Database Info

The Infuse 4G Development Platform AKA UnBrickable Mod

Introduction
This is the 10th device to receive UnBrickable Mod! Lets go back to where it all started. It was proposed by XDA Member js22 that a device could be recovered without JTAG, using only it's native hardware. After months upon months of research, reading debug logs, reverse engineering of hardware and software, we came up with a solution.. Since I was the first to do it, I called it UnBrickable Mod. XDA Member Rebellos then reverse engineered a portion of the IBL into what is known as the HIBL(Hummingbird Interceptor BootLoader). We decided to call it this because the process goes like this: With UBM applied, the processor requests a code download from USB. We feed it the HIBL which reuses IBL code to authenticate with the Hummingbird's secure booting chain, then the Interceptor bootloader calls back and reuses the same IROM Download code used to download it, but we bypass security checks. This "Interception" of the boot sequence is why UnBrickable Mod works. The HIBL has proven to be so powerful and multipurpose that we've been able to package it into a one-click which works with ALL S5PC110 based devices with USB download capabilities.
I'd like to thank pdx 528e for donating the Infuse4G for this modification. This modification would not have been possible on this particular device without total removal of the processor.
After we verify this modification works This will be a replacement for JTAG. How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like an Infuse 4G. See the Special Instructions section.
Modification
You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(my username @gmail.com) or Connexion2005(aka MobileTechVideos.com).
2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (for the wire contained within)
getting started:
You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 12cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.
Take the 12cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.
performing the modification:
1. tear apart your phone... remove six(6) #1 phillips screws from the back. Then you can separate the back from the front. Make sure to take out your SIM and external SDCard before you do this.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2. Remove the two(2) screws and four(4) electric connections securing the mainboard into the unit and remove the board.
3. remove the EM shield from the processor side.
4. remove xOM5 resistor.
5. Bridge the active side of xOM5 to the active side of xOM3. Most of the resistors in the top row will also work.
6. *OPTIONAL* for Bootloader development you will want UART output. You can use these points to a connection outside the device for UART. These points are exposed when the mainboard is secured to the unit. They are located on the JTAG port.
7. Reassemble the device.
Special Instructions
This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds.
To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.
Conclusion
Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.
reading material
Creating your own Samsung Bootloaders: http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example: http://www.boardset.com/products/mv6410.php
ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
drivers and utilities
This will be an ever expanding list
Windows Drivers http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW: http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line tool: http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list
Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list
firmware
Bootloader Hello World by Rebellos http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
UnBrick tool http://forum.xda-developers.com/showthread.php?t=1242466

At this time I have not performed this modification. If you are in a pinch, please use this method. I will be performing this mod on my own device shortly.

We confirmed this device has got another iROM build, this means different HW revision of CPU.
HIBL for that will be released soon.

U are a genius Adam
Sent from my SAMSUNG-SGH-I997 using xda premium

JordanElliott said:
U are a genius Adam
Sent from my SAMSUNG-SGH-I997 using xda premium
Click to expand...
Click to collapse
I second that. I'm ready to send my phone in.
I'm not a developer but I try to play one on XDA. Seriously I'm not a developer. DlevROM Yo!

Thanks. But my wife wont let me touch hers...
Edit. Her phone...LOL..
Sent from my SAMSUNG-SGH-I897 using XDA App

To much trouble .....but thanks anyway
Sent from my SAMSUNG-SGH-I997 using xda premium

To bad i'm a perfectionist that doesn't know how to solder; my baby is to new to put her through this lol.
Sent from my SGH-I997 using xda premium

oh man glad to see this here thanks

It would be good to mention a recommendation on soldering iron power. I mean I have 75 watt irons, and 150/400 watt guns, I like to use a bigger than needed iron because it reduces the heat up time and if you get it the first time reduces damage but only if you get it exactly at the right time.
But I wouldn't put any of those big tools near a computer or phone. I'd say 15 Watts is plenty, 25 is manageable if you are good and the to is sharp and clean, these small electronics are soldered with infrared and aren't even designed to have an iron used on them. Keep that in mind if you consider this mod! This can be tricky stuff that can damage your hardware.
Adam, has any progress been made on the galaxy s to boot Meego or Linux? I know you can install Linux to the sd card and run it along side Android using terminal emulator to access it like you posted in the captivate section a while back but I never saw it running with a GUI on the phone, if you Jeanne a way to accesses fluxbox with the phones touch screen, that would be cool even if I can't boot stair into Linux yet.

This is really great thx so does it mean the infuse can be like the hd2 run almost all the popular Smartphone operating systems ?

leeroy1034 said:
This is really great thx so does it mean the infuse can be like the hd2 run almost all the popular Smartphone operating systems ?
Click to expand...
Click to collapse
What it means is that if you are a developer that wants to develop a way to do those things you can do it without fear or bricking. I doubt it will lead to the infuse being the next hd2 but its a step in the direction.

I'm just hoping it means more roms to get my flashing addiction fix
Sent from my SAMSUNG-SGH-I997 using XDA App

The_Zodiac said:
I'm just hoping it means more roms to get my flashing addiction fix
Sent from my SAMSUNG-SGH-I997 using XDA App
Click to expand...
Click to collapse
I hope it leads to Meego for the infuse, I kinda dislike Android, its too slow, too fractured, we shouldn't need all this super fast hardware to get a smooth experience. but I have never used Meego. Even with a lack of a huge app market it has to be better than lame ios or win phone7.

Wow, reading these threads and the custom bootloaders threads makes me realize how much smarter some of you are than me. I can only thank you for your work done and time given to the community. Great work to everyone involved!

AJerman said:
Wow, reading these threads and the custom bootloaders threads makes me realize how much smarter some of you are than me.
Click to expand...
Click to collapse
Personally...
Naah, I've just got loads of time to waste for pretty useless things (mainly, once per few months something useful like HIBL comes out) :d

https://m.google.com/app/plus/mp/217/#~loop:aid=z12pxpqbdlikhv0rj04cd5gbiz3wg5eqqjg&view=activity

