您尚未登录。

页次： 1

分享链接 / 只看楼主

楼主 # 2021-08-04 19:35:38

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

仔细分析了瑞芯微的maskrom模式，跟全志的fel模式，基本类似，但又有不同，maskrom模式功能有限，除了加载ddr，另外一个重要的功能就是运行usbloader了，这个程序，扩展了usb口通讯功能，什么烧写FLASH，EFUSE, 序列号，读写DDR内存等都是载这里实现的。

经过几天的调研，觉得还是有必要开发一个裸奔工具，名叫xrock
https://github.com/xboot/xrock

当前支持的命令：

xrock(v1.0.0) - https://github.com/xboot/xrock
usage:
    xrock maskrom <ddr> <usbplug>        - Initial chip using ddr and usbplug in maskrom mode
    xrock version                        - Show chip version
    xrock reset [maskrom]                - Reset device to normal or maskrom mode
    xrock hexdump <address> <length>     - Dumps memory region in hex
    xrock dump <address> <length>        - Binary memory dump to stdout
    xrock read <address> <length> <file> - Read memory to file
    xrock write <address> <file>         - Write file to memory
    xrock exec <address>                 - Call function address

支持的芯片：

static struct chip_t chips[] = {
	{ 0x180a, "RK1808" },
	{ 0x281a, "RK2818" },
	{ 0x290a, "RK2918" },
	{ 0x292a, "RK2928" },
	{ 0x292c, "RK3026" },
	{ 0x300a, "RK3066" },
	{ 0x300b, "RK3168" },
	{ 0x301a, "RK3036" },
	{ 0x310a, "RK3066" },
	{ 0x310b, "RK3188" },
	{ 0x310c, "RK3128" },
	{ 0x320a, "RK3288" },
	{ 0x320b, "RK3228" },
	{ 0x320c, "RK3328" },
	{ 0x330a, "RK3368" },
	{ 0x330c, "RK3399" },
	{ 0x330d, "PX30" },
	{ 0x350a, "RK3568" },
};

RK1808

sudo xrock maskrom rk1808_ddr_933MHz_v1.05.bin rk1808_usbplug_v1.05.bin
sudo xrock version

RK3128

sudo xrock maskrom rk3128_ddr_300MHz_v2.12.bin rk3128_usbplug_v2.63.bin
sudo xrock version

RK3288

sudo xrock maskrom rk3288_ddr_400MHz_v1.09.bin rk3288_usbplug_v2.58.bin
sudo xrock version

RK3399

sudo xrock maskrom rk3399_ddr_800MHz_v1.25.bin rk3399_usbplug_v1.26.bin
sudo xrock version

RK3399PRO

sudo xrock maskrom rk3399pro_ddr_666MHz_v1.25.bin rk3399pro_usbplug_v1.26.bin
sudo xrock version

PX30

sudo xrock maskrom px30_ddr_333MHz_v1.16.bin px30_usbplug_v1.31.bin
sudo xrock version

离线

楼主 #1 2021-08-04 19:39:57

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xrock工具不仅linux可以运行，windows平台也是可以的，但不能采用瑞芯微官方提供的驱动，需要用winusb驱动，这个跟全志操作类似，需要用zadig来安装。

1，首先，移除默认驱动，直接点击驱动卸载就可以了
remove-rockchip-driver.png
2，安装winusb驱动，点击reinstall，注意选择0x2207这个UID
zadig.png

离线

楼主 #2 2021-08-04 19:43:44

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

一些截图，用xrock读写DRAM，在linux平台基本能达到25MB/S左右，比全志读写速度高不是一点点，windows平台弱了些，但也能达到5MB/S

1_20210804-1941.png
2_20210804-1941.png

这个windows版本的程序，欢迎体验。
xrock-windows-v1.0.0.7z

离线

楼主 #3 2021-08-04 19:55:47

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

这里有两个比较关键的注意点，芯片运行在maskrom模式时，其实只能干两件事，加载并运行ddr bin 以及usbloader bin，其他啥也干不了，所以第一步都是需要执行maskrom指令，注意loader模式，跟maskrom模式有较大差异，在这个模式时，是不能执行maskrom指令的。

还有一个，就是SDRAM内存读写地址，是从0开始的，不是传递实际物理地址空间，也就是说，关于地址空间的访问，瑞芯微限制了，只能访问SDRAM空间，其他地址是无法访问的，所以，读写寄存器之类的骚操作，就无能为力了。

离线

楼主 #4 2021-08-05 09:37:52

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

扩展一些命令，支持flash读写擦除操作。

xrock(v1.0.1) - https://github.com/xboot/xrock
usage:
    xrock maskrom <ddr> <usbplug>            - Initial chip using ddr and usbplug in maskrom mode
    xrock version                            - Show chip version
    xrock capability                         - Show capability information
    xrock reset [maskrom]                    - Reset device to normal or maskrom mode
    xrock hexdump <address> <length>         - Dumps memory region in hex
    xrock dump <address> <length>            - Binary memory dump to stdout
    xrock read <address> <length> <file>     - Read memory to file
    xrock write <address> <file>             - Write file to memory
    xrock exec <address>                     - Call function address
    xrock flash                              - Detect flash and show information
    xrock flash erase <sector> <count>       - Erase flash sector
    xrock flash read <sector> <count> <file> - Read flash sector to file
    xrock flash write <sector> <file>        - Write file to flash sector

离线

#5 2021-08-05 09:38:51

aozima
会员
所在地： 深圳
注册时间： 2019-05-25
已发帖子： 463
积分： 330.5
个人网站

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

请大佬收下我的膝盖！

离线

楼主 #6 2021-08-05 09:40:45

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

RK3128平台上Flash读写带宽测试

Flash读速度

$ ./xrock flash read 0 1000000 /dev/null
100% [================================================] 512.000 MB, 32.777 MB/s

Flash写速度

$ ./xrock flash write 0 ./256MB 
100% [================================================] 268.435 MB, 13.791 MB/s

离线

楼主 #7 2021-08-05 09:43:54

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

扩展了一些指令，输出信息如下：

$ ./xrock version
RK3128(312A): 0x33313241 0xdfffdfff 0xbf7377ff 0xabed2fcd

$ ./xrock capability
Capability: 27 00 00 00 00 00 00 00
    Direct LBA: enabled
    Vendor Storage: enabled
    First 4M Access: enabled
    Read LBA: disabled
    Read Com Log: enabled
    Read IDB Config: disabled
    Read Secure Mode: disabled
    New IDB: disabled

$ ./xrock flash
Flash Info:
    Manufacturer: Samsung (0)
    Flash Size: 7456MB
    Block Size: 512KB
    Page Size: 2KB
    ECC Bits: 0
    Access Time: 40
    Flash CS: <0>
    Flash ID: 45 4d 4d 43 20

离线

#8 2021-08-05 09:44:46

tigger
Moderator
注册时间： 2021-06-18
已发帖子： 172
积分： 111

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

@xboot
读写速度为什么那么猛？

离线

楼主 #9 2021-08-05 10:43:22

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

速度快，我觉得主要有三点吧

1，瑞芯微USB通讯效率较高，一个请求，一个响应，没有多余的操作
2，usbplug运行在DDR中，而且该开的MMU，cache什么的，都是开着的
3，EMMC本身就比较快，比起spi nor快多了。

离线

#10 2021-08-05 15:52:35

kakatoo
会员
注册时间： 2018-10-08
已发帖子： 88
积分： 65

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

@xboot
楼主牛逼.......期待瑞芯微系列可以裸奔....

离线

#11 2021-08-06 11:04:04

qianfan
会员
注册时间： 2019-11-29
已发帖子： 38
积分： 106.5

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

大佬, 搞个新唐的吧

离线

楼主 #12 2021-08-06 13:37:32

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

新塘官方烧录工具有啥痛点，
https://gitee.com/OpenNuvoton/NUC980_NuWriter_CMD
看这链接，比较齐全。

离线

#13 2021-08-06 16:09:45

qianfan
会员
注册时间： 2019-11-29
已发帖子： 38
积分： 106.5

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

新塘官方烧录工具有啥痛点，
https://gitee.com/OpenNuvoton/NUC980_NuWriter_CMD
看这链接，比较齐全。

痛点就是搞得太烂了.

