[Q] Is it possible to recover data from a corrupted eMMC (potentially SDS)? - Galaxy Note II Q&A, Help & Troubleshooting

Hello.
My SGN2 have classic SDS symptoms (or maybe half SDS): Stuck at boot logo screen, recovery mode shows variuos of mount errors, and Odin fails to flash any file in download mode right after attempting to access NAND.
The device had rooted stock rom with Android 4.4.2 before of dying, and I can see the "product name" in download mode, so there's a possibility that actually it's not the famous sudden death syndrome, but some other kind of eMMC corruption.
After lots of search efforts which didn't lead me to an answer, I want to know from exprienced users if there's a known way to dump plain data out of the eMMC, with JTAG or eMMC reader / adapter, or other external equipment.
I saw in several tutorials that JTAG softwares have a read method. Does it access the direct sectors of the eMMC in low level, or it requires the same normal successful mounting in order to work?
Also, from what I understood, when mounting the eMMC with one of mentioned special devices, it's recognized on PC as a regular removable disk, similarly to a USB flash disk. Perhaps a program like "testdisk" will be able to achieve what I wish?
In addition, this woderful research thread mentions direct MMC commands that can be performed in some manner (I have no enough knowledge to understand how).
As @AdamOutler mentions in post #112 over there, he tried to develop a solution together with @Oranav and @Rebellos. Is there anyone who is familiar with this approach?
I'm mentioning also @Entropy512, @vim1, @AndreiLux and @E:V:A, which seem to have the knowledge according to that thread, hoping that someone can contribute to my thread here.
Thanks in advance for any help!
Meir

What recovery do you have? Does it have adb shell access through USB?
If so - you should be good to go with high level solution. If not, try flashing it with TWRP.
Mind you it might brick your phone "even more" if flashing fails somehwere in the middle.
It's possible to dump mmc using
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/dump.bin
(you need a SDcard mounted, so there's somewhere to dump to).
If my memory serves me well, if this is indeed a SDS - the eMMC will "freeze" once a broken memory block gets accessed. It will remain unresponsible until power-cycled - this can be done either by resetting the phone, or manipulating PMIC settings in the system.
So you'd want to read certain blocks from MMC - http://www.thelinuxdaily.com/2010/03/write-to-or-read-from-a-given-sector-using-dd/ and reboot your phone once you hit the bad one.
However, mind you, SDS was triggered by something. And that was a certain MMC command (TRIM) sent over during flashing by an unpatched system/recovery. Did this happen after some try to flash the device? It still might be some weird way of SDS or, as you said yourself, some other kind of corruption. The device itself is pretty old...
If you cannot reach it through recovery. We're talking another level of complexity.
JTAG would be your best shot, as it's fairly easily accessible and relatively easy to solder. It can break the CPU execution at any given moment, and then either upload a payload, or work directly through JTAG.
A payload would make the CPU configure eMMC and do the necessary stuff - like dumping parts of it to RAM (making it downloadable by JTAG, in process). JTAG could basically do the same, just slower. I am pretty sure there is a (most likely paid) software out there to do exactly that, but I have no experience with it whatsoever. I'm just familiar with the process.
It is also possible to hookup bare eMMC chip as a legacy SD card. But it's really tough (it's hard to imagine how small the chip connections really are, until you try to solder them). See my recent post about that:
http://forum.xda-developers.com/har...e-lumia-to-t2798431/post64703284#post64703284

Rebellos said:
What recovery do you have? Does it have adb shell access through USB?
If so - you should be good to go with high level solution. If not, try flashing it with TWRP.
Mind you it might brick your phone "even more" if flashing fails somehwere in the middle.
It's possible to dump mmc using
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/dump.bin
(you need a SDcard mounted, so there's somewhere to dump to).
If my memory serves me well, if this is indeed a SDS - the eMMC will "freeze" once a broken memory block gets accessed. It will remain unresponsible until power-cycled - this can be done either by resetting the phone, or manipulating PMIC settings in the system.
So you'd want to read certain blocks from MMC - http://www.thelinuxdaily.com/2010/03/write-to-or-read-from-a-given-sector-using-dd/ and reboot your phone once you hit the bad one.
However, mind you, SDS was triggered by something. And that was a certain MMC command (TRIM) sent over during flashing by an unpatched system/recovery. Did this happen after some try to flash the device? It still might be some weird way of SDS or, as you said yourself, some other kind of corruption. The device itself is pretty old...
If you cannot reach it through recovery. We're talking another level of complexity.
JTAG would be your best shot, as it's fairly easily accessible and relatively easy to solder. It can break the CPU execution at any given moment, and then either upload a payload, or work directly through JTAG.
A payload would make the CPU configure eMMC and do the necessary stuff - like dumping parts of it to RAM (making it downloadable by JTAG, in process). JTAG could basically do the same, just slower. I am pretty sure there is a (most likely paid) software out there to do exactly that, but I have no experience with it whatsoever. I'm just familiar with the process.
It is also possible to hookup bare eMMC chip as a legacy SD card. But it's really tough (it's hard to imagine how small the chip connections really are, until you try to solder them). See my recent post about that:
http://forum.xda-developers.com/har...e-lumia-to-t2798431/post64703284#post64703284
Click to expand...
Click to collapse
Hi Rebellos
What level of success do you think could be had with re-partitioning the emmc by trying to use the patched PIT's contained in the zip file "pits-N7100---FOR-EXPERTS-ONLY.zip" contained at the end of the thread http://forum.xda-developers.com/showthread.php?t=1667886
I can only get to download mode using USB jig. Otherwise screen shows "firmware encountered an error..." Regular flashing of stock PIT does not work. Phone never rooted and running stock 4.4.2. Just died one day.
Thanks in advance

have you search this error? I think no ! The forums are full with this error..... !!! a little bit Google "firmware encountered an error" and you have 447.000 Posts
and i have offered in last Post to help you with PM .... but no reaction
pls Do not say THX Press Button Thanks! it has helped................

Rebellos said:
What recovery do you have? Does it have adb shell access through USB?
If so - you should be good to go with high level solution. If not, try flashing it with TWRP.
Mind you it might brick your phone "even more" if flashing fails somehwere in the middle.
It's possible to dump mmc using
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/dump.bin
(you need a SDcard mounted, so there's somewhere to dump to).
If my memory serves me well, if this is indeed a SDS - the eMMC will "freeze" once a broken memory block gets accessed. It will remain unresponsible until power-cycled - this can be done either by resetting the phone, or manipulating PMIC settings in the system.
So you'd want to read certain blocks from MMC - http://www.thelinuxdaily.com/2010/03/write-to-or-read-from-a-given-sector-using-dd/ and reboot your phone once you hit the bad one.
However, mind you, SDS was triggered by something. And that was a certain MMC command (TRIM) sent over during flashing by an unpatched system/recovery. Did this happen after some try to flash the device? It still might be some weird way of SDS or, as you said yourself, some other kind of corruption. The device itself is pretty old...
If you cannot reach it through recovery. We're talking another level of complexity.
JTAG would be your best shot, as it's fairly easily accessible and relatively easy to solder. It can break the CPU execution at any given moment, and then either upload a payload, or work directly through JTAG.
A payload would make the CPU configure eMMC and do the necessary stuff - like dumping parts of it to RAM (making it downloadable by JTAG, in process). JTAG could basically do the same, just slower. I am pretty sure there is a (most likely paid) software out there to do exactly that, but I have no experience with it whatsoever. I'm just familiar with the process.
It is also possible to hookup bare eMMC chip as a legacy SD card. But it's really tough (it's hard to imagine how small the chip connections really are, until you try to solder them). See my recent post about that:
http://forum.xda-developers.com/har...e-lumia-to-t2798431/post64703284#post64703284
Click to expand...
Click to collapse
@Rebellos, I already have TWRP recovery, and I can access the device through adb, but it looks like it doesn't mount the external sdcard.
When I go to "Mount" menu in TWRP and press "External SDCard", I get this output in console:
Code:
[COLOR="Red"]E: Unable to mount '/external_sdcard'[/COLOR]
And this is "mount" output inside adb shell:
Code:
~ # ←[6nmount
mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
"cat /proc/devices" output:
Code:
~ # ←[6ncat /proc/devices
cat /proc/devices
Character devices:
1 mem
4 /dev/vc/0
4 tty
4 ttyS
5 /dev/tty
5 /dev/console
5 /dev/ptmx
7 vcs
10 misc
13 input
21 sg
29 fb
81 video4linux
89 i2c
108 ppp
116 alsa
128 ptm
136 pts
153 spi
180 usb
188 ttyUSB
189 usb_device
204 ttySAC
216 rfcomm
243 ump
244 mali
246 roccat
247 BaseRemoteCtl
248 media
249 ttyGS
250 usbmon
251 hsicctl
252 tzic
253 dia
254 rtc
Block devices:
1 ramdisk
259 blkext
7 loop
8 sd
65 sd
66 sd
67 sd
68 sd
69 sd
70 sd
71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
179 mmc
254 device-mapper
"cat /proc/partitions" output:
Code:
~ # ←[6ncat /proc/partitions
cat /proc/partitions
major minor #blocks name
179 0 30657536 mmcblk0
179 1 30656512 mmcblk0p1
I tried to use the "dd" command you suggested in order to dump despite the above, and surprisingly, when I opened another terminal window, and used "kill" several times to track the "dd" progress, it showed in the first terminal:
Code:
~ # ←[6ndd if=/dev/block/mmcblk0 of=/sdcard/dump.bin
dd if=/dev/block/mmcblk0 of=/sdcard/dump.bin
1492162+0 records in
1492161+0 records out
763986432 bytes (728.6MB) copied, 53.898640 seconds, 13.5MB/s
2888160+0 records in
2888160+0 records out
1478737920 bytes (1.4GB) copied, 104.709910 seconds, 13.5MB/s
3251936+0 records in
3251936+0 records out
1664991232 bytes (1.5GB) copied, 118.393067 seconds, 13.4MB/s
3418080+0 records in
3418080+0 records out
1750056960 bytes (1.6GB) copied, 124.486490 seconds, 13.4MB/s
But then, as you predicted, the process suddenly halted, and the device restarted.
I connected the SD card directly to my PC and I couldn't see a file named "dump.bin".
And some weird thing- when I connect with adb again, the "mount" shows the same output, but "cat /proc/partitions", which listed "mmcblk0" and "mmcblk0p1" before, is now empty:
Code:
~ # ←[6ncat /proc/partitions
cat /proc/partitions
major minor #blocks name
Is it possible that the "dd" process damaged the mmc even more?

Okay, I found out what happened with "cat /proc/partitions", and apparently it's bad news.
It's always empty when the external sd card is not connected to the device, and not empty when it's connected.
I'm afraid that means that emmc partitions are not recognized at all..
So my only hope is using external boxes?

grwalker said:
Hi Rebellos
What level of success do you think could be had with re-partitioning the emmc by trying to use the patched PIT's contained in the zip file "pits-N7100---FOR-EXPERTS-ONLY.zip" contained at the end of the thread http://forum.xda-developers.com/showthread.php?t=1667886
I can only get to download mode using USB jig. Otherwise screen shows "firmware encountered an error..." Regular flashing of stock PIT does not work. Phone never rooted and running stock 4.4.2. Just died one day.
Thanks in advance
Click to expand...
Click to collapse
I think Josh from Mobiletechvideos was experimenting with that technique. It all depends on the block of eMMC that's damaged. If it's something around the beggining of the flash memory where bootloaders, GPT and PIT reside. It's probably impossible to walk-around with PIT patching. If it's somewhere further. It might be possible to fix it with patched PIT. Even if it worked, though - I wouldn't trust such device anymore when holding data.
MeiR_ct said:
Okay, I found out what happened with "cat /proc/partitions", and apparently it's bad news.
It's always empty when the external sd card is not connected to the device, and not empty when it's connected.
I'm afraid that means that emmc partitions are not recognized at all..
So my only hope is using external boxes?
Click to expand...
Click to collapse
Oh, sorry. I forgot to tell you - please post "dmesg" output if you can access the adb. But yeah, as far as I remember mmcblk0 should be eMMC, not external-sd. So it's a bad sign. But eMMC *must* be accessible because, obviously, bootloaders and recovery are being loaded succesfully from there.
About previous post - if mounting SD card failed (probably because TWRP expects to find it under mmcblk1 device node), you will be dumping files into RAM filesystem (this is how Linux behaves). SGS2 has, as far as I remember, 2GB of RAM. So after using all RAM available for in-memory rootfs, your phone crashed.
As long as you don't mix up "if" and "of" parameters of dd command - you shouldn't damage the device anymore.
What's more - when your recovery is already fully loaded into RAM and it occurs eMMC error - your phone shouldn't reboot, but rather burst out a load of errors into kernel log (dmesg). Kernel has no reason to panic as it can still execute.

