BeeLink Mini M8 SII

Links

http://www.linux-meson.com/

amlogic buildroot:
http://openlinux.amlogic.com:8000/download/ARM/filesystem/arm-buildroot-2016-08-18-5aaca1b35f.tar.gz
http://openlinux.amlogic.com:8000/download/doc/linux-3.14-buildroot-pkg-201609-release-v1.4.pdf

links(ulrich):
http://www.cnx-software.com/2015/11/19/amlogic-s905-source-code-published-linux-u-boot-mali-450-gpu-and-other-drivers/
http://www.cnx-software.com/2015/12/06/how-to-run-headless-linux-on-amlogic-s905-devices-such-as-mini-mx-or-k1-plus/
https://makerfeed.net/article/amlogic-s905-source-code-published-linux-u-boot-mali-450-gpu-and-other-drivers

Console access

Open the box, connect serial console
http://redmine.digitalstrom.org/projects/testing/wiki/DSS-IP_Flashing

Flashing the device

http://redmine.digitalstrom.org/projects/testing/wiki/DSS-IP_Flashing#Re-flashing-the-Mini-M8S-II-box-with-a-dssimg-file

Latest instructions available from
https://drive.google.com/open?id=0B7-ETNoWPqihdWpZcXFpNmJqS2M

Flashing full-image including USB:
https://drive.google.com/open?id=0B7-ETNoWPqihcjlCRXRPRFJvLUk

U-Boot

- special kernel + dtb + cmdline images, all checksummed
- redundant environment is explicitly disabled in u-boot
- special partition table, (!= msdos partition), hence standard fs load/fatload does not work from internal emmc (usb stick works though)

Boot Sequence

- usb
- rescue system (u-boot will compute complete sha1sum)
- system(dss-boot-direct)

U-Boot flat device tree

There is hidden flat device tree on dedicated partition, that is used by U-boot to read the splash screen, evtl also partition information...

The configuration file used to generate the fw image, references Image.gz-gxl_p212_2g.dtb explicitly:

https://git.digitalstrom.org/dss-oe/dss-oe/blob/master/yocto/dS/meta-digitalstrom-devel/recipes-core/images/digitalstrom-image/dssip/aml_upgrade_package.conf

gxl_p212_v1#store dtb iread 0xC000000                                           
[store]To run cmd[emmc dtb_read 0xC000000 0x40000]                              
read emmc dtb                                                                   
      Amlogic multi-dtb tool                                                    
      Single dtb detected
gxl_p212_v1#fdt addr 0xC000000
gxl_p212_v1#fdt print

# probably used as the partition table:
gxl_p212_v1#fdt list /partitions

Kernel

http://openlinux.amlogic.com:8000/download/ARM/kernel

digitalSTROM changes on top of code drop:
https://git.digitalstrom.org/bsp/linux/tree/dssip_3.14.29

http://releases.linaro.org/components/toolchain/binaries/

http://releases.linaro.org/14.09/components/toolchain/binaries/gcc-linaro-aarch64-linux-gnu-4.9-2014.09_linux.tar.xz (broken link but used this toolchain)
http://releases.linaro.org/components/toolchain/binaries/4.9-2016.02/aarch64-linux-gnu/gcc-linaro-4.9-2016.02-x86_64_aarch64-linux-gnu.tar.xz
http://releases.linaro.org/components/toolchain/binaries/4.9-2017.01/aarch64-linux-gnu/gcc-linaro-4.9.4-2017.01-i686_aarch64-linux-gnu.tar.xz (4.9 toolchain untested)
http://releases.linaro.org/components/toolchain/binaries/6.3-2017.02/aarch64-linux-gnu/gcc-linaro-6.3.1-2017.02-x86_64_aarch64-linux-gnu.tar.xz (6.3 toolchain untested)

make meson64_defconfig
make gxl_p212_2g.dtb
make -j8 Image.gz

# creating uImage (with CRC) (will probably take the dtb from the fw image, see aml_upgrade_package.conf)
ZRELADDR="0x01080000" 
mkimage -A arm64 -O linux -C gzip -T kernel -a $ZRELADDR -e $ZRELADDR -n dssip-custom -d arch/arm64/boot/Image.gz uImage

