T1s终极救砖探讨(乐视盒子T1s加TF卡、修复CPU及NAND虚焊实录)
图/文：神蓝
花开花谢、暑往寒来，转眼又到了南方尚未落雪的冬，2016年的日历也开始撕下了一页又一页……为了抵御寒冬，难道不应该在业余时间找点乐趣吗？然学海无涯，为了体验博大精深的卯榫之美，特diy了一个三片实木诸葛孔明锁。
然正把玩之时一乐迷兄弟说T1s已变砖，寄来给我盖房，故事得从这说起。
就在第二天，板砖送到，心想T1s救砖还不简单吗？立刻上电，HDMI无信号，撕掉底胶，下四颗螺丝，找到隐藏的按钮，插入U盘，按住按钮上电，换ｕｓｂ口，HDMI依然无信号。你没，那么邪门，然而因此才有了下面的故事。
接下来，首先应该怀疑的是U盘，检测U盘格式内容正确，那么是否有可能是那个隐藏的按钮挂了呢？上万用表检测，通过。那么问题来了，到底是哪出问题了了？这时HDMI是没任何信号的，就是说recovery都没运行。这个时候，胡乱搞是没用的，找TTL接口最实际。
一不小心让哥找到了。嘿嘿，现在笔记本电脑大多没有com口，用ｕｓｂ转TTl线搞定，分别接线：主板RX接ｕｓｂ转TTL的TX，主板TX接ｕｓｂ转TTL的RX，主板GND接ｕｓｂ转TTL的GND，在pc打开windows自带的超级终端，我的是com7，115200，（具体是com几得看配置），上电后一串代码彪过，代码大致如下：
- EEEE I3000000032940xf300100003877530EEEE I400000004294_M6_BL1_3431>2534313
- TE : 77170
- wait pll-0x03 target is 01e0 now it is 0x000001df
- DDR clock is 480MHz with 1T mode
- DDR training :
- DX0DLLCR:40000000
- DX0DQTR:ffffffff
- DX0DQSTR:3db05001
- DX1DLLCR:40000000
- DX1DQTR:ffffffff
- DX1DQSTR:3db05001
- DX2DLLCR:40000000
- DX2DQTR:ffffffff
- DX2DQSTR:3db05001
- DX3DLLCR:40000000
- DX3DQTR:ffffffff
- DX3DQSTR:3db05001
- Stage 00 Result 00000000
- HHH
- Boot From SPI
- 0x12345678
- Boot from internal device 1st SPI RESERVED
- System Started
- U-boot-00000-g0a1849a(m6_letv_g28ref@0a1849a1) (Nov 07 2013 - 01:42:07)
- aml_rtc_init
- aml rtc init first time!
- Clear HDMI KSV RAM
- DRAM: 1 GiB
- relocation Offset is: 105ec000
- usid is: T1S5000
- 3 t1s board_init buf is: T1S5000
- 7 c1 board_init board_type is: 1
- 8 c1 board_init board_type is: 1
- NAND: Amlogic nand flash uboot driver, Version U1.06.017 (c) 2010 Amlogic Inc.
- No NAND device found!!!
- NAND device id: 2c 68 4 4a a9 0
- NAND device: Manufacturer ID: 0x2c, Chip ID: 0x2c (Micron C revision NAND 4GiB M
- T29F32G-C)
- 1 NAND chips detected
- onfi timing mode set failed: 49
- #####aml_nand_init, with RB pins and chip->chip_delay:20
- bus_cycle=10, bus_timing=10, start_cycle=10, end_cycle=10,system=5.0ns
- oob size is not enough for selected bch mode: NAND_BCH60_1K_MODE force bch to mo
- de: NAND_BCH30_1K_MODE
- aml_chip->oob_fill_cnt =0,aml_chip->oob_size =224,bch_bytes =54
- aml_nand_init:oobmul =2,chip->ecc.layout->oobfree[0].length=16,aml_chip->oob_siz
- e=224
- aml nand env valid addr: 20000
- NAND bbt detect factory Bad block at ffc00000
- key start_blk=2039,end_blk=2047,aml_nand_key_init:684
- aml nand key valid addr: fee00000
- aml nand key valid addr: ff000000
- aml nand key valid addr: ff200000
- aml nand key valid addr: ff400000
- CON***_KEYSIZE=0x10000; KEYSIZE=0xfffc; bbt=0x1330; default_keyironment_size=0xe
- ccc
- i=0,register --- nand_key
- NAND bbt detect factory Bad block at 5a00000
- Creating 11 MTD partitions on "nandnormal":
- 0x000000800000-0x000001000000 : "bootargs"
- 0x000001000000-0x000001800000 : "misc"
- 0x000001800000-0x000002000000 : "baseparam"
- 0x000002000000-0x000002800000 : "logo"
- 0x000002800000-0x000003800000 : "aml_logo"
- 0x000003800000-0x000009a00000 : "fastplay"
- NAND bbt detect factory Bad block at 5a00000
- 0x000009a00000-0x00000aa00000 : "recovery"
- 0x00000aa00000-0x00000ba00000 : "boot"
- 0x00000ba00000-0x00002ba00000 : "system"
- 0x00002ba00000-0x00004ba00000 : "cache"
- 0x00004ba00000-0x0000fee00000 : "userdata"
- nandnormal initialized ok
- detect mx chiprevD :1 and nand_type: 0
- nand_curr_device =0
- MMC: SDIO Port B: 0
- SF: Detected MX25L3205D with page size 256, total 4 MiB
- SPI NOR Flash have write protect!!!
