Flashing U-Boot on Radxa Zero failed

#1

Hi everyone!
I’m trying to flash U-Boot to a Radxa Zero with eMMC using the official guide
I successfully build u-boot.bin and was able to sideload the binary and access the u-boot shell via ttyUSB/UART.

When I’m trying to flash u-boot.bin to eMMC with following steps:

Flash U-Boot to eMMC (ONLY FOR BRANCH 2021.01, DOES NOT WORK WITH ABOVE BUILD) <- checked with cd u-boot && git branch -> radxa-zero-v2021.01
We use fastboot to flash U-Boot to eMMC. Unplug microSD card from Zero and press & hold the usb boot button, then connect Zero to your PC.

 sudo apt install fastboot
 wget https://dl.radxa.com/zero/images/loader/rz-fastboot-loader.bin
 boot-g12.py rz-fastboot-loader.bin
 sudo fastboot flash 0x200 /path/to/fip/radxa-zero/u-boot.bin
 sudo fastboot reboot

I get the error:

sudo fastboot flash 0x200 fip/radxa-zero/u-boot.bin
Sending '0x200' (1447 KB)                          OKAY [  0.085s]
Writing '0x200'                                    FAILED (remote: 'no such device')

When I’m typing
sudo fastboot devices -l

I see an entry
RADXA fastboot usb:3-1

What I’m missing here?
The end goal is to build a custom U-Boot image, write a custom uEnv.txt which loads a custom Kernel and rootfs.

Thanks in advance!

#2

Yeah, that guide is outdated. The “0x200” fastboot device only works on an older version of U-Boot. You can read about my U-Boot adventures here: Please help me understand how U-Boot works on this board

The instructions here may be more helpful: https://wiki.radxa.com/Zero/install/Boot_Troubleshooting#Modify_bootloader_on_eMMC

#3

@theophile Thanks for your reply! Especially your last post was helpfull. Still there is something strange going on that I can’t figure out.

I build a custom U-Boot as described in the official documentaion. I can verify this by the build number presented when booting up (U-Boot 2021.01-20513-g7da35aca65) and a custom shell promt that I modified with cd u-boot, make menuconfig, Command line interface --->, Shell prompt

I was able to flash this U-Boot image with sudo fastboot flash mmc0boot0 fip/radxa-zero/u-boot.bin.sd.bin and the debug console output was:


** Bad device specification mmc mmc0boot0_a **
Couldn't find partition mmc mmc0boot0_a
** Bad device specification mmc mmc0boot0 **
Couldn't find partition mmc mmc0boot0
Starting download of 1428336 bytes

..........
downloading of 1428336 bytes finished
........ wrote 1428480 bytes to EMMC_BOOT1

# As a sidenote, can someone explain whats up with mmc mmc0boot0_a? Where can change this behaviour?

Seems there is no mmcboot0 partition.

Then I plug in the device to USB and it automatically loads my U-Boot image. So far so good. Where would I place my uEnvt.txt to describe how and which kernel to load and which rootfs to use. sudo boot-g12.py rz-udisk-loader.bin shows nothing to mount but loads the stock bootloader (U-Boot 2022.04-00001-gaf4d42d7). Are there alternative ways rather than with uEnvt.txt?

Important!

After erasing…

sudo fastboot erase mmc0
sudo fastboot erase mmc0boot0
sudo fastboot erase mmc0boot1

When pluged in the radxa zero in USB mode and executed sudo boot-g12.py rz-fastboot-loader.bin, the device boot up to a stock U-Boot (U-Boot 2022.04-00001-gaf4d42d7) and I’m able to aceess the console. From my perspective it is a security concern since you can access the eMMC partition where our application is stored and potentially modify it as an attacker. Please elobarate if I’m wrong. Security is of an essence fo my project


U-Boot 2022.04-00001-gaf4d42d7 (Jun 29 2022 - 15:19:49 +0800) radxa-zero
Model: Radxa Zero
SoC: Amlogic Meson G12A (S905Y2) Revision 28:b (30:2)
DRAM: 1 GiB
Core: 375 devices, 20 uclasses, devicetree: separate
MMC: sd@ffe03000: 0, sd@ffe05000: 1, mmc@ffe07000: 2
Loading Environment from nowhere... OK
In: serial
Out: serial
Err: serial
Net: No ethernet found.
starting USB...
Bus usb@ff500000: Register 3000140 NbrPorts 3

Starting the controller
USB XHCI 1.10
scanning bus usb@ff500000 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Hit any key to stop autoboot: 0
Enter fastboot mode. Press Ctrl+C to stop...

