0

I had to do a battery replacement on an Android 4.x tablet Denver TAC-97032.

The battery had been obtained from the manufacturer as aftermarket part; it is however not of the same size as the original one.

Still, I opened the tabled, desoldered the old battery, and soldered the new one; behavior thereafter is:

  • If I just plug in the charger, I get the Android "battery fills" animation for a while, the animation shows charging, and then it disappears, as usual. Good - means battery is detected and is mounted properly.
  • If I boot with Power + Vol Up, I get into the recovery, which here just shows the "dead android" picture; there are no extra menus for ADB sideload or similar, so basically it just sits there; adb can also see a "recovery" device, and adb reboot is also recognized and works
  • If I boot with just Power: first the DENVER splash is shows, then an Android splash screen is shown, then screen goes black (but there is still backlight it seems); device appears dead, but if I hold Power to force shutdown, at end a click from the speaker is heard and flash from screen seen - meaning the device ran also under the black screen.

At the black screen, I tried adb - and luckily, it worked:

$ ./adb.exe logcat
--------- beginning of /dev/log/main
I//system/bin/e2fsck(   67): e2fsck 1.41.11 (14-Mar-2010)
I//system/bin/e2fsck(   67): /dev/block/nande: clean, 5183/76800 files, 205676/307200 blocks
I/logwrapper(   67): /system/bin/e2fsck terminated by exit(0)
I//system/bin/e2fsck(   72): e2fsck 1.41.11 (14-Mar-2010)
I//system/bin/e2fsck(   72): /dev/block/nandh: clean, 15/20496 files, 2623/81920 blocks
I/logwrapper(   72): /system/bin/e2fsck terminated by exit(0)
--------- beginning of /dev/log/system
I/USB3G   (   85): usb 3g monitor v0.1 start
I/USB3G   (   85): event { 'add', '/devices/platform/sw_hcd_host0/usb1', 'usb', '', 189, 0 }
I/USB3G   (   85): event { 'add', '/devices/platform/sw-ehci.1/usb2', 'usb', '', 189, 128 }
I/USB3G   (   85): event { 'add', '/devices/platform/sw-ohci.1/usb3', 'usb', '', 189, 256 }
I/Netd    (   80): Netd 1.0 starting
I/Vold    (   79): Vold 2.1 (the revenge) firing up
D/Vold    (   79): Volume sdcard state changing -1 (Initializing) -> 0 (No-Media)
D/Vold    (   79): Volume extsd state changing -1 (Initializing) -> 0 (No-Media)
D/Vold    (   79): Volume usbhost1 state changing -1 (Initializing) -> 0 (No-Media)
D/Vold    (   79): Volume sdcard state changing 0 (No-Media) -> 1 (Idle-Unmounted)
I/SurfaceFlinger(   81): SurfaceFlinger is starting
I/SurfaceFlinger(   81): SurfaceFlinger's main thread ready to run. Initializing graphics H/W...
E/[Gralloc-ERROR](   81): int alloc_device_open(const hw_module_t*, const char*, hw_device_t**):436 UMP open failed with 1
E/FramebufferNativeWindow(   81): couldn't open framebuffer HAL (Operation not permitted)
E/[Gralloc-ERROR](   81): int alloc_device_open(const hw_module_t*, const char*, hw_device_t**):436 UMP open failed with 1
E/FramebufferNativeWindow(   81): couldn't open gralloc HAL (Operation not permitted)
E/SurfaceFlinger(   81): Display subsystem failed to initialize. check logs. exiting...
I/        (   82): ServiceManager: 0xf958
I/AudioFlinger(   82): Loaded primary audio interface from sunxi audio HW HAL (audio)