Rebellos said:
Oh, sorry. I forgot to tell you - please post "dmesg" output if you can access the adb. But yeah, as far as I remember mmcblk0 should be eMMC, not external-sd. So it's a bad sign. But eMMC *must* be accessible because, obviously, bootloaders and recovery are being loaded succesfully from there.
About previous post - if mounting SD card failed (probably because TWRP expects to find it under mmcblk1 device node), you will be dumping files into RAM filesystem (this is how Linux behaves). SGS2 has, as far as I remember, 2GB of RAM. So after using all RAM available for in-memory rootfs, your phone crashed.
As long as you don't mix up "if" and "of" parameters of dd command - you shouldn't damage the device anymore.
What's more - when your recovery is already fully loaded into RAM and it occurs eMMC error - your phone shouldn't reboot, but rather burst out a load of errors into kernel log (dmesg). Kernel has no reason to panic as it can still execute.
Click to expand...
Click to collapse
2GB is clearly not enough, so I ended up using this guide to dump directly to PC, using "nc".
But as found out, it was an unneeded work, since I was dumping the external sd data (by the way, I found out when the size passed 16GB and was still increasing. Then I pulled out the micro sd and noticed that "cat /proc/partitions" is empty).
I have no idea why a sudden reboot occured when dumping to RAM, perhaps it's related to my issue?
The unfortunate fact is that currently I cannot dump anything from the emmc since it has no readable partitions.
Full dmesg output: http://hastebin.com/raw/pohunuhisu (was too long to fit here)
With grep of "mmc" (assuming these are the interesting ones):
Code:
~ # dmesg | grep mmc
dmesg | grep mmc
<5>[ 0.000000] c0 Kernel command line: console=ram loglevel=4 bootmode=2 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.debug_level=0x4f4c [email protected] [email protected] [email protected] s3cfb.bootloaderfb=0x5ec00000 sysscope=0xee000000 lcdtype=1 consoleblank=0 lpj=3981312 vmalloc=176m oops=panic pmic_info=67 cordon=ba920e93ede2b6687252656e7f08332d connie=GT-N7100_OPEN_EUR_0c27b5455e10924c1fcfd032d76705c7 androidboot.emmc_checksum=3 androidboot.odin_download=1 androidboot.bootloader=N7100XXUFNL1 androidboot.selinux=enforcing androidboot.warranty_bit=1 androidboot.sec_atd.tty=/dev/ttySAC2 androidboot.serialno=4df1b7fc16e98fbf snd_soc_core.pmdown_time=1000
<6>[ 2.149294] c2 dw_mmc dw_mmc: clock source 0: sclk_dwmci (40000000 Hz)
<3>[ 2.150586] c2 mmc0: Version ID 0x5342240a.
<6>[ 2.150837] c2 mmc0: FIFO WMARK FOR RX 0x80 WX 0x40. ###########
<6>[ 2.152320] c2 mmc0: MSHCI controller on samsung-mshci [dw_mmc] using IDMA
<6>[ 2.152810] c2 s3c-sdhci s3c-sdhci.2: clock source 2: sclk_mmc (40000000 Hz)
<6>[ 2.153095] c2 mmc1: vtf_2.8v regulator found
<7>[ 2.153301] c2 Registered led device: mmc1::
<6>[ 2.154455] c0 sdhci_set_ios : MMC Card ON samsung-hsmmc
<6>[ 2.154508] c0 mmc1: SDHCI controller on samsung-hsmmc [s3c-sdhci.2] using ADMA
<6>[ 2.154738] c0 mmc1: card removed.
<6>[ 2.154840] c0 s3c-sdhci s3c-sdhci.3: clock source 2: sclk_mmc (8800000 Hz)
<3>[ 2.154921] c0 mmc2: no vmmc regulator found
<7>[ 2.155208] c0 Registered led device: mmc2::
<6>[ 2.155460] c0 mmc2: SDHCI controller on samsung-hsmmc [s3c-sdhci.3] using ADMA
<3>[ 2.180888] c0 mmc0: cmd 52 response timeout error
<3>[ 2.181732] c0 mmc0: cmd 52 response timeout error
<3>[ 2.185774] c0 mmc0: cmd 8 response timeout error
<3>[ 2.186623] c0 mmc0: cmd 5 response timeout error
<3>[ 2.187458] c0 mmc0: cmd 5 response timeout error
<3>[ 2.188288] c0 mmc0: cmd 5 response timeout error
<3>[ 2.189119] c0 mmc0: cmd 5 response timeout error
<3>[ 2.189971] c0 mmc0: cmd 55 response timeout error
<3>[ 2.190886] c0 mmc0: cmd 55 response timeout error
<3>[ 2.191736] c0 mmc0: cmd 55 response timeout error
<3>[ 2.192589] c0 mmc0: cmd 55 response timeout error
<3>[ 2.211830] c0 mmc0: PERM_WRITE_PROTECT was set.
<6>[ 2.211866] c0 mmc0: VTU00M: 15010056545530304df1b7fc16e98fbf
<3>[ 2.290878] c0 mmc0: cmd 13 response timeout error
<6>[ 2.290975] c0 mmc0 : disable PON feature : ffffff92 : 00(10) : 00000000
<3>[ 2.291812] c0 mmc0: cmd 6 response timeout error
<3>[ 2.292644] c0 mmc0: cmd 6 response timeout error
<3>[ 2.293473] c0 mmc0: cmd 6 response timeout error
<3>[ 2.294305] c0 mmc0: cmd 6 response timeout error
<3>[ 2.294372] c0 mmc0: error -110 whilst initialising MMC card
<6>[ 2.329007] c2 sdhci_set_ios : MMC Card OFF samsung-hsmmc

It reboots when dumping to RAM fs because kernel runs out of memory and panics.
(Awesome idea with grep - much easier for me, when on mobile )
As suspected, though oddly. Internal eMMC controller is frozen already when recovery is running. The best shot would be power-cycling it through disabling and enabling the said vtf_2.8v regulator, hoping it doesn't power your CPU aswell. It can probably be done through sysfs. After that, another SDHCI driver probe should be somehow forced - I've got no idea how to do it without modifying kernel. But it might be doable. Try to do some lookup. I will aswell.
Remember dmesg is your best friend here. :3
//edit: Kernel patching itself is not an issue. Flashing it is, in your case. I suggest we try it as a last effort. Kexec, if supported by your current recovery kernel, is promising aswell.

Rebellos said:
It reboots when dumping to RAM fs because kernel runs out of memory and panics.
(Awesome idea with grep - much easier for me, when on mobile )
As suspected, though oddly. Internal eMMC controller is frozen already when recovery is running. The best shot would be power-cycling it through disabling and enabling the said vtf_2.8v regulator, hoping it doesn't power your CPU aswell. It can probably be done through sysfs. After that, another SDHCI driver probe should be somehow forced - I've got no idea how to do it without modifying kernel. But it might be doable. Try to do some lookup. I will aswell.
Remember dmesg is your best friend here. :3
//edit: Kernel patching itself is not an issue. Flashing it is, in your case. I suggest we try it as a last effort. Kexec, if supported by your current recovery kernel, is promising aswell.
Click to expand...
Click to collapse
First of all, I must thank you for your help and efforts so far.
My linux knowledge is quite low, so even before the driver task, I don't really know how to manipulate the vtf_2.8v regulator.
I made some search and saw there's a regulator interface API which should be accessed by some C language compiled script.
Code:
regulator_disable(regulator);
regulator_enable(regulator);
But I have no idea how to compile it correctly and initiate it after boot.
Can you please instruct me or to send me learning it from some tutorial?

Didn't Samsung fix this problem by releasing the kernel fix in Android 4.3?

It cannot be used from "script" nor "application". It's internal kernel API, accessible only from kernel space. You would need to either:
- modify kernel (sdhci driver, most notably), build it and then flash it over recovery (risky business with damaged eMMC, but you might end up doing that)
- modify kernel, build it and launch it with kexec (it is probably not supported by your recovery kernel)
- write a separate kernel module, build it into kernel module binary (.ko) and load it using insmod. It's probably the hardest solution.
//edit:
andrewKode said:
Didn't Samsung fix this problem by releasing the kernel fix in Android 4.3?
Click to expand...
Click to collapse
They supposedly did IIRC. That's why it might not be actually an SDS, but something quite similar.
//edit2:
Oh damn. I just looked at your dmesg again and realized my terrible mistake. VTF_2.8V regulates external SD card connection, not eMMC... It means I have currently not a real clue about how to access your eMMC without JTAG or something.
//edit3:
Here's the answer!
Dug out from publicly available N7100 schematics.
https://github.com/omnirom/android_...id-5.1/arch/arm/mach-exynos/mach-midas.c#L850
Deasserting this GPIO should power down both VMEM_VDD_2.8V and VMEM_VDDF_3.0V PMIC outputs. Which are powering eMMC.
This function controls the said pin:
https://github.com/omnirom/android_.../arch/arm/mach-exynos/setup-mshci-gpio.c#L154
It is called here:
https://github.com/omnirom/android_...0c1b6089d70/drivers/mmc/host/mshci-s3c.c#L585
You could try to suspend kernel (more info here: https://community.freescale.com/thread/261901) but it'll probably not suspend eMMC device, as it's not probed succesfully at all.
So a "proper" hack-around would power cycling eMMC around here:
https://github.com/omnirom/android_...0c1b6089d70/drivers/mmc/host/mshci-s3c.c#L366
by simply adding
Code:
pdata->set_power(pdev, 0); //power off
usleep(1000); //1ms sleep to make sure it is really powered down
pdata->set_power(pdev, 1); //power off
Then build the kernel + recovery and try to kexec it. If it fails, try flashing it and pray it won't break in the middle. Got no more ideas for now.

@Rebellos, I'm afraid that I'm quite lost here due to lack of knowledge.
I found a patched kernel zip for N7100 which includes kexec in this MultiROM MOD thread (kernel download for Touchwiz ROMs in post #2), and pushed it with adb to the device, but then the recovery failed to flash it, probably because the flashing process involves accessing those unmounting directories.
The questions is whether every kernel flashing will fail for the same reason.
If the alternative is to enable kexec support in my current kernel, I have no idea how to do it. =\
I'm a native Windows user, so unfortunately I don't know how to access each of the suggested methods.

You wont flash a thing using recovery, as it flashes stuff onto eMMC, which is already unaccessible.
I had Odin flashing in mind, but I forgot that you stated being unable to flash anything through Odin aswell. Got no viable solution for now then. If obtaining the data is urgent I recommend using a commercial recovery service or someone knowledgable with doing it through jtag.
I just figured eMMC could be power cycled using direct memory writes to GPIO control registers by any application. It still wouldnt get probed again by kernel though. I could try and develop aome walk-around solution but with my current time availability it would probably take weeks, if not months.

Okay, it's not so surprising for me that I cannot perform any recovery actions in the current state.
I contacted some recommended phone lab recently, for replacing the chip, and they said that they have an emmc reader to USB adapter.
I will try my luck there, hoping for a chance of recovering my data.
Thank you again for your time and help @Rebellos, I really appreciate it!

That's great to hear. I'm sorry couldn't help you more. Please let me know how did that go.

Rebellos said:
That's great to hear. I'm sorry couldn't help you more. Please let me know how did that go.
Click to expand...
Click to collapse
Frustration goes on!
It turned out that the lab still doesn't have mentioned eMMC to USB adapter, and it's on the way from a worldwide shipping.
The guy from the lab managed to detach the corrupted eMMC, but so far he didn't manage to revive the device after several attempts with new eMMCs.
He blames the eMMC cards supplier, but actually I'm afraid he damaged the motherboard during his attempts, although he has a very good reputation and experience handling this task.
The unfortunate is that other labs don't accept to touch the device in its current state, after someone else started the work.
He advised me to wait so he will try again, and there is nothing I can do about, since I don't have any special equipment.
It seems that instead of paying 50$ for a fix, I will have to move on to a new device, which means paying about 500$.
All I can hope is to be able to recover data from the detached eMMC card, while the guy will have the adapter.

