• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[HOWTO] Linux on Xiaomi Mi Box S(MDZ-22-AB)

Search This thread

PrinceOfAbyss

Member
May 28, 2010
36
9
Armbian_5.34_S9xxx_Ubuntu_xenial_4.9.40_mate_20171112 from https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN/5.34 boots like charm.
4XeFVKK.jpg


Quick HOWTO:
  1. Download Armbian_5.34_S9xxx_Ubuntu_xenial_4.9.40_mate_20171112.img(or any other flavour) from https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN/5.34
    Unpack xz archive with 7zip(windows)/Keka(mac), Use Rufus(windows)/balenaEtcher(mac) or other img to deploy to any usb drive.
  2. Make sure you are connected to the box via usb serial interface(use putty.exe on windows/Serial.app on mac)
    baud rate 115200, data bits: 8, parity: none, stop bits: 1, flow control: none.
  3. After successful serial connection to the box, you can interrupt uboot(ctrl+c or space) and get a uboot shell. after that paste:
    Code:
    setenv bootcmd "run start_autoscript; run storeboot;"
    setenv start_autoscript "if usb start ; then run start_usb_autoscript; fi; if mmcinfo; then run start_mmc_autoscript; fi;"
    setenv start_mmc_autoscript "if fatload mmc 0 1020000 s905_autoscript; then autoscr 1020000; fi;"
    setenv start_usb_autoscript "if fatload usb 0 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 1 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 2 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 3 1020000 s905_autoscript; then autoscr 1020000; fi;"
    setenv upgrade_step "0"
    saveenv
  4. insert armbian usb that you created in step 1 and power-cycle the box. (you might need to use powered usb hub, my box did not power usb port, so usb flash drive was not working)
  5. you should be able to see armbian booting via HDMI on your TV/Monitor

wifi is not working, but you should be able to use usb wifi or ethernet adapter.

Is the procedure described above foolproof? I have a similar (not the exact model) Technicolor UZW4030WNH TV box with a S905D SoC, and want to interrupt the U-boot process, but it's unstoppable. I've tried all recommended in the bootlog key combinations, Ctrl+C/Space/Enter but once I power up the device, the bootup doesn't stop...

Below I attach the bootlog, if anyone can get a clue of what's going on... Ah, is there any chance that the manufacturer has disabled somehow this interruption? Generally, is this possible to get interrupted? Or is it a matter of finding the correct combination?

Finally, I've identified the UART pins on the PCB to be in the following sequence GND-RX-TX-VCC... But could it be GND-VCC-TX-RX (see attached image to understand what I mean)? This would justify why my interrupt command doesn't get through...

Code:
GXL:BL1:9ac50e:bb16dc;FEAT:BF8D39BE:0;POC:3;EMMC:0;READ:0;0.0;0.0;CHK:0;
TE: 183395

BL2 Built : 13:29:27, Oct 20 2017. \ngxl g6cead14 - [email protected]

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 9
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR4 chl: Rank0 @ 1008MHz
Rank0: 2048MB-2T-18
DataBus test pass!
AddrBus test pass!
-s
emmc switch 3 ok
BL2: rpmb counter: 0x0000001d
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x0000c200, des: 0x01700000, size: 0x00004000
Load BL3x from eMMC, src: 0x00010200, des: 0x01704000, size: 0x000f4000
NOTICE:  BL3-1: v1.0(release):8ede9fe
NOTICE:  BL3-1: Built : 20:00:30, Dec 25 2017
[BL31]: GXL CPU setup!
aml log : bl31 detect secure boot !
[SECURE APB] Write to enable Jtag finished
Wait for your jtag pass word...
mpu_config_enable:ok
[Image: gxl_v1.1.3212-44bf1a7 2017-07-24 17:22:09 [email protected]]
OPS=0x04
58 84 36 41 a0 8c 82 ca 5c 8a c0 7a [1.656177 Inits done]
secure task start!
high task start!
low task start!
INFO:    BL3-2: ATOS-V2.0.2-g39c4135 #2 Fri Jun 15 18:29:54 CST 2018 arm
INFO:    BL3-2: chip version = RevD (21:D - 0:0)
INFO:    BL3-2: crypto engine DMA
INFO:    BL3-2: secure time TEE


U-Boot 2015.01-g7942d0d (Nov 09 2018 - 16:20:49)

DRAM:  2 GiB
Relocation Offset is: 76edb000
register usb cfg[0][1] = 0000000077f61fb8
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
gpio: pin GPIOZ_13 (gpio 72) value is 0
gpio: pin GPIOAO_9 (gpio 109) value is 1
gpio: pin GPIOAO_6 (gpio 106) value is 1
MMC:   aml_priv->desc_buf = 0x0000000073edbdc0
aml_priv->desc_buf = 0x0000000073ede0f0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 4c4d4140
start dts,buffer=0000000073ee0930,dt_addr=0000000073ee0930
parts: 16
00:      logo   0000000000800000 1
01:  recovery   0000000001200000 1
02:       dto   0000000000800000 1
03:  cri_data   0000000000800000 1
04:       tee   0000000002000000 1
05:     param   0000000001000000 1
06:      prsv   0000000001000000 1
07:      misc   0000000000400000 1
08:       oem   0000000006000000 1
09:       odm   0000000010000000 1
10:    vendor   0000000010000000 1
11:       rsv   0000000000800000 1
12:      boot   0000000001000000 1
13:    system   0000000050000000 1
14:     cache   0000000032000000 2
15:      data   ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x35a00000
Using default environment

In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
hpd_state=1
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
Net:   dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=0
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
[1080p50hz] is invalid for cvbs.
set hdmitx VIC = 31
config HPLL = 2970000
HPLL: 0xc000027b
config HPLL done
j = 4  vid_clk_div = 1
hdmitx phy setting done
hdmitx: set enc for VIC: 31
rx version is 1.4 or below  div=10
hdmtix: set audio
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
gpio: pin GPIOAO_2 (gpio 102) value is 1
gpio: pin GPIOX_0 (gpio 0) value is 1
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
[imgread]secureKernelImgSz=0x918800
ee_gate_off ...
## Booting Android Image at 0x01080200 ...
reloc_addr =73f60bd0
copy done
Kernel command line: buildvariant=user
load dtb from 0x1000000 ......
   Uncompressing Kernel Image ... OK
   kernel loaded at 0x01080000, end = 0x0220d6c0
   Loading Ramdisk to 73d4b000, end 73ec8a52 ... OK
   Loading Device Tree to 000000001fff2000, end 000000001fffff72 ... OK
fdt_instaboot: no instaboot image

Starting kernel ...