- In: serial
- Out: serial
- Err: serial
- register u*** cfg[0] = 9fe82e08
- Net: Meson_Ethernet
- init suspend firmware done. (ret:0)
- key_init(P_AO_RTI_PIN_MUX_REG (0xc8100014))_val = 0x9f5e3ec4
- detect_storage
- setenv storage nand
- reboot_mode=charging
- SARADC open channel(4).
- SARADC open channel(4).
- ir init
- key_init(P_AO_RTI_PIN_MUX_REG (0xc8100014))_val = 0x9f5e3804
- usid is: T1S5000
- 3 t1s switch_boot_mode env is: T1S5000
- switch_boot_mode env = T1s
- P_AO_RTI_STATUS_REG2: 0x0
- suspend = <NULL>
- enter_recovery
- ### main_loop: bootcmd="run nandboot"
- Hit any key to stop autoboot: 0
- Booting from nand ...
- NAND read: logo whole chip
- 8388608 bytes read: OK
- wrong pack img!
- cp - memory copy
- Usage:
- cp [.b, .w, .l] source target count
- NAND read: boot offset 0x0, size 0x600000
- 6291456 bytes read: OK
- pre-clear hdmi ram
- hdcp get form storage medium: nand
- name=nand_key nand_key
- read:addr:0xfee00000,phy_blk_addr:2039,phy_page_addr:0,aml_nand_get_key:125
- device:nand, init key ok!!
- don't found keyname,uboot_key_read:1502
- prefetch hdcp keys from nand failed
- Wrong Image Format for bootm command
- ERROR: can't get kernel image!
- recovery
- enter recovery
- NAND read: logo whole chip
- 8388608 bytes read: OK
- wrong pack img!
- cp - memory copy
- Usage:
- cp [.b, .w, .l] source target count
- sdio_detect return 0
- (Re)start U***...
- U***: dwc_u*** driver version: 2.94 6-June-2012
- U*** (1) peri reg base: c1108420
- U*** (1) use clock source: XTAL input
- U*** (1) PHY Clock not detected!
- U*** (1) base addr: 0xc90c0000
- Force id mode: Host
- dwc_otg: No U*** device found !
- Error, couldn't init Lowlevel part
- ** Invalid boot device **
- NAND read: recovery offset 0x0, size 0x600000
- 6291456 bytes read: OK
- Wrong Image Format for bootm command
- ERROR: can't get kernel image!
- m6_letv_g28ref#
复制代码
U盘接ｕｓｂ口按隐藏按钮也没用，代码并无变化。难道这盒子真可以盖房子了？哥偏不信邪，想着俺还有引导卡，嘿嘿！但细细一想，民间传说有太监，谁知T1s也是太监，卡槽活生生被阉了。
幸亏昨晚华佗托梦于我叮嘱我一定要保全T1s的根，乐视你拿屠刀，我劝你立地成佛；功夫不负有心人，俺在主板上找到一个疑似TF卡槽位的地方，俺找来一个TF卡槽，把里面的弹簧去掉（为了伟大的实践需求方便TF卡无数次拔插运动呗），把TF卡插到这个位置正好。
然后找了一张4G TF卡，制作启动卡（软体可以在我以往的帖子内找到，这里就不留篇幅了，需要的自己去以往的帖子里找。）然后短路下图这两个脚上电，嘿嘿……T1s就可以从TF卡启动了。
照常理说故事说到这里就应该划一个句号了，接下来救砖成功似乎是顺利成章之事，然事与愿违，救活这货远远没有你想象的那么简单，而且冬天再冷也冷不过人心。救活这货的过程可谓扑朔迷离，辗转反复，其曲折的过程足以拍一部大片；究其原因竟是官方不提供任何参考与工具以及救砖包。发在论坛的求助贴也如泥牛入海，杳无音讯。
未完待续……
| 
网站导航
发表于 2016-1-10 23:13
提升卡
置顶卡
变色卡
千斤顶
znds.com 