Related
trmacdonal said:
How to Restore your phone on a Windows PC using a Nandroid backup
I am going to assume you already have a Nandroid backup created on your SD card using JF 1.31's recovery Alt-B feature. The backup will create a folder called nandroid on your SD.
What you need:
The Android SDK:
Fastboot Windows Binary in this post:http://forum.xda-developers.com/showpost.php?p=3083753&postcount=1
From your Nandroid backup you need three files:
data.img
system.img
boot.img
Steps to restore your phone
1) Put the files Adb and AdbWinApi.dll from the tools folder in the Android SDK into C:\WINDOWS\System32 folder on your PC. Substitute the correct drive letter if windows is not installed on you C: drive
2) Put the Windows Fastboot.exe into the C:\WINDOWS\System32 folder on your PC
3) Create a folder on the C: drive of your PC called android. The path should be C:\Android.
4) Copy the Nandroid backup files data.img, system.img, and boot.img from your SD card to the folder called Android you created by mounting your SD card as removable disk.
5) Unplug the USB cord and power off your phone
6) Power up your phone by holding CAMERA+POWER, you should see three androids on skateboards. If you don't see this go install the Engineering boot loader
7) Plug the USB cord back into your phone and press back. The screen on your phone should say fastboot.
8) Make sure your pc is using the correct driver. Open the device manager on your pc. It is helpfull to have all other USB storage devices besides your phone unplugged for this part. Look for a USB Mass Storage device in the list of the USB devices. Right click on it and update the driver. Pick the option to browse for a driver on your pc. The driver is located in the Android SDK your downloaded in the folder called usb_driver. If this is done right you will now see a device called HTC Dream
9) Press start, go to run and type cmd (If you are on Vista just type cmd in the search box and hit enter). The command prompt will pop up.
10) Type cd C:\android
then enter the following commands:
fastboot flash system system.img
it will say Sending, then writing and say OKAY if it was successful
then type
fastboot flash userdata data.img
wait for the second OKAY and type
fastboot flash boot boot.img
wait for the second OKAY and type
fastboot reboot
Your phone should now be restored exactly as you had it when it was backed up.
Click to expand...
Click to collapse
I'm young yet in my android/linux learnings and this guide here is great. I've been soaking in information for weeks now on the boards but still, my kungfu is weak.
Hence I'm having an issue today and I've been working on it almost all day so far. Something happened and I ended up having to factory restore my phone and I'm attempting to recover from my nandroid backup files.
I've followed the above instructions to the letter, but now that I'm ready to do the actual fastboot flash system system.img command, I keep getting a "FAILED <command write failed <Too many links>> error". And I've searched high & low looking for a solution to this.
My HTC is correctly running in Fastboot as an ADB Interface in WinXP Pro SP3, I've got my nandroid backup files placed in the C:\Android folder on my pc as directed. Fastboot is in the /system32 folder (and in cmd Fastboot devices lists my phone), but I keep banging my head into this error over & over. Its driving me pretty insane and any help would be appreciated. I know you guys aren't a support desk and I'm probably screwing up something elementary, but I just wanted to say that I'm finally asking as a last resort. I've been trying to figure this out myself for about 9 hours now. My thanks in advance.
Xeroproject said:
I've followed the above instructions to the letter, but now that I'm ready to do the actual fastboot flash system system.img command, I keep getting a "FAILED <command write failed <Too many links>> error". And I've searched high & low looking for a solution to this.
Click to expand...
Click to collapse
If it transfers the image to the phone but aborts halfway or at the end, try adding a ferrite core to your usb cable at the host side, or use one with an integrated ferrite core.
Unfortunately we don't have the source to the SPL so I'm mostly clueless what the "too many links" error means. Alternatively, try on a different pc.
infernix said:
If it transfers the image to the phone but aborts halfway or at the end, try adding a ferrite core to your usb cable at the host side, or use one with an integrated ferrite core.
Unfortunately we don't have the source to the SPL so I'm mostly clueless what the "too many links" error means. Alternatively, try on a different pc.
Click to expand...
Click to collapse
Thanks for the suggestion, I'll have to see if I can find a suitable USB cable, although from some inquires to linux buddies more in the know, I was told it was indicating a "a circular reference symlink" either in fastboot or in the command I used.
Considering I used exactly the commands in the guide, I'm puzzled. Also, I pulled the fastboot.exe for win32 from JF's own attachment.
Regarding another PC, yes, that would be ideal for troubleshooting this, however the pc I have at home is Vista 64bit (unfortunately), so shouldn't I run into issues there?
Xeroproject said:
Hrm, sorry about the few posts in here mods, it seems my issue isn't related to a mistype in the command line of trmacdonal's guide like I thought it was, so its most likely not related to this thread & needs to be split into a separate thread to prevent clutter.
I have noticed something regarding my situation: in command line when I type "fastboot devices" it recognizes & lists my phone. However when I type "adb devices" it does not list my phone. Might this be related?
Click to expand...
Click to collapse
ADB won't see your device till it has booted into android.
And send me a PM with the post numbers and a new thread title and I will move your posts and any posts related to them.
So unfortunately getting any work done on this on my Vista machine has been a total no-go. Vista won't take the 64-bit homebrewed driver, regardless of disabling driver authentication.
So I'm stuck. Day 2 here and I still get the "too many links" error. I've since retraced all my steps, redownloaded the SDK, JF's fastboot-win32, and completely removed all drivers from the system (including registry entiries) then reinstalled everything, and tried a shielded USB cable today. Still pulling up that error.
Is there any information I can include that would help pinpoint whats causing this issue?
Xeroproject said:
So unfortunately getting any work done on this on my Vista machine has been a total no-go. Vista won't take the 64-bit homebrewed driver, regardless of disabling driver authentication.
So I'm stuck. Day 2 here and I still get the "too many links" error. I've since retraced all my steps, redownloaded the SDK, JF's fastboot-win32, and completely removed all drivers from the system (including registry entiries) then reinstalled everything, and tried a shielded USB cable today. Still pulling up that error.
