HY310 - willtry

[well0nez]

Hey guys, this is an awesome project, i love everything about it.
Interested how you pulled it of, using opencode myself but with omo.

Anyway, i got a HY310 which is a H713 aswell, i know there will be some patches necessary but i will still try to find UART.

I'll catch up when i got any news.

UPDATE:
Found the UART pins, i think next step will be uboot.

Update V2:
I think i'll skip uboot for now and start to try to compile the kernel.

[well0nez]

Sooooo i had problems getting u-boot to boot even with my own DDR Timings and RE'd values.

I still have to look into it, BUT i got the kernel compiled for arm32 (cus shitty uboot is 32bit only).

With a minimal DTB file i got the mainline kernel to run:

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 6.16.7 (user@lap) (arm-linux-gnueabi-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #1 SMP Wed Mar 18 16:14:20 CET 2026
[ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c0383d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt: Machine model: HY310 Projector H713
[ 0.000000] earlycon: uart0 at MMIO32 0x02500000 (options '115200n8')
[ 0.000000] printk: legacy bootconsole [uart0] enabled
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] cma: Reserved 16 MiB at 0x7f000000
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000040000000-0x000000006fffffff]
[ 0.000000] HighMem [mem 0x0000000070000000-0x000000007fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000040000000-0x000000007fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[ 0.000000] percpu: Embedded 13 pages/cpu s20556 r8192 d24500 u53248
[ 0.000000] pcpu-alloc: s20556 r8192 d24500 u53248 alloc=13*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Kernel command line: console=ttyS0,115200 earlycon loglevel=8
[ 0.000000] printk: log buffer data + meta data: 131072 + 409600 = 540672 bytes
[ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 262144
[ 0.000000] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] arch_timer: cp15 timer(s) running at 24.00MHz (virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[ 0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[ 0.008011] Switching to timer-based delay loop, resolution 41ns
[ 0.014187] Console: colour dummy device 80x30
[ 0.018671] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[ 0.029073] CPU: Testing write buffer coherency: ok
[ 0.033969] pid_max: default: 32768 minimum: 301
[ 0.038694] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes, linear)
[ 0.046026] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes, linear)
[ 0.054279] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[ 0.059995] cacheinfo: Unable to detect cache hierarchy for CPU 0
[ 0.066721] Setting up static identity map for 0x40100000 - 0x40100060
[ 0.073382] rcu: Hierarchical SRCU implementation.
[ 0.078182] rcu: Max phase no-delay instances is 1000.
[ 0.083731] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.092076] smp: Bringing up secondary CPUs ...
[ 0.097494] smp: Brought up 1 node, 1 CPU
[ 0.101632] SMP: Total of 1 processors activated (48.00 BogoMIPS).
[ 0.107833] CPU: All CPU(s) started in SVC mode.
[ 0.112658] Memory: 1007196K/1048576K available (8192K kernel code, 936K rwdata, 2460K rodata, 1024K init, 256K bss, 22712K reserved, 16384K cma-reserved, 245760K highmem)
[ 0.128289] devtmpfs: initialized
[ 0.132432] VFP support v0.3: implementor 41 architecture 3 part 40 variant 3 rev 4
[ 0.140466] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.150295] posixtimers hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.157791] futex hash table entries: 1024 (65536 bytes on 1 NUMA nodes, total 64 KiB, linear).
[ 0.166720] pinctrl core: initialized pinctrl subsystem
[ 0.172835] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.179323] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.186739] thermal_sys: Registered thermal governor 'step_wise'
[ 0.186806] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[ 0.201285] hw-breakpoint: maximum watchpoint size is 8 bytes.
[ 0.208543] SCSI subsystem initialized
[ 0.212527] libata version 3.00 loaded.
[ 0.216478] usbcore: registered new interface driver usbfs
[ 0.222155] usbcore: registered new interface driver hub
[ 0.227510] usbcore: registered new device driver usb
[ 0.232784] mc: Linux media interface: v0.10
[ 0.237092] videodev: Linux video capture interface: v2.00
[ 0.242616] pps_core: LinuxPPS API ver. 1 registered
[ 0.247571] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti giometti@linux.it
[ 0.256727] PTP clock support registered
[ 0.260856] Advanced Linux Sound Architecture Driver Initialized.
[ 0.267571] clocksource: Switched to clocksource arch_sys_counter
[ 0.278484] NET: Registered PF_INET protocol family
