网上搜了一些没见有比较详细的 刚好自己买了 顺便记录
此处可以看到是 1G的 ddr web界面看不到 emmc! 就普普通的web后台


拆机
刷机
看一下启动代码
跑马
跑马和一些 简单信息 接上跑马能直接打断没有密码
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00090-IPQ60xxLZB-2
S - IMAGE_VARIANT_STRING=IPQ6018LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu47
S - Boot Interface: SPI
S - Secure Boot: Off
S - Boot Config @ 0x000a602c = 0x000002e1
S - JTAG ID @ 0x000a607c = 0x0013a0e1
S - OEM ID @ 0x000a6080 = 0x00000000
S - Serial Number @ 0x000a4128 = 0xe42629b6
S - OEM Config Row 0 @ 0x000a4188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x000a4190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x000a4130 = 0x0000000008000001
S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83383000009
S - PBL Patch Ver: 1
S - I-cache: On
S - D-cache: On
B - 3413 - PBL, Start
B - 592 - bootable_media_detect_entry, Start
B - 4339 - bootable_media_detect_success, Start
B - 4435 - elf_loader_entry, Start
B - 4607 - auth_hash_seg_entry, Start
B - 10853 - auth_hash_seg_exit, Start
B - 11349 - elf_segs_hash_verify_entry, Start
B - 357525 - elf_segs_hash_verify_exit, Start
B - 361711 - auth_xbl_sec_hash_seg_entry, Start
B - 361856 - auth_xbl_sec_hash_seg_exit, Start
B - 368401 - xbl_sec_segs_hash_verify_entry, Start
B - 368402 - xbl_sec_segs_hash_verify_exit, Start
B - 369331 - PBL, End
B - 295606 - SBL1, Start
B - 438468 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B - 440908 - clock_init, Start
D - 2501 - clock_init, Delta
B - 449387 - boot_flash_init, Start
D - 8387 - boot_flash_init, Delta
B - 461007 - sbl1_ddr_set_default_params, Start
D - 335 - sbl1_ddr_set_default_params, Delta
B - 467626 - boot_config_data_table_init, Start
D - 1921 - boot_config_data_table_init, Delta - (575 Bytes)
B - 476745 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:2,Subtype:0
B - 482296 - Image Load, Start
D - 6619 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B - 491660 - Image Load, Start
D - 5063 - PMIC Image Loaded, Delta - (0 Bytes)
B - 499529 - sbl1_ddr_set_params, Start
B - 504592 - CPR configuration: 0x555
B - 507703 - Pre_DDR_clock_init, Start
D - 213 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 542290 - Image Load, Start
D - 427 - APDP Image Loaded, Delta - (0 Bytes)
B - 560712 - Image Load, Start
D - 427 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B - 563121 - Image Load, Start
D - 885 - Auth Metadata
D - 671 - Segments hash check
D - 29555 - QSEE Dev Config Image Loaded, Delta - (36498 Bytes)
B - 594536 - Image Load, Start
D - 6802 - Auth Metadata
D - 10401 - Segments hash check
D - 828014 - QSEE Image Loaded, Delta - (1434988 Bytes)
B - 1422977 - Image Load, Start
D - 702 - Auth Metadata
D - 1006 - Segments hash check
D - 64691 - RPM Image Loaded, Delta - (102800 Bytes)
B - 1489040 - Image Load, Start
D - 671 - Auth Metadata
D - 2989 - Segments hash check
D - 301035 - APPSBL Image Loaded, Delta - (531738 Bytes)
B - 1818562 - SBL1, End
D - 1523261 - SBL1, Delta
S - Flash Throughput, 1000 KB/s (2107271 Bytes, 1123796 us)
S - Core 0 Frequency, 800 MHz
S - DDR Frequency, 466 MHz
U-Boot 2016.01 (Oct 08 2022 - 02:11:55 -0700)
DRAM: smem ram ptable found: ver: 2 len: 4
1 GiB
got gpio configNAND: Nand Flash error. Status = 80
Reset cmd status failed
SPI_ADDR_LEN=3
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x800000
8 MiB
MMC: <NULL>: 0
*** Warning - bad CRC, using default environment
PCI0 is not defined in the device tree
In: serial@78B1000
Out: serial@78B1000
Err: serial@78B1000
