Boot-
Scramble value: 0x00000056
CHA/B dual rank support = 0x00000000

CHANNEL_FOURTH
Dram read data from EMMC .
........................................
CID:0xfa15c91f
:0x52062561
:0x4a544434
:0x15010041
Dram data has been stored in EMMC. Read from EMMC.
Dram read data from EMMC OK.
EMMC data ready.

DRAM ID is :1
CH=0 dram size= 8Gb
CH=1 dram size= 8Gb
CH=2 dram size= 8Gb
CH=3 dram size= 8Gb
Bypass save calibration result to emmc.
EMI_init start
ChA = 8(Gb)
ChB = 8(Gb)
ChC = 8(Gb)
ChD = 8(Gb)
EMI1 Total = 32(Gb)
EMI1 setting DRAM size = 4GB (8:8:8:8)
EMI_init finish
SMI_init start
SMI_init finish

Start Pmain

EMMC boot
load preloader2 image ...
SrcOffset:0x00015440
DstAddr:0x409fffb0
.
CID:0xfa15c91f
:0x52062561
:0x4a544434
:0x15010041
plain size:0x0001b988
LZHS size:0x0000fc07
image size:0x0000fd60
LZHS checksum:0x00000095
LZHS dec begin
LZHS ok
load preloader2 image ok
u4BSSLimit:0x000251a0
LZHS addr:0x40100040
plain size:0x0016d650
LZHS size:0x0007a4d1
LZHS checksum:0x00000029
LZHS begin
LZHS ok
loader ver check ...

[MSDC] LOADER FAST READ EMMC!

[MSDC] id1:00414a54 id2:44345206

[MSDC] Set Bus Clock as HS25(MHz) Success!,src 3 ,mode 0, div 4

[MSDC] --ENTER RPMB--

[MSDC] --EXIT RPMB--

[preloader2_main.c:167] psVersion = 0x40e6d622

image version(header addr is 0x40cfffa0): 0.0.0

[MSDC] --ENTER RPMB--

[MSDC] --EXIT RPMB--

record version: 0.0.0

comparing loader ver with record return 0

loader ver check done

Boot

Start Lmain

[MSDC] MSDC AES INIT CONFIG DONE.
[MSDC] LOADER FAST READ EMMC!
[MSDC] id1:00414a54 id2:44345206
[MSDC] Set Bus Clock as HS25(MHz) Success!,src 3 ,mode 0, div 4

MT5895 Boot Loader v0.9
TCM_Dram_Size = 0x1000.
TCM_DRAM_FLAGS3 = 0x0.
Dram data has been stored in EMMC , no need to write .
setup_usb_host: Setting up USB HOST controller...
mt53xx_u3phy_ports_enable: mt53xx_u3phy_ports_enable u2p:3, u3p:1
mt53xx_u3phy_ports_enable: [yl]u3p_readl(sif_base, U3P_U2_CTRL(i)):0x4c
mt53xx_u3phy_ports_enable: [yl]u3p_readl(sif_base, U3P_U2_CTRL(i)):0x4c
mt53xx_u3phy_ports_enable: [yl]u3p_readl(sif_base, U3P_U2_CTRL(i)):0x4c
mt53xx_phy_index_power_on: mt53xx_phy_index_power_on(0)
mt53xx_phy_index_power_on: mt53xx_phy_index_power_on(1)
mt53xx_phy_index_power_on: mt53xx_phy_index_power_on(2)
setup_usb_host: phy power-on done.
xhci_init: regbase: 0x1202c000
xhci_init: opreg: 0x1202c020
xhci_init: caplen: 0x20
xhci_init: rtsoff: 0x600
xhci_init: dboff: 0x800
xhci_init: hciversion: 1.16
xhci_init: context size: 32
xhci_init: pagesize: 0x1000
xhci_init: xhci->dma_buffer = 0x41d10000
xhci_wait_ready: Waiting for controller to be ready... ok.
xhci_reset: Resetting controller... ok.
xhci_wait_ready: Waiting for controller to be ready... ok.
xhci_reinit: [yl]xhci->ev_ring_table[0].seg_base_lo:0x41d00100, seg_base_hi:0x0, seg_size:0x8
xhci_reinit: [yl]xhci->hcrreg->intrrs[0].erstsz:0x1, erstba_lo :0x41d001c0, erstba_hi:0x0
xHCI: root hub init done(ports:4) dev 0x41e00340
MUSB3_init OK ++
USB0: Set GPIO42 = 1.
USB1: Set GPIO43 = 1.
USB2: Set GPIO48 = 1.
USB3: Set GPIO210 = 1.
[MSDC] enter into SDR50 Mode, max dtr 200000000
[MSDC] Set Bus Clock as HS0(MHz) Success!,src 0 ,mode 0, div 16
[MSDC] Set Bus Clock as HS50(MHz) Success!,src 3 ,mode 0, div 2
[MSDC] check autok done. speed mode 1 ,clock 50
[MSDC] --ENTER RPMB--
[MSDC] --EXIT RPMB--
Support network!.
1st MAC in EEP is valid (68:07:0a:88:8c:af)
1st : (68:07:0a:88:8c:af)
2nd : (68:07:0a:88:8c:af)

