Shelly Wall Display

Botond24 · October 29, 2023, 12:25am

So I have recently gotten a shelly wall display, and I have been trying to figure out if there was any way I could use it with Home Assistant. After a sleepless night here are my findings:

It runs on a custom Android-based system
Shelly gen 2 firmwares are not too hard to find
Its firmware has the “Stargate.apk” preloaded which from what I could find is its own UI app

1

I found this out from its firmware file which gave me the Stargate.apk as well (I’ll attach it to this post)
Also the firmware file seems to be “Singed by SingApk” so maybe the firmware itself is an apk as well

2

When logging into https://control.shelly.cloud/ the browser requests them all, and you can access this request from the dev console’s network tab, I have also uploaded mine to pastebin: { "isok": true, "data": { "7c87ce564d00": { "sta - Pastebin.com

3

Maybe its enough to replace the stargate.apk with a homeassitant apk, I haven’t gotten to that part yet.

I hope this helps any further research into Shelly’s Wall Display product

nickrout · October 29, 2023, 8:26am

Does adb work?

Botond24 · November 2, 2023, 8:08pm

It doesn’t seem to have adb enabled. there are only 2 port open, 80, and 8021 both of which just go to the web interface

EDIT: clarification those are the only TCP ports open, with a lot of UDP ones being open. Needs further testing

Botond24 · November 2, 2023, 10:35pm

I took the thing apart today and found a USB-C port on it and an unused ribbon cable port.
The USB doesn’t seem to provide power to the board, so it must be for debugging/accessing the Android part only. I haven’t tested the USB yet apart from trying to power it through the USB. Also on the PCB there is a writing which seems to suggest that this device has 400MB of memory, so we don’t have a lot to work with.

nixon · November 16, 2023, 10:17pm

any ideas?
the display is gorgeous - much better look’n’feel than the sonoff display… but… until now - i found no way to flash / activate the native android to install fully kiosk or something like that…

autoviking · November 21, 2023, 11:54am

When powering with 230V and connecting the usb cable it shows up as K400_MT6580_32_N. Can’t get adb to work over usb.


 =========================== USB Port1 ===========================

Connection Status        : 0x01 (Device is connected)
Port Chain               : 2-1
Properties               : 0x01
 IsUserConnectable       : yes
 PortIsDebugCapable      : no
 PortHasMultiCompanions  : no
 PortConnectorIsTypeC    : no
ConnectionIndex          : 0x01 (Port 1)
CompanionIndex           : 0
 CompanionHubSymLnk      : USB#ROOT_HUB30#4&33d49526&0&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}
 CompanionPortNumber     : 0x0D (Port 13)
 -> CompanionPortChain   : 2-13

      ========================== Summary =========================
Vendor ID                : 0x0E8D (MediaTek Inc.)
Product ID               : 0x2008
USB Version              : 2.0
Port maximum Speed       : High-Speed (Companion Port 2-13 supports SuperSpeed)
Device maximum Speed     : High-Speed
Device Connection Speed  : High-Speed
Self powered             : yes
Demanded Current         : 500 mA
Used Endpoints           : 4

      ======================== USB Device ========================

        +++++++++++++++++ Device Information ++++++++++++++++++
Device Description       : K400_MT6580_32_N
Device Path 1            : \\?\USB#VID_0E8D&PID_2008#SAWD89832553I#{a5dcbf10-6530-11d2-901f-00c04fb951ed} (GUID_DEVINTERFACE_USB_DEVICE)
Device Path 2            : \\?\USB#VID_0E8D&PID_2008#SAWD89832553I#{6bdd1fc6-810f-11d0-bec7-08002be2092f} (GUID_DEVINTERFACE_IMAGE)
Device Path 3            : \\?\USB#VID_0E8D&PID_2008#SAWD89832553I#{6ac27878-a6fa-4155-ba85-f98f491d4f33} (GUID_DEVINTERFACE_WPD)
Device Path 4            : \\?\USB#VID_0E8D&PID_2008#SAWD89832553I#{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae} (GUID_DEVINTERFACE_WPD_AUDIO)
Kernel Name              : \Device\USBPDO-6
Device ID                : USB\VID_0E8D&PID_2008\SAWD89832553I
Hardware IDs             : USB\VID_0E8D&PID_2008&REV_???? USB\VID_0E8D&PID_2008
Driver KeyName           : {eec5ad98-8080-425f-922a-dabf3de3f69a}\0004 (GUID_DEVCLASS_WPD)
Driver                   : \SystemRoot\System32\drivers\WUDFRd.sys (Version: 10.0.22621.2506  Date: 2023-11-21)
Driver Inf               : C:\WINDOWS\inf\wpdmtp.inf
Legacy BusType           : PNPBus
Class                    : WPD
Class GUID               : {eec5ad98-8080-425f-922a-dabf3de3f69a} (GUID_DEVCLASS_WPD)
Service                  : WUDFWpdMtp
Enumerator               : USB
Location Info            : Port_#0001.Hub_#0001
Location IDs             : PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(1), ACPI(_SB_)#ACPI(PCI0)#ACPI(XHC_)#ACPI(RHUB)#ACPI(HS01)
Container ID             : {20ede00e-6eb0-567e-93ef-bed471f11ba4}
Manufacturer Info        : Shelly
Capabilities             : 0x94 (Removable, UniqueID, SurpriseRemovalOK)
Status                   : 0x0180600A (DN_DRIVER_LOADED, DN_STARTED, DN_DISABLEABLE, DN_REMOVABLE, DN_NT_ENUMERATOR, DN_NT_DRIVER)
Problem Code             : 0
Lower Filters            : WinUsb
IdleInWorkingState       : 0
Power State              : D0 (supported: D0, D3, wake from D0)

        +++++++++++++++++ Registry USB Flags +++++++++++++++++
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\usbflags\0E8D2008FFFF
 osvc                    : REG_BINARY 01 01
 SkipContainerIdQuery    : REG_BINARY 01 00

        ---------------- Connection Information ---------------
Connection Index         : 0x01 (Port 1)
Connection Status        : 0x01 (DeviceConnected)
Current Config Value     : 0x01 (Configuration 1)
Device Address           : 0x05 (5)
Is Hub                   : 0x00 (no)
Device Bus Speed         : 0x02 (High-Speed)
Number Of Open Pipes     : 0x03 (3 pipes to data endpoints)
Pipe[0]                  : EndpointID=1  Direction=IN   ScheduleOffset=0  Type=Bulk       wMaxPacketSize=0x200   bInterval=0  
Pipe[1]                  : EndpointID=1  Direction=OUT  ScheduleOffset=0  Type=Bulk       wMaxPacketSize=0x200   bInterval=0  
Pipe[2]                  : EndpointID=2  Direction=IN   ScheduleOffset=0  Type=Interrupt  wMaxPacketSize=0x1C    bInterval=6   -> 382 Bits/ms = 47750 Bytes/s
Data (HexDump)           : 01 00 00 00 12 01 00 02 00 00 00 40 8D 0E 08 20   ...........@... 
                           FF FF 03 04 05 01 01 02 00 05 00 03 00 00 00 01   ................
                           00 00 00 07 05 81 02 00 02 00 00 00 00 00 07 05   ................
                           01 02 00 02 00 00 00 00 00 07 05 82 03 1C 00 06   ................
                           00 00 00 00                                       ....

        --------------- Connection Information V2 -------------
Connection Index         : 0x01 (1)
Length                   : 0x10 (16 bytes)
SupportedUsbProtocols    : 0x03
 Usb110                  : 1 (yes, port supports USB 1.1)
 Usb200                  : 1 (yes, port supports USB 2.0)
 Usb300                  : 0 (no, port not supports USB 3.0) -> but Companion Port 2-13 does
 ReservedMBZ             : 0x00
Flags                    : 0x00
 DevIsOpAtSsOrHigher     : 0 (Device is not operating at SuperSpeed or higher)
 DevIsSsCapOrHigher      : 0 (Device is not SuperSpeed capable or higher)
 DevIsOpAtSsPlusOrHigher : 0 (Device is not operating at SuperSpeedPlus or higher)
 DevIsSsPlusCapOrHigher  : 0 (Device is not SuperSpeedPlus capable or higher)
 ReservedMBZ             : 0x00
Data (HexDump)           : 01 00 00 00 10 00 00 00 03 00 00 00 00 00 00 00   ................

