今まで日本のテレビとかムフフな動画鑑賞に我が家には無くてはならない 安博盒子 、PROS2に買い換えて引退した UBOX4 をバラしてみました。その技術的記録です。第四代UBOX4は、オクタコア搭載のいわゆるAndroid TV Boxで、2017年に発売されました。
本体裏面の各辺にこのようなツメでとまっているだけなので、これを各辺少しずつこじって開きます(ネジはありません)。
内部構造はとてもシンプル。基板は上部ケースに逆さに配され、下部のフタには放熱用と思われる金属板が貼ってあります(アルミホイル程度ではなく、立派な板です)。
基板の赤外線受信部コネクタ付近には、シリアルコンソール用のピンヘッダがハンダ付けされています。
ネジを3本外すと基板は外れます。下図左端の青いWiFi+BTのRTL8723BUには、アンテナ線がコネクタではなく直付けされていました。
せっかくなのでシリアルを覗いてみましょう。基板にマイナスとプラスは印字されているので、残るTX、RXを類推するだけなので簡単。次のようなピンアサインになっていることを突き止めました。尚、通信速度は115,200bpsです。
次のような起動の様子を拝むことが出来ました。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 |
HELLO! BOOT0 is starting! boot0 commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 boot0 version : 4.0 set pll start set pll end rtc[0] value = 0x00000000 rtc[1] value = 0x00000000 rtc[2] value = 0x00000000 rtc[3] value = 0x00000000 rtc[4] value = 0x00000000 rtc[5] value = 0x00000000 DRAM BOOT DRIVE INFO: V0.6 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 axp not exist DRAM CLK =624 MHZ DRAM Type =3 (2:DDR2,3:DDR3,6:LPDDR2,7:LPDDR3) DRAM zq value: 0x003b3bf9 DRAM SIZE =1024 M DRAM simple test OK. dram size =1024 card no is 2 sdcard 2 line count 8 [mmc]: mmc driver ver 2016-03-15 20:40 [mmc]: ***Try MMC card 2*** [mmc]: MMC 5.0 [mmc]: HSDDR52/DDR50 8 bit [mmc]: 50000000 Hz [mmc]: 14800 MB [mmc]: ***SD/MMC 2 init OK!!!*** sum=35ec23c3 src_sum=35ec23c3 read boot-pkg from emmc 32800 sector Succeed in loading uboot from sdmmc flash. Entry_name = u-boot Entry_name = monitor Entry_name = scp set arisc reset to de-assert state Ready to disable icache. 0xffffffff 0xffffffff 0xff20ffff 0xffffffff 0xff1620ff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff ****{cc**5R* NOTICE: BL3-1: v1.0(debug):4b69fc3 NOTICE: BL3-1: Built : 13:27:16, Jun 8 2016 NOTICE: BL3-1 commit: 4b69fc3a2b852e80afb835a84dc5dd7d9bc13aae INFO: BL3-1: Initializing runtime services ERROR: Error initializing runtime service tspd_fast INFO: BL3-1: Preparing for EL3 exit to normal world INFO: BL3-1: Next image address = 0x4a000000 INFO: BL3-1: Next image spsr = 0x1d3 U-Boot 2014.07 (Jul 19 2017 - 09:51:20) Allwinner Technology uboot commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 secure enable bit: 0 i2c: secure monitor exist [ 0.694]pmbus: ready u0:d7e14ffc [ 0.698][ARISC] :arisc initialize [ 0.830][ARISC] :arisc_dvfs_cfg_vf_table: support only one vf_table [ 0.921][ARISC] :arisc para ok [SCP] :sunxi-arisc driver begin startup 2 [SCP] :arisc_para size:240 [SCP] :arisc version: [sun8iw5_v0.03.00-242-g8fe3aa7] [SCP] :sunxi-arisc driver v1.20 is starting [ 0.939][ARISC] :sunxi-arisc driver startup succeeded axp: get node[charger0] error [SCP ERROR] :message process error [SCP ERROR] :message addr : 48105080 [SCP ERROR] :message state : 5 [SCP ERROR] :message attr : 2 [SCP ERROR] :message type : 80 [SCP ERROR] :message result : f3 [SCP WARING] :callback not install [SCP ERROR] :arisc twi read pmu reg 0x3 err probe axp806 failed axp_probe error [ 0.973]PMU: cpux 1008 Mhz,AXI=336 Mhz PLL6=600 Mhz,AHB1=200 Mhz, APB1=100Mhz MBus=400Mhz run key detect no key found no uart input DRAM: 1 GiB fdt addr: 0x76e9b1a0 Relocation Offset is: 35eee000 axp: get node[charger0] error In: serial Out: serial Err: serial gic: sec monitor mode [box standby] read rtc = 0x0 [box standby] start_type = 0x1 [box standby] to kernel boot_init_gpio used ir boot recovery not used workmode = 0,storage type = 2 [ 1.180]MMC: 2 [mmc]: mmc driver ver 2016-05-20 17:18:00-test0 [mmc]: get sdc_ex_dly_used 2, use auto tuning sdly SUNXI SD/MMC: 2 [mmc]: 50 MHz... [mmc]: sample: 63 - 158(ps) [mmc]: ds: 63 - 158(ps) [mmc]: 100 MHz... [mmc]: sample: 32 - 156(ps) [mmc]: ds: 32 - 156(ps) [mmc]: 200 MHz... [mmc]: sample: 16 - 156(ps) [mmc]: ds: 16 - 156(ps) [mmc]: media type 0x8000000 [mmc]: ************Try MMC card 2************ [mmc]: mmc don't support HS400 [mmc]: host caps: 0x6f [mmc]: MID 000088 PSN ae00a522 [mmc]: PNM NCard -- 0x4e-43-61-72-64 [mmc]: PRV 2.1 [mmc]: MDT m-3 y-2017 [mmc]: MMC v5.0 [mmc]: speed mode : HSSDR52/SDR25 [mmc]: clock : 50000000 Hz [mmc]: bus_width : 8 bit [mmc]: user capacity : 14800 MB [mmc]: boot capacity : 4096 KB [mmc]: rpmb capacity : 4096 KB [mmc]: ************SD/MMC 2 init OK!!!