[JTAG / OpenOCD] Xperia X8 - XPERIA X8 Android Development

Hello people,
I've been trying to unbrick a xperia x8 phone and reflashing the bootloader using JTAG. After some research I managed to connect to the cpu, but I can't get it to halt. I'm using OpenOCD 0.6 in combination with the olimex JTAG usb-arm-ocd tool. Based on the ft2232 chips.
Here's what I get with openocd:
Code:
Open On-Chip Debugger 0.6.0 (2013-03-15-20:11)
Licensed under GNU GPL v2
For bug reports, read
--link
Info : only one transport option; autoselect 'jtag'
DEPRECATED! use 'adapter_khz' not 'jtag_khz'
adapter speed: 500 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
adapter_nsrst_delay: 100
CPU
Info : device: 4 "2232C"
Info : deviceID: 364511235
Info : SerialNumber: FTU1UUZZA
Info : Description: Olimex OpenOCD JTAG A
Info : clock speed 500 kHz
Info : JTAG tap: ARM926EJS.cpu tap/device found: 0x203c00e1 (mfg: 0x070, part: 0x03c0, ver: 0x2)
Info : Embedded ICE version 6
Info : marvel: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection from 4444
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0* CPU arm926ejs little ARM926EJS.cpu running
Info : Halt timed out, wake up GDB.
So it correctly identifies the CPU and embedded ICE version.
For the people wondering why it isn't an ARM1136EJS core... i'm wondering the same thing! I tried pulling down the boot_mode pin but I can only get the TAP for the ARM926 core...
Does anyone know how to get the processor to HALT ? as a start... this would allow me to acces the NAND memory through the CFI interface. Altho i might be reinventing the wheel, it just seems silly to pay lots of money for something as 'simple' as JTAG programming a phone. Would have been easier if i'd designed the software myself!

this is not the section to post this

what is this??

Hey whats going on here??
Is there any chance of hoping more from X8 hardware?

vuiseng said:
what is this??
Click to expand...
Click to collapse
read the title.
@OP. ask a mod to move the thread to Q&A section
but i dont think anybody would be able to answer the question except nAa

I had read something on arm official site and got that
Arm 926EJ is armv5 processor not an armv6
But an armv5 processor have a max freq. = 470 MHz

Any progress regarding the pinout?

Related

[Module] X8Overclock | v004 - Multiple freq | X8 | X10 mini | X10 mini pro | 11-04-11

