Failed handshake (Amazon Fire HD6 - ariel)

UART_log.txt

[PL0] Build Time: 20140925-030705
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x45>
msdc <0> <HYNIX > <SEM08G>
msdc <1> <xxxxxx> <SEM08G>
msdc failed to find
=========use hc erase size
[PL0] Init MMC: OK(0)
[ROM_INFO] 'v2','0x3100000','0x20000','0x3D80000','0x2C00'
[PART] 1: 00000100 00000040 'PRO_INFO'
[PART] 2: 00002000 00000800 'PMT'
[PART] 3: 00002800 00002800 'TEE1'
[PART] 4: 00002800 00005000 'TEE2'
[PART] 5: 00000400 00007800 'UBOOT'
[PART] 6: 00004000 00007C00 'boot_x'
[PART] 7: 00004000 0000BC00 'recovery_x'
[PART] 8: 00000800 0000FC00 'KB'
[PART] 9: 00000800 00010400 'DKB'
[PART] 10: 00000400 00010C00 'MISC'
[PART] 11: 00008000 00011000 'persisbackup'
[PART] 12: 00258000 00019000 'system'
[PART] 13: 001B8000 00271000 'cache'
[PART] 14: 0000F000 00429000 'boot'
[PART] 15: 0000F000 00438000 'recovery'
[PART] 16: 00A43FDF 00447000 'userdata'
[PL0] loading partition 'TEE1' offset=00300000 at address=12001000
[PART] Image with part header
[PART] name : PL1
[PART] addr : FFFFFFFFh
[PART] size : 112636
[PART] magic: 58881688h

[PART] load "2" from 0x0000000001800200 (dev) to 0x12001000 (mem) [SUCCESS]
[PART] load speed: 18332KB/s, 112636 bytes, 6ms
[PL0] Load PL1 from  partition 'TEE1'@ 8X: err=3145728
[PL0]RSA2048 signature for PL1[key0]: (img_size 112380)
[PL0]image verification passed for PL1[key0]
[PL0] PL1 Load OK from TEE1: err=0

[PL0] jump to 12001000
173 442
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=0 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=1 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=2 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=3 rdata=5AA5
[PWRAP] recheck PMIC_GPIO_SMT_CON0 data, data=0x1E6
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6397_init] Start..................
[pmic6397_init] Enable PMIC RST function (depends on main chip RST function) Reg[0x126]=0x53
Reg[0x222]=0x3021
Reg[0x248]=0xB001
[pmic6397_init][Preloader_PMIC_INIT_SETTING_V1] PMIC Chip = 4097
[PMIC_INIT_SETTING_V1] Done
[hw_check_battery+] [0xE]=0x1
[hw_check_battery+] [0x542]=0xA0
[pl_hw_check_battery] Battery exist!!
[hw_check_battery-] [0xE]=0x1
[hw_check_battery-] [0x542]=0xA0
[pmic6397_init] hw_check_battery
[pmic6397_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]

