Bricked 7601 with incompatible release (17)

I’ve managed to brick my mangoRed with WP7601 by loading Release-17 firmware onto it.

With 17 on it, I could still run a few commands via the console each time it “woke up” due to activity on one of the serial USB-gadget ports, so I tried to erase the user partition and system partition (mtd_erase) hoping to allow overwriting those with the correct image.

I used swiflash (and also qmi-firmware-update) to attempt reflashing with the recommended red_wp76xx_0.6.0.spk and the WP76xx_Release16.0.1_GENERIC.spk but neither of these seems to work.

Is there anyway to restore this device to factory condition?

Also, why does the bootloader allow an incompatible load to be installed?

Here is the boot log:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2-00096
S - IMAGE_VARIANT_STRING=LAATANAZA
S - OEM_IMAGE_VERSION_STRING=SWI9X07Y_03.01.07.00 41ad93 jenkins 2023/03/16 10:58:16
S - Boot Config, 0x000002e1
B -      1216 - PBL, Start
B -      3720 - bootable_media_detect_entry, Start
B -      4394 - bootable_media_detect_success, Start
B -      4399 - elf_loader_entry, Start
B -      7852 - auth_hash_seg_entry, Start
B -     31565 - auth_hash_seg_exit, Start
B -     82910 - elf_segs_hash_verify_entry, Start
B -    129972 - PBL, End
B -    138409 - SBL1, Start
B -    200415 - pm_device_init, Start
B -    220545 - PM_SET_VAL:Skip
D -     18818 - pm_device_init, Delta
B -    222192 - boot_config_data_table_init, Start
D -         0 - boot_config_data_table_init, Delta - (0 Bytes)
B -    230671 - CDT version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:129
B -    237473 - sbl1_ddr_set_params, Start
B -    241316 - Pre_DDR_clock_init, Start
D -       213 - Pre_DDR_clock_init, Delta
D -         0 - sbl1_ddr_set_params, Delta
B -    254004 - pm_driver_init, Start
D -      4483 - pm_driver_init, Delta
B -    260348 - cpr_init, Start
D -       122 - cpr_init, Delta
B -    264923 - cpr_cx_mx_apc_vol_update, Start
D -        91 - cpr_cx_mx_apc_vol_update, Delta
B -    280112 - clock_init, Start
D -       183 - clock_init, Delta
B -    280356 - boot_flash_init, Start
D -     39924 - boot_flash_init, Delta
B -    323300 - boot_flash_swi_ddr_init, Start
D -     30713 - boot_flash_swi_ddr_init, Delta
B -    520970 - hw_family:5, hw_type:14, hw_rev:40
B -    525332 - SSMEM init OK
B -    528870 - DEBUG OU: 0000000000000002
B -    528931 - DEBUG OU - setting: 2
B -    529724 - is_memory_dump_allowed (0) in this secure module
B -    552263 - USB non-zero endpoint requirements: 9 in, 5 out
B -    554490 - opening partition 0:SWIFOTA
B -    556045 - error for readpage:0
B -    561352 - DWL-get: ecnt=6 code=6
B -    568916 - API change: date not generated by cwe_header_init
B -    575565 - Failed to read size: /swinv/item_files/CUST_IM_SWITCH_HIDE
B -    581604 - Failed to read size: /swinv/item_files/FOTA_PARTITION
B -    582702 - Failed to read size: /swinv/item_files/CUST_IM_CONFIG
B -    595390 - flags: u=1 e=1 obmsk=c,0
B -    604052 - error for readpage:0
B -    604571 - error for readpage:64
B -    605181 - error for readpage:128
B -    608322 - error for readpage:192
B -    611342 - ssmem_release: region 20 not exists
B -    616008 - ssmem_get: region 20 not exists
B -    622200 - smart recovery counter cleared
B -    624640 - DWL-ety: rea=2 rcv=0
B -   1057343 - Sahara over USB
B - 432252801 - Sahara: Hello pkt sent
B - 462629337 - Imagetype=0x14 compat_id=0x00
B - 462630496 - Imagetype=0x07 compat_id=0x01
B - 462631106 - Imagetype=0x07 compat_id=0x01 incompatible with Flash!
B - 462638030 - Imagetype=0x15 compat_id=0x00
B - 463237782 - Imagetype=0x13 compat_id=0x00
B - 463268129 - Imagetype=0x08 compat_id=0x01
B - 463268404 - Imagetype=0x0C compat_id=0x01 incompatible with Flash!
B - 463272552 - Imagetype=0x08 compat_id=0x00
B - 463276547 - Imagetype=0x17 compat_id=0x00 incompatible with Flash!
B - 463282769 - Imagetype=0x07 compat_id=0x01
