OptiStick 5 signed-bootloader boot test

2026-10-29 · Wilber Zheng · S905X5M (S7D) · eFuse NOT burned

Summary

The device-signed ROM dbg1479 does not boot. On every power-on the chain loads up to boot bl33 !, then U-Boot prints nothing, the chip resets, and the BootROM drops into USB download mode (DFU:1). It happened the same way on two power-ons in a row.

The unit is not bricked. eFuse is open, and the BootROM USB mode still accepts a normal burn.

I only signed the bootloader with the keys SEI gave me. Secure boot is not enabled, because no eFuse was burned. The ROM was burned with Aml_Dev_Tool_Mac. With eFuse open, I expected it to boot like an unsigned ROM, but it fails.

Signed ROM (Google Drive): dbg1479 device-signed .img

Identity

	dbg1479 (tested, fails)	dbg1476 (unsigned twin, for comparison)
File	`optistick-x5m-dbg1479-1g-387047605-sb-prd36-device-signed.img`	`optistick-x5m-dbg1476-1g-f953a8b94-sb-prd36-unsigned-twin.img`
md5	`9c5b93f925245245ed5a01ffe9984e9c`	`3deceafbd9a68c1c060805e915cae796`
Source	prd100036 source (tag rom/prd100036, 1a54d9934) + local commits a0e6b588a, 387047605 on `feature/wilber/secureboot-prd36-test` (local only, not pushed)	Same prd100036 source + local commit f953a8b94
U-Boot	`u-boot.bin.device.signed`, md5 `d849c424e61de708384d945ca4e12038`	Not device-signed (Amlogic chip-signed only, as today)
Machine	`mesons7d-bm201-6.12-lib32`, app 5.7.1-P14

What was changed for dbg1479

U-Boot defconfig: CONFIG_AML_SIGNED_UBOOT=y. The build then runs device-vendor-scs-signing.sh.
Keys: the device-keys set SEI supplied, made with the s905x5m template. Its roothash 27b52f175f4b… matches the eFuse pattern file.
device-fip-header.bin was regenerated with gen_scs_root_hash.sh … --project s905x5m --ops create-device-fip. The supplied header had different blob-size fields, so this SDK's BL30 failed the size check. The regenerated header leaves the roothash unchanged.
Python 2 was installed on the build host because pem_extract_pubkey.py needs it.
Not changed: eFuse (nothing burned), Yocto DISTRO_FEATURES (AVB and scs are not enabled), and the USB-burn stage files (still chip-signed .usb.signed).

What the log shows

Stage	dbg1479
DDR training	OK (1024 MB @ 1584 MHz)
BL2E, BL2X load	SHA CHK OK
BL31, BL32 (OP-TEE)	Started
BL33 (U-Boot)	`decomp BL33 is Success`, then `boot bl33 !`, then no U-Boot output at all
After that	BootROM banner again: `DFU:0 … USB:ADFU`, then `DFU:1;USB:0` (USB download mode)

The same log also has Fails to run secpu(0xfffffff9), ampk: no key in acs and ampk: read vendor_key failed. I have no bootloader log of a normal boot to check whether these lines also appear there. The normal-boot log below starts in the kernel.

Key lines (dbg1479)

NOTICE:  decomp BL33 is Success
bl2e stage2 enable mmu
boot bl33 ! TE:905394

S7D:BL:483268;ID:<chip-id>;FEAT:30F:10000:B002F:19;POC:FF;RCY:0;OVD:0;DFU:0;NAND:306;SPINAND:2FF;SD:2002;USB:ADFU
S7D:BL:483268;ID:<chip-id>;FEAT:30F:10000:B002F:19;POC:FF;RCY:0;OVD:0;DFU:1;USB:0;RD-0:0:0;

