| 00:03.20 | *** join/#openezx jamesmck (n=james@gimel.esc.cam.ac.uk) [NETSPLIT VICTIM] |
| 00:03.21 | *** join/#openezx SuN (i=unices@ip5652ade4.speed.planet.nl) [NETSPLIT VICTIM] |
| 00:03.25 | *** join/#openezx robtaylor (n=robtaylo@dhansak.collabora.co.uk) [NETSPLIT VICTIM] |
| 00:03.33 | *** join/#openezx TimRiker (n=timr@pdpc/supporter/bronze/TimRiker) [NETSPLIT VICTIM] |
| 00:07.25 | *** join/#openezx toi (n=pleemans@d5152D3B4.access.telenet.be) |
| 00:35.54 | *** join/#openezx TimRiker (n=timr@pdpc/supporter/bronze/TimRiker) |
| 02:15.20 | *** join/#openezx proberts (n=proberts@rrcs-64-183-51-174.west.biz.rr.com) |
| 02:22.09 | nh_home | proberts: welcome back |
| 02:37.23 | proberts | nh_home: should we dare each other to be the first to flash the policy file? ;P |
| 02:37.59 | nh_home | proberts: I think we should try some of the other hooks vrist. :) |
| 02:39.12 | proberts | nh_home: That sounds like yeller' talk. ;) |
| 02:39.16 | *** join/#openezx webmind (i=webmind@feather.perl6.nl) |
| 02:39.49 | proberts | nh_home: I dig around in the 38P files tonight when I (eventually) get home. Maybe they'll be something different. |
| 02:40.01 | proberts | s/I/I'll/g |
| 02:41.03 | nh_home | proberts: you're right, you'll have to show me how it's done bravely. ;) |
| 02:41.23 | proberts | :P |
| 02:41.45 | proberts | I also want to take another whack at mmaping and patching the kernel. |
| 02:44.08 | proberts | I may be able to do it from a module since user-space appears to be blocked. |
| 02:46.21 | nh_home | It's hard to know what's bugs and what's intentional locking out. |
| 02:46.52 | nh_home | I looked over your code pretty carefully and I can't find anything wrong. |
| 02:47.17 | proberts | yeah - the mmap *should* work as well. I don't know why, but if I were writing a security layer, I'd prevent kernel mem access from user space. |
| 02:47.29 | nh_home | yeah |
| 02:47.48 | proberts | The odd thing is the return code it gave me. Just like I was trying to access non-existent memory. |
| 02:48.14 | proberts | It's too bad that disable module didn't work. That would have been sweet. :P |
| 02:48.15 | nh_home | btw, at some point I might ask you for some help setting up the ezx dev stuff. |
| 02:48.41 | nh_home | proberts: did you ever look at those arm mmap links I posted? |
| 02:48.48 | proberts | sure - I've done it a couple times now. |
| 02:49.07 | proberts | Yeah - I looked at them. |
| 02:49.35 | nh_home | Are thy at all relevant? |
| 02:50.14 | proberts | They helped me figure out I had the right memory addresses. At first I thought I had to do some address translation to get the physical mem address from the ksyms. |
| 02:50.30 | proberts | (when I kept getting errors) |
| 02:53.05 | proberts | BTW- the dev-ezx setup was a breeze to install. The only gotcha is the qt libs names are totally different for the E2, so the test app will fail to compile and you'll get an error. (and if you try to fix it and re-install, it does the who hours-long process over...). Commenting out the test compile still builds a usable toolchain. |
| 03:02.29 | nh_home | ok, good to know. I'm hoping maybwe on thursday I can try to get it setup. |
| 03:03.47 | nh_home | Then I can try to access some of those other hoks. |
| 03:06.22 | nh_home | sys_ac_execv looks like it might be useful |
| 03:17.09 | nh_home | well, time for bed. Good night! |
| 03:19.41 | proberts | later :) |
| 03:39.29 | alphaone | Yeeha!!! |
| 03:40.44 | alphaone | So it definitely has to do with mux_cli communication |
| 03:41.01 | proberts | sweet! Congrats! |
| 03:44.37 | alphaone | So now we have a working codebase to see what's wrong in the 2.6 kernel |
| 03:44.53 | alphaone | Thanks. I'm actually dancing right now :-) |
| 03:56.12 | alphaone | Okay, gotta write a mail and then off to bed. Good night |
| 04:06.06 | letoto | alphaone: interesting! |
| 04:06.24 | letoto | alphaone: please add ipsec nat-t patch to kernel :) |
| 04:08.38 | alphaone | letoto: Our main goal will be to get a 2.6 kernel running. The 2.4.20 is just so we have some sort of working base |
| 04:11.31 | letoto | I'd like the patch in a 2.6 kernel too :) |
| 04:11.43 | letoto | alphaone: going to be at CCC? |
| 04:12.27 | letoto | I need to setup a dev env so you guys can test the text-based sipclient for me :) |
| 04:12.44 | alphaone | letoto: Yes |
| 04:12.58 | letoto | excellent :) |
| 04:13.38 | alphaone | But I don't own a phone myself :-( |
| 04:13.55 | letoto | if you want to make a few slides and talk for 10-15 minutes about the experience, we can schedule that in |
| 04:13.57 | letoto | ah |
| 04:13.58 | alphaone | At least none with linux on it |
| 04:14.12 | letoto | that's stephan's phone you have? |
| 04:14.17 | alphaone | Yup |
| 04:14.34 | letoto | I'll talk to him then :) |
| 04:14.39 | letoto | so what was the trick? |
| 04:14.39 | alphaone | :-) |
| 04:15.00 | alphaone | You're helping organize the CC? |
| 04:15.07 | alphaone | s/CC/CCC/ |
| 04:15.17 | letoto | I'm speaking :) |
| 04:15.25 | alphaone | ah cool :-) |
| 04:15.28 | letoto | I know people, I might be convinced to do some volunteer duties :) |
| 04:16.02 | alphaone | I'll probably sign up for some angel duties. |
| 04:16.11 | letoto | but i think you guys should do a brief talk within my talk to tell wbout the phone hacking progress :) |
| 04:16.28 | letoto | my talk is on how to create a fully secure voip infrastructure, using gsm phones |
| 04:16.31 | alphaone | Well the trick was compiling the mux_cli driver into the kernel. |
| 04:16.47 | letoto | didnt you compile that in before? wasnt it neede dto talk to the BP ? |
| 04:17.00 | alphaone | It seems that somehow our own kernel couldn't load the mux_cli module |
| 04:17.34 | letoto | and the issue was? |
| 04:18.37 | alphaone | That's next on the todo list. But first I need some sleep. |
| 04:19.22 | alphaone | If I get too tired I do stupid things :-) |
| 04:19.57 | letoto | get some sleep :) |
| 04:21.07 | alphaone | It's either some keepalive timer in the mux_cli or Userspace talking to the BP. Figureing that out should be easy. We have a completely working kernel now. |
| 04:21.11 | alphaone | Thanks :-) |
| 04:21.23 | alphaone | Good night |
| 04:23.53 | *** join/#openezx proberts_ (n=proberts@67-20-86-248.vnnyca.adelphia.net) |
| 06:09.45 | *** join/#openezx nevarrie_ (n=jgrant@CPE-72-128-35-75.kc.res.rr.com) |
| 08:57.05 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 09:17.42 | *** join/#openezx jonwil (n=jonwil@220-245-202-116-wa-pppoe.tpgi.com.au) |
| 09:17.55 | stefan_schmidt | morning all |
| 09:18.11 | stefan_schmidt | Anybody know who is Frankie on the OpenEZX wiki? |
| 09:18.22 | stefan_schmidt | He added nice stuff about A732 |
| 09:18.24 | stefan_schmidt | http://wiki.openezx.org/Image:A732-pcb1-back.jpg |
| 09:19.38 | stefan_schmidt | morning mickeyl |
| 09:19.38 | jonwil | is an a732 EZX? |
| 09:19.53 | stefan_schmidt | We guess so. |
| 09:21.34 | jonwil | did you see the post by Daniel Willmann on the mailing list |