Rom cookers: if you include this module in your ROM, please make a link to this post in your release post, so your users can know how to work with it and update the module themselves
Intro: (dev post)
Since the X10 kernel is working, we might have a hope that someday we will have our custom kernels. If we can have custom kernels, we can do the overclocking easily.
Until that day, we will still have to overclock with modules. To make overclocking works with our current kernel, as far as I can see, we need to do the following things:
1. Patch cpufreq data to change maximum reported freq (these value will be read by Android for further controls). cpufreq will then call the low-level acpuclock functions to change real cpu freq.
2. Patch acpuclock data + code to change real cpu freq.
Right now I'm working a proof-of-concept module, with finished 1 and half of 2. I will need to patch acpuclock code in the running kernel to make the frequency applicable.
That means, right now, Android reported that I have a 800MHz MSM7227, although it's running at 600MHz, and cpufreq's governor accepts to change to the maximum 800MHz (it's 600MHz for real). We will need to patch acpuclock code to change PLL and apply the correct divisor.
Source on github : https://github.com/doixanh/X8Features
Release history
April 11. v004. Default to 691MHz. Multiple frequencies are available for SetCPU: from 614MHz to 826MHz. You can now change frequencies with SetCPU - much like with custom kernels! You can even SetCPU freq at boot.
April 07. v003. Compatible with SetCPU. Easier for code maintenance.
April 06. v002 for mini pro. x8oc module for x10 mini pro released! Be warned: I didn't have your x10mini pro hardware so I didn't test it throughoutly.
April 06. v002 for mini. x8oc module for x10 mini released! Be warned: I didn't have your x10mini hardware so I didn't test it throughoutly. 710MHz was reported not too stable. A lower freq is more stable.
April 06. v002. Experimental! It maybe very unstable! Undervoltage for all frequencies except the max freq (Reduced voltages for 128MHz, 245MHz, 320MHz, 480MHz). This can potentially save battery. I need test results for saving battery from you guys
April 05. v001. Default to 710MHz.
Requirements:
- Rooted
- Baseband x15
- xRecovery (for automatic installtation)
- Dare!
Installation:
a. Manual installation : it will be better if you can do this way.
- Download appropriate x8oc-vXXX.zip (for X8), or x8oc-vXXX-x10m.zip (for X10 mini), or x8oc-vXXX-x10mp.zip (for x10 mini pro) below, unzip
- Remount /system as rw
- Push x8oc.ko in to /system/lib/modules
- Edit /system/etc/hw_config.sh, add one line at the beginning
Code:
insmod /system/lib/modules/x8oc.ko # x8 overclock
For people who want to set specific freq at boot, write the following instead of the code above:
Code:
# x8 overclock
insmod /system/lib/modules/x8oc.ko
sleep 2
echo xAB > /proc/x8oc
Where AB is your desired code for that frequency. Test the frequency carefully before applying it at boot!
(you can edit hw_config.sh by pulling it to your PC, edit, and push it back)
- Reboot your phone
b. Automatic installation : much like x8gesture, I will have to prepare update.zip for each ROM. I'm pretty busy now, so be patient.
General instruction
- When you install x8oc, SetCPU will not recognized the new max frequency. Don't touch the slide and/or change the governor. If you do that, the new frequency will be lost. You will have to reboot your phone to get the new freq.
- For geeks only: it is possible to change maximum frequency after you install x8oc. With following command, you can replace AB to other values to change max freq:
Code:
echo xAB > /proc/x8oc
20 to change to 614MHz
21 to change to 634MHz
22 to change to 653MHz
23 to change to 672MHz
24 to change to 691MHz
25 to change to 710MHz
26 to change to 730MHz
27 to change to 749MHz
For example, set to 749MHz:
Code:
echo x27 > /proc/x8oc
This feature still works with v004
Somebody asked about the meaning of AB above. If you look at the source you will understand
In short :
- AB is stored in hexadecimal
- Max frequency = AB (in decimal) * 19.2MHz
Example:
AB = 27 means AB = 0x27 = 39 (in decimal)
Real frequency = 39*19.2 = 748.8 MHz
You can put 28, 29, for even higher frequency... but I don't recommend to do that. It was unstable for me.
x10 mini / x10 mini pro users:
Support for x10 mini / x10 mini pro has been added since 06-04-11. However, I don't have your hardware so you must test this module before install it:
- Push x8oc.ko to /system/lib/modules
- Run the following command
Code:
insmod /system/lib/modules/x8oc.ko
If the phone is still working, no crash, no black screen, then it works.
Until you're sure that it works with your hardware, don't install it to hw_config.sh or you will get boot loops and may severely damage your hardware
Disclaimer
This module is dangerous! It may cause severe damage to your hardware. I'm not responsible if this module kills your lovely phone. Use it at your own risk!
Donations are welcome
PLEASE DON'T SPAM IN THIS THREAD WITH UNCONTRIBUTED POSTS.
Can you share the source code of your module?
I was too lazy to build a separated module for OCing Everything is a mess inside my current x8gesture module
I'll try to do something more and then separate OC into a new module.
info about MSM7227 CPU:
