| 00:00.05 | BabelO | where did you think spi tsc2046 port is mapped ? |
| 00:00.14 | cr2_ | 0xfffc1000 |
| 00:00.20 | cr2_ | phys |
| 00:00.33 | BabelO | yes, i think i try it too yesturday |
| 00:00.37 | cr2_ | i don't think, it's in bl and wince touch.dll |
| 00:00.40 | BabelO | checking again quicly ;) |
| 00:00.41 | cr2_ | also on herald. |
| 00:03.27 | BabelO | nothing, just the ts irq, what filter i need to use here ? 0xfff ? |
| 00:06.00 | rakeem | Are you guys running the CE ROM through IDA Pro? |
| 00:06.18 | BabelO | rakeem: just IDA demo version ;) |
| 00:06.58 | rakeem | Right, but that's what you refer to often to see what calls are made, beyond what HaRet reveals? |
| 00:07.47 | cr2_ | rakeem: there is also a python disassemble script by pH5. sometimes it's better than ida. and faster anyway. |
| 00:07.48 | mazzanet | cr2_: http://pastebin.ca/754431 |
| 00:08.43 | rakeem | This eats ARM binaries and excretes assembler? |
| 00:09.10 | cr2_ | mazzanet: a0dfea80 looks like a ram address. strange. |
| 00:09.24 | BabelO | rakeem: yes |
| 00:09.39 | cr2_ | rakeem: yes, it uses objdump as a backend, so it can do wince coff and raw binary. |
| 00:10.06 | mazzanet | cr2_: probably nothing, but is it normal to need to softreset twice to boot back into wince? |
| 00:10.09 | cr2_ | mazzanet: you have 240x320 LCD ? |
| 00:10.32 | rakeem | Ooer... You're losing me again... I'll keep earwigging on the channel and reading from the web of lies... Cheers... |
| 00:10.42 | mazzanet | yep |
| 00:10.59 | cr2_ | mazzanet: 64MB RAM ? |
| 00:11.21 | mazzanet | yep |
| 00:13.01 | cr2_ | which haret version is it ? |
| 00:13.08 | mazzanet | 0.5 |
| 00:13.32 | cr2_ | 83 gpios is for pxa26x |
| 00:13.39 | cr2_ | pxa27x has 120 |
| 00:13.55 | mazzanet | `vfh VRAM 240*10 0x0099` does indeed make the top 10 pixels blue too |
| 00:13.59 | mazzanet | hmm curious |
| 00:13.59 | BabelO | good night, it is late here even with the day light saving ;) |
| 00:14.45 | rakeem | I don't mean this to be taken the wrong way, but I'm would it be fair to say that cracking software (w4r3z style;) is somewhat childish beside this stuff? |
| 00:15.58 | Kevin2 | cr2_: "cvs up" and run new command "alloctest" |
| 00:16.00 | cr2_ | rakeem: unlike cracking it's fully legal, and makes much more fun. |
| 00:16.16 | mazzanet | cr2_: i just did some dumping |
| 00:16.25 | cr2_ | ImCoKeMaN: are you still here ? |
| 00:16.27 | mazzanet | that address that it tried to jump to |
| 00:16.31 | mazzanet | <PROTECTED> |
| 00:16.35 | ImCoKeMaN | just got back |
| 00:16.36 | mazzanet | it's in vram |
| 00:17.01 | mazzanet | HaRET(10)# vfh vram 240*20 0x0044 |
| 00:17.01 | mazzanet | HaRET(11)# pdump 0xa0dfea80 255 |
| 00:17.01 | mazzanet | a0dfea80 | 00440044 00440044 00440044 00440044 | D.D.D.D.D.D.D.D. |
| 00:17.02 | mazzanet | a0dfea90 | 00440044 00440044 00440044 00440044 | D.D.D.D.D.D.D.D. |
| 00:17.03 | cr2_ | ImCoKeMaN: can you run the latest CVS haret by Kevin2 ? and this alloctest command ? |
| 00:17.29 | cr2_ | mazzanet: ok, but it's strange that PXA SRAM is not used for the FB. |
| 00:17.43 | ImCoKeMaN | can ya link me =) |
| 00:18.02 | Kevin2 | cr2_ / ImCoKeMaN: http://www.handhelds.org/~koconnor/haret/haret-20071029.exe |
| 00:19.30 | cr2_ | Kevin2: i'll fix and extend the ATIDBG command. it can provide a lot of useful data. |
| 00:21.29 | ImCoKeMaN | ok i loaded it, what you want me to run? |
| 00:21.39 | ImCoKeMaN | or you want me to wait til you add your feature? |
| 00:22.07 | cr2_ | ImCoKeMaN: run 'alloctest' |
| 00:23.06 | ImCoKeMaN | HaRET(1)# alloctest |
| 00:23.06 | ImCoKeMaN | line 1: Expected <count> |
| 00:23.26 | ImCoKeMaN | also for the command kevin wanted me to run: HaRET(2)# set mmutrace p2v(0xc0000000) 1024*1024 |
| 00:23.27 | ImCoKeMaN | line 2: MMUTRACE(1 args) expected |
| 00:23.27 | ImCoKeMaN | line 2: Expected index for var MMUTRACE |
| 00:24.05 | cr2_ | ImCoKeMaN: alloctest 4096 |
| 00:24.34 | cr2_ | not 'set mmutrace', but 'addlist mmutrace' |
| 00:24.35 | ImCoKeMaN | about 4096 lines |
| 00:24.38 | Kevin2 | ImCoKeMaN: Sorry, it is "addlist mmutrace p2v(0xc0000000) 1024*1024" and then "wi 1". |
| 00:24.57 | Kevin2 | ImCoKeMaN: Run cr2_'s tests first. :-) |
| 00:24.57 | cr2_ | ImCoKeMaN: can you pastebin the 4096 lines ? |
| 00:25.26 | ImCoKeMaN | never used that, but i suppose i could |
| 00:25.28 | ImCoKeMaN | irq:8001ab88@A02D43F8=809e00ec abort:8000104c@A02D43F0=809e0110 prefetch:8001a6f |
| 00:25.28 | ImCoKeMaN | 8@A02D43EC=809e013c data=809af000 sizes=c:000011ac,t:000351ac |
| 00:25.29 | ImCoKeMaN | Beginning memory tracing. |
| 00:25.29 | ImCoKeMaN | 00: Mapping 94e00000 accesses to e1100000 (tbl c0002402) |
| 00:25.29 | ImCoKeMaN | Replacing windows exception handlers... |
| 00:25.29 | ImCoKeMaN | Finished installing exception handlers. |
| 00:25.31 | ImCoKeMaN | Restoring windows exception handlers... |
| 00:25.33 | ImCoKeMaN | Finished restoring windows exception handlers. |
| 00:25.35 | ImCoKeMaN | Handled 1021 irq, 427 abort, 88 prefetch, 0 lost, 0 errors |
| 00:25.37 | ImCoKeMaN | thats the wi 1 output |
| 00:26.10 | rakeem | cr2: On the contrary, your work here is not merely legal, but noble and important. If morality is to be mentioned at all, it can only be with regard to the lack thereof displayed by the vested interests whose goal it is to confine these technologies to a pointless lifecycle as an infantile toy, to last year's rubbish. Whatever the practical successes, this and similar projects have made an indelible impression on many. Non-geeks included. |
| 00:28.34 | Kevin2 | ImCoKeMaN: Can you run "clear mmutrace" followed by "addlist mmutrace 0xb4e00000 1024*1024" and then "wi 1"? |
| 00:29.50 | ImCoKeMaN | http://pastebin.com/m56f706bd |
| 00:30.48 | ImCoKeMaN | http://pastebin.com/m8c86b4b |
| 00:32.04 | cr2_ | rakeem: linux is a viable and really working alternative on the phone. imagine what could have been done if we had the full hw docs ;-) |
| 00:32.14 | cr2_ | ImCoKeMaN: looks interesting. |
| 00:34.01 | ImCoKeMaN | hehe, so you think the titan will be able to get a nice linux working on it too? |
| 00:34.37 | Kevin2 | cr2_: What do you think? 0xb4e00000 looks like the irq pending register, and 0x18 looks like the ack register. Not sure what 0x40 is.. And 0x28 looks weird. |
| 00:35.45 | cr2_ | 28 is something else. |
| 00:35.50 | rakeem | I know... If we *did* leave ethics aside entirely, a division of labour between hacking the hardware and TI / ATi / HTC's corporate networks might yield some progress... 8-| |
| 00:37.07 | cr2_ | ImCoKeMaN: can you try 'alloctest 8192' ? |
| 00:37.16 | Kevin2 | ImCoKeMaN: Do you connect via wifi or usb? |
