Rock 3B - Cannot reach MaskROM, always boots from SPI

ROCK 3 Series 3B
1

Hello everyone,

[First time posting]

=== goal ===

I have a Rock 3B and would need to use rkdeveloptool to write the MMC.

=== issue ===

I cannot reach MaskROM as indicated on the documentation page here.

Here is my attempt:

  • I have attached a UART to pins 6,8,10 and can see the u-boot logs via picocom
  • I have shorted the pins as indicated by the documentation page (i could post a photo, woudl it be if necessary ?)
  • I have set the OTG switch to “device” as indicated by the documentation page
  • I have removed SD and NVME, leaving only a brand new MMC attached.
  • I have connected a USB-A to USB-A cable from the OTG to my PC

When connecting the power I see the following logs, on the serial port, where the execution seems to go straight to an SPL that seems to be the one from U-Boot SPI (? I have tried to reach MaskMODE event without the MMC, so no external memory at all (no SD, no MMC, no NVME), and still I am seeing these logs)

Type [C-a] [C-h] to see available commands
Terminal ready
�DDR V1.16 6f71c736ce typ 23/03/02-20:01:48
In
LP4/4x derate en, other dram:1x trefi
ddrconfig:0
LPDDR4X, 324MHz
BW=32 Col=10 Bk=8 CS0 Row=16 CS=1 Die BW=16 Size=2048MB
tdqss: cs0 dqs0: 24ps, dqs1: -48ps, dqs2: -24ps, dqs3: -120ps, 

change to: 324MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x61

change to: 528MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58

change to: 780MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58

change to: 1560MHz(final freq)
PHY drv:clk:36,ca:36,DQ:29,odt:60
vrefinner:16%, vrefout:22%
dram drv:40,odt:80
vref_ca:00000071
clk skew:0x1c
cs 0:
the read training result:
DQS0:0x36, DQS1:0x36, DQS2:0x39, DQS3:0x33, 
min  : 0xd  0xf 0x11  0xc  0x2  0x5  0x9  0x3 , 0xa  0x9  0x2  0x1  0xc  0xb  0xf  0x7 ,
      0x13 0x13  0xe  0xc  0x4  0x2  0x6  0x6 , 0xc  0xa  0x8  0x1  0xf 0x10  0xe 0x10 ,
mid  :0x2a 0x2c 0x2d 0x29 0x1e 0x23 0x24 0x20 ,0x26 0x25 0x1e 0x1d 0x28 0x27 0x2a 0x24 ,
      0x2e 0x2f 0x29 0x27 0x1f 0x1e 0x20 0x22 ,0x27 0x25 0x22 0x1c 0x2b 0x2b 0x29 0x2b ,
max  :0x47 0x49 0x49 0x47 0x3b 0x41 0x3f 0x3e ,0x43 0x42 0x3a 0x3a 0x45 0x44 0x46 0x41 ,
      0x4a 0x4b 0x45 0x42 0x3b 0x3b 0x3b 0x3e ,0x43 0x41 0x3d 0x38 0x47 0x47 0x45 0x47 ,
range:0x3a 0x3a 0x38 0x3b 0x39 0x3c 0x36 0x3b ,0x39 0x39 0x38 0x39 0x39 0x39 0x37 0x3a ,
      0x37 0x38 0x37 0x36 0x37 0x39 0x35 0x38 ,0x37 0x37 0x35 0x37 0x38 0x37 0x37 0x37 ,
the write training result:
DQS0:0x20, DQS1:0x13, DQS2:0x18, DQS3:0x5, 
min  :0x69 0x6e 0x6e 0x6c 0x5f 0x63 0x63 0x64 0x63 ,0x58 0x57 0x50 0x4f 0x5c 0x5b 0x5a 0x59 0x53 ,
      0x63 0x63 0x5e 0x5d 0x54 0x52 0x53 0x59 0x59 ,0x50 0x4d 0x4c 0x47 0x53 0x55 0x50 0x56 0x4b ,
mid  :0x84 0x88 0x88 0x85 0x77 0x7c 0x7d 0x7b 0x7b ,0x73 0x72 0x69 0x69 0x78 0x74 0x74 0x72 0x6e ,
      0x7f 0x7f 0x78 0x78 0x70 0x6d 0x6e 0x73 0x74 ,0x6c 0x69 0x66 0x60 0x6f 0x70 0x6b 0x70 0x67 ,
max  :0xa0 0xa3 0xa3 0x9e 0x90 0x96 0x98 0x93 0x94 ,0x8f 0x8e 0x83 0x84 0x94 0x8e 0x8f 0x8b 0x89 ,
      0x9c 0x9c 0x92 0x94 0x8c 0x89 0x8a 0x8d 0x90 ,0x89 0x86 0x81 0x79 0x8c 0x8c 0x87 0x8b 0x83 ,
range:0x37 0x35 0x35 0x32 0x31 0x33 0x35 0x2f 0x31 ,0x37 0x37 0x33 0x35 0x38 0x33 0x35 0x32 0x36 ,
      0x39 0x39 0x34 0x37 0x38 0x37 0x37 0x34 0x37 ,0x39 0x39 0x35 0x32 0x39 0x37 0x37 0x35 0x38 ,
CA Training result:
cs:0 min  :0x47 0x49 0x3f 0x3c 0x3f 0x3a 0x42 ,0x45 0x42 0x3d 0x39 0x3d 0x39 0x40 ,
cs:0 mid  :0x87 0x87 0x7e 0x7c 0x7e 0x78 0x6e ,0x84 0x81 0x7a 0x77 0x79 0x77 0x6c ,
cs:0 max  :0xc8 0xc5 0xbd 0xbc 0xbd 0xb6 0x9b ,0xc4 0xc1 0xb8 0xb6 0xb6 0xb6 0x98 ,
cs:0 range:0x81 0x7c 0x7e 0x80 0x7e 0x7c 0x59 ,0x7f 0x7f 0x7b 0x7d 0x79 0x7d 0x58 ,
out

