安卓机顶盒也能玩树莓派linux，附fastboot常用命令

网上看到的安卓手机（通常为ARM硬件）安装Linux，实际上这个linux只相当于安卓系统下的一个app应用而已。
这篇文章安装的是完全独立启动的Linux，和安卓系统没有关系。
使用设备：以开放root权限的机顶盒，可以进入fastboot，采用串口方式进行调试，

进入fastboot

通过不停按Ctrl+C还是可以进入fastboot界面，通过显示的可以判断是中断了内存读取强制进入的。

Bootrom start
Boot from eMMC
Starting fastboot …

System startup
DDRS
Reg Version: v1.1.0
Reg Time: 2016-1-21 11:44:04
Reg Name: hi3798mdmo1f_hi3798mv100_ddr3_1gbyte_16bitx2_2layers_emmc.reg

Jump to DDR

Fastboot 3.3.0-dirty (wentong.cen@um-zc) (Jan 21 2016 - 11:41:46)

Fastboot: Version 3.3.0
Build Date: Jan 21 2016, 11:42:22
CPU: Hi3798Mv100
Boot Media: eMMC
DDR Size: 1GB
…省略
str_deviceid:111018410000046

Reserve Memory
Start Addr: 0x3FFFE000
Bound Addr: 0x8D32000
Free Addr: 0x3ED48000
Alloc Block: Addr Size
0x3FBFD000 4194304
0x3F8FC000 3145728
0x3F87B000 524288
0x3F878000 8192
0x3F843000 212992
0x3F742000 1048576
0x3F73E000 12288
0x3F3B9000 3686400
0x3F223000 1658880
0x3EE9E000 3686400
0x3ED4B000 1384448
0x3ED48000 8192

Press Ctrl+C to stop autoboot
fastboot#
fastboot#

修改并保存环境变量

fastboot# setenv ipaddr 192.168.1.10
fastboot# setenv serverip 192.168.1.1
fastboot# setenv bootdelay 3
fastboot# saveenv

按电源重启设备
可以看到显示Ctrl+C的延迟时间变长了。

此时，末尾会多显示一些内存地址信息
str_deviceid:111018410000046

Reserve Memory
Start Addr: 0x3FFFE000
Bound Addr: 0x8D32000
Free Addr: 0x3ED48000
Alloc Block: Addr Size
0x3FBFD000 4194304
0x3F8FC000 3145728
0x3F87B000 524288
0x3F878000 8192
0x3F843000 212992
0x3F742000 1048576
0x3F73E000 12288
0x3F3B9000 3686400
0x3F223000 1658880
0x3EE9E000 3686400
0x3ED4B000 1384448
0x3ED48000 8192

Hibernate!! drv phyaddr 0x3FC00000
Hibernate!! user api phyaddr 0x3F900000
Hibernate!! userapi start 0x12D00000, size 0x800000
Hibernate!! drv start 0x13500000, size 0x800000
Hibernate!! flag start 0x13D00000, size 0x800000
Hibernate!! data start 0x14500000, size 0x12C00000
Press Ctrl+C to stop autoboot
fastboot#
通过prinenv可以验证已生效。

检查插入的SD卡无法识别，只识别了自带的8GB eMMC，无法识别SD卡
fastboot# mmc rescan 0
fastboot# mmc rescan 1
No MMC device(1) driver found!
fastboot# mmc list
himci v200: 0
fastboot# mmcinfo
Device: himci v200
Manufacturer ID: 70
OEM: 100
Name: S1000
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.0
High Capacity: Yes
Capacity: 7818182656
Bus Width: 8-bit
fastboot#

