IRC log for #htc-linux on 20120626

00:34.32*** join/#htc-linux raymonddull (~raymonddu@c-69-245-114-102.hsd1.mi.comcast.net)
01:56.35*** join/#htc-linux rajkosto (~rajkosto@wan.rajkonet.info)
01:57.48jonprywhat is a good illegal instruction?
01:58.24raymonddullumm... no idea
01:58.31jonprylike if i have a void (*foo)(). and want to *(u32*)foo=illegal
02:00.51jonpryssxaryj6uyn7s2zw'
02:16.32*** join/#htc-linux surge (surge@pool-98-118-183-214.bflony.fios.verizon.net)
02:33.27*** join/#htc-linux detule (~detule@unaffiliated/d3tul3)
02:35.59*** join/#htc-linux jonpry (~jon@c-24-17-200-206.hsd1.wa.comcast.net)
02:51.35*** join/#htc-linux ALoGeNo (~alogeno@243.Red-217-125-20.staticIP.rima-tde.net)
02:51.35*** join/#htc-linux ALoGeNo (~alogeno@unaffiliated/alogeno)
03:15.47*** join/#htc-linux ALoGeNo (~alogeno@unaffiliated/alogeno)
03:29.08*** join/#htc-linux bzo (~chatzilla@c-71-196-133-131.hsd1.co.comcast.net)
03:47.05*** join/#htc-linux AstainHellbring (AstainHell@unaffiliated/astainhellbring)
03:48.51detulejonpry, the beast compiled
03:53.22jonprynice
03:57.21jonpryi'm getting walked on by this padconf thing as usual
03:59.52detuleat some point i need to pick your brain about how to go hunting for a ram_console location
04:00.36jonpryi think it basically doesn't matter as long as you carve it out of your known good kernel
04:01.29jonpryprobably towards the end of memory so the boot loaders don't hit it
04:02.07detuleyeah but I am used to our pmem-like kernel where i can see the smi and ebi1 and ebi2
04:02.17detulei can't find anything like a map in here
04:05.45jonpryproc/vmallocinfo?
04:08.02jonpryit might be that your kernel has no holes
04:08.26jonprysome might be visible in dmesg if they are setup through atags or nodes
04:09.39detulei'll see if i can get lucky
04:09.54detulejust need to figure out what "end of memory" is
04:10.13jonprythats easy
04:10.25jonpryload address + 2gb
04:13.53detulei'll try that
04:24.10*** join/#htc-linux mes (~mes@sentry.lazo.ca)
05:20.30*** join/#htc-linux BabelO (~wdlxtv@AMontpellier-553-1-168-32.w92-133.abo.wanadoo.fr)
06:02.19*** join/#htc-linux kiozen (~kiozen@p578a42db.dip0.t-ipconnect.de)
07:16.50*** join/#htc-linux |lippa|^ (~lippa@CPE-124-181-203-204.lnse3.win.bigpond.net.au)
07:31.51*** join/#htc-linux tmzt (~tmzt@adsl-99-164-36-59.dsl.akrnoh.sbcglobal.net)
07:32.00*** join/#htc-linux Willd_ (willd@citu-202.citu.kth.se)
07:32.01*** join/#htc-linux toer_ (~tore@179.81-166-86.customer.lyse.net)
07:45.56*** join/#htc-linux eR^zeRa` (zzeratul@kaj-0011.koleje.cuni.cz)
07:55.11*** join/#htc-linux lamikr (lamikr@nat/nokia/x-cbmmmtmhssqvdzzp)
08:09.55*** join/#htc-linux AK523 (~AK@41.78.77.178)
08:11.39AK523hie,I need help on a Sony Ericson Aspen Faith
08:34.17*** join/#htc-linux ychavan (ychavan@nat/redhat/x-vqoatlgbnllxohyk)
09:25.46*** join/#htc-linux marc1706 (~Marc@phpbb/modifications/marc1706)
09:46.11*** join/#htc-linux Alex[sp3dev] (d5551202@gateway/web/freenode/ip.213.85.18.2)
11:08.27*** join/#htc-linux Bry8Star{EB (Bry8Star-@2607:f128:42:fb::2)
11:47.19*** join/#htc-linux helicopter88 (~helicopte@host161-8-dynamic.55-79-r.retail.telecomitalia.it)
11:57.11*** join/#htc-linux skodde (~skodde@unaffiliated/skodde)
12:27.20*** join/#htc-linux MethoS- (~clemens@134.102.106.250)
13:36.43*** join/#htc-linux detule (~detule@unaffiliated/d3tul3)
13:43.03*** join/#htc-linux Cotulla (~myfakemai@nat100-255-205-109.tvoe.tv)
14:54.05zeuskwtf, krait has 40 bit addressing
14:56.37Alex[sp3dev]heil PAE
14:57.58zeuskmaybe that is the reason US sgs3 has 2gb ram..
