智能电视网

电脑版
提示:原网页已由神马搜索转码, 内容由www.znds.com提供.
跳转到指定楼层
楼主
发表于 2024-7-8 13:11|只看该作者|只看大图回帖奖励
最近有不少人问我家里的小米电视root需要做哪些准备工作？哪些是作为一个新手最需要准备的，今天就给大家做一个2024小米电视刷机详细教程。



一、小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

注意：这不是 root 电视的完整教程,，但是包含了进入电视系统底层的各种准备工作. 能够进入电视系统底层之后, 任何有 magisk 使用经验的人都可以轻松实现 root.

测试设备: 小米电视 A43 pro (L43MA-AP) (2023 年上市)

警告 (免责声明)：操作有风险, 包括但不限于数据丢失, 设备损坏, 失去保修等，所以大家需要谨慎刷机。

1.来源

本文使用的各种方法并非原创, 而是主要来自于以下几篇文章：
(ZNDS 智能电视网) 教程&攻略 2022新款小米电视（安卓6以上）硬核root教程（需要USB转TTL）
https://www.znds.com/tv-1228229-1-1.html

(ZNDS 智能电视网) 教程&攻略 小米电视硬核root教程（需要USB转TTL硬件工具）
https://www.znds.com/tv-1203308-1-1.html

2.启用adb并安装apk

本章所需硬件设备: 小米电视, 小米电视的遥控器, PC (台式机或笔记本), 本地局域网络 (有线以太网或无线 WIFI)。

2.1 正常开机, 先看一下系统信息

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

进入电视设置

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

关于: MIUI TV 版本: MiTV OS 2.8.2129 (稳定版)

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

设备信息: 屏幕参数 3840x2160 43英寸, 存储 内存 2GB 闪存 32GB, 无线连接 2.4GHz/5GHz 蓝牙, 操作系统 Android.

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

存储空间: 共 30536MB, 系统 4446MB.

2.2 在设置中的【关于】页面找到产品型号 (MiTV):
小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

选中 产品型号 然后连续多次点击遥控器上的 确认 按键, 即可进入 开发者模式.

2.3 在设置中的 帐号与安全 页面, 将 ADB调试 选项打开：

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

ADB 调试这个开关只有在上一步开启开发者模式后才会出现. 并且每次重启之后, 这个选项都会自动关闭

2.4 通过有线以太网或无线 wifi 将设备联网, 然后看一下设备的 IP 地址 (下图已打马)：

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

比如此处设备的 IP 地址是 192.168.33.121
注意, 只需要将设备连接至本地局域网, 能够通过 DHCP 获取 IP 地址即可, 无需连接互联网 (Internet).

2.5 在 PC (台式机或笔记本) 上安装 adb工具, 然后执行命令：
  1. > adb connect 192.168.33.121
  2. connected to 192.168.33.121:5555
  3. > adb devices
  4. List of devices attached
  5. 192.168.33.121:5555       device
复制代码

需要在电视上使用遥控器同意 adb 调试.

此时就成功通过 adb 连接到了电视！


2.6 在 PC 上使用 adb 安装 apk, 比如

  1. adb install aida64-v198.apk
复制代码
重复使用这个命令, 就可以安装多个应用

如果安装命令执行成功后, 没有显示出应用图标, 可以重启电视

3.开机进入recovery

本章所需硬件设备: 小米电视, 小米电视的遥控器

3.1 关机, 拔掉电源.

注意, 一定要拔掉电源, 仅仅关机是不够的.

3.2  (适用于 蓝牙遥控器)

同时按住遥控器上的 确认 和 返回 按键, 如图 (黄圈标记):

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程


按住遥控器按键不松手, 插电开机。进入recovery界面如图：

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

4.制作HDMI转 UART (TTL 5V) 调试线

本章所需硬件设备: HDMI 插头 (或 HDMI 线), USB 转 UART 模块 (推荐 CP2102), 杜邦线, 万用表 (可选), 剪刀、螺丝刀等小工具.

在淘宝等购买 HDMI 插头 (推荐 HDMI 免焊接插头, 方便接线), 以及 USB 转 UART 模块 (推荐 CP2102 型号), 照片如图:

小米电视root需要做哪些准备工作？2024小米电视刷机详细教程

按照下表接线：

HDMI 引脚
CP2102 模块
备注
14
+5V
电源
15
TXD
UART 发送
16
RXD
UART 接收
20
GND
接地

注意: 5V电源线必须连接, 如果不接则 UART 不会有输出.

接线后照片：


小米电视root需要做哪些准备工作？2024小米电视刷机详细教程


如果有万用表, 可以在接线之后测量一下是否连通。

5.开机进入uboot

本章所需硬件设备: 小米电视, 章节 (3) 制作的调试线, PC (台式机或笔记本)

注意: 这台设备的 UART 波特率为 921600 ! (之前使用 115200 一直是乱码)

5.1 将调试线的 USB 转 UART 模块插到 PC, 并打开 UART.

使用哪种操作系统, 以及串口软件都可以. 以下栗子只是多种可能之一

操作命令举例 (操作系统 ArchLinux)

  • 插上 CP2102 模块:

  1. > lsusb
  2. Bus 001 Device 006: ID 10c4:ea60 Silicon Labs CP210x UART Bridge
  3. > ls -l /dev/tty*
  4. crw-rw---- 1 root uucp 188,  0 12月26日 15:40 /dev/ttyUSB0
复制代码
此处 CP2102 USB 转 UART 模块出现为设备文件 /dev/ttyUSB0

  • 设置波特率为921600:
  1. > stty -F /dev/ttyUSB0 ispeed 921600 ospeed 921600
  2. > stty -F /dev/ttyUSB0 speed
  3. 921600
复制代码

  • 打开 UART：
  1. > cu -l /dev/ttyUSB0
  2. Connected.
复制代码

如果没有 cu 命令, 可以安装 uucp:
  1. > sudo pacman -S uucp
复制代码

5.2 将调试线的 HDMI 插头插到电视的 HDMI 1 插座, 如图:

正常开机状态下, 重启电视. 然后应该能看到 UART 输出的启动日志

  1. AOCPU unknown cmd=20
  2. [VRTC] xMboxSetRTC val=0x64373481
  3. T5:BL:b49668;ID:4D32583237340F0000250D01;FEAT:B0F875B4:280000;POC:F;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;
  4. aml log : uart_clk_enhance() need fine tune

  6. efuse adjust vddee vol,get efuse index value:0002
  7. use efuse adjust vddee voltage, set vol 0.84v
  8. bl2_stage_init 0x01

  10. L0:00001803
  11. L1:00000702
  12. L2:00008060
  13. L3:00000000
  14. SIP:0006c6a

  16. TE: 117954

  18. BL2 Aarch32 Built : 15:50:08, Mar 17 2023. t5 g2df8b51 - zhiguang.zhang@droid08-bj


  21. aml log : T5 efuse_get_sar_adc_ref() need fine tune
  22. Board ID = 1
  23. Set cpu clk to 24M
  24. Set clk81 to 24M
  25. CPU clk: 1800 MHz
  26. Set clk81 to 166.6M