uboot time: 3603836 us
[    [email protected]] Reserved memory: incorrect alignment of CMA region
[    [email protected]] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xbc)
[    [email protected]] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xbc)
[    [email protected]] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xbc)
[    0.2[email protected]] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xbc)
domain-0 init dvfs: 4
[    [email protected]] tv_vout: chrdev devno 266338304 for disp
[    [email protected]] mtdoops: mtd device (mtddev=name/number) must be supplied
[    [email protected]] amlogic-new-usb3 d0078080.usb3phy: This phy has no usb port
[    [email protected]] ATVR driver - init called!
[    [email protected]] get_storage_dev return 1
[    [email protected]] DI-di_probe: get flag_cma error.
[    [email protected]] PPMGRDRV: err: ppmgr_driver_probe called
[    [email protected]] DVB:async fifo 0 buf size 524288, flush size 262144
[    [email protected]] FE: cannot find resource "tuner0"
[    [email protected]] FE: cannot find resource "atv_demod0"
[    [email protected]] FE: cannot find resource "tuner1"
[    [email protected]] FE: cannot find resource "atv_demod1"
[    [email protected]] FE: cannot find resource "dtv_demod1"
efuse_pw_en: 0x17
[    [email protected]] cectx aocec: no hdmirx reg resource
[    [email protected]] cectx aocec: no hhi reg resource
[    [email protected]] cectx aocec: can't find hdmirx
[    [email protected]] aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTL
[    [email protected]] aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTL -> direct -> Ext Spk
[    [email protected]] aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTR
[    [email protected]] aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTR -> direct -> Ext Spk
[    [    [email protected]] init: waitpid failed: No child processes
[    [email protected]] init: /init.amlogic.rc: 206: chmod requires 2 arguments
[    [email protected]] init: could not import file 'init.mtk.rc' from '/init.amlogic.rc': No such file or directory
[    3.203347[    [email protected]] init: enter do_confirm_formated /dev/block/tee, /tee
[    [email protected]] init: blocksize 1024, bytes_per_inode 1024
[    [email protected]] init: do_confirm_formated ext4 try mount
[    [email protected]] DVB:async fifo 0 buf size 524288, flush size 16384
[    [email protected]] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[    [email protected]] fs_mgr: Warning: unknown flag nosuid
[    [email protected]] fs_mgr: Warning: unknown flag nodev
[    [email protected]] device-mapper: android-verity: come to android_verity_ctr in dm-android-verity.c
[    [email protected]] device-mapper: android-verity: argv[0]: 1
[    [email protected]] device-mapper: android-verity: argv[1]: /dev/block/system
[    [email protected]] device-mapper: android-verity: argv[2]: /dev/block/system
[    [email protected]] device-mapper: android-verity: argv[3]: 4096
[    [email protected]] device-mapper: android-verity: argv[4]: 4096
[    [email protected]] device-mapper: android-verity: argv[5]: 322558
[    [email protected]] device-mapper: android-verity: argv[6]: 322558
[    [email protected]] device-mapper: android-verity: argv[7]: sha256
[    [email protected]] device-mapper: android-verity: argv[8]: 0b1f3bddf3c1cf8b70ba15a20682e9579b85a76b0237ec49e567a8316c189612
[    [email protected]] device-mapper: android-verity: argv[9]: aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7
[    [email protected]] device-mapper: android-verity: argv[10]: 9
[    [email protected]] device-mapper: android-verity: argv[11]: use_fec_from_device
[    [email protected]] device-mapper: android-verity: argv[12]: /dev/block/system
[    [email protected]] device-mapper: android-verity: argv[13]: fec_start
[    [email protected]] device-mapper: android-verity: argv[14]: 325107
[    [email protected]] device-mapper: android-verity: argv[15]: fec_blocks
[    [email protected]] device-mapper: android-verity: argv[16]: 325107
[    [email protected]] device-mapper: android-verity: argv[17]: fec_roots
[    [email protected]] device-mapper: android-verity: argv[18]: 2
[    [email protected]] device-mapper: android-verity: argv[19]: ignore_zero_blocks
[    [email protected]] device-mapper: android-verity: verity_table_args[0]: 1
[    [email protected]] device-mapper: android-verity: verity_table_args[1]: /dev/block/system
[    [email protected]] device-mapper: android-verity: verity_table_args[2]: /dev/block/system
[    [email protected]] device-mapper: android-verity: verity_table_args[3]: 4096
[    [email protected]] device-mapper: android-verity: verity_table_args[4]: 4096
[    [email protected]] device-mapper: android-verity: verity_table_args[5]: 322558
[    [email protected]] device-mapper: android-verity: verity_table_args[6]: 322558
[    [email protected]] device-mapper: android-verity: verity_table_args[7]: sha256
[    [email protected]] device-mapper: android-verity: verity_table_args[8]: 0b1f3bddf3c1cf8b70ba15a20682e9579b85a76b0237ec49e567a8316c189612
[    [email protected]] device-mapper: android-verity: verity_table_args[9]: aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7
[    [email protected]] device-mapper: android-verity: verity_table_args[10]: 9
[    [email protected]] device-mapper: android-verity: verity_table_args[11]: use_fec_from_device
[    [email protected]] device-mapper: android-verity: verity_table_args[12]: /dev/block/system
[    [email protected]] device-mapper: android-verity: verity_table_args[13]: fec_start
[    [email protected]] device-mapper: android-verity: verity_table_args[14]: 325107
[    [email protected]] device-mapper: android-verity: verity_table_args[15]: fec_blocks
[    [email protected]] device-mapper: android-verity: verity_table_args[16]: 325107
[    [email protected]] device-mapper: android-verity: verity_table_args[17]: fec_roots
[    [email protected]] device-mapper: android-verity: verity_table_args[18]: 2
[    [email protected]] device-mapper: android-verity: verity_table_args[19]: ignore_zero_blocks
[    [email protected]] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[    [email protected]] fs_mgr: Warning: unknown flag nosuid
[    [email protected]] fs_mgr: Warning: unknown flag nodev
[    [email protected]] init: property_set("ro.adb.secure", "1") failed
[    [email protected]] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[    [email protected]] fs_mgr: Warning: unknown flag nosuid
[    [email protected]] fs_mgr: Warning: unknown flag nodev
[    [email protected]] init: /recovery not specified in fstab
[    [email protected]] init: do_start: Service debuggerd64 not found
[    [email protected]] dig: dig start!
[    [email protected]] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[    [email protected]] fs_mgr: Warning: unknown flag nosuid
[    [email protected]] fs_mgr: Warning: unknown flag nodev
[    [email protected]] init: decode_uid: Unable to find UID for 'pppoe'. Returning UINT_MAX
[    [email protected]] init: decode_uid: Unable to find UID for 'pppoe'. Returning UINT_MAX
[    [email protected]] init: insmod: open("/system/lib/aml_thermal.ko") failed: No such file or directory
[    [email protected]] vfm_map_store:rm default
[    [email protected]] vfm_map_store:add default decoder ppmgr deinterlace amvideo
[    [email protected]] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    [email protected]] init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[    [email protected]] init: setprop: cannot expand '${sys.usb.state}'
[    [email protected]] init: property 'ro.usb.vendor.string' doesn't exist while expanding '${ro.usb.vendor.string}'
[    [email protected]] init: write: cannot expand '${ro.usb.vendor.string}'
[    [email protected]] init: property 'ro.usb.product.string' doesn't exist while expanding '${ro.usb.product.string}'
[    [email protected]] init: write: cannot expand '${ro.usb.product.string}'
[    [email protected]] init: property_set("ro.radio.noril", "true") failed
[    [email protected]] init: insmod: open("/system/lib/compat.ko") failed: No such file or directory
[    [email protected]] init: cannot find '/system/bin/cwmpd' (No such file or directory), disabling 'cwmpd'
[    [email protected]] init: finit_module for "/system/lib/dwc3.ko" failed: File existsinit: finit_module for "/system/lib/dwc_otg.ko" failed: File exists
[    [email protected]] init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[    [email protected]] init: setprop: cannot expand '${sys.usb.state}'
[    [email protected]] init: property 'ro.usb.vendor.string' doesn't exist while expanding '${ro.usb.vendor.string}'
[    [email protected]] init: write: cannot expand '${ro.usb.vendor.string}'
[    [email protected]] init: property 'ro.usb.product.string' doesn't exist while expanding '${ro.usb.product.string}'
[    [email protected]] init: write: cannot expand '${ro.usb.product.string}'
[    [email protected]] android_usb: already disabled
[    [email protected]] init: cannot find '/system/bin/update_verifier' (No such file or directory), disabling 'exec 2 (/system/bin/update_verifier)'
[    [email protected]] init: cannot find '/system/bin/install-recovery.sh' (No such file or directory), disabling 'flash_recovery'
[    [email protected]] init: cannot find '/system/bin/pppoe_wrapper' (No such file or directory), disabling 'pppoe_wrapper'
[    [email protected]] init: cannot find '/system/bin/factoryreset.sh' (No such file or directory), disabling 'factoryreset'
[    [email protected]] meson-remote c8100580.rc: remote_ioctl invalid user space pointer
[    [email protected]] meson-remote c8100580.rc: remote_ioctl invalid user space pointer
[    [email protected]] init: couldn't write 4118 to /dev/cpuset/camera-daemon/tasks: No such file or directory
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[    [email protected]] name: mbsn, size 32
[BL31]: tee size: 0
[    [email protected]] name: cust_sn, size 32
[BL31]: tee size: 0
[   [email protected]] name: tocom, size 16
[BL31]: tee size: 0
[   [email protected]] name: tch_sn, size 32
[BL31]: tee size: 0
[   [email protected]] name: mac, size 6
[BL31]: tee size: 0
[   [email protected]] name: mac_bt, size 6
[BL31]: tee size: 0
[   [email protected]] name: mac_wlan, size 6
[BL31]: tee size: 0
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
Playready TA Start
provision_storage_read res 0  readlen 1348
Playready TA Exit!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
Playready TA Start
provision_storage_read res 0  readlen 32
Playready TA Exit!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[   [email protected]] rtk_btusb: download_patch: Cold reset bt chip only download
[   [email protected]] rtk_btusb: download_patch: Download fw patch done, fw len 22972
[   [email protected]] dig: isBootCompleted:1!
[   [email protected]] dig: setDataRoCount count:0!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[   [email protected]] name: cust_rootCA, size 2121
 