# creating FIT image (zImage + dtb) (BROKEN: evtl. needs to fix the LOAD/TARGET address)
# mkimage -f auto -A arm64 -O linux -C gzip -T kernel -a $ZRELADDR -e $ZRELADDR -n dssip-custom -d arch/arm64/boot/Image.gz -b arch/arm64/boot/dts/amlogic/gxl_p212_2g.dtb uImage.fit

Rescue-system

Available since commit https://git.digitalstrom.org/bsp/rescue-system/merge_requests/71
But currently not shipped on all feeds

manual install:

# wget https://git.digitalstrom.org/dss-oe/rescue-images/raw/master/dssip/rescue-devel-image-dssip.android.img
# dd if=rescue-devel-image-dssip.android.img of=/dev/system

Mind the image does not always represent the latest rescue-system changes due to http://redmine.digitalstrom.org/issues/16332

manual removal:

u-boot calculates sha1sum over the whole android image, hence toggle one byte and u-boot will skip it and boot the default kernel.
The image format also contains additional kernel argument (-> show up in /proc/cmdline), those are appended before testing the checksum
hence when de-installing, do not remote only one byte. Ensure those kernel arguments are removed as well be erasing the whole image header, otherwise your /proc/cmdline still shows rescue-system=xxx although you erased it:

# dd if=/dev/zero of=/dev/system seek=0 bs=512 count=2048

USB Rescue Stick

fetch latest kernel/initramfs/dtb from here:
https://git.digitalstrom.org/dss-oe/rescue-images/tree/master/dssip/rescue-initramfs

$ cd /media/STICK
$ wget https://git.digitalstrom.org/dss-oe/rescue-images/raw/master/dssip/rescue-initramfs/rescue-devel-initramfs-dssip.cpio.gz.u-boot
$ mv rescue-devel-initramfs-dssip.cpio.gz.u-boot initramfs
$ wget https://git.digitalstrom.org/dss-oe/rescue-images/raw/master/dssip/rescue-initramfs/Image.gz-gxl_p212_2g.dtb
$ mv Image.gz-gxl_p212_2g.dtb gxl_p212_2g.dtb
$ wget https://git.digitalstrom.org/dss-oe/rescue-images/raw/master/dssip/rescue-initramfs/Image.gz-dssip.bin
$ mkimage -A arm64 -O linux -T kernel -C gzip -a "0x1080000" -e "0x1080000" -n "USB recovery" -d Image.gz-dssip.bin uImage

addon:
Either you figure out how to load Image.gz from u-boot, or you need to convert it to an uImage with above mkimage
if your mkimage does not support the -d option yet, run the command from bitbake busybox -c devshell, and change manually into the deploy folder

Creating a boot.scr from ascii file below, see also general description:
http://redmine.digitalstrom.org/projects/dss/wiki/Imx_common#U-Boot-scripts

$ cat boot-script.txt
# mkimage -T script -C none -n 'Autorun Script' -d rescue-boot.txt boot.scr
# fetch kernel/initramfs from here: https://git.digitalstrom.org/dss-oe/rescue-images/tree/master/dssip
#
# usb start
# fatload usb 0 0xCF00000 boot.scr
# autoscr 0xCF00000

setenv bootargs root=/dev/data rootfstype=ext4 init=/sbin/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 maxcpus=4 jtag=apee 

setenv fdt_addr 0xC000000
setenv rd_addr 0xC100000
setenv loadaddr 0xE000000

fatload usb 0 ${loadaddr} uImage
fatload usb 0 ${rd_addr} initramfs
fatload usb 0 ${fdt_addr} gxl_p212_2g.dtb

bootm ${loadaddr} ${rd_addr} ${fdt_addr}

Place the create boot.scr onto the usb stick, then reboot.