| 09:21.50 | jonwil | seems he has working 2.4 kernel that compiles, flashes to the phone and boots |
| 09:21.58 | mickeyl | morning guys |
| 09:22.02 | jonwil | and doesnt get shut down |
| 09:22.15 | jonwil | sounds like we can use that as a place to start |
| 09:22.25 | mickeyl | guess now we're in a good position to find out who exactly is responsible for the shutting down and how to prevent it |
| 09:22.46 | jonwil | my guess is that its most likely BP |
| 09:22.48 | jonwil | or so |
| 09:22.54 | *** join/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 09:23.01 | jonwil | where BP expects some kind of signal from AP that never arrives |
| 09:23.11 | ade|desk | morning all |
| 09:23.22 | jonwil | I think the idea of putting mux_cli into the actual kernel makes sense |
| 09:25.58 | stefan_schmidt | jonwil: Yeah, I just had a phone call with him. :) |
| 09:26.13 | jonwil | so is this good news |
| 09:26.17 | stefan_schmidt | jonwil: It's a local friend of mine hacking on my devel phone. :) |
| 09:26.18 | jonwil | or is it not as major as it sounds? |
| 09:26.54 | stefan_schmidt | jonwil: It is major. Now we can diff step by step our changes angainst a working setup. |
| 09:27.03 | jonwil | yes |
| 09:27.09 | stefan_schmidt | mickeyl: Yeah. We plan another hacking day next sunday. |
| 09:27.12 | stefan_schmidt | morning ade|desk |
| 09:27.40 | jonwil | The other thing this demonstrates is that no part of the EZX phone has any kind of checksumming on the kernel |
| 09:28.03 | ade|desk | thats very good news |
| 09:29.58 | stefan_schmidt | jonwil: Yes, but I don't expected this. |
| 09:30.25 | jonwil | If this level of progress can be continued, we could be making phonecalls with a selfbuilt 2.6 kernel by xmas |
| 09:31.39 | stefan_schmidt | Nobody know Frankie from the wiki.openezx.org? I want thank him for this: http://wiki.openezx.org/A732_Board |
| 09:32.13 | jonwil | It might be that putting mux_cli right into the kernel instead of as a module will magically make a 2.6.x kernel flashed to the phone start working |
| 09:32.27 | stefan_schmidt | jonwil: I have a bet on this with alphaone (Daniel Willmann). :) |
| 09:32.42 | stefan_schmidt | jonwil: We still need a working sound driver for it. Let us see what neolynx can produce. |
| 09:34.08 | jonwil | in the picture of the a732 board, the chip #4 is covered up with a sticker |
| 09:34.45 | stefan_schmidt | jonwil: We will test this all. |
| 09:35.11 | jonwil | does not audio for making a phonecall go straight from microphone through pcap2 to BP? |
| 09:35.17 | jonwil | and same for speaker audio |
| 09:35.19 | stefan_schmidt | jonwil: Yes, a picture without sticker would be nice. Another reason to cantact him. :) |
| 09:36.06 | stefan_schmidt | jonwil: I did not looked in audio system yet, but I guess we need some kind of switching between the different sound sources. |
| 09:36.39 | stefan_schmidt | jonwil: Perhaps it is default on phone call. We will see. |
| 09:38.21 | jonwil | ok, I doing some googling on some a732 chips |
| 09:38.59 | stefan_schmidt | jonwil: thanks. |
| 09:39.00 | jonwil | looks like chip 5 may be a Texas Instruments WL3016 Analog Baseband |
| 09:39.06 | jonwil | Make that TWL3016 |
| 09:39.30 | jonwil | Chip 4 we cant ID because of the sticker |
| 09:39.46 | jonwil | I suspect Chip 4 is the CPU |
| 09:39.54 | jonwil | or one of the CPUs if that phone is dual CPU |
| 09:41.45 | jonwil | I suspect that this phone is single CPU with chip 4 being CPU |
| 09:41.50 | jonwil | and chip 1 being flash memory for it |
| 09:43.27 | jonwil | if you look at chip 5 in the high res photo, you can see the Texas Instruments logo |
| 09:44.13 | jonwil | so chip 5 might be a baseband DSP of some kind |
| 09:44.47 | stefan_schmidt | I'll ask Frankie in the wiki about another picture. |
| 09:46.38 | stefan_schmidt | jonwil: One chip CPU would be a reason against our EZX guess. Perhaps we are wrong with it. |
| 09:46.51 | jonwil | http://focus.ti.com/general/docs/wtbu/wtbuproductcontent.tsp?templateId=6123&navigationId=11981&contentId=4704 |
| 09:47.00 | jonwil | thats a block diagram/info on that analog baseband |
| 09:47.25 | stefan_schmidt | jonwil: Can you add it to the wiki? |
| 09:47.42 | jonwil | Can you add it please |
| 09:47.49 | stefan_schmidt | np |
| 09:49.09 | stefan_schmidt | done |
| 09:49.44 | jonwil | I recon chip 1 is flash chip |
| 09:49.58 | jonwil | with chip 4 being "AP" on this hpone |
| 09:50.07 | jonwil | and the phone side being handled by the TI baseband chip |
| 09:50.50 | jonwil | well engadget says a732 is linux |
| 09:50.53 | jonwil | http://www.engadget.com/2005/07/26/motorolas-latest-linux-phones-the-a728-and-the-a732/ |
| 09:50.55 | stefan_schmidt | jonwil: That could be. We need a picture without sticker? |
| 09:51.03 | jonwil | yes we do |
| 09:52.12 | jonwil | we will probobly never know 100% for sure which of the many wierd phones moto release for china market run linux |
| 09:52.48 | stefan_schmidt | I added your infos. |
| 09:53.06 | stefan_schmidt | IIRC Harald has a A732, too. I need to check this. |
| 09:53.23 | jonwil | akthiygg http://www.engadget.com/2005/07/26/motorolas-latest-linux-phones-the-a728-and-the-a732/ |
| 09:53.25 | jonwil | oops |
| 09:53.54 | jonwil | aah now I see |
| 09:54.38 | jonwil | FYI, I dont think that TI chip is a CPU |
| 09:55.00 | jonwil | its a special purpose ASIC |
| 09:56.05 | jonwil | TI has another chip OMAP730 which talks to that ASIC |
| 09:56.31 | jonwil | The unknown CPU chip may be a Neptune LTE |
| 09:56.38 | jonwil | or it may be some more advanced ARM chip |
| 09:56.40 | jonwil | we dont know |
| 09:56.44 | jonwil | :) |
| 09:57.19 | jonwil | one answer is for someone to contact motorola, ask if a732 runs linux and if so could they please release the source as required by GPL |
| 09:58.41 | jonwil | Also dont forget http://wiki.openezx.org/images/f/f9/A732-pcb2-back.jpg |
| 09:59.23 | jonwil | Maybe the chip on there is the AP |
| 09:59.29 | jonwil | or BP |
| 09:59.39 | stefan_schmidt | added the photo. |
| 09:59.43 | jonwil | its certainly large enough to be a CPU |
| 10:01.19 | stefan_schmidt | yes, we need the chip numbers. Another question for Frankie. :) |
| 10:02.24 | proberts_ | stefan_schmidt: Can you give me a term to google that will help me find out how to get the pages in use for kernel-space data? |
| 10:02.34 | stefan_schmidt | battery is empty. cu later. |
| 10:02.47 | stefan_schmidt | proberts: Sorry, later. |
| 10:02.50 | proberts_ | ok |
| 10:02.55 | jonwil | cya |
| 10:11.32 | mickeyl | i wonder why power through usb doesn't work for us? is that done in software? |
| 10:12.05 | mickeyl | it works on hardware on most mobile's i've seen |
| 10:12.09 | mickeyl | s/on/in/ |
| 10:18.50 | jonwil | I believe USB is connected to PCAP2 |
| 10:19.25 | jonwil | we probobly arent sending right signals to PCAP2 so that PCAP2 can draw power from USB and feed it to battery charging interface |
| 10:19.46 | mickeyl | right |
| 10:21.41 | jonwil | On non ezx motos I have seen, if phone is completly dead it wont charge up over USB, only via an actual charger |
