ERos 4G-IOT communicator phone
How to install PostmarketOS (linux) in SD-card and get device to boot from card in Orange pi 4G-IOT board.
get Ubuntu 18.04 x64 machine. (PostmarketOS installation with android kernel may work another machines but 4G-IOT kernel sources compilation dosn't)
sudo apt-get install adb fastboot python3-pip python3 coreutils procps python-argcomplete
pip3 install --user pmbootstrap
pip3 install --user argcomplete
source ~/.profile
start new project:
pmbootstrap init
Work path [/home/omistaja/.local/var/pmbootstrap]: ~/src/pmos/
Vendor [qemu]: orangepi
Device codename: 4g-iot
Device architecture (armhf/armv7/aarch64/x86_64/x86) [armhf]: armv7
Manufacturer: OrangePI
Name: OrangePI 4G-IOT
Year: 2018
Does the device have a hardware keyboard? (y/n) [n]: n
Does the device have a sdcard or other external storage medium? (y/n) [n]: y
Flash method (fastboot/heimdall/0xffff/uuu/none) [fastboot]: adb
User interface [weston]: gnome
Extra packages [none]: nano,ssh,sshd
Device hostname (short form, e.g. 'foo') [orangepi-4g-iot]: 4g-iot
nano src/pmos/cache_git/pmaports/device/testing/device-orangepi-4g-iot/deviceinfo
deviceinfo_screen_width="960"
deviceinfo_screen_height="540"
nano src/pmos/cache_git/pmaports/device/testing/linux-orangepi-4g-iot/APKBUILD
pkgver=3.0.x
To get kernel remove J5 jumper and connect 4g-iot with microusb cable (data, not charge only) to computer:
sudo adb start-server
adb shell
cd /data
root@bd6737m_35g_b_m0:/data # dd if=/dev/block/mmcblk0p7 of=boot.img
exit
adb pull /data/boot.img
pmbootstrap chroot
exit
cp boot.img ~/src/pmos/chroot_native/tmp/
pmbootstrap chroot
cd /tmp
/tmp # apk add unpackbootimg
/tmp # unpackbootimg -i boot.img
exit
pmbootstrap bootimg_analyze boot.img
nano src/pmos/cache_git/pmaports/device/testing/device-orangepi-4g-iot/deviceinfo
# from: pmbootstrap bootimg_analyze
deviceinfo_kernel_cmdline="bootopt=64S3,32N2,32N2"
deviceinfo_generate_bootimg="true"
deviceinfo_bootimg_qcdt="false"
deviceinfo_bootimg_dtb_second="false"
deviceinfo_flash_offset_base="0x40000000"
deviceinfo_flash_offset_kernel="0x00008000"
deviceinfo_flash_offset_ramdisk="0x04000000"
deviceinfo_flash_offset_second="0x00f00000"
deviceinfo_flash_offset_tags="0x0e000000"
deviceinfo_flash_pagesize="2048"
pmbootstrap install --android-recovery-zip
To modify android boot menu ad reboot to recovery:
https://techviral.net/change-power-button-default-options-in-android/
wget https://download.apkpure.com/b/apk/cG93ZXJfdG9vbHMuYXBwbGljYXRpb24uYW5kcm9pZF8xMTIwNF9kZWE3ZDAyYw?_fn=UG93ZXIgVG9vbHNfdjEuMTIuMDRfYXBrcHVyZS5jb20uYXBr&as=ca0a5b7bf63ca8c4a1d6327cd4461c465ea82764&ai=178431239&at=1588078316&_sa=ai%2Cat&k=16e15f183a26cc1556c3115717300af45eaac9ec&_p=cG93ZXJfdG9vbHMuYXBwbGljYXRpb24uYW5kcm9pZA&c=1%7CTOOLS%7CZGV2PUhleEJlZXJpdW0mdD1hcGsmcz02MzQ4NzcyJnZuPTEuMTIuMDQmdmM9MTEyMDQ
adb install PowerTools.apk
https://apkpure.com/recovery-reboot/gt.recovery.reboot/download?from=details
and just find that there is 'adb reboot-bootloader' that boot board fastboot mode!
adb reboot bootloader works too
fastboot boot ../../../OrangePi4G-iot/output/kernel/arch/arm/boot/zImage-dtb boot.img-ramdisk.gz
creating boot image...
creating boot image - 8675328 bytes
downloading 'boot.img'...
OKAY [ 0.359s]
booting...
FAILED (remote: oem unlock is false)
finished. total time: 0.362s
fastboot oem unlock
fastboot flashing unlock
But where are volume buttons to routed????
fastboot oem unlock
...
