| 00:00.05 | stefan_schmidt | The bootloader now reads the magic and enters a special mode. Passthrough. |
| 00:00.45 | stefan_schmidt | This wires up some of the GPIO directly from the usb plug to usb connection on the Baseband processor. |
| 00:01.34 | stefan_schmidt | At this point you can talk to the BP as if you were the AP. (Of course without the additional GPIO connections) |
| 00:02.09 | letoto | but from an external device on the usb? |
| 00:02.12 | stefan_schmidt | This would help us to test and debug our mux_cli driver. This one is needed for AT commands to tha BP. |
| 00:02.25 | stefan_schmidt | right. You host pc normally. |
| 00:02.57 | stefan_schmidt | One actual problem is, that the phone also power phone in this mode after some time. |
| 00:03.12 | letoto | eh? |
| 00:03.18 | letoto | the phone also power cycles in this mode? |
| 00:03.35 | stefan_schmidt | yes, power off. |
| 00:03.42 | stefan_schmidt | This driving me nuts. |
| 00:03.53 | letoto | ah |
| 00:04.24 | stefan_schmidt | For shorter test cycles I like to have a small binary which let me enter passthrough mode just after I power on the phone again. |
| 00:04.35 | stefan_schmidt | No need for kernel boot, ssh, etc. |
| 00:04.42 | stefan_schmidt | puh |
| 00:04.46 | letoto | right |
| 00:05.07 | stefan_schmidt | I just got an answer for writing the magic. |
| 00:06.28 | stefan_schmidt | OK, I have a binary. But no usb cable here to test it one my phone. |
| 00:06.48 | stefan_schmidt | Somebody likes to test unproofed arm-assembler code on his phone? :) |
| 00:10.59 | letoto | my phone isnt here yet :) |
| 00:11.05 | letoto | maybe tomorrow :) |
| 00:11.22 | stefan_schmidt | heh |
| 00:11.39 | stefan_schmidt | Tomorrow I should have my usb cable again. :) |
| 00:11.59 | letoto | what kind of usb cable is it? or does it come iwth the phone? |
| 00:12.33 | letoto | me already got the micro SD adapter :) |
| 00:12.51 | stefan_schmidt | heh |
| 00:13.01 | stefan_schmidt | I know how you're feeling. :) |
| 00:13.50 | stefan_schmidt | It was shipped with the phone. But it's a simple mini-usb cable. Problem is that i have just one of it. :) |
| 00:47.42 | stefan_schmidt | night all |
| 01:09.07 | mickeyl | good idea |
| 01:09.11 | mickeyl | g'night |
| 01:10.25 | |dion| | stefan_schmidt: still here? |
| 01:20.33 | alphaone | Cool, it's working |
| 01:22.06 | alphaone | I can load the passthrough binary via boot_usb and when I take out the battery and insert it again blob starts in passthrough mode :-) |
| 01:22.26 | alphaone | Just had to fix one thing in the assembler file |
| 01:23.35 | alphaone | LDR (load register) instead of ADR (add register) since the register isn't zero when we jump to the program |
| 01:58.34 | letoto | alphaone: cool. |
| 03:30.12 | alphaone | Good night |
| 04:01.54 | *** join/#openezx proberts (n=proberts@rrcs-64-183-51-174.west.biz.rr.com) |
| 04:03.59 | proberts | nh_work: hey :) Anything new? |
| 05:08.15 | *** join/#openezx jaebird (n=jae@53-89.netblk-69-41-89.coolaccess.net) |
| 05:24.06 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 05:56.30 | *** join/#openezx LoneStar (n=xinzhen@211.144.200.92) |
| 06:10.40 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 07:08.02 | *** join/#openezx proberts (n=proberts@67-20-86-248.vnnyca.adelphia.net) |
| 07:44.20 | *** join/#openezx proberts (n=proberts@67-20-86-248.vnnyca.adelphia.net) |
| 07:53.58 | *** join/#openezx LoneStar (n=xinzhen@211.144.200.92) |
| 08:12.36 | *** join/#openezx blkhawk[work] (n=blkhawk@IP-213157024141.dialin.heagmedianet.de) |
| 08:58.23 | *** join/#openezx blkhawk[work] (n=blkhawk@IP-213157024141.dialin.heagmedianet.de) |
| 09:05.43 | Hopscotch | good morning |
| 09:07.27 | stefan_schmidt | re |
| 09:07.30 | stefan_schmidt | hi Hopscotch |
| 09:13.19 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 09:14.03 | stefan_schmidt | hi ao2 |
| 09:14.20 | ao2 | good morning |
