search

bkerler / edl

Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :)
GNU General Public License v3.0
1.6k stars 375 forks source link

write op8t doesn't work #424

Open 532910 opened 1 year ago

532910 commented 1 year ago

While read works fine:

% ./edl rf lun1.bin --memory=ufs --lun=1
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.61 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
main - Trying to connect to firehose loader ...
firehose - Chip serial num: 1525164611 (0x5ae82a43)
firehose - Supported Functions (24):
firehose - program
firehose - read
firehose - nop
firehose - patch
firehose - configure
firehose - setbootablestoragedrive
firehose - erase
firehose - power
firehose - firmwarewrite
firehose - getstorageinfo
firehose - benchmark
firehose - emmc
firehose - ufs
firehose - fixgpt
firehose - getsha256digest
firehose - gethwversion
firehose - getrfversion
firehose - getprjversion
firehose - eraseuserdata
firehose - sha256init
firehose - sha256final
firehose - demacia
firehose - setprojmodel
firehose - getddrtype
firehose - End of supported functions 24
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=UFS
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - {'ERROR': '[ffu]FWversion', 'UFS fInitialized': '0x1', 'UFS Current LUN Number: ': ' 0xd0', 'UFS Total Active LU': '0x6', 'UFS wManufacturerID': '0x1ce', 'UFS Boot Partition Enabled': '0x1', 'UFS Raw Device Capacity: ': ' 0x1dcbc000', 'UFS Min Block Size': '0x8', 'UFS Erase Block Size': '0x2000', 'UFS Allocation Unit Size': '0x1', 'UFS RPMB ReadWrite Size: ': ' 0x40', 'UFS Number of Allocation Uint for This LU': '0x0', 'UFS Logical Block Size': '0x0', 'UFS Provisioning Type': '0x0', 'UFS LU Write Protect': '0x0', 'UFS Boot LUN ID: ': ' 0x0', 'UFS Memory Type': '0x0', 'UFS LU Total Blocks': '0x0', 'UFS Supported Memory Types': '0x800f', 'UFS dEnhanced1MaxNAllocU': '0xee5e', 'UFS wEnhanced1CapAdjFac': '0x300', 'UFS dEnhanced2MaxNAllocU: ': ' 0x0', 'UFS wEnhanced2CapAdjFac': '0x0', 'UFS dEnhanced3MaxNAllocU': '0x0', 'UFS wEnhanced3CapAdjFac': '0x0', 'UFS dEnhanced4MaxNAllocU': '0x0', 'UFS wEnhanced4CapAdjFac': '0x0', 'UFS LUN Enable Bitmask': '0x3f', 'UFS Logical Block Count': '0x0', 'UFS bConfigDescrLock': '0x0', 'UFS iManufacturerName String Index': '0x0', 'UFS iProductName String Index': '0x1', 'UFS iSerialNumber String Index': '0x2', 'UFS iOemID String Index': '0x3', 'UFS_High_Priority_LUN': '0x0', 'UFS Inquiry Command Output': 'SAMSUNG KLUEG8UHDB-C2D1 1302 '}
firehose - {'ERROR': '[ffu]FWversion', 'UFS fInitialized': '0x1', 'UFS Current LUN Number: ': ' 0xd0', 'UFS Total Active LU': '0x6', 'UFS wManufacturerID': '0x1ce', 'UFS Boot Partition Enabled': '0x1', 'UFS Raw Device Capacity: ': ' 0x1dcbc000', 'UFS Min Block Size': '0x8', 'UFS Erase Block Size': '0x2000', 'UFS Allocation Unit Size': '0x1', 'UFS RPMB ReadWrite Size: ': ' 0x40', 'UFS Number of Allocation Uint for This LU': '0x0', 'UFS Logical Block Size': '0x0', 'UFS Provisioning Type': '0x0', 'UFS LU Write Protect': '0x0', 'UFS Boot LUN ID: ': ' 0x0', 'UFS Memory Type': '0x0', 'UFS LU Total Blocks': '0x0', 'UFS Supported Memory Types': '0x800f', 'UFS dEnhanced1MaxNAllocU': '0xee5e', 'UFS wEnhanced1CapAdjFac': '0x300', 'UFS dEnhanced2MaxNAllocU: ': ' 0x0', 'UFS wEnhanced2CapAdjFac': '0x0', 'UFS dEnhanced3MaxNAllocU': '0x0', 'UFS wEnhanced3CapAdjFac': '0x0', 'UFS dEnhanced4MaxNAllocU': '0x0', 'UFS wEnhanced4CapAdjFac': '0x0', 'UFS LUN Enable Bitmask': '0x3f', 'UFS Logical Block Count': '0x0', 'UFS bConfigDescrLock': '0x0', 'UFS iManufacturerName String Index': '0x0', 'UFS iProductName String Index': '0x1', 'UFS iSerialNumber String Index': '0x2', 'UFS iOemID String Index': '0x3', 'UFS_High_Priority_LUN': '0x0', 'UFS Inquiry Command Output': 'SAMSUNG KLUEG8UHDB-C2D1 1302 '}
firehose - 0x1
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest,gethwversion,getrfversion,getprjversion,eraseuserdata,sha256init,sha256final,demacia,setprojmodel,getddrtype
Dumping flash with sector count 2076 as lun1.bin.
firehose - 
Reading from physical partition 1, sector 0, sectors 2076
Progress: |██████████| 100.0% Read (Sector 0x81C of 0x81C, ) 130.81 MB/s

