adespoton wrote:Any idea what's being held in r13 at the time? If we can backrace to what was loaded there and why, we can likely figure that part out.
i added a fake device around the address 0xf3000000 (where the rom gets stuck), that's what happens:
XXXX: write4 addr f3000024 val 00000080
XXXX: write4 addr f3000028 val ffffffff
XXXX: write4 addr f3000038 val 3aff3e03
XXXX: write4 addr f3000038 val faffbe01
XXXX: wead4 addr f3000038 val 00000000
XXXX: write4 addr f3000038 val 1000000c
XXXX: write1 addr f3017e00 val 10
XXXX: write1 addr f3016600 val 58
XXXX: write1 addr f3016000 val 38
XXXX: write1 addr f3016400 val 30
XXXX: write1 addr f3017800 val 00
XXXX: write1 addr f3017600 val 1c
XXXX: write1 addr f3017c00 val 7f
XXXX: read1 addr f3017600 val 00
XXXX: write1 addr f3017600 val 00
XXXX: write1 addr f3017c00 val 84
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 30
XXXX: read1 addr f3016000 val 00 (3338 of these)
XXXX: read1 addr f3017a00 val 00 (18337 of these)
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 10
XXXX: read1 addr f3016000 val 00 (51675 of these)
XXXX: wead4 addr f3000034 val 00000000
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 30
XXXX: read1 addr f3016000 val 00 (3338 of these)
XXXX: read1 addr f3017a00 val 00 (18337 of these)
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 10
XXXX: read1 addr f3016000 val 00 (18337 of these)
XXXX: read1 addr f3017a00 val 00 (18337 of these)
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 10
XXXX: read1 addr f3016000 val 00 (18337 of these)
XXXX: read1 addr f3017a00 val 00 (18337 of these)
XXXX: read1 addr f3016000 val 00
XXXX: write1 addr f3016000 val 10
XXXX: read1 addr f3016000 val 00 (15000 of these)
XXXX: wead4 addr f3014020 val 00000000 (159608 of these)
XXXX: write1 addr f30723f0 val 1c
XXXX: write1 addr f30723e0 val 42
XXXX: write1 addr f30723d0 val f0
XXXX: write1 addr f30723c0 val ff
XXXX: write1 addr f3013020 val 09
XXXX: write1 addr f3013020 val c0
XXXX: write1 addr f3013020 val 0d
XXXX: write1 addr f3013020 val 00
XXXX: write1 addr f3013020 val 0c
XXXX: write1 addr f3013020 val 0a
XXXX: write1 addr f3013020 val 0e
XXXX: write1 addr f3013020 val 01
XXXX: write1 addr f3013020 val 0b
XXXX: write1 addr f3013020 val 50
XXXX: write1 addr f3013020 val 05
XXXX: write1 addr f3013020 val ea
XXXX: write1 addr f3013020 val 04
XXXX: write1 addr f3013020 val 44
XXXX: write1 addr f3013020 val 03
XXXX: write1 addr f3013020 val c1
XXXX: read1 addr f3013020 val 00 (forever)