**** BEGIN LOGGING AT Sat Apr 25 02:59:57 2009 Apr 25 03:02:38 cool Apr 25 03:22:48 heh i dont know squat Apr 25 03:23:18 ive been paging through the pxa developers manual Apr 25 03:23:41 you need to read the arm dev manuals as well Apr 25 03:23:59 pxa will tell you about those processors but not much about arm itself Apr 25 03:26:04 asm volatile ("mcr p15, 0, %0, c3, c3, 0" : : "r"(0xffffffff) ); Apr 25 03:26:19 is that second c3 a typo? Apr 25 03:26:54 asm volatile ("mcr p15, 0, %0, c3, c0, 0" : : "r"(0xffffffff) ); Apr 25 03:27:02 whats the difference? Apr 25 04:21:20 memory protection is not being disabled ugh :( Apr 25 04:21:25 wtf Apr 25 04:31:09 ok so i can at least dump memory from the usb console now Apr 25 04:31:13 yay Apr 25 05:57:56 usb console? Apr 25 06:53:42 tmzt: probably cocoboot feature Apr 25 07:36:48 hi all Apr 25 12:21:38 hey Apr 25 12:22:11 can i get help with psp hacks in here? Apr 25 19:48:34 mpannen: hi, sorry I wasn't here yesterday Apr 25 19:48:39 mpannen: how's it going ? Apr 25 19:49:18 bluelightning: hi ... I saw a few commits to opie recently, how's it going with it ? Apr 25 19:49:37 Marex: hey Apr 25 19:50:01 ok I guess, haven't been working on it as much as I probably should be Apr 25 19:50:27 datebook2 is almost finished though :) Apr 25 19:50:56 oh, so you are still working on it, that's good Apr 25 19:51:08 but it starts to seem like we are kind-of lonely warriors here :/ Apr 25 19:53:03 bluelightning: is there anyone besides you working on opie ? Apr 25 19:53:29 Marex: no, haven't heard anything from anyone else lately Apr 25 19:53:44 hrm ... that sucks :/ Apr 25 19:53:54 I'd love to have some help of course, but it seems nobody's interested in directly working on Opie Apr 25 19:54:06 HnD is hitting that stage too .. it's only me and sleepwalker recently hacking on Palms Apr 25 19:54:42 I guess everyone gets busy with other things after a while Apr 25 19:54:57 how are things with you? university going well? Apr 25 19:55:41 bluelightning: somehow yes ... examination period is near again and then two months of holiday Apr 25 19:55:52 of course that'll be dedicated mostly to HnD Apr 25 19:56:05 or maybe hacking on some other handhelds ... I have no other plans Apr 25 19:57:12 bluelightning: I still have FSC Loox N560 which needs some work to be properly supported Apr 25 19:57:23 also, there is HP hw6515d which isn't properly supported Apr 25 19:58:18 there's always another machine to support :) Apr 25 19:58:19 bluelightning: how's it going on your end ? Apr 25 19:58:43 bluelightning: yea ... that's why I keep wasting my time with this ... because there always is something to patch in kernel Apr 25 19:59:22 ok, keeping busy with work... been on a few trips since christmas although so far I haven't travelled as much as I had expected to Apr 25 19:59:42 bluelightning: when are you planning to visit us here in .cz ? ;D Apr 25 19:59:57 Marex: one day real soon now :) Apr 25 20:00:30 oh I managed to give away all those h3600s too :) hope it helps get them supported Apr 25 20:00:44 cool, be sure to let me know when you arrive :) Apr 25 20:00:53 will do :) Apr 25 20:00:57 hm, 3600s, those are pretty ancient Apr 25 20:01:05 indeed Apr 25 20:01:16 maybe I could get some too, but