| 10:22.05 | jonwil | so there is definatly some software involved in the case of charging up from a PC |
| 10:22.08 | jonwil | as opposed to a charger |
| 10:32.59 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 10:36.11 | ade|desk | blackberrys don't charge over usb unless you install their software on the host |
| 10:36.53 | ade|desk | and what is the point of the software for syncing when it is all done over the air.... madness |
| 10:41.46 | *** join/#openezx florian_kc (n=fuchs@dns.kernelconcepts.de) |
| 10:43.07 | florian_kc | good morning |
| 11:34.11 | *** join/#openezx [g2] (n=g2@nslu2-linux/g2) |
| 11:49.56 | stefan_schmidt | re with a stable internetconnection now. |
| 11:50.47 | jonwil | I think it would be usefull to take the 2.4 kernel (that we can now compile) and change mux_cli to dump everything sent to the AT command mux devices |
| 11:51.10 | jonwil | and from there figure out how that converts into the AT command one might be familiar with when accessing phones over terminal windows |
| 11:51.39 | stefan_schmidt | yes, good idea |
| 11:51.54 | mickeyl | I'd like to see a 2.4 kernel built by OE |
| 11:52.07 | mickeyl | could you guys send me a known-good-defconfig and sources archiveß |
| 11:52.07 | mickeyl | ? |
| 11:53.46 | ao2 | can openmoko run with linux-2.4? I mean, has it been tested with it? |
| 11:53.59 | florian_kc | i guess i have some patches to make it build here, but i'd need a little bit of free time :-} |
| 11:54.15 | stefan_schmidt | mickeyl: We can. alphaone already posted a link to the patch whcih integrates mux_cli directly into the kernel. I nned to ask him abot the config. |
| 11:54.46 | stefan_schmidt | florian_kc: We have it working with selfbuild 2.4. And it don't turn off. |
| 11:54.47 | mickeyl | ok, i just need to know which kernel sources to use |
| 11:54.55 | mickeyl | + patches + defconfig |
| 11:54.56 | stefan_schmidt | We just have a phone call with it. :) |
| 11:55.00 | mickeyl | the rest i can deal with |
| 11:55.33 | stefan_schmidt | mickeyl: OK, I ask him when he is back from THW. Expect an mail about it in the evening. |
| 11:55.48 | jonwil | the fact that we can make phonecall with selfbuilt kernel is the biggest news since openezx started |
| 11:56.12 | florian_kc | stefan_schmidt: oh cool! what did you have to change? what about the internal flash? |
| 11:56.52 | stefan_schmidt | jonwil: :) even it os 2.5 only until now. |
| 11:57.09 | ao2 | stefan_schmidt, you used motorola userspace software to make the call, right? |
| 11:57.19 | stefan_schmidt | florian_kc: We had to patch mux_cli into kernel. No idea why it don't load the existing modul. |
| 11:57.28 | stefan_schmidt | ao2: right |
| 11:57.53 | stefan_schmidt | And of course the kernel needs to be flashed not loaded over usb. |
| 11:58.11 | ao2 | a huge step anyway |
| 11:58.15 | stefan_schmidt | The problem with loaded over usb and BP in flash mode still exists. |
| 11:58.54 | stefan_schmidt | ao2: Yes. With this basement the 2.6 port is just a question of time and coding. :) |
| 11:59.04 | florian_kc | stefan_schmidt: hmm... so the driver for the internal flash is somewhere too? |
| 11:59.21 | jonwil | I dont know that much about linux devices but from what I can tell, when a call is made, the userspace apps make some combination of read, write and ioctl calls to some combination of things in /dev |
| 11:59.26 | florian_kc | stefan_schmidt: maybe because of different compilers or some funky extra versions it attaches |
| 11:59.53 | jonwil | As far as I know read, write and ioctl are the only ways for userspace apps to talk to the kernel |
| 11:59.56 | jonwil | well there are syscalls |
| 12:00.00 | jonwil | but those are clearly defined |
| 12:00.26 | jonwil | and if motorola had their own syscalls we would have seen it by now :) |
| 12:01.20 | stefan_schmidt | jonwil: Yes, open /dev/muxN, write and close. It's just a question how they make it useable with a library. |
| 12:01.40 | stefan_schmidt | florian_kc: Which internal flash problem you refer to? |
| 12:02.07 | jonwil | what we need to identify is excatly what form the write to /dev/muxN (and to anything else it writes to to handle GPIO and stuff) takes |
| 12:03.26 | stefan_schmidt | yes. But first step is to keep the 2.6 alive with the mux_cli. :) |
| 12:03.49 | jonwil | well yes |
| 12:04.36 | florian_kc | stefan_schmidt: hrm... iirc i read somewhere the kernel released by motorola didn't include a driver for the flash, but maybe this is just wrong. |
| 12:05.12 | jonwil | I do know that the A780/E680 include closed source modules for intel hatcreek flash filesystem |
| 12:05.22 | jonwil | and for m-systems trueflash filesystem |
| 12:05.24 | jonwil | I think |
| 12:06.23 | stefan_schmidt | ah, you refer to flash filesystem drivers. Indeed there are some closed source ones. |
| 12:06.38 | stefan_schmidt | But the phone booted fine into GUI and is useable. |
| 12:07.11 | stefan_schmidt | Perhaps it uses the one on the phone. This opens the question why it does not use the mux_cli there. |
| 12:08.11 | florian_kc | stefan_schmidt: hmm...? reading the module from a filesystem the kernel has no driver for? |
| 12:08.16 | jonwil | the root filesystem does not use either of those flash filesysems |
| 12:08.22 | florian_kc | ah |
| 12:08.23 | jonwil | it uses CRAMFS |
| 12:08.32 | jonwil | the TFFS filesystem is used for some other partitions |
| 12:08.42 | jonwil | no clue what the hatcreek filesysem is for |
| 12:09.12 | florian_kc | right, i forgot - there is the rootfs in nor |
| 12:12.05 | |dion| | hiall |
| 12:12.20 | stefan_schmidt | hi |dion| |
| 12:13.13 | jonwil | is this for AP jtag or BP jtag? |
| 12:13.19 | stefan_schmidt | AP |
| 12:13.33 | jonwil | do we know which jtag pads are which? |
| 12:14.08 | |dion| | stefan_schmidt: so self-compiled 2.4 kernel works fine? |
| 12:14.15 | stefan_schmidt | jonwil: Yes, we are pretty sure. Already had some work on this. When I have a working setup I post it into the wiki. With pictures of the pads. |
| 12:14.21 | jonwil | ok |
| 12:14.29 | stefan_schmidt | |dion|: Yes, just did a phone call. :) |
| 12:15.05 | |dion| | sounds good |
| 12:18.45 | stefan_schmidt | yeah |
| 12:20.22 | vmaster | stefan_schmidt: the pads you've found are certainly fine, otherwise the OpenOCD would have failed a lot eariler |
| 12:20.32 | |dion| | i have no experience with kernel developing, but looks like i can hope that 2.6 kernel will have all phone stuff |
| 12:21.08 | stefan_schmidt | vmaster: Right. I remember you alreay has told me this. :) |
| 12:21.27 | stefan_schmidt | |dion|: Still work to do. But it makes progress. |
| 12:22.03 | stefan_schmidt | vmaster: I try to build a cable for your jtag now. It has a male plug instead of female as the tiny. :( |
| 12:22.34 | stefan_schmidt | vmaster: I have no fittig cable so I'll mod an old scsi cable. :) |
| 12:40.05 | vmaster | ah, yeah, i've thought about sending you a 20-pin female-female cable (~20cm), too, but that would have increased the cable length beyond something useable |