Questions for Frank / Amlogic

On an unfused S7D, should a u-boot.bin.device.signed built with CONFIG_AML_SIGNED_UBOOT=y boot the same way an unsigned one does?
fip/s7d/generate-device-keys/gen-device-fip.sh lines 71 and 74 always pass --infile-aes256-bl30-payload / --infile-aes256-bl33-payload=genkey-prot-*.bin. These keys are derived from DVGK. Is BL33 encrypted in this output? If it is, can an unfused chip with no DVGK run it?
Is regenerating device-fip-header.bin with this SDK, with the s905x5m template, the right fix for the BL30 size mismatch? Or should the header come from Amlogic together with the keys?
Is the defconfig switch enough, or do I need the Yocto scs flow from the secure-boot guide?

Key files and eFuse files

The signing used the SEI device-keys set with the regenerated header. No eFuse file was used in this test. The eFuse files are listed only for reference.

Public files (public key, templates, headers, root hash): public-keyset.zip (contains SHA256SUMS).

Private keys, the DVGK-derived AES keys and the eFuse files (which contain DVGK/DVUK) are listed by sha256 below. Full set, approved by Wilber for Frank's reference: stick5-secureboot-keyset-full.zip (original SEI files + every file and config I changed, see README.txt inside).

Note: level-2-rsa-priv.pem and all six *-level-3-rsa-priv.pem files in the supplied set have the same sha256, so they are the same key.

File	Type	sha256	Published
`boot-blobs/rsa/s905x5m/trustchain-0/key/level-1-rsa-priv.pem`	10f1e82ce0346b16e0712b2350e344f3b90dfe8244a3e947d3658047abc2ddc2	`private key`	no (secret)
`boot-blobs/rsa/s905x5m/trustchain-0/key/level-2-rsa-priv.pem`	04d4dae6a13a2facbe9242d6f81a02f5515c15332187b0262d7a71ebffd3f1e5	`private key`	no (secret)
`boot-blobs/rsa/s905x5m/trustchain-0/key/level-2-rsa-pub.pem`	9b77cf803a330f0449ee463bb39d5cf2fb7366b551b5f76254121102f8224baa	`public key`	yes
`boot-blobs/template/s905x5m/trustchain-0/bb1st.bin`	5578f814e94fe9395c0aa1db958359d6966d03a551f2941113fede9fb5cb4357	`signed template`	yes
`fip/aes/s905x5m/protkey/genkey-prot-bl30.bin`	5be4b8a78ede9b101303a08a3eac8ce9f54cc7146184452b42335e307cbb77c6	`AES key (from DVGK)`	no (secret)
`fip/aes/s905x5m/protkey/genkey-prot-bl33.bin`	e28f010c8f009ea137efa6b05199063739a88c8b1d0fd48b160832c33feedf88	`AES key (from DVGK)`	no (secret)
`fip/aes/s905x5m/protkey/genkey-prot-krnl.bin`	037d71e0b3aa577710f3ea5c5150aa6b1f4125adb54be3da607fdc713667fd39	`AES key (from DVGK)`	no (secret)
`fip/rsa/s905x5m/trustchain-0/key/{bl30,bl31,bl32,bl33,bl40,krnl}-level-3-rsa-priv.pem`	04d4dae6a13a2facbe9242d6f81a02f5515c15332187b0262d7a71ebffd3f1e5	`private keys (6 files)`	no (secret)
`fip/template/s905x5m/trustchain-0/device-fip-header.bin (regenerated, used in dbg1479)`	cbc17bb94a0d781f9dadd3a53b5cac71f2c1f97045e14ed3f007110e2ecf6f15	`signed header`	yes
`device-fip-header.bin as supplied (replaced)`	e24fa1c2be487c8e10ad5ace6eab8698ed0a4bcb61263541d15f312c3ce6140c	`signed header`	yes
`root/rsa/s905x5m/roothash/hash-device-rootcert-rsa.bin`	27b52f175f4b3ea13b17e3f471b63099f7484e027fd0bc9d33a343561f25f702	`root hash`	yes
`pattern.scs_usbpwd.efuse (as supplied)`	d77654fb411a91694624555266d779eebbeb54583056b2bbd15c968d224c6a37	`eFuse pattern (contains DVGK/DVUK)`	no (secret)
`pattern.scs_nolock.efuse (generated by efuse-gen.sh, no USB/DIF lock)`	845931fb1d94570bea1f38278b8d332be6abf0fe3f85045f540a48dcc5ff7c52	`eFuse pattern (contains DVGK/DVUK)`	no (secret)

