NTech NBox 3S

Post Reply
sloppyturtle19
Posts: 5
Joined: Sat Nov 09, 2019 12:43 am
languages_spoken: english
ODROIDs: None
Has thanked: 1 time
Been thanked: 0
Contact:

NTech NBox 3S

Post by sloppyturtle19 »

Hello everybody!

I am not sure this is the right place to ask this but I'll try.

I have an NTech NBox 3S that has similar specs to the Odroid C2, so I thought maybe I will find help here.

This is the device: http://www.ntech.pt/index.php/mini-pc/nbox-3s

Now it came with Android Nougat and I would like to get rid of that and install Linux, preferably Arch. I found a release that fits the architecture but I can not get the box to boot from SD card. There is no boot switch or anything like that and the eMMC with Android on it is soldered onto the board. So I can't take it out.

I have a root shell in Android and poked around a bit but have no idea how the bootloader works.

Any ideas would be appreciated.

Thanks!

mad_ady
Posts: 8464
Joined: Wed Jul 15, 2015 5:00 pm
languages_spoken: english
ODROIDs: XU4, C1+, C2, C4, N1, N2, H2, Go, Go Advance
Location: Bucharest, Romania
Has thanked: 577 times
Been thanked: 461 times
Contact:

Re: NTech NBox 3S

Post by mad_ady »

It says it's a CPU QC A53 Amlogic S905W, so not identical to C2.

If you have access to the emmc pins you can try to disable it by setting Chip Select pin to 0. You'll also need to find the serial port and make sure it works.
With emmc invalidated it should try to boot from SD.

You'll need to flash an sd card with linux and procure a suitable uboot for your board. You can try with C2's uboot, but I think it does board validation and will not boot unless it's a HK board (protection against hardware piracy from competitors).This will be the hardest step - getting into uboot.

Who knows - with serial access you might be able to use the emmc uboot (press enter twice during boot) and be able to have it load a different OS from SD.
These users thanked the author mad_ady for the post:
sloppyturtle19 (Sat Nov 09, 2019 2:38 am)

sloppyturtle19
Posts: 5
Joined: Sat Nov 09, 2019 12:43 am
languages_spoken: english
ODROIDs: None
Has thanked: 1 time
Been thanked: 0
Contact:

Re: NTech NBox 3S

Post by sloppyturtle19 »

Thank you for your reply and yes I was wrong about the CPU.

Being a hardware noob I can't see all that much on the PCB and there don't seem to be accessible pins for the eMMC or a serial port.

The eMMC is a THGBMBG7D2KBAIL by Toshiba. I am attaching some pictures, maybe you see something that I don't?
photo_2019-11-08_17-32-41.jpg
photo_2019-11-08_17-32-41.jpg (99.75 KiB) Viewed 1718 times
photo_2019-11-08_17-32-38.jpg
photo_2019-11-08_17-32-38.jpg (130.88 KiB) Viewed 1718 times
photo_2019-11-08_17-32-34.jpg
photo_2019-11-08_17-32-34.jpg (184.96 KiB) Viewed 1718 times
photo_2019-11-08_17-32-24.jpg
photo_2019-11-08_17-32-24.jpg (173.64 KiB) Viewed 1718 times

mad_ady
Posts: 8464
Joined: Wed Jul 15, 2015 5:00 pm
languages_spoken: english
ODROIDs: XU4, C1+, C2, C4, N1, N2, H2, Go, Go Advance
Location: Bucharest, Romania
Has thanked: 577 times
Been thanked: 461 times
Contact:

Re: NTech NBox 3S

Post by mad_ady »

The thing on the bottom with 4 holes in the last picture looks like a serial port header. Have a look at this video for ideas: https://youtu.be/h5PRvBpLuJs
It should be 3.3V.

sloppyturtle19
Posts: 5
Joined: Sat Nov 09, 2019 12:43 am
languages_spoken: english
ODROIDs: None
Has thanked: 1 time
Been thanked: 0
Contact:

Re: NTech NBox 3S

Post by sloppyturtle19 »

Ok I have connected the board to an Arduino like so:

nbox TX ----> Arduino RX
nbox GND ----> Arduino GND

I have NOT connected nbox RX ----> Arduino TX, because it could fry my board right? I read that a voltage divider could be used.

This is the sketch on the Arduino:

Code: Select all

void setup() {
  Serial.begin(9600);
}

void loop() {
  if (Serial.available() > 0)
  {
    char data = Serial.read();
    Serial.print(data, DEC);
  }
}
It outputs a bunch of numbers, as expected:

Code: Select all

15-15-56-27-25-56-15-29-15-56-27-54-27-54-27-11-27-48-25-48-14-48-54-11-64-911
...and so forth.

