T1s終極救磚探討(樂視盒子T1s加TF卡、修復CPU及NAND虛焊實錄)
圖/文：神藍
花開花謝、暑往寒來，轉眼又到了南方尚未落雪的冬，2016年的日歷也開始撕下了一頁又一頁……為了抵御寒冬，難道不應該在業(yè)余時間找點樂趣嗎？然學海無涯，為了體驗博大精深的卯榫之美，特diy了一個三片實木諸葛孔明鎖。
然正把玩之時一樂迷兄弟說T1s已變磚，寄來給我蓋房，故事得從這說起。
就在第二天，板磚送到，心想T1s救磚還不簡單嗎？立刻上電，HDMI無信號，撕掉底膠，下四顆螺絲，找到隱藏的按鈕，插入U盤，按住按鈕上電，換ｕｓｂ口，HDMI依然無信號。你沒，那么邪門，然而因此才有了下面的故事。
接下來，首先應該懷疑的是U盤，檢測U盤格式內容正確，那么是否有可能是那個隱藏的按鈕掛了呢？上萬用表檢測，通過。那么問題來了，到底是哪出問題了了？這時HDMI是沒任何信號的，就是說recovery都沒運行。這個時候，胡亂搞是沒用的，找TTL接口最實際。
一不小心讓哥找到了。嘿嘿，現在筆記本電腦大多沒有com口，用ｕｓｂ轉TTl線搞定，分別接線：主板RX接ｕｓｂ轉TTL的TX，主板TX接ｕｓｂ轉TTL的RX，主板GND接ｕｓｂ轉TTL的GND，在pc打開windows自帶的超級終端，我的是com7，115200，（具體是com幾得看配置），上電后一串代碼彪過，代碼大致如下：
- EEEE I3000000032940xf300100003877530EEEE I400000004294_M6_BL1_3431>2534313
- TE : 77170
- wait pll-0x03 target is 01e0 now it is 0x000001df
- DDR clock is 480MHz with 1T mode
- DDR training :
- DX0DLLCR:40000000
- DX0DQTR:ffffffff
- DX0DQSTR:3db05001
- DX1DLLCR:40000000
- DX1DQTR:ffffffff
- DX1DQSTR:3db05001
- DX2DLLCR:40000000
- DX2DQTR:ffffffff
- DX2DQSTR:3db05001
- DX3DLLCR:40000000
- DX3DQTR:ffffffff
- DX3DQSTR:3db05001
- Stage 00 Result 00000000
- HHH
- Boot From SPI
- 0x12345678
- Boot from internal device 1st SPI RESERVED
- System Started
- U-boot-00000-g0a1849a(m6_letv_g28ref@0a1849a1) (Nov 07 2013 - 01:42:07)
- aml_rtc_init
- aml rtc init first time!
- Clear HDMI KSV RAM
- DRAM: 1 GiB
- relocation Offset is: 105ec000
- usid is: T1S5000
- 3 t1s board_init buf is: T1S5000
- 7 c1 board_init board_type is: 1
- 8 c1 board_init board_type is: 1
- NAND: Amlogic nand flash uboot driver, Version U1.06.017 (c) 2010 Amlogic Inc.
- No NAND device found!!!
- NAND device id: 2c 68 4 4a a9 0
- NAND device: Manufacturer ID: 0x2c, Chip ID: 0x2c (Micron C revision NAND 4GiB M
- T29F32G-C)
- 1 NAND chips detected
- onfi timing mode set failed: 49
- #####aml_nand_init, with RB pins and chip->chip_delay:20
- bus_cycle=10, bus_timing=10, start_cycle=10, end_cycle=10,system=5.0ns
- oob size is not enough for selected bch mode: NAND_BCH60_1K_MODE force bch to mo
- de: NAND_BCH30_1K_MODE
- aml_chip->oob_fill_cnt =0,aml_chip->oob_size =224,bch_bytes =54
- aml_nand_init:oobmul =2,chip->ecc.layout->oobfree[0].length=16,aml_chip->oob_siz
- e=224
- aml nand env valid addr: 20000
- NAND bbt detect factory Bad block at ffc00000
- key start_blk=2039,end_blk=2047,aml_nand_key_init:684
- aml nand key valid addr: fee00000
- aml nand key valid addr: ff000000
- aml nand key valid addr: ff200000
- aml nand key valid addr: ff400000
- CON***_KEYSIZE=0x10000; KEYSIZE=0xfffc; bbt=0x1330; default_keyironment_size=0xe
- ccc
- i=0,register --- nand_key
- NAND bbt detect factory Bad block at 5a00000
- Creating 11 MTD partitions on "nandnormal":
- 0x000000800000-0x000001000000 : "bootargs"
- 0x000001000000-0x000001800000 : "misc"
- 0x000001800000-0x000002000000 : "baseparam"
- 0x000002000000-0x000002800000 : "logo"
- 0x000002800000-0x000003800000 : "aml_logo"
- 0x000003800000-0x000009a00000 : "fastplay"
- NAND bbt detect factory Bad block at 5a00000
- 0x000009a00000-0x00000aa00000 : "recovery"
- 0x00000aa00000-0x00000ba00000 : "boot"
- 0x00000ba00000-0x00002ba00000 : "system"
- 0x00002ba00000-0x00004ba00000 : "cache"
- 0x00004ba00000-0x0000fee00000 : "userdata"
- nandnormal initialized ok
- detect mx chiprevD :1 and nand_type: 0
- nand_curr_device =0
- MMC: SDIO Port B: 0
- SF: Detected MX25L3205D with page size 256, total 4 MiB
- SPI NOR Flash have write protect!!!
