Debricking a Formlabs Form 3+: SOM failure and black screen of no boot

The symptom

The printer simply stopped coming up. One day it powered on and never reached a usable state. No firmware update had been done, and the machine had been on a UPS the whole time, so there was no power event to point at. From the outside, it looked dead: power on, Formlabs logo lights up, screen backlight blinks, but no motor movement and no working interface, no obvious life.

So how should I approach this issue? Of course, by reaching out to support. But after waiting for two days, I got a response saying I have to replace the System on a Module (SOM), but they no longer have them in stock, so I should just buy a new printer...

Well, that won't do so like any other good engineer, I started searching for a serial console.

Quest for the serial console

You cannot diagnose a Linux device by staring at it. You need its serial console, the text stream the bootloader and kernel print as they start. So where is it?

SOM has a couple of test points, but they are either under a heatsink or on the bottom of the board. Finding what they do get even trickier because, despite the board marking GND and 3.3V, it does not boot when the power is applied to them. Probably the DIMM connection to the motherboard provides the enable signals, but I was not planning on desoldering that.

I checked the "SOM" port on the motherboard for continuity to the DIMM connector with a multimeter, but that was a dead end.

So, no clear indicator on the serial port on the SOM and the motherboard... but wait, there was one more board!

This is the connector board on a flex cable. It has test points for an LED, TX, RX and AB. I have soldered the wires and attached a serial-to-USB adapter, and voilà! Kernel messages. To get GND for the serial connection, I soldered a wire to the reset button on the metal chassis (it will not work without GND).

stty -F /dev/ttyUSB0 115200 cs8 -cstopb -parenb raw -echo
cat /dev/ttyUSB0 | tee boot.log

The first useful finding came straight away: the console is output only. I could read everything the board printed, but anything I typed never reached it. Formlabs locked the console down for production, which is sensible from their side and inconvenient from mine. For pure diagnosis it does not matter, because at this stage all I need to do is read.

Reading the boot log told me almost everything

Power on, capture, and the log tells the story. Trimmed to the part that matters:

[    2.871903] EXT4-fs (mmcblk0p6): mounted filesystem with ordered data mode.
[    2.880068] VFS: Mounted root (ext4 filesystem) on device 179:6.
Freeing unused kernel memory: ...
/sbin/init: error while loading shared libraries: /lib/libc.so.6: invalid ELF header
[    3.116805] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00

Read that carefully:

The kernel loads fine.
The 16 GB internal storage (mmcblk0) is detected and apparently healthy.
The root partition mmcblk0p6 mounts as ext4, and the filesystem journal replays cleanly.
The kernel hands off to /sbin/init, the first userspace program.
init tries to load the C library, /lib/libc.so.6, and finds an invalid ELF header.
With no working init, the kernel does the only thing it can: panic.

So this was not a dead chip, not a dead controller, not a lost partition table, and not a trashed filesystem. It read like one corrupted file.

/lib/libc.so.6 is the C library that essentially every program links against, so the moment it is unreadable, nothing in userspace can start. The first program to need it, init, falls over, and the kernel gives up.

That felt like a good place to be, because the fix is conceptually simple: get write access to that partition and replace one corrupt file. The hard part is "get write access," and that is where most of the work went.

What I was actually dealing with

To plan anything I had to know exactly what was in front of me. The boot log plus a look at the board gave the full picture:

SoC: TI Sitara AM5728, reports as DRA752 ES2.0, dual Cortex-A15.
Module: CompuLab CL-SOM-AM57x system on module. So there is a fallback if the SOM gets fully bricked.
Machine name: "Formlabs Daguerre", their internal board name.
Bootloader: Das U-Boot 2017.01-cl-salsa-am57x, CompuLab's build.
Kernel: TI vendor Linux 4.9.x.
Main storage: soldered eMMC, 16 GB, shows up as mmcblk0.
Boot flash: Winbond W25Q32 QSPI NOR, 4 MB, holds the bootloader.
Console: UART3 at 0x48020000, exposed as ttyS2, 115200n8.

