Database Develop

mods please close thread

closed

How to compile TWRP recovery?
I followed the guide here http://rootzwiki.com/topic/23903-how-to-compile-twrp-from-source/
To summarize...
1. Install Linux
2. Set up CM10 build environment - this is sssssooooo easy and there are loads of guides available with just a simple google search.
3. Repo sync
4. Build standard cm10 from source
5. Delete the contents of the ~/android/system/bootable/recovery and replace with https://github.com/TeamWin/Team-Win-Recovery-Project/ - i just clicked on the download zip button on the top left and unzipped into the folder but am sure there is a proper way of doing this... zip clone???
6. gedit ~/android/system/device/samsung/galaxys2-common/recovery.rc and add: export LD_LIBRARY_PATH .:/sbin
7. gedit ~/android/system/device/samsung/n7000/BoardConfig.mk and add the following to the bottom of the file
#twrp
DEVICE_RESOLUTION := 800x1280
8. cd ~/android/system
9. make -j3 bootimage (if you have a quad core processor make -j5 bootimage)
10. you can find your boot.img at ~/android/system/out/target/product/n7000
11. Copy to SDCARD and flash with mobile odin
12. Done!!!!!

good work. appreciate the effort you have put in.
looking into it now.

Finally here, good work. Will try it as i'm already using TWRP in my N7.
Enviat des d'es meu Nexus 7 amb so Tapatalk2

im using TWRP to flash rom for N8013 and work great.Thanks

nice to see u
subscribed.

You Should pm entropy
Sent from my GT-N7000 using Tapatalk 2

I have sent him a PM
Sent from my GT-N7000 using XDA Premium HD app

timstanley1985 said:
Team Win Recovery Project 2.3 for Galaxy Note (CM10 only)
If you do not know what TWRP is, click here first...... now you know what TWRP is (and how very cool it is!!!) we can continue.
Foreword:
I have looked at those with devices with TWRP with envy for the entire time i have owned a Galaxy Note and have been waiting patiently for an experienced Dev to compile a version for the N7000. After a year of ownership this has not happened so i have decided to go ahead and do it myself!!
Why have you called this a proof on concept?
For a few reasons:
1. I am not an experienced Dev... i have built CM6, 7 and 10 from source and done all the usual tweaks to my android devices but that is where my experience ends. This in itself is no big deal in its self but leads me to point 2...
2. This recovery may have MMC_CAP_ERASE / Brick Bug! I do not know how to check if it is present or not! Until an experienced Dev confirms MMC_CAP_ERASE has been fully suppressed you should assume this recovery is dangerous. As soon as an experienced Dev confirms the recovery is safe i will update this post. If it is confirmed it is not safe i will remove all links
3. I unfortunately to do not have time to maintain this recovery. As Samsung recoveries are included in the boot.img (kernel) it will mean the recovery will need recompiling every time a change is merged to the kernel in CM10. As development is still very active on the N7000 kernel i cannot make the commitment to recompile this that often
4. I am not a kernel Dev therefore i can only compile stock kernel with TWRP recovery. We all love (me included) a custom kernel with all the normal tweaks, OC etc. etc. I will never be able to achieve this so want to use this as the seed for somebody else to take and use to build there own custom kernel with TWRP recovery
5. It needs more extensive testing.... I have been playing with it for an hour this morning and everything seems to work fine but needs more testing.
I have included how to compile TWRP in post two... did i hear someone say enough talking, i want to try this out!!!
How to install
I have attached the boot.img at the bottom of this post.
1. Download
2. Copy to SDCARD
3. Flash with Mobile Odin
4. Enjoy!!
Please remember: This recovery may contain MMC_CAP_ERASE / Brick Bug! I do not known how to check! It is built from CM10 sources and there are TWRP ports for other devices so should be safe but i cannopt be positive! Use at your own risk!
Experienced Dev's: Any feedback on whether this recovery is safe would be VERY gratefully received!
As soon as any confirmation of this recovery being unsafe i will remove link immediately!
Click to expand...
Click to collapse
Based on item #4 (this is using a stock kernel repacked with a new recovery) - it will not be safe for flashing things.
For wipes and backups, it depends on exactly how you built it. Run strings on the binary...
Code:
strings recovery |grep MMC
If you see
Code:
warning: %s: Wipe via secure discard suppressed due to bug in EMMC firmware
The recovery binary is safe to do wipes/backups with, but as said above, if you used a stock kernel, it will be dangerous to flash ZIPs.
Also, of course, as this is a galaxys2-family device, the moment you flash anything containing a new kernel, TWRP will be gone.

Sorry, I should have been clearer. When I say stock kernel I mean stock CM10 kernel. This recovery is built by deleting the /bootable/recovery/ folder and replacing it with TWRP recovery. The rest of the build is standard CM10.
Sent from my GT-N7000 using XDA Premium HD app

Some usage feedback: I found it quite hard navigating through a folder filled with many sub-folders and files to select what I want to flash...quite jerky UI and a lot different from the experience I get on my TWRP-recoveried tablet.
But great initial release dev - really, well done!

And is this Heimdall flashable or do you strictly recommend Odin only? I have never used Odin since it is blackbox and everyone I knew has been recommending Heimdall. I know the former is designed to best-case mimic the latter, but just want to cover all my bases.

Heimdall will work
Sent from my GT-N7000 using XDA Premium HD app

timstanley1985 said:
Heimdall will work
Sent from my GT-N7000 using XDA Premium HD app
Click to expand...
Click to collapse
Alright will give it a go. Thanks for the quick reply.