| 00:37.23 | ImCoKeMaN | via usb |
| 00:37.37 | ImCoKeMaN | not sure if wifi sync works, might be able to try BT sync |
| 00:37.37 | cr2_ | ImCoKeMaN: titan has wifi ? |
| 00:37.40 | ImCoKeMaN | yup |
| 00:37.43 | cr2_ | ok. |
| 00:38.16 | rakeem | Is the titan similar in anatomy / evolution to the Univesal? |
| 00:38.40 | cr2_ | Kevin2: irq acking can be checked in the wince internals. |
| 00:38.41 | ImCoKeMaN | not really from anything i can tell |
| 00:39.13 | ImCoKeMaN | grr you blew up my memory cr2 hehe |
| 00:39.19 | cr2_ | rakeem: no. titan uses a qualcomm CPU without any docs. universal is the device where all hardware has linux drivers. |
| 00:39.37 | cr2_ | ImCoKeMaN: sure. 8192*4096=32M alloc :) |
| 00:40.11 | ImCoKeMaN | so got any better bright ideas? |
| 00:40.32 | cr2_ | take a number between 4096 and 8192 |
| 00:40.41 | rakeem | Qualcomm are doing the CPU now? So not even Omap / XScale development kits to give you clues? Jesus. |
| 00:40.54 | ImCoKeMaN | i have about 24 mb free |
| 00:40.57 | Kevin2 | Okay, there were 1041 irqs and 1041 traps at addr 800537fc -- so we've definitely found the main irq register. |
| 00:42.08 | cr2_ | rakeem: it seems that htc uses omap850 on cheap phones now, and qualcomm's msm7x00 on better ones. both are dual-ARM core devices. |
| 00:42.35 | cr2_ | ImCoKeMaN: try 20MB |
| 00:42.56 | cr2_ | <PROTECTED> |
| 00:43.11 | ImCoKeMaN | 5120? |
| 00:43.18 | cr2_ | 5000 |
| 00:43.23 | ImCoKeMaN | k |
| 00:44.11 | *** join/#htc-linux ljp (n=lpotter@203.94.178.46) |
| 00:44.26 | rakeem | Right, my Tornado's an Omap850. Another thing that pisses me off is that the core architecture was funded by the British taxpayer back in the days of Acorn RISC machines... Surely as a British citizen I should at least be entitled to a copy of the manual... |
| 00:44.44 | cr2_ | :) |
| 00:45.41 | cr2_ | rakeem: they want to "protect" the "secure" parts of the microcontroller. the ARM part is open. |
| 00:46.18 | ImCoKeMaN | sorry i got 6100 instead =) |
| 00:46.23 | rakeem | Secure as in crypto / big brother? |
| 00:46.55 | cr2_ | ImCoKeMaN: more is better. |
| 00:47.32 | ImCoKeMaN | http://pastebin.com/d42af6df5 |
| 00:47.38 | cr2_ | rakeem: they don't want that you mess with the radio (understandable), but there is also SIM access and HW RNG and such. |
| 00:47.40 | rakeem | cr2: More crypto is better too... ;-) |
| 00:49.18 | cr2_ | ImCoKeMaN: great. so it's really 64MB for wince, and something like 32MB for the DSP/framebuffer/etc. |
| 00:49.39 | ImCoKeMaN | so it does really have 96mb ram? |
| 00:50.09 | cr2_ | rakeem: if you use builtin crypto, you are doing something wrong. |
| 00:50.12 | cr2_ | ImCoKeMaN: yes. |
| 00:50.14 | ImCoKeMaN | i did see somewhere that it said that, but it was pre-release leaked info and never looked founted |
| 00:50.17 | ImCoKeMaN | nice |
| 00:50.24 | cr2_ | 64+ |
| 00:50.30 | ImCoKeMaN | sure would kick ass if there was a way to do something with the extra hehe |
| 00:51.15 | cr2_ | it is already used by wince. |
| 00:51.20 | Kevin2 | ImCoKeMaN: Can you run - "addlist irqs p2v(0xc0000000) 0x100" "clear mmutrace" "addlist mmutrace 0xb2a00000 2*1024*1024" "wi 1" |
| 00:51.40 | cr2_ | to store some data, and as a framebuffer RAM. |
| 00:52.48 | ImCoKeMaN | http://pastebin.com/d790ff098 |
| 00:53.12 | ImCoKeMaN | yeah but it only leaves 24 free out of the regular 64mb so it's a pain |
| 00:53.17 | rakeem | Have you read Dr. Markus Kuhn's work at defeating tamperproof cryptoprocessors? If that's their goal they're screwed. Also, I remember reading on another forum (by a regular here I suspect) that the GSM processing in my Tornado is all handled within user addressable registers by the OMAP.... |
| 00:53.32 | ImCoKeMaN | only 47mb is even listed for prog mem |
| 00:53.45 | ImCoKeMaN | seems like they could do something more efficient with that ram |
| 00:55.23 | rakeem | cr2: <Sorry missed your earlier comment about built in crypto> |
| 00:56.01 | cr2_ | rakeem: there is a gsm driver for tornado written by a french guy. the DSP uses a piece of main DRAM through its own MMU. the source is available: http://vivien.chappelier.free.fr/typhoon/gsm.html |
| 00:56.30 | rakeem | That's the guy! |
| 00:56.49 | cr2_ | btw, it's the same on qualcomm i guess. only a bit more clean, because the address spaces are physically separated. |
| 00:57.02 | cr2_ | and the second core runs microkernel linux. |
| 00:57.48 | cr2_ | ok guys. it#s really late now. good night. |
| 00:58.34 | rakeem | Nighty night... I shall keep reading.... |
| 00:58.43 | rakeem | I've gotta go to work now... 9am here..... |
| 00:58.53 | ImCoKeMaN | night cr2_ |
| 00:59.37 | ImCoKeMaN | Kevin2: is there anymore you would like? |
| 01:00.21 | Kevin2 | Yeah - can you download haretconsole? |
| 01:00.28 | Kevin2 | Do you run linux on your host? |
| 01:00.37 | ImCoKeMaN | not natively right now |
| 01:00.47 | Kevin2 | Okay. |
| 01:00.50 | ImCoKeMaN | i can load it up, but i don't have the sync stuff set up that way |
| 01:01.02 | Kevin2 | Do you have python on your windows machine? |
| 01:01.19 | ImCoKeMaN | probly not yet, it's a fairly new install, but i can get it |
| 01:01.27 | Kevin2 | No big deal. |
| 01:01.32 | ImCoKeMaN | hehe ok |
| 01:01.34 | *** join/#htc-linux _ecze (n=ecze@eczema.ecze.com) |
| 01:01.54 | Kevin2 | Can you run "clear irqs" and then "addlist irqs p2v(0xc0000000) 0x100 32 0" |
| 01:02.15 | Kevin2 | Actually, make that "addlist irqs p2v(0xc0000000) 0x8100 32 0" |
| 01:03.11 | ImCoKeMaN | then wi 1 again? |
| 01:03.17 | Kevin2 | Yep. |
| 01:03.56 | ImCoKeMaN | irq:8001ab88@A02D43F8=80a060ec abort:8000104c@A02D43F0=80a06110 prefetch:8001a6f |
| 01:03.56 | ImCoKeMaN | 8@A02D43EC=80a0613c data=809d5000 sizes=c:000011ac,t:000351ac |
| 01:03.56 | ImCoKeMaN | Beginning memory tracing. |
| 01:03.56 | ImCoKeMaN | Watching IRQS(00): Addr 94e00000(@c0000000) |
| 01:03.56 | ImCoKeMaN | 00: Mapping b2a00000 accesses to e1100000 (tbl a9302402) |
| 01:03.57 | ImCoKeMaN | 01: Mapping b2b00000 accesses to e1200000 (tbl a9202402) |
| 01:03.59 | ImCoKeMaN | Replacing windows exception handlers... |
| 01:04.01 | ImCoKeMaN | Finished installing exception handlers. |
| 01:04.03 | ImCoKeMaN | 000000: mem 94e00000=00000100 (00000000) |
| 01:06.22 | Kevin2 | Okay, otherwise quiet? |
| 01:06.48 | ImCoKeMaN | 000000: mem 94e00000=00000100 (00000000) |
| 01:06.48 | ImCoKeMaN | Restoring windows exception handlers... |
| 01:06.48 | ImCoKeMaN | Finished restoring windows exception handlers. |
| 01:06.48 | ImCoKeMaN | Handled 1033 irq, 335 abort, 56 prefetch, 0 lost, 0 errors |
