bkerler
commented
1 year ago Actually, everything is fine, thanks :) I will try to add support for it soon
Closed santiac89 closed 5 months ago
bkerler
commented
1 year ago Actually, everything is fine, thanks :) I will try to add support for it soon
bkerler
commented
1 year ago Can you also upload the console output ? (the hwcode etc.)
santiac89
commented
1 year ago
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 92691A43F8E190DD5326A2EB62B31109
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
Ah, I just saw it should be already supported. Does it fail somewhere ?
santiac89
commented
1 year ago For me on WIndows 10 it fails on uploading stage 2 with a DA hash mismatch error, I'm going to try other OS. But for someone I'm collaborating with and running under Linux it hangs here:
$ python3 mtk r boot1 boot.img
MTK Flash/Exploit Client V1.6.2 (c) B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
...........
Port - Device detected :)
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: CCCA4E53BFD309EADCF4351BF3379434
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
PLTools - Loading payload from mt8167_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/joost/Projects/gitea/echodotv3/tools/mtkclient/mtkclient/payloads/mt8167_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_9.9999.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash - Successfully uploaded stage 2
DAXFlash - EMMC FWVer: 0x0
DAXFlash - EMMC ID: H4G2a
DAXFlash - EMMC CID: 90014a483447326111020f58b11225c7
DAXFlash - EMMC Boot1 Size: 0x400000
DAXFlash - EMMC Boot2 Size: 0x400000
DAXFlash - EMMC GP1 Size: 0x0
DAXFlash - EMMC GP2 Size: 0x0
DAXFlash - EMMC GP3 Size: 0x0
DAXFlash - EMMC GP4 Size: 0x0
DAXFlash - EMMC RPMB Size: 0x400000
DAXFlash - EMMC USER Size: 0xe9000000
DAXFlash - HW-CODE : 0x8167
DAXFlash - HWSUB-CODE : 0x8A00
DAXFlash - HW-VERSION : 0xCB00
DAXFlash - SW-VERSION : 0x1
DAXFlash - CHIP-EVOLUTION : 0x0
DAXFlash - DA-VERSION : 1.0
DAXFlash - Reconnecting to preloader
DeviceClass - [Errno 2] Entity not found
DAXFlash - Connected to preloader
DAXFlash - Upload data was accepted. Jumping to stage 2...I think it is not OS related, I tried with the Live DVD and I am getting the same error
bkerler
commented
1 year ago It's a bit weird it does upload the stage 2 two times. Normally after reconnecting and connecting it should be fine.
bkerler
commented
1 year ago Ah I see. The problem is that after the extensions are uploaded, the da2 loader does seem to hang for an unknown reason. I assume that the reconnect has failed, which might be an usb issue
santiac89
commented
1 year ago I see. About the DA hash mismatch error. Do you know what could be causing it? I've tried with the LIve DVD but still I get that error. It happens when uploading stage 2
bkerler
commented
1 year ago The da hash mismatch error is a different error. Can you send me the full log ? The "MTK_AllInOne_DA_9.9999.bin" isn't supported by me, so I'd need that one as well in order to add support.
santiac89
commented
1 year ago Sure, here is the full log, the bin file used is just a renamed one, here it is with original
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 92691A43F8E190DD5326A2EB62B31109
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
PLTools - Loading payload from mt8167_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Santiago\Development\EchoDotV3\mtkclient\mtkclient\payloads\mt8167_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash
DAXFlash - [LIB]: ←[31mError on sending data: DA hash mismatch (0xc0070004)←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on booting to da (xflash)←[0mI can also get you the full UART output of the device if needed, this is just where it stops
***(4.)Enter cmd_boot_to cmd***
DA hash validation....
da_loop code_length = 0x50ac8
at_address = 0x40000000
No idea why, but the MTK_AllInOne_DA_5.2136.bin always had issues with da hash mismatch under Windows. Do you get the same da hash mismatch error using Linux ?
santiac89
commented
1 year ago Yes, I used the LiveDVD which contains the 2152.bin file and I get the same
bkerler
commented
1 year ago I have just pushed commit 7d13bef. Can you try this one ?
santiac89
commented
1 year ago Now it seems that stage 2 data was accepted! It stays there on Jumping to stage 2 and last UART log is DA verify pass and jump to DRAM
Port - Device detected :)
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 92691A43F8E190DD5326A2EB62B31109
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
PLTools - Loading payload from mt8167_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Santiago\Development\EchoDotV3\mtkclient\mtkclient\payloads\mt8167_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
Mtk - Patched "hash_check" in preloader
xflashext - Patching da2 ...