OKAY [ 66.466s]
finished. total time: 66.466s
You need to connect GPIO header pin6 (GND) wire and 1kohm resistor. Then touch all pins with resistor starting from pin40. Reverse order starting from pin1 hit volume down pin first.
It needs to find correct pins. If you have time to do this then add 40-pin ide cable to board and use it so screen can see. (Phone case dosn't allow cable header hole need to enlargement.
fastboot boot ../../../OrangePi4G-iot/output/kernel/arch/arm/boot/zImage-dtb boot.img-ramdisk.gz
creating boot image...
creating boot image - 8675328 bytes
downloading 'boot.img'...
OKAY [ 0.843s]
booting...
FAILED (remote: oem unlock is false)
finished. total time: 0.846s
Phone screen show transfer ok.
fastboot oem unlock seems to fail even vol up/down is pressed. They are in outer line range maybe pins 20-30. Volume Down pin15 and volume up is not routed at all..fuck.
fastboot reboot
fastboot flashing get_unlock_ability
...
(bootloader) unlock_ability = 16777216
OKAY [ 0.009s]
finished. total time: 0.009s
fastboot -c root=/dev/mmcblk1p2 continue
dos something, device reboot
fastboot unlock-info
adb reboot-recovery
adb fastboot
fastboot oem flash Unlock_code.bin
fastboot oem unlock -i 0xkeyprovidedbysony
less lk.bin
OKAY^@^@^@^@fastboot_init()
^@^@^@^@getvar:^@version^@0.5^@version-preloader^@^@^@flash:^@^@erase:^@^@continue^@^@^@^@reboot^@^@reboot-bootloader^@^@^@
product^@BD6737M_35G_B_M0^@^@^@^@kernel^@^@lk^@^@secure^@^@unlocked^@^@^@^@warranty^@^@^@^@
off mode charge status 'n' is out off boundary
^@partition-type:%s^@^@^@userdata^@^@^@^@%llx^@^@^@^@partition-size:%s^@^@^@download:^@^@^@max-download-size
^@^@^@0x8000000^@^@^@oem p2u^@oem reboot-recovery^@oem append-cmdline^@^@oem off-mode-charge^@
oem unlock^@^@oem lock^@^@^@^@oem key^@oem lks^@flashing unlock^@flashing lock^@^@^@flashing get_unlock_ability^@
fastboot^@^@^@^@[FASTBOOT] Input cmdline length is too long!^@^@^@^@cmdline length is too long^@^@[FASTBOOT] New command line is %s
^@^@APPEND KERNEL CMDLINE
adb push OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk_sd.bin /data/
ls -al /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/
lk -> /dev/block/mmcblk0p5
para -> /dev/block/mmcblk0p6
boot -> /dev/block/mmcblk0p7
recovery -> /dev/block/mmcblk0p8
root@bd6737m_35g_b_m0:/data # dd if=lk_sd.bin of=/dev/block/mmcblk0p5
766+1 records in
766+1 records out
392608 bytes transferred in 0.064 secs (6134500 bytes/sec)
and it fails with blinking bootscreen. Then tryed flash with mtk SPflash (from sources external + dpkg -i missing lib) ubuntu image
it fails/~works with white screen maybe need some serial console input but not tested. Then flashed official android-hdmi,
but it fails with white screen like ubuntu not tested with monitor in hdmi.
https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/15108504
Then flashed official android 8.1. And now we are in official android with binary only tools and Linaro kernel.
Android 8.1 lacks sound, maybe due linaro kernel can'use at phone.
ADB seems to be availabe after phone is full booted not early as in android 6.
