记一次长虹IHO3000拆机学习
一、准备材料
1、软件，win7_32系统，Putty.exe （使用com19,波特率是115200）
2、硬件，PL2303 USB转TTL模块FT232线，长虹机顶盒（实际是广东地区电信4k机顶盒），PC电脑
二、接线和驱动。
先装PL2303 线的驱动，我在http://b.xiazaicc.com/down2/pl2303qudong_downcc.zip 下载了。
参考https://www.znds.com/forum.php?mod=viewthread&tid=1111235&fromguid=hot&mobile=2
我在机顶盒线路板上找到了 GND TXD RXD三个接口。红色的线是GND 绿色是Txd，白色是Rxd。
机顶盒还是关机状态，连接好刷机线电脑之后，打开计算机–>管理–>设备管理，看到串口是COM19
.打开电脑软件putty设置，Serial，COM19 ，115200
给机顶盒通电后，开机。
Bootrom start
Boot from eMMC
Starting fastboot ...
System startup
S
Reg Version: v1.1.0
Reg Time: 2016/9/18 14:40:15
Jump to DDR
Fastboot 3.3.0 (yangyumei@wangYS) (Aug 25 2017 - 09:40:39)
Fastboot: Version 3.3.0
Build Date: Aug 25 2017, 09:40:56
CPU: Hi3798Mv100
Boot Media: eMMC
DDR Size: 1GB
Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
MMC/SD controller initialization.
MMC/SD Card:
MID: 0x15
Read Block: 512 Bytes
Write Block: 512 Bytes
Chip Size: 7456M Bytes (High Capacity)
Name: "8GME4"
Chip Type: MMC
Version: 4.0
Speed: 52000000Hz
Bus Width: 8bit
Boot Addr: 0 Bytes
Boot Env on eMMC
Env Offset: 0x00100000
Env Size: 0x00010000
Env Range: 0x00010000
HI_OTP_LockIdWord,313: ID_WORD have already been locked
SDK Version: HiSTBAndroidV600R001C00CP0007_v2016022217
check remote recovery button begin
HI_UNF_IR_GetValue failed
get chipid =137980100
get chipType (HI3798MV100)
count=2
press the key!!
get key 0 2
otp mac not lock
mac:00:e4:00:13:30:90
Reserve Memory
Start Addr: 0x3FFFE000
Bound Addr: 0x8D45000
Free Addr: 0x3EB9D000
Alloc Block: Addr Size
0x3FBFD000 4194304
0x3F8FC000 3145728
0x3F8F9000 8192
0x3F878000 524288
0x3F843000 212992
0x3F742000 1048576
0x3F73E000 12288
0x3F3B9000 3686400
0x3F223000 1658880
0x3EE9E000 3686400
0x3EBA0000 3133440
0x3EB9D000 8192
Press Ctrl+C to stop autoboot
MMC read: dev # 0, block # 307200, count 20480 ... 20480 blocks read: OK
Found Initrd at 0x04000000 (Size 327506 Bytes), align at 16384 Bytes
## Booting kernel from Legacy Image at 01ffffc0 ...
Image Name: Linux-3.10.0_s40
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 7705848 Bytes = 7.3 MiB
Load Address: 02000000
Entry Point: 02000000
XIP Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.0_s40 (yangyumei@wangYS) (gcc version 4.4.1 (Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)) ) #1 SMP Fri Aug 25 10:06:20 CST 2017
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: bigfish
cma: CMA: reserved 436 MiB at 23400000
cma: CMA: reserved 4 MiB at 3fc00000
Memory policy: ECC disabled, Data cache writealloc
CPU: Hi3798Mv100
PERCPU: Embedded 8 pages/cpu @81a2a000 s12224 r8192 d12352 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 260096
Kernel command line: console=ttyAMA0,115200 blkdevparts=mmcblk0:1M(fastboot),1M(bootargs),10M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),20M(logo),20M(logobak),40M(fastplay),40M(fastplaybak),40M(kernel),20M(misc),8M(userapi),8M(hibdrv),8M(qbflag),800M(backup),1024M(system),3072M(userdata),800M(cache),50M(private),-(sdcard) initrd=0x4000000,0x4FF52 mem=1G mmz=ddr,0,0,435M
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 1024MB = 1024MB total
Memory: 563328k/563328k available, 485248k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xc0800000 - 0xff000000 (1000 MB)
lowmem : 0x80000000 - 0xc0000000 (1024 MB)
pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)
modules : 0x7f000000 - 0x7fe00000 ( 14 MB)
.text : 0x80008000 - 0x80ea272c (14954 kB)
.init : 0x80ea3000 - 0x80f11fc0 ( 444 kB)
.data : 0x80f12000 - 0x81042a08 (1219 kB)
.bss : 0x81042a08 - 0x81223b5c (1925 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:192
sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 178956ms
Console: colour dummy device 80x30
Calibrating delay loop... 1949.69 BogoMIPS (lpj=974848)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
ftrace: allocating 32262 entries in 95 pages
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x80af2d88 - 0x80af2de0
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
Brought up 4 CPUs
SMP: Total of 4 processors activated (7829.50 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
[308 ERROR-Invalid]:MCE_Init[1856]:ERR: get PDM Param
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0xf8b00000 (irq = 81) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0xf8006000 (irq = 82) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0xf8b02000 (irq = 83) is a PL011 rev2
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Initialized.