xflashext
xflashext - [LIB]: ←[33mHash check not patched.←[0m
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...And after a while
DAXFlash
DAXFlash - [LIB]: ←[31mStage was't executed. Maybe dram issue ?.←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on booting to da (xflash)←[0mmhmmm Hash check not patched, need to sort that one out
bkerler
commented
1 year ago Ok, added another commit 65e905e. This will hopefully give other results
santiac89
commented
1 year ago Same results
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 92691A43F8E190DD5326A2EB62B31109
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
PLTools - Loading payload from mt8167_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Santiago\Development\EchoDotV3\mtkclient\mtkclient\payloads\mt8167_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: ←[33mError on patching da1 version check...←[0m
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash
DAXFlash - [LIB]: ←[31mStage was't executed. Maybe dram issue ?.←[0m
DAXFlash
DAXFlash - [LIB]: ←[31mError on booting to da (xflash)←[0mOk, that means that the dram setup most probably failed, Amazon devices sometimes have additional protection in the preloader. Use mtk stage and stage2 to backup the preloader. Wiping the preloader and using --preloader with the backup should work then. Once done you can rewrite the original preloader.
bkerler
commented
1 year ago Using the preloader mode should work fine for dumping the flash. If you still want to use the brom mode, I assume you will need to craft your own payload and implement flash drivers. Do you see any error on uart ?
santiac89
commented
1 year ago No error on UART, just stuck here DA verify pass and jump to DRAM
bkerler
commented
1 year ago Yeah, my best guess is that the dram setup still fails for whatever reason.
santiac89
commented
1 year ago What is the difference between the dumppreloader method and using stage2 to read it? Because I used dumppreloader before and I got an preloader image, but stage2 is not working for me
(python3) C:\Users\Santiago\Development\EchoDotV3\mtkclient>python mtk stage
MTK Flash/Exploit Client V1.6.2 (c) B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
......Port - Device detected :)
Preloader - CPU: MT8167/MT8516/MT8362()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11005000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xcc
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8167
Preloader - Target config: 0xe5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 92691A43F8E190DD5326A2EB62B31109
Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000
Main - Uploading stage 1
PLTools - Loading payload from generic_stage1_payload.bin, 0x3e8 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: C:\Users\Santiago\Development\EchoDotV3\mtkclient\mtkclient\payloads\generic_stage1_payload.bin
Main - Successfully uploaded stage 1, sending stage 2
Main - Done sending stage2, size 0x4000.
Main - Done jumping stage2 at 00201000
Main - Successfully loaded stage2
(python3) C:\Users\Santiago\Development\EchoDotV3\mtkclient>python stage2
MTK Stage2 client (c) B.Kerler 2021
-----------------------------------
Available commands are:
rpmb: Dump rpmb
preloader: Dump preloader
boot2: Dump boot2
reboot: Reboot phone
memread: Read memory [Example: memread 0 0x10]
memwrite: Write memory [Example: memwrite 0x200000 1122334455667788, memwrite 0x0 0x12345678, memwrite 0x0 data.bin]
keys: Extract rpmb and fde key
seccfg: Generate unlock config
(python3) C:\Users\Santiago\Development\EchoDotV3\mtkclient>python stage2 preloader
Stage2 - Reading preloader...
Traceback (most recent call last):
File "C:\Users\Santiago\Development\EchoDotV3\mtkclient\stage2", line 710, in <module>
main()
File "C:\Users\Santiago\Development\EchoDotV3\mtkclient\stage2", line 611, in main
st2.preloader(start, length, filename=filename)
File "C:\Users\Santiago\Development\EchoDotV3\mtkclient\stage2", line 197, in preloader
buffer = self.readflash(type=1, start=0, length=0x4000, display=False)
File "C:\Users\Santiago\Development\EchoDotV3\mtkclient\stage2", line 135, in readflash
self.init_emmc()
File "C:\Users\Santiago\Development\EchoDotV3\mtkclient\stage2", line 74, in init_emmc
if unpack("<I", self.usbread(4))[0] == 0xD1D1D1D1:dumppreloader dumps the preloader from memory, stage2 is trying to read it from flash instead. I've pushed another commit which increases the debug level on uart. Would be helpful to see what uart says then
santiac89
commented
1 year ago [pmic_config_interface] Reg[0]= pmic_wrap read data fail
[pmic_config_interface] Reg[1a]= pmic_wrap read data fail
[SBC] bypass da ver check.
log_level=0(0:trace, 1:debug, 2:info, 3:warning, 4:error, 5:fatal)
log_channel=1(0:none, 1:uart, 2:usb, 3:uart_usb)
system_os=1(0:windows, 1:linux)
ufs_provision=0(0:default, 1:force, 2:skip)
Have 0 hw init parameters.
cmd_set_hw_init_parameter finish.
