きっかけ
前回の記事でTT01のソフトウェア的な面を扱いましたが、今回はハードに付いて行います。
分解
とりあえず分解します。裏面のシールの裏にネジが2本あるのでそれを緩めて外します。開けるとネジが1本見えるのでそれを外せば、基板がとれます。
SoC
端子とか乗っている側の大きい方のシールドを外すとSoCが入ってました。見てみるとHiSilicon製のHi3798MV200が入っていました。AndroidTVとか用のSoCらしく、4K 60fpsに対応しているようです。また、Android専用SoCではなく、Linuxとか色々載せられるようです。
放熱
結構分厚そうなアルミ板が入っています。しかし、他のサイトで放熱が良くなくて熱暴走したとのことなので一応横に風穴を開けておきました。超音波カッターで干渉しなさそうな部分に穴を開けました。
UART(シリアルコンソール)
こういう機器には大抵内部にデバッグ用にUARTやUSBがあるものです。分解したところUARTっぽいものを発見したので抵抗値を測ってみましたが、計測不可だったので、回路が繋がっていないようです。テスタでCPU付近のパッドを探していると導通が来てて抵抗が未接続なものを発見しました。ここを適当にショートさせると、UARTが使用できました。
写真内でピンが立てられている5つのパッドは左からRX、NC、3.3V、GND、TXでした。その上の4つパッドは左からGND、RX、TX、3.3Vです。ボーレートは115200でした。起動時にログが少し流れるだけで、カーネルログとかは一切出ませんでした。入力も禁止されているよう(もしかしたらUART↔USBの相性が悪いだけかも)で、コンソールが出てきたりすることもありませんでした。SoftBank PhotoVision TV 202HWのようには行かないようです。リセットボタンを押した状態で起動させるとリカバリが起動して自動で初期化されます。その際はコンソールに色々出てきて面白かったです(入力禁止なのは変わらず)。下に通常起動ログと初期化時のログを載せておきます。
起動時のログ
Bootrom start (CA)
Boot Media: eMMC
Decrypt auxiliary code ...OK
Entry boot auxiliary code
Auxiliary code - v1.00
DDR code - V1.1.2.1 20171011
Build: Oct 16 2017 - 23:06:43
Reg Version: v1.5.2h
Reg Time: 2017/12/05 21:46:58
Reg Name: hi3798cv2dmf_hi3798cv200_DDR4-2133_2rank_2rank_3GB_16bitx4_8layers.reg
DDRS
Boot auxiliary code success
Bootrom success
System startup
Relocate Boot
Jump to C code
Compressed-boot v1.0.0
Uncompress........................Ok
System startup
Relocate Boot
Jump to C code
TrustedCore Release Version MediaOS V100R003C00SPC001B315 base iCOS_MAIN_3.3.0_MHA_1.10, Mar 13 2019.16:00:07
[TEEGlobalTask]1/1/1970 0:0:2.30 TrustedCore Execute Successfully and jump to Linux kernel
pmem_info->crc32 != boot_crc32Uncompressing Linux... done, booting the kernel.
[task_rpmb]1/1/1970 0:0:48.475 [error] tee_rpmb_req_ioc: tee_rpmb_req_ioc failed, 0xffffffea
[task_rpmb]1/1/1970 0:0:48.483 [error] tee_rpmb_read_counter: send read_counter ioctl failed
[task_rpmb]1/1/1970 0:0:48.491 [error] rpmb_fs_key_verify: [RPMB] get counter ret 0xffff0000
[task_rpmb]1/1/1970 0:0:48.500 [error] rpmb_agent_fs_status: status read fail 0x00000000
[2task_keymaster]1/1/1970 0:0:48.511 [error] __ss_file_open: ss file open failed: ret=0xffff0008 and google/ec_prvkey
[2task_keymaster]1/1/1970 0:0:48.522 [error] __ss_file_open: file: google/ec_prvkey not exist!
[2task_keymaster]1/1/1970 0:0:48.530 [error] do_ss_file_size: ss_file open error.
