trigger FEL most from PC host

[bix64000]

Hello,

I have a A33/z7213 powered device that I am trying to get in FEL mode at boot through the power/data micro-USB cable connected to the PC host. I have seen it done using fel_lib I think, but can't reverse engineer the .exe to find out how. This exe does a "handshake" with the device, maybe by sending a "version" message ?

The device itself is a mini console called "pc engine mini".

The device has no "recovery" or "FEL" or "reset" button.

Thanks for any help.

Bix

[Andre Przywara]

On Fri, 27 Dec 2024 01:10:18 -0800 (PST)
bix64000 <vince...@gmail.com> wrote:

Hi,

> Hello,
> I have a A33/z7213 powered device that I am trying to get in FEL mode at
> boot through the power/data micro-USB cable connected to the PC host. I
> have seen it done using fel_lib I think,

What do you mean with "done using fel_lib"? fel_lib from sunxi-tools?
I wouldn't know if there is a way to force FEL mode via the USB cable,
if this is what you are after: the BootROM only enables the USB-OTG
interface after it decided to enter FEL mode, which is either when it
sees the FEL pin grounded, or when the other boot options don't provide
a valid boot image.

> but can't reverse engineer the
> .exe to find out how. This exe does a "handshake" with the device, maybe by
> sending a "version" message ?

With "the .exe" you mean sunxi-fel.exe, or some other program?

> The device itself is a mini console called "pc engine mini".
> The device has no "recovery" or "FEL" or "reset" button.

Does the device have an SD card slot? Then you could "dd"
fel-sdboot.sunxi from sunxi-tools to an SD card, which should enter FEL
mode when booted with the card in.

If you have a serial console connected, it might help to flood it with
"2"s when the system boots up: some Allwinner boot programs will enter
FEL mode using this method.

Cheers,
Andre

[bix64000]

The device is a mini console, PC Engine mini.

It is apparently possible to trigger FEL mode from USB right at boot of the device, by sending the following bytes to it over USB (OTG port) :

[0x55, 0x53, 0x42, 0x43, 0x4A, 0x53, 0x48, 0x4B, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xF8, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00];

This is done is this program & library :

https://github.com/TeamShinkansen/FelLib/blob/master/FelCli/Program.cs#L204

Also look at :

https://github.com/TeamShinkansen/FelLib/blob/master/FelLib/UMassBbb/CommandBlockWrapper.cs

I successfully reproduced it, it works, as soon as the device boots, the "handshake" happens and the device is in FEL mode, responsive du sunxi-fel.exe

The device doesn't have an SD card slot, and using UART it's the letter "s" that needs to be spammed on this device.

So that's where I am now, I wanted to know more on those bytes that need to be sent, what they mean, there is a signature, a tag, some SCSI command .. I'm not sure what this all means.

Now I am also trying to produce a valide u-boot file but with no luck, compilation errors all the time.

The SoC is a Zuiki z7213, R16/A33 based, 256MB RAM and 4GB NAND.

It would be nice to add this board to the list, as is it commonly used for many mini consoles (PC Engine/Turbografx16, Astro City, Egret II)

Thanks

Vincent