Aftermarket display - no boot in custom ROM - Android Q&A, Help & Troubleshooting

Hello,
I have problem with my Lenovo P1m. After changing unresponsive screen with aftermarket one, phone is not booting. To be explicitly specific, phone is booting OEM ROM correctly, but I was using custom ROM of LineageOS 14.1 before screen replacement and now it is not working. My problem is - I can compile my own kernel with different screen drivers / options / etc as I am familiar with linux kernel itself, BUT - how do I debug bootloop, when the only thing I can dig from phone via TWRP recovery is following line from /proc/last_kmsg which, honestly, tells me nothing
Code:
ram console header, hw_status: 2, fiq step 0.
(previously, I got some error message about wrong kernel header as I was trying to compile kernel myself, but this is solved now - but no luck with bootloop either)
Scenario is like this: after power on, I have vibration and normal white Android screen, which if normal boot, is followed by animation and OS welcome. But now, the screen after is black, and after few seconds everything starts from begining - vibration, white android screen etc...
I cannot use adb at all, as it is not catching the phone in this situation, probably kernel is failing before adbd itself starts. I am using TWRP to extract /proc/last_kmsg but as mentioned before, no usable information.
Is there any other way to get kernel messages from boot process? (It would be besto to have something like dmesg output)

So, I see that nobody knows or wants to help, so I helped myself. Made cable as seen here: h t t p: // w w w .stevenhoneyman.co.uk/2014/11/mtk-mediatek-debug-cable.html
And now I at least have serial console. BUT - all output ends exactly when kernel is loaded. Any ideas how to get verbose output from kernel to uart? I tried to add printk.disable_uart=0 ignore_loglevel into commandline arguments for kernel, but no luck.
End of console output looks like:
Code:
[5940] [PROFILE] ------- boot_time takes 3053 ms --------
[LK_ENV]get_env hibboot
[LK_ENV]get_env resume
[5940] booting linux @ 0x40080000, ramdisk @ 0x44000000 (1611013)
[5940] [LEDS]LK: leds_deinit: LEDS off
[5940] [LEDS]LK: red level is 0
[5940] [LEDS]LK: green level is 0
[5940] [LEDS]LK: PMIC Type: 7, Level: 0
[5940] [LEDS]LK: blue level is 0
[5940] DRAM Rank :2
[5940] DRAM Rank[0] Start = 0x40000000, Size = 0x40000000
[5940] DRAM Rank[1] Start = 0x80000000, Size = 0x3ffc0000
[5940] cmdline: console=tty0 console=ttyMT0,921600n1 root=/dev/ram vmalloc=496M androidboot.hardware=mt6735 slub_max_order=0 slub_debug=O bootopt=64S3,32N2,64N2 androidboot.selinux=permissive buildvariant=userdebug printk.disable_uart=0 ignore_loglevel lcm=1-ili
[5940] lk boot time = 3053 ms
[5940] lk boot mode = 0
[5940] lk boot reason = wdt_by_pass_pwk
[5940] lk finished --> jump to linux kernel 64Bit
[5940]
[LK]jump to K64 0x40080000
[5940] smc jump

Key to get kernel boot output was finally in console on ttyMT1 instead of ttyMT0 (console=ttyMT1,921600n1)and also nousb parameter, so usb port will not switch to real usb during boot and remains uart. Now, I have found out that my kernel is missing some LCM driver, which was then re-compiled and now I have to find out what else is wrong...

Running out of ideas. Phone boots with old broken OEM display. If I connect new aftermarket display, it bootloops. Kernel logs attached for every case: old display, new display. Any ideas what goes wrong with new display?
NEW: https://pastebin.com/Ewz8FF5h
OLD: https://pastebin.com/CjtmA0aB

Code:
[ 14.143167] (0)[1:swapper/0][FTS] Step 1:Reset CTPM
[ 14.243788] (0)[1:swapper/0]hidi2c_to_stdi2c successful.
[ 14.263168] (0)[1:swapper/0][FTS] Step 2:Enter upgrade mode
[ 14.313857] (0)[1:swapper/0][FTS] Step 3: CTPM ID,ID1 = 0x0,ID2 = 0x0
[ 14.314917] (0)[1:swapper/0]ft5x0x 1-0070: [FTS] Step 3 fail: CTPM ID,ID1 = 0x0,ID2 = 0x0, 0x54, 0x2c:
[ 14.423169] (0)[1:swapper/0][FTS] Step 1:Reset CTPM
[ 14.473714] (0)[1:swapper/0]hidi2c_to_stdi2c successful.
[ 14.493166] (0)[1:swapper/0][FTS] Step 2:Enter upgrade mode
[ 14.543852] (0)[1:swapper/0][FTS] Step 3: CTPM ID,ID1 = 0x0,ID2 = 0x0
[ 14.544707] (0)[1:swapper/0]ft5x0x 1-0070: [FTS] Step 3 fail: CTPM ID,ID1 = 0x0,ID2 = 0x0, 0x54, 0x2c:
[ 14.653167] (0)[1:swapper/0][FTS] Step 1:Reset CTPM
THIS is the reason of problems. When I deconfigure FT5446 driver from kernel, system boots without problems. Only thing is that touchscreen is inoperative because of disabled driver. How to debug this issue?