[2task_keymaster]1/1/1970 0:0:48.538 [error] get_attest_key: get file size error: ret=-65528 and file_name=google/ec_prvkey.
[2task_keymaster]1/1/1970 0:0:48.549 [error] get_next_tlv: buf_len too short.
[2task_keymaster]1/1/1970 0:0:48.556 [error] km_attest_key: ecc_import_priv error.
[2task_keymaster]1/1/1970 0:0:48.563 [error] TA_InvokeCommandEntryPoint: keymaster cmd:6 invoke failed, ret=ffffffffresetボタンを押しながらの起動(初期化時)
Bootrom start (CA)
Boot Media: eMMC
Decrypt auxiliary code ...OK
Entry boot auxiliary code
Auxiliary code - v1.00
DDR code - V1.1.2.1 20171011
Build: Oct 16 2017 - 23:06:43
Reg Version: v1.5.2h
Reg Time: 2017/12/05 21:46:58
Reg Name: hi3798cv2dmf_hi3798cv200_DDR4-2133_2rank_2rank_3GB_16bitx4_8layers.reg
DDRS
Boot auxiliary code success
Bootrom success
System startup
Relocate Boot
Jump to C code
Compressed-boot v1.0.0
Uncompress........................Ok
System startup
Relocate Boot
Jump to C code
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.9.44_hi3798cv2x (jenkins@SZX1000503960) (gcc version 4.9.2 20140904 (prerelease) (gcc-4.9.2 + glibc-2.22 (Build by czyong) Tue Oct 27 16:32:03 CST 2015) ) #2 SMP Sat Mar 30 06:16:01 HKT 2019
CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
CPU: div instructions available: patching division code
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
initmrd: found no initmrd.
OF: fdt:Machine model: Hisilicon
cma: Reserved 48 MiB at 0x7c000000
cma: Reserved 4 MiB at 0xba400000
Memory policy: Data cache writealloc
percpu: Embedded 14 pages/cpu @dec5c000 s26368 r8192 d22784 u57344
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 763128
Kernel command line: androidboot.selinux=permissive console=ttyAMA0,115200 blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),32M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),6M(nve),8M(logo),8M(logo2),16M(fastplay),32M(kernel),32M(factory),32M(trustedcore),8M(apanic),4M(misc),1536M(system),32M(securestore),32M(securestorebak),512M(vendor),32M(databackup),256M(cache),-(userdata) initrd=0x4E00000,0x426BEE mem=2985M mmz=ddr,0,0x7c000000,48M vmalloc=500M
log_buf_len individual max cpu contribution: 4096 bytes
log_buf_len total cpu_extra contributions: 12288 bytes
log_buf_len min size: 16384 bytes
log_buf_len: 32768 bytes
early log buf free: 14076(85%)
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 2950596K/3056640K available (7168K kernel code, 608K rwdata, 2236K rodata, 1024K init, 1760K bss, 52796K reserved, 53248K cma-reserved, 2464748K highmem)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xe0800000 - 0xff800000 ( 496 MB)
lowmem : 0xc0000000 - 0xe0400000 ( 516 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0008000 - 0xc0800000 (8160 kB)
.init : 0xc0b00000 - 0xc0c00000 (1024 kB)
.data : 0xc0c00000 - 0xc0c98254 ( 609 kB)
.bss : 0xc0c9a000 - 0xc0e52164 (1761 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
Build-time adjustment of leaf fanout to 32.
NR_IRQS:352
clocksource: hisp804: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 89478484971ns
Calibrating delay loop... 3170.30 BogoMIPS (lpj=1585152)
pid_max: default: 32768 minimum: 301
Security Framework initialized
SELinux: Initializing.