14:59.02Alex[sp3dev]let's just wait for 64-bit armv8
14:59.51Cotullano it's because Samsung's CPU supports only 1 Gb
14:59.52Cotulla:D
15:02.25*** join/#htc-linux conantroutman (~chatzilla@cpc5-pert4-2-0-cust205.sgyl.cable.virginmedia.com)
15:26.39*** join/#htc-linux helicopter88_2 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
15:29.23*** join/#htc-linux jonpry (~jon@c-24-17-200-206.hsd1.wa.comcast.net)
16:11.42*** join/#htc-linux AstainHellbring (~AstainHel@unaffiliated/astainhellbring)
16:14.36*** join/#htc-linux ALoGeNo (~alogeno@243.Red-217-125-20.staticIP.rima-tde.net)
16:14.37*** join/#htc-linux ALoGeNo (~alogeno@unaffiliated/alogeno)
16:32.14zeuskI HATE LK
16:32.24zeuskFUCKING TABS EVERYWHERE
16:32.25zeuskWTF
16:35.10Alex[sp3dev]OMGWTFBBQRUMADBRO
16:39.48*** join/#htc-linux kiozen (~kiozen@ppp-93-104-89-17.dynamic.mnet-online.de)
16:42.09arrrghhhlol
16:43.36*** join/#htc-linux helicopter88_2 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
16:59.38jonprymmmm BBQ
16:59.45*** join/#htc-linux rob_w (~bob@host-188-174-143-194.customer.m-online.net)
16:59.46*** join/#htc-linux rob_w (~bob@unaffiliated/rob-w/x-1112029)
17:02.46detulejonpry this I assume tells me the available pages http://pastebin.com/uK5K8yPr
17:03.04detuleso presumably i can steal 32 of those pages for ram_console?
17:03.47Alex[sp3dev]jonpry: you may or may not be interested but omapflash sources are available. seems a PITA to port them to linux, though, but that's allow to easily reflash even without fastboot https://gforge.ti.com/gf/project/flash/scmsvn/
17:05.23jonprypfn shift thing is 12?
17:06.20detuleyes
17:06.40jonpryi think anywhere not in a hole will work
17:06.59jonpryexcept near 0x80200000
17:07.04detulealright the holes i assume are things the kernel has memblock reserved
17:07.17detulegot it, that's where the kernel is loaded
17:08.02detuleso do I need to reserve my ram_console pages, or ioremap make sure the ram_console pages don't get overritten
17:09.08*** join/#htc-linux helicopter88 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
17:10.00jonpryreserve it somehow
17:11.38jonpryyou have reserve_bootmem()?
17:12.41detulei see that api yes
17:13.44jonprylooks like that can be used in boards map_io()
17:21.38*** join/#htc-linux helicopter88 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
17:23.15*** join/#htc-linux Kookstar (~Kookstar@p4FFF2AE1.dip.t-dialin.net)
17:29.07zeuskDo Qualcomm's scorpion and krait follow standard implementation of cp15 c0, c0 (main id register)
17:29.20zeuski want to identify cpu architecture at runtime
17:32.30*** join/#htc-linux gauner1986 (~Miranda@89.204.137.25)
17:41.02jonpryAlex[sp3dev], will that work on HS devices?
17:44.22Alex[sp3dev]jonpry: yes, provided that you have the signed xloader/uboot. there are packaged versions of omapflash for galaxy nexus and i9100G both of which are HS. so, basically, you only need the signed loader
17:44.51zeuskAlex, galaxy nexus is A9MP based omap cpu right ?
17:45.22Alex[sp3dev]jonpry: look for OMAPFLASH_tuna.zip if you want to have a look at a pre-compiled package
17:45.31Alex[sp3dev]zeusk: yes, omap4460
17:48.44zeuskis even omap using the the epic fail SCU in A9MP ? (snoop control unit)
17:50.29jonpryi'm not sure how useful that will be since there is no reason to flash any of the secure stuff on d3
17:52.01Alex[sp3dev]jonpry: gnex is a security fail - the signed xloader doesn't verify SBL signature. since we're replacing SBL with uboot, we need omapflash for recovery
17:54.08Cotullafail
17:54.29Cotullahow often u fails alexx?
17:55.34Alex[sp3dev]Cotulla: it's not my fault, it's samsung who left a security hole we can abuse
17:55.51CotullaI got that
17:55.53jonpryi fail w/ padconf still
17:56.03Alex[sp3dev]and yeah, I now have camera working when booting with uboot since I fixed pinmux
17:56.09Cotullawhat is it jonpry?
17:56.21Alex[sp3dev]Cotulla: gpio mux
17:56.34Cotullapadconf?
17:56.35jonpryi'm trying to change the mux and it changes back all by itself
17:56.43Cotullamaybe RO?
17:56.50jonprynah it works for a minute
17:56.55Cotulla:O
17:56.57Cotullaso
17:57.00Cotullau know solution ^^
17:57.08jonpryblast it?
17:57.09Cotullasetup timer for 500 ms
17:57.15Alex[sp3dev]windows way
17:57.19Cotullano
17:57.20zeusklol
17:57.21Cotullachina way
17:57.42Cotullajonpry, did u try to keep it for 5 minutes without interrupts or so?
17:57.48Cotullato check if it's not hardware problem
17:58.08jonpryi don't understand
17:58.17jonpryi can't disable interrupts for 5 minutes
17:58.19Alex[sp3dev]maybe it jumps to the secure world and pwns you?
17:58.32Cotullaturn off interrupts -> config -> wait for 2 minutes -> check the state
17:58.42Cotullais it MSM8960 thing?
17:58.49jonpryomap4430
17:59.02jonpryif i turn off interrupts the watchdog will reboot the phone
17:59.10Cotullahm
17:59.15Alex[sp3dev]turn off the watchdog
17:59.16Cotullau can touch watchdog in loop
17:59.22Cotullaor disable it
17:59.58jonprymaybe
18:00.19jonpryi want to unmap a 1mb super section
18:00.27jonpryat 0x4a10 0000
18:00.34Cotullaso it's simple
18:00.41jonpry4u maybe
18:00.44Cotullajust take PTE
18:00.47Cotullaand
18:00.47Cotullathen
18:00.58Cotullapte[0x4a100000 >> 20] = 0;
18:01.08CotullaI believe it has only one global PTE right?
18:01.12Cotullaat BASE + 0x8000
18:01.18Cotulla*at BASE + 0x4000
18:01.21Cotulla*at KERNEL_BASE + 0x4000
18:01.35jonpryso 0x82004000
18:01.36Cotullatry it
18:01.47Cotullabut before dump it
18:02.02jonpryso iormap the pte?
18:02.14Cotullano use kernel address directly
18:02.23Cotulla*(uint32_t)(0x82004000 + 4 * 0x4A1) = 0
18:02.24Cotullashould be
18:02.36Cotullawait
18:02.42jonprybut that is just a vaddr
18:02.45Cotullais 0x4a100000 VA?
18:02.47Cotulla:O
18:02.54jonpry4a1 phys
18:02.59Cotullaoh
18:03.03Cotullaso get VA
18:03.11jonpryload is 0x8200 0000 phys
18:03.26Cotullabut u need VA for access
18:03.31Cotullahow it's mapped btw?
18:03.35Cotullaat the start up time?
18:03.41CotullaI mean 0x4a100000
18:03.50jonpryyeah iotables_init
18:04.29jonprylots of things seem to have there own mapping for whatever reason
18:04.42jonprybut i was able to zonk most of them
18:05.14Cotullacan u disable that mapping to see who access it?
18:05.34jonprythat is what i'm trying to do
18:05.39Cotullaat the start up time
18:05.48jonpryits a secure kernel so this is a runtime patch
18:05.58Cotullaoh
18:06.00Cotullaso
18:06.10Cotullado u know PA -> VA for that address?
18:06.23jonpryi can get the va
18:06.31Cotullais it inside kernel space?
18:06.45jonpryyes. 0xf8c10000 or so
18:06.55Cotullawhat is VA address of 0x8200 0000?
18:07.09Cotullais it 0xC000 0000?
18:07.11jonprywell that i don't know how to find
18:07.19Cotullado u have kernel config ?
