META Quest 3S (panther)
Appearance
This device is still running on aarch64, although it supports -. If you own it, change it and test it that way. |
pmOS can't run on its internal storage. |
This page is about the dedicated port of this device. There is also an optional generic port available for this device - see Generic MSM8650 (qcom-msm8650). |
This device is unsupported by postmarketOS (most likely due to its architecture being unsupported, or limited system resources).
Reason: Pending extracting keys from qfprom, root obtained |
Manufacturer | META |
---|---|
Name | Quest 3S |
Codename | panther |
Released | 2024 |
Type | headset |
Hardware | |
Chipset | Qualcomm Snapdragon XR2 Gen 2 (SM8650) |
CPU |
Octa-core (1x2.84 GHz Cortex-A77 3x2.42 GHz Cortex-A77 4x1.80 GHz Cortex-A55) |
GPU | Adreno 650 |
Display | 3200x1600 (1600x1600 per eye) |
Storage | 128 GB UFS 3.1 |
Memory | 6 GB LPDDR5 Quad-channel 16-bit (64-bit) |
Architecture | aarch64 |
Write-Protect type | qfprom |
Software | |
Original software The software and version the device was shipped with. |
Horizon OS ? |
Extended version The most recent supported version from the manufacturer. |
Horizon OS |
FOSS bootloader | no |
postmarketOS | |
Pre-built images Whether pre-built images are available here. |
no |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
no |
pmOS kernel The kernel version that runs on the device's port. |
pending |
Unixbench score Unixbench Whetstone/Dhrystone score. See Unixbench. |
pending |
Optional Generic Port | Generic MSM8650 (qcom-msm8650) |
This device is under active development by FreeXR Task Force to port into postmarketos and the linux mainline |
Contributors
- FreeXR Task Force
- BreakXR Task Force
- KREYREN
Users owning this device
- Kreyren (Notes: Active Development, disabled updates since firmware v72)
HELP WANTED
The FreeXR Project was able to abuse known vulnerability to obtain root on the device. To enable development we need to extract the secure boot keys from the QFPROM.
Review:
- https://docs.qualcomm.com/bundle/publicresource/topics/80-70018-11/appendix-fuse-configurations.html
- https://lwn.net/Articles/939078
TLDR: There is a memory inside of the SoC which write trace is e-fused. Once the secure boot keys are loaded the e-fuse is burned so that none can rewrite the keys and the device is using these keys to verify boot.
Previous successful exploit on META Quest 2 (hollywood) by NeatMonster and adc: https://github.com/QuestEscape/research
I am not sharing the root method, but willing to run code to try to extract the keys. - Kreyren (talk)