U-Boot SPL latest-2023.07.02-6-4257d241-g4257d241 (Oct 12 2023 - 07:58:46 +0000)
Trying to boot from SPI
## Checking hash(es) for config config-1 ... OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
## Checking hash(es) for Image u-boot ... sha256+ OK
## Checking hash(es) for Image fdt-1 ... sha256+ OK
## Checking hash(es) for Image atf-2 ... sha256+ OK
## Checking hash(es) for Image atf-3 ... sha256+ OK
## Checking hash(es) for Image atf-4 ... sha256+ OK
## Checking hash(es) for Image atf-5 ... sha256+ OK
INFO:    Preloader serial: 2
NOTICE:  BL31: v2.3():v2.3-181-gc9a647cae-dirty:xsf
NOTICE:  BL31: Built : 11:30:09, Oct 18 2022
INFO:    GICv3 without legacy support detected.
INFO:    ARM GICv3 driver initialized in EL3
INFO:    pmu v1 is valid
INFO:    dfs DDR fsp_param[0].freq_mhz= 1560MHz
INFO:    dfs DDR fsp_param[1].freq_mhz= 324MHz
INFO:    dfs DDR fsp_param[2].freq_mhz= 528MHz
INFO:    dfs DDR fsp_param[3].freq_mhz= 780MHz
INFO:    Using opteed sec cpu_context!
INFO:    boot cpu mask: 0
INFO:    BL31: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader, Booting device without OPTEE initialization. SMC`s destined for OPTEE will return SMC_UNK
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0xa00000
INFO:    SPSR = 0x3c9


U-Boot latest-2023.07.02-6-4257d241-g4257d241 (Oct 12 2023 - 07:58:46 +0000)

Model: Radxa ROCK 3 Model B
DRAM:  2 GiB
PMIC:  RK8090 (on=0x40, off=0x00)
Core:  340 devices, 31 uclasses, devicetree: separate
MMC:   mmc@fe2b0000: 1, mmc@fe310000: 0
Loading Environment from nowhere... OK
In:    serial@fe660000
Out:   serial@fe660000
Err:   serial@fe660000
Model: Radxa ROCK 3 Model B
Net:   No ethernet found.