    ---------------------- Device Descriptor ----------------------
bLength                  : 0x12 (18 bytes)
bDescriptorType          : 0x01 (Device Descriptor)
bcdUSB                   : 0x200 (USB Version 2.0)
bDeviceClass             : 0x00 (defined by the interface descriptors)
bDeviceSubClass          : 0x00
bDeviceProtocol          : 0x00
bMaxPacketSize0          : 0x40 (64 bytes)
idVendor                 : 0x0E8D (MediaTek Inc.)
idProduct                : 0x2008
bcdDevice                : 0xFFFF
iManufacturer            : 0x03 (String Descriptor 3)
 Language 0x0409         : "MediaTek"
iProduct                 : 0x04 (String Descriptor 4)
 Language 0x0409         : "Stargate"
iSerialNumber            : 0x05 (String Descriptor 5)
 Language 0x0409         : "SAWD89832553I"
bNumConfigurations       : 0x01 (1 Configuration)
Data (HexDump)           : 12 01 00 02 00 00 00 40 8D 0E 08 20 FF FF 03 04   .......@... ....
                           05 01                                             ..

    ------------------ Configuration Descriptor -------------------
bLength                  : 0x09 (9 bytes)
bDescriptorType          : 0x02 (Configuration Descriptor)
wTotalLength             : 0x0027 (39 bytes)
bNumInterfaces           : 0x01 (1 Interface)
bConfigurationValue      : 0x01 (Configuration 1)
iConfiguration           : 0x00 (No String Descriptor)
bmAttributes             : 0xC0
 D7: Reserved, set 1     : 0x01
 D6: Self Powered        : 0x01 (yes)
 D5: Remote Wakeup       : 0x00 (no)
 D4..0: Reserved, set 0  : 0x00
MaxPower                 : 0xFA (500 mA)
Data (HexDump)           : 09 02 27 00 01 01 00 C0 FA 09 04 00 00 03 FF FF   ..'.............
                           00 11 07 05 81 02 00 02 00 07 05 01 02 00 02 00   ................
                           07 05 82 03 1C 00 06                              .......

        ---------------- Interface Descriptor -----------------
bLength                  : 0x09 (9 bytes)
bDescriptorType          : 0x04 (Interface Descriptor)
bInterfaceNumber         : 0x00 (Interface 0)
bAlternateSetting        : 0x00
bNumEndpoints            : 0x03 (3 Endpoints)
bInterfaceClass          : 0xFF (Vendor Specific)
bInterfaceSubClass       : 0xFF
bInterfaceProtocol       : 0x00
iInterface               : 0x11 (String Descriptor 17)
 Language 0x0409         : "MTP"
Data (HexDump)           : 09 04 00 00 03 FF FF 00 11                        .........

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x81 (Direction=IN EndpointID=1)
bmAttributes             : 0x02 (TransferType=Bulk)
wMaxPacketSize           : 0x0200 (max 512 bytes)
bInterval                : 0x00 (never NAKs)
Data (HexDump)           : 07 05 81 02 00 02 00                              .......

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x01 (Direction=OUT EndpointID=1)
bmAttributes             : 0x02 (TransferType=Bulk)
wMaxPacketSize           : 0x0200 (max 512 bytes)
bInterval                : 0x00 (never NAKs)
Data (HexDump)           : 07 05 01 02 00 02 00                              .......

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x82 (Direction=IN EndpointID=2)
bmAttributes             : 0x03 (TransferType=Interrupt)
wMaxPacketSize           : 0x001C
 Bits 15..13             : 0x00 (reserved, must be zero)
 Bits 12..11             : 0x00 (0 additional transactions per microframe -> allows 1..1024 bytes per packet)
 Bits 10..0              : 0x1C (28 bytes per packet)
bInterval                : 0x06 (32 microframes -> 4 ms)
Data (HexDump)           : 07 05 82 03 1C 00 06                              .......

    --------- Device Qualifier Descriptor (for Full-Speed) --------
bLength                  : 0x0A (10 bytes)
bDescriptorType          : 0x06 (Device_qualifier Descriptor)
bcdUSB                   : 0x200 (USB Version 2.00)
bDeviceClass             : 0x00 (defined by the interface descriptors)
bDeviceSubClass          : 0x00
bDeviceProtocol          : 0x00
bMaxPacketSize0          : 0x40 (64 Bytes)
bNumConfigurations       : 0x01 (1 other-speed configuration)
bReserved                : 0x00
Data (HexDump)           : 0A 06 00 02 00 00 00 40 01 00                     .......@..

    ------------ Other Speed Configuration Descriptor -------------
bLength                  : 0x09 (9 bytes)
bDescriptorType          : 0x07 (Other_speed_configuration Descriptor)
wTotalLength             : 0x0027 (39 bytes)
bNumInterfaces           : 0x01 (1 Interface)
bConfigurationValue      : 0x01 (Configuration 1)
iConfiguration           : 0x00 (No String Descriptor)
bmAttributes             : 0xC0
 D7: Reserved, set 1     : 0x01
 D6: Self Powered        : 0x01 (yes)
 D5: Remote Wakeup       : 0x00 (no)
 D4..0: Reserved, set 0  : 0x00
MaxPower                 : 0xFA (500 mA)
Data (HexDump)           : 09 07 27 00 01 01 00 C0 FA 09 04 00 00 03 FF FF   ..'.............
                           00 11 07 05 81 02 40 00 00 07 05 01 02 40 00 00   ......@......@..
                           07 05 82 03 1C 00 06                              .......

        ---------------- Interface Descriptor -----------------
bLength                  : 0x09 (9 bytes)
bDescriptorType          : 0x04 (Interface Descriptor)
bInterfaceNumber         : 0x00 (Interface 0)
bAlternateSetting        : 0x00
bNumEndpoints            : 0x03 (3 Endpoints)
bInterfaceClass          : 0xFF (Vendor Specific)
bInterfaceSubClass       : 0xFF
bInterfaceProtocol       : 0x00
iInterface               : 0x11 (String Descriptor 17)
 Language 0x0409         : "MTP"
Data (HexDump)           : 09 04 00 00 03 FF FF 00 11                        .........

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x81 (Direction=IN EndpointID=1)
bmAttributes             : 0x02 (TransferType=Bulk)
wMaxPacketSize           : 0x0040 (64 bytes)
bInterval                : 0x00 (ignored)
Data (HexDump)           : 07 05 81 02 40 00 00                              ....@..

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x01 (Direction=OUT EndpointID=1)
bmAttributes             : 0x02 (TransferType=Bulk)
wMaxPacketSize           : 0x0040 (64 bytes)
bInterval                : 0x00 (ignored)
Data (HexDump)           : 07 05 01 02 40 00 00                              ....@..

        ----------------- Endpoint Descriptor -----------------
bLength                  : 0x07 (7 bytes)
bDescriptorType          : 0x05 (Endpoint Descriptor)
bEndpointAddress         : 0x82 (Direction=IN EndpointID=2)
bmAttributes             : 0x03 (TransferType=Interrupt)
wMaxPacketSize           : 0x001C (28 bytes)
bInterval                : 0x06 (6 ms)
Data (HexDump)           : 07 05 82 03 1C 00 06                              .......

      -------------------- String Descriptors -------------------
             ------ String Descriptor 0 ------
bLength                  : 0x04 (4 bytes)
bDescriptorType          : 0x03 (String Descriptor)
Language ID[0]           : 0x0409 (English - United States)
Data (HexDump)           : 04 03 09 04                                       ....
             ------ String Descriptor 3 ------
bLength                  : 0x12 (18 bytes)
bDescriptorType          : 0x03 (String Descriptor)
Language 0x0409          : "MediaTek"
Data (HexDump)           : 12 03 4D 00 65 00 64 00 69 00 61 00 54 00 65 00   ..M.e.d.i.a.T.e.
                           6B 00                                             k.
             ------ String Descriptor 4 ------
bLength                  : 0x12 (18 bytes)
bDescriptorType          : 0x03 (String Descriptor)
Language 0x0409          : "Stargate"
Data (HexDump)           : 12 03 53 00 74 00 61 00 72 00 67 00 61 00 74 00   ..S.t.a.r.g.a.t.
                           65 00                                             e.
             ------ String Descriptor 5 ------
bLength                  : 0x1C (28 bytes)
bDescriptorType          : 0x03 (String Descriptor)
Language 0x0409          : "Serial"
Data (HexDump)           : 
                           
             ------ String Descriptor 17 ------
bLength                  : 0x08 (8 bytes)
bDescriptorType          : 0x03 (String Descriptor)
Language 0x0409          : "MTP"
Data (HexDump)           : 08 03 4D 00 54 00 50 00                           ..M.T.P.

morph1 · November 25, 2023, 6:47pm

here are the boot messages of the underlying android system - you can access them via the testpads.