Logs

Scrubbed: chip ID, Ethernet MAC and journal machine-id are replaced by placeholders.

dbg1479, device-signed, fails (full UART capture of one power-on)

# OptiStick 5 (S905X5M / S7D), UART log, firmware dbg1479 (device-signed u-boot), eFuse NOT burned.
# Captured by Wilber 2026-10-29 on two consecutive power-ons; both identical. This is the second one.
# Scrubbed: chip ID -> <chip-id>. The log starts mid DDR training (start of the UART capture).

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 2
ret_r0

ddr read dq window  0000 0000 0000 0076 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 007a 0000 0000 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 3
ret_r0

ddr read dq window  0000 0000 0000 0000 0000 0073 0000 0000 0000 0074 0000 0000 0000 0000 0000 0000 0000 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 4
ret_r0

ddr read dq window  0000 0000 0072 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 5
ret_r0

ddr read dq window  0074 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0073 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 6
ret_r0

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0071 0000 0000 0000 0075 0000 0000 0000 0000 0000 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq pinmux det pin 7
ret_r0

ddr read dq window  0000 0070 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0073 0000 0000 0000 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

rd dq pinmux det training result
0 32
1 1
2 4
3 5
4 2
5 7
6 6
7 0
8 3
9 10
10 8
11 14
12 33
13 15
14 9
15 13
16 12
17 11
18 17
19 22
20 34
21 19
22 16
23 18
24 20
25 23
26 21
27 28
28 29
29 35
30 26
31 31
32 25
33 30
34 24
35 27
mrs13,0x000000c8
mrs3,0x00000035
mrs4,0x00000000
mrs11,0x00000025
mrs12,0x00000066
mrs16,0x00000000
mrs17,0x00000000
mrs14,0x00000048
mrs22,0x0000001e
mrs23,0x00000040
mrs1,0x00000054
mrs2,0x0000002d
mrs32,0x00000055
mrs40,0x00000055
mrs15,0x00000000
mrs20,0x00000000
rd dq training
ret_r0

ddr read dq window  0073 0078 0079 0075 0075 0075 0072 0070 0000 0076 0076 0079 0074 007b 0075 0073 0075 0000

ret_r1

ddr read dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

ret_r0

ret_r1

ret_r0

ret_r1

write leveling training
ret_r0

ddr write leveling  007f 0091
ret_r1

ddr write leveling (warning 0006  01bf) 0080(warning 0007  01bf) 0080
tdqs2dq=226
write dq training
ret_r0

ddr write dq window  0076 0076 0073 0075 0078 0079 0078 0077 007b 007b 0079 007b 007a 0078 0079 007b 0078 0000
ret_r1

ddr write dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
ret_r0

ret_r1

user cmd dram vref 0x00000045,permil=240 /1000 *vddq
user cmd dram vref 0x00000048,permil=252 /1000 *vddq
write dq training
w_dq_coarse  0000007c 00000079 00000077 0000007a 00000000 00000000 00000000 00000000
write dq training
w_dq_coarse  0000007c 00000079 00000077 00000079 00000000 00000000 00000000 00000000
write dq training
w_dq_coarse  0000007c 00000079 00000077 0000007a 00000000 00000000 00000000 00000000
write dq training
w_dq_coarse  0000007c 00000079 00000077 00000077 00000000 00000000 00000000 00000000index 2 sub_index 0 phase 172
index 2 sub_index 1 phase 156
index 2 sub_index 2 phase 127
index 2 sub_index 3 phase 145
index 2 sub_index 4 phase 128
index 2 sub_index 5 phase 128
index 2 sub_index 6 phase 128
index 2 sub_index 7 phase 128

