Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Bricked Yundoo Y8
#1
Hello

I am a happy yundoo y8 user. The android 7.1 is working quite well for me... but... I wanted to try linux  and I think I have bricked the Y8.

What I did? I got the linux image for an almost identical RK3399 device ( https://en.opensuse.org/HCL:Yundoo-Y8 ) and I flashed it with the command: upgrade_tool uf linux_image.img


After this, at power on with the red light is not switching to blue  nor it boots. Recovery mode (the button hidden inside the audio jack) is not working: the device is not detected in the USB with rkflashkit (before flashing it was appearing).

So, I installed a TTY serial cable to these points:

[Image: uart-e1503104224796.png?w=616&h=401]

and I got this log:

Code:
DDR Version 1.07 20161103
In
Channel 0: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
Channel 1: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
256B stride
ch 0 ddrconfig = 0x101, ddrsize = 0x2020
ch 1 ddrconfig = 0x101, ddrsize = 0x2020
pmugrf_os_reg[2] = 0x3AA17AA1, stride = 0xD
OUT
Boot1: 2016-07-29, version: 1.05
CPUId = 0x0
ChipType = 10 1838
SdmmcInit=2 0
BootCapSize=100000
UserCapSize=29820MB
FwPartOffset=2000 , 100000
SdmmcInit=0 20
StorageInit ok = 68770
LoadTrustBL
No find bl30.bin
theLoader 200000 89483
LoaderFlag2: 0x0
Unhandled Exception in EL3.
x30 =           0x0000000000045004
x0 =            0x0f1e2d3c4b5a6978
x1 =            0x00000000ff3b1fd0
x2 =            0x0000000000000018
x3 =            0x0000000000000018
x4 =            0x0000000000000018
x5 =            0x0000000000000000
x6 =            0x0000000000000000
x7 =            0x0000000000000000
x8 =            0x0000000003011908
x9 =            0x0000000000010080
x10 =           0x0000000000021888
x11 =           0x0000000000000400
x12 =           0x000000000000000a
x13 =           0x000000000000000f
x14 =           0x0000000000000002
x15 =           0x0000000000000004
x16 =           0x0000000008000000
x17 =           0x0000000000000000
x18 =           0x0000000000800000
x19 =           0x0f1e2d3c4b5a6978
x20 =           0x0000000000049220
x21 =           0x0f1e2d3c4b5a6978
x22 =           0x00000000000418f9
x23 =           0x0000000000041000
x24 =           0x0000000000049230
x25 =           0x0000000000000001
x26 =           0x00000000ff8c2000
x27 =           0x0000000000000110
x28 =           0x0000000000000110
x29 =           0x00000000000468c0
scr_el3 =               0x0000000000000238
sctlr_el3 =             0x0000000000c5383a
cptr_el3 =              0x0000000000000000
tcr_el3 =               0x0000000000000000
daif =          0x00000000000003c0
mair_el3 =              0x44e048e000098aa4
spsr_el3 =              0x00000000600002cc
elr_el3 =               0x0000000000011810
ttbr0_el3 =             0x004d002001480e51
esr_el3 =               0x0000000096000000
far_el3 =               0x0f1e2d3c4b5a6978
spsr_el1 =              0x00000000102d62d0
elr_el1 =               0xb2417e412a4080c6
spsr_abt =              0x000000002000ba50
spsr_und =              0x0000000042194012
spsr_irq =              0x000000005a022200
spsr_fiq =              0x0000000098000228
sctlr_el1 =             0x0000000000c52838
actlr_el1 =             0x0000000000000000
cpacr_el1 =             0x0000000000000000
csselr_el1 =            0x0000000000000000
sp_el1 =                0x1140d14022000309
esr_el1 =               0x0000000010000840
ttbr0_el1 =             0x5864082d50290402
ttbr1_el1 =             0x0b8a1f2828082009
mair_el1 =              0x44e048e000098aa4
amair_el1 =             0x0000000000000000
tcr_el1 =               0x0000000000000000
tpidr_el1 =             0x060828054d204008
tpidr_el0 =             0x2120be1112480006
tpidrro_el0 =           0x00020057c542220c
dacr32_el2 =            0x0000000000208021
ifsr32_el2 =            0x0000000000000000
par_el1 =               0x4400004909600104
mpidr_el1 =             0x0000000080000000
afsr0_el1 =             0x0000000000000000
afsr1_el1 =             0x0000000000000000
contextidr_el1 =                0x0000000000000000
vbar_el1 =              0x0000000000000000
cntp_ctl_el0 =          0x0000000000000000
cntp_cval_el0 =         0x04140f1429c21301
cntv_ctl_el0 =          0x0000000000000002
cntv_cval_el0 =         0x480001e005006018
cntkctl_el1 =           0x0000000000000000
fpexc32_el2 =           0x0000000000000700
sp_el0 =                0x00000000000468c0
isr_el1 =               0x0000000000000000
cpuectlr_el1 =          0x0000000000000040
cpumerrsr_el1 =         0x0000000000000000
l2merrsr_el1 =          0x0000000000000000
gicc_hppir =            0x0000000000000000
gicc_ahppir =           0x0000000000000000
gicc_ctlr =             0x0000000014000082
gicd_ispendr regs (Offsets 0x200 - 0x278)
0000000000000200:               0x0000041800000000
0000000000000208:               0x0000000000000000
0000000000000210:               0x0000000000000010
0000000000000218:               0x0000000000000000
0000000000000220:               0x0000000000000000
0000000000000228:               0x0000000000000000
0000000000000230:               0x0000000000000000
0000000000000238:               0x0000000000000000
0000000000000240:               0x0000000000000000
0000000000000248:               0x0000000000000000
0000000000000250:               0x0000000000000000
0000000000000258:               0x0000000000000000
0000000000000260:               0x0000000000000000
0000000000000268:               0x0000000000000000
0000000000000270:               0x0000000000000000
0000000000000278:               0x0000000000000000
cci_snoop_ctrl_cluster0 =               0x00000000c0000000
cci_snoop_ctrl_cluster1 =               0x00000000c0000000