Is there any information I can include that would help pinpoint whats causing this issue?
Click to expand...
Click to collapse
Have you tried booting normally at least once?
Maybe try "fastboot erase cache", then try again?
JesusFreke said:
Have you tried booting normally at least once?
Maybe try "fastboot erase cache", then try again?
Click to expand...
Click to collapse
If you mean booting normally into Vista 64, yes, it sees the G1 as an "unknown device" in Device Manager and when I point it to the 64-bit driver, it won't take it. Same for when driver auth is disabled. (although the message changes from "no device drivers found" to "this driver is not compatible with your device)
If you mean the phone, yes, the phone works, its not bricked, but there's a lot of data I'm losing if I can't solve this issue & backup from my nandroid backups.
I'll give the erase cache thing a shot now and post results, thanks for the suggestion.
interesting, the "fastboot erase cache" command also returns a "FAILED <status read failed <Too many links>>" error
Perhaps the problem is with the fastboot.exe file?
Xeroproject said:
interesting, the "fastboot erase cache" command also returns a "FAILED <status read failed <Too many links>>" error
Perhaps the problem is with the fastboot.exe file?
Click to expand...
Click to collapse
I doubt it. I remember seeing this error once when I stopped a fastboot flash while it was doing it's thing. I don't remember exactly what I did to fix it. I thought I just rebooted or something.
It's a shot in the dark, but maybe take the battery out for a few seconds and put it back in and try again?
I would also try any and all of the fastboot commands
If nothing else, you could try reflashing the engineering SPL, or even the RC29 nbh.
JesusFreke said:
I doubt it. I remember seeing this error once when I stopped a fastboot flash while it was doing it's thing. I don't remember exactly what I did to fix it. I thought I just rebooted or something.
It's a shot in the dark, but maybe take the battery out for a few seconds and put it back in and try again?
I would also try any and all of the fastboot commands
If nothing else, you could try reflashing the engineering SPL, or even the RC29 nbh.
Click to expand...
Click to collapse
Yeah, I wish I knew the cause of it, but the initial use was uninterrupted (and everytime I reboot, I will get 5-10sec lag before getting the error, while after that the error will popup immediately)
I'm happy to try any of the fastboot commands, but being a little nubbin, I'm a little afraid of doing any damage. I did try fastboot reboot and fastboot reboot-bootloader and got no response from the phone. "fastboot devices" immediately sees my phone. "fastboot flashall" returns: "error: neither -p product specified nor ANDROID_PRODUCT_OUT set".
Removing the battery is something I've done a couple times the other day, just gave it another shot now, same result. I've noticed the too many links error will say it "failed to read" on the first attempt, after that it reverts to "failed to write".
Concerning reloading the phone back to RC29....you mean taking it back to RC29, then reflashing the Engineering SPL, then immediately trying to backup from my nandroid backups? (prior to installing any of the JF OS versions?)
I have also faced this error few time, what I do is disconnect the USB, restart both PC and G1, next time I get proper connection, once time I was able to resolve just by moving the ramdisk.img and kernel file from the directory, this was when I was using the fastboot -w flashall command!!
-Pramod
Might be onto something there JF, I just checked my SPL edition and I'm running the HardSPL not the EngineSPL.
Is the HardSPL not suited for this perhaps?
for fastboot -w flashall to work you need to set the ANDROID_PRODUCT_OUT variable, where boot.img, recovery.img and system.img file are, on window just use the set command
set ANDROID_PRODUCT_OUT=c:\<your directory where the files are>
and then run fastboot -w flashall
-Pramod
pramods said:
for fastboot -w flashall to work you need to set the ANDROID_PRODUCT_OUT variable, where boot.img, recovery.img and system.img file are, on window just use the set command
set ANDROID_PRODUCT_OUT=c:\<your directory where the files are>
and then run fastboot -w flashall
-Pramod
Click to expand...
Click to collapse
Alright, I'm with you, just returned "error: could not load android-info.txt"
The same directory also need to have android-info.txt file, this file just have a single entry as board=trout in it, if you don't have it create this file and then run fastboot again
-Pramod
pramods said:
The same directory also need to have android-info.txt file, this file just have a single entry as board=trout in it, if you don't have it create this file and then run fastboot again
-Pramod
Click to expand...
Click to collapse
Alright, so I did a search on my computer to see if I had an android-info.txt I could copy over, didn't have anything (including in the android-sdk files). So I went ahead and created one and just put "board=trout" in it like you said. New error: "getvar:version-bootloader FAILED <command write failed <Too many links>>"
Progress?
btw Pramod, you're a stud, thank you for all these suggestions
Xeroproject said:
I've noticed the too many links error will say it "failed to read" on the first attempt, after that it reverts to "failed to write"./QUOTE]
Do you mean on the first attempt after a reboot?
This makes me suspect usb issues. Do you happen to have any usb cords with a ferrite bead on them laying around that you could try?
Reboot, and then try flashing one of the splash images. They are relatively small, so if it is an issue with usb communication, there is less of a chance of it failing. Try it a couple of times.. if you can get it to work once, then I would say it's more than likely some sort of usb communication issue, bad cable, interference, etc.
Click to expand...
Click to collapse
JesusFreke said:
Xeroproject said:
I've noticed the too many links error will say it "failed to read" on the first attempt, after that it reverts to "failed to write"./QUOTE]
Do you mean on the first attempt after a reboot?
This makes me suspect usb issues. Do you happen to have any usb cords with a ferrite bead on them laying around that you could try?
Reboot, and then try flashing one of the splash images. They are relatively small, so if it is an issue with usb communication, there is less of a chance of it failing. Try it a couple of times.. if you can get it to work once, then I would say it's more than likely some sort of usb communication issue, bad cable, interference, etc.
Click to expand...
Click to collapse
Yeah, the first attempt after a reboot.
Yeah I actually picked a ferrite bead USB cable up the other day and then I also shut off my speakers (just in case a magnet or something was causing interference). Just checking around my desk at work, I don't really have anything else that would interfere to my knowledge. We deal with high speed check scanners at work and I haven't had any issues with the images they pull (also via USB, same computer).