DA build time : Sep 5 2021 15:02:11
***1.Enter DA_init.***
***1-1.heap_init.***
***1-2.pll_init_pass.***
***2.platform_early_init.***
2-1.disable watch dog.
2-2.disable_Charger.
***3.init system objects.***
***4.It is BROM MODE.***
***5.sync with PC Pass.***
time2-time1=103
***6.gpt_init pass.***
[PWRAP] pwrap_init_DA
[PWRAP] ERROR sidly pass range not continuous
[PWRAP] ERROR,line=269fail,dio_en = 1, READ_TEST rdata=a800
[PWRAP] ERROR,line=499pwrap_init_dio error code=11, sub_return=1e
[PMIC_WRAP]wrap_init fail,the return value=18.
[PWRAP] ERROR sidly pass range not continuous
[PWRAP] ERROR,line=269fail,dio_en = 1, READ_TEST rdata=a800
[PWRAP] ERROR,line=499pwrap_init_dio error code=11, sub_return=1e
[PMIC_WRAP]wrap_init fail,the return value=18.
[PWRAP] ERROR sidly pass range not continuous
[PWRAP] ERROR,line=269fail,dio_en = 1, READ_TEST rdata=a800
[PWRAP] ERROR,line=499pwrap_init_dio error code=11, sub_return=1e
[PMIC_WRAP]wrap_init fail,the return value=18.
[pmic6392_init] Start..................
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_read_interface] Reg[100]= pmic_wrap read data fail
[pmic6392_init] PMIC CHIP Code = 0x0
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[16c]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[16c]= pmic_wrap read data fail
INT_MISC_CON: 0 TOP_RST_MISC: 0
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_read_interface] Reg[142]= pmic_wrap read data fail
pl pmic powerkey Press
[pmic6392_init] powerKey = 1
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_read_interface] Reg[0]= pmic_wrap read data fail
[pmic6392_init] is USB in = 0xb004
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[136]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_read_interface] Reg[11a]= pmic_wrap read data fail
[pmic6392_init] Reg[0x11a]=0x0
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_read_interface] Reg[136]= pmic_wrap read data fail
[pmic6392_init] Reg[0x136]=0x0
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[404]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[424]= pmic_wrap read data fail
[auxadc_hw_init] Patched L Start..................
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[738]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[738]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[4e]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[4e]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[73e]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[73e]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[740]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[750]= pmic_wrap read data fail
[pmic6392_init] Done...................
***7.pmic_init pass.***
***8.release_dram pass.***
***9.platform_init start.***
11-1.low_power init pass.
mmc_init start.
boot channel set to: 0
[mmc_init]: msdc0 start in DA
[mmc_init]: msdc0, start mmc_init_host() in DA
[msdc_init]: msdc0 Host controller intialization start in DA
[SD0] Turn off card power
[SD0] Turn off host power
[SD0] Turn off host clock
[msdc_clock]: msdc0, pll[0x1020925c][bit0~1=0x1]=0x0, pll[0x10209250][bit0=0x1]=0x0, mux[0x10000070][bit15,23,31=0x1]=0xfff87ffc, clk[0x10003018][bit 13=msdc0, bit14=msdc1]=0x0
[SD0] Pins mode(1), none(0), down(1), up(2), keep(3)
[SD0] Turn on host power
[SD0] Pins mode(2), none(0), down(1), up(2), keep(3)
[SD0] Turn on host clock
[msdc_clock]: msdc0, pll[0x1020925c][bit0~1=0x1]=0x0, pll[0x10209250][bit0=0x1]=0x0, mux[0x10000070][bit15,23,31=0x1]=0xfff87ffc, clk[0x10003018][bit 13=msdc0, bit14=msdc1]=0x0
[SD0] Turn on card power
