SMDC DV6067Y boot from eMMC

Hi,

I’ve got my hands on an DV6067Y from SDMC, based on an S905Y2 SoC. It boots the latest 9.2.5 stable from an USB drive, which works pretty fine (although USB seems to be a bit slow). Now I’ve tried to install CE to the eMMC, which SEEMS to work at first:

ceemmc -vx

Starting CoreELEC eMMC installation tool...

System is not supported: g12a_s905y2_2g!

There is NO official support by Team CoreELEC
if you continue to run this tool!
Continue? [y]: y

eMMC size: 0x0001d2000000 [8GB]

Original partition table:
[mmcblk0p01]           bootloader  offset 0x000000000000, size 0x000000400000 [4 MB], unkn
[mmcblk0p02]             reserved  offset 0x000002400000, size 0x000004000000 [64 MB], unkn
[mmcblk0p03]                cache  offset 0x000006c00000, size 0x000046000000 [1120 MB], cache
[mmcblk0p04]                  env  offset 0x00004d400000, size 0x000000800000 [8 MB], unkn
[mmcblk0p05]                 logo  offset 0x00004e400000, size 0x000000800000 [8 MB], code
[mmcblk0p06]             recovery  offset 0x00004f400000, size 0x000001800000 [24 MB], code
[mmcblk0p07]                 misc  offset 0x000051400000, size 0x000000800000 [8 MB], code
[mmcblk0p08]                 dtbo  offset 0x000052400000, size 0x000000800000 [8 MB], code
[mmcblk0p09]             cri_data  offset 0x000053400000, size 0x000000800000 [8 MB], cache
[mmcblk0p10]                param  offset 0x000054400000, size 0x000001000000 [16 MB], cache
[mmcblk0p11]                 boot  offset 0x000055c00000, size 0x000001000000 [16 MB], code
[mmcblk0p12]                  rsv  offset 0x000057400000, size 0x000001000000 [16 MB], code
[mmcblk0p13]             metadata  offset 0x000058c00000, size 0x000001000000 [16 MB], code
[mmcblk0p14]               vbmeta  offset 0x00005a400000, size 0x000000200000 [2 MB], code
[mmcblk0p15]                  tee  offset 0x00005ae00000, size 0x000002000000 [32 MB], code
[mmcblk0p16]               vendor  offset 0x00005d600000, size 0x000010000000 [256 MB], code
[mmcblk0p17]                  odm  offset 0x00006de00000, size 0x000001000000 [16 MB], code
[mmcblk0p18]               system  offset 0x00006f600000, size 0x000050000000 [1280 MB], code
[mmcblk0p19]              product  offset 0x0000bfe00000, size 0x000001000000 [16 MB], code
[mmcblk0p20]                 data  offset 0x0000c1600000, size 0x000110a00000 [4362 MB], data

No CoreELEC installation found on eMMC

Install in dual boot mode, CoreELEC and Android on eMMC
  Use CoreELEC data from
    [1] current used SD or USB device
    [2] existing backup on current used SD or USB device

Install in single boot mode, only CoreELEC on eMMC
  Use CoreELEC data from
    [3] current used SD or USB device
    [4] existing backup on current used SD or USB device

Please choose one option? [1/2/3/4]: 3

Free space of 'partition CE_FLASH': 512MB
Warning: Could not find 'dto' partition!
Free space of 'partition CE_STORAGE': 6844MB

New partition table:
[mmcblk0p01]           bootloader  offset 0x000000000000, size 0x000000400000 [4 MB], unkn
[mmcblk0p02]                  env  offset 0x000000400000, size 0x000000800000 [8 MB], unkn
[mmcblk0p03]                 misc  offset 0x000000c00000, size 0x000000800000 [8 MB], code
[mmcblk0p04]                 logo  offset 0x000001400000, size 0x000000800000 [8 MB], code
[mmcblk0p05]                 dtbo  offset 0x000001c00000, size 0x000000800000 [8 MB], code
[mmcblk0p06]             reserved  offset 0x000002400000, size 0x000004000000 [64 MB], unkn
[mmcblk0p07]             CE_FLASH  offset 0x000006400000, size 0x000020000000 [512 MB], data
[mmcblk0p08]           CE_STORAGE  offset 0x000026400000, size 0x0001abc00000 [6844 MB], data

Used space of '/flash': 222MB
Used space of '/storage': 642MB

There is enough free space on eMMC for installation!