I/AudioFlinger(   82): Using 'sunxi audio HW HAL' (audio.primary) as the primary audio interface
I/CameraService(   82): CameraService started (pid=82)
I/AudioFlinger(   82): AudioFlinger's thread 0x1c7b0 ready to run
W/AudioFlinger(   82): Thread AudioOut_1 cannot connect to the power manager service
I/AudioPolicyService(   82): Loaded audio policy from LEGACY Audio Policy HAL (audio_policy)
I/SurfaceFlinger(  129): SurfaceFlinger is starting
I/SurfaceFlinger(  129): SurfaceFlinger's main thread ready to run. Initializing graphics H/W...
I/[Gralloc](  129): using (fd=10)
I/[Gralloc](  129): id           =
I/[Gralloc](  129): xres         = 1024 px
I/[Gralloc](  129): yres         = 768 px
I/[Gralloc](  129): xres_virtual = 1024 px
I/[Gralloc](  129): yres_virtual = 1536 px
I/[Gralloc](  129): bpp          = 32
I/[Gralloc](  129): r            = 16:8
I/[Gralloc](  129): g            =  8:8
I/[Gralloc](  129): b            =  0:8
I/[Gralloc](  129): width        = 163 mm (159.568100 dpi)
I/[Gralloc](  129): height       = 122 mm (159.895081 dpi)
I/[Gralloc](  129): refresh rate = 60.12 Hz
D/libEGL  (  129): loaded /system/lib/egl/libEGL_mali.so
D/libEGL  (  129): loaded /system/lib/egl/libGLESv1_CM_mali.so
D/libEGL  (  129): loaded /system/lib/egl/libGLESv2_mali.so
E/SurfaceFlinger(  129): couldn't find an EGLConfig matching the screen format
W/SurfaceFlinger(  129): ro.sf.lcd_density not defined, using 160 dpi by default.
I/SurfaceFlinger(  129): EGL informations:
I/SurfaceFlinger(  129): # of configs : 21
I/SurfaceFlinger(  129): vendor    : Android
I/SurfaceFlinger(  129): version   : 1.4 Android META-EGL
I/SurfaceFlinger(  129): extensions: EGL_KHR_image EGL_KHR_image_base EGL_KHR_image_pixmap EGL_KHR_gl_texture_2D_image EGL_KHR_gl_texture_cubemap_image EGL_KHR_gl_renderbuffer_image EGL_KHR_fence_sync EGL_ANDROID_image_native_buffer
I/SurfaceFlinger(  129): Client API: OpenGL ES
I/SurfaceFlinger(  129): EGLSurface: 5-6-5-0, config=0x0
I/SurfaceFlinger(  129): OpenGL informations:
I/SurfaceFlinger(  129): vendor    : ARM
I/SurfaceFlinger(  129): renderer  : Mali-400 MP
I/SurfaceFlinger(  129): version   : OpenGL ES-CM 1.1
I/SurfaceFlinger(  129): extensions: GL_OES_byte_coordinates GL_OES_fixed_point GL_OES_single_precision GL_OES_matrix_get GL_OES_read_format GL_OES_compressed_paletted_texture GL_OES_point_size_array GL_OES_point_sprite GL_OES_texture_npot GL_OES_query_matrix GL_OES_matrix_palette GL_OES_extended_matrix_palette GL_OES_compressed_ETC1_RGB8_texture GL_OES_EGL_image GL_OES_draw_texture GL_OES_depth_texture GL_OES_packed_depth_stencil GL_EXT_texture_format_BGRA8888 GL_OES_framebuffer_object GL_OES_stencil8 GL_OES_depth24 GL_ARM_rgba8 GL_OES_EGL_image_external GL_OES_EGL_sync GL_OES_rgb8_rgba8 GL_EXT_multisampled_render_to_texture GL_OES_texture_cube_map GL_EXT_discard_framebuffer GL_EXT_robustness
I/SurfaceFlinger(  129): GL_MAX_TEXTURE_SIZE = 4096
I/SurfaceFlinger(  129): GL_MAX_VIEWPORT_DIMS = 4096 x 4096
I/SurfaceFlinger(  129): flags = 00000000
D/display (  129): ####disp_init, mode:0,out_type:1,tv_mode:0,app_width:1024,app_height:768
D/DisplayDispatcher(  129): display dispatcher enabled

... and here logcat stops - there are no further messages.