POWER ON
set u1Adin3SrvGpio to 0
FRC reset GPIO to output high, fpga reset GPIO to ouput low
LOADER_MtkEnvInitFunc: ui4_RebootEventDetailEepAddr = 0xa1a
LOADER_MtkEnvInitFunc: ui4_EnableQHBEepAddr = 0xa10
LOADER_MtkEnvInitFunc: ui4_SilentRebootEepAddr = 0xa1c
LOADER_MtkEnvInitFunc: ui4_RegisterTimeOfSilentRebootEepAddr = 0xa1b
LOADER_MtkEnvInitFunc: ui4_ObrReootEepAddr = 0x72e8
===========================================

[QHB flag] rDtvCfg.u1Flags4 =0

[HB flag] rDtvCfg.u1Flags2 =0

[QHB flag] prLdrData->rDtvCfg.u1Flags4 = 0

[HB flag] prLdrData->rDtvCfg.u1Flags2 = 0
===========================================
[OBR]LDR_checkIfLkbDownPress
Boot reason: A/C power on!!Servoadc Channel1 frist update!!!, value is 2047
Servoadc Channel1 finish update!!!, value is 2047
Input voltage is 1500 mV
Channel 1 befor Calibration value is 2047
[OBR]u4ServoADCChannelValue: 2047
[OBR-AC] nothing happened.
[TCON-RESET]LDR_checkIfLkbUpPress
Input voltage is 1500 mV
Channel 1 befor Calibration value is 2047
[TCON-RESET]u4ServoADCChannelValue: 2047
[TCON-RESET]nothing happened.
SOC LED.
##DBG##fgSoCLD:0
LOADER_MtkEnvInitFunc: PDWNC_ReadWakeupReason = 6
LOADER_MtkEnvInitFunc: AC_POWER, set ui4_EnableQHBEepAddr to 0
LOADER_MtkEnvInitFunc : ui4_EmmcFirstBootEepAddr = 0x97a
LOADER_MtkEnvInitFunc: [QHB] u1EmmcFirstBoot = 0x1LOADER_MtkEnvInitFunc: [QHB] It is not EmmcFirstBoot, do no cation with QHB.
LOADER_MtkEnvInitFunc: set ui1_reboot_event_detail to 10
LOADER_MtkEnvInitFunc: ui1_reboot_event_detail = 10 (read back)
[LOADER_MtkEnvInitFunc]EMMC Size 16GB.
Remove Quiet Boot misc control in eeprom when Watchdog reason.
[IRRX_InitMtkIrRegSetup]SetRC5WakeupKey - Disabled
IR DATA register : 0x 0
T8032 init A/C on case loader stage...
Load T8032 FW (addr: 0x40e1e058, size: 31278)success!!
T8032 FW version: 10
tz_res0-1: 0x4127000 0x1
capy support dram ch num :1
T8032 change to loader stage...
LDR_FlashCopy 0x4000f010 0x9fa80 0x80
IS_4K_FRC=0,IS_8K_FRC=0
[CM4] LDR_CM4_init: Start init
[CM4] header size: 0x33
[CM4] Write version 0x1835a5a8 into reg
[CM4] data size: 0x152200
[CM4] LDR_CM4_init: Init done with cm4 version 1835a5a8
[CM4] LDR_CM4_start
[CM4] LDR_CM4_done
CC_PHP_SUPPORT_LOADER_CONSOLE_LOCK defined
Uart Rx disabled
u4RebootFlagEepromOffset:1211 u4RebootEepromOffset:1200 u4RebootEepromSize:16
0x100000 read EepromFlag:0
[OBR]Is OBR triggered?. NVM_FSR_RECOVERY_MODE_ADDRESS=0
LOADER_MtkEnvInitFunc: ui4_fullstandbyctrlEepAddr = 0xa16
LOADER_MtkEnvInitFunc: ui1_tpvfullstandbyctrl = 0
[_LdrDetermineEnterStandby 430] PDWNC_WAKE_UP_REASON_AC_POWER continue bootup[UPG upgrade ~ PDWNC_WAKE_UP_REASON_AC_POWER] u1SlicneUpgradeStatus = 0
Org:0x30 Flags:0x30

