When I was pulling apart my u8plus smartwatch, I noted that there were five unlabelled pads, and that these were likely jtag:
Although I had reasonable results with jtagenum, nothing I tried worked with a real adaptor. I turned to google and rediscovered bunnie/xob's work on fernvale. Xob specifically mentions problems with jtag:
"In theory it has JTAG, which should let us attach a debugger and break the execution flow of the CPU. However, we never got it working, and it's unclear what steps must be taken, or even which set of pins to use."
Making the assumption that if bunnie/xob couldn't get the jtag working, I was unlikely to stumble on the required magic. Instead I pulled xob's repo to see what it would do with the mt6261. It was able to connect and extract a bunch of information:
Waiting for serial port to connect: ....... Setting serial port parameters... Ok Initiating communication... Ok Getting hardware version... 0xcb01 Getting chip ID... 0x6261 Getting boot config (low)... 0x0000 Getting boot config (high)... 0x0000 Getting hardware subcode... 0x8000 Getting hardware version (again)... 0xcb01 Getting chip firmware version... 0x0001 Getting security version... v 5 Enabling security (?!)... Ok Reading ME... 00000000 ad 3f 07 fa 5e 5d 0b ad 10 71 b2 02 3d 5b e5 a3 |.?..^]...q..=[..| Disabling WDT... Ok Reading RTC Baseband Power Up (0xa0710000)... 0x0002 Reading RTC Power Key 1 (0xa0710050)... 0xa357 Reading RTC Power Key 2 (0xa0710054)... 0x67d2 Setting seconds... Ok Disabling alarm IRQs... Ok Disabling RTC IRQ interval... Ok Enabling transfers from core to RTC... Ok Reading RTC Baseband Power Up (0xa0710000)... 0x0002 Getting security configuration... None. Getting PSRAM mapping... 0x0000 Disabling PSRAM -> ROM remapping... Ok Checking PSRAM mapping... 0x0002 Checking on PSRAM mapping again... 0x0002 Updating PSRAM mapping again for some reason... Ok Reading some fuses... 0x00000000 Enabling UART... 0x0000
This looked promising but it was hanging before it could attempt to upload the first stage. A lucky guess (based on reading *somewhere* that 6261 had less SRAM) at hacking the load address and the stack address let it continue though to:
Loading Fernly USB loader... checksum matches 0x1ec6 Ok Executing Ferly USB loader... Ok Waiting for Fernly USB loader banner...
At this point, it seems that we might have code running on the cpu; the watch was unresponsive until I pulled the USB - I was hoping I had at least crashed it..
The fernly usb loader is able to read/write memory pretty trivially, so I used it's functions to dump the 4MB of onboard flash (at 0x0). I also attempted to 'spray' all over the area where the uart blocks are on the 6260; with the bus pirate connected to the hardware uart, I thought I'd at least see something random spit out - no luck.
Having a dump of the flash to analyse is useful, but - from reading though the fernly information - a dump of the rom (at 0xfff00000) is where a lot of the hardware detail is hiding. I didn't expect that to be a problem, I expected the usb loader to just dump it out for me; instead it hung, turns out that area is protected from usb reads.
After quite a while of searching for something even remotely looking like a memory map for the 6261, so I could use the uart to dump the rom, I came across this post by jimparis. He'd been through the same process, and also hadn't been able to find the uarts. What he had found though was the address of the vibration motor; his code buzzed the motor on my watch too. Jim also says "So I'm sure that code is running now. What's next? Try to find and dump the internal ROM via the motor? :/"
When I read that, I vaguely remembered reading about how the original ipod rom was dumped and thought that I could do something similar with the vibrator motor. My set up is much simplier than the ipod - I de-soldered the motor and after a quick examination with the scope, I patched the line into an adruino.
The assembler for the mt6261-test image was modified to loop through a memory range, reading in a 32 bit value, and then generating a pulse for each bit. I'm lazy - I chose a short 'on' (1x call to delay()) for zero, a long 'on' (2x calls to delay(), so double the length), using 'off' to represent the gap between bits; e.g:
1 0 1 0 0 1 = off, long, off, short, off, long, off, short, off, short, off, long, off
The main assembler loop was debugged using qemu-arm+gdb (the image can be used as a qemu flash image) before attempting to upload to the real device. On the arduino side, a pin was monitored and the length of the pulses was tracked. If the pulse was over a certain threshold then a '1' is output, otherwise a '0'. To validate the method before dumping the unknown rom, I dumped the first part of the flash - this was compared with the data dumped using the usb loader and after a few tweaks they were bit perfect. A small bit of throwaway python was hacked together to reassemble the bits into a file:
s = """
10110000000000000000000001010111
01111111111111111111111101010111
01111111111111111111111101010111
01111111111111111111111101010111
01111111111111111111111101010111
01111111111111111111111101010111
01111111111111111111111101010111
01111111111111111111111101010111
...
00000000000000000000000000001110
00000000000001000000000000001110
00000000000000100000000000001110
00000000000001100000000000001110
00000000000000010000000000001110
00000000000011010000000000001110
"""
import struct
l = s.replace("\n\n", "\n").split('\n')
f = open('file.dat', 'wb')
for x in l:
try:
i = int(x[::-1], 2)
f.write(struct.pack('I', i))
except:
pass
f.close()
This method wasn't fast - and I suspect that the pulse lengths could be reduced somewhat - but it was getting late, and in the end I just left it running overnight. When I got up, it had stopped before the end of the 64k - however when reassembled I had a 44k file, that seemed to contain the whole rom :) - here's some strings:
SF_BOOT
BRLYT
P0Dx
[USBDL] Waiting for start cmd over 1 min ...
p[USBDL] Waiting for host's response over 1 min ...
8pGpGpG
-JD2
KXhA
p!LD4
ACM COMMU.
ACM DATA
ACM VIRTUALCOM
RC_INIT
JM 5X
EM15M
pRESV0
H@xpG
xSxG"
pBOOTRETY
pBoot failed, reset ...
System halt!
DELY@
pUART0\
p1_ENJump to BL
MhhB
D^[a5d
pUART,\
p1_EN
xpGLI
EEEEMMM
h,I
FILE_INFO
HpG
SCTLCERT
"x1h
BBBB
I h
ZZZZ
HapG
`BA02
G G(G0G8G8
"#KBC{D
Invalid Operation
Divide By Zero
Overflow
Underflow
Inexact Result
: Heap memory corrupted
Unknown signal
X65dAl
Abnormal termination
Arithmetic exception:
Illegal instruction
Interrupt received
Illegal address
Termination request
Stack overflow
Redirect: can't open:
Out of heap memory
User-defined signal 1
User-defined signal 2
Pure virtual fn called
C++ library exception
My fork of the fernly repo (including the arduino sketch) can be found here (mt6261 branch).
I noticed this smart watch on Amazon for the bargain price of £7.51, which was just too cheap to ignore - I didn't expect much but I was quite surprised at how functional it actually was... Anyhow, it was never expected to stay in once piece for long, and after an hour I took the screwdriver to it.
The back is covered by a aluminium plate that seemed to be sticky backed; it came off pretty easily. Underneath was four screws that released the back cover.
Inside, not much too see: a 200mAh, 3.7v battery, speaker, reset button (on the right) and what looks like a bluetooth antenna at the bottom.
With the battery and the speaker pulled back we can see a MediaTek MT6261 SoC and supporting components on the left. On the right are connections for the reset button (mounted on top of the usb connector), speaker and what I assume is a vibrator motor connected to 'VIB'. The touchscreen is also connected at the top, with it's controller mounted on the flat flex cable. The home/power button is tucked in on the far left.
The other side of the board, removed from the shell: the connections to the LCD are at the bottom, the power button on the right and some test pads sprinkled all over :)
The 'D+' and 'D-' and the proximity to the USB suggest the four pads on the left are for the USB; VBAT is positive side of the battery; PWR connects to the power/home button. Just slightly covered by the green label is RXD and TXD - which is likely our UART, and two others ('OW2' and 'OL0'). Above them next to PWR are five unlabelled pads - hopefully these are JTAG.
Wires connected to the GND, RXD and TXD, ready for the bus pirate. With the green label removed we can see that the two adjacent pads are actually labelled 'KROW2' and 'KCOL0'...? (I also added a scrap of sticky label to protect the LCD connections a little.)
And finally, the bootloader (@115200):
F1: 0000 0000 V0: 0000 0000 [0001] 00: 0000 0000 U0: 0000 0001 [0000] G0: 0002 0000 [0000] T0: 0000 00BB Jump to BL ~~~ Welcome to MTK Bootloader V005 (since 2005) ~~~ **===================================================** Bye bye bootloader, jump to=0x1000b5b0
Yet another BT device: a voyager 2091 - another BCM6348 device. UART is nice and easy to get at; even has headers soldered in:
Here's the full boot output:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE) Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer) Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : V2091_BB Psi size in KB : 24 Number of MAC Addresses (1-32) : 4 Ethernet MAC Address : 00:16:e3:1f:0d:1c WEP 128bit Key : a986888aa527c Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 0 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) FLASH_BASE bfc00000,blk 47 Total Flash size: 8192K with 135 sectors NVRAM @71 block Scratch pad is not used for this flash part. V2091_BB prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (michaelc@AskeyBrcmServer) (gcc version 3.1) #1 Mon Sep 26 10:37:13 CST 2005 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 239.20 BogoMIPS Memory: 14112k/16000k available (1171k kernel code, 1888k reserved, 84k data, 48k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Sep 26 2005 10:37:30 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0 VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 48k freed init started: BusyBox v0.60.4 (2005.09.26-02:43+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2005.09.26-02:43+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc0015060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised PCI: Enabling device 00:01.0 (0004 -> 0006) wl: srom not detected, using main memory mapped srom info (wombo board) wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.39.0 Broadcom BCM6348B0 Ethernet Network Device v0.1 Sep 26 2005 10:40:46 Ports 1 unit 1 Internal PHY BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: 00:16:E3:1F:0D:1C Broadcom BCM6348B0 USB Network Device v0.3 Sep 26 2005 10:40:47 usb0: MAC Address: 00 16 E3 1F 0D 1D usb0: Host MAC Address: 00 16 E3 1F 0D 1E USB Vendor id=069a, USB Product id=0318 ==> Bcm963xx Software Version: 2.21.05.08m_A2pB018c1.d16d <==
The DG834v4 is unlike the v1/v2/v3 in that they are TI AR7 based and the v4 is another Broadcom BCM6348 board, clocked at 240MHz and with 16MB RAM. Initially I thought getting to the uart would just be a case of soldering headers, but after reading the openwrt wiki page it became apparent that there were unpopulated resistors on the underside of the board, on the rx/tx lines coming from the CPU (R521 and R522 in the image below).
