Videostrong KII Pro (videostrong-kii-pro)/U-Boot as primary bootloader

This page documents possible ways to get mainline U-Boot to run as the primary bootloader and thus
upgrade from U-Boot 2015.01.
Feature 	Status 	Notes
Running U-Boot as the primary bootloader 	Works 	Uses the WeTek Play 2 FIP sources.
Running mainline U-Boot or a fork close to it	Works 	Upstream supports this board. See: https://lore.kernel.org/u-boot/20230507124109.31778-1-vitali64pmemail@protonmail.com/
Boot from the internal storage 	Untested	Will likely work.
Boot from an SD card 	Works 	-
USB 	Partial 	Hot-plug doesn't seem to work.
Keyboard (connected via USB) 	Works 	See above
== Prerequisites ==
* A way to recover
== FIPs ==
It uses 4 Nanya NT5CB256M16DP-EK RAM chips.
=== Boards using the same SoC with known FIPs ===
* WeTek Play 2 (uses the same RAM chips)
* WeTek Hub (?)
* Amlogic P200 (?)
* Amlogic P201 (?)
== How to build ==
* Create a work directory
$ mkdir u-boot-kii-pro
$ cd u-boot-kii-pro
* Build U-Boot
$ git clone https://git.denx.de/u-boot u-boot
$ cd u-boot
$ make videostrong-kii-pro_defconfig
$ make # CROSS_COMPILE=...
$ cd ..
==== Building and bundling the FIP ====
* Get the binaries required to build the FIP (BL2, BL31, ...) and meson-tools, and install ARM Trusted Firmware utilities
$ git clone https://github.com/LibreELEC/amlogic-boot-fip.git fip
$ git clone https://github.com/afaerber/meson-tools.git
# apk add arm-trusted-firmware-tools # if using an Alpine-based system
* Build amlbootsig from meson-tools
$ cd meson-tools
$ make amlbootsig
$ cd ..
* Build TF-A's BL31 port (if you want a libre BL31 implementation (as seen in the example UART log below), optional)
$ git clone https://github.com/ARM-software/arm-trusted-firmware.git atf
$ cd atf
$ make PLAT=gxbb DEBUG=1 bl31 # CROSS_COMPILE=...
$ dd if=../fip/wetek-play2/bl31.img of=bl31.img bs=512 count=1 # take the header from the proprietary BL31
$ cat build/gxbb/debug/bl31.bin >> bl31.img
$ cp bl31.img ../fip/wetek-play2/bl31.img
* Build the FIP
$ cd fip/wetek-play2 # we use the WeTek Play2 binaries for building the FIP
$ cp ../../u-boot/u-boot.bin ./bl33.bin
$ ./blx_fix.sh \
 ./bl30.bin \
 ./zero_tmp \
 ./bl30_zero.bin \
 ./bl301.bin \
 ./bl301_zero.bin \
 ./bl30_new.bin \
 bl30
$ dd if=bl31.img of=bl31_noheader.bin bs=1 skip=496 count=16
$ dd if=bl31.img of=bl31_noheader.bin skip=1
$ fiptool create \
 --align 0x4000 \
 --scp-fw ./bl30_new.bin \
 --soc-fw ./bl31_noheader.bin \
 --nt-fw ./bl33.bin \
 ./fip.bin
$ sed -i 's/\x73\x02\x08\x91/\x1F\x20\x03\xD5/' ./bl2.bin
$ python3 ./acs_tool.py ./bl2.bin ./bl2_acs.bin ./acs.bin 0
$ ./blx_fix.sh \
 ./bl2_acs.bin \
 ./zero_tmp \
 ./bl2_zero.bin \
 ./bl21.bin \
 ./bl21_zero.bin \
 ./bl2_new.bin \
 bl2
$ cat ./bl2_new.bin ./fip.bin > ./boot_new.bin
$ ../../meson-tools/amlbootsig \
 --input ./boot_new.bin
 --output ./u-boot.bin
$ dd if=./u-boot.bin of=./u-boot.bin.gxbb bs=512 conv=fsync
$ dd if=./u-boot.bin of=./u-boot.bin.gxbb bs=512 seek=9 skip=8 count=87 conv=fsync,notrunc
$ dd if=/dev/zero of=./u-boot.bin.gxbb bs=512 seek=8 count=1 conv=fsync,notrunc
$ dd if=bl1.bin.hardkernel of=./u-boot.bin.gxbb bs=512 seek=2 skip=2 count=1 conv=fsync,notrunc
$ ./aml_chksum u-boot.bin.gxbb
=== How to boot ===
* Write to an SD card
# DEV=mmcblk0 # replace with your SD card device
# dd if=u-boot.bin.gxbb of=/dev/$DEV conv=fsync,notrunc bs=512 skip=1 seek=1
# dd if=u-boot.bin.gxbb of=/dev/$DEV conv=fsync,notrunc bs=1 count=444
* On the set-top box, boot postmarketOS and erase the eMMC THIS WILL WIPE EVERYTHING. BE SURE THAT YOU HAVE A BACKUP
# DEV=mmcblk1 # replace mmcblk1 with your eMMC device
# dd if=/dev/zero of=/dev/${DEV}
# dd if=/dev/zero of=/dev/${DEV}boot0
# dd if=/dev/zero of=/dev/${DEV}boot1
* Power off
* Insert the SD card where you wrote the U-Boot binary
* Power on
== Logs ==
You should see this over UART:
GXBB:BL1:08dafd:0a8993;FEAT:EDFC318C;POC:3;RCY:0;EMMC:0;READ:0;CHK:F3;SD:0;READ:0;CHK:0;
no sdio debug board detected 
TE: 481142
BL2 Built : 09:01:42, Oct 11 2016. 