I'll give the image deal a whirl, I believe I have all that software for converting them already on my computer.
Click to expand...
Click to collapse
Just try one more thing, creat a new directory and put all *.img files and *.txt file there and reboot your system(PC and G1[fastboot mode]) then set the ANDROID_PRODUCT_OUT variable and then fire the command fastboot devices , if the fastboot return the device identity then try fastboot -w flashall command
-Pramod
pramods said:
Just try one more thing, creat a new directory and put all *.img files and *.txt file there and reboot your system(PC and G1[fastboot mode]) then set the ANDROID_PRODUCT_OUT variable and then fire the command fastboot devices , if the fastboot return the device identity then try fastboot -w flashall command
-Pramod
Click to expand...
Click to collapse
All *img & *txt files off the SD card you mean?
This is a long thread because I'm trying to provide the maximum detail possible in the hopes of luring some experts to assist. I am a developer with 30+ years experience, though with little *nix experience, since I hitched my wagon to WinTel when people stopped hiring assembly programmers and the term "GUI" began appearing in help wanted ads.
Yesterday, based upon my experience with one phone that I successfully upgraded to CM6-RC1 and another one that failed, I posted a new thread in the G1 General section, which was probably the wrong place for it. Both phones are US TMo G1's purchased within a few days of each other, around December 2009.
During the subsequent 12 hours I read everything I could find about the dreaded "E: Can't find MISC: / (No space left on device)" problem, which I eventually determined was preventing me from proceeding further.
I found many, many examples of people on all types of hardware who were (and many still are) stuck with a hosed-up misc with no idea how to proceed. This was somewhat alarming to me.
I found a few people who were apparently able to fix it by simply doing a flash_image of a misc.img copied from elsewhere. I found a few who seemed to have fixed it with dd. I found others who went through various combinations of installing other things until the problem mysteriously vanished. I found great info about what the misc partition is and how it's used.
What I did not find is:
(a) any clear explanation of how it gets hosed in the first place,
(b) any clear explanation of how to troubleshoot it,
and most importantly (c) any clear explanation of ways to fix it.
This thread is a request for an expert to step in and fill those gaps. Maybe if we can get some "misc lore" in a single place, other people who encounter the problem won't be left hanging.
So first the back story:
Two days ago I decided to install CM6-RC1 on my own G1. It went very smoothly. I was already on Cupcake, so I formatted the card, downgraded back to RC29, I installed Cupcake, formatted again from the phone, used flashrec to install RA 1.7 (which is amazing, by the way; I may be a n00b to phone-guts but that is already apparent), verified the radio version, installed DangerSPL, installed CM6-RC1, and installed the Google Apps. Flawless process.
Loved it. CM6 is great. So the next morning I had my wife leave her phone at home with me. I had seen a thread which led me to believe that the card didn't necessarily have to be formatted twice. I was under the impression I could format it once and drop all the files out there -- only Cupcake needed to be named update.zip for the process outlined above.
So I connected her phone to my laptop, reformatted to FAT32 over USB from Win7, copied all 211 MB of files over, disconnected and went into flashboot. The RC29 downgrade worked fine. I restarted and logged in just to be sure RC29 was on there. I powered off and restarted in recovery mode -- and the misc problem was already there.
In the stock /!\ recovery screen, ALT+L showed the misc error. I couldn't remember if I had seen that previously (having only done this once before), so I hit ALT+S and hoped for the best. The progress bar went about halfway then bombed on an assert in line 4. And that's as far as I got updating my wife's phone: in theory my story could stop here, but being a lifelong geek-type, I decided to forge ahead. I didn't yet know the importance of misc or even recognize it as my main problem, so bear with me.
I rebooted and rooted via telnet and used flashrec to install RA, and tried installing Cupcake that way. I get a different error from RA: No signature, verification failed. I thought I might have a bad file, somehow, despite having used the same update.zip that went into my G1 just fine, so I downloaded it again from megaupload. Then I downloaded the other one named signed-kila-ota. Then I did a file compare and confirmed they're identical. That won't load through RA. Not sure what's up with that.
But after thinking about it and doing more reading, I concluded I probably didn't need Cupcake for CM6-RC1, I just needed the correct radio image to support DangerSPL. So I grabbed the G1 2.22.23 radio image and tried installing that through RA. It extracts and installs ok, then dumps the Can't read Misc error, then tells me to reboot to complete. So I reboot -- and it goes back into the running OS, of course. And then the light goes on, since I did clearly remember on my own G1 it went back into RA, not into Android.
More digging uncovers the radio/SPL thread that explains how misc is used to control reboots, and I finally clearly realize that misc is my problem. (Actually I still don't know why Cupcake won't load from RA, but I still suspect if I can just load the right radio image, it shouldn't matter.)
During the following six hours I have tried a huge variety of things to fix misc, primarily working through an adb connection.
First I tried making a nandroid backup from my working G1. Took me awhile to figure out I had to do it from the command line to force it to backup misc, then I wasted time trying to get the command line to restore that backup, then I finally made another backup on the non-working G1 and copied the "good" misc over -- and still couldn't get it to restore (kept telling me something about being the current version, which I interpreted to mean it wasn't restoring because it thought the backup already matched the live filesystem).
Again, not knowing much about *nix, at this point I was convinced misc was simply dead and gone. I know what a disk partition is, but I didn't see misc (or the others like recovery) in parted, so I don't think I even understand what it means to say misc is a partition. But I didn't see it anywhere, so I thought it had been erased or overwritten or something along those lines.
Then I ran across a thread in which someone suggested doing a "cat /proc/mtd" which yielded the following:
Code:
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 04380000 00020000 "system"
mtd4: 04380000 00020000 "cache"
mtd5: 04ac0000 00020000 "userdata"
I don't know what it means, but at least I see the system still knows something about misc.
