[Hardware Hacking General] AdamOutler:
I have a Meizu MX HK version(now my wife's phone) in front of me. I tried running viewmem on it..

shell@android:/data/local/tmp # ./viewmem 0x02020000 0x10000
[INFO] Reading 65536 bytes at 0x2020000...
[2] + Stopped (signal) ./viewmem 0x02020000 0x10000
[1] - Bus error ./viewmem 0x02000000 0x10000
shell@android:/data/local/tmp #

so then I tried from a UART prompt.

root@android:/data/local/tmp # ./viewmem 0x02020000 0x10000
[INFO] Reading 65{0}[ 100.815755] Unhandled fault: external abort on non-linefetch (0x018) at 0x400fc000
536 bytes at 0x2020000...
{0}[ 101.126633] Unhandled fault: external abort on non-linefetch (0x018) at 0x400fc000
[1] + Stopped (signal) ./viewmem 0x02020000 0x10000
{0}[ 101.417026] Unhandled fault: external abort on non-linefetch (0x018) at 0x400fc000
root@android:/data/local/tmp #

Rebellos, can you tell anything by these kernel messages? external abort on non-linefetch? These are kinda cryptic but I guess it's saying the input was aborted?

Anyway.. I then tried to analyze the bootloader messages...

OK

U-Boot 2010.12-svn_ver_6708 (Jun 13 2012 - 18:46:00) for MEIZU MX Oversea

CPU: S5PC220 [Samsung SOC on SMP Platform Base on ARM CortexA9]
APLL = 600MHz, MPLL = 800MHz
DRAM: 1023 MiB
TrustZone Enabled BSP
BL1 version: 20120510

Checking Boot Mode ... EMMC4.41
REVISION: 1.1
there are pending interrupts 0x00000001
NAME: S5P_MSHC4
eMMC OPEN Success.!!
!!!Notice!!!
!You must close eMMC boot Partition after all image writing!
!eMMC boot partition has continuity at image writing time.!
!So, Do not close boot partition, Before, all images is written.!
eMMC CLOSE Success.!!
eMMC OPEN Success.!!
!!!Notice!!!
!You must close eMMC boot Partition after all image writing!
!eMMC boot partition has continuity at image writing time.!
!So, Do not close boot partition, Before, all images is written.!
eMMC CLOSE Success.!!
MMC Device 0: 30432 MB
MMC Device 1 not found
NAME: S5P_MSHC4
*** Warning - using default environment

Not factory mode
CHARGE_MODE_BOOT
inform = 0x01000000
reconfig inform4 0x01000000
tiny_kernel_type = 0
Press ctrl+c to stop autoboot: 0
reading kernel..device 0 Start 4096, Count 10240
MMC read: dev # 0, block # 4096, count 10240 ... 10240 blocks read: OK
completed
reading RFS..device 0 Count 24576, Start 10240
MMC read: dev # 0, block # 24576, count 10240 ... 10240 blocks read: OK
completed
eMMC OPEN Success.!!
!!!Notice!!!
!You must close eMMC boot Partition after all image writing!
!eMMC boot partition has continuity at image writing time.!
!So, Do not close boot partition, Before, all images is written.!
reading FWBL1 ..device 0 Start 0, Count 30
MMC read: dev # 0, block # 0, count 30 ... 30 blocks read: OK
completed
eMMC CLOSE Success.!!
eMMC OPEN Success.!!
!!!Notice!!!
!You must close eMMC boot Partition after all image writing!
!eMMC boot partition has continuity at image writing time.!
!So, Do not close boot partition, Before, all images is written.!
reading FWBL1 ..device 0 Start 0, Count 30
MMC read: dev # 0, block # 0, count 30 ... 30 blocks read: OK
completed
eMMC CLOSE Success.!!
Boot with zImage
## Loading init Ramdisk from Legacy Image at 41000000 ...
Image Name: ramdisk
Image Type: ARM Linux RAMDisk Image (uncompressed)
Data Size: 331777 Bytes = 331777 Load Address: 40800000
Entry Point: 40800000

Starting kernel ...