write fails:

% ./edl wf lun1.bin --memory=ufs --lun=1 
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.61 (c) B.Kerler 2018-2023.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
main - Trying to connect to firehose loader ...
firehose - Chip serial num: 1525164611 (0x5ae82a43)
firehose - Supported Functions (24):
firehose - program
firehose - read
firehose - nop
firehose - patch
firehose - configure
firehose - setbootablestoragedrive
firehose - erase
firehose - power
firehose - firmwarewrite
firehose - getstorageinfo
firehose - benchmark
firehose - emmc
firehose - ufs
firehose - fixgpt
firehose - getsha256digest
firehose - gethwversion
firehose - getrfversion
firehose - getprjversion
firehose - eraseuserdata
firehose - sha256init
firehose - sha256final
firehose - demacia
firehose - setprojmodel
firehose - getddrtype
firehose - End of supported functions 24
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=UFS
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - {'ERROR': '[ffu]FWversion', 'UFS fInitialized': '0x1', 'UFS Current LUN Number: ': ' 0xd0', 'UFS Total Active LU': '0x6', 'UFS wManufacturerID': '0x1ce', 'UFS Boot Partition Enabled': '0x1', 'UFS Raw Device Capacity: ': ' 0x1dcbc000', 'UFS Min Block Size': '0x8', 'UFS Erase Block Size': '0x2000', 'UFS Allocation Unit Size': '0x1', 'UFS RPMB ReadWrite Size: ': ' 0x40', 'UFS Number of Allocation Uint for This LU': '0x0', 'UFS Logical Block Size': '0x0', 'UFS Provisioning Type': '0x0', 'UFS LU Write Protect': '0x0', 'UFS Boot LUN ID: ': ' 0x0', 'UFS Memory Type': '0x0', 'UFS LU Total Blocks': '0x0', 'UFS Supported Memory Types': '0x800f', 'UFS dEnhanced1MaxNAllocU': '0xee5e', 'UFS wEnhanced1CapAdjFac': '0x300', 'UFS dEnhanced2MaxNAllocU: ': ' 0x0', 'UFS wEnhanced2CapAdjFac': '0x0', 'UFS dEnhanced3MaxNAllocU': '0x0', 'UFS wEnhanced3CapAdjFac': '0x0', 'UFS dEnhanced4MaxNAllocU': '0x0', 'UFS wEnhanced4CapAdjFac': '0x0', 'UFS LUN Enable Bitmask': '0x3f', 'UFS Logical Block Count': '0x0', 'UFS bConfigDescrLock': '0x0', 'UFS iManufacturerName String Index': '0x0', 'UFS iProductName String Index': '0x1', 'UFS iSerialNumber String Index': '0x2', 'UFS iOemID String Index': '0x3', 'UFS_High_Priority_LUN': '0x0', 'UFS Inquiry Command Output': 'SAMSUNG KLUEG8UHDB-C2D1 1302 '}
firehose - {'ERROR': '[ffu]FWversion', 'UFS fInitialized': '0x1', 'UFS Current LUN Number: ': ' 0xd0', 'UFS Total Active LU': '0x6', 'UFS wManufacturerID': '0x1ce', 'UFS Boot Partition Enabled': '0x1', 'UFS Raw Device Capacity: ': ' 0x1dcbc000', 'UFS Min Block Size': '0x8', 'UFS Erase Block Size': '0x2000', 'UFS Allocation Unit Size': '0x1', 'UFS RPMB ReadWrite Size: ': ' 0x40', 'UFS Number of Allocation Uint for This LU': '0x0', 'UFS Logical Block Size': '0x0', 'UFS Provisioning Type': '0x0', 'UFS LU Write Protect': '0x0', 'UFS Boot LUN ID: ': ' 0x0', 'UFS Memory Type': '0x0', 'UFS LU Total Blocks': '0x0', 