Alcatel Pop35 Notes
Перейти к навигации
Перейти к поиску
Stock kernel output
Here is dmesg collected with TCLFeedback util http://pastebin.com/yWe0CRCi
Vendor kernel source
Alcatel released GPL sources for device https://sourceforge.net/projects/alcatel/files/?source=navbar
Filename OT_5065_20160506.tar.xz
Parse vendor kernel source for device traces
Vendor sources contain configs for alot of devices.
Quick grep sources to find how vendor calls device, using some names from stock dmesg:
grep "PM8909 SMB1360 1GB MTP" arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP"; arch/arm/boot/dts/pixi355/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP"; arch/arm/boot/dts/pixi37/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP"; arch/arm/boot/dts/pixi384g/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP"; arch/arm/boot/dts/pixi445_tf/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP"; arch/arm/boot/dts/qcom/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
grep "HX8379C TDT fwvga video" arch/arm/boot/dts/pixi35/dsi-panel-hx8379c-tdt-fwvga-video.dtsi: qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel"; arch/arm/boot/dts/pixi355/dsi-panel-hx8379c-tdt-fwvga-video.dtsi: qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel"; arch/arm/boot/dts/pixi37/dsi-panel-hx8379c-tdt-fwvga-video.dtsi: qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel"; arch/arm/boot/dts/pixi384g/dsi-panel-hx8379c-tdt-fwvga-video.dtsi: qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel"; arch/arm/boot/dts/pixi445_tf/dsi-panel-hx8379c-tdt-fwvga-video.dtsi: qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
grep "TLi020A1-1956265-2000mAh"
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi: qcom,TCL-TLi020A1-1956265-2000mAh-VBMS-data {
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi: qcom,battery-type = "TLi020A1-1956265-2000mAh";
grep -sni board-id arch/arm/boot/dts/pixi35/msm8909*.dts arch/arm/boot/dts/pixi35/msm8909-1gb-cdp.dts:22: qcom,board-id= <1 0>; arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22: qcom,board-id= <8 0>; arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skua.dts:20: qcom,board-id= <0x1000b 0>; arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skuc.dts:18: qcom,board-id= <0x1000b 0x8>, <0x11000b 0x8>, <0x21000b 0x8>; arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skue.dts:18: qcom,board-id= <0x1000b 0x9>; arch/arm/boot/dts/pixi35/msm8909-1gb-rcm.dts:23: qcom,board-id= <21 0x0>; arch/arm/boot/dts/pixi35/msm8909-512mb-mtp-smb1360.dts:25: qcom,board-id= <8 0x103>; arch/arm/boot/dts/pixi35/msm8909-cdp.dts:23: qcom,board-id= <1 0x100>; arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23: qcom,board-id= <8 0x100>; arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24: qcom,board-id= <8 0x3>; arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-qhd-rcm.dts:23: qcom,board-id= <21 0x1001>; arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-rcm.dts:22: qcom,board-id= <21 0x1>; arch/arm/boot/dts/pixi35/msm8909-pm8916-cdp.dts:24: qcom,board-id= <1 0x2>; arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp.dts:23: qcom,board-id= <8 0x2>; arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp-smb1360.dts:23: qcom,board-id= <8 0x4>; arch/arm/boot/dts/pixi35/msm8909-pm8916-qhd-rcm.dts:24: qcom,board-id= <21 0x1101>; arch/arm/boot/dts/pixi35/msm8909-qhd-cdp.dts:25: qcom,board-id= <1 0x1100>; arch/arm/boot/dts/pixi35/msm8909-qhd-rcm.dts:25: qcom,board-id= <21 0x1100>; arch/arm/boot/dts/pixi35/msm8909-qrd-skua.dts:19: qcom,board-id= <0x1000b 0x100>; arch/arm/boot/dts/pixi35/msm8909-qrd-skuc.dts:19: qcom,board-id= <0x1000b 0x108>, <0x11000b 0x108>, <0x21000b 0x108>; arch/arm/boot/dts/pixi35/msm8909-qrd-skue.dts:19: qcom,board-id= <0x1000b 0x109>; arch/arm/boot/dts/pixi35/msm8909-rumi.dts:22: qcom,board-id= <15 0>; arch/arm/boot/dts/pixi35/msm8909-sim.dts:22: qcom,board-id= <16 0>;
It seems Pop3 (5) name in vendor kernel sources is pixi35.