$ wget https://git.digitalstrom.org/bsp/dss11e-u-boot/raw/dss_2016.01/tools/pack_bootscr.sh
$ sh pack_bootscr.sh boot-script.txt

The boot loader probes the USB stick first for boot.scr. In the rare case that your boot-loader is ancient you need to interrupt the u-boot startup, and load the boot.scr manually.

snapshot can be found here:
http://developer.digitalstrom.org/download/usb-rescue/

HW

Recovery

  • shortcut pins according the picture below, before applying power
  • insert the USB cable, the device should show up in the "Amlogic USB flashing tool"

WiFi/BT

There is a AP6212 mounted on the backside of the device:
http://wiki.friendlyarm.com/wiki/images/5/57/AP6212_V1.1_09022014.pdf

power must be enabled explicitly:(see attached wifi_power.tar.gz)

# /var/run/media/usb/wifi_power                                                        
open: Success                                                                   
[ 2755.757673@2] aml_wifi wifi.32: [extern_wifi_set_enable] WIFI  Disable! 240  
[ 2755.962114@2] aml_wifi wifi.32: [extern_wifi_set_enable] WIFI  Enable! 240   
[ 2756.163347@2] sdio_reset_comm():                                             
[ 2756.182459@3] sdio: queuing unknown CIS tuple 0x80 (2 bytes)                 
[ 2756.185082@3] sdio: queuing unknown CIS tuple 0x80 (3 bytes)                 
[ 2756.190649@3] sdio: queuing unknown CIS tuple 0x80 (3 bytes)                 
[ 2756.198337@3] sdio: queuing unknown CIS tuple 0x80 (7 bytes)                 
[ 2756.345711@3] [sdio_reinit] finish                                           
[ 2756.345729@3] aml_wifi wifi.32: [wifi_power_ioctl] Set sdio wifi power up!

this will then create the create /sys/devices/d0070000.sdio/mmc_host/sdio/sdio:0001/sdio:0001:2

