Related
Main problem of developing - it's testing / feedback
Of course developers test stuffs by themselfs, but it's seems not enough.
Commercially companies like HTC, Samsung, Motorolla have special people who perform tests.
While our developing is free, in our free time for hobby, so we need community support.
In most cases kernel logs can really help developers to improve and fix annoying bug.
Without logs developers don't have chance to detect problem and fix it, so if u appear on IRC and say "hey, I got SOD 2 minutes ago" it's compete useless.
But if u say "hey, I got SOD while playing sound, here my kernel log" it can be really useful.
Because developers can open this log and see something like this at the end:
Code:
[ 54.323889] kernel BUG at arch/arm/mach-msm/qdsp6_10/pcm_out.c:188!
[ 54.323918] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 54.323940] pgd = c7bf4000
[ 54.323951] [00000000] *pgd=27a12031, *pte=00000000, *ppte=00000000
[ 54.323981] Internal error: Oops: 817 [#1] PREEMPT
[ 54.323996] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state
[ 54.324013] Modules linked in:
[ 54.324034] CPU: 0 Not tainted (2.6.32.9-38066-g672726a-dirty #168)
[ 54.324078] PC is at __bug+0x20/0x2c
[ 54.324114] LR is at release_console_sem+0x1f4/0x208
[ 54.324132] pc : [<c006d7d0>] lr : [<c009cfd0>] psr: 60000013
[ 54.324141] sp : c6b51ed8 ip : c6b51e10 fp : c6b51ee4
[ 54.324159] r10: 0000b5d0 r9 : c6b50000 r8 : 00000000
[ 54.324174] r7 : 00000000 r6 : c579f440 r5 : c7bf89a0 r4 : c6b51f08
[ 54.324192] r3 : 00000000 r2 : 00000000 r1 : 0000a043 r0 : 0000004d
[ 54.324212] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 54.324231] Control: 10c5787d Table: 27bf4019 DAC: 00000015
[ 54.324246]
[ 54.324250] PC: 0xc006d750:
[ 54.324261] d750 e89da800 c03ca921 e1a0c00d e92dd800 e24cb004 e1a0c001 e1a03002 e1a01000
[ 54.324308] d770 e1a0200c e59f0004 eb0b7aea e89da800 c03ca938 e1a0c00d e92dd800 e24cb004
[ 54.324355] d790 e1a0c001 e1a03002 e1a01000 e1a0200c e59f0004 eb0b7adf e89da800 c03ca94f
[ 54.324401] d7b0 e1a0c00d e92dd800 e24cb004 e1a02001 e1a01000 e59f000c eb0b7ad6 e3a03000
[ 54.324447] d7d0 e5833000 eafffffe c03ca966 e1a0c00d e92dd800 e24cb004 e59f0004 e30012db
[ 54.324493] d7f0 ebffffee c03ca97f e1a0c00d e92dd800 e24cb004 e1a01000 e59f000c eb0b7ac5
[ 54.324539] d810 e59f0008 e30012bf ebffffe4 c03ca997 c03ca97f e1a0c00d e92dd800 e24cb004
[ 54.324585] d830 e59f000c eb0b7abb e59f0008 eb0b7ab9 e89da800 c03ca9b7 c03ca9ee e1a0c00d
[ 54.324632]
[ 54.324636] LR: 0xc009cf50:
[ 54.324647] cf50 ea000006 e1a00005 e59f3080 e1a05002 e8930006 e2422001 e1550006 1affffe4
[ 54.324693] cf70 e59f3068 e1a01006 e5932048 ebfffe5c e121f008 eaffffa3 e3a03000 e59f0044
[ 54.324739] cf90 e5823018 eb0068ad e121f008 e1a0200d e3c23d7f e3c3303f e5932004 e2422001
[ 54.324785] cfb0 e5832004 e5933000 e3130002 0a000000 eb0abec0 e35a0000 089dadf0 ebfffe9a
[ 54.324831] cfd0 e89dadf0 c0450c60 c0425bbc c03d1c11 c0425b80 e1a0c00d e92dd830 e24cb004
[ 54.324877] cff0 e59f4028 e5943000 e3530000 089da830 e3a0c000 e3a01001 e1a0300c e59f0010
[ 54.324923] d010 e1a02001 e584c000 ebffe70e e89da830 c0425be0 c0425b9c e1a0c00d e92dd800
[ 54.324969] d030 e24cb004 e1a0200d e3c23d7f e3c3303f e5933004 e3c3333f e3c330ff e3530000
[ 54.325016]
[ 54.325020] SP: 0xc6b51e58:
[ 54.325031] 1e58 5d393838 205b0020 34352020 3332332e 5d333538 ffffffff c6b51ec4 c579f440
[ 54.325077] 1e78 00000000 00000000 c6b51ee4 c6b51e90 c0069aac c00692d4 0000004d 0000a043
[ 54.325123] 1e98 00000000 00000000 c6b51f08 c7bf89a0 c579f440 00000000 00000000 c6b50000
[ 54.325167] 1eb8 0000b5d0 c6b51ee4 c6b51e10 c6b51ed8 c009cfd0 c006d7d0 60000013 ffffffff
[ 54.325213] 1ed8 c6b51f3c c6b51ee8 c0087c4c c006d7bc 00000001 000012c0 0000b5d0 c579f470
[ 54.325259] 1ef8 0000003d 00000000 c7bf89a0 c00b2728 c6b51f08 c6b51f08 c0420340 c572d920
[ 54.325305] 1f18 0000b5d0 c6b51f70 000012c0 000012c0 c6b50000 40207000 c6b51f6c c6b51f40
[ 54.325351] 1f38 c0107c2c c0087b40 297f5aac b46c40c0 40c61004 00000000 00000000 c572d920
[ 54.325398]
[ 54.325402] IP: 0xc6b51d90:
[ 54.325413] 1d90 c6b51e90 c7a09370 c6b51ddc c6b51da8 c006fc60 c006f9ec c6b51dd4 c6b51db8
[ 54.325459] 1db0 c027e8f4 c041fe1c c041fe8c 00000817 c6b51e90 00000000 20000113 0000b5d0
[ 54.325504] 1dd0 c6b51e8c c6b51de0 c0069304 c006fa68 0000a043 c6b50000 c6b51e0c c6b51df8
[ 54.325550] 1df0 c009c978 c009c88c c0425b80 0000a043 c6b51e34 c6b51e10 c009cfd0 c009ca48
[ 54.325596] 1e10 00000000 0000000c 00000036 c6b51e4e c0450d1b c6b51e5d c6b51eac c6b51e38
[ 54.325642] 1e30 c009d618 c009cde8 c6b51ebc 00000002 60000013 0000004d 00000000 205b0003
[ 54.325687] 1e50 34352020 3332332e 5d393838 205b0020 34352020 3332332e 5d333538 ffffffff
[ 54.325733] 1e70 c6b51ec4 c579f440 00000000 00000000 c6b51ee4 c6b51e90 c0069aac c00692d4
[ 54.325780]
[ 54.325784] FP: 0xc6b51e64:
[ 54.325795] 1e64 3332332e 5d333538 ffffffff c6b51ec4 c579f440 00000000 00000000 c6b51ee4
[ 54.325841] 1e84 c6b51e90 c0069aac c00692d4 0000004d 0000a043 00000000 00000000 c6b51f08
[ 54.325886] 1ea4 c7bf89a0 c579f440 00000000 00000000 c6b50000 0000b5d0 c6b51ee4 c6b51e10
[ 54.325932] 1ec4 c6b51ed8 c009cfd0 c006d7d0 60000013 ffffffff c6b51f3c c6b51ee8 c0087c4c
[ 54.325978] 1ee4 c006d7bc 00000001 000012c0 0000b5d0 c579f470 0000003d 00000000 c7bf89a0
[ 54.326023] 1f04 c00b2728 c6b51f08 c6b51f08 c0420340 c572d920 0000b5d0 c6b51f70 000012c0
[ 54.326069] 1f24 000012c0 c6b50000 40207000 c6b51f6c c6b51f40 c0107c2c c0087b40 297f5aac
[ 54.326115] 1f44 b46c40c0 40c61004 00000000 00000000 c572d920 000012c0 0000b5d0 c6b51fa4
[ 54.326162]
[ 54.326166] R4: 0xc6b51e88:
[ 54.326178] 1e88 c0069aac c00692d4 0000004d 0000a043 00000000 00000000 c6b51f08 c7bf89a0
[ 54.326223] 1ea8 c579f440 00000000 00000000 c6b50000 0000b5d0 c6b51ee4 c6b51e10 c6b51ed8
[ 54.326268] 1ec8 c009cfd0 c006d7d0 60000013 ffffffff c6b51f3c c6b51ee8 c0087c4c c006d7bc
[ 54.326314] 1ee8 00000001 000012c0 0000b5d0 c579f470 0000003d 00000000 c7bf89a0 c00b2728
[ 54.326360] 1f08 c6b51f08 c6b51f08 c0420340 c572d920 0000b5d0 c6b51f70 000012c0 000012c0
[ 54.326406] 1f28 c6b50000 40207000 c6b51f6c c6b51f40 c0107c2c c0087b40 297f5aac b46c40c0
[ 54.326452] 1f48 40c61004 00000000 00000000 c572d920 000012c0 0000b5d0 c6b51fa4 c6b51f70
[ 54.326497] 1f68 c0107d9c c0107b80 00000000 00000000 00000008 00000001 00000000 0000b450
[ 54.326543]
[ 54.326547] R5: 0xc7bf8920:
[ 54.326558] 8920 c7bf891c 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.326603] 8940 00000000 00000000 00000000 c0480380 c7bf8950 c7bf8950 00000000 c7bf895c
[ 54.326648] 8960 c7bf895c 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.326692] 8980 00000000 0000c350 0000c350 00000000 40406f00 00000000 00000000 00000000
[ 54.326737] 89a0 00000000 c6b50000 00000002 00400040 00000000 ffffffff 00000065 00000065
[ 54.326782] 89c0 00000065 00000000 c0350da8 00000000 0001184b 0000e9d0 00000001 00000000
[ 54.326827] 89e0 00000000 c0425628 c0425628 00000001 a5f3e77f 0000000c 011eaf1b 00000000
[ 54.326873] 8a00 06aabe75 00000005 011eaf1b 00000000 00000000 00000000 00001ad8 00000000
[ 54.326918]
[ 54.326922] R6: 0xc579f3c0:
[ 54.326933] f3c0 c579f3bc 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.326978] f3e0 000010c3 c579f3e4 c579f3e4 00000003 c7da4cd0 00000000 00000000 c7f1dc00
[ 54.327023] f400 c79ee5fc 00000001 00000000 00000000 00343f00 00349d70 00001fe5 c579f41c
[ 54.327069] f420 c579f41c 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327113] f440 250a4000 ffa06000 00001000 00001000 250a5000 ffa07000 00001000 000002c0
[ 54.327159] f460 00000000 00000000 00000000 00000001 c579f470 c579f470 c50d1000 00000000
[ 54.327205] f480 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327249] f4a0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327294]
[ 54.327298] R9: 0xc6b4ff80:
[ 54.327309] ff80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327354] ffa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327398] ffc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327441] ffe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327485] 0000 00000000 00000002 00000000 c7bf89a0 c0425ad0 00000000 00000035 c7c739b0
[ 54.327530] 0020 c7a09370 c7bf89a0 c7a2f620 c6b50000 c7bf8a38 c7bf8c50 c6b51e8c c6b51e48
[ 54.327576] 0040 c034c880 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327620] 0060 40306f00 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 54.327669] Process Playback Thread (pid: 1216, stack limit = 0xc6b502f0)
[ 54.327687] Stack: (0xc6b51ed8 to 0xc6b52000)
[ 54.327704] 1ec0: c6b51f3c c6b51ee8
[ 54.327730] 1ee0: c0087c4c c006d7bc 00000001 000012c0 0000b5d0 c579f470 0000003d 00000000
[ 54.327755] 1f00: c7bf89a0 c00b2728 c6b51f08 c6b51f08 c0420340 c572d920 0000b5d0 c6b51f70
[ 54.327779] 1f20: 000012c0 000012c0 c6b50000 40207000 c6b51f6c c6b51f40 c0107c2c c0087b40
[ 54.327804] 1f40: 297f5aac b46c40c0 40c61004 00000000 00000000 c572d920 000012c0 0000b5d0
[ 54.327829] 1f60: c6b51fa4 c6b51f70 c0107d9c c0107b80 00000000 00000000 00000008 00000001