18:07.29jonpryits 3g/1g split
18:07.29jonpryyes
18:07.39CotullaCONFIG_PAGE_OFFSET=0xC0000000
18:07.49Cotulladunno about 3.X.X but in 2.X.X it was here
18:07.53Cotullalook
18:08.16jonpry0xc000000
18:08.20Cotullaok
18:08.52Cotullawait 0xf8c10000 is not section . . .
18:09.28Cotullashould be coarse
18:09.29jonpryi'll get the address
18:09.41Cotullaok
18:12.29jonpry0xfc100000
18:13.24Cotullacan be section
18:13.26Cotullaso check at
18:13.39Cotullavalue at (0xC000 4000 + 4 * 0xFC1)
18:13.48Cotullaread it
18:16.10Cotullabut what  about aliases?
18:16.14Cotullamaybe it's mapped to user space?
18:18.00jonpryPTE Was 0x4A100412
18:18.16Cotullahm
18:18.28Cotullait's ur crappy 0x4a100000
18:18.29Cotullareally
18:18.33Cotulla402 is uncached
18:18.37Cotullaand 10 is XN I think
18:18.41Cotullaor shared
18:18.48Cotullawell try to put ZERO there
18:18.57Cotullathen do tlb clear
18:19.01Cotullaflush
18:19.06Cotullamaybe u need also dflush
18:19.36Cotullaalso u can try to write there something to check if it will crash
18:19.42Cotullawrite after PTE change
18:21.59jonpryno crash yet
18:23.26Cotulla? tlb flush, dcache flush?
18:23.57jonprylike local_flush_tlb_all()?
18:24.10Cotullayes
18:25.22*** join/#htc-linux helicopter88 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
18:28.42jonprykernel doesn't export flush_cache_all
18:29.05*** join/#htc-linux mes (~mes@S0106000ce55186df.cc.shawcable.net)
18:30.17Cotullaso copy it
18:30.18Cotullaby hands
18:30.41jonpryworking on it
18:33.48jonprycan i just call  v7_flush_kern_cache_all?
18:33.58Cotullamaybe
18:34.05Cotullatry
18:34.20Cotullamaybe u should start from TLB flush
18:34.23Cotullamemory can be uncached
18:34.39Cotullatry to dump from 0xC000 0000 + 4 * 0xC00 and look
18:35.25jonpryi think that function is not safe to call from C. it corrupts r0-r7 and r9-r11
18:38.09Cotullashould be
18:38.31Cotulladump entry
18:38.35zeusk... ldmfdsp!, {r4-r5, r7, r9-r11, lr}
18:38.36Cotullaand try with tlb flush only
18:38.45zeuskit saves to stack and loads back, should be sage
18:39.11zeusks/sage/safe/
18:40.23jonpryhow many tlb entries do you want?
18:41.21Cotulla?
18:41.25Cotullaflush full  - it's better
18:41.55jonpry<Cotulla> try to dump from 0xC000 0000 + 4 * 0xC00 and look
18:42.16zeusklol, 4096 entries..
18:42.26Cotullaok 4 nytes'
18:42.29Cotullabytes'
18:42.44jonpryyou want all?
18:42.50Cotulla4 bytes
18:42.53Cotullaone entry
18:43.00Cotulla0xC000 0000 + 4 * 0xC00
18:43.04zeuskoh
18:43.09Cotullawe will know if PTE cached
18:43.32Cotulladon't forget about ISB and DSB alos
18:43.50jonpry0x8001140E
18:43.56Cotullacached
18:44.03Cotullau need cache flush
18:44.24jonpryi added it
18:44.29Cotullatlb flush also?
18:44.29jonpryno crash
18:44.33jonpryyes
18:44.40jonprytlb before cache?
18:44.41Cotullatlb flush after cache flush?
18:44.57jonpryno
18:45.01Cotullaand put DSB ISB also
18:45.05Cotullato be sure no reordering
18:46.56jonpryi don't think it can reorder function calls
18:47.25Cotullaoutstanding memory writes can be
18:47.25zeuskmemory operation can be re-ordered if it's not strongly ordered
18:48.20jonpryi got a crash but i think i caused it
18:48.27Cotulla?
18:48.31Cotullacheck PC
18:51.07jonpryyeah it was me
18:51.22*** join/#htc-linux helicopter88 (~helicopte@host167-116-dynamic.55-79-r.retail.telecomitalia.it)
18:51.33Cotullawhat ?
18:51.38Cotullaa test write?