u4RebootFlagEepromOffset:1211 u4RebootEepromOffset:1200 u4RebootEepromSize:16
0x100000 read EepromFlag:0
u4RebootFlagEepromOffset:1211 u4RebootEepromOffset:1200 u4RebootEepromSize:16
0x100000 write EepromFlag:0
PDWNC_Init
SOC LED.
GPIO_MtkPowerOnFunc: ui4_SilentRebootEepAddr = 0xa1c
GPIO_MtkPowerOnFunc: ui4_SilentRebootTimeEepAddr = 0xa1b
GPIO_MtkPowerOnFunc: ui4_EnableQHBEepAddr = 0xa10
GPIO_MtkPowerOnFunc: ui4_FullStandbyCtrEepAddr = 0xa16
GPIO_MtkPowerOnFunc: normal cold boot ui1_silent_reboot = 0, ui1_tpvEnableQHB = 0, uil_FullStandbyCtr = 0
GPIO_MtkPowerOnFunc: After check ui1_silent_reboot, [QHB]u1Flags4: org=0, flag4=0
GPIO_MtkPowerOnFunc: not QUIET_HOT_BOOT
ui4_CtnEepAddr = 0x980
CTN = 58PUS8507/60
ui4_RedLedBriEepAddr : 0x317b
use NVM LEDdutyControl value
u1RedLedBriValue : 20
[GPIO_MtkPowerOnFunc 3356] u1_factory_mode = 0
[GPIO_MtkPowerOnFunc 3396] start led sine wave blinking
[GPIO_MtkPowerOnFunc 3402] start 12v drop monitor
GPIO_MtkPowerOnFunc: efrcpowerGpio=235
GPIO_MtkPowerOnFunc: Power On FRC rDtvCfg.u1Flags4 = 0, PDWNC_ReadWakeupReason() = 6
GPIO_MtkPowerOnFunc: After FRC power, [QHB]u1Flags4: org=0, flag4=0
GPIO_MtkPowerOnFunc: eResetfrcGpio is not available
The init function of this module is NULL
The init function of this module is NULL
USB0: Set GPIO42 = 1.
USB1: Set GPIO43 = 1.
USB2: Set GPIO48 = 1.
USB3: Set GPIO210 = 1.
PD_SET = 0
ui4_CtnEepAddr = 0x980
CTN = 58PUS8507/60
u4BmpWidthTopBlack:848,u4BmpHeightTopBlack:422, u4BmpSizeTopBlack:1431424
u4BmpWidthMidBlack:848,u4BmpHeightMidBlack:196, u4BmpSizeMidBlack:664832
puDstAddress:0xb9a00000
puBmpAddress:0x40ded200
u4ColorMode:0xe
u4BmpWidth:848
u4BmpHeight:236
u4BmpSizePhilipsLogo:800512
u4DstAddressPhilipsLogo:0xb9b5d780
Display 0x40e616bc background:0x00000000

Panel ID is 75.