It uses protocoll that have mt6735 flasher availabe but not tested yet. So adb is availabe:
k37mv1_bsp:/ # cat /proc/cpuinfo
Processor : ARMv7 Processor rev 4 (v7l)
processor : 0
model name : ARMv7 Processor rev 4 (v7l)
BogoMIPS : 33.67
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm sha2
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
Hardware : MT6737
Revision : 0000
Serial : 0000000000000000
k37mv1_bsp:/ # cat /proc/partitions
major minor #blocks name
254 0 704900 zram0
179 0 7634944 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 10240 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 16384 mmcblk0p7
179 8 16384 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 10240 mmcblk0p10
179 11 512 mmcblk0p11
179 12 2048 mmcblk0p12
179 13 6144 mmcblk0p13
179 14 8192 mmcblk0p14
179 15 5120 mmcblk0p15
179 16 5120 mmcblk0p16
179 17 1024 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 16384 mmcblk0p19
179 20 37888 mmcblk0p20
179 21 417792 mmcblk0p21
179 22 1400832 mmcblk0p22
179 23 114688 mmcblk0p23
179 24 5488128 mmcblk0p24
179 25 16384 mmcblk0p25
179 96 512 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
179 128 65536000 mmcblk1
179 129 51200 mmcblk1p1
179 130 31178320 mmcblk1p2
253 0 5488128 dm-0
k37mv1_bsp:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0
k37mv1_bsp:/ # cat /proc/meminfo
MemTotal: 939868 kB
MemFree: 20080 kB
MemAvailable: 431068 kB
Buffers: 7320 kB
Cached: 387492 kB
SwapCached: 1824 kB
Active: 328204 kB
Inactive: 352596 kB
Active(anon): 127200 kB
Inactive(anon): 165080 kB
Active(file): 201004 kB
Inactive(file): 187516 kB
Unevictable: 14972 kB
Mlocked: 13128 kB
HighTotal: 452668 kB
HighFree: 2428 kB
LowTotal: 487200 kB
LowFree: 17652 kB
SwapTotal: 704896 kB
SwapFree: 683488 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 300768 kB
Mapped: 262520 kB
Shmem: 1964 kB
Slab: 79896 kB
SReclaimable: 36556 kB
SUnreclaim: 43340 kB
KernelStack: 10104 kB
PageTables: 22628 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 1174828 kB
Committed_AS: 27937492 kB
VmallocTotal: 499712 kB
VmallocUsed: 152692 kB
VmallocChunk: 252720 kB
k37mv1_bsp:/ # ls -la /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/
total 0
drwxr-xr-x 2 root root 580 2020-04-30 12:13 .
drwxr-xr-x 4 root root 660 2020-04-30 12:13 ..
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 cache -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 expdb -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 flashinfo -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 frp -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 keystore -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 lk -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 logo -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 metadata -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 nvdata -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 odmdtbo -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 oemkeystore -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 para -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 23 2020-04-30 12:13 preloader_a -> /dev/block/mmcblk0boot0
lrwxrwxrwx 1 root root 23 2020-04-30 12:13 preloader_b -> /dev/block/mmcblk0boot1
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2020-04-30 12:13 recovery -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 seccfg -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 secro -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 system -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 tee1 -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 tee2 -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 userdata -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 2020-04-30 12:13 vendor -> /dev/block/mmcblk0p21
k37mv1_bsp:/ # ls -al /proc/config.gz
-r--r--r-- 1 root root 24155 2020-04-30 12:32 /proc/config.gz
k37mv1_bsp:/data # dd if=/dev/block/mmcblk0p7 of=boot.img
32768+0 records in
32768+0 records out
16777216 bytes (16 M) copied, 1.540895 s, 10 M/s
k37mv1_bsp:/data # dd if=/dev/block/mmcblk0p8 of=recovery.img
32768+0 records in
32768+0 records out
16777216 bytes (16 M) copied, 1.555331 s, 10 M/s
k37mv1_bsp:/data # dd if=/dev/block/mmcblk0p5 of=lk.img
1024+0 records in
1024+0 records out
524288 bytes (512 K) copied, 0.045803 s, 11 M/s
k37mv1_bsp:/data # uname -a
Linux localhost 3.18.79 #2 SMP PREEMPT Thu Jun 14 15:06:07 CST 2018 armv7l
/src/Android 8.1$ adb pull /data/recovery.img
adb pull /data/boot.img
adb pull /data/lk.img
adb pull /proc/config.gz
zgrep F2FS config.gz
# CONFIG_F2FS_FS is not set
adb reboot-bootloader
~/src/Android 8.1$ fastboot boot ../OrangePi4G-iot/output/kernel/arch/arm/boot/zImage-dtb ../pmos/chroot_native/tmp/boot.img-ramdisk.gz
creating boot image...
creating boot image - 8675328 bytes
downloading 'boot.img'...
OKAY [ 0.350s]
booting...
FAILED (remote: not allowed in locked state)
finished. total time: 0.354s
fastboot oem unlock
Ok we need new LK and adb_dd to put it. We have lk sources to find how disable volume up/down questions.
fastboot continue
adb push ../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin /data/lk_src.bin
[100%] /data/lk_src.bin
k37mv1_bsp:/ # ls -al data/lk*
-rw-rw-rw- 1 root root 524288 2020-04-30 12:36 data/lk.img
-rw-rw-rw- 1 root root 392608 2020-04-26 21:18 data/lk_src.bin
Then try to brick phone..:
k37mv1_bsp:/data # dd if=lk_src.bin of=/dev/block/mmcblk0p5
766+1 records in
766+1 records out
392608 bytes (383 K) copied, 0.069144 s, 5.4 M/s
adb reboot
and briked to slowly blinking whhite screen. fuck.
ok it seems sp-flash can upload previous lk so test can continue..
