黑板小爱救砖成功

zhangjinke

使用这位大佬（GitHub - Vicshs/xiaoai: 小爱音箱固件降级。）的软件尝试降级，然后就启动不起来了，uboot也进不去，后面才发现是支持的s12a，但我的音箱是s12，日志如下：

Switch to boot1 system, because of NOT found SN Code ...
Saving Environment to aml-storage...
[burnup]run cmd[store  read boot1 0x1080000  0x0  0x100000]
[burnup]Read end.
[burnup]Rd:Up sz 0x3a6440 to align 0x1000
[burnup]run cmd[store  read boot1 0x1180000  0x100000  0x3a7000]
[burnup]Read end.
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =bf65830
copy done
load dtb from 0x1000000 ......
ERROR: image is not a fdt - must RESET the board to recover.
load dtb from 0xc402030 ......
ERROR: image is not a fdt - must RESET the board to recover.
Could not find a valid device tree
[rsvmem] no check for rsvmem, should check int kernel
   Loading Ramdisk to 0bdce000, end 0bf25c97 ... OK
ERROR: image is not a fdt - must RESET the board to recover.
FDT creation failed! hanging...### ERROR ### Please RESET the board ###

复制代码

尝试在uboot启动后，读取启动数据前阻止uboot读取启动数据，测试可成功修复，并正常进入系统，方法如下：
上电后，当有部分日志输出时，短接FLASH CE（第9脚）和VCC（第12脚），直到出现如下日志：

GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:800;NAND:0;READ:0;0.0;CHK:0;
TE: 26232

BL2 Built : 18:43:23, Sep  8 2017.
gxl g5190619 - xiaobo.gu@droid12

rn5t618_power_init
Board ID = 0
CPU clk: 1200MHz
DQS calibration enabled
DDR scramble enabled
DDR3 chl: Rank0 @ 792MHz
af_vref ddr_training_win: rank: 0 20 00 4e 43 14 73 1d 00 4a 48 19 78 1d 00 4b 47 17 77 21 00 50 43 12 74 612  rank: 1 33 00 4e 0d 14 73 33 00 4a 11 19 78 34 00 4b 11 17 77 34 00 50 0b 12 74 612
af_vref ddr_bist_window:  rank: 0 1e 00 40 32 20 63 1b 05 3b 36 20 60 1b 01 42 35 20 61 1f 02 3f 32 20 61 612   - PASS

Rank0: 256MB(auto)-2T-11
AddrBus test pass!
NAND init
read start page:00000000
page :00000500
succeed in getting one bbt block!
page :00000540
page :00000580
page :000005c0
select bbt block:00000014
select page:00000001
select page:00000000
bbt status: 00000000000000000000000000000000
Load fip header from NAND, src: 0x00020000, des: 0x01400000, size: 0x00004000
read start page:00000041
New fip structure!
Load bl30 from NAND, src: 0x00024000, des: 0x01100000, size: 0x0000d600
read start page:00000049
Load bl31 from NAND, src: 0x00034000, des: 0x05100000, size: 0x00017400
read start page:00000069
Load bl33 from NAND, src: 0x0004c000, des: 0x01000000, size: 0x00081c00
read start page:00000099
NOTICE:  BL3-1: v1.0(debug):2da3090
NOTICE:  BL3-1: Built : 16:05:52, Jan 19 2017
aml log : bl31 normal boot !
mpu_config_enable:ok
[Image: gxl_v1.1.3170-f392be9 2017-01-04 10:51:57 yun.cai@droid06]
OPS=0xf2
6b ef 54 9f 8 4 a1 de 5f d4 fc f7 [0.482666 Inits done]
secure task start!
high task start!
low task start!
INFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9


U-Boot 2015.01-g85a2387-dirty (Sep 19 2017 - 19:00:12)

DRAM:  256 MiB
Relocation Offset is: 0ef38000
register usb cfg[0][1] = 000000000ffa1290
NAND:  nand id: 200 218
256MiB, SLC, page size: 2048, OOB size: 64
Creating 1 MTD partitions on "ESMT SLC 256MiB 3.3V 8-bit":
0x000000000000-0x000000200000 : "nandboot"
nand id: 200 218
256MiB, SLC, page size: 2048, OOB size: 64
Creating 5 MTD partitions on "ESMT SLC 256MiB 3.3V 8-bit":
0x000000800000-0x000001800000 : "boot0"
0x000001800000-0x000002800000 : "boot1"
0x000002800000-0x000008800000 : "system0"
0x000008800000-0x00000e800000 : "system1"
0x00000e800000-0x000010000000 : "data"
MMC:   In:    serial
Out:   serial
Err:   serial
[burnup]Rd:Up sz 0x800 to align 0x1000
[burnup]run cmd[store  read boot1 0x1000000  0x0  0x1000]
[burnup]Read end.
[burnup]run cmd[store  read boot1 0x149c800  0x49c800  0xa000]
NAND read from offset 49c800 failed -16
nand cmd <NULL> failed
store - STORE sub-system