not now Apr 25 20:01:19 advantage is they are cheap and still easy to find on ebay though Apr 25 20:02:33 I use "aukro" here ... it's similar, but smaller, much smaller scale Apr 25 20:02:54 (and I use "kEdAR" - the Palm collector) Apr 25 20:03:12 hrm, maybe "use" isn't really appropriate word Apr 25 20:03:22 he just lent me some devices so I can hack on them :) Apr 25 20:03:28 *he = kedar Apr 25 20:03:49 he already has about 50 pcs of Palms ... Apr 25 20:04:28 wow, and I thought I had a few devices... Apr 25 20:04:49 well he has even the ancient once (b/w, m68k) Apr 25 20:04:52 s/once/ones/ Apr 25 20:04:58 they can't run linux at all Apr 25 20:05:11 I had one of those, a palmpilot pro Apr 25 20:05:17 my first handheld :) Apr 25 20:05:23 back in 1997 Apr 25 20:05:27 hi marex, havent got anywhere with the phone lol Apr 25 20:05:42 bluelightning: yes, that's one of the first ones :) Apr 25 20:06:04 mpannen: you mean t755p ? hmm, can't you supply use with one unit ? it looks interesting Apr 25 20:06:17 i can use the usb console to read parts of memory Apr 25 20:06:40 heh wish i had an extra one Apr 25 20:06:43 the one in cocoboot ? Apr 25 20:06:44 good Apr 25 20:06:49 yeah Apr 25 20:07:01 no clue Apr 25 20:07:04 mpannen: does t755p have a led ? Apr 25 20:07:08 i havev a question for u Apr 25 20:07:12 go ahead Apr 25 20:07:23 yes it has an led Apr 25 20:07:32 about an assembly instruction Apr 25 20:07:44 try finding out if you can switch it on/off through some GPIO Apr 25 20:08:29 if you can, you can try tracing where cocoboot hangs Apr 25 20:08:54 asm volatile ("mcr p15, 0, %0, c3, c3, 0" : : "r"(0xffffffff) ); Apr 25 20:09:13 that is the memory unlock instruction right? Apr 25 20:09:24 asm volatile ("mcr p15, 0, %0, c3, c1, 0" : : "r"(0xffffffff) ); Apr 25 20:09:35 hang on Apr 25 20:09:38 whats the difference between those two? Apr 25 20:11:29 i mean, looking at the pxa devel manual it looks like the second one is the proper line, but ive seen a mixture of both in the source for cocoboot Apr 25 20:12:46 so i would have the led blink different patterns for each part of the code that is being executed Apr 25 20:13:22 I have to check the book, hang on Apr 25 20:13:37 ok no hurry i just wanted to bring that up Apr 25 20:13:51 mpannen: here's a better idea ... you said it resets when you hit boot, right ? Apr 25 20:14:37 yes Apr 25 20:14:46 put "for(;;);" into the arm/boot.c:boot_linux() Apr 25 20:14:52 that's an endless loop Apr 25 20:15:01 if it hangs, push it further etc. Apr 25 20:15:05 ahhhh Apr 25 20:15:06 ok Apr 25 20:15:40 ive seen someone else post something like that,,,i just wasnt sure where to put that in amongst all of the files Apr 25 20:15:56 sweet ill give that a try Apr 25 20:16:21 try line 131 ... right before irq_off(); Apr 25 20:17:36 also, any idea why the git server isnt responding? Apr 25 20:17:55 looks like a bunch of stuff has been taken down on the source code part of the web site? Apr 25 20:18:13 the domain is being moved Apr 25 20:18:17 farcaller: ping ^ Apr 25 20:19:08 currently only git.hackndev.com is moved. If there's anything alse inaccessible - that's abug Apr 25 20:19:18 ahh' Apr 25 20:19:31 is there a new name? Apr 25 20:19:51 well just the git repositories were missing