Daniel Palmer

Going through the board is a bit of no go at the moment as it would break the routing. I think the 16 pin USB-C connectors would be the way...

It's here. https://github.com/fifteenhex/mc200c2camerahacks/blob/master/msc313ebootrom.bin Since playing with the i2c thingy I'm wondering if the "UART" bootstrap pin setting I have might mean just stopping it booting to interfering with the i2c....

Note to self: UART reading is in the M5 bootrom but not the I3 one. I3 probably doesn't have UART boot.

> So for the msc313e, the only recovery option (in case of broken flash content) would be via i2c, right? The SD card should be bootable. I just haven't looked...

The binary is mapped to 0x0. The vector table is at the beginning. The table is made up of ARM instructions instead of jump locations. The first 4 bytes should...

I tried radare2 via the cutter interface and it was a bit painful. Hopper probably isn't as good as IDA at working out all of the control flow etc but...

According to my notes in the DTS (https://github.com/fifteenhex/linux/blob/4bf698c9b74b02df400bf635b851f85ccf9752ed/arch/arm/boot/dts/chenxing-v7.dtsi#L309) that's where the mailbox is. I think it's a mailbox between the ARM cpu and a house keeping 8051 that is there...

The vendor code writes the kernel log buffer address into some registers there on start up: https://github.com/fifteenhex/linux-ssc325/blob/89341c7012404c72e192f198b2ea6405ec80d15d/arch/arm/mach-sstar/infinity3/soc.c#L404 I'm guessing that's so whatever is behind there is able to write messages...

I think I see what you where talking about now. I just noticed the bootrom writes to the mailbox box right after disabling the WDT. I guess it's the ARM...

I thought I might have seen some writes to it in the code that runs in SRAM to do the suspend (https://github.com/fifteenhex/linux-ssc325/blob/89341c7012404c72e192f198b2ea6405ec80d15d/arch/arm/mach-sstar/infinity3/sram.S#L145) but it looks like I was miss remembering....