alharaka said:
Alright will give it a go. Thanks for the quick reply.
Click to expand...
Click to collapse
Yeah, so maybe I did not understand entirely but when I flashed I got a success with Heimdall 1.3.1 CLI on OS X (10.6.8).
Code:
my-bacbook-pro:~ root# heimdall flash --recovery /Users/myusername/Downloads/boot.img --verbose
Heimdall v1.3.1, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Initialising connection...
Detecting device...
Manufacturer: "SAMSUNG"
Product: "Gadget Serial"
length: 18
device class: 2
S/N: 0
VID:PID: 04E8:685D
bcdDevice: 021B
iMan:iProd:iSer: 1:2:0
nb confs: 1
interface[0].altsetting[0]: num endpoints = 1
Class.SubClass.Protocol: 02.02.01
endpoint[0].address: 83
max packet size: 0010
polling interval: 09
interface[1].altsetting[0]: num endpoints = 2
Class.SubClass.Protocol: 0A.00.00
endpoint[0].address: 81
max packet size: 0200
polling interval: 00
endpoint[1].address: 02
max packet size: 0200
polling interval: 00
Claiming interface...
Setting up interface...
Checking if protocol is initialised...
Protocol is not initialised.
Initialising protocol...
Handshaking with Loke...
Beginning session...
Session begun with device of type: 131072
Downloading device's PIT file...
PIT file download sucessful
Uploading RECOVERY
0%File Part #0... Response: 0 0 0 0 0 0 0 0
2%
File Part #1... Response: 0 0 0 0 1 0 0 0
5%
File Part #2... Response: 0 0 0 0 2 0 0 0
7%
File Part #3... Response: 0 0 0 0 3 0 0 0
10%
File Part #4... Response: 0 0 0 0 4 0 0 0
12%
File Part #5... Response: 0 0 0 0 5 0 0 0
15%
File Part #6... Response: 0 0 0 0 6 0 0 0
18%
File Part #7... Response: 0 0 0 0 7 0 0 0
20%
File Part #8... Response: 0 0 0 0 8 0 0 0
23%
File Part #9... Response: 0 0 0 0 9 0 0 0
25%
File Part #10... Response: 0 0 0 0 A 0 0 0
28%
File Part #11... Response: 0 0 0 0 B 0 0 0
31%
File Part #12... Response: 0 0 0 0 C 0 0 0
33%
File Part #13... Response: 0 0 0 0 D 0 0 0
36%
File Part #14... Response: 0 0 0 0 E 0 0 0
38%
File Part #15... Response: 0 0 0 0 F 0 0 0
41%
File Part #16... Response: 0 0 0 0 10 0 0 0
44%
File Part #17... Response: 0 0 0 0 11 0 0 0
46%
File Part #18... Response: 0 0 0 0 12 0 0 0
49%
File Part #19... Response: 0 0 0 0 13 0 0 0
51%
File Part #20... Response: 0 0 0 0 14 0 0 0
54%
File Part #21... Response: 0 0 0 0 15 0 0 0
57%
File Part #22... Response: 0 0 0 0 16 0 0 0
59%
File Part #23... Response: 0 0 0 0 17 0 0 0
62%
File Part #24... Response: 0 0 0 0 18 0 0 0
64%
File Part #25... Response: 0 0 0 0 19 0 0 0
67%
File Part #26... Response: 0 0 0 0 1A 0 0 0
70%
File Part #27... Response: 0 0 0 0 1B 0 0 0
72%
File Part #28... Response: 0 0 0 0 1C 0 0 0
75%
File Part #29... Response: 0 0 0 0 1D 0 0 0
77%
File Part #30... Response: 0 0 0 0 1E 0 0 0
80%
File Part #31... Response: 0 0 0 0 1F 0 0 0
83%
File Part #32... Response: 0 0 0 0 20 0 0 0
85%
File Part #33... Response: 0 0 0 0 21 0 0 0
88%
File Part #34... Response: 0 0 0 0 22 0 0 0
90%
File Part #35... Response: 0 0 0 0 23 0 0 0
93%
File Part #36... Response: 0 0 0 0 24 0 0 0
96%
File Part #37... Response: 0 0 0 0 25 0 0 0
98%
File Part #38... Response: 0 0 0 0 26 0 0 0
100%
RECOVERY upload successful
Ending session...
Rebooting device...
But I rebooted and was back in ClockwordModRecovery 6.1.2. Did I misunderstand the directions? Sorry, my first time using Heimdall to write to my device; last few times I just detect'n'dump-ed to avoid destroying my phone because it was unnecessary.

If I was you just download mobile Odin lite from xda and flash with that. It's very easy that way
Sent from my GT-N7000 using XDA Premium HD app

timstanley1985 said:
If I was you just download mobile Odin lite from xda and flash with that. It's very easy that way
Sent from my GT-N7000 using XDA Premium HD app
Click to expand...
Click to collapse
I'll give that a try. Who knows what the deal is then.

alharaka said:
I'll give that a try. Who knows what the deal is then.
Click to expand...
Click to collapse
Ok, so I configured Mobile ODIN Lite (thanks for the pointer, by the way, amazing app I thought I had to pay for when I saw it a few weeks ago; had no idea I could test a lite version on XDA, sweet). So, installed it and got the N7000 add-on. What partition do I work with: Hidden?

Just click open file, select the boot.img and then scroll down and click flash image.
You click yes to confirm and then it will flash and reboot
Sent from my GT-N7000 using XDA Premium HD app

timstanley1985 said:
Just click open file, select the boot.img and then scroll down and click flash image.
You click yes to confirm and then it will flash and reboot
Sent from my GT-N7000 using XDA Premium HD app
Click to expand...
Click to collapse
Sorry for all the silly questions, and thanks again. I just wanna be sure since the recovery, well, makes mistakes less serious and I rely on it heavily. Once that is broken fixing my phone will get much more technical than I have time for.