It’s been a while since i made the capture - i don’t recall the parameters anymore.
If someone is actually going to put effort in - i will do another session with proper documentation of the physical interface

\0\xFF\0\xFF\0\0\xFF\0\x80\0\x80\x80\0\0\0\x80\0\0\0\x80\0\0\0\x80\0\0\0\0\0\0\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\x80\0\0\0\x80\x80\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\x80\0\0\x80\x80\x80\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\x80\x80\x80\0\0\0\0\0\0\x80\0\0\x80\x80\x80\x80\0\x80\0\x80\x80\0\0\0\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\x80\0\0\0\x80\0\x80\x80\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\0\0\0\0\x80\x80\x80\x80\0\0\0\0\0\0\0\0\x80\x80\x80\x80\0\x80\0\x80\x80\0\x80\0\x80\0\0\0\x80\0\0\0\0\0\x80\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\x80\0\x80\x80\0\x80\x80\0\x80\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\x80\0\0\0\x80\0\x80\0\0\0\0\x80\x80\x80\x80\0\0\0\0\0\0\0\0\x80\x80\x80\x80\0\x80\0\x80\x80\0\0\x80\x80\x80\0\0\0\x80\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x80\0\0\0\x80\0\x80\x80\x80\0\0\0\x80\x80\x80\x80\0\0\0\0\0\0\0\0\x80\x80\x80\x80\x80\0\x80\0\x80\x80\0\0\x80\0\x80\x80\x80\x80\x80\x80\x80\x80\x80\0\x80\0\0\0\x80\x80\x80\x80\x80\0\0\0\0\x80\0\0\x80\0\x80\0\x80\x80\0\0\x80\0\x80\x80\0[WRAP] pwrap_init_preloader
[WRAP] pwrap_init
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6351] pass,index=0 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=1 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=2 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=3 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=4 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=5 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=6 rdata=5AA5
[WRAP] ERROR,line=657 _pwrap_init_sistrobe [Read Test of MT6350] pass,index=7 rdata=5AA5
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=8 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=9 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=10 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=11 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=12 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=13 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=14 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=15 rdata=B54B
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=16 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=17 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=18 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=19 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=20 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=21 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=22 rdata=6A97
[WRAP] ERROR,line=660 _pwrap_init_sistrobe [Read Test of MT6350] tuning,index=23 rdata=6A97
[WRAP] _pwrap_init_reg_clock
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic6350_init] Preloader Start..................
[pmic6350_init] PMIC CHIP Code = 8272
just_rst = 0
Battery exist
[0xE]=0x5
[pmic_init] turn off usbdl wo battery
pl pmic powerkey Press
[pmic6350_init] powerKey = 1
[pmic6350_init] is USB in = 45060
Battery exist
[0xE]=0x5
[AUXADC] u4channel[4]=250.
[AUXADC] adc_result_temp=250, adc_result=13, r_val_temp=1.
[AUXADC] u4channel[7]=19146.
[AUXADC] adc_result_temp=19146, adc_result=4206, r_val_temp=4.
[pl_check_bat_protect_status]: check VBAT=4206 mV with 3100 mV ,chr:123  start charging... 
[PL][pl_check_bat_protect_status]: check VBAT=4206 mV with 3100 mV, stop charging... 
[pmic6350_init] Done...................
jlink_pre_init_hwinfo 176
[msdc_init]: msdc0 Host controller intialization start 
[SD0] Pins mode(2), none(0), down(1), up(2), keep(3)
[SD0] Pins mode(1), none(0), down(1), up(2), keep(3)
[SD0] Pins mode(2), none(0), down(1), up(2), keep(3)
[info][msdc_config_clksrc] input clock is 208000kHz
[SD0] Bus Width: 1
[info][msdc_config_clksrc] input clock is 208000kHz
[SD0] SET_CLK(260kHz): SCLK(260kHz) MODE(0) DDR(0) DIV(200) DS(0) RS(0)
[msdc_init]: msdc0 Host controller intialization done
[info][msdc_config_clksrc] input clock is 208000kHz
[SD0] SET_CLK(260kHz): SCLK(260kHz) MODE(0) DDR(0) DIV(200) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Switch to High-Speed mode!
[SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[mmc_init_mem_card 3035][SD0] Initialized, eMMC50
before host->cur_bus_clk(260000)
[info][msdc_config_clksrc] input clock is 208000kHz
[SD0] SET_CLK(52000kHz): SCLK(52000kHz) MODE(0) DDR(0) DIV(1) DS(0) RS(0)
host->cur_bus_clk(52000000)
[mmc_init_card]: finish successfully
 buffer_hw[0=]30  buffer_hw[1]=31  buffer_hw[2]=CE 
 0 0 0 0
============ jlink_custom_gpio_fix 90 ==========
mem clk DDR800
AP_PLL_CON1= 0x3C3C23C0
AP_PLL_CON2= 0x4
CLKSQ_STB_CON0= 0x25002100
PLL_ISO_CON0= 0x202020
ARMPLL_CON0= 0x11
ARMPLL_CON1= 0x8009A000
ARMPLL_PWR_CON0= 0x5
MPLL_CON0= 0x8000011
MPLL_CON1= 0x800E7000
MPLL_PWR_CON0= 0x5
UPLL_CON0= 0x38000001
UPLL_CON1= 0x1000060
UPLL_PWR_CON0= 0x5DISP_CG_CON0= 0xFFFFFFFC, 
DISP_CG_CON1= 0x0, 
cpu_freq = 3Khz
bus_freq = 125Khz
mem_freq = 199Khz
[PLF]Init I2C: OK(0)
[PLF]Init PWRAP: OK(0)
[PLF]Init PMIC: OK(0)
[PLF]chip_ver[0]