看看eMMC空间分配

factory_bootargs=mem=1G console=ttyAMA0,115200 root=/dev/mmcblk0p16 rootfstype=ext3 rootwait blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata)
bootargs=console=ttyAMA0,115200 blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata) androidboot.serialno=005404FF0018143000010019F0E21CC6 androidboot.deviceid=111018410000046 androidboot.serialno=005404FF0018143000010019F0E21CC6 androidboot.deviceid=111018410000046
二者对磁盘空间的描述blkdevparts是完全相同的，bootargs少了mem和root的描述，多了androidboot的描述（其中的2个字段都是重复的）
bootcmd=mmc read 0 0x1FFBFC0 0x50000 0x5000; bootm 0x1FFBFC0
boot时是根据bootcmd的描述进行启动的，使用"? mmc"可以看到语法
mmc read addr blk# cnt
从mmc 0的0x50000（320KB）开始读取0x5000（20KB）字节的数据到内存0x1FFBFC0 ，并从该内存地址启动。
查看内存 md.b 1FFBFC0 5000 看起来是很有规律的字符，应该是无法启动
执行命令
fastboot# mmc read 0 0x1FFBFC0 0x50000 0x5000
MMC read: dev # 0, block # 327680, count 20480 … 20480 blocks read: OK
80241612 Bytes/s
输入命令默认都是16进制，打印信息是10进制，这里的block单位应该是字节
再次读取内存 md.b 1FFBFC0 5000
01ffbfc0: 41 4e 44 52 4f 49 44 21 50 b6 77 00 00 80 00 03 ANDROID!P.w…
01ffbfd0: 23 fe 04 00 00 00 00 04 00 00 00 00 00 00 f0 03 #…
01ffbfe0: 00 01 00 03 00 40 00 00 00 00 00 00 00 00 00 00 …@…
…这中间全是0
01ffc200: c6 e6 ac 8c 32 d7 98 86 bf 98 91 0c 42 28 7d e2 …2…B(}.
01ffc210: ea b0 4b ec 00 00 00 00 00 00 00 00 00 00 00 00 …K…
…这中间全是0
01ffffb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
01ffffc0: 27 05 19 56 7e 21 a9 0d 56 9e f4 a1 00 77 b6 10 ‘…V~!..V…w…
01ffffd0: 02 00 00 00 02 00 00 00 65 27 d6 0b 05 02 02 00 …e’…
01ffffe0: 4c 69 6e 75 78 2d 33 2e 31 30 2e 30 5f 73 34 30 Linux-3.10.0_s40
01fffff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …
02000000: 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 …
02000010: 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 …
02000020: 02 00 00 ea 18 28 6f 01 00 00 00 00 10 b6 77 00 …(o…w.
02000030: 00 90 0f e1 09 12 00 eb 01 70 a0 e1 02 80 a0 e1 …p…
02000040: 00 20 0f e1 03 00 12 e3 01 00 00 1a 17 00 a0 e3 . …
02000050: 56 34 12 ef 00 00 0f e1 1a 00 20 e2 1f 00 10 e3 V4… …
02000060: 1f 00 c0 e3 d3 00 80 e3 04 00 00 1a 01 0c 80 e3 …
02000070: 0c e0 8f e2 00 f0 6f e1 0e f3 2e e1 6e 00 60 e1 …o…n.`.
02000080: 00 f0 21 e1 09 f0 6f e1 00 00 00 00 00 00 00 00 …!..o…
先尝试执行命令进行启动 bootm 0x1FFBFC0
接上HDMI显示器正常显示界面，串口提示符为 root@Hi3798MV100:/ #

安卓是基于linux的，从前面的读取信息看起来linux启动地址可能是 01ffffc0
fastboot# mmc read 0 0x1FFBFC0 0x50000 0x5000

MMC read: dev # 0, block # 327680, count 20480 … 20480 blocks read: OK

80418848 Bytes/s
fastboot# bootm 01ffffc0

Booting kernel from Legacy Image at 01ffffc0 …
Image Name: Linux-3.10.0_s40
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 7845392 Bytes = 7.5 MiB
Load Address: 02000000
Entry Point: 02000000
XIP Kernel Image … OK
OK