[ 54.327854] 1f80: 00000000 0000b450 ab70aa89 000012c0 00000004 c006a144 00000000 c6b51fa8
[ 54.327879] 1fa0: c0069fc0 c0107d64 0000b450 ab70aa89 00000013 0000b5d0 000012c0 ab70a697
[ 54.327904] 1fc0: 0000b450 ab70aa89 000012c0 00000004 00100000 a9d1b8e5 40207000 0000d018
[ 54.327929] 1fe0: ab70c6cc 40306d58 ab7073bf afe0c95c 00000010 00000013 581a447b 32081c20
[ 54.327946] Backtrace:
[ 54.327974] [<c006d7b0>] (__bug+0x0/0x2c) from [<c0087c4c>] (pcm_write+0x118/0x1e0)
[ 54.328024] [<c0087b34>] (pcm_write+0x0/0x1e0) from [<c0107c2c>] (vfs_write+0xb8/0x164)
[ 54.328054] [<c0107b74>] (vfs_write+0x0/0x164) from [<c0107d9c>] (sys_write+0x44/0x70)
[ 54.328072] r8:0000b5d0 r7:000012c0 r6:c572d920 r5:00000000 r4:00000000
[ 54.328120] [<c0107d58>] (sys_write+0x0/0x70) from [<c0069fc0>] (ret_fast_syscall+0x0/0x2c)
[ 54.328138] r8:c006a144 r7:00000004 r6:000012c0 r5:ab70aa89 r4:0000b450
[ 54.328179] Code: e1a01000 e59f000c eb0b7ad6 e3a03000 (e5833000)
[ 54.328200] ---[ end trace 7e446c20b8bf60cf ]---
[ 54.328216] Kernel panic - not syncing: Fatal exception
[ 54.328228] Backtrace:
[ 54.328277] [<c006dad4>] (dump_backtrace+0x0/0x110) from [<c034c1e8>] (dump_stack+0x18/0x1c)
[ 54.328296] r7:c006d7d4 r6:c6b51d67 r5:c006d7d2 r4:c0450820
[ 54.328337] [<c034c1d0>] (dump_stack+0x0/0x1c) from [<c034c250>] (panic+0x64/0x13c)
[ 54.328364] [<c034c1ec>] (panic+0x0/0x13c) from [<c006de64>] (die+0x280/0x2c8)
[ 54.328381] r3:00000001 r2:c6b51d38 r1:0000c846 r0:c03cab72
[ 54.328426] [<c006dbe4>] (die+0x0/0x2c8) from [<c006fa4c>] (__do_kernel_fault+0x6c/0x7c)
[ 54.328456] [<c006f9e0>] (__do_kernel_fault+0x0/0x7c) from [<c006fc60>] (do_page_fault+0x204/0x220)
[ 54.328475] r7:c7a09370 r6:c6b51e90 r5:c7bf89a0 r4:00000000
[ 54.328515] [<c006fa5c>] (do_page_fault+0x0/0x220) from [<c0069304>] (do_DataAbort+0x3c/0x9c)
[ 54.328542] [<c00692c8>] (do_DataAbort+0x0/0x9c) from [<c0069aac>] (__dabt_svc+0x4c/0x60)
[ 54.328562] Exception stack(0xc6b51e90 to 0xc6b51ed8)
[ 54.328579] 1e80: 0000004d 0000a043 00000000 00000000
[ 54.328604] 1ea0: c6b51f08 c7bf89a0 c579f440 00000000 00000000 c6b50000 0000b5d0 c6b51ee4
[ 54.328627] 1ec0: c6b51e10 c6b51ed8 c009cfd0 c006d7d0 60000013 ffffffff
[ 54.328643] r8:00000000 r7:00000000 r6:c579f440 r5:c6b51ec4 r4:ffffffff
[ 54.328687] [<c006d7b0>] (__bug+0x0/0x2c) from [<c0087c4c>] (pcm_write+0x118/0x1e0)
[ 54.328713] [<c0087b34>] (pcm_write+0x0/0x1e0) from [<c0107c2c>] (vfs_write+0xb8/0x164)
[ 54.328741] [<c0107b74>] (vfs_write+0x0/0x164) from [<c0107d9c>] (sys_write+0x44/0x70)
[ 54.328759] r8:0000b5d0 r7:000012c0 r6:c572d920 r5:00000000 r4:00000000
[ 54.328803] [<c0107d58>] (sys_write+0x0/0x70) from [<c0069fc0>] (ret_fast_syscall+0x0/0x2c)
[ 54.328822] r8:c006a144 r7:00000004 r6:000012c0 r5:ab70aa89 r4:0000b450
and it's clear that error caused by sound output code, even we know place where it crashed: "pcm_out.c:188". So we can go and look around.
It give much more chances to fix problem and make android stable
For example, source of "mysterious" SOD problem can be detected via kernel logs.
It don't appear random, it appear only on some condition. It's nice if testers able to find this condition and provide kernel logs to developers.
I will expand this message later with more information.
TBD
im in..ill help all i can...
我代表中国用户感谢你们，i will help what i can
Sent from my HTC HD2 using XDA App
Cotulla, do not forget about russian forum 4pda.ru, are ready to help with tests!
got it |o|
han shui ...
Cotulla, you are the THE MAN! Thanks for all your hard work.
I'll be happy to report any bugs with logs... as soon as someone explains how to create the log or where it is located etc
Hopefully thats what this below means
Cotulla said:
I will expand this message later with more information.
TBD
Click to expand...
Click to collapse
i been reading irc logs and i dont now about developing but i can test and send logs you can count with me there so many builds out there but most important is testing and fixing thank you cottula for your hard work
Im also in.. so i need kernel logger from cotulla.pp.ru right?
Sent from my HD2 using XDA app
20mihalko said:
Im also in.. so i need kernel logger from cotulla.pp.ru right?
Sent from my HD2 using XDA app
Click to expand...
Click to collapse
just took a look through cotulla.pp.ru.... cant seem to find a kernel logger.... got a direct link?
Would like to help if possible.. however, I'm not sure where do we get the kernel log? Is the log currently available for extraction and submission?
Sent from my HTC Leo using XDA App
i think he will be posting that info soon...
I help if i can too !!
Greets from Germany
Anything to help out the development.
Im using Android on a day-by-day basis now, so there's bound to be stuff i could report with
Come on guys, you wont help developers if you just write "ok i will help you" Nobody need that besides this thread is going to be confusing. Please help Cotulla and provide him your logs.
How to create logs:
Download the tool Andlog on Cotullas Homepage: http://cotulla.pp.ru/leo/Android/andlog.exe
After you detect Problems in Android (Sleep of Dead or something) you need to reset your device with the red reset button on the back of your HD2
Don't remove battery!!!
Once WM is booted you can run andlog.exe and it will create a andlog.txt file on the root of your device. Be aware that Andlog dont show any message! (like CLRCAD)
Paste the content here: http://pastebin.com
and link it here in this forum with detailed information
Ok i will start with providing logs:
Got SOD while LEO was in Standby. Waited any seconds but screen stayed black
Log: http://pastebin.com/DPPAd6ep
Iam ready for testing any thing
Sent from my HTC HD2 using Xda application
ok, i got mine already for issues..i will post them when i find them
moorgogel said:
Come on guys, you wont help developers if you just write "ok i will help you" Nobody need that besides this thread is going to be confusing. Please help Cotulla and provide him your logs.
How to create logs:
....
Click to expand...
Click to collapse
ahhh, good man. Thank you.
edit:
I know this should probably be common sense but just to make it clear to everyone who wants to help...
Should we report all (even minor/trivial) bugs or just report major bugs ( such as SOD) for now?
cotulla? moorgogel?
moorgogel, nice guide, thanks!
other method (for non-fatal errors) possible to use ADB from Android SDK.
just put in command line
Code:
adb shell dmesg > dmesg.txt
and u got current kernel log in dmesg.txt.
I know this should probably be common sense but just to make it clear to everyone who wants to help...
Should we report all (even minor/trivial) bugs or just report major bugs ( such as SOD) for now?
Click to expand...
Click to collapse
basically it's not obviously.
some bugs won't show anything in log. for example if BT isn't working in some android build, kernel log won't show anything.
May I ask this is only for reporting sods? I guess I can't report anything when the camera crashes in android for example. Btw I had never got sods. I really have the idea that it is caused by a slow sd card. Edit for other thing I have to use adb.
Normally my N1 goes 30-40, record of 52 days uptime.. Only time I ever have to reboot is when 3G mysteriously won't reconnect or Wifi Tether won't enable.
However the last 12 hours I've had 3-4 full system reboots. This last time I looked and found a /proc/last_kmsg, here's the last bits of it. Can anyone make any sense of this?
Looks to me like some sort of watchdog timeout and the kernel is rebooting itself, a hang... But I can't figure out what could be suddenly causing this. I have not tried anything drastic, such as clearing all and reinstalling the ROM or such, but really nothing has changed on the phone except app updates.
Running Enom's 2.14.3, /system, /data, /sdcard, /cache etc all have reasonable space available, each time I wasn't really doing anything with the phone, most times it was actually just in my phone holster and I felt the vibration. Didn't have wifi tether on, etc.. At least one time I had wifi on, but this last time no wifi at work..
[ 1101.675750] suspend: enter suspend
[ 1101.675933] PM: Syncing filesystems ...
[ 1101.845550] save exit: isCheckpointed 1
[ 1105.169342] done.
[ 1105.169494] Freezing user space processes ...
[ 1105.174652] active wake lock PowerManagerService
[ 1105.174957]
[ 1105.175109] Freezing of tasks aborted after 0.00 seconds (477 tasks refusing to freeze):
[ 1105.176361]
[ 1105.176513] Restarting tasks ... done.
[ 1105.186279] suspend: exit suspend, ret = -16 (2011-06-28 15:05:28.001800560 UTC)
[ 1105.186553] active wake lock PowerManagerService
[ 1105.186676] suspend: abort suspend
[ 1111.200378] save exit: isCheckpointed 1
[ 1118.112091] suspend: enter suspend
[ 1118.112274] PM: Syncing filesystems ...
[ 1118.292663] save exit: isCheckpointed 1
[ 1123.845977] done.
[ 1123.846130] Freezing user space processes ... (elapsed 0.08 seconds) done.
[ 1123.927978] Freezing remaining freezable tasks ... (elapsed 0.00 seconds) done.
