akaizen_ has quit [Remote host closed the connection]
akaizen has joined #linux-rockchip
akaizen has quit [Remote host closed the connection]
Astralix1 has joined #linux-rockchip
Astralix has quit [Ping timeout: 264 seconds]
x_x|eebrah is now known as o_O|eebrah
akaizen has joined #linux-rockchip
akaizen has quit [Remote host closed the connection]
akaizen has joined #linux-rockchip
akaizen has quit [Remote host closed the connection]
Dan68 has quit [*.net *.split]
hramrach has quit [*.net *.split]
Dan68 has joined #linux-rockchip
jeremb has quit [Ping timeout: 264 seconds]
jeremb_ has joined #linux-rockchip
jeremb_ is now known as jeremb
merbanan has quit [Ping timeout: 245 seconds]
merbanan has joined #linux-rockchip
hipboi has joined #linux-rockchip
akaizen has joined #linux-rockchip
rellla has joined #linux-rockchip
rellla2 has joined #linux-rockchip
rellla has quit [Ping timeout: 264 seconds]
AstralixNB has joined #linux-rockchip
akaizen has joined #linux-rockchip
akaizen is now known as 36DABGD3Q
36DABGD3Q has quit [Read error: Connection reset by peer]
jeremb has joined #linux-rockchip
jeremb has quit [Changing host]
AstralixNB has left #linux-rockchip [#linux-rockchip]
o_O|eebrah is now known as O_O|eebrah
AstralixNB has joined #linux-rockchip
hramrach has joined #linux-rockchip
arokux2 has joined #linux-rockchip
atiti has joined #linux-rockchip
hramrach has quit [Ping timeout: 240 seconds]
hramrach has joined #linux-rockchip
jpsminix has joined #linux-rockchip
<jpsminix>
Hi!
<AstralixNB>
hi
tonikasch has joined #linux-rockchip
<AstralixNB>
hipboi?
<AstralixNB>
I try to understand rk bootloader mechanism
<hipboi>
AstralixNB, here
<AstralixNB>
From what I kno so far, the mask rom loader fetches 2k of code into SRAM that is used to bring up SDRAM
<AstralixNB>
Then the rest of the bootloader is put into SDRAM and started
<hipboi>
yes
<hipboi>
usually the 2K code just setting the arm core and clock
<AstralixNB>
What I am trying to figure out is, where this code is loaded and from where it is loaded out of the file
<hipboi>
and load from external storage
<AstralixNB>
Yes, and the token that identifies the bootloader is simply "BOOT"
<AstralixNB>
but after this token some text starts... looks like the strings that come up if you start bootloader and have a serial port attached
<hipboi>
my idea is to go from the external sdcard first
<AstralixNB>
there is a SD Card bootloader in the SDK
<hipboi>
since we can read the sdcard on pc
<AstralixNB>
No need, I can read .bin fine
<AstralixNB>
and I can disassemble it too, but I need to get an idea of where certain parts are put.
<hipboi>
that's why we need sd card
<AstralixNB>
do we?
<hipboi>
rockchip provide a window tool to write rkimage to sdcard
<hipboi>
for sd booting
<AstralixNB>
yes
<hipboi>
we can see how the image is laid at the sdcard
<AstralixNB>
ah, sorry, I am more interested in where the things are put inside the RK
<hipboi>
but the bootloader must be there
<hipboi>
the bootloader will be start from some certain sectors
<hipboi>
on sd card
<AstralixNB>
Yes but that is not the question
<AstralixNB>
I am one step ahaead
<AstralixNB>
finding the correct position of the sdboot.bin on an sdcard is a matter of seconds and I can do that some times.
<AstralixNB>
but how is this sdboot.bin put into pieces?
<hipboi>
i see
<AstralixNB>
the mask rom loader will load 2k of it to internal SRAM
<AstralixNB>
which 2k?
<AstralixNB>
and is the SRAM remapped to 0x00000000 or is it run at 0x10080000
<AstralixNB>
What is the start vector in the mask rom loader, as the first bytes of the first 2k of sdboot.bin are not lokking like code, but constants.
<AstralixNB>
And I am not sure if the provided bootloader of the SDK will work with 3188
<hipboi>
i guess the start vector is at 0xffff0000 in mask rom loader
<AstralixNB>
one if the ascii parts in it tell "rk2928usbplug"
<AstralixNB>
0xffff0000 is outside any valid memory
<hipboi>
where is the mask rom located
<AstralixNB>
0000_0000/1012_0000
<AstralixNB>
At reset mask ROM is at 0x10120000 and mirrored to 0x00000000
<AstralixNB>
after relocation, Embedded SRAM at 0x10080000 is mirrored to 0x00000000
<AstralixNB>
0xFFFF0000 is an option as the upper 1GB SDRAM page is at 0xE0000000. But at time if loading bootloader, the SDRAM is not available.
<AstralixNB>
Btw, the procedure is the same for all memory sources, SD (if supported) MMC, SPI NOR, NAND
<hipboi>
if BTMODE an external pin?
<hipboi>
ok
<hipboi>
When soc_remap = 1, the bootrom is mapped
<hipboi>
to address 0x10100000 and internal memory
<hipboi>
is mapped to address 0x0.
<AstralixNB>
yes
<hipboi>
oh, BTMODE is an external pin
<AstralixNB>
ah... wasn't the internal mask rom loader encrypted?
<AstralixNB>
that may be the reason I cannot ready any logical assembly in that bootloader...
<AstralixNB>
Jep, it is encrypted
<hipboi>
how do you figure out it's encrypted
<AstralixNB>
decryped it
<hipboi>
...
<AstralixNB>
now the strings are present that you can see from the serial port while bootloader is up
<AstralixNB>
still missing the entry vector from mask-rom code to SRAM code for SDRA setup
<AstralixNB>
for the encryption thing... all credits go to sarg
<AstralixNB>
We need to find out if we can sign the RK3188 that there is an unencrypted bootloader it should start... otherwise we must find out what rk thinks about that we use their encryption for our bootloader...
mmind00 has joined #linux-rockchip
hipboi has quit [Quit: Leaving]
O_O|eebrah is now known as o_O|eebrah
hipboi has joined #linux-rockchip
<tonikasch>
Hi! what do you think of the wandboard quad?
<hipboi>
AstralixNB, if i understand correct, the bin file is encrypted and was decrypted by the tool(RKAndroidTool or sd imager writer) and then write to nand flash or sd card
<AstralixNB>
Ok, could be that the NAND content then is available unencrpted
<AstralixNB>
Or the SD content
GeorgeJ has joined #linux-rockchip
arokux2 has quit [Remote host closed the connection]
Galland has joined #linux-rockchip
<Galland>
hello all
<Galland>
tonight I've been playing around with the xf86 driver from olegk0 (in turn based on a past version of sunxi's)
<Galland>
which, on the rk3066 was able to do some limited XV (resize videos in HW, avoiding the massive frame losses of SW resizing)