Starting kernel …

Uncompressing Linux… done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.0_s40 (wentong.cen@um-zc) (gcc version 4.4.1 (Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)) ) #1 SMP Wed Jan 20 10:44:41 CST 2016
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: bigfish
cma: CMA: reserved 436 MiB at 23800000
cma: CMA: reserved 4 MiB at 3fc00000
Memory policy: ECC disabled, Data cache writealloc
CPU: Hi3798Mv100
PERCPU: Embedded 8 pages/cpu @81a84000 s12224 r8192 d12352 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 260096
Kernel command line: console=ttyAMA0,115200 blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata) androidboot.serialno=005404FF0018143000010019F0E21CC6 androidboot.deviceid=111018410000046 androidboot.serialno=005404FF0018143000010019F0E21CC6 androidboot.deviceid=111018410000046 mem=1G mmz=ddr,0,0,435M
…
猜中，能引导内核，识别了多种外设，只是最后没有找到root而pannic死机了
…
ALSA device list:
#0: HISI-AIAO
VFS: Cannot open root device “(null)” or unknown-block(0,0): error -6
Please append a correct “root=” boot option; here are the available partitions:
b300 7634944 mmcblk0 driver: mmcblk
b301 1024 mmcblk0p1
b302 1024 mmcblk0p2
b303 10240 mmcblk0p3
b304 2048 mmcblk0p4
b305 8192 mmcblk0p5
b306 8192 mmcblk0p6
b307 20480 mmcblk0p7
103:00000 20480 mmcblk0p8
103:00001 10240 mmcblk0p9
103:00002 40960 mmcblk0p10
103:00003 40960 mmcblk0p11
103:00004 40960 mmcblk0p12
103:00005 20480 mmcblk0p13
103:00006 1024 mmcblk0p14
103:00007 10240 mmcblk0p15
103:00008 71680 mmcblk0p16
103:00009 8192 mmcblk0p17
103:0000a 8192 mmcblk0p18
103:0000b 8192 mmcblk0p19
103:0000c 307200 mmcblk0p20
103:0000d 614400 mmcblk0p21
103:0000e 1048576 mmcblk0p22
103:0000f 51200 mmcblk0p23
103:00010 5280768 mmcblk0p24
b310 4096 mmcblk0boot1 (driver?)
b308 4096 mmcblk0boot0 (driver?)
b318 3891200 mmcblk1 driver: mmcblk
b319 3887104 mmcblk1p1 00000000-01
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.10.0_s40 #1
堆栈信息略
上面信息看起来，甚至还识别出了4GB的外置SD卡mmcblk1，只包含一个分区
b300 7634944 mmcblk0 driver: mmcblk
b318 3891200 mmcblk1 driver: mmcblk
把SD卡插入读卡器，显示 3976200192字节 / 1024 = 3883008 KB
这段内存只有13*16-8=208字节，可能是指向内核的一些信息。

看起来离正常启动，只差一个文件系统。

rufus-3.9.exe写入 2020-05-27-raspios-buster-lite-armhf.img

日志：
Rufus x86 v3.9.1624
Windows version: Windows 10 64-bit (Build 18362.1016)
Syslinux versions: 4.07/2013-07-25, 6.04/pre1
Grub versions: 0.4.6a, 2.04
System locale ID: 0x0804 (zh-CN)
Will use default UI locale 0x0804
SetLGP: Successfully set NoDriveTypeAutorun policy to 0x0000009E
Localization set to ‘zh-CN’
Notice: The ISO download feature has been deactivated because ‘Check for updates’ is disabled in your settings.
Found USB 2.0 device ‘Generic STORAGE DEVICE USB Device’ (05E3:0723)
1 device found
Disk type: Removable, Disk size: 4GB, Sector size: 512 bytes
Cylinders: 484, Tracks per cylinder: 255, Sectors per track: 63
Partition type: MBR, NB Partitions: 1
Disk ID: 0x00000000
Drive has a Zeroed Master Boot Record
Partition 1:
Type: FAT32 (0x0b)
Size: 3.7 GB (3980394496 bytes)
Start Sector: 8192, Boot: No
Scanning image…
ISO analysis:
‘D:\迅雷下载\2020-05-27-raspios-buster-lite-armhf.img’ doesn’t look like an ISO image
Disk image analysis:
Image has an unknown Master Boot Record
Image is a bootable disk image
Using image: 2020-05-27-raspios-buster-lite-armhf.img (1.7 GB)

