Getting UART on Allwinner sun8i (H2+ and EASiTEK Board)

vaughng · April 27, 2024 at 11:56 AM New

I would like to attempt porting LE or at least getting armbian running on an old Android TV box that I got for free. The box looks like a router with a green top. The label underneath says it's a "TVFrog" which I could only locate listing for online and no specifications that actually mean anything. I'm trying to avoid pulling the heat sink off because I don't have any thermal pads lying around. The device is running Android 4.4 KitKat with a sideloaded Netflix and Kodi 16.x.

Kodi reports that the device is a sun8i. The board is long and narrow. It has RCA audio/video (composite out), 2x USB, 1x HDMI out and 1x Ethernet port. HDMI can operate at up to 1080p@60Hz and it actually plays 1080p content beautifully! Netflix works well, Kodi is somewhat iffy because it's old as ever.

The board says it's a "T199 v2.0 Designed by EASiTEK". I've soldered a header to the UART pins (which are labeled GND TX RX VCC). Using a CP2102 USB to UART adapter I cannot get any output. I was hoping to get a root shell and possibly dump the existing firmware before I begin tampering. Any ideas? I'm thinking either I've set something up wrong (baud rate 115200 using minicom on /dev/tty0) or there's something that needs to be done on the board (i.e short pins) to enable UART.

IMAGES:

main-board

**chewitt** · April 27, 2024 at 6:04 PM New

The answer lies under the silver heatsink, but if the 512MB RAM sticker is correct we won't support the board even if it can boot something. All recent LE images need 1GB to run Kodi properly.

vaughng · April 27, 2024 at 6:59 PM New

Yeaaaahhh I figured as much LOL. Ah damn okay. Might just have to stick with Android I guess. I will still try a few things and see where it gets me. Fingers crossed the 512MB sticker is false. Can't seem to find the RAM chip online, only the ROM and WiFi chip are known to the internet apparently. I'll keep at it and update if I find anything but I do believe (by process of elimination and knowing that my cpu has 4 cores) that the device has either an H3 or H2+.

vaughng · April 27, 2024 at 10:03 PM New

I'm blind... If you look between the two USB ports there is a backward facing button which on the board is labelled "UBOOT RECOVER". Still no UART but it's progress nonetheless.

**chewitt** · April 28, 2024 at 5:22 AM New

It's possible to disable UART output in (u-boot) software even if the hardware is correctly wired. It's a little unusual to see that done, but some vendors do more customisation than others. Those chips don't run hot so I wouldn't be too afraid of pulling the heatsink off for a look.

**jernej** · April 28, 2024 at 8:58 AM New

Quote from vaughng

"UBOOT RECOVER"

That's FEL mode on USB. This means one of the USB ports can be used for it. It's supported on USB OTG, but from the image you provided, it's hard to say which one is it. Since I don't see any usual OTG port, it's most likely that you would need non-standard and dangerous USB A to USB A cable for it.

Sorry for further disappointing you, but this board only has NAND storage, which is not supported by LE. You could still run it from SD card, but I don't see any socket for it.

vaughng · April 28, 2024 at 4:04 PM New

jernej I have a USB-A to USB-A, I will try to look more closely at the board to see if I can tell which is the OTG port. Yes the lack of a card slot is a disappointment but I'm hoping I can force some sort of USB boot. Even if I can't run proper LE I'd like to try get some form of linux running even if I have to build my own custom image to install drivers. I've gotten x11 kodi running on armbian on my tanix tx6 before so it would be a nice experiment especially with such little RAM to work with, if it ends up being possible that is.

It's my first time hearing of FEL but I'll do some research.

Thanks chewitt ! I tried but I think it's thermal epoxied to the chip /: will try the floss trick later. The only mentions of EASiTEK I've found online are Chinese forums about other Android TV boxes.