[ 1126.927276] **** DPM device timeout: mmc1:0001 (mmcblk)
[ 1126.928009] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 1126.928405] pgd = c0004000
[ 1126.929077] [00000000] *pgd=00000000
[ 1126.929779] Internal error: Oops: 817 [#1] PREEMPT
[ 1126.930145] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state
[ 1126.930847] Modules linked in: ipv6 ext4 jbd2
[ 1126.932891] CPU: 0 Not tainted (2.6.32.25-TheOfficial-AudioMOD-720p #1)
[ 1126.933319] PC is at dpm_drv_timeout+0x24/0x34
[ 1126.934020] LR is at dpm_drv_timeout+0x20/0x34
[ 1126.934417] pc : [<c01aabc8>] lr : [<c01aabc4>] psr: 20000013
[ 1126.934417] sp : c03ddee8 ip : 00000000 fp : 00000103
[ 1126.935455] r10: c042f36c r9 : c03ddef8 r8 : c042f56c
[ 1126.935821] r7 : c042f76c r6 : c042f96c r5 : c03dc000 r4 : c042eb60
[ 1126.936492] r3 : 00000000 r2 : c03ddedc r1 : c038d1b4 r0 : 00000041
[ 1126.937194] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 1126.937561] Control: 10c5787d Table: 273ac019 DAC: 00000035
[ 1126.938232]
[ 1126.938232] PC: 0xc01aab48:
[ 1126.938934] ab48 e5913020 e3530000 0a00000e e12fff33 e5942020 ea000004 e5943024 e3530000
[ 1126.942749] ab68 0a000008 e12fff33 e5942024 e2504000 0a000005 e59f1018 e1a03004 e59f0014
[ 1126.946563] ab88 eb050d06 ea000000 e3a04000 e1a00004 e8bd8010 c030e3c8 c038d191 e92d4010
[ 1126.950012] aba8 e5903044 e5901008 e3530000 e59f0014 15932000 059f2010 eb050cf8 e3a03000
[ 1126.953765] abc8 e5833000 eafffffd c038d1b4 c038d1aa e3510008 e1a0c003 e92d4007 e1a0e002
[ 1126.957214] abe8 e5903008 059f2090 0a00001d ca000008 e3510002 059f2084 0a000019 e3510004
[ 1126.960662] ac08 059f207c 0a000016 e3510001 1a000013 ea00000e e3510020 059f2068 0a000010
[ 1126.964416] ac28 ca000002 e3510010 1a00000c ea000005 e3510040 059f2050 0a000009 e3510080
[ 1126.968170]
[ 1126.968200] LR: 0xc01aab44:
[ 1126.968872] ab44 ea000005 e5913020 e3530000 0a00000e e12fff33 e5942020 ea000004 e5943024
[ 1126.972656] ab64 e3530000 0a000008 e12fff33 e5942024 e2504000 0a000005 e59f1018 e1a03004
[ 1126.976074] ab84 e59f0014 eb050d06 ea000000 e3a04000 e1a00004 e8bd8010 c030e3c8 c038d191
[ 1126.979553] aba4 e92d4010 e5903044 e5901008 e3530000 e59f0014 15932000 059f2010 eb050cf8
[ 1126.983337] abc4 e3a03000 e5833000 eafffffd c038d1b4 c038d1aa e3510008 e1a0c003 e92d4007
[ 1126.987060] abe4 e1a0e002 e5903008 059f2090 0a00001d ca000008 e3510002 059f2084 0a000019
[ 1126.990814] ac04 e3510004 059f207c 0a000016 e3510001 1a000013 ea00000e e3510020 059f2068
[ 1126.994293] ac24 0a000010 ca000002 e3510010 1a00000c ea000005 e3510040 059f2050 0a000009
[ 1126.998077]
[ 1126.998077] SP: 0xc03dde68:
[ 1126.998779] de68 c03dde9c 3131205b 392e3632 37323732 00205d36 c79bdf94 00000000 00000001
[ 1127.002563] de88 c79b0a08 ffffffff c03dded4 c042f96c c042f76c c0025a6c 00000041 c038d1b4
[ 1127.006347] dea8 c03ddedc 00000000 c042eb60 c03dc000 c042f96c c042f76c c042f56c c03ddef8
[ 1127.010131] dec8 c042f36c 00000103 00000000 c03ddee8 c01aabc4 c01aabc8 20000013 ffffffff
[ 1127.013580] dee8 c042eb60 c005fccc ffffffff c01aaba4 c03ddef8 c03ddef8 2aea5e9e c03dc000
[ 1127.017364] df08 00000101 00000004 c042e9c0 00000103 0000000a c03e7640 00000000 c005b1cc
[ 1127.021118] df28 00000000 c002f4b8 c03ea174 00000001 c03dc000 00000007 00000000 c040b624
[ 1127.024871] df48 00000002 00000001 c03dc000 00000000 00000000 c005b298 00000007 c002506c
[ 1127.028289]
[ 1127.028320] R1: 0xc038d134:
[ 1127.029296] d134 656c6269 72656b00 5f6c656e 0078616d 6d726966 65726177 69726400 73726576
[ 1127.032806] d154 7361622f 65642f65 73657276 3c00632e 73253e33 3a732520 69616620 2064656c
[ 1127.036529] d174 61206f74 636f6c6c 20657461 73616c63 6f632073 6961746e 0a72656e 3e333c00
[ 1127.040283] d194 29287325 7025203a 65722046 6e727574 64252073 6f6e000a 69726420 00726576
[ 1127.044036] d1b4 2a3e303c 202a2a2a 204d5044 69766564 74206563 6f656d69 203a7475 28207325
[ 1127.047485] d1d4 0a297325 73657200 00656d75 65657266 7100657a 73656975 68006563 72656269
[ 1127.051300] d1f4 6574616e 61687400 65720077 726f7473 65720065 65766f63 75280072 6f6e6b6e
[ 1127.055084] d214 50206e77 7665204d 29746e65 3e333c00 203a4d50 69766544 25206563 61662073
[ 1127.058563]
[ 1127.058593] R2: 0xc03dde5c:
[ 1127.059570] de5c 00000106 60000013 00000030 c03dde9c 3131205b 392e3632 37323732 00205d36
[ 1127.063385] de7c c79bdf94 00000000 00000001 c79b0a08 ffffffff c03dded4 c042f96c c042f76c
[ 1127.066833] de9c c0025a6c 00000041 c038d1b4 c03ddedc 00000000 c042eb60 c03dc000 c042f96c
[ 1127.070587] debc c042f76c c042f56c c03ddef8 c042f36c 00000103 00000000 c03ddee8 c01aabc4
[ 1127.074371] dedc c01aabc8 20000013 ffffffff c042eb60 c005fccc ffffffff c01aaba4 c03ddef8
[ 1127.077819] defc c03ddef8 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103 0000000a
[ 1127.081604] df1c c03e7640 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001 c03dc000
[ 1127.085388] df3c 00000007 00000000 c040b624 00000002 00000001 c03dc000 00000000 00000000
[ 1127.089172]
[ 1127.089172] R4: 0xc042eae0:
[ 1127.089843] eae0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.093597] eb00 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001
[ 1127.097076] eb20 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.100799] eb40 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.104553] eb60 00000000 00014161 00014160 c042eb6c c042eb6c c042eb74 c042eb74 c042eb7c
[ 1127.108337] eb80 c042eb7c c042eb84 c042eb84 c042eb8c c042eb8c c042eb94 c042eb94 c042eb9c
[ 1127.111785] eba0 c042eb9c c042eba4 c042eba4 c042ebac c042ebac c042ebb4 c042ebb4 c042ebbc
[ 1127.115234] ebc0 c042ebbc c042ebc4 c042ebc4 c042ebcc c042ebcc c042ebd4 c042ebd4 c042ebdc
[ 1127.119018]
[ 1127.119049] R5: 0xc03dbf80:
[ 1127.119750] bf80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.123504] bfa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.127258] bfc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.130676] bfe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.134094] c000 00000002 00000105 00000000 c03ded08 c03e76c0 00000000 00000035 c03ded08
[ 1127.137847] c020 c03dc000 c03e7208 c03deeb4 00000000 c73e0cc0 c7915360 c03ddfc4 c03ddf80
[ 1127.141632] c040 c02ee40c 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[ 1127.145080] c060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.148803]
[ 1127.148803] R6: 0xc042f8ec:
[ 1127.149505] f8ec c042f8ec c042f8ec c042f8f4 c042f8f4 c042f8fc c042f8fc c042f904 c042f904
[ 1127.152984] f90c c042f90c c042f90c c042f914 c042f914 c042f91c c042f91c c042f924 c042f924
[ 1127.156768] f92c c042f92c c042f92c c042f934 c042f934 c042f93c c042f93c c042f944 c042f944
[ 1127.160552] f94c c042f94c c042f94c c042f954 c042f954 c042f95c c042f95c c042f964 c042f964
[ 1127.164031] f96c c042f96c c042f96c c042f974 c042f974 c042f97c c042f97c c042f984 c042f984
[ 1127.167816] f98c c042f98c c042f98c c042f994 c042f994 c042f99c c042f99c c042f9a4 c042f9a4
[ 1127.171569] f9ac c042f9ac c042f9ac c042f9b4 c042f9b4 c042f9bc c042f9bc c042f9c4 c042f9c4
[ 1127.175018] f9cc c042f9cc c042f9cc c042f9d4 c042f9d4 c042f9dc c042f9dc c042f9e4 c042f9e4
[ 1127.178771]
[ 1127.178771] R7: 0xc042f6ec:
[ 1127.179779] f6ec c042f6ec c042f6ec c042f6f4 c042f6f4 c042f6fc c042f6fc c042f704 c042f704
[ 1127.183288] f70c c042f70c c042f70c c042f714 c042f714 c042f71c c042f71c c042f724 c042f724
[ 1127.187072] f72c c042f72c c042f72c c042f734 c042f734 c042f73c c042f73c c042f744 c042f744
[ 1127.190795] f74c c042f74c c042f74c c042f754 c042f754 c042f75c c042f75c c042f764 c042f764
[ 1127.194213] f76c c042f76c c042f76c c042f774 c042f774 c042f77c c042f77c c042f784 c042f784
[ 1127.197998] f78c c042f78c c042f78c c042f794 c042f794 c042f79c c042f79c c042f7a4 c042f7a4
[ 1127.201782] f7ac c7d29264 c7d3d264 c042f7b4 c042f7b4 c042f7bc c042f7bc c042f7c4 c042f7c4
[ 1127.205566] f7cc c042f7cc c042f7cc c042f7d4 c042f7d4 c042f7dc c042f7dc c042f7e4 c042f7e4
[ 1127.209014]
[ 1127.209014] R8: 0xc042f4ec:
[ 1127.210021] f4ec c042f4ec c042f4ec c042f4f4 c042f4f4 c042f4fc c042f4fc c042f504 c042f504
[ 1127.213500] f50c c042f50c c042f50c c042f514 c042f514 c042f51c c042f51c c042f524 c042f524
[ 1127.217285] f52c c042f52c c042f52c c042f534 c042f534 c042f53c c042f53c c042f544 c042f544
[ 1127.221069] f54c c042f54c c042f54c c042f554 c042f554 c042f55c c042f55c c042f564 c042f564
[ 1127.224822] f56c c042f56c c042f56c c042f574 c042f574 c042f57c c042f57c c042f584 c042f584
[ 1127.228271] f58c c042f58c c042f58c c042f594 c042f594 c04b71e4 c04b71e4 c042f5a4 c042f5a4
[ 1127.232055] f5ac c042f5ac c042f5ac c042f5b4 c042f5b4 c042f5bc c042f5bc c042f5c4 c042f5c4
[ 1127.235534] f5cc c042f5cc c042f5cc c042f5d4 c042f5d4 c042f5dc c042f5dc c042f5e4 c042f5e4
[ 1127.239288]
[ 1127.239288] R9: 0xc03dde78:
[ 1127.239990] de78 00205d36 c79bdf94 00000000 00000001 c79b0a08 ffffffff c03dded4 c042f96c
[ 1127.243743] de98 c042f76c c0025a6c 00000041 c038d1b4 c03ddedc 00000000 c042eb60 c03dc000
[ 1127.247222] deb8 c042f96c c042f76c c042f56c c03ddef8 c042f36c 00000103 00000000 c03ddee8
[ 1127.250976] ded8 c01aabc4 c01aabc8 20000013 ffffffff c042eb60 c005fccc ffffffff c01aaba4
[ 1127.254455] def8 c03ddef8 c03ddef8 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103
[ 1127.258209] df18 0000000a c03e7640 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001
[ 1127.261688] df38 c03dc000 00000007 00000000 c040b624 00000002 00000001 c03dc000 00000000
[ 1127.265411] df58 00000000 c005b298 00000007 c002506c ffffffff f8000000 c040b624 c0025acc
[ 1127.269165]
[ 1127.269165] R10: 0xc042f2ec:
[ 1127.269866] f2ec c042f2ec c042f2ec c042f2f4 c042f2f4 c042f2fc c042f2fc c042f304 c042f304
[ 1127.273651] f30c c042f30c c042f30c c042f314 c042f314 c042f31c c042f31c c042f324 c042f324
[ 1127.277435] f32c c042f32c c042f32c c042f334 c042f334 c042f33c c042f33c c042f344 c042f344
[ 1127.280914] f34c c042f34c c042f34c c042f354 c042f354 c042f35c c042f35c c042f364 c042f364
[ 1127.284698] f36c c042f36c c042f36c c042f374 c042f374 c03e9678 c043301c c042f384 c042f384
[ 1127.288482] f38c c0403078 bf0ccb0c c04072f0 c04072f0 c042f39c c042f39c c042f3a4 c042f3a4
[ 1127.291961] f3ac c042f3ac c042f3ac c042f3b4 c042f3b4 c04069f8 c04069f8 c042f3c4 c042f3c4
[ 1127.295776] f3cc c042f3cc c042f3cc c042f3d4 c042f3d4 c042f3dc c042f3dc c042f3e4 c042f3e4
[ 1127.299591] Process swapper (pid: 0, stack limit = 0xc03dc2f0)
[ 1127.299957] Stack: (0xc03ddee8 to 0xc03de000)
[ 1127.300659] dee0: c042eb60 c005fccc ffffffff c01aaba4 c03ddef8 c03ddef8
[ 1127.301361] df00: 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103 0000000a c03e7640
[ 1127.301757] df20: 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001 c03dc000 00000007
[ 1127.302459] df40: 00000000 c040b624 00000002 00000001 c03dc000 00000000 00000000 c005b298
[ 1127.303161] df60: 00000007 c002506c ffffffff f8000000 c040b624 c0025acc 00000002 00000006
[ 1127.303558] df80: 0ba61847 00000000 c03dc000 c03df9c0 c040b624 c03df9b8 20020d74 510f00f2
[ 1127.304229] dfa0: 00000000 00000000 0e873c8d c03ddfc0 c0026a60 c0026a64 20000013 ffffffff
[ 1127.304931] dfc0: c03dc000 c0026cd0 c0432efc 00000000 c0022e0c c000891c c0008474 00000000
[ 1127.305664] dfe0: 00000000 c0022e10 00000000 10c53c7d c040b6d0 20008034 00000000 00000000
[ 1127.306091] [<c01aabc8>] (dpm_drv_timeout+0x24/0x34) from [<c005fccc>] (run_timer_softirq+0x16c/0x21c)
[ 1127.306823] [<c005fccc>] (run_timer_softirq+0x16c/0x21c) from [<c005b1cc>] (__do_softirq+0x70/0xf8)
[ 1127.307556] [<c005b1cc>] (__do_softirq+0x70/0xf8) from [<c005b298>] (irq_exit+0x44/0xa8)
[ 1127.308288] [<c005b298>] (irq_exit+0x44/0xa8) from [<c002506c>] (asm_do_IRQ+0x6c/0x84)
[ 1127.308685] [<c002506c>] (asm_do_IRQ+0x6c/0x84) from [<c0025acc>] (__irq_svc+0x4c/0x8c)
[ 1127.309356] Exception stack(0xc03ddf78 to 0xc03ddfc0)
[ 1127.310058] df60: 00000002 00000006
[ 1127.310455] df80: 0ba61847 00000000 c03dc000 c03df9c0 c040b624 c03df9b8 20020d74 510f00f2
[ 1127.311157] dfa0: 00000000 00000000 0e873c8d c03ddfc0 c0026a60 c0026a64 20000013 ffffffff
[ 1127.311889] [<c0025acc>] (__irq_svc+0x4c/0x8c) from [<c0026a64>] (default_idle+0x24/0x28)
[ 1127.312286] [<c0026a64>] (default_idle+0x24/0x28) from [<c0026cd0>] (cpu_idle+0x48/0xa0)
[ 1127.312988] [<c0026cd0>] (cpu_idle+0x48/0xa0) from [<c000891c>] (start_kernel+0x26c/0x2c4)
[ 1127.313690] [<c000891c>] (start_kernel+0x26c/0x2c4) from [<20008034>] (0x20008034)
[ 1127.314392] Code: 15932000 059f2010 eb050cf8 e3a03000 (e5833000)
[ 1127.314788] ---[ end trace f32b239b02090df3 ]---
[ 1127.315460] Kernel panic - not syncing: Fatal exception in interrupt
[ 1127.315826] Rebooting in 5 seconds..