B - 463286643 - Imagetype=0x07 compat_id=0x01 incompatible with Flash!
B - 463293353 - Imagetype=0x15 compat_id=0x00
B - 467874971 - Imagetype=0x13 compat_id=0x00
B - 467914957 - Unknown image_val 462C202F
B - 467917031 - Unknown image_val 00000000
B - 467934904 - Found free pages at 36 for image size 21590
B - 467938777 - Imagetype=0x08 compat_id=0x01
B - 467939052 - Imagetype=0x0C compat_id=0x01 incompatible with Flash!
B - 467944755 - Imagetype=0x08 compat_id=0x00
B - 467948629 - Imagetype=0x17 compat_id=0x00 incompatible with Flash!
B - 467954668 - BOOT_HOLD=6,SMART_RECOVERY=yes,DOWNLOADER=boot,VERSION=9999999_9907152_SWI9X07Y_02.37.03.00_00_GENERIC_002.095_003,TYPE=SPKG,SUBIMAGE=DSP2,SUBIMAGE=DSP2,STATUS=PASS
B - 468973459 - API change: date not generated by cwe_header_init
B - 468973673 - API change: date not generated by cwe_header_init
B - 468982091 - Unknown image_val 462C202F
B - 468984531 - Unknown image_val 00000000
B - 46900432
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2-00096
S - IMAGE_VARIANT_STRING=LAATANAZA
S - OEM_IMAGE_VERSION_STRING=SWI9X07Y_03.01.07.00 41ad93 jenkins 2023/03/16 10:58:16
S - Boot Config, 0x000002e1
B -      1216 - PBL, Start
B -      3720 - bootable_media_detect_entry, Start
B -      4395 - bootable_media_detect_success, Start
B -      4400 - elf_loader_entry, Start
B -      7854 - auth_hash_seg_entry, Start
B -     31567 - auth_hash_seg_exit, Start
B -     82949 - elf_segs_hash_verify_entry, Start
B -    130012 - PBL, End
B -    138409 - SBL1, Start
B -    200415 - pm_device_init, Start
B -    220515 - PM_SET_VAL:Skip
D -     18818 - pm_device_init, Delta
B -    222162 - boot_config_data_table_init, Start
D -         0 - boot_config_data_table_init, Delta - (0 Bytes)
B -    230641 - CDT version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:129
B -    237534 - sbl1_ddr_set_params, Start
B -    241285 - Pre_DDR_clock_init, Start
D -       213 - Pre_DDR_clock_init, Delta
D -         0 - sbl1_ddr_set_params, Delta
B -    253973 - pm_driver_init, Start
D -      4483 - pm_driver_init, Delta
B -    260317 - cpr_init, Start
D -       122 - cpr_init, Delta
B -    264892 - cpr_cx_mx_apc_vol_update, Start
D -        91 - cpr_cx_mx_apc_vol_update, Delta
B -    280081 - clock_init, Start
D -       152 - clock_init, Delta
B -    280325 - boot_flash_init, Start
D -     39924 - boot_flash_init, Delta
B -    323269 - boot_flash_swi_ddr_init, Start
D -     30683 - boot_flash_swi_ddr_init, Delta
B -    520879 - hw_family:5, hw_type:14, hw_rev:40
B -    525240 - SSMEM init OK
B -    528809 - DEBUG OU: 0000000000000002
B -    528870 - DEBUG OU - setting: 2
B -    529632 - is_memory_dump_allowed (0) in this secure module
B -    552202 - USB non-zero endpoint requirements: 9 in, 5 out
B -    554429 - opening partition 0:SWIFOTA
B -    555984 - error for readpage:0
B -    561291 - DWL-get: ecnt=0 code=0
B -    568825 - API change: date not generated by cwe_header_init
B -    575474 - Failed to read size: /swinv/item_files/CUST_IM_SWITCH_HIDE
B -    581482 - Failed to read size: /swinv/item_files/FOTA_PARTITION
B -    582580 - Failed to read size: /swinv/item_files/CUST_IM_CONFIG
B -    595268 - flags: u=1 e=1 obmsk=c,0
B -    603961 - error for readpage:0
B -    604449 - error for readpage:64
B -    605089 - error for readpage:128
B -    608200 - error for readpage:192
B -    611250 - ssmem_release: region 20 not exists
B -    615886 - ssmem_get: region 20 not exists
B -    621590 - Image Load, Start
D -    145149 - QSEE Image Loaded, Delta - (930032 Bytes)
D -       213 - boot_pm_post_tz_device_init, Delta
B -    771162 - sbl1_efs_handle_cookies, Start
D -         0 - sbl1_efs_handle_cookies, Delta
B -    779092 - Image Load, Start
D -     38765 - DEVCFG Image Loaded, Delta - (31520 Bytes)
B -    817888 - Image Load, Start
D -        30 - SEC Image Loaded, Delta - (0 Bytes)
B -    824506 - Image Load, Start
D -     55602 - RPM Image Loaded, Delta - (154680 Bytes)
B -    880809 - Image Load, Start
