Related
Introduction
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.
On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
Code:
Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
Starting OS Bootloader from EMMC ...
U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)
Load address: 0x80e80000
DRAM: 1024 MB
Using default environment
In: serial
Out: serial
Err: serial
hw_status 0x23 vbus_status 0x80
mmc read: Invalid size
mmc read: Invalid size
2 bytes read
MAX17042+UBOOT: battery type=LG
MAX17042+UBOOT: gas gauge detected (0x0000)
MAX17042_STATUS (00h) is 0x0000
MAX17042+UBOOT: BATTERY Detected!
MAX17042+UBOOT:WARM BOOT
mmc read: Invalid size
mmc read: Invalid size
40 bytes read
Valid max17042 init data is loaded into memory
0x1234
0x215b
0x00d6
0x2037
0x0000
0x0100
0x007e
0x3670
0x078f
0x0000
0x0000
0x6435
0x2f2c
0x0140
0x7d5a
0x87a4
0x1400
0x205c
0x205c
0x6046
verify if mem loaded: FullcapNom was saved as 2037
uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
uboot verify: 2a RELAXCFG is 083b ; should be 083b
uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
uboot verify: 18 DesignCap is 205c ; should be 205c
uboot verify: 12 Vempty is 7d5a ; should be 7d5a
uboot verify: 25 TEMPLIM is 2305 ; should be 2305
uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
uboot verify: 2c TGAIN is e3e1 ; should be e3e1
uboot verify: 2d TOFF is 290e ; should be 290e
uboot verify: 2e CGAIN is 4000 ; should be 4000
uboot verify: 2f COFF is 0000 ; should be 0000
uboot verify: 37 FCTC is 05e0 ; should be 05e0
MAX17042+UBOOT: warm config is okay
SOC 90%, booting.
Board revision PVT
mmc read: Invalid size
mmc read: Invalid size
16 bytes read
ptn 0 name='xloader' start=256 len=131072
ptn 1 name='bootloader' start=512 len=262144
ptn 2 name='recovery' start=1024 len=15728640
ptn 3 name='boot' start=32768 len=16777216
ptn 4 name='rom' start=65536 len=50331648
ptn 5 name='bootdata' start=163840 len=50331648
ptn 6 name='factory' start=262144 len=387973120
ptn 7 name='system' start=1019904 len=641728512
ptn 8 name='cache' start=2273280 len=446693376
ptn 9 name='media' start=3145728 len=1073741824
ptn 10 name='userdata' start=5242880 len=64991232
mmc read: Invalid size
1088 bytes read
BCB found, checking...
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
Booting into Android
mmc read: Invalid size
mmc read: Invalid size
4 bytes read
BootCnt 2
1 bytes written
Autobooting in 0 seconds, press <SPACE> to stop...
kernel @ 80088120 (2682952)
ramdisk @ 81080000 (157153)
Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.
Starting kernel ...
Linux version 2.6.35.7 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: OMAP4430 ACCLAIM
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 245760
free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
Normal zone: 1536 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 178688 pages, LIFO batch:31
HighMem zone: 512 pages used for memmap
HighMem zone: 65024 pages, LIFO batch:15
***********************
OMAP4430 ES2.3 type(HS)
id-code (6b95c02f)
Die-id (5C360006-00000001-09111715-1601D00D)
Prod-id (000DB95C-000600CC)
***********************
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
FIXME: omap44xx_sram_init not implemented
Reserving 33554432 bytes SDRAM for VRAM
SMC: Allocated workspace of 3M at (0x9c900000)
PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 243712
Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 [email protected] [email protected] init=/init rootwait vram=32M,82000000 omapfb.vram=0:[email protected]
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 448MB 256MB 256MB = 960MB total
Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xf0800000 - 0xf8000000 ( 120 MB)
lowmem : 0xc0000000 - 0xf0000000 ( 768 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.init : 0xc0008000 - 0xc003d000 ( 212 kB)
.text : 0xc003d000 - 0xc053f000 (5128 kB)
.data : 0xc0540000 - 0xc05888c0 ( 291 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
You will need
In order to get started you will need some things. Here's what you will need.
Torx T5 screw driver (the star kind)
Soldering iron ( any soldering iron)
Case opener tool ( or guitar pick or something small and plastic)
30-40 AWG wire (small wires)
1.8V UART to USB converter (Like The Bus Priate)
Tweezers (Makes it easier to handle small things)
Most of the tools and parts used can be obtained at Lowes or Radio Shack
For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.
Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Disassembly
If you have an SDCard inserted, remove it.
Remove two(2) T5 Torx screws securing the back cover to the unit
Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
Remove ten(10) T5 torx screws from the metal case which secure the front cover
Image 2:
disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
Remove the board and LCD from the metal case
Modification
Image 3:
Locate the UART RX and TX lines on the board shown in Image2.
You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..
Stop here and use UART or continue on for a cleaner method
run 40 awg wire to a piece of perf-board, about 8 holes wide.
Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
attach the UART RX
Image 4:
Route the wires along the board and tape them down
Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
Reassemble the unit, Assembly is reverse of Disassembly.
Image 5:
Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
Image 6:
You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)
For the Bus Pirate, get it working in a termianal and use the following settings:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)
(1)>3
Set serial port speed: (bps)
1. 300
2. 1200
3. 2400
4. 4800
5. 9600
6. 19200
7. 38400
8. 57600
9. 115200
10. BRG raw value
(1)>9
Data bits and parity:
1. 8, NONE *default
2. 8, EVEN
3. 8, ODD
4. 9, NONE
(1)>1
Stop bits:
1. 1 *default
2. 2
(1)>1
Receive polarity:
1. Idle 1 *default
2. Idle 0
(1)>1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1)>1
Ready
UART>(3)
Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.
I hope this was informative and/or interesting for you to read.
Thanks to pokey9000 for pointing me to the right area.
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Also, what would happen if it didn't autoboot in 0 seconds and you could hit the spacebar?
Sent from my BNTV250 using Tapatalk
HMG10 said:
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Sent from my BNTV250 using Tapatalk
Click to expand...
Click to collapse
That's the number of boots since the counter was reset. After 8 failed boots, the device will go into recovery and restore all firmware.
this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..
servergod said:
this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..
Click to expand...
Click to collapse
that's exactly what I did...
Adafruit's FTDI Friend should also do the trick, $10 less.
I changed up my UART connection. I feel this is much cleaner and runs less wire through the nook. This makes it into a really good development device.
This new setup is made with a piece of perf-board from Radio Shack and it's held onto the nook using double-sided tape. Here are some pictures:
The wires are routed through the crack in the back cover and run to the same points mentioned in the Original Post. The 3rd connection (middle) here is Ground. Ground is the point on the board closest to the edge and furthest from UART TX in the staggered group of pins..
I thought I'd update this... I though I'd update this after a few weeks of working with it. The external connection works very well. It is easy to remove and replace if required with just 3 solder joints if required. The external perf-board is very unobtrusive, and does not interfere with operation.
I also found a case that works well with this modification. it's called "Mini Suit" for Nook Tablet.
If you go with this method and need a case, Mini Suit will suit you.
Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!
acruxksa said:
Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!
Click to expand...
Click to collapse
disregard picture 4. I took alot of pictures while setting things up and I chose the ones that gave the best idea of what was going on. Thanks.
Replacement for Bus Pirate
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks
chongns said:
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks
Click to expand...
Click to collapse
This should really go into the Samsung forum for the phone you're trying to get to, however here is where you can buy a bus pirate.
