[Fire Android Development] RogerHelios:
Really bricked it

So I've been poking around here too, and thought I'd post a couple thoughts.

I got one of these tablet early on and immediately rooted and installed CM12.1. After it didn't do what I wanted for that experiment, reloaded the stock update and took it up to 5.1.1, then promptly forgot about it for a couple months. In a bonehead move, I started playing with it again without thinking upgraded it to 5.3.1, then realized root tools wouldn't work, then adb sideload back to 5.1.1... hence the brick.

I've messed with it a bit, no issues using the aftv2 tools to rewrite things, but stick stuck as a brick. I decided to try some soldering and got a Prolific USB-to-Serial on TX/RX pads, and got some different output. From the boot console output, it appears that my GPT is messed up (early on I imaged it from a working Fire 5th Gen I had OOB at 5.0.1). Can anyone look at the errors and see if there might be a recovery option? I've restored the boot/UBOOT/LOGO/TEE1 partitions from the 5.3.1 update trying to unbrick it, but now it appears the GPT magic number doesn't match for the UBOOT (LK.bin) so it fails out. See down a little bit.

FYI, I also soldered some picks on the EFUSE pads, I read 1.3MOhm across with battery disconnected. For the heck of it I threw a 1kOhm resistor in there (didn't seem to affect things on boot).

Also in playing, I found that if I hold the Vol(-), the serial output throws this:

key 1 is pressed
[LIB] invalid susbdl config '0xEA000007'
<ASSERT> seclib_dl.c:line 62 0
[PLFM] preloader fatal error...

Other keys just register in the output

[PLFM] Keep stay in USB Mode
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish,Uency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rep stay in USB Mode
Platform initialization is ok
wait for frequency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_cpu_freq = 1040000Khz
wait for frequency meter finish, CUency meter finish, CLK26CALI = 0x81
mt_pll_post_init: mt_get_mem_freq = 333251Khz
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=0,rdata=2D52
[PWRP] _pwrap_init_sistrobe [Read Test] pass,index=1 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=2 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=3 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=4 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=5 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=6 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=7 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] pass,index=8 rdata=5AA5
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=9,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=10,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=11,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=12,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=13,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=14,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=15,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=16,rdata=B54B
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=17,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=18,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=19,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=20,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=21,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=22,rdata=6A97
[PWRAP] _pwrap_init_sistrobe [Read Test] fail,index=23,rdata=6A97
[PWRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6323_init] Preloader Start..................
[pmic6323_init] PMIC CHIP Code = 0x2023
INT_MISC_CON: 1 TOP_RST_MISC: 1
pl pmic powerkey Release
[pmic6323_init] powerKey = 0
[pmic6323_init] is USB in = 0xB003
[pmic6323_init] Reg[0x11A]=0x1B
[pmic6323_init] Done...................
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]