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
ftrace: allocating 24585 entries in 73 pages
CPU0: update cpu_capacity 1024
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x100000 - 0x100058
CPU: hi3798cv200
CPU1: update cpu_capacity 1024
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
CPU2: update cpu_capacity 1024
CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
CPU3: update cpu_capacity 1024
CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
Brought up 4 CPUs
SMP: Total of 4 processors activated (12681.21 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
VFP support v0.3: implementor 41 architecture 3 part 40 variant 3 rev 4
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
futex hash table entries: 1024 (order: 4, 65536 bytes)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
pl061_gpio f8b20000.gpio0: PL061 GPIO chip @0xf8b20000 registered
pl061_gpio f8b21000.gpio1: PL061 GPIO chip @0xf8b21000 registered
pl061_gpio f8b22000.gpio2: PL061 GPIO chip @0xf8b22000 registered
pl061_gpio f8b23000.gpio3: PL061 GPIO chip @0xf8b23000 registered
pl061_gpio f8b24000.gpio4: PL061 GPIO chip @0xf8b24000 registered
pl061_gpio f8004000.gpio5: PL061 GPIO chip @0xf8004000 registered
pl061_gpio f8b26000.gpio6: PL061 GPIO chip @0xf8b26000 registered
pl061_gpio f8b27000.gpio7: PL061 GPIO chip @0xf8b27000 registered
pl061_gpio f8b28000.gpio8: PL061 GPIO chip @0xf8b28000 registered
pl061_gpio f8b29000.gpio9: PL061 GPIO chip @0xf8b29000 registered
pl061_gpio f8b2a000.gpio10: PL061 GPIO chip @0xf8b2a000 registered
pl061_gpio f8b2b000.gpio11: PL061 GPIO chip @0xf8b2b000 registered
pl061_gpio f8b2c000.gpio12: PL061 GPIO chip @0xf8b2c000 registered
f8b00000.uart: ttyAMA0 at MMIO 0xf8b00000 (irq = 134, base_baud = 0) is a PL011 rev2
random: fast init done
console [ttyAMA0] enabled
f8b02000.uart: ttyAMA1 at MMIO 0xf8b02000 (irq = 135, base_baud = 0) is a PL011 rev2
hisi_iommu_ptable_addr:phy 0x1dc00000 size:0x400000
hisi_iommu_err_rdaddr :phy 0x1e6f1400 size:0x200
hisi_iommu_err_wraddr :phy 0x1e6f1600 size:0x200
in hisi_iommu_domain_init start
in hisi_iommu_domain_init end
SCSI subsystem initialized
ssp-pl022 f8b1a000.spi: ARM PL022 driver, device ID: 0x00041022
ssp-pl022 f8b1a000.spi: mapped registers from 0xf8b1a000 to f9b1a000
spi_master spi0: will run message pump with realtime priority
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
clocksource: Switched to clocksource hisp804
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
Freeing initrd memory: 4252K
audit: initializing netlink subsys (disabled)
audit: type=2000 audit(0.330:1): initialized
workingset: timestamp_bits=30 max_order=20 bucket_order=0
ntfs: driver 2.1.32 [Flags: R/O].
bounce: pool size: 64 pages
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
hiahci-phy: registered new sata phy driver
virtual device initialization.
brd: module loaded
[NVE][init_nve]NV init ok!
hifmc100: registerd new interface driver hifmc100.
