linuxer
linuxer
发布于 2026-01-08 / 9 阅读
0
0

双渔、飞利浦 LY1800 ax1800pro ipq6010 +1G+256G

网上搜了一些没见有比较详细的 刚好自己买了 顺便记录

此处可以看到是 1G的 ddr web界面看不到 emmc! 就普普通的web后台

拆机

刷机

看一下启动代码

跑马

跑马和一些 简单信息 接上跑马能直接打断没有密码

Format: Log Type - Time(microsec) - Message - Optional Info

Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic

S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00090-IPQ60xxLZB-2

S - IMAGE_VARIANT_STRING=IPQ6018LA

S - OEM_IMAGE_VERSION_STRING=crm-ubuntu47

S - Boot Interface: SPI

S - Secure Boot: Off

S - Boot Config @ 0x000a602c = 0x000002e1

S - JTAG ID @ 0x000a607c = 0x0013a0e1

S - OEM ID @ 0x000a6080 = 0x00000000

S - Serial Number @ 0x000a4128 = 0xe42629b6

S - OEM Config Row 0 @ 0x000a4188 = 0x0000000000000000

S - OEM Config Row 1 @ 0x000a4190 = 0x0000000000000000

S - Feature Config Row 0 @ 0x000a4130 = 0x0000000008000001

S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83383000009

S - PBL Patch Ver: 1

S - I-cache: On

S - D-cache: On

B - 3413 - PBL, Start

B - 592 - bootable_media_detect_entry, Start

B - 4339 - bootable_media_detect_success, Start

B - 4435 - elf_loader_entry, Start

B - 4607 - auth_hash_seg_entry, Start

B - 10853 - auth_hash_seg_exit, Start

B - 11349 - elf_segs_hash_verify_entry, Start

B - 357525 - elf_segs_hash_verify_exit, Start

B - 361711 - auth_xbl_sec_hash_seg_entry, Start

B - 361856 - auth_xbl_sec_hash_seg_exit, Start

B - 368401 - xbl_sec_segs_hash_verify_entry, Start

B - 368402 - xbl_sec_segs_hash_verify_exit, Start

B - 369331 - PBL, End

B - 295606 - SBL1, Start

B - 438468 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4

B - 440908 - clock_init, Start

D - 2501 - clock_init, Delta

B - 449387 - boot_flash_init, Start

D - 8387 - boot_flash_init, Delta

B - 461007 - sbl1_ddr_set_default_params, Start

D - 335 - sbl1_ddr_set_default_params, Delta

B - 467626 - boot_config_data_table_init, Start

D - 1921 - boot_config_data_table_init, Delta - (575 Bytes)

B - 476745 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:2,Subtype:0

B - 482296 - Image Load, Start

D - 6619 - OEM_MISC Image Loaded, Delta - (0 Bytes)

B - 491660 - Image Load, Start

D - 5063 - PMIC Image Loaded, Delta - (0 Bytes)

B - 499529 - sbl1_ddr_set_params, Start

B - 504592 - CPR configuration: 0x555

B - 507703 - Pre_DDR_clock_init, Start

D - 213 - Pre_DDR_clock_init, Delta

D - 0 - sbl1_ddr_set_params, Delta

B - 542290 - Image Load, Start

D - 427 - APDP Image Loaded, Delta - (0 Bytes)

B - 560712 - Image Load, Start

D - 427 - QTI_MISC Image Loaded, Delta - (0 Bytes)

B - 563121 - Image Load, Start

D - 885 - Auth Metadata

D - 671 - Segments hash check

D - 29555 - QSEE Dev Config Image Loaded, Delta - (36498 Bytes)

B - 594536 - Image Load, Start

D - 6802 - Auth Metadata

D - 10401 - Segments hash check

D - 828014 - QSEE Image Loaded, Delta - (1434988 Bytes)

B - 1422977 - Image Load, Start

D - 702 - Auth Metadata

D - 1006 - Segments hash check

D - 64691 - RPM Image Loaded, Delta - (102800 Bytes)

