Discovery on other Linkplay A31 modules #4
Comments
|
After booting Module 2 the web interface is broken
Partition data: |
|
Board 1 Even after soldering to the trace on the board I can't get any serial output from the module. I THINK I should get data, but there seems to be nothing ... |
|
There is no obvious difference between the two boards (and also my board: https://github.com/hn/linkplay-a31/blob/main/linkplay-a31-pcb-front.jpg). I think you fried board 1 somehow, maybe one can check later to revive it. Board 2 has the same CPU (even the same revision) as mine: The flash chip is the same as well. The module should be compatible with this project. The (slight) difference in the partition table does not matter. You need to get into the bootloader which looks like this Check:
|
|
The board 1 boots fine and works without issue with the default firmware. Just the serial won't play ball. I tried all usual baud rates with board 2 without any result. I can see that the console output takes some time until it starts, so I guess u-boot is doing something. Edit: There is no |
|
|
I just tried pin 24/25 but there is nothing interesting there, just some strings that look like some internal protocol Currently I am a bit stuck trying to get the partition data off the device. I can |
|
Just a thought ... Could I flash the software through mtd from the running system? |
Configure WiFi and use curl ( Since there is no uuencode/base64 on the system, the only other (painful) way would be something like this.
It probably should work ( |
|
Module 2: If you have access to an oscilloscope or logic analyzer, I would double-check again if any level change occurs on the serial TX pin before the kernel starts. An ESP8266 can also be used as a cheap replacement Module 1: If you have access to a microscope and probe needles you might check for serial activity directly at the MT7688 UART pins. |
|
New findings: Module 2 shows no activity on the TX pin before the linux kernel log (at least nothing shown on the oscilloscope). |
|
I flashed, I rebooted, I bricked ... |
|
Module 1:
Module 2: |
|
Module 2 is a MT7688AN. I went through the datasheet and there doesn't seem to be a way to configure the behavior of UART0 through some of the other pins. I kind of suspected the carrier-board to do something weird, so the bootloader won't output. But I don't see any plausible pin that could cause that. I could have checked the registers of the MCU for UART0_MODE, but since it works later in the process, I don't see how that could have changed anything. |
|
Module 2: U-Boot output has been silenced in code (they have intentionally removed the call to the initialization function for UART0). You can work around this by changing bytes (this is your |
|
Can I do that change through writing to the memory chip with a SOIC-8 clip? I bought one, but never used it. Can you walk me through that or should I just google it? ;) |
|
You'll find lots of howtos on the web with helpful pictures. In the end it comes down to something like this:
|
|
After some probing around (and learning how to use a RasPi for SPI interface) I was able to write a new rom (and read the "original" rom before). I read the written data back and it matched the patched image. Sadly, I STILL don't get U-Boot to speak to me. |
|
That's strange. Can you please check (e.g. with a scope) that there is really 'nothing' -- maybe the baud rate is wrong, I would not see that in the emulator. |
|
Sounds good. I am a bit short on time currently, but I will see what I can test |
|
Good news. I patched the image on the broken module and actually got some output now: @hn Kind of off-topic: I am gonna be at 38C3. Are you there? |
|
Nice. Looks like you applied the 0x30c patch to your (older) version of the bootloader. You're lucky that the jump table seems to be the same as You now should be able to log in to OpenWrt via serial ( Your log excerpt refers to module 2 ("Aliexpress"), right? What's the status of module 1 ("Arylic")? I most likely won't be at 38c3, maybe at short notice. |
and others
I have two Linkplay A31 modules that differ in their behaviour. I try to document these modules here and maybe get some more info in the process.
Module 1 - Originally installed on Arylic Up2Stream Amp 2.1
(https://www.arylic.com/products/up2stream-amp-2-1-amp-board)
Module 2 - Sourced through AliExpress
The text was updated successfully, but these errors were encountered: