{"id":205,"date":"2019-12-25T14:40:01","date_gmt":"2019-12-25T14:40:01","guid":{"rendered":"http:\/\/www.beer.org\/blog\/?p=205"},"modified":"2019-12-25T18:41:45","modified_gmt":"2019-12-25T18:41:45","slug":"google-nest-mini-teardown","status":"publish","type":"post","link":"https:\/\/www.beer.org\/blog\/index.php\/2019\/12\/25\/google-nest-mini-teardown\/","title":{"rendered":"Google Nest Mini teardown"},"content":{"rendered":"

Google seems to be giving away these Nest Mini things so my son gave me one of his.\u00a0 While waiting for the family to wake up on Christmas morning, I decided to tear into it and see what’s inside.\u00a0 I’ve only been at it for a couple of hours so I don’t have much to report yet.<\/p>\n

Once you get its pajamas off, you see a board with a cpu (Synaptics AS-370), some DDR,\u00a0 and what looks like a TC58NVG2S0HBAI6 4Gb NAND.\u00a0 \u00a0On the back of the board is a Wifi\/Bluetooth thing probably.\u00a0 I haven’t taken the RF can off yet.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

I usually start by soldering fly wires onto whatever test pads I can find and run the logic analyzer while I boot the thing in hopes I can find a serial port and maybe some I2C or SPI.<\/p>\n

\"\"<\/a><\/p>\n

I found the serial port:<\/p>\n

decompressing kernel image size 3866136…
\nkernel img addr 0x2080000, kern img len 12017672.
\nHACK! skip setup_android_kernel_param
\nmkbootimg bootargs: init=\/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
\nGenerated bootargs: init=\/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
\nupdate opp V2 table to dtb
\nchip rev is A1
\nvl = 825000
\nvh = 900000
\nGot 2 value for vcpu vl and vh
\nchip rev is A1
\nSelect PMIC chip sy8824b for Kernel !
\nUpdate silergy,sy8824!
\nUpdate cpu0-supply!
\nDelete silergy,sy20276 for Kernel !
\nDelete silergy,sy20278 for Kernel !
\nDelete silergy,sy20278 for Kernel !
\nSet dtb param for linux: ramdisk start 0xC3B0800, size 0x21EB30
\nchip rev is A1
\nchip rev is A1<\/p>\n

Boot normal GTV image
\nStart kernel at 0x02080000, dtb at 0x0be00000<\/p><\/blockquote>\n

Looks like it’s running a modified Google TV image just like the old Chromecast.<\/p>\n

The Serial console is at 1.8v and I don’t have a USB<->TTL serial converter at 1.8v right now so it looks like that’ll be the end of that for now.\u00a0 I’m guessing it won’t let me interrupt the boot anyway and nothing appears after the kernel boots (see “console=” is blank).<\/p>\n

Time to open presents.<\/p>\n

 <\/p>\n

After firmware update, the serial port is slightly more interesting:<\/p>\n

 <\/p>\n

bg6cd z1 erom: release id 0x5741fac, commit time Fri May 17 14:26:53 2019 -0700
\nbg6cd z1 hal : release id 0x8651a82, commit time Thu Jun 13 09:30:56 2019 -0700
\ndisable pcie
\nild-in module: release id 0xd32a267, commit time Fri May 17 14:29:05 2019 -0700
\nLoad sysinit
\nStart ACPU
\nset vcore
\nDHL v0p90
\nhw_init done
\ncustom table done
\nasking BCM to load miniloader.
\ntry to verify flash miniloader
\ninit syspll 400MHz
\nimage2_init fitnsismh: erd,e lejaumspe iingd 0txo 85nbe5xt58 6i,ma cgoem.
\nm
\nit time Tue Jun 25 10:2’14’tz5_:l5o0a der2 0s1t9art .- 0b7oot0_0s
\nt
\nrap=0x00010003 (source=SPI Secure), boot_state=0x0
\nsyspll 400MHz, 600MHz
\nset nna_sys at speed 600
\nset nna_core at speed 600
\nset avio_sys at speed 400
\nset nna_core at speed 600
\nset avio_sys at speed 400
\nset atb at speed 200
\nset perif_sys at speed 200
\nset apb_core at speed 100
\nset nfc_ecc at speed 200
\nset nfc_core at speed 200
\npinmux 0 0 0 0
\nclk a1 a1
\nclk a1 121
\nULT (byte[0:7]) = aba80aa2ac782956
\nNAND block size 0x40000, page size 0x1000, ecc_strength 0x30
\n— TZ_loader — bootloader
\nNAND block size 0x40000, page size 0x1000, ecc_strength 0x30
\nRead from block 1
\nnand read 1250000, 7f800, 800
\nlastK: 0x202c237, 0x202c237, 0xa1346d2
\nNAND block size 0x40000, page size 0x1000, ecc_strength 0x30
\nret = 0
\ntz_loader: image4 verified.
\ntz_en image load verify success
\nret = ffe00301
\nLoad LastK: return value: 0xffffffff
\nret = 0
\ntz_loader: image4 verified.
\nbl_en image read and verify success
\nfeature:video\/dolby_vision=true; feature:video\/tcl_hdr=true;
\ntz_loader: start image4.
\nNOTICE: BL31: v1.3(debug):7bf8e6b
\nNOTICE: BL31: Built : 09:46:49, Jan 18 2019
\nINFO: ARM GICv2 driver initialized
\nINFO: BL31: Initializing runtime services
\nINFO: BL3-1: Initializing berlinspd
\nINFO: BL31: Initializing BL32
\ntz kernel starting… total 4 cpus, v3.2.0.9, May 29 2019 10:48:04@HEAD:cff79c5
\nINFO: BL31: Preparing for EL3 exit to normal world
\nINFO: Entry point address = 0x4580000
\nINFO: SPSR = 0x3c9
\nBoard: valens-b4<\/p>\n

