Alcatel Pop35 Notes

Материал из Toshiba AC100 wiki
Версия от 13:21, 10 мая 2018; Zombah (обсуждение | вклад) (add partition map)
(разн.) ← Предыдущая версия | Текущая версия (разн.) | Следующая версия → (разн.)
Перейти к навигации Перейти к поиску

Stock kernel output

Here is dmesg collected with TCLFeedback util http://pastebin.com/yWe0CRCi


Vendor kernel source

Alcatel released GPL sources for device https://sourceforge.net/projects/alcatel/files/?source=navbar
Filename OT_5065_20160506.tar.xz


Parse vendor kernel source for device traces

Vendor sources contain configs for alot of devices.
Quick grep sources to find how vendor calls device, using some names from stock dmesg:

grep "PM8909 SMB1360 1GB MTP"
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi355/msm8909-mtp-smb1360.dts:      model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi37/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi384g/msm8909-mtp-smb1360.dts:     model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi445_tf/msm8909-mtp-smb1360.dts:   model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/qcom/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
grep "HX8379C TDT fwvga video"
arch/arm/boot/dts/pixi35/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi355/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:               qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi37/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi384g/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:              qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi445_tf/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:            qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
grep "TLi020A1-1956265-2000mAh"
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi: qcom,TCL-TLi020A1-1956265-2000mAh-VBMS-data {
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi:      qcom,battery-type = "TLi020A1-1956265-2000mAh";
grep -sni board-id arch/arm/boot/dts/pixi35/msm8909*.dts
arch/arm/boot/dts/pixi35/msm8909-1gb-cdp.dts:22:        qcom,board-id= <1 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skua.dts:20:   qcom,board-id= <0x1000b 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skuc.dts:18:   qcom,board-id= <0x1000b 0x8>, <0x11000b 0x8>, <0x21000b 0x8>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skue.dts:18:   qcom,board-id= <0x1000b 0x9>;
arch/arm/boot/dts/pixi35/msm8909-1gb-rcm.dts:23:        qcom,board-id= <21 0x0>;
arch/arm/boot/dts/pixi35/msm8909-512mb-mtp-smb1360.dts:25:      qcom,board-id= <8 0x103>;
arch/arm/boot/dts/pixi35/msm8909-cdp.dts:23:    qcom,board-id= <1 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:    qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-qhd-rcm.dts:23:     qcom,board-id= <21 0x1001>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-rcm.dts:22: qcom,board-id= <21 0x1>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-cdp.dts:24:     qcom,board-id= <1 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp.dts:23:     qcom,board-id= <8 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp-smb1360.dts:23:     qcom,board-id= <8 0x4>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-qhd-rcm.dts:24: qcom,board-id= <21 0x1101>;
arch/arm/boot/dts/pixi35/msm8909-qhd-cdp.dts:25:        qcom,board-id= <1 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qhd-rcm.dts:25:        qcom,board-id= <21 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skua.dts:19:       qcom,board-id= <0x1000b 0x100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skuc.dts:19:       qcom,board-id= <0x1000b 0x108>, <0x11000b 0x108>, <0x21000b 0x108>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skue.dts:19:       qcom,board-id= <0x1000b 0x109>;
arch/arm/boot/dts/pixi35/msm8909-rumi.dts:22:   qcom,board-id= <15 0>;
arch/arm/boot/dts/pixi35/msm8909-sim.dts:22:    qcom,board-id= <16 0>;


It seems Pop3 (5) name in vendor kernel sources is pixi35. This 3 seems to be our targets:

arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:            qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;

Bootloader

It is usual for qcom LK but with disabled fastboot mode.
Stock firmware 01002 contain Developer options->Enable OEM unlock switch, but
it has no visible effect.
4PDA recomends suspicious KingRoot v.4.0.0.233 app.
It realy installs su somehow, but also place alot of strange files into
all places of system including read-only recovery areas.

Need to check iovyroot or rowhammer exploits, maybe it is possible to use them.
UPDATE: iovyroot works fine on build 01002

Splash screen

Splash screen lives in /dev/block/bootdevice/by-name/splash partition.
Probably it is same as other qcom devices: bitmap of size 480x854, vertically rotated and 24bit RGB888
Konstat have info how to cook it for same msm8909 device here http://konstakang.com/devices/y560/stock-splash/