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
{0}[ 0.000000] Initializing cgroup subsys cpu
{0}[ 0.000000] Linux version 3.0.15-oversea-svn7447 (root@cefanty-desktop) (gcc version 4.4.3 (GCC) ) #2 SMP PREEMPT2
{0}[ 0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c5387d
{0}[ 0.000000] CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
{0}[ 0.000000] Machine: MX
{0}[ 0.000000] Memory policy: ECC disabled, Data cache writealloc
{0}[ 0.000000] Support Trustzone Feature
{0}[ 0.000000] S3C24XX Clocks, Copyright 2004 Simtec Electronics
{0}[ 0.000000] s3c_register_clksrc: clock audiocdclk has no registers set
{0}[ 0.000000] audiocdclk: no parent clock specified
{0}[ 0.000000] s3c_register_clksrc: clock armclk has no registers set
{0}[ 0.000000] uclk1: source is mout_mpll_user (6), rate is 100000000
{0}[ 0.000000] uclk1: source is mout_mpll_user (6), rate is 100000000
{0}[ 0.000000] uclk1: source is mout_mpll_user (6), rate is 100000000
{0}[ 0.000000] uclk1: source is mout_mpll_user (6), rate is 100000000
{0}[ 0.000000] sclk_csis: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_csis: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_cam0: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_cam1: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimc: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimc: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimc: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimc: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimd: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_fimd: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] sclk_mfc: source is mout_mfc0 (0), rate is 50000000
{0}[ 0.000000] sclk_g3d: source is mout_g3d0 (0), rate is 50000000
{0}[ 0.000000] sclk_pwi: source is xusbxti (1), rate is 1500000
{0}[ 0.000000] PERCPU: Embedded 5 pages/cpu @c185f000 s6848 r0 d13632 u32768
{0}[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 259842
{0}[ 0.000000] Kernel command line: console=ttySAC3,115200n8 androidboot.console=ttySAC3
{0}[ 0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
{0}[ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
{0}[ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
{0}[ 0.000000] Memory: 1023MB = 1023MB total
{0}[ 0.000000] Memory: 873048k/873048k available, 174504k reserved, 293888K highmem
{0}[ 0.000000] Virtual kernel memory layout:
{0}[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
{0}[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
{0}[ 0.000000] DMA : 0xfea00000 - 0xffe00000 ( 20 MB)
{0}[ 0.000000] vmalloc : 0xee800000 - 0xf6000000 ( 120 MB)
{0}[ 0.000000] lowmem : 0xc0000000 - 0xee000000 ( 736 MB)
{0}[ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
{0}[ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
{0}[ 0.000000] .init : 0xc0008000 - 0xc003c000 ( 208 kB)
{0}[ 0.000000] .text : 0xc003c000 - 0xc06f8000 (6896 kB)
{0}[ 0.000000] .data : 0xc06f8000 - 0xc0765ce0 ( 440 kB)
{0}[ 0.000000] .bss : 0xc0765d04 - 0xc08a73f8 (1286 kB)
{0}[ 0.000000] SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
{0}[ 0.000000] Preemptible hierarchical RCU implementation.
{0}[ 0.000000] NR_IRQS:456
{0}[ 0.000000] Calibrating delay loop... 1195.21 BogoMIPS (lpj=2988032)
{0}[ 0.060000] pid_max: default: 32768 minimum: 301
{0}[ 0.060000] Mount-cache hash table entries: 512