user cmd dram vref 0x00000048,permil=252 /1000 *vddq
write dq training
ret_r0

ddr write dq window  0077 0077 0072 0074 0079 0079 0077 0077 0079 0079 0079 007a 007a 0079 007b 0079 0079 0000
ret_r1

ddr write dq window  0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
ret_r0

ret_r1

user cmd dram vref 0x00000045,permil=240 /1000 *vddq
user cmd dram vref 0x00000048,permil=252 /1000 *vddqddr boot cost time 256382
2d-eye soc_vref ddr 0,ch 0 0017 0018 0018 0017 0017 0018 0019 0018 0016 0016 0017 0017 0016 0018 0016 0016 0016 0016 0020 0016 0017 0018 0017 0018 0015 0018 0018 0018 0019 0018 0017 0017 average_value_dec 0017 0187 mv
2d-eye dram_vref data 0x0048 0277 mv ac 0x0066 0409 mv
2d-eye soc_vref ddr 0,ch 1 0023 0024 0024 0023 0023 0024 0025 0024 0022 0022 0023 0023 0022 0024 0022 0022 0022 0022 0026 0022 0023 0024 0023 0024 0021 0024 0024 0024 0025 0024 0023 0023 average_value_dec 0023 0253 mv
2d-eye dram_vref data 0x0048 0277 mv ac 0x0066 0409 mv
org 5,0x0000ffff n 5,0x000000ff
org 8,0x00000808 n 8,0x00000008
org 8,0x00000808 n 8,0x00000008auto size-- 7680
org 8,0x00000808 n 8,0x00000008
org 8,0x00000808 n 8,0x00000008
CS0 size: 1024MB
DMC_DDR_CTRL: 0x02d10155
Total size: 1024MB @ 1584MHz
DDR : 1024MB @1584MHz



org 4,0x00000101 n 4,0x00000001
non-sec scramble use random key
scramble key_1 always use random key
ddr scramble enabled

dram_size_cfg =00000022
dram_cs0_size_MB_ch=00000400
dram_cs1_size_MB_ch=00000000
ddr_efuse_info[0]=00000000 [1]=00000000

ddr_refresh_offset=0x00000097 00000000
exit ddr boot

dram_total_size_MB =1024M

INFO: bl2_load_bl2ex start!

open all dmc permission
INFO: load ...
Load: BL2E From: eMMC - 3.2 src: 00002000, dst: 00fffff0, size: 00019000
off:00046200
sdemmc src: INFO: check ...
SHA CHK OK!

aml log : dump from buffer 01000000
5f 88 c6 dd 88 cc 6d 85 29 62 60 92 c3 5d 57 10
2f 6c d4 b8 45 aa 69 86 35 11 d1 a5 53 97 ad c3

INFO: load ...
Load: BL2X From: eMMC - 3.2 src: 00000000, dst: 007ffff0, size: 00019000
off:00061200
sdemmc src: INFO: check ...
SHA CHK OK!

aml log : dump from buffer 00800000
f4 af 7a 48 b8 ac 92 6d 75 cc fe 29 52 e1 f6 76
54 4e dc 2f ff bb ea 24 04 f9 b7 64 c5 f8 53 bc

run into bl2e
start:  BL2E stage from BL2 !
info: get valid params from BL2 !
bl2_gd_init
BL2E: do things as vendor specific ...
Hello world, now in BL2E

TE: 668176

BL2E 1.0.0 Built : 09:00:53, Mar 11 2025. s7d projects/amlogic-dev g9fe78db - bl.autobuild@walle02-sh


Start to do bl2e platform setup!
eMMC boot @ 2
sw-hs2 s
tun-w: s=3, sz=4
sw8 s
aml log : BL2E load BL3X.....