gxb g88b04d6 - haixiang.bao@droid05
set vcck to 1100 mv
set vddee to 1000 mv
Board ID = 7
CPU clk: 1536MHz
DDR chl: Rank0+1 diff @ 912MHz
DDR0: 1024MB(auto)-2T-13
DDR1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
Load fip header from SD, src: 0x0000c000, des: 0x01400000, size: 0x00004000
Load bl30 from SD, src: 0x00010000, des: 0x01000000, size: 0x0000d460
Sending bl30......................................................OK. 
Run bl30...
Load bl31 from SD, src: 0x00020000, des: 0x101000[0, size: 0x000090e0
Image: gxb_v1.1.3135-18177fc 2016-06-24 11:00:09 yun.cai@droid06]
OPS=0x13
a4 f3 ce 38 6e 4Load bl33 from SD, src: 0x0002c000, des: 0x01000000, size: 0x000b1f30
c 4e 8e ed 41 1a 8 [0.582343 Inits done]
secure task start!
high task start!
low task start!
NOTICE: BL31: v2.8(debug):v2.8-776-g0223d1576
NOTICE: BL31: Built : 13:17:48, Apr 30 2023
INFO: ARM GICv2 driver initialized
INFO: BL31: Initializing runtime services
INFO: BL31: cortex_a53: CPU workaround for 843419 was applied
INFO: BL31: cortex_a53: CPU workaround for 855873 was applied
WARNING: BL31: cortex_a53: CPU workaround for 1530924 was missing!
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x1000000
INFO: SPSR = 0x3c9
<debug_uart>
U-Boot 2023.04-00873-g4d842495d4 (Apr 28 2023 - 20:31:56 +0200) videostrong-kii-pro
DRAM: 1 GiB (effective 2 GiB)
Core: 162 devices, 24 uclasses, devicetree: separate
MMC: mmc@70000: 0, mmc@72000: 1, mmc@74000: 2
Loading Environment from nowhere... OK
In: serial
Out: serial
Err: serial
Model: Videostrong KII Pro
SoC: Amlogic Meson GXBB (S905) Revision 1f:c (13:1)
Net: 
Warning: ethernet@c9410000 (eth0) using random MAC address - 22:26:f2:35:bb:c3
eth0: ethernet@c9410000
starting USB...
Bus usb@c9000000: USB DWC2
Bus usb@c9100000: USB DWC2
scanning bus usb@c9000000 for devices... 2 USB Device(s) found
scanning bus usb@c9100000 for devices... 1 USB Device(s) found
 scanning usb for storage devices... 0 Storage Device(s) found
Hit any key to stop autoboot: 0 
=> echo hi from u-boot running as the primary bootloader on the kii pro
hi from u-boot running as the primary bootloader on the kii pro
=> boot
switch to partitions #0, OK
mmc1 is current device
Scanning mmc 1:1...
Found /extlinux/extlinux.conf
Retrieving file: /extlinux/extlinux.conf
boot prev kernel
1: postmarketOS
Enter choice: 1: postmarketOS
Retrieving file: /vmlinuz
Retrieving file: /initramfs
append: console=ttyAML0,115200 PMOS_NO_OUTPUT_REDIRECT
Retrieving file: /meson-gxbb-kii-pro.dtb
Moving Image from 0x8080000 to 0x8200000, end=99f0000
## Flattened Device Tree blob at 08008000
 Booting using the fdt blob at 0x8008000
Working FDT set to 8008000
 Loading Ramdisk to 3fd20000, end 3ffff821 ... OK
 Loading Device Tree to 000000003fd16000, end 000000003fd1fc37 ... OK
Working FDT set to 3fd16000
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
<...>
== Contributors ==
* F
== See also ==
* Bare-bones WIP BL2 port (DON'T USE IT IF YOU'RE A REGULAR USER)
* U-Boot experiments
* Amlogic U-Boot tree (+ some changes)
* Efforts to reverse-engineer Amlogic's proprietary utils (those utilities are used above to create a working FIP)
* Old BL2 sources from before Amlogic made it proprietary (based on TF-A code)
** Mirror