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-platform: EHCI generic platform driver
ehci-platform f9890000.ehci: EHCI Host Controller
ehci-platform f9890000.ehci: new USB bus registered, assigned bus number 1
ehci-platform f9890000.ehci: irq 139, io mem 0xf9890000
ehci-platform f9890000.ehci: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ohci-platform: OHCI generic platform driver
ohci-platform f9880000.ohci: Generic Platform OHCI controller
ohci-platform f9880000.ohci: new USB bus registered, assigned bus number 2
ohci-platform f9880000.ohci: irq 140, io mem 0xf9880000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
xhci-hcd f98a0000.xhci: xHCI Host Controller
xhci-hcd f98a0000.xhci: new USB bus registered, assigned bus number 3
xhci-hcd f98a0000.xhci: hcc params 0x0220f06c hci version 0x100 quirks 0x00010010
xhci-hcd f98a0000.xhci: irq 142, io mem 0xf98a0000
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
xhci-hcd f98a0000.xhci: xHCI Host Controller
xhci-hcd f98a0000.xhci: new USB bus registered, assigned bus number 4
usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
xhci-hcd f98b0000.xhci: xHCI Host Controller
xhci-hcd f98b0000.xhci: new USB bus registered, assigned bus number 5
xhci-hcd f98b0000.xhci: hcc params 0x0220f06c hci version 0x100 quirks 0x00010010
xhci-hcd f98b0000.xhci: irq 143, io mem 0xf98b0000
hub 5-0:1.0: USB hub found
hub 5-0:1.0: 1 port detected
xhci-hcd f98b0000.xhci: xHCI Host Controller
xhci-hcd f98b0000.xhci: new USB bus registered, assigned bus number 6
usb usb6: We don't know the algorithms for LPM for this host, disabling LPM.
hub 6-0:1.0: USB hub found
hub 6-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver option
usbserial: USB Serial support registered for GSM modem (1-port)
i2c /dev entries driver
sp805-wdt f8a2c000.watchdog: registration successful
registered new interface driver himciV1.0_4.9.44_hi3798cv2x_20170401
ashmem: initialized
Registering SWP/SWPB emulation handler
irq_affinity: irq_set_affinity failed. irq:72 cpuid:2
irq_affinity: irq_set_affinity failed. irq:69 cpuid:2
irq_affinity: irq_set_affinity failed. irq:68 cpuid:2
irq_affinity: irq_set_affinity failed. irq:67 cpuid:2
irq_affinity: irq_set_affinity failed. irq:66 cpuid:2
Freeing unused kernel memory: 1024K
init: init first stage started!
mmc0: new DDR MMC card at address 0001
mmcblk0: mmc0:0001 016G72 14.7 GiB
mmcblk0boot0: mmc0:0001 016G72 partition 1 4.00 MiB
mmcblk0boot1: mmc0:0001 016G72 partition 2 4.00 MiB
mmcblk0rpmb: mmc0:0001 016G72 partition 3 4.00 MiB
mmcblk0: p1(fastboot) p2(bootargs) p3(recovery) p4(deviceinfo) p5(baseparam) p6(pqparam) p7(nve) p8(logo) p9(logo2) p10(fastplay) p11(kernel) p12(factory) p13(trustedcore) p14(apanic) p15(misc) p16(system) p17(securestore) p18(securestorebak) p19(vendor) p20(databackup) p21(cache) p22(userdata)
init: First stage mount skipped (recovery mode)
init: Skipped setting INIT_AVB_VERSION (not vbmeta compatible)
init: Loading SELinux policy
SELinux: Permission validate_trans in class security not defined in policy.
SELinux: the above unknown classes and permissions will be denied
audit: type=1403 audit(1.451:2): policy loaded auid=4294967295 ses=4294967295
selinux: SELinux: Loaded policy from /sepolicy
selinux: SELinux: Loaded file_contexts
init: init second stage started!
init: property_set("ro.hardware", "unknown") failed: property already set
selinux: SELinux: Loaded file_contexts
selinux: SELinux: Loaded property_contexts from /plat_property_contexts & /nonplat_property_contexts.
init: Running restorecon...
selinux: SELinux: Could not stat /dev/block: No such file or directory.
init: waitpid failed: No child processes
init: Couldn't load properties from /system/etc/prop.default: No such file or directory
init: Couldn't load properties from /prop.default: No such file or directory
init: property_set("ro.product.board", "bigfish") failed: property already set
ueventd: ueventd started!