B -    883127 - Auth disabled for image 9
B -    929426 - error for readpage:0
B -    929914 - error for readpage:64
B -    930555 - error for readpage:128
B -    933666 - error for readpage:192
B -    936716 - ssmem_release: region 20 not exists
B -    941382 - ssmem_get: region 20 not exists
D -     64843 - APPSBL Image Loaded, Delta - (440068 Bytes)
B -    950929 - QSEE Execution, Start
D -       854 - QSEE Execution, Delta
B -    957608 - SBL1, End
D -    821578 - SBL1, Delta
S - Throughput, 9000 KB/s  (1743540 Bytes,  192143 us)
S - DDR Frequency, 240 MHz
Android Bootloader - UART_DM Initialized!!!
[10] QUP: I2C status flags :0x1363c8 
[10] QUP: I2C status flags :0x11163c8 
[40] Board: MangOH Red
[40] ERROR: No devinfo partition found
[40] Neither 'config' nor 'frp' partition found
[50] ERROR: No misc partition found
[1960] SSMEM init OK[1960] ssmem_get: region 20 not exists[2060] DEBUG: cmdline has root=
[2120] Channel alloc freed
[    0.057825] msm_watchdog b017000.qcom,wdt: Couldn't get memory for dump
[    0.058919] unable to find DT imem DLOAD mode node
[    0.059401] unable to find DT imem EDLOAD mode node
[    0.059836] unable to find DT imem dload-type node
[    0.074011] mdm9607-pinctrl 1000000.pinctrl: invalid resource
[    0.074950] SWI ssmem_framework_init: SSMEM init OK
[    0.075020] mdm9607-pinctrl 1000000.pinctrl: gpio-bit-map = 36
[    0.150908] running cpufreq for CPU0 without cooling dev: -38
[    0.184323] msm_bus_fabric_init_driver
[    0.526526] qcom-sps-dma 7884000.qcom,sps-dma: dma_async_device_register: device has no channels!
[    0.624406] msm_serial 78b0000.serial: Disabled 
[    0.633654] mdm9607-pinctrl 1000000.pinctrl: pin GPIO_12 already requested by 78af000.serial; cannot claim for 78af000.uart
[    0.637576] mdm9607-pinctrl 1000000.pinctrl: pin-12 (78af000.uart) status -22
[    0.648497] mdm9607-pinctrl 1000000.pinctrl: could not request pin 12 (GPIO_12) from group gpio12  on device 1000000.pinctrl
[    0.655758] msm_serial_hs 78af000.uart: Error applying setting, reverse things back
[    0.667211] uart_tx_gpio is not available
[    0.674430] uart_rx_gpio is not available
[    0.678543] uart_cts_gpio is not available
[    0.682577] uart_rfr_gpio is not available
[    0.687042] sps: BAM device 0x07884000 is not registered yet.
[    0.701210] diag: diag_pcie_register: failed registering pcie channels
[    0.701240] diag: MUX: unable to register pcie operations for proc: 0, err: -22
[    0.706626] diag: MUX: unable to register PCIe operations, continuing with USB registrations for proc: 0, err: -22
[    0.744537] sps: BAM device 0x07984000 is not registered yet.
[    0.767931] msm_otg 78d9000.usb: usb_add_phy failed
[    0.801852] msm_hsic_host 7c00000.hsic_host: Probe success
[    0.861364] swimcu_lpo_calibrate_calc: bogus data MCU time=30000 vs MDM time=5 
[    0.902209] msm_otg 78d9000.usb: Could not get usb power_supply
[    0.902236] msm_otg 78d9000.usb: Could not get usb power_supply
[    0.909895] Error registering TZ zone:-19 for dt_ch:52
[    0.934728] calculate_residency: residency < 0 for LPM
[    0.934751] parse_cpu_levels: idx 1 420
[    0.938749] calculate_residency: residency < 0 for LPM
[    0.942916] parse_cpu_levels: idx 2 500
[    0.947800] parse_cpu_levels: idx 2 3040
ima: setting up IMA subsystem...
ima: feature not supported
The proc node does not exist
mount root fs from partition (rootfs|system)
[    1.015584] msm_otg 78d9000.usb: Could not get usb power_supply
[    1.015613] msm_otg 78d9000.usb: Could not get usb power_supply
Cannot find UBI container on MTD 13.
It is not dual system logic
System error!
[    1.070844] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[    1.070844] 
[    1.070890] CPU: 0 PID: 1 Comm: init Not tainted 4.14.253 #1
[    1.079762] Hardware name: Qualcomm Technologies, Inc. MDM 9607 (Flattened Device Tree)
[    1.085431] [<c010d010>] (unwind_backtrace) from [<c010b04c>] (show_stack+0x10/0x14)