[ 0.283543] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.291871] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.300244] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.308027] TCP established hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.315862] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[ 0.323275] TCP: Hash tables configured (established 8192 bind 8192)
[ 0.329703] UDP hash table entries: 512 (order: 2, 28672 bytes, linear)
[ 0.336552] UDP-Lite hash table entries: 512 (order: 2, 28672 bytes, linear)
[ 0.343918] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.350010] RPC: Registered named UNIX socket transport module.
[ 0.356119] RPC: Registered udp transport module.
[ 0.360830] RPC: Registered tcp transport module.
[ 0.365689] RPC: Registered tcp-with-tls transport module.
[ 0.371204] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.378424] workingset: timestamp_bits=30 max_order=18 bucket_order=0
[ 0.385390] NFS: Registering the id_resolver key type
[ 0.390494] Key type id_resolver registered
[ 0.394678] Key type id_legacy registered
[ 0.398909] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 246)
[ 0.406319] io scheduler mq-deadline registered
[ 0.411006] io scheduler kyber registered
[ 0.415145] io scheduler bfq registered
[ 0.447349] Serial: 8250/16550 driver, 8 ports, IRQ sharing disabled
[ 0.455637] printk: legacy console [ttyS0] disabled
[ 0.480952] 2500000.serial: ttyS0 at MMIO 0x2500000 (irq = 29, base_baud = 1500000) is a 16550A
[ 0.489750] printk: legacy console [ttyS0] enabled
[ 0.489750] printk: legacy console [ttyS0] enabled
[ 0.499331] printk: legacy bootconsole [uart0] disabled
[ 0.499331] printk: legacy bootconsole [uart0] disabled
[ 0.511929] CAN device driver interface
[ 0.516002] usbcore: registered new interface driver usb-storage
[ 0.522258] i2c_dev: i2c /dev entries driver
[ 0.527428] usbcore: registered new interface driver usbhid
[ 0.533003] usbhid: USB HID core driver
[ 0.537250] ehci-platform 4200000.usb: EHCI Host Controller
[ 0.542857] ehci-platform 4200000.usb: new USB bus registered, assigned bus number 1
[ 0.553106] ehci-platform 4200000.usb: can't setup: -110
[ 0.558430] ehci-platform 4200000.usb: USB bus 1 deregistered
[ 0.564176] ehci-platform 4200000.usb: probe with driver ehci-platform failed with error -110
[ 0.572820] ohci-platform 4200400.usb: Generic Platform OHCI controller
[ 0.579455] ohci-platform 4200400.usb: new USB bus registered, assigned bus number 1
[ 0.587377] sunxi-mmc 4022000.mmc: Could not get ahb clock
[ 0.592944] sunxi-mmc 4022000.mmc: probe with driver sunxi-mmc failed with error -2
[ 0.600706] ohci-platform 4200400.usb: irq 31, io mem 0x04200400
[ 0.607146] NET: Registered PF_PACKET protocol family
[ 0.612205] can: controller area network core
[ 0.616582] NET: Registered PF_CAN protocol family
[ 0.621377] can: raw protocol
[ 0.624343] can: broadcast manager protocol
[ 0.628533] can: netlink gateway - max_hops=1
[ 0.632909] Key type dns_resolver registered
[ 0.637267] Registering SWP/SWPB emulation handler
[ 0.648945] clk: Disabling unused clocks
[ 0.652878] ALSA device list:
[ 0.655842] No soundcards found.
[ 0.659593] ohci-platform 4200400.usb: init err (00000000 0000)
[ 0.665508] ohci-platform 4200400.usb: can't start
[ 0.670822] ohci-platform 4200400.usb: startup error -75
[ 0.676133] ohci-platform 4200400.usb: USB bus 1 deregistered
[ 0.681900] ohci-platform 4200400.usb: probe with driver ohci-platform failed with error -75
[ 0.690632] /dev/root: Can't open blockdev
[ 0.694731] VFS: Cannot open root device "" or unknown-block(0,0): error -6
[ 0.701698] Please append a correct "root=" boot option; here are the available partitions:
[ 0.710047] List of all bdev filesystems:
[ 0.714049] ext3
[ 0.714052] ext2
[ 0.715974] ext4
[ 0.717902] vfat
[ 0.719825]
[ 0.723234] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 0.731487] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.7 #1 NONE
[ 0.738528] Hardware name: Generic DT based system
[ 0.743311] Call trace:
[ 0.743321] unwind_backtrace from show_stack+0x10/0x14
[ 0.751080] show_stack from dump_stack_lvl+0x54/0x68
[ 0.756132] dump_stack_lvl from panic+0x10c/0x33c
[ 0.760923] panic from mount_root_generic+0x1f8/0x2a8
[ 0.766066] mount_root_generic from prepare_namespace+0x1f8/0x250
[ 0.772248] prepare_namespace from kernel_init+0x1c/0x12c
[ 0.777739] kernel_init from ret_from_fork+0x14/0x28
[ 0.782792] Exception stack(0xf081dfb0 to 0xf081dff8)
[ 0.787838] dfa0: 00000000 00000000 00000000 00000000
[ 0.796005] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 0.804172] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 0.810782] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) ]---

[FrozenLemonn]

So how did you guys fix the timeout issue when trying to write the boot0 file to SRAM?
When I use sunix-fel-4k-chunks/sunix-fel-16k-chunks -p write 0x0104000 I am only able to write 4Kb, anything more than that causes timeout.

