| 00:06.10 | d3tul3 | jonpry, ping |
| 00:06.19 | jonpry | hey |
| 00:07.02 | jonpry | my latest plan didn't quite work |
| 00:07.16 | d3tul3 | you get my present? |
| 00:07.45 | jonpry | indeed :p |
| 00:07.53 | d3tul3 | check this out http://pastebin.com/PtnkyPZa |
| 00:08.55 | *** join/#htc-linux invisiblek (~invisible@unaffiliated/invisiblek) |
| 00:09.04 | d3tul3 | oh no |
| 00:09.17 | invisiblek | =P |
| 00:09.46 | d3tul3 | sorry jonpry http://article.gmane.org/gmane.linux.ports.hexagon/487 |
| 00:09.49 | jonpry | who is that from? |
| 00:10.23 | jonpry | ic |
| 00:10.41 | invisiblek | d3tul3, did they get the zip from earlier here? |
| 00:10.48 | jonpry | so i managed to boot code on this other processor |
| 00:10.55 | jonpry | daytona whatever that is |
| 00:11.11 | invisiblek | i should just throw it up on a public share site somewhere... even if it gets pulled at least it can be re-uploaded |
| 00:11.16 | d3tul3 | jonpry, sorry about that i posted the repo while trying to unearth the documents...didn't intend this to go to any mailing list |
| 00:11.41 | jonpry | i don't mind. if other people are interested i think that is great |
| 00:11.56 | d3tul3 | invisiblek, you should take those docs offline, i suspect can get you in trouble |
| 00:12.04 | invisiblek | right |
| 00:12.14 | d3tul3 | but thanks |
| 00:12.17 | d3tul3 | a lot |
| 00:12.18 | invisiblek | yep |
| 00:12.32 | jonpry | thanks |
| 00:17.17 | d3tul3 | Daytona? |
| 00:20.58 | jonpry | yeah i saw it in one of the pieces of text |
| 00:21.53 | jonpry | 8960 linux camera one |
| 00:22.25 | jonpry | search for like xPU and there is this nifty block diagram that you have to blow up to like 800% to see all the junk |
| 00:22.40 | d3tul3 | so cotulla was right on this one |
| 00:23.06 | jonpry | i guess so |
| 00:23.27 | jonpry | somehow it knows |
| 00:23.55 | jonpry | we can do daytona linux though |
| 00:24.18 | d3tul3 | lol |
| 00:28.23 | jonpry | i'm pretty sure this is a bug though |
| 00:28.41 | jonpry | shouldn't be possible to boot that thing |
| 00:29.03 | d3tul3 | it clobbers? |
| 00:29.16 | d3tul3 | how did you load the image? |
| 00:29.37 | jonpry | i can load stuff on daytona, but not hexagon |
| 00:30.06 | jonpry | it's some kind of arm7 |
| 00:30.24 | d3tul3 | is there a PIL interface for it? |
| 00:30.31 | jonpry | pil-dsps |
| 00:31.07 | jonpry | hmm |
| 00:33.21 | d3tul3 | damn, they have an arm7 in there just for sensor control |
| 00:33.22 | jonpry | ok i have a new plan |
| 00:33.29 | jonpry | lol |
| 00:33.51 | jonpry | this one will probably work but it will take some doing |
| 00:36.32 | d3tul3 | i take it you loaded it with these un-trusted ops |
| 00:36.53 | jonpry | yeah |
| 00:37.12 | jonpry | the required clock control stuff isn't protected |
| 01:17.34 | *** join/#htc-linux the-leviathan (~quassel@c-82-192-226-27.customer.ggaweb.ch) |
| 02:02.33 | jonpry | d3tul3, maybe i just got this all wrong |
| 03:00.03 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 03:17.54 | *** join/#htc-linux GPFerror (~GPF@71-223-137-179.phnx.qwest.net) |
| 03:18.15 | *** part/#htc-linux GPFerror (~GPF@71-223-137-179.phnx.qwest.net) |
| 03:32.03 | *** join/#htc-linux NEMESIS| (~nembnc@bash0rt.euch.kacknubs.de) |
| 03:43.29 | *** join/#htc-linux d3tul3 (~detule@unaffiliated/d3tul3) |