[BLDR] Build Time: 20150215-042325
==== Dump RGU Reg ========
RGU MODE:     6D
RGU LENGTH:   FFE0
RGU STA:      0
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
 mtk_wdt_mode_config  mode value=2D, tmp:22000030
PL P ON
WDT does not trigger reboot
 mtk_wdt_mode_config  mode value=70, tmp:2200007D
kpd register for pmic set!
[RTC-Preloader] bbpu = 0x1, con = 0x407,pdn1=0x1200
[RTC] POWERKEY1 = 0xA357, POWERKEY2 = 0x67D2
[RTC] irqsta = 0x0, pdn1 = 0x1200, pdn2 = 0x201, spar0 = 0xD40, spar1 = 0x0
[RTC] new_spare0 = 0x630D, new_spare1 = 0x81C, new_spare2 = 0x1, new_spare3 = 0x6
[RTC] bbpu = 0x1, con = 0x407
[pmic_detect_powerkey_PL] Release
hw_set_cc: 450
hw_set_cc: done
[PLFM] USB/charger boot!
hw_set_cc: 450
hw_set_cc: done
[RTC] Check SW Long Press RST = 0xD40
[RTC] Clear SW Long Press RST = 0x540
[RTC] Recored Long Press RST = 0x540
[RTC] EXT32k Mode 
[RTC] EXT32k Mode, DCXO REG Value 0x854=0x2807, 0x85c=0xF07, 0x83e=0xA86A
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x45>
msdc <0> <HYNIX > <SEM08G>
msdc <1> <xxxxxx> <SEM08G>
msdc failed to find
=========use hc erase size
check card state<4>
[SD0] Write error (1)
[SD0] Fail to send(CMD50) sandisk fwid 1
[EMI] DDR3
[EMI] eMMC/NAND ID = 45,1,0,53,45,4D,30,38,47
[EMI] MDL number = 0
[mt_pll_init] =793Mhz 
init ddr3 x32
18
40
Test 0701rank 0 coarse = 18
Test 0701rank 0 fine = 40
00:|
opt_dle value:9
[MEM]CONA312E,conf1:F07486E1
DQS loop = 15, cmp_err_1 = FF76FFF1 
DQS loop = 14, cmp_err_1 = FF26FD10 
DQS loop = 13, cmp_err_1 = FF047800 
DQS loop = 12, cmp_err_1 = 7F045000 
DQS loop = 11, cmp_err_1 = 5F004000 
DQS loop = 10, cmp_err_1 = 44004000 
DQS loop = 9, cmp_err_1 = 4000000 
DQS loop = 8, cmp_err_1 = 0 
DQ loop=15, cmp_err_1 = 8B00FF
DQ loop=14, cmp_err_1 = 82000B
DQ loop=13, cmp_err_1 = 20002
DQ loop=12, cmp_err_1 = 2
DQ loop=11, cmp_err_1 = 2
DQ loop=10, cmp_err_1 = 0
TX DQM-0x10, data:0xDCCC
TX DQ[0~7]-0x200, data:0xDDDDCDBD
TX DQ[8~15]-0x204, data:0xCECDCCBC
TX DQ[16~23]-0x208, data:0xBCDCCECC
TX DQ[24~31]-0x20C, data:0xCEDDDEDD
TX DQS-0x14, data:0xDEDF
[EMI] DRAMC calibration passed

[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824 
[Dram_Buffer] structure size: 1557616 
[Dram_Buffer] structure size2: 512 
Note:Close NFI Clock:Success!
[PLFM] Init Boot Device: OK(0)
[platform_vusb_on] PASS
m=0 type = 1
[PL] mt_charger_type_detection : SW workaround for USB
m=64 type = 1

[PLFM] USB cable in
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[USBD] USB High Speed
[TOOL] Enumeration(End): OK 535ms 
[TOOL] sync time 199ms
[BLDR] unknown received: 'READYREA'
Device APC domain init setup:
DEVAPC2_MAS_DOM Setup (0x0)
DEVAPC3_MAS_DOM Setup (0x0)
Device APC domain after setup:
DEVAPC2_MAS_DOM Setup (0x0)
DEVAPC3_MAS_DOM Setup (0x0)
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh
[PART] size : 432528
[PART] magic: 58881688h
[PART] This is a production device.
[PART] Verifying LK...
[HW CRYPTO PL] AXI = 0x0000885B
[HW CRYPTO PL] AXI = 0x0000885B
[HW CRYPTO PL] AXI = 0x0000885B
[HW CRYPTO PL] AXI = 0x0000885B
[VERIFY_LK] Succeed to pass the LK verification.