[ 1132.273376] Restarting Linux version 2.6.32.25-TheOfficial-AudioMOD-720p ([email protected]) (gcc version 4.4.0 (GCC) ) #1 PREEMPT Fri Nov 12 21:52:57 EST 2010
[ 1132.273437]
No errors detected
Given I had used the 720 AudioFix kernel for about 4-5 months I am not sure why, but I switched to the 720 kernel without AudioFix and my n1 hasn't rebooted in a few days. Probably going to switch back to see what happens.
I am wondering if something needed refreshing, which is a little worrying..
khaytsus said:
Given I had used the 720 AudioFix kernel for about 4-5 months I am not sure why, but I switched to the 720 kernel without AudioFix and my n1 hasn't rebooted in a few days. Probably going to switch back to see what happens.
I am wondering if something needed refreshing, which is a little worrying..
Click to expand...
Click to collapse
I hope u get it sorted. I'm also on Enom 2.14. No problems. Love it, especially the raw performance compared to all other ROMs.
ksc6000 said:
I hope u get it sorted. I'm also on Enom 2.14. No problems. Love it, especially the raw performance compared to all other ROMs.
Click to expand...
Click to collapse
Yeah it's weird, I have had virtually zero problems from Enom's ROM until that day, 3-4 spontaneous reboots. And none since! I don't know if switching or refreshing the kernel "fixed" it or if it was something else.
Installed the latest update from Huawei and got backups of the /system dir and the image too. Should help the devs get some libraries for their roms.
/system
rooted image
UPDATE: THIS IS ONLY FOR USERS OF THE u8800 2.3.5 OFFICIAL UPDATE!
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
REMOVED no working.
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance
Concerning the recovery i tried to recompile it with no luck i dunno what has changed to 2.3.5 went over the mount points again it all seemed good to me at recovery.fstab.
Anyway here is the log from /proc/kmsg where it fails.
Anyone more experienced can have a look as i'm totally in the dark here.
Code:
<3>[92, recovery] [ 5.227172] nt35582_lcd_on: nt35582_lcd exit sleep mode ,on_ret=0
<1>[92, recovery] [ 5.227325] Unable to handle kernel NULL pointer dereference at virtual address 00000080
<1>[92, recovery] [ 5.227325] pgd = cee70000
<1>[92, recovery] [ 5.227355] [00000080] *pgd=0f061031, *pte=00000000, *ppte=00000000
<0>[92, recovery] [ 5.227355] Internal error: Oops: 17 [#1] PREEMPT
<0>[92, recovery] [ 5.227386] last sysfs file: /sys/devices/i2c-3/i2c-dev/i2c-3/uevent
<4>[92, recovery] [ 5.227386] Modules linked in:
<4>[92, recovery] [ 5.227386] CPU: 0 Tainted: G W (2.6.32.9-perf #73)
<4>[92, recovery] [ 5.227416] PC is at msm_rpc_call_reply+0x28/0x16c
<4>[92, recovery] [ 5.227416] LR is at msm_rpc_call+0x1c/0x24
<4>[92, recovery] [ 5.227447] pc : [<c005ad9c>] lr : [<c005aefc>] psr: 20000013
<4>[92, recovery] [ 5.227447] sp : cee49d70 ip : 0000000a fp : 000c60a4
<4>[92, recovery] [ 5.227447] r10: 00000030 r9 : cee0f1e0 r8 : 0000000a
<4>[92, recovery] [ 5.227478] r7 : 00000049 r6 : 00000000 r5 : 00000000 r4 : cee49db8
<4>[92, recovery] [ 5.227478] r3 : 00000030 r2 : cee49db8 r1 : 00000049 r0 : 00000000
<4>[92, recovery] [ 5.227478] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
<4>[92, recovery] [ 5.227508] Control: 10c57c7d Table: 0f070059 DAC: 00000015
<4>[92, recovery] [ 5.227508]
<4>[92, recovery] [ 5.227508] PC: 0xc005ad1c:
<4>[92, recovery] [ 5.227539] ad1c e3520000 05843000 0a000010 ebfff31b e1a05000 e5840000 ea000008 e5912200
<4>[92, recovery] [ 5.227539] ad3c eb08fb07 e59d3004 e1a00003 e5934204 e5933200 e0855003 eb03ccb2 e58d4004
<4>[92, recovery] [ 5.227569] ad5c e59d3004 e1a00005 e2531000 1afffff2 e1a00006 e8bd807c e3530027 e92d45f7
<4>[92, recovery] [ 5.227600] ad7c e59d6028 e1a0a003 e1a05000 e1a07001 e1a04002 e59d8030 93e0af83 9a00004d
<4>[92, recovery] [ 5.227630] ad9c e5903080 e3730001 03e0a06a 0a000049 e1a00002 e3a01028 eb08fcc1 e59f211c
<4>[92, recovery] [ 5.227661] adbc e1923f9f e2833001 e1821f93 e3310000 1afffffa e0231863 e3c118ff e3a02402
<4>[92, recovery] [ 5.227661] addc e5842008 e1a00005 e1a01421 e1a0200a e0213463 e5843000 e5953088 e1a01004
<4>[92, recovery] [ 5.227691] adfc e027c867 e3ccc8ff e584300c e595308c e1a0c42c e02c7467 e5847014 e5843010
<4>[92, recovery] [ 5.227722]
<4>[92, recovery] [ 5.227722] LR: 0xc005ae7c:
<4>[92, recovery] [ 5.227722] ae7c eb03cc68 eaffffe9 e5913008 e3530000 13e0a000 1a00000d e5913014 e3530000
<4>[92, recovery] [ 5.227752] ae9c 13e0a015 1a000009 e3560000 01a0a006 0a000006 e59d302c e15a0003 c3e0a00b
<4>[92, recovery] [ 5.227783] aebc ca000002 e1a00006 e1a0200a eb08faa4 e59d0004 eb03cc53 e1a0000a e8bd85fe
<4>[92, recovery] [ 5.227813] aedc c0770c2c e92d401f e3a0c000 e58dc004 e58dc000 e59dc018 e58dc008 ebffff9d
<4>[92, recovery] [ 5.227844] aefc e28dd014 e8bd8000 e92d45f0 e24dd01c e3a03006 e1a04000 e58d3004 e59f327c
<4>[92, recovery] [ 5.227844] af1c e5901078 e590207c e5933000 e58d1008 e3130004 e58d200c 0a000001 e59f0260
<4>[92, recovery] [ 5.227874] af3c eb14e183 e10f5000 f10c0080 e1a0100d e3c13d7f e3c3303f e5932004 e2822001
<4>[92, recovery] [ 5.227905] af5c e5832004 e59f723c e28d8004 e5b76010 ea000013 ebfff475 e250a000 aa00000f
<4>[92, recovery] [ 5.227935]
<4>[92, recovery] [ 5.227935] SP: 0xcee49cf0:
<4>[92, recovery] [ 5.227935] 9cf0 cfdd7600 cee49d54 00000000 cee49d54 cfdd7600 cee49d64 00000000 cee49d64
<4>[92, recovery] [ 5.227966] 9d10 cfdd7600 ffffffff cee49d5c 00000000 00000049 c0037aac 00000000 00000049
<4>[92, recovery] [ 5.227996] 9d30 cee49db8 00000030 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0
<4>[92, recovery] [ 5.228027] 9d50 00000030 000c60a4 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff
<4>[92, recovery] [ 5.228027] 9d70 00000000 00000049 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001
<4>[92, recovery] [ 5.228057] 9d90 cf227d60 c005aefc 00000000 00000000 0000000a 00000030 cfd74254 c0401678
<4>[92, recovery] [ 5.228088] 9db0 0000000a 0000013c cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001
<4>[92, recovery] [ 5.228118] 9dd0 00000000 cfda5024 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728
<4>[92, recovery] [ 5.228118]
<4>[92, recovery] [ 5.228149] R2: 0xcee49d38:
<4>[92, recovery] [ 5.228149] 9d38 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0 00000030 000c60a4
<4>[92, recovery] [ 5.228179] 9d58 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff 00000000 00000049
<4>[92, recovery] [ 5.228179] 9d78 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc
<4>[92, recovery] [ 5.228210] 9d98 00000000 00000000 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c
<4>[92, recovery] [ 5.228240] 9db8 cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024
<4>[92, recovery] [ 5.228271] 9dd8 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000
<4>[92, recovery] [ 5.228302] 9df8 ffffffff cfd74008 c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000
<4>[92, recovery] [ 5.228302] 9e18 cfd74000 c02b9cfc cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0
<4>[92, recovery] [ 5.228332]
<4>[92, recovery] [ 5.228332] R4: 0xcee49d38:
<4>[92, recovery] [ 5.228363] 9d38 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0 00000030 000c60a4
<4>[92, recovery] [ 5.228363] 9d58 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff 00000000 00000049
<4>[92, recovery] [ 5.228393] 9d78 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc
<4>[92, recovery] [ 5.228424] 9d98 00000000 00000000 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c
<4>[92, recovery] [ 5.228454] 9db8 cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024
<4>[92, recovery] [ 5.228454] 9dd8 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000
<4>[92, recovery] [ 5.228485] 9df8 ffffffff cfd74008 c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000
<4>[92, recovery] [ 5.228515] 9e18 cfd74000 c02b9cfc cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0
<4>[92, recovery] [ 5.228546]
<4>[92, recovery] [ 5.228546] R9: 0xcee0f160:
<4>[92, recovery] [ 5.228546] f160 cee10f20 c0153000 00000000 00000000 c05a6db4 00000000 00020001 0000001e
<4>[92, recovery] [ 5.228576] f180 00000004 00000000 00000000 00000000 00000000 00000000 00000000 cf5689c0
<4>[92, recovery] [ 5.228607] f1a0 00000000 00000000 00000000 00000000 00000000 00000000 ffffffff ffffffff
<4>[92, recovery] [ 5.228607] f1c0 00000000 00000000 cf3f16e0 cee0f1cc cee0f1cc cf5bcf4c 00000000 00000000
<4>[92, recovery] [ 5.228637] f1e0 cee10b20 cf412e74 cfdf5220 cf5f3d18 c05bc07c 00000001 00020002 0000001f
<4>[92, recovery] [ 5.228668] f200 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cee03b00
<4>[92, recovery] [ 5.228698] f220 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[92, recovery] [ 5.228729] f240 00000000 00000000 cfd74000 cee0f24c cee0f24c cee01454 00000000 00000000
<0>[92, recovery] [ 5.228729] Process recovery (pid: 92, stack limit = 0xcee482e8)
<0>[92, recovery] [ 5.228759] Stack: (0xcee49d70 to 0xcee4a000)
<0>[92, recovery] [ 5.228759] 9d60: 00000000 00000049 cee49db8 cfd74254
<0>[92, recovery] [ 5.228790] 9d80: 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc 00000000 00000000
<0>[92, recovery] [ 5.228790] 9da0: 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c cee40001 cee49dcf
<0>[92, recovery] [ 5.228820] 9dc0: cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024 00000000 c031eaf8
<0>[92, recovery] [ 5.228820] 9de0: 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000 ffffffff cfd74008
<0>[92, recovery] [ 5.228851] 9e00: c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000 cfd74000 c02b9cfc
<0>[92, recovery] [ 5.228881] 9e20: cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0 cee013b8 00000000
<0>[92, recovery] [ 5.228881] 9e40: c0154f44 cf5f3d18 cee0f1e0 c01551a4 cee013b8 00000000 00000000 cee0f1e0
<0>[92, recovery] [ 5.228912] 9e60: cee013b8 cfdf5220 00000000 c0154f44 cf5f3d18 00000001 000c60a4 c01503b0
<0>[92, recovery] [ 5.228912] 9e80: cf5f3d18 cfdf5220 00020002 cee0f1e0 cee03b00 cee49ef0 00000000 cfd6d000
<0>[92, recovery] [ 5.228942] 9ea0: cee48000 00000001 000c60a4 c0150598 00000000 cee03b00 00000026 00020003