So, the primary error seems to be "Display subsystem failed to initialize", and it explains the black screen; however I cannot really tell:

  • Is this a hardware cause: maybe during battery replacement, I accidentally disconnected some pin from the display, so even if I get splash screens shown at start, there is an error later when normal operation is initialized?
  • There are very few resources online mentioning this error, and I think I got to an IRC chat log, where a factory reset was recommended for an error like this. I would imagine, that maybe there is an ID on the battery of sorts, and since now it is changed from the original one, the OS sees that as an error, and refuses to proceed. Obviously, I do NOT want to do a factory reset - because then, I lose all of the data on the device (I'd do an adb backup, but that typically raises a prompt on the device, and since the screen does not work, I couldn't have allowed it even if the system booted to a state where it would have shown the prompt)

So, my questions are:

  • Would anyone know what is more likely as the cause of ump_open error: hardware wire misconnection, or maybe differing ID of the battery?
  • Is it realistic to hope that factory reset would solve this problem?
  • If I need to do factory reset, is there any way I can back up this device purely from adb (but not using any GUI elements on the target device)?
  • Logcat says: "Display subsystem failed to initialize. check logs." - are there other logs than logcat I could check; and if so, which are they?
  • Is there anything else I could try, to get this tablet to boot fully?
2
  • 1
    Was the tablet fully working before the battery replacement? Regarding the check logs entry I would assume that this is a generic output of a driver developed for Linux. It might not be applicable on Android at all.
    – Robert
    Jun 26 at 11:22
  • Many thanks @Robert - tablet was indeed fully working before; however it had been turned off for several months before todays battery replacement attempt. Thanks for the check logs comment, that makes sense.
    – sdaau
    Jun 26 at 11:40
0

Well, that was a doozy for me...

First of all, I found that the previous state of this tablet was not quite working - old battery ended up discharging completely; after that, plugging in charger only showed the "battery charging" splash screen, but device refused to boot; and at that point it was stashed away - until now.

Anyways: first of all, as documented here Why would Android list some files that are not accessible (I/O error)?, I discovered there were some system files which caused I/O error. That made me think that there is a possible corruption of the /system flash partition - in which case, a factory reset would indeed help.

First of all, mounts visible at this time via adb (at this time, I still run it from a folder under MSYS2 bash, therefore the doubled slashes) were:

root@android:/ # mount
mount
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
/dev/block/nandd /system ext4 rw,nodev,noatime,user_xattr,barrier=0,data=ordered 0 0

Cool, so we know now nandd is the /system partition. Let's check all block devices:

root@android:/ # ls /dev/block
loop0
loop1
loop2
loop3
loop4
loop5
loop6
loop7
nanda
nandb
nandc
nandd
nande
nandf
nandg
nandh
nandi
nandj
ram0
ram1
vold

(vold is some old Android init, which only appears, it seems, when there is a "normal" adb connection - not when in recovery).

So, I thought, I should try a backup, and somehow check for corruption; first I tried this for backup:

$ ./adb.exe backup -apk -shared -all -f /c/BACKUP/2021_06_26_DENVER_TAC_97032.ab
WARNING: adb backup is deprecated and may be removed in a future release
Now unlock your device and confirm the backup operation...

... but this needs an active GUI for confirmation - and my display here won't boot... so no dice.

Then I found https://github.com/TissueFluid/yaffs2-recovery which made me try:

$ ./adb shell 'nandread -d /dev/block/nandd -f /dev/tty' > nandd.bin

Problem being, I don't really have spare disk space at this point, so I tried redirecting to /dev/stdout (so I can save the stream on the PC) but it didn't exist; and finally I tried /dev/tty - but all I got were some text error messages in the output file: "failed get mtd info for /dev/block/nandd, Not a typewriter".

Ok, so I thought, let me check for corruption:

root@android:/ # e2fsck /dev/block/nandd
e2fsck /dev/block/nandd
e2fsck 1.41.11 (14-Mar-2010)
e2fsck: Device or resource busy while trying to open /dev/block/nandd
Filesystem mounted or opened exclusively by another program?

root@android:/ # umount /system
umount /system
failed: Device or resource busy

Eh yeah, can't really unmount the /system partition, when it is the system in use ...

Then I found this: https://superuser.com/questions/401217/how-to-check-root-partition-with-fsck - none if it is really applicable here.