Many people are getting what they are calling a bricked Nook tablet that won't boot or restore an OS. Often when they boot into CWM (from internal or SD) they get errors on screen, or possibly after an attempted install they show in the advanced / log
E:Can't mount / cache/recovery/command/
E:Can't mount / cache/recovery/log/
E:Can't open / cache/recovery/log/
E:Can't mount / cache/recovery/last_log/
E:Can't open / cache/recovery/last_log/
failed to open/sys/class/android_usb/state: No such file or directory
This is actually an extremely common issue it seems. Basically its' quite likely you're partition map has some how been damaged.
Firstly just make sure you can't install an update or restore an old backup from SD, if that still fails and you end up straight back in CWM
All you need to do is download the parted binary HERE extract it from the archive and push it to your device or even just put it on an SD
ADB into your device and run the binary with the following command (you'll need it to be the accesible path or you can just be in the directory where it is)
parted /dev/block/mmcblk0 print
It will most likely show up with an error and ask if you want to fix it. Just say yes and let it do its' thing.
After it completes, reboot your device and see if you still get the same errors, Attempt to install CM7 once more.
If it still doesn't work, run the parted command again then download Adams total wipe and run that. It'll reset your device back to total stock. The parted command will repair the partition table and adamoutlers software will upload all the required software to the correct places for it all to work
Hope that helps!
If you get stuck feel free to give me a shout
This is actually an extremely common issue it seems. Basically its' quite likely you're partition map has some how been damaged.
NT full brick...unable to recover.
My NT is suffering from the CM7-SD format brick problem.
I have hunted high and low for instructions on how to get ADB to work on a bricked NT. My NT is in a state where the only thing that boots on it is an SD-based CWM, but when I plug the NT into a PC, no matter what I do, CWM recovery starts up and the PC detects the unit as disk drives. ADB will NOT find the unit. I have tried on two separate Win7 machines...same problem on both.
I have also tried using Adam's total wipe fix, and while linux boot, the full wipe just hangs forever on the first step (zeroing MLO).
I am not sure I have the right USB drivers...basically, I'm using the ones I had for my long-gone Nook Color.
Can anyone offer me some help?
Thanks.
imacmill said:
My NT is suffering from the CM7-SD format brick problem.
I have hunted high and low for instructions on how to get ADB to work on a bricked NT. My NT is in a state where the only thing that boots on it is an SD-based CWM, but when I plug the NT into a PC, no matter what I do, CWM recovery starts up and the PC detects the unit as disk drives. ADB will NOT find the unit. I have tried on two separate Win7 machines...same problem on both.
I have also tried using Adam's total wipe fix, and while linux boot, the full wipe just hangs forever on the first step (zeroing MLO).
I am not sure I have the right USB drivers...basically, I'm using the ones I had for my long-gone Nook Color.
Can anyone offer me some help?
Thanks.
Click to expand...
Click to collapse
It's not actually caused by formatting SD on CM7 any more. you could happily format your SD all day, although we still recommend not formatting anything at all via the NT.
If you have CWM you should have access to ADB, the probably reason it doesn't work for you is that you need to tell your computer what the id is on the device so that it can recognise it. What operating system are you using?
CelticWebSolutions said:
It's not actually caused by formatting SD on CM7 any more. you could happily format your SD all day, although we still recommend not formatting anything at all via the NT.
If you have CWM you should have access to ADB, the probably reason it doesn't work for you is that you need to tell your computer what the id is on the device so that it can recognise it. What operating system are you using?
Click to expand...
Click to collapse
Thanks, Celtic.
I'm on Win7. I have 'adb_usb.ini' in folder:
C:\Users\<myname>\.android
And the 'ini' contains 0x2080.
More details...
CelticWebSolutions said:
It's not actually caused by formatting SD on CM7 any more. you could happily format your SD all day, although we still recommend not formatting anything at all via the NT.
If you have CWM you should have access to ADB, the probably reason it doesn't work for you is that you need to tell your computer what the id is on the device so that it can recognise it. What operating system are you using?
Click to expand...
Click to collapse
Here's a brief history, as best I can recall, of how I got where I am with my NT.
1. Installed NT CM7 about a week ago. All worked well until I noticed Kindle app misbehaving by not flipping pages on a book. I tried same book on two other android devices, and both worked fine. So...
2. In a complete act of stupidity, I went into 'Storage' on the NT, and noticing that there were 3 sections listed there (whose names escape me, but something like 'Internal SD', 'SD' and 'External SD'), I formatted all 3 (yup, dumb).
3. I shut down the NT (10 second press of power), and from there on in, tablet hung at 'N' screen. I manages to get CWM to start, using a combination of buttons I now don't recall (Power and Volume Up, perhaps?).
4. For reasons I can only describe as lunacy, I used Recovery to format everything it listed as format-able (under Mounts/Storage). From this point on, the tablet would not boot at all, not even back into CWM Recovery.
5. Thru online searching, I found an image for making a bootable CWM Recovery, which I created and used successfully to boot into recovery. I used it unsuccessfully to try to re-install CM7.
6. I then tried getting an ADB connection so I could try the various other fixes offered online, but have been completely unable to get a connection. I followed the instructions found in XDA thread ID 1424563 (sorry, I'm too junior to have link-posting permissions), but the thread assumes I can get to the NT's settings to turn on debug mode, which I can't.
7. As mentioned, I also tried Adam's full wipe/restore, but it hangs on phase one (zeroing MLO).
That's the crux of it, for what it's worth. I think my big issue right now is not being able to get ADB to work with it. If I could, I could try the partition command you gave in the OP.
Thanks for any help or ideas...
imacmill said:
Here's a brief history, as best I can recall, of how I got where I am with my NT.
1. Installed NT CM7 about a week ago. All worked well until I noticed Kindle app misbehaving by not flipping pages on a book. I tried same book on two other android devices, and both worked fine. So...
2. In a complete act of stupidity, I went into 'Storage' on the NT, and noticing that there were 3 sections listed there (whose names escape me, but something like 'Internal SD', 'SD' and 'External SD'), I formatted all 3 (yup, dumb).
3. I shut down the NT (10 second press of power), and from there on in, tablet hung at 'N' screen. I manages to get CWM to start, using a combination of buttons I now don't recall (Power and Volume Up, perhaps?).
4. For reasons I can only describe as lunacy, I used Recovery to format everything it listed as format-able (under Mounts/Storage). From this point on, the tablet would not boot at all, not even back into CWM Recovery.
5. Thru online searching, I found an image for making a bootable CWM Recovery, which I created and used successfully to boot into recovery. I used it unsuccessfully to try to re-install CM7.
6. I then tried getting an ADB connection so I could try the various other fixes offered online, but have been completely unable to get a connection. I followed the instructions found in XDA thread ID 1424563 (sorry, I'm too junior to have link-posting permissions), but the thread assumes I can get to the NT's settings to turn on debug mode, which I can't.
7. As mentioned, I also tried Adam's full wipe/restore, but it hangs on phase one (zeroing MLO).
That's the crux of it, for what it's worth. I think my big issue right now is not being able to get ADB to work with it. If I could, I could try the partition command you gave in the OP.
Thanks for any help or ideas...
Click to expand...
Click to collapse
you should have damaged the partition tables, so please make a CMW card first, and then you can use adb shell to repair the partition table.
you can refer to this thread:http://forum.xda-developers.com/showpost.php?p=22157605&postcount=25
If that older driver you have don't work, you can find a driver in this thread. (I don't know if they are the same as color or not TBH)
Use the USBDeview to rid yourself of anything aldroid related, anything Google related, and any mass storage devices. Restart PC, then plug your NT in. (This is how I had to do it...many times)
ms2003 said:
you should have damaged the partition tables, so please make a CMW card first, and then you can use adb shell to repair the partition table.
you can refer to this thread:http://forum.xda-developers.com/showpost.php?p=22157605&postcount=25
Click to expand...