machid: 8030200
eth5 MAC Address from ART is not valid
Hit any key to stop autoboot: 0
Net: MAC0 addr:0:e0:61:5f:f7:cb
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (0-0)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq6018_edma_alloc_rings: successfull
ipq6018_edma_setup_ring_resources: successfull
ipq6018_edma_configure_rings: successfull
ipq6018_edma_hw_init: successfull
eth0
IPQ6018#
IPQ6018# mmcinfo
Device: <NULL>
Manufacturer ID: d6
OEM: 103
Name: A3A44
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.1
High Capacity: Yes
Capacity: 230.5 GiB
Bus Width: 8-bit
Erase Group Size: 512 KiB
HC WP Group Size: 8 MiB
User Capacity: 230.5 GiB WRREL
Boot Capacity: 4 MiB ENH
RPMB Capacity: 4 MiB ENH
IPQ6018#
IPQ6018# printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=2
eth1addr=0:e0:61:5f:f7:cb
eth2addr=0:e0:61:5f:33:cb
eth3addr=0:e0:61:5f:44:cb
eth4addr=0:e0:61:5f:f7:ca
ethact=eth0
ethaddr=0:e0:61:5f:f7:cb
fdt_high=0x48500000
fdtcontroladdr=4a472000
flash_type=8
ipaddr=192.168.10.10
machid=8030200
netmask=255.255.255.0
serverip=192.168.10.1
soc_version_major=1
soc_version_minor=0
stderr=serial@78B1000
stdin=serial@78B1000
stdout=serial@78B1000
Environment size: 506/65532 bytes
IPQ6018#
IPQ6018# smeminfo
flash_type: 0x6
flash_index: 0x0
flash_chip_select: 0x0
flash_block_size: 0x10000
flash_density: 0x1000000
partition table offset 0x0
No.: Name Attributes Start Size
0: 0:SBL1 0x0000ffff 0x0 0xc0000
1: 0:MIBIB 0x001040ff 0xc0000 0x10000
2: 0:BOOTCONFIG 0x001040ff 0xd0000 0x20000
3: 0:BOOTCONFIG1 0x001040ff 0xf0000 0x20000
4: 0:QSEE 0x0000ffff 0x110000 0x1a0000
5: 0:QSEE_1 0x0000ffff 0x2b0000 0x1a0000
6: 0:DEVCFG 0x0000ffff 0x450000 0x10000
7: 0:DEVCFG_1 0x0000ffff 0x460000 0x10000
8: 0:RPM 0x0000ffff 0x470000 0x40000
9: 0:RPM_1 0x0000ffff 0x4b0000 0x40000
10: 0:CDT 0x0000ffff 0x4f0000 0x10000
11: 0:CDT_1 0x0000ffff 0x500000 0x10000
12: 0:APPSBLENV 0x0000ffff 0x510000 0x10000
13: 0:APPSBL 0x0000ffff 0x520000 0xa0000
14: 0:APPSBL_1 0x0000ffff 0x5c0000 0xa0000
15: 0:ART 0x0000ffff 0x660000 0x40000
IPQ6018#
IPQ6018# mmc part
Partition Map for MMC device 0 -- Partition Type: EFI
Part Start LBA End LBA Name
Attributes
Type GUID
Partition GUID
1 0x00000022 0x00003021 "0:HLOS"
attrs: 0x0000000000000000
type: b51f2982-3ebe-46de-8721-ee641e1f9997
guid: c57bc59c-d6c8-bbf5-5c3f-a5d4438cb6ff
2 0x00003022 0x00006021 "0:HLOS_1"
attrs: 0x0000000000000000
type: a71da577-7f81-4626-b4a2-e377f9174525
guid: ec337cb1-b928-336a-68c8-7a1f3cf03ae6
3 0x00006022 0x00024021 "rootfs"
attrs: 0x0000000000000000
type: 98d2248d-7140-449f-a954-39d67bd6c3b4
guid: 3ac2550f-5f86-0f37-0cb9-59b3208784fe
4 0x00024022 0x00026021 "0:WIFIFW"
attrs: 0x0000000000000000
type: 5911fd72-35be-424e-975d-69c957ad3a43
guid: 8a645e47-eb69-5d44-8805-156fd4b9c278
5 0x00026022 0x00044021 "rootfs_1"
attrs: 0x0000000000000000
type: 5647b280-dc2a-485d-9913-cf53ac40fa32
guid: 8348cdb1-abb0-9fcf-15f8-9ed6b1f21554
6 0x00044022 0x00046021 "0:WIFIFW_1"
attrs: 0x0000000000000000
type: a640a4e3-6aeb-4d83-81a0-dfeae6b7d1a5
guid: a0382913-a2dc-0a6e-fdbb-892428e7df1c
7 0x00046022 0x0006e021 "rootfs_data"
attrs: 0x0000000000000000
type: ab1760da-a8bb-4d6f-98d2-9ad3ab9009cd
guid: 4943cd60-04a4-235f-013f-8ed2abffb8dd
8 0x0006e022 0x009d6021 "app"
attrs: 0x0000000000000000
type: ac176067-a1bc-4c8f-98d1-9bd3ab9011cd
guid: 7ac41eaf-5670-ece5-11e6-2215644973a9
9 0x009d6800 0x149d67ff ""
attrs: 0x0000000000000000
type: 0fc63daf-8483-4772-8e79-3d69d8477de4