Using a hot air station, I removed some 1K Ohm resistors from a dead laptop motherboard. Then using a toothpick, I put a little flux on the empty resistor pads to hopefully give the them something to stick to. A little flux on the end of the toothpick made it pretty easy to pick them up and drag them into position too. Placement accuracy is not that critical; once the solder melts the surface tension will pull the tiny resistors into line.
Above, the R521 and R522 pads have been populated - using the hot air station on a low speed and a high temperature. Once the board cooled, my Bus Pirate was connected to the rx, tx and ground pins and configure as a uart bridge.
Here's the stock boot:
CFE version 1.0.37-6.8 for BCM96348 (32bit,SP,BE) Build Date: Fri Feb 6 03:12:58 UTC 2009 (root@localhost.localdomain) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x80527770 (1206128) Initialized Data: 0x8041EF50 - 0x80420350 (5120) BSS Area: 0x80420350 - 0x80425770 (21536) Local Heap: 0x80425770 - 0x80525770 (1048576) Stack Area: 0x80525770 - 0x80527770 (8192) Text (code) segment: 0x80401000 - 0x8041EF48 (122696) Boot area (physical): 0x00528000 - 0x00568000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.0.1 Host IP address : 192.168.0.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348W3 Psi size in KB : 24 Number of MAC Addresses (1-32) : 2 Base MAC Address : 00:24:b2:2e:73:10 Ethernet PHY Type : Internal Memory size in MB : 16 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 pTag1!=NULL Code Address: 0x80010000, Entry Address: 0x801f6018 Decompression OK! Entry at 0x801f6018 Closing network. Starting program at 0x801f6018 Linux version 2.6.8.1 (root@BUILD_SERVER) (gcc version 3.4.2) #2 Fri Feb 29 17:52:52 CST 2008 Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB Total Flash size: 4096K with 71 sectors 96348W3 prom init CPU revision is: 00029107 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 4000 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 64 (order 6: 512 bytes) Using 120.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 13468k/16000k available (1639k kernel code, 2512k reserved, 300k data, 80k init, 0k highmem) Calibrating delay loop... 239.20 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 MPI: No Card is in the PCMCIA slot Can't analyze prologue code at 801a8894 devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 kernel_addr == 0xbff39100 rootfs_addr == 0xbfc10100 Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 6 MTD partitions on "Physically mapped flash": 0x00010100-0x00339100 : "fs" mtd: partition "fs" doesn't start on an erase block boundary -- force read-only 0x00010000-0x003e0000 : "tag+fs+kernel" 0x00000000-0x00010000 : "bootloader" 0x003f0000-0x00400000 : "nvram" 0x00000000-0x00010000 : "bootloader" 0x003e0000-0x003f0000 : "DPF_file" brcmboard: brcm_board_init entry SES: Button GPIO 0x8023 is enabled SES: Button Interrupt 0x3 is enabled SES: LED GPIO 0x8023 is enabled bcm963xx_serial driver v2.0 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.4.6rc3 NET: Registered protocol family 15 klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251) klips_info:ipsec_alg_init: calling ipsec_alg_static_init() ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0 KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=aes keyminbits=128 keymaxbits=256, found(0) KLIPS: lookup for ciphername=twofish: not found KLIPS: lookup for ciphername=serpent: not found KLIPS: lookup for ciphername=cast5: not found KLIPS: lookup for ciphername=blowfish: not found KLIPS cryptoapi interface: alg_type=15 alg_id=3 name=des3_ede keyminbits=192 keymaxbits=192, found(0) KLIPS cryptoapi interface: alg_type=15 alg_id=2 name=des keyminbits=64 keymaxbits=64, found(0) ip esp init: can't add protocol ip_conntrack version 2.1 (125 buckets, 0 max) - 376 bytes per conntrack ip_conntrack_h323: init ip_nat_h323: initialize the module! ip_tables: (C) 2000-2002 Netfilter core team Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 Bridge firewalling registered NET: Registered protocol family 8 NET: Registered protocol family 20 VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 80k freed init started: BusyBox v1.00 (2007.12.20-13:11+0000) multi-call binary init started: BusyBox v1.00 (2007.12.20-13:11+0000) multi-call binary Starting pid 48, console /dev/tts/0: '/usr/etc/rcS' Algorithmics/MIPS FPU Emulator v1.5 bcm_enet: module license 'Proprietary' taints kernel. Broadcom BCM6348B0 Ethernet Network Device v0.3 Jan 11 2008 17:18:52 Config Ethernet Switch Through SPI Slave Select 0 dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 00:24:B2:2E:73:10 insmod: cannot insert `/lib/modules/vnet.ko': Success (6): Success blaadd: blaa_detect entry adsl: adsl_init entry netfilter PSD loaded - (c) astaro AG ipt_random match loaded device eth0 entered promiscuous mode ap_name=wlan action=stop SIOCGIFFLAGS: No such device interface wl0 does not exist! /usr/sbin/wlctl: wl driver adapter not found /usr/sbin/wlctl: wl driver adapter not found killall: wlctl: no process killed killall: nas: no process killed BcmAdsl_Initialize=0xC0080478, g_pFnNotifyCallback=0xC00992A4 AnnexCParam=0x7FFF7E68 AnnexAParam=0x00003987 adsl2=0x00000003 pSdramPHY=0xA0FFFFF8, 0x90001100 0xA0011901 AdslCoreHwReset: AdslOemDataAddr = 0xA0FFA4D4 AnnexCParam=0x7FFF7E68 AnnexAParam=0x00003987 adsl2=0x00000003 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ap_name=(null) action=start br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state /bin/echo GMT+0 > /etc/TZ killall: udhcpd: no process killed killall: upnpd: no process killed killall: upnpd: no process killed killall: dnrd: no process killed Notice: caching turned off Warning: Using /etc/hosts will be removed in a future version. Please use only the /etc/dnrd/master file or use -m off. dnrd -a 192.168.0.1 -m hosts -c off --timeout=0 -b Setting SSID "recipes4vegans" Setting SSID "Guest" Setting country code using abbreviation: "GB" Receive: good packet 0, bad packet 0 Transmit: good packet 0, bad packet 0 Please press Enter to activate this console. Starting pid 341, console /dev/tts/0: '/bin/sh' BusyBox v1.00 (2007.12.20-13:11+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands.
And the bootloader (CFE):
CFE version 1.0.37-6.8 for BCM96348 (32bit,SP,BE) Build Date: Fri Feb 6 03:12:58 UTC 2009 (root@localhost.localdomain) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x80527770 (1206128) Initialized Data: 0x8041EF50 - 0x80420350 (5120) BSS Area: 0x80420350 - 0x80425770 (21536) Local Heap: 0x80425770 - 0x80525770 (1048576) Stack Area: 0x80525770 - 0x80527770 (8192) Text (code) segment: 0x80401000 - 0x8041EF48 (122696) Boot area (physical): 0x00528000 - 0x00568000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.0.1 Host IP address : 192.168.0.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348W3 Psi size in KB : 24 Number of MAC Addresses (1-32) : 2 Base MAC Address : 00:24:b2:2e:73:10 Ethernet PHY Type : Internal Memory size in MB : 16 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1 CFE> CFE> help Available commands: h Http Download d Download a Asmod c Change booline parameters b Change board parameters reset Reset the board help Obtain help for CFE commands For more information about a command, enter 'help command-name' *** command status = 0
A very old DG834v1 - kernel build date is: Wed Sep 7 16:50:05 CST 2005. Bus Pirate connected to ground/tx/rx on the JP603 header I've soldered in, on the left in the image above. More information on the openwrt wiki.
Here's the stock boot:
ADAM2 Revision 0.18.01 (C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved. (C) Copyright 2003 Telogy Networks, Inc. Usage: setmfreq [-d] [-s sys_freq, in MHz] [cpu_freq, in MHz] Memory optimization Complete! DGB34 > Press any key to abort OS load, or wait 3 seconds for OS to boot... Launching kernel decompressor. Starting LZMA Uncompression Algorithm. Copyright (C) 2003 Texas Instruments Incorporated; Copyright (C) 1999-2003 Igor Pavlov. Compressed file is LZMA format. Kernel decompressor was successful ... launching kernel. LINUX started... Config serial console: ttyS0,115200 VLYNQ INIT FAILED: Please try cold reboot. CPU revision is: 00018448 Primary instruction cache 16kb, linesize 16 bytes (4 ways) Primary data cache 16kb, linesize 16 bytes (4 ways) Number of TLB entries 16. Linux version 2.4.17_mvl21-malta-mips_fp_le (root@Run-P4) (gcc version 2.95.3 20010315 (release/MontaVista)) #6 Wed Sep 7 16:50:05 CST 2005 Determined physical RAM map: memory: 14000000 @ 00000000 (reserved) memory: 00020000 @ 14000000 (ROM data) memory: 00fe0000 @ 14020000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: calculating r4koff... 000b71b0(750000) CPU frequency 150.00 MHz Calibrating delay loop... 149.91 BogoMIPS Freeing Adam2 reserved memory [0x14001000,0x0001f000] Memory: 14356k/16384k available (1479k kernel code, 2028k reserved, 139k data, 56k init) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd Disabling the Out Of Memory Killer devfs: v1.7 (20011216) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Adam2 environment variables API installed. pty: 32 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with no serial options enabled ttyS00 at 0xa8610e00 (irq = 15) is a 16550A ttyS01 at 0xa8610f00 (irq = 16) is a 16550A Vlynq CONFIG_MIPS_AVALANCHE_VLYNQ_PORTS=2 Vlynq Device vlynq0 registered with minor no 63 as misc device. Result=0 VLYNQ 0 : init failed Vlynq Device vlynq1 registered with minor no 62 as misc device. Result=0 VLYNQ 1 : init failed cpu_freq = 150000000 block: 64 slots per queue, batch=16 Cpmac driver is allocating buffer memory at init time. Default Asymmetric MTU for eth0 1500 PPP generic driver version 2.4.1 avalanche flash device: 0x400000 at 0x10000000. Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Looking for mtd device :mtd0: Found a mtd0 image (0xd0000), with size (0x310000). Looking for mtd device :mtd1: Found a mtd1 image (0x20000), with size (0xb0000). Looking for mtd device :mtd2: Found a mtd2 image (0x0), with size (0x20000). Looking for mtd device :mtd3: Found a mtd3 image (0x3e0000), with size (0x10000). Looking for mtd device :mtd4: Found a mtd4 image (0x3f0000), with size (0x10000). Looking for mtd device :mtd5: Creating 5 MTD partitions on "Physically mapped flash": 0x000d0000-0x003e0000 : "mtd0" 0x00020000-0x000d0000 : "mtd1" 0x00000000-0x00020000 : "mtd2" 0x003e0000-0x003f0000 : "mtd3" 0x003f0000-0x00400000 : "mtd4" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 1024) Linux IP multicast router 0.06 plus PIM-SM ip_tables: (c)2000 Netfilter core team NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Initializing the WAN Bridge. Please set the MAC Address for the WAN Bridge. Set the Environment variable 'wan_br_mac'. MAC Address should be in the following format: xx.xx.xx.xx.xx.xx VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 56k freed serial console detected. Disabling virtual terminals. console=/dev/tts/0 init started: BusyBox v0.61.pre (2005.09.27-08:20+0000) multi-call binary Starting pid 9, console /dev/tts/0: '/usr/etc/rcS' Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/drivers/atm/tiatm.o registered device TI Avalanche SAR DSP binary filesize = 357754 bytes Texas Instruments ATM driver: version:[4.05.03.00] Using /lib/modules/push_button.o Using /lib/modules/led.o Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/net/ipv4/netfilter/ipt_REJECT.o Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/net/ipv4/netfilter/ipt_string.o Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/net/ipv4/netfilter/ipt_random.o ipt_random match loaded Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/net/ipv4/netfilter/ipt_mark.o Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/net/ipv4/netfilter/ipt_condition.o Default Asymmetric MTU for br0 1500 device eth0 entered promiscuous mode ap_name=(null) action=start br0: port 1(eth0) entering learning state br0: port 1(eth0) entering forwarding state br0: topology change detected, propagating killall: syslogd: no process killed killall: upnpd: no process killed iptables: No chain/target/match by that name iptables: No chain/target/match by that name killall: upnpd: no process killed killall: snmpd: no process killed killall: cpu: no process killed iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) Notice: caching turned off Warning: Using /etc/hosts will be removed in a future version. Please use only the /etc/dnrd/master file or use -m off. dnrd -a 192.168.1.100 -m hosts -c off -b /usr/etc/rcS: /usr/sbin/dproxy: No such file or directory UPnP Initialized Intialized UPnP with fullurl=http://192.168.1.100:49152/gateway.xml ipaddress=192.168.1.100 port=49152 web_dir_path=/usr/upnp/ desc_doc_url=http://192.168.1.100:49152 Specifying the webserver root directory -- /usr/upnp/ Registering the RootDevice RootDevice Registered Initializing State Table fullurl http://192.168.1.100:49152/gateway.xml SIOCADDRT: File exists /usr/etc/rcS: cannot create /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_log_invalid: No such file or directory Starting pid 121, console /dev/tts/0: '/usr/sbin/mxp' Bummer, could not run '/usr/sbin/mxp': No such file Waiting for enter to start '/bin/sh' (pid 123, terminal /dev/tts/0) Please press Enter to activate this console. Starting pid 123, console /dev/tts/0: '/bin/sh' BusyBox v0.61.pre (2005.09.27-08:20+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. #
And the bootloader (ADAM2):
ADAM2 Revision 0.18.01
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
Usage: setmfreq [-d] [-s sys_freq, in MHz] [cpu_freq, in MHz]
Memory optimization Complete!
