Google seems to be giving away these Nest Mini things so my son gave me one of his.  While waiting for the family to wake up on Christmas morning, I decided to tear into it and see what’s inside.  I’ve only been at it for a couple of hours so I don’t have much to report yet.

Once you get its pajamas off, you see a board with a cpu (Synaptics AS-370), some DDR,  and what looks like a TC58NVG2S0HBAI6 4Gb NAND.   On the back of the board is a Wifi/Bluetooth thing probably.  I haven’t taken the RF can off yet.

I usually start by soldering fly wires onto whatever test pads I can find and run the logic analyzer while I boot the thing in hopes I can find a serial port and maybe some I2C or SPI.

I found the serial port:

decompressing kernel image size 3866136…
kernel img addr 0x2080000, kern img len 12017672.
HACK! skip setup_android_kernel_param
mkbootimg bootargs: init=/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
Generated bootargs: init=/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
update opp V2 table to dtb
chip rev is A1
vl = 825000
vh = 900000
Got 2 value for vcpu vl and vh
chip rev is A1
Select PMIC chip sy8824b for Kernel !
Update silergy,sy8824!
Update cpu0-supply!
Delete silergy,sy20276 for Kernel !
Delete silergy,sy20278 for Kernel !
Delete silergy,sy20278 for Kernel !
Set dtb param for linux: ramdisk start 0xC3B0800, size 0x21EB30
chip rev is A1
chip rev is A1

Boot normal GTV image
Start kernel at 0x02080000, dtb at 0x0be00000

Looks like it’s running a modified Google TV image just like the old Chromecast.

The Serial console is at 1.8v and I don’t have a USB<->TTL serial converter at 1.8v right now so it looks like that’ll be the end of that for now.  I’m guessing it won’t let me interrupt the boot anyway and nothing appears after the kernel boots (see “console=” is blank).

Time to open presents.

After firmware update, the serial port is slightly more interesting:

bg6cd z1 erom: release id 0x5741fac, commit time Fri May 17 14:26:53 2019 -0700
bg6cd z1 hal : release id 0x8651a82, commit time Thu Jun 13 09:30:56 2019 -0700
disable pcie
ild-in module: release id 0xd32a267, commit time Fri May 17 14:29:05 2019 -0700
Load sysinit
Start ACPU
set vcore
DHL v0p90
hw_init done
custom table done
asking BCM to load miniloader.
try to verify flash miniloader
init syspll 400MHz
image2_init fitnsismh: erd,e lejaumspe iingd 0txo 85nbe5xt58 6i,ma cgoem.
m
it time Tue Jun 25 10:2’14’tz5_:l5o0a der2 0s1t9art .- 0b7oot0_0s
t
rap=0x00010003 (source=SPI Secure), boot_state=0x0
syspll 400MHz, 600MHz
set nna_sys at speed 600
set nna_core at speed 600
set avio_sys at speed 400
set nna_core at speed 600
set avio_sys at speed 400
set atb at speed 200
set perif_sys at speed 200
set apb_core at speed 100
set nfc_ecc at speed 200
set nfc_core at speed 200
pinmux 0 0 0 0
clk a1 a1
clk a1 121
ULT (byte[0:7]) = aba80aa2ac782956
NAND block size 0x40000, page size 0x1000, ecc_strength 0x30
— TZ_loader — bootloader
NAND block size 0x40000, page size 0x1000, ecc_strength 0x30
Read from block 1
nand read 1250000, 7f800, 800
lastK: 0x202c237, 0x202c237, 0xa1346d2
NAND block size 0x40000, page size 0x1000, ecc_strength 0x30
ret = 0
tz_loader: image4 verified.
tz_en image load verify success
ret = ffe00301
Load LastK: return value: 0xffffffff
ret = 0
tz_loader: image4 verified.
bl_en image read and verify success
feature:video/dolby_vision=true; feature:video/tcl_hdr=true;
tz_loader: start image4.
NOTICE: BL31: v1.3(debug):7bf8e6b
NOTICE: BL31: Built : 09:46:49, Jan 18 2019
INFO: ARM GICv2 driver initialized
INFO: BL31: Initializing runtime services
INFO: BL3-1: Initializing berlinspd
INFO: BL31: Initializing BL32
tz kernel starting… total 4 cpus, v3.2.0.9, May 29 2019 10:48:04@HEAD:cff79c5
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x4580000
INFO: SPSR = 0x3c9
Board: valens-b4

—— Entered Power_measurement_script() ——-
powerdown emmc
powerdown spi
powerdown pcie

—— End Power_measurement_script() ——
Pinmux reg 0: 0xf7ea0840 = 0x08003049
Pinmux reg 1: 0xf7ea0844 = 0x00009200
Pinmux reg 0: 0xf7ea0840 = 0x08003049
Pinmux reg 1: 0xf7ea0844 = 0x00009200
Pinmux reg 2: 0xf7ea0848 = 0x00000000
Pinmux reg 3: 0xf7ea084c = 0x00000000
Pinmux reg 4: 0xf7ea0850 = 0x00001200
Pinmux reg 5: 0xf7ea0854 = 0x00000000
Pinmux reg 6: 0xf7ea0858 = 0x09209249
PMIC detected with SY8824B
cpupll: 1400
PMIC: SY8824B selected!
chip rev is A1
leakage info 626.
set Vcpu from 850000uv to 825000uv
Clock configuration:
fts: v11 loaded from 0x00028000
chip is warm boot.
****************************************************************
Read and setup kernel Image
****************************************************************
DBGDBG k_buff_img[0]=0x0
DBGDBG k_buff_img[1]=0x0
DBGDBG k_buff_img[2]=0x0
DBGDBG k_buff_img[3]=0x20
decompressing kernel image size 3888875…
kernel img addr 0x2080000, kern img len 12085256.
HACK! skip setup_android_kernel_param
mkbootimg bootargs: init=/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
Generated bootargs: init=/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
update opp V2 table to dtb
chip rev is A1
vl = 825000
vh = 900000
Got 2 value for vcpu vl and vh
chip rev is A1
Select PMIC chip sy8824b for Kernel !
Update silergy,sy8824!
Update cpu0-supply!
Delete silergy,sy20276 for Kernel !
Delete silergy,sy20278 for Kernel !
Set dtb param for linux: ramdisk start 0xC3B6000, size 0x21EF1C
chip rev is A1
chip rev is A1

Boot normal GTV image
Start kernel at 0x02080000, dtb at 0x0be00000