[PART] load "4" from 0x0000000001F00200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 1642KB/s, 432528 bytes, 257ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[HW CRYPTO PL] AXI = 0x0000885B
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh
[PART] size : 1190256
[PART] magic: 58881688h

[PART] load "2" from 0x0000000001500200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 2000KB/s, 2048 bytes, 1ms
[BLDR_MTEE] Succeed to verify mtee image header
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh
[PART] size : 1190256
[PART] magic: 58881688h

[PART] load "2" from 0x0000000001500200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 13836KB/s, 1190256 bytes, 84ms
[BLDR_MTEE] Succeed to verify mtee image header
[BLDR_MTEE] sha256 takes 9 (ms) for 1189680 bytes
[BLDR_MTEE] rsa2048 takes 72 (ms)
[BLDR_MTEE] 0xB1 B1 23 E6 57 6D E6 AB 4D A9 3C C6 32 BB E5 7 78 9C 21 86 44 BF 3B E8 C6 6C C9 4F B7 EF B6 33 96 4E C4 B8 89 40 20 FA EB A6 8B 99 20 92 EC D6 5F 61 17 87 CE 97 E4 B3 86 4C A9 44 46 3A 13 76 F2 AE 33 44 B4 D4 4B 89 65 16 2E 74 C1 66 86 E6 D8 63 CC 24 59 3C 83 E7 2B 62 53 2E 5D B7 A2 CC 58 52 9E 72 2 82 BC A3 8B C0 C6 ED D0 98 EB 26 4C E6 28 CD E0 24 BB CA 5 C8 A8 DC 3A E3 AC 9B 91 1D 1B 75 D 96 BF 8C 51 21 F F4 62 2C 99 5A 91 65 17 F1 60 57 EE 9B 65 2 16 D6 DA DB 56 8C 40 D 58 C2 4D A8 C0 E2 28 8F 9 B1 4F E9 1D 56 FE 19 6B B4 CE 62 44 1F BC 63 E5 26 5 76 90 8A 85 B5 1 4D 26 AC 2B BA 4E 61 74 5A F0 44 BB E E2 13 9C 9D D1 F6 E8 A E5 AB F1 77 74 B0 D 5C A4 E D5 CD 9B 5C 90 EA 9A B3 F3 D4 6C B8 A0 6F D8 FB 7E 42 AF B6 86 EC BF 8D FE 9C 2E 4A 3D 6F 
[BLDR_MTEE] 0x38 D D3 26 64 AB 23 AB C 50 5 66 95 50 8B 14 7B 1B DA B9 FB 6C EA 60 DD 52 59 3A 25 64 16 6C DB 87 7E ED 98 46 76 20 4A C5 76 30 28 8C 8D CC 7B 67 28 36 D8 96 EC 50 4A FE 2D 3 4A 5D BF EB 25 B9 BF D C3 87 B6 4E 4E 17 28 7B F2 32 D4 EC D5 55 31 B2 A3 8D C8 45 DB 99 B8 8B E4 22 9C FC 78 C5 5D E3 79 3A 76 E7 A5 9A 48 E5 D3 3C 59 7 BA 1A 46 19 FB 4A ED 6A D 2A D6 5F EC DE 40 4 B6 80 BB 1F DD BA A4 AE 3 AD A6 DE 98 A4 38 45 12 23 29 82 75 9E 95 5 38 BD D1 B8 A7 6A 52 C 7C 5 F3 4C C1 F5 60 C8 32 3A A1 C4 38 29 5 15 3E 58 F8 1E 1C 21 15 60 CD B0 5A 6F BC 5D 23 B8 A1 54 DF 6D 11 15 D8 C2 8A 21 5A 22 9A 8D CC B8 5A C7 2 D1 E7 66 C9 BC C6 D3 4D AF AD 95 FE 5C DA 56 52 41 C5 AE 7F F9 3B 39 71 7D A1 1F F2 3 B5 2D 4E 95 7C CD 3C E4 89 80 3C 5E A7 AC 63 BC 
[BLDR_MTEE] 0x77 A3 6 C6 D6 5D 15 97 19 EB B5 E2 67 B8 21 96 F7 78 8A 93 87 BA 49 4 7D 44 CD C0 F 56 2E EF 
[BLDR_MTEE] verify pkcs#1 pss takes 0 (ms)
[BLDR_MTEE] aes128cbc takes 12 (ms) for 1189680
[BLDR_MTEE] tee img ver: 0x3006 (<=0x0000FFFF)
[HW CRYPTO PL] AXI = 0x0000885B
[BLDR_MTEE] succeed to load mtee image from TEE1 patition at address 0xB8A00000 (required ext mem size: 0x07600000)
[PLFM] ram_console(0x0)=0x0 (boot reason)
[BT_SD_PG] device info 0x8135 0x8A00 0xCB01 0x202
0:dram_rank_size:40000000
[PLFM] Succedd to adjust dram size in boot args