Format operation started
Requesting disk access…
Will use ‘E:’ as volume mountpoint
Deleting partitions…
Deleting ALL partition(s) from disk ‘\?\PhysicalDrive1’:
● Partition 1 (offset: 4194304, size: 3.7 GB)
Opened \.\PhysicalDrive1 for exclusive write access
Writing Image…
Timeout while waiting for logical drive

Found USB 2.0 device ‘Generic STORAGE DEVICE USB Device’ (05E3:0723)
No logical drive found (unpartitioned?)
1 device found
No volume information for drive 0x81
Disk type: Removable, Disk size: 4GB, Sector size: 512 bytes
Cylinders: 484, Tracks per cylinder: 255, Sectors per track: 63
Partition type: MBR, NB Partitions: 2
Disk ID: 0x2FED7FEE
Drive has an unknown Master Boot Record
Partition 1:
Type: FAT32 LBA (0x0c)
Size: 256 MB (268435456 bytes)
Start Sector: 8192, Boot: No
Partition 2:
Type: GNU/Linux (0x83)
Size: 1.5 GB (1581252608 bytes)
Start Sector: 532480, Boot: No
日志结束

尝试factory_bootargs参数启动

fastboot# setenv bootargs ‘mem=1G console=ttyAMA0,115200 root=/dev/mmcblk0p16 rootfstype=ext3 rootwait blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata)’
fastboot# mmc read 0 0x1FFBFC0 0x50000 0x5000

MMC read: dev # 0, block # 327680, count 20480 … 20480 blocks read: OK

80359682 Bytes/s
fastboot# bootm 01ffffc0

启动提示，找到了root根分区 EXT3-fs (mmcblk0p16)
ALSA device list:
#0: HISI-AIAO
kjournald starting. Commit interval 5 seconds
EXT3-fs (mmcblk0p16): using internal journal
EXT3-fs (mmcblk0p16): recovery complete
EXT3-fs (mmcblk0p16): mounted filesystem with writeback data mode
VFS: Mounted root (ext3 filesystem) on device 259:8.
Freeing unused kernel memory: 448K (80ee1000 - 80f51000)

        _ _ _ _ _ _ _ _ _ _ _ _
        \  _  _   _  _ _ ___
        / /__/ \ |_/
       / __   /  -  _ ___
      / /  / /  / /

_ _ _ / / / _/ _ ______
_________

Not find ldconfig
[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90modules
hi_media: exports duplicate symbol DRV_PM_ModExit (owned by kernel)
后面不少ko模块加载失败了
SQUASHFS error: Xattrs in filesystem, these will be ignored
SQUASHFS error: unable to read xattr id index table
/
[RCS]: /etc/init.d/S99init
Compile file system used arm-hisiv200-linux-
2015-07-31 14时06分25秒 (gsdk@dell910)
Welcome to HiLinux.
call checkca
./test.sh: line 28: ./checkca: not found

屏幕黑屏了，串口后面不停打印类似信息，好像是完全循环打印。
==fd:1,BlockSize=0x2000
g_sto_loaderdb=0x154ab50
erase fd :0 fail
hi_flash_put_data offset 0, data 0xb0198, len 528
hi_flash_put_data fd:1
write ldb success,release s_ldb_Mutex!