Ok. I'm having a problem. We have USB debug mode..
Code:
Bus 001 Device 035: ID 04e8:1234 Samsung Electronics Co., Ltd
It is enumerating properly in Linux.
It is uploading the HIBL properly as well.
Code:
[email protected]:~/Desktop$ sudo smdk-usbdl -a d0020000 -f ./HIBL.bin
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <[email protected]>
S3C64XX Detected!
=> found device: bus 001, dev 034
=> loaded 24576 bytes from ./HIBL.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum 5d9c
=> usb_bulk_write() returned 24586
[email protected]:~/Desktop$
However, the device does not un-enumerate and re-enumerate as it usually does after receiving and executing the HIBL.
Here is the UART output from uploading HIBL.
Code:
Insert an OTG cable into the connector!
����
Uart negotiation Error
����
Here is a typical boot.
Code:
Uart negotiation Error
Insert an OTG cable into the connector!
Enumeration TimeOut Error
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val 2
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val e
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x80040)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 3660mV, soc = 13
check_quick_start_condition- Voltage: 3660.0, Linearized[0/15/30], Capacity: 12
init_fuel_gauge: vcell = 3660mV, soc = 13, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0xc0
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x1
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x0
PMIC_STATUS2 = 0x0
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 0, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0x871f8801)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=0x31352402 0x61dc00ec
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
Uncompressing Linux.............................................................
[ 0.000000] copy: bad source 0
[ 0.000000] mout_audss: bad source 0
[ 0.090119] KERNEL:kernel_sec_get_debug_level_from_boot=0x574f4c44
[ 0.094853] KERNEL:magic_number=0x0 DEBUG LEVEL low!!
[ 0.099864] (kernel_sec_set_upload_cause) : upload_cause set 0
[ 0.804603] irq requested hpd irq
[ 0.850107] --------A1026 i2c driver A1026_probe called
[ 0.853875] --------A1026_probe: device not supported
[ 0.859131] --------A1026_driver_init successful
[ 0.863514] --------A1026_dev_powerup called
[ 3.007976] Failed to request gpio touchkey_init:738
[ 3.011482] Failed to request gpio touchkey_init:740
[ 12.856445] init: [disk_config] initialize_mbr_flash for S1_EUR
[ 12.860891] init: [disk_config] [Disk Size (16005464064), (15630336k), secto]
[ 12.870565] init: [disk_config] calc_pte_of_disk -> start 64 num lba 2732844
[ 12.879153] init: [disk_config] calc_pte_of_disk -> start 27328512 num lba 3
[ 12.888197] init: [disk_config] compare_partition -> num_part 0 , offset (44)
[ 12.896007] init: [disk_config] [ target -> Disk0 : 13992165376 (13664224k) ]
[ 12.905162] init: [disk_config] Match partition table entry ... skip(0)
[ 12.911775] init: [disk_config] compare_partition -> num_part 1 , offset (46)
[ 12.919575] init: [disk_config] [ target -> Disk1 : 2013265920 (1966080k) 00]
[ 12.928584] init: [disk_config] Match partition table entry ... skip(1)
[ 12.935185] init: [disk_config] compare_partition -> num_part 2 , offset (47)
[ 12.942987] init: [disk_config] [ target -> Disk2 : 0 (0k) 00:00:00000000:00]
[ 12.950698] init: [disk_config] Match partition table entry ... skip(2)
[ 12.957303] init: [disk_config] compare_partition -> num_part 3 , offset (49)
[ 12.965104] init: [disk_config] [ target -> Disk3 : 0 (0k) 00:00:00000000:00]
[ 12.972811] init: [disk_config] Match partition table entry ... skip(3)
[ 12.979399] init: [disk_config] bNeedRoot : 0x00
[ 12.990828] init: cannot open '/initlogo.rle'
[ 13.075055] Failed to request FM_RESET!
[ 13.172981] init: [disk_config] :::: /dev/block/mmcblk0p1 :::::
[ 13.180732] init: [disk_config] vfat_identify -> ok
[ 13.184160] init: [disk_config] :::: /dev/block/mmcblk0p2 :::::
[ 13.190129] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.196466] init: [disk_config] rfs_identify -> failed
[ 13.202486] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.207833] init: [disk_config] rfs_identify -> failed
[ 13.213839] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.219189] init: [disk_config] rfs_identify -> failed
[ 13.225210] init: [disk_config] rfs_format -> /system/bin/fat.format -F 32 -
[ 13.252568] init: [disk_config] rfs_format -> ok[BIF: ] FSR VERSION: FSRM
[ 13.552104] init: cannot find '/system/bin/false', disabling 'noplaylogos'
[ 13.586570] init: cannot find '/system/etc/install-recovery.sh', disabling ''
sh: can't access tty; job control turned off
$ [ 19.506760] init: no such service 'bootanim'
[ 43.514858] init: no such service 'bootanim'
[ 61.035132] init: sys_prop: permission denied uid:1000 name:dpm.allowcamera
[ 71.204861] init: untracked pid 3290 exited
����
Uart negotiation Error
Rebellos, any ideas?

Updated 3rd post in this thread. We found out another S5PC110 iROM revision for the first time.

It's working. Excellent work Rebellos!
This log shows HIBL, then SBL going into download mode. Then a heimdall print-pit was excuted and the device rebooted.
Code:
����
Uart negotiation Error
-------------------------------------------------------------
Hummingbird Interceptor Boot Loader (HIBL) v1.0
Copyright (C) Rebellos 2011
-------------------------------------------------------------
Calling IBL Stage2 ...OK
Testing DRAM1 ...OK
iRAM reinit ...OK
cleaning OTG context ...OK
Chain of Trust has been successfully compromised.
Begin unsecure download now...
0x00000000BL3 EP: 0x40244000
Download complete, hold download mode key combination.
Starting BL3 in...
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Modified by Rebell
Build On: Jun 8 2011 21:44:47
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 4102mV, soc = 80
check_quick_start_condition_with_charger- Voltage: 4102.50000, Linearized[64/79/94], Capacity: 83
init_fuel_gauge: vcell = 4102mV, soc = 80, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x28
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x20
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
reading nps status file is successfully!.
nps status=0x504d4f43
==> Welcome to ARIES!
==> Entering usb download mode..
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
Error : Current Mode is Host
EP2: 0, 2, 0; len=7
EP2: 0, 2, 0; len=7
sug: IN EP asserted
Error:Invalid connection string!
Error:Invalid connection string!
- Odin is connected!
set_nps_update_start: set nps start flag successfully.
process_packet: request id(100), data id(0)
process_rqt_init: platform number(0x0), revision(0x0)
process_packet: request id(100), data id(1)
process_packet: request id(101), data id(1)
.Done.
read 1 units.
check_pit_integrity: valid pit magic code.
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(3)
process_packet: request id(103), data id(0)
process_rqt_close: xmit completed!
set_nps_update_completed: set nps completed flag successfully.
process_packet: request id(103), data id(1)
process_rqt_close: target reset!
ARIES MAGIC_ADDR=0x0 / INFORM5=0x12345678
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val 2
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val e
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 4101mV, soc = 80
check_quick_start_condition_with_charger- Voltage: 4101.25000, Linearized[67/82/97], Capacity: 83
init_fuel_gauge: vcell = 4101mV, soc = 80, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x0
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 4, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0x871f8801)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=0x31352402 0x61dc00ec
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
Uncompressing Linux..............................................................................................................
[ 0.000000] copy: bad source 0
[ 0.000000] mout_audss: bad source 0
[ 0.090122] KERNEL:kernel_sec_get_debug_level_from_boot=0x574f4c44
[ 0.094863] KERNEL:magic_number=0x0 DEBUG LEVEL low!!
[ 0.099874] (kernel_sec_set_upload_cause) : upload_cause set 0
[ 0.802403] irq requested hpd irq
[ 0.846178] --------A1026 i2c driver A1026_probe called
[ 0.849942] --------A1026_probe: device not supported
[ 0.855208] --------A1026_driver_init successful
[ 0.859587] --------A1026_dev_powerup called
[ 3.004125] Failed to request gpio touchkey_init:738
[ 3.007639] Failed to request gpio touchkey_init:740
[ 12.613596] init: [disk_config] initialize_mbr_flash for S1_EUR
[ 12.617987] init: [disk_config] [Disk Size (16005464064), (15630336k), sector_size 512 :: num_lba 31260672 ]
[ 12.627716] init: [disk_config] calc_pte_of_disk -> start 64 num lba 27328448 next : 27328512
[ 12.636293] init: [disk_config] calc_pte_of_disk -> start 27328512 num lba 3932160 next : 31260672
[ 12.645348] init: [disk_config] compare_partition -> num_part 0 , offset (446)(0x1be)
[ 12.653148] init: [disk_config] [ target -> Disk0 : 13992165376 (13664224k) 00:0c:00000040:01a0ffc0 ]
[ 12.662313] init: [disk_config] Match partition table entry ... skip(0)
[ 12.668924] init: [disk_config] compare_partition -> num_part 1 , offset (462)(0x1ce)
[ 12.676721] init: [disk_config] [ target -> Disk1 : 2013265920 (1966080k) 00:0c:01a10000:003c0000 ]
[ 12.685729] init: [disk_config] Match partition table entry ... skip(1)
[ 12.692391] init: [disk_config] compare_partition -> num_part 2 , offset (478)(0x1de)
[ 12.700135] init: [disk_config] [ target -> Disk2 : 0 (0k) 00:00:00000000:00000000 ]
[ 12.707841] init: [disk_config] Match partition table entry ... skip(2)
[ 12.714454] init: [disk_config] compare_partition -> num_part 3 , offset (494)(0x1ee)
[ 12.722244] init: [disk_config] [ target -> Disk3 : 0 (0k) 00:00:00000000:00000000 ]
[ 12.729962] init: [disk_config] Match partition table entry ... skip(3)
[ 12.736538] init: [disk_config] bNeedRoot : 0x00
[ 12.748654] init: cannot open '/initlogo.rle'
[ 12.832898] Failed to request FM_RESET!
[ 12.931189] init: [disk_config] :::: /dev/block/mmcblk0p1 :::::
[ 12.938955] init: [disk_config] vfat_identify -> ok
[ 12.942398] init: [disk_config] :::: /dev/block/mmcblk0p2 :::::
[ 12.948354] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.954696] init: [disk_config] rfs_identify -> failed
[ 12.960739] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.966056] init: [disk_config] rfs_identify -> failed
[ 12.972089] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.977424] init: [disk_config] rfs_identify -> failed
[ 12.983432] init: [disk_config] rfs_format -> /system/bin/fat.format -F 32 -S 4096 -s 4 /dev/block/mmcblk0p2
[ 13.009915] init: [disk_config] rfs_format -> ok[BIF: ] FSR VERSION: FSR_1.2.1p1_b139_RTM
[ 13.310236] init: cannot find '/system/bin/false', disabling 'noplaylogos'
[ 13.337944] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
sh: can't access tty; job control turned off
$ [ 19.257644] init: no such service 'bootanim'
[ 39.060649] init: sys_prop: permission denied uid:1000 name:wifi.interface
[ 44.151646] init: no such service 'bootanim'
the commands run were:
Code:
sudo smdk-usbdl -a d0020000 -f ./Infuse_HIBL_3.bin
sudo smdk-usbdl -a d40244000 -f ./Sbl.bin
You can get these pre-release binaries here: http://www.mediafire.com/file/yewg81mwdklb357/HIBLandSblBinaries.zip
Everything is working but I have not yet tested flashing. Flashing should go off without a hitch. You will use Odin 1.7 or 1.8.