When I instead use:

Code: Select all

Serial.print(data);
..without the decimal flag it just prints out garbage.

But I have no idea where to go from here?

Is it possible to decode this into something useful?

mad_ady
Posts: 8464
Joined: Wed Jul 15, 2015 5:00 pm
languages_spoken: english
ODROIDs: XU4, C1+, C2, C4, N1, N2, H2, Go, Go Advance
Location: Bucharest, Romania
Has thanked: 577 times
Been thanked: 461 times
Contact:

Re: NTech NBox 3S

Post by mad_ady »

You need to ensure that voltage is 3.3 and not 5V or it can fry your board.
Try all the baud rates, starting with 115200, which is the default rate on C2

sloppyturtle19
Posts: 5
Joined: Sat Nov 09, 2019 12:43 am
languages_spoken: english
ODROIDs: None
Has thanked: 1 time
Been thanked: 0
Contact:

Re: NTech NBox 3S

Post by sloppyturtle19 »

I ordered a logic level shifter online and it finally arrived.

So I hooked it up between my Arduino and the NBox board. Setting the baud rate to 115200 worked and I am getting output (exciting!). This is what I get during boot of the device:

Code: Select all

GXL:BL1:9ac50e:bb16dc;FEAT:ADFC318C:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;             
TE: 57472                                                                              

BL2 Built : 20:32:17, Sep  8 2017. 
gxl g6296b83 - xiaobo.gu@droid12

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 12
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz
Rank0: 2048MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from eMMC, src: 0x00020200, des: 0x05100000, size: 0x0002c600
Load bl33 from eMMC, src: 0x00050200, des: 0x01000000, size: 0x00065e00
NOTICE:  BL3-1: v1.0(release):a625749
NOTICE:  BL3-1: Built : 11:25:15, Aug 25 2017
[BL31]: GXL CPU setup!
NOTICE:  BL31: BL33 decompress pass
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0xa4
e6 f9 ea c7 8d 13 79 ca 80 31 7e 1d [0.280663 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01-gfd7a7e0 (Nov 03 2018 - 00:13:32)

DRAM:  2 GiB
Relocation Offset is: 76eb3000
register usb cfg[0][1] = 0000000077f5a930
[CANVAS]canvas init
boot_device_flag : 1
set wlan gpio pin 6.
set bluetooth gpio pin 17.
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC:   aml_priv->desc_buf = 0x0000000073eb3790
aml_priv->desc_buf = 0x0000000073eb5ab0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
 init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 5f4c4d41
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p281 variant: 2g
        dtb 0 soc: gxl   plat: p281   vari: 1g
        dtb 1 soc: gxl   plat: p281   vari: 2g
      Find match dtb: 1
start dts,buffer=0000000073eb8300,dt_addr=0000000073ec3300
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p281 variant: 2g
        dtb 0 soc: gxl   plat: p281   vari: 1g
        dtb 1 soc: gxl   plat: p281   vari: 2g
      Find match dtb: 1
parts: 10
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06:      boot   0000000002000000 1
07:    system   0000000080000000 1
08:     cache   0000000020000000 2
09:      data   ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000 
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 5615f53e, store 5615f53e
_verify_dt b_checksum()-917: calc 5615f53e, store 5615f53e
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p281 variant: 2g
        dtb 0 soc: gxl   plat: p281   vari: 1g
        dtb 1 soc: gxl   plat: p281   vari: 2g
      Find match dtb: 1
vpu: clk_level in dts: 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
hpd_state=0
cvbs performance type = 6, table = 0
Net:   dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0 
active slot = 0 
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7fb00000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7fb00000
[CANVAS]addr=0x7fb00000 width=3840, height=2160
 amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
gpio: pin GPIOAO_2 (gpio 102) value is 1
InUsbBurn


noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
gxl_p281_v1# 0 
Unknown command '0' - try 'help'
gxl_p281_v1#
Unknown command '0' - try 'help'
gxl_p281_v1#gxl_p281_v1# 0 
Unknown command 'gxl_p281_v1#' - try 'help'
gxl_p281_v1#
Unknown command 'gxl_p281_v1#' - try 'help'
gxl_p281_v1#
Unknown command 'gxl_p281_v1#' - try 'help'
gxl_p281_v1#Unknown command '0' - try 'help'
Unknown command 'Unknown' - try 'help'
gxl_p281_v1#
Unknown command 'Unknown' - try 'help'
gxl_p281_v1#gxl_p281_v1#v1#gxl_p281_v1# vvv1#Unknown command '0' - try 'helvv1#gxl_p281_v1#v1#gxl_p281_v1'
So there seems to be some interesting stuff in there. What I could not figure out though is how to send a command. I would like to send "Enter" during boot to get into the uboot menu for example.