MeiR_ct said:
Frustration goes on!
It turned out that the lab still doesn't have mentioned eMMC to USB adapter, and it's on the way from a worldwide shipping.
The guy from the lab managed to detach the corrupted eMMC, but so far he didn't manage to revive the device after several attempts with new eMMCs.
He blames the eMMC cards supplier, but actually I'm afraid he damaged the motherboard during his attempts, although he has a very good reputation and experience handling this task.
The unfortunate is that other labs don't accept to touch the device in its current state, after someone else started the work.
He advised me to wait so he will try again, and there is nothing I can do about, since I don't have any special equipment.
It seems that instead of paying 50$ for a fix, I will have to move on to a new device, which means paying about 500$.
All I can hope is to be able to recover data from the detached eMMC card, while the guy will have the adapter.
Click to expand...
Click to collapse
Hi MeiR_ct
Could this guy recover your data? please tell us how your story ended. I have a similar story.
br

ab1009 said:
Hi MeiR_ct
Could this guy recover your data? please tell us how your story ended. I have a similar story.
br
Click to expand...
Click to collapse
Hi ab1009, and sorry for the very late reply (noticed it just today).
In case it's still relevant for someone:
Unfortunately, the attempts to recover the eMMC card have failed.
I moved on to Galaxy Note 4 on that time, and later to Galaxy Note 8.
(Clearly proves that I'm an addicted and proud fan of Samsung Galaxy Note series )

There was a project for the Galaxy S3 which resulted in several repaired Phones. There are some attempts to port this approach to the Note 2, see: https://github.com/oranav/i9300_emmc_toolbox/issues/7

Related

UART Pinout

I finally found some time to inspect the NST board for a spare UART and the search was successful!
The serial port can be accessed on U2713, pin 2 is RX, pin 3 is TX, device node is /dev/ttyS1.
I use it with a 3.3V USB-to-UART adapter, but any voltage between 1.2 and 3.6 should be fine, thanks to the TI voltage-level translator TXB0104.
There is also a second uart connected to J151 (ttyS0), but that one has no voltage-level-translator and runs with 2V. (TX is on pin 9 of J151, no idea where RX is).
I'm still trying to redirect the boot console to ttyS1, i think i have to recompile uboot.
/edit:
Patching u-boot worked, I have the boot console on ttyS1.
Good job!
I wanted to look for this sometime, but you beat me to it.
ttyS0 is for the (cell phone) radio
ttyS1 is for the Bluetooth.
Could the connector place there be for JTAG?
Renate NST said:
Good job!
I wanted to look for this sometime, but you beat me to it.
Click to expand...
Click to collapse
I wanted to do this since my last failed kernel porting attempt. I hope it helps me debugging non succesfully booting configurations.
ttyS0 is for the (cell phone) radio
ttyS1 is for the Bluetooth.
Click to expand...
Click to collapse
Is that an actual android standard, or just some leftovers from the reference platform the nst and nook color are based on (the remains in the init.rc)?
Could the connector place there be for JTAG?
Click to expand...
Click to collapse
I think the JTAG is more probably on J151 together with ttyS0, than on U2713.
ttyS0 was the standard console, and it would make more sense that the J151 was used as debug-port.
mali100 said:
The serial port can be accessed on U2713, pin 2 is RX, pin 3 is TX, device node is /dev/ttyS1.
I use it with a 3.3V USB-to-UART adapter, but any voltage between 1.2 and 3.6 should be fine, thanks to the TI voltage-level translator TXB0104.
Click to expand...
Click to collapse
Mali,
My USB-to-UART adapter needs 3.3V (to set “upper voltage” level)
Could you help, where can I get in on Nook board?
Renate NST said:
ttyS0 is for the (cell phone) radio
ttyS1 is for the Bluetooth.
Click to expand...
Click to collapse
Do you know any devices that can be connected to this ports? It would be great to enable only Bluetooth or even cell phone.
ApokrifX said:
Mali,
My USB-to-UART adapter needs 3.3V (to set “upper voltage” level)
Could you help, where can I get in on Nook board?
Click to expand...
Click to collapse
You can use pin 1 of U2713, it's connected to VCCb on the TXB0104. Altough the voltage is disabled when the nook sleeps, but that shouldn't be a problem.
mali100 said:
You can use pin 1 of U2713, it's connected to VCCb on the TXB0104. Altough the voltage is disabled when the nook sleeps, but that shouldn't be a problem.
Click to expand...
Click to collapse
Ok... But it's gotta be 3.3V somewhere, right?
ApokrifX said:
Ok... But it's gotta be 3.3V somewhere, right?
Click to expand...
Click to collapse
Quick! Break the laws of physics and pull power from a penny!
I haven't had a driving need to use this until I tried an upgrade to 1.2 and got a boot loop.
There are various versions of u-boot.bin.
The easiest way to patch it is to simply search for ttyS0 and replace the two occurrences with ttyS1.
ttyS0 appears also in env.txt inside uRamdisk (and uRecRam).
I found a old fax that has the 10 pin connector that fits on the Nook.
I might try to put it on. For now I have the soldered wires.
In any case, the 1.2 boot loops and the last message is:
Code:
binder: 988:1039 transaction failed 29189
I've screwed with a lot of things on my Nook, but the "update" should have wiped about everything.
Just a short update:
I soldered in the connector successfully. It looks nice.
The level converter to standard 9 pin "RS-232" is simple and cheesy, 2 resistors and a transistor.
It works fine though. I can see the boot up.
After that I can switch to logcat over ADB over USB.
Here's a really poor photo of my setup.
My next cell phone must have auto-focus and macro mode.
Excellent setup, especially for the ribbon cable! It seems something nice its going to happen in the next days
Just a bit of an update.
If you want to do your own level shifting you've got access to two UARTs.
The MSP stuff is I2C to the MSP430 microprocessor that handles the touch screen.
You could eavesdrop on that and have a little multitouch pad.
I'm still trying to see which of the rest of the pins are for JTAG on U151.
The other 4 pins on U2713 are 3.3 level but don't come from the TXB0104 level shifter.
The JTAG stuff is apparently on the 22 pin, 0.5 mm pitch CON6.
The four side buttons are on CON6 too.
I've looked at this a bit and I've determined that using UART2 is a dead end.
The TXB0104 is neither powered nor enabled until late in the boot sequence.
Using the default UART1 is a much better choice.
Yes, you could modify things to use UART2 over UART1 but it's an uphill battle.
u-boot has a nice command interface where you can do lots of stuff (edited a bit):
Code:
Texas Instruments X-Loader 1.41 (Dec 7 2012 - 14:34:26)
Starting OS Bootloader from EMMC ...
U-Boot 1.1.4-carbon1.2_1.2.1.24^{} (Dec 7 2012 - 14:34:22)
OMAP3630-GP rev 2, CPU-OPP2 L3-165MHz
OMAP3621-Gossamer 1.2 Version + mDDR (Boot NAND)
DRAM: 256 MB
In: serial
Out: serial
Err: serial
Hardware arch: GOSSAMER rev: EVT3
Power button is not pressed
pmic watchdog time 0
Power Button Active
gossamer charger init
Booting from eMMC
OMAP36XX GOSSAMER # help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
battery - gas gauge BQ27520 info
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
calc - perform mathematical operation
charger - charger BQ24073 info
clock - Manage system clocks
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
date - get/set/reset date & time
echo - echo args to console
epd tests dspon dspoff image1 image2
exit - exit script
fastboot- use USB Fastboot protocol
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatsave - save binary file to a dos filesystem
ggflash - flash bq27500 from .dffs script
go - start application at address 'addr'
gpio - set/display gpio pins
help - print online help
ibatck - used to track battery id
ibus - Select i2c Bus
icrc32 - checksum calculation
iloop - infinite loop on address range
imd - i2c memory display
iminfo - print header information for application image
imm - i2c memory modify (auto-incrementing)
imw - memory write (fill)
inm - memory modify (constant address)
iprobe - probe to discover valid I2C chip addresses
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mmcinit - initialize mmc
mmc - Read/write/Erase mmc
mspflash- used to flash a new msp430 firmware file
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
setenvmem - set environment variable from memory
sleep - delay execution for some time
test - minimal test like /bin/sh
version - print monitor version
OMAP36XX GOSSAMER #
Just adding the battery pinout to the diagram for completeness.
Excellent! I recently bought a JTAG (http://www.ebay.co.uk/itm/Altera-FP...al_Components_Supplies_ET&hash=item257fc5c582)
I will give it a go... is there anything you'd like me to do?
Cheers
Heres a quick hack to talk to uboot over UART2
Edit: all that's different is enabling the TXB0104 by setting gpio 37 high instead of low.
and redefining the uarts so 2 is used instead of 1.
includes the OP's patch so kernel logs show after boot also.
this second version fixes autoboot. UART2 gets a spurious byte which needs to be cleared otherwise autoboot never works.
This patch is meant to be applied without the first one, i put the uart numbers back to normal and just changed the index of which gets used for console.
I also enabled ^C checking for the case where bootdelay is zero, you can't lock yourself out of u-boot by messing with the env variables. ( Guess why I decided to do this?
NB: There is a third uart, uart3. one of the sets of pins it can be muxed onto are the usbhs0_data0 and 1 pins.
these go to the tps65921, which also has a uart mode , whereby we could have uart access over the usb pins without cracking the case.
droid phones had something similar, called emu-uart. i will look into this more when i get a nook with a working usb port.