http://pdadb.net/index.php?m=cpu&id=a7227&c=qualcomm_msm7227
Holy sh*t. They included bunches of controllers inside this MSM 7227
Max. 800MHz Qualcomm MSM7227 Turbo, Embedded 320MHz DSP (GSM, GPRS/EGPRS Multislot Class 12, EDGE, UMTS Release 6, 7.2 Mbps HSDPA, HSUPA 5.76 Mbps, MBMS baseband), 400MHz modem processor, Adreno 200, OpenGL ES 2.0, OpenGL ES 1.1, OpenVG 1.1, EGL 1.3, Direct3D Mobile, SVGT 1.2, DirectDraw,
Click to expand...
Click to collapse
Is there anyway to enable that turbo mode by moding? It must be locked somewhere, the safe clock is 600mhz, but it might run 800mhz or more stable too, might be battery draining issue, or overvoltage necessity but with scaling that should not be a real issue, if only used to extreme situations, and, for a bit of time.
f.e. Samsung Galaxy Ace has same CPU and it run at 800Mhz
This is a great project and it looks very promissing.
ZTE Blade has same cpu and they had problems overclocking just the main core, but in the end they solved it, I guess you could take a look at their solution as well.
And thanks again for the dualtouch module.
I read many overclocked kernel sources for MSM7227 in difference devices. What they did was to modify acpuclock.c :
1. add new freqs to freq_table
2. add new freqs to clkctl_acpu_speed arrays
3. modify acpuclk_set_div to set PLL for overclocked freqs
Because acpuclock is initialized very early during boot process, cpufreq (initialized much later) will read those available freqs from acpuclock to apply to its governors.
In our case, because we cannot modify acpuclock in the kernel before it's initialized, our module will be loaded much later than both acpuclock and cpufreq. Therefore, my approach is to modify (inline patch) both acpuclock and cpufreq in memory, while the kernel is running.
So far, as mentioned in OP, I modified cpufreq and acpuclock data (as in 1. and 2.), so that Android thinks that max freq is set at 800MHz. We will have to do some inline memory patches to acpuclock function to change PLL for freqs more than 600MHz during runtime. More precisely, we need to patch acpuclk_set_div function.
I did a quick study about ARM instruction set, looked for branch (and branch with links) instructions. I managed to redirect calls to acpuclk_set_div to my own function in module, so that acpuclock_set_rate calls to my function, instead of the original one. However, it seems that the param received by my function is always NULL.
Looking for reasons and solutions. Any suggestions?
@racht: no, we thank you for your hard work in your Hackdroid ROMs.
It seems that I made a mistake. acpuclk_set_div was not separated as a function. Instead, the compiler included it in the caller function (acpuclk_set_rate). This will be a big big big problem for us to hijack the call.....
Hope everything works out! 200mhz is a big jump
Can u share your sources?
Maby i can help you
Sent from my U20i using XDA Premium App
I will need to rewrite the module, because everything is placed in my x8gesture I will do it soon.
The initial commit is pushed to github at : https://github.com/doixanh/X8Overclock
All contributions are welcome.
as an example of omap3
http://code.google.com/p/milestone-overclock/
This project consists of a kernel module for OMAP3 phones with Android to unlock any processor frequency/voltage combination and a companion graphical app to ease the configuration. The phone must be rooted so that the kernel module can be loaded.
The module has an interface in /proc/overclock/* that allows enabling and disabling of overclock in runtime without rebooting. No flashing of custom roms or kernels is needed, since that is not even possible with the Milestone, Droid X and others.
andrej456 said:
as an example of omap3
http://code.google.com/p/milestone-overclock/
This project consists of a kernel module for OMAP3 phones with Android to unlock any processor frequency/voltage combination and a companion graphical app to ease the configuration. The phone must be rooted so that the kernel module can be loaded.
The module has an interface in /proc/overclock/* that allows enabling and disabling of overclock in runtime without rebooting. No flashing of custom roms or kernels is needed, since that is not even possible with the Milestone, Droid X and others.
Click to expand...
Click to collapse
Thats good idea but edit is needed because X8 does not have 1,2 processor
EDIT: With 800 processor thats so close x10 1000 processor,cant imagine how fast x8 will be
as-mario said:
Thats good idea but edit is needed because X8 does not have 1,2 processor
EDIT: With 800 processor thats so close x10 1000 processor,cant imagine how fast x8 will be
Click to expand...
Click to collapse
to not fit in the x8, but the wiki to be useful
if we take this as an example you can write a module
sorry for my english
It seems that my approach is like milestone-overclock. Their CPU is different, but we can know that we're having a good direction.
Good news: I managed to hijack calls to acpuclk_set_rate (the function contains acpuclk_set_div). This way, we can write our own set_rate and set_div function.
Destination is not too far away
YES, YES and YES! It's running at 684MHz! Will upload a screenshot soon!
This below screenshot is taken at 710MHz with only CPU test
It seems that our CPU is not stable above 748MHz.