[Q] [modem.bin]upgrade to leak rom by heimdall

I am trying to upgrade from GC100ZSALJ6 rom but failed when flashing the modem.bin. I have tried odin and heimdallv1.3.1.
The output of the heimdall is,
Heimdall v1.3.1, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
Initialising connection...
Detecting device...
Manufacturer: "SAMSUNG"
Product: "Gadget Serial"
length: 18
device class: 2
S/N: 0
VIDID: 04E8:685D
bcdDevice: 021B
iMan:iProd:iSer: 1:2:0
nb confs: 1
interface[0].altsetting[0]: num endpoints = 1
Class.SubClass.Protocol: 02.02.01
endpoint[0].address: 83
max packet size: 0010
polling interval: 09
interface[1].altsetting[0]: num endpoints = 2
Class.SubClass.Protocol: 0A.00.00
endpoint[0].address: 81
max packet size: 0200
polling interval: 00
endpoint[1].address: 02
max packet size: 0200
polling interval: 00
Claiming interface...
Setting up interface...
Checking if protocol is initialised...
Protocol is not initialised.
Initialising protocol...
Handshaking with Loke...
Beginning session...
Session begun with device of type: 131072
Downloading device's PIT file...
PIT file download sucessful
Uploading RADIO
0%File Part #0... Response: 0 0 0 0 0 0 0 0
1%
File Part #1... Response: 0 0 0 0 1 0 0 0
2%
File Part #2... Response: 0 0 0 0 2 0 0 0
3%
File Part #3... Response: 0 0 0 0 3 0 0 0
4%
File Part #4... Response: 0 0 0 0 4 0 0 0
5%
File Part #5... Response: 0 0 0 0 5 0 0 0
6%
File Part #6... Response: 0 0 0 0 6 0 0 0
7%
File Part #7... Response: 0 0 0 0 7 0 0 0
8%
File Part #8... Response: 0 0 0 0 8 0 0 0
9%
File Part #9... Response: 0 0 0 0 9 0 0 0
10%
File Part #10... Response: 0 0 0 0 A 0 0 0
11%
File Part #11... Response: 0 0 0 0 B 0 0 0
12%
File Part #12... Response: 0 0 0 0 C 0 0 0
13%
File Part #13... Response: 0 0 0 0 D 0 0 0
14%
File Part #14... Response: 0 0 0 0 E 0 0 0
15%
File Part #15... Response: 0 0 0 0 F 0 0 0
16%
File Part #16... Response: 0 0 0 0 10 0 0 0
17%
File Part #17... Response: 0 0 0 0 11 0 0 0
18%
File Part #18... Response: 0 0 0 0 12 0 0 0
19%
File Part #19... Response: 0 0 0 0 13 0 0 0
20%
File Part #20... Response: 0 0 0 0 14 0 0 0
21%
File Part #21... Response: 0 0 0 0 15 0 0 0
22%
File Part #22... Response: 0 0 0 0 16 0 0 0
23%
File Part #23... Response: 0 0 0 0 17 0 0 0
24%
File Part #24... Response: 0 0 0 0 18 0 0 0
26%
File Part #25... Response: 0 0 0 0 19 0 0 0
27%
File Part #26... Response: 0 0 0 0 1A 0 0 0
28%
File Part #27... Response: 0 0 0 0 1B 0 0 0
29%
File Part #28... Response: 0 0 0 0 1C 0 0 0
30%
File Part #29... Response: 0 0 0 0 1D 0 0 0
31%
File Part #30... Response: 0 0 0 0 1E 0 0 0
32%
File Part #31... Response: 0 0 0 0 1F 0 0 0
33%
File Part #32... Response: 0 0 0 0 20 0 0 0
34%
File Part #33... Response: 0 0 0 0 21 0 0 0
35%
File Part #34... Response: 0 0 0 0 22 0 0 0
36%
File Part #35... Response: 0 0 0 0 23 0 0 0
37%
File Part #36... Response: 0 0 0 0 24 0 0 0
38%
File Part #37... Response: 0 0 0 0 25 0 0 0
39%
File Part #38... Response: 0 0 0 0 26 0 0 0
40%
File Part #39... Response: 0 0 0 0 27 0 0 0
41%
File Part #40... Response: 0 0 0 0 28 0 0 0
42%
File Part #41... Response: 0 0 0 0 29 0 0 0
43%
File Part #42... Response: 0 0 0 0 2A 0 0 0
44%
File Part #43... Response: 0 0 0 0 2B 0 0 0
45%
File Part #44... Response: 0 0 0 0 2C 0 0 0
46%
File Part #45... Response: 0 0 0 0 2D 0 0 0
47%
File Part #46... Response: 0 0 0 0 2E 0 0 0
48%
File Part #47... Response: 0 0 0 0 2F 0 0 0
49%
File Part #48... Response: 0 0 0 0 30 0 0 0
51%
File Part #49... Response: 0 0 0 0 31 0 0 0
52%
File Part #50... Response: 0 0 0 0 32 0 0 0
53%
File Part #51... Response: 0 0 0 0 33 0 0 0
54%
File Part #52... Response: 0 0 0 0 34 0 0 0
55%
File Part #53... Response: 0 0 0 0 35 0 0 0
56%
File Part #54... Response: 0 0 0 0 36 0 0 0
57%
File Part #55... Response: 0 0 0 0 37 0 0 0
58%
File Part #56... Response: 0 0 0 0 38 0 0 0
59%
File Part #57... Response: 0 0 0 0 39 0 0 0
60%
File Part #58... Response: 0 0 0 0 3A 0 0 0
61%
File Part #59... Response: 0 0 0 0 3B 0 0 0
62%
File Part #60... Response: 0 0 0 0 3C 0 0 0
63%
File Part #61... Response: 0 0 0 0 3D 0 0 0
64%
File Part #62... Response: 0 0 0 0 3E 0 0 0
65%
File Part #63... Response: 0 0 0 0 3F 0 0 0
66%
File Part #64... Response: 0 0 0 0 40 0 0 0
67%
File Part #65... Response: 0 0 0 0 41 0 0 0
68%
File Part #66... Response: 0 0 0 0 42 0 0 0
69%
File Part #67... Response: 0 0 0 0 43 0 0 0
70%
File Part #68... Response: 0 0 0 0 44 0 0 0
71%
File Part #69... Response: 0 0 0 0 45 0 0 0
72%
File Part #70... Response: 0 0 0 0 46 0 0 0
73%
File Part #71... Response: 0 0 0 0 47 0 0 0
74%
File Part #72... Response: 0 0 0 0 48 0 0 0
76%
File Part #73... Response: 0 0 0 0 49 0 0 0
77%
File Part #74... Response: 0 0 0 0 4A 0 0 0
78%
File Part #75... Response: 0 0 0 0 4B 0 0 0
79%
File Part #76... Response: 0 0 0 0 4C 0 0 0
80%
File Part #77... Response: 0 0 0 0 4D 0 0 0
81%
File Part #78... Response: 0 0 0 0 4E 0 0 0
82%
File Part #79... Response: 0 0 0 0 4F 0 0 0
83%
File Part #80... Response: 0 0 0 0 50 0 0 0
84%
File Part #81... Response: 0 0 0 0 51 0 0 0
85%
File Part #82... Response: 0 0 0 0 52 0 0 0
86%
File Part #83... Response: 0 0 0 0 53 0 0 0
87%
File Part #84... Response: 0 0 0 0 54 0 0 0
88%
File Part #85... Response: 0 0 0 0 55 0 0 0
89%
File Part #86... Response: 0 0 0 0 56 0 0 0
90%
File Part #87... Response: 0 0 0 0 57 0 0 0
91%
File Part #88... Response: 0 0 0 0 58 0 0 0
92%
File Part #89... Response: 0 0 0 0 59 0 0 0
93%
File Part #90... Response: 0 0 0 0 5A 0 0 0
94%
File Part #91... Response: 0 0 0 0 5B 0 0 0
95%
File Part #92... Response: 0 0 0 0 5C 0 0 0
96%
File Part #93... Response: 0 0 0 0 5D 0 0 0
97%
File Part #94... Response: 0 0 0 0 5E 0 0 0
98%
File Part #95... Response: 0 0 0 0 5F 0 0 0
99%
File Part #96... Response: 0 0 0 0 60 0 0 0
100%
RADIO upload failed!
Ending session...
ERROR: Failed to confirm end of file transfer sequence!
ERROR: libusb error -7 whilst sending packet. Retrying...
ERROR: libusb error -7 whilst sending packet. Retrying...
ERROR: libusb error -7 whilst sending packet. Retrying...
ERROR: libusb error -7 whilst sending packet. Retrying...
ERROR: libusb error -7 whilst sending packet. Retrying...
ERROR: libusb error -7 whilst sending packet.
ERROR: Failed to send end session packet!
Are there anyone has done this type of work successfully?
Is it related to the flash tools hasn't support this device yet?

not sure if it makes a diff.. but have you rooted your device ?

pileiba said:
not sure if it makes a diff.. but have you rooted your device ?
Click to expand...
Click to collapse
Thanks for your reply.
Yes I have rooted the device. But as this procedure is in the download mode, is it related to rooted/non-rooted?
I just want to try another rom.
I have tried another way without modem.bin included and seems all the file could be uploaded to the device now.
But I still not sure about why the modem.bin couldn't been flashed

some other solutions I came across where here.. https://github.com/Benjamin-Dobell/Heimdall/issues/43 i.e. to try different versions of heimdell, try a 32bit operating system as opposed to 64 bit, and reinstall the samsung drivers. There is apparently a Heimdell 1.4 . http://www.glassechidna.com.au/2012/devblogs/heimdall-1-4-release-candidate-1/ . Lastly you could try a different usb cable and a different usb port. I think powered hubs sometimes work better.

[Q] P1000 wont boot after overcome

hi there,
I've got a problem on my GT-P1000, its bricked.. so i've tried to flash it with odeon.. but on windows it gave me an error..
The tab is well recognized but in every atempt i've made, the error maintains.. heres 2 pics of the procedure.
The files ive used were : GB_Stock_Safe_v5 .
img546.imageshack.us/img546/2497/image2qy.jpg
/img22.imageshack.us/img22/5357/imagegbf.jpg
img708.imageshack.us/img708/5387/image15tx.jpg
.. after this, when i reboot it loops on samsung logo, or just go black screen with ligths on.
Then i've moved out to MAC OS, and tried with heimdall.. and this is the tricky part.
using the GB_Stock_Safe_v5 or GB_Stock_Safe_v1
the result is the same... so i dunno if I'm missing some step or what..
1rst , put it on download mode and connect it .
img546.imageshack.us/img546/2497/image2qy.jpg
2nd, on console I manage to install the firmware.
img515.imageshack.us/img515/7303/image3ch.jpg
No erros, clean install so far.
img688.imageshack.us/img688/4596/image4hx.jpg
3rd, I've enter again in download mode, and installed the clockworkmod kernel.. but only service mode appears..
img21.imageshack.us/img21/8845/image6oa.jpg
img201.imageshack.us/img201/2470/image7wq.jpg
So.. I've putted it again on download mode and installed the slim kernel that i've seen on another thread.
And so far so good.. with this I can install via zip the clockworkmod and the Overcome .
img845.imageshack.us/img845/8234/image9ly.jpg
img839.imageshack.us/img839/2677/image10wc.jpg
img832.imageshack.us/img832/9839/image12kf.jpg
img27.imageshack.us/img27/1439/image14oy.jpg
But then.. no Boot just keeps on this ...
If I flash with heimdall only the firmware it keeps looping on Android, or samsung logo..
Can someone help me ?