Someone else asked for "dump_image misc /dev/zero" for diagnostic purposes, which yields:
Code:
mtd: ECC errors (0 soft, 1 hard) at 0x00000000
mtd: ECC errors (0 soft, 1 hard) at 0x00020000
Someone suggested "cat /dev/zero > /dev/mtd/mtd0" which results in the error message "cat: write error: No space left on device".
I tried copying misc.img out of the backup folder to the sdcard root and doing "flash_image misc /sdcard/misc.img" and was rewarded with the following lines which I can't interpret, although they're clearly related to the output shown above (I assume flash_image is probably a script or something, which is just doing those same steps internally?):
Code:
mtd: ECC errors (0 soft, 1 hard) at 0x00000000
mtd: ECC errors (0 soft, 1 hard) at 0x00020000
mtd: erase failure at 0x00000000 (I/O error)
mtd: erase failure at 0x00000000 (I/O error)
mtd: skipping write block at 0x00000000
error writing misc: No space left on device
I ran across another thread which suggested the command "dd if=/sdcard/misc.img of=/dev/block/mtd0"... that produced this initially encouraging-looking output, though I don't know what it means and it didn't fix misc:
Code:
512+0 records in
512+0 records out
I also saw a few steps and suggestions relating to fastboot. I didn't try any of these since the only instructions I could find for setting up fastboot (in that stickied noob thread) requires a version 2 radio image, which I can't install because misc is fried.
So, in short, searching xda and the Internet in general hasn't helped much, except perhaps to better prepare me to follow somebody else's instructions . In reality I have gone through several different sets of instructions multiple times and tried a variety of other things, but it always comes back to not being able to complete a radio image installation because of that problem with misc.
I'm willing to try just about anything... and I know there are quite a few others out there with a misc problem who can't seem to make any progress or get any input, so hopefully my exhaustive description of how I got here and what I've tried already will be useful to one of the local experts.
I know that ECC refers to the error correction checksum used to detect memory errors... but I find it awfully suspicious that the two supposed ECC errors fall on the very first and last slots on the misc range -- particularly since everybody else with this problem who posts the results of attempts to troubleshoot it or fix it reports exactly the same thing.
In other words, I assume the error message is wrong. This is pretty much the only reason I don't just conclude that the memory is actually hosed and go shopping for a new phone.
Oh, and... bump.
You are certainly telling the truth about it being quite long. That fact does, unfortunately, make it somewhat difficult to read.
I assume that you've seen a few of ezterry's and/or my own posts about the partitions, which is probably where you saw the info on the misc partition.
In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field. That, along with the misc partition, instructs the SPL to perform a radio or spl update.
Now there is a possibility that it may be possible to salvage the device without a working misc partition. Specifically, the requirement is that you get yourself a high-engineering SPL (one with the ability to fastboot a radio image -- note: it is FAST boot, not flashboot).
One important thing to note that might make things easier is that an error "finding" the misc partition *might not imply a failed misc partition*. It could possibly be a failed CACHE partition. Have you tried FORMATTING your cache partition?
In any case, you are no doubt really wondering about my statement that you might be able to update the SPL without the use of a misc partition.... Read THIS thread and you will see how the partition tables are defined and how they can be overridden. This suggests a way that you can actually DEFINE the SPL partition to the linux kernel, which in turn, should allow you to flash_image an SPL update. What you need to do is determine the starting offset and length of the SPL partition, and define it along with the rest of the partitions on the kernel command line. Once this is done, you should be able to fastboot flash a radio update to the device.
Note: Having just done an RC29 NBH file, there is PRECISELY ONE high-engineering SPL that you can install to the device safely.... 1.33.2003 (ending with a THREE -- very important, a 5 is a brick when combined with an rc29's radio).
Also note: I don't take any responsibility if you fry it completely trying this idiotic procedure without a jtag standing by. It is quite risky. I suggest it because it may be your best chance of getting through this.
Note: fastboot does NOT require a 2.x radio image. Fastboot requires an engineering SPL, which for the same reason, you can't install.
Now as for the location of the read/write errors.... you think that it is suspicious that they occur at the first and last slot of the memory range...
Well this is not unexpected since there are only two slots. Each of 128 kB. The first at 0 offset wrt the start, the second at 20000 offset wrt the start. The ECC error itself says that each of the two blocks has failed whatever operation it was trying to perform.
I suggest that your first step might be to try again writing the RC29 NBH file.
Thank you for the explanations and all the details.
I have actually reloaded RC29 quite a few times. I followed the directions from scratch a couple times in case I had gotten something wrong (of course, this was easy to do since I get stuck pretty early in the process).
I'll try formatting CACHE and I'll take a look at using the SPL you reference and report back later.
I really appreciate the assistance.
Ah, just realized that when you do "Wipe cache" from RA recovery, formatting cache is the second step. Since that is immediately followed by another "Can't read MISC" error message, I guess formatting doesn't fix my misc issue.
In this paragraph:
In any case, you are no doubt really wondering about my statement that you might be able to update the SPL without the use of a misc partition.... Read THIS thread and you will see how the partition tables are defined and how they can be overridden.
Click to expand...
Click to collapse
Your "THIS" didn't link to anything. I'll go search for what you're referring to, since this would appear to be my only remaining solution. No JTAG handy, but if someone of your experience thinks this is probably my last-ditch option, I don't have much to lose anyway, right? I'll take it slowly.
Edit: I think this is it? forum.xda-developers.com/showthread.php?t=704560 Pretty clever... crazy and dangerous, sure, but what the hell, it's just a phone, lol...
Again, thanks for taking the time to help out.
MV10 said:
Ah, just realized that when you do "Wipe cache" from RA recovery, formatting cache is the second step. Since that is immediately followed by another "Can't read MISC" error message, I guess formatting doesn't fix my misc issue.
In this paragraph:
Your "THIS" didn't link to anything. I'll go search for what you're referring to, since this would appear to be my only remaining solution. No JTAG handy, but if someone of your experience thinks this is probably my last-ditch option, I don't have much to lose anyway, right? I'll take it slowly.
Edit: I think this is it? forum.xda-developers.com/showthread.php?t=704560 Pretty clever... crazy and dangerous, sure, but what the hell, it's just a phone, lol...
Again, thanks for taking the time to help out.
Click to expand...
Click to collapse
Before re-writing partitions find a recovery with 'erase_image' (I hear tell clockwork has it) install and try:
erase_image misc
then
flash_image misc <misc.img>
where misc.img is an old nandroid backup from a phone of the same region as your own (least its preferable its the same region your CID is in the structure)
It may correct the issue... if not we can try to flash an engineering SPL via flash_image..
I feel this is very safe in theory (as we don't have to worry about boot mode 3.. thus if a valid SPL is flashed you won't completely brick).. However we have no safeguards at this point in time so be careful that you really understand what is going on.. else you will write garbage to the SPL, and there is no helping that w/o JTAG.
(btw.. the SPL .. even the full engineering ones like 1.33.2003 and 1.33.2005 wont actually let you erase misc.. but will let you flash it)
Thank you, I'll try it later today.
Not that it's relevant to getting me fixed, probably, but no idea how/why this problem crops up? Or is it more a case of an error that can have multiple causes? I found it interesting that so many people were reporting it across the various Android forums, and there seemed to be no attempt to explain it. That kind of thing always makes me curious, particularly in an environment like this -- a room full of curious "dig in and figure it out" personalities...
If it ever happened to me, I would certainly try to figure it out, however this is really difficult since it has never happened to me. I don't think that it is anywhere near as common as you think.
What I believe about the situation at the moment is that it is *probably* a failure somewhere else along the line that simply has this SIDE EFFECT.
ezterry: Do you remember which memory address ranges are written by an nbh file? I recall that the nbh file has divisions for the different partitions, so I suspect that it may not write *everything*. Maybe misc and/or cache are not written?
Note: I have seen plenty of instances of the cache partition getting borked and having weird side-effect. The problem with the cache partition and why IT gets into weird states is that it is a dual-purpose partition -- sometimes a yaffs2 filesystem, sometimes a simple data structure, so if it gets into the data structure mode and something tries to use it as a filesystem, you end up with some interesting side-effects.
lbcoder said:
ezterry: Do you remember which memory address ranges are written by an nbh file? I recall that the nbh file has divisions for the different partitions, so I suspect that it may not write *everything*. Maybe misc and/or cache are not written?
Click to expand...
Click to collapse
The nbh is just a custom archive the header has 3 arrays of 32bit indicating the following for each partition included
> Partition type (this determines the partition via some mapping to flash radio,hboot,misc,cache,recovery,boot,system,splash1,diag)
> Partition offset from start of the nbh file (signature removed if included)
> size of image
The diagnostic nbh only has the fake 'diag' image.. however most others in the wild seem to have radio, hboot, splash1, recovery, system, cache, userdata...
I don't think I've seen one with misc.
Certainly none of my current collection have it. I Wonder if they allow it?
Clockwork's "erase_image misc" returns an error:
mtd: erase failure at 0x00000000
I also tried wiping and formatting the cache again, on the off chance that maybe clockwork did something differently. Nothing new to report there.
As for this kernel partition approach, do I correctly understand that I would be telling the kernel to create a new partition name mapped to a range which precedes misc where the SPL is located? I assume I can derive the size from an img of the stock SPL of the same version. Any tips on how I can figure out where it starts? (Apologies if it's in that thread Ibcoder referenced, I haven't finished reading it yet.)
Or am I thinking about this completely wrong?
Search for my post with the kernel command line with hboot replacing userdata.. it deliberately is not step by step but has the info needed.
On a somewhat peripherally-related note, I see in this post in the De-bricking thread:
forum.xda-developers.com/showpost.php?p=7072492&postcount=195
Ibcoder writes: 3) This person goes to boot to the recovery by issuing a "reboot recovery", which sets the command field of the MISC partition to boot-recovery and reboots.
Earlier I had thought about asking whether "reboot recovery" writes to MISC, since I issued that command from the RA console yesterday and to my surprise it worked. I figured I must have misunderstood something and maybe reboot recovery used some mechanism other than writing to MISC, but now I've run across the comment above.
Wouldn't that boot mode flag be the same thing recovery should use to finish installing a radio image?
ezterry, is this the post you're referring to?
forum.xda-developers.com/showpost.php?p=7064255&postcount=187
MV10 said:
On a somewhat peripherally-related note, I see in this post in the De-bricking thread:
forum.xda-developers.com/showpost.php?p=7072492&postcount=195
Ibcoder writes: 3) This person goes to boot to the recovery by issuing a "reboot recovery", which sets the command field of the MISC partition to boot-recovery and reboots.
Earlier I had thought about asking whether "reboot recovery" writes to MISC, since I issued that command from the RA console yesterday and to my surprise it worked. I figured I must have misunderstood something and maybe reboot recovery used some mechanism other than writing to MISC, but now I've run across the comment above.
Wouldn't that boot mode flag be the same thing recovery should use to finish installing a radio image?
ezterry, is this the post you're referring to?
forum.xda-developers.com/showpost.php?p=7064255&postcount=187
Click to expand...
Click to collapse
Suggesting, of course, that the misc partition itself is actually quite fine, but whatever subsystems responsible for screwing up when it screws up for you are in some other way broken.... which is not inconsistent with the theories I have presented above. Specifically, I am still quite concerned about your cache partition being somehow defective since it is known for having weird side-effects.
What you may possibly be able to do is hack the reboot command into "reboot flash-hboot"... be ***absolutely certain*** that you get your cache partition set up correctly and fully verified before you do this though, otherwise you WILL need jtag to fix it.
Later I wondered whether reboot had options to specify the flashing modes. I take it from your response that it does not. Given my meager relevant knowledge, significant hand-holding would probably be required to pull that one off!
Another oddity I have noticed: my own G1 shows a device ID of HT91CGZ02056 (through something like "adb devices" for example)... but my wife's G1 (with the MISC issue, or whatever it is) just returns a string of zeros: 000000000000. First noticed that in the nandroid backup directory name.