| 01:06.56 | ImCoKeMaN | that was the rest |
| 01:07.29 | Kevin2 | Great. Now, try running wi 15. Then try tapping the screen while it is running. |
| 01:08.15 | ImCoKeMaN | nice |
| 01:08.20 | ImCoKeMaN | that makes it move lots |
| 01:09.18 | ImCoKeMaN | http://pastebin.com/d233e5be0 |
| 01:16.06 | Kevin2 | ImCoKeMaN: Interesting. |
| 01:16.51 | ImCoKeMaN | so you'll have a nice linux zimage for me in a few mins then right? |
| 01:17.27 | Kevin2 | ImCoKeMaN: No, linux will be a long way off. |
| 01:18.06 | ImCoKeMaN | hehe i know i'm just teasin |
| 01:18.29 | Kevin2 | Can you run "vd 0xb2b00000 0x1000" |
| 01:19.07 | ImCoKeMaN | HaRET(16)# vd 0xb2b00000 0x1000 |
| 01:19.07 | ImCoKeMaN | b2b00000 | 1438fb54 1438fb54 1438fb54 1438fb54 | T.8.T.8.T.8.T.8. |
| 01:19.07 | ImCoKeMaN | b2b00010 | 1438fb54 1438fb54 1438fb54 1438fb54 | T.8.T.8.T.8.T.8. |
| 01:19.07 | ImCoKeMaN | b2b00020 | 1438fb54Terminating haret due to unhandled exception (pc=0001e624) |
| 01:20.59 | Kevin2 | Picky picky. Let's try "vd 0xb2b00800 0x100" |
| 01:21.51 | *** join/#htc-linux rakeem__2 (n=root@n220246173102.netvigator.com) |
| 01:22.16 | ImCoKeMaN | http://pastebin.com/d60fbd6f8 |
| 01:25.21 | Kevin2 | Okay -- addlist irqs p2v(0xc0000000) 0x8100 32 0 -- addlist mmutrace 0xb2a00000 2*1024*1024 -- wi 10 |
| 01:25.31 | Kevin2 | And can you hit a button during the "wi" ? |
| 01:26.05 | ImCoKeMaN | do i have to clear first? |
| 01:26.25 | Kevin2 | It wont hurt, but you shouldn't have to. |
| 01:29.00 | ImCoKeMaN | http://pastebin.com/d391fbf3f |
| 01:29.10 | ImCoKeMaN | pushed 2 buttons, stuff loaded in between then |
| 01:37.00 | Kevin2 | ImCoKeMaN: You pressed the same button twice, or two different buttons? |
| 01:37.07 | ImCoKeMaN | two diff |
| 01:37.29 | ImCoKeMaN | notes, then comm manager |
| 01:40.51 | *** join/#htc-linux huhlig (n=UhligH@c-76-20-46-192.hsd1.ca.comcast.net) |
| 01:43.30 | Kevin2 | ImCoKeMaN: Lets try something different. Can you grab http://www.handhelds.org/~koconnor/haret/haret-20071029b.exe |
| 01:43.37 | Kevin2 | and then run "watch gpios 1" |
| 01:44.04 | *** join/#htc-linux the_sys0p (n=the_sys0@117.121.1.245) |
| 01:48.03 | ImCoKeMaN | HaRET(1)# watch gpios 1 |
| 01:48.03 | ImCoKeMaN | Beginning memory tracing. |
| 01:48.03 | ImCoKeMaN | HaRET(2)# watch gpios 10 |
| 01:48.03 | ImCoKeMaN | Beginning memory tracing. |
| 01:49.27 | Kevin2 | Hrmm. Is your machine detected as an msm7500? |
| 01:49.40 | ImCoKeMaN | generic arm |
| 01:51.13 | Kevin2 | Okay. Can you create the file "earlyharetlog.txt" and then look for the line "Wince reports processor: ..." |
| 01:51.22 | ImCoKeMaN | k |
| 01:51.24 | Kevin2 | In the file haretlog.txt |
| 01:52.51 | ImCoKeMaN | Detecting current machine |
| 01:52.51 | ImCoKeMaN | Trying to detect machine (Plat='PocketPC' OEM='TITA100') |
| 01:53.04 | ImCoKeMaN | looks liek titan was never added to the machlist.txt |
| 01:54.44 | Kevin2 | Dump mistake in haret - can you retry with http://www.handhelds.org/~koconnor/haret/haret-20071029c.exe |
| 01:56.04 | ImCoKeMaN | line 2: expected a number got 0addlist |
| 01:56.23 | ImCoKeMaN | but then loads and says generic msm7500 |
| 01:57.12 | Kevin2 | Oops - try http://www.handhelds.org/~koconnor/haret/haret-20071029d.exe |
| 01:57.17 | ImCoKeMaN | still does: HaRET(1)# watch gpios 1 |
| 01:57.17 | ImCoKeMaN | Beginning memory tracing. |
| 01:57.17 | ImCoKeMaN | HaRET(2)# watch gpios 10 |
| 01:57.17 | ImCoKeMaN | Beginning memory tracing. |
| 01:58.45 | ImCoKeMaN | there we go |
| 01:59.54 | ImCoKeMaN | http://pastebin.com/d28d583b7 |
| 02:02.58 | Kevin2 | Can you run "ibit gpios 290 203" and then rerun "watch gpios 1" |
| 02:03.53 | ImCoKeMaN | http://pastebin.com/d1d690468 |
| 02:04.17 | Kevin2 | Also, if you can get haretconsole ( http://www.handhelds.org/~koconnor/haret/haretconsole-20071029.tar.gz ) it will help a lot. |
| 02:04.31 | Kevin2 | Great! Now try "watch gpios 20" -- and then try hitting a button. |
| 02:06.28 | ImCoKeMaN | hmm i hit three, but onlt ones that made any diff was the notes button, it did this: |
| 02:06.31 | ImCoKeMaN | 008378: mem 92b0083c=03e51003 (00000004) |
| 02:06.32 | ImCoKeMaN | 008417: mem 92b0083c=03e51007 (00000004) |
| 02:06.32 | ImCoKeMaN | 008622: mem 92b0080c=000001a8 (00000008) |
| 02:06.32 | ImCoKeMaN | 008622: mem 92b00840=0000001c (00000008) |
| 02:06.32 | ImCoKeMaN | 009701: mem 92b0080c=000001a0 (00000008) |
| 02:06.32 | ImCoKeMaN | 009701: mem 92b00840=00000014 (00000008) |
| 02:07.13 | Kevin2 | Hrmm. Is there a pattern for press and then release? (Try holding it for a couple of seconds, and then releasing it.) |
| 02:08.05 | ImCoKeMaN | it doesn't seem to show much til the prog comes up, but i held it this time and it did: |
| 02:08.16 | ImCoKeMaN | 003251: mem 92b0083c=03e51003 (00000004) |
| 02:08.16 | ImCoKeMaN | 003293: mem 92b0083c=03e51007 (00000004) |
| 02:08.16 | ImCoKeMaN | 003612: mem 92b0080c=000001a8 (00000008) |
| 02:08.16 | ImCoKeMaN | 003612: mem 92b00840=0000001c (00000008) |
| 02:08.16 | ImCoKeMaN | 004248: mem 92b0080c=000001a0 (00000008) |
| 02:08.16 | ImCoKeMaN | 004248: mem 92b00840=00000014 (00000008) |
| 02:08.18 | ImCoKeMaN | 005379: mem 92b0080c=000001a8 (00000008) |
| 02:08.20 | ImCoKeMaN | 005379: mem 92b00840=0000001c (00000008) |
| 02:08.22 | ImCoKeMaN | 006405: mem 92b0080c=000001a0 (00000008) |
| 02:08.24 | ImCoKeMaN | 006405: mem 92b00840=00000014 (00000008) |
| 02:10.23 | Kevin2 | Hrmm. That is odd. |
| 02:10.43 | Kevin2 | What happens if you hit the touchscreen while in "watch gpios"? |
| 02:11.32 | *** join/#htc-linux the_sys0p` (i=nroberts@117.75.144.139) |
| 02:11.41 | ImCoKeMaN | 2 lines each tap |
| 02:11.41 | ImCoKeMaN | 001665: mem 92b00840=00000004 (00000010) |
| 02:11.41 | ImCoKeMaN | 001801: mem 92b00840=00000014 (00000010) |
| 02:11.41 | ImCoKeMaN | 003098: mem 92b00840=00000004 (00000010) |
| 02:11.41 | ImCoKeMaN | 003253: mem 92b00840=00000014 (00000010) |
| 02:11.42 | ImCoKeMaN | 004021: mem 92b00840=00000004 (00000010) |
| 02:11.44 | ImCoKeMaN | 004163: mem 92b00840=00000014 (00000010) |
| 02:11.46 | ImCoKeMaN | 004820: mem 92b00840=00000004 (00000010) |
| 02:11.48 | ImCoKeMaN | 004917: mem 92b00840=00000014 (00000010) |
| 02:12.52 | Kevin2 | Cool - you found your pen down gpio. |
| 02:13.08 | ImCoKeMaN | end button is: |
| 02:13.09 | ImCoKeMaN | 003535: mem 92b0083c=03e51003 (00000004) |
| 02:13.09 | ImCoKeMaN | 003614: mem 92b0083c=03e51007 (00000004) |
| 02:13.09 | ImCoKeMaN | 003912: mem 92b0080c=000001a8 (00000008) |
| 02:13.09 | ImCoKeMaN | 003912: mem 92b00840=0000001c (00000008) |
| 02:13.09 | ImCoKeMaN | 004501: mem 92b0080c=000001a0 (00000008) |