Panel ID 75 writing is done...
Find panel index 75 from EEPROM
Panel Flash Table Size=0 , >0 means using flash table
##DBG## IS_AI_PQ:0, rOPCodeState.rOP4_SoCLD:0 rOP4_100HZ_SET:0
vDrvSetOSTG4K2KMode(0)vApiPanelPowerSequence= 0
vDrvSetOSTG4K2KMode(0)vDrvSetOSTGMjcEn(1)u1DrvSetOSTGInSel(1)[OSD]OSD_SetCropWidth: Current OSD_SetCropWidth = 1
@MTK_TRK [vFrameTrackModeInit][4694] _u4FrameTrackMode:0x14
##DBG vDrvOutputStageInit 4282
rOPCodeState.rOP4_SoCLD:0, rOPCodeState.rOP4_100HZ_SET:0
vSaveRefAttribute_4K2K
[DisplayInit] country=0x0 (EU=0x39, US=0x0)
[DisplayInit] 60TO50(0) 50TO60(0) 3D60(0)
[SA7] vDDDSInit
DDDSinitial only set error limit
[DDDS]u4Error=0xb7ff0003, u4ErrLimPre=0x 0
[DisplayInit] ##1 SV_DCLK_60HZ
vDrvCalPanelTiming: (DCLKType, FrameRate) = (255, 0) -> (2, 60)
@MTK_TRK -vDrvSetRefTiming-- 255 2 1 0
ref ReftimingInfo.u4HTotal=4400
ref ReftimingInfo.u4HActive=3840
ref ReftimingInfo.u4HSyncWidth=88
ref ReftimingInfo.u4HFP=32 CroppingCnt=0
ref ReftimingInfo.u4HBP=440
ref ReftimingInfo.u4VTotal=2250
ref ReftimingInfo.u4VSyncWidth=6
ref ReftimingInfo.u4VActive=2160
ref ReftimingInfo.u4VFP=78
ref ReftimingInfo.u4VBP=6
@MTK_TRK [vDrvSetRefTiming_SETDATA][3831] HA:3840 HFP:32 HBP:440 VA:2160 VFP:78 VBP:6
------ vScpipRefSetData #1
@MTK_DISP [vDrvSetPanelTiming][3322]
[LVDS]vDrvApplyPanelTiming.....
vDrvApplyPanelTiming 16 0 0 0
FSC swapVFP 78 -> 6
[NPTV][EH] u2HSyncWidth=%hu, u2HSyncStart=%hu, u2VSyncWidth=%hu, u2VSyncStart=%hu
fgIsMJCToOSTG=0 PnlCtrlWord2=0x20200
vDrvSwitchOSDRoute = 0
SCANPWMforSPI Sync mode is 1
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:1209, u2Duty:980, u4High:1184
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=245760 u4Val=1209 [1184 25 0]
[SCANPWM]u1PwmPort=1
SCANPWMforSPI Sync mode is 1
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:4950000, u2Duty:980, u4High:4851000
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=60 u4Val=4950000 [4851000 99000 0]
[SCANPWM]u1PwmPort=4
SCANPWMforSPI CS num is 1
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:4950000, u2Duty:300, u4High:1485000
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=60 u4Val=4950000 [1485000 33554431 24750]
[SCANPWM]u1PwmPort=2
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:4950000, u2Duty:0, u4High:0
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=60 u4Val=4950000 [0 4950000 990000]
[SCANPWM]u1PwmPort=3
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:4950000, u2Duty:0, u4High:0
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=60 u4Val=4950000 [0 4950000 2227500]
[SCANPWM]u1PwmPort=5
[SCANPWM]u4HTotal:2200, u4VTotal:2250, u4Val:4950000, u2Duty:0, u4High:0
[SCANPWM]forSPI vDrvGetLCDFreq()=60 u4Freq=60 u4Val=4950000 [0 4950000 3465000]
[SCANPWM]u1PwmPort=6
[SCANPWM]setting update when output v change
FSC Set data
vDrvResetVOPLLFlowFlag
###VbyOne VOPLLInit finsih###vDrvSetOCLKClockSchemaInit.
###VbyOne VOPLLSet finsih###[SA7] _fgVopllUseDDDS = True
vDrvSetVOPLLClockSchema, u1ClockSrc=1.
@vDrvSetVOPLLClockSchema -->4KDD
[LVDS] VOPLL Initialize successful !
OPWM1 pin func=2
fgIsMJCToOSTG=0 PnlCtrlWord2=0x20200
vDrvSwitchOSDRoute = 0
[NPTV][EH] u2HSyncWidth=%hu, u2HSyncStart=%hu, u2VSyncWidth=%hu, u2VSyncStart=%hu
vApiPanelPowerSequence= 1
vApiPanelPowerSequence= TRUE (START)

[PANEL]SILENTUPGRADESTATUS (0) Tpv2k21PanelOnSequence Playfi Gateway: u1PlayfiGatewayPanelOff: 0 !!!
==========Tpv2k21PanelOnSequence=========