离线

楼主 #14 2021-08-19 18:48:18

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

利用xrock烧写瑞芯微RK3128裸机镜像

编译源码，生成的目标文件在output目录下

make clean
make CROSS_COMPILE=/path/to/arm-none-linux-gnueabihf- PLATFORM=arm32-rk3128

进入maskrom模式，利用xrock烧写镜像

sudo xrock maskrom rk3128_ddr_300MHz_v2.12.bin rk3128_usbplug_v2.63.bin;
sleep 3;
sudo xrock flash write 64 xbootpak.bin;
sudo xrock reset;

离线

楼主 #15 2021-08-19 18:53:41

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

对于EMMC，瑞芯微的brom，上电后会去从第64个扇区开始搜索idb头，如果合法就会进行加载，所以为了能够裸奔，就需要对镜像进行处理，idb格式比起全志的要麻烦些，全志仅仅一个校验和，而rockchip需要4个idb头，每个idb头512字节，而且还需要用rc4加密下，具体密钥见mkidb源码。

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>

#define BLKSIZE		(512)

struct idblock0_t {
	uint32_t signature;
	uint8_t	 reserved0[4];
	uint32_t disable_rc4;
	uint16_t bootcode1_offset;
	uint16_t bootcode2_offset;
	uint8_t  reserved1[490];
	uint16_t flash_data_size;
	uint16_t flash_boot_size;
	uint8_t  reserved2[2];
};

struct idblock1_t {
	uint16_t sys_reserved_block;
	uint16_t disk0_size;
	uint16_t disk1_size;
	uint16_t disk2_size;
	uint16_t disk3_size;
	uint32_t chip_tag;
	uint32_t machine_id;
	uint16_t loader_year;
	uint16_t loader_date;
	uint16_t loader_ver;
	uint8_t  reserved0[72];
	uint16_t flash_data_offset;
	uint16_t flash_data_len;
	uint8_t  reserved1[384];
	uint32_t flash_chip_size;
	uint8_t  reserved2;
	uint8_t  access_time;
	uint16_t phy_block_size;
	uint8_t  phy_page_size;
	uint8_t  ecc_bits;

	uint8_t  reserved3[8];
	uint16_t id_block0;
	uint16_t id_block1;
	uint16_t id_block2;
	uint16_t id_block3;
	uint16_t id_block4;
};

struct idblock2_t {
	uint16_t chip_info_size;
	uint8_t chip_info[510];
};

struct idblock3_t {
	uint16_t sn_size;
	uint8_t  sn[30];
	uint8_t  mac_tag[3];
	uint8_t  mac_size;
	uint8_t  mac_addr[6];
	uint8_t  reserved0[468];
};

static void rc4(unsigned char * buf, int len)
{
	unsigned char S[256], K[256], temp;
	unsigned char key[16] = { 124, 78, 3, 4, 85, 5, 9, 7, 45, 44, 123, 56, 23, 13, 23, 17 };
	int i, j, t, x;

	j = 0;
	for(i = 0; i < 256; i++)
	{
		S[i] = (unsigned char) i;
		j &= 0x0f;
		K[i] = key[j];
		j++;
	}

	j = 0;
	for(i = 0; i < 256; i++)
	{
		j = (j + S[i] + K[i]) % 256;
		temp = S[i];
		S[i] = S[j];
		S[j] = temp;
	}

	i = j = 0;
	for(x = 0; x < len; x++)
	{
		i = (i + 1) % 256;
		j = (j + S[i]) % 256;
		temp = S[i];
		S[i] = S[j];
		S[j] = temp;
		t = (S[i] + (S[j] % 256)) % 256;
		buf[x] = buf[x] ^ S[t];
	}
}

int main(int argc, char *argv[])
{
	struct idblock0_t * idb0;
	struct idblock1_t * idb1;
	struct idblock2_t * idb2;
	struct idblock3_t * idb3;
	FILE * fp;
	char * buf;
	int buflen = 256 * 1024 * 1024;
	int dlen, blen;
	int dblk, bblk;
	int n, l;

	if(argc != 4)
	{
		printf("Usage: mkidb <ddr> <boot> <bootpak>\n");
		return -1;
	}

	buf = malloc(buflen);
	if(!buf)
	{
		printf("Malloc buffer error\n");
		return -1;
	}
	memset(buf, 0, buflen);

	/* ddr */
	fp = fopen(argv[1], "r+b");
	if(fp == NULL)
	{
		printf("Open ddr file error\n");
		free(buf);
		return -1;
	}
	fseek(fp, 0L, SEEK_END);
	dlen = ftell(fp);
	fseek(fp, 0L, SEEK_SET);
	n = fread(&buf[4 * BLKSIZE], 1, dlen, fp);
	if(n != dlen)
	{
		printf("Read file boot error\n");
		free(buf);
		fclose(fp);
		return -1;
	}
	fclose(fp);
	dblk = (dlen + BLKSIZE - 1) / BLKSIZE;
	dblk = (dblk + 3) & ~3;

	/* boot */
	fp = fopen(argv[2], "r+b");
	if(fp == NULL)
	{
		printf("Open boot file error\n");
		free(buf);
		return -1;
	}
	fseek(fp, 0L, SEEK_END);
	blen = ftell(fp);
	fseek(fp, 0L, SEEK_SET);
	n = fread(&buf[(4 + dblk) * BLKSIZE], 1, blen, fp);
	if(n != blen)
	{
		printf("Read boot file error\n");
		free(buf);
		fclose(fp);
		return -1;
	}
	fclose(fp);
	bblk = (blen + BLKSIZE - 1) / BLKSIZE;
	bblk = (bblk + 3) & ~3;

	/* idb0 */
	idb0 = (struct idblock0_t *)&buf[0 * BLKSIZE];
	idb0->signature = 0x0ff0aa55;
	idb0->disable_rc4 = 1;
	idb0->bootcode1_offset = 4;
	idb0->bootcode2_offset = 4;
	idb0->flash_data_size = dblk;
	idb0->flash_boot_size = dblk + bblk;
	rc4((unsigned char *)idb0, sizeof(struct idblock0_t));

	/* idb1 */
	idb1 = (struct idblock1_t *)&buf[1 * BLKSIZE];
	rc4((unsigned char *)idb1, sizeof(struct idblock1_t));

	/* idb2 */
	idb2 = (struct idblock2_t *)&buf[2 * BLKSIZE];
	rc4((unsigned char *)idb2, sizeof(struct idblock2_t));

	/* idb3 */
	idb3 = (struct idblock3_t *)&buf[3 * BLKSIZE];
	rc4((unsigned char *)idb3, sizeof(struct idblock3_t));

	/* idbloader */
	fp = fopen(argv[3], "w+b");
	if(fp == NULL)
	{
		printf("Open bootpak file error\n");
		free(buf);
		return -1;
	}
	l = (4 + dblk + bblk) * BLKSIZE;
	n = fwrite(buf, 1, l, fp);
	if(n != l)
	{
		printf("Write bootpak file error\n");
		free(buf);
		fclose(fp);
		return -1;
	}
	fclose(fp);
	free(buf);