tf201 on uart debug interfce

hi all im electronic tech i have brick my tablet when try flash in fastboot adb fastboot mode clockwork recovery 5.8xx first device opened and boot up normal without any problem then i reboot few time i have not seen cwm menu and i wipe data and tablet hardly bricked lol
so i start to find the way how to unbrick it without nvflash wheelie Secure Boot Key (blob.bin) because i not backup it. and still i don't know how to backup it!?
After a long research tegra based schematics and nvidia tegra dev docs, some forum posts, for my prime i got the idea from google nexus 7 schematic there used same pin con. figure
this post nexus7 sch http://forum.xda-developers.com/showpost.php?p=31922480&postcount=86
i find in printed circuit board GMI_OE_N, FORCE_RECOVERY#, and Uart Debug, jtag. connector pinout for comminication but that socket and some resistor used only for development process and test. its unmounted for production.
first i try FORCE_RECOVERY# pin when i power on tablet short it with ground device entered directly APX mode but that is same with vol power button combination tegra Soc still not allowed me to access emmc nand.
I started to research uart debugin i find this post http://forum.xda-developers.com/showthread.php?t=1081743 little information about howto tegra uart debug to understand what has happened to the bootloader
in experiment first i see in terminal garbage ascii characters i change TTL the location of the wire uart TXD, and uart RXD. "UART_DEBUG_TXD <-> UART_DEBUG_RXD" for tf201 showed me the right uart log in terminal meybe jtag pins are different placed i still not sure? but F_Recovery, pin and Hot_reset, pin are in same place VDD1.8v pin where have in right placed! i have edit schematic picture with paint for correction
i use for Uart debugin Usb TTL adapter pl2303 and PuTTY terminal emulator
How to: UART
1. Connect TTL to source device TX
2. Connect TTL RxD to source device RX
3. Connect TTL GND to source device GND! (don't forgot it!)
5. Open a terminal emulator, like PuTTY.
Connection parameters:
115200, 8 n 1, no flow control
Warning! Use this information at your own risk. Will void your warranty!
!don't Unmount nothing in pcb!
edited by me 24pin con. points schematic View attachment 1784738
mb pad connector pic View attachment 1784739
here is the power on boot debug log
Code:
-Mé11AÁé¢ÂZ¡é)9YI8
-MéAUéºZ¡é)9YI8I8 1=
½¹Ñɽ±±ÉéªRre%Õiêjjj¥*áÑɹ
½¹Ñɽ±±ÉéªRş
ADJUSTED CLOCKS:
MC clock is set to 250000 KHz
EMC clock is set to 500000 KHz (DDR clock is at 500000 KHz)
PLLX0 clock is set to 700000 KHz
PLLC0 clock is set to 600000 KHz
CPU clock is set to 700000 KHz
System and AVP clock is set to 102000 KHz
GraphicsHost clock is set to 163200 KHz
3D clock is set to 83333 KHz
2D clock is set to 83333 KHz
Epp clock is set to 83333 KHz
Mpe clock is set to 83333 KHz
Vde clock is set to 272000 KHz
Bootloader Start at:2017 ms
PCB value(0x0)
Initializing Display
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
Inval idate-only cache maint not supported in NvOs
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
LowLowBatteryCheck
LowLowBattery Check pinvalue=0
Battery capacity >low low Battery voltage
PCB value(0x0)Show mdpilogo
show logo at 2814ms
[bootloader] (built on Nov 22 2012, 20:19:53)
Platform Pre Boot configuration...
Verify chip uid
chip uid 1st RSAVerify ok
The Device is UnLocked.
SocCpuMaxKHz = 1000000
SocCpuMinKHz = 32
PLLX0 FreqKHz = 700000
Checking for android ota recovery
PCB value(0x0)
Platform Pre OS Boot configuration...
HDMI CPLD Program - ERROR
HDMI CPLD Program - ERROR
CpldRead8(): Failed: SlaveNotFound slave Add 0xd2
The enabling SDMMC1 Power rail is FAILED.
Actual Size = 0x540800 bytes
Verify chip uid
chip uid 1st RSAVerify ok
The proc BoardInfo: 0x0222:0x8200:0xe0:0x4f:0x44
PCB value(0x0)
!!!ERROR!!! EKS Partition is not available
Jumping to kernel at:3737 ms
"END"
i find jelly bean internal FLASH ROM partition table documentation for lg x4 HD tegra3 based SoC
chinse http://bbs.gfan.com/android-5633570-1-1.html
The EKS hidden partition 2M
The "NVEKSP" logo, followed by a 2048-bit key and guess verify boot.img with the public key. Using RAS (guess) algorithm SOS and LNX partition data do signature verification, signature data block (1024 bytes) in the tail of the SOS and LNX partition data.
[partition]
name=EKS
id=6
type=data
allocation_policy=sequential
filesystem_type=basic
size=81200
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=eks.dat
thanks
fullcontrol said:
hi all in my bricked tablet i find my uart debug pins on pcb in terminal here is the on boot log it have chanse to i unbrick it ?
-Mé11AÁé¢ÂZ¡é)9YI8
-MéAUéºZ¡é)9YI8I8 1=
½¹Ñɽ±±ÉéªRre%Õiêjjj¥*áÑɹ
½¹Ñɽ±±ÉéªRş
ADJUSTED CLOCKS:
MC clock is set to 250000 KHz
EMC clock is set to 500000 KHz (DDR clock is at 500000 KHz)
PLLX0 clock is set to 700000 KHz
PLLC0 clock is set to 600000 KHz
CPU clock is set to 700000 KHz
System and AVP clock is set to 102000 KHz
GraphicsHost clock is set to 163200 KHz
3D clock is set to 83333 KHz
2D clock is set to 83333 KHz
Epp clock is set to 83333 KHz
Mpe clock is set to 83333 KHz
Vde clock is set to 272000 KHz
Bootloader Start at:2017 ms
PCB value(0x0)
Initializing Display
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
Inval idate-only cache maint not supported in NvOs
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
LowLowBatteryCheck
LowLowBattery Check pinvalue=0
Battery capacity >low low Battery voltage
PCB value(0x0)Show mdpilogo
show logo at 2814ms
[bootloader] (built on Nov 22 2012, 20:19:53)
Platform Pre Boot configuration...
Verify chip uid
chip uid 1st RSAVerify ok
The Device is UnLocked.
SocCpuMaxKHz = 1000000
SocCpuMinKHz = 32
PLLX0 FreqKHz = 700000
Checking for android ota recovery