crc success,read main ldb success,release s_ldb_Mutex!
loaderinfo.succes=0x40000
HI_WLAN_STA_GetConnectionStatus ret=0
OTA_COMMON_WriteLoaderInfo lock s_ldb_Mutex succees!
关机，启动，屏幕显示无变化。

再来尝试从SD卡启动

根据factory_bootargs参数修改，sd卡写了2个分区，从1开始编号，第一个分区可能是/boot，这里选第2个分区
fastboot# setenv bootargs ‘mem=1G console=ttyAMA0,115200 root=/dev/mmcblk1p2 rootfstype=ext3 rootwait blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata)’
fastboot# mmc read 0 0x1FFBFC0 0x50000 0x5000

MMC read: dev # 0, block # 327680, count 20480 … 20480 blocks read: OK

80359682 Bytes/s
fastboot# bootm 01ffffc0
识别了新分区，但启动失败
b318 3891200 mmcblk1 driver: mmcblk
b319 262144 mmcblk1p1 2fed7fee-01
b31a 1544192 mmcblk1p2 2fed7fee-02
No filesystem could mount root, tried: ext3
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(179,26)

进入安卓检查一下分区

root@Hi3798MV100:/ # mount
…
/dev/block/platform/hi_mci.1/by-name/system /system ext4 ro,relatime,data=ordered 0 0
/dev/block/vold/179:25 /mnt/mmcblk1/mmcblk1p1 vfat rw,dirsync,nosuid,nodev,relatime,uid=1000,gid=1015,fmask=0000,dmask=0000,allow_utime=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:26 /mnt/mmcblk1/mmcblk1p2 ext4 rw,dirsync,nosuid,nodev,relatime,data=ordered,share 0 0
root@Hi3798MV100:/ # ls -l /mnt/mmcblk1/mmcblk1p1
包含kernel.img等
root@Hi3798MV100:/ # ls /mnt/mmcblk1/mmcblk1p2
包含 bin etc dev proc
看来挂载的分区也确实是根盘，但从mount可以看出是ext4分区，但安卓的内核是支持ext4的。
挂载emmc的内核所在分区失败
root@Hi3798MV100:/data # mount -r -w -t ext4 /dev/block/mmcblk0p12 /mnt/tmp
mount: Invalid argument

在linux下挂载cp -a拷贝出去，格式化mkfs.ext3，再拷贝回来

识别根分区了，挂死在这里
ALSA device list:
#0: HISI-AIAO
kjournald starting. Commit interval 5 seconds
EXT3-fs (mmcblk1p2): using internal journal
EXT3-fs (mmcblk1p2): mounted filesystem with writeback data mode
VFS: Mounted root (ext3 filesystem) on device 179:26.
Freeing unused kernel memory: 448K (80ee1000 - 80f51000)

选择下载的匹配文件系统

rufus-3.9.exe写入hi3798mv-ubuntu\debian.img时，无法选择镜像文件，调整为非可引导，选择了默认的FAT格式写入4G TF卡。
只有一个分区，需要修改root
fastboot# setenv bootargs ‘mem=1G console=ttyAMA0,115200 root=/dev/mmcblk1p1 rootfstype=ext3 rootwait blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),10M(loaderdb),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),1M(stbid),10M(fackernel),70M(facrootbox),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),600M(cache),1024M(system),50M(keydata),-(userdata)’
fastboot# mmc read 0 0x1FFBFC0 0x50000 0x5000

MMC read: dev # 0, block # 327680, count 20480 … 20480 blocks read: OK

80359682 Bytes/s
fastboot# bootm 01ffffc0
报错
No filesystem could mount root, tried: ext3
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(179,25)

不能再次选择img文件了，总是提示 未能扫描到镜像 Failed to scan image
更新版本： Rufus 3.11 (2020.06.19)，未解决。
正确方法：选择报错后，只需要修改引导类型，不需要再次选择。
更改为ext3分区写入，非常慢，尝试几次后使用DiskGenius格式化，较快。
Rufus 3.11不勾选快速格式化，仍然会删除分区重新格式化。