This 3 seems to be our targets:
arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22: qcom,board-id= <8 0>; arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23: qcom,board-id= <8 0x100>; arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24: qcom,board-id= <8 0x3>;
Bootloader
It is usual for qcom LK but with disabled fastboot mode.
Stock firmware 01002 contain Developer options->Enable OEM unlock switch, but
it has no visible effect.
4PDA recomends suspicious KingRoot v.4.0.0.233 app.
It realy installs su somehow, but also place alot of strange files into
all places of system including read-only recovery areas.
Need to check iovyroot or rowhammer exploits, maybe it is possible to use them.
UPDATE: iovyroot works fine on build 01002
Splash screen
Splash screen lives in /dev/block/bootdevice/by-name/splash partition.
Probably it is same as other qcom devices: bitmap of size 480x854, vertically rotated and 24bit RGB888
Konstat have info how to cook it for same msm8909 device here http://konstakang.com/devices/y560/stock-splash/
Input devices
cm-12.1 data
shell@pop35:/ $ getevent -p
add device 1: /dev/input/event8
name: "msm8909-snd-card Headset Jack"
events:
SW (0005): 0002 0004 0006 000e 000f 0010
input props:
<none>
add device 2: /dev/input/event7
name: "msm8909-snd-card Button Jack"
events:
KEY (0001): 0072 0073 00e2 0104 0246
input props:
<none>
add device 3: /dev/input/event5
name: "qpnp_pon"
events:
KEY (0001): 0072 0074
input props:
0004
add device 4: /dev/input/event2
name: "tsl27723-als"
events:
ABS (0003): 0028 : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
input props:
<none>
add device 5: /dev/input/event1
name: "tsl27723-ps"
events:
ABS (0003): 0019 : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
input props:
<none>
could not get driver version for /dev/input/mice, Not a typewriter
add device 6: /dev/input/event0
name: "ft5x06_ts"
events:
KEY (0001): 0074 014a
ABS (0003): 002f : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
0035 : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0
0036 : value 0, min 0, max 854, fuzz 0, flat 0, resolution 0
0039 : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
input props:
INPUT_PROP_DIRECT
add device 7: /dev/input/event6
name: "gpio-keys"
events:
KEY (0001): 0073
input props:
<none>
add device 8: /dev/input/event4
name: "bma_interrupt"
events:
REL (0002): 0001 0002 0006 0007 0008 0009
ABS (0003): 0018 : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
0019 : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
input props:
<none>
add device 9: /dev/input/event3
name: "bma2x2-accel"
events:
ABS (0003): 0000 : value 96, min -512, max 512, fuzz 0, flat 0, resolution 0
0001 : value 16, min -512, max 512, fuzz 0, flat 0, resolution 0
0002 : value 1008, min -512, max 512, fuzz 0, flat 0, resolution 0
0028 : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