| 05:36.31 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 06:45.22 | *** join/#htc-linux eR^zeRa` (~zzeratul@ip-94-112-113-32.net.upcbroadband.cz) |
| 06:53.38 | *** join/#htc-linux kiozen (~kiozen@p578a42db.dip0.t-ipconnect.de) |
| 07:11.44 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 07:14.24 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 07:34.10 | *** join/#htc-linux lamikr (lamikr@nat/nokia/x-cgsfkvwddsorfivz) |
| 07:34.52 | *** join/#htc-linux MarkFurniture (79623778@gateway/web/freenode/ip.121.98.55.120) |
| 08:59.27 | *** join/#htc-linux lipp[a] (~lippa@CPE-124-181-17-130.lns7.win.bigpond.net.au) |
| 09:00.56 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 09:04.53 | *** join/#htc-linux lipp[a] (~lippa@CPE-124-181-17-130.lns7.win.bigpond.net.au) |
| 09:22.57 | *** join/#htc-linux lipp[a] (~lippa@CPE-124-181-17-130.lns7.win.bigpond.net.au) |
| 09:34.23 | *** join/#htc-linux lipp[a] (~lippa@CPE-124-181-17-130.lns7.win.bigpond.net.au) |
| 09:42.37 | *** join/#htc-linux ElFinLazz (~elfinlazz@182.215.84.22) |
| 10:52.53 | *** join/#htc-linux |lippa|^ (~lippa@CPE-121-220-19-20.lnse1.win.bigpond.net.au) |
| 10:58.53 | *** join/#htc-linux lipp[a] (~lippa@138.217.109.147) |
| 11:03.54 | *** join/#htc-linux lipp[a] (~lippa@101.160.140.72) |
| 11:27.18 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |
| 11:29.03 | *** join/#htc-linux d3tul3 (~detule@pool-108-40-44-60.bltmmd.east.verizon.net) |
| 11:44.53 | *** join/#htc-linux |lippa|^ (~lippa@CPE-120-144-152-106.lnse5.lon.bigpond.net.au) |
| 11:49.23 | *** join/#htc-linux lipp[a] (~lippa@CPE-121-219-139-141.lnse2.lon.bigpond.net.au) |
| 12:04.54 | *** join/#htc-linux lipp[a] (~lippa@CPE-58-165-53-139.vic.bigpond.net.au) |
| 12:08.53 | *** join/#htc-linux |lippa|^ (~lippa@CPE-124-180-237-254.lns10.lon.bigpond.net.au) |
| 12:33.54 | *** join/#htc-linux lipp[a] (~lippa@CPE-121-219-41-152.lnse1.lon.bigpond.net.au) |
| 12:42.24 | *** join/#htc-linux |lippa|^ (~lippa@CPE-121-219-11-197.lnse1.lon.bigpond.net.au) |
| 12:44.21 | *** join/#htc-linux Cotulla (~myfakemai@109.205.253.11) |
| 12:49.23 | *** join/#htc-linux lipp[a] (~lippa@101.160.36.217) |
| 12:57.54 | *** join/#htc-linux |lippa|^ (~lippa@CPE-121-219-31-192.lnse1.lon.bigpond.net.au) |
| 13:00.28 | *** join/#htc-linux lipp[a] (~lippa@CPE-124-180-224-90.lns9.lon.bigpond.net.au) |
| 13:03.25 | Cotulla | hello |
| 13:27.23 | *** join/#htc-linux |lippa|^ (~lippa@101.160.29.191) |
| 13:35.53 | *** join/#htc-linux lipp[a] (~lippa@CPE-137-147-18-57.lnse7.lon.bigpond.net.au) |
| 13:40.04 | jonpry | hi Cotulla |
| 13:40.26 | Cotulla | how is it jonpry? |
| 13:41.43 | *** join/#htc-linux helicopter88 (~helicopte@host248-113-dynamic.47-79-r.retail.telecomitalia.it) |
| 13:41.47 | jonpry | hrm |
| 13:42.12 | jonpry | i managed to run unsigned code on daytona arm7 |
| 13:43.08 | jonpry | but it is not able to access q6 ebi or control |
| 13:44.16 | Cotulla | on MSM8960? |
| 13:44.51 | jonpry | apq8064 |
| 13:46.44 | Cotulla | hehe |
| 13:46.56 | Cotulla | so like I said it's protected |
| 13:48.45 | jonpry | i'm not entirely convinced 0x28800000 is the correct address |
| 13:49.54 | jonpry | you see this http://pastebin.com/PtnkyPZa |
| 13:52.33 | Cotulla | it's correct address |
| 13:52.36 | Cotulla | I am sure |
| 13:52.53 | Cotulla | hm interesting |
| 13:53.01 | jonpry | i don't see why it is protected |