[Q] Yet another -potentially- USB Bricked Desire

Hi there,
First of all: thanks for all the good threads and all in this forum, I learned a lot about my phone. Unfortunately not enough to fix it myself
The problem's symptoms are:
- no SD Card access (neither through different recoveries nor android itself)
- in Recovery, I get "No such file or directory" errors on /dev/block/mmcpblk0p1
- no SIM Card detected
-> both cards work flawlessly in other mobiles/computers
I'm not sure if that's a typical USB Brick, since I tried the usual (see below).
The phone:
HTC Desire, rooted with unrevoked3, S-OFF with alpharev, H-BOOT-6.93.1002 (downloaded from alpharev.nl)
currently: RMD Recovery v.1.0.3.4, ROM 2.12.110.4
The CID (in case this is needed, I didn't really understand the role of that ID for that particular problem)
(bootloader) Device CID is super CID
(bootloader) CID is super CID
(bootloader) Backup CID is T-MOB101
(bootloader) setting->cid::T-MOB101
My (unsuccessfull) attempts:
0. manually restoring my NANDbackup (userdata, system, boot, cache) via fastboot
1. enableqxdm 0/eraseconfig method via fastboot:
commands were executed successfully, but no change in behaviour
2a. flashing MISC partition via fastboot
2b. flashing MISC partition via /data/flash_image method
3. using USB fix in RMD
4. flashing different recoverys (AmonRA, RMD, CWM)
5. Flashing to the current Rom using RUU
I had the SIM Card problem before. Back then, I could solve it by restoring my NANDbackup from SD Card in AmonRA because I didn't have the SD Card access problem. So it might be actually two different problems. Or only one. I simply don't know
I really hope you can help me out on this one, don't want to buy a new phone and usually, there's always a way to unbrick
Max
doofbirne said:
Hi there,
First of all: thanks for all the good threads and all in this forum, I learned a lot about my phone. Unfortunately not enough to fix it myself
The problem's symptoms are:
- no SD Card access (neither through different recoveries nor android itself)
- in Recovery, I get "No such file or directory" errors on /dev/block/mmcpblk0p1
- no SIM Card detected
-> both cards work flawlessly in other mobiles/computers
I'm not sure if that's a typical USB Brick, since I tried the usual (see below).
The phone:
HTC Desire, rooted with unrevoked3, S-OFF with alpharev, H-BOOT-6.93.1002 (downloaded from alpharev.nl)
currently: RMD Recovery v.1.0.3.4, ROM 2.12.110.4
The CID (in case this is needed, I didn't really understand the role of that ID for that particular problem)
(bootloader) Device CID is super CID
(bootloader) CID is super CID
(bootloader) Backup CID is T-MOB101
(bootloader) setting->cid::T-MOB101
My (unsuccessfull) attempts:
0. manually restoring my NANDbackup (userdata, system, boot, cache) via fastboot
1. enableqxdm 0/eraseconfig method via fastboot:
commands were executed successfully, but no change in behaviour
2a. flashing MISC partition via fastboot
2b. flashing MISC partition via /data/flash_image method
3. using USB fix in RMD
4. flashing different recoverys (AmonRA, RMD, CWM)
5. Flashing to the current Rom using RUU
I had the SIM Card problem before. Back then, I could solve it by restoring my NANDbackup from SD Card in AmonRA because I didn't have the SD Card access problem. So it might be actually two different problems. Or only one. I simply don't know
I really hope you can help me out on this one, don't want to buy a new phone and usually, there's always a way to unbrick
Max
Click to expand...
Click to collapse
Flash 4ext touch recovery......boot in recovery, go to tools, select USB unbrick.....voila...
Done.
Regards
Sent from outer space using RF transmitters
Thanks for your quick answer. I flashed 4ext Touch v 1.0.0.5. Upon start, it said "can't mount sd-card, try Tools->usb unbrick" and something about entering Safe-Mode. I tried the unbrick routine and it said:
Your CID: T-MOB101
Patching misc image...
Your misc partition size: 1024kb
Writing mtd0..
Done.. please reboot!
Did that (actually several times), but it didn't help :/
Edit: I checked with my WinXP VM, USB is definitely working through HTCSync. I'm even more confused (and desperate).
What drivers do you have installed?
Did you try uninstall HTC sync and keep drivers
or try unrevoked usb modified drivers
then try fastboot oem enableqxdm 0
On my Windows XP VM, I installed version 2.0.7.8 of the driver which is shipped with HTCsync and on my Linux machine, I'm running the Android SDK w/ platform-tools.
The more and more I try and read, I start thinking it might actually be a hardware problem :/
Edit: Thanks, kotag82, gonna try that!
Edit2: Ok, tried it, with no luck. I uninstalled HTCSync as suggested, fiddled around with the modified drivers but it still won't access the SD card.
Does anybody have another idea? I saw, that my bootloader says something along the lines of "SHIP S-OFF". That hasn't always been there - at least I can't remember reading that before. Is it necessary to have ENG S-OFF for the usb brick fix to work? In that case, I should get error messages while executing fastboot commands, shouldn't I?
Mh Ok, I just found out it is definitely not a problem with the MISC partition. I read it by executing 'cat /dev/mtd/mtd0 > /data/mtd0.partition' and comparing that bytewise to a functional mtd0.img (created with the webtool from wistinga [can't post links yet]) . It is exactly the same.
Did anybody come accross that?
Edit: And yet another very(!) strange thing. When running dmesg on an adb shell, it displays this in the beginning:
Linux version 2.6.37.6-cyanogenmod-g2ac83ea-dirty
I had cyanogen installed before, but reflashed with RUU. How the h*** is that even possible? Does the RUU keep the kernel untouched? That would explain a lot.
How did you manage that? Going completely to stock will not help?
Sent from my Sensation XE with Beats Audio Z715e
Turned out to be my mistake. Running dmesg via adb when in Recovery mode (4Ext) and in booted android returns different kernel versions (strange?)
I googled a little and continued checking my dmesg output (after changing the ROM to cyanogen again), this is the output of dmesg |grep mmc1:
<6>[ 9.167144] mmc1: Qualcomm MSM SDCC at 0x00000000a0400000 irq 26,0 dma 8
<6>[ 9.172698] mmc1: Platform slot type: N/A
<6>[ 9.176727] mmc1: 4 bit data mode enabled
<6>[ 9.180725] mmc1: 8 bit data mode disabled
<6>[ 9.184814] mmc1: MMC clock 144000 -> 50000000 Hz, PCLK 64000000 Hz
<6>[ 9.190948] mmc1: Slot eject status = 0
<6>[ 9.194824] mmc1: Power save feature enable = 1
<6>[ 9.202545] mmc1: DM non-cached buffer at ffa05000, dma_addr 0x3b2b0000
<6>[ 9.205871] mmc1: DM cmd busaddr 0x3b2b0000, cmdptr busaddr 0x3b2b0300
<3>[ 9.710784] mmc1: Data timeout
<3>[ 9.930694] mmc1: Data timeout
<3>[ 10.150756] mmc1: Data timeout
<3>[ 10.371002] mmc1: Data timeout
<3>[ 10.601135] mmc1: Data timeout
<3>[ 10.601348] mmc1: mmc_sd_init_card() failure (err = -110)
<3>[ 10.601806] mmc1: error -110 whilst initialising SD card
Click to expand...
Click to collapse
The mmc controller doesn't seem to be bricked, then it shouldn't recognise the device at all. Any ideas?
Mh, too bad, I totally ran out of ideas and if you guys can't help, probably noone can
So I'm resetting it to stock (which is a pain in the a** as far as I heard, because it is a T-Mobile branded phone and they don't have Froyo RUUs and I have a sLCD....) and bringing it to the vendor. Any things that I really have to do besides trying not to run into a sLCD brick? My motivation of running into even more trouble is kinda low.
Thanks for your help guys/girls!
http://www.google.ie/url?sa=t&sourc...koXLAw&usg=AFQjCNE6y7kx-Agh29QKseeCftdUz2wIQQ
Sent from my HTC Desire
doofbirne said:
Mh, too bad, I totally ran out of ideas and if you guys can't help, probably noone can
So I'm resetting it to stock (which is a pain in the a** as far as I heard, because it is a T-Mobile branded phone and they don't have Froyo RUUs and I have a sLCD....) and bringing it to the vendor. Any things that I really have to do besides trying not to run into a sLCD brick? My motivation of running into even more trouble is kinda low.
Thanks for your help guys/girls!
Click to expand...
Click to collapse
Dont return to stock, it dont fix it like stated above, i know coz i tried myself lol
Sent from my HTC Desire
thanks
thanks for the latest hints. unfortunately, the method you posted the link to doesn't work either.
i wanted to return it to stock, so i can have my vendor (i'm still in the warranty period [i hope]) replace it because i think (thought) it was a hardware error.
that was my original plan at least, now i noticed: hboot kind of recognises the sd card. when it's physically plugged out, it doesn't look for PB99IMG.zip but it does, when it's plugged in. but it doesn't find this file, even though i've put one there :/
now i'm trying to debug, what hboot is doing which is kinda hard without an adb shell.
is there any way to run something like dmesg while in hboot mode? that'd probably be a question for the dev board i guess
mh okay, I don't seem to be able to give up (might be stupid)
But I think I found out, why the misc flash doesn't work. Here a little log output containing my cid:
Code:
<5>[ 0.000000] Kernel command line:
board_bravo.disable_uart3=0
board_bravo.usb_h2w_sw=0
board_bravo.disable_sdcard=0
diag.enabled=0
board_bravo.debug_uart=0
smisize=0
userdata_sel=0
androidboot.emmc=false
androidboot.baseband=5.17.05.23
[B]androidboot.cid=T-MOB101���� [/B]
androidboot.carrier=COMMON
androidboot.mid=PB9920000
androidboot.keycaps=qwerty
androidboot.mode=normal
androidboot.serialno=*********
androidboot.bootloader=6.93.1002
no_console_suspend=1
msmsdcc_sdioirq=1
wire.search_count=5
those weird question marks also appear, when I run 'fastboot oem boot'. So I guess the location where my CID is stored is kinda messed up. Is there any chance to repair that? As far as I understood, the misc flashing method needs to have the correct cid, while ROM number doesn't really matter. But if the CID in the phone is broken, I won't be able to flash a correct misc image, am I right?
Edit: also, what does "androidboot.carrier=COMMON" mean? When I googled it, I had a lot of hits concerning USB bricks but no info, if that's actually linked somehow. Is it? Or is it just because everyone is posting their logs when running into a brick?
WTF? My SD-Card is working again. All I did was removing it with the battery in (which is almost physically impossible) and now it's working. I can't believe it!
My sim card is still not detected though. But it's a step! Although I do not recommend my procedure as a workaround
Any ideas on the SIM problem?
maybe try another sim card and see if that works then u will know if its ur sim card r phone thats the problem
Sent from my HTC Desire
thanks for your hint, I tried that already with 3 different sim cards (which work in my other phone). Reflashing the radio back to the old version didn't help as well :/ But I'm not giving up! And I'm glad about every single hint
thanks a lot!
does ur phone boot now? maybe try a factory reset then power off ur phone, take out battery and sim card for bout a min the put them back in and reboot and see if that works.
Sent from my HTC Desire
My phone always booted It just didn't manage to give me signal or sd card access.
BUT: It's working now! Please don't ask what I did. Basically going to a shop, getting a prepaid T-Mobile card (I thought maybe the simlock was somehow (re)activated) did the trick. And it works now with every SIM card. I have no, like absolutely NO idea, why. First I "fix" my SD card problem by pulling it the hard way, then I "fix" my SIM card problem by plugging in another one while 3 didn't work? I don't get it. Anyway, thanks to all for the help!
lol as long as it works thats the main thing.
Sent from my HTC Desire

