[skipjack, sparrow, catfish_ext] Bootloader doesn't boot system after first reboot; Stuck in QHSUSB__BULK mode

[kellerman]

Hello. Thanks for the effort for bringing this firmware to so many devices! But I encountered a nasty problem:
I flashed AsteroidOS for Ticwatch C2 using the instructions in this page: https://asteroidos.org/watches/skipjack/
I unlocked the bootloader and flashed userdata and boot using 'Real install' and both flash commands executed well with OK status.
The system booted fine after 'fastboot continue' and worked perfectly. I tested and tinkered with the system, which was working great! But after a reboot, the system didn't boot anymore, the bootloader seems not to work. The screen stays black and when connecting to a PC, I get a 'QHSUSB__BULK' device, for which I managed to install the Qualcomm COM Port drivers, but I don't have the old (QPST/QFIL) compatible firmware, which I could flash.
There is no fastboot, the system seems to be in the so called EDL mode. Maybe someone owns the necessary firmware, I suppose that the boot partition is the problem, because the system booted fine the first time.
My battery is also still the original one, but the watch doesn't boot neither itself or powered by USB.
Thanks in advance.

[beroset]

On 3 June 2023, I had reflashed my catfish, confirmed it was working and configured several things to my preferences (installed asteroid-weatherfetch, set timezone and watchface, etc.). Then I left it on the charger plugged in to my computer's USB port as I went to do some other things for about an hour. When I came back, the watch appeared to be off and would not reboot via button press. When I connect to the computer I get this via dmesg:

[71766.613884] usb 3-1: new high-speed USB device number 23 using xhci_hcd
[71766.741355] usb 3-1: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00
[71766.741359] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[71766.741360] usb 3-1: Product: QHSUSB__BULK
[71766.741361] usb 3-1: Manufacturer: Qualcomm CDMA Technologies MSM

This appears to be some kind of Qualcomm diagnostic mode.

[kellerman]

On 3 June 2023, I had reflashed my catfish, confirmed it was working and configured several things to my preferences (installed asteroid-weatherfetch, set timezone and watchface, etc.). Then I left it on the charger plugged in to my computer's USB port as I went to do some other things for about an hour. When I came back, the watch appeared to be off and would not reboot via button press. When I connect to the computer I get this via dmesg:

[71766.613884] usb 3-1: new high-speed USB device number 23 using xhci_hcd
[71766.741355] usb 3-1: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00
[71766.741359] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[71766.741360] usb 3-1: Product: QHSUSB__BULK
[71766.741361] usb 3-1: Manufacturer: Qualcomm CDMA Technologies MSM

This appears to be some kind of Qualcomm diagnostic mode.

I have the exact same device recognition. And exact same problem. Looking for a way to unbrick the watch. With EDL mode it should be possible, but I could't find any firmware for those watches in the internet at all.
At first I tought that it might be a battery related problem and even ordered a new one, but after seeing your post, it is unlikely. Also the troubleshooting pages mention, that the critical partitions of the watch aren't affected, but somehow the watch still bricked.

[nerdius]

I managed to brick mine a week ago. Mine is beluga. I tried using fastboot and TWRP to wipe the partitions and reinstall the images, but nothing worked.

Will re-flashing it fix the device after builds are fixed?

Unfortunately, I don't have the old firmware to test it. I even checked my Btrfs snapshots. If anybody has a working firmware for beluga, I'd really appreciate a copy.

[eLtMosen]

@nerdius as long as your watch is able to enter/show the fastboot bootloader, you are having a different issue than the one described above. This issue is about watches getting stuck in QHSUSB__BULK mode.

@beroset i find it very curious that your idProduct shows 900e. All sources i found to describe the QHSUSB_BULK mode refer to it as 9006 mode and it is showing 9006 on my sparrow as idProduct. Very curious imho.

@kellerman Sorry for not taking the issue more serious for more than a week. I only got convinced this issue exists when Thorgalix reported the same for his sparrow in the matrix chat. Testing on my sparrow then sent it into QHSUSB__BULK mode too. And i did not find a way to leave that mode.

Current leads are

1. Phone users on XDA recovered their devices in this mode by copying stock partitions to the exposed mass storage devices. Thorgalix tried that using linux and got write errors and disconnects. Which lead to his watch being forced to EDL mode now. The various XDA threads all advise to use windows and a Qualcomm COM driver to write to the device in QHSUSB__BULK mode.
   I failed to set up a windows where this would work. When i connect my sparrow to windows using any driver, it just vibrate loops. But i am not done trying.
   Goal would be to recreate what the phone guys do and just write back known good partitions to the device while not receiving write errors and see if it boots again
   As i understand you can connect to the watch using windows, i would be very happy if you could link to the driver you used.

