🗂
Anbernic RG35XX Plusに UART をつける
Background
前回 Anbernic RG35XX Plus を分解した。
リバースエンジニアリングするにするにあたって UART でブート時のログなどを確認する必要があるので、今回は UART を増設する。
必要なもの
前回リストした分解に必要なものに加え、以下のものが必要。
- 半田付けの道具 (ハンダゴテ、はんだ、など)
- メスピンがついたケーブル
- 今回はブレッドボードなどに使うメスピンのケーブルを切って利用した。
- ただし、上記のケーブルは少し太い。すぐ買えるものは見つからなかったが、 AWG 28 くらいがちょうどいいという情報もある。
- ラジオペンチなど、ケースに穴を開けたりする道具
- 3.3v の UART ケーブル
- ここでは Raspberry Pi Debug Probe を使った。
分解については https://zenn.dev/articles/5fe8052eed0e88 参照
作業手順
まずは基板だけの状態まで分解する。
次に右上にある UART のスルーホールにケーブルをつけていく。今回は手元にあったオスピン <-> メスピンのケーブルを切って使うことにした (出す方をメスにした)。 長さは次に書くケーブルの出し方で決める。
ケーブルをどうやって出すかはいくつか選択肢がある。
１つ目はバッテリーの下に収納する方法。多少スペースが狭いのでプラスチックの部分をいくらか切断してもいいかもしれない。この方法だと UART を使う時はバッテリカバーを外してバッテリも出す必要がある。
２つ目は直接外に出す方法。最初は L 字のピンヘッダをスルーホールにはんだ付けする方法を考えたものの、音量ボタンが近すぎてケースに穴を開けることが困難だった。そのため少し下に行ってからケースに穴を開け、そこからケーブルを出すことにした。工作が得意であればもっとカッコよく接続インターフェイスを出すことも可能だろうと思う。一方でうっかり引っ張ってしまってハンダが剥がれるなどのリスクもある。
筆者は RG35XX Plus をゲーム機として使うよりはハックの対象として使うため、２つ目の選択肢を選んだ。
確認手順
確認は半田付けを行った直後に行う、ケースを閉じた後に正しく動作していないことがわかると面倒なため。 ここでは Ubuntu 24.04 から確認を行う。 Ubuntu 24.04 で Raspberry Pi Debug Probe を使う方法は Raspberry Pi に接続するときと同じなのでソフトウェアのセットアップについては https://zenn.dev/articles/f59121f414f3c1/ 参照。
Raspberry Pi Debug Probe の "U" 側にオスのピンが出ているケーブルを接続する。
オスピンを RG35XX から出ているケーブルに接続する。どのケーブルが GND/TX/RX なのかわかりやすいように書いておくと良い。
接続したら cu を使って UART を開く。 (ボーレートは 115200)
$ cu -s 115200 -l /dev/ttyACM0
この状態で RG35XX を起動したら起動ログが取得できる。
RG35XX Plus の起動ログ
[37]HELLO! BOOT0 is starting!
[40]BOOT0 commit : 749c1f9a-dirty
[43]set pll start
[46]periph0 has been enabled
[49]set pll end
[50][pmu]: bus read error
[53][pmu]: bus read error
[55]PMU: AXP2202
[64]vaild para:8 select dram para0
[67]board init ok
[69]rtc[1] value = 0x4801b400
[72]rtc[2] value = 0xf
[74]DRAM BOOT DRIVE INFO: V0.651
[77]the chip id is 0x6c00
[80]chip id check OK
[82]DRAM_VCC set to 1100 mv
[85][DST] Dram DST Loop1
[110]read_calibration error
[123]read_calibration error
[137]read_calibration error
[151]read_calibration error
[165]read_calibration error
[179]read_calibration error
[193]read_calibration error
[207]read_calibration error
[220]read_calibration error
[234]read_calibration error
[237]retraining final error
[254][AUTO DEBUG]32bit,1 ranks training success!