{0}[ 0.060000] Initializing cgroup subsys debug
{0}[ 0.060000] Initializing cgroup subsys cpuacct
{0}[ 0.060000] Initializing cgroup subsys freezer
{0}[ 0.060000] CPU: Testing write buffer coherency: ok
{0}[ 0.060000] CPU0: thread -1, cpu 0, socket 10, mpidr 80000a00
{0}[ 0.060000] L310 cache controller enabled
{0}[ 0.060000] l2x0: 16 ways, CACHE_ID 0x4100c4c8, AUX_CTRL 0x7e470001, Cache size: 1048576 B
{1}[ 0.100000] CPU1: Booted secondary processor
{1}[ 0.100000] CPU1: thread -1, cpu 1, socket 10, mpidr 80000a01
{2}[ 0.130000] CPU2: Booted secondary processor
{2}[ 0.130000] CPU2: thread -1, cpu 2, socket 10, mpidr 80000a02
{3}[ 0.160000] CPU3: Booted secondary processor
{3}[ 0.160000] CPU3: thread -1, cpu 3, socket 10, mpidr 80000a03
{0}[ 0.170000] Brought up 4 CPUs
{0}[ 0.170000] SMP: Total of 4 processors activated (4780.85 BogoMIPS).
{0}[ 0.185000] print_constraints: dummy:
{0}[ 0.190000] NET: Registered protocol family 16
{0}[ 0.190000] ram_console: ram_console_module_init
{0}[ 0.190000] Registered chained gpio int handler for interrupt 111.
{0}[ 0.190000] Registered interrupt support for gpio group 9.
{0}[ 0.210000] ram_console: got buffer at 6dfd4000, size 1f000
{0}[ 0.210000] ram_console: found existing buffer, size 47577, start 47577
{0}[ 0.310000] console [ram-1] enabled
{0}[ 0.310000] ram_console: Boot from: 1, software reboot, 12582925
{0}[ 0.315000] ram_console: Boot stat:
{0}[ 0.315000] ram_console: 0, fresh boot, 2147483649
{0}[ 0.315000] ram_console: 1, software reboot, 12582925
{0}[ 0.315000] ram_console: 2, oops reboot, 0
{0}[ 0.315000] ram_console: 3, panic reboot, 0
{0}[ 0.315000] ram_console: 4, halt reboot, 70368744177664
{0}[ 0.315000] ram_console: 5, poweroff reboot, 1
{0}[ 0.315000] ram_console: 6, kexec reboot, 0
{0}[ 0.315000] ram_console: 7, emerg reboot, 18015223143202816
{0}[ 0.315000] ram_console: 8, warm reset, 0
{0}[ 0.315000] ram_console: 9, watchdog reset, 0
{0}[ 0.315000] ram_console: 10, pin reset, 1
{0}[ 0.315000] ram_console: 11, unknow reason, 0
{0}[ 0.315000] S3C Power Management, Copyright 2004 Simtec Electronics
{0}[ 0.320000] samsung-pd samsung-pd.0: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.1: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.2: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.5: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.4: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.6: power domain registered
{0}[ 0.320000] samsung-pd samsung-pd.7: power domain registered
{0}[ 0.325000] samsung-pd samsung-pd.8: power domain registered
{0}[ 0.325000] s3c24xx-pwm s3c24xx-pwm.0: tin at 100000000, tdiv at 100000000, tin=divclk, base 0
{0}[ 0.325000] s3c24xx-pwm s3c24xx-pwm.1: tin at 100000000, tdiv at 100000000, tin=divclk, base 8
{0}[ 0.325000] UMP: UMP device driver 7447 loaded
{0}[ 0.365000] bio: create slab <bio-0> at 0
{0}[ 0.365000] registered panel driver(ls040b3sx01) to mipi-dsi driver.
{0}[ 0.365000] print_constraints: VDD_1.8V: 1800 mV
{0}[ 0.365000] print_constraints: DC_5V: 5000 mV
{0}[ 0.365000] print_constraints: VDD_3.3V: 3300 mV
{0}[ 0.365000] print_constraints: VDD_5.5V: 5500 mV
{0}[ 0.365000] print_constraints: SPDIF 1.8V: 1800 mV
{0}[ 0.365000] print_constraints: SENSOR_POWER 2.8V: 2800 mV
{0}[ 0.370000] print_constraints: iNAND_POWER 2.8V: 2800 mV
{0}[ 0.370000] print_constraints: HSIC_1.0V: 1000 mV
{0}[ 0.370000] print_constraints: VDD_1.0V: 1000 mV