Bluetooth: Core ver 2.16
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Switching to clocksource timer3
NET: Registered protocol family 2
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 512 (order: 2, 16384 bytes)
UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Regi▒▒▒loop: module loaded
input: Hi keyboard as /devices/virtual/input/input0
input: Hi mouse as /devices/virtual/input/input1
input: qwerty as /devices/virtual/input/input2
Hi Android vinput driver init successful!
Found Nand Flash Controller V610.
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky
libphy: himii: probed
Up port phy at 0x01 is connect
libphy: PHY himii:1f not found
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
usbotg: usb otg driver registeredusbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver option
usbserial: USB Serial support registered for GSM modem (1-port)
dwc_otg: version 3.00a 10-AUG-2012
Core Release: 3.10a
Setting default values for core params
Using Buffer DMA mode
Dedicated Tx FIFOs mode
g_ffs: file system registered
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver uvcvideo
USB Video Class driver (1.1.1)
device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: [email protected]
mmc0: BKOPS_EN bit is not set
mmc0: new high speed DDR MMC card at address 0001
mmcblk0: mmc0:0001 8GME4R 7.28 GiB
mmcblk0boot0: mmc0:0001 8GME4R partition 1 4.00 MiB
mmcblk0boot1: mmc0:0001 8GME4R partition 2 4.00 MiB
mmcblk0: p1(fastboot) p2(bootargs) p3(recovery) p4(deviceinfo) p5(baseparam) p6(pqparam) p7(logo) p8(logobak) p9(fastplay) p10(fastplaybak) p11(kernel) p12(misc) p13(userapi) p14(hibdrv) p15(qbflag) p16(backup) p17(system) p18(userdata) p19(cache) p20(private) p21(sdcard)
mmcblk0boot1: unknown partition table
mmcblk0boot0: unknown partition table
hi_mci0: eMMC/MMC/SD Device NOT detected!
hidraw: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
zram: Created 1 device(s) ...
ashmem: initialized
logger: created 256K log 'log_main'
logger: created 256K log 'log_events'
logger: created 256K log 'log_radio'
logger: created 256K log 'log_system'
Mali: Mali device driver loaded
usbcore: registered new interface driver snd-usb-audio
oprofile: using timer interrupt.
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (15846 buckets, 63384 max)
ctnetlink v0.93: registering with nfnetlink.
NF_TPROXY: Transparent proxy support initialized, version 4.1.0
NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
xt_time: kernel timezone is -0000
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: Creating netns size=776 id=0
IPVS: ipvs loaded.
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
Bridge firewalling registered
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
8021q: 802.1Q VLAN Support v1.8
lib80211: common routines for IEEE802.11 drivers
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
Load hi_tde.ko success. (SDK_VERSION:[HiSTBAndroidV600R001C00CP0007_v2016022217] Build Time:[Aug 25 2017, 10:05:10])
Load hi_fb.ko success. (SDK_VERSION:[HiSTBAndroidV600R001C00CP0007_v2016022217] Build Time:[Aug 25 2017, 10:04:43])
Load hi_jpegdec.ko success. (SDK_VERSION:[HiSTBAndroidV600R001C00CP0007_v2016022217] Build Time:[Aug 25 2017, 10:04:49])
DieID is locked!
hisi-sndcard hisi-sndcard: aiao-hifi <-> hisi-i2s mapping ok
Load hi_png.ko success. (SDK_VERSION:[HiSTBAndroidV600R001C00CP0007_v2016022217] Build Time:[Aug 25 2017, 10:05:03])
Load hi_jpegenc.ko success. (SDK_VERSION:[HiSTBAndroidV600R001C00CP0007_v2016022217] Build Time:[Aug 25 2017, 10:04:50])
enter temperature_control_thread
ALSA device list:
#0: HISI-AIAO
Freeing unused kernel memory: 440K (80ea3000 - 80f11000)
init: /init.bigfish.rc: 103: ignored duplicate definition of service 'release_eth0'
init: /init.bigfish.rc: 108: ignored duplicate definition of service 'release_eth1'
init: not 512M version
init (1): /proc/1/oom_adj is deprecated, please use /proc/1/oom_score_adj instead.