So something in bootloader sources is wrong. Should whole bootloader update? No I think LK sources are not functional.
~/src/Android 8.1$ diff -a IoT_ry_smt_hd720_pcb_v2/images/lk.img ../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin
differs much.
diff -a IoT_ry_smt_hd720_pcb_v2/images/lk.img ../Android\ image（support\ HDMI\ output）/IoT_op_smt_hd720_pcb_v2/images/lk.bin
differs lot.
~/src/Android 6.0/IoT_op_smt_hd720_pcb_v2$ diff -a images/lk.bin ../../Android\ 8.1/IoT_ry_smt_hd720_pcb_v2/images/lk.img
differs lot
diff -a images/lk.bin ../../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin
differs lot
diff -a images/lk.bin ../../OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk_emmc.bin
differs lot
diff -a images/lk.bin ../../OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk.bin
diff lot
diff -a ../../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin ../../OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk.bin
1302c1302
MATCH!!
diff -a ../../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin ../../OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk_emmc.bin
1302c1302
< Apr 26 202021:17:51 chip_code[0x%x]
---
> Mar 17 202018:12:35 chip_code[0x%x]
MATCH - so we have code from 2018 and keyword to grep dates from other lk's.
diff -a ../../OrangePi4G-iot/output/lk/build-bd6737m_35g_b_m0/lk.bin ../../OrangePi_4g-iot_ubuntu_xenial_server_linux3.18.19_v1.1/lk_sd.bin
< Apr 26 202021:17:51 chip_code[0x%x]
---
> Mar 17 202018:58:31 chip_code[0x%x]
console=ttyMT3,921600n1 console=tty0 root=/dev/mmcblk0p20 rw rootwait loglevel=8
console=ttyMT3,921600n1 console=tty0 root=/dev/mmcblk1 rw rootwait loglevel=8
Almost identical and seems to have two diffrent boot data. There should be second bootloader in sd-card if use that lk..
some lk code from net
typedef enum
{
NORMAL_BOOT = 0,
META_BOOT = 1,
RECOVERY_BOOT = 2,
SW_REBOOT = 3,
FACTORY_BOOT = 4,
ADVMETA_BOOT = 5,
ATE_FACTORY_BOOT = 6,
ALARM_BOOT = 7,
#if defined (MTK_KERNEL_POWER_OFF_CHARGING)
KERNEL_POWER_OFF_CHARGING_BOOT = 8,
LOW_POWER_OFF_CHARGING_BOOT = 9,
#endif
FASTBOOT = 99,
DOWNLOAD_BOOT = 100,
UNKNOWN_BOOT
} BOOTMODE;
adb reboot 99
dosnt not work.
strings images/lk.bin |grep Volume
Press the Volume UP/Down buttons to select Yes or No.
Yes (Volume UP):Unlock(may void warranty).
No (Volume Down):Do not unlock bootloader.
Yes (Volume UP):Lock bootloader.
No (Volume Down):Do not lock bootloader.
well test if a8.1 allow 6.0 lk
adb push images/lk.bin /data/a6lk.bin
[100%] /data/a6lk.bin
k37mv1_bsp:/data # dd if=/dev/block/mmcblk0p5 of=a6lk.bin
1024+0 records in
1024+0 records out
524288 bytes (512 K) copied, 0.049051 s, 10 M/s
adb reboot fastboot
hmm, normal boot
and now adb seems to be here early..
adb reboot-bootloader
So we have two functional lk's that differ lot. How unpack them? How fix sources to enable display..?
fastboot getvar all
(bootloader) max-download-size: 0x8000000
(bootloader) partition-size:flashinfo: 1000000
(bootloader) partition-type:flashinfo: raw data
(bootloader) partition-size:userdata: 32000000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:cache: 7000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 55800000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:vendor: 19800000
(bootloader) partition-type:vendor: ext4
(bootloader) partition-size:metadata: 2500000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:odmdtbo: 1000000
(bootloader) partition-type:odmdtbo: raw data
(bootloader) partition-size:nvdata: 2000000
(bootloader) partition-type:nvdata: ext4
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:tee2: 500000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:keystore: 800000
(bootloader) partition-type:keystore: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: raw data
(bootloader) partition-size:oemkeystore: 200000
(bootloader) partition-type:oemkeystore: raw data
(bootloader) partition-size:seccfg: 80000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-size:expdb: a00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:para: 80000
(bootloader) partition-type:para: raw data
(bootloader) partition-size:lk: 80000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:protect2: a00000
(bootloader) partition-type:protect2: ext4
(bootloader) partition-size:protect1: a00000
(bootloader) partition-type:protect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-size:proinfo: 300000
(bootloader) partition-type:proinfo: raw data
(bootloader) partition-size:preloader: 40000
(bootloader) partition-type:preloader: raw data
(bootloader) off-mode-charge: 1
(bootloader) warranty: yes
(bootloader) unlocked: no
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: K37MV1_BSP
(bootloader) version-preloader: 0.1.00
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.016s
fastboot oem unlock
ask volume keys.
