Huawei MT2 temperature control system design defects

Huawei MT2 temperature control system design defects

The Huawei MT2 mobile phone uses the [Generic Thermal sysfs driver] To monitor the temperature of the device. This driver provides a real-time monitoring function for the temperature of the device, when the specified Monitoring Device reaches the temperature setting value, the underlying process will execute the corresponding configuration parameters to reduce the temperature of the device. The general method is to limit the CPU or GPU frequency, this prevents the risk of phone overheating and damage certain parts.


The underlying daemon process of the Huawei MT2 mobile phone is/system/bin/thermalm.



MT2 vendor configuration file:

sampling 5000[systemh]sampling 1000thresholds 43 46 50 64thresholds_clr 41 44 47 58actions app+ucurrent+bcurrent+cpu+gpu ucurrent+bcurrent+cpu+gpu cpu+gpu shutdownaction_info 1+900+512+0+0 900+256+1196000+355000 798000+266000 30000

The preceding configuration file indicates that when the temperature reaches 43 ℃, the system daemon will execute the app + ucurrent + bcurrent + cpu + gpu action. The action parameter is 1 + 900 + 512 + 0 + 0. The first parameter: app action executes ACTION: APP-Setting APP mitigation to 1.



Android provides an Intent mechanism to assist in interaction and communication between applications or within applications. For example, when we start an application from the desktop, the Desktop Manager starts a third-party program by calling Intent. (Description: http://developer.android.com/reference/android/content/Intent.html)



The Desktop Manager calls a third-party application using similar code:

Intent intent = new Intent(Intent.ACTION_MAIN);intent.setComponent(new ComponentName(“com.tencent.mm”, “com.tencent.mm.ui.LauncherUI”));intent.setFlags(0×10200000);intent.addCategory(Intent.CATEGORY_LAUNCHER);startActivity(intent);

Common apps call other third-party applications in the same way, because Intent has different construction call methods and different call codes. If any APP on a Huawei MT2 mobile phone calls other third-party applications in Intent mode, such as Flags (0 × 10200000) not called by the System) when the temperature reaches 43 ℃, the system will execute ACTION: APP-Setting APP mitigation to 1. Due to the design defect of the Huawei temperature control daemon process, the called APP will crash and exit immediately.

For example, start to send an image to a friend and select the camera to take the image (this method is called using Intent ). After a normal mobile phone is working for a period of time, the temperature will reach 34 ℃-37 ℃. After the camera program is started, the temperature of the mobile phone will be increased due to image computation, as long as the phone temperature reaches 43 ℃, the system camera will crash. In other similar scenarios, when you choose to open it in a browser, the browser will crash if you call it in Intent mode. Any APP on the Huawei MT2 mobile phone can use the Intent mode for interaction (non-0 × 10200000 Flags), which causes the application to crash, theoretically, any type of mobile phone of Huawei uses the thermalm daemon and the configuration file is app + 1, which causes any application crash.

Test code:

Test mobile phone: Huawei MT2

ROM version: MT2-L05V100R001C17B111
 

Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE, null);startActivity(intent);

 

Use the above Code to call the built-in camera function of the system. It takes about 10-15 seconds to start the built-in camera (depending on the ambient temperature) in the left-right corner, the mobile phone temperature will be gradually increased to 43 ℃ due to image processing operations. Then, the system temperature daemon will crash the system camera due to the execution of the design defect mitigation function.



[Note: Other Huawei mobile phones are not tested. If the same configuration file is used, the problem may be the same.]