[DEV] Discussion about USB-TTL UART JIG

Hey all,
I've created this thread to gather all the info and doubts about UART JIG (also so <I> don't pollute OpenFIMG's thread ).
Readings of interest:
Fun with resistors
Setup in a Nexus S (with pictures)
UART / Serial / JTAG
Odd serial port on Spica (samdroid)
Galaxy S UART JIG & Debugging connector
Developing methods to recover bricks without JTAG
Kernel serial console on i9100
UART Output / Bootloader Hacking / Kernel debugging
Configuration:
Vcc (Pin 1) -> Disconnected.
D- (Pin 2) -> RXD.
D+ (Pin 3) -> TXD.
ID (Pin 4) -> Connected to GND with 523k ohm attached.
GND (Pin 5) -> GND
Baud rate: 115200, 8N1. No control flow.
Boot from the SBL:
Code:
SBL>loadkernel
SBL>loadmodem
SBL>boot
How to get output from kernel.

tom3q said:
<Quote Snipped>.
Click to expand...
Click to collapse
Awesome. Thanks donator!
You've got the uart jig there? Can you test it? (I'm not getting any output.. not [X]BL, nor kernel)

moikop said:
Awesome. Thanks donator!
You've got the uart jig there? Can you test it? (I'm not getting any output.. not [X]BL, nor kernel)
Click to expand...
Click to collapse
This is what I get from the serial port of G3:
Code:
Secondary Boot Loader(SBL)
Built for apollo rev02 by root on Oct 27 2010 17:10:33
Copyright (C) SAMSUNG Corporation 2006-2010
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 10
partitions loading success
==== PARTITION INFORMATION ====
ID : IBL & PBL (0x0)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : SBL (0x1)
ATTR : RO ENTRYPOINT SLC BOOTLOADING PREWRITING (0xd402)
FIRST_UNIT : 1
NO_UNITS : 5
===============================
ID : PARAM (0x2)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 6
NO_UNITS : 2
===============================
ID : EFS (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 8
NO_UNITS : 32
===============================
ID : KERNEL (0x4)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 40
NO_UNITS : 30
===============================
ID : FACTORYFS (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 70
NO_UNITS : 880
===============================
ID : DATAFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 950
NO_UNITS : 810
===============================
ID : CACHE (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1760
NO_UNITS : 152 (*mismatch* 152 should be 150)
===============================
ID : TEMP (0x3)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 1912
NO_UNITS : 28 (*mismatch* 28 should be 30)
===============================
ID : MODEM (0x5)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 1940
NO_UNITS : 64
===============================
Read image(PARAM) from flash .......
..Done
read 2 units.
Normal Case : MAIN(O) & BACKUP(O)
main: Debug Level Low
RST_STAT = 0x00000004 WAKEUP_STAT = 0x00000000
s5p_fb_info_init start
s5p_fb_info_init end
s5p_fimd_info_init start
s5p_fimd_info_init end
LoadPNG: width:240, height:400, bpp:32, color_type:6, channels:4, rowbytes:960
lcd_gpio_init start
lcd_gpio_init end
lcd_backlight_ctrl start
lcd type: 1
ldi mtpdata: 52 9 11
lcd type is smd
set brightness:0x43
lcd_backlight_ctrl end
SBL:Phone Boot Mode=0
AST_POWERON
usb_download_mode:0
Autoboot (0 seconds) in progress, press any key to stop
AST_ERROR
Autoboot aborted
Type "help" to get a list of commands
SBL>
SBL>
SBL>
SBL> help
Following commands are supported:
* setenv
* savedefault
* saveenv
* printenv
* help
* sec_log
* kernel
* boot
* reset
* nandwrite
* nandread
* nkernel
* readcheck
* savepart
* delpart
* addpart
* showpart
* loadmodem
* loadkernel
* eraseall
* erasepart
* close
* open
* format
* getreg
* setreg
* getadc
* sleep
To get commands help, Type "help <command>"
SBL>
When I let the kernel boot instead of entering the console I get no output from the kernel, possibly because UART switch is being reconfigured to modem somewhere in the kernel, kernel doesn't have serial console enabled or the serial port passed to the kernel in kernel arguments by the bootloader isn't the serial port accessible from microUSB connector.
For reference:
Code:
Secondary Boot Loader(SBL)
Built for apollo rev02 by root on Oct 27 2010 17:10:33
Copyright (C) SAMSUNG Corporation 2006-2010
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 10
partitions loading success
==== PARTITION INFORMATION ====
ID : IBL & PBL (0x0)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : SBL (0x1)
ATTR : RO ENTRYPOINT SLC BOOTLOADING PREWRITING (0xd402)
FIRST_UNIT : 1
NO_UNITS : 5
===============================
ID : PARAM (0x2)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 6
NO_UNITS : 2
===============================
ID : EFS (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 8
NO_UNITS : 32
===============================
ID : KERNEL (0x4)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 40
NO_UNITS : 30
===============================
ID : FACTORYFS (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 70
NO_UNITS : 880
===============================
ID : DATAFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 950
NO_UNITS : 810
===============================
ID : CACHE (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1760
NO_UNITS : 152 (*mismatch* 152 should be 150)
===============================
ID : TEMP (0x3)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 1912
NO_UNITS : 28 (*mismatch* 28 should be 30)
===============================
ID : MODEM (0x5)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 1940
NO_UNITS : 64
===============================
Read image(PARAM) from flash .......
..Done
read 2 units.
Normal Case : MAIN(O) & BACKUP(O)
main: Debug Level Low
RST_STAT = 0x00000004 WAKEUP_STAT = 0x00000000
s5p_fb_info_init start
s5p_fb_info_init end
s5p_fimd_info_init start
s5p_fimd_info_init end
LoadPNG: width:240, height:400, bpp:32, color_type:6, channels:4, rowbytes:960
lcd_gpio_init start
lcd_gpio_init end
lcd_backlight_ctrl start
lcd type: 1
ldi mtpdata: 52 9 11
lcd type is smd
set brightness:0x43
lcd_backlight_ctrl end
SBL:Phone Boot Mode=0
AST_POWERON
usb_download_mode:0
Autoboot (0 seconds) in progress, press any key to stop
FOTA Check Bit
Read BML page=1e4ff, NumPgs=1
FOTA Check Bit (0x0)
Load Partion idx = (4)
..............................done
Kernel read success from kernel partition
setKernelParam: setting param.serialnr=3930c0cf08x 0x159100ec
setKernelParam: setting param.board_rev=0x2
setKernelParam: setting param.cmdline=console=ttySAC1,115200 loglevel=4 version=Sbl(1.0.0) 2010-10-27 17:10:33
Starting kernel at 0x22000000...