[PLFM] boot reason: 1
[PLFM] boot mode: 0
[PLFM] META COM0: 0
[PLFM] <0xAFB53C10>: 0x0
[PLFM] boot time: 2219ms

[BLDR] jump to 0xB8A00000
[BLDR] <0xB8A00000>=0xE24F4008
[BLDR] <0xB8A00004>=0xE59F545C
[TZ_SEC]Start world switch from secure to non-secure world.
[0] [LK_pmic6397_init] Start...................
[0] [LK_PMIC_INIT] PMIC CID=0x4097
[0] [LK_PMIC_INIT_SETTING_V1] Done
[0] [LK_PMIC_CUSTOM_SETTING_V1] Done
[0] [LK]PMIC_TOP_CKCON3: 0x0000
[0] [LK]PWRAP_EVENT GPIO dir: 0, mode=1, in=0, out=0, pull_en=1, pull_sel=0
[0] 
LK Ver=8CE3747 (BUILD@IP_10_11_19_140)
[110] idme_initialize
[110] life_cycle_platform_init: Support MTK platform
[120] board.board_type: 0x12
[120] board.board_revision: 0x7
[120] [LK/LCM] GPIO110/66/65 - Control PANEL/PWM/VSYS
[410] [LK_ENV]ENV initialize success
[560] [AUXADC] adc_result_temp=895, adc_result=4195, r_val_temp=4
[640] [AUXADC] adc_result_temp=589, adc_result=690, r_val_temp=1
[640] BattVoltToTemp() : TBAT_OVER_CRITICAL_LOW = 499900
[650] BattVoltToTemp() : RBAT_PULL_UP_VOLT = 1200
[650] BattVoltToTemp() : dwVolt = 690
[660] BattVoltToTemp() : TRes = 32470
[660] BattVoltToTemp() : sBaTTMP = 33
[660] is_low_battery, FALSE
[670] Normal Mode:RTC_PDN1=0x1200,RTC_SPAR0=0x540
[680] Normal Mode:powerkey1=0xa357,powerkey2=0x67d2
[680] [RTC-LK]:irqsta = 0x0, pdn1 = 0x1200, pdn2 = 0x201, spar0 = 0x540, spar1 = 0x0
[690] [pmic_detect_powerkey] Release
[790] [AUXADC] adc_result_temp=895, adc_result=4195, r_val_temp=4
[800] g_boot_mode = 8
[800] check VBAT=4195 mV with 3500 mV
[870] [AUXADC] adc_result_temp=589, adc_result=690, r_val_temp=1
[880] BattVoltToTemp() : TBAT_OVER_CRITICAL_LOW = 499900
[890] BattVoltToTemp() : RBAT_PULL_UP_VOLT = 1200
[890] BattVoltToTemp() : dwVolt = 690
[890] BattVoltToTemp() : TRes = 32470
[900] BattVoltToTemp() : sBaTTMP = 33
[900] [mt65xx_bat_init] bq24297 init
[900] [pmic_init_for_bq24297] Start
[910] [pmic_init_for_bq24297] Done
[910] [bq24297_dump_register] Reg[0x0]=0x4A
[910] [bq24297_dump_register] Reg[0x1]=0xB
[920] [bq24297_dump_register] Reg[0x2]=0x64
[920] [bq24297_dump_register] Reg[0x3]=0x10
[930] [bq24297_dump_register] Reg[0x4]=0xB2
[930] [bq24297_dump_register] Reg[0x5]=0x8C
[940] [bq24297_dump_register] Reg[0x6]=0x73
[940] [bq24297_dump_register] Reg[0x7]=0x49
[940] [bq24297_dump_register] Reg[0x8]=0x44
[950] [bq24297_dump_register] Reg[0x9]=0x0
[950] [bq24297_dump_register] Reg[0xA]=0x60
[960] use BQ24297 charger detection
[960] count=0, vbus_stat=1, charger_type=1
[970] [BATTERY:bq24297] Set Aston/Ariel vindpm 4.60V
[990] [BATTERY:bq24297] pchr_turn_on_charging_bq24297 !