	printf("Binary pack file -> %s\n", argv[3]);
	return 0;
}

https://gitee.com/xboot/xboot/blob/master/developments/rockchip/mkidb/mkidb.c

离线

楼主 #16 2021-08-19 18:54:53

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

RK3128启动log信息

DDR Version 2.12 20190926
In
ID:0xFFF
1A1A1B1B   3
DDR3
1B1B1B1B   F
Bus Width=32 Col=10 Bank=8 Row=15 CS=1 Die Bus-Width=16 Size=1024MB
mach:2
OUT
       _                   _                     
 _  _ | |___ _____ _____ _| |_                   
\ \/ /|  _  |  _  |  _  |_   _|  (C) 2007-2021   
 )  ( | |_| | |_| | |_| | | |____JIANJUN.JIANG__ 
/_/\_\|_____|_____|_____| |_____________________|
V3.0.0 (Aug 19 2021 - 18:37:50) - [x3128][X3128 Based On RK3128 SOC]
[    0.000000] Probe device 'blk-romdisk.0' with blk-romdisk
[    0.000010] Probe device 'usbphy480m' with clk-fixed
[    0.000020] Probe device 'xin24m' with clk-fixed
[    0.000030] Probe device 'xin32k' with clk-fixed
[    0.000040] Probe device 'apll' with clk-rk3128-pll
[    0.000050] Probe device 'dpll' with clk-rk3128-pll
[    0.000060] Probe device 'cpll' with clk-rk3128-pll
[    0.000070] Probe device 'gpll' with clk-rk3128-pll
[    0.000080] Probe device 'gpll-d2' with clk-fixed-factor
[    0.000090] Probe device 'gpll-d3' with clk-fixed-factor
[    0.000100] Probe device 'mux-cpu-aclk' with clk-rk3128-mux
[    0.000110] Probe device 'cpu-aclk' with clk-rk3128-divider
[    0.000120] Probe device 'cpu-hclk' with clk-rk3128-divider
[    0.000130] Probe device 'cpu-pclk' with clk-rk3128-divider
[    0.000140] Probe device 'mux-periph-aclk' with clk-rk3128-mux
[    0.000150] Probe device 'periph-aclk' with clk-rk3128-divider
[    0.000160] Probe device 'periph-hclk' with clk-rk3128-ratio
[    0.000170] Probe device 'periph-pclk' with clk-rk3128-ratio
[    0.000180] Probe device 'mux-dclk-lcd' with clk-rk3128-mux
[    0.000190] Probe device 'gate-dclk-lcd' with clk-rk3128-gate
[    0.000200] Probe device 'div-dclk-lcd' with clk-rk3128-divider
[    0.000210] Probe device 'link-dclk-lcd' with clk-link
[    0.000220] Probe device 'mux-sclk-lcd' with clk-rk3128-mux
[    0.000230] Probe device 'gate-sclk-lcd' with clk-rk3128-gate
[    0.000240] Probe device 'div-sclk-lcd' with clk-rk3128-divider
[    0.000250] Probe device 'link-sclk-lcd' with clk-link
[    0.000260] Probe device 'gate-timer0' with clk-rk3128-gate
[    0.000270] Probe device 'gate-timer1' with clk-rk3128-gate
[    0.000280] Probe device 'gate-timer2' with clk-rk3128-gate
[    0.000290] Probe device 'gate-timer3' with clk-rk3128-gate
[    0.000300] Probe device 'gate-timer4' with clk-rk3128-gate
[    0.000310] Probe device 'gate-timer5' with clk-rk3128-gate
[    0.000320] Probe device 'link-timer0' with clk-link
[    0.000330] Probe device 'link-timer1' with clk-link
[    0.000340] Probe device 'link-timer2' with clk-link
[    0.000350] Probe device 'link-timer3' with clk-link
[    0.000360] Probe device 'link-timer4' with clk-link
[    0.000370] Probe device 'link-timer5' with clk-link
[    0.000380] Probe device 'gate-i2c0' with clk-rk3128-gate
[    0.000390] Probe device 'gate-i2c1' with clk-rk3128-gate
[    0.000400] Probe device 'gate-i2c2' with clk-rk3128-gate
[    0.000410] Probe device 'gate-i2c3' with clk-rk3128-gate
[    0.000420] Probe device 'link-i2c0' with clk-link
[    0.000430] Probe device 'link-i2c1' with clk-link
[    0.000440] Probe device 'link-i2c2' with clk-link
[    0.000450] Probe device 'link-i2c3' with clk-link
[    0.000460] Probe device 'gate-pwm' with clk-rk3128-gate
[    0.000470] Probe device 'link-pwm0' with clk-link
[    0.000480] Probe device 'link-pwm1' with clk-link
[    0.000490] Probe device 'link-pwm2' with clk-link
[    0.000500] Probe device 'link-pwm3' with clk-link
[    0.000510] Probe device 'gate-wdt' with clk-rk3128-gate
[    0.000520] Probe device 'link-wdt' with clk-link
[    0.000530] Probe device 'gate-saradc' with clk-rk3128-gate
[    0.000540] Probe device 'div-saradc' with clk-rk3128-divider
[    0.000550] Probe device 'link-saradc' with clk-link
[    0.000560] Probe device 'mux-spi-src' with clk-rk3128-mux
[    0.000570] Probe device 'gate-spi-src' with clk-rk3128-gate
[    0.000580] Probe device 'div-spi-src' with clk-rk3128-divider
[    0.000590] Probe device 'gate-spi' with clk-rk3128-gate
[    0.000600] Probe device 'link-spi' with clk-link
[    0.000610] Probe device 'mux-emmc-src' with clk-rk3128-mux
[    0.000620] Probe device 'gate-emmc-src' with clk-rk3128-gate
[    0.000630] Probe device 'div-emmc-src' with clk-rk3128-divider
[    0.000640] Probe device 'gate-emmc' with clk-rk3128-gate
[    0.000650] Probe device 'link-emmc' with clk-link
[    0.000660] Probe device 'mux-sdmmc-src' with clk-rk3128-mux
[    0.000670] Probe device 'gate-sdmmc-src' with clk-rk3128-gate
[    0.000680] Probe device 'div-sdmmc-src' with clk-rk3128-divider
[    0.000690] Probe device 'gate-sdmmc' with clk-rk3128-gate
[    0.000700] Probe device 'link-sdmmc' with clk-link
[    0.000710] Probe device 'mux-sdio-src' with clk-rk3128-mux
[    0.000720] Probe device 'gate-sdio-src' with clk-rk3128-gate
[    0.000730] Probe device 'div-sdio-src' with clk-rk3128-divider
[    0.000740] Probe device 'gate-sdio' with clk-rk3128-gate
[    0.000750] Probe device 'link-sdio' with clk-link
[    0.000760] Probe device 'mux-uart0-src' with clk-rk3128-mux
[    0.000770] Probe device 'gate-uart0-src' with clk-rk3128-gate
[    0.000780] Probe device 'div-uart0-src' with clk-rk3128-divider
[    0.000790] Probe device 'gate-uart0-frac' with clk-rk3128-gate
[    0.000800] Probe device 'factor-uart0-frac' with clk-rk3128-factor
[    0.000810] Probe device 'mux-uart0' with clk-rk3128-mux
[    0.000820] Probe device 'link-uart0' with clk-link
[    0.000830] Probe device 'mux-uart12-src' with clk-rk3128-mux
[    0.000840] Probe device 'gate-uart1-src' with clk-rk3128-gate
[    0.000850] Probe device 'gate-uart2-src' with clk-rk3128-gate
[    0.000860] Probe device 'div-uart1-src' with clk-rk3128-divider
[    0.000870] Probe device 'div-uart2-src' with clk-rk3128-divider
[    0.000880] Probe device 'gate-uart1-frac' with clk-rk3128-gate
[    0.000890] Probe device 'gate-uart2-frac' with clk-rk3128-gate
[    0.000900] Probe device 'factor-uart1-frac' with clk-rk3128-factor
[    0.000910] Probe device 'factor-uart2-frac' with clk-rk3128-factor
[    0.000920] Probe device 'mux-uart1' with clk-rk3128-mux
[    0.000930] Probe device 'mux-uart2' with clk-rk3128-mux
[    0.000940] Probe device 'link-uart1' with clk-link
[    0.000950] Probe device 'link-uart2' with clk-link
[    0.000960] Probe device 'reset-rk3128.0' with reset-rk3128
[    0.000970] Probe device 'reset-rk3128.1' with reset-rk3128
[    0.000980] Probe device 'reset-rk3128.2' with reset-rk3128
[    0.000990] Probe device 'reset-rk3128.3' with reset-rk3128
[    0.001000] Probe device 'reset-rk3128.4' with reset-rk3128
[    0.001010] Probe device 'reset-rk3128.5' with reset-rk3128
[    0.001020] Probe device 'reset-rk3128.6' with reset-rk3128
[    0.001030] Probe device 'reset-rk3128.7' with reset-rk3128
[    0.001040] Probe device 'reset-rk3128.8' with reset-rk3128
[    0.001050] Probe device 'irq-gic400.0' with irq-gic400
[    0.001060] Probe device 'irq-rk3128-gpio.0' with irq-rk3128-gpio
[    0.001070] Probe device 'irq-rk3128-gpio.1' with irq-rk3128-gpio
[    0.001080] Probe device 'irq-rk3128-gpio.2' with irq-rk3128-gpio
[    0.001090] Probe device 'irq-rk3128-gpio.3' with irq-rk3128-gpio
[    0.001100] Probe device 'gpio-rk3128.0' with gpio-rk3128
[    0.001110] Probe device 'gpio-rk3128.1' with gpio-rk3128
[    0.001120] Probe device 'gpio-rk3128.2' with gpio-rk3128
[    0.001130] Probe device 'gpio-rk3128.3' with gpio-rk3128
[    0.001140] Probe device 'pwm-rk3128.0' with pwm-rk3128
[    0.001150] Probe device 'pwm-rk3128.1' with pwm-rk3128
[    0.001160] Probe device 'pwm-rk3128.2' with pwm-rk3128
[    0.001170] Probe device 'pwm-rk3128.3' with pwm-rk3128
[    0.001180] Probe device 'adc-rk3128.0' with adc-rk3128
[    0.001190] Probe device 'ce-rockchip-timer.0' with ce-rockchip-timer
[    0.000025] Probe device 'cs-rockchip-timer.0' with cs-rockchip-timer
[    0.006435] Probe device 'uart-8250.0' with uart-8250
[    0.011456] Probe devi+$HHߐ.016483] Probe device 'uart-8250.2' with uart-8250
[    0.018702] Probe device 'i2c-rk3128.0' with i2c-rk3128
[    0.023899] Probe device 'i2c-rk3128.1' with i2c-rk3128
[    0.029102] Probe device 'i2c-rk3128.2' with i2c-rk3128
[    0.034302] Probe device 'i2c-rk3128.3' with i2c-rk3128
[    0.039499] Probe device 'spi-gpio.0' with spi-gpio
[    0.044465] Probe device 'dcdc1' with regulator-rk816
[    0.049485] Probe device 'dcdc2' with regulator-rk816
[    0.054511] Probe device 'dcdc3' with regulator-rk816
[    0.059538] Probe device 'dcdc4' with regulator-rk816
[    0.064564] Probe device 'ldo1' with regulator-rk816
[    0.069505] Probe device 'ldo2' with regulator-rk816
[    0.074445] Probe device 'ldo3' with regulator-rk816
[    0.079542] Probe device 'ldo4' with regulator-rk816
[    0.084324] Probe device 'ldo5' with regulator-rk816
[    0.089419] Probe device 'ldo6' with regulator-rk816
[    0.094096] Probe device 'lcd-power-5v' with regulator-gpio
[    0.301310] Probe device 'sdhci-spi.0' with sdhci-spi
[    0.305032] Probe device 'rtc-rk816.0' with rtc-rk816
[    0.308548] Probe device 'wdg-rk3128.0' with wdg-rk3128
[    0.313766] Fail to probe device with gmeter-mma8452
[    0.319261] Probe device 'key-rk816.0' with key-rk816
[    0.323716] Probe device 'key-adc.0' with key-adc
[    0.328416] Probe device 'rc-gpio.0' with rc-gpio
[    0.333073] Probe device 'led-gpio.0' with led-gpio
[    0.337921] Probe device 'led-gpio.1' with led-gpio
[    0.342775] Probe device 'led-gpio.2' with led-gpio
[    0.347628] Probe device 'led-gpio.3' with led-gpio
[    0.352486] Probe device 'ledtrigger-heartbeat.0' with ledtrigger-heartbeat
[    0.359424] Probe device 'led-pwm-bl.0' with led-pwm-bl
[    0.364621] Probe device 'buzzer-gpio.0' with buzzer-gpio
[    0.369992] Probe device 'buzzer-pwm.0' with buzzer-pwm
[    0.375194] Probe device 'vibrator-pwm.0' with vibrator-pwm
[    0.380812] Probe device 'fb-rk3128.0' with fb-rk3128
[    0.385760] Probe device 'console-uart.0' with console-uart
[    0.392008] mount /private with 'ram' filesystem
Press any key to stop auto boot:  0.690

