Banana Pi BPI-D1 discussion board

(zhiz z) #1

Banana Pi BPI-D1 discussion board

(mrobo) #2

need help how to recover device like Banana Pi BPI-D1, its ANYKA CPU AK3916 Cloud39E_AK3918E+H42_V1.0.2

(mrobo) #3

here is boot from terminal connected trough serial debug: Uncompressing Linux… done, booting the kernel.

Anyka Linux Kernel Version: 2.0.00

Booting Linux on physical CPU 0

Linux version 3.4.35 (root@ubuntu) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #12 Wed Oct 11 14:35:14 CST 2017

CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177

CPU: VIVT data cache, VIVT instruction cache

Machine: Cloud39E_AK3918E+H42_V1.0.2

Memory policy: ECC disabled, Data cache writeback

ANYKA CPU AK3916 (ID 0x20150200)

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 10160

Kernel command line: root=/dev/mtdblock1 ro rootfstype=squashfs init=/sbin/init mem=64M console=ttySAK0,115200

PID hash table entries: 256 (order: -2, 1024 bytes)

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Memory: 40MB = 40MB total

Memory: 36580k/36580k available, 4380k reserved, 0K highmem

Virtual kernel memory layout:

vector  : 0xffff0000 - 0xffff1000   (   4 kB)

fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)

vmalloc : 0xc3000000 - 0xff000000   ( 960 MB)

lowmem  : 0xc0000000 - 0xc2800000   (  40 MB)

modules : 0xbf000000 - 0xc0000000 ( 16 MB)

  .text : 0xc0008000 - 0xc0381000   (3556 kB)

  .init : 0xc0381000 - 0xc039b000   ( 104 kB)

  .data : 0xc039c000 - 0xc03bf480   ( 142 kB)

   .bss : 0xc03bf4a4 - 0xc03ddda4   ( 123 kB)

SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1


sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms

AK39 console driver initial

console [ttySAK0] enabled

Calibrating delay loop… 199.06 BogoMIPS (lpj=995328)

pid_max: default: 32768 minimum: 301

Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

Setting up static identity map for 0x81abceb0 - 0x81abcf08

devtmpfs: initialized

NET: Registered protocol family 16

On-chip L2 memory initialized

AK39 clocks: CPU 400MHz, MEM 200MHz, ASIC 100MHz

Anyka platform share gpio locks initialize.

bio: create slab at 0

SCSI subsystem initialized

*********akfha_char init

akfha Char Device Initialize Successed!

usbcore: registered new interface driver usbfs

usbcore: registered new interface driver hub

usbcore: registered new device driver usb

i2c-ak39 i2c-ak39: i2c-0: AK39 I2C adapter

Linux video capture interface: v2.00

cfg80211: Calling CRDA to update world regulatory domain

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP: reno registered

UDP hash table entries: 256 (order: 0, 4096 bytes)

UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

NET: Registered protocol family 1

squashfs: version 4.0 (2009/01/31) Phillip Lougher

exFAT: Version 1.2.9

jffs2: version 2.2. © 2001-2006 Red Hat, Inc.

msgmni has been set to 71

io scheduler noop registered

io scheduler cfq registered (default)

AK39xx uart driver init, © 2013 ANYKA

ion: failed to create debug files.

brd: module loaded

loop: module loaded

AK Motor Driver © 2013 ANYKA

akgpio driver initialize.


ak39_codec_probe enter.


akpcm initialize OK!

akpcm_probe ok.

sw2001: version 2015.09.21


sw2001: sw2001_write(0x10,0xc1)

sw2001: sw2001_write(0x11,0x3a)

sw2001: sw2001_write(0x12,0xd8)

sw2001: sw2001_write(0x13,0x7)

sw2001: sw2001_write(0x14,0xdb)

sw2001: sw2001_write(0x15,0xef)

sw2001: sw2001_write(0x16,0x1a)

sw2001: sw2001_write(0x17,0x60)

sw2001: sw2001_write(0x18,0x94)

sw2001: sw2001_write(0x19,0x32)

sw2001: sw2001_write(0x1a,0xe6)

sw2001: sw2001_write(0x1b,0xf6)

sw2001: sw2001_write(0x1c,0x78)

sw2001: sw2001_write(0x1d,0x8)

sw2001: sw2001_write(0x1e,0x15)

sw2001: sw2001_write(0x1f,0xfb)

sw2001: sw2001_write(0x0,0x1a)

sw2001: sw2001_read(0x0) return 0x1


sw2001: sw2001_write(0x0,0x1b)

sw2001: sw2001_read(0x0) return 0x1


sw2001: sw2001_read(0x10) return 0x1


sw2001: sw2001_read(0x11) return 0x1


sw2001: sw2001_read(0x12) return 0x1


sw2001: sw2001_read(0x13) return 0x1


sw2001: sw2001_read(0x14) return 0x1


sw2001: sw2001_read(0x15) return 0x1


sw2001: sw2001_read(0x16) return 0x1


sw2001: sw2001_read(0x17) return 0x1


sw2001: sw2001_read(0x18) return 0x1


sw2001: sw2001_read(0x19) return 0x1


sw2001: sw2001_read(0x1a) return 0x1


sw2001: sw2001_read(0x1b) return 0x1


sw2001: sw2001_read(0x1c) return 0x1


sw2001: sw2001_read(0x1d) return 0x1


sw2001: sw2001_read(0x1e) return 0x1


sw2001: sw2001_read(0x1f) return 0x1



pt Data : 0x33 0x43 0x5a 0xbb 0x6e 0x81 0xe7 0xde 0xd4 0x72 0xb6 0x4a 0x76 0x06 0xb9 0xf4

result Data : 0x33 0x43 0x5a 0xbb 0x6e 0x81 0xe7 0xde 0xd4 0x72 0xb6 0x4a 0x76 0x06 0xb9 0xf4

ct Data : 0xc1 0x3a 0xd8 0x07 0xdb 0xef 0x1a 0x60 0x94 0x32 0xe6 0xf6 0x78 0x08 0x15 0xfb


verify success!