- In: serial
- Out: serial
- Err: serial
- register u*** cfg[0] = 9fe82e08
- Net: Meson_Ethernet
- init suspend firmware done. (ret:0)
- key_init(P_AO_RTI_PIN_MUX_REG (0xc8100014))_val = 0x9f5e3ec4
- detect_storage
- setenv storage nand
- reboot_mode=charging
- SARADC open channel(4).
- SARADC open channel(4).
- ir init
- key_init(P_AO_RTI_PIN_MUX_REG (0xc8100014))_val = 0x9f5e3804
- usid is: T1S5000
- 3 t1s switch_boot_mode env is: T1S5000
- switch_boot_mode env = T1s
- P_AO_RTI_STATUS_REG2: 0x0
- suspend = <NULL>
- enter_recovery
- ### main_loop: bootcmd="run nandboot"
- Hit any key to stop autoboot: 0
- Booting from nand ...
- NAND read: logo whole chip
- 8388608 bytes read: OK
- wrong pack img!
- cp - memory copy
- Usage:
- cp [.b, .w, .l] source target count
- NAND read: boot offset 0x0, size 0x600000
- 6291456 bytes read: OK
- pre-clear hdmi ram
- hdcp get form storage medium: nand
- name=nand_key nand_key
- read:addr:0xfee00000,phy_blk_addr:2039,phy_page_addr:0,aml_nand_get_key:125
- device:nand, init key ok!!
- don't found keyname,uboot_key_read:1502
- prefetch hdcp keys from nand failed
- Wrong Image Format for bootm command
- ERROR: can't get kernel image!
- recovery
- enter recovery
- NAND read: logo whole chip
- 8388608 bytes read: OK
- wrong pack img!
- cp - memory copy
- Usage:
- cp [.b, .w, .l] source target count
- sdio_detect return 0
- (Re)start U***...
- U***: dwc_u*** driver version: 2.94 6-June-2012
- U*** (1) peri reg base: c1108420
- U*** (1) use clock source: XTAL input
- U*** (1) PHY Clock not detected!
- U*** (1) base addr: 0xc90c0000
- Force id mode: Host
- dwc_otg: No U*** device found !
- Error, couldn't init Lowlevel part
- ** Invalid boot device **
- NAND read: recovery offset 0x0, size 0x600000
- 6291456 bytes read: OK
- Wrong Image Format for bootm command
- ERROR: can't get kernel image!
- m6_letv_g28ref#
復制代碼
U盤接ｕｓｂ口按隱藏按鈕也沒用，代碼并無變化。難道這盒子真可以蓋房子了？哥偏不信邪，想著俺還有引導卡，嘿嘿！但細細一想，民間傳說有太監(jiān)，誰知T1s也是太監(jiān)，卡槽活生生被閹了。![]()
幸虧昨晚華佗托夢于我叮囑我一定要保全T1s的根，樂視你拿屠刀，我勸你立地成佛；功夫不負有心人，俺在主板上找到一個疑似TF卡槽位的地方，俺找來一個TF卡槽，把里面的彈簧去掉（為了偉大的實踐需求方便TF卡無數次拔插運動唄），把TF卡插到這個位置正好。
![]()
然后找了一張4G TF卡，制作啟動卡（軟體可以在我以往的帖子內找到，這里就不留篇幅了，需要的自己去以往的帖子里找。）然后短路下圖這兩個腳上電，嘿嘿……T1s就可以從TF卡啟動了。
![]()
照常理說故事說到這里就應該劃一個句號了，接下來救磚成功似乎是順利成章之事，然事與愿違，救活這貨遠遠沒有你想象的那么簡單，而且冬天再冷也冷不過人心。救活這貨的過程可謂撲朔迷離，輾轉反復，其曲折的過程足以拍一部大片；究其原因竟是官方不提供任何參考與工具以及救磚包。發(fā)在論壇的求助貼也如泥牛入海，杳無音訊。
未完待續(xù)……
| 
網站導航
發(fā)表于 2016-1-10 23:13
收藏
淘帖
頂一個
踩
提升卡
置頂卡
變色卡
千斤頂
znds.com 