  28. aml log : bl2_platform_setup() need fine tune
  29. eMMC boot [url=home.php?mod=space&uid=103582]@[/url] 0
  30. sw-hs 00000000
  31. s
  32. sw8 s
  33. storage init finish
  34. DDR debug 1  p_acs_set=fffc30f0,come here plat/t5/ddr/ddr.c ,207
  35. aml log : not USB BOOT...
  36. DDR_DRIVER_VERSION: AML_A_PHY_V_1_2; Built : 15:50:08, Mar 17 2023. t5 g2df8b51 - zhiguang.zhang@droid08-bj
  37. 00000000
  38. emmc switch 1 ok
  39. ddr saved addr:00016000
  40. Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffc4fbc, size: 0x00001000, part: 0
  41. 00000000
  42. emmc switch 0 ok
  43. fastboot data verify
  44. verify result: 0
  45. enable_fast_boot
  46. dram_type==DDR4
  47. config==Rank01_32bit_ch0
  48. DDR : DDR4 Rank01_32bit_ch0
  49. Set ddr clk to 1176 MHz
  50. DDR debug 1 dram_vref_reg_value=00000016 plat/t5/ddr/ddr_lib.c ,4844
  51. CS0 size: 1024MB
  52. CS1 size: 1024MB
  53. Total size: 2048MB @ 1176MHz
  54. DDR : 2048MB @1176MHz
  55. cs0 DataBus test pass
  56. cs1 DataBus test pass
  57. cs0 AddrBus test pass
  58. cs1 AddrBus test pass
  59. bdlr_step_size ps=397
  60. rpmb not init until< register.h> have been fixed
  61. Load FIP HDR from eMMC, src: 0x00014200, des: 0x00200000, size: 0x00004000, part: 0
  62. Load BL3X from eMMC, src: 0x00018200, des: 0x00204000, size: 0x00138000, part: 0

  64. boot BL31
  65. NOTICE:  BL31: v1.3(release):e2d6c4e91
  66. NOTICE:  BL31: Built : 15:39:27, May 20 2021
  67. BL31:tsensor calibration rev, buf1[1], buf1[0]: 0x2, 0x80, 0xc
  68. BL31:tsensor calibration: 0x8600000c
  69. tsensor reg: 0x20d4
  70. mhu init done-v2
  71. NOTICE:  BL31: T5 secure boot!
  72. NOTICE:  BL31: BL33 decompress pass
  73. Starting IANFO:   BL3-2: ATOS-V2.4.4-145-gf6c6ed9e2 #1 Wed Dec 16 12:45:54 2020 +0800 arm
  74. INFO:   BL3-2: Chip: T5 Rev: B (34:B - 10:11)
  75. INFO:   BL3-2: crypto engine DMA
  76. INFO:   BL3-2: secure time TEE
  77. INFO:   BL3-2: CONFIG_DEVICE_SECURE 0xb200000e
  78. OCPU FreeRTOS
  79. AOCPU image version='(no 6774b479c2e09162650601c4c33d8a1f194dd5f1 15:55:52 2023-04-04'
  80. [AOCPU]: mailbox init start
  81. reg idx=0 cmd=6 handler=100051da
  82. reg idx=1 cmd=7 handler=100051c4
  83. [AOCPU]: mailbox -v1 init end
  84. reg idx=2 cmd=9 handler=100057ca
  85. Starting timer ...
  86. reg idx=3 cmd=b4 handler=10002a4e
  87. reg idx=4 cmd=b6 handler=10002992
  88. reg idx=5 cmd=11 handler=100017b0
  89. reg idx=6 cmd=12 handler=100017e8
  90. reg idx=7 cmd=4 handler=100019b6
  91. reg idx=8 cmd=30 handler=100019a2
  92. reg idx=9 cmd=31 handler=100019b2
  93. Starting task scheduler ...
  94. protect cbus registers


  97. U-Boot 2015.01-g9fb9269-mulan_a-22 (Apr 04 2023 - 15:55:49), Build: jenkins-uboot_Mulan_A-22

  99. DRAM:  2 GiB
  100. Relocation Offset is: 76e45000
  101. mmu cfg end: 0x80000000
  102. mmu cfg end: 0x80000000
  103. spi_post_bind(spicc): req_seq = 0
  104. register usb cfg[0][1] = 0000000077f4dae8
  105. gpio: pin GPIOD_2 (gpio 2) value is 0
  106. gpio: pin GPIOD_3 (gpio 3) value is 1
  107. gpio: pin GPIOB_12 (gpio 48) value is 0
  108. gpio: pin GPIOB_13 (gpio 49) value is 0
  109. MMC:   aml_priv->desc_buf = 0x0000000073e35cd0
  110. aml_priv->desc_buf = 0x0000000073e38010
  111. SDIO Port B: 0, SDIO Port C: 1
  112. co-phase 0x3, tx-dly 0, clock 400000
  113. co-phase 0x3, tx-dly 0, clock 400000
  114. co-phase 0x3, tx-dly 0, clock 400000
  115. emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800
  116. emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800
  117. co-phase 0x3, tx-dly 0, clock 400000
  118. co-phase 0x3, tx-dly 0, clock 40000000
  119. init_part() 297: PART_TYPE_AML
  120. [mmc_init] mmc init success
  121. aml log : R2048 check pass!
  122.      Amlogic Multi-DTB tool
  123.      Multi DTB detected.
  124.      Multi DTB tool version: v2.
  125.      Support 2 DTBS.
  126. ddr size = 80000000
  127.      Found DTB for "t5_mulan_01_2g"
  128. start dts,buffer=0000000073e3a860,dt_addr=0000000073e3b060
  129. get_partition_from_dts() 80: ret 0
  130. parts: 19
  131. 00:     logo       0000000000800000 1
  132. 01:  recovery       0000000001800000 1
  133. 02:     misc       0000000000800000 1
  134. 03:     dtbo       0000000000800000 1
  135. 04:  cri_data       0000000000800000 11
  136. 05:     param       0000000001000000 2
  137. 06:     boot       0000000001000000 1
  138. set has_boot_slot = 0
  139. 07:     rsv       0000000001000000 1
  140. 08:  metadata       0000000001000000 1
  141. 09:   vbmeta       0000000000200000 1
  142. 10:     tee       0000000002000000 1
  143. 11:secure_recovery       0000000002000000 1
  144. 12:factorydata       0000000000a00000 11
  145. 13:   vendor       0000000020000000 1
  146. 14:     odm       0000000008000000 1
  147. 15:   system       0000000060000000 1
  148. 16:   product       0000000002000000 1
  149. 17:     cache       0000000020000000 2
  150. 18:     data       ffffffffffffffff 4
  151. init_part() 297: PART_TYPE_AML
  152. eMMC/TSD partition table have been checked OK!
  153. crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
  154. crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
  155. crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
  156. mmc env offset: 0x27400000
  157. aml log : internal sys error!
  158. reboot_mode=normal
  159. gpio: pin GPIOD_7 (gpio 7) value is 1
  160. [store]To run cmd[emmc dtb_read 0x1000000 0x40000]
  161. _verify_dtb_checksum()-3476: calc 21656022, store 21656022
  162. _verify_dtb_checksum()-3476: calc 21656022, store 21656022
  163. dtb_read()-3691: total valid 2
  164. update_old_dtb()-3672: do nothing
  165. aml log : R2048 check pass!
  166.      Amlogic Multi-DTB tool
  167.      Multi DTB detected.
  168.      Multi DTB tool version: v2.
  169.      Support 2 DTBS.
  170. ddr size = 80000000
  171.      Found DTB for "t5_mulan_01_2g"
  172. amlkey_init() enter!
  173. calc 62758a9f50c, store 62758a9f50c
  174. calc 62758a9f50c, store 62758a9f50c
  175. do nothing
  176. [EFUSE_MSG]keynum is 4
  177. co-phase 0x3, tx-dly 0, clock 40000000
  178. co-phase 0x3, tx-dly 0, clock 40000000
  179. co-phase 0x3, tx-dly 0, clock 400000
  180. emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800
  181. emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800
  182. co-phase 0x3, tx-dly 0, clock 400000
  183. co-phase 0x3, tx-dly 0, clock 40000000
  184. init_part() 297: PART_TYPE_AML
  185. [mmc_init] mmc init success
  186. switch to partitions #0, OK
  187. mmc1(part 0) is current device
  188. current model_name: dzvc_01_20
  189. mmc env offset: 0x27400000
  190. Writing to MMC(1)... done
  191. D/   model:   handle_lcd_phy, phy_lane_ctrl[0] is (0x37)