[BLDR] Build Time: 20230519-192152
==== Dump RGU Reg ========
RGU MODE:     4D
RGU LENGTH:   FFE0
RGU STA:      0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
 mtk_wdt_mode_config  mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
 mtk_wdt_mode_config  mode value=5D, tmp:2200005D
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
Enter mtk_kpd_gpio_set! 
after set KP enable: KP_SEL = 0x1C70 !
[WDT][0x28A]=0x0
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=3960
[RTC] bbpu = 0x1, con = 0x84A7, osc32con = 0x9C2A, sec = 0x0, yea = 0x2
rtc_first_boot_init
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=0
[RTC] get_frequency_meter: input=0x0, ouput=5
[RTC] get_frequency_meter: input=0x0, ouput=4333
[RTC] EOSC_Cali: TOP_CKCON1=0xC0
[RTC] get_frequency_meter: val=0xF osc32con=0xBC2F
[RTC] get_frequency_meter: osc32con=0x9C2A
[RTC] get_frequency_meter: input=0xF, ouput=874
[RTC] EOSC_Cali: val=0x36A
[RTC] get_frequency_meter: val=0x7 osc32con=0xBC27
[RTC] get_frequency_meter: osc32con=0x9C2A
[RTC] get_frequency_meter: input=0x7, ouput=742
[RTC] EOSC_Cali: val=0x2E6
[RTC] get_frequency_meter: val=0xB osc32con=0xBC2B
[RTC] get_frequency_meter: osc32con=0x9C2A
[RTC] get_frequency_meter: input=0xB, ouput=807
[RTC] EOSC_Cali: val=0x327
[RTC] get_frequency_meter: val=0x9 osc32con=0xBC29
[RTC] get_frequency_meter: osc32con=0x9C2A
[RTC] get_frequency_meter: input=0x9, ouput=775
[RTC] EOSC_Cali: val=0x307
[RTC] get_frequency_meter: val=0xA osc32con=0xBC2A
[RTC] get_frequency_meter: osc32con=0x9C2A
[RTC] get_frequency_meter: input=0xA, ouput=792
[RTC] EOSC_Cali: val=0x318
[RTC] EOSC cali val = 0xA
[RTC] EOSC cali val = 0x3C8A
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x80, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0x1, con = 0x4A6, cali = 0x0
[WDT2][0x28A]=0x0
pl pmic powerkey Press
power key is pressed
Battery exist
[0xE]=0x5
[PLF]PWR key boot
[RTC] rtc_bbpu_power_on done
mt_get_dram_type() 0x3
[EMI] LPDDR3
[EMI] mcp_dram_num:0,discrete_dram_num:1,enable_combo_dis:0
[Check]mt_get_mdl_number 0x0
[EMI] eMMC/NAND ID = 15,1,0,46,4E,31,32,4D,42,0,84,C5,6A,94,43,53
[EMI] MDL number = 0
[EMI] emi_set eMMC/NAND ID = 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Start REXTDN SW calibration...
enable P drive (initial settings), 0x0644:27Dh
2.1. DRVP 0x00c0[15:12]:0h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:1000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:2000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:3000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:4000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:5000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:6000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:7000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:8000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:9000h
2.2. CMPOP 0x03dc[31]:0h
2.1. DRVP 0x00c0[15:12]:A000h
2.2. CMPOP 0x03dc[31]:80000000h
P drive:10
enable N drive (initial settings), 0x0644:17Dh
4.1. DRVN 0x00c0[11:8]:A000h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A100h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A200h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A300h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A400h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A500h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A600h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A700h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A800h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:A900h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:AA00h
4.2.CMPON 0x3dc[30]:0h
4.1. DRVN 0x00c0[11:8]:AB00h
4.2.CMPON 0x3dc[30]:40000000h
N drive:10
drvp=10,drvn=10
=============================================
X-axis: DQS Gating Window Delay (Fine Scale)
Y-axis: DQS Gating Window Delay (Coarse Scale)
=============================================
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1
000E:|    1    1    1    1    1    1    1    1    1    1    1    1    1    1    1    1
000F:|    1    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0
0010:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0011:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
Rank 0 coarse tune value selection : 14, \xF0\x1F\xE5
[fcGATING_SAME_MCK]rank0 gating record N-1, coarse = 13, fine = 112
rk0 coarse=14
rk0 fine=64
NEW DATLAT calibration 
DATLAT DefVal=0x7
TAP=3, err=0xFFFFFFFF, begin=0, first=255, sum=0
TAP=4, err=0xFFFFFFFF, begin=0, first=255, sum=0
TAP=5, err=0xFFFFFFFF, begin=0, first=255, sum=0
TAP=6, err=0x0, begin=1, first=6, sum=1
TAP=7, err=0x0, begin=1, first=6, sum=2
New DATLAT with RX scan. Early Break!!
first=6 total=2 best=7
[EMI]warning:rank auto detect:==single rank==
DQS loop = 15, cmperr = FFFFFFFF 
DQS loop = 14, cmperr = FFFFFFFF 
DQS loop = 13, cmperr = FFFFFFFF 
DQS loop = 12, cmperr = FFFFFFFF 
DQS loop = 11, cmperr = FFFFFFFF 
DQS loop = 10, cmperr = FFFFFFFF 
DQS loop = 9, cmperr = FFFFFFFF 
DQS loop = 8, cmperr = FFFFFFFF 
DQS loop = 7, cmperr = FFFFFFFF 
DQS loop = 6, cmperr = FFFFFFFF 
DQS loop = 5, cmperr = FFFFFFFF 
DQS loop = 4, cmperr = FFFFFFFF 
DQS loop = 3, cmperr = FFFFFFFF 
DQS loop = 2, cmperr = FFFFFFFF 
DQS loop = 1, cmperr = FFFFFFFF 
DQS loop = 0, cmperr = FFFFFFFF 
DQ loop=15, cmperr = FFFFFFFF
DQ loop=14, cmperr = FFFFFFFF
DQ loop=13, cmperr = FFFFFFFF
DQ loop=12, cmperr = FFFFFFFF
DQ loop=11, cmperr = FFFFFFFF
DQ loop=10, cmperr = FFFFFFFF
DQ loop=9, cmperr = FFFFFFFF
DQ loop=8, cmperr = FFFFFFFF
DQ loop=7, cmperr = FFFFFFFF
DQ loop=6, cmperr = FFFFFFFF
DQ loop=5, cmperr = FFFFFFFF
DQ loop=4, cmperr = FFFFFFFF
DQ loop=3, cmperr = FFFFFFFF
DQ loop=2, cmperr = FFFFFFFF
DQ loop=1, cmperr = FFFFFFFF
DQ loop=0, cmperr = FFFFFFFF
byte:0, (DQS,DQ)=(0,0)
byte:1, (DQS,DQ)=(0,0)
byte:2, (DQS,DQ)=(0,0)
byte:3, (DQS,DQ)=(0,0)
[EMI] DRAMC calibration passed

1234cw: 10 15
########## 3742 rsize :40000000 ##########
old pdn1: 1:40
new pdn1: 40
jlink_write_data: olen: 512 offset: 256000 512
########### bt: 27, wt:0, it:0, 8000, 0###########
1234cw: 10 15
[MEM] complex R/W mem test pass
0:dram_rank_size:40000000
[Dram_Buffer] dram size:0x40000000
[Dram_Buffer] dram_buf_t sz:0x19D240
[Dram_Buffer] part_hdr_t sz:0x200
[Dram_Buffer] dram_buf start:0x82000000 
RAM_CONSOLE sram(0x10DC00) sig (0x945B1ED2)  mismatch
RAM_CONSOLE start: 0x83F00000, size: 0x10000, sig: 0x8000
RAM_CONSOLE wdt status (0x83F00040)=0x0
[PLF]Init Boot Dev: OK(0)
Enter mtk_kpd_gpio_set! 
0:dram_rank_size:40000000
0:dram_rank_size:40000000
orig_dram_info[0] start: 0x0000000080000000, size: 0x0000000040000000
total_dram_size: 0x0000000040000000, max_dram_size: 0xFFFFFFFFFFFFFFFF
[EMI_DRV]mpu protect region 7 0x80000000 to 0x C0000000[OK]
[GPT_PL]Parsing Primary GPT now...
[GPT_PL][0]name=proinfo, part_id=8, start_sect=0x400, nr_sects=0x1800
[GPT_PL][1]name=nvram, part_id=8, start_sect=0x1C00, nr_sects=0x2800
[GPT_PL][2]name=protect1, part_id=8, start_sect=0x4400, nr_sects=0x5000
[GPT_PL][3]name=protect2, part_id=8, start_sect=0x9400, nr_sects=0x5000
[GPT_PL][4]name=seccfg, part_id=8, start_sect=0xE400, nr_sects=0x200
[GPT_PL][5]name=lk, part_id=8, start_sect=0xE600, nr_sects=0x1000
[GPT_PL][6]name=boot, part_id=8, start_sect=0xF600, nr_sects=0x8000
[GPT_PL][7]name=recovery, part_id=8, start_sect=0x17600, nr_sects=0x8000
[GPT_PL][8]name=para, part_id=8, start_sect=0x1F600, nr_sects=0x400
[GPT_PL][9]name=logo, part_id=8, start_sect=0x1FA00, nr_sects=0xA000
[GPT_PL][10]name=expdb, part_id=8, start_sect=0x29A00, nr_sects=0x5000
[GPT_PL][11]name=Partition_null, part_id=8, start_sect=0x2EA00, nr_sects=0x8FB00
[GPT_PL][12]name=nvdata, part_id=8, start_sect=0xBE500, nr_sects=0x10000
[GPT_PL][13]name=metadata, part_id=8, start_sect=0xCE500, nr_sects=0x11B00
[GPT_PL][14]name=oemkeystore, part_id=8, start_sect=0xE0000, nr_sects=0x1000
[GPT_PL][15]name=secro, part_id=8, start_sect=0xE1000, nr_sects=0x3000
[GPT_PL][16]name=keystore, part_id=8, start_sect=0xE4000, nr_sects=0x4000
[GPT_PL][17]name=system, part_id=8, start_sect=0xE8000, nr_sects=0x300000
[GPT_PL][18]name=cache, part_id=8, start_sect=0x3E8000, nr_sects=0x80000
[GPT_PL][19]name=custom, part_id=8, start_sect=0x468000, nr_sects=0x96000
[GPT_PL][20]name=frp, part_id=8, start_sect=0x4FE000, nr_sects=0x2000
[GPT_PL][21]name=userdata, part_id=8, start_sect=0x500000, nr_sects=0x987C00
[GPT_PL][22]name=flashinfo, part_id=8, start_sect=0xE87C00, nr_sects=0x8000
[GPT_PL]Success to find valid GPT.