Click to collapse
Thanks, ms, but as I mentioned, I am completely unable to get ADB to work. It will not find the tablet. When I plug the tablet in to my Win7 box, the installed CMW card boots the tablet into recovery, and the PC detects it as disk drives (as seen in Win7's Device Mangler).
Quick progress update...
Know-Fear said:
If that older driver you have don't work, you can find a driver in this thread. (I don't know if they are the same as color or not TBH)
Use the USBDeview to rid yourself of anything aldroid related, anything Google related, and any mass storage devices. Restart PC, then plug your NT in. (This is how I had to do it...many times)
Click to expand...
Click to collapse
The old drivers and instructions you linked to worked...ADB now finds my NT! Thanks much!
Now...
I did the 'parted' thing, and while 3 or 4 errors were reported thru the process, it stated it completed successfully. I then rebooted with my CWM Recovery SD card and attempted to re-install CM7. The installer completed quite quickly and without errors, but it did not work (as I suspected it wouldn't, given how fast it executed). I then ran 'Brick_fix.zip', and it, too, completed successfully (well, except for the ping at the end), but I was unable to install CM7. So...
I'm now on to Adam's fix (note in the OP) and I'm glad to report it's working now. It got past the first stage (zeroing MLO) and is in the middle of 'flashing factory'. Sweet!
I'll report back in the morning, hopefully with good news. Thanks so much for the help, everyone.
imacmill said:
The old drivers and instructions you linked to worked...ADB now finds my NT! Thanks much!
Now...
I did the 'parted' thing, and while 3 or 4 errors were reported thru the process, it stated it completed successfully. I then rebooted with my CWM Recovery SD card and attempted to re-install CM7. The installer completed quite quickly and without errors, but it did not work (as I suspected it wouldn't, given how fast it executed). I then ran 'Brick_fix.zip', and it, too, completed successfully (well, except for the ping at the end), but I was unable to install CM7. So...
I'm now on to Adam's fix (note in the OP) and I'm glad to report it's working now. It got past the first stage (zeroing MLO) and is in the middle of 'flashing factory'. Sweet!
I'll report back in the morning, hopefully with good news. Thanks so much for the help, everyone.
Click to expand...
Click to collapse
Sorry I didn't get back to you last night, I had already gone to bed, looks like you've already got the help you need though. If the wiping had started to work you'll be fine lesson learnt though, DO NOT FORMAT ANYTHING ON NT
Let us know it's fixed (which I'm sure it will be )
Bad news...
CelticWebSolutions said:
Sorry I didn't get back to you last night, I had already gone to bed, looks like you've already got the help you need though. If the wiping had started to work you'll be fine lesson learnt though, DO NOT FORMAT ANYTHING ON NT
Let us know it's fixed (which I'm sure it will be )
Click to expand...
Click to collapse
Well, the news is bad this morning. As someone mentioned in Adam's post, during the install, the screen went blank, so I left it for about another half an hour, then powered the device off and restarted it. All appeared OK, as the B&N firmware stated that it was clearing data, but that process froze for a long while, then a message popped up stating "Please restart your device and try again. If you encounter the same issue, contact technical support at blah, blah, blah." I restarted...same message. Over and over.
I tried the full wipe no less than 4 more times, preceding each attempt with a 'part' command, but the full wipe, for some unknown reason, stops about 60 seconds in, and pops up what appears to be a windowed 'ls -al'. I tried two different class 4 SDs in the 4 attempts...same for each.
Not feeling hopeful at this point.
---------- Post added at 04:37 PM ---------- Previous post was at 03:46 PM ----------
Here's the results from my 'part' command:
Code:
~ # parted /dev/block/mmcblk0 print
parted /dev/block/mmcblk0 print
Model: MMC SEM16G (sd/mmc)
Disk /dev/block/mmcblk0: 15.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
1 131kB 262kB 131kB xloader
2 262kB 524kB 262kB bootloader
3 524kB 16.3MB 15.7MB recovery
4 16.8MB 33.6MB 16.8MB boot
5 33.6MB 83.9MB 50.3MB rom
6 83.9MB 134MB 50.3MB fat32 bootdata
7 134MB 522MB 388MB factory
8 522MB 1164MB 642MB ext4 system
9 1164MB 1611MB 447MB ext4 cache
10 1611MB 2684MB 1074MB fat32 media
11 2684MB 15.6GB 12.9GB ext4 userdata
Note the fat32 and ext4 file system designations for various directories (is directories the correct word?). On page 6 of Adam's full wipe thread, user 'howcansheslap' shows the output of his/her 'part' command, and the file system in his/her output is all blank. Perhaps not coincidentally, my full wipe process stops on processing 'bootdata', the first item listed as fat32 above, and displays the windowed 'ls' of folder 'bootdata'.
Any thoughts on the relevance of this info?
Thanks all.
---------- Post added at 05:33 PM ---------- Previous post was at 04:37 PM ----------
Turns out the full wipe *was* working. The trouble is, my impatience got the better of me. Adam's wipe process does not provide a whole lot in the way of progress feedback, and in fact, it can be 5 minutes or so before you see anything meaningful on screen. Best advice: give the process a full half hour to complete and don't assume that it's hung/stopped working just because you see virtually no progress reports. Note also that if you touch the screen anywhere during the wipe, any progress bar that may or may not have been present will probably disappear, and you won't see another one displayed for possibly several minutes.
My apologies to all for subjecting you to my own impatience, and a big thank-you for all the help.
I spoke too soon...again.
The full wipe/restore completed successfully, but now when I start the tablet, I get taken thru the B&N setup process and at the stage where it asks me to login to my B&N account, I get:
Error
Sorry we're having trouble setting up your NOOK. Please shutdown the device and try again. If the problem persist, contact Customer Support at...
Well, the problem has persisted all day. I have even done the full restore a couple of extra times. And the tech support line just keeps telling me they're unable to process my call at this time.
I am definitely able to login to my B&N account thru my PC, so I've got the credentials right.
Has anyone encountered this before?
UPDATE: I followed the instructions for bypassing registration, found here:
http://nookdevs.com/NookColor_Factory_Mode/Skip_Oobe
This allowed me to get into settings and 'erase/unregister' the device, but alas, still no joy after a reboot.
back from brick to Nook Tablet
Hi to all, i had the same problem as imacmill onlly i've idiotly erased the "SD card" the 1 gb amount.
After restarting the NT did not boot. I've entered in CWM recovery... and had the same problem (***up my partition table)
E:Can't mount / cache/recovery/command/
E:Can't mount / cache/recovery/log/
E:Can't open / cache/recovery/log/
E:Can't mount / cache/recovery/last_log/
E:Can't open / cache/recovery/last_log/
after agonizing 3hrs we succeeded to repair my NT via parted with ADB.
I've attached the log from adb.