moikop said:
Awesome. I think ttySAC1 is defined as s3c2410_serial1 in the kernel. And maybe you'll have to change SWITCH_SEL from the sbl console (from 65 to 6543).
I still don't understand why all I get this � weird character :/
Vcc connected to 3.3v, 150k ohm (though tried with 619k too) resistor and baud rate 115200 8N1, right?
Click to expand...
Click to collapse
Maybe something wrong with your level converter?
Also, if I decoded color codes of resistors correctly, I have 522k ohms connected between GND and ID pins (two 1M connected in parallel and additional 22k after them).
Edit: Would make sense, as according to http://forum.xda-developers.com/showthread.php?t=820275 it would be
Code:
RID_FM_BOOT_OFF_UART, /* 1 1 1 0 0 523K Factory Mode Boot OFF-UART */

tom3q said:
Maybe something wrong with your level converter?
Also, if I decoded color codes of resistors correctly, I have 522k ohms connected between GND and ID pins (two 1M connected in parallel and additional 22k after them).
Edit: Would make sense, as according to http://forum.xda-developers.com/showthread.php?t=820275 it would be
Code:
RID_FM_BOOT_OFF_UART, /* 1 1 1 0 0 523K Factory Mode Boot OFF-UART */
Click to expand...
Click to collapse
Tried with both, 522k & 523k (just in case) and still the same.. So it's gotta be my level converter... that's weird :S

moikop said:
Tried with both, 522k & 523k (just in case) and still the same.. So it's gotta be my level converter... that's weird :S
Click to expand...
Click to collapse
Just for reference, my level converter: http://translate.google.com/transla...unikacja-przez-usb---modul-em212.html&act=url
EDIT: Maybe we should create new topic for discussion on such things?

tom3q said:
Just for reference, my level converter: http://translate.google.com/transla...unikacja-przez-usb---modul-em212.html&act=url
EDIT: Maybe we should create new topic for discussion on such things?
Click to expand...
Click to collapse
You're right. So here it is.
I don't see why my level converter wouldn't work, since it supports the right voltage, baud rate, etc.
mmm, some weird idea: what's you're bootloader version? (I mean from which release). I'm thinking maybe the bootloader version is my problem? (since I have Samsungs latest installed)

moikop said:
You're right. So here it is.
I don't see why my level converter wouldn't work, since it supports the right voltage, baud rate, etc.
mmm, some weird idea: what's you're bootloader version? (I mean from which release). I'm thinking maybe the bootloader version is my problem? (since I have Samsungs latest installed)
Click to expand...
Click to collapse
I don't know the exact version as it was already on the phone as I got it. The only thing saying a bit about the version is its output:
Code:
Built for apollo rev02 by root on Oct 27 2010 17:10:33
Have you tried different baud rates? Common ones other than 115200 are 9600 and 38400.
Also this thread would become a bit more informative if all the posts on this topic would get moved here from OpenFIMG thread.
EDIT: Also make sure that ground signal is properly connected, otherwise the converter might not recognize voltage levels correctly. What's exactly your connection layout? I have only 4 lines wired to the microUSB connector, RX, TX, GND and ID with VCC left unconnected.

tom3q said:
I don't know the exact version as it was already on the phone as I got it. The only thing saying a bit about the version is its output:
Code:
Built for apollo rev02 by root on Oct 27 2010 17:10:33
Click to expand...
Click to collapse
mmm.. I have JPU, so my bootloader is at least from 2011..
tom3q said:
Have you tried different baud rates? Common ones other than 115200 are 9600 and 38400.
Click to expand...
Click to collapse
Tried with those 3. With 9600 and 38400 I don't get anything, when with 115200 I get the "?" character.
tom3q said:
Also this thread would become a bit more informative if all the posts on this topic would get moved here from OpenFIMG thread.
Click to expand...
Click to collapse
I'll contact a mod and see what can be done.
tom3q said:
EDIT: Also make sure that ground signal is properly connected, otherwise the converter might not recognize voltage levels correctly. What's exactly your connection layout? I have only 4 lines wired to the microUSB connector, RX, TX, GND and ID with VCC left unconnected.
Click to expand...
Click to collapse
Double checked my GND connection and is ok. My layout is the following:
VCC -> 3.3v
Tx & Rx with their corresponding pins.
ID connected to GND with 523k ohm in between
and GND connected to GND.

Could you try without VCC connected?
I really don't think that Samsung would disable bootloader console used in service centers for phone diagnostics...

tom3q said:
Could you try without VCC connected?
Click to expand...
Click to collapse
Exact same result.
With GND disconected also same result.
If Tx is disconnected there's no output (obviously). So a badly soldered/connected Pin2 can be discarded.
Checked Rx too, So a badly soldered/connected Pin3 can be discarded as well..
tom3q said:
I really don't think that Samsung would disable bootloader console used in service centers for phone diagnostics...
Click to expand...
Click to collapse
You must be right..
Edit: I changed pin2 & pin3 (now Pin2 is to Rx and Pin3 to Tx). Also connected GND (but left vcc disconnected as you) and got it working
Thanks for the help!

moikop said:
Edit: I changed pin2 & pin3 (now Pin2 is to Rx and Pin3 to Tx). Also connected GND (but left vcc disconnected as you) and got it working
Thanks for the help!
Click to expand...
Click to collapse
So what good is this that you are doing? Benefits etc.
And are we meant to be doing something similar to make phone work better?
Sent from the Persian Sphinx's private Galaxy

PersianSphinx said:
So what good is this that you are doing? Benefits etc.
And are we meant to be doing something similar to make phone work better?
Sent from the Persian Sphinx's private Galaxy
Click to expand...
Click to collapse
With this, we can get into the SBL console, get information about kernel panics (not yet) and this will help us debug kernel ports, drivers ports, etc.
And no. This would be useless for a normal user. Unless that (s)he wants to make a Download JIG (to get into download mode without having to use the three-button combo). In that case, a different resistor value (301k) is needed (and no level converter, of cource )

@PersianSphinx
This wud resurrect a hard bricked phone...this JTAG thing
Sent from my GT-I9100 using Tapatalk

Orr.Penn.18 said:
@PersianSphinx
This wud resurrect a hard bricked phone...this JTAG thing
Sent from my GT-I9100 using Tapatalk
Click to expand...
Click to collapse
This is not JTAG.

moikop said:
Edit: I changed pin2 & pin3 (now Pin2 is to Rx and Pin3 to Tx). Also connected GND (but left vcc disconnected as you) and got it working
Thanks for the help!
Click to expand...
Click to collapse
This is common fault people are doing - phone Rxd must be connected to converter Txd and vice versa.

