Jump to content

META Quest 3S (panther)

From postmarketOS Wiki
Note This device is still running on aarch64, although it supports -. If you own it, change it and test it that way.
Note pmOS can't run on its internal storage.
Note This page is about the dedicated port of this device. There is also an optional generic port available for this device - see Generic MSM8650 (qcom-msm8650).
META Quest 3S
Manufacturer META
Name Quest 3S
Codename panther
Released 2024
Type headset
Hardware
Chipset Qualcomm Snapdragon XR2 Gen 2 (SM8650)
CPU Octa-core (1x2.84 GHz Cortex-A77
3x2.42 GHz Cortex-A77
4x1.80 GHz Cortex-A55)
GPU Adreno 650
Display 3200x1600 (1600x1600 per eye)
Storage 128 GB UFS 3.1
Memory 6 GB LPDDR5 Quad-channel 16-bit (64-bit)
Architecture aarch64
Write-Protect type qfprom
Software
Original software
The software and version the device was shipped with.
Horizon OS ?
Extended version
The most recent supported version from the manufacturer.
Horizon OS
FOSS bootloader no
postmarketOS
Pre-built images
Whether pre-built images are available here.
no
Mainline
Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.
no
pmOS kernel
The kernel version that runs on the device's port.
pending
Unixbench score
Unixbench Whetstone/Dhrystone score. See Unixbench.
pending
Optional Generic Port Generic MSM8650 (qcom-msm8650)
Note This device is under active development by FreeXR Task Force to port into postmarketos and the linux mainline

Contributors

  • FreeXR Task Force
  • BreakXR Task Force
  • KREYREN

Users owning this device

  • Kreyren (Notes: Active Development, disabled updates since firmware v72)


HELP WANTED

The FreeXR Project was able to abuse known vulnerability to obtain root on the device. To enable development we need to extract the secure boot keys from the QFPROM.

Review:

TLDR: There is a memory inside of the SoC which write trace is e-fused. Once the secure boot keys are loaded the e-fuse is burned so that none can rewrite the keys and the device is using these keys to verify boot.

Previous successful exploit on META Quest 2 (hollywood) by NeatMonster and adc: https://github.com/QuestEscape/research

I am not sharing the root method, but willing to run code to try to extract the keys. - Kreyren (talk)