Two facts here shaped everything that followed.

First, the AM5728 is a GP (general-purpose) part, not a high-security part. There is no signed boot wall stopping me from running my own boot code on it.

Second, the eMMC is soldered down. There is no SD card slot and no socket. I could not pop the storage out, read it on another machine, and put it back. Or do a full BGA desoldering, attaching tiny wires to access it and then solder it back with fixes that would hopefully restore the corrupted file. That did not sound like fun. Whatever I did, I had to do in place, through the chip's own interfaces.

Two flash chips, and why there are two

People are sometimes surprised that the printer has two separate non volatile chips. They do different jobs:

The QSPI NOR (4 MB) is small, simple, and reliable. It holds the early boot code: the first stage loader (MLO/SPL), U-Boot itself, and U-Boot's environment (its settings). The SoC's mask ROM knows how to read this chip at power on. Think of it as the ignition.
The eMMC (16 GB) is large and holds the actual operating system: the kernel, the device tree, and the root filesystem with all of Formlabs' software. This is the chip with the bad file on it.

The QSPI layout on this board, for reference:

0x00000 to 0x40000: MLO, the first stage bootloader (SPL).
0x40000 to 0xc0000: U-Boot proper.
0xc0000 to 0x100000: the U-Boot environment (settings and boot commands).
0x100000 to 0x400000: reserved, about 3 MB, unused.

How Sitara CPU boots

A recovery plan lives or dies on understanding the boot chain, so here it is for this class of TI SoC:

Mask ROM. Burned into the SoC, runs first. Then it reads the QSPI and loads the first stage loader. It can also be coaxed into accepting code over USB.
MLO / SPL. The first stage loader. Its main job is to bring up the DDR memory and then load the bigger bootloader.
U-Boot. The full bootloader common on embedded systems and Android phones. It reads its environment, then loads the kernel and device tree and starts them. On this board, U-Boot runs silently in production, and with the console input disabled, there is no "press a key to stop" prompt available.
Kernel. Linux comes up, mounts the root filesystem from the eMMC, and hands off to /sbin/init.
init and userspace. This is where it died.

My printer got all the way to step 5 and fell at the last hurdle. The hardware, the bootloader, the kernel, and the filesystem were all fine. Only userspace could not start.

Why I suspected bit rot

The interesting question was why one file went bad, because the answer affects how worried other Form 3 owners should be. The usual suspects did not fit:

Power loss or brownout? The machine was on a UPS. And a power loss during a write tends to leave filesystem damage that the journal flags. Here, the journal replayed cleanly, and only the file's contents were wrong. That is not the signature of an interrupted write.
Bad firmware update? No update was performed. The file just went bad in place.

What does fit is silent bit rot in the eMMC. NAND flash cells lose charge over time and can be disturbed by nearby reads and by accumulated wear. An ageing or marginal block that holds a file can eventually read back incorrectly. The block that happened to hold libc.so.6 returned garbage, the ELF header no longer validated, and the system could not start. The surrounding filesystem metadata, living in other blocks, was untouched, which is exactly what you would expect from a localised media problem rather than a system-wide event.

These boards accumulate years of logging and state writes to the same eMMC, so a single tired block is entirely plausible. Several other owners report similar "it just stopped booting" failures, which is consistent with a wear and retention pattern rather than bad luck.

First attempt at a way in: forcing USB boot

I knew the target: get write access to mmcblk0p6. The first idea was to make the SoC boot from USB instead of the eMMC, push my own bootloader, and use that to reach the storage.

The AM5728 mask ROM will fall through to a USB peripheral boot mode if it cannot boot from its normal source. I desoldered and lifted the QSPI chip-select pin to isolate the chip and break the normal boot path, and on power up the SoC duly enumerated on my host as a USB device (it shows up as 0451:d013, TI's "VAYU" boot device).