写入对应的根文件系统，正确识别rootfs，还是会死机

setenv bootargs ‘mem=1G console=ttyAMA0,115200 root=/dev/mmcblk1p1 rootfstype=ext3 rootwait rw’
mmc read 0 0x1FFBFC0 0x50000 0x5000
bootm 01ffffc0

死机在这里，没有报pannic rootfs
ALSA device list:
#0: HISI-AIAO
kjournald starting. Commit interval 5 seconds
EXT3-fs (mmcblk1p1): using internal journal
EXT3-fs (mmcblk1p1): recovery complete
EXT3-fs (mmcblk1p1): mounted filesystem with writeback data mode
VFS: Mounted root (ext3 filesystem) on device 179:25.
Freeing unused kernel memory: 448K (80ee1000 - 80f51000)

备份emmc卡内容到u盘

先备份前面5个分区 mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam)
共22M=2210241024=0x1600000
fastboot# mmc read 0 0x01000000 0 0x1600000

MMC read: dev # 0, block # 0, count 23068672 …
*** irq: prefetch abort

*** irq: undefined instruction
报错了，把内存搞混乱了。只读取2M，安卓的不管了
1GB最大 0x4000 0000
fastboot# mmc read 0 0x30000000 0 0x200000
都不行

尝试用usbboot启动

拷贝配套的linux系统
root@ubuntu18:~# dd if=ubuntu-16-04.img of=/dev/sdb bs=M status=progress
404201472 bytes (404 MB, 385 MiB) copied, 9 s, 44.2 MB/s
^CC
385+1 records in
385+1 records out
404201472 bytes (404 MB, 385 MiB) copied, 576.607 s, 701 kB/s
dd: closing input file ‘ubuntu-16-04.img’: Bad file descriptor
虚拟机下去写，作，太慢；改用Rufus格式化ext3也很慢，而且只能格式化，写入后无文件；
用rsync写，再用sync同步缓存。
root@ubuntu18:~# mount /dev/sdb1 /mnt
root@ubuntu18:~# mount ubuntu-16-04.img /media/
root@ubuntu18:~# rsync /media/ /mnt -av
root@ubuntu18:~# sync
root@ubuntu18:~# umount /mnt
usb start
usb boot启动不了

决定尝试重刷uboot

重刷动力

缺少内存分布说明
usb不能启动
ext3分区不能直接读取
sd卡不能识别
配置网络后ping不通serverip
各种失败，这个uboot版本叫dirty估计就是这么来的。
进入安卓直接卡死不能动
lowmemorykiller: Killing ‘shcmcc.download’ (8159), adj 647,
to free 14044kB on behalf of ‘kswapd0’ (541) because
cache 16328kB is below limit 16384kB for oom_score_adj 529
Free memory is -184kB above reserved
init: untracked pid 9502 exited

烧写Fastboot镜像也失败

HiTool–HiBurn 4.0.10–烧写eMMC，采用下载的20200318-hi3798mv100-ubuntu16.04
指定分区表文件，emmc_partitions-rootfs.xml 注意修改为实际存放路径
关闭其他串口连接，关闭机顶盒，由于网口有问题，本次使用串口先刷（只勾选）fastboot，不勾选20M的bootargs（串口太慢）
串口已经连接，请给单板上电，若已经上电，请断电后重新上电。
######################发送头帧失败，可能的原因如下：
1.烧写的Fastboot镜像与当前单板型号不匹配导致
2.单板DDR有问题，无法正常进行DDR初始化操作
下载文件失败！
Failed to download fastboot!
这个不是华为盒子，看来还有校验，工具也不好使。
烧写Fastboot–Flash类型选择ddr也是一样报错。