DGB34 >
DGB34 >
Press any key to abort OS load, or wait 3 seconds for OS to boot...
DGB34 > help
Commands Description
-------- -----------
h/help Displays the commands supported
info Displays board information
memop Memory Optimization
setmfreq configures/dumps the system and cpu frequencies
dm Dump memory at <address>
erase Erase Flash except Adam2 Kernel and Env space
printenv Displays Env. Variables
setenv Sets Env. variable <var> with a value <val>
unsetenv Unsets the Env. variable <var>
fixenv Defragment for Env. space
go Loads the image starting at address <mtd1>
DGB34 > info
Monitor Revision 0.18.01
Monitor Compilation time Aug 1 2003, 14:43:32
Endianness Little
External Memory rate Full, 16 bit wide
CPU Frequency 150 MHz
DGB34 >
Another BT device - this one is a Voyager 220V. It uses same type of processor as the home hub and again, the four serial uart pins (+v, gnd, rx and tx) were close by. On the 220V they already had a connector soldered in:
To identify the pins, the process was roughly:
Finally connect a TTL serial interface - I'm using a FTDI breakout and level shift as needed. The 220V is a 3.3v system and my FTDI board is 5v so I use a Spark Fun board to do the shifting (on the little red breadboard in the first image). A bit of trial and error may be required to find the RX pin but it's usually next to the TX. (OLS will also guess the baud rate but I've chopped that bit off in my screen grab.)
Here's the full boot output (captured with "cu -l /dev/ttyUSB0 -s 115200"):
CFE version 1.0.37-21.6.5 for BCM96348 (32bit,SP,BE) Build Date: Tue Jul 19 17:51:53 CST 2005 (michaelc@AskeyBrcmServer) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : RTA1052V Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:11:f5:8d:53:be Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 0 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Flash 88c5 with cs0 0x00000015 Total Flash size: 4096K with 71 sectors Scratch pad is not used for this flash part. RTA1052V prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (michaelc@AskeyBrcmServer) (gcc version 3.1) #1 Thu Jul 28 22:15:28 CST 2005 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 255.59 BogoMIPS Memory: 14140k/16000k available (1146k kernel code, 1860k reserved, 84k data, 44k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Jul 28 2005 22:15:50 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0 VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 44k freed init started: BusyBox v0.60.4 (2005.07.28-14:25+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2005.07.28-14:25+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc000d060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised Endpoint: endpoint_init entry BOS: Enter bosInit BOS: Enter bosAppInit BOS: Exit bosAppInit BOS: Exit bosInit Endpoint: endpoint_init COMPLETED Broadcom BCM6348A2 Ethernet Network Device v0.1 Jul 28 2005 22:22:53 Ports 1 unit 0 Internal PHY BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: 00:11:F5:8D:53:BE Broadcom BCM6348A2 USB Network Device v0.3 Jul 28 2005 22:22:54 usb0: MAC Address: 00 11 F5 8D 53 BF usb0: Host MAC Address: 00 11 F5 8D 53 C0 USB Vendor id=069a, USB Product id=0319 ==> Bcm963xx Software Version: 2.21.05.07_A2pB018c1.d16d <== The MGCP client is already stopped ##Client==>Server>B:Call agent is NOT ready ##Client==>Server>D:Internet Connection is down
And here's the CFE boot loader:
CFE version 1.0.37-21.6.5 for BCM96348 (32bit,SP,BE) Build Date: Tue Jul 19 17:51:53 CST 2005 (michaelc@AskeyBrcmServer) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : RTA1052V Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:11:f5:8d:53:be Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 1 web info: Waiting for connection on socket 0. CFE> CFE> ? Invalid command: "?" Available commands: w, e, r, p, c, f, i, b, reset, flashimage, help *** command status = -1 CFE> help Available commands: w Write the whole image start from beginning of the flash e Erase [n]vram or [a]ll flash except bootrom r Run program from flash image or from host depend on [f/h] flag p Print boot line and board parameter info c Change booline parameters f Write image to the flash i Erase persistent storage data b Change board parameters reset Reset the board flashimage Flashes a compressed image after the bootloader. help Obtain help for CFE commands
This one was pretty easy to guess at - there's a row of four standard pitch holes just to the right of the CPU (the large Broadcom chip) - and as openwrt has been ported, it was pretty easy to verify too :)
I've soldered female headers on to this one and in the image above you can see the braided black/green/yellow wires that lead off to a level converter and FTDI board on a small red breadboard that's just out of shot.
It's got a 250MHz MIPS cpu, 32MB of RAM, two 100Mb wired interfaces, 802.11bg, USB and just maybe the DECT bits might be usable (no ADSL though) - wonder what to do with it!
As it's really just a Speedtouch 7G, the best information can be found here. (Including pinouts and links on how to install redboot and openwrt.)
My cheap android set top box finally stopped booting - it's already had a couple of episodes where it's needed factory defaulting but this time it was just getting stuck on the first boot screen. The accessible system information - from when it used to boot - had already confirmed my suspicion that it was another A10 device and so I thought it was time to crack it open and see if I could find the uarts again.
