Database Users

New problems after updating Mogul firmware

TCPMP:
I get the following in crash.txt:
TCPMP 0.72RC1 crash report
----------------------------
Access violation(c0000005) at 782d49ec 782d49ec)
Read from 782d49ec
cpu dump:
R0 = a22cb3c3
R1 = 00000000
R2 = a22cb3c3
R3 = ffffcbac
R4 = 01a00130
R5 = 00012000
R6 = 00012010
R7 = 00000003
R8 = 179ffed8
R9 = 179ffed8
R10 = 782826a8 (common:000016a8)
R11 = 179ffd04
R12 = a22cb3c3
Sp = 179ffcd8
Lr = 78282798 (common:00001798)
Pc = 782d49ec
Psr = 6000001f
stack dump:
179ffcd8 78253f20
179ffcdc 0001318c
179ffce0 179ffed8
179ffce4 8204eeb0
179ffce8 421b89ee
179ffcec 78253f48
179ffcf0 00000000
179ffcf4 a34f00aa
179ffcf8 ffffc894
179ffcfc 179ffd04
179ffd00 00011108
179ffd04 00000000
179ffd08 00000000
179ffd0c 8389f7e0
179ffd10 00000000
179ffd14 00011424
179ffd18 01ffcc94
179ffd1c 01ffc9e0
179ffd20 179ffed8
179ffd24 a34f00aa
179ffd28 ffffc894
179ffd2c 8001cbd0
179ffd30 00000047
179ffd34 a34f00aa
179ffd38 00000000
179ffd3c 179ffed8
179ffd40 00000005
179ffd44 8389f7e0
179ffd48 00000000
179ffd4c 00011424
179ffd50 01ffcc94
179ffd54 01ffc9e0
179ffd58 179ffed8
179ffd5c a34f00aa
179ffd60 ffffc894
179ffd64 03f68ad8
179ffd68 179ffe44
179ffd6c 03f692e8
179ffd70 00011424
179ffd74 8000001f
179ffd78 01ffcc94
179ffd7c 80032c6c
179ffd80 0000c7b2
179ffd84 8005006c
179ffd88 179fc7b2
179ffd8c 03f6dc40
179ffd90 00000000
179ffd94 00000000
179ffd98 0da03ab8
179ffd9c 0d9e0000
179ffda0 0d9e0030
179ffda4 00000014
179ffda8 82c9fe40
179ffdac 00000000
179ffdb0 00000000
179ffdb4 828a5400
179ffdb8 8034c2d0
179ffdbc 821b89ec
179ffdc0 82c9fe40
179ffdc4 00000000
179ffdc8 f000fe38
179ffdcc 179ffe10
179ffdd0 8001f0ac
179ffdd4 00000000
179ffdd8 00004000
179ffddc 00000010
179ffde0 ffffcb48
179ffde4 ffffc894
179ffde8 00000000
179ffdec 8001f538
179ffdf0 00004000
179ffdf4 00000010
179ffdf8 ffffcb48
179ffdfc a22cb3c2
179ffe00 a34f00aa
179ffe04 00000001
179ffe08 8001c440
179ffe0c 03f68ad8
179ffe10 00000000
179ffe14 0000001f
179ffe18 a34f00aa
179ffe1c 00000000
179ffe20 179ffed8
179ffe24 00000005
179ffe28 01ffc9e0
179ffe2c 00011450
179ffe30 8389f7e0
179ffe34 00000000
179ffe38 00011424
179ffe3c 01ffcc94
179ffe40 03f692e8
179ffe44 00010000
179ffe48 00000000
179ffe4c 00000000
179ffe50 00000000
179ffe54 00000000
179ffe58 00000001
179ffe5c 00000000
179ffe60 00000000
179ffe64 00000000
179ffe68 00000000
179ffe6c 00000000
179ffe70 00000000
179ffe74 00000000
179ffe78 00000000
179ffe7c 00000000
179ffe80 00000000
179ffe84 00000000
179ffe88 00000000
179ffe8c 00000000
179ffe90 f000fe3c
179ffe94 c203fe7c
179ffe98 8003e87c
179ffe9c 8003e8ec
179ffea0 00000000
179ffea4 80000004
179ffea8 00000001
179ffeac 00000004
179ffeb0 8389f7e0
179ffeb4 00000000
179ffeb8 00000000
179ffebc 00010000
179ffec0 006c0070
179ffec4 00790061
179ffec8 00720065
179ffecc 0065002e
179ffed0 00650078
179ffed4 00000000
179ffed8 00000000
179ffedc 00000000
179ffee0 00000000
179ffee4 16000000
179ffee8 00000002
179ffeec 00000001
179ffef0 00020000
179ffef4 00000000
179ffef8 179fd000
179ffefc 179e0000
179fff00 7c090950
179fff04 179ffe50
179fff08 00000000
179fff0c 00000000
179fff10 00000000
179fff14 01a01840
179fff18 00000000
179fff1c 00000000
179fff20 00000000
179fff24 00000000
179fff28 00000000
179fff2c 00000000
179fff30 00000000
179fff34 00000000
179fff38 00000000
179fff3c 00000000
179fff40 00000000
179fff44 00000000
179fff48 00000000
179fff4c 00000000
179fff50 00000000
179fff54 00000000
179fff58 00000000
179fff5c 00000000
179fff60 00000000
179fff64 00000000
179fff68 00000000
179fff6c 00000000
179fff70 00000000
179fff74 00000000
179fff78 00000000
179fff7c 00000000
179fff80 00000000
179fff84 00000000
179fff88 00000000
179fff8c 00000000
179fff90 00000000
179fff94 00000000
179fff98 00000000
179fff9c 00000000
179fffa0 00000000
179fffa4 00000000
179fffa8 00000000
179fffac 00000000
179fffb0 00000000
179fffb4 00000000
179fffb8 00000000
179fffbc 00000000
179fffc0 00000000
179fffc4 00000000
179fffc8 00000000
179fffcc 00000000
179fffd0 00000000
179fffd4 00000000
179fffd8 00000000
179fffdc 00000000
179fffe0 00000000
179fffe4 00000000
179fffe8 00000000
179fffec 00000000
179ffff0 00000000
179ffff4 00000000
179ffff8 00000000
179ffffc 00000000
17a00000 50616548
17a00004 00000000
17a00008 00000000
17a0000c 00002000
17a00010 00000000
17a00014 03f6d4ac
17a00018 03f6d4c0
17a0001c 00000001
17a00020 00000000
17a00024 81ce0438
17a00028 00000000
17a0002c 00000000
17a00030 17a02578
17a00034 17a00030
17a00038 00010c31
17a0003c 17a1dce8
17a00040 17a00000
17a00044 00000000
17a00048 00000000
17a0004c 00000000
17a00050 00000000
17a00054 00000000
17a00058 ffffff80
17a0005c 17a00030
17a00060 0050005c
17a00064 006f0072
17a00068 00720067
17a0006c 006d0061
17a00070 00460020
17a00074 006c0069
17a00078 00730065
17a0007c 0054005c
17a00080 00500043
17a00084 0050004d
17a00088 0069005c
17a0008c 0074006e
17a00090 00720065
17a00094 00610066
17a00098 00650063
17a0009c 0070002e
17a000a0 0067006c
17a000a4 00000000
17a000a8 ffffffd0
17a000ac 17a00030
17a000b0 00790061
17a000b4 00730067
17a000b8 00650068
17a000bc 006c006c
17a000c0 0064002e
17a000c4 006c006c
17a000c8 00000000
17a000cc 00000000
17a000d0 00000000
17a000d4 00000000
common 78281000-782cc000 obj:0 class:30
General (0x01a01600)
Language(16)=1600081477
Platform(23)=PocketPC
Ver(25)=502
OS Version(27)=5.02
OEM Info(24)=TITA100
TypeNo(26)=1
Model(18)=0
Caps(19)=0x00008000
Processor(17)=ARM
Clock speed(34)=390
ICache(20)=32768
DCache(21)=32768
(37)=10
(38)=0
Advanced (0x01a01920)
No backlight keepalive for video(32)=No
Home Screen time out with music playback(45)=No
Old style toolbars(31)=No
No wireless MMX usage(40)=No
Slow video memory(37)=Yes
Less rotation tearing (slower)(41)=No
Prefer lookup tables over arithmetic(38)=Yes
D-Pad follow screen orientation(56)=Yes
Prefer less buffering over smooth video(54)=No
Use system volume(52)=No
Benchmark from current position(48)=No
Override AVI frame rate based on audio(53)=No
Widcomm BT Audio button support(58)=No
Disable AVC deblocking filter(65)=No
Manual A/V offset +/-(44)=0.00 ms
Soft-drop tolerance(42)=54.99 ms
Hard-drop tolerance(43)=699.95 ms
(59)=No
System Timer (0x01a01c70)
Time(96)=0
Speed(98)=100.00%
Play(99)=No
Wave Output (0x01a01e20)
Input(32):IN=empty packet format
Input(32):IN=NULL
Output(33):OUT=empty packet format
Total(34)=0
Dropped(35)=0
Volume(81)=60
Mute(82)=No
(89)=0
Quality(83)=2
(90)=No
(91)= (0x01a01e30)
NULA AOUT p:1 r:1 c: e: p: m:common
OVLA VOUT p:1 r:1 c: e: p: m:common
RAWA FMTB p:1 r:1 c: e: p: m:common
FMTB FMT_ p:1 r:1 c: e: p: m:common
CODC FLOW p:1 r:1 c: e: p: m:common
CCID FLOW p:1 r:1 c: e: p: m:common
NODE p:0 r:1 c: e: p: m:common
FILE STRM p:1 r:1 c:file e: p: m:common
WAVE AOUT p:1 r:1 c: e: p: m:common
RAWI FMTB p:1 r:1 c: e: p: m:common
FMTL FMTM p:1 r:1 c: e: p: m:common
STRM NODE p:1 r:1 c: e: p: m:common
FMTM NODE p:1 r:1 c: e: p: m:common
ADMO CODC p:1 r:1 c: e: p: m:common
STRP FMTM p:1 r:1 c: e: p: m:common
OUTP FLOW p:1 r:1 c: e: p: m:common
ADVP NODE p:1 r:1 c: e: p: m:common
TIMR NODE p:1 r:1 c: e: p: m:common
MEMS STRM p:1 r:1 c: e: p: m:common
PLAT NODE p:1 r:1 c: e: p: m:common
IDCT FLOW p:1 r:1 c: e: p: m:common
SYST TIMR p:1 r:1 c: e: p: m:common
AOUT OUTP p:1 r:1 c: e: p: m:common
VOUT OUTP p:1 r:1 c: e: p: m:common
NULV VOUT p:1 r:1 c: e: p: m:common
FLOW NODE p:1 r:1 c: e: p: m:common
RASX FMTL p:1 r:1 c: e:asx;wmx;wmweb;wmwebasf;wmwebasx;wvx:V;wax:A p:and(text,scan(64,stri('<ASX'),0,fwd)) m:common
PLS_ FMTL p:1 r:1 c:audio/x-scpls,audio/scpls els p:and(text,scan(64,stri('[playlist]'),0,fwd)) m:common
FMT_ FMTM p:1 r:1 c: e: p: m:common
M3U_ FMTL p:1 r:1 c:audio/x-mpegurl,audio/mpegurl e:m3u p:and(text,gt(512,length),or(eq(lines,1),eq(lines,0))) m:common

Bump #1!
Well, aside from the previous post - I found what I thought was a zip file that would work, but I copied it over to the phone and found out it was about 30 MB worth of C++ Source Code files, and no appication included. Does anyone know where I can find a working, compiled, and tested version of TCPMP that works with WM 6.1 on the Titan/Mogul?

Using CAB or OEM
How are you going to load it to your phone. I am using an OEM. Try these CABs if that is what you use to install or this OEM. The oem works for me.

Thank you! Flash videos now play on my phone!