| 13:53.37 | jonpry | if they can isolate ebi sections then why not allow insecure booting |
| 13:53.43 | Cotulla | which ARM7 is it? |
| 13:53.52 | jonpry | sensors arm7 |
| 13:53.56 | Cotulla | protected by XPU |
| 13:54.07 | detule | I think we should inquire whether Linas is interested in pursuing his hexagon work even if he doesn't work for qcom any more |
| 13:54.27 | Cotulla | and one secure core can access XPU config while other can't |
| 13:54.39 | Cotulla | it can be RPM or TZ |
| 13:55.10 | jonpry | i have another plan |
| 13:55.18 | Cotulla | did u write to him jonpry? |
| 13:55.22 | Cotulla | to that guy? |
| 13:55.23 | jonpry | no |
| 13:55.31 | Cotulla | where did u found that? |
| 13:55.50 | jonpry | somebody posted about our project on a mailing list |
| 13:56.04 | Cotulla | lol |
| 13:56.06 | Cotulla | who it was? |
| 13:56.12 | jonpry | dunno |
| 13:56.18 | Cotulla | can u give a link? |
| 13:56.22 | detule | it was my fault |
| 13:56.24 | Cotulla | maybe I should try to send my mail again |
| 13:56.42 | jonpry | http://article.gmane.org/gmane.linux.ports.hexagon/487 |
| 13:57.24 | jonpry | that sounds a little like E:V:A |
| 13:57.24 | detule | jonpry, what's the plan |
| 13:57.39 | detule | no, it's someone else from d2common |
| 13:57.49 | Cotulla | what is d2common? |
| 13:57.55 | jonpry | like doing the scm call to shutdown q6 unlocks the ebi region |
| 13:58.04 | detule | it's a place where some sgs3 folks hang out, I posted there asking for the 8960 docs |
| 13:58.22 | jonpry | and in theory most of the stuff in qdsp6ss has been setup |
| 13:58.32 | Cotulla | jonpry which stuff exactly? |
| 13:58.49 | jonpry | evb |
| 13:59.03 | Cotulla | on Q6 side? |
| 13:59.28 | jonpry | q6 reset vector is programmed into 0x2880 0000 |
| 14:00.14 | Cotulla | yes |
| 14:00.32 | jonpry | so the plan is to make scm shutdown fail |
| 14:00.43 | Cotulla | hm |
| 14:00.46 | Cotulla | but it turns it off |
| 14:00.49 | jonpry | like let it clear and unlock memory, but block all writes to 0x2800 0000 |
| 14:00.49 | Cotulla | during shutdown |
| 14:01.05 | jonpry | turn off q6ss pclk |
| 14:01.49 | Cotulla | u think u can do that? |
| 14:01.55 | Cotulla | try |
| 14:01.58 | Cotulla | sounds not so bad |
| 14:02.29 | jonpry | it's fine except that i can't actualy reset q6 |
| 14:04.43 | Cotulla | it can halts inside |
| 14:04.56 | Cotulla | and doesn't return or watchdog reset |
| 14:04.57 | detule | does shutting down the modem also unlock ebi0? |
| 14:05.09 | jonpry | probably |
| 14:05.18 | jonpry | it seems to unlock everything in the elf header |
| 14:05.42 | detule | where's the clock control for the modem hexagon? |
| 14:06.07 | jonpry | which clocks? |
| 14:06.36 | detule | whatever the equivalent of 288000 is |
| 14:06.42 | Cotulla | cool to know that glibc is working |
| 14:07.31 | Cotulla | 0x08800000 and 0x08900000 :) |
| 14:10.41 | jonpry | modem has 2 q6 |
| 14:12.16 | Cotulla | yes |
| 14:13.08 | Cotulla | but this guy looks a bit wrong about interrupts |
| 14:25.08 | jonpry | any idea what q6 aclk is? |
| 14:25.39 | Cotulla | AXI Clock |
| 14:25.42 | Cotulla | I think |
| 14:26.32 | jonpry | so that should disconnect the control registers? |
| 14:28.53 | Cotulla | http://news.gmane.org/gmane.linux.ports.hexagon |
| 14:28.54 | Cotulla | ha |