SW2001 Test Success!!!

encryption_verify: valid.


Start to init Anyka SPI Flash…

AK SPI Driver, © 2012 ANYKA

akpi regs: SPICON:00000152, SPISTA:00000015, SPIINT:00000000.

ak-spi ak-spi: master is unqueued, this is deprecated

ak_spi setup the master.

pre-scaler=2 (wanted 20Mhz, got 16Mhz)

ak spiflash probe enter.

pre-scaler=2 (wanted 20Mhz, got 16Mhz)


akspi flash ID: 0x00c84017

gd25q64, info->sector_size = 65536, info->n_sectors = 128

akspi flash VERSION: 0xff

ak-spiflash spi0.0: gd25q64 (8192 Kbytes)

FHA:fhalib V1.0.25

FHA:FHA_S SPIFlash_Init: BinPageStartblock:35,

FHA:FHA_S SPIFlash_Init: BinPageStart:560,




name = A

size = 0x200000

offset = 0x260000

mask_flags = 0x0


name = B

size = 0x300000

offset = 0x460000

mask_flags = 0x0


name = C

size = 0x50000

offset = 0x760000

mask_flags = 0x0

Creating 3 MTD partitions on “spi0.0”:

0x000000260000-0x000000460000 : “A”

0x000000460000-0x000000760000 : “B”

0x000000760000-0x0000007b0000 : “C”

Init AK SPI Flash finish.

akspi master initialize success, use for DMA mode.

AK39E_MAC Ethernet Driver, V1.0

input: akgpio-keys as /devices/platform/akgpio-keys/input/input0

ak-rtc ak-rtc: rtc core: registered ak-rtc as rtc0

battery:cap=19; vol=3633; status=discharge; full=0; poweroff_cap=0; low_cap=5.

AK Battery initialized

akplat_wifi_probe entered.

wifi power reset, 200(delay times)

wifi power on

AK MCI Driver © 2010 ANYKA

akmci ak_mci: Mci Interface driver.mmc0. using l2dma, sw IRQ. detect mode:GPIO detect.

akmci ak_sdio: Mci Interface driver.mmc1. using l2dma, hw IRQ. detect mode:plugin alway.

TCP: cubic registered

NET: Registered protocol family 17

lib80211: common routines for IEEE802.11 drivers

ak-rtc ak-rtc: setting system clock to 1980-01-12 23:52:44 UTC (316569164)

Warning: unable to open an initial console.

VFS: Mounted root (squashfs filesystem) readonly on device 31:1.

devtmpfs: mounted

Freeing init memory: 104K

mmc0: host does not support reading read-only switch. assuming write-enable.

mmc0: new SDHC card at address aaaa

mmcblk0: mmc0:aaaa SS04G 3.69 GiB

mmcblk0: p1


Did you manage to recover this camera?

I’ve got the same ‘Machine’ - i.e. Cloud39E_AK3918E+H42_V1.0.2

I managed to get the nanddump if you’d want it to fix your device.

However, my device’s firmware is completely locked - i.e. the only way to watch the camera feed is via the Chinese mobile app :frowning:

is there a way you could create a dump of your firmware so I could try to compare those 2?

(mrobo) #5

No I was not possible to recover it, because I am in some read only mode probably, connected trough serial console. I can only see the boot process and that is all.


can you see a login prompt? can you login to the console over the serial?

you might try removing the SD card and try to boot again - my SD card broke and was causing the boot to fail.

also - there’s a ‘hard way’ to fix this camera - you’d need the USB ISP programmer and dump the firmware from the SPI chip (that chip above ANYKA CPU - 25q64…)

then you can extract the filesystem and play with that. Or you might write different firmware onto it and recover it that way. - I could send you my firmware

but if there’s a chance you can get the shell it’s easier that way.

(mrobo) #7

No I can’t see login prompt from console, but I think there is probably possible to switch from read to write mode over the serial console connection but can’t figure out how? Or I am connected trough the debugging interface and this can interact as read only?

I tried boot even without microsd card and also connected microsd card reader trough usb otg with no progress. If you are sure that it is possible dump and program it from the SPI chip, and you are sure that is it really Serial Peripheral Interface chip I would try to get some programmer or build it if you have advice how to or where buy it cheap :smiley: , because it would be possible to solder on it cables, the whole things are so small :frowning: But I cant find info about that chip when googled, neither 1741A or G25064W, how should I figure out the pins?


Well if you cannot see the prompt then I’d say the programmer is your last hope. I bought a set like this one: ebay: “CH341A 24 25 Series EEPROM Flash BIOS USB Programmer + SOIC8 Clip On Board”

it’s cheap and it works

the g25q64 chip is a well-known chip and it’s supported by this programmer.

once you dump the firmware you’d need to run a tool like “binwalk” to detect where are the partitions and then use “dd” to extract them. After that it’s “just” Linux play :wink:

good luck!