[PART] blksz: 512B
[PART] [0x0000000000080000-0x000000000037FFFF] "proinfo" (6144 blocks) 
[PART] [0x0000000000380000-0x000000000087FFFF] "nvram" (10240 blocks) 
[PART] [0x0000000000880000-0x000000000127FFFF] "protect1" (20480 blocks) 
[PART] [0x0000000001280000-0x0000000001C7FFFF] "protect2" (20480 blocks) 
[PART] [0x0000000001C80000-0x0000000001CBFFFF] "seccfg" (512 blocks) 
[PART] [0x0000000001CC0000-0x0000000001EBFFFF] "lk" (4096 blocks) 
[PART] [0x0000000001EC0000-0x0000000002EBFFFF] "boot" (32768 blocks) 
[PART] [0x0000000002EC0000-0x0000000003EBFFFF] "recovery" (32768 blocks) 
[PART] [0x0000000003EC0000-0x0000000003F3FFFF] "para" (1024 blocks) 
[PART] [0x0000000003F40000-0x000000000533FFFF] "logo" (40960 blocks) 
[PART] [0x0000000005340000-0x0000000005D3FFFF] "expdb" (20480 blocks) 
[PART] [0x0000000005D40000-0x0000000017C9FFFF] "Partition_null" (588544 blocks) 
[PART] [0x0000000017CA0000-0x0000000019C9FFFF] "nvdata" (65536 blocks) 
[PART] [0x0000000019CA0000-0x000000001BFFFFFF] "metadata" (72448 blocks) 
[PART] [0x000000001C000000-0x000000001C1FFFFF] "oemkeystore" (4096 blocks) 
[PART] [0x000000001C200000-0x000000001C7FFFFF] "secro" (12288 blocks) 
[PART] [0x000000001C800000-0x000000001CFFFFFF] "keystore" (16384 blocks) 
[PART] [0x000000001D000000-0x000000007CFFFFFF] "system" (3145728 blocks) 
[PART] [0x000000007D000000-0x000000008CFFFFFF] "cache" (524288 blocks) 
[PART] [0x000000008D000000-0x000000009FBFFFFF] "custom" (614400 blocks) 
[PART] [0x000000009FC00000-0x000000009FFFFFFF] "frp" (8192 blocks) 
[PART] [0x00000000A0000000-0x00000001D0F7FFFF] "userdata" (9993216 blocks) 
[PART] [0x00000001D0F80000-0x00000001D1F7FFFF] "flashinfo" (32768 blocks) 
[ROM_INFO] 'v2','0x0','0x0','0x0','0x2C00'
[SEC] AES Legacy : 0
[SEC] SECCFG AC : 1

[LIB] Loading SEC config
[LIB] Name = 
[LIB] Config = 0x22, 0x22
[LIB] SECRO (ac, ac_offset, ac_length) = (0x1, 0x40, 0x40)
0x31,0x41,0x35,0x35


[SEC] read '0x1C80000'
0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,
[LIB] CFG read size '0x2000' '0x1860'
0x0
[LIB] HW DEC
0xACB5B17F
[LIB] SEC CFG doesn't exist
[SEC] init fail '0x3000'
[LIB] seccfg magic is incorrect
\0\0\x80\x80\x80\x80\0\x80\x80\0\x80\0\0\x80\x80\0\x80\x80[BLDR] Tool connection is unlocked
VUSB_EN is on
[TOOL] PMIC not dectect usb cable!
[TOOL] <UART> listen  ended, receive size:0!

[TOOL] <UART> wait sync time 150ms->150ms
[TOOL] <UART> receieved data: ()
[LIB] NS-CHIP
[SECRO] Don't read
[LIB] NS-CHIP
[SBC] Don't check

Device APC domain init setup:

Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x54800000)
Domain Setup (0x0)
[PART] partition hdr (1)
[PART] Image with part header
[PART] name : lk
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 370584
[PART] magic: 58881688h

[PART] load "lk" from 0x0000000001CC0200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 25849KB/s, 370584 bytes, 14ms
=================jlink_load_hwinfo 276, 8F100000
LCD devices id:0x30
LCD devices id:0x31
LCD devices id:0xCE
LCD devices id:0x30
LCD devices id:0x31
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x31
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
LCD devices id:0x30
no jlink 340
Battery exist
[0xE]=0x5

[PLF] boot to LK by ATAG.
boot reason: 0
boot mode: 0
META COM0: 0
rank[0] size 0x40000000
tee resv mem 0x0000000000000000 0x0000000000000000
md_type[0]: 0x0
md_type[1]: 0x0
boot time: 1727
DDR resv mode enable = 0, success = 0, ready = 0
dram buf size 1692224
SMC 0x0
LK 0x3
Kernel 0x3
N-Sec SRAM Addr: 0x10DC00, size: 0x2400
PL_VERSION = 0.1.00

