请选择 进入手机版 | 继续访问电脑版

『瀚思彼岸』» 智能家居技术论坛

 找回密码
 立即注册
查看: 4613|回复: 2

[求助] Redmi小爱音箱play 无法过uboot引导

[复制链接]

1

主题

1

帖子

34

积分

新手上路

Rank: 1

积分
34
金钱
33
HASS币
0
发表于 2020-9-15 01:48:12 | 显示全部楼层 |阅读模式
本帖最后由 Nenedesu 于 2020-9-15 01:57 编辑

趁着活动买了这个音箱,本想开放ssh却发现分区只读,按照写导出分区修改再写入的方法修改了/dev/nand0p3 => rootfs1 。
然后重启测试,发现修改无效,后来又提取/dev/nand0p5 => rootfs2 分区数据替换 rootfs1 ,依旧无效。
无意间在uboot引导时发现 rootfs2 验证通过的字样,就修改了环境变量强制启动 rootfs1。
事实证明确实成功了,然而这是最后一次成功引导进入系统,这次重启之后就始终无法通过检测。

TTL记录:
[252]HELLO! SBOOT is starting!
[255]sboot commit : 
[292]set pll start
[294]set pll end
[296]board init ok
[298]try to probe rtc region
[301]the chip id is 0x1
[303]the chip id is 0x1
[305]the chip id is 0x1
[308]the chip id is 0x1
[310]the chip id is 0x1
[312]chip id check OK
[314]DRAM BOOT DRIVE INFO: V0.18
[317]DRAM CLK = 528 MHz
[320]DRAM Type = 2 (2:DDR2,3:DDR3)
[323]DRAMC read ODT  off.
[325]DRAM ODT off.
[328]DRAM SIZE =64 M
[331]DRAM simple test OK.
[334]spinand UBOOT_START_BLK_NUM 8 UBOOT_LAST_BLK_NUM 40
[339]block from 8 to 40
[769]Check is correct.
[771]OLD version: 0.0
[773]NEW version: 0.0
[845]load rotpk hash
[907]load optee-key hash
[972]load kernel1-key hash
[1036]load kernel2-key hash
[1101]load rootfs1-key hash
[1166]load rootfs2-key hash
[1232]load u-boot-key hash
[1240]monitor entry=0x0
[1243]uboot entry=0x43000000
[1245]optee entry=0x41a00000
[1248]run out of boot0


U-Boot 2018.05 (Jan 19 2020 - 10:33:33 +0000) Allwinner Technology, Build: jenkins-Mico_l07a_ota_publish-78

CPU:   Allwinner Family
Model: sun8iw18
I2C:   ready
DRAM:  64 MiB
Relocation Offset is: 00f48000
secure enable bit: 1
CPU=1008 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz  MBus=264Mhz
initr_ledc
pwm_request: reg = 0x300a000. pwm = 4.
request pwm success, pwm = 4.
pwm_request: reg = 0x300a000. pwm = 3.
request pwm success, pwm = 3.
pwm_request: reg = 0x300a000. pwm = 2.
request pwm success, pwm = 2.
init led: r:0, g:30 b:255
pwm_led_init end
workmode = 0,storage type = 0
NAND_UbootInit
[01.446]NAND_UbootInit start
[01.449]NB1: enter NAND_LogicInit
Change PC_Power Mode Select to 1.8V
Change PC_Power Mode Select to 3.3V
[01.463] no nand found !
[01.465]nand_physic_init nand_build_nsi error
[01.469]nand_physic_init error -1
[01.472]SpiNandHwInit: Start Nand Hardware initializing .....
[01.478]uboot: nand version: 3 6058 20190419 18212019
[01.487]uboot nand_request_tx_dma: reqest genernal dma for nand success, 0x43fb5e1c
[01.494]uboot nand_request_tx_dma: reqest genernal dma for nand success, 0x43fb5e38
sclk0_reg_adr: 0x8300030e, src clock: 0xb8003100
sclk0_reg_adr: 0x8300020e, src clock: 0xb8003100
sclk0_reg_adr: 0x8300000b, src clock: 0xb8003100
[01.528]not burn nand partition table!
[01.531]NB1: nftl num: 1
[01.533]init nftl: 0
[01.766][ND] not find panic data, no need to recovery!
[01.771]NB1: NAND_LogicInit ok, result = 0x0
[01.775]NAND_UbootInit end: 0x0
sunxi flash init ok
Loading Environment from SUNXI_FLASH... OK
keybox_list not set in env, leave empty
the secure storage map is empty
In:    serial
Out:   serial
Err:   serial
gic: sec monitor mode
(weak)update dtb dram start
update dtb dram  end
[01.825]update dts
[01.827]update part info
[01.829]flag_try_sys1_failed=0
[01.832]flag_try_sys2_failed=0
[01.835]flag_ota_reboot     =0
[01.838]flag_last_success   =0
[01.840]os index:0
[01.843]to be run cmd=run setargs_first boot_first
Net:   Net Initialization Skipped
No ethernet found.
[01.854]probe MP tools from boot
delay time 0
weak:otg_phy_config
[01.863]usb init ok
[02.365]usb overtime
try to burn key
out of usb burn from boot: not need burn key
Hit any key to stop autoboot:  0 
partinfo: name kernel1, start 0x600, size 0x3000
out of memory
partition rootfs1 verify failed
bootm - boot application image from memory