18:51.48Cotullapte entry zerofilling?
18:51.50jonpryno i loaded the module twice
18:51.53Cotullalol
18:51.56Cotulla:(
18:52.16jonpryso first it sets up padconf and then disables padconf writing
18:52.26Cotullaok
18:52.46Cotullau can try to memset(0xC0004000, 0, 0x4000); :D
18:52.48Cotullato be sure
18:55.20jonpryi guess someone must have an alias?
18:55.33jonpryi blame all things on hwmod
18:55.49Cotullawait
18:55.53Cotullamaybe this PTE not used
18:56.30jonpryyeah i think that is possible
18:56.38Cotullashow code
18:56.49jonprymy code or the rest of the kernel
18:56.50Cotullau don't forgot volatile and etc?
18:57.00Cotullaur test code
18:57.27Cotullaalso u can read TTBR0 and TTBR1
18:57.35Cotullato know where PTE is
18:57.49jonpryhttp://pastebin.com/cVSj2C1G
18:58.00jonpryit's horrible
18:58.06jonpryi can barely look at it
18:59.22Cotulla0xFC1 can be differnet after reboot?
18:59.47jonpryno
19:00.02jonpryits hard coded. they use macros for hardware access
19:00.24Cotullawait where is *(volatile uint32*)0xFC10 0000 = 0; ?
19:00.27Cotullaas test
19:00.52Cotullaput after  flush_tlb_all_ptr(); to test
19:01.18jonpryloading the module twice has essentially the same effect
19:01.31Cotulla?
19:01.37Cotullajust to be sure
19:01.38jonprywrite_omap_mux_register() writes to 0xfc10 0000
19:01.43jonpryand it blows up
19:02.05Cotullaso basic idea is working
19:02.18jonpry<4>[ 1285.231048] [<c0046bec>] (__dabt_svc+0x4c/0x60) from [<c006bf78>] (omap_readw+0x4/0xc)
19:02.19jonpry<4>[ 1285.231079] [<c006bf78>] (omap_readw+0x4/0xc) from [<bf00f458>] (write_omap_mux_register+0x3c/0x5c [board_mapphone_emu_uart])
19:02.35Cotullaso should be alias or hardware?
19:03.09jonpryi suspect this may all stop if i can somehow shutdown the usb port
19:04.07jonpryi think it has some kind of internal power management crud where its constantly going in and out of some state that causes the pins to get remuxed
19:05.07*** join/#htc-linux bzo (~chatzilla@c-71-196-133-131.hsd1.co.comcast.net)
19:06.21Cotullawhat about docs?
19:10.24jonpryi think its code in the kernel
19:10.32jonpryso must be an alias
19:11.28jonprythe usb controller is some core they bought from mentor graphics. there aren't really and docs for it.
19:12.07jonpryanyways thanks cotulla
19:13.49Cotullahm
19:13.54Cotullau may scan table
19:13.55Cotullaby hands
19:13.57Cotullaand find them
20:14.13*** join/#htc-linux jonpry (~jon@c-24-17-200-206.hsd1.wa.comcast.net)
20:22.57*** join/#htc-linux BabelO (~wdlxtv@AMontpellier-553-1-168-32.w92-133.abo.wanadoo.fr)
20:47.03*** join/#htc-linux Bry8Star{EB (Bry8Star-@2607:f128:42:fb::2)
21:00.59*** join/#htc-linux skodde (~skodde@unaffiliated/skodde)
21:40.22zeuskwhat will happen if my first virtual mb is unmapped ? will a null dereference behave differently ? (data abort ?)
21:42.49*** join/#htc-linux MethoS- (~clemens@134.102.106.250)
21:50.27*** join/#htc-linux MethoS- (~clemens@134.102.106.250)
21:51.52*** part/#htc-linux Cotulla (~myfakemai@nat100-255-205-109.tvoe.tv)
22:36.04*** join/#htc-linux raymonddull (~raymonddu@c-69-245-114-102.hsd1.mi.comcast.net)
23:23.50*** join/#htc-linux detule (~detule@unaffiliated/d3tul3)
23:34.47detulejonpry, something like this? http://pastebin.com/93AkWcgL
23:37.04jonpryis that the .map_io ?
23:38.36detulei think this is in the machine_init
23:39.19jonpryi think there are some requirements about when reserve_bootmem can be called
23:53.55detuleoh the machine has a reserve handle
23:54.04detuleprobably it's meant to go in there

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.