{0}[ 0.370000] print_constraints: VDD_1.2V: 1200 mV
{0}[ 0.370000] print_constraints: VDD_1.2V: 1200 mV
{0}[ 0.370000] rdev_init_debugfs: VDD_1.2V: Failed to create debugfs directory
{0}[ 0.375000] i2c-core: driver [bu26507-led] using legacy suspend method
{0}[ 0.375000] i2c-core: driver [bu26507-led] using legacy resume method
{0}[ 0.375000] SCSI subsystem initialized
{0}[ 0.375000] usbcore: registered new interface driver usbfs
{0}[ 0.375000] usbcore: registered new interface driver hub
{0}[ 0.380000] usbcore: registered new device driver usb
{0}[ 0.380000] i2c-gpio i2c-gpio.8: using pins 67 (SDA) and 74 (SCL)
{0}[ 0.380000] i2c-gpio i2c-gpio.9: using pins 274 (SDA) and 275 (SCL)
{0}[ 0.380000] i2c-gpio i2c-gpio.10: using pins 269 (SDA) and 270 (SCL)
{0}[ 0.380000] i2c-gpio i2c-gpio.11: using pins 287 (SDA) and 288 (SCL)
{0}[ 0.385000] i2c-gpio i2c-gpio.12: using pins 170 (SDA) and 169 (SCL)
{0}[ 0.400000] bu26507_i2c_probe: doned
{0}[ 0.400000] i2c-gpio i2c-gpio.13: using pins 77 (SDA) and 75 (SCL)
{0}[ 0.400000] s3c-i2c s3c2440-i2c.0: i2c-0: S3C I2C adapter
{0}[ 0.400000] s3c-i2c s3c2440-i2c.1: i2c-1: S3C I2C adapter
{0}[ 0.400000] max77686 3-0009: device found, device_id = 2
{0}[ 0.405000] max77686_irq_init+
{0}[ 0.405000] max77686_irq_lock
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.405000] max77686_irq_lock
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.405000] max77686_irq_lock
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.405000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.410000] max77686_irq_lock
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.410000] max77686_irq_lock
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.410000] max77686_irq_lock
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.410000] max77686_irq_lock
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.410000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.415000] max77686_irq_lock
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.415000] max77686_irq_lock
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.415000] max77686_irq_lock
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.415000] max77686_irq_lock
{0}[ 0.415000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.420000] max77686_irq_lock
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.420000] max77686_irq_lock
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.420000] max77686_irq_lock
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.420000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.425000] max77686_irq_lock
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.425000] max77686_irq_lock
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[0]=0x4, cur=0xff
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[1]=0x5, cur=0xff
{0}[ 0.425000] max77686_irq_sync_unlock: mask_reg[2]=0x1, cur=0xff
{0}[ 0.425000] max77686_irq_init-
{0}[ 0.430000] print_constraints: vdd_mif range: 850 <--> 1050 mV at 1050 mV
{0}[ 0.430000] print_constraints: vdd_arm range: 600 <--> 1400 mV at 1100 mV
{0}[ 0.435000] print_constraints: vdd_int range: 850 <--> 1037 mV at 1000 mV
{0}[ 0.435000] print_constraints: vdd_g3d range: 850 <--> 1200 mV at 1050 mV
{0}[ 0.435000] print_constraints: vdd_mem_on: 1200 mV
{0}[ 0.435000] print_constraints: vdd_1.35v: 1350 mV
{0}[ 0.435000] print_constraints: vdd_2.00v: 2000 mV