<0>[92, recovery] [ 5.228942] 9ec0: 00000026 c015dfac cf4d0aa0 00004b3a 00000000 00020002 00000000 c02ed3dc
<0>[92, recovery] [ 5.228973] 9ee0: cee49fb0 c003f6f0 000c8e84 0000081f cfdf5220 cf5f3d18 c02ecae4 00000001
<0>[92, recovery] [ 5.229003] 9f00: 00004b3a 00000000 cf601798 00000101 00000001 00000000 00004b3a 00000003
<0>[92, recovery] [ 5.229003] 9f20: c0038128 c015fce4 cee48000 001a9000 00100077 00000004 cf2e10ec 00020003
<0>[92, recovery] [ 5.229034] 9f40: 00000000 cee0f1e0 00000000 00020002 cfde2804 cee48000 00000004 00000000
<0>[92, recovery] [ 5.229034] 9f60: 00000004 00020002 00000000 cfd6d000 cee48000 00000000 000c60a4 c01500cc
<0>[92, recovery] [ 5.229064] 9f80: 00000000 000bac21 0019b74c 001a4020 000c8e04 00000005 c0038128 cee48000
<0>[92, recovery] [ 5.229095] 9fa0: 00000000 c0037f80 0019b74c 001a4020 000bac21 00020002 00000000 201d064a
<0>[92, recovery] [ 5.229095] 9fc0: 0019b74c 001a4020 000c8e04 00000005 be8b6d9c be8b6d98 000ca6b8 000c60a4
<0>[92, recovery] [ 5.229125] 9fe0: 0019b74c be8b6c88 0008569d 0000a69c 40000010 000bac21 00000000 00000000
<4>[92, recovery] [ 5.229156] [<c005ad9c>] (msm_rpc_call_reply+0x28/0x16c) from [<c005aefc>] (msm_rpc_call+0x1c/0x24)
<4>[92, recovery] [ 5.229156] [<c005aefc>] (msm_rpc_call+0x1c/0x24) from [<c0401678>] (huawei_rpc_current_consuem_notify+0x74/0x88)
<4>[92, recovery] [ 5.229187] [<c0401678>] (huawei_rpc_current_consuem_notify+0x74/0x88) from [<c02b9728>] (msm_fb_set_backlight+0x70/0x84)
<4>[92, recovery] [ 5.229217] [<c02b9728>] (msm_fb_set_backlight+0x70/0x84) from [<c02b989c>] (msm_fb_blank_sub+0xfc/0x168)
<4>[92, recovery] [ 5.229248] [<c02b989c>] (msm_fb_blank_sub+0xfc/0x168) from [<c02b9cfc>] (msm_fb_open+0x34/0x64)
<4>[92, recovery] [ 5.229248] [<c02b9cfc>] (msm_fb_open+0x34/0x64) from [<c02b098c>] (fb_open+0x17c/0x1b8)
<4>[92, recovery] [ 5.229278] [<c02b098c>] (fb_open+0x17c/0x1b8) from [<c01551a4>] (chrdev_open+0x260/0x284)
<4>[92, recovery] [ 5.229309] [<c01551a4>] (chrdev_open+0x260/0x284) from [<c01503b0>] (__dentry_open+0x208/0x328)
<4>[92, recovery] [ 5.229339] [<c01503b0>] (__dentry_open+0x208/0x328) from [<c0150598>] (nameidata_to_filp+0x44/0x58)
<4>[92, recovery] [ 5.229370] [<c0150598>] (nameidata_to_filp+0x44/0x58) from [<c015dfac>] (do_filp_open+0x43c/0x838)
<4>[92, recovery] [ 5.229370] [<c015dfac>] (do_filp_open+0x43c/0x838) from [<c01500cc>] (do_sys_open+0x58/0x10c)
<4>[92, recovery] [ 5.229400] [<c01500cc>] (do_sys_open+0x58/0x10c) from [<c0037f80>] (ret_fast_syscall+0x0/0x2c)
<0>[92, recovery] [ 5.229431] Code: e1a04002 e59d8030 93e0af83 9a00004d (e5903080)
<4>[92, recovery] [ 5.229431] ---[ end trace da227214a82491b9 ]---
<4>[92, recovery] [ 5.229461] do_exit: exit code=11
thanks for the backup bud i will start working with that.
Dzo could you help a little bit?
Thanks
boss_y said:
Dzo could you help a little bit?
Thanks
Click to expand...
Click to collapse
Well, the new 2.3.5 uses a newer version of amss (version 4040) and so the rpc calls are different and that is why it's crashing. Try extracting the new kernel and putting it into the recovery image using abootimg.
I am pretty sure in my first versions i was using the 2.3.5 kernel and i posted the wrong log here..
Anyway that happens if you don't sleep.
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
Recovery
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance
ret4rt said:
I am pretty sure in my first versions i was using the 2.3.5 kernel and i posted the wrong log here..
Anyway that happens if you don't sleep.
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
Recovery
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance
Click to expand...
Click to collapse
Its not working bro....
1st and 2nd does not go to recovey screen
3rd opens complete Blue screen that is it......
krish_nank said:
Its not working bro....
1st and 2nd does not go to recovey screen
3rd opens complete Blue screen that is it......
Click to expand...
Click to collapse
Yeah i thought so :/
Please if you can either on the 1st or 2nd one while it's on ideos screen do
adb shell cat /proc/kmsg > kmsg.txt wait till it auto reboots and paste it to pastebin so i can check it out.
It does not pass 1st Logo of Huawei.... will i get the log??
krish_nank said:
It does not pass 1st Logo of Huawei.... will i get the log??
Click to expand...
Click to collapse
Yeap adb should work
Sent from my u8800 using XDA App
I just tried to boot on to recovery from rom manager(I choosed the U8800 recovery first).
The flashing failed and the default recovery load.
I get this messages in default recovery mode, which maybe help:
Finding update package...
Opening update package...
Verifying update package..
E: failed to verify whole-file signature
E: signature verification failed
Installation aborted.
ret4rt said:
Yeap adb should work
Sent from my u8800 using XDA App
Click to expand...
Click to collapse
Got the dmesg.txt for 1st recovery.img file only others shows as not found...
krish_nank said:
Got the dmesg.txt for 1st recovery.img file only others shows as not found...
Click to expand...
Click to collapse
Thanks krish_nank. i've removed teh test recoveries from the first post as apparently they don't work.
Will have a look again when i have more time but i guess someone more experienced can do it faster..
1st of all good effort for that thanks.
also plz find a way to correctly root the new 2.3 otherwise I see we will get stuck with it.
I want to go back to a custom rom and just can revert the installation of this crap
Can please someone try this recovery too <removed didn't work>
Goto pink screen make a backup of your recovery.img and replace with the one from the rar.
See if it boots and report.
ONLY for those that has the 2.3.5 overseas version.
EDIT: Another failed attempt..
Nop.
It is not working.Stuck at Huawei logo.
I will post logs later.
Damn it!Ok nvm logs won't help right now anyway. Will wait till the Thursday update then i might get 2.3.5 on my phone to try things myself. Thanks for checking it anyway
I got a half working recovery myself (tried CM9 recovery). It boots, but after a couple of minutes it reboots. Where to get the logs?
Blefish said:
I got a half working recovery myself (tried CM9 recovery). It boots, but after a couple of minutes it reboots. Where to get the logs?
Click to expand...
Click to collapse
where do you find that recovery ?
Darksage07 said:
where do you find that recovery ?
Click to expand...
Click to collapse
Made it myself. I'm currently setting up a hardware config for CM9 and CWM is the first step.
Blefish said:
Made it myself. I'm currently setting up a hardware config for CM9 and CWM is the first step.
Click to expand...
Click to collapse
can you send me the link where you get a tutorial to do that ?
I changed my build.prop and my phone is stuck bootlooping. I have the stock build.prop on my computer. I'm trying to adb push the file onto my phone but my computer isn't recognizing the phone in the bootloop nor in Philztouch recovery. Any tips? mounting usb and mounting unmounting system arent doing anything
After reflashing the kernel in recovery I'm able to see my device under adb devices during the bootloop but am unable to push anything, either a full stock rom or a buil.prop. Any clues?
mejorguille said:
I changed my build.prop and my phone is stuck bootlooping. I have the stock build.prop on my computer. I'm trying to adb push the file onto my phone but my computer isn't recognizing the phone in the bootloop nor in Philztouch recovery. Any tips? mounting usb and mounting unmounting system arent doing anything
After reflashing the kernel in recovery I'm able to see my device under adb devices during the bootloop but am unable to push anything, either a full stock rom or a buil.prop. Any clues?
Click to expand...
Click to collapse
I think the best and fool proof option is to go download mode and restore via LG Tool/Mobile Support Tool. Then, restart root all over again. This happened to me once.
m0ngstr0us said:
I think the best and fool proof option is to go download mode and restore via LG Tool/Mobile Support Tool. Then, restart root all over again. This happened to me once.
Click to expand...
Click to collapse
I feared I'd have to do that, I think I'll make a nandroid, reroot, restore the nandroid and make an update.zip with the correct build.prop so I don't lose my things
I don't suppose you made a nandroid. Before you started messing with the build prop
Sent from my LG-D800 using Tapatalk
mejorguille said:
I feared I'd have to do that, I think I'll make a nandroid, reroot, restore the nandroid and make an update.zip with the correct build.prop so I don't lose my things
Click to expand...
Click to collapse
if you have the stock build.prop on your computer, why can't you just make an update.zip and use it?
tdevaughn said:
I don't suppose you made a nandroid. Before you started messing with the build prop
Sent from my LG-D800 using Tapatalk
Click to expand...
Click to collapse
Nope, only had this phone for a week or so and I'm running the stock rom, didn't think I needed it yet. You'd think I learned my lesson in 6 years of android rom hacking huh?
datechnerd said:
if you have the stock build.prop on your computer, why can't you just make an update.zip and use it?
Click to expand...
Click to collapse
I can't push anything to my device even with adb push. I've tried a mounting usb storage on my computer, adb push, pushing individual lines to the build.prop, and a few tools like android commander to no avail
mejorguille said:
Nope, only had this phone for a week or so and I'm running the stock rom, didn't think I needed it yet. You'd think I learned my lesson in 6 years of android rom hacking huh?
I can't push anything to my device even with adb push. I've tried a mounting usb storage on my computer, adb push, pushing individual lines to the build.prop, and a few tools like android commander to no avail
Click to expand...
Click to collapse
if you can do it in recovery, you should be using adb sideload
datechnerd said:
if you can do it in recovery, you should be using adb sideload
Click to expand...