| 02:13.11 | ImCoKeMaN | 004501: mem 92b00840=00000014 (00000008) |
| 02:13.56 | Kevin2 | Does wince play sound when you hit a button? |
| 02:15.03 | ImCoKeMaN | it did with teh notes button |
| 02:15.24 | ImCoKeMaN | ohhh and the end button |
| 02:15.28 | Kevin2 | I think what you're seeing is the speaker power on gpio. |
| 02:15.29 | ImCoKeMaN | it's just super quiet |
| 02:15.32 | ImCoKeMaN | good catch |
| 02:15.43 | Kevin2 | Heh, I've done this before. :-} |
| 02:15.53 | ImCoKeMaN | really? never would have guessed =P |
| 02:17.05 | Kevin2 | If you want to verify the sound thing -- click on "listen" and open a second telnet window. |
| 02:17.24 | Kevin2 | In the first window, run "watch gpios ...", and in the second run "playsound 5" |
| 02:19.50 | ImCoKeMaN | yup |
| 02:19.50 | ImCoKeMaN | 005013: mem 92b0083c=03e51003 (00000004) |
| 02:19.51 | ImCoKeMaN | 005049: mem 92b0083c=03e51007 (00000004) |
| 02:19.51 | ImCoKeMaN | 005261: mem 92b0080c=000001a8 (00000008) |
| 02:19.51 | ImCoKeMaN | 005261: mem 92b00840=0000001c (00000008) |
| 02:19.51 | ImCoKeMaN | 008016: mem 92b0080c=000001a0 (00000008) |
| 02:19.52 | ImCoKeMaN | 008016: mem 92b00840=00000014 (00000008) |
| 02:21.56 | ImCoKeMaN | darn python is 10mb |
| 02:22.44 | Kevin2 | Heh. The haretconsole stuff really helps - it will pull apart the memory dumps and show meaningful names. |
| 02:22.59 | ImCoKeMaN | i jsut have crappy net here |
| 02:27.26 | Kevin2 | I'm going to have to call it a night. Lets see if cr2 has further suggestions tomorrow. |
| 02:27.35 | ImCoKeMaN | hehe ok |
| 02:27.44 | ImCoKeMaN | he'll probly have fun with the buffer |
| 02:28.12 | ImCoKeMaN | thanks for the help, and i hope this was useful |
| 02:29.51 | Kevin2 | Yep - we've found the irq registers and confirmed the gpio locations. This gives the basis for more a lot more research. |
| 05:56.07 | *** join/#htc-linux rmoravcik (n=rmoravci@ip-89-103-152-149.karneval.cz) |
| 06:00.35 | *** join/#htc-linux |dion| (n=dion@inhex.net) |
| 06:01.47 | *** join/#htc-linux sadeness_ (n=LamersIn@nat2.rlan.ru) |
| 06:10.28 | *** join/#htc-linux par (i=par@dipole.idlepattern.com) |
| 06:16.49 | *** join/#htc-linux sadeness_ (n=LamersIn@nat2.rlan.ru) |
| 06:22.02 | *** join/#htc-linux pleemans (n=peter@leemanpe.ugent.be) |
| 06:33.19 | *** join/#htc-linux the_sys0p (i=nroberts@118.147.4.135) |
| 06:58.01 | *** join/#htc-linux goxboxlive (n=jrs@195.159.97.196) |
| 07:01.41 | *** join/#htc-linux Marex-notebook (n=marex@vasut.kolej.mff.cuni.cz) |
| 07:04.26 | goxboxlive | good morning |
| 07:08.43 | par | hi goxboxlive |
| 07:08.53 | par | whats new on the xanadux front |
| 07:09.03 | par | did you get your universal pimped out? |
| 07:09.08 | goxboxlive | par: nothing much |
| 07:09.17 | goxboxlive | yes i have it running |
| 07:10.20 | par | what kernel is that latest |
| 07:20.36 | *** join/#htc-linux rob_w (n=bob@M8029.m.pppool.de) |
| 07:29.04 | goxboxlive | Still 2.6.21-hh17. but it hasent ahppend anythin since allmost .16 i think :-) |
| 07:31.51 | par | ah, .16 was last time i was around |
| 07:33.06 | *** join/#htc-linux rob_w (n=bob@M8029.m.pppool.de) |
| 07:35.56 | mazzanet | bleh this is frustrating |
| 07:39.18 | rob_w | mazzanet: what ? |
| 07:41.26 | mazzanet | fiddling with my o2 xda atom |
| 07:41.39 | mazzanet | hangs on jumping to kernel |
| 07:42.12 | *** join/#htc-linux bd2__ (n=cbou@85.21.88.2) |
| 07:51.25 | *** join/#htc-linux _law_ (n=law@mail.stiftadmont.at) |
| 08:08.28 | mazzanet | cr2_: i just opened the best up |
| 08:08.55 | mazzanet | cr2_: Intel PXA272FC5416 |
| 08:23.00 | mazzanet | and while i was at it i documented everything else |
| 08:42.37 | *** join/#htc-linux Robwoerle (n=bob@Mbaae.m.pppool.de) |
| 08:57.20 | *** join/#htc-linux Mineque (n=Mineque@195.60.65.50) |
| 08:59.47 | *** join/#htc-linux BabelO (n=Miranda@81.80.236.75) |
| 09:25.11 | mazzanet | cr2_: http://wiki.xda-developers.com/index.php?pagename=HTC_Atom |
| 09:28.26 | cr2_ | mazzanet: hi. g3 or g3 mdoc ? |
| 09:28.37 | cr2_ | s/or g3/or g4/ |
| 09:28.50 | cr2_ | moko uses wm9713 too ? |
| 09:29.35 | cr2_ | CPLD is not for i2c. it's either egpio or just some bt/wifi addon. |
| 09:31.43 | *** join/#htc-linux rob_w (n=bob@Ma9c5.m.pppool.de) |
| 09:42.22 | mazzanet | mdoc? |
| 09:42.48 | mazzanet | ah |
| 09:42.49 | mazzanet | umm |
| 09:43.30 | mazzanet | *grabs screwdriver* |
| 09:46.15 | mazzanet | G3 |
| 09:46.33 | mazzanet | 512mb |
| 09:46.37 | mazzanet | (:O?) |
| 09:47.05 | mazzanet | or not.. |
| 09:48.28 | mazzanet | what the heck is DiskOnChip G3 63MB (512MB) supposed to mean? |
| 09:52.06 | cr2_ | 64MB = 512Mb |
| 09:52.26 | cr2_ | so it's g3 64MB |
| 09:52.34 | mazzanet | ah :P |
| 09:52.35 | cr2_ | like on ba. ok. |
| 09:53.01 | cr2_ | well, you need an older gnu-haret do make some easy dumps. |
| 09:53.14 | cr2_ | but afaik the latest version crashes on atom. |
| 09:53.28 | cr2_ | i've added too much debug stuff for other devices ;) |
| 09:53.51 | mazzanet | cr2_: i've compiled that many kernels today and i can't get any further than jumping to the address |
| 09:56.53 | cr2_ | you need to dump your LCD parameters first. |
| 09:57.06 | cr2_ | otherwise your LCD will not show anything useful. |
| 09:57.29 | cr2_ | it can be done by hand, but it's too much pain. |
| 09:57.54 | cr2_ | gnulinux.biz is down ;) |
| 09:58.43 | cr2_ | check this one http://jornada820.sourceforge.net/files/haret/ |
| 09:58.54 | cr2_ | gnuharet-* |
| 09:59.02 | cr2_ | and tell me if it crashes |
| 10:00.10 | mazzanet | i think i'll start by putting the thing back together :P |
| 10:05.59 | mazzanet | cr2_: it crashes when i connect |
| 10:06.54 | cr2_ | mazzanet: ok, but it strats ? then try do add a command in the default.txt |
| 10:07.38 | mazzanet | yeah it id's the cpu and then crashes |
| 10:07.58 | cr2_ | on telnet connect ? |
| 10:08.03 | mazzanet | yeah |
| 10:08.08 | cr2_ | hmm. wait. |
| 10:10.11 | cr2_ | ok, does it start at all ? do you see the dialog with the 'Run' button ? |
| 10:10.35 | mazzanet | yeah |
| 10:10.49 | mazzanet | then it listens fine |
| 10:10.59 | mazzanet | telnet connects |
| 10:11.34 | mazzanet | prints the usual speil until 'enter help for help' and then crashes |
| 10:15.03 | mazzanet | boot2 makes it think a little bit and then crash |
| 10:15.32 | cr2_ | ok. |
| 10:15.40 | cr2_ | so edit the default.txt file |
| 10:16.12 | cr2_ | try |
| 10:16.19 | cr2_ | dump PXA27xLCCR xxx |
| 10:16.25 | cr2_ | and press 'Run' |
| 10:16.31 | cr2_ | check the xxx file |
| 10:18.44 | mazzanet | xxx 0 bytes |
| 10:31.28 | *** join/#htc-linux _law_ (n=law@mail.stiftadmont.at) |
| 10:36.27 | cr2_ | hmm. |