离线

楼主 #17 2021-08-19 22:12:34

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

补充点RK3128 DDR程序rk3128_ddr_300MHz_v2.12.bin 相关逆向信息，
DDR.bin链接地址为0x20008000，文件偏移4个字节，其头会包含一个RK31标识，这个DDR程序执行完后，还会回到brom代码。但rk3128_usbplug_v2.63执行后，就不会回到brom空间了。

离线

楼主 #18 2021-08-19 22:51:42

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

贴一个bootrom的流程图，方便大家理解
1_20210819-2251.png

离线

楼主 #19 2021-08-20 11:41:14

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

利用xrock烧写瑞芯微RK3228裸机镜像

编译源码，生成的目标文件在output目录下

make clean
make CROSS_COMPILE=/path/to/arm-none-linux-gnueabihf- PLATFORM=arm32-rk3288

进入maskrom模式，利用xrock烧写镜像

sudo xrock maskrom rk3288_ddr_400MHz_v1.09.bin rk3288_usbplug_v2.58.bin;
sleep 3;
sudo xrock flash write 64 xbootpak.bin;
sudo xrock reset;

RK3288启动log信息

DDR Version 1.09 20201119
In
SRX
Channel a: DDR3 400MHz
Bus Width=32 Col=10 Bank=8 Row=15 CS=1 Die Bus-Width=16 Size=1024MB
Channel b: DDR3 400MHz
Bus Width=32 Col=10 Bank=8 Row=15 CS=1 Die Bus-Width=16 Size=1024MB
OUT
       _                   _                     
 _  _ | |___ _____ _____ _| |_                   
\ \/ /|  _  |  _  |  _  |_   _|  (C) 2007-2021   
 )  ( | |_| | |_| | |_| | | |____JIANJUN.JIANG__ 
/_/\_\|_____|_____|_____| |_____________________|
V3.0.0 (Aug 20 2021 - 11:34:50) - [x3288][X3288 Based On RK3288 SOC]
[    0.000000] Probe device 'blk-romdisk.0' with blk-romdisk
[    0.000010] Probe device 'usbphy480m' with clk-fixed
[    0.000020] Probe device 'xin24m' with clk-fixed
[    0.000030] Probe device 'xin32k' with clk-fixed
[    0.000040] Probe device 'apll' with clk-rk3288-pll
[    0.000050] Probe device 'dpll' with clk-rk3288-pll
[    0.000060] Probe device 'cpll' with clk-rk3288-pll
[    0.000070] Probe device 'gpll' with clk-rk3288-pll
[    0.000080] Probe device 'npll' with clk-rk3288-pll
[    0.000090] Probe device 'gate-gpll' with clk-rk3288-gate
[    0.000100] Probe device 'gate-cpll' with clk-rk3288-gate
[    0.000110] Probe device 'mux-pd-bus-src' with clk-rk3288-mux
[    0.000120] Probe device 'div-pd-bus-src' with clk-rk3288-divider
[    0.000130] Probe device 'div-pd-bus' with clk-rk3288-divider
[    0.000140] Probe device 'gate-aclk-bus' with clk-rk3288-gate
[    0.000150] Probe device 'aclk-bus-pre' with clk-link
[    0.000160] Probe device 'gate-cpu-pclk' with clk-rk3288-gate
[    0.000170] Probe device 'div-cpu-pclk' with clk-rk3288-divider
[    0.000180] Probe device 'pclk-bus-pre' with clk-link
[    0.000190] Probe device 'gate-cpu-hclk' with clk-rk3288-gate
[    0.000200] Probe device 'div-cpu-hclk' with clk-rk3288-divider
[    0.000210] Probe device 'hclk-bus-pre' with clk-link
[    0.000220] Probe device 'div-pclk-pd-alive' with clk-rk3288-divider
[    0.000230] Probe device 'pclk-pd-alive' with clk-link
[    0.000240] Probe device 'gate-pclk-pd-pmu' with clk-rk3288-gate
[    0.000250] Probe device 'div-pclk-pd-pmu' with clk-rk3288-divider
[    0.000260] Probe device 'pclk-pd-pmu' with clk-link
[    0.000270] Probe device 'mux-clk-peri' with clk-rk3288-mux
[    0.000280] Probe device 'gate-clk-peri' with clk-rk3288-gate
[    0.000290] Probe device 'div-clk-peri' with clk-rk3288-divider
[    0.000300] Probe device 'ratio-pclk-peri' with clk-rk3288-ratio
[    0.000310] Probe device 'gate-pclk-peri-pre' with clk-rk3288-gate
[    0.000320] Probe device 'pclk-peri-pre' with clk-link
[    0.000330] Probe device 'ratio-hclk-peri' with clk-rk3288-ratio
[    0.000340] Probe device 'gate-hclk-peri-pre' with clk-rk3288-gate
[    0.000350] Probe device 'hclk-peri-pre' with clk-link
[    0.000360] Probe device 'gate-aclk-peri-pre' with clk-rk3288-gate
[    0.000370] Probe device 'aclk-peri-pre' with clk-link
[    0.000380] Probe device 'mux-aclk-vio0' with clk-rk3288-mux
[    0.000390] Probe device 'gate-aclk-vio0' with clk-rk3288-gate
[    0.000400] Probe device 'div-aclk-vio0' with clk-rk3288-divider
[    0.000410] Probe device 'aclk-vio0-pre' with clk-link
[    0.000420] Probe device 'div-hclk-vio' with clk-rk3288-divider
[    0.000430] Probe device 'hclk-vio-pre' with clk-link
[    0.000440] Probe device 'mux-aclk-vio1' with clk-rk3288-mux
[    0.000450] Probe device 'gate-aclk-vio1' with clk-rk3288-gate
[    0.000460] Probe device 'div-aclk-vio1' with clk-rk3288-divider
[    0.000470] Probe device 'aclk-vio1-pre' with clk-link
[    0.000480] Probe device 'mux-aclk-rga' with clk-rk3288-mux
[    0.000490] Probe device 'gate-aclk-rga' with clk-rk3288-gate
[    0.000500] Probe device 'div-aclk-rga' with clk-rk3288-divider
[    0.000510] Probe device 'aclk-rga-pre' with clk-link
[    0.000520] Probe device 'mux-clk-rga' with clk-rk3288-mux
[    0.000530] Probe device 'gate-clk-rga' with clk-rk3288-gate
[    0.000540] Probe device 'div-clk-rga' with clk-rk3288-divider
[    0.000550] Probe device 'clk-rga' with clk-link
[    0.000560] Probe device 'gate-pclk-rkpwm' with clk-rk3288-gate
[    0.000570] Probe device 'link-pclk-rkpwm' with clk-link
[    0.000580] Probe device 'gate-timer0' with clk-rk3288-gate
[    0.000590] Probe device 'gate-timer1' with clk-rk3288-gate
[    0.000600] Probe device 'gate-timer2' with clk-rk3288-gate
[    0.000610] Probe device 'gate-timer3' with clk-rk3288-gate
[    0.000620] Probe device 'gate-timer4' with clk-rk3288-gate
[    0.000630] Probe device 'gate-timer5' with clk-rk3288-gate
[    0.000640] Probe device 'link-timer0' with clk-link
[    0.000650] Probe device 'link-timer1' with clk-link
[    0.000660] Probe device 'link-timer2' with clk-link
[    0.000670] Probe device 'link-timer3' with clk-link
[    0.000680] Probe device 'link-timer4' with clk-link
[    0.000690] Probe device 'link-timer5' with clk-link
[    0.000700] Probe device 'gate-saradc' with clk-rk3288-gate
[    0.000710] Probe device 'div-saradc' with clk-rk3288-divider
[    0.000720] Probe device 'gate-pclk-saradc' with clk-rk3288-gate
[    0.000730] Probe device 'link-pclk-saradc' with clk-link
[    0.000740] Probe device 'mux-uart0-src' with clk-rk3288-mux
[    0.000750] Probe device 'gate-uart0-src' with clk-rk3288-gate
[    0.000760] Probe device 'div-uart0-src' with clk-rk3288-divider
[    0.000770] Probe device 'gate-uart0-frac' with clk-rk3288-gate
[    0.000780] Probe device 'factor-uart0-frac' with clk-rk3288-factor
[    0.000790] Probe device 'mux-uart0' with clk-rk3288-mux
[    0.000800] Probe device 'link-uart0' with clk-link
[    0.000810] Probe device 'mux-uart1234-src' with clk-rk3288-mux
[    0.000820] Probe device 'gate-uart1-src' with clk-rk3288-gate
[    0.000830] Probe device 'div-uart1-src' with clk-rk3288-divider
[    0.000840] Probe device 'gate-uart1-frac' with clk-rk3288-gate
[    0.000850] Probe device 'factor-uart1-frac' with clk-rk3288-factor
[    0.000860] Probe device 'mux-uart1' with clk-rk3288-mux
[    0.000870] Probe device 'link-uart1' with clk-link
[    0.000880] Probe device 'gate-uart2-src' with clk-rk3288-gate
[    0.000890] Probe device 'div-uart2-src' with clk-rk3288-divider
[    0.000900] Probe device 'gate-uart2-frac' with clk-rk3288-gate
[    0.000910] Probe device 'factor-uart2-frac' with clk-rk3288-factor
[    0.000920] Probe device 'mux-uart2' with clk-rk3288-mux
[    0.000930] Probe device 'link-uart2' with clk-link
[    0.000940] Probe device 'gate-uart3-src' with clk-rk3288-gate
[    0.000950] Probe device 'div-uart3-src' with clk-rk3288-divider
[    0.000960] Probe device 'gate-uart3-frac' with clk-rk3288-gate
[    0.000970] Probe device 'factor-uart3-frac' with clk-rk3288-factor
[    0.000980] Probe device 'mux-uart3' with clk-rk3288-mux
[    0.000990] Probe device 'link-uart3' with clk-link