Kernel output:
To get kernel output, all you need to do is:
Code:
setenv SWITCH_SEL 6543
And then boot normally from SBL.
To make this setting permanent:
Code:
setenv SWITCH_SEL 6543
saveenv
Result:
Code:
SBL> boot
setKernelParam: setting param.serialnr=3830f5ff08x 0xd44100ec
setKernelParam: setting param.board_rev=0x2
setKernelParam: setting param.cmdline=console=ttySAC1,115200 version=Sbl(1.0.0)2
Starting kernel at 0x22000000...
Uncompressing Linux.............................................................
<6>Initializing cgroup subsys cpu
<5>Linux version 2.6.32.9 ([email protected]) (gcc version 4.5.2 (Sourcery G++ Lite2
CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv6TEJ), cr=00c5387f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: GT-I5800
Memory policy: ECC disabled, Data cache writeback
<7>On node 0 totalpages: 65536
<7>free_area_init_node: node 0, pgdat c0aa7640, node_mem_map c0c3e000
<7> Normal zone: 512 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 65024 pages, LIFO batch:15
<7>On node 1 totalpages: 0
<7>free_area_init_node: node 1, pgdat c0aa7cf8, node_mem_map c0e47800
<4> Normal zone: 1 pages exceeds realsize 0
<7>On node 2 totalpages: 0
<7>free_area_init_node: node 2, pgdat c0aa83b0, node_mem_map c0e4f880
<4> Normal zone: 1 pages exceeds realsize 0
<7>On node 3 totalpages: 0
<7>free_area_init_node: node 3, pgdat c0aa8a68, node_mem_map c0e57900
<4> Normal zone: 1 pages exceeds realsize 0
CPU S5P6442 (id 0xababab00)
<7>s5p6442_init_clocks: initialising clocks
<6>S3C24XX Clocks, (c) 2004 Simtec Electronics
<7>s5p6442_setup_clocks: registering clocks
<6>mout_apll: source is fout_apll (1), rate is 667000000
<6>mout_epll: source is fout_epll (1), rate is 48000000
<6>mout_mpll: source is mpll (1), rate is 166000000
<6>mout_d0: source is mout_mpll (0), rate is 166000000
<6>mout_d1: source is mout_mpll (0), rate is 166000000
<6>mout_d0sync: source is mout_d0 (0), rate is 166000000
<6>mout_d1sync: source is mout_d1 (0), rate is 166000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>sclk_uart: source is mout_mpll (6), rate is 166000000
<6>sclk_uart: source is mout_mpll (6), rate is 166000000
<6>sclk_uart: source is mout_mpll (6), rate is 83000000
<6>spi-bus: source is mout_epll (7), rate is 48000000
<6>sclk_lcd: source is mout_mpll (6), rate is 166000000
<6>sclk_cam0: source is mout_mpll (6), rate is 166000000
<6>sclk_cam1: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>clk_g2d: source is mout_mpll (1), rate is 166000000
<6>i2sclk: source is i2smain_clk (0), rate is 48000000
<6>audss_hclk: source is i2smain_clk (0), rate is 48000000
<6>i2smain_clk: source is fout_epll (1), rate is 48000000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
<5>Kernel command line: console=ttySAC1,115200 version=Sbl(1.0.0) 2011-05-27 142
<6>PID hash table entries: 1024 (order: 0, 4096 bytes)
<6>Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
<6>Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Memory: 256MB = 256MB total
<5>Memory: 247040KB available (7488K code, 1639K data, 2972K init, 0K highmem)
<6>SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=4
<6>NR_IRQS:287
<7>s5p64xx_init_irq: initialising interrupts
<6>VIC @f4000000: id 0x00041192, vendor 0x41
<6>VIC @f4010000: id 0x00041192, vendor 0x41
<6>VIC @f4020000: id 0x00041192, vendor 0x41
<3>vic_pm_register: too few VICs, increase CONFIG_ARM_VIC_NR
Console: colour dummy device 80x30
s3c24xx_serial_initconsole
s3c24xx_serial_init_ports: initialising ports...
s3c24xx_serial_init_port: port=c0ad8a60, platdev=c0aabb10
s3c24xx_serial_init_port: c0ad8a60 (hw 0)...
...

moikop said:
To get kernel output, all you need to do is:
Code:
setenv SWITCH_SEL 6543
And then boot normally from SBL.
To make this setting permanent:
Code:
setenv SWITCH_SEL 6543
saveenv
Result:
Code:
SBL> boot
setKernelParam: setting param.serialnr=3830f5ff08x 0xd44100ec
setKernelParam: setting param.board_rev=0x2
setKernelParam: setting param.cmdline=console=ttySAC1,115200 version=Sbl(1.0.0)2
Starting kernel at 0x22000000...
Uncompressing Linux.............................................................
<6>Initializing cgroup subsys cpu
<5>Linux version 2.6.32.9 ([email protected]) (gcc version 4.5.2 (Sourcery G++ Lite2
CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv6TEJ), cr=00c5387f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: GT-I5800
Memory policy: ECC disabled, Data cache writeback
<7>On node 0 totalpages: 65536
<7>free_area_init_node: node 0, pgdat c0aa7640, node_mem_map c0c3e000
<7> Normal zone: 512 pages used for memmap
<7> Normal zone: 0 pages reserved
<7> Normal zone: 65024 pages, LIFO batch:15
<7>On node 1 totalpages: 0
<7>free_area_init_node: node 1, pgdat c0aa7cf8, node_mem_map c0e47800
<4> Normal zone: 1 pages exceeds realsize 0
<7>On node 2 totalpages: 0
<7>free_area_init_node: node 2, pgdat c0aa83b0, node_mem_map c0e4f880
<4> Normal zone: 1 pages exceeds realsize 0
<7>On node 3 totalpages: 0
<7>free_area_init_node: node 3, pgdat c0aa8a68, node_mem_map c0e57900
<4> Normal zone: 1 pages exceeds realsize 0
CPU S5P6442 (id 0xababab00)
<7>s5p6442_init_clocks: initialising clocks
<6>S3C24XX Clocks, (c) 2004 Simtec Electronics
<7>s5p6442_setup_clocks: registering clocks
<6>mout_apll: source is fout_apll (1), rate is 667000000
<6>mout_epll: source is fout_epll (1), rate is 48000000
<6>mout_mpll: source is mpll (1), rate is 166000000
<6>mout_d0: source is mout_mpll (0), rate is 166000000
<6>mout_d1: source is mout_mpll (0), rate is 166000000
<6>mout_d0sync: source is mout_d0 (0), rate is 166000000
<6>mout_d1sync: source is mout_d1 (0), rate is 166000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>mmc_bus: source is mout_mpll (6), rate is 83000000
<6>sclk_uart: source is mout_mpll (6), rate is 166000000
<6>sclk_uart: source is mout_mpll (6), rate is 166000000
<6>sclk_uart: source is mout_mpll (6), rate is 83000000
<6>spi-bus: source is mout_epll (7), rate is 48000000
<6>sclk_lcd: source is mout_mpll (6), rate is 166000000
<6>sclk_cam0: source is mout_mpll (6), rate is 166000000
<6>sclk_cam1: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>lclk_fimc: source is mout_mpll (6), rate is 166000000
<6>clk_g2d: source is mout_mpll (1), rate is 166000000
<6>i2sclk: source is i2smain_clk (0), rate is 48000000
<6>audss_hclk: source is i2smain_clk (0), rate is 48000000
<6>i2smain_clk: source is fout_epll (1), rate is 48000000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
<5>Kernel command line: console=ttySAC1,115200 version=Sbl(1.0.0) 2011-05-27 142
<6>PID hash table entries: 1024 (order: 0, 4096 bytes)
<6>Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
<6>Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
<6>Memory: 256MB = 256MB total
<5>Memory: 247040KB available (7488K code, 1639K data, 2972K init, 0K highmem)
<6>SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=4
<6>NR_IRQS:287
<7>s5p64xx_init_irq: initialising interrupts
<6>VIC @f4000000: id 0x00041192, vendor 0x41
<6>VIC @f4010000: id 0x00041192, vendor 0x41
<6>VIC @f4020000: id 0x00041192, vendor 0x41
<3>vic_pm_register: too few VICs, increase CONFIG_ARM_VIC_NR
Console: colour dummy device 80x30
s3c24xx_serial_initconsole
s3c24xx_serial_init_ports: initialising ports...
s3c24xx_serial_init_port: port=c0ad8a60, platdev=c0aabb10
s3c24xx_serial_init_port: c0ad8a60 (hw 0)...
...
Click to expand...
Click to collapse
Yep, on Spica setenv SWITCH_SEL 3 is enough. According to SBL sources, bit 0 selects USB switch mode and bit 1 selects UART swtich mode.

Orr.Penn.18 said:
@PersianSphinx
This wud resurrect a hard bricked phone...this JTAG thing
Sent from my GT-I9100 using Tapatalk
Click to expand...
Click to collapse
this is not jtag.... this is UART...this gives us info on what went wrong when the phone dosnt boot up properly when devs are testing new things.