PCB value(0x0)
Platform Pre OS Boot configuration...
HDMI CPLD Program - ERROR
HDMI CPLD Program - ERROR
CpldRead8(): Failed: SlaveNotFound slave Add 0xd2
The enabling SDMMC1 Power rail is FAILED.
Actual Size = 0x540800 bytes
Verify chip uid
chip uid 1st RSAVerify ok
The proc BoardInfo: 0x0222:0x8200:0xe0:0x4f:0x44
PCB value(0x0)
!!!ERROR!!! EKS Partition is not available
Jumping to kernel at:3737 ms
thanks
Click to expand...
Click to collapse
1) where is the uart?
2) is that all there is of the log?
yes its all log frezed on asus logo not continue meybe it is first warmboot sorry i will edit first post for points for uart debuging txd and rxd pins still not redy drawing. meybe i find too jtag pin points too still i not sure
fullcontrol said:
yes its all log frezed on asus logo not continue meybe it is first warmboot sorry i will edit first post for points for uart debuging txd and rxd pins still not redy drawing. meybe i find too jtag pin points too still i not sure
Click to expand...
Click to collapse
How did you brick your Prime? Did you check the unbricking thread?
fullcontrol said:
yes its all log frezed on asus logo not continue meybe it is first warmboot sorry i will edit first post for points for uart debuging txd and rxd pins still not redy drawing. meybe i find too jtag pin points too still i not sure
Click to expand...
Click to collapse
have you tried holding vol-down?
first post have been updated... i hope it will be helpful for you
i brick it when i send clockwork 5x img in fastboot adb mode first i have no problem with boot up after few a reboot enter in fastmode try to active cwm menu and didnt see cwm recovery menu i have do wipe data wipe process gone long time and i power off my tablet then tablet bricked sty in asus logo only. vol power button combination not help i see nothing there is full log what happened on boot
i not underdstand why on debug i see only command end line not all commands meybe UART4_TXD n UART4_RXD not connected? i will check it soon
what mean "Checking for android ota recovery" i have try with microSD put there firmware not work i not have otg for test i will build one later meybe look special file name? or boot look some recovery file in any port!? devs will be know it i think all answers have in oficial kernel im not dev programmer to i find sorry i will try soon
wipe data or cwm kill my "EKS Partition" it is for jelly bean partition table here is link for jelly bean partition table http://forum.xda-developers.com/showthread.php?p=38754475
Looking over your log, and with the new information sadly you have a bricked unit.
JTAG is fused off on production devices, so that is out, and it looks like you have a boot to recovery flag set, but a broken recovery partition.
There is one thing you could try if you are up to it, but it really isn't the most simple exercise, find the mmc data lines, wire that up to an mmc reader, then using your pc find the misc partition and clean it.
lilstevie said:
Looking over your log, and with the new information sadly you have a bricked unit.
JTAG is fused off on production devices, so that is out, and it looks like you have a boot to recovery flag set, but a broken recovery partition.
There is one thing you could try if you are up to it, but it really isn't the most simple exercise, find the mmc data lines, wire that up to an mmc reader, then using your pc find the misc partition and clean it.
Click to expand...
Click to collapse
thanks for your advice yes i have jrag before arm power pc stb processors arm cpu must be enter test mode to allow jtagin! it is rulle
tegra based arm have that pin TEST_MODE_EN R28 i not have t30 bga stenchil to remove cpu to folow that lines i will check it soon
and update first post im just lazy
last other possibility is to i remove nand flash and place different arm device to root or programmer to reflash it easy but i need worked dump file stil emmc nand is new not all devices use that nand.
sorry you mean SDmmc or nand device there have alot memmory controler data lines
fullcontrol said:
thanks for your advice yes i have jrag before arm power pc stb processors arm cpu must be enter test mode to allow jtagin! it is rulle
tegra based arm have that pin TEST_MODE_EN R28 i not have t30 bga stenchil to remove cpu to folow that lines i will check it soon
and update first post im just lazy
last other possibility is to i remove nand flash and place different arm device to root or programmer to reflash it easy but i need worked dump file stil emmc nand is new not all devices use that nand.
sorry you mean SDmmc or nand device there have alot memmory controler data lines
Click to expand...
Click to collapse
the test mode pin is irrelevant, the device has an efuse block that when a specific fuse is blown (ODM_SECURE) JTAG is strictly prohibited by the bootrom, this is inside the SoC and not exposed externally at all.
While the emmc may have many many pins underneath it, there are only a limited number in use as it isn't attached as nand but rather mmc, and connected to the tegras mmc bus, with a little bit of time and probing you would be able to figure out which pins are required for data, there is even a possibility of disabling the emmc as it tries to read the boot flag but timing that would be extremely hard, and it would be easier to figure out the data bus.
Your only other real option is to send it to asus
Can you explain with a little more detail exactly what you did to get uart working? I've looked over the the instructions and they aren't very clear (I do understand that English is not your first language and that does make it harder).
I've tried to follow them myself and I'm not having much success really
first post updated so any idea ?