Attachments

  • IMG_20200426_003046___.jpg
    IMG_20200426_003046___.jpg
    255.6 KB · Views: 563

Preclikos

New member
May 5, 2021
1
0
3.3V pin is last pin around TX and RX
Or adapter has 5.1V can pick voltage after connector depend on usage u can use low drop diode or other component to get 5V from 5.1
 

V0idst4r

Senior Member
Jun 13, 2016
303
101
Anyone tried flashing the unofficial s905x twrp build to the recovery partition or pulling the boot partition and repacking it with magisk?
 

alexinc

Senior Member
Feb 4, 2008
648
80
as latest update bricked my device (bootloop without getting into recovery), is there any chance to revive this box by booting with uart, interrupting the boot process and entering something like "reboot recovery"?

thanks i.a.!
 

jonah1024

Member
Oct 14, 2020
8
6
I
as latest update bricked my device (bootloop without getting into recovery), is there any chance to revive this box by booting with uart, interrupting the boot process and entering something like "reboot recovery"?

thanks i.a.!
Hi, I'm in the same boat with you after the last updat. I've watched the serial output and it stops at after some "[BL31]: tee size: 0" lines.

This is the only bit that's different from a normal bootlog:
`
aml log : R1024 check pass!
aml log : R1024 check pass!
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
aml log : R~1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
`
 

Attachments

  • mi_box_bootloop.txt
    2.6 KB · Views: 24
  • Like
Reactions: kolvi077

LisWitalis

New member
Nov 14, 2021
3
0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
aml log : R~1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
`
some solution? I have the same error.

MiBOX has no voltage on the USB port and does not start after being powered through this port, so recovery does not work
 
Last edited:

jonah1024

Member
Oct 14, 2020
8
6
some solution? I have the same error.

MiBOX has no voltage on the USB port and does not start after being powered through this port, so recovery does not work
Hi, I fixed my box by reflashing the Android 8 image using the Amlogic USB Burning Tool. I then updated to 8.1 then to 9. Here are the instructions I've used: https://4pda.to/forum/index.php?showtopic=928322&st=23080#entry94116294

Follow the two steps from method 2 that requires shorting a pin to ground. Use google translator if you don't understand russian. (Make sure you don't select the Erease bootloader box otherwise you'll lose DRM keys - this step is specified in the guide as well but wanted to emphasize it)

Jonah
 

Attachments

  • Screenshot 2021-11-14 at 13.51.18.png
    Screenshot 2021-11-14 at 13.51.18.png
    66.2 KB · Views: 31

LisWitalis

New member
Nov 14, 2021
3
0
Hi, I fixed my box by reflashing the Android 8 image using the Amlogic USB Burning Tool. I then updated to 8.1 then to 9. Here are the instructions I've used: https://4pda.to/forum/index.php?showtopic=928322&st=23080#entry94116294

Follow the two steps from method 2 that requires shorting a pin to ground. Use google translator if you don't understand russian. (Make sure you don't select the Erease bootloader box otherwise you'll lose DRM keys - this step is specified in the guide as well but wanted to emphasize it)