ueventd: /sys/ rule /sys/devices/platform/trusty.* trusty_version
ueventd: /sys/ rule /sys/devices/virtual/input/input* enable
ueventd: /sys/ rule /sys/devices/virtual/input/input* poll_delay
ueventd: /sys/ rule /sys/devices/virtual/usb_composite/* enable
ueventd: /sys/ rule /sys/devices/system/cpu/cpu* cpufreq/scaling_max_freq
ueventd: /sys/ rule /sys/devices/system/cpu/cpu* cpufreq/scaling_min_freq
ueventd: invalid gid 'net_bt_stack'
ueventd: invalid gid 'net_bt_stack'
selinux: SELinux: Loaded file_contexts
index : 0 switch_value : 0
index : 1 switch_value : 2
audit: type=1400 audit(1.796:3): avc: denied { entrypoint } for pid=817 comm="init" path="/sbin/recovery" dev="rootfs" ino=4135 scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
audit: type=1400 audit(1.815:4): avc: denied { execute } for pid=817 comm="recovery" path="/sbin/recovery" dev="rootfs" ino=4135 scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
recovery: Starting recovery -----
recovery: Boot command: boot-recovery
recovery: Got 2 arguments from boot message
audit: type=1400 audit(1.853:5): avc: denied { mounton } for pid=817 comm="recovery" path="/cache" dev="rootfs" ino=2509 scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
audit: type=1400 audit(1.878:6): avc: denied { setsched } for pid=817 comm="recovery" scontext=u:r:recovery:s0 tcontext=u:r:kernel:s0 tclass=process permissive=1
EXT4-fs (mmcblk0p21): recovery complete
EXT4-fs (mmcblk0p21): mounted filesystem with ordered data mode. Opts: (null)
audit: type=1400 audit(1.905:7): avc: denied { mount } for pid=817 comm="recovery" name="/" dev="mmcblk0p21" ino=2 scontext=u:r:recovery:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=1
audit: type=1400 audit(1.923:8): avc: denied { dac_override } for pid=817 comm="recovery" capability=1 scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=capability permissive=1
audit: type=1400 audit(1.940:9): avc: denied { search } for pid=817 comm="recovery" name="recovery" dev="mmcblk0p21" ino=8193 scontext=u:r:recovery:s0 tcontext=u:object_r:cache_recovery_file:s0 tclass=dir permissive=1
audit: type=1400 audit(1.959:10): avc: denied { read } for pid=817 comm="recovery" name="last_locale" dev="mmcblk0p21" ino=8196 scontext=u:r:recovery:s0 tcontext=u:object_r:cache_recovery_file:s0 tclass=file permissive=1
recovery: Failed to read max brightness: No such file or directory
recovery: Screensaver disabled
EXT4-fs (mmcblk0p20): recovery complete
EXT4-fs (mmcblk0p20): mounted filesystem with ordered data mode. Opts: (null)
recovery: ------wipe cache + data + databackup-----
random: crng init done
recovery: volume is already mounted
EXT4-fs (mmcblk0p21): mounted filesystem with ordered data mode. Opts: (null)
recovery: volume is already mounted
recovery: volume is already mounted
recovery: volume is already mounted
EXT4-fs (mmcblk0p16): mounted filesystem with ordered data mode. Opts: barrier=1,inode_readahead_blks=8
audit_printk_skb: 141 callbacks suppressed
audit: type=1400 audit(5.439:58): avc: denied { fowner } for pid=817 comm="recovery" capability=3 scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=capability permissive=1
audit: type=1400 audit(5.459:59): avc: denied { fsetid } for pid=817 comm="recovery" capability=4 scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=capability permissive=1
audit: type=1400 audit(5.494:60): avc: denied { write } for pid=817 comm="recovery" name="property_service" dev="tmpfs" ino=3350 scontext=u:r:recovery:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1
audit: type=1400 audit(5.514:61): avc: denied { connectto } for pid=817 comm="recovery" path="/dev/socket/property_service" scontext=u:r:recovery:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
recovery: 11 output lines suppressed due to ratelimiting
reboot: Restarting system with command ''
CPU will restart.おわりに
UARTで起動ログが見れたのは良かったんですが、コンソールにアクセスできないとどうしようもないです。誰か頑張ってみて…(超他力本願)