tpv2k21PanelPowerSequence start...
tpv2k21PanelPowerSequence request Panel ON.
tpv2k21PanelPowerSequence= TRUE (START)
VB1 VB1 impedance cal set to default terminaion 8.........................
[VB1][LOCKN] 0x32f064 set to FUNCTION2
[VB1][HTPDN] 0x31f060 set to FUNCTION2
8k_output(32 lanes) disable by EFUSE!!
[<=24 lanes]0xff
[VB1][SetPadOn] LVDSA_EXT_EN=0xff
[PreEmp]u4PreEmpEn=0xffffff00
[DrvPwd]u4DrvPwd=0xffffff00
[VB1][OSD_LOCKN] 0x36f474 set to FUNCTION2
[VB1][OSD_HTPDN] 0x35f070 set to FUNCTION5
[TCON_INT]HW init!
[TCON_INT]TCLK_SEL=0 CKEN_TCON=1
[TCON_INT]INT_STA#1=0x30
[TCON_INT]INT_STA#2=0x0
[TCON_INT]INT_STA#3=0x0
_|-|_ vApiPanelPowerSequence Bright:255
lock on
_|-|_ BACKLT_SetDimming OPWM freq:240Hz,duty:255(0xff is 100 percent)
OPWM 1 u4TimeBase=0x dc8, u4DutyON and u4DutyAll= [0x ff,0x fe]
tpv2k21PanelPowerSequence = TRUE (END)
[PNL_ON]panel backlight power is already on!
[_drawGreenScreenIfNeeded][2804] <Call start>
[_drawGreenScreenIfNeeded][2837] bDrawGreenScreenFlag == 0, bWipeDataCommandFound == 0, bOpcodeVirginBit == 0, bMiscVirginBit == 0, bFactoryModeFlag == 0
[_drawGreenScreenIfNeeded][2846] <Call end>
LDR_OsdDisplay(14, 0xb9a00000, 848, 236)
Color:14 BmpAddr:0xb9a00000 Width:848 Height:1080
fgIsMJCToOSTG=0 PnlCtrlWord2=0x20200
vDrvSwitchOSDRoute = 0
======u1FlipMirrorEnable 0

[OSD]OSD_InitCommon: Get OSTG Crop cnt = 1
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_SC_DoScale: Scaling parameter incorrect!
[OSD]OSD_BASE_SetPlaneSwitchOrder: OSD plane order[3,2,1]
[OSD]Before PQ Module offset:i4H=243 i4V=7
[OSD]DBG SRS INT
[OSD]DBG XvYCC bypass
[OSD]DBG Gamma position 0 or 1
[OSD]After PQ Module offset:i4H=306 i4V=16

OSD_BASE_GetDisplayWidth
KMEM_SIZE_1 > 0x40000000
final upHaderAddr = 0x7f800000, upDisAddr=0x7f801000
Panel 3840 x 2160

*************u4BmpPitch=3392******************
u4OutWidth=848,u4OutHeight=1080,u4OutX=536,u4OutY=0.
======u1FlipMirrorEnable 0

[OSD]OSD_PLA_Enable: plane:1, enable:1
[OSD]OSD_BASE_ClearIntStatus: CLEAR OSD3 INT STATUS!!
u1NVMFSRRecoveryMode = 0x0
ui_HW_AUD_BW = 0
ui_HW_DISPLAY_TECHNOLOGY = 0
not OLED set or in recovery, no need to extends 5 seconds display for OLED philips logo
LDR_CheckWeakSymbol_mtk.
[LDR]_factoryCmdUpgradeByFunctionType_init is called
[LDR] ui4_upgradeDeviceTypeAddr : 0x7200
[LDR] ui1_upgradeDeviceType : 0x0
[LDR] ui1_functionType : 0xff
[LDR]_factoryCmdUpgradeByFunctionType_isSkipUpgradeEnabled return FALSE

Do USB upgrade
[UFRC] BOOT SLOT 1
[UFRC] NVM 0x317c[0x0], 0x97d[0x0], 0x7f3d[0x0], 0x7f3c[0x1], 0x3145[0x0], 0x471[0x0]
u1USBBlock = 0x42195600
set SSUSB_FINDING_UPGRADE_IMG_FLAG=1 _BIM_GetCurTime=5008904
[yl] usb_poll loop:0, controller->devices[0]:0x41e00340
xhci xhci_rh_hub_status_changed detect begin now, poll time = 1000
xhci xhci_rh_hub_status_changed: 0x0, changed:0
[yl] usb_poll loop:1, controller->devices[1]:0x0
[yl] usb_poll loop:2, controller->devices[2]:0x0
[yl] usb_poll loop:3, controller->devices[3]:0x0
[yl] usb_poll loop:4, controller->devices[4]:0x0
[yl] usb_poll loop:5, controller->devices[5]:0x0
[yl] usb_poll loop:6, controller->devices[6]:0x0
[yl] usb_poll loop:7, controller->devices[7]:0x0
[yl] usb_poll loop:8, controller->devices[8]:0x0
[yl] usb_poll loop:9, controller->devices[9]:0x0

No U3 USB device.

prLdrData->rDtvCfg.u1Upgrade_Ext :0x0

_fgDeviceType :0x1
USB upgrade stop
recovery_opcode
recovery_opcode(3)
recovery_opcode(4)
exit LDR_CheckUpgrade
[CMain 1467][OLED Tcon error handle]display_techonlogy = 0
[CMain 1470][OLED Tcon error handle] Not OLED Panel.