Searching the net (topic: Unhandled Exception in EL3) I found another person having same issue as my Y8 which he resolved by resetting the device short-circuiting what he called testpoints. I believe that these testpoints are the MASKROM points that shortcircuit emmc clock. But I am not sure:

Code:
http://webcache.googleusercontent.com/search?q=cache:SWO0NRo6sNMJ:bbs.t-firefly.com/forum.php%3Fmod%3Dviewthread%26tid%3D1980+&cd=3&hl=es&ct=clnk&gl=es&client=ubuntu


With the console cable in place, I was able to determine that "mask rom" was not being entered.  I used a piece of wire to short the test points and reset the device until it appeared over USB.  At this point I was able to erase and re-flash it with the Ubuntu image.

For anyone else that experiences this, the tip is to make sure you have good contact on the test points.  Also, its much easier to press the reset button while shorting the pins than it is to plug/un-plug the power connector.


I think  that in the Yundoo Y8 board, these MASKROM or test points are these:

[Image: emmc_clock1.png]

If I shortcircuit the GND to the above ending of the resistor, the one that is pointed by the eMMC clock's arrow, then I get no log at all in the TTY terminal and the USB-C doesn't become accessible either.

So, I shortcircuited the points GND and the other copper point in the image beside the 22ohm label (the one below the resistor) and the emmc seems to be not accessible. Also, some kind of reset seems to happen, but when I release the points, the Unhandled Exception in EL3 hits again.

This is the log in the TTY terminal while shortcircuiting the points:


