斐讯N1救砖记之TTL大法【亲身经历】

变砖过程

先前刷的CoreELEC9.0.2版本,想升级9.0.3。这个时候9.0.3的优盘已做好,错误的插在了N1靠近HDMI的USB插口,ssh输入命令reboot update,然后去N1那里看,出错了!再重启就卡在开机画面不动了,感觉是砖了……

总结:降级、刷错包、刷机时断电,都可能变砖。

救砖尝试

1、尝试:U盘启动,失败!!
2、尝试:拆机 短接,线刷W大的2.1和2.2,失败!!传送门:【V2.1】 | 【V2.2】
3、尝试:加秘钥线刷V3救砖包,失败!!传送门:【V3】


拆机 继续尝试,TTL救砖

参考N1不能通过网络刷机后拆机救砖
如果只是不能进线刷模式,导致不能刷机,又不能通过网络进入刷机模式,可以通过用镊子短接2个点,强行进入刷机模式,刷机!!
如果还刷不成功请继续看!

准备工具:

  • 电烙铁和焊锡
  • 公母、公公头杜邦线若干
  • 排针
  • 镊子
  • 螺丝刀等拆机工具

N1拆机焊接TTL.jpg
焊接RX/TX/GND
RX - TX
TX - RX
GND - GND
用USB转串口,连接电脑,设置串口号(设备管理器中查看)和波特率115200
115200.png
盒子上电看到串口打印信息(恩山论坛玩家说,有回显说明没真砖,BootLoader还在)。
进入Uboot命令行:uboot命令行的启动方式,板子启动后在PC端的putty界面中通过串口快速按任意键或者输入ctrl+c,即可进入uboot命令行模式。
用户由p230# 变成了 gxl_p230_v1#
在这个模式下,将N1降级恢复线刷的3个文件boot.imgbootloader.imgrecovery.img三个文件拷到一个fat32格式的U盘中,(U盘必须是单分区的),一定要确定文件,没有问题,必须是v2.19版本的。
将U盘插入N1盒子,putty中逐条输入如下三条命令更新系统boot:

usb_update  bootloader bootloader.img
usb_update  recovery recovery.img
usb_update  boot  boot.img

逐条执行命令后,串口返回的信息:

usb_update bootloader bootloader.img 执行返回:

gxl_p230_v1#usb_update  bootloader bootloader.img
usb_start_count 0
(Re)start USB...
USB0:   USB3.0 XHCI init start
Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... init_part() 278: PART_TYPE_DOS
1 Storage Device(s) found
[fat]Filesize is 0xa4200B[0M]
[fat]0x:leftSz 2000 < BPS 4000, gotSz 2000
[MSG]Down(store) part(bootloader) sz(0xa4200) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 11
[fat]Filesize is 0xa4200B[0M]
[fat]0x:leftSz 200 < BPS 4000, gotSz 4200
[MSG]Burn Start...
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
[MSG]align bootloader sz from 0xa4200 to 0xa8000
[MSG]Burn complete
BURN bootloader.img to part bootloader OK!
=====>Burn part bootloader in fmt normal OK<======

usb_update recovery recovery.img 执行返回:

gxl_p230_v1#usb_update  recovery recovery.img
usb_start_count 1
[fat]Filesize is 0x1172a00B[17M]
[fat]0x:leftSz 2000 < BPS 4000, gotSz 2000
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(recovery) sz(0x1172a00) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[fat]Filesize is 0x1172a00B[17M]
[MSG]Burn Start...
[fat]0x:leftSz 2a00 < BPS 4000, gotSz 2a00
[MSG]Burn complete
BURN recovery.img to part recovery OK!
=====>Burn part recovery in fmt normal OK<======

usb_update boot boot.img 执行返回:

gxl_p230_v1#usb_update  boot  boot.img
usb_start_count 1
[fat]Filesize is 0xd88a00B[13M]
[fat]0x:leftSz 2000 < BPS 4000, gotSz 2000
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(boot) sz(0xd88a00) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[fat]Filesize is 0xd88a00B[13M]
[MSG]Burn Start...
[fat]0x:leftSz a00 < BPS 4000, gotSz 8a00
[MSG]Burn complete
BURN boot.img to part boot OK!
=====>Burn part boot in fmt normal OK<======

gxl_p230_v1#

如图:
ttl.png

降级3个文件后,如果还是不能通过网络进入线刷模式或者短接触点刷机依然失败的,可以继续看!