| 12:40.20 | jonwil | what will we be able to do with JTAG? |
| 12:40.46 | vmaster | you can debug the AP with it |
| 12:40.52 | stefan_schmidt | vmaster: I now build one with 7cm cable length. |
| 12:40.55 | vmaster | i.e. halt it, display/modify memory |
| 12:41.08 | vmaster | that should be fine |
| 12:41.13 | jonwil | ok, sounds good |
| 12:41.14 | stefan_schmidt | jonwil: And don't forget to flash it. |
| 12:41.17 | stefan_schmidt | heh |
| 12:41.34 | stefan_schmidt | Flashing another bootloader could be interesting for further hacking. |
| 12:41.54 | stefan_schmidt | harald has added usb firmware updates to u-boot. :) |
| 12:42.25 | |dion| | it's possible to replace bootloader? |
| 12:42.55 | stefan_schmidt | |dion|: If we have JTAG it shoudl be doable. |
| 12:43.04 | jonwil | I wonder if the BLOB code is the first thing that runs or if there is another layer below that |
| 12:43.45 | stefan_schmidt | jonwil: In A780/E680 it should the first code. In A1200/E2 there is another layer |
| 12:44.44 | jonwil | does anyone know how ARM architecture knows where in memory to start executing? |
| 12:44.53 | jonwil | I know how it works for x86 and for 68000 |
| 12:44.54 | jonwil | but not ARM |
| 12:46.02 | stefan_schmidt | vmaster: OK, attach the adpater to pc: right led gets orange. attach it to phone left got green. Should be fine? |
| 12:53.37 | jonwil | btw, there is evidence in A1200/E2 kernels that motorola has done something with itunes and EZX |
| 12:53.37 | stefan_schmidt | vmaster: hmm, do I need anything else as the config for the tiny? |
| 12:53.56 | stefan_schmidt | vmaster: Info: openocd.c:83 main(): Open On-Chip Debugger (XScale branch, 2006-11-22 14:00 CEST) |
| 12:53.56 | stefan_schmidt | Error: ft2232.c:1350 ft2232_init(): unable to open ftdi device: unable to claim usb device. Make sure ftdi_sio is unloaded! |
| 12:54.07 | stefan_schmidt | No ftdi_sio is loaded. |
| 12:54.10 | jonwil | perhaps they plan new itunes phone based on EZX |
| 12:54.44 | jonwil | E1 ROKR was a crappy phone though |
| 12:55.07 | stefan_schmidt | I guess my setup is not complete. It's another notebook as Shoragan used. |
| 12:57.41 | vmaster | jonwil: it starts at 0x0 |
| 12:58.02 | vmaster | or 0xffff0000 if high-vectors are enabled |
| 12:58.07 | vmaster | but usually 0x0 |
| 12:58.08 | jonwil | we should confirm that BLOB code lies at 0x0 on e680/a780 |
| 12:59.13 | stefan_schmidt | vmaster: Any idea about the error? |
| 12:59.38 | vmaster | stefan_schmidt: mhh, could you check the VID/PID (lsusb)? |
| 12:59.48 | |dion| | stefan_schmidt: do you run it as root? |
| 13:00.03 | stefan_schmidt | vmaster: Bus 002 Device 004: ID 0403:cff8 Future Technology Devices International, Ltd |
| 13:00.17 | stefan_schmidt | |dion|: Ah, only tried as user. |
| 13:00.47 | stefan_schmidt | ok, root works better. Sorry for the noise |
| 13:00.58 | vmaster | ah, thx |dion| |
| 13:00.59 | |dion| | libusb require root RW access to /dev/bus/usb/xxx/xxx |
| 13:01.13 | jonwil | so does this mean jtag can talk to phone now? |
| 13:01.20 | stefan_schmidt | ok, started and phone rebooted. |
| 13:01.57 | vmaster | i'm using udev rules to give rw to group "usb", which i'm a member of |
| 13:02.02 | stefan_schmidt | vmaster: How can I test further? Sorry, Shoragan did all these things before and he is not here right now. :( |
| 13:02.27 | vmaster | launch with "sudo ./openocd -f config.file -d -l <logfile>" |
| 13:02.53 | vmaster | check the log for Warnings or Errors, and send me the log if there are some |
| 13:03.11 | stefan_schmidt | ok |
| 13:04.15 | vmaster | the really bad ones are "Warning: jtag.c:1074 jtag_read_buffer(): value captured during scan didn't pass the requested check:" |
| 13:04.50 | stefan_schmidt | Error: jtag.c:1185 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x01ff |
| 13:04.55 | vmaster | oh, yeah, and that one |
| 13:05.06 | vmaster | Shoragan had to run it twice, iirc |
| 13:05.12 | vmaster | there's a problem with libftdi |
| 13:05.21 | stefan_schmidt | ok, I try again. |
| 13:05.44 | vmaster | ah, did you modify the .cfg for the protoype layout? |
| 13:05.54 | stefan_schmidt | looks better. |
| 13:06.07 | stefan_schmidt | No I don't changed. What to do? |
| 13:06.34 | vmaster | change ft2232_layout from jtagkey to jtagkey_prototype_v1 |
| 13:06.45 | stefan_schmidt | ok |
| 13:08.28 | stefan_schmidt | ok, I get this now: |
| 13:08.29 | stefan_schmidt | Warning: jtag.c:1074 jtag_read_buffer(): value captured during scan didn't pass the requested check: captured: 0x00 check_value: 0x02 check_mask: 0x07 |
| 13:08.36 | stefan_schmidt | Error: xscale.c:1595 xscale_deassert_reset(): couldn't stat() target/xscale/debug_handler.bin: No such file or directory |
| 13:09.21 | stefan_schmidt | hmm, need to check file not found |
| 13:09.56 | vmaster | the xscale code currently expects to be run from ./src/ |
| 13:10.22 | stefan_schmidt | sudo src/openocd -f ../../openocd.cfg -d -l ../../openocd-new-jtag.log |
| 13:10.29 | vmaster | cd src |
| 13:10.37 | stefan_schmidt | ah, sorry |
| 13:10.58 | vmaster | but the Warning means that communication still isn't reliable |
| 13:11.12 | vmaster | what's jtag_speed set to atm? |
| 13:11.32 | stefan_schmidt | wow, now i get _many debug messages. |
| 13:11.48 | stefan_schmidt | speed is 40 IIRC |
| 13:11.48 | vmaster | yeah, debug is noisy |
| 13:12.05 | vmaster | did the daemon exit? |
| 13:12.10 | stefan_schmidt | jtag_speed 40 |
| 13:12.20 | stefan_schmidt | no, he keeps alive |
| 13:12.35 | vmaster | ok, try telnetting to localhost 4444 |
| 13:12.40 | stefan_schmidt | First time exit, second time alive |
| 13:13.35 | stefan_schmidt | connection refused |
| 13:14.15 | vmaster | can you send me the log? |
| 13:14.23 | stefan_schmidt | no problem |
| 13:14.55 | stefan_schmidt | heh, i start a new one. This one is 66MB right now. :) |
| 13:15.59 | ade|desk | if the log is text, that'll bzip2 ~ 5mb |
| 13:16.01 | vmaster | it compresses rather well |
| 13:16.26 | stefan_schmidt | I hvae now one with 5,9 MB |
| 13:16.34 | stefan_schmidt | Will compress and mail |
| 13:16.53 | vmaster | i have a 140mb log that compresses to 900kb |
| 13:17.30 | stefan_schmidt | wow |
| 13:17.53 | stefan_schmidt | 20K now |
| 13:18.05 | vmaster | it spends most of the time in a loop, outputting the same debug information again and again |
| 13:18.14 | vmaster | it's the little differences when something went wrong that matter |
| 13:18.38 | ade|desk | dd if=/dev/zero of=some.log count=100000000000000000000000000000000000 then bzip2 ;) |
| 13:19.39 | stefan_schmidt | heh |
| 13:20.34 | stefan_schmidt | vmaster: log sent |
| 13:22.48 | stefan_schmidt | oh, time for my next course. |
| 13:22.58 | stefan_schmidt | I'll be back on this in the evening. |
| 13:23.00 | stefan_schmidt | cu all |
| 13:23.55 | vmaster | i wont be back before 9 or 10 pm either |
| 13:23.56 | vmaster | ciao |
| 13:24.09 | stefan_schmidt | vmaster: np. Thanks for your help. |
| 13:49.01 | nh_work | wow, great job guys. :D |