Usage:
bootm [addr [arg ...]]
    - boot application image stored in memory
        passing arguments 'arg ...'; when booting a Linux kernel,
        'arg' can be the address of an initrd image
        When booting a Linux kernel which requires a flat device-tree
        a third argument is required which is the address of the
        device-tree blob. To boot that kernel without an initrd image,
        use a '-' for the second argument. If you do not pass a third
        a bd_info struct will be passed instead

Sub-commands to do part of the bootm sequence.  The sub-commands must be
issued in the order below (it's ok to not issue all sub-commands):
        start [addr [arg ...]]
        loados  - load OS image
        ramdisk - relocate initrd, set env initrd_start/initrd_end
        fdt     - relocate flat device tree
        cmdline - OS specific command line processing/setup
        bdt     - OS specific bd_t processing
        prep    - OS specific prep before relocation or go
        go      - start OS
=> printenv
boot_fastboot=fastboot
boot_first=sunxi_flash read 40007800 ${boot_partition_1};bootm 40007800
boot_from_partion=kernel1
boot_partition_1=kernel1
boot_partition_2=kernel2
boot_second=sunxi_flash read 40007800 ${boot_partition_2};bootm 40007800
bootargs=earlyprintk=sunxi-uart,0x05000000 console=ttyS0,115200 root=/dev/nand0p3 rootwait init=/sbin/init rdinit=/rdinit loglevel=1 partitions=env@nand0p1:kernel1@nand0p2:rootfs1@nand0p3:kernel2@nand0p4:rootfs2@nand0p5:misc@nand0p6:private@nand0p7:crashlog@nand0p8:UDISK@nand0p9 gpt=1 rotpk_status=1
bootcmd=run setargs_first boot_first
bootdelay=0
console=ttyS0,115200
earlyprintk=sunxi-uart,0x05000000
fastboot_key_value_max=0x8
fastboot_key_value_min=0x2
fdtcontroladdr=42b172a8
first_root=/dev/nand0p3
gpt=1
init=/sbin/init
loglevel=1
partitions=env@nand0p1:kernel1@nand0p2:rootfs1@nand0p3:kernel2@nand0p4:rootfs2@nand0p5:misc@nand0p6:private@nand0p7:crashlog@nand0p8:UDISK@nand0p9
rdinit=/rdinit
recovery_key_value_max=0x13
recovery_key_value_min=0x10
rotpk_status=1
second_root=/dev/nand0p5
set=environmeneabs the result of eval expressi delay execution for some time
setargs_first=setenv bootargs earlyprintk=${earlyprintk} console=${console} root=${first_root} rootwait init=${init} rdinit=${rdinit} loglevel=${loglevel} partitions=${partitions} gpt=${gpt} rotpk_status=${rotpk_status}
setargs_second=setenv bootargs earlyprintk=${earlyprintk} console=${console} root=${second_root} rootwait init=${init} rdinit=${rdinit} loglevel=${loglevel} partitions=${partitions} gpt=${gpt} rotpk_status=${rotpk_status}

Environment size: 1616/131068 bytes
=> 

无论是修改partitions中的映射关系还是强制执行 run setargs_second boot_second
无一例外都是:
out of memory
partition rootfs1 verify failed

除了内核起始地址不一样
kernel1是0x600
kernel2忘了
我目前手上有导出的rootfs1 , rootfs2分区img格式镜像,但我不知道是否能直接在uboot下写入,也不知道写入地址。或者是否有办法关闭引导镜像hash检测。


求助!..我该怎么做


回复

使用道具 举报

1

主题

12

帖子

52

积分

注册会员

Rank: 2

积分
52
金钱
40
HASS币
0
发表于 2020-9-15 11:36:00 | 显示全部楼层
学习了
回复

使用道具 举报

1

主题

5

帖子

153

积分

论坛技术达人

积分
153
金钱
143
HASS币
20
发表于 2021-6-16 05:15:01 | 显示全部楼层
@Nenedesu if you still have the original rootfs image file somewhere, you can check if the file contains any certificate data.
I'm also facing this similar issue with new Xiaomi Mi Speaker Gen 2 L15A, unfortunately i'm bricked

Since you have the uboot shell, at least I guess you can edit the content somehow, or just change the boot params.

DSP VERSION IS
DSP1 booting from 0x101000...
aes end!
out of memory
partition rootfs0 verify failed
[05.196]can not boot.
resetting ...
NAND_UbootExit
[05.451]NB1: NAND_LogicExit

# binwalk nand0p6

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 32240378 bytes, 2430 inodes, blocksize: 262144 bytes, created: 2021-04-28 06:34:34
32243716      0x1EC0004       Certificate in DER format (x509 v3), header length: 4, sequence length: 830

# dd if=nand0p6 skip=32243716 bs=1 count=1024 | openssl x509 -inform der  -noout -text
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

Archiver|手机版|小黑屋|Hassbian

GMT+8, 2024-3-29 06:14 , Processed in 0.049090 second(s), 24 queries .

Powered by Discuz! X3.4

Copyright © 2001-2021, Tencent Cloud.

快速回复 返回顶部 返回列表