BeaglePlay fails to boot after flashing

Product support balenaOS
1

After flashing, I the the following on the serial console:


U-Boot SPL 2025.04-rc3-00002-g9bc28cd0f8aa (Mar 04 2025 - 22:40:53 +0000)
SYSFW ABI: 4.0 (firmware rev 0x000b '11.0.2-v11.00.02 (Fancy Rat)')
Changed A53 CPU frequency to 1250000000Hz (T grade) in DT
SPL initial stack usage: 13424 bytes
Trying to boot from MMC1
Starting ATF on ARM64 core...

NOTICE:  BL31: v2.10.0(release):v2.10.0-367-g00f1ec6b87-dirty
NOTICE:  BL31: Built : 16:09:05, Feb  9 2024
ERROR:   Timeout waiting for thread SP_RESPONSE to fill
ERROR:   Thread SP_RESPONSE verification failed (-60)
ERROR:   Message receive failed (-60)
ERROR:   Failed to get response (-60)
ERROR:   Transfer send failed (-60)
ERROR:   Timeout waiting for thread SP_RESPONSE to fill
ERROR:   Thread SP_RESPONSE verification failed (-60)
ERROR:   Message receive failed (-60)
ERROR:   Failed to get response (-60)
ERROR:   Transfer send failed (-60)
ERROR:   Unable to query firmware capabilities (-60)
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 ti_sci_init:486 Unable to communicate with control firmware (-65523)
E/TC:0 0 call_initcalls:43 Initcall __text_start + 0x0006fae0 failed
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 tee_otp_get_hw_unique_key:97 Could not get HUK
E/TC:0 0 call_initcalls:43 Initcall __text_start + 0x0006fb08 failed
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 k3_sec_proxy_verify_thread:108 Queue is busy
E/TC:0 0 k3_sec_proxy_recv:196 Thread SEC_PROXY_RESPONSE_THREAD verification failed. ret = -65523
E/TC:0 0 ti_sci_get_response:101 Message receive failed (-65523)
E/TC:0 0 ti_sci_do_xfer:150 Failed to get response (-65523)
E/TC:0 0 sa2ul_init:106 Could not change TRNG firewall owner
E/TC:0 0 call_initcalls:43 Initcall __text_start + 0x0006fb10 failed
E/TC:0 0 
E/TC:0 0 Core data-abort at address 0x14 (translation fault)
E/TC:0 0  esr 0x96000005  ttbr0 0x9e8a1000   ttbr1 0x00000000   cidr 0x0
E/TC:0 0  cpu #0          cpsr 0x600003c4
E/TC:0 0  x0  000000009e874000 x1  0000000000000000
E/TC:0 0  x2  0000000000000000 x3  0000000000000000
E/TC:0 0  x4  00000000000003a0 x5  000000009e891d70
E/TC:0 0  x6  ffffffffffffffb0 x7  0000000000010cb0
E/TC:0 0  x8  000000009e891f80 x9  000000009e881070
E/TC:0 0  x10 0000000000000042 x11 0000000000000008
E/TC:0 0  x12 0000000000000000 x13 000000009e8a9050
E/TC:0 0  x14 0000000000000000 x15 0000000000000000
E/TC:0 0  x16 000000009e81c67c x17 0000000000000000
E/TC:0 0  x18 0000000000000000 x19 000000009e8a93d0
E/TC:0 0  x20 000000009e8a93d8 x21 000000009e874000
E/TC:0 0  x22 000000009e874000 x23 000000009e874ee0
E/TC:0 0  x24 000000009e873db0 x25 0000000000000000
E/TC:0 0  x26 0000000000000000 x27 0000000000000000
E/TC:0 0  x28 0000000000000000 x29 000000009e8a9360
E/TC:0 0  x30 000000009e816fcc elr 000000009e816fdc
E/TC:0 0  sp_el0 000000009e8a9360
E/TC:0 0 TEE load address @ 0x9e800000
E/TC:0 0 Call stack:
E/TC:0 0  0x9e816fdc
E/TC:0 0  0x9e807d24
E/TC:0 0  0x9e822148
E/TC:0 0  0x9e807e94
E/TC:0 0 Panic 'unhandled pageable abort' at core/arch/arm/kernel/abort.c:582 <abort_handler>
E/TC:0 0 TEE load address @ 0x9e800000
E/TC:0 0 Call stack:
E/TC:0 0  0x9e80801c
E/TC:0 0  0x9e81eb88
E/TC:0 0  0x9e807920
E/TC:0 0  0x9e804a98
2

It seems a bad version of u-boot is there.

Per Robert Nelson, “See the build time stamp difference… U-boot SPL on r5 loaded a much newer u-boot, then it loaded an ancient one for second stage and fell apart”

3

I’m going to start looking for the flashing code, but I worry if the boot0 partition is overwritten in the process.

4

Just a bit of an update…

Starting from a board I attempted to flash with the balena flasher image, after the initial provisioning that programmed the eMMC, I attempted to recover the device.

I found information about programming the eMMC to use a specific version of u-boot. I booted a version of BeagleBoard.org Debian by holding the USER button and applying power while the Debian image was on a microSD card and then performed the operations below.

sudo mount /dev/mmcblk0p1 /mnt
echo 0 | sudo tee /sys/block/mmcblk0boot0/force_ro
sudo dd if=/mnt/tiboot3.bin of=/dev/mmcblk0boot0 seek=0 bs=512
sudo dd if=/mnt/tispl.bin of=/dev/mmcblk0boot0 seek=1024 bs=512
sudo dd if=/mnt/u-boot.img of=/dev/mmcblk0boot0 seek=5120 bs=512
sync

After this, I pulled power, removed the microSD card and try to continue by powering up the board again. This time, boot continued and the board provisioning completed.

It seems updating the bootloader in /dev/mmcblk0boot0 is necessary for this version of BalenaOS to run. This should be done in the flasher.