CoreELEC BL301 Wake-Up feature [inject_bl301]

BL301.BIN Injection

Some Amlogic devices have problems with wake-up from suspend, power off by IR remote, CEC or WOL, this is related to a poorly configured bootloader.

This is the reason for the new tool that we have created, inject_bl301!
This tool is written by Team CoreELEC and exclusive for Amlogic devices running CoreELEC!

What is the purpose of this tool:
If you have an Amlogic device that has issues with wake-up features like IR remote wake-up or CEC wake-up then you can use this tool to fix those issues.

How it works:
inject_bl301 will exchange part of the bootloader (bl301 blob) and leave the rest untouched, this is responsible for handling the suspend/power off functions of the device and so by exchanging this part of the bootloader the wake-up features can be fixed/enabled.

This has the advantage that CoreELEC can still use the original bootloader and it is almost impossible to brick the device as the bl301 bootloader blob only gets activated when sending the device to suspend or power off, so if you encounter any problems then you can reflash your original firmware image on the device and the bootloader will be restored.

Currently supported Amlogic SoC’s:

SoC ID: 0x28 - G12A (S905X2)
SoC ID: 0x29 - G12B (S922X, A311D)

How to use the inject_bl301 tool:

Usage of the tool:

Usage: inject_bl301 [options] [BL301.bin file...]

[options]
 -b     define local bootloader blob BL301.bin
 -d     upload the debug output to http://ix.io
 -s     define a system root path (needed for update.sh)
 -Y     auto confirm user interaction request
 -h     print this help

Firstly you must SSH to your device and run the tool by entering:

inject_bl301

Push enter and the tool will print out some debug information like this:

CoreELEC:~ # inject_bl301
Starting bootloader blob BL301 injection tool v0.1...

This tool can be used to update the bootloader
blob BL301 of the vendor bootloader on the internal
eMMC. This bootloader blob BL301 is customized by
Team CoreELEC to support all wake-up features like
CEC, Wake-On-LAN, IR, and GPIO wake-up from
suspend or power off state!

Device serial number: 290b4000010b1900000f38304e424e50
Using CPU type G12B (29): S922X, A311D
Using binary type because of CoreELEC DT-ID: Generic
Using /dev/bootloader as bootloader partition
Found TOC_HEADER at:            0x00010210
Name:                           AA640001
Serial Number:                  12345678
Flags:                          0

TOC ENTRY #0
UUID:                           9766FD3D89BEE849AE5D78A140608213
Offset Address:                 0x5C000 (absolute: 0x6C210)
Size:                           0xE570
Flags:                          0x0
Found BL30 blob image at:       0x0006C210
Amlogic magic:                  @AML
Old signature:                  5BD742D8DFED889ED5A29279A3B11B0114C455FFB454A6D0738E14FBF7517395
Using BL301.bin:                Generic_28_29_bl301.bin
New signature:                  DE5F59943B2A7CA29859521395C9B444CD1855ABF42763DEB9AB257FDA629CAA

Please confirm to write the bootloader blob BL301 to
the internal eMMC! Please ensure to update first the device
to the last vendor firmware! And remember if the vendor
firmware get updated you have to do this step again as the
bootloader blob will be overwritten!

Continue? [Y/n] Y

Answer the question with Y to inject the CoreELEC bl301 binary on the Amlogic device:

Make backup of vendor bootloader to: /flash/290b4000010b1900000f38304e424e50_bl301.bin
Finished update of BL301.bin on internal eMMC!
Please reboot device now and enjoy the new CoreELEC wake-up features!

Now the flashing of the bl301 binary on the Amlogic device is finished and you just need to reboot the device by typing:

reboot

Or unplug power to restart the device.

After your device has rebooted you can start to customize our config.ini like described here:
How to configure IR wakeup code

Was the injection successful?
Just run the tool again and if the old signature and the new signature matches then the bl301 bootloader blob got updated. It won’t cause any problems if you run the tool multiple times:

CoreELEC:~ # inject_bl301
Starting bootloader blob BL301 injection tool v0.1...

This tool can be used to update the bootloader
blob BL301 of the vendor bootloader on the internal
eMMC. This bootloader blob BL301 is customized by
Team CoreELEC to support all wake-up features like
CEC, Wake-On-LAN, IR, and GPIO wake-up from
suspend or power off state!

Device serial number: 290b4000010b1900000f38304e424e50
Using CPU type G12B (29): S922X, A311D
Using binary type because of CoreELEC DT-ID: Generic
Using /dev/bootloader as bootloader partition
Found TOC_HEADER at:            0x00010210
Name:                           AA640001
Serial Number:                  12345678
Flags:                          0

TOC ENTRY #0
UUID:                           9766FD3D89BEE849AE5D78A140608213
Offset Address:                 0x5C000 (absolute: 0x6C210)
Size:                           0xE570
Flags:                          0x0
Found BL30 blob image at:       0x0006C210
Amlogic magic:                  @AML
Old signature:                  DE5F59943B2A7CA29859521395C9B444CD1855ABF42763DEB9AB257FDA629CAA
Using BL301.bin:                Generic_28_29_bl301.bin
New signature:                  DE5F59943B2A7CA29859521395C9B444CD1855ABF42763DEB9AB257FDA629CAA
Update of BL301.bin on eMMC is not needed, exit now...

Restore the vendor bootloader:

  • Use the typical Amlogic recovery method like with Burncardmaker or the USB Burning Tool to restore the vendor bootloader. When restoring by a vendor image the bootloader get restored too.

  • The tool is making a backup of the vendor bootloader before the first injection to the internal eMMC. The backup can be found on your CoreELEC media at:

     /flash/<CPU_SERIAL>_bl301.bin
    

    Firstly you must SSH to your device and run the dd command:

    dd if=/flash/<CPU_SERIAL>_bl301.bin of=/dev/bootloader conv=fsync bs=512
    reboot 
    

Reminder:
The injection is NOT automatic (yet) and so every time you restore your Amlogic device with a firmware image then you will have to run the tool again as the bootloader will be overwritten and restored.

If the bl301 bootloader blob was injected once it get updated automatically when updating the CoreELEC system by the common update method.

Problems, Questions:
Please use this thread to ask for help: Bl301 injection, problems, help,

6 Likes