'UFS Supported Memory Types': '0x800f', 'UFS dEnhanced1MaxNAllocU': '0xee5e', 'UFS wEnhanced1CapAdjFac': '0x300', 'UFS dEnhanced2MaxNAllocU: ': ' 0x0', 'UFS wEnhanced2CapAdjFac': '0x0', 'UFS dEnhanced3MaxNAllocU': '0x0', 'UFS wEnhanced3CapAdjFac': '0x0', 'UFS dEnhanced4MaxNAllocU': '0x0', 'UFS wEnhanced4CapAdjFac': '0x0', 'UFS LUN Enable Bitmask': '0x3f', 'UFS Logical Block Count': '0x0', 'UFS bConfigDescrLock': '0x0', 'UFS iManufacturerName String Index': '0x0', 'UFS iProductName String Index': '0x1', 'UFS iSerialNumber String Index': '0x2', 'UFS iOemID String Index': '0x3', 'UFS_High_Priority_LUN': '0x0', 'UFS Inquiry Command Output': 'SAMSUNG KLUEG8UHDB-C2D1 1302 '}
firehose - 0x1
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest,gethwversion,getrfversion,getprjversion,eraseuserdata,sha256init,sha256final,demacia,setprojmodel,getddrtype
firehose - 
Writing to physical partition 1, sector 0, sectors 2076
Traceback (most recent call last):
  File "/home/sergio/projects/all/phone/edl/./edl", line 393, in <module>
    base.run()
  File "/home/sergio/projects/all/phone/edl/./edl", line 388, in run
    fh.handle_firehose(cmd, options)
  File "/home/sergio/projects/all/phone/edl/edlclient/Library/firehose_client.py", line 791, in handle_firehose
    if self.firehose.cmd_program(lun, start, filename):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/sergio/projects/all/phone/edl/edlclient/Library/firehose.py", line 480, in cmd_program
    data += self.modules.addprogram()
            ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/sergio/projects/all/phone/edl/edlclient/Library/Modules/init.py", line 66, in addprogram
    return self.ops.addprogram()
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/sergio/projects/all/phone/edl/edlclient/Library/Modules/oneplus.py", line 239, in addprogram
    pk, token = self.ops.generatetoken(True)
                ^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'generatetoken'
zsh: exit 1     ./edl wf lun1.bin --memory=ufs --lun=1
qianmo-xw commented 1 year ago

Yes, whether it is qfil or other similar tools, reading is ok, and writing will always fail. I think we can grab the communication process of msmdownloadtool to analyze how to write successfully. @bkerler Need any information? I have a plus 8T mobile phone.

bkerler commented 1 year ago

Can you sniff the usb comm using wireshark and send the pcap file ? Then I can have a look at which point it was failing

bkerler commented 1 year ago

Most probably you need to give the project id (5 digits) such as --devicemodel=20809 (for Op8t TMO)

bkerler commented 1 year ago

Just checked, prjid 19806 (op8t regular) works fine. It could be that you need a specific loader for the op8t tmo

bkerler commented 1 year ago

prog_firehose_ddr_8t_tmo.zip This is the firehose for 8t tmo ... try it with this one and with --devicemodel=20809 setting