It was my understanding that both UART and JTAG are efused out on production hardware? If not, I am going to feel compelled to give this a whirl...
Sent from my Transformer Prime TF201 using xda app-developers app
all the answers are in blob.ebt =bootloader.bin file who can extract the strings in the bootloader ?
fullcontrol said:
hi all im electronic tech i have brick my tablet when try flash in fastboot adb fastboot mode clockwork recovery 5.8xx first device opened and boot up normal without any problem then i reboot few time i have not seen cwm menu and i wipe data and tablet hardly bricked lol
so i start to find the way how to unbrick it without nvflash wheelie Secure Boot Key (blob.bin) because i not backup it. and still i don't know how to backup it!?
After a long research tegra based schematics and nvidia tegra dev docs, some forum posts, for my prime i got the idea from google nexus 7 schematic there used same pin con. figure
this post nexus7 sch http://forum.xda-developers.com/showpost.php?p=31922480&postcount=86
i find in printed circuit board GMI_OE_N, FORCE_RECOVERY#, and Uart Debug, jtag. connector pinout for comminication but that socket and some resistor used only for development process and test. its unmounted for production.
first i try FORCE_RECOVERY# pin when i power on tablet short it with ground device entered directly APX mode but that is same with vol power button combination tegra Soc still not allowed me to access emmc nand.
I started to research uart debugin i find this post http://forum.xda-developers.com/showthread.php?t=1081743 little information about howto tegra uart debug to understand what has happened to the bootloader
in experiment first i see in terminal garbage ascii characters i change TTL the location of the wire uart TXD, and uart RXD. "UART_DEBUG_TXD <-> UART_DEBUG_RXD" for tf201 showed me the right uart log in terminal meybe jtag pins are different placed i still not sure? but F_Recovery, pin and Hot_reset, pin are in same place VDD1.8v pin where have in right placed! i have edit schematic picture with paint for correction
i use for Uart debugin Usb TTL adapter pl2303 and PuTTY terminal emulator
How to: UART
1. Connect TTL to source device TX
2. Connect TTL RxD to source device RX
3. Connect TTL GND to source device GND! (don't forgot it!)
5. Open a terminal emulator, like PuTTY.
Connection parameters:
115200, 8 n 1, no flow control
Warning! Use this information at your own risk. Will void your warranty!
!don't Unmount nothing in pcb!
edited by me 24pin con. points schematic View attachment 1784738
mb pad connector pic View attachment 1784739
here is the power on boot debug log
Code:
-Mé11AÁé¢ÂZ¡é)9YI8
-MéAUéºZ¡é)9YI8I8 1=
½¹Ñɽ±±ÉéªRre%Õiêjjj¥*áÑɹ
½¹Ñɽ±±ÉéªRş
ADJUSTED CLOCKS:
MC clock is set to 250000 KHz
EMC clock is set to 500000 KHz (DDR clock is at 500000 KHz)
PLLX0 clock is set to 700000 KHz
PLLC0 clock is set to 600000 KHz
CPU clock is set to 700000 KHz
System and AVP clock is set to 102000 KHz
GraphicsHost clock is set to 163200 KHz
3D clock is set to 83333 KHz
2D clock is set to 83333 KHz
Epp clock is set to 83333 KHz
Mpe clock is set to 83333 KHz
Vde clock is set to 272000 KHz
Bootloader Start at:2017 ms
PCB value(0x0)
Initializing Display
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
Inval idate-only cache maint not supported in NvOs
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
PCB value(0x0)
LowLowBatteryCheck
LowLowBattery Check pinvalue=0
Battery capacity >low low Battery voltage
PCB value(0x0)Show mdpilogo
show logo at 2814ms
[bootloader] (built on Nov 22 2012, 20:19:53)
Platform Pre Boot configuration...
Verify chip uid
chip uid 1st RSAVerify ok
The Device is UnLocked.
SocCpuMaxKHz = 1000000
SocCpuMinKHz = 32
PLLX0 FreqKHz = 700000
Checking for android ota recovery
PCB value(0x0)
Platform Pre OS Boot configuration...
HDMI CPLD Program - ERROR
HDMI CPLD Program - ERROR
CpldRead8(): Failed: SlaveNotFound slave Add 0xd2
The enabling SDMMC1 Power rail is FAILED.
Actual Size = 0x540800 bytes
Verify chip uid
chip uid 1st RSAVerify ok
The proc BoardInfo: 0x0222:0x8200:0xe0:0x4f:0x44
PCB value(0x0)
!!!ERROR!!! EKS Partition is not available
Jumping to kernel at:3737 ms
"END"
i find jelly bean internal FLASH ROM partition table documentation for lg x4 HD tegra3 based SoC
chinse http://bbs.gfan.com/android-5633570-1-1.html
The EKS hidden partition 2M
The "NVEKSP" logo, followed by a 2048-bit key and guess verify boot.img with the public key. Using RAS (guess) algorithm SOS and LNX partition data do signature verification, signature data block (1024 bytes) in the tail of the SOS and LNX partition data.
[partition]
name=EKS
id=6
type=data
allocation_policy=sequential
filesystem_type=basic
size=81200
file_system_attribute=0
partition_attribute=0
allocation_attribute=8
percent_reserved=0
filename=eks.dat
thanks
Click to expand...
Click to collapse
Hi,
I have a bricked tf201.
I'm very interested in the progress you made so far. Any luck sniffing the nand data lines?
I have a hard bricked tf201, does this mean there's a possibility to fix it?
Sent from my LG-P880
axepted said:
I have a hard bricked tf201, does this mean there's a possibility to fix it?
Sent from my LG-P880
Click to expand...
Click to collapse
Well... everything is possible....
I'm waiting for my bus pirate to arrive. After that, It may be possible to reflash the nand thru the jtag interface
Any updates?
I hard bricked my tf201 too and i try to find unbrick
Hello,
Is there a way to hack the encryption in order to create our proper blob.bin manually ( with hex editing another blob.bin)
No ?
Thanks
Hi guys,
Finally , does anyone could retrieve the start of our TF201 using the procedure with JTAG ? or change, does only have the option to change motherboard of the TF201 ?