| 14:28.58 | Cotulla | finally I did that |
| 14:29.42 | Cotulla | shit forgot to write at the end "Enjoy my english 11" :\ |
| 14:29.45 | Cotulla | :D |
| 14:30.15 | jonpry | haha |
| 14:33.07 | *** join/#htc-linux helicopter88 (~helicopte@host248-113-dynamic.47-79-r.retail.telecomitalia.it) |
| 14:33.16 | detule | oh snap |
| 14:33.55 | Cotulla | snap? |
| 14:37.19 | detule | i wonder if some lawyer at qualcomm is getting a phone call right about now |
| 14:38.23 | Cotulla | :) |
| 14:38.27 | Cotulla | but it's not clear |
| 14:38.39 | Cotulla | can we thread trap1() as GPL violatation or not |
| 14:38.56 | Cotulla | actually Q6 doesn't provide any hypervision |
| 14:40.44 | jonpry | i don't think so |
| 14:40.59 | jonpry | that's like saying PC BIOS must be GPL because Linux can call it |
| 14:42.00 | Cotulla | well BIOS is kinda PC hardware thing |
| 14:42.06 | Cotulla | while this HVM is just software |
| 14:43.50 | Cotulla | lol "offiicial" |
| 14:43.51 | Cotulla | epic |
| 14:46.31 | jonpry | think linus will be trolled? |
| 14:48.35 | fakker | yes |
| 14:50.06 | Cotulla | I don't know |
| 14:50.08 | Cotulla | for me it's strange |
| 14:50.14 | Cotulla | why include it into mainline? |
| 14:50.26 | Cotulla | and why QCT wanted to include it to mailline? |
| 14:50.54 | detule | they may have had plans to make the binary public |
| 14:51.10 | Cotulla | well, already around year since it was pushed |
| 14:53.02 | Cotulla | also that guy didn't say about SW MMU the most important thing |
| 14:53.10 | Cotulla | I think he worked under userland |
| 14:53.25 | jonpry | or HVM land |
| 14:53.28 | detule | doesnt hypervisor take care of all that |
| 14:54.15 | Cotulla | don't think so |
| 14:54.28 | Cotulla | if he worked under HVM he should mention SW MMU I think |
| 14:54.45 | jonpry | doesn't the HVM do the SW MMU? |
| 14:54.54 | Cotulla | yes it is |
| 14:54.58 | jonpry | i mean under like a level of abstraction under |
| 14:55.00 | Cotulla | I don't think they added new hardware |
| 14:55.01 | jonpry | ie kernel |
| 14:55.14 | Cotulla | I think HVM is lowest level |
| 14:55.25 | Cotulla | cuz it needs to execute sypervisor instructions |
| 14:55.27 | Cotulla | like RTE |
| 14:55.27 | Cotulla | and etc |
| 14:55.30 | jonpry | yeah |
| 14:55.45 | Cotulla | but in qMAGLDR SW MMU works |
| 14:55.51 | Cotulla | at least half |
| 14:56.00 | Cotulla | I didn't test user/kernel modes yet |
| 14:56.02 | jonpry | how can i stop q6 from executing |
| 14:56.11 | jonpry | so it doesn't freak out when it's memory is all zero'd |
| 14:56.28 | Cotulla | via 2880 0000 registers I think |
| 14:56.34 | jonpry | without those |
| 14:56.42 | Cotulla | hm |
| 14:56.56 | Cotulla | not sure |
| 14:57.01 | Cotulla | also code can be loaded to icache |
| 14:57.07 | Cotulla | ever at wait() state |
| 14:57.15 | Cotulla | or power collapse |
| 14:58.52 | Cotulla | well today I hope will continue work |
| 15:31.31 | jonpry | the q6 aclk thing doesn't seem to be working |
| 15:32.51 | fakker | shoots meteor over Cotulla |
| 15:33.48 | Cotulla | bad :( |
| 15:34.29 | fakker | looked amazing |
| 15:34.34 | fakker | tonight there is another one you can see in space :) |
| 15:34.46 | Cotulla | about what u talking? |
| 15:37.53 | fakker | http://www.bbc.co.uk/news/science-environment-21442863 |