[414][DST] Lclk,0x00008888,Memtest Pass
[418][DST] Clk =672 MHz
[420][DST] R_2d
[1600][DST] R_2d_hv_D2:0x18-0x60,0x49(314mV),0
[1604][DST] R_2d_hv_D2:0x34~0x48,0x3e
[1608][DST] R_2d tpr6 = 0x3e808080
[1619][DST] R_1st
[1633][DST] DB0 R_1st:3,0~23,24,0x05
[1650][DST] DB1 R_1st:3,0~25,26,0x06
[1667][DST] DB2 R_1st:3,1~25,25,0x07
[1685][DST] DB3 R_1st:3,0~25,26,0x06
[1688][DST] R_1st Tpr12 = 0x06070605
[1692][DST] W_2st
[1738][DST] DB0 W_2st:0,17~39,23,0x1c
[1790][DST] DB1 W_2st:0,21~43,23,0x20
[1841][DST] DB2 W_2st:0,21~43,23,0x20
[1892][DST] DB3 W_2st:0,16~39,24,0x1b
[1896][DST] W_2st Tpr11 = 0x1b20201c
[1899][DST] R_2st
[1924][DST] DB0 R_2st:3,0~21,22,0x04
[1966][DST] DB1 R_2st:3,1~24,24,0x06
[2003][DST] DB2 R_2st:3,2~22,21,0x06
[2033][DST] DB3 R_2st:3,0~22,23,0x05
[2037][DST] R_2st Tpr12 = 0x05060604
[2201][DST] RV_C, VW:0x38-0x44, DW:120ps
[2298][DST] Dram DST Success
[2300]DRAM CLK =672 MHZ
[2303]DRAM Type =8 (3:DDR3,4:DDR4,7:LPDDR3,8:LPDDR4)
[2315]Actual DRAM SIZE =1024 M
[2318]DRAM SIZE =1024 MBytes, para1 = 30fa, para2 = 4000000, dram_tpr13 = 2006c61
[2332]DRAM simple test OK.
[2334]rtc standby flag is 0x0, super standby flag is 0x0
[2340]dram size =1024
[2343]card no is 0
[2345]sdcard 0 line count 4
[2347][mmc]: mmc driver ver 2021-10-12 13:56
[2352][mmc]: b mmc 0 bias 0
[2360][mmc]: Wrong media type 0x0
[2363][mmc]: ***Try SD card 0***
[2373][mmc]: HSSDR52/SDR25 4 bit
[2376][mmc]: 50000000 Hz
[2379][mmc]: 59638 MB
[2381][mmc]: ***SD/MMC 0 init OK!!!***
[2491]Loading boot-pkg Succeed(index=0).
[2495][mmc]: b mmc 0 bias 0
[2498]Entry_name = u-boot
[2508]Entry_name = monitor
[2512]Entry_name = dtbo
[2515]Entry_name = dtb
[2519]Jump to second Boot.
NOTICE: BL3-1: v1.0(debug):335ab35
NOTICE: BL3-1: Built : 14:03:48, 2023-12-07
NOTICE: BL3-1 commit: 8
NOTICE: cpuidle init version V2.0
ERROR: Error initializing runtime service tspd_fast
NOTICE: BL3-1: Preparing for EL3 exit to normal world
NOTICE: BL3-1: Next image address = 0x4a000000
�OTICE: BL3-1: Next image spsr = 0x1d3
U-Boot 2018.05 (Mar 15 2024 - 15:18:32 +0800) Allwinner Technology
[02.604]CPU: Allwinner Family
[02.607]Model: sun50iw9
I2C: ready
[02.611]DRAM: 1 GiB
[02.614]Relocation Offset is: 35eba000
[02.662]secure enable bit: 0
[02.664]pmu_axp152_probe pmic_bus_read fail
[02.668]pmu_axp1530_probe pmic_bus_read fail
[02.673]PMU: AXP2202
[02.676]BMU: AXP2202
[02.678][AXP2202] comm status : 0x0 = 0x18, 0x1 = 0xd0
[02.683][AXP2202] onoff status: 0x20 = 0x0, 0x21 = 0x0
AXP2202_IIN_LIM:38
AXP2202_IIN_LIM:38
[02.693][axp][err]:
b12_mode: 0
AXP2202_IIN_LIM:38
FDT ERROR:fdt_get_regulator_name:get property handle twi-supply error:FDT_ERR_INTERNAL
[02.727]battery_check pass:radio:15, vol:3534
[02.732]CPU=1008 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=400Mhz
[02.740]drv_disp_init
[02.774]__clk_enable: clk is null.