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(181) DS(0) RS(0)
[SD0] Set read data timeout: 100000000ns 0clks -> 1 x 1048576 cycles
[msdc_init]: msdc0 Host controller intialization done in DA
[mmc_init]: msdc0 start mmc_init_card() in DA
[SD0] CMD(0): ARG(0x0), RAW(0x0), RSP(0)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x100)
[SD0] CMD(0): RSP(0)
[SD0] CMD(8): ARG(0x1aa), RAW(0x88), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(8): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(55): ARG(0x0), RAW(0xb7), RSP(1)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(55): RSP(1) ERR(CMDTO) AUTO(0)
[SD0] CMD(1): ARG(0x0), RAW(0x181), RSP(3)
[WARN] (MSDC_READ32(MSDC_INTEN) & intrs) != intrs LINE:957
[SD0] INT(0x200)
[SD0] CMD(1): RSP(3) ERR(CMDTO) AUTO(0)
Reg[0] MSDC_CFG = 0x200b599
Reg[4] MSDC_IOCON = 0x0
Reg[8] MSDC_PS = 0x81ff0002
Reg[c] MSDC_INT = 0x0
Reg[10] MSDC_INTEN = 0x0
Reg[14] MSDC_FIFOCS = 0x0
Reg[18] MSDC_TXDATA = not read
Reg[1c] MSDC_RXDATA = not read
Reg[30] SDC_CFG = 0x87ffc
Reg[34] SDC_CMD = 0x181
Reg[38] SDC_ARG = 0x0
Reg[3c] SDC_STS = 0x100000
Reg[40] SDC_RESP0 = 0x0
Reg[44] SDC_RESP1 = 0x0
Reg[48] SDC_RESP2 = 0x0
Reg[4c] SDC_RESP3 = 0x0
Reg[50] SDC_BLK_NUM = 0xffffffff
Reg[58] SDC_CSTS = 0x0
Reg[5c] SDC_CSTS_EN = 0x0
Reg[60] SDC_DATCRC_STS = 0x0
Reg[64] SDC_CMD_STS = 0xe000
Reg[70] EMMC_CFG0 = 0x1004
Reg[74] EMMC_CFG1 = 0xa000c8
Reg[78] EMMC_STS = 0x0
Reg[7c] EMMC_IOCON = 0x0
Reg[80] SDC_ACMD_RESP = 0x0
Reg[84] SDC_ACMD19_TRG = 0x0
Reg[88] SDC_ACMD19_STS = 0x0
Reg[90] DMA_SA = 0x0
Reg[94] DMA_CA = 0x0
Reg[98] DMA_CTRL = 0x6008
Reg[9c] DMA_CFG = 0x4
Reg[a0] SG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x9
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xa
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xb
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xc
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xd
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xe
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0xf
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x10
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x11
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x12
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x13
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x14
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x15
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x16
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x17
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x18
SW_DBG_OUT: read reg[a4] to 0x0
SW_DBG_SEL: write reg[a0] to 0x19
SW_DBG_OUT: read reg[a4] to 0x1
[SD0] Fail in SEND_IF_COND cmd
=====error====change to hc erase group failed err = 1!
[mmc_init]: msdc0 init done in DA, err=1
mmc init pass.
device_mmc init failed.
[NUTL_DAinit_NFI_Init] *NFI_ACCCON 0xffffffff
[NUTL_DAinit_NFI_Init] *NFI_PAGEFMT 0x8804
[NUTL_DAinit_CheckDevice]
[NUTL_DAinit_CheckDevice] g_NandFlashIdTbl 0x219ccc, size 0x46
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0x45 0x4c 0x98 0xa3 0x76
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0x45 0xde 0x94 0x93 0x76
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0xc2 0xdc 0x90 0x95 0x56
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0x98 0xdc 0x90 0x26 0x76
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0x2c 0x38 0x0 0x26 0x85
[NAND_COMMON_ReadID_For_DaInit]
NFI_ACCCON 0x10804222
LINE 6170 NFI_CNFG 0x5000
[NUTL_DAinit_CheckDevice] id1: 0xa290dcc2 id2: 0x357
[NUTL_DAinit_CheckDevice] ID: 0x2c 0xda 0x90 0x95 0x6
[NUTL_DAinit_CheckDevice] ID: 0x0 0x0 0x0 0x0 0x0 0x0 0x0
11-4.device_nand init pass.