So I tried splitting the boot0.bin into chunks and tried flashing sequentially:

• 0x0104000: success
• 0x0105000: timeout

And I couldn't find/compile the sunxi-fel-h713-complete-fix

[well0nez]

Got mainline 6.16 booting. ARM32 mode, custom CCU driver, own DTS.
All USB ports up, WiFi working via external USB adapter (rtl8xxxu).
Running Debian from USB stick, auto-boot from eMMC — no manual intervention needed.
Turns out the H713 is more cooperative than expected once you figure out the clock tree.
Happy to share notes if anyone else is poking at these.

So how did you guys fix the timeout issue when trying to write the boot0 file to SRAM? When I use sunix-fel-4k-chunks/sunix-fel-16k-chunks -p write 0x0104000 I am only able to write 4Kb, anything more than that causes timeout.

So I tried splitting the boot0.bin into chunks and tried flashing sequentially:

* 0x0104000: success

* 0x0105000: timeout

And I couldn't find/compile the sunxi-fel-h713-complete-fix

Instead of fighting with SRAM writes and timeouts, I worked from within stock Android over ADB. No root needed — /dev/block/mmcblk0 is world-writable on these devices. The stock U-Boot on eMMC already does everything you need, it just needs to be told what to do:

1. Patched env_a (mmcblk0p3) via adb shell dd to set bootdelay=5 and add usb start to bootcmd. The partition uses CRC32 over the first 128KB starting at offset 4 — took a while to figure that out. Once the checksum is correct, U-Boot happily accepts it.
2. Wrote my mainline kernel directly to the boot_a slot (mmcblk0p5) as an Android boot image v3 — stock U-Boot loads and boots it without knowing it's running 6.16.7 instead of the factory kernel.
3. Rootfs lives on a USB stick (ext4 partition). Kernel has root=/dev/sda2 rootwait in the DTS chosen node.
   All flashing done via adb shell dd — no FEL, no root, no custom bootloader, no special tools. Enable developer mode, plug in USB, done.
   Can't help with the actual FEL SRAM timeout unfortunately. Looks like an H713-specific SRAM mapping issue. But depending on what you're trying to achieve, you might not need FEL at all.

[FrozenLemonn]

Ahhh I see, that's the catch here, for me my device is pretty much in a "bricked" state, i can only access FEL for now

[FrozenLemonn]

I am trying to get it bootloader somehow so that I can flash back my emmc dump, but this timeouts are a real pain.

Also my device is not HY300, but it's has H716 SoC

[well0nez]

try to create an update.img with your dump, then flash it via phoenixsuit/phoenixusbpro

[FrozenLemonn]

I did, I made a whole update package by extracting from my dump.
After successful flash, it is still on the no display/light, only fan state, with the LED indicator being red.

[well0nez]

you need to find uart pins on the mainboard and hook that up to get more logs out of it or try to find real working images for your device somewhere

[FrozenLemonn]

The whole internet doesn't seem to have the one specific to my device. I went deep in 4PDA and Baidu, still no luck.

The thing is, I saw a video on YT for the exact same model (but different vendor) where they flash the firmware, but no links or anything were provided.
My actual model number is LLPJH10, but it's same as L007
https://youtu.be/-RI_MFgPMak

[well0nez]

i would try to 100% identify your chipset and try to find other relatable same chipset firmware versions. maybe you are in luck.
but still, uart would propably be the best to see where it fails

i can share my firmware for my h310 which is also h713 like in the video
maybe it will help but i doubt it

[FrozenLemonn]

I've identified the chipset from the dump, it's H713 only, but with a slightly different kernel as it runs 1080p display, extra ports and a loud ass fan

Yeah i feel like I should get a UART, but I'm kinda reluctant to open up the whole unit as it is new.

I've contacted the OEM with the issue, they straight up told me they'll take the unit for repair and it'll take 15-20 days to get it back. So I told me, hold up, give me firmware first, if that don't work take it for repair. And for that they said they provide the download link but it'll take time (72 hours and still counting). Fingers crossed.

[FrozenLemonn]

@well0nez if you can share the

> boot0_xxxx files
> boot-package
> u-boot.fex
> mbr
> dlinfo
> env

At least I'll get a chance to compare those

[well0nez]

No Problem! :)

[FrozenLemonn]

Appreciate it man, I'll take a look into these and see if using these from Phoenix tool would do any good

[FrozenLemonn]

@well0nez while checking your dlinfo.fex I see that it is using a media_data partition too, but the same is not available in the firmwares (other models) I have.

Could you please check for any media_data bin/fex in your firmware and share that file.
If it's not big you can just simple paste the first and last few bytes of the file after your open it in any hex editors