I have resolved this issue for me. Hardcode-edited driver for FT5446 IC touchscreen to workaround firmware upgrade checking. Now I have operational P1m with aftermarket display under LOS 14.1 on 3.18.19 kernel. If anybody interested, here is boot.img for darklords LOS14.1 ROM lineage-14.1-20171119_095733-UNOFFICIAL-P1m.zip but I think it will work also for his other versions
https://uloz.to/!cuEWkiCv9flq/boot-img

can you share the changes you made to the kernel source
i have compared some changes that you shared , they can be seen in here

Related

[Q] HTC Polaris hangs kernel 2.6.32 when Haret installing Android

Hello)
Sorry for my english)
Help me, please, install android on my device HTC Touch Cruise (Polaris 100)
WM 6.1 OS official, Radio 1.65.38.14, ROM version 3.13.411.0 RUS, protocol version 25.111.40.09H
POLA100 MFG, SPL-2.20.OliNex, CPLD-2
Was the replacement of the display and touchscreen
I did everything according to the instructions
sourceforge.net/apps/trac/androidhtc/wiki/HowToInstallWithAtoolsHaret
With Atool download the latest zImage 2.6.32, similarly downloaded initrd.lzma
Then place them, as well as startup.txt and androidinstall.tgz andboot folder on the memory card
Contents of the file startup.txt:
Code:
set RAMSIZE 0x08000000
set MTYPE 1723
set KERNEL zImage
Set initrd initrd.lzma
set cmdline "board-htcpolaris.panel_type = 3 pm.sleep_mode = 1 mddi.width = 240 mddi.height = 320 lcd.density = 120 no_console_suspend board-htcpolaris-battery.battery_capacity = 1350 clock-7x00.mddi = 0xa51 ppp.nostart = 1 hw3d.version = 0 "
boot
board-htcpolaris.panel_type = 3, because other parameters did not work: 1 - wrong color palette, 2 - get black / white zebra
If you take the zImage 2.6.25, then for any issues panel_type screen "broken TV"
Run Haret, phone reboots, vibrates twice, shows a penguin, start running log lines on the screen and stops at:
Code:
adb_bind_config
TSC2003
fake_vsync_int
_
Loader must reach the request by pressing the center button to enter the setup menu, but they do not
Maybe someone faced with such a case, what could be the problem?
Who has any ideas?
Thank you in advance for your help!
Thank you!

Archos 101 g9 8gb & Huawei modem E173u-1[No driver found]

Hi, I am having issues with a Huawei modem E173u-1 on my tablet Archos 101 g9 8gb
driver not found.
Can you help me, pls?
USB_ModeSwitch log from Wed Apr 09 17:50:44 PKT 2014
Raw args from udev: 1-1/1-1:1.0
Using top device dir /sys/bus/usb/devices/1-1
----------------
USB values from sysfs:
manufacturer HUAWEI
product HUAWEI Mobile
serial
----------------
bNumConfigurations is 1 - don't check for active configuration
SCSI attributes not needed, moving on
checking config: /data/data/de.draisberghof.pppwidget/app_tmp/12d1.14fe
! matched. Reading config data
devList 1:
config: TargetVendor set to 12d1
config: TargetProduct set to 1506
Driver module is "option", ID path is /sys/bus/usb-serial/drivers/option1
Logger is: /system/bin/log
Command to be run:
usb_modeswitch -I -W -D -s 20 -u -1 -b 1 -g 2 -v 12d1 -p 14fe -f $cB
Verbose debug output of usb_modeswitch and libusb follows
(Note that some USB errors are to be expected in the process)
--------------------------------
Reading long config from command line
* usb_modeswitch: handle USB devices with multiple modes
* Version 1.2.4 (C) Josua Dietze 2012
* Based on libusb0 (0.1.12 and above)
! PLEASE REPORT NEW CONFIGURATIONS !
DefaultVendor= 0x12d1
DefaultProduct= 0x14fe
TargetVendor= 0x12d1
TargetProduct= 0x1506
TargetClass= not set
TargetProductList=""
DetachStorageOnly=0
HuaweiMode=0
SierraMode=0
SonyMode=0
QisdaMode=0
GCTMode=0
KobilMode=0
SequansMode=0
MobileActionMode=0
CiscoMode=0
MessageEndpoint= not set
MessageContent="55534243123456780000000000000011062000000100000000000000000000"
NeedResponse=0
ResponseEndpoint= not set
InquireDevice disabled
Success check enabled, max. wait time 20 seconds
System integration mode enabled
Use given bus/device number: 001/002 ...
Looking for default devices ...
bus/device number matched
searching devices, found USB ID 12d1:14fe
found matching vendor ID
found matching product ID
adding device
Found device in default mode, class or configuration (1)
Skipping the check for the current configuration
Using interface number 0
Using endpoints 0x01 (out) and 0x81 (in)
USB description data (for identification)
-------------------------
Manufacturer: HUAWEI
Product: HUAWEI Mobile
Serial No.: not provided
-------------------------
Looking for active driver ...
OK, driver found; name unknown, limitation of libusb1
OK, driver "unkown" detached
Setting up communication with interface 0
Using endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
OK, message successfully sent
Resetting response endpoint 0x81
Could not reset endpoint (probably harmless): -34
Resetting message endpoint 0x01
Could not reset endpoint (probably harmless): -6
Device is gone, skipping any further commands
Bus/dev search active, referring success check to wrapper. Bye.
ok:busdev
--------------------------------
(end of usb_modeswitch output)
Checking success of mode switch for max. 20 seconds ...
Waiting for device file system (1 sec.) ...
Waiting for device file system (2 sec.) ...
Waiting for device file system (3 sec.) ...
Waiting for device file system (4 sec.) ...
Waiting for device file system (5 sec.) ...
Waiting for device file system (6 sec.) ...
Waiting for device file system (7 sec.) ...
Reading attributes ...
Mode switch has completed
Mode switching was successful, found 12d1:1506 (HUAWEI: HUAWEI Mobile)
Device class of first interface is ff
Now checking for bound driver ...
No driver has bound to interface 0 yet
Module loader is /sbin/insmod
Trying to find and install main driver module "option"
Trying to find module "option"
Loading support module /lib/modules/usb_wwan.ko
Error: insmod: cannot insert '/lib/modules/usb_wwan.ko': Invalid module format (-1): Exec
format error
Loading main driver module "option"
Error: insmod: cannot insert '/lib/modules/option.ko': Invalid module format (-1): Exec
format error
Falling back to "usbserial"
Module "usb_serial" not found, can't do more here
Driver binding seems to have failed
All done, exiting
please answer!!!
i'm solved the problem by replacing the nucleus