B - 1489040 - Image Load, Start

D - 671 - Auth Metadata

D - 2989 - Segments hash check

D - 301035 - APPSBL Image Loaded, Delta - (531738 Bytes)

B - 1818562 - SBL1, End

D - 1523261 - SBL1, Delta

S - Flash Throughput, 1000 KB/s (2107271 Bytes, 1123796 us)

S - Core 0 Frequency, 800 MHz

S - DDR Frequency, 466 MHz

U-Boot 2016.01 (Oct 08 2022 - 02:11:55 -0700)

DRAM: smem ram ptable found: ver: 2 len: 4

1 GiB

got gpio configNAND: Nand Flash error. Status = 80

Reset cmd status failed

SPI_ADDR_LEN=3

SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB

ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x800000

8 MiB

MMC: <NULL>: 0

*** Warning - bad CRC, using default environment

PCI0 is not defined in the device tree

In: serial@78B1000

Out: serial@78B1000

Err: serial@78B1000

machid: 8030200

eth5 MAC Address from ART is not valid

Hit any key to stop autoboot: 0

Net: MAC0 addr:0:e0:61:5f:f7:cb

PHY ID1: 0x4d

PHY ID2: 0xd0b1

EDMA ver 1 hw init

Num rings - TxDesc:1 (0-0) TxCmpl:1 (0-0)

RxDesc:1 (15-15) RxFill:1 (7-7)

ipq6018_edma_alloc_rings: successfull

ipq6018_edma_setup_ring_resources: successfull

ipq6018_edma_configure_rings: successfull

ipq6018_edma_hw_init: successfull

eth0

IPQ6018#

IPQ6018# mmcinfo

Device: <NULL>

Manufacturer ID: d6

OEM: 103

Name: A3A44

Tran Speed: 52000000

Rd Block Len: 512

MMC version 5.1

High Capacity: Yes

Capacity: 230.5 GiB

Bus Width: 8-bit

Erase Group Size: 512 KiB

HC WP Group Size: 8 MiB

User Capacity: 230.5 GiB WRREL

Boot Capacity: 4 MiB ENH

RPMB Capacity: 4 MiB ENH

IPQ6018#

IPQ6018# printenv

baudrate=115200

bootargs=console=ttyMSM0,115200n8

bootcmd=bootipq

bootdelay=2

eth1addr=0:e0:61:5f:f7:cb

eth2addr=0:e0:61:5f:33:cb

eth3addr=0:e0:61:5f:44:cb

eth4addr=0:e0:61:5f:f7:ca

ethact=eth0

ethaddr=0:e0:61:5f:f7:cb

fdt_high=0x48500000

fdtcontroladdr=4a472000

flash_type=8

ipaddr=192.168.10.10

machid=8030200

netmask=255.255.255.0

serverip=192.168.10.1

soc_version_major=1

soc_version_minor=0

stderr=serial@78B1000

stdin=serial@78B1000

stdout=serial@78B1000

Environment size: 506/65532 bytes

IPQ6018#

IPQ6018# smeminfo

flash_type: 0x6

flash_index: 0x0

flash_chip_select: 0x0

flash_block_size: 0x10000

flash_density: 0x1000000

partition table offset 0x0

No.: Name Attributes Start Size

0: 0:SBL1 0x0000ffff 0x0 0xc0000

1: 0:MIBIB 0x001040ff 0xc0000 0x10000

2: 0:BOOTCONFIG 0x001040ff 0xd0000 0x20000

3: 0:BOOTCONFIG1 0x001040ff 0xf0000 0x20000

4: 0:QSEE 0x0000ffff 0x110000 0x1a0000

5: 0:QSEE_1 0x0000ffff 0x2b0000 0x1a0000

6: 0:DEVCFG 0x0000ffff 0x450000 0x10000

7: 0:DEVCFG_1 0x0000ffff 0x460000 0x10000

8: 0:RPM 0x0000ffff 0x470000 0x40000

9: 0:RPM_1 0x0000ffff 0x4b0000 0x40000

10: 0:CDT 0x0000ffff 0x4f0000 0x10000

11: 0:CDT_1 0x0000ffff 0x500000 0x10000

12: 0:APPSBLENV 0x0000ffff 0x510000 0x10000

13: 0:APPSBL 0x0000ffff 0x520000 0xa0000

14: 0:APPSBL_1 0x0000ffff 0x5c0000 0xa0000

15: 0:ART 0x0000ffff 0x660000 0x40000

IPQ6018#

IPQ6018# mmc part

Partition Map for MMC device 0 -- Partition Type: EFI

Part Start LBA End LBA Name

Attributes

Type GUID

Partition GUID

1 0x00000022 0x00003021 "0:HLOS"