| 13:49.08 | nh_work | Sounds like things are really moving along! |
| 14:17.15 | *** join/#openezx agd5f (n=DeucherA@65.242.105.130) |
| 14:43.10 | *** join/#openezx proberts_ (n=proberts@cpe-76-167-78-52.socal.res.rr.com) |
| 15:05.08 | *** join/#openezx leoncamel (n=leoncame@219.142.137.2) |
| 15:06.04 | *** join/#openezx jaebird (n=jae@53-89.netblk-69-41-89.coolaccess.net) |
| 15:22.31 | *** join/#openezx LoneStar (n=xinzhen@218.81.34.26) |
| 16:00.23 | proberts_ | nh_work: I tried using cap_capset_set() to change the task secuirty settings for a running process. I was able to do it and changed the telnet's bash proc to {0,0,0}, which is what the init process has, and also tried {-247,0,-1} which is what a couple other high-level processes have. It didn't seem to have any effect on subprocesses even though inherrit was 0 or -1... I'm going to play with it a bit more to see if I can create |
| 16:00.23 | proberts_ | <PROTECTED> |
| 16:01.01 | proberts_ | m not sure sure what good it will do if child procs don't pick up the same attributes. |
| 16:01.26 | nh_work | proberts: ah... |
| 16:01.45 | proberts_ | (i.e. I tried 'touch /sbin/test' and it still failed... possibly because touch didn't pick up the 0,0,0) |
| 16:02.10 | nh_work | proberts: couldn't we promote a program that waits a while and then modifies the acpolicy.cfg file? |
| 16:02.56 | proberts_ | Ahhhh! Good thinking! I hadn't considered trying to change the policy file, just get a shell outside the policy. |
| 16:03.46 | nh_work | proberts: I think if the file is not read correctly ac_policy_init is never set. |
| 16:03.55 | proberts_ | I was also successful reading kernel .data from a module with the ksyms addresses. |
| 16:04.10 | nh_work | That should theoretically disable motoac entirely. |
| 16:04.33 | proberts_ | nh_work: I can try killing the magic number. |
| 16:05.02 | nh_work | proberts_: ok, cool. Sounds like you made some good progress! :D |
| 16:06.16 | proberts_ | Yeah :P Altough not what I'm actually supposed to be doing ... but it's more fun. |
| 16:07.24 | nh_work | proberts_: lol, I know what you mean. :) |
| 16:07.40 | jonwil | what is this about policy? |
| 16:07.43 | nh_work | proberts_: btw, how goes your E2 software endevor? |
| 16:08.58 | proberts_ | well :P What I should be doing is figuring out how to get keypad input (/dev/keypad0 only allows one open session), so I have to do some ezx/qt RE. I've got gfx, sound, and backlight working. |
| 16:10.42 | nh_work | proberts_: that's great though. When you figure out how to get keypad input that means we can create a phone dialer once we get our own kernels booting. :D |
| 16:11.43 | nh_work | assuming your company is ok with you talking about the method. :) |
| 16:12.18 | proberts_ | Oh - I also started taking apart the libezxtapi.so to see how user-space apps communicate with the BP. There's some calls I may try to create headers for (like dialing and answering the phone, and recording audio) |
| 16:12.37 | proberts_ | (btw- it uses 2 UDP sockets) |
| 16:12.39 | jonwil | sounds nice |
| 16:12.41 | nh_work | proberts_: wow |
| 16:12.51 | nh_work | proberts_: man I'm glad your around. :) |
| 16:12.59 | nh_work | s/your/you're |
| 16:13.03 | proberts_ | thanks :P |
| 16:13.07 | jonwil | is libezxtapi.so what listens on tapisock? |
| 16:13.17 | jonwil | or is it what talks to tapisock? |
| 16:13.17 | Shoragan | proberts, perhaps you could exec touch /sbin/test |
| 16:14.46 | proberts_ | jonwil: I think 'tapiserv' is the daemon that listens. The lib opens the sockets and sends commands from the ezx/qt apps. |
| 16:15.01 | jonwil | sounds about right |
| 16:16.48 | proberts_ | Shoragan: I think that's the next thing to try. |
| 16:17.17 | jonwil | IIRC there is an example of how to send something to tapisock and dial a number somewhere |
| 16:18.01 | proberts_ | brb |
| 16:20.09 | jonwil | At this rate you guys will give the community an xmas present. The abillity to make and recieve calls on an a780/e680 using only selfcompiled open source programs on the AP side :) |
| 16:25.49 | nh_work | jonwil: tough to know. He says they are working on things from the inside of motorola, but that big corperations move slowly. |
| 16:25.54 | nh_work | I'm not sure if he'd be happy or not. |
| 16:26.44 | jonwil | basicly, as long as openezx does not violate any motorola copyright, do anything that could cause the EZX phone to no longer be legally certified (fcc etc) or otherwise harm motorola, they probobly dont care |
| 16:27.22 | nh_work | jonwil: Lets hope. :) |
| 16:27.23 | jonwil | They can say that using anything other than official motorola software voids the warrenty |
| 16:27.45 | nh_work | jonwil: I do think it's interesting that they've seemingly unnecessarily locked down the A1200 and E2. |
| 16:27.45 | jonwil | and refuse to service ezx phones with modified software |
| 16:28.09 | nh_work | jonwil: they already do that if you flash a different motorola firmware. |
| 16:28.15 | jonwil | yes :) |
| 16:30.41 | jonwil | Other than china what other countries can you currently buy ezx phones in? |
| 16:30.46 | jonwil | I know singapore is one |
| 16:30.54 | jonwil | but do any western carriers sell ezx? |
| 16:31.39 | nh_work | jonwil: Maybe Canada and Europe for some models. |
| 16:31.50 | nh_work | jonwil: you can get the E2 in HK too. |
| 16:33.07 | nh_work | And Taiwan |
| 16:33.35 | jonwil | My worry is that some carrier who sells EZX phone will complain about openness of openezx and other open efforts |
| 16:33.50 | jonwil | and will ask motorola to shut down this work because of <insert bogus reason here> |
| 16:34.03 | nh_work | jonwil: they might. There were rumors of the E2 coming to cingular, but who knows. |
| 16:34.14 | jonwil | although naturally the real reason probobly has something to do with bits of paper with presidents on them :) |
| 16:34.52 | nh_work | jonwil: If openmoko takes off it might not matter... |
| 16:35.12 | jonwil | yes |
| 16:35.20 | nh_work | jonwil: The worst carriers regarding openness are CDMA in the states anyway. |
| 16:35.51 | nh_work | verizon and sprint are both really controlling, while cingular and tmobile seem to be somewhat reasonable. |
| 16:36.08 | nh_work | tombile will even unlock your phone for you if you've been a customer with them for a while. |
| 16:38.34 | jonwil | the big problem in america is that the CDMA carriers have so much coverage in so many places (thanks to exclusive licence aggreements and stuff) that the GSM carriers cant match it |
| 16:38.47 | jonwil | and so for too many people, CDMA is the only viable option |
| 16:39.25 | jonwil | Bring on UMTS 3G I say |
| 16:39.45 | jonwil | or better yet, some kind of WiMax type setup |
| 16:39.56 | jonwil | that completly replaces the dinosaur telcos altogether |
| 16:40.18 | nh_work | jonwil: it's not so bad. According to wikipedia Cingular is actually the largest carrier. |
| 16:40.42 | jonwil | thankfully australia is nowhere near as bad |