Bricked Huawei HiSilicon phones - Honor P6, Mate, 4C etc... way to unbrick???

Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㄰㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
This board is base around the HiSilicon Kirin 6220 eight-core ARM Cortex-A53 64-bit SoC running at 1.2GHz and delivering over 10,000 Dhrystone VAX MIPS total performance. The SoC also delivers high performance 3D graphics support with its ARM Mali 450-MP4 GPU.
1GB 800MHz LPDDR3 DRAM, 4GB eMMC Flash Storage and the standard 96Boards microSD v3.0 socket provide high performance. Flexible storage options and connectivity are available through 802.11a/b/g/n WiFi, Bluetooth 4.0 LE, three high speed USB 2.0 ports (1 OTG), an HDMI 1.3 1080p video output with audio, and Maker, DSI display and CSI camera interfaces. The board is the standard 96Boards credit-card form factor powered by an 8-18V DC 2A power supply.
Click to expand...
Click to collapse
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
i have same problem pleas tell me if you fix it
michfood said:
Noone intersted in?
I`ve found UART Rx Tx points on the motherboard and now I can get some debug info.
I see I can load images into RAM but...
Code:
debug EMMC boot: print init OK
debug EMMC boot: send RST_N .
debug EMMC boot: start eMMC boot......
OnChipRom: fastboot1 Verif sucess !
[BDID]boardid: 745 <7.4.5>
battery ocv is 4141 mv
�����������������������������������������������������壂�{��?O
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f��B�rreset device done.
start enum.
enum done intr
Enum is starting.
usb reset intr
enum done intr
NULL package
NULL package
USB ENUM OK.
init ser device done....
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
USB:: Err!! Unknown USB setup packet!
NULL package
uFileAddress=ss=f9800800
start armboot download mode
[BDID]boardid: 745 <7.4.5>
battery 펟v���W�����ʝcn�g������
H�����������w!!I㡡�v�J�ơ�����硾�B����9�F�F�$�/"�0D�c���������f��B���B�f���gc姾����fB�ʔ
thats all for a while
Click to expand...
Click to collapse
Hello, can you uload somewere the python file to have a look at it? Also the log you have provided to us it's the whole log?
no the log is not full.
it changes UART speed while booting.
script:
Code:
#!/usr/bin/python
#-*- coding: utf-8 -*-
import os
import os.path
import serial, time
import array
import sys, getopt
class bootdownload(object):
'''
Hisilicon boot downloader
>>> downloader = bootdownload()
>>> downloader.download(filename)
'''
# crctab calculated by Mark G. Mendel, Network Systems Corporation
crctable = [
0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,
0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,
0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,
0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,
0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,
0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,
0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,
0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,
0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,
0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,
0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,
0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,
0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,
0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,
0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,
0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,
0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0,
]
startframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
headframe = {
'hi3716cv200':[0xFE,0x00,0xFF,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x02,0x01]
}
bootheadaddress = {
'hi3716cv200':0xF9800800
}
bootdownloadaddress = {
'hi3716cv200':0x07000000
}
BOOT_HEAD_LEN = 0x4F00
MAX_DATA_LEN = 0x400
def __init__(self,chiptype,serialport):
try:
self.s = serial.Serial(port=serialport, baudrate=115200, timeout=1)
except serial.serialutil.SerialException:
#no serial connection
self.s = None
print "\nFailed to open serial!", serialport
sys.exit(2)
self.chip = chiptype
def __del__(self):
if self.s != None:
self.s.close()
def calc_crc(self, data, crc=0):
for char in data:
crc = ((crc << 8) | ord(char)) ^ self.crctable[(crc >> 8) & 0xff]
for i in range(0,2):
crc = ((crc << 8) | 0) ^ self.crctable[(crc >> 8) & 0xff]
return crc & 0xffff
def getsize(self, filename):
st = os.stat(filename)
return st.st_size
def sendframe(self, data, loop):
for i in range(1, loop):
self.s.flushOutput()
self.s.write(data)
self.s.flushInput()
try:
ack = self.s.read()
if len(ack) == 1:
if ack == chr(0xaa):
return None
except:
return None
print 'failed'
def sendstartframe(self):
self.s.setTimeout(0.01)
data = array.array('B', self.startframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,10000)
def sendheadframe(self,length,address):
self.s.setTimeout(0.03)
self.headframe[self.chip][4] = (length>>24)&0xff
self.headframe[self.chip][5] = (length>>16)&0xff
self.headframe[self.chip][6] = (length>>8)&0xff
self.headframe[self.chip][7] = (length)&0xff
self.headframe[self.chip][8] = (address>>24)&0xff
self.headframe[self.chip][9] = (address>>16)&0xff
self.headframe[self.chip][10] = (address>>8)&0xff
self.headframe[self.chip][11] = (address)&0xff
data = array.array('B', self.headframe[self.chip]).tostring()
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddataframe(self,seq,data):
self.s.setTimeout(0.15)
head = chr(0xDA)
head += chr(seq&0xFF)
head += chr((~seq)&0xFF)
data = head + data
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,32)
def sendtailframe(self,seq):
data = chr(0xED)
data += chr(seq&0xFF)
data += chr((~seq)&0xFF)
crc = self.calc_crc(data)
data += chr((crc >> 8)&0xff)