  193. D/   model:   handle_lcd_phy, phy_lane_ctrl[1] is (0x37)

  195. D/   model:   handle_lcd_phy, phy_lane_ctrl[2] is (0x37)

  197. D/   model:   handle_lcd_phy, phy_lane_ctrl[3] is (0x37)

  199. D/   model:   handle_lcd_phy, phy_lane_ctrl[4] is (0x37)

  201. D/   model:   handle_lcd_phy, phy_lane_ctrl[5] is (0x37)

  203. D/   model:   handle_lcd_phy, phy_lane_ctrl[6] is (0x37)

  205. D/   model:   handle_lcd_phy, phy_lane_ctrl[7] is (0x37)

  207. D/   model:   handle_lcd_phy, phy_lane_ctrl[8] is (0x37)

  209. D/   model:   handle_lcd_phy, phy_lane_ctrl[9] is (0x37)

  211. D/   model:   handle_lcd_phy, phy_lane_ctrl[10] is (0x37)

  213. D/   model:   handle_lcd_phy, phy_lane_ctrl[11] is (0x37)

  215. [KM]Error:f[keymanage_dts_get_key_device]L99:lcd_optical key name is not exist
  216. [KM]Error:f[_get_km_ops_by_name]L247:key lcd_optical not know device 5
  217. [KM]Error:f[key_unify_query_exist]L367:key[lcd_optical] not cfg in dts
  218. E/   UnifyKey:   checkUnifyKey, lcd_optical query exist error.

  220. E/   ini_io:   check_hex_data_have_header_valid, rd data len error (0x0, 0xffffffff)

  222. D/   model:   handle_panel_ini, check lcd_optical param data diff (0xffffffff), save new param.

  224. [KM]Error:f[keymanage_dts_get_key_device]L99:lcd_optical key name is not exist
  225. [KM]Error:f[_get_km_ops_by_name]L247:key lcd_optical not know device 5
  226. [KM]Error:f[key_unify_write]L278:key[lcd_optical] no cfg in dts
  227. vpu: clk_level in dts: 7
  228. vpu: vpu_power_on_new
  229. vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
  230. vpu: vpu_module_init_config
  231. vpp: vpp_init
  232. vpp: vpp osd1 matrix rgb2yuv..............
  233. vpp: vpp osd2 matrix rgb2yuv..............
  234. hdr_func 4, hdr_process_select 0x1
  235. hdr_func 1, hdr_process_select 0x1
  236. lcd: lcd_debug_print flag: 0
  237. lcd: detect mode: tv, key_valid: 1
  238. lcd: load lcd_config from unifykey
  239. lcd_phy_probe
  240. lcd: unifykey version: 0x0002
  241. lcd: unifykey version: 0x0002
  242. lcd: tcon: rsv_mem addr:0x2bc00000, size:0xc00000
  243. lcd: lcd_tcon_bin_path_update: init_load: 0
  244. lcd: tcon: load init data len: 6356, ver: 20221009
  245. lcd: lcd_tcon_bin_load
  246. E/   model:   handle_tcon_data_load, tcon_data[4] file name "/param/tcon_demura.bin" not exist.

  248. lcd extern: load config from unifykey
  249. lcd extern: add driver ext_default(0)
  250. lcd: lcd_extern_config_update_dynamic_size size:0x2b
  251. lcd: lcd_extern_config_update_dynamic_size size:0x0
  252. lcd: lcd_extern_config_update_dynamic_size size:0x0
  253. lcd extern: aml_lcd_extern_probe: index(0->0) ok
  254. lcd: load backlight_config from unifykey
  255. lcd: bl: unifykey version: 0x0001
  256. lcd: bl: pinctrl_version: 2
  257. lcd: bl: name: bl_pwm, method: 2
  258. lcd: bl: bl_level: 127
  259. lcd: bl: aml_bl_power_ctrl: 0
  260. aml log : internal sys error!
  261. s_version: U-Boot 2015.01-g9fb9269-mulan_a-22
  262. do_factorydata_read:258 Can't find out dcdc from factorydata.
  263. factorydata - Access the factorydata from Xiaomi Partition

  265. Usage:
  266. factorydata     argv:  
  267.    dump
  268.    read keyname
  269.    write keyname value
  270.    erase keyname

  272. Hit Enter or space or Ctrl+C key to stop autoboot -- :  0

  274. soc_family_id==0x00000034
  275. table_max=0000000c,p_ddr_base_add=77f4b9c0,chip_id=00000034
  276. table_index=00000000,p_ddr_base_add=77f4b9c0,(p_ddr_base->chip_id==00000028
  277. no find match chip id=0x00000034, ,G12A will use default value
  278. table_index=00000001,p_ddr_base_add=77f4ba10,(p_ddr_base->chip_id==00000029
  279. no find match chip id=0x00000034, ,G12B will use default value
  280. table_index=00000002,p_ddr_base_add=77f4ba60,(p_ddr_base->chip_id==0000002e
  281. no find match chip id=0x00000034, ,TL1 will use default value
  282. table_index=00000003,p_ddr_base_add=77f4bab0,(p_ddr_base->chip_id==0000002b
  283. no find match chip id=0x00000034, ,SM1 will use default value
  284. table_index=00000004,p_ddr_base_add=77f4bb00,(p_ddr_base->chip_id==0000002f
  285. no find match chip id=0x00000034, ,TM2 will use default value
  286. table_index=00000005,p_ddr_base_add=77f4bb50,(p_ddr_base->chip_id==0000002c
  287. no find match chip id=0x00000034, ,A1 will use default value
  288. table_index=00000006,p_ddr_base_add=77f4bba0,(p_ddr_base->chip_id==00000030
  289. no find match chip id=0x00000034, ,C1 will use default value
  290. table_index=00000007,p_ddr_base_add=77f4bbf0,(p_ddr_base->chip_id==00000033
  291. no find match chip id=0x00000034, ,C2 will use default value
  292. table_index=00000008,p_ddr_base_add=77f4bc40,(p_ddr_base->chip_id==00000032
  293. no find match chip id=0x00000034, ,SC2 will use default value
  294. table_index=00000009,p_ddr_base_add=77f4bc90,(p_ddr_base->chip_id==00000034
  295. find match chip id=0x00000034 ,T5
  296. uboot  auto fast boot check flash data is ok return
  297. Command: bcb uboot-command
  298. Start read misc partition datas!
  299. BCB hasn't any datas,exit!
  300. pll tsensor avg: 0x20da, u_efuse: 0xc
  301. temp1: 45
  302. device cool done
  303. [OSD]load fb addr from dts:/meson-fb
  304. [OSD]load fb addr from dts:/fb
  305. [OSD]set initrd_high: 0x2b400000
  306. [OSD]fb_addr for logo: 0x2b400000
  307. [OSD]load fb addr from dts:/meson-fb
  308. [OSD]load fb addr from dts:/fb
  309. [OSD]fb_addr for logo: 0x2b400000
  310. [OSD]VPP_OFIFO_SIZE:0xfff01fff
  311. [CANVAS]canvas init
  312. [CANVAS]addr=0x2b400000 width=3840, height=2160
  313. [OSD]osd_hw.free_dst_data: 0,3839,0,2159
  314. [OSD]osd1_update_disp_freescale_enable
  315. vpp: vpp_matrix_update: 0
  316. vpp: g12a/b post2(bit12) matrix: YUV limit -> RGB ..............
  317. lcd: enable: ST4251D02_1, p2p, 3840x2160@60. 0Hz
  318. lcd: tv driver init(ver 20221101): p2p
  319. lcd: reset tcon
  320. lcd: lcd_pll_wait_lock: pll_lock=1, wait_loop=1
  321. lcd: set pll spread spectrum: 15, 30000ppm
  322. lcd: set pll spread spectrum: freq=0, mode=0
  323. vpp: vpp_init_lcd_gamma_table
  324. [info]spicc_probe: amlogic,meson-g12a-spicc @00000000ffd13000
  325. [info]spicc_cs_gpio_init: cs_gpio[0]=22
  326. [info]spicc_cs_gpio_init: total (1) slaves
  327. SF: Detected XM25QH80B with page size 256 Bytes, erase size 4 KiB, total 1 MiB
  328. spi read test ok spi_read_test
  329. lcd: error: spi read test ok
  330. lcd: lcd_tcon_core_reg_set
  331. lcd: error: lcd_tcon_data_set: data index -1 is invalid
  332. lcd extern: lcd_extern_power_ctrl: ext_default(0): 1
  333. lcd: bl: set level: 127, last level: 0
  334. lcd: bl: aml_bl_power_ctrl: 1
  335. lcd: clear mute
  336. Start read misc partition datas!
  337. info->attemp_times = 0
  338. info->active_slot = 0
  339. info->slot_info[0].bootable = 1
  340. info->slot_info[0].online = 1
  341. info->slot_info[1].bootable = 0
  342. info->slot_info[1].online = 0
  343. info->attemp_times = 0
  344. attemp_times = 0
  345. active slot = 0
  346. [imgread]szTimeStamp[2023041122493711]
  347. [imgread]secureKernelImgSz=0x866000
  348. aml log : R~2048 check pass!
  349. aml log : R2048 check pass!
  350. aml log : R2048 check pass!
  351. avb2: 0
  352. ee_gate_off ...
  353. avb2: 0
  354. ## Booting Android Image at 0x01080000 ...
  355. Kernel command line: androidboot.dtbo_idx=0 buildvariant=user
  356. [store]Is good fdt check header, no need decrypt!
  357. active_slot is normal
  358. load dtb from 0x1000000 ......
  359.      Amlogic Multi-DTB tool
  360.      Single DTB detected
  361. find 1 dtbos
  362. dtbos to be applied: 0
  363. Apply dtbo 0
  364.    Loading Kernel Image(COMP_NONE) ... OK
  365.    kernel loaded at 0x01080000, end = 0x018b9000
  366. libfdt fdt_getprop(): FDT_ERR_NOTFOUND
  367.    Loading Device Tree to 0000000009fe7000, end 0000000009fff559 ... OK
  368. fdt_fixup_memory_banks, reg:0000000000000000