[Q] MTK6589 / MT6589 Overclock - Help building Kernel

I have a Star S9500 with MTK6589 Cortex-A7 Quad Core @ 1.2GHz with PowerVR SGX544 Single Core.
I have the Kernel Source extracted from an Acer smartphone here: https://github.com/varunchitre15/MT6589_kernel_source .
In the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_cpufreq.c file, in the line 127 has the code:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F1; /* default 1.2GHz */
If I change it to:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F0_0; /* OC 1.7GHz */
it changes from 1209000 KHz to 1703000 KHz, as in the line 70:
Code:
#define DVFS_F0_0 (1703000) // KHz
#define DVFS_F0_1 (1599000) // KHz
#define DVFS_F0_2 (1508000) // KHz
#define DVFS_F0_3 (1404000) // KHz
#define DVFS_F0_4 (1300000) // KHz
#define DVFS_F1 (1209000) // KHz
#define DVFS_F2 ( 988000) // KHz
#define DVFS_F3 ( 754000) // KHz
#define DVFS_F4 ( 497250) // KHz
I think I don't need to change de voltage as it is already set to the max supported by the Kernel.
I don't have problems with overheating or extreme battery drain, as I have the CPU Master Pro app and when the screen is off or he is overheating it sets to 500MHz x4.
I want to OC the GPU too, but I can't find the line to change te clock in the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_gpufreq.c file.
I already built the Kernel in Debian OS succefully, but now I don't know how to put to .img to flash it!
Anyone can build the Kernel and publish it or just tell me what must I do?
EDIT: I just want to be able to play Real Racing 3 at 960p. I only get a great performance at standard FWVGA resolution and if I set 960x1708 @ 390 DPI screen the performance is very good except in Real Racing 3 and other graphical intense games.
Best regards,
Ivan Santos.
IvanSantosPT said:
I have a Star S9500 with MTK6589 Cortex-A7 Quad Core @ 1.2GHz with PowerVR SGX544 Single Core.
I have the Kernel Source extracted from an Acer smartphone here: https://github.com/varunchitre15/MT6589_kernel_source .
In the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_cpufreq.c file, in the line 127 has the code:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F1; /* default 1.2GHz */
If I change it to:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F0_0; /* OC 1.7GHz */
it changes from 1209000 KHz to 1703000 KHz, as in the line 70:
Code:
#define DVFS_F0_0 (1703000) // KHz
#define DVFS_F0_1 (1599000) // KHz
#define DVFS_F0_2 (1508000) // KHz
#define DVFS_F0_3 (1404000) // KHz
#define DVFS_F0_4 (1300000) // KHz
#define DVFS_F1 (1209000) // KHz
#define DVFS_F2 ( 988000) // KHz
#define DVFS_F3 ( 754000) // KHz
#define DVFS_F4 ( 497250) // KHz
I think I don't need to change de voltage as it is already set to the max supported by the Kernel.
I don't have problems with overheating or extreme battery drain, as I have the CPU Master Pro app and when the screen is off or he is overheating it sets to 500MHz x4.
I want to OC the GPU too, but I can't find the line to change te clock in the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_gpufreq.c file.
I already built the Kernel in Debian OS succefully, but now I don't know how to put to .img to flash it!
Anyone can build the Kernel and publish it or just tell me what must I do?
EDIT: I just want to be able to play Real Racing 3 at 960p. I only get a great performance at standard FWVGA resolution and if I set 960x1708 @ 390 DPI screen the performance is very good except in Real Racing 3 and other graphical intense games.
Best regards,
Ivan Santos.
Click to expand...
Click to collapse
Why don't you try to upload and share your compiled kernel (i.e zImage) with us, we can test it, and if it's really working, we can work on overclock gpu too..
IvanSantosPT said:
I have a Star S9500 with MTK6589 Cortex-A7 Quad Core @ 1.2GHz with PowerVR SGX544 Single Core.
I have the Kernel Source extracted from an Acer smartphone here: https://github.com/varunchitre15/MT6589_kernel_source .
In the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_cpufreq.c file, in the line 127 has the code:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F1; /* default 1.2GHz */
If I change it to:
Code:
static unsigned int g_max_freq_by_ptp = DVFS_F0_0; /* OC 1.7GHz */
it changes from 1209000 KHz to 1703000 KHz, as in the line 70:
Code:
#define DVFS_F0_0 (1703000) // KHz
#define DVFS_F0_1 (1599000) // KHz
#define DVFS_F0_2 (1508000) // KHz
#define DVFS_F0_3 (1404000) // KHz
#define DVFS_F0_4 (1300000) // KHz
#define DVFS_F1 (1209000) // KHz
#define DVFS_F2 ( 988000) // KHz
#define DVFS_F3 ( 754000) // KHz
#define DVFS_F4 ( 497250) // KHz
I think I don't need to change de voltage as it is already set to the max supported by the Kernel.
I don't have problems with overheating or extreme battery drain, as I have the CPU Master Pro app and when the screen is off or he is overheating it sets to 500MHz x4.
I want to OC the GPU too, but I can't find the line to change te clock in the MT6589_kernel_source/mediatek/platform/mt6589/kernel/core/mt_gpufreq.c file.
I already built the Kernel in Debian OS succefully, but now I don't know how to put to .img to flash it!
Anyone can build the Kernel and publish it or just tell me what must I do?
EDIT: I just want to be able to play Real Racing 3 at 960p. I only get a great performance at standard FWVGA resolution and if I set 960x1708 @ 390 DPI screen the performance is very good except in Real Racing 3 and other graphical intense games.
Best regards,
Ivan Santos.
Click to expand...
Click to collapse
Any news? A Kernel upload could help you and the community.
However. Read this http://forum.xda-developers.com/showthread.php?t=1748297
This helped me to recompile a GNex Kernel... added missing SmartassV2 :laugh:
IvanSantosPT said:
I only get a great performance at standard FWVGA resolution and if I set 960x1708 @ 390 DPI screen the performance is very good except in Real Racing 3 and other graphical intense games.
Best regards,
Ivan Santos.
Click to expand...
Click to collapse
Wow, how you can that? 960x1708 @390 DPI.... can you spend a little more time to explain us how we can? :fingers-crossed:
I have Wiko Stairway with this processor (MT 6589), your kernel will work with my phone ?
Maybe this will help to pack to img:
http://forum.xda-developers.com/showthread.php?t=2364271
---------- Post added at 10:26 AM ---------- Previous post was at 10:15 AM ----------
http://forum.xda-developers.com/showthread.php?t=1587411
I use Virtuous Ten Studio (VTS) you can search XDA for it. Quite popular as it unpacks boot.img, allows edits to ramdisk, and you can swap zimage and pack it back together into a new boot.img
Also, it de-compiles, de-odex, blah blah blah.... Pretty much a 1 stop shop. Runs in windows. Sure beats doing all it from a cmd window!
IvanSantosPT said:
I have a Star S9500 with MTK6589 Cortex-A7 Quad Core @ 1.2GHz with PowerVR SGX544 Single Core.
I have the Kernel Source extracted from an Acer smartphone here:
Ivan Santos.
Click to expand...
Click to collapse
Ivan, I'm curious. You have a Star S9500 device. And you're using kernel source from an Acer smartphone???
Uhm, unless I am mistaken, you really shouldn't use kernel source from a different device, as the results could be bad. Unless the devices are identical and branded under a different name.
I also am searching kernel source for my ExPlay X-Tremer which uses the MTK6589 CPU.
Am quite interested in your results.
MD
Hi
Well, sorry but you cant OC an Mediatek SoC, it doesnt use those freq-values. Its still an mystery how to do it on that brand. since they will never share the FULL sourcecode.
All you will be able to do, by changing that is to display an "value" it will be only Visual, And not actually overclocked.
So just stop wasting your time on that. Will never work
You can also ask varun his also an kernel developer with experience on the MTK platform. Still the answer will be the same.
On an side note, you just build an kernel that will only work on the original acer device, not yours. It doesn't work that way lol
Its not all JUST about having the same SoC, there are other things:
Alps, magnetic sensor, proximity, etc that you need to config on kernel boardconfig to work on your device.
For packing /unpacking, since this is an MTK device, the best tool is Bruno Martins pack and unpack scripts:
forum.xda-developers.com/showthread.php?t=1587411
B.Regards
superdragonpt said:
