FEL - Amlogic NO support

is s928x-j left out for good?

\[    0.747536\] dovi disable in uboot
\[   15.557197\] dovi_gen_5_15_stb26: disagrees about version of symbol module_layout
\[   15.557214\] please rebuild ko: dovi_gen_5_15_stb26
\[   15.557223\] dovi_gen_5_15_stb26: module license ‘AML’ taints kernel.
\[   15.557932\] dovi_gen_5_15_stb26: disagrees about version of symbol \__stack_chk_fail
\[   15.557945\] please rebuild ko: dovi_gen_5_15_stb26
\[   15.558306\] dovi_gen_5_15_stb26: using CFI init symbol \__cfi_jt_init_module
\[   15.558311\] dovi_gen_5_15_stb26: using CFI exit symbol \__cfi_jt_cleanup_module
\[   15.558790\] \[dovi_gen_5_15_stb26\]: \*\*\* amlogic_dolby_vision_init dv: gen \*\*\*
\[   15.559009\] \[dovi_gen_5_15_stb26\]: Creating DV mp success
\[   15.559227\] \[dovi_gen_5_15_stb26\]: Creating DV mp success
1 Like

@djnice is who we have to thank for the DV work, he mentioned in a post that this isn’t feasible: CoreELEC 22.0-Piers_beta1 Discussion - #24 by djnice

As we’ve mentioned several times, S928X-J has DV support but FEL is not possible. It seems that it will never happen but who knows. It’s not a choice.

Dear, sometimes, when fast-forwarding or rewinding movies with Dolby Vision, my AM6B+ reboots on its own. Could the DV module be the issue? I’m using CoreELEC-NO nightly with the “5.15_2.6_dovi_patched_fix_fel.ko” module.

I know that the S928X doesn’t support FEL, but I’m wondering if this dovi.ko could be used on my S928X-K (Ugoos SK1) for other Dolby Vision profiles. Has anyone tried it?

If you can’t understand what was written then just try and see what happens? Why do you ask for permission…

1 Like

Thanks @vpeter now I know what to do.

Hi all,

I’m seeing a repeatable FEL freeze/reboot on my Ugoos AM9 Pro running CoreELEC 22.0-Piers nightly 20260711 with kernel 5.15.196 and the patched FEL dovi.ko.

The panic consistently ends at:

Commit2DmKs+0xd10/0xd14

From the ramoops log and disassembly, it looks like Commit2DmKs detects a stack-canary mismatch, calls __stack_chk_fail, and then reaches a final brk #0x5512, which causes the reboot.

The module also reports at boot:

dovi_gen_5_15_2026: disagrees about version of symbol module_layout
please rebuild ko: dovi_gen_5_15_2026
dovi_gen_5_15_2026: disagrees about version of symbol __stack_chk_fail
please rebuild ko: dovi_gen_5_15_2026

As an experiment, I changed the conditional branch to the canary-failure path inside Commit2DmKs to a nop.

The change is only four bytes:

File offset: 0x33fcc

Original: 81 1e 00 54
Patched:  1f 20 03 d5

This only bypasses the canary-failure branch in that one function. It does not disable CFI or stack protection globally.

Has anyone else investigated or tried this approach?

In particular, does anyone know whether the module’s canary access is compatible with the current 5.15.196 kernel, or whether the module_layout and __stack_chk_fail version mismatches could explain the false canary failure?

Of course.

Hi all and especially @djnice who from what I gather is the author of the FEL patch. Hopefully I got the attribution correct, if so I really appreciate your work.

I have some questions about the patched dovi.ko (5.15_2.6_dovi_patched_fix_fel.ko). I diffed it against the untouched version to see what was changed, there are 5 patches:

Function Address Patch
1 commit_reg 05CBDC disable checking disable_residual_flag if input_mode == OTT
2 commit_reg 05D894 Set Composer_Mode to 0 instead of 1
3 commit_reg 05E564 changes if ( h_ctx->last_l11_avail == 1 ) to if ( h_ctx->last_l11_avail )
4 multi_control_path 05EE74 forces if ( src_format == signal_format_enum__FORMAT_DOVI || src_format == signal_format_enum__FORMAT_DOVI_LL ) to always evaluate true
5 multi_control_path 05F5C0 forces if ( src_format == signal_format_enum__FORMAT_DOVI || src_format == signal_format_enum__FORMAT_DOVI_LL ) to always evaluate true

I was wondering if we can skip patching dovi.ko all together? Patches 4 and 5, operate on src_format which we is set in the open kernel module. I also don’t really understand the purpose of these two patches, I’d appreciate an explanation if possible.