Not sure if that tells anyone anything useful or interesting, but it sure seems weird.
MV10 said:
Another oddity I have noticed: my own G1 shows a device ID of HT91CGZ02056 (through something like "adb devices" for example)... but my wife's G1 (with the MISC issue, or whatever it is) just returns a string of zeros: 000000000000. First noticed that in the nandroid backup directory name.
Not sure if that tells anyone anything useful or interesting, but it sure seems weird.
Click to expand...
Click to collapse
It could mean that there is a serious defect.... or it could be the same glitch that is causing you problems with misc. Remember that the device ID is stored within the same chip as the misc partition, just at a non-writeable address.
Ha, interesting, I didn't know there was any sort of relationship there. Very interesting.
Well, at this point my wife is freaking out without a phone so I'm just buying her a Galaxy S (yeah I know, Samsung... but frickin' T-Mo doesn't have anything else particularly compelling).
I'm sort of interested in what's wrong with her G1 and I have an unhealthy urge to keep fiddling with it, but honestly I can't justify spending much more time on it right now, too many other things going on in my non-phone-based life.
That means I have a thoroughly unexciting RC29 G1. I assume OTA updates aren't likely to work either (assuming they're still sent out). If either you or ezterry would have any interest in this device (maybe some questions about what went wrong since you haven't seen a MISC failure?), shoot me a PM, I'll see about shipping it off to one of you.
Regardless, I can't express how much I appreciate both of your attempts to help a complete stranger, and I look forward to reading about all the other weird and interesting stuff you guys dig up in the future...
UPDATED STEP #8 WITH PARTITION # WARNING!!!
I decided to take rothnics excellent sticky thread;
http://forum.xda-developers.com/showthread.php?t=859383
and break it down a little more in depth as I found myself a little lost with the NVFlash wiki... so I combined and extracted the info... again... read his thread as it has all the warnings etc etc, but here is mine: CONTINUE AT YOUR OWN RISK!!!!
If you want a different logo that the one on the thread, you can use the one I chose which is an impressive TegraII logo found at this link below:
http://i253.photobucket.com/albums/hh71/JSZESZE/tegra.jpg
(thank you XDA member Rayden25):
The Android 2.2 system images and support files were found here:
http://developer.nvidia.com/tegra/devkit-250tango
Here are the steps I followed successfully based on the rothnic thread... again... this is advanced, for windows users, and the video at GTabUnleashed will cover just the last few steps!!!
1. Download the Android 2.2 MSI file and install.
2. Download the bootloader.bin file from the rothnic thread (its at the end of the thread - I would link it but this way forces you to read the whole thread... or pretend that you did)
3. copy the bootload.bin you just downloaded into the folder you just installed at:
"C:\Program Files (x86)\NVIDIA Corporation\tegra_froyo_20110207"
which will overwrite the one from the SDK.
NOTE: remove "(x86)" if you are not running a 64 bit system
4. Place whatever .bmp boot logo you plan to use in that same folder (it must be a .bmp file and same dimensions as the one I linked - but if you read up on this you would already know this) the name doesn't matter, but I named mine bootlogo.bmp for simplicity.
5. Connect your PC and GTab via USB, reboot holding volume (-) which will boot into APX mode.
6. (Remember: THIS IS FOR WINDOWS) the driver will most likely not recognize the GTab and you will need to update the APX driver by going to the device manager and pointing the driver update to the tegra_froyo_20110207 folder - then your PC and GTab will talk - look for APX under devices and drivers for proof.
7. Open command prompt and change directory to the one with the all our files by typing:
cd c:\Program Files (x86)\NVIDIA Corporation\tegra_froyo_20110207
NOTE: remove "(x86)" if you are not running a 64 bit system
8. Finally you will replace the stock bird logo with this command:
nvflash --bl bootloader.bin --download 6 bootlogo.bmp
WARNING: THE NUMBER "6" REPRESENTS THE PARTITION BEING FLASHED WHERE THE LOGO IS ASSUMED TO RESIDE... THIS IS NOT THE SAME FOR ALL GTABS... READ UP ON THIS ISSUE BELOW AND ON OTHER THREADS!
Watch the video for a visual on the last few steps:
http://www.gtabunleashed.com/2011/03/replacing-viewsonic-boot-logo-step-by.html
Peer through this screenshot for all the relevant information:
https://picasaweb.google.com/sean.g.kessel/GTabBootlogo#slideshow/5590101553192845506
Buried on page 5 or 6 of the original thread is a part about finding which partition your boot logo is on. It's not always #6. After your step 7 (ie, the software is all setup), run this first:
nvflash --bl bootloader.bin --getpartitiontable gtab_part_table
That will create a text file in the \progs...\nvidia...\tegra... directory called gtab_part_table. Open that up and see which partition is labeled BLO. From the previous thread, it'll be either 6 or 7. Yours was probably 6, mine was 7.
After that, I couldn't immediately run nvflash again, I had to reboot the tablet, but I was able to boot immediately back into APX mode (ie, run the first nvflash, shut down gtab, boot into APX again with power and volume-). Then I could run nvflash again and run the download command.
If your BLO is 7 (or something else), just change the command to:
nvflash --bl bootloader.bin --download 7 bootlogo.bmp
I dropped in the Tegra2 one you linked, I like it, thanks!
Funny story. Before I saw this post, I decided to try this and I pulled partition 6 out (use nvflash --bl bootloader.bin --read 6 part6.bin ). I realized it was NOT the image and that's when I did a search and found this thread. I read back partition 7 and sure enough there were the viewsonic birds.
So after patting myself on the back for realizing that I should not blindly flash partition 6, I got everything ready, typed in the line... hit enter... and of course had put 6 on the command line, writing a beautiful logo on top of partition 6 (the MSC partition).
As far as I can tell this must be the system cache as it seems to have no effect. I am doing a fast backup and then I'll clear the cache read it back out and see if it looks like it changed. Doh!
