09
2025
02

小米盒子4S Pro TTL调试

小米盒子4S Pro网上资料比较少,只能自己拆机查看了
拆机发现板子非常简陋,板子连TF卡槽都取消了,主板上有一个未焊接的3脚焊盘位,应该就是TTL,接上测试可以进行调试,系统uboot可以进入,系统命令行操作是关闭的,无法进入,不过能进入Uboot感觉还是可以玩玩的,说不定可以USB启动外部系统

简陋的主板照:

小米盒子4S Pro TTL调试

小米盒子4S Pro TTL调试

TTL接口,如果没有启动信息可能是TX,RX标反了,反接一下即可

小米盒子4S Pro TTL调试

小米盒子4S Pro TTL调试

详细的TTL信息:
  1. SM1:BL:511f6b:81ca2f;FEAT:B0F971B0:20292020;POC:F;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;

  2. bl2_stage_init 0x01

  3. bl2_stage_init 0x81

  4. hw id: 0x0000 - pwm id 0x01

  5. bl2_stage_init 0xc1

  6. bl2_stage_init 0x02


  7. L0:0000000f

  8. L1:00000700

  9. L2:00008067

  10. L3:15000020

  11. S1:00000000

  12. B2:20292020

  13. B1:b0f971b0


  14. TE: 514704


  15. BL2 Built : 13:38:54, Oct 10 2020. g12a g92322cd - shuAI.wu@xiaomi


  16. Board ID = 0

  17. Set cpu clk to 24M

  18. Set clk81 to 24M

  19. Use GP1_pll as DSU clk.

  20. DSU clk: 1200 Mhz

  21. CPU clk: 1800 MHz

  22. Set clk81 to 166.6M

  23. eMMC boot [url=home.php?mod=space&uid=103582]@[/url] 0

  24. sw8 s

  25. board id: 0

  26. Load FIP HDR DDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0

  27. fw parse done

  28. PIEI prepare done

  29. 00000000

  30. emmc switch 1 ok

  31. 00000000

  32. emmc switch 2 ok

  33. NO find ddr boot_info from eMMC

  34. fastboot data verify

  35. result: 255

  36. Cfg max: 12, cur: 1. Board id: 255. Force loop cfg

  37. DDR4 probe


  38. LPDDR4_PHY_V_0_1_21-Built : 15:37:51, Mar 26 2020. g12a gf098346 - gongwei.chen@droid11-sz

  39. ddr clk to 1320MHz

  40. 00000000

  41. emmc switch 0 ok


  42. dmc_version 0001

  43. Check phy result

  44. INFO : End of initialization

  45. INFO : End of read enable training

  46. INFO : End of fine write leveling

  47. INFO : ERROR : Training has failed!

  48. 1D training failed

  49. Cfg max: 12, cur: 2. Board id: 255. Force loop cfg

  50. DDR4 probe

  51. ddr clk to 1320MHz


  52. dmc_version 0001

  53. Check phy result

  54. INFO : End of initialization

  55. INFO : End of read enable training

  56. INFO : End of fine write leveling

  57. INFO : End of read dq deskew training

  58. INFO : End of MPR read delay center optimization

  59. INFO : End of Write leveling coarse delay

  60. INFO : End of write delay center optimization

  61. INFO : End of read delay center optimization

  62. INFO : End of max read latency training

  63. INFO : Training has run successfully!

  64. 1D training succeed

  65. Check phy result

  66. INFO : End of initialization

  67. INFO : End of 2D read delay Voltage center optimization

  68. INFO : End of 2D write delay Voltage center optimization

  69. INFO : Training has run successfully!


  70. soc_VRef_reg_value 0x 00000032 00000030 0000002b 0000002f 0000002d 0000002d 00000032 0000002f 0000002d 00000030 0000002e 00000030 0000002a 0000002f 00000031 0000002d 00000034 00000031 0000002f 0000002b 0000002e 0000002f 0000002e 00000030 0000002c 0000002c 00000032 00000031 0000002f 0000002a 00000032 0000002f dwc_ddrphy_apb_wr((0<<20)|(2<<16)|(0<<12)|(0xb0):0001