| 15:37.54 | fakker | another one |
| 15:38.01 | fakker | not so close, but still visible |
| 15:39.39 | Cotulla | since when u started to talk about space? |
| 15:40.44 | fakker | [15:33:04] * fakker shoots meteor over Cotulla |
| 15:40.51 | Cotulla | pff |
| 15:41.06 | jonpry | Cotulla, probably have to do this old school way |
| 15:41.20 | Cotulla | which one |
| 15:41.42 | jonpry | disassemble qdsp image and find something that can cause it to hyperspace jump |
| 15:42.16 | Cotulla | try |
| 15:42.53 | Cotulla | but ur OS memory can be protected from access |
| 15:43.25 | jonpry | seems not |
| 15:43.34 | jonpry | i can write it with daytona |
| 15:43.44 | Cotulla | dunno |
| 15:43.47 | Cotulla | depends from XPU config I think |
| 16:09.35 | *** join/#htc-linux kiozen (~kiozen@p578a42db.dip0.t-ipconnect.de) |
| 16:19.23 | jonpry | Cotulla, how do you turn off XPU? |
| 16:53.12 | Cotulla | I had never turned it off |
| 16:53.24 | *** join/#htc-linux paulk-desktop (~paulk@lib33-1-82-233-88-171.fbx.proxad.net) |
| 16:54.13 | Cotulla | lol 8064 supports SATA? :O |
| 17:06.13 | Cotulla | it seems that every bus has own config |
| 17:06.16 | Cotulla | to enable disable |
| 17:12.24 | jonpry | tzbsp_mpu_lock_area2(HAL_XPU_EBI0, TZBSP_EBI1_RG_LPASS, |
| 17:12.24 | jonpry | 1 |
| 17:12.25 | jonpry | 2 TZBSP_EBI1_LPASS_BASE, TZBSP_EBI1_LPASS_END, |
| 17:12.25 | jonpry | 3 TZBSP_VMID_LPASS_BIT | TZBSP_VMID_TZ_BIT, |
| 17:12.25 | jonpry | TZBSP_VMID_LPASS_BIT | TZBSP_VMID_TZ_BIT); |
| 17:12.46 | Cotulla | ? |
| 17:12.58 | jonpry | thats how it is programmed |
| 17:13.18 | Cotulla | kinda |
| 17:13.21 | Cotulla | but it's high level |
| 17:13.22 | *** join/#htc-linux arif-ali (~arif-ali@31.99.40.93) |
| 17:14.06 | jonpry | looks like the only domains that can read it are TZ and LAPSS |
| 17:15.02 | Cotulla | where u got that? better not post it here cuz this channel has logs. |
| 17:19.01 | *** join/#htc-linux jonpry_ (~jon@user-0c6tmn0.cable.mindspring.com) |
| 17:51.29 | *** join/#htc-linux {simonsimons34} (~SimonSick@unaffiliated/simonsimons34) |
| 19:28.31 | *** join/#htc-linux helicopter88 (~helicopte@host248-113-dynamic.47-79-r.retail.telecomitalia.it) |
| 19:29.08 | *** join/#htc-linux jonpry__ (~jon@2602:306:c417:8aa0:19c:511d:44a8:59) |
| 20:42.15 | *** join/#htc-linux bartman (~bart@2607:f2c0:f00e:700::dd) |
| 21:17.58 | *** join/#htc-linux Marc (~quassel@phpbb/modifications/marc1706) |
| 21:28.10 | *** join/#htc-linux jonpry (~jon@2602:306:c417:8aa0:d9af:d3d6:bb47:d59f) |
| 21:31.46 | Cotulla | Marc how is it? |
| 21:43.18 | jonpry | seems that userspace doesn't use RTAC |
| 21:46.57 | Cotulla | :( |
| 21:49.57 | *** join/#htc-linux jonpry_ (~jon@2602:306:c417:8aa0:fc1b:9eed:d0ec:15fe) |
| 21:55.35 | Marc | Cotulla: usb is still broken ... |
| 21:55.40 | Cotulla | heh |
| 21:56.10 | Cotulla | I remember some people complains about non working Android on NAND cuz bad blocks |
| 21:56.12 | Cotulla | is it ? |
| 21:58.19 | Marc | bad blocks should actually be treated by the fs drivers |
| 21:58.47 | Cotulla | no |
| 21:58.53 | Cotulla | it's storage level thing |
| 22:11.33 | Marc | yes, for the system partition |
| 22:12.16 | Marc | if the bad blocks take up too much space it might cause incomplete data during flashing |
| 23:27.50 | *** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info) |