Hi @Portisch
I have captured the issue with S905X with -ng build and bl301 that cause the device stuck after power off if, apparently, connected to a Samsung TV
There is an oops in CEC routines:
This happen like 90% of the time at poweroff. Auto shutdown is also affected, which means it is affected the device even if the TV is already powered off.
In the log I have switched off the device with its remote, not by CEC
You have enabled any cec debug?
This dump_cecrx_reg should normally not be called anytime. If it get called it looks like to read some hdmirx registers. And I remember there is a kernel oops because of the frame switch @cdu13a when booting, enter suspend and resume without a hdmi connection. Maybe it’s the same fault.
Never have seen such kernel oops as this function call should only be done in debug/dump mode of the driver.
It’s only a effect of bl301 as suspend/resume is working now what wasn’t before.
No, I did not enable anything at least on purpose. These are s905x box that have been updated across non ng to ng a couple of months ago.
Where can I check for this Debug setting?
As you just updated can you try to do a clean install?
Just prepare a other uSD card or usb stick and flash Amlogic-ng 9.2.5 on it. Copy your matching dtb.img and try again. If it is solved it’s maybe a unknown setting somewhere on the gxl system.
@Portisch So, I have make a fresh CoreELEC SD and it seems the problem disappeared.
There must be something, because I have three A95x, all of them updated across non ng to ng and all have the problem
I don’t know what causes this as it was the first time I was reading something about this error.
Maybe you make a debug log on one setup what do have this issue!?
I have a box X96 (S905X), recorded on the microSD “Corelec-Amlogic-ng. arm-9.2-nightly_201129-Generic”. But there is no item in the hardware menu “inject_bl301” and “sleep mode” in the shutdown menu.
This menu item did not exist initially. I didn’t activate anything in the console.
I’m sorry, I didn’t read the instructions very well. What about sleep mode?
Hi there. Just bricked with Bl301 injection my recently bought (I lately discovered is a fake) Tanix TX3 S905x3:
Does anyone know which are the pins that I have to short to force the recovery from sdcard?
I will really appreciate any help. Thank you very much in advance 
Why you are sure it’s bl301?
Does any logo get shown on the screen when power on?
There are two copper dots right now next to the eMMC. Maybe these?
Hi Portisch. Thanks for the reply.
Well I’m pretty sure. Coreelec was working fine. Installed in the NAND, rebooted a couple of times. Everything was good.
Then I installed bl301, then reboot and never came back.
I may have done something wrong: at the very end instead of doing a “sync && reboot” I did just a “reboot now”. Can this generate the issue?
Regarding the pins: I’ve been trying for a while shorting those two copper dots but they don’t seem to make any effect.
No logo, no lights on.
Is there any method to identify which pins are the proper?
In 4pda they say those are the right pins for this board:
https://4pda.ru/forum/index.php?showtopic=969245&view=findpost&p=93443902
My attempts to perform the restoration shorting those exact pins were unsuccessful.
Hard brick then?
No Amlogic box can “hard” brick. You just need to search the correct pins that the eMMC is not “online” when power on. So the bootloader in the SoC search the uSD instead eMMC.
I do normally try it with like a small screwdriver to short also components near the eMMC. uSD from Burncardmaker have to be in the slot. Then apply power. After apply DC remove the short until ~2s and check if the recovery starts. If not power off DC, short another place and try again.
It’s like you short the DC supply for eMMC that it remain “dead” when apply DC power.
But of course, trying some places by random can damage such other parts! So short only a short time when DC power is on.
Try first the pins around the eMMC. If there is nothing check the PCB underneath. There are some pads where nothing is assembled. Maybe one of them can help.
There is also on backside near underneath the eMMC a small capacitor marked 1.8V. maybe short this can do the job. But only short time!
The pads underneath the eMMC, also where the capacitors are assembled are also a good place to try.
I could start it! Funny thing: it started loading the old installation of CE that remains in the NAND. It disregarded the SDcard content.
So I understand that it used the bootloader from the sdcard then loaded directly into the main partition of the NAND, right?
Anyway, just rebooted the device and now I can’t start it again 
If I can start it again and it loads CE, is there any method that I can use from SSH to recover it definitely?
Yes it is. You can disable bl301 in ce settings. Then the original bootloader is restored.
Hi Portisch, it worked! Restored the bootloader from the backup though the CE menu and now it boots again without the short.
Now, the question is: is there any way to make bl301 work on this one? Was this caused because I f***ed it up with the last command? or do I have to totally forget about bl301 for this device?
Many thanks for your support!
Just FTR, maybe it can help somebody else: these are the pins that worked for me for the (fake) Tanix TX3 S905x3:
It is a little bit tricky to get it boot with this method. More than short the pins and turn the power on, for me worked by turning the power on and short them just 1 or 2 seconds after for just the shortest time possible. Then it booted.
About | FAQ | Terms of Service | Privacy Policy | Legal Notice
