01-09-2016, 12:10 PM
I've had some luck with the LeapTV so far, having attached a serial console to the 4-pin header inside the device. This gives me access to the system before telnet comes up but unfortunately u-boot seems to be ignoring any attempt to stop or pause boot.
I also did a look at the strings in the NOR flash to determine if u-boot does anything beyond scanning the internal emmc. As it turns out, it does. :-D
I did however use an inexpensive game cart as a holder for an 8G microSD. After doing a similar partition layout to the internal EMMC and copying the partitions over netcat to the SD on my pc, I noticed while attempting to boot the card that the firmware was looking for a file named 'factory-cart' during startup, so I created a simple file with that name. Here's the result: It's not perfect since the factory cart is expected to have the NOR files present, but I'm happy it didn't undo my changes to the internal root FS. ;-)
The surgeon software cowardly refuses to continue since it can't find the NORBoot files. There's a shell hidden there as usual, overwritten by the debug output from the factory-restore script.
Note also that the system does start up from COLD boot instead of powering down and waiting for the power button to be pressed.
For everyone's reference I noticed that the LeapTV appears unable to write to the cartrdige's SD card while booted from the internal EMMC due to DMA timeouts, but has no trouble doing so while booted from the surgeon's initrd.
Elinux.org has some good info on the surgeon boot as well as the .cbf file format from the older systems. I'll work later on seeing if I can get a more useful system put on the cartridge by building a custom surgeon CBF, possibly allowing an entire custom system to be run without disturbing the internal EMMC.
-David
I also did a look at the strings in the NOR flash to determine if u-boot does anything beyond scanning the internal emmc. As it turns out, it does. :-D
I did however use an inexpensive game cart as a holder for an 8G microSD. After doing a similar partition layout to the internal EMMC and copying the partitions over netcat to the SD on my pc, I noticed while attempting to boot the card that the firmware was looking for a file named 'factory-cart' during startup, so I created a simple file with that name. Here's the result: It's not perfect since the factory cart is expected to have the NOR files present, but I'm happy it didn't undo my changes to the internal root FS. ;-)
Code:
DDR 666, 1% spread
Second Boot by Nexell Co. : Built on Oct 7 2014 16:22:17
PLL0: 984000000 PLL1: 655500000 PLL2: 800000000 PLL3: 666000000
Divider0 PLL: 0 CPU:984000000 CPU BUS:246000000
Divider1 PLL: 2 BCLK:400000000 PCLK:200000000
Divider2 PLL: 3 MDCLK:666000000 MCLK:666000000
MBCLK:333000000 MPCLK:166500000
Divider3 PLL: 2 G3D BCLK:400000000
Divider4 PLL: 1 MPEG BCLK:327750000 MPEG PCLK:163875000
DDR3 POR Init Start
## pNxDrex_reg->DIRECTCMD[MR2] : 0x00020220
## pNxDrex_reg->DIRECTCMD[MR3] : 0x00030000
## pNxDrex_reg->DIRECTCMD[MR1] : 0x00010006
## pNxDrex_reg->DIRECTCMD[MR0] : 0x00001D1C
## READ/GATE Level ##
Searching write delay value......
lane average positive min:45 negative min:13 margin: 32 adj: 16
lane average positive min:42 negative min:15 margin: 27 adj: 13
lane average positive min:43 negative min:16 margin: 27 adj: 13
lane average positive min:41 negative min:17 margin: 24 adj: 12
read delay value is 0x12121212
write delay value is 0x0C0D0D10
## AXI BUS ##
## PNxDDRphy_reg->PHY_CON[4] : 0x12121212
## PNxDDRphy_reg->PHY_CON[6] : 0x0C0D0D10
## PNxDDRphy_reg->PHY_CON[13] : 0x00009207
## PNxDDRphy_reg->PHY_CON[16] : 0x0E400304
DDR3 Init Done!
Board_ID : 0x00000448
SPI Load Address: 0x40C00000
SPI Load Size : 0x0007A000
DDR3 SelfRefresh exit Done!
WakeUpStatus reg: 0x00000001
Suspend Signature is different
Read Signature :0x00000010
Restoring ALIVESCRATCH: 0x00000010
It's COLD BOOT
FCS Verify Succeeded
Image Loading Done!