Install CoreELEC on eMMC.
Continue? [y]: y

Moved 'env' from offset 0x00004d400000, size 0x000000800000 to offset 0x000000400000
Moved 'misc' from offset 0x000051400000, size 0x000000800000 to offset 0x000000c00000
Moved 'logo' from offset 0x00004e400000, size 0x000000800000 to offset 0x000001400000
Moved 'dtbo' from offset 0x000052400000, size 0x000000800000 to offset 0x000001c00000

Starting to format the new 'CE_STORAGE' partition...
mke2fs 1.45.3 (14-Jul-2019)
Discarding device blocks: done
Creating filesystem with 1752064 4k blocks and 438048 inodes
Filesystem UUID: feb25a7f-24b2-4373-94df-5a66099ac324
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done


Starting to format the new 'CE_FLASH' partition...
mkfs.fat 4.1 (2017-01-24)
Stopping Kodi before start of copy process!

Starting copying of data to the eMMC!
Please do NOT interrupt this progress till it's finished!

Copy all data from '/flash' to '/media/CE_FLASH'
        222.89M 100%   33.67MB/s    0:00:06 (xfr#69, to-chk=0/73)

Syncthing, please wait...
Copy all data from '/storage' to '/media/CE_STORAGE/coreelec_storage'
        642.92M  99%   22.59MB/s    0:00:27 (xfr#2595, to-chk=0/3174)

Syncthing, please wait...
Start Kodi again to have a user interface!

Success!


You can now power off the device, remove the used boot media (SD or USB) and
power on again to boot the device from eMMC!

After restarting and pulling the USB drive, the device just displays a black screen, not booting from eMMC, no error, nothing…

I noticed that if I restart and boot from USB again, ceemmc doesn’t detect a CE installation on the eMMC:

No CoreELEC installation found on eMMC

Also if I try use ceemmc twice wothout rebooting, I get the following error:

eMMC size: 0x0001d2000000 [8GB]
Partition '/dev/reserved' does not exist!
Failed to read original partition table!

Don’t know if that gives any clue about what’s the problem here.

Regards

Daniel

Looks like your box is using unrooted firmware. My suggestion: run from SD Card.

You mean a locked bootloader? The device sadly has no SD card slot, only USB over Y-OTG cable, which is a bit slow.

CE can boot from USB. I am afraid that might be your only option atm, unless you can find rooted firmware and flash it onto the box., or find some other way to root the box.

Like I said, it boots fine from USB :slight_smile: I just wanted to try eMMC because USB it’s kinda slow on this device. I don’t think there will a way to unlock the bootloader because the device is sold rebranded (MegantaTV Stick) as a Fire TV competitor by a big german telephone company/ISP.

Maybe you could try an OTG Pen Drive? The OTG cable is most likely a bottleneck.

I did some research on your device and it has a Micro-USB charging port with a maximum signaling rate of 480 Mbit/s (60 MB/s) which makes it USB 2.0 compliant. The average, cheap, no-name, 8GB Micro SD Card averages 90MB/s, while standard eMMC averages around 400 MB/s.

60 MB/s might not seem like a lot, however, consider this: CE would run similar to running on a S905X with 1GB Ram, which is tolerable as long as you don’t have long playlists, those would take forever to load (Amazon VOD is bad for this, but fortunately caches it’s playlists so it’s usually a one time experience). NetFlix, YouTube, PlutoTV, Tubi etc addons should run smooth as long as you don’t ask for more than 720p.

51pgZHe4X3L.AC

I’m aware of this. The Raw throughput on USB isn’t the problem. Core CE fuctions run fast enough from USB, however I wanted to use the device for retro gaming with ROM collection browser and that’s where USB Flash-Memory bottlenecks because of the amount of cover art files and stuff… eMMC would have been a much faster option in terms of file access times.

That ain’t going to happen

Works fine besides loading RCB being very slow from USB.

Anyway, that’s not what I wanted to discuss. The device works fine for what I intended to do with it. I just wanted know if there’s a way to get CE running from the eMMC to get a speed bump on everything I/O related.

As far as I understand, a locked bootlaoder also prevents CE booting from USB. Can somebody confirm this? Maybe the device has no locked bootloader but needs some ceemmc tweaks to boot from eMMC.

Looks like nobody has figured out yet how to root the device.

Rooting Android wouldn’t help anyway.

Bootloader unlock(if it’s locked) would be helpful.

