ZTE B860AV2.1 折腾 Armbian

    技术   Linux

开篇废话

这是我折腾这坑爹玩意留下的笔记，防止以后折腾的时候找不到了。

ZTE官方的产品描述跟没写一样，不愧是 to b 产品
产品描述

而且产品线非常混乱，在折腾之前请确认是 B860AV2.1 型号，型号参考可以直接到结尾#参考材料部分。
世界未解之谜，这破电视盒子到底是 s905l 的什么型号呢？

具体折腾思路是：先刷入改版后的 Android（当作底包）然后在改版 Android 重启到 u盘内的 Armbian 然后拷贝到 emmc 中（替换掉 Android）

过程

准备

首先我们要准备以下材料：

拆机

此处注意，ZTE节省成本只给了两个螺柱，所以我们不需要把四个脚垫都掀开来（参考右上角）：
box-overwrite

刷 Android 底包

usb burning tool 工具和驱动自己找去。

翻到主板背面，找到 C125 用镊子或者小螺丝刀短接然后上电：
C125
请忽略这么脏的 DC

成功后 S905 会进入下载模式，我们可以用 USB_Burning_Tool 把上面提到的底包 android_tv_mgv2000-s905l2-android4.4.2-root 刷进去 usb burning tool

导入烧录包后点击开始即可。 然后重启开机测试下能不能进入 Android 系统，这个可以连 HDMI 也可以在 TTL 知道。

如果触发失败需要重试，需要 DC 和 USB 都断开连接，否则双公 USB 线会给电视盒子继续供电导致重开失败。

TTL

115200
连接方式如图：
ttl
^ 黄 = GND 红 = RX 橙 = TX

在 macOS：

screen /dev/tty.usbserial-1410 115200

Windows 不再啰嗦。

中断 u-boot 启动是 ctrl + z
如果有兴趣看 u-boot 菜单的话：

?       - alias for 'help'
aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
amlmmc  - AMLMMC sub system
autoscr - run script from memory
base    - print or set address offset
bmp     - manipulate BMP image data
booti   - boot arm64 Linux Image image from memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cbusreg - cbus register read/write
clkmsr  - measure PLL clock
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
cvbs    - CVBS sub-system
dcache  - enable or disable data cache
defenv_reserv- reserve some specified envs after defaulting env
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
efuse   - efuse read/write data commands
efuse_user- efuse user space read write ops
emmc    - EMMC sub system
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatsize - determine a file's size
fdt     - flattened device tree utility commands
get_rebootmode- get reboot mode
go      - start application at address 'addr'
gpio    - query and control gpio pins
hdmitx  - HDMITX sub-system
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imgread - Read the image from internal flash with actual size
irkey   - irkey key_value1 key_value2 key_value3 time_value
itest   - return true/false on integer compare
jtagoff - disable jtag
jtagon  - enable jtag
keyman  - Unify key ops interfaces based dts cfg
keyunify- key unify sub-system
loop    - infinite loop on address range
macreg  - ethernet mac register read/write/dump
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mw      - memory write (fill)
mwm     - mw mask function
nm      - memory modify (constant address)
open_scp_log- print SCP messgage
osd     - osd sub-system
phyreg  - ethernet phy register read/write/dump
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
read_temp- cpu temp-system
reboot  - set reboot mode and reboot system
reset   - Perform RESET of the CPU
rsvmem  - reserve memory
run     - run commands in an environment variable
saradc  - saradc sub-system
saradc_12bit- saradc sub-system
saveenv - save environment variables to persistent storage
sdc_burn- Burning with amlogic format package in sdmmc 
sdc_update- Burning a partition with image file in sdmmc card
set_trim_base- cpu temp-system
set_usb_boot- set usb boot mode
setenv  - set environment variables
showvar - print local hushshell variables
sleep   - delay execution for some time
store   - STORE sub-system
systemoff- system off 
temp_triming- cpu temp-system
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
unpackimg- un pack logo image into pictures
update  - Enter v2 usbburning mode
usb     - USB sub-system
usb_burn- Burning with amlogic format package in usb 
usb_update- Burning a partition with image file in usb host
usbboot - boot from USB device
version - print monitor, compiler and linker version
vout    - VOUT sub-system
vpu     - vpu sub-system
wipeisb - wipeisb
write_trim- cpu temp-system
write_version- cpu temp-system