[BLDR] Build Time: 20150923-180133
==== Dump RGU Reg ========
RGU MODE: 5
RGU LENGTH: FFE0
RGU STA: 40000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:2
mtk_wdt_mode_config mode value=10, tmp:22000010
PL RGU RST: ??
SW reset without bypass power key flag
SW reset without bypass power key flag
No bypass powerkey flag
mtk_wdt_mode_config mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
kpd read addr: 0x0040: data:0x4005
Enter mtk_kpd_gpio_set!
kpd debug column : -2147483612, -2147483611, 0, 0, 0, 0, 0, 0
kpd debug row : 0, 0, 0, 0, 0, 0, 0, 0
after set KP enable: KP_SEL = 0x0 !
MTK_PMIC_RST_KEY is used for this project!
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3967
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] bbpu = 0xD, con = 0x426
[RTC] powerkey1 = 0xA357, powerkey2 = 0x67D2
Writeif_unlock
[RTC] RTC_SPAR0=0x40
rtc_2sec_reboot_check cali=1792
rtc_2sec_stat_clear
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0xD, con = 0x426, cali = 0x700
SW reset without bypass power key flag
[PLFM] WDT normal boot!
hw_set_cc: 450
[0x0]=0x6B
[0x1]=0x6B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
[RTC] Check SW Long Press RST = 0x40
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x15>
msdc <0> <HYNIX > <8GND3R>
msdc <1> <xxxxxx> <8GND3R>
msdc failed to find
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
mt_get_dram_type() 0x3
[EMI] LPDDR3
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,38,47,4E,44,33,52,1,83,76,48,F3,B2,E3
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[EMI][Vcore]0x21E=0x48,0x220=0x48
[EMI][Vmem]0x554=0xF
[EMI] LPDDR3 DRAM Clock = 1333 MHz, MEMPLL MODE = 2
[EMI] PCDDR3 RXTDN Calibration:
Start REXTDN SW calibration...
PD 0x1e4[13]:0h
1.INTREF_SEL:0x100[17:16]:0h
2.enable P drive (initial settings),DRAMC_DLLSEL:500F0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:500F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:510F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:520F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:530F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:540F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:550F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:560F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:570F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:580F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:590F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5A0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5B0F0h
2.2.CMPOT:0x3dc[31]:0h
2.1.DRAMC_DLLSEL, CMPDRVP 0x0c0[15:12]:5C0F0h
2.2.CMPOT:0x3dc[31]:80000000h
P drive:12
3.INTREF_SEL:0x100[17:16]:0h
4.enable N drive (initial settings),DRAMC_DLLSEL:3C0FFh
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C0FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C1FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C2FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C3FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C4FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C5FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C6FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C7FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C8FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3C9FFh
4.2.CMPOT:0x3dc[31]:80000000h
4.1.DRAMC_DLLSEL, CMPDRVN 0x0c0[11:8]:3CAFFh
4.2.CMPOT:0x3dc[31]:0h
N drive:9
drvp=0xC,drvn=0x9
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0010:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0011:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1
0013:| 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1
0014:| 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0
0015:| 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Rank 13 coarse tune value selection : 32,
20
48
rank 0 coarse = 20
rank 0 fine = 48
00:| 0 0 0 0 1 1 1 0
opt_dle value:9
[EMI]warning:rank auto detect:==single rank==
Change CMD/ADDR output delay = 15
Change CLK output delay = 15
20
64
Change CMD/ADDR output delay = 14
Change CLK output delay = 14
20
64
Change CMD/ADDR output delay = 13
Change CLK output delay = 13
20
64
Change CMD/ADDR output delay = 0
Change CLK output delay = 0
20
48
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,9)
byte:2, (DQS,DQ)=(8,7)
byte:3, (DQS,DQ)=(8,8)
[EMI] DRAMC calibration passed

[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:1073741824
[Dram_Buffer] structure size: 1557624
[Dram_Buffer] MAX_TEE_DRAM_SIZE: 268435456
sram(0xB44C75C1) sig mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x4000
RAM_CONSOLE preloader last status: 0x0 0x0 0x0
RAM_CONSOLE wdt status (0x2)=0x2
[PLFM] Init Boot Device: OK(0)

[PART] GPT dump
[PART] 1: 00000800 00000800 'KB'
[PART] 2: 00000800 00001000 'DKB'
[PART] 3: 00008B00 00001800 'EXPDB'
[PART] 4: 00000800 0000A300 'UBOOT'
[PART] 5: 00008000 0000AB00 'boot'
[PART] 6: 00008000 00012B00 'recovery'
[PART] 7: 00000400 0001AB00 'MISC'
[PART] 8: 00001C00 0001AF00 'LOGO'
[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'
[LIB] HW ENC
[platform_vusb_on] PASS
hw_set_cc: 450
[0x0]=0x7B
[0x1]=0x7B
[0x2]=0xB2
[0x3]=0xB2
[0x4]=0x8C
[0x5]=0x8C
[0x6]=0x1F
[0x7]=0x1F
[0x8]=0xC
[0x9]=0xC
[0xA]=0x0
[0xB]=0x0
[0xC]=0x1
[0xD]=0x1
[0xE]=0x1
[0xF]=0x1
[0x10]=0x0
[0x11]=0x0
[0x12]=0x0
[0x13]=0x0
[0x14]=0x60
[0x15]=0x60
[0x16]=0x0
[0x17]=0x0
[0x18]=0x0
[0x19]=0x0
[0x1A]=0x10
[0x1B]=0x10
[0x1C]=0x0
[0x1D]=0x0
[0x1E]=0x1
[0x1F]=0x1
[0x20]=0x1
[0x21]=0x1
[0x22]=0x0
[0x23]=0x0
[0x24]=0x0
[0x25]=0x0
[0x26]=0x0
[0x27]=0x0
[0x28]=0x21
[0x29]=0x21
[0x2A]=0x14
[0x2B]=0x14
[0x2C]=0x44
[0x2D]=0x44
[0x2E]=0x54
[0x2F]=0x54
[0x30]=0x0
[0x31]=0x0
[0x32]=0x0
[0x33]=0x0
[0x34]=0x0
[0x35]=0x0
[0x36]=0x0
[0x37]=0x0
[0x38]=0x55
[0x39]=0x55
[0x3A]=0x0
hw_set_cc: done
step A2 : Standard USB Host!