So on your "2nd" steps, at the end of it you managed to boot into a clean GB JQ1 ROM?
(which is what GB stock safe v5)
If so, next question,
which clockworkmode kernel you flash in step "3rd"
better be the zImage that is unpacked from Overcome Kernel 4.0.tar
Because you can't just stick any kernel.
I just did my own flashing of kernel in linux and it doesn't have those messages you capture
$ heimdall flash --kernel ./zImage
Heimdall v1.3.1, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Initialising connection...
Detecting device...
Claiming interface...
Attempt failed. Detaching driver...
Claiming interface again...
Setting up interface...
Checking if protocol is initialised...
Protocol is not initialised.
Initialising protocol...
Handshaking with Loke...
Beginning session...
Session begun with device of type: 0
Downloading device's PIT file...
PIT file download sucessful
Uploading KERNEL
100%
KERNEL upload successful
Ending session...
Rebooting device...
Re-attaching kernel driver...

priyana, nope !
I can't anything.. It will get stuck every time.
After flashing in heimdall the GB Stock Safe V5.
heimdall flash --repartition --pit ./gt-p1000_mr.pit --factoryfs ./factoryfs.rfs --cache ./cache.rfs --dbdata ./hidden.rfs --primary-boot ./boot.bin --secondary-boot ./Sbl.bin --param ./param.lfs --kernel ./zImage
Click to expand...
Click to collapse
When i finish this.. this wont boot.
Here's the log of heimdall.
heimdall flash --repartition --pit ./gt-p1000_mr.pit --factoryfs ./factoryfs.rfs --cache ./cache.rfs --dbdata ./hidden.rfs --primary-boot ./boot.bin --secondary-boot ./Sbl.bin --param ./param.lfs --kernel ./zImage
Claiming interface... Success
Setting up interface... Success
Beginning session...
Handshaking with Loke... Success
Uploading PIT
PIT upload successful
Uploading IBL+PBL
100%
IBL+PBL upload successful
Uploading SBL
100%
SBL upload successful
Uploading KERNEL
100%
KERNEL upload successful
Uploading PARAM
100%
PARAM upload successful
Uploading FACTORYFS
100%
FACTORYFS upload successful
Uploading DBDATAFS
100%
DBDATAFS upload successful
Uploading CACHE
100%
CACHE upload successful
Ending session...
Rebooting device...
Click to expand...
Click to collapse
Note : When it reboot's a voice says: "not enough space on partition, bla bla bla, restore operation, your ... is now activated" and it enter on Android system recovery.
Now after this I flashed with Overcome_Kernel_v4.0.0.tar.
Here's the heimdall log :
heimdall flash --kernel zImage --verbose
Manufacturer: "SAMSUNG"
Product: "Gadget Serial"
length: 18
device class: 2
S/N: 0
VIDID: 04E8:6601
bcdDevice: 021B
iMan:iProd:iSer: 1:2:0
nb confs: 1
interface[0].altsetting[0]: num endpoints = 1
Class.SubClass.Protocol: 02.02.01
endpoint[0].address: 83
max packet size: 0010
polling interval: 09
interface[1].altsetting[0]: num endpoints = 2
Class.SubClass.Protocol: 0A.00.00
endpoint[0].address: 81
max packet size: 0200
polling interval: 00
endpoint[1].address: 02
max packet size: 0200
polling interval: 00
Claiming interface... Success
Setting up interface... Success
Beginning session...
Handshaking with Loke... Success
Downloading device's PIT file...
PIT file download sucessful
Uploading KERNEL
0%File Part #0... Response: 0 0 0 0 0 0 0 0
File Part #1... Response: 0 0 0 0 1 0 0 0
File Part #2... Response: 0 0 0 0 2 0 0 0
File Part #3... Response: 0 0 0 0 3 0 0 0
File Part #4... Response: 0 0 0 0 4 0 0 0
File Part #5... Response: 0 0 0 0 5 0 0 0
File Part #6... Response: 0 0 0 0 6 0 0 0
File Part #7... Response: 0 0 0 0 7 0 0 0
File Part #8... Response: 0 0 0 0 8 0 0 0
File Part #9... Response: 0 0 0 0 9 0 0 0
File Part #10... Response: 0 0 0 0 A 0 0 0
File Part #11... Response: 0 0 0 0 B 0 0 0
File Part #12... Response: 0 0 0 0 C 0 0 0
File Part #13... Response: 0 0 0 0 D 0 0 0
File Part #14... Response: 0 0 0 0 E 0 0 0
File Part #15... Response: 0 0 0 0 F 0 0 0
File Part #16... Response: 0 0 0 0 10 0 0 0
File Part #17... Response: 0 0 0 0 11 0 0 0
File Part #18... Response: 0 0 0 0 12 0 0 0
File Part #19... Response: 0 0 0 0 13 0 0 0
File Part #20... Response: 0 0 0 0 14 0 0 0
File Part #21... Response: 0 0 0 0 15 0 0 0
File Part #22... Response: 0 0 0 0 16 0 0 0
File Part #23... Response: 0 0 0 0 17 0 0 0
File Part #24... Response: 0 0 0 0 18 0 0 0
File Part #25... Response: 0 0 0 0 19 0 0 0
File Part #26... Response: 0 0 0 0 1A 0 0 0
File Part #27... Response: 0 0 0 0 1B 0 0 0
File Part #28... Response: 0 0 0 0 1C 0 0 0
File Part #29... Response: 0 0 0 0 1D 0 0 0
File Part #30... Response: 0 0 0 0 1E 0 0 0
File Part #31... Response: 0 0 0 0 1F 0 0 0
File Part #32... Response: 0 0 0 0 20 0 0 0
File Part #33... Response: 0 0 0 0 21 0 0 0
File Part #34... Response: 0 0 0 0 22 0 0 0
File Part #35... Response: 0 0 0 0 23 0 0 0
File Part #36... Response: 0 0 0 0 24 0 0 0
KERNEL upload successful
Ending session...
Rebooting device...
Click to expand...
Click to collapse
At this point, its reboots again to System Recovery ..
I restart the tab, Galaxy TAB Logo appears with Samsung under... the voice comes again " not enough space on partition bla bla " ... Samsung spinning logo apears and stuckk... !
Looks like a loop on logo, and doesnt do anything.

Search again for my last post on "heimdall flash", about less than a week ago.
You might have followed one of my bad earlier example command line ( although I don't think it matters for flashing overcome kernel).
Notice you stick hidden.rfs into dbdata like I once did.
Should have one for --hidden and one for --dbdata
Sent from my GT-I9300 using xda app-developers app

Notice you stick hidden.rfs into dbdata like I once did.
Should have one for --hidden and one for --dbdata
Click to expand...
Click to collapse
Thank you for the reply.. but should I assign hidden.rfs twice for different parameters ?