TE: 673147
Load: FIP HDR From: eMMC - 3.2 src: 00000000, des: 00308000, size: 00002000
off:000bc200
Load: BL3X From: eMMC - 3.2 src: 00002000, des: 0030a000, size: 0026c260
off:000be200
aml log : BL2E loading BL3X is done...!
boot bl2x
params to bl2x, address=0x0100e3c0


 Hello, we are in BL2X world !

TE: 717904

BL2X 1.1.0 Built : 07:10:10, Feb 10 2025. s7d projects/amlogic-dev g64bb619 - bl.autobuild@walle02-sh

bl2_platform_setup

ampk: no key in acs
INFO: get valid list_blobinfo, 0x0100e3c0

Loading secpu fw
Run secpu ... Fails to send 1st packet to secpu.(0xfffffff9)
Error: AML_ERROR_TIMEOUT
Fails to boot secpu rom.(0xfffffff9)
Fails to run secpu(0xfffffff9)
bl2e_2 entry: 010000c4
run into bl31
NOTICE:  BL31: start aocpu
NOTICE:  BL31: v2.7.2(release):s7_s7d_s6_nsv_11262024-30-g0874d7849 bl.autobuild@walle02-sh
NOTICE:  BL31: Built : 15:47:45, Mar 17 2026
[BL31] mbox init
NOTICE:  BL31:tsensor calibration: tsensor1 = 860000ac
NOTICE:  DEVICE_MVN=0x0
NOTICE:  ignore fixed_pll clock init
NOTICE:  vmin:34 d9 6 0!
NOTICE:  vmin:34 d9 6 0!
NOTICE:  decomp BL32 is Success
E/TC:0 00 INFO:    BL3-2: ATOS-V3.18.4-67066ff8a-bl.autobuild@walle02-sh (gcc version 13.3.1 20240614 (Arm GNU Toolchain 13.3.Rel1 (Build arm-13.24))) #1 Fri Feb  6 06:28:53 UTC 2026 aarch64

E/TC:0 00 INFO:    BL3-2: Chip: S7D Rev: B (47:B - 0:1)

E/TC:0 00 INFO:    BL3-2: Secure Timer Initialized.

E/TC:0 00 ampk_init:143 ampk: read vendor_key failed, res = 0xffff000b

NOTICE:  decomp BL33 is Success
bl2e stage2 enable mmu
boot bl33 ! TE:905394

S7D:BL:483268;ID:<chip-id>;FEAT:30F:10000:B002F:19;POC:FF;RCY:0;OVD:0;DFU:0;NAND:306;SPINAND:2FF;SD:2002;USB:ADFU
S7D:BL:483268;ID:<chip-id>;FEAT:30F:10000:B002F:19;POC:FF;RCY:0;OVD:0;DFU:1;USB:0;RD-0:0:0;

Normal boot (kernel excerpt from ~5.3 s)

# OptiStick 5 (S905X5M / S7D), UART log excerpt of a NORMAL boot, captured by Wilber 2026-10-29.
# Firmware of this boot: <firmware - to be confirmed by Wilber>.
# Excerpt only: it starts in the kernel at ~5.3 s (the bootloader part was not captured).
# Scrubbed: ethernet MAC -> <mac>, journal machine-id -> <machine-id>.