I was expecting to have to probe out a bunch of anonymous pads again but instead the pins were clearly marked:
Above you can easily see the rx, tx pads, along with 3.3v and what I'm guessing is a bunch of SPI (MS, CK, DI, DO, DO1 DO2) pins. Although I didn't have to spend any time looking for the uart, due to their tiny size they were difficult to solder - I managed to lift both the pads from the board and ended up having to solder the wires (which are far too heavy at this scale) to the edge of the resistors that are on the lines - next time I do this I'm using an air station. The tx and rx were hooked up to an FTDI board via a couple of level shifters. Here's the output from the initial boot:
HELLO! BOOT0 is starting! boot0 version : 1.5.0 dram size =1024 Succeed in opening nand flash. Succeed in reading Boot1 file head. The size of Boot1 is 0x00074000. The file stored in 0X00000000 of block 2 is perfect. Check is correct. Ready to disable icache. Succeed in loading Boot1. Jump to Boot1. [ 0.212] boot1 version : 1.6.0 [ 0.212] pmu type = 3 [ 0.213] bat vol = 0 [ 0.217] set dcdc2 failed, set default clock 384M [ 0.219] script installed early [ 0.222] script_main_key_count=81 [ 0.226] key [ 0.239] no key found [ 0.239] flash init start [ 0.239] NB1 : enter NFB_Init [ 0.242] NB1 : enter phy init [ 0.245] [NAND] nand driver version: 0x0x00000002, 0x0x00000011, data: 0x20120926 [ 0.253] [NAND] nand driver: secure debug v1.2.9, 20121103, 13:09 [ 0.259] NAND_RequestDMA ok [ 0.262] NFC Randomizer start. [ 0.266] [SCAN_DBG] Nand flash chip id is:0x0x0000002c 0x0x00000068 0x0x00000004 0x0x426ffdfc 0x0x42428638 0x0x424529d0 [ 0.277] Nand Unique ID of chip 0 is : [ 0.281] 0x000000ea, 0x000000bc, 0x0000004e, 0x426ffd84 [ 0.287] 0x00000010, 0x000000f8, 0x00000020, 0x426ffd84 [ 0.292] 0x000000ff, 0x00000000, 0x000000ff, 0x426ffd84 [ 0.298] 0x000000ff, 0x00000000, 0x000000ff, 0x426ffd84 [ 0.303] [ 0.305] 0x00000015, 0x00000043, 0x000000b1, 0x426ffd84 [ 0.310] 0x000000ef, 0x00000007, 0x000000df, 0x426ffd84 [ 0.316] 0x00000000, 0x000000ff, 0x00000000, 0x426ffd84 [ 0.321] 0x00000000, 0x000000ff, 0x00000000, 0x426ffd84 [ 0.327] [ 0.329] [ 0.330] [SCAN_DBG] ==============Nand Architecture Parameter============== [ 0.338] [SCAN_DBG] Nand Chip ID: 0x0x4a04682c 0x0xffffffff [ 0.345] [SCAN_DBG] Nand Chip Count: 0x0x00000001 [ 0.350] [SCAN_DBG] Nand Chip Connect: 0x0x00000001 [ 0.356] [SCAN_DBG] Nand Rb Connect Mode: 0x0x00000001 [ 0.362] [SCAN_DBG] Sector Count Of Page: 0x0x00000008 [ 0.368] [SCAN_DBG] Page Count Of Block: 0x0x00000100 [ 0.374] [SCAN_DBG] Block Count Of Die: 0x0x00001000 [ 0.379] [SCAN_DBG] Plane Count Of Die: 0x0x00000002 [ 0.385] [SCAN_DBG] Die Count Of Chip: 0x0x00000001 [ 0.391] [SCAN_DBG] Bank Count Of Chip: 0x0x00000001 [ 0.396] [SCAN_DBG] Optional Operation: 0x0x00001208 [ 0.402] [SCAN_DBG] Access Frequence: 0x0x00000028 [ 0.408] [SCAN_DBG] ECC Mode: 0x0x00000002 [ 0.414] [SCAN_DBG] Read Retry Type: 0x0x00000000 [ 0.419] [SCAN_DBG] DDR Type: 0x0x00000000 [ 0.425] [SCAN_DBG] ======================================================= [ 0.433] [SCAN_DBG] ==============Optional Operaion Parameter============== [ 0.440] [SCAN_DBG] MultiPlaneReadCmd: 0x0x00000000, 0x0x00000030 [ 0.447] [SCAN_DBG] MultiPlaneWriteCmd: 0x0x00000011, 0x0x00000080 [ 0.454] [SCAN_DBG] MultiPlaneCopyReadCmd: 0x0x00000000, 0x0x00000000, 0x0x00000035 [ 0.462] [SCAN_DBG] MultiPlaneCopyWriteCmd: 0x0x00000085, 0x0x00000011, 0x0x00000080 [ 0.471] [SCAN_DBG] MultiPlaneStatusCmd: 0x0x00000070 [ 0.477] [SCAN_DBG] InterBnk0StatusCmd: 0x0x00000078 [ 0.482] [SCAN_DBG] InterBnk1StatusCmd: 0x0x00000078 [ 0.488] [SCAN_DBG] BadBlockFlagPosition: 0x0x00000001 [ 0.494] [SCAN_DBG] MultiPlaneBlockOffset: 0x0x00000001 [ 0.500] [SCAN_DBG] ======================================================= [ 0.507] NB1 : nand phy init ok [ 0.511] Request memory for lsb page table [ 0.515] page type: 0x00000000 [ 0.519] Init lsb page table ok [ 1.728] _RepairLogBlkTbl start [ 1.728] [DUBG], check free block 0x000007fe ok! [ 1.870] Log Block Index 0x00000000, LogicBlockNum: 0x000001e1, LogBlockType: 0x00000001 [ 1.872] log0: 0x00000702, Log1: 0x000007fe, WriteIndex: 0x00000000 [ 1.879] datablock: 0x0000068e, lastusedpage: 0x0000000e [ 1.885] [DUBG], check free block 0x000007fa ok! [ 2.029] Log Block Index 0x00000001, LogicBlockNum: 0x000001e3, LogBlockType: 0x00000001 [ 2.032] log0: 0x0000070c, Log1: 0x000007fa, WriteIndex: 0x00000000 [ 2.039] datablock: 0x000005f9, lastusedpage: 0x00000007 [ 2.184] Log Block Index 0x00000002, LogicBlockNum: 0x000001e0, LogBlockType: 0x00000001 [ 2.187] log0: 0x0000071c, Log1: 0x000007f8, WriteIndex: 0x00000001 [ 2.194] datablock: 0x0000065b, lastusedpage: 0x0000000a [ 2.200] [DUBG], check free block 0x000007f7 ok! [ 2.324] Log Block Index 0x00000003, LogicBlockNum: 0x000000c8, LogBlockType: 0x00000001 [ 2.327] log0: 0x00000785, Log1: 0x000007f7, WriteIndex: 0x00000000 [ 2.333] datablock: 0x000005e2, lastusedpage: 0x000000fb [ 2.339] _RepairLogBlkTbl end [ 2.350] The 0 disk name = bootloader, class name = DISK, disk size = 0x426ffe9c [ 2.352] The 1 disk name = env, class name = DISK, disk size = 0x426ffe9c [ 2.359] The 2 disk name = boot, class name = DISK, disk size = 0x426ffe9c [ 2.366] The 3 disk name = system, class name = DISK, disk size = 0x426ffe9c [ 2.374] The 4 disk name = data, class name = DISK, disk size = 0x426ffe9c [ 2.381] The 5 disk name = misc, class name = DISK, disk size = 0x426ffe9c [ 2.388] The 6 disk name = recovery, class name = DISK, disk size = 0x426ffe9c [ 2.396] The 7 disk name = cache, class name = DISK, disk size = 0x426ffe9c [ 2.403] The 8 disk name = private, class name = DISK, disk size = 0x426ffe9c [ 2.410] The 9 disk name = sysrecovery, class name = DISK, disk size = 0x426ffe9c [ 2.418] The 10 disk name = UDISK, class name = DISK, disk size = 0x426ffe9c [ 2.426] Part 0: part_type: 0x0x00000000 [ 2.430] startblock: 0x0x00000008, endblock 0x0x00000010 [ 2.436] Part 1: part_type: 0x0x00000000 [ 2.440] startblock: 0x0x00000010, endblock 0x0x00000018 [ 2.446] Part 2: part_type: 0x0x00000000 [ 2.450] startblock: 0x0x00000018, endblock 0x0x00000028 [ 2.456] Part 3: part_type: 0x0x00000001 [ 2.460] startblock: 0x0x00000028, endblock 0x0x000000c8 [ 2.466] Part 4: part_type: 0x0x00000001 [ 2.470] startblock: 0x0x000000c8, endblock 0x0x000001c8 [ 2.476] Part 5: part_type: 0x0x00000000 [ 2.480] startblock: 0x0x000001c8, endblock 0x0x000001d0 [ 2.486] Part 6: part_type: 0x0x00000000 [ 2.491] startblock: 0x0x000001d0, endblock 0x0x000001e0 [ 2.496] Part 7: part_type: 0x0x00000001 [ 2.501] startblock: 0x0x000001e0, endblock 0x0x00000220 [ 2.507] Part 8: part_type: 0x0x00000000 [ 2.511] startblock: 0x0x00000220, endblock 0x0x00000228 [ 2.517] Part 9: part_type: 0x0x00000000 [ 2.521] startblock: 0x0x00000228, endblock 0x0x000002c8 [ 2.527] Part 10: part_type: 0x0x00000000 [ 2.531] startblock: 0x0x000002c8, endblock 0x0x00000760 [ 2.537] NB1 : init ok [ 2.540] flash init finish [ 2.543] fs init ok [ 2.546] fattype FAT16 [ 2.548] fs mount ok [ 2.550] script finish [ 2.553] boot power:unable to find dcdc4 set [ 2.558] power finish [ 2.574] BootMain start [ 2.574] 0 [ 2.585] key value = 0 [ 2.585] recovery key high 6, low 4 [ 2.586] unable to find fastboot_key key_max value [ 2.592] test for multi os boot with display [ 2.596] show pic finish [ 2.598] load kernel start [ 2.620] load kernel successed [ 2.620] start address = 0x4a000000 U-Boot 2011.09-rc1 (Nov 29 2012 - 20:36:02) Allwinner Technology CPU: SUNXI Family Board: A10-EVB DRAM: 512 MiB NAND: 3776 MiB In: serial Out: serial Err: serial --------fastboot partitions-------- -total partitions:11- -name- -start- -size- bootloader : 1000000 1000000 env : 2000000 1000000 boot : 3000000 2000000 system : 5000000 14000000 data : 19000000 20000000 misc : 39000000 1000000 recovery : 3a000000 2000000 cache : 3c000000 8000000 private : 44000000 1000000 sysrecovery : 45000000 14000000 UDISK : 59000000 93000000 ----------------------------------- Hit any key to stop autoboot: 0 NAND read: device 0 offset 0x3000000, size 0x2000000 33554432 bytes read: OK Starting kernel ... [ 0.187728] cryptomgr_test used greatest stack depth: 6672 bytes left [ 0.188142] cryptomgr_test used greatest stack depth: 6480 bytes left [ 0.190336] cryptomgr_test used greatest stack depth: 6120 bytes left [ 0.218189] sw_ahci sw_ahci.0: AHCI is disable [ 0.222748] sw_ahci: probe of sw_ahci.0 failed with error -22 [ 0.521586] [LCD] lcd_module_init [ 0.588835] regulator_init_complete: axp20_buck3: incomplete constraints, leaving on [ 0.596873] regulator_init_complete: axp20_buck2: incomplete constraints, leaving on [ 0.604897] regulator_init_complete: axp20_ldo4: incomplete constraints, leaving on [ 0.612833] regulator_init_complete: axp20_ldo3: incomplete constraints, leaving on [ 0.620756] regulator_init_complete: axp20_ldo2: incomplete constraints, leaving on [ 0.628659] regulator_init_complete: axp20_ldo1: incomplete constraints, leaving on [ 0.639321] init: could not import file init.sun4i.usb.rc [ 0.696874] init: to sleep 1 seconds. [ 1.700802] init: has waken up. [ 1.703984] init: [william] hdmistatus = 0! [ 1.708171] init: [william] tvstatus = 0! [ 1.712590] init: width = 1280 [ 1.715658] init: height = 720 [ 1.718723] init: s.st_size = 3686400 [ 2.043504] EXT4-fs (nandd): VFS: Can't find ext4 filesystem [ 2.061565] init: do_umount: /data [ 2.198835] init: do_umount: /cache [ 2.212841] init: dont need format /dev/block/nandk [ 2.218923] init: dont need format /dev/block/nandi [ 2.229917] init (1): /proc/1/oom_adj is deprecated, please use /proc/1/oom_score_adj instead. [ 2.240448] init: cannot find '/system/bin/sh', disabling 'console' [ 2.246726] init: cannot find '/system/bin/servicemanager', disabling 'servicemanager' [ 2.254700] init: cannot find '/system/bin/vold', disabling 'vold' [ 2.260944] init: cannot find '/system/bin/netd', disabling 'netd' [ 2.267136] init: cannot find '/system/bin/debuggerd', disabling 'debuggerd' [ 2.274223] init: cannot find '/system/bin/surfaceflinger', disabling 'surfaceflinger' [ 2.282183] init: cannot find '/system/bin/app_process', disabling 'zygote' [ 2.289162] init: cannot find '/system/bin/drmserver', disabling 'drm' [ 2.295728] init: cannot find '/system/bin/mediaserver', disabling 'media' [ 2.302645] init: cannot find '/system/bin/sambaserver', disabling 'netshare' [ 2.309786] init: cannot find '/system/bin/dbus-daemon', disabling 'dbus' [ 2.316633] init: cannot find '/system/bin/installd', disabling 'installd' [ 2.323552] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery' [ 2.331946] init: cannot find '/system/bin/keystore', disabling 'keystore' [ 2.338838] init: cannot find '/system/bin/u3gmonitor', disabling 'u3gmonitor' [ 2.346106] init: cannot find '/system/bin/rild', disabling 'ril-daemon' [ 2.352850] init: cannot find '/system/bin/securefileserver', disabling 'securefile' [ 2.360629] init: cannot find '/system/bin/isomountmanagerservice', disabling 'isomountmanager' [ 2.480392] init: cannot find '/system/bin/sh', disabling 'console'
The boot sequence on this device is slightly different in that the A10's boot loader jumps to uboot and then uboot boots to the kernel, rather than A10 straight to kernel. Apart from some version number differences the A10 boot loader appears to be the same as before - at least it appears to have all the same modes (FEL, key test etc).