There is a dbdata.rfs
Sent from my GT-I9300 using xda app-developers app

priyana said:
There is a dbdata.rfs
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
Still the same.. it's getting stuck on samsung logo.

Grab a windows machine and try Odin.
Drivers and Odin are included in gb-stock-safe-v5
Or, just try out CM/AOKP.
By now, you should have overcome kernel installed, that means you can boot to CWM recovery.
boot to it and flash cm10/aokp or any custom ROM, then flash the rom zip file (you may need to do it 3 times, depending on the steps within the updater script),
then flash gapps and reboot into a new ROM.
For me, doing the GB-stock-safe-v5 + overcome for all intent and purposes are just to "restock" the partition and to install CWM.
Sent from my GT-P1000 using xda app-developers app

[Q] Xperia FMRadio for CM12

Hi, I'm trying to make stock Sony FM radio app with CM12 ROM. I have found FM radio needs some external configuration and frameworks and I have following files and radio apk installed.
/system/bin/fmconfig
/system/frameworks/qcom.fmradio
/system/etc/init.qcom.fm.sh
/system/bin/fm_qsoc_patches
but still FM radio does not work and FC after launch. here is the logcat output I captured.
Code:
01-20 17:55:09.023: E/AndroidRuntime(4938): FATAL EXCEPTION: main
01-20 17:55:09.023: E/AndroidRuntime(4938): Process: com.sonyericsson.fmradio, PID: 4938
01-20 17:55:09.023: E/AndroidRuntime(4938): java.lang.NoClassDefFoundError: com.sonyericsson.fmradio.mock.MockReceiver
01-20 17:55:09.023: E/AndroidRuntime(4938): at com.sonyericsson.fmradio.ui.MockUtil.setupFmService(MockUtil.java:36)
01-20 17:55:09.023: E/AndroidRuntime(4938): at com.sonyericsson.fmradio.ui.FmRadioActivity.connectToFmService(FmRadioActivity.java:485)
01-20 17:55:09.023: E/AndroidRuntime(4938): at com.sonyericsson.fmradio.ui.FmRadioActivity.onStart(FmRadioActivity.java:244)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.Instrumentation.callActivityOnStart(Instrumentation.java:1220)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.Activity.performStart(Activity.java:5949)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2261)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2360)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.ActivityThread.access$800(ActivityThread.java:144)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1278)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.os.Handler.dispatchMessage(Handler.java:102)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.os.Looper.loop(Looper.java:135)
01-20 17:55:09.023: E/AndroidRuntime(4938): at android.app.ActivityThread.main(ActivityThread.java:5221)
01-20 17:55:09.023: E/AndroidRuntime(4938): at java.lang.reflect.Method.invoke(Native Method)
01-20 17:55:09.023: E/AndroidRuntime(4938): at java.lang.reflect.Method.invoke(Method.java:372)
01-20 17:55:09.023: E/AndroidRuntime(4938): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:898)
01-20 17:55:09.023: E/AndroidRuntime(4938): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:693)
Is there a way I can make the app work on CM? Thanks in advance

Bootloader Unlock Ideas

Hi Guys I have been messing with Bootloader unlock ideas and wanted to share some of my thoughts on it. I really dont know much about it but here is what i have found so far
I know that if i reboot to fastboot mode with
Code:
adb reboot bootloader
I can run getvar all and see this unlock_code
Code:
fastboot getvar all
(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 17329be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) off-mode-charge: 1
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: FORD
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x32c5657dd83d5139
(bootloader) prod: 1
all: Done!!
I also know that the command to unlock the bootloader
Code:
fastboot flash unlock unlock.bin
Code:
C:\Development\adt-bundle-windows-x86_64-20130729\sdk\platform-tools>fastboot fl
ash unlock "H:\Tom Stuff\Amazon Fire 7in 5th gen Ford\unlock.bin"
target reported max download size of 134217728 bytes
sending 'unlock' (0 KB)...
OKAY [ 0.015s]
writing 'unlock'...
FAILED (remote: unlock code error)
finished. total time: 0.028s
I also ran idme print with root access and got back this
Code:
[email protected]:/ $ su
[email protected]:/ # idme print
board_id: 0025001040000015
serial: G0K0H40453870FHX
mac_addr: F0272D525FE6
mac_sec: 3E9WML8GV8BJH6Z1CD88
bt_mac_addr: 00BB3A0BFFEE
product_name: 0
productid: 0
productid2: 0
bootmode: 0
postmode: 0
bootcount: 90
manufacturing:
unlock_code:
sensorcal: 480000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000
register_tag: 715aa2763b01f250
KB:
4b 42 50 46 18 0e 00 00 28 0e
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
device_type_id: A2M4YX06LWP8WI
dev_flags: 0
fos_flags: 0
usr_flags: 0
At this point i have tried creating a couple different unlock.bin's with this unlock code and even changing it to decimal instead of hexadecimal but really i am lost here was hoping someone with a little more info and experiance might be able to help thanks.

Seems interesting but I doubt it will be this easy.

I can't wait to see what you all do with this!

You've probably tried this, but use the unlock code as a parameter, so fastboot flash unlock 0xABCD etc. Also, fastboot flash unlock isn't a stock fastboot command, it might be Amazon's , but not stock. Try fastboot oem unlock, or the new commands, fastboot flashing unlock or fastboot flashing unlock-critical.
---------- Post added at 08:41 PM ---------- Previous post was at 08:39 PM ----------
Also try fastboot flash unlocktoken unlock.bin

Koopa777 said:
You've probably tried this, but use the unlock code as a parameter, so fastboot flash unlock 0xABCD etc. Also, fastboot flash unlock isn't a stock fastboot command, it might be Amazon's , but not stock. Try fastboot oem unlock, or the new commands, fastboot flashing unlock or fastboot flashing unlock-critical.
---------- Post added at 08:41 PM ---------- Previous post was at 08:39 PM ----------
Also try fastboot flash unlocktoken unlock.bin
Click to expand...
Click to collapse
good ideas but i have already tried all of those first before this post but ideas are welcome

I don't have a Windows installation ATM. Has anyone tried sp flash tool for mediatek devices?
EDIT: I played a bit with MTK droid tools to create a scatter file, but no luck (so it seems SP tools are a no go). I also tried some shady Mediatek tools. Also with no luck. My take is that unlocking via fastboot may not work at all. Maybe look into mediatek stuff to unlock the Fire.

Keep at it guys! Apparently Android 6.0/CM13 isn't doable until bootloader unlocked. This is probably best tablet around $50 with probably fairly large sales. Worth the effort.

As far as I know, that unlock code that fastboot gives is much like Motorola's unlock setup... The device's code is hashed/SHA/etc with a master key, spits out a device unlock code that you can give fastboot.

xenokc said:
Apparently Android 6.0/CM13 isn't doable until bootloader unlocked. This is probably best tablet around $50 with probably fairly large sales. Worth the effort.
Click to expand...
Click to collapse
We should just need kexec.

Idk but I need some marshmallow love
Sent from my KFFOWI using Tapatalk

This has been discussed a bit in other threads
Amazon Fire Bootloader unlock code?? by @Awesomeslayerg
Working Bootable recovery for the KFFOWI (Ford) by @Vlasp

I have a similar thread in the HD 8 & 10 section, but nothing you have not found already.

ok so i dont really know where to post this but i am trying to adb shell dd my mmcblk0 file and i got a img that was 4ggs and now i try to dd blahblah skip=4294967295 but i get an error "dd: dev/block/mmcblk0: Invalid argument"almost 100 percent that it is the same file iwas using before all i did was exit the shell (2 times i was root) and adb pull the mmcblk0.img from the ../sdcard2/ it took a few minutes and i just went on to procede with the skip=4ggs and got the error dont want to try to reboot incase i fd it up. ok i figured it out i just changed it to skip=40049... hopefully i can still merge the two together later.