Jonah

[18:51:22 648][HUB2-5][Inf]--Start burning...
[18:51:22 711][HUB2-5][Inf]--------------ERASE BOOTLOADER------------
[18:51:22 711][HUB2-5][Inf]-------------Download DDR.USB-----------
[18:51:22 711][HUB2-5][Inf]--2-4-0-0
[18:51:22 711][HUB2-5][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[18:51:23 220][HUB2-5][Inf]--Control write pll reg1 0xd9000000:0x00005183
[18:51:23 736][HUB2-5][Inf]--Write initial succeed
[18:51:23 736][HUB2-5][Inf]--Upload encrypt at 0xc8100228
[18:51:23 736][HUB2-5][Inf]--ulValue = 0x20444142
[18:51:23 736][HUB2-5][Inf]--Read encrypt value succeed
[18:51:33 743][HUB2-5][Err]--Download file failed, sequence 0
[18:51:33 743][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:33 743][HUB2-5][Inf]--Failure : 1, FailureMax : 3
[18:51:33 743][HUB2-5][War]--[18:51:43 764][HUB2-5][Err]--Download file failed, sequence 0
[18:51:43 764][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:43 764][HUB2-5][Inf]--Failure : 2, FailureMax : 3
[18:51:43 764][HUB2-5][War]--[18:51:53 781][HUB2-5][Err]--Download file failed, sequence 0
[18:51:53 781][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:53 781][HUB2-5][Inf]--Failure : 3, FailureMax : 3
[18:51:53 783][HUB2-5][Err]--[0x10103003]Romcode/Initialize DDR/Download buffer/USB transfer error
[18:51:53 783][HUB2-5][Inf]--Close device handle 0x00000d4


nothing more :(
i test 3 usb cable and 2 laptop :(
 

jonah1024

Member
Oct 14, 2020
8
6
[18:51:22 648][HUB2-5][Inf]--Start burning...
[18:51:22 711][HUB2-5][Inf]--------------ERASE BOOTLOADER------------
[18:51:22 711][HUB2-5][Inf]-------------Download DDR.USB-----------
[18:51:22 711][HUB2-5][Inf]--2-4-0-0
[18:51:22 711][HUB2-5][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[18:51:23 220][HUB2-5][Inf]--Control write pll reg1 0xd9000000:0x00005183
[18:51:23 736][HUB2-5][Inf]--Write initial succeed
[18:51:23 736][HUB2-5][Inf]--Upload encrypt at 0xc8100228
[18:51:23 736][HUB2-5][Inf]--ulValue = 0x20444142
[18:51:23 736][HUB2-5][Inf]--Read encrypt value succeed
[18:51:33 743][HUB2-5][Err]--Download file failed, sequence 0
[18:51:33 743][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:33 743][HUB2-5][Inf]--Failure : 1, FailureMax : 3
[18:51:33 743][HUB2-5][War]--[18:51:43 764][HUB2-5][Err]--Download file failed, sequence 0
[18:51:43 764][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:43 764][HUB2-5][Inf]--Failure : 2, FailureMax : 3
[18:51:43 764][HUB2-5][War]--[18:51:53 781][HUB2-5][Err]--Download file failed, sequence 0
[18:51:53 781][HUB2-5][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[18:51:53 781][HUB2-5][Inf]--Failure : 3, FailureMax : 3
[18:51:53 783][HUB2-5][Err]--[0x10103003]Romcode/Initialize DDR/Download buffer/USB transfer error
[18:51:53 783][HUB2-5][Inf]--Close device handle 0x00000d4


nothing more :(
i test 3 usb cable and 2 laptop :(
Did you load the password file? At what percent does it halt?
 

LisWitalis

New member
Nov 14, 2021
3
0
1636913528713.png


[19:08:43 860][HUB3-4][Inf]--Start burning...
[19:08:43 922][HUB3-4][Inf]--------------ERASE BOOTLOADER------------
[19:08:43 922][HUB3-4][Inf]-------------Download DDR.USB-----------
[19:08:43 922][HUB3-4][Inf]--Close device handle 0x00000b2c
[19:08:43 984][HUB3-4][Inf]--Open device handle \\?\usb#vid_1b8e&pid_c003#6&df7fac1&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed} 0x00000ad4
[19:08:44 040][HUB3-4][Inf]--2-4-0-0
[19:08:44 040][HUB3-4][Inf]--Test Identify support
[19:08:44 040][HUB3-4][Inf]--Identify return: 2-4-0-0-1-0
[19:08:44 040][HUB3-4][Inf]--Get Password!
[19:08:51 070][HUB3-4][Inf]--Identify return: 2-4-0-0-1-1
[19:08:51 070][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[19:08:51 585][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x00005183
[19:08:52 101][HUB3-4][Inf]--Test Identify support
[19:08:52 101][HUB3-4][Inf]--Identify support 6byte
[19:08:52 101][HUB3-4][Inf]--Identify return: 2-4-0-0-1-1
[19:08:52 101][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[19:08:52 617][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x00005183
[19:08:53 132][HUB3-4][Inf]--Write initial succeed
[19:08:53 132][HUB3-4][Inf]--Upload encrypt at 0xc8100228
[19:08:53 132][HUB3-4][Inf]--ulValue = 0xbdfd71be
[19:08:53 132][HUB3-4][Inf]--File change to DDR_ENC.USB
[19:08:53 132][HUB3-4][Inf]--Read encrypt value succeed
[19:08:53 132][HUB3-4][Inf]--Download DDR_ENC.USB,size: 49152!
[19:09:03 149][HUB3-4][Err]--Download file failed, sequence 0
[19:09:03 149][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:03 149][HUB3-4][Inf]--Failure : 1, FailureMax : 3
[19:09:13 696][HUB3-4][Err]--Download file failed, sequence 0
[19:09:13 696][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:13 696][HUB3-4][Inf]--Failure : 2, FailureMax : 3
[19:09:24 248][HUB3-4][Err]--Download file failed, sequence 0
[19:09:24 248][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:24 248][HUB3-4][Inf]--Failure : 3, FailureMax : 3
[19:09:24 248][HUB3-4][Err]--[0x10103003]Romcode/Initialize DDR/Download buffer/USB transfer error
[19:09:24 248][HUB3-4][Inf]--Close device handle 0x00000ad4