env:

gxl_p211_v1#env print
1080i_h=1043
1080i_w=1853
1080i_x=33
1080i_y=18
1080p_h=1043
1080p_w=1853
1080p_x=33
1080p_y=18
480i_h=433
480i_w=649
480i_x=35
480i_y=23
480p_h=433
480p_w=649
480p_x=35
480p_y=23
576i_h=554
576i_w=680
576i_x=20
576i_y=11
576p_h=554
576p_w=680
576p_x=20
576p_y=11
720p_h=691
720p_w=1229
720p_x=25
720p_y=14
ab=0
aml_dt=gxl_p211_1g
baudrate=115200
boardid=8
bootargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 use_cma_first=1 androidboot.selinux=disabled logo=osd1,loaded,0x3d800000,720p50hz vout=720p50hz,enable hdmimode=720p50hz cvbsmode=576cvbs hdmitx= cvbsdrv=1 androidboot.firstboot=1 jtag=apee quiet androidboot.hardware=amlogic androidboot.boardid=8
bootcmd=run start_autoscript; run storeboot
bootdelay=1
bootup_offset=0x1088600
bootup_size=0x3f4848
cmdline_keys=if keyman init 0x1234; then if keyman read usid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.serialno=${usid};fi;if keyman read mac ${loadaddr} str; then setenv bootargs ${bootargs} mac=${mac} androidboot.mac=${mac};fi;if keyman read deviceid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.deviceid=${deviceid};fi;fi;
cvbs_drv=1
cvbsmode=576cvbs
digitaudiooutput=PCM
display_bpp=16
display_color_bg=0
display_color_fg=0xffff
display_color_index=16
display_height=720
display_layer=osd1
display_width=1280
dtb_mem_addr=0x1000000
ethact=dwmac.c9410000
ethaddr=00:15:18:01:81:31
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; if test ${wipe_cache} = failed; then run init_display; run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; 
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
filesize=2c5
firstboot=1
gatewayip=10.18.9.1
hdmimode=720p50hz
hostname=arm_gxbb
init_display=imgread pic logo bootup $loadaddr;bmp pixel $bootup_offset;osd open;osd clear;bmp display $bootup_offset;bmp scale
initargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 use_cma_first=1 androidboot.selinux=disabled
ipaddr=10.18.9.97
irremote_update=if irkey 0x7d82dd22 0x7e81dd22 0x728ddd22 500000; then run recovery_from_flash; if itest ${irkey_value} == 0x29d64cb3; then run update;else if itest ${irkey_value} == 0x6996c43b; then run update;else if itest ${irkey_value} == 0x728ddd22; then run update;\
fi;fi;fi;fi;
jtag=apee
judge_factory_reset_protect=echo into judge_factory_reset_protect;if test ${wipe_data} = failed; then echo wipe_data=${wipe_data};if test ${reboot_mode} = cold_boot; then run factory_reset_poweroff_protect;fi;fi;if test ${wipe_cache} = failed; then echo wipe_cache=${wipe_cache};if test ${reboot_mode} = cold_boot; then run factory_reset_poweroff_protect;fi;fi;
loadaddr=1080000
netmask=255.255.255.0
outputmode=720p50hz
preboot=run factory_reset_poweroff_protect;run init_display;run upgrade_check;run storeargs;run switch_bootmode;run irremote_update
reboot_mode=cold_boot
recovery_from_flash=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then bootm ${loadaddr}; fi
recovery_from_sdcard=if fatload mmc 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload mmc 0 ${loadaddr} recovery.img; then if fatload mmc 0 ${dtb_mem_addr} dtb.img; then echo sd dtb.img loaded; fi;bootm ${loadaddr};fi;
recovery_from_udisk=if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then echo udisk dtb.img loaded; fi;bootm ${loadaddr};fi;
recovery_offset=0
recovery_part=recovery
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
serverip=10.18.9.113
start_autoscript=if mmcinfo; then run start_mmc_autoscript; fi; if usb start; then run start_usb_autoscript; fi; run start_emmc_autoscript
start_emmc_autoscript=if fatload mmc 1 1020000 emmc_autoscript; then autoscr 1020000; fi;
start_mmc_autoscript=if fatload mmc 0 1020000 s905_autoscript; then autoscr 1020000; fi;
start_usb_autoscript=for usbdev in 0 1 2 3; do if fatload usb ${usbdev} 1020000 s905_autoscript; then autoscr 1020000; fi; done
stderr=serial
stdin=serial
stdout=serial
storeargs=setenv bootargs ${initargs} logo=${display_layer},loaded,${fb_addr},${outputmode} vout=${outputmode},enable hdmimode=${hdmimode} cvbsmode=${cvbsmode} hdmitx=${cecconfig} cvbsdrv=${cvbs_drv} androidboot.firstboot=${firstboot} jtag=${jtag} quiet; setenv bootargs ${bootargs} androidboot.hardware=amlogic androidboot.boardid=${boardid};run cmdline_keys;
storeboot=if imgread kernel boot ${loadaddr}; then bootm ${loadaddr}; fi;run update;
switch_bootmode=get_rebootmode;echo rebootmode=${reboot_mode};if test ${reboot_mode} = factory_reset; then run recovery_from_flash;else if test ${reboot_mode} = update; then run update;fi;fi;
try_auto_burn=update 700 750;
uimode=720p
update=run usb_burning; run sdc_burning; if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else if itest ${upgrade_step} == 1; then defenv_reserv; setenv upgrade_step 2; saveenv; run init_display;fi;fi;
upgrade_step=2
usb_burning=update 1000
wipe_cache=successful
wipe_data=successful