The kernel output at the end of the boot indicates that some sort of file system corruption has taken place, which right now I'm attributing to over heating. The A10 feels hotter than I would like and there is very limited air flow through the casing, so I'm planning on installing a heatsink and to maybe modify the case.
The device is a JUSTOP Android 4.0 TV Box. Below are images of the front and back of the board.
Click here for a higher resolution PNG. Interesting you can see a space for a microphone at the front of the board (bottom of the image). The tracks appear to be connected to the A10.
Click here for a higher resolution PNG. On the right side of the image you can see the IC and the module that make up the wifi hardware.
In the end I recovered it by flashing with the latest stable firmware as per the manufacturers instructions.
Now I have a working logic analyser I wanted to see if I could use it to find the serial console ports hidden away on the main boards of one of the embedded linux devices I have. I decided to look at the no-name, 7 inch android tablet I was given last year as it's based on the Allwinner A10 - there are huge numbers of devices based on these chips so some familiarity with the architecture can be only be a good thing.
Finding the uart turned out to be pretty easy; on bottom left of the mainboard there are two groups of three copper pads, I first used my multimeter to identify the grounds - on both groups this was the left pad - then I checked the voltages on the other pads to be sure that I wasn't about to damage anything.
Then using a stellaris and OLS set to capture at 2MHz I held a probe on each of the four remaining pads in turn and pressed the power button, hoping that the wake from sleep would produce some kernel messages. The group of pads on the right side of the board didn't seem to do much, the centre pad looks to be connected to the power button and the other one might just be v+. Testing on the centre pin on the other set of pads showed binary data though and once run though the uart analyser in OLS was exactly the kernel messages I was expecting.
I soldered three wires onto the pads and put a female header on the other end, then assembled a FTDI usb<->uart breakout and a 5v to 3.3v level shifter (as the A10 appears to be a 3.3v system) on a small breadboard. After connecting the USB to a PC I then used cu to connect to ttyUSB0 at 115200. At this point I now had an interactive root shell and decided to reboot the device to get the boot logs:
HELLO! BOOT0 is starting! boot0 version : .2.2 dram size =512 Succeed in opening nand flash. Succeed in reading Boot1 file head. The size of Boot1 is 0x00036000. The file stored in 0X00000000 of block 2 is perfect. Check is correct. Ready to disable icache. Succeed in loading Boot1. Jump to Boot1. [ 0.122] boot1 version : 1.2.6 [ 0.122] pmu type = 3 [ 0.123] bat vol = 3919 [ 0.152] axi:ahb:apb=3:2:2 [ 0.152] set dcdc2=1400, clock=1008 successed [ 0.154] key [ 0.167] no key found [ 0.167] flash init start [ 0.182] flash init finish [ 0.184] fs init ok [ 0.184] fattype FAT16 [ 0.185] fs mount ok [ 0.191] script finish [ 0.192] power finish [ 0.196] BootMain start [ 0.196] 0 [ 0.205] gpio config [ 0.205] gpio finish [ 0.279] startup status = -1 [ 0.279] The all optional count is 1 [ 0.281] key high 6, low 4 [ 0.284] key value = -1 [ 0.287] key invalid [ 0.292] test for multi os boot with display [ 0.295] ERR: Parse_Pic_BMP failed [ 0.297] show pic finish [ 0.300] load kernel start [ 0.773] load kernel successed [ 0.773] start address = 0x40008000 [ 0.775] jump to [ 0.000000] Linux version 2.6.36-android (paco@inet) (gcc version 4.5.1 (Sourcery G++ Lite 2010.09-50) ) #5 PREEMPT Wed Mar 7 15:51:05 CST 2012 [ 0.000000] CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f [ 0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache [ 0.000000] Machine: sun4i [ 0.000000] Lichee System fixup [ 0.000000] Total Detected Memory: 512MB with 1 banks [ 0.000000] fbmem: start=0x5a000000, size=0x02000000 [ 0.000000] Memory Reserved: [ 0.000000] VE: 0x43000000, 0x04a00000 [ 0.000000] FB: 0x5a000000, 0x02000000 [ 0.000000] G2D: 0x58000000, 0x01000000 [ 0.000000] Memory policy: ECC disabled, Data cache writeback [ 0.000000] On node 0 totalpages: 114688 [ 0.000000] free_area_init_node: node 0, pgdat c07b4910, node_mem_map c0873000 [ 0.000000] DMA zone: 896 pages used for memmap [ 0.000000] DMA zone: 0 pages reserved [ 0.000000] DMA zone: 113792 pages, LIFO batch:31 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 113792 [ 0.000000] Kernel command line: console=ttyS0,115200 root=/dev/nandb rw init=/init fbmem=32M@0x5a000000 loglevel=8; [ 0.000000] [ 0.000000] [ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) [ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Memory: 448MB = 448MB total [ 0.000000] Memory: 321176k/321176k available, 137576k reserved, 0K highmem [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) [ 0.000000] DMA : 0xfee00000 - 0xffe00000 ( 16 MB) [ 0.000000] vmalloc : 0xdc800000 - 0xf0000000 ( 312 MB) [ 0.000000] lowmem : 0xc0000000 - 0xdc000000 ( 448 MB) [ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) [ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB) [ 0.000000] .init : 0xc0008000 - 0xc002f000 ( 156 kB) [ 0.000000] .text : 0xc002f000 - 0xc0772000 (7436 kB) [ 0.000000] .data : 0xc0772000 - 0xc07b5540 ( 270 kB) [ 0.000000] SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] RCU-based detection of stalled CPUs is disabled. [ 0.000000] Verbose stalled-CPUs detection is disabled. [ 0.000000] NR_IRQS:96 [ 0.000000] timer_set_mode: periodic [ 0.000000] Console: colour dummy device 80x30 [ 0.000000] Calibrating delay loop... 1005.97 BogoMIPS (lpj=5029888) [ 0.240000] pid_max: default: 32768 minimum: 301 [ 0.250000] Mount-cache hash table entries: 512 [ 0.250000] CPU: Testing write buffer coherency: ok [ 0.250000] devtmpfs: initialized [ 0.250000] DRAM Size: 512 [ 0.250000] regulator: core version 0.5 [ 0.250000] NET: Registered protocol family 16 [ 0.250000] hw perfevents: enabled with ARMv7 Cortex-A8 PMU driver, 5 counters available [ 0.250000] SOFTWINNER DMA Driver, (c) 2003-2004,2006 Simtec Electronics [ 0.250000] bio: create slab <bio-0> at 0 [ 0.250000] SCSI subsystem initialized [ 0.250000] libata version 3.00 loaded. [ 0.260000] usbcore: registered new interface driver usbfs [ 0.260000] usbcore: registered new interface driver hub [ 0.260000] usbcore: registered new device driver usb [ 0.260000] Advanced Linux Sound Architecture Driver Version 1.0.23. [ 0.260000] Bluetooth: Core ver 2.15 [ 0.260000] NET: Registered protocol family 31 [ 0.260000] Bluetooth: HCI device and connection manager initialized [ 0.260000] Bluetooth: HCI socket layer initialized [ 0.260000] cfg80211: Calling CRDA to update world regulatory domain [ 0.260000] Init eGon pin module V2.0 [ 0.260000] Switching to clocksource aw 64bits couter [ 0.260000] NET: Registered protocol family 2 [ 0.260000] IP route cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.270000] TCP established hash table entries: 16384 (order: 5, 131072 bytes) [ 0.270000] TCP bind hash table entries: 16384 (order: 4, 65536 bytes) [ 0.270000] TCP: Hash tables configured (established 16384 bind 16384) [ 0.270000] TCP reno registered [ 0.270000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.270000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.270000] NET: Registered protocol family 1 [ 0.270000] RPC: Registered udp transport module. [ 0.270000] RPC: Registered tcp transport module. [ 0.270000] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 0.270000] sw_sys: init [ 0.270000] [pm]aw_pm_init! [ 0.270000] ashmem: initialized [ 0.280000] NTFS driver 2.1.29 [Flags: R/W]. [ 0.280000] fuse init (API version 7.15) [ 0.280000] msgmni has been set to 627 [ 0.280000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 0.280000] io scheduler noop registered [ 0.280000] io scheduler deadline registered [ 0.280000] io scheduler cfq registered (default) [ 0.280000] G2D: drv_g2d_init [ 0.280000] G2D: g2dmem: g2d_start=58000000, g2d_size=1000000 [ 0.280000] G2D: head:d8000000,tail:d9000000 [ 0.280000] G2D: Module initialized.major:251 [ 0.280000] sw-uart.0: ttyS0 at MMIO 0x1c28000 (irq = 1) is a sw-uart0 [ 0.820000] console [ttyS0] enabled [ 0.820000] sw-uart.2: ttyS2 at MMIO 0x1c28800 (irq = 3) is a sw-uart2 [ 0.830000] brd: module loaded [ 0.840000] loop: module loaded [ 0.840000] [NAND]nand driver, init. [ 0.850000] [NAND] nand gpio_request [ 0.850000] [NAND] nand driver version: 0x2 0x9 [ 0.850000] [NAND] nand driver update: 20120214 [ 0.860000] nand interrupte register ok [ 0.860000] ret of NFC_ChangMode is 0 [ 0.870000] dma_hdle is 0 [ 0.870000] dma_hdle is 10000008 [ 0.890000] The 0 disk name = BOOTFS, class name = DISK, disk size = 32768 [ 0.900000] The 1 disk name = LROOTFS, class name = DISK, disk size = 65536 [ 0.910000] The 2 disk name = LSYSTEMFS, class name = DISK, disk size = 524288 [ 0.920000] The 3 disk name = LDATAFS, class name = DISK, disk size = 3774874 [ 0.920000] The 4 disk name = MISC, class name = DISK, disk size = 2048 [ 0.930000] The 5 disk name = LRECOVERYFS, class name = DISK, disk size = 65536 [ 0.940000] The 6 disk name = LCACHEFS, class name = DISK, disk size = 262144 [ 0.950000] The 7 disk name = UDISK, class name = DISK, disk size = 3053158 [ 0.960000] The 7 disk size = 3053158 [ 0.960000] part total count = 8 [ 0.960000] nanda: [ 0.970000] nandb: unknown partition table [ 0.970000] nandc: unknown partition table [ 0.980000] nandd: unknown partition table [ 0.990000] nande: unknown partition table [ 0.990000] nandf: unknown partition table [ 1.000000] nandg: unknown partition table [ 1.010000] nandh: [ 1.010000] benn: nand probe enter [ 1.010000] [NAND]nand driver, ok. [ 1.020000] PPP generic driver version 2.4.2 [ 1.020000] PPP Deflate Compression module registered [ 1.030000] PPP BSD Compression module registered [ 1.030000] PPP MPPE Compression module registered [ 1.040000] NET: Registered protocol family 24 [ 1.040000] emac driver is disabled [ 1.050000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.050000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 1.060000] [sw-ehci1]: probe, pdev->name: sw-ehci, pdev->id: 1, sw_ehci: 0xc07f3424 [ 1.070000] [sw-ehci1]: open clock [ 1.090000] [sw-ehci1]: Set USB Power ON [ 1.100000] sw-ehci sw-ehci.1: SW USB2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.110000] sw-ehci sw-ehci.1: new USB bus registered, assigned bus number 1 [ 1.110000] sw-ehci sw-ehci.1: irq 39, io mem 0xf1c14000 [ 1.140000] sw-ehci sw-ehci.1: USB 0.0 started, EHCI 1.00 [ 1.140000] hub 1-0:1.0: USB hub found [ 1.150000] hub 1-0:1.0: 1 port detected [ 1.150000] [sw-ohci1]: probe, pdev->name: sw-ohci, pdev->id: 1, sw_ohci: 0xc07f3534 [ 1.160000] [sw-ohci1]: open clock [ 1.180000] sw-ohci sw-ohci.1: SW USB2.0 'Open' Host Controller (OHCI) Driver [ 1.190000] sw-ohci sw-ohci.1: new USB bus registered, assigned bus number 2 [ 1.200000] sw-ohci sw-ohci.1: irq 64, io mem 0xf1c14400 [ 1.260000] hub 2-0:1.0: USB hub found [ 1.260000] hub 2-0:1.0: 1 port detected [ 1.270000] [sw-ehci2]: probe, pdev->name: sw-ehci, pdev->id: 2, sw_ehci: 0xc07f3648 [ 1.280000] [sw-ehci2]: open clock [ 1.300000] [sw-ehci2]: Set USB Power ON [ 1.310000] sw-ehci sw-ehci.2: SW USB2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.310000] sw-ehci sw-ehci.2: new USB bus registered, assigned bus number 3 [ 1.320000] sw-ehci sw-ehci.2: irq 40, io mem 0xf1c1c000 [ 1.350000] sw-ehci sw-ehci.2: USB 0.0 started, EHCI 1.00 [ 1.350000] ehci_irq: port change detect [ 1.360000] hub 3-0:1.0: USB hub found [ 1.360000] hub 3-0:1.0: 1 port detected [ 1.360000] [sw-ehci2]: sw_usb_disable_ehci [ 1.370000] [sw-ehci2]: remove, pdev->name: sw-ehci, pdev->id: 2, sw_ehci: 0xc07f3648 [ 1.380000] sw-ehci sw-ehci.2: remove, state 1 [ 1.380000] usb usb3: USB disconnect, address 1 [ 1.390000] sw-ehci sw-ehci.2: USB bus 3 deregistered [ 1.400000] [sw-ehci2]: Set USB Power OFF [ 1.400000] [sw-ehci2]: close clock [ 1.400000] [sw-ohci2]: probe, pdev->name: sw-ohci, pdev->id: 2, sw_ohci: 0xc07f3758 [ 1.410000] [sw-ohci2]: open clock [ 1.440000] [sw-ohci2]: Set USB Power ON [ 1.440000] sw-ohci sw-ohci.2: SW USB2.0 'Open' Host Controller (OHCI) Driver [ 1.450000] sw-ohci sw-ohci.2: new USB bus registered, assigned bus number 3 [ 1.460000] sw-ohci sw-ohci.2: irq 65, io mem 0xf1c1c400 [ 1.520000] hub 3-0:1.0: USB hub found [ 1.520000] hub 3-0:1.0: 1 port detected [ 1.530000] [sw-ohci2]: sw_usb_disable_ohci [ 1.530000] [sw-ohci2]: remove, pdev->name: sw-ohci, pdev->id: 2, sw_ohci: 0xc07f3758 [ 1.540000] sw-ohci sw-ohci.2: remove, state 1 [ 1.550000] usb usb3: USB disconnect, address 1 [ 1.550000] sw-ohci sw-ohci.2: USB bus 3 deregistered [ 1.560000] [sw-ohci2]: Set USB Power OFF [ 1.560000] [sw-ohci2]: close clock [ 1.570000] Initializing USB Mass Storage driver... [ 1.570000] usbcore: registered new interface driver usb-storage [ 1.580000] USB Mass Storage support registered. [ 1.580000] usbcore: registered new interface driver usbserial [ 1.590000] USB Serial support registered for generic [ 1.600000] usbcore: registered new interface driver usbserial_generic [ 1.600000] usbserial: USB Serial Driver core [ 1.610000] USB Serial support registered for GSM modem (1-port) [ 1.610000] usbcore: registered new interface driver option [ 1.620000] option: v0.7.2:USB Driver for GSM modems [ 1.630000] WRN:L158(drivers/usb/sun4i_usb/manager/usb_manager.c):ERR: get usbc(1) id failed [ 1.640000] WRN:L164(drivers/usb/sun4i_usb/manager/usb_manager.c):ERR: get usbc(1) det_vbus failed [ 1.650000] WRN:L158(drivers/usb/sun4i_usb/manager/usb_manager.c):ERR: get usbc(2) id failed [ 1.660000] WRN:L164(drivers/usb/sun4i_usb/manager/usb_manager.c):ERR: get usbc(2) det_vbus failed [ 1.690000] sw_hcd_host0 sw_hcd_host0: sw_hcd host driver [ 1.690000] sw_hcd_host0 sw_hcd_host0: new USB bus registered, assigned bus number 3 [ 1.700000] hub 3-0:1.0: USB hub found [ 1.710000] hub 3-0:1.0: 1 port detected [ 1.710000] android init [ 1.710000] android-platform_device_register [ 1.720000] ------print_msc_config----- [ 1.720000] vendor_id = 0x18d1 [ 1.730000] mass_storage_id = 0x1 [ 1.730000] adb_id = 0x2 [ 1.730000] usb_manufacturer_name = USB Developer [ 1.740000] usb_product_name = Android [ 1.740000] usb_serial_number = 20080411 [ 1.750000] msc_vendor_name = USB 2.0 [ 1.750000] msc_product_name = USB Flash Driver [ 1.760000] msc_release = 100 [ 1.760000] luns = 3 [ 1.770000] --------------------------- [ 1.770000] android_probe pdata: c0790544 [ 1.780000] WRN:L2671(drivers/usb/sun4i_usb/udc/sw_udc.c):ERR: usb device is not active [ 1.790000] android_bind [ 1.790000] android_bind_config [ 1.790000] Gadget Android: controller 'sw_usb_udc' not recognized [ 1.800000] WRN:L2671(drivers/usb/sun4i_usb/udc/sw_udc.c):ERR: usb device is not active [ 1.810000] android_usb gadget: android_usb ready [ 1.810000] f_adb init [ 1.820000] android_register_function adb [ 1.820000] f_mass_storage init [ 1.820000] fsg_probe pdev: c07906a0, pdata: c0790568 [ 1.830000] android_register_function usb_mass_storage [ 1.840000] android_usb gadget: Mass Storage Function, version: 2009/09/11 [ 1.840000] android_usb gadget: Number of LUNs=3 [ 1.850000] lun0: LUN: removable file: (no medium) [ 1.850000] lun1: LUN: removable file: (no medium) [ 1.860000] lun2: LUN: removable file: (no medium) [ 1.860000] adb_bind_config [ 1.870000] [ps2]: sw_ps2_init [ 1.870000] ps2: cannot find any unsing configuration for 2 ps/2 controller, return directly! [ 1.880000] mice: PS/2 mouse device common for all mice [ 1.890000] sun4i RTC version 0.1 [ 1.890000] sun4i-rtc sun4i-rtc: f23_rtc_probe tmp_data = 380239881 [ 1.900000] using rtc device, rtc, for alarms [ 1.900000] sun4i-rtc sun4i-rtc: rtc core: registered rtc as rtc0 [ 1.910000] i2c /dev entries driver [ 1.910000] ================power===================, status = 0 [ 1.920000] gsensor: registered bma250 @ addr 0x18 [ 1.930000] ctp_used == 0. [ 1.930000] ctp_used == 1. [ 1.930000] i2c_info_ctp1[0].type is: Goodix-TS, name is Goodix-TS. [ 1.940000] i2c: Goodix-TS_ctp1_twi_addr is 85, 0x55. [ 1.950000] i2c: Goodix-TS_ctp_twi_id is 2. [ 1.950000] ================Goodix-TS==============, twi_id = 2, status = 0 [ 1.960000] ctp_used == 1. [ 1.960000] i2c_info_ctp2[0].type is: ssd253x-ts, name is ssd253x-ts. [ 1.970000] i2c: ssd253x-ts_ctp2_twi_addr is 72, 0x48. [ 1.970000] i2c: ssd253x-ts_ctp2_twi_id is 2. [ 1.980000] ================ssd253x-ts==============, twi_id = 2, status = 0 [ 1.990000] ctp_used == 1. [ 1.990000] i2c_info_ctp[0].type is: novatek-ts, name is novatek-ts. [ 2.000000] i2c: novatek-ts_ctp_twi_addr is 1, 0x1. [ 2.000000] i2c: novatek-ts_ctp3_twi_id is 2. [ 2.010000] ================novatek-ts==============, twi_id = 2, status = 0 [ 2.020000] ctp4_used == 1. [ 