If I understand the architecture correctly, and that is dovi.ko just prepares the registers and amdolby_vision actually writes them to hardware we can also avoid having to do patch 2 (and update the value after the call to multi_control_path).

That leaves us with patch 1 and 3. Patch 3 to me seems redundant, looking at the surrounding code last_l11_avail is only ever set to 0 or 1. Finally patch 1 is interesting as disable_residual_flag is set in only 3 places:

Set disable_residual_flag in rpu_header_read
v268 = *p_i_bits;
if ( *p_i_bits <= 0 ) {
    v275 = p_rpu_bitstream->ui_buf;
}
else {
    v269 = rdc->rpu_bitstream.pui8_ptr;
    v270 = rdc->rpu_bitstream.pui8_buffer_end;
    if ( v269 > v270 + 4 ) {
        v269 = rdc->rpu_bitstream.pui8_buffer_end;
        rdc->rpu_bitstream.pui8_ptr = v270;
    }
    v271 = *v269;
    v272 = v269[1];
    v273 = rdc->rpu_bitstream.ui_buf;
    rdc->rpu_bitstream.pui8_ptr = v269 + 2;
    v274 = (v272 & 0xFFFF00FF | (v271 << 8)) << v268;
    v268 -= 16;
    v275 = v274 | v273;
    rdc->rpu_bitstream.ui_buf = v275;
    rdc->rpu_bitstream.i_bits = v268;
}
p_rpu_bitstream->ui_buf = 2 * v275;
*p_i_bits = v268 + 1;
++*p_i_le
// here
rpu_data_header->rpu_sequence_header.disable_residual_flag = v275 < 0;
if ( a1->prev_sequence_header_available ) {
    // Irrelevant variables read [omitted]
    disable_residual_flag = a1->rpu_sequence_header_store.disable_residual_flag;
    // Other irrelevent variables set [omitted]
    rpu_data_header->rpu_sequence_header.disable_residual_flag = disable_residual_flag;
}
else {
    event_callback = a1->event_callback;
    if ( event_callback ) {
        _cfi_slowpath_diag(0x789936D4DD313E00LL, a1->event_callback, &unk_34D70);
        event_callback(S_RPU_WARNING, 259, "No previous sequence header found, using default values.");
    }
    // Other defaults set [omitted]
    rpu_data_header->rpu_sequence_header.disable_residual_flag = 1;
}
Set disable_residual_flag in rpu_decoder_process_buffer
if ( !rdc->disable_MEL_detection && detect_MEL(rdc) )
    rdc->rpu_data->rpu_data_header->rpu_sequence_header.disable_residual_flag = 1;

The one in rpu_decoder_process_buffer can be disabled using a flag (disable_MEL_detection). But it also seems correct, detect_MEL seems right internally. Finally the way it’s set in rpu_header_read also looks about right, but someone more familiar with the format might take a look. All of this to say that the patches might not be necessary.

I’m hoping that using an unpatched dovi.ko will lead to less instability.

5 Likes

i have video files that hav HDR10 AND DV.. but only plays HDR.. is that normal ? i have latest odroid n2 nightly and latest dovi.ko running

Yes, that’s expected the Odroid N2 SOC isn’t DV-licensed, the dovi.ko won’t work with it.

If you already have access to the unpatched dovi.ko file, why not just test it?

1 Like

I could, I was just hoping to have a chat with the author of the patch so I don’t waste my time

Fair enough, although testing another dovi.ko is not a very time consuming job IMHO :grinning_face:

1 Like

Just testing the unpatched dovi.ko would not be enought to get FEL, id need to make changes to the kernel as well, and that takes more time.

Ah ok. Sorry, I’m not a developer, I thought you were just talking about a drop-in replacement.

No one can compile it except Amlogic,LOL.

Dear, will we be getting a better version of dovi.ko? Just yesterday, my AM6B+ rebooted on its own while playing a DV movie.

Yes, it is on already send to a post :grimacing:

4 Likes