  370. Starting kernel ...

  372. uboot time: 3036492 us
  373. vmin:72 b2 6 0!
  374. [VRTC]: xMboxGetRTC val=0x64373481
  375. [cec_get_portinfo]: info=0x0
  376. AOCPU unknown cmd=b5
复制代码


如果看到类似上面的输出, 说明调试线及各种设置一切正常！

5.3 再次重启, 同时快速连续多次按回车键, 直到进入 uboot 命令行
  1. s_version: U-Boot 2015.01-g9fb9269-mulan_a-22
  2. do_factorydata_read:258 Can't find out dcdc from factorydata.
  3. factorydata - Access the factorydata from Xiaomi Partition

  5. Usage:
  6. factorydata     argv:  
  7.    dump
  8.    read keyname
  9.    write keyname value
  10.    erase keyname

  12. Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
  13. mulan#
  14. mulan#
  15. mulan#
  16. mulan#
复制代码
好了, 这就进入 uboot 命令行了 ! 我们先来查看一些信息

执行 printenv 命令:
  1. mulan#printenv
  2. DisableSelinux=permissive
  3. EnableSelinux=enforcing
  4. Irq_check_en=0
  5. Ramoops_io_dump=0
  6. Ramoops_io_en=0
  7. Ramoops_io_skip=1
  8. assm_mn=DZVCARF3B18TXNXX02321
  9. assm_sn=48276106100061401
  10. baudrate=115200
  11. bl_level=127
  12. boot_part=boot
  13. bootargs=init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 logo=osd0,loaded,0x3d800000 powermode=on fb_width=1920 fb_height=1080 display_bpp=16 outputmode=2160p60hz vout=2160p60hz,enable panel_type= lcd_ctrl=0x00001185 osd_reverse=n video_reverse=0 androidboot.firstboot=0 jtag=disable irq_check_en=0 ramoops_io_en=0 ramoops_io_dump=0 ramoops_io_skip=1 androidboot.mi.panel_size=43 bl_level=127 androidboot.mi.panel_vendor=csot androidboot.mi.panel_resolution=3840x2160 androidboot.panel_type=20 androidboot.reboot_mode=normal androidboot.platform_id=1180 androidboot.model_name=dzvc_01_20 androidboot.redmi=false androidboot.hwid=01 androidboot.serialno=48276106100061401 androidboot.mac=78:53:33:10:dd:a5 androidboot.assm_mn=DZVCARF3B18TXNXX02321 androidboot.did_key=00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O loglevel=0 androidboot.console_enable=0 androidboot.hardware=amlogic androidboot.bootloader=U-Boot 2015.01-g9fb9269-mulan_a-22 androidboot.build.expect.baseband=N/A androidboot.provider=amlogic androidboot.watchdog=enabled androidboot.mi.panel_buildin=true androidboot.mi.panel_3d_attribut=0 androidboot.mi.cpu=Cortex-A35 androidboot.mi.gpu=Mali-G31
  14. bootcmd=ddr_auto_fast_boot_check 6; run switch_bootmode
  15. bootdelay=1
  16. bootloader_version=U-Boot 2015.01-g9fb9269-mulan_a-22
  17. cec_ac_wakeup=1
  18. cec_fun=0x2F
  19. cmdline_keys=if factorydata read assm_sn; then setenv bootargs ${bootargs} androidboot.serialno=${assm_sn};else setenv bootargs ${bootargs} androidboot.serialno=1234567890;fi;if factorydata read mac; then setenv bootargs ${bootargs} androidboot.mac=${mac};fi;if factorydata read assm_mn; then setenv bootargs ${bootargs} androidboot.assm_mn=${assm_mn};fi;if factorydata read did_key; then setenv bootargs ${bootargs} androidboot.did_key=${did_key};fi;if factorydata read dcdc; then setenv bootargs ${bootargs} androidboot.dcdc=${dcdc};fi;if factorydata read log_level; then setenv bootargs ${bootargs} loglevel=${log_level};else setenv bootargs ${bootargs} quiet;fi;if factorydata read console_enable; then setenv bootargs ${bootargs} androidboot.console_enable=${console_enable};if itest ${console_enable} != 0; then setenv bootargs ${bootargs} ${console_userdebug};fi;else setenv bootargs ${bootargs} ${console_userdebug};fi;if factorydata read mitv_screen_on; then if test ${mitv_screen_on} = false; then factorydata write mitv_screen_on 'true';else factorydata write mitv_screen_on 'true';setenv mitv_screen_on true;fi;else factorydata write mitv_screen_on 'true';setenv mitv_screen_on true;fi;
  20. console_enable=0
  21. console_userdebug=console=ttyS0,921600 no_console_suspend earlycon=aml-uart,0xffd23000 printk.devkmsg=on
  22. did_key=00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O
  23. display_bpp=16
  24. display_color_bg=0
  25. display_color_fg=0xffff
  26. display_color_index=16
  27. display_height=1080
  28. display_layer=osd0
  29. display_width=1920
  30. dtb_mem_addr=0x1000000
  31. edid_14_dir=/odm/etc/tvconfig/hdmi/port_14.bin
  32. edid_20_dir=/odm/etc/tvconfig/hdmi/port_20.bin
  33. edid_select=0
  34. factory_reset_poweroff_protect=if test ${wipe_data} = failed; then echo wipe_data=${wipe_data};run update;fi;if test ${wipe_cache} = failed; then echo wipe_cache=${wipe_cache};run update;fi;
  35. fb_addr=0x3d800000
  36. fb_height=1080
  37. fb_width=1920
  38. fdt_high=0x20000000
  39. ffv_freeze=off
  40. ffv_wake=off
  41. firstboot=0
  42. frac_rate_policy=1
  43. fs_type=root=/dev/mmcblk0p20 ro rootwait skip_initramfs
  44. hdmimode=2160p60hz
  45. hdr_policy=1
  46. hwid=01
  47. init_display=osd open;osd clear;if test ${redmi} = true; then imgread pic logo redmi ${loadaddr};bmp display ${redmi_offset};else imgread pic logo bootup ${loadaddr};bmp display ${bootup_offset};fi;bmp scale;vout output ${outputmode}
  48. initargs=init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000
  49. irremote_update=if irkey 2500000 0xe31cfb04 0xb748fb04; then echo read irkey ok!; if itest ${irkey_value} == 0xe31cfb04; then run update;fi;fi;
  50. jtag=disable