[    0.001000] Probe device 'gate-uart4-src' with clk-rk3288-gate
[    0.001010] Probe device 'div-uart4-src' with clk-rk3288-divider
[    0.001020] Probe device 'gate-uart4-frac' with clk-rk3288-gate
[    0.001030] Probe device 'factor-uart4-frac' with clk-rk3288-factor
[    0.001040] Probe device 'mux-uart4' with clk-rk3288-mux
[    0.001050] Probe device 'link-uart4' with clk-link
[    0.001060] Probe device 'gate-pclk-i2c0' with clk-rk3288-gate
[    0.001070] Probe device 'gate-pclk-i2c1' with clk-rk3288-gate
[    0.001080] Probe device 'gate-pclk-i2c2' with clk-rk3288-gate
[    0.001090] Probe device 'gate-pclk-i2c3' with clk-rk3288-gate
[    0.001100] Probe device 'gate-pclk-i2c4' with clk-rk3288-gate
[    0.001110] Probe device 'gate-pclk-i2c5' with clk-rk3288-gate
[    0.001120] Probe device 'link-pclk-i2c0' with clk-link
[    0.001130] Probe device 'link-pclk-i2c1' with clk-link
[    0.001140] Probe device 'link-pclk-i2c2' with clk-link
[    0.001150] Probe device 'link-pclk-i2c3' with clk-link
[    0.001160] Probe device 'link-pclk-i2c4' with clk-link
[    0.001170] Probe device 'link-pclk-i2c5' with clk-link
[    0.001180] Probe device 'mux-spi0' with clk-rk3288-mux
[    0.001190] Probe device 'gate-spi0' with clk-rk3288-gate
[    0.001200] Probe device 'div-spi0' with clk-rk3288-divider
[    0.001210] Probe device 'link-spi0' with clk-link
[    0.001220] Probe device 'mux-spi1' with clk-rk3288-mux
[    0.001230] Probe device 'gate-spi1' with clk-rk3288-gate
[    0.001240] Probe device 'div-spi1' with clk-rk3288-divider
[    0.001250] Probe device 'link-spi1' with clk-link
[    0.001260] Probe device 'mux-spi2' with clk-rk3288-mux
[    0.001270] Probe device 'gate-spi2' with clk-rk3288-gate
[    0.001280] Probe device 'div-spi2' with clk-rk3288-divider
[    0.001290] Probe device 'link-spi2' with clk-link
[    0.001300] Probe device 'mux-dclk-vop0' with clk-rk3288-mux
[    0.001310] Probe device 'gate-dclk-vop0' with clk-rk3288-gate
[    0.001320] Probe device 'div-dclk-vop0' with clk-rk3288-divider
[    0.001330] Probe device 'dclk-vop0' with clk-link
[    0.001340] Probe device 'mux-dclk-vop1' with clk-rk3288-mux
[    0.001350] Probe device 'gate-dclk-vop1' with clk-rk3288-gate
[    0.001360] Probe device 'div-dclk-vop1' with clk-rk3288-divider
[    0.001370] Probe device 'dclk-vop1' with clk-link
[    0.001380] Probe device 'gate-aclk-vop0' with clk-rk3288-gate
[    0.001390] Probe device 'link-aclk-vop0' with clk-link
[    0.001400] Probe device 'gate-hclk-vop0' with clk-rk3288-gate
[    0.001410] Probe device 'link-hclk-vop0' with clk-link
[    0.001420] Probe device 'gate-aclk-vop1' with clk-rk3288-gate
[    0.001430] Probe device 'link-aclk-vop1' with clk-link
[    0.001440] Probe device 'gate-hclk-vop1' with clk-rk3288-gate
[    0.001450] Probe device 'link-hclk-vop1' with clk-link
[    0.001460] Probe device 'reset-rk3288.0' with reset-rk3288
[    0.001470] Probe device 'reset-rk3288.1' with reset-rk3288
[    0.001480] Probe device 'reset-rk3288.2' with reset-rk3288
[    0.001490] Probe device 'reset-rk3288.3' with reset-rk3288
[    0.001500] Probe device 'reset-rk3288.4' with reset-rk3288
[    0.001510] Probe device 'reset-rk3288.5' with reset-rk3288
[    0.001520] Probe device 'reset-rk3288.6' with reset-rk3288
[    0.001530] Probe device 'reset-rk3288.7' with reset-rk3288
[    0.001540] Probe device 'reset-rk3288.8' with reset-rk3288
[    0.001550] Probe device 'reset-rk3288.9' with reset-rk3288
[    0.001560] Probe device 'reset-rk3288.10' with reset-rk3288
[    0.001570] Probe device 'reset-rk3288.11' with reset-rk3288
[    0.001580] Probe device 'irq-gic400.0' with irq-gic400
[    0.001590] Probe device 'irq-rk3288-gpio.0' with irq-rk3288-gpio
[    0.001600] Probe device 'irq-rk3288-gpio.1' with irq-rk3288-gpio
[    0.001610] Probe device 'irq-rk3288-gpio.2' with irq-rk3288-gpio
[    0.001620] Probe device 'irq-rk3288-gpio.3' with irq-rk3288-gpio
[    0.001630] Probe device 'irq-rk3288-gpio.4' with irq-rk3288-gpio
[    0.001640] Probe device 'irq-rk3288-gpio.5' with irq-rk3288-gpio
[    0.001650] Probe device 'irq-rk3288-gpio.6' with irq-rk3288-gpio
[    0.001660] Probe device 'irq-rk3288-gpio.7' with irq-rk3288-gpio
[    0.001670] Probe device 'irq-rk3288-gpio.8' with irq-rk3288-gpio
[    0.001680] Probe device 'gpio-rk3288.0' with gpio-rk3288
[    0.001690] Probe device 'gpio-rk3288.1' with gpio-rk3288
[    0.001700] Probe device 'gpio-rk3288.2' with gpio-rk3288
[    0.001710] Probe device 'gpio-rk3288.3' with gpio-rk3288
[    0.001720] Probe device 'gpio-rk3288.4' with gpio-rk3288
[    0.001730] Probe device 'gpio-rk3288.5' with gpio-rk3288
[    0.001740] Probe device 'gpio-rk3288.6' with gpio-rk3288
[    0.001750] Probe device 'gpio-rk3288.7' with gpio-rk3288
[    0.001760] Probe device 'gpio-rk3288.8' with gpio-rk3288
[    0.001770] Probe device 'pwm-rk3288.0' with pwm-rk3288
[    0.001780] Probe device 'pwm-rk3288.1' with pwm-rk3288
[    0.001790] Probe device 'pwm-rk3288.2' with pwm-rk3288
[    0.001800] Probe device 'pwm-rk3288.3' with pwm-rk3288
[    0.001810] Probe device 'adc-rk3288.0' with adc-rk3288
[    0.001820] Probe device 'ce-rockchip-timer.0' with ce-rockchip-timer
[    0.000285] Probe device 'cs-rockchip-timer.0' with cs-rockchip-timer
[    0.006686] Probe device 'uart-8250.0' with uart-82[    0.016752] Probe device 'uart-8250.2' with uart-8250
[    0.017370] Probe device 'uart-8250.3' with uart-8250
[    0.021773] Probe device 'uart-8250.4' with uart-8250
[    0.026764] Probe device 'i2c-rk3288.0' with i2c-rk3288
[    0.031968] Probe device 'i2c-rk3288.1' with i2c-rk3288
[    0.037189] Probe device 'i2c-rk3288.2' with i2c-rk3288
[    0.042393] Probe device 'i2c-rk3288.3' with i2c-rk3288
[    0.047623] Probe device 'i2c-rk3288.4' with i2c-rk3288
[    0.052847] Probe device 'i2c-rk3288.5' with i2c-rk3288
[    0.057863] Probe device 'spi-rk3288.0' with spi-rk3288
[    0.063067] Probe device 'spi-rk3288.1' with spi-rk3288
[    0.068295] Probe device 'spi-rk3288.2' with spi-rk3288
[    0.073537] Probe device 'dc1' with regulator-act8846
[    0.078536] Probe device 'dc2' with regulator-act8846
[    0.083559] Probe device 'dc3' with regulator-act8846
[    0.088583] Probe device 'dc4' with regulator-act8846
[    0.093621] Probe device 'ldo1' with regulator-act8846
[    0.098736] Probe device 'ldo2' with regulator-act8846
[    0.103845] Probe device 'ldo3' with regulator-act8846
[    0.108964] Probe device 'ldo4' with regulator-act8846
[    0.114074] Probe device 'ldo5' with regulator-act8846
[    0.119192] Probe device 'ldo6' with regulator-act8846
[    0.124301] Probe device 'ldo7' with regulator-act8846
[    0.129419] Probe device 'ldo8' with regulator-act8846
[    0.134771] Probe device 'syr827-cpu' with regulator-syr82x
[    0.140321] Probe device 'syr828-gpu' with regulator-syr82x
[    0.145553] Probe device 'lcd-bl-power' with regulator-gpio
[    0.151067] Probe device 'key-adc.0' with key-adc
[    0.155980] Probe device 'rc-gpio.0' with rc-gpio
[    0.260200] Fail to probe device with ts-gslx680
[    0.260278] Probe device 'led-gpio.0' with led-gpio
[    0.264056] Probe device 'ledtrigger-heartbeat.0' with ledtrigger-heartbeat
[    0.271001] Probe device 'led-pwm-bl.0' with led-pwm-bl
[    0.276191] Probe device 'buzzer-gpio.0' with buzzer-gpio
[    0.281572] Probe device 'wdg-rk3288.0' with wdg-rk3288
[    0.288390] Probe device 'fb-rk3288.0' with fb-rk3288
[    0.291786] Probe device 'console-uart.0' with console-uart
[    0.299180] mount /private with 'ram' filesystem
Press any key to stop auto boot:  0.000
xboot: /#