[02.780]drv_disp_init finish
[02.782]gic: sec monitor mode
[02.815]flash init start
[02.817]workmode = 0,storage type = 1
[02.820]MMC: 0
[02.822][mmc]: mmc driver ver uboot2018:2021-07-19 14:09:00
[02.828][mmc]: get sdc_type fail and use default host:tm1.
[02.839][mmc]: Using default timing para
[02.842][mmc]: SUNXI SDMMC Controller Version:0x40200
[02.860][mmc]: card_caps:0x3000000a
[02.863][mmc]: host_caps:0x3000003f
[02.867]sunxi flash init ok
[02.871]Loading Environment from SUNXI_FLASH... OK
[02.887]out of usb burn from boot: not need burn key
[02.892]boot_gui_init:start
partno erro : can't find partition Reserve0
[02.905]Get Reserve0 partition number fail!
tcon_de_attach:de=0,tcon=0===LCD_power_on:178
--allen--data0 = 128
[02.920]boot_gui_init:finish
[02.923]bmp_name=bootlogo.bmp
partno erro : can't find partition bootloader
===lcd_panel_uboot_fj035fhd05_v1_init:261 lcd_type = 1
921654 bytes read in 354 ms (2.5 MiB/s)
[03.300]Item0 (Map) magic is bad
[03.302]the secure storage item0 copy0 magic is bad
[03.307]Item0 (Map) magic is bad
[03.310]the secure storage item0 copy1 magic is bad
[03.315]Item0 (Map) magic is bad
[03.321]update dts
partno erro : can't find partition private
partno erro : can't find partition private
partno erro : can't find partition private
partno erro : can't find partition private
partno erro : can't find partition private
partno erro : can't find partition private
partno erro : can't find partition private
[03.392]update part info
start detect rtc domain...
rtc domain status: okay [0x90000000]
[03.408]update bootcmd
[03.410]No ethernet found.
Hit any key to stop autoboot: 0
===LCD_bl_open:197
[03.445]LCD open finish
Android's image name: sun50i_arm64
[04.325]Starting kernel ...
[04.328][mmc]: MMC Device 2 not found
[04.331][mmc]: mmc 2 not find, so not exit
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 4.9.170 (cc@cc-H81M-S1) (gcc version 5.3.1 20160412 (Linaro GCC 5.3-2016.05) ) #212 SMP PREEMPT Tue Mar 12 21:15:01 CST 2024
[ 0.000000] Boot CPU: AArch64 Processor [410fd034]
[ 0.000000] bootconsole [earlycon0] enabled
[ 0.000000] allen_boe_lcd=1, str=boe
[ 0.081601] BOOTEVENT: 81.596582: ON
[ 0.600980] axp2101-regulator axp2101-regulator.0: Setting DCDC frequency for unsupported AXP variant
[ 0.601063] axp2101-regulator axp2101-regulator.0: Error setting dcdc frequency: -22
[ �[ 0.966910] uart uart1: get regulator failed
[ 0.993204] [NAND][NE] Not found valid nand node on dts
[ 1.001142] sunxi-wlan soc@03000000:wlan: get gpio chip_en failed
[ 1.008247] sunxi-wlan soc@03000000:wlan: get gpio power_en failed
[ 1.116086] hci: request ohci0-controller gpio:272
[ 1.121846] hci: request ohci1-controller gpio:147
[ 1.351361] rtc-pcf8563 5-0051: low voltage detected, date/time is not reliable.
[ 1.362557] VE: get debugfs_mpp_root is NULL, please check mpp
[ 1.362557]
[ 1.370800] VE: sunxi ve debug register driver failed!
[ 1.370800]
[ 1.382180] axp2202_usb_power: axp2202-acin device is not configed, not use vbus-det
[ 1.382180]
[ 1.565520] mmc:failed to get gpios
[ 1.635890] sunxi-mmc sdc1: smc 2 p1 err, cmd 52, RTO !!
[ 1.642689] sunxi-mmc sdc1: smc 2 p1 err, cmd 52, RTO !!
[ 1.653027] sunxi-mmc sdc1: smc 2 p1 err, cmd 5, RTO !!
[ 1.659735] sunxi-mmc sdc1: smc 2 p1 err, cmd 5, RTO !!