nand_info.type=0x0
***9.platform_init pass.***
***10.dagent_register_commands pass.***
***11.notify host DA is ready to execute commands.***
***12.dagent_command_loop:***
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x40011)
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x20004)
***(0.)Enter devc_set_reset_key cmd***
@@enable reset key [0x68]
IN SAL_PMIC_HW_Reset_Enable
Configure pmic hw reset two key mode
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[40]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
IN SAL_PMIC_HW_Reset_Enable Done
reset_key=0x68(0x68:two key,0x50:one key)
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x20003)
***(1.)Enter devc_set_checksum_level cmd***
checksum_level=0(usb.emmc.both)
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x4000a)
009)
REVEIVING DEV CTRL CMD(0x40001)
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x40004)
REVEIVING CMD(0x1000a)
***(3.)Enter cmd_init_dram cmd***
emi id= MTK_BLOADER_INFO_v28 , emi_count: 2
--------------------
0x1 0x4 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x2012 0x3 0x9090640 0x19491401 0xb090201 0x550c0306 0x23566560 0x908 0x14140000 0x0 0x40000000 0x0 0x0 0x0 0 x4210000 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x80000000 0x0
--------------------
0x1 0x4 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x2010 0x3 0x9090640 0x19491401 0xb090201 0x550c0306 0x23566560 0x908 0x14140000 0x0 0x20000000 0x0 0x0 0x0 0 x4210000 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x44000000 0x0
v_emi_settings->sub_version = 0x1
EMI_TAG_Version == 28, Using preloader tag
num_of_emi_records = 2
fix dram setting idx 0
[EMI] MDL number = 0
[EMI] PCDDR3
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[554]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[554]= pmic_wrap read data fail
get dram size from AUXADC1 518 1
[EMI] Use Common DDR3 x32 emi settings
[EMI] Config emi settings:
EMI_CONA=0x3012, EMI_CONH=0x3
EMI_RANK0=0x80000000, EMI_RANK1=0x0
EMI_CONA=0x3012
EMI_CONF=0x4210000
EMI_CONH=0x3
[DramcSwImpedanceCal] FINAL: DRVP=7, DRVN=6
PCDDR3 Pinmux 0
SSC OFF
DRAM Clock: 1040MHz
[Write Leveling]
WriteLevelingMoveDQSInsteadOfCLK
===============================================================================
Dram Type= 4, Freqency= 1066, rank 0
odt_onoff= 0, Byte mode= 0, Read_DBI= 0, Write DBI= 0
===============================================================================
WL Clk delay = 0, CA CLK delay = 0
No need to update CA/CS delay because the CLK delay is small than CA training.
Final Clk output delay = 0
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS0 delay = 31
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS1 delay = 30
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS2 delay = 0
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS3 delay = 0
[DramcWriteLeveling] ====Done====
[Gating]
===============================================================================
Dram Type= 4, Freqency= 1066, rank 0
odt_onoff= 0, Byte mode= 0, Read_DBI= 0, Write DBI= 0
===============================================================================
[Byte 0]First pass (1, 2, 20)
[Byte 1]First pass (1, 2, 20)
[Byte 0]Bigger pass win(1, 4, 14) Pass tap=58
[Byte 1]Bigger pass win(1, 4, 15) Pass tap=59
error, no pass taps in DQS_2 !!!
error, no pass taps in DQS_3 !!!
===============================================================================
dqs input gating widnow, final delay value
Frequency=1066 rank=0
===============================================================================
R0 FINAL: GW best DQS0 P0 delay(2T, 0.5T, PI) = (1, 3, 17) [tap = 58]
R0 FINAL: GW best DQS1 P0 delay(2T, 0.5T, PI) = (1, 3, 17) [tap = 59]
R0 FINAL: GW best DQS2 P0 delay(2T, 0.5T, PI) = (135, 1, 0) [tap = 0]
R0 FINAL: GW best DQS3 P0 delay(2T, 0.5T, PI) = (75, 5, 0) [tap = 0]
R0 FINAL: GW best DQS0 P1 delay(2T, 0.5T, PI) = (1, 5, 17)
R0 FINAL: GW best DQS1 P1 delay(2T, 0.5T, PI) = (1, 5, 17)
R0 FINAL: GW best DQS2 P1 delay(2T, 0.5T, PI) = (135, 3, 0)
R0 FINAL: GW best DQS3 P1 delay(2T, 0.5T, PI) = (75, 7, 0)
[DramcRxdqsGatingCal] ====Done====
[DATLAT]
DATLAT Default value = 0xf
5, 0xFFFFFFFF, sum=0
6, 0xFFFFFFFF, sum=0
7, 0xFFFFFFFF, sum=0
8, 0xFFFFFFFF, sum=0
9, 0xFFFFFFFF, sum=0
10, 0xFFFFFFFF, sum=0
11, 0xFFFFFFFF, sum=0
12, 0xFFFFFFFF, sum=0
13, 0xFFFF0000, sum=0
14, 0xFFFF0000, sum=0
15, 0xFFFF0000, sum=0
16, 0xFFFF0000, sum=0
17, 0xFFFF0000, sum=0
18, 0xFFFF0000, sum=0
19, 0xFFFF0000, sum=0
20, 0xFFFF0000, sum=0
21, 0xFFFF0000, sum=0
22, 0xFFFF0000, sum=0
23, 0xFFFF0000, sum=0
24, 0xFFFF0000, sum=0
25, 0xFFFF0000, sum=0
26, 0xFFFF0000, sum=0
27, 0xFFFF0000, sum=0
28, 0xFFFF0000, sum=0
29, 0xFFFFFFFF, sum=0
30, 0xFFFFFFFF, sum=0
31, 0xFFFFFFFF, sum=0
no DATLAT taps pass, DATLAT calibration fail!!
pattern=5 first_step=255 total pass=0 best_step=15
R0 FINAL: DATLAT = 15 [255 ~ 254]
DATLAT calibration fail, write back to default values!