离线

#20 2021-08-23 12:54:09

kakatoo
会员
注册时间： 2018-10-08
已发帖子： 88
积分： 65

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

@Xboot RK3228,  RK3128...... 都好老的芯片啊。 tongue

离线

楼主 #21 2021-08-23 13:49:16

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

是的，rockchip的新芯片没人去玩裸机

离线

#22 2021-08-23 14:21:24

kakatoo
会员
注册时间： 2018-10-08
已发帖子： 88
积分： 65

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

是的，rockchip的新芯片没人去玩裸机

先有鸡还是先有蛋的问题哈 tongue  ，   PX30    RK3568 的裸机需求 还是挺多啊，只是大家搞不定 wink

离线

楼主 #23 2021-08-24 09:11:28

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

这种级别的芯片玩裸机，意义也没那么大了，复杂芯片只有一个唯一的出路，上linux，别无他法。

离线

#24 2021-09-23 09:39:12

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

maskrom能烧录uboot，image，rootfs到SD卡，然后从SD卡启动Linux系统吗？

离线

#25 2021-09-23 10:16:55

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

贴一个bootrom的流程图，方便大家理解
https://whycan.com/files/members/2137/1_20210819-2251.png

看来要从SD卡启动Linux得把nand flash clean！至于通过USB下载image到SD卡，得把nand彻底拆了!

离线

#26 2021-09-23 10:20:07

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

能悄咪咪的开个车车吗，我想捡点垃圾玩玩。

离线

#27 2021-09-24 14:02:40

feibob
会员
注册时间： 2021-09-24
已发帖子： 6
积分： 3

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

强得不是一点半点啊：（

有了这工具，能在Linux下刷RK了吧：）

离线

#28 2021-09-24 15:49:12

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

feibob 说：

强得不是一点半点啊：（

有了这工具，能在Linux下刷RK了吧：）

Ubuntu 不识别maskrom模式的USB设备！不知道这个驱动怎么安装到Ubuntu的。

离线

楼主 #29 2021-09-24 19:51:54

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

ubuntu 无需安装任何驱动，lsusb能认到设备就可以访问，最多加个sudo 权限

离线

#30 2021-09-25 10:45:17

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

ubuntu 无需安装任何驱动，lsusb能认到设备就可以访问，最多加个sudo 权限

我的Ubuntu 18.04，64位不识别maskrom/loader模式 USB，没装xrock，仅仅用瑞星微的Linux_upgrade_ tool，板子正常启动后有个rkxxx设备，adb可用。感觉瑞星微有自己的骚操作，uboot下不能操作flash，只能用它自己的Windows上位机加驱动操作芯片操作外设。

离线

楼主 #31 2021-09-25 11:37:26

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

uboot里有loader模式 ，敲rockusb就可以进入loader，进入loader后，就可以用xrock读写flash了

离线

楼主 #32 2021-09-25 11:41:04

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

Linux_upgrade_ tool，也是基于loader模式来操作，支持的指令也是类似的。只不过Linux_upgrade_ tool可以直接刷完整包。
这是loader模式支持的一些指令

enum {
	OPCODE_TEST_UNIT_READY	= 0x00,
	OPCODE_READ_FLASH_ID	= 0x01,
	OPCODE_TEST_BAD_BLOCK	= 0x03,
	OPCODE_READ_SECTOR		= 0x04,
	OPCODE_WRITE_SECTOR		= 0x05,
	OPCODE_ERASE_NORMAL		= 0x06,
	OPCODE_ERASE_FORCE		= 0x0b,
	OPCODE_READ_LBA			= 0x14,
	OPCODE_WRITE_LBA		= 0x15,
	OPCODE_ERASE_SYSTEM		= 0x16,
	OPCODE_READ_SDRAM		= 0x17,
	OPCODE_WRITE_SDRAM		= 0x18,
	OPCODE_EXEC_SDRAM		= 0x19,
	OPCODE_READ_FLASH_INFO	= 0x1a,
	OPCODE_READ_CHIP_INFO	= 0x1b,
	OPCODE_SET_RESET_FLAG	= 0x1e,
	OPCODE_WRITE_EFUSE		= 0x1f,
	OPCODE_READ_EFUSE		= 0x20,
	OPCODE_READ_SPI_FLASH	= 0x21,
	OPCODE_WRITE_SPI_FLASH	= 0x22,
	OPCODE_WRITE_NEW_EFUSE	= 0x23,
	OPCODE_READ_NEW_EFUSE	= 0x24,
	OPCODE_ERASE_LBA		= 0x25,
	OPCODE_READ_CAPABILITY	= 0xaa,
	OPCODE_RESET_DEVICE		= 0xff,
};

