Lenovo G505S hacking

From DP

(Difference between revisions)
Jump to: navigation , search
m
m (NEWS)
Line 1: Line 1:
== NEWS ==
== NEWS ==
-
'''csb_patcher.sh script is ready! GET IT HERE (15th July 2019) - https://pastebin.com/D2iJPSRv , https://privatebin.net/?4ceec51b421b38d5#CduZAcgqBZfR1DXkgB6RJ9CcTuUg3pJmCst27UtiZqyL or - a more official place - https://review.coreboot.org/c/coreboot/+/33509 . It has replaced the smaller patcher scripts, and I'll be happy if you can do a code review of it and share your feedback.'''
+
'''csb_patcher.sh script is ready! GET IT HERE (16th August 2019) - https://pastebin.com/sY4y5ZNF , https://privatebin.net/?b8017dfd3a1afadd#674PZbBZAzKDBcjemuuod75isEi4mCphKstuwQxJEg9f or - a more official place - https://review.coreboot.org/c/coreboot/+/33509 . It has replaced the smaller patcher scripts, and I'll be happy if you can do a code review of it and share your feedback.'''
Copy this '''./csbget.sh''' script to your ./coreboot/ directory, '''chmod +x ./csbget.sh''' and run it - '''./csbget.sh''' - to easily and securely download a ''(much)'' larger csb_patcher.sh script :
Copy this '''./csbget.sh''' script to your ./coreboot/ directory, '''chmod +x ./csbget.sh''' and run it - '''./csbget.sh''' - to easily and securely download a ''(much)'' larger csb_patcher.sh script :

Revision as of 07:07, 16 August 2019

Contents

NEWS

csb_patcher.sh script is ready! GET IT HERE (16th August 2019) - https://pastebin.com/sY4y5ZNF , https://privatebin.net/?b8017dfd3a1afadd#674PZbBZAzKDBcjemuuod75isEi4mCphKstuwQxJEg9f or - a more official place - https://review.coreboot.org/c/coreboot/+/33509 . It has replaced the smaller patcher scripts, and I'll be happy if you can do a code review of it and share your feedback.

Copy this ./csbget.sh script to your ./coreboot/ directory, chmod +x ./csbget.sh and run it - ./csbget.sh - to easily and securely download a (much) larger csb_patcher.sh script :

#!/bin/sh
###
### https://review.coreboot.org/c/coreboot/+/33509
### csb_patcher.sh: gets,checks,installs the coreboot and SeaBIOS patches
###
rm -f "./csb_patcher.sh"
rm -f "./4166f08.diff" && rm -f "./patch?zip"
wget "https://review.coreboot.org/changes/33509/revisions/9/patch?zip"
unzip "./patch?zip" && rm -f "./patch?zip"
sha256sum_correct="d148d90a6d76b46b4336a3452d224e1312ad4ead179b47af7fe71b4abe17dafc  ./4166f08.diff"
sha256sum_my=$(sha256sum "./4166f08.diff")
printf "\n=== sha256sum should be\n$sha256sum_correct\n"
if [ "$sha256sum_my" = "$sha256sum_correct" ] ; then
    printf "^^^ this is correct, will extract a ./csb_patcher.sh script now...\n"
    patch -p1 < "./4166f08.diff"
    chmod +x "./csb_patcher.sh"
    printf "\nRun ./csb_patcher.sh help or ./csb_patcher.sh usage for more information.\n\n"
    exit 0
else
    printf "^^^ ! MISMATCH ! Check sha256sum manually: sha256sum ./4166f08.diff\n"
    exit 1
fi
###


Run ./csb_patcher.sh help or ./csb_patcher.sh usage for more information.

csb_patcher.sh: gets,checks,installs the coreboot and SeaBIOS patches

Conveniently and securely gets, checks SHA256 and installs some of my
patches from this page - https://review.coreboot.org/q/status:open+banon
- and also gets a collection of useful floppy-based operating systems.

Sometimes it takes quite a long time to get a patch merged, while the
people might need it today! - and this script could be really helpful.

It asks a [Y/N] question for every addition, and since there are some
"universal" patches as well as great floppies, you may still want to
run this script - even if your board is not Lenovo G505S or not AMD.

Please share your feedback/suggestions and tell about other useful patches,
preferably the "universal" ones - i.e. SeaBIOS. Currently included:

1) "board-specific": G505S dGPU support, G505S config and AtomBIOS ROMs

2) "universal": SeaBIOS patches: advanced_bootmenu, multiple_floppies,
writeprotected_usb ; tint build system ; and also a floppies collection :
KolibriOS, FreeDOS, MichalOS, Snowdrop, Fiwix, Memtest, Tatos, Plop, FloppyBird.