Tomsgt said:
Hi Guys I have been messing with Bootloader unlock ideas and wanted to share some of my thoughts on it. I really dont know much about it but here is what i have found so far
I know that if i reboot to fastboot mode with
Code:
adb reboot bootloader
I can run getvar all and see this unlock_code
Code:
fastboot getvar all
(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 17329be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) off-mode-charge: 1
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: FORD
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x32c5657dd83d5139
(bootloader) prod: 1
all: Done!!
I also know that the command to unlock the bootloader
Code:
fastboot flash unlock unlock.bin
Code:
C:\Development\adt-bundle-windows-x86_64-20130729\sdk\platform-tools>fastboot fl
ash unlock "H:\Tom Stuff\Amazon Fire 7in 5th gen Ford\unlock.bin"
target reported max download size of 134217728 bytes
sending 'unlock' (0 KB)...
OKAY [ 0.015s]
writing 'unlock'...
FAILED (remote: unlock code error)
finished. total time: 0.028s
I also ran idme print with root access and got back this
Code:
[email protected]:/ $ su
[email protected]:/ # idme print
board_id: 0025001040000015
serial: G0K0H40453870FHX
mac_addr: F0272D525FE6
mac_sec: 3E9WML8GV8BJH6Z1CD88
bt_mac_addr: 00BB3A0BFFEE
product_name: 0
productid: 0
productid2: 0
bootmode: 0
postmode: 0
bootcount: 90
manufacturing:
unlock_code:
sensorcal: 480000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000
register_tag: 715aa2763b01f250
KB:
4b 42 50 46 18 0e 00 00 28 0e
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
device_type_id: A2M4YX06LWP8WI
dev_flags: 0
fos_flags: 0
usr_flags: 0
At this point i have tried creating a couple different unlock.bin's with this unlock code and even changing it to decimal instead of hexadecimal but really i am lost here was hoping someone with a little more info and experiance might be able to help thanks.
Click to expand...
Click to collapse
Ok so i dont know if any of this will help but....
Code:
[email protected]:/ # idme print
board_id: 0025001050010015
serial: G000H4045445154K
mac_addr: F0272D9D13E0
mac_sec: 3ECQJN1SLTE1HRUQ770F
bt_mac_addr: 84D6D0221452
product_name: 0
productid: 0
productid2: 0
bootmode: 0
postmode: 0
bootcount: 64
manufacturing: PSN=P00082035443042S FSN=3862080402143
unlock_code:
sensorcal: 4800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
register_tag: 715aa2763b01f250
KB:
4b 42 50 46 18 0e 00 00 28 0e
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
device_type_id: A2M4YX06LWP8WI
dev_flags: 0
fos_flags: 0
usr_flags: 0
[email protected]:/ #
And
Code:
fastboot getvar all
(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 17329be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) off-mode-charge: 1
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: FORD
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x444d63d061775c38
(bootloader) prod: 1
all: Done!!
finished. total time: 0.012s
if there is anything i can do/donate to help such as Raw image files or logs let me know i have Amazon Fire 5.1.1 rooted after ota, it updated overnight before i could look anything up, my wife got this for xmas, with gapps framework, hidden fireos launcher, and hidden ota's and such, can use fastboot oem append-cmdline "androidboot.unlocked_kernel=true" to run adb as root and remount my file system, and i am going to pull a full mmcblk0 raw binary image tonight hopefully it will work. going to run some file system forensics on the image and hopefully find some hidden or deleted files from when devices where manufactured.

serial console output
I bought one of these 7-inch Fire Tablets (5th generation) during the $35 sale a few weeks back. I purchased it from a big chain store, so it has model SV98LN rather than the KFFOWI reported by others in this forum, but everything else seems the same. After removing the rear panel, I looked around for test points on the motherboard. There were two conveniently labeled TX and RX. Poking around with a multimeter revealed that things were running at 1.8v. I found a good places to attach leads for VCC and GND, and connected them along with TX and RX to a spare FD232R-based serial adapter.
At 115200 baud (on-chip boot rom):
Code:
[DL] 00000000 00000000 010701
PR: 0001 01A6
F3: 0000 0000
V0: 0000 0000 [0001]
00: 1027 0002
01: 0000 0000
BP: 0000 0059
G0: 0182 0000
T0: 0000 0418
Jump to BL
Then at 921600 baud (preloader):
Code:
[USBD] USB PRB0 LineState: 0
[USBD] USB cable/ No Cable inserted!
[PLFM] Keep stay in USB Mode
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D52
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=1,rdata=800
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=8 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=1001
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=2003
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 0 TOP_RST_MISC: 0
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[BLDR] Build Time: 20150730-164940
At this point the port switches back to 115200 baud, emits "READY", and waits briefly for input (in case the flash programming tool is connected). After a short time, it switches back to 921000 baud and continues.
Code:
==== Dump RGU Reg ========
RGU MODE: 4D
RGU LENGTH: FFE0
RGU STA: 0
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
mtk_wdt_mode_config mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xE, con = 0xBFFA
rtc_first_boot_init
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
rtc_2sec_stat_clear
rtc_2sec_reboot_check cali=1536
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0xC0, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xE, con = 0x426, cali = 0x600
pl pmic powerkey Release
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[PLFM] USB/charger boot!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0xC0
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x90>
msdc <0> <HYNIX > <H8G1e>
msdc <1> <xxxxxx> <H8G1e>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 90,1,4A,48,38,47,31,65,5,7,D0,C8,D4,FA,82,CB
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:12
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3C0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C8FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C9FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3CAFFh
4.2.CMPOT:0x3dc[31]:0h
N drive:9
drvp=0xC,drvn=0x9
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0010:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0011:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
0013:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
0014:| 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0
0015:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0
0016:| 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Rank 13 coarse tune value selection : 32,
20
64
rank 0 coarse = 20
rank 0 fine = 64
00:| 0 0 0 0 1 1 1 0
opt_dle value:9
[EMI]warning:rank auto detect:==single rank==
Change CMD/ADDR output delay = 15
Change CLK output delay = 15
20
80
Change CMD/ADDR output delay = 14
Change CLK output delay = 14
20
80
Change CMD/ADDR output delay = 13
Change CLK output delay = 13
20
80
Change CMD/ADDR output delay = 12
Change CLK output delay = 12
20
80
Change CMD/ADDR output delay = 11
Change CLK output delay = 11
20
80
Change CMD/ADDR output delay = 0
Change CLK output delay = 0
20
64
byte:0, (DQS,DQ)=(8,9)
byte:1, (DQS,DQ)=(8,A)
byte:2, (DQS,DQ)=(8,8)
byte:3, (DQS,DQ)=(8,8)
[EMI] DRAMC calibration passed
[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824
[Dram_Buffer] structure size: 1557624
[Dram_Buffer] MAX_TEE_DRAM_SIZE: 268435456
<< binary spew, perhaps signature from nvram? >>
sram(0xC10C983F) sig mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x4000
RAM_CONSOLE wdt status (0x0)=0x0
[PLFM] Init Boot Device: OK(0)
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
[PART] GPT dump
[PART] 1: 00000800 00000800 'KB'
[PART] 2: 00000800 00001000 'DKB'
[PART] 3: 00008B00 00001800 'EXPDB'
[PART] 4: 00000800 0000A300 'UBOOT'
[PART] 5: 00008000 0000AB00 'boot'
[PART] 6: 00008000 00012B00 'recovery'
[PART] 7: 00000400 0001AB00 'MISC'
[PART] 8: 00001C00 0001AF00 'LOGO'
[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'
[LIB] HW ENC
[platform_vusb_on] PASS
step A2 : Standard USB Host!
[PLFM] USB cable in
No Battery
[0xE]=0x1005
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
USB HW reg: index14=0x0
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[TOOL] Enumeration(End): OK 616ms
[TOOL] : usb listen timeout
[TOOL] <USB> cannot detect tools!
[TOOL] <UART> listen ended, receive size:0!
[TOOL] <UART> wait sync time 150ms->5ms
[TOOL] <UART> receieved data: ()
Device APC domain init setup:
mmc_rpmb_get_wc, mmc_set_part_config done!!
mmc_rpmb_send_command -> req_type=0x1, type=0x2, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x2, blks=0x1
mmc_rpmb_get_wc, rpmb_req.result=0
[RPMB] RPMB Provisioned
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[RPMB] Valid anti-rollback block exists
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 409428
[PART] magic: 58881688h
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.
[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2960KB/s, 409428 bytes, 135ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 74213KB/s, 1063936 bytes, 14ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 79922KB/s, 1063936 bytes, 13ms
[BLMTEE] sha256 takes 6 (ms) for 1063360 bytes
[BLMTEE] rsa2048 takes 117 (ms)
[BLMTEE] verify pkcs#1 pss: 1 (ms)
[BLMTEE] aes128cbc 9 (ms) for 1063360
[ANTI-ROLLBACK] Processing anti-rollback data
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 2 TEE: 3002 LK: 2
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] All checks passed
No Battery
[0xE]=0x1005
hw_set_cc: 450
[0x0]=0x6B
[0x1]=0x6B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[PLFM] Wait for battery inserted...
pl pmic close pre-chr LED
pl charging en
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x4
[0x2D]=0x4
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x9
[0x21]=0x9
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x4
[0x2D]=0x4
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
pl charging done
No Battery
[0xE]=0x1005
No Battery
[0xE]=0x1005
Over the next few days, I'll try various boot configurations (holding down buttons, poking various test points, using a "factory cable") and look for differences in the console output. I'll summarize those differences when I've finished the work.
NOTE: When I captured this output, it was after having written some bad data to the NVRAM partition. I believe that explains the initial "[Read Test] fail" messages as well as the later complaint "sram(0xC10C983F) sig mismatch".
---------- Post added at 12:38 AM ---------- Previous post was at 12:21 AM ----------
If anyone has a bricked or broken tablet that they'd be willing to part with, please PM me. I'd like to have at least one more device on which to experiment.
I've been poking and prodding my current device quite a bit already, and I think I may have zapped some part of the power-management curcuitry which charges the battery. (Pro tip: remember to unplug the USB cable before applying an alcohol-soaked Q-tip to the board.)
I've already found lots of test points hiding on the motherboard, but it's almost impossible to see where they're going. I'd like to use a hot-air rework station and remove the big chips so I can get to the solder pads.