Code:
<6> boxer : boxer_spi_probe called , line 310
<6>boxer: spi setup returned : 0
<6> boxer : boxer_panel_probe called , line 129
<4>omap_smartreflex_disable_reset_volt: omap_sr struct for sr_core not found
<4>omap_smartreflex_enable: omap_sr struct for sr_core not found
<6>Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
<6>omap-hsuart.0: ttyO0 at MMIO 0x4806a000 (irq = 104) is a OMAP UART0
<6>console [ttyO0] enabled
<6>omap-hsuart.1: ttyO1 at MMIO 0x4806c000 (irq = 105) is a OMAP UART1
<6>omap-hsuart.2: ttyO2 at MMIO 0x48020000 (irq = 106) is a OMAP UART2
<6>omap-hsuart.3: ttyO3 at MMIO 0x4806e000 (irq = 102) is a OMAP UART3
<6>brd: module loaded
<6>loop: module loaded
<6>android init
<6>android_probe pdata: c0563eb8
<6>android_bind
<7>android_bind_config
<6>android_usb gadget: android_usb ready
<6>f_adb init
<6>android_register_function adb
<6>f_mass_storage init
<6>fsg_probe pdev: c0563c00, pdata: c0563ea8
<6>android_register_function usb_mass_storage
<6>android_usb gadget: Mass Storage Function, version: 2009/09/11
<6>android_usb gadget: Number of LUNs=2
<6> lun0: LUN: removable file: (no medium)
<6> lun1: LUN: removable file: (no medium)
<6>adb_bind_config
<6>input: gpio-keys as /devices/platform/gpio-keys/input/input0
<6>input: omap-keypad as /devices/platform/omap-keypad/input/input1
<6>ft5x06_init() - FT I2C Touchscreen Driver (Built Jan 11 2012 @ 09:02:56)
<6>ft5x06_probe() - FT5x06 found on I2C bus.
<7>ft5x06_reset_panel_via_gpio() - Toggling GPIO 39 to reset the Touch Panel...
<4>omap_smartreflex_disable_reset_volt: omap_sr struct for sr_core not found
<4>omap_smartreflex_enable: omap_sr struct for sr_core not found
<6>android_usb gadget: high speed config #1: android
<6>input: ft5x06-i2c as /devices/platform/i2c_omap.2/i2c-2/2-0038/input/input2
<6>ft5x06_initialize() - sysfs_create_group() succeeded.
<6>kxtf9 1-000f: WHO_AM_I = 0x01
<6>input: kxtf9_accel as /devices/virtual/input/input3
<6>using rtc device, twl_rtc, for alarms
<6>twl_rtc twl_rtc: rtc core: registered twl_rtc as rtc0
<6>i2c /dev entries driver
<6>Linux video capture interface: v2.00
<4>max17042: max17042_init ...
<4>max17042: max17042_probe ...
<4>max17042: next history save at 4294936947
<4>max17042: max17042_probe > IRQ is 225
<4>max17042 GPIO pin read 1
<4>max17042: max17042_device_power_on ...
<4>max17042: max17042_hw_init ...
<4>max17042: BATTERY Detected!
<4>config = 0x2214
<4>Valert = 0xff9b
<4>Salert = 0xff05
<4>config = 0x2214
<4>config = 0x2214
<4>shdntimer = 0x0002
<4>max17042: max17042_verify ...
<6>max17042 1-0036: Version = 0x0092
<6>max17042 1-0036: support ver. 1.0.0 enabled
<4>MAX8903: Charger registering!
<4>MAX8903: Charger Initializing...
<4>MAX8903: Request CHARGER FLT IRQ successfully!
<4>MAX8903: Charger detected at boot = 1
<4>MAX8903: USB_EVENT_VBUS: Charger=5
<6>OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
<6>cpuidle: using governor ladder
<6>cpuidle: using governor menu
<6>omap_pwm_led omap_pwm_led: OMAP PWM LED (lcd-backlight) at GP timer 11/0
<7>Registered led device: lcd-backlight
<4>[BL set power] 1
<6>logger: created 64K log 'log_main'
<6>logger: created 256K log 'log_events'
<6>logger: created 64K log 'log_radio'
<6>logger: created 64K log 'log_system'
<6>proc4430_drv_initializeModule
<6>omap-devicehandler omap-devicehandler.0: omap_devh_probe: adding devh Tesla
<6>omap-devh initialized Tesla, major: 241, base-minor: 0
<6>omap-devicehandler omap-devicehandler.1: omap_devh_probe: adding devh SysM3
<6>omap-devh initialized SysM3, major: 241, base-minor: 1
<6>omap-devicehandler omap-devicehandler.2: omap_devh_probe: adding devh AppM3
<6>omap-devh initialized AppM3, major: 241, base-minor: 2
<6>omap3epd-sound: Audio SoC init
<6>Found Board EVT 2.1-ABE support Enabled
<6>asoc: null-codec-dai <-> MultiMedia1 LP mapping ok
<6>asoc: null-codec-dai <-> MultiMedia2 mapping ok
<3>tlv320aic3100_init: Unable get gpio for CODEC POWER 101
<6>mmc0: new high speed DDR MMC card at address 0001
<6>mmcblk0: mmc0:0001 SEM16G 14.8 GiB
<6> mmcblk0: p1
<4>mmc1: host does not support reading read-only switch. assuming write-enable.
<6>mmc1: new high speed SDHC card at address b368
<6>mmcblk1: mmc1:b368 SD04G 3.66 GiB
<6> mmcblk1: p1
<1>##-tlv320aic3100_init
<6>Created the sysfs Files for Audio Driver
<4>Page 4 has 41 Coefficient Values
<4>Page 8 has 61 Coefficient Values
<4>Updated Page 8 DAC Coefficient Control Reg for Adaptive Mode
<6>asoc: tlv320aic3100-dai <-> omap-mcbsp-dai.1 mapping ok
<6>input: OMAP4_ACCLAIM_ABE Headset Jack as /devices/platform/soc-audio/sound/ca
rd0/input4
<6>ALSA device list:
<6> #0: OMAP4 Acclaim AIC3100 ABE
<6>Netfilter messages via NETLINK v0.30.
<6>nf_conntrack version 0.5.0 (14615 buckets, 58460 max)
<4>CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
<4>nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
<4>sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
<6>ctnetlink v0.93: registering with nfnetlink.
<6>xt_time: kernel timezone is -0000
<6>ip_tables: (C) 2000-2006 Netfilter Core Team
<6>arp_tables: (C) 2002 David S. Miller
<6>TCP cubic registered
<6>Initializing XFRM netlink socket
<6>NET: Registered protocol family 10
<6>lo: Disabled Privacy Extensions
<6>Mobile IPv6
<6>IPv6 over IPv4 tunneling driver
<6>sit0: Disabled Privacy Extensions
<6>ip6tnl0: Disabled Privacy Extensions
<6>NET: Registered protocol family 17
<6>NET: Registered protocol family 15
<6>ThumbEE CPU extension supported.
<4>omap_hwmod: Initialize debugfs support
<3>Power Management for TI OMAP4.