| 09:17.30 | ao2 | I've had a strange dream, I found the screen of my a780 irreparably cracked and i started to hunt for the guilty... |
| 09:18.17 | ao2 | hoping it's not a prophecy :) |
| 09:20.37 | stefan_schmidt | heh |
| 09:21.14 | stefan_schmidt | http://svn.openezx.org/trunk/src/passthrough-mode/ |
| 09:21.49 | stefan_schmidt | Here you can find the assembler code for entering passsthrough mode from blob. |
| 09:22.23 | stefan_schmidt | alphaone already tested it succefull on my E680. |
| 09:22.34 | stefan_schmidt | I'm interested in more feedback. |
| 09:23.37 | *** join/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 09:24.00 | ade|desk | hi all |
| 09:24.12 | stefan_schmidt | hi ade|desk |
| 09:57.23 | *** join/#openezx lkcl_work (n=c3a976e3@217.147.94.29) |
| 10:00.18 | stefan_schmidt | vmaster: Post is great. Your JTAGKey arrived today. |
| 10:00.33 | stefan_schmidt | vmaster: I will have some tests with it tomorrow. :) |
| 10:01.33 | *** join/#openezx florian_kc (n=fuchs@dns.kernelconcepts.de) |
| 10:02.06 | stefan_schmidt | wb florian_kc |
| 10:04.11 | florian_kc | good morning |
| 10:10.27 | vmaster | stefan_schmidt: wow, cool |
| 10:11.14 | vmaster | stefan_schmidt: you have to use the " 103,1 5% |
| 10:11.18 | vmaster | doh |
| 10:11.28 | vmaster | "jtagkey_prototype_v1" layout |
| 10:12.10 | vmaster | the prototype lacks one LED, and connects the reset lines a bit differently, but other than that it's similar to the final version |
| 10:12.36 | vmaster | read-back of the reset signal might be wrong, but that's not used by the OpenOCD |
| 11:09.58 | ao2 | I tried to enter pass-through mode on a780, it seems to work, but the usb id on host side didn't change |
| 11:11.12 | ao2 | ... it changed, just misread it. in flash mode the is is 22b8:6003, in pt-mode it is 22b8:3006 |
| 11:11.26 | ao2 | sorry |
| 11:12.09 | ao2 | I used boot_usb and the stefan_schmidt's assembler snippet to write to ram, very easy. |
| 11:47.02 | stefan_schmidt | ao2: Thanks for test and report. |
| 11:47.12 | stefan_schmidt | vmaster: ok |
| 11:47.52 | ao2 | now, if only i knew how to use it :) |
| 11:49.07 | stefan_schmidt | i just good some code per email which should be able to send and recieve some frames to the BP in this mode. |
| 11:49.41 | stefan_schmidt | I need to eat something first and send it out afterwards for playing. |
| 11:55.30 | Shoragan | ao2, did it switch off after some time in pass though mode? |
| 11:57.03 | ao2 | yes |
| 11:57.56 | ao2 | can this pass-through mode can be somehow dangerous for the BP ? |
| 11:58.09 | alphaone | Okay (good) news: I managed to boot a stock kernel that panics by changing the commandline in the zImage and it has the same poweroff issue |
| 12:00.19 | alphaone | The most probable locations where the power off issue is handled is in the mux_cli module which was not yet loaded or in some communication through mux_cli. |
| 12:03.01 | Shoragan | alphaone, are you sure that mux_cli was not loaded? |
| 12:04.06 | alphaone | Did anyone manage to record the communication going through /dev/muxN on the original kernel yet? |
| 12:05.15 | alphaone | Shoragan: Well I wasn't able to see the kernel panic message since the Hello Moto Splash screen but it wasn't animated so I'm pretty positive it didn't find the root fs. |
| 12:05.35 | Shoragan | ok |
| 12:06.09 | ao2 | maybe the splash screen can be disabled changing kernel cmd-line as well |
| 12:06.50 | stefan_schmidt | alphaone: sounds interesting. |
| 12:07.25 | stefan_schmidt | Perhaps we really need to have working mux_cli and send a special AT command to let BP kick the watchdog. |
| 12:07.27 | alphaone | ao2: Yeah, that would be worth a try |
| 12:07.29 | ao2 | and just for curiosity, how the cmd line of stock kernel looks like? |
| 12:08.27 | stefan_schmidt | I see three possibilities to further tests: |
| 12:08.55 | stefan_schmidt | 1. Use host with 2.4 kernel and motos mux_cli driver compiled for x86 |
