Skip to content

Rooting HiSilicon HiLinux based h264 encoder

Jump to bottom
Gerry Demaret edited this page Nov 13, 2017 · 5 revisions

Picture of the board: http://gerry.safehex.be/tmp/fosdem/board.jpg

  • JTAG is (probably) on J1

  • UART is available on J2 (TX, GND, RX)

  • seems to accept any rar archive as firmware update

  • You can connect via telnet as root, the password is 325523

    • interrupt u-boot
    • setenv bootargs ${bootargs} single
    • sf probe 0;sf read 0x82000000 0x100000 0x400000;bootm 0x82000000
    • /etc/passwd contains root:LpD8Dq4UZSS3s:0:0::/root:/bin/sh

  • Root file system is most probably on the flash chip. It's a https://www.digikey.com/product-detail/en/macronix/MX25L25635FMI-10G/1092-1149-ND/4211590 could always hook a soic-16 clip up to U25, dump the flash with any number of nice, cheap tools, extract the rootfs, and jtr etc/{password,shadow}

Processor       : ARMv7 Processor rev 1 (v7l)
BogoMIPS        : 1318.91
Features        : swp half thumb fastmult edsp 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x4
CPU part        : 0xc09
CPU revision    : 1

Hardware        : hi3520d
Revision        : 0000
Serial          : 0000000000000000

Linux version 3.0.8 (pub@BVT-SDK-SERVER3) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #1 Tue Apr 7 17:14:39 HKT 2015
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: hi3520d
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 24576
free_area_init_node: node 0, pgdat c05c66a4, node_mem_map c0622000
  Normal zone: 192 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 24384 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 24384
Kernel command line: mem=96M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:1M(boot),4M(kernel),27M(rootfs)
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 96MB = 96MB total
Memory: 91112k/91112k available, 7192k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc6800000 - 0xfe000000   ( 888 MB)
    lowmem  : 0xc0000000 - 0xc6000000   (  96 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc002b000   ( 140 kB)
      .text : 0xc002b000 - 0xc05a3000   (5600 kB)
      .data : 0xc05a4000 - 0xc05c6d20   ( 140 kB)
       .bss : 0xc05c6d44 - 0xc0621528   ( 362 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128 nr_irqs:128 128
sched_clock: 32 bits at 82MHz, resolution 12ns, wraps every 52060ms
Console: colour dummy device 80x30
Calibrating delay loop... 1318.91 BogoMIPS (lpj=6594560)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 40) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 41) is a PL011 rev2
bio: create slab  at 0
SCSI subsystem initialized
libata version 3.00 loaded.
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
L2cache cache controller enabled
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
SGI XFS with security attributes, large block/inode numbers, no debug enabled
msgmni has been set to 177
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
ahci: SSS flag set, parallel bus scan disabled
ahci ahci.0: AHCI 0001.0200 32 slots 2 ports 3 Gbps 0x3 impl platform mode
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp pio slum part ccc sxs boh 
scsi0 : ahci_platform
scsi1 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x100 irq 52
ata2: SATA max UDMA/133 mmio [mem 0x10080000-0x1008ffff] port 0x180 irq 52
Spi id table Version 1.22
Hisilicon Spi Flash Controller V350 Device Driver, Version 1.10
Spi(cs1) ID: 0xC2 0x20 0x19 0xC2 0x20 0x19
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1): 
Block:64KB 
Chip:32MB 
Name:"MX25L25635E/735E/635F"
spi size: 32MB
chip num: 1
3 cmdlinepart partitions found on MTD device hi_sfc
Creating 3 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000500000 : "kernel"
0x000000500000-0x000002000000 : "rootfs"
Fixed MDIO Bus: probed
ata1: SATA link down (SStatus 0 SControl 300)
himii: probed
ata2: SATA link down (SStatus 0 SControl 300)
Invalid HW-MAC Address: 00:00:00:00:00:00
Set Random MAC address: 72:33:91:D0:0D:63
usbmon: debugfs is not available
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 53, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 54, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Registering the dns_resolver key type
registered taskstats version 1
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 140K
udevd (529): /proc/529/oom_adj is deprecated, please use /proc/529/oom_score_adj instead.
Hisilicon Media Memory Zone Manager
hi3520D_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
load sys.ko ...OK!
Load tde.ko ...OK!
load venc.ko ...OK!
load group.ko ...OK!
load chnl.ko ...OK!
load h264e.ko ...OK!
load rc.ko ...OK!
load jpege.ko ...OK!
load viu.ko ...OK!
load vou.ko ....OK!
load vpss.ko ....OK!
load vda.ko ....OK!
load region.ko ....OK!
load vdec.ko ....OK
load vhd firmware.ko OK
load hdmi.ko ....OK!
Load hi_jpegdec.ko success.     (SDK_VERSION:[SDK_VERSION] Build Time:[Apr 15 2015, 20:12:57])
cx26828 driver version 1.0.104 loaded
cx26828 driver init successful !
RTL871X: rtl8188eu driver version=v4.1.8_9499.20131104
RTL871X: build time: Dec 29 2015 07:40:04
usbcore: registered new interface driver rtl8188eu
ADDRCONF(NETDEV_UP): eth0: link is not ready
PHY: himii:03 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Clone this wiki locally