但uboot的loader实现不一定完整，很多指令不支持，仅支持核心的FLASH读写之类的。

离线

#33 2021-09-29 16:49:48

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

电子垃圾专业改造 说：

maskrom能烧录uboot，zimage，rootfs到SD卡，然后从SD卡启动Linux系统吗？

maskrom 模式要先加载ddr bin初始化ddr ，然后指针跳到ddr 0x0000000，在ddr运行miniloader 才能进入loader模式。loader模式就能读spi nand的uboot到ddr。串口打印都是在loader阶段？

DDR Version V1.04 20201030
DDR3, 328MHz
BW=32 Col=10 Bk=8 CS0 Row=15 CS=1 Die BW=16 Size=1024MB
change to: 328MHz
change to: 528MHz
change to: 784MHz
change to: 924MHz(final freq)
out
U-Boot SPL board init
U-Boot SPL 2017.09 (Sep 29 2021 - 01:36:11)
unrecognized JEDEC id bytes: ff, d2, c8
Trying to boot from MTD2
No misc partition
## Verified-boot: 0
## Checking optee 0x08400000 ... sha256+ OK
## Checking uboot 0x00400000 ... sha256+ OK
## Checking fdt 0x004aadec ... sha256+ OK
Jumping to U-Boot(0x00400000) via OP-TEE(0x08400000)
Total: 103.935 ms

I/TC: 
I/TC: cpu feature:0x13
I/TC: cpu_st=0xe0
I/TC: OP-TEE version: 3.6.0-300-g380b79bf #35 Sat Oct 17 03:53:58 UTC 2020 arm
I/TC: Next entry point address: 0x00400000
I/TC: Initialized


U-Boot 2017.09 (Sep 29 2021 - 01:36:11 +0800)

Model: Rockchip RV1126 Evaluation Board
PreSerial: 2, raw, 0xff570000
DRAM:  1021.7 MiB
Sysmem: init
Relocation Offset: 00000000, fdt: 3bcf9bd8 
Using default environment

Hotkey: ctrl+b
Bootdev(atags): mtd 1
PartType: EFI
No misc partition
boot mode: None
FIT: No fdt blob
Found DTB in boot part
DTB: rk-kernel.dtb
HASH(c): OK
Enter bootrom download...

离线

#34 2021-09-29 17:12:38

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

电子垃圾专业改造 说：
xboot 说：

贴一个bootrom的流程图，方便大家理解
https://whycan.com/files/members/2137/1_20210819-2251.png

看来要从SD卡启动Linux得把nand flash clean！至于通过USB下载image到SD卡，得把nand彻底拆了!

反正不拆spi nand 只擦除flash怎么也不能从sd卡启动linux。擦除spi nand，用官方的SDDiskTool_v1.62制作sd启动卡，怎么也不启动。既然bootrom实现了sd卡驱动，应该能从sd卡读miniloader到ddr。

4.10.3
SD配置
SD启动/升级:各平台SDK发布的U-Boot已经默认使能该功能,用户不需要额外配置。

2.20 SD/U
RK平台的U-Boot支持SD/U盘的固件启动或升级。其中:
SD启动/升级是从bootrom这一级开始支持
U盘启动/升级是从U-Boot这一级开始支持

难道在spl阶段或者miniloader阶段或者uboot阶段又把sd卡驱动搞乱了？反正uboot 阶段是不能读sd卡的。
=> mmc info                                 
Device: dwmmc@ffc60000
Manufacturer ID: 3
OEM: 5344
Name: SU08G
Timing Interface: Legacy
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 7.4 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes
=> mmc read 0x082000000 0x00002000 0x00002000

MMC read: dev # 1, block # 8192, count 8192 ... 0 blocks read: ERROR

Call trace:
  PC:   [< 004001a0 >]
  LR:   [< 00000000 >]

Stack:
        [< 004001a0 >]

Copy info from "Call trace..." to a file(eg. dump.txt), and run
command in your U-Boot project: ./scripts/stacktrace.sh dump.txt

Resetting CPU ...

### ERROR ### Please RESET the board ###


老打包方式dd  idbloader.img到64扇区也不行。
./tools/mkimage  -n rv1126 -T rksd -d /home/abc/rksdk/rv1126/rkbin/bin/rv11/rv1126_ddr_924MHz_v1.04.bin idbloader.img
cat /home/abc/rksdk/rv1126/rkbin/bin/rv11/rv110x_miniloader_v1.26.bin >> idbloader.img

最近编辑记录 电子垃圾专业改造 (2021-09-29 18:14:15)

离线

#35 2021-09-29 18:23:50

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

11.1.3
打包
1. 编译生成的u-boot-tpl.bin需要将头4个byte替换成相应平台的tag后才是一个合法的ddr bin。如
RV1126/RV1109平台该tag是“110B”。如果只需要ddr bin的话需要自己手动完成该步骤tag的替换动
作,该动作可参考scripts/spl.sh脚本。
Example:替换RV1126 u-boot-tpl.bin的tag。
dd bs=4 skip=1 if=tpl/u-boot-tpl.bin of=tpl/u-boot-tpl-tag.bin && sed -i
'1s/^/110B&/' tpl/u-boot-tpl-tag.bin
2. 如果需要生成完整的可烧写入板子的Loader文件的话,可通过下面命令自动完成u-boot-tpl.bin tag的
替换动作以及和spl.bin打包成一个完整的Loader文件动作。
./make.sh tpl

离线

楼主 #36 2021-10-08 13:47:29

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

具体打包成idbloder，看15楼的代码

离线

#37 2021-10-15 23:00:09

电子垃圾专业改造
封禁
注册时间： 2021-07-21
已发帖子： 55
积分： 36

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

具体打包成idbloder，看15楼的代码

打开SDK打包的allminiloader.bin，没有31313042是加密了的原因，只加密这个，其他的什么uboot.img 没加密！rkbin下的什么ddr.bin有31313042的idb头。uboot-tpl.bin没31313042头，SDK的打包方式和老的打包方式具体哪里不同？加密？老打包方式输出的img是乱码。

离线

#38 2021-10-31 10:50:23

thank you very much!
封禁
注册时间： 2021-10-10
已发帖子： 9
积分： 11

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xboot 说：

uboot里有loader模式 ，敲rockusb就可以进入loader，进入loader后，就可以用xrock读写flash了

在spi nand flash，tf卡等没有任何代码的情况下，ubuntu下使用瑞星微的Linux_upgrade_ tool是不行的。uboot下是输入download进入rockusb模式。在不能进uboot的情况下只能windows下先烧录ddr.bin,usbplug.bin到外部存储.

离线

#39 2021-10-31 12:51:30

电子垃圾专业户
封禁
注册时间： 2021-10-07
已发帖子： 21
积分： 22

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

kakatoo 说：

@xboot
楼主牛逼.......期待瑞芯微系列可以裸奔....

有裸奔的例子吗？uboot下实现各种驱动，外加自己的code！uboot下点灯？直接操作寄存器？

最近编辑记录 电子垃圾专业户 (2021-10-31 12:55:36)

离线

楼主 #40 2022-01-25 13:41:17

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

开发xrock已有近半年了，因RK裸奔玩家较少，故更新频率较低，最近因为要解决某些问题，增加了对RK3566， RK3568芯片的支持，新芯片采用New IDB，包括未来的RK3588旗舰芯片，这里扩展了maskrom指令，增加--rc4-off参数。

RK3566

sudo xrock maskrom rk3566_ddr_1056MHz_v1.11.bin rk356x_usbplug_v1.13.bin --rc4-off
sudo xrock version

RK3568

sudo xrock maskrom rk3568_ddr_1560MHz_v1.11.bin rk356x_usbplug_v1.13.bin --rc4-off
sudo xrock version

离线

#41 2022-02-18 13:59:29

taotieren
会员
注册时间： 2020-05-19
已发帖子： 116
积分： 151

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xrcok 也有打包道 Arch Linux 那边

离线

#42 2022-10-06 14:43:49

astankvai
会员
注册时间： 2021-02-23
已发帖子： 62
积分： 62

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

蒋大神NB啊， 膜拜！啥时带我们玩下裸机RISC-V的D1

离线

楼主 #43 2024-09-06 12:15:35

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

转眼开发xrock已经三年了，最近有闲情，通过逆向并实现了部分指令，包括序列号读写，vendor storage访问，多存储器切换，otp dump等。

usage:
    xrock maskrom <ddr> <usbplug> [--rc4-off]    - Initial chip using ddr and usbplug in maskrom mode
    xrock download <loader>                      - Initial chip using loader in maskrom mode
    xrock ready                                  - Show chip ready or not
    xrock version                                - Show chip version
    xrock capability                             - Show capability information
    xrock reset [maskrom]                        - Reset chip to normal or maskrom mode
    xrock dump <address> <length>                - Dump memory region in hex format
    xrock read <address> <length> <file>         - Read memory to file
    xrock write <address> <file>                 - Write file to memory
    xrock exec <address> [dtb]                   - Call function address
    xrock otp <length>                           - Dump otp memory in hex format
    xrock sn                                     - Read serial number
    xrock sn <string>                            - Write serial number
    xrock vs dump <index> <length> [type]        - Dump vendor storage in hex format
    xrock vs read <index> <length> <file> [type] - Read vendor storage
    xrock vs write <index> <file> [type]         - Write vendor storage
    xrock storage                                - Read storage media list
    xrock storage <index>                        - Switch storage media and show list
    xrock flash                                  - Detect flash and show information
    xrock flash erase <sector> <count>           - Erase flash sector
    xrock flash read <sector> <count> <file>     - Read flash sector to file
    xrock flash write <sector> <file>            - Write file to flash sector
extra:
    xrock extra maskrom --rc4 <on|off> [--sram <file> --delay <ms>] [--dram <file> --delay <ms>] [...]