  71. dram_vref_reg_value 0x 0000001a

  72. 2D training succeed

  73. auto size-- 65535DDR cs0 size: 2048MB

  74. DDR cs1 size: 0MB

  75. DMC_DDR_CTRL: 0050002cDDR size: 2048MB

  76. cs0 DataBus test pass

  77. cs0 AddrBus test pass


  78. non-sec scramble use zero key

  79. ddr scramble enabled


  80. 100bdlr_step_size ps== 440

  81. result report

  82. boot times 0Enable ddr reg access

  83. 00000000

  84. emmc switch 3 ok

  85. BL2: rpmb counter: 0x0000001c

  86. 00000000

  87. emmc switch 0 ok

  88. Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0

  89. Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x0013aa00, part: 0

  90. 0.0;0.0;M3 CHK:0;cm4_sp_mode 0

  91. [Image: g12a_v1.1.3395-4f61cc3 2020-09-21 11:08:04 shuai.wu@xiaomi]

  92. OPS=0x03

  93. ring efuse init

  94. 2b 0b 03 00 01 11 2a 00 00 11 31 36 41 34 56 50

  95. [0.050490 Inits done]

  96. secure task start!

  97. high task start!

  98. low task start!

  99. boot bl31

  100. NOTICE:  BL31: v1.3(release):61f890e5e

  101. NOTICE:  BL31: Built : 15:09:20, Sep 16 2020

  102. NOTICE:  BL31: G12A secure boot!

  103. NOTICE:  BL31: BL33 decompress pass

  104. INFO:    BL3-2: ATOS-V2.4.4-30-g921539e #1 Fri Dec 6 01:21:23 2019 -0700 arm

  105. INFO:    BL3-2: Chip: SM1 Rev: B (2B:B - 0:2)

  106. INFO:    BL3-2: crypto engine DMA

  107. INFO:    BL3-2: secure time TEE

  108. INFO:    BL3-2: CONFIG_DEVICE_SECURE 0xb200000e



  109. U-Boot 2015.01-g6223619 (Oct 19 2020 - 14:52:47), Build: jenkins-uboot_frozen_release-2


  110. DRAM:  1 GiB

  111. Relocation Offset is: 36d89000

  112. mmu cfg end: 0x40000000

  113. mmu cfg end: 0x40000000

  114. register usb cfg[0][1] = 0000000037ea4890

  115. gpio: pin GPIOAO_11 (gpio 11) value is 1

  116. InUsbBurn

  117. wait for phy ready count is 0

  118. noSof

  119. sof timeout, reset usb phy tuning

  120. gpio: pin GPIOX_6 (gpio 86) value is 1

  121. MMC:   aml_priv->desc_buf = 0x0000000033d7a0c0

  122. aml_priv->desc_buf = 0x0000000033d7c400

  123. SDIO Port B: 0, SDIO Port C: 1

  124. co-phase 0x3, tx-dly 0, clock 400000

  125. co-phase 0x3, tx-dly 0, clock 400000

  126. co-phase 0x3, tx-dly 0, clock 400000

  127. emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800

  128. emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800

  129. co-phase 0x3, tx-dly 0, clock 400000

  130. co-phase 0x3, tx-dly 0, clock 40000000

  131. [set_emmc_calc_fixed_adj][875]find fixed adj_delay=20

  132. init_part() 297: PART_TYPE_AML

  133. [mmc_init] mmc init success

  134. aml log : R2048 check pass!

  135.       Amlogic multi-dtb tool

  136.       Single dtb detected

  137. start dts,buffer=0000000001000000,dt_addr=0000000001000000

  138. get_partition_from_dts() 92: ret 0

  139.       Amlogic multi-dtb tool

  140.       Single dtb detected

  141. parts: 17

  142. 00:      logo   0000000000800000 1

  143. 01:  recovery   0000000001800000 1

  144. 02:      misc   0000000000800000 1

  145. 03:      dtbo   0000000000800000 1

  146. 04:  cri_data   0000000000800000 2

  147. 05:     param   0000000001000000 2

  148. 06:      boot   0000000001000000 1

  149. set has_boot_slot = 0

  150. 07:       rsv   0000000001000000 1

  151. 08:  metadata   0000000001000000 1

  152. 09:    vbmeta   0000000000200000 1

  153. 10:       tee   0000000002000000 1

  154. 11:factorydata  0000000000a00000 2

  155. 12:    vendor   0000000020000000 1

  156. 13:    system   0000000040000000 1

  157. 14:   product   0000000002000000 1

  158. 15:     cache   0000000020000000 2

  159. 16:      data   ffffffffffffffff 4

  160. init_part() 297: PART_TYPE_AML

  161. eMMC/TSD partition table have been checked OK!