I load password as password.bin file (unziped)



some times look like this:
1636914553354.png


and mibox got restart


EDIT 2:

after a few restarts and 1 beer
1636916245453.png


thank you very much for the help
 

Attachments

  • password.bin.zip
    565 bytes · Views: 32
Last edited:

jonah1024

Member
Oct 14, 2020
8
6
View attachment 5458233

[19:08:43 860][HUB3-4][Inf]--Start burning...
[19:08:43 922][HUB3-4][Inf]--------------ERASE BOOTLOADER------------
[19:08:43 922][HUB3-4][Inf]-------------Download DDR.USB-----------
[19:08:43 922][HUB3-4][Inf]--Close device handle 0x00000b2c
[19:08:43 984][HUB3-4][Inf]--Open device handle \\?\usb#vid_1b8e&pid_c003#6&df7fac1&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed} 0x00000ad4
[19:08:44 040][HUB3-4][Inf]--2-4-0-0
[19:08:44 040][HUB3-4][Inf]--Test Identify support
[19:08:44 040][HUB3-4][Inf]--Identify return: 2-4-0-0-1-0
[19:08:44 040][HUB3-4][Inf]--Get Password!
[19:08:51 070][HUB3-4][Inf]--Identify return: 2-4-0-0-1-1
[19:08:51 070][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[19:08:51 585][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x00005183
[19:08:52 101][HUB3-4][Inf]--Test Identify support
[19:08:52 101][HUB3-4][Inf]--Identify support 6byte
[19:08:52 101][HUB3-4][Inf]--Identify return: 2-4-0-0-1-1
[19:08:52 101][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[19:08:52 617][HUB3-4][Inf]--Control write pll reg1 0xd9000000:0x00005183
[19:08:53 132][HUB3-4][Inf]--Write initial succeed
[19:08:53 132][HUB3-4][Inf]--Upload encrypt at 0xc8100228
[19:08:53 132][HUB3-4][Inf]--ulValue = 0xbdfd71be
[19:08:53 132][HUB3-4][Inf]--File change to DDR_ENC.USB
[19:08:53 132][HUB3-4][Inf]--Read encrypt value succeed
[19:08:53 132][HUB3-4][Inf]--Download DDR_ENC.USB,size: 49152!
[19:09:03 149][HUB3-4][Err]--Download file failed, sequence 0
[19:09:03 149][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:03 149][HUB3-4][Inf]--Failure : 1, FailureMax : 3
[19:09:13 696][HUB3-4][Err]--Download file failed, sequence 0
[19:09:13 696][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:13 696][HUB3-4][Inf]--Failure : 2, FailureMax : 3
[19:09:24 248][HUB3-4][Err]--Download file failed, sequence 0
[19:09:24 248][HUB3-4][Err]--usbWriteFile len=4096, ret=-116 error_msg=libusb0-dll:err [_usb_reap_async] timeout error

[19:09:24 248][HUB3-4][Inf]--Failure : 3, FailureMax : 3
[19:09:24 248][HUB3-4][Err]--[0x10103003]Romcode/Initialize DDR/Download buffer/USB transfer error
[19:09:24 248][HUB3-4][Inf]--Close device handle 0x00000ad4


I load password as password.bin file (unziped)



some times look like this:
View attachment 5458245

and mibox got restart


EDIT 2:

after a few restarts and 1 beer
View attachment 5458267

thank you very much for the help
Yup! Mine took around 3 trials until it burnt the image successfully. I'm glad you sort it out!
 

sieempi

Senior Member
Jul 30, 2010
295
401
Decrypted dtb,boot & recovery images for mdz-22-ab & mdz-24-aa for rom developers.
eg: use extracted zImage from mdz-22-ab-boot.img with gxl_oneday_v1.dtb to boot s905x armbian roms with method described earlier.
 

Attachments

  • img.zip
    53.1 MB · Views: 24

kalehrl

Senior Member
Nov 22, 2017
653
287
How did you decrypt them. I've got a box from my cable operator with root access but bootloader and other files are encrypted.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    UART Pins for TTL (I used Nokia CA-42 USB cable)
    XCIYTg0.png


    Boot log:
    Code:
    GXL:BL1:9ac50e:bb16dc;FEAT:BDFD71BC:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;
    TE: 112230
    
    BL2 Built : 14:26:56, Dec 14 2017. gxl g56303a2 - [email protected]
    
    set vcck to 1120 mv
    set vddee to 1000 mv
    Board ID = 5
    CPU clk: 1200MHz
    DQS-corr enabled
    DDR scramble enabled
    DDR3 chl: Rank0+1 @ 912MHz
    bist_test rank: 0 18 01 30 2b 16 41 17 00 2f 2e 1a 43 19 04 2f 2c 1a 3f 17 00 2f 2d 17 43 702  rank: 1 15 01 2a 2a 16 3f 14 00 29 2f 1b 43 14 02 26 2c 18 41 15 00 2a 2d 17 44 702   - PASS
    
    Rank0: 1024MB(auto)-2T-13
    
    Rank1: 1024MB(auto)-2T-13
    AddrBus test pass!
    -s
    emmc switch 3 ok
    Authentication key not yet programmed
    emmc_rpmb_key_is_programmed: error 0x00000007
    emmc switch 0 ok
    Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
    aml log : R1024 check pass!
    New fip structure!
    Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
    aml log : R1024 check pass!
    Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x0002c600
    aml log : R1024 check pass!
    Load bl32 from eMMC, src: 0x00050200, des: 0x01700000, size: 0x00033e00
    aml log : R1024 check pass!
    Load bl33 from eMMC, src: 0x00084200, des: 0x01700000, size: 0x00053c00
    aml log : R1024 check pass!
    NOTICE:  BL3-1: v1.0(release):b60a036
    NOTICE:  BL3-1: Built : 17:03:54, Apr 10 2018
    [BL31]: GXL CPU setup!
    NOTICE:  BL3-1: GXL secure boot!
    NOTICE:  BL3-1: BL33 decompress pass
    mpu_config_enable:ok
    [Image: gxl_v1.1.3255-1a77b01 2017-09-15 16:58:02 [email protected]]
    OPS=0x84
    31 ab f1 38 a4 4e b b1 c6 9f 14 93 [1.440554 Inits done]
    secure task start!
    high task start!
    low task start!
    INFO:    BL3-2: ATOS-V2.4-69-gc1e2fb5 #1 Wed Jan 31 06:57:06 UTC 2018 arm
    INFO:    BL3-2: Chip: GXL Rev: D (21:D - 80:2)
    INFO:    BL3-2: crypto engine DMA
    INFO:    BL3-2: secure time TEE
    INFO:    BL3-2: CONFIG_DEVICE_SECURE 0xb200000e
    
    
    U-Boot 2015.01-gccdffc5-dirty (Nov 18 2018 - 10:53:49), Build: jenkins-oneday-430
    