Then I burned time on the wrong tool. My first reach was omapboot / omap4boot, which speaks the OMAP44xx ROM USB protocol. The AM5728 is a DRA7xx class part with a different ROM USB boot protocol. The device enumerates but never accepts the OMAP4 handshake. It was the right idea aimed at the wrong era of silicon.

The correct host tool for this SoC is TI's dra7xx-bootswitch. I built it, sliced an SPL out of a TI AM57x EVM MLO, and pushed it. The transfer went through (about 157 KB sent), but then nothing: no serial banner, no second stage USB device. The reason is mundane and important. The first stage loader's main job is to initialise DDR, and the DDR configuration is board specific. A stock TI EVM SPL does not match the CompuLab SOM's memory, so it faults during DDR bring up and never gets far enough to do anything useful. Without a first stage loader built for this exact module, USB peripheral boot was a dead end.

Reading the boot flash with a Raspberry Pi

If I could not push a working bootloader in, the next move was to read the genuine one out, so I could understand the lock and eventually modify it. The QSPI is a standard 3.3V SOIC-8 SPI NOR chip, and a Raspberry Pi has an SPI bus, and flashrom talks to SPI NOR directly.

QSPI deadbug connected to raspberry pi for flashing

Because of multiple debricking attempts I had to wire a connector to avoid constand soldering and desoldering of the QSPI chip

With the chip lifted off the board to isolate it from the SoC, a deadbug approach was my first try (Later, I added a small soldered connector, because desoldering, attaching tiny wires, then removing them and soldering the chip back to the board was taking too long).

One wiring note that cost me twenty minutes: the chip will not respond unless its write-protect and hold pins, and its supply, are all tied to 3.3V, and the clip has to sit cleanly on all eight contacts. With that right:

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1000 -c W25Q32JV -r qspi_dump.bin

I read it twice and compared the two dumps byte for byte. They matched, which told me the connection was stable and the data was trustworthy. That 4 MB dump is also a complete backup of the boot chain, which is worth having on its own.

What the boot flash told me

The dump was the real turning point of this first phase. Decoding it:

The MLO and U-Boot were byte for byte the genuine Formlabs/CompuLab build, with no signature wall on the GP part.
The U-Boot environment had silent=1 and bootdelay=0. That is why the console looked locked: silent output and no countdown to interrupt.
The boot logic implements an A/B root filesystem. A variable called fl_bootpart selects which partition the system boots from, and it flips between partition 5 and partition 6. The printer was running from partition 6, the flash bit-rotted one. There was a second, separate copy of the operating system on partition 5.
There was about 3 MB of unused space in the QSPI, from 0x100000 to the end.
There is a factory netboot recovery path, reached through a test button on a GPIO, that pulls a kernel and root filesystem over the network from a hardcoded server address.
U-Boot had the usual storage and network commands compiled in (ext4load, ext4write, tftp, dhcp, nfs, mmc, sf), but no ums, no fastboot, and no dfu. So there was no built-in way to expose the eMMC as a USB disk.

That 3 MB of free space in the boot flash both turned out to matter a great deal.

Trying to unlock the console

Knowing why the console was silent, the obvious move was to un-silence it. The environment is a list of name=value pairs with a CRC32 in front. Get the CRC wrong and U-Boot rejects the whole block and falls back to defaults, so this has to be exact. I reproduced the genuine environment's checksum byte for byte first to prove I understood the format, then made a tiny edit: remove silent, set a real bootdelay. Only a handful of bytes changed. I flashed just the environment region back with the Pi and verified it.

Then I tried to use the console: interrupt the autoboot, drop to a U-Boot prompt, type the few commands that would have ended this in five minutes.

Nothing I typed did anything.

Proving the serial input was really dead

I needed to know whether the input was genuinely dead or just mis-wired, because the answer changes the entire approach. U-Boot's environment defines a couple of helper commands that toggle the printer's status LEDs through a GPIO. I put a multimeter on that GPIO test point and sent the toggle commands blindly. The voltage never moved. The autoboot countdown was never interrupted either. And an FTDI loopback test confirmed my adapter's transmit line was fine on its own.