starting USB...
Bus usb@fcc00000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
Bus usb@fd000000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
Bus usb@fd800000: USB EHCI 1.00
Bus usb@fd840000: USB OHCI 1.0
Bus usb@fd880000: USB EHCI 1.00
Bus usb@fd8c0000: USB OHCI 1.0
scanning bus usb@fcc00000 for devices... 1 USB Device(s) found
scanning bus usb@fd000000 for devices... 1 USB Device(s) found
scanning bus usb@fd800000 for devices... 2 USB Device(s) found
scanning bus usb@fd840000 for devices... 1 USB Device(s) found
scanning bus usb@fd880000 for devices... 1 USB Device(s) found
scanning bus usb@fd8c0000 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
Hit Ctrl+C key in 0 seconds to stop autoboot...
Card did not respond to voltage select! : -110
Card did not respond to voltage select! : -110
pcie_dw_rockchip pcie@fe260000: PCIe-0 Link Fail
pcie_dw_rockchip pcie@fe280000: PCIe-1 Link Fail
pcie_dw_rockchip pcie@fe260000: PCIe-0 Link Fail
pcie_dw_rockchip pcie@fe280000: PCIe-1 Link Fail
scanning bus for devices...
pcie_dw_rockchip pcie@fe260000: PCIe-0 Link Fail
pcie_dw_rockchip pcie@fe280000: PCIe-1 Link Fail
No ethernet found.
pcie_dw_rockchip pcie@fe260000: PCIe-0 Link Fail
pcie_dw_rockchip pcie@fe280000: PCIe-1 Link Fail
No ethernet found.
## Error: "distro_bootcmd" not defined
Boot failed. Reset in 3 seconds...
resetting ...

=== emptying the SPI ===
I thought that by emptying the SPI I could convince the BootROM that only MaskROM is available, but i cannot find, in rsetup, the option to manually emptying the SPI (as otherwise indicated in the documentation here)

2025-11-09_01-10
2025-11-09_01-10946×540 21.1 KB

=== questions ===

  • how to correctly get to MaskMODE in Rock 3B ? Any visible mistakes ?
  • is SPI SPL that i see in the logs ? If yes would removing it allow me to reach MaskMODE ? if yes how ?

Thanks you in advance,

Any sort of help would be appreciated,

Have a great week,

Cheers,

2

If the goal is to write something to eMMC: Your ROCK3B is able to boot and run Linux, so I consider it much easier to use dd or flashcp to write something to eMMC or SPI. You need to make sure that you understand how to use those tools. Radxa OS and also docs might look OK, but I have seen and experienced several times that it won’t help you or won’t work.

So for example on my ROCK3A, I need a certain kernel to boot successfully and then from there overwrite the SPI contents. ‘emptying the SPI’ is then writing a file with all zeros to it.

It also makes sense to have a (spare) SD-card (or an eMMC USB adaptor) available. Those are removable so easier to check and test in another computer before you try to boot the ROCK3B.

3

Hi @radrocks,

Thank you for your words,

You are right on this,

‘emptying the SPI’ is then writing a file with all zeros to it.

Usually I don’t tend to “roll my own” too soon. But, yes, if the there is not other way, then DIY will be.

You are also absolutely right in the fact that MaskROM is optional in this scenari.

Although, on my part, I did not disclaim the very very ultimate goal of the whole process.

Professionally, I am working with an industrial board that has the same chip, rk3568, and only MMC as storage, so writable only with rkdeveloptool/MaskMODE.
On such board I will need to implement SecureBoot (and other customiztions), which will lead me write the SoC one-programmable efuses, which can be written only once, if any mistake will happen with that process, then it is not recoverable, so I will have one shot. On very expensive and hard to obtain boards.

Therefore I am using the Rock3b as an iso-SoC board to fully develop the technical process.

And also, I must say, I liked a lot the Radxa documentation while gathering documentation on Rockchip boards.

Therefore MaskROM writing (and then SecureBoot) is an exact process that I still need to go through to assure that the process is perfect.

So, as you say, sometimes the documentation is misleading/not working ?
Where do you best gather information in such cases ? (blogs/other documentations/)

Have a nice day

Cheers,