Check out the G505S-related coreboot patches I'm currently working on here - https://review.coreboot.org/q/status:open+banon . 31448 and 31450 patches are required for getting a discrete GPU working ( together with AMD GPU AtomBIOS blobs ). If you are impatient to test them, you could grab a "16JUN2019" build here.

Introduction

Lenovo G505S is the latest most powerful laptop from the Supported Motherboards list of coreboot open source BIOS ( FAQ about coreboot ) which does not contain the Intel ME / AMD PSP hardware backdoors inside its' CPU. That makes this laptop very unique and valuable to any hardware/software hacker, and hopefully this page could be of a great interest - and maybe even useful! - to you, the visitor of DangerousPrototypes.

Current status

The firmware of this laptop is already 98% open source and free-as-in-freedom ; this page will describe the hacking efforts to liberate the remaining 2% as well as to make this laptop truly future-proof by collecting the described Lenovo G505S parts and upgrading its' various components.

Instructions

Flashing a BIOS chip and Flashing KB9012

After flashing with coreboot once, you can use the following command for the internal flashing:

sudo flashrom -p internal:laptop=force_I_want_a_brick,amd_imc_force=yes -w coreboot.rom


To successfully compile flashrom at ubuntu-like systems (e.g. Trisquel 8) you need to install the following packages:

sudo apt-get install build-essential git libpci-dev libusb-dev libusb-1.0-0-dev libftdi-dev


Please take a look at Lenovo_G505S_.config after applying the Unofficial coreboot patches.

Unofficial coreboot patches

NOTE: THEY COULD BE EASILY INSTALLED ON TOP OF A FRESHLY CLONED COREBOOT WITH A SCRIPT HERE - http://dangerousprototypes.com/docs/Lenovo_G505S_hacking#NEWS

NOTE2: THE LOWER PART OF THIS ARTICLE IS A BIT OUTDATED, WILL UPDATE A BIT LATER

Discrete GPU support

31929: G505S dGPU support: scripts for applying the unofficial (not-merged-yet) patches

These scripts will help you to securely and conveniently apply the three changes to add the discrete GPU support by patching the source code files.

Save all 4 files of this change to

./coreboot/


Allow the execution of 3 scripts by doing

chmod +x ./*_dgpu_patches.sh


then run

./get_dgpu_patches.sh


to download the patches and extract them,

./check_dgpu_patches.sh


to compare their checksums with

./sha256sums_dgpu_correct.txt
1e6dff37ae1b8080c431f25b7a12c561bd949dfa68f6487a1bece39941f74195  ./f5c1e4d.diff
f46310d570c6700fb0d4be1a1aadb98d4d464375511174648b7affc1eb0bd785  ./3457b7f.diff
5670075d9d139bb0fbc162176015695428e11060475de5f8490fdde5457543cc  ./bbe978d.diff


and finally, if everything is good,

./apply_dgpu_patches.sh


This will install the following dGPU support patches:

31357: src/mainboard/lenovo/g505s: Disable SeaBIOS options not supported by hardware

31448: src/device/pci: Add support for discrete VGA initialization and OpROM loading

31450: lenovo/g505s: Add the discrete VGA support for AMD Lenovo G505S laptop

AMD GPU AtomBIOS blobs

31944: G505S AtomBIOS ROMs: known good binaries with a script to check their SHA256

This change contains the known good AtomBIOS ROMs for your G505S, together with their SHA256 checksums and two scripts - to extract them from .rom.txt files by xxd -r and check their SHA256. NOTE: for my convenience I've just added two ROMs for my ASUS AM1I-A and A88XM-E boards to the same change; if you don't have these boards, please ignore their ROMs.

Save all 8 files of this change to

./coreboot/


Allow the execution of 2 scripts by doing

chmod +x ./*_atombios_roms.sh


then run

./extract_atombios_roms.sh


to extract the AtomBIOS ROMs from .rom.txt files using the xxd -r command,

./check_atombios_roms.sh


to compare their checksums with

./sha256sums_atombios_correct.txt
6104e6989ea3f494d7bfa30573bf38e830f1068bab9980caec5e890e0ccbfced  ./pci1002,990b.rom
6052b5def3fda2a93f6c4d55ec91b819429e212e26cdb8e0fcca54599c9c92ed  ./pci1002,6663.rom
15d74515332bc512de66e0dc910d8600aeb134bf715bbc34a4faac0257f4a0dc  ./pci1002,6665.rom
cf5ad6f562cda07c8455a5fd33aae49ee6f451561a758e9761d1788767348115  ./pci1002,9830.rom
73d52887c5c0797a00c38ff1d26528f32620efe41b47c592aa295f008712d0e5  ./pci1002,990c.rom


and, if everything is good, use these AtomBIOS ROMs at your coreboot Lenovo_G505S_.config :