************ [mmc]: ========best spd md: 2-HSDDR52/DDR50, freq: 2-50000000 [mmc]: already at HSSDR52_SDR25 mode [mmc]: hsddr 2-50000000 [mmc]: get max-frequency ok 50000000 Hz [mmc]: 1 1 0: 1 1 0 [mmc]: no mmc-hs400-1_8v! [mmc]: no mmc-hs200-1_8v! [mmc]: erase_grp_size : 0x400WrBlk*0x200=0x80000 Byte [mmc]: secure_feature : 0x55 [mmc]: secure_removal_type : 0x9 [mmc]: EOL Info(Rev blks): Normal [mmc]: Wear out(type A): 0%-10% life time used [mmc]: Wear out(type B): 0%-10% life time used [ 1.420]sunxi flash init ok read item0 copy0 the secure storage item0 copy0 is good no item name key_burned_flag in the map sunxi storage read fail sunxi secure storage has no flag [ 1.442]usb burn from boot delay time 0 [ 1.534]usb prepare ok [ 2.333]timer occur [ 2.334]overtime [ 2.367]do_burn_from_boot usb : no usb exist [ 2.367]start drv_disp_init tv_init: tv_probe:000 no report hpd work,you need support the switch class! screen 0 don't support TV! tv_init: fetch tv1 err. drv_disp_init finish hdcp is closed by sys config. reading disp_rsl.fex FAT: Misaligned buffer address (76e8cfa0) 10 bytes read in 2 ms (4.9 KiB/s) get format[40a] for type[4] get format[20e] for type[2] hpd_dev_num=2, id of def_output_dev is 0 hdmi hpd out, force open? fdt_setprop_u32 disp.init_disp(0x20e040a) code:<no error> fb_id=0, size=3686400, gd->ram_size=1073741824, SUNXI_DISPLAY_FRAME_BUFFER_SIZE=16777216 [ 2.952]end PowerBus = 0( 2:vBus 3:acBus other: not exist) no battery, limit to dc no battery exist sunxi_bmp_logo_display reading advert.crc ** Unable to read file advert.crc ** sunxi bmp info error : unable to open logo file sunxi_flash bmp_name=bootlogo.bmp reading bootlogo.bmp [mmc]: blkcnt should not be 0 58 bytes read in 5 ms (10.7 KiB/s) no support big size bmp[1x-1] on fb[1280x720] show bmp on fb failed ! --------fastboot partitions-------- -total partitions:15- -name- -start- -size- bootloader : 1000000 1000000 env : 2000000 1000000 boot : 3000000 1000000 system : 4000000 60000000 verity_block: 64000000 1000000 misc : 65000000 1000000 recovery : 66000000 2000000 sysrecovery : 68000000 60000000 private : c8000000 1000000 alog : c9000000 4000000 Reserve0 : cd000000 1000000 Reserve1 : ce000000 2000000 Reserve2 : d0000000 1000000 cache : d1000000 30000000 UDISK : 1000000 0 ----------------------------------- base bootcmd=run setargs_nand boot_normal bootcmd set setargs_mmc misc partition found to be run cmd=run setargs_mmc boot_normal no item name selinux in the map sunxi storage read fail name in map mac the secure storage item1 copy0 is good update mac = 00:27:41:6C:67:B7 no item name wifi_mac in the map sunxi storage read fail no item name bt_mac in the map sunxi storage read fail no item name specialstr in the map sunxi storage read fail check user data form private update dtb dram start update dtb dram end serial is: 14005190411820310a0d [ 3.192]inter uboot shell Hit any key to stop autoboot: 0 read partition: boot or recovery [ 4.454]sunxi flash read :offset 3000000, 15636900 bytes OK Kernel load addr 0x40080000 size 11915 KiB RAM disk load addr 0x41000000 size 2332 KiB [ 4.519]ready to boot prepare for kernel [mmc]: mmc exit start [mmc]: 50 MHz... [mmc]: sample: 31 - 322(ps) [mmc]: ds: 32 - 312(ps) [mmc]: 100 MHz... [mmc]: sample: 16 - 312(ps) [mmc]: ds: 16 - 312(ps) [mmc]: 200 MHz... [mmc]: sample: 11 - 227(ps) [mmc]: ds: 11 - 227(ps) [mmc]: mmc 2 exit ok Starting kernel ... INFO: BL3-1: Next image address = 0x40080000 INFO: BL3-1: Next image spsr = 0x3c5 [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.65 (hush1305@ubuntu12-64) (gcc version 4.9.3 20150113 (prerelease) (Linaro GCC 4.9-2015.7 [ 0.000000] CPU: AArch64 Processor [410fd034] revision 4 [ 0.000000] Machine: sun50iw2 [ 0.000000] bootconsole [earlycon0] enabled root@cheetah-p1:/ # |
最後にプロンプトは出るものの、何を打っても応答がありませんでした。
今回バラしてみようと思ったのには、コピー機対策にハードウェア識別する何かチップ類が搭載されているのか、確認してみたかった為でした。しかし基板上にはいかにも!という怪しい部品は見当たらず。私の見る限りはそんな印象でした。