Flash load lzhs header from 0x100000 to dram(0x42198590), size=2048
Decompression uboot to 0x41800000...

Flash load image from 0x100000 to dram(0x42198590), size=0x76ebf
uboot ver check ...
[loader_anti.c:145] psVersion = 0x4220f132
image version(version addr is 0x4220f132): 0.0.0
[MSDC] --ENTER RPMB--
[MSDC] --EXIT RPMB--
record uboot version: 0.0.0
comparing uboot ver with record return 0
uboot ver check done
LZHS start
LZHS done
Starting image...

U-Boot 2011.12.12 (Apr 07 2025 - 16:49:56)

Total ( 1 ) DRAM Channels.
Total DRAM for kernel: 1.7 GiB
# Channel-A DRAM Size: 4096 MB.
WARNING: Caches not enabled
MMC: [MSDC] Set max clk to 50MHZ in default
[MSDC] Uboot max clock 52000000
[MSDC] MSDC AES INIT CONFIG DONE.
[MSDC] HOST 1, rca 0x1
[MSDC] Set DMA Mode!

[MSDC] id1:C91F5206 id2:25614A54
: 0
msdcgpio=76,-1,-1,176,-1,-1,
[Uboot] MSDC_EEPROM_Read API
Read ok

[crash count] the 0x46c is 0xc

[crash count] OPW7-07 0
[crash count] enable = 1 (func: BIM_IsRecoveryMode)
[Uboot] MSDC_EEPROM_Read API
Read ok

[crash count] u4Crashcount_bit = 0 (BIM_increaseCrashCounter)
Boot reason: A/C power on!!
[crash count] WakeupReason is PDWNC_WAKE_UP_REASON_AC_POWER, Not accumulate counter
[crash count] count = 0 (MAX = 20) (func: BIM_IsRecoveryMode)
[crash count] Crash counter has not exceed the MAX, boot base on misc
[Uboot] MSDC_EEPROM_Read API
Read ok

pmisc_msg:
[Uboot] MSDC_EEPROM_Read API
Read ok

enter normal mode!
[Uboot] MSDC_EEPROM_Read API
Read ok

pmisc_msg:
[Uboot] MSDC_EEPROM_Read API
Read ok

enter normal mode!
[Uboot] MSDC_EEPROM_Read API
Read ok
###########################i4_misc_val==0x0000
###########################i4QueryRet==0x0000
###########################i4ReadRet==0x0000
###########################u4Addr==0x0a18
###########################u4Val==0x0000
###########################Final u4Val==0x0000
Env_common.c/env_add_adb_support read EEPROM ADB Support = 0
env_add_bootreason: wakeupReason = 0x0
[Uboot] MSDC_EEPROM_Read API
Read ok
loaderlogo=0x800000@0x7f800000
...=====PMIC I2C Param=====...

mt53xxregulator=200:5:6:16:1:700:1500:1000:4:-1:200:4:6:16:1:700:1500:1000:4:-1:
[Uboot] MSDC_EEPROM_Read API
Read ok
env_add_opregion: 0
[Uboot] MSDC_EEPROM_Read API
Read ok
env_add_oppd: 0
[Uboot] MSDC_EEPROM_Read API
Read ok
env_add_btsink: 0
In: serial
Out: serial
Err: serial