[Q] "Cannot connect to camera" in all AOSP based aftermarket ROMs

I finally got the chance to purchase a Galaxy S III yesterday and so far it's proving to be a gorgeous device. Not being a huge fan of TouchWiz, I decided to go the CM route, and decided to be brave and use the 10.1 nightlies. Everything works except the camera, which upon being started, displays "Camera error: Cannot connect to camera" and the app exits.
This is not just a bug with CM Nightly. (Otherwise I wouldn't be asking for support.) This symptom has been observed with the following ROMs:
CyanogenMod 10.1 nightly (2013-01-16) - flashed via CWM and TWRP
CyanogenMod 10.0 stable - flashed via TWRP
LiquidSmooth JB v2.1 beta 2 (based on 4.2.1) - flashed via CWM
It appears that only one other person has had this issue with d2tmo. My device is brand new, as in purchased 18 hours ago new. Date on the box is December 31, 2012. It's a 16GB Titanium Grey T-Mobile model, if that is of any relevance.
I have not yet encountered any AOSP based ROM in which the camera works. I have already attempted the following troubleshooting steps, with no luck:
Wipe dalvik cache/cache partition
Fix permissions (via the option in both TWRP and CWM)
Manually shelling in and chmodding /dev/video* to 0666. They were owned previously by root/camera with mode 0660.
I did an adb logcat and found the Java traceback where the camera open fails:
Code:
I/ActivityManager( 643): Displayed com.android.gallery3d/com.android.camera.CameraLauncher: +390ms
D/dalvikvm( 4160): GC_CONCURRENT freed 1410K, 6% free 18148K/19252K, paused 3ms+4ms, total 32ms
D/dalvikvm( 4160): WAIT_FOR_CONCURRENT_GC blocked 17ms
D/qdoverlay( 237): Unset pipe=RGB1 dpy=0;
E/Sensors ( 643): accelHandler 3.133883 2.830913 8.935818
D/qdoverlay( 237): Set pipe=RGB1 dpy=0;
E/mm-camera( 240): mm_camera_open: ctrl_fd = -1
E/mm-camera( 240): Errno:5
E/MP-Decision( 1326): DOWN Ld:34 Ns:1.100000 Ts:190 rq:0.100000 seq:196.000000
E/mm-camera( 240): mm_camera_open: ctrl_fd = -1
E/mm-camera( 240): Errno:5
E/mm-camera( 240): mm_camera_open: opened, break out while loop
E/mm-camera( 240): mm_camera_open: after while loop
E/QCameraHWI( 240): startCamera: cam_ops_open failed: id = 0
W/QualcommCamera2( 240): int android::camera_device_open(const hw_module_t*, char const*, hw_device_t**): end
E/CameraClient( 240): Could not open camera 0: -1
E/CameraClient( 240): initialize: Camera 0: unable to initialize device: Operation not permitted (-1)
I/CameraClient( 240): Destroying camera 0
E/CameraHolder( 4160): fail to connect Camera
E/CameraHolder( 4160): java.lang.RuntimeException: Fail to connect to camera service
E/CameraHolder( 4160): at android.hardware.Camera.native_setup(Native Method)
E/CameraHolder( 4160): at android.hardware.Camera.<init>(Camera.java:340)
E/CameraHolder( 4160): at android.hardware.Camera.open(Camera.java:302)
E/CameraHolder( 4160): at com.android.camera.CameraManager.cameraOpen(CameraManager.java:283)
E/CameraHolder( 4160): at com.android.camera.CameraHolder.open(CameraHolder.java:210)
E/CameraHolder( 4160): at com.android.camera.Util.openCamera(Util.java:358)
E/CameraHolder( 4160): at com.android.camera.PhotoModule$CameraStartUpThread.run(PhotoModule.java:327)
D/qdoverlay( 237): Unset pipe=RGB1 dpy=0;
So my theory is a permissions issue. I poked around for anything in /dev that was owned by the "camera" group and chmodded it to 0666, just to temporarily see if it'd work... no dice.
I'm certainly no Linux noob, though I don't hack on android much and I don't know all the terrible things they've done to the kernel, but if anyone has more advanced troubleshooting suggestions, throw 'em at me.
Any help would be much appreciated. Thanks!
Seen it happen to my wife's S2 running CM10 stable.. but I simply clicked the camera icon again, and it connected. Never had an issue again.. weird.
*bump*
I found that starting the camera produces some rather extensive dmesg output:
Code:
<3>[ 1072.801739] store_afe_cal: offset 1089687720 is > mem_len 344064
<6>[ 1072.821150] msm_pcm_routing_process_audio: reg 0 val 0 set 1
<6>[ 1072.821364] msm8960_i2s_startup
<6>[ 1072.826399] msm8660_i2s_hw_params Codec Clock 0xc0c372bc ; Rx Bit Clock c0c37228
<6>[ 1072.826399] tabla_hw_params: DAI-ID 1 rate : 48000
<6>[ 1072.826430] msm_pcm_routing_hw_params : channel = 2
<6>[ 1072.831313] msm_pcm_routing_prepare : be_id = 0
<6>[ 1072.842606] afe_q6_interface_prepare:
<6>[ 1072.854387] msm8960_enable_codec_ext_clk: enable = 1
<6>[ 1072.908866] msm_dai_q6_trigger:port:0 cmd:1 dai_data->status_mask = 0
<6>[ 1072.908866] afe_send_cal
<6>[ 1072.927636] mdp_bus_scale_update_request: handle=-460495872 index=2 ab=1610612736 ib=1744830464
<4>[ 1072.942804] CPU1: Booted secondary processor
<7>[ 1072.947138] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1072.947138] [s5c73m3] rear camera on 1
<7>[ 1072.947169] [s5c73m3] check GPIO_CAM_FLASH_SW : 1
<7>[ 1072.951747] [s5c73m3] check vddCore : 1150000
<6>[ 1072.952906] CAM_ISP_CORE voltage is enabled to 1150 mV by selector value [38]
<7>[ 1072.954158] [s5c73m3] check GPIO_CAM_A_EN : 1
<7>[ 1072.956111] [s5c73m3] check GPIO_CAM_SENSOR_EN : 1
<7>[ 1072.958461] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1072.958461] [s5c73m3] rear camera on 2
<7>[ 1072.958492] [s5c73m3] check CAM_AF_EN : 1
<6>[ 1072.960475] mdp_bus_scale_update_request: handle=-460495872 index=1 ab=805306368 ib=872415232
<7>[ 1072.962276] [s5c73m3] check CAM_MIPI_EN : 1
<7>[ 1072.964382] [s5c73m3] check ISP_RESET : 1
<6>[ 1072.981565] TIMERIRQ_START : period=200
<6>[ 1072.981657] Sensors set: 70
<6>[ 1072.984526] <6>MPL-accmpu6050_set_odr:199
<6>[ 1072.984648] <6>MPL-accODR : 5000 (199)mHz
<3>[ 1073.006622] [s5c73m3_sensor_init:3410] Entered
<3>[ 1073.010285] [s5c73m3_sensor_init_probe:3358] Entered
<3>[ 1073.022188] [s5c73m3_check_fw:3124] Enter
<3>[ 1073.064428] [s5c73m3_get_sensor_fw_version : 2768] sensor_fw = ZHFJ02
<3>[ 1073.070318] [s5c73m3_get_phone_fw_version:2844] Entered
<3>[ 1073.086586] [s5c73m3_get_phone_fw_version:2957] can't open ZHFJ02. download from F-ROM
<3>[ 1073.095131] [s5c73m3_reset_module:424] E
<7>[ 1073.098550] [cam_ldo_power_off : 1987] REAR CAMERA POWER OFF!!
<7>[ 1073.115122] [s5c73m3] check GPIO_CAM_FLASH_SW : 0
<7>[ 1073.116740] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1073.116740] [s5c73m3] rear camera on 1
<7>[ 1073.116770] [s5c73m3] check GPIO_CAM_FLASH_SW : 1
<7>[ 1073.119304] [s5c73m3] check vddCore : 1150000
<6>[ 1073.133373] CAM_ISP_CORE voltage is enabled to 1150 mV by selector value [38]
<7>[ 1073.135937] [s5c73m3] check GPIO_CAM_A_EN : 1
<7>[ 1073.137890] [s5c73m3] check GPIO_CAM_SENSOR_EN : 1
<7>[ 1073.141431] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1073.141461] [s5c73m3] rear camera on 2
<7>[ 1073.141461] [s5c73m3] check CAM_AF_EN : 1
<7>[ 1073.148084] [s5c73m3] check CAM_MIPI_EN : 1
<7>[ 1073.152937] [s5c73m3] check ISP_RESET : 1
<3>[ 1073.155562] [s5c73m3_reset_module:441] X
<3>[ 1073.170028] [s5c73m3_get_sensor_fw_binary:2453] Entered
<6>[ 1073.308438] mdp_bus_scale_update_request: handle=-460495872 index=2 ab=1543503872 ib=1677721600
<3>[ 1073.583732] [s5c73m3_get_sensor_fw_binary:2549] sent SPI ready CMD
<3>[ 1074.108438] [s5c73m3_get_sensor_fw_binary:2578] made CSC value by S/W = 0x563c77e
<3>[ 1074.115153] [s5c73m3_get_sensor_fw_binary:2584] Original CRC Int = 0x563c77e
<3>[ 1074.126018] [s5c73m3_get_sensor_fw_binary : 2593] failed to open /data/SlimISP_ZH.bin, err -13
<3>[ 1074.133831] [s5c73m3_get_sensor_fw_binary:2622] Exit
<3>[ 1074.138776] [s5c73m3_get_phone_fw_version : 2962] i2c failed, err -22
<3>[ 1074.146406] [s5c73m3_check_fw : 3137] failed s5c73m3_get_phone_fw_version!!
<3>[ 1074.152601] [s5c73m3_sensor_init_probe : 3376] failed s5c73m3_check_fw!!
<3>[ 1074.159957] [s5c73m3_sensor_init : 3428] s5c73m3_sensor_init failed!
<3>[ 1074.165786] msm_mctl_open_init: isp init failed: -5
<7>[ 1074.178147] [cam_ldo_power_off : 1987] REAR CAMERA POWER OFF!!
<7>[ 1074.188615] [s5c73m3] check GPIO_CAM_FLASH_SW : 0
<3>[ 1074.189714] msm_open_init: HW open failed rc = 0xfffffffb
<7>[ 1074.214527] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1074.214527] [s5c73m3] rear camera on 1
<7>[ 1074.214558] [s5c73m3] check GPIO_CAM_FLASH_SW : 1
<7>[ 1074.216602] [s5c73m3] check vddCore : 1150000
<6>[ 1074.217854] CAM_ISP_CORE voltage is enabled to 1150 mV by selector value [38]
<7>[ 1074.219105] [s5c73m3] check GPIO_CAM_A_EN : 1
<7>[ 1074.220143] [s5c73m3] check GPIO_CAM_SENSOR_EN : 1
<7>[ 1074.222218] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1074.222249] [s5c73m3] rear camera on 2
<7>[ 1074.222249] [s5c73m3] check CAM_AF_EN : 1
<7>[ 1074.225759] [s5c73m3] check CAM_MIPI_EN : 1
<7>[ 1074.227803] [s5c73m3] check ISP_RESET : 1
<3>[ 1074.255546] [s5c73m3_sensor_init:3410] Entered
<3>[ 1074.259026] [s5c73m3_sensor_init_probe:3358] Entered
<3>[ 1074.272729] [s5c73m3_check_fw:3124] Enter
<3>[ 1074.284877] [s5c73m3_get_sensor_fw_version : 2768] sensor_fw = ZHFJ02
<3>[ 1074.291255] [s5c73m3_get_phone_fw_version:2844] Entered
<3>[ 1074.295742] [s5c73m3_get_phone_fw_version:2957] can't open ZHFJ02. download from F-ROM
<3>[ 1074.303647] [s5c73m3_reset_module:424] E
<7>[ 1074.307462] [cam_ldo_power_off : 1987] REAR CAMERA POWER OFF!!
<7>[ 1074.317442] [s5c73m3] check GPIO_CAM_FLASH_SW : 0
<7>[ 1074.318479] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1074.318510] [s5c73m3] rear camera on 1
<7>[ 1074.318510] [s5c73m3] check GPIO_CAM_FLASH_SW : 1
<7>[ 1074.320921] [s5c73m3] check vddCore : 1150000
<6>[ 1074.322050] CAM_ISP_CORE voltage is enabled to 1150 mV by selector value [38]
<7>[ 1074.323271] [s5c73m3] check GPIO_CAM_A_EN : 1
<7>[ 1074.324309] [s5c73m3] check GPIO_CAM_SENSOR_EN : 1
<7>[ 1074.325347] [cam_ldo_power_on : 1816] REAR CAMERA POWER ON!!
<7>[ 1074.325377] [s5c73m3] rear camera on 2
<7>[ 1074.325377] [s5c73m3] check CAM_AF_EN : 1
<7>[ 1074.328856] [s5c73m3] check CAM_MIPI_EN : 1
<7>[ 1074.330932] [s5c73m3] check ISP_RESET : 1
<3>[ 1074.333373] [s5c73m3_reset_module:441] X
<3>[ 1074.336303] [s5c73m3_get_sensor_fw_binary:2453] Entered
<3>[ 1074.759072] [s5c73m3_get_sensor_fw_binary:2549] sent SPI ready CMD
<3>[ 1075.295376] [s5c73m3_get_sensor_fw_binary:2578] made CSC value by S/W = 0x563c77e
<3>[ 1075.302121] [s5c73m3_get_sensor_fw_binary:2584] Original CRC Int = 0x563c77e
<3>[ 1075.309018] [s5c73m3_get_sensor_fw_binary : 2593] failed to open /data/SlimISP_ZH.bin, err -13
<3>[ 1075.317808] [s5c73m3_get_sensor_fw_binary:2622] Exit
<3>[ 1075.322752] [s5c73m3_get_phone_fw_version : 2962] i2c failed, err -22
<3>[ 1075.329314] [s5c73m3_check_fw : 3137] failed s5c73m3_get_phone_fw_version!!
<3>[ 1075.336273] [s5c73m3_sensor_init_probe : 3376] failed s5c73m3_check_fw!!
<3>[ 1075.343384] [s5c73m3_sensor_init : 3428] s5c73m3_sensor_init failed!
<3>[ 1075.349427] msm_mctl_open_init: isp init failed: -5
<7>[ 1075.362185] [cam_ldo_power_off : 1987] REAR CAMERA POWER OFF!!
<7>[ 1075.373355] [s5c73m3] check GPIO_CAM_FLASH_SW : 0
<3>[ 1075.376071] msm_open_init: HW open failed rc = 0xfffffffb
<6>[ 1075.591179] mdp_bus_scale_update_request: handle=-460495872 index=1 ab=805306368 ib=872415232
Per the last couple of lines, I tried copying several of the /system/cameradata/SlimISP_Z*.bin files to /data/SlimISP_ZH.bin. No luck, even the same error code (-EACCES)... and permissions are sufficient for anyone to open the file for reading.
[edit] I also verified (using Skype) that the front camera works. Some interesting information from sysfs:
Code:
[email protected]:/sys/class/camera # cat rear/rear_camtype
S5C73M3
[email protected]:/sys/class/camera # cat rear/rear_camfw ; echo
ZHFJ02 ZCFC13
[email protected]:/sys/class/camera # cat front/front_camtype ; echo
SLSI_S5K6A3YX
[email protected]:/sys/class/camera # cat front/front_camfw ; echo
S5K6A3 S5K6A3
I'm lost.
Got it!
For those who will inevitably encounter this problem later and find this thread via Google/etc.: (possibly myself included)
I restored the stock firmware, which (through some process I have yet to understand) dropped that file (SlimISP_ZH.bin) into /data/. I pulled that file out of my stock /data/ and dropped it into the same directory under CyanogenMod and - voilá! - the camera instantly began to work.
I'm unsure whether I can legally stick this file up on the web at the moment, but it should be pretty easy to obtain - try looking in the backup you took before you flashed your custom ROM or just spend half an hour backing up, flashing to stock, pulling the file down, flashing back to CM, and pushing that file to /data/ (you may need to restart adbd as root on the phone).
I spent the better part of yesterday flashing many aokp/cm10.x/miui roms only to inevitably go back on a TW based rom so that I had a working camera.
Thanks for your findings. I will try this out in a bit and will post that it hopefully worked for me too
metalfingers_ said:
dropped that file (SlimISP_ZH.bin) into /data/. I pulled that file out of my stock /data/ and dropped it into the same directory under CyanogenMod and - voilá! - the camera instantly began to work.
Click to expand...
Click to collapse
so you're saying that the stock image will contain this SlimISP_ZH.bin file in /data ? it was a little bit hard to understand from your post.
i'm going to check this out and see what i can do. it would be great if you could post that file up somewhere, so that others don't have to restore and fart around and on and on and on. maybe i'll post it somewhere when i try this.
so, you are NOT alone in this problem. i have been banging my head into this issue for days now since i bought my brand new S3 (same as you, Titanium gray, attempting to run CM10)
UPDATE: i've reloaded ICS stock rom using ODIN and now the phone won't boot. it just sits at the Samsung logo. i've tried wiping cache, dalvik cache, fixing permissions, etc. no joy.
what a ****ing day.
progress!
i think i might have things working for me! wow... what a day this was.
the SlimISP file seemed to be at issue. someone recovered a version from a stock Galaxy S III. (that file is posted here, btw)
interestingly, this person's version of the file was SlimISP_GC and not _ZH
i moved the file over to my /data directory and the camera did not work.
then this person also told me that they found the file in their /system/cameradata folder. interesting, i though... and i looked in that folder on my phone. there were about a half dozen SlimISP bin files there!
taking a bit of a shotgun approach, i just copied them ALL over to my /data directory. and while i was at it, i fixed permissions to make these files all readable, writeable, and executable. 777 perms for testing.
lo and behold, my camera suddenly worked! no reboots necessary, etc.
so, i do not know if this was the result of the SlimISP_GC.bin file, or any of the files i copied, or if permissions were also a factor. i hope to whittle it down a little and do some more testing to see exactly what's what.
for now i'm going to reboot a few times, test the camera a few times, and so forth. then once i have a solid TWRP backup image, i'll tinker with some of these files and see which one might be the keystone in this whole affair.
either way, so thankful that it's working. major props to @wimremes and especially to @badger32d for the missing file help (Badger switched his S III back to stock just to dig around since my phone wasn't liking the ODIN process for some reason today)
a slight boo and hiss to someone in #CyanogenMod on freenode who had the gall to just spew hate and profanity at people who would dare to question why a non-working camera would not be considered a key feature of a phone.
most of all, HUGE thanks to the whole CyanogenMod community for all the tireless effort that they put into porting this most awesome of roms to so many devices and to their ceaseless quest to always keep improving the whole experience for the users.
EDIT: i never did figure out why my phone wouldn't boot when i rolled it back to ICS stock via ODIN. bad cable or bad download simply perhaps? i am not sure. i have successfully used ODIN to push all sorts of things to the phone in the past.