Then I made a bad mistake: I found there is a program directiotest - so I thought, what could go wrong, it is a "test" of block devices? BAD mistake:

root@android:/ # /system/xbin/directiotest
/system/xbin/directiotest
Usage: directiotest blkdev_path

1|root@android:/ # /system/xbin/directiotest /dev/block/nandd
/system/xbin/directiotest /dev/block/nandd
Starting test
Testing area 8192/8192 (100.00% complete)
Test complete

root@android:/ # ls -la /system/xbin
ls -la /system/xbin

Ouch ...

$ ./adb logcat
- exec '/system/bin/sh' failed: No such file or directory (2) -

Oops ... the entire /system filesystem is now gone! Looking at the source afterwards https://android.googlesource.com/platform/system/extras/+/master/tests/directiotest/directiotest.c - it turns out that it "tests" by writing bytes in Flash memory, then reading them; which (now) obviously causes the entire content to be wiped!

Oh damn; only recovery left to try: turn off tablet; Power + Vol Up to get to "dead droid" splash; and the Power + Vol Up + Vol Down (or some other combo) - and I could see that /sdcard files were still live and listed! Boy, I better back that up ... but if I couldn't do it with adb backup earlier, I would be even less able to use it now ...

Then I found https://stackoverflow.com/questions/19908641/how-do-you-use-force-adb-to-backup-without-user-confirmation, which suggests:

sudo adb shell dd if=/dev/block/bootdevice/by-name/boot > boot.bin

Well, I didn't have dd before, and now I don't even have shell - so nope ...

Funny enough, as suggested in https://stackoverflow.com/questions/10050925/how-do-i-adb-pull-all-files-of-a-folder-present-in-sd-card -- I could still use adb pull to copy files from sdcard; but:

$ ../adb pull '//sdcard'
adb: error: cannot create '.\sdcard\Android\data\net.nurik.roman.muzei\cache\artcache\net.nurik.roman.muzei_com.google.android.apps.muzei.gallery.GalleryArtSource\file__external_images_media_16730_a40e97f6903cd2217b225c5fcec4cfcc_6d89a17d2a7ee168c95d93662a817314': Not a directory
pull: building file list...

So, this might have worked - unfortunately, adb breaks the process at first error, and apparently also /sdcard got corrupt ...

To solve this, ADB pull stops after first error suggests tar - but yeah, I do not have tar anymore, as it resided on the wiped /system ... I also found a suggestion for:

$ ../adb-sync --adb=../adb --reverse //sdcard/ .
INFO:root:Sync: local b'.', remote b'//sdcard/'
ERROR:root:Device not connected or not working.

Yup, this also uses /system commands, which are now wiped...

And finally, this https://stackoverflow.com/questions/29442630/copy-full-disk-image-from-android-to-computer helped:

As said in comment, adb pull /dev/block/mmcblk0 mmcblk0.img worked for me

Nice:

$ ../adb pull //dev/block/nanda nanda.img
//dev/block/nanda: 1 file pulled, 0 skipped. 5.9 MB/s (16777216 bytes in 2.702s)
...
$ ../adb pull //dev/block/nandj nandj.img
//dev/block/nandj: 1 file pulled, 0 skipped. 4.3 MB/s (5519704064 bytes in 1237.721s)

Yup, got all nand devices now; quick check:

$ for ix in *.img; do echo "$(du -hs $ix); $(file $ix)"; done
16M     nanda.img; nanda.img: , code offset 0x0+3, OEM-ID "        ", sectors/cluster 4, root entries 256, sectors 32768 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 32, sectors/track 0, dos < 4.0 BootSector (0x0), FAT (16 bit)
16M     nandb.img; nandb.img: data
32M     nandc.img; nandc.img: Android bootimg, kernel (0x40008000), ramdisk (0x41000000), page size: 2048, cmdline (console=ttyS0,115200 rw init=/init loglevel=8)
512M    nandd.img; nandd.img: data
1.2G    nande.img; nande.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-ffffabf4-655f-ffffbf67-946fc0f9fffff25b (extents) (large files)
16M     nandf.img; nandf.img: data
32M     nandg.img; nandg.img: Android bootimg, kernel (0x40008000), ramdisk (0x41000000), page size: 2048, cmdline (console=ttyS0,115200 rw init=/init loglevel=8)
256M    nandi.img; nandi.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-ffffabf4-655f-ffffbf67-946fc0f9fffff25b (extents) (large files)
5.2G    nandj.img; nandj.img: DOS/MBR boot sector, code offset 0x58+2, OEM-ID "android ", sectors/cluster 8, sectors/track 63, heads 64, sectors 10776527 (volumes > 32 MB), FAT (32 bit), sectors/FAT 10504, serial number 0x7d690be0, label: "CRANE      "