I just received my level converter and it's working fine, I can get SBL logs.
But how to access the SBL prompt ?
I tried with some key combinaison but nothing work :/

[Q] How can i unpack/repack this system_1.img+system_2.img+...+system_8.img

I want to modify the Saihon X6 ROM, but the system.img is different from I've ever met, they put the system.img into 8 img, now do not know how to unpack/repack, I need help, need a detailed tutorial. Thank you
ht tp://pan.baidu.com/s/1pJAvLer

How can i unpack/repack like this system.img
ardager said:
I want to modify the Saihon X6 ROM, but the system.img is different from I've ever met, they put the system.img into 8 img, now do not know how to unpack/repack, I need help, need a detailed tutorial. Thank you
ht tp://pan.baidu.com/s/1pJAvLer
Click to expand...
Click to collapse
I used this on ubuntu
Run sudo mount-o loop system_1.img system
displays
Mount: wrong fs type, bad option, bad superblock on / dev/loop0,
Missing codepage or helper program, or Other Error
system log may have some important information,
try using dmesg | tail like a command.
Run dmesg | tail view LOG
display
[74.005499] audit_printk_skb: 18 callbacks suppressed
[74.005518] type = 1400 Audit (1360118240.727:23): AppArmor = "DENIED" operation = "capable" parent = 1 Profile = "/ usr / lib / Telepathy / mission-control-5 "pid = 1553 COMM =" mission-control "Capability = 23 capname =" sys_nice "
[74.415356] type = 1400 Audit (1360118241.135:24): AppArmor = "DENIED" operation = "Open" parent = 1 profile = "/ usr/lib/telepathy/mission-control-5" name = "/ usr / share / gvfs / remote-volume-monitors /" pid = 1553 comm = "mission-control" requested_mask = "r" denied_mask = "r" fsuid = 0 ouid = 0
[365.116251] EXT4-fs (loop0): bad geometry: Block count 97 656 Exceeds Size of device (32767 Blocks)
[579.113993] hrtimer: interrupt took 5,682,946 ns
[630.545278] EXT4-fs ( loop0): bad geometry: Block count ninety-seven thousand six hundred and fifty-six Exceeds Size of device (32767 Blocks)
[644.026965] EXT4-fs (loop0): Unrecognized Mount option "loop1" or Missing value
[670.312507] EXT4-fs (loop0): bad geometry: Block count ninety-seven thousand six hundred fifty-six Exceeds Size of device (32767 Blocks)
[788.599457] EXT4-fs (loop0): bad geometry: 76800 Block count Exceeds Size of device (1657 Blocks)
[1008.514549] EXT4-fs (loop0): bad geometry: Block count 97,656 exceeds size of device (32767 blocks)
file system_1.img
results
system_1.img: Linux rev 1.0 ext4 filesystem data, UUID = 57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)

HELP!!!!! I NEED TO REINsTALL LINUX ON A TV BOX

Hello all ,
I linked a serial cable to my allwinner a20 based Android Tv box.
It can not pass after the boot logo and next is all what it display in serial console.
Somebody pelase help i need to reisntall linux on it ,if you knwo any u boot keys that i have to press on the uboot serial consoel pelase help.I tryed to press ransom keys but i see nothin.
Here is all i see when it start:
====================================
HELLO! BOOT0 is starting!
boot0 version : 3.0.0
dram size =512
sum=0x9c3bd8cf
src_sum=0x9c3bd8cf
Ready to disable icache.
Jump to secend Boot.
[ 0.133]
U-Boot 2011.09-rc1-dirty (Nov 08 2013 - 11:06:32) Allwinner Technology
[ 0.141]version: 1.1.0
[ 0.144]pmbus: ready
axp read error
probe axp20x failed
axp_probe error
boot_clock = 912
dcdc2_vol = 1400
axp set dcdc2_vol to 1400 failed
dcdc3_vol = 1250
ldo2_vol = 3000
ldo3_vol = 2800
ldo4_vol = 2800
power_start = 0
storage_type = -1
usb_recovery = 0
find power_sply to end
fel key old mode
run key detect
no key found
no key input
dram_para_set start
dram_para_set end
[ 0.293]DRAM: 512 MiB
relocation Offset is: 15b27000
user_gpio config
user_gpio ok
DRV_DISP_Init: opened
[ 0.560]boot_disp.output_type=2
[ 0.563]boot_disp.output_mode=5
[ 0.567]boot_disp.auto_hpd=1
workmode = 0
[ 1.871]NAND: NAND_UbootInit
NB1 : enter NAND_LogicInit
nand : get id_number_ctl from script, 3
not burn nand partition table!
NB1 : nftl num: 3
init nftl: 0
NB1 : NAND_LogicInit ok, result = 0x0
[ 2.381]sunxi flash init ok
In: serial
Out: serial
Err: serial
--------fastboot partitions--------
-total partitions:12-
-name- -start- -size-
bootloader : 1000000 1000000
env : 2000000 1000000
boot : 3000000 1000000
system : 4000000 20000000
recovery : 24000000 2000000
databk : 26000000 2000000
misc : 28000000 1000000
private : 29000000 1000000
sysrecovery : 2a000000 21000000
data : 4b000000 40000000
cache : 8b000000 17000000
UDISK : a2000000 0
-----------------------------------
base bootcmd=run setargs_nand boot_normal
bootcmd set setargs_nand
key 0
recovery key high 6, low 4
cant find fstbt value
Fastboot detected, will boot fastboot
to be run cmd=run setargs_nand boot_fastboot
the user data'magic is bad
WORK_MODE_BOOT
board_status_probe
sunxi_bmp_display
WORK_MODE_BOOT
[ 2.509]Hit any key to stop autoboot: 0
run usb fastboot
sunxi_fastboot_init
recv addr 0x41000000
send addr 0x582580a8
delay time 0
usb init ok
------------------------------------------------------------------
After this nothing .Please help me

After searching all google and reading documantation ,I contacted the box seller and he gied me the files i neeeded.
I used a image file named sun7i_A20v2.0_android_sugar-ref001_2014.09.04_TakenYBSJ.img and a windwos software to flash it via usb named PhoenixPacketV333
To flash teh device you muist hava a serial console to the box (veru easy to do if you have the cable ) ,and keep pushed the key 2
on serial consle (putty) while powering the device ,so it enter in fel mode ( something like recovery mode ,it accept usb connection) .Then oyu need a usb male to male cable to conect the android tv box usb port to the windows usb port ,and start flasing using the PhoenixPacketV333 software.
If somebody needs more help or files just write here I check daily .
have a nice day all!

Mi Stick stuck on boot logo (bricked?)

Hello everybody.
A couple of years ago I bought a Mi Stick for my mother, to use connected to an old LED tv she had. She used just 3 o 4 times tops with a Netflix account my brother shared with her. The device was practically new. My brother stopped paying Netflix a couple of months ago so she stopped using the device altogether so I disconnected it. But yesterday she told me my brother started paying Netflix again and told me to connect the MiStick to her TV again. Surprisingly, the device is now stuck on the boot logo:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I'm really angry because the device had very little use and especially because I live in third world ****hole: a new MiStick costs almost 4 times more now. It's not like I have couple of dollars getting dust on a drawer somewhere and I can go buy another one.
Anyway, I know it's possible to flash/unbrick a MiBox, I did it some time ago. Anybody knows if it's possible to the same with the Mi Stick??? I googled about it but I didn't find anything.
Thank you for your time.

hello, my Mi TV Stick MDZ-24-AA also unfortunately hangs all the time on the logo, checked on various cables and on a decent power supply
through the remote control (arrow + OK) does not want to enter the bootloader
I have purchased PL2303HX converter
According to the instructions from https://forum.xda-developers.com/t/help-pleas...-no-power-led-no-video.4452819/#post-87044521
and partially supported by Ruslan's film
With a backup downloaded from https://disk-yandex-ru.translate.goog/d/aL5Xo...en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true
Using Putty and ADB
I went through the entire installation process
Unfortunately, my mi stick still hangs on the logo: / What could be the cause? Is my mi stick still salvageable?

kedzior.kedzior said:
I have purchased PL2303HX converter
Using Putty and ...
I went through the entire installation process
Unfortunately, my mi stick still hangs on the logo
Click to expand...
Click to collapse
With the PL2303HX connected to the uart while the device is booting (to a hung state), what is shown in the uart log while the device is trying to boot?
Are you able to get a prompt over the uart as shown in the video?