morph1 · November 25, 2023, 6:47pm

second part necessary due to character limit per post

[BLDR] jump to 0x81E00000
[BLDR] <0x81E00000>=0xEA000007
[BLDR] <0x81E00004>=0xEA006C12
[0] kernel_boot_opt=3
[0] 32Bit Kernel
[0] [LEDS]LK: leds_init: mt65xx_backlight_off 
[0] [LEDS]LK: mt65xx_backlight_off 
[0] [LEDS]LK: lcd-backlight level is 0 
[0] [pmic_init] LK Start..................
[0] [pmic_init] MT6350 CHIP Code = 0x2050
[0] [pmic_init] Done
heap base 0x81ead414 size 8727532 bytes: 82700000
[10]  ==LK info ==
[20]  Build time:May 19 2023, 19:21:53
[20]  chip_code[0x6580]
[20]  chip_ver[0x0]
[20]  ==LK info ==
[20] ==dump boot argument==
[20] BOOT_REASON: 0
[20] BOOT_MODE: 0
[20] META_COM TYPE: 0
[20] META_COM ID: 0
[20] META_COM PORT: 285233152
[20] LOG_COM PORT: 285233152
[20] LOG_COM BAUD: 921600
[20] LOG_COM EN: 1
[20] MEM_NUM: 1
[20] MEM_SIZE: 0x40000000
[20] mblock num: 0x1
[20] mblock start: 0x80000000
[20] mblock size: 0x40000000
[20] mblock rank: 0x0
[20] mblock start: 0x0
[20] mblock size: 0x0
[20] mblock rank: 0x0
[20] mblock start: 0x0
[20] mblock size: 0x0
[20] mblock rank: 0x0
[20] mblock start: 0x0
[20] mblock size: 0x0
[20] mblock rank: 0x0
[20] orig_dram num: 0x1
[20] orig_dram start: 0x80000000
[20] orig_dram size: 0x40000000
[20] orig_dram start: 0x0
[20] orig_dram size: 0x0
[20] orig_dram start: 0x0
[20] orig_dram size: 0x0
[20] orig_dram start: 0x0
[40] orig_dram size: 0x0
[40] lca start: 0x0
[40] lca size: 0x0
[40] tee start: 0x0
[40] tee size: 0x0
[40] MD_INFO: 0x0
[40] MD_INFO: 0x0
[40] MD_INFO: 0x0
[40] MD_INFO: 0x0
[40] BOOT_TIME: 1727
[40] DA_INFO: 0x0
[40] DA_INFO: 0x1000
[40] DA_INFO: 0x0
[40] DA_INFO: 0x0
[40] DA_INFO: 0x0
[40] SEC_INFO: 0x80000
[40] SEC_INFO: 0x0
[40] PART_NUM: 1
[40] PART_INFO: 0x82058a04
[40] EFLAG: 0
[40] DDR_RESERVE: 0
[40] DDR_RESERVE: 0
[40] DRAM_BUF: 1692224
[40] SMC: 0x0
[40] SMC: 0x3
[40] SMC: 0x3
[40] SRAM satrt: 0x10dc00
[40] SRAM size: 0x2400
[40] ==dump boot argument==
[40] platform_init()
[40] [msdc_init]: msdc0 Host controller intialization start 
[40] [SD0] Pins mode(2), none(0), down(1), up(2), keep(3)
[40] [SD0] Pins mode(1), none(0), down(1), up(2), keep(3)
[40] [SD0] Pins mode(2), none(0), down(1), up(2), keep(3)
[40] [info][msdc_config_clksrc] input clock is 208000kHz
[60] [SD0] Bus Width: 1
[60] [info][msdc_config_clksrc] input clock is 208000kHz
[60] [SD0] SET_CLK(260kHz): SCLK(260kHz) MODE(0) DDR(0) DIV(200) DS(0) RS(0)
[60] [msdc_init]: msdc0 Host controller intialization done
[180] [info][msdc_config_clksrc] input clock is 208000kHz
[180] [SD0] SET_CLK(260kHz): SCLK(260kHz) MODE(0) DDR(0) DIV(200) DS(0) RS(0)
[180] [SD0] Bus Width: 8
[180] [SD0] Switch to High-Speed mode!
[200] [SD0] Size: 7456 MB, Max.Speed: 52000 kHz, blklen(512), nblks(15269888), ro(0)
[200] [mmc_init_mem_card 3035][SD0] Initialized, eMMC50
[200] before host->cur_bus_clk(260000)
[200] [info][msdc_config_clksrc] input clock is 208000kHz
[200] [SD0] SET_CLK(52000kHz): SCLK(52000kHz) MODE(0) DDR(0) DIV(1) DS(0) RS(0)
[200] host->cur_bus_clk(52000000)
[200] [mmc_init_card]: finish successfully
[200] [mt_part_register_device]
[200] [partition init]
[200] [GPT_LK]Parsing Primary GPT now...
[200] [GPT_LK][0]name=proinfo, part_id=8, start_sect=0x400, nr_sects=0x1800
[220] [GPT_LK][1]name=nvram, part_id=8, start_sect=0x1c00, nr_sects=0x2800
[220] [GPT_LK][2]name=protect1, part_id=8, start_sect=0x4400, nr_sects=0x5000
[220] [GPT_LK][3]name=protect2, part_id=8, start_sect=0x9400, nr_sects=0x5000
[220] [GPT_LK][4]name=seccfg, part_id=8, start_sect=0xe400, nr_sects=0x200
[220] [GPT_LK][5]name=lk, part_id=8, start_sect=0xe600, nr_sects=0x1000
[220] [GPT_LK][6]name=boot, part_id=8, start_sect=0xf600, nr_sects=0x8000
[220] [GPT_LK][7]name=recovery, part_id=8, start_sect=0x17600, nr_sects=0x8000
[220] [GPT_LK][8]name=para, part_id=8, start_sect=0x1f600, nr_sects=0x400
[220] [GPT_LK][9]name=logo, part_id=8, start_sect=0x1fa00, nr_sects=0xa000
[220] [GPT_LK][10]name=expdb, part_id=8, start_sect=0x29a00, nr_sects=0x5000
[220] [GPT_LK][11]name=Partition_null, part_id=8, start_sect=0x2ea00, nr_sects=0x8fb00
[220] [GPT_LK][12]name=nvdata, part_id=8, start_sect=0xbe500, nr_sects=0x10000
[240] [GPT_LK][13]name=metadata, part_id=8, start_sect=0xce500, nr_sects=0x11b00
[240] [GPT_LK][14]name=oemkeystore, part_id=8, start_sect=0xe0000, nr_sects=0x1000
[240] [GPT_LK][15]name=secro, part_id=8, start_sect=0xe1000, nr_sects=0x3000
[240] [GPT_LK][16]name=keystore, part_id=8, start_sect=0xe4000, nr_sects=0x4000
[240] [GPT_LK][17]name=system, part_id=8, start_sect=0xe8000, nr_sects=0x300000
[240] [GPT_LK][18]name=cache, part_id=8, start_sect=0x3e8000, nr_sects=0x80000
[240] [GPT_LK][19]name=custom, part_id=8, start_sect=0x468000, nr_sects=0x96000
[240] [GPT_LK][20]name=frp, part_id=8, start_sect=0x4fe000, nr_sects=0x2000
[240] [GPT_LK][21]name=userdata, part_id=8, start_sect=0x500000, nr_sects=0x987c00
[240] [GPT_LK][22]name=flashinfo, part_id=8, start_sect=0xe87c00, nr_sects=0x8000
[240] [GPT_LK]Success to find valid GPT.
[240] [mboot_recovery_load_misc]: size is 6144
[260] [mboot_recovery_load_misc]: misc_addr is 0x82036da8
[260] [PART_LK][get_part] para
[260] [LK_BOOT] Load '<null>' partition to 0x82036DA8 (6144 bytes in 2 ms)
[260] [PART_LK][get_part] boot
[260] [LK_BOOT] Load '<null>' partition to 0x81EB6D9C (2656 bytes in 3 ms)
[260] [PART_LK][get_part] boot
[260] [partition_get_index]find boot boot index 8
[260] [PART_LK][get_part] boot
[280] [PART_LK][get_part] boot
[280] [PART_LK][get_part] boot
[380] [LK] fdt setup addr:0x8e000000 status:1!!!
[400] [PART_LK][get_part] para
read_env_area 324 =========== ,
[LK_ENV]ENV initialize sucess
[LK_ENV]env:
off-mode-charge=1
disp_lcm_probe 1225 
jlink_load_lcm_mode_for_gpio_control 933 ==================== 5028
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-0: 14
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-0: 14: 16816
jlink_load_lcm_mode_for_gpio_control 950 == a00, 10
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-1: 15
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-1: 15: 16948
jlink_load_lcm_mode_for_gpio_control 950 == a00, 10
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-2: 16
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-2: 16: 17080
jlink_load_lcm_mode_for_gpio_control 950 == 4600, 70
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-3: 17
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-3: 17: 17212
jlink_load_lcm_mode_for_gpio_control 950 == 4600, 70
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-4: 18
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-4: 18: 17344
jlink_load_lcm_mode_for_gpio_control 950 == 1000, 16
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-5: 19
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-5: 19: 17472
jlink_load_lcm_mode_for_gpio_control 950 == 1000, 16
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-6: 20
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-6: 20: 17600
jlink_load_lcm_mode_for_gpio_control 950 == 1100, 17
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-7: 21
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-7: 21: 17728
jlink_load_lcm_mode_for_gpio_control 950 == 1100, 17
jlog== jlink_lcm_read_raw_from_part 1272 we need hwinfo[5] to be m to start logo parse
jlink_load_lcm_mode_for_gpio_control 933 ==================== 5028
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-0: 14
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-0: 14: 16816
jlink_load_lcm_mode_for_gpio_control 950 == a00, 10
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-1: 15
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-1: 15: 16948
jlink_load_lcm_mode_for_gpio_control 950 == a00, 10
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-2: 16
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-2: 16: 17080
jlink_load_lcm_mode_for_gpio_control 950 == 4600, 70
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-3: 17
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-3: 17: 17212
jlink_load_lcm_mode_for_gpio_control 950 == 4600, 70
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-4: 18
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-4: 18: 17344
jlink_load_lcm_mode_for_gpio_control 950 == 1000, 16
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-5: 19
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-5: 19: 17472
jlink_load_lcm_mode_for_gpio_control 950 == 1000, 16
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-6: 20
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-6: 20: 17600
jlink_load_lcm_mode_for_gpio_control 950 == 1100, 17
jlink_load_lcm_mode_for_gpio_control 940 == pinctrl-7: 21
jlink_load_lcm_mode_for_gpio_control 943 == pinctrl-7: 21: 17728
jlink_load_lcm_mode_for_gpio_control 950 == 1100, 17
lcm_common_get_params 744 
we will check lcm: 0xce_st7703_ly_psd_dsi_vdo
[620] [LCM][jlink] jlink_fast_hwinfo_compare_id: Compare ID 1 cmd:0: 184
jlink fast compare lcm got 0xce_st7703_ly_psd_dsi_vdo
lcm_common_get_params 744 
[620] mblock[0].start: 0x80000000, sz: 0x40000000, limit: 0x100000000, max_addr: 0x0, max_rank: 0, target: -1, mblock[].rank: 0
[630] mblock_reserve dbg[0]: 1, 1, 1, 1
[640] mblock_reserve: bf800000 - c0000000 from mblock 0
[640] FB base = 0xbf800000, FB size = 8388608
[640] fb_va: 0xbf800000, fb_pa: 0xbf800000, fb_pa_k: 0xbf800000
[LK_ENV]get_env DFO
[640] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 4, 70
[640] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 4, 10
[640] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 5, 1
[640] [LCM][JLINK CUSTOM] lcm_gpio_set_data/106: set mode: 1 => 10:1
[640] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 5, 3
[640] [LCM][JLINK CUSTOM] lcm_gpio_set_data/106: set mode: 3 => 70:1
[660] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 5, 2
[660] [LCM][JLINK CUSTOM] lcm_gpio_set_data/106: set mode: 2 => 70:0
[680] LHS====PIN_NUM====[LCM][ERROR] _lcm_gpio_check_data: 5, 3
[680] [LCM][JLINK CUSTOM] lcm_gpio_set_data/106: set mode: 3 => 70:1
[1340] [lk logo: mt_disp_fill_rect 298]
[1340] [lk logo: init_fb_screen 59]
[1340] mt_get_logo_db_addr: 0xbf400000
[1340] [lk logo: init_fb_screen 77]MTK_LCM_PHYSICAL_ROTATION = 270
[1360] [lk logo: sync_anim_version 42]
[1360] [lk logo: init_fb_screen 110]pinfo[0]=0x00000000, pinfo[1]=0x00008000, pinfo[2]=0
[1360] [lk logo: init_fb_screen 112]define ANIMATION_NEW:show new animation with capacity num
[1360] [lk logo: init_fb_screen 113]CAPACITY_LEFT =172, CAPACITY_TOP =330 
[1360] [lk logo: init_fb_screen 114]LCM_HEIGHT=307, LCM_WIDTH=546 
[1360] [show_logo_common: fill_rect_with_color_by_32bit 344]
[1420] fb dump: 0x00000000, 0x00000000, 0x00000000, 0x00000000
[1420] s_mt65xx_gd.gdfIndex=3[1420] mt_get_logo_db_addr_pa: 0xbf400000
[1420] [PART_LK][get_part] logo
[1420] [PART_LK][get_part] logo
[1420] 
=========================================
[1420] [LK_BOOT] logo magic number : 0x58881688
[1420] [LK_BOOT] logo name         : LOGO
[1420] [LK_BOOT] logo size         : 1251293
[1420] =========================================
[1420] read the data of logo
[1520] mt_get_logo_db_addr: 0xbf400000
mt_disp_get_logo_base_index width=720 height=720 
 mt_disp_get_logo_base_index width=720 height=720 
chenjia MULTI_BOOT_LOGO_LIST = 720D
chenjia MULTI_BOOT_LOGO_LIST = 720d
try:720d 0,5: 4
can not find any 720d defines
=================================some big error===============
kkkkk mt_disp_get_logo_base_index logo_index_base=0 
mt_disp_get_logo_base_index 1171: new logo index: 0, hwinfo (set_idx): 0
kedump mini start
kedump: lkdump debug not ready
kedump: boot_reason(0)
RAM_CONSOLE. sram(0x10dc00) sig 945b1ed2 mismatch
RAM_CONSOLE. start: 0x83f00000, size: 0x10000
RAM_CONSOLE. lk last status: 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 
RAM_CONSOLE. wdt_status 0x0, fiq_step 0x0, exp_type 0x0
[1540] detecting pmic just reset
[1540] [mboot_recovery_load_misc]: size is 6144
[1540] [mboot_recovery_load_misc]: misc_addr is 0x81ebada8
[1540] [PART_LK][get_part] para
[1540] [LK_BOOT] Load '<null>' partition to 0x81EBADA8 (6144 bytes in 3 ms)
[1540] MT65XX_FACTORY_KEY 0x9
[1540] MT65XX_BOOT_MENU_KEY 0x0
[1540] MT65XX_RECOVERY_KEY 0x0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 0
[1560] mtk detect key function key = 9
[1560] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 0
[1580] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 9
[1600] mtk detect key function key = 0
[1600] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 0
[1620] mtk detect key function key = 9
[1620] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 9
[1640] mtk detect key function key = 0
[1640] mtk detect key function key = 0
< Kernel Enter Normal Boot > 
[1640] [partition_get_index]find preloader preloader index 0
[1660] [PART_LK][get_part] seccfg
[1660] [partition_get_index]find seccfg seccfg index 6
[1660] [PART_LK][get_part] seccfg
[1660] [PART_LK][get_part] secro
[1660] [partition_get_index]find secro secro index 11
[1660] [PART_LK][get_part] secro
[1660] [PART_LK][get_part] seccfg
[1660] [partition_get_index]find seccfg seccfg index 6
[1660] [PART_LK][get_part] seccfg
[1660] [PART_LK][get_part] seccfg
[1660] [PART_LK][get_part] seccfg
[SEC_CFG] sec_read_seccfg fail:3001
[SEC_INIT] sec_func_init -- fail to search seccfg
[SEC_CFG] initializing seccfg
[SBC] NS-CHIP
[1680] [PART_LK][get_part] secro
[1680] [partition_get_index]find secro secro index 11
[1680] [PART_LK][get_part] secro
[1680] [PART_LK][get_part] secro
[1680] [PART_LK][get_part] secro
[1700] [PART_LK][get_part] secro
[1700] [partition_get_index]find secro secro index 11
[1700] [PART_LK][get_part] secro
[1700] [PART_LK][get_part] secro
[1700] [PART_LK][get_part] secro
[SEC_SRO] Search SRO - SRO Ready
[SEC_INIT] Search SECRO - SW sec boot configured        (0, 0)
[SEC_INIT] Search SECRO - SDL configuration[LOCK]        (2, 2, 2, 2)
[SEC_INIT] Search SECRO - SB configuration[LOCK]     (1, 1, 1, 1, 1, 1, 1, 1)
[SEC_INIT] Search SECRO - SDL configuration[UNLOCK]      (2, 2, 2, 2)
[SEC_INIT] Search SECRO - SB configuration[UNLOCK]   (2, 2, 2, 2, 2, 2, 2, 2)
[SEC_INIT] Search SECRO - SDL configuration[VERIFIED]    (1, 1, 1, 2)
[SEC_INIT] Search SECRO - SB configuration[VERIFIED] (1, 1, 1, 1, 2, 2, 2, 2)
[SEC_INIT] Search SECRO - SDL configuration[CUSTOM]      (1, 1, 1, 1)
[SEC_INIT] Search SECRO - SB configuration[CUSTOM]   (1, 1, 1, 1, 1, 1)
[SEC_POLICY] lock state = 0x0(default)
[SEC_POLICY] use default sec policy
[SEC_POLICY] dl_format_lock = 0x1
[SEC_POLICY] dl_1st_loader_lock = 0x1
[SEC_POLICY] dl_2nd_loader_lock = 0x1
[SEC_POLICY] dl_image_lock = 0x1
[SEC_POLICY] dl_tee_lock = 0x1
[SEC_POLICY] boot_chk_2nd_loader = 0x2
[SEC_POLICY] boot_chk_logo = 0x2
[SEC_POLICY] boot_chk_bootimg = 0x2
[SEC_POLICY] boot_chk_recovery = 0x2
[SEC_POLICY] boot_chk_system = 0x2
[SEC_POLICY] boot_chk_others = 0x2
[SEC_POLICY] boot_chk_cust1 = 0x2
[SEC_POLICY] boot_chk_cust2 = 0x2
[SEC_POLICY] boot_chk_tee = 0x2
[1740] [AUXADC] u4channel[7]=19142.
[1740] [AUXADC] adc_result_temp=19142, adc_result=4206, r_val_temp=4.
[1740] [mt65xx_bat_init] check VBAT=4206 mV with 3450 mV
[1740] [lk logo: mt_disp_show_boot_logo 145]
[1740] [lk logo: init_fb_screen 59]
[1740] mt_get_logo_db_addr: 0xbf400000
[1740] [lk logo: init_fb_screen 77]MTK_LCM_PHYSICAL_ROTATION = 270
[1740] [lk logo: sync_anim_version 42]
[1740] [lk logo: init_fb_screen 110]pinfo[0]=0x00000027, pinfo[1]=0x001317dd, pinfo[2]=164
[1740] [lk logo: init_fb_screen 112]define ANIMATION_NEW:show new animation with capacity num
[1740] [lk logo: init_fb_screen 113]CAPACITY_LEFT =172, CAPACITY_TOP =330 
[1740] [lk logo: init_fb_screen 114]LCM_HEIGHT=307, LCM_WIDTH=546 
[1740] mt_get_tempfb_addr: 0xbfc22000
[1740] [show_animation_common: check_logo_index_valid 71]logonum =39, index =0
[1740] show_animation_common, in_addr=0xbf4000a4,  logolen=9295
[1760] [decompress_logo decompress_logo 48]in=0xbf4000a4, out=0xbfc22000, inlen=9295, logolen=2166784
[1780] [decompress_logo decompress_logo 97]have=2073600
[1780] [show_animation_common: fill_animation_logo 128]bits = 32
[1780] [show_logo_common: fill_rect_with_content 430]
[1780] [show_logo_common: fill_rect_with_content_by_32bit_argb8888 129]
[1780] [show_logo_common]dst_addr= 0xff000000, color_addr= 0xff000000, i= 0, j=0
[1780] [show_logo_common]dst_addr= 0xff000000, color_addr= 0xff000000, i= 0, j=719
[1860] [show_logo_common]dst_addr= 0xff000000, color_addr= 0xff000000, i= 719, j=0
[1880] [show_logo_common]dst_addr= 0xff000000, color_addr= 0xff000000, i= 719, j=719
[1880] fb dump: 0xff000000, 0xff000000, 0xff000000, 0xff000000
[1880] [LEDS]LK: mt65xx_backlight_on:level =  255
[1880] [LEDS]LK: lcd-backlight level is 255 
[1880] fb dump: 0xff000000, 0xff000000, 0xff000000, 0xff000000
[1880] [PART_LK][get_part] proinfo
[1880] [LK_BOOT] Load '<null>' partition to 0x81EB14AC (19 bytes in 1 ms)
[SEC_POLICY] lock state = 0x0(default)
[SEC_POLICY] security policy backup (0)[SBC] Consume (0) ms