The conclusion was unavoidable: the board's UART receive path is disabled in this production build either in software or in hardware. The console is output only by design, not by accident. Even with silent gone and a real bootdelay set, there was no way to type a single character at the bootloader.

Where this left me

At the end of this first stretch of work I had learned a lot and proved a hard limit:

The printer is, as far as the boot log shows, a small number of corrupt files away from working.
The storage is soldered, so I have to reach it in place, through the chip's own interfaces.
The SoC is open, a GP part, so I am allowed to run my own boot code. USB peripheral boot is reachable but needs a first stage loader built for this exact module, which I do not have.
I can read the boot flash and rewrite it at will with a Raspberry Pi and flashrom, and I have a verified backup of it.
But the serial console takes no input. I can watch the machine boot and I can rewrite its boot flash, and I still cannot type one command at the bootloader.

That last constraint, no interactive prompt anywhere, is the thing that shaped every decision about how to get a repair onto the chip.

Looks like a part two will be needed...

Btw. the full boot log is bellow:

....[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.9.65+ (oe-user@oe-host) (gcc version 7.3.0 (GCC) ) #1 SMP PREEMPT Fri May 17 09:49:14 UTC 2024
[    0.000000] CPU: ARMv7 Processor [412fc0f2] revision 2 (ARMv7), cr=30c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt:Machine model: Formlabs Daguerre
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: created CMA memory pool at 0x0000000095800000, size 56 MiB
[    0.000000] OF: reserved mem: initialized node ipu2_cma@95800000, compatible id shared-dma-pool
[    0.000000] Reserved memory: created CMA memory pool at 0x0000000099000000, size 64 MiB
[    0.000000] OF: reserved mem: initialized node dsp1_cma@99000000, compatible id shared-dma-pool
[    0.000000] Reserved memory: created CMA memory pool at 0x000000009d000000, size 32 MiB
[    0.000000] OF: reserved mem: initialized node ipu1_cma@9d000000, compatible id shared-dma-pool
[    0.000000] cma: Reserved 24 MiB at 0x00000000be400000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] OMAP4: Map 0x00000000bfd00000 to fe600000 for dram barrier
[    0.000000] DRA752 ES2.0
[    0.000000] percpu: Embedded 13 pages/cpu @ef62b000 s22284 r8192 d22772 u53248
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 259648
[    0.000000] Kernel command line: console=ttyS2,115200n8 root=/dev/mmcblk0p6 rootfstype=ext4 rw rootwait mem=1G
[    0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Memory: 836624K/1045504K available (8192K kernel code, 944K rwdata, 5208K rodata, 2048K init, 306K bss, 28656K reserved, 180224K cma-reserved, 234496K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xf0800000 - 0xff800000   ( 240 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xf0000000   ( 768 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0a00000   (10208 kB)
[    0.000000]       .init : 0xc1000000 - 0xc1200000   (2048 kB)
[    0.000000]       .data : 0xc1200000 - 0xc12ec3f0   ( 945 kB)
[    0.000000]        .bss : 0xc12ee000 - 0xc133a8c0   ( 307 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] .Build-time adjustment of leaf fanout to 32.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] OMAP clockevent source: timer1 at 32786 Hz
[    0.000000] arm_arch_timer: Architected cp15 timer(s) running at 6.14MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x16af5adb9, max_idle_ns: 440795202250 ns