Launch to 0x40C00000
U-Boot 2013.01.01 (Oct 07 2014 - 16:25:34)7.0.1.2634
PLL : [0] = 984000000, [1] = 655500000, [2] = 800000000, [3] = 666000000
PLLSETREG[0] : 0x1019ec01 ( SS_EN = 0 P = 6 M = 492 S = 1 )
PLLSETREG[1] : 0x1011b502 ( SS_EN = 0 P = 4 M = 437 S = 2 )
PLLSETREG[2] : 0x100cc801 ( SS_EN = 0 P = 3 M = 200 S = 1 )
PLLSETREG[3] : 0x5010de01 ( SS_EN = 1 P = 4 M = 222 S = 1 )
PLLSETREG_SSCG[2] : 0x00000000 ( K = 0 MFR = 0 MRR = 0 SEL_PF = 0 )
PLLSETREG_SSCG[3] : 0x0000055c ( K = 0 MFR = 5 MRR = 23 SEL_PF = 0 )
PLL0: CPU FCLK = 984000000, HCLK = 246000000
PLL2: BUS BCLK = 400000000, PCLK = 200000000
PLL3: MEM MCLK = 666000000, DCLK = 666000000, BCLK = 333000000, PCLK = 166500000
PLL2: G3D BCLK = 400000000
PLL1: MPG BCLK = 327750000, PCLK = 163875000
nxp_soc_rsc_reset: id=20
nx-i2c.0: 260416 Hz [pclk=200000000, src=256, scale=3]
nxp_soc_rsc_reset: id=21
nx-i2c.1: 260416 Hz [pclk=200000000, src=256, scale=3]
I2C: ready
DRAM: 256 MiB
Heap = 0x43fff000~0x45000000
Code = 0x40c00000~0x40c89b2c
GLD = 0x40bfff80
GLBD = 0x40bfff60
SP = 0x40bfff60,0x40bfff48(CURR)
PC = 0x40c0ba28
TAGS = 0x40000100
MACH = [4330]
MMC: NXP DWMMC: 0, NXP DWMMC: 1, NXP DWMMC: 2
*** Warning - bad CRC, using default environment
drv_lcd_init: power = 0x00000001
drv_lcd_init: skipping HDMI init -- "COLD boot"
In: serial
Out: serial
Err: serial
is_sd_boot()
cartridge_is_present(): yes
reading factory_cart
3350312 bytes read in 290 ms (11 MiB/s)
** FACTORY CARTRIDGE FOUND **
reading surgeon-kernel.cbf
12021248 bytes read in 8 ms (1.4 GiB/s)
cbf_init ram_base=40000000
INHEADER cbf_common: buf=42000000 len=00b76e00 need=00000018 where=40c575e8 Memcpy=00000018 suggest=40c57600
INDATA cbf_common: buf=42000018 len=00b76de8 need=00b76d64 where=40008000 Memcpy=00b76d64 suggest=40b7ed64
INTAIL cbf_common: buf=42b76d7c len=00000084 need=00000004 where=40c57600 Memcpy=00000004 suggest=40c57604
DONE boot_surgeon_kernel_cbf: cbf_process_chunk returned successfully!
Starting kernel ...
Booting Linux on physical CPU 0
Linux version 3.4.24 (glasgow2@emdlfwbuild03) (gcc version 4.5.4 20120305 (prerelease) (GCC) ) #1
(removed normal kernel startup messages)
init started: BusyBox v1.19.4 (2014-10-04 01:08:08 PDT)
starting pid 703, tty '': '/etc/init.d/rcS'
mount: mounting none on /dev/pts failed: No such file or directory
mknod: /dev/i2c-0: File exists
mmc1: new high speed SDHC card at address 1234
mmcblk1: mmc1:1234 SA08G 7.28 GiB
mmcblk1: p1 p2 p3
mmc2: card claims to support voltages below the defined range. These will be ignored.
eth%d: status ep1in, 8 bytes period 11
mmc2: queuing unknown CIS tuple 0x91 (3 bytes)
mmc2: new high speed SDIO card at address 0001
eth0: register 'asix' at usb-nxp4330-ehci-1, ASIX AX88772C USB 2.0 Ethernet, 00:0e:c6:87:72:01
/bin/sh: /etc/mdev/usb.sh: not found
/bin/sh: /etc/mdev/usb.sh: not found
/bin/sh: /etc/mdev/usb.sh: not found
tar: Removing leading `/' from member names
cat: can't open '/sys/devices/platform/lfp100-chip/pmic_revision': No such file or directory
cat: can't open '/sys/devices/platform/lf1000-gpio/boot_image': No such file or directory
boot_image= cat: can't open '/sys/devices/platform/lf1000-gpio/boot_source': No such file or directory
boot_source= cat: can't open '/sys/devices/platform/lf1000-gpio/panic': No such file or directory
panic= cat: can't open '/sys/devices/platform/lf1000-gpio/power': No such file or directory
power= cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
request= cat: can't open '/sys/devices/platform/lf1000-gpio/shutdown': No such file or directory
shutdown= cat: can't open '/sys/devices/platform/lf1000-alvgpio/scratchpad': No such file or directory
raw=
REQUEST=cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
: Unknown
g_mass_storage gadget: controller 'dwc_otg_pcd' not recognized
g_mass_storage gadget: Mass Storage Function, version: 2009/09/11
g_mass_storage gadget: Number of LUNs=1
lun0: LUN: file: /LF/fuse/dftp
g_mass_storage gadget: Mass Storage Gadget, version: 2009/09/11
g_mass_storage gadget: g_mass_storage ready
Resume from soft disconnect
Using Buffer DMA mode
Periodic Transfer Interrupt Enhancement - disabled
Multiprocessor Interrupt Enhancement - disabled
OTG VER PARAM: 0, OTG VER FLAG: 0
Loaded g_mass_storage driver
FACTORY recovery mode
starting pid 773, tty '/dev/ttyS0': '-/bin/sh'
~ # eth0: rxqlen 0 --> 5
eth0: ax88772c - Link status is: 0
Mounted Factory Cartridge successfully
Starting to flash FW...
nor_write_addr_threshold set to 0x0
While trying to open NORBoot/u-boot.bin: No such file or directory
NORBoot flashing error
RECOVERY-FACTORY failed!
Waiting for power button to poweroff...
eth0: ax88772c - Link status is: 1The surgeon software cowardly refuses to continue since it can't find the NORBoot files. There's a shell hidden there as usual, overwritten by the debug output from the factory-restore script.
Note also that the system does start up from COLD boot instead of powering down and waiting for the power button to be pressed.
For everyone's reference I noticed that the LeapTV appears unable to write to the cartrdige's SD card while booted from the internal EMMC due to DMA timeouts, but has no trouble doing so while booted from the surgeon's initrd.
Elinux.org has some good info on the surgeon boot as well as the .cbf file format from the older systems. I'll work later on seeing if I can get a more useful system put on the cartridge by building a custom surgeon CBF, possibly allowing an entire custom system to be run without disturbing the internal EMMC.
-David