  51. lcd_ctrl=0x00001185
  52. lcd_init_level=0
  53. led_brightness=0xff
  54. loadaddr=1080000
  55. lock=10101000
  56. log_level=0
  57. logic_addr=0x0
  58. mac=78:53:33:10:dd:a5
  59. mitv_screen_on=true
  60. model_edid=/odm/etc/tvconfig/hdmi/port_14.bin
  61. model_name=dzvc_01_20
  62. model_panel=/odm/panel/CSOT_ST4251D02-1/p2p_cspi_cvte.ini
  63. model_tcon=/odm/panel/CSOT_ST4251D02-1/p2p_cspi.bin
  64. model_tcon_bin_header=1
  65. model_tcon_ext_b0=null
  66. model_tcon_ext_b0_spi=/param/tcon_p_gamma.bin
  67. model_tcon_ext_b1=null
  68. model_tcon_ext_b1_spi=null
  69. model_tcon_ext_b2=null
  70. model_tcon_ext_b2_spi=null
  71. model_tcon_ext_b3=null
  72. model_tcon_ext_b3_spi=null
  73. osd_reverse=n
  74. otg_device=0
  75. outputmode=2160p60hz
  76. panel_name=ST4251D02_1
  77. panel_resolution=3840x2160
  78. panel_reverse=0
  79. panel_size=43
  80. panel_vendor=csot
  81. platform_id=1180
  82. port_map=4312
  83. powermode=on
  84. preboot=run storeargs;
  85. ramdump_enable=1
  86. reboot_mode=normal
  87. recovery_from_flash=if itest ${upgrade_step} == 3; then if ext4load mmc 1:2 ${dtb_mem_addr} /recovery/dtb.img; then echo cache dtb.img loaded; fi;if ext4load mmc 1:2 ${loadaddr} /recovery/recovery.img; then echo cache recovery.img loaded; bootm ${loadaddr}; fi;fi;if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then bootm ${loadaddr}; fi;
  88. recovery_from_udisk=if fatload usb 0 ${loadaddr} mulan.autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} mulan.recovery; then if fatload usb 0 ${dtb_mem_addr} mulan.dtb; then echo udisk dtb loaded; fi;bootm ${loadaddr};fi;
  89. recovery_fs_type=root=ramfs
  90. recovery_offset=0
  91. recovery_part=recovery
  92. redmi=false
  93. sdr2hdr=0
  94. secureboot=setenv bootargs ${bootargs} ${recovery_fs_type} otg_device=0;run init_display;get_valid_slot;if imgread kernel secure_recovery ${loadaddr} 0; then bootm ${loadaddr}; fi;reboot;
  95. stderr=serial
  96. stdin=serial
  97. stdout=serial
  98. storeargs=get_rebootmode;get_bootloaderversion;setenv bootargs ${initargs} logo=${display_layer},loaded,${fb_addr} powermode=${powermode} fb_width=${fb_width} fb_height=${fb_height} display_bpp=${display_bpp} outputmode=${outputmode} vout=${outputmode},enable panel_type=${panel_type} lcd_ctrl=${lcd_ctrl} osd_reverse=${osd_reverse} video_reverse=${video_reverse} androidboot.firstboot=${firstboot} jtag=${jtag} irq_check_en=${Irq_check_en} ramoops_io_en=${Ramoops_io_en} ramoops_io_dump=${Ramoops_io_dump} ramoops_io_skip=${Ramoops_io_skip};setenv bootargs ${bootargs} androidboot.mi.panel_size=${panel_size} bl_level=${bl_level} androidboot.mi.panel_vendor=${panel_vendor} androidboot.mi.panel_resolution=${panel_resolution} androidboot.panel_type=${tag};setenv bootargs ${bootargs} androidboot.reboot_mode=${reboot_mode} androidboot.platform_id=${platform_id} androidboot.model_name=${model_name} androidboot.redmi=${redmi} androidboot.hwid=${hwid};run cmdline_keys;setenv bootargs ${bootargs} androidboot.hardware=amlogic androidboot.bootloader=${bootloader_version} androidboot.build.expect.baseband=N/A;setenv bootargs ${bootargs} androidboot.provider=amlogic androidboot.watchdog=enabled androidboot.mi.panel_buildin=true androidboot.mi.panel_3d_attribut=0 androidboot.mi.cpu=Cortex-A35 androidboot.mi.gpu=Mali-G31;
  99. suspend=shutdown
  100. switch_bootmode=bcb uboot-command;run factory_reset_poweroff_protect;run upgrade_check;if test ${reboot_mode} = cold_boot; then if adcdetect; then echo GOT secure_recovery key from ADC;run secureboot;fi;if irdetect; then echo GOT recovery key from IR;run update;fi;if monitor_bt_cmdline; then echo GOT recovery key from BT;run update;fi;if factorydata read factory_power_mode; then echo Factory power mode: ${factory_power_mode};if test ${factory_power_mode} = secondary;then systemoff;fi;fi;else boot_cooling;if test ${reboot_mode} = fastboot; then fastboot;else if test ${reboot_mode} = update; then setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;run recovery_from_flash;else if test ${reboot_mode} = watchdog_reboot; then if test ${mitv_screen_on} = false; then monitor_bt_cmdline;echo watchdog enter system off;systemoff;fi;else if test ${reboot_mode} = kernel_panic; then if test ${mitv_screen_on} = false; then monitor_bt_cmdline;echo kernel_panic enter system off;systemoff;fi;else if test ${reboot_mode} = factory_reset; then setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;run recovery_from_flash;fi; fi; fi; fi; fi; fi;run init_display;setenv bootargs ${bootargs} ${fs_type} androidboot.selinux=${EnableSelinux} otg_device=${otg_device} androidboot.led_brightness=${led_brightness};get_valid_slot;if imgread kernel boot ${loadaddr}; then bootm ${loadaddr}; fi;run storeargs;setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run recovery_from_flash;
  101. tag=20
  102. update=setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
  103. upgrade_check=if itest ${upgrade_step} == 3; then echo upgrade_step=${upgrade_step}; run update;fi;
  104. upgrade_step=0
  105. video_reverse=0
  106. wipe_cache=successful
  107. wipe_data=successful