I opened up the device, there seems to be a UART header. If I find time, I clean up my workbench and solder some jumper wires to it. Hupefully I can get some logs…

Here we go:

▒▒▒▒▒▒▒▒G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:0;READ:0;1.0;                                                                                                                                                             1.0;
    bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0001 - pwm id 0x00
bl2_stage_init 0xc0
bl2_stage_init 0x02

L0:0000037f
L1:00000701
L2:00008060
L3:04000000
S1:00000000
B2:00032060
B1:f2f939b2

TE: 277488

BL2 Built : 10:46:59, Jan 14 2019. g12a g152d217 - guotai.shen@droid11-sz

Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
CPU clk: 1200 MHz
Set clk81 to 166.6M
eMMC boot @ 0
sw8 s
sd/emmc cmd 8 arg 0x00000000 status 01ff3000
OTP_ARB=00000001
DDR driver_vesion: LPDDR4_PHY_V_0_1_11 build time: Jan 14 2019 10:46:56
board id: 1
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part                                                                                                                                                             : 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part:                                                                                                                                                              0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part:                                                                                                                                                              0
PIEI prepare done
Cfg max: 6, cur: 1. Board id: 255. Force loop cfg
DDR4 probe
ddr clk to 1200MHz
Load ddrfw from eMMC, src: 0x00014200, des: 0xfffd0000, size: 0x0000c000, part:                                                                                                                                                              0
Check phy result
INFO : End of initialization
INFO : End of read enable training
INFO : End of fine write leveling
INFO : STREAM 0x00490002 - 0x00000000 0x00000000
INFO : STREAM 0x04020000 -
INFO : ERROR : Training has failed!
1D training failed
Cfg max: 6, cur: 2. Board id: 255. Force loop cfg
DDR3 probe
ddr clk to 912MHz
Load ddrfw from eMMC, src: 0x0002c200, des: 0xfffd0000, size: 0x0000c000, part:                                                                                                                                                              0
Check phy result
INFO : End of initialization
INFO : End of read enable training
INFO : End of fine write leveling
INFO : End of read dq deskew training
INFO : End of MPR read delay center optimization
INFO : End of Write leveling coarse delay
INFO : End of write delay center optimization
INFO : End of read delay center optimization
INFO : End of max read latency training
INFO : Training has run successfully!

 ddr scramble enable
1D training succeed
auto size-- 65535DDR cs0 size: 1024MB
DDR cs1 size: 1024MB
DMC_DDR_CTRL: 0020001bDDR size: 2048MB
cs0 DataBus test pass
cs1 DataBus test pass
cs0 AddrBus test pass
cs1 AddrBus test pass
 pre test  bdlr_100_average==507 bdlr_100_min==507 bdlr_100_max==507 bdlr_100_cu                                                                                                                                                             r==507
 aft test  bdlr_100_average==507 bdlr_100_min==507 bdlr_100_max==507 bdlr_100_cu                                                                                                                                                             r==507
100bdlr_step_size ps== 512
result report
boot times 0Enable ddr reg access
00000000
emmc switch 3 ok
BL2: rpmb counter: 0x00000024
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part                                                                                                                                                             : 0
Load BL3X from eMMC, src: 0x0006c200, des: 0x0175c000, size: 0x00104000, part: 0
bl2z: ptr: 0512a330, size: 00001e40
1.0;1.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x01010101
MVN_2=0x01010000
[Image: g12a_v1.1.3375-8f9c8a7 2019-01-24 10:39:12 guotai.shen@droid11-sz]
OPS=0x30
ring efuse init
28 0b 30 00 01 16 25 00 00 02 35 30 56 47 4d 50
[0.017299 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):ccc7ca6da
NOTICE:  BL31: Built : 14:52:59, Apr 27 2020
NOTICE:  BL31: G12A secure boot!
NOTICE:  BL31: BL33 decompress pass
INFO:    BL3-2: ATOS-V2.4-239-g48b8c37d #1 Wed Feb  5 09:34:44 UTC 2020 arm
INFO:    BL3-2: Chip: G12A Rev: B (28:B - 30:2)
INFO:    BL3-2: crypto engine DMA
INFO:    BL3-2: secure time TEE
INFO:    BL3-2: CONFIG_DEVICE_SECURE 0xb200000e


U-Boot 2015.01-gd02c381 (Nov 14 2020 - 11:28:20)

DRAM:  2 GiB
Relocation Offset is: 76e68000
▒pi_post_bind(spifc): req_seq = 0

BL3-2 is the secure blob from Amlogic.
Looks like BL33 (u-boot) is loaded in secure memory. Normally the log continue posting on UART. Your log just stop.

Yes, it just stops there.

FYI: That’s the boot process AFTER I tried ceemmc and WIHTOUT inserted USB Drive with CE on it.

With inserted CE USB drive, log stops at the exact same spot. Like UART is tuned off at this point.

ram drive.

if you could run “df” command it would tell.

There is no working OS on the eMMC that could execute any commandline tools…