guid: a69be341-9779-9440-804a-fd9926ce4878
10 0x149d6800 0x1cad67ff ""
attrs: 0x0000000000000000
type: 0fc63daf-8483-4772-8e79-3d69d8477de4
guid: d5fedd0d-6fc1-6c4b-a167-5b73ea9f0fe8
11 0x1cad6800 0x1cbd67ff ""
attrs: 0x0000000000000000
type: 0fc63daf-8483-4772-8e79-3d69d8477de4
guid: a40b6381-d668-2e46-9407-687a5cb5f98d
IPQ6018#
备份
第一次弄 顺便备份吧
sf probe && sf read 0x50000000 0x000000 0x0c0000 && tftpput 0x50000000 0x0c0000 0_sbl1.bin
sf probe && sf read 0x50000000 0x0c0000 0x0e0000 && tftpput 0x50000000 0x0e0000 1_sbl1bak.bin
sf probe && sf read 0x50000000 0x1a0000 0x1c0000 && tftpput 0x50000000 0x1c0000 4_qsee.bin
sf probe && sf read 0x50000000 0x360000 0x020000 && tftpput 0x50000000 0x020000 6_devcfg.bin
sf probe && sf read 0x50000000 0x380000 0x020000 && tftpput 0x50000000 0x020000 8_rpm.bin
sf probe && sf read 0x50000000 0x3a0000 0x020000 && tftpput 0x50000000 0x020000 9_rpmbak.bin
sf probe && sf read 0x50000000 0x3c0000 0x130000 && tftpput 0x50000000 0x130000 gap_3c0000_to_4f0000.bin # 填充间隙(含可能的 reserved)
sf probe && sf read 0x50000000 0x4f0000 0x010000 && tftpput 0x50000000 0x010000 10_cdt.bin
sf probe && sf read 0x50000000 0x500000 0x020000 && tftpput 0x50000000 0x020000 12_appsblenv.bin
sf probe && sf read 0x50000000 0x520000 0x0a0000 && tftpput 0x50000000 0x0a0000 13_appsbl.bin
sf probe && sf read 0x50000000 0x5c0000 0x0a0000 && tftpput 0x50000000 0x0a0000 14_appsblbak.bin
sf probe && sf read 0x50000000 0x660000 0x040000 && tftpput 0x50000000 0x040000 15_art.bin
sf probe && sf read 0x50000000 0x6a0000 0x160000 && tftpput 0x50000000 0x160000 tail_6a0000_to_end.bin上面是 每个分区 下面是单独备份完整的spi
sf probe && sf read 0x50000000 0x0 0x800000 && tftpput 0x50000000 0x800000 full_spi_8m.bin恢复
# 恢复命令(按顺序执行) 基本也没有人会用。。
sf probe && tftpboot 0x50000000 0_sbl1.bin && sf erase 0x000000 0x0c0000 && sf write 0x50000000 0x000000 0x0c0000
sf probe && tftpboot 0x50000000 1_sbl1bak.bin && sf erase 0x0c0000 0x0e0000 && sf write 0x50000000 0x0c0000 0x0e0000
sf probe && tftpboot 0x50000000 4_qsee.bin && sf erase 0x1a0000 0x1c0000 && sf write 0x50000000 0x1a0000 0x1c0000
sf probe && tftpboot 0x50000000 6_devcfg.bin && sf erase 0x360000 0x020000 && sf write 0x50000000 0x360000 0x020000
sf probe && tftpboot 0x50000000 8_rpm.bin && sf erase 0x380000 0x020000 && sf write 0x50000000 0x380000 0x020000
sf probe && tftpboot 0x50000000 9_rpmbak.bin && sf erase 0x3a0000 0x020000 && sf write 0x50000000 0x3a0000 0x020000
sf probe && tftpboot 0x50000000 gap_3c0000_to_4f0000.bin && sf erase 0x3c0000 0x130000 && sf write 0x50000000 0x3c0000 0x130000
sf probe && tftpboot 0x50000000 10_cdt.bin && sf erase 0x4f0000 0x010000 && sf write 0x50000000 0x4f0000 0x010000
sf probe && tftpboot 0x50000000 12_appsblenv.bin && sf erase 0x500000 0x020000 && sf write 0x50000000 0x500000 0x020000
sf probe && tftpboot 0x50000000 13_appsbl.bin && sf erase 0x520000 0x0a0000 && sf write 0x50000000 0x520000 0x0a0000
sf probe && tftpboot 0x50000000 14_appsblbak.bin && sf erase 0x5c0000 0x0a0000 && sf write 0x50000000 0x5c0000 0x0a0000
sf probe && tftpboot 0x50000000 15_art.bin && sf erase 0x660000 0x040000 && sf write 0x50000000 0x660000 0x040000
sf probe && tftpboot 0x50000000 tail_6a0000_to_end.bin && sf erase 0x6a0000 0x160000 && sf write 0x50000000 0x6a0000 0x160000恢复全SPI的
sf probe && tftpboot 0x50000000 full_spi_8m.bin && sf erase 0x0 0x800000 && sf write 0x50000000 0x0 0x800000一般人 不跑分应该不会再回官方系统了吧
刷机 据说能和亚瑟通刷 但要先去掉spi和改一个电阻 看了下是 好像是在 短接哪里 主板和 亚瑟 ax1800pcb设计是一样的
短接哪里 的电阻刚好拆了移动到下面那个 马上就进入9008了 无法启动!