  162. crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!

  163. crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!

  164. crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!

  165. mmc env offset: 0x27400000

  166. aml log : internal sys error!

  167. reboot_mode=cold_boot

  168. amlkey_init() enter!

  169. [EFUSE_MSG]keynum is 4

  170. vpu: driver version: v20190313

  171. vpu: detect chip type: 11

  172. vpu: clk_level default: 7(666667000Hz), max: 7(666667000Hz)

  173. vpu: clk_level in dts: 7

  174. vpu: vpu_power_on

  175. vpu: set_vpu_clk

  176. vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)

  177. vpu: set_vpu_clk finish

  178. vpu: vpu_module_init_config

  179. vpp: vpp_init

  180. vpp: vpp osd2 matrix rgb2yuv..............

  181. hdr_func 4, hdr_process_select 0x1

  182. gpio: pin GPIOH_7 (gpio 38) value is 1

  183. cvbs: cpuid:0x2b

  184. cvbs: find performance_pal config

  185. aml log : internal sys error!

  186. pll tsensor avg: 0x1f9b, u_efuse: 0x2b

  187. temp1: 36

  188. ddr tsensor avg: 0x1f9c, u_efuse: 0x53

  189. temp2: 37

  190. device cool done

  191. hpd_state=0

  192. do_hpd_detect: hdmimode=2160p60hz

  193. do_hpd_detect: colorattribute=420,8bit

  194. Saving Environment to aml-storage...

  195. mmc env offset: 0x27400000

  196. Writing to MMC(1)... done

  197. no sink, fallback to 720p60hz[4]