*990b.rom = iGPU HD-8650G | *6663.rom = dGPU HD-8570M /
                            *6665.rom = dGPU R5-M230


Origin of these AtomBIOS ROMs, and how they have been obtained:

https://github.com/g505s-opensource-researcher/g505s-atombios

pci1002,990b.rom (for iGPU HD-8650G) has been taken from G505S with R5-M230, and despite the tiny voltage difference - it's working great for all G505S versions. See this thread for more information.

tint build system

23856: tint: introduce the new tint build system with checksum verification

Contains the tint build system - for more secure tint installation.

Unofficial SeaBIOS patches

32351: SeaBIOS patches: advanced_bootmenu, multiple_floppies, writeprotected_usb

Contains the following unofficial SeaBIOS patches:

advanced_bootmenu: up to 35 entries (2 pages if >18), numpad support (console)

|PATCH v2| ramdisk: search for all available floppy images instead of one

|PATCHv2| Support booting USB drives with a write protect switch enabled

Sample G505S .config

32352: configs: add Lenovo G505S sample configuration (use with dGPU patches)

Contains the sample Lenovo_G505S_.config - which should be used only after you have installed the Discrete GPU support patches. Read important notes about this .config here.

Useful floppies

They could be easily added to your coreboot's CBFS with one simple command:

./build/cbfstool ./build/coreboot.rom add -f ./yourfloppy.img -n floppyimg/nameinsidecbfs.lzma -t raw -c lzma


1) KolibriOS - great x86 OS with GUI and lots of really useful apps! After the networking driver for our chip will be completed, it should become possible to access the Internet and IRC chaaat with your friends right from a BIOS chip.

2) FreeDOS - also lots of cool apps, although many of them are proprietary and also FreeDOS might be vulnerable to DOS viruses. Their floppy seems to be only for installation and does not contain anything useful, but it should be possible to replace the installer in it with more useful stuff and extend the floppy from 1.44MB to 2.88MB - which is also supported by SeaBIOS - if needed. Luckily LZMA compression will reduce its' size significantly, allowing to still put more useful floppies instead of just FreeDOS.

3) MichalOS - really interesting OS based on MikeOS but significantly evolved, has many cool things like PLAYER.APP --> two octave piano which is using a beeper, and great for showing off to your IRL friends what your opensource BIOS can do. Currently MichalOS is much better than its' brother TachyonOS, but maybe something could be borrowed from there as well.

4) Snowdrop - very promising OS, has some cool games and could be useful to develop something bigger on top of it.

5) Fiwix - quite a prominent project and also may be useful.

6) Memtest - for testing your RAM, and much better than coreboot's poor version. A bit more work is required for it - e.g. you'd need to extend its' image to 1.44MB - so here are the instructions

7) TatOS - sadly abandoned, tried contacting the author but he is not replying. Not fully explored yet but may be quite useful for research purposes and occupies just about 100KB in your CBFS when LZMA compressed.

8) Plop Boot Manager 5.0 - prominent boot manager that is still proprietary, but may be possible to persuade its' author to release the source code.

9) FloppyBird OS - provides a FloppyBird game and occupies just ~2K bytes inside a flash chip when LZMA compressed.

Improve this page

Fill this page with a lot of truly valuable information. For example:

maybe copy some info from Coreboot G505s page and other sources like coreboot subreddit or 4chan.

TODO list

1) Sleep mode does not work under Qubes. See https://www.mail-archive.com/qubes-users@googlegroups.com/msg27687.html.

2) Both XHCI options in Coreboot menu should be disabled (unless you'd like to add the XHCI firmware) or the left side ports won't work at all. These options are already disabled by default and all the ports are functioning as USB 2.0.

awokd tells:

"You may have to use irqpoll in sys-usb kernel options with Qubes OS. USB interrupts don't seem to be routing correctly in Coreboot, and the only way to use them in Qubes is with irqpoll in the kernel options."


3) A10-5750M processor is cpu fam 21/0x15, mod 19/0x13, step 1 raw 00610f31

^^ Maybe post the full cat /proc/cpuinfo here?

4) If your model has a secondary GPU and you are NOT using the discrete GPU support patches, then you need to add

xen-pciback.hide=(02:00.0)


to boot options (02:00.0 is an example, check first!). xen-pciback.hide hides the secondary GPU from Qubes so it doesn't even attempt to initialize it.

5) If reverse engineering an OEM image, you can locate the firmware by using UEFITool and searching for your BIOS version in reverse byte order, like for version 0x06001119, search for 0x19110006.