| 10:39.00 | cr2_ | dump PXA27xCKEN yyy |
| 10:40.16 | cr2_ | otherwise this code needs to be ported to mainline haret. |
| 10:42.10 | mazzanet | yep 0 again |
| 10:42.13 | cr2_ | i think things like that can be done in the haret command language: |
| 10:42.16 | cr2_ | uint32 *lccr0 = (uint32 *)memPhysMap (LCCR0); |
| 10:42.25 | cr2_ | <PROTECTED> |
| 10:42.57 | cr2_ | memPhysMap is easy |
| 10:43.24 | cr2_ | but i'm not sure if it supports A ? B: C |
| 10:43.30 | cr2_ | probably not. |
| 10:44.03 | cr2_ | then it's something for the haretconsole python register decoder. |
| 10:45.23 | cr2_ | if you have some time, you can do it manually: |
| 10:45.25 | cr2_ | <PROTECTED> |
| 10:45.26 | cr2_ | <PROTECTED> |
| 10:45.26 | cr2_ | <PROTECTED> |
| 10:45.26 | cr2_ | <PROTECTED> |
| 10:45.35 | cr2_ | <PROTECTED> |
| 10:45.36 | cr2_ | <PROTECTED> |
| 10:45.36 | cr2_ | <PROTECTED> |
| 10:45.36 | cr2_ | <PROTECTED> |
| 10:46.26 | cr2_ | just dump the LCCR* register block. |
| 10:47.02 | cr2_ | phys 0x44000000 |
| 10:47.39 | mazzanet | how big is it? |
| 10:49.30 | cr2_ | 3 registers. |
| 10:50.11 | cr2_ | define LCCR0 __REG(0x44000000) /* LCD Controller Control Register 0 */ |
| 10:50.12 | cr2_ | #define LCCR1 __REG(0x44000004) /* LCD Controller Control Register 1 */ |
| 10:50.12 | cr2_ | #define LCCR2 __REG(0x44000008) /* LCD Controller Control Register 2 */ |
| 10:50.12 | cr2_ | #define LCCR3 __REG(0x4400000C) /* LCD Controller Control Register 3 */ |
| 10:51.50 | mazzanet | 44000000 | 07b008f9 020314ef 02020d3f 04300003 |
| 10:54.17 | cr2_ | start decoding :) |
| 10:54.36 | cr2_ | the bits are above. |
| 10:54.50 | cr2_ | the only missing thing is the pixclock. |
| 10:54.57 | cr2_ | but it's more involved. |
| 10:55.40 | cr2_ | btw, dump the LCCR4 too. |
| 10:59.52 | mazzanet | 0x07b008f9 is all 0s |
| 11:03.16 | cr2_ | mazzanet: it's the LCCR0 value. |
| 11:03.37 | cr2_ | you only need to pick necessary bits from it. |
| 11:03.43 | mazzanet | oh value not address |
| 11:04.08 | cr2_ | the LCCR1 and LCCR2 may be more important. |
| 11:17.31 | cr2_ | BabelO: http://sourceforge.net/projects/navipowm |
| 11:20.22 | BabelO | cr2_: it is a good idea, and i like the prepare "TMC stuff" :) |
| 11:25.50 | mazzanet | cr2_: http://pastebin.com/f2a20a0a7 |
| 11:25.52 | mazzanet | :D |
| 12:22.34 | cr2_ | mazzanet: ok, then register atom at armlinux. ok, i can do it too. |
| 12:36.12 | cr2_ | BabelO: TMC is interesting, but i don't understand why he wants to reinvent the wheel in some other areas. |
| 12:38.32 | BabelO | cr2_ : TMC on artemis :), the tda chipset which manage radio over i2c can receive rds data as it seem, just need to decode them |
| 12:40.30 | cr2_ | wow. that's interesting. |
| 12:43.07 | BabelO | cr2_ : i just say that in all htc marketing about artemis they say about tmc |
| 12:43.56 | cr2_ | BabelO: that's a start http://wiki.xda-developers.com/index.php?pagename=ArtemisCPLD |
| 12:44.40 | cr2_ | BabelO: i can send you the .asm, so you can fill many gpios and cpld gpios. |
| 12:45.40 | BabelO | oh , there is lot of bank on cpld :) |
| 12:46.07 | BabelO | cr2_: ok send me i create a wiki account ;) |
| 12:48.27 | cr2_ | BabelO: somebody again used the old .12 ba kernel+familiar and is unhappy about the 1GB limit ;) |
| 12:48.34 | cr2_ | can we kill it completely ? |
| 12:50.46 | BabelO | cr2_: i think yes , only thing is thatit have gcommunicator running |
| 12:53.26 | BabelO | cr2_ : dn sound record ;) |
| 12:54.52 | BabelO | cr2_: can you send me asm file, i ll look if i understand something in it ;) |
| 12:56.05 | cr2_ | BabelO: ok, i've forgot about gomunicator. |
| 12:56.29 | cr2_ | BabelO: you only need to grep for 'set_gpio' |
| 12:56.49 | cr2_ | and look for r0 and r1 settings before. |
| 12:56.57 | BabelO | cr2_: ok, do you see my trace from yesturday about bt and other ? |
| 12:58.12 | cr2_ | BabelO: yes. but these are cpld traces. |
| 13:02.57 | cr2_ | BabelO: sent. |
| 13:03.58 | BabelO | cr2_: thanks |
| 13:08.40 | BabelO | cr2_: lol, 16 Mb of text file in a windows viewer |
| 13:12.19 | cr2_ | BabelO: apple_iphoneMACH_APPLE_IPHONEAPPLE_IPHONE1506 |
| 13:13.00 | BabelO | cr2_: uh already someone want linux on it ;) |
| 13:13.21 | cr2_ | somebody was not bright enough -> heraldMACH_HERMESHERMES1461 |
| 13:13.24 | BabelO | cr2_: some interestiong function like serialpower ;) |
| 13:13.43 | BabelO | cr2_: yes that's pH5 :) |
| 13:14.05 | cr2_ | wtf is it MACH_HERMES ? |
| 13:14.25 | BabelO | cr2_: i make a mistake and can't go back to correct value :( |
| 13:14.32 | cr2_ | ok. |
| 13:14.34 | BabelO | s/i make/he make/ |
| 13:14.37 | cr2_ | but artemis is ok. |
| 13:15.14 | BabelO | cr2_: what about Perseus2_io ? this say something to me , i already see it somewhere |
| 13:16.01 | cr2_ | perseus2 is the omap730 reference design from TI. |
| 13:18.26 | BabelO | cr2_: ok and it is in the code |
| 13:19.08 | BabelO | cr2_: ok i understand beter now, i see some set_gpio_dir, set_gpio_data and set_cpld_r0_r1 :) |
| 13:19.10 | cr2_ | i've fixed herald/hermes |
| 13:19.27 | cr2_ | set_cpld_r0_r1 should be set_cpld_r0_r1_r2 |
| 13:19.36 | cr2_ | it's a triple |
| 13:19.42 | cr2_ | bank,bit,value |
| 13:21.41 | cr2_ | xda_atom MACH_XDA_ATOM XDA_ATOM 1529 |
| 13:22.09 | BabelO | ko |
| 13:22.17 | cr2_ | mazzanet: now you can start hacking a new kernel. |
| 13:23.32 | BabelO | cr2_: woh hitachi are doing lcd now ;) |
| 13:26.19 | cr2_ | mazzanet: the .pixclock is needed too. |
| 13:30.59 | cr2_ | hehe. one more spoiled by windows ;) |
| 13:31.02 | cr2_ | ../src/TargetIncludes.hpp:34: error: conflicting declaration ‘typedef unsigned int size_t’ |
| 13:45.44 | BabelO | cr2_: vibrator on cpld too |
| 13:45.59 | BabelO | but i did not see r2 |
| 13:47.38 | cr2_ | BabelO: r2 is on/off |
| 13:47.58 | BabelO | cr2_: ok so 0xff or 0x00 |
| 13:48.14 | cr2_ | BabelO: there is enormous amount of gpios in the LCD startup. |
| 13:48.18 | cr2_ | 1 or 0 |
| 13:48.28 | cr2_ | &0xff is not important |
| 13:48.34 | BabelO | i see that lcd take a big part |
| 13:49.10 | BabelO | cr2_: 0x0 or 0xff seem to be ok, as they have low time and high time for pwm i think |
| 13:50.29 | cr2_ | ok. |
| 13:50.55 | cr2_ | fmradio is (4,1,1) (4,2,1) and (4,4,1) |
| 13:53.11 | BabelO | cr2_: audio seem to be as complex as for universal lot of possible routing |
| 13:53.25 | mazzanet | cr2_: how does one find pixclock? |
| 14:01.06 | BabelO | cr2_: can you refresh my memory about CMP R3, #0x69, it is some compare stuff but where it store result or jump ??? in R3 too ? |
| 14:01.29 | BabelO | cr2_: i ve some CMP without any BNE or so after |