Click to collapse
ADB sideload doesn't work for me, in recovery even if I have ADB sideload on, ADB won't recognize the phone. I have ADB 1.0.31 and the latest LG drivers installed
logcat
Code:
I/DEBUG ( 246): d22 6c2f6c67652f6269 d23 327653454c476269
I/DEBUG ( 246): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 246): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 246): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 246): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 246): scr 20000010
I/DEBUG ( 246):
I/DEBUG ( 246): backtrace:
I/DEBUG ( 246): #00 pc 00000000 <unknown>
I/DEBUG ( 246): #01 pc 0000470d /system/vendor/lib/egl/eglsubAndroid.so
I/DEBUG ( 246): #02 pc 00004a6b /system/vendor/lib/egl/eglsubAndroid.so
I/DEBUG ( 246): #03 pc 0000c964 /system/vendor/lib/egl/libEGL_adreno.so
(qeglDrvAPI_eglCreateWindowSurface+568)
I/DEBUG ( 246): #04 pc 00006844 /system/vendor/lib/egl/libEGL_adreno.so
(eglCreateWindowSurface+16)
I/DEBUG ( 246): #05 pc 0000d6b1 /system/lib/libEGL.so (eglCreateWindowS
urface+200)
I/DEBUG ( 246): #06 pc 0001f679 /system/lib/libsurfaceflinger.so (andro
id::DisplayDevice::init(void*)+32)
I/DEBUG ( 246): #07 pc 0001f7cd /system/lib/libsurfaceflinger.so (andro
id::DisplayDevice::DisplayDevice(android::sp<android::SurfaceFlinger> const&, an
droid::DisplayDevice::DisplayType, bool, android::wp<android::IBinder> const&, a
ndroid::sp<ANativeWindow> const&, android::sp<android::FramebufferSurface> const
&, void*)+188)
I/DEBUG ( 246): #08 pc 0002ac05 /system/lib/libsurfaceflinger.so (andro
id::SurfaceFlinger::readyToRun()+424)
I/DEBUG ( 246): #09 pc 0001123d /system/lib/libutils.so (android::Threa
d::_threadLoop(void*)+72)
I/DEBUG ( 246): #10 pc 00010dcd /system/lib/libutils.so
I/DEBUG ( 246): #11 pc 0000e538 /system/lib/libc.so (__thread_entry+72)
I/DEBUG ( 246): #12 pc 0000dc24 /system/lib/libc.so (pthread_create+160
)
I/DEBUG ( 246):
I/DEBUG ( 246): stack:
I/DEBUG ( 246): 40548be0 00000000
I/DEBUG ( 246): 40548be4 00000000
I/DEBUG ( 246): 40548be8 41f131d0
I/DEBUG ( 246): 40548bec 40317f19 /system/lib/libgui.so
I/DEBUG ( 246): 40548bf0 40548c08 [stack:3063]
I/DEBUG ( 246): 40548bf4 00000000
I/DEBUG ( 246): 40548bf8 00000780
I/DEBUG ( 246): 40548bfc 4031ec9f /system/lib/libgui.so (android::
SurfaceTextureClient::setBuffersDimensions(int, int)+110)
I/DEBUG ( 246): 40548c00 00000000
I/DEBUG ( 246): 40548c04 41f131d0
I/DEBUG ( 246): 40548c08 00000002
I/DEBUG ( 246): 40548c0c 00000000
I/DEBUG ( 246): 40548c10 40548c28 [stack:3063]
I/DEBUG ( 246): 40548c14 41f12e10
I/DEBUG ( 246): 40548c18 df0027ad
I/DEBUG ( 246): 40548c1c 00000000
I/DEBUG ( 246): #00 40548c20 40548c44 [stack:3063]
I/DEBUG ( 246): ........ ........
I/DEBUG ( 246): #01 40548c20 40548c44 [stack:3063]
I/DEBUG ( 246): 40548c24 4031f223 /system/lib/libgui.so (android::
SurfaceTextureClient::dispatchSetBuffersDimensions(std::__va_list)+12)
I/DEBUG ( 246): 40548c28 4031f415 /system/lib/libgui.so (android::
SurfaceTextureClient::perform(int, std::__va_list))
I/DEBUG ( 246): 40548c2c 4031e93f /system/lib/libgui.so (android::
SurfaceTextureClient::hook_perform(ANativeWindow*, int, ...)+24)
I/DEBUG ( 246): 40548c30 41f12e10
I/DEBUG ( 246): 40548c34 40548c40 [stack:3063]
I/DEBUG ( 246): 40548c38 406c0ddf /system/vendor/lib/egl/eglsubAnd
roid.so
I/DEBUG ( 246): 40548c3c 00000008
I/DEBUG ( 246): 40548c40 00000438
I/DEBUG ( 246): 40548c44 00000000
I/DEBUG ( 246): 40548c48 00000438
I/DEBUG ( 246): 40548c4c 41f14088
I/DEBUG ( 246): 40548c50 41f12e10
I/DEBUG ( 246): 40548c54 405517b8 [heap]
I/DEBUG ( 246): 40548c58 00000000
I/DEBUG ( 246): 40548c5c 00000001
I/DEBUG ( 246): ........ ........
I/DEBUG ( 246): #02 40548c70 00000000
I/DEBUG ( 246): 40548c74 00000000
I/DEBUG ( 246): 40548c78 00000110
I/DEBUG ( 246): 40548c7c 40588b44 /system/vendor/lib/libgsl.so
I/DEBUG ( 246): 40548c80 00000001
I/DEBUG ( 246): 40548c84 4010409d /system/lib/libc.so (dlcalloc+64
)
I/DEBUG ( 246): 40548c88 00000000
I/DEBUG ( 246): 40548c8c 00000000
I/DEBUG ( 246): 40548c90 00000110
I/DEBUG ( 246): 40548c94 406c2829 /system/vendor/lib/egl/eglsubAnd
roid.so
I/DEBUG ( 246): 40548c98 40551780 [heap]
I/DEBUG ( 246): 40548c9c 40588b44 /system/vendor/lib/libgsl.so
I/DEBUG ( 246): 40548ca0 41f13f70
I/DEBUG ( 246): 40548ca4 00000004
I/DEBUG ( 246): 40548ca8 41f12e10
I/DEBUG ( 246): 40548cac 4055f968 /system/vendor/lib/egl/libEGL_ad
reno.so (qeglDrvAPI_eglCreateWindowSurface+572)
I/DEBUG ( 246):
I/DEBUG ( 246): memory near r0:
I/DEBUG ( 246): 40745fe4 4010a780 40110e0d 4010e0fb 4012c75c
I/DEBUG ( 246): 40745ff4 4010e0bb 401048e9 40109028 40746000
I/DEBUG ( 246): 40746004 48574d54 00000001 407446e0 4074474d
I/DEBUG ( 246): 40746014 4074476e 407461c4 400dcce8 00000000
I/DEBUG ( 246): 40746024 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746034 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746044 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746054 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746064 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746074 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40746084 407444ed 40744543 407445bb 407445d9
I/DEBUG ( 246): 40746094 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 407460a4 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 407460b4 405520a0 00000001 00000002 00000000
I/DEBUG ( 246): 407460c4 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 407460d4 00000438 00000780 00000438 00000f00
I/DEBUG ( 246):
I/DEBUG ( 246): memory near r5:
I/DEBUG ( 246): 41f14068 ffffffff 00000000 00000000 00000000
I/DEBUG ( 246): 41f14078 41f12e10 00000000 00000000 000000f3
I/DEBUG ( 246): 41f14088 406c6503 00000001 00000020 00000008
I/DEBUG ( 246): 41f14098 00000008 00000008 00000008 00003038
I/DEBUG ( 246): 41f140a8 00000004 00000000 00000000 00000000
I/DEBUG ( 246): 41f140b8 00000000 00000001 00000000 00000000
I/DEBUG ( 246): 41f140c8 00000000 000005e5 00003038 ffffffff
I/DEBUG ( 246): 41f140d8 ffffffff ffffffff 00000000 00000001
I/DEBUG ( 246): 41f140e8 00000000 00000001 00000000 0000308e
I/DEBUG ( 246): 41f140f8 00000047 00000000 00000047 00000001
I/DEBUG ( 246): 41f14108 000030c3 00000001 00000001 00000020
I/DEBUG ( 246): 41f14118 41f12e10 00000001 00000001 00000000
I/DEBUG ( 246): 41f14128 00000438 00000780 00000001 00000000
I/DEBUG ( 246): 41f14138 00000000 00000000 00000000 41f14178
I/DEBUG ( 246): 41f14148 ffffffff 00000000 00000000 40746004
I/DEBUG ( 246): 41f14158 00000000 00000000 00000000 00000000
I/DEBUG ( 246):
I/DEBUG ( 246): memory near r9:
I/DEBUG ( 246): 40548c68 405517b8 406c2a6f 00000000 00000000
I/DEBUG ( 246): 40548c78 00000110 40588b44 00000001 4010409d
I/DEBUG ( 246): 40548c88 00000000 00000000 00000110 406c2829
I/DEBUG ( 246): 40548c98 40551780 40588b44 41f13f70 00000004
I/DEBUG ( 246): 40548ca8 41f12e10 4055f968 41f14044 00000004
I/DEBUG ( 246): 40548cb8 40551780 40548ce8 00000004 0000302e
I/DEBUG ( 246): 40548cc8 40548dac 40570890 00003089 0000308b
I/DEBUG ( 246): 40548cd8 000005e5 00000047 00000020 00000008
I/DEBUG ( 246): 40548ce8 00000008 00000008 00000008 00003038
I/DEBUG ( 246): 40548cf8 00000004 00000000 00000000 00000000
I/DEBUG ( 246): 40548d08 00000000 00000001 00000000 00000000
I/DEBUG ( 246): 40548d18 00000000 000005e5 00003038 ffffffff
I/DEBUG ( 246): 40548d28 ffffffff ffffffff 00000000 00000001
I/DEBUG ( 246): 40548d38 00000000 00000001 00000000 0000308e
I/DEBUG ( 246): 40548d48 00000047 00000000 00000047 00000001
I/DEBUG ( 246): 40548d58 000030c3 00000001 00000001 00000020
I/DEBUG ( 246):
I/DEBUG ( 246): memory near sl:
I/DEBUG ( 246): 40548c6c 406c2a6f 00000000 00000000 00000110
I/DEBUG ( 246): 40548c7c 40588b44 00000001 4010409d 00000000
I/DEBUG ( 246): 40548c8c 00000000 00000110 406c2829 40551780
I/DEBUG ( 246): 40548c9c 40588b44 41f13f70 00000004 41f12e10
I/DEBUG ( 246): 40548cac 4055f968 41f14044 00000004 40551780
I/DEBUG ( 246): 40548cbc 40548ce8 00000004 0000302e 40548dac
I/DEBUG ( 246): 40548ccc 40570890 00003089 0000308b 000005e5
I/DEBUG ( 246): 40548cdc 00000047 00000020 00000008 00000008
I/DEBUG ( 246): 40548cec 00000008 00000008 00003038 00000004
I/DEBUG ( 246): 40548cfc 00000000 00000000 00000000 00000000
I/DEBUG ( 246): 40548d0c 00000001 00000000 00000000 00000000
I/DEBUG ( 246): 40548d1c 000005e5 00003038 ffffffff ffffffff
I/DEBUG ( 246): 40548d2c ffffffff 00000000 00000001 00000000
I/DEBUG ( 246): 40548d3c 00000001 00000000 0000308e 00000047
I/DEBUG ( 246): 40548d4c 00000000 00000047 00000001 000030c3
I/DEBUG ( 246): 40548d5c 00000001 00000001 00000020 40548d78
I/DEBUG ( 246):
I/DEBUG ( 246): memory near ip:
I/DEBUG ( 246): 4032fd24 40108fe8 40110e0d 40117841 40108eec
I/DEBUG ( 246): 4032fd34 401048e9 4016af8c 400ff898 400ffdc8
I/DEBUG ( 246): 4032fd44 4016aea8 4020f129 402db53b 40100220
I/DEBUG ( 246): 4032fd54 402097eb 401005fc 402096b5 40209957
I/DEBUG ( 246): 4032fd64 402097bf 40208f63 4016af6c 40208fb9
I/DEBUG ( 246): 4032fd74 40208ff1 40100148 40100204 402f2a31
I/DEBUG ( 246): 4032fd84 401001c8 4020bd91 400ff684 40209a3f
I/DEBUG ( 246): 4032fd94 402f1b2d 402f2af7 4020c1a5 4020bf13
I/DEBUG ( 246): 4032fda4 40246f65 4020c32d 4020c335 40246fa9
I/DEBUG ( 246): 4032fdb4 402468a1 40207cbb 40207cbb 40207cbb
I/DEBUG ( 246): 4032fdc4 40207cbb 40207cbb 40207cbb 40207cbb
I/DEBUG ( 246): 4032fdd4 40207cbb 4014c901 402db09f 402db09b
I/DEBUG ( 246): 4032fde4 402db09b 402db325 402db0a3 402db0a3
I/DEBUG ( 246): 4032fdf4 402db09b 402db2af 402db289 402db267
I/DEBUG ( 246): 4032fe04 402db0a9 402db09b 402db3dd 402dc0cd
I/DEBUG ( 246): 4032fe14 402dc0f9 402dc0bf 402dc0ed 402db095
I/DEBUG ( 246):
I/DEBUG ( 246): memory near sp:
I/DEBUG ( 246): 40548c00 00000000 41f131d0 00000002 00000000
I/DEBUG ( 246): 40548c10 40548c28 41f12e10 df0027ad 00000000
I/DEBUG ( 246): 40548c20 40548c44 4031f223 4031f415 4031e93f
I/DEBUG ( 246): 40548c30 41f12e10 40548c40 406c0ddf 00000008
I/DEBUG ( 246): 40548c40 00000438 00000000 00000438 41f14088
I/DEBUG ( 246): 40548c50 41f12e10 405517b8 00000000 00000001
I/DEBUG ( 246): 40548c60 00000000 00003084 405517b8 406c2a6f
I/DEBUG ( 246): 40548c70 00000000 00000000 00000110 40588b44
I/DEBUG ( 246): 40548c80 00000001 4010409d 00000000 00000000
I/DEBUG ( 246): 40548c90 00000110 406c2829 40551780 40588b44
I/DEBUG ( 246): 40548ca0 41f13f70 00000004 41f12e10 4055f968