Functioner said:
With the PL2303HX connected to the uart while the device is booting (to a hung state), what is shown in the uart log while the device is trying to boot?
Are you able to get a prompt over the uart as shown in the video?
Click to expand...
Click to collapse
GXL:BL1:9ac50e:bb16dc;FEAT:BDFD71BC:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;
TE: 138335
BL2 Built : 10:18:52, Sep 14 2020. gxl g9f162b4-dirty - [email protected]
set vcck to 1120 mv
set vddee to 1000 mv
id=3
DDR4 board
CPU clk: 1200MHz
DDR scramble enabled
DDR4 chl: Rank0+1 @ 1056MHz - FAIL
DDR4 chl: Rank0 @ 1056MHz
bist_test rank: 0 19 05 2e 28 16 3a 17 02 2d 2b 1d 3a 17 02 2c 2c 1c 3d 18 02 2f 27 16 38 706 - PASS
Rank0: 1024MB(auto)-2T-18
AddrBus test pass!
eMMC boot @ 0
sw8 s
emmc switch 3 ok
BL2: rpmb counter: 0x00000020
emmc switch 0 ok
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000, part: 0
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600, part: 0
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x0002b400, part: 0
aml log : R1024 check pass!
Load bl32 from eMMC, src: 0x0004c200, des: 0x01700000, size: 0x0003e200, part: 0
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x0008c200, des: 0x01700000, size: 0x00080e00, part: 0
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(release):129a6bc
NOTICE: BL3-1: Built : 17:09:37, Apr 25 2019
[BL31]: GXL CPU setup!
NOTICE: BL3-1: GXL secure boot!
NOTICE: BL3-1: BL33 decompress pass
mpu_config_enable:system pre init ok
dmc sec lock
[Image: gxl_v1.1.3377-2941e55e3 2020-07-08 17:19:09 [email protected]]
OPS=0xb4
21 0d b4 00 6b a3 4a 05 e8 35 9e 81 38 16 4f b7
[0.733983 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-2: ATOS-V2.4-239-g48b8c37d #1 Wed Feb 5 09:34:09 UTC 2020 arm
INFO: BL3-2: Chip: GXL Rev: D (21 - B0:2)
INFO: BL3-2: crypto engine DMA
INFO: BL3-2: secure time TEE
INFO: BL3-2: CONFIG_DEVICE_SECURE 0xb200000e
U-Boot 2015.01-g2e3e77d-dirty (Nov 07 2020 - 00:20:15), Build: jenkins-aquaman-664
DRAM: 1 GiB
Relocation Offset is: 36e80000
gpio: pin gpiodv_24 (gpio 43) value is 1
register usb cfg[0][1] = 0000000037f4c4f8
[CANVAS]canvas init
MMC: aml_priv->desc_buf = 0x0000000033e80ab0
aml_priv->desc_buf = 0x0000000033e82df0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
co-phase 0x2, tx-dly 0, clock 400000
co-phase 0x2, tx-dly 0, clock 40000000
[mmc_startup] mmc refix success
init_part() 297: PART_TYPE_AML
[mmc_init] mmc init success
aml log : R1024 check pass!
start dts,buffer=0000000033e85640,dt_addr=0000000033e85640
get_partition_from_dts() 71: ret 0
parts: 17
00: logo 0000000000800000 1
01: recovery 0000000001800000 1
02: misc 0000000000800000 1
03: dtbo 0000000000800000 1
04: cri_data 0000000000800000 2
05: param 0000000001000000 2
06: boot 0000000001000000 1
set has_boot_slot = 0
07: rsv 0000000001000000 1
08: tee 0000000002000000 1
09: vendor 0000000006400000 1
10: odm 0000000001400000 1
11: metadata 0000000001000000 1
12: vbmeta 0000000000200000 1
13: system 000000005ac00000 1
14: product 0000000006a00000 1
15: cache 0000000010000000 2
16: data ffffffffffffffff 4
init_part() 297: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x7fd3b243 == storage crc_pattern:0x7fd3b243!!!
mmc env offset: 0x17400000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-2755: calc 6955a20f, store 6955a20f
_verify_dtb_checksum()-2755: calc 6955a20f, store 6955a20f
dtb_read()-2972: total valid 2
update_old_dtb()-2953: do nothing
aml log : R1024 check pass!
vpu: clk_level in dts: 7
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x300)
vpu: vpu_clk_gate_init_off finish
vpp: vpp_init
hpd_state=0
vpp: vpp_matrix_update: 2
cvbs performance type = 6, table = 0
cvbs_config_hdmipll_gxl
cvbs_set_vid2_clk
the HHI_VDAC_CNTL0 =b0001
the HHI_VDAC_CNTL0 =b0200
the HHI_VDAC_CNTL1 =0
the HHI_VDAC_CNTL1 =8
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[region] not programed yet
CONFIG_AVB2: avb2
Start read misc partition datas!
info->magic =
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
reboot_mode:::: cold_boot
[OSD]load fb addr from dts:/meson-fb
[OSD]fb_addr for logo: 0x3f800000
[OSD]load fb addr from dts:/meson-fb
[OSD]fb_addr for logo: 0x3f800000
[OSD]VPP_OFIFO_SIZE:0xfff00fff
[CANVAS]addr=0x3f800000 width=5760, height=2160
[OSD]osd_hw.free_dst_data: 0,719,0,575
Command: bcb uboot-command
Start read misc partition datas!
BCB hasn't any datas,exit!
do_monitor_bt_cmdline
gpio: pin GPIOX_17 (gpio 17) value is 0
gpio: pin GPIOX_17 (gpio 17) value is 1
gpio: pin GPIOX_18 (gpio 18) value is 1
hw_config_start:state = 3
bt_cmdline: fw downloaded
no recovery mod!
gpio: pin GPIOX_8 (gpio 8) value is 1
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
CONFIG_SYSTEM_AS_ROOT: systemroot
system_mode: 1
CONFIG_AVB2: avb2
active_slot: normal avb2: 1
Err imgread(L328):Fmt unsupported!genFmt 0x0 != 0x3
InUsbBurn
[MSG]sof
Set Addr 4
Get DT cfg
Get DT cfg
Get DT cfg
set CFG
Get DT cfg
Get DT cfg
Get DT cfg
Get DT cfg
waitIdentifyTime(751) > timeout(750)
(Re)start USB...
USB0: USB3.0 XHCI init start
Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
** Bad device usb 0 **
active_slot: normal
Err imgread(L328):Fmt unsupported!genFmt 0x0 != 0x3
gxl_aquaman_v1#

kedzior.kedzior said:
Err imgread(L328):Fmt unsupported!genFmt 0x0 != 0x3
Click to expand...
Click to collapse
The above error might be an issue.
at the prompt:
gxl_aquaman_v1#
type:
printenv
and post the output.

