[MTCD  Android Head Units Q&A] doitright:
Joying "N2" firmware.

Looking into the process for booting to recovery, I started looking into the Joying firmware, specifically, the file fwu_image.bin. This is an interesting file, it appears to be a bootloader and/or some kind of hypervisor.

Some strings in it led me to find a tool called the "Intel Phone Flash Tool"

There is a LOT of potentially useful information in this thread; http://xdaforums.com/general/device...70-3g-sofia-atom-x3-c3130-quad-t3103085/page2

Other interesting strings;

USB Driver Bootcore module --- something about booting via USB?

There is a bunch of stuff about **fastboot**.

"rockchip,power-key-pressed-time" -- interesting. Does it respond differently to holding the power key for different lengths of time?

"%s BCB is boot-normal, set NVM to normal mode." -- this seems to be related to selecting boot modes based on data on NVM, i.e., what happens when you issue "reboot recovery".

Wonder what would happen if you ran "reboot bootloader"?

Some stuff about "special" key...

This stuff.... some kernel parameters, and, of course, the SERIAL NUMBER that freaks tomtom out;

phyBlk = 0x%x die = %d block_in_die = 0x%x 0x%x
0123456789abcdef
(null)
0123456789ABCDEF
bug in vfprintf: bad base
SF_3GR_ver 1639.400
1639.400_M1S1
,dDK
,DDK
androidboot.bootloader
androidboot.serialno
loader_charged
normal
androidboot.mode
ptest
charger
0123456789012345678901234567890
0123456789012345
update-radio/hboot
boot-fb-pt-updated
boot-fastboot
boot-recovery
update-psi
fb_update_bl

At least partial kernel commandline as; "console=ttyFIQ0,115200n8 idle=halt earlyprintk=xgold notsc apic=sofia androidboot.hardware=sofiaboard nolapic_pm firmware_class.path=/system/vendor/firmware androidboot.selinux=permissive x86_intel_xgold_timer=soctimer_only vmalloc=512m slub_max_order=2 uvcvideo.en_autosuspend=0 selinux=0 limit_cpu=disable mvpipe.at_dbg_port=1"

Note: serial console on ttyFIQ0, I wonder where that could be found.

Also note: selinux is in a pointless state. Major copout.

There are a *LOT* of strings in there that tie it to the FYT SoM. The bootloader is, no doubt, incompatible with MTCD boards.

There seem to be a LOT of references to hardware that these units do not have. Even found the string "huawei" in it. Makes me thing that this is a lot more than just a simple bootloader. This looks like it actually contains a *complete Linux kernel*. No wait, actually TWO.

This is really weird. Perhaps a bootloader followed by 2 kernels?

"/local/zengguan/RK-release-for-eoi/1511-official-release/mobilevisor/core"

"Mobilevisor/bootloader boot shared info structure version mismatch!"

Ok, so here is what I'm thinking;

1) It might have fastboot.

2) The USB keyboard - boot to recovery process may well avoid starting the boot partition, I think that it may be starting one of the kernels in the hypervisor partition, and using that to adjust the NVM to cause a recovery boot.

3) NEITHER of those are guaranteed, further study would be required.

Found THIS immediately before what appears to be fastboot:

"-----BOOT_REASON_LONG_ON_KEY-----"

So what does that mean? Boots to fastboot if you hold down the ON key for a long time? What is an ON key?

This comes AFTER fastboot:

"------display screen start------"

Could be that fastboot mode has no display output.

Hmm...

%s line=%d DOWN bit is set

%s line=%d DOWN and Power bit is set

Another edit... they aren't calling it a hypervisor, they're calling it a MICROVISOR. Essentially, a combined hypervisor + microkernel. The main kernel accesses security sensitive resources via the microkernel. Think of it as TRUSTZONE.

I *think* that the watchdog is implemented in the microvisor. With any luck, they didn't completely bonehead it -- a complete mess up should (if implemented in a sane manner) result in a reboot into some mode where recovery is possible, such as fastboot or recovery.