[1000] [BATTERY:bq24297] bq24297_set_ac_current 
[1000] [BATTERY:bq24297] productid2 = 0111
[1010] [BATTERY:bq24297] Set Aston charging current
[1020] [BATTERY:bq24297] pchr_turn_off_charging_bq24297!
[1030] ###### 100 <-> voltage : 4189 ######
[1030] [BATTERY] check_point_sync_leds  battery_level = 100 
[1040] [RTC-LK]:irqsta = 0x0, pdn1 = 0x1200, pdn2 = 0x201, spar0 = 0x440, spar1 = 0x0
[1040] mtk_write_shutdown_reason: shutdown_reason 0x1
[1050] [bq24297_dump_register] Reg[0x0]=0x4A
[1050] [bq24297_dump_register] Reg[0x1]=0xB
[1060] [bq24297_dump_register] Reg[0x2]=0x64
[1060] [bq24297_dump_register] Reg[0x3]=0x10
[1070] [bq24297_dump_register] Reg[0x4]=0xB2
[1070] [bq24297_dump_register] Reg[0x5]=0x9C
[1080] [bq24297_dump_register] Reg[0x6]=0x73
[1080] [bq24297_dump_register] Reg[0x7]=0x48
[1090] [bq24297_dump_register] Reg[0x8]=0x44
[1090] [bq24297_dump_register] Reg[0x9]=0x0
[1090] [bq24297_dump_register] Reg[0xA]=0x60
[1100] bootcount = 3306
[1110]  > page count of kernel image = 14379
[2400] Verifying kernel...
This is LK-payload by xyz. Copyright 2019
Original version for sloane by k4y0z and t0x1cSH. Copyright 2020
Ported to ariel ariel by R0rt1z2. Copyright 2024
found lk at 0x00007800
found boot_x at 0x00007C00
found recovery_x at 0x0000BC00
found misc at 0x00010C00
found boot at 0x00429000
found recovery at 0x00438000
g_boot_mode 8
f_boot_mode 0
bootloader_msg: 
Clean lk
[2510] bootcount = 3307
read_func hook
block_off 0x0000000A 0x86200000
dev 0x81E6C7B0 dst 0x81E8B460 sz 0x00000260
[2520]  > page count of kernel image = 2563
read_func hook
block_off 0x0000000A 0x86200000
dev 0x81E6C7B0 dst 0x80207800 sz 0x005B3000
[2790] Device or user build unlocked, or non user build on engineering device! Skip kernel verification.
[2830] booting linux @ 0x80208000, ramdisk @ 0x84000000 (721073)
[2830] [pmic_detect_powerkey] Release
[2830] mtk_write_boot_reason: current 0x81c boot_reason 0x104
[2830] mtk_write_special_mode: special_mode 0x0
[2830] DRAM Rank :1
[2830] DRAM Rank[0] Size = 0x38a00000
[2830] cmdline: console=tty0 console=ttyMT3,115200n1 root=/dev/ram androidboot.unlocked_kernel=true androidboot.prod=1 lcm=1-nt51012_wxga_dsi_vdo fps=5934 androidboot.serialno=0092060644640W30 printk.disable_uart=1 bootprof.pl_t=2219 bootprof.lk_t=3116 bootprof.[2830] lk boot time = 3116 ms
[2830] lk boot reason = 1
[2830] lk boot mode = 8
[2830] lk finished --> jump to linux kernel

TargetStart=80208000
FreeStart=811E13E8
FreeEnd=811F13E8
DataStart=80CE38AC
Uncompressing Linux... done, booting the kernel.
shell@android:/ $