input props:
<none>
Stock partition map
shell@Pop35:/dev/block/bootdevice/by-name $ ls -la lrwxrwxrwx root root 1970-01-01 05:01 DDR -> /dev/block/mmcblk0p19 lrwxrwxrwx root root 1970-01-01 05:01 aboot -> /dev/block/mmcblk0p22 lrwxrwxrwx root root 1970-01-01 05:01 abootbak -> /dev/block/mmcblk0p23 lrwxrwxrwx root root 1970-01-01 05:01 boot -> /dev/block/mmcblk0p24 lrwxrwxrwx root root 1970-01-01 05:01 cache -> /dev/block/mmcblk0p33 lrwxrwxrwx root root 1970-01-01 05:01 config -> /dev/block/mmcblk0p38 lrwxrwxrwx root root 1970-01-01 05:01 devinfo -> /dev/block/mmcblk0p36 lrwxrwxrwx root root 1970-01-01 05:01 efsdata -> /dev/block/mmcblk0p18 lrwxrwxrwx root root 1970-01-01 05:01 fota -> /dev/block/mmcblk0p32 lrwxrwxrwx root root 1970-01-01 05:01 fsc -> /dev/block/mmcblk0p4 lrwxrwxrwx root root 1970-01-01 05:01 fsg -> /dev/block/mmcblk0p20 lrwxrwxrwx root root 1970-01-01 05:01 hdcp -> /dev/block/mmcblk0p31 lrwxrwxrwx root root 1970-01-01 05:01 hyp -> /dev/block/mmcblk0p13 lrwxrwxrwx root root 1970-01-01 05:01 hypbak -> /dev/block/mmcblk0p14 lrwxrwxrwx root root 1970-01-01 05:01 keystore -> /dev/block/mmcblk0p37 lrwxrwxrwx root root 1970-01-01 05:01 misc -> /dev/block/mmcblk0p34 lrwxrwxrwx root root 1970-01-01 05:01 modem -> /dev/block/mmcblk0p1 lrwxrwxrwx root root 1970-01-01 05:01 modemst1 -> /dev/block/mmcblk0p15 lrwxrwxrwx root root 1970-01-01 05:01 modemst2 -> /dev/block/mmcblk0p16 lrwxrwxrwx root root 1970-01-01 05:01 oem -> /dev/block/mmcblk0p39 lrwxrwxrwx root root 1970-01-01 05:01 pad -> /dev/block/mmcblk0p12 lrwxrwxrwx root root 1970-01-01 05:01 persist -> /dev/block/mmcblk0p27 lrwxrwxrwx root root 1970-01-01 05:01 persistent -> /dev/block/mmcblk0p35 lrwxrwxrwx root root 1970-01-01 05:01 recovery -> /dev/block/mmcblk0p25 lrwxrwxrwx root root 1970-01-01 05:01 reserved -> /dev/block/mmcblk0p28 lrwxrwxrwx root root 1970-01-01 05:01 rpm -> /dev/block/mmcblk0p8 lrwxrwxrwx root root 1970-01-01 05:01 rpmbak -> /dev/block/mmcblk0p9 lrwxrwxrwx root root 1970-01-01 05:01 sbl1 -> /dev/block/mmcblk0p6 lrwxrwxrwx root root 1970-01-01 05:01 sbl1bak -> /dev/block/mmcblk0p7 lrwxrwxrwx root root 1970-01-01 05:01 sec -> /dev/block/mmcblk0p21 lrwxrwxrwx root root 1970-01-01 05:01 simlock -> /dev/block/mmcblk0p17 lrwxrwxrwx root root 1970-01-01 05:01 splash -> /dev/block/mmcblk0p29 lrwxrwxrwx root root 1970-01-01 05:01 ssd -> /dev/block/mmcblk0p5 lrwxrwxrwx root root 1970-01-01 05:01 system -> /dev/block/mmcblk0p26 lrwxrwxrwx root root 1970-01-01 05:01 tctpersist -> /dev/block/mmcblk0p30 lrwxrwxrwx root root 1970-01-01 05:01 traceability -> /dev/block/mmcblk0p3 lrwxrwxrwx root root 1970-01-01 05:01 tunning -> /dev/block/mmcblk0p2 lrwxrwxrwx root root 1970-01-01 05:01 tz -> /dev/block/mmcblk0p10 lrwxrwxrwx root root 1970-01-01 05:01 tzbak -> /dev/block/mmcblk0p11 lrwxrwxrwx root root 1970-01-01 05:01 userdata -> /dev/block/mmcblk0p40