HTC Magic 32A random reboots with any non-htc kernel

Hi, I'm hoping that someone on here has a clue about what's happening with this HTC Magic 32A.
What I'm seeing is ROMS with a custom kernel (e.g. the bc kernel) on an Amon_RA or Cyanogen ROM is that the phone randomly reboots. It could be sitting on the table, doing nothing.. or could be in use.
I've used a couple of older ROMS, which included a HTC kernel, and they were always stable.
If it helps, I managed to grab a couple of /proc/last_kmsg's after reboots, but I don't really know what's causing the problem.
Code:
[ 358.834381] PM: Syncing filesystems ... done.
[ 358.840209] Freezing user space processes ... (elapsed 0.01 seconds) done.
[ 358.858886] Freezing remaining freezable tasks ... (elapsed 0.00 seconds) done.
[ 358.864990] wakeup wake lock: tiwlan_irq_wake
[ 358.871337] Restarting tasks ... done.
[ 358.877929] suspend: exit suspend, ret = 0 (2009-12-10 03:02:28.507171631 UTC)
[ 358.882080] PM: Syncing filesystems ... done.
[ 358.886291] Freezing user space processes ... (elapsed 0.01 seconds) done.
[ 358.901367] Freezing remaining freezable tasks ... (elapsed 0.00 seconds) done.
[ 358.910675] wakeup wake lock: tiwlan_irq_wake
[ 358.914611] Restarting tasks ... <1>Unable to handle kernel NULL pointer dereference at virtual address 0000001c
[ 358.920684] pgd = cb9b0000
[ 358.920928] [0000001c] *pgd=24b9a031, *pte=00000000, *ppte=00000000
[ 358.922058] Internal error: Oops: 17 [#1] PREEMPT
[ 358.922302] Modules linked in: wlan
[ 358.923004] CPU: 0 Not tainted (2.6.29.6-cm42 #2)
[ 358.923492] PC is at rb_erase+0xdc/0x360
[ 358.923767] LR is at __dequeue_entity+0x38/0x3c
[ 358.924194] pc : [<c0189dd8>] lr : [<c0049bd4>] psr: 20000093
[ 358.924224] sp : c5031d20 ip : c5031d40 fp : c5031d3c
[ 358.924896] r10: 00000000 r9 : c02edb50 r8 : c50f052c
[ 358.925140] r7 : 00000001 r6 : cb9a86d0 r5 : cb9a86f0 r4 : 00040cf1
[ 358.925598] r3 : 00000000 r2 : 0000001c r1 : cb9a86f0 r0 : c03ee198
[ 358.925842] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 358.926269] Control: 00c5387d Table: 24bb0008 DAC: 00000015
[ 358.926513]
[ 358.926513] PC: 0xc0189d58:
[ 358.927185] 9d58 15821000 e5901000 e1540000 e5831000 e5901000 05842004 15842008 e5907004
[ 358.929504] 9d78 e5906008 01a04003 e3d11003 e5837004 e5836008 05853000 0a000003 e5916008
[ 358.931976] 9d98 e1560000 05813008 15813004 e9900042 e5960000 e3510000 e2000003 e1830000
[ 358.934478] 9db8 e5860000 15910000 12000003 11833000 15813000 ea00000e e3520000 e5904000
[ 358.936950] 9dd8 15923000 e204c001 12033003 e3c44003 11833004 15823000 e3540000 05852000
[ 358.939239] 9df8 0a000003 e5943008 e1530000 05842008 15842004 e35c0001 189da8f0 ea000082
[ 358.941711] 9e18 e5943008 e1530002 1a00003b e5943004 e5932000 e3120001 1a000008 e3822001
[ 358.944183] 9e38 e5832000 e5943000 e1a00004 e3c33001 e5843000 e1a01005 ebffff21 e5943004
[ 358.946441]
[ 358.946441] LR: 0xc0049b54:
[ 358.947113] 9b54 13e00015 03a00000 e89da830 c02edb50 e1a0c00d e92dd800 e24cb004 e5903318
[ 358.949584] 9b74 e2611014 e59331c0 e1510003 93a00001 989da800 e3a00017 eb004647 e2500000
[ 358.951904] 9b94 13a00001 e89da800 e1a0c00d e92dd830 e24cb004 e5903024 e2815008 e1530005
[ 358.954376] 9bb4 e1a04000 1a000002 e1a00005 eb05013b e5840024 e1a00005 e2841020 eb050049
[ 358.956848] 9bd4 e89da830 e1a0c00d e92dd8f0 e24cb004 e591301c e1a04001 e3530000 e1a05000
[ 358.959075] 9bf4 0a000029 e5902044 e3a03ffe e0822003 e1c165d0 e1c220d0 e591105c e5940058
[ 358.961547] 9c14 e0522006 e0c33007 e1510003 e1a0c003 8a000002 1a000003 e1500002 9a000001
[ 358.964080] 9c34 e1a02000 e1a0c001 e1c406d0 e5842058 e3a02001 e0900002 e3a03000 e0a11003
[ 358.966369]
[ 358.966369] SP: 0xc5031ca0:
[ 358.966827] 1ca0 c006e248 c006e1d4 c50f02c0 c03ee160 cea01000 914f1a84 ffffffff c5031d0c
[ 358.969329] 1cc0 cb9a86d0 00000001 c5031d3c c5031cd8 c00259ac c0025200 c03ee198 cb9a86f0
[ 358.971588] 1ce0 0000001c 00000000 00040cf1 cb9a86f0 cb9a86d0 00000001 c50f052c c02edb50
[ 358.974060] 1d00 00000000 c5031d3c c5031d40 c5031d20 c0049bd4 c0189dd8 20000093 ffffffff
[ 358.976531] 1d20 cb9a86d0 c03ee198 cb9a86d0 00000001 c5031d5c c5031d40 c0049bd4 c0189d08
[ 358.978820] 1d40 c03ee198 cb9a86d0 00000000 000003f8 c5031d7c c5031d60 c0049dd8 c0049be4
[ 358.981079] 1d60 c50f02c0 c03ee160 c5030000 000003f8 c5031dc4 c5031d80 c02e92bc c0049d54
[ 358.983581] 1d80 002ec000 00000000 c5031dc4 c50f052c c5031e40 00000000 c5031e60 00000000
[ 358.986083]
[ 358.986083] IP: 0xc5031cc0:
[ 358.986541] 1cc0 cb9a86d0 00000001 c5031d3c c5031cd8 c00259ac c0025200 c03ee198 cb9a86f0
[ 358.989044] 1ce0 0000001c 00000000 00040cf1 cb9a86f0 cb9a86d0 00000001 c50f052c c02edb50
[ 358.991333] 1d00 00000000 c5031d3c c5031d40 c5031d20 c0049bd4 c0189dd8 20000093 ffffffff
[ 358.993591] 1d20 cb9a86d0 c03ee198 cb9a86d0 00000001 c5031d5c c5031d40 c0049bd4 c0189d08
[ 358.996063] 1d40 c03ee198 cb9a86d0 00000000 000003f8 c5031d7c c5031d60 c0049dd8 c0049be4
[ 358.998565] 1d60 c50f02c0 c03ee160 c5030000 000003f8 c5031dc4 c5031d80 c02e92bc c0049d54
[ 359.001068] 1d80 002ec000 00000000 c5031dc4 c50f052c c5031e40 00000000 c5031e60 00000000
[ 359.003326] 1da0 c5031e4c c5030000 00000000 c5031e60 c041d7a0 002ec86c c5031ebc c5031dc8
[ 359.005828]
[ 359.005828] FP: 0xc5031cbc:
[ 359.006286] 1cbc c5031d0c cb9a86d0 00000001 c5031d3c c5031cd8 c00259ac c0025200 c03ee198
[ 359.008758] 1cdc cb9a86f0 0000001c 00000000 00040cf1 cb9a86f0 cb9a86d0 00000001 c50f052c
[ 359.011230] 1cfc c02edb50 00000000 c5031d3c c5031d40 c5031d20 c0049bd4 c0189dd8 20000093
[ 359.013732] 1d1c ffffffff cb9a86d0 c03ee198 cb9a86d0 00000001 c5031d5c c5031d40 c0049bd4
[ 359.015991] 1d3c c0189d08 c03ee198 cb9a86d0 00000000 000003f8 c5031d7c c5031d60 c0049dd8
[ 359.018493] 1d5c c0049be4 c50f02c0 c03ee160 c5030000 000003f8 c5031dc4 c5031d80 c02e92bc
[ 359.020965] 1d7c c0049d54 002ec000 00000000 c5031dc4 c50f052c c5031e40 00000000 c5031e60
[ 359.023254] 1d9c 00000000 c5031e4c c5030000 00000000 c5031e60 c041d7a0 002ec86c c5031ebc
[ 359.025726]
[ 359.025726] R0: 0xc03ee118:
[ 359.026397] e118 c03c7a58 c03c7a64 c03c7a70 c03c7a7c c03c7a88 c03c7a94 00003a98 e0131b08
[ 359.028686] e138 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cc44c000
[ 359.031188] e158 cc46ebc0 00000000 0000008d 000030c4 00003d4a 00006848 00006322 00006709
[ 359.033691] e178 00000000 00000000 00000000 00040cf1 00000000 00004015 00af3216 00000000
[ 359.035949] e198 00040cf1 00000000 0000001c 00000000 784ca882 0000001b 8ebd0837 0000002e
[ 359.038421] e1b8 cb79efd8 cb9a86d8 c53e2744 cc582c64 00000000 00000000 00000000 cc582c50
[ 359.040924] e1d8 0000080a c03ee160 c03ee538 cba19188 c03eea58 00000000 00000000 00000000
[ 359.043365] e1f8 00000000 00000010 c03ee200 c03ee200 c03ee208 c03ee208 c03ee210 c03ee210
[ 359.045654]
[ 359.045654] R1: 0xcb9a8670:
[ 359.046325] 8670 00000002 ffffffff 00000000 00000001 ffffffff 00000000 00000000 00000000
[ 359.048583] 8690 00000000 00000000 00000000 00000000 00000000 cb9f0000 00000004 00400140
[ 359.051086] 86b0 00000000 ffffffff 00000078 00000078 00000078 00000000 c02edb50 00000000
[ 359.053558] 86d0 00000400 00400000 c6e0f2b9 c6e39298 00000000 cb806544 c6e392a4 00000001
[ 359.056030] 86f0 8f83f628 00040cf0 a1018b11 00000000 8e2471b7 0000002e a1018b11 00000000
[ 359.058319] 8710 00000000 00000000 00003629 00000000 00000000 00000000 074a5ed5 00000000
[ 359.060821] 8730 00004006 00000000 c2fbde43 00000001 00000000 00000000 eab7f810 00000025
[ 359.063293] 8750 e923f5af 00000047 00000000 00000000 1c7b530e 00000000 009933db 00000000
[ 359.065765]
[ 359.065795] R5: 0xcb9a8670:
[ 359.066253] 8670 00000002 ffffffff 00000000 00000001 ffffffff 00000000 00000000 00000000
[ 359.068695] 8690 00000000 00000000 00000000 00000000 00000000 cb9f0000 00000004 00400140
[ 359.070953] 86b0 00000000 ffffffff 00000078 00000078 00000078 00000000 c02edb50 00000000
[ 359.073455] 86d0 00000400 00400000 c6e0f2b9 c6e39298 00000000 cb806544 c6e392a4 00000001
[ 359.075958] 86f0 8f83f628 00040cf0 a1018b11 00000000 8e2471b7 0000002e a1018b11 00000000
[ 359.078430] 8710 00000000 00000000 00003629 00000000 00000000 00000000 074a5ed5 00000000
[ 359.080718] 8730 00004006 00000000 c2fbde43 00000001 00000000 00000000 eab7f810 00000025
[ 359.083007] 8750 e923f5af 00000047 00000000 00000000 1c7b530e 00000000 009933db 00000000
[ 359.085510]
[ 359.085510] R6: 0xcb9a8650:
[ 359.085968] 8650 00000000 00000000 00000000 00000000 cb9a2640 c6e06680 000006a0 cb9a86a0
[ 359.088439] 8670 00000002 ffffffff 00000000 00000001 ffffffff 00000000 00000000 00000000
[ 359.090942] 8690 00000000 00000000 00000000 00000000 00000000 cb9f0000 00000004 00400140
[ 359.093231] 86b0 00000000 ffffffff 00000078 00000078 00000078 00000000 c02edb50 00000000
[ 359.095489] 86d0 00000400 00400000 c6e0f2b9 c6e39298 00000000 cb806544 c6e392a4 00000001
[ 359.097961] 86f0 8f83f628 00040cf0 a1018b11 00000000 8e2471b7 0000002e a1018b11 00000000
[ 359.100219] 8710 00000000 00000000 00003629 00000000 00000000 00000000 074a5ed5 00000000
[ 359.102722] 8730 00004006 00000000 c2fbde43 00000001 00000000 00000000 eab7f810 00000025
[ 359.105194]
[ 359.105194] R8: 0xc50f04ac:
[ 359.105651] 04ac cbd222a0 cbd222a0 c50f04b4 c50f04b4 c535e49c c535f01c cb9a3200 c50f04c8
[ 359.107910] 04cc c50f04c8 c50f04d0 c50f04d0 00000000 c6d5ede8 c6d5ede0 cb729144 cb9a88c4
[ 359.110412] 04ec cc5e99e0 cb987410 cb9a88d0 c03ca990 cb9a343c c6d70dfc 00000000 00000000
[ 359.112640] 050c 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 359.114685] 052c 00000157 00000007 00000033 2c419d66 00000033 2c419d66 00000002 00000000
[ 359.117126] 054c 00000000 00000000 00000000 00000000 00000000 c50f0560 c50f0560 c50f0568
[ 359.119598] 056c c50f0568 c50f0570 c50f0570 cbceb1a0 cbceb1a0 00000001 c50f0584 c50f0584
[ 359.121887] 058c 206b7453 20707041 76726553 00656369 00000000 00000000 00000000 00000000
[ 359.124145]
[ 359.124145] R9: 0xc02edad0:
[ 359.124816] dad0 0004624c 00057ff5 0006dd25 000899bc 000abe5d 000d5d21 0010c73e 0014ff97
[ 359.127136] daf0 001a3434 0020ea87 00295252 003351fe 00400000 004fec05 00640e12 007c97d9
[ 359.129608] db10 009aee73 00c3a13e 00f0f0f1 0130d190 017d05f4 01de5d6e 0253c825 02f14990
[ 359.132080] db30 03a83a84 04924924 05b05b05 071c71c7 08d3dcb0 0b21642c 0e38e38e 11111111
[ 359.134368] db50 c02ed8c8 c004b210 c004af90 c004ac44 c004aa18 c0049d48 c004a950 c0049d18
[ 359.136657] db70 c004a88c c004b24c 00000000 c0048720 c00486c0 c004a85c c02edb50 c004f868
[ 359.139160] db90 c004c630 c0048768 c00487c4 c0049960 c004c60c c00488a4 c004c508 00000000
[ 359.141632] dbb0 00000000 c0048804 c004884c 00000000 54445352 00585a74 00000000 00000000
[ 359.143920] Process Stk App Service (pid: 292, stack limit = 0xc5030260)
[ 359.144378] Stack: (0xc5031d20 to 0xc5032000)
[ 359.144622] 1d20: cb9a86d0 c03ee198 cb9a86d0 00000001 c5031d5c c5031d40 c0049bd4 c0189d08
[ 359.147094] 1d40: c03ee198 cb9a86d0 00000000 000003f8 c5031d7c c5031d60 c0049dd8 c0049be4
[ 359.149353] 1d60: c50f02c0 c03ee160 c5030000 000003f8 c5031dc4 c5031d80 c02e92bc c0049d54
[ 359.151824] 1d80: 002ec000 00000000 c5031dc4 c50f052c c5031e40 00000000 c5031e60 00000000
[ 359.154113] 1da0: c5031e4c c5030000 00000000 c5031e60 c041d7a0 002ec86c c5031ebc c5031dc8
[ 359.156616] 1dc0: c007596c c02e9138 c004ad40 c004a654 c50f02f0 c5031e54 ffffffff 00000001
[ 359.159088] 1de0: c03ee198 cb9a86d8 c2a452ea 00000001 c5031e14 c5031e00 c5030000 c50f02c0
[ 359.161560] 1e00: 00000015 000003f8 c50f052c cb9a86a0 c5031e3c c5031e20 c006e1fc c006dbbc
[ 359.163848] 1e20: 00000000 000003f8 cb9f001c c50f02c0 c5031e54 c5031e40 c006e248 c006e1d4
[ 359.166107] 1e40: 00000064 c041d7a0 c041d7a0 c041d7a8 c041d7a8 c5031e84 c5031e84 c041d7a0
[ 359.168609] 1e60: 002ec000 cb614820 0000086e 00000000 c50f02c0 ffffffff 00000000 c50f02c0
[ 359.171112] 1e80: c004bd80 c5031e54 c5031e54 ffffffff c5031ebc 00000000 002ec86c 002ec868
[ 359.173400] 1ea0: 000000f0 c0025f24 ffffffff 00000001 c5031f44 c5031ec0 c00771ac c007570c
[ 359.175872] 1ec0: ffffffff 00000000 c5031f4c c50f05e0 c023190c 45a4fd60 c0186201 c0025f24
[ 359.178344] 1ee0: c5030000 42638f08 c5031f14 c5031ef8 c00c0998 c0231918 45a4fd60 cb7eaaa0
[ 359.180633] 1f00: c0186201 00000014 c5031f7c c5031f18 c00c1004 c00c0970 ffffffff 00000000
[ 359.183105] 1f20: 00000000 00000000 000000f0 c0025f24 c5030000 002ec86c c5031fa4 c5031f48
[ 359.185607] 1f40: c0077c80 c0077110 002ec868 00000000 ffffffff c0057744 cb7eaaa0 ffffffff
[ 359.188049] 1f60: c0186201 00000014 c0025f24 c5030000 c5031fa4 002ec868 002ec86c 002ec868
[ 359.190368] 1f80: 002ec86c 00000000 000000f0 c0025f24 c5030000 42638ed4 00000000 c5031fa8
[ 359.192840] 1fa0: c0025da0 c0077b54 002ec868 002ec86c 002ec86c 00000000 ffffffff 00000000
[ 359.195343] 1fc0: 002ec868 002ec86c 00000000 000000f0 ad00f380 002ebf20 42638ed4 002ebf20
[ 359.197875] 1fe0: ad080248 45a4fd08 afe0f5d4 afe0dc44 60000010 002ec86c 00000000 00000000
[ 359.200164] Backtrace:
[ 359.200836] [<c0189cfc>] (rb_erase+0x0/0x360) from [<c0049bd4>] (__dequeue_entity+0x38/0x3c)
[ 359.201812] r7:00000001 r6:cb9a86d0 r5:c03ee198 r4:cb9a86d0
[ 359.203155] [<c0049bd8>] (set_next_entity+0x0/0x140) from [<c0049dd8>] (pick_next_task_fair+0x90/0xa4)
[ 359.204315] r7:000003f8 r6:00000000 r5:cb9a86d0 r4:c03ee198
[ 359.205474] [<c0049d48>] (pick_next_task_fair+0x0/0xa4) from [<c02e92bc>] (schedule+0x190/0x444)
[ 359.206634] r7:000003f8 r6:c5030000 r5:c03ee160 r4:c50f02c0
[ 359.207763] [<c02e912c>] (schedule+0x0/0x444) from [<c007596c>] (futex_wait+0x26c/0x510)
[ 359.208923] [<c0075700>] (futex_wait+0x0/0x510) from [<c00771ac>] (do_futex+0xa8/0xa44)
[ 359.210083] [<c0077104>] (do_futex+0x0/0xa44) from [<c0077c80>] (sys_futex+0x138/0x14c)
[ 359.211212] [<c0077b48>] (sys_futex+0x0/0x14c) from [<c0025da0>] (ret_fast_syscall+0x0/0x2c)
[ 359.212188] Code: 15813000 ea00000e e3520000 e5904000 (15923000)
[ 359.214141] Kernel panic - not syncing: Fatal exception
[ 359.214508] apanic_writeflashpage: No panic_write available
[ 359.214965] apanic: Flash write failed (0)

