Session 30 — 2026-03-29a

Field	Value
Date	2026-03-29
Phase	03b2 — Boot mode selection
Duration	~2 h

XPU Discovery: Flat TLMM is Blocked

During oem test-sensor testing:

• CNOC clocks already ON (all three CBCRs read 0x00000001) — XBL leaves them active through ABL
• Flat TLMM: 0x03069000 (GPIO 105 flat) → HUNG (watchdog fired)
• Flat TLMM: 0x03000000 (GPIO 0 flat) → HUNG
• South tile: 0x03169000 (GPIO 105) → ✅ WORKS — reads 0x00000001 (cover open)
• South tile: 0x03100000 (GPIO 0) → ✅ WORKS

TrustZone XPU blocks ABL’s VMID from the flat decode window (0x03000000–0x03069FFF). The south tile range (0x03100000–0x03169FFF) is not blocked. Both map to the same physical registers.

ABL v2.4 — Boot Mode Selection

Reads GPIO 105 at 0x03169004 after GetKeyPress(). If bit 0 = 0 (cover closed), waits 3 seconds, re-reads. If still closed, sets BootIntoRecovery = TRUE.

State	GPIO 105	Result
Cover open	bit 0 = 1	Normal Android boot
Cover closed	bit 0 = 0	→ TWRP (display + touch + ADB)

Both states confirmed working. v2.4 is the new last-known-good ABL.

Phase 03b2 Status: COMPLETE

• South tile address (0x03169004) is the permanent address for hall sensor reads from ABL
• No clock enable needed — CNOC confirmed already running
• 3-second debounce prevents accidental recovery entry
• Watchdog-armed oem test-sensor kept for future diagnostics