Nice, so apparently nandj here is /sdcard ... Now I can fsck the image files instead, but I have to boot to Linux for that ...


Right, so - as per https://askubuntu.com/questions/1147586/identifying-the-file-system-of-an-img-file-and-mount-it , it turns out that the images which are Android bootimg are mountable as sysfs:

$ mkdir /tmp/nandc
$ sudo mount -t sysfs -o loop nandc.img /tmp/nandc
$ ls /tmp/nandc
block  class  devices   fs          kernel  power
bus    dev    firmware  hypervisor  module

$ mkdir /tmp/nandg
$ sudo mount -t sysfs -o loop nandg.img /tmp/nandg
$ ls /tmp/nandg
block  class  devices   fs          kernel  power
bus    dev    firmware  hypervisor  module

However, since sysfs is is a pseudo file system provided by the Linux kernel, there seems to be no fsck for it. So, we can only do a file system check on the ext4 and DOS partitions.

$ e2fsck -p -f nande.img
nande.img: Directory inode 61534, block #0, offset 0: directory corrupted


nande.img: UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
    (i.e., without -a or -p options)

$ e2fsck -f nande.img
e2fsck 1.45.5 (07-Jan-2020)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Directory inode 61534, block #0, offset 0: directory corrupted
Salvage<y>? 
...

$ e2fsck -y -f nande.img
...
Free inodes count wrong (71634, counted=71639).
Fix? yes


nande.img: ***** FILE SYSTEM WAS MODIFIED *****
nande.img: 5161/76800 files (4.9% non-contiguous), 204247/307200 blocks

$ e2fsck -f nande.img
e2fsck 1.45.5 (07-Jan-2020)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
nande.img: 5161/76800 files (4.9% non-contiguous), 204247/307200 blocks

$ e2fsck -y -f nandi.img 
...
nandi.img: ***** FILE SYSTEM WAS MODIFIED *****
nandi.img: 11/16384 files (0.0% non-contiguous), 2089/65536 blocks

$ e2fsck -f nandi.img 
e2fsck 1.45.5 (07-Jan-2020)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
nandi.img: 11/16384 files (0.0% non-contiguous), 2089/65536 blocks

$ fsck.vfat nanda.img
fsck.fat 4.1 (2017-01-24)
nanda.img: 44 files, 4188/8171 clusters


...
  Bad short file name (╗ö2╜Uδ┐F.pAñ).
1) Drop file
2) Rename file
3) Auto-rename
4) Keep it
? 3
...
Orphaned long file name part "img-28773653"
1: Delete.
2: Leave it.
? 2
Reclaimed 98484 unused clusters (403390464 bytes).
Free cluster summary wrong (321342 vs. really 419828)
1) Correct
2) Don't correct
? 1
Perform changes ? (y/n) y
nandj.img: 2483 files, 924607/1344435 clusters

So, quite a bit of corruption - unfortunately, repeated fsck of nandj does not seem to clear the errors ...

Regardless, I have as good nand backup as I can now, so I can try "wipe data/factory reset" from the Android system recovery <3e> menu ... Unfortunately, the end result now is:

-- Wiping data...
Formatting /data...
Formatting /cache...
E:failed to mount /system (Invalid argument)
Data wipe complete.

Eh, so apparently you cannot recover /system on this device ...

So my best bet now, is to somehow find the original firmware to restore.

In summary: the old battery, upon failing, probably caused some flash corruption -- which was first revealed upon the installation of the new battery. In spite of my error of wiping /system, it was corrupt to begin with, and factory reset would not have helped even if I did not make the mistake of wiping it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.