Here's another:
Code:
[ 106.688842] Freezing user space processes ... <1>Unable to handle kernel paging request at virtual address 41b881d8
[ 106.699829] pgd = c530c000
[ 106.700286] [41b881d8] *pgd=1e513031, *pte=00000000, *ppte=00000000
[ 106.701202] Internal error: Oops: 817 [#1] PREEMPT
[ 106.701660] Modules linked in: wlan ramzswap
[ 106.702575] CPU: 0 Not tainted (2.6.29.6-cm42 #2)
[ 106.702850] PC is at set_next_entity+0xb4/0x140
[ 106.703308] LR is at pick_next_task_fair+0x90/0xa4
[ 106.703552] pc : [<c0049c8c>] lr : [<c0049dd8>] psr: 20000093
[ 106.703582] sp : c534be18 ip : 00000000 fp : c534be34
[ 106.704254] r10: 00000000 r9 : c02edb50 r8 : c6f9246c
[ 106.704681] r7 : 00000000 r6 : 69ef2e6c r5 : cba190e0 r4 : 41b88170
[ 106.704925] r3 : 6b55bd8f r2 : 11983e9c r1 : 00000000 r0 : 00000000
[ 106.705383] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 106.705841] Control: 00c5387d Table: 1e50c008 DAC: 00000015
[ 106.706085]
[ 106.706085] PC: 0xc0049c0c:
[ 106.706542] 9c0c e591105c e5940058 e0522006 e0c33007 e1510003 e1a0c003 8a000002 1a000003
[ 106.709045] 9c2c e1500002 9a000001 e1a02000 e1a0c001 e1c406d0 e5842058 e3a02001 e0900002
[ 106.711547] 9c4c e3a03000 e0a11003 e584c05c e1c406f0 e5952044 e3a03ffe e0822003 e1c466d8
[ 106.714019] 9c6c e1c220d0 e1c405d0 e0922006 e0a33007 e0522000 e0c33001 e3a00000 e3a01000
[ 106.716278] 9c8c e1c426f8 e1c405f0 e1a00005 e1a01004 ebffffbe e5952044 e3a03ffe e0822003
[ 106.718566] 9cac e1c220d0 e1c422f0 e5953044 e5854034 e5942000 e5933024 e1530082 3a00000f
[ 106.721069] 9ccc e1c422d8 e1c463d8 e59400a4 e594c0a0 e0522006 e0c33007 e1500003 e1a01003
[ 106.723541] 9cec 8a000002 1a000003 e15c0002 9a000001 e1a0200c e1a01000 e58420a0 e58410a4
[ 106.725830]
[ 106.725830] LR: 0xc0049d58:
[ 106.726470] 9d58 e3550000 01a00005 089da8f0 e2804038 e3a06000 e5945024 e5940038 e3550000
[ 106.728759] 9d78 12455008 e3500000 0a000004 e1a01005 ebfffe4b e3500000 d5945038 da000006
[ 106.731048] 9d98 e594003c e3500000 0a000003 e1a01005 ebfffe43 e3500000 d594503c e594303c
[ 106.733551] 9db8 e1a00004 e1530005 e5943038 0584603c e1530005 05846038 e1a01005 ebffff7f
[ 106.736022] 9dd8 e5954130 e3540000 1affffe1 e2450030 e89da8f0 e1a0c00d e92ddbf0 e24cb004
[ 106.738281] 9df8 e1c081d8 e1c143d0 e1a03000 e280c020 e0544008 e0c55009 e3a00001 e3a0e000
[ 106.740753] 9e18 ea00000b e1c262d8 e282c008 e0566008 e0c77009 e1570005 ca000004 1a000001
[ 106.743225] 9e38 e1560004 8a000001 e282c004 e3a00000 e1a0e002 e59c2000 e3520000 1afffff0
[ 106.745544]
[ 106.745544] SP: 0xc534bd98:
[ 106.746185] bd98 ff67e0b8 ffffffff c534be4c c6f92230 cba190e0 00000001 ffffffff c534be04
[ 106.748687] bdb8 69ef2e6c 00000000 c534be34 c534bdd0 c00259ac c0025200 00000000 00000000
[ 106.750976] bdd8 11983e9c 6b55bd8f 41b88170 cba190e0 69ef2e6c 00000000 c6f9246c c02edb50
[ 106.753479] bdf8 00000000 c534be34 00000000 c534be18 c0049dd8 c0049c8c 20000093 ffffffff
[ 106.755950] be18 cba190e0 c7058170 00000000 000003f8 c534be54 c534be38 c0049dd8 c0049be4
[ 106.758209] be38 c6f92200 c03ee160 c534a000 000003f8 c534be9c c534be58 c02e92bc c0049d54
[ 106.760681] be58 d56ac5a1 00000018 ad080000 c6f9246c d56ac5a1 00000018 c6f92200 c534a000
[ 106.763153] be78 00000000 00000002 000000f0 c0025f24 c534a000 10000000 c534bebc c534bea0
[ 106.765655]
[ 106.765655] FP: 0xc534bdb4:
[ 106.766113] bdb4 c534be04 69ef2e6c 00000000 c534be34 c534bdd0 c00259ac c0025200 00000000
[ 106.768585] bdd4 00000000 11983e9c 6b55bd8f 41b88170 cba190e0 69ef2e6c 00000000 c6f9246c
[ 106.770874] bdf4 c02edb50 00000000 c534be34 00000000 c534be18 c0049dd8 c0049c8c 20000093
[ 106.773376] be14 ffffffff cba190e0 c7058170 00000000 000003f8 c534be54 c534be38 c0049dd8
[ 106.775878] be34 c0049be4 c6f92200 c03ee160 c534a000 000003f8 c534be9c c534be58 c02e92bc
[ 106.778381] be54 c0049d54 d56ac5a1 00000018 ad080000 c6f9246c d56ac5a1 00000018 c6f92200
[ 106.780639] be74 c534a000 00000000 00000002 000000f0 c0025f24 c534a000 10000000 c534bebc
[ 106.783142] be94 c534bea0 c006ff68 c02e9138 c534bfb0 c0025f24 00000000 000000f0 c534bf9c
[ 106.785430]
[ 106.785430] R5: 0xcba19060:
[ 106.785858] 9060 0000000a 0000000b 0000000c 0000000d 0000000e 0000000f 00000010 00000011
[ 106.788330] 9080 00000012 00000013 00000014 00000015 00000016 00000017 00000018 00000019
[ 106.790802] 90a0 0000001a 0000001b 0000001c 0000001d 0000001e 0000001f 00000020 00000021
[ 106.793060] 90c0 00000022 00000023 00000024 00000025 00000026 00000027 ffffffff 00000000
[ 106.795562] 90e0 00009000 00000000 00000024 00000000 e619afda 00000000 490f6bef 00000003
[ 106.797821] 9100 c6fcccd8 c7058178 c5309064 c6ee94a4 00000000 00000000 00000000 00000000
[ 106.800323] 9120 00000804 c03ee160 cba19188 c03ee538 cba20560 00000000 00000000 00000000
[ 106.802581] 9140 00000000 00000000 00000000 00000000 00000000 00000000 fff00000 ffffffff
[ 106.805053]
[ 106.805084] R8: 0xc6f923ec:
[ 106.805511] 23ec cbcfa280 cbcfa280 c6f923f4 c6f923f4 c530869c c53031fc c5303000 c6f92408
[ 106.808013] 240c c6f92408 c6f92410 c6f92410 00000000 c6f5a6a8 c6f5a6a0 c505c624 cc5e9a6c
[ 106.810302] 242c cc5e9a60 c505c630 c03ca9a0 c03ca990 c53086dc c530323c 00000000 00000000
[ 106.812774] 244c 00000000 00000003 00000000 00000003 00000000 00000000 00000000 00000000
[ 106.815063] 246c 00000011 0000000e 00000039 01442d0f 00000039 01442d0f 000003cf 00000000
[ 106.817535] 248c 00000000 00000000 00000000 00000000 00000000 c6f924a0 c6f924a0 c6f924a8
[ 106.820037] 24ac c6f924a8 c6f924b0 c6f924b0 cc5ed8a0 cc5ed8a0 00000001 c6f924c4 c6f924c4
[ 106.822326] 24cc 70616548 6b726f57 00007265 00000000 00000000 00000001 00000000 00000000
[ 106.824829]
[ 106.824829] R9: 0xc02edad0:
[ 106.825469] dad0 0004624c 00057ff5 0006dd25 000899bc 000abe5d 000d5d21 0010c73e 0014ff97
[ 106.827758] daf0 001a3434 0020ea87 00295252 003351fe 00400000 004fec05 00640e12 007c97d9
[ 106.830230] db10 009aee73 00c3a13e 00f0f0f1 0130d190 017d05f4 01de5d6e 0253c825 02f14990
[ 106.832702] db30 03a83a84 04924924 05b05b05 071c71c7 08d3dcb0 0b21642c 0e38e38e 11111111
[ 106.835021] db50 c02ed8c8 c004b210 c004af90 c004ac44 c004aa18 c0049d48 c004a950 c0049d18
[ 106.837493] db70 c004a88c c004b24c 00000000 c0048720 c00486c0 c004a85c c02edb50 c004f868
[ 106.839965] db90 c004c630 c0048768 c00487c4 c0049960 c004c60c c00488a4 c004c508 00000000
[ 106.842468] dbb0 00000000 c0048804 c004884c 00000000 54445352 00585a74 00000000 00000000
[ 106.844726] Process HeapWorker (pid: 331, stack limit = 0xc534a260)
[ 106.845184] Stack: (0xc534be18 to 0xc534c000)
[ 106.845428] be00: cba190e0 c7058170
[ 106.847686] be20: 00000000 000003f8 c534be54 c534be38 c0049dd8 c0049be4 c6f92200 c03ee160
[ 106.850189] be40: c534a000 000003f8 c534be9c c534be58 c02e92bc c0049d54 d56ac5a1 00000018
[ 106.852539] be60: ad080000 c6f9246c d56ac5a1 00000018 c6f92200 c534a000 00000000 00000002
[ 106.855041] be80: 000000f0 c0025f24 c534a000 10000000 c534bebc c534bea0 c006ff68 c02e9138
[ 106.857513] bea0: c534bfb0 c0025f24 00000000 000000f0 c534bf9c c534bec0 c002828c c006fe48
[ 106.860015] bec0: ffffffff 00000000 c534bf4c c6f92520 c00b3b18 c00e11ec 00000000 c02330dc
[ 106.862304] bee0: c009fe28 100ffe24 00000004 100ffe23 00000001 100ffe58 0000000b 00000000
[ 106.864807] bf00: c534bf1c c534bf10 c006d384 c018a5fc c534bfa4 c534bf20 c009ce90 00000000
[ 106.867248] bf20: 00000000 00000000 000000f0 c0025f24 c534a000 ad080fa8 c534bfa4 c534bf48
[ 106.869750] bf40: c0077c80 c0077110 ad080fa4 00000000 ffffffff 00000004 cba906a0 ffffffb7
[ 106.872039] bf60: c534bfa4 c534bf70 c00b3c00 c00b4a40 00000000 ad080fa4 ad080fa8 00000000
[ 106.874481] bf80: 000000f0 c0025f24 c534a000 10000000 c534bfac c534bfa0 c00287b8 c002824c
[ 106.876953] bfa0: 00000000 c534bfb0 c0025dec c0028794 ad080fa8 00000000 ffffffb7 00000000
[ 106.879455] bfc0: ad080fa4 ad080fa8 00000000 000000f0 00100000 ad041c25 10000000 00134738
[ 106.881713] bfe0: ad080248 100ffe38 afe0f5d4 afe0dc40 60000010 ad080fa8 00000000 00000000
[ 106.884216] Backtrace:
[ 106.884674] [<c0049bd8>] (set_next_entity+0x0/0x140) from [<c0049dd8>] (pick_next_task_fair+0x90/0xa4)
[ 106.885833] r7:000003f8 r6:00000000 r5:c7058170 r4:cba190e0
[ 106.887207] [<c0049d48>] (pick_next_task_fair+0x0/0xa4) from [<c02e92bc>] (schedule+0x190/0x444)
[ 106.888153] r7:000003f8 r6:c534a000 r5:c03ee160 r4:c6f92200
[ 106.889495] [<c02e912c>] (schedule+0x0/0x444) from [<c006ff68>] (refrigerator+0x12c/0x18c)
[ 106.890655] [<c006fe3c>] (refrigerator+0x0/0x18c) from [<c002828c>] (do_signal+0x4c/0x548)
[ 106.891601] r7:000000f0 r6:00000000 r5:c0025f24 r4:c534bfb0
[ 106.892974] [<c0028240>] (do_signal+0x0/0x548) from [<c00287b8>] (do_notify_resume+0x30/0x34)
[ 106.894104] [<c0028788>] (do_notify_resume+0x0/0x34) from [<c0025dec>] (work_pending+0x1c/0x20)
[ 106.895080] Code: e0522000 e0c33001 e3a00000 e3a01000 (e1c426f8)
[ 106.896850] Kernel panic - not syncing: Fatal exception
[ 106.897216] apanic_writeflashpage: No panic_write available
[ 106.897674] apanic: Flash write failed (0)
Not sure if it's related, but I also see this in the dmesg:
Code:
<6>[15014.889343] get_smem_clock: exit timeout state 10d29 clock 509296055 in 257 ticks
<6>[15014.914093] get_smem_clock: invalid start state 10d29 clock 509296055
<6>[15016.968231] get_smem_clock: exit timeout state 10d29 clock 509370592 in 257 ticks
<6>[15017.197174] get_smem_clock: invalid start state 10d29 clock 509370592
<6>[15019.866333] get_smem_clock: exit timeout state 10d29 clock 509459049 in 257 ticks
<6>[15019.877075] get_smem_clock: invalid start state 10d29 clock 509459049
<6>[15021.312255] get_smem_clock: exit timeout state 10d29 clock 509507224 in 257 ticks
<6>[15021.396606] get_smem_clock: invalid start state 10d29 clock 509507224
<6>[15022.048858] get_smem_clock: exit timeout state 10d29 clock 509535679 in 257 ticks
<6>[15022.216491] get_smem_clock: invalid start state 10d29 clock 509535679
<6>[15026.966278] get_smem_clock: exit timeout state 10d29 clock 509691696 in 257 ticks
<6>[15026.977020] get_smem_clock: invalid start state 10d29 clock 509691696
<6>[15026.982513] get_smem_clock: exit timeout state 10d29 clock 509692230 in 257 ticks
<6>[15026.993225] get_smem_clock: invalid start state 10d29 clock 509692230
Has anybody seen anything like this?