serial console: no soldering!
In reading threads about other phones and tablets, I somewhere ran across a mention that perhaps the USB port can be used directly as the console. After a bit of experimentation, I got that to work on the Fire.
Code:
TTL USB A/B USB MINI/MICRO
SIGNAL PORT PIN PORT PIN
--------- --------- ---------------
+5V 1 1
RX 2 2
TX 3 3
NC 4
GND 5 4
I verified that this works with three USB/serial chipsets: FT232RL, PL-2302/X, and CP2102.

fully bricked output
Great find noelcragg!
I dumped the output of my fire that I bricked trying to downgrade, through the usb serial port.
Code:
CC¡¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遺jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•é€‚jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•…™Ñ•É遒jj¤Ô¨HhU5%ÕE‹K—‚ÂÙáb²…±Õ•éÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•…™Ñ•ÉéÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•é¢jj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遢jj¤ü
[USB]addr: 0x11002090 (UART1), value: 0
[USB]addr: 0x11002090 (UART1), value after: 1
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D50
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=1 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=8,rdata=5885
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 1 TOP_RST_MISC: 1
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[BLDR] Build Time: 20150730-164940
€€€€ €€ € €€ €€ ==== Dump RGU Reg ========
RGU MODE: 55
RGU LENGTH: FFE0
RGU STA: A0000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:5
mtk_wdt_mode_config mode value=10, tmp:22000010
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3967
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xD, con = 0x426
[RTC] powerkey1 = 0xA357, powerkey2 = 0x67D2
Writeif_unlock
[RTC] RTC_SPAR0=0x40
rtc_2sec_reboot_check cali=1792
rtc_2sec_stat_clear
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xD, con = 0x426, cali = 0x700
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0x40
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x15>
msdc <0> <HYNIX > <8GND3R>
msdc <1> <xxxxxx> <8GND3R>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,38,47,4E,44,33,52,1,CE,17,4F,F4,B2,51
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5D0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:13
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3D0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D8FFh
4.2
CC¡¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遺jj¤Ô¨HhU5%ÕE‹K—‚ÂÉÉb²…±Õ•é‚jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•…™Ñ•É遒jh¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•éÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•…™Ñ•ÉéÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•é¢jj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•„™Ñ•É遢jj¤ü
[USB]addr: 0x11002090 (UART1), value: 0
[USB]addr: 0x11002090 (UART1), value after: 1
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D52
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=1 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=8 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 1 TOP_RST_MISC: 1
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[BLDR] Build Time: 20150730-164940
€€€€ €€ € €€ €€ ==== Dump RGU Reg ========
RGU MODE: 55
RGU LENGTH: FFE0
RGU STA: A0000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:5
mtk_wdt_mode_config mode value=10, tmp:22000010
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xD, con = 0x426
[RTC] powerkey1 = 0xA357, powerkey2 = 0x67D2
Writeif_unlock
[RTC] RTC_SPAR0=0x40
rtc_2sec_reboot_check cali=1792
rtc_2sec_stat_clear
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xD, con = 0x426, cali = 0x700
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0x40
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x15>
msdc <0> <HYNIX > <8GND3R>
msdc <1> <xxxxxx> <8GND3R>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,38,47,4E,44,33,52,1,CE,17,4F,F4,B2,51
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5D0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:13
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3D0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D8FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D9FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3DAFFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3DBFFh
4.2.CMPOT:0x3dc[31]:0h
N drive:10
drvp=0xD,drvn=0xA
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0010:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0011:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1
0013:| 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1
0014:| 0 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0
0015:| 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Rank 12 coarse tune value selection : 32,
20
56
rank 0 coarse = 20
rank 0 fine = 56
00:| 0 0 0 0 1 1 1 0
opt_dle value:9
[EMI]warning:rank auto detect:==single rank==
Change CMD/ADDR output delay = 15
Change CLK output delay = 15
20
64
Change CMD/ADDR output delay = 14
Change CLK output delay = 14
20
64
Change CMD/ADDR output delay = 0
Change CLK output delay = 0
20
48
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
byte:2, (DQS,DQ)=(8,7)
byte:3, (DQS,DQ)=(8,8)
[EMI] DRAMC calibration passed
[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824
[Dram_Buffer] structure size: 1557624
[Dram_Buffer] MAX_TEE_DRAM_SIZE: 268435456
E~ sram(0x25007E45) sig mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x4000
RAM_CONSOLE preloader last status: 0x0 0x0 0x0
RAM_CONSOLE wdt status (0x5)=0x5
[PLFM] Init Boot Device: OK(0)
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
[PART] GPT dump
[PART] 1: 00000800 00000800 'KB'
[PART] 2: 00000800 00001000 'DKB'
[PART] 3: 00008B00 00001800 'EXPDB'
[PART] 4: 00000800 0000A300 'UBOOT'
[PART] 5: 00008000 0000AB00 'boot'
[PART] 6: 00008000 00012B00 'recovery'
[PART] 7: 00000400 0001AB00 'MISC'
[PART] 8: 00001C00 0001AF00 'LOGO'
[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'
[LIB] HW ENC
[platform_vusb_on] PASS
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.
[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2917KB/s, 406452 bytes, 136ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 79922KB/s, 1063936 bytes, 13ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 74213KB/s, 1063936 bytes, 14ms
[BLMTEE] sha256 takes 6 (ms) for 1063360 bytes
[BLMTEE] rsa2048 takes 118 (ms)
[BLMTEE] verify pkcs#1 pss: 0 (ms)
[BLMTEE] aes128cbc 8 (ms) for 1063360
[ANTI-ROLLBACK] Processing anti-rollback data
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 2 TEE: 3002 LK: 3
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] LK version mismatch!
[ANTI-ROLLBACK] L: 3 R: 2