vendor:0x02d0 (broadcom)
device:0xa9a6

custom driver on the android rootfs

# insmod /mnt/lib/dhd.ko                                            
[ 2870.483164@2] dhd_module_init: in                                            
[ 2870.483190@2] ======== bcm_wlan_set_plat_data ========                       
[ 2870.485945@2] host_oob_irq: 100                                              
[ 2870.489049@2] host_oob_irq_flags=0x414                                       
[ 2870.492774@2] dhd_wifi_platform_load: Enter                                  
[ 2870.496918@2] Power-up adapter 'DHD generic adapter'                         
[ 2870.501815@2] wifi_platform_set_power = 1                                    
[ 2870.505788@2] ======== PULL WL_REG_ON HIGH! ========                         
[ 2870.510713@2] aml_wifi wifi.32: [extern_wifi_set_enable] WIFI  Disable! 240  
[ 2870.717631@2] aml_wifi wifi.32: [extern_wifi_set_enable] WIFI  Enable! 240   
[ 2871.222488@2] wifi_platform_bus_enumerate device present 1                   
[ 2871.222507@2] ======== Card detection to detect SDIO card! ========          
[ 2871.228540@2] sdio_reset_comm():                                             
[ 2871.250819@3] sdio: queuing unknown CIS tuple 0x80 (2 bytes)                 
[ 2871.253414@3] sdio: queuing unknown CIS tuple 0x80 (3 bytes)                 
[ 2871.259009@3] sdio: queuing unknown CIS tuple 0x80 (3 bytes)                 
[ 2871.266679@3] sdio: queuing unknown CIS tuple 0x80 (7 bytes)                 
[ 2871.414229@3] [sdio_reinit] finish                                           
[ 2871.430887@3] bcmsdh_register: register client driver                        
[ 2871.431009@3] bcmsdh_sdmmc: bcmsdh_sdmmc_probe Enter                         
[ 2871.435378@3] bcmsdh_sdmmc: bcmsdh_sdmmc_probe Enter                         
[ 2871.440129@3] bus num (host idx)=0, slot num (rca)=1                         
[ 2871.445077@3] found adapter info 'DHD generic adapter'                       
[ 2871.450176@3] sdioh_attach: set sd_f2_blocksize 128                          
[ 2871.455236@3] dhdsdio_probe : no mutex held. set lock                        
[ 2871.460054@3] F1 signature read @0x18000000=0x1530a9a6                       
[ 2871.467205@3] F1 signature OK, socitype:0x1 chip:0xa9a6 rev:0x0 pkg:0x3      
[ 2871.472408@3] DHD: dongle ram size is set to 524288(orig 524288) at 0x0      
[ 2871.478310@3] dhd_conf_set_chiprev: chip=0xa9a6, chiprev=0                   
[ 2871.483627@3] firmware path not found                                        
[ 2871.487221@3] dhd_conf_read_config: config path                              
[ 2871.492606@3] wl_create_event_handler(): thread:wl_event_handler:bdd started 
[ 2871.498941@3] tsk Enter, tsk = 0xffffff80013ed860                            
[ 2871.503605@0] dhd_attach(): thread:dhd_watchdog_thread:bdf started           
[ 2871.509594@0] dhd_attach(): thread:dhd_dpc:be0 started                       
[ 2871.509620@1] dhd_dpc_thread: set dpc_cpucore 0 from config.txt              
[ 2871.520579@0] dhd_attach(): thread:dhd_rxf:be1 started                       
[ 2871.525628@0] dhd_deferred_work_init: work queue initialized                 
[ 2871.540486@3] Dongle Host Driver, version 1.201.59.6 (r506368)               
[ 2871.540486@3] Compiled in drivers/net/wireless/bcmdhd                        
[ 2871.546720@0] Register interface [wlan0]  MAC: 44:2c:05:6c:4b:8a             
[ 2871.546720@0]                                                                
[ 2871.553289@0] dhd_prot_ioctl : bus is down. we have nothing to do            
[ 2871.559369@3] bcmsdh_oob_intr_unregister: Enter                              
[ 2871.563846@3] bcmsdh_oob_intr_unregister: irq is not registered              
[ 2871.569657@3] dhd_txglom_enable: enable 0                                    
[ 2871.573646@3] dhd_conf_set_txglom_params: swtxglom=0, txglom_ext=0           
[ 2871.579741@3] dhd_conf_set_txglom_params: txglom_bucket_size=0               
[ 2871.585541@3] dhd_conf_set_txglom_params: txglomsize=0, deferred_tx_len=0, b0
[ 2871.593522@3] dhd_conf_set_txglom_params: tx_in_rx=1, tx_max_offset=0        
[ 2871.599838@3] dhd_bus_devreset:  WLAN OFF DONE                               
[ 2871.604320@3] wifi_platform_set_power = 0                                    
[ 2871.608203@3] ======== PULL WL_REG_ON LOW! ========                          
[ 2871.613064@3] dhdsdio_probe : the lock is released.                          
[ 2871.618133@3] dhd_module_init: Exit err=0 

# ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 44:2C:05:6C:4B:8A                         
          BROADCAST MULTICAST  MTU:1500  Metric:1                               
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0                    
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0                  
          collisions:0 txqueuelen:1000                                          
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)                                

# modinfo  /mnt/lib/dhd.ko                                          
filename:       /mnt/lib/dhd.ko                                                 
license:        GPL v2                                                          
alias:          sdio:c00v*d*                                                    
alias:          sdio:c*v02D0dA8E7*                                              
alias:          sdio:c*v02D0d4324*                                              
alias:          sdio:c*v02D0d4334*                                              
alias:          sdio:c*v02D0d4330*                                              
alias:          sdio:c*v02D0d4319*                                              
alias:          sdio:c*v02D0d4329*                                              
alias:          sdio:c*v02D0d0493*                                              
alias:          sdio:c*v02D0d0492*                                              
alias:          sdio:c*v02D0d0000*                                              
depends:                                                                        
vermagic:       3.14.29 SMP preempt mod_unload aarch64                          
parm:           dhd_oob_gpio_num:DHD oob gpio number                            
parm:           clockoverride:SDIO card clock override  

searching dhd in
http://openlinux.amlogic.com:8000/download/ARM/wifi/
http://openlinux.amlogic.com:8000/download/ARM/wifi/brcmap6xxx-2016-08-18-88f3d466c6.tar.gz

searching for "dhd_oob_gpio_num"
https://github.com/arco/linux-amlogic/commit/dcdd7220c42b27092e774cd0021f3a69997ddd34
https://android.googlesource.com/kernel/omap/+/03400d7a0a7f8b43cd9815c95cfb1813d09830ed/drivers/net/wireless/bcmdhd