  109. Environment size: 9759/65532 bytes
  110. mulan#
复制代码

uboot 命令行帮助信息
  1. mulan#help
  2. ?     - alias for 'help'
  3. adcdetect- Detect ADC Key to start secure recovery system
  4. adnl   - use Amlogic DNL protocol
  5. aml_bcb - aml_bcb
  6. aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
  7. amlmmc  - AMLMMC sub system
  8. autoscr - run script from memory
  9. avb     - avb
  10. base   - print or set address offset
  11. bcb     - bcb
  12. bmp     - manipulate BMP image data
  13. boot_cooling- cpu temp-system
  14. booti   - boot arm64 Linux Image image from memory
  15. bootm   - boot application image from memory
  16. cec     - Amlogic cec
  17. clkmsr  - Amlogic measure clock
  18. cmp     - memory compare
  19. cp     - memory copy
  20. crc32   - checksum calculation
  21. dcache  - enable or disable data cache
  22. ddr_auto_fast_boot_check- ddr_fastboot_config cmd arg1 arg2 arg3...
  23. ddr_auto_scan_drv- ddr_test_cmd cmd arg1 arg2 arg3...
  24. ddr_auto_test_window- ddr_test_cmd cmd arg1 arg2 arg3...
  25. ddr_cpu_test- ddr_test_cmd cmd arg1 arg2 arg3...
  26. ddr_fast_boot- ddr_fastboot_config cmd arg1 arg2 arg3...
  27. ddr_g12_offset_data- ddr_g12_offset_data  1 0  0 0  1 3
  28. ddr_g12_override_data- ddr_g12_override_data  1 0  0 0  1 3
  29. ddr_spec_test- DDR test function
  30. ddr_test_cmd- ddr_test_cmd cmd arg1 arg2 arg3...
  31. ddr_test_copy- ddr_test_copy function
  32. ddrtest - DDR test function
  33. defenv_reserv- reserve some specified envs after defaulting env
  34. dspjtagreset- excute dsp jtag rest
  35. dtimg   - manipulate dtb/dtbo Android image
  36. echo   - echo args to console
  37. efuse   - efuse commands
  38. efuse_user- efuse user space read write ops
  39. emmc   - EMMC sub system
  40. env     - environment handling commands
  41. exit   - exit script
  42. ext4load- load binary file from a Ext4 filesystem
  43. ext4ls  - list files in a directory (default /)
  44. ext4size- determine a file's size
  45. factorydata- Access the factorydata from Xiaomi Partition
  46. false   - do nothing, unsuccessfully
  47. fastboot- use USB Fastboot protocol
  48. fatinfo - print information about filesystem
  49. fatload - load binary file from a dos filesystem
  50. fatls   - list files in a directory (default /)
  51. fatsize - determine a file's size
  52. fdt     - flattened device tree utility commands
  53. forceupdate- forceupdate
  54. g12_d2pll- g12_d2pll 1300  1 0x10 0
  55. get_avb_mode- get_avb_mode
  56. get_bootloaderversion- print bootloader version
  57. get_nearly_model- find the nearly model name
  58. get_rebootmode- get reboot mode
  59. get_system_as_root_mode- get_system_as_root_mode
  60. get_valid_slot- get_valid_slot
  61. go     - start application at address 'addr'
  62. gpio   - query and control gpio pins
  63. gpt     - GUID Partition Table
  64. guid   - GUID - generate Globally Unique Identifier based on random UUID
  65. hdmirx  - hdmirx init function

  67. help   - print command description/usage
  68. i2c     - I2C sub-system
  69. icache  - enable or disable instruction cache
  70. img_osd - image osd sub-system
  71. imgread - Read the image from internal flash with actual size
  72. ini     - parse an ini file in memory and merge the specified section into the env
  73. ini_model- parse ini file by env model_name
  74. init_vpp- Initial VPP Module
  75. irdetect- Detect IR Key to start recovery system
  76. itest   - return true/false on integer compare
  77. jtagoff - disable jtag
  78. jtagon  - enable jtag
  79. keyman  - Unify key ops interfaces based dts cfg
  80. keyunify- key unify sub-system
  81. lcd     - lcd sub-system
  82. loadb   - load binary file over serial line (kermit mode)
  83. loadx   - load binary file over serial line (xmodem mode)
  84. loady   - load binary file over serial line (ymodem mode)
  85. loop   - infinite loop on address range
  86. md     - memory display
  87. mm     - memory modify (auto-incrementing address)
  88. mmc     - MMC sub system
  89. mmcinfo - display MMC info
  90. model_list- list ini model name
  91. monitor_bt_cmdline- monitor_bt_cmdline
  92. mw     - memory write (fill)
  93. mwm     - mw mask function
  94. nm     - memory modify (constant address)
  95. open_scp_log- print SCP messgage
  96. osd     - osd sub-system
  97. panel_detect- Detect panel type from GPIO pin configuration
  98. printenv- print environment variables
  99. query   - SoC query commands
  100. rdext4pic- read logo bmp from ext4 part
  101. readMetadata- readMetadata
  102. read_temp- cpu temp-system
  103. reboot  - set reboot mode and reboot system
  104. reset   - Perform RESET of the CPU
  105. ringmsr - Amlogic measure ring
  106. rpmb_state- RPMB sub-system
  107. rsvmem  - reserve memory
  108. run     - run commands in an environment variable
  109. saradc  - saradc sub-system
  110. saradc_12bit- saradc sub-system
  111. saveenv - save environment variables to persistent storage
  112. sdc_burn- Burning with amlogic format package in sdmmc
  113. sdc_update- Burning a partition with image file in sdmmc card
  114. set_active_slot- set_active_slot
  115. set_trim_base- cpu temp-system
  116. set_usb_boot- set usb boot mode
  117. setenv  - set environment variables
  118. sf     - SPI flash sub-system
  119. showvar - print local hushshell variables
  120. sleep   - delay execution for some time
  121. spi_read_test- read spi

  123. sspi   - SPI utility command
  124. startdsp- load dspboot.bin from address
  125. store   - STORE sub-system
  126. systemoff- system off
  127. tee_log_level- update tee log level
  128. temp_triming- cpu temp-system
  129. test   - minimal test like /bin/sh
  130. testcache- cache test
  131. testsmp - test each CPU power on/off
  132. true   - do nothing, successfully
  133. unpackimg- un pack logo image into pictures
  134. usb     - USB sub-system
  135. usb_burn- Burning with amlogic format package in usb
  136. usb_update- Burning a partition with image file in usb host
  137. usbboot - boot from USB device
  138. uuid   - UUID - generate random Universally Unique Identifier
  139. version - print monitor, compiler and linker version
  140. viu_probe- enable viu probe in no secure chip
  141. vout   - VOUT sub-system
  142. vout2   - VOUT2 sub-system
  143. vpp     - vpp sub-system
  144. vpu     - vpu sub-system
  145. write_trim- cpu temp-system
  146. write_version- cpu temp-system
  147. mulan#
复制代码

分区信息
  1. mulan#mmcinfo
  2. Device: SDIO Port C
  3. Manufacturer ID: 9b
  4. OEM: 100
  5. Name: Y2P03
  6. Tran Speed: 52000000
  7. Rd Block Len: 512
  8. MMC version 5.1
  9. High Capacity: Yes
  10. Capacity: (0x747c00000 Bytes) 29.1 GiB
  11. mmc clock: 40000000
  12. Bus Width: 8-bit
  13. mulan#mmc part

  15. Partition Map for MMC device 1  --   Partition Type: AML

  17. Part   Start     Sect x Size Type  name
  18. 00 0 8192   512 U-Boot bootloader
  19. 01 73728 131072   512 U-Boot reserved
  20. 02 221184 1048576   512 U-Boot cache
  21. 03 1286144 16384   512 U-Boot env
  22. 04 1318912 16384   512 U-Boot logo
  23. 05 1351680 49152   512 U-Boot recovery
  24. 06 1417216 16384   512 U-Boot misc
  25. 07 1449984 16384   512 U-Boot dtbo
  26. 08 1482752 16384   512 U-Boot cri_data
  27. 09 1515520 32768   512 U-Boot param
  28. 10 1564672 32768   512 U-Boot boot
  29. 11 1613824 32768   512 U-Boot rsv
  30. 12 1662976 32768   512 U-Boot metadata
  31. 13 1712128 4096   512 U-Boot vbmeta
  32. 14 1732608 65536   512 U-Boot tee
  33. 15 1814528 65536   512 U-Boot secure_recovery
  34. 16 1896448 20480   512 U-Boot factorydata
  35. 17 1933312 1048576   512 U-Boot vendor
  36. 18 2998272 262144   512 U-Boot odm
  37. 19 3276800 3145728   512 U-Boot system
  38. 20 6438912 65536   512 U-Boot product
  39. 21 6520832 54550528   512 U-Boot data
  40. ** Partition 22 not found on device 1 **
  41. mulan#
复制代码