| 14:08.13 | *** join/#htc-linux x7500denmark (n=x7500den@88.212.77.130) |
| 14:10.04 | x7500denmark | hi cr2_ I get the harel up and run in the default.txt what was it I should write in it :) |
| 14:12.11 | *** join/#htc-linux ivucica (i=ivucica@161.53.76.44) |
| 14:14.13 | cr2_ | BabelO: it sets the bits the status register. MOVS may be used later too. |
| 14:14.39 | cr2_ | mazzanet: look at the haret source. i'll post a link. |
| 14:14.43 | BabelO | cr2_: ok |
| 14:15.24 | cr2_ | x7500denmark: pwf x7500 0xa0100000 0x200000 |
| 14:17.37 | cr2_ | mazzanet: it's in the pxa27xDump() function. http://xanadux.cvs.sourceforge.net/xanadux/haret/haret-gnu/src/script.cpp?view=markup |
| 14:17.54 | x7500denmark | thanks cr2_ it ask for a zImage |
| 14:18.51 | cr2_ | x7500denmark: remove everything from default.txt and put only this line. |
| 14:19.23 | x7500denmark | ok :) |
| 14:19.49 | cr2_ | x7500denmark: if you just want to have fun later, get athena-boot.exe from http://jornada820.sourceforge.net/files/haret |
| 14:20.09 | cr2_ | hehe, 27-May-2007 |
| 14:23.48 | BabelO | cr2_ : im not sure about your cpld naming, if i ve cpld_r0_r1(6,1,1) and 6,2,1 ? it is D0 and D1 ? or D1 and D2, i know it is a stupid question but i always make mistake with that :) |
| 14:25.52 | x7500denmark | okay hehe ;) |
| 14:28.56 | *** join/#htc-linux x7500denmark (n=x7500den@88.212.77.130) |
| 14:29.29 | *** join/#htc-linux goxboxlive (n=goxboxli@139.80-202-160.nextgentel.com) |
| 14:32.10 | cr2_ | BabelO: what is D? |
| 14:32.45 | BabelO | cr2_: it is bank D like you set in wiki ? isn't ? |
| 14:35.15 | cr2_ | the wiki is copied from athena :) |
| 14:35.25 | cr2_ | artemis has A-H |
| 14:36.01 | cr2_ | it's necessary to check with the code where is the bank, or compare with the traces. |
| 14:36.07 | cr2_ | i'm not 100% sure. |
| 14:38.10 | BabelO | cr2_: ok |
| 14:47.21 | cr2_ | BabelO: write the omap gpio direction in the wiki too |
| 14:47.42 | BabelO | cr2_: but the direction change :( |
| 14:47.54 | cr2_ | ok. then write IO |
| 14:47.59 | BabelO | ok |
| 14:48.13 | cr2_ | btw, 33 is also USB_En on tornado. |
| 14:48.30 | cr2_ | http://vivien.chappelier.free.fr/typhoon/doc.html |
| 14:55.03 | cr2_ | BabelO: write down the triples for cpld, we can decode them later. |
| 14:55.36 | BabelO | ok |
| 15:02.59 | *** join/#htc-linux rob_w (n=bob@Maf8b.m.pppool.de) |
| 15:22.09 | *** join/#htc-linux TimRiker (n=timr@216.49.181.128) |
| 15:41.39 | *** join/#htc-linux x7500denmark (n=x7500den@3e6b30d0.rev.stofanet.dk) |
| 15:46.02 | ivucica | how much space do i need for openembedded to build its base stuff? (i'm running "bitbake nano" so i believe it's a bare minimum) |
| 15:46.09 | ivucica | will 2.3gb do? |
| 15:50.48 | TimRiker | ivucica: should do. seem I normally use around 2G for full embedded builds. |
| 15:51.23 | TimRiker | 'course I normally use uclibc and not glibc |
| 15:58.16 | ivucica | TimRiker: eff, i'll use glibc |
| 15:59.28 | ivucica | TimRiker: uclibc is the ucLinux's variant on libc theme, right? |
| 15:59.37 | ivucica | meaning it's optimized for no-mmu environments? |
| 16:33.44 | BabelO | cr2_: Pcc_cam_clk_ct so i can pick timing from here |
| 16:39.02 | *** join/#htc-linux |dion| (n=dion@inhex.net) |
| 16:58.50 | *** join/#htc-linux goxboxlive (n=goxboxli@139.80-202-160.nextgentel.com) |
| 17:12.30 | *** join/#htc-linux lieter (n=lieter@a62-251-100-248.adsl.xs4all.nl) |
| 17:30.46 | *** join/#htc-linux UhligH_ (n=UhligH@c-76-20-46-192.hsd1.ca.comcast.net) |
| 17:33.12 | TimRiker | ivucica: uclibc is optimised for small size. mmu-full and mmu-less are fully supported. |
| 17:33.46 | ivucica | TimRiker: thanks |
| 17:34.16 | TimRiker | uclibc is often faster than glibc in addition to being less than 1/4 the size. |
| 17:35.02 | ivucica | i may be an ignorant fool for saying this, but i am sticking to glibc due to compatibility reasons |
| 17:35.15 | ivucica | i think most h3800 pre-built packages are made for glibc |
| 17:35.30 | ivucica | i'm actually trying to use openembedded to build a custom kernel |
| 17:37.37 | *** join/#htc-linux pH5 (n=ph5@e178240013.adsl.alicedsl.de) |
| 17:40.56 | ivucica | TimRiker: does qemu-native really take very long to compile, or is it just my configuration? |
| 17:41.25 | *** join/#htc-linux Marex-notebook (n=marex@vasut.kolej.mff.cuni.cz) |
| 17:54.32 | *** join/#htc-linux mfisher (n=moe@HSI-KBW-091-089-001-192.hsi2.kabelbw.de) |
| 17:56.22 | ivucica | ok, cya folks, this appears to be progressing ... slowly, but progressing |
| 17:56.23 | ivucica | bye! |
| 18:06.18 | TimRiker | anyone here hear anything from google about the alleged gphone? sounds like they are at least talking to HTC. |
| 18:29.29 | cr2_ | TimRiker: no idea. do you know how is the iphone-linux going ? |
| 18:39.21 | *** join/#htc-linux wireddd (n=wired@97-81-78-105.dhcp.athn.ga.charter.com) |
| 18:46.36 | TimRiker | nope, not checked in on that either. though with the iPhone hacks, the platform is nice and open. Not as much motivation there for me as to get the useless windows mobile off a device. |
| 18:47.30 | cr2_ | i'm more interested in the commodity hardware too. |
| 18:48.21 | cr2_ | but since the msm7x00 is produced by samsung, there may be some overlaps. |
| 19:20.12 | *** join/#htc-linux BabelO (n=Fabrice@lun34-2-82-238-28-28.fbx.proxad.net) |
| 19:30.14 | *** join/#htc-linux maniacxs (n=maniacxs@p5B21B6D6.dip0.t-ipconnect.de) |
| 19:32.24 | maniacxs | hi i fetched the new image for qtopia/opie-ii |
| 19:32.42 | maniacxs | and trying to get the phone running... |
| 19:33.09 | maniacxs | sorry the image for the htc-universal |
| 19:34.26 | BabelO | maniacxs: can you post your ROM version + rom radio please ? |
| 19:36.13 | *** join/#htc-linux slarner_ (n=slarner@213.165.224.54) |
| 19:36.45 | maniacxs | BabelO: R: 1.10.03; G: 43.44. P8; D: 1.30.113 GER This is what it shows on boot i hope this is the needed info |
| 19:36.49 | ImCoKeMaN | cr2_: did you look at the titan info i took after you left last night? |
| 19:38.59 | cr2_ | ImCoKeMaN: yes. we are making progress. i've told you before that the serial ports look like something from samsung. now we know that the cpu is produced by samsung told us by wince ;) |
| 19:39.40 | goxboxlive | BabelO: there? |
| 19:39.57 | BabelO | goxboxlive: yes ;), do you see maniacxs question ? |
| 19:40.37 | goxboxlive | That seems like some gps cords. Am i right? |
| 19:41.17 | goxboxlive | sorry :-/ |
| 19:41.25 | pH5 | cr2_: the qualcomm chips are produced by samsung? |
| 19:41.53 | BabelO | goxboxlive: no yesturday you say that there is some issue with rom radio, which version did you use ? 1.18 |