| 12:09.27 | stefan_schmidt | 2. Use the hacked boot_usb which do some parts of the mux_cli communication but still not all. |
| 12:09.42 | stefan_schmidt | 3. Port Haralds mux_cli to x86. |
| 12:09.59 | stefan_schmidt | I would prefer 1 over 2 over 3. |
| 12:10.26 | alphaone | root=3e00 rootfstype=cramfs ip=off |
| 12:10.32 | stefan_schmidt | alphaone, Shoragan: What's about another hacking session tommorow? We also can test the ne JTAG. |
| 12:10.54 | alphaone | stefan_schmidt: I have THW tomorrow :-( |
| 12:10.59 | ao2 | thanks alphaone |
| 12:11.26 | stefan_schmidt | alphaone: wednesday? It's a pity. |
| 12:11.42 | ao2 | see you later |
| 12:11.43 | stefan_schmidt | Shoragan: Do you have time? |
| 12:11.47 | stefan_schmidt | cu ao2 |
| 12:11.51 | alphaone | Yeah, and Friday and most of Saturday |
| 12:12.08 | stefan_schmidt | alphaone: ok |
| 12:12.22 | alphaone | How about Sunday? |
| 12:12.46 | Shoragan | the weekend would be better for me, too |
| 12:12.46 | stefan_schmidt | alphaone: Thursday? I can kick my DoIT job this day? |
| 12:13.17 | alphaone | AM Party... |
| 12:13.26 | stefan_schmidt | No time on saturday, but perhaps I can rip off sunday. Need to talk to GF. |
| 12:13.36 | stefan_schmidt | stupid parties. :) |
| 12:13.49 | alphaone | This week really sucks from a free-time-for-hacking-perspective |
| 12:14.30 | stefan_schmidt | ok, no problem. I fetch my setup from you tomorrow and do some tests on my own until weekend. |
| 12:14.44 | alphaone | Tell me about it. We still have no one cleaning up in the morning. |
| 12:14.55 | alphaone | okay |
| 12:14.58 | stefan_schmidt | heh |
| 12:15.48 | alphaone | That means I have to spend the rest of the day useful. :-) |
| 12:19.04 | alphaone | There is another thing we could try: Get the mux_cli sources working in a self compiled 2.4 kernel on the phone. Maybe loading the module fails for some reason. |
| 12:19.32 | stefan_schmidt | alphaone: Suprise me. You can give me my phone tomorrow and say "BTW, I fixed the problem yesterday." ;) |
| 12:20.13 | alphaone | stefan_schmidt: If you can be here in 5 minutes I could show you right now ;-) |
| 12:20.19 | stefan_schmidt | Good idea. We should take this as point 0. |
| 12:20.25 | stefan_schmidt | heh |
| 12:21.16 | stefan_schmidt | alphaone: You like to test the built-in mux_cli? |
| 12:21.39 | alphaone | ? |
| 12:22.02 | alphaone | -v |
| 12:22.12 | stefan_schmidt | <alphaone> There is another thing we could try: Get the mux_cli sources working in a self compiled 2.4 kernel on the phone. Maybe loading the module fails for some reason. |
| 12:22.31 | stefan_schmidt | You like to try this, or should I do tomorrow? |
| 12:22.38 | alphaone | Yeah, I'll probably try that today. |
| 12:23.31 | stefan_schmidt | ok |
| 12:24.11 | alphaone | I got confused that by built-in you meant the kernel module built in the original motorola image |
| 12:24.59 | stefan_schmidt | ah, sorry. |
| 12:24.59 | alphaone | But you meant built-in our compiled kernel. So yes :-) |
| 12:25.08 | alphaone | np |
| 12:25.10 | stefan_schmidt | http://people.openezx.org/stefan/code/passthrough.tar.gz |
| 12:25.48 | stefan_schmidt | This is a hacked boot_usb which do a small subset of the mux_cli driver. |
| 12:26.19 | stefan_schmidt | Send to me by some kind developer. |
| 12:27.55 | alphaone | cool |
| 12:30.22 | stefan_schmidt | Just a thought. Perhpas there is also some kind of magic send by the mux_cli driver. We need to check the moto code for this. |
| 12:31.04 | alphaone | Right |
| 12:31.28 | alphaone | The program segfaults quite often.. |
| 12:32.24 | stefan_schmidt | which program? |
| 12:32.53 | alphaone | passthrough |
| 12:36.01 | stefan_schmidt | you mean the hacked boot_usb and not the assembler binary, right? |
| 12:41.31 | alphaone | yes |
| 12:43.14 | stefan_schmidt | ok |
| 12:50.07 | *** join/#openezx lkcl_work (n=c3a976e3@217.147.94.29) |