[    1.093139] [<c010b04c>] (show_stack) from [<c082c318>] (panic+0x150/0x34c)
[    1.101121] [<c082c318>] (panic) from [<c011e538>] (do_exit+0x174/0xaf4)
[    1.107807] [<c011e538>] (do_exit) from [<c011ef38>] (do_group_exit+0x54/0xe4)
[    1.114753] [<c011ef38>] (do_group_exit) from [<c011efd8>] (__wake_up_parent+0x0/0x18)
[    1.121784] msm_bus_panic_callback: fab-bimc: sleep max_ib: 800000000: client-name: hsic
[    1.129678] msm_bus_panic_callback: fab-bimc: active max_ib: 2399141888: client-name: soc:qcom,cpubw
[    1.137923] msm_bus_panic_callback: fab-bimc: sleep max_ab: 400000000: client-name: qpic_nand
[    1.147039] msm_bus_panic_callback: fab-bimc: active max_ab: 400000000: client-name: qpic_nand
[    1.155460] msm_bus_panic_callback: fab-pcnoc: sleep max_ib: 800000000: client-name: hsic
[    1.163965] msm_bus_panic_callback: fab-pcnoc: active max_ib: 800000000: client-name: hsic
[    1.172213] msm_bus_panic_callback: fab-pcnoc: sleep max_ab: 400000000: client-name: qpic_nand
[    1.180372] msm_bus_panic_callback: fab-pcnoc: active max_ab: 400000000: client-name: qpic_nand
[    1.188989] ------------[ cut here ]------------
[    1.197561] WARNING: CPU: 0 PID: 1 at kernel/rcu/tree_plugin.h:329 rcu_note_context_switch+0xb0/0x578
[    1.202419] Modules linked in:
[    1.211532] CPU: 0 PID: 1 Comm: init Not tainted 4.14.253 #1
[    1.214484] Hardware name: Qualcomm Technologies, Inc. MDM 9607 (Flattened Device Tree)
[    1.220310] [<c010d010>] (unwind_backtrace) from [<c010b04c>] (show_stack+0x10/0x14)
[    1.228028] [<c010b04c>] (show_stack) from [<c011ba80>] (__warn+0xd4/0xf0)
[    1.236019] [<c011ba80>] (__warn) from [<c011bb40>] (warn_slowpath_null+0x1c/0x24)
[    1.242703] [<c011bb40>] (warn_slowpath_null) from [<c0166220>] (rcu_note_context_switch+0xb0/0x578)
[    1.250257] [<c0166220>] (rcu_note_context_switch) from [<c0836ff4>] (__schedule+0x9c/0x638)
[    1.259546] [<c0836ff4>] (__schedule) from [<c0837620>] (schedule+0x90/0xac)
[    1.267961] [<c0837620>] (schedule) from [<c083b990>] (schedule_timeout+0x35c/0x3a0)
[    1.274997] [<c083b990>] (schedule_timeout) from [<c016ac7c>] (msleep+0x18/0x1c)
[    1.282724] [<c016ac7c>] (msleep) from [<c03c1dfc>] (subsys_panic+0x18/0x28)
[    1.290101] [<c03c1dfc>] (subsys_panic) from [<c0441a5c>] (bus_for_each_dev+0x7c/0x8c)
[    1.297133] [<c0441a5c>] (bus_for_each_dev) from [<c03c2b34>] (ssr_panic_handler+0x18/0x28)
[    1.304860] [<c03c2b34>] (ssr_panic_handler) from [<c0139514>] (notifier_call_chain+0x40/0x64)
[    1.313101] [<c0139514>] (notifier_call_chain) from [<c0139678>] (__atomic_notifier_call_chain+0x34/0x48)
[    1.321786] [<c0139678>] (__atomic_notifier_call_chain) from [<c01396a0>] (atomic_notifier_call_chain+0x14/0x1c)
[    1.331421] [<c01396a0>] (atomic_notifier_call_chain) from [<c082c334>] (panic+0x16c/0x34c)
[    1.341659] [<c082c334>] (panic) from [<c011e538>] (do_exit+0x174/0xaf4)
[    1.349734] [<c011e538>] (do_exit) from [<c011ef38>] (do_group_exit+0x54/0xe4)
[    1.356677] [<c011ef38>] (do_group_exit) from [<c011efd8>] (__wake_up_parent+0x0/0x18)
[    1.363707] ---[ end trace 032332db567ba191 ]---
[    1.376435] msm_rpm_flush_requests: Error: more than 24 requests are buffered
[    1.462137] usb 1-1: New USB device found, idVendor=0424, idProduct=3503
[    1.462170] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    1.468476] hub 1-1:1.0: USB hub found
[    1.475386] hub 1-1:1.0: 3 ports detected
[    1.760464] usb 1-1.1: new full-speed USB device number 3 using msm_hsic_host
[    1.876553] usb 1-1.1: New USB device found, idVendor=10c4, idProduct=87a0
[    1.876586] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    1.882446] usb 1-1.1: Product: CP2130 USB-to-SPI Bridge
[    1.889576] usb 1-1.1: Manufacturer: Silicon Laboratories
[    1.895133] usb 1-1.1: SerialNumber: 000EB761
[    2.080455] cpr_panic_callback: apc_corner: [corner:7, fuse_corner:3] = 1200000 uV
[    2.080496] Rebooting in 5 seconds..
[    7.128470] Going down for restart now