[PLFM] USB cable in
No Battery
[0xE]=0x1005
[TOOL] USB enum timeout (Yes), handshake timeout(Yes)
USB HW reg: index14=0x0
[USBD] USB Full Speed
[TOOL] Enumeration(Start)
[USBD] USB High Speed
[TOOL] Enumeration(End): OK 306ms
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
usbdl_flush timeout
[TOOL] : usb listen timeout
[TOOL] <USB> cannot detect tools!
[TOOL] <UART> listen ended, receive size:0!

[TOOL] <UART> wait sync time 150ms->5ms
[TOOL] <UART> receieved data: ()

Device APC domain init setup:

mmc_rpmb_get_wc, mmc_set_part_config done!!
mmc_rpmb_send_command -> req_type=0x1, type=0x2, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x2, blks=0x1
mmc_rpmb_get_wc, rpmb_req.result=0
[RPMB] RPMB Provisioned
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[RPMB] Valid anti-rollback block exists
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 408760
[PART] magic: 58881688h
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Error: fail to do pss decode for lk data.
[PART] fail to verify Second Bootloader.
[BLDR] Second Bootloader Load Failed
[PLFM] preloader fatal error...
mtk_arch_reset at pre-loader!
reset

So, I did a "write_mmc.py" of the lk.bin to 0x1460000 and the ending changed to:

Device APC domain init setup:

mmc_rpmb_get_wc, mmc_set_part_config done!!
mmc_rpmb_send_command -> req_type=0x1, type=0x2, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x2, blks=0x1
mmc_rpmb_get_wc, rpmb_req.result=0
[RPMB] RPMB Provisioned
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[RPMB] Valid anti-rollback block exists
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 408548
[PART] magic: 58881688h
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.

[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2933KB/s, 408548 bytes, 136ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[BLMTEE] sha256 takes 7 (ms) for 1147472 bytes
[BLMTEE] rsa2048 takes 117 (ms)
[BLMTEE] verify pkcs#1 pss: 0 (ms)
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "9" from 0x0000000003E60200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "9" from 0x0000000003E60200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[BLMTEE] sha256 takes 7 (ms) for 1147472 bytes
[BLMTEE] rsa2048 takes 118 (ms)
[BLMTEE] verify pkcs#1 pss: 0 (ms)
[BLDR] Error: fail to load mtee image
[BLDR] fail to load mtee image
[PLFM] preloader fatal error...
mtk_arch_reset at pre-loader!
reset

I then pushed the 5.1.1 version of tz.img to 0x3e60000 and got this:

Device APC domain init setup:

mmc_rpmb_get_wc, mmc_set_part_config done!!
mmc_rpmb_send_command -> req_type=0x1, type=0x2, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x2, blks=0x1
mmc_rpmb_get_wc, rpmb_req.result=0
[RPMB] RPMB Provisioned
mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[RPMB] Valid anti-rollback block exists
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 408548
[PART] magic: 58881688h
[SECURITY]: Production device
[PART] This is a production device.
[PART] Verifying LK...
[VERIFY_LK] Succeed to pass the LK verification.

[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2933KB/s, 408548 bytes, 136ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1148048
[PART] magic: 58881688h

[PART] load "8" from 0x0000000003960200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 56056KB/s, 1148048 bytes, 20ms
[BLMTEE] sha256 takes 6 (ms) for 1147472 bytes
[BLMTEE] rsa2048 takes 117 (ms)
[BLMTEE] verify pkcs#1 pss: 0 (ms)
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h

[PART] load "9" from 0x0000000003E60200 (dev) to 0xBFF00000 (mem) [SUCCESS]
[PART] load speed: 57721KB/s, 1063936 bytes, 18ms
[PART] Image with part header
[PART] name : TEE
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 1063936
[PART] magic: 58881688h

[PART] load "9" from 0x0000000003E60200 (dev) to 0xB8A00000 (mem) [SUCCESS]
[PART] load speed: 57721KB/s, 1063936 bytes, 18ms
[BLMTEE] sha256 takes 7 (ms) for 1063360 bytes
[BLMTEE] rsa2048 takes 118 (ms)
[BLMTEE] verify pkcs#1 pss: 1 (ms)
[BLMTEE] aes128cbc 9 (ms) for 1063360
[ANTI-ROLLBACK] Processing anti-rollback data

mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 4 TEE: 3002 LK: 4
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] PL version mismatch!
[ANTI-ROLLBACK] L: 4 R: 2

It seems like it wants to do the security verification on 5.1.1 for TEE2 and anti-rollback check for 5.3.1 (remember this is the tablet I did an adb push of 5.1.1 from 5.3.1. Anybody smart enough to figure out an unbrick from those parameters?