{0}[ 0.440000] print_constraints: vdd_2.80v: 2800 mV
{0}[ 0.440000] print_constraints: vdd_ldo1 range: 1000 mV
{0}[ 0.440000] print_constraints: vdd_ldo2 range: 1200 mV
{0}[ 0.440000] print_constraints: vdd_ldo3 range: 1800 mV
{0}[ 0.445000] print_constraints: vdd_ldo4 range: 2800 mV
{0}[ 0.445000] print_constraints: vdd_ldo6 range: 1000 mV
{0}[ 0.445000] print_constraints: vdd_ldo7 range: 1000 mV
{0}[ 0.450000] print_constraints: vdd_ldo11 range: 1800 mV
{0}[ 0.450000] print_constraints: vdd_ldo14 range: 1800 mV
{0}[ 0.450000] print_constraints: vdd_ldo22 range: 2800 mV
{0}[ 0.450000] print_constraints: CAM0_ISP_1.2V: 1200 mV
{0}[ 0.455000] print_constraints: CAM_1.8V: 1800 mV
{0}[ 0.455000] print_constraints: vdd_ldo8 range: 1000 mV
{0}[ 0.455000] print_constraints: GPS_1.8V: 1800 mV
{0}[ 0.455000] print_constraints: vdd_ldo10 range: 1800 mV
{0}[ 0.460000] print_constraints: vdd_ldo12 range: 3000 mV
{0}[ 0.460000] print_constraints: vdd_ldo13 range: 1800 mV
{0}[ 0.460000] print_constraints: vdd_ldo15 range: 1000 mV
{0}[ 0.465000] print_constraints: vdd_ldo16 range: 1800 mV
{0}[ 0.465000] print_constraints: CAM0_SENSOR_1.2V: 1200 mV
{0}[ 0.465000] print_constraints: vdd_ldo18 range: 1800 mV
{0}[ 0.465000] print_constraints: vdd_ldo19 range: 1800 mV
{0}[ 0.470000] print_constraints: vdd_ldo20 range: 1200 mV
{0}[ 0.470000] print_constraints: CAM1_2.8V: 2800 mV
{0}[ 0.470000] print_constraints: CAM0_SENSOR_2.7V: 2700 mV
{0}[ 0.475000] print_constraints: CAM0_AF_2.7V: 2700 mV
{0}[ 0.475000] print_constraints: vdd_ldo25 range: 2800 mV
{0}[ 0.475000] print_constraints: vdd_ldo26 range: 3000 mV
{0}[ 0.475000] print_constraints: 32KHZ_PMIC:
{0}[ 0.475000] s3c-i2c s3c2440-i2c.3: i2c-3: S3C I2C adapter
{0}[ 0.480000] max77665 4-0066: device ID: 0x2
{0}[ 0.495000] [drivers/regulator/max77665.c:643] pdata->num_regulators:6
{0}[ 0.495000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.500000] print_constraints: safeout1 range: at 4900 mV
{0}[ 0.500000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.500000] print_constraints: safeout2 range: at 4900 mV
{0}[ 0.500000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.500000] print_constraints: CHARGER: 60 <--> 2580 mA at 460 mA
{0}[ 0.500000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.500000] print_constraints: FLASH LED: 15 <--> 1000 mA at 312 mA
{0}[ 0.505000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.505000] print_constraints: TORCH LED: 15 <--> 250 mA at 15 mA
{0}[ 0.505000] [drivers/regulator/max77665.c:649] for in pdata->num_regulators:6
{0}[ 0.505000] #### max77665_reverse_reg_disable
{0}[ 0.505000] print_constraints: REVERSE:
{0}[ 0.505000] s3c-i2c s3c2440-i2c.4: i2c-4: S3C I2C adapter
{0}[ 0.505000] s3c-i2c s3c2440-i2c.5: i2c-5: S3C I2C adapter
{0}[ 0.510000] s3c-i2c s3c2440-i2c.6: i2c-6: S3C I2C adapter
{0}[ 0.510000] s3c-i2c s3c2440-i2c.7: i2c-7: S3C I2C adapter
{0}[ 0.510000] Advanced Linux Sound Architecture Driver Version 1.0.24.
{0}[ 0.510000] 0-003e: A1028: load a1028_24m_soc_fw.bin
{0}[ 0.515000] Bluetooth: Core ver 2.16
{0}[ 0.515000] NET: Registered protocol family 31
{0}[ 0.515000] Bluetooth: HCI device and connection manager initialized
{0}[ 0.515000] Bluetooth: HCI socket layer initialized
{0}[ 0.515000] Bluetooth: L2CAP socket layer initialized
{0}[ 0.515000] Bluetooth: SCO socket layer initialized
