有了上一篇刷機成功經驗後，又找了一台家中未使用的 OVO-B01 機上盒來玩玩，這次改刷 LibreELEC。

拆解

拆解後，找到兩個像是 TTL 接腳 (紅框)，雖然沒有特別標示，查找網路上的資料得知：方形標示為 GND，所以從左往右分別是 VCC, RX ,TX, GND。兩個我都有試，一樣接上 CP2102 (USB 轉 TTL) 的晶片，VCC 不用接，GND 接主板的 GND，RXD 接主板的 TX，TXD 接主板的 RX。測試後右下的紅框靠近 USB 那個才是對的，波特率為 115200。

完整的啟動資訊如下

QA9:A;SVN:74E;POC:1FF;STS:0;BOOT:0;INIT:0;READ:0;CHECK:0;PASS:0;
no sdio debug board detected 
TE : 655472
BT : 19:07:45 Jul 27 2016
PMU:rn5t618
DC01 v:1100, 0x[36]: 18 -> 28
DC02 v:1150, 0x[37]: 18 -> 2c
DC03 v:1500, 0x[38]: 38 -> 48
LDO01 v:2900, 0x[4c]: 4e -> 50
LDO02 v:1800, 0x[4d]: 24 -> 24
LDO03 v:1800, 0x[4e]: 30 -> 30
LDO04 v:2850, 0x[4f]: 4e -> 4e
LDO05 v:1800, 0x[50]: 24 -> 24
LDO0a v:2700, 0x[56]: 28 -> 28
LDO0b v:900, 0x[57]: 00 -> 00

CPU clock is 1200MHz

CPU type: M8M2
DDR info: 2GB(auto) @ 792MHz(1T)
DDR channel: DDR 0 + DDR 1

DDR init use : 12278 us

HHH
Boot From SDIO C
0x0000008d
ucl decompress...pass
0x12345678
Boot from internal device 1st SDIO C

TE : 816977

System Started


U-boot-00000-g2c83233-dirty(m8_k200_v1@) (Jul 27 2016 - 19:07:13)

clr h-ram
DRAM:  2 GiB
relocation Offset is: 6fec0000
show partition table: 
part: 0, name :       logo, size : 2000000
part: 1, name :   recovery, size : 2000000
part: 2, name :       misc, size : 2000000
part: 3, name :       boot, size : 2000000
part: 4, name :     system, size : 40000000
part: 5, name :      cache, size : 20000000
part: 6, name :       data, size : end 
aml_card_type=0x100
MMC:   [mmc_register] add mmc dev_num=0, port=1, if_type=6
[mmc_register] add mmc dev_num=1, port=2, if_type=6
SDIO Port B: 0, SDIO Port C: 1
PMU fault status:
reg[0x9A] = 0x1d
LSI version:04, OTP version:0c
PMU type:RN5T618
IR init done!
register usb cfg[0][1] = 7ff6fe04
register usb cfg[2][0] = 7ff73334
NAND:  EMMC BOOT: not init nand
do not init nand : cause boot_device_flag without nand 
get_boot_device_flag: init_ret -1
get_boot_device_flag EMMC BOOT: 
Emmckey: Access range is illegal!
[mmc_init] SDIO Port C:1, if_type=6, initialized OK!
[mmc_get_partition_table] skip cache partition.
Partition table get from SPL is : 
        name                        offset              size              flag
===================================================================================
   0: bootloader                         0            400000                  0
   1: reserved                     2400000           4000000                  0
   2: cache                        6c00000          20000000                  2
   3: env                         27400000            800000                  0
   4: logo                        28400000           2000000                  1
   5: recovery                    2ac00000           2000000                  1
   6: misc                        2d400000           2000000                  1
   7: boot                        2fc00000           2000000                  1
   8: system                      32400000          40000000                  1
   9: data                        72c00000         15f400000                  4
mmc read lba=0x12000, blocks=0x1
mmc read lba=0x12001, blocks=0x1
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
i=0,register --- emmc_key
MMC BOOT, emmc_env_relocate_spec : env_relocate_spec 59 
set_storage_device_flag: store 2
vpu driver detect cpu type: m8m2
vpu clk_level in dts: 7
set vpu clk: 364000000Hz, readback: 364000000Hz(0x700)
Net:   Meson_Ethernet
init suspend firmware done. (ret:0)
cvbs trimming.1.v5: 0xa0, 0x0
vdac open.1 = 0x1, 0x0
config HPLL
config HPLL done
not config efuse version
aml_keys: version 0 can not be init 7ff73570
current storer:emmc_key
reboot_mode=charging
ir init
efuse version is not selected.
Hit Enter key to stop autoboot -- :  0 
exit abortboot: 0
 sdio_detect return 1
[mmc_init] SDIO Port B:0, SD or TSD: Card did not respond to voltage select! mmc->block_dev.if_type=7
key save is auto select storer(nand or emmc)
write key code version3_flush:708,prov->write:7ff05790
write key ok!!
Booting...
not config efuse version
## ANDROID Format IMAGE
## Booting kernel from Legacy Image at 12000000 ...
   Image Name:   Linux-3.10.33
   Image Type:   ARM Linux Kernel Image (lzo compressed)
   Data Size:    6084816 Bytes = 5.8 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
    Ramdisk start addr = 0x125ce800, len = 0x1efd4c
    Flat device tree start addr = 0x127be800, len = 0x526e magic=0xedfe0dd0
   Uncompressing Kernel Image ... OK
uboot time: 5345982 us.
EFUSE machid is not set.
Using machid 0xf81 from environment
From device tree /memory/ node aml_reserved_end property, for relocate ramdisk and fdt, relocate_addr: 0x51f9001
   Loading Ramdisk to 05009000, end 051f8d4c ... OK
   Loading Device Tree to 05000000, end 0500826d ... OK

Starting kernel ...

[    0.000000@0] Booting Linux on physical CPU 0x200
[    0.000000@0] Linux version 3.10.33 (zackchiu@Matrix) (gcc version 4.7.3 20130205 (prerelease) (crosstool-NG linaro-1.13.1-4.7-2013.02-01-20130221 - Linaro GCC 2013.02) ) #1 SMP PREEMPT Wed Oct 30 20:04:13 CST 2019
[    0.000000@0] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c5387d
[    0.000000@0] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000@0] Machine: Amlogic Meson8, model: AMLOGIC
[    0.000000@0] physical memory start address is 0x200000

燒錄

這台機上盒使用的 CPU 是 Amlogic S812，至 https://libreelec.dtech.hu/images/S8X2/ 下載對應映像檔。
題外話，竟然與大陸 M8S+ 是同一顆 CPU 呢！

接著將 SD 卡插入電腦，並使用 LibreELEC 提供的工具寫入。

寫入完成後，將 SD 卡插入機上盒，這時 TTL 才派上用場，輸入指令重啟並改由 SD 卡啟動。

1	reboot update

該指令可以透過 adb 來輸入，但我從 OVO 的系統選項一直找不到打開 debug 開發人員模式的地方，另外有用 Reboot to LibreELEC 也沒成功，走了不少冤枉路。

等看到該畫面表示成功囉！

參考資料

Mike的筆記

[LibreELEC] 機上盒刷機

拆解

燒錄