| 16:40.45 | nh_work | jonwil: yeah, I'm sure they are deathly afraid of that. |
| 16:40.49 | jonwil | we actually have real competition |
| 16:41.05 | jonwil | with no less than 4 companies offering service |
| 16:41.15 | proberts_ | jonwil: Cingular has plans to release the E2 for $49 on contract. Supposedly Verizon is asking about a CDMA version. |
| 16:41.42 | nh_work | proberts_: $49? wow |
| 16:42.06 | proberts_ | nobody heard that from me though :P |
| 16:42.32 | nh_work | proberts_: I wonder if we should hold off making any announcements until after they've shipped. :) |
| 16:42.52 | jonwil | how do you know this, do you work for a phone company or something? :P |
| 16:43.01 | proberts_ | nh_work: Might be a good idea. |
| 16:43.25 | proberts_ | jonwil: I work for a (small) third-party mobile software developer. |
| 16:44.42 | proberts_ | jonwil: And I made friends with a guy in marketing at our publisher/distributor who likes to show off how "industry" he is by telling people stuff he probably shouldn't |
| 16:45.07 | nh_work | proberts:_: very nice. :) |
| 16:45.32 | proberts_ | nh_work: I'm guessing the 38P formware will be what's on the Cingular phone... but that's just a guess... not even an educated guess. |
| 16:45.42 | nh_work | proberts_: any ideas about rough dates? I had heard Q1 for cingular, but I haven't been keeping up. |
| 16:46.02 | jonwil | I would imagine that the cingular E2 would be locked to cingular |
| 16:46.12 | jonwil | I wonder how subsidy lock works on EZX |
| 16:46.18 | jonwil | and whether its all done by the AP |
| 16:46.23 | jonwil | or if the BP does the secure part |
| 16:46.25 | proberts_ | It looks like subsidy lock is in the BP. |
| 16:46.43 | jonwil | yeah, I figured that the AP would just send it messages such as subsidy password |
| 16:46.44 | proberts_ | There's a function in libexztapi to get the subsidy lock status via tapiserv |
| 16:46.50 | nh_work | proberts_: I've read that it's in the BP somewhere. |
| 16:47.51 | jonwil | There is evidence that moto have done something related to itunes on EZX phone |
| 16:47.58 | jonwil | evidence in E2 ROKR kernel source |
| 16:48.18 | jonwil | maybe they are going to do E2 ROKR with itunes |
| 16:48.25 | jonwil | Alkthough e1 sucked |
| 16:48.29 | jonwil | so who knows |
| 16:49.17 | nh_work | jonwil: not much on the 33P phones. Who knows about the US market. |
| 16:49.17 | proberts_ | The "TAPI_ACCE_*" functions (some interesting ones: GetSubsidyStatus, GetFactorSerial, MasterReset, MasterClear, SetFrMode, GetImei, GetImsi, getBpVersion) |
| 16:49.17 | proberts_ | s/setFrMode/setRfMode |
| 16:49.19 | proberts_ | s/setFrMode/setRfMode/ |
| 16:49.33 | proberts_ | whoops.. well- whatever.. :P |
| 16:49.43 | nh_work | proberts_: oh! that reminds me. Be very careful playing with those. If you flash to a locked firmware, apparently the phone locks. If you flash to an unlocked firmware, the phone does not unlock. |
| 16:50.02 | nh_work | That was what a couple of people were saying in some of the forums. |
| 16:50.12 | jonwil | I have heard that that is true on all motos |
| 16:50.16 | proberts_ | locked==subsidy locked? |
| 16:50.23 | jonwil | yes subsidy locked |
| 16:50.38 | jonwil | if the phone is unlocked, flashing a locked firmware will lock it |
| 16:50.56 | jonwil | if its already locked, you should only flash matching locked f/w on it as far as I know |
| 16:51.13 | proberts_ | cool... thanks. |
| 16:51.13 | jonwil | I wouldnt try flashing anything onto my L6 |
| 16:51.46 | proberts_ | I can't flash mine for a while anyway. I'm still trying to find official 33P file I can use to restore just in case. |
| 16:52.30 | nh_work | proberts: I doubt we'll get one. At some point we might have to bite the bullet. Maybe once we can get a $50 test phone. ;) |
| 16:52.49 | proberts_ | Yeah - but it'll be $50 with a 1 or 2 year contract. |
| 16:53.03 | nh_work | proberts_: I might be willing to do it. We'll see. |
| 16:53.21 | nh_work | I'm reasonably happy with t-mobile right now though. |
| 16:53.26 | proberts_ | The same guy who told me about Cingular's E2 said there's an EZX RAZR coming out as well |
| 16:53.41 | proberts_ | Same here... |
| 16:53.50 | jonwil | did we ever find out what EZX stands for? |
| 16:53.52 | nh_work | proberts_: I've heard rumors about it. I think it's a bit chunkier than the current ones. |
| 16:54.24 | jonwil | perhaps a910 is what rumors point to |
| 16:54.30 | proberts_ | nh_work: If it still uses 2 procs, it probably would be. |
| 16:55.39 | proberts_ | Anyone know what Mhz the BP/Neptune procs run at? |
| 16:57.04 | nh_work | proberts: might be in the wiki |
| 16:58.28 | proberts_ | I didn't see anything. I thought the one in the P2K razr runs at ~100Mhz. |
| 17:00.18 | jonwil | I cant remember where I saw it but I think I saw something about a 26mhz crystal being used with neptune on some moto phone |
| 17:00.23 | jonwil | No idea what phone |
| 17:00.26 | jonwil | or where I saw it |
| 17:00.41 | jonwil | There is probobly also multiplier inside neptune to multiply that number I would guess |
| 17:02.23 | proberts_ | I know the iDEN motorola phones run really low Mhz. We figure one of our apps needs about at least a 75Mhz CPU, and when we mentioned that to the Motorola iDEN people they all laughed. :P |
| 17:03.00 | jonwil | IDEN phones are ancient |
| 17:03.02 | jonwil | aparently |
| 17:03.18 | proberts_ | Boost is selling them like hotcakes in the U.S. |
| 17:03.38 | jonwil | btw, this link |
| 17:03.39 | proberts_ | ....but only because that's the only bandwidth Sprint would give them. |
| 17:03.39 | jonwil | http://www.yamaha.co.jp/english/product/lsi/us/products/maudio.html |
| 17:03.59 | jonwil | I think the YMU762C-QZ is the FM chip in e680 |
| 17:05.18 | jonwil | assuming thats true, now we know what said chip can do :P |
| 17:06.01 | proberts_ | Any of you guys happen to know a kernelspace routine to check if a specific physical memory page is free or in use? |
| 17:11.58 | proberts_ | nh_work: BTW- I found there is a selinux routine that intercepts mmap |
| 17:12.48 | nh_work | proberts_: aha! what's the name? |
| 17:14.00 | proberts_ | ac_file_mmap / selinux_file_mmap |
| 17:16.50 | *** join/#openezx letoto (n=paul@tla.xelerance.com) |
| 17:17.08 | letoto | heard some good news before my isp kicked the bucket again? |
| 17:17.18 | jonwil | keep up the good work guys |
| 17:17.45 | nh_work | letoto: lots of good news. |
| 17:17.46 | jonwil | later |
| 17:17.46 | proberts_ | later |
| 17:17.57 | nh_work | letoto: working 2.4 kernel that stays up more than 1 minute, more potential ways around motoAC on A1200 and E2s. |
| 17:18.43 | nh_work | letoto: Stefan was able to make a phone call on a custom 2.4 kernel |
| 17:20.04 | nh_work | proberts_: hrm... ac_file_mmap just returns 0 doesn't it? It looks like they just implemented it to meet the security spec. |
| 17:23.15 | proberts_ | yeah - looks that way... athough I'm still not sure why I couldn't mmap kernel mem... maybe that's something built into the Linux kernel... I've only played with mmaping /dev/kmem on Irix. |