I have tried both minicom and the Arduino serial monitor. Now my question is do I need to put something in the sketch on the Arduino so that it writes the commands it receives from the computer via USB out to the TX pin?

mad_ady
Posts: 8464
Joined: Wed Jul 15, 2015 5:00 pm
languages_spoken: english
ODROIDs: XU4, C1+, C2, C4, N1, N2, H2, Go, Go Advance
Location: Bucharest, Romania
Has thanked: 577 times
Been thanked: 461 times
Contact:

Re: NTech NBox 3S

Post by mad_ady »

It does look good. First - I'd try to convert the Arduino into a usb to serial adapter so that you can type interactivelly. That way you can explore around.
You have already broken into the uboot shell. Typing enter will just repeat the previous command.
Now you'll need to learn uboot and see:
1. Dump the uboot environment (printenv)
2. Figure out how Android Boots
3. See if you attach an SD card if uboot sees it.
4. Add a kernel/dtb/initrd and rootfs on the SD card and have uboot try to load kernel/dtb and initrd. If the kernel parameters are ok it should eventually boot to linux. You'll need to get the kernel/dtb/initrd for your board. You can even try to boot the android kernel, but point it to a linux rootfs (you can flash a SD card with a C2 image) and try to change root=/path/to/sd/partition

Document your work for yourself/posterity.
Once you can boot you can start worrying about how to automate it...

sloppyturtle19
Posts: 5
Joined: Sat Nov 09, 2019 12:43 am
languages_spoken: english
ODROIDs: None
Has thanked: 1 time
Been thanked: 0
Contact:

Re: NTech NBox 3S

Post by sloppyturtle19 »

Ok I have a proper serial console now with minicom, I wired the Arduino GND to RESET and am in the uboot console.

printenv looks like this:

Code: Select all

1080p60hz_deepcolor=444,8bit
EnableSelinux=permissive
active_slot=_a
aml_dt=gxl_p281_2g
baudrate=115200
bcb_cmd=get_valid_slot;
boot_part=/dev/mmcblk1p1
bootargs=rootfstype=ext4 init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissia
bootcmd=run storeboot
bootdelay=1
bootup_offset=0x110dc0f0
bootup_size=0x3f4848
cmdline_keys=if keyman init 0x1234; then if keyman read usid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.serialno=${usid};setenv serial ${usid};fi;if keyman read mac ${loadaddr} str; then seten;
colorattribute=444,8bit
condev=console=ttyS0,115200n8 console=tty0
cvbs_drv=0
cvbsmode=576cvbs
display_bpp=16
display_color_bg=0
display_color_fg=0xffff
display_color_index=16
display_height=576
display_layer=osd1
display_width=720
dtb_loadaddr=0x1000000
dtb_mem_addr=0x1000000
ethact=dwmac.c9410000
ethaddr=ee:1a:d4:50:39:57
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb s 
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
filesize=70f83d
firstboot=0
gatewayip=10.18.9.1
hdmimode=1080p60hz
hostname=arm_gxbb
identifyWaitTime=750
init_display=osd open;osd clear;imgread pic logo bootup $loadaddr;bmp display $bootup_offset;bmp scale
initargs=rootfstype=ext4 init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000
initrd_loadaddr=0x13000000
ipaddr=10.18.9.97
jtag=apao
loadaddr=0x11000000
mac=96:44:30:32:63:57
maxcpus=4
netmask=255.255.255.0
outputmode=576cvbs
preboot=run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run init_display;run storeargs;run upgrade_key;run switch_bootmode;
reboot_mode=cold_boot
recovery_from_flash=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if itest ${upgrade_step} == 3; then if ext4load mmc 1:2 ${dtb_mem_addr} /recovery/;
recovery_from_sdcard=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if fatload mmc 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatl;
recovery_from_udisk=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatlo;
recovery_offset=0
recovery_part=recovery
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
serverip=10.18.9.113
stderr=serial
stdin=serial
stdout=serial
storeargs=setenv bootargs ${initargs} androidboot.selinux=${EnableSelinux} logo=${display_layer},loaded,${fb_addr},${outputmode} maxcpus=${maxcpus} vout=${outputmode},enable hdmimode=${hdmimode} cvbsmode=${cvbsm;
storeboot=if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run update;
switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then run recovery_from_flash;else if test ${reboot_mode} = update; then run update;else if test ${reboot_mode} = cold_boot; then run try_aut;
try_auto_burn=update 700 750;
update=run usb_burning; run sdc_burning; if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else fi;
upgrade_key=if gpio input GPIOAO_2; then echo detect upgrade key; sleep 3;if gpio input GPIOAO_2; then run update; fi;fi;
upgrade_step=2
usb_burning=update 1000
wipe_cache=successful
wipe_data=successful
When I insert an SD card I can see it with ext4ls or fatls.