[DramcRxdatlatCal] ====Done====
u1DatlatWindowSum 0 is too small(<5), Start RX + Datlat scan
[DATLAT]
DATLAT Default value = 0xf
RX DQS delay = 36, 5, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 6, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 7, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 8, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 9, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 10, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 11, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 12, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 13, 0xFFFF0043, sum=0
RX DQS delay = 36, 14, 0xFFFF0043, sum=0
RX DQS delay = 36, 15, 0xFFFF0043, sum=0
RX DQS delay = 36, 16, 0xFFFF0043, sum=0
RX DQS delay = 36, 17, 0xFFFF0043, sum=0
RX DQS delay = 36, 18, 0xFFFF0043, sum=0
RX DQS delay = 36, 19, 0xFFFF0043, sum=0
RX DQS delay = 36, 20, 0xFFFF0043, sum=0
RX DQS delay = 36, 21, 0xFFFF0043, sum=0
RX DQS delay = 36, 22, 0xFFFF0043, sum=0
RX DQS delay = 36, 23, 0xFFFF0043, sum=0
RX DQS delay = 36, 24, 0xFFFF0043, sum=0
RX DQS delay = 36, 25, 0xFFFF0043, sum=0
RX DQS delay = 36, 26, 0xFFFF0043, sum=0
RX DQS delay = 36, 27, 0xFFFF0043, sum=0
RX DQS delay = 36, 28, 0xFFFF0043, sum=0
RX DQS delay = 36, 29, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 30, 0xFFFFFFFF, sum=0
RX DQS delay = 36, 31, 0xFFFFFFFF, sum=0
no DATLAT taps pass, DATLAT calibration fail!!
pattern=5 first_step=255 total pass=0 best_step=15
R0 FINAL: DATLAT = 15 [255 ~ 254]
DATLAT calibration fail, write back to default values!
[DramcRxdatlatCal] ====Done====
[RX]
===============================================================================
Dram Type= 4, Freqency= 1066, rank 0
odt_onoff= 0, Byte mode= 0, Read_DBI= 0, Write DBI= 0
===============================================================================
RX Window Sum 839
R0 FINAL: RX Bit 0, 4 (-22 ~ 31) 54
R0 FINAL: RX Bit 1, 5 (-20 ~ 31) 52
R0 FINAL: RX Bit 2, 6 (-21 ~ 33) 55
R0 FINAL: RX Bit 3, 6 (-20 ~ 33) 54
R0 FINAL: RX Bit 4, 6 (-20 ~ 32) 53
R0 FINAL: RX Bit 5, 6 (-20 ~ 32) 53
R0 FINAL: RX Bit 6, 5 (-20 ~ 31) 52
R0 FINAL: RX Bit 7, 5 (-22 ~ 32) 55
R0 FINAL: RX Bit 8, 7 (-19 ~ 34) 54
R0 FINAL: RX Bit 9, 7 (-20 ~ 34) 55
R0 FINAL: RX Bit 10, 8 (-18 ~ 34) 53
R0 FINAL: RX Bit 11, 7 (-18 ~ 33) 52
R0 FINAL: RX Bit 12, 8 (-18 ~ 34) 53
R0 FINAL: RX Bit 13, 8 (-18 ~ 34) 53
R0 FINAL: RX Bit 14, 7 (-19 ~ 34) 54
R0 FINAL: RX Bit 15, 8 (-18 ~ 34) 53
R0 FINAL: RX Bit 16, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 17, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 18, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 19, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 20, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 21, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 22, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 23, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 24, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 25, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 26, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 27, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 28, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 29, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 30, 32767 (32767 ~ 32767) 1
R0 FINAL: RX Bit 31, 32767 (32767 ~ 32767) 1