data += chr(crc&0xff)
self.sendframe(data,16)
def senddata(self, data, address):
length=len(data)
self.sendheadframe(length,address)
seq=1
while length > self.MAX_DATA_LEN:
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:seq*self.MAX_DATA_LEN])
seq = seq+1
length = length-self.MAX_DATA_LEN
self.senddataframe(seq,data[(seq-1)*self.MAX_DATA_LEN:])
self.sendtailframe(seq+1)
def download(self, filename1, filename2):
f=open(filename1,"rb")
data = f.read()
f.close()
print 'Sending', filename1, '...'
self.senddata(data,self.bootheadaddress[self.chip])
print 'Done\n'
if filename2:
f=open(filename2,"rb")
data = f.read()
f.close()
print 'Sending', filename2, '...'
self.senddata(data,self.bootdownloadaddress[self.chip])
print 'Done\n'
def burnboot(chiptype, serialport, filename1, filename2=''):
downloader = bootdownload(chiptype, serialport)
downloader.download(filename1, filename2)
def startterm(serialport=0):
try:
miniterm = Miniterm(
serialport,
115200,
'N',
rtscts=False,
xonxoff=False,
echo=False,
convert_outgoing=2,
repr_mode=0,
)
except serial.SerialException, e:
sys.stderr.write("could not open port %r: %s\n" % (port, e))
sys.exit(1)
miniterm.start()
miniterm.join(True)
miniterm.join()
def main(argv):
'''
img2 = 'fastboot2.img'
'''
img1 = 'fastboot1.img'
img2 = ''
dev = '/dev/serial/by-id/usb-䕇䕎䥎_㄰㌲㔴㜶㤸-if00-port0'
try:
opts, args = getopt.getopt(argv,"hd:",["img1=","img2="])
except getopt.GetoptError:
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit(2)
for opt, arg in opts:
if opt == '-h':
print 'hisi-idt.py -d device --img1 <fastboot1> --img2 <fastboot2>'
sys.exit()
elif opt in ("-d"):
dev = arg
elif opt in ("--img1"):
img1 = arg
elif opt in ("--img2"):
img2 = arg
print '+----------------------+'
print ' Serial: ', dev
print ' Image1: ', img1
print ' Image2: ', img2
print '+----------------------+\n'
if not os.path.isfile(img1):
print "Image don't exists:", img1
sys.exit(1)
if (img2):
if not os.path.isfile(img2):
print "Image don't exists:", img2
sys.exit(1)
burnboot('hi3716cv200', dev, img1, img2)
if __name__ == "__main__":
main(sys.argv[1:])
logs:
Code:
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cb0, hpm_dly_exit = 0x00000cf6!
prof[960000]: hpm_dly_exp = 0x00000cb6, hpm_dly_exit = 0x00000cfc!
prof[1200000]: hpm_dly_exp = 0x00000e94, hpm_dly_exit = 0x00000eda!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������0
===>vbus_is_high!
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000caf, hpm_dly_exit = 0x00000cf5!
prof[960000]: hpm_dly_exp = 0x00000cb5, hpm_dly_exit = 0x00000cfb!
prof[1200000]: hpm_dly_exp = 0x00000e90, hpm_dly_exit = 0x00000ed6!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: no valid data in buffer , (sig = 0x43474244)
[emmc_set_card_ready]emmc id:0xb64432c9 0x520644c1 0x474e4433 0x15010038
[emmc_set_card_ready]manufid: 0x00000015
DDR mode emmc
--error: gps/ldo16
[SEC]check_oem_hw: carrier_id = 0x00000000
DX_BIV_SwImageVerification image id is 0x00000011, return is 0xf1000002 !
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
Load fastboot2 failed!
hw_error_print : led = 12. func = 0. err = 0.
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
[fastboot]:k3_led_green_on
enter fatal_exception!
Unrecovery Error, go to onchiprom usbloader!
USB Soft Disconnect
��������������������������������������������������������������������������������������������������������������������������́v
nUpdate debug uart baudRate to :921600
===>vbus_is_high!
fastboot1 download_mode:1
fastboot1 charger_type:CHARGER_TYPE_PC
get_hw_config_int,hw_afreq:1200000.
get_efuse_value,efuse ATE_flag temp:0x0af00000.
ATE PASS,ate flag value:0x00000001.
get_efuse_value,efuse acpu_freq change level:0x8e186100.
get_efuse_value,efuse afreq change level val:0x00000000.
get_efuse_value,efuse acpu_freq level:0x8e186100.
get_efuse_value,efuse acpu freq sys level:0x00000000.
###INFO###,soc_freq = hw_afreq, efuse_afreq:1200000,hw_afreq:1200000.
efuse ACPU 1.4G HPM:0.
efuse ACPU 1.2G HPM:0.
efuse ACPU 960M HPM:0.
fastboot: acpu_dvfs_init successful!
begin get voltage by hpm...
prof[729000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[960000]: hpm_dly_exp = 0x00000cad, hpm_dly_exit = 0x00000cf3!
prof[1200000]: hpm_dly_exp = 0x00000e88, hpm_dly_exit = 0x00000ece!
acpu support freq num:5
volt:0x0000004a 0x0000004a 0x0000004a 0x0000004a 0x00000057
acpu_get_dvfs_volt,g_afreq_max_pro is :5��acpu max freq:1200000.
#### success !!!!! set_acpu_freq: acpu support freq num is 5 and start is 4 .
get_ddr_type 1; (lpddr2: 0; lpddr3: 1)
pass the func addr: [0xfff81b10]: 0xf980d044ddr_init(): get_ddr_type: 1
ddr freq: 800000
in lpddr3_init: mode: 0; freq_config: 800
switch ddr voltage: 1.25V -> 1.2V
lpddr3_init 150
lpddr3_150_rank0_init_pass
lpddr3_150_rank1_init_pass
lpddr3_init 266
lpddr3_266_rank0_init_pass
lpddr3_266_rank1_init_pass
lpddr3_init 400
lpddr3_400_rank0_init_pass
lpddr3_400_rank1_init_pass
switch ddr voltage: 1.2V -> 1.25V
lpddr3_init 533
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_533_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_533_rank1_init_pass
lpddr3_init 800
lpddr3_rank0_phydraminit_pass
lpddr3_cat_pass
lpddr3_800_rank0_init_pass
rdet_lbs_passrdet_ds_passrdet_rbs_av_passwdet_lbs_passwdet_ds_passwdet_rbs_av_passlpddr3_800_rank1_init_pass
ERROR: tmp_freq: 0
tmp_freq: 400000
MR8 value=:0x0000005b
MR5 value=:0x00000001
Samsung DDR
MR6 value=:0x00000004
MR5 value=:0x00000000
[MR7,MR6,MR5]=:0x00000401
ddr init pll1 0x00007800!ddrc_qos_init done
bootloader_logger got buffer at 0x07300000, size 0x00040000
bootloader_logger: found existing buffer, size 1044, addr 24
USB_DOWNLOAD_MODE
timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
uFileAddress=ss=07000000
