S912 limited to 1200 MHz with multithreaded loads


#61

the offsets in the bl30 ELF generator seem off though, as it appears the beginning of bl30.bin is an interrupt vectors table and not assembler code.

as we see here and here, and with this raw objdump command:

dd if=bl30.bin bs=440 skip=1 of=bl30-text.bin
arm-none-eabi-objdump -b binary -marm --prefix-addresses -EL -M force-thumb -D -C bl30-text.bin

we see that the output closely matches init.S from chromiumOS’s EC code:

Disassembly of section .data:
0x00000000 mov.w        r0, #0
0x00000004 msr  CONTROL, r0
0x00000008 isb  sy
0x0000000c ldr  r1, [pc, #60]   ; (0x0000004c)
0x0000000e ldr  r2, [pc, #64]   ; (0x00000050)
0x00000010 str  r1, [r2, #0]
0x00000012 mov.w        r0, #0
0x00000016 ldr  r1, [pc, #28]   ; (0x00000034)
0x00000018 ldr  r2, [pc, #28]   ; (0x00000038)
0x0000001a cmp  r1, r2
0x0000001c it   lt
0x0000001e strlt.w      r0, [r1], #4
0x00000022 blt.n        0x0000001a
0x00000024 ldr  r0, [pc, #44]   ; (0x00000054)
0x00000026 mov  sp, r0
0x00000028 bl   0x00005738
0x0000002c b.n  0x0000002c
0x0000002e b.w  0x00000158
0x00000032 nop

so with a little bit of adaptation, it can be made exploitable as an ELF file (maybe by taking chromium-ec’s linker file as well)


#62

also for reference: ARM’s Cortex-M3 documentation


#63

looks like I wasn’t the first one to think about all this: the author of bl30-elf did too


#64

You finished getting us faster clocks yet? :stuck_out_tongue:

Great stuff @g4b42


#65

not yet, I can’t get my hands on that c2_freq_patch_0902.zip file, it seems to have been removed from the odroid forum, and the bl30.bin blob that was pushed to hardkernel’s u-boot git tree seems to have more changes than the few bytes @cyrozap talked about, so I can’t easily find them in the S912 binary…


#66

I’m gonna need that one too: c2_1.6MHz_freq_patch.zip


#67

Did you try these versions?:



#68

I want to avoid versions with changes unrelated to the max freq settings.

also, it appears the binary varies a lot depending on who at amlogic compiled it, probably due to different gcc versions, making comparison more difficult.

if nothing comes out of the hardkernel thread, I’ll resort to full-scale reverse engineering using radare2 and/or retdec and/or snowman decompiler… (good occasion to learn how to properly use these powerful tools)


#69

There is a fresh version of the ZIP files in the Odroid forums: https://forum.odroid.com/viewtopic.php?f=141&t=23044&p=223198#p223198

Also, there are some interesting remarks from the same author, in the linux-amlogic mailing lists: https://lists.infradead.org/pipermail/linux-amlogic/2017-May/003823.html


#70

excellent! thanks a lot


#71

Yup have @Khadas any updates on this? This is gnucash starting on my VIM2 - allocated to CPU5 running 100% CPU but at 1000MHz!