[U-Boot] Use u-boot to recover bricked NVIDIA SHIELD TV.

[Matthew Gorski]

On Mon, Jun 19, 2017 at 12:22 PM, Matthew Gorski <matt.gorski at gmail.com>
wrote:

>
>
> On Mon, Jun 19, 2017 at 11:53 AM, Stephen Warren <swarren at wwwdotorg.org>
> wrote:
>
>> On 06/18/2017 04:46 PM, Matthew Gorski wrote:
>>
>>> I am curious if there is a possibility to recover a wrongly flashed
>>> NVIDIA SHIELD TV device by flashing u-boot instead of cboot and mounting
>>> the emmc in uboot to do some repairs.
>>>
>>
>> The NVIDIA SHIELD TV is a production Android device, and hence I'm pretty
>> sure it has boot security enabled. This security also applies to the USB
>> recovery mode protocol, so I don't believe you'll be able to communicate
>> with the device unless you know the system's keys, which I assume you don't.
>>
>> There is some support for flashing generic upstream Linux onto the NVIDIA
>> SHIELD tablet, but I believe that relies on  making (at least some of) the
>> modifications from a running system, so if your system isn't booting, I
>> don't expect this will work either. Just in case it's useful, see:
>>
>> https://github.com/linux-shield
>>
>
> Thanks for chiming in Simon and Stephen.  I appreciate you both taking the
> time out of your busy day to answer. I figured the boot security was
> preventing communication to the USB recovery mode protocol.  I tried
> tegrarcm just to see if I could read the bct and no go.  Seems this happens
> quite a bit and there is no way to recover and NVIDIA will not do any
> repairs after the warranty expiration date.  Would have been nice if
> fastboot could have recognized I used the wrong package :/  Maybe a crc
> check to see if the system images match up to the correct device.
>
> Is there anyway to determine what mode I am currently in with tegrarcm
> (assuming I can even get communication)?
>
> Operating Mode:          0x3 (developer mode)
>
>
> Simon the soldering solution sounds interesting.  If someone can elaborate
> on that just for reference that would be great.  Ive always wanted UART on
> foster.  Thanks again guys for your input.  I'll try a few tricks just to
> see what happens and report back.
>
>
>
>
>
> Okay definitely locked down, no communication with APX USB recovery device
in production mode. Error: Return value 3 = No communication with USB
device (even if APX is recognized in linux):

tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
Assuming zero filled SBK key

[1467528.418181] usb 2-1.3: Product: APX
[1467528.418185] usb 2-1.3: Manufacturer: NVIDIA Corp.

sudo ./tegraflash.py --bl cboot.bin --applet nvtboot_recovery.bin --chip
0x21 --cmd "write USP blob"

Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[   0.0655 ] Generating RCM messages
[   0.0803 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 --download rcm
nvtboot_recovery.bin 0 0
[   0.0819 ] RCM 0 is saved as rcm_0.rcm
[   0.0951 ] RCM 1 is saved as rcm_1.rcm
[   0.0952 ] List of rcm files are saved in rcm_list.xml
[   0.0952 ]
[   0.0952 ] Signing RCM messages
[   0.1080 ] tegrasign --key None --list rcm_list.xml --pubkeyhash
pub_key.key
[   0.1097 ] Assuming zero filled SBK key
[   0.1301 ]
[   0.1302 ] Copying signature to RCM mesages
[   0.1318 ] tegrarcm --chip 0x21 --updatesig rcm_list_signed.xml
[   0.1484 ]
[   0.1484 ] Boot Rom communication
[   0.1500 ] tegrarcm --chip 0x21 --rcm rcm_list_signed.xml
[   0.1515 ] BR_CID: 0x621010015c6561861800000010fd8140
[   0.1526 ] RCM version 0X13
[   0.1526 ] Boot Rom communication failed
[   0.1526 ]
Error: Return value 3
Command tegrarcm --chip 0x21 --rcm rcm_list_signed.xml