===============================================================================
Dram Type= 4, Freqency= 1066, rank 0
odt_onoff= 0, Byte mode= 0, Read_DBI= 0, Write DBI= 0
===============================================================================
DQS Delay :
DQS0 = 0, DQS1 = 0, DQS2 = 0, DQS3 = 0
DQM Delay :
DQM0 = 5, DQM1 = 7, DQM2 = 8191, DQM3 = 8191
DQ Delay :
DQ0 =4, DQ1 =5, DQ2 =6, DQ3 =6
DQ4 =6, DQ5 =6, DQ6 =5, DQ7 =5
DQ8 =7, DQ9 =7, DQ10 =8, DQ11 =7
DQ12 =8, DQ13 =8, DQ14 =7, DQ15 =8
DQ16 =32767, DQ17 =32767, DQ18 =32767, DQ19 =32767
DQ20 =32767, DQ21 =32767, DQ22 =32767, DQ23 =32767
DQ24 =32767, DQ25 =32767, DQ26 =32767, DQ27 =32767
DQ28 =32767, DQ29 =32767, DQ30 =32767, DQ31 =32767
________________________________________________________________________
[DramcRxWindowPerbitCal] ====Done====
[TX]
[DramcTxWindowPerbitCal] Frequency=1066, Rank=0, calType=2
[DramcTxWindowPerbitCal] Begin, TX DQ(2, 0), DQ OEN(1, 2)
TX Window Sum 472
===============================================================================
Dram Type= 4, Freqency= 1066, rank 0
odt_onoff= 0, Byte mode= 0, Read_DBI= 0, Write DBI= 0
===============================================================================
R0 FINAL: TX Bit0 (33~60) 28 46, Bit8 (33~61) 29 47, Bit16 (32767~32767) 1 32767, Bit24 (32767~32767) 1 32767
R0 FINAL: TX Bit1 (33~60) 28 46, Bit9 (34~62) 29 48, Bit17 (32767~32767) 1 32767, Bit25 (32767~32767) 1 32767
R0 FINAL: TX Bit2 (33~60) 28 46, Bit10 (34~62) 29 48, Bit18 (32767~32767) 1 32767, Bit26 (32767~32767) 1 32767
R0 FINAL: TX Bit3 (34~61) 28 47, Bit11 (33~62) 30 47, Bit19 (32767~32767) 1 32767, Bit27 (32767~32767) 1 32767
R0 FINAL: TX Bit4 (33~60) 28 46, Bit12 (33~61) 29 47, Bit20 (32767~32767) 1 32767, Bit28 (32767~32767) 1 32767
R0 FINAL: TX Bit5 (34~61) 28 47, Bit13 (34~61) 28 47, Bit21 (32767~32767) 1 32767, Bit29 (32767~32767) 1 32767
R0 FINAL: TX Bit6 (33~60) 28 46, Bit14 (34~62) 29 48, Bit22 (32767~32767) 1 32767, Bit30 (32767~32767) 1 32767
R0 FINAL: TX Bit7 (33~61) 29 47, Bit15 (34~61) 28 47, Bit23 (32767~32767) 1 32767, Bit31 (32767~32767) 1 32767
==================================================================
Byte0, PI DQ Delay 46 Delay2 47
Final DQ PI Delay(LargeUI, SmallUI, PI) =(2 ,0, 47)
OEN DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,2, 47)
Byte1, PI DQ Delay 47 Delay2 47
Final DQ PI Delay(LargeUI, SmallUI, PI) =(2 ,0, 47)
OEN DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,2, 47)
Byte2, PI DQ Delay 32767 Delay2 32767
Final DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,2, 63)
OEN DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,0, 63)
Byte3, PI DQ Delay 32767 Delay2 32767
Final DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,2, 63)
OEN DQ PI Delay(LargeUI, SmallUI, PI) =(1 ,0, 63)
[DramcTxWindowPerbitCal] ====Done====
[DramcRxdqsGatingPostProcess] p->frequency 1066
[DramcRxdqsGatingPostProcess] s1ChangeDQSINCTL 0, reg_TX_dly_DQSgated_min 2, u1TXDLY_Cal_min 2
[MEM_TEST] 01: Before run time config
0:dram_rank_size:80000000
[MEM_TEST] Rank 0 Fail. (uiFixedAddr 0x40000000, Pass count =0, Fail count =16384)
=========================
[DramcHWGatingStatus] Rank=0
Byte0(2T, 0.5T, PI) =(1, 3, 17)
Byte1(2T, 0.5T, PI) =(1, 3, 17)
Byte2(2T, 0.5T, PI) =(7, 1, 0)
Byte3(2T, 0.5T, PI) =(3, 5, 0)
UI_Phase1 (DQS0~3) =(13, 13, 59, 31)
=========================
Settings after calibration ...