  198. hdr mode is 0

  199. dv  mode is ver:0  len: 0

  200. hdr10+ mode is 0

  201. read hdmichecksum 0x00000000, colorattribute 420,8bit

  202. read hdmimode 2160p60hz, colorspace <NULL>, colordepth <NULL>

  203. do_get_parse_edid: autoMode = false, manualMode=97

  204. isYuv4KSink: false, maxTMDSRate=150

  205. do_get_parse_edid: non-yuv4k sink: inColorSpace: HDMI_COLOR_FORMAT_RGB

  206. do_get_parse_edid: default inColorDepth: HDMI_COLOR_DEPTH_24B

  207. TV is same, initial mode is: 576cvbs attr: 420,8bit

  208. dolby_status 0

  209. dolby_status 0

  210. dolby_vision_process: no tv and dv disabled

  211. Saving Environment to aml-storage...

  212. mmc env offset: 0x27400000

  213. Writing to MMC(1)... done

  214. [OSD]load fb addr from dts:/meson-fb

  215. [OSD]load fb addr from dts:/fb

  216. [OSD]set initrd_high: 0x7f800000

  217. [OSD]fb_addr for logo: 0x7f800000

  218. [OSD]load fb addr from dts:/meson-fb

  219. [OSD]load fb addr from dts:/fb

  220. [OSD]fb_addr for logo: 0x7f800000

  221. [OSD]VPP_OFIFO_SIZE:0xfff01fff

  222. [CANVAS]canvas init

  223. [CANVAS]addr=0x7f800000 width=3840, height=2160

  224. [OSD]osd_hw.free_dst_data: 0,719,0,575

  225. [OSD]osd1_update_disp_freescale_enable

  226. vpp: vpp_matrix_update: 2

  227. cvbs_performance_enhancement

  228. cvbs_config_hdmipll_g12a

  229. cvbs_set_vid2_clk

  230. dolby_status 0

  231. dolby_status 0

  232. hdr_packet

  233. vpp: hdr_policy = 0

  234. vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0

  235. s_version: U-Boot 2015.01-g6223619

  236. Hit Enter or space or Ctrl+C key to stop autoboot -- :  0

  237. co-phase 0x3, tx-dly 0, clock 40000000

  238. co-phase 0x3, tx-dly 0, clock 40000000

  239. co-phase 0x3, tx-dly 0, clock 400000

  240. emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800

  241. emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800

  242. co-phase 0x3, tx-dly 0, clock 400000

  243. co-phase 0x3, tx-dly 0, clock 40000000

  244. [set_emmc_calc_fixed_adj][875]find fixed adj_delay=20

  245. init_part() 297: PART_TYPE_AML

  246. [mmc_init] mmc init success

  247. switch to partitions #0, OK

  248. mmc1(part 0) is current device

  249. do_factorydata_read:204 Can't find out assm_mn from factorydata.

  250. factorydata - Access the factorydata from Xiaomi Partition


  251. Usage:

  252. factorydata     argv:

  253.     dump

  254.     read keyname

  255.     write keyname value

  256.     erase keyname


  257. do_factorydata_read:204 Can't find out loglevel from factorydata.

  258. factorydata - Access the factorydata from Xiaomi Partition


  259. Usage:

  260. factorydata     argv:

  261.     dump

  262.     read keyname

  263.     write keyname value

  264.     erase keyname


  265. do_factorydata_read:204 Can't find out console_enable from factorydata.

  266. factorydata - Access the factorydata from Xiaomi Partition


  267. Usage:

  268. factorydata     argv:

  269.     dump

  270.     read keyname

  271.     write keyname value

  272.     erase keyname


  273. Command: bcb uboot-command

  274. Start read misc partition datas!

  275. BCB hasn't any datas,exit!

  276. do_monitor_bt_cmdline

  277. USB0:   USB3.0 XHCI init start

  278. Register 3000140 NbrPorts 2

  279. Starting the controller

  280. USB XHCI 1.10

  281. scanning bus 0 for devices... 3 USB Device(s) found

  282. udev->descriptor.idVendor:0xbda udev->descriptor.idProduct:0xc820

  283. enumerate rtk usb dev OK usb_port:1

  284. bt_cmdline: start to download fw

  285. bt_cmdline: fw downloaded

  286. rtk_set_wake_polarity, polarity=0

  287. hci_set_scan_enable

  288. no recovery mod!

  289. rc scan end

  290. [imgread]szTimeStamp[2020102104463406]

  291. [imgread]secureKernelImgSz=0x91d800

  292. aml log : R~2048 check pass!

  293. aml log : R2048 check pass!

  294. aml log : R2048 check pass!

  295. avb2: 0

  296. ee_gate_off ...

  297. avb2: 0

  298. ## Booting Android Image at 0x01080000 ...

  299. Kernel command line: androidboot.dtbo_idx=0 buildvariant=user

  300. [store]Is good fdt check header, no need decrypt!

  301. load dtb from 0x1000000 ......

  302.       Amlogic multi-dtb tool

  303.       Single dtb detected

  304.    Loading Kernel Image(COMP_NONE) ... OK

  305.    kernel loaded at 0x01080000, end = 0x01989000

  306. libfdt fdt_getprop(): FDT_ERR_NOTFOUND

  307.    Loading Device Tree to 0000000009fea000, end 0000000009fffbbc ... OK

  308. fdt_fixup_memory_banks, reg:0000000000000000


  309. Starting kernel ...


  310. uboot time: 10220517 us

  311. [    0.000000@0] Linux version 4.9.113-g0ba0888-dirty ([email protected]) (gcc version 6.3.1 20170109 (Linaro GCC 6.3-2017.02) ) #1 SMP PREEMPT Wed Oct 21 04:30:00 CST 2020

  312. [    0.000000@0] Reserved memory: regions without no-map are not yet supported