pmisc_msg:
[_updateVirginBitsAndGreenScreen][1819] <Call start>

pmisc_msg->recovery:
[_updateVirginBitsAndGreenScreen][1822] bWipeDataCommandFound == 0
[_readPkgUpgradedFlag][1634] <Call start>
[_readPkgUpgradedFlag][1640] u4RebootEepromAddress == 0x4B0
[_readPkgUpgradedFlag][1646] u4RebootEepromSize == 0x10
[_readPkgUpgradedFlag][1649] u4RebootFlagEepromOffset == 0x4BF
[Uboot] MSDC_EEPROM_Read API
Read ok
[_readPkgUpgradedFlag][1654] u1ReadWriteValue == 0x00
[_updateVirginBitsAndGreenScreen][1828] bPkgUpgradedFlag == 0
[_readRecoveryModeFlag][1667] <Call start>
[_readRecoveryModeFlag][1673] u4EepromAddrRecoveryModeFlag == 0x3141
[Uboot] MSDC_EEPROM_Read API
Read ok
[_readRecoveryModeFlag][1679] u1ReadWriteValue == 0x00
[_updateVirginBitsAndGreenScreen][1834] bRecoveryModeFlag == 0
[_readResetToGreenScreen][1751] <Call start>
[_readResetToGreenScreen][1757] u4eEepromAddrPowerStatusAfterReset == 0x7201
[Uboot] MSDC_EEPROM_Read API
Read ok
[_readResetToGreenScreen][1763] u1ReadWriteValue == 0x00
[_updateVirginBitsAndGreenScreen][1840] bResetToGreenScreen == 0
[_readDrawGreenScreenFlag][1771] <Call start>
[_readDrawGreenScreenFlag][1777] u4EepromAddrDrawGreenScreenFlag == 0x7214
[Uboot] MSDC_EEPROM_Read API
Read ok
[_readDrawGreenScreenFlag][1783] u1ReadWriteValue == 0x00
[Uboot] MSDC_EEPROM_Read API
Read ok

[crash count] the 0x46c is 0xc

[crash count] OPW7-07 0
[crash count] enable = 1 (func: BIM_IsRecoveryMode)
[Uboot] MSDC_EEPROM_Read API
Read ok

[crash count] u4Crashcount_bit = 0 (BIM_increaseCrashCounter)
Boot reason: A/C power on!!
[crash count] WakeupReason is PDWNC_WAKE_UP_REASON_AC_POWER, Not accumulate counter
[crash count] count = 0 (MAX = 20) (func: BIM_IsRecoveryMode)
[crash count] Crash counter has not exceed the MAX, boot base on misc
[Uboot] MSDC_EEPROM_Read API
Read ok

pmisc_msg:
[Uboot] MSDC_EEPROM_Read API
Read ok

enter normal mode!
[main_loop][495] 0
### main_loop: bootcmd="eboread_rollback_index done, Location: 4, Index: 0x0
read_rollback_index done, Location: 6, Index: 0x0
read_rollback_index done, Location: 7, Index: 0x0
read_rollback_index done, Location: 8, Index: 0x0
read_rollback_index done, Location: 9, Index: 0x0

System will boot from slot: _a

## AVB2.0 append extra bootargs:
androidboot.vbmeta.device=179:8 androidboot.vbmeta.avb_version=1.0 androidboot.vbmeta.device_state=locked androidboot.vbmeta.hash_alg=sha256 androidboot.vbmeta.size=19136 androidboot.vbmeta.digest=d21d38ac70bef507729ebf3a9cb88046f8f5b0f068a646034cc8ec2939e0aa6a androidboot.veritymode=enforcing

Boot/Recovery image header version: 2

Kernel Cmdline : [androidboot.boot_devices=soc/1006d000.MSDC0 buildvariant=user]
Boot state is: Green !

signature verification is OK
LZHS start
LZHS done
## LZHS decode success! src=0x4b901dd0,dst=0xfa610000,psize=0x40d000,lsize=0x1cf3c2,chk=0xa0
DTB offset: 0x1c48800, size: 28560 Bytes.
## Loading image from partition: r20_a
signature verification is OK
LZHS start
LZHS done
## LZHS decode success! src=0x4bad12c0,dst=0xf9600000,psize=0xc6a90,lsize=0x94353,chk=0x16
## Loading image from partition: r21_a
signature verification is OK
LZHS start
LZHS done
## LZHS decode success! src=0x4bed12e0,dst=0xf9a00000,psize=0xb868,lsize=0x6d36,chk=0x58
## Loading image from partition: 3dlut_a
signature verification is OK
## Plaintext img, src=0x4c2d12f0,dst=0xfa200000,psize=0x0,lsize=0x0,chk=0x0
* kernel: cmdline image address = 0x48063590
## Booting kernel from Legacy Image at 48063590 ...
kernel data at 0x480635d0, len = 0x0097d07d (9949309)
The fdt of index: 0, fdt_addr = 49cab5d0, fdt_size = 6f50.
DTB bootargs: androidboot.dtb_idx=0
Uncompressing Kernel Image ... ##gzip uncompress takes 208.279 ms
OK
kernel loaded at 0x40080000, end = 0x413cd810
reserving fdt memory region: addr=0 size=10000
Applying the overlay fdt of index: 0 ... OK
## boot_ufdt_overlay_aosp: Merge DTBO to main DTB done, takes 9.367 ms
Loading Device Tree to 463f5000, end 463ff2ba ... OK
## Transferring control to Linux (at address fa610000) ...
## Linux start= 0x040000000 size= 0x06f442000 ...
## Linux start= 0x100000000 size= 0x040000000 ...

