Wednesday, April 13, 2016

[Q] Can't flash IFWI on my Lenovo P90

Hi guys,

I bricked my Lenovo P90 smartphone (z3560 Moorefield device, 4GB), after attempting to unlock the bootloader. I flashed a zenfone2 ifwi firmware, after flashing the phone doesn't boot up anymore. Just the red led and that's it. I tried to do a couple of things with xfstk-dldr-solo 1.8.1 on Linux. The device boots up in Moorefield target mode and the xfstk-dldr-solo --wipeifwi command tells me the bootloader partition is blank. I tried to reflash ifwi by using the original Lenovo dnx.bin and ifwi.bin, but get this error: "XFSTK-STATUS--Error Code: 40 - ER04 - SecurityInit". From the log files it can be seen the error occurs before the dnx.bin is uploaded to the device when it is in the "DCFI00" state. This is the relevant snippet from the logs:
Code:

00:11:02 - XFSTK-STATUS--FW download is in progress ...
00:11:02 - XFSTK-LOG--StartFw
00:11:02 - XFSTK-LOG--sending 6 DWORDS of DnxFW size and checksum...
00:11:02 - XFSTK-LOG--WriteOutPipe ?±
00:11:02 - XFSTK-LOG--WriteOutPipe 0
00:11:02 - XFSTK-LOG--Write --->?±
00:11:02 - XFSTK-LOG--LogProgress
00:11:02 - XFSTK-LOG--End of MrfdStHandleFwNormal
00:11:02 - XFSTK-LOG--LogProgress
00:11:02 - XFSTK-LOG--GetOpCode
00:11:02 - XFSTK-LOG--ReadInAck
00:11:02 - XFSTK-LOG--GetAck - DCFI00(6)
00:11:02 - XFSTK-STATUS--FW: Sending DnX DCFI00 ...
00:11:02 - XFSTK-LOG--WriteOutPipe __BINARY__
00:11:02 - XFSTK-LOG--WriteOutPipe 0
00:11:02 - XFSTK-LOG--Write --->__BINARY__
00:11:02 - XFSTK-LOG--LogProgress
00:11:02 - XFSTK-LOG--GetOpCode
00:11:02 - XFSTK-LOG--ReadInAck
00:11:02 - XFSTK-LOG--GetAck - ER04(4)
00:11:02 - XFSTK-LOG--LogError
00:11:02 - XFSTK-STATUS--Error Code: 40 - ER04 - SecurityInit
00:11:02 - XFSTK-LOG--void MerrifieldDownloader::do_abort()

I have little hope there is anyone here who knows what this is about, but would appreciate any tip or hint that can lead me to flash back the original IFWI to the bootloader partition. The error message clearly states there is a security initialization problem. Perhaps someone knows a procedure to reinit security.

Cheers,
JockyW

PS: I do have a backup of the bootloader partitions mmcblk0boot0 and mmcblk0boot1 (dups). Perhaps that can be of value. Also I do get a readout when I do xfstk-dldr-solo --idrq
Here is the anonymized output (hashkeys and pmic values edited):
Code:

sudo ./xfstk-dldr-solo --idrq -v

XFSTK-LOG--Start
XFSTK-LOG--Sending IDRQ...
XFSTK-LOG--WriteOutPipe IDRQ
XFSTK-LOG--WriteOutPipe 0
XFSTK-LOG--virtual bool MerrifieldUSB20Device::Write(void*, unsigned int) --->IDRQ
XFSTK-LOG--Read - MOOR�xbb(H7���"�x�        _Jxӗ����L/�8�c��0(3�ɨ(204)
XFSTK-STATUS--Warning: Device responded with error code 0x1
XFSTK-STATUS-- Hashkey 1: 0123456789ABCDEF0123456789ABCDEF
XFSTK-STATUS-- Hashkey 2: 0123456789ABCDEF0123456789ABCDEF
XFSTK-STATUS-- Hashkey 3: 0123456789ABCDEF0123456789ABCDEF
XFSTK-STATUS-- Hashkey 4: 00000000000000000000000000000000
XFSTK-STATUS-- Hashkey 5: 00000000000000000000000000000000
XFSTK-STATUS-- Hashkey 6: 00000000000000000000000000000000
XFSTK-STATUS-- Hashkey 7: 00000000000000000000000000000000
XFSTK-STATUS-- Hashkey 8: 00000000000000000000000000000000
XFSTK-STATUS--PartSpecificIDVariable: 00000000000000000000000000000000
XFSTK-STATUS--PartSpecificIDConstant: 0123456789ABCDEF0123456789ABCDEF
XFSTK-STATUS--PMICTimeBase: 00000000
XFSTK-STATUS--PMICNonce: FFEEDDCC000000000000000A000000B0
XFSTK-STATUS--LiveNonce: 00000000000000000000000000000000
XFSTK-LOG--void MerrifieldDownloader::do_abort()
XFSTK-LOG--virtual bool MerrifieldUSB20Device::Abort()
XFSTK-STATUS--PASS
XFSTK-STATUS--IDRQ completed.
XFSTK-LOG--virtual bool MerrifieldDownloader::Cleanup()



from xda-developers http://ift.tt/23ucPG4
via IFTTT

No comments:

Post a Comment