from the site Apr 25 20:20:11 you can clone old repos from thor.hackndev.com via git:// until all of them are moved Apr 25 20:20:24 (same url syntax as before) Apr 25 20:21:10 Marex: do you know what linux trees are actually useful? we have three of them Apr 25 20:21:29 ato/linux-2.6-arm, linux-2.6, linux-hnd Apr 25 20:21:35 farcaller: see RTFM.txt in the topic Apr 25 20:21:37 those are useful Apr 25 20:22:08 farcaller: but if you want to avoid CristianoP whining about his code, preserve them Apr 25 20:22:14 even four - new hackndev/arm-linux is there on frigga Apr 25 20:22:21 XD Apr 25 20:23:24 also there's cocoboot, tools and a bunch of old/* stuff Apr 25 20:23:47 cocoboot is active Apr 25 20:23:52 preserve that all Apr 25 20:24:11 ato/linux-2.6 contains some useful stuff iirc Apr 25 20:24:17 linux-hnd is needed by OE Apr 25 20:24:31 linux-2.6 ... who knows, isn't that your creation ? Apr 25 20:24:46 definitely not mine Apr 25 20:25:00 farcaller: definitelly yours ;-) Apr 25 20:25:36 if you say so :p Apr 25 20:25:51 I felt like arguing ... damn :/ Apr 25 20:28:49 * farcaller moved cocoboot over to frigga Apr 25 20:36:48 marex:the pone reset with the loop just before irq_off in boot.c:boot_linux() Apr 25 20:38:13 that's very weird Apr 25 20:39:09 mpannen: well ... try putting the loop at line 109 Apr 25 20:40:23 ok' Apr 25 20:40:32 it loooped at line 94 :) Apr 25 20:40:35 heh Apr 25 20:40:50 mpannen: well ... try tracing it this way Apr 25 20:40:59 pinpoint where it resets Apr 25 20:41:00 ill try 109 next Apr 25 20:41:07 yea, bisect it Apr 25 20:42:18 i am assuming the only way to get out of the loop is to yank the battery :) Apr 25 20:43:00 yup Apr 25 20:43:29 you can set WDT, but that'd take longer than this way Apr 25 20:45:14 a for loop at line 109 caused a reset Apr 25 20:45:54 maybe virt_to_phys is broken ? Apr 25 20:46:10 see line 103 ... try looping before that and after that Apr 25 20:47:01 i will insert a loop after line 102 right now Apr 25 20:51:12 it did not reset with a loop inserted after line 102 Apr 25 20:53:11 mpannen: what about after line 103 ? Apr 25 20:53:19 (after kernel = (void *)... ) Apr 25 20:53:52 oh my line numbers are different ive been commenting out the for loops Apr 25 20:53:53 hehe Apr 25 20:54:20 i will put one there right now Apr 25 20:54:21 use "u" ;-) Apr 25 20:54:24 (undo in Vim) Apr 25 20:57:05 it resets with a loop just after kernel=void Apr 25 20:57:50 damn Apr 25 20:58:42 mpannen: I think I have bad news for you ;-) Apr 25 20:58:57 its still broken? Apr 25 20:59:12 haha Apr 25 20:59:35 no kernel for me! Apr 25 20:59:50 well see virt_to_phys() for yourself Apr 25 21:00:00 ok, try this (lemme think) Apr 25 21:00:16 my pphone is completely virtual? Apr 25 21:00:23 put this at boot.c:90 Apr 25 21:00:42 return virt_to_phys(g, 0x98000000); Apr 25 21:01:54 ok, where does that result go back to? Apr 25 21:02:03 you'll see it in cocoboot Apr 25 21:02:17 iirc "Returned: " will appear Apr 25 21:02:24 ahhh Apr 25 21:02:53 i supopose u know what should be returned? Apr 25 21:04:20 not at all Apr 25 21:04:34 I just guess what it'll be Apr 25 21:04:40 does it work or does it just reset Apr 25 21:04:40 ? Apr 25 21:05:08 one sec Apr 25 21:05:26 big fat reset Apr 25 21:05:47 