[Fire Android Development] noelcragg:
serial console output

I bought one of these 7-inch Fire Tablets (5th generation) during the $35 sale a few weeks back. I purchased it from a big chain store, so it has model SV98LN rather than the KFFOWI reported by others in this forum, but everything else seems the same. After removing the rear panel, I looked around for test points on the motherboard. There were two conveniently labeled TX and RX. Poking around with a multimeter revealed that things were running at 1.8v. I found a good places to attach leads for VCC and GND, and connected them along with TX and RX to a spare FD232R-based serial adapter.

At 115200 baud (on-chip boot rom):

[DL] 00000000 00000000 010701

PR: 0001 01A6
F3: 0000 0000
V0: 0000 0000 [0001]
00: 1027 0002
01: 0000 0000
BP: 0000 0059
G0: 0182 0000
T0: 0000 0418
Jump to BL

Then at 921600 baud (preloader):

[USBD] USB PRB0 LineState: 0

[USBD] USB cable/ No Cable inserted!

[PLFM] Keep stay in USB Mode
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CLK26CALI = 0x90
mt_pll_post_init: mt_get_bus_freq = 273000Khz
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D52
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=1,rdata=800
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=8 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=1001
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=2003
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 0 TOP_RST_MISC: 0
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]

[BLDR] Build Time: 20150730-164940

At this point the port switches back to 115200 baud, emits "READY", and waits briefly for input (in case the flash programming tool is connected). After a short time, it switches back to 921000 baud and continues.

==== Dump RGU Reg ========
RGU MODE: 4D
RGU LENGTH: FFE0
RGU STA: 0
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
mtk_wdt_mode_config mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4001
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xE, con = 0xBFFA
rtc_first_boot_init
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3968
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
rtc_2sec_stat_clear
rtc_2sec_reboot_check cali=1536
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0xC0, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xE, con = 0x426, cali = 0x600
pl pmic powerkey Release
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[PLFM] USB/charger boot!
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0xC0
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x90>
msdc <0> <HYNIX > <H8G1e>
msdc <1> <xxxxxx> <H8G1e>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 90,1,4A,48,38,47,31,65,5,7,D0,C8,D4,FA,82,CB
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:12
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3C0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C8FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C9FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3CAFFh
4.2.CMPOT:0x3dc[31]:0h
N drive:9
drvp=0xC,drvn=0x9
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0010:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0011:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
0013:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
0014:| 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0
0015:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0
0016:| 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Rank 13 coarse tune value selection : 32,
20
64
rank 0 coarse = 20
rank 0 fine = 64
00:| 0 0 0 0 1 1 1 0
opt_dle value:9
[EMI]warning:rank auto detect:==single rank==
Change CMD/ADDR output delay = 15
Change CLK output delay = 15
20
80
Change CMD/ADDR output delay = 14
Change CLK output delay = 14
20
80
Change CMD/ADDR output delay = 13
Change CLK output delay = 13
20
80
Change CMD/ADDR output delay = 12
Change CLK output delay = 12
20
80
Change CMD/ADDR output delay = 11
Change CLK output delay = 11
20
80
Change CMD/ADDR output delay = 0
Change CLK output delay = 0
20
64
byte:0, (DQS,DQ)=(8,9)
byte:1, (DQS,DQ)=(8,A)
byte:2, (DQS,DQ)=(8,8)
byte:3, (DQS,DQ)=(8,8)
[EMI] DRAMC calibration passed

[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824
[Dram_Buffer] structure size: 1557624
[Dram_Buffer] MAX_TEE_DRAM_SIZE: 268435456

<< binary spew, perhaps signature from nvram? >>

sram(0xC10C983F) sig mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x4000
RAM_CONSOLE wdt status (0x0)=0x0
[PLFM] Init Boot Device: OK(0)
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0

[PART] GPT dump
[PART] 1: 00000800 00000800 'KB'
[PART] 2: 00000800 00001000 'DKB'
[PART] 3: 00008B00 00001800 'EXPDB'
[PART] 4: 00000800 0000A300 'UBOOT'
[PART] 5: 00008000 0000AB00 'boot'
[PART] 6: 00008000 00012B00 'recovery'
[PART] 7: 00000400 0001AB00 'MISC'
[PART] 8: 00001C00 0001AF00 'LOGO'
[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'
[LIB] HW ENC
[platform_vusb_on] PASS
step A2 : Standard USB Host!

[PLFM] USB cable in
No Battery
[0xE]=0x1005
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
USB HW reg: index14=0x0
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[TOOL] Enumeration(End): OK 616ms
[TOOL] : usb listen timeout
[TOOL] <USB> cannot detect tools!
[TOOL] <UART> listen ended, receive size:0!

[TOOL] <UART> wait sync time 150ms->5ms
[TOOL] <UART> receieved data: ()

Device APC domain init setup:

mmc_rpmb_get_wc, mmc_set_part_config done!!
mmc_rpmb_send_command -> req_type=0x1, type=0x2, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x2, blks=0x1
mmc_rpmb_get_wc, rpmb_req.result=0
[RPMB] RPMB Provisioned
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[RPMB] Valid anti-rollback block exists
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 409428
[PART] magic: 58881688h
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.

[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2960KB/s, 409428 bytes, 135ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 74213KB/s, 1063936 bytes, 14ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 79922KB/s, 1063936 bytes, 13ms
[BLMTEE] sha256 takes 6 (ms) for 1063360 bytes
[BLMTEE] rsa2048 takes 117 (ms)
[BLMTEE] verify pkcs#1 pss: 1 (ms)
[BLMTEE] aes128cbc 9 (ms) for 1063360
[ANTI-ROLLBACK] Processing anti-rollback data

mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 2 TEE: 3002 LK: 2
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] All checks passed
No Battery
[0xE]=0x1005
hw_set_cc: 450
[0x0]=0x6B
[0x1]=0x6B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[PLFM] Wait for battery inserted...
pl pmic close pre-chr LED
pl charging en
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x4
[0x2D]=0x4
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1005
[0xF]=0x1005
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x9
[0x21]=0x9
[0x22]=0x0
[0x23]=0x0
[0x24]=0x3
[0x25]=0x3
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x4
[0x2D]=0x4
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
pl charging done
No Battery
[0xE]=0x1005
No Battery
[0xE]=0x1005

Over the next few days, I'll try various boot configurations (holding down buttons, poking various test points, using a "factory cable") and look for differences in the console output. I'll summarize those differences when I've finished the work.

NOTE: When I captured this output, it was after having written some bad data to the NVRAM partition. I believe that explains the initial "[Read Test] fail" messages as well as the later complaint "sram(0xC10C983F) sig mismatch".

---------- Post added at 12:38 AM ---------- Previous post was at 12:21 AM ----------

If anyone has a bricked or broken tablet that they'd be willing to part with, please PM me. I'd like to have at least one more device on which to experiment.

I've been poking and prodding my current device quite a bit already, and I think I may have zapped some part of the power-management curcuitry which charges the battery. (Pro tip: remember to unplug the USB cable before applying an alcohol-soaked Q-tip to the board.)

I've already found lots of test points hiding on the motherboard, but it's almost impossible to see where they're going. I'd like to use a hot-air rework station and remove the big chips so I can get to the solder pads.