终极TTL大法

N1通过USB转串口双公头线同时连接电脑,putty进入uboot命令行模式后,打开刷机工具选好刷机包,点击开始
uboot命令行,可以通过putty输入

update

串口返回信息见下面。
ok.png
刷机开始,祝您成功!!!

2019年9月11日补充:

刷机成功后,一定要重新【fastboot 烧录】刷3个降级文件

如果不重新刷降级文件,会出现未知问题,已知的有:
1、有线网卡、无线网卡MAC不固定,蓝牙不固定
2、最严重的,每次重启卡画面,一定要断电才能正常重新启动。
降级方法详见:https://www.right.com.cn/forum/thread-322223-1-1.html


附:救砖成功记录

从156行update命令开始

GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;
TE: 222355

BL2 Built : 11:58:42, May 27 2017.
gxl gc3c9a84 - xiaobo.gu@droid05

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 4
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0+1 @ 912MHz - PASS
Rank0: 1024MB(auto)-2T-13
Rank1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R2048 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R2048 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x0002c600
aml log : R2048 check pass!
Load bl33 from eMMC, src: 0x00050200, des: 0x01700000, size: 0x00053400
aml log : R2048 check pass!
NOTICE:  BL3-1: v1.0(release):a625749
NOTICE:  BL3-1: Built : 11:25:15, Aug 25 2017
[BL31]: GXL CPU setup!
NOTICE:  BL31: BL33 decompress pass
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0x04
2b f9 fd 4e 7a c5 85 cb 23 29 1f 98 [0.809198 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01-00010-gfe36fb9 (Mar 02 2018 - 19:00:28)

DRAM:  2 GiB
Relocation Offset is: 76ed9000
register usb cfg[0][9] = 0000000077f5d330
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
MMC:   aml_priv->desc_buf = 0x0000000073ed9640
aml_priv->desc_buf = 0x0000000073edb960
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 71b104da
aml log : R2048 check pass!
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
start dts,buffer=0000000073ede1b0,dt_addr=0000000073ee91b0
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
parts: 10
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06:      boot   0000000002000000 1
07:    system   0000000050000000 1
08:     cache   0000000020000000 2
09:      data   ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 38e6622d, store 38e6622d
_verify_dtb_checksum()-917: calc 38e6622d, store 38e6622d
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
aml log : R2048 check pass!
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
vpp: vpp_pq_load pq val error !!!
Net:   Phy 0 not found
dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=0
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
Err imgread(L453):Logo header err.
There is no valid bmp file at the given address
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
gpio: pin GPIOAO_2 (gpio 102) value is 1
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
gxl_p230_v1#<INTERRUPT>
gxl_p230_v1#<INTERRUPT>
gxl_p230_v1#update
InUsbBurn
[MSG]sof
Set Addr 14
Get DT cfg
Get DT cfg
Get DT cfg
set CFG

ID[16]
BULKcmd[upload mem 0xc8100228 normal 0x4]
[MSG]Down(mem) part(0xc8100228) sz(0x4) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 0
[info]success
[MSG]Burn Start...
[MSG]Burn complete

ID[16]
tplcmd[    echo 12345]
12345
[MSG]ret = 0
[info]success
BULKcmd[    low_power]
[info]success

ID[16]
tplcmd[    download mem dtb normal 89120]
[MSG]Down(mem) part(dtb) sz(0x15c20) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 2
[info]success
[MSG]Burn Start...
[MSG]load dt.img to 0x0000000001000000, sz=0x15c20
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[disk_initial 0]
[MSG]Exit before re-init
command:        store  exit
dtb magic 71b104da
aml log : R2048 check pass!
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
start dts,buffer=0000000001000000,dt_addr=000000000100b000
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
parts: 10
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06:      boot   0000000002000000 1
07:    system   0000000050000000 1
08:     cache   0000000020000000 2
09:      data   ffffffffffffffff 4
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
switch to partitions #0, OK
mmc1(part 0) is current device
Device: SDIO Port C
Manufacturer ID: 15
OEM: 100
Name: 8GTF4
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.1
High Capacity: Yes
Capacity: 7.3 GiB
mmc clock: 40000000
Bus Width: 8-bit
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
[info]success