[SBC] Total Consume (1) ms
[SEC_POLICY] use default sec policy
[SEC_POLICY] dl_format_lock = 0x1
[SEC_POLICY] dl_1st_loader_lock = 0x1
[SEC_POLICY] dl_2nd_loader_lock = 0x1
[SEC_POLICY] dl_image_lock = 0x1
[SEC_POLICY] dl_tee_lock = 0x1
[SEC_POLICY] boot_chk_2nd_loader = 0x2
[SEC_POLICY] boot_chk_logo = 0x2
[SEC_POLICY] boot_chk_bootimg = 0x2
[SEC_POLICY] boot_chk_recovery = 0x2
[SEC_POLICY] boot_chk_system = 0x2
[SEC_POLICY] boot_chk_others = 0x2
[SEC_POLICY] boot_chk_cust1 = 0x2
[SEC_POLICY] boot_chk_cust2 = 0x2
[SEC_POLICY] boot_chk_tee = 0x2
[SEC_POLICY] security policy restore (0)[1900] [PART_LK][get_part] boot
[1900] [PART_LK][get_part] boot
[1900] part page addr is 0x1ec0000
[1900] 
============================================================
[1900] [LK_BOOT] Android Partition Name                : boot
[1920] [LK_BOOT] Android Boot IMG Hdr - Kernel Size    : 0x008887C9
[1920] [LK_BOOT] Android Boot IMG Hdr - Kernel Address : 0x80008000
[1920] [LK_BOOT] Android Boot IMG Hdr - Rootfs Size    : 0x001C7892
[1920] [LK_BOOT] Android Boot IMG Hdr - Rootfs Address : 0x84000000
[1920] [LK_BOOT] Android Boot IMG Hdr - Tags Address   : 0x8E000000
[1920] [LK_BOOT] Android Boot IMG Hdr - Page Size      : 0x00000800
[1920] [LK_BOOT] Android Boot IMG Hdr - Command Line   : bootopt=64S3,32S1,32S1
[1920] ============================================================
[1920]  > page count of kernel image = 4369
[1920]  > kernel mem offset = 0x80008000
[1920]  > rootfs mem offset = 0x80890800
[1920]  > boot image size = 0xa51000
[1920] boot state: green
[1920] [PART_LK][get_part] boot
[1920] 
read the data of boot (size = 0xa51000)
[1920]  > from - 0x0000000001ec0800 (skip boot img hdr)
[1920]  > to   - 0x80008000 (starts with kernel img hdr)
[2740] [PROFILE] ------- load boot.img takes 421 ms -------- 
[2820] mt_disp_get_lcd_time, fps=5878
[LK_ENV]get_env apjtag
[2820] [APJTAG] current setting is 0.
[2820] model=MT6580
[2820] g_mt6311_hw_exist=0
[2820] mt6311 not exist
[2820] cluster-0: 4 core
[2820] cluster-1: 0 core
[2820] [ccci] modem standalone not support
[2820] mblock[0].start: 0x80000000, size: 0x3f800000
[2900] Not Support VCORE DVFS
[2980] mt_disp_get_lcd_time, fps=5879
[2980] videolfb - fb_base    = 0xbf800000
[2980] videolfb - islcmfound = 1
[3120] mt_disp_get_lcd_time, fps=5878
[3120] videolfb - fps        = 5878
[3120] videolfb - vram       = 8388608
[3120] videolfb - lcmname    = 0xce_st7703_ly_psd_dsi_vdo
[3140] [ccci] modem mem info not support
[3140] [ccci] modem mem arguments info using v1
[3140] PTP_INFO Only support in MT6795
start dump lk masp atag 
dump sw sbc:22, sw sdl:22 , hw sbc: 0
dump lock_state, 1
dump rid, c82e204a, 4fbd909d, 2a98d8f6, 4d445dbe
[3160] create masp atag OK
[3160] tee_reserved_mem not supported
[3160] non_secure_sram not supported
jj fixup hwinfo
[3180] jserial number CMRWDELBVKIZS4SK
serial:CMRWDELBVKIZS4SK 16
============ fdt_chosen_add_hwinfo 423 ==========inject jlcm data size: 66756 0 0
[3200] [PART_LK][get_part] proinfo
old crash record location
using DRAM
############ 43474244 === 0 0 0 0- 0 0 27
[3220] [PROFILE] ------- boot_time takes 1655 ms -------- 
[LK_ENV]get_env hibboot
[LK_ENV]get_env resume
[3220] resume = NULL 
[3300] booting linux @ 0x80008000, ramdisk @ 0x84000000 (1865874)
[3300] [LEDS]LK: leds_deinit: LEDS off 
[3300] [LEDS]LK: red level is 0 
[3300] [LEDS]LK: green level is 0 
[3300] [LEDS]LK: blue level is 0 
[3300] DRAM Rank :1
[3300] DRAM Rank[0] Start = 0x80000000, Size = 0x40000000
[3300] cmdline: console=tty0 console=ttyMT0,921600n1 root=/dev/ram vmalloc=496M androidboot.hardware=mt6580 androidboot.verifiedbootstate=green bootopt=64S3,32S1,32S1 lcm=1-0xce_st7703_ly_psd_dsi_vdo fps=5878 vram=8388608 androidboot.selinux=permissive hw_info=01|01000000001000000_00000000000000100000_01000000000000002000_0000000000|000000000_00000000000000000000 jseriall=-hwk00-0-0-27 printk.disable_uart=1 bootprof.pl_t=1727 bootprof.lk_t=1655 boot_reason=0 androidboot.serialno=SAWD8983246DM androidboot.bootreason=power_key gpt=1
[3300] lk boot time = 1655 ms
[3300] lk boot mode = 0
[3300] lk boot reason = power_key
[3300] lk finished --> jump to linux kernel 32Bit