dang ... Apr 25 21:06:00 see boot/arm.c:257 ... good luck ;) Apr 25 21:08:00 wtf is all of that?!?! Apr 25 21:08:01 haha Apr 25 21:08:25 TTB resolver Apr 25 21:09:03 should i just start adding loops? Apr 25 21:09:17 you should fix it ;) Apr 25 21:09:21 haha Apr 25 21:09:42 better grab an arm assembly book Apr 25 21:10:04 that's C Apr 25 21:10:12 that too Apr 25 21:10:17 try one more thing Apr 25 21:10:40 boot.c:86, put there return (UInt32)(g->ttb); Apr 25 21:11:57 what does it return Apr 25 21:11:57 ? Apr 25 21:12:03 or errr ... Apr 25 21:12:20 something else? Apr 25 21:12:39 yes Apr 25 21:12:47 I need to find some working Palm, hang on Apr 25 21:15:28 mpannen: so, run cocoboot, disable memory protection and then select "Memory" from menu Apr 25 21:15:31 send me it's content Apr 25 21:15:44 ok Apr 25 21:16:05 we modified the memory size so it will always say 64mb Apr 25 21:16:09 one sec Apr 25 21:17:10 RAM base: 0xa0000000 Apr 25 21:17:39 Size: 64mb (0x1b00000) Apr 25 21:17:58 Phys TTB: 0xa1ffc000 Apr 25 21:18:13 Virt TTB: 0x1ffc000 Apr 25 21:18:15 what?! Apr 25 21:18:28 well here's the problem Apr 25 21:18:28 thats what it says Apr 25 21:18:58 heh Apr 25 21:19:04 i like your response Apr 25 21:19:48 well the problem is with TTB somewhere where it shouldn't be, but I dunno how to fix it yet Apr 25 21:21:45 i think i need to google what a ttb does exactly, obviously it has to do with memory mapping? Apr 25 21:22:16 yes, memory translation table Apr 25 21:24:16 try arm.com -> documentation -> arm architecture -> reference manuals -> armv5 -> PDF version Apr 25 21:27:29 mpannen: does T755p by any chance have 64Mb of RAM ? Apr 25 21:30:11 im back Apr 25 21:30:58 the phone itself is reporting 62.8 mb Apr 25 21:31:08 so i guess it is 64mb Apr 25 21:31:25 free space 46.6mb of 62.8mb Apr 25 21:36:20 hm ... it's still weird Apr 25 21:36:30 are you sure that thing's xscale ? Apr 25 21:37:52 the palm treo 755p is an xscale pxa something Apr 25 21:39:04 Intel PXA272 312MHz Apr 25 21:39:35 hmm Apr 25 21:39:42 Palm OS 5.4.9 Apr 25 21:40:05 I see ... still, hmmm Apr 25 21:43:25 mpannen: well ... do you have armarm.pdf (or 14128.pdf) handy already ? Apr 25 21:43:32 (from the website above) Apr 25 21:44:18 yes Apr 25 21:44:28 it has a single ttb right? Apr 25 21:44:33 yes Apr 25 21:44:49 try dumping that address then Apr 25 21:44:51 im looking at b.4.7.1 Apr 25 21:44:53 see what it really contains Apr 25 21:45:02 that 0xa1ffc000 Apr 25 21:45:06 ok Apr 25 21:45:18 ill fire up the usb console and dump it Apr 25 21:48:12 0xa1ff9001 Apr 25 21:48:53 that's weird Apr 25 21:48:58 try dumping 0xa0004000 Apr 25 21:49:03 what does that mean? Apr 25 21:49:04 ok Apr 25 21:49:41 0x00000000 Apr 25 21:50:03 all zeroes' Apr 25 21:50:19 well 0xa0004000 is TTB address on most palms (and most Xscale devices) Apr 25 21:50:25 hm ... something's wrong Apr 25 21:51:23 should a try too dump those with haret? or will they be the same Apr 25 21:51:37 you can try Apr 25 21:51:47 I cant get T755p here Apr 25 21:51:58 it's CDMA and they dont sell it here at all Apr 25 21:53:07 same results Apr 25 21:53:24 try dumping a bit further Apr 25 21:53:29 0xa0004004 Apr 25 21:53:30 0xa0004008 Apr 25 21:53:31 0xa000400c Apr 25 21:53:33 0xa0004010 Apr 