—— Entered Power_measurement_script() ——-
\npowerdown emmc
\npowerdown spi
\npowerdown pcie<\/p>\n

—— End Power_measurement_script() ——
\nPinmux reg 0: 0xf7ea0840 = 0x08003049
\nPinmux reg 1: 0xf7ea0844 = 0x00009200
\nPinmux reg 0: 0xf7ea0840 = 0x08003049
\nPinmux reg 1: 0xf7ea0844 = 0x00009200
\nPinmux reg 2: 0xf7ea0848 = 0x00000000
\nPinmux reg 3: 0xf7ea084c = 0x00000000
\nPinmux reg 4: 0xf7ea0850 = 0x00001200
\nPinmux reg 5: 0xf7ea0854 = 0x00000000
\nPinmux reg 6: 0xf7ea0858 = 0x09209249
\nPMIC detected with SY8824B
\ncpupll: 1400
\nPMIC: SY8824B selected!
\nchip rev is A1
\nleakage info 626.
\nset Vcpu from 850000uv to 825000uv
\nClock configuration:
\nfts: v11 loaded from 0x00028000
\nchip is warm boot.
\n****************************************************************
\nRead and setup kernel Image
\n****************************************************************
\nDBGDBG k_buff_img[0]=0x0
\nDBGDBG k_buff_img[1]=0x0
\nDBGDBG k_buff_img[2]=0x0
\nDBGDBG k_buff_img[3]=0x20
\ndecompressing kernel image size 3888875…
\nkernel img addr 0x2080000, kern img len 12085256.
\nHACK! skip setup_android_kernel_param
\nmkbootimg bootargs: init=\/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
\nGenerated bootargs: init=\/init console= mtdblock.ro_fspart=”rootfs” ro nooverlayfs
\nupdate opp V2 table to dtb
\nchip rev is A1
\nvl = 825000
\nvh = 900000
\nGot 2 value for vcpu vl and vh
\nchip rev is A1
\nSelect PMIC chip sy8824b for Kernel !
\nUpdate silergy,sy8824!
\nUpdate cpu0-supply!
\nDelete silergy,sy20276 for Kernel !
\nDelete silergy,sy20278 for Kernel !
\nSet dtb param for linux: ramdisk start 0xC3B6000, size 0x21EF1C
\nchip rev is A1
\nchip rev is A1<\/p>\n

Boot normal GTV image
\nStart kernel at 0x02080000, dtb at 0x0be00000<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Google seems to be giving away these Nest Mini things so my son gave me one of his.\u00a0 While waiting for the family to wake up on Christmas morning, I decided to tear into it and see what’s inside.\u00a0 I’ve only been at it for a couple of hours so I don’t have much to… Continue reading »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-205","post","type-post","status-publish","format-standard","hentry","category-tech-stuff"],"_links":{"self":[{"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/posts\/205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=205"}],"version-history":[{"count":4,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/posts\/205\/revisions"}],"predecessor-version":[{"id":212,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/posts\/205\/revisions\/212"}],"wp:attachment":[{"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.beer.org\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}