**jernej** · April 28, 2024 at 4:12 PM New

This is it: https://linux-sunxi.org/FEL Booting can be done this way: https://linux-sunxi.org/FEL/USBBoot Unfortunately, this requires another device to boot, so it's not "proper" USB boot, like via USB stick. However, you can use FEL to boot and use USB stick for rootfs.

vaughng · April 28, 2024 at 8:45 PM New

The USB port closest to the Ethernet port appears to be the OTG port as there are more traces than necessary for USB that are going directly to the chip and I'm assuming these are the ID/VBUS for OTG although not sure how they're connected to a type A port, maybe faked when forced into FEL? The floss trick worked, I was so close, it's not an H3 but rather an H2+. Cannot identify the RAM but it is a Chinese brand (GCAI). WiFi chip is XR819.

jernej Installed sunxi-tools (thanks AUR). I see the sunxi-fel command has these options:

hex[dump] address length Dumps memory region in hex
dump address length Binary memory dump

does that mean I can dump firmware from the device's NAND flash by cycling through the addresses? Or does memory in this case mean RAM?

**jernej** · April 28, 2024 at 9:00 PM New

You can only access whatever is memory mapped, so RAM and peripherals. In any case, I would suggest to run "ver" first to see if it works.

vaughng · April 28, 2024 at 9:54 PM New

Now we're getting somewhere. Turns out the extra traces are for power to be fed back into the USB port. After connecting the USB-A to USB-A cable, the device powered on! Never seen this before so it's pretty cool, but I guess it's just a hacked OTG port with a type A connector. In any case, I disconnected the cable, held the recover button and reconnected - success.

Bus 001 Device 064: ID 1f3a:efe8 Allwinner Technology sunxi SoC OTG connector in FEL/flashing mode

jernej The output of sunxi-fel ver is:

AWUSBFEX soc=00001680(H3) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000

EDIT: I will check for serial output in a bit, the FEL docs say there may serial output now.

**jernej** · April 28, 2024 at 10:05 PM New

Nope, FEL doesn't produce serial output on its own. But you can run binary which it can produce some.

vaughng · April 30, 2024 at 10:57 AM New

So I've played around with some binaries but can't seem to find any compatible ones. Running sunxi-fel write xxxxxxxx fes1.bin and sunxi-fel exec xxxxxxxx results in FEL crashing (fes1.bin is the NES Classic binary for dumping firmware I think, read a tutoiral...).

Can anyone direct me towards resources regarding finding/building binaries that will work with this board? I'm very new to low level stuff but I do understand the basics such as addresses and hex data. Are the binaries board specific or chip specific?

EDIT: This is the tutorial that I was reading through: https://xor.co.za/post/2018-12-01-fel-bootprocess/

vaughng · April 30, 2024 at 12:43 PM New

A huge thanks to everyone who has/is responding to my noob questions. I really appreciate it especially @/jernej (avoiding a mention).

Follow up question

What uboot compatible board is closest in configuration to mine? [H2+/H3] [512MB RAM] [8GB Sandisk ROM]

Or is there a way to read find/create a config for my board? I read some of the existing configs but I'm not familiar with all the variables or how to retrieve them. I'm at the "Booting U-Boot over USB" section of the FEL/USBBoot doc.

**jernej** · April 30, 2024 at 9:04 PM New

Making proper board support means creating device tree file and proper U-Boot configuration. This gives you board specific binaries which can be also used for FEL booting. In the H3/H2+ era, this was done by first dumping firmware from the board and extracting script.bin, which is then converted to human readable named script.fex. This file contains all board specific configuration, which is used for creating device tree file and U-Boot config. In any case, you have to first obtain access to existing system, so you can dump it. Since UART doesn't work, I don't have idea how to do that.

vaughng · April 30, 2024 at 11:05 PM New

Thanks for the info! I'll dig deeper and see what I can do about it. Much appreciated.

vaughng · May 1, 2024 at 8:39 PM New

So... I found this regarding reading the required information via FEL mode. However, running these commands:

./sunxi-fel read 0x42400000 0x82d0 boot1.header
./sunxi-fel read 0x43000000 0x20000 script.bin

fail with usb_bulk_send() ERROR -7: Operation timed out which I believe may be related to size limits as outline here.

I don't know what length would be appropriate to avoid the error. If I knew how addresses work (I read something about 8 bits but didn't quite grasp it) I could script a read in chunks and concatenate them into a single binary. Apologies, I know I need to learn on my own but if someone could just point me in the right direction I'll figure it out myself. Many thanks

EDIT: Ignore the above, boot1 isn't loaded so cannot be read. My bad!