Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
The Surface RT UEFI consists multi phases. Some issues are outlined below.
The CPU gets out of reset in Secure Mode. SEC phase kicks in, does fundamental setup and enter TrustZone. TrustZone memory occupies the lower memory (32MB).
In stock firmware, TZ MVBAR address is 0x811f8000 on RT for primary core (Boot Processor.)
For secondary CPUs, the MVBAR is:
Core 1 MVBAR 0x82002860
Core 2 MVBAR 0x82003860
Core 3 MVBAR 0x82004860
MVBAR only has valid SMC instruction entry, other exception entries are unused.
There's an issue in TZ's UEFI variable handling. A working exploit can be found at https://github.com/NekomimiRouter/yahallo.
Extends DSDT.
Surface RT has 2 SSDT tables.
SSDT0000.bin contains the hardware description (very interesting) SSDT0001.bin contains only TPM stuff. (uninteresting at the moment)
Most of the ACPI tables can be decompiled by iASL (Intel ASL compiler).
But SSDT0000.bin can not be decompiled by iASL.
We have to use MS-ASL compiler. (MS ASL is not as strict as iASL which leads to issues with Linux)
https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compiler
use asl.exe /u /e /ResDecode SSDT0000.bin
Decompiled output below:
There is a way to compile the SSDT0000.ASL with iasl, without getting a lot of errors about external symbols. Just put the file next to the other acpi tables (don't decompile them), and it shouldn't give errors about missing external symbols. There are 4 syntax errors, currently there are no fixes available.
WorkInProgress
Search for I2CSerialBus
should reveal all i2c devices.
I2C1 0x00 - tCover
I2C1 0x28 - SEN1 / SNMU
I2C1 0x50 - GFXC??
I2C2 0x0C - SARA
I2C2 0x2D - TEV2 - cypress
I2C2 0x39 - TIC2
I2C2 0x5B - TOUA -atmel
I2C3 0x10 - GFXC
I2C3 0x72 - GFXC
I2C4 0x30 - GFXC - EDID
I2C4 0x3A - GFXC - EDID
I2C4 0x3B - GFXC - EDID
I2C4 0x50 - GFXC - EDID
I2C5 0x0A - TRO1 - battery?
I2C5 0x0C - SARA / TIC1
I2C5 0x1A - AUDI - wolfson
I2C5 0x2D - Power resource / PMUD / TR3_(RTC) - PMIC
I2C5 0x4C - THEM / TI2C
I2C5 0x60 - PMUD - PMIC2
PRS1
PD7 - ESD1
PRCN - PMIC(I2C5)
LDO5 - SD Regulator 1V8-3V3
PRMU
PD7 - ESD1
PRTU
PD1- ESD1
PD2 - ESD2
PRI5
PRTC
GFXC: PR6 LDO1 PR7 LDO2 PBB4 E1V8
These tables aren't needed yet since we deal with basic hardware stuff at the moment
Surface RT ACPI Tables.
APIC - Advanced Programmable Interrupt Controller
BGRT - Boot Graphics Resource Table
DBG2 - Debug Port Table 2
CSRT - Core System Resource Table
DSDT - Differentiated System Description Table
FACP - Fixed ACPI Description Table
FPDT - Firmware Performance Data Table
MSDM - Microsoft Data Management table
RSDP - Root System Description Pointer
SSDT - Secondary System Description Table
TPM2 - Trusted Platform Module 2.0
WDSA - Windows Specific Table. Contains tCover information
XSDT - Extended System Description Table Fields
You need to be able to run unsigned EFI apps. get ShellBinPkg.zip from https://github.com/tianocore/edk2/releases/tag/edk2-stable201911 And use the startup script below. Dumped tables should be in the dump folder
To decompile ACPI on Linux you would normally use IASL. But all Tables are compiled with the Microsoft ASL compiler. Since MS_ASL isn't as strict as IASL, IASL detects some errors and won't decompile all tables.
https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compiler
You can't decompile RSDP0000.bin but it only contains 2 Pointers
The Multiple APIC (Advanced Programmable Interrupt Controller) Description Table
This table is used for the ACPI Parking Protocol. It is a protocol that allows parked CPU cores to be unparked. The parked state doesn't allow the CPU cores to execute any code, they are "disabled".
The document that describes the ACPI Parking Protocol is here: Multi-processor Startup for ARM Platforms
The grate-driver/linux GitHub repository contains a working arm32 version of the ACPI Parking Protocol (Link points to the source file). It allows the usage of SMP on the Surface RT and on other arm32 Windows RT devices. (When you boot Linux from UEFI; not used in APX mode).