For reference, the phone is:
Sapphire PVT 32A ENG S-OFF H
HBOOT-1.33.2010 (SAPP10000)
CPLD-12
RADIO-3.22.20.17
I've used a couple of different SPL's and radios. Never makes any difference.

hate to say this, but I've gone thru 2 HTC Magic's from Rogers and both were doing the random re-boot, seemed especially while the screen was off (sleep mode?) and getting a text or a phone call. The worst thing was that the last phone, which was a warranty replacement, wasn't even rooted yet but had the FACTORY IMAGE still.

Standard operator ROMS (with the HTC kernel) are fine.. so this isn't a problem like that.

I have the EXACT problem! How do I know which ROMS have an HTC kernel though?

I've done a lot of trial and error. I've tried so many ROMS, and it seemed that any custom kernel has these reboot problems.. and you can only get Android 1.5 ROMS with HTC kernel
You can find out your kernel version in Settings -> About Phone. It'll have 'htc' in there if it's a HTC kernel. On my G1, I've got 2.6.29-cm42 for a Cyanogen kernel for example.
I've flashed the phone now with a generic carrier ROM, just so that it would be stable. Not happy about doing it.. but at least it works. I image that it'll never even see Android 1.6, because they'll never release it.

Nexus One on Enom 2.14 suddenly rebooting frequently

Normally my N1 goes 30-40, record of 52 days uptime.. Only time I ever have to reboot is when 3G mysteriously won't reconnect or Wifi Tether won't enable.
However the last 12 hours I've had 3-4 full system reboots. This last time I looked and found a /proc/last_kmsg, here's the last bits of it. Can anyone make any sense of this?
Looks to me like some sort of watchdog timeout and the kernel is rebooting itself, a hang... But I can't figure out what could be suddenly causing this. I have not tried anything drastic, such as clearing all and reinstalling the ROM or such, but really nothing has changed on the phone except app updates.
Running Enom's 2.14.3, /system, /data, /sdcard, /cache etc all have reasonable space available, each time I wasn't really doing anything with the phone, most times it was actually just in my phone holster and I felt the vibration. Didn't have wifi tether on, etc.. At least one time I had wifi on, but this last time no wifi at work..
[ 1101.675750] suspend: enter suspend
[ 1101.675933] PM: Syncing filesystems ...
[ 1101.845550] save exit: isCheckpointed 1
[ 1105.169342] done.
[ 1105.169494] Freezing user space processes ...
[ 1105.174652] active wake lock PowerManagerService
[ 1105.174957]
[ 1105.175109] Freezing of tasks aborted after 0.00 seconds (477 tasks refusing to freeze):
[ 1105.176361]
[ 1105.176513] Restarting tasks ... done.
[ 1105.186279] suspend: exit suspend, ret = -16 (2011-06-28 15:05:28.001800560 UTC)
[ 1105.186553] active wake lock PowerManagerService
[ 1105.186676] suspend: abort suspend
[ 1111.200378] save exit: isCheckpointed 1
[ 1118.112091] suspend: enter suspend
[ 1118.112274] PM: Syncing filesystems ...
[ 1118.292663] save exit: isCheckpointed 1
[ 1123.845977] done.
[ 1123.846130] Freezing user space processes ... (elapsed 0.08 seconds) done.
[ 1123.927978] Freezing remaining freezable tasks ... (elapsed 0.00 seconds) done.
[ 1126.927276] **** DPM device timeout: mmc1:0001 (mmcblk)
[ 1126.928009] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 1126.928405] pgd = c0004000
[ 1126.929077] [00000000] *pgd=00000000
[ 1126.929779] Internal error: Oops: 817 [#1] PREEMPT
[ 1126.930145] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state
[ 1126.930847] Modules linked in: ipv6 ext4 jbd2
[ 1126.932891] CPU: 0 Not tainted (2.6.32.25-TheOfficial-AudioMOD-720p #1)
[ 1126.933319] PC is at dpm_drv_timeout+0x24/0x34
[ 1126.934020] LR is at dpm_drv_timeout+0x20/0x34
[ 1126.934417] pc : [<c01aabc8>] lr : [<c01aabc4>] psr: 20000013
[ 1126.934417] sp : c03ddee8 ip : 00000000 fp : 00000103
[ 1126.935455] r10: c042f36c r9 : c03ddef8 r8 : c042f56c
[ 1126.935821] r7 : c042f76c r6 : c042f96c r5 : c03dc000 r4 : c042eb60
[ 1126.936492] r3 : 00000000 r2 : c03ddedc r1 : c038d1b4 r0 : 00000041
[ 1126.937194] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 1126.937561] Control: 10c5787d Table: 273ac019 DAC: 00000035
[ 1126.938232]
[ 1126.938232] PC: 0xc01aab48:
[ 1126.938934] ab48 e5913020 e3530000 0a00000e e12fff33 e5942020 ea000004 e5943024 e3530000
[ 1126.942749] ab68 0a000008 e12fff33 e5942024 e2504000 0a000005 e59f1018 e1a03004 e59f0014
[ 1126.946563] ab88 eb050d06 ea000000 e3a04000 e1a00004 e8bd8010 c030e3c8 c038d191 e92d4010
[ 1126.950012] aba8 e5903044 e5901008 e3530000 e59f0014 15932000 059f2010 eb050cf8 e3a03000
[ 1126.953765] abc8 e5833000 eafffffd c038d1b4 c038d1aa e3510008 e1a0c003 e92d4007 e1a0e002
[ 1126.957214] abe8 e5903008 059f2090 0a00001d ca000008 e3510002 059f2084 0a000019 e3510004
[ 1126.960662] ac08 059f207c 0a000016 e3510001 1a000013 ea00000e e3510020 059f2068 0a000010
[ 1126.964416] ac28 ca000002 e3510010 1a00000c ea000005 e3510040 059f2050 0a000009 e3510080
[ 1126.968170]
[ 1126.968200] LR: 0xc01aab44:
[ 1126.968872] ab44 ea000005 e5913020 e3530000 0a00000e e12fff33 e5942020 ea000004 e5943024
[ 1126.972656] ab64 e3530000 0a000008 e12fff33 e5942024 e2504000 0a000005 e59f1018 e1a03004
[ 1126.976074] ab84 e59f0014 eb050d06 ea000000 e3a04000 e1a00004 e8bd8010 c030e3c8 c038d191
[ 1126.979553] aba4 e92d4010 e5903044 e5901008 e3530000 e59f0014 15932000 059f2010 eb050cf8
[ 1126.983337] abc4 e3a03000 e5833000 eafffffd c038d1b4 c038d1aa e3510008 e1a0c003 e92d4007
[ 1126.987060] abe4 e1a0e002 e5903008 059f2090 0a00001d ca000008 e3510002 059f2084 0a000019
[ 1126.990814] ac04 e3510004 059f207c 0a000016 e3510001 1a000013 ea00000e e3510020 059f2068
[ 1126.994293] ac24 0a000010 ca000002 e3510010 1a00000c ea000005 e3510040 059f2050 0a000009
[ 1126.998077]
[ 1126.998077] SP: 0xc03dde68:
[ 1126.998779] de68 c03dde9c 3131205b 392e3632 37323732 00205d36 c79bdf94 00000000 00000001
[ 1127.002563] de88 c79b0a08 ffffffff c03dded4 c042f96c c042f76c c0025a6c 00000041 c038d1b4
[ 1127.006347] dea8 c03ddedc 00000000 c042eb60 c03dc000 c042f96c c042f76c c042f56c c03ddef8
[ 1127.010131] dec8 c042f36c 00000103 00000000 c03ddee8 c01aabc4 c01aabc8 20000013 ffffffff
[ 1127.013580] dee8 c042eb60 c005fccc ffffffff c01aaba4 c03ddef8 c03ddef8 2aea5e9e c03dc000
[ 1127.017364] df08 00000101 00000004 c042e9c0 00000103 0000000a c03e7640 00000000 c005b1cc
[ 1127.021118] df28 00000000 c002f4b8 c03ea174 00000001 c03dc000 00000007 00000000 c040b624
[ 1127.024871] df48 00000002 00000001 c03dc000 00000000 00000000 c005b298 00000007 c002506c
[ 1127.028289]
[ 1127.028320] R1: 0xc038d134:
[ 1127.029296] d134 656c6269 72656b00 5f6c656e 0078616d 6d726966 65726177 69726400 73726576
[ 1127.032806] d154 7361622f 65642f65 73657276 3c00632e 73253e33 3a732520 69616620 2064656c
[ 1127.036529] d174 61206f74 636f6c6c 20657461 73616c63 6f632073 6961746e 0a72656e 3e333c00
[ 1127.040283] d194 29287325 7025203a 65722046 6e727574 64252073 6f6e000a 69726420 00726576
[ 1127.044036] d1b4 2a3e303c 202a2a2a 204d5044 69766564 74206563 6f656d69 203a7475 28207325
[ 1127.047485] d1d4 0a297325 73657200 00656d75 65657266 7100657a 73656975 68006563 72656269
[ 1127.051300] d1f4 6574616e 61687400 65720077 726f7473 65720065 65766f63 75280072 6f6e6b6e
[ 1127.055084] d214 50206e77 7665204d 29746e65 3e333c00 203a4d50 69766544 25206563 61662073
[ 1127.058563]
[ 1127.058593] R2: 0xc03dde5c:
[ 1127.059570] de5c 00000106 60000013 00000030 c03dde9c 3131205b 392e3632 37323732 00205d36
[ 1127.063385] de7c c79bdf94 00000000 00000001 c79b0a08 ffffffff c03dded4 c042f96c c042f76c
[ 1127.066833] de9c c0025a6c 00000041 c038d1b4 c03ddedc 00000000 c042eb60 c03dc000 c042f96c
[ 1127.070587] debc c042f76c c042f56c c03ddef8 c042f36c 00000103 00000000 c03ddee8 c01aabc4
[ 1127.074371] dedc c01aabc8 20000013 ffffffff c042eb60 c005fccc ffffffff c01aaba4 c03ddef8
[ 1127.077819] defc c03ddef8 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103 0000000a