[    0.000005] sched_clock: 56 bits at 6MHz, resolution 162ns, wraps every 4398046511023ns
[    0.000016] Switching to timer-based delay loop, resolution 162ns
[    0.000321] clocksource: 32k_counter: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 58327039986419 ns
[    0.000328] OMAP clocksource: 32k_counter at 32768 Hz
[    0.000800] Console: colour dummy device 80x30
[    0.000826] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.29 BogoMIPS (lpj=61475)
[    0.000840] pid_max: default: 32768 minimum: 301
[    0.000946] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000956] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.001635] CPU: Testing write buffer coherency: ok
[    0.001850] /cpus/cpu@0 missing clock-frequency property
[    0.001867] /cpus/cpu@1 missing clock-frequency property
[    0.001878] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.001895] Setting up static identity map for 0x80200000 - 0x80200060
[    0.082471] EFI services will not be available.
[    0.170233] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.170327] Brought up 2 CPUs
[    0.170340] SMP: Total of 2 processors activated (24.59 BogoMIPS).
[    0.170346] CPU: All CPU(s) started in SVC mode.
[    0.170844] devtmpfs: initialized
[    0.203738] VFP support v0.3: implementor 41 architecture 4 part 30 variant f rev 0
[    0.203983] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.204000] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.207473] pinctrl core: initialized pinctrl subsystem
[    0.208314] NET: Registered protocol family 16
[    0.209216] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.210354] omap_hwmod: l3_main_2 using broken dt data from ocp
[    0.430341] cpuidle: using governor ladder
[    0.470372] cpuidle: using governor menu
[    0.478122] GPIO line 22 (rgb-iovdd) hogged as output/high
[    0.479819] OMAP GPIO hardware version 0.1
[    0.494814] irq: no irq domain found for /ocp/l4@4a000000/scm@2000/pinmux@1400 !
[    0.520414] No ATAGs?
[    0.520461] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.520470] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.520860] omap4_sram_init:Unable to allocate sram needed to handle errata I688
[    0.520870] omap4_sram_init:Unable to get sram pool needed to handle errata I688
[    0.521407] OMAP DMA hardware revision 0.0
[    0.561458] omap-dma-engine 4a056000.dma-controller: OMAP DMA engine driver (LinkedList1/2/3 supported)
[    0.562749] edma 43300000.edma: memcpy is disabled
[    0.567499] edma 43300000.edma: TI EDMA DMA engine driver
[    0.571124] omap-iommu 40d01000.mmu: 40d01000.mmu registered
[    0.571306] omap-iommu 40d02000.mmu: 40d02000.mmu registered
[    0.571468] omap-iommu 58882000.mmu: 58882000.mmu registered
[    0.571618] omap-iommu 55082000.mmu: 55082000.mmu registered
[    0.573759] omap_i2c 48070000.i2c: could not find pctldev for node /ocp/l4@4a000000/scm@2000/pinmux@1400/i2c1_pins_default, deferring probe
[    0.573798] omap_i2c 48072000.i2c: could not find pctldev for node /ocp/l4@4a000000/scm@2000/pinmux@1400/i2c2_pins_default, deferring probe
[    0.573830] omap_i2c 48060000.i2c: could not find pctldev for node /ocp/l4@4a000000/scm@2000/pinmux@1400/i2c3_pins_default, deferring probe
[    0.573862] omap_i2c 4807a000.i2c: could not find pctldev for node /ocp/l4@4a000000/scm@2000/pinmux@1400/i2c4_pins_default, deferring probe
[    0.573894] omap_i2c 4807c000.i2c: could not find pctldev for node /ocp/l4@4a000000/scm@2000/pinmux@1400/i2c5_pins_default, deferring probe
