Hi, I ve a bricked Z9X, I tried downgrade the firmware but bricked. It's now showing red led standby after power on. I have followed the uart method, but not success. Appreciate any ideas to recover.
It is a ftdi chip TTL board, I have no idea to verify if the condition is ok. Last I used, it was fine, but that was years ago. And it has been kept in box for years. What is the serial port speed, data bit, stop bit,s flow control parameter I should use? The link doesnt mentioned that, I searched through here no mention too.
When I had to do it years ago I used: 115200 baud 8 data bits 1 stop bit No Parity I used a CP2102 USB to UART bridge.
I managed to get something from serial console. But it doesnt seem to help. It stop booting at "jump to BL31: 0x80001000" I used a Max3232E serial, and connect to an ATEN serial to USB Gosh, so much hassles yet no outcome. C1:80000000 C2h hwsetting size: 00000a78 ------------------- Write Leveling -------------------- DQS0 PI = 0x0000001b, DQ0 PI = 0x00000003 DQS1 PI = 0x0000001d, DQ1 PI = 0x00000005 DQS2 PI = 0x0000001a, DQ2 PI = 0x00000002 DQS3 PI = 0x0000001b, DQ3 PI = 0x00000003 -------------------- TX VREF Scan --------------------- ODT60, TX VREF Range = [0x00000cd7, 0x00000cec] Tx VREF = 0x00000ce1, Weight = 0x0000000b ------------------- DQS Calibration ------------------- DQS0 Map = [0x00000016, 0x00000000], Width = 0x0000000b DQS0 Best PI = 0x0000001b DQS1 Map = [0x00000018, 0x00000002], Width = 0x0000000b DQS1 Best PI = 0x0000001d DQS2 Map = [0x00000015, 0x0000001f], Width = 0x0000000b DQS2 Best PI = 0x0000001a DQS3 Map = [0x00000016, 0x00000000], Width = 0x0000000b DQS3 Best PI = 0x0000001b BSTC verify: OK DDR calibration done REG32(VO_SW_SEC_1) = 0x00ce070d warmboot_indicator = 0x00004815 C3 DTE_Bootcode Flash Addr = 0x00012600 DTE_Bootcode Flash Length = 0x00044a00 DTE_Bootcode target addr = 0x10120000 C4 C5 jump to FSBL_DDR: 0x10120000 FSBL_DDR: Mar 17 2020, 10:29:37 p_FW_Entry_DTE_FW_Certificate: type: 10, flash_addr: 0x20c00, length: 0x400, emmc_partition: 0 p_FW_Entry_DTE_BOOTCODE_RTK: type: 16, flash_addr: 0x1a0000, length: 0x180000, emmc_partition: 0 p_FW_Entry_BL31: type: 17, flash_addr: 0x28800, length: 0xd114, emmc_partition: 0 p_FW_Entry_TEEOS: type: 18, flash_addr: 0x35a00, length: 0x1409a4, emmc_partition: 0 p_FW_Entry_PCPU_FW_Certificate: type: 2, flash_addr: 0x20800, length: 0x400, emmc_partition: 0 p_FW_Entry_PCPU_FW: type: 14, flash_addr: 0x21800, length: 0x7000, emmc_partition: 0 get_bl31 = 0x00000000 copy_img_from_emmc(00000000, 00000144, 0000d114, 80001000) AES_ECB_decrypt(80001000, 0000d000, 80001000, 10130260, 00000000, 00000080) AES key (0x10130260) 0x10130260: 12 ef cd 22 68 24 57 13 d4 c3 b2 a1 be ba 90 90 SHA256_hash(80001000, 0000d014, 1012f280, 00000000, 00000001) sha256 hash (0x1012f280) 0x1012f280: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be 0x1012f290: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be return hash2 = 0x1012f180 hash1 from CP (0x1012f280) 0x1012f280: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be 0x1012f290: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be hash2 from sig (0x1012f180) 0x1012f180: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be 0x1012f190: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be compare_memory(1012f280, 1012f180, 00000020): 00000000 process_bl31: 0x0 get_dte_fw_certificate = 0x00000000 copy_img_from_emmc(00000000, 00000106, 00000400, 1012e900) process_dte_fw_certificate: 0x0 get_dte_bootcode_rtk = 0x00000000 copy_img_from_emmc(00000000, 00000d00, 00180000, 00030000) process_dte_bootcode_rtk: 0x0 jump to BL31: 0x80001000
Unfortunately I can't help much - it's years since I did this and I barely remember what I had for dinner yesterday It was @jjm2473 who helped me out, but that was way back in 2020.