uFileAddress=ss=07000000
image verify failed!
@michfood hmm okay i had a look. As i can understand your phone doesn't accept the second fastboot.img. I don't think that the problem is the crctable. Maybe you have a wrong fastboot.img?? Try to get a new dump from an another phone.
If your image it's an original dump then there is no reason why it fails to pass the check. The reason why i think the crc signature it's correct it is because you are able to download both images(i saw more details in 96boards forum).
the second image do not start.
after loading first - it says:
"timestamp: 0xfff2c982
return from fastboot1!
uFileAddress=ss=07000000
image verify failed!"
so it is returned from fastboot1 to onchip loader and tries to load second image - but fails.
have no possibility to look normal boot as all phones are under guaranty - nobody want to solder uart pins
Actually i didn't said to you to look at a normal boot uart log. In a normal boot you'll just see the kernel booting. Maybe you second fastboot.img is faulty...
the second boot is correct - from the update.app, as the first one
there is a thought that message "image verify failed" is an onchip loader message after fastboot2 loads, runs, made some checks of other partitions (broken) (with no UART messages) and exits with some error code.
here we can see difference between boot from eMMC (left) and boot from RAM (right)
http://clip2net.com/s/3mFVeRi
No, i think fastboot2 doesn't boot at all. Look at ths:
Code:
execute_load_fastboot2: In secure mode and fastboot2 verify failed!
If you try to load only one fastboot.img? what happens?
you just look at log booting from emmc. while booting from ram - no such message.
and once more - after loading first fastboot to RAM it exits with message "return from fastboot1" and tries to load second file to RAM. read carefully
I've got a honor 4x which uses the same chipset. Mine is also bricked but loads into Fastboot&rescue mode, which does not allow me to update the fastboot image due to a signature verify problem (BL31 image). This is related to ARM Trusted Firmware. Also, it does not load a new update.app from the SDCARD - Simply hangs on the logo screen. Therefore, I need to force it to flash a new fastboot.img. I read the HiKey user guide, and noticed there's a J15 SEL jumper, where, when closed, will attempt to program the flash from USB OTG source. Before a pull my phone apart, I would like to know whether anybody has tried flashing a new fastboot.img via USB OTG via closing the J15 SEL jumper and whether it worked. Or if there's any other way to boot my own fastboot.img
some info. i`m looking for motherboard on ali.. have no success
Same problem
michfood said:
Hi people.
I have new bricked Huawei Honor 4c with HiSilicon Kirin 620 octacore (Hi6620) Hardly bricked.
I`ve unlocked bootloader and custom recovery used to flash it with my own update.zip from other phone (with LTE support). At the end of flashing - it turned off and bricked.
BUT! After connecting to PC via USB it flashes GREEN and RED leds a few times and after windows determines it as a device with USB\VID_12D1&PID_3609&REV_0000 and named as 䕇䕎䥎 ㄰㌲㔴㜶㤸 .
It is Huawei`s VID. And after a lot of search I found a driver for it - and device became HUAWEI USB-COM 1.0. But nothing else.
No flash utility, nothing. HiSilicon-IDT for K3 processor doesn`t work.
After another searches I found very similar device - it`s named HiKey board. Based on Hisilicon Kirin processor too https://www.96boards.org/.
As we can see - it is very close to ours phone.
It is fully documented and has a lot of spec about proc and other.
And in it`s manual written about recovery procedure after damage of ROM - when device is powered on - it is in "download mode" for 90 seconds - abslolutly like mine phone - after 90 second it turns off from windows.
In short - it is ability to write 2 fastboot images (fastboot1.img and fastboot2.img) in RAM, launch them and using fastboot command flash images to eMMC. They use SERIAL COM PORT to manipulate with device.
It uses utility called "hisi-idt.py" - it is a python script for Linux based machines.
I`ve Installed Linux Mint and try it.
And I`ve some result - first image is going fine and I receive "Done"
But second image is always "Failed". And fastboot command "fastboot devices" do not list any devices.
Viewing binaries from my ROM (Fastboot.img and Fastboot1.img) in HEX - I can see load addresses to ROM are the same as in python script. It is 0xf9800800 and 0x0700000 for both images.
But.... have no success. It looks like I`m close to the goal.
Any ideas?
Click to expand...
Click to collapse
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
JackLenz said:
Hi,
I'm stucked in the same hard brick. Could you provide a download link for the driver you found?
Are there news about progresses with this issue?
Thank you very much, I'll try to help if you want
Click to expand...
Click to collapse
still nothing
zhaozihanzzh said:
In China,Hisilicon Kirin 620 is hi6210,not 6620.You can get the source code of HUAWEI Honor 4C from:http://emuirom123.dbankcloud.com/Cherrymini_kernel_[Android 5.1 EMUI3.1].tar.gz?rid=1520
It is for the China Mobile version(CHM-TL00H) with Kirin 620.
Chinese version Kirin 620 runs 8×A53 1.2GHz cores and ARM Mali-450 MP4 Gpu.The baseband of hisilicon kirin 620 is Balong V8R1SFT.
Sorry for my bad English.
来自搭载Android 2.3 GingerBread的华为Y220-T10
Click to expand...
Click to collapse
thanks for info - but how it helps?
michfood said:
still nothing
Click to expand...
Click to collapse
And what about the driver link?
I found some source code on github, maybe it could be useful
https://github.com/muhammadfahadbaig/android_vendor_huawei_hi6210sft