[ 1127.081604] df1c c03e7640 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001 c03dc000
[ 1127.085388] df3c 00000007 00000000 c040b624 00000002 00000001 c03dc000 00000000 00000000
[ 1127.089172]
[ 1127.089172] R4: 0xc042eae0:
[ 1127.089843] eae0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.093597] eb00 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001
[ 1127.097076] eb20 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.100799] eb40 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.104553] eb60 00000000 00014161 00014160 c042eb6c c042eb6c c042eb74 c042eb74 c042eb7c
[ 1127.108337] eb80 c042eb7c c042eb84 c042eb84 c042eb8c c042eb8c c042eb94 c042eb94 c042eb9c
[ 1127.111785] eba0 c042eb9c c042eba4 c042eba4 c042ebac c042ebac c042ebb4 c042ebb4 c042ebbc
[ 1127.115234] ebc0 c042ebbc c042ebc4 c042ebc4 c042ebcc c042ebcc c042ebd4 c042ebd4 c042ebdc
[ 1127.119018]
[ 1127.119049] R5: 0xc03dbf80:
[ 1127.119750] bf80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.123504] bfa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.127258] bfc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.130676] bfe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.134094] c000 00000002 00000105 00000000 c03ded08 c03e76c0 00000000 00000035 c03ded08
[ 1127.137847] c020 c03dc000 c03e7208 c03deeb4 00000000 c73e0cc0 c7915360 c03ddfc4 c03ddf80
[ 1127.141632] c040 c02ee40c 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[ 1127.145080] c060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1127.148803]
[ 1127.148803] R6: 0xc042f8ec:
[ 1127.149505] f8ec c042f8ec c042f8ec c042f8f4 c042f8f4 c042f8fc c042f8fc c042f904 c042f904
[ 1127.152984] f90c c042f90c c042f90c c042f914 c042f914 c042f91c c042f91c c042f924 c042f924
[ 1127.156768] f92c c042f92c c042f92c c042f934 c042f934 c042f93c c042f93c c042f944 c042f944
[ 1127.160552] f94c c042f94c c042f94c c042f954 c042f954 c042f95c c042f95c c042f964 c042f964
[ 1127.164031] f96c c042f96c c042f96c c042f974 c042f974 c042f97c c042f97c c042f984 c042f984
[ 1127.167816] f98c c042f98c c042f98c c042f994 c042f994 c042f99c c042f99c c042f9a4 c042f9a4
[ 1127.171569] f9ac c042f9ac c042f9ac c042f9b4 c042f9b4 c042f9bc c042f9bc c042f9c4 c042f9c4
[ 1127.175018] f9cc c042f9cc c042f9cc c042f9d4 c042f9d4 c042f9dc c042f9dc c042f9e4 c042f9e4
[ 1127.178771]
[ 1127.178771] R7: 0xc042f6ec:
[ 1127.179779] f6ec c042f6ec c042f6ec c042f6f4 c042f6f4 c042f6fc c042f6fc c042f704 c042f704
[ 1127.183288] f70c c042f70c c042f70c c042f714 c042f714 c042f71c c042f71c c042f724 c042f724
[ 1127.187072] f72c c042f72c c042f72c c042f734 c042f734 c042f73c c042f73c c042f744 c042f744
[ 1127.190795] f74c c042f74c c042f74c c042f754 c042f754 c042f75c c042f75c c042f764 c042f764
[ 1127.194213] f76c c042f76c c042f76c c042f774 c042f774 c042f77c c042f77c c042f784 c042f784
[ 1127.197998] f78c c042f78c c042f78c c042f794 c042f794 c042f79c c042f79c c042f7a4 c042f7a4
[ 1127.201782] f7ac c7d29264 c7d3d264 c042f7b4 c042f7b4 c042f7bc c042f7bc c042f7c4 c042f7c4
[ 1127.205566] f7cc c042f7cc c042f7cc c042f7d4 c042f7d4 c042f7dc c042f7dc c042f7e4 c042f7e4
[ 1127.209014]
[ 1127.209014] R8: 0xc042f4ec:
[ 1127.210021] f4ec c042f4ec c042f4ec c042f4f4 c042f4f4 c042f4fc c042f4fc c042f504 c042f504
[ 1127.213500] f50c c042f50c c042f50c c042f514 c042f514 c042f51c c042f51c c042f524 c042f524
[ 1127.217285] f52c c042f52c c042f52c c042f534 c042f534 c042f53c c042f53c c042f544 c042f544
[ 1127.221069] f54c c042f54c c042f54c c042f554 c042f554 c042f55c c042f55c c042f564 c042f564
[ 1127.224822] f56c c042f56c c042f56c c042f574 c042f574 c042f57c c042f57c c042f584 c042f584
[ 1127.228271] f58c c042f58c c042f58c c042f594 c042f594 c04b71e4 c04b71e4 c042f5a4 c042f5a4
[ 1127.232055] f5ac c042f5ac c042f5ac c042f5b4 c042f5b4 c042f5bc c042f5bc c042f5c4 c042f5c4
[ 1127.235534] f5cc c042f5cc c042f5cc c042f5d4 c042f5d4 c042f5dc c042f5dc c042f5e4 c042f5e4
[ 1127.239288]
[ 1127.239288] R9: 0xc03dde78:
[ 1127.239990] de78 00205d36 c79bdf94 00000000 00000001 c79b0a08 ffffffff c03dded4 c042f96c
[ 1127.243743] de98 c042f76c c0025a6c 00000041 c038d1b4 c03ddedc 00000000 c042eb60 c03dc000
[ 1127.247222] deb8 c042f96c c042f76c c042f56c c03ddef8 c042f36c 00000103 00000000 c03ddee8
[ 1127.250976] ded8 c01aabc4 c01aabc8 20000013 ffffffff c042eb60 c005fccc ffffffff c01aaba4
[ 1127.254455] def8 c03ddef8 c03ddef8 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103
[ 1127.258209] df18 0000000a c03e7640 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001
[ 1127.261688] df38 c03dc000 00000007 00000000 c040b624 00000002 00000001 c03dc000 00000000
[ 1127.265411] df58 00000000 c005b298 00000007 c002506c ffffffff f8000000 c040b624 c0025acc
[ 1127.269165]
[ 1127.269165] R10: 0xc042f2ec:
[ 1127.269866] f2ec c042f2ec c042f2ec c042f2f4 c042f2f4 c042f2fc c042f2fc c042f304 c042f304
[ 1127.273651] f30c c042f30c c042f30c c042f314 c042f314 c042f31c c042f31c c042f324 c042f324
[ 1127.277435] f32c c042f32c c042f32c c042f334 c042f334 c042f33c c042f33c c042f344 c042f344
[ 1127.280914] f34c c042f34c c042f34c c042f354 c042f354 c042f35c c042f35c c042f364 c042f364
[ 1127.284698] f36c c042f36c c042f36c c042f374 c042f374 c03e9678 c043301c c042f384 c042f384
[ 1127.288482] f38c c0403078 bf0ccb0c c04072f0 c04072f0 c042f39c c042f39c c042f3a4 c042f3a4
[ 1127.291961] f3ac c042f3ac c042f3ac c042f3b4 c042f3b4 c04069f8 c04069f8 c042f3c4 c042f3c4
[ 1127.295776] f3cc c042f3cc c042f3cc c042f3d4 c042f3d4 c042f3dc c042f3dc c042f3e4 c042f3e4
[ 1127.299591] Process swapper (pid: 0, stack limit = 0xc03dc2f0)
[ 1127.299957] Stack: (0xc03ddee8 to 0xc03de000)
[ 1127.300659] dee0: c042eb60 c005fccc ffffffff c01aaba4 c03ddef8 c03ddef8
[ 1127.301361] df00: 2aea5e9e c03dc000 00000101 00000004 c042e9c0 00000103 0000000a c03e7640
[ 1127.301757] df20: 00000000 c005b1cc 00000000 c002f4b8 c03ea174 00000001 c03dc000 00000007
[ 1127.302459] df40: 00000000 c040b624 00000002 00000001 c03dc000 00000000 00000000 c005b298
[ 1127.303161] df60: 00000007 c002506c ffffffff f8000000 c040b624 c0025acc 00000002 00000006
[ 1127.303558] df80: 0ba61847 00000000 c03dc000 c03df9c0 c040b624 c03df9b8 20020d74 510f00f2
[ 1127.304229] dfa0: 00000000 00000000 0e873c8d c03ddfc0 c0026a60 c0026a64 20000013 ffffffff
[ 1127.304931] dfc0: c03dc000 c0026cd0 c0432efc 00000000 c0022e0c c000891c c0008474 00000000
[ 1127.305664] dfe0: 00000000 c0022e10 00000000 10c53c7d c040b6d0 20008034 00000000 00000000
[ 1127.306091] [<c01aabc8>] (dpm_drv_timeout+0x24/0x34) from [<c005fccc>] (run_timer_softirq+0x16c/0x21c)
[ 1127.306823] [<c005fccc>] (run_timer_softirq+0x16c/0x21c) from [<c005b1cc>] (__do_softirq+0x70/0xf8)
[ 1127.307556] [<c005b1cc>] (__do_softirq+0x70/0xf8) from [<c005b298>] (irq_exit+0x44/0xa8)
[ 1127.308288] [<c005b298>] (irq_exit+0x44/0xa8) from [<c002506c>] (asm_do_IRQ+0x6c/0x84)
[ 1127.308685] [<c002506c>] (asm_do_IRQ+0x6c/0x84) from [<c0025acc>] (__irq_svc+0x4c/0x8c)
[ 1127.309356] Exception stack(0xc03ddf78 to 0xc03ddfc0)
[ 1127.310058] df60: 00000002 00000006
[ 1127.310455] df80: 0ba61847 00000000 c03dc000 c03df9c0 c040b624 c03df9b8 20020d74 510f00f2
[ 1127.311157] dfa0: 00000000 00000000 0e873c8d c03ddfc0 c0026a60 c0026a64 20000013 ffffffff
[ 1127.311889] [<c0025acc>] (__irq_svc+0x4c/0x8c) from [<c0026a64>] (default_idle+0x24/0x28)
[ 1127.312286] [<c0026a64>] (default_idle+0x24/0x28) from [<c0026cd0>] (cpu_idle+0x48/0xa0)
[ 1127.312988] [<c0026cd0>] (cpu_idle+0x48/0xa0) from [<c000891c>] (start_kernel+0x26c/0x2c4)
[ 1127.313690] [<c000891c>] (start_kernel+0x26c/0x2c4) from [<20008034>] (0x20008034)
[ 1127.314392] Code: 15932000 059f2010 eb050cf8 e3a03000 (e5833000)
[ 1127.314788] ---[ end trace f32b239b02090df3 ]---
[ 1127.315460] Kernel panic - not syncing: Fatal exception in interrupt
[ 1127.315826] Rebooting in 5 seconds..
[ 1132.273376] Restarting Linux version 2.6.32.25-TheOfficial-AudioMOD-720p ([email protected]) (gcc version 4.4.0 (GCC) ) #1 PREEMPT Fri Nov 12 21:52:57 EST 2010
[ 1132.273437]
No errors detected