| 12:53.46 | alphaone | Thats the string I get back from the hacked boot_usb: "\371\002\a\357]U\r\n+MBAN: Copyright 2000-2002 Motorola, Inc.\r\n\324\371" |
| 12:57.20 | Shoragan | alphaone, do you send anything to the phone before receiving that string/ |
| 12:57.59 | alphaone | Yeah, the boot_usb sends some stuff |
| 12:58.09 | *** join/#openezx lkcl_work (n=c3a976e3@217.147.94.29) |
| 13:05.14 | stefan_schmidt | hmm |
| 13:06.18 | alphaone | I googled for MBAN and found this pdf: http://www.motorola.com/governmentandenterprise/contentdir/he_IL/Files/C18_AT_Commands.pdf |
| 13:06.40 | alphaone | I'm not so sure how it helps though |
| 13:07.29 | alphaone | Seems like that's usually the response to at+mode=2 |
| 13:07.49 | alphaone | (see page 251) |
| 13:08.08 | stefan_schmidt | wow357 pages |
| 13:18.08 | stefan_schmidt | wb mickeyl |
| 13:21.11 | stefan_schmidt | #ifdef USB_FOR_MUX |
| 13:21.11 | stefan_schmidt | <PROTECTED> |
| 13:21.24 | alphaone | where from? |
| 13:21.38 | stefan_schmidt | moto mu_cli driver. |
| 13:22.27 | mickeyl | thanks |
| 13:22.27 | alphaone | heh |
| 13:23.34 | stefan_schmidt | ~lart 24h DLS disconnect. |
| 13:28.44 | vmaster | hehehe |
| 13:49.01 | alphaone | cu |
| 13:50.11 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 15:12.33 | *** join/#openezx alphaone (n=alphaone@c120.apm.etc.tu-bs.de) |
| 15:51.19 | *** join/#openezx alphaone (n=daniel@sirius.lasnet.de) |
| 15:52.22 | *** join/#openezx alphaone (n=daniel@datenfreihafen.org) |
| 15:52.40 | stefan_schmidt | welcome on the bouncer alphaone :) |
| 15:52.47 | alphaone | stefan_schmidt: :-) |
| 15:59.50 | *** join/#openezx alphaone (n=daniel@datenfreihafen.org) |
| 16:08.28 | *** join/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 16:14.06 | *** join/#openezx alphaone (n=daniel@datenfreihafen.org) |
| 16:46.30 | *** join/#openezx TimRiker (n=timr@pdpc/supporter/bronze/TimRiker) |
| 16:50.07 | stefan_schmidt | hi TimRiker |
| 17:45.05 | *** join/#openezx blkhawk (i=blkhawk@pD9E06DCB.dip.t-dialin.net) |
| 18:17.41 | *** join/#openezx vmaster_ (i=vmaster@p549B6A08.dip.t-dialin.net) |
| 19:29.33 | *** join/#openezx proberts (n=proberts@rrcs-64-183-51-174.west.biz.rr.com) |
| 19:45.29 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 19:57.25 | *** join/#openezx kenws (n=ken@dslb-088-064-144-090.pools.arcor-ip.net) |
| 20:05.20 | proberts | stefan_schmidt: How's it going with the JTAG? |
| 20:06.43 | stefan_schmidt | proberts: Today the third JTAG arrived. Honestly borrowed by vmaster_. I'll try it tomorrow. |
| 20:07.55 | proberts | stafan_schmidt: Do you know where Harald got the source for mux_cli.o? (mux_client.c)... it isn't in the E2 releases from Motorola. |
| 20:10.01 | stefan_schmidt | Moto offered the code for the A780/E680 phones. It is not available for E2? hmm |
| 20:10.40 | proberts | not that I could find in either the 33P or 38P kernel releases. |
| 20:10.48 | stefan_schmidt | moment |
| 20:11.55 | stefan_schmidt | proberts: Perhaps it is directly in the kernel tree? |
| 20:12.18 | stefan_schmidt | proberts: https://opensource.motorola.com/sf/frs/do/viewRelease/projects.a780e680/frs.a780_e680_source.mux_cli_source |
| 20:12.29 | stefan_schmidt | proberts: That's the one i work with. |
| 20:14.08 | proberts | stefan_schmidt: thanks. |
| 20:14.19 | stefan_schmidt | proberts: np |
| 20:14.56 | stefan_schmidt | proberts: Looking forward to a selinux free E2 once we finished the work on A780/E680. ;) SCNR |
| 20:16.59 | proberts | I think unfortunately the only solution is going to be to flash a modded firmware update that has a modified policy file. I found a hook in the kernel module that looks like it was supposed to disable selinux, but it didn't work. I even had nh look at the code to make sure I didn't miss anything and he came to the same conclusion... |
| 20:18.19 | stefan_schmidt | proberts: hmm, I have no idea about the E2/a1200 yet. Seems I really need one of these devices. |