Usage:
store store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data:
        erase the area which is uboot or data
store erase partition <partition_name>:
        erase the area which partition in u-boot
store erase dtb
store erase key
store disprotect key
store rom_protect on/off
store scrub off|partition size
        scrub the area from offset and size
store dtb iread/read/write addr <size>
        read/write dtb, size is optional
store key read/write addr <size>
        read/write key, size is optional

[burnup]Err:store_read_ops,L63:cmd failed, ret=1, [store  read boot1 0x149c800  0x49c800  0xa000]
Err imgread(L180):Fail to read 0xa000B from part[boot1] at offset 0x49c800
board_late_init(): cmd[imgread dtb ${boot_part} ${dtb_mem_addr}] fail, ret=1
[KM]Error:f[keymanage_dts_parse]L287:not a fdt at 0x0000000001000000
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
[KM]Error:f[keymanage_dts_get_key_device]L80:/unify not parsed yet!
[KM]Error:f[_get_km_ops_by_name]L231:key deviceid not know device 4
[KM]Error:f[key_manage_query_exist]L546:There isn't dts cfg for key[deviceid]
[KM]Error:f[key_manage_query_size]L503:Fail in query key exist
Switch to boot1 system, because of NOT found SN Code ...
Saving Environment to aml-storage...
[burnup]run cmd[store  read boot1 0x1080000  0x0  0x100000]
NAND read from offset 0 failed -16
nand cmd <NULL> failed
store - STORE sub-system

Usage:
store store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data:
        erase the area which is uboot or data
store erase partition <partition_name>:
        erase the area which partition in u-boot
store erase dtb
store erase key
store disprotect key
store rom_protect on/off
store scrub off|partition size
        scrub the area from offset and size
store dtb iread/read/write addr <size>
        read/write dtb, size is optional
store key read/write addr <size>
        read/write key, size is optional

[burnup]Err:store_read_ops,L63:cmd failed, ret=1, [store  read boot1 0x1080000  0x0  0x100000]
Err imgread(L245):Fail to read 0x100000B from part[boot1] at offset 0
resetting ...
GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:800;NAND:81;SD:800;USB:8;LOOP:1;EMMC:800;NAND:0;READ:0;0.0;CHK:0;
TE: 5078972

BL2 Built : 18:43:23, Sep  8 2017.
gxl g5190619 - xiaobo.gu@droid12

rn5t618_power_init
Board ID = 0
CPU clk: 1200MHz
DQS calibration enabled
DDR scramble enabled
DDR3 chl: Rank0 @ 792MHz
af_vref ddr_training_win: rank: 0 22 00 4f 43 14 73 1f 00 4b 48 19 78 1d 00 4c 47 17 78 21 00 50 44 13 75 612  rank: 1 33 00 4f 0c 14 73 34 00 4b 10 19 78 35 00 4c 11 17 78 35 00 50 0b 13 75 612
af_vref ddr_bist_window:  rank: 0 20 02 41 32 20 62 1d 04 3b 36 21 61 1b 01 42 35 22 61 1f 00 3b 33 20 61 612   - PASS

Rank0: 256MB(auto)-2T-11
AddrBus test pass!
NAND init
read start page:00000000
page :00000500
succeed in getting one bbt block!
page :00000540
page :00000580
page :000005c0
select bbt block:00000014
select page:00000001
select page:00000000
bbt status: 00000000000000000000000000000000
Load fip header from NAND, src: 0x00020000, des: 0x01400000, size: 0x00004000
read start page:00000041
New fip structure!
Load bl30 from NAND, src: 0x00024000, des: 0x01100000, size: 0x0000d600
read start page:00000049
Load bl31 from NAND, src: 0x00034000, des: 0x05100000, size: 0x00017400
read start page:00000069
Load bl33 from NAND, src: 0x0004c000, des: 0x01000000, size: 0x00081c00
read start page:00000099
NOTICE:  BL3-1: v1.0(debug):2da3090
NOTICE:  BL3-1: Built : 16:05:52, Jan 19 2017
aml log : bl31 normal boot !
mpu_config_enable:ok
[Image: gxl_v1.1.3170-f392be9 2017-01-04 10:51:57 yun.cai@droid06]
OPS=0xf2
6b ef 54 9f 8 4 a1 de 5f d4 fc f7 [5.534276 Inits done]
secure task start!
high task start!
low task start!
INFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9


U-Boot 2015.01-g85a2387-dirty (Sep 19 2017 - 19:00:12)