c]: aml_card_probe error ret:-517
[    5.347206][3 T608   -.] [snd-codec-t9015]: regmap_resource, to_acodec, start:0xfe330740, size:0x4
[    5.347736][3 T608   -.] [snd-codec-t9015]: regmap_resource, acodec, start:0xfe01a000, size:0x24
[    5.352424][0 T549   -.] amvenc probe, hcodec get reset failed: -2
[    5.353892][0 T572   -.] pps_core: LinuxPPS API ver. 1 registered
[    5.353974][0 T572   -.] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <[email protected]>
[    5.354499][2 T609   -.] vdin-v4l: vdin1 v4l2 open ok
[    5.355904][2 T609   -.] video71: VIDIOC_QUERYCAP: driver=vdin_video, card=meson-s4d, bus=vdin1 v4l2, version=0x20220120, capabilities=0x85201000, device_caps=0x05201000
[    5.360197][1 T60    -.] asoc-aml-card auge_sound: error -ENXIO: IRQ audio_exception64 not found
[    5.364138][1 T572   -.] PTP clock support registered
[    5.366095][0 T60    -.] [snd-codec-t9015]: no call standard reset interface
[    5.411254][1 T572   -.] meson8b-dwmac fe368000.ethernet: Cannot get pipe line clock
[    5.411564][1 T572   -.] meson8b-dwmac fe368000.ethernet: Cannot get gp clock
[    5.412444][1 T572   -.] meson8b-dwmac fe368000.ethernet: Cannot get gp clock
[    5.413040][0 T549   -.] [media_sync]:mediasync_policy_manager_init(ffffff800a714f00) initiation success.
[    5.421067][0 T549   -.] Registered frame rate driver success.
[    5.421983][1 T572   -.] meson8b-dwmac fe368000.ethernet: Cannot get gp clock
[    5.427844][0 T549   -.] zram: Added device: zram0
[    5.441821][1 T572   -.] meson8b-dwmac fe368000.ethernet: .DWMAC4/5
[    5.441936][1 T572   -.] meson8b-dwmac fe368000.ethernet: TX Checksum insertion supported
[    5.443038][1 T572   -.] meson8b-dwmac fe368000.ethernet: device MAC address <mac>
[    5.444040][1 T572   -.] meson8b-dwmac fe368000.ethernet: Enabled L3L4 Flow TC (entries=1)
[    5.452675][1 T572   -.] meson8b-dwmac fe368000.ethernet: Enabled RFS Flow TC (entries=10)
[    5.454019][1 T572   -.] could not read property 'amlogic,smc-id', default value will be used
[    5.454588][1 T572   -.] input: input_ethrcu as /devices/platform/soc/fe368000.ethernet/input/input9
[    5.510435][3 T51    -.] audit: type=1130 audit(1703415032.593:19): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=systemd-modules-load comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    5.602083][3 T764   -.] loop0: detected capacity change from 0 to 524288
[    5.603277][3 T714   -.] zram: setup backing device /dev/loop0
[    5.605386][0 T51    -.] audit: type=1130 audit(1703415032.697:20): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=systemd-sysctl comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    5.625884][3 T60    -.] aml_codec_T9015 fe01a000.t9015: ASoC: source widget Left DAC overwritten
[    5.626820][3 T60    -.] [snd-soc]: spdifout_play_with_zerodata_free, spdif id:0
[    5.627297][3 T60    -.] [snd-soc]: spdifout_play_with_zerodata_free, spdif id:1
[    5.627341][0 T714   -.] zram0: detected capacity change from 0 to 1903544
[    5.635738][3 T60    -.] [snd-soc]: Failed to add locker controls
[    5.635872][3 T60    -.] [snd-soc]: no node audio_effect for eq/drc info!
[    5.650327][3 T60    -.] [mdio-g12a]: tx_amp_addr fe010330
[    5.650387][3 T60    -.] [mdio-g12a]: txamp 0x187162e