    DRAM:  2 GiB
    Relocation Offset is: 76ed6000
    gpio: pin gpiodv_24 (gpio 43) value is 1
    gpio: pin gpioh_3 (gpio 52) value is 1
    register usb cfg[0][1] = 0000000077f5f388
    MMC:   aml_priv->desc_buf = 0x0000000073ed6b40
    aml_priv->desc_buf = 0x0000000073ed8e60
    SDIO Port B: 0, SDIO Port C: 1
    emmc/sd response timeout, cmd8, status=0x3ff2800
    emmc/sd response timeout, cmd55, status=0x3ff2800
    init_part() 293: PART_TYPE_AML
    [mmc_init] mmc init success
    aml log : R1024 check pass!
    start dts,buffer=0000000073edb690,dt_addr=0000000073edb690
    get_partition_from_dts() 103: ret 0
    parts: 14
    00:      logo   0000000000800000 1
    01:  recovery   0000000001800000 1
    02:      misc   0000000000800000 1
    03:       dto   0000000000800000 1
    04:  cri_data   0000000000800000 2
    05:     param   0000000001000000 2
    06:      boot   0000000001000000 1
    07:       rsv   0000000001000000 1
    08:       tee   0000000002000000 1
    09:    vendor   0000000006400000 1
    10:       oem   0000000012c00000 1
    11:    system   0000000046000000 1
    12:     cache   0000000010000000 2
    13:      data   ffffffffffffffff 4
    init_part() 293: PART_TYPE_AML
    eMMC/TSD partition table have been checked OK!
    check pattern success
    mmc env offset: 0x17400000 
    In:    serial
    Out:   serial
    Err:   serial
    reboot_mode=cold_boot
    [store]To run cmd[emmc dtb_read 0x1000000 0x40000]
    _verify_dtb_checksum()-2610: calc 723413d2, store 723413d2
    _verify_dtb_checksum()-2610: calc 723413d2, store 723413d2
    dtb_read()-2827: total valid 2
    update_old_dtb()-2808: do nothing
    aml log : R1024 check pass!
    vpu: clk_level in dts: 7
    vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
    vpu: vpu_clk_gate_init_off finish
    hpd_state=0
    cvbs performance type = 6, table = 0
    amlkey_init() enter!
    [EFUSE_MSG]keynum is 4
    [BL31]: tee size: 0
    [BL31]: tee size: 0
    [BL31]: tee size: 0
    [BL31]: tee size: 0
    [KM]Error:f[keymanage_dts_get_key_device]L85:carrier key name is not exist
    [KM]Error:f[_get_km_ops_by_name]L231:key carrier not know device 4
    [KM]Error:f[key_manage_query_exist]L546:There isn't dts cfg for key[carrier]
    [KM]Error:f[key_manage_query_size]L503:Fail in query key exist
    Start read misc partition datas!
    info->magic = 
    info->version_major = 1
    info->version_minor = 0
    info->slots[0].priority = 15
    info->slots[0].tries_remaining = 7
    info->slots[0].successful_boot = 0
    info->slots[1].priority = 14
    info->slots[1].tries_remaining = 7
    info->slots[1].successful_boot = 0
    info->crc32 = -1075449479
    active slot = 0
    wipe_data=successful
    wipe_cache=successful
    upgrade_step=2
    [OSD]load fb addr from dts
    [OSD]fb_addr for logo: 0x7f800000
    [OSD]load fb addr from dts
    [OSD]fb_addr for logo: 0x7f800000
    [CANVAS]canvas init
    [CANVAS]addr=0x7f800000 width=5760, height=2160
    pull down bt_reset
    pull up bt_reset
    set hci reset
    04 0e 04 01 03 0c 00 
    set scan parameters
    04 0e 04 01 0b 20 00 
    set scan enable
    04 0e 04 01 0c 20 00 
    04 3e 2b 02 01 00 01 9d 53 be 6c e1 67 1f 02 01 02 03 03 9f fe 17 16 9f fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cf 
    04 3e 16 02 01 04 01 9d 53 be 6c e1 67 0a 09 ff e0 00 01 43 a5 4c 5a 24 cd 
    04 3e 21 02 01 00 01 88 0a 0b 55 03 54 15 02 01 02 11 07 fc 9d d0 b3 cb 84 e0 84 06 42 f3 f7 e1 e0 bf cb b8 
    04 3e 0c 02 01 04 01 88 0a 0b 55 03 54 00 b8 
    pull down bt_enable
    Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
    [imgread]szTimeStamp[2018111811300118]
    [imgread]secureKernelImgSz=0xa96800
    aml log : R-1024 check pass!
    aml log : R1024 check pass!
    aml log : R1024 check pass!
    aml log : R1024 check pass!
    ee_gate_off ...
    ## Booting Android Image at 0x01080000 ...
    reloc_addr =73f5b8e0
    copy done
    Kernel command line: buildvariant=user
    load dtb from 0x1000000 ......
       Uncompressing Kernel Image ... OK
       kernel loaded at 0x01080000, end = 0x02604a00
       Loading Ramdisk to 73cad000, end 73ec3800 ... OK
       Loading Device Tree to 000000001fff1000, end 000000001ffff000 ... OK
    
    Starting kernel ...
    
