   4096
/sys/fs/cgroup         389.4M    12.0K   389.4M   4096
/mnt/asec              389.4M     0.0K   389.4M   4096
/mnt/obb               389.4M     0.0K   389.4M   4096
/tmp                   389.4M     0.0K   389.4M   4096
/tmp/playInfoLog       389.4M     0.0K   389.4M   4096
/tmp/capture           389.4M   240.0K   389.2M   4096
/storage/external_storage   389.4M     0.0K   389.4M   4096
/system                506.9M   387.7M   119.2M   1024
/data                    4.6G   108.7M     4.5G   4096
/cache                 495.9M   388.0K   495.6M   4096
/params                 59.0M    40.0K    58.9M   4096
/ghost                 495.9M   388.0K   495.6M   4096
/info                   59.0M    44.0K    58.9M   4096
/mnt/shell/emulated      4.5G   108.7M     4.4G   4096