I/DEBUG ( 246): 40548cb0 41f14044 00000004 40551780 40548ce8
I/DEBUG ( 246): 40548cc0 00000004 0000302e 40548dac 40570890
I/DEBUG ( 246): 40548cd0 00003089 0000308b 000005e5 00000047
I/DEBUG ( 246): 40548ce0 00000020 00000008 00000008 00000008
I/DEBUG ( 246): 40548cf0 00000008 00003038 00000004 00000000
I/DEBUG ( 246):
I/DEBUG ( 246): code around pc:
I/DEBUG ( 246): 00000000 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000010 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000020 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000030 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000040 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000050 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000060 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000070 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000080 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 00000090 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000a0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000b0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000c0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000d0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000e0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246): 000000f0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 246):
I/DEBUG ( 246): code around lr:
I/DEBUG ( 246): 406c26ec f8d5a90a 220040a8 00ccf8d5 2d04f841
I/DEBUG ( 246): 406c26fc 91004632 f8d04623 21027090 80a4f8d5
I/DEBUG ( 246): 406c270c b12047b8 0c1ff106 001ff02c f8d59009
I/DEBUG ( 246): 406c271c b18f70c8 429e6a3b 6a79d10b d1084588
I/DEBUG ( 246): 406c272c f7ff4638 4284f9b1 6ab8d103 42829a09
I/DEBUG ( 246): 406c273c 2300d002 30c8f8c5 fd12f7fd 9a09b1a0
I/DEBUG ( 246): 406c274c 4b314930 44794831 9206447b 93004478
I/DEBUG ( 246): 406c275c 22009001 f44f2005 95027332 f8cd9603
I/DEBUG ( 246): 406c276c 94058010 edcaf7fc 0f00f1b9 f8c9d001
I/DEBUG ( 246): 406c277c f1ba6000 d0010f00 8000f8ca 0f00f1bb
I/DEBUG ( 246): 406c278c 2c04d00f dc03d009 29011e61 e002d834
I/DEBUG ( 246): 406c279c 7f81f5b4 2320d130 2310e000 3000f8cb
I/DEBUG ( 246): 406c27ac 465be000 b34a9a15 7f81f5b4 361fd104
I/DEBUG ( 246): 406c27bc 061ff026 e0099609 d0072c04 3c01dc03
I/DEBUG ( 246): 406c27cc d8072c01 f5b4e002 d1037f81 43439809
I/DEBUG ( 246): 406c27dc e00010db 99152300 e00f600b 2002490c
I/DEBUG ( 246):
I/DEBUG ( 246): [Dalvik] Can't dump ETB. /dev/coresight-etb doesn't exist
I/DEBUG ( 246): [Dalvik] Cannot find trace addr from PC, use thread ptr in r6
I/DEBUG ( 246): [Dalvik] fffffffc doesn't look like a trace start address
I/ServiceManager( 239): service 'sensorservice' died
I/ServiceManager( 239): service 'entropy' died
I/ServiceManager( 239): service 'power' died
I/ServiceManager( 239): service 'batteryinfo' died
I/ServiceManager( 239): service 'usagestats' died
I/ServiceManager( 239): service 'display' died
I/ServiceManager( 239): service 'telephony.registry' died
I/ServiceManager( 239): service 'scheduling_policy' died
E/installd( 252): eof
E/installd( 252): failed to read size
I/installd( 252): closing connection
D/Xposed ( 3070): Starting Xposed binary version 47, compiled for SDK 16
D/Xposed ( 3070): Phone: n/a (n/a), Android version n/a (SDK n/a)
D/Xposed ( 3070): ROM: n/a
I/Xposed ( 3070): -----------------
I/Xposed ( 3070): Added Xposed (/data/data/de.robv.android.xposed.installer/bin
/XposedBridge.jar) to CLASSPATH.
D/AndroidRuntime( 3070):
D/AndroidRuntime( 3070): >>>>>> AndroidRuntime START de.robv.android.xposed.Xpos
edBridge <<<<<<
D/AndroidRuntime( 3070): CheckJNI is OFF
D/dalvikvm( 3070): Trying to load lib libjavacore.so 0x0
D/dalvikvm( 3070): Added shared lib libjavacore.so 0x0
D/dalvikvm( 3070): Trying to load lib libnativehelper.so 0x0
D/dalvikvm( 3070): Added shared lib libnativehelper.so 0x0
D/Xposed ( 3070): Using structure member offsets for mode WITH_JIT
I/Xposed ( 3070): Found Xposed class 'de/robv/android/xposed/XposedBridge', now
initializing
I/Xposed ( 3070): -----------------
I/Xposed ( 3070): Feb 4, 2014 12:55:05 AM UTC
I/Xposed ( 3070): Loading Xposed v42 (for Zygote)...
I/Xposed ( 3070): Errors during Xposed initialization
I/Xposed ( 3070): java.lang.NoSuchMethodError: android.app.ActivityThread#getTo
pLevelResources(java.lang.String,android.content.res.CompatibilityInfo)#exact
I/Xposed ( 3070): at de.robv.android.xposed.XposedHelpers.findMethodExact(
XposedHelpers.java:208)
I/Xposed ( 3070): at de.robv.android.xposed.XposedHelpers.findMethodExact(
XposedHelpers.java:155)
I/Xposed ( 3070): at de.robv.android.xposed.XposedHelpers.findAndHookMetho
d(XposedHelpers.java:167)
I/Xposed ( 3070): at de.robv.android.xposed.XposedBridge.initXbridgeZygote
(XposedBridge.java:267)
I/Xposed ( 3070): at de.robv.android.xposed.XposedBridge.main(XposedBridge
.java:111)
I/Xposed ( 3070): at dalvik.system.NativeStart.main(Native Method)
I/SamplingProfilerIntegration( 3070): Profiling disabled.
I/Vold ( 240): [LGE][VOLD][NetlinkHandler.cpp][onEvent()] subsys:power_suppl
y, action:3
I/Vold ( 240): [LGE][VOLD][NetlinkHandler.cpp][onEvent()] subsys:power_suppl
y, action:3
I/Zygote ( 3070): Preloading classes...
D/dalvikvm( 3070): JIT code cache reset in 0 ms (0 bytes 1/0)
D/dalvikvm( 3070): GC_EXPLICIT freed 182K, 23% free 620K/804K, paused 0ms+0ms, t
otal 2ms
I managed to push the original build.prop into the phonem but sometime before I was able to push, the phone stopped turning off past splash1 (black lg logo). Before it would boot up to the white tmobile splash screen
Sorry for all the posts, but I managed to get this thing booting again! My mistake is that I was trying to send my flashable zips to /sdcard/ , which, on this phone, doesn't exist!!! I'm putting this out there in case anyone else is stuck in a bootloop like this, if you have a custom recovery and access to adb, adb push a rom to /data/media/0/ . I ended up flashing cm11 as it was a 200 mb file vs the 1.7gb stock rom, I'll flash back to stock after messing with this for a while. Thankfully, I did a nandroid prior to installing cm so all I have to do now is restore my texts/apps and I'll be golden! Thanks for all the suggestions, I can't believe I overlooked something so simple, it never once occurred to me that /sdcard/ was no longer the default location for it.
These one click root methods have made me so forgetful! I remember back in 2008-2009 how even the simplest things required diving into terminal emulator.
mejorguille said:
Sorry for all the posts, but I managed to get this thing booting again! My mistake is that I was trying to send my flashable zips to /sdcard/ , which, on this phone, doesn't exist!!! I'm putting this out there in case anyone else is stuck in a bootloop like this, if you have a custom recovery and access to adb, adb push a rom to /data/media/0/ . I ended up flashing cm11 as it was a 200 mb file vs the 1.7gb stock rom, I'll flash back to stock after messing with this for a while. Thankfully, I did a nandroid prior to installing cm so all I have to do now is restore my texts/apps and I'll be golden! Thanks for all the suggestions, I can't believe I overlooked something so simple, it never once occurred to me that /sdcard/ was no longer the default location for it.
These one click root methods have made me so forgetful! I remember back in 2008-2009 how even the simplest things required diving into terminal emulator.
Click to expand...
Click to collapse
Good to know man! Thanks for the resolution!:good:
I know that this comes a little bit late but this device still a good machine...
This could be used potentially to boot bricked devices. Unfortunately further work would be required since the Shield Tablet uses a private key (not on the device) to sign the bootloader and if I understand correctly from fuses, nvflash cmds. Probably it could be posible boot into Linux implementing something like shofelf2 does and reflash the emmc from it.... at the same time I don't have a bricked device to verify this.
My main aim with this was to learn about SOCs bootchain/baremetal and related protocols and maybe boot clean Debian with a clean uBoot.... I still pending to acknowledge the second but I really don't know how long will it take me... I don't have that much spare time and this took me almost 1 year and a half to earn the knowledge to reach this point...
ShofEL2 for T124
This is a Fusee Gelee / ShofEL2 exploit port for the Nvidia T124 (a.k.a Jetson TK1, Shield K1, etc).
Currently this code allows you to download and execute a payload to the T124, dump the fuses and memory and boot bct without apply the locks.
Mostly of my code is based on the original ShofEL2 code and Katherine Temkin research, so I cannot take that much credit for this.
See the original fail0verflow blog post: https://fail0verflow.com/blog/2018/shofel2/ See additional info at the original Katherine Temkin github: https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md
Obligatory disclaimer
This code is provided without any warranty, use under your own resposability.
Usage
You need an arm-*-eabi toolkit. You can use Crosstool-ng compile it.
Build the loader and payloads:
$ cd ShofEL2-for-T124
$ make
Usage
$ ./shofel2_t124 ( MEM_DUMP | READ_FUSES | BOOT_BCT | PAYLOAD ) [options]
$ MEM_DUMP address length out_file -> Dumps "length" bytes starting from "address" to "out_file".
$ READ_FUSES out_file -> Dumps the T124 fuses to "out_file" and show them in console.
$ BOOT_BCT -> Boots BCT without applying locks.
$ PAYLOAD payload.bin [arm|thumb] -> Boots "payload.bin" the entrymode mode can be specified (thumb by default)
Interesting facts (maybe some of them wrong):
RCM loads the payload to IRAM at 0x4000E000 (described on tegrarcm source code).
RCM cmd format is sligitly different. RCM cmd header length is 0x284 bytes but the firtst 4 bytes still containing the RCM cmd length.
RCM cmd length restrictions are different to X1 bootrom:
Bulk transfers need to be multiply of 0x1000 to ensure use the whole usb buffer.
RCM cmd length minus 0x284 (header length) must be a multiple of 0x10 (which means RCM CMD length needs to end in 4).
RCM cmd min length is 0x404 bytes. Due to the previous condition the minimun length would be 0x1004.