部分启动日志：

GXL:BL1:9ac50e:a1974b;FEAT:ADFD318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 64550

BL2 Built : 15:10:35, Sep  1 2017. 
gxl g64082aa - xiaobo.gu@droid12

Board ID = 8, adc=618
set vcck to 1070 mv
set vddee to 1070 mv
CPU clk: 1200MHz
2layers board, use ddr_set[0]
DQS-corr enabled
DDR scramble enabled
STICKY_REG0: 0x00000000
STICKY_REG1: 0x00000000
STICKY_REG9: 0x00000000
DDR3 chl: Rank0 @ 792MHz
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
emmc switch highspeed 52M
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x00007600
Load bl301 from eMMC, src: 0x00018200, des: 0x01200000, size: 0x00002200
Load bl31 from eMMC, src: 0x0001c200, des: 0x10100000, size: 0x00019600
Load bl33 from eMMC, src: 0x00038200, des: 0x01000000, size: 0x0005b600
NOTICE:  BL3-1: v1.0(debug):3048f05
NOTICE:  BL3-1: Built : 22:38:14, Aug 20 2017
NOTICE:  BL31: GXL normal boot!
NOTICE:  BL31: BL33 decompress pass
[Image: gxl_v1.1.3098-cf1f353 2017-09-11 19:43:10 xiaobo.gu@droid12]

efuse init ops = c2


efuse init hdcp = c, cf9=7


bl30: check_permit, count is 1


bl30: check_permit: ok!


chipid: ef be ad de d f0 ad ba ef be ad de not ES chip

[0.301723 Inits done]

sINFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9
ecure task start!

hi
g
hU t-aBsoko ts t2a0r1t5!.
0
1 low( Otcats k2 6s t2a0r1t7! 
-
 21:19:40)