fastboot continue
Hmm, intresting: FACTORY_BOOT and ATE_FACTORY_BOOT will try to load an Android boot image stored in the file factory.img on the SD card, if that fails the BOOTIMG partition is used instead.
LK hacking:
~/src/OrangePi4G-iot/uboot/lk$ nano platform/mt6735/include/platform/mt_reg_base.h
~/src/OrangePi4G-iot/uboot/lk$ nano app/mt_boot/sec_unlock.c
~/src/OrangePi4G-iot/uboot/lk$ nano project/bd6737m_35g_b_m0.mk
Wittu:
~/src/Android 6.0/IoT_op_smt_hd720_pcb_v2$ strings images/lk.bin |grep hd720_dsi
jd9522_hd720_dsi_vdo_qc
ili9881c_hd720_dsi_vdo_cpt
strings ../../Android\ 8.1/lk.img |grep hd720_dsi
jd9522_hd720_dsi_vdo_qc
st7703_hd720_dsi_vdo_boe
nt35521_hd720_dsi_vdo_cmi_tps65132
k37mv1_bsp:/data # dd if=lk_src.bin of=/dev/block/mmcblk0p5
758+1 records in
758+1 records out
388208 bytes (379 K) copied, 0.076913 s, 4.8 M/s
~/src/pmos$ adb reboot-bootloader
White screen due missing lcd driver but it stay and:
~/src/pmos$ fastboot oem unlock
...
(bootloader) Start unlock flow
OKAY [ 3.129s]
finished. total time: 3.129s
fastboot boot ../../OrangePi4G-iot/output/kernel/arch/arm/boot/zImage-dtb ../../pmos/chroot_native/tmp/boot.img-ramdisk.gz
creating boot image...
creating boot image - 8675328 bytes
downloading 'boot.img'...
OKAY [ 0.845s]
booting...
FAILED (remote: invalid kernel address: not lie in memory)
finished. total time: 0.853s
fastboot boot ../../boot.img
downloading 'boot.img'...
OKAY [ 1.617s]
booting...
OKAY [ 0.062s]
finished. total time: 1.679s
Flash back to bootscreen. Android 8 may need some bootvars which are not present in android 6 boot.img? White screen flash is slow so it do something, maybe boot kernel?
Maybe flash back to android 6 it have better kernel atleast sound works and test that lk in android 6.
get some lcd sources to lk maybe frong but.. and they compile
~/src/OrangePi4G-iot/uboot/lk$ adb push ../../output/lk/build-bd6737m_35g_b_m0/lk.bin /data/lk_src.bin
[100%] /data/lk_src.bin
root@bd6737m_35g_b_m0:/data # dd if=lk_src.bin of=/dev/block/mmcblk0p5
741+1 records in
741+1 records out
379488 bytes transferred in 0.059 secs (6432000 bytes/sec)
adb reboot-bootloader
fastboot oem unlock
...
(bootloader) Start unlock flow
OKAY [ 3.130s]
finished. total time: 3.130s
~/src/pmos$ fastboot boot ../boot.img
downloading 'boot.img'...
OKAY [ 1.629s]
booting...
OKAY [ 0.055s]
finished. total time: 1.684s
some time and it go white slowly blinkng screen. Time to SP reflash LK. Intresting to see is unlock var inside LK or somewhere else..
And suprise fastboot unlock bit is somewhere else. It is not in LK because:
~/src/pmos$ fastboot boot ../boot.img
downloading 'boot.img'...
OKAY [ 1.616s]
booting...
OKAY [ 0.064s]
finished. total time: 1.681s
And it boots A6. Maybe need to inspect from sources where hell it store it and it is maybe dd-abble direct from android.
Tats really funny..:
~/src/OrangePi4G-iot/uboot/lk$ grep -R sec_set_device_lock *
Binääritiedosto platform/mt6735/lib/libsec.a täsmää hakuun