| 20:19.43 | proberts | The other option, and I tried this a little but I think selinux or some security measure is preventing this, is mmapping and patching the live kernel to disable the routines just enough to modify the policy file on a live install (then reboot.) I can mmap any app, but when I try it with anything reported in the kernel's memory it fails. |
| 20:21.19 | proberts | ...but for a "secure" linux, it would make sense to prevent live kmem patching |
| 20:22.39 | proberts | but both nh and I have been too chicken to try patching our E2s... for fear of bricking the device and not being able to get it repaired. |
| 20:23.07 | proberts | ...plus I need an official 33P or 38P for work. |
| 20:27.54 | stefan_schmidt | heh, I understand this. |
| 20:36.34 | nh_work | proberts: I think we should try those other kernel hooks just to see if we can interact with them... |
| 20:37.47 | nh_work | proberts: there are a couple of other ones that we can try calling to see what the current policy is. If we can't disable motoac, maybe we can change the policy for the acpolicy.cfg file. |
| 20:44.56 | nh_work | it's weird though. As far as I can tell what you wrote should have worked. |
| 20:45.29 | nh_work | It makes me wonder if the source we got isn't slightly different (like they broke that function). |
| 20:54.16 | nh_work | stefan: yeah, I periodically read those. |
| 20:54.16 | stefan_schmidt | Totaly useless in my opinion. |
| 20:54.23 | nh_work | stefan: pretty much. |
| 20:54.40 | stefan_schmidt | They should have just make the downloads available. |
| 20:55.51 | nh_work | They occasionally make vague indications that they are working internally to get motorola management on board. |
| 20:55.53 | nh_work | I'm not particularly hopeful. |
| 20:56.27 | stefan_schmidt | nh_work: That's the same Jim told me one year ago in the time I wrote emails over emails to get source code from them. |
| 20:56.30 | *** join/#openezx letoto (n=paul@tla.xelerance.com) |
| 20:56.33 | letoto | fuck tigerdirect |
| 20:56.39 | stefan_schmidt | hi letoto |
| 20:56.50 | letoto | they helt up the order cause of the address |
| 20:56.54 | letoto | now they can't get it to me before i fly |
| 20:57.01 | letoto | or I have to pay $100 to fedex it after me |
| 20:57.09 | stefan_schmidt | aargh |
| 20:57.18 | letoto | they wont ship it to me in NL |
| 20:57.26 | stefan_schmidt | ~lart tigerdirect for being not nice to letoto |
| 20:57.43 | nh_work | stefan_shmidt: Yeah. I suppose it's good that they are at least attempting to do the bare minimum to be within the terms of the GPL, but that seems to be all they are willing to do. |
| 20:58.54 | stefan_schmidt | nh_work: It fine with me if they only offer the code, nothing more. |
| 20:59.43 | stefan_schmidt | nh_work: But trying as if they were OSS friendly, without being, is bullshit. |
| 21:00.36 | nh_work | stefan: yeah. I'd even be happy if they released images for the firmware shipped on the phone. I'd be a lot less afraid to try flashing. |
| 21:01.10 | nh_work | As it is we'll have to find a way to backup our own firmware. |
| 21:01.55 | stefan_schmidt | k |
| 21:10.53 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 21:11.16 | stefan_schmidt | night all |
| 21:38.29 | letoto | you can't dd the flash over usbnet? |
| 21:40.47 | proberts | nh_work: I dl'ed the E2 38P sourcecode from the Motorola site last night. I'll check motoac tonight and see if anything is different. |
| 21:41.59 | proberts | nh_work: Not that it helps OpenEZX, but I did some RE on the libezxtapi.so and think I might be able to make a phone call :P |
| 21:45.24 | *** join/#openezx jim_rayner (n=jim_rayn@beyondvoice.plus.com) |
| 22:05.25 | *** join/#openezx ljp (n=lpotter@203.94.178.46) |
| 22:37.54 | *** join/#openezx florian (n=fuchs@87-193-10-210.ipool.celox.de) |
| 22:38.33 | florian | re |
| 22:51.15 | *** part/#openezx jim_rayner (n=jim_rayn@beyondvoice.plus.com) |
| 23:13.12 | *** join/#openezx webmind (i=webmind@feather.perl6.nl) |