Code:
DDR Version 1.07 20161103
In
Channel 0: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
Channel 1: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
256B stride
ch 0 ddrconfig = 0x101, ddrsize = 0x2020
ch 1 ddrconfig = 0x101, ddrsize = 0x2020
pmugrf_os_reg[2] = 0x3AA17AA1, stride = 0xD
OUT
Boot1: 2016-07-29, version: 1.05
CPUId = 0x0
ChipType = 10 1844
mmc: ERROR: SDHCI:Transfer data timeout
mmc: ERROR: SDHCI ERR:cmd:0x153a,stat:0x0
mmc: ERROR: Tuning procedure failed, falling back to fixed sampling clock
mmc: ERROR: tuning execution failed
emmc reinit
mmc: ERROR: SDHCI:Transfer data timeout
mmc: ERROR: SDHCI ERR:cmd:0x153a,stat:0x0
mmc: ERROR: Tuning procedure failed, falling back to fixed sampling clock
mmc: ERROR: tuning execution failed
SdmmcInit=2 1
SdmmcInit=0 20
StorageInit ok = 25547134
LoadTrustBL
LoadTrustBL error:-1
powerOn 25959639
Usb re Boot. 5
Usb re Boot. 10000010
Usb re Boot. 20000013
SoftReset
DDR Version 1.07 20161103
In
soft reset
SRX
Channel 0: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
Channel 1: DDR3, 666MHz
Bus Width=32 Col=10 Bank=8 Row=15/15 CS=2 Die Bus-Width=16 Size=2048MB
256B stride
ch 0 ddrconfig = 0x101, ddrsize = 0x2020
ch 1 ddrconfig = 0x101, ddrsize = 0x2020
pmugrf_os_reg[2] = 0x3AA17AA1, stride = 0xD
OUT
Boot1: 2016-07-29, version: 1.05
CPUId = 0x0
ChipType = 10 1907
SdmmcInit=2 0
BootCapSize=100000
UserCapSize=29820MB
FwPartOffset=2000 , 100000
SdmmcInit=0 20
StorageInit ok = 69508
LoadTrustBL
No find bl30.bin
theLoader 200000 90358
LoaderFlag2: 0x5242c300
Unhandled Exception in EL3.
x30 =           0x0000000000045004
x0 =            0x0f1e2d3c4b5a6978
x1 =            0x00000000ff3b1fd0
x2 =            0x0000000000000018
x3 =            0x0000000000000018
x4 =            0x0000000000000018
x5 =            0x0000000000000000
x6 =            0x0000000000000000
x7 =            0x0000000000000000
x8 =            0x0000000003011908
x9 =            0x0000000000010080
x10 =           0x0000000000021888
x11 =           0x0000000000000400
x12 =           0x000000000000000a
x13 =           0x000000000000000f
x14 =           0x0000000000000002
x15 =           0x0000000000000004
x16 =           0x0000000008000000
x17 =           0x0000000000000000
x18 =           0x0000000000800000
x19 =           0x0f1e2d3c4b5a6978
x20 =           0x0000000000049220
x21 =           0x0f1e2d3c4b5a6978
x22 =           0x00000000000418f9
x23 =           0x0000000000041000
x24 =           0x0000000000049230
x25 =           0x0000000000000001
x26 =           0x00000000ff8c2000
x27 =           0x0000000000000110
x28 =           0x0000000000000110
x29 =           0x00000000000468c0
scr_el3 =               0x0000000000000238
sctlr_el3 =             0x0000000000c5383a
cptr_el3 =              0x0000000000000000
tcr_el3 =               0x0000000000000000
daif =          0x00000000000003c0
mair_el3 =              0x44e048e000098aa4
spsr_el3 =              0x00000000600002cc
elr_el3 =               0x0000000000011810
ttbr0_el3 =             0x004d000001480e50
esr_el3 =               0x0000000096000000
far_el3 =               0x0f1e2d3c4b5a6978
spsr_el1 =              0x00000000102d62d4
elr_el1 =               0xb2415e412a408046
spsr_abt =              0x000000002000ba40
spsr_und =              0x0000000042194012
spsr_irq =              0x000000005a022220
spsr_fiq =              0x000000009e000228
sctlr_el1 =             0x0000000000c52838
actlr_el1 =             0x0000000000000000
cpacr_el1 =             0x0000000000000000
csselr_el1 =            0x0000000000000000
sp_el1 =                0x1140d14022000309
esr_el1 =               0x0000000010000940
ttbr0_el1 =             0x5864082d50290402
ttbr1_el1 =             0x0b8a1f2828682009
mair_el1 =              0x44e048e000098aa4
amair_el1 =             0x0000000000000000
tcr_el1 =               0x0000000000000000
tpidr_el1 =             0x040828074d204009
tpidr_el0 =             0x2400be9512480006
tpidrro_el0 =           0x00220257c542220c
dacr32_el2 =            0x0000000000200021
ifsr32_el2 =            0x0000000000000000
par_el1 =               0x4000000909640104
mpidr_el1 =             0x0000000080000000
afsr0_el1 =             0x0000000000000000
afsr1_el1 =             0x0000000000000000
contextidr_el1 =                0x0000000000000000
vbar_el1 =              0x0000000000000000
cntp_ctl_el0 =          0x0000000000000000
cntp_cval_el0 =         0x04040d1429c21301
cntv_ctl_el0 =          0x0000000000000002
cntv_cval_el0 =         0x400401e005006008
cntkctl_el1 =           0x0000000000000000
fpexc32_el2 =           0x0000000000000700
sp_el0 =                0x00000000000468c0
isr_el1 =               0x0000000000000000
cpuectlr_el1 =          0x0000000000000040
cpumerrsr_el1 =         0x0000000000000000
l2merrsr_el1 =          0x0000000000000000
gicc_hppir =            0x0000000000000000
gicc_ahppir =           0x0000000000000000
gicc_ctlr =             0x0000000014000082
gicd_ispendr regs (Offsets 0x200 - 0x278)
0000000000000200:               0x0000001800000000
0000000000000208:               0x0000000000000000
0000000000000210:               0x0000000000000010
0000000000000218:               0x0000000000000000
0000000000000220:               0x0000000000000000
0000000000000228:               0x0000000000000000
0000000000000230:               0x0000000000000000
0000000000000238:               0x0000000000000000
0000000000000240:               0x0000000000000000
0000000000000248:               0x0000000000000000
0000000000000250:               0x0000000000000000
0000000000000258:               0x0000000000000000
0000000000000260:               0x0000000000000000
0000000000000268:               0x0000000000000000
0000000000000270:               0x0000000000000000
0000000000000278:               0x0000000000000000
cci_snoop_ctrl_cluster0 =               0x00000000c0000000
cci_snoop_ctrl_cluster1 =               0x00000000c0000000



After this I don't know what to do.