看看uboot信息

之前备份出来的
vim -b fastboot.bin
:%!xdd
文件头信息
00000000: 1908 00ea 14f0 9fe5 14f0 9fe5 14f0 9fe5 …
00000010: 14f0 9fe5 14f0 9fe5 14f0 9fe5 14f0 9fe5 …
00000020: 804e c000 004f c000 804f c000 0050 c000 .N…O…O…P…
00000030: 8050 c000 0051 c000 8051 c000 0d59 5a43 .P…Q…Q…YZC
00000040: 7631 2e31 2e30 0000 0000 0000 0000 0000 v1.1.0…
00000050: a000 0000 6018 0000 0000 0000 0000 0000 …`…
00000060: 0000 0000 0000 0000 0000 0000 0000 0000 …
00000070: 0000 0000 0000 0000 0000 0000 0000 0000 …
00000080: 3230 3136 2d31 2d32 3120 2031 313a 3434 2016-1-21 11:44
00000090: 3a30 3400 6869 3337 3938 6d64 6d6f 3166 :04.hi3798mdmo1f
000000a0: 5f68 6933 3739 386d 7631 3030 5f64 6472 _hi3798mv100_ddr
000000b0: 335f 3167 6279 7465 5f31 3662 6974 7832 3_1gbyte_16bitx2
000000c0: 5f32 6c61 7965 7273 5f65 6d6d 632e 7265 _2layers_emmc.re
000000d0: 6700 0000 0000 0000 0000 0000 0000 0000 g…
000000e0: c820 a2f8 0100 0000 0000 0000 ff00 0000 . …
000000f0: 1830 a2f8 a700 4300 6400 0000 ff00 0000 .0…C.d…
00000100: 1c30 a2f8 e700 2f00 6400 0000 ff00 0000 .0…/.d…
…
00001870: ac00 00f8 ff00 0000 0000 0000 3f40 0000 …?@…
00001880: 0000 0000 0000 0000 0000 0000 0000 0000 …
0x1880 * 0xf = 96kb，但后面数据不为0

手动加载外部内核指定根系统

fastboot# getinfo ddrfree
DDR free region baseaddr:0x1000000 size:0x3F000000
读取1M字节正常
fastboot# mmc read 0 1000000 0 100000

MMC read: dev # 0, block # 0, count 1048576 … 1048576 blocks read: OK

76089447 Bytes/s

显示前面1段，相同的
fastboot# fastboot# md.b 1000000 10000

把U盘格式化为fat32格式，拷贝kernel进去。
启动usb
fastboot# usb start
(Re)start USB…
USB0: Register 1212 NbrPorts 2
USB EHCI 1.00
scanning bus 0 for devices… 3 USB Device(s) found
USB1: Register 1111 NbrPorts 1
USB EHCI 1.00
scanning bus 1 for devices… 1 USB Device(s) found
scanning usb for storage devices… 1 Storage Device(s) found
查看分区，设备0分区1
fastboot# usb part 0

Partition Map for USB device 0 – Partition Type: DOS

Partition Start Sector Num Sectors Type
1 2048 15726592 c
查看设备，当前选择的0
fastboot# usb dev

USB device 0: Vendor: Rev: 8.07 Prod:
Type: Removable Hard Disk
Capacity: 7680.0 MB = 7.5 GB (15728640 x 512)
设置选择设备0，可以跳过
fastboot# usb dev 0

USB device 0:
Device 0: Vendor: Rev: 8.07 Prod:
Type: Removable Hard Disk
Capacity: 7680.0 MB = 7.5 GB (15728640 x 512)
… is now current device
查看文件正常
fastboot# fatinfo usb 0:1
Interface: USB
Device 0: Vendor: Rev: 8.07 Prod:
Type: Removable Hard Disk
Capacity: 7680.0 MB = 7.5 GB (15728640 x 512)
Partition 1: Filesystem: FAT32 "NO NAME "
fastboot# fatls usb 0:1
system volume information/
7243160 hi_kernel.bin