| 19:42.01 | goxboxlive | maniacxs: i am using radio 1.15 |
| 19:42.38 | goxboxlive | But i dont think that is has something to do with the radiorom. I heard that ellisway has problmes with one of his sim card. |
| 19:43.08 | BabelO | yes that what he s saying yesturday |
| 19:45.10 | maniacxs | i try to put the new t-mobile image on it. maybe it is better then |
| 19:45.18 | maniacxs | "new" |
| 19:49.13 | goxboxlive | maniacxs: do youhave another sim card just to test, so you dont flash your phone for nothing? |
| 19:50.44 | maniacxs | no i do not have another sim card. |
| 19:51.42 | maniacxs | currently there is nothing on the phone so this is not really a problem. |
| 19:54.02 | goxboxlive | ok |
| 19:58.15 | maniacxs | hm the latest t-mobile image from their webpage has radio 1.17 |
| 20:00.39 | maniacxs | the 1.18 is this the radio or extended radio? |
| 20:07.35 | cr2_ | pH5: S3CA460 there too |
| 20:10.52 | pH5 | heh, the world is small. |
| 20:13.17 | cr2_ | pH5: and the serial ports are like on S3C24xx. now i need to remember their address. |
| 20:14.03 | cr2_ | pH5: the herald is really weird with this i2c. btw, i've fixed the hh.org mach-types for MACH_HERALD |
| 20:18.29 | BabelO | maniacxs: bettar is to have 1.15 same as goxboxlive , and it is just radio i think |
| 20:23.54 | maniacxs | nice ... green windows |
| 20:34.26 | maniacxs | what ip does the usb0 has in the image? |
| 20:34.31 | maniacxs | by default? |
| 20:37.03 | maniacxs | no it happened again there appears a screen with a num pad (seems to be the dialing pad) with the info please wait ... |
| 20:37.34 | BabelO | maniacxs: ip adress is 192.168.0.202 for universal |
| 20:39.03 | maniacxs | thanks |
| 20:39.53 | maniacxs | should there be a gsmd? |
| 20:40.08 | BabelO | maniacxs: no , it is qtopia |
| 20:46.44 | maniacxs | ups it crashed.. |
| 20:51.07 | maniacxs | goxboxlive: do you have in "call networks" -> modem -> current state unknown in the technology field, too? |
| 21:00.00 | goxboxlive | maniacxs: as far as i remember yes. Remember, the phonevendor file for universal is a major hack. I just made it so i could have the pone and modem working. |
| 21:08.05 | ImCoKeMaN | so how can haret console be used on windows after python is installed |
| 21:09.46 | ImCoKeMaN | nevermind got it |
| 21:13.08 | maniacxs | ok |
| 21:13.41 | cr2_ | pH5: do you know what is MMC CMD4 ? |
| 21:13.46 | maniacxs | the pin request should it come automaticly? |
| 21:14.01 | cr2_ | pH5: sorry. it's a mistake. |
| 21:14.26 | ImCoKeMaN | cr2 anything you want me to test with haretconsole now? |
| 21:15.23 | cr2_ | ImCoKeMaN: can you trace the 0xb13* and 0xb14* spaces ? |
| 21:15.33 | cr2_ | while working with the SD card. |
| 21:16.06 | cr2_ | i think these are 2 samsung sdio controllers. |
| 21:16.53 | ImCoKeMaN | so what do i need to run? then i can just do any file views on sd card? or do i need to copy paste to make writes? |
| 21:17.12 | ImCoKeMaN | sorry, first time this detailed digging |
| 21:17.14 | cr2_ | addlist mmutrace 0xb1300000 1024*1204 |
| 21:17.27 | cr2_ | addlist mmutrace 0xb1400000 1024*1024 |
| 21:17.34 | cr2_ | wi 5 |
| 21:36.25 | ImCoKeMaN | http://pastebin.com/dea8b3cb |
| 21:39.21 | cr2_ | ImCoKeMaN: looks like sdio1 is the SD controller. http://wiki.xda-developers.com/index.php?pagename=TitanMemoryMap |
| 21:39.45 | cr2_ | may be helpful to compare it with the samsung SD regs. |
| 21:40.19 | cr2_ | ImCoKeMaN: are you logged in over wifi or usb ? |
| 21:40.59 | ImCoKeMaN | usb |
| 21:41.44 | cr2_ | can you check the 0xb2500000 ? |
| 21:42.21 | cr2_ | then you may trace 0xb2400000 with wifi switched on and off. |
| 21:47.35 | ImCoKeMaN | http://pastebin.com/d6be9843e |
| 21:49.03 | cr2_ | ok, so you see the activity there. |
| 21:49.35 | cr2_ | Kevin2: it is very interesting to resolve the addresses back to .exe/.dll in the log |
| 21:49.38 | cr2_ | 000212: mmutrace 03c65870: e5933070(ldr) b2501070 00000020 (00000000) |
| 21:50.39 | cr2_ | 03c65870 is the (probably .dll) address |
| 21:50.55 | cr2_ | ImCoKeMaN: can you pastebin the 'lsmod' output ? |
| 21:57.42 | ImCoKeMaN | http://pastebin.com/d40fd897b |
| 21:58.36 | cr2_ | ok. |
| 22:00.23 | cr2_ | base=03C5E000 size=00011000 hmod=82F25EDC mod=msm7500usbfn.dll |
| 22:00.32 | cr2_ | base=03C6F000 size=00029000 hmod=82EA4000 mod=keybddr.dll |
| 22:00.36 | cr2_ | hmm. |
| 22:00.50 | cr2_ | it seems i need to sort it on base= column |
| 22:09.42 | ImCoKeMaN | i can connect via wifi if it helps, but it seems when conncted to usb it doesn't like to turn on even though ihavew activesync allow it |
| 22:09.58 | cr2_ | ok. |
| 22:10.03 | mazzanet | cr2_: i calculated my run clock to be 286mhz, does that sound right? :| |
| 22:10.50 | cr2_ | no. |
| 22:11.03 | cr2_ | .pixclock ? |
| 22:11.28 | *** join/#htc-linux ImCoKeMaN_ (n=me@rrcs-67-78-122-67.sw.biz.rr.com) |
| 22:11.36 | ImCoKeMaN_ | i can connect via wifi if it helps, but it seems when conncted to usb it doesn't like to turn on even though ihavew activesync allow it |
| 22:11.50 | cr2_ | ImCoKeMaN_: your previous trace. |
| 22:12.05 | cr2_ | 03ba9f9c: e5831080(str) b1400080 ac900000 |
| 22:12.24 | cr2_ | 03ba9e24: e5933080(ldr) b1400080 00000000 |
| 22:12.44 | cr2_ | base=03BA5000 size=0000a000 hmod=82EDBC1C mod=sdhc.dll |
| 22:12.57 | ImCoKeMaN | looks like sdcard access there |
| 22:13.04 | cr2_ | base=03BAF000 size=0000f000 hmod=82F5D960 mod=sdbus.dll |
| 22:13.21 | cr2_ | yes, it's inside the sdhc.dll |
| 22:13.32 | cr2_ | see how easy it is :) |
| 22:13.49 | ImCoKeMaN | nice |
| 22:14.13 | cr2_ | haret can decode it automatically |
| 22:14.33 | cr2_ | so you can trace the remaining address spaces :) |
| 22:14.59 | ImCoKeMaN | so how do i get haret to do that? |
| 22:15.22 | ImCoKeMaN | that was why kevin told me to get haretconsole i think, but i'm not sure from there |
| 22:15.30 | cr2_ | we need to ask Kevin2 to patch haret for that. |
| 22:15.45 | ImCoKeMaN | hehe sounds good |
| 22:16.08 | cr2_ | so you'll get the dll/exe name for the address |
| 22:16.11 | ImCoKeMaN | that should take him all of about 5 minutes at the rate he does that, i have 4 versions from yesterday lol |
| 22:16.33 | cr2_ | yes, it's not difficult. |
| 22:16.52 | cr2_ | http://wiki.xda-developers.com/index.php?pagename=TitanMemoryMap |
| 22:17.11 | cr2_ | you see, there are many unknown fields here. |
| 22:18.18 | cr2_ | the diagramm shows the subsystems we are looking for |
| 22:18.20 | cr2_ | http://www.cdmatech.com/download_library/pdf/msm7500_chipset.pdf |
| 22:18.42 | cr2_ | page 4 |
| 22:20.05 | cr2_ | we have found SDRAM, SRAM, USB and MMC/SDIO |
| 22:20.18 | cr2_ | still unsure about MDDI. |
