We have a reliable method to unbrick disabled Flatfish tablets

B2G OS Tablet Contributor Program
#1

As you may or may not know, Flatfish tablets currently have no way to boot into fastboot mode via hardware buttons.  This means that if you flash a broken build of Firefox OS (or your OS becomes disabled by other means) you may be unable to enter fastboot and flash a working OS - leaving your tablet disabled (bricked).

We now have a method to “unbrick” such tablets.

Currently you can find some specifics to this method at this bug. Be sure to view the README file in the linked download and I would recommend reading the other comments in the bug as well.  You can also drop into #TCP on IRC if you need further assistance.

Once we have formal instructions written up, I will update this post.

Please note: this current method requires using Windows.  We are working on creating an approach which can be used on any platform.

3 Likes
#2

Yay. Awesome! This is a really important fix, until we get a working
recovery mode from the manufacturer, if we do.

I know you and others worked really hard on this so thanks for this
contribution.

Steve

Autocomplete may have messed with my text

#3

To be clear, this is actually a working fastboot mode from the manufacturer.
It’s just reliant on a Windows-only tool.

Or did you mean something else?

#4

@Caspy7 I think when @slee mentioned “recovery” he referring the the usual situation on android devcies, where there is a separate partition on a devices internal flash disk (nand) that you can boot into instead of booting into the normal OS (fxOS in our case). This is somewhat similiar to “booting into fastboot” except where into fastboot means that the bootloader just stops its normal bootup process and doesn’t boot the normal OS and instead just sits there listening for fastboot commands on the USB port, recovery partitions are really an alternative tiny OS, with a separate Linux kernel and usually very basic app that gets run to provide a UI to do the same kinds of things as you would from fastboot, ie. copy over new imgs onto the internal flash, reformat existing internal disk partitions, etc.

However the problem with having a recovery partition for flatfish devices is the same as the one we currently have fastboot - the only way to boot into it is via an adb command, unlike on many android consumer devices, where there is a hardware button combo to press at boot, to make the bootloader boot into the recovery partition (or put the bootloader into fastboot mode). Without that button combo, recovery would only be a step forward in that it would provide a nicer UI for people to use to update to newer builds without the need to have the fastboot exe installed on a separate notebook/desktop OS.

I don’t have my tablet yet, but once I do I plan on trying to figure out how difficult it will be to modify the u-boot version installed on the flatfish to look for a hardware button combo to either go into fastboot mode or boot an alternative partition to boot.img which would be the recovery parition. I think the easier starting point will be just fastboot, as unless the nand partitioning scheme already includes a recovery partition, we’d need to change it to accomodate one.

Finally terminology wise, in the android community, people often refer to CWM recovery, (ClockWorkMod) which is the most popular recovery image (linux kernel + app UI. etc) though there are others and I think AOSP comes with a simple default sample from Google iirc.

Hope that helps clear things up - sorry I really should have documented this earlier as its become a bit of a FAQ in irc and email discussions. Maybe this should go into the wiki somewhere as well?

#5

@maks Yes, spot on.

This is usually a simple button access to boot a separate recovery.img which is a self contained minimal OS with simple text menu UI. The MDN docs mention this as one of the 4 key .img files to be built [1] as part of Firefox OS. I don’t think it is eve built however, but should be on the device and backed up.

My ZTE One with Firefox OS has such an Android system recovery partition, accessed by holding the volume up key when turning on with the power button. It has menu items to:

  • Reboot
  • Update from external store (packaged images on sdcard)
  • Wipe data / factory reset
  • Wipe cache
  • Appliy update from cache
  • md5 check

This provides a relatively non technical way for users to factory reset the device if “bricked” during normal operation. I assume it also provides adb and/or fastboot servers for access to allow recover from bad image flashing or OTA access for more techy users and devs. .

We need the manufacturer to sort this out. As there appears to be no recovery.image shipped then perhaps if all the hardware support is there we just need to provide a recovery.img and it will work? .

I expect it is perfectly possible to screw up the images so that there is no way to boot at all. In this case the ZTE One has another mode in its Firmeware allowing upload from a PC using a client tool. This is accessed by pressing both volume keys when plugging in the USB and with battery removed. They only provide a Windows client to upload files and it’s not in English either, but does the trick. I eventually found this as my ZTE One had no usable adb or fastboot mode for flashing.

If only I had my device I would had some of tried these things out.

1: https://developer.mozilla.org/en-US/Firefox_OS/Building_and_installing_Firefox_OS/Firefox_OS_build_overview

#6

@slee the issue is not some much the lack of a recovery image, even if one is not built as part of the current build, its a relatively straight forward task to put one together given that we have a git repo for the linux kernel src tree for the flatfish.

The key thing here is bootloader (u-boot) support for booting into a alternative (recovery) partition by holding down a specific hardware button(key) combination. As far as I know this is not currently implemented in the u-boot shipped on the flatfish devices and is what lead to the situation of ‘bricked’ devices, as the only way to update the filesystem partitions/images installed on the internal nand was via adb rebooting and getting u-boot to go into fastboot mode and of course that couldn’t happen with a dud boot or system img installed - catch22.

Luckily we now have a img provided that can be used with the proprietary (windows only) phoenixsuite tool that uses the FEL mode thats built into the BROM of all Allwinner SoCs that lets us get a bricked tablet to reboot u-boot straight into fastboot mode and then fix the issue from there. The SoC can go into FEL mode in several different ways, in this case its via pressing a hardware key combination. This sounds like it maybe simliar to what is available with the ZTE phone but I’m not familiar with which SoC it uses so can’t say if it definitely is or not BUT note on the Allwinner SoCs (ie the A31 in flatfish) it is done before u-boot runs.

So to re-iterate, the issue is with the current build o f the u-boot bootloader on the flatfishes and not lack of a recovery img, which may or may not already be present on the devices. Even if it is present, it does not help the current situation in anyway as once you stuff up boot or system partitions, you have no way of booting into a recovery partition without there being a button combo that gets u-boot to do this for you.

Given the above - thats why my tack is to come up with a u-boot build that can be installed on a sdcard which would automatically go into fastboot mode. This should be usable via FEL mode, because according to the diagram in the linux-sunxi community wiki, the A31 will try booting from sdcard0 when in FEL mode, if it finds it to be bootable. The holdup here though is that the spl first stage boot loader thats needed to boot u-boot is not yet working on the A31 and the proprietary alternative boot0/1 bootloader that could do the job is not publicly available for the A31 either. I’ve got a A31 development board on order, so I’m hoping that I could make some progress to help get this to work with it, as doing this kind of work on a tablet like that flatfish without UART access is very difficult.

1 Like
#7

Great @maks, I’m beginning to get to grips with all these moving parts! You are identifying the problem as the u-boot, which happens early in the boot process. It’s great you found a way to make it behave without manufacturers input…

I liked the sdcard boot idea when first mentioned so let’s hope it can be made to work.

Thanks again for all your hard work on this serious problem.

PS ZTE don’t name the extra mode but the Windows file download tool is called NandDL_firefox.

#8

I appear to have bricked my tablet while attempting to update the bootloader as per Caspy7’s instructions. I encountered the same problem as that described here. Unfortunately I have not been able to un-brick it thus far - no combination of long-presses, mashing the power button, plugging and unplugging the USB, and so forth, have had any effect.

The tablet is totally unresponsive and is not visible when listing connected USB devices. Sadness prevails.

#9

There are recoveries , check this : https://discourse.mozilla-community.org/t/some-nice-custom-recovery-hooray/2194 . But no way to access it using hardware buttons :’(