RCM cmd length cannot exceed avaiable IRAM for the payload (from 0x4000E000 till 0x4003FFFF).
With all this in mind max RCM cmd length is 0x32274 bytes.
Since the exploit uses usb buffer 2, only 0x31000 bytes can be used for the payload in order to avoid finishing the RCM cmd.
A payload can still be loaded using the same path as the one used by the original shofEL2, since no validation is carried out till the whole payload is received.
Even if the specs says that the JTAG is enabled by default, cold bootrom code disasbles it while is runnig (not as dumb as expected ).
RCM runs on an ARM7TDMI core, I manage to halt the CPU on uboot using a Segger J-LINK.
When the poisoned get status is executed, 0x30C bytes will be copied before the payload. These bytes are part of the execution stack, starting with the USB status var.
Using the original sanity_check function from shofel2, I got from the execution stack that the RCM USB buffers are located at 0x40004000 and 0x40008000.
Two USB buffers of 0x1000 bytes still present. They still alternating on each USB txn. And odd number of USB txn will let you on the hight buffer for the next txn.
Using the original sanity_check function from shofel2, I got from the execution stack that the memcpy return address is located at 0x4000DCD8 (0x4000DCF4 - 0xC - 2 * 4 - 2 * 4).
The position in the RCM cmd where the entry adress need to be write to smash the memcpy return address is calculated as follow:
n_bytes_to_copy = 0x4000DCD8 - 0x40008000 (memcpy_ret_add_loc - usb_buf2_add) -> n_bytes_to_copy = 0x5CD8 bytes
pos_in_payload = n_bytes_to_copy - 0x30C (copied from the execution stack) - 0x4 -> pos_in_payload = 0x59C8
pos_in_rcm_cmd = pos_in_payload + 0x284 (header length) -> pos_in_rcm_cmd = 0x5C4C
I found the following functions on the the bootrom:
void ep1_in_write_imm(void *buffer, u32 size, u32 *num_xfer) -> 0x001065C0 -> Writes EP1_IN
void ep1_out_read_imm(void *buffer, u32 size, u32 *num_xfer) -> 0x00106612 -> Reads EP1_OUT
void do_bct_boot() -> 0x00100624 -> Boots BCT without applying locks.Hello
Source: https://github.com/LordRafa/ShofEL2-for-T124/releases
Great work! Does this mean you could in theory push payloads made for the switch to the K1, as they are both tegra-based devices?
xdpirate said:
Great work! Does this mean you could in theory push payloads made for the switch to the K1, as they are both tegra-based devices?
Click to expand...
Click to collapse
Well, yes that is partially right but bear in mind that these payloads relies sometimes on the switch peripherals, so for example if you want to show something on the LCD it will not work because the shield and switch LCDs controllers aint the same, the code will run on the boot CPU but the LCD will not work because they don't work in the same way... It is something like use the wrong driver for a device.
Also you need to understand that the payloads normally are used as first stage loader for something else, if that something else is wrote for the switch app CPU it will not work at all. Switch Tegra app CPU is an arm64 CPU and shield app CPU is a 32bit armv7 so they are not compatible. E.g. this is why I cannot run the Switch Linux directly on my shield.... and even if they could work, again you will find the problem of the peripherals and many others customized things for Nintendo... that is why a Shield TV is not a Switch... same same... but different.
This can be more useful to those people that are interesting to do some research around this device.
Is it possible to unbrick a Shield Tablet killed with this ?
Tonio1987french said:
Is it possible to unbrick a Shield Tablet killed with this ?
Click to expand...
Click to collapse
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....
Lord_Rafa said:
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....
Click to expand...
Click to collapse
I do have a killed Shield Tablet LTE. Where are you from?
The OTA that kills the tablet has been dissected here: https://forum.xda-developers.com/shield-tablet/general/kill-kill-switch-shield-tablet-xx-t3179489
Once flashed the tablet doesn't give any signs of life, and goes only in APX mode when connected:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Is it possible to use ShoEL in APX mode? I don't think?
Gave a quick try compiling crosstool-ng on Debian 8 but it's hanging at make, will have a look at it later.
On a side note, one user (Drims75) from Ukraine restores motherboard for a modic cost, you can find a couple of user who sent their motherboard to him: https://forum.xda-developers.com/showpost.php?p=71516196&postcount=139
Thanks for your work!
I can confirm the exploit is working.
Thanks so much LordRafa, you're a legend!
How do i get the SBK Key? Is the FUSE_PRIVATE_KEY i get via READ_FUSES the SBK? And is it possible to dump the BIS keys? The biskeydump payload seems only working for switch. Anyone has a biskeydump payload for t124?
This is absolutely awesome.
I have a bricked shield tablet, here is the output from the fuses:
Waiting T124 to enter RCM mode (ctrl-c to cancel). Note: root permission could be required.
K1 in RCM mode connected.
Chip ID: 0x40 0x02 0x07 0x01 0x00 0x00 0x00 0x10 0x09 0xa1 0x0c 0x74 0x01 0x10 0x00 0x64
Hacky Get Status returned error... Probably the stack got smashed, Congrats
Dumping 768 bytes from 0x7000f900.
FUSE_PRODUCTION_MODE: 00000001
FUSE_JTAG_SECUREID_VALID: 00000001
FUSE_ODM_LOCK: 00000006
FUSE_OPT_OPENGL_EN: 00000001
FUSE_SKU_INFO: 0000001f
FUSE_CPU_SPEEDO_0_CALIB: 000008cd
FUSE_CPU_IDDQ_CALIB: 0000030f
RESERVED_0x01C: 00000000
RESERVED_0x020: 00000000
RESERVED_0x024: 00000000
FUSE_OPT_FT_REV: 00000022
FUSE_CPU_SPEEDO_1_CALIB: 00000000
FUSE_CPU_SPEEDO_2_CALIB: 000007fe
FUSE_SOC_SPEEDO_0_CALIB: 0000089f
FUSE_SOC_SPEEDO_1_CALIB: 00000000
FUSE_SOC_SPEEDO_2_CALIB: 00000000
FUSE_SOC_IDDQ_CALIB: 0000025f
RESERVED_0x044: 00000000
FUSE_FA: 00000000
FUSE_RESERVED_PRODUCTION: 00000002
FUSE_HDMI_LANE0_CALIB: 00000000
FUSE_HDMI_LANE1_CALIB: 00000000
FUSE_HDMI_LANE2_CALIB: 00000000
FUSE_HDMI_LANE3_CALIB: 00000000
FUSE_ENCRYPTION_RATE: 00000000
FUSE_PUBLIC_KEY 0-3: bc420312 298f5d3c a5abe328 9e556001
FUSE_PUBLIC_KEY 4-7: 0eefbfaa 756a7b0f b7507e2f 149672c4
FUSE_TSENSOR1_CALIB: 03a27cbb
FUSE_TSENSOR2_CALIB: 03ee9ee6
RESERVED_0x08C: 00000000
FUSE_OPT_CP_REV: 00000022
FUSE_OPT_PFG: 00000000
FUSE_TSENSOR0_CALIB: 0053a324
FUSE_BOOTROM_PATCH_SIZE: 00000002
FUSE_SECURITY_MODE: 00000001
FUSE_PRIVATE_KEY: 5f244a57 d0197865 940f80a3 15484c8f
FUSE_DEVICE_KEY: 5e65bbde
FUSE_ARM_DEBUG_DIS: 00000000
FUSE_BOOT_DEVICE_INFO: 00000000
FUSE_RESERVED_SW: 00000000
FUSE_VP8_ENABLE: 00000001
FUSE_RESERVED_ODM 0-3: 00000000 00007090 0000000b 00000000
FUSE_RESERVED_ODM 4-7: 00000000 00000000 00000000 00000000
FUSE_OBS_DIS: 00000000
RESERVED_0x0EC: 00000000
FUSE_USB_CALIB: 02c6038b
FUSE_SKU_DIRECT_CONFIG: 00000000
FUSE_KFUSE_PRIVKEY_CTRL: 00000003
FUSE_PACKAGE_INFO: 00000004
FUSE_OPT_VENDOR_CODE: 00000000
FUSE_OPT_FAB_CODE: 00000000
FUSE_OPT_LOT_CODE_0: 00000000
FUSE_OPT_LOT_CODE_1: 00000000
FUSE_OPT_WAFER_ID: 00000000
FUSE_OPT_X_COORDINATE: 00000000
FUSE_OPT_Y_COORDINATE: 00000000
FUSE_OPT_SEC_DEBUG_EN: 00000000
FUSE_OPT_OPS_RESERVED: 00000000
FUSE_SATA_CALIB: 00000000
FUSE_GPU_IDDQ_CALIB: 0000036e
FUSE_TSENSOR3_CALIB: 03e21f59
FUSE_SKU_BOND_OUT_L: 00000000
FUSE_SKU_BOND_OUT_H: 00000000
FUSE_SKU_BOND_OUT_U: 00000000
FUSE_SKU_BOND_OUT_V: 00000000
FUSE_SKU_BOND_OUT_W: 00000000
RESERVED_0x144: 00000000
FUSE_OPT_SUBREVISION: 00000000
FUSE_OPT_SW_RESERVED_0: 00000000
FUSE_OPT_SW_RESERVED_1: 00000000
FUSE_TSENSOR4_CALIB: 03b41d91
FUSE_TSENSOR5_CALIB: 0024c106
FUSE_TSENSOR6_CALIB: 03f15f1c
FUSE_TSENSOR7_CALIB: 00788335
FUSE_OPT_PRIV_SEC_EN: 00000000
FUSE_PKC_DISABLE: 00000000
RESERVED_0x16C: 00000000
RESERVED_0x170: 00000000
RESERVED_0x174: 00000000
RESERVED_0x178: 00000000
FUSE_FUSE2TSEC_DEBUG_DISABLE: 00000001
FUSE_TSENSOR8_CALIB: 00173ab1
FUSE_OPT_CP_BIN: 00000003
FUSE_OPT_GPU_FS: 00000000
FUSE_OPT_FT_BIN: 00000001
RESERVED_0x190: 00000000
FUSE_SKU_BOND_OUT_X: 00000000
FUSE_APB2JTAG_DISABLE: 00000000
RESERVED_0x19C: 00000000
FUSE_PHY_FLOORSWEEP: 00000000
FUSE_PHY_FLOOR_ENABLE: 00000000
FUSE_ARM_CRYPT_DE_FEATURE: 00000000
FUSE_DENVER_MTS_DE_FEATURE: 00000000
FUSE_DIE_VERSION_OVERRIDE: 00000000
FUSE_TRIMMERS: 00000000
FUSE_DENVER_BOOT_SEC: 00000000
FUSE_DENVER_DFD_ACCESS: 00000000
FUSE_WOA_SKU_FLAG: 00000000
FUSE_ECO_RESERVE_1: 00000000
FUSE_GCPLEX_CONFIG_FUSE: 00000002
RESERVED_0x1CC: 00000000
RESERVED_0x1D0: 00000000
RESERVED_0x1D4: 00000000
RESERVED_0x1D8: 00000000
RESERVED_0x1DC: 00000000
RESERVED_0x1E0: 00000000
RESERVED_0x1E4: 00000000
RESERVED_0x1E8: 00000000
RESERVED_0x1EC: 00000000
RESERVED_0x1F0: 00000000
RESERVED_0x1F4: 00000000
RESERVED_0x1F8: 00000000
FUSE_SPARE_REALIGNMENT_REG: 00000000
FUSE_SPARE_BITS 00-03: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 04-07: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 08-11: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 12-15: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 16-19: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 20-23: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 24-27: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 28-31: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 32-35: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 36-39: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 40-43: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 44-47: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 48-51: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 52-55: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 56-59: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 60-63: 00000000 00000000 00000000 00000000
Lord_Rafa said:
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....
Click to expand...
Click to collapse
Did you have any success running/porting mainline linux?
Would this dump the key required to nvflash u-boot?
Edit: I think I understand enough now to know why this is a dumb question. One would use tegrarcm, not nvflash.
Fuses - Nintendo Switch Brew
switchbrew.org
Edit: From NVidia's bct-overview:
When a chip has an RSA public key (PKC) programmed into its flash, it expects the BCT to contain RSA-PSS signatures created/validated using that key pair. When a chip has an AES key (SBK; Secure Boot Key) programmed into its flash, it expects the BCT to contain AES-CMAC hashes created/validated using that key.
Click to expand...
Click to collapse
Has anyone done any testing around what that means for devices with both PKC and SBK? As in does it validate both, either or a does one take precedence over the other?