i may tinker with it in the future some more... but for now, i'm just endlessly thrilled that this last item is working. phone feels "complete" now
For those of you still looking (including the 2 people that PMed me... sorry, I didn't notice until now):
So it turns out that noobnl, one of the maintainers for Cyanogen for the S III, goes to the same university as me, and we're both members of the same student organization. We actually sat down the other night and fast-tracked this firmware file into CyanogenMod's blobs repo. Thanks Shareef!
The blob file you're probably looking for:
I don't have the requisite 10 posts yet so I can't post outside links. It's at goo dot gl slash ANigI.
here's the link that metalfingers_ couldn't post....
goo.gl/ANigI
Same problem here - Liquid Smooth and Slim Bean
Thank you all for the information in this thread. My mother already told me I was an idiot years ago. I have tmo sg3 and now have Liquid-JB-v2.1-Beta2 running on it. I do like it, but have no camera. I had no camera under Slim Bean too. I have the files you folks have mentioned, but don't really see a data directory other than /android/data. Unfortunately at this point, I'm using Windows to connect to the phone instead of a linux box.
I guess my question is what is the most effective way to copy this file to the correct directory? I was guessing I need to go into CWM and copy through there, but I have little experience so far. I got the phone about 2 weeks ago, and couldn't stand the stock rom, but everything did work. So I went ahead and took a dive.
Thanks in advance, and if I am looking for answers that have already been posted, I missed them so please excuse me.
sgibney said:
Thank you all for the information in this thread. My mother already told me I was an idiot years ago.
Click to expand...
Click to collapse
don't worry... you're surely not an idiot. i don't know what kind of person it takes to run the Galaxy S III as stock, but i surely couldn't ever be content with that bloated, awful environment. I nearly puked when i first started mine up, and i immediately shut the phone off and couldn't wait to get home to start modding it.
sgibney said:
I have tmo sg3 and now have Liquid-JB-v2.1-Beta2 running on it. I do like it, but have no camera. I had no camera under Slim Bean too.
Click to expand...
Click to collapse
yes, the non-working camera seems to be one of the biggest problems that people have when running non-stock Android on the Galaxy S III.
sgibney said:
I have the files you folks have mentioned, but don't really see a data directory other than /android/data. Unfortunately at this point, I'm using Windows to connect to the phone instead of a linux box. I guess my question is what is the most effective way to copy this file to the correct directory?
Click to expand...
Click to collapse
ah, so i presume that you are browsing the file system either from your windows box or by using a "typical" file manager app on the phone. in either case, you are not seeing the whole picture.
here's a brief overview of a few details...
When Android devices have an SD card or microSD card present, the file system will often treat this as an /sdcard directory (that's right off the root of the whole filesystem)
even devices that do not take any removable media often still allocate a partition of their internal memory to this purpose, and thus on something like the Nexus 7 tablet you'll have an /sdcard directory even when there is no card slot
some devices, like our Galaxy S III phones, actually do both. there is an internal partition for users to access and also a microSD card slot
in that case, the root of the file system will have a /storage directory and within that there will be /sdcard0 (internal partition) and /sdcard1 (microSD card, if present)
... in ALL of these cases, when you plug your Android phone into a computer or even when you browse the device with a "typical" file manager app, all you can view are the /sdcard directories. What you need is a way to "break out" of those directories and go "deeper" into the file system (or, technically, one would really call that "higher up" in the directories) so that you can start by viewing just the root directory (simply the "/" and nothing else) and then see utterly the whole device directory tree.
To do that, most power users like to rely on better file manager apps. Two of the most popular are: Root Explorer and ES File Explorer
I think you'll find that most folk here (or at least i can say "most folk whom i know") prefer Root Explorer. Its interface is clean and it allows very fast toggling between Read-Only and Read/Write mounting. (that's also an issue that comes up, i'll explain) ES File Explorer does all the same tasks (and i think comes as part of some ROM packages i've seen) but just doesn't pop for me in the same way. ES File Explorer is totally free, however. Root Explorer used to be (and you can still surely find links to the old versions or just email me and i'll send it to you) but the current version now costs a dollar or something.
If you have full root access on your phone, you can easily use an app like one of those file managers to view the WHOLE file system, from the root directory on down. You will see that there is a /data directory (a directory named "data" just within the "/" root directory of the device) and THIS data directory is where you'll need to place those SlimISP files. If you're running a custom Android rom you should already have root access on your phone so this should work.
When people do NOT have root access of their phone, they run into problems copying/moving files in some ways. The /system directory, for example, is often mounted as Read-Only and therefore you can't push things into there. But with root-enabled file manager apps like the ones mentioned above, that's not a problem.
Your /data directory should not have any such restrictions. You should be able to move the SlimISP files into there (from your /sdcard directory or wherever they are right now) but once you do, you will have to set the permissions properly.
If you've never worked within a UNIX environment, the concept of permissions is a little different from how an O/S like Windows treats it, but it's not a totally foreign notion. Essentially, there are three kinds of permissions and three categories to which they can be applied...
Permissions: Read, Write, Execute
Categories: Owner, Group, All
... the details of all this get a little weighty for our discussion here, but suffice it to say that when you view a UNIX-based file system, it's typical to see strings of letters next to file names. Like this: rw-rw-r-x or rwxr--r-- etc etc. These are triplets of letters, representing whether the Read, Write, or Execute permission exists for people in the three categories. The letters (and hyphens, if the permission does not exist) are all mashed together in a long string.
So in our two examples in the above paragraph, in the first case (rw-rw-r-x ... maybe you can try to visualize it this way: rw- rw- r-x) the Owner of the file has Read and Write but not Execute perms. Others in the same group as the owner have these same permissions. And the "all" group has Read and Execute permissions but Write is not set. (which is a pretty odd permission set overall, hah). In the second example i posted (rwxr--r-- ... visualize it this way: rwx r-- r--) the owner has full Read/Write/Execute but others in the owner's group and also the "all" group only have Read permissions. Is that a little clear?
Overall, we don't have to get into details like that too deeply. Just know that when you copy or move the SlimISP files into your /data directory, there is a chance they will arrive with unhelpful permissions. While i myself have never narrowed down exactly which permissions are necessary to make the camera work, you can't go wrong (in this case*) by just setting them all. My SlimISP files all are set to rwxrwxrwx and the camera works for me. One day i'll drill into the file system and actually start revoking permissions and renaming files to see EXACTLY which file and what permissions worked for me. For now, just setting them all is fine.
So, hopefully that will help you out! Sorry the post was long-winded. It just seemed like you really wanted to learn.
* NOTE - While setting full permissions on a random camera driver file is fine on a phone that doesn't get used by other people, this is NOT a healthy attitude or wise course of action to ever take if, say, you're administrating a computer or running a network or something. Getting frustrated that something isn't working can be rough, but it's basically never a good idea to solve the problem by throwing up your hands and saying, "screw it... give EVERYONE and ALL PROCESSES permissions on this damn resource because I don't know why the hell it's failing."
That's a recipe for trouble and for security breaches. Can't count the number of times i've seen a firewall config with an "any any" rule thrown in there because some dumb sysadmin couldn't be bothered to actually troubleshoot why some oddball service wasn't working correctly. Heh, and i've usually seen these firewall configs when called in on post-intrusion audit jobs.
I got same problem, but found a different solution:
http://forum.xda-developers.com/showthread.php?p=37328191
Thank you Deviant
Thank you for the information. I found another Rom from ktmdave7 [ROM] JB 4.1.1 STOCK Slim 01-18-2013 (3rd Release) which I decided to try. I concur with your assessment of the device with stock software. I like this ROM, but I have no GPS now. I'd rather have no GPS than no camera, but damn if it hasn't had me looking around for a fix. At this point, what I found was says it is a stock t-mobile sgh-t999 rom T999UVDLJA_T999TMBDLJA_T999UVDLJA_HOME.tar that I will try to go back to stock and see if the GPS works. This is about the only solution I've seen replicated to some success. I do not know why I'm letting the GPS crap bother me... I will keep you folks informed.
Thank you again for taking the time to go over the steps you added. I will do what you suggest if I still have problems. I sure would like to use some more ROMs and these are so much more functional than stock Samsung/T-Mobile.
You are not the only one
I have the same exact firmware zhfj02 on my g3 and it was just purchased 3 weeks ago. No working camera on any non stock based roms. I had no GPS with all non stock roms until I went to 4.2.1 but then again no camera. Going back to stock before would never get the GPS working again. I just went back to stock again to check the cam firmware and suddenly the gps is working again. Going to try ktmdave7's rom again as it is basically stock slimmed.
So, you are not the only one. I have a shg-t999 from t-mobile and experience the same problem. I was able to take one pic using Deviant's method, but then right back to "can't connect to camera" or whatever the message was. I would have to reboot, then I could take one picture. This prompted back to stock, then discovered gps working again, now going back to ktmdave7's rom.
I've been experiencing this error for the past month.. normally it would fix itself after a reboot/clear cache, but not this time. I've messed with it countless times, wiped it, flashed different roms, nothing worked... So just now I ODIN'd back to stock...and it STILL DOESN'T WORK.. Is there any reason why using ODIN to return to stock from an AOSP rom, wouldn't fix this problem?
I attempted to go thru the steps here.. http://forum.xda-developers.com/showthread.php?t=2113526 but for some reason I'm unable to pull up that camera firmware menu though, the screen goes black then closes and "factory test" FC's every damn time.....
So at this point, I've been searching around and I can't get any of the Factory Test USSD codes to work, most fail or just FC. I can't check my firmware version and even if I knew what it was, I still wouldn't be able to flash an updated fw. What options do I have left? Is it possible to manually flash the drivers..?
I've tried both the stock JB rom and the prerooted stock JB rom and neither will pull up the menu...
civicvx94 said:
I've been experiencing this error for the past month.. normally it would fix itself after a reboot/clear cache, but not this time. I've messed with it countless times, wiped it, flashed different roms, nothing worked... So just now I ODIN'd back to stock...and it STILL DOESN'T WORK.
Click to expand...
Click to collapse
i am not familiar with whether ODIN return to stock flashing would fail to flash, say, the boot partition (and thus if you have some other kernel somehow, say) but overall that is genuinely weird.
some questions...
1. what is the exact way in which this error manifests itself? when you launch the camera app does it give you "cannot connect to camera" error or something else?
2. does EITHER camera work for you? for example, using Skype with the camera facing the user... can that camera operate properly?
overall, this may just be odd and academic. if you are running stock Galaxy S III and it looks factory-normal, etc... you could likely just go into the store where you purchased this and attempt a warranty exchange. explain that the camera worked fine until the other day, and now it's erroring.
tell them that trouble shooting forums (or even reps on the phone) informed you that this is a sign of a faulty camera lens or something else you choose to make up. let them proceed with the warranty swap.
Deviant Ollam said:
i am not familiar with whether ODIN return to stock flashing would fail to flash, say, the boot partition (and thus if you have some other kernel somehow, say) but overall that is genuinely weird.
some questions...
1. what is the exact way in which this error manifests itself? when you launch the camera app does it give you "cannot connect to camera" error or something else?
2. does EITHER camera work for you? for example, using Skype with the camera facing the user... can that camera operate properly?
overall, this may just be odd and academic. if you are running stock Galaxy S III and it looks factory-normal, etc... you could likely just go into the store where you purchased this and attempt a warranty exchange. explain that the camera worked fine until the other day, and now it's erroring.
tell them that trouble shooting forums (or even reps on the phone) informed you that this is a sign of a faulty camera lens or something else you choose to make up. let them proceed with the warranty swap.
Click to expand...
Click to collapse
Yes, if I'm on an AOSP rom and open the camera it says "cannot connect to camera" and closes.. when I'm on a stock rom it says "camera failed" and closes.
The FFC does work, but i can't access it. The only way I was able to find this out was by running a USSD code to get to the hardware test menu. The rear camera fails and closes, but the front works fine. However, in apps like Instagram for example, when I attempt to use it, it defaults to the rear camera and closes before I can switch to the FFC.
All issues are consistant no matter the rom or the firmware.. I've flashed 3 roms, 2 different stock firmwares and 1 stock rooted one today alone.. Same on each.
I'm going to try to get it replaced I guess.. It just seems crazy to me that its stuck like this.
have you tried adding the .bin files that we have added to make it work?
I am running CM10 and it worked when i dropped in the SlimISP_ZH.bin file.
Deviant Ollam said:
have you tried adding the .bin files that we have added to make it work?
I am running CM10 and it worked when i dropped in the SlimISP_ZH.bin file.
Click to expand...
Click to collapse
Yeah... I extracted those all of those files and pasted them all in /data/ and set permissions to 777.. but still nothing.
Any other ideas or should I try to get a warranty replacement?
Sent from my SGH-T999 using xda app-developers app