当前版本为v1.0.9
https://gitee.com/xboot/xrock/releases

离线

楼主 #45 2024-09-10 16:00:57

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

补充一个xrock dump系统固件仅能支持32MB的问题，这问题主要出现在官方实现的uboot源码里做了限制，rockusb协议实现限制了读操作的最大范围，超过了限定区域全部返回0xCC，要修复此问题也比较简单，删除限制代码或者放宽RKUSB_READ_LIMIT_ADDR宏定义的值。看一下如下代码就了解了。

#define RKUSB_READ_LIMIT_ADDR	        (32 * 2048)	/* 32MB */
static int rkusb_read_sector(struct ums *ums_dev,
                             ulong start, lbaint_t blkcnt, void *buf)
{
        struct blk_desc *block_dev = &ums_dev->block_dev;
        lbaint_t blkstart = start + ums_dev->start_sector;
        int ret;

        if ((blkstart + blkcnt) > RKUSB_READ_LIMIT_ADDR) {
                memset(buf, 0xcc, blkcnt * SECTOR_SIZE);
                return blkcnt;
        } else {
                ret = blk_dread(block_dev, blkstart, blkcnt, buf);
                if (!ret)
                        ret = -EIO;
                return ret;
        }
}

此限制仅针对于dump，写入是没有任何限制的。uboot有源码修复相对简单，但闭源的usbplug需要修复此问题的话，就只能去hack了，实测不是每个usbplug都做了限制，当遇到此问题时，需要注意下此限制。

离线

楼主 #46 2024-09-20 13:13:41

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

xrock终于突破瑞芯微的限制，瑞芯微在执行权限上，限制得比较死，要想在无flash的板子上运行程序，基本是不可能的事，都是需要将程序预先烧录到flash中，然后复位，才能实现引导，这给裸机调试带来很多麻烦，如果能直接将裸机程序烧写到ram中再执行，将大大提升开发的效率。

通过仔细研究maskrom后发现，我们完全可以在maskrom模式下编写各种payload，来实现各种骚操作。比如，初始化DDR，写程序到RAM中，指定地址执行等，还有很多其他奇淫技巧，比如开jtag，操作寄存器，你甚至都可以直接用jtag调试器来调试bootrom。

贴一个write指令的payload。
write-payload.png

先保存maskrom上下文，再memmove，将附在此payload尾巴上的程序搬移到目的地址。最后在恢复maskrom环境，再次进去maskrom模式。

sudo xrock extra maskrom --rc4 off --sram rv1106_ddr_924MHz_v1.15.bin --delay 10
sudo xrock extra maskrom-write-arm32 --rc4 off 0x00000000 xstar.bin
sudo xrock extra maskrom-exec-arm32 --rc4 off 0x00000000

上面这些命令，就是先初始化RV1106的内部DDR,再将xstar.bin程序写入到DDR空间，DDR空间从0地址开始，然后再执行0地址的程序。
这里借用了rkbin里面的ddr初始化程序。

    xrock maskrom <ddr> <usbplug> [--rc4-off]    - Initial chip using ddr and usbplug in maskrom mode
    xrock download <loader>                      - Initial chip using loader in maskrom mode
    xrock ready                                  - Show chip ready or not
    xrock version                                - Show chip version
    xrock capability                             - Show capability information
    xrock reset [maskrom]                        - Reset chip to normal or maskrom mode
    xrock dump <address> <length>                - Dump memory region in hex format
    xrock read <address> <length> <file>         - Read memory to file
    xrock write <address> <file>                 - Write file to memory
    xrock exec <address> [dtb]                   - Call function address(Recommend to use extra command)
    xrock otp <length>                           - Dump otp memory in hex format
    xrock sn                                     - Read serial number
    xrock sn <string>                            - Write serial number
    xrock vs dump <index> <length> [type]        - Dump vendor storage in hex format
    xrock vs read <index> <length> <file> [type] - Read vendor storage
    xrock vs write <index> <file> [type]         - Write vendor storage
    xrock storage                                - Read storage media list
    xrock storage <index>                        - Switch storage media and show list
    xrock flash                                  - Detect flash and show information
    xrock flash erase <sector> <count>           - Erase flash sector
    xrock flash read <sector> <count> <file>     - Read flash sector to file
    xrock flash write <sector> <file>            - Write file to flash sector
extra:
    xrock extra maskrom --rc4 <on|off> [--sram <file> --delay <ms>] [--dram <file> --delay <ms>] [...]
    xrock extra maskrom-write-arm32 --rc4 <on|off> <address> <file>
    xrock extra maskrom-exec-arm32 --rc4 <on|off> <address>

这是完整指令说明。

最近编辑记录 xboot (2024-09-20 13:16:17)

离线

#47 2024-09-21 11:35:18

zzm24
会员
注册时间： 2018-05-07
已发帖子： 120
积分： 107

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

感谢xboot,最近用rk3566,rockchip那个windows下的RKDevTool已经可以用恶心来形容,一个分区表已经可以劝退不少人了,出错信息更让人莫名其妙.还是xrock.exe好,最近更新频繁,功能增加,期待,双击点赞666.

离线

楼主 #48 2024-09-21 17:48:41

xboot
会员
注册时间： 2019-10-15
已发帖子： 692
积分： 434

Re: 全志有fel模式，瑞芯微有maskrom模式，为了给裸机开发舔砖加瓦，fel模式有xfel工具，那么maskrom模式就需要xrock工具了

v1.1.2版本发布，这个版本增加了arm64核相关payload。

usage:
    xrock maskrom <ddr> <usbplug> [--rc4-off]    - Initial chip using ddr and usbplug in maskrom mode
    xrock download <loader>                      - Initial chip using loader in maskrom mode
    xrock ready                                  - Show chip ready or not
    xrock version                                - Show chip version
    xrock capability                             - Show capability information
    xrock reset [maskrom]                        - Reset chip to normal or maskrom mode
    xrock dump <address> <length>                - Dump memory region in hex format
    xrock read <address> <length> <file>         - Read memory to file
    xrock write <address> <file>                 - Write file to memory
    xrock exec <address> [dtb]                   - Call function address(Recommend to use extra command)
    xrock otp <length>                           - Dump otp memory in hex format
    xrock sn                                     - Read serial number
    xrock sn <string>                            - Write serial number
    xrock vs dump <index> <length> [type]        - Dump vendor storage in hex format
    xrock vs read <index> <length> <file> [type] - Read vendor storage
    xrock vs write <index> <file> [type]         - Write vendor storage
    xrock storage                                - Read storage media list
    xrock storage <index>                        - Switch storage media and show list
    xrock flash                                  - Detect flash and show information
    xrock flash erase <sector> <count>           - Erase flash sector
    xrock flash read <sector> <count> <file>     - Read flash sector to file
    xrock flash write <sector> <file>            - Write file to flash sector
extra:
    xrock extra maskrom --rc4 <on|off> [--sram <file> --delay <ms>] [--dram <file> --delay <ms>] [...]
    xrock extra maskrom-dump-arm32 --rc4 <on|off> --uart <register> <address> <length>
    xrock extra maskrom-dump-arm64 --rc4 <on|off> --uart <register> <address> <length>
    xrock extra maskrom-write-arm32 --rc4 <on|off> <address> <file>
    xrock extra maskrom-write-arm64 --rc4 <on|off> <address> <file>
    xrock extra maskrom-exec-arm32 --rc4 <on|off> <address>
    xrock extra maskrom-exec-arm64 --rc4 <on|off> <address>

比如你想dump rk3588的bootrom,在maskrom模式下，执行如下指令即可，调试串口会以16进制方式打印出dump内容。

xrock extra maskrom-dump-arm64 --rc4 off --uart 0xfeb50000 0xffff0000 1024

https://github.com/xboot/xrock/releases

离线

页次： 1

分享链接 / 只看楼主

页脚

工信部备案：粤ICP备20025096号 Powered by FluxBB

感谢为中文互联网持续输出优质内容的各位老铁们。 QQ: 516333132, 微信(wechat): whycan_cn (哇酷网/挖坑网/填坑网) service@whycan.cn