[    5.650961][3 T60    -.] [mdio-g12a]: phy_mode 5
[    5.651537][3 T60    -.] [mdio-g12a]: use default st_mode
[    5.652206][3 T60    -.] [mdio-g12a]: led setting 0x2800000
[    5.674650][1 T817   -.] Adding 951768k swap on /dev/zram0.  Priority:100 extents:1 across:951768k SS
[    5.717787][3 T51    -.] audit: type=1130 audit(1703415032.805:21): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=optisigns-zram-setup comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.171215][3 T1194  -.] v4lvideo:[1]vidioc_open
[    6.171373][3 T1194  -.] v4lvideo:[1]vidioc_close!!!!
[    6.171745][3 T1194  -.] buf_mgr:[1:1]di buf_mgr free
[    6.175537][0 T1196  -.] v4lvideo:[3]vidioc_open
[    6.175536][3 T1201  -.] v4lvideo:[7]vidioc_open
[    6.175670][3 T1201  -.] v4lvideo:[7]vidioc_close!!!!
[    6.176099][0 T1196  -.] v4lvideo:[3]vidioc_close!!!!
[    6.177951][3 T1201  -.] buf_mgr:[1:7]di buf_mgr free
[    6.178898][0 T1199  -.] v4lvideo:[6]vidioc_open
[    6.178898][2 T1202  -.] v4lvideo:[4]vidioc_open
[    6.179024][0 T1199  -.] v4lvideo:[6]vidioc_close!!!!
[    6.179461][2 T1202  -.] v4lvideo:[4]vidioc_close!!!!
[    6.179994][0 T1199  -.] buf_mgr:[1:6]di buf_mgr free
[    6.180621][2 T1202  -.] buf_mgr:[1:4]di buf_mgr free
[    6.183064][2 T1195  -.] v4lvideo:[0]vidioc_open
[    6.183227][2 T1195  -.] v4lvideo:[0]vidioc_close!!!!
[    6.183593][2 T1195  -.] buf_mgr:[1:0]di buf_mgr free
[    6.184141][0 T1197  -.] v4lvideo:[2]vidioc_open
[    6.184832][0 T1196  -.] buf_mgr:[1:3]di buf_mgr free
[    6.186199][0 T1197  -.] v4lvideo:[2]vidioc_close!!!!
[    6.186237][0 T1197  -.] buf_mgr:[1:2]di buf_mgr free
[    6.188504][2 T1200  -.] v4lvideo:[5]vidioc_open
[    6.188724][2 T1200  -.] v4lvideo:[5]vidioc_close!!!!
[    6.189035][2 T1200  -.] buf_mgr:[1:5]di buf_mgr free
[    6.189366][0 T1198  -.] v4lvideo:[8]vidioc_open
[    6.190343][0 T1198  -.] v4lvideo:[8]vidioc_close!!!!
[    6.191257][0 T1198  -.] buf_mgr:[1:8]di buf_mgr free
[    6.311473][3 T1243  -.] FAT-fs (mmcblk0p11): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[    6.403468][3 T1281  -.] [wireless]: BT_RADIO going: on
[    6.403509][3 T1281  -.] [wireless]: AML_BT: going ON,btpower_evt=0
[    6.404223][3 T1281  -.] [wireless]: [off_def_power]: pid: 1281 comm: systemd-rfkill
[    6.412695][3 T51    -.] audit: type=1130 audit(1703415033.501:22): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=modprobe@efi_pstore comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.414673][3 T51    -.] audit: type=1131 audit(1703415033.501:23): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=modprobe@efi_pstore comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.420576][3 T51    -.] audit: type=1130 audit(1703415033.501:24): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=optisigns-timesync-state comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.425775][0 T1307  -.] overlayfs: failed to set xattr on upper
[    6.425850][0 T1307  -.] overlayfs: ...falling back to redirect_dir=nofollow.
[    6.426735][0 T1307  -.] overlayfs: ...falling back to uuid=null.
[    6.427766][3 T51    -.] audit: type=1130 audit(1703415033.509:25): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=systemd-random-seed comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.431413][0 T1310  -.] overlayfs: failed to set xattr on upper