I wanted to point out one thing though. You don't need to reboot after you do a read, just use -r instead of --bl after the first time. So:
nvflash --bl bootloader.bin --read 6 part6.img
nvflash -r --read 7 part7.img
nvflash -r --download 7 mylogo.bmp
You only need to do the --bl after you reboot.
Man did I freak when I realized I had put 6 in instead of 7. I got lucky. Be careful doing this!!!
UPDATE: MSC is _not_ the cache partition. I cleared the cache and pulled #6 and it was still the bitmap (mostly, anyway -- some of it had been changed). So I took the #7 partition from the stock restore (which is MSC) and flashed it to 6. Didn't matter any but made me feel better.
A few other tips: First of all, the bitmap can't be any .BMP format. GIMP saves RGBA bitmaps it can't read. The 24 bit RGB seemed to be ok. Also, I decided I didn't want to make a mistake again so I wrote a shell script:
#!/bin/bash
# ################### YOU MUST SET YOUR BLO PARTITION HERE! ######
BLO=7
NVFLASHDIR=~/Downloads/nvflash
if [ -z "$1" -o ! -f "$1" ]
then
echo Usage: flashlogo logo
echo BLO set to partition $BLO
exit 1
fi
$NVFLASHDIR/nvflash --bl $NVFLASHDIR/bootloader.bin --download 7 $1
exit 0
Followed you instructions NVflashed to partition 7 and i got rid of the viewsonig logo but all i get is a blank screen when it boots.
Not the bmp image i wanted. I get a message from the nvflash that the file was sent successfully. I unplug and reboot and
the Gtab works perfectly, it boots with a blank screen, then shows the gtablet logo and loads TNT Lite 4.25
Any ideas why.
Could it be the wrong bootloader?
Found the problem. Image.bmp has to be 24 bit, changed to 24 bit worked beautifully.
Now I want to change the gtablet logo that comes up right after the boot logo.
Any suggestions???
Bet you that you have the BMP saved with alpha or maybe 32 bit. You need 24 bit RGB (maybe others, I haven't tested). Worse case get one of the images people have posted and or the stock partition #6. You did verify that you really have the BLO partition on 7 right? Sounds like it thought because an incompatible bitmap is what causes black logo on boot.
Thanks man , this is sweet = nice package, the only problem the i had was the i use a image from another thread and didn't work as i hope to. but is a done deal man, i am not going to see does birds any more.
shalom beushhh
Please update this for the 1.2 bootloader. While installing vegan-tab, i saw that there is a huge difference between bootloader 1.1 that most everyone has and the 1.2 bootloader. plus the android 2.2 images, will that work with the newest version of vegan-tab? either way, the link doesnt work any more
My purpose is to locate the fastboot system, and I thought that I would start from, well, the start. Boot-up on the OMAP4430 tries many places, one is an on-chip 48kb ROM. I initially tried to read /dev/mem, but no matter what address I tried to read it would say Bad Address, so I had to make a kernel module, in which I dumped the boot ROM to a file... and it worked.
The reversion of the ROM on my bionic is 0x03 0x19
(Please read Ch 27(.4.2.1) of OMAP4430_ES2.x_PUBLIC_TRM_vY.zip )
I am more handy with ia32 assembly, not arm...
So where is fastboot? I can see a few other addresses, but if I try to map some of them, the device will reboot.. The TRM spoke of 0x08000000 for a fast boot XIP but a reboot occurs (I think) ... any ideas where to look next?
After a day of digging around, I was able to find that "fastboot"(0x08000000) address at 0x28C18 (0x28000 is the base address of the boot.rom) ... just helping out anyone else interested in looking into this. I somehow don't think that this is what I am looking for though... but atleast I do know that I am making some headway
Edit: Confirm that I am unable to read even one byte from 0x08000000 .. reboots
Edit2: Polling from the Control Register (0x4A0022C4) returned 0x00000AEF ... which means that
1) This is not a GP(General Purpose) OMAP4430
2) SYS_BOOT[5:0] is b101111 which tells us
a) to use Memory, not Peripheral boot devices
b) 1st boot device is MMC2(1)(perm) (eMMC/eSD = GPMC pins)
c) 2nd= USB-ULPI (external transceiver)
... Does the MMC mean it boots from the onboard 16gb? If so, then this might be easier to trace through than I thought...
Has anyone dumped the entire contents of that memory? or just the known partitions?
Edit3: Reading the TRM more (pg 5240) tells me that SDMMC2 only Raw mode is supported, no file system (FAT12/FAT16/FAT32) support because the purpose of this approach is to avoid the boot time penalty of searching for a file system hierarchy when it is not always necessary.
Edit4: ...and Sure enough, dumping the first 512 bytes of /dev/block/mmcblk1 shows the Bootable signature (0x55AA) at the end (0x01FE)
... I thought I read that it would just try to read in RAW mode, which makes it not want to even have such a thing, but I knew it had all those other partitions, so I figured I might have been wrong there...
A proper dump of this soon enough.. atleast I gave you guys the boot.rom from the actual OMAP4430 that would have been otherwise hard to retreive... I only wasted one day on this, not bad and I learned some ARM ASM
Edit5: Maybe I am getting ahead of myself, it is of type 0x83 ... which is Linux, not any of the FAT FS which the boot.rom supports... ?
Edit6: Well, it has the file it's looking for, not sure if it's a FAT system like it's suppose to be though, and it looks like in a 1MB dump that fastboot is in the 2nd or maybe more, partition... I still want to try to dump this "MLO" bootup file... but i have to learn about FAT fs structure, ugh...
The implications of deep hardware hacking like this make me very excited for what could be possible with the Bionic. It contains some absolutely absurd hardware for a mobile device so the sky's the limit at this point. Fantastic work! I could only dream of being able to comprehend the things that guys like you can.
Also I wonder if this thread would end up getting proper attention in the dev section.
projektorboy said:
The implications of deep hardware hacking like this make me very excited for what could be possible with the Bionic. It contains some absolutely absurd hardware for a mobile device so the sky's the limit at this point. Fantastic work! I could only dream of being able to comprehend the things that guys like you can.