[    0.574027] media: Linux media interface: v0.10
[    0.574076] Linux video capture interface: v2.00
[    0.574108] pps_core: LinuxPPS API ver. 1 registered
[    0.574115] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.574134] PTP clock support registered
[    0.574163] EDAC MC: Ver: 3.0.0
[    0.575155] omap-mailbox 48840000.mailbox: omap mailbox rev 0x400
[    0.575447] omap-mailbox 48842000.mailbox: omap mailbox rev 0x400
[    0.575771] Advanced Linux Sound Architecture Driver Initialized.
[    0.576686] clocksource: Switched to clocksource arch_sys_counter
[    0.586877] NET: Registered protocol family 2
[    0.587377] TCP established hash table entries: 8192 (order: 3, 32768 bytes)
[    0.587439] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[    0.587564] TCP: Hash tables configured (established 8192 bind 8192)
[    0.587618] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    0.587649] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    0.587849] NET: Registered protocol family 1
[    0.588183] RPC: Registered named UNIX socket transport module.
[    0.588191] RPC: Registered udp transport module.
[    0.588198] RPC: Registered tcp transport module.
[    0.588204] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.589127] hw perfevents: enabled with armv7_cortex_a15 PMU driver, 7 counters available
[    0.592019] workingset: timestamp_bits=14 max_order=18 bucket_order=4
[    0.602212] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.603140] NFS: Registering the id_resolver key type
[    0.603161] Key type id_resolver registered
[    0.603169] Key type id_legacy registered
[    0.603208] ntfs: driver 2.1.32 [Flags: R/O].
[    0.604463] Key type asymmetric registered
[    0.604473] Asymmetric key parser 'x509' registered
[    0.604519] bounce: pool size: 64 pages
[    0.604693] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 246)
[    0.604704] io scheduler noop registered
[    0.604711] io scheduler deadline registered
[    0.604869] io scheduler cfq registered (default)
[    0.609631] pinctrl-single 4a003400.pinmux: 282 pins at pa fc003400 size 1128
[    0.616021] backlight supply power not found, using dummy regulator
[    0.673361] Serial: 8250/16550 driver, 10 ports, IRQ sharing disabled
[    0.676766] console [ttyS2] disabled
[    0.676813] 48020000.serial: ttyS2 at MMIO 0x48020000 (irq = 299, base_baud = 3000000) is a 8250
[    1.512317] console [ttyS2] enabled
[    1.516791] 4806e000.serial: ttyS3 at MMIO 0x4806e000 (irq = 300, base_baud = 3000000) is a 8250
[    1.526505] 48066000.serial: ttyS4 at MMIO 0x48066000 (irq = 301, base_baud = 3000000) is a 8250
[    1.537298] omap_rng 48090000.rng: OMAP Random Number Generator ver. 20
[    1.544401] [drm] Initialized
[    1.548523] omapdss_dss 58000000.dss: master bind failed: -517
[    1.556411] display supply vcc not found, using dummy regulator
[    1.562535] panel-dpi display: failed to find video source
[    1.580445] brd: module loaded
[    1.588760] loop: module loaded
[    1.595474] m25p80 spi0.0: w25q32 (4096 Kbytes)
[    1.600095] 4 ofpart partitions found on MTD device spi0.0
[    1.605603] Creating 4 MTD partitions on "spi0.0":
[    1.610447] 0x000000000000-0x000000040000 : "MLO"
[    1.616130] 0x000000040000-0x0000000c0000 : "uboot"
[    1.621971] 0x0000000c0000-0x000000100000 : "uboot environment"
[    1.628871] 0x000000100000-0x000000400000 : "reserved"
[    1.635814] libphy: Fixed MDIO Bus: probed
[    1.640843] tun: Universal TUN/TAP device driver, 1.6