    uboot time: 3849048 us
    [    [email protected]] Booting Linux on physical CPU 0x0
    [    [email protected]] Linux version 4.9.61-g92463ee ([email protected]) (gcc version 6.3.1 20170109 (Linaro GCC 6.3-2017.02) ) #1 SMP PREEMPT Sun Nov 18 10:56:38 CST 2018
    [    [email protected]] Boot CPU: AArch64 Processor [410fd034]
    [    [email protected]] earlycon: aml_uart0 at MMIO 0x00000000c81004c0 (options '')
    [    [email protected]] bootconsole [aml_uart0] enabled
    [    [email protected]] efi: Getting EFI parameters from FDT:
    [    [email protected]] efi: UEFI not found.
    [    [email protected]] OF: reserved mem: __reserved_mem_alloc_size, start:5000000, end:7400000, len:2400000
    [    [email protected]] Reserved memory: created CMA memory pool at 0x0000000005000000, size 36 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,secmon, compatible id shared-dma-pool
    [    [email protected]] OF: reserved mem: __reserved_mem_alloc_size, start:7f800000, end:80000000, len:800000
    [    [email protected]] Reserved memory: created CMA memory pool at 0x000000007f800000, size 8 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,meson-fb, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: created CMA memory pool at 0x000000007d800000, size 32 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,di_cma, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: created CMA memory pool at 0x0000000075c00000, size 124 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,ion-dev, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: created CMA memory pool at 0x0000000074c00000, size 16 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,vdin1_cma, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: created DMA memory pool at 0x0000000074c00000, size 0 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,ppmgr, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: created CMA memory pool at 0x0000000060800000, size 308 MiB
    [    [email protected]] OF: reserved mem: initialized node linux,codec_mm_cma, compatible id shared-dma-pool
    [    [email protected]] Reserved memory: unable to setup CMA region
    [    [email protected]] OF: reserved mem: initialized node linux,codec_mm_reserved, compatible id amlogic, codec-mm-reserved
    [    [email protected]] cma: Reserved 8 MiB at 0x0000000074400000
    [    [email protected]] psci: probing for conduit method from DT.
    [    [email protected]] psci: PSCIv0.2 detected in firmware.
    [    [email protected]] psci: Using standard PSCI v0.2 function IDs
    [    [email protected]] psci: Trusted OS migration not required
    [    [email protected]] percpu: Embedded 23 pages/cpu @ffffffc074355000 s53528 r8192 d32488 u94208
    [    [email protected]] Detected VIPT I-cache on CPU0
    [    [email protected]] CPU features: enabling workaround for ARM erratum 845719
    [    [email protected]] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 515844
    [    [email protected]] Kernel command line: rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=enforcing logo=osd1,loaded,0x3d800000,576cvbs maxcpus=4 vout=576cvbs,enable hdmimode=1080p60hz cvbsmode=576cvbs hdmitx= cvbsdrv=0 androidboot.firstboot=0 jtag=apao androidboot.veritymode=enforcing androidboot.hardware=amlogic androidboot.btmacaddr=c8:28:32:2d:a2:36 androidboot.wifimac=c8:28:32:2b:0a:26 androidboot.wificountrycode=US androidboot.bootloader=oneday androidboot.serialno=18554280002242 androidboot.rpmb_state=0 androidboot.verifiedbootstate=orange androidboot.slot_suffix=_a buildvariant=user
    [    [email protected]] fb: osd1
    [    [email protected]] fb: loaded
    [    [email protected]] fb: 0x3d800000
    [    [email protected]] fb: 576cvbs
    [    [email protected]] vout: 576cvbs
    [    [email protected]] vout: enable: 1
    [    [email protected]] vout: get hdmimode: 1080p60hz
    [    [email protected]] vout: get cvbsmode: 576cvbs
    [    [email protected]] cvbs_out: cvbs performance line = 0
    [    [email protected]] jtag: jtag select apao
    [    [email protected]] (NULL device *): [mac_addr_set] try to wifi mac from emmc key!
    [    [email protected]] (NULL device *): [mac_addr_set] uboot setup mac-addr: c8:28:32:2b:a:26
    [    [email protected]] PID hash table entries: 4096 (order: 3, 32768 bytes)
    [    [email protected]] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes)
    [    [email protected]] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes)
    [    [email protected]] Memory: 1488104K/2096128K available (11644K kernel code, 1426K rwdata, 4472K rodata, 4416K init, 1434K bss, 63256K reserved, 544768K cma-reserved)
    [    [email protected]] Virtual kernel memory layout:
    [    [email protected]]     modules : 0xffffff8000000000 - 0xffffff8008000000   (   128 MB)
    [    [email protected]]     vmalloc : 0xffffff8008000000 - 0xffffffbebfff0000   (   250 GB)
    [    [email protected]]       .text : 0xffffff8009080000 - 0xffffff8009be0000   ( 11648 KB)
    [    [email protected]]     .rodata : 0xffffff8009be0000 - 0xffffff800a050000   (  4544 KB)
    [    [email protected]]       .init : 0xffffff800a050000 - 0xffffff800a4a0000   (  4416 KB)
    [    [email protected]]       .data : 0xffffff800a4a0000 - 0xffffff800a604a00   (  1427 KB)
    [    [email protected]]        .bss : 0xffffff800a604a00 - 0xffffff800a76b324   (  1435 KB)
    [    [email protected]]     fixed   : 0xffffffbefe7fd000 - 0xffffffbefec00000   (  4108 KB)
    [    [email protected]]     PCI I/O : 0xffffffbefee00000 - 0xffffffbeffe00000   (    16 MB)
    [    [email protected]]     vmemmap : 0xffffffbf00000000 - 0xffffffc000000000   (     4 GB maximum)
    [    [email protected]]               0xffffffbf00004000 - 0xffffffbf02000000   (    31 MB actual)
    [    [email protected]]     memory  : 0xffffffc000100000 - 0xffffffc080000000   (  2047 MB)
    [    [email protected]] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
    [    [email protected]] Preemptible hierarchical RCU implementation.
    [    [email protected]]        Build-time adjustment of leaf fanout to 64.
    [    [email protected]]        RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=4.
    [    [email protected]] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=4
    [    [email protected]] NR_IRQS:64 nr_irqs:64 0
    [    [email protected]] amlogic_init_sdemmc: register amlogic sdemmc clk
    [    [email protected]] amlogic_init_sdemmc: register amlogic sdemmc clk
    [    [email protected]] success set parent gpu_p1_composite rate to 400000000
    [    [email protected]] amlogic_init_gpu: register meson gpu clk
    [    [email protected]] amlogic_init_media: register meson media clk
    [    [email protected]] amlogic_init_misc: register meson misc clk
    [    [email protected]] gxl_clkc_init initialization complete
    [    [email protected]] arm_arch_timer: Architected cp15 timer(s) running at 24.00MHz (phys).
    [    [email protected]] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
    [    [email protected]] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
    [    [email protected]] meson_bc_timer: mclk->mux_reg =ffffff8008006990,mclk->reg =ffffff8008008994
    [    [email protected]] Console: colour dummy device 80x25
    [    [email protected]] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=96000)
    [    [email protected]] pid_max: default: 32768 minimum: 301
    [    [email protected]] Security Framework initialized
    [    [email protected]] SELinux:  Initializing.
    [    [email protected]] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes)
    [    [email protected]] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes)
    [    [email protected]] ftrace: allocating 38256 entries in 150 pages
    [    [email protected]] sched-energy: CPU device node has no sched-energy-costs
    [    [email protected]] CPU0: update cpu_capacity 1024
    [    [email protected]] ASID allocator initialised with 65536 entries
    [    [email protected]] EFI services will not be available.
    [    [email protected]] Meson chip version = RevD (21:D - 84:0)
    [    [email protected]] Detected VIPT I-cache on CPU1
    [    [email protected]] CPU1: update cpu_capacity 1024
    [    [email protected]] CPU1: Booted secondary processor [410fd034]
    [    [email protected]] Detected VIPT I-cache on CPU2
    [    [email protected]] CPU2: update cpu_capacity 1024
    [    [email protected]] CPU2: Booted secondary processor [410fd034]
    [    [email protected]] Detected VIPT I-cache on CPU3
    [    [email protected]] CPU3: update cpu_capacity 1024
    [    [email protected]] CPU3: Booted secondary processor [410fd034]
    [    [email protected]] Brought up 4 CPUs
    full bootlog at https://pastebin.com/GaRRd76p

