https://github.com/platform-system-interface/aml_boot
https://github.com/platform-system-interface/aml_boot
Last synced: about 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/platform-system-interface/aml_boot
- Owner: platform-system-interface
- License: gpl-2.0
- Created: 2023-07-12T19:50:58.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2024-06-17T19:12:24.000Z (almost 2 years ago)
- Last Synced: 2025-03-25T03:12:31.608Z (about 1 year ago)
- Language: Rust
- Size: 41 KB
- Stars: 11
- Watchers: 5
- Forks: 3
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Amlogic Boot Tool
This tool talks to Amlogic's mask ROM loader over USB.
## Accessing the loader
Many SBCs have a button to press on power-on to enter the loader mode. Some
products may come with a button as well or require entering certain commands
into the stock bootloader. We have found them to be an inconsistent mess. 🤷
## Compatibility
SoCs up to generation 3 (S905X, S905X2, S905{X,Y,D}3, etc) should be supported.
Those show as product string "GX-CHIP".
On some platforms, the commands may (partially) not work or behave different.
**NOTE: Since the protocols are not public, we had to find our ways.
Contributions and opening issues are welcome.**
For details, see the sections on [how we got there](#how-we-got-there) and the
[protocol versions](#protocol-versions).
## Building
Have a Rust toolchain installed with Cargo.
```sh
cargo build --release
```
## Preparation
You need to have udev rules for Amlogic devices installed to access them as a
regular user. Copy `70-amlogic.rules` into `/etc/udev/rules.d/`.
## Usage
```
./target/release/aml_boot
```
Or directly:
```
cargo run --release
```
This will print help on the CLI usage.
You can work on the code and directly run it to see if your changes work, e.g.:
```sh
cargo run --release -- info
```
Note the `--` to escape from Cargo.
## How we got there
This tool has been stated one evening at [Chaospott](https://chaospott.de), in
part to get familiar with the protocol and have our own clean slate code base.
We had a look at existing tools which were either lacking some features or just
errored for the boards we tried them with. Memory read/write are still erroring.
Examples are a TV box based on the S905X4 (different protocol?) and the Libre
Computer S905D3-CC.
The Khadas VIM1 and Libre Computer A311D-CC work fine, e.g., blinky demo:
```sh
aml_boot blinky khadas-vim1
aml_boot blinky lc-a311d-cc
```
Note that other authors have already done a lot and documented their findings.
Big kudos to Neil Armstrong and others who did all the hard work before us. :)
Look at [proto-rev.md](proto-rev.md) for notes on previous and our work.
### Previous work
See for reference.
Corresponding talk by Neil Armstrong at Embedded Linux Conference Europe 2020:
> U-Boot: Porting and Maintaining a Bootloader for a Multimedia SoC Family
Slides:
Frederic B has dumped the S905D3 mask ROM and found vulnerabilities.
## Protocol versions
So, there _is_ now a newer protocol, as people write.
[Sean Hoyt](https://twitter.com/Deadman_Android/status/1505570226540355592)
(Mar 20, 2022):
> As with all newer amlogic soc's it now uses "Amlogic DNL" for it's flashing
> instead of the older World cup update tool. The button on the board can take
> you to fastboot/recovery or USB burn mode. Currently it is not bootloader
> unlockable.
[Previous post in thread (with photos)](
https://twitter.com/Deadman_Android/status/1505570224531247105):
> T-Mobile TVision Hub 2nd gen board pics and general info. Specs: Amlogic
> S905Y4, 2gb of ram (Rayson RS512M32), 8gb emmc 5.1 (Samsung KLM8G1GETF-B041)
So the mask ROM's protocol has changed from version 4 on (needs verification!)?