| 22:20.44 | cr2_ | finding the keypad should be easy. |
| 22:21.07 | cr2_ | bluetooth is on the uart |
| 22:21.16 | cr2_ | can be traced too. |
| 22:23.16 | cr2_ | yeah, 3 uarts. like on S3C |
| 22:23.32 | cr2_ | is this I O sign on uart3 mean IR ? |
| 22:26.57 | cr2_ | tnetw1251 |
| 22:27.44 | cr2_ | atcmd,data and virser_dmr_dpram. ok. |
| 22:28.13 | cr2_ | need to locate the dpram too. |
| 22:37.25 | mazzanet | cr2_: the CCSR keeps changing... |
| 22:37.28 | *** join/#htc-linux toi (n=pleemans@d5152D3B4.access.telenet.be) |
| 22:37.28 | *** join/#htc-linux gw280 (n=george@vm.gwright.org.uk) |
| 22:38.35 | mazzanet | so far i've seen it as 0x30000108, 0x30000208, 0x30000308 and 0x3000210 |
| 22:44.27 | cr2_ | mazzanet: does it affect pixclock ? |
| 22:44.52 | cr2_ | you only need to calculate pixclock. |
| 22:45.03 | cr2_ | the rest does not matter. |
| 22:47.02 | mazzanet | it does |
| 22:47.17 | mazzanet | out(data, "lcdlck_pixclock: %d pcd=%d\n", (pcd*2*1000000)/ (K / 1000000), pcd); |
| 22:47.31 | mazzanet | K = L / k; |
| 22:47.36 | mazzanet | L = l * BASE_CLK; |
| 22:47.48 | mazzanet | l = *ccsr & 0x1f; |
| 22:48.39 | mazzanet | k = (l <= 7) ? 1 : (l <= 16) ? 2 : 4; |
| 22:49.26 | cr2_ | the math is a bit bizarre. |
| 22:49.55 | cr2_ | what is the pcd value ? |
| 22:50.29 | cr2_ | <PROTECTED> |
| 22:51.06 | cr2_ | so l > 7 and <= 16 |
| 22:53.05 | *** join/#htc-linux x7500denmark (n=x7500den@88.212.77.130) |
| 22:53.55 | mazzanet | pcd i got from lccr which is.. |
| 22:54.12 | mazzanet | 3 |
| 22:54.31 | x7500denmark | hi cr2_ i running the haret now but nothing hapens ?? only a x7500 file on 2 mb is in the directory ?? :) |
| 22:55.21 | cr2_ | x7500denmark: yes. pack this file and put it somewhere i can get it. |
| 22:55.51 | cr2_ | mazzanet: if you know pcd and K you can calculate the pixclock. |
| 22:55.55 | x7500denmark | ok have you a mail ? |
| 22:56.35 | cr2_ | x7500denmark: 2mb is too much. |
| 23:00.51 | x7500denmark | ok what do you use normally ? |
| 23:02.28 | mazzanet | cr2_: the changing value does affect pixclock |
| 23:02.38 | mazzanet | i get values of 71428, 57692, 76923, 92307 |
| 23:11.51 | x7500denmark | cr2_ here :) http://www.4shared.com/dir/4395552/c1bab9ff/sharing.html |
| 23:19.23 | x7500denmark | cr2_ the athenaboot.exe works can i get acces from ubuntu with usb cable ? |
| 23:20.35 | cr2_ | x7500denmark: got the file, you can remove it. |
| 23:20.49 | cr2_ | x7500denmark: i think yes. |
| 23:21.13 | cr2_ | ImCoKeMaN: your wifi is newer than on other phones. it's 1251 and not 1250 |
| 23:21.49 | ImCoKeMaN | yay i'm a winner |
| 23:22.14 | ImCoKeMaN | wait you judging by a file? |
| 23:23.03 | x7500denmark | cr2_ ok how does this work. sorry i am new :) |
| 23:23.11 | ImCoKeMaN | cuz i'm running an updated OS now |
| 23:23.30 | *** join/#htc-linux the_sys0p (i=nroberts@118.147.4.135) |
| 23:24.14 | cr2_ | x7500denmark: you have run linux, and have overwritten parts of wince dmesg :) |
| 23:25.17 | cr2_ | x7500denmark: yes, your boardid is 6. it seems everybody has the same hardware. ok, maybe x7501 is different. |
| 23:26.19 | cr2_ | Board ID: 6 |
| 23:26.19 | cr2_ | 1583 on board |
| 23:26.19 | cr2_ | CHW::Initialize - signalling H/W reset |
| 23:26.19 | cr2_ | CHW::Initialize ChipId(0x70) is 158230- signalling H/W reset |
| 23:26.42 | cr2_ | but i still have not found where it is on a running device ;) |
| 23:27.14 | cr2_ | mazzanet: Initial Values: cccr: 02000310 cken: 0158cec1 oscc: 00000003 ccsr: 30000310 |
| 23:27.29 | x7500denmark | ok do i use tty ?? to get acces ? :) |
| 23:27.32 | cr2_ | mazzanet: this is pxa270 at 624MHz |
| 23:27.59 | cr2_ | x7500denmark: there is no spi keyboard driver yet. you can login only over usb. |
| 23:28.30 | x7500denmark | ok how can i do that :) |
| 23:28.37 | cr2_ | ImCoKeMaN: i have still not found the serial ports. |
| 23:28.47 | cr2_ | ImCoKeMaN: do you have IR ? |
| 23:29.01 | ImCoKeMaN | i have wifi i can console with |
| 23:29.12 | ImCoKeMaN | i do have ir, but not on lappy |
| 23:29.40 | cr2_ | ImCoKeMaN: ok. |
| 23:32.54 | cr2_ | ImCoKeMaN: have you already done 'dump mmu' ? |
| 23:33.17 | ImCoKeMaN | i think i pasted sent it to ya before, but you need it again? |
| 23:33.34 | mazzanet | cr2_: i see... |
| 23:33.35 | mazzanet | 41300000 | 02000210 00dd5ae7 00000003 30000210 | .....Z.........0 |
| 23:33.55 | mazzanet | 41300000 | 00000108 00dd5ae7 00000003 30000108 | .....Z.........0 |
| 23:34.01 | mazzanet | 41300000 | 02000208 00dd5ae7 00000003 30000208 | .....Z.........0 |
| 23:34.07 | cr2_ | ImCoKeMaN: it's too big to be pasted. |
| 23:34.20 | ImCoKeMaN | yeah i meant sent...i think i have a link... |
| 23:34.28 | cr2_ | i'll look |
| 23:34.41 | ImCoKeMaN | ftp://ppcgeeks:ezupload@ftp.ppcgeeks.com/Titan/Users/ImCoKeMaN/mmu.txt |
| 23:34.49 | cr2_ | ok |
| 23:34.50 | mazzanet | 41300000 | 02000408 00dd5ae7 00000003 30000308 | .....Z.........0 |
| 23:34.51 | ImCoKeMaN | 300k? |
| 23:35.02 | mazzanet | so which one would i use to calculate? :P |
| 23:35.36 | cr2_ | mazzanet: well, probably it's easier to port this command to haret. |
| 23:36.31 | mazzanet | hm |
| 23:36.52 | mazzanet | i might just take the value as soon after startup as possible |
| 23:40.09 | cr2_ | ImCoKeMaN: if we will trust wince registry, then the BT is on uart0 and IR is on uart2. AFAIR it's the same as on hermes. we only need to find the base address. |
| 23:40.51 | cr2_ | these are probably the same serial ports as on S3C24xx |
| 23:40.53 | mazzanet | 30000210 is is the winner |
| 23:40.56 | ImCoKeMaN | k, well i'm about to head for dinner |
| 23:41.09 | cr2_ | ok. |
| 23:41.13 | ImCoKeMaN | i can prob read buffer or a /msg if ya have stuff for me to test though |
| 23:42.01 | cr2_ | i'm tired myself. will go to bed soon :) |
| 23:42.34 | cr2_ | we are moving much faster than i've expected. |
| 23:44.20 | mazzanet | arm-linux-ld: no machine record defined |
| 23:44.21 | mazzanet | make: *** [.tmp_vmlinux1] Error 1 |
| 23:44.22 | mazzanet | hrm. |
| 23:45.16 | *** join/#htc-linux rakeem__ (n=root@n219079205166.netvigator.com) |
| 23:47.58 | cr2_ | mazzanet: too early. |
| 23:48.13 | cr2_ | there is no code fo your device. |
| 23:48.25 | cr2_ | you need the .pixclock to see the penguin :) |
| 23:48.44 | mazzanet | i just added code :P |
| 23:48.55 | mazzanet | arch/arm/mach-pxa/xda_atom/ |
| 23:49.19 | mazzanet | this is at the very very end of the kernel compile too |
| 23:52.13 | cr2_ | copy the a701 code |
| 23:52.42 | cr2_ | but replace the LCD params. |
| 23:55.27 | mazzanet | that's what i did |
| 23:58.47 | mazzanet | a la http://pastebin.ca/755900 |