25 21:53:35 etc. Apr 25 21:57:32 well when i got to 0xa0004018 it reset Apr 25 21:57:42 all were zeroes Apr 25 21:58:38 um Apr 25 21:58:47 try doing the same at 0xa1ffc000 Apr 25 21:59:05 but we're really deep in darkness here Apr 25 22:00:13 a1ffc004=0 Apr 25 22:00:22 a1ffc008=0 Apr 25 22:00:32 f*ck, da**it, sh*t Apr 25 22:00:41 a1ffc00c=0 Apr 25 22:00:45 that's enough Apr 25 22:00:50 something's wrong here Apr 25 22:01:02 mpannen: try one more thing ... try reading from 0x4000 Apr 25 22:01:27 these are virtual addresses that i can enter diredtly right? Apr 25 22:01:39 i dont need to add something? Apr 25 22:02:28 for instance, the lcd0 is 04000000, but really 94000000 Apr 25 22:02:28 nope Apr 25 22:02:41 maybe RAM is mapped to 0x0 Apr 25 22:02:43 that happens Apr 25 22:02:47 so TTB would be at 0x4000 Apr 25 22:02:50 give it a go Apr 25 22:03:57 dump 00004000: c76fb88a49d7b3d7 Apr 25 22:04:11 haret you have sucks Apr 25 22:04:16 o Apr 25 22:04:19 one sec Apr 25 22:04:23 well it displays some garbage ;) Apr 25 22:06:39 00004000: c76fb88a Apr 25 22:06:53 using cocoboot console mw command Apr 25 22:08:04 still, that's weird Apr 25 22:08:13 what should it be? Apr 25 22:08:28 it should end with ...c1a or something Apr 25 22:08:34 try 0x01ffc000 Apr 25 22:08:42 that's the last option Apr 25 22:09:26 phone reset Apr 25 22:10:12 it actually makes sense that the TTB can be there Apr 25 22:10:25 retry it again, but disable memory protection first Apr 25 22:10:31 if the co processor returns the address of the ttb why wouldnt it be right? Apr 25 22:10:55 the problem is we cant access it probably Apr 25 22:10:57 shit i think i forgot that part Apr 25 22:11:39 it we can unblock access there, we're fine Apr 25 22:12:08 I'll be back in about 10 mins, gotta finish my prep for exam Apr 25 22:12:48 even after disabling memory protection using the menu option, trying to read that address reset the device Apr 25 22:12:54 ok Apr 25 22:14:32 is the ttb read by normal memory access? Apr 25 22:14:45 yes, it's just normal piece of memory Apr 25 22:15:00 looks into ARMARM if there isnt some additional memory protection option Apr 25 22:16:39 also, see PXA27x devman (can still be found at gumstix.com somewhere iirc) Apr 25 22:19:41 http://pubs.gumstix.com/documents/ here you go Apr 25 22:22:04 ive got em, i was reading up on the co processors in the dev manual Apr 25 22:22:12 good Apr 25 22:22:14 interesting Apr 25 22:22:53 i thought i found a typo in the memory protection code Apr 25 22:22:59 not sure Apr 25 22:23:44 sm volatile ("mcr p15, 0, %0, c3, c3, 0" : : "r"(0xffffffff) ); Apr 25 22:23:48 a Apr 25 22:23:53 in arm.c Apr 25 22:24:05 i thought the second c3 should be c0 Apr 25 22:24:13 but not sure if that mattered Apr 25 22:24:52 iirc it shouldnt matter what's the second argument in case of cp15:r3 Apr 25 22:24:57 but give it a go Apr 25 22:25:00 oh Apr 25 22:25:01 ok Apr 25 22:25:05 thats ok then Apr 25 22:26:16 i see something about data access permissions in ARMARM, does that apply to memory reads? Apr 25 22:26:33 which page ? Apr 25 22:27:24 760 Apr 25 22:27:59 maybe the xscale doesnt impliment protected memory Apr 25 22:28:30 xscale is armv5, that should have it Apr 25 22:28:49 ok Apr 25 22:29:56 cp15 register 5 for