DRAM:  256 MiB
Relocation Offset is: 0ef38000
register usb cfg[0][1] = 000000000ffa1290
NAND:  nand id: 200 218
256MiB, SLC, page size: 2048, OOB size: 64
Creating 1 MTD partitions on "ESMT SLC 256MiB 3.3V 8-bit":
0x000000000000-0x000000200000 : "nandboot"
nand id: 200 218
256MiB, SLC, page size: 2048, OOB size: 64
Creating 5 MTD partitions on "ESMT SLC 256MiB 3.3V 8-bit":
0x000000800000-0x000001800000 : "boot0"
0x000001800000-0x000002800000 : "boot1"
0x000002800000-0x000008800000 : "system0"
0x000008800000-0x00000e800000 : "system1"
0x00000e800000-0x000010000000 : "data"
MMC:   In:    serial
Out:   serial
Err:   serial
[burnup]Rd:Up sz 0x800 to align 0x1000
[burnup]run cmd[store  read boot1 0x1000000  0x0  0x1000]
[burnup]Read end.
[burnup]run cmd[store  read boot1 0x149c800  0x49c800  0xa000]
[burnup]Read end.
Err imgread(L209):Fail in fdt check header
board_late_init(): cmd[imgread dtb ${boot_part} ${dtb_mem_addr}] fail, ret=1
[KM]Error:f[keymanage_dts_parse]L287:not a fdt at 0x0000000001000000
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
Saving Environment to aml-storage...
[burnup]run cmd[store  read boot0 0x1080000  0x0  0x100000]
[burnup]Read end.
[burnup]Rd:Up sz 0x8905be to align 0x1000
[burnup]run cmd[store  read boot0 0x1180000  0x100000  0x891000]
[burnup]Read end.
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
load dtb from 0x1000000 ......
ERROR: image is not a fdt - must RESET the board to recover.
load dtb from 0x1a08800 ......
   Loading Kernel Image(COMP_NONE) ... OK
   kernel loaded at 0x01080000, end = 0x018bbc88
[rsvmem] no check for rsvmem, should check int kernel
   Loading Ramdisk to 0bdda000, end 0bf25810 ... OK
   Loading Device Tree to 000000000bdcf000, end 000000000bdd9dbd ... OK

Starting kernel ...

uboot time: 6339582 us
[    0.136572@0] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xb4)
[    0.139044@0] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xb4)
[    0.147279@0] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xb4)
[    0.155144@0] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xb4)
domain-0 init dvfs: 4
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
WARNING: Unimplemented Sip Call: 0x82000036
[ get key is 0x00 , curr_boot is boot0
Booting from boot0
UBI device number 0, total 768 LEBs (97517568 bytes, 93.0 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
/dev/mtd3 is ready now.
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Please press Enter to activate this console.
[    4.740578@1] compat: exports duplicate symbol woken_wake_function (owned by kernel)

mico login:

复制代码

此时音箱led点亮，且可正常进行语音交互，但登录root账户始终密码错误，重启后，root账户也能登录了，救砖成功。

sh8188

大神请教一下
BL2 Built : 18:30:39, Aug 28 2018. axg g56303a2-dirty - liang.yang@droid11-sz

set vcck to 1140 mv
set vddee to 1070 mv
Board ID = 4
CPU clk: 1200MHz
DDR low power enabled
DDR3 chl: Rank0 16bit @ 792MHz - FAIL
DDR4 chl: Rank0 16bit @ 792MHz - FAIL
DDR init failed...
Reset...
AXG:BL1:d1dbf2:a4926f;FEAT:E0DC318C:2000OC:F;EMMC:800;NAND:0;READ:0;0.0;CHK:0;
sdio debug board detected
TE: 23489
请教下这个情况是闪存坏了还是CPU有问题啊

82822173

BL2 Built : 15:46:00, Sep 29 2019. axg g8667414 - sentao.gao@droid08-bj

set vcck to 1140 mv
set vddee to 1070 mv
Board ID = 12
CPU clk: 1200MHz
DDR low power enabled
DDR DQS-calibration enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz - PASS
Rank0: 256MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
NAND init
chk page: 00000500
chk page: 00000540
chk page: 00000580
chk page: 000005c0
bbt blk:00000014
bbt page:00000000
0000000000000000000000000000000000000000000000000000000000000000
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000
FIP HDR CHK: ffffffdb ADDR 0x01700000
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000
FIP HDR CHK: 000000a0 ADDR 0x01700000
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000
FIP HDR CHK: 00000062 ADDR 0x01700000
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000
FIP HDR CHK: ffffffdb ADDR 0x01700000
reset...
AXG:BL1:d1dbf2:a4926f;FEAT:E0DC318C:2000OC:F;EMMC:800;NAND:0;READ:0;0.0;CHK:0;
sdio debug board detected
TE: 23723
一模一样，求教有人知道吗？