[ 1.666448] sunxi-mmc sdc1: smc 2 p1 err, cmd 5, RTO !!
[ 1.673143] sunxi-mmc sdc1: smc 2 p1 err, cmd 5, RTO !!
[ 1.696081] ERROR: pinctrl_get for HDMI2.0 DDC fail
[ 1.719125] cpu cpu1: opp_list_debug_create_link: Failed to create link
[ 1.726701] cpu cpu1: _add_opp_dev: Failed to register opp debugfs (-12)
[ 1.734290] cpu cpu2: opp_list_debug_create_link: Failed to create link
[ 1.741731] cpu cpu2: _add_opp_dev: Failed to register opp debugfs (-12)
[ 1.749356] cpu cpu3: opp_list_debug_create_link: Failed to create link
[ 1.756817] cpu cpu3: _add_opp_dev: Failed to register opp debugfs (-12)
[ 1.768160] ---[allen] gpio_keys_polled_init: 754
[ 1.773653] ---[allen] gpio_keys_polled_probe: 565
[ 1.780036] ---[allen] gpio_keys_polled_probe: 694
[ 1.832195] rtc-pcf8563 5-0051: low voltage detected, date/time is not reliable.
[ 1.840485] rtc-pcf8563 5-0051: hctosys: unable to read the hardware clock
[ 1.849647] [sound 402][CODEC-HDMI sunxi_codec_dev_probe] register codec-hdmi success
[ 1.859385] [asoc_simple_probe, 432]
[ 1.865045] [asoc_simple_probe, 432]
[ 1.869624] [asoc_simple_probe, 432]
[ 1.873716] [asoc_simple_probe, 432]
[ 1.879068] [asoc_simple_probe, 432]
[/init]: getty is ttyS0
[/init]: RootDevice is "/dev/mmcblk0p5" , GPT_SUPPORT=1
[/init]: Try to load EMMC ...
e2fsck 1.42.12 (29-Aug-2014)
/dev/mmcblk0p5 has unsupported feature(s): metadata_csum
e2fsck: Get a newer version of e2fsck!
[ 2.379590] cgroup: cgroup2: unknown option "nsdelegate"
Welcome to Ubuntu 18.04.6 LTS!
[ OK ] Started Dispatch Password Requests to Console Directory Watch.
[ OK ] Reached target Remote File Systems.
[ OK ] Reached target Swap.
[ OK ] Created slice User and Session Slice.
[ OK ] Created slice System Slice.
[ OK ] Listening on Journal Socket (/dev/log).
[ OK ] Listening on Journal Socket.
Starting Load Kernel Modules...
[ 3.043867] [asoc_simple_probe, 432]
Starting Set the console keyboard layout...
[ OK ] Listening on udev Kernel Socket.
[ OK ] Listening on /dev/initctl Compatibility Named Pipe.
[ OK ] Reached target Slices.
[ OK ] Listening on Journal Audit Socket.
Mounting Kernel Debug File System...
Starting Journal Service...
[ OK ] Listening on udev Control Socket.
[ OK ] Created slice system-serial\x2dgetty.slice.
[ OK ] Started Forward Password Requests to Wall Directory Watch.
[ OK ] Reached target Paths.
[ OK ] Reached target Local Encrypted Volumes.
Starting udev Coldplug all Devices...
Starting Create Static Device Nodes in /dev...
Starting Remount Root and Kernel File Systems...
[ OK ] Started Journal Service.
[ OK ] Started Load Kernel Modules.
[ OK ] Started Set the console keyboard layout.
[ OK ] Mounted Kernel Debug File System.
[ OK ] Started Create Static Device Nodes in /dev.
[ OK ] Started Remount Root and Kernel File Systems.
Starting Load/Save Random Seed...
Starting udev Kernel Device Manager...
[ OK ] Reached target Local File Systems (Pre).
Mounting /tmp...
Starting Apply Kernel Variables...
Mounting FUSE Control File System...
Mounting Kernel Configuration File System...
Starting Flush Journal to Persistent Storage...
[ OK ] Started udev Kernel Device Manager.
[ OK ] Started udev Coldplug all Devices.
[ OK ] Started Load/Save Random Seed.