attrs: 0x0000000000000000

type: b51f2982-3ebe-46de-8721-ee641e1f9997

guid: c57bc59c-d6c8-bbf5-5c3f-a5d4438cb6ff

2 0x00003022 0x00006021 "0:HLOS_1"

attrs: 0x0000000000000000

type: a71da577-7f81-4626-b4a2-e377f9174525

guid: ec337cb1-b928-336a-68c8-7a1f3cf03ae6

3 0x00006022 0x00024021 "rootfs"

attrs: 0x0000000000000000

type: 98d2248d-7140-449f-a954-39d67bd6c3b4

guid: 3ac2550f-5f86-0f37-0cb9-59b3208784fe

4 0x00024022 0x00026021 "0:WIFIFW"

attrs: 0x0000000000000000

type: 5911fd72-35be-424e-975d-69c957ad3a43

guid: 8a645e47-eb69-5d44-8805-156fd4b9c278

5 0x00026022 0x00044021 "rootfs_1"

attrs: 0x0000000000000000

type: 5647b280-dc2a-485d-9913-cf53ac40fa32

guid: 8348cdb1-abb0-9fcf-15f8-9ed6b1f21554

6 0x00044022 0x00046021 "0:WIFIFW_1"

attrs: 0x0000000000000000

type: a640a4e3-6aeb-4d83-81a0-dfeae6b7d1a5

guid: a0382913-a2dc-0a6e-fdbb-892428e7df1c

7 0x00046022 0x0006e021 "rootfs_data"

attrs: 0x0000000000000000

type: ab1760da-a8bb-4d6f-98d2-9ad3ab9009cd

guid: 4943cd60-04a4-235f-013f-8ed2abffb8dd

8 0x0006e022 0x009d6021 "app"

attrs: 0x0000000000000000

type: ac176067-a1bc-4c8f-98d1-9bd3ab9011cd

guid: 7ac41eaf-5670-ece5-11e6-2215644973a9

9 0x009d6800 0x149d67ff ""

attrs: 0x0000000000000000

type: 0fc63daf-8483-4772-8e79-3d69d8477de4

guid: a69be341-9779-9440-804a-fd9926ce4878

10 0x149d6800 0x1cad67ff ""

attrs: 0x0000000000000000

type: 0fc63daf-8483-4772-8e79-3d69d8477de4

guid: d5fedd0d-6fc1-6c4b-a167-5b73ea9f0fe8

11 0x1cad6800 0x1cbd67ff ""