Hi
Well, sorry but you cant OC an Mediatek SoC, it doesnt use those freq-values. Its still an mystery how to do it on that brand. since they will never share the FULL sourcecode.
All you will be able to do, by changing that is to display an "value" it will be only Visual, And not actually overclocked.
So just stop wasting your time on that. Will never work
You can also ask varun his also an kernel developer with experience on the MTK platform. Still the answer will be the same.
On an side note, you just build an kernel that will only work on the original acer device, not yours. It doesn't work that way lol
Its not all JUST about having the same SoC, there are other things:
Alps, magnetic sensor, proximity, etc that you need to config on kernel boardconfig to work on your device.
For packing /unpacking, since this is an MTK device, the best tool is Bruno Martins pack and unpack scripts:
forum.xda-developers.com/showthread.php?t=1587411
B.Regards
Click to expand...
Click to collapse
Exactly, not to mention trying to install a kernel meant for another device could have disastrous results...
As far as Full kernel source, I'm not even sure if the device manufacturers even have it. I suppose a lot of these devices are just "re-branded" clones, as I have been getting nowhere in answer on anything from Ex-Play, even citing GPL and such. "Somebody" has it, as 2 other ROMs (MIUI and Lewa) have 2 available ROMs, but I would guess they use the same zimage, considering they run the same OS version.
With the source, could check freq tables, and see if they use a speedo id that can be faked. But without current source, just don't know.
Still searching for the elusive kernel source
Moscow Desire said:
Exactly, not to mention trying to install a kernel meant for another device could have disastrous results...
As far as Full kernel source, I'm not even sure if the device manufacturers even have it. I suppose a lot of these devices are just "re-branded" clones, as I have been getting nowhere in answer on anything from Ex-Play, even citing GPL and such. "Somebody" has it, as 2 other ROMs (MIUI and Lewa) have 2 available ROMs, but I would guess they use the same zimage, considering they run the same OS version.
With the source, could check freq tables, and see if they use a speedo id that can be faked. But without current source, just don't know.
Still searching for the elusive kernel source
Click to expand...
Click to collapse
All the available kernel sources for the MTK platform can be found on my git:
https://github.com/dragonpt
And from varunchitre15 git:
https://github.com/varunchitre15?tab=repositories
As for OC, it was already tried in the past, yes after moding the kernel freq it shows OC values, but they are only Visual, MTK code is really weird.
About sourcecode, only some OEM's have release those, and it tooked ALOT of efforts for it (Petitions and so on), and all we got was the kernel source of course, and most of it it's NOT buildable (needs some fixs to compile).
As for my OEM, they said, they never got it, lol funny no?
This is one of the most ANTI-GPL, Closed Source Company i ever saw, in these last years...
Also Mediatek uses alot of Hacks on their code, i.e: the compiled zlmage needs an patch on kernel header to boot.
regards
superdragonpt said:
Also Mediatek uses alot of Hacks on their code, i.e: the compiled zlmage needs an patch on kernel header to boot.
regards
Click to expand...
Click to collapse
Thanks Mate. Yeah, looking over the sources, it's quite a mess in there! Tegra3 is so much more in order.
Will have to check my proc, and see which defconfig I use. Seems like a logical place to start. And talk about strange, they use only the Hotpug governor, although it seems several are available, but clearly they aren't set up for the device correctly as only Hotplug works, and the other configs have horrible performance.
Cheers
Moscow Desire said:
Thanks Mate. Yeah, looking over the sources, it's quite a mess in there! Tegra3 is so much more in order.
Will have to check my proc, and see which defconfig I use. Seems like a logical place to start. And talk about strange, they use only the Hotpug governor, although it seems several are available, but clearly they aren't set up for the device correctly as only Hotplug works, and the other configs have horrible performance.
Cheers
Click to expand...
Click to collapse
If you wanna start kernel compiling in this platform, the usuall config.gz wont work, if you are lucky enought you may find some old configs on kernel source code, then the "make oldconfig" should work, if the source doesnt have it then it will be an pain in the a## to compile.
Also some tips:
MTK kernels usually compile only with linaro toolchain 4.6.x or less, higher that this and its gonna be an mess with alot of compiler errors.
About the govs, yes on my tab(6589 soc) seems that the hotplug is the only one working ok, the other 2 govs seems that are only using the first 2 cores.
On the boardconfig, you can add several other govs, and IO,s, but i never add those, i may try that in the future and check if those extra govs work ok.
Regards
superdragonpt said:
If you wanna start kernel compiling in this platform, the usuall config.gz wont work, if you are lucky enought you may find some old configs on kernel source code, then the "make oldconfig" should work, if the source doesnt have it then it will be an pain in the a## to compile.
Also some tips:
MTK kernels usually compile only with linaro toolchain 4.6.x or less, higher that this and its gonna be an mess with alot of compiler errors.
About the govs, yes on my tab(6589 soc) seems that the hotplug is the only one working ok, the other 2 govs seems that are only using the first 2 cores.
On the boardconfig, you can add several other govs, and IO,s, but i never add those, i may try that in the future and check if those extra govs work ok.
Regards
Click to expand...
Click to collapse
Thanks for the tip on the toolchain. I usually use Google's latest. Never installed linaro as I really haven't seen a lot of difference in other testing comparisons. Generates a bunch of errors, but usually on things not specific to my device. Sloppy programming I guess.My guess is it's up to the device manufaturers responsibility to clean up the code.
Cheers
i am interested in under-voltage! very useful for battery time
I will be really happy is someone explains to me how can i overclock my mt6589?
chenrp said:
i am interested in under-voltage! very useful for battery time
Click to expand...
Click to collapse
Check Varun's Git sources, it's there...
rdlegy said:
I will be really happy is someone explains to me how can i overclock my mt6589?
Click to expand...
Click to collapse
There's nothing to explain at this point. It simply CAN'T be Overclocked, Mediatek Code isn't the same as (i.e)Qualcomm ...
(It's so Messy --...)
Regards
mtk and spd are the two biggest chinese chip companies that don't provide source code, you won't be able to modify your device except root it for some work

Help to overclock the cpu msm8974ab

** - I'm using mobile devices using Snapdragon 801 msm8974ab
- I changed the code in the kernel opensource path:
arch / arm / boot / dts package but when I overclock kernel has yet been ./. So I ask you to revise the opensource code file in the kernel to get overclocking on this chip
Sorry for my english is not fluent ./. Looking forward to receiving your reply !!

Retrieve complete soc name on Android

Hello,
I try to retrieve complete soc name programmatically on an Android device like it made on CPU-Z app for example that displays for my device :
Qualcomm Snapdragon 600 @ 1.89Ghz / Architecture : Krait 300 / Model : APQ8064T
Click to expand...
Click to collapse
By reading /proc/cpuinfo file and /sytem/build.prop I could have the following data :
Board : MSM8960 / Manufacturer : qcom
Click to expand...
Click to collapse
I can also find CPU max clock.
But, it's impossible to me to get the same information that CPU-Z displays programmatically. Do you know how the app makes that ?
For example, where it finds Soc Architecture and Model ?
And then, to get complete name as Qualcomm Snapdragon 600, how they make that ? It's written somehow ? Or, they have a sort of database with board id and manufacturer with complete informations associated ?
Thanks for your answers.
Sylvain
Any ideas ?

Categories

Resources