Image format

Unpack image

cp <dssip-workdir>/build/sysroots/x86_64-linux/usr/bin/aml_image_v2_packer_new .
./aml_image_v2_packer_new -d update_MINIM8SII_rv104.img unpacked/

extract dtb

dd if=unpacked/meson1.dtb skip=1 bs=2048 > meson1.dtb
dtc -I dtb meson1.dtb  > meson1.dts
system (rootfs), not an android image, ext4 but probably with some offest
  • booted from rescue-usb stick, then created tarball from /dev/system

kernel:
http://www.cnx-software.com/2014/05/12/how-to-extract-a-device-tree-file-from-android-firmware-files/
also attached [split_bootimg.pl]

./split_bootimg.pl unpacked/boot.PARTITION

Partitions

The device is ~8GB. The largest partition, /dev/data, is about half of that. /dev/system is 1GB. And there is a couple of smaller ones. This is from the kernel log (Similar information also appears in the u-boot log):

[    4.481582@1] [mmc_read_partition_tbl] mmc read partition OK!
[    4.486467@1] add_emmc_partition
[    4.489913@0] [mmcblk1p01]           bootloader  offset 0x000000000000, size 0x000000400000  (4MB)
[    4.498287@0] [mmcblk1p02]             reserved  offset 0x000002400000, size 0x000004000000  (64MB)
[    4.524871@0] [mmcblk1p03]                cache  offset 0x000006c00000, size 0x000020000000  (512MB)
[    4.533143@0] [mmcblk1p04]                  env  offset 0x000027400000, size 0x000000800000  (8MB)
[    4.563048@0] [mmcblk1p05]                 logo  offset 0x000028400000, size 0x000002000000  (32MB)
[    4.580151@0] [mmcblk1p06]             recovery  offset 0x00002ac00000, size 0x000002000000  (32MB)
[    4.596143@0] [mmcblk1p07]                  rsv  offset 0x00002d400000, size 0x000000800000  (8MB)
[    4.613520@0] [mmcblk1p08]                  tee  offset 0x00002e400000, size 0x000000800000  (8MB)
[    4.621884@0] [mmcblk1p09]                crypt  offset 0x00002f400000, size 0x000002000000  (32MB)
[    4.631066@0] [mmcblk1p10]                 misc  offset 0x000031c00000, size 0x000002000000  (32MB)
[    4.639085@0] [mmcblk1p11]            instaboot  offset 0x000034400000, size 0x000020000000  (512MB)
[    4.646992@0] [mmcblk1p12]                 boot  offset 0x000054c00000, size 0x000002000000  (32MB)
[    4.655338@0] [mmcblk1p13]               system  offset 0x000057400000, size 0x000040000000  (1GB)
[    4.664038@0] [mmcblk1p14]                 data  offset 0x000097c00000, size 0x000136500000  (4.8GB/4965MB)

The partiton is named /dev/system, not /dev/mmcblk1p13

48-bit address space and java script

https://fedoraproject.org/wiki/Changes/aarch64-48bitVA

dssip_reflashing_instructions.txt Magnifier - full usb-flashing (2016-09-20) (3.59 KB) Andreas Fenkart, 09/20/2016 02:36 PM

mimin8sii_emmc.png (1.09 MB) Andreas Fenkart, 03/03/2017 08:40 AM

split_bootimg.pl Magnifier (5.98 KB) Andreas Fenkart, 04/12/2017 09:47 AM

wifi_power.tar.gz (6.51 KB) Andreas Fenkart, 04/12/2017 02:08 PM