do you mean you want to downgrade from R17 to R16?

this is not allowed to do so:

https://source.sierrawireless.com/resources/airprime/software/wp76xx/wp76xx-firmware-release-17/#sthash.CPllsKVT.dpbs

BTW, when you do the upgrade to R17, did you go throught R16.3 first?

Lastly, I don’t see R17 is supportig WP7601…

Thanks for the reply.

To clarify, yes I did upgrade through 16.3 to 17. At the time I thought I was using a WP7611 since it is the device we’re targeting. It was later that I realized that I had a WP7601 and that 16.0.1 was the last rev to support WP7601.

So, my problem is that the bootloader allowed me to install an incompatible version (twice), and now I have a brick. I’m wondering if there is a way to revert right back to the qualcomm bootloader and reinstall “from scratch”.

Have you tried to trigger the tp1 pin to force module to download mode?

I should have mentioned it before. Yes, I’ve tried using TP1 (dip switch 7 on mangoRed) to force download mode. The download mostly works, but doesn’t finish. Here is an example:

swiflash -m WP76XX -r -i ~/Downloads/WP76xx_Release16.0.1_GENERIC.spk

Detecting USB of the target
DONE
Communicating with the target
DONE
Downloading the firmware
....................DONE
Rebooting the module
..................................DONE
Rebooting the module
.............................................................................................................................^C

At the first “Rebooting the module … DONE” Isee on the serial console that the WP7601 does actually reboot. However, the second “Rebooting the module” doesn’t succeed. I’ve let it run for an hour (in previous attempts), and it still just prints … until I break out.

it will never end even for good module as it is waiting the module to go to online mode, but since you are using TP1 pin to force module to download mode, it will never go to online mode

You can double check the swiflash with a good module

Forgot to mention a few details in my procedure. Sorry about that.

I set the TP1 to force bootloader mode, and reset it after the firmware download started. After the first Reboot, I see that it does boot to linux login prompt but still at Release 17. At that point the device is unstable and the second attempt to reboot never succeeds.

That was before I attempted to erase a few of the partitions (app, system) in an attempt to allow overwriting those. Now, the kernel panics several times before dropping back to “Sahara over USB”.

At the moment, I need to somehow restore (or re-write) back to 16.0.1, but that doesn’t appear to be allowed. I’m not sure if the messages such as:

B - 462631106 - Imagetype=0x07 compat_id=0x01 incompatible with Flash!

mean those particular images don’t fit, or are rejected for some other reason. I assume those rejected images are part of what I’m missing.

I think this message is showing downgrade is not possible in some partitions

Ok, looks like I’m out of luck, but thanks for the help.

I’m switched to working with a WP7607 and have upgraded it successfully. Now I have to figure out how to repartition it so I can get gstreamer on there. I’ve had no luck with the AT!APPPARTCHG? command yet. It always returns ERROR, but I’ll start a new thread for that.