<6>prcm_clear_statdep_regs: Clearing static depndencies
<3>CPUidle for CPU0 registered
<3>CPUidle for CPU1 registered
<4>sr_init: No PMIC hook to init smartreflex
<6>smartreflex smartreflex.0: omap_smartreflex_probe: SmartReflex driver initial
ized
<6>smartreflex smartreflex.1: omap_smartreflex_probe: SmartReflex driver initial
ized
<6>smartreflex smartreflex.2: omap_smartreflex_probe: SmartReflex driver initial
ized
<7>Disabling unused clock "auxclk4_src_ck"
<7>Disabling unused clock "hdq1w_fck"
<7>Disabling unused clock "gpmc_ick"
<7>Disabling unused clock "gpio4_dbclk"
<7>Disabling unused clock "efuse_ctrl_cust_fck"
<6>VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
<6> boxer : boxer_panel_enable called , line 233
<6> boxer : boxer_panel_start called , line 150
<6>regulator_init_complete: disabling VANA
<6>twl_rtc twl_rtc: setting system clock to 2012-03-02 10:59:45 UTC (1330685985)
<6>omap_vout omap_vout: : registered and initialized video device 0
<6>omap_vout omap_vout: : registered and initialized video device 1
<6>omap_vout omap_vout: : registered and initialized video device 2
<6>omap_wb: registered and initialized wb device 4 [v4l2]
<6>Freeing init memory: 212K
<3>init: cannot open '/initlogo.rle'
<3>init: Unable to open persistent property directory /data/property errno: 2
<6>enabling adb
<6> boxer : boxer_panel_suspend called , line 245
<6> boxer : boxer_panel_stop called , line 215
<3><dss_mgr_disable> disabling 2lcd
<6>adb_open
<6> boxer : boxer_panel_resume called , line 255
<6> boxer : boxer_panel_start called , line 150
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6> boxer : spi_send called , line 84
<6>kxtf9 1-000f: IRQ TILT [1]
<6>android_usb gadget: high speed config #1: android
<4>MAX8903: Charging is now enabled!
<4>MAX8903: USB Charging at 500 mA
<6>adb_release
<6>adb_open
<6>android_usb gadget: high speed config #1: android
<6>kxtf9 1-000f: IRQ TAP1 [1]
<6>kxtf9 1-000f: IRQ TAP1 [2]
<6>kxtf9 1-000f: IRQ TAP2 [2]
<6>kxtf9 1-000f: IRQ TAP1 [20]
<6>kxtf9 1-000f: IRQ TILT [10]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TILT [10]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TAP1 [1]
<6>kxtf9 1-000f: IRQ TAP1 [1]
<6>kxtf9 1-000f: IRQ TAP1 [2]
<6>adb_release
<6>adb_open
<6>android_usb gadget: high speed config #1: android
<6>adb_release
<6>adb_open
<6>android_usb gadget: high speed config #1: android
<6>kxtf9 1-000f: IRQ TAP1 [1]
<4>
<4> usb unplugged!
<6>adb_release
<4>MAX8903: USB_EVENT_NONE
<6>adb_open
<6>kxtf9 1-000f: IRQ TAP1 [1]
<4>MAX8903: Charging is now disabled!
<4>MAX8903: Charger Unplugged!
<6>kxtf9 1-000f: IRQ TAP1 [1]
<6>PC detected
<4>MAX8903: USB_EVENT_VBUS: Charger=3
<6>android_usb gadget: high speed config #1: android
<4>MAX8903: Charging is now enabled!
<4>MAX8903: USB Charging at 500 mA
<6>kxtf9 1-000f: IRQ TILT [10]
<4>
<4> usb unplugged!
<6>adb_release
<6>adb_open
<4>MAX8903: USB_EVENT_NONE
<6>kxtf9 1-000f: IRQ TAP1 [10]
<6>kxtf9 1-000f: IRQ TILT [1]
<4>MAX8903: Charging is now disabled!
<4>MAX8903: Charger Unplugged!
<6>kxtf9 1-000f: IRQ TILT [10]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TILT [10]
<6>kxtf9 1-000f: IRQ TAP2 [2]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TILT [8]
<6>kxtf9 1-000f: IRQ TAP2 [2]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TILT [8]
<6>kxtf9 1-000f: IRQ TILT [1]
<6>kxtf9 1-000f: IRQ TAP1 [1]
<6>kxtf9 1-000f: IRQ TAP2 [1]
<6>PC detected
<4>MAX8903: USB_EVENT_VBUS: Charger=3
<6>android_usb gadget: high speed config #1: android
<4>MAX8903: Charging is now enabled!
<4>MAX8903: USB Charging at 500 mA
/sdcard # mount
mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
/dev/block/mmcblk1p1 on /sdcard type vfat (rw,nodev,noatime,nodiratime,fmask=000
0,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed
,errors=remount-ro)
/sdcard # parted /dev/block/mmcblk0 print
parted /dev/block/mmcblk0 print
Warning: /dev/block/mmcblk0 contains GPT signatures, indicating that it has a
GPT table. However, it does not have a valid fake msdos partition table, as it
should. Perhaps it was corrupted -- possibly by a program that doesn't
understand GPT partition tables. Or perhaps you deleted the GPT table, and are
now using an msdos partition table. Is this a GPT partition table?
Yes/No? Yes
Yes
Yes
Error: The backup GPT table is not at the end of the disk, as it should be.
This might mean that another operating system believes the disk is smaller.
Fix, by moving the backup to the end (and removing the old backup)?
Fix/Ignore/Cancel? Yes
Yes
Yes
parted: invalid token: Yes
Fix/Ignore/Cancel? Fix
Fix
Fix
Warning: Not all of the space available to /dev/block/mmcblk0 appears to be
used, you can fix the GPT to use all of the space (an extra 569312 blocks) or
continue with the current setting?
Fix/Ignore? Fix
Fix
Fix
Model: MMC SEM16G (sd/mmc)
Disk /dev/block/mmcblk0: 15.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
1 131kB 262kB 131kB xloader
2 262kB 524kB 262kB bootloader
3 524kB 16.3MB 15.7MB recovery
4 16.8MB 33.6MB 16.8MB boot
5 33.6MB 83.9MB 50.3MB fat32 rom
6 83.9MB 134MB 50.3MB fat32 bootdata
7 134MB 522MB 388MB ext4 factory
8 522MB 1164MB 642MB ext4 system
9 1164MB 1611MB 447MB ext4 cache
10 1611MB 2684MB 1074MB fat32 media
11 2684MB 15.6GB 12.9GB ext4 userdata
/sdcard #
/sdcard # reboot
reboot
Also BIG thank you for you guys, especialy to CelticWebSolutions.
Thank you guys.
Cj.
similar problem! help!
I too formatted my 1g partition, and now my nook wont boot, goes to pic of box, hangs. i try cwm from sdcard, same box, hangs. i cant see my device when i plug it in to my win 7 pc. no adb. ive rooted 3 NT's now and i cant understand what i should do next. any help?
DeltreeZero said:
I too formatted my 1g partition, and now my nook wont boot, goes to pic of box, hangs. i try cwm from sdcard, same box, hangs. i cant see my device when i plug it in to my win 7 pc. no adb. ive rooted 3 NT's now and i cant understand what i should do next. any help?
Click to expand...
Click to collapse
Sounds like its not actually booting the SD card. Try powering off completely and the put SD card in. Connect power cable and see if it boots. It could also be your SD isn't written correctly. Could be worth you downloading the latest cm7 SD image from the dev thread. See if that boots.
Sent from my Nook Tablet using Tapatalk
cwm wont run
Thanks for the reply! i have tried all combinations of power,"n", vol up, and vol down, holding not holding all combinations of buttons and also the 8 failed boot buisness, plugging in to wall outlet, plugging in to pc... no changes yet, still "n" symbol on screen, then pic of box, hang. i am downloading the latest cm7 build and downloaded the installer located
here: http://forum.xda-developers.com/showthread.php?t=1000957
per your suggestion. im now making ramen, because the download says 52 min left. I will check back soon. thanks again.
I have followed the instructions and still no boot to cm7. still "n", then pic of box, hang. darn. any ideas?
Can't ADB. PLEASE HELP.