EDIT: I made a backup for all the partitions with rkflashkit before flashing the linux image. 

Does anybody knows how to solve this issue... or... is my Yundoo Y8  bricked forever?
Reply
IPVanish is probably the best VPN service to use in order to watch movies and TV shows anonymously on Kodi or otherwise. And, Check GearBest $12 Sale (including many TV Boxes and Smartphones!)
#2
Do you know y8 dont support Linx system,so that you fail to boot it
Reply
#3
(08-24-2018, 04:02 AM)Jojo Wrote: Do you know y8 dont support Linx system,so that you fail to boot it

So you know any way to recover my Y8 and reinstall android 7.1? That's my question  Smile
Reply
#4
Got it back to life!

I found this guide http://ugoos.net/blog/reflashing-in-...device-bricked , Looks like it will do the thing. I will follow it and provide some feedback
This guide worked restoring the boot loader and whole device after that. So, I am back with android 7.1

So, just to summarize:

* Maskrom points are the one marked with GND and eMMC Clock (the resitor end closer to the GND copper point) in the above image.
* UART must not be connected
* Disconnect usb and device, start androidtool program (windows)
* Shortcircuit the Maskrom points, I did it with a needle connected to a wire and the other end of this wire soldered to the UART GND point (it is the same as the cooper one marked as GND, but easier to do the soldering)
* Start the device (power button) while holding the shortcircuit for 5 seconds
* press the audio internal switch for 2 seconds while holding the Maskrom points shorcircuited (I think this is not really necessary, but first time my device connected to USB y pressed this hidden switch... so it might be mandatory to press it... I pressed it for couple of seconds then released)
* release audio internal hidden switch
* release the maskrom shortcircuit
* connect the USB-C to the PC and then, the manual at http://ugoos.net/blog/reflashing-in-...device-bricked can be followed as it is:

* press upgrade firmware tab, select the firmware secondary tab, select any ROM image for the Yundoo Y8
* wait for some time for the program to load the ROM (partition will be shown when done) and then select the secondary "Upgrade" tab, and press the upgrade button

That's all... after some minutes, device is with blue light, ready for new adventures

PS. androidtool might be in Chinese, if so, close it, open config.ini and change Selected=2 in the [Language] section.... then save, start it again and it should be in English (I used AndroidTool v2.38)
Reply
IPVanish is probably the best VPN service to use in order to watch movies and TV shows anonymously on Kodi or otherwise. And, Check GearBest $12 Sale (including many TV Boxes and Smartphones!)
#5
Well done ,for you!
Thank you for sharing it!
Reply
#6
(08-24-2018, 04:33 PM)gatos814 Wrote: Well done ,for you!
Thank you for sharing it!

Thanks to you!

BTW, do you know if it is possible to flash the ubuntu 16.04 image for firefly rk3399 (I have Firefly-RK3399-ubuntu16.04-20180416112819.img ) in the Y8?

I tried to flash it with my linux desktop with the command:

sudo upgrade_tool uf Firefly-RK3399-ubuntu16.04-20180416112819.img

It didn't worked at all... the tool didn't show any progress and after around 20 minutes (with no application log/feedback at all) I rebooted the Y8 in the state in described in the 1st post in this thread (Bricked)

Do you know if I could flash this image with other tool? Since firefly RK3399 and Yundoo Y8 have so similar hardware. I wish it is possible that it will work, but I dont find much info in the net.

Also ROCKPro64 and NanoPC-T4 development boards offer linux support for RK3399 and have public images for ubuntu 16.04 / 18.04. Armbian is supporting the RK3399 for ROCKPro64 aswell.

Does anyone here have some stories to share? Otherwise I might start flashing linux images until I definitively kill the Y8 forcing myself to buy something that I was expecting in the 1st place: a RK3399 device with linux support.
Reply
#7
Sorry i don't have this tv box!
So, i don't know!
Regards
Reply
IPVanish is probably the best VPN service to use in order to watch movies and TV shows anonymously on Kodi or otherwise. And, Check GearBest $12 Sale (including many TV Boxes and Smartphones!)


Forum Jump:


Users browsing this thread: 1 Guest(s)
TV Box News