DRAM:  1 GiB
Relocation Offset is: 36ec4000
gpio: pin GPIODV_24 (gpio 43) value is 1
register usb cfg[0][1] = 0000000037f5c2d0
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
MMC:   aml_priv->desc_buf = 0x0000000033eb4ac0
aml_priv->desc_buf = 0x0000000033eb6de0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
[mmc_init] mmc init success
dtb magic 08088b1f
      Amlogic multi-dtb tool
      GZIP format, decompress...
      Multi dtb detected
      2layers board, board id use 7
      Multi dtb tool version: v2 .
      Support 7 dtbs.
        aml_dt soc: gxl platform: p211 variant: 1g
        dtb 0 soc: gxbb   plat: p201   vari: 1g
        dtb 1 soc: gxbb   plat: p201   vari: 2g
        dtb 2 soc: gxl   plat: p211   vari: 1g
        dtb 3 soc: gxl   plat: p211   vari: 2g
        dtb 4 soc: gxl   plat: p215   vari: 1g
        dtb 5 soc: gxl   plat: p215   vari: 2g
        dtb 6 soc: gxlx   plat: p261   vari: 1g
      Find match dtb: 2
start dts,buffer=0000000033eb9610,dt_addr=0000000033eb9610
      Amlogic multi-dtb tool
      Single dtb detected
parts: 13
00:      logo	0000000002000000 1
01:  recovery	0000000002000000 1
02:       rsv	0000000000800000 1
03:       tee	0000000000800000 1
04:     crypt	0000000002000000 1
05:      misc	0000000002000000 1
06: instaboot	0000000020000000 1
07:      boot	0000000002000000 1
08:    system	0000000040000000 1
09:     cache	0000000020000000 2
10:    params	0000000004000000 2
11: bootfiles	0000000020000000 2
12:      data	ffffffffffffffff 4
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000 
In:    serial
Out:   serial
Err:   serial
board id is : 8
hpd_state=1
[720p50hz] is invalid for cvbs.
set hdmitx VIC = 19
config HPLL = 2970
HPLL: 0xc000027b
config HPLL done
j = 2  vid_clk_div = 1
hdmitx: set enc for VIC: 19
HDMITX-DWC addr=0x10004006 rd_data=0x40
Error: HDMITX-DWC exp_data=0xff mask=0x9f
hdmitx phy setting done
div40 = 0
hdmtix: set audio
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 5ebc33a9, store 5ebc33a9
_verify_dtb_checksum()-917: calc 5ebc33a9, store 5ebc33a9
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
      Amlogic multi-dtb tool
      GZIP format, decompress...
      Multi dtb detected
      2layers board, board id use 7
      Multi dtb tool version: v2 .
      Support 7 dtbs.
        aml_dt soc: gxl platform: p211 variant: 1g
        dtb 0 soc: gxbb   plat: p201   vari: 1g
        dtb 1 soc: gxbb   plat: p201   vari: 2g
        dtb 2 soc: gxl   plat: p211   vari: 1g
        dtb 3 soc: gxl   plat: p211   vari: 2g
        dtb 4 soc: gxl   plat: p215   vari: 1g
        dtb 5 soc: gxl   plat: p215   vari: 2g
        dtb 6 soc: gxlx   plat: p261   vari: 1g
      Find match dtb: 2
Net:   dwmac.c9410000
wipe_data=successful
wipe_cache=successful
bmp pixel: 16
[CANVAS]addr=0x3d800000 width=3840, height=2160
upgrade_step=2
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[mac] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
rebootmode=cold_boot
key1 = 7d82dd22
key2 = 7e81dd22
key3 = 728ddd22
time_out = 7a120
ir init
irkey - irkey key_value1 key_value2 key_value3 time_value

Usage:
irkey 
Hit any key to stop autoboot:  1     0 
gxl_p211_v1#    set            env print
Unknown command '   env' - try 'help'

进到系统后，我们输入 reboot update 即可让电视盒子从 U盘（没试过内存卡是否可以）sideload 启动

root@p201_iptv:/ # reboot update

好像忘记说明怎么做系统盘了

制作系统u盘

首先从#准备中下载最新的 Armbian 包，至于要 Ubuntu/Debian 看个人喜好了。
用 balenaEtcher 之类的玩意写U盘就是了 记得解压啊！。
然后我们要更改下 uEnv.ini 和手动替换(加入) dtb

uEnv.ini

LINUX=/zImage
INITRD=/uInitrd
#FDT=/meson-gxl-s905x-p212.dtb
FDT=/dtb/amlogic/meson-gxl-s905x-p212.dtb
APPEND=root=LABEL=ROOTFS_EMMC rootflags=data=writeback rw rootfstype=ext4 console=ttyAML0,115200n8 console=tty0 no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory swapaccount=1

然后:

cp u-boot-s905x-s912.bin u-boot.ext
wget https://blog.huggy.moe/attachment/2022/15/meson-gxl-s905x-p212.dtb

人话:

  • 复制 u-boot-s905x-s912.bin 成 u-boot.ext
  • 下载 meson-gxl-s905x-p212.dtb 并且随便放（uEnv.ini）也要跟着改

