TB-RK3399ProD刷机后无法正常启动求解答

开发板： TB-RK3399ProD， 板子丝印：TB-RK3399ProD_33101_V1.2固件:       https://eyun.baidu.com/s/3smgVI13
操作方法:
              a. 使用devtool 2.9，下载不成功， 提示uboot、trust等超过flash空间了
              b. 使用devtool 2.84, 按照 Toybrick Wiki (rock-chips.com)
              c. 下载完成后，启动不成功.
              d. 一字不落得按照Toybrick Wiki (rock-chips.com)进行，错误一样
              e. 不知所措之下，下载了firefly的固件，启动到一半卡住不动。

迷茫中，求帮助。


串口Log如下

-DDR Version 1.27 20211018
In
Channel 0: LPDDR3, 800MHz
CS = 0
MR0=0xD8
MR1=0xD8
MR2=0xD8
MR3=0xD8
MR4=0x3
MR5=0x6
MR6=0x4
MR7=0x0
MR8=0x1F
MR9=0x1F
MR10=0x1F
MR11=0x1F
MR12=0x1F
MR13=0x1F
MR14=0x1F
MR15=0x1F
MR16=0x1F
CS = 1
MR0=0xD8
MR1=0xD8
MR2=0xD8
MR3=0xD8
MR4=0x3
MR5=0x6
MR6=0x4
MR7=0x0
MR8=0x1F
MR9=0x1F
MR10=0x1F
MR11=0x1F
MR12=0x1F
MR13=0x1F
MR14=0x1F
MR15=0x1F
MR16=0x1F
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=32 Size=2048MB
Channel 1: LPDDR3, 800MHz
CS = 0
MR0=0xD8
MR1=0xD8
MR2=0xD8
MR3=0xD8
MR4=0x3
MR5=0x6
MR6=0x4
MR7=0x0
MR8=0x1F
MR9=0x1F
MR10=0x1F
MR11=0x1F
MR12=0x1F
MR13=0x1F
MR14=0x1F
MR15=0x1F
MR16=0x1F
CS = 1
MR0=0xD8
MR1=0xD8
MR2=0xD8
MR3=0xD8
MR4=0x3
MR5=0x6
MR6=0x4
MR7=0x0
MR8=0x1F
MR9=0x1F
MR10=0x1F
MR11=0x1F
MR12=0x1F
MR13=0x1F
MR14=0x1F
MR15=0x1F
MR16=0x1F
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=32 Size=2048MB
256B stride
ch 0 ddrconfig = 0x101, ddrsize = 0x2020
ch 1 ddrconfig = 0x101, ddrsize = 0x2020
pmugrf_os_reg[2] = 0x3AA0DAA0, stride = 0xD
OUT
Boot1 Release Time: May 29 2020 17:36:36, version: 1.26
CPUId = 0x0
ChipType = 0x10, 342
SdmmcInit=2 0
BootCapSize=100000
UserCapSize=29820MB
FwPartOffset=2000 , 100000
mmc0:cmd8,20
mmc0:cmd5,20
mmc0:cmd55,20
mmc0:cmd1,20
mmc0:cmd8,20
mmc0:cmd5,20
mmc0:cmd55,20
mmc0:cmd1,20
mmc0:cmd8,20
mmc0:cmd5,20
mmc0:cmd55,20
mmc0:cmd1,20
SdmmcInit=0 1
StorageInit ok = 68482
SecureMode = 0
SecureInit read PBA: 0x4
SecureInit read PBA: 0x404
SecureInit read PBA: 0x804
SecureInit read PBA: 0xc04
SecureInit read PBA: 0x1004
SecureInit read PBA: 0x1404
SecureInit read PBA: 0x1804
SecureInit read PBA: 0x1c04
SecureInit ret = 0, SecureMode = 0
atags_set_bootdev: ret0)
GPT part:  0, name:            uboot, start:0x2000, size:0x2000
GPT part:  1, name:            trust, start:0x4000, size:0x2000
GPT part:  2, name:       boot_linux, start:0x6000, size:0x30000
GPT part:  3, name:           rootfs, start:0x36000, size:0x3a07fdf
find part:uboot OK. first_lba:0x2000.
find part:trust OK. first_lba:0x4000.
Trust Addr:0x4000, 0x58334c42
No find bl30.bin
Load uboot, ReadLba = 2000
Load OK, addr=0x200000, size=0xf48c4
RunBL31 0x40000 @ 108281 us
NOTICE:  BL31: v1.3(debug):42583b6
NOTICE:  BL31: Built : 07:55:13, Oct 15 2019
NOTICE:  BL31: Rockchip release version: v1.1
INFO:    GICv3 with legacy support detected. ARM GICV3 driver initialized in EL3
INFO:    Using opteed sec cpu_context!
INFO:    boot cpu mask: 0
INFO:    plat_rockchip_pmu_init(1190): pd status 3e
INFO:    BL31: Initializing runtime services
INFO:    BL31: Initializing BL32
INF [0x0] TEE-CORE:init_primary_helper:337: Initializing (1.1.0-230-g6c76e8a9 #191 Mon Nov 18 07:00:24 UTC 2019 aarch64)