=== [DramcRunTimeConfig] ===
ZQCS_ENABLE: ON
LOWPOWER_GOLDEN_SETTINGS(DCM): ON
SPM_CONTROL_AFTERK: ON
TEMP_SENSOR_ENABLE: OFF
ENABLE_PER_BANK_REFRESH: OFF
HW_SAVE_FOR_SR: OFF
=========================
[MEM_TEST] 01: After run time config
0:dram_rank_size:80000000
[MEM_TEST] Rank 0 Fail. (uiFixedAddr 0x40000000, Pass count =0, Fail count =16384)
=========================
[DramcHWGatingStatus] Rank=0
Byte0(2T, 0.5T, PI) =(1, 3, 17)
Byte1(2T, 0.5T, PI) =(1, 3, 17)
Byte2(2T, 0.5T, PI) =(7, 1, 0)
Byte3(2T, 0.5T, PI) =(3, 5, 0)
UI_Phase1 (DQS0~3) =(13, 13, 59, 31)
=========================
EMI Setting OK.
emi_num(2), bl_info_len(0x70)
dram_baseaddr=0x40000000
dram_max_size=0x80000000
init dram pass
dram_type: 1
dram_baseaddress: 0x40000000, size: 0x0
REVEIVING CMD(0x10008)
***(4.)Enter cmd_boot_to cmd***
DA hash validation....
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
0x0: 0xdb 0x7
0x1: 0x7c 0xa0
0x2: 0x66 0x94
0x3: 0x10 0x4b
0x4: 0x90 0x98
0x5: 0x31 0x60
0x6: 0x11 0xd
0x7: 0x11 0xb9
0x8: 0xd5 0x27
0x9: 0x76 0xfb
0xa: 0x51 0xbe
0xb: 0xd5 0xc9
0xc: 0x35 0x54
0xd: 0x83 0xd9
0xe: 0x2d 0x80
0xf: 0xf2 0x9b
0x10: 0x72 0x80
0x11: 0xc6 0x78
0x12: 0xc6 0x56
0x13: 0xe4 0xba
da_loop code_length = 0x514b8
at_address = 0x40000000
DA verify pass and jump to DRAM
yeah, that clearly shows that the dram init fails:
***(0.)Enter devc_set_reset_key cmd***
@@enable reset key [0x68]
IN SAL_PMIC_HW_Reset_Enable
Configure pmic hw reset two key mode
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[40]= pmic_wrap read data fail
[PWRAP] ERROR,line=177initialization isn't finished
[pmic_config_interface] Reg[11a]= pmic_wrap read data fail
IN SAL_PMIC_HW_Reset_Enable Done
reset_key=0x68(0x68:two key,0x50:one key)
REVEIVING CMD(0x10009)
REVEIVING DEV CTRL CMD(0x20003)
You could try using --loader and the attached da (unzip first), maybe this resolves the issue. da.zip
santiac89
commented
1 year ago Same result, it gets stuck at Jumping to stage 2. Same errors on DRAM init that you mentioned before.
emeric254
commented
1 year ago Got the same problem on a redmi note 10s (Helio G95) I bricked it doing while doing testing :)
Trying with or without the --loader and --preloader options
python mtk wl ~/rosemary_global_images_V14.0.4.0.TKLMIXM_20230519.0000.00_13.0_global_f31f67683f/rosemary_global_images_V14.0.4.0.TKLMIXM_13.0/imagesMTK Flash/Exploit Client V1.6.2 (c) B.Kerler 2018-2023
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
........Port - Device detected :)
Preloader - CPU: MT6785(Helio G90)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x813
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: E556B4B9B8867AAB0D785364288AF329
Preloader - SOC_ID: BB7DBC82538150973E9071713F96BB1E74C2DF60027EA30E6F96E6CF848C6FB1
PLTools - Loading payload from mt6785_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/user/Projets/mtkclient/mtkclient/payloads/mt6785_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "hash_check" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: MT064GASAO2U21
DAXFlash - UFS MID: 0x2c
DAXFlash - UFS CID: 2c014d54303634474153414f32553231
DAXFlash - UFS FWVer: 30363035
DAXFlash - UFS Serial: 202020200000000000000000
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DRAM config needed for : 2c014d54303634474153414f32553231
DAXFlash - Sending emi data ...
DAXFlash - DRAM setup passed.
DAXFlash - Sending emi data succeeded.
DAXFlash - Uploading stage 2...
DAXFlash - Upload data was accepted. Jumping to stage 2...
DAXFlash
DAXFlash - [LIB]: Stage was't executed. Maybe dram issue ?.
DAXFlash
DAXFlash - [LIB]: Error on booting to da (xflash)
in my case could it be related to #400 ?
Not really sure if done correctly but had no error on the output of the process.
echo_dot_3_brom_preloader.zip