Also I wonder if this thread would end up getting proper attention in the dev section.
Click to expand...
Click to collapse
I only wish I could comprehend what he is talking about. I'm glad to see a vested interest is being taken!
Sent from my DROID BIONIC
Thanks so much, Noxz for making the effort to do this!
hey, thanks finally for the responses, a full day after the initial dump and no responses... I think because it's NOT in the dev section... but I can't post a thread there until I have 10 posts... maybe I can get that privilege now, moderators?
The bad part with disassembling is that when it computes an jump in code(in ARM it's called a branch) and doesn't give a specific address, it makes finding that code very hard.. I found the text "MLO", the bootable file, in the boot.rom but nothing of the code I know referenced it yet, unfortunate because that partition is not a standard FAT fs and thus is taking a while to read, but if I did have the disassemble of the ROM code where it looks for that, or even just the file search, then I could easily see what it is reading...
Obviously knowing that fastboot and such is in the second or third partition is quite a step forward, but I need to dump this MLO file so we can read from start to finish...
I'll keep everyone posted
So this partition isn't a correct FAT fs... I don't know if being identified as a Linux partition means anything and I'm just not reading into it right, but I am having some time trying to look into these files, you can easily see the MLO file, a KEYS file, and a PRIMAPP file right at the start, or I should say the file name, but there isn't much information on where they are mapped, etc etc...
Maybe partition2 will be better? It's also identified as a Linux partition
I still have a few days to waste...
Sorry to ask dumb. But what exactly does this benefit me when flashing it?
Sent from my DROID BIONIC using Tapatalk
The current fastboot does not have several commands that is in the original source... but really, I am just interested in the entire boot procedure.. there's a few things I might like to change... The good news is because everything but the boot.rom resides on the eSD, that means we should be able to write to it very easily, so we can change quite a bit
Noxz, I am along with these guys in I would understand more if I was just dropped in the middle of Ghana :\ but I would like you to know that you have given me my 1024th item on my 'to research' list. So once I get bored with what I'm doing now, I am going to try to learn a little bit about ARM and OMAP
Hah, I understand...
I've done a bit of x86 ASM and BIOS disassembly before.. so I figured I might as well peek into this and see what is being hidden and such...
I am seeking help right now... If you know anything about the FAT filesystem... you can start by doing "dd if=/dev/block/mmcblk1p1 of=/mnt/sdcard-ext/partition1"
.. It obviously has that MLO bootup file in it as mentioned in the OMAP4430 TRM but I can't seem to trace what cluster it might be in... I have to assume that it is in fact a FAT fs... but it doesnt seem to follow any of the structures/formats I've been reading... ???
The boot rom you've dumped is the ti omap itself; the only real purpose of that is to bootstrap the bootloader. You are correct in that it's not a GP; none of the Motorola phones are -- this boot rom is what verifies the signature of the bootloader.
http://www.droid-developers.org/wiki/Booting_chain
While not exact, the above diagram will give you an overview of the layout used by Motorola phone. The short version is boot rom -> mbmloader -> mbm -> lbl -> kernel, where mbmloader is the Motorola terminology for the MLO or X-LOADER referenced in the TRM. mbm is the bootloader (motorola boot manager) and controls all actions henceforth, including fastboot (which replaced an older sbf protocol).
The CDT acts as a partition table and lists the layout of the device, including marking where the signatures are located and how often they're checked.
http://blog.opticaldelusion.org/2011/10/bionic-development-notes.html
Sorry for late answer.
Here you can find example of reversing OMAP 3430 bootrom http://hg.droid-developers.org/reverse_engineering/src/b8b881184b5f/asm
As mentioned before droid-developers wiki contain a lot of info about bootrom.
Here you can find info about bootrom itself http://www.droid-developers.org/wiki/Application_Processor_Boot_ROM
Here you can find info about security model in omap http://www.droid-developers.org/wiki/Security http://www.droid-developers.org/wiki/Secure_Services
Here you can find info about my project - emulation of early OMAP booting (including bootrom debugging) http://www.droid-developers.org/wiki/QEMU
BLUF (Bottom Line Up Front) Both the CF and SuperRoot auto-root's would give me "No such file or directory" errors in reference to fastboot when I knew damn well fastboot was present and working!
I don't have 10 posts and therefore I cannot post this in the actual CF-Auto-Root thread where this might help someone. However, If you happened to be having the same issue I had, I hope you find this.
I assume I cant post links to things either so, we'll skip that and hope people can google-along with me.
I should say that I am mostly to blame for my own issue since I read through several different rooting methods and I tried to quilt together pieces from each. Sometimes I think I'm smarter than I actually am when I should really just follow directions.
Here's how I went about it:
1. I pulled "adb" and "fastboot" from the webpud8 PPA (no issues)
2. I used "fastboot oem unlock" to unlock the bootloader (no issues)
3. I tried two separate auto-root methods and the Nexus-toolkit (NOTHING WORKED!)
My solution:
After pulling most of my hair out I began to realize the scripts were trying to reference a "fastboot-linux" file from the auto-rooter-specific files. In the case of CF-Auto-Root it was looking for "CF-Auto-Root-mako-occam-nexus4/tools/fastboot-linux". I don't know why the referenced "fastboot-linux" was throwing errors but I did know I had "fastboot" installed and that it was working fine.
I ran the two pieces of CF's "root-linux.sh" script manually, substituting "fastboot" in place of "tools/fastboot-linux".
They looked like this (It's important the CF-Auto-Root folder is extracted into the Home directory):
sudo fastboot oem unlock
sudo fastboot boot ~/CF-Auto-Root-mako-occam-nexus4/image/CF-Auto-Root-mako-occam-nexus4.img
I'm no expert (but I did stay in a Holiday Inn....once), and I can't claim this wont send you further in the wrong direction - but it finally ended hours of frustration for me!
-Jerry