attrs: 0x0000000000000000

type: 0fc63daf-8483-4772-8e79-3d69d8477de4

guid: a40b6381-d668-2e46-9407-687a5cb5f98d

IPQ6018#

备份

第一次弄 顺便备份吧

sf probe && sf read 0x50000000 0x000000 0x0c0000 && tftpput 0x50000000 0x0c0000 0_sbl1.bin
sf probe && sf read 0x50000000 0x0c0000 0x0e0000 && tftpput 0x50000000 0x0e0000 1_sbl1bak.bin
sf probe && sf read 0x50000000 0x1a0000 0x1c0000 && tftpput 0x50000000 0x1c0000 4_qsee.bin
sf probe && sf read 0x50000000 0x360000 0x020000 && tftpput 0x50000000 0x020000 6_devcfg.bin
sf probe && sf read 0x50000000 0x380000 0x020000 && tftpput 0x50000000 0x020000 8_rpm.bin
sf probe && sf read 0x50000000 0x3a0000 0x020000 && tftpput 0x50000000 0x020000 9_rpmbak.bin
sf probe && sf read 0x50000000 0x3c0000 0x130000 && tftpput 0x50000000 0x130000 gap_3c0000_to_4f0000.bin   # 填充间隙(含可能的 reserved)
sf probe && sf read 0x50000000 0x4f0000 0x010000 && tftpput 0x50000000 0x010000 10_cdt.bin
sf probe && sf read 0x50000000 0x500000 0x020000 && tftpput 0x50000000 0x020000 12_appsblenv.bin
sf probe && sf read 0x50000000 0x520000 0x0a0000 && tftpput 0x50000000 0x0a0000 13_appsbl.bin
sf probe && sf read 0x50000000 0x5c0000 0x0a0000 && tftpput 0x50000000 0x0a0000 14_appsblbak.bin
sf probe && sf read 0x50000000 0x660000 0x040000 && tftpput 0x50000000 0x040000 15_art.bin
sf probe && sf read 0x50000000 0x6a0000 0x160000 && tftpput 0x50000000 0x160000 tail_6a0000_to_end.bin

上面是 每个分区 下面是单独备份完整的spi

sf probe && sf read 0x50000000 0x0 0x800000 && tftpput 0x50000000 0x800000 full_spi_8m.bin


恢复

# 恢复命令(按顺序执行)   基本也没有人会用。。
sf probe && tftpboot 0x50000000 0_sbl1.bin && sf erase 0x000000 0x0c0000 && sf write 0x50000000 0x000000 0x0c0000
sf probe && tftpboot 0x50000000 1_sbl1bak.bin && sf erase 0x0c0000 0x0e0000 && sf write 0x50000000 0x0c0000 0x0e0000
sf probe && tftpboot 0x50000000 4_qsee.bin && sf erase 0x1a0000 0x1c0000 && sf write 0x50000000 0x1a0000 0x1c0000
sf probe && tftpboot 0x50000000 6_devcfg.bin && sf erase 0x360000 0x020000 && sf write 0x50000000 0x360000 0x020000
sf probe && tftpboot 0x50000000 8_rpm.bin && sf erase 0x380000 0x020000 && sf write 0x50000000 0x380000 0x020000
sf probe && tftpboot 0x50000000 9_rpmbak.bin && sf erase 0x3a0000 0x020000 && sf write 0x50000000 0x3a0000 0x020000
sf probe && tftpboot 0x50000000 gap_3c0000_to_4f0000.bin && sf erase 0x3c0000 0x130000 && sf write 0x50000000 0x3c0000 0x130000
sf probe && tftpboot 0x50000000 10_cdt.bin && sf erase 0x4f0000 0x010000 && sf write 0x50000000 0x4f0000 0x010000
sf probe && tftpboot 0x50000000 12_appsblenv.bin && sf erase 0x500000 0x020000 && sf write 0x50000000 0x500000 0x020000
sf probe && tftpboot 0x50000000 13_appsbl.bin && sf erase 0x520000 0x0a0000 && sf write 0x50000000 0x520000 0x0a0000
sf probe && tftpboot 0x50000000 14_appsblbak.bin && sf erase 0x5c0000 0x0a0000 && sf write 0x50000000 0x5c0000 0x0a0000
sf probe && tftpboot 0x50000000 15_art.bin && sf erase 0x660000 0x040000 && sf write 0x50000000 0x660000 0x040000
sf probe && tftpboot 0x50000000 tail_6a0000_to_end.bin && sf erase 0x6a0000 0x160000 && sf write 0x50000000 0x6a0000 0x160000

恢复全SPI的

sf probe && tftpboot 0x50000000 full_spi_8m.bin && sf erase 0x0 0x800000 && sf write 0x50000000 0x0 0x800000


一般人 不跑分应该不会再回官方系统了吧



刷机 据说能和亚瑟通刷 但要先去掉spi和改一个电阻 看了下是 好像是在 短接哪里 主板和 亚瑟 ax1800pcb设计是一样的

短接哪里 的电阻刚好拆了移动到下面那个 马上就进入9008了 无法启动!


评论