Functioner said:
The above error might be an issue.
at the prompt:
gxl_aquaman_v1#
type:
printenv
and post the output.
Click to expand...
Click to collapse
gxl_aquaman_v1#printenv
1080p60hz_deepcolor=444,12bit
480p60hz_deepcolor=rgb,8bit
EnableSelinux=permissive
active_slot=normal
avb2=1
baudrate=115200
bcb_cmd=get_avb_mode;get_valid_slot;
boardid=3
boot_part=boot
bootargs=init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 ro rootwait skip_initramfs reboot_mode_android=normal androidboot.selinux=permissive logo=osd1,loaded,0x3d800000,576cvbs maxcpus=4 vout=576cvbs,enable hdmimode=1080p60hz frac_rate_policy=1 cvbsmode=576cvbs hdmitx=,444,12bit cvbsdrv=0 androidboot.firstboot=0 jtag=apao androidboot.veritymode=enforcing androidboot.hardware=amlogic androidboot.btmacaddr=00:00:00:00:00:00 androidboot.wifimac=00:00:00:00:00:00 androidboot.wificountrycode=US androidboot.bootloader= androidboot.serialno=26919800002433906 androidboot.boardid=3 androidboot.region=none androidboot.reboot_mode=cold_boot page_trace=on androidboot.rpmb_state=0 aml_dt= recovery_part={recovery_part} recovery_offset={recovery_offset} aml_dt= recovery_part={recovery_part} recovery_offset={recovery_offset}
bootcmd=run storeboot
bootdelay=1
bootup_offset=0x1133b50
bootup_size=0x5eec7a
btmac=00:00:00:00:00:00
cmdline_keys=keyman init 0x1234; setkeys;
colorattribute=444,12bit
cvbs_drv=0
cvbsmode=576cvbs
display_bpp=24
display_color_bg=0
display_color_fg=0xffff
display_color_index=24
display_height=576
display_layer=osd1
display_width=720
dtb_mem_addr=0x1000000
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; if test ${wipe_cache} = failed; then run init_display; run storeargs;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi;
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
firstboot=0
frac_rate_policy=1
fs_type=ro rootwait skip_initramfs
hdmimode=1080p60hz
identifyWaitTime=750
init_display=get_rebootmode;echo reboot_mode:::: ${reboot_mode};if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else setenv reboot_mode_android normal;run storeargs;osd open;osd clear;imgread pic logo bootup $loadaddr;bmp display $bootup_offset;bmp scale; fi;fi;
initargs=init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000
jtag=apao
loadaddr=1080000
lock=10001000
maxcpus=4
outputmode=576cvbs
page_trace=on
preboot=run cmdline_keys;run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run init_display;run storeargs;bcb uboot-command;run switch_bootmode;
reboot_mode=cold_boot
reboot_mode_android=normal
recovery_from_flash=get_valid_slot;echo active_slot: ${active_slot};if test ${active_slot} = normal; then setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if itest ${upgrade_step} == 3; then if ext4load mmc 1:2 ${dtb_mem_addr} /recovery/dtb.img; then echo cache dtb.img loaded; fi;if ext4load mmc 1:2 ${loadaddr} /recovery/recovery.img; then echo cache recovery.img loaded; wipeisb; bootm ${loadaddr}; fi;else fi;if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then wipeisb; bootm ${loadaddr}; fi;else setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part=${boot_part} recovery_offset=${recovery_offset};if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;fi;
recovery_from_udisk=setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then echo udisk dtb.img loaded; fi;wipeisb; bootm ${loadaddr};fi;
recovery_offset=0
recovery_part=recovery
region=none
rpmb_state=0
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
serialno=26919800002433906
sn2=3236393139383030303032343333393036
stderr=serial
stdin=serial
stdout=serial
storeargs=get_rebootmode;setenv bootargs ${initargs} ${fs_type} reboot_mode_android=${reboot_mode_android} androidboot.selinux=${EnableSelinux} logo=${display_layer},loaded,${fb_addr},${outputmode} maxcpus=${maxcpus} vout=${outputmode},enable hdmimode=${hdmimode} frac_rate_policy=${frac_rate_policy} cvbsmode=${cvbsmode} hdmitx=${cecconfig},${colorattribute} cvbsdrv=${cvbs_drv} androidboot.firstboot=${firstboot} jtag=${jtag}; setenv bootargs ${bootargs} androidboot.veritymode=enforcing androidboot.hardware=amlogic androidboot.btmacaddr=${btmac} androidboot.wifimac=${wifimac} androidboot.wificountrycode=${wifi_ccode} androidboot.bootloader=${bootloader} androidboot.serialno=${serialno} androidboot.boardid=${boardid} androidboot.region=${region} androidboot.reboot_mode=${reboot_mode};setenv bootargs ${bootargs} page_trace=${page_trace};setenv bootargs ${bootargs} androidboot.rpmb_state=${rpmb_state};
storeboot=get_system_as_root_mode;echo system_mode: ${system_mode};if test ${system_mode} = 1; then setenv fs_type ro rootwait skip_initramfs;run storeargs;fi;get_valid_slot;get_avb_mode;echo active_slot: ${active_slot} avb2: ${avb2};if test ${active_slot} != normal; then setenv bootargs ${bootargs} androidboot.slot_suffix=${active_slot};fi;if test ${avb2} = 0; then if test ${active_slot} = _a; then setenv bootargs ${bootargs} root=/dev/mmcblk0p23;else if test ${active_slot} = _b; then setenv bootargs ${bootargs} root=/dev/mmcblk0p24;fi;fi;fi;if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run update;
switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then setenv reboot_mode_android normal;run storeargs;run recovery_from_flash;else if test ${reboot_mode} = update; then setenv reboot_mode_android normal;run storeargs;run update;else if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;run recovery_from_flash;else if test ${reboot_mode} = cold_boot; then setenv reboot_mode_android normal;run storeargs;else if test ${reboot_mode} = fastboot; then setenv reboot_mode_android normal;run storeargs;fastboot;fi;fi;fi;fi;fi;fi;if monitor_bt_cmdline; then run update; fi;
system_mode=1
try_auto_burn=update 700 750;
update=run try_auto_burn; if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else fi;
upgrade_step=2
usb_burning=update 1000
wifi_ccode=US
wifimac=00:00:00:00:00:00
wipe_cache=successful
wipe_data=successful
Environment size: 7334/65532 bytes

I'm not sure if imgread is being called by the normal boot process, or a recovery process because the device failed to boot.
At the uart prompt type:
imgread dtb boot 0x1000000
imgread kernel boot 0x1080000
bootm 0x1080000
and post the output.
If it's the same error as before, the boot partition might not be flashed with the correct image.

gxl_aquaman_v1#imgread dtb boot 0x1000000
Err imgread(L220):Fmt unsupported! only support 0x3
gxl_aquaman_v1#imgread kernel boot 0x1080000
Err imgread(L328):Fmt unsupported!genFmt 0x0 != 0x3
gxl_aquaman_v1#imgread kernel boot 0x1080000
Err imgread(L328):Fmt unsupported!genFmt 0x0 != 0x3
gxl_aquaman_v1#<INTERRUPT>
gxl_aquaman_v1#bootm 0x1080000
aml log : Sig Check 1830

kedzior.kedzior said:
gxl_aquaman_v1#imgread dtb boot 0x1000000
Err imgread(L220):Fmt unsupported! only support 0x3
Click to expand...
Click to collapse
Are you able to flash the boot partition with the boot image again?
Which version of the firmware did you flash?

Are you able to flash the boot partition with the boot image again?
Yes
Which version of the firmware did you flash?
https://disk.yandex.ru/d/aL5XolrdAbTJ0g How to check it?
Other than this one I have no other
Did you flash it with fastboot or burn mode?
According to the instructions from the post https://forum.xda-developers.com/t/help-please-mdz-24-aa-no-power-led-no-video.4452819/post-87044521
but one of the commands "fastboot oem unlock" not working
"astboot flashing unlock" worked
"fastboot flashing unlock_critical" worked
I notice from the environment that the bootloader is currently locked.
The russian guy in the video mentioned that it is important to keep the older version of the bootloader, because the newer version could lock you out.
What I would try is starting fastboot, and then using the ota source files, flashing all of the partitions again, except NOT the bootloader.
What you could try first is just flashing the boot partition again from whatever firmware you used the last time.
Unfortunately, I do not have the previous works version :/

kedzior.kedzior said:
https://disk.yandex.ru/d/aL5XolrdAbTJ0g How to check it?
Click to expand...
Click to collapse
I will check that version, and will also check which version is the newest version.

At the uart prompt, type:
get_bootloaderversion
and post the version.

Functioner said:
At the uart prompt, type:
get_bootloaderversion
and post the version.
Click to expand...
Click to collapse
gxl_aquaman_v1#get_bootloaderversion
Nieznane polecenie 'get_bootloaderversion' - spróbuj 'help'
C:\adb>fastboot getvar version-bootloader
version-bootloader: U-Boot 2015.01-g2e3e77d-dirty
Finished. Total time: 0.003s

The version of the firmware in backup-Restore.rar from the above yandex link is r293:
Xiaomi/aquaman/aquaman:9/PI/293:user/release-keys
This is quite old. It's from May 26 2020.
If you flashed the tee image from that download, it could have corrupted your device.

thank you very much for your help and your time. I will continue to try to bring my stick back to life

kedzior.kedzior said:
thank you very much for your help and your time. I will continue to try to bring my stick back to life
Click to expand...
Click to collapse
sure, good luck.