1 file(s), 1 dir(s)

fastboot#
加载内核文件到内存
fastboot# fatload
usage: fatload <dev[:part]> [bytes]
fastboot# fatload usb 0:1 2000000 hi_kernel.bin
reading hi_kernel.bin
…
7243160 bytes read
fastboot# bootm 2000000
正常进入安卓界面

增加rootfs，去掉mem=1G
把命令重新汇总
setenv bootargs ‘console=ttyAMA0,115200 root=/dev/mmcblk1p2 rootfstype=ext3 rootwait rw’
usb start
fatload usb 0:1 2000000 hi_kernel.bin
bootm 2000000
这次看仔细了，自动重启了uboot。
fastboot# bootm 2000000
Booting kernel from Legacy Image at 02000000 …
Image Name: Linux-3.18.24_s40
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 7243096 Bytes = 6.9 MiB
Load Address: 02000000
Entry Point: 02000000
XIP Kernel Image … OK
OK

Starting kernel …

*** irq: undefined instruction
undefined instruction
pc : [<600001d3>] lr : [<00c67c28>]
sp : 00bfffb8 ip : 00d003e0 fp : 00000124
r10: 00ce3e48 r9 : 000006ff r8 : 005fffe0
r7 : 00610720 r6 : 005ff1c0 r5 : 00000000 r4 : 005fffc4
r3 : 02000000 r2 : 00000100 r1 : 00001f40 r0 : 00000000
Flags: nzcv IRQs on FIQs on Mode UK8_26
Resetting CPU …

resetting …
▒
Bootrom start
Boot from eMMC
Starting fastboot …

换回原来指定的内存地址 0x1FFBFC0，用的树莓派的根文件系统是ext4的（如果指定ext3会Unable to mount root fs）
setenv bootargs ‘console=ttyAMA0,115200 root=/dev/mmcblk1p2 rootfstype=ext4 rootwait rw’
usb start
fatload usb 0:1 0x1FFBFC0 hi_kernel.bin
bootm 0x1FFBFC0
好吧，我顺利进入了树莓派的图形界面。
串口显示
Raspbian GNU/Linux 10 raspberrypi ttyAMA0

raspberrypi login:

能正常显示，但色彩较差，字体不是很清除，cpu占用5，内存使用220/988MB
wifi不能驱动，插上网线正常
root@raspberrypi:/home/pi# ping qq.com
PING qq.com (58.247.214.47) 56(84) bytes of data.
64 bytes from 58.247.214.47 (58.247.214.47): icmp_seq=1 ttl=54 time=34.2 ms
开哔哩哔哩正常，首页+弹幕播放完全卡死，关闭弹幕，720p经常缓冲，勉强可以看，cpu在80-90；声卡不能驱动。
只有2个usb，缺一个usb口，还不能接键盘

root@raspberrypi:/home/pi# lscpu
Architecture: armv7l
Byte Order: Little Endian
CPU(s): 4
On-line CPU(s) list: 0-3
Thread(s) per core: 1
Core(s) per socket: 4
Socket(s): 1
Vendor ID: ARM
Model: 5
Model name: Cortex-A7
Stepping: r0p5
CPU max MHz: 1500.0000
CPU min MHz: 600.0000
BogoMIPS: 1169.81
Flags: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae
root@raspberrypi:/home/pi# cat /proc/cpuinfo
Hardware : bigfish

小结一下

1、uboot是板级软件，完全不能通用。
2、安卓的内核虽然也是Linux，但不能引导Linux的根文件系统。
3、内核加载（引导）地址是板级固化的地址，不能乱放。
4、linux的内核对CPU具体型号和厂家没有明显限制，比如树莓派和机顶盒都是armV7的cpu是通用的。
5、网卡、声卡的驱动内核可能不支持，需要单独移植。

下一篇：改造安卓+Linux双启动，配置mini和ubuntu系统rootFs根系统。

已完成，参考文档。
自动启动到linux，可以挂载移动硬盘，安装samba可以实现和windows共享。