cyrozap / mediatek-lte-baseband-re

Notes and utilities for reverse engineering the MediaTek LTE baseband and its Coresonic DSP.
GNU General Public License v3.0
178 stars 38 forks source link

Add support for MT6750 #8

Closed DidntRead closed 3 years ago

DidntRead commented 3 years ago

Tested all commands in hello-aarch64 and they work. I am a bit unsure about l2 sram size. Functional spec lists size as 0x20000, but there is unique data from 0x00200000 to 0x00240000, which is then repeated so I think l2 sram's size is actually 0x40000.

cyrozap commented 3 years ago

Tested all commands in hello-aarch64 and they work.

Thanks, I appreciate it.

I am a bit unsure about l2 sram size. Functional spec lists size as 0x20000, but there is unique data from 0x00200000 to 0x00240000, which is then repeated so I think l2 sram's size is actually 0x40000.

Yeah, the same thing happened with a few other SoCs where the size/offset in the spec/manual are incorrect, so I've been thinking that maybe I should add a "identify memory regions" function to usbdl.py, where it would automatically guess where the BROM/SRAM/L2 SRAM are and verify their sizes. For the BROM, we can verify its size by reading it until we start seeing a bunch of 0xff bytes in a row, then continuing until we start getting null bytes (since the mask ROM is filled with 0xff, but the space beyond it reads as zero). For the SRAMs, we can just fill it with random data for a few MB, then read it all back and do an autocorrelation to find where it repeats and where the boundaries are.

But until I get around to implementing that, for manual testing, I generally just write some unique string at the start of the SRAM, then dump a few megabytes, hexdump -C it, and note where I see the string repeat. Actually, now that I think of it, automating using that process might be a better approach than filling with random data like I described earlier. Well, I'll figure something out.

Thanks again for your help! I'm really glad to see that other people are working on this stuff, too.