+------------------------+
| Welcome to Stargate!!! |
+------------------------+
K400_MT6580_32_N:/ $

rogercasals-plazah · November 25, 2023, 6:52pm

Any progress with adding Apps to Shelly Wall display?
I miss the ability to use Sonos, and other Camera/security related apps.
Thanks

lordlame · November 25, 2023, 10:42pm

Not yet :L - following

theadam · December 10, 2023, 11:28am

Finger’s crossed for progress on this. I have bought just one and I am glad I didn’t pull the trigger for more. It is almost useless in my setup. I am using the output to fire an action in HASS via mqtt (output is not connected to anything, nor is the switch), but just one button and a few sensors makes this a pretty low value.

luka177 · December 14, 2023, 11:12pm

Hi, where did you manage to find firmware? Would like to have a loot at it. Thanks!

nickrout · December 14, 2023, 11:14pm

Who are you replying to?

luka177 · December 14, 2023, 11:37pm

Hi. @Botond24 appears to have it. Sadly i cant fetch it as i dont have device yet so shelly cloud do not provide me a link to fw, and link on pastebin is outdated.

nickrout · December 15, 2023, 10:10am

I think he has the device, not sure he has extracted the firmware

zittix · December 15, 2023, 1:34pm

I managed to get adb working. Here is a small how-to:

Make sure you have wifi configured (you can also configure it directly from the serial)
Solder TX/RX testpoint to a USB-to-serial adapter
Power the device on
When you have the prompt on the serial console write:

settings put global development_settings_enabled 1
settings put global adb_enabled 1
setprop service.adb.tcp.port 5555
stop adbd
start adbd

On your computer you can then connect to adb using adb connect <Device Wifi IP>:5555

zittix · December 15, 2023, 1:55pm

After manually installing Chrome (the default browser does not work with HA), I can finally get HA running on it

ezcGman · December 15, 2023, 1:57pm

wow, interesting u can access adb via the TX/RX pins but not via USB. GREAT FINDING

zittix · December 15, 2023, 2:14pm

and with the above and a USB-C to USB-A cable (USB-C to USB-C doesn’t work for me on a Mac) you can get ADB through USB as well.

ezcGman · December 15, 2023, 2:23pm

Wondering if the same could work for the newer T6E displays, that have “Linux” (it’s some kind of Android branch) and have a password on the adb… Sadly the PCB has no labellings, so can’t find the TX/RX pins