2.020000] i2c_info_ctp4[0].type is: ssd253x, name is ssd253x. [ 2.030000] i2c: ssd253x_ctp4_twi_addr is 75, 0x4b. [ 2.030000] i2c: ssd253x_ctp4_twi_id is 2. [ 2.040000] ================ssd253x==============, twi_id = 2, status = 0 [ 2.040000] bus num = 0, twi used = 1 [ 2.050000] bus num = 1, twi used = 1 [ 2.050000] bus num = 2, twi used = 1 [ 2.060000] config i2c gpio with gpio_config api [ 2.060000] twi0, apb clock = 24000000 [ 2.070000] _twi_set_clk: clk_n = 0, clk_m = 5 [ 2.070000] axp_mfd 0-0034: AXP (CHIP ID: 0x21) detected [ 2.080000] [AXP]axp driver uning configuration failed(322) [ 2.090000] [AXP]power_start = 0 [ 2.090000] I2C: i2c-0: AW16XX I2C adapter [ 2.090000] **********start************ [ 2.100000] 0x40 [ 2.100000] 0xf8 [ 2.100000] 0x28 [ 2.100000] 0x0 [ 2.110000] 0x0 [ 2.110000] **********end************ [ 2.110000] twi1, apb clock = 24000000 [ 2.120000] _twi_set_clk: clk_n = 0, clk_m = 11 [ 2.120000] I2C: i2c-1: AW16XX I2C adapter [ 2.130000] **********start************ [ 2.130000] 0x40 [ 2.130000] 0xf8 [ 2.140000] 0x58 [ 2.140000] 0x0 [ 2.140000] 0x0 [ 2.140000] **********end************ [ 2.150000] twi2, apb clock = 24000000 [ 2.150000] _twi_set_clk: clk_n = 0, clk_m = 11 [ 2.160000] I2C: i2c-2: AW16XX I2C adapter [ 2.160000] **********start************ [ 2.160000] 0x40 [ 2.170000] 0xf8 [ 2.170000] 0x58 [ 2.170000] 0x0 [ 2.170000] 0x0 [ 2.170000] **********end************ [ 2.180000] lirc_dev: IR Remote Control driver registered, major 250 [ 2.190000] IR NEC protocol handler initialized [ 2.190000] IR RC5(x) protocol handler initialized [ 2.200000] IR RC6 protocol handler initialized [ 2.200000] IR JVC protocol handler initialized [ 2.210000] IR Sony protocol handler initialized [ 2.210000] IR LIRC bridge handler initialized [ 2.220000] Linux video capture interface: v2.00 [ 2.220000] usbcore: registered new interface driver em28xx [ 2.230000] em28xx driver loaded [ 2.230000] Em28xx: Initialized (Em28xx Audio Extension) extension [ 2.240000] cx231xx v4l2 driver loaded. [ 2.240000] usbcore: registered new interface driver cx231xx [ 2.250000] cx231xx: Cx231xx Audio Extension initialized [ 2.260000] usbcore: registered new interface driver usbvision [ 2.260000] USBVision USB Video Device Driver for Linux : 0.9.10 [ 2.270000] usbcore: registered new interface driver pvrusb2 [ 2.280000] pvrusb2: V4L in-tree version:Hauppauge WinTV-PVR-USB2 MPEG2 Encoder/Tuner [ 2.280000] pvrusb2: Debug mask is 31 (0x1f) [ 2.290000] SE401 usb camera driver version 0.24 registering [ 2.300000] usbcore: registered new interface driver se401 [ 2.300000] usbcore: registered new interface driver zr364xx [ 2.310000] zr364xx: Zoran 364xx [ 2.310000] usbcore: registered new interface driver stkwebcam [ 2.320000] sn9c102: V4L2 driver for SN9C1xx PC Camera Controllers v1:1.47pre49 [ 2.330000] usbcore: registered new interface driver sn9c102 [ 2.330000] et61x251: V4L2 driver for ET61X[12]51 PC Camera Controllers v1:1.09 [ 2.340000] usbcore: registered new interface driver et61x251 [ 2.350000] pwc: Philips webcam module version 10.0.13 loaded. [ 2.350000] pwc: Supports Philips PCA645/646, PCVC675/680/690, PCVC720[40]/730/740/750 & PCVC830/840. [ 2.360000] pwc: Also supports the Askey VC010, various Logitech Quickcams, Samsung MPC-C10 and MPC-C30, [ 2.370000] pwc: the Creative WebCam 5 & Pro Ex, SOTEC Afina Eye and Visionite VCS-UC300 and VCS-UM100. [ 2.380000] pwc: Trace options: 0x0001 [ 2.390000] usbcore: registered new interface driver Philips webcam [ 2.400000] gspca: main v2.10.0 registered [ 2.400000] usbcore: registered new interface driver hdpvr [ 2.410000] usbcore: registered new interface driver ibmcam [ 2.410000] usbcore: registered new interface driver ultracam [ 2.420000] konicawc: v1.4:Konica Webcam driver [ 2.420000] usbcore: registered new interface driver konicawc [ 2.430000] usbcore: registered new interface driver vicam [ 2.440000] usbcore: registered new interface driver s2255 [ 2.440000] usbcore: registered new interface driver uvcvideo [ 2.450000] USB Video Class driver (v0.1.0) [ 2.450000] [cedar dev]: install start!!! [ 2.460000] [cedar dev]: install end!!! [ 2.460000] [ace_drv] init end!!! [ 2.470000] [pa_drv] start!!! [ 2.470000] [pa_drv] init end!!! [ 2.480000] regulator: axp20_ldo1: 1300 mV [ 2.480000] regulator: axp20_ldo2: 1800 <--> 3300 mV at 3000 mV [ 2.490000] regulator: axp20_ldo3: 700 <--> 3500 mV at 2800 mV [ 2.500000] regulator: axp20_ldo4: 1250 <--> 3300 mV at 2800 mV [ 2.500000] regulator: axp20_buck2: 700 <--> 2275 mV at 1400 mV [ 2.510000] regulator: axp20_buck3: 700 <--> 3500 mV at 1250 mV [ 2.520000] regulator: axp20_ldoio0: 1800 <--> 3300 mV at 2800 mV [ 2.530000] input: axp20-supplyer as /devices/platform/aw16xx-i2c.0/i2c-0/0-0034/axp20-supplyer.28/input/input0 [ 2.540000] [AXP]axp driver uning configuration failed(1580) [ 2.550000] [AXP]pmu_suspendpwroff_vol = 3500 [ 2.560000] device-mapper: uevent: version 1.0.3 [ 2.570000] device-mapper: ioctl: 4.18.0-ioctl (2010-06-29) initialised: dm-devel@redhat.com [ 2.580000] device-mapper: multipath: version 1.1.1 loaded [ 2.580000] device-mapper: multipath round-robin: version 1.0.0 loaded [ 2.590000] Bluetooth: HCI UART driver ver 2.2 [ 2.600000] Bluetooth: HCI H4 protocol initialized [ 2.600000] Bluetooth: HCI BCSP protocol initialized [ 2.610000] Bluetooth: HCILL protocol initialized [ 2.610000] [mmc_pm]: no sdio card used in configuration [ 2.620000] [mmc]: awsmc_init [ 2.620000] [mmc]: awsmc controller unsing config sdc0 1, sdc1 1, sdc2 0, sdc3 1 [ 2.630000] [mmc]: awsmc.0: pdev->name: awsmc, pdev->id: 00000000 [ 2.640000] [mmc]: smc 0, source = sdram_pll_p, src_clk = 408000000, mclk 40800000, [ 2.650000] [mmc]: MMC Driver init host 0 [ 2.650000] [mmc]: sdc 0 idma des address d9a98000 [ 2.660000] [mmc]: mmc 0 suspend pins [ 2.660000] [mmc]: awsmc.0: Initialisation Done. ret 0 [ 2.670000] [mmc]: awsmc.1: pdev->name: awsmc, pdev->id: 00000001 [ 2.670000] [mmc]: smc 1, source = sdram_pll_p, src_clk = 408000000, mclk 40800000, [ 2.680000] [mmc]: MMC Driver init host 1 [ 2.690000] [mmc]: sdc 1 idma des address d9a9c000 [ 2.690000] [mmc]: mmc 1 suspend pins [ 2.700000] [mmc]: awsmc.1: Initialisation Done. ret 0 [ 2.700000] [mmc]: awsmc.3: pdev->name: awsmc, pdev->id: 00000003 [ 2.710000] [mmc]: smc 3, source = sdram_pll_p, src_clk = 408000000, mclk 81600000, [ 2.720000] [mmc]: MMC Driver init host 3 [ 2.720000] [mmc]: sdc 3 idma des address d9aa0000 [ 2.730000] [mmc]: mmc 3 suspend pins [ 2.730000] [mmc]: awsmc.3: Initialisation Done. ret 0 [ 2.740000] usbcore: registered new interface driver usbhid [ 2.740000] usbhid: USB HID core driver [ 2.750000] logger: created 64K log 'log_main' [ 2.750000] logger: created 256K log 'log_events' [ 2.760000] logger: created 64K log 'log_radio' [ 2.760000] logger: created 64K log 'log_system' [ 2.770000] enter sun4i Audio codec!!! [ 2.770000] sun4i audio support initialized [ 2.780000] baseaddr = dc84ac00 [ 2.780000] audiocodec_adap_awxx_init: script_parser_fetch err. [ 2.790000] sun4i Audio codec successfully loaded.. [ 2.790000] No device for DAI sun4i-hdmiaudio [ 2.800000] No device for DAI SNDHDMI [ 2.800000] asoc: SNDHDMI <-> sun4i-hdmiaudio mapping ok [ 2.810000] [SPDIF]sun4i-spdif cannot find any using configuration for controllers, return directly! [ 2.820000] [SPDIF]sndspdif cannot find any using configuration for controllers, return directly! [ 2.830000] [SPDIF]sun4i_sndspdif cannot find any using configuration for controllers, return directly! [ 2.840000] usbcore: registered new interface driver snd-usb-audio [ 2.850000] usbcore: registered new interface driver snd-ua101 [ 2.850000] usbcore: registered new interface driver snd-usb-caiaq [ 2.860000] ALSA device list: [ 2.870000] #0: sun4i-CODEC Audio Codec [ 2.870000] #1: SUN4I_SNDHDMI (SNDHDMI) [ 2.870000] nf_conntrack version 0.5.0 (5018 buckets, 20072 max) [ 2.880000] IPv4 over IPv4 tunneling driver [ 2.890000] GRE over IPv4 tunneling driver [ 2.890000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 2.900000] TCP cubic registered [ 2.900000] NET: Registered protocol family 10 [ 2.910000] IPv6 over IPv4 tunneling driver [ 2.910000] NET: Registered protocol family 17 [ 2.920000] NET: Registered protocol family 15 [ 2.920000] Bluetooth: L2CAP ver 2.15 [ 2.930000] Bluetooth: L2CAP socket layer initialized [ 2.930000] Bluetooth: SCO (Voice Link) ver 0.6 [ 2.940000] Bluetooth: SCO socket layer initialized [ 2.940000] Bluetooth: RFCOMM TTY layer initialized [ 2.950000] Bluetooth: RFCOMM socket layer initialized [ 2.950000] Bluetooth: RFCOMM ver 1.11 [ 2.960000] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 2.960000] Bluetooth: BNEP filters: protocol multicast [ 2.970000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2 [ 2.980000] L2TP core driver, V2.0 [ 2.980000] PPPoL2TP kernel driver, V2.0 [ 2.980000] lib80211: common routines for IEEE802.11 drivers [ 2.990000] lib80211_crypt: registered algorithm 'NULL' [ 3.000000] [mmc_pm]: No sdio card, please check your config !! [ 3.000000] VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3 [ 3.010000] regulator_init_complete: incomplete constraints, leaving axp20_buck3 on [ 3.020000] regulator_init_complete: incomplete constraints, leaving axp20_buck2 on [ 3.030000] regulator_init_complete: incomplete constraints, leaving axp20_ldo4 on [ 3.040000] regulator_init_complete: incomplete constraints, leaving axp20_ldo3 on [ 3.050000] regulator_init_complete: incomplete constraints, leaving axp20_ldo2 on [ 3.060000] sun4i-rtc sun4i-rtc: f23_rtc_gettime [ 3.060000] sun4i-rtc sun4i-rtc: read time 2010-1-1 0:1:46 [ 3.070000] sun4i-rtc sun4i-rtc: setting system clock to 2010-01-01 00:01:46 UTC (1262304106) [ 3.110000] EXT3-fs (nandb): error: couldn't mount because of unsupported optional features (240) [ 3.120000] EXT2-fs (nandb): error: couldn't mount because of unsupported optional features (244) [ 3.140000] EXT4-fs (nandb): warning: maximal mount count reached, running e2fsck is recommended [ 3.150000] EXT4-fs (nandb): recovery complete [ 3.160000] EXT4-fs (nandb): mounted filesystem with ordered data mode. Opts: (null) [ 3.160000] VFS: Mounted root (ext4 filesystem) on device 93:8. [ 3.170000] devtmpfs: mounted [ 3.170000] Freeing init memory: 156K [ 3.470000] [LCD] lcd_module_init [ 4.160000] init: width = 800 [ 4.160000] init: height = 480 [ 4.160000] init: s.st_size = 1536000 [ 4.260000] init: do_mount [ 4.270000] init: do_mount [ 4.270000] init: do_mount [ 4.270000] init: do_mount [ 4.280000] init: do_mount [ 4.280000] init: do_mount [ 4.290000] EXT4-fs (nandc): barriers disabled [ 4.310000] EXT4-fs (nandc): warning: maximal mount count reached, running e2fsck is recommended [ 4.320000] EXT4-fs (nandc): recovery complete [ 4.330000] EXT4-fs (nandc): mounted filesystem with ordered data mode. Opts: barrier=0 [ 4.330000] init: do_mount [ 4.350000] EXT4-fs (nandd): barriers disabled [ 12.910000] JBD2: Disabling barriers on nandb-8, not supported by device [ 12.920000] EXT4-fs (nandd): recovery complete [ 13.400000] EXT4-fs (nandd): mounted filesystem with ordered data mode. Opts: barrier=0 [ 13.410000] init: do_umount: /data [ 14.090000] EXT4-fs (nandd): barriers disabled [ 14.100000] EXT4-fs (nandd): mounted filesystem with ordered data mode. Opts: noauto_da_alloc,barrier=0 [ 14.110000] init: do_mount [ 14.120000] EXT4-fs (nandg): barriers disabled [ 15.100000] EXT4-fs (nandg): recovery complete [ 15.110000] EXT4-fs (nandg): mounted filesystem with ordered data mode. Opts: barrier=0 [ 15.110000] init: do_mount [ 15.120000] init: dont need format /dev/block/nandh [ 15.220000] init (1): /proc/1/oom_adj is deprecated, please use /proc/1/oom_score_adj instead. [ 15.230000] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery' [ 15.760000] sun4i-ts.c: sun4i_ts_init: start ... [ 15.770000] rtp_used == 1. [ 15.770000] sun4i-ts: tp_screen_size is 7 inch. [ 15.780000] sun4i-ts: tp_regidity_level is 5. [ 15.780000] sun4i-ts: tp_press_threshold_enable is 0. [ 15.790000] sun4i-ts: rtp_sensitive_level is 15. [ 15.790000] sun4i-ts: rtp_exchange_x_y_flag is 0. [ 15.800000] sun4i-ts.c: sun4i_ts_probe: start... [ 15.800000] begin get platform resourec [ 15.810000] input: sun4i-ts as /devices/platform/sun4i-ts/input/input1 [ 15.820000] tp init [ 15.820000] sun4i-ts.c: sun4i_ts_probe: end [ 15.820000] ==register_early_suspend = [ 15.860000] input: sun4i-keyboard as /devices/virtual/input/input2 [ 15.870000] ==register_early_suspend = [ 15.970000] UMP: UMP device driver loaded [ 16.120000] mali: use config clk_div 3 [ 16.130000] mali: clk_div 3 [ 16.130000] Mali: mali clock set completed, clock is 320000000 Mhz [ 16.140000] mali: use config clk_div 3 [ 16.140000] mali: clk_div 3 [ 16.140000] Mali: mali clock set completed, clock is 320000000 Mhz [ 16.150000] Mali: Mali device driver loaded [ 16.260000] [CSI]Welcome to CSI driver [ 16.270000] [CSI]registered sub device,input_num = 0 [ 16.270000] [CSI]power on and power off camera! [ 16.320000] [CSI]V4L2 device registered as video0 [ 16.340000] Bosch Sensortec Device detected! [ 16.340000] BMA250 registered I2C driver! [ 16.350000] input: bma250 as /devices/virtual/input/input3 [ 16.460000] usbcore: registered new interface driver asix [ 16.510000] rtl8150: v0.6.2 (2004/08/27):rtl8150 based usb-ethernet driver [ 16.520000] usbcore: registered new interface driver rtl8150 [ 16.570000] usbcore: registered new interface driver sr9700_android [ 16.620000] usbcore: registered new interface driver MOSCHIP usb-ethernet driver [ 16.650000] enabling adb [ 16.650000] adb_open [ 22.350000] warning: `zygote' uses 32-bit capabilities (legacy support in use) [ 65.800000] request_suspend_state: wakeup (3->0) at 65803651553 (2010-01-01 00:02:49.215197497 UTC) [ 65.990000] sw_usb_enable_hcd: usbc_num = 2 [ 65.990000] [sw-ehci2]: sw_usb_enable_ehci [ 65.990000] [sw-ehci2]: probe, pdev->name: sw-ehci, pdev->id: 2, sw_ehci: 0xc07f3648 [ 66.000000] [sw-ehci2]: open clock [ 66.030000] [sw-ehci2]: Set USB Power ON [ 66.040000] sw-ehci sw-ehci.2: SW USB2.0 'Enhanced' Host Controller (EHCI) Driver [ 66.050000] sw-ehci sw-ehci.2: new USB bus registered, assigned bus number 4 [ 66.050000] sw-ehci sw-ehci.2: irq 40, io mem 0xf1c1c000 [ 66.080000] sw-ehci sw-ehci.2: USB 0.0 started, EHCI 1.00 [ 66.080000] ehci_irq: port change detect [ 66.090000] hub 4-0:1.0: USB hub found [ 66.100000] hub 4-0:1.0: 1 port detected [ 66.100000] [sw-ohci2]: sw_usb_enable_ohci [ 66.110000] [sw-ohci2]: probe, pdev->name: sw-ohci, pdev->id: 2, sw_ohci: 0xc07f3758 [ 66.120000] [sw-ohci2]: open clock [ 66.140000] sw-ohci sw-ohci.2: SW USB2.0 'Open' Host Controller (OHCI) Driver [ 66.150000] sw-ohci sw-ohci.2: new USB bus registered, assigned bus number 5 [ 66.160000] sw-ohci sw-ohci.2: irq 65, io mem 0xf1c1c400 [ 66.220000] hub 5-0:1.0: USB hub found [ 66.220000] hub 5-0:1.0: 1 port detected [ 66.230000] [ 66.230000] rtw driver version=v3.3.2_3192.20120103 [ 66.240000] ##########rtw_suspend_lock_init ########### [ 66.250000] usbcore: registered new interface driver rtl8192cu [ 66.420000] usb 4-1: new high speed USB device using sw-ehci and address 2 [ 66.570000] register rtw_netdev_ops to netdev_ops [ 66.570000] CHIP TYPE: RTL8188C_8192C [ 66.660000] [ 66.660000] usb_endpoint_descriptor(0): [ 66.670000] bLength=7 [ 66.670000] bDescriptorType=5 [ 66.670000] bEndpointAddress=81 [ 66.780000] wMaxPacketSize=200 [ 66.790000] bInterval=0 [ 66.790000] RT_usb_endpoint_is_bulk_in = 1 [ 66.790000] [ 66.790000] usb_endpoint_descriptor(1): [ 66.890000] bLength=7 [ 66.890000] bDescriptorType=5 [ 66.890000] bEndpointAddress=2 [ 67.020000] wMaxPacketSize=200 [ 67.020000] bInterval=0 [ 67.020000] RT_usb_endpoint_is_bulk_out = 2 [ 67.110000] [ 67.110000] usb_endpoint_descriptor(2): [ 67.110000] bLength=7 [ 67.200000] bDescriptorType=5 [ 67.290000] bEndpointAddress=3 [ 67.290000] wMaxPacketSize=200 [ 67.290000] bInterval=0 [ 67.390000] RT_usb_endpoint_is_bulk_out = 3 [ 67.390000] [ 67.390000] usb_endpoint_descriptor(3): [ 67.490000] bLength=7 [ 67.490000] bDescriptorType=5 [ 67.490000] bEndpointAddress=84 [ 67.490000] wMaxPacketSize=40 [ 67.600000] bInterval=1 [ 67.600000] RT_usb_endpoint_is_int_in = 4, Interval = 1 [ 67.740000] nr_endpoint=4, in_num=2, out_num=2 [ 67.740000] [ 67.740000] USB_SPEED_HIGH [ 67.750000] Chip Version ID: VERSION_NORMAL_TSMC_CHIP_88C. [ 67.750000] RF_Type is 3!! [ 67.760000] EEPROM type is E-FUSE [ 67.760000] ====> ReadAdapterInfo8192C [ 67.760000] Boot from EFUSE, Autoload OK ! [ 68.100000] EEPROMVID = 0x0bda [ 68.100000] EEPROMPID = 0x8176 [ 68.120000] EEPROMCustomerID : 0x00 [ 68.120000] EEPROMSubCustomerID: 0x00 [ 68.120000] RT_CustomerID: 0x00
The 'BOOT0' stuff is the initial hardware boot loader (more information here) which has a button test mode; I couldn't exit from this and had to cut the battery wires to be able to reset the device!
The mainboard is marked as "iNet-97F Rev 02" - more information here.