| 17:23.44 | letoto | nh_work: cool. so was there magic that needs to be send every minute? |
| 17:23.51 | letoto | or just a wrong way of doing things? |
| 17:24.51 | nh_work | letoto: I think they are trying to figure that out. It worked once the mux_cli was compiled in the kernel afaik. |
| 17:25.22 | proberts_ | nh_work: Worked compiled into, but not as a loaded module? |
| 17:25.30 | nh_work | I think that's what they said |
| 17:25.37 | proberts_ | weird. |
| 17:27.38 | nh_work | <alphaone> Well the trick was compiling the mux_cli driver into the kernel. |
| 17:27.38 | nh_work | <letoto> didnt you compile that in before? wasnt it neede dto talk to the BP ? |
| 17:27.38 | nh_work | <alphaone> It seems that somehow our own kernel couldn't load the mux_cli module |
| 17:27.39 | nh_work | <letoto> and the issue was? |
| 17:27.39 | nh_work | <alphaone> That's next on the todo list. But first I need some sleep. |
| 17:27.39 | nh_work | <alphaone> If I get too tired I do stupid things :-) |
| 17:27.41 | nh_work | <letoto> get some sleep :) |
| 17:27.43 | nh_work | <alphaone> It's either some keepalive timer in the mux_cli or Userspace talking to the BP. Figureing that out should be easy. We have a completely working kernel now. |
| 17:30.54 | proberts_ | Hmmm... if it's userspace, it might be in the tapiserv daemon. |
| 17:38.43 | proberts_ | nh_work: Just tried running an app that sets its own task policy and tries to create a file in /sbin... no luck. (It changes it's policy values successfully, but fopen fails) |
| 17:39.08 | nh_work | proberts: doh |
| 17:39.23 | proberts_ | gotta leave for work.. later |
| 17:54.10 | *** join/#openezx nevarrie_ (n=jgrant@CPE-72-128-35-75.kc.res.rr.com) |
| 18:08.08 | stefan_schmidt | re |
| 18:18.56 | *** join/#openezx vmaster_ (i=vmaster@p549B557F.dip.t-dialin.net) |
| 18:20.50 | stefan_schmidt | vmaster_: I'm back. It's up to you when we will start again. |
| 18:41.28 | proberts | rehi |
| 18:42.37 | proberts | stefan_schmidt: (seeing as you're the kernel guru) Is there an easy way for a module to check if a page of memory is in use or free? (something nice like page_is_free(phy_addr) )? |
| 18:44.20 | stefan_schmidt | proberts: Sorry. No kernel guru here right now. :) I have no idea. :( |
| 18:45.05 | nh_work | proberts: I'm wondering what the heck is going on (ie why your program didn't work) |
| 18:47.27 | proberts | nh_work: I don't know either.. the only thing I can think of is we don't have the "real" motoac, OR, somewhere they write a "release policy" patch over the existing policy routine pointer struct. |
| 18:49.05 | proberts | nh_work: If I can access what would be the .bss memory for the selinux .o file that's compiled into the kernel, I can overwrite both the active policy and any of the function pointers. |
| 18:49.05 | nh_work | proberts: I guess that's the way to go for now. |
| 18:49.27 | nh_work | proberts: I might try emailing motorola and asking if the kernel source they provide is exactly what is released on the phone. |
| 18:49.43 | proberts | nh_work: I've found what would be the .data memory, but need to figure out a way to find pages that are in-use (or free)? |
| 18:50.45 | proberts | hmmm... I guess I could also try locating their master permissions routine and noop it as well. |
| 18:51.50 | proberts | nh_work: I may have figured out why cap_setcap_set didn't work as I thought it would. It may only control exec (tsec) policy, not fs (dsec) policy.. |
| 18:52.21 | nh_work | proberts: ah |
| 18:53.28 | nh_work | proberts: lol |
| 18:54.11 | nh_work | ok, so the next question: are there any functions that control dsec policy? |
| 18:54.50 | nh_work | hrm.. may_create() checks if a task can create a file |
| 18:55.22 | proberts | the one that the first module I sent to you patches *appears* to, but I guess in reality it doesn't. If I can find the security vector table in memory I can see if that routine is actually being used. |
| 18:56.19 | proberts | Yeah- that's where I found it. The filesystem stuff looks like it's coming from the dsec, and the stuff I was modding with cap_setcap_set is in the tsec. (I think that was it... don't have any ezx stuff installed here at work) |
| 18:56.54 | nh_work | proberts: there's a lot of stuff in ac_hooks |
| 18:57.55 | *** join/#openezx florian (n=fuchs@84-245-183-76.hbg.bpool.celox.de) |
| 18:58.19 | florian | re |
| 18:58.24 | proberts | florian: hi |
| 18:58.34 | proberts | florian: Do you know much about kernel memory management? |
| 18:58.34 | stefan_schmidt | wb florian |
| 18:59.36 | nh_work | there's a lot of stuff like "task_free_security" "task_alloc_security" "inode_alloc_security" "inode_free_security" "file_alloc_security" "file_free_security" |
| 18:59.56 | nh_work | superblock too. |
| 19:00.23 | florian | proberts: not really, but i remember there was a very good document describing this. but its quite complex |
| 19:00.33 | proberts | All (or most) those routines in ac_hooks.c get put into the security vector table (at the end of the file) |
| 19:01.22 | proberts | florian: I've been googling like crazy :P |
| 19:02.08 | proberts | florian: I can find lots of stuff on allocating free pages, but nothing that lets me ask the mm if a page is already allocated or if it is free (just "give me a free page') |
| 19:02.34 | florian | proberts: iirc that was some stuff done at an Irish university |
| 19:06.12 | proberts | ...I better get some real work done :P |
| 19:07.44 | nh_work | hehe |
| 19:08.10 | nh_work | proberts: I've got some friends who may be able to answer kernel questions. |
| 19:08.15 | nh_work | proberts: waiting to hear back from them. |
| 19:08.18 | proberts | cool - thanks |
| 19:11.33 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 19:12.13 | stefan_schmidt | wb |dion| |
| 19:18.36 | |dion| | stefan_schmidt: |
| 19:18.37 | |dion| | hiall |
| 19:23.31 | ao2 | stefan_schmidt, a question, when you booted your custom 2.4 kernel, did you success to load another module compiled for the stock kernel? I was waonderig why the original mux_cli didn't load with custom kernel, was is a timing issue or a versioning problem? |
| 19:38.40 | stefan_schmidt | ao2: Good question. I did not investigate this further. Will do on sunday. |
| 20:06.14 | *** join/#openezx kenws (n=ken@dslb-088-064-151-081.pools.arcor-ip.net) |
| 20:47.11 | stefan_schmidt | vmaster_: Still the problem with: Warning: jtag.c:1074 jtag_read_buffer(): value captured during scan didn't pass the requested check: captured: 0x00 check_value: 0x02 check_mask: 0x07 |
| 20:47.27 | vmaster_ | hey stefan_schmidt |
| 20:47.30 | vmaster_ | just got back |
| 20:47.33 | stefan_schmidt | heh |
| 20:47.51 | stefan_schmidt | Is this related to: jtag_device 7 0x01 0x7f 0x7e |
| 20:47.51 | stefan_schmidt | ? |
| 20:47.57 | vmaster | i'll look through the log you've sent me |
| 20:48.02 | stefan_schmidt | ok |
| 20:48.33 | vmaster | it would be nice if you could send me another log, so i can see if the warnings occur always at the same time |