Given I had used the 720 AudioFix kernel for about 4-5 months I am not sure why, but I switched to the 720 kernel without AudioFix and my n1 hasn't rebooted in a few days. Probably going to switch back to see what happens.
I am wondering if something needed refreshing, which is a little worrying..

khaytsus said:
Given I had used the 720 AudioFix kernel for about 4-5 months I am not sure why, but I switched to the 720 kernel without AudioFix and my n1 hasn't rebooted in a few days. Probably going to switch back to see what happens.
I am wondering if something needed refreshing, which is a little worrying..
Click to expand...
Click to collapse
I hope u get it sorted. I'm also on Enom 2.14. No problems. Love it, especially the raw performance compared to all other ROMs.

ksc6000 said:
I hope u get it sorted. I'm also on Enom 2.14. No problems. Love it, especially the raw performance compared to all other ROMs.
Click to expand...
Click to collapse
Yeah it's weird, I have had virtually zero problems from Enom's ROM until that day, 3-4 spontaneous reboots. And none since! I don't know if switching or refreshing the kernel "fixed" it or if it was something else.

[DEV] U8800 2.3.5 Backup / CWM

Installed the latest update from Huawei and got backups of the /system dir and the image too. Should help the devs get some libraries for their roms.
/system
rooted image
UPDATE: THIS IS ONLY FOR USERS OF THE u8800 2.3.5 OFFICIAL UPDATE!
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
REMOVED no working.
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance
Concerning the recovery i tried to recompile it with no luck i dunno what has changed to 2.3.5 went over the mount points again it all seemed good to me at recovery.fstab.
Anyway here is the log from /proc/kmsg where it fails.
Anyone more experienced can have a look as i'm totally in the dark here.
Code:
<3>[92, recovery] [ 5.227172] nt35582_lcd_on: nt35582_lcd exit sleep mode ,on_ret=0
<1>[92, recovery] [ 5.227325] Unable to handle kernel NULL pointer dereference at virtual address 00000080
<1>[92, recovery] [ 5.227325] pgd = cee70000
<1>[92, recovery] [ 5.227355] [00000080] *pgd=0f061031, *pte=00000000, *ppte=00000000
<0>[92, recovery] [ 5.227355] Internal error: Oops: 17 [#1] PREEMPT
<0>[92, recovery] [ 5.227386] last sysfs file: /sys/devices/i2c-3/i2c-dev/i2c-3/uevent
<4>[92, recovery] [ 5.227386] Modules linked in:
<4>[92, recovery] [ 5.227386] CPU: 0 Tainted: G W (2.6.32.9-perf #73)
<4>[92, recovery] [ 5.227416] PC is at msm_rpc_call_reply+0x28/0x16c
<4>[92, recovery] [ 5.227416] LR is at msm_rpc_call+0x1c/0x24
<4>[92, recovery] [ 5.227447] pc : [<c005ad9c>] lr : [<c005aefc>] psr: 20000013
<4>[92, recovery] [ 5.227447] sp : cee49d70 ip : 0000000a fp : 000c60a4
<4>[92, recovery] [ 5.227447] r10: 00000030 r9 : cee0f1e0 r8 : 0000000a
<4>[92, recovery] [ 5.227478] r7 : 00000049 r6 : 00000000 r5 : 00000000 r4 : cee49db8
<4>[92, recovery] [ 5.227478] r3 : 00000030 r2 : cee49db8 r1 : 00000049 r0 : 00000000
<4>[92, recovery] [ 5.227478] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
<4>[92, recovery] [ 5.227508] Control: 10c57c7d Table: 0f070059 DAC: 00000015
<4>[92, recovery] [ 5.227508]
<4>[92, recovery] [ 5.227508] PC: 0xc005ad1c:
<4>[92, recovery] [ 5.227539] ad1c e3520000 05843000 0a000010 ebfff31b e1a05000 e5840000 ea000008 e5912200
<4>[92, recovery] [ 5.227539] ad3c eb08fb07 e59d3004 e1a00003 e5934204 e5933200 e0855003 eb03ccb2 e58d4004
<4>[92, recovery] [ 5.227569] ad5c e59d3004 e1a00005 e2531000 1afffff2 e1a00006 e8bd807c e3530027 e92d45f7
<4>[92, recovery] [ 5.227600] ad7c e59d6028 e1a0a003 e1a05000 e1a07001 e1a04002 e59d8030 93e0af83 9a00004d
<4>[92, recovery] [ 5.227630] ad9c e5903080 e3730001 03e0a06a 0a000049 e1a00002 e3a01028 eb08fcc1 e59f211c
<4>[92, recovery] [ 5.227661] adbc e1923f9f e2833001 e1821f93 e3310000 1afffffa e0231863 e3c118ff e3a02402
<4>[92, recovery] [ 5.227661] addc e5842008 e1a00005 e1a01421 e1a0200a e0213463 e5843000 e5953088 e1a01004
<4>[92, recovery] [ 5.227691] adfc e027c867 e3ccc8ff e584300c e595308c e1a0c42c e02c7467 e5847014 e5843010
<4>[92, recovery] [ 5.227722]
<4>[92, recovery] [ 5.227722] LR: 0xc005ae7c:
<4>[92, recovery] [ 5.227722] ae7c eb03cc68 eaffffe9 e5913008 e3530000 13e0a000 1a00000d e5913014 e3530000
<4>[92, recovery] [ 5.227752] ae9c 13e0a015 1a000009 e3560000 01a0a006 0a000006 e59d302c e15a0003 c3e0a00b
<4>[92, recovery] [ 5.227783] aebc ca000002 e1a00006 e1a0200a eb08faa4 e59d0004 eb03cc53 e1a0000a e8bd85fe
<4>[92, recovery] [ 5.227813] aedc c0770c2c e92d401f e3a0c000 e58dc004 e58dc000 e59dc018 e58dc008 ebffff9d
<4>[92, recovery] [ 5.227844] aefc e28dd014 e8bd8000 e92d45f0 e24dd01c e3a03006 e1a04000 e58d3004 e59f327c
<4>[92, recovery] [ 5.227844] af1c e5901078 e590207c e5933000 e58d1008 e3130004 e58d200c 0a000001 e59f0260
<4>[92, recovery] [ 5.227874] af3c eb14e183 e10f5000 f10c0080 e1a0100d e3c13d7f e3c3303f e5932004 e2822001
<4>[92, recovery] [ 5.227905] af5c e5832004 e59f723c e28d8004 e5b76010 ea000013 ebfff475 e250a000 aa00000f
<4>[92, recovery] [ 5.227935]
<4>[92, recovery] [ 5.227935] SP: 0xcee49cf0:
<4>[92, recovery] [ 5.227935] 9cf0 cfdd7600 cee49d54 00000000 cee49d54 cfdd7600 cee49d64 00000000 cee49d64
<4>[92, recovery] [ 5.227966] 9d10 cfdd7600 ffffffff cee49d5c 00000000 00000049 c0037aac 00000000 00000049
<4>[92, recovery] [ 5.227996] 9d30 cee49db8 00000030 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0
<4>[92, recovery] [ 5.228027] 9d50 00000030 000c60a4 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff
<4>[92, recovery] [ 5.228027] 9d70 00000000 00000049 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001
<4>[92, recovery] [ 5.228057] 9d90 cf227d60 c005aefc 00000000 00000000 0000000a 00000030 cfd74254 c0401678
<4>[92, recovery] [ 5.228088] 9db0 0000000a 0000013c cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001
<4>[92, recovery] [ 5.228118] 9dd0 00000000 cfda5024 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728
<4>[92, recovery] [ 5.228118]
<4>[92, recovery] [ 5.228149] R2: 0xcee49d38:
<4>[92, recovery] [ 5.228149] 9d38 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0 00000030 000c60a4
<4>[92, recovery] [ 5.228179] 9d58 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff 00000000 00000049
<4>[92, recovery] [ 5.228179] 9d78 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc
<4>[92, recovery] [ 5.228210] 9d98 00000000 00000000 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c
<4>[92, recovery] [ 5.228240] 9db8 cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024
<4>[92, recovery] [ 5.228271] 9dd8 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000
<4>[92, recovery] [ 5.228302] 9df8 ffffffff cfd74008 c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000
<4>[92, recovery] [ 5.228302] 9e18 cfd74000 c02b9cfc cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0
<4>[92, recovery] [ 5.228332]
<4>[92, recovery] [ 5.228332] R4: 0xcee49d38:
<4>[92, recovery] [ 5.228363] 9d38 cee49db8 00000000 00000000 00000049 0000000a cee0f1e0 00000030 000c60a4
<4>[92, recovery] [ 5.228363] 9d58 0000000a cee49d70 c005aefc c005ad9c 20000013 ffffffff 00000000 00000049
<4>[92, recovery] [ 5.228393] 9d78 cee49db8 cfd74254 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc
<4>[92, recovery] [ 5.228424] 9d98 00000000 00000000 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c
<4>[92, recovery] [ 5.228454] 9db8 cee40001 cee49dcf cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024
<4>[92, recovery] [ 5.228454] 9dd8 00000000 c031eaf8 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000
<4>[92, recovery] [ 5.228485] 9df8 ffffffff cfd74008 c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000
<4>[92, recovery] [ 5.228515] 9e18 cfd74000 c02b9cfc cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0
<4>[92, recovery] [ 5.228546]
<4>[92, recovery] [ 5.228546] R9: 0xcee0f160:
<4>[92, recovery] [ 5.228546] f160 cee10f20 c0153000 00000000 00000000 c05a6db4 00000000 00020001 0000001e
<4>[92, recovery] [ 5.228576] f180 00000004 00000000 00000000 00000000 00000000 00000000 00000000 cf5689c0
<4>[92, recovery] [ 5.228607] f1a0 00000000 00000000 00000000 00000000 00000000 00000000 ffffffff ffffffff
<4>[92, recovery] [ 5.228607] f1c0 00000000 00000000 cf3f16e0 cee0f1cc cee0f1cc cf5bcf4c 00000000 00000000
<4>[92, recovery] [ 5.228637] f1e0 cee10b20 cf412e74 cfdf5220 cf5f3d18 c05bc07c 00000001 00020002 0000001f
<4>[92, recovery] [ 5.228668] f200 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cee03b00
<4>[92, recovery] [ 5.228698] f220 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[92, recovery] [ 5.228729] f240 00000000 00000000 cfd74000 cee0f24c cee0f24c cee01454 00000000 00000000
<0>[92, recovery] [ 5.228729] Process recovery (pid: 92, stack limit = 0xcee482e8)
<0>[92, recovery] [ 5.228759] Stack: (0xcee49d70 to 0xcee4a000)
<0>[92, recovery] [ 5.228759] 9d60: 00000000 00000049 cee49db8 cfd74254
<0>[92, recovery] [ 5.228790] 9d80: 000000ff cfd74410 000000ff 00000001 cf227d60 c005aefc 00000000 00000000
<0>[92, recovery] [ 5.228790] 9da0: 0000000a 00000030 cfd74254 c0401678 0000000a 0000013c cee40001 cee49dcf
<0>[92, recovery] [ 5.228820] 9dc0: cfda5024 c031e3fc cfda5024 0c000001 00000000 cfda5024 00000000 c031eaf8
<0>[92, recovery] [ 5.228820] 9de0: 00000000 ff000000 cfd74410 c02b9728 cfd74254 00000000 ffffffff cfd74008
<0>[92, recovery] [ 5.228851] 9e00: c0154f44 cee0f1e0 cee0f1e0 c02b989c cfd74254 00000000 cfd74000 c02b9cfc
<0>[92, recovery] [ 5.228881] 9e20: cfd74000 00000000 cee013b8 c02b098c 00000000 cfdad8e0 cee013b8 00000000
<0>[92, recovery] [ 5.228881] 9e40: c0154f44 cf5f3d18 cee0f1e0 c01551a4 cee013b8 00000000 00000000 cee0f1e0
<0>[92, recovery] [ 5.228912] 9e60: cee013b8 cfdf5220 00000000 c0154f44 cf5f3d18 00000001 000c60a4 c01503b0
<0>[92, recovery] [ 5.228912] 9e80: cf5f3d18 cfdf5220 00020002 cee0f1e0 cee03b00 cee49ef0 00000000 cfd6d000
<0>[92, recovery] [ 5.228942] 9ea0: cee48000 00000001 000c60a4 c0150598 00000000 cee03b00 00000026 00020003
<0>[92, recovery] [ 5.228942] 9ec0: 00000026 c015dfac cf4d0aa0 00004b3a 00000000 00020002 00000000 c02ed3dc
<0>[92, recovery] [ 5.228973] 9ee0: cee49fb0 c003f6f0 000c8e84 0000081f cfdf5220 cf5f3d18 c02ecae4 00000001
<0>[92, recovery] [ 5.229003] 9f00: 00004b3a 00000000 cf601798 00000101 00000001 00000000 00004b3a 00000003
<0>[92, recovery] [ 5.229003] 9f20: c0038128 c015fce4 cee48000 001a9000 00100077 00000004 cf2e10ec 00020003
<0>[92, recovery] [ 5.229034] 9f40: 00000000 cee0f1e0 00000000 00020002 cfde2804 cee48000 00000004 00000000
<0>[92, recovery] [ 5.229034] 9f60: 00000004 00020002 00000000 cfd6d000 cee48000 00000000 000c60a4 c01500cc
<0>[92, recovery] [ 5.229064] 9f80: 00000000 000bac21 0019b74c 001a4020 000c8e04 00000005 c0038128 cee48000
<0>[92, recovery] [ 5.229095] 9fa0: 00000000 c0037f80 0019b74c 001a4020 000bac21 00020002 00000000 201d064a
<0>[92, recovery] [ 5.229095] 9fc0: 0019b74c 001a4020 000c8e04 00000005 be8b6d9c be8b6d98 000ca6b8 000c60a4
<0>[92, recovery] [ 5.229125] 9fe0: 0019b74c be8b6c88 0008569d 0000a69c 40000010 000bac21 00000000 00000000
<4>[92, recovery] [ 5.229156] [<c005ad9c>] (msm_rpc_call_reply+0x28/0x16c) from [<c005aefc>] (msm_rpc_call+0x1c/0x24)
<4>[92, recovery] [ 5.229156] [<c005aefc>] (msm_rpc_call+0x1c/0x24) from [<c0401678>] (huawei_rpc_current_consuem_notify+0x74/0x88)
<4>[92, recovery] [ 5.229187] [<c0401678>] (huawei_rpc_current_consuem_notify+0x74/0x88) from [<c02b9728>] (msm_fb_set_backlight+0x70/0x84)
<4>[92, recovery] [ 5.229217] [<c02b9728>] (msm_fb_set_backlight+0x70/0x84) from [<c02b989c>] (msm_fb_blank_sub+0xfc/0x168)
<4>[92, recovery] [ 5.229248] [<c02b989c>] (msm_fb_blank_sub+0xfc/0x168) from [<c02b9cfc>] (msm_fb_open+0x34/0x64)
<4>[92, recovery] [ 5.229248] [<c02b9cfc>] (msm_fb_open+0x34/0x64) from [<c02b098c>] (fb_open+0x17c/0x1b8)
<4>[92, recovery] [ 5.229278] [<c02b098c>] (fb_open+0x17c/0x1b8) from [<c01551a4>] (chrdev_open+0x260/0x284)
<4>[92, recovery] [ 5.229309] [<c01551a4>] (chrdev_open+0x260/0x284) from [<c01503b0>] (__dentry_open+0x208/0x328)
<4>[92, recovery] [ 5.229339] [<c01503b0>] (__dentry_open+0x208/0x328) from [<c0150598>] (nameidata_to_filp+0x44/0x58)
<4>[92, recovery] [ 5.229370] [<c0150598>] (nameidata_to_filp+0x44/0x58) from [<c015dfac>] (do_filp_open+0x43c/0x838)
<4>[92, recovery] [ 5.229370] [<c015dfac>] (do_filp_open+0x43c/0x838) from [<c01500cc>] (do_sys_open+0x58/0x10c)
<4>[92, recovery] [ 5.229400] [<c01500cc>] (do_sys_open+0x58/0x10c) from [<c0037f80>] (ret_fast_syscall+0x0/0x2c)
<0>[92, recovery] [ 5.229431] Code: e1a04002 e59d8030 93e0af83 9a00004d (e5903080)
<4>[92, recovery] [ 5.229431] ---[ end trace da227214a82491b9 ]---
<4>[92, recovery] [ 5.229461] do_exit: exit code=11