Where is this booloader located and how I can I lock or delete it?

#4

It sounds like there are couple things going on here. First, I’m not sure what’s up with the mmc0boot0_a line. I never ran into that. I’m also not sure why you would be getting an error about no mmc0boot0 partition. It might help to see exactly what commands you issued to get those responses?

Second, if you have fully erased U-Boot from all emmc partitions, you should not get a U-Boot console after restarting the board. Instead, you should get something like:

G12A:BL:0253b8:61aa2d;FEAT:E0F83180:2000;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:20000;USB:8;

My guess is that the fastboot erase mmc0boot0 command didn’t run properly so there is still an instance of U-Boot present in that partition. I would try to make sure you’ve got all U-Boot binaries wiped from the emmc and you’re getting the G12A bootloader code above before proceeding to flash your custom U-Boot image.

As far as your new U-Boot, you’re going to have to make sure your custom build is configured to look for your boot script or env file wherever you happen to put it. Some of the documentation here might be helpful. Another option, especially if your application is security conscious, is to not use an external env file at all, but instead bake everything into the U-Boot binary with CONFIG_BOOTCOMMAND.

1 Like
#5

Thanks for your reply!
My previous post is based upon the exact commands I issued and their corresponding outputs.
When I type sudo fastboot flash mmc0boot1 fip/radxa-zero/u-boot.bin I get the same error with another index. This seems like a bug for me.

** Bad device specification mmc mmc0boot1_a **
Couldn't find partition mmc mmc0boot1_a
** Bad device specification mmc mmc0boot1 **
Couldn't find partition mmc mmc0boot1
Starting download of 1420656 bytes
..........
downloading of 1420656 bytes finished
........ wrote 1420800 bytes to EMMC_BOOT2

Anyway when pluged in, it is automatically booting my custom U-Boot.
If I plug the device in holding the USB button I see G12A:BL:0253b8:61aa2d;FEAT:E0F83180:2000;POC:D;RCY:0;USB:0;. When I type sudo boot-g12.py rz-fastboot-loader.bin the device is booting into the stock U-Boot. The fastboot erase $(any_paritition) deletes only my custom U-Boot. After that if I normally plug in the device I see G12A:BL:0253b8:61aa2d;FEAT:E0F83180:2000;POC:F;RCY:0;EMMC:0;READ:0;CHK:1F;READ:0;CHK:1F;READ:0;CHK:1F;SD?:0;SD:0;READ:0;CHK:1F;USB:8;

It is obvious to me that there is another stock bootloader I don’t have any access to, that is also defeating the purpose of being able to build and install a custom bootloader.

#6

rz-fastboot-loader.bin is just a U-Boot binary that has been configured to run a boot command that puts the device in “fastboot mode.” Note that the build date in that U-Boot version string is June 29, 2022, which is also the file modification date for rz-fastboot-loader.bin. The boot-g12.py script just sideloads that U-Boot binary so you can use fastboot operations on the emmc. I don’t know of any way to prevent an end user who has physical access to the device from being able to do that. I supposed you could make it more difficult by removing the “boot” button and putting epoxy over the pads, but I don’t think you can make it impossible with a SBC/development board like this. I think you’d have to work a deal with Amlogic to get a custom SoC that only accepts signed code, or something along those lines.

Aside from the strange device errors, it sounds like everything is working properly. You’ve flashed your custom U-Boot and that’s what loads when the board is powered up.

#7

Thanks for your help! Now some things are much clearer. I really thought that the .bins provided by Radxa were some kind of executables for the ROM code on the Radxa Zero that were loaded with boot-g12.py.

I hope the people at Radxa will update their documentation for the Radxa Zero accordingly!