I am having trouble with my nook tablet. It will not boot an OS, and it just hangs at CWM. I am trying the original solution posted by CelticWebSolutions, but I am very new to all of this, and I can't get my computer (windows 7) to recognize the nook as an ADB device. I have no idea what USBDeview is, or where to get it. I have also managed to kill my 2 best micro SD cards. They were 32 gb cards, and when I tried to install CM7. If possible, I would like to just get back to a factory Nook Tablet. If anyone can help me reach a solution, I would be happy to donate.
kodonnell204 said:
I am having trouble with my nook tablet. It will not boot an OS, and it just hangs at CWM. I am trying the original solution posted by CelticWebSolutions, but I am very new to all of this, and I can't get my computer (windows 7) to recognize the nook as an ADB device. I have no idea what USBDeview is, or where to get it. I have also managed to kill my 2 best micro SD cards. They were 32 gb cards, and when I tried to install CM7. If possible, I would like to just get back to a factory Nook Tablet. If anyone can help me reach a solution, I would be happy to donate.
Click to expand...
Click to collapse
Can you get into CWM?, Have you tried Adam's total wipe method?, what OS did you have when you bricked your device? What exactly have you done to it? We need more details in order to help you.
~ Veronica
Sent from XDA premium using my Nook Tablet
Following is a detailed explaination of quacomm MSM Boot
Process
(thanks to the original author "TJ world")
hope it helps DEVs in order to bypass SecureBoot.
An examination of how the
Qualcomm Mobile Station Modem
(MSM) Snapdragon 7x30 system-on-
chip boot-straps the processors into
an operating system.
There are two processors in the
MSM 7x30, an ARM9 for the radio
and an ARM11 auxiliary applications
processor. Each processor has its
own JTAG and can be independently
controlled using it.
ARM9 Boot Process
The ARM9 is the primary processor.
It boots first, executing the Primary
Boot Loader (PBL) from on-board
ROM at 0xFFFF0000 .
The MSM platform has the facility to
force Secure Boot using the status of
the FORCE_TRUSTED_BOOT Qfuse
on-chip or a high-state BOOT_SCUR
pin connected to GPIO95. In this
mode the PBL verifies the signature
of the SBL/OSBL before executing
it,which verifies the REX/AMMS
signature in the same way.
After some hardware initialisation the
PBL reads the Device Boot Loader
(DBL) from the first partition of the
flash memory device (In Linux,
mmcblk0p1).
DBL is part of Qualcomm's
SecureBoot, which uses
cryptography to guarantee that the
boot-loader images haven't been
tampered with. DBL configures the
Cryptographic Look-aside Processor
(CLP), a dedicated cryptographic co-
processor, and other hardware
sufficient to load and execute the
Secondary Boot Loader (SBL) from a
Flash memory device on EBI2
(External Bus Interface 2) from
partition 3 (Linux mmcblk0p3).
The SBL, also known as the
Operating System Boot Loader
(OSBL), is loaded into memory at
0x8000000 (IMEM - Internal Memory,
the MSM7230 package-on-package
(PoP) RAM). This is the ARM9
Monitor (AMON). It provides an
Extensible Firmware Interface (EFI) -
like environment for controlling the
boot process. After doing more
hardware configuration including
UARTs and USB (for potential remote
console connections to the monitor)
it loads the Applications processor
Secondary Boot Loader (APPSBL
a.k.a. hboot) on the ARM11
applications processor from partition
18 (Linux mmcblk0p18) into memory
@ 0x8D000000 virtual, 0x00000000
physical.
It then loads and executes the
combined REX/AMSS from partition
5 (Linux mmcblk0p5). The image
contains the REX (Real-time
EXecutive) which is an L4A
Pistachio embedded micro-kernel
and Iguana operating system
combination, with extensive
Qualcomm and HTC modifications
and extensions.
REX is responsible for loading the
firmware into the ancillary micro-
controller (microP), digital signal
processor and voice processor and
initialising them. It runs in Security
Domain 0 (SD0).
When the ARM11 starts REX
unloads/disconnects its eMMC driver
and from then on relies on remote
procedure calls (RPC) via shared
memory (SMEM) to the ARM11
application processor to read and
write the eMMC. On the ARM11 side
the Linux operating system uses the
rmt_storage (remote storage) driver
to handle such requests.
Finally on the ARM9 REX executes
the Advanced Mobile Subscriber
Software (AMSS). AMSS runs in
Security Domain 1 (SD1).
ARM11 Boot Process
The ARM9 running REX loads the
eMMC "hboot" partition into memory
at 0x8D00000 (virtual) and starts the
ARM11 auxiliary applications
processor executing at this location.
It runs in Security Domain 3 (SD3).
The core of the boot-loader can be
found in the Android source-code
repository in the platform/bootable/
bootloader/legacy.git project. This
source-code maps well to current
hboot images when they are reverse-
engineered; allowing the libc and
core functions and structures to be
identified.
What about grand 2 SM-G7102? Can u help on this phone its as it is also qualcomm. But bootstrap or unlockbootloader required... still not available..
Sent from my SM-G7102 using Tapatalk
i am currently working on the Main SBL only
but what i get is a bunch of useless Hashes!
http://forum.xda-developers.com/showthread.php?t=2666183
Check this out and also u can contact this developer he has already developer kernel for grand2
Sent from my SM-G7102 using Tapatalk
manan001 said:
http://forum.xda-developers.com/showthread.php?t=2666183
Check this out and also u can contact this developer he has already developer kernel for grand2
Sent from my SM-G7102 using Tapatalk
Click to expand...
Click to collapse
actually i know how kernel works,
but the thing is that how do i edit the assembly code in primary registers in order to directly skip the verification which is done by boot image(kernel)
PM Hashcode or dorimanx
Galaxy grand2 SM-G7102
first let me try by my own..
if no progress is done then i'll surely contact them
vrushabh sutar said:
first let me try by my own..
if no progress is done then i'll surely contact them
Click to expand...
Click to collapse
check this..
TripRex is working on stock kernel you can take his help to bulid one..
http://forum.xda-developers.com/showpost.php?p=51549344&postcount=17
bro any progress?
hmm
i've checked all the Memory offsets but found nothing different
Follwoing were the partitions:-
SBL
AMSS
QSCBL (i think we may do something of this but i am nt sure..)
AP
CSC
SYSTEM
CACHE
USRDATA
RAM
EEPROM
Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
This board is base around the HiSilicon Kirin 6220 eight-core ARM Cortex-A53 64-bit SoC running at 1.2GHz and delivering over 10,000 Dhrystone VAX MIPS total performance. The SoC also delivers high performance 3D graphics support with its ARM Mali 450-MP4 GPU.
1GB 800MHz LPDDR3 DRAM, 4GB eMMC Flash Storage and the standard 96Boards microSD v3.0 socket provide high performance. Flexible storage options and connectivity are available through 802.11a/b/g/n WiFi, Bluetooth 4.0 LE, three high speed USB 2.0 ports (1 OTG), an HDMI 1.3 1080p video output with audio, and Maker, DSI display and CSI camera interfaces. The board is the standard 96Boards credit-card form factor powered by an 8-18V DC 2A power supply.
Click to expand...
Click to collapse
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
i have same problem pleas tell me if you fix it
michfood said:
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
Click to expand...