P760 Brick. Only fastboot work (example by omap4boot-for_optimus-v1.21)

Hi.
Similar problem like here: http://forum.xda-developers.com/showthread.php?t=2334337
I am fighting with this phone two days.
In the first phase ( 18h ago) i connected by omap4boot and tried this - http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20
next i did all wipes, i tried by cwm install this rom - u2_v20o_signed_022314_123556.zip
I thought all is good, but ofc still was logo LG.
Anyone LG FLash tool didnt work (i will explain it with screens after, when will can run into S/W mode)
I tried this http://forum.xda-developers.com/showthread.php?t=2292828
and i had very weird error:
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
reading ASIC ID
usb_write 4
usb_read 81
[*] read 0 bytes
NumOfSubblocks: 0x5
Subblock ID: 0x1
Subblock Size: 0x5
CH enabled: 0x7
ROM revision: 0x4
Checksum Subblock: 0x15
CHIP: 4430
IDEN: b1a3cecb3e5a097ee4d9313e2070f8863ca117f3
MPKH: 5f4092eccddf90fa43f546adf89508b31b9c74795e9516194c0ea6412fdcb7f6
CRC0: 9c669ad9
CRC1: 682adccf
sending 2ndstage to target... f0030002
usb_write 4
usb_write 4
wait 5-lelelel...
[*] msg size = 4
usb_write 21552
[*] data size = 21552
usb_close
Reopen usb...
Device descriptor:
bLength = 18
bDescriptorType = 1
bcdUSB = 528
bDeviceClass = 255
bDeviceSubClass = 255
bDeviceProtocol = 255
bMaxPacketSize0 = 64
idVendor = 451
idProduct = D00F
bcdDevice = 0
iManufacturer = 33
iProduct = 37
iSerialNumber = 0
bNumConfigurations = 1
waiting for 2ndstage response...
usb_read 4
usb read = aabbccdd
accepted 2ndstage response
sending image to target...
size = 246272
usb_write 4
usb_write 246272
** Done **
< waiting for device >
sending 'x-loader' (384 KB)...
OKAY [ 0.204s]
writing 'x-loader'...
OKAY [ 2.845s]
finished. total time: 3.050s
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
Done
Click to expand...
Click to collapse
Then i tried all ideas, which came to my head.
(Relock bootloader http://forum.xda-developers.com/showthread.php?p=44580559
p760-twrp-2.6.1-recovery.img
and much other, which i didnt remember...)
Finaly phone is bricking.
Any advices?
Edit:
Yesterday battery had 4.01 V, today has 3.7. I will try charge tomorrow.
Guys, what when i-loaded u-boot, x-loader after like i flashed JB rom by CWM ?
It can explain my current situation?
Look:
It are partiton for JB
View attachment 3762143
It are partition for ICS
View attachment 3762144
So i should now load some loader and boot file from JB?
Can U help me, pls?
I downloaded ICS stock rom. Exctracted it.
I made x-loader from file 0-gpt1.img. (256LBA-1023LBA). It is exactly same what file p1ics760.bin from fastboot by Lelus http://forum.xda-developers.com/showthread.php?t=2292828 )
once again i tried:
fastboot flash x-loader
fastboot flash u-boot
fastboot flash boot
fastboot flash recovery
All files are original from ICS stock rom.
No result.....
works only fastboot mode by software fastboot by Lelus.
Srsly this topic is so boring?
Edit:
Hm... u-boot file from here http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20
is different from mine... x-loader is same like i wrote early...
It weird:
In Fastboot by Lelus - if i use any option between 2 and 7 - i get:
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
So i replaced file:
\fastboot\xu\p2ics760.bin
for original stock u-boot (in second try i replaced u-boot from this link http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20)
(original p2ics760.bin i renamed to p2ics760.bin.old and u-boot.img i renamed to p2ics760.bin
and still is error - Too many links
But when i use:
fastboot flash u-boot u-boot.img - it hasn't error. It is same file!
Maybe the operation is successful, but in real it doesen't change anything? Is it possible?
Groszexxx said:
It weird:
In Fastboot by Lelus - if i use any option between 2 and 7 - i get:
sending 'u-boot' (1024 KB)...
FAILED (status read failed (Too many links))
finished. total time: 107.422s
So i replaced file:
\fastboot\xu\p2ics760.bin
for original stock u-boot (in second try i replaced u-boot from this link http://forum.xda-developers.com/showpost.php?p=39732470&postcount=20)
(original p2ics760.bin i renamed to p2ics760.bin.old and u-boot.img i renamed to p2ics760.bin
and still is error - Too many links
But when i use:
fastboot flash u-boot u-boot.img - it hasn't error. It is same file!
Maybe the operation is successful, but in real it doesen't change anything? Is it possible?
Click to expand...
Click to collapse
If you can enter in lelus fastboot, then flash a recovery wipe partitions and then with the recovery flash a rom....
My english is such bad or u didnt read the all posts? .
I flashed recovery partition much time. Telefon still is dead. Stock recovery, CWM, TWRP.
If I could flash recovery and after could "instal" rom - then it would not be problem .
Groszexxx said:
My english is such bad or u didnt read the all posts? .
I flashed recovery partition much time. Telefon still is dead. Stock recovery, CWM, TWRP.
If I could flash recovery and after could "instal" rom - then it would not be problem .
Click to expand...