[FIX][EMMC] Nexus 7 2013 ⊕ bricked, dead, frozen or stuck ⊕

Quick Links
if fastboot mode is not available, try Unbricking Guide
if fastboot mode is available, do RESTOCK
In this thread I would like to consolidate information about eMMC flash memory failures and remedies.
When flash memory fails it becomes inaccessible or unwriteable with errors like the following:
Code:
sending 'bootloader' <3911 KB>...
OKAY [ 0.202s ]
writing 'bootloader'...
FAILED <remote: flash write failure>
or
E:can't mount /cache/recovery/last_install
E:can't open /cache/recovery/last_install
E:failed closing /dev/block/platform/msm_sdcc. 1/by-name/misc (I/O error)
E:failed to mount /cache (Invalid argument)
or
E:Unable to find partition size for '/boot'
E:Unable to find partition size for '/recovery'
E:Unable to find partition size for '/misc'
E:Primary block device '/dev/block/platform/msm_sdcc.1/by-name/userdata' for mount point '/data' is not present!
E:Unable to mount '/data'
E:Unable to recreate /data/media folder.
dmesg...
mmc0: error -110 whilst initialising MMC card
We observe these hardware failure symptoms:
device is totally dead
dead but flashes a few times the white LED next to USB port
dead but with active USB on PC device list
works up to fastboot stage or Google logo
may slowly boot Android sometimes
intermittently Android does not boot or work at all
#1 - eMMC unrelated
#2 - battery fault is most likely
#3 - catastrophic eMMC failure or GPT/bootloader damage, PC registers a new USB\VID_05C6&PID_9008 device, refer to QPST diagnostics below
#4 - partial eMMC failure or OS error, refer to fastboot diagnostics below
#5 - probably eMMC failure, unlocking and TWRP tests are required - post your logs
#6 - unlikely eMMC fault
Fastboot Diagnostics​
If your bricked unit still works in fastboot mode then please do the following tests:
boot the Nexus in fastboot mode (when off press power+vol.dn)
connect it to your PC
on PC run:
fastboot oem gpt-info
fastboot format cache​
You can run the fastboot app from Windows or Linux...
on Windows get RESTOCK and run it from the 'data' folder
or run it from live Linux
If you get "partition[30].size 27852783 KB" then your eMMC chip is from Kingston (very high failure rate).
If the format command freezes at any stage, then the eMMC chip is faulty and needs to be replaced.
The normal format output takes only 1 second and is:
Code:
Creating filesystem with parameters:
Size: 587202560
Block size: 4096
Blocks per group: 32768
Inodes per group: 7168
Inode size: 256
Journal blocks: 2240
Label:
Blocks: 143360
Block groups: 5
Reserved block group size: 39
Created filesystem with 11/35840 inodes and 4616/143360 blocks
erasing 'cache'...
OKAY [ 0.359s]
sending 'cache' (10984 KB)...
OKAY [ 0.359s]
writing 'cache'...
OKAY [ 0.484s]
finished. total time: 1.203s
QPST Diagnostics​
Please upload your bricked device's memory dump for investigation. Just try the unbricking guide.
download "New Qualcomm 2012.rar"
extract the "fre" folder
connect your N7 to PC and when asked for a driver point it to the above folder
download "New_Qualcomm_QPST-2.7.422.zip"
extract it and run "setup.exe"
run Start/QPST/MemoryDebugApp.exe
in Memory Debug keep clicking "Browse" until you see a new COM port
in Memory Debug click "Get Regions"
in Memory Debug select and save "CODERAM.BIN"
upload "CODERAM.BIN" here
Repair Options​
ASUS service - apparently they can now do it for free with paid shipping!
motherboard replacement - for example this one "pulled from a working unit" for $25
RIFF JTAG Box - while the box is not cheap it can be used for other devices too (v1 was $109). Optional tool.
off-circuit eMMC programming and chip replacement - it is difficult and expensive but feasible
in-circuit Service ROM flashing - after chip replacement or if eMMC is OK but with damaged partition table or bootloader
eMMC chip replacement​
do not replace it with another Kingston
search for eMMC in FBGA 153 or 169 package
you can upgrade it to a higher capacity memory
new high-performance eMMC v5.1 requires updated software, available here
Nexus 7 2013 uses 3 brands of eMMC chips: Kingston, Hynix and Toshiba.
Kingston was initially identified as unreliable in this post a few years ago:
Google Nexus 7 2013 (Asus Razor)
This is bootloader repair package for Google Nexus 7 based on QUALCOMM APQ8064 MCU. Tegra based is not supported !
- GPT is for 32GB chip, hence it's not ticked by default. DO NOT tick it if You have 16GB version
- EFS/CEFS partitions You can tick in case that nothing else works, it's not recommended to try it if You haven't made backup first. In this model, partitions layout is different from all other known Qualcomm devices, hence reading first 512MB for backup wont do any help. Do do proper backup, You have to read 2GB + size (from 0x0000 0000 0000 to 0x0000 9000 0000)
Important ! ! !
- If You have device which hangs on Google logo, and resurrection process hangs at 1%, You'll have to replace the eMMC chip first. Kingston eMMC chips used in these devices oftenly fail and become unwriteable !
Attached Files Asus_Nexus_7.rar (103.60 MB)
Click to expand...
Click to collapse
The above file is for RIFF JTAG flasher.
My Nexus 7 JTAG collection:
Asus_Nexus_7.rar
Asus_Nexus_7.txt
nexus7 jtag.jpg
RIFF Box JTAG GettingStarted.pdf
RIFF Box JTAG Manager Setup v1.56.exe
Please post your Nexus 7 2013 eMMC maker in this thread.
So far I have collected the following reports:
Code:
BRICKED Kingston Hynix Toshiba
-------------------------------------------
graphdarnell 1
fuser-invent 1
aungmyoswe 1
marc1706 1
micl9 1
consumer61 1*
bl4cKz4cK 1
patmann03 1
CWempe 1
purian23 1
NX3 1
ali1234 1
lowridincrew 1
DaWeIII 1
HTC Tytn... 1
jaybea 1
vfrvulcan 1
TechnicsKuzya 2
barbuda 1
Snoob25 1
Dazmatic 1
459below 1
amix 1
hypochondrej 1
WORKING Kingston Hynix Toshiba
-------------------------------------------
fuser-invent 1
k23m 2
yosmokinman 2
Tmzdroid 1
graphdarnell 1 2
OrBy 1
mydian 1
quickdraw86 1
micl9 1
tegodwin 1*
noahvt 1
Carrick Glen 1*
Axel85 1
NTRNSTR 1
*2015 production
To check the chip in working units use this app or dmesg:
Code:
Kingston (MMC32G)
-----------------
mmc0: new HS200 MMC card at address 0001
mmcblk0: mmc0:0001 MMC32G 28.8 GiB
Hynix (HBG4e)
-------------
mmc0: new HS200 MMC card at address 0001
mmcblk0: mmc0:0001 HBG4e 29.1 GiB
Toshiba (016G92)
----------------
mmcblk0: mmc0:0001 016G92 14.6 GiB
It is not so simple with bricked units but this device is exceptionally easy to disassemble. The chip is on the bottom of the motherboard but unlike the top, it is not covered with any shield (the purple chip).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
:good:
SD insight says mine is using a Toshiba chip:
Model 016g92, size 16gb, manufacture Apr 2013.
OrBy said:
SD insight says mine is using a Toshiba chip:
Model 016g92, size 16gb, manufacture Apr 2013.
Click to expand...
Click to collapse
The third brand - I updated our stats. Thanks a lot for your post!
Mine also says Toshiba chip that was manufactured June 2013. I purchased it in November of 2014.
mydian said:
Mine also says Toshiba chip that was manufactured June 2013. I purchased it in November of 2014.
Click to expand...
Click to collapse
Would you be able to check if dmesg log of Toshiba's chip matches model number in the app? My N7 has HBG4e in dmesg and the app.
k23m said:
Would you be able to check if dmesg log of Toshiba's chip matches model number in the app? My N7 has HBG4e in dmesg and the app.
Click to expand...
Click to collapse
Mine also has HBG4e in dsmesg and the app... Also may 2013.
I don't think this flash memory problem is mainly on Kingston equipped Nexus 7's. I previously had a device with hynix flash and it would bootloop/restart/hang at Google logo endlessly so I exchanged it for my current device (with Kingston memory ) which runs superb. Is there any way of measuring degrading flash memory over time if there is I'll do it or anything else to solve this issue.
I still have nearly 2 years warranty so am willing to be a Guinea pig.
So after nearly 2 years of daily usage my device is still running like a champ I haven't noticed any performance slowdown over time ?. The touchscreen response improved after I replaced the battery a while back I'm guessing it had something to do with the ribbon cable or the small circuit board attached to the battery ?.
Tmzdroid said:
I don't think this flash memory problem is mainly on Kingston equipped Nexus 7's. I previously had a device with hynix flash and it would bootloop/restart/hang at Google logo endlessly so I exchanged it for my current device (with Kingston memory ) which runs superb. Is there any way of measuring degrading flash memory over time if there is I'll do it or anything else to solve this issue. I still have nearly 2 years warranty so am willing to be a Guinea pig
Click to expand...
Click to collapse
I have Hynix N7 which had a bootloop but this was my fault, I think, because I disabled a service. Now it runs CM12.1 and no more OTAs.
Yes there is a way of measuring flash memory just like SMART in HDD - it was introduced in eMMC v5.0 as "Device Health Report" but our Nexus 7 is probably too old for it. I received a very detailed description of fuser-invent's bricked Nexus 7 with Kingston KE4CN5B6A chip which is eMMC v4.5, without the health report function.
Can you please check the production date of your Kingston? It is possible that only early units were affected and you have nothing to worry about. Kingston does not actually manufacture NAND flash and can use any component available for a product or just change it later.
k23m said:
I have Hynix N7 which had a bootloop but this was my fault, I think, because I disabled a service. Now it runs CM12.1 and no more OTAs.
Yes there is a way of measuring flash memory just like SMART in HDD - it was introduced in eMMC v5.0 as "Device Health Report" but our Nexus 7 is probably too old for it. I received a very detailed description of fuser-invent's bricked Nexus 7 with Kingston KE4CN5B6A chip which is eMMC v4.5, without the health report function.
Can you please check the production date of your Kingston? It is possible that only early units were affected and you have nothing to worry about. Kingston does not actually manufacture NAND flash and can use any component available for a product or just change it later.
Click to expand...
Click to collapse
It's July 2013 my previous device was pure stock 6.0.1 factory reset etc it wouldn't even turn on 50% of the time I messed about inside with the ribbon connectors and insulating tape and it improved a little. I had to wait 3 weeks for a replacement which I'm very happy with. Have a look at my previous xda posts you'll get the gist of what I'm saying.
i flashed on my nexus 7 2013 one 2012 rom, now he changed to grouper and i cannot use any rom from my 2013, how i go back to the 2013 rom ? since i have signature missmatch
Try the Nexus Root Toolkit (NRT) by wugfresh
Tmzdroid said:
It's July 2013 my previous device was pure stock 6.0.1 factory reset etc it wouldn't even turn on 50% of the time I messed about inside with the ribbon connectors and insulating tape and it improved a little. I had to wait 3 weeks for a replacement which I'm very happy with. Have a look at my previous xda posts you'll get the gist of what I'm saying.
Click to expand...
Click to collapse
I read your thread. It was a hardware fault but not of Hynix or other eMMC which, in Nexus 7 2013, fails either catastrophically or becomes unwriteable. It looks like a battery fault. The Nexus is almost 3 years old and statistically it is time for all batteries to go now.
Have a look at my second Nexus 7 2013, it was dead, unrechargeable and would not start on external power. I replaced the original 4Ah battery with 1Ah from an ancient phone. A much smaller battery was not an issue because I always use it with power supply. I have since changed it to 2x 1Ah batteries because the old 1Ah gradually started to do exactly as you describe: rebooting (a lot) also struggling to boot up while being fully recharged and constantly connected to a charger.
Here is my screenshot from SD Insight. How do I check with dmesg? When I type it in the terminal emulator I get pages and pages of stuff and am not familiar with what I'm looking at.
mydian said:
Here is my screenshot from SD Insight. How do I check with dmesg? When I type it in the terminal emulator I get pages and pages of stuff and am not familiar with what I'm looking at.
Click to expand...
Click to collapse
Please type the following in the terminal:
Code:
dmesg | grep mmc0
it will be probably - mmcblk0: mmc0:0001 016G92
Or use this open source app.
Either way do it asap after reboot because dmesg is buffered and soon overwritten.
Thank you for checking it.
k23m said:
Please type the following in the terminal:
Code:
dmesg | grep mmc0
it will be probably - mmcblk0: mmc0:0001 016G92
Or use this open source app.
Either way do it asap after reboot because dmesg is buffered and soon overwritten.
Thank you for checking it.
Click to expand...
Click to collapse
Thanks that was much easier, and you are correct with what it says.
Thank you again. I updated the front page with Toshiba info.
:good:
i have too with Kingstone 32G EMMC
so so dead Asus Nexus 7 (2013) wifi
only, connect to computer it will " Qualcomm HS-USB DQloader 9008 "....and nothing , may be dead boot or damage emmc .If anyone have a good N7 2013 device, there is a way to backup the necessary files. Here....
so please,i need that files....
thanks for reading and sorry for my english
aungmyoswe said:
so so dead Asus Nexus 7 (2013) wifi
only, connect to computer it will " Qualcomm HS-USB DQloader 9008 "....and nothing , may be dead boot or damage emmc .If anyone have a good N7 2013 device, there is a way to backup the necessary files. Here....
so please,i need that files....
thanks for reading and sorry for my english
Click to expand...
Click to collapse
Before you can use backup files, the first step is to switch from 9008 to 9006 mode. Does it work for you?
Would you be able to post the Kingstone's production date, the four digits...
:fingers-crossed:
k23m said:
Before you can use backup files, the first step is to switch from 9008 to 9006 mode. Does it work for you?
Would you be able to post the Kingstone's production date, the four digits...
:fingers-crossed:
Click to expand...
Click to collapse
Photo Here.....Kingstone emmc
aungmyoswe said:
Photo Here.....Kingstone emmc
Click to expand...
Click to collapse
Great shots, thank you, but the date code is under the sticker. If you intend to claim warranty, do not remove it.
Another user reported code 1244 meaning the end of 2012 while still working Kingstones are (so far) from the middle of 2013. It would be interesting to know if there is a pattern here - maybe a bad batch from 2012 only?