First I flashed the Arch Linux Odroid-C2 image to SD (https://archlinuxarm.org/platforms/armv ... /odroid-c2).

Then I tried to load it into memory:

Code: Select all

setenv loadaddr "0x11000000"
setenv dtb_loadaddr "0x1000000"
setenv initrd_loadaddr "0x13000000"

ext4load mmc 0:1 ${dtb_loadaddr} /boot/dtbs/meson64_odroidc2.dtb
ext4load mmc 0:1 ${loadaddr} /boot/Image
ext4load mmc 0:1 ${initrd_loadaddr} /boot/initramfs-linux.img
and run it with:

Code: Select all

booti ${loadaddr} ${initrd_loadaddr} ${dtb_loadaddr}
That gave me the error:

Code: Select all

[rsvmem] get fdtaddr NULL!
rsvmem - reserve memory

Usage:
rsvmem check                   - check reserved memory
rsvmem dump                    - dump reserved memory

rsvmem check failed
Wrong Ramdisk Image Format
Ramdisk image is corrupt or invalid
So it doesn't like the ramdisk image (because it is not in a uboot wrapper?)

Then I tried Ubuntu 18.4 minimal and loaded it like this:

Code: Select all

fatload mmc 0:1 ${dtb_loadaddr} /meson64_odroidc2.dtb
fatload mmc 0:1 ${loadaddr} /image
fatload mmc 0:1 ${initrd_loadaddr} /uinitrd
That got me a little further but hangs right after "Starting kernel ...":

Code: Select all

[rsvmem] get fdtaddr NULL!
rsvmem - reserve memory

Usage:
rsvmem check                   - check reserved memory
rsvmem dump                    - dump reserved memory

rsvmem check failed
## Loading init Ramdisk from Legacy Image at 13000000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (uncompressed)
   Data Size:    7671655 Bytes = 7.3 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
load dtb from 0x1000000 ......
      Amlogic multi-dtb tool
      Single dtb detected
## Flattened Device Tree blob at 01000000
   Booting using the fdt blob at 0x1000000
[rsvmem] env set fail.
   Loading Ramdisk to 73750000, end 73ea0f67 ... OK
   Loading Device Tree to 000000001fff5000, end 000000001ffff506 ... OK
fdt_instaboot: no instaboot image

Starting kernel ...

uboot time: 116602962 us
When I try to boot normally by just restarting the device it gets stuck with a lot of these messages:

Code: Select all

[   12.039654@1] FAT-fs (mmcblk1p1): bogus number of reserved sectors
[   12.040199@1] FAT-fs (mmcblk1p1): Can't find a valid FAT filesystem
[   12.048093@1] FAT-fs (mmcblk1p1): bogus number of reserved sectors
[   12.052619@1] FAT-fs (mmcblk1p1): Can't find a valid FAT filesystem
[   12.060719@1] FAT-fs (mmcblk1): invalid media value (0xbf)
[   12.064175@1] FAT-fs (mmcblk1): Can't find a valid FAT filesystem
[   12.071946@1] FAT-fs (mmcblk1): invalid media value (0xbf)
[   12.075645@1] FAT-fs (mmcblk1): Can't find a valid FAT filesystem

That is probably because i messed with the settings in uboot.

How can I convince it to boot from the SD card?

mad_ady
Posts: 8464
Joined: Wed Jul 15, 2015 5:00 pm
languages_spoken: english
ODROIDs: XU4, C1+, C2, C4, N1, N2, H2, Go, Go Advance
Location: Bucharest, Romania
Has thanked: 577 times
Been thanked: 461 times
Contact:

Re: NTech NBox 3S

Post by mad_ady »

How can I convince it to boot from the SD card
I don't know... That's as far as I can take you...

Post Reply

Return to “General Topics”

Who is online

Users browsing this forum: No registered users and 2 guests