INF [0x0] TEE-CORE:init_primary_helper:338: Release version: 1.2

INF [0x0] TEE-CORE:init_teecore:83: teecore inits done
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x200000
INFO:    SPSR = 0x3c9


U-Boot 2017.09-g22af63bad7-dirty (Sep 15 2022 - 14:42:56 +0800)

Model: Rockchip RK3399 Evaluation Board
PreSerial: 2
DRAM:  3.8 GiB
Sysmem: init
Relocation Offset is: f5bd0000
Using default environment

dwmmc@fe320000: 1, sdhci@fe330000: 0
Bootdev(atags): mmc 0
MMC0: HS400, 150Mhz
PartType: EFI
rockchip_get_boot_mode: Could not found misc partition
boot mode: None
init_resource_list: failed to get boot part, ret=-1
init_resource_list: failed to get resource part, ret=-1
Distro DTB: /extlinux/toybrick.dtb
105872 bytes read in 66 ms (1.5 MiB/s)
I2c0 speed: 400000Hz
PMIC:  RK8090 (on=0x10, off=0x00)
vdd_center 900000 uV
vdd_cpu_l 900000 uV
Warn: can't find connect driver
Warn: can't find connect driver
Failed to found available display route
Warn: can't find connect driver
Warn: can't find connect driver
Failed to found available display route
toybrick_SnMacAc_check read sn id fail
toybrick_SnMacAc_check read mac id fail
toybrick_SnMacAc_check read ac id fail
toybrick_SnMacAc_check read sn_mac_ac fail
toybrick_SnMacAc_check goto loader
RKUSB: LUN 0, dev 0, hwpart 0, sector 0x0, count 0x3a3e000
\

没人答，我就自己来吧。按照以下步骤操作后，可以启动，但是使用不了toybrick的官方固件。官方固件里甚至修改了apt，所以我就记录一下怎么启动到firefly的rootfs去。
1. 跳过uboot的SN检查
   修改u-boot/arch/arm/mach-rockchip/boot_mode.c中的函数toybrick_SnMacAc_check， 令其直接返回0

2. 跳过initrd的teec服务
    拆开initramfs-toybrick-2.0.img。 这是一个gzip压缩的cpio文件，解压后用cpio拆开即可。拆开后得到一个小型的跟文件系统，修改usr/bin/teec.sh，直接exit 0，不要执行其它指令。
    指南:Using the initial RAM disk (initrd) — The Linux Kernel documentation

3. build后得到新的uboot.img和boot_linux.img

4. 从firefly官方下载rk3399pro的rootfs, 参考https://wiki.t-firefly.com/zh_CN ... fw_pack_unpack.html，将固件拆包，取出rootfs.img

5. 烧写uboot.img、boot_linux.img、rootfs.img，等待即可。