重启设备：
  1. mulan#reset
  2. resetting ...
复制代码

6. 进入 recovery 命令行
本章所需硬件设备: 小米电视, 小米电视的遥控器, 章节 (3) 制作的调试线, PC (台式机或笔记本)

6.1 按照章节 (5) 的方法进入 uboot 命令行

工厂数据
  1. mulan#factorydata
  2. factorydata - Access the factorydata from Xiaomi Partition

  4. Usage:
  5. factorydata     argv:  
  6.    dump
  7.    read keyname
  8.    write keyname value
  9.    erase keyname

  11. mulan#factorydata dump
  12. do_factorydata_dump : Got factory_power_mode[18] is [9]secondary
  13. do_factorydata_dump : Got console_enable[14] is [1]0
  14. do_factorydata_dump : Got pcba_mn[7] is [21]DZVCBCP3A12XXNXF00793
  15. do_factorydata_dump : Got pcba_sn[7] is [21]DZVCBCP3A12XXNXF00793
  16. do_factorydata_dump : Got assm_sn[7] is [17]48276106100061401
  17. do_factorydata_dump : Got mac[3] is [17]78:53:33:10:dd:a5
  18. do_factorydata_dump : Got did_key[7] is [39]00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O
  19. do_factorydata_dump : Got assm_mn[7] is [21]DZVCARF3B18TXNXX02321
  20. do_factorydata_dump : Got bt_rc_mac[9] is [18]F4:22:7A:63:AE:6D;
  21. do_factorydata_dump : Got log_level[9] is [1]0
  22. do_factorydata_dump : Got mitv_screen_on[14] is [4]true
  23. do_factorydata_dump : Got miot_beacon_pdu[15] is [38]0201060FFF8F030A10070F00ACE90FE18040E0
  24. mulan#
复制代码


6.2 启用 console:
  1. mulan#factorydata write console_enable 1
复制代码


6.3 按照章节 (3) 的方法进入 recovery
  1. Starting kernel ...

  3. uboot time: 10638025 us
  4. vmin:72 b2 6 0!
  5. [VRTC]: xMboxGetRTC val=0x0
  6. [cec_get_portinfo]: info=0x0
  7. AOCPU unknown cmd=b5
  8. #
复制代码
好了, 我们进入 recovery 命令行了 ! 看一下基本信息
  1. # type busybox
  2. busybox is /sbin/busybox
  3. # busybox id
  4. uid=0(root) gid=0(root) context=u:r:shell:s0
  5. # busybox getenforce
  6. Permissive
  7. # busybox uname -a
  8. Linux localhost 4.9.113 #1 SMP PREEMPT Tue Apr 11 22:37:53 CST 2023 armv7l GNU/Linux
  9. #
复制代码
好, 我们是 root, 并且 SELinux 处于关闭状态, 可以为所欲为了！

根目录：
  1. # busybox ls -al /
  2. total 2080
  3. __bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
  4. __bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
  5. __bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
  6. drwxr-xr-x   27 root     root         0 Jan  1 00:00 .
  7. drwxr-xr-x   27 root     root         0 Jan  1 00:00 ..
  8. dr-xr-xr-x   4 root     root         0 Jan  1 00:00 acct
  9. lrwxrwxrwx   1 root     root         11 Jan  1  1970 bin -> /system/bin
  10. drwxr-xr-x   2 root     root         0 Jan  1  1970 boot
  11. lrwxrwxrwx   1 root     root         50 Jan  1  1970 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
  12. drwxrwx---   6 system   cache       4096 Jan  1 00:03 cache
  13. lrwxrwxrwx   1 root     root         13 Jan  1  1970 charger -> /sbin/charger
  14. drwxr-xr-x   4 root     root         0 Jan  1  1970 config
  15. lrwxrwxrwx   1 root     root         17 Jan  1  1970 d -> /sys/kernel/debug
  16. drwxr-xr-x   2 root     root         0 Jan  1  1970 data
  17. lrwxrwxrwx   1 root     root         12 Jan  1  1970 default.prop -> prop.default
  18. drwxr-xr-x   12 root     root       5320 Jan  1 00:00 dev
  19. drwxr-xr-x   2 root     root         0 Jan  1  1970 etc
  20. -rwxr-x---   1 root     root     1500384 Jan  1  1970 init
  21. -rwxr-x---   1 root     root       2842 Jan  1  1970 init.rc
  22. -rwxr-x---   1 root     root       14915 Jan  1  1970 init.recovery.amlogic.rc
  23. drwxr-xr-x   2 root     root         0 Jan  1  1970 metadata
  24. drwxr-xr-x   3 root     system       60 Jan  1 00:00 mnt
  25. drwxr-xr-x   2 root     root         0 Jan  1  1970 odm
  26. drwxr-xr-x   2 root     root         0 Jan  1  1970 oem
  27. drwxr-xr-x   3 root     root         0 Jan  1  1970 persist
  28. -rw-r--r--   1 root     root       24584 Jan  1  1970 plat_file_contexts
  29. -rw-r--r--   1 root     root       28976 Jan  1  1970 plat_property_contexts
  30. dr-xr-xr-x  137 root     root         0 Jan  1  1970 proc
  31. drwxr-xr-x   2 root     root         0 Jan  1  1970 product
  32. -rw-r--r--   1 root     root       6676 Jan  1  1970 prop.default
  33. drwxr-xr-x   3 root     root         0 Jan  1  1970 res
  34. drwx------   2 root     root         0 Apr 11  2023 root
  35. drwxr-x---   2 root     root         0 Jan  1  1970 sbin
  36. drwxr-xr-x   2 root     root         0 Jan  1  1970 sdcard
  37. -rw-r--r--   1 root     root       472377 Jan  1  1970 sepolicy
  38. drwxr-xr-x   2 root     root         0 Jan  1 00:00 sideload
  39. drwxr-x--x   2 root     root         0 Jan  1  1970 storage
  40. dr-xr-xr-x   12 root     root         0 Jan  1 00:00 sys
  41. lrwxr-xr-x   1 root     root         19 Jan  1  1970 system -> /system_root/system
  42. drwxr-xr-x   2 root     root         0 Jan  1  1970 system_root
  43. drwxrwxr-x   2 root     shell         80 Jan  1 00:00 tmp
  44. drwx------   3 root     root       8192 Jan  1  1970 udisk
  45. -rw-r--r--   1 root     root       5272 Jan  1  1970 ueventd.rc
  46. drwxr-xr-x   5 root     root         0 Jan  1  1970 vendor
  47. -rw-r--r--   1 root     root       28202 Jan  1  1970 vendor_file_contexts
  48. -rw-r--r--   1 root     root       4146 Jan  1  1970 vendor_property_contexts
  49. #
复制代码

7.在 uboot 下备份各个系统分区

本章所需硬件设备: 小米电视, 章节 (3) 制作的调试线, PC (台式机或笔记本), U 盘 (1 个, 格式化为 FAT32 文件系统, 容量 8GB 以上)


8.在 recovery下备份各个系统分区

本章所需硬件设备: 小米电视, 小米电视的遥控器, 章节 (3) 制作的调试线, PC (台式机或笔记本), U 盘 (1 个, 格式化为 FAT32 文件系统, 容量 8GB 以上).