  313. [    0.000000@0] Kernel command line: init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 hdr_policy=0 hdr_priority= reboot_mode_android=normal logo=osd0,loaded,0x3d800000 vout=576cvbs,enable hdmitx=,420,8bit hdmimode=2160p60hz hdmichecksum=0x00000000 dolby_vision_on=0 frac_rate_policy=1 hdmi_read_edid=1 cvbsmode=576cvbs osd_reverse=0 video_reverse=0 irq_check_en=0 androidboot.firstboot=0 jtag=disable androidboot.hardware=amlogic androidboot.bootloader=U-Boot 2015.01-g6223619 androidboot.build.expect.baseband=N/A androidboot.reboot_mode=cold_boot androidboot.platform_id=216 androidboot.mi.cpu=Cortex-A55 androidboot.mi.gpu=Mali-G31 androidboot.model_name=m23m_00_3f androidboot.provider=amlogic androidboot.serialno=30699800000001836 androidboot.mac=6c:0d:c4:0f:6e:0a quiet root=/dev/mmcblk0p18 ro rootwait skip_initramfs androidboot.selinux=enforcing otg_device=0 androidboot.dtbo_idx=0 build

  314. [    0.455892@0] vout: error: invalid vinfo1. current vmode is not supported

  315. [    0.457064@0] vout: error: invalid vinfo1. current vmode is not supported

  316. [    0.602556@1] meson_cpufreq_init:don't find the node <dynamic_gp1_clk>

  317. [    0.606573@1] ff803000.serial: clock gate not found

  318. [    0.747851@1] di_get_vpu_clkb: get clk vpu error.

  319. [    0.749132@1] get fclk_div5 err

  320. [    0.750031@1] vdin_drv_probe: vdin cannot get msr clk !!!

  321. [    0.755758@1] get fclk_div5 err

  322. [    0.758555@1] vdin_drv_probe: vdin cannot get msr clk !!!

  323. [    0.768861@1] pixel_probe: vpp probe func error!

  324. [    0.810889@0] cectx ff80023c.aocec: not find 'port_num'

  325. [    0.810936@0] cectx ff80023c.aocec: no hdmirx regs

  326. [    0.815271@0] cectx ff80023c.aocec: no hhi regs

  327. [    0.821827@0] cectx ff80023c.aocec: wakeup_reason:0x0

  328. [    0.857197@0] request_irq error ret=-22

  329. [    0.857258@0] dev_pm_set_wake_irq failed: -22

  330. [    0.861218@0] page_trace_module_init, create sysfs failed

  331. [    0.866034@0] defendkey ff630218.defendkey: Reserved memory is not enough!

  332. [    1.089421@0] asoc-aml-card auge_sound: control 2:0:0:I2SIn CLK:0 is already present

  333. [    1.091526@0] snd_tdm ff660000.audiobus:tdm@1: ASoC: Failed to add I2SIn CLK: -16

  334. [    1.098990@0] aml_dai_tdm_probe, failed add snd tdm controls

  335. [    1.104626@0] asoc-aml-card auge_sound: control 2:0:0:I2SIn CLK:0 is already present

  336. [    1.112379@0] snd_tdm ff660000.audiobus:tdm@2: ASoC: Failed to add I2SIn CLK: -16

  337. [    1.119799@0] aml_dai_tdm_probe, failed add snd tdm controls

  338. [    1.[    1.590270@3] EXT4-fs (mmcblk0p18): couldn't mount as ext3 due to feature incompatibilities

  339. [    1.623333@3] usb 1-1: Unsupported device

  340. [    1.623707@3] usb 1-1: Unsupported device

  341. [    1.626047@3] usb 1-1: Unsupported device

  342. [    1.878156@2] init: waitid failed: No child processes

  343. [    1.878230@2] init: get_model_name: Model Name -> m23m_00_3f

  344. [    1.883446@2] init: get_model_property_ini : INI load file error, use default file

  345. [    2.055145@3] ueventd: /vendor/ueventd.rc: 110: /sys/ lines must have 5 entries

  346. [    3.626765@3] Amlogic A/V streaming port init

  347. [    4.418508@3] [email protected]: wakealarm_init: timerfd_create failed

  348. [   12.760974@2] init: Boot Completed !!!

  349. [   12.761842@2] inyt: Can't create : File exists

  350. [   13.976602@2] rtk_btusb: reset_controller

  351. [   15.619288@0] rtk_btusb: btchr_ioctl:Failed with wrong Cmd:1074021809

  352. [   21.074753@2] init: No such service 'bdupdate' for ctl.stop

  353. [   21.078214@3] init: No such service 'sensord' for ctl.stop



« 上一篇

发表评论:

◎欢迎参与讨论,请在这里发表您的看法、交流您的观点。