init: /dev/hw_random not found
init: cannot open '/initlogo.rle'
EXT4-fs (mmcblk0p17): mounted filesystem with ordered data mode. Opts: (null)
EXT4-fs (mmcblk0p18): recovery complete
EXT4-fs (mmcblk0p18): mounted filesystem with ordered data mode. Opts: (null)
EXT4-fs (mmcblk0p19): warning: mounting fs with errors, running e2fsck is recommended
EXT4-fs (mmcblk0p19): recovery complete
EXT4-fs (mmcblk0p19): mounted filesystem with ordered data mode. Opts: (null)
EXT4-fs (mmcblk0p20): recovery complete
EXT4-fs (mmcblk0p20): mounted filesystem with ordered data mode. Opts: (null)
init: /dev/hw_random not found
healthd: No charger supplies found
init: cannot find '/system/bin/dbus-daemon', disabling 'dbus'
healthd: BatteryStatusPath not found
healthd: BatteryHealthPath not found
init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
healthd: BatteryPresentPath not found
healthd: BatteryCapacityPath not found
healthd: BatteryVoltagePath not found
init: cannot find '/system/bin/dtvserver', disabling 'dtvserver'
init: cannot find '/system/bin/hidns-sd', disabling 'hidns-sd'
init: cannot find '/system/bin/usb-driver', disabling 'usb-driver'
init: property 'sys.powerctl' doesn't exist while expanding '${sys.powerctl}'
init: powerctl: cannot expand '${sys.powerctl}'
init: property 'sys.sysctl.extra_free_kbytes' doesn't exist while expanding '${sys.sysctl.extra_free_kbytes}'
init: cannot expand '${sys.sysctl.extra_free_kbytes}' while writing to '/proc/sys/vm/extra_free_kbytes'
healthd: BatteryTemperaturePath not found
healthd: BatteryTechnologyPath not found
binder: 1399:1399 transaction failed 29189, size 0-0
root@OPENBASE_HI3798M:/ #
Welcome to HiYunOS
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 98, io mem 0xf9890000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
hiusb-ehci hiusb-ehci.1: HIUSB EHCI
hiusb-ehci hiusb-ehci.1: new USB bus registered, assigned bus number 2
hiusb-ehci hiusb-ehci.1: irq 94, io mem 0xf9930000
hiusb-ehci hiusb-ehci.1: USB 0.0 started, EHCI 1.00
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 3
hiusb-ohci hiusb-ohci.0: irq 99, io mem 0xf9880000
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 2 ports detected
hiusb-ohci hiusb-ohci.1: HIUSB OHCI
hiusb-ohci hiusb-ohci.1: new USB bus registered, assigned bus number 4
hiusb-ohci hiusb-ohci.1: irq 95, io mem 0xf9920000
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
rtk_btusb: RTKBT_RELEASE_NAME: 20170401_TV_ANDROID_4.4(Beta)
rtk_btusb: Realtek Bluetooth USB driver module init, version 4.1.4
rtk_btusb: Register usb char device interface for BT driver
usbcore: registered new interface driver rtk_btusb
usb 2-1: new high-speed USB device number 2 using hiusb-ehci
tntfs: module license 'Commercial. For support email [email protected].' taints kernel.
Disabling lock debugging due to kernel taint
Tuxera NTFS driver 3014.6.29 [Flags: R/W MODULE].
input: alitv-sensor as /devices/virtual/input/input3
input: alitv-mouse as /devices/virtual/input/input4
input: alitv-Vcontroller as /devices/virtual/input/input5
input: alitv-motion as /devices/virtual/input/input6
warning: `zygote' uses 32-bit capabilities (legacy support in use)
lowmemorykiller: lowmem_shrink: convert oom_adj to oom_score_adj:
lowmemorykiller: oom_adj 0 => oom_score_adj 0
lowmemorykiller: oom_adj 1 => oom_score_adj 58
lowmemorykiller: oom_adj 2 => oom_score_adj 117
lowmemorykiller: oom_adj 3 => oom_score_adj 176
lowmemorykiller: oom_adj 9 => oom_score_adj 529
lowmemorykiller: oom_adj 15 => oom_score_adj 1000
IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
EXT4-fs (mmcblk0p21): recovery complete
EXT4-fs (mmcblk0p21): mounted filesystem with ordered data mode. Opts: share
cfg80211: Calling CRDA to update world regulatory domain
RTL871X: module init start
RTL871X: rtl8188fu v4.3.23_17926.20160531_beta
RTL871X: build time: Aug 25 2017 10:12:35
RTL871X: hal_com_config_channel_plan chplan:0x20
RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=00:e4:00:12:f6:a1
RTL871X: rtw_ndev_init(p2p0) if2 mac_addr=02:e4:00:12:f6:a1
usbcore: registered new interface driver rtl8188fu
RTL871X: module init ret=0
IPv6: ADDRCONF(NETDEV_UP): p2p0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
rtk_btusb: btchr_open: BT usb char device is opening
rtk_btusb: btchr_open: Failed to get hci dev[NULL]
input: kw_mouse as /devices/virtual/input/input7
input: kw_keyboard0 as /devices/virtual/input/input8
rtk_btusb: btchr_open: BT usb char device is opening
rtk_btusb: btchr_open: Failed to get hci dev[NULL]
最后一直提示我没有接入hci高清接口设备，意思是没接电视。
到这里就差不多了，之后，再做刷机处理。
固件地址：http://cdn.tvapk.com/zndsjc/cm101s_hi3798m.zip
遥控器xml文件可以自己提取出来，进入system/etc下找到 cp 出来 然后替换回去即可
参考网址及文章：
https://www.znds.com/forum.php?mod=viewthread&tid=1111235&fromguid=hot&mobile=2