Boot to FEL mode with fastboot or adb shell

[Matt Krenik]

I'm trying to write a script that can entirely flash an image onto my device (A64) using the USB and without needing press any buttons or a serial port. I have read through the FEL page several times and it seems like the only option to do this is if all of the other boot options fail.  Is there a way that I can overwrite or corrupt the bootloader partition from the adb shell or with a fastboot command so that it will fail on the next reboot and enter FEL mode?

[Arti Zirk]

On T, 2020-05-26 at 15:21 -0700, Matt Krenik wrote:
> Is there a way that I can overwrite or corrupt the bootloader
> partition from the adb shell or with a fastboot command so that it
> will fail on the next reboot and enter FEL mode?

You could simply zero out the Initial SPL Loader

dd if=/dev/zero of=/dev/mmcblk0 bs=1024 count=40

Or you could write the special fel-boot sd card image into the internal
storage https://linux-sunxi.org/FEL#Through_a_special_SD_card_image

Mainline U-Boot defines a nice partition table[1] that allows you to
write the fel-sdboot image file[2] quite easily by running following
commands

fastboot oem format
fastboot flash loader1 fel-sdboot.sunxi
fastboot reboot

And after that boot with a clean U-Boot via FEL[3]

Nicer options would be to add a custom boot-to-fel oem command to u-
boot fastboot implementation[4]


But I think the best way would be to figure out a way to trigger FEL
via the FEL/UBOOT pin because it will be more reliable those hackish
methods.


[1]:
https://gitlab.denx.de/u-boot/u-boot/-/blob/v2020.04/include/configs/sunxi-common.h#L467
[2]:
https://github.com/linux-sunxi/sunxi-tools/blob/master/bin/fel-sdboot.sunxi
[3]: https://plaes.org/technotes/embedded-systems/sunxi-notes/
[4]:
https://gitlab.denx.de/u-boot/u-boot/-/blob/v2020.04/drivers/fastboot/fb_command.c

[Arti Zirk]

On T, 2020-06-02 at 22:33 -0500, Matt Krenik wrote:
> Hello Arti,
>
> Thanks so much for your detailed reply. I tried the first suggestion
> of just zeroing out the initial SPL loader. Its not clear if I
> accessed the correct location, because there is no /dev/mmcblk0.
> Instead I tried a few different options, including: '/dev/block/by-
> name/boot' '/dev/block/by-name/bootloader' and '/dev/block/nanda'.
> In each of the cases, I believe the device is getting past the
> initial SPL loader, but is getting stuck on the main bootloader. I'll
> keep trying to find out what memory device could store the initial
> SPL loader.

Its possible that SPL is stored in raw NAND or in a SPI Flash chip. You
probably have to hook up serial console to figure that out.


> I did notice that when I probe 'lsusb' when the device is first
> starting, the device appears in flash mode for a small window of time
> before loading the bootloader. I have been unable to figure out a way
> to take advantage of this to flash the device (I tried starting the
> sunxi-livesuite gui), since it proceeds to the bootloader. This was
> surprising to me according to the documentation on the Sunxi linux
> wiki. Its clear that I'm working with some custom/vendor firmware
> that might differ from what is standard.
>
> Again, thanks for your help. It seems that I'm on my own since I'm
> working with hardware that differs from what this community supports.
> But if you have any tips on what I can investigate, I would find it
> extremely helpful.
>
> Best,
> Matt

[Matt Krenik]

Would you (or someone you know) be interested in (paid) consulting, contract work, or mentorship? I'm a new engineer working as the sole firmware developer at a startup, and I feel like I'm in a bit over my head. Even some small amount of guidance would be invaluable for developing as an engineer and being able to contribute to the company.

Best,

Matt

--
You received this message because you are subscribed to the Google Groups "linux-sunxi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to linux-sunxi...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/linux-sunxi/5281ce053fc8cb663a862c8130a8107abbcf0c44.camel%40gmail.com.

[Priit Laes]

What kind of storage does your device use and how is it mapped (aka if it's
eMMC then on which pins it is mapped).

This is how I am doing it for eMMC-based device

0. (In case bootloader is already flashed) - Insert the fel-sdboot formatted
sdcard (search from wiki) that puts device in FEL mode.

1. Connect USB and load uboot via FEL to put device into fastboot mode

$ cat my.env
#=uEnv
bootcmd=fastboot usb 0

$ sunxi-fel uboot u-boot-sunxi-with-spl.bin write 0x43100000 my.env

2. Now device should end up in fastboot mode

$ fastboot oem format

3. Reboot the device (should end up in FEL mode because fel-sdboot sdcard)

$ fastboot reboot

4. Another boot into fastboot mode

$ sunxi-fel uboot u-boot-sunxi-with-spl.bin write 0x43100000 my.env

5. Do the flashing

$ fastboot flash loader1 sunxi-spl.bin
$ fastboot flash loader2 u-boot.img
$ fastboot flash esp esp.img
$ fastboot flash system system.img

> --
> You received this message because you are subscribed to the Google Groups "linux-sunxi" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to linux-sunxi...@googlegroups.com.

> To view this discussion on the web, visit https://groups.google.com/d/msgid/linux-sunxi/d602bb08-e8c6-49c3-a4fd-3425e262621c%40googlegroups.com.