picture of usb-serial connected to micro usb plug
For those who are more visually-oriented, I've attached a picture showing the attachment of a FT232RL USB-to-TTL-Serial adapter to a 5-pin micro USB plug.

flaming_goat said:
Great find noelcragg!
I dumped the output of my fire that I bricked trying to downgrade, through the usb serial port.
Code:
CC¡¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遺jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•é€‚jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•…™Ñ•É遒jj¤Ô¨HhU5%ÕE‹K—‚ÂÙáb²…±Õ•éÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•…™Ñ•ÉéÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•é¢jj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遢jj¤ü
[USB]addr: 0x11002090 (UART1), value: 0
[USB]addr: 0x11002090 (UART1), value after: 1
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D50
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=1 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=8,rdata=5885
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 1 TOP_RST_MISC: 1
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[BLDR] Build Time: 20150730-164940
€€€€ €€ € €€ €€ ==== Dump RGU Reg ========
RGU MODE: 55
RGU LENGTH: FFE0
RGU STA: A0000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:5
mtk_wdt_mode_config mode value=10, tmp:22000010
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3967
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xD, con = 0x426
[RTC] powerkey1 = 0xA357, powerkey2 = 0x67D2
Writeif_unlock
[RTC] RTC_SPAR0=0x40
rtc_2sec_reboot_check cali=1792
rtc_2sec_stat_clear
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xD, con = 0x426, cali = 0x700
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0x40
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x15>
msdc <0> <HYNIX > <8GND3R>
msdc <1> <xxxxxx> <8GND3R>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,38,47,4E,44,33,52,1,CE,17,4F,F4,B2,51
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5D0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:13
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3D0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D8FFh
4.2
CC¡¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•…™Ñ•É遺jj¤Ô¨HhU5%ÕE‹K—‚ÂÉÉb²…±Õ•é‚jj¤Ô¨HhU5%Õ‘‘É遂ÂÉÉb²…±Õ•…™Ñ•É遒jh¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•éÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙáb²…±Õ•…™Ñ•ÉéÂjj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•é¢jj¤Ô¨HhU5%Õ‘‘É遂ÂÙ±²…±Õ•„™Ñ•É遢jj¤ü
[USB]addr: 0x11002090 (UART1), value: 0
[USB]addr: 0x11002090 (UART1), value after: 1
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D52
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=1 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=8 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 1 TOP_RST_MISC: 1
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[BLDR] Build Time: 20150730-164940
€€€€ €€ € €€ €€ ==== Dump RGU Reg ========
RGU MODE: 55
RGU LENGTH: FFE0
RGU STA: A0000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:5
mtk_wdt_mode_config mode value=10, tmp:22000010
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xD, con = 0x426
[RTC] powerkey1 = 0xA357, powerkey2 = 0x67D2
Writeif_unlock
[RTC] RTC_SPAR0=0x40
rtc_2sec_reboot_check cali=1792
rtc_2sec_stat_clear
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xD, con = 0x426, cali = 0x700
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0x40
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x15>
msdc <0> <HYNIX > <8GND3R>
msdc <1> <xxxxxx> <8GND3R>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,38,47,4E,44,33,52,1,CE,17,4F,F4,B2,51
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5D0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:13
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3D0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D8FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3D9FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3DAFFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3DBFFh
4.2.CMPOT:0x3dc[31]:0h
N drive:10
drvp=0xD,drvn=0xA
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0010:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0011:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1
0013:| 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1
0014:| 0 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0
0015:| 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Rank 12 coarse tune value selection : 32,
20
56
rank 0 coarse = 20
rank 0 fine = 56
00:| 0 0 0 0 1 1 1 0
opt_dle value:9
[EMI]warning:rank auto detect:==single rank==
Change CMD/ADDR output delay = 15
Change CLK output delay = 15
20
64
Change CMD/ADDR output delay = 14
Change CLK output delay = 14
20
64
Change CMD/ADDR output delay = 0
Change CLK output delay = 0
20
48
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
byte:2, (DQS,DQ)=(8,7)
byte:3, (DQS,DQ)=(8,8)
[EMI] DRAMC calibration passed
[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824
[Dram_Buffer] structure size: 1557624
[Dram_Buffer] MAX_TEE_DRAM_SIZE: 268435456
E~ sram(0x25007E45) sig mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x4000
RAM_CONSOLE preloader last status: 0x0 0x0 0x0
RAM_CONSOLE wdt status (0x5)=0x5
[PLFM] Init Boot Device: OK(0)
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
[PART] GPT dump
[PART] 1: 00000800 00000800 'KB'
[PART] 2: 00000800 00001000 'DKB'
[PART] 3: 00008B00 00001800 'EXPDB'
[PART] 4: 00000800 0000A300 'UBOOT'
[PART] 5: 00008000 0000AB00 'boot'
[PART] 6: 00008000 00012B00 'recovery'
[PART] 7: 00000400 0001AB00 'MISC'
[PART] 8: 00001C00 0001AF00 'LOGO'
[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'
[LIB] HW ENC
[platform_vusb_on] PASS
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.
[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2917KB/s, 406452 bytes, 136ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 79922KB/s, 1063936 bytes, 13ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h
[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 74213KB/s, 1063936 bytes, 14ms
[BLMTEE] sha256 takes 6 (ms) for 1063360 bytes
[BLMTEE] rsa2048 takes 118 (ms)
[BLMTEE] verify pkcs#1 pss: 0 (ms)
[BLMTEE] aes128cbc 8 (ms) for 1063360
[ANTI-ROLLBACK] Processing anti-rollback data
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 2 TEE: 3002 LK: 3
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] LK version mismatch!
[ANTI-ROLLBACK] L: 3 R: 2
Click to expand...
Click to collapse
anti rollback is the problem with that brick like we all figured but still cool to see it in the output

Is it a lost cause at this point?
Sent from my LG-E980 using XDA-Developers mobile app