Input devices

cm-12.1 data

shell@pop35:/ $ getevent -p
add device 1: /dev/input/event8
  name:     "msm8909-snd-card Headset Jack"
  events:
    SW  (0005): 0002  0004  0006  000e  000f  0010 
  input props:
    <none>
add device 2: /dev/input/event7
  name:     "msm8909-snd-card Button Jack"
  events:
    KEY (0001): 0072  0073  00e2  0104  0246 
  input props:
    <none>
add device 3: /dev/input/event5
  name:     "qpnp_pon"
  events:
    KEY (0001): 0072  0074 
  input props:
    0004
add device 4: /dev/input/event2
  name:     "tsl27723-als"
  events:
    ABS (0003): 0028  : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
  input props:
    <none>
add device 5: /dev/input/event1
  name:     "tsl27723-ps"
  events:
    ABS (0003): 0019  : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
  input props:
    <none>
could not get driver version for /dev/input/mice, Not a typewriter
add device 6: /dev/input/event0
  name:     "ft5x06_ts"
  events:
    KEY (0001): 0074  014a 
    ABS (0003): 002f  : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
                0035  : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0
                0036  : value 0, min 0, max 854, fuzz 0, flat 0, resolution 0
                0039  : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
  input props:
    INPUT_PROP_DIRECT
add device 7: /dev/input/event6
  name:     "gpio-keys"
  events:
    KEY (0001): 0073 
  input props:
    <none>
add device 8: /dev/input/event4
  name:     "bma_interrupt"
  events:
    REL (0002): 0001  0002  0006  0007  0008  0009 
    ABS (0003): 0018  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
                0019  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
  input props:
    <none>
add device 9: /dev/input/event3
  name:     "bma2x2-accel"
  events:
    ABS (0003): 0000  : value 96, min -512, max 512, fuzz 0, flat 0, resolution 0
                0001  : value 16, min -512, max 512, fuzz 0, flat 0, resolution 0
                0002  : value 1008, min -512, max 512, fuzz 0, flat 0, resolution 0
                0028  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
  input props:
    <none>

Stock partition map

shell@Pop35:/dev/block/bootdevice/by-name $ ls -la
lrwxrwxrwx root     root              1970-01-01 05:01 DDR -> /dev/block/mmcblk0p19
lrwxrwxrwx root     root              1970-01-01 05:01 aboot -> /dev/block/mmcblk0p22
lrwxrwxrwx root     root              1970-01-01 05:01 abootbak -> /dev/block/mmcblk0p23
lrwxrwxrwx root     root              1970-01-01 05:01 boot -> /dev/block/mmcblk0p24
lrwxrwxrwx root     root              1970-01-01 05:01 cache -> /dev/block/mmcblk0p33
lrwxrwxrwx root     root              1970-01-01 05:01 config -> /dev/block/mmcblk0p38
lrwxrwxrwx root     root              1970-01-01 05:01 devinfo -> /dev/block/mmcblk0p36
lrwxrwxrwx root     root              1970-01-01 05:01 efsdata -> /dev/block/mmcblk0p18
lrwxrwxrwx root     root              1970-01-01 05:01 fota -> /dev/block/mmcblk0p32
lrwxrwxrwx root     root              1970-01-01 05:01 fsc -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              1970-01-01 05:01 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root     root              1970-01-01 05:01 hdcp -> /dev/block/mmcblk0p31
lrwxrwxrwx root     root              1970-01-01 05:01 hyp -> /dev/block/mmcblk0p13
lrwxrwxrwx root     root              1970-01-01 05:01 hypbak -> /dev/block/mmcblk0p14
lrwxrwxrwx root     root              1970-01-01 05:01 keystore -> /dev/block/mmcblk0p37
lrwxrwxrwx root     root              1970-01-01 05:01 misc -> /dev/block/mmcblk0p34
lrwxrwxrwx root     root              1970-01-01 05:01 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              1970-01-01 05:01 modemst1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root     root              1970-01-01 05:01 modemst2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root     root              1970-01-01 05:01 oem -> /dev/block/mmcblk0p39
lrwxrwxrwx root     root              1970-01-01 05:01 pad -> /dev/block/mmcblk0p12
lrwxrwxrwx root     root              1970-01-01 05:01 persist -> /dev/block/mmcblk0p27
lrwxrwxrwx root     root              1970-01-01 05:01 persistent -> /dev/block/mmcblk0p35
lrwxrwxrwx root     root              1970-01-01 05:01 recovery -> /dev/block/mmcblk0p25
lrwxrwxrwx root     root              1970-01-01 05:01 reserved -> /dev/block/mmcblk0p28
lrwxrwxrwx root     root              1970-01-01 05:01 rpm -> /dev/block/mmcblk0p8
lrwxrwxrwx root     root              1970-01-01 05:01 rpmbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root     root              1970-01-01 05:01 sbl1 -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              1970-01-01 05:01 sbl1bak -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              1970-01-01 05:01 sec -> /dev/block/mmcblk0p21
lrwxrwxrwx root     root              1970-01-01 05:01 simlock -> /dev/block/mmcblk0p17
lrwxrwxrwx root     root              1970-01-01 05:01 splash -> /dev/block/mmcblk0p29
lrwxrwxrwx root     root              1970-01-01 05:01 ssd -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              1970-01-01 05:01 system -> /dev/block/mmcblk0p26
lrwxrwxrwx root     root              1970-01-01 05:01 tctpersist -> /dev/block/mmcblk0p30
lrwxrwxrwx root     root              1970-01-01 05:01 traceability -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              1970-01-01 05:01 tunning -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              1970-01-01 05:01 tz -> /dev/block/mmcblk0p10
lrwxrwxrwx root     root              1970-01-01 05:01 tzbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root     root              1970-01-01 05:01 userdata -> /dev/block/mmcblk0p40