Click to collapse
Then, If your L9 doesn't boot, it could be beacause a "IC power Cristal" or other hardware issue like EMM break (Eprom). In some case a box like http://octopusbox.com can solve the problem or in other case extract a log file with the exact issue details
A dead block of flash will produce CRC errors after or during the flash process and random lockups or reboots during operation. And if the fastboot problem strikes, you can issue commands via ADB, but after the necessary reboot there will be the PnP sound loop. If the phone is in Charge-only mode, ADB commands will be ignored, you can issue them, but **** happens.
Was there any positive feedback for the flash commands?
puntoazul said:
Then, If your L9 doesn't boot, it could be beacause a "IC power Cristal" or other hardware issue like EMM break (Eprom). In some case a box like http://octopusbox.com can solve the problem or in other case extract a log file with the exact issue details
Click to expand...
Click to collapse
It can be true. I received similar diagnosis about corrupt emmc. Anyway - for me it is possible but very unlikely (Ofc i havent experience).
lecorbusier said:
A dead block of flash will produce CRC errors after or during the flash process and random lockups or reboots during operation. And if the fastboot problem strikes, you can issue commands via ADB, but after the necessary reboot there will be the PnP sound loop. If the phone is in Charge-only mode, ADB commands will be ignored, you can issue them, but **** happens.
Was there any positive feedback for the flash commands?
Click to expand...
Click to collapse
Maybe i will show it on screens:
I run Fastboot by Lelus and set 2 option.
View attachment 3765116
And i get error:
View attachment 3765119
When i run fastboot by Lelus and set option 1 and type:
fastboot flash recovery 'filename'
View attachment 3765117
EHh, Finaly i think theory with emmc corrupt is are confirming.... after 30-40x flashed now i get one new and one very common error:
View attachment 3765322
View attachment 3765324
I am so sad! . But anyway, i am feeling much better when i know what is wrong with phone.
U-boot gets sent to the phone's RAM, but writing to its appropiate partition fails utterly. That is not necessarily hardware related. And nothing I've seen before. Either the partition got damaged or deleted, or it's in F2FS format. Artas' CM11 uses F2FS, EdwinMoqs CM13 as an option, and TWRP from 2.8.x can format partitions with F2FS.
But D/L mode is almost indestructible, only a bit tricky to invoke. And requires LG drivers. Even if the phone is no longer getting recognized by LG drivers and LG software because of a custom rom, when in D/L mode the LG driver should install a virtual COM port and the LG flash tool should now recognize the phone. Ihad difficulties flashing a KDZ file with LG Fladh Tool 2014,but the tool from the LG site, getting the stock rom directly from the server, works reliably, but it's best to flash twice in a row. If the phone auto-reboots into launcher, it's a success. If you see LG's stock recovery after the flash, flash another time.
Ok. if you run this command: "fastboot flash u-boot u-boot.img" (assuming that the u-boot.img file is for your l9 model), and result is cannot write in partition then EMMC is break (95% probability)
---------- Post added at 09:16 AM ---------- Previous post was at 09:13 AM ----------
lecorbusier said:
U-boot gets sent to the phone's RAM, but writing to its appropiate partition fails utterly. That is not necessarily hardware related. And nothing I've seen before. Either the partition got damaged or deleted, or it's in F2FS format. Artas' CM11 uses F2FS, EdwinMoqs CM13 as an option, and TWRP from 2.8.x can format partitions with F2FS.
But D/L mode is almost indestructible, only a bit tricky to invoke. And requires LG drivers. Even if the phone is no longer getting recognized by LG drivers and LG software because of a custom rom, when in D/L mode the LG driver should install a virtual COM port and the LG flash tool should now recognize the phone. Ihad difficulties flashing a KDZ file with LG Fladh Tool 2014,but the tool from the LG site, getting the stock rom directly from the server, works reliably, but it's best to flash twice in a row. If the phone auto-reboots into launcher, it's a success. If you see LG's stock recovery after the flash, flash another time.
Click to expand...
Click to collapse
Could be... perhaps if use Lg flash tool 2014 in emergency mode... (5% probability but is more than nothing) i hope @Groszexxx can revive his device
and if i was you... i try this... (see attach)
Yes, i talked about octoplus with someone, who has it. I never had anyone box . It is not my job . I was only curious what is it with phone my friend. I spend much hours on this issue. Anyway, i dont regret.
I will send phone to someone, who can flash it by some box like octoplus or jtag.
Thanks for lecorbusier post. I read much post, but this one is new for me.
So - time saying goodbye .
Maybe i will inform what will be next, maybe not ;p. We will see .
Thanks for all!