thanks for the backup bud i will start working with that.

Dzo could you help a little bit?
Thanks

boss_y said:
Dzo could you help a little bit?
Thanks
Click to expand...
Click to collapse
Well, the new 2.3.5 uses a newer version of amss (version 4040) and so the rpc calls are different and that is why it's crashing. Try extracting the new kernel and putting it into the recovery image using abootimg.

I am pretty sure in my first versions i was using the 2.3.5 kernel and i posted the wrong log here..
Anyway that happens if you don't sleep.
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
Recovery
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance

ret4rt said:
I am pretty sure in my first versions i was using the 2.3.5 kernel and i posted the wrong log here..
Anyway that happens if you don't sleep.
Since i have reverted back to pre 2.3.5 update and i don't have time to redo all the process again can someone please test this recoveries.
Recovery
Test both 3 of theme please and report if they work.
Goto pink screen backup your current recovery.img by renaming to recovery.imgok
Put test1.img to /image rename it to recovery.img pull the battery reboot to recovery.
If it doesn't boot and all you see is the IDEOS logo do
adb shell cat /proc/kmsg > kmsg.txt
adb shell dmesg > dmesg.txt
adb shell cat /tmp/recovery.log > recovery.txt
and paste them all to pastebin.
Does it works do the same again and have a little dance
Click to expand...
Click to collapse
Its not working bro....
1st and 2nd does not go to recovey screen
3rd opens complete Blue screen that is it......

krish_nank said:
Its not working bro....
1st and 2nd does not go to recovey screen
3rd opens complete Blue screen that is it......
Click to expand...
Click to collapse
Yeah i thought so :/
Please if you can either on the 1st or 2nd one while it's on ideos screen do
adb shell cat /proc/kmsg > kmsg.txt wait till it auto reboots and paste it to pastebin so i can check it out.

It does not pass 1st Logo of Huawei.... will i get the log??

krish_nank said:
It does not pass 1st Logo of Huawei.... will i get the log??
Click to expand...
Click to collapse
Yeap adb should work
Sent from my u8800 using XDA App

I just tried to boot on to recovery from rom manager(I choosed the U8800 recovery first).
The flashing failed and the default recovery load.
I get this messages in default recovery mode, which maybe help:
Finding update package...
Opening update package...
Verifying update package..
E: failed to verify whole-file signature
E: signature verification failed
Installation aborted.

ret4rt said:
Yeap adb should work
Sent from my u8800 using XDA App
Click to expand...
Click to collapse
Got the dmesg.txt for 1st recovery.img file only others shows as not found...

krish_nank said:
Got the dmesg.txt for 1st recovery.img file only others shows as not found...
Click to expand...
Click to collapse
Thanks krish_nank. i've removed teh test recoveries from the first post as apparently they don't work.
Will have a look again when i have more time but i guess someone more experienced can do it faster..

1st of all good effort for that thanks.
also plz find a way to correctly root the new 2.3 otherwise I see we will get stuck with it.
I want to go back to a custom rom and just can revert the installation of this crap

Can please someone try this recovery too <removed didn't work>
Goto pink screen make a backup of your recovery.img and replace with the one from the rar.
See if it boots and report.
ONLY for those that has the 2.3.5 overseas version.
EDIT: Another failed attempt..

Nop.
It is not working.Stuck at Huawei logo.
I will post logs later.

Damn it!Ok nvm logs won't help right now anyway. Will wait till the Thursday update then i might get 2.3.5 on my phone to try things myself. Thanks for checking it anyway

I got a half working recovery myself (tried CM9 recovery). It boots, but after a couple of minutes it reboots. Where to get the logs?

Blefish said:
I got a half working recovery myself (tried CM9 recovery). It boots, but after a couple of minutes it reboots. Where to get the logs?
Click to expand...
Click to collapse
where do you find that recovery ?

Darksage07 said:
where do you find that recovery ?
Click to expand...
Click to collapse
Made it myself. I'm currently setting up a hardware config for CM9 and CWM is the first step.

Blefish said:
Made it myself. I'm currently setting up a hardware config for CM9 and CWM is the first step.
Click to expand...
Click to collapse
can you send me the link where you get a tutorial to do that ?

Fusee Gelee / ShofEL2 exploit port for the T124 (Shield Tablet). AKA Dump SBK

I know that this comes a little bit late but this device still a good machine...
This could be used potentially to boot bricked devices. Unfortunately further work would be required since the Shield Tablet uses a private key (not on the device) to sign the bootloader and if I understand correctly from fuses, nvflash cmds. Probably it could be posible boot into Linux implementing something like shofelf2 does and reflash the emmc from it.... at the same time I don't have a bricked device to verify this.
My main aim with this was to learn about SOCs bootchain/baremetal and related protocols and maybe boot clean Debian with a clean uBoot.... I still pending to acknowledge the second but I really don't know how long will it take me... I don't have that much spare time and this took me almost 1 year and a half to earn the knowledge to reach this point...
ShofEL2 for T124
This is a Fusee Gelee / ShofEL2 exploit port for the Nvidia T124 (a.k.a Jetson TK1, Shield K1, etc).
Currently this code allows you to download and execute a payload to the T124, dump the fuses and memory and boot bct without apply the locks.
Mostly of my code is based on the original ShofEL2 code and Katherine Temkin research, so I cannot take that much credit for this.
See the original fail0verflow blog post: https://fail0verflow.com/blog/2018/shofel2/ See additional info at the original Katherine Temkin github: https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md
Obligatory disclaimer
This code is provided without any warranty, use under your own resposability.
Usage
You need an arm-*-eabi toolkit. You can use Crosstool-ng compile it.
Build the loader and payloads:
$ cd ShofEL2-for-T124
$ make
Usage
$ ./shofel2_t124 ( MEM_DUMP | READ_FUSES | BOOT_BCT | PAYLOAD ) [options]
$ MEM_DUMP address length out_file -> Dumps "length" bytes starting from "address" to "out_file".
$ READ_FUSES out_file -> Dumps the T124 fuses to "out_file" and show them in console.
$ BOOT_BCT -> Boots BCT without applying locks.
$ PAYLOAD payload.bin [arm|thumb] -> Boots "payload.bin" the entrymode mode can be specified (thumb by default)
Interesting facts (maybe some of them wrong):
RCM loads the payload to IRAM at 0x4000E000 (described on tegrarcm source code).
RCM cmd format is sligitly different. RCM cmd header length is 0x284 bytes but the firtst 4 bytes still containing the RCM cmd length.
RCM cmd length restrictions are different to X1 bootrom:
Bulk transfers need to be multiply of 0x1000 to ensure use the whole usb buffer.
RCM cmd length minus 0x284 (header length) must be a multiple of 0x10 (which means RCM CMD length needs to end in 4).
RCM cmd min length is 0x404 bytes. Due to the previous condition the minimun length would be 0x1004.
RCM cmd length cannot exceed avaiable IRAM for the payload (from 0x4000E000 till 0x4003FFFF).
With all this in mind max RCM cmd length is 0x32274 bytes.
Since the exploit uses usb buffer 2, only 0x31000 bytes can be used for the payload in order to avoid finishing the RCM cmd.
A payload can still be loaded using the same path as the one used by the original shofEL2, since no validation is carried out till the whole payload is received.
Even if the specs says that the JTAG is enabled by default, cold bootrom code disasbles it while is runnig (not as dumb as expected ).
RCM runs on an ARM7TDMI core, I manage to halt the CPU on uboot using a Segger J-LINK.
When the poisoned get status is executed, 0x30C bytes will be copied before the payload. These bytes are part of the execution stack, starting with the USB status var.
Using the original sanity_check function from shofel2, I got from the execution stack that the RCM USB buffers are located at 0x40004000 and 0x40008000.
Two USB buffers of 0x1000 bytes still present. They still alternating on each USB txn. And odd number of USB txn will let you on the hight buffer for the next txn.
Using the original sanity_check function from shofel2, I got from the execution stack that the memcpy return address is located at 0x4000DCD8 (0x4000DCF4 - 0xC - 2 * 4 - 2 * 4).
The position in the RCM cmd where the entry adress need to be write to smash the memcpy return address is calculated as follow:
n_bytes_to_copy = 0x4000DCD8 - 0x40008000 (memcpy_ret_add_loc - usb_buf2_add) -> n_bytes_to_copy = 0x5CD8 bytes
pos_in_payload = n_bytes_to_copy - 0x30C (copied from the execution stack) - 0x4 -> pos_in_payload = 0x59C8
pos_in_rcm_cmd = pos_in_payload + 0x284 (header length) -> pos_in_rcm_cmd = 0x5C4C
I found the following functions on the the bootrom:
void ep1_in_write_imm(void *buffer, u32 size, u32 *num_xfer) -> 0x001065C0 -> Writes EP1_IN
void ep1_out_read_imm(void *buffer, u32 size, u32 *num_xfer) -> 0x00106612 -> Reads EP1_OUT
void do_bct_boot() -> 0x00100624 -> Boots BCT without applying locks.Hello
Source: https://github.com/LordRafa/ShofEL2-for-T124/releases