The following table describes the MADT entries of the 4 CPU cores. The ACPI Parking Protocol only requires to unpark CPU1-3, as CPU0 is already in use.
The MADT table has an entry about the Generic Interrupt Distributor. Here are the contents:
CPU0
CPU1
CPU2
CPU3
Subtable Type
(0B = Generic Interrupt Controller)
0x0B
0x0B
0x0B
0x0B
Subtable Length
0x28
0x28
0x28
0x28
Reserved
0x0
0x0
0x0
0x0
CPU Interface Number
0x0
0x1
0x2
0x3
Processor UID
0x0
0x1
0x2
0x3
Processor Enabled
True (1)
True (1)
True (1)
True (1)
Performance Interrupt Trigger Mode
False (0)
False (0)
False (0)
False (0)
Virtual GIC Interrupt Trigger Mode
False (0)
False (0)
False (0)
False (0)
Parking Protocol Version
1.0
1.0
1.0
1.0
Performance Interrupt
B0
B1
B2
B3
Parked Address
0x82001000
0x82002000
0x82003000
0x82004000
Base Address
0x0
0x0
0x0
0x0
Generic Interrupt Distributor
Subtable Type
(0C = Generic Interrupt Distributor)
0x0C
Length
0x18
Reserved
0x0
Local GIC Hardware ID
0x0
Base Address
0x50041000
Interrupt Base
0x0
Version
0.0
Reserved (x2)
0x0
We will use a pre-patched GRUB from https://github.com/coherixmatts/grub-2.04 as this will work out of the box on both the SurfaceRT and SurfaceRT2
You will need to have installed the compiler tools and libraries noted in Cross Compiling We recommend using a small Debian or Ubuntu machine or similar for development. A Raspberry PI4 is quite a good option.
git clone https://github.com/coherixmatts/grub-2.04
cd grub-2.04
./bootstrap
./configure --with-platform=efi --target=arm-linux-gnueabihf --enable-mm-debug --enable-boot-time
Grub should compile successfully and you should see something similar to the results below:
*******************************************************
GRUB2 will be compiled with following components:
Platform: arm-efi
With devmapper support: Yes
With memory debugging: Yes
With disk cache statistics: No
With boot time statistics: Yes
efiemu runtime: No (not available on efi)
grub-mkfont: Yes
grub-mount: Yes
starfield theme: Yes
With DejaVuSans font from /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
With libzfs support: No (need zfs library)
Build-time grub-mkfont: Yes
With unifont from /usr/share/fonts/X11/misc/unifont.pcf.gz
With liblzma from -llzma (support for XZ-compressed mips images)
*******************************************************
We now need to compile grub as below:
make
cd grub-core
../grub-mkimage -O arm-efi -d . -o grub.efi -p / part_gpt part_msdos ntfs ntfscomp hfsplus fat ext2 normal chain boot configfile linux gfxterm videoinfo efi_gop all_video video video_fb loadenv help reboot raid6rec raid5rec mdraid1x mdraid09 lvm diskfilter zfsinfo zfscrypt gcry_rijndael gcry_sha1 zfs true test sleep search search_fs_uuid search_fs_file search_label png password_pbkdf2 gcry_sha512 pbkdf2 part_apple minicmd memdisk lsacpi lssal lsefisystab lsefimmap lsefi disk keystatus jpeg iso9660 halt gfxterm_background gfxmenu trig bitmap_scale video_colors bitmap font fshelp efifwsetup echo terminal gettext efinet net priority_queue datetime bufio cat btrfs gzio lzopio crypto acpi extcmd mmap
The compiled grub.efi should now be in the current directory. Rename that file to boot.efi and copy to the root of a prepared USB for testing. A pre-compiled GRUB2 that will work on SurfaceRT and SurfaceRT2 is below:
Pinmux dump taken from UEFI boot
The extraction of these tables was done with UEFI shell. Because there is no display output on the sRT unless you patch the GOP we used a startup script. You can download these files in zip below.
You can get information about the commands used here: https://www.uefi.org/sites/default/files/resources/UEFI_Shell_2_2.pdf (Chapter 5)
lsefimmap
on SurfaceRT
Good reading - https://people.kernel.org/linusw/how-the-arm32-kernel-starts
DSDT (Differentiated System Description Table) is a part of the ACPI specification. It supplies information about supported power events in a given system.
Ours are compiled with the Microsoft compiler. RT location: Address : 0xFD8E0000 Length : 9361 (NCIDIA AP30EDK2)
You can compare an DSDT table to a dtsi devicetree file.
Contains information about tCover and gets loaded when the tCover detect Interrupt triggers. Tables gets unloaded if tCover gets disconnected