    Uboot env:
    Code:
    oneday#printenv
    1080p60hz_deepcolor=444,8bit
    1080p_h=1080
    1080p_w=1920
    1080p_x=0
    1080p_y=0
    480p60hz_deepcolor=rgb,8bit
    EnableSelinux=enforcing
    active_slot=_a
    baudrate=115200
    bcb_cmd=get_valid_slot;
    boot_part=boot
    bootargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=enforcing logo=osd1,loaded,0x3d800000,1080p60hz maxcpus=4 vout=1080p60hz,enable hdmimode=1080p60hz cvbsmode=576cvbs hdmitx= cvbsdrv=0 androidboot.firstboot=0 jtag=apao androidboot.veritymode=enforcing androidboot.hardware=amlogic androidboot.btmacaddr=c8:28:32:2d:a2:36 androidboot.wifimac=c8:28:32:2b:0a:26 androidboot.wificountrycode=US androidboot.bootloader=oneday androidboot.serialno=18554280002242 androidboot.rpmb_state=0 androidboot.verifiedbootstate=orange androidboot.slot_suffix=_a
    bootcmd=run storeboot;
    bootdelay=1
    bootloader=oneday
    bootup_offset=0x10dbbb0
    bootup_size=0x5eec7a
    btmac=c8:28:32:2d:a2:36
    cmdline_keys=keyman init 0x1234; setkeys;
    colorattribute=444,8bit
    cvbs_drv=0
    cvbsmode=576cvbs
    display_bpp=24
    display_color_bg=0
    display_color_fg=0xffff
    display_color_index=24
    display_height=1080
    display_layer=osd1
    display_width=1920
    dtb_mem_addr=0x1000000
    factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; if test ${wipe_cache} = failed; then run init_display; run storeargs;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; 
    fb_addr=0x3d800000
    fb_height=1080
    fb_width=1920
    fdt_high=0x20000000
    firstboot=0
    hdmimode=1080p60hz
    init_display=osd open;osd clear;imgread pic logo bootup $loadaddr;bmp display $bootup_offset;bmp scale
    initargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 
    is.bestmode=false
    jtag=apao
    loadaddr=1080000
    maxcpus=4
    outputmode=1080p60hz
    preboot=run cmdline_keys;run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run init_display;run storeargs;run switch_bootmode;
    reboot_mode=cold_boot
    recovery_from_flash=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if itest ${upgrade_step} == 3; then if ext4load mmc 1:2 ${dtb_mem_addr} /recovery/dtb.img; then echo cache dtb.img loaded; fi;if ext4load mmc 1:2 ${loadaddr} /recovery/recovery.img; then echo cache recovery.img loaded; wipeisb; bootm ${loadaddr}; fi;else fi;if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then wipeisb; bootm ${loadaddr}; fi;
    recovery_from_udisk=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then echo udisk dtb.img loaded; fi;wipeisb; bootm ${loadaddr};fi;
    recovery_offset=0
    recovery_part=recovery
    rpmb_state=0
    sdc_burning=sdc_burn ${sdcburncfg}
    sdcburncfg=aml_sdc_burn.ini
    serialno=18554280002242
    sn2=3138353534323830303032323432
    stderr=serial
    stdin=serial
    stdout=serial
    storeargs=setenv bootargs ${initargs} androidboot.selinux=${EnableSelinux} logo=${display_layer},loaded,${fb_addr},${outputmode} maxcpus=${maxcpus} vout=${outputmode},enable hdmimode=${hdmimode} cvbsmode=${cvbsmode} hdmitx=${cecconfig} cvbsdrv=${cvbs_drv} androidboot.firstboot=${firstboot} jtag=${jtag}; setenv bootargs ${bootargs} androidboot.veritymode=enforcing androidboot.hardware=amlogic androidboot.btmacaddr=${btmac} androidboot.wifimac=${wifimac} androidboot.wificountrycode=${wifi_ccode} androidboot.bootloader=${bootloader} androidboot.serialno=${serialno};setenv bootargs ${bootargs} androidboot.rpmb_state=${rpmb_state};setenv bootargs ${bootargs} androidboot.verifiedbootstate=${verifiedbootstate};setenv bootargs ${bootargs} androidboot.slot_suffix=${active_slot};
    storeboot=if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run update;
    switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then run recovery_from_flash;else if test ${reboot_mode} = update; then run update;else if test ${reboot_mode} = cold_boot; then else if test ${reboot_mode} = fastboot; then fastboot;fi;fi;fi;fi;if monitor_bt_cmdline; then run recovery_from_flash; fi;
    try_auto_burn=update 700 750;
    update=run usb_burning; run sdc_burning; if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
    upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else fi;
    upgrade_step=0
    usb_burning=update 1000
    verifiedbootstate=orange
    wifi_ccode=US
    wifimac=c8:28:32:2b:0a:26
    wipe_cache=successful
    wipe_data=successful
    2
    successfully booted Armbian 5.34 on Mi Box S

    Armbian_5.34_S9xxx_Ubuntu_xenial_4.9.40_mate_20171112 from https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN/5.34 boots like charm.
    4XeFVKK.jpg


    Quick HOWTO:
    1. Download Armbian_5.34_S9xxx_Ubuntu_xenial_4.9.40_mate_20171112.img(or any other flavour) from https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN/5.34
      Unpack xz archive with 7zip(windows)/Keka(mac), Use Rufus(windows)/balenaEtcher(mac) or other img to deploy to any usb drive.
    2. Make sure you are connected to the box via usb serial interface(use putty.exe on windows/Serial.app on mac)
      baud rate 115200, data bits: 8, parity: none, stop bits: 1, flow control: none.
    3. After successful serial connection to the box, you can interrupt uboot(ctrl+c or space) and get a uboot shell. after that paste:
      Code:
      setenv bootcmd "run start_autoscript; run storeboot;"
      setenv start_autoscript "if usb start ; then run start_usb_autoscript; fi; if mmcinfo; then run start_mmc_autoscript; fi;"
      setenv start_mmc_autoscript "if fatload mmc 0 1020000 s905_autoscript; then autoscr 1020000; fi;"
      setenv start_usb_autoscript "if fatload usb 0 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 1 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 2 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 3 1020000 s905_autoscript; then autoscr 1020000; fi;"
      setenv upgrade_step "0"
      saveenv
    4. insert armbian usb that you created in step 1 and power-cycle the box. (you might need to use powered usb hub, my box did not power usb port, so usb flash drive was not working)
    5. you should be able to see armbian booting via HDMI on your TV/Monitor

    wifi is not working, but you should be able to use usb wifi or ethernet adapter.
    1
    would root and custom android tv be possible too?
    1
    would root and custom android tv be possible too?

    might be possible. All Android partitions are visible and mountable in linux. I guess you can't make changes to system partition, as android has protections in place that will revert previous system state, but I'm sure there are ways around it.
    1
    did a stupid thing, after Oreo update on my MiBox S MDZ 22 AB everything went down, wifi connection drops in every 10 seconds, so I used a version of android from a MDZ-16 on a stick and tried to flash on a tutorial found on the web. It started to flash for a few seconds and total brick!
    Now when I plug it, have no signal on hdmi, no led on front, nothing. (
    Can I restore the life in the box or no? Is it totally lost?

    Are there any test points for MDZ 22 AB?