{0}[ 0.515000] Switching to clocksource mct-frc
{0}[ 0.516593] Switched to NOHz mode on CPU #0
{2}[ 0.517035] Switched to NOHz mode on CPU #2
{3}[ 0.517047] Switched to NOHz mode on CPU #3
{1}[ 0.517066] Switched to NOHz mode on CPU #1
{0}[ 0.519777] NET: Registered protocol family 2
{0}[ 0.520532] IP route cache hash table entries: 32768 (order: 5, 131072 bytes)
{0}[ 0.522737] TCP established hash table entries: 131072 (order: 8, 1048576 bytes)
{0}[ 0.525616] TCP bind hash table entries: 65536 (order: 8, 1572864 bytes)
{0}[ 0.528280] TCP: Hash tables configured (established 131072 bind 65536)
{0}[ 0.528574] TCP reno registered
{0}[ 0.528790] UDP hash table entries: 512 (order: 3, 32768 bytes)
{0}[ 0.529137] UDP-Lite hash table entries: 512 (order: 3, 32768 bytes)
{0}[ 0.530125] NET: Registered protocol family 1
{0}[ 0.530785] Trying to unpack rootfs image as initramfs...
{0}[ 0.561988] Freeing initrd memory: 324K
{0}[ 0.562479] PMU: registered new PMU device of type 0
{0}[ 0.562939] A1028: starting to load fw ...
{3}[ 0.565431] input: wakeup_assist as /devices/platform/wakeup_assist.0/input/input0
{3}[ 0.566214] gps successfully probed!
{3}[ 0.567334] [BT] Device Powering ON
{3}[ 0.720484] [BT] Device Powering OFF
{3}[ 0.720753] [BT] driver loaded!
{3}[ 0.722616] Loaded driver for PL330 DMAC-0 s3c-pl330
{3}[ 0.722913] DBUFF-64x8bytes Num_Chans-8 Num_Peri-1 Num_Events-32
{3}[ 0.723311] Loaded driver for PL330 DMAC-1 s3c-pl330
{3}[ 0.723607] DBUFF-32x4bytes Num_Chans-8 Num_Peri-32 Num_Events-32
{3}[ 0.723995] Loaded driver for PL330 DMAC-2 s3c-pl330
{3}[ 0.724286] DBUFF-32x4bytes Num_Chans-8 Num_Peri-32 Num_Events-32
{3}[ 0.732479] highmem bounce pool size: 64 pages
{3}[ 0.733138] ashmem: initialized
{3}[ 0.753725] fuse init (API version 7.16)
{3}[ 0.755545] msgmni has been set to 1131
{3}[ 0.757968] io scheduler noop registered
{3}[ 0.758179] io scheduler deadline registered
{3}[ 0.758543] io scheduler cfq registered (default)
{3}[ 0.761055] crc32: CRC_LE_BITS = 64, CRC_BE BITS = 64
{3}[ 0.761345] crc32: self tests passed, processed 225944 bytes in 1119417 nsec
{3}[ 0.762677] crc32c: CRC_LE_BITS = 64
{3}[ 0.762967] crc32c: self tests passed, processed 225944 bytes in 557167 nsec
{3}[ 0.764305] s5p-mipi-dsim s5p-mipi-dsim.0: lcd_drv->id = -1, lcd_dev->id = -1
{3}[ 0.764604] s5p-mipi-dsim s5p-mipi-dsim.0: lcd_dev->bus_id = 0, dsim->id = 0
{0}[ 0.805050] ls040b3sx01_probe finish
{0}[ 0.819826] s5p-mipi-dsim s5p-mipi-dsim.0: DSI Master driver has been completed.
{0}[ 0.820152] s5p-mipi-dsim s5p-mipi-dsim.0: DSI Master state is stop state
{0}[ 0.839731] s5p-mipi-dsim s5p-mipi-dsim.0: mipi-dsi driver(RGB mode) has been probed.
{0}[ 0.841069] s3cfb s3cfb.0: [fb2] dma: 0x6d574000, cpu: 0xee871000, size: 0x004b0000
{0}[ 0.845902] s3cfb_draw_logo: draw mx logo:base=0xee871000, yres=960, xres=640, height=84, width=56
{0}[ 0.931713] s3cfb s3cfb.0: parent clock: 800000000, vclk: 38725000, vclk div: 21
{0}[ 0.932160] s3cfb s3cfb.0: registered successfully
{0}[ 0.933575] s5pv210-uart.0: ttySAC0 at MMIO 0x13800000 (irq = 16) is a S3C6400/10
{0}[ 1.045160] s5pv210-uart.1: ttySAC1 at MMIO 0x13810000 (irq = 20) is a S3C6400/10
{0}[ 1.125155] s5pv210-uart.2: ttySAC2 at MMIO 0x13820000 (irq = 24) is a S3C6400/10
{0}[ 1.205162] s5pv210-uart.3: ttySAC3 at MMIO 0x13830000 (irq = 28) is a S3C6400/10
{0}[ 2.995911] console [ttySAC3] enabled

