# TECKIN TC100 (AK3918EV300 + JXF23, XMC xm25qh64a 8 MB) — UART boot + OpenIPC U-Boot tested from RAM

Follow-up to reports r-rxh32hs4 and r-gc72ugx7 (same board).

## Stock boot (UART, 115200 8N1)
- Attached: full boot log of the stock boot chain and the stock U-Boot `printenv` (MAC removed).
- U-Boot 2013.10.0-AK_V3.0.05; bootdelay=1, any key stops it; the prompt is `anyka$`.
- The stock U-Boot does not relocate: it runs at 0x80e00000. Loading anything there freezes it.
- Flash: XMC xm25qh64a, JEDEC 0x207017, 8 MiB.
- Vendor FHA partition table at 0x37000:
  - U-Boot 0x0–0x37000
  - KERNEL @0x39000, 2 MiB
  - MAC @0x239000
  - ENV @0x23a000
  - A @0x23b000, 1.5 MiB
  - B @0x3bb000, 500 KiB (mtdblock4, root squashfs)
  - C @0x438000, ~3.7 MiB
- Stock trap: `erase_env` erases 0x20000–0x22000, which is inside U-Boot, not the ENV partition.

## OpenIPC U-Boot (2022.10-g0076cd0a, built 2026-10-19 14:56 UTC, u-boot-ak3918ev300-nor.bin) run from RAM only — nothing was written to flash
- Method, from the stock prompt:
  1. `fatload mmc 0 0x82000000 u-boot-ak3918ev300-nor.bin`.
  2. Put an 18-word stub at 0x82100000 with `mw.l`. The stub disables IRQ/FIQ, copies 0x82000200 → 0x80e00000 (0x39800 bytes), cleans/invalidates the D-cache, drains the write buffer, invalidates the I-cache, then jumps to 0x80e00000.
  3. `go 0x82100000`.
- Works:
  - CPU (chip id <die_id:09317f394d35cf6f>), DRAM 64 MiB, relocation to 0x83fb3000;
  - the SPI flash is detected (`JEDEC 207017 … erase size 64 KiB, total 8 MiB`), although the header SPIP names gd25q64;
  - the SD card (ak_mci, SD 3.0 HS, fatls/fatload OK);
  - the console and Ctrl-C autoboot stop.
- Expected and harmless: env bad CRC → default env (not saved); "Firmware is absent/corrupt" (the stock kernel is at 0x39000, not 0x50000); no PHY (the board has Wi-Fi only).

## Bug: `sf read` intermittently returns wrong data on longer reads
- Reads of 4 KiB are always byte-exact against a Linux dump of the same flash.
- Reads of 0x8000 bytes and more **intermittently** return data with one 32-bit word duplicated, so everything after it is shifted by 4 bytes.
  - Example: in a 0x39000 read from 0, the data at 0x2000 equals flash 0x1ffc. By 0x37000 the slip is 6 bytes.
  - The same `sf read 0x82300000 0x40000 0x8000` gave the correct CRC 3 times, then a wrong one 3 times.
  - `Read: OK` is printed in every case.
- Consequence: `loadkernel` (sf read 0x200000) would load a corrupted kernel.
- Probably a FIFO/DMA race in the Anyka SPI read path. Happy to test a fix the same way (RAM only).

## Layout note
- The OpenIPC default env at 0x40000 falls inside the stock KERNEL partition (0x39000–0x239000).
- The automatic saveenv in board_late_init (env bad CRC and 0x40000 erased) is skipped on this board, because 0x40000 holds kernel data. Flashing over the stock layout must take this into account.

Full project (open source, alternative firmware for this camera): https://github.com/morgeek/TECKIN-TC100-Anyka-AK3918