[    1.645914] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    1.706717] davinci_mdio 48485000.mdio: davinci mdio revision 1.6
[    1.712840] libphy: 48485000.mdio: probed
[    1.719732] davinci_mdio 48485000.mdio: phy[0]: device 48485000.mdio:00, driver Micrel KSZ8081 or KSZ8091
[    1.729934] cpsw 48484000.ethernet: No slave[1] phy_id, phy-handle, or fixed-link property
[    1.738278] cpsw 48484000.ethernet: Detected MACID = 38:0a:ab:06:35:a4
[    1.744917] cpsw 48484000.ethernet: cpts: overflow check period 500 (jiffies)
[    1.753627] mousedev: PS/2 mouse device common for all mice
[    1.760542] omap_rtc 48838000.rtc: rtc core: registered 48838000.rtc as rtc2
[    1.768451] i2c /dev entries driver
[    1.777216] omap_hsmmc 4809c000.mmc: Got CD GPIO
[    1.781900] omap_hsmmc 4809c000.mmc: Got WP GPIO
[    1.786742] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr104 mode
[    1.793212] omap_hsmmc 4809c000.mmc: no pinctrl state for ddr50 mode
[    1.799612] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr50 mode
[    1.805993] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr25 mode
[    1.812393] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr12 mode
[    1.819166] omap_hsmmc 4809c000.mmc: no pinctrl state for hs mode
[    1.825962] omap_hsmmc 480b4000.mmc: no pinctrl state for sdr25 mode
[    1.832372] omap_hsmmc 480b4000.mmc: no pinctrl state for sdr12 mode
[    1.838775] omap_hsmmc 480b4000.mmc: no pinctrl state for ddr_1_8v mode
[    1.845419] omap_hsmmc 480b4000.mmc: no pinctrl state for hs mode
[    1.851553] omap_hsmmc 480b4000.mmc: no pinctrl state for hs200_1_8v mode
[    1.921376] ledtrig-cpu: registered to indicate activity on CPUs
[    1.927852] hidraw: raw HID events driver (C) Jiri Kosina
[    1.947031] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[    1.953850] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.959970] NET: Registered protocol family 10
[    1.964662] mmc0: new MMC card at address 0001
[    1.979627] mmcblk0: mmc0:0001 TB2916 14.6 GiB 
[    1.980128] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.989907] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[    1.996434] NET: Registered protocol family 17
[    2.000121] mmcblk0boot0: mmc0:0001 TB2916 partition 1 4.00 MiB
[    2.007096] Key type dns_resolver registered
[    2.010388] mmcblk0boot1: mmc0:0001 TB2916 partition 2 4.00 MiB
[    2.017539] omap_voltage_late_init: Voltage driver support not added
[    2.024015] Power Management for TI OMAP4+ devices.
[    2.028214]  mmcblk0: p1 p2 p3 < p5 p6 p7 >
[    2.033491] Registering SWP/SWPB emulation handler
[    2.039853] registered taskstats version 1
[    2.055118] dmm 4e000000.dmm: workaround for errata i878 in use
[    2.062721] dmm 4e000000.dmm: initialized all PAT entries
[    2.069645] palmas 0-0058: Irq flag is 0x00000008
[    2.099090] palmas 0-0058: Muxing GPIO 2f, PWM 0, LED 0
[    2.113210] random: fast init done
[    2.119799] ldo1: Bringing 3000000uV into 3300000-3300000uV
[    2.145792] palmas-rtc 48070000.i2c:tps659038@58:tps659038_rtc: rtc core: registered 48070000.i2c:tps659 as rtc1
[    2.158332] omap_i2c 48070000.i2c: bus 0 rev0.12 at 400 kHz
[    2.307222] Goodix-TS 1-005d: ID 911, version: 1060
[    2.312555] omap_i2c 48072000.i2c: bus 1 rev0.12 at 400 kHz
[    2.318513] Goodix-TS 1-005d: Direct firmware load for goodix_911_cfg.bin failed with error -2
[    2.332623] input: Goodix Capacitive TouchScreen as /devices/platform/44000000.ocp/48072000.i2c/i2c-1/1-005d/input/input0
[    2.357683] rtc-pcf8523 2-0068: rtc core: registered rtc-pcf8523 as rtc0
[    2.364515] omap_i2c 48060000.i2c: bus 2 rev0.12 at 400 kHz