2. Thorgalix managed to force his watch into EDL. But we do not know if his sparrow got corrupted further in the process. Since EDL is the ultimate fall back mode in protected area of memory. I and @beroset tried to enter EDL mode by using an EDL cable. But those attempts failed. Thorgalix being in EDL mode doe not help much currently. since we do not have QFIL/EDL compatible images to even flash in EDL. So priority would be to solve the situation EDL unrelated. But who knows, maybe we can manage to create QFIL images with the required .xml descriptions at some point.

Generally, the problem seems to have been solved for new builds as i could test today with images i compiled after this PR got merged #262
This means, we "only" got 5 or 6 known watches bricked. Limiting my personal incentive to spend much more time on this issue just to safe a few watches. Personally, i am soon going to just write off my sparrow :/

[nerdius]

@eLtMosen, ah, I see. My bad.

Yes, I can enter fastboot mode. I can even access ADB shell after the OS boots. The problem is, after the boot splash screen, it goes completely black and doesn't respond to any input, including ADB.

Good news is, I can access dmesg for a brief moment.

[kellerman]

@eLtMosen Thanks for the answer. I looked up my Downloads folder and this seems to be the Windows driver I used.
https://failiem.lv/u/m6pzawcf8
OPST version I used: 2.7.496.1 with packaged QFIL 2.0.3.5. It detects the Qualcomm COM port and seems that only the right firmware is needed. Maybe some different version can also work, I don't know about that. Not an expert in EDL. Once flashed my phone this way, but the software was freely available on the internet.
It would be great to download the software from another watch and make some flashable firmware. But I can't help much with that, so my watch will be laying in the shelf for now. I own this one catfish and that's it.
My catfish identifies as this under linux:

[ 3597.877298] usb 1-14: new high-speed USB device number 19 using xhci_hcd
[ 3598.004762] usb 1-14: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00
[ 3598.004765] usb 1-14: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3598.004766] usb 1-14: Product: QHSUSB__BULK
[ 3598.004767] usb 1-14: Manufacturer: Qualcomm CDMA Technologies MSM
[ 3598.004768] usb 1-14: SerialNumber: 1234567890ABCDEF
[ 3605.524522] usb 1-14: USB disconnect, device number 19
[ 3606.093404] usb 1-14: new high-speed USB device number 20 using xhci_hcd
[ 3606.220992] usb 1-14: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00
[ 3606.220996] usb 1-14: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3606.220997] usb 1-14: Product: QHSUSB__BULK
[ 3606.220999] usb 1-14: Manufacturer: Qualcomm CDMA Technologies MSM
[ 3606.220999] usb 1-14: SerialNumber: 1234567890ABCDEF

Good luck guys, maybe you can figure a way to get the correct firmware...

[eLtMosen]

We definitely got thre different states between our watches then.
The idProduct is 9006, not 900e on my sparrow.
For EDL mode however, i only find 9008 documented.
If your catfish is indeed in the "regular" EDL mode i have seen on other devices, your sparrow should pop up as "Qualcomm Gobi ..." in lsusb, @beroset

This woukd be the output of the EDL mode i am a bit familiar with, as seen on Thorgalix watch after breaking partitions in 9006 mode on sparrow:
Note the "Qualcomm USB modem converter detected", which is only present for Thorgalix.

[ 4964.057022] qcserial 1-2:1.0: device disconnected

[ 4969.703250] usb 1-2: new high-speed USB device number 59 using xhci_hcd

[ 4969.844180] usb 1-2: New USB device found, idVendor=05c6, idProduct=9008, bcdDevice= 0.00

[ 4969.844195] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0


[ 4969.844201] usb 1-2: Product: QHSUSB__BULK



[ 4969.844206] usb 1-2: Manufacturer: Qualcomm CDMA Technologies MSM



[ 4969.846223] qcserial 1-2:1.0: Qualcomm USB modem converter detected




[ 4969.846511] usb 1-2: Qualcomm USB modem converter now attached to ttyUSB0

This is the output on my sparrow with unaltered state after running into the problem in first place:

10063.455493] usb 1-2: new high-speed USB device number 10 using xhci_hcd

[10063.597169] usb 1-2: config 1 has an invalid interface number: 20 but max is 1

[10063.597182] usb 1-2: config 1 has no interface number 1

[10063.598596] usb 1-2: New USB device found, idVendor=05c6, idProduct=9006, bcdDevice= 0.00

[10063.598604] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3


[10063.598608] usb 1-2: Product: QHSUSB__BULK


[10063.598611] usb 1-2: Manufacturer: Qualcomm CDMA Technologies MSM



[10063.598614] usb 1-2: SerialNumber: 1234567890ABCDEF




[10063.600010] usb-storage 1-2:1.20: USB Mass Storage device detected





[10063.600343] scsi host0: usb-storage 1-2:1.20

[eLtMosen]

The different mdes did not quite let me sleep. Here is what i found out regarding those:

9006 Mode:

• Also known as "QDLoader 9006 mode or QHSUSB__BULK mode."
• In this mode, the device identifies itself to the computer as a "Qualcomm HS-USB QDLoader 9006" and is ready to receive firmware updates or new software.
• It was often used during the initial flashing process to load new firmware or repair a bricked device. But has been disconntinued at some point.
• 9006 mode is generally triggered by specific button combinations or commands sent to the device. I found no mention of it being a fallback mode due to corruption of the boot partition, like i found for EDL 9008 mode. So, we might have entered it "willingly" by accident?