....
....

{0}[ 3.199061] lis3dh: probe start.
{0}[ 3.202563] lis3dh: hw init start
{0}[ 3.211309] lis3dh: hw init done
{1}[ 3.215570] input: lis3dh as /devices/platform/i2c-gpio.9/i2c-9/9-0019/input/input3
{1}[ 3.223167] lis3dh 9-0019: lis3dh: probed
{1}[ 3.228301] input: gyroscope as /devices/platform/i2c-gpio.11/i2c-11/11-0069/input/input4
{1}[ 3.235577] l3g4200d_gyro_update_odr: poll_interval_us = 200000, set odr to 0
{0}[ 3.245960] print_constraints: AVDD1: 2400 <--> 3100 mV
{0}[ 3.252340] print_constraints: DCVDD: 1000 <--> 1300 mV
{0}[ 3.273149] wm8994 0-001a: WM8958 revision B
{0}[ 3.329504] wm8994 0-001a: No interrupt specified, no interrupts
{0}[ 3.335742] i2c-core: driver [wm8994] using legacy suspend method
{0}[ 3.340859] i2c-core: driver [wm8994] using legacy resume method
{0}[ 3.348180] PPP generic driver version 2.4.2
{2}[ 3.352260] PPP Deflate Compression module registered
{2}[ 3.357000] PPP BSD Compression module registered
{2}[ 3.362228] PPP MPPE Compression module registered
{2}[ 3.366975] NET: Registered protocol family 24
{2}[ 3.372116] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
{0}[ 3.380422] s5p-ehci s5p-ehci: power on usb PHY
{0}[ 3.383960] s5p-ehci s5p-ehci: Change USB MUX from Device to Host
{0}[ 3.390564] s5p-ehci s5p-ehci: S5P EHCI Host Controller
{0}[ 3.395796] s5p-ehci s5p-ehci: new USB bus registered, assigned bus number 1
{0}[ 3.403320] s5p-ehci s5p-ehci: irq 134, io mem 0x12580000
{0}[ 3.415073] s5p-ehci s5p-ehci: USB 0.0 started, EHCI 1.00
{0}[ 3.419705] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
{0}[ 3.426516] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
{0}[ 3.434058] usb usb1: Product: S5P EHCI Host Controller
{0}[ 3.439527] usb usb1: Manufacturer: Linux 3.0.15-oversea-svn7447 ehci_hcd
{0}[ 3.446472] usb usb1: SerialNumber: s5p-ehci
{0}[ 3.452121] hub 1-0:1.0: USB hub found
{0}[ 3.454978] hub 1-0:1.0: 3 ports detected
{0}[ 3.460175] Initializing USB Mass Storage driver...
{0}[ 3.464690] usbcore: registered new interface driver usb-storage
{0}[ 3.470608] USB Mass Storage support registered.
{3}[ 3.476159] s3c-udc : S3C HS USB OTG Device Driver,(c) 2008-2009 Samsung Electronics
{3}[ 3.476170] s3c-udc : version 15 March 2009
{3}[ 3.492126] android_usb gadget: Mass Storage Function, version: 2009/09/11
{3}[ 3.498016] android_usb gadget: Number of LUNs=1
{3}[ 3.502953] lun0: LUN: removable file: (no medium)
{3}[ 3.508575] android_usb gadget: android_usb ready
{3}[ 3.513022] Registered gadget driver 'android_usb'
{3}[ 3.520388] input: gpio-keys as /devices/platform/gpio-keys.0/input/input5
{0}[ 3.590260] A1028: fw load successfully
{0}[ 3.615070] A1028: set a1028 into Suspend mode
{0}[ 3.645590] atmel_mxt_ts 6-004a: Family ID: 129 Variant ID: 1 Version: 16 Build: 170
{0}[ 3.652345] atmel_mxt_ts 6-004a: Matrix X Size: 17 Matrix Y Size: 13 Object Num: 18
{0}[ 3.663021] input: m03x_ts as /devices/platform/s3c2440-i2c.6/i2c-6/6-004a/input/input6
{2}[ 3.670972] input: mx-touch-keypad as /devices/platform/s3c2440-i2c.6/i2c-6/6-004a/input/input7