Click to collapse
Hello, can you uload somewere the python file to have a look at it? Also the log you have provided to us it's the whole log?
no the log is not full.
it changes UART speed while booting.
script:
Code:
#!/usr/bin/python
#-*- coding: utf-8 -*-
import os
import os.path
import serial, time
import array
import sys, getopt
class bootdownload(object):
'''
Hisilicon boot downloader
>>> downloader = bootdownload()
>>> downloader.download(filename)
'''
# crctab calculated by Mark G. Mendel, Network Systems Corporation
crctable = [
0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,
0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,
0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,
0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,
0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,
0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,
0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,
0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,
0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,
0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,
0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,
0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,
0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,
0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,
0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,
0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,
0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0,
]
startframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
headframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
bootheadaddress = {
'hi3716cv200':0xF9800800
}
bootdownloadaddress = {
'hi3716cv200':0x07000000
}
BOOT_HEAD_LEN = 0x4F00
MAX_DATA_LEN = 0x400
def __init__(self,chiptype,serialport):
try:
self.s = serial.Serial(port=serialport, baudrate=115200, timeout=1)
except serial.serialutil.SerialException:
#no serial connection
self.s = None
print "\nFailed to open serial!", serialport
sys.exit(2)
self.chip = chiptype
def __del__(self):
if self.s != None:
self.s.close()
def calc_crc(self, data, crc=0):
for char in data:
crc = ((crc << 8) | ord(char)) ^ self.crctable[(crc >> 8) & 0xff]
for i in range(0,2):
crc = ((crc << 8) | 0) ^ self.crctable[(crc >> 8) & 0xff]
return crc & 0xffff
def getsize(self, filename):
st = os.stat(filename)
return st.st_size
def sendframe(self, data, loop):
for i in range(1, loop):
self.s.flushOutput()
self.s.write(data)
self.s.flushInput()
try:
ack = self.s.read()
if len(ack) == 1:
if ack == chr(0xaa):
return None
except:
return None
print 'failed'
def sendstartframe(self):
self.s.setTimeout(0.01)
data = array.array('B', self.startframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,10000)
def sendheadframe(self,length,address):
self.s.setTimeout(0.03)
self.headframe[self.chip][4] = (length>>24)&0xff
self.headframe[self.chip][5] = (length>>16)&0xff
self.headframe[self.chip][6] = (length>>8)&0xff
self.headframe[self.chip][7] = (length)&0xff
self.headframe[self.chip][8] = (address>>24)&0xff
self.headframe[self.chip][9] = (address>>16)&0xff
self.headframe[self.chip][10] = (address>>8)&0xff
self.headframe[self.chip][11] = (address)&0xff
data = array.array('B', self.headframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddataframe(self,seq,data):
self.s.setTimeout(0.15)
head = chr(0xDA)
head += chr(seq&0xFF)
head += chr((~seq)&0xFF)
data = head + data
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,32)
def sendtailframe(self,seq):
data = chr(0xED)
data += chr(seq&0xFF)
data += chr((~seq)&0xFF)
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddata(self, data, address):
length=len(data)
self.sendheadframe(length,address)
seq=1
while length > self.MAX_DATA_LEN:
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:seq*self.MAX_DATA_LEN])
seq = seq+1
length = length-self.MAX_DATA_LEN
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:])
self.sendtailframe(seq+1)
def download(self, filename1, filename2):
f=open(filename1,"rb")
data = f.read()
f.close()
print 'Sending', filename1, '...'
self.senddata(data,self.bootheadaddress[self.chip])
print 'Done\n'
if filename2:
f=open(filename2,"rb")
data = f.read()
f.close()
print 'Sending', filename2, '...'
self.senddata(data,self.bootdownloadaddress[self.chip])
print 'Done\n'
def burnboot(chiptype, serialport, filename1, filename2=''):
downloader = bootdownload(chiptype, serialport)
downloader.download(filename1, filename2)
def startterm(serialport=0):
try:
miniterm = Miniterm(
serialport,
115200,
'N',
rtscts=False,
xonxoff=False,
echo=False,
convert_outgoing=2,
repr_mode=0,
)
except serial.SerialException, e:
sys.stderr.write("could not open port %r: %s\n" % (port, e))
sys.exit(1)
miniterm.start()
miniterm.join(True)
miniterm.join()
def main(argv):
'''
img2 = 'fastboot2.img'
'''
img1 = 'fastboot1.img'
img2 = ''
dev = '/dev/serial/by-id/usb-䕇䕎䥎_㌲㔴㜶㤸-if00-port0'
try:
opts, args = getopt.getopt(argv,"hd:",["img1=","img2="])
except getopt.GetoptError:
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit(2)
for opt, arg in opts:
if opt == '-h':
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit()
elif opt in ("-d"):
dev = arg
elif opt in ("--img1"):
img1 = arg
elif opt in ("--img2"):
img2 = arg
print '+----------------------+'
print ' Serial: ', dev
print ' Image1: ', img1
print ' Image2: ', img2
print '+----------------------+\n'
if not os.path.isfile(img1):
print "Image don't exists:", img1
sys.exit(1)
if (img2):
if not os.path.isfile(img2):
print "Image don't exists:", img2
sys.exit(1)
burnboot('hi3716cv200', dev, img1, img2)
if __name__ == "__main__":
main(sys.argv[1:])
logs:
Code:
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cb0, hpm_dly_exit = 0x00000cf6!
prof[960000]: hpm_dly_exp = 0x00000cb6, hpm_dly_exit = 0x00000cfc!
prof[1200000]: hpm_dly_exp = 0x00000e94, hpm_dly_exit = 0x00000eda!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000caf, hpm_dly_exit = 0x00000cf5!
prof[960000]: hpm_dly_exp = 0x00000cb5, hpm_dly_exit = 0x00000cfb!
prof[1200000]: hpm_dly_exp = 0x00000e90, hpm_dly_exit = 0x00000ed6!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������́v
nUpdate debug uart baudRate to :921600
===>vbus_is_high!
fastboot1 download_mode:1
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[960000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[1200000]: hpm_dly_exp = 0x00000e88, hpm_dly_exit = 0x00000ece!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: found existing buffer, size 1044, addr 24
USB_DOWNLOAD_MODE
timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
uFileAddress=ss=07000000
uFileAddress=ss=07000000
image verify failed!
@michfood hmm okay i had a look. As i can understand your phone doesn't accept the second fastboot.img. I don't think that the problem is the crctable. Maybe you have a wrong fastboot.img?? Try to get a new dump from an another phone.
If your image it's an original dump then there is no reason why it fails to pass the check. The reason why i think the crc signature it's correct it is because you are able to download both images(i saw more details in 96boards forum).
the second image do not start.
after loading first - it says:
"timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
image verify failed!"
so it is returned from fastboot1 to onchip loader and tries to load second image - but fails.
have no possibility to look normal boot as all phones are under guaranty - nobody want to solder uart pins
Actually i didn't said to you to look at a normal boot uart log. In a normal boot you'll just see the kernel booting. Maybe you second fastboot.img is faulty...
the second boot is correct - from the update.app, as the first one
there is a thought that message "image verify failed" is an onchip loader message after fastboot2 loads, runs, made some checks of other partitions (broken) (with no UART messages) and exits with some error code.
here we can see difference between boot from eMMC (left) and boot from RAM (right)
http://clip2net.com/s/3mFVeRi
No, i think fastboot2 doesn't boot at all. Look at ths:
Code:
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
If you try to load only one fastboot.img? what happens?
you just look at log booting from emmc. while booting from ram - no such message.
and once more - after loading first fastboot to RAM it exits with message "return from fastboot1" and tries to load second file to RAM. read carefully
I've got a honor 4x which uses the same chipset. Mine is also bricked but loads into Fastboot&rescue mode, which does not allow me to update the fastboot image due to a signature verify problem (BL31 image). This is related to ARM Trusted Firmware. Also, it does not load a new update.app from the SDCARD - Simply hangs on the logo screen. Therefore, I need to force it to flash a new fastboot.img. I read the HiKey user guide, and noticed there's a J15 SEL jumper, where, when closed, will attempt to program the flash from USB OTG source. Before a pull my phone apart, I would like to know whether anybody has tried flashing a new fastboot.img via USB OTG via closing the J15 SEL jumper and whether it worked. Or if there's any other way to boot my own fastboot.img
some info. i`m looking for motherboard on ali.. have no success
Same problem
michfood said:
Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Click to expand...