memory access permissions? Apr 25 22:31:25 yes ... looks like so Apr 25 22:31:30 try it Apr 25 22:32:02 wtf the pxa dev manual says cp15 reg 5 is a fault status register Apr 25 22:35:06 read about that protected memory system architecture Apr 25 22:35:24 pg 775 of the ARMARM more about pre v6 memory protection Apr 25 22:37:00 mpannen: I'm still integrating using the spheric substitution method ... gimme a little more time ;) Apr 25 22:37:32 ok, im gonna go integrate some food in my mouth Apr 25 22:37:34 haha Apr 25 22:37:50 be sure to do it in three dimensions ;) Apr 25 22:39:25 im gonna do 4d Apr 25 22:58:23 i cant be looking at the right thing, i think the mpu applies to armv6, not armv5 Apr 25 23:06:32 MPU should be v5 too (which is prePMSA6) Apr 25 23:09:31 also, there is mention of vmsav6 Apr 25 23:10:13 VMSAv6, dont know what version of the virtual memory architecture the xscale uses Apr 25 23:11:33 v5 I think, see pxa manual Apr 25 23:12:09 yeah must be v5 arm, with VMSAv6 Apr 25 23:12:45 this goes beyond me (at least now, I'm still integrating) Apr 25 23:40:11 mpannen: ok, done ... any progress on your end ? Apr 25 23:42:12 mpannen: I think PXA doesn't have PMSA Apr 25 23:42:46 just reading the armarm Apr 25 23:46:17 mpannen: see pg. 689 Apr 25 23:46:50 try reading cp15 r0 with opcode2 = b100 (MPU type register) Apr 25 23:50:14 maybe see bit 8 and bit 9 of CP15 r1 with opcode2 = b000 ... Apr 25 23:53:34 maybe have to flush the table as well to clear previous permissions? Apr 25 23:56:21 you can try it, but dunno Apr 26 00:01:53 mpannen: maybe you have to flush TLB Apr 26 00:02:22 (sorry, it's too late here, I'm braindead) Apr 26 00:02:30 looks like there is a flush_caches() defined Apr 26 00:02:33 for that Apr 26 00:02:45 yup, it's already there Apr 26 00:05:15 add those: Apr 26 00:05:17 asm volatile ("mcr p15, 0, r0, c7, c7, 0" : : : "r0"); Apr 26 00:05:24 asm volatile ("mcr p15, 0, r0, c8, c7, 0" : : : "r0"); Apr 26 00:05:40 to arm.c:82 Apr 26 00:05:51 and try rereading the memory location that was unreadable Apr 26 00:06:10 err ... add also CPWAIT Apr 26 00:14:55 flush cache? should add access permission changes? or does the domain register modification take care of that? Apr 26 00:16:36 just append it at the end of the code that's there Apr 26 00:17:11 81 case ARM_unlock_mem: Apr 26 00:17:11 82 asm volatile ("mcr p15, 0, %0, c3, c3, 0" : : "r"(0xffffffff) ); Apr 26 00:17:14 83 asm volatile ("mcr p15, 0, r0, c7, c7, 0" : : : "r0"); Apr 26 00:17:17 84 asm volatile ("mcr p15, 0, r0, c8, c7, 0" : : : "r0"); Apr 26 00:17:19 85 CPWAIT Apr 26 00:17:22 86 Apr 26 00:17:24 87 ret = 0; Apr 26 00:17:27 like this Apr 26 00:17:30 ok Apr 26 00:17:58 "r0" Apr 26 00:18:13 "r0" what does that do? Apr 26 00:18:33 asm volatile ("mov r0, #0" : : : "r0"); Apr 26 00:18:38 this one is missing there ;) Apr 26 00:18:54 but be sure to backup r0 before doing it and then restore it Apr 26 00:21:23 "mcr p15, 0, %0, c7, c7, 0" : : "r"(0x0) Apr 26 00:21:29 would that work? Apr 26 00:22:26 I'm not sure if r0 doesnt have special meaning there Apr 26 00:23:05 just drop that mov r0 #0 before accessing c7 and see what happens Apr 26 01:51:13 http://marex.hackndev.com/status/ :-) **** ENDING LOGGING AT Sun Apr 26 02:59:57 2009