| 20:49.53 | stefan_schmidt | np |
| 20:50.08 | stefan_schmidt | Something special, or just the same again? |
| 20:50.30 | vmaster | the same again |
| 20:50.37 | stefan_schmidt | ok |
| 20:51.00 | vmaster | just make sure it didn't exit after the validate_chain |
| 20:53.35 | stefan_schmidt | ok, it's 3,3 MB. I zip and sent asap |
| 20:56.42 | stefan_schmidt | vmaster: done |
| 20:57.07 | stefan_schmidt | vmaster: Do you think it's a hardware problem or something in openocd? |
| 20:57.26 | stefan_schmidt | vmaster: How good is the xscale support working on other devices? |
| 21:08.59 | vmaster | stefan_schmidt: i haven't received reports other than yours and g2s |
| 21:09.08 | vmaster | stefan_schmidt: it's working fine with a PXA250 here |
| 21:09.53 | stefan_schmidt | vmaster: ok, g2 has IPX, right? So we have the first test with pxa270. |
| 21:11.36 | vmaster | stefan_schmidt: yeah, IXP42x |
| 21:12.21 | vmaster | stefan_schmidt: but g2 only has a gateworks g16012 that always scans at ~8mhz, which is close to the maximum specified for the ixp |
| 21:12.40 | vmaster | stefan_schmidt: the failed checks in the second log are exactly at the same point |
| 21:12.58 | vmaster | stefan_schmidt: there might be a bug or incompatibility with PXA270, i'll check that |
| 21:13.03 | stefan_schmidt | vmaster: OK, at least reproduceable |
| 21:13.14 | vmaster | stefan_schmidt: yeah, it's a lot better than with the tiny |
| 21:13.31 | stefan_schmidt | vmaster: Good to know. |
| 21:14.05 | stefan_schmidt | vmaster: Means we _had_ voltage problems with tiny, but also some other. |
| 21:14.27 | vmaster | stefan_schmidt: right |
| 21:18.10 | vmaster | stefan_schmidt: i'll recompile here with libftdi, to make sure it's not a problem with that (i'm using ftd2xx most of the time) |
| 21:18.56 | stefan_schmidt | vmaster: I can try this one, too. But Shoragan reported me that he doesn't get it working. |
| 21:20.21 | vmaster | stefan_schmidt: ok, it's not libftdi, i could connect without problems |
| 21:20.42 | stefan_schmidt | vmaster: hmm |
| 21:21.00 | vmaster | stefan_schmidt: i'll have to go through the log step by step, this might take a while |
| 21:22.55 | stefan_schmidt | vmaster: Take your time. |
| 21:50.42 | vmaster | hmm, stefan_schmidt, do you think it's possible that there are more devices in the chain? |
| 21:51.22 | vmaster | jtag devices can be daisy chained, connecting one device's TDO to the next one's TDI |
| 21:51.31 | stefan_schmidt | vmaster: hmm, I don't know much about JTAG chaining. |
| 21:52.01 | stefan_schmidt | vmaster: You can see what chips we have in the device here: http://wiki.openezx.org/E680_Board |
| 21:52.39 | stefan_schmidt | vmaster: It seems the Baseband processor has an own JTAG, so no chaining with it. |
| 21:52.55 | stefan_schmidt | vmaster: Perhaps the m-systems DiscOnShip? |
| 21:53.03 | stefan_schmidt | Chip even |
| 21:57.26 | vmaster | doesn't seem to have a JTAG port |
| 21:59.47 | stefan_schmidt | vmaster: I'm afraid that the other chips are GSM/RF related or even should have no JTAG |
| 22:46.49 | *** join/#openezx jonwil (n=jonwil@220-245-202-116-wa-pppoe.tpgi.com.au) |
| 22:47.45 | jonwil | hi |
| 23:00.20 | *** part/#openezx agd5f (n=DeucherA@65.242.105.130) |
| 23:11.29 | *** join/#openezx lkcl (n=lkcl@535411CB.cable.casema.nl) |
| 23:12.46 | vmaster | stefan_schmidt: could you try adding "jtag_ntrst_delay 500" and "jtag_nsrst_delay 500" to the .cfg? |
| 23:13.05 | stefan_schmidt | vmaster: Of course. |
| 23:13.15 | vmaster | the problems only occur right after the openocd starts up, maybe the device needs more time to recover from the resets |
| 23:14.53 | stefan_schmidt | vmaster: jtag_speed should stay on 40? |
| 23:15.58 | vmaster | you shouldn't see problems with 2 or 3 |
| 23:15.59 | vmaster | at least if the jtag lines are ok on both your cable and one the pcb |
| 23:16.04 | stefan_schmidt | vmaster: OK, i set jtag_speed to 3 |
| 23:17.37 | stefan_schmidt | vmaster: No warnings until now. |
| 23:17.54 | vmaster | are you able to connect via telnet? |
| 23:17.58 | stefan_schmidt | vmaster: But I can't connect to 127.0.0.1:4444 |
| 23:18.01 | vmaster | hmm... |
| 23:18.06 | vmaster | can you send me a log again? |
| 23:19.01 | stefan_schmidt | sure |
| 23:19.19 | vmaster | but it's great that you're not seeing Warnings anymore |
| 23:20.45 | stefan_schmidt | vmaster: I just found them in the log. Sorry. |
| 23:23.19 | stefan_schmidt | vmaster: Mail is gone. |
| 23:24.01 | vmaster | stefan_schmidt: thx |
| 23:26.53 | vmaster | stefan_schmidt: hmm, different failures this time, but that doesn't mean anything, as the first one is still the same |
| 23:27.56 | stefan_schmidt | vmaster: ok |
| 23:29.24 | stefan_schmidt | vmaster: JFYI: I will be awake the next half hour. And can't test before friday next time. Hard day tomorrow. Need some sleep for it. :) |
| 23:30.54 | vmaster | stefan_schmidt: heh, yeah, i think i have enough logs now |
| 23:33.22 | stefan_schmidt | vmaster: If you want more just ask. :) |
| 23:36.27 | jonwil | this all sounds good |
| 23:37.35 | stefan_schmidt | jonwil: It _is_ good when I can do the first time ATD with the 2.6. :) |
| 23:38.07 | jonwil | what so you actually dialed another phone with 2.6? |
| 23:39.49 | vmaster | stefan_schmidt: i'm somewhat exhausted today, i'll work on this tomorrow |
| 23:39.49 | *** join/#openezx florian (n=fuchs@84-245-183-76.hbg.bpool.celox.de) |
| 23:39.54 | vmaster | stefan_schmidt: night everyone |
| 23:39.56 | stefan_schmidt | jonwil: No, I _like_ to do this. |
| 23:39.59 | jonwil | ok |
| 23:40.01 | stefan_schmidt | vmaster: night |
| 23:40.05 | stefan_schmidt | wb florian |
| 23:40.17 | jonwil | Hopefully building mux |
| 23:40.23 | jonwil | mux_cli right into kernel will help |
| 23:40.26 | florian | that's better |
| 23:41.32 | stefan_schmidt | jonwil: Yeah, I make some notes what to test. But Next time slot I have for better testing is sunday. |
| 23:42.16 | jonwil | if you can do as much this sunday as you did last sunday, great things will happen |
| 23:42.42 | stefan_schmidt | jonwil: We hope so. :) |
| 23:42.56 | stefan_schmidt | florian: More power is always good. :) |
| 23:44.01 | alphaone | re |
| 23:44.08 | stefan_schmidt | wb alphaone |
| 23:44.20 | florian | stefan_schmidt: right, now i only need to buy a fast machine for compiling |
| 23:44.23 | alphaone | jonwil: This sunday we can finally compare the code |
| 23:49.23 | stefan_schmidt | alphaone forces me to test the working 2.4 with wrong rootfs now. That will tell us if userspace is invoked or not. Hopefully. |
| 23:51.43 | alphaone | Don't type - flash! |
| 23:51.46 | alphaone | ;-) |
| 23:52.57 | stefan_schmidt | On my way |
| 23:55.50 | stefan_schmidt | ~lart alphaone for forcing stefan_schmidt doing things for him when he is tired. |
| 23:55.58 | stefan_schmidt | heh |
| 23:57.26 | alphaone | ~lart stefan_schmidt since pain is good fatigue treatment |
| 23:57.39 | stefan_schmidt | lol |
| 23:58.23 | alphaone | Hmm, that was not what I had in mind but okay |