......
.....

{0}[ 4.270918] S3C2410 Watchdog Timer, (c) 2004 Simtec Electronics
{0}[ 4.277442] s3c2410-wdt s3c2410-wdt: starting watchdog timer
{0}[ 4.282705] s3c2410-wdt s3c2410-wdt: watchdog active, reset enabled, irq disabled
{2}[ 4.290633] watchdog_thread: Enter into watchdog_thread

.........
.........

{0}[ 5.505978] charger_work_func, charger_status:1
{0}[ 5.510550] mxt_write_charger_param charger_status:1
{0}[ 5.646850] EXT4-fs warning (device mmcblk0p2): ext4_clear_journal_err:4153: Filesystem error recorded from previe
{0}[ 5.658134] EXT4-fs warning (device mmcblk0p2): ext4_clear_journal_err:4154: Marking fs in need of filesystem che.
{0}[ 5.670484] EXT4-fs (mmcblk0p2): warning: mounting fs with errors, running e2fsck is recommended
{1}[ 5.680379] EXT4-fs (mmcblk0p2): recovery complete
{1}[ 5.685806] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
{1}[ 5.694962] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
{1}[ 5.711443] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: noauto_da_alloc
{3}[ 5.752503] EXT4-fs (mmcblk0p4): mounted filesystem with ordered data mode. Opts: (null)
{1}[ 5.826504] EXT4-fs (mmcblk0p5): mounted filesystem with ordered data mode. Opts: (null)
{3}[ 5.834031] m6mo_mipi_cam_power():1
{1}[ 5.993173] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
{1}[ 6.005965] adb_bind_config
{3}[ 6.012931] warning: `adbd' uses 32-bit capabilities (legacy support in use)
{0}[ 6.019652] adb_open
{3}[ 6.072095] wm8994-codec wm8994-codec: fw= (null)!
root@android:/ #

I had to edit out parts of the above log. This UART device is /dev/ttySAC3, which i found interesting because on Samsung they are usually /dev/ttySAC2

This is a U-Boot device.. Amongst the messages I see press ... but ctrl+c does nothing at all. I can't get into the UART prompt. I suppose that inserting a custom U-Boot would render the TrustZone inoperative and then crash the device.. I don' t really know.. I don't have a way to recover yet either. So, any suggestions are appreciated.