[    2.371328] omap_i2c 4807a000.i2c: bus 3 rev0.12 at 400 kHz
[    2.417146] lm75 4-0048: hwmon0: sensor 'lm75'
[    2.448514] omap_i2c 4807c000.i2c: bus 4 rev0.12 at 400 kHz
[    2.455942] OMAP DSS rev 6.1
[    2.459285] omapdss_dss 58000000.dss: bound 58001000.dispc (ops dispc_component_ops)
[    2.467579] display supply vcc not found, using dummy regulator
[    2.475737] omap_hsmmc 4809c000.mmc: Got CD GPIO
[    2.480448] omap_hsmmc 4809c000.mmc: Got WP GPIO
[    2.485283] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr104 mode
[    2.491771] omap_hsmmc 4809c000.mmc: no pinctrl state for ddr50 mode
[    2.498167] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr50 mode
[    2.504547] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr25 mode
[    2.510940] omap_hsmmc 4809c000.mmc: no pinctrl state for sdr12 mode
[    2.517333] omap_hsmmc 4809c000.mmc: no pinctrl state for hs mode
[    2.607235] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[    2.613878] [drm] No driver support for vblank timestamp query.
[    2.626784] [drm] Enabling DMM ywrap scrolling
[    2.631501] omapdrm omapdrm.0: fb0: omapdrm frame buffer device
[    2.678500] rtc-pcf8523 2-0068: setting system clock to 2015-07-08 00:42:43 UTC (1436316163)
[    2.688285] aux_regulator_3v3: disabling
[    2.692247] ALSA device list:
[    2.695225]   No soundcards found.
[    2.867080] EXT4-fs (mmcblk0p6): recovery complete
[    2.871903] EXT4-fs (mmcblk0p6): mounted filesystem with ordered data mode. Opts: (null)
[    2.880068] VFS: Mounted root (ext4 filesystem) on device 179:6.
[    2.906502] devtmpfs: mounted
[    2.910798] Freeing unused kernel memory: 2048K
/sbin/init: error while loading shared libraries: /lib/libc.so.6: invalid ELF header
[    3.116805] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
[    3.116805] 
[    3.125986] CPU1: stopping
[    3.128708] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.65+ #1
[    3.134737] Hardware name: Generic DRA74X (Flattened Device Tree)
[    3.140854] Backtrace: 
[    3.143332] [<c020be68>] (dump_backtrace) from [<c020c144>] (show_stack+0x18/0x1c)
[    3.150934]  r7:fa212000 r6:20000193 r5:00000000 r4:c12244b8
[    3.156620] [<c020c12c>] (show_stack) from [<c04e0fbc>] (dump_stack+0x90/0xa4)
[    3.163876] [<c04e0f2c>] (dump_stack) from [<c020f370>] (handle_IPI+0x1b8/0x1cc)
[    3.171303]  r7:fa212000 r6:00000001 r5:00000000 r4:c1066e04
[    3.176987] [<c020f1b8>] (handle_IPI) from [<c02014a4>] (gic_handle_irq+0x78/0x7c)
[    3.184586]  r6:ef0bbf48 r5:fa21200c r4:c120446c
[    3.189222] [<c020142c>] (gic_handle_irq) from [<c020cbf8>] (__irq_svc+0x58/0x8c)
[    3.196734] Exception stack(0xef0bbf48 to 0xef0bbf90)
[    3.201807] bf40:                   00000001 00000000 fe600000 00000000 ffffe000 c120407c
[    3.210018] bf60: 00000002 c12040e4 00000000 00000000 c12040ec ef0bbfa4 ef0bbf84 ef0bbf98
[    3.218228] bf80: c0222058 c02092e4 60000013 ffffffff
[    3.223301]  r9:ef0ba000 r8:00000000 r7:ef0bbf7c r6:ffffffff r5:60000013 r4:c02092e4
[    3.231083] [<c02092bc>] (arch_cpu_idle) from [<c09e227c>] (default_idle_call+0x28/0x34)
[    3.239211] [<c09e2254>] (default_idle_call) from [<c0270cc8>] (cpu_startup_entry+0x19c/0x218)
[    3.247860] [<c0270b2c>] (cpu_startup_entry) from [<c020ef14>] (secondary_start_kernel+0x174/0x19c)
[    3.256942]  r7:c12ee250
[    3.259487] [<c020eda0>] (secondary_start_kernel) from [<8020154c>] (0x8020154c)
[    3.266911]  r5:00000000 r4:af060600
[    3.270508] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
[    3.270508]