[ OK ] Mounted /tmp.
[ OK ] Started Apply Kernel Variables.
[ OK ] Mounted FUSE Control File System.
[ OK ] Mounted Kernel Configuration File System.
[ OK ] Reached target Local File Systems.
Starting Set console font and keymap...
Starting Raise network interfaces...
[ OK ] Started Flush Journal to Persistent Storage.
[ OK ] Started Set console font and keymap.
[ OK ] Found device /dev/ttyS0.
[ OK ] Reached target Sound Card.
Starting Create Volatile Files and Directories...
[FAILED] Failed to start Create Volatile Files and Directories.
See 'systemctl status systemd-tmpfiles-setup.service' for details.
[ OK ] Started Raise network interfaces.
[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.
Starting Update UTMP about System Boot/Shutdown...
Starting Network Name Resolution...
Starting Load/Save RF Kill Switch Status...
[ OK ] Started Load/Save RF Kill Switch Status.
[ OK ] Started Update UTMP about System Boot/Shutdown.
[ OK ] Reached target System Initialization.
[ OK ] Started Daily Cleanup of Temporary Directories.
[ OK ] Started Daily apt download activities.
[ OK ] Started Message of the Day.
[ OK ] Started Daily apt upgrade and clean activities.
[ OK ] Listening on D-Bus System Message Bus Socket.
[ OK ] Reached target Sockets.
[ OK ] Reached target Basic System.
[ OK ] Started D-Bus System Message Bus.
Starting Login Service...
[ OK ] Started Set the CPU Frequency Scaling governor.
[ OK ] Started Regular background program processing daemon.
Starting Restore /etc/resolv.conf i…fore the ppp link was shut down...
Starting Network Manager...
Starting Save/Restore Sound Card State...
Starting WPA supplicant...
Starting Modem Manager...
Starting launcher.service...
Starting Dispatcher daemon for systemd-networkd...
[ OK ] Started Discard unused blocks once a week.
[ OK ] Reached target Timers.
[ OK ] Started Network Name Resolution.
[ OK ] Started Restore /etc/resolv.conf if…before the ppp link was shut down.
[ OK ] Started launcher.service.
[ OK ] Started Save/Restore Sound Card State.
[ OK ] Started Login Service.
[ OK ] Started WPA supplicant.
[ OK ] Reached target Host and Network Name Lookups.
Starting Authorization Manager...
[ OK ] Started Modem Manager.
[ OK ] Started Authorization Manager.
Starting Hostname Service...
[ OK ] Started Dispatcher daemon for systemd-networkd.
[ OK ] Started Hostname Service.
Starting Network Manager Script Dispatcher Service...
[ OK ] Started Network Manager Script Dispatcher Service.
[ OK ] Stopped Network Manager.
Starting Network Manager...
[ OK ] Started Network Manager.
[ OK ] Reached target Network.
Starting Permit User Sessions...
Starting /etc/rc.local Compatibility...
[ OK ] Started Unattended Upgrades Shutdown.
[ OK ] Started Permit User Sessions.
Starting Set console scheme...
[ OK ] Started Set console scheme.
[ 8.374868] sunxi-mmc sdc1: smc 2 p1 err, cmd 52, RTO !!
[ 8.381686] sunxi-mmc sdc1: smc 2 p1 err, cmd 52, RTO !!
[ OK ] Created slice system-getty.slice.
Starting Bluetooth service...
[ 9.093691] [asoc_simple_probe, 432]
[ 9.123255] [asoc_simple_probe, 432]
[ OK ] Started /etc/rc.local Compatibility.
[ OK ] Started Serial Getty on ttyS0.
[ OK ] Started Getty on tty1.
[ OK ] Reached target Login Prompts.
[ OK ] Reached target Multi-User System.
[ OK ] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[ OK ] Started Bluetooth service.
[ OK ] Started Update UTMP about System Runlevel Changes.
Ubuntu 18.04.6 LTS deeplay ttyS0
deeplay login: [ 11.356002] Bluetooth: Non-link packet received in non-active state
Tips
RG35XX Plus はどうやら 5v の電源 (not PD) を必要とするようだ。分解して組み立て終わった後にバッテリ 0 % で起動できなかったが、 PC の USB ポートから充電したら復活できた。
Discussion