启动 & 刷入 emmc

在这个阶段，可以使用 网络 / TTL / HDMI + 键盘 操控

用 armbian-install no 参数不解释。

Please Input ID: 0
Please Input SoC Name(such as s9xxx): s905l2a
Please Input DTB Name(such as meson-xxx.dtb): meson-gxl-s905x-p212.dtb
Please Input UBOOT_OVERLOAD Name(such as u-boot-xxx.bin): 
Please Input MAINLINE_UBOOT Name(such as xxx-u-boot.bin.sd.bin): 
Please Input ANDROID_UBOOT Name(such as xxx-bootloader.img): 
[[94m INFO [0m] Input Box ID: [ 0 ]
[[94m INFO [0m] FDTFILE: [ meson-gxl-s905x-p212.dtb ]
[[94m INFO [0m] MAINLINE_UBOOT: [  ]
[[94m INFO [0m] ANDROID_UBOOT:  [  ]
[[94m INFO [0m] UBOOT_OVERLOAD: [  ]
[[94m INFO [0m] K510: [ 0 ]
[[95m STEPS [0m] Start selecting file system type...
-----------------------------------------------
ID  TYPE
-----------------------------------------------
1   ext4
2   btrfs
-----------------------------------------------
[[93m OPTIONS [0m] Please Input ID: 1
[[94m INFO [0m] Input Type ID: [ 1 ]
[[94m INFO [0m] The type of file system: [ ext4 ]

然后再次重启即可

dtb

此处我也没有折腾懂，当一个记录了

在实际折腾中，我找不到 emmc，大概是 dtb 对于设备描述有些问题，毕竟机器和真的 p212 公版还是有点区别的。
我想到的方案是比对 Android 里面的 dtb 文件，然后比对：

dump android dtb

首先需要在 Android 系统内 dump boot.img 出来，方便我们对比，找个对于你来说方便的姿势就好，这里我用了 adb 来安排：

# root 情况下
dd if=/dev/block/boot of=/sdcard/boot.img

# 电脑
adb pull /sdcard/boot.img

解包

此处我们不需要打包回去，所以 binwalk 一把梭即可。

binwalk boot.img -e
ls _boot.img.extracted
# 688000     688000.gz  800        800.gz     dt.img     dt.img.gz

其中 dt.img 就是 dtb(s) 了 我们用 split-appended-dtb 或者 extract-dtb 把 dtb dump 出来
然后才发现有7份 dtb 根本不知道用的是哪个
dtb

dtb2dts

dtc 好像是 mkbootimg 工具链送的，自己装一下

# dtc -I (输入格式) -O (输出格式） （输入文件）-o （输出文件）
# 所以此处 dtb dts 对调一下就是编译回去的了
dtc -I dtb -O dts dtbdump_1.dtb -o 1.dts
dtc -I dtb -O dts dtbdump_2.dtb -o 2.dts
dtc -I dtb -O dts dtbdump_3.dtb -o 3.dts
dtc -I dtb -O dts dtbdump_4.dtb -o 4.dts
dtc -I dtb -O dts dtbdump_5.dtb -o 5.dts
dtc -I dtb -O dts dtbdump_6.dtb -o 6.dts
dtc -I dtb -O dts dtbdump_7.dtb -o 7.dts

折腾期间的各种想法

一开始我认为是针脚顺序不对，然而解包 p212 的 dtb 发现都是 by-name 形式的，应该没有什么问题，由于格式差别太大，已经无法通过人肉比对 .mmc 部分来修了，直到我看到了 中兴机顶盒ZXV10 B860AV2.1T 2022款刷armbian系统 帖子才知道是这坑爹玩意批次的硬件规格都有不一样的。。。。

你在写卡部分会提示找不到emmc原因就是新款中兴盒子把 emmc 换成 e-nand 它的频率从 0x5f5e100 变到了 0x2faf080 如果你有兴趣的话可以使用device-tree-compiler自己更改这个数值 ，篇幅问题我不再详述。

0x2faf080

搜索 0x2faf080 可以看到确实有部分 dtb 是用了 0x2faf080 于是在 armbian 就可以识别到 emmc 了

结尾

为了这个破玩意折腾了一天多了，感觉还是什么都没学到，只是得到了一台 1+8G 的垃圾机器而已。
另外我的 不过 TTL 比以前熟练多了，这次还尝试自己改 dtb 来适配移植 Armbian，也算不错了。

neofetch

最后怀念下拆外壳而牺牲的 sd 卡：
rip sdcard
R.I.P.



完

参考材料