9008 Mode:

• Also known as "Emergency Download Mode (EDL) 9008."
• In this mode, the device identifies itself as "Qualcomm HS-USB QDLoader 9008" and is ready to establish a connection with a computer to download and flash firmware via an exposed modem.
• 9008 mode is often used for unbricking devices or performing low-level operations when the bootloader or regular Android system is inaccessible.
• Itt is typically activated through specific hardware events like shorting test pins, an EDL cable or software commands such as reboot edl or fastboot oem edl.

900E Mode:

• Also known as "Emergency Download Mode (EDL) 900E."
• 900E mode is somewhat similar to 9008 mode but indicates a different state of the device.
• When a device enters 900E mode, it usually means that the device's primary bootloader is corrupted or missing.
• This mode is often used by manufacturers or service centers to recover devices with severe software issues when 9008 mode may not be accessible.
• Entering 900E mode can usually be more challenging than accessing 9006 or 9008 mode. Which is not the case for us as it seems.

[kellerman]

Hello guys. Is there any progress on trying to flash the bricked devices?

[CE1CECL]

On 3 June 2023, I had reflashed my catfish, confirmed it was working and configured several things to my preferences (installed asteroid-weatherfetch, set timezone and watchface, etc.). Then I left it on the charger plugged in to my computer's USB port as I went to do some other things for about an hour. When I came back, the watch appeared to be off and would not reboot via button press. When I connect to the computer I get this via dmesg:

[71766.613884] usb 3-1: new high-speed USB device number 23 using xhci_hcd
[71766.741355] usb 3-1: New USB device found, idVendor=05c6, idProduct=900e, bcdDevice= 0.00
[71766.741359] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[71766.741360] usb 3-1: Product: QHSUSB__BULK
[71766.741361] usb 3-1: Manufacturer: Qualcomm CDMA Technologies MSM

This appears to be some kind of Qualcomm diagnostic mode.

I have the exact same device recognition. And exact same problem. Looking for a way to unbrick the watch. With EDL mode it should be possible, but I could't find any firmware for those watches in the internet at all. At first I tought that it might be a battery related problem and even ordered a new one, but after seeing your post, it is unlikely. Also the troubleshooting pages mention, that the critical partitions of the watch aren't affected, but somehow the watch still bricked.

If anyone needs catfish (NOT EXT) firmware, full edl stock rom, let me know. Planning to upload to archive.org

[kellerman]

If anyone needs catfish (NOT EXT) firmware, full edl stock rom, let me know. Planning to upload to archive.org

Great news for catfish users with dead devices! Could there be a possibility to this firmware to somehow work on the different similar variants like sparrow or skipjack? Enough for fastboot to work?

[beroset]

Unfortunately, the stock firmware won't help much unless someone figures out a way to get the device out of the 900e mode and into either the 9006 or 9008 modes.

[beroset]

Update: after languishing for months in a dark drawer, I pulled out this same catfish and put it on the charger. After some time, I attempted to boot it and it showed the Ticwatch logo, followed by a brief appearance of the AsteroidOS splash screen. It promptly rebooted, but now I can reliably get it into fastboot mode, and it seems to have miraculously unbricked itself! A battery is on order.

Previously, I had removed the battery and left it for a few days before replacing with a known good battery. That sequence did not recover the watch.

[kellerman]

Update: after languishing for months in a dark drawer, I pulled out this same catfish and put it on the charger. After some time, I attempted to boot it and it showed the Ticwatch logo, followed by a brief appearance of the AsteroidOS splash screen. It promptly rebooted, but now I can reliably get it into fastboot mode, and it seems to have miraculously unbricked itself! A battery is on order.

Previously, I had removed the battery and left it for a few days before replacing with a known good battery. That sequence did not recover the watch.

Mine is also in a dark drawer, maybe I should take it out as well.

[eLtMosen]

No luck with sparrow. It still exposes all partitions when conected.
But it sat in daylight on a cupboard. Maybe i should try a drawer.
On a more serious note, i think this sparrows battery was/is not empty and i might just try pulling it out for very much longer than before.