Lenovo TB-X306F stuck booting to blank recovery

Hello,
I was following some threads regarding flashing Magisk to root this tablet and managed to get it working after some trial and error and recovering with Lenovo's Rescue tool. I did not manage to flash TWRP successfully because there doesn't seem to be any port of it (I tried flashing the port for the X606 series, but didn't work).
I then tried to flash a Lineage GSI following this XDA guide, using the manual process, and after I did the factory reset from the system's UI, the tablet rebooted and is now always stuck on a black screen. Tried to reboot to recovery and bootloader using adb and the physical buttons, to no avail. Then I thought of checking what `adb devices` was reporting, and it turns out it's stuck on the recovery?
Code:
❱ sudo adb devices
List of devices attached
HA1MPS2C recovery
Is there a way to fix this? Or did I screw up somewhere really badly?
Thanks in advance!
Just took a peek with `adb shell` to read the `/tmp/recovery.log` file and found this repeating:
Code:
Starting TWRP 3.6.0_11-0-aafc82e8-dirty on Sat Jan 1 10:22:18 2011
(pid 765)
RECOVERY_SDCARD_ON_DATA := true
I:Lun file '/sys/class/android_usb/android0/f_mass_storage/lun0/file' does not exist, USB storage mode disabled
TW_INCLUDE_CRYPTO := true
I:Find_File: Error opening '/sys/class/backlight'
I:Found brightness file at '/sys/class/leds/lcd-backlight/brightness'
I:Got max brightness 255 from '/sys/class/leds/lcd-backlight/max_brightness'
I:TWFunc::Set_Brightness: Setting brightness control to 255
I:TW_EXCLUDE_ENCRYPTED_BACKUPS := true
I:LANG: en
Starting the UI...
setting DRM_FORMAT_RGB565 and GGL_PIXEL_FORMAT_RGB_565
cannot find/open a drm device: No such file or directory
fb0 reports (possibly inaccurate):
vi.bits_per_pixel = 32
vi.red.offset = 0 .length = 8
vi.green.offset = 8 .length = 8
vi.blue.offset = 16 .length = 8
failed to mmap framebuffer: Invalid argument
I:TWFunc::Set_Brightness: Setting brightness control to 255
TW_SCREEN_BLANK_ON_BOOT := true
I:TWFunc::Set_Brightness: Setting brightness control to 0
ioctl(): blank: Bad file descriptor
ioctl(): blank: Bad file descriptor
I:TWFunc::Set_Brightness: Setting brightness control to 255
I:Loading package: splash (/twres/splash.xml)
I:Load XML directly
I:PageManager::LoadFileToBuffer loading filename: '/twres/splash.xml' directly
I:Checking resolution...
libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 765 (recovery), pid 765 (recovery)
libc: Unable to set property "ro.twrp.boot" to "1": error code: 0xb
libc: Unable to set property "ro.twrp.version" to "3.6.0_11-0": error code: 0xb
So the failed TWRP is still there, and somehow always booting to it?
Further development: I have tried flashing the stock recovery using `flash_image` through an adb shell, but with no success. It just spits out
Code:
failed with error: -1
I assume you cannot flash the recovery while in the recovery...?
I just don't understand how this started happening after I it did the factory reset from the booted Android UI.
I finally solved this conundrum!
After digging around a bit more, I found this blog post on someone's website (thank you!) and tried it out.
In my case, I had /dev/block/platform/bootdevice/by-name/recovery but it still worked wonders.
In case that blog ever goes down, what you have to do is check that path and see if it matches. Like the post suggests, you can do DEV=$(ls /dev/block/platform/*/by-name/recovery); echo $DEV.
Then, it's a matter of using dd to dump the image onto that path, like this: dd of=$DEV if=/path/to/recovery.img (I put mine in /sdcard with adb push).
Finally, just reboot using adb reboot ... or using your device's physical buttons.
Hope this helps!
if TWRP would be broken, you wouldn't be able to use adb shell.
system won't boot because avb/dm-verity detects modified partition (such as recovery) and will therefore send into recovery mode on unsuccessful boot. It's not the recovery blocking here, this would happen with every custom recovery no matter what file you flash, unless you disable dm-verity.
The TWRP used here is most likely targeting Android 11
aIecxs said:
if TWRP would be broken, you wouldn't be able to use adb shell.
system won't boot because avb/dm-verity detects modified partition (such as recovery) and will therefore send into recovery mode on unsuccessful boot. It's not the recovery blocking here, this would happen with every custom recovery no matter what file you flash, unless you disable dm-verity.
The TWRP used here is most likely targeting Android 11
Click to expand...
Click to collapse
Oooh I see. So if I disable verity (with fastboot's --disable-verity, I assume), it could work?
I will have to try that, thank you for the response!

Categories

Resources