Click to collapse
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
JackLenz said:
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
Click to expand...
Click to collapse
still nothing
zhaozihanzzh said:
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
Click to expand...
Click to collapse
thanks for info - but how it helps?
michfood said:
still nothing
Click to expand...
Click to collapse
And what about the driver link?
I found some source code on github, maybe it could be useful
https://github.com/muhammadfahadbaig/android_vendor_huawei_hi6210sft
hello to everyone sorry for my bad english im from germany and i have a problem i v searched but nothing found.
i think my tv firmware is corrupted because
when i plug the tv with UART Cable and putty console i become the boot information and ends with
FATAL ERROR! There is no bootable image on this machine!
Code:
I2C switch set as 1
--------- I2C Initialization ----------
I2C_INIT: I2C-2 bus
I2C_INIT: I2C-1 bus
I2C_INIT: I2C-0 bus
DDR reg 0xF7CB0BAC value : 0x00021421
DDR reg 0xF7CB0C00 value : 0x00004031
leakage info 464.
set Vcpu to 1300mV, default setting by hardware.
set Vcore to 1150mV, default setting by hardware.
flash_ts_init() success.
RDKDMP BG2Q [Oct 27 2017 18:04:12]
Pinmux configuration:
GSM 0xf7fcd040 0x009c0261;
0xf7ea0014: 00000072 00240611 00000253 1249008a
0xf7ea0028: 01249492 00000048 1ca54009 0430e44d
0xf7ea003c: 00000000 00000000 0000001f 63c06a52
Clock configuration:
VCO_B frequency 1620
AVPLLB[4] frequency 300
AVPLLB[5] frequency 800
AVPLLB[6] frequency 1680
AVPLLB[7] frequency 610
cpuPll frequency 1200
memPll frequency 1500
sysPll frequency 800
dClk frequency 375
cpuClk frequency 1200
sysClk frequency 400
drmClk frequency 400
cfgClk frequency 100
gfxClk frequency 400
zspClk frequency 400
perifClk frequency 200
pCubeClk frequency 610
vScopeClk frequency 610
nfcEccClk frequency 100
vppSysClk frequency 400
appClk frequency 800
gfx3DCoreClk frequency 420
gfx3DSysClk frequency 400
arcRefClk frequency 400
vipClk frequency 400
sdioXinClk frequency 200
sdio1XinClk frequency 200
gfx3DShClk frequency 420
avif0Clk frequency 300
avif1Clk frequency 300
[00,sd00] bootloader: part1(start=0, blks=1, version=201710271804), part2(start=
0, blks=1, version=000000000000)
[01,sd01] fts: part1(start=32, blks=32, version=201710271804), part2(start=32, b
lks=32, version=000000000000)
[02,sd02] recovery: part1(start=64, blks=120, version=201710271804), part2(start
=64, blks=120, version=000000000000)
[03,sd03] tzk_recovery: part1(start=184, blks=8, version=201710271804), part2(st
art=184, blks=8, version=000000000000)
[04,sd04] factory_setting: part1(start=192, blks=128, version=201710271804), par
t2(start=192, blks=128, version=000000000000)
[05,sd05] itm: part1(start=320, blks=128, version=201710271804), part2(start=320
, blks=128, version=000000000000)
[06,sd06] boot: part1(start=448, blks=24, version=201710271804), part2(start=448
, blks=24, version=000000000000)
[07,sd07] tzk_normal: part1(start=472, blks=8, version=201710271804), part2(star
t=472, blks=8, version=000000000000)
[08,sd08] system: part1(start=480, blks=1600, version=201710271804), part2(start
=480, blks=1600, version=000000000000)
[09,sd09] user_setting: part1(start=2080, blks=960, version=201710271804), part2
(start=2080, blks=960, version=000000000000)
[10,sd10] cache: part1(start=3040, blks=896, version=201710271804), part2(start=
3040, blks=896, version=000000000000)
[11,sd11] firmware: part1(start=3936, blks=64, version=201710271804), part2(star
t=3936, blks=64, version=000000000000)
[12,sd12] factory_data: part1(start=4000, blks=32, version=201710271804), part2(
start=4000, blks=32, version=000000000000)
[13,sd13] userdata: part1(start=4032, blks=3328, version=201710271804), part2(st
art=4032, blks=3328, version=000000000000)
get macaddr from fts:
cpu id:38bdc6b3 5359eb9c
macaddr=00:B3:53:59:EB:9C
tzk boot with normal mode
start to kick off SM CPU: start 0x3ff0449c, size 63216
SM CPU is kicked [ of f .
L 1as]It(pSoMwe)r:m eondte eirs mnaoint
St[a nd b y 6]W(SM): Entering adc_init.
[ 10]W(SM): Leaving adc_init.
[ 13]W(SM): PWM Initialized
[ 16]I(SM): begin to run tasks
[ 509]W(SM): Joystick connected
[3.019337] TZ CPU0 ERROR[tz_sw_verify_image:75] verify image fail, src=0x19c0000
0, len=0x004c0c00, dst=0x19c00000GIH magic num is not correct (0x482a4d49 != 0xe
ea8f2bc)!!!
FATAL ERROR! There is no bootable image on this machine!
tbdzz---- Img_Ld_And_Start error! Spinning now!
œëYS³Æ½8[ 0] sys_init start. boot_strap=0x00000514 (source=eMMC), boot_state
=0x0
[ 278] image verified, start at 0x00920000...
tz kernel starting... MV88DE3114(BG2Q)-A1 total 4 cpus, v2.0.0.21, Aug 5 2014 1
4:39:52
0321[ 333] start_bootloader
UªULAUNCH_ITM is set to zero
board_number = 6
uiBoot = 0
I2C switch set as 0
i founded that the SoC are a Marvell Armada 1500 do you know if is possible to flash a firmware file with Uart? beacuese i have no access to recovery no image error and i m not sure or emmc problem or dram problem what do you think??
best regards
Emmc
So now with extra tool i can acces emmc with my pc as any one a dump or recovery.img file?
alschepmist17 said:
So now with extra tool i can acces emmc with my pc as any one a dump or recovery.img file?
Click to expand...
Click to collapse
Hi,
Have you found a dump for this TV set ?
I have 2 boards and I've managed to read the emmc chip from both of them.
With 1 board I have Philips displayed at boot in full brightness and after that constantly reboots without a chance to get to recovery. I can see a dark Philips written in the center that appears and disappears every 2 seconds or so.
The 2nd board does nothing.
Thank you
hello can you please describe with what hardware and software read ??
many thanks
Request for recovery.img
bebilakner said:
Hi,
Have you found a dump for this TV set ?
I have 2 boards and I've managed to read the emmc chip from both of them.
With 1 board I have Philips displayed at boot in full brightness and after that constantly reboots without a chance to get to recovery. I can see a dark Philips written in the center that appears and disappears every 2 seconds or so.
The 2nd board does nothing.
Thank you
Click to expand...
Click to collapse
Hi bebilakner, I am trying to fix a 55pus8809/12 with corrupted recovery partition. Can you please share images that you extracted from emmc for recovery and tzk_recovery partitions? Thanks!