ID[16]
tplcmd[download store _aml_dtb normal 89120]
[MSG]Down(store) part(_aml_dtb) sz(0x15c20) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 2
[info]success
[MSG]Burn Start...
[MSG]optimus_download_dtb_image:dataSzReceived=0x15c20
start erase dtb......
start = 81920,end = 82943
dev # 1,  , several blocks erased OK
[store]To run cmd[emmc dtb_write 0x0000000007700000 0x40000]
dtb_write()-1140: valid 2
dtb_write()-1160: new stamp 3, checksum 0x96094b56, version 1, magic A~D
dtb magic 71b104da
aml log : R2048 check pass!
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
start dts,buffer=0000000007700000,dt_addr=000000000770b000
dtb magic 5f4c4d41
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
start dts,buffer=0000000007700000,dt_addr=000000000770b000
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: gxl platform: p230 variant: 2g
        dtb 0 soc: gxl   plat: p230   vari: 1g
        dtb 1 soc: gxl   plat: p230   vari: 2g
      Find match dtb: 1
parts: 10
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06:      boot   0000000002000000 1
07:    system   0000000050000000 1
08:     cache   0000000020000000 2
09:      data   ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
partition table success
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum dfc2b2e7a335949facb3b37eef85fb575a654150]
[store]To run cmd[emmc dtb_read 0x0000000007700000 0x40000]
dtb_read_shortcut()-975: short cut in...
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store boot normal 14191104]
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(boot) sz(0xd88a00) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[info]success
[MSG]Burn Start...
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum 1a0d04db8fb57f252c72c909a3268b6b2c3bd241]
[MSG]Verify Start...
[MSG]To verify part boot in fmt normal
[MSG]Verify End
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store data sparse 243305224]
[MSG]flash LOGIC partCap 0x14ac00000B
[MSG]Down(store) part(data) sz(0xe808b08) fmt(sparse)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1024
[info]success
[MSG]Burn Start...
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum d60525782a53edda29fa4d62a8ba2edbac4a8279]
[MSG]Verify Start...
[MSG]To verify part data in fmt sparse
[MSG]Verify End
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store logo normal 1160640]
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(logo) sz(0x11b5c0) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[info]success
[MSG]Burn Start...
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum 474362581cadbf2b2c22ee1a1e1eba0a9867a5e2]
[MSG]Verify Start...
[MSG]To verify part logo in fmt normal
[MSG]Verify End
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store recovery normal 18295296]
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(recovery) sz(0x1172a00) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1
[info]success
[MSG]Burn Start...
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum b468a3134b376a5295c1fd5857343128d0ac056c]
[MSG]Verify Start...
[MSG]To verify part recovery in fmt normal
[MSG]Verify End
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store system sparse 1131171384]
[MSG]flash LOGIC partCap 0x50000000B
[MSG]Down(store) part(system) sz(0x436c4e38) fmt(sparse)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1024
[info]success
[MSG]Burn Start...
[MSG]Burn complete
Downloading %100
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum 2a3d8081af68cfd0492284abe7c75a135053756d]
[MSG]Verify Start...
[MSG]To verify part system in fmt sparse
[MSG]Verify End
[MSG]VERIFY OK
[info]success

ID[16]
tplcmd[download store bootloader normal 672256]
[MSG]Down(store) part(bootloader) sz(0xa4200) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 11
[info]success
[MSG]Burn Start...
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
[MSG]align bootloader sz from 0xa4200 to 0xa8000
[MSG]Burn complete
BULKcmd[download get_status]
[info]success
BULKcmd[verify sha1sum 3a1ffcadf062748ca1d00eb80e73f2175b160a0d]
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
[MSG]VERIFY OK
[info]success
BULKcmd[save_setting]
[MSG]Set upgrade_step to 1
Saving Environment to aml-storage...
mmc env offset: 0x27400000
Writing to MMC(1)... done
[info]success
BULKcmd[burn_complete 3]
[MSG]Pls un-plug USB line to poweroff
[info]success

参考 N1不能通过网络刷机后拆机救砖
参考 小白的斐讯N1半砖救砖历程

最后修改:2019 年 09 月 11 日 01 : 57 PM
如果觉得我的文章对你有用,请随意赞赏

7 条评论

  1. Elliot

    我用fastboot 重新刷降级文件了 但是还是每次重启卡界面,你也有这个问题吗?

  2. viki

    你好,T1能这样么,有没有弄过

  3. zrenyi

    太复杂,我直接用flash emmc。

  4. Carrdy

    能通过短接刷rush固件 刷不了w的固件 刷V2.2卡在26% V2.1卡24% 能解决吗 刷失败就又变砖了。。。

  5. whhlcj

    我的n1接ttl以后pttuy端显示只有一行信息如下!这么搞?
    GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:400;NAND:82;SD:800;USB:8;

    1. quzard
      @whhlcj

      我也和你一样

    2. Recall
      @whhlcj

      CPU挂掉了

发表评论