8.1 插入 U 盘 (FAT32 格式), 然后进入 recovery

看一下分区
  1. # busybox ls -al /dev/block
  2. total 0
  3. __bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
  4. __bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
  5. __bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
  6. drwxr-xr-x   3 root     root         820 Jan  1 00:00 .
  7. drwxr-xr-x   12 root     root       5320 Jan  1 00:00 ..
  8. brw-------   1 root     root     179,  11 Jan  1 00:00 boot
  9. brw-------   1 root     root     179,   1 Jan  1 00:00 bootloader
  10. brw-------   1 root     root     179,   3 Jan  1 00:00 cache
  11. brw-------   1 root     root     179,   9 Jan  1 00:00 cri_data
  12. brw-------   1 root     root     179,  22 Jan  1 00:00 data
  13. brw-------   1 root     root     179,   8 Jan  1 00:00 dtbo
  14. brw-------   1 root     root     179,   4 Jan  1 00:00 env
  15. brw-------   1 root     root     179,  17 Jan  1 00:00 factorydata
  16. brw-------   1 root     root     179,   5 Jan  1 00:00 logo
  17. brw-------   1 root     root       7,   0 Jan  1 00:00 loop0
  18. brw-------   1 root     root       7,   8 Jan  1 00:00 loop1
  19. brw-------   1 root     root       7,  16 Jan  1 00:00 loop2
  20. brw-------   1 root     root       7,  24 Jan  1 00:00 loop3
  21. brw-------   1 root     root       7,  32 Jan  1 00:00 loop4
  22. brw-------   1 root     root       7,  40 Jan  1 00:00 loop5
  23. brw-------   1 root     root       7,  48 Jan  1 00:00 loop6
  24. brw-------   1 root     root       7,  56 Jan  1 00:00 loop7
  25. brw-------   1 root     root     179,  13 Jan  1 00:00 metadata
  26. brw-------   1 root     root     179,   7 Jan  1 00:00 misc
  27. brw-------   1 root     root     179,   0 Jan  1 00:00 mmcblk0
  28. brw-------   1 root     root     179,  32 Jan  1 00:00 mmcblk0boot0
  29. brw-------   1 root     root     179,  64 Jan  1 00:00 mmcblk0boot1
  30. brw-------   1 root     root     179,  96 Jan  1 00:00 mmcblk0rpmb
  31. brw-------   1 root     root     31,   0 Jan  1 00:00 mtdblock0
  32. brw-------   1 root     root     179,  19 Jan  1 00:00 odm
  33. brw-------   1 root     root     179,  10 Jan  1 00:00 param
  34. drwxr-xr-x   5 root     root         100 Jan  1 00:00 platform
  35. brw-------   1 root     root     179,  21 Jan  1 00:00 product
  36. brw-------   1 root     root     179,   6 Jan  1 00:00 recovery
  37. brw-------   1 root     root     179,   2 Jan  1 00:00 reserved
  38. brw-------   1 root     root     179,  12 Jan  1 00:00 rsv
  39. brw-------   1 root     root       8,   0 Jan  1 00:00 sda
  40. brw-------   1 root     root       8,   1 Jan  1 00:00 sda1
  41. brw-------   1 root     root     179,  16 Jan  1 00:00 secure_recovery
  42. brw-------   1 root     root     179,  20 Jan  1 00:00 system
  43. brw-------   1 root     root     179,  15 Jan  1 00:00 tee
  44. brw-------   1 root     root     179,  14 Jan  1 00:00 vbmeta
  45. brw-------   1 root     root     179,  18 Jan  1 00:00 vendor
  46. brw-------   1 root     root     254,   0 Jan  1 00:00 zram0
复制代码

挂载状态
  1. # busybox mount
  2. rootfs on / type rootfs (rw,seclabel)
  3. tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
  4. devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000)
  5. proc on /proc type proc (rw,relatime)
  6. sysfs on /sys type sysfs (rw,seclabel,relatime)
  7. selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
  8. tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000)
  9. none on /acct type cgroup (rw,relatime,cpuacct)
  10. tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
  11. none on /config type configfs (rw,relatime)
  12. adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
  13. /dev/block/sda1 on /udisk type vfat (rw,nodev,noatime,nodiratime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
  14. /dev/block/cache on /cache type ext4 (rw,seclabel,nodev,noatime,nodiratime,discard,data=ordered)
  15. # busybox ls -al /udisk
  16. total 16
  17. __bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
  18. __bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
  19. __bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
  20. drwx------   3 root     root       8192 Jan  1  1970 .
  21. drwxr-xr-x   27 root     root         0 Jan  1 00:00 ..
  22. drwx------   2 root     root       8192 Dec 26  2023 202312
  23. #
复制代码
recovery 已经自动将 U盘挂载到了 /udisk 目录

8.2 备份除了 data (用户数据) 外的所有分区
  1. # busybox dd if=/dev/block/boot of=/udisk/boot.img
  2. 32768+0 records in
  3. 32768+0 records out
  4. 16777216 bytes (16.0MB) copied, 0.417935 seconds, 38.3MB/s
  5. #
复制代码
重复使用 dd 命令, 具体需要备份的分区可以参考以下列表:
  1. # busybox ls -al /udisk
  2. total 3072016
  3. __bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
  4. __bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
  5. __bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
  6. drwx------   3 root     root       8192 Jan  1 00:21 .
  7. drwxr-xr-x   27 root     root         0 Jan  1 00:00 ..
  8. drwx------   2 root     root       8192 Dec 26  2023 202312
  9. -rwx------   1 root     root     16777216 Jan  1 00:05 boot.img
  10. -rwx------   1 root     root     4194304 Jan  1 00:06 bootloader.img
  11. -rwx------   1 root     root     536870912 Jan  1 00:13 cache.img
  12. -rwx------   1 root     root     8388608 Jan  1 00:16 cri_data.img
  13. -rwx------   1 root     root     8388608 Jan  1 00:17 dtbo.img
  14. -rwx------   1 root     root     8388608 Jan  1 00:17 env.img
  15. -rwx------   1 root     root     10485760 Jan  1 00:18 factorydata.img
  16. -rwx------   1 root     root     8388608 Jan  1 00:20 logo.img
  17. -rwx------   1 root     root     16777216 Jan  1 00:18 metadata.img
  18. -rwx------   1 root     root     8388608 Jan  1 00:20 misc.img
  19. -rwx------   1 root     root     4194304 Jan  1 00:12 mmcblk0boot0.img
  20. -rwx------   1 root     root     4194304 Jan  1 00:12 mmcblk0boot1.img
  21. -rwx------   1 root     root     134217728 Jan  1 00:16 odm.img
  22. -rwx------   1 root     root     16777216 Jan  1 00:17 param.img
  23. -rwx------   1 root     root     33554432 Jan  1 00:19 product.img
  24. -rwx------   1 root     root     25165824 Jan  1 00:21 recovery.img
  25. -rwx------   1 root     root     67108864 Jan  1 00:21 reserved.img
  26. -rwx------   1 root     root     16777216 Jan  1 00:12 rsv.img
  27. -rwx------   1 root     root     33554432 Jan  1 00:16 secure_recovery.img
  28. -rwx------   1 root     root     1610612736 Jan  1 00:24 system.img
  29. -rwx------   1 root     root     33554432 Jan  1 00:17 tee.img
  30. -rwx------   1 root     root     2097152 Jan  1 00:18 vbmeta.img
  31. -rwx------   1 root     root     536870912 Jan  1 00:20 vendor.img
  32. #
复制代码

8.3 重启设备, 拔出 U 盘

然后把上述获得的分区镜像文件, 打包压缩一下, 找个安全的地方备份起来 (建议上传网盘), 以后对于救砖有重要用途

上述整个操作过程中获得的各种信息 (UART 输出), 也建议保存备用

以上就是我对”小米电视root需要做哪些准备工作？2024小米电视刷机详细教程”的内容分享，如果还有其他问题可以在评论区留言。



相关阅读：
海信电视如何精简系统？海信电视刷机简化系统操作教程

上一篇：智能电视怎么调出电视台频道？什么软件可以看电视直播？
下一篇：
什么软件看电视剧全部免费？2024免费看电视剧的软件合集
沙发
发表于 2024-7-8 13:13|只看该作者
来看看这个