[    6.431484][0 T1310  -.] overlayfs: ...falling back to redirect_dir=nofollow.
[    6.432520][0 T1310  -.] overlayfs: ...falling back to uuid=null.
[    6.451087][2 T51    -.] audit: type=1130 audit(1703415033.541:26): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=var-volatile-spool comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.453060][2 T51    -.] audit: type=1130 audit(1703415033.541:27): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='unit=var-volatile-srv comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[    6.465634][3 T548   -.] systemd-journald[548]: Oldest entry in /run/log/journal/<machine-id>/system.journal is older than the configured file retention duration (1month), suggesting rotation.
[    6.467335][3 T548   -.] systemd-journald[548]: /run/log/journal/<machine-id>/system.journal: Journal header limits reached or header out-of-date, rotating.
[    6.511143][2 T548   -.] systemd-journald[548]: Received client request to flush runtime journal.
[    6.581917][2 T548   -.] systemd-journald[548]: Oldest entry in /var/log/journal/<machine-id>/system.journal is older than the configured file retention duration (1month), suggesting rotation.
[    6.583623][2 T548   -.] systemd-journald[548]: /var/log/journal/<machine-id>/system.journal: Journal header limits reached or header out-of-date, rotating.
[    6.608667][0 T1281  -.] [wireless]: [usb_power_control] Set BT power down
[    6.608853][0 T1281  -.] [wireless]: [on_def_power]: pid: 1281 comm: systemd-rfkill
[    6.609818][0 T1281  -.] [wireless]: [usb_power_control] Set BT power on !
[    6.819818][3 T46    -.] meson-gx-mmc fe088000.sdio: card claims to support voltages below defined range
[    6.863261][3 T46    -.] [mmc]: device:0xb853
[    6.946848][3 T46    -.] [mmc]: r: b_s = e, b_sz = 2b, f: b_s = 0, b_sz = 1b
[    6.947049][3 T46    -.] [mmc]: the final result: sel = 1, rx = 23
[    6.948473][3 T46    -.] mmc2: new ultra high speed SDR104 SDIO card at address 0001
[    6.949622][1 T1281  -.] [wireless]: [usb_power_control] Set BT power on !
[    6.958383][1 T1525  -.] wifi_comm: loading out-of-tree module taints kernel.
[    6.959744][1 T1525  -.] usbcore: registered new interface driver wifi_usb_common
[    6.960145][1 T1525  -.] aml_usb_common->
[    6.960152][1 T1525  -.] aml_wifi_usb_insmod(138) aml common driver insmod
[    6.962411][1 T1525  -.] *****************aml sdio common driver is insmoded********************
[    6.962829][1 T1525  -.] aml_wifi_sdio_insmod(288) start...
[    7.469228][0 T576   -.] eric-tx CALL alloc_txring !!!!
[    7.469850][0 T576   -.] eric-tx CALL alloc_txring !!!!
[    7.470444][0 T576   -.] eric-tx CALL alloc_txring !!!!

中文摘要

签名版固件 dbg1479 开不了机。每次上电，启动链都能走到 boot bl33 !。之后 U-Boot 一行输出都没有，芯片复位，BootROM 进入 USB 烧录模式（DFU:1）。连续两次上电都是这样。

DDR、BL2E、BL2X、BL31、BL32 都正常，问题出在跳进 U-Boot 这一步。
eFuse 没有烧，棒子能重新烧回去，没有变砖。
这次和平时的区别只在 U-Boot：打开了 CONFIG_AML_SIGNED_UBOOT=y，用我们收到的 device-keys 签名，device-fip-header.bin 是用本 SDK 重新生成的。
请 Frank 看上面 4 个问题，重点是第 2 个：签名脚本固定传入了用 DVGK 派生的 AES 密钥。如果 BL33 被加密了，没烧 DVGK 的芯片能不能运行它。
正常开机那份日志只有内核部分，没有 bootloader 部分，所以 secpu、ampk 这几行报错没法和正常开机对比。