Great work! Does this mean you could in theory push payloads made for the switch to the K1, as they are both tegra-based devices?

xdpirate said:
Great work! Does this mean you could in theory push payloads made for the switch to the K1, as they are both tegra-based devices?
Click to expand...
Click to collapse
Well, yes that is partially right but bear in mind that these payloads relies sometimes on the switch peripherals, so for example if you want to show something on the LCD it will not work because the shield and switch LCDs controllers aint the same, the code will run on the boot CPU but the LCD will not work because they don't work in the same way... It is something like use the wrong driver for a device.
Also you need to understand that the payloads normally are used as first stage loader for something else, if that something else is wrote for the switch app CPU it will not work at all. Switch Tegra app CPU is an arm64 CPU and shield app CPU is a 32bit armv7 so they are not compatible. E.g. this is why I cannot run the Switch Linux directly on my shield.... and even if they could work, again you will find the problem of the peripherals and many others customized things for Nintendo... that is why a Shield TV is not a Switch... same same... but different.
This can be more useful to those people that are interesting to do some research around this device.

Is it possible to unbrick a Shield Tablet killed with this ?

Tonio1987french said:
Is it possible to unbrick a Shield Tablet killed with this ?
Click to expand...
Click to collapse
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....

Lord_Rafa said:
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....
Click to expand...
Click to collapse
I do have a killed Shield Tablet LTE. Where are you from?
The OTA that kills the tablet has been dissected here: https://forum.xda-developers.com/shield-tablet/general/kill-kill-switch-shield-tablet-xx-t3179489
Once flashed the tablet doesn't give any signs of life, and goes only in APX mode when connected:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Is it possible to use ShoEL in APX mode? I don't think?
Gave a quick try compiling crosstool-ng on Debian 8 but it's hanging at make, will have a look at it later.
On a side note, one user (Drims75) from Ukraine restores motherboard for a modic cost, you can find a couple of user who sent their motherboard to him: https://forum.xda-developers.com/showpost.php?p=71516196&postcount=139

Thanks for your work!

I can confirm the exploit is working.
Thanks so much LordRafa, you're a legend!

How do i get the SBK Key? Is the FUSE_PRIVATE_KEY i get via READ_FUSES the SBK? And is it possible to dump the BIS keys? The biskeydump payload seems only working for switch. Anyone has a biskeydump payload for t124?

This is absolutely awesome.
I have a bricked shield tablet, here is the output from the fuses:
Waiting T124 to enter RCM mode (ctrl-c to cancel). Note: root permission could be required.
K1 in RCM mode connected.
Chip ID: 0x40 0x02 0x07 0x01 0x00 0x00 0x00 0x10 0x09 0xa1 0x0c 0x74 0x01 0x10 0x00 0x64
Hacky Get Status returned error... Probably the stack got smashed, Congrats
Dumping 768 bytes from 0x7000f900.
FUSE_PRODUCTION_MODE: 00000001
FUSE_JTAG_SECUREID_VALID: 00000001
FUSE_ODM_LOCK: 00000006
FUSE_OPT_OPENGL_EN: 00000001
FUSE_SKU_INFO: 0000001f
FUSE_CPU_SPEEDO_0_CALIB: 000008cd
FUSE_CPU_IDDQ_CALIB: 0000030f
RESERVED_0x01C: 00000000
RESERVED_0x020: 00000000
RESERVED_0x024: 00000000
FUSE_OPT_FT_REV: 00000022
FUSE_CPU_SPEEDO_1_CALIB: 00000000
FUSE_CPU_SPEEDO_2_CALIB: 000007fe
FUSE_SOC_SPEEDO_0_CALIB: 0000089f
FUSE_SOC_SPEEDO_1_CALIB: 00000000
FUSE_SOC_SPEEDO_2_CALIB: 00000000
FUSE_SOC_IDDQ_CALIB: 0000025f
RESERVED_0x044: 00000000
FUSE_FA: 00000000
FUSE_RESERVED_PRODUCTION: 00000002
FUSE_HDMI_LANE0_CALIB: 00000000
FUSE_HDMI_LANE1_CALIB: 00000000
FUSE_HDMI_LANE2_CALIB: 00000000
FUSE_HDMI_LANE3_CALIB: 00000000
FUSE_ENCRYPTION_RATE: 00000000
FUSE_PUBLIC_KEY 0-3: bc420312 298f5d3c a5abe328 9e556001
FUSE_PUBLIC_KEY 4-7: 0eefbfaa 756a7b0f b7507e2f 149672c4
FUSE_TSENSOR1_CALIB: 03a27cbb
FUSE_TSENSOR2_CALIB: 03ee9ee6
RESERVED_0x08C: 00000000
FUSE_OPT_CP_REV: 00000022
FUSE_OPT_PFG: 00000000
FUSE_TSENSOR0_CALIB: 0053a324
FUSE_BOOTROM_PATCH_SIZE: 00000002
FUSE_SECURITY_MODE: 00000001
FUSE_PRIVATE_KEY: 5f244a57 d0197865 940f80a3 15484c8f
FUSE_DEVICE_KEY: 5e65bbde
FUSE_ARM_DEBUG_DIS: 00000000
FUSE_BOOT_DEVICE_INFO: 00000000
FUSE_RESERVED_SW: 00000000
FUSE_VP8_ENABLE: 00000001
FUSE_RESERVED_ODM 0-3: 00000000 00007090 0000000b 00000000
FUSE_RESERVED_ODM 4-7: 00000000 00000000 00000000 00000000
FUSE_OBS_DIS: 00000000
RESERVED_0x0EC: 00000000
FUSE_USB_CALIB: 02c6038b
FUSE_SKU_DIRECT_CONFIG: 00000000
FUSE_KFUSE_PRIVKEY_CTRL: 00000003
FUSE_PACKAGE_INFO: 00000004
FUSE_OPT_VENDOR_CODE: 00000000
FUSE_OPT_FAB_CODE: 00000000
FUSE_OPT_LOT_CODE_0: 00000000
FUSE_OPT_LOT_CODE_1: 00000000
FUSE_OPT_WAFER_ID: 00000000
FUSE_OPT_X_COORDINATE: 00000000
FUSE_OPT_Y_COORDINATE: 00000000
FUSE_OPT_SEC_DEBUG_EN: 00000000
FUSE_OPT_OPS_RESERVED: 00000000
FUSE_SATA_CALIB: 00000000
FUSE_GPU_IDDQ_CALIB: 0000036e
FUSE_TSENSOR3_CALIB: 03e21f59
FUSE_SKU_BOND_OUT_L: 00000000
FUSE_SKU_BOND_OUT_H: 00000000
FUSE_SKU_BOND_OUT_U: 00000000
FUSE_SKU_BOND_OUT_V: 00000000
FUSE_SKU_BOND_OUT_W: 00000000
RESERVED_0x144: 00000000
FUSE_OPT_SUBREVISION: 00000000
FUSE_OPT_SW_RESERVED_0: 00000000
FUSE_OPT_SW_RESERVED_1: 00000000
FUSE_TSENSOR4_CALIB: 03b41d91
FUSE_TSENSOR5_CALIB: 0024c106
FUSE_TSENSOR6_CALIB: 03f15f1c
FUSE_TSENSOR7_CALIB: 00788335
FUSE_OPT_PRIV_SEC_EN: 00000000
FUSE_PKC_DISABLE: 00000000
RESERVED_0x16C: 00000000
RESERVED_0x170: 00000000
RESERVED_0x174: 00000000
RESERVED_0x178: 00000000
FUSE_FUSE2TSEC_DEBUG_DISABLE: 00000001
FUSE_TSENSOR8_CALIB: 00173ab1
FUSE_OPT_CP_BIN: 00000003
FUSE_OPT_GPU_FS: 00000000
FUSE_OPT_FT_BIN: 00000001
RESERVED_0x190: 00000000
FUSE_SKU_BOND_OUT_X: 00000000
FUSE_APB2JTAG_DISABLE: 00000000
RESERVED_0x19C: 00000000
FUSE_PHY_FLOORSWEEP: 00000000
FUSE_PHY_FLOOR_ENABLE: 00000000
FUSE_ARM_CRYPT_DE_FEATURE: 00000000
FUSE_DENVER_MTS_DE_FEATURE: 00000000
FUSE_DIE_VERSION_OVERRIDE: 00000000
FUSE_TRIMMERS: 00000000
FUSE_DENVER_BOOT_SEC: 00000000
FUSE_DENVER_DFD_ACCESS: 00000000
FUSE_WOA_SKU_FLAG: 00000000
FUSE_ECO_RESERVE_1: 00000000
FUSE_GCPLEX_CONFIG_FUSE: 00000002
RESERVED_0x1CC: 00000000
RESERVED_0x1D0: 00000000
RESERVED_0x1D4: 00000000
RESERVED_0x1D8: 00000000
RESERVED_0x1DC: 00000000
RESERVED_0x1E0: 00000000
RESERVED_0x1E4: 00000000
RESERVED_0x1E8: 00000000
RESERVED_0x1EC: 00000000
RESERVED_0x1F0: 00000000
RESERVED_0x1F4: 00000000
RESERVED_0x1F8: 00000000
FUSE_SPARE_REALIGNMENT_REG: 00000000
FUSE_SPARE_BITS 00-03: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 04-07: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 08-11: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 12-15: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 16-19: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 20-23: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 24-27: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 28-31: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 32-35: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 36-39: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 40-43: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 44-47: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 48-51: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 52-55: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 56-59: 00000000 00000000 00000000 00000000
FUSE_SPARE_BITS 60-63: 00000000 00000000 00000000 00000000

Lord_Rafa said:
With some additional development I think that it could be posible. Unfortunately I don't have a killed device to work on this.
Someone that would like to work on this, would need to check where the kill switch is enabled and where is verified.
If I understand correctly this would be the boot chain: bootrom -> nvtboot ( boot cpu code ) -> nvtboot ( app cpu code ) -> second stage bootloader( uboot/fastboot??? ) -> Android.
I would be tempted to think that nvtboot at boot cpu is the responsible to check if the kill switch has been enabled, or maybe the kill switch just modifies the bct header to break the boot chain... If I am right then maybe it would be posible to use shoelf2 to restore a backup to the emmc.
A payload would still need to be developed to being able to read/write the emmc using shoelf2. This is something that I am considering to implement as part of the works porting mainline Linux.
Also it would be nice to see if all devices shares the same private key that would be great because anyone could read a working shield emmc and share it to restore a killed one... if anyone could share the fuse dump, that my shoelf2 generates I could answer this question....
Anyway I would require a killed switch to being able to work on this... My main focus now is run mainline Linux....
Click to expand...
Click to collapse
Did you have any success running/porting mainline linux?

Would this dump the key required to nvflash u-boot?
Edit: I think I understand enough now to know why this is a dumb question. One would use tegrarcm, not nvflash.
Fuses - Nintendo Switch Brew
switchbrew.org
Edit: From NVidia's bct-overview:
When a chip has an RSA public key (PKC) programmed into its flash, it expects the BCT to contain RSA-PSS signatures created/validated using that key pair. When a chip has an AES key (SBK; Secure Boot Key) programmed into its flash, it expects the BCT to contain AES-CMAC hashes created/validated using that key.
Click to expand...
Click to collapse
Has anyone done any testing around what that means for devices with both PKC and SBK? As in does it validate both, either or a does one take precedence over the other?