How to find original build version when soft bricked?

Ok, I have searched the internet and these forums for hours and have not seen an answer to this anywhere.
I can't believe I'm the only person who has ever wanted to know how to determine this information!
I repair Nexus 7 2013 as a hobby - usually with broken screens, but now and then buy a soft bricked one.
I have the same issue every time - trying to find what is the original build number when it is soft bricked and you can't access Recovery either. I have even tried to see if Asus has a cross reference of serial number to original build number - no they don't.
I use the Wug tool and so far the score is 3 saved, one that even has Wug stumped, and the one I'm working on tonight that I simply can't get to work.
I always have to guess and try versions. tonight I've tried the single version of 4.4.4 and 3 other version of 5 to 6. Each time the best that I can get is a sluggish boot that usually eventually freezes while trying to run setup. That is BEST CASE. Worst case would take pages to describe. It sort of works on lmy47v a little and not at all on any other build. Manufacture date is March 2015.
If I didn't know better, if this was a PC, I would say there is a bad RAM chip.
Regardless, I would feel a lot happier if I knew I was installing the right build which leads back to the original question - how do you find the original build if it's soft bricked?
Thanks to anybody who can answer this!
Do this:
PC: download TWRP image, e.g. twrp-2.8.6.0-flo.img
N7: boot in fastboot mode
PC run: fastboot boot twrp-2.8.6.0-flo.img
N7: in TWRP UI mount system
PC run: adb shell cat /system/build.prop > build.prop.txt
View build.prop.txt on PC:
Code:
ro.build.id=LMY48Y
ro.build.display.id=cm_flo-userdebug 5.1.1 LMY48Y ceb9c142ee test-keys
ro.build.version.incremental=ceb9c142ee
But why do you bother to restore "original build number"?
Most of them are locked and will lose all data in the process of unlocking.
Then why not flash the latest OS image?
k23m said:
Do this:
PC: download TWRP image, e.g. twrp-2.8.6.0-flo.img
N7: boot in fastboot mode
PC run: fastboot boot twrp-2.8.6.0-flo.img
N7: in TWRP UI mount system
PC run: adb shell cat /system/build.prop > build.prop.txt
View build.prop.txt on PC:
Code:
ro.build.id=LMY48Y
ro.build.display.id=cm_flo-userdebug 5.1.1 LMY48Y ceb9c142ee test-keys
ro.build.version.incremental=ceb9c142ee
But why do you bother to restore "original build number"?
Most of them are locked and will lose all data in the process of unlocking.
Then why not flash the latest OS image?
Click to expand...
Click to collapse
Thanks for your reply. No less complicated way to find that out eh? I'm afraid that's a bit over my head (or perhaps its just the way its worded - no offense intended). If it was PC, and particularly DOS, I would be laughing.
When nothing else was working on this particular tablet, I did try for the heck of it to use the Wug toolkit to root and install TWRP, and it would just lock up and never install - no error messages or anything.
As far as why not use the most recent image, there are lots of opinions, and the majority I have ever read says if you don't use the original build you will get all kinds of problems right up to completely bricking the device. Since you have to take every opinion with a grain of salt, it just seems to make sense to use what it came with. 2 out of 3 tablets I have been able to do that with I have be able to save. Only 1 where I used a random build worked.
consumer61 said:
No less complicated way to find that out eh?
Click to expand...
Click to collapse
The simplest way is to check it in stock recovery but you say it is not an option...
consumer61 said:
the majority I have ever read says if you don't use the original build you will get all kinds of problems right up to completely bricking the device
Click to expand...
Click to collapse
Please post a link to one of them.
k23m said:
Please post a link to one of them.
Click to expand...
Click to collapse
I wish I could. Just random things read from hundreds of pages over a couple of years, and of course when you look for them you can't find them. I have on and off been trying to find an answer to this question for over a year.
Even the wug toolkit encourages you to make a backup of your own system rather than re-flash a random stock image. Since as soon as you unlock you lose everything anyway, there hardly seems any purpose to a backup as opposed to just re-flashing with the newest version - ergo that also leads you to believe you need to use the exact version that was there before.
I don't discount the possibility that even though not said, what was actually meant was that each device model has a version specific to it. Again, that was never clearly said, I am just using logic based on your concept that you can install any image at all, with absolutely no issue.
consumer61 said:
I wish I could... when you look for them you can't find them.
...rather than re-flash a random stock image.
Click to expand...
Click to collapse
That's it, all those horror stories are from "random stock" flashers. If you choose wisely the very latest stock image then there is no danger whatsoever.
Let's talk about the latest case - is it unlocked already?
I was able to unlock, but could not access recovery - when booting to recovery it would still just sit at the Google logo.
In order, I tried from the list that comes up on the Wug tool, a 6.01 version, then lmy47v, then lmy48g, then finally thought I would try going back quite far since there was only one version for 4.4.4 - ktu84p, then finally lmy48t.
With tiny variations, all had the exact same result - no errors when wiping or reloading. The circling balls would just around as normal, then eventually grind to halt - moving a tiny bit every 5-30 seconds. After maybe an hour, sometimes you would finally get the normal "pick your language" screen, although most times, after about 30 min I would just shut it down and power it back on.
That would result in sometimes getting the "pick a language". Sometimes able to get as far as entering a gmail address, but the system would always lag - registering a touch many seconds after doing it. Once single time, I got a full boot up. Then it came up with the OTA as it should. ran it, and back to soft bricked.
Also a couple of the times I was able to get it to boot, as soon as you would reboot, it would be back to soft bricked.
Motherboard got exceptionally hot, and battery was down to 18% once, and 27% another time from full charge - so it was working abnormally hard
I have been playing with and building pc' etc since the Vic 20, C 64 and so on, and it behaves just like a bad RAM chip. I did find a post on here saying the Kingston/Toshiba chip can get corrupted and must be replaced, with a link to the same guy selling MB on ebay - can't remember his id on here, but here is the ebay sale:
http://www.ebay.ca/itm/121637666631?_trksid=p2055119.m1438.l2649&ssPageName=STRK:MEBIDX:IT
Overall this is similar behaviour although not quite as bad, as the other motherboard that stumped Wug. He finally said it must be hardware in that case, and I certainly tend to think the same thing here.
consumer61 said:
He finally said it must be hardware in that case, and I certainly tend to think the same thing here.
Click to expand...
Click to collapse
Let's find out exactly. As you are comfortable with DOS then the following should be piece of cake:
download twrp-2.8.6.0-flo.img from https://dl.twrp.me/flo/
go to Wug(NRT)\data folder - can you see fastboot.exe and adb.exe there?
boot the Nexus in fastboot mode (when off press power+vol.down), connect it to your PC
in Wug's data folder open a DOS command window and copy/paste: fastboot boot twrp-2.8.6.0-flo.img [Enter]
when TWRP is up and running, copy/paste in the DOS: adb shell dmesg > dmesg.txt [Enter]
you will find dmesg.txt in Wug's data folder
zip up the file and attach it to your next post
This is THE hardware log and another chance to play with DOS-like stuff :laugh:
Ok excellent instructions. (did tech support for years).
I had pulled the MB and replaced it, so I just switched it back.
Install TWRP worked fine. TWRP screen came up.
Typed command for the msg file, and dos error was "error: device '<null>' not found
I know of TWRP, but have never used it. I hit the centre button on the screen which brought up what appears may be an install log, and its full of errors.
Goes down over a full screen, but the common statement is:
"unable to find partition size for /boot" /recovery /misc and about 15 more lines.
Also other errors like unable to mount cache, data, system
I just took a photo of the screen but it seems you can't post actual images, only links to images stored on the internet, not something off your hard drive.
Just to let you know, I did try various spacing around the dmesg > dmesg.txt command just to be sure, same error every time.
Now that is from the TWRP screen with all the buttons on it. If you meant for me to open a certain function of TWRP, I didn't.
Regards,
UPDATE: had a brainwave and loaded up Wugfresh and device manger. Showed exclamation mark beside the device so re-installed adb driver. Now the log worked. It is only 64k, and both the twrp photo and the log file should be attached now.
I looked through the log, and even not knowing the internals of the system that well, only one part stood out as appearing bad:
<3>[ 0.277130] msm_gpiomux_install: write failure: -22
<3>[ 0.277221] msm_gpiomux_install: write failure: -22
<3>[ 0.277404] msm_gpiomux_install: write failure: -22
<3>[ 0.277496] msm_gpiomux_install: write failure: -22
<3>[ 0.277648] msm_gpiomux_install: write failure: -22
<3>[ 0.277740] msm_gpiomux_install: write failure: -22
<6>[ 0.278656] Registering gpio keys
<6>[ 0.278778] Reconfigure VOL_UP(GPIO155) and VOL_DOWN(GPIO189) with PMIC
<4>[ 0.278991] 8921_l17: Failed to create debugfs directory
<4>[ 0.280609] ------------[ cut here ]------------
<4>[ 0.280700] WARNING: at arch/arm/mach-msm/subsystem_restart.c:573 subsys_restart_init+0xd8/0x104()
<4>[ 0.280883] Modules linked in:
<4>[ 0.281066] [<c0015f44>] (unwind_backtrace+0x0/0x11c) from [<c007ae88>] (warn_slowpath_common+0x4c/0x64)
<4>[ 0.281250] [<c007ae88>] (warn_slowpath_common+0x4c/0x64) from [<c007aeb8>] (warn_slowpath_null+0x18/0x1c)
<4>[ 0.281433] [<c007aeb8>] (warn_slowpath_null+0x18/0x1c) from [<c0c0c600>] (subsys_restart_init+0xd8/0x104)
<4>[ 0.281616] [<c0c0c600>] (subsys_restart_init+0xd8/0x104) from [<c0008718>] (do_one_initcall+0x8c/0x15c)
<4>[ 0.281799] [<c0008718>] (do_one_initcall+0x8c/0x15c) from [<c0c00a24>] (kernel_init+0xe8/0x1a4)
<4>[ 0.281982] [<c0c00a24>] (kernel_init+0xe8/0x1a4) from [<c000fdf8>] (kernel_thread_exit+0x0/0x8)
<4>[ 0.282104] ---[ end trace ff63e6c2cba9c001 ]---
consumer61 said:
Typed command for the msg file, and dos error was "error: device '<null>' not found
Click to expand...
Click to collapse
When TWRP is running please type adb devices and it should respond like:
Code:
List of devices attached
087777e8 recovery
If not, re-plug USB cable, check Windows device manager for new hardware. You may need ADB driver but Wug would install it before.
Please upload the picture(s) to http://imgur.com/?noFlash
We don't need to interact with TWRP for this task at all.
Btw, TWRP was not flashed, but only temporarily booted so you may need to repeat it all over again.
Cheers
I suspect you were writing your reply above, as I updated the info. Please see the end of page 1 - the photo and the log file are attached.
simply put is was my mess up - adb had to be re-installed every time you plug a device in when running XP Pro. (Yes I know XP. Hate 7 and 8 and 10, but this is the last version where you had SOME semblance of control over your own computer lol)
Thanks!
consumer61 said:
I suspect you were writing your reply above, as I updated the info. Please see the end of page 1 - the photo and the log file are attached.
simply put is was my mess up - adb had to be re-installed every time you plug a device in when running XP Pro. (Yes I know XP. Hate 7 and 8 and 10, but this is the last version where you had SOME semblance of control over your own computer lol)
Thanks!
Click to expand...
Click to collapse
Yes.
I use Linux and ...XP too :highfive:
Please check my last post here.

Categories

Resources