## uBoot bootargs size is limited: 4096 Bytes, current size: 2405 Bytes.

Starting kernel ...

INFO: LK boot argument

INFO: atf_magic=0x4d415446

INFO: tee_support=0x1

INFO: tee_entry=0xfa635000

INFO: tee_boot_arg_addr=0x0

INFO: atf_log_port=0x0

INFO: atf_log_baudrate=0x0

INFO: atf_log_buf_start=0x0

INFO: atf_log_buf_size=0x0

INFO: atf_aee_debug_buf_start=0x0

INFO: atf_aee_debug_buf_size=0x0

INFO: atf_irq_num=0

INFO: BL33_START_ADDRESS=0x40080000

INFO: bl31_setup
INFO: RESET_TO_BL31

INFO: Kernel is 64Bit
INFO: pc=0x40080000, r0=0x463f5000, r1=0x1707,r2=0x0
INFO: BL31: bl31_plat_arch_setup done
INFO: BL31: v2.6(debug):
INFO: BL31: Built : 12:33:15, Mar 5 2025
INFO: GICv3 without legacy support detected. ARM GICV3 driver initialized in EL3
INFO: BL31: Initializing runtime services
INFO: tvtee_setup!

INFO: trusty_init

INFO: BL31: cortex_a73: CPU workaround for cve_2018_3639 was applied
INFO: BL31: cortex_a73: CPU workaround for cve_2022_23960 was applied
INFO: BL31: Initializing BL32

welcome to lk/MP

boot args 0x0 0x0 0x0 0x0
HKDF-SHA256 Verification: PASS
initializing trusty (Built: )
Initializing Trusted OS SMC handler
Trusty Init Done, Jump to linux Kernel 4294967294
INFO: BL31: BL32 initialization Done
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x40080000
INFO: SPSR = 0x3c5
INFO: [BL31] SHOULD not dump in UART !

INFO: mtk: plat_affinst_on cpu_id 1
INFO: mtk: plat_affinst_on cpu_id 2
INFO: mtk: plat_affinst_on cpu_id 3
read data: Addr failure, 0
read data: Addr failure, 0
read data: Addr failure, 0
fs_init_from_super:400: loaded super block version 2
fs_init_from_super:400: loaded super block version 0
[WKBValidate] KEYBOX HAS BAD MAGIC
[OEMCrypto_IsKeyboxValid(): BAD_MAGIC]
[OEMCrypto_InstallKeybox] FACTORY_KEYBOX_SIZE=212
[OEMCrypto_InstallKeybox]: FACTORY_KEYBOX_SIZE success
[UTSetGenEpoch(): entry] epoch=1744016400
[UTSetGenEpoch(): master_generation=17481194396919202503]
[UTSetGenEpoch(): exit]
[OEMCrypto_Initialize]: entry
UTLoadUsageTableHeader: exit
[NagraTA]: 196: uuid is 85B2CD42-3BED-4F1F-B195-197005A43DF0
[NagraTA]: 197: checksum is 33F0A1D8
[NagraTA]: 198: keysize is 3520
[NagraTA]: 215: checksum cal is 33F0A1D8
[NagraTA]: 216: clear key size is 2640
SECTEE: 424: secGenericSessionEncrypt:424, emi: 4026, xMessageSize(16)
SECTEE: 424: secGenericSessionEncrypt:424, emi: 4026, xMessageSize(2624)
[OEMCrypto_Initialize]: entry
UTLoadUsageTableHeader: exit
[OEMCrypto_Initialize]: entry
UTLoadUsageTableHeader: exit
[OEMCrypto_Initialize]: entry
UTLoadUsageTableHeader: exit
[OEMCrypto_Initialize]: entry
UTLoadUsageTableHeader: exit
[OEMCrypto_Initialize]: entry